Skip to content

GitLab

"frontend/src/vscode:/vscode.git/clone" did not exist on "3a089242f863742a17d3df470a84d4c725ab718a"
Commit 46dda583 authored by shaw's avatar shaw
Browse files

Merge PR #146: feat: 提升流式网关稳定性与安全策略强化

parents 27ed042c f8e7255c
Hide whitespace changes
Inline Side-by-side
backend/internal/service/openai_gateway_service.go
View file @ 46dda583
...@@ -16,9 +16,12 @@ import ( ...@@ -16,9 +16,12 @@ import (
"sort" "sort"
"strconv" "strconv"
"strings" "strings"
"sync/atomic"
"time" "time"
"github.com/Wei-Shaw/sub2api/internal/config" "github.com/Wei-Shaw/sub2api/internal/config"
"github.com/Wei-Shaw/sub2api/internal/util/responseheaders"
"github.com/Wei-Shaw/sub2api/internal/util/urlvalidator"
"github.com/gin-gonic/gin" "github.com/gin-gonic/gin"
) )
...@@ -630,10 +633,14 @@ func (s *OpenAIGatewayService) buildUpstreamRequest(ctx context.Context, c *gin. ...@@ -630,10 +633,14 @@ func (s *OpenAIGatewayService) buildUpstreamRequest(ctx context.Context, c *gin.
case AccountTypeAPIKey: case AccountTypeAPIKey:
// API Key accounts use Platform API or custom base URL // API Key accounts use Platform API or custom base URL
baseURL := account.GetOpenAIBaseURL() baseURL := account.GetOpenAIBaseURL()
if baseURL != "" { if baseURL == "" {
targetURL = baseURL + "/responses"
} else {
targetURL = openaiPlatformAPIURL targetURL = openaiPlatformAPIURL
} else {
validatedURL, err := s.validateUpstreamBaseURL(baseURL)
if err != nil {
return nil, err
}
targetURL = validatedURL + "/responses"
} }
default: default:
targetURL = openaiPlatformAPIURL targetURL = openaiPlatformAPIURL
...@@ -775,48 +782,158 @@ func (s *OpenAIGatewayService) handleStreamingResponse(ctx context.Context, resp ...@@ -775,48 +782,158 @@ func (s *OpenAIGatewayService) handleStreamingResponse(ctx context.Context, resp
usage := &OpenAIUsage{} usage := &OpenAIUsage{}
var firstTokenMs *int var firstTokenMs *int
scanner := bufio.NewScanner(resp.Body) scanner := bufio.NewScanner(resp.Body)
scanner.Buffer(make([]byte, 64*1024), 1024*1024) maxLineSize := defaultMaxLineSize
if s.cfg != nil && s.cfg.Gateway.MaxLineSize > 0 {
maxLineSize = s.cfg.Gateway.MaxLineSize
}
scanner.Buffer(make([]byte, 64*1024), maxLineSize)
type scanEvent struct {
line string
err error
}
// 独立 goroutine 读取上游，避免读取阻塞影响 keepalive/超时处理
events := make(chan scanEvent, 16)
done := make(chan struct{})
sendEvent := func(ev scanEvent) bool {
select {
case events <- ev:
return true
case <-done:
return false
}
}
var lastReadAt int64
atomic.StoreInt64(&lastReadAt, time.Now().UnixNano())
go func() {
defer close(events)
for scanner.Scan() {
atomic.StoreInt64(&lastReadAt, time.Now().UnixNano())
if !sendEvent(scanEvent{line: scanner.Text()}) {
return
}
}
if err := scanner.Err(); err != nil {
_ = sendEvent(scanEvent{err: err})
}
}()
defer close(done)
streamInterval := time.Duration(0)
if s.cfg != nil && s.cfg.Gateway.StreamDataIntervalTimeout > 0 {
streamInterval = time.Duration(s.cfg.Gateway.StreamDataIntervalTimeout) * time.Second
}
// 仅监控上游数据间隔超时，不被下游写入阻塞影响
var intervalTicker *time.Ticker
if streamInterval > 0 {
intervalTicker = time.NewTicker(streamInterval)
defer intervalTicker.Stop()
}
var intervalCh <-chan time.Time
if intervalTicker != nil {
intervalCh = intervalTicker.C
}
keepaliveInterval := time.Duration(0)
if s.cfg != nil && s.cfg.Gateway.StreamKeepaliveInterval > 0 {
keepaliveInterval = time.Duration(s.cfg.Gateway.StreamKeepaliveInterval) * time.Second
}
// 下游 keepalive 仅用于防止代理空闲断开
var keepaliveTicker *time.Ticker
if keepaliveInterval > 0 {
keepaliveTicker = time.NewTicker(keepaliveInterval)
defer keepaliveTicker.Stop()
}
var keepaliveCh <-chan time.Time
if keepaliveTicker != nil {
keepaliveCh = keepaliveTicker.C
}
// 记录上次收到上游数据的时间，用于控制 keepalive 发送频率
lastDataAt := time.Now()
// 仅发送一次错误事件，避免多次写入导致协议混乱（写失败时尽力通知客户端）
errorEventSent := false
sendErrorEvent := func(reason string) {
if errorEventSent {
return
}
errorEventSent = true
_, _ = fmt.Fprintf(w, "event: error\ndata: {\"error\":\"%s\"}\n\n", reason)
flusher.Flush()
}
needModelReplace := originalModel != mappedModel needModelReplace := originalModel != mappedModel
for scanner.Scan() { for {
line := scanner.Text() select {
case ev, ok := <-events:
if !ok {
return &openaiStreamingResult{usage: usage, firstTokenMs: firstTokenMs}, nil
}
if ev.err != nil {
if errors.Is(ev.err, bufio.ErrTooLong) {
log.Printf("SSE line too long: account=%d max_size=%d error=%v", account.ID, maxLineSize, ev.err)
sendErrorEvent("response_too_large")
return &openaiStreamingResult{usage: usage, firstTokenMs: firstTokenMs}, ev.err
}
sendErrorEvent("stream_read_error")
return &openaiStreamingResult{usage: usage, firstTokenMs: firstTokenMs}, fmt.Errorf("stream read error: %w", ev.err)
}
// Extract data from SSE line (supports both "data: " and "data:" formats) line := ev.line
if openaiSSEDataRe.MatchString(line) { lastDataAt = time.Now()
data := openaiSSEDataRe.ReplaceAllString(line, "")
// Extract data from SSE line (supports both "data: " and "data:" formats)
if openaiSSEDataRe.MatchString(line) {
data := openaiSSEDataRe.ReplaceAllString(line, "")
// Replace model in response if needed
if needModelReplace {
line = s.replaceModelInSSELine(line, mappedModel, originalModel)
}
// Replace model in response if needed // Forward line
if needModelReplace { if _, err := fmt.Fprintf(w, "%s\n", line); err != nil {
line = s.replaceModelInSSELine(line, mappedModel, originalModel) sendErrorEvent("write_failed")
return &openaiStreamingResult{usage: usage, firstTokenMs: firstTokenMs}, err
}
flusher.Flush()
// Record first token time
if firstTokenMs == nil && data != "" && data != "[DONE]" {
ms := int(time.Since(startTime).Milliseconds())
firstTokenMs = &ms
}
s.parseSSEUsage(data, usage)
} else {
// Forward non-data lines as-is
if _, err := fmt.Fprintf(w, "%s\n", line); err != nil {
sendErrorEvent("write_failed")
return &openaiStreamingResult{usage: usage, firstTokenMs: firstTokenMs}, err
}
flusher.Flush()
} }
// Forward line case <-intervalCh:
if _, err := fmt.Fprintf(w, "%s\n", line); err != nil { lastRead := time.Unix(0, atomic.LoadInt64(&lastReadAt))
return &openaiStreamingResult{usage: usage, firstTokenMs: firstTokenMs}, err if time.Since(lastRead) < streamInterval {
continue
} }
flusher.Flush() log.Printf("Stream data interval timeout: account=%d model=%s interval=%s", account.ID, originalModel, streamInterval)
sendErrorEvent("stream_timeout")
return &openaiStreamingResult{usage: usage, firstTokenMs: firstTokenMs}, fmt.Errorf("stream data interval timeout")
// Record first token time case <-keepaliveCh:
if firstTokenMs == nil && data != "" && data != "[DONE]" { if time.Since(lastDataAt) < keepaliveInterval {
ms := int(time.Since(startTime).Milliseconds()) continue
firstTokenMs = &ms
} }
s.parseSSEUsage(data, usage) if _, err := fmt.Fprint(w, ":\n\n"); err != nil {
} else {
// Forward non-data lines as-is
if _, err := fmt.Fprintf(w, "%s\n", line); err != nil {
return &openaiStreamingResult{usage: usage, firstTokenMs: firstTokenMs}, err return &openaiStreamingResult{usage: usage, firstTokenMs: firstTokenMs}, err
} }
flusher.Flush() flusher.Flush()
} }
} }
if err := scanner.Err(); err != nil {
return &openaiStreamingResult{usage: usage, firstTokenMs: firstTokenMs}, fmt.Errorf("stream read error: %w", err)
}
return &openaiStreamingResult{usage: usage, firstTokenMs: firstTokenMs}, nil
} }
func (s *OpenAIGatewayService) replaceModelInSSELine(line, fromModel, toModel string) string { func (s *OpenAIGatewayService) replaceModelInSSELine(line, fromModel, toModel string) string {
...@@ -911,18 +1028,25 @@ func (s *OpenAIGatewayService) handleNonStreamingResponse(ctx context.Context, r ...@@ -911,18 +1028,25 @@ func (s *OpenAIGatewayService) handleNonStreamingResponse(ctx context.Context, r
body = s.replaceModelInResponseBody(body, mappedModel, originalModel) body = s.replaceModelInResponseBody(body, mappedModel, originalModel)
} }
// Pass through headers responseheaders.WriteFilteredHeaders(c.Writer.Header(), resp.Header, s.cfg.Security.ResponseHeaders)
for key, values := range resp.Header {
for _, value := range values {
c.Header(key, value)
}
}
c.Data(resp.StatusCode, "application/json", body) c.Data(resp.StatusCode, "application/json", body)
return usage, nil return usage, nil
} }
func (s *OpenAIGatewayService) validateUpstreamBaseURL(raw string) (string, error) {
normalized, err := urlvalidator.ValidateHTTPSURL(raw, urlvalidator.ValidationOptions{
AllowedHosts: s.cfg.Security.URLAllowlist.UpstreamHosts,
RequireAllowlist: true,
AllowPrivate: s.cfg.Security.URLAllowlist.AllowPrivateHosts,
})
if err != nil {
return "", fmt.Errorf("invalid base_url: %w", err)
}
return normalized, nil
}
func (s *OpenAIGatewayService) replaceModelInResponseBody(body []byte, fromModel, toModel string) []byte { func (s *OpenAIGatewayService) replaceModelInResponseBody(body []byte, fromModel, toModel string) []byte {
var resp map[string]any var resp map[string]any
if err := json.Unmarshal(body, &resp); err != nil { if err := json.Unmarshal(body, &resp); err != nil {
......
backend/internal/service/openai_gateway_service_test.go 0 → 100644
View file @ 46dda583
package service
import (
"bufio"
"errors"
"io"
"net/http"
"net/http/httptest"
"strings"
"testing"
"time"
"github.com/Wei-Shaw/sub2api/internal/config"
"github.com/gin-gonic/gin"
)
func TestOpenAIStreamingTimeout(t *testing.T) {
gin.SetMode(gin.TestMode)
cfg := &config.Config{
Gateway: config.GatewayConfig{
StreamDataIntervalTimeout: 1,
StreamKeepaliveInterval: 0,
MaxLineSize: defaultMaxLineSize,
},
}
svc := &OpenAIGatewayService{cfg: cfg}
rec := httptest.NewRecorder()
c, _ := gin.CreateTestContext(rec)
c.Request = httptest.NewRequest(http.MethodPost, "/", nil)
pr, pw := io.Pipe()
resp := &http.Response{
StatusCode: http.StatusOK,
Body: pr,
Header: http.Header{},
}
start := time.Now()
_, err := svc.handleStreamingResponse(c.Request.Context(), resp, c, &Account{ID: 1}, start, "model", "model")
_ = pw.Close()
_ = pr.Close()
if err == nil || !strings.Contains(err.Error(), "stream data interval timeout") {
t.Fatalf("expected stream timeout error, got %v", err)
}
if !strings.Contains(rec.Body.String(), "stream_timeout") {
t.Fatalf("expected stream_timeout SSE error, got %q", rec.Body.String())
}
}
func TestOpenAIStreamingTooLong(t *testing.T) {
gin.SetMode(gin.TestMode)
cfg := &config.Config{
Gateway: config.GatewayConfig{
StreamDataIntervalTimeout: 0,
StreamKeepaliveInterval: 0,
MaxLineSize: 64 * 1024,
},
}
svc := &OpenAIGatewayService{cfg: cfg}
rec := httptest.NewRecorder()
c, _ := gin.CreateTestContext(rec)
c.Request = httptest.NewRequest(http.MethodPost, "/", nil)
pr, pw := io.Pipe()
resp := &http.Response{
StatusCode: http.StatusOK,
Body: pr,
Header: http.Header{},
}
go func() {
defer func() { _ = pw.Close() }()
// 写入超过 MaxLineSize 的单行数据，触发 ErrTooLong
payload := "data: " + strings.Repeat("a", 128*1024) + "\n"
_, _ = pw.Write([]byte(payload))
}()
_, err := svc.handleStreamingResponse(c.Request.Context(), resp, c, &Account{ID: 2}, time.Now(), "model", "model")
_ = pr.Close()
if !errors.Is(err, bufio.ErrTooLong) {
t.Fatalf("expected ErrTooLong, got %v", err)
}
if !strings.Contains(rec.Body.String(), "response_too_large") {
t.Fatalf("expected response_too_large SSE error, got %q", rec.Body.String())
}
}
backend/internal/service/pricing_service.go
View file @ 46dda583
...@@ -16,6 +16,7 @@ import ( ...@@ -16,6 +16,7 @@ import (
"github.com/Wei-Shaw/sub2api/internal/config" "github.com/Wei-Shaw/sub2api/internal/config"
"github.com/Wei-Shaw/sub2api/internal/pkg/openai" "github.com/Wei-Shaw/sub2api/internal/pkg/openai"
"github.com/Wei-Shaw/sub2api/internal/util/urlvalidator"
) )
var ( var (
...@@ -211,16 +212,35 @@ func (s *PricingService) syncWithRemote() error { ...@@ -211,16 +212,35 @@ func (s *PricingService) syncWithRemote() error {
// downloadPricingData 从远程下载价格数据 // downloadPricingData 从远程下载价格数据
func (s *PricingService) downloadPricingData() error { func (s *PricingService) downloadPricingData() error {
log.Printf("[Pricing] Downloading from %s", s.cfg.Pricing.RemoteURL) remoteURL, err := s.validatePricingURL(s.cfg.Pricing.RemoteURL)
if err != nil {
return err
}
log.Printf("[Pricing] Downloading from %s", remoteURL)
ctx, cancel := context.WithTimeout(context.Background(), 30*time.Second) ctx, cancel := context.WithTimeout(context.Background(), 30*time.Second)
defer cancel() defer cancel()
body, err := s.remoteClient.FetchPricingJSON(ctx, s.cfg.Pricing.RemoteURL) var expectedHash string
if strings.TrimSpace(s.cfg.Pricing.HashURL) != "" {
expectedHash, err = s.fetchRemoteHash()
if err != nil {
return fmt.Errorf("fetch remote hash: %w", err)
}
}
body, err := s.remoteClient.FetchPricingJSON(ctx, remoteURL)
if err != nil { if err != nil {
return fmt.Errorf("download failed: %w", err) return fmt.Errorf("download failed: %w", err)
} }
if expectedHash != "" {
actualHash := sha256.Sum256(body)
if !strings.EqualFold(expectedHash, hex.EncodeToString(actualHash[:])) {
return fmt.Errorf("pricing hash mismatch")
}
}
// 解析JSON数据（使用灵活的解析方式） // 解析JSON数据（使用灵活的解析方式）
data, err := s.parsePricingData(body) data, err := s.parsePricingData(body)
if err != nil { if err != nil {
...@@ -373,10 +393,31 @@ func (s *PricingService) useFallbackPricing() error { ...@@ -373,10 +393,31 @@ func (s *PricingService) useFallbackPricing() error {
// fetchRemoteHash 从远程获取哈希值 // fetchRemoteHash 从远程获取哈希值
func (s *PricingService) fetchRemoteHash() (string, error) { func (s *PricingService) fetchRemoteHash() (string, error) {
hashURL, err := s.validatePricingURL(s.cfg.Pricing.HashURL)
if err != nil {
return "", err
}
ctx, cancel := context.WithTimeout(context.Background(), 10*time.Second) ctx, cancel := context.WithTimeout(context.Background(), 10*time.Second)
defer cancel() defer cancel()
return s.remoteClient.FetchHashText(ctx, s.cfg.Pricing.HashURL) hash, err := s.remoteClient.FetchHashText(ctx, hashURL)
if err != nil {
return "", err
}
return strings.TrimSpace(hash), nil
}
func (s *PricingService) validatePricingURL(raw string) (string, error) {
normalized, err := urlvalidator.ValidateHTTPSURL(raw, urlvalidator.ValidationOptions{
AllowedHosts: s.cfg.Security.URLAllowlist.PricingHosts,
RequireAllowlist: true,
AllowPrivate: s.cfg.Security.URLAllowlist.AllowPrivateHosts,
})
if err != nil {
return "", fmt.Errorf("invalid pricing url: %w", err)
}
return normalized, nil
} }
// computeFileHash 计算文件哈希 // computeFileHash 计算文件哈希
......
backend/internal/service/setting_service.go
View file @ 46dda583
...@@ -221,21 +221,23 @@ func (s *SettingService) InitializeDefaultSettings(ctx context.Context) error { ...@@ -221,21 +221,23 @@ func (s *SettingService) InitializeDefaultSettings(ctx context.Context) error {
// parseSettings 解析设置到结构体 // parseSettings 解析设置到结构体
func (s *SettingService) parseSettings(settings map[string]string) *SystemSettings { func (s *SettingService) parseSettings(settings map[string]string) *SystemSettings {
result := &SystemSettings{ result := &SystemSettings{
RegistrationEnabled: settings[SettingKeyRegistrationEnabled] == "true", RegistrationEnabled: settings[SettingKeyRegistrationEnabled] == "true",
EmailVerifyEnabled: settings[SettingKeyEmailVerifyEnabled] == "true", EmailVerifyEnabled: settings[SettingKeyEmailVerifyEnabled] == "true",
SMTPHost: settings[SettingKeySMTPHost], SMTPHost: settings[SettingKeySMTPHost],
SMTPUsername: settings[SettingKeySMTPUsername], SMTPUsername: settings[SettingKeySMTPUsername],
SMTPFrom: settings[SettingKeySMTPFrom], SMTPFrom: settings[SettingKeySMTPFrom],
SMTPFromName: settings[SettingKeySMTPFromName], SMTPFromName: settings[SettingKeySMTPFromName],
SMTPUseTLS: settings[SettingKeySMTPUseTLS] == "true", SMTPUseTLS: settings[SettingKeySMTPUseTLS] == "true",
TurnstileEnabled: settings[SettingKeyTurnstileEnabled] == "true", SMTPPasswordConfigured: settings[SettingKeySMTPPassword] != "",
TurnstileSiteKey: settings[SettingKeyTurnstileSiteKey], TurnstileEnabled: settings[SettingKeyTurnstileEnabled] == "true",
SiteName: s.getStringOrDefault(settings, SettingKeySiteName, "Sub2API"), TurnstileSiteKey: settings[SettingKeyTurnstileSiteKey],
SiteLogo: settings[SettingKeySiteLogo], TurnstileSecretKeyConfigured: settings[SettingKeyTurnstileSecretKey] != "",
SiteSubtitle: s.getStringOrDefault(settings, SettingKeySiteSubtitle, "Subscription to API Conversion Platform"), SiteName: s.getStringOrDefault(settings, SettingKeySiteName, "Sub2API"),
APIBaseURL: settings[SettingKeyAPIBaseURL], SiteLogo: settings[SettingKeySiteLogo],
ContactInfo: settings[SettingKeyContactInfo], SiteSubtitle: s.getStringOrDefault(settings, SettingKeySiteSubtitle, "Subscription to API Conversion Platform"),
DocURL: settings[SettingKeyDocURL], APIBaseURL: settings[SettingKeyAPIBaseURL],
ContactInfo: settings[SettingKeyContactInfo],
DocURL: settings[SettingKeyDocURL],
} }
// 解析整数类型 // 解析整数类型
......
backend/internal/service/settings_view.go
View file @ 46dda583
...@@ -4,17 +4,19 @@ type SystemSettings struct { ...@@ -4,17 +4,19 @@ type SystemSettings struct {
RegistrationEnabled bool RegistrationEnabled bool
EmailVerifyEnabled bool EmailVerifyEnabled bool
SMTPHost string SMTPHost string
SMTPPort int SMTPPort int
SMTPUsername string SMTPUsername string
SMTPPassword string SMTPPassword string
SMTPFrom string SMTPPasswordConfigured bool
SMTPFromName string SMTPFrom string
SMTPUseTLS bool SMTPFromName string
SMTPUseTLS bool
TurnstileEnabled bool TurnstileEnabled bool
TurnstileSiteKey string TurnstileSiteKey string
TurnstileSecretKey string TurnstileSecretKey string
TurnstileSecretKeyConfigured bool
SiteName string SiteName string
SiteLogo string SiteLogo string
......
backend/internal/setup/setup.go
View file @ 46dda583
...@@ -9,6 +9,7 @@ import ( ...@@ -9,6 +9,7 @@ import (
"log" "log"
"os" "os"
"strconv" "strconv"
"strings"
"time" "time"
"github.com/Wei-Shaw/sub2api/internal/repository" "github.com/Wei-Shaw/sub2api/internal/repository"
...@@ -196,11 +197,17 @@ func Install(cfg *SetupConfig) error { ...@@ -196,11 +197,17 @@ func Install(cfg *SetupConfig) error {
// Generate JWT secret if not provided // Generate JWT secret if not provided
if cfg.JWT.Secret == "" { if cfg.JWT.Secret == "" {
if strings.EqualFold(cfg.Server.Mode, "release") {
return fmt.Errorf("jwt secret is required in release mode")
}
secret, err := generateSecret(32) secret, err := generateSecret(32)
if err != nil { if err != nil {
return fmt.Errorf("failed to generate jwt secret: %w", err) return fmt.Errorf("failed to generate jwt secret: %w", err)
} }
cfg.JWT.Secret = secret cfg.JWT.Secret = secret
log.Println("Warning: JWT secret auto-generated for non-release mode. Do not use in production.")
} else if strings.EqualFold(cfg.Server.Mode, "release") && len(cfg.JWT.Secret) < 32 {
return fmt.Errorf("jwt secret must be at least 32 characters in release mode")
} }
// Test connections // Test connections
...@@ -474,12 +481,17 @@ func AutoSetupFromEnv() error { ...@@ -474,12 +481,17 @@ func AutoSetupFromEnv() error {
// Generate JWT secret if not provided // Generate JWT secret if not provided
if cfg.JWT.Secret == "" { if cfg.JWT.Secret == "" {
if strings.EqualFold(cfg.Server.Mode, "release") {
return fmt.Errorf("jwt secret is required in release mode")
}
secret, err := generateSecret(32) secret, err := generateSecret(32)
if err != nil { if err != nil {
return fmt.Errorf("failed to generate jwt secret: %w", err) return fmt.Errorf("failed to generate jwt secret: %w", err)
} }
cfg.JWT.Secret = secret cfg.JWT.Secret = secret
log.Println("Generated JWT secret automatically") log.Println("Warning: JWT secret auto-generated for non-release mode. Do not use in production.")
} else if strings.EqualFold(cfg.Server.Mode, "release") && len(cfg.JWT.Secret) < 32 {
return fmt.Errorf("jwt secret must be at least 32 characters in release mode")
} }
// Generate admin password if not provided // Generate admin password if not provided
...@@ -489,8 +501,8 @@ func AutoSetupFromEnv() error { ...@@ -489,8 +501,8 @@ func AutoSetupFromEnv() error {
return fmt.Errorf("failed to generate admin password: %w", err) return fmt.Errorf("failed to generate admin password: %w", err)
} }
cfg.Admin.Password = password cfg.Admin.Password = password
log.Printf("Generated admin password: %s", cfg.Admin.Password) fmt.Printf("Generated admin password (one-time): %s\n", cfg.Admin.Password)
log.Println("IMPORTANT: Save this password! It will not be shown again.") fmt.Println("IMPORTANT: Save this password! It will not be shown again.")
} }
// Test database connection // Test database connection
......
backend/internal/util/logredact/redact.go 0 → 100644
View file @ 46dda583
package logredact
import (
"encoding/json"
"strings"
)
// maxRedactDepth 限制递归深度以防止栈溢出
const maxRedactDepth = 32
var defaultSensitiveKeys = map[string]struct{}{
"authorization_code": {},
"code": {},
"code_verifier": {},
"access_token": {},
"refresh_token": {},
"id_token": {},
"client_secret": {},
"password": {},
}
func RedactMap(input map[string]any, extraKeys ...string) map[string]any {
if input == nil {
return map[string]any{}
}
keys := buildKeySet(extraKeys)
redacted, ok := redactValueWithDepth(input, keys, 0).(map[string]any)
if !ok {
return map[string]any{}
}
return redacted
}
func RedactJSON(raw []byte, extraKeys ...string) string {
if len(raw) == 0 {
return ""
}
var value any
if err := json.Unmarshal(raw, &value); err != nil {
return "<non-json payload redacted>"
}
keys := buildKeySet(extraKeys)
redacted := redactValueWithDepth(value, keys, 0)
encoded, err := json.Marshal(redacted)
if err != nil {
return "<redacted>"
}
return string(encoded)
}
func buildKeySet(extraKeys []string) map[string]struct{} {
keys := make(map[string]struct{}, len(defaultSensitiveKeys)+len(extraKeys))
for k := range defaultSensitiveKeys {
keys[k] = struct{}{}
}
for _, key := range extraKeys {
normalized := normalizeKey(key)
if normalized == "" {
continue
}
keys[normalized] = struct{}{}
}
return keys
}
func redactValueWithDepth(value any, keys map[string]struct{}, depth int) any {
if depth > maxRedactDepth {
return "<depth limit exceeded>"
}
switch v := value.(type) {
case map[string]any:
out := make(map[string]any, len(v))
for k, val := range v {
if isSensitiveKey(k, keys) {
out[k] = "***"
continue
}
out[k] = redactValueWithDepth(val, keys, depth+1)
}
return out
case []any:
out := make([]any, len(v))
for i, item := range v {
out[i] = redactValueWithDepth(item, keys, depth+1)
}
return out
default:
return value
}
}
func isSensitiveKey(key string, keys map[string]struct{}) bool {
_, ok := keys[normalizeKey(key)]
return ok
}
func normalizeKey(key string) string {
return strings.ToLower(strings.TrimSpace(key))
}
backend/internal/util/responseheaders/responseheaders.go 0 → 100644
View file @ 46dda583
package responseheaders
import (
"net/http"
"strings"
"github.com/Wei-Shaw/sub2api/internal/config"
)
// defaultAllowed 定义允许透传的响应头白名单
// 注意：以下头部由 Go HTTP 包自动处理，不应手动设置：
// - content-length: 由 ResponseWriter 根据实际写入数据自动设置
// - transfer-encoding: 由 HTTP 库根据需要自动添加/移除
// - connection: 由 HTTP 库管理连接复用
var defaultAllowed = map[string]struct{}{
"content-type": {},
"content-encoding": {},
"content-language": {},
"cache-control": {},
"etag": {},
"last-modified": {},
"expires": {},
"vary": {},
"date": {},
"x-request-id": {},
"x-ratelimit-limit-requests": {},
"x-ratelimit-limit-tokens": {},
"x-ratelimit-remaining-requests": {},
"x-ratelimit-remaining-tokens": {},
"x-ratelimit-reset-requests": {},
"x-ratelimit-reset-tokens": {},
"retry-after": {},
"location": {},
"www-authenticate": {},
}
// hopByHopHeaders 是跳过的 hop-by-hop 头部，这些头部由 HTTP 库自动处理
var hopByHopHeaders = map[string]struct{}{
"content-length": {},
"transfer-encoding": {},
"connection": {},
}
func FilterHeaders(src http.Header, cfg config.ResponseHeaderConfig) http.Header {
allowed := make(map[string]struct{}, len(defaultAllowed)+len(cfg.AdditionalAllowed))
for key := range defaultAllowed {
allowed[key] = struct{}{}
}
for _, key := range cfg.AdditionalAllowed {
normalized := strings.ToLower(strings.TrimSpace(key))
if normalized == "" {
continue
}
allowed[normalized] = struct{}{}
}
forceRemove := make(map[string]struct{}, len(cfg.ForceRemove))
for _, key := range cfg.ForceRemove {
normalized := strings.ToLower(strings.TrimSpace(key))
if normalized == "" {
continue
}
forceRemove[normalized] = struct{}{}
}
filtered := make(http.Header, len(src))
for key, values := range src {
lower := strings.ToLower(key)
if _, blocked := forceRemove[lower]; blocked {
continue
}
if _, ok := allowed[lower]; !ok {
continue
}
// 跳过 hop-by-hop 头部，这些由 HTTP 库自动处理
if _, isHopByHop := hopByHopHeaders[lower]; isHopByHop {
continue
}
for _, value := range values {
filtered.Add(key, value)
}
}
return filtered
}
func WriteFilteredHeaders(dst http.Header, src http.Header, cfg config.ResponseHeaderConfig) {
filtered := FilterHeaders(src, cfg)
for key, values := range filtered {
for _, value := range values {
dst.Add(key, value)
}
}
}
backend/internal/util/urlvalidator/validator.go 0 → 100644
View file @ 46dda583
package urlvalidator
import (
"context"
"errors"
"fmt"
"net"
"net/url"
"strings"
"time"
)
type ValidationOptions struct {
AllowedHosts []string
RequireAllowlist bool
AllowPrivate bool
}
func ValidateHTTPSURL(raw string, opts ValidationOptions) (string, error) {
trimmed := strings.TrimSpace(raw)
if trimmed == "" {
return "", errors.New("url is required")
}
parsed, err := url.Parse(trimmed)
if err != nil || parsed.Scheme == "" || parsed.Host == "" {
return "", fmt.Errorf("invalid url: %s", trimmed)
}
if !strings.EqualFold(parsed.Scheme, "https") {
return "", fmt.Errorf("invalid url scheme: %s", parsed.Scheme)
}
host := strings.ToLower(strings.TrimSpace(parsed.Hostname()))
if host == "" {
return "", errors.New("invalid host")
}
if !opts.AllowPrivate && isBlockedHost(host) {
return "", fmt.Errorf("host is not allowed: %s", host)
}
allowlist := normalizeAllowlist(opts.AllowedHosts)
if opts.RequireAllowlist && len(allowlist) == 0 {
return "", errors.New("allowlist is not configured")
}
if len(allowlist) > 0 && !isAllowedHost(host, allowlist) {
return "", fmt.Errorf("host is not allowed: %s", host)
}
parsed.Path = strings.TrimRight(parsed.Path, "/")
parsed.RawPath = ""
return strings.TrimRight(parsed.String(), "/"), nil
}
// ValidateResolvedIP 验证 DNS 解析后的 IP 地址是否安全
// 用于防止 DNS Rebinding 攻击：在实际 HTTP 请求时调用此函数验证解析后的 IP
func ValidateResolvedIP(host string) error {
ctx, cancel := context.WithTimeout(context.Background(), 5*time.Second)
defer cancel()
ips, err := net.DefaultResolver.LookupIP(ctx, "ip", host)
if err != nil {
return fmt.Errorf("dns resolution failed: %w", err)
}
for _, ip := range ips {
if ip.IsLoopback() || ip.IsPrivate() || ip.IsLinkLocalUnicast() ||
ip.IsLinkLocalMulticast() || ip.IsUnspecified() {
return fmt.Errorf("resolved ip %s is not allowed", ip.String())
}
}
return nil
}
func normalizeAllowlist(values []string) []string {
if len(values) == 0 {
return nil
}
normalized := make([]string, 0, len(values))
for _, v := range values {
entry := strings.ToLower(strings.TrimSpace(v))
if entry == "" {
continue
}
if host, _, err := net.SplitHostPort(entry); err == nil {
entry = host
}
normalized = append(normalized, entry)
}
return normalized
}
func isAllowedHost(host string, allowlist []string) bool {
for _, entry := range allowlist {
if entry == "" {
continue
}
if strings.HasPrefix(entry, "*.") {
suffix := strings.TrimPrefix(entry, "*.")
if host == suffix || strings.HasSuffix(host, "."+suffix) {
return true
}
continue
}
if host == entry {
return true
}
}
return false
}
func isBlockedHost(host string) bool {
if host == "localhost" || strings.HasSuffix(host, ".localhost") {
return true
}
if ip := net.ParseIP(host); ip != nil {
if ip.IsLoopback() || ip.IsPrivate() || ip.IsLinkLocalUnicast() || ip.IsLinkLocalMulticast() || ip.IsUnspecified() {
return true
}
}
return false
}
deploy/Caddyfile
View file @ 46dda583
...@@ -25,8 +25,8 @@ ...@@ -25,8 +25,8 @@
timeouts { timeouts {
read_body 30s read_body 30s
read_header 10s read_header 10s
write 60s write 300s
idle 120s idle 300s
} }
} }
} }
...@@ -77,7 +77,10 @@ example.com { ...@@ -77,7 +77,10 @@ example.com {
write_buffer 16KB write_buffer 16KB
compression off compression off
} }
# SSE/流式传输优化：禁用响应缓冲，立即刷新数据给客户端
flush_interval -1
# 故障转移 # 故障转移
fail_duration 30s fail_duration 30s
max_fails 3 max_fails 3
...@@ -92,6 +95,10 @@ example.com { ...@@ -92,6 +95,10 @@ example.com {
gzip 6 gzip 6
minimum_length 256 minimum_length 256
match { match {
# SSE 请求通常会带 Accept: text/event-stream，需排除压缩
not header Accept text/event-stream*
# 排除已知 SSE 路径（即便 Accept 缺失）
not path /v1/messages /v1/responses /responses /antigravity/v1/messages /v1beta/models/* /antigravity/v1beta/models/*
header Content-Type text/* header Content-Type text/*
header Content-Type application/json* header Content-Type application/json*
header Content-Type application/javascript* header Content-Type application/javascript*
...@@ -179,6 +186,3 @@ example.com { ...@@ -179,6 +186,3 @@ example.com {
# ============================================================================= # =============================================================================
# HTTP 重定向到 HTTPS (Caddy 默认自动处理，此处显式声明) # HTTP 重定向到 HTTPS (Caddy 默认自动处理，此处显式声明)
# ============================================================================= # =============================================================================
; http://example.com {
; redir https://{host}{uri} permanent
; }
deploy/config.example.yaml
View file @ 46dda583
...@@ -12,6 +12,8 @@ server: ...@@ -12,6 +12,8 @@ server:
port: 8080 port: 8080
# Mode: "debug" for development, "release" for production # Mode: "debug" for development, "release" for production
mode: "release" mode: "release"
# Trusted proxies for X-Forwarded-For parsing (CIDR/IP). Empty disables trusted proxies.
trusted_proxies: []
# ============================================================================= # =============================================================================
# Run Mode Configuration # Run Mode Configuration
...@@ -21,12 +23,54 @@ server: ...@@ -21,12 +23,54 @@ server:
# - simple: Hides SaaS features and skips billing/balance checks # - simple: Hides SaaS features and skips billing/balance checks
run_mode: "standard" run_mode: "standard"
# =============================================================================
# CORS Configuration
# =============================================================================
cors:
# Allowed origins list. Leave empty to disable cross-origin requests.
allowed_origins: []
# Allow credentials (cookies/authorization headers). Cannot be used with "*".
allow_credentials: true
# =============================================================================
# Security Configuration
# =============================================================================
security:
url_allowlist:
# Allowed upstream hosts for API proxying
upstream_hosts:
- "api.openai.com"
- "api.anthropic.com"
- "generativelanguage.googleapis.com"
- "cloudcode-pa.googleapis.com"
- "*.openai.azure.com"
# Allowed hosts for pricing data download
pricing_hosts:
- "raw.githubusercontent.com"
# Allowed hosts for CRS sync (required when using CRS sync)
crs_hosts: []
# Allow localhost/private IPs for upstream/pricing/CRS (use only in trusted networks)
allow_private_hosts: false
response_headers:
# Extra allowed response headers from upstream
additional_allowed: []
# Force-remove response headers from upstream
force_remove: []
csp:
# Enable Content-Security-Policy header
enabled: true
# Default CSP policy (override if you host assets on other domains)
policy: "default-src 'self'; script-src 'self'; style-src 'self' 'unsafe-inline'; img-src 'self' data: https:; font-src 'self' data:; connect-src 'self' https:; frame-ancestors 'none'; base-uri 'self'; form-action 'self'"
proxy_probe:
# Allow skipping TLS verification for proxy probe (debug only)
insecure_skip_verify: false
# ============================================================================= # =============================================================================
# 网关配置 # 网关配置
# ============================================================================= # =============================================================================
gateway: gateway:
# 等待上游响应头超时时间（秒） # 等待上游响应头超时时间（秒）
response_header_timeout: 300 response_header_timeout: 600
# 请求体最大字节数（默认 100MB） # 请求体最大字节数（默认 100MB）
max_body_size: 104857600 max_body_size: 104857600
# 连接池隔离策略： # 连接池隔离策略：
...@@ -38,14 +82,35 @@ gateway: ...@@ -38,14 +82,35 @@ gateway:
max_idle_conns: 240 max_idle_conns: 240
max_idle_conns_per_host: 120 max_idle_conns_per_host: 120
max_conns_per_host: 240 max_conns_per_host: 240
idle_conn_timeout_seconds: 300 idle_conn_timeout_seconds: 90
# 上游连接池客户端缓存配置 # 上游连接池客户端缓存配置
# max_upstream_clients: 最大缓存客户端数量，超出后淘汰最久未使用的 # max_upstream_clients: 最大缓存客户端数量，超出后淘汰最久未使用的
# client_idle_ttl_seconds: 客户端空闲回收阈值（秒），超时且无活跃请求时回收 # client_idle_ttl_seconds: 客户端空闲回收阈值（秒），超时且无活跃请求时回收
max_upstream_clients: 5000 max_upstream_clients: 5000
client_idle_ttl_seconds: 900 client_idle_ttl_seconds: 900
# 并发槽位过期时间（分钟） # 并发槽位过期时间（分钟）
concurrency_slot_ttl_minutes: 15 concurrency_slot_ttl_minutes: 30
# 流数据间隔超时（秒），0=禁用
stream_data_interval_timeout: 180
# 流式 keepalive 间隔（秒），0=禁用
stream_keepalive_interval: 10
# SSE 单行最大字节数（默认 10MB）
max_line_size: 10485760
# Log upstream error response body summary (safe/truncated; does not log request content)
log_upstream_error_body: false
# Max bytes to log from upstream error body
log_upstream_error_body_max_bytes: 2048
# Auto inject anthropic-beta for API-key accounts when needed (default off)
inject_beta_for_apikey: false
# Allow failover on selected 400 errors (default off)
failover_on_400: false
# =============================================================================
# 并发等待配置
# =============================================================================
concurrency:
# 并发等待期间的 SSE ping 间隔（秒）
ping_interval: 10
# ============================================================================= # =============================================================================
# Database Configuration (PostgreSQL) # Database Configuration (PostgreSQL)
...@@ -77,7 +142,7 @@ jwt: ...@@ -77,7 +142,7 @@ jwt:
# IMPORTANT: Change this to a random string in production! # IMPORTANT: Change this to a random string in production!
# Generate with: openssl rand -hex 32 # Generate with: openssl rand -hex 32
secret: "change-this-to-a-secure-random-string" secret: "change-this-to-a-secure-random-string"
# Token expiration time in hours # Token expiration time in hours (max 24)
expire_hour: 24 expire_hour: 24
# ============================================================================= # =============================================================================
...@@ -123,19 +188,21 @@ pricing: ...@@ -123,19 +188,21 @@ pricing:
hash_check_interval_minutes: 10 hash_check_interval_minutes: 10
# ============================================================================= # =============================================================================
# Gateway (Optional) # Billing Configuration
# ============================================================================= # =============================================================================
gateway: billing:
# Wait time (in seconds) for upstream response headers (streaming body not affected) circuit_breaker:
response_header_timeout: 300 enabled: true
# Log upstream error response body summary (safe/truncated; does not log request content) failure_threshold: 5
log_upstream_error_body: false reset_timeout_seconds: 30
# Max bytes to log from upstream error body half_open_requests: 3
log_upstream_error_body_max_bytes: 2048
# Auto inject anthropic-beta for API-key accounts when needed (default off) # =============================================================================
inject_beta_for_apikey: false # Turnstile Configuration
# Allow failover on selected 400 errors (default off) # =============================================================================
failover_on_400: false turnstile:
# Require Turnstile in release mode (when enabled, login/register will fail if not configured)
required: false
# ============================================================================= # =============================================================================
# Gemini OAuth (Required for Gemini accounts) # Gemini OAuth (Required for Gemini accounts)
......
frontend/src/api/admin/settings.ts
View file @ 46dda583
...@@ -26,14 +26,37 @@ export interface SystemSettings { ...@@ -26,14 +26,37 @@ export interface SystemSettings {
smtp_host: string smtp_host: string
smtp_port: number smtp_port: number
smtp_username: string smtp_username: string
smtp_password: string smtp_password_configured: boolean
smtp_from_email: string smtp_from_email: string
smtp_from_name: string smtp_from_name: string
smtp_use_tls: boolean smtp_use_tls: boolean
// Cloudflare Turnstile settings // Cloudflare Turnstile settings
turnstile_enabled: boolean turnstile_enabled: boolean
turnstile_site_key: string turnstile_site_key: string
turnstile_secret_key: string turnstile_secret_key_configured: boolean
}
export interface UpdateSettingsRequest {
registration_enabled?: boolean
email_verify_enabled?: boolean
default_balance?: number
default_concurrency?: number
site_name?: string
site_logo?: string
site_subtitle?: string
api_base_url?: string
contact_info?: string
doc_url?: string
smtp_host?: string
smtp_port?: number
smtp_username?: string
smtp_password?: string
smtp_from_email?: string
smtp_from_name?: string
smtp_use_tls?: boolean
turnstile_enabled?: boolean
turnstile_site_key?: string
turnstile_secret_key?: string
} }
/** /**
...@@ -50,7 +73,7 @@ export async function getSettings(): Promise<SystemSettings> { ...@@ -50,7 +73,7 @@ export async function getSettings(): Promise<SystemSettings> {
* @param settings - Partial settings to update * @param settings - Partial settings to update
* @returns Updated settings * @returns Updated settings
*/ */
export async function updateSettings(settings: Partial<SystemSettings>): Promise<SystemSettings> { export async function updateSettings(settings: UpdateSettingsRequest): Promise<SystemSettings> {
const { data } = await apiClient.put<SystemSettings>('/admin/settings', settings) const { data } = await apiClient.put<SystemSettings>('/admin/settings', settings)
return data return data
} }
......
frontend/src/api/client.ts
View file @ 46dda583
...@@ -62,8 +62,24 @@ apiClient.interceptors.response.use( ...@@ -62,8 +62,24 @@ apiClient.interceptors.response.use(
// 401: Unauthorized - clear token and redirect to login // 401: Unauthorized - clear token and redirect to login
if (status === 401) { if (status === 401) {
const hasToken = !!localStorage.getItem('auth_token')
const url = error.config?.url || ''
const isAuthEndpoint =
url.includes('/auth/login') || url.includes('/auth/register') || url.includes('/auth/refresh')
const headers = error.config?.headers as Record<string, unknown> | undefined
const authHeader = headers?.Authorization ?? headers?.authorization
const sentAuth =
typeof authHeader === 'string'
? authHeader.trim() !== ''
: Array.isArray(authHeader)
? authHeader.length > 0
: !!authHeader
localStorage.removeItem('auth_token') localStorage.removeItem('auth_token')
localStorage.removeItem('auth_user') localStorage.removeItem('auth_user')
if ((hasToken || sentAuth) && !isAuthEndpoint) {
sessionStorage.setItem('auth_expired', '1')
}
// Only redirect if not already on login page // Only redirect if not already on login page
if (!window.location.pathname.includes('/login')) { if (!window.location.pathname.includes('/login')) {
window.location.href = '/login' window.location.href = '/login'
......
frontend/src/components/account/OAuthAuthorizationFlow.vue
View file @ 46dda583
...@@ -136,16 +136,16 @@ ...@@ -136,16 +136,16 @@
<ol <ol
class="list-inside list-decimal space-y-1 text-xs text-amber-700 dark:text-amber-300" class="list-inside list-decimal space-y-1 text-xs text-amber-700 dark:text-amber-300"
> >
<li v-html="t('admin.accounts.oauth.step1')"></li> <li>{{ t('admin.accounts.oauth.step1') }}</li>
<li v-html="t('admin.accounts.oauth.step2')"></li> <li>{{ t('admin.accounts.oauth.step2') }}</li>
<li v-html="t('admin.accounts.oauth.step3')"></li> <li>{{ t('admin.accounts.oauth.step3') }}</li>
<li v-html="t('admin.accounts.oauth.step4')"></li> <li>{{ t('admin.accounts.oauth.step4') }}</li>
<li v-html="t('admin.accounts.oauth.step5')"></li> <li>{{ t('admin.accounts.oauth.step5') }}</li>
<li v-html="t('admin.accounts.oauth.step6')"></li> <li>{{ t('admin.accounts.oauth.step6') }}</li>
</ol> </ol>
<p <p
class="mt-2 text-xs text-amber-600 dark:text-amber-400" class="mt-2 text-xs text-amber-600 dark:text-amber-400"
v-html="t('admin.accounts.oauth.sessionKeyFormat')" v-text="t('admin.accounts.oauth.sessionKeyFormat')"
></p> ></p>
</div> </div>
...@@ -390,7 +390,7 @@ ...@@ -390,7 +390,7 @@
> >
<p <p
class="text-xs text-amber-800 dark:text-amber-300" class="text-xs text-amber-800 dark:text-amber-300"
v-html="oauthImportantNotice" v-text="oauthImportantNotice"
></p> ></p>
</div> </div>
<!-- Proxy Warning (for non-OpenAI) --> <!-- Proxy Warning (for non-OpenAI) -->
...@@ -400,7 +400,7 @@ ...@@ -400,7 +400,7 @@
> >
<p <p
class="text-xs text-yellow-800 dark:text-yellow-300" class="text-xs text-yellow-800 dark:text-yellow-300"
v-html="t('admin.accounts.oauth.proxyWarning')" v-text="t('admin.accounts.oauth.proxyWarning')"
></p> ></p>
</div> </div>
</div> </div>
...@@ -423,7 +423,7 @@ ...@@ -423,7 +423,7 @@
</p> </p>
<p <p
class="mb-3 text-sm text-blue-700 dark:text-blue-300" class="mb-3 text-sm text-blue-700 dark:text-blue-300"
v-html="oauthAuthCodeDesc" v-text="oauthAuthCodeDesc"
></p> ></p>
<div> <div>
<label class="input-label"> <label class="input-label">
......
frontend/src/components/keys/UseKeyModal.vue
View file @ 46dda583
...@@ -107,7 +107,10 @@ ...@@ -107,7 +107,10 @@
</button> </button>
</div> </div>
<!-- Code Content --> <!-- Code Content -->
<pre class="p-4 text-sm font-mono text-gray-100 overflow-x-auto"><code v-html="file.highlighted"></code></pre> <pre class="p-4 text-sm font-mono text-gray-100 overflow-x-auto">
<code v-if="file.highlighted" v-html="file.highlighted"></code>
<code v-else v-text="file.content"></code>
</pre>
</div> </div>
</div> </div>
</div> </div>
...@@ -164,8 +167,8 @@ interface TabConfig { ...@@ -164,8 +167,8 @@ interface TabConfig {
interface FileConfig { interface FileConfig {
path: string path: string
content: string content: string
highlighted: string
hint?: string // Optional hint message for this file hint?: string // Optional hint message for this file
highlighted?: string
} }
const props = defineProps<Props>() const props = defineProps<Props>()
...@@ -311,14 +314,23 @@ const platformNote = computed(() => { ...@@ -311,14 +314,23 @@ const platformNote = computed(() => {
} }
}) })
// Syntax highlighting helpers const escapeHtml = (value: string) => value
const keyword = (text: string) => `<span class="text-purple-400">${text}</span>` .replace(/&/g, '&amp;')
const variable = (text: string) => `<span class="text-cyan-400">${text}</span>` .replace(/</g, '&lt;')
const string = (text: string) => `<span class="text-green-400">${text}</span>` .replace(/>/g, '&gt;')
const operator = (text: string) => `<span class="text-yellow-400">${text}</span>` .replace(/"/g, '&quot;')
const comment = (text: string) => `<span class="text-gray-500">${text}</span>` .replace(/'/g, '&#39;')
const key = (text: string) => `<span class="text-blue-400">${text}</span>`
const wrapToken = (className: string, value: string) =>
`<span class="${className}">${escapeHtml(value)}</span>`
const keyword = (value: string) => wrapToken('text-emerald-300', value)
const variable = (value: string) => wrapToken('text-sky-200', value)
const operator = (value: string) => wrapToken('text-slate-400', value)
const string = (value: string) => wrapToken('text-amber-200', value)
const comment = (value: string) => wrapToken('text-slate-500', value)
// Syntax highlighting helpers
// Generate file configs based on platform and active tab // Generate file configs based on platform and active tab
const currentFiles = computed((): FileConfig[] => { const currentFiles = computed((): FileConfig[] => {
const baseUrl = props.baseUrl || window.location.origin const baseUrl = props.baseUrl || window.location.origin
...@@ -343,37 +355,29 @@ const currentFiles = computed((): FileConfig[] => { ...@@ -343,37 +355,29 @@ const currentFiles = computed((): FileConfig[] => {
function generateAnthropicFiles(baseUrl: string, apiKey: string): FileConfig[] { function generateAnthropicFiles(baseUrl: string, apiKey: string): FileConfig[] {
let path: string let path: string
let content: string let content: string
let highlighted: string
switch (activeTab.value) { switch (activeTab.value) {
case 'unix': case 'unix':
path = 'Terminal' path = 'Terminal'
content = `export ANTHROPIC_BASE_URL="${baseUrl}" content = `export ANTHROPIC_BASE_URL="${baseUrl}"
export ANTHROPIC_AUTH_TOKEN="${apiKey}"` export ANTHROPIC_AUTH_TOKEN="${apiKey}"`
highlighted = `${keyword('export')} ${variable('ANTHROPIC_BASE_URL')}${operator('=')}${string(`"${baseUrl}"`)}
${keyword('export')} ${variable('ANTHROPIC_AUTH_TOKEN')}${operator('=')}${string(`"${apiKey}"`)}`
break break
case 'cmd': case 'cmd':
path = 'Command Prompt' path = 'Command Prompt'
content = `set ANTHROPIC_BASE_URL=${baseUrl} content = `set ANTHROPIC_BASE_URL=${baseUrl}
set ANTHROPIC_AUTH_TOKEN=${apiKey}` set ANTHROPIC_AUTH_TOKEN=${apiKey}`
highlighted = `${keyword('set')} ${variable('ANTHROPIC_BASE_URL')}${operator('=')}${baseUrl}
${keyword('set')} ${variable('ANTHROPIC_AUTH_TOKEN')}${operator('=')}${apiKey}`
break break
case 'powershell': case 'powershell':
path = 'PowerShell' path = 'PowerShell'
content = `$env:ANTHROPIC_BASE_URL="${baseUrl}" content = `$env:ANTHROPIC_BASE_URL="${baseUrl}"
$env:ANTHROPIC_AUTH_TOKEN="${apiKey}"` $env:ANTHROPIC_AUTH_TOKEN="${apiKey}"`
highlighted = `${keyword('$env:')}${variable('ANTHROPIC_BASE_URL')}${operator('=')}${string(`"${baseUrl}"`)}
${keyword('$env:')}${variable('ANTHROPIC_AUTH_TOKEN')}${operator('=')}${string(`"${apiKey}"`)}`
break break
default: default:
path = 'Terminal' path = 'Terminal'
content = '' content = ''
highlighted = ''
} }
return [{ path, content, highlighted }] return [{ path, content }]
} }
function generateGeminiCliContent(baseUrl: string, apiKey: string): FileConfig { function generateGeminiCliContent(baseUrl: string, apiKey: string): FileConfig {
...@@ -398,9 +402,9 @@ ${keyword('export')} ${variable('GEMINI_MODEL')}${operator('=')}${string(`"${mod ...@@ -398,9 +402,9 @@ ${keyword('export')} ${variable('GEMINI_MODEL')}${operator('=')}${string(`"${mod
content = `set GOOGLE_GEMINI_BASE_URL=${baseUrl} content = `set GOOGLE_GEMINI_BASE_URL=${baseUrl}
set GEMINI_API_KEY=${apiKey} set GEMINI_API_KEY=${apiKey}
set GEMINI_MODEL=${model}` set GEMINI_MODEL=${model}`
highlighted = `${keyword('set')} ${variable('GOOGLE_GEMINI_BASE_URL')}${operator('=')}${baseUrl} highlighted = `${keyword('set')} ${variable('GOOGLE_GEMINI_BASE_URL')}${operator('=')}${string(baseUrl)}
${keyword('set')} ${variable('GEMINI_API_KEY')}${operator('=')}${apiKey} ${keyword('set')} ${variable('GEMINI_API_KEY')}${operator('=')}${string(apiKey)}
${keyword('set')} ${variable('GEMINI_MODEL')}${operator('=')}${model} ${keyword('set')} ${variable('GEMINI_MODEL')}${operator('=')}${string(model)}
${comment(`REM ${modelComment}`)}` ${comment(`REM ${modelComment}`)}`
break break
case 'powershell': case 'powershell':
...@@ -440,40 +444,20 @@ base_url = "${baseUrl}" ...@@ -440,40 +444,20 @@ base_url = "${baseUrl}"
wire_api = "responses" wire_api = "responses"
requires_openai_auth = true` requires_openai_auth = true`
const configHighlighted = `${key('model_provider')} ${operator('=')} ${string('"sub2api"')}
${key('model')} ${operator('=')} ${string('"gpt-5.2-codex"')}
${key('model_reasoning_effort')} ${operator('=')} ${string('"high"')}
${key('network_access')} ${operator('=')} ${string('"enabled"')}
${key('disable_response_storage')} ${operator('=')} ${keyword('true')}
${key('windows_wsl_setup_acknowledged')} ${operator('=')} ${keyword('true')}
${key('model_verbosity')} ${operator('=')} ${string('"high"')}
${comment('[model_providers.sub2api]')}
${key('name')} ${operator('=')} ${string('"sub2api"')}
${key('base_url')} ${operator('=')} ${string(`"${baseUrl}"`)}
${key('wire_api')} ${operator('=')} ${string('"responses"')}
${key('requires_openai_auth')} ${operator('=')} ${keyword('true')}`
// auth.json content // auth.json content
const authContent = `{ const authContent = `{
"OPENAI_API_KEY": "${apiKey}" "OPENAI_API_KEY": "${apiKey}"
}` }`
const authHighlighted = `{
${key('"OPENAI_API_KEY"')}: ${string(`"${apiKey}"`)}
}`
return [ return [
{ {
path: `${configDir}/config.toml`, path: `${configDir}/config.toml`,
content: configContent, content: configContent,
highlighted: configHighlighted,
hint: t('keys.useKeyModal.openai.configTomlHint') hint: t('keys.useKeyModal.openai.configTomlHint')
}, },
{ {
path: `${configDir}/auth.json`, path: `${configDir}/auth.json`,
content: authContent, content: authContent
highlighted: authHighlighted
} }
] ]
} }
......
frontend/src/components/layout/AuthLayout.vue
View file @ 46dda583
...@@ -63,6 +63,7 @@ ...@@ -63,6 +63,7 @@
<script setup lang="ts"> <script setup lang="ts">
import { ref, computed, onMounted } from 'vue' import { ref, computed, onMounted } from 'vue'
import { getPublicSettings } from '@/api/auth' import { getPublicSettings } from '@/api/auth'
import { sanitizeUrl } from '@/utils/url'
const siteName = ref('Sub2API') const siteName = ref('Sub2API')
const siteLogo = ref('') const siteLogo = ref('')
...@@ -74,7 +75,7 @@ onMounted(async () => { ...@@ -74,7 +75,7 @@ onMounted(async () => {
try { try {
const settings = await getPublicSettings() const settings = await getPublicSettings()
siteName.value = settings.site_name || 'Sub2API' siteName.value = settings.site_name || 'Sub2API'
siteLogo.value = settings.site_logo || '' siteLogo.value = sanitizeUrl(settings.site_logo || '', { allowRelative: true })
siteSubtitle.value = settings.site_subtitle || 'Subscription to API Conversion Platform' siteSubtitle.value = settings.site_subtitle || 'Subscription to API Conversion Platform'
} catch (error) { } catch (error) {
console.error('Failed to load public settings:', error) console.error('Failed to load public settings:', error)
......
frontend/src/i18n/locales/en.ts
View file @ 46dda583
...@@ -200,6 +200,7 @@ export default { ...@@ -200,6 +200,7 @@ export default {
registrationFailed: 'Registration failed. Please try again.', registrationFailed: 'Registration failed. Please try again.',
loginSuccess: 'Login successful! Welcome back.', loginSuccess: 'Login successful! Welcome back.',
accountCreatedSuccess: 'Account created successfully! Welcome to {siteName}.', accountCreatedSuccess: 'Account created successfully! Welcome to {siteName}.',
reloginRequired: 'Session expired. Please log in again.',
turnstileExpired: 'Verification expired, please try again', turnstileExpired: 'Verification expired, please try again',
turnstileFailed: 'Verification failed, please try again', turnstileFailed: 'Verification failed, please try again',
completeVerification: 'Please complete the verification', completeVerification: 'Please complete the verification',
...@@ -1127,13 +1128,13 @@ export default { ...@@ -1127,13 +1128,13 @@ export default {
'One sessionKey per line, e.g.:\nsk-ant-sid01-xxxxx...\nsk-ant-sid01-yyyyy...', 'One sessionKey per line, e.g.:\nsk-ant-sid01-xxxxx...\nsk-ant-sid01-yyyyy...',
sessionKeyPlaceholderSingle: 'sk-ant-sid01-xxxxx...', sessionKeyPlaceholderSingle: 'sk-ant-sid01-xxxxx...',
howToGetSessionKey: 'How to get sessionKey', howToGetSessionKey: 'How to get sessionKey',
step1: 'Login to <strong>claude.ai</strong> in your browser', step1: 'Login to claude.ai in your browser',
step2: 'Press <kbd>F12</kbd> to open Developer Tools', step2: 'Press F12 to open Developer Tools',
step3: 'Go to <strong>Application</strong> tab', step3: 'Go to Application tab',
step4: 'Find <strong>Cookies</strong> → <strong>https://claude.ai</strong>', step4: 'Find Cookies → https://claude.ai',
step5: 'Find the row with key <strong>sessionKey</strong>', step5: 'Find the row with key sessionKey',
step6: 'Copy the <strong>Value</strong>', step6: 'Copy the Value',
sessionKeyFormat: 'sessionKey usually starts with <code>sk-ant-sid01-</code>', sessionKeyFormat: 'sessionKey usually starts with sk-ant-sid01-',
startAutoAuth: 'Start Auto-Auth', startAutoAuth: 'Start Auto-Auth',
authorizing: 'Authorizing...', authorizing: 'Authorizing...',
followSteps: 'Follow these steps to authorize your Claude account:', followSteps: 'Follow these steps to authorize your Claude account:',
...@@ -1145,10 +1146,10 @@ export default { ...@@ -1145,10 +1146,10 @@ export default {
openUrlDesc: openUrlDesc:
'Open the authorization URL in a new tab, log in to your Claude account and authorize.', 'Open the authorization URL in a new tab, log in to your Claude account and authorize.',
proxyWarning: proxyWarning:
'<strong>Note:</strong> If you configured a proxy, make sure your browser uses the same proxy to access the authorization page.', 'Note: If you configured a proxy, make sure your browser uses the same proxy to access the authorization page.',
step3EnterCode: 'Enter the Authorization Code', step3EnterCode: 'Enter the Authorization Code',
authCodeDesc: authCodeDesc:
'After authorization is complete, the page will display an <strong>Authorization Code</strong>. Copy and paste it below:', 'After authorization is complete, the page will display an Authorization Code. Copy and paste it below:',
authCode: 'Authorization Code', authCode: 'Authorization Code',
authCodePlaceholder: 'Paste the Authorization Code from Claude page...', authCodePlaceholder: 'Paste the Authorization Code from Claude page...',
authCodeHint: 'Paste the Authorization Code copied from the Claude page', authCodeHint: 'Paste the Authorization Code copied from the Claude page',
...@@ -1169,10 +1170,10 @@ export default { ...@@ -1169,10 +1170,10 @@ export default {
openUrlDesc: openUrlDesc:
'Open the authorization URL in a new tab, log in to your OpenAI account and authorize.', 'Open the authorization URL in a new tab, log in to your OpenAI account and authorize.',
importantNotice: importantNotice:
'<strong>Important:</strong> The page may take a while to load after authorization. Please wait patiently. When the browser address bar changes to <code>http://localhost...</code>, the authorization is complete.', 'Important: The page may take a while to load after authorization. Please wait patiently. When the browser address bar changes to http://localhost..., the authorization is complete.',
step3EnterCode: 'Enter Authorization URL or Code', step3EnterCode: 'Enter Authorization URL or Code',
authCodeDesc: authCodeDesc:
'After authorization is complete, when the page URL becomes <code>http://localhost:xxx/auth/callback?code=...</code>:', 'After authorization is complete, when the page URL becomes http://localhost:xxx/auth/callback?code=...:',
authCode: 'Authorization URL or Code', authCode: 'Authorization URL or Code',
authCodePlaceholder: authCodePlaceholder:
'Option 1: Copy the complete URL\n(http://localhost:xxx/auth/callback?code=...)\nOption 2: Copy only the code parameter value', 'Option 1: Copy the complete URL\n(http://localhost:xxx/auth/callback?code=...)\nOption 2: Copy only the code parameter value',
...@@ -1195,7 +1196,7 @@ export default { ...@@ -1195,7 +1196,7 @@ export default {
'Open the authorization URL in a new tab, log in to your Google account and authorize.', 'Open the authorization URL in a new tab, log in to your Google account and authorize.',
step3EnterCode: 'Enter Authorization URL or Code', step3EnterCode: 'Enter Authorization URL or Code',
authCodeDesc: authCodeDesc:
'After authorization, copy the callback URL (recommended) or just the <code>code</code> and paste it below.', 'After authorization, copy the callback URL (recommended) or just the code and paste it below.',
authCode: 'Callback URL or Code', authCode: 'Callback URL or Code',
authCodePlaceholder: authCodePlaceholder:
'Option 1 (recommended): Paste the callback URL\nOption 2: Paste only the code value', 'Option 1 (recommended): Paste the callback URL\nOption 2: Paste only the code value',
...@@ -1237,10 +1238,10 @@ export default { ...@@ -1237,10 +1238,10 @@ export default {
step2OpenUrl: 'Open the URL in your browser and complete authorization', step2OpenUrl: 'Open the URL in your browser and complete authorization',
openUrlDesc: 'Open the authorization URL in a new tab, log in to your Google account and authorize.', openUrlDesc: 'Open the authorization URL in a new tab, log in to your Google account and authorize.',
importantNotice: importantNotice:
'<strong>Important:</strong> The page may take a while to load after authorization. Please wait patiently. When the browser address bar shows <code>http://localhost...</code>, authorization is complete.', 'Important: The page may take a while to load after authorization. Please wait patiently. When the browser address bar shows http://localhost..., authorization is complete.',
step3EnterCode: 'Enter Authorization URL or Code', step3EnterCode: 'Enter Authorization URL or Code',
authCodeDesc: authCodeDesc:
'After authorization, when the page URL becomes <code>http://localhost:xxx/auth/callback?code=...</code>:', 'After authorization, when the page URL becomes http://localhost:xxx/auth/callback?code=...:',
authCode: 'Authorization URL or Code', authCode: 'Authorization URL or Code',
authCodePlaceholder: authCodePlaceholder:
'Option 1: Copy the complete URL\n(http://localhost:xxx/auth/callback?code=...)\nOption 2: Copy only the code parameter value', 'Option 1: Copy the complete URL\n(http://localhost:xxx/auth/callback?code=...)\nOption 2: Copy only the code parameter value',
...@@ -1652,8 +1653,8 @@ export default { ...@@ -1652,8 +1653,8 @@ export default {
secretKey: 'Secret Key', secretKey: 'Secret Key',
siteKeyHint: 'Get this from your Cloudflare Dashboard', siteKeyHint: 'Get this from your Cloudflare Dashboard',
cloudflareDashboard: 'Cloudflare Dashboard', cloudflareDashboard: 'Cloudflare Dashboard',
secretKeyHint: 'Server-side verification key (keep this secret)' secretKeyHint: 'Server-side verification key (keep this secret)',
}, secretKeyConfiguredHint: 'Secret key configured. Leave empty to keep the current value.' },
defaults: { defaults: {
title: 'Default User Settings', title: 'Default User Settings',
description: 'Default values for new users', description: 'Default values for new users',
...@@ -1703,6 +1704,8 @@ export default { ...@@ -1703,6 +1704,8 @@ export default {
password: 'SMTP Password', password: 'SMTP Password',
passwordPlaceholder: '********', passwordPlaceholder: '********',
passwordHint: 'Leave empty to keep existing password', passwordHint: 'Leave empty to keep existing password',
passwordConfiguredPlaceholder: '********',
passwordConfiguredHint: 'Password configured. Leave empty to keep the current value.',
fromEmail: 'From Email', fromEmail: 'From Email',
fromEmailPlaceholder: "noreply{'@'}example.com", fromEmailPlaceholder: "noreply{'@'}example.com",
fromName: 'From Name', fromName: 'From Name',
......
frontend/src/i18n/locales/zh.ts
View file @ 46dda583
...@@ -197,6 +197,7 @@ export default { ...@@ -197,6 +197,7 @@ export default {
registrationFailed: '注册失败，请重试。', registrationFailed: '注册失败，请重试。',
loginSuccess: '登录成功！欢迎回来。', loginSuccess: '登录成功！欢迎回来。',
accountCreatedSuccess: '账户创建成功！欢迎使用 {siteName}。', accountCreatedSuccess: '账户创建成功！欢迎使用 {siteName}。',
reloginRequired: '会话已过期，请重新登录。',
turnstileExpired: '验证已过期，请重试', turnstileExpired: '验证已过期，请重试',
turnstileFailed: '验证失败，请重试', turnstileFailed: '验证失败，请重试',
completeVerification: '请完成验证', completeVerification: '请完成验证',
...@@ -1279,13 +1280,13 @@ export default { ...@@ -1279,13 +1280,13 @@ export default {
'每行一个 sessionKey，例如：\nsk-ant-sid01-xxxxx...\nsk-ant-sid01-yyyyy...', '每行一个 sessionKey，例如：\nsk-ant-sid01-xxxxx...\nsk-ant-sid01-yyyyy...',
sessionKeyPlaceholderSingle: 'sk-ant-sid01-xxxxx...', sessionKeyPlaceholderSingle: 'sk-ant-sid01-xxxxx...',
howToGetSessionKey: '如何获取 sessionKey', howToGetSessionKey: '如何获取 sessionKey',
step1: '在浏览器中登录 <strong>claude.ai</strong>', step1: '在浏览器中登录 claude.ai',
step2: '按 <kbd>F12</kbd> 打开开发者工具', step2: '按 F12 打开开发者工具',
step3: '切换到 <strong>Application</strong> 标签', step3: '切换到 Application 标签',
step4: '找到 <strong>Cookies</strong> → <strong>https://claude.ai</strong>', step4: '找到 Cookies → https://claude.ai',
step5: '找到 <strong>sessionKey</strong> 所在行', step5: '找到 sessionKey 所在行',
step6: '复制 <strong>Value</strong> 列的值', step6: '复制 Value 列的值',
sessionKeyFormat: 'sessionKey 通常以 <code>sk-ant-sid01-</code> 开头', sessionKeyFormat: 'sessionKey 通常以 sk-ant-sid01- 开头',
startAutoAuth: '开始自动授权', startAutoAuth: '开始自动授权',
authorizing: '授权中...', authorizing: '授权中...',
followSteps: '按照以下步骤授权您的 Claude 账号：', followSteps: '按照以下步骤授权您的 Claude 账号：',
...@@ -1296,9 +1297,9 @@ export default { ...@@ -1296,9 +1297,9 @@ export default {
step2OpenUrl: '在浏览器中打开 URL 并完成授权', step2OpenUrl: '在浏览器中打开 URL 并完成授权',
openUrlDesc: '在新标签页中打开授权 URL，登录您的 Claude 账号并授权。', openUrlDesc: '在新标签页中打开授权 URL，登录您的 Claude 账号并授权。',
proxyWarning: proxyWarning:
'<strong>注意：</strong>如果您配置了代理，请确保浏览器使用相同的代理访问授权页面。', '注意：如果您配置了代理，请确保浏览器使用相同的代理访问授权页面。',
step3EnterCode: '输入授权码', step3EnterCode: '输入授权码',
authCodeDesc: '授权完成后，页面会显示一个 <strong>授权码</strong>。复制并粘贴到下方：', authCodeDesc: '授权完成后，页面会显示一个授权码。复制并粘贴到下方：',
authCode: '授权码', authCode: '授权码',
authCodePlaceholder: '粘贴 Claude 页面的授权码...', authCodePlaceholder: '粘贴 Claude 页面的授权码...',
authCodeHint: '粘贴从 Claude 页面复制的授权码', authCodeHint: '粘贴从 Claude 页面复制的授权码',
...@@ -1318,10 +1319,10 @@ export default { ...@@ -1318,10 +1319,10 @@ export default {
step2OpenUrl: '在浏览器中打开链接并完成授权', step2OpenUrl: '在浏览器中打开链接并完成授权',
openUrlDesc: '请在新标签页中打开授权链接，登录您的 OpenAI 账户并授权。', openUrlDesc: '请在新标签页中打开授权链接，登录您的 OpenAI 账户并授权。',
importantNotice: importantNotice:
'<strong>重要提示：</strong>授权后页面可能会加载较长时间，请耐心等待。当浏览器地址栏变为 <code>http://localhost...</code> 开头时，表示授权已完成。', '重要提示：授权后页面可能会加载较长时间，请耐心等待。当浏览器地址栏变为 http://localhost... 开头时，表示授权已完成。',
step3EnterCode: '输入授权链接或 Code', step3EnterCode: '输入授权链接或 Code',
authCodeDesc: authCodeDesc:
'授权完成后，当页面地址变为 <code>http://localhost:xxx/auth/callback?code=...</code> 时：', '授权完成后，当页面地址变为 http://localhost:xxx/auth/callback?code=... 时：',
authCode: '授权链接或 Code', authCode: '授权链接或 Code',
authCodePlaceholder: authCodePlaceholder:
'方式1：复制完整的链接\n(http://localhost:xxx/auth/callback?code=...)\n方式2：仅复制 code 参数的值', '方式1：复制完整的链接\n(http://localhost:xxx/auth/callback?code=...)\n方式2：仅复制 code 参数的值',
...@@ -1340,7 +1341,7 @@ export default { ...@@ -1340,7 +1341,7 @@ export default {
step2OpenUrl: '在浏览器中打开链接并完成授权', step2OpenUrl: '在浏览器中打开链接并完成授权',
openUrlDesc: '请在新标签页中打开授权链接，登录您的 Google 账户并授权。', openUrlDesc: '请在新标签页中打开授权链接，登录您的 Google 账户并授权。',
step3EnterCode: '输入回调链接或 Code', step3EnterCode: '输入回调链接或 Code',
authCodeDesc: '授权完成后，复制浏览器跳转后的回调链接（推荐）或仅复制 <code>code</code>，粘贴到下方即可。', authCodeDesc: '授权完成后，复制浏览器跳转后的回调链接（推荐）或仅复制 code，粘贴到下方即可。',
authCode: '回调链接或 Code', authCode: '回调链接或 Code',
authCodePlaceholder: '方式1（推荐）：粘贴回调链接\n方式2：仅粘贴 code 参数的值', authCodePlaceholder: '方式1（推荐）：粘贴回调链接\n方式2：仅粘贴 code 参数的值',
authCodeHint: '系统会自动从链接中解析 code/state。', authCodeHint: '系统会自动从链接中解析 code/state。',
...@@ -1376,10 +1377,10 @@ export default { ...@@ -1376,10 +1377,10 @@ export default {
step2OpenUrl: '在浏览器中打开链接并完成授权', step2OpenUrl: '在浏览器中打开链接并完成授权',
openUrlDesc: '请在新标签页中打开授权链接，登录您的 Google 账户并授权。', openUrlDesc: '请在新标签页中打开授权链接，登录您的 Google 账户并授权。',
importantNotice: importantNotice:
'<strong>重要提示：</strong>授权后页面可能会加载较长时间，请耐心等待。当浏览器地址栏变为 <code>http://localhost...</code> 开头时，表示授权已完成。', '重要提示：授权后页面可能会加载较长时间，请耐心等待。当浏览器地址栏变为 http://localhost... 开头时，表示授权已完成。',
step3EnterCode: '输入授权链接或 Code', step3EnterCode: '输入授权链接或 Code',
authCodeDesc: authCodeDesc:
'授权完成后，当页面地址变为 <code>http://localhost:xxx/auth/callback?code=...</code> 时：', '授权完成后，当页面地址变为 http://localhost:xxx/auth/callback?code=... 时：',
authCode: '授权链接或 Code', authCode: '授权链接或 Code',
authCodePlaceholder: authCodePlaceholder:
'方式1：复制完整的链接\n(http://localhost:xxx/auth/callback?code=...)\n方式2：仅复制 code 参数的值', '方式1：复制完整的链接\n(http://localhost:xxx/auth/callback?code=...)\n方式2：仅复制 code 参数的值',
...@@ -1847,8 +1848,8 @@ export default { ...@@ -1847,8 +1848,8 @@ export default {
secretKey: '私密密钥', secretKey: '私密密钥',
siteKeyHint: '从 Cloudflare Dashboard 获取', siteKeyHint: '从 Cloudflare Dashboard 获取',
cloudflareDashboard: 'Cloudflare Dashboard', cloudflareDashboard: 'Cloudflare Dashboard',
secretKeyHint: '服务端验证密钥（请保密）' secretKeyHint: '服务端验证密钥（请保密）',
}, secretKeyConfiguredHint: '密钥已配置，留空以保留当前值。' },
defaults: { defaults: {
title: '用户默认设置', title: '用户默认设置',
description: '新用户的默认值', description: '新用户的默认值',
...@@ -1897,6 +1898,8 @@ export default { ...@@ -1897,6 +1898,8 @@ export default {
password: 'SMTP 密码', password: 'SMTP 密码',
passwordPlaceholder: '********', passwordPlaceholder: '********',
passwordHint: '留空以保留现有密码', passwordHint: '留空以保留现有密码',
passwordConfiguredPlaceholder: '********',
passwordConfiguredHint: '密码已配置，留空以保留当前值。',
fromEmail: '发件人邮箱', fromEmail: '发件人邮箱',
fromEmailPlaceholder: "noreply{'@'}example.com", fromEmailPlaceholder: "noreply{'@'}example.com",
fromName: '发件人名称', fromName: '发件人名称',
......
frontend/src/utils/url.ts 0 → 100644
View file @ 46dda583
/**
* 验证并规范化 URL
* 默认只接受绝对 URL（以 http:// 或 https:// 开头），可按需允许相对路径
* @param value 用户输入的 URL
* @returns 规范化后的 URL，如果无效则返回空字符串
*/
type SanitizeOptions = {
allowRelative?: boolean
}
export function sanitizeUrl(value: string, options: SanitizeOptions = {}): string {
const trimmed = value.trim()
if (!trimmed) {
return ''
}
if (options.allowRelative && trimmed.startsWith('/') && !trimmed.startsWith('//')) {
return trimmed
}
// 只接受绝对 URL，不使用 base URL 来避免相对路径被解析为当前域名
// 检查是否以 http:// 或 https:// 开头
if (!trimmed.match(/^https?:\/\//i)) {
return ''
}
try {
const parsed = new URL(trimmed)
const protocol = parsed.protocol.toLowerCase()
if (protocol !== 'http:' && protocol !== 'https:') {
return ''
}
return parsed.toString()
} catch {
return ''
}
}
frontend/src/views/HomeView.vue
View file @ 46dda583
...@@ -493,6 +493,7 @@ import { useI18n } from 'vue-i18n' ...@@ -493,6 +493,7 @@ import { useI18n } from 'vue-i18n'
import { getPublicSettings } from '@/api/auth' import { getPublicSettings } from '@/api/auth'
import { useAuthStore } from '@/stores' import { useAuthStore } from '@/stores'
import LocaleSwitcher from '@/components/common/LocaleSwitcher.vue' import LocaleSwitcher from '@/components/common/LocaleSwitcher.vue'
import { sanitizeUrl } from '@/utils/url'
const { t } = useI18n() const { t } = useI18n()
...@@ -549,9 +550,9 @@ onMounted(async () => { ...@@ -549,9 +550,9 @@ onMounted(async () => {
try { try {
const settings = await getPublicSettings() const settings = await getPublicSettings()
siteName.value = settings.site_name || 'Sub2API' siteName.value = settings.site_name || 'Sub2API'
siteLogo.value = settings.site_logo || '' siteLogo.value = sanitizeUrl(settings.site_logo || '', { allowRelative: true })
siteSubtitle.value = settings.site_subtitle || 'AI API Gateway Platform' siteSubtitle.value = settings.site_subtitle || 'AI API Gateway Platform'
docUrl.value = settings.doc_url || '' docUrl.value = sanitizeUrl(settings.doc_url || '', { allowRelative: true })
} catch (error) { } catch (error) {
console.error('Failed to load public settings:', error) console.error('Failed to load public settings:', error)
} }
......
Markdown is supported
0% or .
You are about to add 0 people to the discussion. Proceed with caution.
Finish editing this message first!
Please register or to comment