feat: 元点流商 OriginFlow 二次开发 + 与 originflow 统一 web/src 前端

[peidunyue]

Summary

This PR delivers the OriginFlow (元点流商) secondary-development work and resolves the frontend directory conflict with the originflow branch by unifying on web/src as the single canonical frontend.

web/src unification (conflict resolution)

• web/src is now the single canonical frontend (matches our fork/upstream-main); originflow's divergent web/src additions and the unused date-fns-tz patch are dropped.
• Frontend builds and typechecks cleanly (bun run build + bun x tsgo -b).

Backend

• Kept originflow's self-contained additions: common/redirect.go (IsSafeRedirect), model/analytics_event.go, deploy/nginx/originflow.conf, and the OriginFlow SystemName branding in common/constants.go.
• Dropped service/public_site.go (referenced model helpers absent from our tree and was not wired into any router, so it did not compile).

Feature content included

• P1-01 API Quick Start developer onboarding page
• OriginFlow branding, marketing site, market-models storefront, sales-leads admin, etc.

Verification

• go build (CGO_ENABLED=0) passes
• bun run build passes
• bun x tsgo -b passes

Summary by CodeRabbit

• New Features
  • Added localized public marketing pages for pricing, solutions, models, quick start, and sales contact.
  • Added a public model marketplace and SLA status page.
  • Added administration for teams, distributors, regional routing, market models, and SLA incidents.
  • Added team and distributor billing, membership, project, pricing, and usage views.
  • Added regional routing based on request region and user preferences.
• Enhancements
  • Updated OriginFlow branding, logos, titles, and localized content.
  • Added safer redirects and improved deployment configuration.
• Bug Fixes
  • Improved dependency installation reliability during container builds.

[coderabbitai]

Walkthrough

OriginFlow adds regional channel routing, administration APIs and models, public marketing pages, model catalogs, SLA status, teams, distributors, deployment configuration, and frontend management pages.

Changes

Platform foundation

Layer / File(s)	Summary
Build, deployment, branding, and shared persistence .dockerignore, Dockerfile, docker-compose.yml, deploy/nginx/originflow.conf, common/..., constant/..., model/...	Builds use configurable npm registries and retries. Nginx serves the www, app, and api hosts. Shared models now support OriginFlow branding, team context, analytics events, and public-site initialization.

Regional routing

Layer / File(s)	Summary
Regional route resolution and channel selection model/region_route.go, model/channel_cache.go, model/ability.go, service/channel_select.go, model/region_route_test.go, service/channel_select_test.go	Regional policies resolve by normalized request region, cache results, score channels by strategy, filter candidates, and preserve fallback behavior when routing is inactive or unavailable.

Backend domains and APIs

Layer / File(s)	Summary
Administration and public API domains controller/*.go, model/{market_model,team,sla,distributor,public_site}*.go, router/*.go	Added CRUD and query APIs for market models, teams, SLA incidents, region routes, and distributors. Added public pricing, model categories, sales leads, market catalogs, and SLA status endpoints.

Frontend features

Layer / File(s)	Summary
Public marketing and administration interfaces web/src/features/{marketing,market-models,region-routes,sla-incidents,teams,distributors}/...	Added localized marketing pages, public model and pricing views, and administration interfaces with typed APIs, validation, tables, responsive lists, dialogs, drawers, billing tabs, and mutation flows.

Routing and host isolation

Layer / File(s)	Summary
Marketing host routing and page registration web/src/routes/..., web/src/lib/marketing-mode.ts, web/src/routeTree.gen.ts, web/src/hooks/use-sidebar-data.ts, web/src/i18n/locales/*.json	Added public and protected routes, marketing-mode host redirects, generated route metadata, Model Market navigation, and localized Model Market strings.

Estimated code review effort: 5 (Critical) | ~120 minutes

Possibly related PRs

• QuantumNous/new-api#5825: Overlaps with advanced channel selection and filtering in model/ability.go and model/channel_cache.go.
• QuantumNous/new-api#6405: Overlaps with request-specific channel selection and routing behavior.
• QuantumNous/new-api#6636: Overlaps with marketing pages, pricing, model catalogs, and frontend localization.

Poem

A rabbit sees routes bloom wide,
With models hopping side by side.
Teams and leads now join the flow,
While regions guide each channel’s go.
OriginFlow shines, both near and far—
A carrot-powered platform star.

🚥 Pre-merge checks | ✅ 4 | ❌ 1

❌ Failed checks (1 warning)

Check name	Status	Explanation	Resolution
Docstring Coverage	⚠️ Warning	Docstring coverage is 68.71% which is insufficient. The required threshold is 80.00%.	Write docstrings for the functions missing them to satisfy the coverage threshold.

✅ Passed checks (4 passed)

Check name	Status	Explanation
Description Check	✅ Passed	Check skipped - CodeRabbit’s high-level summary is enabled.
Title check	✅ Passed	标题准确概括了 OriginFlow 二次开发及统一使用 web/src 前端这两项主要变更。
Linked Issues check	✅ Passed	Check skipped because no linked issues were found for this pull request.
Out of Scope Changes check	✅ Passed	Check skipped because no linked issues were found for this pull request.

✨ Finishing Touches

🧪 Generate unit tests (beta)

• Create PR with unit tests

---

Thanks for using CodeRabbit! It's free for OSS, and your support helps us grow. If you like it, consider giving us a shout-out.

❤️ Share

• X
• Mastodon
• Reddit
• LinkedIn

_{Comment @coderabbitai help to get the list of available commands.}

Warning

⚠️ This pull request shows signs of AI-generated slop (redundant_comments). It has been flagged by CodeRabbit slop detection and should be reviewed carefully.

[coderabbitai]

Actionable comments posted: 2

Note

Due to the large number of review comments, Critical severity comments were prioritized as inline comments.

Caution

Some comments are outside the diff and can’t be posted inline due to platform limitations.

⚠️ Outside diff range comments (1)

web/src/routes/_authenticated/route.tsx (1)

25-40: 🔒 Security & Privacy | 🟠 Major | ⚡ Quick win

Limit the authentication bypass to the public models route.

isMarketingMode() is true when the request includes marketing=1. Lines 25-40 then bypass authentication for every _authenticated child route, not only /models.

Use location.pathname to allow the bypass only for /models and /models/. Keep authentication required for all other child routes. The root host redirect can remain an additional safeguard.

As per coding guidelines, “认证与权限必须在路由和接口层校验”。

🤖 Prompt for AI Agents

Verify each finding against current code. Fix only still-valid issues, skip the
rest with a brief reason, keep changes minimal, and validate.

In `@web/src/routes/_authenticated/route.tsx` around lines 25 - 40, Restrict the
isMarketingMode() authentication bypass in Route.beforeLoad to pathname values
exactly equal to /models or /models/. For all other _authenticated child routes,
continue through the existing auth.user and auth.accessToken check and redirect
to /sign-in when unauthenticated.

Source: Coding guidelines

🟠 Major comments (34)

model/analytics_event.go-13-15 (1)

13-15: 🔒 Security & Privacy | 🟠 Major | ⚡ Quick win

Remove query data before persisting URLs.

Path and Referrer can contain email addresses, invitation tokens, or reset tokens in query parameters. Normalize these values server-side and discard query and fragment data before storage.

🤖 Prompt for AI Agents

Verify each finding against current code. Fix only still-valid issues, skip the
rest with a brief reason, keep changes minimal, and validate.

In `@model/analytics_event.go` around lines 13 - 15, Normalize URL values assigned
to the Path and Referrer fields before persisting analytics events, removing all
query parameters and fragments while preserving the URL path. Apply this
server-side at the event handling or model persistence boundary, using the
existing URL parsing utilities if available.

Dockerfile-14-14 (1)

14-14: 🩺 Stability & Availability | 🟠 Major | ⚡ Quick win

Preserve the existing .npmrc settings.

Line 14 replaces the copied .npmrc file. A build that uses NPM_REGISTRY then loses scoped registry and authentication configuration.

Append the registry override instead of replacing the file.

Proposed fix

-RUN if [ -n "$NPM_REGISTRY" ]; then echo "registry=$NPM_REGISTRY" > .npmrc; fi \
+RUN if [ -n "$NPM_REGISTRY" ]; then printf '\nregistry=%s\n' "$NPM_REGISTRY" >> .npmrc; fi \

🤖 Prompt for AI Agents

Verify each finding against current code. Fix only still-valid issues, skip the
rest with a brief reason, keep changes minimal, and validate.

In `@Dockerfile` at line 14, Update the Dockerfile RUN command that handles
NPM_REGISTRY to append the registry override to the existing .npmrc instead of
overwriting it, preserving copied scoped registry and authentication settings
while retaining the conditional behavior.

model/main.go-295-313 (1)

295-313: 🗄️ Data Integrity & Integration | 🟠 Major | ⚡ Quick win

Migrate AnalyticsEvent before accepting analytics writes.

CreateAnalyticsEvent writes to the AnalyticsEvent model, but migrateDB()’s AutoMigrate() list omits &AnalyticsEvent{}. Add it so fresh deployments create analytics_events before analytics writes run.

🤖 Prompt for AI Agents

Verify each finding against current code. Fix only still-valid issues, skip the
rest with a brief reason, keep changes minimal, and validate.

In `@model/main.go` around lines 295 - 313, Add &AnalyticsEvent{} to the
AutoMigrate model list in migrateDB alongside the other persisted models,
ensuring the analytics_events table is created before CreateAnalyticsEvent
accepts writes.

model/region_route.go-171-181 (1)

171-181: 🩺 Stability & Availability | 🟠 Major | 🏗️ Heavy lift

Bound and actively evict routing-cache entries.

Line 171 includes modelName in the cache key. Lines 172-181 never delete expired entries. Requests with unique model names can grow regionRoutingCache without bound, even though entries have a TTL.

Use a size-bounded cache with expiry eviction. Do not retain unlimited request-derived keys.

🤖 Prompt for AI Agents

Verify each finding against current code. Fix only still-valid issues, skip the
rest with a brief reason, keep changes minimal, and validate.

In `@model/region_route.go` around lines 171 - 181, The region routing cache
around regionRoutingCache.Load and Store must enforce both a maximum size and
expiry eviction, rather than retaining expired request-derived modelName keys
indefinitely. Update the cache implementation and its use in the
routing-resolution flow to remove expired entries and evict entries when the
configured bound is reached, while preserving valid cached routing results.

model/public_site_seed.go-11-18 (1)

11-18: 🗄️ Data Integrity & Integration | 🟠 Major | 🏗️ Heavy lift

Make default pricing initialization safe for concurrent startup.

Two instances can both read pricingCount == 0 and insert the defaults. PublicPricing has separate indexes on plan_key and locale, but no composite uniqueness constraint. This can create duplicate public plans.

Add a unique (plan_key, locale) constraint and insert through an idempotent conflict-safe operation. Deduplicate existing rows in the migration path before enforcing the constraint.

🤖 Prompt for AI Agents

Verify each finding against current code. Fix only still-valid issues, skip the
rest with a brief reason, keep changes minimal, and validate.

In `@model/public_site_seed.go` around lines 11 - 18, Update defaultPublicPricings
initialization and its migration path: deduplicate existing PublicPricing rows
by (plan_key, locale), add a composite unique constraint for those columns, and
replace the unconditional DB.Create call with an idempotent conflict-safe
insert. Preserve existing pricing data while ensuring concurrent startups cannot
create duplicate plans.

model/region_route.go-21-22 (1)

21-22: 🎯 Functional Correctness | 🟠 Major | ⚡ Quick win

Define or remove RegionRoute.Weight.

Weight is accepted by the region route API and stored in RegionRoute, but RegionRouting does not carry it and channel selection only uses the RegionRouting.AllowedIds, Strategy, and Priority. Users can save a route weight with no routing effect; add and test the intended weighting behavior, or remove it from the model and API.

🤖 Prompt for AI Agents

Verify each finding against current code. Fix only still-valid issues, skip the
rest with a brief reason, keep changes minimal, and validate.

In `@model/region_route.go` around lines 21 - 22, Remove RegionRoute.Weight from
the model and API unless weighting is implemented end to end; otherwise
propagate it through RegionRouting and channel selection with tests covering its
effect. Ensure RegionRoute no longer accepts or stores an ignored weight value.

deploy/nginx/originflow.conf-143-145 (1)

143-145: 🎯 Functional Correctness | 🟠 Major | ⚡ Quick win

Allow the regional routing request header in CORS.

Third-party browser clients that send X-Region trigger a preflight request. The current Access-Control-Allow-Headers value rejects that request. Add X-Region to the allowlist.

🤖 Prompt for AI Agents

Verify each finding against current code. Fix only still-valid issues, skip the
rest with a brief reason, keep changes minimal, and validate.

In `@deploy/nginx/originflow.conf` around lines 143 - 145, Update the
Access-Control-Allow-Headers directive to include X-Region alongside the
existing Authorization and Content-Type headers, preserving the current CORS
configuration and always behavior.

model/user.go-1435-1437 (1)

1435-1437: 🎯 Functional Correctness | 🟠 Major | ⚡ Quick win

Use commonGroupCol for the reserved group column.

group is a reserved SQL keyword in MySQL. This raw select list can fail on a required MySQL deployment. Build the select list with commonGroupCol instead of the bare identifier.

As per coding guidelines, “When raw SQL is unavoidable, account for dialect-specific quoting and values; use commonGroupCol ... for reserved columns.”

🤖 Prompt for AI Agents

Verify each finding against current code. Fix only still-valid issues, skip the
rest with a brief reason, keep changes minimal, and validate.

In `@model/user.go` around lines 1435 - 1437, Update the raw select list in the
query building the user items to use the existing commonGroupCol symbol for the
reserved group column instead of the bare group identifier, while preserving the
other selected columns and query behavior.

Source: Coding guidelines

deploy/nginx/originflow.conf-19-22 (1)

19-22: 🩺 Stability & Availability | 🟠 Major | ⚡ Quick win

Use certificate paths that match the documented Certbot command.

A fresh deployment creates one certificate lineage for this multi-domain command, normally named www.91flow.com. It does not create the app.91flow.com and api.91flow.com lineages referenced at Lines 102-103 and Lines 131-132.

Use the www.91flow.com certificate path in all three TLS blocks, or issue three explicitly named certificates. Otherwise Nginx cannot load the app and API server blocks.

🤖 Prompt for AI Agents

Verify each finding against current code. Fix only still-valid issues, skip the
rest with a brief reason, keep changes minimal, and validate.

In `@deploy/nginx/originflow.conf` around lines 19 - 22, Update the certificate
paths in all three TLS server blocks to use the single Certbot lineage
`/etc/letsencrypt/live/www.91flow.com/` for both fullchain.pem and privkey.pem,
matching the documented multi-domain command and replacing the app- and
api-specific lineage references.

model/channel_cache.go-268-270 (1)

268-270: 🎯 Functional Correctness | 🟠 Major | ⚡ Quick win

Enforce active regional allowlists consistently.

Both selection paths restore excluded channels when an active route has no eligible allowlisted candidate. This bypasses the regional policy. Return no candidate instead. Configure an explicit fallback route when availability fallback is required.

• model/channel_cache.go#L268-L270: return the empty filtered set instead of channels.
• model/ability.go#L171-L173: preserve the empty allowlist result instead of restoring abilities.
• model/region_route_test.go#L131-L133: expect no cached candidate for an empty allowlist intersection.
• model/region_route_test.go#L154-L156: expect no database-backed ability for an empty allowlist intersection.

🤖 Prompt for AI Agents

Verify each finding against current code. Fix only still-valid issues, skip the
rest with a brief reason, keep changes minimal, and validate.

In `@model/channel_cache.go` around lines 268 - 270, Enforce active regional
allowlists by preserving empty results instead of restoring excluded candidates:
in model/channel_cache.go lines 268-270, return filtered; in model/ability.go
lines 171-173, preserve the empty allowlist result rather than abilities; update
model/region_route_test.go lines 131-133 to expect no cached candidate and lines
154-156 to expect no database-backed ability for empty allowlist intersections.
Configure an explicit fallback route where availability fallback is required.

controller/distributor.go-230-235 (1)

230-235: 🗄️ Data Integrity & Integration | 🟠 Major | ⚡ Quick win

Bind the price update to the parent distributor.

The handler reads price_id only. model.UpdateDistributorPrice filters by id alone. A request to /admin/distributors/1/prices/99 therefore updates a price row that belongs to distributor 2. The same applies to DeleteDistributorPrice. Parse the :id path parameter and pass it as an additional filter.

🤖 Prompt for AI Agents

Verify each finding against current code. Fix only still-valid issues, skip the
rest with a brief reason, keep changes minimal, and validate.

In `@controller/distributor.go` around lines 230 - 235, Update
UpdateDistributorPrice and DeleteDistributorPrice to parse the parent
distributor path parameter (:id) and pass it alongside priceId to
model.UpdateDistributorPrice or the corresponding delete operation. Ensure both
operations filter by distributor ID and price ID so prices belonging to another
distributor cannot be modified.

router/p2-router.go-41-43 (1)

41-43: 🩺 Stability & Availability | 🟠 Major | ⚡ Quick win

Add rate limiting to the public SLA endpoints.

Both routes are anonymous. GetPublicSlaStatus runs an aggregation over a window of up to 720 hours, so repeated anonymous calls can load the database. The comparable public endpoints in router/api-router.go apply middleware.CriticalRateLimit(). Apply it here, or cache the summary.

🤖 Prompt for AI Agents

Verify each finding against current code. Fix only still-valid issues, skip the
rest with a brief reason, keep changes minimal, and validate.

In `@router/p2-router.go` around lines 41 - 43, Apply
middleware.CriticalRateLimit() to both anonymous SLA routes, /sla/incidents and
/sla/status, in the router registration alongside
controller.GetPublicSlaIncidents and controller.GetPublicSlaStatus. Match the
middleware usage in router/api-router.go and preserve the existing handlers.

controller/public_site.go-34-38 (1)

34-38: 🔒 Security & Privacy | 🟠 Major | ⚡ Quick win

Do not return raw database errors on public endpoints.

err.Error() exposes driver and schema details to anonymous callers. Log the error and return a generic message, or use common.ApiError, which the other new controllers use.

Also applies to: 46-51

🤖 Prompt for AI Agents

Verify each finding against current code. Fix only still-valid issues, skip the
rest with a brief reason, keep changes minimal, and validate.

In `@controller/public_site.go` around lines 34 - 38, Update the database error
handling in the controller methods containing the model.DB queries to avoid
exposing err.Error() through public API responses. Log the underlying error for
server-side diagnostics and return a generic client-safe message, applying the
same behavior to both referenced error branches.

model/distributor.go-95-105 (1)

95-105: 🗄️ Data Integrity & Integration | 🟠 Major | ⚡ Quick win

Reused GORM query chains between Count and Find. Each listing builds one *gorm.DB, calls the Count finisher, then reuses the same chain for Find. GORM treats chain reuse after a finisher as unsafe, because clauses from the first statement can leak into the second. Create a new session for the second statement in each listing.

• model/distributor.go#L95-L105: in SearchDistributors, derive the paged query from q.Session(&gorm.Session{}) before Order/Offset/Limit/Find.
• model/team.go#L67-L77: in ListTeams, apply the same session split before the paged Find.
• model/team.go#L114-L121: in ListTeamMembers, apply the same session split before the paged Find.

🤖 Prompt for AI Agents

Verify each finding against current code. Fix only still-valid issues, skip the
rest with a brief reason, keep changes minimal, and validate.

In `@model/distributor.go` around lines 95 - 105, Split the GORM query session
after counting to prevent finisher-state reuse: in SearchDistributors
(model/distributor.go:95-105), ListTeams (model/team.go:67-77), and
ListTeamMembers (model/team.go:114-121), derive the paginated query from
q.Session(&gorm.Session{}) before applying ordering, pagination, and Find; leave
the count query unchanged.

model/distributor.go-175-182 (1)

175-182: 🗄️ Data Integrity & Integration | 🟠 Major | ⚡ Quick win

DistributorBilling.DistributorId receives a user id.

GetDistributorBilling takes distributorUserId and assigns it to DistributorId. The controller passes d.UserId, so the field returned to the frontend holds the owner account id, not the distributor id. Any client that correlates billing with a distributor row will match the wrong record. Pass the distributor id explicitly, or rename the response field.

🤖 Prompt for AI Agents

Verify each finding against current code. Fix only still-valid issues, skip the
rest with a brief reason, keep changes minimal, and validate.

In `@model/distributor.go` around lines 175 - 182, Update GetDistributorBilling to
distinguish the distributor identifier from distributorUserId: obtain or pass
the actual distributor id explicitly and assign that value to
DistributorBilling.DistributorId, while retaining distributorUserId for querying
sub-users. Update its callers, including the controller using d.UserId, so the
response field identifies the distributor record rather than the owner account.

controller/distributor.go-247-254 (1)

247-254: 🗄️ Data Integrity & Integration | 🟠 Major | ⚡ Quick win

Validate model and prices in UpdateDistributorPrice.

CreateDistributorPrice rejects an empty model and negative prices. UpdateDistributorPrice does not. model.UpdateDistributorPrice writes model, input_price, and output_price unconditionally, so a request can clear the model name or store a negative price on a billing record.

🛡️ Proposed fix

+	if req.Model == "" {
+		common.ApiErrorMsg(c, "model is required")
+		return
+	}
+	if req.InputPrice < 0 || req.OutputPrice < 0 {
+		common.ApiErrorMsg(c, "prices must be >= 0")
+		return
+	}
 	if !model.AllowedDistributorPriceCurrencies[req.Currency] {
 		common.ApiErrorMsg(c, "invalid currency (expected CNY|USD)")
 		return
 	}

🤖 Prompt for AI Agents

Verify each finding against current code. Fix only still-valid issues, skip the
rest with a brief reason, keep changes minimal, and validate.

In `@controller/distributor.go` around lines 247 - 254, Update
UpdateDistributorPrice to apply the same validation as CreateDistributorPrice:
reject an empty req.Model and any negative input or output price before calling
model.UpdateDistributorPrice. Preserve the existing currency and unit
validation, and return through common.ApiErrorMsg for invalid requests.

controller/region_route.go-112-130 (1)

112-130: 🗄️ Data Integrity & Integration | 🟠 Major | ⚡ Quick win

Apply the create-time normalization in UpdateRegionRoute.

CreateRegionRoute requires a non-empty region and converts an empty model to "*". The update handler does neither, so an update can store an empty region or an empty model. Routes stored that way no longer match the wildcard convention used at creation. Also note that an omitted enabled field resets the route to enabled, which silently re-enables a disabled route.

🐛 Proposed fix

+	if req.Region == "" {
+		common.ApiErrorMsg(c, "region is required")
+		return
+	}
+	if req.Model == "" {
+		req.Model = "*"
+	}
 	if !model.AllowedRegionRouteStrategies[req.Strategy] {

🤖 Prompt for AI Agents

Verify each finding against current code. Fix only still-valid issues, skip the
rest with a brief reason, keep changes minimal, and validate.

In `@controller/region_route.go` around lines 112 - 130, Apply the same
normalization used by CreateRegionRoute in UpdateRegionRoute: reject an empty
req.Region and convert an empty req.Model to the wildcard value "*" before
constructing model.RegionRoute. Preserve the existing Enabled value when
req.Enabled is omitted instead of defaulting it to true, while still applying an
explicitly provided enabled value.

controller/public_site.go-102-108 (1)

102-108: 🔒 Security & Privacy | 🟠 Major | ⚡ Quick win

Reuse common.IsSafeRedirect(req.Redirect).

The local check keeps the local safeRedirect string and rejects valid relative redirects containing :, while bypassing the shared parsed-URL whitelist for http/https targets. Use the shared helper instead.

🤖 Prompt for AI Agents

Verify each finding against current code. Fix only still-valid issues, skip the
rest with a brief reason, keep changes minimal, and validate.

In `@controller/public_site.go` around lines 102 - 108, Replace the local redirect
validation in the surrounding handler with common.IsSafeRedirect(req.Redirect),
and assign its result to safeRedirect while preserving the existing
empty/default behavior. Remove the duplicated strings-based checks so redirects
follow the shared helper’s parsed-URL whitelist, including valid relative paths
and permitted http/https targets.

web/src/features/region-routes/components/channel-multi-select.tsx-45-50 (1)

45-50: 🎯 Functional Correctness | 🟠 Major | 🏗️ Heavy lift

Do not limit selectable channels to the first 1,000 records.

This query loads only one page. Channels after that page cannot be selected for a region route. Add server-side search or pagination, and resolve already-selected channel IDs separately.

🤖 Prompt for AI Agents

Verify each finding against current code. Fix only still-valid issues, skip the
rest with a brief reason, keep changes minimal, and validate.

In `@web/src/features/region-routes/components/channel-multi-select.tsx` around
lines 45 - 50, Update the channel-loading query in the channel multi-select
component so it does not assume the first 1,000 channels are sufficient. Add
server-side search or pagination for selectable channels, and separately resolve
already-selected channel IDs so existing selections remain available even when
outside the current result page.

controller/team.go-47-55 (1)

47-55: 🎯 Functional Correctness | 🟠 Major | ⚡ Quick win

Validate team and project names by character count.

len(req.Name) counts UTF-8 bytes. It rejects valid non-ASCII names before the stated 64-character limit.

• controller/team.go#L47-L55: use a character-aware count before creating a team.
• controller/team.go#L199-L203: use the same character-aware count before creating a team project.

🤖 Prompt for AI Agents

Verify each finding against current code. Fix only still-valid issues, skip the
rest with a brief reason, keep changes minimal, and validate.

In `@controller/team.go` around lines 47 - 55, Replace the byte-based
len(req.Name) validation with a character-aware count in the team creation
validation at controller/team.go lines 47-55 and the team project creation
validation at controller/team.go lines 199-203. Apply the same
character-counting approach at both sites while preserving the existing
required-name and 64-character limit behavior.

web/src/features/teams/components/teams-mutate-drawer.tsx-94-117 (1)

94-117: 🎯 Functional Correctness | 🟠 Major | ⚡ Quick win

Handle unsuccessful API responses as failures.

A success: false mutation leaves the drawer open without feedback. A success: false billing response becomes null, then renders as zero quota and usage.

• web/src/features/teams/components/teams-mutate-drawer.tsx#L94-L117: show the localized server error when the mutation response is unsuccessful.
• web/src/features/teams/components/team-billing-tab.tsx#L35-L67: propagate the failed response as a query error and render an error state instead of zero billing values.

As per coding guidelines, “服务端错误统一使用 handleServerError；错误提示使用 i18n，统一通过 toast.error 等方式展示。”

🤖 Prompt for AI Agents

Verify each finding against current code. Fix only still-valid issues, skip the
rest with a brief reason, keep changes minimal, and validate.

In `@web/src/features/teams/components/teams-mutate-drawer.tsx` around lines 94 -
117, Handle unsuccessful mutation responses in teams-mutate-drawer.tsx within
onSubmit by passing the server error through handleServerError and displaying
the localized message with toast.error, while preserving the submitting-state
cleanup. In team-billing-tab.tsx, propagate unsuccessful billing responses as
query errors rather than converting them to null, and render the query error
state instead of zero quota and usage; apply the changes at
web/src/features/teams/components/teams-mutate-drawer.tsx:94-117 and
web/src/features/teams/components/team-billing-tab.tsx:35-67.

Source: Coding guidelines

web/src/features/sla-status/index.tsx-54-68 (1)

54-68: 🎯 Functional Correctness | 🟠 Major | ⚡ Quick win

Do not render failed SLA status responses as healthy data.

getPublicSlaStatus() currently accepts success: false responses when data exists, so lines 113, 124, 136, and 146 can show availability, incident/node counts, and window metadata from a failed request. Throw the business-failure response and handle SLA query errors instead.

🤖 Prompt for AI Agents

Verify each finding against current code. Fix only still-valid issues, skip the
rest with a brief reason, keep changes minimal, and validate.

In `@web/src/features/sla-status/index.tsx` around lines 54 - 68, Update the
statusData queryFn around getPublicSlaStatus to detect unsuccessful responses
and throw the business-failure response before returning data, so failed
responses never render as healthy SLA data. Add error handling for the SLA
status query and preserve the existing successful data path; ensure the
rendering logic at the status display points handles the query error state
appropriately.

web/src/features/distributors/components/distributor-billing-tab.tsx-35-42 (1)

35-42: 🎯 Functional Correctness | 🟠 Major | ⚡ Quick win

Do not convert failed API responses into valid empty data.

These query functions mark an unsuccessful API response as a successful query result. Billing then displays zero values. The tables display an empty state. The detail page loses the distributor identity. Throw or propagate the failure, then render an explicit error state. Reserve empty data for successful responses.

• web/src/features/distributors/components/distributor-billing-tab.tsx#L35-L42: propagate the failed billing request instead of returning null.
• web/src/features/distributors/components/distributor-detail.tsx#L42-L45: propagate the failed detail request instead of returning null.
• web/src/features/distributors/components/distributor-sub-users-tab.tsx#L48-L60: do not return an empty page for a failed request.
• web/src/features/teams/components/teams-table.tsx#L64-L77: do not return an empty page for a failed request.

As per coding guidelines, “服务端错误统一使用 handleServerError；错误提示使用 i18n，统一通过 toast.error 等方式展示。”

🤖 Prompt for AI Agents

Verify each finding against current code. Fix only still-valid issues, skip the
rest with a brief reason, keep changes minimal, and validate.

In `@web/src/features/distributors/components/distributor-billing-tab.tsx` around
lines 35 - 42, Update the query functions to propagate unsuccessful API
responses instead of returning null or empty pages, so only successful responses
produce data. Apply this in
web/src/features/distributors/components/distributor-billing-tab.tsx lines
35-42, web/src/features/distributors/components/distributor-detail.tsx lines
42-45, web/src/features/distributors/components/distributor-sub-users-tab.tsx
lines 48-60, and web/src/features/teams/components/teams-table.tsx lines 64-77;
use handleServerError for server failures and preserve i18n-based toast.error
messaging, with each query rendering its explicit error state.

Source: Coding guidelines

web/src/features/distributors/components/distributors-mutate-drawer.tsx-105-129 (1)

105-129: 🩺 Stability & Availability | 🟠 Major | ⚡ Quick win

Handle failed API operations in every mutation and query path.

Each path only handles successful responses. A success: false response gives no feedback for several mutations. A rejected api request also bypasses feedback. Show a localized error for unsuccessful responses. Catch rejected requests with handleServerError. Keep destructive dialogs open when the operation fails.

• web/src/features/distributors/components/distributors-mutate-drawer.tsx#L105-L129: Handle unsuccessful create and update responses and rejected requests.
• web/src/features/sla-incidents/components/sla-incidents-table.tsx#L74-L88: Handle rejected list requests through the standard server-error path.
• web/src/features/sla-incidents/components/data-table-row-actions.tsx#L53-L66: Handle unsuccessful resolve responses and rejected requests.
• web/src/features/teams/components/team-projects-tab.tsx#L116-L150: Handle unsuccessful add and remove responses and rejected requests.
• web/src/features/teams/components/team-members-tab.tsx#L135-L169: Handle unsuccessful add and remove responses and rejected requests.

As per coding guidelines, “服务端错误统一使用 handleServerError；错误提示使用 i18n，统一通过 toast.error 等方式展示”.

🤖 Prompt for AI Agents

Verify each finding against current code. Fix only still-valid issues, skip the
rest with a brief reason, keep changes minimal, and validate.

In `@web/src/features/distributors/components/distributors-mutate-drawer.tsx`
around lines 105 - 129, Handle both unsuccessful responses and rejected requests
across all mutation and query paths: in
web/src/features/distributors/components/distributors-mutate-drawer.tsx:105-129,
update onSubmit for create and update failures; in
web/src/features/sla-incidents/components/sla-incidents-table.tsx:74-88, catch
list-request errors; in
web/src/features/sla-incidents/components/data-table-row-actions.tsx:53-66,
handle failed resolve operations; and in
web/src/features/teams/components/team-projects-tab.tsx:116-150 and
web/src/features/teams/components/team-members-tab.tsx:135-169, handle failed
add/remove operations. Use localized toast.error messages for success:false
responses, route rejected requests through handleServerError, and only close
destructive dialogs after successful operations.

Source: Coding guidelines

web/src/features/sla-incidents/lib/sla-incidents-form.ts-49-56 (1)

49-56: 🗄️ Data Integrity & Integration | 🟠 Major | ⚡ Quick win

Create the default start time when the form resets.

Line 54 runs once when this module loads. SlaIncidentsMutateDrawer reuses this value for useForm and create resets. An incident created later can persist the application-start time instead of its creation time.

Replace the constant date with a default-values factory. Call that factory for form initialization and every create reset.

🤖 Prompt for AI Agents

Verify each finding against current code. Fix only still-valid issues, skip the
rest with a brief reason, keep changes minimal, and validate.

In `@web/src/features/sla-incidents/lib/sla-incidents-form.ts` around lines 49 -
56, Replace the static started_at value in SLA_INCIDENT_FORM_DEFAULT_VALUES with
a default-values factory that creates a fresh Date on each invocation. Update
SlaIncidentsMutateDrawer to call the factory when initializing useForm and for
every create reset, while preserving the existing field defaults.

web/src/features/market-models/components/market-models-mutate-drawer.tsx-101-137 (1)

101-137: 🗄️ Data Integrity & Integration | 🟠 Major | ⚡ Quick win

Reset the form and report failed operations.

A failed getMarketModel request leaves the previous form values in place because the catch block is empty. A later submit can update currentRow.id with stale values. Failed create or update responses also provide no feedback.

Reset to defaults before loading the selected model. Handle unsuccessful responses and rejected requests with handleServerError.

As per coding guidelines, “服务端错误统一使用 handleServerError；错误提示使用 i18n，统一通过 toast.error 等方式展示”。

🤖 Prompt for AI Agents

Verify each finding against current code. Fix only still-valid issues, skip the
rest with a brief reason, keep changes minimal, and validate.

In `@web/src/features/market-models/components/market-models-mutate-drawer.tsx`
around lines 101 - 137, Update the useEffect around getMarketModel to reset the
form to MARKET_MODEL_FORM_DEFAULT_VALUES before loading the selected model, and
call handleServerError for unsuccessful or rejected requests instead of
swallowing errors. In onSubmit, handle failed createMarketModel and
updateMarketModel results and rejected requests with handleServerError,
displaying errors through the existing i18n-backed toast.error flow while
preserving success behavior.

Source: Coding guidelines

web/src/features/region-routes/components/region-routes-table.tsx-49-76 (1)

49-76: 🩺 Stability & Availability | 🟠 Major | ⚡ Quick win

Do not render load failures as an empty list.

listRegionRoutes failures return items: [] from queryFn, and routes = data?.items ?? [] passes that through to DataTablePage. The component also destructures only data, isLoading, and isFetching, so query errors do not render an error state.

Propagate failures from queryFn; catch rejected requests and show the translated server error via handleServerError and/or toast.error instead of No Region Routes Found.

🤖 Prompt for AI Agents

Verify each finding against current code. Fix only still-valid issues, skip the
rest with a brief reason, keep changes minimal, and validate.

In `@web/src/features/region-routes/components/region-routes-table.tsx` around
lines 49 - 76, Update the region-routes query around listRegionRoutes and its
consuming state so failures are not converted into an empty items array.
Propagate unsuccessful or rejected requests as query errors, capture the query
error state, and render the translated server error through handleServerError
and/or toast.error instead of allowing DataTablePage to show “No Region Routes
Found.”

Source: Coding guidelines

web/src/features/market-models/components/market-models-table.tsx-68-95 (1)

68-95: 🎯 Functional Correctness | 🟠 Major | ⚡ Quick win

Wire global search into the backend list call.

globalFilter only triggers a refetch and a local filter for the current page. manualFiltering: true disables globalFilterFn for pagination and row models, while ListMarketModels only reads status and category. Add keyword support to the backend path and forward it via getMarketModels; otherwise do not expose this search input.

🤖 Prompt for AI Agents

Verify each finding against current code. Fix only still-valid issues, skip the
rest with a brief reason, keep changes minimal, and validate.

In `@web/src/features/market-models/components/market-models-table.tsx` around
lines 68 - 95, Add backend keyword-search support to the market-models query by
extending the getMarketModels request in the queryFn to forward globalFilter,
and update the corresponding list API parameter handling to apply it. Ensure
globalFilter is not exposed unless it is actually sent to and processed by the
backend; preserve the existing pagination and status filtering behavior.

web/src/features/marketing/components/Cards.tsx-4-9 (1)

4-9: 🩺 Stability & Availability | 🟠 Major | ⚡ Quick win

Validate parsed JSON shapes before rendering.

JSON.parse accepts valid non-array JSON such as null or {}. Line 25 then calls features.map, and Line 64 accesses fields on each models entry. A malformed persisted public record can therefore crash the marketing page. Validate that each value is an array and filter entries to the expected element shape before rendering.

Also applies to: 51-56

🤖 Prompt for AI Agents

Verify each finding against current code. Fix only still-valid issues, skip the
rest with a brief reason, keep changes minimal, and validate.

In `@web/src/features/marketing/components/Cards.tsx` around lines 4 - 9, Validate
the parsed values in the Cards component before rendering: ensure plan.features
is an array, and filter its entries to the expected feature shape before the
features.map call. Apply the same array and element-shape validation to the
models parsing block around the models rendering path, so malformed records
cannot cause field-access or map errors.

web/src/lib/marketing-mode.ts-27-32 (1)

27-32: 🎯 Functional Correctness | 🟠 Major | ⚡ Quick win

Normalize trailing slashes before classifying paths.

isMarketingPath('/pricing/') and isMarketingPath('/models/') return false. isConsolePath then returns true, so a public URL such as www.example.com/pricing/ redirects to the console host. Normalize the pathname before both marketing-path checks.

Also applies to: 45-53

🤖 Prompt for AI Agents

Verify each finding against current code. Fix only still-valid issues, skip the
rest with a brief reason, keep changes minimal, and validate.

In `@web/src/lib/marketing-mode.ts` around lines 27 - 32, Normalize the pathname
by removing its trailing slash before the path-membership checks in both
isMarketingPath and isMarketingOnlyPath. Ensure normalized public paths such as
“/pricing/” and “/models/” classify identically to their slashless forms while
preserving the root path behavior.

web/src/features/marketing/hooks/usePublicData.ts-38-40 (1)

38-40: 🩺 Stability & Availability | 🟠 Major | ⚡ Quick win

Use the shared api client for public API requests.

Direct fetch bypasses the project interceptor path. It also does not reject non-2xx responses, so an error payload can be converted into an empty result instead of setting the query error state. Use the shared api instance and propagate failed responses.

Also applies to: 50-52

🤖 Prompt for AI Agents

Verify each finding against current code. Fix only still-valid issues, skip the
rest with a brief reason, keep changes minimal, and validate.

In `@web/src/features/marketing/hooks/usePublicData.ts` around lines 38 - 40,
Replace the direct fetch calls in the public pricing and corresponding second
request within the hook’s query functions with the shared api client. Ensure
non-2xx responses are rejected and propagated to the query error state, while
preserving the existing locale parameters and successful data extraction
behavior.

Source: Coding guidelines

web/src/features/marketing/components/Cards.tsx-32-41 (1)

32-41: 🎯 Functional Correctness | 🟠 Major | ⚡ Quick win

Route custom plans to the sales page.

Line 40 shows Contact Sales for custom billing, but Line 33 always links to /sign-up. Send custom plans to /contact-sales.

Proposed fix

-        href='/sign-up'
+        href={plan.billing_mode === 'custom' ? '/contact-sales' : '/sign-up'}

🤖 Prompt for AI Agents

Verify each finding against current code. Fix only still-valid issues, skip the
rest with a brief reason, keep changes minimal, and validate.

In `@web/src/features/marketing/components/Cards.tsx` around lines 32 - 41, Update
the plan CTA anchor in Cards so its href routes custom billing plans to
/contact-sales and all other plans to /sign-up. Preserve the existing Contact
Sales and Get Started labels and styling.

web/src/features/marketing/hooks/useSiteContent.ts-8-13 (1)

8-13: 📐 Maintainability & Code Quality | 🟠 Major | 🏗️ Heavy lift

Use the shared i18next catalogs for all marketing text.

useSiteContent bypasses t() and selects a separate catalog that supports only en and zh. Users on the other supported locales receive English fallback text. The copy button and region labels also bypass translation.

• web/src/features/marketing/hooks/useSiteContent.ts#L8-L13: replace the custom locale switch with t() calls.
• web/src/features/marketing/types.ts#L1-L1: remove the two-locale marketing contract.
• web/src/features/marketing/data/content.ts#L3-L3: migrate marketing strings to the shared locale JSON catalogs.
• web/src/features/marketing/components/CodeBlock.tsx#L20-L20: translate Copy and Copied.
• web/src/features/marketing/components/ContactForm.tsx#L5-L5: store region translation keys instead of display strings.
• web/src/features/marketing/components/ContactForm.tsx#L97-L101: render each region with t().

As per coding guidelines, “Frontend user-facing text must use i18next/react-i18next” and supported locales include en, zh, zh-TW, fr, ru, ja, and vi.

🤖 Prompt for AI Agents

Verify each finding against current code. Fix only still-valid issues, skip the
rest with a brief reason, keep changes minimal, and validate.

In `@web/src/features/marketing/hooks/useSiteContent.ts` around lines 8 - 13,
Replace the two-locale catalog selection in useSiteContent with react-i18next
t() lookups, and migrate the marketing content contract and strings in
web/src/features/marketing/types.ts#L1-L1 and
web/src/features/marketing/data/content.ts#L3-L3 into the shared locale JSON
catalogs for all supported locales. In
web/src/features/marketing/components/CodeBlock.tsx#L20-L20, translate Copy and
Copied with t(); in web/src/features/marketing/components/ContactForm.tsx#L5-L5,
store region translation keys, and at
web/src/features/marketing/components/ContactForm.tsx#L97-L101 render labels
through t().

Source: Coding guidelines

web/src/features/marketing/data/content.ts-141-169 (1)

141-169: 🎯 Functional Correctness | 🟠 Major | ⚡ Quick win

Do not hardcode the public API endpoint.

The quick-start copy and all examples embed https://api.91flow.com/v1. This makes the generated documentation incorrect for regional or alternate deployments. Define a VITE_ public API base URL and build the displayed base URL and examples from that value.

• web/src/features/marketing/data/content.ts#L141-L169: use the environment-backed value in English quick-start text.
• web/src/features/marketing/data/content.ts#L309-L336: use the same value in Chinese quick-start text.
• web/src/features/marketing/data/content.ts#L345-L383: generate each example from the same value.

As per coding guidelines, “环境变量使用 .env 并以 VITE_ 为前缀，代码中不得硬编码配置”.

🤖 Prompt for AI Agents

Verify each finding against current code. Fix only still-valid issues, skip the
rest with a brief reason, keep changes minimal, and validate.

In `@web/src/features/marketing/data/content.ts` around lines 141 - 169, Replace
the hardcoded public API endpoint with a shared VITE_-prefixed
environment-backed base URL in content.ts. Update the English quick-start text
at web/src/features/marketing/data/content.ts:141-169 and Chinese quick-start
text at :309-336 to use that value, and generate all examples at :345-383 from
the same value rather than embedding the endpoint; ensure the corresponding .env
configuration is used.

Source: Coding guidelines

---

ℹ️ Review info

⚙️ Run configuration

Configuration used: Organization UI

Review profile: CHILL

Plan: Pro Plus

Run ID: 32ba0ca5-9556-498e-86e7-72e1a3e117ea

📥 Commits

Reviewing files that changed from the base of the PR and between 0cd9dc8 and 34a52be.

⛔ Files ignored due to path filters (1)

• web/public/favicon.ico is excluded by !**/*.ico

📒 Files selected for processing (162)

• .dockerignore
• Dockerfile
• common/constants.go
• common/redirect.go
• constant/context_key.go
• controller/distributor.go
• controller/market.go
• controller/public_site.go
• controller/region_route.go
• controller/sla.go
• controller/team.go
• deploy/nginx/originflow.conf
• docker-compose.yml
• model/ability.go
• model/analytics_event.go
• model/channel_cache.go
• model/distributor.go
• model/log.go
• model/main.go
• model/market_model.go
• model/public_model_category.go
• model/public_pricing.go
• model/public_site_seed.go
• model/region_route.go
• model/region_route_test.go
• model/sales_lead.go
• model/sla.go
• model/team.go
• model/user.go
• model/user_cache.go
• router/api-router.go
• router/p2-router.go
• service/channel_select.go
• service/channel_select_test.go
• web/index.html
• web/public/logo.webp
• web/src/components/layout/components/footer.tsx
• web/src/features/distributors/api.ts
• web/src/features/distributors/components/data-table-row-actions.tsx
• web/src/features/distributors/components/distributor-billing-tab.tsx
• web/src/features/distributors/components/distributor-detail.tsx
• web/src/features/distributors/components/distributor-price-mutate-drawer.tsx
• web/src/features/distributors/components/distributor-prices-tab.tsx
• web/src/features/distributors/components/distributor-sub-users-tab.tsx
• web/src/features/distributors/components/distributors-columns.tsx
• web/src/features/distributors/components/distributors-delete-dialog.tsx
• web/src/features/distributors/components/distributors-dialogs.tsx
• web/src/features/distributors/components/distributors-mobile-list.tsx
• web/src/features/distributors/components/distributors-mutate-drawer.tsx
• web/src/features/distributors/components/distributors-primary-buttons.tsx
• web/src/features/distributors/components/distributors-provider.tsx
• web/src/features/distributors/components/distributors-table.tsx
• web/src/features/distributors/constants.ts
• web/src/features/distributors/index.tsx
• web/src/features/distributors/lib/distributors-form.ts
• web/src/features/distributors/lib/index.ts
• web/src/features/distributors/types.ts
• web/src/features/market-models/api.ts
• web/src/features/market-models/components/market-models-columns.tsx
• web/src/features/market-models/components/market-models-delete-dialog.tsx
• web/src/features/market-models/components/market-models-dialogs.tsx
• web/src/features/market-models/components/market-models-mutate-drawer.tsx
• web/src/features/market-models/components/market-models-primary-buttons.tsx
• web/src/features/market-models/components/market-models-provider.tsx
• web/src/features/market-models/components/market-models-row-actions.tsx
• web/src/features/market-models/components/market-models-table.tsx
• web/src/features/market-models/constants.ts
• web/src/features/market-models/index.tsx
• web/src/features/market-models/lib/market-model-form.ts
• web/src/features/market-models/storefront.tsx
• web/src/features/market-models/types.ts
• web/src/features/marketing/components/Cards.tsx
• web/src/features/marketing/components/CodeBlock.tsx
• web/src/features/marketing/components/ContactForm.tsx
• web/src/features/marketing/components/MarketingSections.tsx
• web/src/features/marketing/data/content.ts
• web/src/features/marketing/hooks/usePublicData.ts
• web/src/features/marketing/hooks/useSiteConfig.ts
• web/src/features/marketing/hooks/useSiteContent.ts
• web/src/features/marketing/pages/ContactSales.tsx
• web/src/features/marketing/pages/Home.tsx
• web/src/features/marketing/pages/Models.tsx
• web/src/features/marketing/pages/Pricing.tsx
• web/src/features/marketing/pages/QuickStart.tsx
• web/src/features/marketing/pages/Solutions.tsx
• web/src/features/marketing/types.ts
• web/src/features/region-routes/api.ts
• web/src/features/region-routes/components/channel-multi-select.tsx
• web/src/features/region-routes/components/data-table-row-actions.tsx
• web/src/features/region-routes/components/region-routes-columns.tsx
• web/src/features/region-routes/components/region-routes-delete-dialog.tsx
• web/src/features/region-routes/components/region-routes-dialogs.tsx
• web/src/features/region-routes/components/region-routes-mobile-list.tsx
• web/src/features/region-routes/components/region-routes-mutate-drawer.tsx
• web/src/features/region-routes/components/region-routes-primary-buttons.tsx
• web/src/features/region-routes/components/region-routes-provider.tsx
• web/src/features/region-routes/components/region-routes-table.tsx
• web/src/features/region-routes/constants.ts
• web/src/features/region-routes/index.tsx
• web/src/features/region-routes/lib/index.ts
• web/src/features/region-routes/lib/region-routes-form.ts
• web/src/features/region-routes/lib/utils.ts
• web/src/features/region-routes/types.ts
• web/src/features/sla-incidents/api.ts
• web/src/features/sla-incidents/components/data-table-row-actions.tsx
• web/src/features/sla-incidents/components/sla-incidents-columns.tsx
• web/src/features/sla-incidents/components/sla-incidents-delete-dialog.tsx
• web/src/features/sla-incidents/components/sla-incidents-dialogs.tsx
• web/src/features/sla-incidents/components/sla-incidents-mobile-list.tsx
• web/src/features/sla-incidents/components/sla-incidents-mutate-drawer.tsx
• web/src/features/sla-incidents/components/sla-incidents-primary-buttons.tsx
• web/src/features/sla-incidents/components/sla-incidents-provider.tsx
• web/src/features/sla-incidents/components/sla-incidents-table.tsx
• web/src/features/sla-incidents/constants.ts
• web/src/features/sla-incidents/index.tsx
• web/src/features/sla-incidents/lib/index.ts
• web/src/features/sla-incidents/lib/sla-incidents-form.ts
• web/src/features/sla-incidents/types.ts
• web/src/features/sla-status/index.tsx
• web/src/features/system-settings/general/system-info-section.tsx
• web/src/features/teams/api.ts
• web/src/features/teams/components/data-table-row-actions.tsx
• web/src/features/teams/components/team-billing-tab.tsx
• web/src/features/teams/components/team-detail.tsx
• web/src/features/teams/components/team-members-tab.tsx
• web/src/features/teams/components/team-projects-tab.tsx
• web/src/features/teams/components/teams-columns.tsx
• web/src/features/teams/components/teams-delete-dialog.tsx
• web/src/features/teams/components/teams-dialogs.tsx
• web/src/features/teams/components/teams-mobile-list.tsx
• web/src/features/teams/components/teams-mutate-drawer.tsx
• web/src/features/teams/components/teams-primary-buttons.tsx
• web/src/features/teams/components/teams-provider.tsx
• web/src/features/teams/components/teams-table.tsx
• web/src/features/teams/constants.ts
• web/src/features/teams/index.tsx
• web/src/features/teams/lib/index.ts
• web/src/features/teams/lib/teams-form.ts
• web/src/features/teams/types.ts
• web/src/hooks/use-sidebar-data.ts
• web/src/i18n/locales/en.json
• web/src/i18n/locales/zh.json
• web/src/lib/constants.ts
• web/src/lib/marketing-mode.ts
• web/src/routeTree.gen.ts
• web/src/routes/__root.tsx
• web/src/routes/_authenticated/distributors/$distributorId/index.tsx
• web/src/routes/_authenticated/distributors/index.tsx
• web/src/routes/_authenticated/market-models/index.tsx
• web/src/routes/_authenticated/models/index.tsx
• web/src/routes/_authenticated/region-routes/index.tsx
• web/src/routes/_authenticated/route.tsx
• web/src/routes/_authenticated/sla-incidents/index.tsx
• web/src/routes/_authenticated/teams/$teamId/index.tsx
• web/src/routes/_authenticated/teams/index.tsx
• web/src/routes/contact-sales.tsx
• web/src/routes/index.tsx
• web/src/routes/market/index.tsx
• web/src/routes/pricing/index.tsx
• web/src/routes/quick-start.tsx
• web/src/routes/sla-status/index.tsx
• web/src/routes/solutions.tsx

[coderabbitai]

🔒 Security & Privacy | 🔴 Critical | ⚡ Quick win

Reject backslash-based protocol-relative paths.

Line 16 accepts /\evil.example because it starts with / but not //. Browser URL parsing treats backslashes as path separators for special URLs. The destination can become //evil.example and bypass the origin restriction.

Normalize backslashes before the protocol-relative URL check.

Proposed fix

 if strings.HasPrefix(u, "/") {
-	return !strings.HasPrefix(u, "//")
+	return !strings.HasPrefix(strings.ReplaceAll(u, "\\", "/"), "//")
 }

📝 Committable suggestion

‼️ IMPORTANT
Carefully review the code before committing. Ensure that it accurately replaces the highlighted code, contains no missing lines, and has no issues with indentation. Thoroughly test & benchmark the code to ensure it meets the requirements.

Suggested change

	// 相对路径，但排除协议相对地址（//evil.com）
	if strings.HasPrefix(u, "/") {
	return !strings.HasPrefix(u, "//")
	}
	// 相对路径，但排除协议相对地址（//evil.com）
	if strings.HasPrefix(u, "/") {
	return !strings.HasPrefix(strings.ReplaceAll(u, "\\", "/"), "//")
	}

🤖 Prompt for AI Agents

Verify each finding against current code. Fix only still-valid issues, skip the
rest with a brief reason, keep changes minimal, and validate.

In `@common/redirect.go` around lines 15 - 18, Update the relative-path validation
around the strings.HasPrefix check in the redirect helper to normalize
backslashes to forward slashes before testing for protocol-relative paths.
Ensure inputs such as `/\evil.example` are rejected like `//evil.example`, while
preserving acceptance of valid single-slash relative paths.

[coderabbitai]

🗄️ Data Integrity & Integration | 🔴 Critical | ⚡ Quick win

CreateMarketModel drops Currency and Metadata.

The struct literal never assigns req.Currency or req.Metadata. m.Currency is therefore always empty at Line 137 and gets forced to "CNY", so a request with "currency": "USD" is stored as CNY. The validated Metadata is discarded, so locale overrides read back by resolveMarketModelI18n are always absent for newly created records. UpdateMarketModel sets both fields, which confirms the omission.

The m.Status == 0 branch is also unreachable, because validateMarketModelRequest rejects status 0.

🐛 Proposed fix

 	m := &model.MarketModel{
 		Model:       req.Model,
 		Provider:    req.Provider,
 		Category:    req.Category,
 		Tags:        req.Tags,
 		InputPrice:  req.InputPrice,
 		OutputPrice: req.OutputPrice,
+		Currency:    orDefault(req.Currency, "CNY"),
 		Unit:        orDefault(req.Unit, "token"),
+		Metadata:    req.Metadata,
 		TrialQuota:  req.TrialQuota,
 		Status:      req.Status,
 		Featured:    req.Featured,
 		Sort:        req.Sort,
 	}
-	if m.Status == 0 {
-		m.Status = MarketModelStatusAvailable
-	}
-	if m.Currency == "" {
-		m.Currency = "CNY"
-	}

📝 Committable suggestion

‼️ IMPORTANT
Carefully review the code before committing. Ensure that it accurately replaces the highlighted code, contains no missing lines, and has no issues with indentation. Thoroughly test & benchmark the code to ensure it meets the requirements.

Suggested change

	m := &model.MarketModel{
	Model: req.Model,
	Provider: req.Provider,
	Category: req.Category,
	Tags: req.Tags,
	InputPrice: req.InputPrice,
	OutputPrice: req.OutputPrice,
	Unit: orDefault(req.Unit, "token"),
	TrialQuota: req.TrialQuota,
	Status: req.Status,
	Featured: req.Featured,
	Sort: req.Sort,
	}
	if m.Status == 0 {
	m.Status = MarketModelStatusAvailable
	}
	if m.Currency == "" {
	m.Currency = "CNY"
	}
	m := &model.MarketModel{
	Model: req.Model,
	Provider: req.Provider,
	Category: req.Category,
	Tags: req.Tags,
	InputPrice: req.InputPrice,
	OutputPrice: req.OutputPrice,
	Currency: orDefault(req.Currency, "CNY"),
	Unit: orDefault(req.Unit, "token"),
	Metadata: req.Metadata,
	TrialQuota: req.TrialQuota,
	Status: req.Status,
	Featured: req.Featured,
	Sort: req.Sort,
	}

🤖 Prompt for AI Agents

Verify each finding against current code. Fix only still-valid issues, skip the
rest with a brief reason, keep changes minimal, and validate.

In `@controller/market.go` around lines 121 - 139, Update CreateMarketModel’s
model construction to assign req.Currency and req.Metadata, preserving requested
currency values and validated locale metadata for newly created records; retain
the existing default currency behavior only when the request currency is empty.
Remove the unreachable m.Status == 0 defaulting branch, since
validateMarketModelRequest rejects status 0.

[peidunyue]

@Calcium-Ion 你好，这是 OriginFlow（元点流商）二次开发 + 与 originflow 分支统一 web/src 前端的 PR，CI 已通过且可合并。麻烦抽空评审，谢谢！

[Calcium-Ion]

这个pr改的太多了，并且我们对 originflow 并不熟悉，如果您是 originflow 相关负责人，麻烦先和 newapi@quantumnous.com 联系，我们会在一周内回复您

[peidunyue]

Superseded by a split for easier review: this combined PR (originflow merge + OriginFlow secondary-dev) was broken into two independent, build-passing PRs:

• Backend/infra: feat: OriginFlow backend — region routing, Model Market & sales-leads APIs, originflow infra #6738
• Frontend (unified web/src): feat: OriginFlow frontend — unified web/src (marketing, Quick Start, Model Market storefront) #6739

Together they reconstruct this change. Please review #6738 and #6739 instead. Note: the frontend PR (#6739) currently drops upstream's auto-group frontend feature (our branch predates it) — flagged there; can be restored as a follow-up if desired.