fix(oauth): 修复 OAuth 刷新后 Token 有效期不更新问题 (#324)

- 持久化刷新后的 `expires_at` 到 Provider Key SQL 更新链路 - 手动刷新接口优先返回本次刷新得到的过期时间 - 按当前 Key 字段重建 OAuth 状态快照，避免旧快照覆盖 - 前端刷新后防止旧列表数据回退覆盖新有效期
2026-09-01 17:00:21 +08:00 · 2026-04-24 09:35:25 +08:00
parent 31e871fe1b
commit a9d10163af
8 changed files with 70 additions and 18 deletions
--- a/apps/aether-gateway/src/handlers/admin/provider/oauth/dispatch/refresh/execution.rs
+++ b/apps/aether-gateway/src/handlers/admin/provider/oauth/dispatch/refresh/execution.rs
@@ -24,8 +24,8 @@ pub(super) async fn execute_admin_provider_oauth_refresh(
        transport,
    } = request;

-    match state.force_local_oauth_refresh_entry(&transport).await {
-        Ok(Some(_)) => {}
+    let refreshed_entry = match state.force_local_oauth_refresh_entry(&transport).await {
+        Ok(Some(entry)) => Some(entry),
        Ok(None) => {
            return Ok(RefreshDispatch::Respond(response::control_error_response(
                http::StatusCode::BAD_REQUEST,
@@ -75,7 +75,7 @@ pub(super) async fn execute_admin_provider_oauth_refresh(
                response::oauth_refresh_failed_bad_request_response(&message),
            ));
        }
-    }
+    };

    if !helpers::key_is_account_blocked(&key, OAUTH_ACCOUNT_BLOCK_PREFIX) {
        let _ = state
@@ -89,10 +89,25 @@ pub(super) async fn execute_admin_provider_oauth_refresh(
        .into_iter()
        .next()
        .unwrap_or(key);
-    let refreshed_auth_config = helpers::refreshed_auth_config_object(
-        state,
-        refreshed_key.encrypted_auth_config.as_deref(),
-    );
+    let refreshed_auth_config = refreshed_entry
+        .as_ref()
+        .and_then(|entry| entry.metadata.as_ref())
+        .and_then(serde_json::Value::as_object)
+        .cloned()
+        .unwrap_or_else(|| {
+            helpers::refreshed_auth_config_object(
+                state,
+                refreshed_key.encrypted_auth_config.as_deref(),
+            )
+        });
+    let refreshed_expires_at_unix_secs = refreshed_entry
+        .as_ref()
+        .and_then(|entry| entry.expires_at_unix_secs)
+        .or_else(|| {
+            refreshed_auth_config
+                .get("expires_at")
+                .and_then(serde_json::Value::as_u64)
+        });
    let (account_state_recheck_attempted, account_state_recheck_error) = state
        .refresh_provider_oauth_account_state_after_update(&provider, &key_id, None)
        .await?;
@@ -100,6 +115,7 @@ pub(super) async fn execute_admin_provider_oauth_refresh(
    Ok(RefreshDispatch::Continue(RefreshSuccessContext {
        provider_type,
        refreshed_auth_config,
+        refreshed_expires_at_unix_secs,
        account_state_recheck_attempted,
        account_state_recheck_error,
    }))
--- a/apps/aether-gateway/src/handlers/admin/provider/oauth/dispatch/refresh/helpers.rs
+++ b/apps/aether-gateway/src/handlers/admin/provider/oauth/dispatch/refresh/helpers.rs
@@ -23,6 +23,7 @@ pub(super) struct RefreshRequestContext {
 pub(super) struct RefreshSuccessContext {
    pub(super) provider_type: String,
    pub(super) refreshed_auth_config: Map<String, Value>,
+    pub(super) refreshed_expires_at_unix_secs: Option<u64>,
    pub(super) account_state_recheck_attempted: bool,
    pub(super) account_state_recheck_error: Option<String>,
 }
--- a/apps/aether-gateway/src/handlers/admin/provider/oauth/dispatch/refresh/response.rs
+++ b/apps/aether-gateway/src/handlers/admin/provider/oauth/dispatch/refresh/response.rs
@@ -36,13 +36,14 @@ pub(super) fn oauth_refresh_failed_service_unavailable_response(
 pub(super) fn admin_provider_oauth_refresh_success_response(
    success: RefreshSuccessContext,
 ) -> Response<Body> {
+    let expires_at = success
+        .refreshed_expires_at_unix_secs
+        .map(serde_json::Value::from)
+        .or_else(|| success.refreshed_auth_config.get("expires_at").cloned())
+        .unwrap_or(Value::Null);
    Json(json!({
        "provider_type": success.provider_type,
-        "expires_at": success
-            .refreshed_auth_config
-            .get("expires_at")
-            .cloned()
-            .unwrap_or(Value::Null),
+        "expires_at": expires_at,
        "has_refresh_token": success
            .refreshed_auth_config
            .get("refresh_token")
--- a/apps/aether-gateway/src/handlers/admin/provider/pool_admin/payloads.rs
+++ b/apps/aether-gateway/src/handlers/admin/provider/pool_admin/payloads.rs
@@ -121,6 +121,10 @@ fn admin_pool_derive_oauth_expires_at(
        return None;
    }

+    if key.expires_at_unix_secs.is_some() {
+        return key.expires_at_unix_secs;
+    }
+
    for field in ["expires_at", "expiresAt", "expiry", "exp"] {
        let expires_at = admin_pool_json_to_u64(auth_config.and_then(|config| config.get(field)));
        if expires_at.is_some() {
@@ -128,7 +132,7 @@ fn admin_pool_derive_oauth_expires_at(
        }
    }

-    key.expires_at_unix_secs
+    None
 }

 fn admin_pool_derive_oauth_plan_type(
--- a/apps/aether-gateway/src/handlers/shared/catalog.rs
+++ b/apps/aether-gateway/src/handlers/shared/catalog.rs
@@ -1023,6 +1023,10 @@ pub(crate) fn provider_key_status_snapshot_payload(
    let mut snapshot = provider_key_status_snapshot_object(Some(&payload))
        .or_else(|| default_provider_key_status_snapshot().as_object().cloned())
        .unwrap_or_default();
+    snapshot.insert(
+        "oauth".to_string(),
+        build_provider_key_oauth_status_snapshot(key),
+    );
    snapshot.insert(
        "account".to_string(),
        build_provider_key_account_status_snapshot(key, provider_type),