@@ -1 +1 @@
-1.2.0
+1.2.1
@@ -1,13 +1,14 @@
 from __future__ import annotations
 
-from fastapi import APIRouter, Header, HTTPException
+from fastapi import APIRouter, Header, HTTPException, Response
 from fastapi.concurrency import run_in_threadpool
 from pydantic import BaseModel, Field
 
 from services.auth_service import auth_service
 
 from api.support import (
     require_admin,
+    require_identity,
     sanitize_cpa_pool,
     sanitize_cpa_pools,
     sanitize_sub2api_server,
@@ -26,12 +27,17 @@
 
 class UserKeyCreateRequest(BaseModel):
     name: str = ""
+    quota: int = 0
+    unlimited: bool = False
 
 
 class UserKeyUpdateRequest(BaseModel):
     name: str | None = None
     enabled: bool | None = None
     key: str | None = None
+    quota: int | None = None
+    unlimited: bool | None = None
+    reset_used: bool | None = None
 
 
 class AccountCreateRequest(BaseModel):
@@ -99,11 +105,41 @@ async def list_user_keys(authorization: str | None = Header(default=None)):
         require_admin(authorization)
         return {"items": auth_service.list_keys(role="user")}
 
+    @router.get("/api/auth/me")
+    async def get_my_identity(response: Response, authorization: str | None = Header(default=None)):
+        # 余额会随每次画图动态变化，不能让浏览器/SPA 兜底 HTML 缓存住，
+        # 否则前端永远显示老值。明确禁止任何中间层缓存。
+        response.headers["Cache-Control"] = "no-store"
+        identity = require_identity(authorization)
+        # admin 走 _legacy_admin_identity 不走 auth_service，没 id；前端按 unlimited=True 处理。
+        item_id = str(identity.get("id") or "").strip()
+        if not item_id or item_id == "admin":
+            return {
+                "identity": {
+                    "id": item_id,
+                    "name": identity.get("name"),
+                    "role": identity.get("role"),
+                    "quota": 0,
+                    "used": 0,
+                    "unlimited": True,
+                    "remaining": None,
+                }
+            }
+        record = auth_service.get_by_id(item_id)
+        if record is None:
+            raise HTTPException(status_code=404, detail={"error": "用户不存在"})
+        return {"identity": record}
+
     @router.post("/api/auth/users")
     async def create_user_key(body: UserKeyCreateRequest, authorization: str | None = Header(default=None)):
         require_admin(authorization)
         try:
-            item, raw_key = auth_service.create_key(role="user", name=body.name)
+            item, raw_key = auth_service.create_key(
+                role="user",
+                name=body.name,
+                quota=max(0, int(body.quota or 0)),
+                unlimited=bool(body.unlimited),
+            )
         except ValueError as exc:
             raise HTTPException(status_code=400, detail={"error": str(exc)}) from exc
         return {"item": item, "key": raw_key, "items": auth_service.list_keys(role="user")}
@@ -121,6 +157,9 @@ async def update_user_key(
                 "name": body.name,
                 "enabled": body.enabled,
                 "key": body.key,
+                "quota": body.quota,
+                "unlimited": body.unlimited,
+                "reset_used": body.reset_used,
             }.items()
             if value is not None
         }
 
@@ -4,8 +4,9 @@
 from fastapi.concurrency import run_in_threadpool
 from pydantic import BaseModel, ConfigDict, Field
 
-from api.support import require_identity, resolve_image_base_url
+from api.support import consume_user_quota, require_identity, resolve_image_base_url
 from services.content_filter import check_request, request_text
+from services.image_owners_service import record_owner_for_result
 from services.log_service import LoggedCall
 from services.protocol import (
     anthropic_v1_messages,
@@ -80,11 +81,17 @@ async def generate_images(
             authorization: str | None = Header(default=None),
     ):
         identity = require_identity(authorization)
+        # /v1 入口按 n 整体扣，1 次提交 = n 张。失败直接 402，不进 call.run。
+        consume_user_quota(identity, max(1, int(body.n or 1)))
         payload = body.model_dump(mode="python")
         payload["base_url"] = resolve_image_base_url(request)
         call = LoggedCall(identity, "/v1/images/generations", body.model, "文生图", request_text=body.prompt)
         await filter_or_log(call, body.prompt)
-        return await call.run(openai_v1_image_generations.handle, payload)
+        result = await call.run(openai_v1_image_generations.handle, payload)
+        # 对接 dict 返回时把图片归属也写一下；StreamingResponse 不动。
+        if isinstance(result, dict):
+            record_owner_for_result(identity, result.get("data"))
+        return result
 
     @router.post("/v1/images/edits")
     async def edit_images(
@@ -103,6 +110,8 @@ async def edit_images(
         call = LoggedCall(identity, "/v1/images/edits", model, "图生图", request_text=prompt)
         if n < 1 or n > 4:
             raise HTTPException(status_code=400, detail={"error": "n must be between 1 and 4"})
+        # 同样按 n 整体扣，校验过 n 范围之后再扣，避免无效请求也被记账。
+        consume_user_quota(identity, max(1, int(n)))
         await filter_or_log(call, prompt)
         uploads = [*(image or []), *(image_list or [])]
         if not uploads:
@@ -123,7 +132,10 @@ async def edit_images(
             "stream": stream,
             "base_url": resolve_image_base_url(request),
         }
-        return await call.run(openai_v1_image_edit.handle, payload)
+        result = await call.run(openai_v1_image_edit.handle, payload)
+        if isinstance(result, dict):
+            record_owner_for_result(identity, result.get("data"))
+        return result
 
     @router.post("/v1/chat/completions")
     async def create_chat_completion(body: ChatCompletionRequest, authorization: str | None = Header(default=None)):
 
@@ -3,7 +3,7 @@
 from contextlib import asynccontextmanager
 from threading import Event
 
-from fastapi import FastAPI, HTTPException
+from fastapi import FastAPI, HTTPException, Request
 from fastapi.middleware.cors import CORSMiddleware
 from fastapi.responses import FileResponse
 from fastapi.staticfiles import StaticFiles
@@ -38,6 +38,17 @@ async def lifespan(_: FastAPI):
         allow_methods=["*"],
         allow_headers=["*"],
     )
+
+    # 动态接口禁缓存：/api/* 与 /v1/* 都是后端业务数据，浏览器若自行启发式缓存
+    # 会出现"改了配置/数据但 UI 不更新"的诡异现象。一律 no-store 让每次都打到后端。
+    @app.middleware("http")
+    async def _no_store_for_api(request: Request, call_next):
+        response = await call_next(request)
+        path = request.url.path
+        if path.startswith("/api/") or path.startswith("/v1/"):
+            response.headers["Cache-Control"] = "no-store"
+        return response
+
     app.include_router(ai.create_router())
     app.include_router(accounts.create_router())
     app.include_router(image_tasks.create_router())
 
@@ -4,7 +4,7 @@
 from fastapi.concurrency import run_in_threadpool
 from pydantic import BaseModel, Field
 
-from api.support import require_identity, resolve_image_base_url
+from api.support import consume_user_quota, require_identity, resolve_image_base_url
 from services.content_filter import check_request
 from services.image_task_service import image_task_service
 from services.log_service import LoggedCall
@@ -17,6 +17,10 @@ class ImageGenerationTaskRequest(BaseModel):
     size: str | None = None
 
 
+class ImageTaskCancelRequest(BaseModel):
+    ids: list[str] = Field(default_factory=list)
+
+
 def _parse_task_ids(value: str) -> list[str]:
     return [item.strip() for item in value.split(",") if item.strip()]
 
@@ -40,13 +44,25 @@ async def list_image_tasks(
         identity = require_identity(authorization)
         return await run_in_threadpool(image_task_service.list_tasks, identity, _parse_task_ids(ids))
 
+    @router.post("/api/image-tasks/cancel")
+    async def cancel_image_tasks(
+        body: ImageTaskCancelRequest,
+        authorization: str | None = Header(default=None),
+    ):
+        identity = require_identity(authorization)
+        ids = [task_id.strip() for task_id in body.ids if task_id and task_id.strip()]
+        return await run_in_threadpool(image_task_service.cancel_tasks, identity, ids)
+
     @router.post("/api/image-tasks/generations")
     async def create_generation_task(
         body: ImageGenerationTaskRequest,
         request: Request,
         authorization: str | None = Header(default=None),
     ):
         identity = require_identity(authorization)
+        # 前端每张图独立提交一次任务，按 1 扣；额度不足直接 402，
+        # 不要等 submit_generation 跑完才发现没额度。
+        consume_user_quota(identity, 1)
         await filter_or_log(LoggedCall(identity, "/api/image-tasks/generations", body.model, "文生图任务", request_text=body.prompt), body.prompt)
         try:
             return await run_in_threadpool(
@@ -73,6 +89,8 @@ async def create_edit_task(
         size: str | None = Form(default=None),
     ):
         identity = require_identity(authorization)
+        # 同样按 1 张扣；前端会拆成多次提交，所以这里不需要乘以 n。
+        consume_user_quota(identity, 1)
         await filter_or_log(LoggedCall(identity, "/api/image-tasks/edits", model, "图生图任务", request_text=prompt), prompt)
         uploads = [*(image or []), *(image_list or [])]
         if not uploads:
 
@@ -57,6 +57,19 @@ def raise_image_quota_error(exc: Exception) -> None:
     raise HTTPException(status_code=502, detail={"error": message}) from exc
 
 
+def consume_user_quota(identity: dict[str, object], amount: int) -> None:
+    """画图入口处扣减用户密钥额度。admin / unlimited 直接放行；
+    普通用户额度不足直接 402，让前端把按钮禁用并提示联系管理员加额度。"""
+    role = str(identity.get("role") or "").strip().lower()
+    item_id = str(identity.get("id") or "").strip()
+    if role == "admin" or not item_id or item_id == "admin":
+        return
+    result = auth_service.consume_quota(item_id, max(1, int(amount or 1)))
+    if not result.get("ok"):
+        reason = str(result.get("reason") or "额度不足")
+        raise HTTPException(status_code=402, detail={"error": reason})
+
+
 def sanitize_cpa_pool(pool: dict | None) -> dict | None:
     if not isinstance(pool, dict):
         return None
 
@@ -8,14 +8,44 @@
 from pydantic import BaseModel, ConfigDict
 
 from api.support import require_admin, require_identity, resolve_image_base_url
+from services.auth_service import auth_service
 from services.backup_service import BackupError, backup_service
 from services.config import config
-from services.image_service import delete_images, download_images_zip, get_image_download_response, get_thumbnail_response, list_images
+from services.image_owners_service import owner_counts
+from services.image_service import count_total_images, delete_images, download_images_zip, get_image_download_response, get_thumbnail_response, list_images
 from services.image_tags_service import delete_tag, get_all_tags, set_tags
 from services.log_service import log_service
 from services.proxy_service import test_proxy
 
 
+def _admin_owner_ids() -> set[str]:
+    """收集所有可能落在 image_owners.json 里的 admin id：
+    - "admin"：旧 auth_key（CHATGPT2API_AUTH_KEY / config.json.auth-key）的固定 id
+    - 其余：通过 auth_service 创建的 admin 角色密钥
+    用来把"管理员生成"和"真孤儿"两个桶区分开，别再混在一起。
+    """
+    ids: set[str] = {"admin"}
+    for item in auth_service.list_keys(role="admin"):
+        uid = str(item.get("id") or "").strip()
+        if uid:
+            ids.add(uid)
+    return ids
+
+
+def _admin_owner_ids() -> set[str]:
+    """收集所有可能落在 image_owners.json 里的 admin id：
+    - "admin"：旧 auth_key（CHATGPT2API_AUTH_KEY / config.json.auth-key）的固定 id
+    - 其余：通过 auth_service 创建的 admin 角色密钥
+    用来把"管理员生成"和"真孤儿"两个桶区分开，别再混在一起。
+    """
+    ids: set[str] = {"admin"}
+    for item in auth_service.list_keys(role="admin"):
+        uid = str(item.get("id") or "").strip()
+        if uid:
+            ids.add(uid)
+    return ids
+
+
 class SettingsUpdateRequest(BaseModel):
     model_config = ConfigDict(extra="allow")
 
@@ -28,6 +58,7 @@ class ImageDeleteRequest(BaseModel):
     paths: list[str] = []
     start_date: str = ""
     end_date: str = ""
+    owner: str = ""
     all_matching: bool = False
 
 class ImageDownloadRequest(BaseModel):
@@ -72,9 +103,68 @@ async def save_settings(body: SettingsUpdateRequest, authorization: str | None =
         return {"config": config.update(body.model_dump(mode="python"))}
 
     @router.get("/api/images")
-    async def get_images(request: Request, start_date: str = "", end_date: str = "", authorization: str | None = Header(default=None)):
+    async def get_images(
+        request: Request,
+        start_date: str = "",
+        end_date: str = "",
+        owner: str = "",
+        authorization: str | None = Header(default=None),
+    ):
+        require_admin(authorization)
+        return list_images(
+            resolve_image_base_url(request),
+            start_date=start_date.strip(),
+            end_date=end_date.strip(),
+            owner=owner.strip(),
+            admin_ids=_admin_owner_ids(),
+        )
+
+    @router.get("/api/images/owners")
+    async def get_image_owners(authorization: str | None = Header(default=None)):
+        """图片管理页用户筛选下拉的数据源。
+        三类语义，互不混淆：
+        1. 普通用户：列出所有用户密钥（即便 count=0），admin 期望"我建过的密钥都能筛"
+        2. 管理员（__admin__）：所有 admin 角色（含旧 auth_key 的 "admin" id）生成的图聚合
+        3. 未归属（__unowned__）：image_owners.json 里没记录的真孤儿，多半是老数据
+        孤儿 user id（用户密钥已被删但归属表还留着）单列出来，标记 deleted=true。
+        """
         require_admin(authorization)
-        return list_images(resolve_image_base_url(request), start_date=start_date.strip(), end_date=end_date.strip())
+        counts = owner_counts()
+        admin_ids = _admin_owner_ids()
+        users = auth_service.list_keys(role="user")
+        items: list[dict[str, object]] = []
+        seen_ids: set[str] = set()
+        for user in users:
+            uid = str(user.get("id") or "").strip()
+            if not uid:
+                continue
+            seen_ids.add(uid)
+            items.append({
+                "id": uid,
+                "name": user.get("name") or uid,
+                "deleted": False,
+                "count": int(counts.get(uid, 0)),
+            })
+        # admin 集合本身已经独立成一桶，所以 seen_ids 里要带上 admin_ids 防止重复
+        seen_ids |= admin_ids
+        admin_count = sum(int(c) for k, c in counts.items() if k in admin_ids)
+        for owner_id, count in counts.items():
+            if not owner_id or owner_id in seen_ids:
+                continue
+            items.append({
+                "id": owner_id,
+                "name": owner_id,
+                "deleted": True,
+                "count": int(count),
+            })
+        items.sort(key=lambda x: (-int(x.get("count") or 0), str(x.get("name") or "")))
+        # 真孤儿 = 总图片数 − 已挂归属的所有图（含 admin / 用户 / 已删用户）
+        owned_total = sum(int(v) for v in counts.values())
+        unowned_count = max(0, count_total_images() - owned_total)
+        # 两个固定桶；前端会把它们置顶到列表最上方。
+        items.append({"id": "__admin__", "name": "管理员", "deleted": False, "count": admin_count})
+        items.append({"id": "__unowned__", "name": "未归属", "deleted": False, "count": unowned_count})
+        return {"items": items}
 
     @router.get("/image-thumbnails/{image_path:path}", include_in_schema=False)
     async def get_image_thumbnail(image_path: str):
@@ -83,7 +173,14 @@ async def get_image_thumbnail(image_path: str):
     @router.post("/api/images/delete")
     async def delete_images_endpoint(body: ImageDeleteRequest, authorization: str | None = Header(default=None)):
         require_admin(authorization)
-        return delete_images(body.paths, start_date=body.start_date.strip(), end_date=body.end_date.strip(), all_matching=body.all_matching)
+        return delete_images(
+            body.paths,
+            start_date=body.start_date.strip(),
+            end_date=body.end_date.strip(),
+            owner=body.owner.strip(),
+            all_matching=body.all_matching,
+            admin_ids=_admin_owner_ids(),
+        )
 
     @router.post("/api/images/download")
     async def download_images_endpoint(body: ImageDownloadRequest, authorization: str | None = Header(default=None)):
 
@@ -1,6 +1,6 @@
 [project]
 name = "chatgpt2api"
-version = "1.2.0"
+version = "1.2.1"
 description = "Add your description here"
 readme = "README.md"
 requires-python = ">=3.13"