Skip to content

GitLab

Switch branch/tag
  1. 09 Mar, 2026 1 commit
  3. 08 Mar, 2026 1 commit
  5. 07 Mar, 2026 9 commits
  7. 06 Mar, 2026 7 commits
  9. 05 Mar, 2026 9 commits
  11. 04 Mar, 2026 6 commits
  13. 03 Mar, 2026 5 commits
    • shaw's avatar
      feat: 重构 /v1/usage 端点，支持 quota_limited 和 unrestricted 双模式 · 838dad87
      shaw authored 
      - quota_limited 模式：返回 Key 级别的总额度、速率限制窗口用量和过期时间
- unrestricted 模式：返回订阅限额或钱包余额信息（向后兼容）
- 新增 model_stats 字段，支持 start_date/end_date 参数查询按模型用量统计
- 提取 buildUsageData/parseUsageDateRange 等辅助方法，减少主函数复杂度
- 新增 APIKeyService.GetRateLimitData 和 UsageService.GetAPIKeyModelStats
      838dad87
    • QTom's avatar
      feat(gateway): 系统设置控制未分组 Key 调度 — Handler 层中间件拦截 · 0c7cbe35
      QTom authored 
      新增系统设置 allow_ungrouped_key_scheduling（默认关闭），
未分组的 API Key 在网关请求时直接返回 403，
由 RequireGroupAssignment 中间件统一拦截，
支持 Anthropic / Google 两种错误格式响应。

全栈实现：常量 → 结构体 → 解析/更新/初始化 → DTO → 管理接口 →
中间件 → 路由注册 → 前端设置界面 + i18n。
      0c7cbe35
    • shaw's avatar
      fix: resolve CI lint errors and test compilation failures for rate limit feature · b8b5cec3
      shaw authored 
      - Fix errcheck: properly handle rows.Close() error via named return + defer closure
- Fix gofmt: auto-format billing_cache.go, api_key_service.go, billing_cache_service.go
- Add missing rate limit interface methods to 4 test stubs (GetRateLimitData, IncrementRateLimitUsage, ResetRateLimitWindows)
- Fix NewBillingCacheService calls missing the new apiKeyRepo parameter
      b8b5cec3
    • shaw's avatar
      feat: apikey支持5h/1d/7d速率控制 · a80ec5d8
      shaw authored
      a80ec5d8
    • QTom's avatar
      fix(gateway): 分组隔离 — 禁止未分组账号被跨组调度 · 530a1629
      QTom authored 
      当 API Key 无分组时，调度仅从未分组账号池中选取。
修复 isAccountInGroup 在 groupID==nil 时的逻辑，
同时补全 scheduler_snapshot_service 和 gemini_compat_service
中的 SimpleMode 保护，确保分组隔离在所有调度路径生效。

新增 ListSchedulableUngroupedByPlatform/s 方法，
使用 Ent 的 Not(HasAccountGroups()) 谓词实现未分组账号隔离。
新增 17 个单元和端到端隔离测试，覆盖所有分支和边界条件。
      530a1629
  15. 02 Mar, 2026 2 commits
    • erio's avatar
      fix: security hardening and architectural improvements for custom menu · e97c3766
      erio authored 
      

1. (Critical) Filter admin-only menu items from public API responses -
   both GetPublicSettings handler and GetPublicSettingsForInjection now
   exclude visibility=admin items, preventing unauthorized access to
   admin menu URLs.

2. (Medium) Validate JSON array structure in sanitizeCustomMenuItemsJSON -
   use json.Unmarshal into []json.RawMessage instead of json.Valid to
   reject non-array JSON values that would cause frontend runtime errors.

3. (Medium) Decouple router from business JSON parsing - move origin
   extraction logic from router.go to SettingService.GetFrameSrcOrigins,
   eliminating direct JSON parsing of custom_menu_items in the routing
   layer.

4. (Low) Restrict custom menu item ID charset to [a-zA-Z0-9_-] via
   regex validation, preventing route-breaking characters like / ? # or
   spaces.

5. (Low) Handle crypto/rand error in generateMenuItemID - return error
   instead of silently ignoring, preventing potential duplicate IDs.
Co-Authored-By: default avatarClaude Opus 4.6 <noreply@anthropic.com>
      e97c3766
    • erio's avatar
      fix: custom menu security hardening and code quality improvements · bf6fe5e9
      erio authored 
      

- Add admin menu permission check in CustomPageView (visibility + role)
- Sanitize SVG content with DOMPurify before v-html rendering (XSS prevention)
- Decouple router.go from dto package using anonymous struct
- Consolidate duplicate parseCustomMenuItems into dto.ParseCustomMenuItems
- Enhance menu item validation (count, length, ID uniqueness limits)
- Add audit logging for purchase_subscription and custom_menu_items changes
- Update API contract test to include custom_menu_items field
Co-Authored-By: default avatarClaude Opus 4.6 <noreply@anthropic.com>
      bf6fe5e9