feat(proxy): 支持为 chatgpt.com 上游请求配置代理

- 新增 proxy_service 持久化 data/proxy_config.json，支持环境变量 CHATGPT2API_PROXY 初始化
- account_service / image_service 的 Session 在启用时注入 http/socks 代理
- 新增 /api/proxy GET/POST 和 /api/proxy/test 路由，URL 回显时遮蔽密码
- 设置页新增「上游代理配置」卡片，支持启用开关、地址编辑、连通测试

Co-Authored-By: Claude Opus 4.7 (1M context) <noreply@anthropic.com>

.gitignore

@@ -14,4 +14,6 @@ config.json
 edit
 test
 
-docker-compose-local.yml
+docker-compose-local.yml
+
+.claude/settings.local.json

services/account_service.py

@@ -12,6 +12,7 @@ from datetime import datetime
 from curl_cffi.requests import Session
 
 from services.config import config
+from services.proxy_service import apply_proxy_to_session
 
 
 class AccountService:
@@ -399,6 +400,7 @@ class AccountService:
         headers, impersonate = self._build_remote_headers(access_token)
         print(f"[account-refresh] start {access_token[:12]}...")
         session = Session(impersonate=impersonate, verify=True)
+        apply_proxy_to_session(session)
         session.headers.update(headers)
         try:
             with ThreadPoolExecutor(max_workers=2) as executor:

services/api.py

@@ -14,6 +14,7 @@ from services.account_service import account_service
 from services.chatgpt_service import ChatGPTService
 from services.config import config
 from services.cpa_service import cpa_config, cpa_import_service, list_remote_files
+from services.proxy_service import proxy_config, test_proxy
 from services.sub2api_service import (
     list_remote_accounts as sub2api_list_remote_accounts,
     sub2api_config,
@@ -111,6 +112,15 @@ class Sub2APIImportRequest(BaseModel):
     account_ids: list[str] = Field(default_factory=list)
 
 
+class ProxyUpdateRequest(BaseModel):
+    enabled: bool | None = None
+    url: str | None = None
+
+
+class ProxyTestRequest(BaseModel):
+    url: str = ""
+
+
 def build_model_item(model_id: str) -> dict[str, object]:
     return {
         "id": model_id,
@@ -541,6 +551,44 @@ def create_app() -> FastAPI:
             raise HTTPException(status_code=404, detail={"error": "server not found"})
         return {"import_job": server.get("import_job")}
 
+    # ── Upstream proxy endpoints ─────────────────────────────────────
+
+    @router.get("/api/proxy")
+    async def get_proxy(authorization: str | None = Header(default=None)):
+        require_auth_key(authorization)
+        return {"proxy": proxy_config.get_public()}
+
+    @router.post("/api/proxy")
+    async def update_proxy(body: ProxyUpdateRequest, authorization: str | None = Header(default=None)):
+        require_auth_key(authorization)
+
+        # If the client echoes back the masked form (contains `***@`), treat it as "no change"
+        # so the stored password is preserved.
+        url = body.url
+        if url is not None and "***@" in url:
+            url = None
+
+        try:
+            proxy_config.update(enabled=body.enabled, url=url)
+        except ValueError as exc:
+            raise HTTPException(status_code=400, detail={"error": str(exc)}) from exc
+        return {"proxy": proxy_config.get_public()}
+
+    @router.post("/api/proxy/test")
+    async def test_proxy_endpoint(
+            body: ProxyTestRequest,
+            authorization: str | None = Header(default=None),
+    ):
+        require_auth_key(authorization)
+        candidate = (body.url or "").strip()
+        if not candidate or "***@" in candidate:
+            # Fall back to the stored url when caller omits it or sent the masked form.
+            candidate = (proxy_config.get().get("url") or "").strip()
+        if not candidate:
+            raise HTTPException(status_code=400, detail={"error": "proxy url is required"})
+        result = await run_in_threadpool(test_proxy, candidate)
+        return {"result": result}
+
     app.include_router(router)
 
     @app.get("/{full_path:path}", include_in_schema=False)

services/image_service.py

@@ -13,6 +13,7 @@ from curl_cffi.requests import Session
 
 from services.account_service import account_service
 from services import proof_of_work
+from services.proxy_service import apply_proxy_to_session
 
 
 BASE_URL = "https://chatgpt.com"
@@ -100,6 +101,7 @@ def _new_session(access_token: str) -> tuple[Session, dict]:
         impersonate=fp.get("impersonate") or "edge101",
         verify=True,
     )
+    apply_proxy_to_session(session)
     session.headers.update(
         {
             "user-agent": fp.get("user-agent") or USER_AGENT,

services/proxy_service.py

@@ -0,0 +1,172 @@
+"""Upstream proxy configuration for requests against chatgpt.com.
+
+Only chatgpt.com traffic goes through this proxy. Internal services like
+sub2api / CPA pools always call their own base_url directly.
+"""
+
+from __future__ import annotations
+
+import json
+import os
+import time
+from pathlib import Path
+from threading import Lock
+from urllib.parse import quote, urlparse, urlunparse
+
+from curl_cffi.requests import Session
+
+from services.config import DATA_DIR
+
+
+PROXY_CONFIG_FILE = DATA_DIR / "proxy_config.json"
+
+
+def _clean(value: object) -> str:
+    return str(value or "").strip()
+
+
+def _is_valid_proxy_url(url: str) -> bool:
+    if not url:
+        return False
+    try:
+        parsed = urlparse(url)
+    except Exception:
+        return False
+    if parsed.scheme not in {"http", "https", "socks4", "socks5", "socks5h"}:
+        return False
+    return bool(parsed.hostname)
+
+
+def _mask_proxy_url(url: str) -> str:
+    """Return a display-safe version of the proxy URL where password is hidden."""
+    if not url:
+        return ""
+    try:
+        parsed = urlparse(url)
+    except Exception:
+        return url
+    if not parsed.password:
+        return url
+    user = parsed.username or ""
+    host = parsed.hostname or ""
+    port = f":{parsed.port}" if parsed.port else ""
+    netloc = f"{quote(user, safe='')}:***@{host}{port}"
+    return urlunparse(parsed._replace(netloc=netloc))
+
+
+class ProxyConfig:
+    def __init__(self, store_file: Path):
+        self._store_file = store_file
+        self._lock = Lock()
+        self._state = self._load()
+
+    def _default_state(self) -> dict:
+        env_url = _clean(os.getenv("CHATGPT2API_PROXY"))
+        if env_url and _is_valid_proxy_url(env_url):
+            return {"enabled": True, "url": env_url}
+        return {"enabled": False, "url": ""}
+
+    def _load(self) -> dict:
+        if not self._store_file.exists():
+            return self._default_state()
+        try:
+            raw = json.loads(self._store_file.read_text(encoding="utf-8"))
+        except Exception:
+            return self._default_state()
+        if not isinstance(raw, dict):
+            return self._default_state()
+        return {
+            "enabled": bool(raw.get("enabled")),
+            "url": _clean(raw.get("url")),
+        }
+
+    def _save(self) -> None:
+        self._store_file.parent.mkdir(parents=True, exist_ok=True)
+        self._store_file.write_text(
+            json.dumps(self._state, ensure_ascii=False, indent=2) + "\n",
+            encoding="utf-8",
+        )
+
+    def get(self) -> dict:
+        with self._lock:
+            return dict(self._state)
+
+    def get_public(self) -> dict:
+        """Return a masked representation safe to expose over the API."""
+        state = self.get()
+        return {
+            "enabled": bool(state.get("enabled")),
+            "url": _mask_proxy_url(_clean(state.get("url"))),
+        }
+
+    def update(self, *, enabled: bool | None, url: str | None) -> dict:
+        with self._lock:
+            next_state = dict(self._state)
+            if enabled is not None:
+                next_state["enabled"] = bool(enabled)
+            if url is not None:
+                new_url = _clean(url)
+                if new_url and not _is_valid_proxy_url(new_url):
+                    raise ValueError("invalid proxy url")
+                next_state["url"] = new_url
+            if next_state.get("enabled") and not next_state.get("url"):
+                raise ValueError("proxy url is required when enabled")
+            self._state = next_state
+            self._save()
+            return dict(self._state)
+
+    def get_proxies(self) -> dict[str, str] | None:
+        """Return a dict suitable for curl_cffi's `proxies=` kwarg, or None."""
+        state = self.get()
+        if not state.get("enabled"):
+            return None
+        url = _clean(state.get("url"))
+        if not url:
+            return None
+        return {"http": url, "https": url}
+
+
+proxy_config = ProxyConfig(PROXY_CONFIG_FILE)
+
+
+def apply_proxy_to_session(session: Session) -> None:
+    """Attach the current upstream proxy to a curl_cffi Session, if configured."""
+    proxies = proxy_config.get_proxies()
+    if proxies:
+        session.proxies.update(proxies)
+
+
+def test_proxy(url: str, *, timeout: float = 15.0) -> dict:
+    """Probe chatgpt.com through the given proxy URL. Returns {ok, status, latency_ms, error}."""
+    candidate = _clean(url)
+    if not candidate:
+        return {"ok": False, "status": 0, "latency_ms": 0, "error": "proxy url is required"}
+    if not _is_valid_proxy_url(candidate):
+        return {"ok": False, "status": 0, "latency_ms": 0, "error": "invalid proxy url"}
+
+    session = Session(impersonate="edge101", verify=True)
+    session.proxies.update({"http": candidate, "https": candidate})
+    started = time.perf_counter()
+    try:
+        response = session.get(
+            "https://chatgpt.com/api/auth/csrf",
+            headers={"user-agent": "Mozilla/5.0 (chatgpt2api proxy test)"},
+            timeout=timeout,
+        )
+        latency_ms = int((time.perf_counter() - started) * 1000)
+        return {
+            "ok": response.status_code < 500,
+            "status": int(response.status_code),
+            "latency_ms": latency_ms,
+            "error": None if response.status_code < 500 else f"HTTP {response.status_code}",
+        }
+    except Exception as exc:
+        latency_ms = int((time.perf_counter() - started) * 1000)
+        return {
+            "ok": False,
+            "status": 0,
+            "latency_ms": latency_ms,
+            "error": str(exc) or exc.__class__.__name__,
+        }
+    finally:
+        session.close()

web/src/app/settings/components/proxy-settings.tsx

@@ -0,0 +1,214 @@
+"use client";
+
+import { useEffect, useRef, useState } from "react";
+import {
+  Eye,
+  EyeOff,
+  LoaderCircle,
+  PlugZap,
+  Save,
+  Wifi,
+} from "lucide-react";
+import { toast } from "sonner";
+
+import { Button } from "@/components/ui/button";
+import { Card, CardContent } from "@/components/ui/card";
+import { Input } from "@/components/ui/input";
+import {
+  fetchProxy,
+  testProxy,
+  updateProxy,
+  type ProxySettings,
+  type ProxyTestResult,
+} from "@/lib/api";
+
+export function ProxySettingsCard() {
+  const didLoadRef = useRef(false);
+  const [settings, setSettings] = useState<ProxySettings>({ enabled: false, url: "" });
+  const [formUrl, setFormUrl] = useState("");
+  const [formEnabled, setFormEnabled] = useState(false);
+  const [showUrl, setShowUrl] = useState(false);
+  const [isLoading, setIsLoading] = useState(true);
+  const [isSaving, setIsSaving] = useState(false);
+  const [isTesting, setIsTesting] = useState(false);
+  const [testResult, setTestResult] = useState<ProxyTestResult | null>(null);
+
+  const load = async () => {
+    setIsLoading(true);
+    try {
+      const data = await fetchProxy();
+      setSettings(data.proxy);
+      setFormUrl(data.proxy.url);
+      setFormEnabled(data.proxy.enabled);
+    } catch (error) {
+      toast.error(error instanceof Error ? error.message : "加载代理配置失败");
+    } finally {
+      setIsLoading(false);
+    }
+  };
+
+  useEffect(() => {
+    if (didLoadRef.current) {
+      return;
+    }
+    didLoadRef.current = true;
+    void load();
+  }, []);
+
+  const urlChanged = formUrl.trim() !== settings.url;
+  const enabledChanged = formEnabled !== settings.enabled;
+  const dirty = urlChanged || enabledChanged;
+
+  const handleSave = async () => {
+    if (formEnabled && !formUrl.trim()) {
+      toast.error("启用代理时必须填写代理地址");
+      return;
+    }
+    setIsSaving(true);
+    try {
+      const payload: { enabled?: boolean; url?: string } = {};
+      if (enabledChanged) payload.enabled = formEnabled;
+      if (urlChanged) payload.url = formUrl.trim();
+      const data = await updateProxy(payload);
+      setSettings(data.proxy);
+      setFormUrl(data.proxy.url);
+      setFormEnabled(data.proxy.enabled);
+      toast.success("代理配置已保存");
+    } catch (error) {
+      toast.error(error instanceof Error ? error.message : "保存失败");
+    } finally {
+      setIsSaving(false);
+    }
+  };
+
+  const handleTest = async () => {
+    const candidate = formUrl.trim();
+    if (!candidate) {
+      toast.error("请先填写代理地址");
+      return;
+    }
+    setIsTesting(true);
+    setTestResult(null);
+    try {
+      const data = await testProxy(candidate);
+      setTestResult(data.result);
+      if (data.result.ok) {
+        toast.success(`代理可用（${data.result.latency_ms} ms，HTTP ${data.result.status}）`);
+      } else {
+        toast.error(`代理不可用：${data.result.error ?? "未知错误"}`);
+      }
+    } catch (error) {
+      toast.error(error instanceof Error ? error.message : "测试代理失败");
+    } finally {
+      setIsTesting(false);
+    }
+  };
+
+  return (
+    <Card className="rounded-2xl border-white/80 bg-white/90 shadow-sm">
+      <CardContent className="space-y-6 p-6">
+        <div className="flex items-start justify-between">
+          <div className="flex items-center gap-3">
+            <div className="flex size-10 items-center justify-center rounded-xl bg-stone-100">
+              <Wifi className="size-5 text-stone-600" />
+            </div>
+            <div>
+              <h2 className="text-lg font-semibold tracking-tight">上游代理配置</h2>
+              <p className="text-sm text-stone-500">
+                为 chatgpt.com 的请求配置出网代理，适合国内服务器部署；Sub2API / CPA 请求不受影响。
+              </p>
+            </div>
+          </div>
+        </div>
+
+        {isLoading ? (
+          <div className="flex items-center justify-center py-10">
+            <LoaderCircle className="size-5 animate-spin text-stone-400" />
+          </div>
+        ) : (
+          <div className="space-y-4">
+            <label className="flex cursor-pointer items-start gap-3 rounded-xl border border-stone-200 bg-white px-4 py-3">
+              <input
+                type="checkbox"
+                className="mt-1 size-4 rounded border-stone-300 text-stone-900 focus:ring-stone-900"
+                checked={formEnabled}
+                onChange={(event) => setFormEnabled(event.target.checked)}
+              />
+              <div className="space-y-0.5">
+                <div className="text-sm font-medium text-stone-800">启用代理</div>
+                <div className="text-sm text-stone-500">
+                  关闭后 chatgpt.com 请求会直连。保存后立即生效，无需重启。
+                </div>
+              </div>
+            </label>
+
+            <div className="space-y-2">
+              <label className="flex items-center gap-1.5 text-sm font-medium text-stone-700">
+                <PlugZap className="size-3.5" />
+                代理地址
+              </label>
+              <div className="relative">
+                <Input
+                  type={showUrl ? "text" : "password"}
+                  value={formUrl}
+                  onChange={(event) => setFormUrl(event.target.value)}
+                  placeholder="http://user:pass@host:port 或 socks5://host:port"
+                  className="h-11 rounded-xl border-stone-200 bg-white pr-10 font-mono text-xs"
+                />
+                <button
+                  type="button"
+                  className="absolute top-1/2 right-3 -translate-y-1/2 text-stone-400 transition hover:text-stone-600"
+                  onClick={() => setShowUrl((prev) => !prev)}
+                >
+                  {showUrl ? <EyeOff className="size-4" /> : <Eye className="size-4" />}
+                </button>
+              </div>
+              <div className="text-xs text-stone-400">
+                支持 <code className="font-mono">http / https / socks4 / socks5 / socks5h</code>。
+                密码部分展示时会被遮蔽（<code className="font-mono">***</code>），回传时保持原样即可保留密码。
+              </div>
+            </div>
+
+            {testResult ? (
+              <div
+                className={`rounded-xl border px-4 py-3 text-sm leading-6 ${
+                  testResult.ok
+                    ? "border-emerald-200 bg-emerald-50 text-emerald-800"
+                    : "border-rose-200 bg-rose-50 text-rose-800"
+                }`}
+              >
+                {testResult.ok ? (
+                  <>
+                    代理可用：HTTP {testResult.status}，用时 {testResult.latency_ms} ms
+                  </>
+                ) : (
+                  <>代理不可用：{testResult.error ?? "未知错误"}（用时 {testResult.latency_ms} ms）</>
+                )}
+              </div>
+            ) : null}
+
+            <div className="flex items-center gap-2">
+              <Button
+                className="h-10 rounded-xl bg-stone-950 px-5 text-white hover:bg-stone-800"
+                onClick={() => void handleSave()}
+                disabled={isSaving || !dirty}
+              >
+                {isSaving ? <LoaderCircle className="size-4 animate-spin" /> : <Save className="size-4" />}
+                保存
+              </Button>
+              <Button
+                variant="outline"
+                className="h-10 rounded-xl border-stone-200 bg-white px-5 text-stone-700"
+                onClick={() => void handleTest()}
+                disabled={isTesting}
+              >
+                {isTesting ? <LoaderCircle className="size-4 animate-spin" /> : <PlugZap className="size-4" />}
+                测试连通
+              </Button>
+            </div>
+          </div>
+        )}
+      </CardContent>
+    </Card>
+  );
+}

web/src/app/settings/page.tsx

@@ -47,6 +47,7 @@ import {
   type CPAPool,
   type CPARemoteFile,
 } from "@/lib/api";
+import { ProxySettingsCard } from "@/app/settings/components/proxy-settings";
 import { Sub2APIConnections } from "@/app/settings/components/sub2api-connections";
 
 const PAGE_SIZE_OPTIONS = ["50", "100", "200"] as const;
@@ -305,6 +306,8 @@ export default function SettingsPage() {
       </section>
 
       <section className="space-y-6">
+        <ProxySettingsCard />
+
         <Card className="rounded-2xl border-white/80 bg-white/90 shadow-sm">
           <CardContent className="space-y-6 p-6">
             <div className="flex items-start justify-between">

web/src/lib/api.ts

@@ -277,3 +277,35 @@ export async function startSub2APIImport(serverId: string, accountIds: string[])
 export async function fetchSub2APIImportJob(serverId: string) {
   return httpRequest<{ import_job: CPAImportJob | null }>(`/api/sub2api/servers/${serverId}/import`);
 }
+
+// ── Upstream proxy ────────────────────────────────────────────────
+
+export type ProxySettings = {
+  enabled: boolean;
+  url: string;
+};
+
+export type ProxyTestResult = {
+  ok: boolean;
+  status: number;
+  latency_ms: number;
+  error: string | null;
+};
+
+export async function fetchProxy() {
+  return httpRequest<{ proxy: ProxySettings }>("/api/proxy");
+}
+
+export async function updateProxy(updates: { enabled?: boolean; url?: string }) {
+  return httpRequest<{ proxy: ProxySettings }>("/api/proxy", {
+    method: "POST",
+    body: updates,
+  });
+}
+
+export async function testProxy(url?: string) {
+  return httpRequest<{ result: ProxyTestResult }>("/api/proxy/test", {
+    method: "POST",
+    body: { url: url ?? "" },
+  });
+}