wushenghua/sub2api
1
0
Fork 0
Code Issues Pull Requests Actions Packages Projects Releases Wiki Activity
5,273 Commits 1 Branch 0 Tags
cc84cd8b4c0aaae83544e46bb76c1f0ae8e49c5e
Commit Graph
1323 Commits
Author SHA1 Message Date
chinnsenn 71d7f86883 fix(antigravity): 
1. harden OpenAI compatibility forwarding
 2. reject usage-only non-stream responses
 2026-07-26 20:23:50 +09:00
shaw bc3acd6e28 fix(auth): 收紧注册别名查重（根点绕过 / 误拒 / 无界扫描 / 并发竞态） 
对 #4814 的审计跟进修复：

- 域名尾随点绕过：user@gmail.com. 的域名不在 gmail 家族名单内，点号折叠与
  googlemail 归一被整体跳过，别名刷号原样可复现。归一化入口统一去掉 FQDN 根点。
- 误拒合法用户：剥 "+后缀" 缺空串守卫，+alice@ 与 +bob@ 都折叠成 @domain，
  该域后续 "+x@" 注册会永久 EMAIL_EXISTS 且无自助恢复。改为仅当 "+" 不在首位时剥离。
- 无界不可索引全表扫描：原实现按 LOWER(email) LIKE '%@domain' 把整域邮箱读进内存，
  且挂在公开未鉴权的 send-verify-code 上。改为按去点邮箱
  REPLACE(LOWER(TRIM(email)), '.', '') 做等值 + "local+%@domain" 前缀探针并带 LIMIT，
  新增同表达式的部分索引（migrations/190）。TRIM 口径与既有精确匹配一致，
  历史带首尾空白的行同样命中；LIKE 元字符转义，% 与 _ 不会扩大匹配面。
- 并发竞态：注册改走 CreateWithEmailAliasGuard，在邮箱唯一性锁上追加收件箱身份锁并在
  锁内复查，避免同一收件箱的多个别名变体同时通过服务层前置查重。管理员建号仍走
  Create，不受别名限制。
- 能力断言静默 fail-open：别名查重方法上提到 UserRepository 端口（编译期强制），
  移除可选接口类型断言与静默降级分支。
- OAuth 邮箱注册的两条建号路径（同样发放注册赠额）纳入同一查重口径；邮箱换绑/绑定
  不纳入，否则用户把邮箱改成自己收件箱的别名会被误拒。
 2026-07-25 19:40:53 +08:00
alfadb b403f88f51 fix(ollama): 避免刷新候选饥饿 
ListDue 在 LIMIT 前用与 service 纯函数一致的 debounce/max-wait/backoff
规则筛真正 due 组，防止有活动但未到期的组占满每轮 20 名额。
 2026-07-25 15:37:06 +08:00
alfadb 0f72b7dca7 feat(ollama): 按模型请求刷新云端用量 
将 Ollama Cloud settings HTML 自动抓取从固定间隔轮询改为请求驱动的
trailing debounce + max-wait：无新请求不再抓取，连续请求最晚在
max-wait 强制刷新；失败退避仍优先于活动 due。新增 debounce_minutes
（默认 1），interval_minutes 保留为最长等待兼容字段。
 2026-07-25 15:37:05 +08:00
shaw 5374ce2a0f Merge remote-tracking branch 'origin/main' into feature/openai-live-gateway 2026-07-25 15:16:05 +08:00
Wesley LiddickandGitHub 6d956bdc20 Merge pull request #4801 from SemonCat/feat/persist-session-id 
feat(usage): persist client session identifiers
 2026-07-25 14:03:32 +08:00
song db6fbdbf29 fix(openai): satisfy Live CI checks 2026-07-25 12:51:20 +08:00
song 988d4b577e feat(openai): add macOS Live attestation 2026-07-25 12:50:46 +08:00
song e6eb23eaac feat(openai): add Live gateway support 2026-07-25 12:50:46 +08:00
Edison42 1c0cb24c7e feat(usage): persist client session identifiers 2026-07-24 01:22:34 +08:00
404QAQ 4fd9182aff fix(images): log requested quality and size 2026-07-23 23:04:00 +08:00
Wesley LiddickandGitHub cd8bb98c44 Merge pull request #4774 from superman2003/fix/issues-4763-4765-4769-20260723 
fix: optimize Codex identity imports and OpenAI account tests
 2026-07-23 17:38:05 +08:00
alfadb 5ac4a9fac2 feat(ollama): 支持 Cloud 官方用量自动刷新 2026-07-23 15:50:44 +08:00
Wesley LiddickandGitHub 2c76506e07 Merge pull request #4734 from wjx2951874/feat/alipay-mobile-precreate-deep-link 
feat(payment): add mobile Alipay precreate deep link
 2026-07-23 14:06:18 +08:00
superman2003 dd5956be5e fix(openai): prefer concrete GPT-5.6 test model 2026-07-23 13:44:15 +08:00
superman2003 5dfe838c21 fix(admin): optimize Codex identity import index 2026-07-23 13:43:57 +08:00
Wesley LiddickandGitHub 6f7bad3f2f Merge pull request #4751 from heathermhuang/codex/fix-grok-402-account-cooldown 
fix(grok): cool down accounts after upstream 402
 2026-07-23 11:19:30 +08:00
shaw ba88cc239c fix(billing): bill composite alias requests by the concrete forwarded model 
Composite public aliases (e.g. all/claude) reach the Anthropic/Gemini
billing core via OriginalModel/ChannelMappedModel source overrides.
Unknown aliases resolved to no pricing and silently recorded $0 cost,
while family-word aliases were mispriced by the fallback family match
(Opus traffic billed at the Sonnet fallback rate). The OpenAI path
already guards this via usageBillingModelCandidates; the shared
recordUsageCore had neither the guard nor a fallback.

- composite groups: unless the admin explicitly configured channel
  pricing for the alias (OpenRouter-style custom pricing), bill by the
  concrete forwarded model
- general safety net: when the selected billing model has no resolvable
  pricing at all, fall back to the concrete forwarded model instead of
  silently recording $0
- grok media usage records now attribute OriginalModel to the client
  requested public alias, consistent with every other endpoint
  (billing unaffected: empty BillingModelSource never triggers source
  overrides)

Priced traffic and non-composite groups are unaffected.
 2026-07-23 10:26:58 +08:00
shaw 90c4f50a5e fix(admin): restore currency and timestamps in admin plan list response 
The composite-groups PR (#3581) replaced the raw ent SubscriptionPlan
response of GET /admin/payment/plans with a projection struct but
dropped the currency field added by #4323. PlanEditDialog then read an
undefined currency, sent an empty string on save, and silently wiped
the stored plan currency. Restore currency plus created_at/updated_at
so the projection preserves the full original response shape.
 2026-07-23 10:26:46 +08:00
Heatherm Huang cb81e17fea test: align composite route contracts after rebase 2026-07-23 09:20:52 +08:00
Heatherm Huang 1c7959d0de fix: allow composite grok chat completions 2026-07-23 09:20:52 +08:00
Heatherm Huang 1d2dfab86d fix: allow composite grok messages routing 2026-07-23 09:20:52 +08:00
Heatherm Huang ee332cee64 Fix composite model defaults for linked platforms 2026-07-23 09:20:52 +08:00
Heatherm Huang ce3272c41b Build composite subscription bucket two 2026-07-23 09:20:52 +08:00
Heatherm Huang 3a683fff55 Fix composite route alias attribution 2026-07-23 09:20:52 +08:00
Heatherm Huang a008b63c16 Add composite group route registry 2026-07-23 09:20:18 +08:00
Heatherm Huang c8d1e2e16f Harden composite group product surfaces 2026-07-23 09:19:25 +08:00
Heatherm Huang ebc1028771 Add composite group routing 2026-07-23 09:19:24 +08:00
Heatherm Huang ca0d3314cf fix(grok): cool down accounts after 402 2026-07-23 00:06:04 +08:00
wjx2951874 7914433011 feat(payment): add mobile Alipay precreate deep link 2026-07-22 19:18:04 +08:00
nagi330 fde95fcd0f fix(usage): 统一后台使用记录模型筛选口径 2026-07-22 09:51:04 +08:00
Wesley LiddickandGitHub ebfaf2496b Merge pull request #4674 from AdrianZhaoDev/main 
feat(groups): add OpenAI reasoning policy
 2026-07-22 09:37:06 +08:00
zhaozewu 6af622c340 feat(groups): add OpenAI reasoning policy 
Persist reasoning ceilings and exact mappings for OpenAI groups, enforce them across HTTP and WebSocket forwarding, and invalidate cached auth snapshots.
 2026-07-21 11:02:43 +08:00
Wesley LiddickandGitHub 0b9d44545b Merge pull request #4641 from abbzbb/pr/grok-responses-compact 
feat(grok): 基于 Grok Responses 实现 /responses/compact 适配 (#4554)
 2026-07-21 10:43:04 +08:00
wucm667 addd5ef1dc [verified] fix: align sync cache billing after failover 2026-07-20 22:43:11 +08:00
Wesley LiddickandGitHub 27f094e096 Merge pull request #4638 from superman2003/fix/s3-secret-ephemeral-encryption-key 
fix(backup): 拒绝用自动生成的临时密钥持久化 S3 SecretAccessKey，修复重启后解密失败
 2026-07-20 16:21:46 +08:00
abbzbb 2ae61f3da0 fix(grok): Codex compact 适配与链式视频 content 代理 
- #4223/#4554: Grok 模拟 /responses/compact，调度允许 Grok 账号
- #4494/#4626: 支持链式中继的受保护视频 /content 下载
 2026-07-20 16:12:56 +08:00
Wesley LiddickandGitHub deb5e8756a Merge pull request #4572 from catoncat/fix/openai-agent-identity-team-isolation 
fix(openai): 按 Team 隔离 Agent Identity 导入
 2026-07-20 15:30:26 +08:00
Wesley LiddickandGitHub 78f85583ea Merge pull request #4630 from feitianbubu/fix/api-key-update-ip-list-clear 
fix: 部分更新 API Key 时不再静默清空 IP 白/黑名单
 2026-07-20 15:28:51 +08:00
superman2003 7a7f51a534 fix(backup): 拒绝用自动生成的临时密钥持久化 S3 SecretAccessKey 
totp.encryption_key 未配置时，加密密钥每次进程启动都会随机重新生成。
备份/图床把 S3 SecretAccessKey 用这把临时密钥加密落库后，重启或升级
即无法解密（decrypt: cipher: message authentication failed），S3 备份
与图床静默失效（#4524）。

对齐支付（payment.ProvideEncryptionKey）与 TOTP 启用已有的护栏：在
持久化新 secret 之前，若密钥非固定配置则返回可操作的
SECRET_ENCRYPTION_KEY_NOT_CONFIGURED（400），提示配置固定
TOTP_ENCRYPTION_KEY。不带 secret 的更新（沿用已存值）与
ReuseBackupS3 模式不受影响；已配置固定密钥的部署无感。
 2026-07-20 15:20:51 +08:00
shaw a90c18cbea Merge branch 'main' into fix/issues-4561-4562-4566-4582 
Resolve const-block conflict in openai_gateway_grok_cache.go:
keep #4590's client tool cache constants, drop grokFreeRolling24hTokenLimit
(moved to pkg/xai as IsGrokFreeRolling24hTokenLimit with legacy 2M support).
 2026-07-20 11:25:11 +08:00
feitianbubu e502766170 fix: 部分更新 API Key 时不再静默清空 IP 白/黑名单 2026-07-20 11:15:37 +08:00
Wesley LiddickandGitHub 34c8dbd604 Merge pull request #4618 from superman2003/fix/system-update-detach-request-ctx 
fix(update): detach in-place update from the HTTP request lifetime
 2026-07-20 10:26:47 +08:00
Wesley LiddickandGitHub e311d368d3 Merge pull request #4611 from superman2003/fix/codex-models-manifest-401-unschedulable 
fix(openai): mark OAuth accounts unschedulable on Codex models manifest 401
 2026-07-20 10:26:39 +08:00
Wesley LiddickandGitHub f133fde643 Merge pull request #4602 from jianjianai/new/perf-responses-image-intent 
perf(openai): 复用 Responses 生图意图判定
 2026-07-20 10:26:31 +08:00
Wesley LiddickandGitHub f5e484aa70 Merge pull request #4625 from wucm667/fix/issue-4624-sticky-force-cache-billing 
fix(handler): avoid cache billing on same-account retry
 2026-07-20 10:24:38 +08:00
Wesley LiddickandGitHub bfabfe60c8 Merge pull request #4593 from StarryKira/fix/image-storage-env-unreachable 
fix: 异步生图开关配了却不生效（环境变量被静默丢弃 + 迁移到后台开关）
 2026-07-20 09:20:15 +08:00
wucm667 a2acbf553b fix(handler): avoid cache billing on same-account retry 2026-07-20 02:20:58 +08:00
JlypxandSisyphus fedeba2568 feat: 审计客户端 IP 请求头变更 
Ultraworked with [Sisyphus](https://github.com/code-yeongyu/oh-my-openagent)

Co-authored-by: Sisyphus <clio-agent@sisyphuslabs.ai>
 2026-07-20 00:09:37 +08:00
JlypxandSisyphus 3c86e249f4 feat: 接入客户端 IP 请求头管理接口 
Ultraworked with [Sisyphus](https://github.com/code-yeongyu/oh-my-openagent)

Co-authored-by: Sisyphus <clio-agent@sisyphuslabs.ai>
 2026-07-20 00:09:21 +08:00