i/Aether
1
0
Fork 0
mirror of https://github.com/fawney19/Aether.git synced 2026-09-03 01:40:21 +08:00
Code Issues Packages Projects Releases Wiki Activity

Fix/api key concurrency runtime miss (#309)

Browse Source 
* test(cli): 覆盖 API key 并发等待与超时路径

* feat(scheduler): API key 并发饱和时等待可用槽位

* fix(proxy): 区分 API key 并发受限与真正的 runtime miss

* fix(outcome): runtime miss 仅归因真实执行候选

* feat(api-keys): 统一 concurrent_limit 默认值与校验辅助

* feat(admin): 独立 Key 接口支持 concurrent_limit

* feat(admin): 用户 API Key 路由支持 concurrent_limit

* feat(public): 自助 API Key 路由支持 concurrent_limit

* feat(import): 导入与存储层持久化 concurrent_limit

* feat(frontend): 同步 API Key concurrent_limit 类型定义

* feat(frontend): 独立 Key 表单支持 concurrent_limit

* feat(frontend): 管理员用户 API Key 表单支持 concurrent_limit

* feat(frontend): 自助 API Key 页面支持 concurrent_limit

* chore(fmt): 统一 runtime 归因相关 Rust 格式

* chore(fmt): 统一 admin API key 路由 Rust 格式

* chore(fmt): 统一 public 路由与相关测试 Rust 格式

* fix(test): 对齐 no-execution usage 归因断言

* test(middleware): 固定 access log tracing 用例线程模型

* fix(frontend): 提取用户 API Key payload 默认并发辅助

* fix(frontend): 保留用户 Key 的 concurrent_limit 默认值

* fix(api-keys): remove hardcoded concurrent limit default

---------

Co-authored-by: fawney19 <elky0401@gmail.com>
This commit is contained in:
RWDai
2026-04-17 14:21:43 +08:00
committed by GitHub
parent e5d3722adf
commit b8702ae124
39 changed files with 1739 additions and 128 deletions
Download Patch File Download Diff File Expand all files Collapse all files

16
apps/aether-gateway/src/handlers/admin/auth/api_keys/mutation_routes.rs
View File

@@ -13,6 +13,7 @@ use crate::handlers::admin::users::{
normalize_admin_optional_api_key_name, normalize_admin_user_api_formats,
normalize_admin_user_string_list,
};
use crate::handlers::shared::normalize_optional_api_key_concurrent_limit;
use crate::GatewayError;
use aether_admin::system::serialize_admin_system_users_export_wallet;
use axum::{
@@ -114,6 +115,11 @@ pub(super) async fn build_admin_create_api_key_response(
"rate_limit 必须大于等于 0",
));
}
let concurrent_limit =
match normalize_optional_api_key_concurrent_limit(payload.concurrent_limit) {
Ok(value) => value,
Err(detail) => return Ok(build_admin_api_keys_bad_request_response(detail)),
};
let (initial_balance_usd, unlimited_balance) = match normalize_standalone_initial_balance(
payload.initial_balance_usd,
payload.unlimited_balance,
@@ -154,7 +160,7 @@ pub(super) async fn build_admin_create_api_key_response(
allowed_api_formats,
allowed_models,
rate_limit: payload.rate_limit,
concurrent_limit: 5,
concurrent_limit,
force_capabilities: None,
is_active: true,
expires_at_unix_secs,
@@ -184,6 +190,7 @@ pub(super) async fn build_admin_create_api_key_response(
"is_standalone": true,
"is_active": created.is_active,
"rate_limit": created.rate_limit,
"concurrent_limit": created.concurrent_limit,
"allowed_providers": created.allowed_providers,
"allowed_api_formats": created.allowed_api_formats,
"allowed_models": created.allowed_models,
@@ -270,6 +277,11 @@ pub(super) async fn build_admin_update_api_key_response(
"rate_limit 必须大于等于 0",
));
}
let concurrent_limit =
match normalize_optional_api_key_concurrent_limit(payload.concurrent_limit) {
Ok(value) => value,
Err(detail) => return Ok(build_admin_api_keys_bad_request_response(detail)),
};
let allowed_providers = if field_presence.contains("allowed_providers") {
match normalize_admin_user_string_list(payload.allowed_providers, "allowed_providers") {
Ok(value) => Some(value),
@@ -356,6 +368,8 @@ pub(super) async fn build_admin_update_api_key_response(
name,
rate_limit_present: field_presence.contains("rate_limit"),
rate_limit: payload.rate_limit,
concurrent_limit_present: field_presence.contains("concurrent_limit"),
concurrent_limit,
allowed_providers,
allowed_api_formats,
allowed_models,

4
apps/aether-gateway/src/handlers/admin/auth/api_keys/shared.rs
View File

@@ -22,6 +22,7 @@ pub(super) struct AdminStandaloneApiKeyCreateRequest {
pub(super) allowed_api_formats: Option<Vec<String>>,
pub(super) allowed_models: Option<Vec<String>>,
pub(super) rate_limit: Option<i32>,
pub(super) concurrent_limit: Option<i32>,
pub(super) initial_balance_usd: Option<f64>,
pub(super) unlimited_balance: Option<bool>,
pub(super) expire_days: Option<i32>,
@@ -36,6 +37,7 @@ pub(super) struct AdminStandaloneApiKeyUpdateRequest {
pub(super) allowed_api_formats: Option<Vec<String>>,
pub(super) allowed_models: Option<Vec<String>>,
pub(super) rate_limit: Option<i32>,
pub(super) concurrent_limit: Option<i32>,
pub(super) initial_balance_usd: Option<f64>,
pub(super) unlimited_balance: Option<bool>,
pub(super) expire_days: Option<i32>,
@@ -144,6 +146,7 @@ pub(super) fn build_admin_api_key_list_item_payload(
"total_tokens": total_tokens,
"total_cost_usd": record.total_cost_usd,
"rate_limit": record.rate_limit,
"concurrent_limit": record.concurrent_limit,
"allowed_providers": record.allowed_providers,
"allowed_api_formats": record.allowed_api_formats,
"allowed_models": record.allowed_models,
@@ -173,6 +176,7 @@ pub(super) fn build_admin_api_key_detail_payload(
"total_tokens": total_tokens,
"total_cost_usd": record.total_cost_usd,
"rate_limit": record.rate_limit,
"concurrent_limit": record.concurrent_limit,
"allowed_providers": record.allowed_providers,
"allowed_api_formats": record.allowed_api_formats,
"allowed_models": record.allowed_models,

20
apps/aether-gateway/src/handlers/admin/request/system/import.rs
View File

@@ -1871,8 +1871,10 @@ impl<'a> AdminAppState<'a> {
let concurrent_limit = invalid_value!(imported_optional_i32(
key.get("concurrent_limit"),
"concurrent_limit"
))
.unwrap_or(5);
));
if concurrent_limit.is_some_and(|value| value < 0) {
return Ok(Err(invalid_request("concurrent_limit 必须是非负整数")));
}
let force_capabilities = imported_optional_value(key.get("force_capabilities"));
let is_active =
invalid_value!(imported_optional_bool(key.get("is_active"))).unwrap_or(true);
@@ -1913,6 +1915,11 @@ impl<'a> AdminAppState<'a> {
api_key_id: existing_key.api_key_id.clone(),
name: name.clone(),
rate_limit: Some(rate_limit),
concurrent_limit: if key.contains_key("concurrent_limit") {
concurrent_limit
} else {
None
},
},
)
.await?;
@@ -2051,8 +2058,10 @@ impl<'a> AdminAppState<'a> {
let concurrent_limit = invalid_value!(imported_optional_i32(
key.get("concurrent_limit"),
"concurrent_limit"
))
.unwrap_or(5);
));
if concurrent_limit.is_some_and(|value| value < 0) {
return Ok(Err(invalid_request("concurrent_limit 必须是非负整数")));
}
let force_capabilities = imported_optional_value(key.get("force_capabilities"));
let is_active =
invalid_value!(imported_optional_bool(key.get("is_active"))).unwrap_or(true);
@@ -2099,6 +2108,8 @@ impl<'a> AdminAppState<'a> {
name: name.clone(),
rate_limit_present: true,
rate_limit: Some(rate_limit),
concurrent_limit_present: key.contains_key("concurrent_limit"),
concurrent_limit,
allowed_providers: Some(allowed_providers.clone()),
allowed_api_formats: Some(allowed_api_formats.clone()),
allowed_models: Some(allowed_models.clone()),
@@ -2123,7 +2134,6 @@ impl<'a> AdminAppState<'a> {
|| key.contains_key("force_capabilities")
|| key.contains_key("total_requests")
|| key.contains_key("total_cost_usd")
|| key.contains_key("concurrent_limit")
{
stats.errors.push(
"现有独立余额 Key 仅覆盖基础字段；高级导入字段保持原值".to_string(),

1
apps/aether-gateway/src/handlers/admin/users/api_keys/helpers.rs
View File

@@ -43,6 +43,7 @@ pub(super) fn build_admin_user_api_key_detail_payload(
"total_requests": record.total_requests,
"total_cost_usd": record.total_cost_usd,
"rate_limit": record.rate_limit,
"concurrent_limit": record.concurrent_limit,
"expires_at": format_optional_unix_secs_iso8601(record.expires_at_unix_secs),
"last_used_at": serde_json::Value::Null,
"created_at": serde_json::Value::Null,

17
apps/aether-gateway/src/handlers/admin/users/api_keys/responses/create.rs
View File

@@ -10,6 +10,7 @@ use super::super::helpers::{
use super::super::paths::admin_user_id_from_api_keys_path;
use crate::handlers::admin::request::{AdminAppState, AdminRequestContext};
use crate::handlers::shared::normalize_optional_api_key_concurrent_limit;
use crate::GatewayError;
use axum::{
body::Body,
@@ -69,7 +70,7 @@ pub(crate) async fn build_admin_create_user_api_key_response(
{
return Ok((
http::StatusCode::BAD_REQUEST,
Json(json!({ "detail": "当前仅支持 name、rate_limit、allowed_providers 字段" })),
Json(json!({ "detail": "当前仅支持 name、rate_limit、concurrent_limit、allowed_providers 字段" })),
)
.into_response());
}
@@ -103,6 +104,17 @@ pub(crate) async fn build_admin_create_user_api_key_response(
)
.into_response());
}
let concurrent_limit =
match normalize_optional_api_key_concurrent_limit(payload.concurrent_limit) {
Ok(value) => value,
Err(detail) => {
return Ok((
http::StatusCode::BAD_REQUEST,
Json(json!({ "detail": detail })),
)
.into_response());
}
};
let plaintext_key = generate_admin_user_api_key_plaintext();
let Some(key_encrypted) = state.encrypt_catalog_secret_with_fallbacks(&plaintext_key) else {
@@ -124,7 +136,7 @@ pub(crate) async fn build_admin_create_user_api_key_response(
allowed_api_formats: None,
allowed_models: None,
rate_limit,
concurrent_limit: 5,
concurrent_limit,
force_capabilities: None,
is_active: true,
expires_at_unix_secs: None,
@@ -156,6 +168,7 @@ pub(crate) async fn build_admin_create_user_api_key_response(
"name": created.name,
"key_display": masked_user_api_key_display(state, created.key_encrypted.as_deref()),
"rate_limit": created.rate_limit,
"concurrent_limit": created.concurrent_limit,
"expires_at": format_optional_unix_secs_iso8601(created.expires_at_unix_secs),
"created_at": chrono::Utc::now().to_rfc3339(),
"message": "API Key创建成功，请妥善保存完整密钥",

1
apps/aether-gateway/src/handlers/admin/users/api_keys/responses/list.rs
View File

@@ -62,6 +62,7 @@ pub(crate) async fn build_admin_list_user_api_keys_response(
"total_requests": record.total_requests,
"total_cost_usd": record.total_cost_usd,
"rate_limit": record.rate_limit,
"concurrent_limit": record.concurrent_limit,
"expires_at": format_optional_unix_secs_iso8601(record.expires_at_unix_secs),
"last_used_at": serde_json::Value::Null,
"created_at": serde_json::Value::Null,

13
apps/aether-gateway/src/handlers/admin/users/api_keys/responses/update.rs
View File

@@ -9,6 +9,7 @@ use super::super::helpers::{
use super::super::paths::admin_user_api_key_parts;
use crate::handlers::admin::request::{AdminAppState, AdminRequestContext};
use crate::handlers::shared::normalize_optional_api_key_concurrent_limit;
use crate::GatewayError;
use axum::{
body::Body,
@@ -68,6 +69,17 @@ pub(crate) async fn build_admin_update_user_api_key_response(
)
.into_response());
}
let concurrent_limit =
match normalize_optional_api_key_concurrent_limit(payload.concurrent_limit) {
Ok(value) => value,
Err(detail) => {
return Ok((
http::StatusCode::BAD_REQUEST,
Json(json!({ "detail": detail })),
)
.into_response());
}
};
let Some(updated) = state
.update_user_api_key_basic(aether_data::repository::auth::UpdateUserApiKeyBasicRecord {
@@ -75,6 +87,7 @@ pub(crate) async fn build_admin_update_user_api_key_response(
api_key_id: api_key_id.clone(),
name,
rate_limit: payload.rate_limit,
concurrent_limit,
})
.await?
else {

4
apps/aether-gateway/src/handlers/admin/users/shared.rs
View File

@@ -22,6 +22,8 @@ pub(super) struct AdminCreateUserApiKeyRequest {
#[serde(default)]
pub(super) rate_limit: Option<i32>,
#[serde(default)]
pub(super) concurrent_limit: Option<i32>,
#[serde(default)]
pub(super) expire_days: Option<i32>,
#[serde(default)]
pub(super) expires_at: Option<String>,
@@ -41,6 +43,8 @@ pub(super) struct AdminUpdateUserApiKeyRequest {
pub(super) name: Option<String>,
#[serde(default)]
pub(super) rate_limit: Option<i32>,
#[serde(default)]
pub(super) concurrent_limit: Option<i32>,
}
#[derive(Debug, serde::Deserialize)]

161
apps/aether-gateway/src/handlers/proxy/mod.rs
View File

@@ -14,14 +14,14 @@ use crate::constants::{
DEPENDENCY_REASON_HEADER, EXECUTION_PATH_CONTROL_EXECUTE_STREAM,
EXECUTION_PATH_CONTROL_EXECUTE_SYNC, EXECUTION_PATH_DISTRIBUTED_OVERLOADED,
EXECUTION_PATH_EXECUTION_RUNTIME_STREAM, EXECUTION_PATH_EXECUTION_RUNTIME_SYNC,
EXECUTION_PATH_LOCAL_AI_PUBLIC, EXECUTION_PATH_LOCAL_AUTH_DENIED,
EXECUTION_PATH_LOCAL_EXECUTION_LOOP_DETECTED, EXECUTION_PATH_LOCAL_EXECUTION_RUNTIME_MISS,
EXECUTION_PATH_LOCAL_OVERLOADED, EXECUTION_PATH_LOCAL_PROXY_PASSTHROUGH_REMOVED,
EXECUTION_PATH_LOCAL_RATE_LIMITED, EXECUTION_PATH_LOCAL_ROUTE_NOT_FOUND,
EXECUTION_PATH_PUBLIC_PROXY_PASSTHROUGH, EXECUTION_RUNTIME_LOOP_GUARD_HEADER,
FORWARDED_FOR_HEADER, FORWARDED_HOST_HEADER, FORWARDED_PROTO_HEADER, GATEWAY_HEADER,
LOCAL_EXECUTION_RUNTIME_MISS_REASON_HEADER, TRACE_ID_HEADER,
TRUSTED_AUTH_ACCESS_ALLOWED_HEADER, TRUSTED_AUTH_API_KEY_ID_HEADER,
EXECUTION_PATH_LOCAL_AI_PUBLIC, EXECUTION_PATH_LOCAL_API_KEY_CONCURRENCY_LIMITED,
EXECUTION_PATH_LOCAL_AUTH_DENIED, EXECUTION_PATH_LOCAL_EXECUTION_LOOP_DETECTED,
EXECUTION_PATH_LOCAL_EXECUTION_RUNTIME_MISS, EXECUTION_PATH_LOCAL_OVERLOADED,
EXECUTION_PATH_LOCAL_PROXY_PASSTHROUGH_REMOVED, EXECUTION_PATH_LOCAL_RATE_LIMITED,
EXECUTION_PATH_LOCAL_ROUTE_NOT_FOUND, EXECUTION_PATH_PUBLIC_PROXY_PASSTHROUGH,
EXECUTION_RUNTIME_LOOP_GUARD_HEADER, FORWARDED_FOR_HEADER, FORWARDED_HOST_HEADER,
FORWARDED_PROTO_HEADER, GATEWAY_HEADER, LOCAL_EXECUTION_RUNTIME_MISS_REASON_HEADER,
TRACE_ID_HEADER, TRUSTED_AUTH_ACCESS_ALLOWED_HEADER, TRUSTED_AUTH_API_KEY_ID_HEADER,
TRUSTED_AUTH_BALANCE_HEADER, TRUSTED_AUTH_USER_ID_HEADER, TUNNEL_AFFINITY_FORWARDED_BY_HEADER,
TUNNEL_AFFINITY_OWNER_INSTANCE_HEADER,
};
@@ -75,6 +75,8 @@ const LOCAL_PROXY_PASSTHROUGH_REMOVED_DETAIL: &str =
"Route matched a removed compatibility passthrough; implement it in Rust or retire the route";
const LOCAL_EXECUTION_LOOP_DETECTED_DETAIL: &str =
"Gateway detected an execution runtime request loop back into the local frontdoor";
const AUTH_API_KEY_CONCURRENCY_LIMIT_REACHED_DETAIL: &str =
"当前 API Key 并发请求数已达上限，请稍后重试";
const EXECUTION_PATH_TUNNEL_AFFINITY_FORWARD: &str = "tunnel_affinity_forward";
fn local_execution_outcome_label(outcome: &LocalExecutionRequestOutcome) -> &'static str {
@@ -1018,23 +1020,38 @@ pub(crate) async fn proxy_request(
}
let local_execution_runtime_miss_diagnostic =
state.take_local_execution_runtime_miss_diagnostic(&trace_id);
let local_execution_runtime_miss_context =
build_local_execution_runtime_miss_context(&state, &trace_id, control_decision).await;
let auth_api_key_concurrency_limited = diagnostic_is_auth_api_key_concurrency_limited(
local_execution_runtime_miss_diagnostic.as_ref(),
) || local_execution_runtime_miss_context
.all_candidates_skipped_for_reason("api_key_concurrency_limit_reached");
let local_execution_runtime_miss_detail = local_execution_runtime_miss_detail(
control_decision,
local_execution_runtime_miss_diagnostic.as_ref(),
auth_api_key_concurrency_limited,
stream_request,
)
.unwrap_or_else(|| {
"AI public execution runtime miss did not match a Rust execution path".to_string()
});
let local_execution_failure_path = if auth_api_key_concurrency_limited {
EXECUTION_PATH_LOCAL_API_KEY_CONCURRENCY_LIMITED
} else {
EXECUTION_PATH_LOCAL_EXECUTION_RUNTIME_MISS
};
let local_execution_failure_log = if auth_api_key_concurrency_limited {
"gateway local execution blocked by api key concurrency limit"
} else {
"gateway local execution runtime miss"
};
state.record_fallback_metric(
GatewayFallbackMetricKind::LocalExecutionRuntimeMiss,
control_decision,
None,
Some(EXECUTION_PATH_LOCAL_EXECUTION_RUNTIME_MISS),
Some(local_execution_failure_path),
GatewayFallbackReason::LocalExecutionPathRequired,
);
let local_execution_runtime_miss_context =
build_local_execution_runtime_miss_context(&state, &trace_id, control_decision).await;
warn!(
trace_id = %trace_id,
local_execution_runtime_miss_reason = local_execution_runtime_miss_diagnostic
@@ -1094,7 +1111,7 @@ pub(crate) async fn proxy_request(
request_candidates = local_execution_runtime_miss_context
.candidate_summary()
.unwrap_or_default(),
"gateway local execution runtime miss"
local_execution_failure_log
);
if let Some(exhaustion) = local_execution_exhaustion {
record_failed_usage_for_exhausted_request(
@@ -1102,6 +1119,7 @@ pub(crate) async fn proxy_request(
exhaustion,
&started_at,
local_execution_runtime_miss_detail.as_str(),
local_execution_failure_path,
local_execution_runtime_miss_diagnostic.as_ref(),
)
.await;
@@ -1111,6 +1129,7 @@ pub(crate) async fn proxy_request(
&trace_id,
&started_at,
local_execution_runtime_miss_detail.as_str(),
local_execution_failure_path,
control_decision,
local_execution_runtime_miss_diagnostic.as_ref(),
&local_execution_runtime_miss_context,
@@ -1123,21 +1142,28 @@ pub(crate) async fn proxy_request(
http::StatusCode::SERVICE_UNAVAILABLE,
local_execution_runtime_miss_detail.as_str(),
)?;
if let Some(diagnostic) = local_execution_runtime_miss_diagnostic {
if !diagnostic.reason.trim().is_empty() {
response.headers_mut().insert(
HeaderName::from_static(LOCAL_EXECUTION_RUNTIME_MISS_REASON_HEADER),
HeaderValue::from_str(diagnostic.reason.as_str())
.map_err(|err| GatewayError::Internal(err.to_string()))?,
);
}
let local_execution_runtime_miss_reason = local_execution_runtime_miss_diagnostic
.as_ref()
.map(|diagnostic| diagnostic.reason.trim())
.filter(|reason| !reason.is_empty())
.map(ToOwned::to_owned)
.or_else(|| {
auth_api_key_concurrency_limited
.then_some("api_key_concurrency_limit_reached".to_string())
});
if let Some(reason) = local_execution_runtime_miss_reason {
response.headers_mut().insert(
HeaderName::from_static(LOCAL_EXECUTION_RUNTIME_MISS_REASON_HEADER),
HeaderValue::from_str(reason.as_str())
.map_err(|err| GatewayError::Internal(err.to_string()))?,
);
}
return Ok(finalize_gateway_response_with_context(
&state,
response,
&remote_addr,
&request_context,
EXECUTION_PATH_LOCAL_EXECUTION_RUNTIME_MISS,
local_execution_failure_path,
&started_at,
request_permit.take(),
));
@@ -1163,8 +1189,15 @@ pub(crate) async fn proxy_request(
fn local_execution_runtime_miss_detail(
decision: Option<&GatewayControlDecision>,
diagnostic: Option<&LocalExecutionRuntimeMissDiagnostic>,
auth_api_key_concurrency_limited: bool,
stream_request: bool,
) -> Option<String> {
if auth_api_key_concurrency_limited
|| diagnostic_is_auth_api_key_concurrency_limited(diagnostic)
{
return Some(AUTH_API_KEY_CONCURRENCY_LIMIT_REACHED_DETAIL.to_string());
}
if let Some(detail) = local_execution_runtime_miss_model_detail(diagnostic, stream_request) {
return Some(detail);
}
@@ -1195,6 +1228,23 @@ fn local_execution_runtime_miss_model_detail(
))
}
fn diagnostic_is_auth_api_key_concurrency_limited(
diagnostic: Option<&LocalExecutionRuntimeMissDiagnostic>,
) -> bool {
let Some(diagnostic) = diagnostic else {
return false;
};
diagnostic.reason == "api_key_concurrency_limit_reached"
|| (diagnostic.reason == "all_candidates_skipped"
&& diagnostic.skip_reasons.len() == 1
&& diagnostic
.skip_reasons
.get("api_key_concurrency_limit_reached")
.copied()
.unwrap_or(0)
> 0)
}
fn local_execution_runtime_miss_route_detail(
decision: Option<&GatewayControlDecision>,
) -> Option<&'static str> {
@@ -1226,8 +1276,8 @@ fn local_execution_runtime_miss_route_detail(
#[cfg(test)]
mod tests {
use super::{
local_execution_runtime_miss_detail, GatewayControlDecision,
LocalExecutionRuntimeMissDiagnostic,
diagnostic_is_auth_api_key_concurrency_limited, local_execution_runtime_miss_detail,
GatewayControlDecision, LocalExecutionRuntimeMissDiagnostic,
};
#[test]
@@ -1245,7 +1295,8 @@ mod tests {
..LocalExecutionRuntimeMissDiagnostic::default()
};
let detail = local_execution_runtime_miss_detail(Some(&decision), Some(&diagnostic), true);
let detail =
local_execution_runtime_miss_detail(Some(&decision), Some(&diagnostic), false, true);
assert_eq!(
detail.as_deref(),
@@ -1268,13 +1319,73 @@ mod tests {
..LocalExecutionRuntimeMissDiagnostic::default()
};
let detail = local_execution_runtime_miss_detail(Some(&decision), Some(&diagnostic), false);
let detail =
local_execution_runtime_miss_detail(Some(&decision), Some(&diagnostic), false, false);
assert_eq!(
detail.as_deref(),
Some("Claude messages execution runtime miss did not match a Rust execution path")
);
}
#[test]
fn runtime_miss_detail_returns_api_key_concurrency_message_for_exact_all_skipped_limit_case() {
let decision = GatewayControlDecision::synthetic(
"/v1/responses",
Some("ai_public".to_string()),
Some("openai".to_string()),
Some("cli".to_string()),
Some("openai:cli".to_string()),
);
let diagnostic = LocalExecutionRuntimeMissDiagnostic {
reason: "all_candidates_skipped".to_string(),
skip_reasons: std::collections::BTreeMap::from([(
"api_key_concurrency_limit_reached".to_string(),
1,
)]),
requested_model: Some("gpt-5.4".to_string()),
..LocalExecutionRuntimeMissDiagnostic::default()
};
let detail =
local_execution_runtime_miss_detail(Some(&decision), Some(&diagnostic), false, false);
assert_eq!(
detail.as_deref(),
Some("当前 API Key 并发请求数已达上限，请稍后重试")
);
assert!(diagnostic_is_auth_api_key_concurrency_limited(Some(
&diagnostic
)));
}
#[test]
fn runtime_miss_detail_prefers_api_key_concurrency_message_when_classified_from_context() {
let decision = GatewayControlDecision::synthetic(
"/v1/responses",
Some("ai_public".to_string()),
Some("openai".to_string()),
Some("cli".to_string()),
Some("openai:cli".to_string()),
);
let diagnostic = LocalExecutionRuntimeMissDiagnostic {
reason: "all_candidates_skipped".to_string(),
skip_reasons: std::collections::BTreeMap::from([(
"format_conversion_disabled".to_string(),
1,
)]),
requested_model: Some("gpt-5.4".to_string()),
..LocalExecutionRuntimeMissDiagnostic::default()
};
let detail =
local_execution_runtime_miss_detail(Some(&decision), Some(&diagnostic), true, false);
assert_eq!(
detail.as_deref(),
Some("当前 API Key 并发请求数已达上限，请稍后重试")
);
}
}
#[path = "finalize.rs"]

27
apps/aether-gateway/src/handlers/public/support/user_me_api_keys.rs
View File

@@ -10,7 +10,8 @@ use serde::Deserialize;
use serde_json::json;
use crate::handlers::shared::{
api_key_placeholder_display, generate_gateway_api_key_plaintext, masked_gateway_api_key_display,
api_key_placeholder_display, generate_gateway_api_key_plaintext,
masked_gateway_api_key_display, normalize_optional_api_key_concurrent_limit,
};
use super::{
@@ -28,6 +29,8 @@ struct UsersMeCreateApiKeyRequest {
name: String,
#[serde(default)]
rate_limit: Option<i32>,
#[serde(default)]
concurrent_limit: Option<i32>,
}
#[derive(Debug, Deserialize)]
@@ -36,6 +39,8 @@ struct UsersMeUpdateApiKeyRequest {
name: Option<String>,
#[serde(default)]
rate_limit: Option<i32>,
#[serde(default)]
concurrent_limit: Option<i32>,
}
#[derive(Debug, Deserialize)]
@@ -148,6 +153,7 @@ fn build_users_me_api_key_list_payload(
"total_requests": record.total_requests,
"total_cost_usd": record.total_cost_usd,
"rate_limit": record.rate_limit,
"concurrent_limit": record.concurrent_limit,
"allowed_providers": record.allowed_providers,
"force_capabilities": record.force_capabilities,
})
@@ -167,6 +173,7 @@ fn build_users_me_api_key_detail_payload(
"allowed_providers": record.allowed_providers,
"force_capabilities": record.force_capabilities,
"rate_limit": record.rate_limit,
"concurrent_limit": record.concurrent_limit,
"last_used_at": serde_json::Value::Null,
"expires_at": format_users_me_optional_unix_secs_iso8601(record.expires_at_unix_secs),
"created_at": serde_json::Value::Null,
@@ -515,6 +522,13 @@ pub(super) async fn handle_users_me_api_key_create(
false,
);
}
let concurrent_limit =
match normalize_optional_api_key_concurrent_limit(payload.concurrent_limit) {
Ok(value) => value,
Err(detail) => {
return build_auth_error_response(http::StatusCode::BAD_REQUEST, detail, false);
}
};
let plaintext_key = generate_users_me_api_key_plaintext();
let Some(key_encrypted) = encrypt_catalog_secret_with_fallbacks(state, &plaintext_key) else {
@@ -534,7 +548,7 @@ pub(super) async fn handle_users_me_api_key_create(
allowed_api_formats: None,
allowed_models: None,
rate_limit,
concurrent_limit: 5,
concurrent_limit,
force_capabilities: None,
is_active: true,
expires_at_unix_secs: None,
@@ -561,6 +575,7 @@ pub(super) async fn handle_users_me_api_key_create(
"key": plaintext_key,
"key_display": users_me_masked_api_key_display(state, created.key_encrypted.as_deref()),
"rate_limit": created.rate_limit,
"concurrent_limit": created.concurrent_limit,
"message": "API密钥创建成功",
}))
.into_response()
@@ -621,6 +636,13 @@ pub(super) async fn handle_users_me_api_key_update(
false,
);
}
let concurrent_limit =
match normalize_optional_api_key_concurrent_limit(payload.concurrent_limit) {
Ok(value) => value,
Err(detail) => {
return build_auth_error_response(http::StatusCode::BAD_REQUEST, detail, false);
}
};
let Some(updated) = (match state
.update_user_api_key_basic(aether_data::repository::auth::UpdateUserApiKeyBasicRecord {
@@ -628,6 +650,7 @@ pub(super) async fn handle_users_me_api_key_update(
api_key_id: snapshot.api_key_id.clone(),
name,
rate_limit,
concurrent_limit,
})
.await
{

9
apps/aether-gateway/src/handlers/shared/api_keys.rs
View File

@@ -60,6 +60,15 @@ pub(crate) fn masked_gateway_api_key_display(full_key: Option<&str>) -> String {
format!("{prefix}...{suffix}")
}
pub(crate) fn normalize_optional_api_key_concurrent_limit(
value: Option<i32>,
) -> Result<Option<i32>, String> {
if value.is_some_and(|limit| limit < 0) {
return Err("concurrent_limit 必须是非负整数".to_string());
}
Ok(value)
}
#[cfg(test)]
mod tests {
use super::{

2
apps/aether-gateway/src/handlers/shared/mod.rs
View File

@@ -15,7 +15,7 @@ pub(crate) use self::admin_proxy::{
};
pub(crate) use self::api_keys::{
api_key_placeholder_display, configured_api_key_prefix, generate_gateway_api_key_plaintext,
masked_gateway_api_key_display,
masked_gateway_api_key_display, normalize_optional_api_key_concurrent_limit,
};
pub(crate) use self::catalog::{
build_admin_provider_key_response, decrypt_catalog_secret_with_fallbacks,