feat: publish v1.0.0-rc.36-custom.1

setting/system_setting/discord.go

@@ -0,0 +1,21 @@
+package system_setting
+
+import "github.com/QuantumNous/new-api/setting/config"
+
+type DiscordSettings struct {
+	Enabled      bool   `json:"enabled"`
+	ClientId     string `json:"client_id"`
+	ClientSecret string `json:"client_secret"`
+}
+
+// 默认配置
+var defaultDiscordSettings = DiscordSettings{}
+
+func init() {
+	// 注册到全局配置管理器
+	config.GlobalConfig.Register("discord", &defaultDiscordSettings)
+}
+
+func GetDiscordSettings() *DiscordSettings {
+	return &defaultDiscordSettings
+}

setting/system_setting/fetch_setting.go

@@ -0,0 +1,34 @@
+package system_setting
+
+import "github.com/QuantumNous/new-api/setting/config"
+
+type FetchSetting struct {
+	EnableSSRFProtection   bool     `json:"enable_ssrf_protection"` // 是否启用SSRF防护
+	AllowPrivateIp         bool     `json:"allow_private_ip"`
+	DomainFilterMode       bool     `json:"domain_filter_mode"`         // 域名过滤模式，true: 白名单模式，false: 黑名单模式
+	IpFilterMode           bool     `json:"ip_filter_mode"`             // IP过滤模式，true: 白名单模式，false: 黑名单模式
+	DomainList             []string `json:"domain_list"`                // domain format, e.g. example.com, *.example.com
+	IpList                 []string `json:"ip_list"`                    // CIDR format
+	AllowedPorts           []string `json:"allowed_ports"`              // port range format, e.g. 80, 443, 8000-9000
+	ApplyIPFilterForDomain bool     `json:"apply_ip_filter_for_domain"` // 对域名启用IP过滤（实验性）
+}
+
+var defaultFetchSetting = FetchSetting{
+	EnableSSRFProtection:   true, // 默认开启SSRF防护
+	AllowPrivateIp:         false,
+	DomainFilterMode:       false,
+	IpFilterMode:           false,
+	DomainList:             []string{},
+	IpList:                 []string{},
+	AllowedPorts:           []string{"80", "443", "8080", "8443"},
+	ApplyIPFilterForDomain: true,
+}
+
+func init() {
+	// 注册到全局配置管理器
+	config.GlobalConfig.Register("fetch_setting", &defaultFetchSetting)
+}
+
+func GetFetchSetting() *FetchSetting {
+	return &defaultFetchSetting
+}

setting/system_setting/legal.go

@@ -0,0 +1,21 @@
+package system_setting
+
+import "github.com/QuantumNous/new-api/setting/config"
+
+type LegalSettings struct {
+	UserAgreement string `json:"user_agreement"`
+	PrivacyPolicy string `json:"privacy_policy"`
+}
+
+var defaultLegalSettings = LegalSettings{
+	UserAgreement: "",
+	PrivacyPolicy: "",
+}
+
+func init() {
+	config.GlobalConfig.Register("legal", &defaultLegalSettings)
+}
+
+func GetLegalSettings() *LegalSettings {
+	return &defaultLegalSettings
+}

setting/system_setting/oidc.go

@@ -0,0 +1,41 @@
+package system_setting
+
+import (
+	"strings"
+
+	"github.com/QuantumNous/new-api/setting/config"
+)
+
+type OIDCSettings struct {
+	Enabled               bool   `json:"enabled"`
+	DisplayName           string `json:"display_name"`
+	ClientId              string `json:"client_id"`
+	ClientSecret          string `json:"client_secret"`
+	WellKnown             string `json:"well_known"`
+	AuthorizationEndpoint string `json:"authorization_endpoint"`
+	TokenEndpoint         string `json:"token_endpoint"`
+	UserInfoEndpoint      string `json:"user_info_endpoint"`
+}
+
+// 默认配置
+var defaultOIDCSettings = OIDCSettings{}
+
+func init() {
+	// 注册到全局配置管理器
+	config.GlobalConfig.Register("oidc", &defaultOIDCSettings)
+}
+
+func GetOIDCSettings() *OIDCSettings {
+	return &defaultOIDCSettings
+}
+
+// GetEffectiveDisplayName returns the admin-configured display name, or the
+// literal "OIDC" when none has been set. Centralizing this fallback keeps the
+// default in one place for both the OAuth provider name and the public
+// status payload.
+func (s *OIDCSettings) GetEffectiveDisplayName() string {
+	if trimmed := strings.TrimSpace(s.DisplayName); trimmed != "" {
+		return trimmed
+	}
+	return "OIDC"
+}

setting/system_setting/oidc_test.go

@@ -0,0 +1,47 @@
+package system_setting
+
+import (
+	"testing"
+
+	"github.com/QuantumNous/new-api/setting/config"
+	"github.com/stretchr/testify/assert"
+	"github.com/stretchr/testify/require"
+)
+
+func TestOIDCSettings_GetEffectiveDisplayName(t *testing.T) {
+	tests := []struct {
+		name        string
+		displayName string
+		want        string
+	}{
+		{name: "blank falls back to OIDC", displayName: "", want: "OIDC"},
+		{name: "custom name is returned verbatim", displayName: "Acme SSO", want: "Acme SSO"},
+		{name: "whitespace-only falls back to OIDC", displayName: "   ", want: "OIDC"},
+		{name: "surrounding whitespace is trimmed", displayName: "  Acme SSO  ", want: "Acme SSO"},
+	}
+
+	for _, tt := range tests {
+		t.Run(tt.name, func(t *testing.T) {
+			s := &OIDCSettings{DisplayName: tt.displayName}
+			assert.Equal(t, tt.want, s.GetEffectiveDisplayName())
+		})
+	}
+}
+
+func TestOIDCSettings_DisplayNamePersistenceRoundTrip(t *testing.T) {
+	settings := &OIDCSettings{DisplayName: "  Acme SSO  "}
+	manager := config.NewConfigManager()
+	manager.Register("oidc", settings)
+
+	saved := make(map[string]string)
+	require.NoError(t, manager.SaveToDB(func(key, value string) error {
+		saved[key] = value
+		return nil
+	}))
+	require.Equal(t, "  Acme SSO  ", saved["oidc.display_name"])
+
+	settings.DisplayName = ""
+	require.NoError(t, manager.LoadFromDB(saved))
+	assert.Equal(t, "  Acme SSO  ", settings.DisplayName)
+	assert.Equal(t, "Acme SSO", settings.GetEffectiveDisplayName())
+}

setting/system_setting/passkey.go

@@ -0,0 +1,50 @@
+package system_setting
+
+import (
+	"net/url"
+	"strings"
+
+	"github.com/QuantumNous/new-api/common"
+	"github.com/QuantumNous/new-api/setting/config"
+)
+
+type PasskeySettings struct {
+	Enabled              bool   `json:"enabled"`
+	RPDisplayName        string `json:"rp_display_name"`
+	RPID                 string `json:"rp_id"`
+	Origins              string `json:"origins"`
+	AllowInsecureOrigin  bool   `json:"allow_insecure_origin"`
+	UserVerification     string `json:"user_verification"`
+	AttachmentPreference string `json:"attachment_preference"`
+}
+
+var defaultPasskeySettings = PasskeySettings{
+	Enabled:              false,
+	RPDisplayName:        common.SystemName,
+	RPID:                 "",
+	Origins:              "",
+	AllowInsecureOrigin:  false,
+	UserVerification:     "preferred",
+	AttachmentPreference: "",
+}
+
+func init() {
+	config.GlobalConfig.Register("passkey", &defaultPasskeySettings)
+}
+
+func GetPasskeySettings() *PasskeySettings {
+	if defaultPasskeySettings.RPID == "" && ServerAddress != "" {
+		// 从ServerAddress提取域名作为RPID
+		// ServerAddress可能是 "https://newapi.pro" 这种格式
+		serverAddr := strings.TrimSpace(ServerAddress)
+		if parsed, err := url.Parse(serverAddr); err == nil && parsed.Host != "" {
+			defaultPasskeySettings.RPID = parsed.Host
+		} else {
+			defaultPasskeySettings.RPID = serverAddr
+		}
+	}
+	if defaultPasskeySettings.Origins == "" || defaultPasskeySettings.Origins == "[]" {
+		defaultPasskeySettings.Origins = ServerAddress
+	}
+	return &defaultPasskeySettings
+}

setting/system_setting/system_setting_old.go

@@ -0,0 +1,11 @@
+package system_setting
+
+var ServerAddress = "http://localhost:3000"
+var TaskPublicAddress = ""
+var WorkerUrl = ""
+var WorkerValidKey = ""
+var WorkerAllowHttpImageRequestEnabled = false
+
+func EnableWorker() bool {
+	return WorkerUrl != ""
+}

setting/system_setting/task_artifact.go

@@ -0,0 +1,56 @@
+package system_setting
+
+import "github.com/QuantumNous/new-api/common"
+
+const (
+	DefaultTaskArtifactInvalidRateLimitPerMinute = 60
+	DefaultTaskArtifactGlobalConcurrency         = 128
+	DefaultTaskArtifactIPConcurrency             = 64
+	DefaultTaskArtifactObjectConcurrency         = 16
+)
+
+const (
+	TaskArtifactInvalidRateLimitEnv = "TASK_ARTIFACT_INVALID_RATE_LIMIT_PER_MINUTE"
+	TaskArtifactGlobalLimitEnv      = "TASK_ARTIFACT_GLOBAL_CONCURRENCY"
+	TaskArtifactIPLimitEnv          = "TASK_ARTIFACT_IP_CONCURRENCY"
+	TaskArtifactObjectLimitEnv      = "TASK_ARTIFACT_OBJECT_CONCURRENCY"
+)
+
+type TaskArtifactAccessLimits struct {
+	InvalidRatePerMinute int
+	GlobalConcurrency    int
+	IPConcurrency        int
+	ObjectConcurrency    int
+}
+
+func positiveTaskArtifactLimit(env string, defaultValue int) int {
+	value := common.GetEnvOrDefault(env, defaultValue)
+	if value <= 0 {
+		common.SysError(env + " must be positive; using default")
+		return defaultValue
+	}
+	return value
+}
+
+// LoadTaskArtifactAccessLimits reads startup configuration. Invalid and
+// non-positive values safely fall back to the documented defaults.
+func LoadTaskArtifactAccessLimits() TaskArtifactAccessLimits {
+	return TaskArtifactAccessLimits{
+		InvalidRatePerMinute: positiveTaskArtifactLimit(
+			TaskArtifactInvalidRateLimitEnv,
+			DefaultTaskArtifactInvalidRateLimitPerMinute,
+		),
+		GlobalConcurrency: positiveTaskArtifactLimit(
+			TaskArtifactGlobalLimitEnv,
+			DefaultTaskArtifactGlobalConcurrency,
+		),
+		IPConcurrency: positiveTaskArtifactLimit(
+			TaskArtifactIPLimitEnv,
+			DefaultTaskArtifactIPConcurrency,
+		),
+		ObjectConcurrency: positiveTaskArtifactLimit(
+			TaskArtifactObjectLimitEnv,
+			DefaultTaskArtifactObjectConcurrency,
+		),
+	}
+}

setting/system_setting/task_artifact_store.go

@@ -0,0 +1,165 @@
+package system_setting
+
+import (
+	"errors"
+	"fmt"
+	"net"
+	"net/url"
+	"regexp"
+	"strings"
+	"unicode"
+
+	"github.com/QuantumNous/new-api/common"
+)
+
+const (
+	TaskArtifactStoreModeUpstream = "upstream"
+	TaskArtifactStoreModeS3       = "s3"
+
+	DefaultTaskArtifactStorePresignTTLSeconds = 900
+	MaxTaskArtifactStorePresignTTLSeconds     = 7 * 24 * 60 * 60
+)
+
+const (
+	TaskArtifactStoreModeEnv         = "TASK_ARTIFACT_STORE_MODE"
+	TaskArtifactStoreS3EndpointEnv   = "TASK_ARTIFACT_STORE_S3_ENDPOINT"
+	TaskArtifactStoreS3BucketEnv     = "TASK_ARTIFACT_STORE_S3_BUCKET"
+	TaskArtifactStoreS3RegionEnv     = "TASK_ARTIFACT_STORE_S3_REGION"
+	TaskArtifactStoreS3AccessKeyEnv  = "TASK_ARTIFACT_STORE_S3_ACCESS_KEY"
+	TaskArtifactStoreS3SecretKeyEnv  = "TASK_ARTIFACT_STORE_S3_SECRET_KEY"
+	TaskArtifactStoreS3PrefixEnv     = "TASK_ARTIFACT_STORE_S3_PREFIX"
+	TaskArtifactStoreS3PresignTTLEnv = "TASK_ARTIFACT_STORE_S3_PRESIGN_TTL"
+)
+
+var (
+	taskArtifactStoreBucketPattern = regexp.MustCompile(`^[a-z0-9][a-z0-9.-]{1,61}[a-z0-9]$`)
+	taskArtifactStoreRegionPattern = regexp.MustCompile(`^[A-Za-z0-9][A-Za-z0-9._-]{0,127}$`)
+)
+
+// TaskArtifactStoreConfig reserves the configuration contract for a future S3
+// implementation. The current release always falls back to upstream proxying.
+type TaskArtifactStoreConfig struct {
+	Mode                string
+	S3Endpoint          string
+	S3Bucket            string
+	S3Region            string
+	S3AccessKey         string
+	S3SecretKey         string
+	S3Prefix            string
+	S3PresignTTLSeconds int
+}
+
+// LoadTaskArtifactStoreConfig reads and validates startup-only configuration.
+// S3 mode is deliberately disabled until a storage implementation is shipped.
+func LoadTaskArtifactStoreConfig() TaskArtifactStoreConfig {
+	config := TaskArtifactStoreConfig{
+		Mode:                common.GetEnvOrDefaultString(TaskArtifactStoreModeEnv, TaskArtifactStoreModeUpstream),
+		S3Endpoint:          common.GetEnvOrDefaultString(TaskArtifactStoreS3EndpointEnv, ""),
+		S3Bucket:            common.GetEnvOrDefaultString(TaskArtifactStoreS3BucketEnv, ""),
+		S3Region:            common.GetEnvOrDefaultString(TaskArtifactStoreS3RegionEnv, ""),
+		S3AccessKey:         common.GetEnvOrDefaultString(TaskArtifactStoreS3AccessKeyEnv, ""),
+		S3SecretKey:         common.GetEnvOrDefaultString(TaskArtifactStoreS3SecretKeyEnv, ""),
+		S3Prefix:            common.GetEnvOrDefaultString(TaskArtifactStoreS3PrefixEnv, ""),
+		S3PresignTTLSeconds: common.GetEnvOrDefault(TaskArtifactStoreS3PresignTTLEnv, DefaultTaskArtifactStorePresignTTLSeconds),
+	}
+	if err := ValidateTaskArtifactStoreConfig(config); err != nil {
+		common.SysError("invalid task artifact store configuration: " + err.Error() + "; using upstream mode")
+		config.Mode = TaskArtifactStoreModeUpstream
+		return config
+	}
+	if config.Mode == TaskArtifactStoreModeS3 {
+		common.SysError("task artifact S3 storage is not implemented; using upstream mode")
+		config.Mode = TaskArtifactStoreModeUpstream
+	}
+	return config
+}
+
+// ValidateTaskArtifactStoreConfig performs syntax checks only. It never
+// resolves hosts, contacts an endpoint, or verifies credentials.
+func ValidateTaskArtifactStoreConfig(config TaskArtifactStoreConfig) error {
+	if config.Mode != TaskArtifactStoreModeUpstream && config.Mode != TaskArtifactStoreModeS3 {
+		return fmt.Errorf("unsupported mode %q", config.Mode)
+	}
+	if config.S3PresignTTLSeconds <= 0 || config.S3PresignTTLSeconds > MaxTaskArtifactStorePresignTTLSeconds {
+		return fmt.Errorf("S3 presign TTL must be between 1 and %d seconds", MaxTaskArtifactStorePresignTTLSeconds)
+	}
+
+	requireS3Fields := config.Mode == TaskArtifactStoreModeS3
+	if requireS3Fields && config.S3Endpoint == "" {
+		return errors.New("S3 endpoint is required")
+	}
+	if config.S3Endpoint != "" {
+		if config.S3Endpoint != strings.TrimSpace(config.S3Endpoint) {
+			return errors.New("S3 endpoint must not contain surrounding whitespace")
+		}
+		endpoint, err := url.Parse(config.S3Endpoint)
+		if err != nil || endpoint == nil || endpoint.Host == "" || endpoint.User != nil || endpoint.Opaque != "" {
+			return errors.New("S3 endpoint must be an absolute URL without userinfo")
+		}
+		if endpoint.Scheme != "http" && endpoint.Scheme != "https" {
+			return errors.New("S3 endpoint must use http or https")
+		}
+		if endpoint.RawQuery != "" || endpoint.ForceQuery || endpoint.Fragment != "" {
+			return errors.New("S3 endpoint must not contain a query or fragment")
+		}
+	}
+
+	if requireS3Fields && config.S3Bucket == "" {
+		return errors.New("S3 bucket is required")
+	}
+	if config.S3Bucket != "" {
+		if !taskArtifactStoreBucketPattern.MatchString(config.S3Bucket) ||
+			strings.Contains(config.S3Bucket, "..") || net.ParseIP(config.S3Bucket) != nil {
+			return errors.New("S3 bucket syntax is invalid")
+		}
+	}
+
+	if requireS3Fields && config.S3Region == "" {
+		return errors.New("S3 region is required")
+	}
+	if config.S3Region != "" && !taskArtifactStoreRegionPattern.MatchString(config.S3Region) {
+		return errors.New("S3 region syntax is invalid")
+	}
+	if err := validateTaskArtifactStoreCredential("access key", config.S3AccessKey, 256, requireS3Fields); err != nil {
+		return err
+	}
+	if err := validateTaskArtifactStoreCredential("secret key", config.S3SecretKey, 1024, requireS3Fields); err != nil {
+		return err
+	}
+
+	if config.S3Prefix != "" {
+		if config.S3Prefix != strings.TrimSpace(config.S3Prefix) || len(config.S3Prefix) > 512 ||
+			strings.HasPrefix(config.S3Prefix, "/") || strings.Contains(config.S3Prefix, "\\") {
+			return errors.New("S3 prefix syntax is invalid")
+		}
+		for part := range strings.SplitSeq(config.S3Prefix, "/") {
+			if part == "." || part == ".." {
+				return errors.New("S3 prefix must not contain dot segments")
+			}
+		}
+		for _, character := range config.S3Prefix {
+			if unicode.IsControl(character) {
+				return errors.New("S3 prefix must not contain control characters")
+			}
+		}
+	}
+	return nil
+}
+
+func validateTaskArtifactStoreCredential(name, value string, maxLength int, required bool) error {
+	if required && value == "" {
+		return fmt.Errorf("S3 %s is required", name)
+	}
+	if value == "" {
+		return nil
+	}
+	if value != strings.TrimSpace(value) || len(value) > maxLength {
+		return fmt.Errorf("S3 %s syntax is invalid", name)
+	}
+	for _, character := range value {
+		if unicode.IsControl(character) {
+			return fmt.Errorf("S3 %s syntax is invalid", name)
+		}
+	}
+	return nil
+}

setting/system_setting/task_artifact_store_test.go

@@ -0,0 +1,76 @@
+package system_setting
+
+import (
+	"testing"
+
+	"github.com/stretchr/testify/assert"
+	"github.com/stretchr/testify/require"
+)
+
+func TestValidateTaskArtifactStoreConfig(t *testing.T) {
+	valid := TaskArtifactStoreConfig{
+		Mode:                TaskArtifactStoreModeS3,
+		S3Endpoint:          "https://objects.example.com/storage",
+		S3Bucket:            "task-artifacts",
+		S3Region:            "us-east-1",
+		S3AccessKey:         "access-key",
+		S3SecretKey:         "secret-key",
+		S3Prefix:            "tasks/v1/",
+		S3PresignTTLSeconds: 900,
+	}
+	require.NoError(t, ValidateTaskArtifactStoreConfig(valid))
+	require.NoError(t, ValidateTaskArtifactStoreConfig(TaskArtifactStoreConfig{
+		Mode:                TaskArtifactStoreModeUpstream,
+		S3PresignTTLSeconds: DefaultTaskArtifactStorePresignTTLSeconds,
+	}))
+
+	tests := []struct {
+		name   string
+		mutate func(*TaskArtifactStoreConfig)
+		match  string
+	}{
+		{name: "mode", mutate: func(config *TaskArtifactStoreConfig) { config.Mode = "filesystem" }, match: "unsupported mode"},
+		{name: "endpoint scheme", mutate: func(config *TaskArtifactStoreConfig) { config.S3Endpoint = "ftp://objects.example.com" }, match: "http or https"},
+		{name: "endpoint credentials", mutate: func(config *TaskArtifactStoreConfig) { config.S3Endpoint = "https://user:pass@objects.example.com" }, match: "without userinfo"},
+		{name: "endpoint query", mutate: func(config *TaskArtifactStoreConfig) { config.S3Endpoint = "https://objects.example.com?token=secret" }, match: "query or fragment"},
+		{name: "bucket", mutate: func(config *TaskArtifactStoreConfig) { config.S3Bucket = "Invalid_Bucket" }, match: "bucket syntax"},
+		{name: "IP bucket", mutate: func(config *TaskArtifactStoreConfig) { config.S3Bucket = "192.168.1.1" }, match: "bucket syntax"},
+		{name: "region", mutate: func(config *TaskArtifactStoreConfig) { config.S3Region = "bad region" }, match: "region syntax"},
+		{name: "access key", mutate: func(config *TaskArtifactStoreConfig) { config.S3AccessKey = " access-key" }, match: "access key syntax"},
+		{name: "secret key", mutate: func(config *TaskArtifactStoreConfig) { config.S3SecretKey = "secret\nkey" }, match: "secret key syntax"},
+		{name: "prefix root", mutate: func(config *TaskArtifactStoreConfig) { config.S3Prefix = "/tasks" }, match: "prefix syntax"},
+		{name: "prefix traversal", mutate: func(config *TaskArtifactStoreConfig) { config.S3Prefix = "tasks/../private" }, match: "dot segments"},
+		{name: "TTL zero", mutate: func(config *TaskArtifactStoreConfig) { config.S3PresignTTLSeconds = 0 }, match: "presign TTL"},
+		{name: "TTL too long", mutate: func(config *TaskArtifactStoreConfig) {
+			config.S3PresignTTLSeconds = MaxTaskArtifactStorePresignTTLSeconds + 1
+		}, match: "presign TTL"},
+	}
+	for _, testCase := range tests {
+		t.Run(testCase.name, func(t *testing.T) {
+			config := valid
+			testCase.mutate(&config)
+			assert.ErrorContains(t, ValidateTaskArtifactStoreConfig(config), testCase.match)
+		})
+	}
+}
+
+func TestLoadTaskArtifactStoreConfigFallsBackToUpstream(t *testing.T) {
+	t.Setenv(TaskArtifactStoreModeEnv, "filesystem")
+	t.Setenv(TaskArtifactStoreS3PresignTTLEnv, "900")
+	config := LoadTaskArtifactStoreConfig()
+	assert.Equal(t, TaskArtifactStoreModeUpstream, config.Mode)
+
+	t.Setenv(TaskArtifactStoreModeEnv, TaskArtifactStoreModeS3)
+	t.Setenv(TaskArtifactStoreS3EndpointEnv, "https://objects.example.com")
+	t.Setenv(TaskArtifactStoreS3BucketEnv, "task-artifacts")
+	t.Setenv(TaskArtifactStoreS3RegionEnv, "us-east-1")
+	t.Setenv(TaskArtifactStoreS3AccessKeyEnv, "access-key")
+	t.Setenv(TaskArtifactStoreS3SecretKeyEnv, "secret-key")
+	t.Setenv(TaskArtifactStoreS3PrefixEnv, "tasks/v1")
+	t.Setenv(TaskArtifactStoreS3PresignTTLEnv, "600")
+	config = LoadTaskArtifactStoreConfig()
+
+	assert.Equal(t, TaskArtifactStoreModeUpstream, config.Mode)
+	assert.Equal(t, "https://objects.example.com", config.S3Endpoint)
+	assert.Equal(t, 600, config.S3PresignTTLSeconds)
+}

setting/system_setting/task_artifact_test.go

@@ -0,0 +1,33 @@
+package system_setting
+
+import (
+	"testing"
+
+	"github.com/stretchr/testify/assert"
+)
+
+func TestLoadTaskArtifactAccessLimitsUsesPositiveEnvironmentValues(t *testing.T) {
+	t.Setenv(TaskArtifactInvalidRateLimitEnv, "17")
+	t.Setenv(TaskArtifactGlobalLimitEnv, "23")
+	t.Setenv(TaskArtifactIPLimitEnv, "11")
+	t.Setenv(TaskArtifactObjectLimitEnv, "7")
+
+	limits := LoadTaskArtifactAccessLimits()
+	assert.Equal(t, 17, limits.InvalidRatePerMinute)
+	assert.Equal(t, 23, limits.GlobalConcurrency)
+	assert.Equal(t, 11, limits.IPConcurrency)
+	assert.Equal(t, 7, limits.ObjectConcurrency)
+}
+
+func TestLoadTaskArtifactAccessLimitsFallsBackForInvalidValues(t *testing.T) {
+	t.Setenv(TaskArtifactInvalidRateLimitEnv, "0")
+	t.Setenv(TaskArtifactGlobalLimitEnv, "-1")
+	t.Setenv(TaskArtifactIPLimitEnv, "invalid")
+	t.Setenv(TaskArtifactObjectLimitEnv, "")
+
+	limits := LoadTaskArtifactAccessLimits()
+	assert.Equal(t, DefaultTaskArtifactInvalidRateLimitPerMinute, limits.InvalidRatePerMinute)
+	assert.Equal(t, DefaultTaskArtifactGlobalConcurrency, limits.GlobalConcurrency)
+	assert.Equal(t, DefaultTaskArtifactIPConcurrency, limits.IPConcurrency)
+	assert.Equal(t, DefaultTaskArtifactObjectConcurrency, limits.ObjectConcurrency)
+}

setting/system_setting/telegram.go

@@ -0,0 +1,26 @@
+package system_setting
+
+import (
+	"strings"
+
+	"github.com/QuantumNous/new-api/setting/config"
+)
+
+type TelegramSettings struct {
+	ClientID     string `json:"client_id"`
+	ClientSecret string `json:"client_secret"`
+}
+
+var telegramSettings TelegramSettings
+
+func init() {
+	config.GlobalConfig.Register("telegram", &telegramSettings)
+}
+
+func GetTelegramSettings() *TelegramSettings {
+	return &telegramSettings
+}
+
+func (s *TelegramSettings) IsConfigured() bool {
+	return strings.TrimSpace(s.ClientID) != "" && strings.TrimSpace(s.ClientSecret) != ""
+}