feat: add openai-compatible model gateway

backend/apps/modelhub/tests/__init__.py

@@ -0,0 +1 @@
+

backend/apps/modelhub/tests/test_crypto.py

@@ -0,0 +1,23 @@
+import pytest
+
+from apps.modelhub.crypto import (
+    CredentialEncryptionError,
+    decrypt_secret,
+    encrypt_secret,
+    mask_secret,
+)
+
+
+def test_encrypts_masks_and_decrypts_secret(settings):
+    encrypted = encrypt_secret("sk-example-1234")
+
+    assert encrypted != "sk-example-1234"
+    assert decrypt_secret(encrypted) == "sk-example-1234"
+    assert mask_secret(encrypted) == "****1234"
+
+
+def test_missing_encryption_key_is_rejected(settings):
+    settings.AI_CREDENTIAL_ENCRYPTION_KEY = ""
+
+    with pytest.raises(CredentialEncryptionError):
+        encrypt_secret("secret")

backend/apps/modelhub/tests/test_modelhub_api.py

@@ -0,0 +1,88 @@
+from django.contrib.auth import get_user_model
+from django.core.management import call_command
+
+from apps.modelhub.crypto import decrypt_secret
+from apps.modelhub.models import ModelProvider
+from apps.modelhub.services import CompletionResult
+
+
+def login_admin(client):
+    call_command("bootstrap_governance")
+    user = get_user_model().objects.get(username="admin")
+    client.force_login(user)
+    return user
+
+
+def create_provider(client):
+    return client.post(
+        "/api/modelhub/providers",
+        data={
+            "name": "企业模型渠道",
+            "base_url": "https://models.example.com/v1/",
+            "api_key": "sk-secret-1234",
+            "default_timeout_seconds": 30,
+        },
+        content_type="application/json",
+    )
+
+
+def test_admin_manages_provider_without_exposing_secret(client, db):
+    login_admin(client)
+
+    response = create_provider(client)
+
+    assert response.status_code == 200
+    assert "api_key" not in response.json()
+    assert response.json()["credential_masked"] == "****1234"
+    provider = ModelProvider.objects.get()
+    assert provider.api_key_encrypted != "sk-secret-1234"
+    assert decrypt_secret(provider.api_key_encrypted) == "sk-secret-1234"
+
+    updated = client.patch(
+        f"/api/modelhub/providers/{provider.id}",
+        data={"name": "新渠道名称", "api_key": ""},
+        content_type="application/json",
+    )
+    assert updated.status_code == 200
+    provider.refresh_from_db()
+    assert decrypt_secret(provider.api_key_encrypted) == "sk-secret-1234"
+
+
+def test_model_test_runs_through_recorded_invocation(client, db, monkeypatch):
+    login_admin(client)
+    provider_id = create_provider(client).json()["id"]
+    deployment = client.post(
+        "/api/modelhub/deployments",
+        data={
+            "provider_id": provider_id,
+            "display_name": "支持模型",
+            "model_name": "support-model",
+        },
+        content_type="application/json",
+    )
+    assert deployment.status_code == 200
+
+    monkeypatch.setattr(
+        "apps.modelhub.services._request_completion",
+        lambda *args, **kwargs: CompletionResult("连接正常", 8, 4),
+    )
+    response = client.post(
+        f"/api/modelhub/deployments/{deployment.json()['id']}/test",
+        data={"prompt": "测试连接"},
+        content_type="application/json",
+    )
+
+    assert response.status_code == 200
+    assert response.json()["status"] == "succeeded"
+    assert response.json()["output_text"] == "连接正常"
+    assert response.json()["input_tokens"] == 8
+    assert response.json()["output_tokens"] == 4
+
+
+def test_non_ai_admin_cannot_manage_modelhub(client, db):
+    user = get_user_model().objects.create_user(username="requester", password="password")
+    client.force_login(user)
+
+    response = client.get("/api/modelhub/providers")
+
+    assert response.status_code == 403

backend/apps/modelhub/tests/test_services.py

@@ -0,0 +1,59 @@
+from openai import APITimeoutError
+
+from apps.modelhub.crypto import encrypt_secret
+from apps.modelhub.models import ModelDeployment, ModelInvocation, ModelProvider
+from apps.modelhub.services import CompletionResult, execute_invocation
+
+
+def create_invocation():
+    provider = ModelProvider.objects.create(
+        name="模型渠道",
+        base_url="https://models.example.com/v1",
+        api_key_encrypted=encrypt_secret("secret"),
+    )
+    deployment = ModelDeployment.objects.create(
+        provider=provider,
+        display_name="支持模型",
+        model_name="support-model",
+    )
+    return ModelInvocation.objects.create(
+        deployment=deployment,
+        input_snapshot={"messages": [{"role": "user", "content": "hello"}]},
+    )
+
+
+def test_transient_error_retries_once(db, monkeypatch):
+    invocation = create_invocation()
+    calls = []
+
+    def request(*args, **kwargs):
+        calls.append(1)
+        if len(calls) == 1:
+            raise APITimeoutError(request=None)
+        return CompletionResult("ok", 3, 1)
+
+    monkeypatch.setattr("apps.modelhub.services._request_completion", request)
+    monkeypatch.setattr("apps.modelhub.services.sleep", lambda *_: None)
+
+    execute_invocation(invocation, invocation.input_snapshot["messages"])
+
+    invocation.refresh_from_db()
+    assert len(calls) == 2
+    assert invocation.status == "succeeded"
+    assert invocation.retry_count == 1
+
+
+def test_non_transient_error_fails_without_exposing_raw_error(db, monkeypatch):
+    invocation = create_invocation()
+
+    def request(*args, **kwargs):
+        raise ValueError("secret provider detail")
+
+    monkeypatch.setattr("apps.modelhub.services._request_completion", request)
+
+    execute_invocation(invocation, invocation.input_snapshot["messages"])
+
+    invocation.refresh_from_db()
+    assert invocation.status == "failed"
+    assert invocation.error_code == "unexpected_error"
+    assert "secret provider detail" not in invocation.error_message