CaIon 043ff99a51 fix: handle legacy database constraints and scoped policies ...

Resolve obsolete PostgreSQL single-column unique constraints by their actual
catalog names inside a locked transaction. Preserve unrelated indexes and
roll back constraint removal when foreign keys depend on them.

Load legacy authorization policies as structured fields. Preserve scoped
rows during baseline reseeding and load unsupported own/other scopes as
deny, preventing fallback to broader admin grants. Existing global grants
remain usable; unsupported scoped grants require administrator review.

Validation: fresh databases and rc.37 through rc.27, 60/60 combinations on
SQLite 3.50.4, MySQL 5.7.44/8.0.46, and PostgreSQL 9.6.24/16.15. Each ran
InitDB, separate InitLogDB, and authz.Init twice with persisted data.
Focused schema, foreign-key rollback, and master/slave policy reload
regressions passed, along with the authz package tests.

Security references: OWASP ASVS 5.0.0 controls 8.2.1, 8.2.2, and 8.3.1;
OWASP Authorization Cheat Sheet (least privilege and deny by default).

2026-09-12 19:33:53 +08:00

..

ability.go

feat(models): rework model/vendor management and pricing

2026-09-06 22:49:02 +08:00

account_security.go

feat(auth): unify login verification and secure account deletion

2026-09-06 22:49:02 +08:00

audit_log.go

refactor: modernize Go code conventions

2026-09-08 20:55:03 +08:00

audit_other.go

feat(security): add access token management and audit logs

2026-09-06 22:48:58 +08:00

auth_flow_test.go

refactor(auth): replace dashboard sessions with stateless tokens and session control (#6329)

2026-07-20 16:48:43 +08:00

auth_flow.go

feat(auth): unify login verification and secure account deletion

2026-09-06 22:49:02 +08:00

authz_role.go

feat: better admin permissions (#5755)

2026-06-27 17:01:59 +08:00

casbin_rule.go

feat: better admin permissions (#5755)

2026-06-27 17:01:59 +08:00

channel_cache.go

refactor: modernize Go code conventions

2026-09-08 20:55:03 +08:00

channel_constraint_test.go

feat(task): replace built-in task adaptors with a sandboxed JS plugin system (#7076)

2026-08-29 18:51:57 +08:00

channel_constraint.go

feat(plugins): enhance task streaming and model pricing

2026-09-11 21:44:56 +08:00

channel_satisfy.go

refactor: modernize Go code conventions

2026-09-08 20:55:03 +08:00

channel_settings_test.go

feat: add per-channel HTTP transport controls

2026-07-27 21:41:13 +08:00

channel_status_test.go

refactor: modernize Go code conventions

2026-09-08 20:55:03 +08:00

channel.go

refactor: modernize Go code conventions

2026-09-08 20:55:03 +08:00

checkin.go

refactor: modernize Go code conventions

2026-09-08 20:55:03 +08:00

clickhouse_log_test.go

fix: adapt ClickHouse log LIKE filters

2026-06-27 17:03:25 +08:00

custom_oauth_provider.go

feat(auth): migrate Telegram to unified OAuth

2026-09-06 22:48:59 +08:00

db_time.go

feat: support ClickHouse log database (#5663)

2026-06-22 18:41:26 +08:00

email_binding.go

feat(security): harden account binding and password changes

2026-09-06 22:49:00 +08:00

errors.go

refactor(auth): replace dashboard sessions with stateless tokens and session control (#6329)

2026-07-20 16:48:43 +08:00

external_identity_claim_test.go

refactor(auth): replace dashboard sessions with stateless tokens and session control (#6329)

2026-07-20 16:48:43 +08:00

external_identity_claim.go

feat(auth): migrate Telegram to unified OAuth

2026-09-06 22:48:59 +08:00

frontend_option_migration_test.go

refactor(auth): replace dashboard sessions with stateless tokens and session control (#6329)

2026-07-20 16:48:43 +08:00

frontend_option_migration.go

refactor(auth): replace dashboard sessions with stateless tokens and session control (#6329)

2026-07-20 16:48:43 +08:00

gorm_logger_test.go

fix(model): disable PostgreSQL prepared statements for pooler compatibility

2026-08-30 20:06:32 +08:00

gorm_logger.go

refactor: modernize Go code conventions

2026-09-08 20:55:03 +08:00

json_column_test.go

refactor: modernize Go code conventions

2026-09-08 20:55:03 +08:00

legacy_dalle_pricing.go

feat(pricing): convert legacy prices into expression drafts

2026-09-11 21:44:54 +08:00

locking_test.go

fix(model): centralize row locking in transactional flows

2026-07-07 12:40:09 +08:00

locking.go

fix(model): centralize row locking in transactional flows

2026-07-07 12:40:09 +08:00

log_format_test.go

refactor: modernize Go code conventions

2026-09-08 20:55:03 +08:00

log_other_test.go

refactor: modernize Go code conventions

2026-09-08 20:55:03 +08:00

log_other.go

feat(task): give polling hooks a real query context, host HTTP classification, and bounded poll failures

2026-09-03 14:37:47 +08:00

log.go

refactor: modernize Go code conventions

2026-09-08 20:55:03 +08:00

login_verification.go

feat(auth): unify login verification and secure account deletion

2026-09-06 22:49:02 +08:00

main.go

fix(options): rebuild options table primary key and stop pricing writes resetting rows

2026-09-09 00:24:49 +08:00

midjourney.go

fix(billing): 异步任务退款时同步减少 used_quota (#6795)

2026-08-13 22:06:40 +08:00

migration_dialector_test.go

fix: handle legacy database constraints and scoped policies

2026-09-12 19:33:53 +08:00

migration_dialector.go

fix: handle legacy database constraints and scoped policies

2026-09-12 19:33:53 +08:00

missing_models.go

🖼️ chore: format code file

2025-08-10 12:11:31 +08:00

model_extra.go

🚀 perf: optimize model management APIs, unify pricing types as array, and remove redundancies

2025-08-11 14:40:01 +08:00

model_meta.go

feat(models): improve model listing, pricing and visibility filters

2026-09-08 17:03:10 +08:00

model_metadata_sync.go

feat(models): rework model/vendor management and pricing

2026-09-06 22:49:02 +08:00

model_owner_test.go

fix: resolve model owned_by from active channels (#4416)

2026-05-21 11:16:17 +08:00

model_pricing_config.go

feat(plugins): enhance task streaming and model pricing

2026-09-11 21:44:56 +08:00

model_pricing_conversion.go

feat(pricing): convert legacy prices into expression drafts

2026-09-11 21:44:54 +08:00

option_auto_group_test.go

Feat/auto group (#6590)

2026-08-01 23:19:01 +08:00

option_primary_key_migration.go

fix(options): rebuild options table primary key and stop pricing writes resetting rows

2026-09-09 00:24:49 +08:00

option_task_plugin_test.go

refactor(task): remove the custom-plugin layer switch

2026-09-07 22:38:09 +08:00

option.go

feat(auth): add safe multi-RP ID passkey support

2026-09-11 23:15:29 +08:00

passkey_option.go

feat(auth): add safe multi-RP ID passkey support

2026-09-11 23:15:29 +08:00

passkey.go

feat(auth): add safe multi-RP ID passkey support

2026-09-11 23:15:29 +08:00

password_crypto.go

feat(auth): encrypt password login transport

2026-08-29 20:11:36 +08:00

payment_method_guard_test.go

refactor: deprecate int32 (#7025)

2026-08-26 20:57:54 +08:00

perf_metric.go

refactor: modernize Go code conventions

2026-09-08 20:55:03 +08:00

prefill_group_migration_test.go

fix(model): migrate renamed prefill group unique indexes

2026-09-12 18:43:18 +08:00

prefill_group_migration.go

fix(model): migrate renamed prefill group unique indexes

2026-09-12 18:43:18 +08:00

prefill_group.go

refactor: modernize Go code conventions

2026-09-08 20:55:03 +08:00

pricing_default.go

feat(models): rework model/vendor management and pricing

2026-09-06 22:49:02 +08:00

pricing_endpoint_test.go

refactor: extract protocol conversion layer into standalone relaykit module (#6369)

2026-07-27 15:56:21 +08:00

pricing_refresh.go

🖼️ chore: format code file

2025-08-10 12:11:31 +08:00

pricing_usage_schema_test.go

feat(plugins): enhance task streaming and model pricing

2026-09-11 21:44:56 +08:00

pricing.go

feat(plugins): enhance task streaming and model pricing

2026-09-11 21:44:56 +08:00

quota_reserve_test.go

refactor: modernize Go code conventions

2026-09-08 20:55:03 +08:00

quota_reserve.go

refactor: modernize Go code conventions

2026-09-08 20:55:03 +08:00

redemption_test.go

refactor: modernize Go code conventions

2026-09-08 20:55:03 +08:00

redemption.go

refactor: modernize Go code conventions

2026-09-08 20:55:03 +08:00

setup.go

✨ feat: Implement system setup functionality

2025-04-03 18:57:15 +08:00

subscription_auth_test.go

refactor(auth): replace dashboard sessions with stateless tokens and session control (#6329)

2026-07-20 16:48:43 +08:00

subscription_reset_test.go

feat(subscription): add admin quota reset actions (#5952)

2026-07-07 12:47:41 +08:00

subscription.go

refactor: modernize Go code conventions

2026-09-08 20:55:03 +08:00

system_instance.go

feat(system-info): add stale instance cleanup actions (#5953)

2026-07-07 21:22:49 +08:00

system_task_test.go

fix(model): do not treat no-op system task state writes as lock loss (#7135)

2026-09-01 20:54:17 +08:00

system_task.go

fix(model): do not treat no-op system task state writes as lock loss (#7135)

2026-09-01 20:54:17 +08:00

task_cas_test.go

refactor: modernize Go code conventions

2026-09-08 20:55:03 +08:00

task_model_alias.go

feat(task): resolve channel-mapped aliases and case variants for plugin models

2026-08-30 19:13:51 +08:00

task_openai_video_test.go

feat(task): replace built-in task adaptors with a sandboxed JS plugin system (#7076)

2026-08-29 18:51:57 +08:00

task_plugin_channel_select_test.go

feat(plugins): enhance task streaming and model pricing

2026-09-11 21:44:56 +08:00

task_plugin_test.go

feat(task): replace built-in task adaptors with a sandboxed JS plugin system (#7076)

2026-08-29 18:51:57 +08:00

task_plugin.go

feat(plugins): extend plugin metadata and icon support

2026-09-08 15:15:55 +08:00

task.go

refactor: modernize Go code conventions

2026-09-08 20:55:03 +08:00

token_auto_groups_cache_test.go

fix: harden concurrent quota and status updates

2026-08-11 22:03:47 +08:00

token_cache.go

fix: harden concurrent quota and status updates

2026-08-11 22:03:47 +08:00

token_migration_test.go

fix(model): migrate legacy token key constraints

2026-08-31 11:51:59 +08:00

token_migration.go

fix(model): migrate legacy token key constraints

2026-08-31 11:51:59 +08:00

token.go

refactor: modernize Go code conventions

2026-09-08 20:55:03 +08:00

topup.go

refactor: modernize Go code conventions

2026-09-08 20:55:03 +08:00

twofa_enrollment.go

fix(security): bind verification proofs to sessions and actions

2026-09-06 22:48:59 +08:00

twofa.go

refactor: modernize Go code conventions

2026-09-08 20:55:03 +08:00

usedata_flow_test.go

feat(dashboard): add traffic flow sankey chart (#5465)

2026-06-20 18:57:47 +08:00

usedata_flow.go

feat(dashboard): add traffic flow sankey chart (#5465)

2026-06-20 18:57:47 +08:00

usedata_rankings.go

feat: support ClickHouse log database (#5663)

2026-06-22 18:41:26 +08:00

usedata.go

refactor: modernize Go code conventions

2026-09-08 20:55:03 +08:00

user_auth_cache.go

refactor: modernize Go code conventions

2026-09-08 20:55:03 +08:00

user_authentication_test.go

feat(auth): add safe multi-RP ID passkey support

2026-09-11 23:15:29 +08:00

user_cache_auth_version_test.go

refactor(auth): replace dashboard sessions with stateless tokens and session control (#6329)

2026-07-20 16:48:43 +08:00

user_cache.go

refactor: modernize Go code conventions

2026-09-08 20:55:03 +08:00

user_oauth_binding.go

fix(oauth): clear bindings when hard deleting users (#5582)

2026-06-18 12:16:23 +08:00

user_pagination_test.go

fix: add server-side sorting to user list, prevent client-side sort on paged data (#6194)

2026-07-17 19:36:44 +08:00

user_quota_adjustment.go

feat(audit): complete token and quota operation records

2026-09-06 22:49:01 +08:00

user_session_migration_test.go

fix(db): avoid redundant schema migrations on restart

2026-09-06 22:48:58 +08:00

user_session_test.go

refactor: modernize Go code conventions

2026-09-08 20:55:03 +08:00

user_session.go

refactor: modernize Go code conventions

2026-09-08 20:55:03 +08:00

user_update_test.go

refactor: modernize Go code conventions

2026-09-08 20:55:03 +08:00

user.go

refactor: modernize Go code conventions

2026-09-08 20:55:03 +08:00

utils.go

refactor: modernize Go code conventions

2026-09-08 20:55:03 +08:00

vendor_management.go

feat(models): rework model/vendor management and pricing

2026-09-06 22:49:02 +08:00

vendor_meta.go

feat(models): rework model/vendor management and pricing

2026-09-06 22:49:02 +08:00