shaw 80a229bce5 fix(batch-image): 修复审计发现的计费死锁、状态机与队列原子性缺陷 ...

修复 PR #3768 批量图像 MVP 合并后审计报告中的全部问题：

结算与计费（高危）：
- 所有 SETTLEMENT_* 失败（超冻结/计数非法/manifest 冲突/定价缺失/扣费失败）
  统一计入 retry_count 并在耗尽时释放冻结转 failed，消灭 settling 无限
  requeue 导致的冻结余额永久锁死
- 耗尽出口的释放指纹统一为 RequestHash，与 processor/Cancel/recovery 一致；
  release 遇同 request id 指纹冲突视为幂等成功，治愈历史毒消息
- 管理端校验 hold_multiplier >= discount_multiplier，定价快照对存量脏数据钳制
- 释放前校验 per-job hold claim（dedup+归档表），杜绝幻影释放

索引对账（高危）：
- provider 输出与提交 custom_id 集对账：未知条目丢弃并记事件，
  漏项补 PROVIDER_RESULT_MISSING 失败行，保证 success+fail == item_count

提交与恢复（高危）：
- 提交前转 uploading 并在 provider.Submit 期间心跳刷新 updated_at；
  恢复扫描改为原子复核（FailStaleUnsubmittedBatchImageJob），
  消灭慢提交被误杀退款而上游任务照常计费的孤儿场景
- 上游任务创建成功但本地状态推进失败时，尽力取消上游并清理输入
- recovery 释放失败时入队交由 worker releaseTerminalHold 兜底重试

队列与并发（中危）：
- Enqueue（SetNX+LPush）与 Reserve（BRPop+ZAdd）均改为 Lua 原子脚本，
  消灭崩溃窗口导致 job 脱离队列、被 7 天 inflight 键锁死
- 锁冲突按 LockConflictDelay 重新入队（原直接丢弃需等 10 分钟 stale 恢复）
- 处理期间心跳：active zset 续期（ZAddXX 防幽灵成员）+ 锁 TTL 续期
- ReplaceBatchImageItemsForJob 增加 indexing 状态守卫，防掉队 worker 重写账目

存量回归（中危）：
- image-only 定价条目（仅图片价无 token 价）恢复 token 计费 fail-closed，
  不再按 $0 计费；图片计费路径不受影响
- 鉴权余额门槛恢复 balance <= 0 语义，MinimumBalanceReserve 不再作硬 403

加固：
- ZIP max_items 钳制到管理员上限；Submit 补齐 Platform==Gemini 校验；
  gemini downloadUri 跟随前做 host 白名单校验
- 批量客户端改用共享 httpclient（拨号/TLS/响应头超时有界）
- 审计点名的忽略错误（MarkDownloaded/SettlementFailed/AppendEvent 等）改为记日志

2026-07-07 18:53:56 +08:00

..

admin

merge: sync batch image branch with origin main

2026-07-07 03:27:11 +08:00

dto

merge: sync batch image branch with origin main

2026-07-07 03:27:11 +08:00

quotaview

feat(quota): 用户 × 平台 USD 配额

2026-05-26 10:49:20 +08:00

announcement_handler.go

merge upstream main

2026-02-02 22:13:50 +08:00

api_key_handler.go

fix: return 404 instead of 403 for unauthorized key access to prevent ID oracle (CWE-204)

2026-06-02 00:46:50 +08:00

auth_current_user_test.go

fix(profile): stabilize identity binding management

2026-04-22 13:19:28 +08:00

auth_dingtalk_client_test.go

feat(dingtalk): 钉钉 OAuth 登录接入与 internal_only 用户属性同步

2026-05-19 15:27:47 +08:00

auth_dingtalk_client.go

feat(dingtalk): 钉钉 OAuth 登录接入与 internal_only 用户属性同步

2026-05-19 15:27:47 +08:00

auth_dingtalk_oauth_test.go

feat(dingtalk): 钉钉 OAuth 登录接入与 internal_only 用户属性同步

2026-05-19 15:27:47 +08:00

auth_dingtalk_oauth.go

fix(auth): apply promo codes to oauth signups

2026-06-11 18:55:27 +08:00

auth_email_oauth_test.go

fix(auth): apply promo codes to oauth signups

2026-06-11 18:55:27 +08:00

auth_email_oauth.go

fix(auth): apply promo codes to oauth signups

2026-06-11 18:55:27 +08:00

auth_handler.go

feat(auth): 透传验证码邮件语言偏好

2026-05-20 13:25:45 +08:00

auth_linuxdo_oauth_test.go

feat: fix OAuth email completion flow

2026-06-30 01:11:51 +08:00

auth_linuxdo_oauth.go

feat: fix OAuth email completion flow

2026-06-30 01:11:51 +08:00

auth_oauth_logout_test.go

fix(auth): harden pending oauth and backend mode flows

2026-04-22 12:30:00 +08:00

auth_oauth_pending_flow_test.go

fix(auth): enforce email bind suffix whitelist

2026-06-19 21:17:45 +08:00

auth_oauth_pending_flow.go

fix(auth): apply promo codes to oauth signups

2026-06-11 18:55:27 +08:00

auth_oauth_test_helpers_test.go

fix(oidc): harden verified-email fast path

2026-05-21 15:19:29 +08:00

auth_oidc_oauth_test.go

fix(oidc): harden verified-email fast path

2026-05-21 15:19:29 +08:00

auth_oidc_oauth.go

fix(auth): apply promo codes to oauth signups

2026-06-11 18:55:27 +08:00

auth_session_revocation_test.go

feat(quota): 用户 × 平台 USD 配额

2026-05-26 10:49:20 +08:00

auth_wechat_oauth_test.go

feat(quota): 用户 × 平台 USD 配额

2026-05-26 10:49:20 +08:00

auth_wechat_oauth.go

fix(auth): apply promo codes to oauth signups

2026-06-11 18:55:27 +08:00

available_channel_handler_test.go

fix: 高峰倍率全链路透传、计费术语修正与边界处理

2026-07-01 17:46:12 +08:00

available_channel_handler.go

fix: 高峰倍率全链路透传、计费术语修正与边界处理

2026-07-01 17:46:12 +08:00

batch_image_handler.go

fix(batch-image): 修复审计发现的计费死锁、状态机与队列原子性缺陷

2026-07-07 18:53:56 +08:00

channel_monitor_user_handler.go

feat(channel-monitor): add feature switch settings + fix extra_models save

2026-04-21 00:21:29 +08:00

concurrency_error_response_test.go

fix: classify concurrency acquire failures

2026-05-28 10:03:41 +00:00

concurrency_error_response.go

fix: move user wait queue accounting off hot path

2026-06-16 11:41:54 +08:00

content_moderation_helper.go

feat(risk-control): add content moderation audit

2026-05-07 09:14:47 +08:00

endpoint_test.go

test: cover endpoint wildcard edge cases

2026-07-07 10:20:23 +08:00

endpoint.go

fix: normalize inbound endpoints from raw request path

2026-07-07 10:20:23 +08:00

failover_loop_test.go

feat: 支持 API Key 上游池模式同账号重试次数配置与自定义错误策略

2026-03-08 14:12:17 +08:00

failover_loop.go

feat: 支持 API Key 上游池模式同账号重试次数配置与自定义错误策略

2026-03-08 14:12:17 +08:00

gateway_handler_billing_error_test.go

feat(quota): 用户 × 平台 USD 配额

2026-05-26 10:49:20 +08:00

gateway_handler_chat_completions.go

fix(gateway): 记录请求体解析失败的真实原因，不再吞错

2026-07-07 13:53:39 +08:00

gateway_handler_error_fallback_test.go

fix: avoid double-writing error frame on non-stream upstream errors

2026-06-09 22:46:06 +08:00

gateway_handler_intercept_test.go

fix(gateway): intercept max_tokens=1 haiku probes for streaming requests too

2026-06-11 20:46:47 +08:00

gateway_handler_responses.go

fix(gateway): 记录请求体解析失败的真实原因，不再吞错

2026-07-07 13:53:39 +08:00

gateway_handler_stream_failover_test.go

增加测试

2026-03-15 16:21:49 +08:00

gateway_handler_warmup_intercept_unit_test.go

优化并发槽位清理

2026-07-03 21:02:31 +08:00

gateway_handler.go

fix(gateway): 记录请求体解析失败的真实原因，不再吞错

2026-07-07 13:53:39 +08:00

gateway_helper_backoff_test.go

test: 为代码审核修复添加详细单元测试（7个测试文件，50+测试用例）

2026-02-07 22:14:07 +08:00

gateway_helper_fastpath_test.go

优化并发槽位清理

2026-07-03 21:02:31 +08:00

gateway_helper_hotpath_test.go

Merge pull request #3645 from bestony/worktree/lucky-harbor-dbe4

2026-07-06 16:45:15 +08:00

gateway_helper_test.go

…

gateway_helper.go

feat(keys): add api key concurrency stats

2026-07-02 15:58:29 +08:00

gateway_models_test.go

fix(gateway): honor Anthropic custom models list

2026-07-05 08:35:34 +08:00

gemini_cli_session_test.go

fix(gateway): harden digest logging and align antigravity ops

2026-02-07 17:12:15 +08:00

gemini_v1beta_handler_test.go

fix(handler): fallback known gemini models on v1beta 404

2026-04-01 02:20:13 +08:00

gemini_v1beta_handler.go

fix: return 404 model_not_found instead of 503 when no account supports the model

2026-06-26 15:38:06 +08:00

grok_media_test.go

fix: recognize grok media models

2026-07-01 11:43:35 +08:00

grok_media.go

fix(scheduler): 修复 OpenAI 高级调度器审计发现的正确性与性能问题

2026-07-06 11:43:16 +08:00

handler.go

feat: add batch image MVP

2026-07-04 05:30:50 +08:00

idempotency_helper_test.go

feat(idempotency): 为关键写接口接入幂等并完善并发容错

2026-02-23 12:45:37 +08:00

idempotency_helper.go

feat(idempotency): 为关键写接口接入幂等并完善并发容错

2026-02-23 12:45:37 +08:00

image_concurrency_limiter_test.go

feat(quota): 用户 × 平台 USD 配额

2026-05-26 10:49:20 +08:00

image_concurrency_limiter.go

feat: add OpenAI image generation controls

2026-05-05 03:26:54 +08:00

logging.go

chore(logging): 完成后端日志审计与结构化迁移

2026-02-12 19:01:09 +08:00

no_account_error_test.go

fix: return 404 model_not_found instead of 503 when no account supports the model

2026-06-26 15:38:06 +08:00

no_account_error.go

fix: repair CI build & lint regressions on main

2026-06-26 16:06:01 +08:00

openai_chat_completions.go

fix(gateway): 记录请求体解析失败的真实原因，不再吞错

2026-07-07 13:53:39 +08:00

openai_embeddings.go

fix(gateway): 记录请求体解析失败的真实原因，不再吞错

2026-07-07 13:53:39 +08:00

openai_gateway_compact_log_test.go

fix(openai): bump codex CLI version from 0.104.0 to 0.125.0

2026-04-25 05:26:33 +00:00

openai_gateway_count_tokens.go

fix(gateway): 记录请求体解析失败的真实原因，不再吞错

2026-07-07 13:53:39 +08:00

openai_gateway_cyber_test.go

feat(openai): cyber_policy 硬阻断全链路透传、审计与计费

2026-06-12 01:47:01 +08:00

openai_gateway_endpoint_normalization_test.go

refactor: migrate all handlers to shared endpoint normalization middleware

2026-03-15 22:13:42 +08:00

openai_gateway_handler_test.go

fix: allow grok messages compatibility

2026-06-29 18:33:37 +08:00

openai_gateway_handler.go

fix(gateway): 记录请求体解析失败的真实原因，不再吞错

2026-07-07 13:53:39 +08:00

openai_gateway_usage_context_test.go

Preserve usage request context

2026-05-28 22:44:25 +08:00

openai_images_controls_test.go

feat: add OpenAI image generation controls

2026-05-05 03:26:54 +08:00

openai_images_failover_test.go

test: fix grok oauth validation suite

2026-06-26 10:36:09 +08:00

openai_images.go

feat(spark-shadow): OpenAI Spark 链接型影子账号

2026-07-01 12:21:45 +08:00

openai_quota_platform_contract_test.go

fix(openai): preserve quota platform in usage billing

2026-06-28 11:13:09 +08:00

openai_stream_validation_test.go

fix: validate stream field type

2026-06-03 14:18:12 +08:00

openai_stream_validation.go

fix: validate stream field type

2026-06-03 14:18:12 +08:00

ops_error_logger_attribution_test.go

feat(ops): 错误日志 key 归因与早退字段补全

2026-06-05 14:00:57 +08:00

ops_error_logger_cyber_test.go

feat(openai): cyber_policy 硬阻断全链路透传、审计与计费

2026-06-12 01:47:01 +08:00

ops_error_logger_test.go

feat(ops): 错误日志 key 归因与早退字段补全

2026-06-05 14:00:57 +08:00

ops_error_logger.go

feat(openai): cyber_policy 硬阻断全链路透传、审计与计费

2026-06-12 01:47:01 +08:00

page_handler_test.go

Fix image billing size normalization

2026-05-12 15:21:31 +08:00

page_handler.go

Add admin compliance acknowledgement gate

2026-06-10 14:16:51 +08:00

payment_handler_resume_test.go

fix(payment): 区分退款 pending 并收敛匿名查单

2026-06-30 10:00:48 +08:00

payment_handler.go

feat(payment): 订阅 CNY 换算改为独立汇率配置的显式 opt-in

2026-07-06 14:34:17 +08:00

payment_webhook_handler_test.go

feat: add Airwallex payments and multi-currency support

2026-05-11 11:17:26 +08:00

payment_webhook_handler.go

feat: add Airwallex payments and multi-currency support

2026-05-11 11:17:26 +08:00

redeem_handler.go

…

request_body_limit_test.go

…

request_body_limit.go

…

request_body_parse_log_test.go

fix(gateway): 记录请求体解析失败的真实原因，不再吞错

2026-07-07 13:53:39 +08:00

request_body_parse_log.go

fix(gateway): 记录请求体解析失败的真实原因，不再吞错

2026-07-07 13:53:39 +08:00

setting_handler_public_test.go

feat(settings): support dual-mode wechat oauth defaults

2026-04-21 20:36:10 +08:00

setting_handler.go

fix(group): harden peak-rate config handling and label peak windows with server timezone

2026-07-02 16:11:07 +08:00

stream_error_event_test.go

style: fix lint errors in response.failed SSE writer

2026-05-25 18:16:46 +08:00

stream_error_event.go

test: cover endpoint wildcard edge cases

2026-07-07 10:20:23 +08:00

subscription_handler.go

…

totp_handler.go

feat(auth): 透传验证码邮件语言偏好

2026-05-20 13:25:45 +08:00

usage_handler_daily_test.go

feat(usage): 记录并展示失败请求(用户端+管理端)

2026-06-05 14:00:57 +08:00

usage_handler_request_type_test.go

feat: align user usage analytics with admin

2026-06-30 15:31:28 +08:00

usage_handler_sort_test.go

feat(table): 表格排序与搜索改为后端处理

2026-04-09 18:14:28 +08:00

usage_handler.go

feat(usage): 错误请求对齐用量明细(UI/排序/筛选/列设置)

2026-07-03 23:02:27 +08:00

usage_record_submit_task_test.go

Preserve usage request context

2026-05-28 22:44:25 +08:00

user_handler_test.go

feat(usage): 在 /admin/usage 支持查看已删除用户的历史使用情况

2026-05-30 17:52:18 +08:00

user_handler.go

feat(quota): 用户 × 平台 USD 配额

2026-05-26 10:49:20 +08:00

user_msg_queue_helper.go

feat(gateway): 双模式用户消息队列 — 串行队列 + 软性限速

2026-03-03 01:05:11 +08:00

user_platform_quotas_handler_test.go

feat(quota): 用户 × 平台 USD 配额

2026-05-26 10:49:20 +08:00

wire.go

feat: add batch image MVP

2026-07-04 05:30:50 +08:00