opensource/sub2api
3
0
Fork 0
mirror of https://github.com/Wei-Shaw/sub2api.git synced 2026-09-24 16:05:44 +08:00
Code Issues Packages Projects Releases Wiki Activity
4,099 Commits 38 Branches 54 Tags
v0.1.141
Commit Graph
4099 Commits
This Branch
This Branch
All Branches
Author SHA1 Message Date
Wesley Liddick 7cb98e5bdc Merge pull request #2007 from PMExtra/feature/user-usage-admin-parity 
feat: align user usage analytics with admin
v0.1.141 		2026-06-30 17:10:09 +08:00
shaw 930326116e fix: 修复订阅支付金额显示错误 2026-06-30 16:26:22 +08:00
PMExtra cafc95c3e2 feat: align user usage analytics with admin 2026-06-30 15:31:28 +08:00
github-actions[bot] 89b2d63ef2 chore: sync VERSION to 0.1.140 [skip ci] 2026-06-30 06:26:55 +00:00
shaw 345d5c6b56 chore: update sponsors v0.1.140 2026-06-30 14:11:14 +08:00
Wesley Liddick 76e0d90736 Merge pull request #3509 from wucm667/fix/refund-pending-not-success 
fix(payment): 退款 pending 不再当成最终成功，避免站内账务与网关状态不一致
 2026-06-30 13:38:04 +08:00
Wesley Liddick 56ca027a0f Merge pull request #3568 from DaydreamCoding/fix/auth-signup-grok-platform-quota 
fix(auth-signup): 平台配额快照脱离注册事务 + grok 补入 CHECK 约束
 2026-06-30 13:37:54 +08:00
shaw bf4f006736 fix: 修复用户列表使用时间排序冲突 2026-06-30 13:36:36 +08:00
DaydreamCodingandClaude Opus 4.8 185f9c9920 fix(auth-signup): 平台配额快照脱离注册事务 + grok 补入 CHECK 约束 
自助注册(含钉钉/OAuth)报 500→404 的根因:grok 自 2026-06 进入默认平台配额
(default_platform_quotas / auth_source_*),但 user_platform_quotas 的 CHECK
约束(迁移 142)仅允许 anthropic/openai/gemini/antigravity。注册时
snapshotPlatformQuotaDefaults 写 grok 行违反约束 → 整个注册事务被 Postgres 标记
aborted → consumePendingOAuthBrowserSessionTx 撞 "transaction aborted" → 500 →
clearCookies → 用户重试拿到 404(PENDING_AUTH_SESSION_NOT_FOUND)。
影响面:所有新自助注册(不限钉钉)。

修复(两层):
- 事务隔离(fix①):snapshotPlatformQuotaDefaults 用 ent.WithoutTx 剥离调用方事务,
  在基础连接 autocommit 执行。best-effort 快照失败永不毒化注册主事务,从根上消除
  "事务内 fail-open 形同虚设"陷阱——今后任何平台/约束漂移都不会再连累注册。
- 迁移 157:把 grok 加入 user_platform_quotas.platform 的 CHECK 约束,与代码平台
  列表(domain/constants.go PlatformGrok)对齐(DROP IF EXISTS + ADD,可重入)。

新增 ent.WithoutTx(ctx) helper(手写文件,不动生成代码)。

测试:
- 单测 TestSnapshotPlatformQuotaDefaults_DetachesCallerTransaction(RED→GREEN):
  快照即便在事务 ctx 中也必须用脱离事务的 ctx 调 repo。
- 集成测试 TestUserPlatformQuotaRepository_BulkInsertInitial_GrokAllowed:
  迁移 157 后 grok 可写入(真实 postgres 容器验证)。

验证:go build ./... / go vet -tags unit ./... / 全量单测(-tags unit,45 包) /
平台配额+迁移集成测试 全绿。

Co-Authored-By: Claude Opus 4.8 <noreply@anthropic.com>
 2026-06-30 13:22:27 +08:00
Wesley Liddick dcd8689d78 Merge pull request #3548 from dftian478/codex/中文-上下文窗口不切号 
修复 OpenAI 上下文窗口错误误触发账号切换
 2026-06-30 10:57:26 +08:00
Wesley Liddick efb8b45876 Merge pull request #3560 from StarryKira/feat/issue-3557-oauth-email 
feat: fix OAuth email completion flow
 2026-06-30 10:55:00 +08:00
Wesley Liddick ac6d4ccf09 Merge pull request #3549 from dftian478/codex/中文-gpt55-codex-instructions 
修复 OpenAI GPT-5.5 的 Codex 指令选择
 2026-06-30 10:53:35 +08:00
Wesley Liddick ac6f2e9693 Merge pull request #3559 from 315944211/fix/privacy-toast-result 
fix: show privacy setting result accurately
 2026-06-30 10:50:17 +08:00
Wesley Liddick e70e36e4d2 Merge pull request #3484 from bwliangc/feat/risk-control-matched-keyword 
feat(risk-control): record matched keyword in keyword-block logs
 2026-06-30 10:40:30 +08:00
wucm667 93a3bf3077 Fix refund pending finalization gaps 2026-06-30 10:19:50 +08:00
wucm667 7316d83027 fix(payment): 区分退款 pending 并收敛匿名查单 2026-06-30 10:00:48 +08:00
Wesley Liddick 55902d8548 Merge pull request #3558 from heathermhuang/codex/grok-cli-compat 
fix: support Grok admin test and CLI compatibility
 2026-06-30 08:42:59 +08:00
haruka 260fda19b3 feat: fix OAuth email completion flow 2026-06-30 01:11:51 +08:00
315944211 a0a3d0c33e fix: show privacy setting result accurately 2026-06-30 00:37:21 +08:00
Heatherm Huang 438510d298 fix: sanitize grok codex responses payloads 2026-06-29 21:37:30 +08:00
Heatherm Huang 10e623f674 fix: allow grok messages compatibility 2026-06-29 18:33:37 +08:00
Heatherm Huang 4a7148e203 fix: support grok cli compatibility routes 2026-06-29 17:53:19 +08:00
Wesley Liddick d3acd8e96e Merge pull request #3497 from JRBaggins/fix/openai-count-tokens-bridge 
Bridge OpenAI count_tokens to responses input_tokens
 2026-06-29 15:23:11 +08:00
dftian478 7cbf82ed65 修复 OpenAI 上下文窗口错误误触发账号切换 2026-06-29 10:29:23 +08:00
dftian478 709cf61853 修复 OpenAI GPT-5.5 的 Codex 指令选择 2026-06-29 10:25:43 +08:00
Wesley Liddick c99112a9e9 Merge pull request #3515 from bestony/feat/ops-system-log-key-id 
feat(ops): add key id filter to system logs
 2026-06-29 09:24:40 +08:00
Wesley Liddick a22b12677f Merge pull request #3517 from bestony/feat/keys-column-settings 
feat(keys): add API key column settings
 2026-06-29 09:24:20 +08:00
Wesley Liddick b0dbc22fe5 Merge pull request #3510 from wucm667/fix/subscription-confirm-show-converted-amount 
fix(payment): 订阅订单确认页显示换算后的 CNY 实付金额，而非 USD 套餐价
 2026-06-29 09:24:01 +08:00
Wesley Liddick 7c857bd080 Merge pull request #3441 from deqiying/feature/openai-quota-headroom-scheduler 
新增 OpenAI 剩余额度调度权重
 2026-06-29 09:23:32 +08:00
Wesley Liddick bebafe7697 Merge pull request #3437 from imfangwenjie/fix/api-base-fetch 
fix(frontend): use configured API base for direct requests
 2026-06-29 09:23:13 +08:00
Wesley Liddick fc1e5a94a9 Merge pull request #3534 from mxyhi/fix/openai-quota-platform-post-billing 
fix(openai): preserve quota platform in usage billing
 2026-06-29 09:21:44 +08:00
Wesley Liddick 61f735a667 Merge pull request #3498 from liuaho6-commits/fix/codex-image-bridge-tool-choice 
fix(openai): set tool_choice auto for Codex image bridge
 2026-06-29 09:21:25 +08:00
Wesley Liddick b105cc0fd5 Merge pull request #3337 from ddnio/codex/openai-json-mode-developer-input 
fix(openai): preserve JSON instructions in Codex OAuth input
 2026-06-29 09:21:05 +08:00
Wesley Liddick 38577c6ca0 Merge pull request #3533 from Pluviobyte/codex/fix-api-key-unlimited-quota 
fix(keys): reactivate exhausted keys set to unlimited
 2026-06-29 09:19:53 +08:00
Wesley Liddick 47598462f5 Merge pull request #3401 from StarryKira/fix/issue-3394-fallback-pricing-log-spam 
fix: stop per-request fallback-pricing log spam for unknown models (#3394)
 2026-06-29 09:19:44 +08:00
Wesley Liddick 753c5e255c Merge pull request #3215 from fchange/fix/image-billing-false-positive 
fix(openai): prevent false image billing on text-only /v1/responses requests
 2026-06-29 09:19:34 +08:00
Wesley Liddick 3b18d1fa3d Merge pull request #3532 from smartcmd/fix/subscription-direct-pay-price 
fix(payment): keep subscription price as direct pay amount
 2026-06-29 09:19:24 +08:00
Wesley Liddick a822972d80 Merge pull request #3494 from devnomad-byte/docs/source-compile-admin-setup 
docs: note admin account wizard requirement in source-compile install
 2026-06-29 09:19:14 +08:00
mxyhi 82553c4dca fix(openai): preserve quota platform in usage billing 2026-06-28 11:13:09 +08:00
Pluviobyte da810c3b43 fix(keys): reactivate exhausted keys set to unlimited 2026-06-28 09:05:28 +08:00
daoge_cmd b1403e8b29 fix(payment): keep subscription price as direct pay amount 2026-06-28 06:29:01 +08:00
Bestony b244f850e7 feat(keys): add column settings 2026-06-27 15:14:13 +08:00
Bestony bad87ff533 feat(ops): add api key filter to system logs 2026-06-27 14:35:19 +08:00
wucm667 88ca0c1d13 fix(payment): 显示订阅 CNY 换算实付金额 2026-06-27 12:15:39 +08:00
Hao Liu e5f7836bf3 fix(openai): set tool_choice auto for Codex image bridge 2026-06-26 19:10:37 +08:00
JRBaggins 7a38c66214 Bridge OpenAI count_tokens to responses input_tokens 2026-06-26 17:59:26 +08:00
github-actions[bot] c275422251 chore: sync VERSION to 0.1.139 [skip ci] 2026-06-26 09:55:00 +00:00
shaw 9a0fbcc87d chore: update sponsors v0.1.139 2026-06-26 17:32:50 +08:00
Wesley Liddick df99b9417c Merge pull request #3495 from DaydreamCoding/feat/codex-detect-cli-only-engine-fingerprint 
feat(codex-detect): codex_cli_only 检测加固 + 引擎指纹统一信号列表 + 账号级 app-server
 2026-06-26 16:41:23 +08:00
DaydreamCodingandClaude Opus 4.8 819fda34d9 feat(codex-detect): codex_cli_only 检测加固 + 引擎指纹统一信号列表 + 账号级 app-server 
将 codex_cli_only 客户端识别从「单一 strict 开关 + 固定 OR 头集合」重构为
可逐项管理的引擎指纹信号列表，加固整条判定链，并补齐账号级 app-server 控制、
对齐前端设置文案。

判定链（每步可短路）：
- 账号未开 codex_cli_only → 不限制；gateway.force_codex_cli → 旁路放行
- 全局黑名单命中（OR 宽 deny）→ 立即拒
- 身份候选：官方 UA（strict，仅前缀）/ 官方 originator（OR）/ 全局白名单（双因子 AND）
  / 全局 app-server 开关 OR 账号 app-server 开关；均不命中 → 拒
- 版本门（仅官方候选）：UA 须可解析引擎版本，再校验 [min,max] 区间
- 引擎指纹 AND 硬门：按信号列表逐条勾选 AND、每条行内变体 OR；无 Required 信号 → 放行

引擎指纹信号列表（唯一真源）
- 新增 openai.EngineFingerprintSignal 类型 + EvaluateEngineFingerprint 求值器
  （勾选 AND / 行内变体 OR / 无勾选 → 放行）
- CodexRestrictionPolicy 增 EngineFingerprintSignals；信号列表单一决定是否启用指纹门，
  不再保留独立「要求引擎指纹」总开关（与「信号全不选」语义重复）
- 新设置键 codex_cli_only_engine_fingerprint_signals（默认只勾 x-codex- 前缀）；
  旧 body 指纹开关幂等迁移并入信号列表；wire 接线
- 黑/白名单自由条目、命名预设、版本区间 全局设置管线
- gateway 缺 settingService（仅测试/误配可达）时指纹门回退默认种子信号、失败关闭，
  不再因零值 policy（nil 信号）失败开放

账号级 Codex app-server（替换已失效的 ClaudeCode 放行机制）
- account.IsCodexCLIOnlyAppServerAllowed() 读 extra.codex_cli_only_allow_app_server，
  仅在 codex_cli_only 开启时生效；候选身份门「全局 OR 账号」，与旧系统双层控制对齐
- 移除已无入口的 claude_code 预设机制（allowedClientRegistry / MatchAllowedClients /
  账号 GetCodexCLIOnlyAllowedClients / reason）；白名单 AllowedClientEntry / IsAllowedClientMatch 保留

门加固（反伪 + 写入校验）
- 官方 UA 访问门改 strict：IsCodexOfficialClientRequestStrict 仅前缀匹配，收窄「浏览器前缀 +
  中段 codex token」伪造面（strict 仍保留 Codex 家族前缀与 UA 尾部兜底，故对「任意前缀 +
  官方尾部 (name;ver)」仍放行——与 UA 可伪造、真正反伪靠引擎指纹门的设计一致）
- 官方客户端识别扩展：新增 codex-tui/、codex_vscode_copilot/ 前缀 + UA 尾部 (name;ver) 兜底
  （恢复 CODEX_INTERNAL_ORIGINATOR_OVERRIDE 的真实 client，如 cccc→codex-tui），originator 改
  精确集。该识别经 IsCodexOfficialClientByHeaders 被 passthrough 复用，故透传的官方判定一并
  修正（codex-tui 等不再被误改写 UA）——非「行为不变」，属有意修正
- 白名单写入校验 ValidateCodexWhitelistEntriesJSON + AllowedClientEntry.IsWhitelistable：
  双因子 AND 条目须可命中（非空 originator + 非空 ua_contains），拒绝写入会静默失效的死规则；
  黑名单（OR 宽 deny，允许 originator-only）不受约束

管理端 / 前端
- handler / DTO / settings_view / 契约测试；gateway 接入判定链
- 信号列表编辑器（替换 body 开关）、api 类型、SettingsView；无勾选给常驻警告
- Create/Edit/Bulk 三弹窗「Codex Only」下新增 app-server 开关（OR 合并全局）
- 文案：UA/Originator → User-Agent/Originator；黑/白名单重命名为 User-Agent/Originator 黑/白名单；
  「允许 App Server 第三方客户端」→「Codex app-server」+ 简介示例；i18n zh/en 同步
- 移除死代码 HasCodex*Fingerprint helper

测试：引擎指纹求值器 / 账号 app-server（OR 语义）/ detector（含 N1 strict、失败关闭）/
白名单写入校验 / BulkEdit spec 等；后端 build + service/openai/admin 单测全绿，前端 vue-tsc + vitest 全绿。

Co-Authored-By: Claude Opus 4.8 (1M context) <noreply@anthropic.com>
 2026-06-26 16:19:41 +08:00