-
Notifications
You must be signed in to change notification settings - Fork 31
feat: 添加模型价格同步功能 #17
New issue
Have a question about this project? Sign up for a free GitHub account to open an issue and contact its maintainers and the community.
By clicking “Sign up for GitHub”, you agree to our terms of service and privacy statement. We’ll occasionally send you account related emails.
Already on GitHub? Sign in to your account
Merged
Merged
feat: 添加模型价格同步功能 #17
Changes from all commits
Commits
Show all changes
2 commits
Select commit
Hold shift + click to select a range
File filter
Filter by extension
Conversations
Failed to load comments.
Loading
Jump to
Jump to file
Failed to load files.
Loading
Diff view
Diff view
There are no files selected for viewing
This file contains hidden or bidirectional Unicode text that may be interpreted or compiled differently than what appears below. To review, open the file in an editor that reveals hidden Unicode characters.
Learn more about bidirectional Unicode characters
| Original file line number | Diff line number | Diff line change |
|---|---|---|
| @@ -0,0 +1,146 @@ | ||
| import { NextResponse } from "next/server"; | ||
| import { config } from "@/lib/config"; | ||
| import { db } from "@/lib/db/client"; | ||
| import { modelPrices } from "@/lib/db/schema"; | ||
|
|
||
| export const runtime = "nodejs"; | ||
|
|
||
| type ModelsDevModel = { | ||
| id: string; | ||
| cost?: { input?: number; output?: number; cache_read?: number }; | ||
| }; | ||
|
|
||
| type ModelsDevProvider = { | ||
| models: Record<string, ModelsDevModel>; | ||
| }; | ||
|
|
||
| type ModelsDevResponse = Record<string, ModelsDevProvider>; | ||
|
|
||
| export async function POST(request: Request) { | ||
| try { | ||
| const { apiKey } = await request.json(); | ||
|
|
||
| if (!apiKey) { | ||
| return NextResponse.json({ error: "缺少 apiKey 参数" }, { status: 400 }); | ||
| } | ||
|
|
||
| const envBaseUrl = process.env.CLIPROXY_API_BASE_URL || ""; | ||
| if (!envBaseUrl) { | ||
| return NextResponse.json({ error: "服务端未配置 CLIPROXY_API_BASE_URL" }, { status: 500 }); | ||
| } | ||
|
|
||
| if (!config.postgresUrl) { | ||
| return NextResponse.json({ error: "服务端未配置 DATABASE_URL" }, { status: 500 }); | ||
| } | ||
|
|
||
| const baseUrl = envBaseUrl.replace(/\/v0\/management\/?$/, "").replace(/\/$/, ""); | ||
|
|
||
| // 1. 从 models.dev 获取价格数据 | ||
| const modelsDevRes = await fetch("https://models.dev/api.json", { | ||
| headers: { "Accept": "application/json" }, | ||
| cache: "no-store" | ||
| }); | ||
|
|
||
| if (!modelsDevRes.ok) { | ||
| return NextResponse.json({ error: `无法获取 models.dev 数据: ${modelsDevRes.status}` }, { status: 502 }); | ||
| } | ||
|
|
||
| const modelsDevData: ModelsDevResponse = await modelsDevRes.json(); | ||
|
|
||
| // 2. 构建模型ID到价格的映射 | ||
| const priceMap = new Map<string, { input: number; output: number; cached: number }>(); | ||
| for (const provider of Object.values(modelsDevData)) { | ||
| if (!provider.models) continue; | ||
| for (const model of Object.values(provider.models)) { | ||
| if (model.cost && (model.cost.input || model.cost.output)) { | ||
| priceMap.set(model.id, { | ||
| input: model.cost.input ?? 0, | ||
| output: model.cost.output ?? 0, | ||
| cached: model.cost.cache_read ?? 0 | ||
| }); | ||
| } | ||
| } | ||
| } | ||
|
|
||
| // 3. 从 CLIProxyAPI 获取当前模型列表 | ||
| const modelsUrl = `${baseUrl}/v1/models`; | ||
| const cliproxyRes = await fetch(modelsUrl, { | ||
| headers: { "Authorization": `Bearer ${apiKey}`, "Accept": "application/json" }, | ||
| cache: "no-store" | ||
| }); | ||
|
|
||
| if (!cliproxyRes.ok) { | ||
| return NextResponse.json({ error: `无法获取模型列表: ${cliproxyRes.status}` }, { status: 502 }); | ||
| } | ||
|
|
||
| const cliproxyData = await cliproxyRes.json(); | ||
| const models: { id: string }[] = cliproxyData.data || []; | ||
|
|
||
| // 4. 匹配并更新价格到本地数据库 | ||
| let updatedCount = 0; | ||
| let skippedCount = 0; | ||
| let failedCount = 0; | ||
| const details: { model: string; status: string; matchedWith?: string; reason?: string }[] = []; | ||
|
|
||
| for (const { id: modelId } of models) { | ||
| let priceInfo = priceMap.get(modelId); | ||
| let matchedKey = modelId; | ||
|
|
||
| // 尝试去掉前缀匹配 | ||
| if (!priceInfo) { | ||
| const simpleName = modelId.split("/").pop() || modelId; | ||
| priceInfo = priceMap.get(simpleName); | ||
| if (priceInfo) matchedKey = simpleName; | ||
| } | ||
|
|
||
| // 模糊匹配 | ||
| if (!priceInfo) { | ||
| const baseModelName = modelId.replace(/-\d{4,}.*$/, "").replace(/@.*$/, ""); | ||
| for (const [key, value] of priceMap.entries()) { | ||
| if (key.includes(baseModelName) || baseModelName.includes(key)) { | ||
| priceInfo = value; | ||
| matchedKey = key; | ||
| break; | ||
| } | ||
| } | ||
| } | ||
|
|
||
| if (!priceInfo) { | ||
| skippedCount++; | ||
| details.push({ model: modelId, status: "skipped", reason: "未找到价格信息" }); | ||
| continue; | ||
| } | ||
|
|
||
| try { | ||
| await db.insert(modelPrices).values({ | ||
| model: modelId, | ||
| inputPricePer1M: String(priceInfo.input), | ||
| cachedInputPricePer1M: String(priceInfo.cached), | ||
| outputPricePer1M: String(priceInfo.output) | ||
| }).onConflictDoUpdate({ | ||
| target: modelPrices.model, | ||
| set: { | ||
| inputPricePer1M: String(priceInfo.input), | ||
| cachedInputPricePer1M: String(priceInfo.cached), | ||
| outputPricePer1M: String(priceInfo.output) | ||
| } | ||
| }); | ||
| updatedCount++; | ||
| details.push({ model: modelId, status: "updated", matchedWith: matchedKey }); | ||
| } catch (err) { | ||
| failedCount++; | ||
| details.push({ model: modelId, status: "failed", reason: err instanceof Error ? err.message : "数据库写入失败" }); | ||
| } | ||
| } | ||
|
|
||
| return NextResponse.json({ | ||
| success: true, | ||
| summary: { total: models.length, updated: updatedCount, skipped: skippedCount, failed: failedCount }, | ||
| details | ||
| }); | ||
|
|
||
| } catch (error) { | ||
| console.error("/api/sync-model-prices POST failed:", error); | ||
| return NextResponse.json({ error: error instanceof Error ? error.message : "内部服务器错误" }, { status: 500 }); | ||
| } | ||
| } | ||
Oops, something went wrong.
Add this suggestion to a batch that can be applied as a single commit.
This suggestion is invalid because no changes were made to the code.
Suggestions cannot be applied while the pull request is closed.
Suggestions cannot be applied while viewing a subset of changes.
Only one suggestion per line can be applied in a batch.
Add this suggestion to a batch that can be applied as a single commit.
Applying suggestions on deleted lines is not supported.
You must change the existing code in this line in order to create a valid suggestion.
Outdated suggestions cannot be applied.
This suggestion has been applied or marked resolved.
Suggestions cannot be applied from pending reviews.
Suggestions cannot be applied on multi-line comments.
Suggestions cannot be applied while the pull request is queued to merge.
Suggestion cannot be applied right now. Please check back later.
There was a problem hiding this comment.
Choose a reason for hiding this comment
The reason will be displayed to describe this comment to others. Learn more.
🚨 issue (security): 同步端点信任由客户端提供的
apiKey,并且看起来允许在未认证的情况下更新modelPrices,这存在风险。任何能够访问
/api/sync-model-prices并发送任意apiKey值的调用方,都可以更新modelPrices,因为这里没有进行身份认证/会话检查,也没有在服务端验证该操作是否为内部/可信操作。这实际上是在公共路由上暴露了一个管理员级别的操作。请通过以下方式之一来加固安全性:要求适当的授权(例如使用你现有的认证/会话)、使用来自配置/环境变量的服务端凭证而不是客户端提供的apiKey,或者以其他方式将该路由限制为可信调用方(例如仅限内部调用,或者通过共享密钥 header)。Original comment in English
🚨 issue (security): The sync endpoint trusts a client-provided
apiKeyand appears to allow unauthenticated updates tomodelPrices, which is risky.Any caller that can reach
/api/sync-model-pricesand send anyapiKeyvalue can updatemodelPrices, since there’s no auth/session check or server-side verification that this is an internal/trusted operation. This effectively exposes an admin operation on a public route. Please secure this by requiring proper authorization (e.g., your existing auth/session), using a server-side credential from config/env instead of a client-providedapiKey, or otherwise restricting the route to trusted callers only (e.g., internal-only or via a shared secret header).