Support per-format provider key auth

2026-09-02 09:20:22 +08:00 · 2026-04-29 15:46:50 +08:00
parent 07a319259b
commit e751289dfb
67 changed files with 1244 additions and 420 deletions
--- a/apps/aether-gateway/src/tests/ai_execute/stream/decision.rs
+++ b/apps/aether-gateway/src/tests/ai_execute/stream/decision.rs
@@ -339,9 +339,10 @@ async fn gateway_executes_openai_chat_stream_via_local_decision_gate_without_exe
    backup_key.id = "key-openai-local-stream-2".to_string();
    backup_key.provider_id = "provider-openai-local-stream-2".to_string();
    backup_key.name = "backup".to_string();
-    backup_key.encrypted_api_key =
+    backup_key.encrypted_api_key = Some(
        encrypt_python_fernet_plaintext(DEVELOPMENT_ENCRYPTION_KEY, "sk-upstream-openai-backup")
-            .expect("api key should encrypt");
+            .expect("api key should encrypt"),
+    );
    let (upstream_url, upstream_handle) = start_server(upstream).await;
    let (provider_url, provider_handle) = start_server(provider).await;
    let mut primary_endpoint = sample_provider_catalog_endpoint();
--- a/apps/aether-gateway/src/tests/ai_execute/sync/chat/failover.rs
+++ b/apps/aether-gateway/src/tests/ai_execute/sync/chat/failover.rs
@@ -311,9 +311,10 @@ async fn gateway_skips_unsupported_local_openai_chat_sync_candidate_before_tryin
    supported_key.id = "key-openai-skip-local-2".to_string();
    supported_key.provider_id = "provider-openai-skip-local-2".to_string();
    supported_key.name = "backup".to_string();
-    supported_key.encrypted_api_key =
+    supported_key.encrypted_api_key = Some(
        encrypt_python_fernet_plaintext(DEVELOPMENT_ENCRYPTION_KEY, "sk-upstream-openai-backup")
-            .expect("api key should encrypt");
+            .expect("api key should encrypt"),
+    );
    let provider_catalog_repository = Arc::new(InMemoryProviderCatalogReadRepository::seed(
        vec![unsupported_provider, supported_provider],
        vec![unsupported_endpoint, supported_endpoint],
--- a/apps/aether-gateway/src/tests/ai_execute/sync/chat/local_decision.rs
+++ b/apps/aether-gateway/src/tests/ai_execute/sync/chat/local_decision.rs
@@ -293,9 +293,10 @@ async fn gateway_executes_openai_chat_sync_via_local_decision_gate_without_execu
    backup_key.id = "key-openai-local-2".to_string();
    backup_key.provider_id = "provider-openai-local-2".to_string();
    backup_key.name = "backup".to_string();
-    backup_key.encrypted_api_key =
+    backup_key.encrypted_api_key = Some(
        encrypt_python_fernet_plaintext(DEVELOPMENT_ENCRYPTION_KEY, "sk-upstream-openai-backup")
-            .expect("api key should encrypt");
+            .expect("api key should encrypt"),
+    );
    let (upstream_url, upstream_handle) = start_server(upstream).await;
    let (provider_url, provider_handle) = start_server(provider).await;
    let mut primary_endpoint = sample_provider_catalog_endpoint();
--- a/apps/aether-gateway/src/tests/architecture/ai_pipeline.rs
+++ b/apps/aether-gateway/src/tests/architecture/ai_pipeline.rs
@@ -2848,7 +2848,9 @@ fn retired_api_format_occurrences_are_whitelisted() {
        "crates/aether-ai-formats/src/matrix.rs",
        "crates/aether-ai-formats/src/registry.rs",
        "crates/aether-ai-pipeline/src/conversion/registry.rs",
+        "crates/aether-data/src/migrate.rs",
        "crates/aether-usage-runtime/src/report.rs",
+        "frontend/src/api/endpoints/types/__tests__/api-format.spec.ts",
    ];
    let allowed = allowed_paths
        .into_iter()
--- a/apps/aether-gateway/src/tests/control/admin/endpoints/keys.rs
+++ b/apps/aether-gateway/src/tests/control/admin/endpoints/keys.rs
@@ -799,7 +799,10 @@ async fn gateway_updates_admin_provider_key_locally_with_trusted_admin_principal
    assert!(!reloaded[0].is_active);
    let decrypted = decrypt_python_fernet_ciphertext(
        DEVELOPMENT_ENCRYPTION_KEY,
-        &reloaded[0].encrypted_api_key,
+        reloaded[0]
+            .encrypted_api_key
+            .as_deref()
+            .expect("api key should be present"),
    )
    .expect("ciphertext should decrypt");
    assert_eq!(decrypted, "sk-updated-openai");
--- a/apps/aether-gateway/src/tests/control/admin/oauth.rs
+++ b/apps/aether-gateway/src/tests/control/admin/oauth.rs
@@ -421,9 +421,14 @@ async fn gateway_handles_admin_provider_oauth_device_poll_locally_with_trusted_a
        persisted.proxy,
        Some(json!({"node_id": "proxy-node-kiro", "enabled": true}))
    );
-    let decrypted_api_key =
-        decrypt_python_fernet_ciphertext(DEVELOPMENT_ENCRYPTION_KEY, &persisted.encrypted_api_key)
-            .expect("api key should decrypt");
+    let decrypted_api_key = decrypt_python_fernet_ciphertext(
+        DEVELOPMENT_ENCRYPTION_KEY,
+        persisted
+            .encrypted_api_key
+            .as_deref()
+            .expect("api key should be present"),
+    )
+    .expect("api key should decrypt");
    assert_eq!(decrypted_api_key, expected_access_token);
    let decrypted_auth_config = decrypt_python_fernet_ciphertext(
        DEVELOPMENT_ENCRYPTION_KEY,
@@ -729,9 +734,14 @@ async fn gateway_revalidates_kiro_device_poll_via_idc_refresh_and_backfills_emai
        persisted.proxy,
        Some(json!({"node_id": "proxy-node-kiro", "enabled": true}))
    );
-    let decrypted_api_key =
-        decrypt_python_fernet_ciphertext(DEVELOPMENT_ENCRYPTION_KEY, &persisted.encrypted_api_key)
-            .expect("api key should decrypt");
+    let decrypted_api_key = decrypt_python_fernet_ciphertext(
+        DEVELOPMENT_ENCRYPTION_KEY,
+        persisted
+            .encrypted_api_key
+            .as_deref()
+            .expect("api key should be present"),
+    )
+    .expect("api key should decrypt");
    assert_eq!(decrypted_api_key, expected_refreshed_access_token);
    let decrypted_auth_config = decrypt_python_fernet_ciphertext(
        DEVELOPMENT_ENCRYPTION_KEY,
@@ -1473,9 +1483,14 @@ async fn gateway_batch_imports_admin_provider_oauth_locally_with_trusted_admin_p
        persisted.proxy,
        Some(json!({"node_id": "proxy-node-batch-import", "enabled": true}))
    );
-    let decrypted_api_key =
-        decrypt_python_fernet_ciphertext(DEVELOPMENT_ENCRYPTION_KEY, &persisted.encrypted_api_key)
-            .expect("api key should decrypt");
+    let decrypted_api_key = decrypt_python_fernet_ciphertext(
+        DEVELOPMENT_ENCRYPTION_KEY,
+        persisted
+            .encrypted_api_key
+            .as_deref()
+            .expect("api key should be present"),
+    )
+    .expect("api key should decrypt");
    assert_eq!(decrypted_api_key, "batch-imported-codex-access-token");

    gateway_handle.abort();
@@ -1919,9 +1934,14 @@ async fn gateway_completes_admin_provider_oauth_key_locally_with_trusted_admin_p
        .await
        .expect("keys should load");
    let persisted = reloaded.first().expect("persisted key should exist");
-    let decrypted_api_key =
-        decrypt_python_fernet_ciphertext(DEVELOPMENT_ENCRYPTION_KEY, &persisted.encrypted_api_key)
-            .expect("api key should decrypt");
+    let decrypted_api_key = decrypt_python_fernet_ciphertext(
+        DEVELOPMENT_ENCRYPTION_KEY,
+        persisted
+            .encrypted_api_key
+            .as_deref()
+            .expect("api key should be present"),
+    )
+    .expect("api key should decrypt");
    assert_eq!(decrypted_api_key, "new-codex-access-token");
    let decrypted_auth_config = decrypt_python_fernet_ciphertext(
        DEVELOPMENT_ENCRYPTION_KEY,
@@ -2104,9 +2124,14 @@ async fn gateway_completes_admin_provider_oauth_provider_locally_with_trusted_ad
        persisted.proxy,
        Some(json!({"node_id": "proxy-node-codex-oauth", "enabled": true}))
    );
-    let decrypted_api_key =
-        decrypt_python_fernet_ciphertext(DEVELOPMENT_ENCRYPTION_KEY, &persisted.encrypted_api_key)
-            .expect("api key should decrypt");
+    let decrypted_api_key = decrypt_python_fernet_ciphertext(
+        DEVELOPMENT_ENCRYPTION_KEY,
+        persisted
+            .encrypted_api_key
+            .as_deref()
+            .expect("api key should be present"),
+    )
+    .expect("api key should decrypt");
    assert_eq!(decrypted_api_key, "provider-codex-access-token");
    let decrypted_auth_config = decrypt_python_fernet_ciphertext(
        DEVELOPMENT_ENCRYPTION_KEY,
@@ -2275,9 +2300,14 @@ async fn gateway_imports_admin_provider_oauth_refresh_token_locally_with_trusted
        persisted.proxy,
        Some(json!({"node_id": "proxy-node-codex-import", "enabled": true}))
    );
-    let decrypted_api_key =
-        decrypt_python_fernet_ciphertext(DEVELOPMENT_ENCRYPTION_KEY, &persisted.encrypted_api_key)
-            .expect("api key should decrypt");
+    let decrypted_api_key = decrypt_python_fernet_ciphertext(
+        DEVELOPMENT_ENCRYPTION_KEY,
+        persisted
+            .encrypted_api_key
+            .as_deref()
+            .expect("api key should be present"),
+    )
+    .expect("api key should decrypt");
    assert_eq!(decrypted_api_key, "imported-codex-access-token");
    let decrypted_auth_config = decrypt_python_fernet_ciphertext(
        DEVELOPMENT_ENCRYPTION_KEY,
@@ -2452,9 +2482,14 @@ async fn gateway_imports_admin_provider_oauth_refresh_token_over_active_expired_
    );
    assert_eq!(persisted.oauth_invalid_at_unix_secs, None);
    assert_eq!(persisted.oauth_invalid_reason, None);
-    let decrypted_api_key =
-        decrypt_python_fernet_ciphertext(DEVELOPMENT_ENCRYPTION_KEY, &persisted.encrypted_api_key)
-            .expect("api key should decrypt");
+    let decrypted_api_key = decrypt_python_fernet_ciphertext(
+        DEVELOPMENT_ENCRYPTION_KEY,
+        persisted
+            .encrypted_api_key
+            .as_deref()
+            .expect("api key should be present"),
+    )
+    .expect("api key should decrypt");
    assert_eq!(decrypted_api_key, "imported-expired-codex-access-token");
    let decrypted_auth_config = decrypt_python_fernet_ciphertext(
        DEVELOPMENT_ENCRYPTION_KEY,
@@ -4105,7 +4140,10 @@ async fn gateway_refreshes_admin_provider_oauth_key_locally_with_trusted_admin_p
        .expect("refreshed key should exist");
    let decrypted_api_key = decrypt_python_fernet_ciphertext(
        DEVELOPMENT_ENCRYPTION_KEY,
-        stored_key.encrypted_api_key.as_str(),
+        stored_key
+            .encrypted_api_key
+            .as_deref()
+            .expect("api key should be present"),
    )
    .expect("refreshed api key should decrypt");
    assert_eq!(decrypted_api_key, "refreshed-codex-access-token");
--- a/apps/aether-gateway/src/tests/control/admin/system_import.rs
+++ b/apps/aether-gateway/src/tests/control/admin/system_import.rs
@@ -348,8 +348,14 @@ async fn gateway_imports_admin_system_config_locally_and_persists_data() {
        .expect("keys should load");
    assert_eq!(keys.len(), 1);
    assert_eq!(
-        decrypt_python_fernet_ciphertext(DEVELOPMENT_ENCRYPTION_KEY, &keys[0].encrypted_api_key)
-            .expect("api key should decrypt"),
+        decrypt_python_fernet_ciphertext(
+            DEVELOPMENT_ENCRYPTION_KEY,
+            keys[0]
+                .encrypted_api_key
+                .as_deref()
+                .expect("api key should be present"),
+        )
+        .expect("api key should decrypt"),
        "sk-import-123"
    );

@@ -1018,8 +1024,14 @@ async fn gateway_imports_oauth_provider_key_credentials_from_admin_system_config
    assert_eq!(keys.len(), 1);
    assert_eq!(keys[0].auth_type, "oauth");
    assert_eq!(
-        decrypt_python_fernet_ciphertext(DEVELOPMENT_ENCRYPTION_KEY, &keys[0].encrypted_api_key)
-            .expect("oauth access token should decrypt"),
+        decrypt_python_fernet_ciphertext(
+            DEVELOPMENT_ENCRYPTION_KEY,
+            keys[0]
+                .encrypted_api_key
+                .as_deref()
+                .expect("api key should be present"),
+        )
+        .expect("oauth access token should decrypt"),
        "oauth-access-token-1"
    );
    let auth_config = decrypt_python_fernet_ciphertext(
@@ -1108,8 +1120,14 @@ async fn gateway_overwrites_oauth_provider_key_credentials_from_admin_system_imp
    assert_eq!(keys.len(), 1);
    assert_eq!(keys[0].name, "oauth-primary");
    assert_eq!(
-        decrypt_python_fernet_ciphertext(DEVELOPMENT_ENCRYPTION_KEY, &keys[0].encrypted_api_key)
-            .expect("oauth access token should decrypt"),
+        decrypt_python_fernet_ciphertext(
+            DEVELOPMENT_ENCRYPTION_KEY,
+            keys[0]
+                .encrypted_api_key
+                .as_deref()
+                .expect("api key should be present"),
+        )
+        .expect("oauth access token should decrypt"),
        "oauth-access-token-new"
    );
    let auth_config = decrypt_python_fernet_ciphertext(
@@ -1282,8 +1300,13 @@ async fn gateway_overwrites_oauth_provider_key_credentials_from_admin_system_imp
    assert_eq!(key.oauth_invalid_reason, None);
    assert!(key.expires_at_unix_secs.is_some());
    assert_eq!(
-        decrypt_python_fernet_ciphertext(DEVELOPMENT_ENCRYPTION_KEY, &key.encrypted_api_key)
-            .expect("oauth access token should decrypt"),
+        decrypt_python_fernet_ciphertext(
+            DEVELOPMENT_ENCRYPTION_KEY,
+            key.encrypted_api_key
+                .as_deref()
+                .expect("api key should be present"),
+        )
+        .expect("oauth access token should decrypt"),
        "oauth-access-token-refreshed"
    );