feat: 支持 v0.1 deepseek backend profile

src/common/validation.ts

@@ -1,9 +1,9 @@
 import { createHash, randomUUID } from "node:crypto";
 import type { BackendProfile, CreateCommandInput, CreateRunInput, ExecutionPolicy, JsonRecord, JsonValue } from "./types.js";
 import { AgentRunError } from "./errors.js";
+import { backendProfileSpec, backendProfiles, isBackendProfile } from "./backend-profiles.js";
 
 const allowedTenants = new Set(["unidesk", "hwlab"]);
-const allowedBackends = new Set<BackendProfile>(["codex"]);
 
 export function nowIso(): string {
   return new Date().toISOString();
@@ -42,9 +42,11 @@ export function validateCreateRun(input: unknown): CreateRunInput {
   const record = asRecord(input, "run");
   const tenantId = requiredString(record, "tenantId");
   if (!allowedTenants.has(tenantId)) throw new AgentRunError("tenant-policy-denied", `tenantId ${tenantId} is not allowed`, { httpStatus: 403 });
-  const backendProfile = requiredString(record, "backendProfile") as BackendProfile;
-  if (!allowedBackends.has(backendProfile)) throw new AgentRunError("schema-invalid", `backendProfile ${backendProfile} is not supported in v0.1`, { httpStatus: 400 });
+  const backendProfileValue = requiredString(record, "backendProfile");
+  if (!isBackendProfile(backendProfileValue)) throw new AgentRunError("schema-invalid", `backendProfile ${backendProfileValue} is not supported in v0.1`, { httpStatus: 400, details: { allowedBackends: [...backendProfiles] } });
+  const backendProfile = backendProfileValue as BackendProfile;
   const executionPolicy = validateExecutionPolicy(requiredRecord(record, "executionPolicy"));
+  validateBackendSecretScope(backendProfile, executionPolicy);
   return {
     tenantId,
     projectId: requiredString(record, "projectId"),
@@ -64,8 +66,15 @@ export function validateExecutionPolicy(record: JsonRecord): ExecutionPolicy {
   const providerCredentials = Array.isArray(secretScope.providerCredentials) ? secretScope.providerCredentials : [];
   for (const credential of providerCredentials) {
     const item = asRecord(credential, "providerCredential");
+    const profile = typeof item.profile === "string" ? item.profile.trim() : "";
+    if (profile.length === 0) throw new AgentRunError("schema-invalid", "provider credential profile is required", { httpStatus: 400 });
+    if (!isBackendProfile(profile)) throw new AgentRunError("schema-invalid", `provider credential profile ${profile} is not supported in v0.1`, { httpStatus: 400, details: { allowedBackends: [...backendProfiles] } });
     const secretRef = asRecord(item.secretRef, "providerCredential.secretRef");
     if (typeof secretRef.name !== "string" || secretRef.name.length === 0) throw new AgentRunError("schema-invalid", "provider credential secretRef.name is required", { httpStatus: 400 });
+    const keys = Array.isArray(secretRef.keys) ? secretRef.keys : [];
+    for (const requiredKey of backendProfileSpec(profile)?.requiredSecretKeys ?? []) {
+      if (!keys.includes(requiredKey)) throw new AgentRunError("schema-invalid", `provider credential ${profile} secretRef.keys must include ${requiredKey}`, { httpStatus: 400 });
+    }
   }
   const secretScopeResult: ExecutionPolicy["secretScope"] = { allowCredentialEcho: false };
   if (providerCredentials.length > 0) secretScopeResult.providerCredentials = providerCredentials as NonNullable<ExecutionPolicy["secretScope"]["providerCredentials"]>;
@@ -78,6 +87,15 @@ export function validateExecutionPolicy(record: JsonRecord): ExecutionPolicy {
   };
 }
 
+function validateBackendSecretScope(backendProfile: BackendProfile, executionPolicy: ExecutionPolicy): void {
+  const credentials = executionPolicy.secretScope.providerCredentials ?? [];
+  const matching = credentials.filter((item) => item.profile === backendProfile);
+  if (matching.length === 0) {
+    throw new AgentRunError("secret-unavailable", `backendProfile ${backendProfile} requires a matching provider credential SecretRef`, { httpStatus: 400, details: { backendProfile, requiredSecretName: backendProfileSpec(backendProfile)?.defaultSecretName ?? null } });
+  }
+  if (matching.length > 1) throw new AgentRunError("schema-invalid", `backendProfile ${backendProfile} has multiple matching provider credentials`, { httpStatus: 400 });
+}
+
 export function validateCreateCommand(input: unknown): CreateCommandInput {
   const record = asRecord(input, "command");
   const type = requiredString(record, "type");