sub2api 开通授初始余额：余额为 0 的 key 在网关侧直接 403

cloud/tests/test_sub2api.py

@@ -36,6 +36,8 @@ class FakeApi:
         self.next_user_id = 10
         self.next_key_id = 20
         self.fail_refresh_once = False
+        self.balance_calls = []
+        self.fail_balance = False
 
     def __call__(self, method, url, body=None, token=None):
         path = url.split("28084", 1)[-1] if "28084" in url else url
@@ -52,6 +54,12 @@ class FakeApi:
             return 200, {"data": {"access_token": "new-tok",
                                   "refresh_token": "new-ref",
                                   "expires_in": 3600}}
+        if path.startswith("/api/v1/admin/users/") \
+                and path.endswith("/balance") and method == "POST":
+            self.balance_calls.append(body)
+            if self.fail_balance:
+                return 400, {"message": "bad balance"}
+            return 200, {"data": {"balance": body.get("balance")}}
         if path == "/api/v1/admin/users" and method == "POST":
             self.next_user_id += 1
             return 200, {"data": {"id": self.next_user_id}}
@@ -135,6 +143,43 @@ class TestEnsureGatewayKey(unittest.TestCase):
                                              request=self.api)
         self.assertEqual(models, ["gpt-5", "claude-x"])
 
+    def test_provision_grants_opening_balance(self):
+        conn = _conn()
+        key = ensure_user_gateway_key(conn, "user-bal", admin=self.admin,
+                                      request=self.api)
+        self.assertTrue(key.startswith("sk-probe-"))
+        self.assertEqual(len(self.api.balance_calls), 1)
+        self.assertEqual(self.api.balance_calls[0]["balance"], 10.0)
+        self.assertEqual(self.api.balance_calls[0]["operation"], "set")
+
+    def test_provision_balance_failure_cleans_up(self):
+        self.api.fail_balance = True
+        conn = _conn()
+        with self.assertRaises(sub2api.Sub2apiError):
+            ensure_user_gateway_key(conn, "user-fail", admin=self.admin,
+                                    request=self.api)
+        paths = [(m, p) for (m, p, _b, _t) in self.api.calls]
+        self.assertIn(("DELETE", "/api/v1/keys/21"), paths)
+        self.assertIn(("DELETE", "/api/v1/admin/users/11"), paths)
+        row = conn.execute(
+            "SELECT COUNT(*) FROM user_gateway_keys"
+            " WHERE user_id = ?", ("user-fail",)).fetchone()
+        self.assertEqual(row[0], 0)
+
+    def test_provision_zero_opening_balance_skips_grant(self):
+        old = os.environ.get("CLOUD_SUB2API_OPENING_BALANCE_USD")
+        os.environ["CLOUD_SUB2API_OPENING_BALANCE_USD"] = "0"
+        try:
+            conn = _conn()
+            ensure_user_gateway_key(conn, "user-zero", admin=self.admin,
+                                    request=self.api)
+        finally:
+            if old is None:
+                os.environ.pop("CLOUD_SUB2API_OPENING_BALANCE_USD", None)
+            else:
+                os.environ["CLOUD_SUB2API_OPENING_BALANCE_USD"] = old
+        self.assertEqual(self.api.balance_calls, [])
+
 
 class TestProviderCommand(unittest.TestCase):
     def test_server_command_sub2api(self):