fix(officeace): 昵称取 principal_urn 里的用户名；轮询失败透出上游原因

- `client-permission-validate` 没有独立用户名字段，用户名只在
  `principal_urn`（`iam::<account>:user:<name>`）末尾。之前没解析，
  凭证昵称退化成一串 32 位账号 ID，用户认不出哪条是自己的。
- 登录对话框轮询失败时统一显示「登录轮询失败，请重试」，把上游可行动
  的原因（如「这个账号还没开通 officeAce 服务」）吞掉了，用户不知道该
  去开通。改为透出 ApiError 的 message。

Author: RobbsLuo

src/provider/officeace/events.py

@@ -600,12 +600,29 @@ def parse_model_info(payload: Any) -> dict[str, str]:
     return {
         "account_id": str(data.get("account_id") or ""),
         "principal_id": str(data.get("principal_id") or ""),
+        "user_name": _user_name_of(data),
         "app_key": str(auth_info.get("model_app_key") or ""),
         "app_secret": str(auth_info.get("model_app_secret") or ""),
         "base_url": base,
     }
 
 
+def _user_name_of(data: dict[str, Any]) -> str:
+    """从 `principal_urn` 末尾取用户名：`iam::<account>:user:<name>`。
+
+    该接口**没有**独立的用户名字段（实测 2026-10-21），用户名只出现在 URN
+    里。取不到就留空——调用方会退到账号 ID 当昵称，不能让登录因此失败。
+    """
+    explicit = str(data.get("user_name") or data.get("userName") or "").strip()
+    if explicit:
+        return explicit
+    urn = str(data.get("principal_urn") or "")
+    marker = ":user:"
+    if marker not in urn:
+        return ""
+    return urn.split(marker, 1)[1].strip()
+
+
 def build_authorize_url(*, auth_base: str, client_id: str, state: str,
                         code_challenge: str, redirect_uri: str) -> str:
     """拼华为云授权地址（参数集与 OfficeAce 客户端逐项对齐，勿增删）。

src/provider/officeace/oauth.py

@@ -372,6 +372,9 @@ async def _finish(self, code: str,
         credential.model_base_url = info["base_url"]
         credential.account_id = info["account_id"] or credential.account_id
         credential.principal_id = info["principal_id"] or credential.principal_id
+        # 用户名只出现在 `principal_urn` 里（接口无独立字段）：补上后昵称才不是
+        # 一串 32 位账号 ID，用户才认得出「哪条凭证是自己的」。
+        credential.user_name = info["user_name"] or credential.user_name
         # 昵称只用于展示：优先上游给的、其次用户名、最后账号 ID（都没有就留空，
         # 前端按凭证 ID 兜底）。用 `or` 链而非 if：三者都缺是合法情况，
         # STS 响应本身并不带 nickname 字段。

tests/provider/officeace/test_events.py

@@ -468,7 +468,7 @@ def test_parse_model_info_reads_subscription_block():
         }},
     }
     assert events.parse_model_info(payload) == {
-        "account_id": "acct", "principal_id": "prin",
+        "account_id": "acct", "principal_id": "prin", "user_name": "",
         "app_key": "K", "app_secret": "S", "base_url": "https://gw.test/v2",
     }
 
@@ -484,8 +484,8 @@ def test_parse_model_info_unprovisioned_account():
     """未开通：`subscription: null`（实测三账号全如此）→ 各字段空。"""
     info = events.parse_model_info({"account_id": "a", "subscription": None,
                                     "model_info": {}})
-    assert info == {"account_id": "a", "principal_id": "", "app_key": "",
-                    "app_secret": "", "base_url": ""}
+    assert info == {"account_id": "a", "principal_id": "", "user_name": "",
+                    "app_key": "", "app_secret": "", "base_url": ""}
 
 
 def test_parse_model_info_tolerates_garbage():
@@ -495,6 +495,29 @@ def test_parse_model_info_tolerates_garbage():
         {"subscription": {"model_info": {"model_auth_info": "x"}}})["base_url"] == ""
 
 
+def test_parse_model_info_reads_user_name_from_principal_urn():
+    """用户名只在 `principal_urn` 末尾，接口没有独立字段（2026-10-21 实测）。"""
+    info = events.parse_model_info(
+        {"principal_urn": "iam::acct:user:robbsluo"})
+    assert info["user_name"] == "robbsluo"
+
+
+def test_parse_model_info_prefers_explicit_user_name():
+    for key in ("user_name", "userName"):
+        info = events.parse_model_info(
+            {key: " carol ", "principal_urn": "iam::acct:user:ignored"})
+        assert info["user_name"] == "carol"
+
+
+def test_parse_model_info_urn_without_user_marker_is_blank():
+    """URM 形态变了也不能炸：认不出就留空，昵称退到账号 ID。"""
+    assert events.parse_model_info({"principal_urn": "iam::acct"})["user_name"] == ""
+    assert events.parse_model_info(
+        {"principal_urn": 123})["user_name"] == ""
+    assert events.parse_model_info(
+        {"user_name": "  "})["user_name"] == ""
+
+
 # ------------------------------------------------------------------ 授权 URL
 
 def test_build_authorize_url_wraps_login_page():

tests/provider/officeace/test_oauth.py

@@ -381,6 +381,17 @@ async def test_poll_nickname_falls_back_to_user_name():
     assert result is not None and result.nickname == "carol"
 
 
+async def test_poll_nickname_from_principal_urn():
+    """令牌里没名字时用开通校验的 `principal_urn`：否则昵称是一串账号 ID。"""
+    oauth, state = await _started(_flow(permission=_permission_response(
+        principal_urn="iam::acct:user:dave")))
+    result = await oauth.poll(state, "alice")
+    assert result is not None
+    assert result.nickname == "dave"
+    assert OfficeAceCredential.from_dict(
+        result.credential_data).user_name == "dave"
+
+
 async def test_poll_concurrent_consume_raises():
     """两路轮询同时拿到码时，后完成的那路不能再落一条重复凭证。"""
     class LosingStore(AuthStateStore):

web/src/components/AddCredentialDialog.tsx

@@ -173,9 +173,13 @@ export function AddCredentialDialog({
             onNotice("登录成功，凭证已保存。");
             onImported("登录成功，凭证已保存。");
           }
-        } catch {
+        } catch (caught) {
           stopPolling(provider);
-          onError("登录轮询失败，请重试。");
+          // 轮询失败多半是上游给的可行动原因（如「这个账号还没开通 officeAce」），
+          // 兜底文案会把它抹掉，用户只会看到「失败」而不知道该去做什么。
+          onError(caught instanceof Error && caught.message
+            ? caught.message
+            : "登录轮询失败，请重试。");
         }
       }, interval);
       loginTimersRef.current[provider] = timer;

web/src/components/__tests__/AddCredentialDialog.test.tsx

@@ -86,6 +86,31 @@ describe("AddCredentialDialog", () => {
     vi.useRealTimers();
   });
 
+  it("poll 失败时透出上游可行动原因，而不是兜底文案", async () => {
+    vi.useFakeTimers({ shouldAdvanceTime: true });
+    vi.stubGlobal("fetch", vi.fn(async (input: RequestInfo | URL) => {
+      const url = String(input);
+      if (url.includes("/upstream/start")) {
+        return jsonResponse({ flow: "poll", state: "s", auth_url: "https://a", interval: 1 });
+      }
+      if (url.includes("/upstream/poll")) {
+        return jsonResponse({ error: {
+          code: "upstream_error",
+          message: "这个账号还没开通 officeAce 服务。请先在 OfficeAce 客户端里登录并兑换邀请码完成开通，再回来重新登录。",
+        } }, 400);
+      }
+      return jsonResponse({ credentials: [], viewer: "root", is_admin: true });
+    }));
+    vi.stubGlobal("open", () => null);
+    const props = renderDialog();
+    await userEvent.click(screen.getByTestId("start-login-officeace"));
+    await vi.advanceTimersByTimeAsync(2000);
+
+    expect(props.onError).toHaveBeenCalledWith(
+      expect.stringContaining("还没开通 officeAce 服务"));
+    vi.useRealTimers();
+  });
+
   it("拒绝非 http(s) 授权地址，不对弹窗赋值", async () => {
     vi.stubGlobal("fetch", vi.fn(async (input: RequestInfo | URL) => {
       const url = String(input);