Spaces:
Paused
Paused
Commit History
-
feat: dashboard login gate for public deployments (#148)
icebear +1: icebear0828Unverified signature* feat: dashboard login gate for public deployments (#141) Cookie-based session auth when proxy_api_key is set and request is non-localhost. API routes (/v1/*) unaffected, Electron (localhost) auto-bypassed. - In-memory session store with TTL from session.ttl_minutes config - Dashboard auth middleware with path-based allowlist - Login/logout/status endpoints with per-IP brute-force protection - HTTPS auto-detection: Secure flag on cookie when X-Forwarded-Proto: https - Remote session cannot clear proxy_api_key (prevents disabling login gate) - Frontend LoginGate component with i18n (en/zh), conditional logout button * fix: dashboard login security hardening - Timing-safe password comparison (crypto.timingSafeEqual) - Rate limiter cleanup of expired entries to prevent memory leak - Extract shared parseSessionCookie to src/utils/parse-cookie.ts - Remove silent password.trim() that could cause subtle mismatches - Logout button visible on mobile (icon-only on small screens) - Fix fragi…91ee702 -
feat: usage stats page with time-series token tracking (#147)
icebear +1: icebear0828Unverified signature* feat: usage stats page with time-series token tracking - Background snapshot recording (piggybacks on quota refresh, ~5min interval) - UsageStatsStore: JSON persistence, 7-day retention, delta computation - GET /admin/usage-stats/summary — live cumulative totals - GET /admin/usage-stats/history — time-series deltas with hourly/daily granularity - Pure SVG line charts (input/output tokens + request count) - Granularity (hourly/daily) and range (24h/3d/7d) selectors - 13 backend tests (snapshot, delta, aggregation, retention, API routes) - i18n: en + zh * fix: usage stats review fixes — chart coords, refresh, cleanup --------- Co-authored-by: icebear0828 <icebear0828@users.noreply.github.com>df56b50 -
feat: account management page with batch operations (#146)
icebear +1: icebear0828Unverified signature* fix: treat unfetched plan types as possibly compatible in acquire() When model-fetcher fails to fetch models for a plan type (e.g. the selected free account had an expired token), _planModelMap only contains successfully fetched plans. acquire() then excludes all accounts whose planType is absent from the map — even though their compatibility is unknown, not negative. Add isPlanFetched() to model-store and use it in acquire() to distinguish "plan was fetched and model is absent" (exclude) from "plan was never fetched" (include as possibly compatible). This prevents false 503s when a plan's model fetch failed at startup. * feat: account management page with batch operations Add #/account-management page for bulk account management: - POST /auth/accounts/batch-delete and batch-status endpoints - Batch delete, set active, set disabled with confirmation - Status summary chips (clickable to filter) - Reuse AccountTable with optional proxy column - Import/export accessible from new pag…7516302
-
fix: clear quota warnings when account is deleted (#100) (#102)
icebear +1: icebear0828Unverified signatureDELETE /auth/accounts/:id was missing clearWarnings() call, causing stale quota warning banners to persist in the dashboard after account removal. Co-authored-by: icebear0828 <icebear0828@users.noreply.github.com>5c5129f -
fix: make instructions optional in /v1/responses for client compatibility (#71) (#112)
icebear +1: icebear0828Unverified signatureCherry and other third-party clients don't send the `instructions` field. Previously this returned 400; now it defaults to an empty string. Co-authored-by: icebear0828 <icebear0828@users.noreply.github.com>6fa846e -
feat: add sticky rotation strategy (#107) (#110)
icebear +1: icebear0828Unverified signature* feat: add sticky rotation strategy with admin UI (#107) Keep using the same account until rate-limited or quota exhausted, instead of rotating across multiple accounts. - Add "sticky" to rotation_strategy config enum - Implement sticky sort in selectByStrategy() (last_used desc) - Add GET/POST /admin/rotation-settings endpoints - Add RotationSettings component (sticky vs rotation radio group) - Add i18n translations (en + zh) - 13 new tests (account-pool-sticky + rotation-settings routes) * refactor: extract ROTATION_STRATEGIES constant to eliminate hardcoded duplication Single source of truth for valid rotation strategies — route handler and Zod schema both reference the exported constant. --------- Co-authored-by: icebear0828 <icebear0828@users.noreply.github.com>d0eeb87 -
feat: add POST /admin/refresh-models endpoint + plan routing integration tests (#104)
icebear +1: icebear0828Unverified signatureModel-fetcher's ~1h cache caused stale plan maps that blocked valid model+plan combinations (e.g. free accounts couldn't use gpt-5.4 after it was opened to free tier). This adds a manual refresh endpoint and integration tests covering the full proxy handler plan routing path. Co-authored-by: icebear0828 <icebear0828@users.noreply.github.com>fce5280
-
feat: add quota settings UI to dashboard (#101)
icebear +1: icebear0828* feat: add quota settings UI to dashboard (#92) Allow users to configure quota refresh interval, warning thresholds, and skip-exhausted toggle directly from the web dashboard instead of editing YAML manually. * docs: update CHANGELOG for quota settings UI --------- Co-authored-by: icebear0828 <icebear0828@users.noreply.github.com>07041c6
-
fix: server-side export filtering and JSON parse safety
icebear0828- Export endpoint supports ?ids= query param for selective export, preventing full token payload over the network - Import hook wraps JSON.parse in try-catch for invalid files - Add test for selective export filteringa8a2d95 -
feat: bulk account import/export with selective export (#82)
icebear0828- GET /auth/accounts/export — export all accounts (with tokens) for backup - POST /auth/accounts/import — bulk import from JSON with dedup detection - Dashboard: import/export buttons next to refresh, multi-file import - Selective export: checkbox on each account card, select all/deselect all - 9 unit tests for backend routes268c5a4