Merge pull request #285 from modelstudioai/fix/fix-workspace-auth

Fix workspace MaaS API key login validation

Author: hopelynd

docs/agents/auth-change.md

@@ -33,7 +33,7 @@ defineCommand({ auth }) → runtime/authStage → ctx.client → command.run(ctx
 
 `~/.bailian/config.json` 可同时保存 `api_key`、`access_token` 与 `access_key_*`。登录任一种方式不得删除另一种:
 
-- `bl auth login --api-key ...` 先通过只读 `GET /models` 校验 Key，校验成功后才原子写入 `api_key` 与实际匹配的 `base_url`。显式 `--base-url` 只校验该站点，不自动改写；未显式指定时，普通 `sk-*` / `sk-ws-*` 按“当前 Profile 已保存的同类站点 → 基于 `workspace_id` 构造的各地域 Workspace 专属站点 → 公共地域”顺序选择首个成功结果，`sk-sp-*` 并行探测国内站与新加坡 Token Plan，其他格式同时尝试两类候选。所有候选明确拒绝时返回 `AUTH`；网络、超时、非 JSON 或 5xx 视为校验无法确定并透传原错误。任一失败都不落盘、不激活 Profile
+- `bl auth login --api-key ...` 先通过只读 `GET /models` 校验 Key，校验成功后才原子写入 `api_key` 与实际匹配的 `base_url`。公共 DashScope 站点使用 `/api/v1/models?page_no=1&page_size=1`，`*.maas.aliyuncs.com`（Workspace 与 Token Plan）使用 `/compatible-mode/v1/models`。显式 `--base-url` 只校验该站点，不自动改写；未显式指定时，普通 `sk-*` / `sk-ws-*` 按“当前 Profile 已保存的同类站点 → 基于 `workspace_id` 构造的各地域 Workspace 专属站点 → 公共地域”顺序选择首个成功结果，`sk-sp-*` 并行探测国内站与新加坡 Token Plan，其他格式同时尝试两类候选。所有候选失败时选择最有诊断价值的原始错误透传：无 HTTP status 的网络、超时或响应解析错误优先，其次为 HTTP 429/5xx，最后为其他 HTTP 错误；同级保持候选顺序。HTTP status、API code、request ID 与服务端 message 保持不变，不重新分类为 `AUTH`。任一失败都不落盘、不激活 Profile
 - 未显式传 `--config` 时，`sk-sp-*` 自动写入并激活 `token-plan`；普通 `sk-*` / `sk-ws-*` 仅在当前为 `token-plan` 时改写并激活 `default`，否则保留当前 Profile；其他格式不自动切换。显式 `--config` 始终优先。`sk-sp-*` 无论写入哪个 Profile 都会携带 Token Plan 的预设默认模型，并在保留已有项的基础上补齐 `api_key_capabilities`，不自动删除任何已有能力。登录仍不得删除其他鉴权域的凭证
 - `bl auth login --console` 更新 `access_token` 以及回调携带的 console 作用域字段；若所选 Profile 没有模型 API Key，会要求控制台页面创建并回传一个普通 API Key 与 Base URL 一并保存。该回调结果不重复执行 `/models` 校验，且不会创建或配置 Token Plan
 - `bl auth login --open-api ...` 调用 OpenAPI 生成 CLI `access_token`，通过目标 Console 网关的只读 `loginInfo` 校验后，才一并写入 `access_key_id` / `access_key_secret` / `access_token` 和实际 `console_region` / `console_site`；失败不覆盖原凭证、不激活 Profile。一次成功登录同时产生 `openapi` 与 `console` 域凭证

packages/commands/src/commands/auth/login-api-key.ts

@@ -1,6 +1,5 @@
 import {
   BailianError,
-  ExitCode,
   getApiKeyLoginKind,
   normalizeModelBaseUrl,
   requestJson,
@@ -53,7 +52,6 @@ export interface ApiKeyValidationResult {
 }
 
 const API_KEY_VALIDATION_TIMEOUT_SECONDS = 5;
-const DEFINITIVE_VALIDATION_FAILURE_STATUSES = new Set([200, 400, 401, 403, 404, 405]);
 const ORDINARY_WORKSPACE_REGIONS = [
   "cn-beijing",
   "ap-southeast-1",
@@ -76,12 +74,15 @@ const KNOWN_BASE_URLS: Readonly<Record<ApiKeyEndpointKind, readonly string[]>> =
   ],
 };
 
+function usesCompatibleModelsApi(baseUrl: string, kind: ApiKeyEndpointKind): boolean {
+  const hostname = new URL(normalizeModelBaseUrl(baseUrl)).hostname;
+  return kind === "token-plan" || hostname.endsWith(".maas.aliyuncs.com");
+}
+
 function modelsUrl(baseUrl: string, kind: ApiKeyEndpointKind): string {
-  const url = new URL(
-    kind === "token-plan" ? "/compatible-mode/v1/models" : "/api/v1/models",
-    `${baseUrl}/`,
-  );
-  if (kind === "ordinary") {
+  const compatible = usesCompatibleModelsApi(baseUrl, kind);
+  const url = new URL(compatible ? "/compatible-mode/v1/models" : "/api/v1/models", `${baseUrl}/`);
+  if (!compatible) {
     url.searchParams.set("page_no", "1");
     url.searchParams.set("page_size", "1");
   }
@@ -97,6 +98,14 @@ function isTokenPlanBaseUrl(baseUrl: string): boolean {
   return new URL(normalizeModelBaseUrl(baseUrl)).hostname.startsWith("token-plan.");
 }
 
+function kindsForBaseUrl(
+  kinds: readonly ApiKeyEndpointKind[],
+  baseUrl: string,
+): ApiKeyEndpointKind[] {
+  if (!isTokenPlanBaseUrl(baseUrl) || !kinds.includes("token-plan")) return [...kinds];
+  return ["token-plan", ...kinds.filter((kind) => kind !== "token-plan")];
+}
+
 function addCandidate(
   candidates: ApiKeyValidationCandidate[],
   seenUrls: Set<string>,
@@ -120,13 +129,15 @@ export function apiKeyValidationCandidates(
   const seenUrls = new Set<string>();
 
   if (options.explicitBaseUrl) {
-    for (const kind of kinds) addCandidate(candidates, seenUrls, options.explicitBaseUrl, kind);
+    for (const kind of kindsForBaseUrl(kinds, options.explicitBaseUrl)) {
+      addCandidate(candidates, seenUrls, options.explicitBaseUrl, kind);
+    }
     return candidates;
   }
 
   if (options.storedBaseUrl) {
     const storedIsTokenPlan = isTokenPlanBaseUrl(options.storedBaseUrl);
-    for (const kind of kinds) {
+    for (const kind of kindsForBaseUrl(kinds, options.storedBaseUrl)) {
       if (apiKeyKind === "unknown" || storedIsTokenPlan === (kind === "token-plan")) {
         addCandidate(candidates, seenUrls, options.storedBaseUrl, kind);
       }
@@ -152,10 +163,25 @@ export function apiKeyValidationCandidates(
   return candidates;
 }
 
-function isDefinitiveCandidateFailure(error: unknown): boolean {
-  if (!(error instanceof BailianError)) return false;
-  const status = error.api?.httpStatus;
-  return status !== undefined && DEFINITIVE_VALIDATION_FAILURE_STATUSES.has(status);
+function validationFailurePriority(error: unknown): number {
+  if (!(error instanceof BailianError) || error.api?.httpStatus === undefined) return 0;
+  const status = error.api.httpStatus;
+  if (status === 429 || status >= 500) return 1;
+  return 2;
+}
+
+function selectValidationFailure(results: readonly { error?: unknown }[]): unknown {
+  let selectedError: unknown;
+  let selectedPriority = Number.POSITIVE_INFINITY;
+  for (const result of results) {
+    if (result.error === undefined) continue;
+    const priority = validationFailurePriority(result.error);
+    if (priority < selectedPriority) {
+      selectedError = result.error;
+      selectedPriority = priority;
+    }
+  }
+  return selectedError;
 }
 
 /** Validate a key without consuming model quota and return the first matching endpoint. */
@@ -183,17 +209,10 @@ export async function validateApiKey(
   const success = results.find((result) => result.error === undefined);
   if (success) return { baseUrl: success.candidate.baseUrl, kind: success.candidate.kind };
 
-  const inconclusive = results.find((result) => !isDefinitiveCandidateFailure(result.error));
-  if (inconclusive?.error !== undefined) throw inconclusive.error;
+  const failure = selectValidationFailure(results);
+  if (failure !== undefined) throw failure;
 
-  const explicitHint = options.explicitBaseUrl
-    ? "Check that the API key belongs to this Base URL."
-    : "For a workspace-specific or custom endpoint, retry with --base-url <url>.";
-  throw new BailianError(
-    "API key validation failed: the key was not accepted by any supported model endpoint.",
-    ExitCode.AUTH,
-    explicitHint,
-  );
+  throw new TypeError("API key validation completed without a success or failure result.");
 }
 
 /**

packages/commands/tests/auth-api-key.test.ts

@@ -25,10 +25,10 @@ const settings: Settings = {
   telemetry: false,
 };
 
-function jsonResponse(body: unknown, status = 200): Response {
+function jsonResponse(body: unknown, status = 200, headers: Record<string, string> = {}): Response {
   return new Response(JSON.stringify(body), {
     status,
-    headers: { "content-type": "application/json" },
+    headers: { "content-type": "application/json", ...headers },
   });
 }
 
@@ -73,25 +73,82 @@ test("普通 Key 优先使用已保存地址，再尝试 Workspace 专属地址
     }),
   ).toEqual([
     "https://stored.example.com/api/v1/models?page_no=1&page_size=1",
-    "https://llm-test-workspace.cn-beijing.maas.aliyuncs.com/api/v1/models?page_no=1&page_size=1",
-    "https://llm-test-workspace.ap-southeast-1.maas.aliyuncs.com/api/v1/models?page_no=1&page_size=1",
-    "https://llm-test-workspace.cn-hongkong.maas.aliyuncs.com/api/v1/models?page_no=1&page_size=1",
-    "https://llm-test-workspace.ap-northeast-1.maas.aliyuncs.com/api/v1/models?page_no=1&page_size=1",
-    "https://llm-test-workspace.eu-central-1.maas.aliyuncs.com/api/v1/models?page_no=1&page_size=1",
-    "https://llm-test-workspace.us-east-1.maas.aliyuncs.com/api/v1/models?page_no=1&page_size=1",
+    "https://llm-test-workspace.cn-beijing.maas.aliyuncs.com/compatible-mode/v1/models",
+    "https://llm-test-workspace.ap-southeast-1.maas.aliyuncs.com/compatible-mode/v1/models",
+    "https://llm-test-workspace.cn-hongkong.maas.aliyuncs.com/compatible-mode/v1/models",
+    "https://llm-test-workspace.ap-northeast-1.maas.aliyuncs.com/compatible-mode/v1/models",
+    "https://llm-test-workspace.eu-central-1.maas.aliyuncs.com/compatible-mode/v1/models",
+    "https://llm-test-workspace.us-east-1.maas.aliyuncs.com/compatible-mode/v1/models",
     "https://dashscope.aliyuncs.com/api/v1/models?page_no=1&page_size=1",
     "https://dashscope-intl.aliyuncs.com/api/v1/models?page_no=1&page_size=1",
     "https://dashscope-us.aliyuncs.com/api/v1/models?page_no=1&page_size=1",
     "https://cn-hongkong.dashscope.aliyuncs.com/api/v1/models?page_no=1&page_size=1",
   ]);
 });
 
+test("已保存的 Workspace MaaS 地址使用 Compatible /models", () => {
+  expect(
+    candidateUrls("sk-ws-placeholder", {
+      storedBaseUrl: "https://ws-stored.ap-southeast-1.maas.aliyuncs.com/compatible-mode/v1",
+    }),
+  ).toEqual([
+    "https://ws-stored.ap-southeast-1.maas.aliyuncs.com/compatible-mode/v1/models",
+    "https://dashscope.aliyuncs.com/api/v1/models?page_no=1&page_size=1",
+    "https://dashscope-intl.aliyuncs.com/api/v1/models?page_no=1&page_size=1",
+    "https://dashscope-us.aliyuncs.com/api/v1/models?page_no=1&page_size=1",
+    "https://cn-hongkong.dashscope.aliyuncs.com/api/v1/models?page_no=1&page_size=1",
+  ]);
+});
+
+test("Workspace 地域候选先于公共站点选择首个成功地域", async () => {
+  const originalFetch = httpTransport.fetch;
+  const workspaceOrigin = "https://llm-test-workspace.ap-southeast-1.maas.aliyuncs.com";
+  httpTransport.fetch = async (input) => {
+    const url = requestUrl(input);
+    if (url === `${workspaceOrigin}/compatible-mode/v1/models`) {
+      return jsonResponse({ object: "list", data: [{ id: "workspace-model" }] });
+    }
+    if (url.startsWith("https://dashscope-intl.aliyuncs.com/")) {
+      return jsonResponse({ data: [{ id: "public-model" }] });
+    }
+    const status = url.includes(".maas.aliyuncs.com/") ? 404 : 401;
+    return jsonResponse({ code: "Rejected", message: "candidate rejected" }, status);
+  };
+
+  try {
+    await expect(
+      validateApiKey({ identity, settings }, "sk-ws-placeholder", {
+        workspaceId: "llm-test-workspace",
+      }),
+    ).resolves.toEqual({
+      baseUrl: workspaceOrigin,
+      kind: "ordinary",
+    });
+  } finally {
+    httpTransport.fetch = originalFetch;
+  }
+});
+
 test("其他格式 Key 不限制端点类型", () => {
   expect(
     apiKeyValidationCandidates("custom-key-placeholder", {}).map((candidate) => candidate.kind),
   ).toEqual(["ordinary", "ordinary", "ordinary", "ordinary", "token-plan", "token-plan"]);
 });
 
+test("未知格式 Key 指向 Token Plan host 时保留 Token Plan kind", () => {
+  expect(
+    apiKeyValidationCandidates("custom-key-placeholder", {
+      explicitBaseUrl: "https://token-plan.ap-southeast-1.maas.aliyuncs.com",
+    }),
+  ).toEqual([
+    {
+      baseUrl: "https://token-plan.ap-southeast-1.maas.aliyuncs.com",
+      kind: "token-plan",
+      modelsUrl: "https://token-plan.ap-southeast-1.maas.aliyuncs.com/compatible-mode/v1/models",
+    },
+  ]);
+});
+
 test("显式 Base URL 只校验指定站点，并根据 Key 类型选择 /models 路径", () => {
   expect(
     candidateUrls("sk-sp-placeholder", {
@@ -103,6 +160,11 @@ test("显式 Base URL 只校验指定站点，并根据 Key 类型选择 /models
       explicitBaseUrl: "https://workspace.example.com/compatible-mode/v1",
     }),
   ).toEqual(["https://workspace.example.com/api/v1/models?page_no=1&page_size=1"]);
+  expect(
+    candidateUrls("sk-ws-placeholder", {
+      explicitBaseUrl: "https://ws-explicit.ap-southeast-1.maas.aliyuncs.com/compatible-mode/v1",
+    }),
+  ).toEqual(["https://ws-explicit.ap-southeast-1.maas.aliyuncs.com/compatible-mode/v1/models"]);
 });
 
 test("Token Plan 多地区并行校验选择实际接受 Key 的国际站点", async () => {
@@ -140,15 +202,53 @@ test("Token Plan 多地区并行校验选择实际接受 Key 的国际站点", a
   }
 });
 
-test("所有候选站点明确拒绝 Key 时返回 AUTH 校验失败", async () => {
+test("所有候选站点拒绝 Key 时透传首个服务端错误", async () => {
   const originalFetch = httpTransport.fetch;
-  httpTransport.fetch = async () =>
-    jsonResponse({ code: "InvalidApiKey", message: "invalid key" }, 401);
+  httpTransport.fetch = async (input) => {
+    const requestId = requestUrl(input).includes("cn-beijing")
+      ? "req-cn-rejected"
+      : "req-sg-rejected";
+    return jsonResponse(
+      { code: "InvalidApiKey", message: "invalid key", request_id: requestId },
+      401,
+    );
+  };
 
   try {
     const error = await captureValidationError("sk-sp-placeholder");
-    expect(error.exitCode).toBe(ExitCode.AUTH);
-    expect(error.message).toMatch(/API key validation failed/);
+    expect(error.exitCode).toBe(ExitCode.GENERAL);
+    expect(error.message).toBe("invalid key");
+    expect(error.api).toEqual({
+      httpStatus: 401,
+      apiCode: "InvalidApiKey",
+      requestId: "req-cn-rejected",
+    });
+  } finally {
+    httpTransport.fetch = originalFetch;
+  }
+});
+
+test("显式 Base URL 返回 404 时保留状态和 request ID", async () => {
+  const originalFetch = httpTransport.fetch;
+  httpTransport.fetch = async () =>
+    jsonResponse({ code: "NotFound", message: "models route not found" }, 404, {
+      "x-request-id": "req-route-not-found",
+    });
+
+  try {
+    const error = await validateApiKey({ identity, settings }, "sk-ws-placeholder", {
+      explicitBaseUrl: "https://ws-explicit.ap-southeast-1.maas.aliyuncs.com",
+    }).catch((caught) => caught);
+    expect(error).toBeInstanceOf(BailianError);
+    expect(error).toMatchObject({
+      exitCode: ExitCode.GENERAL,
+      message: "models route not found",
+      api: {
+        httpStatus: 404,
+        apiCode: "NotFound",
+        requestId: "req-route-not-found",
+      },
+    });
   } finally {
     httpTransport.fetch = originalFetch;
   }
@@ -157,11 +257,15 @@ test("所有候选站点明确拒绝 Key 时返回 AUTH 校验失败", async ()
 test.each([
   { name: "5xx", status: 503, message: "temporary outage" },
   { name: "429", status: 429, message: "too many requests" },
-])("存在 $name 时校验结论不确定，不误报 Key 无效", async ({ status, message }) => {
+])("后续候选出现 $name 时优先透传该错误", async ({ status, message }) => {
   const originalFetch = httpTransport.fetch;
   httpTransport.fetch = async (input) => {
-    if (requestUrl(input).startsWith("https://dashscope.aliyuncs.com/")) {
-      return jsonResponse({ code: "TemporaryFailure", message }, status);
+    const url = requestUrl(input);
+    if (url.startsWith("https://dashscope-intl.aliyuncs.com/")) {
+      return jsonResponse(
+        { code: "TemporaryFailure", message, request_id: `req-${status}` },
+        status,
+      );
     }
     return jsonResponse({ code: "InvalidApiKey", message: "invalid key" }, 401);
   };
@@ -170,6 +274,62 @@ test.each([
     const error = await captureValidationError("sk-placeholder");
     expect(error.exitCode).toBe(ExitCode.GENERAL);
     expect(error.message).toBe(message);
+    expect(error.api).toEqual({
+      httpStatus: status,
+      apiCode: "TemporaryFailure",
+      requestId: `req-${status}`,
+    });
+  } finally {
+    httpTransport.fetch = originalFetch;
+  }
+});
+
+test("后续候选出现网络错误时优先透传该错误", async () => {
+  const originalFetch = httpTransport.fetch;
+  const networkError = new TypeError("fetch failed", {
+    cause: Object.assign(new Error("connection reset"), { code: "ECONNRESET" }),
+  });
+  httpTransport.fetch = async (input) => {
+    if (requestUrl(input).startsWith("https://dashscope-intl.aliyuncs.com/")) {
+      throw networkError;
+    }
+    return jsonResponse({ code: "InvalidApiKey", message: "invalid key" }, 401);
+  };
+
+  try {
+    const error = await validateApiKey({ identity, settings }, "sk-placeholder", {}).catch(
+      (caught) => caught,
+    );
+    expect(error).toBe(networkError);
+  } finally {
+    httpTransport.fetch = originalFetch;
+  }
+});
+
+test("同一优先级的 HTTP 错误保持候选顺序", async () => {
+  const originalFetch = httpTransport.fetch;
+  httpTransport.fetch = async (input) => {
+    const url = requestUrl(input);
+    if (url.startsWith("https://dashscope.aliyuncs.com/")) {
+      return jsonResponse(
+        { code: "FirstRejected", message: "first candidate rejected", request_id: "req-first" },
+        401,
+      );
+    }
+    return jsonResponse(
+      { code: "LaterRejected", message: "later candidate rejected", request_id: "req-later" },
+      404,
+    );
+  };
+
+  try {
+    const error = await captureValidationError("sk-placeholder");
+    expect(error.message).toBe("first candidate rejected");
+    expect(error.api).toEqual({
+      httpStatus: 401,
+      apiCode: "FirstRejected",
+      requestId: "req-first",
+    });
   } finally {
     httpTransport.fetch = originalFetch;
   }