wushenghua/sub2api
1
0
Fork 0
Code Issues Pull Requests Actions Packages Projects Releases Wiki Activity
Files
539bfc8bad90cd4e6ef00f1e6fc42272a30f2afb
sub2api/backend/internal/handler
T
History
shaw 539bfc8bad feat(security): 敏感操作 step-up 2FA 开关化，安全开关默认关闭 
新增系统设置 step_up_enabled（默认关闭），把敏感操作 2FA 门控做成可开关；
同时将会话 IP/UA 绑定默认值从开启改为关闭，避免用户因 IP 变动登录后掉线。

## 新增功能
- 敏感操作 step-up 2FA 总开关 step_up_enabled（默认关闭）：关闭时账号/代理导出、
  备份创建/下载、S3 配置修改、提升管理员等操作恢复门控引入前的直接放行行为；
  开启后要求当前会话在 15 分钟内完成过 TOTP step-up 验证。

## 优化改进
- 会话 IP/UA 绑定默认改为关闭（功能保留，可在设置页按需开启）。
- 开启 step-up 开关需操作者本人已启用 TOTP（防自锁）；关闭开关本身作为敏感操作，
  需通过 step-up 验证（防止攻击者拿到会话后先关闸再导出/备份）。
- 两个安全开关请求字段改为可空指针（省略=保持现值），避免旧客户端全量保存时
  静默重置安全开关。
- 备份恢复（整库覆盖可回滚安全设置）纳入 step-up 门控。
- 审计摘要 diffSettings 补记 step_up_enabled / session_binding_enabled 变更。

## Bug 修复
- 修复 BackupView 恢复操作 409（恢复进行中）判断未适配 apiClient 扁平化错误对象。
2026-07-18 10:46:42 +08:00
..
admin
feat(security): 敏感操作 step-up 2FA 开关化，安全开关默认关闭
2026-07-18 10:46:42 +08:00
dto
feat(security): 敏感操作 step-up 2FA 开关化，安全开关默认关闭
2026-07-18 10:46:42 +08:00
quotaview
…
announcement_handler.go
…
api_key_handler.go
…
auth_current_user_test.go
…
auth_dingtalk_client_test.go
…
auth_dingtalk_client.go
…
auth_dingtalk_oauth_test.go
…
auth_dingtalk_oauth.go
fix(auth): apply promo codes to oauth signups
2026-06-11 18:55:27 +08:00
auth_email_oauth_test.go
fix(auth): apply promo codes to oauth signups
2026-06-11 18:55:27 +08:00
auth_email_oauth.go
fix(auth): apply promo codes to oauth signups
2026-06-11 18:55:27 +08:00
auth_handler.go
feat(security): 操作审计日志 + 会话IP/UA绑定 + 敏感操作 step-up 2FA
2026-07-16 13:47:50 +08:00
auth_linuxdo_oauth_test.go
feat(security): 操作审计日志 + 会话IP/UA绑定 + 敏感操作 step-up 2FA
2026-07-16 13:47:50 +08:00
auth_linuxdo_oauth.go
feat: fix OAuth email completion flow
2026-06-30 01:11:51 +08:00
auth_oauth_logout_test.go
…
auth_oauth_pending_flow_test.go
Merge pull request #4425 from AdrianZhaoDev/agent/admin-users-batch-limits
2026-07-16 19:33:32 +08:00
auth_oauth_pending_flow.go
fix(auth): apply promo codes to oauth signups
2026-06-11 18:55:27 +08:00
auth_oauth_test_helpers_test.go
…
auth_oidc_oauth_test.go
…
auth_oidc_oauth.go
fix(auth): apply promo codes to oauth signups
2026-06-11 18:55:27 +08:00
auth_session_revocation_test.go
…
auth_wechat_oauth_test.go
…
auth_wechat_oauth.go
fix(auth): apply promo codes to oauth signups
2026-06-11 18:55:27 +08:00
available_channel_handler_test.go
fix: 高峰倍率全链路透传、计费术语修正与边界处理
2026-07-01 17:46:12 +08:00
available_channel_handler.go
feat(billing): 渠道自定义定价支持图片输入 token 单价 image_input_price
2026-07-15 09:35:34 -07:00
batch_image_handler.go
feat(security-audit): add OpenAI-compatible prompt auditing
2026-07-17 00:39:39 +08:00
channel_monitor_user_handler.go
…
chat_completions_image_model_test.go
fix(openai): reject image models on chat completions
2026-07-15 22:22:51 +08:00
concurrency_error_response_test.go
…
concurrency_error_response.go
fix: move user wait queue accounting off hot path
2026-06-16 11:41:54 +08:00
content_moderation_helper.go
feat(security-audit): add OpenAI-compatible prompt auditing
2026-07-17 00:39:39 +08:00
endpoint_test.go
feat: add async image generation tasks
2026-07-15 19:57:37 -07:00
endpoint.go
feat: add async image generation tasks
2026-07-15 19:57:37 -07:00
failover_loop_test.go
fix(gateway): 客户端断开后 failover 静默终止，不再误报 502 账号耗尽
2026-07-15 09:29:05 +08:00
failover_loop.go
fix(gateway): 客户端断开后 failover 静默终止，不再误报 502 账号耗尽
2026-07-15 09:29:05 +08:00
gateway_handler_billing_error_test.go
…
gateway_handler_cancellation_test.go
fix(grok): fail over OAuth credential errors safely
2026-07-14 14:55:30 +08:00
gateway_handler_chat_completions.go
feat(security-audit): add OpenAI-compatible prompt auditing
2026-07-17 00:39:39 +08:00
gateway_handler_error_fallback_test.go
…
gateway_handler_intercept_test.go
fix(gateway): intercept max_tokens=1 haiku probes for streaming requests too
2026-06-11 20:46:47 +08:00
gateway_handler_responses.go
feat(security-audit): add OpenAI-compatible prompt auditing
2026-07-17 00:39:39 +08:00
gateway_handler_stream_failover_test.go
…
gateway_handler_usage_test.go
Keep usage ranges consistent across API and dashboards
2026-07-13 11:35:46 +08:00
gateway_handler_warmup_intercept_unit_test.go
增加调度分组生命周期租约
2026-07-15 00:12:40 +08:00
gateway_handler.go
Merge pull request #4485 from Sub2API-Devs/dev
2026-07-17 16:15:26 +08:00
gateway_helper_backoff_test.go
…
gateway_helper_fastpath_test.go
fix(openai-ws): bound ingress session lifecycle
2026-07-13 15:32:42 +08:00
gateway_helper_hotpath_test.go
Merge pull request #3645 from bestony/worktree/lucky-harbor-dbe4
2026-07-06 16:45:15 +08:00
gateway_helper_test.go
fix(grok): fail over OAuth credential errors safely
2026-07-14 14:55:30 +08:00
gateway_helper.go
fix(grok): fail over OAuth credential errors safely
2026-07-14 14:55:30 +08:00
gateway_key_billing_test.go
feat: 增加 API Key 计费倍率自省接口
2026-07-15 22:42:53 +08:00
gateway_key_billing.go
feat: 增加 API Key 计费倍率自省接口
2026-07-15 22:42:53 +08:00
gateway_models_test.go
fix(grok): repair OAuth routing regressions
2026-07-16 16:52:25 +08:00
gemini_cli_session_test.go
…
gemini_v1beta_handler_test.go
…
gemini_v1beta_handler.go
feat(security-audit): add OpenAI-compatible prompt auditing
2026-07-17 00:39:39 +08:00
grok_media_test.go
fix(grok): quarantine ineligible media accounts
2026-07-17 11:51:16 +08:00
grok_media.go
Merge pull request #4485 from Sub2API-Devs/dev
2026-07-17 16:15:26 +08:00
handler.go
feat(security-audit): add OpenAI-compatible prompt auditing
2026-07-17 00:39:39 +08:00
idempotency_helper_test.go
…
idempotency_helper.go
…
image_concurrency_limiter_test.go
…
image_concurrency_limiter.go
…
image_task_handler_test.go
feat: 异步图片任务结果落对象存储
2026-07-15 19:57:37 -07:00
image_task_handler.go
feat(security-audit): add OpenAI-compatible prompt auditing
2026-07-17 00:39:39 +08:00
logging.go
…
no_account_error_test.go
fix(grok): diagnose unavailable models by platform
2026-07-13 10:11:34 +08:00
no_account_error.go
fix(grok): diagnose unavailable models by platform
2026-07-13 10:11:34 +08:00
openai_alpha_search.go
feat(security-audit): add OpenAI-compatible prompt auditing
2026-07-17 00:39:39 +08:00
openai_body_limit_failover_test.go
test(openai): validate body-limit error envelope
2026-07-16 00:52:26 +08:00
openai_chat_completions.go
feat(security-audit): add OpenAI-compatible prompt auditing
2026-07-17 00:39:39 +08:00
openai_codex_models_handler_test.go
避免无效模型清单破坏 Codex 能力发现
2026-07-16 17:10:44 +08:00
openai_codex_models_handler.go
fix: fail over Codex manifest accounts
2026-07-13 20:36:37 +08:00
openai_embeddings.go
feat(security-audit): add OpenAI-compatible prompt auditing
2026-07-17 00:39:39 +08:00
openai_gateway_compact_body_signal_test.go
fix: 保留 remote_compaction_v2 原生 Responses 链路
2026-07-11 12:51:53 +08:00
openai_gateway_compact_log_test.go
fix(openai-ws): make first-message timeout configurable
2026-07-14 22:40:05 +08:00
openai_gateway_count_tokens.go
feat: 按上游计费倍率调度 OpenAI 账号
2026-07-16 00:40:46 +08:00
openai_gateway_credential_failover_loop_test.go
fix(grok): harden OAuth pool recovery
2026-07-14 14:55:30 +08:00
openai_gateway_credential_failover_test.go
fix(grok): fail over OAuth credential errors safely
2026-07-14 14:55:30 +08:00
openai_gateway_cyber_test.go
feat(openai): cyber_policy 硬阻断全链路透传、审计与计费
2026-06-12 01:47:01 +08:00
openai_gateway_endpoint_normalization_test.go
…
openai_gateway_first_output_timeout_test.go
fix(openai): bound native responses first output wait
2026-07-15 13:01:16 +08:00
openai_gateway_handler_test.go
Merge pull request #4384 from wp-a/fix/openai-model-scoped-transient-cooldown
2026-07-16 09:33:09 +08:00
openai_gateway_handler.go
Merge pull request #4485 from Sub2API-Devs/dev
2026-07-17 16:15:26 +08:00
openai_gateway_usage_context_test.go
…
openai_grok_image_intent_gate_test.go
test: 更新 image permission 测试适配 explicit intent 检查
2026-07-17 15:29:14 +08:00
openai_image_intent_hint_test.go
复用请求级图片生成意图判断
2026-07-15 04:20:11 +08:00
openai_images_controls_test.go
…
openai_images_failover_test.go
test: fix grok oauth validation suite
2026-06-26 10:36:09 +08:00
openai_images.go
feat(security-audit): add OpenAI-compatible prompt auditing
2026-07-17 00:39:39 +08:00
openai_quota_platform_contract_test.go
fix(openai): preserve quota platform in usage billing
2026-06-28 11:13:09 +08:00
openai_responses_failover_cancel_test.go
fix(gateway): 客户端断开后 failover 静默终止，不再误报 502 账号耗尽
2026-07-15 09:29:05 +08:00
openai_stream_validation_test.go
…
openai_stream_validation.go
…
ops_capture_writer_nil_test.go
修复 compact 心跳 writer 生命周期
2026-07-12 04:53:41 +08:00
ops_error_logger_attribution_test.go
…
ops_error_logger_cyber_test.go
feat(openai): cyber_policy 硬阻断全链路透传、审计与计费
2026-06-12 01:47:01 +08:00
ops_error_logger_test.go
fix(ops): 记录固化 200 SSE 流上的就地错误，修复流内限流不进错误看板
2026-07-08 02:51:51 +00:00
ops_error_logger.go
fix(grok): fail over OAuth credential errors safely
2026-07-14 14:55:30 +08:00
page_handler_test.go
…
page_handler.go
…
payment_handler_resume_test.go
fix(payment): 删除泄露内部 AI 渠道配置的废弃接口
2026-07-13 15:22:39 +08:00
payment_handler.go
feat(payment): 订阅套餐支持币种标注，区分 $ 符号对应币种
2026-07-15 11:17:45 +08:00
payment_webhook_handler_test.go
…
payment_webhook_handler.go
…
redeem_handler.go
…
request_body_limit_test.go
…
request_body_limit.go
fix(gateway): cap lenient json normalization
2026-07-09 11:15:52 +08:00
request_body_parse_log_test.go
fix(gateway): 记录请求体解析失败的真实原因，不再吞错
2026-07-07 13:53:39 +08:00
request_body_parse_log.go
fix(gateway): 记录请求体解析失败的真实原因，不再吞错
2026-07-07 13:53:39 +08:00
security_audit_errors_test.go
feat(security-audit): add OpenAI-compatible prompt auditing
2026-07-17 00:39:39 +08:00
security_audit_errors.go
feat(security-audit): add OpenAI-compatible prompt auditing
2026-07-17 00:39:39 +08:00
security_audit_helper_test.go
fix(security-audit): close prompt-audit bypass and privacy gaps
2026-07-17 08:46:57 +08:00
security_audit_helper.go
fix(security-audit): close prompt-audit bypass and privacy gaps
2026-07-17 08:46:57 +08:00
security_audit_media_submit_test.go
feat(security-audit): add OpenAI-compatible prompt auditing
2026-07-17 00:39:39 +08:00
security_audit_order_test.go
feat(security-audit): add OpenAI-compatible prompt auditing
2026-07-17 00:39:39 +08:00
setting_handler_public_test.go
…
setting_handler.go
fix(group): harden peak-rate config handling and label peak windows with server timezone
2026-07-02 16:11:07 +08:00
stream_error_event_test.go
…
stream_error_event.go
test: cover endpoint wildcard edge cases
2026-07-07 10:20:23 +08:00
subscription_handler.go
…
totp_handler.go
feat(security): gate admin role promotion behind step-up 2FA and harden admin TOTP verification
2026-07-16 16:49:08 +08:00
usage_handler_daily_test.go
…
usage_handler_request_type_test.go
fix: split Grok image and video pricing
2026-07-08 13:50:49 +08:00
usage_handler_sort_test.go
…
usage_handler.go
fix: split Grok image and video pricing
2026-07-08 13:50:49 +08:00
usage_record_submit_task_test.go
…
user_handler_test.go
feat(admin): batch update user limits
2026-07-16 15:37:35 +08:00
user_handler.go
…
user_msg_queue_helper.go
…
user_platform_quotas_handler_test.go
…
wire.go
feat(security): 敏感操作 step-up 2FA 开关化，安全开关默认关闭
2026-07-18 10:46:42 +08:00