wushenghua/sub2api
1
0
Fork 0
Code Issues Pull Requests Actions Packages Projects Releases Wiki Activity
5,020 Commits 1 Branch 0 Tags
bfabfe60c84cfbb10fbe7900a7ea2bd280aefb75
Commit Graph
38 Commits
Author SHA1 Message Date
Wesley LiddickandGitHub 7e13b6d039 Merge pull request #4425 from AdrianZhaoDev/agent/admin-users-batch-limits 
feat(admin): batch update user concurrency and RPM
 2026-07-16 19:33:32 +08:00
zhaozewu 7947619cc3 feat(admin): batch update user limits 2026-07-16 15:37:35 +08:00
shaw 0ddd58aaf9 feat(security): 操作审计日志 + 会话IP/UA绑定 + 敏感操作 step-up 2FA 
应对管理员访问凭证失守导致的数据外泄风险，新增三层防护：

审计日志（admin-only 可见，用户不可见）
- 新增 append-only audit_logs 表（migration 180）+ 异步批量写入 + 保留期清理
- 审计中间件挂在 admin/user/auth/admin-payment 组认证之后：记录所有变更类
  请求 + 白名单敏感读取（账号/代理导出、备份下载、admin/user API key 读取）
- 请求头凭证首尾掩码；请求体 JSON 递归脱敏（api_key/password 等擦除，base_url
  保留以便追责）；非 JSON body 不入库
- 无单条删除；全量清空需现场 TOTP 校验、拒绝 admin API key、未启用 2FA 不允许，
  清空后同步写入留痕记录

会话 IP/UA 绑定（默认开启，可在系统设置关闭）
- JWT 携带 session id + IP/UA 指纹哈希；IP 或 UA 任一变化即撤销会话家族并要求
  重新登录；旧 token 无指纹时放行以平滑升级

敏感操作 step-up 2FA（sudo 窗口 15 分钟）
- 账号/代理导出、DB 备份创建/下载、S3 目标修改要求近期 TOTP 二次验证；admin API
  key 一律拒绝；前端 useStepUp 组合式 + TotpStepUpDialog 弹码后自动重试
- API key 查看按需求暂不加强管控

前端：新增 /admin/audit-logs 操作日志页面（筛选/详情/2FA 清空）、侧边栏入口、
step-up 弹窗接入导出与备份流程、安全设置项（绑定开关 + 日志保留天数）、zh/en i18n
 2026-07-16 13:47:50 +08:00
wucm667 ecedc7c8d3 fix(auth): enforce email bind suffix whitelist 2026-06-19 21:17:45 +08:00
wucm667 f8c80bf038 fix(auth): apply promo codes to oauth signups 2026-06-11 18:55:27 +08:00
DaydreamCodingandClaude Opus 4.7 b60d8bb4cc feat(usage): 在 /admin/usage 支持查看已删除用户的历史使用情况 
用户软删除后使用记录仍在,但身份(邮箱)被 ent 软删除拦截器隐藏。本次在
三条管理员只读路径定点穿透软删除过滤,并把删除状态传播到前端标记,零新表/
迁移/回填:

- 后端穿透:富化 usage 日志(loadUsers)、用户搜索(ListWithFilters +
  UserListFilters.IncludeDeleted)、点击详情(GetByIDIncludeDeleted /
  GetUserIncludeDeleted + getById ?include_deleted 分支)
- 状态传播:service.User / dto.User 新增 DeletedAt;SearchUsers 标记 deleted
- 前端:表格与余额弹窗展示"已删除"徽标、筛选下拉标注并排序、点击走
  include_deleted;新增 i18n admin.usage.userDeletedBadge
- 安全:普通用户 usage 仅查本人(无 PII 泄漏);主用户列表与默认 getById
  行为不变(已删用户仍 404);仅 admin 搜索设 IncludeDeleted

后端 build / 三态 vet / unit 全量 / 仓储集成全绿;前端 typecheck / vitest /
改动文件 eslint 全清。

Co-Authored-By: Claude Opus 4.7 (1M context) <noreply@anthropic.com>
 2026-05-30 17:52:18 +08:00
DaydreamCodingQTomClaude Opus 4.7
 		6b39b344d8 feat(quota): 用户 × 平台 USD 配额 
为用户在 anthropic/openai/gemini/antigravity 四个平台上提供日/周/月
三个窗口的 USD 配额管控。配额语义：未设置=不限制，0=禁用，>0=美元上限。

两层模型：
- 配置层：系统默认配额，以及 email/linuxdo/oidc/wechat/github/google/
  dingtalk 七个鉴权来源的默认配额，存于 settings，以嵌套 JSON 整体读写
  （系统 1 个 key + 每个来源 1 个 key），整体替换语义。
- 运行时层：user_platform_quota 表按用户记录实际配额，与配置层解耦。

后端：新增 ent schema 与 140_user_platform_quotas.sql 迁移、repository
与 service 端口、计费链路集成、管理端与用户端读写接口。
前端：管理端设置页配额编辑、用户配额管理 Modal、用户 Dashboard 展示、
中英文案。

Co-Authored-By: Claude Opus 4.7 (1M context) <noreply@anthropic.com>
 2026-05-26 10:49:20 +08:00
wucm667 3263ca63c7 feat(redeem): add redeem code batch update 2026-05-20 16:08:41 +08:00
Wesley LiddickandGitHub e69319e747 Merge pull request #2224 from lyen1688/feat-email-oauth-github-google 
feat: 增加 GitHub 和 Google 邮箱快捷登录
 2026-05-07 10:07:28 +08:00
lyen1688 af550fa64e feat: 增加 GitHub 和 Google 邮箱快捷登录 2026-05-06 16:06:11 +08:00
Michael-JetsonandClaude Opus 4.6 4cbd4932a0 feat: add redeem code affiliate rebate, batch concurrency API, and markdown page rendering 
1. Redeem code affiliate rebate: balance-type redeem codes now trigger
   invite rebate for the inviter. Payment fulfillment uses context key
   to prevent double-rebate.

2. Batch concurrency update: new POST /admin/users/batch-concurrency
   endpoint supporting mode=set/add with all=true for all users.

3. Markdown page rendering: new GET /api/v1/pages/:slug API serves local
   .md files. Custom menu items with url="md:slug" render markdown with
   collapsible TOC sidebar, scroll spy, and copy buttons on code blocks.

Co-Authored-By: Claude Opus 4.6 (1M context) <noreply@anthropic.com>
 2026-05-05 06:44:37 -07:00
shaw aa8ee33b0a refactor(affiliate): tighten DI and harden inviter code validation 
- Drop SetAffiliateService setters and ProvideAuthService /
  ProvidePaymentService / ProvideUserHandler wrappers in favor of direct
  Wire constructor injection. AffiliateService has no back-edge to
  Auth/Payment/User, so the indirection was never required.
- Change RegisterWithVerification's variadic affiliateCode to a fixed
  parameter; adjust all call sites.
- Validate aff_code length and charset in BindInviterByCode before any
  DB lookup, eliminating timing-side-channel and useless DB roundtrips
  on malformed input.
- Make affiliate cache invalidation synchronous; surface Redis errors
  via the project logger instead of swallowing them in a detached
  goroutine.
- Add an integration test guarding cross-layer tx propagation in
  AccrueQuota and a unit test pinning the aff_code format rules.
 2026-04-25 08:44:18 +08:00
IanShaw027 82259d1380 fix(auth): preserve resolved token version on oauth login 2026-04-22 16:01:25 +08:00
IanShaw027 36aed35957 fix(auth): harden oauth identity upgrade paths 2026-04-22 14:56:56 +08:00
IanShaw027 83cad63ce0 fix(auth): harden oauth callback adoption flows 2026-04-22 13:19:20 +08:00
IanShaw027 767f2f2dfe fix(auth): harden pending oauth and backend mode flows 2026-04-22 12:30:00 +08:00
IanShaw027 be9df2bea7 fix(auth): scrub legacy pending oauth tokens on upgrade 2026-04-22 11:29:05 +08:00
IanShaw027 454873221c test(auth): strengthen pending oauth legacy token assertions 2026-04-22 11:18:09 +08:00
IanShaw027 ca1f30a911 fix(auth): harden pending oauth session consumption 2026-04-22 11:17:38 +08:00
IanShaw027 b13e34f831 fix(ci): align auth and payment verification tests 2026-04-22 02:32:53 +08:00
IanShaw027 d4c0a99114 feat(auth): support unbinding third-party identities 2026-04-22 00:54:38 +08:00
IanShaw027 e4cfcae652 fix: reassign oauth adoption decisions on repeat login 2026-04-21 23:39:21 +08:00
IanShaw027 11db3989ce Fix repeated OAuth adoption prompt for existing logins 2026-04-21 23:35:59 +08:00
IanShaw027 d5819181ea feat(auth): reclaim stale identities and refresh profile UI 2026-04-21 07:49:40 -07:00
IanShaw027 d08757ce9e refactor(admin): remove auth migration reports 2026-04-21 17:34:18 +08:00
IanShaw027 7e89bca5e6 fix: tighten pending oauth email routing and binding state 2026-04-21 10:41:29 +08:00
IanShaw027 dcd5c43da4 feat: complete email binding and pending oauth verification flows 2026-04-21 10:00:06 +08:00
IanShaw027 09351e9459 fix auth completion and payment resume hardening 2026-04-21 08:23:26 +08:00
IanShaw027 7c6491c2d3 fix auth pending session hardening 2026-04-21 01:45:25 +08:00
IanShaw027 e4fe9fae2a Fix profile refresh identity compatibility 2026-04-21 00:42:55 +08:00
IanShaw027 9204145746 Close profile identity and avatar loop 2026-04-21 00:11:03 +08:00
IanShaw027 aaf4946b27 fix: normalize pending oauth email lookups 2026-04-20 21:59:03 +08:00
IanShaw027 5adefb466b fix: finalize oauth identity bindings 2026-04-20 21:24:33 +08:00
IanShaw027 fb6204ea8b feat: apply oauth first-bind defaults and pending bind 2fa 2026-04-20 19:53:22 +08:00
IanShaw027 6a75bd77e3 feat: add pending oauth email onboarding flow 2026-04-20 19:30:09 +08:00
IanShaw027 c6d8592484 feat: add profile auth identity binding flow 2026-04-20 18:28:44 +08:00
IanShaw027 e9de839d87 feat: rebuild auth identity foundation flow 2026-04-20 17:39:57 +08:00
IanShaw027 fbd0a2e3c4 feat: carry suggested third-party profile through pending oauth 2026-04-20 16:27:23 +08:00