feat(account): OpenAI Free 通用基础池 + 个人账号模型白名单严格化

- OpenAI「Free」共享号池改为通用基础池:接受同平台任意等级及未识别等级
  的账号,分组查询保留平台谓词、去掉等级谓词;其他等级池仍精确匹配,
  Grok 的 Free/Heavy 严格匹配不变。
- 个人账号 model_mapping 收敛为「服务端当前定价目录内的非空精确集合」,
  校验时机移到所有业务字段校验之后、重复/容量检查与写入之前。
- 凭证文件导入没有模型选择步骤,按当前活跃渠道定价并集生成同名白名单,
  不使用平台预置模型全集兜底,也不覆盖已有账号的白名单。
- 用户端「测试连接」可选模型列表严格遵守号主白名单,空白名单返回空集合。
- OAuth 授权码兑换成功后立即清理输入与会话,避免创建失败时重复兑换同一个
  一次性 code 导致上游 502;兑换前重新拉取服务端模型目录并校验,失效模型
  明确报错而非静默裁剪。
- OAuth 失败提示统一走 extractApiErrorMessage,修正错误对象结构不符导致的
  空白原因。

Author: Open-Pixel-AI

backend/internal/handler/admin/account_handler_available_models_test.go

@@ -35,14 +35,16 @@ func setupAvailableModelsRouter(adminSvc service.AdminService) *gin.Engine {
 }
 
 func TestAccountHandlerGetAvailableModels_OpenAIOAuthUsesExplicitModelMapping(t *testing.T) {
+	ownerUserID := int64(7)
 	svc := &availableModelsAdminService{
 		stubAdminService: newStubAdminService(),
 		account: service.Account{
-			ID:       42,
-			Name:     "openai-oauth",
-			Platform: service.PlatformOpenAI,
-			Type:     service.AccountTypeOAuth,
-			Status:   service.StatusActive,
+			ID:          42,
+			Name:        "openai-oauth",
+			Platform:    service.PlatformOpenAI,
+			Type:        service.AccountTypeOAuth,
+			Status:      service.StatusActive,
+			OwnerUserID: &ownerUserID,
 			Credentials: map[string]any{
 				"model_mapping": map[string]any{
 					"gpt-5": "gpt-5.1",
@@ -196,6 +198,36 @@ func TestAccountHandlerGetAvailableModels_GeminiGoogleOneRespectsMappingPreceden
 	}
 }
 
+func TestAccountHandlerGetAvailableModels_OwnedOpenAIEmptyWhitelistReturnsNoModels(t *testing.T) {
+	ownerUserID := int64(7)
+	svc := &availableModelsAdminService{
+		stubAdminService: newStubAdminService(),
+		account: service.Account{
+			ID:          46,
+			Name:        "openai-owned-legacy",
+			Platform:    service.PlatformOpenAI,
+			Type:        service.AccountTypeOAuth,
+			Status:      service.StatusActive,
+			OwnerUserID: &ownerUserID,
+			Credentials: map[string]any{"model_mapping": map[string]any{}},
+		},
+	}
+	router := setupAvailableModelsRouter(svc)
+
+	rec := httptest.NewRecorder()
+	req := httptest.NewRequest(http.MethodGet, "/api/v1/admin/accounts/46/models", nil)
+	router.ServeHTTP(rec, req)
+
+	require.Equal(t, http.StatusOK, rec.Code)
+	var resp struct {
+		Data []struct {
+			ID string `json:"id"`
+		} `json:"data"`
+	}
+	require.NoError(t, json.Unmarshal(rec.Body.Bytes(), &resp))
+	require.Empty(t, resp.Data)
+}
+
 func TestAccountHandlerGetAvailableModels_RejectsUnsupportedPlatform(t *testing.T) {
 	svc := &availableModelsAdminService{
 		stubAdminService: newStubAdminService(),

backend/internal/handler/user_account_handler.go

@@ -2274,7 +2274,7 @@ func (h *UserAccountHandler) Test(c *gin.Context) {
 
 // GetAvailableModels handles getting available models for a user-owned account.
 // GET /api/v1/accounts/:id/models
-// 复用 service.AvailableTestModels，与管理员端「测试连接」模型列表保持同一口径。
+// 复用 service.AvailableTestModels，用户端严格遵守个人账号模型白名单。
 func (h *UserAccountHandler) GetAvailableModels(c *gin.Context) {
 	subject, ok := middleware2.GetAuthSubjectFromContext(c)
 	if !ok {

backend/internal/repository/account_repo.go

@@ -4935,10 +4935,12 @@ func (r *accountRepository) queryAccountsByGroup(ctx context.Context, groupID in
 		requiredLevel := service.NormalizeRequiredAccountLevel(group.RequiredAccountLevel)
 		if group.Platform == service.PlatformOpenAI && requiredLevel != "" {
 			allowedLevels := service.OpenAISharedPoolAllowedAccountLevels(requiredLevel)
-			if len(allowedLevels) == 0 {
-				return []service.Account{}, nil
+			// The OpenAI Free pool is level-unrestricted but remains platform-bound.
+			// Strict pools add their exact allowed-level predicate below.
+			preds = append(preds, dbaccount.PlatformEQ(service.PlatformOpenAI))
+			if len(allowedLevels) > 0 {
+				preds = append(preds, dbaccount.AccountLevelIn(allowedLevels...))
 			}
-			preds = append(preds, dbaccount.PlatformEQ(service.PlatformOpenAI), dbaccount.AccountLevelIn(allowedLevels...))
 		} else if group.Platform == service.PlatformGrok && requiredLevel != "" {
 			if !service.IsUserSelectableGrokAccountLevel(requiredLevel) {
 				return []service.Account{}, nil

backend/internal/service/account.go

@@ -344,6 +344,15 @@ func NormalizeOpenAISharedPoolRequiredLevel(level string) string {
 	return NormalizeRequiredAccountLevel(level)
 }
 
+// IsOpenAISharedPoolLevelUnrestricted reports whether an OpenAI shared pool
+// accepts every account level. The Free pool is the platform's common base
+// pool: accounts with a detected paid/custom level and accounts whose level is
+// unknown may all use it. Other non-empty level pools remain exact-match only.
+func IsOpenAISharedPoolLevelUnrestricted(requiredLevel string) bool {
+	required := NormalizeOpenAISharedPoolRequiredLevel(requiredLevel)
+	return required == "" || required == AccountLevelFree
+}
+
 func OpenAISharedPoolLevelRank(level string) int {
 	return OpenAISharedPoolLevelRankWithConfigs(level, DefaultOpenAIAccountLevelConfigs())
 }
@@ -364,7 +373,7 @@ func CanOpenAIAccountJoinSharedPool(accountLevel, requiredLevel string) bool {
 
 func CanOpenAIAccountJoinSharedPoolWithConfigs(accountLevel, requiredLevel string, configs []OpenAIAccountLevelConfig) bool {
 	required := NormalizeOpenAISharedPoolRequiredLevel(requiredLevel)
-	if required == "" {
+	if IsOpenAISharedPoolLevelUnrestricted(required) {
 		return true
 	}
 	account := NormalizeOpenAISharedPoolAccountLevel(accountLevel)
@@ -383,7 +392,10 @@ func OpenAISharedPoolAllowedAccountLevels(requiredLevel string) []string {
 
 func OpenAISharedPoolAllowedAccountLevelsWithConfigs(requiredLevel string, configs []OpenAIAccountLevelConfig) []string {
 	required := NormalizeOpenAISharedPoolRequiredLevel(requiredLevel)
-	if required == "" {
+	// nil means that the pool has no account-level predicate. Callers must still
+	// apply the OpenAI platform predicate so cross-platform stale bindings cannot
+	// enter scheduling.
+	if IsOpenAISharedPoolLevelUnrestricted(required) {
 		return nil
 	}
 	normalizedConfigs := NormalizeOpenAIAccountLevelConfigs(configs)
@@ -392,9 +404,6 @@ func OpenAISharedPoolAllowedAccountLevelsWithConfigs(requiredLevel string, confi
 		return []string{required}
 	}
 	levels := make([]string, 0, 6)
-	if required == AccountLevelFree {
-		levels = append(levels, AccountLevelUnknown)
-	}
 	for _, cfg := range normalizedConfigs {
 		if cfg.Enabled && CanOpenAIAccountJoinSharedPoolWithConfigs(cfg.Key, required, normalizedConfigs) {
 			levels = append(levels, cfg.Key)

backend/internal/service/account_available_models.go

@@ -23,7 +23,8 @@ func accountModelWhitelistKeys(account *Account) []string {
 	return models
 }
 
-// AvailableTestModels 返回账号「测试连接」流程可选的模型列表，管理员端与用户端共用。
+// AvailableTestModels 返回账号「测试连接」流程可选的模型列表。
+// 对个人账号严格使用号主白名单，空白名单必须返回空集合。
 //
 // 返回值是各平台各自的模型切片类型（openai.Model / geminicli.Model / xai.Model /
 // claude.Model / antigravity.ClaudeModel），直接 JSON 序列化给前端即可——前端只依赖

backend/internal/service/account_service.go

@@ -1011,6 +1011,16 @@ func (s *AccountService) ImportOwnedWithResult(ctx context.Context, ownerUserID
 		return nil, err
 	}
 	if !IsOpenAIAgentIdentityCredentials(req.Credentials) {
+		// 凭证文件导入没有单独的模型选择步骤。新建账号时若调用方未携带
+		// model_mapping，使用同一份活跃渠道定价并集生成 identity 白名单；
+		// 这不是平台默认模型兜底，且不会覆盖已有账号的白名单。
+		if !IsOpenAIPersonalAccessTokenCredentials(req.Credentials) {
+			credentials, err := s.ensureOwnedImportModelMapping(ctx, req.Platform, req.Credentials)
+			if err != nil {
+				return nil, err
+			}
+			req.Credentials = credentials
+		}
 		account, err := s.createOwned(ctx, ownerUserID, req, false)
 		if err != nil {
 			return nil, err
@@ -1040,6 +1050,9 @@ func (s *AccountService) ImportOwnedWithResult(ctx context.Context, ownerUserID
 		return &OwnedAccountImportResult{Account: account, Updated: true}, nil
 	}
 
+	if req.Credentials, err = s.ensureOwnedImportModelMapping(ctx, req.Platform, req.Credentials); err != nil {
+		return nil, err
+	}
 	account, err := s.createOwned(ctx, ownerUserID, req, false)
 	if err == nil {
 		return &OwnedAccountImportResult{Account: account}, nil
@@ -1103,6 +1116,9 @@ func (s *AccountService) ImportOwnedValidatedPersonalAccessTokenWithResult(
 		return &OwnedAccountImportResult{Account: account, Updated: true}, nil
 	}
 
+	if req.Credentials, err = s.ensureOwnedImportModelMapping(ctx, req.Platform, req.Credentials); err != nil {
+		return nil, err
+	}
 	account, err := s.createOwned(ctx, ownerUserID, req, true)
 	if err == nil {
 		return &OwnedAccountImportResult{Account: account}, nil
@@ -1358,7 +1374,6 @@ func (s *AccountService) createOwned(ctx context.Context, ownerUserID int64, req
 	if isAgentIdentity {
 		req.Credentials = normalizeOwnedAgentIdentityCredentials(req.Credentials)
 	}
-	_, modelMappingProvided := req.Credentials["model_mapping"]
 	targetLevel := NormalizeAccountLevel(req.AccountLevel)
 	levelConfigs, err := s.openAIAccountLevelConfigs(ctx)
 	if err != nil {
@@ -1369,11 +1384,6 @@ func (s *AccountService) createOwned(ctx context.Context, ownerUserID int64, req
 	if err := applyOwnedPersonalAccountTemplateToCreate(&req); err != nil {
 		return nil, err
 	}
-	if modelMappingProvided {
-		if err := s.validateOwnedPersonalModelMapping(ctx, req.Platform, req.Credentials); err != nil {
-			return nil, err
-		}
-	}
 	if err := validateOwnedAccountSourceForPlatform(req.Platform, req.Type, req.Credentials, req.Extra); err != nil {
 		return nil, err
 	}
@@ -1438,6 +1448,12 @@ func (s *AccountService) createOwned(ctx context.Context, ownerUserID int64, req
 	if err != nil {
 		return nil, err
 	}
+	// 个人账号只能使用非空、精确的服务端定价白名单。放在所有业务字段
+	// 校验之后、任何重复/容量检查和写入之前，既保持错误优先级，也确保
+	// 无效模型不会触发后续副作用。
+	if err := s.validateOwnedPersonalModelMapping(ctx, req.Platform, req.Credentials); err != nil {
+		return nil, err
+	}
 
 	account := &Account{
 		Name:                  req.Name,
@@ -1899,6 +1915,40 @@ func (s *AccountService) listOwnedSelectableModelIDs(ctx context.Context, platfo
 	return result, nil
 }
 
+// ensureOwnedImportModelMapping supplies the compatibility mapping for a
+// credential-file import that does not have a UI model-selection step. The
+// generated mapping is always an identity whitelist from the current active
+// channel pricing union; platform DefaultModels are intentionally never used.
+func (s *AccountService) ensureOwnedImportModelMapping(
+	ctx context.Context,
+	platform string,
+	credentials map[string]any,
+) (map[string]any, error) {
+	next := mergeAccountMap(credentials, nil)
+	if next == nil {
+		next = make(map[string]any)
+	}
+	if _, exists := next["model_mapping"]; exists {
+		return next, nil
+	}
+	models, err := s.listOwnedSelectableModelIDs(ctx, platform)
+	if err != nil {
+		return nil, err
+	}
+	if len(models) == 0 {
+		return nil, ErrOwnedAccountModelMappingInvalid.WithMetadata(map[string]string{
+			"field":    "model_mapping",
+			"platform": strings.ToLower(strings.TrimSpace(platform)),
+		})
+	}
+	mapping := make(map[string]any, len(models))
+	for _, model := range models {
+		mapping[model] = model
+	}
+	next["model_mapping"] = mapping
+	return next, nil
+}
+
 // ListOwnedSelectableModelIDs 返回号主可用于个人账号白名单的精确模型集合。
 // 它只暴露模型 ID，不泄露渠道、价格或分组配置。
 func (s *AccountService) ListOwnedSelectableModelIDs(ctx context.Context, platform string) ([]string, error) {

backend/internal/service/account_service_owned_agent_identity_test.go

@@ -306,6 +306,9 @@ func newOwnedAgentIdentityService(repo *ownedAgentIdentityRepoStub) (*AccountSer
 		accountShareModeRepo:       placementRepo,
 		accountShareRoomRepo:       placementRepo,
 		agentIdentityWSInvalidator: invalidator,
+		pricedModelCatalog: &ownedPricedModelCatalogStub{modelsByPlatform: map[string][]string{
+			PlatformOpenAI: {"test-model"},
+		}},
 	}, invalidator
 }
 
@@ -413,6 +416,7 @@ func TestAccountServiceImportOwnedAgentIdentityCreatesPrivateOwnedAccount(t *tes
 	require.Nil(t, result.Account.ProxyID)
 	require.Nil(t, result.Account.ExpiresAt)
 	require.Equal(t, []int64{ownedAgentIdentityPrivateGroupID}, result.Account.GroupIDs)
+	require.Equal(t, map[string]any{"test-model": "test-model"}, result.Account.Credentials["model_mapping"])
 	require.Empty(t, invalidator.accountIDs)
 }