refactor(auth): replace dashboard sessions with stateless tokens and session control (#6329)

* refactor(auth): replace dashboard sessions with stateless tokens * feat(auth): harden session issuance and distributed enforcement * fix(proxy): preserve trusted proxy compatibility defaults * refactor: address dashboard auth review feedback * refactor: remove classic frontend and flatten web app
2026-07-20 16:48:43 +08:00
parent 5a6c53d496
commit 31d70fca39
1605 changed files with 17511 additions and 147913 deletions
@@ -0,0 +1,246 @@
+/*
+Copyright (C) 2023-2026 QuantumNous
+
+This program is free software: you can redistribute it and/or modify
+it under the terms of the GNU Affero General Public License as
+published by the Free Software Foundation, either version 3 of the
+License, or (at your option) any later version.
+
+This program is distributed in the hope that it will be useful,
+but WITHOUT ANY WARRANTY; without even the implied warranty of
+MERCHANTABILITY or FITNESS FOR A PARTICULAR PURPOSE. See the
+GNU Affero General Public License for more details.
+
+You should have received a copy of the GNU Affero General Public License
+along with this program. If not, see <https://www.gnu.org/licenses/>.
+
+For commercial licensing, please contact support@quantumnous.com
+*/
+import fs from 'node:fs/promises'
+import path from 'node:path'
+
+const TARGET_DIRS = ['src', 'scripts']
+const SOURCE_EXTENSIONS = new Set([
+  '.cjs',
+  '.css',
+  '.js',
+  '.jsx',
+  '.mjs',
+  '.scss',
+  '.ts',
+  '.tsx',
+])
+const EXCLUDED_DIRS = new Set([
+  '.git',
+  '.rsbuild',
+  '.turbo',
+  'build',
+  'coverage',
+  'dist',
+  'node_modules',
+])
+const GENERATED_FILE_MARKERS = [
+  'This file was automatically generated',
+  'This file is auto-generated',
+  'This file is generated',
+  'DO NOT EDIT',
+  'You should NOT make any changes in this file',
+]
+
+const COPYRIGHT_HEADER = `/*
+Copyright (C) 2023-2026 QuantumNous
+
+This program is free software: you can redistribute it and/or modify
+it under the terms of the GNU Affero General Public License as
+published by the Free Software Foundation, either version 3 of the
+License, or (at your option) any later version.
+
+This program is distributed in the hope that it will be useful,
+but WITHOUT ANY WARRANTY; without even the implied warranty of
+MERCHANTABILITY or FITNESS FOR A PARTICULAR PURPOSE. See the
+GNU Affero General Public License for more details.
+
+You should have received a copy of the GNU Affero General Public License
+along with this program. If not, see <https://www.gnu.org/licenses/>.
+
+For commercial licensing, please contact support@quantumnous.com
+*/
+`
+
+const PROJECT_COPYRIGHT_BLOCK_PATTERN =
+  /^\/\*\r?\nCopyright \(C\) .+? QuantumNous\r?\n[\s\S]*?For commercial licensing, please contact support@quantumnous\.com\r?\n\*\/\r?\n?/
+const THIRD_PARTY_COPYRIGHT_PATTERN =
+  /^\/\*[\s\S]*?Copyright[\s\S]*?\*\/\r?\n?/i
+
+const checkMode = process.argv.includes('--check')
+
+function isGeneratedFile(filePath) {
+  return path.basename(filePath).includes('.gen.')
+}
+
+function hasGeneratedMarker(text) {
+  return GENERATED_FILE_MARKERS.some((marker) => text.includes(marker))
+}
+
+function hasThirdPartyCopyright(text) {
+  return (
+    THIRD_PARTY_COPYRIGHT_PATTERN.test(text) &&
+    !PROJECT_COPYRIGHT_BLOCK_PATTERN.test(text)
+  )
+}
+
+async function collectSourceFiles(dir) {
+  const entries = await fs.readdir(dir, { withFileTypes: true })
+  const files = []
+
+  for (const entry of entries) {
+    const fullPath = path.join(dir, entry.name)
+
+    if (entry.isDirectory()) {
+      if (!EXCLUDED_DIRS.has(entry.name)) {
+        files.push(...(await collectSourceFiles(fullPath)))
+      }
+      continue
+    }
+
+    if (
+      entry.isFile() &&
+      SOURCE_EXTENSIONS.has(path.extname(entry.name)) &&
+      !isGeneratedFile(fullPath)
+    ) {
+      files.push(fullPath)
+    }
+  }
+
+  return files
+}
+
+async function collectTargetFiles(rootDir) {
+  const files = []
+
+  for (const targetDir of TARGET_DIRS) {
+    const fullPath = path.join(rootDir, targetDir)
+
+    try {
+      const stat = await fs.stat(fullPath)
+      if (stat.isDirectory()) {
+        files.push(...(await collectSourceFiles(fullPath)))
+      }
+    } catch (error) {
+      if (error.code !== 'ENOENT') {
+        throw error
+      }
+    }
+  }
+
+  return files.sort()
+}
+
+function splitShebang(text) {
+  if (!text.startsWith('#!')) {
+    return ['', text]
+  }
+
+  const lineEnd = text.indexOf('\n')
+  if (lineEnd === -1) {
+    return [text, '']
+  }
+
+  return [text.slice(0, lineEnd + 1), text.slice(lineEnd + 1)]
+}
+
+function applyHeader(text) {
+  const newline = text.includes('\r\n') ? '\r\n' : '\n'
+  const header = COPYRIGHT_HEADER.replaceAll('\n', newline)
+  const [shebang, body] = splitShebang(text)
+  const hadHeader = PROJECT_COPYRIGHT_BLOCK_PATTERN.test(body)
+  let strippedBody = body
+  while (PROJECT_COPYRIGHT_BLOCK_PATTERN.test(strippedBody)) {
+    strippedBody = strippedBody
+      .replace(PROJECT_COPYRIGHT_BLOCK_PATTERN, '')
+      .replace(/^(?:\r?\n)+/, '')
+  }
+
+  if (strippedBody.length === 0) {
+    return {
+      action: hadHeader ? 'updated' : 'added',
+      text: shebang + header,
+    }
+  }
+
+  return {
+    action: hadHeader ? 'updated' : 'added',
+    text: shebang + header + strippedBody,
+  }
+}
+
+function formatPath(rootDir, filePath) {
+  return path.relative(rootDir, filePath).replaceAll(path.sep, '/')
+}
+
+async function main() {
+  const rootDir = process.cwd()
+  const sourceFiles = await collectTargetFiles(rootDir)
+  const stats = {
+    added: 0,
+    checked: 0,
+    skippedGenerated: 0,
+    skippedThirdParty: 0,
+    updated: 0,
+  }
+  const pendingFiles = []
+
+  for (const file of sourceFiles) {
+    stats.checked += 1
+
+    const originalText = await fs.readFile(file, 'utf8')
+    const bom = originalText.startsWith('\uFEFF') ? '\uFEFF' : ''
+    const text = bom ? originalText.slice(1) : originalText
+    const [, body] = splitShebang(text)
+
+    if (hasGeneratedMarker(body)) {
+      stats.skippedGenerated += 1
+      continue
+    }
+
+    if (hasThirdPartyCopyright(body)) {
+      stats.skippedThirdParty += 1
+      continue
+    }
+
+    const result = applyHeader(text)
+    const nextText = bom + result.text
+
+    if (nextText !== originalText) {
+      stats[result.action] += 1
+      pendingFiles.push(formatPath(rootDir, file))
+
+      if (!checkMode) {
+        await fs.writeFile(file, nextText)
+      }
+    }
+  }
+
+  console.log(
+    [
+      `copyright: checked ${stats.checked}`,
+      `added ${stats.added}`,
+      `updated ${stats.updated}`,
+      `skipped generated ${stats.skippedGenerated}`,
+      `skipped third-party ${stats.skippedThirdParty}`,
+    ].join(', ')
+  )
+
+  if (checkMode && pendingFiles.length > 0) {
+    console.error('copyright: headers need to be updated in:')
+    for (const file of pendingFiles) {
+      console.error(`- ${file}`)
+    }
+    process.exitCode = 1
+  }
+}
+
+main().catch((error) => {
+  console.error(error)
+  process.exitCode = 1
+})
@@ -0,0 +1,172 @@
+/*
+Copyright (C) 2023-2026 QuantumNous
+
+This program is free software: you can redistribute it and/or modify
+it under the terms of the GNU Affero General Public License as
+published by the Free Software Foundation, either version 3 of the
+License, or (at your option) any later version.
+
+This program is distributed in the hope that it will be useful,
+but WITHOUT ANY WARRANTY; without even the implied warranty of
+MERCHANTABILITY or FITNESS FOR A PARTICULAR PURPOSE. See the
+GNU Affero General Public License for more details.
+
+You should have received a copy of the GNU Affero General Public License
+along with this program. If not, see <https://www.gnu.org/licenses/>.
+
+For commercial licensing, please contact support@quantumnous.com
+*/
+import { spawnSync } from 'node:child_process'
+import { readdirSync, readFileSync, statSync, writeFileSync } from 'node:fs'
+import { join, relative } from 'node:path'
+
+const mode = process.argv[2]
+
+if (mode !== '--check' && mode !== '--write') {
+  console.error(
+    'Usage: node scripts/format-with-protected-headers.mjs --check|--write'
+  )
+  process.exit(2)
+}
+
+const root = process.cwd()
+const excludedDirs = new Set([
+  '.git',
+  '.tanstack',
+  'build',
+  'coverage',
+  'dist',
+  'node_modules',
+])
+const headerExtensions = new Set([
+  '.cjs',
+  '.cts',
+  '.js',
+  '.jsx',
+  '.mjs',
+  '.mts',
+  '.ts',
+  '.tsx',
+])
+const protectedHeaderPattern =
+  /^\/\*\nCopyright \(C\)[\s\S]*?QuantumNous[\s\S]*?\*\/\n+/
+
+function extensionOf(path) {
+  const index = path.lastIndexOf('.')
+  return index === -1 ? '' : path.slice(index)
+}
+
+function walk(dir, files = []) {
+  for (const entry of readdirSync(dir, { withFileTypes: true })) {
+    if (entry.isDirectory()) {
+      if (!excludedDirs.has(entry.name)) {
+        walk(join(dir, entry.name), files)
+      }
+      continue
+    }
+
+    if (entry.isFile()) {
+      files.push(join(dir, entry.name))
+    }
+  }
+
+  return files
+}
+
+function snapshotFiles(files) {
+  const snapshot = new Map()
+  for (const file of files) {
+    snapshot.set(file, readFileSync(file))
+  }
+  return snapshot
+}
+
+function restoreSnapshot(snapshot) {
+  for (const [file, content] of snapshot) {
+    writeFileSync(file, content)
+  }
+}
+
+function stripProtectedHeaders(files) {
+  const headers = new Map()
+
+  for (const file of files) {
+    if (!headerExtensions.has(extensionOf(file))) {
+      continue
+    }
+
+    const content = readFileSync(file, 'utf8')
+    const match = content.match(protectedHeaderPattern)
+    if (!match) {
+      continue
+    }
+
+    headers.set(file, match[0])
+    writeFileSync(file, content.slice(match[0].length))
+  }
+
+  return headers
+}
+
+function restoreProtectedHeaders(headers) {
+  for (const [file, header] of headers) {
+    const content = readFileSync(file, 'utf8').replace(/^\n+/, '')
+    if (!content.startsWith(header)) {
+      writeFileSync(file, header + content)
+    }
+  }
+}
+
+function listChangedFiles(before, files) {
+  const changed = []
+
+  for (const file of files) {
+    const previous = before.get(file)
+    const current = readFileSync(file)
+    if (!previous || !previous.equals(current)) {
+      changed.push(relative(root, file))
+    }
+  }
+
+  return changed
+}
+
+const files = walk(root).filter(
+  (file) => statSync(file).size < 10 * 1024 * 1024
+)
+const before = mode === '--check' ? snapshotFiles(files) : null
+let headers = new Map()
+let exitCode = 0
+
+try {
+  headers = stripProtectedHeaders(files)
+  const result = spawnSync(
+    'oxfmt',
+    ['-c', '.oxfmtrc.json', '--ignore-path', '.gitignore', '--write', '.'],
+    {
+      cwd: root,
+      stdio: 'inherit',
+    }
+  )
+  exitCode = result.status ?? 1
+  restoreProtectedHeaders(headers)
+
+  if (mode === '--check' && exitCode === 0) {
+    const changed = listChangedFiles(before, files)
+    if (changed.length > 0) {
+      console.error('Format issues found in protected-header-safe check:')
+      for (const file of changed) {
+        console.error(file)
+      }
+      exitCode = 1
+    }
+  }
+} finally {
+  if (mode === '--check' && before) {
+    restoreSnapshot(before)
+  } else {
+    restoreProtectedHeaders(headers)
+  }
+}
+
+process.exit(exitCode)
@@ -0,0 +1,356 @@
+/*
+Copyright (C) 2023-2026 QuantumNous
+
+This program is free software: you can redistribute it and/or modify
+it under the terms of the GNU Affero General Public License as
+published by the Free Software Foundation, either version 3 of the
+License, or (at your option) any later version.
+
+This program is distributed in the hope that it will be useful,
+but WITHOUT ANY WARRANTY; without even the implied warranty of
+MERCHANTABILITY or FITNESS FOR A PARTICULAR PURPOSE. See the
+GNU Affero General Public License for more details.
+
+You should have received a copy of the GNU Affero General Public License
+along with this program. If not, see <https://www.gnu.org/licenses/>.
+
+For commercial licensing, please contact support@quantumnous.com
+*/
+import fs from 'node:fs/promises'
+import path from 'node:path'
+
+// This script is executed from the web/ package root (see package.json script).
+const LOCALES_DIR = path.resolve('src/i18n/locales')
+const FALLBACK_COMPARE_LOCALE = 'en' // used for "still English" detection only
+const OBFUSCATED_KEYS = [
+  {
+    runtime: ['footer', 'new' + 'api', 'projectAttributionSuffix'].join('.'),
+    serialized: 'footer.new\\u0061pi.projectAttributionSuffix',
+  },
+]
+
+const BRAND_AND_LITERAL_KEYS = new Set([
+  'AI Proxy',
+  'AIGC2D',
+  'Alipay',
+  'Anthropic',
+  'API URL',
+  'API2GPT',
+  'AccessKey / SecretAccessKey',
+  'AZURE_OPENAI_ENDPOINT *',
+  'Baidu V2',
+  'CC Switch',
+  'ChatGPT',
+  'ChatGPT Subscription (Codex)',
+  'Claude',
+  'Client ID',
+  'Client Secret',
+  'Cloudflare',
+  'Cohere',
+  'DeepSeek',
+  'Discord',
+  'DoubaoVideo',
+  'FastGPT',
+  'Gemini',
+  'Gemini Image 4K',
+  'GitHub',
+  'Jimeng',
+  'JustSong',
+  'LingYiWanWu',
+  'LinuxDO',
+  'MjProxy',
+  'MjProxyPlus',
+  'MiniMax',
+  'Mistral',
+  'MokaAI',
+  'Moonshot',
+  'New API',
+  'New API &lt;noreply@example.com&gt;',
+  'NewAPI',
+  'OAuth Client Secret',
+  'OhMyGPT',
+  'Ollama',
+  'One API',
+  'OpenAI',
+  'OpenAIMax',
+  'OpenRouter',
+  'Pancake',
+  'Passkey',
+  'Perplexity',
+  'QuantumNous',
+  'Quota:',
+  'Replicate',
+  'SiliconFlow',
+  'Stripe',
+  'Submodel',
+  'SunoAPI',
+  'Telegram',
+  'Tencent',
+  'TTFT P50',
+  'TTFT P95',
+  'TTFT P99',
+  'Uptime Kuma',
+  'Uptime Kuma URL',
+  'Vertex AI',
+  'VolcEngine',
+  'Waffo Pancake Dashboard',
+  'Waffo Pancake MoR',
+  'WeChat',
+  'WeChat Pay',
+  'Webhook URL',
+  'Webhook URL:',
+  'Well-Known URL',
+  'Worker URL',
+  'Xinference',
+  'Xunfei',
+  'Zhipu V4',
+  '"default": "us-central1", "claude-3-5-sonnet-20240620": "europe-west1"',
+  'edit_this',
+  'footer.columns.related.links.midjourney',
+  'footer.columns.related.links.newApiKeyTool',
+  'my-status',
+  'new-api-key-tool',
+  'price_xxx',
+  'whsec_xxx',
+])
+
+function isPlainObject(v) {
+  return typeof v === 'object' && v !== null && !Array.isArray(v)
+}
+
+function stableStringify(obj) {
+  let text = JSON.stringify(obj, null, 2)
+  for (const key of OBFUSCATED_KEYS) {
+    text = text.replaceAll(`"${key.runtime}":`, `"${key.serialized}":`)
+  }
+  return text + '\n'
+}
+
+function countLeafKeys(obj) {
+  if (Array.isArray(obj)) return obj.length
+  if (!isPlainObject(obj)) return 0
+  let count = 0
+  for (const k of Object.keys(obj)) {
+    const v = obj[k]
+    if (isPlainObject(v) || Array.isArray(v)) count += countLeafKeys(v)
+    else count += 1
+  }
+  return count
+}
+
+function reorderLikeBase(
+  base,
+  target,
+  fill,
+  extras,
+  missing,
+  currentPath = []
+) {
+  // If base is an object, we keep base's key order and recurse.
+  if (isPlainObject(base)) {
+    const out = {}
+    const t = isPlainObject(target) ? target : {}
+    const f = isPlainObject(fill) ? fill : {}
+
+    for (const key of Object.keys(base)) {
+      const nextPath = [...currentPath, key]
+      if (Object.prototype.hasOwnProperty.call(t, key)) {
+        out[key] = reorderLikeBase(
+          base[key],
+          t[key],
+          f[key],
+          extras,
+          missing,
+          nextPath
+        )
+      } else {
+        missing.push(nextPath.join('.'))
+        out[key] = reorderLikeBase(
+          base[key],
+          undefined,
+          f[key],
+          extras,
+          missing,
+          nextPath
+        )
+      }
+    }
+
+    for (const key of Object.keys(t)) {
+      if (!Object.prototype.hasOwnProperty.call(base, key)) {
+        const nextPath = [...currentPath, key].join('.')
+        extras[nextPath] = t[key]
+      }
+    }
+
+    return out
+  }
+
+  // For arrays: prefer target if it's also an array; otherwise use base.
+  if (Array.isArray(base)) {
+    if (Array.isArray(target)) return target
+    if (Array.isArray(fill)) return fill
+    return base
+  }
+
+  // For primitives: prefer target if defined, else base.
+  return target === undefined ? (fill ?? base) : target
+}
+
+function isLikelyUntranslated({ locale, baseValue, value }) {
+  if (typeof value !== 'string' || typeof baseValue !== 'string') return false
+  if (value !== baseValue) return false
+
+  // Skip short tokens / acronyms / ids
+  const s = baseValue.trim()
+  if (BRAND_AND_LITERAL_KEYS.has(s)) return false
+  if (
+    /^https?:\/\//.test(s) ||
+    /^\/[\w/-]+/.test(s) ||
+    /^[\w.-]+@[\w.-]+$/.test(s) ||
+    /^smtp\./i.test(s) ||
+    /^socks5:/i.test(s) ||
+    /^org-/.test(s) ||
+    /^gpt-/i.test(s) ||
+    /^checkout\./.test(s) ||
+    /^footer\./.test(s) ||
+    /^[A-Z0-9_ *./:-]+$/.test(s) ||
+    s.startsWith('{') ||
+    s.startsWith('[') ||
+    s.includes('&#10;')
+  ) {
+    return false
+  }
+  if (s.length < 6) return false
+  if (!/[A-Za-z]{3,}/.test(s)) return false
+
+  // For locales with non-latin scripts, equality with EN is a strong signal.
+  if (locale === 'ja' || locale === 'zh') return true
+  if (locale === 'ru') return true
+
+  // For fr/vi: still useful but noisier; keep it conservative.
+  if (locale === 'fr' || locale === 'vi')
+    return /\b(the|and|or|to|with|please)\b/i.test(s)
+
+  return false
+}
+
+async function main() {
+  const entries = await fs.readdir(LOCALES_DIR, { withFileTypes: true })
+  const localeFiles = entries
+    .filter((e) => e.isFile() && e.name.endsWith('.json'))
+    .map((e) => e.name)
+    .sort((a, b) => a.localeCompare(b))
+
+  // Auto-pick base locale as the one with the most leaf keys under translation (most "rich").
+  const parsedByLocale = {}
+  for (const filename of localeFiles) {
+    const locale = filename.replace(/\.json$/i, '')
+    const raw = await fs.readFile(path.join(LOCALES_DIR, filename), 'utf8')
+    parsedByLocale[locale] = JSON.parse(raw)
+  }
+
+  const baseLocale = Object.keys(parsedByLocale)
+    .map((locale) => {
+      const json = parsedByLocale[locale]
+      const trans = json?.translation ?? {}
+      return { locale, score: countLeafKeys(trans) }
+    })
+    .sort(
+      (a, b) => b.score - a.score || a.locale.localeCompare(b.locale)
+    )[0]?.locale
+
+  if (!baseLocale) throw new Error('No locale files found.')
+
+  const baseFile = `${baseLocale}.json`
+  const baseJson = parsedByLocale[baseLocale]
+
+  const compareJson = parsedByLocale[FALLBACK_COMPARE_LOCALE] ?? baseJson
+
+  const report = {
+    base: baseFile,
+    locales: {},
+  }
+
+  const extrasDir = path.join(LOCALES_DIR, '_extras')
+  const reportsDir = path.join(LOCALES_DIR, '_reports')
+  await fs.mkdir(extrasDir, { recursive: true })
+  await fs.mkdir(reportsDir, { recursive: true })
+
+  for (const filename of localeFiles) {
+    const locale = filename.replace(/\.json$/i, '')
+    const full = path.join(LOCALES_DIR, filename)
+    const json = parsedByLocale[locale]
+
+    const extras = {}
+    const missing = []
+    const fixed = reorderLikeBase(baseJson, json, compareJson, extras, missing)
+
+    // Untranslated scan (translation namespace only)
+    const untranslated = {}
+    const compareTrans = compareJson?.translation ?? {}
+    const trans = fixed?.translation ?? {}
+    if (
+      isPlainObject(compareTrans) &&
+      isPlainObject(trans) &&
+      locale !== FALLBACK_COMPARE_LOCALE &&
+      locale !== baseLocale
+    ) {
+      for (const k of Object.keys(compareTrans)) {
+        const baseValue = compareTrans[k]
+        const value = trans[k]
+        if (isLikelyUntranslated({ locale, baseValue, value })) {
+          untranslated[k] = value
+        }
+      }
+    }
+
+    report.locales[locale] = {
+      file: filename,
+      missingCount: missing.length,
+      extrasCount: Object.keys(extras).length,
+      untranslatedCount: Object.keys(untranslated).length,
+    }
+
+    if (Object.keys(extras).length > 0) {
+      await fs.writeFile(
+        path.join(extrasDir, `${locale}.extras.json`),
+        stableStringify(extras),
+        'utf8'
+      )
+    } else {
+      await fs.rm(path.join(extrasDir, `${locale}.extras.json`), {
+        force: true,
+      })
+    }
+    if (Object.keys(untranslated).length > 0) {
+      await fs.writeFile(
+        path.join(reportsDir, `${locale}.untranslated.json`),
+        stableStringify(untranslated),
+        'utf8'
+      )
+    } else {
+      await fs.rm(path.join(reportsDir, `${locale}.untranslated.json`), {
+        force: true,
+      })
+    }
+
+    // Rewrite locale file in base order (even for en to normalize formatting)
+    await fs.writeFile(full, stableStringify(fixed), 'utf8')
+  }
+
+  await fs.writeFile(
+    path.join(reportsDir, '_sync-report.json'),
+    stableStringify(report),
+    'utf8'
+  )
+
+  console.log(
+    `i18n sync done. Report: ${path.join(reportsDir, '_sync-report.json')}`
+  )
+}
+
+main().catch((err) => {
+  console.error(err)
+  process.exitCode = 1
+})