wushenghua/sub2api
1
0
Fork 0
Code Issues Pull Requests Actions Packages Projects Releases Wiki Activity
4,758 Commits 1 Branch 0 Tags
2d218fbe610f5cdc2ea9eff3b074158350c19636
Commit Graph
445 Commits
Author SHA1 Message Date
Wesley LiddickandGitHub 2d218fbe61 Merge pull request #4317 from yan9651688/feat/account-one-click-copy 
feat(accounts): add safe one-click account duplication
 2026-07-15 14:23:35 +08:00
yan9651688 f7da6e2bc6 fix(accounts): prevent duplicate retries from crossing admins 
Ambiguous idempotency-store failures can occur after the account transaction commits. Scope durable recovery markers to the authenticated admin, retain the operation key across reloads, and recover only an already committed copy without rerunning active work.

Constraint: Generic idempotent handlers may legitimately remain active while a recovery lookup is attempted

Rejected: Reclaim or rerun an in-progress duplicate request | can execute account creation concurrently

Rejected: Recover by source account and key alone | allows another admin to observe the committed copy

Confidence: high

Scope-risk: narrow

Reversibility: clean

Directive: Keep ambiguous-response recovery read-only and bind durable operation markers to the authenticated actor

Tested: Full Go unit suite, go vet, server build, integration-test compilation; frontend lint, typecheck, 1,030 Vitest tests, and production build

Not-tested: Docker-backed PostgreSQL integration runtime because Docker is unavailable

Related: Wei-Shaw/sub2api#1379

Related: Wei-Shaw/sub2api#2928
 2026-07-15 10:51:13 +08:00
yan9651688 60ff61132d feat(accounts): make repeated static account setup safer 
Admins often need another account with the same provider and routing configuration. Duplicate on the server so credentials never return to the browser, preserve exact group priorities atomically, start the copy paused, and recover the same copy after ambiguous idempotency-store failures.

Constraint: Admin account responses redact credentials, so duplication must remain server-side

Constraint: OAuth and setup-token credentials rotate and must not be shared across account rows

Rejected: Copy raw account JSON to the clipboard | exposes credentials outside the server

Rejected: Duplicate rotating credentials | account-scoped refresh locks can race token rotation

Confidence: high

Scope-risk: moderate

Reversibility: clean

Directive: Keep copies paused, avoid automatic upstream probes, and exclude rotating credential types unless token ownership is redesigned

Tested: Targeted Go tests, Go vet, server build; frontend lint, typecheck, Vitest suite, production build; integration test compiled

Not-tested: Docker-backed PostgreSQL execution because Docker is unavailable

Related: Wei-Shaw/sub2api#1379

Related: Wei-Shaw/sub2api#2928
 2026-07-15 10:51:13 +08:00
bestony 324a491671 feat: extend Server-Timing to authenticated user web APIs 
Mirror the Admin UI Server-Timing opt-in for user-facing pages so
authenticated callers can inspect total/app/db/redis/deps metrics on
session, profile, keys, usage, payment, and related user APIs.

- Collect when X-User-UI-Request=1 or path is on the user allowlist
- Emit for non-admin only on allowlisted paths (header is not auth)
- Exclude payment public/webhook surfaces
- Mark matching SPA requests and allow the new CORS request header
 2026-07-15 00:23:27 +08:00
superman2003 d2d3fcf57b feat(frontend): show Grok monitoring and Free plan badge 2026-07-14 12:24:42 +08:00
superman2003 30d4301bea fix(grok): use rolling 24h free quota estimate 2026-07-14 10:53:43 +08:00
shaw d41a10111d Merge remote-tracking branch 'origin/main' into feat/grok-sso-device-oauth 
# Conflicts:
#	frontend/src/api/admin/grok.ts
 2026-07-14 10:19:16 +08:00
Wesley LiddickandGitHub 93f2ccf3a5 Merge pull request #4188 from superman2003/fix/grok-free-quota-429-20260713 
feat(grok): improve free quota probing and usage display
 2026-07-14 10:14:41 +08:00
Wesley LiddickandGitHub a8927d8ec7 Merge pull request #4214 from bestony/agent/devbox-coding/25c66071-1783957460 
feat: add opt-in Server-Timing for Admin UI APIs
 2026-07-14 10:14:17 +08:00
bestonyandmultica-agent 2c2e50ba58 feat(ops): add host filtering to system logs 
Co-authored-by: multica-agent <github@multica.ai>
 2026-07-14 01:29:46 +08:00
bestonyandmultica-agent 54d228dda5 feat(admin): add opt-in server timing metrics 
Co-authored-by: multica-agent <github@multica.ai>
 2026-07-14 01:29:30 +08:00
jinfeijie bot ad4bf5c60d feat(grok): 支持 Web SSO 批量导入并转换为 Build OAuth 
新增 Grok Web SSO → xAI Device Flow → Grok Build OAuth 导入链路，
支持管理员批量粘贴 SSO key 创建 OAuth 账号。

- 后端：ConvertSSOToBuild、ConvertFromSSO、POST /admin/grok/sso-to-oauth
- 批量：3 worker 并发，失败跳过并汇总 created/failed，worker panic recover
- 无 refresh_token 时写入 expires_at 并强制 auto_pause_on_expired
- 前端：SSO Cookie 导入入口、动态超时、中英文案、部分成功不关弹窗
- 测试：pkg/service/handler/前端超时单测；本地 Docker 真实 SSO e2e 通过
 2026-07-14 01:09:07 +08:00
superman2003 c896cacf6d feat(grok): improve free quota probing and usage 2026-07-13 19:49:56 +08:00
li 03ccb2a08e fix(payment): 删除泄露内部 AI 渠道配置的废弃接口 
Fixes #4160
 2026-07-13 15:22:39 +08:00
Lyonle f2966530c5 feat(openai): 支持用户级 Fast/Flex 策略 2026-07-10 15:16:09 +08:00
li ea9f40b63f fix(frontend): UserBreakdownParams.request_type 类型从 number 改为 UsageRequestType 2026-07-10 12:38:21 +08:00
shaw 1c2e6503c6 feat: 版本徽章新增近3个历史版本在线回退与手动回退指引 
后端：
- UpdateService 新增 ListRollbackVersions/RollbackToVersion，回退目标强制
  限定为比当前版本更旧的近3个正式版本（排除当前/更新/预发布/草稿），
  越界返回 400 ROLLBACK_VERSION_NOT_ALLOWED；下载复用既有 HTTPS 域名
  白名单 + checksum 校验 + 原子换二进制管线
- GitHubReleaseClient 新增 FetchRecentReleases（releases 列表 API）
- 新增 GET /admin/system/rollback-versions；POST /admin/system/rollback
  支持可选 {"version"} body，无 body 保持原 .backup 本地回退行为不变
- 端点均在 /admin 组 adminAuth（IsAdmin+TokenVersion）保护内

前端：
- VersionBadge「已是最新版本」状态下新增版本回退面板：radio 卡片选择
  近3个版本，手动回退方式按部署形态 tab 切换（脚本部署 curl 命令 /
  Docker 镜像 tag 指引），支持一键复制；release 构建提供一键回退并
  复用重启流程；源码构建仅提示不支持在线回退
- 下拉根元素重置 whitespace-normal，修复 sidebar-brand 的
  white-space:nowrap 继承导致的长文本溢出裁切

测试：服务层过滤/排序/上限/非法目标拒绝、handler 双模式与鉴权错误映射、
GitHub client 列表拉取、前端 API 请求体行为共 16 个新增用例
 2026-07-09 22:30:04 +08:00
Wesley LiddickandGitHub 10102807e2 Merge pull request #3869 from Birditch/feat/admin-user-role-and-token-ranking 
feat(admin): 用户角色管理 + 用户 Token 排行
 2026-07-09 19:50:01 +08:00
BirditchandClaude Opus 4.8 b062b36646 feat(admin): 用量记录页新增"用户 Token 排行"面板 
- 在 /admin/usage 新增按用户聚合的 Token 排行表（输入/输出/缓存/总 Token、请求数、费用）
- 支持按列排序、邮箱搜索、Top N (20/50/100/200)，点击行下钻到该用户
- 复用现有筛选（用户/时间/模型/分组等）与既有 KPI 卡片、逐条日志
- 后端对 /admin/dashboard/user-breakdown 做加法扩展（向后兼容）：
  - UserBreakdownItem 增加 input_tokens/output_tokens/cache_tokens
  - 新增 sort_by（白名单排序，防注入，缺省仍按 actual_cost）
- 新增 sort_by 转发单元测试；更新 UsageView.spec 稳定桩

Co-Authored-By: Claude Opus 4.8 (1M context) <noreply@anthropic.com>
 2026-07-09 06:04:22 -04:00
BirditchandClaude Opus 4.8 64fdc11ec4 feat(admin): 用户创建/编辑支持选择与修改角色 (user/admin) 
- 创建用户时可指定角色，缺省仍为 user，不再硬编码为普通用户
- 编辑用户时可在 user/admin 之间切换角色
- 后端对角色做 admin/user 合法性校验
- 防锁死保护：管理员不能把自己降级为普通用户（与既有"不能禁用/删除 admin"保护一致；降级其他管理员仍允许）
- 前端创建/编辑弹窗新增角色下拉，复用既有 i18n 文案
- 新增角色创建/更新/非法值/防降级单元测试

Co-Authored-By: Claude Opus 4.8 (1M context) <noreply@anthropic.com>
 2026-07-09 06:04:06 -04:00
Heatherm Huang 1a0a6ea9a8 fix: stabilize Grok quota probe model 2026-07-09 17:58:31 +08:00
Wesley LiddickandGitHub e2c662e965 Merge pull request #3840 from feitianbubu/fix/crs-sync-frontend-timeout 
fix(crs-sync): raise frontend sync timeout to 180s
 2026-07-09 14:39:39 +08:00
feitianbubu 4e5be8f75e fix(crs-sync): raise frontend sync timeout to 180s 2026-07-09 09:45:47 +08:00
superman2003ClawdCursor
 		29a5fcd25e fix(gateway,frontend): 修复鉴权绕过与前端支付/会话缺陷 
后端:
- Gemini /v1beta 鉴权中间件补齐主中间件的授权校验: API Key 的 IP 白/黑名单、
  专属分组授权、运行时过期/配额二次检查, 修复经 Gemini 端点绕过 IP ACL、
  越权访问专属分组、以及状态未刷新时的配额/有效期绕过窗口。
- 粘性会话等待计划分支改走 newSelectionResult 以 hydrate 账号凭证, 修复调度
  快照中账号凭证被剥离导致等待路径转发鉴权失败。
- SSE 流式转发客户端断开时不再 break 跳过当前事件 usage 合并, 修复少计费。
- Forward 对 nil gin.Context 的防御补齐; 上游错误体读取失败时记录日志避免静默。

前端:
- logout 将本地会话清理移入 finally, 服务端吊销失败也保证本地登出。
- Stripe 弹窗轮询改用正确的 auth_token 键并加防重入; 收到 INIT 后清除兜底
  超时定时器, onUnmounted 清理 message 监听器。
- token 刷新请求补充 30s 超时, 避免挂起导致请求队列与 loading 永久卡死。
- 路由守卫在公共设置未加载时先 await fetchPublicSettings, 避免 payment/
  risk_control 被误判为未启用而错误拦截。
- 支付状态轮询回调补充防重入与终态守卫。

Co-authored-by: Cursor <cursoragent@cursor.com>
 2026-07-09 09:06:56 +08:00
jjaw 6ae5fc31b3 fix(admin): gate scheduler score calculation 2026-07-08 06:58:35 +08:00
Wesley LiddickandGitHub 4bcb13f77f Merge pull request #3786 from creamtea47/codex/openai-fast-force-priority 
add force priority fast policy action
 2026-07-07 20:45:45 +08:00
NellPoi e979990bf9 add force priority fast policy action 2026-07-07 15:27:23 +08:00
Turtle_Li 5494261902 Merge remote-tracking branch 'origin/main' into feature/batch-image-foundation 
# Conflicts:
#	.github/audit-exceptions.yml
 2026-07-07 10:53:17 +08:00
Turtle_Li 3c43fdec11 docs: add batch image PR readiness notes 2026-07-07 03:31:39 +08:00
Turtle_Li 1b07fe821a merge: sync batch image branch with origin main 2026-07-07 03:27:11 +08:00
wucm667 a23a263513 feat(payment): preview subscription CNY charge in plan editor 2026-07-06 17:52:53 +08:00
shaw d56e94b875 feat(payment): 订阅 CNY 换算改为独立汇率配置的显式 opt-in 
- 新增 SUBSCRIPTION_USD_TO_CNY_RATE 配置（1 USD = X CNY，默认 0=关闭），
  替代复用 balance_recharge_multiplier 的隐式换算，促销倍率与订阅定价解耦
- 未配置汇率时订阅保持 price 直付的存量行为，存量部署升级零影响
- 前端确认页/原价/手续费/方式限额与后端换算条件严格镜像（rate>0 且币种为 CNY）
- 管理后台新增汇率配置输入（zh/en 文案），checkout-info 透出 subscription_usd_to_cny_rate
- 单测锁定：汇率未配置时不换算、换算使用汇率而非余额倍率、余额订单不受影响、返利仍按 USD price
 2026-07-06 14:34:17 +08:00
Turtle_Li 9703ca9d33 merge: sync batch image foundation with upstream main 2026-07-06 13:40:09 +08:00
Turtle_Li 8fab636998 feat: complete batch image workflow 2026-07-06 12:22:04 +08:00
linshuboy f26ca5661e feat: add OpenAI advanced scheduler controls 
Related: #1089, #408, #123
 2026-07-05 17:24:38 +08:00
DaydreamCoding ebbdc70311 feat(usage): 错误请求对齐用量明细(UI/排序/筛选/列设置) 
错误请求列表(/admin/usage 错误 tab、Ops 弹窗、用户端 /usage 错误 tab)
对齐用量明细的交互与信息密度。Squash of:

- feat(usage): 错误请求全面对齐用量明细(UI/列序/排序/筛选/列设置/新列)
- refactor(usage): 错误表提取共享徽章工具与 IP 批量工具条,后端排序解析归并 SetSort
- feat(usage): /admin/usage 错误请求新增分类过滤
- fix(ops): 错误列表 phase=upstream 过滤生效,守卫豁免改为显式 opt-in
- fix(ops): 错误列表用户列回退显示已删除 KEY 所有者
- fix(usage): 错误请求状态码排序对齐展示/过滤,筛选项改固定常用码
 2026-07-03 23:02:27 +08:00
shaw a5638a4e54 fix: match Codex session imports by chatgpt_user_id before shared account id 
Members of the same ChatGPT team share chatgpt_account_id, so matching
imports by the account key first could overwrite another member's
account credentials. Identity keys are now ordered by strength
(user > email > access > account), and an account-key hit is rejected
when both sides carry different chatgpt_user_id values.

- Keep the account-key fallback when either side lacks a user id, so
  legacy accounts without chatgpt_user_id are updated and backfilled
  instead of duplicated
- Index all candidate accounts per shared key so a teammate's row can
  no longer shadow a legacy account depending on row order
- Apply the same conflict check to in-batch dedup and emit a warning
  when a legacy account is claimed via the shared account key
- Scope a 120s timeout to the Codex session import request instead of
  raising the global client timeout
 2026-07-03 10:13:51 +08:00
Wesley LiddickandGitHub 537bd50469 Merge pull request #3638 from infinityf4p/show-reset-credit-expiration 
feat(openai): show reset credit expiration
 2026-07-02 17:39:17 +08:00
Wesley LiddickandGitHub 821399ade1 Merge pull request #3622 from deqiying/feat/subscription-revoke-restore 
支持恢复已撤销订阅
 2026-07-02 17:34:20 +08:00
infinityf4p dfb36e45f1 show reset credit expiration 2026-07-02 13:27:58 +08:00
deqiying b26dcc3da2 feat(subscription): 支持恢复已撤销订阅 2026-07-01 22:19:21 +08:00
xueshijiandGitHub 5e99561d6e Merge branch 'Wei-Shaw:main' into main 2026-07-01 17:48:42 +08:00
xueshiji 1034f576d7 fix: 高峰倍率全链路透传、计费术语修正与边界处理 
- 高峰倍率信息透传至可用渠道、支付计划、结算信息等 API，前端
  GroupBadge / GroupOptionItem / SubscriptionPlanCard / PaymentView /
  SubscriptionsView 统一展示高峰时段与倍率标签
- 修正计费术语："文本倍率" → "token 倍率"，明确高峰倍率同时作用于
  token 计费的图片 token，图片按次计费不受高峰影响
- 允许高峰倍率 multiplier=0，支持高峰时段免费策略
- 切换分组类型为 standard 时自动清除高峰倍率配置
- 长上下文计费与标准计费路径改用内部实现，移除冗余中间调用
- 前端高峰倍率相关控件文案改为 i18n
- 新增多组高峰倍率相关单元测试
 2026-07-01 17:46:12 +08:00
Wesley LiddickandGitHub 0a9146c3d1 Merge pull request #3586 from deqiying/codex/fix-subscription-revoke-soft-delete 
修复订阅撤销操作实际上是软删除的bug
 2026-07-01 15:38:45 +08:00
DaydreamCodingQTomClaude Sonnet 5
 		bdf7ead157 feat(spark-shadow): OpenAI Spark 链接型影子账号 
背景:gpt-5.3-codex-spark 使用独立于 codex 全局(5h/7d)的配额窗口(数据源是
/wham/usage 响应体的 codex_bengalfox,而非 codex 全局用的 x-codex-* 响应头),且
只能挂在已完成 OAuth 授权的 OpenAI 账号下复用其登录态,不能作为独立账号单独接入。
为此新增“链接型影子账号”(spark shadow account):影子账号本身不持有任何凭据,
通过 parent_account_id 指向母账号,凭据/token/代理透传自母账号并共享母账号的刷新
周期,仅在配额维度(quota_dimension=spark)和用量窗口上与母账号完全独立调度、互不
连坐。

实现:
- 数据模型:migration 154(+154a)给 accounts 表加 parent_account_id /
  quota_dimension 列 + 4 条约束(维度合法 / parent⟺非 global 维度一致 / 禁自指 /
  FK)+ 2 个 CONCURRENTLY 索引(母账号索引 + 每母账号至多一个影子的唯一索引)。
- 创建:POST /api/v1/admin/accounts/:id/shadow(CreateShadow)—— 一母一影(唯一
  索引兜底并发竞态),继承母账号 proxy/分组/并发/优先级(显式传参可覆盖),默认
  model_mapping 恒等映射到 spark(拒绝非 spark 模型),母账号必须是真实的 OpenAI
  OAuth 账号(非影子)。
- 凭据透传:resolveCredentialAccount 把影子解析回母账号,GetAccessToken / 请求头
  / WS 三条路径统一走此函数;影子自身 Credentials 恒为空(仅允许写 model_mapping),
  凭据写入的汇聚点 persistAccountCredentials 对影子早返 no-op,防止误写。
- 调度:parentHealthyForShadow 只看母账号是否仍是 OpenAI OAuth + 凭据/传输是否
  可用(active、token 未过期、未处于 401/刷新失败/传输故障导致的临时不可调度冷却),
  刻意不看母账号的 global 限流窗口——两条 429 道互不连坐。
- 用量:影子的 codex_5h/7d 走 OpenAIQuotaService.QueryUsage(/wham/usage 的
  codex_bengalfox),与母账号走的 WSv2 探测(/responses 头)完全独立的数据源、
  刷新节流与 staleness 判定。
- 备份:ExportData 显式排除影子账号(影子不持凭据,通用凭据型导入强制
  credentials 非空、无法表达父子链接),按 skipped_shadows 计数提示前端。
- 前端:账号操作菜单新增“创建 Spark 影子”入口,影子行展示回填的母账号信息
  (邮箱 / plan / 隐私模式 / 订阅到期 / chatgpt_account_id),批量操作自动跳过
  影子账号。

说明:migrations 目录用完整文件名(而非纯数字前缀)标识迁移,故本次新增的
154_account_spark_shadow.sql / 154a_..._notx.sql 与已有的
154_add_ops_system_logs_api_key_id.sql 按序号共存,与目录里 145/151 已有的
先例一致。

测试:新增约 20 个测试文件,覆盖 handler(CreateShadow 校验 / 母账号信息回填)、
repository(影子 round-trip / 一母一影唯一索引 / 迁移 schema)、service(凭据
透传三路径 / 调度母健康门 / 用量窗口来源与刷新节流 / CRS 母账号不变量 / 各类
早返与 fail-closed 场景)及前端组件(账号列表 / 操作菜单 / 用量重置)。

验证(镜像 CI;golangci-lint 首次全量分析耗时过长被跳过,其余全部实测):
- gofmt -l:干净
- go build ./... / go vet ./...:通过
- go test ./... -count=1:全绿(全部包 ok,含 internal/service、
  internal/repository、migrations)
- go test -tags integration ./internal/repository/... ./internal/service/...
  (真实 Postgres,testcontainers):全绿,含迁移幂等性
  (TestMigrationsRunner_IsIdempotent_AndSchemaIsUpToDate)与影子相关全部用例
- pnpm lint:check / pnpm typecheck / pnpm build(真实 vite 构建)/
  pnpm vitest run:全绿(124 文件 760 用例)

Co-Authored-By: Claude Sonnet 5 <noreply@anthropic.com>
 2026-07-01 12:21:45 +08:00
shaw 59e9356c51 feat: 抹除 Anthropic OAuth 请求中客户端 dateline 隐写指纹 
对 /v1/messages 转发到 Anthropic OAuth/setup-token 账号的请求做 dateline
归一化，将 system prompt 与 <system-reminder> 块中 "Today's date is …"
语句里的 4 种撇号变体与 "/" 日期分隔符还原为 ASCII 撇号 + "-"，抹除某些
客户端在检测到非官方 base URL 时注入的 3 bit 隐写指纹。API Key 账号不受
影响。新增系统设置开关 enable_client_dateline_normalization，默认开启。
 2026-07-01 10:54:18 +08:00
deqiying 03727ac363 fix(subscription): 修复订阅撤销软删除失效 
总: 增加明确的订阅撤销接口，修复撤销后的缓存失效和管理端 revoked 展示。

分: 同步失效订阅 L1 与 billing cache，补跨实例失效通知、soft-delete-aware 列表查询、revoked_at DTO 字段和回归测试。
 2026-07-01 00:37:51 +08:00
PMExtra cafc95c3e2 feat: align user usage analytics with admin 2026-06-30 15:31:28 +08:00
Wesley LiddickandGitHub 76e0d90736 Merge pull request #3509 from wucm667/fix/refund-pending-not-success 
fix(payment): 退款 pending 不再当成最终成功，避免站内账务与网关状态不一致
 2026-06-30 13:38:04 +08:00
Wesley LiddickandGitHub efb8b45876 Merge pull request #3560 from StarryKira/feat/issue-3557-oauth-email 
feat: fix OAuth email completion flow
 2026-06-30 10:55:00 +08:00