@aigentic/ruflo 3.7.0-alpha.69

package/src/ruvocal/src/routes/conversation/[id]/message/[messageId]/prompt/+server.ts

@@ -0,0 +1,66 @@
+import { buildPrompt } from "$lib/buildPrompt";
+import { authCondition } from "$lib/server/auth";
+import { collections } from "$lib/server/database";
+import { models } from "$lib/server/models";
+import { buildSubtree } from "$lib/utils/tree/buildSubtree";
+import { isMessageId } from "$lib/utils/tree/isMessageId";
+import { error } from "@sveltejs/kit";
+import { ObjectId } from "mongodb";
+
+export async function GET({ params, locals }) {
+	const conv =
+		params.id.length === 7
+			? await collections.sharedConversations.findOne({
+					_id: params.id,
+				})
+			: await collections.conversations.findOne({
+					_id: new ObjectId(params.id),
+					...authCondition(locals),
+				});
+
+	if (conv === null) {
+		error(404, "Conversation not found");
+	}
+
+	const messageId = params.messageId;
+
+	const messageIndex = conv.messages.findIndex((msg) => msg.id === messageId);
+
+	if (!isMessageId(messageId) || messageIndex === -1) {
+		error(404, "Message not found");
+	}
+
+	const model = models.find((m) => m.id === conv.model);
+
+	if (!model) {
+		error(404, "Conversation model not found");
+	}
+
+	const messagesUpTo = buildSubtree(conv, messageId);
+
+	const prompt = await buildPrompt({
+		preprompt: conv.preprompt,
+		messages: messagesUpTo,
+		model,
+	}).catch((err) => {
+		console.error(err);
+		return "Prompt generation failed";
+	});
+
+	return Response.json({
+		prompt,
+		model: model.name,
+		parameters: {
+			...model.parameters,
+			return_full_text: false,
+		},
+		messages: messagesUpTo.map((msg) => ({
+			role: msg.from,
+			content: msg.content,
+			createdAt: msg.createdAt,
+			updatedAt: msg.updatedAt,
+			updates: msg.updates?.filter((u) => u.type === "title"),
+			files: msg.files,
+		})),
+	});
+}

package/src/ruvocal/src/routes/conversation/[id]/share/+server.ts

@@ -0,0 +1,69 @@
+import { authCondition } from "$lib/server/auth";
+import { collections } from "$lib/server/database";
+import type { SharedConversation } from "$lib/types/SharedConversation";
+import { hashConv } from "$lib/utils/hashConv";
+import { error } from "@sveltejs/kit";
+import { ObjectId } from "mongodb";
+import { nanoid } from "nanoid";
+
+export async function POST({ params, locals }) {
+	const conversation = await collections.conversations.findOne({
+		_id: new ObjectId(params.id),
+		...authCondition(locals),
+	});
+
+	if (!conversation) {
+		error(404, "Conversation not found");
+	}
+
+	const hash = await hashConv(conversation);
+
+	const existingShare = await collections.sharedConversations.findOne({ hash });
+
+	if (existingShare) {
+		return new Response(
+			JSON.stringify({
+				shareId: existingShare._id,
+			}),
+			{ headers: { "Content-Type": "application/json" } }
+		);
+	}
+
+	const shared: SharedConversation = {
+		_id: nanoid(7),
+		hash,
+		createdAt: new Date(),
+		updatedAt: new Date(),
+		rootMessageId: conversation.rootMessageId,
+		messages: conversation.messages,
+		title: conversation.title,
+		model: conversation.model,
+		preprompt: conversation.preprompt,
+	};
+
+	await collections.sharedConversations.insertOne(shared);
+
+	// copy files from `${conversation._id}-` to `${shared._id}-`
+	const files = await collections.bucket
+		.find({ filename: { $regex: `^${conversation._id}-` } })
+		.toArray();
+
+	await Promise.all(
+		files.map(async (file) => {
+			const newFilename = file.filename.replace(`${conversation._id}-`, `${shared._id}-`);
+			// copy files from `${conversation._id}-` to `${shared._id}-` by downloading and reuploaidng
+			const downloadStream = collections.bucket.openDownloadStream(file._id);
+			const uploadStream = collections.bucket.openUploadStream(newFilename, {
+				metadata: { ...file.metadata, conversation: shared._id.toString() },
+			});
+			downloadStream.pipe(uploadStream);
+		})
+	);
+
+	return new Response(
+		JSON.stringify({
+			shareId: shared._id,
+		}),
+		{ headers: { "Content-Type": "application/json" } }
+	);
+}

package/src/ruvocal/src/routes/conversation/[id]/stop-generating/+server.ts

@@ -0,0 +1,35 @@
+import { authCondition } from "$lib/server/auth";
+import { collections } from "$lib/server/database";
+import { AbortRegistry } from "$lib/server/abortRegistry";
+import { error } from "@sveltejs/kit";
+import { ObjectId } from "mongodb";
+
+/**
+ * Ideally, we'd be able to detect the client-side abort, see https://github.com/huggingface/chat-ui/pull/88#issuecomment-1523173850
+ */
+export async function POST({ params, locals }) {
+	if (!locals.user && !locals.sessionId) {
+		error(401, "Unauthorized");
+	}
+
+	const conversationId = new ObjectId(params.id);
+
+	const conversation = await collections.conversations.findOne({
+		_id: conversationId,
+		...authCondition(locals),
+	});
+
+	if (!conversation) {
+		error(404, "Conversation not found");
+	}
+
+	AbortRegistry.getInstance().abort(conversationId.toString());
+
+	await collections.abortedGenerations.updateOne(
+		{ conversationId },
+		{ $set: { updatedAt: new Date() }, $setOnInsert: { createdAt: new Date() } },
+		{ upsert: true }
+	);
+
+	return new Response();
+}

package/src/ruvocal/src/routes/healthcheck/+server.ts

@@ -0,0 +1,3 @@
+export async function GET() {
+	return new Response("OK", { status: 200 });
+}

package/src/ruvocal/src/routes/login/+server.ts

@@ -0,0 +1,5 @@
+import { triggerOauthFlow } from "$lib/server/auth";
+
+export async function GET(event) {
+	return await triggerOauthFlow(event);
+}

package/src/ruvocal/src/routes/login/callback/+server.ts

@@ -0,0 +1,103 @@
+import { error, redirect } from "@sveltejs/kit";
+import { getOIDCUserData, validateAndParseCsrfToken } from "$lib/server/auth";
+import { z } from "zod";
+import { base } from "$app/paths";
+import { config } from "$lib/server/config";
+import JSON5 from "json5";
+import { updateUser } from "./updateUser.js";
+
+const sanitizeJSONEnv = (val: string, fallback: string) => {
+	const raw = (val ?? "").trim();
+	const unquoted = raw.startsWith("`") && raw.endsWith("`") ? raw.slice(1, -1) : raw;
+	return unquoted || fallback;
+};
+
+const allowedUserEmails = z
+	.array(z.string().email())
+	.optional()
+	.default([])
+	.parse(JSON5.parse(sanitizeJSONEnv(config.ALLOWED_USER_EMAILS, "[]")));
+
+const allowedUserDomains = z
+	.array(z.string().regex(/\.\w+$/)) // Contains at least a dot
+	.optional()
+	.default([])
+	.parse(JSON5.parse(sanitizeJSONEnv(config.ALLOWED_USER_DOMAINS, "[]")));
+
+export async function GET({ url, locals, cookies, request, getClientAddress }) {
+	const { error: errorName, error_description: errorDescription } = z
+		.object({
+			error: z.string().optional(),
+			error_description: z.string().optional(),
+		})
+		.parse(Object.fromEntries(url.searchParams.entries()));
+
+	if (errorName) {
+		throw error(400, errorName + (errorDescription ? ": " + errorDescription : ""));
+	}
+
+	const { code, state, iss } = z
+		.object({
+			code: z.string(),
+			state: z.string(),
+			iss: z.string().optional(),
+		})
+		.parse(Object.fromEntries(url.searchParams.entries()));
+
+	const csrfToken = Buffer.from(state, "base64").toString("utf-8");
+
+	const validatedToken = await validateAndParseCsrfToken(csrfToken, locals.sessionId);
+
+	if (!validatedToken) {
+		throw error(403, "Invalid or expired CSRF token");
+	}
+
+	const codeVerifier = cookies.get("hfChat-codeVerifier");
+	if (!codeVerifier) {
+		throw error(403, "Code verifier cookie not found");
+	}
+
+	const { userData, token } = await getOIDCUserData(
+		{ redirectURI: validatedToken.redirectUrl },
+		code,
+		codeVerifier,
+		iss,
+		url
+	);
+
+	// Filter by allowed user emails or domains
+	if (allowedUserEmails.length > 0 || allowedUserDomains.length > 0) {
+		if (!userData.email) {
+			throw error(403, "User not allowed: email not returned");
+		}
+		const emailVerified = userData.email_verified ?? true;
+		if (!emailVerified) {
+			throw error(403, "User not allowed: email not verified");
+		}
+
+		const emailDomain = userData.email.split("@")[1];
+		const isEmailAllowed = allowedUserEmails.includes(userData.email);
+		const isDomainAllowed = allowedUserDomains.includes(emailDomain);
+
+		if (!isEmailAllowed && !isDomainAllowed) {
+			throw error(403, "User not allowed");
+		}
+	}
+
+	await updateUser({
+		userData,
+		token,
+		locals,
+		cookies,
+		userAgent: request.headers.get("user-agent") ?? undefined,
+		ip: getClientAddress(),
+	});
+
+	// Prefer returning the user to their original in-app path when provided.
+	// `validatedToken.next` is sanitized server-side to avoid protocol-relative redirects.
+	const next = validatedToken.next;
+	if (next) {
+		return redirect(302, next);
+	}
+	return redirect(302, `${base}/`);
+}

package/src/ruvocal/src/routes/login/callback/updateUser.spec.ts

@@ -0,0 +1,157 @@
+import { assert, it, describe, afterEach, vi, expect } from "vitest";
+import type { Cookies } from "@sveltejs/kit";
+import { collections } from "$lib/server/database";
+import { updateUser } from "./updateUser";
+import { ObjectId } from "mongodb";
+import { DEFAULT_SETTINGS } from "$lib/types/Settings";
+import { defaultModel } from "$lib/server/models";
+import { findUser } from "$lib/server/auth";
+import type { TokenSet } from "openid-client";
+
+const userData = {
+	preferred_username: "new-username",
+	name: "name",
+	picture: "https://example.com/avatar.png",
+	sub: "1234567890",
+};
+Object.freeze(userData);
+
+const locals = {
+	userId: "1234567890",
+	sessionId: "1234567890",
+	isAdmin: false,
+};
+
+const token = {
+	access_token: "access_token",
+	refresh_token: "refresh_token",
+	expires_at: Math.floor(Date.now() / 1000) + 3600, // Expires 1 hour from now
+	expires_in: 3600,
+} as TokenSet;
+
+// @ts-expect-error SvelteKit cookies dumb mock
+const cookiesMock: Cookies = {
+	set: vi.fn(),
+};
+
+const insertRandomUser = async () => {
+	const res = await collections.users.insertOne({
+		_id: new ObjectId(),
+		createdAt: new Date(),
+		updatedAt: new Date(),
+		username: "base-username",
+		name: userData.name,
+		avatarUrl: userData.picture,
+		hfUserId: userData.sub,
+	});
+
+	return res.insertedId;
+};
+
+const insertRandomConversations = async (count: number) => {
+	const res = await collections.conversations.insertMany(
+		new Array(count).fill(0).map(() => ({
+			_id: new ObjectId(),
+			title: "random title",
+			messages: [],
+			model: defaultModel.id,
+			// embedding model removed in this build
+			createdAt: new Date(),
+			updatedAt: new Date(),
+			sessionId: locals.sessionId,
+		}))
+	);
+
+	return res.insertedIds;
+};
+
+describe("login", () => {
+	it("should update user if existing", async () => {
+		await insertRandomUser();
+
+		await updateUser({ userData, locals, cookies: cookiesMock, token });
+
+		const existingUser = await collections.users.findOne({ hfUserId: userData.sub });
+
+		assert.equal(existingUser?.name, userData.name);
+
+		expect(cookiesMock.set).toBeCalledTimes(1);
+	}, 30000);
+
+	it("should migrate pre-existing conversations for new user", async () => {
+		const insertedId = await insertRandomUser();
+
+		await insertRandomConversations(2);
+
+		await updateUser({ userData, locals, cookies: cookiesMock, token });
+
+		const conversationCount = await collections.conversations.countDocuments({
+			userId: insertedId,
+			sessionId: { $exists: false },
+		});
+
+		assert.equal(conversationCount, 2);
+
+		await collections.conversations.deleteMany({ userId: insertedId });
+	});
+
+	it("should create default settings for new user", async () => {
+		await updateUser({ userData, locals, cookies: cookiesMock, token });
+
+		// updateUser creates a new sessionId, so we need to use the updated value
+		const user = (await findUser(locals.sessionId, undefined, new URL("http://localhost"))).user;
+
+		assert.exists(user);
+
+		const settings = await collections.settings.findOne({ userId: user?._id });
+
+		expect(settings).toMatchObject({
+			userId: user?._id,
+			updatedAt: expect.any(Date),
+			createdAt: expect.any(Date),
+			...DEFAULT_SETTINGS,
+		});
+
+		await collections.settings.deleteOne({ userId: user?._id });
+	});
+
+	it("should migrate pre-existing settings for pre-existing user", async () => {
+		const { insertedId } = await collections.settings.insertOne({
+			sessionId: locals.sessionId,
+			updatedAt: new Date(),
+			createdAt: new Date(),
+			...DEFAULT_SETTINGS,
+			shareConversationsWithModelAuthors: false,
+		});
+
+		await updateUser({ userData, locals, cookies: cookiesMock, token });
+
+		const settings = await collections.settings.findOne({
+			_id: insertedId,
+			sessionId: { $exists: false },
+		});
+
+		assert.exists(settings);
+
+		const user = await collections.users.findOne({ hfUserId: userData.sub });
+
+		expect(settings).toMatchObject({
+			userId: user?._id,
+			updatedAt: expect.any(Date),
+			createdAt: expect.any(Date),
+			...DEFAULT_SETTINGS,
+			shareConversationsWithModelAuthors: false,
+		});
+
+		await collections.settings.deleteOne({ userId: user?._id });
+	});
+});
+
+afterEach(async () => {
+	await collections.users.deleteMany({ hfUserId: userData.sub });
+	await collections.sessions.deleteMany({});
+
+	locals.userId = "1234567890";
+	locals.sessionId = "1234567890";
+	vi.clearAllMocks();
+});

package/src/ruvocal/src/routes/login/callback/updateUser.ts

@@ -0,0 +1,215 @@
+import {
+	getCoupledCookieHash,
+	refreshSessionCookie,
+	tokenSetToSessionOauth,
+} from "$lib/server/auth";
+import { collections } from "$lib/server/database";
+import { ObjectId } from "mongodb";
+import { DEFAULT_SETTINGS } from "$lib/types/Settings";
+import { z } from "zod";
+import type { UserinfoResponse, TokenSet } from "openid-client";
+import { error, type Cookies } from "@sveltejs/kit";
+import crypto from "crypto";
+import { sha256 } from "$lib/utils/sha256";
+import { addWeeks } from "date-fns";
+import { OIDConfig } from "$lib/server/auth";
+import { config } from "$lib/server/config";
+import { logger } from "$lib/server/logger";
+
+export async function updateUser(params: {
+	userData: UserinfoResponse;
+	token: TokenSet;
+	locals: App.Locals;
+	cookies: Cookies;
+	userAgent?: string;
+	ip?: string;
+}) {
+	const { userData, token, locals, cookies, userAgent, ip } = params;
+
+	// Microsoft Entra v1 tokens do not provide preferred_username, instead the username is provided in the upn
+	// claim. See https://learn.microsoft.com/en-us/entra/identity-platform/access-token-claims-reference
+	if (!userData.preferred_username && userData.upn) {
+		userData.preferred_username = userData.upn as string;
+	}
+
+	const {
+		preferred_username: username,
+		name,
+		email,
+		picture: avatarUrl,
+		sub: hfUserId,
+		orgs,
+	} = z
+		.object({
+			preferred_username: z.string().optional(),
+			name: z.string(),
+			picture: z.string().optional(),
+			sub: z.string(),
+			email: z.string().email().optional(),
+			orgs: z
+				.array(
+					z.object({
+						sub: z.string(),
+						name: z.string(),
+						picture: z.string(),
+						preferred_username: z.string(),
+						plan: z.string().optional(),
+					})
+				)
+				.optional(),
+		})
+		.setKey(OIDConfig.NAME_CLAIM, z.string())
+		.refine((data) => data.preferred_username || data.email, {
+			message: "Either preferred_username or email must be provided by the provider.",
+		})
+		.transform((data) => ({
+			...data,
+			name: data[OIDConfig.NAME_CLAIM],
+		}))
+		.parse(userData) as {
+		preferred_username?: string;
+		email?: string;
+		picture?: string;
+		sub: string;
+		name: string;
+		orgs?: Array<{
+			sub: string;
+			name: string;
+			picture: string;
+			preferred_username: string;
+			plan?: string;
+		}>;
+	} & Record<string, string>;
+
+	// Dynamically access user data based on NAME_CLAIM from environment
+	// This approach allows us to adapt to different OIDC providers flexibly.
+
+	logger.info(
+		{
+			login_username: username,
+			login_name: name,
+			login_email: email,
+			login_orgs: orgs?.map((el) => el.sub),
+		},
+		"user login"
+	);
+	// if using huggingface as auth provider, check orgs for earl access and amin rights
+	const isAdmin =
+		(config.HF_ORG_ADMIN && orgs?.some((org) => org.sub === config.HF_ORG_ADMIN)) || false;
+	const isEarlyAccess =
+		(config.HF_ORG_EARLY_ACCESS && orgs?.some((org) => org.sub === config.HF_ORG_EARLY_ACCESS)) ||
+		false;
+
+	logger.debug(
+		{
+			isAdmin,
+			isEarlyAccess,
+			hfUserId,
+		},
+		`Updating user ${hfUserId}`
+	);
+
+	// check if user already exists
+	const existingUser = await collections.users.findOne({ hfUserId });
+	let userId = existingUser?._id;
+
+	// update session cookie on login
+	const previousSessionId = locals.sessionId;
+	const secretSessionId = crypto.randomUUID();
+	const sessionId = await sha256(secretSessionId);
+
+	if (await collections.sessions.findOne({ sessionId })) {
+		error(500, "Session ID collision");
+	}
+
+	locals.sessionId = sessionId;
+
+	// Get cookie hash if coupling is enabled
+	const coupledCookieHash = await getCoupledCookieHash(cookies);
+
+	// Prepare OAuth token data for session storage
+	const oauthData = tokenSetToSessionOauth(token);
+
+	if (existingUser) {
+		// update existing user if any
+		await collections.users.updateOne(
+			{ _id: existingUser._id },
+			{ $set: { username, name, avatarUrl, isAdmin, isEarlyAccess } }
+		);
+
+		// remove previous session if it exists and add new one
+		await collections.sessions.deleteOne({ sessionId: previousSessionId });
+		await collections.sessions.insertOne({
+			_id: new ObjectId(),
+			sessionId: locals.sessionId,
+			userId: existingUser._id,
+			createdAt: new Date(),
+			updatedAt: new Date(),
+			userAgent,
+			ip,
+			expiresAt: addWeeks(new Date(), 2),
+			...(coupledCookieHash ? { coupledCookieHash } : {}),
+			...(oauthData ? { oauth: oauthData } : {}),
+		});
+	} else {
+		// user doesn't exist yet, create a new one
+		const { insertedId } = await collections.users.insertOne({
+			_id: new ObjectId(),
+			createdAt: new Date(),
+			updatedAt: new Date(),
+			username,
+			name,
+			email,
+			avatarUrl,
+			hfUserId,
+			isAdmin,
+			isEarlyAccess,
+		});
+
+		userId = insertedId;
+
+		await collections.sessions.insertOne({
+			_id: new ObjectId(),
+			sessionId: locals.sessionId,
+			userId,
+			createdAt: new Date(),
+			updatedAt: new Date(),
+			userAgent,
+			ip,
+			expiresAt: addWeeks(new Date(), 2),
+			...(coupledCookieHash ? { coupledCookieHash } : {}),
+			...(oauthData ? { oauth: oauthData } : {}),
+		});
+
+		// move pre-existing settings to new user
+		const { matchedCount } = await collections.settings.updateOne(
+			{ sessionId: previousSessionId },
+			{
+				$set: { userId, updatedAt: new Date() },
+				$unset: { sessionId: "" },
+			}
+		);
+
+		if (!matchedCount) {
+			// if no settings found for user, create default settings
+			await collections.settings.insertOne({
+				userId,
+				updatedAt: new Date(),
+				createdAt: new Date(),
+				...DEFAULT_SETTINGS,
+			});
+		}
+	}
+
+	// refresh session cookie
+	refreshSessionCookie(cookies, secretSessionId);
+
+	// migrate pre-existing conversations
+	await collections.conversations.updateMany(
+		{ sessionId: previousSessionId },
+		{
+			$set: { userId },
+			$unset: { sessionId: "" },
+		}
+	);
+}

package/src/ruvocal/src/routes/logout/+server.ts

@@ -0,0 +1,18 @@
+import { dev } from "$app/environment";
+import { base } from "$app/paths";
+import { collections } from "$lib/server/database";
+import { redirect } from "@sveltejs/kit";
+import { config } from "$lib/server/config";
+
+export async function POST({ locals, cookies }) {
+	await collections.sessions.deleteOne({ sessionId: locals.sessionId });
+
+	cookies.delete(config.COOKIE_NAME, {
+		path: "/",
+		// So that it works inside the space's iframe
+		sameSite: dev || config.ALLOW_INSECURE_COOKIES === "true" ? "lax" : "none",
+		secure: !dev && !(config.ALLOW_INSECURE_COOKIES === "true"),
+		httpOnly: true,
+	});
+	return redirect(302, `${base}/`);
+}

package/src/ruvocal/src/routes/metrics/+server.ts

@@ -0,0 +1,18 @@
+import { config } from "$lib/server/config";
+import { MetricsServer } from "$lib/server/metrics";
+
+export async function GET() {
+	if (config.METRICS_ENABLED !== "true") {
+		return new Response("Not Found", { status: 404 });
+	}
+
+	const payload = await MetricsServer.getInstance().render();
+
+	return new Response(payload, {
+		status: 200,
+		headers: {
+			"Content-Type": "text/plain; version=0.0.4",
+			"Cache-Control": "no-store",
+		},
+	});
+}