修复 Codex 账号额度导入与启停刷新

- 后端管理端新增 secret-ref 只读解析入口，并在 auth-files 列表中从受保护 id_token 派生 chatgpt_account_id、plan_type，同时保留 account_id 回退。
- 后端启停认证文件时清理账号运行期不可用、错误、重试、quota 和模型 cooldown 状态，并同步清理 auth manager 运行期阻塞状态。
- WebUI 扩展 Codex 账号 ID 解析来源，支持顶层、metadata、attributes 字段并回退 id_token。
- WebUI 账号列表和额度页改为首屏阻塞加载、后续刷新保留已有列表，额度页首屏加载显示统一提示。
- 补充管理端 auth-files secret/JWT/回退测试、启停状态清理测试、auth manager 清理测试和前端 resolver 测试。

Author: C4AL

resources/backend/source/internal/api/handlers/management/auth_files.go

@@ -432,8 +432,10 @@ func (h *Handler) buildAuthFileEntry(auth *coreauth.Auth) gin.H {
 			log.WithError(err).Warnf("failed to stat auth file %s", path)
 		}
 	}
-	if claims := extractCodexIDTokenClaims(auth); claims != nil {
-		entry["id_token"] = claims
+	if fields := extractCodexAuthFileFields(auth); fields != nil {
+		for key, value := range fields {
+			entry[key] = value
+		}
 	}
 	// Expose priority from Attributes (set by synthesizer from JSON "priority" field).
 	// Fall back to Metadata for auths registered via UploadAuthFile (no synthesizer).
@@ -469,21 +471,52 @@ func (h *Handler) buildAuthFileEntry(auth *coreauth.Auth) gin.H {
 	return entry
 }
 
-func extractCodexIDTokenClaims(auth *coreauth.Auth) gin.H {
-	if auth == nil || auth.Metadata == nil {
+func extractCodexAuthFileFields(auth *coreauth.Auth) gin.H {
+	if auth == nil || !strings.EqualFold(strings.TrimSpace(auth.Provider), "codex") {
+		return nil
+	}
+
+	result := gin.H{}
+	if claims := extractCodexIDTokenClaims(auth); claims != nil {
+		result["id_token"] = claims
+		for key, value := range claims {
+			result[key] = value
+		}
+	}
+	if _, ok := result["chatgpt_account_id"]; !ok {
+		if accountID := authStringField(auth, "chatgpt_account_id", "chatgptAccountId", "account_id", "accountId"); accountID != "" {
+			result["chatgpt_account_id"] = accountID
+		}
+	}
+	if _, ok := result["plan_type"]; !ok {
+		if planType := authStringField(auth, "plan_type", "planType"); planType != "" {
+			result["plan_type"] = planType
+		}
+	}
+
+	if len(result) == 0 {
 		return nil
 	}
-	if !strings.EqualFold(strings.TrimSpace(auth.Provider), "codex") {
+	return result
+}
+
+func extractCodexIDTokenClaims(auth *coreauth.Auth) gin.H {
+	if auth == nil {
 		return nil
 	}
-	idTokenRaw, ok := auth.Metadata["id_token"].(string)
-	if !ok {
+	idTokenRaw := authStringField(auth, "id_token", "idToken")
+	if idTokenRaw == "" {
 		return nil
 	}
 	idToken := strings.TrimSpace(idTokenRaw)
 	if idToken == "" {
 		return nil
 	}
+	if resolved, err := config.ResolveCodexCliPlusSecretRefForRead("auth-files."+strings.TrimSpace(auth.ID)+".id_token", idToken); err == nil {
+		idToken = strings.TrimSpace(resolved)
+	} else {
+		log.WithError(err).Debugf("failed to resolve Codex id_token secret reference for auth %s", auth.ID)
+	}
 	claims, err := codex.ParseJWTToken(idToken)
 	if err != nil || claims == nil {
 		return nil
@@ -509,6 +542,40 @@ func extractCodexIDTokenClaims(auth *coreauth.Auth) gin.H {
 	return result
 }
 
+func authStringField(auth *coreauth.Auth, keys ...string) string {
+	if auth == nil {
+		return ""
+	}
+	if auth.Metadata != nil {
+		for _, key := range keys {
+			if value := strings.TrimSpace(authMetadataString(auth.Metadata[key])); value != "" {
+				return value
+			}
+		}
+	}
+	if auth.Attributes != nil {
+		for _, key := range keys {
+			if value := strings.TrimSpace(auth.Attributes[key]); value != "" {
+				return value
+			}
+		}
+	}
+	return ""
+}
+
+func authMetadataString(value any) string {
+	switch v := value.(type) {
+	case string:
+		return strings.TrimSpace(v)
+	case json.Number:
+		return strings.TrimSpace(v.String())
+	case fmt.Stringer:
+		return strings.TrimSpace(v.String())
+	default:
+		return ""
+	}
+}
+
 func authEmail(auth *coreauth.Auth) string {
 	if auth == nil {
 		return ""
@@ -1109,6 +1176,8 @@ func (h *Handler) PatchAuthFileStatus(c *gin.Context) {
 	}
 
 	// Update disabled state
+	clearAuthRuntimeBlockingState(targetAuth)
+	h.authManager.ClearRuntimeBlockingState(targetAuth.ID)
 	targetAuth.Disabled = *req.Disabled
 	if *req.Disabled {
 		targetAuth.Status = coreauth.StatusDisabled
@@ -1127,6 +1196,23 @@ func (h *Handler) PatchAuthFileStatus(c *gin.Context) {
 	c.JSON(http.StatusOK, gin.H{"status": "ok", "disabled": *req.Disabled})
 }
 
+func clearAuthRuntimeBlockingState(auth *coreauth.Auth) {
+	if auth == nil {
+		return
+	}
+	if auth.ID != "" && len(auth.ModelStates) > 0 {
+		modelRegistry := registry.GetGlobalRegistry()
+		for model := range auth.ModelStates {
+			modelRegistry.ClearModelQuotaExceeded(auth.ID, model)
+		}
+	}
+	auth.Unavailable = false
+	auth.LastError = nil
+	auth.NextRetryAfter = time.Time{}
+	auth.Quota = coreauth.QuotaState{}
+	auth.ModelStates = nil
+}
+
 // PatchAuthFileFields updates editable fields (prefix, proxy_url, headers, priority, note) of an auth file.
 func (h *Handler) PatchAuthFileFields(c *gin.Context) {
 	if h.authManager == nil {

resources/backend/source/internal/api/handlers/management/auth_files_codex_test.go

@@ -0,0 +1,202 @@
+package management
+
+import (
+	"context"
+	"encoding/base64"
+	"encoding/json"
+	"net/http"
+	"net/http/httptest"
+	"strings"
+	"testing"
+
+	"github.com/gin-gonic/gin"
+	"github.com/router-for-me/CLIProxyAPI/v6/internal/config"
+	coreauth "github.com/router-for-me/CLIProxyAPI/v6/sdk/cliproxy/auth"
+)
+
+func TestListAuthFiles_CodexSecretIDTokenReturnsAccountFields(t *testing.T) {
+	t.Setenv("MANAGEMENT_PASSWORD", "")
+	gin.SetMode(gin.TestMode)
+
+	idToken := makeCodexIDToken(t, "chatgpt-account-secret", "plus")
+	secretServer := httptest.NewServer(http.HandlerFunc(func(w http.ResponseWriter, r *http.Request) {
+		if got := r.Header.Get("Authorization"); got != "Bearer test-secret-token" {
+			t.Fatalf("Authorization = %q, want bearer token", got)
+		}
+		if r.URL.Path != "/v1/secrets/codex-id-token" {
+			t.Fatalf("secret path = %q", r.URL.Path)
+		}
+		_ = json.NewEncoder(w).Encode(map[string]string{"value": idToken})
+	}))
+	t.Cleanup(secretServer.Close)
+	t.Setenv("CCP_SECRET_BROKER_URL", secretServer.URL)
+	t.Setenv("CCP_SECRET_BROKER_TOKEN", "test-secret-token")
+
+	manager := coreauth.NewManager(nil, nil, nil)
+	if _, errRegister := manager.Register(context.Background(), &coreauth.Auth{
+		ID:       "codex-secret",
+		FileName: "codex-secret.json",
+		Provider: "codex",
+		Attributes: map[string]string{
+			"runtime_only": "true",
+		},
+		Metadata: map[string]any{
+			"id_token": "ccp-secret://codex-id-token",
+		},
+	}); errRegister != nil {
+		t.Fatalf("register auth: %v", errRegister)
+	}
+
+	entry := listSingleAuthFile(t, manager)
+
+	if got := entry["chatgpt_account_id"]; got != "chatgpt-account-secret" {
+		t.Fatalf("chatgpt_account_id = %#v", got)
+	}
+	if got := entry["plan_type"]; got != "plus" {
+		t.Fatalf("plan_type = %#v", got)
+	}
+
+	idTokenClaims, ok := entry["id_token"].(map[string]any)
+	if !ok {
+		t.Fatalf("id_token claims missing: %#v", entry["id_token"])
+	}
+	if got := idTokenClaims["chatgpt_account_id"]; got != "chatgpt-account-secret" {
+		t.Fatalf("id_token.chatgpt_account_id = %#v", got)
+	}
+	if text := strings.TrimSpace(toJSON(t, entry)); strings.Contains(text, idToken) || strings.Contains(text, "ccp-secret://") {
+		t.Fatalf("auth file response exposed token material: %s", text)
+	}
+}
+
+func TestListAuthFiles_CodexVaultIDTokenReturnsAccountFields(t *testing.T) {
+	t.Setenv("MANAGEMENT_PASSWORD", "")
+	gin.SetMode(gin.TestMode)
+
+	idToken := makeCodexIDToken(t, "chatgpt-account-vault", "team")
+	secretServer := httptest.NewServer(http.HandlerFunc(func(w http.ResponseWriter, r *http.Request) {
+		if r.URL.Path != "/v1/secrets/vault-token" {
+			t.Fatalf("secret path = %q", r.URL.Path)
+		}
+		_ = json.NewEncoder(w).Encode(map[string]string{"value": idToken})
+	}))
+	t.Cleanup(secretServer.Close)
+	t.Setenv("CCP_SECRET_BROKER_URL", secretServer.URL)
+	t.Setenv("CCP_SECRET_BROKER_TOKEN", "test-secret-token")
+
+	manager := coreauth.NewManager(nil, nil, nil)
+	if _, errRegister := manager.Register(context.Background(), &coreauth.Auth{
+		ID:       "codex-vault",
+		FileName: "codex-vault.json",
+		Provider: "codex",
+		Attributes: map[string]string{
+			"runtime_only": "true",
+		},
+		Metadata: map[string]any{
+			"id_token": "vault://vault-token",
+		},
+	}); errRegister != nil {
+		t.Fatalf("register auth: %v", errRegister)
+	}
+
+	entry := listSingleAuthFile(t, manager)
+
+	if got := entry["chatgpt_account_id"]; got != "chatgpt-account-vault" {
+		t.Fatalf("chatgpt_account_id = %#v", got)
+	}
+	if got := entry["plan_type"]; got != "team" {
+		t.Fatalf("plan_type = %#v", got)
+	}
+}
+
+func TestListAuthFiles_CodexFallsBackToMetadataAccountID(t *testing.T) {
+	t.Setenv("MANAGEMENT_PASSWORD", "")
+	gin.SetMode(gin.TestMode)
+
+	manager := coreauth.NewManager(nil, nil, nil)
+	if _, errRegister := manager.Register(context.Background(), &coreauth.Auth{
+		ID:       "codex-fallback",
+		FileName: "codex-fallback.json",
+		Provider: "codex",
+		Attributes: map[string]string{
+			"runtime_only": "true",
+		},
+		Metadata: map[string]any{
+			"id_token":   "not-a-jwt",
+			"account_id": "chatgpt-account-fallback",
+			"plan_type":  "plus",
+		},
+	}); errRegister != nil {
+		t.Fatalf("register auth: %v", errRegister)
+	}
+
+	entry := listSingleAuthFile(t, manager)
+
+	if got := entry["chatgpt_account_id"]; got != "chatgpt-account-fallback" {
+		t.Fatalf("chatgpt_account_id = %#v", got)
+	}
+	if got := entry["plan_type"]; got != "plus" {
+		t.Fatalf("plan_type = %#v", got)
+	}
+	if _, ok := entry["id_token"]; ok {
+		t.Fatalf("invalid id_token should not be exposed: %#v", entry["id_token"])
+	}
+}
+
+func listSingleAuthFile(t *testing.T, manager *coreauth.Manager) map[string]any {
+	t.Helper()
+
+	handler := NewHandlerWithoutConfigFilePath(&config.Config{AuthDir: t.TempDir()}, manager)
+	rec := httptest.NewRecorder()
+	ginCtx, _ := gin.CreateTestContext(rec)
+	ginCtx.Request = httptest.NewRequest(http.MethodGet, "/v0/management/auth-files", nil)
+
+	handler.ListAuthFiles(ginCtx)
+
+	if rec.Code != http.StatusOK {
+		t.Fatalf("list status = %d, body = %s", rec.Code, rec.Body.String())
+	}
+
+	var payload struct {
+		Files []map[string]any `json:"files"`
+	}
+	if err := json.Unmarshal(rec.Body.Bytes(), &payload); err != nil {
+		t.Fatalf("decode response: %v", err)
+	}
+	if len(payload.Files) != 1 {
+		t.Fatalf("files length = %d, body = %s", len(payload.Files), rec.Body.String())
+	}
+	return payload.Files[0]
+}
+
+func makeCodexIDToken(t *testing.T, accountID, planType string) string {
+	t.Helper()
+
+	header := map[string]any{"alg": "none", "typ": "JWT"}
+	payload := map[string]any{
+		"https://api.openai.com/auth": map[string]any{
+			"chatgpt_account_id": accountID,
+			"chatgpt_plan_type":  planType,
+		},
+	}
+	return encodeJWTPart(t, header) + "." + encodeJWTPart(t, payload) + ".signature"
+}
+
+func encodeJWTPart(t *testing.T, payload any) string {
+	t.Helper()
+
+	data, err := json.Marshal(payload)
+	if err != nil {
+		t.Fatalf("marshal JWT payload: %v", err)
+	}
+	return base64.RawURLEncoding.EncodeToString(data)
+}
+
+func toJSON(t *testing.T, payload any) string {
+	t.Helper()
+
+	data, err := json.Marshal(payload)
+	if err != nil {
+		t.Fatalf("marshal payload: %v", err)
+	}
+	return string(data)
+}