CaIon 2506e1b980 fix(auth): reject non-standard roles when creating a user ...

CreateUser accepted any integer role below the operator's own, so an
admin could create a user with role 5 or -1, and a root user's request
for role 99 went on to step-up verification before failing. Only the
guest, common, admin and root roles are accepted now; any other value
fails with an invalid-parameter error before verification and nothing
is written.

2026-09-30 20:52:10 +08:00

..

access_token_audit_test.go

feat(auth): replace the dashboard access token with scoped access tokens

2026-09-30 17:24:19 +08:00

access_token.go

feat(auth): replace the dashboard access token with scoped access tokens

2026-09-30 17:24:19 +08:00

admin_user_verification_test.go

fix(auth): reject non-standard roles when creating a user

2026-09-30 20:52:10 +08:00

audit.go

feat(auth): replace the dashboard access token with scoped access tokens

2026-09-30 17:24:19 +08:00

auth_flow_test.go

fix(oauth): require account evidence before migrating legacy GitHub bindings

2026-09-18 23:00:37 +08:00

auth_session_test.go

fix(oauth): require account evidence before migrating legacy GitHub bindings

2026-09-18 23:00:37 +08:00

auth_session.go

feat(auth): replace the dashboard access token with scoped access tokens

2026-09-30 17:24:19 +08:00

authz.go

feat: better admin permissions (#5755)

2026-06-27 17:01:59 +08:00

billing_option_test.go

feat(billing): configure trust threshold and input pre-consume multiplier

2026-09-20 22:17:20 +08:00

billing.go

refactor: extract protocol conversion layer into standalone relaykit module (#6369)

2026-07-27 15:56:21 +08:00

channel_affinity_cache.go

fix: channel affinity (#2799)

2026-02-02 14:37:31 +08:00

channel_authz_test.go

refactor: modernize Go code conventions

2026-09-08 20:55:03 +08:00

channel_authz.go

feat: better admin permissions (#5755)

2026-06-27 17:01:59 +08:00

channel_billing_test.go

feat(channel): 修复获取DeepSeek余额错误 (#6814)

2026-09-15 00:46:54 +08:00

channel_inference_test.go

feat: vllm channel && sglang channel (#7332)

2026-09-15 00:06:42 +08:00

channel_inference.go

feat: vllm channel && sglang channel (#7332)

2026-09-15 00:06:42 +08:00

channel_multi_key_test.go

Add Responses WebSocket relay support (#5062)

2026-09-14 21:04:26 +08:00

channel_pin_retry_test.go

feat(policy): add request policies settings and routing decision records

2026-09-18 11:24:29 +08:00

channel_task_plugin_bind_test.go

feat(channel): bind multiple task plugins to New API channels

2026-09-20 17:51:51 +08:00

channel_task_plugin_validation_test.go

feat(channel): bind multiple task plugins to New API channels

2026-09-20 17:51:51 +08:00

channel_test_internal_test.go

fix(channels): show built-in base URLs as placeholders

2026-09-12 11:42:13 +08:00

channel_test_request_test.go

fix(relay): apply model-specific OpenAI chat capabilities (#7211)

2026-09-06 15:47:45 +08:00

channel_upstream_update_test.go

refactor: modernize Go code conventions

2026-09-08 20:55:03 +08:00

channel_upstream_update.go

feat: vllm channel && sglang channel (#7332)

2026-09-15 00:06:42 +08:00

channel-billing.go

feat(channel): 修复获取DeepSeek余额错误 (#6814)

2026-09-15 00:46:54 +08:00

channel-test.go

refactor: modernize Go code conventions

2026-09-08 20:55:03 +08:00

channel.go

feat(channel): bind multiple task plugins to New API channels

2026-09-20 17:51:51 +08:00

checkin.go

feat(checkin): add check-in functionality with status retrieval and user quota rewards

2026-01-02 23:00:33 +08:00

codex_usage.go

fix(channel): improve proxy client compatibility and cache lifecycle (#6157)

2026-07-20 18:11:22 +08:00

custom_oauth.go

feat(auth): replace the dashboard access token with scoped access tokens

2026-09-30 17:24:19 +08:00

deployment.go

refactor: modernize Go code conventions

2026-09-08 20:55:03 +08:00

email_binding.go

feat(auth): replace the dashboard access token with scoped access tokens

2026-09-30 17:24:19 +08:00

group.go

refactor: modernize Go code conventions

2026-09-08 20:55:03 +08:00

image.go

feat: support dify upload image file

2025-03-15 19:10:12 +08:00

log.go

fix(logs): isolate privileged metadata

2026-09-03 11:28:57 +08:00

login_verification.go

fix(oauth): require account evidence before migrating legacy GitHub bindings

2026-09-18 23:00:37 +08:00

midjourney.go

fix(billing): 异步任务退款时同步减少 used_quota (#6795)

2026-08-13 22:06:40 +08:00

misc_oidc_test.go

feat(oidc): 支持自定义 OIDC 登录显示名称 (#6012)

2026-07-29 16:27:15 +08:00

misc.go

fix: refine sign-in page behavior

2026-09-13 15:26:10 +08:00

missing_models.go

format: package name -> github.com/QuantumNous/new-api (#2017)

2025-10-11 15:30:09 +08:00

model_list_test.go

fix(oauth): require account evidence before migrating legacy GitHub bindings

2026-09-18 23:00:37 +08:00

model_management_test.go

feat(plugins): serve OpenAI Images API through task plugins

2026-09-20 17:58:45 +08:00

model_meta.go

refactor: modernize Go code conventions

2026-09-08 20:55:03 +08:00

model_owned_by_test.go

Feat/auto group (#6590)

2026-08-01 23:19:01 +08:00

model_pricing_config.go

feat(pricing): convert legacy prices into expression drafts

2026-09-11 21:44:54 +08:00

model_sync.go

refactor: modernize Go code conventions

2026-09-08 20:55:03 +08:00

model.go

refactor: modernize Go code conventions

2026-09-08 20:55:03 +08:00

oauth.go

fix(oauth): require account evidence before migrating legacy GitHub bindings

2026-09-18 23:00:37 +08:00

option_claude_test.go

refactor: extract protocol conversion layer into standalone relaykit module (#6369)

2026-07-27 15:56:21 +08:00

option_gemini_test.go

refactor: extract protocol conversion layer into standalone relaykit module (#6369)

2026-07-27 15:56:21 +08:00

option.go

feat(auth): add safe multi-RP ID passkey support

2026-09-11 23:15:29 +08:00

passkey_test.go

feat(auth): replace the dashboard access token with scoped access tokens

2026-09-30 17:24:19 +08:00

passkey.go

feat(auth): replace the dashboard access token with scoped access tokens

2026-09-30 17:24:19 +08:00

payment_compliance.go

feat: require compliance confirmation for paid features

2026-05-13 22:18:46 +08:00

payment_webhook_availability_test.go

[Feature Request] Waffo Pancake gateway — full integration with subscription support + admin catalog binding flow (#4935)

2026-05-22 11:00:58 +08:00

payment_webhook_availability.go

[Feature Request] Waffo Pancake gateway — full integration with subscription support + admin catalog binding flow (#4935)

2026-05-22 11:00:58 +08:00

perf_metrics.go

perf(metrics): record relay outcomes at the request boundary and classify stream results

2026-09-18 11:24:30 +08:00

performance.go

fix: log management race condition, partial delete reporting, and UX issues

2026-03-21 20:40:39 +08:00

playground.go

refactor: extract protocol conversion layer into standalone relaykit module (#6369)

2026-07-27 15:56:21 +08:00

plugin_endpoint_test.go

feat(task): replace built-in task adaptors with a sandboxed JS plugin system (#7076)

2026-08-29 18:51:57 +08:00

plugin_native_e2e_test.go

feat(task): replace built-in task adaptors with a sandboxed JS plugin system (#7076)

2026-08-29 18:51:57 +08:00

plugin_protocol_image.go

feat(plugins): serve OpenAI Images API through task plugins

2026-09-20 17:58:45 +08:00

plugin_protocol_limiter_test.go

feat(task): replace built-in task adaptors with a sandboxed JS plugin system (#7076)

2026-08-29 18:51:57 +08:00

plugin_protocol_limiter.go

feat(task): replace built-in task adaptors with a sandboxed JS plugin system (#7076)

2026-08-29 18:51:57 +08:00

plugin_protocol_sdk_test.go

feat(task): replace built-in task adaptors with a sandboxed JS plugin system (#7076)

2026-08-29 18:51:57 +08:00

plugin_protocol_test.go

feat(plugins): serve OpenAI Images API through task plugins

2026-09-20 17:58:45 +08:00

plugin_protocol.go

feat(jsplugin): run task plugins on moejs

2026-09-30 17:24:19 +08:00

prefill_group.go

format: package name -> github.com/QuantumNous/new-api (#2017)

2025-10-11 15:30:09 +08:00

pricing.go

refactor: modernize Go code conventions

2026-09-08 20:55:03 +08:00

rankings.go

fix: enforce header nav access control for public modules (#4889)

2026-05-16 14:54:47 +08:00

ratio_config.go

feat(models): rework model/vendor management and pricing

2026-09-06 22:49:02 +08:00

ratio_sync_test.go

feat(models): rework model/vendor management and pricing

2026-09-06 22:49:02 +08:00

ratio_sync.go

refactor: modernize Go code conventions

2026-09-08 20:55:03 +08:00

redemption_batch_test.go

feat(redemptions): add batch deletion and optional file exports

2026-09-08 20:47:01 +08:00

redemption.go

refactor: modernize Go code conventions

2026-09-08 20:55:03 +08:00

relay_count_tokens_test.go

feat(relay): hosted-tool conversion fidelity, reasoning normalization, and billing usage integrity (#7137)

2026-09-01 21:53:35 +08:00

relay_error_log_test.go

refactor: modernize Go code conventions

2026-09-08 20:55:03 +08:00

relay_task_plugin_test.go

feat(plugins): serve OpenAI Images API through task plugins

2026-09-20 17:58:45 +08:00

relay.go

feat(plugins): serve OpenAI Images API through task plugins

2026-09-20 17:58:45 +08:00

request_policy.go

feat(policy): add request policies settings and routing decision records

2026-09-18 11:24:29 +08:00

responses_websocket_test.go

test(billing): fix websocket rejection refund test after pre-consume dropped output estimation (#7491)

2026-09-21 12:48:24 +08:00

responses_websocket.go

Add Responses WebSocket relay support (#5062)

2026-09-14 21:04:26 +08:00

return_path_test.go

refactor(auth): replace dashboard sessions with stateless tokens and session control (#6329)

2026-07-20 16:48:43 +08:00

return_path.go

refactor(auth): replace dashboard sessions with stateless tokens and session control (#6329)

2026-07-20 16:48:43 +08:00

revalidated_response.go

fix: keep ETag valid across different JSON packages

2026-09-03 20:42:57 +08:00

secure_verification.go

feat(auth): replace the dashboard access token with scoped access tokens

2026-09-30 17:24:19 +08:00

security_account_test.go

feat(auth): replace the dashboard access token with scoped access tokens

2026-09-30 17:24:19 +08:00

security_enrollment_test.go

feat(auth): replace the dashboard access token with scoped access tokens

2026-09-30 17:24:19 +08:00

setup.go

feat(security): harden account binding and password changes

2026-09-06 22:49:00 +08:00

subscription_payment_creem.go

feat: require compliance confirmation for paid features

2026-05-13 22:18:46 +08:00

subscription_payment_epay.go

refactor(auth): replace dashboard sessions with stateless tokens and session control (#6329)

2026-07-20 16:48:43 +08:00

subscription_payment_stripe.go

refactor(auth): replace dashboard sessions with stateless tokens and session control (#6329)

2026-07-20 16:48:43 +08:00

subscription_payment_waffo_pancake.go

[BugFix] fix webhook process (#5047)

2026-05-24 16:19:27 +08:00

subscription.go

refactor: modernize Go code conventions

2026-09-08 20:55:03 +08:00

system_info.go

feat(system-info): add stale instance cleanup actions (#5953)

2026-07-07 21:22:49 +08:00

system_task_handlers.go

refactor: update task refund logic and remove legacy handling

2026-07-26 20:47:52 +08:00

system_task_test.go

feat(system-tasks): add filtered task history with cleanup

2026-09-18 11:24:30 +08:00

system_task.go

feat(system-tasks): add filtered task history with cleanup

2026-09-18 11:24:30 +08:00

task_generic_test.go

feat(plugins): serve OpenAI Images API through task plugins

2026-09-20 17:58:45 +08:00

task_log_view_test.go

feat(task): replace built-in task adaptors with a sandboxed JS plugin system (#7076)

2026-08-29 18:51:57 +08:00

task_plugin_debug_test.go

feat(task): replace built-in task adaptors with a sandboxed JS plugin system (#7076)

2026-08-29 18:51:57 +08:00

task_plugin_debug.go

feat(task): replace built-in task adaptors with a sandboxed JS plugin system (#7076)

2026-08-29 18:51:57 +08:00

task_plugin_test.go

perf(plugins): sync task plugins from hashes and load source only for changed rows

2026-09-21 21:01:16 +08:00

task_plugin.go

perf(plugins): sync task plugins from hashes and load source only for changed rows

2026-09-21 21:01:16 +08:00

task.go

feat(plugins): serve OpenAI Images API through task plugins

2026-09-20 17:58:45 +08:00

telegram_test.go

refactor: modernize Go code conventions

2026-09-08 20:55:03 +08:00

telegram.go

feat(auth): migrate Telegram to unified OAuth

2026-09-06 22:48:59 +08:00

theme_compat_test.go

refactor(auth): replace dashboard sessions with stateless tokens and session control (#6329)

2026-07-20 16:48:43 +08:00

token_auto_groups_test.go

Feat/auto group (#6590)

2026-08-01 23:19:01 +08:00

token_test.go

feat(audit): complete token and quota operation records

2026-09-06 22:49:01 +08:00

token.go

feat(audit): complete token and quota operation records

2026-09-06 22:49:01 +08:00

topup_creem.go

fix(topup): guard wallet quota during recharge

2026-08-14 17:34:57 +08:00

topup_quota_limit_test.go

refactor: deprecate int32 (#7025)

2026-08-26 20:57:54 +08:00

topup_stripe.go

fix(topup): guard wallet quota during recharge

2026-08-14 17:34:57 +08:00

topup_waffo_pancake_test.go

refactor: modernize Go code conventions

2026-09-08 20:55:03 +08:00

topup_waffo_pancake.go

fix(topup): guard wallet quota during recharge

2026-08-14 17:34:57 +08:00

topup_waffo.go

refactor: modernize Go code conventions

2026-09-08 20:55:03 +08:00

topup.go

refactor: modernize Go code conventions

2026-09-08 20:55:03 +08:00

twofa.go

feat(auth): replace the dashboard access token with scoped access tokens

2026-09-30 17:24:19 +08:00

uptime_kuma.go

refactor: modernize Go code conventions

2026-09-08 20:55:03 +08:00

usedata_flow_test.go

feat(dashboard): add traffic flow sankey chart (#5465)

2026-06-20 18:57:47 +08:00

usedata.go

feat(dashboard): add traffic flow sankey chart (#5465)

2026-06-20 18:57:47 +08:00

user_manage_test.go

feat(auth): replace the dashboard access token with scoped access tokens

2026-09-30 17:24:19 +08:00

user_quota.go

feat(audit): complete token and quota operation records

2026-09-06 22:49:01 +08:00

user.go

fix(auth): reject non-standard roles when creating a user

2026-09-30 20:52:10 +08:00

vendor_meta.go

feat(models): rework model/vendor management and pricing

2026-09-06 22:49:02 +08:00

video_proxy.go

feat(task): replace built-in task adaptors with a sandboxed JS plugin system (#7076)

2026-08-29 18:51:57 +08:00

wechat.go

feat(auth): replace the dashboard access token with scoped access tokens

2026-09-30 17:24:19 +08:00