mirrors/pikasTech-agentrun
1
0
Fork 0
Code Issues Pull Requests Actions Packages Projects Releases Wiki Activity

feat: 支持 provider profile auth.json 写入

Browse Source
This commit is contained in:
Codex
2026-06-08 10:59:38 +08:00
parent f86bee4563
commit 47b02b5101
2 changed files with 53 additions and 22 deletions
Download Patch File Download Diff File Expand all files Collapse all files
src/mgr/provider-profiles.ts
+31 -19
View File
@@ -167,10 +167,9 @@ export async function setProviderProfileCredential(profileValue: string, body: u
const profile = validateBackendProfile(profileValue);
const spec = requiredSpec(profile);
const record = asRecord(body ?? {}, "providerProfileCredential");
const apiKey = stringField(record, "apiKey");
if (apiKey.length < 8) throw new AgentRunError("secret-unavailable", "apiKey is too short", { httpStatus: 400 });
const credential = credentialAuthJson(record);
const delegatedBy = delegatedBySummary(record.delegatedBy);
const rendered = renderCredential(apiKey, await renderedConfigForWrite(profile, record, options));
const renderedConfig = await renderedConfigForWrite(profile, record, options);
const namespace = profileNamespace(options);
const secretManifest: JsonRecord = {
apiVersion: "v1",
@@ -184,16 +183,16 @@ export async function setProviderProfileCredential(profileValue: string, body: u
},
annotations: {
[`${credentialAnnotationPrefix}-profile`]: profile,
[`${credentialAnnotationPrefix}-credential-hash-suffix`]: shortHash(rendered.authJson),
[`${credentialAnnotationPrefix}-config-hash-suffix`]: shortHash(rendered.config.configToml),
[`${credentialAnnotationPrefix}-credential-hash-suffix`]: shortHash(credential.authJson),
[`${credentialAnnotationPrefix}-config-hash-suffix`]: shortHash(renderedConfig.configToml),
[`${credentialAnnotationPrefix}-updated-at`]: new Date().toISOString(),
...(delegatedBy ? { [`${credentialAnnotationPrefix}-delegated-system`]: delegatedBy.system, [`${credentialAnnotationPrefix}-delegated-request-id`]: delegatedBy.requestId ?? "" } : {}),
},
},
type: "Opaque",
data: {
"auth.json": base64Data(rendered.authJson),
"config.toml": base64Data(rendered.config.configToml),
"auth.json": base64Data(credential.authJson),
"config.toml": base64Data(renderedConfig.configToml),
},
};
const applied = await kubectlUpsertSecret(secretManifest, options.kubectlCommand ?? "kubectl");
@@ -204,12 +203,13 @@ export async function setProviderProfileCredential(profileValue: string, body: u
configured: true,
secretRef: secretRefSummary(profile, namespace),
resourceVersion: objectPath(applied, ["metadata", "resourceVersion"]),
credentialHashSuffix: shortHash(rendered.authJson),
configHashSuffix: shortHash(rendered.config.configToml),
credentialHashSuffix: shortHash(credential.authJson),
configHashSuffix: shortHash(renderedConfig.configToml),
updatedAt: objectPath(applied, ["metadata", "annotations", `${credentialAnnotationPrefix}-updated-at`]) ?? new Date().toISOString(),
configSummary: rendered.config.configSummary,
credentialSource: credential.source,
configSummary: renderedConfig.configSummary,
delegatedBy,
requiresExternalBridgeUpdate: profileUsesMoonBridge(profile, rendered.config.configToml),
requiresExternalBridgeUpdate: profileUsesMoonBridge(profile, renderedConfig.configToml),
valuesPrinted: false,
pollCommands: {
show: `./scripts/agentrun provider-profiles show ${profile}`,
@@ -357,20 +357,32 @@ function profileFromSecretName(name: string | null): string | null {
return profile.length > 0 ? profile : null;
}
function renderCredential(apiKey: string, config: RenderedConfig): { authJson: string; config: RenderedConfig } {
const authJson = `${JSON.stringify(authPayload(apiKey))}\n`;
return {
authJson,
config,
};
}
function providerProfileSecretData(input: { authJsonData?: string | null; configToml: string }): JsonRecord {
const data: JsonRecord = { "config.toml": base64Data(input.configToml) };
if (input.authJsonData) data["auth.json"] = input.authJsonData;
return data;
}
function credentialAuthJson(record: JsonRecord): { authJson: string; source: "auth-json" | "api-key" } {
const authJson = record.authJson;
if (typeof authJson === "string" && authJson.trim().length > 0) return { authJson: authJsonField(authJson), source: "auth-json" };
const apiKey = stringField(record, "apiKey");
if (apiKey.length < 8) throw new AgentRunError("secret-unavailable", "apiKey is too short", { httpStatus: 400 });
return { authJson: `${JSON.stringify(authPayload(apiKey))}\n`, source: "api-key" };
}
function authJsonField(value: string): string {
if (!value.trim()) throw new AgentRunError("schema-invalid", "authJson is required", { httpStatus: 400 });
let parsed: unknown;
try {
parsed = JSON.parse(value);
} catch {
throw new AgentRunError("schema-invalid", "authJson must be valid JSON", { httpStatus: 400 });
}
if (!parsed || typeof parsed !== "object" || Array.isArray(parsed)) throw new AgentRunError("schema-invalid", "authJson must be a JSON object", { httpStatus: 400 });
return value;
}
function authPayload(apiKey: string): JsonRecord {
return { OPENAI_API_KEY: apiKey };
}
src/selftest/cases/45-provider-profile-management.ts
+22 -3
View File
@@ -23,11 +23,12 @@ const selfTest: SelfTestCase = async (context) => {
const createdJobPath = path.join(context.tmp, "provider-validation-job.json");
const secretStateDir = path.join(context.tmp, "provider-secret-state");
await writeFile(fakeKubectl, `#!/usr/bin/env bun
import { rmSync } from "node:fs";
import { mkdirSync, rmSync } from "node:fs";
const args = Bun.argv.slice(2);
const secretStateDir = ${JSON.stringify(secretStateDir)};
const secretStatePath = (name) => secretStateDir + "/" + name + ".json";
const deletedMarkerPath = (name) => secretStateDir + "/" + name + ".deleted";
mkdirSync(secretStateDir, { recursive: true });
const fixtureSecret = (name) => ({ apiVersion: "v1", kind: "Secret", metadata: { name, namespace: "agentrun-v01", resourceVersion: "rv-selftest", creationTimestamp: "2026-06-05T00:00:00.000Z" }, data: { "auth.json": Buffer.from(JSON.stringify({ token: "redacted-fixture" })).toString("base64"), "config.toml": Buffer.from("model = \\\"fixture\\\"\\n").toString("base64") } });
const readStdin = async () => {
const chunks = [];
@@ -119,7 +120,7 @@ if (args[0] === "create") {
if (args[0] === "delete" && args[1] === "secret") {
const name = args[2];
try { rmSync(secretStatePath(name)); } catch {}
await Bun.write(deletedMarkerPath(name), "deleted\n");
await Bun.write(deletedMarkerPath(name), "deleted\\n");
console.log(JSON.stringify({ kind: "Status", status: "Success", details: { name } }));
process.exit(0);
}
@@ -265,6 +266,24 @@ process.exit(1);
const dynamicReplaceData = dynamicReplaceManifest.data as JsonRecord;
assert.equal(Buffer.from(String(dynamicReplaceData["auth.json"]), "base64").toString("utf8").includes(secretText), true);
assert.equal(Buffer.from(String(dynamicReplaceData["config.toml"]), "base64").toString("utf8"), dynamicConfigToml);
const directAuthJsonSecret = "sk-selftest-auth-json-direct";
const directAuthJson = `${JSON.stringify({ OPENAI_API_KEY: directAuthJsonSecret })}\n`;
const dynamicAuthJsonCredential = await client.put(`/api/v1/provider-profiles/${encodeURIComponent(dynamicProfile)}/credential`, {
authJson: directAuthJson,
delegatedBy: { system: "hwlab-v02", userId: "u4", username: "tester4", requestId: "req-dynamic-auth-json-selftest" },
reason: "self-test-dynamic-auth-json",
}) as JsonRecord;
assert.equal(dynamicAuthJsonCredential.profile, dynamicProfile);
assert.equal(dynamicAuthJsonCredential.credentialSource, "auth-json");
assert.equal(JSON.stringify(dynamicAuthJsonCredential).includes(directAuthJsonSecret), false);
assertNoSecretLeak(dynamicAuthJsonCredential);
const dynamicAuthJsonReplaceRecord = JSON.parse(await readFile(replacedSecretPath, "utf8")) as JsonRecord;
const dynamicAuthJsonReplaceManifest = dynamicAuthJsonReplaceRecord.manifest as JsonRecord;
const dynamicAuthJsonData = dynamicAuthJsonReplaceManifest.data as JsonRecord;
assert.equal(Buffer.from(String(dynamicAuthJsonData["auth.json"]), "base64").toString("utf8"), directAuthJson);
assert.equal(Buffer.from(String(dynamicAuthJsonData["config.toml"]), "base64").toString("utf8"), dynamicConfigToml);
const dynamicShown = await client.get(`/api/v1/provider-profiles/${encodeURIComponent(dynamicProfile)}`) as JsonRecord;
assert.equal(dynamicShown.configured, true);
assert.equal(dynamicShown.failureKind, null);
@@ -322,7 +341,7 @@ process.exit(1);
assert.equal(finalValidation.status, "completed");
assert.equal(JSON.stringify(finalValidation).includes(secretText), false);
assertNoSecretLeak(finalValidation);
return { name: "provider-profile-management", tests: ["provider-profiles-list-redacted", "provider-profile-config", "provider-profile-set-key-redacted", "provider-profile-secret-replace-annotation-cleanup", "provider-profile-secret-create-upsert", "provider-profile-config-only-create", "provider-profile-dynamic-slug-roundtrip", "provider-profile-remove-builtin", "provider-profile-remove-dynamic-slug", "provider-profile-deepseek-moon-bridge", "provider-profile-manager-secret-rbac", "provider-profile-validation-runner-job"] };
return { name: "provider-profile-management", tests: ["provider-profiles-list-redacted", "provider-profile-config", "provider-profile-set-key-redacted", "provider-profile-set-auth-json-redacted", "provider-profile-secret-replace-annotation-cleanup", "provider-profile-secret-create-upsert", "provider-profile-config-only-create", "provider-profile-dynamic-slug-roundtrip", "provider-profile-remove-builtin", "provider-profile-remove-dynamic-slug", "provider-profile-deepseek-moon-bridge", "provider-profile-manager-secret-rbac", "provider-profile-validation-runner-job"] };
} finally {
await new Promise<void>((resolve) => server.server.close(() => resolve()));
}