i/Aether
1
0
Fork 0
mirror of https://github.com/fawney19/Aether.git synced 2026-09-02 09:20:22 +08:00
Code Issues Packages Projects Releases Wiki Activity

Support per-format provider key auth

Browse Source
This commit is contained in:
fawney19
2026-04-29 15:46:50 +08:00
parent 07a319259b
commit e751289dfb
67 changed files with 1244 additions and 420 deletions
Download Patch File Download Diff File Expand all files Collapse all files

5
apps/aether-gateway/src/handlers/admin/observability/monitoring/cache_payloads.rs
View File

@@ -30,7 +30,10 @@ pub(super) fn admin_monitoring_masked_provider_key_prefix(
"service_account" | "vertex_ai" => Some("[Service Account]".to_string()),
"oauth" => Some("[OAuth Token]".to_string()),
_ => {
let full_key = admin_monitoring_try_decrypt_secret(state, &key.encrypted_api_key)?;
let full_key = key
.encrypted_api_key
.as_deref()
.and_then(|ciphertext| admin_monitoring_try_decrypt_secret(state, ciphertext))?;
if full_key.len() <= 12 {
Some(format!("{full_key}***"))
} else {

2
apps/aether-gateway/src/handlers/admin/provider/delete_task.rs
View File

@@ -168,7 +168,7 @@ pub(crate) fn mapping_preview_masked_catalog_api_key(
state: &AdminAppState<'_>,
key: &StoredProviderCatalogKey,
) -> String {
let ciphertext = key.encrypted_api_key.trim();
let ciphertext = key.encrypted_api_key.as_deref().unwrap_or("").trim();
if ciphertext.is_empty() {
return "***".to_string();
}

2
apps/aether-gateway/src/handlers/admin/provider/oauth/provisioning.rs
View File

@@ -159,7 +159,7 @@ pub(crate) async fn update_existing_provider_oauth_catalog_key(
.map(|duration| duration.as_secs())
.unwrap_or(0);
let mut updated = existing_key.clone();
updated.encrypted_api_key = encrypted_api_key;
updated.encrypted_api_key = Some(encrypted_api_key);
updated.encrypted_auth_config = Some(encrypted_auth_config);
updated.api_formats = provider_oauth_catalog_key_api_formats(provider_type, api_formats);
updated.is_active = true;

4
apps/aether-gateway/src/handlers/admin/provider/pool_admin/payloads.rs
View File

@@ -831,6 +831,10 @@ pub(super) fn build_admin_pool_key_payload(
payload.insert("key_name".to_string(), json!(key.name));
payload.insert("is_active".to_string(), json!(key.is_active));
payload.insert("auth_type".to_string(), json!(key.auth_type));
payload.insert(
"auth_type_by_format".to_string(),
json!(key.auth_type_by_format),
);
payload.insert(
"credential_kind".to_string(),
json!(auth_semantics.credential_kind().as_str()),

1
apps/aether-gateway/src/handlers/admin/provider/pool_admin/read_routes/resolve_selection.rs
View File

@@ -98,6 +98,7 @@ pub(super) async fn build_admin_pool_resolve_selection_response(
"key_id": key.id,
"key_name": key.name,
"auth_type": key.auth_type,
"auth_type_by_format": key.auth_type_by_format,
"credential_kind": auth_semantics.credential_kind().as_str(),
"runtime_auth_kind": auth_semantics.runtime_auth_kind().as_str(),
"oauth_managed": auth_semantics.oauth_managed(),

4
apps/aether-gateway/src/handlers/admin/provider/shared/payloads.rs
View File

@@ -12,6 +12,8 @@ pub(crate) struct AdminProviderKeyCreateRequest {
#[serde(default)]
pub(crate) auth_type: Option<String>,
#[serde(default)]
pub(crate) auth_type_by_format: Option<serde_json::Value>,
#[serde(default)]
pub(crate) auth_config: Option<serde_json::Value>,
pub(crate) name: String,
#[serde(default)]
@@ -49,6 +51,8 @@ pub(crate) struct AdminProviderKeyUpdateRequest {
#[serde(default)]
pub(crate) auth_type: Option<String>,
#[serde(default)]
pub(crate) auth_type_by_format: Option<serde_json::Value>,
#[serde(default)]
pub(crate) auth_config: Option<serde_json::Value>,
#[serde(default)]
pub(crate) name: Option<String>,

47
apps/aether-gateway/src/handlers/admin/provider/write/keys/create.rs
View File

@@ -1,7 +1,7 @@
use crate::handlers::admin::provider::shared::payloads::AdminProviderKeyCreateRequest;
use crate::handlers::admin::provider::write::normalize::{
normalize_api_format_json_object_keys, normalize_api_format_list, normalize_auth_type,
validate_vertex_api_formats,
normalize_auth_type_by_format, validate_vertex_api_formats,
};
use crate::handlers::admin::request::AdminAppState;
use crate::handlers::admin::shared::{
@@ -33,6 +33,15 @@ pub(crate) async fn build_admin_create_provider_key_record(
);
let auth_type = normalize_auth_type(payload.auth_type.as_deref())?;
validate_vertex_api_formats(&provider.provider_type, &auth_type, &api_formats)?;
let auth_type_by_format = if matches!(auth_type.as_str(), "api_key" | "bearer") {
normalize_auth_type_by_format(
payload.auth_type_by_format,
"auth_type_by_format",
&api_formats,
)?
} else {
None
};
let api_key = payload.api_key.unwrap_or_default().trim().to_string();
let auth_config = normalize_json_object(payload.auth_config, "auth_config")?;
@@ -42,9 +51,6 @@ pub(crate) async fn build_admin_create_provider_key_record(
.cloned();
match auth_type.as_str() {
"api_key" if api_key.is_empty() => {
return Err("API Key 认证模式下 api_key 为必填字段".to_string());
}
"service_account" if auth_config_object.is_none() => {
return Err("Service Account 认证模式下 auth_config 为必填字段".to_string());
}
@@ -59,15 +65,18 @@ pub(crate) async fn build_admin_create_provider_key_record(
.await
.map_err(|err| format!("{err:?}"))?;
if auth_type == "api_key" {
if matches!(auth_type.as_str(), "api_key" | "bearer") && !api_key.is_empty() {
for existing in existing_keys
.iter()
.filter(|existing| existing.auth_type.trim().eq_ignore_ascii_case("api_key"))
.filter(|existing| raw_secret_auth_type(&existing.auth_type))
{
let Some(decrypted) = decrypt_catalog_secret_with_fallbacks(
state.encryption_key(),
&existing.encrypted_api_key,
) else {
let Some(decrypted) = existing
.encrypted_api_key
.as_deref()
.and_then(|ciphertext| {
decrypt_catalog_secret_with_fallbacks(state.encryption_key(), ciphertext)
})
else {
continue;
};
if decrypted != "__placeholder__" && decrypted == api_key {
@@ -116,10 +125,12 @@ pub(crate) async fn build_admin_create_provider_key_record(
}
let encrypted_api_key = match auth_type.as_str() {
"api_key" => encrypt_catalog_secret_with_fallbacks(state, &api_key),
_ => encrypt_catalog_secret_with_fallbacks(state, "__placeholder__"),
}
.ok_or_else(|| "gateway 未配置 provider key 加密密钥".to_string())?;
"api_key" | "bearer" if !api_key.is_empty() => Some(
encrypt_catalog_secret_with_fallbacks(state, &api_key)
.ok_or_else(|| "gateway 未配置 provider key 加密密钥".to_string())?,
),
_ => None,
};
let encrypted_auth_config = auth_config
.as_ref()
@@ -180,7 +191,15 @@ pub(crate) async fn build_admin_create_provider_key_record(
normalize_string_list(payload.model_exclude_patterns).map(|value| json!(value));
key.health_by_format = Some(json!({}));
key.circuit_breaker_by_format = Some(json!({}));
key.auth_type_by_format = auth_type_by_format;
key.created_at_unix_ms = Some(now_unix_secs);
key.updated_at_unix_secs = Some(now_unix_secs);
Ok(key)
}
fn raw_secret_auth_type(value: &str) -> bool {
matches!(
value.trim().to_ascii_lowercase().as_str(),
"api_key" | "bearer"
)
}

94
apps/aether-gateway/src/handlers/admin/provider/write/keys/update.rs
View File

@@ -1,7 +1,7 @@
use crate::handlers::admin::provider::shared::payloads::AdminProviderKeyUpdatePatch;
use crate::handlers::admin::provider::write::normalize::{
normalize_api_format_json_object_keys, normalize_api_format_list, normalize_auth_type,
validate_vertex_api_formats,
normalize_auth_type_by_format, validate_vertex_api_formats,
};
use crate::handlers::admin::request::AdminAppState;
use crate::handlers::admin::shared::{
@@ -48,10 +48,6 @@ pub(crate) async fn build_admin_update_provider_key_record(
.as_deref()
.map(str::trim)
.map(ToOwned::to_owned);
if api_key_present && api_key_value.as_deref() == Some("") {
return Err("api_key 不能为空".to_string());
}
let auth_config_present = fields.contains("auth_config");
let auth_config = normalize_json_object(payload.auth_config, "auth_config")?;
let auth_config_object = auth_config
@@ -65,31 +61,26 @@ pub(crate) async fn build_admin_update_provider_key_record(
.map_err(|err| format!("{err:?}"))?;
match target_auth_type.as_str() {
"api_key" => {
if auth_type_switch
&& matches!(
api_key_value.as_deref(),
None | Some("") | Some("__placeholder__")
)
"api_key" | "bearer" => {
if let Some(api_key) = api_key_value
.as_deref()
.filter(|value| !value.is_empty() && *value != "__placeholder__")
{
return Err("切换到 API Key 认证模式时，必须提供新的 API Key".to_string());
}
if api_key_present
&& matches!(
api_key_value.as_deref(),
None | Some("") | Some("__placeholder__")
)
{
return Err("API Key 认证模式下 api_key 不能为空".to_string());
}
if let Some(api_key) = api_key_value.as_deref() {
for existing_key in existing_keys.iter().filter(|key| {
key.id != existing.id && key.auth_type.trim().eq_ignore_ascii_case("api_key")
}) {
let Some(decrypted) = decrypt_catalog_secret_with_fallbacks(
state.encryption_key(),
&existing_key.encrypted_api_key,
) else {
for existing_key in existing_keys
.iter()
.filter(|key| key.id != existing.id && raw_secret_auth_type(&key.auth_type))
{
let Some(decrypted) =
existing_key
.encrypted_api_key
.as_deref()
.and_then(|ciphertext| {
decrypt_catalog_secret_with_fallbacks(
state.encryption_key(),
ciphertext,
)
})
else {
continue;
};
if decrypted != "__placeholder__" && decrypted == api_key {
@@ -99,9 +90,12 @@ pub(crate) async fn build_admin_update_provider_key_record(
));
}
}
updated.encrypted_api_key =
updated.encrypted_api_key = Some(
encrypt_catalog_secret_with_fallbacks(state, api_key)
.ok_or_else(|| "gateway 未配置 provider key 加密密钥".to_string())?;
.ok_or_else(|| "gateway 未配置 provider key 加密密钥".to_string())?,
);
} else if api_key_present {
updated.encrypted_api_key = None;
}
updated.encrypted_auth_config = None;
}
@@ -120,9 +114,7 @@ pub(crate) async fn build_admin_update_provider_key_record(
return Err("Service Account 认证模式下不允许直接填写 api_key".to_string());
}
if auth_type_switch || api_key_present {
updated.encrypted_api_key =
encrypt_catalog_secret_with_fallbacks(state, "__placeholder__")
.ok_or_else(|| "gateway 未配置 provider key 加密密钥".to_string())?;
updated.encrypted_api_key = None;
}
if let Some(client_email) = auth_config_object
.as_ref()
@@ -181,9 +173,7 @@ pub(crate) async fn build_admin_update_provider_key_record(
return Err("OAuth 认证模式下不允许直接填写 api_key".to_string());
}
if auth_type_switch {
updated.encrypted_api_key =
encrypt_catalog_secret_with_fallbacks(state, "__placeholder__")
.ok_or_else(|| "gateway 未配置 provider key 加密密钥".to_string())?;
updated.encrypted_api_key = None;
updated.encrypted_auth_config = None;
}
}
@@ -197,6 +187,7 @@ pub(crate) async fn build_admin_update_provider_key_record(
);
if managed_fixed_oauth_key {
updated.api_formats = None;
updated.auth_type_by_format = None;
} else {
validate_vertex_api_formats(&provider.provider_type, &target_auth_type, &api_formats)?;
updated.api_formats = Some(json!(api_formats));
@@ -211,6 +202,26 @@ pub(crate) async fn build_admin_update_provider_key_record(
}
}
let effective_api_formats =
normalize_api_format_list(json_string_list(updated.api_formats.as_ref()));
if matches!(target_auth_type.as_str(), "api_key" | "bearer") {
if fields.contains("auth_type_by_format") {
updated.auth_type_by_format = normalize_auth_type_by_format(
payload.auth_type_by_format,
"auth_type_by_format",
&effective_api_formats,
)?;
} else if fields.contains("api_formats") {
updated.auth_type_by_format = normalize_auth_type_by_format(
updated.auth_type_by_format.clone(),
"auth_type_by_format",
&effective_api_formats,
)?;
}
} else {
updated.auth_type_by_format = None;
}
updated.auth_type = target_auth_type;
if let Some(name) = payload.name {
@@ -285,7 +296,7 @@ pub(crate) async fn build_admin_update_provider_key_record(
if fields.contains("fingerprint") {
updated.fingerprint = normalize_json_object(payload.fingerprint, "fingerprint")?;
}
if auth_config_present && !auth_type_switch && updated.auth_type != "api_key" {
if auth_config_present && !auth_type_switch && !raw_secret_auth_type(&updated.auth_type) {
updated.encrypted_auth_config = auth_config
.as_ref()
.map(serde_json::to_string)
@@ -304,3 +315,10 @@ pub(crate) async fn build_admin_update_provider_key_record(
.map(|duration| duration.as_secs());
Ok(updated)
}
fn raw_secret_auth_type(value: &str) -> bool {
matches!(
value.trim().to_ascii_lowercase().as_str(),
"api_key" | "bearer"
)
}

63
apps/aether-gateway/src/handlers/admin/provider/write/normalize.rs
View File

@@ -42,6 +42,45 @@ pub(crate) fn normalize_api_format_json_object_keys(
Ok(Some(serde_json::Value::Object(normalized)))
}
pub(crate) fn normalize_auth_type_by_format(
value: Option<serde_json::Value>,
field_name: &str,
api_formats: &[String],
) -> Result<Option<serde_json::Value>, String> {
let Some(value) = normalize_json_like_object(value, field_name)? else {
return Ok(None);
};
let serde_json::Value::Object(map) = value else {
return Ok(Some(value));
};
let allowed = api_formats.iter().cloned().collect::<BTreeSet<_>>();
let mut normalized = serde_json::Map::new();
for (key, value) in map {
let canonical = crate::ai_pipeline::normalize_api_format_alias(&key);
if !allowed.is_empty() && !allowed.contains(&canonical) {
return Err(format!("{field_name} 包含未选择的 API 格式: {canonical}"));
}
let Some(auth_type) = value
.as_str()
.map(str::trim)
.filter(|value| !value.is_empty())
else {
return Err(format!("{field_name}.{canonical} 必须是字符串"));
};
let auth_type = match auth_type.to_ascii_lowercase().as_str() {
"api_key" | "apikey" | "api-key" => "api_key",
"bearer" | "bearer_token" | "bearer-token" | "authorization" => "bearer",
_ => return Err(format!("{field_name}.{canonical} 仅支持 api_key / bearer")),
};
normalized.insert(canonical, serde_json::Value::String(auth_type.to_string()));
}
if normalized.is_empty() {
Ok(None)
} else {
Ok(Some(serde_json::Value::Object(normalized)))
}
}
pub(crate) fn normalize_auth_type(value: Option<&str>) -> Result<String, String> {
let auth_type = value.unwrap_or("api_key").trim().to_ascii_lowercase();
match auth_type.as_str() {
@@ -111,7 +150,7 @@ fn normalize_json_like_object(
mod tests {
use super::{
normalize_api_format_json_object_keys, normalize_api_format_list, normalize_auth_type,
normalize_pool_advanced_config, validate_vertex_api_formats,
normalize_auth_type_by_format, normalize_pool_advanced_config, validate_vertex_api_formats,
};
use serde_json::json;
@@ -180,6 +219,28 @@ mod tests {
);
}
#[test]
fn normalize_auth_type_by_format_accepts_per_format_bearer_override() {
assert_eq!(
normalize_auth_type_by_format(
Some(json!({
"claude:messages": "bearer",
"gemini:generate_content": "api-key"
})),
"auth_type_by_format",
&[
"claude:messages".to_string(),
"gemini:generate_content".to_string(),
],
)
.expect("auth map should normalize"),
Some(json!({
"claude:messages": "bearer",
"gemini:generate_content": "api_key"
}))
);
}
#[test]
fn validate_vertex_api_formats_uses_canonical_message_formats() {
assert!(validate_vertex_api_formats(

18
apps/aether-gateway/src/handlers/admin/provider/write/reveal.rs
View File

@@ -2,6 +2,7 @@ fn normalize_reveal_auth_type(value: &str) -> &str {
match value.trim().to_ascii_lowercase().as_str() {
"service_account" | "vertex_ai" => "service_account",
"oauth" => "oauth",
"bearer" => "bearer",
_ => "api_key",
}
}
@@ -44,8 +45,10 @@ pub(crate) fn build_admin_reveal_key_payload(
"auth_config": auth_config,
}));
}
let decrypted = state
.decrypt_catalog_secret_with_fallbacks(&key.encrypted_api_key)
let decrypted = key
.encrypted_api_key
.as_deref()
.and_then(|ciphertext| state.decrypt_catalog_secret_with_fallbacks(ciphertext))
.ok_or_else(|| {
"无法解密认证配置，可能是加密密钥已更改。请重新添加该密钥。".to_string()
})?;
@@ -58,9 +61,14 @@ pub(crate) fn build_admin_reveal_key_payload(
}));
}
let decrypted = state
.decrypt_catalog_secret_with_fallbacks(&key.encrypted_api_key)
.ok_or_else(|| "无法解密 API Key，可能是加密密钥已更改。请重新添加该密钥。".to_string())?;
let decrypted = match key.encrypted_api_key.as_deref().map(str::trim) {
Some(ciphertext) if !ciphertext.is_empty() => state
.decrypt_catalog_secret_with_fallbacks(ciphertext)
.ok_or_else(|| {
"无法解密 API Key，可能是加密密钥已更改。请重新添加该密钥。".to_string()
})?,
_ => String::new(),
};
Ok(json!({
"auth_type": auth_type,
"api_key": decrypted,

37
apps/aether-gateway/src/handlers/admin/request/system/import.rs
View File

@@ -250,20 +250,18 @@ fn apply_imported_oauth_key_credentials(
record: &mut aether_data_contracts::repository::provider_catalog::StoredProviderCatalogKey,
) -> Result<(), String> {
if let Some(api_key_value) = raw_key.get("api_key") {
let plaintext = match api_key_value {
Value::String(raw) => {
let trimmed = raw.trim();
if trimmed.is_empty() {
"__placeholder__"
} else {
trimmed
}
}
_ => "__placeholder__",
let plaintext = api_key_value
.as_str()
.map(str::trim)
.filter(|value| !value.is_empty());
record.encrypted_api_key = match plaintext {
Some(plaintext) => Some(
state
.encrypt_catalog_secret_with_fallbacks(plaintext)
.ok_or_else(|| "gateway 未配置 provider key 加密密钥".to_string())?,
),
None => None,
};
record.encrypted_api_key = state
.encrypt_catalog_secret_with_fallbacks(plaintext)
.ok_or_else(|| "gateway 未配置 provider key 加密密钥".to_string())?;
}
if raw_key.contains_key("auth_config") {
@@ -1118,14 +1116,15 @@ impl<'a> AdminAppState<'a> {
.filter(|value| !value.is_empty())
.map(ToOwned::to_owned);
existing_keys.iter().position(|existing_key| {
let decrypted_existing = existing_key
.encrypted_api_key
.as_deref()
.and_then(|ciphertext| {
self.decrypt_catalog_secret_with_fallbacks(ciphertext)
});
target_key
.as_deref()
.zip(
self.decrypt_catalog_secret_with_fallbacks(
&existing_key.encrypted_api_key,
)
.as_deref(),
)
.zip(decrypted_existing.as_deref())
.is_some_and(|(target, decrypted)| decrypted == target)
})
} else if matches!(auth_type.as_str(), "service_account" | "vertex_ai") {

9
apps/aether-gateway/src/handlers/admin/system/shared/export/providers.rs
View File

@@ -106,10 +106,10 @@ pub(crate) async fn build_admin_system_export_providers_payload(
})
.map(serde_json::Value::String);
AdminSystemConfigProviderKey {
api_key: Some(
decrypt_admin_system_export_secret(state, &key.encrypted_api_key)
.unwrap_or_default(),
),
api_key: key.encrypted_api_key.as_deref().map(|ciphertext| {
decrypt_admin_system_export_secret(state, ciphertext)
.unwrap_or_default()
}),
auth_type: Some(key.auth_type.clone()),
auth_config,
name: Some(key.name.clone()),
@@ -119,6 +119,7 @@ pub(crate) async fn build_admin_system_export_providers_payload(
rate_multipliers: key.rate_multipliers.clone(),
internal_priority: Some(key.internal_priority),
global_priority_by_format: key.global_priority_by_format.clone(),
auth_type_by_format: key.auth_type_by_format.clone(),
rpm_limit: key.rpm_limit,
allowed_models: key.allowed_models.as_ref().and_then(|value| {
value.as_array().map(|items| {

40
apps/aether-gateway/src/handlers/shared/catalog.rs
View File

@@ -106,19 +106,29 @@ pub(crate) fn masked_catalog_api_key(state: &AppState, key: &StoredProviderCatal
match key.auth_type.trim() {
"service_account" | "vertex_ai" => "[Service Account]".to_string(),
"oauth" => "[OAuth Token]".to_string(),
_ => decrypt_catalog_secret_with_fallbacks(state.encryption_key(), &key.encrypted_api_key)
.map(|value| {
if value.len() <= 12 {
format!("{value}***")
} else {
format!(
"{}***{}",
&value[..8],
&value[value.len().saturating_sub(4)..]
)
}
})
.unwrap_or_else(|| "***ERROR***".to_string()),
_ => {
let Some(ciphertext) = key
.encrypted_api_key
.as_deref()
.map(str::trim)
.filter(|value| !value.is_empty())
else {
return "[未设置]".to_string();
};
decrypt_catalog_secret_with_fallbacks(state.encryption_key(), ciphertext)
.map(|value| {
if value.len() <= 12 {
format!("{value}***")
} else {
format!(
"{}***{}",
&value[..8],
&value[value.len().saturating_sub(4)..]
)
}
})
.unwrap_or_else(|| "***ERROR***".to_string())
}
}
}
@@ -1267,6 +1277,10 @@ pub(crate) fn build_admin_provider_key_response(
);
payload.insert("api_key_plain".to_string(), serde_json::Value::Null);
payload.insert("auth_type".to_string(), json!(key.auth_type));
payload.insert(
"auth_type_by_format".to_string(),
json!(key.auth_type_by_format),
);
payload.insert(
"credential_kind".to_string(),
json!(auth_semantics.credential_kind().as_str()),