;
+}) {
+ const { t } = useTranslation('model');
+ const tierCount = pricing.price_tiers?.length ?? 0;
+ const tierDetails = tierCount > 0 ? formatPriceTiers(pricing) : '';
+ const title = [
+ pricing.price_version ? `v${pricing.price_version}` : '',
+ tierDetails,
+ ].filter(Boolean).join('\n');
+
+ return (
+
+ {formatPricingPerMillion(pricing)}
+ {tierCount > 0 && (
+
+ {t('status.tieredPricing', { count: tierCount })}
+
+ )}
+
+ );
+}
+
function ModelCard({ model, enabled, testStatus, onOpenDetail, onTestModel, onToggle, onDelete }: {
model: ModelDefinitionV2;
enabled: boolean;
@@ -1099,7 +1126,7 @@ function ModelCard({ model, enabled, testStatus, onOpenDetail, onTestModel, onTo
{contextK && {contextK}}
{pricing && !isPricingFree(pricing) && (
- {formatPricingPerMillion(pricing)}
+
)}
{pricing && isPricingFree(pricing) && (
{t('status.free')}
@@ -1189,6 +1216,7 @@ function AddProviderDialog({ connectedIds, onClose, onAdded }: {
const [apiKey, setApiKey] = useState('');
const [showApiKey, setShowApiKey] = useState(false);
const [baseUrl, setBaseUrl] = useState('');
+ const [modelCatalogUrl, setModelCatalogUrl] = useState('');
const [description, setDescription] = useState('');
const [providerName, setProviderName] = useState('');
const [azureDeploymentName, setAzureDeploymentName] = useState('');
@@ -1273,6 +1301,7 @@ function AddProviderDialog({ connectedIds, onClose, onAdded }: {
if (provider) {
setDisplayName(provider.name);
setBaseUrl(provider.default_base_url || '');
+ setModelCatalogUrl(provider.default_model_catalog_url || '');
setApiKey('');
setDescription(provider.description || '');
setSelectedModelIds(new Set(provider.models.map(m => m.id)));
@@ -1317,6 +1346,9 @@ function AddProviderDialog({ connectedIds, onClose, onAdded }: {
await providerAPI.setCredentials(selectedCatalogId, {
api_key: apiKey.trim(),
base_url: baseUrl.trim() || undefined,
+ model_catalog_url: selectedCatalogId === 'threatbook-cn-llm'
+ ? modelCatalogUrl.trim()
+ : undefined,
provider_name: selectedCatalogId === 'openai-compatible' && providerName.trim() ? providerName.trim() : undefined,
});
const azureModelId = isAzureProviderId(selectedCatalogId) ? azureDeploymentName.trim() : '';
@@ -1371,6 +1403,9 @@ function AddProviderDialog({ connectedIds, onClose, onAdded }: {
await providerAPI.setCredentials(selectedCatalogId, {
api_key: apiKey.trim() || 'not-needed',
base_url: baseUrl.trim() || undefined,
+ model_catalog_url: selectedCatalogId === 'threatbook-cn-llm'
+ ? modelCatalogUrl.trim()
+ : undefined,
});
if (selectedCatalog) {
const unselected = selectedCatalog.models.filter(m => !selectedModelIds.has(m.id)).map(m => m.id);
@@ -1694,6 +1729,23 @@ function AddProviderDialog({ connectedIds, onClose, onAdded }: {
/>
+ {selectedCatalogId === 'threatbook-cn-llm' && (
+
+
+
setModelCatalogUrl(e.target.value)}
+ className="w-full px-3 py-2 border border-gray-300 rounded-lg focus:outline-none focus:ring-2 focus:ring-slate-400 text-sm"
+ placeholder={selectedCatalog.default_model_catalog_url || 'https://router.example.com/api/console/common/models'}
+ />
+
{t('form.modelCatalogUrlHint')}
+
+ {provider.id === 'threatbook-cn-llm' && (
+
+
+
setModelCatalogUrl(e.target.value)}
+ className="w-full px-3 py-2 border border-gray-300 rounded-lg focus:outline-none focus:ring-2 focus:ring-slate-400 text-sm"
+ placeholder="https://router.example.com/api/console/common/models"
+ />
+
{t('form.modelCatalogUrlHint')}
+
- {/* 价格 — 可编辑 */}
+ {/* Router prices are authoritative; other providers remain editable. */}
+ {isRouterManagedPricing && (
+
+ {t('form.routerPricingManaged')}
+ {model.pricing?.price_version && (
+
+ {t('form.priceVersion')}: {model.pricing.price_version}
+
+ )}
+
+ )}
+ {priceTiers.length > 0 && (
+
+
+ {t('form.inputTokenRange')}
+ {t('form.inputUnitPrice')}
+ {t('form.outputUnitPrice')}
+
+ {priceTiers.map((tier, index) => (
+
+ {formatTierTokenRange(priceTiers, index)}
+ {priceSymbol}{tier.input_price}
+ {priceSymbol}{tier.output_price}
+
+ ))}
+
+ )}
{/* 启用此模型 — 可编辑 */}
From 3e82e50d0fd53ecf0b31be4638ec65a82810306e Mon Sep 17 00:00:00 2001
From: stephamie7 <1223696150@qq.com>
Date: Wed, 26 Aug 2026 17:22:12 +0800
Subject: [PATCH 5/6] fix(provider): isolate Router catalog authentication
---
flocks/provider/sdk/threatbook.py | 77 ++++++++----
flocks/server/routes/provider.py | 79 ++++++++++++
.../routes/test_provider_model_bootstrap.py | 96 ++++++++++++++-
webui/src/locales/en-US/model.json | 4 +
webui/src/locales/zh-CN/model.json | 4 +
webui/src/pages/Model/index.tsx | 113 +++++++++++++-----
.../Model/providerCredentialUtils.test.ts | 17 +++
.../pages/Model/providerCredentialUtils.ts | 4 +-
webui/src/types/index.ts | 3 +
9 files changed, 339 insertions(+), 58 deletions(-)
diff --git a/flocks/provider/sdk/threatbook.py b/flocks/provider/sdk/threatbook.py
index 18b47a619..e8791f76b 100644
--- a/flocks/provider/sdk/threatbook.py
+++ b/flocks/provider/sdk/threatbook.py
@@ -7,10 +7,11 @@
"""
import asyncio
+import hashlib
import os
import time
from typing import Any, Optional
-from urllib.parse import urlsplit, urlunsplit
+from urllib.parse import urlsplit
import httpx
@@ -35,6 +36,9 @@ class ThreatBookCnLLMProvider(OpenAIBaseProvider):
CATALOG_ID = "threatbook-cn-llm"
MODEL_CATALOG_CACHE_TTL_SECONDS = 60.0
MODEL_CATALOG_TIMEOUT_SECONDS = 5.0
+ MODEL_CATALOG_SESSION_SECRET_PREFIX = (
+ "threatbook-cn-llm_model_catalog_session_"
+ )
def __init__(self):
super().__init__(provider_id="threatbook-cn-llm", name="ThreatBook-cn-llm")
@@ -81,26 +85,52 @@ def _get_model_definition_source_models(self) -> list[ModelInfo]:
return self.get_models()
def _model_catalog_urls(self) -> list[str]:
- """Return catalog sources in consistency-preferred order.
-
- Console's common-model endpoint is the fee-details page's exact data
- source. It currently requires a Passport ``session_token`` cookie, so
- the API-key-protected ``/v1/models`` endpoint remains the runtime
- fallback for ordinary Flocks installations. Both response shapes are
- parsed identically below.
- """
+ """Return only the explicitly configured Router catalog endpoint."""
custom_settings = getattr(self._config, "custom_settings", None) or {}
configured_url = (
custom_settings.get("model_catalog_url") if isinstance(custom_settings, dict) else None
) or os.getenv("THREATBOOK_CN_LLM_MODEL_CATALOG_URL")
catalog_url = configured_url or self.DEFAULT_MODEL_CATALOG_URL
- urls = [catalog_url]
- if "/api/console/" in urlsplit(catalog_url).path:
- parsed = urlsplit(catalog_url)
- origin = urlunsplit((parsed.scheme, parsed.netloc, "", "", ""))
- urls.append(f"{origin}/v1/models")
- return list(dict.fromkeys(urls))
+ return [catalog_url]
+
+ @classmethod
+ def supports_model_catalog_session(cls, catalog_url: str) -> bool:
+ """Only attach a Console session to trusted HTTPS Router URLs."""
+ parsed = urlsplit(catalog_url)
+ hostname = (parsed.hostname or "").lower()
+ return (
+ parsed.scheme == "https"
+ and (
+ hostname == "threatbook-inc.cn"
+ or hostname.endswith(".threatbook-inc.cn")
+ )
+ and parsed.path.startswith("/api/console/")
+ )
+
+ @classmethod
+ def model_catalog_session_secret_id(cls, catalog_url: str) -> str:
+ """Build an environment-bound secret ID from the catalog origin."""
+ parsed = urlsplit(catalog_url)
+ origin = f"{parsed.scheme.lower()}://{parsed.netloc.lower()}"
+ origin_hash = hashlib.sha256(origin.encode("utf-8")).hexdigest()[:16]
+ return f"{cls.MODEL_CATALOG_SESSION_SECRET_PREFIX}{origin_hash}"
+
+ @classmethod
+ def get_model_catalog_session_token(cls, catalog_url: str) -> Optional[str]:
+ """Resolve the session for this Router environment without exposing it."""
+ env_token = os.getenv("THREATBOOK_CN_LLM_CONSOLE_SESSION_TOKEN")
+ if env_token and env_token.strip():
+ return env_token.strip()
+ try:
+ from flocks.security import get_secret_manager
+
+ token = get_secret_manager().get(
+ cls.model_catalog_session_secret_id(catalog_url)
+ )
+ except Exception:
+ return None
+ return token.strip() if isinstance(token, str) and token.strip() else None
@staticmethod
def _positive_float_env(
@@ -299,7 +329,7 @@ async def _fetch_catalog_rows(
headers: dict[str, str],
cookies: Optional[dict[str, str]],
) -> list[Any]:
- """Fetch either Console's paginated shape or ``/v1/models``."""
+ """Fetch Router Console's model catalog, including paginated results."""
page = 1
page_size = 100
rows: list[Any] = []
@@ -384,12 +414,6 @@ async def refresh_models(self, force: bool = False) -> bool:
self.MODEL_CATALOG_TIMEOUT_SECONDS,
)
headers: dict[str, str] = {"Accept": "application/json"}
- api_key = self._config.api_key if self._config else self._api_key
- if api_key:
- headers["Authorization"] = f"Bearer {api_key}"
-
- session_token = os.getenv("THREATBOOK_CN_LLM_CONSOLE_SESSION_TOKEN")
- cookies = {"session_token": session_token} if session_token else None
models = None
successful_url = None
@@ -401,6 +425,15 @@ async def refresh_models(self, force: bool = False) -> bool:
) as client:
for models_url in models_urls:
try:
+ session_token = self.get_model_catalog_session_token(
+ models_url
+ )
+ cookies = (
+ {"session_token": session_token}
+ if session_token
+ and self.supports_model_catalog_session(models_url)
+ else None
+ )
rows = await self._fetch_catalog_rows(
client,
models_url,
diff --git a/flocks/server/routes/provider.py b/flocks/server/routes/provider.py
index e8f408bfb..3dc4bfd24 100644
--- a/flocks/server/routes/provider.py
+++ b/flocks/server/routes/provider.py
@@ -1687,6 +1687,10 @@ class ProviderCredentialRequest(BaseModel):
None,
description="Model catalog URL, independent from the provider chat Base URL",
)
+ model_catalog_session_token: Optional[str] = Field(
+ None,
+ description="Router Console session token used only for model catalog sync",
+ )
username: Optional[str] = Field(None, description="Optional username for API services")
fields: Optional[Dict[str, Optional[str]]] = Field(None, description="Dynamic service credential fields")
provider_name: Optional[str] = Field(None, description="Display name for the provider")
@@ -1701,6 +1705,8 @@ class ProviderCredentialResponse(BaseModel):
secret_masked: Optional[str] = None
base_url: Optional[str] = None
model_catalog_url: Optional[str] = None
+ model_catalog_session_token_masked: Optional[str] = None
+ has_model_catalog_session: bool = False
username: Optional[str] = None
fields: Optional[Dict[str, Optional[str]]] = None
secret_ids: Optional[Dict[str, str]] = None
@@ -1747,6 +1753,19 @@ def _load_llm_provider_credentials(
except Exception:
pass
+ model_catalog_session_token = None
+ if provider_id == "threatbook-cn-llm" and model_catalog_url:
+ try:
+ from flocks.provider.sdk.threatbook import ThreatBookCnLLMProvider
+
+ model_catalog_session_token = (
+ ThreatBookCnLLMProvider.get_model_catalog_session_token(
+ model_catalog_url
+ )
+ )
+ except Exception:
+ pass
+
is_placeholder = _is_placeholder_api_key(api_key)
ui_api_key = None if is_placeholder else api_key
@@ -1756,6 +1775,12 @@ def _load_llm_provider_credentials(
api_key_masked=SecretManager.mask(ui_api_key) if ui_api_key else None,
base_url=base_url,
model_catalog_url=model_catalog_url,
+ model_catalog_session_token_masked=(
+ SecretManager.mask(model_catalog_session_token)
+ if model_catalog_session_token
+ else None
+ ),
+ has_model_catalog_session=bool(model_catalog_session_token),
has_credential=bool(api_key),
)
@@ -1843,6 +1868,7 @@ async def set_provider_credentials(
- api_key → .secret.json
- base_url → flocks.json provider.{id}.options.baseURL
- model_catalog_url → flocks.json provider.{id}.options.model_catalog_url
+ - model_catalog_session_token → environment-bound local secret storage
- Ensures provider entry exists in flocks.json
- Configures provider runtime immediately
"""
@@ -1905,6 +1931,42 @@ async def set_provider_credentials(
detail="Model catalog URL must be an absolute HTTP(S) URL",
)
+ model_catalog_session_was_set = (
+ "model_catalog_session_token" in request.model_fields_set
+ )
+ effective_model_catalog_session = (
+ (request.model_catalog_session_token or "").strip()
+ if model_catalog_session_was_set
+ else None
+ )
+ catalog_session_secret_id = None
+ if model_catalog_session_was_set:
+ if provider_id != "threatbook-cn-llm":
+ raise HTTPException(
+ status_code=400,
+ detail="Model catalog session is only supported for ThreatBook-cn-llm",
+ )
+ session_catalog_url = effective_model_catalog_url
+ if not model_catalog_url_was_set:
+ current = _load_llm_provider_credentials(provider_id)
+ session_catalog_url = current.model_catalog_url
+ from flocks.provider.sdk.threatbook import ThreatBookCnLLMProvider
+
+ if not session_catalog_url or not ThreatBookCnLLMProvider.supports_model_catalog_session(
+ session_catalog_url
+ ):
+ raise HTTPException(
+ status_code=400,
+ detail=(
+ "Model catalog session requires an HTTPS ThreatBook Console catalog URL"
+ ),
+ )
+ catalog_session_secret_id = (
+ ThreatBookCnLLMProvider.model_catalog_session_secret_id(
+ session_catalog_url
+ )
+ )
+
# 1. Save API key to .secret.json using _llm_key convention for LLM providers
if preserve_existing_secret:
log.info("provider.credentials.preserved", {
@@ -1928,6 +1990,15 @@ async def set_provider_credentials(
"base_url": request.base_url,
})
+ if model_catalog_session_was_set and catalog_session_secret_id:
+ if effective_model_catalog_session:
+ secrets.set(
+ catalog_session_secret_id,
+ effective_model_catalog_session,
+ )
+ else:
+ secrets.delete(catalog_session_secret_id)
+
# 2. Ensure provider entry exists in flocks.json and update base_url / name
raw_provider = ConfigWriter.get_provider_raw(provider_id)
if raw_provider:
@@ -2086,6 +2157,14 @@ async def delete_provider_credentials(
deleted_secret = secrets.delete(f"{provider_id}_api_key") or deleted_secret
# Also clean up legacy base_url entries
secrets.delete(f"{provider_id}_base_url")
+ if provider_id == "threatbook-cn-llm":
+ from flocks.provider.sdk.threatbook import ThreatBookCnLLMProvider
+
+ for stored_secret_id in secrets.list():
+ if stored_secret_id.startswith(
+ ThreatBookCnLLMProvider.MODEL_CATALOG_SESSION_SECRET_PREFIX
+ ):
+ deleted_secret = secrets.delete(stored_secret_id) or deleted_secret
if not removed_config and not deleted_secret:
raise HTTPException(status_code=404, detail="No credentials found for this provider")
diff --git a/tests/server/routes/test_provider_model_bootstrap.py b/tests/server/routes/test_provider_model_bootstrap.py
index 6d898c022..e1e932790 100644
--- a/tests/server/routes/test_provider_model_bootstrap.py
+++ b/tests/server/routes/test_provider_model_bootstrap.py
@@ -96,6 +96,11 @@ async def get(self, url, headers=None, cookies=None, params=None):
)
monkeypatch.setattr(threatbook.httpx, "AsyncClient", FakeClient)
+ monkeypatch.setattr(
+ ThreatBookCnLLMProvider,
+ "get_model_catalog_session_token",
+ classmethod(lambda cls, _url: "test-console-session"),
+ )
provider = ThreatBookCnLLMProvider()
provider.configure(ProviderConfig(
provider_id=provider.id,
@@ -103,7 +108,7 @@ async def get(self, url, headers=None, cookies=None, params=None):
base_url="https://router.example/v1",
custom_settings={
"trust_env": False,
- "model_catalog_url": "https://catalog.example/api/console/common/models",
+ "model_catalog_url": "https://flocks-router-test.threatbook-inc.cn/api/console/common/models",
},
))
@@ -139,11 +144,14 @@ async def get(self, url, headers=None, cookies=None, params=None):
assert definitions["qwen3.8-max"].capabilities.supports_vision is True
assert definitions["qwen3.8-max"].limits.context_window == 1000000
assert definitions["Router-New"].pricing.input == 3.0
- assert requests[0][0] == "https://catalog.example/api/console/common/models"
- assert requests[0][1]["Authorization"] == "Bearer test-key"
+ assert requests[0][0] == (
+ "https://flocks-router-test.threatbook-inc.cn/api/console/common/models"
+ )
+ assert requests[0][1] == {"Accept": "application/json"}
+ assert requests[0][2] == {"session_token": "test-console-session"}
assert requests[0][3] == {"page": 1, "pageSize": 100}
- def test_model_catalog_fallback_stays_on_configured_router_origin(self):
+ def test_model_catalog_uses_only_explicitly_configured_url(self):
provider = ThreatBookCnLLMProvider()
provider.configure(ProviderConfig(
provider_id=provider.id,
@@ -156,9 +164,28 @@ def test_model_catalog_fallback_stays_on_configured_router_origin(self):
assert provider._model_catalog_urls() == [
"https://router-prod.example/api/console/common/models",
- "https://router-prod.example/v1/models",
]
+ def test_model_catalog_session_is_bound_to_router_environment(self):
+ test_url = (
+ "https://flocks-router-test.threatbook-inc.cn"
+ "/api/console/common/models"
+ )
+ prod_url = (
+ "https://flocks-router.threatbook-inc.cn"
+ "/api/console/common/models"
+ )
+
+ assert ThreatBookCnLLMProvider.supports_model_catalog_session(test_url)
+ assert ThreatBookCnLLMProvider.supports_model_catalog_session(prod_url)
+ assert (
+ ThreatBookCnLLMProvider.model_catalog_session_secret_id(test_url)
+ != ThreatBookCnLLMProvider.model_catalog_session_secret_id(prod_url)
+ )
+ assert not ThreatBookCnLLMProvider.supports_model_catalog_session(
+ "https://example.com/api/console/common/models"
+ )
+
@pytest.mark.asyncio
async def test_router_refresh_failure_keeps_config_fallback(
self, monkeypatch: pytest.MonkeyPatch
@@ -325,6 +352,65 @@ async def test_model_catalog_url_rejects_non_http_url_before_writing_secret(
assert exc_info.value.status_code == 400
fake_secrets.set.assert_not_called()
+ @pytest.mark.asyncio
+ async def test_model_catalog_session_is_stored_separately_and_masked(
+ self, monkeypatch: pytest.MonkeyPatch
+ ):
+ catalog_url = (
+ "https://flocks-router-test.threatbook-inc.cn"
+ "/api/console/common/models"
+ )
+ ConfigWriter.add_provider(
+ "threatbook-cn-llm",
+ ConfigWriter.build_provider_config(
+ "threatbook-cn-llm",
+ base_url="https://flocks-router-test.threatbook-inc.cn/v1",
+ models={},
+ extra_options={"model_catalog_url": catalog_url},
+ ),
+ )
+ stored = {"threatbook-cn-llm_llm_key": "existing-api-key"}
+ fake_secrets = MagicMock()
+ fake_secrets.get.side_effect = stored.get
+ fake_secrets.set.side_effect = lambda secret_id, value: stored.__setitem__(
+ secret_id, value
+ )
+ runtime_provider = MagicMock()
+ runtime_provider._config = ProviderConfig(
+ provider_id="threatbook-cn-llm",
+ api_key="existing-api-key",
+ base_url="https://flocks-router-test.threatbook-inc.cn/v1",
+ custom_settings={"model_catalog_url": catalog_url},
+ )
+ monkeypatch.setattr("flocks.security.get_secret_manager", lambda: fake_secrets)
+ monkeypatch.setattr(provider_routes.Provider, "_ensure_initialized", MagicMock())
+ monkeypatch.setattr(
+ provider_routes.Provider,
+ "get",
+ lambda _provider_id: runtime_provider,
+ )
+
+ result = await provider_routes.set_provider_credentials(
+ "threatbook-cn-llm",
+ provider_routes.ProviderCredentialRequest(
+ model_catalog_session_token="test-session-token"
+ ),
+ )
+
+ session_secret_id = (
+ ThreatBookCnLLMProvider.model_catalog_session_secret_id(catalog_url)
+ )
+ assert result["success"] is True
+ assert stored[session_secret_id] == "test-session-token"
+ assert "model_catalog_session_token" not in str(
+ ConfigWriter.get_provider_raw("threatbook-cn-llm")
+ )
+ response = provider_routes._load_llm_provider_credentials(
+ "threatbook-cn-llm"
+ )
+ assert response.has_model_catalog_session is True
+ assert response.model_catalog_session_token_masked == "te***oken"
+
@pytest.mark.asyncio
async def test_existing_provider_model_catalog_url_is_updated_and_returned(
self, monkeypatch: pytest.MonkeyPatch
diff --git a/webui/src/locales/en-US/model.json b/webui/src/locales/en-US/model.json
index 810b815d3..17d6c561f 100644
--- a/webui/src/locales/en-US/model.json
+++ b/webui/src/locales/en-US/model.json
@@ -108,6 +108,10 @@
"baseUrlRequired": "Please enter Base URL",
"modelCatalogUrl": "Model Catalog URL",
"modelCatalogUrlHint": "Syncs Router model names, prices, and pricing tiers independently from the Chat Base URL; replace it when promoting environments.",
+ "modelCatalogSession": "Model Catalog Session",
+ "modelCatalogSessionPlaceholder": "Paste the session_token for this Router environment",
+ "modelCatalogSessionKeepExisting": "Leave blank to keep this environment's session",
+ "modelCatalogSessionHint": "Used only for this catalog URL and stored separately per test/production site; enter the matching session when switching environments.",
"apiKey": "API Key",
"ollamaNoKey": "(Ollama usually doesn't need this)",
"apiKeyOptional": "(optional, leave empty for no-auth gateways)",
diff --git a/webui/src/locales/zh-CN/model.json b/webui/src/locales/zh-CN/model.json
index 5f0bb1a11..75d4469d9 100644
--- a/webui/src/locales/zh-CN/model.json
+++ b/webui/src/locales/zh-CN/model.json
@@ -108,6 +108,10 @@
"baseUrlRequired": "请填写 Base URL",
"modelCatalogUrl": "模型目录 URL",
"modelCatalogUrlHint": "用于同步 Router 模型名称、价格和阶梯计费；与 Chat Base URL 相互独立，上线时可直接替换。",
+ "modelCatalogSession": "模型目录会话",
+ "modelCatalogSessionPlaceholder": "粘贴当前 Router 环境的 session_token",
+ "modelCatalogSessionKeepExisting": "留空以保留当前环境的目录会话",
+ "modelCatalogSessionHint": "仅用于访问该目录 URL，并按测试/生产站点隔离保存；切换环境时需填写对应环境的会话。",
"apiKey": "API Key",
"ollamaNoKey": "（Ollama 通常不需要）",
"apiKeyOptional": "（可选，无鉴权网关可留空）",
diff --git a/webui/src/pages/Model/index.tsx b/webui/src/pages/Model/index.tsx
index b025a364e..df03d9ee3 100644
--- a/webui/src/pages/Model/index.tsx
+++ b/webui/src/pages/Model/index.tsx
@@ -1236,6 +1236,7 @@ function AddProviderDialog({ connectedIds, onClose, onAdded }: {
const [showApiKey, setShowApiKey] = useState(false);
const [baseUrl, setBaseUrl] = useState('');
const [modelCatalogUrl, setModelCatalogUrl] = useState('');
+ const [modelCatalogSessionToken, setModelCatalogSessionToken] = useState('');
const [description, setDescription] = useState('');
const [providerName, setProviderName] = useState('');
const [azureDeploymentName, setAzureDeploymentName] = useState('');
@@ -1321,6 +1322,7 @@ function AddProviderDialog({ connectedIds, onClose, onAdded }: {
setDisplayName(provider.name);
setBaseUrl(provider.default_base_url || '');
setModelCatalogUrl(provider.default_model_catalog_url || '');
+ setModelCatalogSessionToken('');
setApiKey('');
setDescription(provider.description || '');
setSelectedModelIds(new Set(provider.models.map(m => m.id)));
@@ -1368,6 +1370,9 @@ function AddProviderDialog({ connectedIds, onClose, onAdded }: {
model_catalog_url: selectedCatalogId === 'threatbook-cn-llm'
? modelCatalogUrl.trim()
: undefined,
+ model_catalog_session_token: selectedCatalogId === 'threatbook-cn-llm'
+ ? (modelCatalogSessionToken.trim() || undefined)
+ : undefined,
provider_name: selectedCatalogId === 'openai-compatible' && providerName.trim() ? providerName.trim() : undefined,
});
const azureModelId = isAzureProviderId(selectedCatalogId) ? azureDeploymentName.trim() : '';
@@ -1425,6 +1430,9 @@ function AddProviderDialog({ connectedIds, onClose, onAdded }: {
model_catalog_url: selectedCatalogId === 'threatbook-cn-llm'
? modelCatalogUrl.trim()
: undefined,
+ model_catalog_session_token: selectedCatalogId === 'threatbook-cn-llm'
+ ? (modelCatalogSessionToken.trim() || undefined)
+ : undefined,
});
if (selectedCatalog) {
const unselected = selectedCatalog.models.filter(m => !selectedModelIds.has(m.id)).map(m => m.id);
@@ -1749,20 +1757,37 @@ function AddProviderDialog({ connectedIds, onClose, onAdded }: {
{selectedCatalogId === 'threatbook-cn-llm' && (
-
-
-
setModelCatalogUrl(e.target.value)}
- className="w-full px-3 py-2 border border-gray-300 rounded-lg focus:outline-none focus:ring-2 focus:ring-slate-400 text-sm"
- placeholder={selectedCatalog.default_model_catalog_url || 'https://router.example.com/api/console/common/models'}
- />
-
{t('form.modelCatalogUrlHint')}
-
+
+
setModelCatalogUrl(e.target.value)}
+ className="w-full px-3 py-2 border border-gray-300 rounded-lg focus:outline-none focus:ring-2 focus:ring-slate-400 text-sm"
+ placeholder={selectedCatalog.default_model_catalog_url || 'https://router.example.com/api/console/common/models'}
+ />
+
{t('form.modelCatalogUrlHint')}
+
+
+
setModelCatalogSessionToken(e.target.value)}
+ className="w-full px-3 py-2 border border-gray-300 rounded-lg focus:outline-none focus:ring-2 focus:ring-slate-400 text-sm"
+ placeholder={t('form.modelCatalogSessionPlaceholder')}
+ autoComplete="off"
+ />
+
{t('form.modelCatalogSessionHint')}
+
@@ -2387,9 +2412,11 @@ function ConfigureProviderDialog({ provider, existingCredentials, models, onClos
const existingKey = existingCredentials?.api_key ?? '';
const existingBaseUrl = existingCredentials?.base_url ?? '';
const existingModelCatalogUrl = existingCredentials?.model_catalog_url ?? '';
+ const hasExistingModelCatalogSession = existingCredentials?.has_model_catalog_session ?? false;
const [baseUrl, setBaseUrl] = useState(existingCredentials?.base_url ?? '');
const [modelCatalogUrl, setModelCatalogUrl] = useState(existingModelCatalogUrl);
+ const [modelCatalogSessionToken, setModelCatalogSessionToken] = useState('');
const [apiKey, setApiKey] = useState(existingKey);
const [providerName, setProviderName] = useState(provider.name);
const [showApiKey, setShowApiKey] = useState(false);
@@ -2421,6 +2448,7 @@ function ConfigureProviderDialog({ provider, existingCredentials, models, onClos
setApiKey(existingKey);
setBaseUrl(existingBaseUrl);
setModelCatalogUrl(existingModelCatalogUrl);
+ setModelCatalogSessionToken('');
setProviderName(provider.name);
}, [existingBaseUrl, existingKey, existingModelCatalogUrl, provider.id, provider.name]);
@@ -2481,6 +2509,9 @@ function ConfigureProviderDialog({ provider, existingCredentials, models, onClos
? (providerName.trim() || undefined)
: undefined,
};
+ if (provider.id === 'threatbook-cn-llm' && modelCatalogSessionToken.trim()) {
+ payload.model_catalog_session_token = modelCatalogSessionToken.trim();
+ }
if (nextApiKey && apiKeyChanged) payload.api_key = nextApiKey;
await providerAPI.setCredentials(provider.id, payload);
@@ -2517,8 +2548,8 @@ function ConfigureProviderDialog({ provider, existingCredentials, models, onClos
return;
}
const hasPendingChanges = hasPendingProviderCredentialChanges(
- { apiKey: existingKey, baseUrl: existingBaseUrl, modelCatalogUrl: existingModelCatalogUrl },
- { apiKey, baseUrl, modelCatalogUrl },
+ { apiKey: existingKey, baseUrl: existingBaseUrl, modelCatalogUrl: existingModelCatalogUrl, modelCatalogSessionToken: '' },
+ { apiKey, baseUrl, modelCatalogUrl, modelCatalogSessionToken },
);
const nextApiKey = apiKey.trim();
@@ -2541,6 +2572,9 @@ function ConfigureProviderDialog({ provider, existingCredentials, models, onClos
? (providerName.trim() || undefined)
: undefined,
};
+ if (provider.id === 'threatbook-cn-llm' && modelCatalogSessionToken.trim()) {
+ payload.model_catalog_session_token = modelCatalogSessionToken.trim();
+ }
if (nextApiKey && apiKeyChanged) payload.api_key = nextApiKey;
await providerAPI.setCredentials(provider.id, payload);
} catch (err: any) {
@@ -2657,20 +2691,39 @@ ${hasExisting ? '你已有凭证配置，可以更新或测试连接。' : '请
{provider.id === 'threatbook-cn-llm' && (
-
-
-
setModelCatalogUrl(e.target.value)}
- className="w-full px-3 py-2 border border-gray-300 rounded-lg focus:outline-none focus:ring-2 focus:ring-slate-400 text-sm"
- placeholder="https://router.example.com/api/console/common/models"
- />
-
{t('form.modelCatalogUrlHint')}
-
+
+
setModelCatalogUrl(e.target.value)}
+ className="w-full px-3 py-2 border border-gray-300 rounded-lg focus:outline-none focus:ring-2 focus:ring-slate-400 text-sm"
+ placeholder="https://router.example.com/api/console/common/models"
+ />
+
{t('form.modelCatalogUrlHint')}
+
+
+
setModelCatalogSessionToken(e.target.value)}
+ className="w-full px-3 py-2 border border-gray-300 rounded-lg focus:outline-none focus:ring-2 focus:ring-slate-400 text-sm"
+ placeholder={hasExistingModelCatalogSession
+ ? t('form.modelCatalogSessionKeepExisting')
+ : t('form.modelCatalogSessionPlaceholder')}
+ autoComplete="off"
+ />
+
{t('form.modelCatalogSessionHint')}
+
-
-
setModelCatalogUrl(e.target.value)}
- className="w-full px-3 py-2 border border-gray-300 rounded-lg focus:outline-none focus:ring-2 focus:ring-slate-400 text-sm"
- placeholder={selectedCatalog.default_model_catalog_url || 'https://router.example.com/api/console/common/models'}
- />
-
{t('form.modelCatalogUrlHint')}
-
-
-
setModelCatalogSessionToken(e.target.value)}
- className="w-full px-3 py-2 border border-gray-300 rounded-lg focus:outline-none focus:ring-2 focus:ring-slate-400 text-sm"
- placeholder={t('form.modelCatalogSessionPlaceholder')}
- autoComplete="off"
- />
-
{t('form.modelCatalogSessionHint')}
-
- {provider.id === 'threatbook-cn-llm' && (
- <>
-
-
-
setModelCatalogUrl(e.target.value)}
- className="w-full px-3 py-2 border border-gray-300 rounded-lg focus:outline-none focus:ring-2 focus:ring-slate-400 text-sm"
- placeholder="https://router.example.com/api/console/common/models"
- />
-
{t('form.modelCatalogUrlHint')}
-
-
-
setModelCatalogSessionToken(e.target.value)}
- className="w-full px-3 py-2 border border-gray-300 rounded-lg focus:outline-none focus:ring-2 focus:ring-slate-400 text-sm"
- placeholder={hasExistingModelCatalogSession
- ? t('form.modelCatalogSessionKeepExisting')
- : t('form.modelCatalogSessionPlaceholder')}
- autoComplete="off"
- />
-
{t('form.modelCatalogSessionHint')}
-
- {/* Router prices are authoritative; other providers remain editable. */}
+ {/* 价格 — 可编辑 */}
- {isRouterManagedPricing && (
-
- {t('form.routerPricingManaged')}
- {model.pricing?.price_version && (
-
- {t('form.priceVersion')}: {model.pricing.price_version}
-
- )}
-
- )}
- {priceTiers.length > 0 && (
-
-
- {t('form.inputTokenRange')}
- {t('form.inputUnitPrice')}
- {t('form.outputUnitPrice')}
-
- {priceTiers.map((tier, index) => (
-
- {formatTierTokenRange(priceTiers, index)}
- {priceSymbol}{tier.input_price}
- {priceSymbol}{tier.output_price}
-
- ))}
-
- )}
{/* 启用此模型 — 可编辑 */}
@@ -3280,9 +3078,7 @@ function formatModelPricing(
const pricing = model.pricing;
if (!pricing) return unavailableLabel;
if (isPricingFree(pricing)) return freeLabel;
- const base = formatPricingPerMillion(pricing);
- const tiers = formatPriceTiers(pricing);
- return tiers ? `${base}\n${tiers}` : base;
+ return formatPricingPerMillion(pricing);
}
function ModelSelectionInfo({ model }: { model: ModelDefinitionV2 }) {
diff --git a/webui/src/pages/Model/providerCredentialUtils.test.ts b/webui/src/pages/Model/providerCredentialUtils.test.ts
index 8c6464fa6..0a5808ce0 100644
--- a/webui/src/pages/Model/providerCredentialUtils.test.ts
+++ b/webui/src/pages/Model/providerCredentialUtils.test.ts
@@ -21,40 +21,6 @@ describe('hasPendingProviderCredentialChanges', () => {
).toBe(true);
});
- it('returns true when only the model catalog url changes', () => {
- expect(
- hasPendingProviderCredentialChanges(
- {
- apiKey: 'same-key',
- baseUrl: 'https://chat.example/v1',
- modelCatalogUrl: 'https://router-test.example/models',
- },
- {
- apiKey: 'same-key',
- baseUrl: 'https://chat.example/v1',
- modelCatalogUrl: 'https://router-prod.example/models',
- },
- ),
- ).toBe(true);
- });
-
- it('returns true when a model catalog session is entered', () => {
- expect(
- hasPendingProviderCredentialChanges(
- {
- apiKey: 'same-key',
- modelCatalogUrl: 'https://router.example/models',
- modelCatalogSessionToken: '',
- },
- {
- apiKey: 'same-key',
- modelCatalogUrl: 'https://router.example/models',
- modelCatalogSessionToken: 'new-session',
- },
- ),
- ).toBe(true);
- });
-
it('ignores whitespace-only differences', () => {
expect(
hasPendingProviderCredentialChanges(
diff --git a/webui/src/pages/Model/providerCredentialUtils.ts b/webui/src/pages/Model/providerCredentialUtils.ts
index a90f8ad33..580445d21 100644
--- a/webui/src/pages/Model/providerCredentialUtils.ts
+++ b/webui/src/pages/Model/providerCredentialUtils.ts
@@ -1,8 +1,6 @@
export interface ProviderCredentialSnapshot {
apiKey: string;
baseUrl?: string | null;
- modelCatalogUrl?: string | null;
- modelCatalogSessionToken?: string | null;
}
function normalizeValue(value?: string | null): string {
@@ -15,8 +13,6 @@ export function hasPendingProviderCredentialChanges(
): boolean {
return (
normalizeValue(existing.apiKey) !== normalizeValue(current.apiKey) ||
- normalizeValue(existing.baseUrl) !== normalizeValue(current.baseUrl) ||
- normalizeValue(existing.modelCatalogUrl) !== normalizeValue(current.modelCatalogUrl) ||
- normalizeValue(existing.modelCatalogSessionToken) !== normalizeValue(current.modelCatalogSessionToken)
+ normalizeValue(existing.baseUrl) !== normalizeValue(current.baseUrl)
);
}
diff --git a/webui/src/types/index.ts b/webui/src/types/index.ts
index 4cbf5692d..507682e77 100644
--- a/webui/src/types/index.ts
+++ b/webui/src/types/index.ts
@@ -419,9 +419,6 @@ export interface ProviderCredentials {
secret?: string | null;
secret_masked?: string | null;
base_url?: string | null;
- model_catalog_url?: string | null;
- model_catalog_session_token_masked?: string | null;
- has_model_catalog_session?: boolean;
username?: string | null;
/** Sensitive entries are masked on reads and must not be resubmitted unchanged. */
fields?: Record;
@@ -434,8 +431,6 @@ export interface ProviderCredentialInput {
api_key?: string;
secret?: string;
base_url?: string;
- model_catalog_url?: string;
- model_catalog_session_token?: string;
username?: string;
fields?: Record;
provider_name?: string;
@@ -515,14 +510,6 @@ export interface PriceConfigV2 {
cache_write?: number;
unit: number;
currency: string;
- price_tiers?: PriceTierConfigV2[] | null;
- price_version?: string | null;
-}
-
-export interface PriceTierConfigV2 {
- max_input_tokens?: number | null;
- input_price: number;
- output_price: number;
}
export interface ParameterRuleV2 {
@@ -659,7 +646,6 @@ export interface CatalogProvider {
credential_schemas: CatalogCredentialSchema[];
env_vars: string[];
default_base_url: string | null;
- default_model_catalog_url?: string | null;
model_count: number;
models: CatalogModel[];
allow_multiple?: boolean;
@@ -703,8 +689,6 @@ export interface CatalogModel {
cache_read?: number;
cache_write?: number;
currency: string;
- price_tiers?: PriceTierConfigV2[] | null;
- price_version?: string | null;
};
}
diff --git a/webui/src/utils/modelPricing.test.ts b/webui/src/utils/modelPricing.test.ts
index 56dc13034..44b0142b1 100644
--- a/webui/src/utils/modelPricing.test.ts
+++ b/webui/src/utils/modelPricing.test.ts
@@ -1,6 +1,6 @@
import { describe, expect, it } from 'vitest';
-import { formatPriceTiers, formatPricingPerMillion, isPricingFree } from './modelPricing';
+import { formatPricingPerMillion, isPricingFree } from './modelPricing';
describe('formatPricingPerMillion', () => {
it('formats input and output prices', () => {
@@ -11,18 +11,6 @@ describe('formatPricingPerMillion', () => {
})).toBe('¥1/¥2/M');
});
- it('formats all Router input-token price tiers', () => {
- expect(formatPriceTiers({
- input: 4.2,
- output: 16.8,
- currency: 'CNY',
- price_tiers: [
- { max_input_tokens: 512000, input_price: 4.2, output_price: 16.8 },
- { max_input_tokens: null, input_price: 8.4, output_price: 33.6 },
- ],
- })).toBe('≤ 512,000: ¥4.2/¥16.8/M\n> 512,000: ¥8.4/¥33.6/M');
- });
-
it('includes the cache-read price when configured', () => {
expect(formatPricingPerMillion({
input: 1,
diff --git a/webui/src/utils/modelPricing.ts b/webui/src/utils/modelPricing.ts
index f8f1c293f..baf3faa28 100644
--- a/webui/src/utils/modelPricing.ts
+++ b/webui/src/utils/modelPricing.ts
@@ -4,21 +4,8 @@ type PricingPerMillion = {
cache_read?: number | null;
cache_write?: number | null;
currency: string;
- price_tiers?: Array<{
- max_input_tokens?: number | null;
- input_price: number;
- output_price: number;
- }> | null;
};
-function currencySymbol(currency: string): string {
- return currency === 'CNY'
- ? '¥'
- : currency === 'USD'
- ? '$'
- : `${currency} `;
-}
-
export function isPricingFree(pricing: PricingPerMillion): boolean {
return pricing.input === 0
&& pricing.output === 0
@@ -27,23 +14,12 @@ export function isPricingFree(pricing: PricingPerMillion): boolean {
}
export function formatPricingPerMillion(pricing: PricingPerMillion): string {
- const symbol = currencySymbol(pricing.currency);
+ const symbol = pricing.currency === 'CNY'
+ ? '¥'
+ : pricing.currency === 'USD'
+ ? '$'
+ : `${pricing.currency} `;
const prices = [pricing.input, pricing.output];
if (pricing.cache_read != null) prices.push(pricing.cache_read);
return `${prices.map(price => `${symbol}${price}`).join('/')}/M`;
}
-
-export function formatPriceTiers(pricing: PricingPerMillion): string {
- const tiers = pricing.price_tiers ?? [];
- const symbol = currencySymbol(pricing.currency);
- let previousMax = 0;
- return tiers.map(tier => {
- const range = tier.max_input_tokens == null
- ? `> ${previousMax.toLocaleString('en-US')}`
- : previousMax === 0
- ? `≤ ${tier.max_input_tokens.toLocaleString('en-US')}`
- : `${previousMax.toLocaleString('en-US')} < Token ≤ ${tier.max_input_tokens.toLocaleString('en-US')}`;
- if (tier.max_input_tokens != null) previousMax = tier.max_input_tokens;
- return `${range}: ${symbol}${tier.input_price}/${symbol}${tier.output_price}/M`;
- }).join('\n');
-}