shaw fead4c7ec3 feat(security): add panel API rate limiting to protect DB from high-frequency requests ...

用户可高频刷面板接口（usage/dashboard 等重聚合查询）直接打爆数据库：
现有限流器只覆盖登录/注册等公开认证入口，登录后的全部面板端点无任何限流。

三层防护（阈值均可在后台可视化配置，panel_rate_limit_settings）：

1. 认证面板接口按「用户 ID」限流，与来源 IP 无关——反向代理/NAT 共享出口
   （所有请求源地址坍缩为 127.0.0.1 等）不会互相误伤：
   - Global 档（默认 240 rpm/账号）：user/auth/payment/admin 全部登录后路由
   - Heavy 档（默认 60 rpm/账号）：/usage、/usage/dashboard/*、
     /user/api-keys/:id/usage/daily 等重 SQL 聚合端点叠加计数
   - 管理员默认豁免（可关闭）

2. 无认证公开接口（/api/v1/settings/*，每次请求都查 DB）按安全客户端 IP
   限流（默认 300 rpm/IP）；回环/私网/链路本地地址（反代内部转发地址）
   一律跳过计数，杜绝把整条反代链路合并进同一个桶造成大面积误拦截。

3. 修复既有隐患：auth 入口限流的 IP 取值从 c.ClientIP() 切换到与审计日志/
   会话绑定/API Key ACL 同源的安全客户端 IP 解析（尊重后台「信任反代转发
   IP」开关快照）。原实现下默认反代部署（未配置 server.trusted_proxies）
   所有用户共享同一个登录限流桶，既会全员误拦也可被单人恶意占满形成登录
   DoS；开关关闭时行为与原来完全一致。

工程约束：
- 配置热路径走进程内缓存（atomic.Value + singleflight，60s TTL），
  限流中间件零 DB 访问；保存后当前节点立即生效
- 面板限流 Redis 故障 fail-open（auth 入口保持原有 fail-close）
- 429 响应携带 Retry-After；错误码 RATE_LIMITED
- 支付 webhook / 公开支付回调有意不挂限流
- 新增 GET/PUT /api/v1/admin/settings/panel-rate-limit；设置页安全 tab
  新增「面板接口限流」卡片（zh/en i18n 全量）

测试：rate_limiter/panel_rate_limit/setting_panel_rate_limit 单测全绿；
routes、handler/admin、-tags unit 契约测试通过；前端 vue-tsc/ESLint/
SettingsView spec（26/26，含新增交互用例）/i18n 守卫全部通过。

2026-07-27 15:12:51 +08:00

..

admin

feat(security): add panel API rate limiting to protect DB from high-frequency requests

2026-07-27 15:12:51 +08:00

dto

feat(security): add panel API rate limiting to protect DB from high-frequency requests

2026-07-27 15:12:51 +08:00

quotaview

…

announcement_handler.go

…

api_key_handler.go

fix: 部分更新 API Key 时不再静默清空 IP 白/黑名单

2026-07-20 11:15:37 +08:00

auth_current_user_test.go

…

auth_dingtalk_client_test.go

…

auth_dingtalk_client.go

…

auth_dingtalk_oauth_test.go

…

auth_dingtalk_oauth.go

fix(auth): apply promo codes to oauth signups

2026-06-11 18:55:27 +08:00

auth_email_oauth_test.go

fix(auth): apply promo codes to oauth signups

2026-06-11 18:55:27 +08:00

auth_email_oauth.go

fix(auth): apply promo codes to oauth signups

2026-06-11 18:55:27 +08:00

auth_handler.go

feat(security): 操作审计日志 + 会话IP/UA绑定 + 敏感操作 step-up 2FA

2026-07-16 13:47:50 +08:00

auth_linuxdo_oauth_test.go

feat(security): 操作审计日志 + 会话IP/UA绑定 + 敏感操作 step-up 2FA

2026-07-16 13:47:50 +08:00

auth_linuxdo_oauth.go

feat: fix OAuth email completion flow

2026-06-30 01:11:51 +08:00

auth_oauth_logout_test.go

…

auth_oauth_pending_flow_test.go

fix(auth): 收紧注册别名查重（根点绕过 / 误拒 / 无界扫描 / 并发竞态）

2026-07-25 19:40:53 +08:00

auth_oauth_pending_flow.go

fix(auth): apply promo codes to oauth signups

2026-06-11 18:55:27 +08:00

auth_oauth_test_helpers_test.go

…

auth_oidc_oauth_test.go

…

auth_oidc_oauth.go

fix(auth): apply promo codes to oauth signups

2026-06-11 18:55:27 +08:00

auth_session_revocation_test.go

…

auth_wechat_oauth_test.go

…

auth_wechat_oauth.go

fix(auth): apply promo codes to oauth signups

2026-06-11 18:55:27 +08:00

available_channel_handler_test.go

fix: 高峰倍率全链路透传、计费术语修正与边界处理

2026-07-01 17:46:12 +08:00

available_channel_handler.go

feat(billing): 渠道自定义定价支持图片输入 token 单价 image_input_price

2026-07-15 09:35:34 -07:00

batch_image_handler.go

feat(usage): persist client session identifiers

2026-07-24 01:22:34 +08:00

channel_monitor_user_handler.go

…

chat_completions_image_model_test.go

fix(openai): reject image models on chat completions

2026-07-15 22:22:51 +08:00

composite_platform_test.go

fix: allow composite grok chat completions

2026-07-23 09:20:52 +08:00

composite_platform.go

Harden composite group product surfaces

2026-07-23 09:19:25 +08:00

concurrency_error_response_test.go

…

concurrency_error_response.go

fix: move user wait queue accounting off hot path

2026-06-16 11:41:54 +08:00

content_moderation_helper.go

Fix composite route alias attribution

2026-07-23 09:20:52 +08:00

endpoint_test.go

fix(antigravity):

2026-07-26 20:23:50 +09:00

endpoint.go

fix(antigravity):

2026-07-26 20:23:50 +09:00

failover_loop_test.go

fix(handler): avoid cache billing on same-account retry

2026-07-20 02:20:58 +08:00

failover_loop.go

fix(handler): avoid cache billing on same-account retry

2026-07-20 02:20:58 +08:00

gateway_handler_billing_error_test.go

…

gateway_handler_cancellation_test.go

test: align composite route contracts after rebase

2026-07-23 09:20:52 +08:00

gateway_handler_chat_completions.go

fix(antigravity):

2026-07-26 20:23:50 +09:00

gateway_handler_error_fallback_test.go

fix(antigravity):

2026-07-26 20:23:50 +09:00

gateway_handler_intercept_test.go

fix(gateway): intercept max_tokens=1 haiku probes for streaming requests too

2026-06-11 20:46:47 +08:00

gateway_handler_responses.go

fix(antigravity):

2026-07-26 20:23:50 +09:00

gateway_handler_stream_failover_test.go

…

gateway_handler_usage_test.go

Keep usage ranges consistent across API and dashboards

2026-07-13 11:35:46 +08:00

gateway_handler_warmup_intercept_unit_test.go

Add composite group route registry

2026-07-23 09:20:18 +08:00

gateway_handler.go

feat(usage): persist client session identifiers

2026-07-24 01:22:34 +08:00

gateway_helper_backoff_test.go

…

gateway_helper_fastpath_test.go

fix(openai-ws): bound ingress session lifecycle

2026-07-13 15:32:42 +08:00

gateway_helper_hotpath_test.go

Merge pull request #3645 from bestony/worktree/lucky-harbor-dbe4

2026-07-06 16:45:15 +08:00

gateway_helper_test.go

fix(grok): fail over OAuth credential errors safely

2026-07-14 14:55:30 +08:00

gateway_helper.go

fix(grok): fail over OAuth credential errors safely

2026-07-14 14:55:30 +08:00

gateway_key_billing_test.go

test: align composite route contracts after rebase

2026-07-23 09:20:52 +08:00

gateway_key_billing.go

feat: 增加 API Key 计费倍率自省接口

2026-07-15 22:42:53 +08:00

gateway_models_test.go

Fix composite model defaults for linked platforms

2026-07-23 09:20:52 +08:00

gemini_cli_session_test.go

…

gemini_v1beta_handler_test.go

…

gemini_v1beta_handler.go

feat(usage): persist client session identifiers

2026-07-24 01:22:34 +08:00

grok_media_test.go

Merge origin/main into codex/secure-protected-video-content-4498

2026-07-18 21:38:17 +08:00

grok_media.go

feat(usage): persist client session identifiers

2026-07-24 01:22:34 +08:00

handler.go

feat(security-audit): add OpenAI-compatible prompt auditing

2026-07-17 00:39:39 +08:00

idempotency_helper_test.go

…

idempotency_helper.go

…

image_concurrency_limiter_test.go

…

image_concurrency_limiter.go

…

image_task_admin_toggle_test.go

fix(backup): 拒绝用自动生成的临时密钥持久化 S3 SecretAccessKey

2026-07-20 15:20:51 +08:00

image_task_handler_test.go

feat: 异步图片任务结果落对象存储

2026-07-15 19:57:37 -07:00

image_task_handler.go

feat(image-storage): 异步生图对象存储改为后台配置，保存即生效

2026-07-19 00:56:21 -07:00

logging.go

…

no_account_error_test.go

fix: classify transient account exhaustion as 503 instead of 404

2026-07-17 22:10:18 +08:00

no_account_error.go

Add composite group routing

2026-07-23 09:19:24 +08:00

openai_alpha_search.go

feat(usage): persist client session identifiers

2026-07-24 01:22:34 +08:00

openai_body_limit_failover_test.go

test(openai): validate body-limit error envelope

2026-07-16 00:52:26 +08:00

openai_chat_completions.go

feat(usage): persist client session identifiers

2026-07-24 01:22:34 +08:00

openai_codex_models_handler_test.go

避免无效模型清单破坏 Codex 能力发现

2026-07-16 17:10:44 +08:00

openai_codex_models_handler.go

fix(openai): mark OAuth accounts unschedulable on Codex models manifest 401

2026-07-19 21:13:27 +08:00

openai_embeddings.go

feat(usage): persist client session identifiers

2026-07-24 01:22:34 +08:00

openai_gateway_compact_body_signal_test.go

fix: 保留 remote_compaction_v2 原生 Responses 链路

2026-07-11 12:51:53 +08:00

openai_gateway_compact_log_test.go

fix(openai-ws): make first-message timeout configurable

2026-07-14 22:40:05 +08:00

openai_gateway_count_tokens.go

Add composite group routing

2026-07-23 09:19:24 +08:00

openai_gateway_credential_failover_loop_test.go

fix(grok): cool down accounts after 402

2026-07-23 00:06:04 +08:00

openai_gateway_credential_failover_test.go

fix(antigravity):

2026-07-26 20:23:50 +09:00

openai_gateway_cyber_test.go

feat(openai): cyber_policy 硬阻断全链路透传、审计与计费

2026-06-12 01:47:01 +08:00

openai_gateway_endpoint_normalization_test.go

…

openai_gateway_first_output_timeout_test.go

fix(openai): bound native responses first output wait

2026-07-15 13:01:16 +08:00

openai_gateway_handler_test.go

fix(openai): track websocket models per turn

2026-07-26 13:43:06 +08:00

openai_gateway_handler.go

Merge branch 'Wei-Shaw:main' into fix/antigravity-openai-compat

2026-07-27 13:40:05 +09:00

openai_gateway_reasoning_failover_test.go

fix(openai): strip foreign reasoning on account failover

2026-07-26 13:33:56 +08:00

openai_gateway_reasoning_failover.go

fix(openai): strip foreign reasoning on account failover

2026-07-26 13:33:56 +08:00

openai_gateway_usage_context_test.go

…

openai_grok_image_intent_gate_test.go

test: 更新 image permission 测试适配 explicit intent 检查

2026-07-17 15:29:14 +08:00

openai_image_intent_hint_test.go

复用请求级图片生成意图判断

2026-07-15 04:20:11 +08:00

openai_images_controls_test.go

…

openai_images_failover_test.go

fix(images): log requested quality and size

2026-07-23 23:04:00 +08:00

openai_images.go

Merge pull request #4801 from SemonCat/feat/persist-session-id

2026-07-25 14:03:32 +08:00

openai_live_test.go

feat(openai): add macOS Live attestation

2026-07-25 12:50:46 +08:00

openai_live.go

fix(openai): satisfy Live CI checks

2026-07-25 12:51:20 +08:00

openai_quota_platform_contract_test.go

fix(openai): preserve quota platform in usage billing

2026-06-28 11:13:09 +08:00

openai_responses_failover_cancel_test.go

fix(gateway): 客户端断开后 failover 静默终止，不再误报 502 账号耗尽

2026-07-15 09:29:05 +08:00

openai_responses_image_intent_benchmark_test.go

优化 Responses 生图意图复用

2026-07-19 18:49:08 +08:00

openai_stream_validation_test.go

…

openai_stream_validation.go

…

ops_capture_writer_nil_test.go

修复 compact 心跳 writer 生命周期

2026-07-12 04:53:41 +08:00

ops_error_logger_attribution_test.go

fix: 过滤入口拒绝日志并强化鉴权边界

2026-07-18 00:11:18 +08:00

ops_error_logger_cyber_test.go

feat(openai): cyber_policy 硬阻断全链路透传、审计与计费

2026-06-12 01:47:01 +08:00

ops_error_logger_test.go

Merge pull request #4515 from BenjaminAaron196/feat/filter-noise-rejected-requests

2026-07-18 20:46:50 +08:00

ops_error_logger.go

Add composite group route registry

2026-07-23 09:20:18 +08:00

ops_ingress_reject_capture_test.go

fix: 过滤入口拒绝日志并强化鉴权边界

2026-07-18 00:11:18 +08:00

ops_platform_test.go

Harden composite group product surfaces

2026-07-23 09:19:25 +08:00

page_handler_test.go

…

page_handler.go

…

payment_handler_resume_test.go

fix(payment): 删除泄露内部 AI 渠道配置的废弃接口

2026-07-13 15:22:39 +08:00

payment_handler.go

feat(payment): add mobile Alipay precreate deep link

2026-07-22 19:18:04 +08:00

payment_webhook_handler_test.go

…

payment_webhook_handler.go

…

redeem_handler.go

…

request_body_limit_test.go

…

request_body_limit.go

fix(gateway): cap lenient json normalization

2026-07-09 11:15:52 +08:00

request_body_parse_log_test.go

fix(gateway): 记录请求体解析失败的真实原因，不再吞错

2026-07-07 13:53:39 +08:00

request_body_parse_log.go

fix(gateway): 记录请求体解析失败的真实原因，不再吞错

2026-07-07 13:53:39 +08:00

security_audit_errors_test.go

feat(security-audit): add OpenAI-compatible prompt auditing

2026-07-17 00:39:39 +08:00

security_audit_errors.go

feat(security-audit): add OpenAI-compatible prompt auditing

2026-07-17 00:39:39 +08:00

security_audit_helper_test.go

fix(security-audit): close prompt-audit bypass and privacy gaps

2026-07-17 08:46:57 +08:00

security_audit_helper.go

fix(security-audit): close prompt-audit bypass and privacy gaps

2026-07-17 08:46:57 +08:00

security_audit_media_submit_test.go

feat(security-audit): add OpenAI-compatible prompt auditing

2026-07-17 00:39:39 +08:00

security_audit_order_test.go

feat(security-audit): add OpenAI-compatible prompt auditing

2026-07-17 00:39:39 +08:00

setting_handler_public_test.go

…

setting_handler.go

fix(group): harden peak-rate config handling and label peak windows with server timezone

2026-07-02 16:11:07 +08:00

stream_error_event_test.go

…

stream_error_event.go

test: cover endpoint wildcard edge cases

2026-07-07 10:20:23 +08:00

subscription_handler.go

…

totp_handler.go

feat(security): gate admin role promotion behind step-up 2FA and harden admin TOTP verification

2026-07-16 16:49:08 +08:00

usage_handler_daily_test.go

…

usage_handler_request_type_test.go

fix: split Grok image and video pricing

2026-07-08 13:50:49 +08:00

usage_handler_sort_test.go

…

usage_handler.go

fix: split Grok image and video pricing

2026-07-08 13:50:49 +08:00

usage_record_submit_task_test.go

…

user_handler_test.go

fix(auth): 收紧注册别名查重（根点绕过 / 误拒 / 无界扫描 / 并发竞态）

2026-07-25 19:40:53 +08:00

user_handler.go

…

user_msg_queue_helper.go

…

user_platform_quotas_handler_test.go

…

wire.go

feat(ollama): 支持 Cloud 官方用量自动刷新

2026-07-23 15:50:44 +08:00