feat(pricing): add price field to pricing API response - #2816
Closed
zhaolion wants to merge 40 commits into
Closed
Conversation
Add new channel type (57) for StreamLake integration with URL path handling that trims the /v1 prefix from request URLs. 🤖 Generated with [Claude Code](https://claude.com/claude-code) Co-Authored-By: Claude <noreply@anthropic.com>
Add a new docker job to build and push images to ghcr.io/zhaolion/newapi:{tag}
when tags are pushed, running in parallel with existing release jobs.
🤖 Generated with [Claude Code](https://claude.com/claude-code)
Co-Authored-By: Claude <noreply@anthropic.com>
Remove deprecated workflow files that are no longer needed: - docker-image-alpha.yml (alpha Docker builds) - docker-image-arm64.yml (multi-arch Docker builds, now handled by release workflow) - electron-build.yml (Electron app builds) - sync-to-gitee.yml (Gitee release sync) 🤖 Generated with [Claude Code](https://claude.com/claude-code) Co-Authored-By: Claude <noreply@anthropic.com>
- Add repository name normalization to lowercase for GHCR compatibility - Replace hardcoded image path with dynamic $GITHUB_REPOSITORY - Add metadata extraction for proper image labels - Add latest tag alongside version tag 🤖 Generated with [Claude Code](https://claude.com/claude-code) Co-Authored-By: Claude <noreply@anthropic.com>
Remove macOS and Windows build jobs to simplify the release workflow, keeping only Linux binary builds and Docker image publishing. 🤖 Generated with [Claude Code](https://claude.com/claude-code) Co-Authored-By: Claude <noreply@anthropic.com>
… image handling # Conflicts: # go.mod # go.sum # relay/channel/ali/dto.go # relay/channel/ali/image_wan.go
…d payments in Stripe
- Update Stripe-Version header to 2025-03-31.basil - Reorder managed_payments parameter after headers setup - Remove StripeAutoTaxEnabled feature and related code - Change STRIPE_MANAGED_PAYMENTS_ENABLED default to false Co-Authored-By: Claude <noreply@anthropic.com>
fix: update Stripe managed payments configuration and disable auto-tax
Add a dedicated test endpoint mapping that includes rerank endpoint for channel testing purposes, separate from the main endpoint defaults. Co-Authored-By: Claude <noreply@anthropic.com>
feat: add separate test endpoint defaults for channel testing
…payments by default - Add /v1/rerank endpoint detection for rerank models in channel testing - Change STRIPE_MANAGED_PAYMENTS_ENABLED default from true to false Co-Authored-By: Claude <noreply@anthropic.com>
feat: add rerank model endpoint detection and disable Stripe managed payments by default
feat: enhance channel testing with extended model type detection
* feat: enhance channel testing with extended model type detection - Exclude image edit models from testing (not supported) - Add endpoint type tracking for embeddings and rerank models - Add image generation detection for qwen and gpt image models - Add response endpoint detection for gpt-5.2 models Co-Authored-By: Claude <noreply@anthropic.com> * feat: add kwai-kolors image generation model detection Add endpoint detection for kwai-kolors image generation models to use /v1/images/generations endpoint during channel testing. Co-Authored-By: Claude <noreply@anthropic.com> * fix: exclude rerank models from embedding detection in channel test Rerank models like BAAI/bge-reranker-v2-m3 contain "bge-" in their name and were incorrectly matched as embedding models. This fix ensures rerank models are properly routed to the /v1/rerank endpoint. Co-Authored-By: Claude <noreply@anthropic.com> --------- Co-authored-by: Claude <noreply@anthropic.com>
* feat: implement oauth * chore: modify image * fix: make error message consistent add avoid magic number * chore: clean unused env * chore: clean again * feat(oauth): oauth client * feat(ui): oauth test * feat(oauth): implement oauth clients * fix: clean local yaml
feat: integrate Pyroscope for performance monitoring (#9)
- Add registration link on OAuth login page with login_challenge param - Handle login_challenge in RegisterForm to redirect back to OAuth flow - Auto-create default token on consent when tokens:write scope granted Co-Authored-By: Claude Opus 4.5 <noreply@anthropic.com>
Ensure tokens:write is both requested by client AND granted by user before auto-creating default token, preventing scope escalation attacks. Co-Authored-By: Claude Opus 4.5 <noreply@anthropic.com>
…-flow Feature/oauth registration flow
- Change Hydra proxy to redirect /oauth/login to /register - Make AuthRedirect OAuth-aware to not redirect when login_challenge present - Add OAuth session check in RegisterForm to auto-continue for logged-in users This improves the OAuth UX by showing registration first for new users, while existing users can click to login or are auto-redirected if already logged in. Co-Authored-By: Claude Opus 4.5 <noreply@anthropic.com>
feat(oauth): redirect to register page first in OAuth flow
- Add comprehensive request context (method, path, query, client IP, request ID) - Include request body with truncation for large payloads - Add full stack trace for debugging - Use common.GetRequestBody() helper for consistent body retrieval
Include operation_setting.Price in the GetPricing endpoint response to expose pricing configuration to clients.
Contributor
|
Caution Review failedThe pull request is closed. WalkthroughIntroduces comprehensive OAuth/Hydra integration for third-party application authorization, adds Pyroscope profiling support, modernizes Docker-based release workflows, integrates Ali-Qwen image generation endpoints, and updates dependencies including Stripe v83. Frontend gains OAuth login/consent flows and OAuth client management interface. Changes
Sequence Diagram(s)sequenceDiagram
participant User as User Agent
participant App as New-API Frontend
participant API as New-API Backend
participant Hydra as Hydra Server
participant DB as Database
User->>App: Click "Authorize" on 3rd-party app
App->>Hydra: Redirect to /oauth/login?login_challenge=X
Hydra->>User: Display login form
User->>Hydra: Submit username/password
Hydra->>API: POST /api/oauth/login<br/>(with login_challenge)
API->>DB: Validate credentials
DB-->>API: User ID
API->>Hydra: AcceptLogin(challenge, userID)
Hydra-->>API: Redirect to consent
API-->>User: Redirect to /oauth/consent
User->>App: Shown consent page with scopes
User->>App: Click "Approve"
App->>API: POST /api/oauth/consent<br/>(with challenge & scopes)
API->>Hydra: AcceptConsent(challenge, scopes)
Hydra-->>API: Redirect to 3rd-party app
API-->>User: Redirect to callback URL<br/>with authorization code
User->>Hydra: Exchange code for token
Hydra->>DB: Validate code
DB-->>Hydra: Authorization valid
Hydra-->>User: Return access_token
Estimated code review effort🎯 4 (Complex) | ⏱️ ~60 minutes Possibly related PRs
Suggested labels
Suggested reviewers
Poem
✨ Finishing touches
🧪 Generate unit tests (beta)
Thanks for using CodeRabbit! It's free for OSS, and your support helps us grow. If you like it, consider giving us a shout-out. Comment |
There was a problem hiding this comment.
Copilot reviewed 72 out of 73 changed files in this pull request and generated 10 comments.
💡 Add Copilot custom instructions for smarter, more guided reviews. Learn how to get started.
| "usable_group": usableGroup, | ||
| "supported_endpoint": model.GetSupportedEndpointMap(), | ||
| "auto_groups": service.GetUserAutoGroup(group), | ||
| "price": operation_setting.Price, |
There was a problem hiding this comment.
This is the only change that matches the PR title and description. All other changes in this PR implement a complete OAuth 2.0 provider system which is not mentioned in the PR description. This represents a massive scope creep and should either be:
- Split into separate PRs (recommended)
- The PR title and description should be completely rewritten to accurately reflect the OAuth implementation
The current PR description is misleading and makes code review extremely difficult.
| HttpOnly: true, | ||
| Secure: false, | ||
| SameSite: http.SameSiteStrictMode, | ||
| SameSite: http.SameSiteLaxMode, // Lax allows OAuth redirect flows while preventing CSRF |
There was a problem hiding this comment.
This change modifies the SameSite cookie policy from Strict to Lax. While the comment explains this is for OAuth redirect flows, this is a security-relevant change that should be explicitly documented in the PR description and carefully reviewed. SameSite=Lax allows cookies to be sent in top-level navigation from external sites, which enables OAuth flows but also slightly weakens CSRF protection.
Comment on lines
+19
to
+23
| "/oauth2/fallbacks/login": "/register", | ||
| "/oauth2/fallbacks/consent": "/oauth/consent", | ||
| "/oauth2/fallbacks/logout": "/oauth/logout", | ||
| // Configured OAuth paths - redirect login to register page | ||
| "/oauth/login": "/register", |
There was a problem hiding this comment.
The redirect path mapping shows that /oauth/login redirects to /register instead of /oauth/login. This means all OAuth login attempts will be redirected to the registration page. This appears to be intentional based on the comment "redirect login to register page", but this is unusual OAuth behavior and may confuse users who already have accounts. Consider providing a clearer path for existing users to login during OAuth flows.
Comment on lines
+2110
to
+2111
| "已发起跳转，请返回应用完成登录": "已发起跳转，请返回应用完成登录", | ||
| "已发起跳转，请返回应用完成登录": "已发起跳转，请返回应用完成登录", |
There was a problem hiding this comment.
The Chinese translation key appears twice at lines 2110 and 2111 with the same value. This is a duplication that should be removed.
| COPY --from=builder /build/dist ./web/dist | ||
| RUN go build -ldflags "-s -w -X 'github.com/QuantumNous/new-api/common.Version=$(cat VERSION)'" -o new-api | ||
|
|
||
| FROM oryd/hydra:v25.4.0 AS hydra |
There was a problem hiding this comment.
The Hydra version in the Dockerfile (v25.4.0) doesn't match the Go dependency version in go.mod (v2.2.1). This version mismatch could cause compatibility issues. Ensure these versions are compatible or update them to match.
Suggested change
| FROM oryd/hydra:v25.4.0 AS hydra | |
| FROM oryd/hydra:v2.2.1 AS hydra |
| #!/bin/sh | ||
| set -e | ||
|
|
||
| if [ "${HYDRA_ENABLED:-true}" = "true" ]; then |
There was a problem hiding this comment.
The entrypoint script has HYDRA_ENABLED defaulting to "true" if the environment variable is not set. This means Hydra will run by default even if users don't intend to use OAuth. Consider defaulting to "false" to avoid unexpected resource consumption and to make this opt-in rather than opt-out.
| For commercial licensing, please contact support@quantumnous.com | ||
| */ | ||
|
|
||
| import React, { useState } from 'react'; |
There was a problem hiding this comment.
Unused import useState.
Comment on lines
+41
to
+47
| import { | ||
| IconLink, | ||
| IconSave, | ||
| IconClose, | ||
| IconKey, | ||
| IconCopy, | ||
| } from '@douyinfe/semi-icons'; |
There was a problem hiding this comment.
Unused import IconCopy.
| const isMobile = useIsMobile(); | ||
| const formApiRef = useRef(null); | ||
| const isEdit = props.editingClient?.client_id !== undefined; | ||
| const [newClientSecret, setNewClientSecret] = useState(null); |
There was a problem hiding this comment.
Unused variable newClientSecret.
Comment on lines
+4
to
+6
| if [ "${HYDRA_ENABLED:-true}" = "true" ]; then | ||
| /usr/bin/hydra migrate sql -e --yes | ||
| /usr/bin/hydra serve all --dev & |
There was a problem hiding this comment.
This entrypoint starts ORY Hydra using hydra serve all --dev, which runs the OAuth provider in development mode even for this production image, enabling insecure defaults that are explicitly not safe outside local testing. If this container is deployed in a real environment, an attacker who can reach Hydra’s endpoints could abuse those relaxed settings (e.g., permissive redirect/CORS or weaker secret/TLS handling) to register arbitrary OAuth clients or otherwise weaken your authentication flows. Run Hydra with a proper production configuration (without --dev) and gate enabling Hydra behind explicit environment- or deployment-specific settings rather than a default-on flag.
Suggested change
| if [ "${HYDRA_ENABLED:-true}" = "true" ]; then | |
| /usr/bin/hydra migrate sql -e --yes | |
| /usr/bin/hydra serve all --dev & | |
| if [ "${HYDRA_ENABLED:-false}" = "true" ]; then | |
| /usr/bin/hydra migrate sql -e --yes | |
| /usr/bin/hydra serve ${HYDRA_SERVE_ARGS:-all} & |
This file contains hidden or bidirectional Unicode text that may be interpreted or compiled differently than what appears below. To review, open the file in an editor that reveals hidden Unicode characters.
Learn more about bidirectional Unicode characters
Sign up for free
to join this conversation on GitHub.
Already have an account?
Sign in to comment
Add this suggestion to a batch that can be applied as a single commit.This suggestion is invalid because no changes were made to the code.Suggestions cannot be applied while the pull request is closed.Suggestions cannot be applied while viewing a subset of changes.Only one suggestion per line can be applied in a batch.Add this suggestion to a batch that can be applied as a single commit.Applying suggestions on deleted lines is not supported.You must change the existing code in this line in order to create a valid suggestion.Outdated suggestions cannot be applied.This suggestion has been applied or marked resolved.Suggestions cannot be applied from pending reviews.Suggestions cannot be applied on multi-line comments.Suggestions cannot be applied while the pull request is queued to merge.Suggestion cannot be applied right now. Please check back later.
Summary
pricefield fromoperation_setting.Priceto the GetPricing endpoint responseTest plan
/api/pricingendpoint returns the newpricefield🤖 Generated with Claude Code
Summary by CodeRabbit
New Features
Infrastructure
Dependencies