Refine OAuth auto cleanup conditions

(cherry picked from commit 78826eae47ab18ace6931dd190a41070416b5e10)

apps/aether-gateway/src/handlers/admin/provider/oauth/errors.rs

@@ -1,5 +1,5 @@
 use crate::handlers::admin::provider::shared::payloads::{
-    OAUTH_ACCOUNT_BLOCK_PREFIX, OAUTH_EXPIRED_PREFIX,
+    OAUTH_ACCOUNT_BLOCK_PREFIX, OAUTH_EXPIRED_PREFIX, OAUTH_REFRESH_FAILED_PREFIX,
 };
 use axum::{
     body::Body,
@@ -147,6 +147,14 @@ pub(crate) fn merge_provider_oauth_refresh_failure_reason(
         return Some(refresh_reason.to_string());
     }
     if current_reason.starts_with(OAUTH_EXPIRED_PREFIX) {
+        if refresh_reason.starts_with(OAUTH_REFRESH_FAILED_PREFIX)
+            && !current_reason
+                .lines()
+                .map(str::trim)
+                .any(|line| line.starts_with(OAUTH_REFRESH_FAILED_PREFIX))
+        {
+            return Some(format!("{current_reason}\n{refresh_reason}"));
+        }
         return Some(current_reason.to_string());
     }
     if oauth_invalid_reason_is_account_level_block(Some(current_reason)) {
@@ -190,13 +198,16 @@ mod tests {
     }
 
     #[test]
-    fn refresh_failure_does_not_replace_access_token_expired_marker() {
+    fn refresh_failure_is_appended_to_access_token_expired_marker() {
         assert_eq!(
             merge_provider_oauth_refresh_failure_reason(
                 Some("[OAUTH_EXPIRED] access token invalid"),
                 "[REFRESH_FAILED] Token 续期失败 (401): refresh_token 无效",
             ),
-            Some("[OAUTH_EXPIRED] access token invalid".to_string()),
+            Some(
+                "[OAUTH_EXPIRED] access token invalid\n[REFRESH_FAILED] Token 续期失败 (401): refresh_token 无效"
+                    .to_string()
+            ),
         );
     }
 }

apps/aether-gateway/src/handlers/admin/provider/oauth/quota/codex/mod.rs

@@ -15,7 +15,7 @@ use self::plan::{build_codex_quota_request_spec, execute_codex_quota_plan};
 use super::shared::{
     build_quota_snapshot_payload, extract_execution_error_message,
     persist_provider_quota_refresh_state, provider_auto_remove_banned_keys,
-    quota_refresh_success_invalid_state, should_auto_remove_structured_reason,
+    quota_refresh_success_invalid_state, should_auto_remove_oauth_invalid_key,
     ProviderQuotaExecutionOutcome,
 };
 use crate::handlers::admin::request::AdminAppState;
@@ -261,8 +261,22 @@ pub(crate) async fn refresh_codex_provider_quota_locally(
             }
         }
 
+        let auto_remove_key = if auto_remove_abnormal_keys {
+            state
+                .read_provider_catalog_keys_by_ids(std::slice::from_ref(&key.id))
+                .await?
+                .into_iter()
+                .next()
+                .unwrap_or_else(|| key.clone())
+        } else {
+            key.clone()
+        };
         let auto_removed = auto_remove_abnormal_keys
-            && should_auto_remove_structured_reason(oauth_invalid_reason.as_deref());
+            && should_auto_remove_oauth_invalid_key(
+                &auto_remove_key,
+                oauth_invalid_reason.as_deref(),
+                now_unix_secs,
+            );
         if auto_removed {
             if state.delete_provider_catalog_key(&key.id).await? {
                 auto_removed_count += 1;

apps/aether-gateway/src/handlers/admin/provider/oauth/quota/shared.rs

@@ -48,8 +48,16 @@ pub(super) fn provider_auto_remove_banned_keys(config: Option<&serde_json::Value
     admin_provider_quota_pure::provider_auto_remove_banned_keys(config)
 }
 
-pub(super) fn should_auto_remove_structured_reason(reason: Option<&str>) -> bool {
-    admin_provider_quota_pure::should_auto_remove_structured_reason(reason)
+pub(super) fn should_auto_remove_oauth_invalid_key(
+    key: &StoredProviderCatalogKey,
+    candidate_reason: Option<&str>,
+    now_unix_secs: u64,
+) -> bool {
+    admin_provider_quota_pure::should_auto_remove_oauth_invalid_key(
+        key,
+        candidate_reason,
+        now_unix_secs,
+    )
 }
 
 pub(crate) fn normalize_string_id_list(values: Option<Vec<String>>) -> Option<Vec<String>> {