Skip to content

Refactor/account store provider - #5933

Merged
qin-ctx merged 9 commits into
volcengine:mainfrom
runyunzhou:refactor/account-store-provider
Oct 12, 2026
Merged

qin-ctx merged 9 commits into
volcengine:mainfrom
runyunzhou:refactor/account-store-provider

Conversation

@runyunzhou

@runyunzhou runyunzhou commented Oct 12, 2026 •

Copy link
Copy Markdown
Contributor

Description

本 PR 将现有账号、用户、用户组和 API Key 持久化逻辑重构为可插拔的异步 AccountStore 架构。

现有 AGFS 文件存储实现被抽离为 FileStore,APIKeyManager 收敛为与具体存储实现无关的协调层。认证、OAuth、管理接口、删除流程和历史数据迁移等调用链同步迁移到新的异步契约,同时保持现有文件路径、认证行为和默认配置兼容。

本 PR 仅包含 Account Store 基础抽象和 File provider,不包含 MySQL、Redis 或 Redis + MySQL provider 实现。

Human Involvement

  • A human participated in the implementation or review loop
  • This PR was generated entirely by AI agents without human participation in the loop

Related Issue

N/A

Type of Change

  • Bug fix (non-breaking change that fixes an issue)
  • New feature (non-breaking change that adds functionality)
  • Breaking change (fix or feature that would cause existing functionality to not work as expected)
  • Documentation update
  • Refactoring (no functional changes)
  • Performance improvement
  • Test update

Changes Made

  • 新增异步 AccountStore 契约及共享数据模型,统一账号、用户、用户组、凭证、删除状态和认证相关存储操作。
  • 将原有 AGFS 账号与 API Key 存储逻辑抽离为 FileStore,保留既有文件路径、加密、Argon2 哈希、删除 fence 和凭证轮换语义。
  • 将 APIKeyManager 收敛为 provider 无关的异步协调层,并新增集中式 Store 装配入口。
  • 将 API Key、Trusted、OAuth、MCP、Admin、资源访问、账号删除和历史迁移等调用链迁移到异步接口。
  • 保留多实例文件存储 watcher,并通过显式 fresh management read 保证关键管理操作读取最新状态。
  • 补充 FileStore 原子写入、凭证唯一性、删除并发保护、fresh 查询、装配和身份认证等回归测试。
  • 更新中英文配置及认证文档,说明 Account Store 配置和兼容行为。

Testing

  • I have added tests that prove my fix is effective or that my feature works
  • New and existing unit tests pass locally with my changes
  • I have tested this on the following platforms:
    • Linux
    • macOS
    • Windows

验证结果:

  • pytest tests/server/test_account_services.py tests/server/test_store_assembly.py
    • 13 passed
  • git diff --check main...refactor/account-store-provider
    • Passed
  • 已对 main...refactor/account-store-provider 的完整差异执行代码审查,未发现 P0/P1 级别问题。

Checklist

  • My code follows the project's coding style
  • I have performed a self-review of my code
  • I have commented my code, particularly in hard-to-understand areas
  • I have made corresponding changes to the documentation
  • My changes generate no new warnings
  • Any dependent changes have been merged and published

Screenshots (if applicable)

N/A

Additional Notes

@qin-ctx qin-ctx left a comment

Copy link
Copy Markdown
Collaborator

Choose a reason for hiding this comment

The reason will be displayed to describe this comment to others. Learn more.

AccountStore 抽象能收敛现有存储职责,重构方向合理。当前需要先解决 Studio 将不可读的哈希密钥标为可绑定的问题;另有两处注册路径的额外存储读取,详见 inline comments。

Comment thread openviking/server/routers/admin.py Outdated
Comment thread openviking/server/auth/plugins/trusted.py Outdated
Comment thread openviking/server/api_keys/legacy.py Outdated
@runyunzhou
runyunzhou requested a review from qin-ctx October 12, 2026 09:48
@runyunzhou
runyunzhou force-pushed the refactor/account-store-provider branch from 8bd5653 to 19a71d3 Compare October 12, 2026 11:23

@qin-ctx qin-ctx left a comment

Copy link
Copy Markdown
Collaborator

Choose a reason for hiding this comment

The reason will be displayed to describe this comment to others. Learn more.

当前 Head 存在已复现的自定义认证插件启动回归,修复前暂不建议合入,详见行级评论。

Comment thread openviking/server/app.py Outdated
@runyunzhou
runyunzhou force-pushed the refactor/account-store-provider branch from 19a71d3 to 0c2fe5e Compare October 12, 2026 11:59
@runyunzhou
runyunzhou requested a review from qin-ctx October 12, 2026 12:01
@runyunzhou
runyunzhou force-pushed the refactor/account-store-provider branch from 0c2fe5e to 367fabf Compare October 12, 2026 13:27
@qin-ctx
qin-ctx merged commit 90df145 into volcengine:main Oct 12, 2026
11 checks passed
runyunzhou added a commit to runyunzhou/OpenViking that referenced this pull request Oct 12, 2026
…providers

Main's volcengine#5933 added the abstract AccountStore.create_account to support
trusted keyless identity provisioning. Implement it in the MySQL and
Redis/MySQL providers so they remain instantiable and preserve the
file provider's keyless-admin creation semantics.
@runyunzhou runyunzhou mentioned this pull request Oct 12, 2026
12 of 21 tasks
yenchang265-afk pushed a commit to yenchang265-afk/OpenViking that referenced this pull request Oct 13, 2026
…at startup

Upstream's account store refactor (volcengine#5933) replaced the synchronous
APIKeyManager.get_accounts() with async list_accounts(). The fork's
startup hook (#31) still called get_accounts() synchronously while the
lifespan started, so any server with an API key manager (api_key or
trusted mode) failed to start.

Move the account lookup into the background install task, await
list_accounts(), and log instead of failing when the account store
cannot be read, so Skill installation never blocks startup.

Co-Authored-By: Claude Opus 5.5 <noreply@anthropic.com>
Claude-Session: https://claude.ai/code/session_01Uj7NbV51xgmi6dwwyZq2AW
Sign up for free to join this conversation on GitHub. Already have an account? Sign in to comment

Labels

None yet

Projects

Status: Done

Development

Successfully merging this pull request may close these issues.

2 participants