2 Commits

Include renames

Author	SHA1	Message	Date
shaw	dec47e8fae	fix(profit-control): stop leaking profit policy, close veto livelock, restore passthrough turn pricing ... 审计修复，逐条如下。 H1 利润策略泄露给所有普通用户 profit_control_enabled / profit_min_margin / profit_safety_buffer 从 dto.Group 移到 dto.AdminGroup（后者内嵌前者），赋值相应从 groupFromServiceBase 移到 GroupFromServiceAdmin；前端 TS 同步从 Group 移到 AdminGroup。dto.Group 是 GET /api/v1/groups/available 的响应体，该响应本就带 rate_multiplier，相乘即可反推运营方上游采购成本上限。 api_contract_test.go 的 /groups/available golden JSON 回滚这三个字段，并把 fixture 改成非零值（require.JSONEq 是精确比对，缺字段即失败）。 新增 dto 层边界测试：普通用户 DTO 不含三字段、管理员 DTO 仍含。 M1 利润终检 continue 与 failover 503 退避互动产生活锁 FailoverState 新增 profitVetoedAccountIDs / profitVetoCount 与 RecordProfitVeto()：加入排除集 + 计数，达 maxProfitVetoAttempts(10) 返回 FailoverExhausted。HandleSelectionExhausted 的 503 清空分支改为清空后把利润 否决的账号放回排除集；若排除集已全部由利润否决贡献，清空不会带来任何新候选， 直接判定耗尽（否则 SwitchCount 永不前进、退避条件永远成立，每 2s 空转一轮）。 五个 handler 否决点（gateway_handler ×2 / responses / chat_completions / gemini_v1beta）改为经 RecordProfitVeto 决策，耗尽时按无可用账号终止。 回归测试钉死：503 之后持续利润否决必须有限步终止且不 spin；未启用利润控制的 请求退避语义完全不变。 M2 排队等槽后才终检，延迟可放大到 N × WaitPlan.Timeout OpenAI 侧选号循环（自有 failedAccountIDs map，非 FailoverState）新增 recordOpenAIProfitVeto + handleOpenAIProfitVetoExhausted，共用同一上限语义。 覆盖 responses / messages-dispatch / chat_completions / alpha_search / embeddings / images / grok_media 七处，以及 WS 两处否决分支。 M4 ws_v2 透传 ingress 绕过 per-turn 重定价（选方案 B：最小止血） 透传 relay 只回调 AfterTurn、没有任何 turn 起始回调，hooks.BeforeTurn 永远 不触发，而 handler 把 turnPricingAt 初始化成建连时刻 ⇒ 透传连接全部 turn 按 建连时刻的高峰因子结算，客户端峰前建连保活即可全程谷价——正是本 PR 想堵的 漏洞。改为 openAIWSTurnPricing 零值起步、只由 BeforeTurn 冻结；透传路径保持 零值，RecordUsage 回退记录时刻，与引入利润控制前的基线一致。 未选方案 A（给透传补 turn 起始回调）：passthrough_relay.go 是 #5167 刚修过的 取消传播/close frame 时序敏感区；且 BeforeTurn 还承担 turn>1 的并发槽位抢占， 接进去等于给透传连接引入 per-turn 抢槽，风险远超本次修复范围。透传仍有建连时 的准入门，只是没有 turn 级复核，已在两处注释写明。 测试：service 层钉死透传 ingress 不触发 BeforeTurn（含失败时的复核指引）， handler 层钉死零值语义与逐 turn 覆盖。 M5 装门读分组走了带账号计数聚合的 GetByID SchedulerSnapshotService 新增 GetGroupByIDLite，openai/gateway 两处装门改用 之。门只需要平台/倍率/利润/高峰字段，且该查询发生在「是否启用利润控制」判定 之前，未启用的分组同样付代价。两个测试 stub 的 GetByID 改成 panic 守卫。 M6 认证快照注释与真实读取路径相反 门解析优先取 ctxkey.Group，而它就是本快照物化出来的对象，直连流量走的正是这 条路。改正注释，与 api_key_repo.go 投影处的说明对齐，避免后人照旧注释删列。 M3 rate_multiplier 为 nil 时利润门 fail-closed（不改行为，加护栏） 保留 fail-closed。补 repository 层测试钉死账号调度快照的 full/metadata 两份 payload 都必须保留 RateMultiplier（含 0 值），漏列在 CI 就红。 L1 迁移号注释 191 / 191-192 改为实际的 192/193。 L2 admin group Create 的利润配置预校验改用与 CreateGroup 一致的归一化平台 （新增 service.NormalizeGroupPlatform，两边共用）。保留预校验而非删除： service 层返回的是无类型 error，经 ErrorFrom 会变成 500，删掉会把合法的 400 降级成 500。 L3 前端利润校验的上界改为判定换算后的小数（后端按小数校验 [0,1)）， 99.999% 会四舍五入进位成 1.0 而被后端 400；i18n en/zh 同步改为 0-99.99。 L4 clampProfitControlThreshold / profitControlOverThreshold 抽为共用函数， 线上装门/否决点与 profit-preview 不再各自实现，附边界语义测试。 L5 profit-preview 补「默认 D 有账号但最低有效 D 归零」的告警（两档都为 0 由 既有告警覆盖，不重复）。	2026-08-01 22:39:33 +08:00
Brisbanehuang	20ad5ec506	feat(scheduler): per-group profit control for token account admission ... Group pricing (rate multiplier, peak windows, per-user overrides) and account cost (accounts.rate_multiplier) already live side by side, but nothing stops the scheduler from handing a request to an account whose cost multiplier exceeds what the group's pricing can profitably serve. Add an opt-in per-group profit gate that filters scheduling candidates by a margin rule, while ordering, scoring, stickiness and breakers keep working unchanged among qualified accounts. Admission rule: an account qualifies iff U <= D * (1 - min_margin - safety_buffer) within a small relative epsilon, where U is accounts.rate_multiplier (0 is legal; missing/negative/NaN/Inf are conservatively rejected as invalid) and D is the requester's effective downstream multiplier (user-group override ?? group default, times the group peak factor) frozen at the request's pricing instant. - groups gain profit_control_enabled / profit_min_margin / profit_safety_buffer (migration 191); the durable auth-cache invalidation trigger additionally watches the profit and pricing columns (migration 192) so out-of-band group edits cannot leave stale auth snapshots; GetByKeyForAuth explicitly projects the new columns and the API-key auth snapshot version is bumped to force a refresh of pre-existing snapshots - request-level pricing instant: token entry points install pricingAt into ctx; the profit threshold D and the RecordUsage peak factor read the same instant, so one request never changes price mid-flight across waits/retries/failover (media and unwired paths keep the existing record-time semantics) - the gate covers token requests on openai, anthropic, gemini, grok and antigravity groups: OpenAI-family handlers via WithOpenAIRequestPricingContext (responses incl. WS bridge, chat completions, messages, embeddings, alpha search), the shared gateway via WithGatewayTokenRequestPricing (messages, chat completions, responses, gemini model actions); composite groups cannot enable it directly; image/video/models/usage/count_tokens stay ungated and an explicit image-generation intent suppresses the gate end to end - post-slot recheck: after a slot is acquired the account is re-read via SchedulerSnapshotService.GetAccount (scheduler cache, then DB; only when both fail the check fails open with WARN + metric); a vetoed account releases its slot and joins the request's exclusion set for reselection; sticky bindings are written only after the final check passes, and an over-threshold sticky account is skipped, not deleted, so it comes back once its rate recovers - sticky-session cache contract: GatewayCache.GetSessionAccountID now returns ErrStickySessionNotFound on a miss (mapped from redis.Nil in the repository implementation, mirroring ErrRefreshTokenNotFound) so the profit sticky path can distinguish "no binding yet" from a real read failure without importing the cache driver in service code - cross-group re-entry (composite parent -> member group) resolves the gate against the member group and clears a stale parent gate instead of letting a foreign threshold veto accounts - per-platform/group activity counters (installs, threshold vetoes, invalid-rate vetoes, refresh failures) for observability - admin UI: profit-control section on the five platforms' group forms with percent input, validation and platform-switch reset; group create/update/duplicate normalize and validate the config at a single choke point - cmd/profit-preview: offline what-if tool that replays the production admission semantics over an exported config/account/override/model dump, reports per-model admitted-account counts under the default and the worst-case (lowest user override) D, and surfaces probe-sync staleness as warnings without affecting admission Tests: service unit coverage for gate resolution/veto/threshold epsilon/pricing instant/suppress marker/scheduler filtering and post-slot recheck (incl. -race on the profit surface), unit-tagged handler slot-recheck and capability-mapping regressions, sqlmock and real-PostgreSQL integration regressions for the GetByKeyForAuth projection and the migration-192 trigger watch list, API contract update, and frontend specs for the five-platform form helpers.	2026-08-01 22:39:31 +08:00