Skip to content

phsl / new-api

Go to a project
Switch branch/tag
  1. 24 Apr, 2026 5 commits
  3. 23 Apr, 2026 17 commits
  5. 22 Apr, 2026 7 commits
  7. 21 Apr, 2026 1 commit
  9. 19 Apr, 2026 1 commit
  11. 18 Apr, 2026 1 commit
  13. 17 Apr, 2026 8 commits
    • Merge pull request #4311 from KoellM/fix-gemini-3-toolconfig · 5b9dcf1b 
      fix(gemini): add IncludeServerSideToolInvocations field to ToolConfig
      Seefs committed
    • chore(docker-compose): set default redis password · d75a0467 
      Enable Redis requirepass in the compose template and embed the matching
credential in REDIS_CONN_STRING, aligning with the existing PostgreSQL
default password pattern so out-of-the-box deployments are not left with
an unauthenticated Redis instance.
      CaIon committed
    • feat(topup-log): add NODE_NAME env var for audit logs · 209645e2 
      Introduce NODE_NAME environment variable to identify node identity in top-up
audit logs, improving readability over auto-detected container internal IPs
in Docker/K8s deployments. Surface node_name in admin expanded log rows and
add it as a commented example to docker-compose.yml.
      CaIon committed
    • fix(topup-log): keep row expandable and warn admins on legacy logs · 6ff8c7ab 
      Top-up logs written by pre-upgrade instances have no admin_info, which
made the expanded row empty and the row un-expandable. For admins, always
emit an entry: either the audit fields from admin_info when present, or a
warning prompting the operator to upgrade the instance so audit fields
(server IP, callback IP, payment method, system version) are recorded.
      CaIon committed
    • fix(log): hide admin identity in user-visible management logs · c31343ac 
      Admin username/ID was embedded directly into the log Content for
quota changes and forced 2FA disable, leaking the operator's
identity to the target user via their own usage log page.

Move operator info into Other.admin_info so formatUserLogs strips
it for non-admin viewers, and render it in the expand panel only
for admins as "操作管理员".

Closes #4301
      CaIon committed
    • fix(topup): harden top-up search against DoS and cap user queries to 30 days · b2e62a44 
      Apply the same LIKE sanitization used for token search to SearchUserTopUps
and SearchAllTopUps (reject %%, cap % count, require >=2 stripped chars,
use ESCAPE '!') and bound COUNT with a 10000-row hard limit to avoid
unbounded full-table scans.

Also restrict user-facing list and search (GetUserTopUps, SearchUserTopUps)
to records within the last 30 days via create_time. Admin endpoints
(GetAllTopUps, SearchAllTopUps) remain unrestricted.
      CaIon committed
    • fix(user): invalidate user and token caches when disabling user · 92534262 
      When an admin disables/deletes/promotes/demotes a user via ManageUser,
explicitly evict the user cache and all of the user's token caches from
Redis. This prevents a disabled user from continuing to make successful
API requests until the user cache TTL expires, and ensures subsequent
requests reload fresh status from the database.
      CaIon committed
    • feat(topup): add admin-only audit info to top-up logs · 209d90e8 
      Thread caller IP from webhook/admin controllers through model recharge
functions and record a new RecordTopupLog entry with admin_info (server
IP, caller IP, order payment method, callback payment method, system
version). Frontend shows these fields in the expanded log row and the
IP column for admins on top-up logs, while non-admins continue to see
admin_info stripped by formatUserLogs.
      CaIon committed