fix: support trusted proxies for API allowlist

[ssongliu]

No description provided.

[Copilot]

Pull request overview

Adds support for defining “trusted proxies” so API IP allowlisting can correctly evaluate the real client IP when requests arrive via a reverse proxy.

Changes:

• Add apiTrustedProxies to the API config UI, request payloads, and i18n strings.
• Persist a new ApiTrustedProxies setting via migration and include it in API auth config loading.
• Update API auth middleware to derive the client IP from X-Forwarded-For / X-Real-IP when the immediate peer is a trusted proxy.

Reviewed changes

Copilot reviewed 24 out of 24 changed files in this pull request and generated 4 comments.

Show a summary per file

File	Description
frontend/src/layout/components/Sidebar/components/user-info/index.vue	Adds textarea + validation and persists apiTrustedProxies in API config UI.
frontend/src/api/interface/auth.ts	Extends frontend auth interfaces with apiTrustedProxies.
frontend/src/lang/modules/zh.ts	Adds UI strings for trusted proxies.
frontend/src/lang/modules/zh-Hant.ts	Adds UI strings for trusted proxies.
frontend/src/lang/modules/en.ts	Adds UI strings for trusted proxies.
frontend/src/lang/modules/tr.ts	Adds UI strings for trusted proxies.
frontend/src/lang/modules/ru.ts	Adds UI strings for trusted proxies.
frontend/src/lang/modules/pt-br.ts	Adds UI strings for trusted proxies.
frontend/src/lang/modules/ms.ts	Adds UI strings for trusted proxies.
frontend/src/lang/modules/lo.ts	Adds UI strings for trusted proxies.
frontend/src/lang/modules/ko.ts	Adds UI strings for trusted proxies.
frontend/src/lang/modules/ja.ts	Adds UI strings for trusted proxies.
frontend/src/lang/modules/fa.ts	Adds UI strings for trusted proxies.
frontend/src/lang/modules/es-es.ts	Adds UI strings for trusted proxies.
core/app/dto/auth.go	Adds ApiTrustedProxies to DTOs for config + current user info.
core/app/auth/auth.go	Normalizes and stores ApiTrustedProxies setting during API config updates.
core/app/auth/api_auth.go	Loads/stores trusted proxies config and derives client IP for allowlist checks.
core/app/api/v2/auth.go	Validates/normalizes apiTrustedProxies on the update API endpoint.
core/init/migration/migrations/init.go	Adds initial/default setting + migration for ApiTrustedProxies.
core/init/migration/migrate.go	Registers the new migration.
core/cmd/server/docs/x-log.json	Updates panel log schema/format for API config updates.
core/cmd/server/docs/swagger.json	Updates swagger/log metadata (also includes additional unrelated AI endpoints).
core/cmd/server/docs/docs.go	Updates embedded swagger template (also includes additional unrelated AI endpoints).
agent/cmd/server/docs/x-log.json	Mirrors panel log schema/format updates for the agent docs.

---

💡 Add Copilot custom instructions for smarter, more guided reviews. Learn how to get started.

[Copilot]

Pull request overview

Copilot reviewed 24 out of 24 changed files in this pull request and generated no new comments.

Comments suppressed due to low confidence (2)

frontend/src/layout/components/Sidebar/components/user-info/index.vue:617

• checkIPs validates each line without trimming whitespace. This can incorrectly reject valid IP/CIDR inputs when users paste values with leading/trailing spaces or Windows CRLF (e.g., 1.2.3.4\r). Since the validator is now reused for both ipWhiteList and apiTrustedProxies, trimming each entry avoids false validation failures while matching backend normalization behavior.

    if (value !== '') {
        let addr = value.split('\n');
        for (const item of addr) {
            if (item === '') {
                continue;
            }
            if (item.indexOf('/') !== -1) {
                if (item.indexOf(':') !== -1) {
                    if (checkCidrV6(item)) {
                        return callback(new Error(i18n.global.t('firewall.addressFormatError')));
                    }
                } else if (checkCidr(item)) {
                    return callback(new Error(i18n.global.t('firewall.addressFormatError')));
                }
            } else if (checkIpV4V6(item)) {
                return callback(new Error(i18n.global.t('firewall.addressFormatError')));
            }

core/cmd/server/docs/docs.go:2135

• The generated Core Swagger template now documents new /ai/agents/plugins/* endpoints and references DTOs like dto.AgentPluginMarketInstallReq, but there are no corresponding routes or DTO types in the core codebase (the only occurrences are in these docs files). This makes the core server API documentation inaccurate and introduces large unrelated diffs for a PR focused on API trusted proxies.

		"/ai/agents/plugins/install": {
			"post": {
				"consumes": [
					"application/json"
				],
				"parameters": [
					{
						"description": "request",
						"in": "body",
						"name": "request",
						"required": true,
						"schema": {
							"$ref": "#/definitions/dto.AgentPluginMarketInstallReq"

[Copilot]

Pull request overview

Copilot reviewed 24 out of 24 changed files in this pull request and generated no new comments.

Comments suppressed due to low confidence (3)

frontend/src/layout/components/Sidebar/components/user-info/index.vue:608

• apiTrustedProxies is validated with the same checkIPs function as the API allowlist, but the UI helper text (and backend normalization) disallow unrestricted CIDRs (0.0.0.0/0 and ::/0). Adding a small field-specific check here will prevent inputs that are guaranteed to be rejected on save.

function checkIPs(rule: any, value: any, callback: any) {
    if (value !== '') {
        let addr = value.split('\n');
        for (const rawItem of addr) {
            const item = rawItem.trim();
            if (item === '') {
                continue;
            }
            if (item.indexOf('/') !== -1) {

frontend/src/layout/components/Sidebar/components/user-info/index.vue:365

• The placeholder for apiTrustedProxies uses setting.allowIPEgs, which describes a different concept (authorized IPs) and can confuse users configuring proxy IPs. Consider reusing the existing setting.ipWhiteListEgs example text (same IP/CIDR format) or adding a dedicated apiTrustedProxiesEgs key.

            <el-form-item :label="$t('setting.apiTrustedProxies')" prop="apiTrustedProxies">
                <el-input
                    type="textarea"
                    :placeholder="$t('setting.allowIPEgs')"
                    :rows="3"
                    v-model="form.apiTrustedProxies"
                />

core/cmd/server/docs/docs.go:2133

• This Swagger docs update introduces a large block of new AI plugin endpoints/DTOs (e.g. /ai/agents/plugins/install) which appears unrelated to the PR’s stated purpose (trusted proxies for the API allowlist). If these are intentional doc-regeneration changes, consider splitting them into a separate PR to keep scope focused; otherwise, please confirm they’re not accidental output from a broader docs generation step.

					"AI"
				]
			}
		},
		"/ai/agents/plugins/install": {
			"post": {
				"consumes": [
					"application/json"
				],
				"parameters": [
					{
						"description": "request",
						"in": "body",
						"name": "request",
						"required": true,