mirror of
https://github.com/diegosouzapw/OmniRoute.git
synced 2026-07-31 04:12:10 +03:00
Merge pull request #102 from diegosouzapw/feat/issue-fixes-and-security
Release v1.0.8
This commit is contained in:
Diego Rodrigues de Sa e Souza
@@ -1,54 +0,0 @@
|
||||
---
|
||||
description: Git workflow — NEVER commit directly to main. Always use feature branches.
|
||||
---
|
||||
|
||||
# Git Workflow
|
||||
|
||||
## ⚠️ CRITICAL RULE: NEVER commit directly to `main`
|
||||
|
||||
## Steps
|
||||
|
||||
1. **Before starting any work**, create a feature branch from `main`:
|
||||
|
||||
```bash
|
||||
git checkout main && git pull origin main
|
||||
git checkout -b feature/<feature-name>
|
||||
```
|
||||
|
||||
2. **During development**, commit to the feature branch:
|
||||
|
||||
```bash
|
||||
git add -A && git commit -m "<type>(<scope>): <description>"
|
||||
```
|
||||
|
||||
3. **Before pushing**, verify the build passes:
|
||||
|
||||
```bash
|
||||
npm run build
|
||||
```
|
||||
|
||||
4. **When the feature is complete and verified**, push the branch and STOP:
|
||||
|
||||
```bash
|
||||
git push origin feature/<feature-name>
|
||||
```
|
||||
|
||||
5. **DO NOT** create a PR, merge, or push to `main`. Let the user handle that.
|
||||
|
||||
## Branch naming convention
|
||||
|
||||
- `feature/<name>` — new features
|
||||
- `fix/<name>` — bugfixes
|
||||
- `refactor/<name>` — refactoring
|
||||
- `docker/<name>` — Docker / infrastructure changes
|
||||
- `style/<name>` — UI / CSS changes
|
||||
|
||||
## Commit types
|
||||
|
||||
- `feat` — new feature
|
||||
- `fix` — bugfix
|
||||
- `refactor` — code refactoring
|
||||
- `style` — UI / CSS changes
|
||||
- `docker` — Docker / infrastructure
|
||||
- `docs` — documentation
|
||||
- `chore` — maintenance
|
||||
18
CHANGELOG.md
18
CHANGELOG.md
@@ -7,6 +7,24 @@ and this project adheres to [Semantic Versioning](https://semver.org/spec/v2.0.0
|
||||
|
||||
---
|
||||
|
||||
## [1.0.8] — 2026-02-21
|
||||
|
||||
> ### 🔒 API Security & Windows Support
|
||||
>
|
||||
> Adds API Endpoint Protection for `/models`, Windows server startup fixes, and UI improvements.
|
||||
|
||||
### ✨ New Features
|
||||
|
||||
- **API Endpoint Protection (`/models`)** — New Security Tab settings to optionally require an API key for the `/v1/models` endpoint (returns 404 when unauthorized) and to selectively block specific providers from appearing in the models list ([#100](https://github.com/diegosouzapw/OmniRoute/issues/100), [#96](https://github.com/diegosouzapw/OmniRoute/issues/96))
|
||||
- **Interactive Provider UI** — Blocked Providers setting features an interactive chip selector with visual badges for all available AI providers
|
||||
|
||||
### 🐛 Bug Fixes
|
||||
|
||||
- **Windows Server Startup** — Fixed `ERR_INVALID_FILE_URL_PATH` crash on Windows by safely wrapping `import.meta.url` resolution with a fallback to `process.cwd()` for globally installed npm packages ([#98](https://github.com/diegosouzapw/OmniRoute/issues/98))
|
||||
- **Combo buttons visibility** — Fixed layout overlap and tight spacing for the Quick Action buttons (Clone / Delete / Test) on the Combos page on narrower screens ([#95](https://github.com/diegosouzapw/OmniRoute/issues/95))
|
||||
|
||||
---
|
||||
|
||||
## [1.0.7] — 2026-02-20
|
||||
|
||||
> ### 🐛 Bugfix Release — OpenAI Compatibility, Custom Models & OAuth UX
|
||||
|
||||
@@ -373,6 +373,7 @@ Access via: WhatsApp, Telegram, Slack, Discord, iMessage, Signal...
|
||||
| 🔒 **TLS Fingerprint Spoofing** | Bypass TLS-based bot detection via wreq-js |
|
||||
| 🌐 **IP Filtering** | Allowlist/blocklist for API access control |
|
||||
| 📊 **Editable Rate Limits** | Configurable RPM, min gap, and max concurrent at system level |
|
||||
| 🛡 **API Endpoint Protection** | Auth gating + provider blocking for the `/models` endpoint |
|
||||
|
||||
### 📊 Observability & Analytics
|
||||
|
||||
|
||||
@@ -373,6 +373,7 @@ Acesso via: WhatsApp, Telegram, Slack, Discord, iMessage, Signal...
|
||||
| 🔒 **Spoofing de Fingerprint TLS** | Bypass de detecção de bot via TLS com wreq-js |
|
||||
| 🌐 **Filtragem de IP** | Allowlist/blocklist para controle de acesso à API |
|
||||
| 📊 **Rate Limits Editáveis** | RPM, gap mínimo e concorrência máxima configuráveis |
|
||||
| 🛡 **Proteção de Endpoint API** | Gateway de Auth + bloqueio de provedores para o endpoint `/models` |
|
||||
|
||||
### 📊 Observabilidade e Analytics
|
||||
|
||||
|
||||
@@ -46,7 +46,7 @@ Four modes for debugging API translations: **Playground** (format converter), **
|
||||
|
||||
## ⚙️ Settings
|
||||
|
||||
General settings, system storage, backup management (export/import database), appearance (dark/light mode), security, routing, resilience, and advanced configuration.
|
||||
General settings, system storage, backup management (export/import database), appearance (dark/light mode), security (includes API endpoint protection and custom provider blocking), routing, resilience, and advanced configuration.
|
||||
|
||||
|
||||
|
||||
|
||||
@@ -610,7 +610,7 @@ The settings page is organized into 5 tabs for easy navigation:
|
||||
|
||||
| Tab | Contents |
|
||||
| -------------- | ---------------------------------------------------------------------------------------------- |
|
||||
| **Security** | Login/Password settings and IP Access Control (allowlist/blocklist) |
|
||||
| **Security** | Login/Password settings, IP Access Control, API auth for `/models`, and Provider Blocking |
|
||||
| **Routing** | Global routing strategy (6 options), wildcard model aliases, fallback chains, combo defaults |
|
||||
| **Resilience** | Provider profiles, editable rate limits, circuit breaker status, policies & locked identifiers |
|
||||
| **AI** | Thinking budget configuration, global system prompt injection, prompt cache stats |
|
||||
|
||||
@@ -409,14 +409,14 @@ function ComboCard({
|
||||
</div>
|
||||
|
||||
{/* Actions */}
|
||||
<div className="flex items-center gap-1 shrink-0">
|
||||
<div className="flex items-center gap-1.5 shrink-0 ml-2">
|
||||
<Toggle
|
||||
size="sm"
|
||||
checked={!isDisabled}
|
||||
onChange={onToggle}
|
||||
title={isDisabled ? "Enable combo" : "Disable combo"}
|
||||
/>
|
||||
<div className="flex gap-0.5 opacity-0 group-hover:opacity-100 transition-opacity">
|
||||
<div className="flex items-center gap-1 opacity-0 group-hover:opacity-100 transition-opacity">
|
||||
<button
|
||||
onClick={onTest}
|
||||
disabled={testing}
|
||||
|
||||
@@ -2,11 +2,12 @@
|
||||
|
||||
import { useState, useEffect } from "react";
|
||||
import { Card, Button, Input, Toggle } from "@/shared/components";
|
||||
import { AI_PROVIDERS } from "@/shared/constants/providers";
|
||||
import IPFilterSection from "./IPFilterSection";
|
||||
import SessionInfoCard from "./SessionInfoCard";
|
||||
|
||||
export default function SecurityTab() {
|
||||
const [settings, setSettings] = useState({ requireLogin: false, hasPassword: false });
|
||||
const [settings, setSettings] = useState<any>({ requireLogin: false, hasPassword: false });
|
||||
const [loading, setLoading] = useState(true);
|
||||
const [passwords, setPasswords] = useState({ current: "", new: "", confirm: "" });
|
||||
const [passStatus, setPassStatus] = useState({ type: "", message: "" });
|
||||
@@ -37,6 +38,29 @@ export default function SecurityTab() {
|
||||
}
|
||||
};
|
||||
|
||||
const updateSetting = async (key: string, value: any) => {
|
||||
try {
|
||||
const res = await fetch("/api/settings", {
|
||||
method: "PATCH",
|
||||
headers: { "Content-Type": "application/json" },
|
||||
body: JSON.stringify({ [key]: value }),
|
||||
});
|
||||
if (res.ok) {
|
||||
setSettings((prev) => ({ ...prev, [key]: value }));
|
||||
}
|
||||
} catch (err) {
|
||||
console.error(`Failed to update ${key}:`, err);
|
||||
}
|
||||
};
|
||||
|
||||
const toggleBlockedProvider = (providerId: string) => {
|
||||
const current: string[] = settings.blockedProviders || [];
|
||||
const updated = current.includes(providerId)
|
||||
? current.filter((p) => p !== providerId)
|
||||
: [...current, providerId];
|
||||
updateSetting("blockedProviders", updated);
|
||||
};
|
||||
|
||||
const handlePasswordChange = async (e) => {
|
||||
e.preventDefault();
|
||||
if (passwords.new !== passwords.confirm) {
|
||||
@@ -70,6 +94,8 @@ export default function SecurityTab() {
|
||||
}
|
||||
};
|
||||
|
||||
const blockedProviders: string[] = settings.blockedProviders || [];
|
||||
|
||||
return (
|
||||
<div className="flex flex-col gap-6">
|
||||
<Card>
|
||||
@@ -146,6 +172,92 @@ export default function SecurityTab() {
|
||||
)}
|
||||
</div>
|
||||
</Card>
|
||||
|
||||
{/* API Endpoint Protection */}
|
||||
<Card>
|
||||
<div className="flex items-center gap-3 mb-4">
|
||||
<div className="p-2 rounded-lg bg-amber-500/10 text-amber-600 dark:text-amber-400">
|
||||
<span className="material-symbols-outlined text-[20px]" aria-hidden="true">
|
||||
api
|
||||
</span>
|
||||
</div>
|
||||
<h3 className="text-lg font-semibold">API Endpoint Protection</h3>
|
||||
</div>
|
||||
<div className="flex flex-col gap-4">
|
||||
{/* Require auth for /models */}
|
||||
<div className="flex items-center justify-between">
|
||||
<div>
|
||||
<p className="font-medium">Require API key for /models</p>
|
||||
<p className="text-sm text-text-muted">
|
||||
When ON, the{" "}
|
||||
<code className="text-xs bg-black/5 dark:bg-white/5 px-1 py-0.5 rounded">
|
||||
/v1/models
|
||||
</code>{" "}
|
||||
endpoint returns 404 for unauthenticated requests. Prevents model discovery by
|
||||
unauthorized users.
|
||||
</p>
|
||||
</div>
|
||||
<Toggle
|
||||
checked={settings.requireAuthForModels === true}
|
||||
onChange={() => updateSetting("requireAuthForModels", !settings.requireAuthForModels)}
|
||||
disabled={loading}
|
||||
/>
|
||||
</div>
|
||||
|
||||
{/* Blocked Providers */}
|
||||
<div className="pt-4 border-t border-border/50">
|
||||
<div className="mb-3">
|
||||
<p className="font-medium">Blocked Providers</p>
|
||||
<p className="text-sm text-text-muted">
|
||||
Hide specific providers from the{" "}
|
||||
<code className="text-xs bg-black/5 dark:bg-white/5 px-1 py-0.5 rounded">
|
||||
/v1/models
|
||||
</code>{" "}
|
||||
response. Blocked providers will not appear in model listings.
|
||||
</p>
|
||||
</div>
|
||||
<div className="flex flex-wrap gap-2">
|
||||
{Object.values(AI_PROVIDERS).map((provider: any) => {
|
||||
const isBlocked = blockedProviders.includes(provider.id);
|
||||
return (
|
||||
<button
|
||||
key={provider.id}
|
||||
onClick={() => toggleBlockedProvider(provider.id)}
|
||||
disabled={loading}
|
||||
className={`inline-flex items-center gap-1.5 px-2.5 py-1.5 rounded-lg text-xs font-medium transition-all border ${
|
||||
isBlocked
|
||||
? "bg-red-500/10 border-red-500/30 text-red-600 dark:text-red-400"
|
||||
: "bg-black/[0.02] dark:bg-white/[0.02] border-transparent text-text-muted hover:bg-black/[0.05] dark:hover:bg-white/[0.05]"
|
||||
}`}
|
||||
title={isBlocked ? `Unblock ${provider.name}` : `Block ${provider.name}`}
|
||||
>
|
||||
<span
|
||||
className="material-symbols-outlined text-[14px]"
|
||||
style={{ color: isBlocked ? undefined : provider.color }}
|
||||
>
|
||||
{isBlocked ? "block" : provider.icon}
|
||||
</span>
|
||||
{provider.name}
|
||||
{isBlocked && (
|
||||
<span className="material-symbols-outlined text-[12px] text-red-500">
|
||||
close
|
||||
</span>
|
||||
)}
|
||||
</button>
|
||||
);
|
||||
})}
|
||||
</div>
|
||||
{blockedProviders.length > 0 && (
|
||||
<p className="text-xs text-amber-600 dark:text-amber-400 mt-2 flex items-center gap-1">
|
||||
<span className="material-symbols-outlined text-[14px]">warning</span>
|
||||
{blockedProviders.length} provider{blockedProviders.length !== 1 ? "s" : ""} blocked
|
||||
from /models
|
||||
</p>
|
||||
)}
|
||||
</div>
|
||||
</div>
|
||||
</Card>
|
||||
|
||||
<SessionInfoCard />
|
||||
<IPFilterSection />
|
||||
</div>
|
||||
|
||||
@@ -1,7 +1,8 @@
|
||||
import { CORS_ORIGIN } from "@/shared/utils/cors";
|
||||
import { PROVIDER_MODELS, PROVIDER_ID_TO_ALIAS } from "@/shared/constants/models";
|
||||
import { AI_PROVIDERS } from "@/shared/constants/providers";
|
||||
import { getProviderConnections, getCombos, getAllCustomModels } from "@/lib/localDb";
|
||||
import { getProviderConnections, getCombos, getAllCustomModels, getSettings } from "@/lib/localDb";
|
||||
import { extractApiKey, isValidApiKey } from "@/sse/services/auth";
|
||||
import { getAllEmbeddingModels } from "@omniroute/open-sse/config/embeddingRegistry.ts";
|
||||
import { getAllImageModels } from "@omniroute/open-sse/config/imageRegistry.ts";
|
||||
import { getAllRerankModels } from "@omniroute/open-sse/config/rerankRegistry.ts";
|
||||
@@ -94,10 +95,28 @@ export async function OPTIONS() {
|
||||
* GET /v1/models - OpenAI compatible models list
|
||||
* Returns models from all active providers, combos, embeddings, and image models in OpenAI format
|
||||
*/
|
||||
export async function GET() {
|
||||
export async function GET(request: Request) {
|
||||
try {
|
||||
// Issue #100: Optionally require API key for /models (security hardening)
|
||||
// When enabled, unauthenticated requests get 404 to hide endpoint existence
|
||||
let settings: Record<string, any> = {};
|
||||
try {
|
||||
settings = await getSettings();
|
||||
} catch {}
|
||||
if (settings.requireAuthForModels === true) {
|
||||
const apiKey = extractApiKey(request);
|
||||
if (!apiKey || !(await isValidApiKey(apiKey))) {
|
||||
return new Response("Not Found", { status: 404 });
|
||||
}
|
||||
}
|
||||
|
||||
const { aliasToProviderId, providerIdToAlias } = buildAliasMaps();
|
||||
|
||||
// Issue #96: Allow blocking specific providers from the models list
|
||||
const blockedProviders: Set<string> = new Set(
|
||||
Array.isArray(settings.blockedProviders) ? settings.blockedProviders : []
|
||||
);
|
||||
|
||||
// Get active provider connections
|
||||
let connections = [];
|
||||
let totalConnectionCount = 0; // Track if DB has ANY connections (even disabled)
|
||||
@@ -150,6 +169,9 @@ export async function GET() {
|
||||
const providerId = aliasToProviderId[alias] || alias;
|
||||
const canonicalProviderId = FALLBACK_ALIAS_TO_PROVIDER[alias] || providerId;
|
||||
|
||||
// Skip blocked providers (Issue #96)
|
||||
if (blockedProviders.has(alias) || blockedProviders.has(canonicalProviderId)) continue;
|
||||
|
||||
// Only include models from providers with active connections
|
||||
if (!activeAliases.has(alias) && !activeAliases.has(canonicalProviderId)) {
|
||||
continue;
|
||||
|
||||
@@ -14,9 +14,26 @@ import path from "node:path";
|
||||
import { fileURLToPath } from "node:url";
|
||||
import type Database from "better-sqlite3";
|
||||
|
||||
const __filename = fileURLToPath(import.meta.url);
|
||||
const __dirname = path.dirname(__filename);
|
||||
const MIGRATIONS_DIR = path.join(__dirname, "migrations");
|
||||
/**
|
||||
* Resolve the migrations directory path safely across platforms.
|
||||
* On Windows with global npm installs, `import.meta.url` may not be a valid
|
||||
* `file://` URL, causing `fileURLToPath` to throw `ERR_INVALID_FILE_URL_PATH`.
|
||||
*/
|
||||
function resolveMigrationsDir(): string {
|
||||
try {
|
||||
const metaUrl = import.meta.url;
|
||||
if (metaUrl && metaUrl.startsWith("file://")) {
|
||||
const __filename = fileURLToPath(metaUrl);
|
||||
return path.join(path.dirname(__filename), "migrations");
|
||||
}
|
||||
} catch {
|
||||
// fileURLToPath failed (e.g. Windows global install) — use fallback
|
||||
}
|
||||
// Fallback: resolve relative to cwd (works for both dev and global installs)
|
||||
return path.join(process.cwd(), "src", "lib", "db", "migrations");
|
||||
}
|
||||
|
||||
const MIGRATIONS_DIR = resolveMigrationsDir();
|
||||
|
||||
/**
|
||||
* Ensure the schema_migrations tracking table exists.
|
||||
|
||||
Reference in New Issue
Block a user