github/sub2api
4
0
Fork 0
mirror of https://github.com/Wei-Shaw/sub2api.git synced 2026-10-30 08:22:34 +00:00
Code Issues Packages Projects Releases Wiki Activity
4,857 Commits 49 Branches 65 Tags
2d97207d412bd89806c98ea42b1883113ca6a994
Commit Graph
452 Commits
Author SHA1 Message Date
shaw 0ddd58aaf9 feat(security): 操作审计日志 + 会话IP/UA绑定 + 敏感操作 step-up 2FA 
应对管理员访问凭证失守导致的数据外泄风险，新增三层防护：

审计日志（admin-only 可见，用户不可见）
- 新增 append-only audit_logs 表（migration 180）+ 异步批量写入 + 保留期清理
- 审计中间件挂在 admin/user/auth/admin-payment 组认证之后：记录所有变更类
  请求 + 白名单敏感读取（账号/代理导出、备份下载、admin/user API key 读取）
- 请求头凭证首尾掩码；请求体 JSON 递归脱敏（api_key/password 等擦除，base_url
  保留以便追责）；非 JSON body 不入库
- 无单条删除；全量清空需现场 TOTP 校验、拒绝 admin API key、未启用 2FA 不允许，
  清空后同步写入留痕记录

会话 IP/UA 绑定（默认开启，可在系统设置关闭）
- JWT 携带 session id + IP/UA 指纹哈希；IP 或 UA 任一变化即撤销会话家族并要求
  重新登录；旧 token 无指纹时放行以平滑升级

敏感操作 step-up 2FA（sudo 窗口 15 分钟）
- 账号/代理导出、DB 备份创建/下载、S3 目标修改要求近期 TOTP 二次验证；admin API
  key 一律拒绝；前端 useStepUp 组合式 + TotpStepUpDialog 弹码后自动重试
- API key 查看按需求暂不加强管控

前端：新增 /admin/audit-logs 操作日志页面（筛选/详情/2FA 清空）、侧边栏入口、
step-up 弹窗接入导出与备份流程、安全设置项（绑定开关 + 日志保留天数）、zh/en i18n
 2026-07-16 13:47:50 +08:00
shaw 0408bdb34f Merge remote-tracking branch 'origin/main' into feat/upstream-rate-scheduling 
# Conflicts:
#	backend/internal/handler/openai_gateway_handler.go
 2026-07-16 10:31:21 +08:00
Wesley Liddick ab978e615e Merge pull request #4385 from yardbirds0/feat/upstream-billing-probe 
feat: 增加上游 Sub2API 计费倍率探测与账号展示
 2026-07-16 10:27:45 +08:00
Tian Lee 90ee85f3ef feat: 按上游计费倍率调度 OpenAI 账号 2026-07-16 00:40:46 +08:00
harukaandClaude Opus 4.8 06e03f467a feat(billing): 渠道自定义定价支持图片输入 token 单价 image_input_price 
渠道 token 计费模式此前无法为图片输入 token 单独定价，gpt-image-2
图片编辑等请求的图像输入被按文本 input_price 计费。新增
channel_model_pricing.image_input_price 列及全链路支持。

后端:
- 迁移 178：channel_model_pricing 新增 image_input_price 列
- ChannelModelPricing 新增 ImageInputPrice 字段，repo 读写、校验补齐
- model_pricing_resolver / GetModelPricingWithChannel 映射到
  ImageInputPricePerToken；未配置时归零，由 computeTokenBreakdown
  回退文本输入价（向后兼容，与 image_output_price 的渠道权威规则一致）
- admin / 用户侧定价 DTO 与 model-pricing 自动填充接口补充该字段

前端:
- 渠道定价表单新增「图片输入」价格输入（token 模式）
- API 类型、表单模型、form↔API 换算、自动填充、用户侧模型定价卡展示
- zh/en i18n 标签

相关 #4386。

Co-Authored-By: Claude Opus 4.8 (1M context) <noreply@anthropic.com>
Claude-Session: https://claude.ai/code/session_015wcJTKDddxXSQrepSs3wrU
 2026-07-15 09:35:34 -07:00
Tian Lee 0765d10c1d feat: 增加上游 Sub2API 计费倍率探测与账号展示 2026-07-15 23:58:46 +08:00
Yuhao Jiang 736824dd7a feat(affiliate): add admin recharge rebate option 2026-07-15 04:28:55 -05:00
Wesley Liddick 2d218fbe61 Merge pull request #4317 from yan9651688/feat/account-one-click-copy 
feat(accounts): add safe one-click account duplication
 2026-07-15 14:23:35 +08:00
yan9651688 f7da6e2bc6 fix(accounts): prevent duplicate retries from crossing admins 
Ambiguous idempotency-store failures can occur after the account transaction commits. Scope durable recovery markers to the authenticated admin, retain the operation key across reloads, and recover only an already committed copy without rerunning active work.

Constraint: Generic idempotent handlers may legitimately remain active while a recovery lookup is attempted

Rejected: Reclaim or rerun an in-progress duplicate request | can execute account creation concurrently

Rejected: Recover by source account and key alone | allows another admin to observe the committed copy

Confidence: high

Scope-risk: narrow

Reversibility: clean

Directive: Keep ambiguous-response recovery read-only and bind durable operation markers to the authenticated actor

Tested: Full Go unit suite, go vet, server build, integration-test compilation; frontend lint, typecheck, 1,030 Vitest tests, and production build

Not-tested: Docker-backed PostgreSQL integration runtime because Docker is unavailable

Related: Wei-Shaw/sub2api#1379

Related: Wei-Shaw/sub2api#2928
 2026-07-15 10:51:13 +08:00
yan9651688 60ff61132d feat(accounts): make repeated static account setup safer 
Admins often need another account with the same provider and routing configuration. Duplicate on the server so credentials never return to the browser, preserve exact group priorities atomically, start the copy paused, and recover the same copy after ambiguous idempotency-store failures.

Constraint: Admin account responses redact credentials, so duplication must remain server-side

Constraint: OAuth and setup-token credentials rotate and must not be shared across account rows

Rejected: Copy raw account JSON to the clipboard | exposes credentials outside the server

Rejected: Duplicate rotating credentials | account-scoped refresh locks can race token rotation

Confidence: high

Scope-risk: moderate

Reversibility: clean

Directive: Keep copies paused, avoid automatic upstream probes, and exclude rotating credential types unless token ownership is redesigned

Tested: Targeted Go tests, Go vet, server build; frontend lint, typecheck, Vitest suite, production build; integration test compiled

Not-tested: Docker-backed PostgreSQL execution because Docker is unavailable

Related: Wei-Shaw/sub2api#1379

Related: Wei-Shaw/sub2api#2928
 2026-07-15 10:51:13 +08:00
bestony 324a491671 feat: extend Server-Timing to authenticated user web APIs 
Mirror the Admin UI Server-Timing opt-in for user-facing pages so
authenticated callers can inspect total/app/db/redis/deps metrics on
session, profile, keys, usage, payment, and related user APIs.

- Collect when X-User-UI-Request=1 or path is on the user allowlist
- Emit for non-admin only on allowlisted paths (header is not auth)
- Exclude payment public/webhook surfaces
- Mark matching SPA requests and allow the new CORS request header
 2026-07-15 00:23:27 +08:00
superman2003 d2d3fcf57b feat(frontend): show Grok monitoring and Free plan badge 2026-07-14 12:24:42 +08:00
superman2003 30d4301bea fix(grok): use rolling 24h free quota estimate 2026-07-14 10:53:43 +08:00
shaw d41a10111d Merge remote-tracking branch 'origin/main' into feat/grok-sso-device-oauth 
# Conflicts:
#	frontend/src/api/admin/grok.ts
 2026-07-14 10:19:16 +08:00
Wesley Liddick 93f2ccf3a5 Merge pull request #4188 from superman2003/fix/grok-free-quota-429-20260713 
feat(grok): improve free quota probing and usage display
 2026-07-14 10:14:41 +08:00
Wesley Liddick a8927d8ec7 Merge pull request #4214 from bestony/agent/devbox-coding/25c66071-1783957460 
feat: add opt-in Server-Timing for Admin UI APIs
 2026-07-14 10:14:17 +08:00
bestonyandmultica-agent 2c2e50ba58 feat(ops): add host filtering to system logs 
Co-authored-by: multica-agent <github@multica.ai>
 2026-07-14 01:29:46 +08:00
bestonyandmultica-agent 54d228dda5 feat(admin): add opt-in server timing metrics 
Co-authored-by: multica-agent <github@multica.ai>
 2026-07-14 01:29:30 +08:00
jinfeijie bot ad4bf5c60d feat(grok): 支持 Web SSO 批量导入并转换为 Build OAuth 
新增 Grok Web SSO → xAI Device Flow → Grok Build OAuth 导入链路，
支持管理员批量粘贴 SSO key 创建 OAuth 账号。

- 后端：ConvertSSOToBuild、ConvertFromSSO、POST /admin/grok/sso-to-oauth
- 批量：3 worker 并发，失败跳过并汇总 created/failed，worker panic recover
- 无 refresh_token 时写入 expires_at 并强制 auto_pause_on_expired
- 前端：SSO Cookie 导入入口、动态超时、中英文案、部分成功不关弹窗
- 测试：pkg/service/handler/前端超时单测；本地 Docker 真实 SSO e2e 通过
 2026-07-14 01:09:07 +08:00
superman2003 c896cacf6d feat(grok): improve free quota probing and usage 2026-07-13 19:49:56 +08:00
li 03ccb2a08e fix(payment): 删除泄露内部 AI 渠道配置的废弃接口 
Fixes #4160
 2026-07-13 15:22:39 +08:00
Lyonle f2966530c5 feat(openai): 支持用户级 Fast/Flex 策略 2026-07-10 15:16:09 +08:00
li ea9f40b63f fix(frontend): UserBreakdownParams.request_type 类型从 number 改为 UsageRequestType 2026-07-10 12:38:21 +08:00
shaw 1c2e6503c6 feat: 版本徽章新增近3个历史版本在线回退与手动回退指引 
后端：
- UpdateService 新增 ListRollbackVersions/RollbackToVersion，回退目标强制
  限定为比当前版本更旧的近3个正式版本（排除当前/更新/预发布/草稿），
  越界返回 400 ROLLBACK_VERSION_NOT_ALLOWED；下载复用既有 HTTPS 域名
  白名单 + checksum 校验 + 原子换二进制管线
- GitHubReleaseClient 新增 FetchRecentReleases（releases 列表 API）
- 新增 GET /admin/system/rollback-versions；POST /admin/system/rollback
  支持可选 {"version"} body，无 body 保持原 .backup 本地回退行为不变
- 端点均在 /admin 组 adminAuth（IsAdmin+TokenVersion）保护内

前端：
- VersionBadge「已是最新版本」状态下新增版本回退面板：radio 卡片选择
  近3个版本，手动回退方式按部署形态 tab 切换（脚本部署 curl 命令 /
  Docker 镜像 tag 指引），支持一键复制；release 构建提供一键回退并
  复用重启流程；源码构建仅提示不支持在线回退
- 下拉根元素重置 whitespace-normal，修复 sidebar-brand 的
  white-space:nowrap 继承导致的长文本溢出裁切

测试：服务层过滤/排序/上限/非法目标拒绝、handler 双模式与鉴权错误映射、
GitHub client 列表拉取、前端 API 请求体行为共 16 个新增用例
 2026-07-09 22:30:04 +08:00
Wesley Liddick 10102807e2 Merge pull request #3869 from Birditch/feat/admin-user-role-and-token-ranking 
feat(admin): 用户角色管理 + 用户 Token 排行
 2026-07-09 19:50:01 +08:00
BirditchandClaude Opus 4.8 b062b36646 feat(admin): 用量记录页新增"用户 Token 排行"面板 
- 在 /admin/usage 新增按用户聚合的 Token 排行表（输入/输出/缓存/总 Token、请求数、费用）
- 支持按列排序、邮箱搜索、Top N (20/50/100/200)，点击行下钻到该用户
- 复用现有筛选（用户/时间/模型/分组等）与既有 KPI 卡片、逐条日志
- 后端对 /admin/dashboard/user-breakdown 做加法扩展（向后兼容）：
  - UserBreakdownItem 增加 input_tokens/output_tokens/cache_tokens
  - 新增 sort_by（白名单排序，防注入，缺省仍按 actual_cost）
- 新增 sort_by 转发单元测试；更新 UsageView.spec 稳定桩

Co-Authored-By: Claude Opus 4.8 (1M context) <noreply@anthropic.com>
 2026-07-09 06:04:22 -04:00
BirditchandClaude Opus 4.8 64fdc11ec4 feat(admin): 用户创建/编辑支持选择与修改角色 (user/admin) 
- 创建用户时可指定角色，缺省仍为 user，不再硬编码为普通用户
- 编辑用户时可在 user/admin 之间切换角色
- 后端对角色做 admin/user 合法性校验
- 防锁死保护：管理员不能把自己降级为普通用户（与既有"不能禁用/删除 admin"保护一致；降级其他管理员仍允许）
- 前端创建/编辑弹窗新增角色下拉，复用既有 i18n 文案
- 新增角色创建/更新/非法值/防降级单元测试

Co-Authored-By: Claude Opus 4.8 (1M context) <noreply@anthropic.com>
 2026-07-09 06:04:06 -04:00
Heatherm Huang 1a0a6ea9a8 fix: stabilize Grok quota probe model 2026-07-09 17:58:31 +08:00
Wesley Liddick e2c662e965 Merge pull request #3840 from feitianbubu/fix/crs-sync-frontend-timeout 
fix(crs-sync): raise frontend sync timeout to 180s
 2026-07-09 14:39:39 +08:00
feitianbubu 4e5be8f75e fix(crs-sync): raise frontend sync timeout to 180s 2026-07-09 09:45:47 +08:00
superman2003andCursor 29a5fcd25e fix(gateway,frontend): 修复鉴权绕过与前端支付/会话缺陷 
后端:
- Gemini /v1beta 鉴权中间件补齐主中间件的授权校验: API Key 的 IP 白/黑名单、
  专属分组授权、运行时过期/配额二次检查, 修复经 Gemini 端点绕过 IP ACL、
  越权访问专属分组、以及状态未刷新时的配额/有效期绕过窗口。
- 粘性会话等待计划分支改走 newSelectionResult 以 hydrate 账号凭证, 修复调度
  快照中账号凭证被剥离导致等待路径转发鉴权失败。
- SSE 流式转发客户端断开时不再 break 跳过当前事件 usage 合并, 修复少计费。
- Forward 对 nil gin.Context 的防御补齐; 上游错误体读取失败时记录日志避免静默。

前端:
- logout 将本地会话清理移入 finally, 服务端吊销失败也保证本地登出。
- Stripe 弹窗轮询改用正确的 auth_token 键并加防重入; 收到 INIT 后清除兜底
  超时定时器, onUnmounted 清理 message 监听器。
- token 刷新请求补充 30s 超时, 避免挂起导致请求队列与 loading 永久卡死。
- 路由守卫在公共设置未加载时先 await fetchPublicSettings, 避免 payment/
  risk_control 被误判为未启用而错误拦截。
- 支付状态轮询回调补充防重入与终态守卫。

Co-authored-by: Cursor <cursoragent@cursor.com>
 2026-07-09 09:06:56 +08:00
jjaw 6ae5fc31b3 fix(admin): gate scheduler score calculation 2026-07-08 06:58:35 +08:00
Wesley Liddick 4bcb13f77f Merge pull request #3786 from creamtea47/codex/openai-fast-force-priority 
add force priority fast policy action
 2026-07-07 20:45:45 +08:00
NellPoi e979990bf9 add force priority fast policy action 2026-07-07 15:27:23 +08:00
Turtle_Li 5494261902 Merge remote-tracking branch 'origin/main' into feature/batch-image-foundation 
# Conflicts:
#	.github/audit-exceptions.yml
 2026-07-07 10:53:17 +08:00
Turtle_Li 3c43fdec11 docs: add batch image PR readiness notes 2026-07-07 03:31:39 +08:00
Turtle_Li 1b07fe821a merge: sync batch image branch with origin main 2026-07-07 03:27:11 +08:00
wucm667 a23a263513 feat(payment): preview subscription CNY charge in plan editor 2026-07-06 17:52:53 +08:00
shaw d56e94b875 feat(payment): 订阅 CNY 换算改为独立汇率配置的显式 opt-in 
- 新增 SUBSCRIPTION_USD_TO_CNY_RATE 配置（1 USD = X CNY，默认 0=关闭），
  替代复用 balance_recharge_multiplier 的隐式换算，促销倍率与订阅定价解耦
- 未配置汇率时订阅保持 price 直付的存量行为，存量部署升级零影响
- 前端确认页/原价/手续费/方式限额与后端换算条件严格镜像（rate>0 且币种为 CNY）
- 管理后台新增汇率配置输入（zh/en 文案），checkout-info 透出 subscription_usd_to_cny_rate
- 单测锁定：汇率未配置时不换算、换算使用汇率而非余额倍率、余额订单不受影响、返利仍按 USD price
 2026-07-06 14:34:17 +08:00
Turtle_Li 9703ca9d33 merge: sync batch image foundation with upstream main 2026-07-06 13:40:09 +08:00
Turtle_Li 8fab636998 feat: complete batch image workflow 2026-07-06 12:22:04 +08:00
linshuboy f26ca5661e feat: add OpenAI advanced scheduler controls 
Related: #1089, #408, #123
 2026-07-05 17:24:38 +08:00
DaydreamCoding ebbdc70311 feat(usage): 错误请求对齐用量明细(UI/排序/筛选/列设置) 
错误请求列表(/admin/usage 错误 tab、Ops 弹窗、用户端 /usage 错误 tab)
对齐用量明细的交互与信息密度。Squash of:

- feat(usage): 错误请求全面对齐用量明细(UI/列序/排序/筛选/列设置/新列)
- refactor(usage): 错误表提取共享徽章工具与 IP 批量工具条,后端排序解析归并 SetSort
- feat(usage): /admin/usage 错误请求新增分类过滤
- fix(ops): 错误列表 phase=upstream 过滤生效,守卫豁免改为显式 opt-in
- fix(ops): 错误列表用户列回退显示已删除 KEY 所有者
- fix(usage): 错误请求状态码排序对齐展示/过滤,筛选项改固定常用码
 2026-07-03 23:02:27 +08:00
shaw a5638a4e54 fix: match Codex session imports by chatgpt_user_id before shared account id 
Members of the same ChatGPT team share chatgpt_account_id, so matching
imports by the account key first could overwrite another member's
account credentials. Identity keys are now ordered by strength
(user > email > access > account), and an account-key hit is rejected
when both sides carry different chatgpt_user_id values.

- Keep the account-key fallback when either side lacks a user id, so
  legacy accounts without chatgpt_user_id are updated and backfilled
  instead of duplicated
- Index all candidate accounts per shared key so a teammate's row can
  no longer shadow a legacy account depending on row order
- Apply the same conflict check to in-batch dedup and emit a warning
  when a legacy account is claimed via the shared account key
- Scope a 120s timeout to the Codex session import request instead of
  raising the global client timeout
 2026-07-03 10:13:51 +08:00
Wesley Liddick 537bd50469 Merge pull request #3638 from infinityf4p/show-reset-credit-expiration 
feat(openai): show reset credit expiration
 2026-07-02 17:39:17 +08:00
Wesley Liddick 821399ade1 Merge pull request #3622 from deqiying/feat/subscription-revoke-restore 
支持恢复已撤销订阅
 2026-07-02 17:34:20 +08:00
infinityf4p dfb36e45f1 show reset credit expiration 2026-07-02 13:27:58 +08:00
deqiying b26dcc3da2 feat(subscription): 支持恢复已撤销订阅 2026-07-01 22:19:21 +08:00
xueshiji 5e99561d6e Merge branch 'Wei-Shaw:main' into main 2026-07-01 17:48:42 +08:00
xueshiji 1034f576d7 fix: 高峰倍率全链路透传、计费术语修正与边界处理 
- 高峰倍率信息透传至可用渠道、支付计划、结算信息等 API，前端
  GroupBadge / GroupOptionItem / SubscriptionPlanCard / PaymentView /
  SubscriptionsView 统一展示高峰时段与倍率标签
- 修正计费术语："文本倍率" → "token 倍率"，明确高峰倍率同时作用于
  token 计费的图片 token，图片按次计费不受高峰影响
- 允许高峰倍率 multiplier=0，支持高峰时段免费策略
- 切换分组类型为 standard 时自动清除高峰倍率配置
- 长上下文计费与标准计费路径改用内部实现，移除冗余中间调用
- 前端高峰倍率相关控件文案改为 i18n
- 新增多组高峰倍率相关单元测试
 2026-07-01 17:46:12 +08:00