feat(security): harden client IP and admin controls

This commit is contained in:
elky
2026-07-10 15:13:12 +08:00
parent 6e0dc3b59e
commit bc1da3bf3f
19 changed files with 976 additions and 378 deletions
+3 -3
View File
@@ -1747,7 +1747,7 @@ pub fn admin_system_config_default_value(key: &str) -> Option<serde_json::Value>
"medium": { "reasoning_effort": "medium" },
"high": { "reasoning_effort": "high" },
"xhigh": { "reasoning_effort": "xhigh" },
"max": { "reasoning_effort": "xhigh" },
"max": { "reasoning_effort": "max" },
"fast": { "service_tier": "priority" }
}
},
@@ -1758,7 +1758,7 @@ pub fn admin_system_config_default_value(key: &str) -> Option<serde_json::Value>
"medium": { "reasoning": { "effort": "medium" } },
"high": { "reasoning": { "effort": "high" } },
"xhigh": { "reasoning": { "effort": "xhigh" } },
"max": { "reasoning": { "effort": "xhigh" } },
"max": { "reasoning": { "effort": "max" } },
"fast": { "service_tier": "priority" }
}
},
@@ -1769,7 +1769,7 @@ pub fn admin_system_config_default_value(key: &str) -> Option<serde_json::Value>
"medium": { "reasoning": { "effort": "medium" } },
"high": { "reasoning": { "effort": "high" } },
"xhigh": { "reasoning": { "effort": "xhigh" } },
"max": { "reasoning": { "effort": "xhigh" } },
"max": { "reasoning": { "effort": "max" } },
"fast": { "service_tier": "priority" }
}
},
@@ -44,7 +44,8 @@ impl ReasoningEffort {
Self::Low => "low",
Self::Medium => "medium",
Self::High => "high",
Self::XHigh | Self::Max => "xhigh",
Self::XHigh => "xhigh",
Self::Max => "max",
}
}
@@ -55,7 +56,8 @@ impl ReasoningEffort {
Self::Low => "low",
Self::Medium => "medium",
Self::High => "high",
Self::XHigh | Self::Max => "xhigh",
Self::XHigh => "xhigh",
Self::Max => "max",
}
}
@@ -547,9 +549,32 @@ mod tests {
"gpt-5.4-max",
)
.expect("directive should apply");
assert_eq!(responses["reasoning"]["effort"], "xhigh");
assert_eq!(responses["reasoning"]["effort"], "max");
assert_eq!(responses["reasoning"]["summary"], "auto");
let mut compact = json!({
"model": "gpt-5-upstream",
"reasoning": {"effort": "low"}
});
apply_model_directive_overrides_from_model(
&mut compact,
"openai:responses:compact",
"gpt-5-upstream",
"gpt-5.4-max",
)
.expect("directive should apply");
assert_eq!(compact["reasoning"]["effort"], "max");
let mut openai_chat_max = json!({"model": "gpt-5-upstream", "reasoning_effort": "low"});
apply_model_directive_overrides_from_model(
&mut openai_chat_max,
"openai:chat",
"gpt-5-upstream",
"gpt-5.4-max",
)
.expect("directive should apply");
assert_eq!(openai_chat_max["reasoning_effort"], "max");
let mut claude = json!({"model": "claude-sonnet-4-5"});
apply_model_directive_overrides_from_model(
&mut claude,
@@ -776,7 +776,7 @@ mod tests {
assert_eq!(provider_request_body["model"], "gpt-5-upstream");
assert_eq!(provider_request_body["reasoning"]["summary"], "auto");
assert_eq!(provider_request_body["reasoning"]["effort"], "xhigh");
assert_eq!(provider_request_body["reasoning"]["effort"], "max");
}
#[test]