feeeei 26e0a89323 人机验证增加阿里云验证码 2.0 ...

沿用腾讯天御验证码引入的多服务商模型：aliyun_captcha_enabled 作为独立
开关，与 Cloudflare Turnstile、腾讯天御三方互斥（保存校验 + 运行时
CAPTCHA_PROVIDER_CONFLICT）。后台「安全与认证」合并为单张人机验证卡片：
总开关 + 服务商单选（Turnstile / 腾讯天御 / 阿里云），选中即启用该家并
关闭其它，落库仍是三个独立开关键，由前端映射保证互斥。

阿里云侧同时支持 aliyun 中国站与国际站（alibabacloud.com）：两站前端脚本、
region 取值与服务端 API 完全一致，仅账号与 AccessKey 相互独立，因此由
「服务地域」决定线路即可——中国内地走 captcha.cn-shanghai.aliyuncs.com，
非中国内地（新加坡）走 captcha.ap-southeast-1.aliyuncs.com，AccessKey
取自持有该实例的账号，无需在配置中区分站点。

- AliyunCaptchaService 对称 TencentCaptchaService：服务端校验走官方 SDK
  VerifyIntelligentCaptcha，调用异常按 fail-closed 拦截，与 Turnstile
  网络错误行为对称；保存设置时真实探测 AK/SK 有效性
- 保护面对齐腾讯扩展入口：VerifyTencentCaptchaIfEnabled 通用化为
  VerifyActionCaptchaIfEnabled，OAuth 登录启动、passkey 登录在阿里云
  启用时同样拦截；Turnstile 维持既有覆盖不扩大
- 前端 AliyunCaptchaWidget 为表单内预验证按钮（popup 模式），同时暴露
  verify() 供 OAuth 启动、passkey 等动作入口程序化弹窗；未预验证直接
  提交时弹窗兜底。SDK 按钮绑定异步完成，弹窗未出现前按 tick 重试触发，
  并轮询弹窗可见性识别用户关闭
- captchaVerifyParam 复用 turnstile_token 请求字段提交；公开设置下发
  aliyun_captcha_enabled / scene_id / prefix / region
- CSP 放行验证码 CDN：script-src/style-src 加 *.alicdn.com

2026-08-04 20:57:15 +08:00

..

account_codex_agent_identity_import_test.go

test(openai): 检查 Agent Identity 测试类型断言

2026-07-19 14:42:01 +08:00

account_codex_import_test.go

fix(admin): optimize Codex identity import index

2026-07-23 13:43:57 +08:00

account_codex_import.go

fix(admin): optimize Codex identity import index

2026-07-23 13:43:57 +08:00

account_data_handler_test.go

fix(grok): route generic account refresh correctly

2026-07-14 15:00:52 +08:00

account_data.go

feat(grok): probe newly imported OAuth accounts

2026-07-14 12:24:42 +08:00

account_handler_available_models_test.go

fix(openai): prefer concrete GPT-5.6 test model

2026-07-23 13:44:15 +08:00

account_handler_batch_delete_test.go

feat(admin): 为账号批量删除增加并发限制

2026-07-30 18:03:54 +08:00

account_handler_duplicate_test.go

fix(test): align duplicate account test with new NewAccountHandler signature

2026-07-15 16:13:22 +08:00

account_handler_grok_refresh_test.go

fix(grok): route generic account refresh correctly

2026-07-14 15:00:52 +08:00

account_handler_list_test.go

fix(grok): route generic account refresh correctly

2026-07-14 15:00:52 +08:00

account_handler_long_context_billing_test.go

feat: cache OpenAI reset credit details

2026-08-02 21:32:31 +08:00

account_handler_mixed_channel_test.go

feat(billing-probe): optionally sync account rate from upstream declared rate

2026-08-01 22:11:09 +08:00

account_handler_passthrough_test.go

fix(grok): route generic account refresh correctly

2026-07-14 15:00:52 +08:00

account_handler_spark_shadow_test.go

feat(spark-shadow): OpenAI Spark 链接型影子账号

2026-07-01 12:21:45 +08:00

account_handler.go

feat(billing-probe): optionally sync account rate from upstream declared rate

2026-08-01 22:11:09 +08:00

account_ollama_cloud_usage_test.go

fix(ollama): 避免刷新候选饥饿

2026-07-25 15:37:06 +08:00

account_ollama_cloud_usage.go

feat(ollama): 支持 Cloud 官方用量自动刷新

2026-07-23 15:50:44 +08:00

account_shadow_parent_test.go

feat(spark-shadow): OpenAI Spark 链接型影子账号

2026-07-01 12:21:45 +08:00

account_shadow_parent.go

feat(spark-shadow): OpenAI Spark 链接型影子账号

2026-07-01 12:21:45 +08:00

account_today_stats_cache.go

refactor: 消除重复的 normalizeAccountIDList，补充 PR#754 新增组件的单元测试

2026-03-04 15:22:46 +08:00

account_upstream_billing_probe_test.go

feat: 增加上游 Sub2API 计费倍率探测与账号展示

2026-07-15 23:58:46 +08:00

account_upstream_billing_probe.go

feat: 增加上游 Sub2API 计费倍率探测与账号展示

2026-07-15 23:58:46 +08:00

admin_basic_handlers_test.go

Add composite group route registry

2026-07-23 09:20:18 +08:00

admin_helpers_test.go

feat(openai): 支持用户级 Fast/Flex 策略

2026-07-10 15:16:09 +08:00

admin_service_stub_test.go

feat(billing-probe): optionally sync account rate from upstream declared rate

2026-08-01 22:11:09 +08:00

affiliate_handler.go

feat: add admin affiliate record pages

2026-05-03 20:33:13 +08:00

announcement_handler_sort_test.go

feat(table): 表格排序与搜索改为后端处理

2026-04-09 18:14:28 +08:00

announcement_handler.go

feat(table): 表格排序与搜索改为后端处理

2026-04-09 18:14:28 +08:00

antigravity_oauth_handler.go

feat(antigravity): 支持 Refresh Token 批量导入创建 OAuth 账号

2026-02-11 01:23:21 +08:00

apikey_handler_test.go

fix(api-key): reset rate limit usage cache

2026-04-27 16:47:44 +08:00

apikey_handler.go

fix(api-key): reset rate limit usage cache

2026-04-27 16:47:44 +08:00

audit_log_handler.go

fix(security): unify audit log & session binding client IP with API key ACL trust toggle

2026-07-17 09:33:18 +08:00

backup_handler.go

feat(image-storage): 异步生图对象存储改为后台配置，保存即生效

2026-07-19 00:56:21 -07:00

batch_update_credentials_test.go

fix(grok): route generic account refresh correctly

2026-07-14 15:00:52 +08:00

channel_handler_test.go

feat(channels): 模型定价支持一键同步最新模型

2026-05-19 20:32:32 +08:00

channel_handler.go

feat(billing): 渠道自定义定价支持图片输入 token 单价 image_input_price

2026-07-15 09:35:34 -07:00

channel_monitor_duplicate_test.go

Make repeated channel-monitor setup safer

2026-07-16 16:30:19 +08:00

channel_monitor_handler.go

Make repeated channel-monitor setup safer

2026-07-16 16:30:19 +08:00

channel_monitor_template_handler.go

feat(monitor): support Grok channel health checks

2026-07-14 12:24:42 +08:00

compliance_handler.go

Add admin compliance acknowledgement gate

2026-06-10 14:16:51 +08:00

content_moderation_handler.go

feat(moderation): route content moderation through configurable proxy server

2026-07-31 23:12:22 +08:00

dashboard_handler_cache_test.go

Reduce admin dashboard read amplification

2026-03-11 16:46:58 +08:00

dashboard_handler_request_type_test.go

test(backend): add tests for upstream model tracking and model source filtering

2026-03-17 19:26:30 +08:00

dashboard_handler_user_breakdown_test.go

fix(admin): GetUserBreakdown 使用 ParseUsageRequestType 解析 request_type

2026-07-10 11:43:44 +08:00

dashboard_handler.go

fix(admin): GetUserBreakdown 使用 ParseUsageRequestType 解析 request_type

2026-07-10 11:43:44 +08:00

dashboard_query_cache.go

feat(api): expose model_source filter in dashboard endpoints

2026-03-17 19:26:11 +08:00

dashboard_snapshot_v2_handler.go

feat(api): expose model_source filter in dashboard endpoints

2026-03-17 19:26:11 +08:00

data_management_handler_test.go

feat(sync): full code sync from release

2026-02-28 15:01:20 +08:00

data_management_handler.go

fix(lint): resolve data management staticcheck warnings

2026-02-28 15:05:54 +08:00

error_passthrough_handler.go

feat: 错误透传规则支持 skip_monitoring 跳过运维监控记录

2026-02-10 11:42:39 +08:00

gemini_oauth_handler.go

fix: 修复 Gemini 授权链接生成失败并改进错误提示

2026-02-24 20:04:05 +08:00

grok_import_probe_handler_test.go

Merge remote-tracking branch 'origin/main' into pr4241-fix

2026-07-15 16:11:28 +08:00

grok_import_probe_test.go

fix(grok): gate OAuth media on paid eligibility

2026-07-17 19:15:16 +08:00

grok_import_probe.go

fix(grok): gate OAuth media on paid eligibility

2026-07-17 19:15:16 +08:00

grok_oauth_handler_test.go

fix(grok): align Free probes with health checks

2026-07-18 21:05:50 +08:00

grok_oauth_handler.go

fix(grok): gate OAuth media on paid eligibility

2026-07-17 19:15:16 +08:00

group_handler_duplicate_test.go

Make repeated group setup safer

2026-07-16 18:18:28 +08:00

group_handler_reasoning_effort_test.go

feat(groups): add OpenAI reasoning policy

2026-07-21 11:02:43 +08:00

group_handler.go

fix(profit-control): stop leaking profit policy, close veto livelock, restore passthrough turn pricing

2026-08-01 22:39:33 +08:00

id_list_utils_test.go

refactor: 消除重复的 normalizeAccountIDList，补充 PR#754 新增组件的单元测试

2026-03-04 15:22:46 +08:00

id_list_utils.go

perf(admin): optimize large-dataset loading for dashboard/users/accounts/ops

2026-03-04 13:45:49 +08:00

idempotency_helper_test.go

feat(idempotency): 为关键写接口接入幂等并完善并发容错

2026-02-23 12:45:37 +08:00

idempotency_helper.go

fix(accounts): prevent duplicate retries from crossing admins

2026-07-15 10:51:13 +08:00

openai_oauth_handler_reset_quota_test.go

fix(openai): harden reset-credit refresh and account recovery

2026-08-03 14:40:55 +08:00

openai_oauth_handler_spark_shadow_test.go

feat: cache OpenAI reset credit details

2026-08-02 21:32:31 +08:00

openai_oauth_handler.go

fix(openai): harden reset-credit refresh and account recovery

2026-08-03 14:40:55 +08:00

ops_alerts_handler.go

feat(proxies): 代理有效期与失败回退

2026-06-08 00:01:30 +08:00

ops_auth_cache_health_handler.go

fix: 过滤入口拒绝日志并强化鉴权边界

2026-07-18 00:11:18 +08:00

ops_dashboard_handler.go

feat(ops): 运维监控新增 OpenAI Token 请求统计表

2026-02-12 14:20:14 +08:00

ops_handler.go

fix(grok): fail over OAuth credential errors safely

2026-07-14 14:55:30 +08:00

ops_ingress_reject_handler_test.go

fix: 过滤入口拒绝日志并强化鉴权边界

2026-07-18 00:11:18 +08:00

ops_ingress_reject_handler.go

fix: 过滤入口拒绝日志并强化鉴权边界

2026-07-18 00:11:18 +08:00

ops_realtime_handler.go

fix: optimize ops realtime account stats

2026-07-02 20:04:47 +00:00

ops_runtime_logging_handler_test.go

feat(log): 落地统一日志底座与系统日志运维能力

2026-02-12 16:27:29 +08:00

ops_settings_handler.go

feat(log): 落地统一日志底座与系统日志运维能力

2026-02-12 16:27:29 +08:00

ops_snapshot_v2_handler.go

perf(admin): optimize large-dataset loading for dashboard/users/accounts/ops

2026-03-04 13:45:49 +08:00

ops_system_log_handler_test.go

feat(ops): add host filtering to system logs

2026-07-14 01:29:46 +08:00

ops_system_log_handler.go

feat(ops): add host filtering to system logs

2026-07-14 01:29:46 +08:00

ops_ws_handler.go

feat(admin): add opt-in server timing metrics

2026-07-14 01:29:30 +08:00

payment_handler_test.go

fix(admin): restore currency and timestamps in admin plan list response

2026-07-23 10:26:46 +08:00

payment_handler.go

fix(admin): restore currency and timestamps in admin plan list response

2026-07-23 10:26:46 +08:00

promo_handler.go

fix(promo): allow clearing promo code expiry on edit

2026-06-18 23:07:25 +08:00

proxy_data_handler_test.go

fix(export): 导出逻辑与当前筛选条件对齐

2026-04-09 18:14:28 +08:00

proxy_data.go

feat(proxies): 代理有效期与失败回退

2026-06-08 00:01:30 +08:00

proxy_handler.go

feat(proxies): 代理有效期与失败回退

2026-06-08 00:01:30 +08:00

redeem_export_handler_test.go

fix(export): 导出逻辑与当前筛选条件对齐

2026-04-09 18:14:28 +08:00

redeem_handler_test.go

feat(redeem): 兑换码支持设置使用有效期

2026-05-19 15:53:28 +08:00

redeem_handler.go

feat(redeem): add redeem code batch update

2026-05-20 16:08:41 +08:00

scheduled_test_handler.go

feat(admin): 支持定时测试自动恢复并统一账号恢复入口

2026-03-08 06:59:53 +08:00

search_truncate_test.go

fix(audit): 第二批审计修复 — P0 生产 Bug、安全加固、性能优化、缓存一致性、代码质量

2026-02-07 19:46:42 +08:00

setting_handler_audit.go

人机验证增加阿里云验证码 2.0

2026-08-04 20:57:15 +08:00

setting_handler_auth_source_defaults_test.go

feat: 按上游计费倍率调度 OpenAI 账号

2026-07-16 00:40:46 +08:00

setting_handler_codex_whitelist_test.go

feat(codex-detect): codex_cli_only 检测加固 + 引擎指纹统一信号列表 + 账号级 app-server

2026-06-26 16:19:41 +08:00

setting_handler_dingtalk_test.go

feat(dingtalk): 钉钉 OAuth 登录接入与 internal_only 用户属性同步

2026-05-19 15:27:47 +08:00

setting_handler_email.go

fix(security): HTML-escape site_name 并对 doc_url 统一应用 sanitizeUrl

2026-07-09 10:03:49 +08:00

setting_handler_partial_payload_test.go

新增腾讯天御验证码认证门禁

2026-08-04 15:09:29 +08:00

setting_handler_platform_quota_test.go

新增腾讯天御验证码认证门禁

2026-08-04 15:09:29 +08:00

setting_handler_runtime.go

feat(security): add panel API rate limiting to protect DB from high-frequency requests

2026-07-27 15:12:51 +08:00

setting_handler_stepup_switch_test.go

feat: 接入客户端 IP 请求头管理接口

2026-07-20 00:09:21 +08:00

setting_handler_update.go

人机验证增加阿里云验证码 2.0

2026-08-04 20:57:15 +08:00

setting_handler.go

人机验证增加阿里云验证码 2.0

2026-08-04 20:57:15 +08:00

snapshot_cache_test.go

Reduce admin dashboard read amplification

2026-03-11 16:46:58 +08:00

snapshot_cache.go

Reduce admin dashboard read amplification

2026-03-11 16:46:58 +08:00

subscription_handler.go

feat(subscription): 支持恢复已撤销订阅

2026-07-01 22:19:21 +08:00

system_handler_test.go

fix(update): detach in-place update from the HTTP request lifetime

2026-07-19 22:40:44 +08:00

system_handler.go

fix(update): detach in-place update from the HTTP request lifetime

2026-07-19 22:40:44 +08:00

tls_fingerprint_profile_handler.go

feat(tls-fingerprint): 新增 TLS 指纹 Profile 数据库管理及代码质量优化

2026-03-27 14:33:05 +08:00

usage_cleanup_handler_test.go

feat(sync): full code sync from release

2026-02-28 15:01:20 +08:00

usage_handler_request_type_test.go

fix(admin): filter usage logs by request id

2026-07-26 00:53:13 +08:00

usage_handler_search_users_test.go

feat(usage): 在 /admin/usage 支持查看已删除用户的历史使用情况

2026-05-30 17:52:18 +08:00

usage_handler_sort_test.go

feat(table): 表格排序与搜索改为后端处理

2026-04-09 18:14:28 +08:00

usage_handler.go

fix(admin): filter usage logs by request id

2026-07-26 00:53:13 +08:00

usage_query_cache_test.go

perf(usage): 优化 /admin/usage 打开速度与刷新响应

2026-05-30 18:56:08 +08:00

usage_query_cache.go

perf(usage): 优化 /admin/usage 打开速度与刷新响应

2026-05-30 18:56:08 +08:00

user_attribute_handler.go

perf(admin): optimize large-dataset loading for dashboard/users/accounts/ops

2026-03-04 13:45:49 +08:00

user_handler_activity_test.go

feat(security): 敏感操作 step-up 2FA 开关化，安全开关默认关闭

2026-07-18 10:46:42 +08:00

user_handler_batch_limits_test.go

feat(security): 敏感操作 step-up 2FA 开关化，安全开关默认关闭

2026-07-18 10:46:42 +08:00

user_handler_get_deleted_test.go

feat(security): 敏感操作 step-up 2FA 开关化，安全开关默认关闭

2026-07-18 10:46:42 +08:00

user_handler_list_apikey_group_test.go

feat(security): 敏感操作 step-up 2FA 开关化，安全开关默认关闭

2026-07-18 10:46:42 +08:00

user_handler_role_stepup_test.go

feat(security): 敏感操作 step-up 2FA 开关化，安全开关默认关闭

2026-07-18 10:46:42 +08:00

user_handler.go

feat(security): 敏感操作 step-up 2FA 开关化，安全开关默认关闭

2026-07-18 10:46:42 +08:00

user_platform_quota_admin_test.go

fix: allow five platform quota updates

2026-06-29 09:40:04 +08:00

user_platform_quotas_handler_test.go

feat(quota): 用户 × 平台 USD 配额

2026-05-26 10:49:20 +08:00