opensource/sub2api
3
0
Fork 0
mirror of https://github.com/Wei-Shaw/sub2api.git synced 2026-09-24 16:05:44 +08:00
Code Issues Packages Projects Releases Wiki Activity
3,932 Commits 38 Branches 54 Tags
v0.1.137
Commit Graph
462 Commits
Author SHA1 Message Date
Bestony@Homelab 56c62c59c8 fix(auth): include client ip in acl denial message 2026-06-16 17:00:35 +08:00
Wesley Liddick 16765bde69 Merge pull request #3230 from DaydreamCoding/feat/openai-cyber-policy-passthrough 
feat(openai): cyber_policy 硬阻断全链路透传、审计与计费
 2026-06-16 16:55:51 +08:00
shaw b816949291 feat(openai-quota): query + reset rate-limit credits for OpenAI accounts 
Adds an admin-side action that mirrors the Codex Desktop "rate-limit reset"
flow against chatgpt.com upstream for OpenAI OAuth accounts.

Backend
- OpenAIQuotaService.QueryUsage / ResetCredit hit /wham/usage and
  /wham/rate-limit-reset-credits/consume with the Codex Desktop header set,
  reusing OpenAITokenProvider for refreshed tokens and PrivacyClientFactory
  for the impersonated Chrome TLS fingerprint.
- Honors the account's configured proxy by reading the eager-loaded
  account.Proxy directly (falls back to proxyRepo only when missing).
- GET /api/v1/admin/openai/accounts/:id/quota
  POST /api/v1/admin/openai/accounts/:id/reset-quota
- Wire DI for the new service + handler dependency.

Frontend
- OpenAIQuotaResetCell renders a single action row in AccountUsageCell's
  OpenAI section: the existing local "查询" (active sampling) is injected
  via #pre-actions, alongside a "次数 N" button that doubles as the
  upstream query trigger and the available-credit indicator, and a "重置"
  button that consumes one credit.
- No duplicate 5h/7d window display; the local UsageProgressBar owns those
  bars to avoid confusion.
 2026-06-16 16:55:07 +08:00
shaw acaffe29ec fix(account-repo): refresh candidates SQL excluded healthy accounts; fix CI build 
Post-merge audit of #3272 found two regressions:

1. ListOAuthRefreshCandidates used "AND NOT (a AND b)" which, under PG
   3-valued logic, evaluates to NULL when both temp_unschedulable_until
   and temp_unschedulable_reason are NULL — i.e., the common healthy
   account state. Such rows were silently excluded from the background
   token refresh worker, so their OAuth access tokens would never get
   refreshed and eventually start returning 401.

   Verified empirically against PostgreSQL: only 3 of 5 test rows
   matched before the fix; after switching to "(a AND b) IS NOT TRUE"
   the expected 4 rows match.

2. The new ListOAuthRefreshCandidates method on AccountRepository was
   not implemented on stubAccountRepo in api_contract_test.go (build
   tag "unit"), breaking "make test-unit" which CI runs in
   .github/workflows/backend-ci.yml.

Tests:
- Added IS NOT TRUE and "AND NOT (" assertions to the SQL-shape unit
  test so the predicate can't regress to the broken form again.
- "go test -tags=unit ./internal/..." now passes cleanly.
 2026-06-16 14:08:50 +08:00
dailingfei 8ce7b9a8f6 feat: configure Claude OAuth system prompt blocks 2026-06-13 04:12:13 +08:00
DaydreamCodingandClaude Opus 4.8 b62b573f7f feat(openai): cyber_policy 硬阻断全链路透传、审计与计费 
上游对单次请求下发 error.code=cyber_policy 硬阻断时,网关在所有端点
(/v1/responses、/v1/chat/completions、/v1/messages、WebSocket)及流式/
非流式路径下,将该结果原样透传给客户端,绝不 failover、换号或同步拦截;
命中后异步完成审计与计费:

- 风控中心记录 cyber_policy 留痕并发送通知邮件,落库先于发信,SMTP 阻塞
  不影响留痕
- ops 错误请求记录,状态码对齐客户端实际接收(流式 200 / 非流式 400)
- 用量明细标记 request_type=cyber,按上游真实 token 计费,HTTP 与
  WebSocket 计费口径统一,零 token 命中不误扣
- 会话级自动屏蔽(管理员开关,默认关):命中的会话在可配 TTL 内本地拦截
  不再发往上游,仅屏蔽该会话不影响同 Key 其他会话
- 封号计数排除开关:可选让 cyber 命中不计入自动封号,命中当次不判定且
  历史行在违规计数中一并排除

WebSocket 多轮连接下 cyber 标记按 turn 生命周期管理,逐轮独立检测与记录;
透传的错误响应不被兜底逻辑追加内容污染。

Co-Authored-By: Claude Opus 4.8 <noreply@anthropic.com>
 2026-06-12 01:47:01 +08:00
shaw 0acf00c4a1 Add admin compliance acknowledgement gate 2026-06-10 14:16:51 +08:00
Wesley Liddick 870cefddf5 Merge pull request #3097 from NeckBozia/fix/5h-resets-at-stale 
fix(usage): sync 5h ResetsAt to SessionWindowEnd and zero expired window
 2026-06-08 09:08:23 +08:00
Wesley Liddick a2bf6ad77a Merge pull request #3107 from DaydreamCoding/feat/proxy-failover-resilience 
feat: 代理生命周期与故障健壮性增强
 2026-06-08 08:59:15 +08:00
DaydreamCoding af19d44327 feat(proxies): 代理有效期与失败回退 
- schema/迁移: 代理有效期、提醒天数、失败回退配置 + 账号 fallback 来源字段
- service/repo/DTO/handler: CRUD 透传新字段 + 校验
- fallback 目标解析纯函数(链式解析 + 环检测 + 兜底)
- SweepExpiredProxies 到期改投账号 + outbox 失效
- ProxyExpiryService 后台到期扫描任务 + wire 注册
- 账号侧手动回切原代理 + fallback 来源徽章/按钮
- 前端: 创建/编辑表单、列表到期徽章、类型/API/i18n
- ops 告警: proxy_expired_count / proxy_expiring_soon_count 指标
- 导入导出携带有效期/回退字段(备用按 name 映射)
- 补全测试 stub + 集成测试 + review 问题修复
 2026-06-08 00:01:30 +08:00
CoolCoolTomato 1a86c6ce12 fix: enforce exclusive group access for api keys 2026-06-07 20:46:03 +08:00
NeckBozia 16bc876935 fix(usage): sync 5h ResetsAt to SessionWindowEnd and zero expired window 
active poll 拿到新 5h ResetsAt 时只回写了 Extra.session_window_utilization，
没回写 SessionWindowEnd column；estimateSetupTokenUsage 读这个 column 作为 5h
窗口结束时间，导致被动采样模式下 dashboard 显示 utilization > 0 但 reset
时间渲染为「现在」。

- syncActiveToPassive 增加 UpdateSessionWindowEnd 回写
- estimateSetupTokenUsage 抄齐 Codex 分支的过期归零 guard，避免 active
  poll 没回写时 UI 渲染矛盾
- UsageProgressBar 区分「待刷新」/「现在」语义；i18n key 中英补齐
 2026-06-07 15:23:45 +08:00
feitianbubu 7386f38cf5 test(usage): API契约测试补充缓存创建/命中token字段 2026-06-06 22:43:06 +08:00
Wesley Liddick 427d591212 Merge pull request #2930 from touwaeriol/feat/image-token-billing 
fix(billing): channel pricing override for image generation + display image_output_tokens
 2026-06-06 09:28:46 +08:00
erio b8c89c34d8 fix(ci): add missing fields to pass frontend typecheck and contract test 
- Add `service_quota_enabled` to PublicSettings default in app.ts
- Add `image_output_tokens` and `image_output_cost` to usage contract test
 2026-06-05 17:55:22 +08:00
DaydreamCodingandClaude Opus 4.8 cfb195c7b2 feat(usage): 记录并展示失败请求(用户端+管理端) 
- 记录失败请求并在用户端/管理端展示;分类下拉改用统一 Select 组件
- 模型过滤改后端 ILIKE 模糊匹配;新增「Key 名称」列(含已删除标记)与按 Key 过滤;时间列移至末列
- 用户可见「已删除 key 失败请求」:OpsErrorLogFilter 加 MatchDeletedKeyOwner,用户侧归属
  放宽为 (user_id OR deleted_key_owner_user_id),让 key 原所有者能看到删除 key 后继续请求
  导致的认证失败记录(他人仍 NotFound,不泄露存在性)
- 迁移 148:ops_error_logs 用户+时间索引

Co-Authored-By: Claude Opus 4.8 (1M context) <noreply@anthropic.com>
 2026-06-05 14:00:57 +08:00
DaydreamCodingandClaude Opus 4.8 ddf063352a feat(ops): 错误日志 key 归因与早退字段补全 
让 /admin/ops 错误详情正确归因 API key 并补全早退场景字段，合并三项改动:

- 鉴权早退补全用户/分组/平台字段:引入 ops fallback key(ContextKeyOpsFallbackAPIKey),
  apiKey 一加载成功即写入,覆盖分组停用/删除、Key 停用/过期/额度、用户停用、IP 限制等早退
  路径;ops 错误日志改用 getOpsAPIKey(正式 key 优先、回退键兜底),不改「已鉴权」语义。
- 已删除 key 归因(迁移 145):删除 key 时同一事务写 deleted_api_key_audits 映射,认证失败
  时用明文反查命中原所有者,错误详情展示「已删除 Key 所有者」「尝试的 Key 前缀」。
- 有效 key 报错快照前缀(迁移 147):对绑定有效 key 的错误,落库时快照明文前 8 位到
  api_key_prefix(与 attempted_key_prefix 互斥),key 之后被删仍保留报错当时真实前缀。

均仅对上线后新产生的错误/删除生效。

Co-Authored-By: Claude Opus 4.8 (1M context) <noreply@anthropic.com>
 2026-06-05 14:00:57 +08:00
Wesley Liddick 910ff3cd58 Merge pull request #2892 from Arron196/feat/sync-upstream-models-on-create 
feat: 添加账号时支持同步上游支持的模型
 2026-06-01 09:58:33 +08:00
DaydreamCodingandClaude Opus 4.7 b60d8bb4cc feat(usage): 在 /admin/usage 支持查看已删除用户的历史使用情况 
用户软删除后使用记录仍在,但身份(邮箱)被 ent 软删除拦截器隐藏。本次在
三条管理员只读路径定点穿透软删除过滤,并把删除状态传播到前端标记,零新表/
迁移/回填:

- 后端穿透:富化 usage 日志(loadUsers)、用户搜索(ListWithFilters +
  UserListFilters.IncludeDeleted)、点击详情(GetByIDIncludeDeleted /
  GetUserIncludeDeleted + getById ?include_deleted 分支)
- 状态传播:service.User / dto.User 新增 DeletedAt;SearchUsers 标记 deleted
- 前端:表格与余额弹窗展示"已删除"徽标、筛选下拉标注并排序、点击走
  include_deleted;新增 i18n admin.usage.userDeletedBadge
- 安全:普通用户 usage 仅查本人(无 PII 泄漏);主用户列表与默认 getById
  行为不变(已删用户仍 404);仅 admin 搜索设 IncludeDeleted

后端 build / 三态 vet / unit 全量 / 仓储集成全绿;前端 typecheck / vitest /
改动文件 eslint 全清。

Co-Authored-By: Claude Opus 4.7 (1M context) <noreply@anthropic.com>
 2026-05-30 17:52:18 +08:00
benjamin 57d9e15e04 feat: 添加账号时支持同步上游模型 
新增 POST /admin/accounts/models/sync-upstream-preview 端点，
允许在创建账号流程中直接使用凭证同步上游支持的模型，
无需先保存账号获取 ID。

- 后端: 新增 SyncUpstreamModelsPreview handler
- 前端: 新增 syncUpstreamModelsPreview API 函数
- 前端: ModelWhitelistSelector 支持 syncCredentials prop
- 前端: CreateAccountModal 传递凭证给 ModelWhitelistSelector
 2026-05-30 12:19:38 +08:00
Wesley Liddick 69e7c4db30 Merge pull request #2865 from wey-gu/feat/usage-request-context 
fix(gateway): preserve usage request context
 2026-05-29 16:21:59 +08:00
Wesley Liddick 433f8dcd13 Merge pull request #2834 from DaydreamCoding/pr/openai-codex-cli-allow-claude-code 
feat(openai): codex_cli_only 新增放行 Claude Code Codex 插件的机制
 2026-05-29 10:30:33 +08:00
Wey Gu 2bd3125d0f Preserve usage request context 2026-05-28 22:44:25 +08:00
Wey Gu ccace69d4e Add OpenAI embeddings gateway 2026-05-28 19:39:52 +08:00
DaydreamCodingandClaude Opus 4.7 56908d3c4c feat(openai): codex_cli_only 新增放行 Claude Code Codex 插件的机制 
适用场景：在 Claude Code 中使用 https://github.com/openai/codex-plugin-cc
插件时，插件经官方 codex app-server 以 clientInfo.name="Claude Code" 完成
initialize 握手，请求头被设为 originator=Claude Code、User-Agent 含
"Claude Code/"，不在官方客户端白名单内，原本会被 codex_cli_only 拦截 403。

在官方客户端白名单未命中时评估两层独立放行（OR 语义）：

- 按账号：account.Extra.codex_cli_only_allowed_clients 引用命名预设
  （目前仅 claude_code），detector reason=allowed_client_matched
- 全局开关：/admin/settings 网关服务 OpenAI 区块新增
  openai_allow_claude_code_codex_plugin（默认 false），开启后对所有
  codex_cli_only 账号统一放行，detector reason=global_allowed_client_matched

签名仍要求 originator=Claude Code 精确等值 + UA 含 "Claude Code/"。
上游转发保持透传不变。

Co-Authored-By: Claude Opus 4.7 (1M context) <noreply@anthropic.com>
 2026-05-27 23:55:34 +08:00
Wesley Liddick 61ce79533e Merge pull request #2800 from wucm667/fix/scheduler-model-not-found-per-model-cooldown 
fix(scheduler): 模型 404 仅冷却该账号-模型组合，不再封整个账号
 2026-05-27 21:01:52 +08:00
lyen1688 f597c1581b feat(group): 支持自定义 /v1/models 模型列表 2026-05-27 18:00:45 +08:00
wucm667 a31b507484 fix(scheduler): 模型404仅冷却账号模型组合 2026-05-26 20:29:48 +08:00
Wesley Liddick 4b9b63443f Merge pull request #2790 from Arron196/from-arron-main 
修复 Ops SLA 本地限制错误统计
 2026-05-26 20:21:11 +08:00
DaydreamCodingandClaude Opus 4.7 11fe7de926 fix(account): 重新授权不再清空 Extra 配置 
Claude / OpenAI 账号重新授权走通用 PUT /accounts/:id 时，后端
UpdateAccount 会全量覆盖 account.Extra（仅保留 5 个 quota 用量键），
导致 base_rpm / window_cost_limit / window_cost_sticky_reserve /
max_sessions / quota_* / privacy_mode 等持久化配置全部丢失。

新增专用接口 POST /accounts/:id/apply-oauth-credentials，沿用
现有 /refresh 路径模式：Credentials-only update + Extra JSONB
key 级合并（UpdateAccountExtra） + ClearError + InvalidateToken。

作用域：Claude OAuth / Claude Cookie auth / OpenAI OAuth 三个
调用点。Gemini / Antigravity 现有路径本就不传 extra，保持不变。

顺带修复：旧重新授权路径未调用 InvalidateToken，导致重新授权后
首请求可能仍用缓存中的旧 token 而立即 401。

Co-Authored-By: Claude Opus 4.7 (1M context) <noreply@anthropic.com>
 2026-05-26 19:46:08 +08:00
benjaminandSisyphus c3e7476992 fix(gateway): mark local platform gates business-limited 
Ultraworked with [Sisyphus](https://github.com/code-yeongyu/oh-my-openagent)

Co-authored-by: Sisyphus <clio-agent@sisyphuslabs.ai>
 2026-05-26 17:19:23 +08:00
benjaminandSisyphus 00eb3abbe1 fix(auth): mark Google group denials business-limited 
Ultraworked with [Sisyphus](https://github.com/code-yeongyu/oh-my-openagent)

Co-authored-by: Sisyphus <clio-agent@sisyphuslabs.ai>
 2026-05-26 17:18:55 +08:00
benjaminandSisyphus bd1e98ec29 fix(auth): mark API key group denials business-limited 
Ultraworked with [Sisyphus](https://github.com/code-yeongyu/oh-my-openagent)

Co-authored-by: Sisyphus <clio-agent@sisyphuslabs.ai>
 2026-05-26 17:18:41 +08:00
DaydreamCodingandClaude Opus 4.7 6b39b344d8 feat(quota): 用户 × 平台 USD 配额 
为用户在 anthropic/openai/gemini/antigravity 四个平台上提供日/周/月
三个窗口的 USD 配额管控。配额语义：未设置=不限制，0=禁用，>0=美元上限。

两层模型：
- 配置层：系统默认配额，以及 email/linuxdo/oidc/wechat/github/google/
  dingtalk 七个鉴权来源的默认配额，存于 settings，以嵌套 JSON 整体读写
  （系统 1 个 key + 每个来源 1 个 key），整体替换语义。
- 运行时层：user_platform_quota 表按用户记录实际配额，与配置层解耦。

后端：新增 ent schema 与 140_user_platform_quotas.sql 迁移、repository
与 service 端口、计费链路集成、管理端与用户端读写接口。
前端：管理端设置页配额编辑、用户配额管理 Modal、用户 Dashboard 展示、
中英文案。

Co-Authored-By: Claude Opus 4.7 (1M context) <noreply@anthropic.com>
 2026-05-26 10:49:20 +08:00
shaw b6c0b40848 fix: update x/net vulnerability dependency 2026-05-23 10:55:44 +08:00
shaw 1e406fed52 fix: optimize OpenAI account cooldown scheduling 2026-05-23 10:18:43 +08:00
shaw a613a587ba feat: add subscription expiry email toggle 2026-05-21 14:27:50 +08:00
Wesley Liddick eda04c6129 Merge pull request #2615 from wucm667/feat/redeem-code-batch-update 
feat(redeem): 兑换码支持批量修改
 2026-05-21 10:39:46 +08:00
lyen1688 1d2445ff52 修复 API Key ACL 开关的 CI 校验 2026-05-20 23:51:39 +08:00
lyen1688 08c8c67df7 为 API Key ACL 增加反代真实 IP 开关 2026-05-20 22:51:46 +08:00
Wesley Liddick 51f72186a5 Merge pull request #2613 from wucm667/feat/api-key-usage-daily-detail 
feat(usage): 用户 API Key 用量页支持按日明细
 2026-05-20 16:55:42 +08:00
wucm667 3263ca63c7 feat(redeem): add redeem code batch update 2026-05-20 16:08:41 +08:00
wucm667 22ff1acde3 fix(auth): 停用/删除分组后阻断 API Key 2026-05-20 15:52:00 +08:00
wucm667 90b2b2a757 feat(usage): 用户 API Key 用量页支持按日明细 2026-05-20 15:48:38 +08:00
Wesley Liddick 378a0a6a61 Merge pull request #2599 from Arron196/feature/email-template-editor 
feat: 添加邮件模板编辑器与通知邮件模板化
 2026-05-20 15:12:57 +08:00
shaw 825834b5cb test(api-contract): fix admin/settings expected map missing openai_codex_user_agent 2026-05-20 15:07:07 +08:00
benjaminandSisyphus 55b13cd7b4 feat(settings): 添加邮件退订入口 
Ultraworked with [Sisyphus](https://github.com/code-yeongyu/oh-my-openagent)

Co-authored-by: Sisyphus <clio-agent@sisyphuslabs.ai>
 2026-05-20 11:09:18 +08:00
benjaminandSisyphus 88346b4d53 feat(admin): 添加邮件模板管理接口 
Ultraworked with [Sisyphus](https://github.com/code-yeongyu/oh-my-openagent)

Co-authored-by: Sisyphus <clio-agent@sisyphuslabs.ai>
 2026-05-20 11:09:18 +08:00
Wesley Liddick 74e35a0150 Merge pull request #2582 from wucm667/feat/channel-pricing-sync-models 
feat(channels): 模型定价支持一键同步最新模型
 2026-05-20 08:43:10 +08:00
Wesley Liddick 44c13e7a73 Merge pull request #2578 from wucm667/feat/payment-force-qrcode 
feat(payment): 支持强制移动端统一使用二维码支付
 2026-05-20 08:41:29 +08:00