Register a DoubaoVideo asset adapter that forwards the Ark-compatible
asset API (POST /api/v1/volcengine/asset?Action=xx) to the official
/openApi/portrait endpoint with a Volcengine V4 HMAC-SHA256 signature
(canonical request over content-type/host/x-content-sha256/x-date,
date/cn-beijing/ark/request scope). The AK/SK pair and optional
project code are stored in channel_asset_credentials (pool_id holds
the project code), so asset credentials stay separate from the video
Bearer key; the channel form now accepts them for type 54.
DoubaoVideo joins the seedance asset family so a user's asset upload
channel and video task channel stay the same (asset:// references
pass through to the upstream). Both resolution chains (asset proxy
resolver and video asset family matcher) now require the asset
credential to be configured before a type-54 channel can serve,
bind, or be auto-matched for assets, falling through to compatible
channels otherwise. The /api/v3 native-path whitelist simplifies
back to the family list now that 54 is a member.
Verified end-to-end against the real upstream: CreateAssetGroup,
CreateAsset (real video upload, Processing -> Active moderation),
ListAssets/GetAsset, and a video generation task referencing the
asset via asset://video reference (succeeded, 432900 tokens).
Co-Authored-By: ZCode <noreply@anthropic.com>
The native /api/v3/contents/generations/tasks route was restricted to
the seedance asset channel family (58/60/61); official Volcengine Ark
channels (DoubaoVideo, type 54) could only be reached via the
standardized /v1/video/generations path. Allow type 54 on the native
route in both the distributor and the task retry channel selection,
while keeping it out of the seedance asset binding system.
The taskdoubao adaptor now reuses a pre-parsed task request from the
context (native path) instead of re-parsing the body as TaskSubmitReq,
whose prompt validation would reject the Volcengine-native format.
When req.Prompt is empty (native path), content text items from
metadata are preserved instead of being replaced with an empty prompt;
the standardized path behavior (prompt replaces metadata text) is
unchanged and covered by existing tests.
Co-Authored-By: ZCode <noreply@anthropic.com>
Add two layers of defense:
1. Webhook availability guard (controller/payment_webhook_availability.go):
- isStripeWebhookEnabled() checks StripeWebhookSecret != "" before processing
- isCreemWebhookEnabled(), isWechatPayWebhookEnabled(), isAlipayWebhookEnabled()
- isEpayWebhookEnabled() with similar checks for all payment webhooks
- Applied to: StripeWebhook, CreemWebhook, WechatPayWebhook, AlipayPayWebhook,
EpayNotify, SubscriptionEpayNotify
2. PaymentProvider field (model/topup.go):
- New PaymentProvider field on TopUp to identify which gateway created the order
- Recharge() checks PaymentProvider == PaymentProviderStripe
- rechargeByQRCodePayment() checks PaymentProvider matches wechat/alipay
- RechargeCreem() checks PaymentProvider == PaymentProviderCreem
- All payment controllers set PaymentProvider when creating orders
Root cause: When StripeWebhookSecret was empty, ComputeSignature used
an empty HMAC key, allowing attackers to forge valid signatures and
complete orders from any payment gateway without actually paying.
Co-Authored-By: Claude <noreply@anthropic.com>
Add KlingAiping usage-token settlement from upstream final_unit_deduction and duration fallback handling.
Normalize model endpoint config persistence and convert model pricing values between stored USD and display currency in the editor.
Co-Authored-By: Codex <noreply@anthropic.com>
Add candidate user selection and explicit_ids batch creation flow for overseas migration. Also add cancellable batches to release selected-user locks and extend backend, frontend, and e2e coverage for the new flow.
Co-Authored-By: Codex <noreply@anthropic.com>
Reject redemption requests from synced users, surface a localized API message, and cover both model- and controller-level paths with tests.
Co-Authored-By: Codex <noreply@anthropic.com>
Delete leftover channel pricing controllers and routes after removing channel pricing, and align relay price helpers with global pricing plus user channel ratio only.
Co-Authored-By: Codex <noreply@anthropic.com>
fengsilin