JianFeeeee 6432b61eb6 fix(gateway): AUTO scope grants all models — restrict to routing mode only ...

A key with scope=[AUTO] could previously:
1. request ANY concrete model id directly (hasScopeModel/checkModelScope
   treated AUTO as a wildcard)
2. see the full 56-model list on /v1/models (intersectModels considered
   AUTO as grant-everything)

AUTO now only authorizes the AUTO routing mode. Direct requests to a
specific model require an explicit scope entry.

Also carries agentrouter.lua WAF fingerprint headers (Origin/Referer/
X-Requested-With) already staged on this branch.

Tests: TestHasScopeModelWithSourcePrefix updated; full suite green.
(cherry picked from commit 7fb8f96b82)

2026-09-27 17:12:03 +08:00

..

ui

feat(webui): Mono theme — pure white in light mode, pure black in dark mode

2026-08-30 10:04:53 +08:00

api.go

fix(webui): send DELETE when removing keys and adapters

2026-08-30 09:07:05 +08:00

chat_cache_test.go

fix: anthropic tool-call round-trip, cache zero-hit parity, round-robin load balancing

2026-08-28 12:02:46 +08:00

chat.go

fix(gateway): AUTO scope grants all models — restrict to routing mode only

2026-09-27 17:12:03 +08:00

gateway_test.go

fix(gateway): AUTO scope grants all models — restrict to routing mode only

2026-09-27 17:12:03 +08:00

keys.go

fix(webui): send DELETE when removing keys and adapters

2026-08-30 09:07:05 +08:00

login_guard_test.go

style: gofmt the tree

2026-08-30 08:04:22 +08:00

overflow_err_test.go

fix(gateway): 上下文超窗错误归一化，客户端才能压缩重试

2026-09-10 20:38:39 +08:00

server.go

fix(gateway): keep the record ring small now that aggregates scan everything

2026-08-30 09:34:25 +08:00

stats_test.go

fix(gateway): aggregate the full audit history, repair record paging

2026-08-30 09:29:42 +08:00

stats.go

fix(gateway): aggregate the full audit history, repair record paging

2026-08-30 09:29:42 +08:00

ui_contract_test.go

feat(webui): Mono theme — pure white in light mode, pure black in dark mode

2026-08-30 10:04:53 +08:00