labimotion 2.4.0.rc2 → 2.4.0.rc4

data/lib/labimotion/helpers/segment_helpers.rb

@@ -1,6 +1,9 @@
 # frozen_string_literal: true
 require 'grape'
-require 'labimotion/models/segment_klass'
+# require 'labimotion/models/segment_klass' — the constant resolves through the gem's
+# autoload table at call time, like the element path; an eager require drags ActiveRecord
+# into any process that only wants the helpers (element_helpers keeps its own model require
+# commented for the same reason).
 require 'labimotion/utils/utils'
 
 module Labimotion
@@ -36,7 +39,13 @@ module Labimotion
       attributes[:uuid] = uuid
       attributes[:released_at] = DateTime.now
       attributes[:properties_release] = attributes[:properties_template]
-      klass = Labimotion::SegmentKlass.create!(attributes)
+      # The owner row shares the create's transaction: a klass committed without it is
+      # owner-less, which falls open to the legacy designer-wide gate.
+      klass = Labimotion::SegmentKlass.transaction do
+        Labimotion::SegmentKlass.create!(attributes).tap do |klz|
+          Labimotion::KlassShare.seed_owner!(klz, current_user.id)
+        end
+      end
       klass.reload
       klass.create_klasses_revision(current_user)
       klass
@@ -45,8 +54,71 @@ module Labimotion
       raise e
     end
 
+    # Create a new (inactive) segment klass whose properties template is
+    # generated by an LLM from a user-provided label plus optional description,
+    # reference links and uploaded files. The parent ElementKlass must be set on
+    # @klass by the API (after_validation), mirroring create_segment_klass. The
+    # admin reviews/edits the generated template in the designer and activates it.
+    def create_ai_segment_klass(current_user, params)
+      return { status: 'error', message: 'A parent element class is required.' } if @klass.nil?
+
+      if Array(params[:files]).size > Labimotion::AiTemplate::MAX_FILES
+        return { status: 'error', message: "Too many files (max #{Labimotion::AiTemplate::MAX_FILES})." }
+      end
+
+      overrides = ai_user_overrides(current_user)
+      ai = Labimotion::AiTemplate.generate(
+        kind: 'segment',
+        subject: params[:label],
+        desc: params[:desc],
+        cols: params[:cols],
+        references: params[:references],
+        files: params[:files],
+        **overrides
+      )
+
+      uuid = SecureRandom.uuid
+      # property-base schema requires pkg, uuid, klass, layers, version, identifier.
+      properties_template = {
+        'uuid' => uuid,
+        'klass' => 'SegmentKlass',
+        'pkg' => Labimotion::Utils.pkg(nil),
+        'version' => '1.0.0',
+        'identifier' => uuid,
+        'layers' => ai['layers'],
+        'select_options' => ai['select_options'],
+        'metadata' => ai['metadata']
+      }
+      attributes = {
+        'label' => params[:label],
+        'desc' => params[:desc].presence || ai['label'].presence,
+        'element_klass' => @klass,
+        'place' => 100,
+        'is_active' => false,
+        'uuid' => uuid,
+        'released_at' => DateTime.now,
+        'properties_template' => properties_template,
+        'properties_release' => properties_template,
+        'created_by' => current_user.id
+      }
+      # Klass-level segment metadata (render kind: own tab vs the host element's
+      # Properties tab), mirroring the non-AI create_segment_klass which persists
+      # params[:metadata] via declared. Absent -> leave the column default.
+      attributes['metadata'] = params[:metadata] if params[:metadata].present?
+
+      klass = Labimotion::SegmentKlass.create!(attributes)
+      klass.reload
+      klass.create_klasses_revision(current_user)
+      { status: 'success',
+        message: "The AI segment template [#{params[:label]}] has been created as inactive. Review and activate it in the designer." }
+    rescue StandardError => e
+      Labimotion.log_exception(e, current_user)
+      { status: 'error', message: e.message }
+    end
+
     def update_segment_klass(current_user, params)
       segment = fetch_klass('SegmentKlass', params[:id])
+      authorize_klass!(segment, :write)
       place = params[:place]
       begin
         place = place.to_i if place.present? && place.to_i == place.to_f
@@ -77,7 +149,14 @@ module Labimotion
         if segment_klass['uuid'] == attributes['uuid'] && segment_klass['version'] == attributes['version']
           return { status: 'success', message: "This segment: #{attributes['label']} has the latest version!" }
         else
-          segment_klass.update!(attributes)
+          # Upgrading bumps the version and cuts a revision — :release, owner-only, and the
+          # gate lives here because the create/update branch is unknown until the identifier
+          # lookup. error! throws rather than raises, so it escapes this method's rescue.
+          authorize_klass!(segment_klass, :release)
+          # Same reassignment defect as the element path: `upload_klass` merges
+          # `created_by: current_user.id` unconditionally (segment_api.rb:147), so upgrading an
+          # existing segment template would hand its authorship to the importer.
+          segment_klass.update!(attributes.except('created_by', :created_by))
           segment_klass.create_klasses_revision(current_user)
           return { status: 'success', message: "This segment: [#{attributes['label']}] has been upgraded to the version: #{attributes['version']}!" }
         end
@@ -87,7 +166,11 @@ module Labimotion
           return { status: 'error', message: "The segment [#{attributes['label']}] is already in use." }
         else
           attributes['created_by'] = current_user.id
-          segment_klass = Labimotion::SegmentKlass.create!(attributes)
+          segment_klass = Labimotion::SegmentKlass.transaction do
+            Labimotion::SegmentKlass.create!(attributes).tap do |klz|
+              Labimotion::KlassShare.seed_owner!(klz, current_user.id)
+            end
+          end
           segment_klass.create_klasses_revision(current_user)
           return { status: 'success', message: "The segment: #{attributes['label']} has been created using version: #{attributes['version']}!" }
         end

data/lib/labimotion/libs/ai_egress_guard.rb

@@ -0,0 +1,84 @@
+# frozen_string_literal: true
+
+require 'resolv'
+require 'ipaddr'
+require 'uri'
+
+module Labimotion
+  # Validates a USER-SUPPLIED AI provider base URL before the server makes an
+  # outbound request to it, to prevent SSRF. A user may point the AI feature at
+  # their own OpenAI-compatible endpoint, but only at a PUBLIC https host — never
+  # at loopback / private / link-local / cloud-metadata addresses.
+  #
+  # Known limitation: validation resolves DNS at check time; a hostile resolver
+  # could rebind between this check and the actual request (TOCTOU). Redirect
+  # following is disabled at the HTTP layer, which removes the most common bypass;
+  # pinning the connection to the validated IP would close the residual window.
+  class AiEgressGuard
+    class BlockedError < StandardError; end
+
+    # Ranges Ruby's IPAddr#private?/#loopback?/#link_local? don't all cover:
+    # unspecified, CGNAT, benchmarking/test-net, IPv4-broadcast, reserved,
+    # and the IPv6 unique-local / link-local / multicast blocks.
+    EXTRA_BLOCKED = [
+      '0.0.0.0/8', '100.64.0.0/10', '192.0.0.0/24', '192.0.2.0/24',
+      '198.18.0.0/15', '198.51.100.0/24', '203.0.113.0/24', '240.0.0.0/4',
+      '255.255.255.255/32', '::/128', '::1/128', 'fc00::/7', 'fe80::/10', 'ff00::/8'
+    ].map { |cidr| IPAddr.new(cidr) }.freeze
+
+    # Raise BlockedError unless url is a public https endpoint. Returns url.
+    def self.validate!(url)
+      uri = parse(url)
+      raise BlockedError, 'AI provider URL must use https' unless uri.scheme == 'https'
+
+      host = uri.host.to_s
+      raise BlockedError, 'AI provider URL has no host' if host.empty?
+
+      addresses = resolve(host)
+      raise BlockedError, "AI provider host could not be resolved: #{host}" if addresses.empty?
+
+      blocked = addresses.find { |ip| !public_ip?(ip) }
+      raise BlockedError, "AI provider host resolves to a non-public address (#{blocked})" if blocked
+
+      url
+    end
+
+    def self.parse(url)
+      URI.parse(url.to_s.strip)
+    rescue URI::InvalidURIError
+      raise BlockedError, 'AI provider URL is not a valid URL'
+    end
+
+    # All A/AAAA addresses for host as IPAddr; a literal IP resolves to itself.
+    def self.resolve(host)
+      return [IPAddr.new(host)] if literal_ip?(host)
+
+      Resolv.getaddresses(host).filter_map { |addr| safe_ipaddr(addr) }
+    rescue StandardError
+      []
+    end
+
+    def self.literal_ip?(str)
+      IPAddr.new(str)
+      true
+    rescue IPAddr::InvalidAddressError
+      false
+    end
+
+    def self.safe_ipaddr(addr)
+      ip = IPAddr.new(addr.to_s)
+      ip.ipv4_mapped? ? ip.native : ip
+    rescue StandardError
+      nil
+    end
+
+    # Public = not loopback/private/link-local and not in EXTRA_BLOCKED.
+    def self.public_ip?(ip)
+      return false if ip.loopback? || ip.private? || ip.link_local?
+
+      EXTRA_BLOCKED.none? { |net| net.include?(ip) }
+    rescue StandardError
+      false
+    end
+  end
+end