opensource/sub2api
3
0
Fork 0
mirror of https://github.com/Wei-Shaw/sub2api.git synced 2026-09-24 16:05:44 +08:00
Code Issues Packages Projects Releases Wiki Activity
4,266 Commits 38 Branches 54 Tags
67e945f8e83ab65d0ebdc3c5bcf8a8549f74e1fd
Commit Graph
4266 Commits
This Branch
This Branch
All Branches
Author SHA1 Message Date
Wesley Liddick 67e945f8e8 Merge pull request #3759 from Wei-Shaw/feat/account-header-override 
feat: apikey 账号支持请求头覆写（Anthropic/OpenAI）
 2026-07-06 20:47:33 +08:00
shaw 31b6e0d94a fix: 请求头覆写审计问题修复（禁止名单缺口/beta 对称性/批量清空防护） 
后端：
- 禁止名单补充 content-type（multipart boundary 为每请求随机值，静态覆写必坏
  images 路径）、x-claude-code-session-id / x-client-request-id（会击穿每请求
  会话同步，与已禁的 session_id 等同类）、cookie / x-goog-api-key（与透传路径
  的入站鉴权残留清洗保持一致）
- anthropic-beta 覆写与 body 净化对称：四个 Anthropic 构建器在
  sanitizeAnthropicBodyForBetaTokens 前以覆写值为有效 finalBeta，避免覆写
  丢 token 后 header/body 不对称被上游 400
- 保存/应用两路径共用 normalizeHeaderOverrideEntry，消除双份校验规则漂移
- GetHeaderOverrides 按 modelMappingCache 先例增加热路径缓存（WS 每消息
  重建头场景收益最大）；ApplyHeaderOverrides 移除无观测效果的排序

前端：
- 禁止名单镜像同步新增项；值长度改按 UTF-8 字节校验（与后端 len() 对齐）
- Create 弹窗切换平台时重置覆写配置，避免上一平台模板行串台
- BulkEdit：开启覆写但无有效行时拦截保存（防止整键替换静默清空所选账号
  既有配置）；开启分支显示整体替换警告；混合平台选择时隐藏模板按钮
- 删除未使用的 isBlockedHeaderOverrideName 导出
 2026-07-06 20:05:50 +08:00
shaw ec7b20649e feat: apikey 账号支持请求头覆写（Anthropic/OpenAI） 
- 账号 credentials 新增 header_override_enabled / header_overrides，
  仅对 anthropic/openai 平台的 api_key 账号生效
- 转发前对同名请求头做大小写不敏感覆盖（EqualFold 全量删除后按
  wire casing 写入单值），值为空的条目视为占位不参与覆盖
- 覆盖全部出站路径：/v1/messages（标准+透传）、count_tokens、
  /v1/responses、chat completions、embeddings、images、全部 WS 模式、
  账号测试/探测、上游模型列表
- 创建/编辑/批量更新统一校验：RFC 7230 名称格式、去重、长度/条目上限、
  24 个禁止覆写头（认证/连接控制/accept-encoding/sec-websocket-*/
  会话隔离头），应用时二次防御过滤
- 前端三个账号弹窗新增开关+键值行编辑器+模板按钮（Claude Code CLI /
  Codex CLI 标准头，值为空），本地校验与后端规则对齐，i18n 中英文
 2026-07-06 19:11:08 +08:00
shaw 6cea1c35bb feat: 适配 OpenAI 新模型 gpt-5.6-sol/terra/luna 2026-07-06 17:34:22 +08:00
Wesley Liddick d1d3400b69 Merge pull request #3645 from bestony/worktree/lucky-harbor-dbe4 
feat(keys): add api key concurrency stats
 2026-07-06 16:45:15 +08:00
github-actions[bot] 76bb7b0338 chore: sync VERSION to 0.1.145 [skip ci] 2026-07-06 08:30:51 +00:00
Wesley Liddick 3fa08aa930 Merge pull request #3749 from moonfunjohn/codex/easypay-custom-methods 
EasyPay custom visible payment methods
v0.1.145 		2026-07-06 16:06:59 +08:00
Albert Coady 27cb485d55 fix: share built-in payment method matching 2026-07-06 15:00:29 +08:00
Albert Coady 22ec77b570 fix: match built-in payment methods exactly 2026-07-06 15:00:29 +08:00
Albert Coady b197ba61ce test: align antigravity mapping preset label 2026-07-06 15:00:29 +08:00
Albert Coady a5a2fea045 Polish EasyPay custom method UI 2026-07-06 15:00:29 +08:00
Albert Coady 0dc6e56aae fix: harden easypay custom method validation 2026-07-06 15:00:29 +08:00
Albert Coady bf76168ba5 feat: add custom easypay payment methods 2026-07-06 15:00:29 +08:00
Wesley Liddick 2854ab2ace Merge pull request #3744 from Wei-Shaw/fix/subscription-cny-optin-rate 
fix(payment): 订阅 CNY 换算改为独立汇率配置的显式 opt-in（含 #3738）
 2026-07-06 14:58:20 +08:00
Wesley Liddick e95c909ee5 Merge pull request #3747 from Wei-Shaw/revert-3738-fix/subscription-confirm-amount-and-affiliate-base 
Revert "fix(payment): 订阅确认页显示换算后 CNY 金额 + 邀请返利按 USD price 计算"
 2026-07-06 14:58:00 +08:00
Wesley Liddick ba1bb0a3d3 Revert "fix(payment): 订阅确认页显示换算后 CNY 金额 + 邀请返利按 USD price 计算" 2026-07-06 14:55:04 +08:00
Wesley Liddick 11fd61458c Merge pull request #3738 from wucm667/fix/subscription-confirm-amount-and-affiliate-base 
fix(payment): 订阅确认页显示换算后 CNY 金额 + 邀请返利按 USD price 计算
 2026-07-06 14:53:59 +08:00
shaw d56e94b875 feat(payment): 订阅 CNY 换算改为独立汇率配置的显式 opt-in 
- 新增 SUBSCRIPTION_USD_TO_CNY_RATE 配置（1 USD = X CNY，默认 0=关闭），
  替代复用 balance_recharge_multiplier 的隐式换算，促销倍率与订阅定价解耦
- 未配置汇率时订阅保持 price 直付的存量行为，存量部署升级零影响
- 前端确认页/原价/手续费/方式限额与后端换算条件严格镜像（rate>0 且币种为 CNY）
- 管理后台新增汇率配置输入（zh/en 文案），checkout-info 透出 subscription_usd_to_cny_rate
- 单测锁定：汇率未配置时不换算、换算使用汇率而非余额倍率、余额订单不受影响、返利仍按 USD price
 2026-07-06 14:34:17 +08:00
shaw d089c5789c Merge branch 'pr-3738' into fix/subscription-cny-optin-rate 2026-07-06 14:14:19 +08:00
Wesley Liddick 9fac6f15ce Merge pull request #3739 from Wei-Shaw/fix/openai-advanced-scheduler-audit-fixes 
fix(scheduler): 修复 OpenAI 高级调度器审计发现的正确性与性能问题
 2026-07-06 13:45:15 +08:00
shaw 0fd2e9216d fix(scheduler): 修复 OpenAI 高级调度器审计发现的正确性与性能问题 
针对 #3692 合并后审计发现的问题集中修复：

- previous_response_id 剥离条件改为按 call_id 全覆盖校验，
  部分可重建的工具续链不再被误剥离（不受开关门控的行为回归）
- 粘性加权回退路径补分组归属校验并清理失效绑定，杜绝跨分组账号泄漏
- 账号列表页：无 OpenAI 账号时跳过分数计算、过滤池限定 openai 平台、
  负载批查合并为账号并集一次查询，消除全表扫描与 Redis N+1
- 订阅优先模式下常规池不可用时回退订阅池等待计划，
  busy-but-waitable 的订阅账号不再导致请求硬失败
- TopK/权重 DB 覆盖显式受总开关门控，与兄弟子开关语义一致
- 前端未分组 OpenAI 账号回退展示基础分，不再显示 "-"
- ListAllWithFilters 等能力正式进入 AccountRepository/AdminService 接口，
  移除匿名接口断言与静默降级；负载批查失败补 warn 日志
- SelectAccountWithSchedulerForCapability 增加显式 previousResponseCanMove
  参数，移除 "previous_response_can_move" 魔法字符串哨兵
- 设置写入路径补"基础权重不得全为零"聚合校验；
  运行时设置批量读取失败的降级路径覆盖全部键并留痕
 2026-07-06 11:43:16 +08:00
Wesley Liddick 759332aa92 Merge pull request #3692 from linshuboy/codex/openai-advanced-scheduler-controls-squashed 
[codex] add OpenAI advanced scheduler controls
 2026-07-06 10:59:23 +08:00
wucm667 b408edf97b fix(payment): convert subscription CNY pay amount 2026-07-06 10:56:43 +08:00
Wesley Liddick f0f1f59a44 Merge pull request #3716 from wucm667/fix/antigravity-refresh-server-invalidated-token 
fix(antigravity): 401 服务端失效的 token 触发主动刷新，修复 NeedsRefresh 仅看 expires_at 的死循环
 2026-07-06 10:18:49 +08:00
Wesley Liddick ac68d73f0c Merge pull request #3717 from wucm667/fix/anthropic-models-honor-group-config 
fix(gateway): Anthropic /v1/models 返回分组 models_list_config 自定义模型列表
 2026-07-06 10:18:36 +08:00
Wesley Liddick 2e70ec0a15 Merge pull request #3714 from MoRanHuiShou-pug/fix-payment-nul-bytes 
fix: sanitize payment response NUL bytes
 2026-07-06 10:18:18 +08:00
Wesley Liddick de15f29d1f Merge pull request #3718 from wucm667/fix/usage-csv-export-utf8-bom 
fix(usage): CSV 导出补 UTF-8 BOM，修复 Excel 打开中文列乱码
 2026-07-06 10:12:27 +08:00
Wesley Liddick 809e1cf8ee Merge pull request #3704 from feitianbubu/feat/sidebar-logo-home-link 
feat: 点击侧边栏 Logo/站点名返回首页
 2026-07-06 10:12:15 +08:00
Wesley Liddick c9dda3c01f Merge pull request #3734 from Yinr/patch-1 
fix(i18n): correct misleading "irreversible" description for revoke action
 2026-07-06 10:12:04 +08:00
shaw 6752cdc826 fix(i18n): 用量页费用明细提示将面向用户的"成本"措辞统一为"费用" 
用户 /usage 页费用列悬浮提示中的成本明细/输入成本/输出成本/
缓存创建成本/缓存读取成本/图片输出成本 改为对应的"费用"表述;
成本是运营方视角的词,面向用户应称费用。管理端真正的账号成本
词条(accountCost 等)保持不变。
 2026-07-06 09:36:21 +08:00
Yeyin Hu ee90246aa5 Modify revokeDesc for subscription termination 
Updated revokeDesc to indicate restoration option.
 2026-07-06 08:23:43 +08:00
Yeyin Hu 2d2b6f0325 Update revokeDesc to allow subscription recovery 2026-07-06 08:12:09 +08:00
linshuboy f26ca5661e feat: add OpenAI advanced scheduler controls 
Related: #1089, #408, #123
 2026-07-05 17:24:38 +08:00
wucm667 aee9a7ba98 fix(usage): add UTF-8 BOM to CSV export 2026-07-05 08:36:15 +08:00
wucm667 41cdd438d7 fix(gateway): honor Anthropic custom models list 2026-07-05 08:35:34 +08:00
wucm667 b23475ac0c fix(antigravity): refresh server-invalidated tokens 2026-07-05 08:34:34 +08:00
MoRanHuiShou-pug e76e0499d7 fix: sanitize payment response NUL bytes 2026-07-05 03:55:40 +08:00
shaw 498f010ec3 fix(部署): 统一 Docker 部署 URL 安全默认值为开发友好模式 
docker-compose.yml / docker-compose.local.yml 中
SECURITY_URL_ALLOWLIST_ALLOW_INSECURE_HTTP 与
SECURITY_URL_ALLOWLIST_ALLOW_PRIVATE_HOSTS 的兜底值由 false 改为 true，
与代码默认值（0c7a58fc）保持一致，避免未配置 .env 的 Docker 部署
在测试账号连接时因 http base URL 报 "invalid url scheme: http"。

同步更新 README（三语）、.env.example、config.example.yaml 中
过时的"默认拒绝 HTTP"描述，改为默认允许并指导生产环境显式收紧。
 2026-07-04 13:51:37 +08:00
feitianbubu 20008264fe feat: 点击侧边栏 Logo/站点名返回首页 2026-07-04 13:33:53 +08:00
github-actions[bot] b650bdd68d chore: sync VERSION to 0.1.144 [skip ci] 2026-07-04 03:49:44 +00:00
Wesley Liddick 41def4ba03 Merge pull request #3699 from wucm667/fix/responses-billing-use-mapped-model 
fix(openai): /v1/responses 计费使用映射后模型，修复按原始模型价格误计费
v0.1.144 		2026-07-04 10:40:53 +08:00
Wesley Liddick 707b87a96f Merge pull request #3676 from wucm667/fix/codex-import-refresh-token-missing-collision 
fix(admin): Codex Session 导入 refresh_token 缺失时不再合并同 workspace 不同账号
 2026-07-04 10:29:47 +08:00
shaw cbe0c4665f chore: update readme 2026-07-04 10:18:41 +08:00
shaw dec709fb3a chore: update sponsors 2026-07-04 10:06:11 +08:00
wucm667 4dd3aee5c2 fix(openai): use mapped billing model for responses 2026-07-04 10:04:42 +08:00
wucm667 6bd248fd1f fix(admin): avoid merging Codex access-only imports 2026-07-04 09:53:01 +08:00
shaw be297b90ce refactor(frontend): merge Codex image bridge and tool policy into one four-state control 
Replace the two adjacent account-level controls (3-state injection bridge
+ 2-state explicit tool policy) in EditAccountModal with a single
four-state selector: follow channel / force inject / no injection /
block all. The four states map onto the existing extra keys
(codex_image_generation_bridge, codex_image_generation_explicit_tool_policy)
with no backend change; strip already disables the bridge upstream, so
the effective decision space is exactly these four states.

- load: strip takes precedence and reads as "block all"; legacy
  bridge_enabled key still recognized and cleaned up on save
- save: block writes policy=strip and drops the bridge override;
  inherit clears both keys
- semantic accent colors per state (sky/emerald/amber/rose) with dark
  mode support; state badge follows the same palette
- replace account-scope i18n keys in zh/en (channel-scope keys untouched)
- rewrite specs to cover all four states (25/25 passing)
 2026-07-04 09:49:37 +08:00
Wesley Liddick dfdb838ce4 Merge pull request #3690 from AndersonBY/feature/codex-image-tool-policy 
feat: add Codex image tool strip policy
 2026-07-04 09:27:37 +08:00
Wesley Liddick be3aee1a4b Merge pull request #3694 from zhaoteng45/fix/antigravity-gemini31-pro-agent 
fix: normalize Antigravity Gemini 3.1 Pro routing
 2026-07-04 09:23:46 +08:00
Wesley Liddick 588e02b29e Merge pull request #3673 from heathermhuang/codex/grok-admin-issues-3545-3649 
fix: preserve configured Grok OAuth concurrency
 2026-07-04 09:22:18 +08:00