rails_ai 0.1.0

data/lib/rails_ai/providers/secure_anthropic_adapter.rb

@@ -0,0 +1,206 @@
+# frozen_string_literal: true
+
+require "net/http"
+require "json"
+require_relative "../security"
+
+module RailsAi
+  module Providers
+    class SecureAnthropicAdapter < Base
+      ANTHROPIC_API_BASE = "https://api.anthropic.com/v1"
+      
+      def initialize
+        @api_key = Security::APIKeyManager.secure_fetch("ANTHROPIC_API_KEY")
+        @rate_limiter = Security::RateLimiter.new(limit: 50, window: 3600)
+        super
+      end
+
+      def chat!(messages:, model:, **opts)
+        return "(stubbed) #{messages.last[:content]}" if RailsAi.config.stub_responses
+        
+        # Security validations
+        Security::InputValidator.validate_messages(messages)
+        
+        # Rate limiting
+        @rate_limiter.check_limit("chat_#{RailsAi::Context.user_id}")
+        
+        # Sanitize content
+        sanitized_messages = messages.map do |message|
+          {
+            role: message[:role],
+            content: Security::ContentSanitizer.sanitize_content(message[:content])
+          }
+        end
+        
+        response = make_request(
+          "messages",
+          {
+            model: model,
+            max_tokens: opts[:max_tokens] || RailsAi.config.token_limit,
+            messages: sanitized_messages,
+            **opts.except(:max_tokens)
+          }
+        )
+        
+        response.dig("content", 0, "text")
+      end
+
+      def stream_chat!(messages:, model:, **opts, &on_token)
+        return on_token.call("(stubbed stream)") if RailsAi.config.stub_responses
+        
+        # Security validations
+        Security::InputValidator.validate_messages(messages)
+        
+        # Rate limiting
+        @rate_limiter.check_limit("stream_#{RailsAi::Context.user_id}")
+        
+        # Sanitize content
+        sanitized_messages = messages.map do |message|
+          {
+            role: message[:role],
+            content: Security::ContentSanitizer.sanitize_content(message[:content])
+          }
+        end
+        
+        make_streaming_request(
+          "messages",
+          {
+            model: model,
+            max_tokens: opts[:max_tokens] || RailsAi.config.token_limit,
+            messages: sanitized_messages,
+            stream: true,
+            **opts.except(:max_tokens, :stream)
+          },
+          &on_token
+        )
+      end
+
+      def analyze_image!(image:, prompt:, model: "claude-3-5-sonnet-20241022", **opts)
+        return "(stubbed analysis)" if RailsAi.config.stub_responses
+        
+        # Security validations
+        Security::InputValidator.validate_text_input(prompt, max_length: 1000)
+        
+        # Rate limiting
+        @rate_limiter.check_limit("vision_#{RailsAi::Context.user_id}")
+        
+        # Sanitize prompt
+        sanitized_prompt = Security::ContentSanitizer.sanitize_content(prompt)
+        
+        # Prepare image securely
+        image_data = prepare_image_securely(image)
+        
+        response = make_request(
+          "messages",
+          {
+            model: model,
+            max_tokens: opts[:max_tokens] || 1000,
+            messages: [
+              {
+                role: "user",
+                content: [
+                  {
+                    type: "text",
+                    text: sanitized_prompt
+                  },
+                  {
+                    type: "image",
+                    source: {
+                      type: "base64",
+                      media_type: "image/png",
+                      data: image_data
+                    }
+                  }
+                ]
+              }
+            ],
+            **opts.except(:max_tokens)
+          }
+        )
+        
+        response.dig("content", 0, "text")
+      end
+
+      private
+
+      def make_request(endpoint, payload)
+        Security::SecureHTTPClient.make_request(
+          "#{ANTHROPIC_API_BASE}/#{endpoint}",
+          method: 'POST',
+          body: payload.to_json,
+          headers: {
+            'Authorization' => "Bearer #{@api_key}",
+            'Content-Type' => 'application/json',
+            'Anthropic-Version' => '2023-06-01'
+          }
+        )
+      end
+
+      def make_streaming_request(endpoint, payload, &on_token)
+        Security::SecureHTTPClient.make_streaming_request(
+          "#{ANTHROPIC_API_BASE}/#{endpoint}",
+          method: 'POST',
+          body: payload.to_json,
+          headers: {
+            'Authorization' => "Bearer #{@api_key}",
+            'Content-Type' => 'application/json',
+            'Anthropic-Version' => '2023-06-01'
+          }
+        ) do |chunk|
+          parse_streaming_chunk(chunk, &on_token)
+        end
+      end
+
+      def parse_streaming_chunk(chunk, &on_token)
+        return if chunk.strip.empty?
+        
+        chunk.split("\n").each do |line|
+          next unless line.start_with?("data: ")
+          
+          data = line[6..-1]
+          next if data == "[DONE]"
+          
+          begin
+            parsed = JSON.parse(data)
+            content = parsed.dig("delta", "text")
+            on_token.call(content) if content
+          rescue JSON::ParserError
+            # Skip invalid JSON
+          end
+        end
+      end
+
+      def prepare_image_securely(image)
+        if image.is_a?(String)
+          if image.start_with?("data:image/")
+            # Validate base64 data
+            Security::InputValidator.validate_base64_data(image, expected_type: :image)
+            # Extract base64 data
+            image.split(",")[1]
+          elsif image.start_with?("http")
+            # Validate URL
+            Security::InputValidator.validate_url(image)
+            convert_url_to_base64_securely(image)
+          else
+            # Validate file path
+            Security::InputValidator.validate_file_path(image)
+            convert_file_to_base64_securely(image)
+          end
+        else
+          # File object - convert to base64
+          convert_file_to_base64_securely(image)
+        end
+      end
+
+      def convert_url_to_base64_securely(url)
+        response = Security::SecureHTTPClient.make_request(url, method: 'GET')
+        Base64.strict_encode64(response.body)
+      end
+
+      def convert_file_to_base64_securely(file_path)
+        file_content = Security::SecureFileHandler.safe_file_read(file_path)
+        Base64.strict_encode64(file_content)
+      end
+    end
+  end
+end

data/lib/rails_ai/providers/secure_openai_adapter.rb

@@ -0,0 +1,284 @@
+# frozen_string_literal: true
+
+require "net/http"
+require "json"
+require "base64"
+require_relative "../security"
+
+module RailsAi
+  module Providers
+    class SecureOpenAIAdapter < Base
+      OPENAI_API_BASE = "https://api.openai.com/v1"
+      
+      def initialize
+        @api_key = ENV.fetch("OPENAI_API_KEY")
+        @rate_limiter = Security::RateLimiter.new(limit: 100, window: 3600)
+        super
+      end
+
+      def chat!(messages:, model:, **opts)
+        return "(stubbed) #{messages.last[:content]}" if RailsAi.config.stub_responses
+        
+        # Security validations
+        Security::InputValidator.validate_messages(messages)
+        
+        # Rate limiting
+        @rate_limiter.check_limit("chat_#{RailsAi::Context.user_id}")
+        
+        # Sanitize content
+        sanitized_messages = messages.map do |message|
+          {
+            role: message[:role],
+            content: Security::ContentSanitizer.sanitize_content(message[:content])
+          }
+        end
+        
+        response = make_request(
+          "chat/completions",
+          {
+            model: model,
+            messages: sanitized_messages,
+            max_tokens: opts[:max_tokens] || RailsAi.config.token_limit,
+            temperature: opts[:temperature] || 0.7,
+            top_p: opts[:top_p] || 1.0,
+            frequency_penalty: opts[:frequency_penalty] || 0.0,
+            presence_penalty: opts[:presence_penalty] || 0.0,
+            **opts.except(:max_tokens, :temperature, :top_p, :frequency_penalty, :presence_penalty)
+          }
+        )
+        
+        response.dig("choices", 0, "message", "content")
+      end
+
+      def stream_chat!(messages:, model:, **opts, &on_token)
+        return on_token.call("(stubbed stream)") if RailsAi.config.stub_responses
+        
+        # Security validations
+        Security::InputValidator.validate_messages(messages)
+        
+        # Rate limiting
+        @rate_limiter.check_limit("stream_#{RailsAi::Context.user_id}")
+        
+        # Sanitize content
+        sanitized_messages = messages.map do |message|
+          {
+            role: message[:role],
+            content: Security::ContentSanitizer.sanitize_content(message[:content])
+          }
+        end
+        
+        make_streaming_request(
+          "chat/completions",
+          {
+            model: model,
+            messages: sanitized_messages,
+            max_tokens: opts[:max_tokens] || RailsAi.config.token_limit,
+            temperature: opts[:temperature] || 0.7,
+            top_p: opts[:top_p] || 1.0,
+            frequency_penalty: opts[:frequency_penalty] || 0.0,
+            presence_penalty: opts[:presence_penalty] || 0.0,
+            stream: true,
+            **opts.except(:max_tokens, :temperature, :top_p, :frequency_penalty, :presence_penalty, :stream)
+          },
+          &on_token
+        )
+      end
+
+      def generate_image!(prompt:, model: "dall-e-3", size: "1024x1024", quality: "standard", **opts)
+        return "(stubbed image)" if RailsAi.config.stub_responses
+        
+        # Security validations
+        Security::InputValidator.validate_text_input(prompt, max_length: 1000)
+        
+        # Rate limiting
+        @rate_limiter.check_limit("image_#{RailsAi::Context.user_id}")
+        
+        # Sanitize prompt
+        sanitized_prompt = Security::ContentSanitizer.sanitize_content(prompt)
+        
+        response = make_request(
+          "images/generations",
+          {
+            model: model,
+            prompt: sanitized_prompt,
+            size: size,
+            quality: quality,
+            n: opts[:n] || 1,
+            **opts.except(:n)
+          }
+        )
+        
+        response.dig("data", 0, "url")
+      end
+
+      def analyze_image!(image:, prompt:, model: "gpt-4o", **opts)
+        return "(stubbed analysis)" if RailsAi.config.stub_responses
+        
+        # Security validations
+        Security::InputValidator.validate_text_input(prompt, max_length: 1000)
+        
+        # Rate limiting
+        @rate_limiter.check_limit("vision_#{RailsAi::Context.user_id}")
+        
+        # Sanitize prompt
+        sanitized_prompt = Security::ContentSanitizer.sanitize_content(prompt)
+        
+        # Prepare image securely
+        image_data = prepare_image_securely(image)
+        
+        response = make_request(
+          "chat/completions",
+          {
+            model: model,
+            messages: [
+              {
+                role: "user",
+                content: [
+                  {
+                    type: "text",
+                    text: sanitized_prompt
+                  },
+                  {
+                    type: "image_url",
+                    image_url: {
+                      url: image_data
+                    }
+                  }
+                ]
+              }
+            ],
+            max_tokens: opts[:max_tokens] || 1000,
+            **opts.except(:max_tokens)
+          }
+        )
+        
+        response.dig("choices", 0, "message", "content")
+      end
+
+      private
+
+      def make_request(endpoint, payload)
+        uri = URI("#{OPENAI_API_BASE}/#{endpoint}")
+        
+        http = Net::HTTP.new(uri.host, uri.port)
+        http.use_ssl = true
+        http.read_timeout = 30
+        http.open_timeout = 10
+        
+        request = Net::HTTP::Post.new(uri)
+        request["Authorization"] = "Bearer #{@api_key}"
+        request["Content-Type"] = "application/json"
+        request.body = payload.to_json
+        
+        response = http.request(request)
+        
+        case response.code.to_i
+        when 200..299
+          JSON.parse(response.body)
+        when 429
+          raise Security::RateLimitError, "OpenAI API rate limit exceeded"
+        when 401
+          raise Security::SecurityError, "Invalid API key"
+        when 403
+          raise Security::SecurityError, "API access forbidden"
+        else
+          raise Security::SecurityError, "API request failed: #{response.code} #{response.message}"
+        end
+      end
+
+      def make_streaming_request(endpoint, payload, &on_token)
+        uri = URI("#{OPENAI_API_BASE}/#{endpoint}")
+        
+        http = Net::HTTP.new(uri.host, uri.port)
+        http.use_ssl = true
+        http.read_timeout = 60
+        http.open_timeout = 10
+        
+        request = Net::HTTP::Post.new(uri)
+        request["Authorization"] = "Bearer #{@api_key}"
+        request["Content-Type"] = "application/json"
+        request.body = payload.to_json
+        
+        http.request(request) do |response|
+          case response.code.to_i
+          when 200..299
+            response.read_body do |chunk|
+              next if chunk.strip.empty?
+              
+              chunk.split("\n").each do |line|
+                next unless line.start_with?("data: ")
+                
+                data = line[6..-1]
+                next if data == "[DONE]"
+                
+                begin
+                  parsed = JSON.parse(data)
+                  content = parsed.dig("choices", 0, "delta", "content")
+                  on_token.call(content) if content
+                rescue JSON::ParserError
+                  # Skip invalid JSON
+                end
+              end
+            end
+          when 429
+            raise Security::RateLimitError, "OpenAI API rate limit exceeded"
+          when 401
+            raise Security::SecurityError, "Invalid API key"
+          when 403
+            raise Security::SecurityError, "API access forbidden"
+          else
+            raise Security::SecurityError, "API request failed: #{response.code} #{response.message}"
+          end
+        end
+      end
+
+      def prepare_image_securely(image)
+        if image.is_a?(String)
+          if image.start_with?("data:image/")
+            # Validate base64 data
+            Security::InputValidator.validate_base64_data(image, expected_type: :image)
+            image
+          elsif image.start_with?("http")
+            # Validate URL
+            Security::InputValidator.validate_url(image)
+            convert_url_to_base64_securely(image)
+          else
+            # Validate file path
+            Security::InputValidator.validate_file_path(image)
+            convert_file_to_base64_securely(image)
+          end
+        else
+          # File object - convert to base64
+          convert_file_to_base64_securely(image)
+        end
+      end
+
+      def convert_url_to_base64_securely(url)
+        uri = URI(url)
+        
+        http = Net::HTTP.new(uri.host, uri.port)
+        http.use_ssl = true
+        http.read_timeout = 30
+        http.open_timeout = 10
+        
+        request = Net::HTTP::Get.new(uri)
+        request["User-Agent"] = "RailsAI/1.0"
+        
+        response = http.request(request)
+        
+        if response.code == "200"
+          base64_data = Base64.strict_encode64(response.body)
+          "data:image/png;base64,#{base64_data}"
+        else
+          raise Security::SecurityError, "Failed to fetch image from URL: #{response.code}"
+        end
+      end
+
+      def convert_file_to_base64_securely(file_path)
+        file_content = Security::SecureFileHandler.safe_file_read(file_path)
+        base64_data = Base64.strict_encode64(file_content)
+        "data:image/png;base64,#{base64_data}"
+      end
+    end
+  end
+end

data/lib/rails_ai/railtie.rb

@@ -0,0 +1,48 @@
+# frozen_string_literal: true
+
+module RailsAi
+  class Railtie < ::Rails::Railtie
+    config.rails_ai = ActiveSupport::OrderedOptions.new
+
+    # Rails version compatibility
+    if Rails.version >= "8.0"
+      # Rails 8 specific configuration
+      initializer "rails_ai.configure", before: :load_config_initializers do |app|
+        RailsAi.configure do |c|
+          c.provider ||= app.config.rails_ai.provider || :openai
+          c.default_model ||= app.config.rails_ai.default_model || "gpt-4o-mini"
+          c.token_limit ||= app.config.rails_ai.token_limit || 4000
+          c.cache_ttl ||= app.config.rails_ai.cache_ttl || 1.hour
+          c.stub_responses ||= app.config.rails_ai.stub_responses || false
+        end
+      end
+    elsif Rails.version >= "7.0"
+      # Rails 7 specific configuration
+      initializer "rails_ai.configure", before: :load_config_initializers do |app|
+        RailsAi.configure do |c|
+          c.provider ||= app.config.rails_ai.provider || :openai
+          c.default_model ||= app.config.rails_ai.default_model || "gpt-4o-mini"
+          c.token_limit ||= app.config.rails_ai.token_limit || 4000
+          c.cache_ttl ||= app.config.rails_ai.cache_ttl || 1.hour
+          c.stub_responses ||= app.config.rails_ai.stub_responses || false
+        end
+      end
+    else
+      # Rails 5.2+ and 6.x configuration
+      initializer "rails_ai.configure" do |app|
+        RailsAi.configure do |c|
+          c.provider ||= app.config.rails_ai.provider || :openai
+          c.default_model ||= app.config.rails_ai.default_model || "gpt-4o-mini"
+          c.token_limit ||= app.config.rails_ai.token_limit || 4000
+          c.cache_ttl ||= app.config.rails_ai.cache_ttl || 1.hour
+          c.stub_responses ||= app.config.rails_ai.stub_responses || false
+        end
+      end
+    end
+
+    # Common configuration for all Rails versions
+    initializer "rails_ai.logger" do
+      Rails.logger.info "Rails AI #{RailsAi::VERSION} loaded for Rails #{Rails.version}"
+    end
+  end
+end

data/lib/rails_ai/redactor.rb

@@ -0,0 +1,12 @@
+# frozen_string_literal: true
+
+module RailsAi
+  module Redactor
+    EMAIL = /\b[A-Z0-9._%+-]+@[A-Z0-9.-]+\.[A-Z]{2,}\b/i
+    PHONE = /\+?\d[\d\s().-]{7,}\d/
+
+    def self.call(text)
+      text.to_s.gsub(EMAIL, "[email]").gsub(PHONE, "[phone]")
+    end
+  end
+end

data/lib/rails_ai/security/api_key_manager.rb

@@ -0,0 +1,82 @@
+# frozen_string_literal: true
+
+require 'openssl'
+require 'securerandom'
+
+module RailsAi
+  module Security
+    class APIKeyManager
+      def self.encrypt_key(key)
+        return nil if key.nil? || key.empty?
+        
+        cipher = OpenSSL::Cipher.new('AES-256-GCM')
+        cipher.encrypt
+        cipher.key = derive_key
+        cipher.iv = SecureRandom.random_bytes(12)
+        
+        encrypted = cipher.update(key) + cipher.final
+        auth_tag = cipher.auth_tag
+        
+        Base64.strict_encode64({
+          data: Base64.strict_encode64(encrypted),
+          iv: Base64.strict_encode64(cipher.iv),
+          auth_tag: Base64.strict_encode64(auth_tag)
+        }.to_json)
+      end
+
+      def self.decrypt_key(encrypted_key)
+        return nil if encrypted_key.nil? || encrypted_key.empty?
+        
+        begin
+          key_data = JSON.parse(Base64.strict_decode64(encrypted_key))
+          
+          cipher = OpenSSL::Cipher.new('AES-256-GCM')
+          cipher.decrypt
+          cipher.key = derive_key
+          cipher.iv = Base64.strict_decode64(key_data['iv'])
+          cipher.auth_tag = Base64.strict_decode64(key_data['auth_tag'])
+          
+          encrypted_data = Base64.strict_decode64(key_data['data'])
+          cipher.update(encrypted_data) + cipher.final
+        rescue => e
+          raise SecurityError, "Failed to decrypt API key: #{e.message}"
+        end
+      end
+
+      def self.mask_key(key)
+        return nil if key.nil? || key.empty?
+        return "***" if key.length < 8
+        
+        "#{key[0..3]}***#{key[-4..-1]}"
+      end
+
+      def self.secure_fetch(env_var, required: true)
+        key = ENV[env_var]
+        
+        if key.nil? || key.empty?
+          if required
+            raise SecurityError, "Required environment variable #{env_var} is not set"
+          else
+            return nil
+          end
+        end
+        
+        # Check if key is already encrypted
+        if key.start_with?('{') && key.include?('"data"')
+          decrypt_key(key)
+        else
+          key
+        end
+      end
+
+      private
+
+      def self.derive_key
+        secret = ENV['RAILS_AI_SECRET'] || Rails.application&.secret_key_base || 'default_secret'
+        salt = ENV['RAILS_AI_SALT'] || 'rails_ai_default_salt'
+        
+        OpenSSL::PKCS5.pbkdf2_hmac_sha256(secret, salt, 100000, 32)
+      end
+    end
+  end
+end

data/lib/rails_ai/security/audit_logger.rb

@@ -0,0 +1,46 @@
+# frozen_string_literal: true
+
+module RailsAi
+  module Security
+    class AuditLogger
+      def self.log_security_event(event_type, details = {})
+        return unless defined?(Rails) && Rails.logger
+        
+        log_entry = {
+          timestamp: Time.now.iso8601,
+          event_type: event_type,
+          details: details,
+          user_id: RailsAi::Context.user_id,
+          request_id: RailsAi::Context.request_id
+        }
+        
+        Rails.logger.info("[SECURITY] #{log_entry.to_json}")
+      end
+
+      def self.log_api_call(endpoint, user_id, success: true)
+        log_security_event(:api_call, {
+          endpoint: endpoint,
+          user_id: user_id,
+          success: success,
+          timestamp: Time.now
+        })
+      end
+
+      def self.log_validation_error(error_type, details)
+        log_security_event(:validation_error, {
+          error_type: error_type,
+          details: details,
+          timestamp: Time.now
+        })
+      end
+
+      def self.log_rate_limit_exceeded(identifier, limit)
+        log_security_event(:rate_limit_exceeded, {
+          identifier: identifier,
+          limit: limit,
+          timestamp: Time.now
+        })
+      end
+    end
+  end
+end