refactor(access): Introduce ApplyAccessProviders helper function

The logic for reconciling access providers, updating the manager, and logging the changes was previously handled directly in the service layer.

This commit introduces a new `ApplyAccessProviders` helper function in the `internal/access` package to encapsulate this entire process. The service layer is updated to use this new helper, which simplifies its implementation and reduces code duplication.

This refactoring centralizes the provider update logic and improves overall code maintainability. Additionally, the `sdk/access` package import is now aliased to `sdkaccess` for clarity.

internal/access/reconcile.go

@@ -1,25 +1,27 @@
 package access
 
 import (
+	"fmt"
 	"reflect"
 	"sort"
 	"strings"
 
 	"github.com/router-for-me/CLIProxyAPI/v6/internal/config"
-	"github.com/router-for-me/CLIProxyAPI/v6/sdk/access"
+	sdkaccess "github.com/router-for-me/CLIProxyAPI/v6/sdk/access"
 	sdkConfig "github.com/router-for-me/CLIProxyAPI/v6/sdk/config"
+	log "github.com/sirupsen/logrus"
 )
 
 // ReconcileProviders builds the desired provider list by reusing existing providers when possible
 // and creating or removing providers only when their configuration changed. It returns the final
 // ordered provider slice along with the identifiers of providers that were added, updated, or
 // removed compared to the previous configuration.
-func ReconcileProviders(oldCfg, newCfg *config.Config, existing []access.Provider) (result []access.Provider, added, updated, removed []string, err error) {
+func ReconcileProviders(oldCfg, newCfg *config.Config, existing []sdkaccess.Provider) (result []sdkaccess.Provider, added, updated, removed []string, err error) {
 	if newCfg == nil {
 		return nil, nil, nil, nil, nil
 	}
 
-	existingMap := make(map[string]access.Provider, len(existing))
+	existingMap := make(map[string]sdkaccess.Provider, len(existing))
 	for _, provider := range existing {
 		if provider == nil {
 			continue
@@ -30,7 +32,7 @@ func ReconcileProviders(oldCfg, newCfg *config.Config, existing []access.Provide
 	oldCfgMap := accessProviderMap(oldCfg)
 	newEntries := collectProviderEntries(newCfg)
 
-	result = make([]access.Provider, 0, len(newEntries))
+	result = make([]sdkaccess.Provider, 0, len(newEntries))
 	finalIDs := make(map[string]struct{}, len(newEntries))
 
 	isInlineProvider := func(id string) bool {
@@ -60,7 +62,7 @@ func ReconcileProviders(oldCfg, newCfg *config.Config, existing []access.Provide
 			}
 		}
 
-		provider, buildErr := access.BuildProvider(providerCfg, &newCfg.SDKConfig)
+		provider, buildErr := sdkaccess.BuildProvider(providerCfg, &newCfg.SDKConfig)
 		if buildErr != nil {
 			return nil, nil, nil, nil, buildErr
 		}
@@ -88,7 +90,7 @@ func ReconcileProviders(oldCfg, newCfg *config.Config, existing []access.Provide
 						if existingProvider, okExisting := existingMap[key]; okExisting {
 							result = append(result, existingProvider)
 						} else {
-							provider, buildErr := access.BuildProvider(providerCfg, &newCfg.SDKConfig)
+							provider, buildErr := sdkaccess.BuildProvider(providerCfg, &newCfg.SDKConfig)
 							if buildErr != nil {
 								return nil, nil, nil, nil, buildErr
 							}
@@ -100,7 +102,7 @@ func ReconcileProviders(oldCfg, newCfg *config.Config, existing []access.Provide
 							result = append(result, provider)
 						}
 					} else {
-						provider, buildErr := access.BuildProvider(providerCfg, &newCfg.SDKConfig)
+						provider, buildErr := sdkaccess.BuildProvider(providerCfg, &newCfg.SDKConfig)
 						if buildErr != nil {
 							return nil, nil, nil, nil, buildErr
 						}
@@ -112,7 +114,7 @@ func ReconcileProviders(oldCfg, newCfg *config.Config, existing []access.Provide
 						result = append(result, provider)
 					}
 				} else {
-					provider, buildErr := access.BuildProvider(providerCfg, &newCfg.SDKConfig)
+					provider, buildErr := sdkaccess.BuildProvider(providerCfg, &newCfg.SDKConfig)
 					if buildErr != nil {
 						return nil, nil, nil, nil, buildErr
 					}
@@ -146,6 +148,33 @@ func ReconcileProviders(oldCfg, newCfg *config.Config, existing []access.Provide
 	return result, added, updated, removed, nil
 }
 
+// ApplyAccessProviders reconciles the configured access providers against the
+// currently registered providers and updates the manager. It logs a concise
+// summary of the detected changes and returns whether any provider changed.
+func ApplyAccessProviders(manager *sdkaccess.Manager, oldCfg, newCfg *config.Config) (bool, error) {
+	if manager == nil || newCfg == nil {
+		return false, nil
+	}
+
+	existing := manager.Providers()
+	providers, added, updated, removed, err := ReconcileProviders(oldCfg, newCfg, existing)
+	if err != nil {
+		log.Errorf("failed to reconcile request auth providers: %v", err)
+		return false, fmt.Errorf("reconciling access providers: %w", err)
+	}
+
+	manager.SetProviders(providers)
+
+	if len(added)+len(updated)+len(removed) > 0 {
+		log.Debugf("auth providers reconciled (added=%d updated=%d removed=%d)", len(added), len(updated), len(removed))
+		log.Debugf("auth provider changes details - added=%v updated=%v removed=%v", added, updated, removed)
+		return true, nil
+	}
+
+	// log.Debug("auth providers unchanged after config update")
+	return false, nil
+}
+
 func accessProviderMap(cfg *config.Config) map[string]*sdkConfig.AccessProvider {
 	result := make(map[string]*sdkConfig.AccessProvider)
 	if cfg == nil {

internal/api/server.go

@@ -552,19 +552,9 @@ func (s *Server) applyAccessConfig(oldCfg, newCfg *config.Config) {
 	if s == nil || s.accessManager == nil || newCfg == nil {
 		return
 	}
-	existing := s.accessManager.Providers()
+	if _, err := access.ApplyAccessProviders(s.accessManager, oldCfg, newCfg); err != nil {
-	providers, added, updated, removed, err := access.ReconcileProviders(oldCfg, newCfg, existing)
-	if err != nil {
-		log.Errorf("failed to reconcile request auth providers: %v", err)
 		return
 	}
-	s.accessManager.SetProviders(providers)
-	if len(added)+len(updated)+len(removed) > 0 {
-		log.Debugf("auth providers reconciled (added=%d updated=%d removed=%d)", len(added), len(updated), len(removed))
-		log.Debugf("auth provider changes details - added=%v updated=%v removed=%v", added, updated, removed)
-	} else {
-		log.Debug("auth providers unchanged after config update")
-	}
 }
 
 // UpdateClients updates the server's client list and configuration.

sdk/cliproxy/service.go

@@ -115,19 +115,9 @@ func (s *Service) refreshAccessProviders(cfg *config.Config) {
 	oldCfg := s.cfg
 	s.cfgMu.RUnlock()
 
-	existing := s.accessManager.Providers()
+	if _, err := access.ApplyAccessProviders(s.accessManager, oldCfg, cfg); err != nil {
-	providers, added, updated, removed, err := access.ReconcileProviders(oldCfg, cfg, existing)
-	if err != nil {
-		log.Errorf("failed to reconcile request auth providers: %v", err)
 		return
 	}
-	s.accessManager.SetProviders(providers)
-	if len(added)+len(updated)+len(removed) > 0 {
-		log.Debugf("auth providers reconciled (added=%d updated=%d removed=%d)", len(added), len(updated), len(removed))
-		log.Debugf("auth provider changes details - added=%v updated=%v removed=%v", added, updated, removed)
-	} else {
-		log.Debug("auth providers unchanged after config reload")
-	}
 }
 
 func (s *Service) ensureAuthUpdateQueue(ctx context.Context) {