seewe/sub2api
1
0
Fork 0
mirror of https://github.com/Wei-Shaw/sub2api.git synced 2026-10-16 07:33:06 +08:00
Code Issues Packages Projects Releases Wiki Activity
6,995 Commits 46 Branches 62 Tags
c19204289d04f643fcf3442dbf998d3796f33555
Commit Graph
6995 Commits
This Branch
This Branch
All Branches
Author SHA1 Message Date
feeeei c19204289d fix(affiliate): 线下提现登记按 Idempotency-Key 幂等 
登记请求只有金额，提交成功但响应丢失时，管理员重试会把同一笔站外打款再扣
一次返利额度。现在一次登记由 Idempotency-Key 标识，数据库在同一事务内以唯一
约束去重：

- user_affiliate_ledger 新增 operation_id（幂等键派生的 SHA-256）与部分唯一
  索引（迁移 240）；接口要求 Idempotency-Key，缺失或非法返回 400
- 事务内先以 operation_id 写入占位流水，再解冻、扣减并补写额度快照；同键
  重试返回首笔流水的结果并带 X-Idempotency-Replayed，不重复扣减；同键换了
  用户或金额返回 409 IDEMPOTENCY_KEY_CONFLICT；额度不足时占位随事务回滚
- 并发的同键请求在唯一索引上等待先到者：先到者提交则返回同一条流水，回滚
  则自行登记
- 弹窗在网络错误、超时、5xx、408/409 时锁定用户与金额，重试沿用同一请求与
  幂等键；幂等键按管理员、用户、金额暂存于 sessionStorage，登记有确定结果后
  释放
 2026-09-23 01:24:59 +08:00
feeeei 57b7dbdc85 feat(affiliate): 提取记录支持登记线下提现 
管理员在站外给邀请人打款后，系统里原本无法扣减对应的返利额度，用户仍可把
这部分额度转入余额。现在可在「邀请返利 → 提取记录」点「登记线下提现」，
从该用户的可提取返利额度中扣除已打款金额：

- POST /api/v1/admin/affiliates/users/:user_id/withdraw，请求体只含 amount，
  金额按 8 位小数舍入后校验
- 先解冻已到期的冻结额度，再以 aff_quota >= amount 为条件原子扣减，写入
  action=withdraw 的流水并带额度快照；额度不足返回 AFFILIATE_QUOTA_INSUFFICIENT
- 不新增字段与迁移：线下提现复用已有 action 列区分，操作人由管理端审计日志记录
- 提取记录同时列出转入余额与线下提现，新增「类型」列
- 弹窗选择用户后展示可提取额度，支持一键填入全部；从未产生返利的用户按 0 处理

返利记录改为 LEFT JOIN 订单与被邀请人，兑换码、管理员充值来源的返利也会出现
在明细中，接口里订单相关字段与被邀请人 ID 可为 null。
 2026-09-17 23:42:02 +08:00
Wesley Liddick efe9aab1e4 Merge pull request #7246 from laoxiechuzheng/fix/deepseek-native-responses-tool-output-media 
fix(deepseek): lift Responses tool output images
 2026-09-17 17:02:43 +08:00
Wesley Liddick aeab57b9b2 Merge pull request #7256 from zhudaguaneren/fix/antigravity-attribution-429 
fix(antigravity): 过滤 Claude attribution 元数据，修复特定请求的 429
 2026-09-17 16:44:09 +08:00
Wesley Liddick 18328aed05 Merge pull request #7212 from wucm667/feat/issue-7203-redemption-pagination 
feat(redeem): paginate user redemption history
 2026-09-17 16:43:06 +08:00
Wesley Liddick 48a86ec926 Merge pull request #7224 from HypoxanthineOvO/codex/upstream-chat-role-compat 
fix(gateway): normalize developer roles for strict native Chat upstreams
 2026-09-17 16:42:31 +08:00
Wesley Liddick b4e560824a Merge pull request #7177 from xO-ox-ai/codex/fix-openai-response-binding-context 
fix(openai): 客户端断开后仍持久化 Responses 续聊绑定
 2026-09-17 16:42:12 +08:00
Wesley Liddick 9efc167482 Merge pull request #7195 from bitnom/fix/refresh-paused-oauth-accounts 
fix(account): keep refreshing OAuth tokens for paused accounts
 2026-09-17 16:41:54 +08:00
Wesley Liddick 5050471822 Merge pull request #7239 from Liu8Can/fix/register-promo-code-flicker 
fix: prevent promo code field flash on registration
 2026-09-17 16:41:35 +08:00
Wesley Liddick c84a3d50a3 Merge pull request #7215 from xz-dev/fix/manifest-double-parse 
fix(openai): parse Codex models manifest envelope once
 2026-09-17 16:41:12 +08:00
Wesley Liddick cd1834e0a9 Merge pull request #7262 from ouchihao/codex/bug-refund-balance-warning 
fix(payment): base refund balance warnings on the requested amount
 2026-09-17 16:41:00 +08:00
Wesley Liddick 0932e8ce0a Merge pull request #7266 from ouchihao/codex/bug-subscription-loading-reset 
fix(subscriptions): reset loading when clearing state
 2026-09-17 16:40:44 +08:00
Wesley Liddick ffa43607e5 Merge pull request #7236 from ouchihao/codex/bug-payment-amount-input 
fix(payment): restore accepted text after invalid amount input
 2026-09-17 16:40:33 +08:00
Wesley Liddick 57e9f6a4b8 Merge pull request #7238 from ouchihao/codex/bug-model-tag-tab-navigation 
fix(channels): allow tabbing out of an empty model input
 2026-09-17 16:40:23 +08:00
Wesley Liddick 71c0eb5126 Merge pull request #7184 from ouchihao/codex/bug-totp-error-messages 
fix(totp): display normalized API error messages
 2026-09-17 16:40:07 +08:00
Wesley Liddick 10fd1ada28 Merge pull request #7182 from ouchihao/codex/bug-orders-filter-page 
fix(payment): reset the order page when changing status
 2026-09-17 16:39:53 +08:00
Wesley Liddick 53fd5f8351 Merge pull request #7183 from ouchihao/codex/bug-proxy-test-dedup 
fix(proxies): reuse in-flight test guards during batch testing
 2026-09-17 16:39:34 +08:00
Wesley Liddick 55bde0857f Merge pull request #7185 from ouchihao/codex/bug-announcement-read-results 
fix(announcements): preserve successful bulk read results
 2026-09-17 16:39:16 +08:00
Wesley Liddick 5f75e0d2a7 Merge pull request #7186 from ouchihao/codex/bug-clipboard-fallback-error 
fix(clipboard): report errors thrown by the copy fallback
 2026-09-17 16:38:55 +08:00
Wesley Liddick efd86c63e6 Merge pull request #7235 from ouchihao/codex/bug-totp-setup-input-sync 
fix(auth): keep TOTP setup digits in sync with state
 2026-09-17 16:38:37 +08:00
Wesley Liddick ea68c0e82c Merge pull request #7263 from ouchihao/codex/bug-dialog-title-ids 
fix(ui): keep dialog title IDs unique across instances
 2026-09-17 16:38:16 +08:00
Wesley Liddick 40e7ce7fbf Merge pull request #7265 from ouchihao/codex/bug-payment-config-await 
fix(payment): await in-flight configuration requests
 2026-09-17 16:37:54 +08:00
Wesley Liddick d52ab27def Merge pull request #7173 from HuntercodeT/fix/gemini-native-mixed-model-listing 
fix(gemini): discover Antigravity mappings in native model lists
 2026-09-17 16:37:38 +08:00
Wesley Liddick 7e4164c1cf Merge pull request #7207 from HuntercodeT/fix/group-usage-summary-seq-scan 
fix: 分组用量汇总不再全表扫 usage_logs（48.7s → 34ms）
 2026-09-17 16:37:21 +08:00
Wesley Liddick 44831bb854 Merge pull request #7261 from HuntercodeT/chore/bump-grpc-1.83.2 
chore(deps): 升级 google.golang.org/grpc 到 v1.83.2，修复 govulncheck 报告的 GO-2026-6443 / GO-2026-6348
 2026-09-17 16:36:57 +08:00
Wesley Liddick 131893e449 Merge pull request #7237 from ouchihao/codex/bug-platform-quota-negative 
fix(admin): reject negative platform quota limits before saving
 2026-09-17 16:36:34 +08:00
Wesley Liddick 4daabc3d84 Merge pull request #7234 from ouchihao/codex/bug-pagination-jump-number 
fix(pagination): handle numeric jump input
 2026-09-17 16:36:23 +08:00
laoxiechuzheng acc05620cb fix(deepseek): keep parallel Responses tool outputs contiguous 2026-09-17 15:45:56 +08:00
chihao.ou 406be7c518 fix(subscriptions): reset loading when clearing state 2026-09-17 14:59:43 +08:00
chihao.ou b51f0759d4 fix(payment): await in-flight configuration requests 2026-09-17 14:58:46 +08:00
chihao.ou be313735dc fix(ui): keep dialog title IDs unique across instances 2026-09-17 14:56:58 +08:00
chihao.ou 017e9e98d1 fix(payment): base refund balance warnings on the requested amount 2026-09-17 14:56:33 +08:00
HuntercodeT 611c30f04f chore(deps): 升级 google.golang.org/grpc 到 v1.83.2 修复 govulncheck 报告的两条公告 
Security Scan / backend-security 自 2026-09-16 起在所有 PR 上失败，govulncheck 对
google.golang.org/grpc v1.82.1 报：
- GO-2026-6443 Server panic via missing authority or Host headers（修复于 v1.83.2）
- GO-2026-6348 Heap Memory Exhaustion via HTTP/2 DATA Frame Fragmentation（修复于 v1.83.1）
调用链在 pkg/pluginapi/v1/runtime.go 与 internal/service/plugin_runtime.go。

go get google.golang.org/grpc@v1.83.2 && go mod tidy。最小版本选择连带抬升了
golang.org/x/{crypto,mod,net,sync,term,sys,text,tools}、genproto/googleapis/rpc 与
go.opentelemetry.io/otel* 的间接依赖，均为补丁级别。
 2026-09-17 14:33:48 +08:00
zhudaguaneren be4a4990ff fix(antigravity): strip Claude attribution metadata from system prompts 2026-09-17 11:57:53 +08:00
laoxiechuzheng 881ab1b0c6 fix(deepseek): lift Responses tool output images 
DeepSeek native Responses rejects Codex view_image results when function_call_output.output contains input_image parts. Move media into a following user message and keep the tool output as a string so call_id pairing remains valid.
 2026-09-17 01:22:22 +08:00
DanielSong fe36f4a914 fix: prevent promo code field flash on registration 2026-09-16 18:34:52 +08:00
chihao.ou f8e5a0d94f fix(channels): allow tabbing out of an empty model input 2026-09-16 18:19:41 +08:00
chihao.ou 0838e0e610 fix(admin): reject negative platform quota limits before saving 2026-09-16 18:17:29 +08:00
chihao.ou 98321a054e fix(payment): restore accepted text after invalid amount input 2026-09-16 18:17:14 +08:00
chihao.ou ee9ac3e45f fix(auth): keep TOTP setup digits in sync with state 2026-09-16 18:15:28 +08:00
chihao.ou 1a32b91eb2 fix(pagination): handle numeric jump input 2026-09-16 18:15:12 +08:00
HypoxanthineOvO 18bfa4bf20 fix(gateway): normalize developer roles for strict Chat upstreams 2026-09-16 16:11:43 +08:00
Xiangzhe 31f3003ff5 fix(openai): preserve manifest key validation 2026-09-16 06:15:31 +00:00
Xiangzhe 2f16e0984e fix(openai): avoid duplicate manifest parsing 2026-09-16 06:15:25 +00:00
wucm667 a9ed218989 feat(redeem): paginate user redemption history 2026-09-16 13:19:15 +08:00
HuntercodeT 18d483c2a1 fix: 分组用量汇总不再全表扫 usage_logs 
GET /api/v1/admin/groups/usage-summary 在有一定数据量的库上会退化成
usage_logs 全表扫。根因是 getAllGroupUsageSummaryFromRollups 里，tail CTE
的 created_at 下界 state.tail_start 由同一条 SQL 的 state CTE 算出、再用
CROSS JOIN 交给 tail：这个值对 planner 来说要到运行期才知道，既进不了
index cond，也估不准选择性，于是只能顺序扫全表再逐行过滤。

生产实测（1721 万行 usage_logs / PostgreSQL 17）：

    Nested Loop  (actual time=28161..48334 rows=34788)
      Join Filter: (ul.created_at >= state_1.tail_start)
      Rows Removed by Join Filter: 17178082
      ->  Seq Scan on usage_logs  (actual time=0.030..47567 rows=17212870)
          Buffers: shared hit=12863 read=951875
    Execution Time: 48720 ms

改成先读一次水位行、在 Go 侧算出 tail_start / closed_before / retained
日期，再把它们当查询参数传进来。同一套数据上：

    Index Scan using idx_usage_logs_created_at on usage_logs
      Index Cond: (created_at >= $7)
    Execution Time: 34 ms

水位有效性的判定（恰好一行、时区名与配置一致、水位不在未来）和无效时
退化成从 epoch 全量重算的行为，与原先 SQL 里 state_values / CASE WHEN
valid 的分支逐条对应，结果口径不变。

另外读取水位的语句不加锁，不参与 #6976 那条 FOR UPDATE / FOR KEY SHARE
的阻塞链。
 2026-09-16 10:11:18 +08:00
bitnom 8e34ca5e31 fix(account): keep refreshing OAuth tokens for paused accounts 
Paused (schedulable=false) active accounts were excluded from the
background token refresh candidates, so their stored access_token
silently expired. The admin usage-window quota probe uses the stored
token verbatim (no token provider / no refresh), so the probe then gets
HTTP 401 UNAUTHENTICATED and the dashboard reports a false "needs
re-auth" for a perfectly healthy account, while Test Connection and live
traffic (which refresh on demand via the token provider) keep working.

Pause is not permanent rejection: error accounts are already excluded by
the status = 'active' filter, and accounts whose refresh genuinely fails
are rate-limited by the retry-cooldown exclusion (10-minute retry-
exhausted cooldown). Refresh success only persists credentials and never
touches schedulable, so a paused account cannot be silently un-paused.

Drop the schedulable filter and update the SQL-filter test, the
integration pagination test, and the service-level candidate fake.
 2026-09-15 10:00:26 -04:00
chihao.ou 130ba634ad fix(clipboard): report errors thrown by the copy fallback 2026-09-15 20:08:45 +08:00
chihao.ou 6a4938bdfb fix(announcements): preserve successful bulk read results 2026-09-15 20:06:33 +08:00
chihao.ou 14636d2f0e fix(totp): display normalized API error messages 2026-09-15 20:06:18 +08:00