feat: 扩展 Rust gateway 全功能模块，新增 billing/crypto/wallet crate 及完整数据层

- 新增 aether-billing、aether-crypto、aether-wallet 独立 crate - aether-data 扩展 repository 层：announcements、auth_modules、billing、 candidate_selection、gemini_file_mappings、global_models、management_tokens、 oauth_providers、proxy_nodes、quota、users、wallet 等模块 - aether-gateway 新增 api/auth/billing/control/middleware/scheduler/usage/ video_tasks/hooks/maintenance/model_fetch/provider_transport 等功能模块 - 重构 executor decision 和 gateway state 为模块目录结构 - 新增 gateway router、frontdoor 路由层及对应测试 - Python 侧 API 路由重构，新增 compat/support 模块 - 前端 Logo 组件更新及 Provider 管理页面调整
2026-10-10 19:29:50 +08:00 · 2026-03-31 19:19:04 +08:00
parent b5a0070023
commit ddf18fed9a
690 changed files with 235085 additions and 16299 deletions
@@ -0,0 +1,151 @@
+async fn handle_admin_provider_oauth_start_key(
+    state: &AppState,
+    request_context: &GatewayPublicRequestContext,
+) -> Result<Response<Body>, GatewayError> {
+    let Some(key_id) = admin_provider_oauth_start_key_id(&request_context.request_path) else {
+        return Ok(build_internal_hub_error_response(
+            http::StatusCode::NOT_FOUND,
+            "Key 不存在",
+        ));
+    };
+    let key = state
+        .read_provider_catalog_keys_by_ids(std::slice::from_ref(&key_id))
+        .await?
+        .into_iter()
+        .next();
+    let Some(key) = key else {
+        return Ok(build_internal_hub_error_response(
+            http::StatusCode::NOT_FOUND,
+            "Key 不存在",
+        ));
+    };
+    if !key.auth_type.eq_ignore_ascii_case("oauth") {
+        return Ok(build_internal_hub_error_response(
+            http::StatusCode::BAD_REQUEST,
+            "该 Key 不是 oauth 认证类型",
+        ));
+    }
+
+    let provider_id = key.provider_id.clone();
+    let provider = state
+        .read_provider_catalog_providers_by_ids(std::slice::from_ref(&provider_id))
+        .await?
+        .into_iter()
+        .next();
+    let Some(provider) = provider else {
+        return Ok(build_internal_hub_error_response(
+            http::StatusCode::NOT_FOUND,
+            "Provider 不存在",
+        ));
+    };
+    let provider_type = provider.provider_type.trim().to_ascii_lowercase();
+    if !is_fixed_provider_type_for_provider_oauth(&provider_type) {
+        return Ok(build_internal_hub_error_response(
+            http::StatusCode::BAD_REQUEST,
+            "该 Provider 不是固定类型，无法使用 provider-oauth",
+        ));
+    }
+    let Some(template) = admin_provider_oauth_template(&provider_type) else {
+        return Ok(build_internal_hub_error_response(
+            http::StatusCode::BAD_REQUEST,
+            "该 Provider 不支持 OAuth 授权",
+        ));
+    };
+
+    let pkce_verifier = template.use_pkce.then(generate_provider_oauth_pkce_verifier);
+    let code_challenge = pkce_verifier.as_deref().map(provider_oauth_pkce_s256);
+    let nonce = match save_provider_oauth_state(
+        state,
+        &key_id,
+        &provider_id,
+        &provider_type,
+        pkce_verifier.as_deref(),
+    )
+    .await
+    {
+        Ok(nonce) => nonce,
+        Err(_) => {
+            return Ok(build_internal_hub_error_response(
+                http::StatusCode::SERVICE_UNAVAILABLE,
+                "provider oauth redis unavailable",
+            ));
+        }
+    };
+
+    Ok(Json(build_provider_oauth_start_response(
+        template,
+        &nonce,
+        code_challenge.as_deref(),
+    ))
+    .into_response())
+}
+
+async fn handle_admin_provider_oauth_start_provider(
+    state: &AppState,
+    request_context: &GatewayPublicRequestContext,
+) -> Result<Response<Body>, GatewayError> {
+    let Some(provider_id) = admin_provider_oauth_start_provider_id(&request_context.request_path)
+    else {
+        return Ok(build_internal_hub_error_response(
+            http::StatusCode::NOT_FOUND,
+            "Provider 不存在",
+        ));
+    };
+    let provider = state
+        .read_provider_catalog_providers_by_ids(std::slice::from_ref(&provider_id))
+        .await?
+        .into_iter()
+        .next();
+    let Some(provider) = provider else {
+        return Ok(build_internal_hub_error_response(
+            http::StatusCode::NOT_FOUND,
+            "Provider 不存在",
+        ));
+    };
+    let provider_type = provider.provider_type.trim().to_ascii_lowercase();
+    if !is_fixed_provider_type_for_provider_oauth(&provider_type) {
+        return Ok(build_internal_hub_error_response(
+            http::StatusCode::BAD_REQUEST,
+            "该 Provider 不是固定类型，无法使用 provider-oauth",
+        ));
+    }
+    if provider_type == "kiro" {
+        return Ok(build_internal_hub_error_response(
+            http::StatusCode::BAD_REQUEST,
+            "Kiro 不支持 OAuth 授权，请使用导入授权。",
+        ));
+    }
+    let Some(template) = admin_provider_oauth_template(&provider_type) else {
+        return Ok(build_internal_hub_error_response(
+            http::StatusCode::BAD_REQUEST,
+            "该 Provider 不支持 OAuth 授权",
+        ));
+    };
+
+    let pkce_verifier = template.use_pkce.then(generate_provider_oauth_pkce_verifier);
+    let code_challenge = pkce_verifier.as_deref().map(provider_oauth_pkce_s256);
+    let nonce = match save_provider_oauth_state(
+        state,
+        "",
+        &provider_id,
+        &provider_type,
+        pkce_verifier.as_deref(),
+    )
+    .await
+    {
+        Ok(nonce) => nonce,
+        Err(_) => {
+            return Ok(build_internal_hub_error_response(
+                http::StatusCode::SERVICE_UNAVAILABLE,
+                "provider oauth redis unavailable",
+            ));
+        }
+    };
+
+    Ok(Json(build_provider_oauth_start_response(
+        template,
+        &nonce,
+        code_challenge.as_deref(),
+    ))
+    .into_response())
+}