Fix/2fa require password#5775
Closed
z23cc wants to merge 41 commits into
Closed
Conversation
Add local Docker stack script for one-command builds.
…al fallback and visibility rules
# Conflicts: # .gitignore
- 新增批量导入功能（classic/default双主题） - 支持 余额<Tab>密钥 格式，每行一条 - 自动命名：YYYYMMDDHHmm-余额-标签 - 自动使用Claude默认模型 - 逐条创建，实时显示进度和结果 - 创建渠道默认类型从OpenAI(1)改为Anthropic Claude(14) - docker-local.sh 默认前端主题改为classic
…x docker build OOM
…ild solely for GHCR
Usage log Excel export: - backend export service (service/usage_log_export) with field groups, streaming XLSX (auto multi-sheet), admin/self field filtering, and other_json redaction; cache fields exported as independent columns - new routes: /api/log[/self]/export_fields and /api/log[/self]/export - default + classic frontends: field-selection export dialog beside the column-settings button (basic / cache / advanced groups, per-field checkboxes), with i18n for all locales Cost report: - cost report templates / runs / snapshots models and migrations - cost_report controller + service (aggregation, classification, config, manual cells, Excel export) and classic UI (jspreadsheet preview/export) Co-Authored-By: Claude Opus 4.8 (1M context) <noreply@anthropic.com>
…0608 # Conflicts: # Dockerfile # middleware/distributor.go # relay/channel/claude/constants.go # router/api-router.go # setting/ratio_setting/cache_ratio.go # setting/ratio_setting/model_ratio.go # web/bun.lock # web/classic/bun.lock # web/classic/vite.config.js # web/default/src/features/usage-logs/components/usage-logs-mobile-card.tsx # web/default/src/i18n/locales/en.json # web/default/src/i18n/locales/fr.json # web/default/src/i18n/locales/ja.json # web/default/src/i18n/locales/ru.json # web/default/src/i18n/locales/vi.json # web/default/src/i18n/locales/zh.json
2FA management endpoints were gated only by UserAuth(), so a stolen session cookie alone could self-enroll a 2FA, pass secure verification, and disable it again — bypassing the secure-verification gate protecting sensitive actions (e.g. viewing channel keys). Add verifyAccountPasswordForTwoFA() and require the account password on /api/user/2fa/setup, /enable and /disable (accounts without a password, e.g. OAuth-only, are skipped to avoid lockout). Classic frontend now prompts for the password before setup and on disable. Co-Authored-By: Claude Opus 4.8 (1M context) <noreply@anthropic.com>
Contributor
|
Caution Review failedThe pull request is closed. ℹ️ Recent review info⚙️ Run configurationConfiguration used: Organization UI Review profile: CHILL Plan: Pro Run ID: ⛔ Files ignored due to path filters (2)
📒 Files selected for processing (135)
WalkthroughThis PR introduces four major new systems: a channel preparation pool with configurable auto-promotion scheduling, a cost report template/preview/export system with formula and classification engines, a hierarchical navigation menu system with RBAC visibility, and usage log XLSX export. It also adds channel key query reporting, 2FA password verification, channel affinity usability validation, Claude file type handling improvements, model ratio backfilling for ChangesCI/Docker Infrastructure
Channel Preparation Pool & Auto-Promotion
Cost Report System
Navigation System
Feature Additions
Sequence Diagram(s)sequenceDiagram
participant Scheduler as AutoPromotion Scheduler
participant RunFn as RunChannelPreparationAutoPromotion
participant DB as Database
participant Preparation as ChannelPreparation
participant ChannelCache as Channel Cache
Scheduler->>RunFn: trigger="scheduler"
RunFn->>RunFn: TryLock (reject if already running)
loop per configured rule
RunFn->>DB: compute effective capacity (enabled channels balance - used quota)
RunFn->>DB: compute count deficit vs MinimumUsableChannelCount
alt shortage detected
RunFn->>DB: load pending preparations (group/type/balance filter)
RunFn->>RunFn: chooseCandidate (SmallBalance/LargeBalance/PriorityWeighted)
RunFn->>Preparation: promoteChannelPreparation (DB transaction)
Preparation->>DB: lock row, status→promoting, create channels, delete preparation
Preparation-->>RunFn: channelID
RunFn->>ChannelCache: InitChannelCache + ResetProxyClientCache
else no shortage or no candidate
RunFn->>RunFn: break rule loop
end
end
RunFn-->>Scheduler: RunSummary (promotions, limit_reached)
Estimated code review effort🎯 5 (Critical) | ⏱️ ~180+ minutes Possibly related PRs
Suggested labels
Suggested reviewers
Poem
✨ Finishing Touches🧪 Generate unit tests (beta)
⚔️ Resolve merge conflicts
Warning There were issues while running some tools. Please review the errors and either fix the tool's configuration or disable the tool if it's a critical failure. 🔧 ast-grep (0.44.0)web/classic/src/components/table/channels/modals/EditChannelModal.jsxThanks for using CodeRabbit! It's free for OSS, and your support helps us grow. If you like it, consider giving us a shout-out. Comment |
This file contains hidden or bidirectional Unicode text that may be interpreted or compiled differently than what appears below. To review, open the file in an editor that reveals hidden Unicode characters.
Learn more about bidirectional Unicode characters
Sign up for free
to join this conversation on GitHub.
Already have an account?
Sign in to comment
1 participant
Add this suggestion to a batch that can be applied as a single commit.This suggestion is invalid because no changes were made to the code.Suggestions cannot be applied while the pull request is closed.Suggestions cannot be applied while viewing a subset of changes.Only one suggestion per line can be applied in a batch.Add this suggestion to a batch that can be applied as a single commit.Applying suggestions on deleted lines is not supported.You must change the existing code in this line in order to create a valid suggestion.Outdated suggestions cannot be applied.This suggestion has been applied or marked resolved.Suggestions cannot be applied from pending reviews.Suggestions cannot be applied on multi-line comments.Suggestions cannot be applied while the pull request is queued to merge.Suggestion cannot be applied right now. Please check back later.
Important
📝 变更描述 / Description
(简述：做了什么？为什么这样改能生效？请基于你对代码逻辑的理解来写，避免粘贴未经整理的内容)
🚀 变更类型 / Type of change
🔗 关联任务 / Related Issue
✅ 提交前检查项 / Checklist
Bug fix，我已提交或关联对应 Issue，且不会将设计取舍、预期不一致或理解偏差直接归类为 bug。📸 运行证明 / Proof of Work
(请在此粘贴截图、关键日志或测试报告，以证明变更生效)
Summary by CodeRabbit
New Features
Bug Fixes