chore: sync upstream 2026-06-15

.github/workflows/alert-bridge.yml

@@ -0,0 +1,52 @@
+name: Alert Bridge
+on:
+  workflow_dispatch:
+    inputs:
+      mode:
+        required: true
+        type: choice
+        options: [list, dismiss]
+        description: 'list = download open alerts; dismiss = patch alerts to dismissed'
+      dismissals:
+        required: false
+        default: '[]'
+        description: 'JSON array of {number,reason,comment} — only used in dismiss mode'
+
+permissions:
+  security-events: write
+  contents: read
+
+jobs:
+  bridge:
+    runs-on: ubuntu-latest
+    env:
+      GH_TOKEN: ${{ github.token }}
+    steps:
+      - name: LIST
+        if: ${{ inputs.mode == 'list' }}
+        run: |
+          gh api --paginate "repos/${{ github.repository }}/code-scanning/alerts?state=open&per_page=100" > alerts.json
+          echo "## Open code-scanning alerts" >> $GITHUB_STEP_SUMMARY
+          echo "$(jq length alerts.json) open alert(s)" >> $GITHUB_STEP_SUMMARY
+
+      - name: Upload alerts artifact
+        if: ${{ inputs.mode == 'list' }}
+        uses: actions/upload-artifact@v4
+        with:
+          name: alerts
+          path: alerts.json
+
+      - name: DISMISS
+        if: ${{ inputs.mode == 'dismiss' }}
+        run: |
+          echo '${{ inputs.dismissals }}' | jq -c '.[]' | while read d; do
+            n=$(jq -r .number <<<"$d")
+            r=$(jq -r .reason <<<"$d")
+            c=$(jq -r .comment <<<"$d")
+            gh api -X PATCH "repos/${{ github.repository }}/code-scanning/alerts/$n" \
+              -f state=dismissed \
+              -f dismissed_reason="$r" \
+              -f dismissed_comment="$c" \
+              && echo "dismissed #$n ($r)" >> $GITHUB_STEP_SUMMARY \
+              || echo "FAILED #$n" >> $GITHUB_STEP_SUMMARY
+          done

AGENTS.md

@@ -135,3 +135,11 @@ For request structs that are parsed from client JSON and then re-marshaled to up
 ### Rule 7: Billing Expression System — Read `pkg/billingexpr/expr.md`
 
 When working on tiered/dynamic billing (expression-based pricing), you MUST read `pkg/billingexpr/expr.md` first. It documents the design philosophy, expression language (variables, functions, examples), full system architecture (editor → storage → pre-consume → settlement → log display), token normalization rules (`p`/`c` auto-exclusion), quota conversion, and expression versioning. All code changes to the billing expression system must follow the patterns described in that document.
+
+### Rule 8: Pull Requests — Identify AI-Generated Contributions When Appropriate
+
+When creating a pull request:
+
+- First compare the current git user (`git config user.name` / `git config user.email`) with the repository's historical core developers (for example, the recurring top authors in `git log`). Do not change git config.
+- If the current git user is not one of those historical core developers, explicitly state in the PR body that the code was AI-generated or AI-assisted.
+- Always use the repository PR template at `.github/PULL_REQUEST_TEMPLATE.md` when drafting the PR title/body. Preserve the template structure and fill in the relevant sections instead of replacing it with an ad hoc format.

CLAUDE.md

@@ -135,3 +135,11 @@ For request structs that are parsed from client JSON and then re-marshaled to up
 ### Rule 7: Billing Expression System — Read `pkg/billingexpr/expr.md`
 
 When working on tiered/dynamic billing (expression-based pricing), you MUST read `pkg/billingexpr/expr.md` first. It documents the design philosophy, expression language (variables, functions, examples), full system architecture (editor → storage → pre-consume → settlement → log display), token normalization rules (`p`/`c` auto-exclusion), quota conversion, and expression versioning. All code changes to the billing expression system must follow the patterns described in that document.
+
+### Rule 8: Pull Requests — Identify AI-Generated Contributions When Appropriate
+
+When creating a pull request:
+
+- First compare the current git user (`git config user.name` / `git config user.email`) with the repository's historical core developers (for example, the recurring top authors in `git log`). Do not change git config.
+- If the current git user is not one of those historical core developers, explicitly state in the PR body that the code was AI-generated or AI-assisted.
+- Always use the repository PR template at `.github/PULL_REQUEST_TEMPLATE.md` when drafting the PR title/body. Preserve the template structure and fill in the relevant sections instead of replacing it with an ad hoc format.

common/init.go

@@ -112,11 +112,11 @@ func InitEnv() {
 
 	// Initialize rate limit variables
 	GlobalApiRateLimitEnable = GetEnvOrDefaultBool("GLOBAL_API_RATE_LIMIT_ENABLE", true)
-	GlobalApiRateLimitNum = GetEnvOrDefault("GLOBAL_API_RATE_LIMIT", 180)
+	GlobalApiRateLimitNum = GetEnvOrDefault("GLOBAL_API_RATE_LIMIT", 360)
 	GlobalApiRateLimitDuration = int64(GetEnvOrDefault("GLOBAL_API_RATE_LIMIT_DURATION", 180))
 
 	GlobalWebRateLimitEnable = GetEnvOrDefaultBool("GLOBAL_WEB_RATE_LIMIT_ENABLE", true)
-	GlobalWebRateLimitNum = GetEnvOrDefault("GLOBAL_WEB_RATE_LIMIT", 60)
+	GlobalWebRateLimitNum = GetEnvOrDefault("GLOBAL_WEB_RATE_LIMIT", 120)
 	GlobalWebRateLimitDuration = int64(GetEnvOrDefault("GLOBAL_WEB_RATE_LIMIT_DURATION", 180))
 
 	CriticalRateLimitEnable = GetEnvOrDefaultBool("CRITICAL_RATE_LIMIT_ENABLE", true)

constant/channel.go

@@ -174,7 +174,7 @@ var ChannelTypeNames = map[int]string{
 	ChannelTypeDoubaoVideo:    "DoubaoVideo",
 	ChannelTypeSora:           "Sora",
 	ChannelTypeReplicate:      "Replicate",
-	ChannelTypeCodex:          "Codex",
+	ChannelTypeCodex:          "ChatGPT Subscription (Codex)",
 }
 
 func GetChannelTypeName(channelType int) string {

constant/context_key.go

@@ -66,4 +66,10 @@ const (
 	// ContextKeyLanguage stores the user's language preference for i18n
 	ContextKeyLanguage ContextKey = "language"
 	ContextKeyIsStream ContextKey = "is_stream"
+
+	// ContextKeyAuditLogged marks that the current request has already recorded
+	// a manage/operation audit log inside the handler. When set, the admin-audit
+	// fallback in authHelper (finishAdminAudit) skips its record to avoid
+	// duplicate entries.
+	ContextKeyAuditLogged ContextKey = "audit_logged"
 )

controller/audit.go

@@ -0,0 +1,105 @@
+package controller
+
+import (
+	"fmt"
+	"os"
+
+	"github.com/QuantumNous/new-api/common"
+	"github.com/QuantumNous/new-api/constant"
+	"github.com/QuantumNous/new-api/model"
+
+	"github.com/gin-gonic/gin"
+)
+
+// auditContentTemplates 将稳定的操作标识 action 映射为英文兜底模板，渲染后写入
+// Log.Content（供导出 / 经典前端等非本地化消费者使用）。占位符为 ${name}，由该
+// action 的 params 填充。本地化展示文案在前端 i18n 模板中维护，本表是语言中立的
+// 英文基线——调用方因此无需在每个埋点处手写句子（避免与 params 重复书写同一份值）。
+var auditContentTemplates = map[string]string{
+	"user.create":           "Created user ${username} (role ${role})",
+	"user.update":           "Updated user ${username} (ID: ${id})",
+	"user.delete":           "Deleted user ${username} (ID: ${id})",
+	"user.manage":           "Performed ${action} on user ${username} (ID: ${id})",
+	"user.quota_add":        "Increased user quota by ${quota}",
+	"user.quota_subtract":   "Decreased user quota by ${quota}",
+	"user.quota_override":   "Overrode user quota from ${from} to ${to}",
+	"user.binding_clear":    "Cleared ${bindingType} binding for user ${username}",
+	"user.2fa_disable":      "Force-disabled two-factor authentication for the user",
+	"user.passkey_register": "Registered a passkey",
+	"user.passkey_delete":   "Deleted a passkey",
+	"user.reset_passkey":    "Reset the user passkey",
+	"option.update":         "Updated system setting ${key}",
+
+	"channel.create":             "Created channel ${name} (type ${type}, count ${count})",
+	"channel.update":             "Updated channel ${name} (ID: ${id})",
+	"channel.delete":             "Deleted channel ${name} (ID: ${id})",
+	"channel.delete_batch":       "Batch deleted ${count} channels",
+	"channel.delete_disabled":    "Deleted all disabled channels (${count})",
+	"channel.key_view":           "Viewed channel key ${name} (ID: ${id})",
+	"channel.tag_disable":        "Disabled channels with tag ${tag}",
+	"channel.tag_enable":         "Enabled channels with tag ${tag}",
+	"channel.tag_edit":           "Edited channels with tag ${tag}",
+	"channel.tag_batch_set":      "Batch set tag for ${count} channels",
+	"channel.copy":               "Copied channel (source ID: ${sourceId}) to ${name} (new ID: ${id})",
+	"channel.multi_key_manage":   "Multi-key management ${action} on channel (ID: ${id})",
+	"channel.upstream_apply":     "Applied upstream model changes to channel (ID: ${id})",
+	"channel.upstream_apply_all": "Applied upstream model changes to ${count} channels",
+
+	"redemption.create": "Created ${count} redemption codes named ${name} (${quota} each)",
+}
+
+// auditContentEN 按 action 模板渲染英文兜底文本；未登记的 action 退回 action 本身。
+func auditContentEN(action string, params map[string]interface{}) string {
+	tmpl, ok := auditContentTemplates[action]
+	if !ok {
+		return action
+	}
+	return os.Expand(tmpl, func(key string) string {
+		if v, ok := params[key]; ok {
+			return fmt.Sprintf("%v", v)
+		}
+		return ""
+	})
+}
+
+// auditOperatorInfo 从上下文构建操作者身份信息（管理员 id/用户名/角色）。
+func auditOperatorInfo(c *gin.Context) map[string]interface{} {
+	return map[string]interface{}{
+		"admin_id":       c.GetInt("id"),
+		"admin_username": c.GetString("username"),
+		"admin_role":     c.GetInt("role"),
+		"auth_method":    auditAuthMethod(c),
+	}
+}
+
+func auditAuthMethod(c *gin.Context) string {
+	if c.GetBool("use_access_token") {
+		return "access_token"
+	}
+	return "session"
+}
+
+// markAuditLogged 标记当前请求已在 handler 内手动记录审计日志，
+// 使鉴权链路中的审计兜底（finishAdminAudit）跳过兜底记录，避免重复。
+func markAuditLogged(c *gin.Context) {
+	common.SetContextKey(c, constant.ContextKeyAuditLogged, true)
+}
+
+// recordManageAudit 记录一条由操作者本人归属的管理/高危审计日志（资源类操作：
+// 渠道 / 系统设置 / 兑换码等）。content 由 action+params 自动渲染。
+func recordManageAudit(c *gin.Context, action string, params map[string]interface{}) {
+	recordManageAuditFor(c, c.GetInt("id"), action, params)
+}
+
+// recordManageAuditFor 记录一条归属于 logUserId 的管理审计日志（面向用户的操作：
+// 对目标用户的额度调整 / 解绑 / 2FA 等，使该用户也能在自己的日志中看到）。
+func recordManageAuditFor(c *gin.Context, logUserId int, action string, params map[string]interface{}) {
+	model.RecordOperationAuditLog(logUserId, auditContentEN(action, params), c.ClientIP(), action, params, auditOperatorInfo(c), nil)
+	markAuditLogged(c)
+}
+
+// recordUserSecurityAudit 记录普通用户自己的安全敏感操作（如 passkey 绑定/解绑）。
+// 这类日志没有管理员操作者，不写 admin_info；同时不依赖 AdminAuth/RootAuth 的兜底。
+func recordUserSecurityAudit(c *gin.Context, userId int, action string, params map[string]interface{}) {
+	model.RecordOperationAuditLog(userId, auditContentEN(action, params), c.ClientIP(), action, params, nil, nil)
+}