refactor: comprehensive audit — fix bugs, harden security, deduplicate providers, add CI/Docker

Phase 1: Fix compilation (config_path Option<PathBuf>, streaming test, stale test cleanup)
Phase 2: Fix critical bugs (remove block_on deadlocks in 4 providers, fix broken SQL query builder)
Phase 3: Security hardening (session manager, real auth, token masking, Gemini key to header, password policy)
Phase 4: Implement stubs (real provider test, /proc health metrics, client/provider/backup endpoints, has_images)
Phase 5: Code quality (shared provider helpers, explicit re-exports, all Clippy warnings fixed, unwrap removal, 6 unused deps removed, dashboard split into 7 sub-modules)
Phase 6: Infrastructure (GitHub Actions CI, multi-stage Dockerfile, rustfmt.toml, clippy.toml, script fixes)

src/providers/openai.rs

@@ -1,18 +1,14 @@
-use async_trait::async_trait;
 use anyhow::Result;
-use futures::stream::{BoxStream, StreamExt};
-use serde_json::Value;
+use async_trait::async_trait;
+use futures::stream::BoxStream;
 
-use crate::{
-    models::UnifiedRequest,
-    errors::AppError,
-    config::AppConfig,
-};
+use super::helpers;
 use super::{ProviderResponse, ProviderStreamChunk};
+use crate::{config::AppConfig, errors::AppError, models::UnifiedRequest};
 
 pub struct OpenAIProvider {
     client: reqwest::Client,
-    _config: crate::config::OpenAIConfig,
+    config: crate::config::OpenAIConfig,
     api_key: String,
     pricing: Vec<crate::config::ModelPricing>,
 }
@@ -26,7 +22,7 @@ impl OpenAIProvider {
     pub fn new_with_key(config: &crate::config::OpenAIConfig, app_config: &AppConfig, api_key: String) -> Result<Self> {
         Ok(Self {
             client: reqwest::Client::new(),
-            _config: config.clone(),
+            config: config.clone(),
             api_key,
             pricing: app_config.pricing.openai.clone(),
         })
@@ -47,40 +43,13 @@ impl super::Provider for OpenAIProvider {
         true
     }
 
-    async fn chat_completion(
-        &self,
-        request: UnifiedRequest,
-    ) -> Result<ProviderResponse, AppError> {
-        let mut body = serde_json::json!({
-            "model": request.model,
-            "messages": request.messages.iter().map(|m| {
-                serde_json::json!({
-                    "role": m.role,
-                    "content": m.content.iter().map(|p| {
-                        match p {
-                            crate::models::ContentPart::Text { text } => serde_json::json!({ "type": "text", "text": text }),
-                            crate::models::ContentPart::Image(image_input) => {
-                                let (base64_data, mime_type) = futures::executor::block_on(image_input.to_base64()).unwrap_or_default();
-                                serde_json::json!({
-                                    "type": "image_url",
-                                    "image_url": { "url": format!("data:{};base64,{}", mime_type, base64_data) }
-                                })
-                            }
-                        }
-                    }).collect::<Vec<_>>()
-                })
-            }).collect::<Vec<_>>(),
-            "stream": false,
-        });
+    async fn chat_completion(&self, request: UnifiedRequest) -> Result<ProviderResponse, AppError> {
+        let messages_json = helpers::messages_to_openai_json(&request.messages).await?;
+        let body = helpers::build_openai_body(&request, messages_json, false);
 
-        if let Some(temp) = request.temperature {
-            body["temperature"] = serde_json::json!(temp);
-        }
-        if let Some(max_tokens) = request.max_tokens {
-            body["max_tokens"] = serde_json::json!(max_tokens);
-        }
-
-        let response = self.client.post(format!("{}/chat/completions", self._config.base_url))
+        let response = self
+            .client
+            .post(format!("{}/chat/completions", self.config.base_url))
             .header("Authorization", format!("Bearer {}", self.api_key))
             .json(&body)
             .send()
@@ -92,125 +61,51 @@ impl super::Provider for OpenAIProvider {
             return Err(AppError::ProviderError(format!("OpenAI API error: {}", error_text)));
         }
 
-        let resp_json: Value = response.json().await.map_err(|e| AppError::ProviderError(e.to_string()))?;
-        
-        let choice = resp_json["choices"].get(0).ok_or_else(|| AppError::ProviderError("No choices in response".to_string()))?;
-        let message = &choice["message"];
-        
-        let content = message["content"].as_str().unwrap_or_default().to_string();
-        let reasoning_content = message["reasoning_content"].as_str().map(|s| s.to_string());
-        
-        let usage = &resp_json["usage"];
-        let prompt_tokens = usage["prompt_tokens"].as_u64().unwrap_or(0) as u32;
-        let completion_tokens = usage["completion_tokens"].as_u64().unwrap_or(0) as u32;
-        let total_tokens = usage["total_tokens"].as_u64().unwrap_or(0) as u32;
+        let resp_json: serde_json::Value = response
+            .json()
+            .await
+            .map_err(|e| AppError::ProviderError(e.to_string()))?;
 
-        Ok(ProviderResponse {
-            content,
-            reasoning_content,
-            prompt_tokens,
-            completion_tokens,
-            total_tokens,
-            model: request.model,
-        })
+        helpers::parse_openai_response(&resp_json, request.model)
     }
 
     fn estimate_tokens(&self, request: &UnifiedRequest) -> Result<u32> {
         Ok(crate::utils::tokens::estimate_request_tokens(&request.model, request))
     }
 
-    fn calculate_cost(&self, model: &str, prompt_tokens: u32, completion_tokens: u32, registry: &crate::models::registry::ModelRegistry) -> f64 {
-        if let Some(metadata) = registry.find_model(model) {
-            if let Some(cost) = &metadata.cost {
-                return (prompt_tokens as f64 * cost.input / 1_000_000.0) + 
-                       (completion_tokens as f64 * cost.output / 1_000_000.0);
-            }
-        }
-        
-        let (prompt_rate, completion_rate) = self.pricing.iter()
-            .find(|p| model.contains(&p.model))
-            .map(|p| (p.prompt_tokens_per_million, p.completion_tokens_per_million))
-            .unwrap_or((0.15, 0.60));
-            
-        (prompt_tokens as f64 * prompt_rate / 1_000_000.0) + (completion_tokens as f64 * completion_rate / 1_000_000.0)
+    fn calculate_cost(
+        &self,
+        model: &str,
+        prompt_tokens: u32,
+        completion_tokens: u32,
+        registry: &crate::models::registry::ModelRegistry,
+    ) -> f64 {
+        helpers::calculate_cost_with_registry(
+            model,
+            prompt_tokens,
+            completion_tokens,
+            registry,
+            &self.pricing,
+            0.15,
+            0.60,
+        )
     }
 
     async fn chat_completion_stream(
         &self,
         request: UnifiedRequest,
     ) -> Result<BoxStream<'static, Result<ProviderStreamChunk, AppError>>, AppError> {
-        let mut body = serde_json::json!({
-            "model": request.model,
-            "messages": request.messages.iter().map(|m| {
-                serde_json::json!({
-                    "role": m.role,
-                    "content": m.content.iter().map(|p| {
-                        match p {
-                            crate::models::ContentPart::Text { text } => serde_json::json!({ "type": "text", "text": text }),
-                            crate::models::ContentPart::Image(image_input) => {
-                                let (base64_data, mime_type) = futures::executor::block_on(image_input.to_base64()).unwrap_or_default();
-                                serde_json::json!({
-                                    "type": "image_url",
-                                    "image_url": { "url": format!("data:{};base64,{}", mime_type, base64_data) }
-                                })
-                            }
-                        }
-                    }).collect::<Vec<_>>()
-                })
-            }).collect::<Vec<_>>(),
-            "stream": true,
-        });
+        let messages_json = helpers::messages_to_openai_json(&request.messages).await?;
+        let body = helpers::build_openai_body(&request, messages_json, true);
 
-        if let Some(temp) = request.temperature {
-            body["temperature"] = serde_json::json!(temp);
-        }
-        if let Some(max_tokens) = request.max_tokens {
-            body["max_tokens"] = serde_json::json!(max_tokens);
-        }
+        let es = reqwest_eventsource::EventSource::new(
+            self.client
+                .post(format!("{}/chat/completions", self.config.base_url))
+                .header("Authorization", format!("Bearer {}", self.api_key))
+                .json(&body),
+        )
+        .map_err(|e| AppError::ProviderError(format!("Failed to create EventSource: {}", e)))?;
 
-        // Create eventsource stream
-        use reqwest_eventsource::{EventSource, Event};
-        let es = EventSource::new(self.client.post(format!("{}/chat/completions", self._config.base_url))
-            .header("Authorization", format!("Bearer {}", self.api_key))
-            .json(&body))
-            .map_err(|e| AppError::ProviderError(format!("Failed to create EventSource: {}", e)))?;
-        
-        let model = request.model.clone();
-        
-        let stream = async_stream::try_stream! {
-            let mut es = es;
-            while let Some(event) = es.next().await {
-                match event {
-                    Ok(Event::Message(msg)) => {
-                        if msg.data == "[DONE]" {
-                            break;
-                        }
-                        
-                        let chunk: Value = serde_json::from_str(&msg.data)
-                            .map_err(|e| AppError::ProviderError(format!("Failed to parse stream chunk: {}", e)))?;
-                        
-                        if let Some(choice) = chunk["choices"].get(0) {
-                            let delta = &choice["delta"];
-                            let content = delta["content"].as_str().unwrap_or_default().to_string();
-                            let reasoning_content = delta["reasoning_content"].as_str().map(|s| s.to_string());
-                            let finish_reason = choice["finish_reason"].as_str().map(|s| s.to_string());
-                            
-                            yield ProviderStreamChunk {
-                                content,
-                                reasoning_content,
-                                finish_reason,
-                                model: model.clone(),
-                            };
-                        }
-                    }
-                    Ok(_) => continue,
-                    Err(e) => {
-                        Err(AppError::ProviderError(format!("Stream error: {}", e)))?;
-                    }
-                }
-            }
-        };
-        
-        Ok(Box::pin(stream))
+        Ok(helpers::create_openai_stream(es, request.model, None))
     }
 }