fix(kiro): 修复 Kiro OAuth 过期懒刷新 (#334)

* fix(kiro): 修复 OAuth 过期懒刷新

* fix(kiro): 修复 OAuth 过期懒刷新

* fix(scheduler): 修复 candidate extra data clippy 告警

crates/aether-provider-transport/src/kiro/auth.rs

@@ -22,12 +22,17 @@ pub fn build_kiro_request_auth_from_config(
     auth_config: KiroAuthConfig,
     fallback_secret: Option<&str>,
 ) -> Option<KiroRequestAuth> {
+    let cached_token_needs_refresh = auth_config.cached_access_token_requires_refresh(120);
     let fallback_secret = fallback_secret
         .map(str::trim)
         .filter(|value| !value.is_empty() && *value != "__placeholder__");
+    if cached_token_needs_refresh && auth_config.can_refresh_access_token() {
+        return None;
+    }
+
     let token = auth_config
         .cached_access_token()
-        .filter(|_| !auth_config.cached_access_token_requires_refresh(120))
+        .filter(|_| !cached_token_needs_refresh)
         .or(fallback_secret)?;
     let machine_id = generate_machine_id(&auth_config, Some(token))?;
 
@@ -291,9 +296,9 @@ mod tests {
     }
 
     #[test]
-    fn falls_back_to_decrypted_api_key_when_cached_access_token_is_expired() {
+    fn refreshable_expired_cached_access_token_does_not_fallback_to_decrypted_api_key() {
         let mut transport = sample_transport();
-        transport.key.decrypted_api_key = "live-upstream-token".to_string();
+        transport.key.decrypted_api_key = "stale-upstream-token".to_string();
         transport.key.decrypted_auth_config = Some(
             r#"{
                 "access_token":"expired-token",
@@ -303,9 +308,8 @@ mod tests {
             .to_string(),
         );
 
-        let auth = resolve_local_kiro_request_auth(&transport)
-            .expect("request auth should fall back to decrypted api key");
-        assert_eq!(auth.value, "Bearer live-upstream-token");
+        assert!(resolve_local_kiro_request_auth(&transport).is_none());
+        assert!(supports_local_kiro_request_auth_resolution(&transport));
     }
 
     #[test]

crates/aether-scheduler-core/src/request_candidate.rs

@@ -153,7 +153,7 @@ pub fn resolve_report_request_candidate_slot(
         proxy,
     } = metadata;
     let request_id = request_id?;
-    let synthesized_extra_data = build_report_candidate_extra_data(
+    let synthesized_extra_data = build_report_candidate_extra_data(ReportCandidateExtraDataInput {
         client_api_format,
         provider_api_format,
         upstream_url,
@@ -162,7 +162,7 @@ pub fn resolve_report_request_candidate_slot(
         header_rules,
         body_rules,
         proxy,
-    );
+    });
     let created_at_unix_ms = matched_candidate
         .as_ref()
         .map(|candidate| candidate.created_at_unix_ms)
@@ -316,16 +316,16 @@ pub fn build_local_request_candidate_status_record(
         .filter(|value| !value.is_empty())?;
     let metadata = parse_request_candidate_report_context(report_context)?;
     let candidate_index = metadata.candidate_index?;
-    let extra_data = build_report_candidate_extra_data(
-        metadata.client_api_format.clone(),
-        metadata.provider_api_format.clone(),
-        metadata.upstream_url.clone(),
-        metadata.mapped_model.clone(),
-        metadata.key_name.clone(),
-        metadata.header_rules.clone(),
-        metadata.body_rules.clone(),
-        metadata.proxy.clone(),
-    );
+    let extra_data = build_report_candidate_extra_data(ReportCandidateExtraDataInput {
+        client_api_format: metadata.client_api_format.clone(),
+        provider_api_format: metadata.provider_api_format.clone(),
+        upstream_url: metadata.upstream_url.clone(),
+        mapped_model: metadata.mapped_model.clone(),
+        key_name: metadata.key_name.clone(),
+        header_rules: metadata.header_rules.clone(),
+        body_rules: metadata.body_rules.clone(),
+        proxy: metadata.proxy.clone(),
+    });
     let created_at_unix_ms = started_at_unix_ms.or(finished_at_unix_ms);
 
     Some(UpsertRequestCandidateRecord {
@@ -526,7 +526,7 @@ fn next_candidate_index(candidates: &[StoredRequestCandidate]) -> u32 {
         .unwrap_or_default()
 }
 
-fn build_report_candidate_extra_data(
+struct ReportCandidateExtraDataInput {
     client_api_format: Option<String>,
     provider_api_format: Option<String>,
     upstream_url: Option<String>,
@@ -535,7 +535,19 @@ fn build_report_candidate_extra_data(
     header_rules: Option<Value>,
     body_rules: Option<Value>,
     proxy: Option<Value>,
-) -> Option<Value> {
+}
+
+fn build_report_candidate_extra_data(input: ReportCandidateExtraDataInput) -> Option<Value> {
+    let ReportCandidateExtraDataInput {
+        client_api_format,
+        provider_api_format,
+        upstream_url,
+        mapped_model,
+        key_name,
+        header_rules,
+        body_rules,
+        proxy,
+    } = input;
     let mut extra_data = Map::with_capacity(8);
     extra_data.insert("gateway_execution_runtime".to_string(), Value::Bool(true));
     extra_data.insert("phase".to_string(), Value::String("3c_trial".to_string()));