feat: align NewAPI identity with Account Center subjects - #6863
Closed
AidenNovak wants to merge 4 commits into
Closed
feat: align NewAPI identity with Account Center subjects#6863AidenNovak wants to merge 4 commits into
AidenNovak wants to merge 4 commits into
Conversation
* Wire NewAPI CI to this fork and keep upstream publish workflows off. The stock PR Check workflow closes AI-looking PRs, and Docker jobs push to the official calciumion image. Neither belongs on this freeze. * Drop bun test from the required frontend gate on this freeze. rc.24's web tests mix node:test describe() with bun test, which fails on the pinned Bun and would block every product PR. --------- Co-authored-by: AidenNovak <>
Account Center treats issuer+sub as the only cross-product user key. Store those subjects in digest-backed claims so MySQL collation cannot merge distinct OIDC ids, and backfill existing oidc_id rows on startup. Co-authored-by: Cursor <cursoragent@cursor.com>
Account Center already merges email/Google/GitHub onto one sub. NewAPI now follows that subject on login and bind, and refuses to attach an OIDC identity to a different local user just because the emails match. Co-authored-by: Cursor <cursoragent@cursor.com>
Account Center needs a subject-keyed quota display without a dashboard session. Keep the HMAC endpoint and HTTPS redirect disabled until their secrets are configured so default deployments stay closed. Co-authored-by: Cursor <cursoragent@cursor.com>
Contributor
|
Caution Review failedThe pull request is closed. ℹ️ Recent review info⚙️ Run configurationConfiguration used: Organization UI Review profile: CHILL Plan: Pro Plus Run ID: 📒 Files selected for processing (16)
WalkthroughThis change adds Account Center configuration, redirect and HMAC-authenticated overview endpoints, exact OIDC identity claims, transactional OIDC login and binding, related tests, and repository-scoped CI and release workflow conditions. ChangesAccount Center and OIDC identity integration
Workflow execution guards
Estimated code review effort: 4 (Complex) | ~45 minutes Sequence Diagram(s)sequenceDiagram
participant AccountCenter
participant API
participant GetAccountCenterOverview
participant ExternalIdentityClaim
AccountCenter->>API: POST /internal/account/overview
API->>GetAccountCenterOverview: forward bounded request
GetAccountCenterOverview->>ExternalIdentityClaim: verify signature and resolve OIDC subject
ExternalIdentityClaim-->>GetAccountCenterOverview: return matching user
GetAccountCenterOverview-->>AccountCenter: return account metrics
Possibly related PRs
Suggested reviewers: Poem
✨ Finishing Touches🧪 Generate unit tests (beta)
Thanks for using CodeRabbit! It's free for OSS, and your support helps us grow. If you like it, consider giving us a shout-out. Comment Warning |
Author
|
Closing: this was opened against upstream by mistake. The change belongs on the AidenNovak/newapi-custom fork (Account Center identity wiring), not QuantumNous/new-api. |
This file contains hidden or bidirectional Unicode text that may be interpreted or compiled differently than what appears below. To review, open the file in an editor that reveals hidden Unicode characters.
Learn more about bidirectional Unicode characters
Sign up for free
to join this conversation on GitHub.
Already have an account?
Sign in to comment
1 participant
Add this suggestion to a batch that can be applied as a single commit.This suggestion is invalid because no changes were made to the code.Suggestions cannot be applied while the pull request is closed.Suggestions cannot be applied while viewing a subset of changes.Only one suggestion per line can be applied in a batch.Add this suggestion to a batch that can be applied as a single commit.Applying suggestions on deleted lines is not supported.You must change the existing code in this line in order to create a valid suggestion.Outdated suggestions cannot be applied.This suggestion has been applied or marked resolved.Suggestions cannot be applied from pending reviews.Suggestions cannot be applied on multi-line comments.Suggestions cannot be applied while the pull request is queued to merge.Suggestion cannot be applied right now. Please check back later.
Important
This change was AI-assisted. I reviewed the Account Center identity contract, the three commits, and the local CI-equivalent test run before opening the PR.
📝 变更描述 / Description
NewAPI now plugs into the shared Account Center identity without copying the Vultr login shell.
Account Center already merges email / Google / GitHub onto one OIDC
sub. These commits make NewAPI consume that subject as the only customer key, and add an optional signed quota overview so Account Center can display the API wallet.users.oidc_id.subis the same NewAPI user; matching email on a different local user is a conflict, not a merge.POST /api/internal/account/overview(HMAC) andGET /api/account-center(HTTPS redirect). Both stay closed unless configured.Existing GitHub/Discord/password login paths are unchanged. OIDC PKCE / portal-only login UX is intentionally not ported.
🚀 变更类型 / Type of change
🔗 关联任务 / Related Issue
✅ 提交前检查项 / Checklist
Bug fix，我已提交或关联对应 Issue，且不会将设计取舍、预期不一致或理解偏差直接归类为 bug。📸 运行证明 / Proof of Work
Each commit was written so it can land independently:
feat(identity): claim OIDC subjects as exact opaque identitiesfeat(oauth): resolve OIDC users by exact subject claimsfeat(account-center): expose a signed API wallet overviewLocal verification matching this repo's CI backend job:
Both succeeded. Frontend files were not changed; CI typecheck should remain a no-op for this diff.
Test plan
make teston CI.subcreates one NewAPI user and a claim row.subreturns the same user even if the email claim changed.POST /api/internal/account/overviewreturns 404.suband does not see keys or session data.Made with Cursor
Summary by CodeRabbit
New Features
Bug Fixes
Chores