feat: 元点流商 OriginFlow 二次开发 + 与 originflow 统一 web/src 前端

.dockerignore

@@ -7,6 +7,16 @@ Makefile
 docs
 .eslintcache
 .gocache
-/web/node_modules
+# 依赖一律在镜像内 bun install，任何层级的 node_modules 都不需要进构建上下文
+# (Dependencies are installed inside the image; no node_modules at any depth.)
+**/node_modules
+# web/dist 由 builder 阶段产出并 COPY --from，构建上下文里的产物一律忽略
+# (web/dist is produced by the builder stage; ignore any prebuilt output here.)
 /web/dist
+/web/classic/dist
+/web/default/dist
+# 运行时目录，由 compose 以 bind mount 挂载
+# (Runtime directories, provided by compose bind mounts.)
+/data
+/logs
 !THIRD-PARTY-LICENSES.md

Dockerfile

@@ -1,8 +1,22 @@
 FROM oven/bun:1@sha256:0733e50325078969732ebe3b15ce4c4be5082f18c4ac1a0f0ca4839c2e4e42a7 AS builder
 
 WORKDIR /build/web
-COPY web/package.json web/bun.lock ./
-RUN bun install --frozen-lockfile
+# .npmrc must land before `bun install`, otherwise the registry it configures is
+# ignored (it would only arrive with the later `COPY ./web ./`).
+COPY web/package.json web/bun.lock web/.npmrc ./
+# Point at a nearby mirror when the default registry is slow, e.g.
+#   docker build --build-arg NPM_REGISTRY=https://repo.huaweicloud.com/repository/npm/ .
+ARG NPM_REGISTRY=
+# Bun's default fetch concurrency corrupts large tarballs (react-icons is 22MB,
+# @hugeicons/core-free-icons larger still) on constrained links, surfacing as
+# "Integrity check failed" on a different package each run. Cap concurrency and
+# retry so a single dropped connection doesn't fail the whole build.
+RUN if [ -n "$NPM_REGISTRY" ]; then echo "registry=$NPM_REGISTRY" > .npmrc; fi \
+    && for attempt in 1 2 3; do \
+         echo "bun install attempt $attempt" \
+         && BUN_CONFIG_MAX_HTTP_REQUESTS=8 bun install --frozen-lockfile && break \
+         || { [ "$attempt" = 3 ] && exit 1; echo "retrying..."; sleep 5; }; \
+       done
 COPY ./web ./
 COPY ./VERSION /build/VERSION
 RUN DISABLE_ESLINT_PLUGIN='true' VITE_REACT_APP_VERSION=$(cat /build/VERSION) bun run build

common/constants.go

@@ -12,7 +12,7 @@ import (
 
 var StartTime = time.Now().Unix() // unit: second
 var Version = "v0.0.0"            // this hard coding will be replaced automatically when building, no need to manually change
-var SystemName = "New API"
+var SystemName = "OriginFlow"
 var Footer = ""
 var Logo = ""
 var TopUpLink = ""

common/redirect.go

@@ -0,0 +1,28 @@
+package common
+
+import (
+	"net/url"
+	"strings"
+)
+
+// IsSafeRedirect 校验重定向目标是否安全，防止开放重定向（Open Redirect）。
+// 允许：空串（无重定向）、同源相对路径（以 / 开头且非协议相对 //host）、指向已知官方域名。
+func IsSafeRedirect(u string) bool {
+	u = strings.TrimSpace(u)
+	if u == "" {
+		return true
+	}
+	// 相对路径，但排除协议相对地址（//evil.com）
+	if strings.HasPrefix(u, "/") {
+		return !strings.HasPrefix(u, "//")
+	}
+	parsed, err := url.Parse(u)
+	if err != nil {
+		return false
+	}
+	if parsed.Scheme != "http" && parsed.Scheme != "https" {
+		return false
+	}
+	host := parsed.Host
+	return host == "91flow.com" || strings.HasSuffix(host, ".91flow.com")
+}

constant/context_key.go

@@ -72,4 +72,23 @@ const (
 	// fallback in authHelper (finishAdminAudit) skips its record to avoid
 	// duplicate entries.
 	ContextKeyAuditLogged ContextKey = "audit_logged"
+
+	// ContextKeyRequestRegion stores the normalized region of the current request,
+	// used by region-based channel routing (see model.ResolveRegionRouting).
+	// It is distinct from the vertex-specific "region" key set in the distributor.
+	ContextKeyRequestRegion ContextKey = "request_region"
+
+	// ContextKeyUserRegionPreference stores the authenticated user's preferred
+	// region (see User.RegionPreference). Region-based channel routing falls back
+	// to it when no X-Region header or request-region context is present.
+	ContextKeyUserRegionPreference ContextKey = "user_region_preference"
+
+	// ContextKeyUserTeamId stores the authenticated user's enterprise team id
+	// (see User.TeamId). Consume logs are stamped with it for per-team billing
+	// aggregation.
+	ContextKeyUserTeamId ContextKey = "user_team_id"
 )
+
+// HeaderRegion is the request header declaring the caller's region for
+// region-based channel routing, e.g. `X-Region: cn`.
+const HeaderRegion = "X-Region"