wushenghua/sub2api
1
0
Fork 0
Code Issues Pull Requests Actions Packages Projects Releases Wiki Activity
Files
7d3a896fcd912e6141b9bbbe90ca5bd08ff49ea3
sub2api/backend/internal/handler
T
History
shaw bc3acd6e28 fix(auth): 收紧注册别名查重（根点绕过 / 误拒 / 无界扫描 / 并发竞态） 
对 #4814 的审计跟进修复：

- 域名尾随点绕过：user@gmail.com. 的域名不在 gmail 家族名单内，点号折叠与
  googlemail 归一被整体跳过，别名刷号原样可复现。归一化入口统一去掉 FQDN 根点。
- 误拒合法用户：剥 "+后缀" 缺空串守卫，+alice@ 与 +bob@ 都折叠成 @domain，
  该域后续 "+x@" 注册会永久 EMAIL_EXISTS 且无自助恢复。改为仅当 "+" 不在首位时剥离。
- 无界不可索引全表扫描：原实现按 LOWER(email) LIKE '%@domain' 把整域邮箱读进内存，
  且挂在公开未鉴权的 send-verify-code 上。改为按去点邮箱
  REPLACE(LOWER(TRIM(email)), '.', '') 做等值 + "local+%@domain" 前缀探针并带 LIMIT，
  新增同表达式的部分索引（migrations/190）。TRIM 口径与既有精确匹配一致，
  历史带首尾空白的行同样命中；LIKE 元字符转义，% 与 _ 不会扩大匹配面。
- 并发竞态：注册改走 CreateWithEmailAliasGuard，在邮箱唯一性锁上追加收件箱身份锁并在
  锁内复查，避免同一收件箱的多个别名变体同时通过服务层前置查重。管理员建号仍走
  Create，不受别名限制。
- 能力断言静默 fail-open：别名查重方法上提到 UserRepository 端口（编译期强制），
  移除可选接口类型断言与静默降级分支。
- OAuth 邮箱注册的两条建号路径（同样发放注册赠额）纳入同一查重口径；邮箱换绑/绑定
  不纳入，否则用户把邮箱改成自己收件箱的别名会被误拒。
2026-07-25 19:40:53 +08:00
..
admin
fix(ollama): 避免刷新候选饥饿
2026-07-25 15:37:06 +08:00
dto
Merge remote-tracking branch 'origin/main' into feature/openai-live-gateway
2026-07-25 15:16:05 +08:00
quotaview
feat(quota): 用户 × 平台 USD 配额
2026-05-26 10:49:20 +08:00
announcement_handler.go
…
api_key_handler.go
fix: 部分更新 API Key 时不再静默清空 IP 白/黑名单
2026-07-20 11:15:37 +08:00
auth_current_user_test.go
…
auth_dingtalk_client_test.go
feat(dingtalk): 钉钉 OAuth 登录接入与 internal_only 用户属性同步
2026-05-19 15:27:47 +08:00
auth_dingtalk_client.go
feat(dingtalk): 钉钉 OAuth 登录接入与 internal_only 用户属性同步
2026-05-19 15:27:47 +08:00
auth_dingtalk_oauth_test.go
feat(dingtalk): 钉钉 OAuth 登录接入与 internal_only 用户属性同步
2026-05-19 15:27:47 +08:00
auth_dingtalk_oauth.go
fix(auth): apply promo codes to oauth signups
2026-06-11 18:55:27 +08:00
auth_email_oauth_test.go
fix(auth): apply promo codes to oauth signups
2026-06-11 18:55:27 +08:00
auth_email_oauth.go
fix(auth): apply promo codes to oauth signups
2026-06-11 18:55:27 +08:00
auth_handler.go
feat(security): 操作审计日志 + 会话IP/UA绑定 + 敏感操作 step-up 2FA
2026-07-16 13:47:50 +08:00
auth_linuxdo_oauth_test.go
feat(security): 操作审计日志 + 会话IP/UA绑定 + 敏感操作 step-up 2FA
2026-07-16 13:47:50 +08:00
auth_linuxdo_oauth.go
feat: fix OAuth email completion flow
2026-06-30 01:11:51 +08:00
auth_oauth_logout_test.go
…
auth_oauth_pending_flow_test.go
fix(auth): 收紧注册别名查重（根点绕过 / 误拒 / 无界扫描 / 并发竞态）
2026-07-25 19:40:53 +08:00
auth_oauth_pending_flow.go
fix(auth): apply promo codes to oauth signups
2026-06-11 18:55:27 +08:00
auth_oauth_test_helpers_test.go
fix(oidc): harden verified-email fast path
2026-05-21 15:19:29 +08:00
auth_oidc_oauth_test.go
fix(oidc): harden verified-email fast path
2026-05-21 15:19:29 +08:00
auth_oidc_oauth.go
fix(auth): apply promo codes to oauth signups
2026-06-11 18:55:27 +08:00
auth_session_revocation_test.go
feat(quota): 用户 × 平台 USD 配额
2026-05-26 10:49:20 +08:00
auth_wechat_oauth_test.go
feat(quota): 用户 × 平台 USD 配额
2026-05-26 10:49:20 +08:00
auth_wechat_oauth.go
fix(auth): apply promo codes to oauth signups
2026-06-11 18:55:27 +08:00
available_channel_handler_test.go
fix: 高峰倍率全链路透传、计费术语修正与边界处理
2026-07-01 17:46:12 +08:00
available_channel_handler.go
feat(billing): 渠道自定义定价支持图片输入 token 单价 image_input_price
2026-07-15 09:35:34 -07:00
batch_image_handler.go
feat(usage): persist client session identifiers
2026-07-24 01:22:34 +08:00
channel_monitor_user_handler.go
…
chat_completions_image_model_test.go
fix(openai): reject image models on chat completions
2026-07-15 22:22:51 +08:00
composite_platform_test.go
fix: allow composite grok chat completions
2026-07-23 09:20:52 +08:00
composite_platform.go
Harden composite group product surfaces
2026-07-23 09:19:25 +08:00
concurrency_error_response_test.go
fix: classify concurrency acquire failures
2026-05-28 10:03:41 +00:00
concurrency_error_response.go
fix: move user wait queue accounting off hot path
2026-06-16 11:41:54 +08:00
content_moderation_helper.go
Fix composite route alias attribution
2026-07-23 09:20:52 +08:00
endpoint_test.go
feat: add async image generation tasks
2026-07-15 19:57:37 -07:00
endpoint.go
feat: add async image generation tasks
2026-07-15 19:57:37 -07:00
failover_loop_test.go
fix(handler): avoid cache billing on same-account retry
2026-07-20 02:20:58 +08:00
failover_loop.go
fix(handler): avoid cache billing on same-account retry
2026-07-20 02:20:58 +08:00
gateway_handler_billing_error_test.go
feat(quota): 用户 × 平台 USD 配额
2026-05-26 10:49:20 +08:00
gateway_handler_cancellation_test.go
test: align composite route contracts after rebase
2026-07-23 09:20:52 +08:00
gateway_handler_chat_completions.go
feat(usage): persist client session identifiers
2026-07-24 01:22:34 +08:00
gateway_handler_error_fallback_test.go
fix: avoid double-writing error frame on non-stream upstream errors
2026-06-09 22:46:06 +08:00
gateway_handler_intercept_test.go
fix(gateway): intercept max_tokens=1 haiku probes for streaming requests too
2026-06-11 20:46:47 +08:00
gateway_handler_responses.go
feat(usage): persist client session identifiers
2026-07-24 01:22:34 +08:00
gateway_handler_stream_failover_test.go
…
gateway_handler_usage_test.go
Keep usage ranges consistent across API and dashboards
2026-07-13 11:35:46 +08:00
gateway_handler_warmup_intercept_unit_test.go
Add composite group route registry
2026-07-23 09:20:18 +08:00
gateway_handler.go
feat(usage): persist client session identifiers
2026-07-24 01:22:34 +08:00
gateway_helper_backoff_test.go
…
gateway_helper_fastpath_test.go
fix(openai-ws): bound ingress session lifecycle
2026-07-13 15:32:42 +08:00
gateway_helper_hotpath_test.go
Merge pull request #3645 from bestony/worktree/lucky-harbor-dbe4
2026-07-06 16:45:15 +08:00
gateway_helper_test.go
fix(grok): fail over OAuth credential errors safely
2026-07-14 14:55:30 +08:00
gateway_helper.go
fix(grok): fail over OAuth credential errors safely
2026-07-14 14:55:30 +08:00
gateway_key_billing_test.go
test: align composite route contracts after rebase
2026-07-23 09:20:52 +08:00
gateway_key_billing.go
feat: 增加 API Key 计费倍率自省接口
2026-07-15 22:42:53 +08:00
gateway_models_test.go
Fix composite model defaults for linked platforms
2026-07-23 09:20:52 +08:00
gemini_cli_session_test.go
…
gemini_v1beta_handler_test.go
…
gemini_v1beta_handler.go
feat(usage): persist client session identifiers
2026-07-24 01:22:34 +08:00
grok_media_test.go
Merge origin/main into codex/secure-protected-video-content-4498
2026-07-18 21:38:17 +08:00
grok_media.go
feat(usage): persist client session identifiers
2026-07-24 01:22:34 +08:00
handler.go
feat(security-audit): add OpenAI-compatible prompt auditing
2026-07-17 00:39:39 +08:00
idempotency_helper_test.go
…
idempotency_helper.go
…
image_concurrency_limiter_test.go
feat(quota): 用户 × 平台 USD 配额
2026-05-26 10:49:20 +08:00
image_concurrency_limiter.go
…
image_task_admin_toggle_test.go
fix(backup): 拒绝用自动生成的临时密钥持久化 S3 SecretAccessKey
2026-07-20 15:20:51 +08:00
image_task_handler_test.go
feat: 异步图片任务结果落对象存储
2026-07-15 19:57:37 -07:00
image_task_handler.go
feat(image-storage): 异步生图对象存储改为后台配置，保存即生效
2026-07-19 00:56:21 -07:00
logging.go
…
no_account_error_test.go
fix: classify transient account exhaustion as 503 instead of 404
2026-07-17 22:10:18 +08:00
no_account_error.go
Add composite group routing
2026-07-23 09:19:24 +08:00
openai_alpha_search.go
feat(usage): persist client session identifiers
2026-07-24 01:22:34 +08:00
openai_body_limit_failover_test.go
test(openai): validate body-limit error envelope
2026-07-16 00:52:26 +08:00
openai_chat_completions.go
feat(usage): persist client session identifiers
2026-07-24 01:22:34 +08:00
openai_codex_models_handler_test.go
避免无效模型清单破坏 Codex 能力发现
2026-07-16 17:10:44 +08:00
openai_codex_models_handler.go
fix(openai): mark OAuth accounts unschedulable on Codex models manifest 401
2026-07-19 21:13:27 +08:00
openai_embeddings.go
feat(usage): persist client session identifiers
2026-07-24 01:22:34 +08:00
openai_gateway_compact_body_signal_test.go
fix: 保留 remote_compaction_v2 原生 Responses 链路
2026-07-11 12:51:53 +08:00
openai_gateway_compact_log_test.go
fix(openai-ws): make first-message timeout configurable
2026-07-14 22:40:05 +08:00
openai_gateway_count_tokens.go
Add composite group routing
2026-07-23 09:19:24 +08:00
openai_gateway_credential_failover_loop_test.go
fix(grok): cool down accounts after 402
2026-07-23 00:06:04 +08:00
openai_gateway_credential_failover_test.go
fix: 修复CI检查问题
2026-07-18 00:42:16 +08:00
openai_gateway_cyber_test.go
feat(openai): cyber_policy 硬阻断全链路透传、审计与计费
2026-06-12 01:47:01 +08:00
openai_gateway_endpoint_normalization_test.go
…
openai_gateway_first_output_timeout_test.go
fix(openai): bound native responses first output wait
2026-07-15 13:01:16 +08:00
openai_gateway_handler_test.go
优化 Responses 生图意图复用
2026-07-19 18:49:08 +08:00
openai_gateway_handler.go
feat(usage): persist client session identifiers
2026-07-24 01:22:34 +08:00
openai_gateway_usage_context_test.go
Preserve usage request context
2026-05-28 22:44:25 +08:00
openai_grok_image_intent_gate_test.go
test: 更新 image permission 测试适配 explicit intent 检查
2026-07-17 15:29:14 +08:00
openai_image_intent_hint_test.go
复用请求级图片生成意图判断
2026-07-15 04:20:11 +08:00
openai_images_controls_test.go
…
openai_images_failover_test.go
fix(images): log requested quality and size
2026-07-23 23:04:00 +08:00
openai_images.go
Merge pull request #4801 from SemonCat/feat/persist-session-id
2026-07-25 14:03:32 +08:00
openai_live_test.go
feat(openai): add macOS Live attestation
2026-07-25 12:50:46 +08:00
openai_live.go
fix(openai): satisfy Live CI checks
2026-07-25 12:51:20 +08:00
openai_quota_platform_contract_test.go
fix(openai): preserve quota platform in usage billing
2026-06-28 11:13:09 +08:00
openai_responses_failover_cancel_test.go
fix(gateway): 客户端断开后 failover 静默终止，不再误报 502 账号耗尽
2026-07-15 09:29:05 +08:00
openai_responses_image_intent_benchmark_test.go
优化 Responses 生图意图复用
2026-07-19 18:49:08 +08:00
openai_stream_validation_test.go
fix: validate stream field type
2026-06-03 14:18:12 +08:00
openai_stream_validation.go
fix: validate stream field type
2026-06-03 14:18:12 +08:00
ops_capture_writer_nil_test.go
修复 compact 心跳 writer 生命周期
2026-07-12 04:53:41 +08:00
ops_error_logger_attribution_test.go
fix: 过滤入口拒绝日志并强化鉴权边界
2026-07-18 00:11:18 +08:00
ops_error_logger_cyber_test.go
feat(openai): cyber_policy 硬阻断全链路透传、审计与计费
2026-06-12 01:47:01 +08:00
ops_error_logger_test.go
Merge pull request #4515 from BenjaminAaron196/feat/filter-noise-rejected-requests
2026-07-18 20:46:50 +08:00
ops_error_logger.go
Add composite group route registry
2026-07-23 09:20:18 +08:00
ops_ingress_reject_capture_test.go
fix: 过滤入口拒绝日志并强化鉴权边界
2026-07-18 00:11:18 +08:00
ops_platform_test.go
Harden composite group product surfaces
2026-07-23 09:19:25 +08:00
page_handler_test.go
Fix image billing size normalization
2026-05-12 15:21:31 +08:00
page_handler.go
Add admin compliance acknowledgement gate
2026-06-10 14:16:51 +08:00
payment_handler_resume_test.go
fix(payment): 删除泄露内部 AI 渠道配置的废弃接口
2026-07-13 15:22:39 +08:00
payment_handler.go
feat(payment): add mobile Alipay precreate deep link
2026-07-22 19:18:04 +08:00
payment_webhook_handler_test.go
feat: add Airwallex payments and multi-currency support
2026-05-11 11:17:26 +08:00
payment_webhook_handler.go
feat: add Airwallex payments and multi-currency support
2026-05-11 11:17:26 +08:00
redeem_handler.go
…
request_body_limit_test.go
…
request_body_limit.go
fix(gateway): cap lenient json normalization
2026-07-09 11:15:52 +08:00
request_body_parse_log_test.go
fix(gateway): 记录请求体解析失败的真实原因，不再吞错
2026-07-07 13:53:39 +08:00
request_body_parse_log.go
fix(gateway): 记录请求体解析失败的真实原因，不再吞错
2026-07-07 13:53:39 +08:00
security_audit_errors_test.go
feat(security-audit): add OpenAI-compatible prompt auditing
2026-07-17 00:39:39 +08:00
security_audit_errors.go
feat(security-audit): add OpenAI-compatible prompt auditing
2026-07-17 00:39:39 +08:00
security_audit_helper_test.go
fix(security-audit): close prompt-audit bypass and privacy gaps
2026-07-17 08:46:57 +08:00
security_audit_helper.go
fix(security-audit): close prompt-audit bypass and privacy gaps
2026-07-17 08:46:57 +08:00
security_audit_media_submit_test.go
feat(security-audit): add OpenAI-compatible prompt auditing
2026-07-17 00:39:39 +08:00
security_audit_order_test.go
feat(security-audit): add OpenAI-compatible prompt auditing
2026-07-17 00:39:39 +08:00
setting_handler_public_test.go
…
setting_handler.go
fix(group): harden peak-rate config handling and label peak windows with server timezone
2026-07-02 16:11:07 +08:00
stream_error_event_test.go
style: fix lint errors in response.failed SSE writer
2026-05-25 18:16:46 +08:00
stream_error_event.go
test: cover endpoint wildcard edge cases
2026-07-07 10:20:23 +08:00
subscription_handler.go
…
totp_handler.go
feat(security): gate admin role promotion behind step-up 2FA and harden admin TOTP verification
2026-07-16 16:49:08 +08:00
usage_handler_daily_test.go
feat(usage): 记录并展示失败请求(用户端+管理端)
2026-06-05 14:00:57 +08:00
usage_handler_request_type_test.go
fix: split Grok image and video pricing
2026-07-08 13:50:49 +08:00
usage_handler_sort_test.go
…
usage_handler.go
fix: split Grok image and video pricing
2026-07-08 13:50:49 +08:00
usage_record_submit_task_test.go
Preserve usage request context
2026-05-28 22:44:25 +08:00
user_handler_test.go
fix(auth): 收紧注册别名查重（根点绕过 / 误拒 / 无界扫描 / 并发竞态）
2026-07-25 19:40:53 +08:00
user_handler.go
feat(quota): 用户 × 平台 USD 配额
2026-05-26 10:49:20 +08:00
user_msg_queue_helper.go
…
user_platform_quotas_handler_test.go
feat(quota): 用户 × 平台 USD 配额
2026-05-26 10:49:20 +08:00
wire.go
feat(ollama): 支持 Cloud 官方用量自动刷新
2026-07-23 15:50:44 +08:00