fix: harden OAuth identity and cookies and correct quota and JSON display

crates/aether-admin/src/provider/oauth.rs

@@ -20,7 +20,7 @@ pub fn build_kiro_batch_import_key_name(
                 .iter()
                 .map(|byte| format!("{byte:02x}"))
                 .collect::<String>();
-            format!("kiro_{}", &hex[..6])
+            format!("账号_{}", &hex[..6])
         });
     format!("{base} ({method})")
 }
@@ -130,3 +130,36 @@ pub fn parse_admin_provider_oauth_kiro_batch_import_entries(raw_credentials: &st
         .map(|refresh_token| json!({ "refreshToken": refresh_token }))
         .collect()
 }
+
+#[cfg(test)]
+mod tests {
+    use super::build_kiro_batch_import_key_name;
+
+    #[test]
+    fn kiro_batch_import_key_name_preserves_email_and_auth_method() {
+        for method in ["social", "idc"] {
+            assert_eq!(
+                build_kiro_batch_import_key_name(
+                    Some("  [email protected]  "),
+                    Some(method),
+                    Some("refresh-token-1"),
+                ),
+                format!("[email protected] ({method})")
+            );
+        }
+    }
+
+    #[test]
+    fn kiro_batch_import_key_name_without_email_uses_generic_account_prefix() {
+        for email in [None, Some(""), Some("  ")] {
+            assert_eq!(
+                build_kiro_batch_import_key_name(email, None, Some("refresh-token-1")),
+                "账号_154f43 (social)"
+            );
+            assert_eq!(
+                build_kiro_batch_import_key_name(email, Some("idc"), Some("refresh-token-1")),
+                "账号_154f43 (idc)"
+            );
+        }
+    }
+}

crates/aether-admin/src/provider/state.rs

@@ -405,18 +405,40 @@ pub fn build_kiro_device_key_name(email: Option<&str>, refresh_token: Option<&st
                 .collect::<String>()
         })
         .unwrap_or_else(|| "unknown".to_string());
-    format!("kiro_{fallback} (idc)")
+    format!("账号_{fallback} (idc)")
 }
 
 #[cfg(test)]
 mod tests {
     use super::{
-        decode_jwt_claims, enrich_admin_provider_oauth_auth_config,
+        build_kiro_device_key_name, decode_jwt_claims, enrich_admin_provider_oauth_auth_config,
         parse_provider_oauth_callback_params, MAX_UNVERIFIED_JWT_CLAIMS_BYTES,
     };
     use base64::{engine::general_purpose::URL_SAFE_NO_PAD, Engine as _};
     use serde_json::json;
 
+    #[test]
+    fn kiro_device_key_name_preserves_email_and_auth_method() {
+        assert_eq!(
+            build_kiro_device_key_name(Some("  [email protected]  "), Some("refresh-token-1")),
+            "[email protected] (idc)"
+        );
+    }
+
+    #[test]
+    fn kiro_device_key_name_without_email_uses_generic_account_prefix() {
+        for email in [None, Some(""), Some("  ")] {
+            assert_eq!(
+                build_kiro_device_key_name(email, Some("refresh-token-1")),
+                "账号_154f43 (idc)"
+            );
+            assert_eq!(
+                build_kiro_device_key_name(email, None),
+                "账号_unknown (idc)"
+            );
+        }
+    }
+
     fn sample_unsigned_jwt(payload: serde_json::Value) -> String {
         let header = URL_SAFE_NO_PAD.encode(r#"{"alg":"none","typ":"JWT"}"#);
         let payload = URL_SAFE_NO_PAD.encode(payload.to_string());