mirror of
https://gh-proxy.org/https://github.com/klinsmaya/new-api.git
synced 2026-11-08 17:36:59 +08:00
WingStoneandCaIon
9a42033a61
* fix(task): honor channel header overrides for submission and polling Apply the existing Request Header Override configuration after task plugin headers, including per-task, batch and realtime queries. Resolve api_key from the credential used for that request and skip client-only placeholders when polling has no original client request. Reuse the HTTP header resolver without changing plugin contracts or adding provider-specific settings. Keep polling redirects visible, matching submission and utils.fetch, so a custom credential header cannot be forwarded to a redirect destination. Document configuration and cover precedence, saved keys, absent client context, invalid values, redirects and all polling initialization paths. Validation with Go 1.26.4 and GOWORK=off: - make test: root, relaykit and tokenkit passed before the realtime follow-up - go test ./relay ./relay/channel ./relay/channel/task/jsplugin ./service -count=1: passed after the follow-up - go vet ./... and go build ./...: passed after the follow-up - Independent read-only review: passed Scoped security review used OWASP ASVS 5.0.0 and the Authentication, Session Management and REST Security cheat sheets. Credentials remain in headers, client headers are not persisted, and redirects are not followed. No live provider calls or production deployment were performed. https://owasp.org/www-project-application-security-verification-standard/ https://cheatsheetseries.owasp.org/cheatsheets/Authentication_Cheat_Sheet.html https://cheatsheetseries.owasp.org/cheatsheets/Session_Management_Cheat_Sheet.html https://cheatsheetseries.owasp.org/cheatsheets/REST_Security_Cheat_Sheet.html * fix(task): follow poll redirects and override content request headers Polling follows redirects again through the shared HTTP client, which checks every hop against the SSRF protection settings. Refusing them turned each poll of a redirecting upstream into a failure, and after enough failures the task was failed and refunded. Credentialed content requests now carry the channel header overrides, as submission and polling do. Credentialless links, utils.fetch and the Host header stay as the plugin builds them. * fix(task): settle tasks that a realtime query sees finish Fetching a Gemini or Vertex task queries the upstream directly. When that query saw the task finish, it wrote the final status itself, so the poller skipped the task and never settled or refunded it: a failed task kept its charge. Hand that transition to the poller's single-task update, which records the status and settles exactly once. --------- Co-authored-by: CaIon <[email protected]>