Sub2API v1.0 - AI API 网关（二开初始版本，基于上游 Wei-Shaw/sub2api）

backend/internal/service/openai_gateway_service_shadow_token_test.go

@@ -0,0 +1,47 @@
+package service
+
+import (
+	"context"
+	"testing"
+
+	"github.com/stretchr/testify/require"
+)
+
+// TestGetAccessToken_SparkShadowResolvesToParent 验证对影子账号调用 GetAccessToken
+// 时能透明地解析到母账号的凭据，防止 refresh_token 脱钩。
+// 影子账号不持凭据；断言必须返回母账号的 access_token。
+func TestGetAccessToken_SparkShadowResolvesToParent(t *testing.T) {
+	ctx := context.Background()
+
+	parentID := int64(100)
+	parent := Account{
+		ID:       parentID,
+		Platform: PlatformOpenAI,
+		Type:     AccountTypeOAuth,
+		Status:   StatusActive,
+		Credentials: map[string]any{
+			"access_token": "parent-access-token",
+		},
+	}
+	shadow := Account{
+		ID:              200,
+		Platform:        PlatformOpenAI,
+		Type:            AccountTypeOAuth,
+		ParentAccountID: &parentID,
+		// 影子账号不持凭据，与生产语义一致
+	}
+
+	repo := &stubOpenAIAccountRepo{accounts: []Account{parent}}
+
+	svc := &OpenAIGatewayService{
+		accountRepo: repo,
+		// openAITokenProvider=nil → 走降级路径，直接读 account.GetOpenAIAccessToken()
+	}
+
+	// Before fix (RED): shadow 无凭据 → GetOpenAIAccessToken()="" → error
+	// After fix (GREEN): shadow 解析到 parent → 返回 parent 的 "parent-access-token"
+	token, tokenType, err := svc.GetAccessToken(ctx, &shadow)
+	require.NoError(t, err)
+	require.Equal(t, "parent-access-token", token)
+	require.Equal(t, "oauth", tokenType)
+}