refactor ai serving modules and crates

apps/aether-gateway/src/scheduler/candidate/runtime.rs

@@ -307,7 +307,7 @@ fn read_key_oauth_invalid_map(
 fn key_requires_oauth_reauth(
     key: &StoredProviderCatalogKey,
     provider_type: &str,
-    now_unix_secs: u64,
+    _now_unix_secs: u64,
 ) -> bool {
     if !key.auth_type.trim().eq_ignore_ascii_case("oauth") {
         return false;
@@ -319,46 +319,41 @@ fn key_requires_oauth_reauth(
         .map(str::trim)
         .unwrap_or_default();
     if !invalid_reason.is_empty() {
-        return oauth_invalid_reason_requires_reauth(key, provider_type, invalid_reason);
+        return oauth_invalid_reason_is_hard_account_block(key, provider_type, invalid_reason);
     }
 
-    key.expires_at_unix_secs
-        .is_some_and(|value| value > 0 && value <= now_unix_secs)
-        && !kiro_key_has_refreshable_session(key, provider_type)
+    false
 }
 
-fn oauth_invalid_reason_requires_reauth(
+fn oauth_invalid_reason_is_hard_account_block(
     key: &StoredProviderCatalogKey,
     provider_type: &str,
     invalid_reason: &str,
 ) -> bool {
-    if invalid_reason.starts_with("[REQUEST_FAILED]") {
-        return false;
-    }
     let account_state = admin_provider_status_pure::resolve_pool_account_state(
         Some(provider_type),
         key.upstream_metadata.as_ref(),
         Some(invalid_reason),
     );
-    if account_state.blocked && !account_state.recoverable {
-        return true;
-    }
-    if invalid_reason.starts_with("[REFRESH_FAILED]")
-        || invalid_reason.starts_with("[ACCOUNT_BLOCK]")
-        || invalid_reason.starts_with("[OAUTH_EXPIRED]")
-    {
-        return true;
-    }
-    !kiro_key_has_refreshable_session(key, provider_type)
+    account_state.blocked
+        && !account_state.recoverable
+        && account_state
+            .code
+            .as_deref()
+            .is_some_and(oauth_account_state_code_is_hard_block)
 }
 
-fn kiro_key_has_refreshable_session(key: &StoredProviderCatalogKey, provider_type: &str) -> bool {
-    provider_type.trim().eq_ignore_ascii_case("kiro")
-        && key
-            .encrypted_auth_config
-            .as_deref()
-            .map(str::trim)
-            .is_some_and(|value| !value.is_empty())
+fn oauth_account_state_code_is_hard_block(code: &str) -> bool {
+    matches!(
+        code.trim().to_ascii_lowercase().as_str(),
+        "account_banned"
+            | "account_suspended"
+            | "account_disabled"
+            | "workspace_deactivated"
+            | "account_forbidden"
+            | "account_blocked"
+            | "account_verification"
+    )
 }
 
 fn read_provider_key_rpm_reset_at_map(