feat(proxy): 实现代理节点批量升级回滚、隧道重定向跟随及远程配置管理

核心功能： - 新增代理节点批量升级回滚工作流，支持分批升级、健康探针、跳过/重试/取消等操作 - proxy 隧道流处理器支持 HTTP 重定向跟随（最多 10 跳），区分 307/308 可重播与不可重播请求体 - proxy 协议新增 follow_redirects / http1_only 字段，网关侧同步支持 - 新增代理节点远端配置变更接口（名称、允许端口、调度状态、升级目标等） - 新增代理节点注册/反注册/心跳的 Admin API，及节点过期清理维护任务 - gateway 隧道 owner-relay 支持流式代理大请求体，新增 5 MiB 默认限制 - 新增 ProxyNodeRegistrationMutation / ProxyNodeRemoteConfigMutation 数据类型 - proxy 配置新增重定向重播预算、心跳间隔等参数，TUI 安装向导同步更新 - 前端 ProxyNodes 页面新增批量升级操作面板及滚动进度展示
2026-10-09 02:47:45 +08:00 · 2026-04-12 16:02:38 +08:00
parent 7c5bb7f383
commit 9703840a36
83 changed files with 11832 additions and 1520 deletions
@@ -126,6 +126,7 @@ pub(super) async fn execute_admin_provider_oauth_batch_import(
            state,
            template,
            entry.refresh_token.as_str(),
+            proxy_node_id,
        )
        .await
        {
@@ -1,6 +1,5 @@
 use super::parse::{AdminProviderOAuthBatchImportEntry, AdminProviderOAuthBatchImportOutcome};
 use crate::handlers::admin::provider::oauth::duplicates::find_duplicate_provider_oauth_key;
-use crate::handlers::admin::provider::oauth::errors::build_internal_control_error_response;
 use crate::handlers::admin::provider::oauth::provisioning::{
    create_provider_oauth_catalog_key, provider_oauth_active_api_formats,
    provider_oauth_key_proxy_value, update_existing_provider_oauth_catalog_key,
@@ -8,9 +7,8 @@ use crate::handlers::admin::provider::oauth::provisioning::{
 use crate::handlers::admin::provider::oauth::runtime::refresh_provider_oauth_account_state_after_update;
 use crate::handlers::admin::provider::oauth::state::decode_jwt_claims;
 use crate::handlers::admin::provider::shared::support::ADMIN_PROVIDER_OAUTH_DATA_UNAVAILABLE_DETAIL;
-use crate::handlers::admin::request::{
-    AdminAppState, AdminKiroAuthConfig, AdminKiroOAuthRefreshAdapter,
-};
+use crate::handlers::admin::request::{AdminAppState, AdminKiroAuthConfig};
+use crate::provider_transport::kiro::generate_machine_id;
 use crate::GatewayError;
 use aether_admin::provider::oauth::{
    build_kiro_batch_import_key_name, coerce_admin_provider_oauth_import_str,
@@ -20,6 +18,9 @@ use serde_json::{json, Map, Value};
 use std::collections::BTreeSet;
 use std::time::{SystemTime, UNIX_EPOCH};

+const KIRO_IDC_AMZ_USER_AGENT: &str =
+    "aws-sdk-js/3.738.0 ua/2.1 os/other lang/js md/browser#unknown_unknown api/sso-oidc#3.738.0 m/E KiroIDE";
+
 fn admin_provider_oauth_kiro_refresh_base_url_override(
    state: &AdminAppState<'_>,
    override_key: &str,
@@ -29,6 +30,293 @@ fn admin_provider_oauth_kiro_refresh_base_url_override(
    (!normalized.is_empty()).then(|| normalized.to_string())
 }

+fn admin_provider_oauth_kiro_build_refresh_url(
+    auth_config: &AdminKiroAuthConfig,
+    override_base_url: Option<&str>,
+    path: &str,
+    default_host: impl FnOnce(&str) -> String,
+) -> String {
+    if let Some(base_url) = override_base_url
+        .map(str::trim)
+        .filter(|value| !value.is_empty())
+    {
+        return format!("{}/{}", base_url.trim_end_matches('/'), path);
+    }
+    let region = auth_config.effective_auth_region();
+    default_host(region)
+}
+
+fn admin_provider_oauth_kiro_effective_host(url: &str, fallback_host: String) -> String {
+    reqwest::Url::parse(url)
+        .ok()
+        .and_then(|value| value.host_str().map(ToOwned::to_owned))
+        .unwrap_or(fallback_host)
+}
+
+fn admin_provider_oauth_kiro_ide_tag(kiro_version: &str, machine_id: &str) -> String {
+    if machine_id.trim().is_empty() {
+        format!("KiroIDE-{kiro_version}")
+    } else {
+        format!("KiroIDE-{kiro_version}-{machine_id}")
+    }
+}
+
+fn admin_provider_oauth_kiro_refresh_expires_at(payload: &Value) -> u64 {
+    let expires_in = payload
+        .get("expiresIn")
+        .and_then(|value| {
+            value
+                .as_u64()
+                .or_else(|| value.as_str()?.parse::<u64>().ok())
+        })
+        .unwrap_or(3600);
+    SystemTime::now()
+        .duration_since(UNIX_EPOCH)
+        .ok()
+        .map(|value| value.as_secs())
+        .unwrap_or_default()
+        .saturating_add(expires_in)
+}
+
+fn admin_provider_oauth_kiro_refresh_response_json(
+    body_text: &str,
+    json_body: Option<Value>,
+) -> Result<Value, String> {
+    json_body
+        .or_else(|| serde_json::from_str::<Value>(body_text).ok())
+        .ok_or_else(|| "refresh 接口返回了非 JSON 响应".to_string())
+}
+
+fn admin_provider_oauth_kiro_refresh_error_detail(
+    status: http::StatusCode,
+    body_text: &str,
+) -> String {
+    let detail = body_text.trim();
+    if detail.is_empty() {
+        format!("HTTP {}", status.as_u16())
+    } else {
+        detail.to_string()
+    }
+}
+
+async fn refresh_admin_provider_oauth_kiro_auth_config(
+    state: &AdminAppState<'_>,
+    auth_config: &AdminKiroAuthConfig,
+    proxy_node_id: Option<&str>,
+    social_refresh_base_url: Option<&str>,
+    idc_refresh_base_url: Option<&str>,
+) -> Result<AdminKiroAuthConfig, String> {
+    if auth_config.is_idc_auth() {
+        let fallback_host = format!("oidc.{}.amazonaws.com", auth_config.effective_auth_region());
+        let url = admin_provider_oauth_kiro_build_refresh_url(
+            auth_config,
+            idc_refresh_base_url,
+            "token",
+            |region| format!("https://oidc.{region}.amazonaws.com/token"),
+        );
+        let host = admin_provider_oauth_kiro_effective_host(&url, fallback_host);
+        let headers = reqwest::header::HeaderMap::from_iter([
+            (
+                reqwest::header::CONTENT_TYPE,
+                reqwest::header::HeaderValue::from_static("application/json"),
+            ),
+            (
+                reqwest::header::HOST,
+                reqwest::header::HeaderValue::from_str(&host)
+                    .map_err(|_| "IDC host 无效".to_string())?,
+            ),
+            (
+                reqwest::header::HeaderName::from_static("x-amz-user-agent"),
+                reqwest::header::HeaderValue::from_static(KIRO_IDC_AMZ_USER_AGENT),
+            ),
+            (
+                reqwest::header::USER_AGENT,
+                reqwest::header::HeaderValue::from_static("node"),
+            ),
+            (
+                reqwest::header::ACCEPT,
+                reqwest::header::HeaderValue::from_static("*/*"),
+            ),
+        ]);
+        let response = state
+            .execute_admin_provider_oauth_http_request(
+                "kiro_batch_refresh:idc",
+                reqwest::Method::POST,
+                &url,
+                &headers,
+                Some("application/json"),
+                Some(json!({
+                    "clientId": auth_config
+                        .client_id
+                        .as_deref()
+                        .map(str::trim)
+                        .unwrap_or_default(),
+                    "clientSecret": auth_config
+                        .client_secret
+                        .as_deref()
+                        .map(str::trim)
+                        .unwrap_or_default(),
+                    "refreshToken": auth_config
+                        .refresh_token
+                        .as_deref()
+                        .map(str::trim)
+                        .unwrap_or_default(),
+                    "grantType": "refresh_token",
+                })),
+                None,
+                proxy_node_id,
+            )
+            .await
+            .map_err(|err| format!("IDC refresh 请求失败: {err}"))?;
+        if !response.status.is_success() {
+            return Err(format!(
+                "IDC refresh 失败: {}",
+                admin_provider_oauth_kiro_refresh_error_detail(
+                    response.status,
+                    &response.body_text
+                )
+            ));
+        }
+        let payload = admin_provider_oauth_kiro_refresh_response_json(
+            &response.body_text,
+            response.json_body,
+        )?;
+        let access_token = payload
+            .get("accessToken")
+            .and_then(Value::as_str)
+            .map(str::trim)
+            .filter(|value| !value.is_empty())
+            .ok_or_else(|| "IDC refresh 返回了空 accessToken".to_string())?;
+
+        let mut refreshed = auth_config.clone();
+        refreshed.access_token = Some(access_token.to_string());
+        refreshed.expires_at = Some(admin_provider_oauth_kiro_refresh_expires_at(&payload));
+        if refreshed
+            .machine_id
+            .as_deref()
+            .map(str::trim)
+            .is_none_or(|value| value.is_empty())
+        {
+            refreshed.machine_id = generate_machine_id(auth_config, None);
+        }
+        if let Some(refresh_token) = payload
+            .get("refreshToken")
+            .and_then(Value::as_str)
+            .map(str::trim)
+            .filter(|value| !value.is_empty())
+        {
+            refreshed.refresh_token = Some(refresh_token.to_string());
+        }
+        return Ok(refreshed);
+    }
+
+    let machine_id = generate_machine_id(auth_config, None)
+        .ok_or_else(|| "缺少 machine_id 种子，无法刷新 social token".to_string())?;
+    let fallback_host = format!(
+        "prod.{}.auth.desktop.kiro.dev",
+        auth_config.effective_auth_region()
+    );
+    let url = admin_provider_oauth_kiro_build_refresh_url(
+        auth_config,
+        social_refresh_base_url,
+        "refreshToken",
+        |region| format!("https://prod.{region}.auth.desktop.kiro.dev/refreshToken"),
+    );
+    let host = admin_provider_oauth_kiro_effective_host(&url, fallback_host);
+    let user_agent =
+        admin_provider_oauth_kiro_ide_tag(auth_config.effective_kiro_version(), &machine_id);
+    let headers = reqwest::header::HeaderMap::from_iter([
+        (
+            reqwest::header::USER_AGENT,
+            reqwest::header::HeaderValue::from_str(&user_agent)
+                .map_err(|_| "Kiro User-Agent 无效".to_string())?,
+        ),
+        (
+            reqwest::header::HOST,
+            reqwest::header::HeaderValue::from_str(&host)
+                .map_err(|_| "Kiro host 无效".to_string())?,
+        ),
+        (
+            reqwest::header::ACCEPT,
+            reqwest::header::HeaderValue::from_static("application/json, text/plain, */*"),
+        ),
+        (
+            reqwest::header::CONTENT_TYPE,
+            reqwest::header::HeaderValue::from_static("application/json"),
+        ),
+        (
+            reqwest::header::CONNECTION,
+            reqwest::header::HeaderValue::from_static("close"),
+        ),
+        (
+            reqwest::header::ACCEPT_ENCODING,
+            reqwest::header::HeaderValue::from_static("gzip, compress, deflate, br"),
+        ),
+    ]);
+    let response = state
+        .execute_admin_provider_oauth_http_request(
+            "kiro_batch_refresh:social",
+            reqwest::Method::POST,
+            &url,
+            &headers,
+            Some("application/json"),
+            Some(json!({
+                "refreshToken": auth_config
+                    .refresh_token
+                    .as_deref()
+                    .map(str::trim)
+                    .unwrap_or_default(),
+            })),
+            None,
+            proxy_node_id,
+        )
+        .await
+        .map_err(|err| format!("social refresh 请求失败: {err}"))?;
+    if !response.status.is_success() {
+        return Err(format!(
+            "social refresh 失败: {}",
+            admin_provider_oauth_kiro_refresh_error_detail(response.status, &response.body_text)
+        ));
+    }
+    let payload =
+        admin_provider_oauth_kiro_refresh_response_json(&response.body_text, response.json_body)?;
+    let access_token = payload
+        .get("accessToken")
+        .and_then(Value::as_str)
+        .map(str::trim)
+        .filter(|value| !value.is_empty())
+        .ok_or_else(|| "social refresh 返回了空 accessToken".to_string())?;
+
+    let mut refreshed = auth_config.clone();
+    refreshed.access_token = Some(access_token.to_string());
+    refreshed.expires_at = Some(admin_provider_oauth_kiro_refresh_expires_at(&payload));
+    if refreshed
+        .machine_id
+        .as_deref()
+        .map(str::trim)
+        .is_none_or(|value| value.is_empty())
+    {
+        refreshed.machine_id = Some(machine_id);
+    }
+    if let Some(refresh_token) = payload
+        .get("refreshToken")
+        .and_then(Value::as_str)
+        .map(str::trim)
+        .filter(|value| !value.is_empty())
+    {
+        refreshed.refresh_token = Some(refresh_token.to_string());
+    }
+    if let Some(profile_arn) = payload
+        .get("profileArn")
+        .and_then(Value::as_str)
+        .map(str::trim)
+        .filter(|value| !value.is_empty())
+    {
+        refreshed.profile_arn = Some(profile_arn.to_string());
+    }
+    Ok(refreshed)
+}
+
 pub(super) async fn execute_admin_provider_oauth_kiro_batch_import(
    state: &AdminAppState<'_>,
    provider_id: &str,
@@ -65,10 +353,10 @@ pub(super) async fn execute_admin_provider_oauth_kiro_batch_import(
        .list_provider_catalog_endpoints_by_provider_ids(&[provider_id.to_string()])
        .await?;
    let key_proxy = provider_oauth_key_proxy_value(proxy_node_id);
-    let adapter = AdminKiroOAuthRefreshAdapter::default().with_refresh_base_urls(
-        admin_provider_oauth_kiro_refresh_base_url_override(state, "kiro_social_refresh"),
-        admin_provider_oauth_kiro_refresh_base_url_override(state, "kiro_idc_refresh"),
-    );
+    let social_refresh_base_url =
+        admin_provider_oauth_kiro_refresh_base_url_override(state, "kiro_social_refresh");
+    let idc_refresh_base_url =
+        admin_provider_oauth_kiro_refresh_base_url_override(state, "kiro_idc_refresh");
    let mut results = Vec::with_capacity(entries.len());
    let mut success = 0usize;
    let mut failed = 0usize;
@@ -101,9 +389,14 @@ pub(super) async fn execute_admin_provider_oauth_kiro_batch_import(
            continue;
        }

-        refreshed_auth_config = match adapter
-            .refresh_auth_config(state.http_client(), &refreshed_auth_config)
-            .await
+        refreshed_auth_config = match refresh_admin_provider_oauth_kiro_auth_config(
+            state,
+            &refreshed_auth_config,
+            proxy_node_id,
+            social_refresh_base_url.as_deref(),
+            idc_refresh_base_url.as_deref(),
+        )
+        .await
        {
            Ok(config) => config,
            Err(err) => {
@@ -111,7 +404,7 @@ pub(super) async fn execute_admin_provider_oauth_kiro_batch_import(
                results.push(json!({
                    "index": index,
                    "status": "error",
-                    "error": format!("Token 验证失败: {err:?}"),
+                    "error": format!("Token 验证失败: {err}"),
                    "replaced": false,
                }));
                continue;
@@ -130,6 +130,7 @@ pub(super) async fn handle_admin_provider_oauth_complete_key(
            &callback.code,
            &callback.state_nonce,
            state_data.pkce_verifier.as_deref(),
+            payload.proxy_node_id.as_deref(),
        )
        .await
    {
@@ -121,6 +121,7 @@ pub(super) async fn handle_admin_provider_oauth_complete_provider(
            &callback.code,
            &callback.state_nonce,
            state_data.pkce_verifier.as_deref(),
+            payload.proxy_node_id.as_deref(),
        )
        .await
    {
@@ -85,7 +85,11 @@ pub(super) async fn handle_admin_provider_oauth_device_authorize(
    };

    let client_registration = match state
-        .register_admin_kiro_device_oidc_client(&region, &start_url)
+        .register_admin_kiro_device_oidc_client(
+            &region,
+            &start_url,
+            payload.proxy_node_id.as_deref(),
+        )
        .await
    {
        Ok(payload) => payload,
@@ -105,7 +109,13 @@ pub(super) async fn handle_admin_provider_oauth_device_authorize(
    };

    let device_authorization = match state
-        .start_admin_kiro_device_authorization(&region, &client_id, &client_secret, &start_url)
+        .start_admin_kiro_device_authorization(
+            &region,
+            &client_id,
+            &client_secret,
+            &start_url,
+            payload.proxy_node_id.as_deref(),
+        )
        .await
    {
        Ok(payload) => payload,
@@ -132,6 +132,7 @@ pub(super) async fn handle_admin_provider_oauth_device_poll(
            &session.client_id,
            &session.client_secret,
            &session.device_code,
+            session.proxy_node_id.as_deref(),
        )
        .await
    {
@@ -98,7 +98,11 @@ pub(super) async fn handle_admin_provider_oauth_import_refresh_token(
    };

    let token_payload = match state
-        .exchange_admin_provider_oauth_refresh_token(template, refresh_token_input)
+        .exchange_admin_provider_oauth_refresh_token(
+            template,
+            refresh_token_input,
+            proxy_node_id.as_deref(),
+        )
        .await
    {
        Ok(payload) => payload,