fix(kiro,pool,model): 对齐 Kiro 管理链路并修复全局模型删除行为 (#305)

* feat(pool): 号池支持跳过额度耗尽账号 - 新增 pool_advanced.skip_exhausted_accounts 开关及高级设置 UI, 默认关闭并兼容旧配置 - 为 Codex/Kiro 增加额度耗尽判定, 接入请求侧候选跳过并新增 account_quota_exhausted skip reason - 号池列表将额度耗尽账号标记为 blocked/额度耗尽, 并补充前后端相关测试 * fix(kiro): 对齐账号管理与 provider-query 的 Rust 行为 - 修复 Kiro 单条导入误走 import-refresh-token 的前端分流, 并为误用路径返回明确错误提示 - 为 Kiro 导入与本地请求链补齐 bearer 兼容, 同步放开账号启停等 Key 更新操作的 auth_type 校验 - 实现 Kiro provider-query 本地模型测试与 failover 执行链, 并修复结果弹窗在无 trace 时无法展示 attempts/响应体的问题 * fix(model): 删除全局模型时级联清理关联提供商模型 - 对齐 Python 版本删除逻辑, GlobalModel 删除前先在事务内清理关联的 Provider Model 记录 - 修复已绑定 Provider 的模型在 Rust SQL 仓库下会被外键约束拦住、无法正常删除的问题 - 增加管理端回归测试, 覆盖绑定 Provider Model 的 GlobalModel 删除场景 * fix(kiro,ci): 恢复 Kiro OAuth 持久化并修复 Rust CI * Fix oauth-managed provider key semantics --------- Co-authored-by: fawney19 <[email protected]>
2026-10-11 03:39:49 +08:00 · 2026-04-17 12:57:06 +08:00
parent 96a25d058b
commit ac1a126756
43 changed files with 2909 additions and 168 deletions
@@ -0,0 +1,230 @@
+use aether_data_contracts::repository::provider_catalog::StoredProviderCatalogKey;
+
+#[derive(Debug, Clone, Copy, PartialEq, Eq)]
+pub(crate) enum ProviderKeyCredentialKind {
+    RawSecret,
+    OAuthSession,
+    ServiceAccount,
+}
+
+impl ProviderKeyCredentialKind {
+    pub(crate) const fn as_str(self) -> &'static str {
+        match self {
+            Self::RawSecret => "raw_secret",
+            Self::OAuthSession => "oauth_session",
+            Self::ServiceAccount => "service_account",
+        }
+    }
+}
+
+#[derive(Debug, Clone, Copy, PartialEq, Eq)]
+pub(crate) enum ProviderKeyRuntimeAuthKind {
+    ApiKey,
+    Bearer,
+    ServiceAccount,
+    Unknown,
+}
+
+impl ProviderKeyRuntimeAuthKind {
+    pub(crate) const fn as_str(self) -> &'static str {
+        match self {
+            Self::ApiKey => "api_key",
+            Self::Bearer => "bearer",
+            Self::ServiceAccount => "service_account",
+            Self::Unknown => "unknown",
+        }
+    }
+}
+
+#[derive(Debug, Clone, Copy, PartialEq, Eq)]
+pub(crate) struct ProviderKeyAuthSemantics {
+    credential_kind: ProviderKeyCredentialKind,
+    runtime_auth_kind: ProviderKeyRuntimeAuthKind,
+    oauth_managed: bool,
+}
+
+impl ProviderKeyAuthSemantics {
+    pub(crate) const fn credential_kind(self) -> ProviderKeyCredentialKind {
+        self.credential_kind
+    }
+
+    pub(crate) const fn runtime_auth_kind(self) -> ProviderKeyRuntimeAuthKind {
+        self.runtime_auth_kind
+    }
+
+    pub(crate) const fn oauth_managed(self) -> bool {
+        self.oauth_managed
+    }
+
+    pub(crate) const fn can_refresh_oauth(self) -> bool {
+        self.oauth_managed
+    }
+
+    pub(crate) const fn can_export_oauth(self) -> bool {
+        self.oauth_managed
+    }
+
+    pub(crate) const fn can_edit_oauth(self) -> bool {
+        self.oauth_managed
+    }
+
+    pub(crate) const fn can_show_oauth_metadata(self) -> bool {
+        self.oauth_managed
+    }
+}
+
+fn normalized_auth_type(key: &StoredProviderCatalogKey) -> String {
+    key.auth_type.trim().to_ascii_lowercase()
+}
+
+fn key_has_auth_config(key: &StoredProviderCatalogKey) -> bool {
+    key.encrypted_auth_config
+        .as_deref()
+        .map(str::trim)
+        .is_some_and(|value| !value.is_empty())
+}
+
+fn provider_uses_bearer_oauth_runtime(provider_type: &str) -> bool {
+    matches!(
+        provider_type.trim().to_ascii_lowercase().as_str(),
+        "claude_code" | "codex" | "gemini_cli" | "antigravity" | "kiro"
+    )
+}
+
+fn provider_key_is_legacy_kiro_oauth_session(
+    key: &StoredProviderCatalogKey,
+    provider_type: &str,
+    auth_type: &str,
+) -> bool {
+    provider_type.trim().eq_ignore_ascii_case("kiro")
+        && auth_type.eq_ignore_ascii_case("bearer")
+        && key_has_auth_config(key)
+}
+
+pub(crate) fn provider_key_auth_semantics(
+    key: &StoredProviderCatalogKey,
+    provider_type: &str,
+) -> ProviderKeyAuthSemantics {
+    let auth_type = normalized_auth_type(key);
+    let oauth_managed = auth_type == "oauth"
+        || provider_key_is_legacy_kiro_oauth_session(key, provider_type, &auth_type);
+    let credential_kind = if oauth_managed {
+        ProviderKeyCredentialKind::OAuthSession
+    } else if matches!(auth_type.as_str(), "service_account" | "vertex_ai") {
+        ProviderKeyCredentialKind::ServiceAccount
+    } else {
+        ProviderKeyCredentialKind::RawSecret
+    };
+
+    let runtime_auth_kind = match credential_kind {
+        ProviderKeyCredentialKind::OAuthSession => {
+            if provider_uses_bearer_oauth_runtime(provider_type) {
+                ProviderKeyRuntimeAuthKind::Bearer
+            } else {
+                ProviderKeyRuntimeAuthKind::Unknown
+            }
+        }
+        ProviderKeyCredentialKind::ServiceAccount => ProviderKeyRuntimeAuthKind::ServiceAccount,
+        ProviderKeyCredentialKind::RawSecret => match auth_type.as_str() {
+            "bearer" => ProviderKeyRuntimeAuthKind::Bearer,
+            "api_key" => ProviderKeyRuntimeAuthKind::ApiKey,
+            _ => ProviderKeyRuntimeAuthKind::Unknown,
+        },
+    };
+
+    ProviderKeyAuthSemantics {
+        credential_kind,
+        runtime_auth_kind,
+        oauth_managed,
+    }
+}
+
+pub(crate) fn provider_key_is_oauth_managed(
+    key: &StoredProviderCatalogKey,
+    provider_type: &str,
+) -> bool {
+    provider_key_auth_semantics(key, provider_type).oauth_managed()
+}
+
+#[cfg(test)]
+mod tests {
+    use super::{
+        provider_key_auth_semantics, ProviderKeyCredentialKind, ProviderKeyRuntimeAuthKind,
+    };
+    use aether_data_contracts::repository::provider_catalog::StoredProviderCatalogKey;
+
+    fn sample_key(auth_type: &str) -> StoredProviderCatalogKey {
+        StoredProviderCatalogKey::new(
+            "key-1".to_string(),
+            "provider-1".to_string(),
+            "key-1".to_string(),
+            auth_type.to_string(),
+            None,
+            true,
+        )
+        .expect("key should build")
+    }
+
+    #[test]
+    fn recognizes_oauth_managed_key() {
+        let semantics = provider_key_auth_semantics(&sample_key("oauth"), "codex");
+
+        assert!(semantics.oauth_managed());
+        assert_eq!(
+            semantics.credential_kind(),
+            ProviderKeyCredentialKind::OAuthSession
+        );
+        assert_eq!(
+            semantics.runtime_auth_kind(),
+            ProviderKeyRuntimeAuthKind::Bearer
+        );
+    }
+
+    #[test]
+    fn recognizes_legacy_kiro_bearer_key_with_auth_config_as_oauth_managed() {
+        let mut key = sample_key("bearer");
+        key.encrypted_auth_config = Some("ciphertext".to_string());
+
+        let semantics = provider_key_auth_semantics(&key, "kiro");
+
+        assert!(semantics.oauth_managed());
+        assert_eq!(
+            semantics.credential_kind(),
+            ProviderKeyCredentialKind::OAuthSession
+        );
+        assert_eq!(
+            semantics.runtime_auth_kind(),
+            ProviderKeyRuntimeAuthKind::Bearer
+        );
+    }
+
+    #[test]
+    fn keeps_plain_bearer_key_as_raw_secret() {
+        let semantics = provider_key_auth_semantics(&sample_key("bearer"), "kiro");
+
+        assert!(!semantics.oauth_managed());
+        assert_eq!(
+            semantics.credential_kind(),
+            ProviderKeyCredentialKind::RawSecret
+        );
+        assert_eq!(
+            semantics.runtime_auth_kind(),
+            ProviderKeyRuntimeAuthKind::Bearer
+        );
+    }
+
+    #[test]
+    fn recognizes_service_account_key() {
+        let semantics = provider_key_auth_semantics(&sample_key("service_account"), "vertex_ai");
+
+        assert!(!semantics.oauth_managed());
+        assert_eq!(
+            semantics.credential_kind(),
+            ProviderKeyCredentialKind::ServiceAccount
+        );
+        assert_eq!(
+            semantics.runtime_auth_kind(),
+            ProviderKeyRuntimeAuthKind::ServiceAccount
+        );
+    }
+}