CaIon 2906e4f779 fix(oauth): require account evidence before migrating legacy GitHub bindings ...

Legacy GitHub bindings stored the login name, while current bindings store
the numeric account ID. A legacy match no longer signs the user in on its
own. When the account has two-factor or a passkey, the binding is rewritten
only after that verification completes, inside the transaction that issues
the session. Otherwise it is rewritten when one of the GitHub account's
verified emails matches the account email. Without either, the login is
declined with guidance to sign in another way and relink GitHub in account
settings. All-digit login names never take part in the comparison, the bind
flow no longer compares login names, and every migration or declined
attempt is recorded as an account binding audit event.

2026-09-18 23:00:37 +08:00

..

access_token_audit_test.go

refactor: modernize Go code conventions

2026-09-08 20:55:03 +08:00

access_token.go

refactor: modernize Go code conventions

2026-09-08 20:55:03 +08:00

audit.go

feat(auth): add safe multi-RP ID passkey support

2026-09-11 23:15:29 +08:00

auth_flow_test.go

fix(oauth): require account evidence before migrating legacy GitHub bindings

2026-09-18 23:00:37 +08:00

auth_session_test.go

fix(oauth): require account evidence before migrating legacy GitHub bindings

2026-09-18 23:00:37 +08:00

auth_session.go

fix(auth): keep login state on rate-limited or failing token refresh

2026-07-21 12:39:29 +08:00

authz.go

feat: better admin permissions (#5755)

2026-06-27 17:01:59 +08:00

billing_option_test.go

feat(plugins): enhance task streaming and model pricing

2026-09-11 21:44:56 +08:00

billing.go

refactor: extract protocol conversion layer into standalone relaykit module (#6369)

2026-07-27 15:56:21 +08:00

channel_affinity_cache.go

fix: channel affinity (#2799)

2026-02-02 14:37:31 +08:00

channel_authz_test.go

refactor: modernize Go code conventions

2026-09-08 20:55:03 +08:00

channel_authz.go

feat: better admin permissions (#5755)

2026-06-27 17:01:59 +08:00

channel_billing_test.go

feat(channel): 修复获取DeepSeek余额错误 (#6814)

2026-09-15 00:46:54 +08:00

channel_inference_test.go

feat: vllm channel && sglang channel (#7332)

2026-09-15 00:06:42 +08:00

channel_inference.go

feat: vllm channel && sglang channel (#7332)

2026-09-15 00:06:42 +08:00

channel_multi_key_test.go

Add Responses WebSocket relay support (#5062)

2026-09-14 21:04:26 +08:00

channel_pin_retry_test.go

feat(policy): add request policies settings and routing decision records

2026-09-18 11:24:29 +08:00

channel_task_plugin_bind_test.go

feat(plugins): extend plugin metadata and icon support

2026-09-08 15:15:55 +08:00

channel_task_plugin_validation_test.go

feat(plugins): extend plugin metadata and icon support

2026-09-08 15:15:55 +08:00

channel_test_internal_test.go

fix(channels): show built-in base URLs as placeholders

2026-09-12 11:42:13 +08:00

channel_test_request_test.go

fix(relay): apply model-specific OpenAI chat capabilities (#7211)

2026-09-06 15:47:45 +08:00

channel_upstream_update_test.go

refactor: modernize Go code conventions

2026-09-08 20:55:03 +08:00

channel_upstream_update.go

feat: vllm channel && sglang channel (#7332)

2026-09-15 00:06:42 +08:00

channel-billing.go

feat(channel): 修复获取DeepSeek余额错误 (#6814)

2026-09-15 00:46:54 +08:00

channel-test.go

refactor: modernize Go code conventions

2026-09-08 20:55:03 +08:00

channel.go

feat(policy): add request policies settings and routing decision records

2026-09-18 11:24:29 +08:00

checkin.go

feat(checkin): add check-in functionality with status retrieval and user quota rewards

2026-01-02 23:00:33 +08:00

codex_usage.go

fix(channel): improve proxy client compatibility and cache lifecycle (#6157)

2026-07-20 18:11:22 +08:00

custom_oauth.go

refactor: modernize Go code conventions

2026-09-08 20:55:03 +08:00

deployment.go

refactor: modernize Go code conventions

2026-09-08 20:55:03 +08:00

email_binding.go

refactor: modernize Go code conventions

2026-09-08 20:55:03 +08:00

group.go

refactor: modernize Go code conventions

2026-09-08 20:55:03 +08:00

image.go

feat: support dify upload image file

2025-03-15 19:10:12 +08:00

log.go

fix(logs): isolate privileged metadata

2026-09-03 11:28:57 +08:00

login_verification.go

fix(oauth): require account evidence before migrating legacy GitHub bindings

2026-09-18 23:00:37 +08:00

midjourney.go

fix(billing): 异步任务退款时同步减少 used_quota (#6795)

2026-08-13 22:06:40 +08:00

misc_oidc_test.go

feat(oidc): 支持自定义 OIDC 登录显示名称 (#6012)

2026-07-29 16:27:15 +08:00

misc.go

fix: refine sign-in page behavior

2026-09-13 15:26:10 +08:00

missing_models.go

format: package name -> github.com/QuantumNous/new-api (#2017)

2025-10-11 15:30:09 +08:00

model_list_test.go

fix(oauth): require account evidence before migrating legacy GitHub bindings

2026-09-18 23:00:37 +08:00

model_management_test.go

feat(plugins): enhance task streaming and model pricing

2026-09-11 21:44:56 +08:00

model_meta.go

refactor: modernize Go code conventions

2026-09-08 20:55:03 +08:00

model_owned_by_test.go

Feat/auto group (#6590)

2026-08-01 23:19:01 +08:00

model_pricing_config.go

feat(pricing): convert legacy prices into expression drafts

2026-09-11 21:44:54 +08:00

model_sync.go

refactor: modernize Go code conventions

2026-09-08 20:55:03 +08:00

model.go

refactor: modernize Go code conventions

2026-09-08 20:55:03 +08:00

oauth.go

fix(oauth): require account evidence before migrating legacy GitHub bindings

2026-09-18 23:00:37 +08:00

option_claude_test.go

refactor: extract protocol conversion layer into standalone relaykit module (#6369)

2026-07-27 15:56:21 +08:00

option_gemini_test.go

refactor: extract protocol conversion layer into standalone relaykit module (#6369)

2026-07-27 15:56:21 +08:00

option.go

feat(auth): add safe multi-RP ID passkey support

2026-09-11 23:15:29 +08:00

passkey_test.go

fix(oauth): require account evidence before migrating legacy GitHub bindings

2026-09-18 23:00:37 +08:00

passkey.go

feat(auth): add safe multi-RP ID passkey support

2026-09-11 23:15:29 +08:00

payment_compliance.go

feat: require compliance confirmation for paid features

2026-05-13 22:18:46 +08:00

payment_webhook_availability_test.go

[Feature Request] Waffo Pancake gateway — full integration with subscription support + admin catalog binding flow (#4935)

2026-05-22 11:00:58 +08:00

payment_webhook_availability.go

[Feature Request] Waffo Pancake gateway — full integration with subscription support + admin catalog binding flow (#4935)

2026-05-22 11:00:58 +08:00

perf_metrics.go

perf(metrics): record relay outcomes at the request boundary and classify stream results

2026-09-18 11:24:30 +08:00

performance.go

fix: log management race condition, partial delete reporting, and UX issues

2026-03-21 20:40:39 +08:00

playground.go

refactor: extract protocol conversion layer into standalone relaykit module (#6369)

2026-07-27 15:56:21 +08:00

plugin_endpoint_test.go

feat(task): replace built-in task adaptors with a sandboxed JS plugin system (#7076)

2026-08-29 18:51:57 +08:00

plugin_native_e2e_test.go

feat(task): replace built-in task adaptors with a sandboxed JS plugin system (#7076)

2026-08-29 18:51:57 +08:00

plugin_protocol_limiter_test.go

feat(task): replace built-in task adaptors with a sandboxed JS plugin system (#7076)

2026-08-29 18:51:57 +08:00

plugin_protocol_limiter.go

feat(task): replace built-in task adaptors with a sandboxed JS plugin system (#7076)

2026-08-29 18:51:57 +08:00

plugin_protocol_sdk_test.go

feat(task): replace built-in task adaptors with a sandboxed JS plugin system (#7076)

2026-08-29 18:51:57 +08:00

plugin_protocol_test.go

feat(task): give polling hooks a real query context, host HTTP classification, and bounded poll failures

2026-09-03 14:37:47 +08:00

plugin_protocol.go

feat(task): replace built-in task adaptors with a sandboxed JS plugin system (#7076)

2026-08-29 18:51:57 +08:00

prefill_group.go

format: package name -> github.com/QuantumNous/new-api (#2017)

2025-10-11 15:30:09 +08:00

pricing.go

refactor: modernize Go code conventions

2026-09-08 20:55:03 +08:00

rankings.go

fix: enforce header nav access control for public modules (#4889)

2026-05-16 14:54:47 +08:00

ratio_config.go

feat(models): rework model/vendor management and pricing

2026-09-06 22:49:02 +08:00

ratio_sync_test.go

feat(models): rework model/vendor management and pricing

2026-09-06 22:49:02 +08:00

ratio_sync.go

refactor: modernize Go code conventions

2026-09-08 20:55:03 +08:00

redemption_batch_test.go

feat(redemptions): add batch deletion and optional file exports

2026-09-08 20:47:01 +08:00

redemption.go

refactor: modernize Go code conventions

2026-09-08 20:55:03 +08:00

relay_count_tokens_test.go

feat(relay): hosted-tool conversion fidelity, reasoning normalization, and billing usage integrity (#7137)

2026-09-01 21:53:35 +08:00

relay_error_log_test.go

refactor: modernize Go code conventions

2026-09-08 20:55:03 +08:00

relay_task_plugin_test.go

feat(policy): add request policies settings and routing decision records

2026-09-18 11:24:29 +08:00

relay.go

feat(responses-ws): extend channel support and share routing with HTTP

2026-09-18 11:24:31 +08:00

request_policy.go

feat(policy): add request policies settings and routing decision records

2026-09-18 11:24:29 +08:00

responses_websocket_test.go

feat(responses-ws): extend channel support and share routing with HTTP

2026-09-18 11:24:31 +08:00

responses_websocket.go

Add Responses WebSocket relay support (#5062)

2026-09-14 21:04:26 +08:00

return_path_test.go

refactor(auth): replace dashboard sessions with stateless tokens and session control (#6329)

2026-07-20 16:48:43 +08:00

return_path.go

refactor(auth): replace dashboard sessions with stateless tokens and session control (#6329)

2026-07-20 16:48:43 +08:00

revalidated_response.go

fix: keep ETag valid across different JSON packages

2026-09-03 20:42:57 +08:00

secure_verification.go

feat(auth): add safe multi-RP ID passkey support

2026-09-11 23:15:29 +08:00

security_account_test.go

refactor: modernize Go code conventions

2026-09-08 20:55:03 +08:00

security_enrollment_test.go

feat(auth): add safe multi-RP ID passkey support

2026-09-11 23:15:29 +08:00

setup.go

feat(security): harden account binding and password changes

2026-09-06 22:49:00 +08:00

subscription_payment_creem.go

feat: require compliance confirmation for paid features

2026-05-13 22:18:46 +08:00

subscription_payment_epay.go

refactor(auth): replace dashboard sessions with stateless tokens and session control (#6329)

2026-07-20 16:48:43 +08:00

subscription_payment_stripe.go

refactor(auth): replace dashboard sessions with stateless tokens and session control (#6329)

2026-07-20 16:48:43 +08:00

subscription_payment_waffo_pancake.go

[BugFix] fix webhook process (#5047)

2026-05-24 16:19:27 +08:00

subscription.go

refactor: modernize Go code conventions

2026-09-08 20:55:03 +08:00

system_info.go

feat(system-info): add stale instance cleanup actions (#5953)

2026-07-07 21:22:49 +08:00

system_task_handlers.go

refactor: update task refund logic and remove legacy handling

2026-07-26 20:47:52 +08:00

system_task_test.go

feat(system-tasks): add filtered task history with cleanup

2026-09-18 11:24:30 +08:00

system_task.go

feat(system-tasks): add filtered task history with cleanup

2026-09-18 11:24:30 +08:00

task_generic_test.go

feat(task): replace built-in task adaptors with a sandboxed JS plugin system (#7076)

2026-08-29 18:51:57 +08:00

task_log_view_test.go

feat(task): replace built-in task adaptors with a sandboxed JS plugin system (#7076)

2026-08-29 18:51:57 +08:00

task_plugin_debug_test.go

feat(task): replace built-in task adaptors with a sandboxed JS plugin system (#7076)

2026-08-29 18:51:57 +08:00

task_plugin_debug.go

feat(task): replace built-in task adaptors with a sandboxed JS plugin system (#7076)

2026-08-29 18:51:57 +08:00

task_plugin_test.go

feat(plugins): enhance task streaming and model pricing

2026-09-11 21:44:56 +08:00

task_plugin.go

feat(plugins): enhance task streaming and model pricing

2026-09-11 21:44:56 +08:00

task.go

feat(task): replace built-in task adaptors with a sandboxed JS plugin system (#7076)

2026-08-29 18:51:57 +08:00

telegram_test.go

refactor: modernize Go code conventions

2026-09-08 20:55:03 +08:00

telegram.go

feat(auth): migrate Telegram to unified OAuth

2026-09-06 22:48:59 +08:00

theme_compat_test.go

refactor(auth): replace dashboard sessions with stateless tokens and session control (#6329)

2026-07-20 16:48:43 +08:00

token_auto_groups_test.go

Feat/auto group (#6590)

2026-08-01 23:19:01 +08:00

token_test.go

feat(audit): complete token and quota operation records

2026-09-06 22:49:01 +08:00

token.go

feat(audit): complete token and quota operation records

2026-09-06 22:49:01 +08:00

topup_creem.go

fix(topup): guard wallet quota during recharge

2026-08-14 17:34:57 +08:00

topup_quota_limit_test.go

refactor: deprecate int32 (#7025)

2026-08-26 20:57:54 +08:00

topup_stripe.go

fix(topup): guard wallet quota during recharge

2026-08-14 17:34:57 +08:00

topup_waffo_pancake_test.go

refactor: modernize Go code conventions

2026-09-08 20:55:03 +08:00

topup_waffo_pancake.go

fix(topup): guard wallet quota during recharge

2026-08-14 17:34:57 +08:00

topup_waffo.go

refactor: modernize Go code conventions

2026-09-08 20:55:03 +08:00

topup.go

refactor: modernize Go code conventions

2026-09-08 20:55:03 +08:00

twofa.go

refactor: modernize Go code conventions

2026-09-08 20:55:03 +08:00

uptime_kuma.go

refactor: modernize Go code conventions

2026-09-08 20:55:03 +08:00

usedata_flow_test.go

feat(dashboard): add traffic flow sankey chart (#5465)

2026-06-20 18:57:47 +08:00

usedata.go

feat(dashboard): add traffic flow sankey chart (#5465)

2026-06-20 18:57:47 +08:00

user_manage_test.go

feat(audit): complete token and quota operation records

2026-09-06 22:49:01 +08:00

user_quota.go

feat(audit): complete token and quota operation records

2026-09-06 22:49:01 +08:00

user.go

fix(oauth): require account evidence before migrating legacy GitHub bindings

2026-09-18 23:00:37 +08:00

vendor_meta.go

feat(models): rework model/vendor management and pricing

2026-09-06 22:49:02 +08:00

video_proxy.go

feat(task): replace built-in task adaptors with a sandboxed JS plugin system (#7076)

2026-08-29 18:51:57 +08:00

wechat.go

fix(oauth): require account evidence before migrating legacy GitHub bindings

2026-09-18 23:00:37 +08:00