多 key：OAuth 登录签发附加 key 不再轮换，keys 管理端点

cloud/tests/test_oauth_real_login.py

@@ -107,7 +107,7 @@ class OAuthRealLoginTestCase(unittest.TestCase):
         self.assertIsNotNone(match, page)
         return match.group(1)
 
-    # -- GET 回调成功：发 key、key 可用、轮换旧 key 失效 -------------
+    # -- GET 回调成功：发 key、旧 key 不失效（多 key） ---------------
     def test_get_callback_success_issues_key_and_rotation(self):
         state = self._login_state()
         status, page = self._req(
@@ -121,20 +121,22 @@ class OAuthRealLoginTestCase(unittest.TestCase):
         user_id = self.auth.authenticate(key1)
         self.assertIsNotNone(user_id)
 
-        # 同一身份第二次登录：新 key、旧 key 失效、审计有轮换记录。
+        # 同一身份第二次登录：新 key 是附加 key，旧 key 仍可用，
+        # 审计记 api_key_issued（不再轮换、不再记 api_key_rotated）。
         state2 = self._login_state()
         status, page2 = self._req(
             "GET", "/oauth/github/callback?code=fake-code&state=" + state2)
         self.assertEqual(status, 200, page2)
         self.assertIn("new user: no", page2)
-        self.assertIn("rotated", page2)
+        self.assertIn("Previous keys still work", page2)
         key2 = self._api_key_in_page(page2)
         self.assertNotEqual(key1, key2)
-        self.assertIsNone(self.auth.authenticate(key1))
+        self.assertEqual(self.auth.authenticate(key1), user_id)
         self.assertEqual(self.auth.authenticate(key2), user_id)
         actions = [row["action"] for row in self.auth.list_audit("", limit=50)]
         self.assertIn("oauth_login", actions)
-        self.assertIn("api_key_rotated", actions)
+        self.assertIn("api_key_issued", actions)
+        self.assertNotIn("api_key_rotated", actions)
 
     def test_post_callback_success_returns_key_once(self):
         state = self._login_state()