kaiyuan/chatgpt-on-wechat
1
0
Fork 0
mirror of https://github.com/zhayujie/chatgpt-on-wechat.git synced 2026-07-18 20:17:09 +08:00
Code Issues Packages Projects Releases Wiki Activity

refactor(custom): id-based routing, single source of truth, security fixes

Browse Source 
Rework the multi custom-provider design per maintainer review:

1. Data model: use server-generated uuid4 short id as primary key;
   'name' is now a pure display label that can be freely renamed.

2. Routing: drop 'custom_active_provider'; activate a provider by
   setting bot_type to 'custom:<id>'. Single source of truth — no
   pointer drift between bot_type and a separate active selector.

3. Security: drag_sensitive() now recursively masks api_key/secret in
   nested structures (custom_providers list); previously only top-level
   string fields were masked.

4. Per-provider model: the provider's 'model' field now takes effect on
   the main chat path and agent path (was silently ignored before).

5. XSS fix: replace all inline onclick handlers in custom-provider UI
   with data-* attributes + event delegation. Provider names never
   appear in executable HTML contexts.

Legacy compatibility: bot_type='custom' (no colon) still reads the flat
custom_api_key/custom_api_base fields byte-for-byte identically.

Closes: consolidates #2876 into this PR as requested.
Ref: #2838
This commit is contained in:
kirs-hi
2026-06-11 17:25:24 +08:00
parent cffa590d3e
commit 1940d628a8
11 changed files with 504 additions and 353 deletions
Download Patch File Download Diff File Expand all files Collapse all files

20
docs/models/custom.mdx
View File

@@ -63,20 +63,21 @@ Switching models under a custom vendor only changes `model` — `bot_type` and t
## Configuring Multiple Custom Providers
If you need to configure several OpenAI-compatible third-party services at once (e.g. SiliconFlow, Qiniu), use the `custom_providers` list and select the active one with `custom_active_provider`:
If you need to configure several OpenAI-compatible third-party services at once (e.g. SiliconFlow, Qiniu), use the `custom_providers` list and activate one by setting `bot_type` to `"custom:<id>"`:
```json
{
"bot_type": "custom",
"custom_active_provider": "siliconflow",
"bot_type": "custom:3f2a9c1b",
"custom_providers": [
{
"id": "3f2a9c1b",
"name": "siliconflow",
"api_key": "YOUR_SILICONFLOW_KEY",
"api_base": "https://api.siliconflow.cn/v1",
"model": "deepseek-ai/DeepSeek-V3"
},
{
"id": "a1b2c3d4",
"name": "qiniu",
"api_key": "YOUR_QINIU_KEY",
"api_base": "https://api.qnaigc.com/v1",
@@ -88,9 +89,16 @@ If you need to configure several OpenAI-compatible third-party services at once
| Parameter | Description |
| --- | --- |
| `custom_providers` | List of custom providers; each item has `name`, `api_key`, `api_base`, and an optional `model` |
| `custom_active_provider` | The `name` of the active provider; when empty, the first entry in the list is used |
| `custom_providers` | List of custom providers; each item has `id`, `name`, `api_key`, `api_base`, and an optional `model` |
| `bot_type` | Set to `"custom:<id>"` to activate a specific provider; `id` is the provider's unique identifier |
| `id` | Server-generated short identifier (8-char hex); used as the primary key for each provider |
| `name` | User-facing display label — can be freely renamed without breaking anything |
| `model` | Optional; when set, this model is used instead of the global `model` field |
<Note>
When `custom_providers` is empty, CowAgent automatically falls back to the single-provider `custom_api_key` / `custom_api_base` fields above, so existing configurations keep working without any changes.
The `id` is auto-generated by the web console when you add a provider — you don't need to create it manually. If editing `config.json` by hand, use any unique 8-character hex string (e.g. run `python3 -c "import uuid; print(uuid.uuid4().hex[:8])"`).
</Note>
<Note>
When `bot_type` is exactly `"custom"` (no colon suffix), CowAgent uses the legacy single-provider `custom_api_key` / `custom_api_base` fields, so existing configurations keep working without any changes.
</Note>