CaIon 4924361aef feat(auth): edit the name and permissions of an access token ...

The token menu now opens an edit dialog instead of a rename prompt.
Renaming still needs no verification. Changing the permissions requires
step-up verification bound to the token id and the new grant, so a
proof cannot be replayed for another token or another set of
permissions; the grant is checked against what the owner can do, the
same as at creation. PATCH /api/user/access_tokens/:id takes an
optional scopes list and is rate limited like the other token routes.

A token that holds permissions the catalog no longer offers can still
be renamed and keeps them; a new grant only contains offered
permissions. Edit stays disabled until the permission catalog has
loaded.

Grant changes are audited as access_token.update with the previous and
new scopes, and audit details show both as permission names.

The permission picker for tokens and admin users now uses toggle
buttons. Token permissions are grouped by personal, administration and
system, each group collapsible with a selected count and select-all or
clear.

2026-09-30 20:52:36 +08:00

..

ability.go

feat(models): rework model/vendor management and pricing

2026-09-06 22:49:02 +08:00

account_security.go

fix(oauth): require account evidence before migrating legacy GitHub bindings

2026-09-18 23:00:37 +08:00

audit_log.go

feat(auth): replace the dashboard access token with scoped access tokens

2026-09-30 17:24:19 +08:00

audit_other.go

feat(security): add access token management and audit logs

2026-09-06 22:48:58 +08:00

auth_flow_test.go

refactor(auth): replace dashboard sessions with stateless tokens and session control (#6329)

2026-07-20 16:48:43 +08:00

auth_flow.go

feat(auth): replace the dashboard access token with scoped access tokens

2026-09-30 17:24:19 +08:00

authz_role.go

feat: better admin permissions (#5755)

2026-06-27 17:01:59 +08:00

casbin_rule.go

feat: better admin permissions (#5755)

2026-06-27 17:01:59 +08:00

channel_cache.go

refactor: modernize Go code conventions

2026-09-08 20:55:03 +08:00

channel_constraint_test.go

feat(task): replace built-in task adaptors with a sandboxed JS plugin system (#7076)

2026-08-29 18:51:57 +08:00

channel_constraint.go

feat(channel): bind multiple task plugins to New API channels

2026-09-20 17:51:51 +08:00

channel_satisfy.go

refactor: modernize Go code conventions

2026-09-08 20:55:03 +08:00

channel_settings_test.go

feat: vllm channel && sglang channel (#7332)

2026-09-15 00:06:42 +08:00

channel_status_test.go

refactor: modernize Go code conventions

2026-09-08 20:55:03 +08:00

channel.go

feat: vllm channel && sglang channel (#7332)

2026-09-15 00:06:42 +08:00

checkin.go

refactor: modernize Go code conventions

2026-09-08 20:55:03 +08:00

clickhouse_log_test.go

fix: adapt ClickHouse log LIKE filters

2026-06-27 17:03:25 +08:00

custom_oauth_provider.go

feat(auth): migrate Telegram to unified OAuth

2026-09-06 22:48:59 +08:00

db_time.go

feat: support ClickHouse log database (#5663)

2026-06-22 18:41:26 +08:00

email_binding.go

feat(security): harden account binding and password changes

2026-09-06 22:49:00 +08:00

errors.go

refactor(auth): replace dashboard sessions with stateless tokens and session control (#6329)

2026-07-20 16:48:43 +08:00

external_identity_claim_test.go

refactor(auth): replace dashboard sessions with stateless tokens and session control (#6329)

2026-07-20 16:48:43 +08:00

external_identity_claim.go

feat(auth): migrate Telegram to unified OAuth

2026-09-06 22:48:59 +08:00

frontend_option_migration_test.go

refactor(auth): replace dashboard sessions with stateless tokens and session control (#6329)

2026-07-20 16:48:43 +08:00

frontend_option_migration.go

refactor(auth): replace dashboard sessions with stateless tokens and session control (#6329)

2026-07-20 16:48:43 +08:00

gorm_logger_test.go

fix(model): disable PostgreSQL prepared statements for pooler compatibility

2026-08-30 20:06:32 +08:00

gorm_logger.go

refactor: modernize Go code conventions

2026-09-08 20:55:03 +08:00

json_column_test.go

refactor: modernize Go code conventions

2026-09-08 20:55:03 +08:00

legacy_dalle_pricing.go

feat(pricing): convert legacy prices into expression drafts

2026-09-11 21:44:54 +08:00

locking_test.go

fix(model): centralize row locking in transactional flows

2026-07-07 12:40:09 +08:00

locking.go

fix(model): centralize row locking in transactional flows

2026-07-07 12:40:09 +08:00

log_format_test.go

refactor: modernize Go code conventions

2026-09-08 20:55:03 +08:00

log_other_test.go

refactor: modernize Go code conventions

2026-09-08 20:55:03 +08:00

log_other.go

feat(task): give polling hooks a real query context, host HTTP classification, and bounded poll failures

2026-09-03 14:37:47 +08:00

log.go

refactor: modernize Go code conventions

2026-09-08 20:55:03 +08:00

login_verification.go

fix(oauth): require account evidence before migrating legacy GitHub bindings

2026-09-18 23:00:37 +08:00

main.go

feat(auth): replace the dashboard access token with scoped access tokens

2026-09-30 17:24:19 +08:00

midjourney.go

fix(billing): 异步任务退款时同步减少 used_quota (#6795)

2026-08-13 22:06:40 +08:00

migration_dialector_test.go

fix: handle legacy database constraints and scoped policies

2026-09-12 19:33:53 +08:00

migration_dialector.go

fix: handle legacy database constraints and scoped policies

2026-09-12 19:33:53 +08:00

missing_models.go

🖼️ chore: format code file

2025-08-10 12:11:31 +08:00

model_extra.go

🚀 perf: optimize model management APIs, unify pricing types as array, and remove redundancies

2025-08-11 14:40:01 +08:00

model_meta.go

feat(models): improve model listing, pricing and visibility filters

2026-09-08 17:03:10 +08:00

model_metadata_sync.go

feat(models): rework model/vendor management and pricing

2026-09-06 22:49:02 +08:00

model_owner_test.go

fix: resolve model owned_by from active channels (#4416)

2026-05-21 11:16:17 +08:00

model_pricing_config.go

fix(pricing): keep prices saved before a usage profile narrows editable

2026-09-30 17:24:19 +08:00

model_pricing_conversion.go

feat(plugins): serve OpenAI Images API through task plugins

2026-09-20 17:58:45 +08:00

option_auto_group_test.go

Feat/auto group (#6590)

2026-08-01 23:19:01 +08:00

option_primary_key_migration.go

fix(options): rebuild options table primary key and stop pricing writes resetting rows

2026-09-09 00:24:49 +08:00

option_task_plugin_test.go

refactor(task): remove the custom-plugin layer switch

2026-09-07 22:38:09 +08:00

option.go

feat(auth): replace the dashboard access token with scoped access tokens

2026-09-30 17:24:19 +08:00

passkey_option.go

feat(auth): add safe multi-RP ID passkey support

2026-09-11 23:15:29 +08:00

passkey.go

feat(auth): add safe multi-RP ID passkey support

2026-09-11 23:15:29 +08:00

password_crypto.go

feat(auth): encrypt password login transport

2026-08-29 20:11:36 +08:00

payment_method_guard_test.go

refactor: deprecate int32 (#7025)

2026-08-26 20:57:54 +08:00

perf_metric.go

refactor: modernize Go code conventions

2026-09-08 20:55:03 +08:00

prefill_group_migration_test.go

fix(model): migrate renamed prefill group unique indexes

2026-09-12 18:43:18 +08:00

prefill_group_migration.go

fix(model): migrate renamed prefill group unique indexes

2026-09-12 18:43:18 +08:00

prefill_group.go

refactor: modernize Go code conventions

2026-09-08 20:55:03 +08:00

pricing_default.go

feat(models): rework model/vendor management and pricing

2026-09-06 22:49:02 +08:00

pricing_endpoint_test.go

refactor: extract protocol conversion layer into standalone relaykit module (#6369)

2026-07-27 15:56:21 +08:00

pricing_refresh.go

🖼️ chore: format code file

2025-08-10 12:11:31 +08:00

pricing_usage_schema_test.go

fix(pricing): keep prices saved before a usage profile narrows editable

2026-09-30 17:24:19 +08:00

pricing.go

feat(plugins): enhance task streaming and model pricing

2026-09-11 21:44:56 +08:00

quota_reserve_test.go

refactor: modernize Go code conventions

2026-09-08 20:55:03 +08:00

quota_reserve.go

refactor: modernize Go code conventions

2026-09-08 20:55:03 +08:00

redemption_test.go

refactor: modernize Go code conventions

2026-09-08 20:55:03 +08:00

redemption.go

refactor: modernize Go code conventions

2026-09-08 20:55:03 +08:00

request_policy_test.go

feat(policy): add request policies settings and routing decision records

2026-09-18 11:24:29 +08:00

request_policy.go

feat(policy): add request policies settings and routing decision records

2026-09-18 11:24:29 +08:00

setup.go

✨ feat: Implement system setup functionality

2025-04-03 18:57:15 +08:00

subscription_auth_test.go

refactor(auth): replace dashboard sessions with stateless tokens and session control (#6329)

2026-07-20 16:48:43 +08:00

subscription_reset_test.go

feat(subscription): add admin quota reset actions (#5952)

2026-07-07 12:47:41 +08:00

subscription.go

refactor: modernize Go code conventions

2026-09-08 20:55:03 +08:00

system_instance.go

feat(system-info): add stale instance cleanup actions (#5953)

2026-07-07 21:22:49 +08:00

system_task_test.go

feat(system-tasks): add filtered task history with cleanup

2026-09-18 11:24:30 +08:00

system_task.go

feat(system-tasks): add filtered task history with cleanup

2026-09-18 11:24:30 +08:00

task_cas_test.go

feat(auth): replace the dashboard access token with scoped access tokens

2026-09-30 17:24:19 +08:00

task_model_alias.go

feat(task): resolve channel-mapped aliases and case variants for plugin models

2026-08-30 19:13:51 +08:00

task_openai_video_test.go

feat(task): replace built-in task adaptors with a sandboxed JS plugin system (#7076)

2026-08-29 18:51:57 +08:00

task_plugin_channel_select_test.go

feat(channel): bind multiple task plugins to New API channels

2026-09-20 17:51:51 +08:00

task_plugin_test.go

feat(task): replace built-in task adaptors with a sandboxed JS plugin system (#7076)

2026-08-29 18:51:57 +08:00

task_plugin.go

perf(plugins): sync task plugins from hashes and load source only for changed rows

2026-09-21 21:01:16 +08:00

task.go

feat(plugins): serve OpenAI Images API through task plugins

2026-09-20 17:58:45 +08:00

token_auto_groups_cache_test.go

fix: harden concurrent quota and status updates

2026-08-11 22:03:47 +08:00

token_cache.go

fix: harden concurrent quota and status updates

2026-08-11 22:03:47 +08:00

token_migration_test.go

fix(model): migrate legacy token key constraints

2026-08-31 11:51:59 +08:00

token_migration.go

fix(model): migrate legacy token key constraints

2026-08-31 11:51:59 +08:00

token.go

refactor: modernize Go code conventions

2026-09-08 20:55:03 +08:00

topup.go

refactor: modernize Go code conventions

2026-09-08 20:55:03 +08:00

twofa_enrollment.go

fix(security): bind verification proofs to sessions and actions

2026-09-06 22:48:59 +08:00

twofa.go

refactor: modernize Go code conventions

2026-09-08 20:55:03 +08:00

usedata_flow_test.go

feat(dashboard): add traffic flow sankey chart (#5465)

2026-06-20 18:57:47 +08:00

usedata_flow.go

feat(dashboard): add traffic flow sankey chart (#5465)

2026-06-20 18:57:47 +08:00

usedata_rankings.go

feat: support ClickHouse log database (#5663)

2026-06-22 18:41:26 +08:00

usedata.go

refactor: modernize Go code conventions

2026-09-08 20:55:03 +08:00

user_access_token.go

feat(auth): edit the name and permissions of an access token

2026-09-30 20:52:36 +08:00

user_auth_cache.go

refactor: modernize Go code conventions

2026-09-08 20:55:03 +08:00

user_authentication_test.go

feat(auth): replace the dashboard access token with scoped access tokens

2026-09-30 17:24:19 +08:00

user_cache_auth_version_test.go

refactor(auth): replace dashboard sessions with stateless tokens and session control (#6329)

2026-07-20 16:48:43 +08:00

user_cache.go

refactor: modernize Go code conventions

2026-09-08 20:55:03 +08:00

user_oauth_binding.go

fix(oauth): clear bindings when hard deleting users (#5582)

2026-06-18 12:16:23 +08:00

user_pagination_test.go

fix: add server-side sorting to user list, prevent client-side sort on paged data (#6194)

2026-07-17 19:36:44 +08:00

user_quota_adjustment.go

feat(audit): complete token and quota operation records

2026-09-06 22:49:01 +08:00

user_session_migration_test.go

fix(db): avoid redundant schema migrations on restart

2026-09-06 22:48:58 +08:00

user_session_test.go

refactor: modernize Go code conventions

2026-09-08 20:55:03 +08:00

user_session.go

refactor: modernize Go code conventions

2026-09-08 20:55:03 +08:00

user_update_test.go

feat(auth): edit the name and permissions of an access token

2026-09-30 20:52:36 +08:00

user.go

feat(auth): replace the dashboard access token with scoped access tokens

2026-09-30 17:24:19 +08:00

utils.go

refactor: modernize Go code conventions

2026-09-08 20:55:03 +08:00

vendor_management.go

feat(models): rework model/vendor management and pricing

2026-09-06 22:49:02 +08:00

vendor_meta.go

feat(models): rework model/vendor management and pricing

2026-09-06 22:49:02 +08:00