CaIon 45c3fbe8ae fix(security): bind verification proofs to sessions and actions ...

Require single-use operation proofs for passkey enrollment, two-factor setup, and channel key access. Add password and OAuth verification flows, enforce session-bound enrollment, and redact OAuth callback secrets from logs.

Validation: affected Go packages pass; frontend typecheck, changed-file lint, and 111 tests pass. Security enrollment regressions pass on SQLite 3.50.4, MySQL 8.0.46, and PostgreSQL 16.15. Full frontend lint has pre-existing errors outside the changed files.

2026-09-06 22:48:59 +08:00

..

limiter

format: package name -> github.com/QuantumNous/new-api (#2017)

2025-10-11 15:30:09 +08:00

api_type_task_plugin_test.go

feat(task): replace built-in task adaptors with a sandboxed JS plugin system (#7076)

2026-08-29 18:51:57 +08:00

api_type.go

feat(task): replace built-in task adaptors with a sandboxed JS plugin system (#7076)

2026-08-29 18:51:57 +08:00

audio.go

Revert "feat(audio): replace SysLog with logger for improved logging in GetAudioDuration"

2025-12-14 00:04:40 +08:00

body_storage_test.go

refactor(relay): move replay metadata onto request bodies

2026-08-06 17:33:10 +08:00

body_storage.go

refactor(relay): move replay metadata onto request bodies

2026-08-06 17:33:10 +08:00

constants.go

fix(relay): bound the wait for upstream response headers (fixes unbounded heap growth → OOM) (#6949)

2026-08-30 21:18:41 +08:00

copy.go

perf(common): 批量复制 RawMessage，优化请求深拷贝 (#7221)

2026-09-06 14:02:39 +08:00

crypto.go

format: package name -> github.com/QuantumNous/new-api (#2017)

2025-10-11 15:30:09 +08:00

custom-event.go

refactor: remove mutex from CustomEvent and update TCP connection handling in tests

2026-07-28 15:09:49 +08:00

database.go

fix(sqlite): enable WAL + working busy timeout + _txlock=immediate to stop concurrent write lockouts (#7030)

2026-08-30 20:46:56 +08:00

disk_cache_config.go

feat(cache): enhance disk cache management with concurrency control and cleanup optimizations

2026-02-04 18:23:17 +08:00

disk_cache.go

feat(cache): enhance disk cache management with concurrency control and cleanup optimizations

2026-02-04 18:23:17 +08:00

email_ntlm_auth.go

fix: preserve SMTP PLAIN auth TLS guard

2026-06-24 12:50:54 +08:00

email_test.go

refactor: remove mutex from CustomEvent and update TCP connection handling in tests

2026-07-28 15:09:49 +08:00

email-outlook-auth.go

fix: 多地区outlook邮箱和ofb邮箱Auth

2024-08-23 17:16:09 +08:00

email.go

fix: support SMTP STARTTLS mode and NTLM auth (#5426)

2026-06-24 12:45:39 +08:00

embed-file-system.go

refactor(auth): replace dashboard sessions with stateless tokens and session control (#6329)

2026-07-20 16:48:43 +08:00

endpoint_defaults.go

feat: configurable tool pricing, Sub2API channel, and alpha search billing

2026-07-26 20:05:15 +08:00

endpoint_type.go

feat: add New API channel support

2026-07-27 15:20:19 +08:00

env.go

feat: add env DIFY_DEBUG

2024-07-07 02:24:51 +08:00

etag.go

fix: keep ETag valid across different JSON packages

2026-09-03 20:42:57 +08:00

gin.go

perf: reduce heap residency for large base64 relay requests

2026-05-22 19:08:38 +08:00

go-channel.go

refactor: Replace manual goroutine creation with gopool.Go

2025-02-19 18:38:29 +08:00

gopool.go

format: package name -> github.com/QuantumNous/new-api (#2017)

2025-10-11 15:30:09 +08:00

hash.go

fix: for AI review problems

2025-07-10 20:55:43 +08:00

init.go

feat(task): give polling hooks a real query context, host HTTP classification, and bounded poll failures

2026-09-03 14:37:47 +08:00

ip.go

feat(auth): enhance IP restriction handling with CIDR support

2025-12-15 17:24:09 +08:00

json_test.go

fix(security): bind verification proofs to sessions and actions

2026-09-06 22:48:59 +08:00

json.go

fix(security): bind verification proofs to sessions and actions

2026-09-06 22:48:59 +08:00

model.go

feat: refactor token estimation logic

2025-12-02 21:34:39 +08:00

node_identity.go

feat: add system task runner (#5680)

2026-06-24 17:16:21 +08:00

page_info.go

fix: page query param is p

2025-07-21 15:39:16 +08:00

password_crypto.go

feat(auth): encrypt password login transport

2026-08-29 20:11:36 +08:00

performance_config.go

feat(performance): implement system performance monitoring with configurable thresholds

2026-02-04 21:26:07 +08:00

pprof.go

format: package name -> github.com/QuantumNous/new-api (#2017)

2025-10-11 15:30:09 +08:00

proxy_url.go

fix(channel): improve proxy client compatibility and cache lifecycle (#6157)

2026-07-20 18:11:22 +08:00

pyro.go

docs: document pyroscope env var

2025-12-19 23:16:56 +08:00

quota_math_test.go

refactor: deprecate int32 (#7025)

2026-08-26 20:57:54 +08:00

quota_math.go

refactor: deprecate int32 (#7025)

2026-08-26 20:57:54 +08:00

quota.go

refactor: enhance quota handling and logging for pre-consume operations

2025-08-14 21:30:03 +08:00

rate-limit.go

Initial commit

2023-04-22 20:39:27 +08:00

redis.go

✨ feat: refactor environment variable initialization and introduce new constant types for API and context keys

2025-07-03 13:10:25 +08:00

request_body_limit.go

fix: limit anonymous request body (#5244)

2026-06-05 11:39:29 +08:00

session_cookie.go

refactor(auth): replace dashboard sessions with stateless tokens and session control (#6329)

2026-07-20 16:48:43 +08:00

ssrf_protection_test.go

feat(ssrf): implement SSRF protection in HTTP clients and validation functions

2026-07-06 14:52:01 +08:00

ssrf_protection.go

feat(ssrf): implement SSRF protection in HTTP clients and validation functions

2026-07-06 14:52:01 +08:00

str.go

refactor: extract protocol conversion layer into standalone relaykit module (#6369)

2026-07-27 15:56:21 +08:00

sys_log.go

refactor(auth): replace dashboard sessions with stateless tokens and session control (#6329)

2026-07-20 16:48:43 +08:00

system_monitor_unix.go

feat(performance): implement system performance monitoring with configurable thresholds

2026-02-04 21:26:07 +08:00

system_monitor_windows.go

feat(performance): implement system performance monitoring with configurable thresholds

2026-02-04 21:26:07 +08:00

system_monitor.go

feat(performance): implement system performance monitoring with configurable thresholds

2026-02-04 21:26:07 +08:00

topup-ratio.go

refactor(ratio): replace maps with RWMap for improved concurrency handling

2026-02-08 00:48:21 +08:00

totp.go

fix: coderabbit review

2025-08-03 10:41:00 +08:00

trusted_proxies.go

feat(task): replace built-in task adaptors with a sandboxed JS plugin system (#7076)

2026-08-29 18:51:57 +08:00

url_validator_test.go

refactor(auth): replace dashboard sessions with stateless tokens and session control (#6329)

2026-07-20 16:48:43 +08:00

url_validator.go

feat: Add trusted redirect domains.

2026-01-26 22:18:04 +09:00

user_session_test.go

refactor(auth): replace dashboard sessions with stateless tokens and session control (#6329)

2026-07-20 16:48:43 +08:00

utils.go

feat: support ClickHouse log database (#5663)

2026-06-22 18:41:26 +08:00

validate.go

Initial commit

2023-04-22 20:39:27 +08:00

verification.go

format: package name -> github.com/QuantumNous/new-api (#2017)

2025-10-11 15:30:09 +08:00