@allbluecn/web-app 0.17.1 → 0.18.0

package/src/server/serverFns/design/ai/providers.ts

@@ -0,0 +1,566 @@
+// SPDX-License-Identifier: AGPL-3.0-or-later
+// AllBlue - 理想之海
+// Copyright (C) 2026 AllBlue Contributors
+//
+// This program is free software: you can redistribute it and/or modify
+// it under the terms of the GNU Affero General Public License as published by
+// the Free Software Foundation, either version 3 of the License, or
+// (at your option) any later version.
+//
+// This program is distributed in the hope that it will be useful,
+// but WITHOUT ANY WARRANTY; without even the implied warranty of
+// MERCHANTABILITY or FITNESS FOR A PARTICULAR PURPOSE. See the
+// GNU Affero General Public License for more details.
+//
+// You should have received a copy of the GNU Affero General Public License
+// along with this program. If not, see <https://www.gnu.org/licenses/>.
+
+// apps/web/src/server/serverFns/design/ai/providers.ts
+import { createServerFn } from "@tanstack/react-start"
+import { getRequest } from "@tanstack/react-start/server"
+import { z } from "zod"
+import { getPrisma } from "@allbluecn/database/get-prisma"
+import type { Prisma } from "@allbluecn/database"
+import type {
+  AiModelMeta,
+  AiProviderMeta,
+  ModelCapability,
+} from "@allbluecn/kernel"
+import { getServerSeam } from "@allbluecn/kernel"
+import { checkAiRateLimit } from "@/server/lib/rate-limit"
+import {
+  listVisibleProvidersForUser,
+  listEnabledModelsForUser,
+  checkProviderConnectivity,
+  fetchProviderModels,
+} from "@/server/ai-gateway"
+import { encryptApiKey, decryptApiKey } from "@/server/lib/api-key-cipher"
+
+const PLACEHOLDER_KEYS = new Set([
+  "sk-your-api-key-here",
+  "sk-or-your-api-key-here",
+  "",
+])
+
+function asCustomModels(raw: unknown): AiModelMeta[] {
+  return Array.isArray(raw) ? (raw as AiModelMeta[]) : []
+}
+
+/** Prisma Json 字段不接受强类型数组（缺 index signature），统一 cast */
+function toJson(value: unknown): Prisma.InputJsonValue {
+  return value as unknown as Prisma.InputJsonValue
+}
+
+function maskKey(key: string | null | undefined): string {
+  if (!key) return ""
+  if (key.length <= 8) return "****"
+  return `${key.slice(0, 3)}…${key.slice(-4)}`
+}
+
+function dbRowToMeta(provider: {
+  providerId: string
+  displayName: string
+  brandName: string
+  description: string
+  category: string
+  iconSlug: string | null
+  badge: string | null
+  brandColor: string
+  adapterKind: string
+  defaultBaseUrl: string | null
+  keyUrl: string | null
+  docsUrl: string | null
+  keyPlaceholder: string | null
+  isLocal: boolean
+  models: unknown
+}): AiProviderMeta {
+  return {
+    providerId: provider.providerId,
+    displayName: provider.displayName,
+    brandName: provider.brandName,
+    description: provider.description,
+    category: provider.category as AiProviderMeta["category"],
+    iconSlug: provider.iconSlug ?? "",
+    badge: provider.badge ?? undefined,
+    brandColor: provider.brandColor,
+    adapterKind: provider.adapterKind as AiProviderMeta["adapterKind"],
+    defaultBaseUrl: provider.defaultBaseUrl ?? undefined,
+    keyUrl: provider.keyUrl ?? undefined,
+    docsUrl: provider.docsUrl ?? undefined,
+    keyPlaceholder: provider.keyPlaceholder ?? undefined,
+    isLocal: provider.isLocal,
+    models: provider.models as unknown as AiProviderMeta["models"],
+  }
+}
+
+/** 列出当前用户可见的所有服务商（平台启用 ∪ 用户已配置） */
+export const listAiProvidersFn = createServerFn({ method: "GET" }).handler(
+  async () => {
+    const prisma = await getPrisma()
+    const request = getRequest()
+    const session = await getServerSeam().requireAuth(request)
+    const userId = session.user!.id!
+    return listVisibleProvidersForUser(userId)
+  },
+)
+
+/** 获取单个 provider 的元数据 + 用户配置 */
+export const getAiProviderFn = createServerFn({ method: "GET" })
+  .validator(z.object({ providerId: z.string() }))
+  .handler(async ({ data }) => {
+    const prisma = await getPrisma()
+    const request = getRequest()
+    const session = await getServerSeam().requireAuth(request)
+    const userId = session.user!.id!
+
+    const provider = await prisma.aiProvider.findUnique({
+      where: { providerId: data.providerId },
+    })
+    if (!provider) throw new Error(`未知的服务商：${data.providerId}`)
+
+    const cfg = await prisma.aiProviderConfig.findUnique({
+      where: {
+        userId_providerId: { userId, providerId: data.providerId },
+      },
+    })
+
+    return {
+      meta: dbRowToMeta(provider),
+      platformEnabled: provider.enabled,
+      config: cfg
+        ? {
+            apiKeyMasked: maskKey(decryptApiKey(cfg.apiKey)),
+            hasKey: !!cfg.apiKey,
+            baseUrl: cfg.baseUrl,
+            voiceApiKeyMasked: maskKey(decryptApiKey(cfg.voiceApiKey)),
+            hasVoiceKey: !!cfg.voiceApiKey,
+            voiceBaseUrl: cfg.voiceBaseUrl,
+            enabled: cfg.enabled,
+            models: Array.isArray(cfg.models) ? (cfg.models as string[]) : [],
+            customModels: asCustomModels(cfg.customModels),
+          }
+        : {
+            apiKeyMasked: "",
+            hasKey: false,
+            baseUrl: null,
+            voiceApiKeyMasked: "",
+            hasVoiceKey: false,
+            voiceBaseUrl: null,
+            enabled: false,
+            models: [],
+            customModels: [],
+          },
+    }
+  },
+)
+
+const modelMetaSchema = z.object({
+  id: z.string(),
+  displayName: z.string(),
+  contextWindow: z.number().optional(),
+  capabilities: z
+    .array(z.enum(["text", "vision", "tools", "reasoning", "audio"]))
+    .optional(),
+  defaultEnabled: z.boolean().optional(),
+  iconSlug: z.string().optional(),
+  releaseDate: z.string().optional(),
+  inputPrice: z.number().optional(),
+  outputPrice: z.number().optional(),
+  tags: z.array(z.string()).optional(),
+})
+
+const updateSchema = z.object({
+  providerId: z.string(),
+  apiKey: z.string().min(1).max(500).optional(),
+  baseUrl: z.string().url().or(z.literal("")).optional(),
+  voiceApiKey: z.string().max(500).optional(),
+  voiceBaseUrl: z.string().url().or(z.literal("")).optional(),
+  enabled: z.boolean().optional(),
+  models: z.array(z.string()).optional(),
+  customModels: z.array(modelMetaSchema).optional(),
+  clearKey: z.boolean().optional(),
+})
+
+export const updateAiProviderFn = createServerFn({ method: "POST" })
+  .validator(updateSchema)
+  .handler(async ({ data }) => {
+    const prisma = await getPrisma()
+    const request = getRequest()
+    const session = await getServerSeam().requireAuth(request)
+    const userId = session.user!.id!
+    await getServerSeam().requireUserInDb(userId)
+
+    const provider = await prisma.aiProvider.findUnique({
+      where: { providerId: data.providerId },
+      select: { providerId: true },
+    })
+    if (!provider) throw new Error(`未知的服务商：${data.providerId}`)
+
+    const update: {
+      apiKey?: string | null
+      baseUrl?: string | null
+      voiceApiKey?: string | null
+      voiceBaseUrl?: string | null
+      enabled?: boolean
+      models?: string[]
+      customModels?: Prisma.InputJsonValue
+    } = {}
+    if (data.clearKey) {
+      update.apiKey = null
+    } else if (data.apiKey !== undefined) {
+      const key = data.apiKey.trim()
+      if (PLACEHOLDER_KEYS.has(key)) {
+        throw new Error("API Key 无效：请填写真实 Key")
+      }
+      update.apiKey = encryptApiKey(key)
+    }
+    if (data.baseUrl !== undefined) update.baseUrl = data.baseUrl || null
+    if (data.voiceApiKey !== undefined) {
+      const vKey = data.voiceApiKey.trim()
+      if (vKey) {
+        if (PLACEHOLDER_KEYS.has(vKey)) {
+          throw new Error("Voice API Key 无效：请填写真实 Key")
+        }
+        update.voiceApiKey = encryptApiKey(vKey)
+      } else {
+        update.voiceApiKey = null
+      }
+    }
+    if (data.voiceBaseUrl !== undefined) update.voiceBaseUrl = data.voiceBaseUrl || null
+    if (data.enabled !== undefined) update.enabled = data.enabled
+    if (data.models !== undefined) update.models = data.models
+    if (data.customModels !== undefined)
+      update.customModels = toJson(data.customModels)
+
+    await prisma.aiProviderConfig.upsert({
+      where: {
+        userId_providerId: { userId, providerId: data.providerId },
+      },
+      create: { userId, providerId: data.providerId, ...update },
+      update,
+    })
+    return { success: true }
+  })
+
+export const deleteAiProviderConfigFn = createServerFn({ method: "POST" })
+  .validator(z.object({ providerId: z.string() }))
+  .handler(async ({ data }) => {
+    const prisma = await getPrisma()
+    const request = getRequest()
+    const session = await getServerSeam().requireAuth(request)
+    const userId = session.user!.id!
+    await prisma.aiProviderConfig.deleteMany({
+      where: { userId, providerId: data.providerId },
+    })
+    return { success: true }
+  })
+
+/**
+ * 从 provider API 获取可用模型列表，智能合并到用户 customModels：
+ * 已有（全局 models + 用户 customModels）的保留原元数据，新增的用默认值追加。
+ * 不删除现有模型（自定义或 API 限制都应保留）。
+ */
+export const refreshModelsFn = createServerFn({ method: "POST" })
+  .validator(z.object({ providerId: z.string() }))
+  .handler(async ({ data }) => {
+    const prisma = await getPrisma()
+    const request = getRequest()
+    const session = await getServerSeam().requireAuth(request)
+    const userId = session.user!.id!
+    await getServerSeam().requireUserInDb(userId)
+
+    const provider = await prisma.aiProvider.findUnique({
+      where: { providerId: data.providerId },
+      select: {
+        isLocal: true,
+        defaultBaseUrl: true,
+        models: true,
+        displayName: true,
+      },
+    })
+    if (!provider) throw new Error(`未知的服务商：${data.providerId}`)
+
+    const cfg = await prisma.aiProviderConfig.findUnique({
+      where: {
+        userId_providerId: { userId, providerId: data.providerId },
+      },
+      select: { apiKey: true, baseUrl: true, customModels: true },
+    })
+
+    // 本地 provider（ollama）无需 apiKey，其他必须有 key
+    const apiKey = decryptApiKey(cfg?.apiKey) ?? undefined
+    if (!provider.isLocal && !apiKey) {
+      return { success: false, message: "请先配置 API Key 再获取模型列表", added: 0 }
+    }
+    const baseUrl = cfg?.baseUrl || provider.defaultBaseUrl || ""
+    if (!baseUrl) {
+      return { success: false, message: "缺少 BaseURL，无法获取模型列表", added: 0 }
+    }
+
+    let remoteIds: string[]
+    try {
+      remoteIds = await fetchProviderModels(data.providerId, {
+        apiKey: apiKey ?? "",
+        baseUrl,
+      })
+    } catch (e) {
+      // 错误透传治理：上游错误细节（含远端响应体片段、守卫拒绝原因）只进服务端日志，
+      // 客户端收通用文案，避免借 BYOK baseUrl 探测内网后回读响应内容
+      console.error("[providers] 获取远程模型列表失败", {
+        providerId: data.providerId,
+        userId,
+        error: e,
+      })
+      return {
+        success: false,
+        message: "获取模型列表失败，请检查 API Key、BaseURL 与网络后重试",
+        added: 0,
+      }
+    }
+
+    // 现有模型 id 集合（全局 + 用户 customModels）
+    const globalIds = new Set(
+      Array.isArray(provider.models)
+        ? (provider.models as Array<{ id: string }>).map((m) => m.id)
+        : [],
+    )
+    const customModels = asCustomModels(cfg?.customModels)
+    const existingIds = new Set([...globalIds, ...customModels.map((m) => m.id)])
+
+    // 新增 = remote 中不在现有的
+    const added: AiModelMeta[] = remoteIds
+      .filter((id) => !existingIds.has(id))
+      .map((id) => ({
+        id,
+        displayName: id,
+        capabilities: ["text" as ModelCapability],
+        tags: ["API 获取"],
+      }))
+
+    if (added.length > 0) {
+      const merged = [...customModels, ...added]
+      await prisma.aiProviderConfig.upsert({
+        where: {
+          userId_providerId: { userId, providerId: data.providerId },
+        },
+        create: {
+          userId,
+          providerId: data.providerId,
+          customModels: toJson(merged),
+        },
+        update: { customModels: toJson(merged) },
+      })
+    }
+
+    return {
+      success: true,
+      message:
+        added.length > 0
+          ? `${provider.displayName} 新增 ${added.length} 个模型`
+          : `${provider.displayName} 模型列表已是最新`,
+      added: added.length,
+    }
+  })
+
+/** 创建自定义模型，追加到用户 customModels（id 重复则报错） */
+export const createCustomModelFn = createServerFn({ method: "POST" })
+  .validator(
+    z.object({ providerId: z.string(), model: modelMetaSchema }),
+  )
+  .handler(async ({ data }) => {
+    const prisma = await getPrisma()
+    const request = getRequest()
+    const session = await getServerSeam().requireAuth(request)
+    const userId = session.user!.id!
+    await getServerSeam().requireUserInDb(userId)
+
+    const provider = await prisma.aiProvider.findUnique({
+      where: { providerId: data.providerId },
+      select: { models: true },
+    })
+    if (!provider) throw new Error(`未知的服务商：${data.providerId}`)
+
+    // id 不能与全局 models 或现有 customModels 重复
+    const globalIds = new Set(
+      Array.isArray(provider.models)
+        ? (provider.models as Array<{ id: string }>).map((m) => m.id)
+        : [],
+    )
+    const cfg = await prisma.aiProviderConfig.findUnique({
+      where: {
+        userId_providerId: { userId, providerId: data.providerId },
+      },
+      select: { customModels: true },
+    })
+    const customModels = asCustomModels(cfg?.customModels)
+    const exists =
+      globalIds.has(data.model.id) ||
+      customModels.some((m) => m.id === data.model.id)
+    if (exists) {
+      return { success: false, message: `模型 ID「${data.model.id}」已存在` }
+    }
+
+    const merged: AiModelMeta[] = [
+      ...customModels,
+      {
+        ...data.model,
+        tags: ["自定义", ...(data.model.tags ?? [])],
+      },
+    ]
+    await prisma.aiProviderConfig.upsert({
+      where: {
+        userId_providerId: { userId, providerId: data.providerId },
+      },
+      create: {
+        userId,
+        providerId: data.providerId,
+        customModels: toJson(merged),
+      },
+      update: { customModels: toJson(merged) },
+    })
+    return { success: true, message: `已创建模型「${data.model.displayName}」` }
+  })
+
+/** 列出当前用户所有已启用 provider 的模型列表（聊天模型选择器用） */
+export const listEnabledModelsFn = createServerFn({ method: "GET" }).handler(
+  async () => {
+    const request = getRequest()
+    const session = await getServerSeam().requireAuth(request)
+    const userId = session.user!.id!
+    return listEnabledModelsForUser(userId)
+  },
+)
+
+/** 测试单个 provider 的 API Key 连通性（参考 lobehub：实际发起轻量级请求验证） */
+const testSchema = z.object({
+  providerId: z.string(),
+  apiKey: z.string().optional(),
+  baseUrl: z.string().url().or(z.literal("")).optional(),
+})
+
+export const testAiProviderFn = createServerFn({ method: "POST" })
+  .validator(testSchema)
+  .handler(async ({ data }) => {
+    const prisma = await getPrisma()
+    const request = getRequest()
+    const session = await getServerSeam().requireAuth(request)
+    const userId = session.user!.id!
+    await checkAiRateLimit(userId, "testProvider")
+
+    const provider = await prisma.aiProvider.findUnique({
+      where: { providerId: data.providerId },
+      select: { isLocal: true, models: true, defaultBaseUrl: true },
+    })
+    if (!provider) throw new Error(`未知的服务商：${data.providerId}`)
+    if (provider.isLocal) return { success: true, message: "本地部署无需校验" }
+
+    // 优先用本次传入的 apiKey；为空时从已保存配置兜底（用户未重新输入的场景）
+    let apiKey = data.apiKey
+    if (!apiKey) {
+      const cfg = await prisma.aiProviderConfig.findUnique({
+        where: {
+          userId_providerId: { userId, providerId: data.providerId },
+        },
+        select: { apiKey: true },
+      })
+      apiKey = decryptApiKey(cfg?.apiKey) ?? undefined
+    }
+    if (!apiKey) {
+      return { success: false, message: "请先填写 API Key" }
+    }
+
+    const baseUrl = data.baseUrl || provider.defaultBaseUrl || ""
+    if (!baseUrl) {
+      return { success: false, message: "缺少 BaseURL" }
+    }
+
+    const firstModel =
+      Array.isArray(provider.models) && provider.models.length > 0
+        ? (provider.models[0] as { id: string }).id
+        : "test"
+
+    return checkProviderConnectivity(data.providerId, {
+      apiKey,
+      baseUrl,
+      model: firstModel,
+    })
+  })
+
+/** 用户创建自定义 OpenAI 兼容服务商 */
+export const createCustomProviderFn = createServerFn({ method: "POST" })
+  .validator(
+    z.object({
+      displayName: z.string().min(1).max(64),
+      baseUrl: z.string().url(),
+      apiKey: z.string().min(1),
+      defaultModel: z.string().min(1),
+    }),
+  )
+  .handler(async ({ data }) => {
+    const prisma = await getPrisma()
+    const request = getRequest()
+    const session = await getServerSeam().requireAuth(request)
+    const userId = session.user!.id!
+    await getServerSeam().requireUserInDb(userId)
+
+    const slug = data.displayName
+      .toLowerCase()
+      .replace(/[^a-z0-9\u4e00-\u9fff]+/g, "-")
+      .replace(/-+/g, "-")
+      .slice(0, 20)
+      .replace(/^-|-$/g, "")
+    const shortUid = userId.slice(0, 8)
+    const providerId = `custom-${shortUid}-${slug}`
+
+    const exists = await prisma.aiProvider.findUnique({
+      where: { providerId },
+    })
+    if (exists) {
+      throw new Error(`服务商名称与已有服务商冲突，请换一个名称`)
+    }
+
+    const models: AiModelMeta[] = [
+      {
+        id: data.defaultModel,
+        displayName: data.defaultModel,
+        capabilities: ["text"],
+        defaultEnabled: true,
+      },
+    ]
+
+    const provider = await prisma.aiProvider.create({
+      data: {
+        providerId,
+        displayName: data.displayName,
+        brandName: data.displayName,
+        description: "用户自定义 OpenAI 兼容服务商",
+        category: "popular",
+        adapterKind: "openai-compatible",
+        defaultBaseUrl: data.baseUrl,
+        brandColor: "#6467F2",
+        isLocal: false,
+        enabled: false,
+        models: toJson(models),
+        sortOrder: 0,
+      },
+    })
+
+    if (data.apiKey.trim()) {
+      await prisma.aiProviderConfig.create({
+        data: {
+          userId,
+          providerId,
+          apiKey: encryptApiKey(data.apiKey.trim()),
+          baseUrl: data.baseUrl,
+          enabled: true,
+          models: models.map((m) => m.id),
+        },
+      })
+    }
+
+    return {
+      success: true,
+      providerId,
+      displayName: provider.displayName,
+    }
+  })

package/src/server/serverFns/design/comments.ts

@@ -0,0 +1,114 @@
+// SPDX-License-Identifier: AGPL-3.0-or-later
+// AllBlue - 理想之海
+// Copyright (C) 2026 AllBlue Contributors
+//
+// This program is free software: you can redistribute it and/or modify
+// it under the terms of the GNU Affero General Public License as published by
+// the Free Software Foundation, either version 3 of the License, or
+// (at your option) any later version.
+//
+// This program is distributed in the hope that it will be useful,
+// but WITHOUT ANY WARRANTY; without even the implied warranty of
+// MERCHANTABILITY or FITNESS FOR A PARTICULAR PURPOSE. See the
+// GNU Affero General Public License for more details.
+//
+// You should have received a copy of the GNU Affero General Public License
+// along with this program. If not, see <https://www.gnu.org/licenses/>.
+
+import { createServerFn } from '@tanstack/react-start'
+import { getRequest } from '@tanstack/react-start/server'
+import { z } from 'zod'
+import { getPrisma } from '@allbluecn/database/get-prisma'
+import { getServerSeam } from '@allbluecn/kernel'
+
+const listSchema = z.object({
+  designId: z.string(),
+  pageId: z.string().optional(),
+  includeResolved: z.boolean().default(false),
+})
+
+export const listCommentsFn = createServerFn({ method: 'GET' })
+  .validator(listSchema)
+  .handler(async ({ data }) => {
+    const prisma = await getPrisma()
+    return prisma.comment.findMany({
+      where: {
+        designId: data.designId,
+        ...(data.pageId ? { pageId: data.pageId } : {}),
+        ...(data.includeResolved ? {} : { resolved: false }),
+      },
+      orderBy: { createdAt: 'desc' },
+      include: {
+        user: {
+          select: {
+            id: true,
+            username: true,
+            email: true,
+            avatarConfig: true,
+            bgShape: true,
+            bgColor: true,
+          },
+        },
+      },
+    })
+  })
+
+const createSchema = z.object({
+  designId: z.string(),
+  pageId: z.string().optional(),
+  content: z.string().min(1).max(2000),
+  position: z.object({ from: z.number(), to: z.number() }).optional(),
+})
+
+export const createCommentFn = createServerFn({ method: 'POST' })
+  .validator(createSchema)
+  .handler(async ({ data }) => {
+    const prisma = await getPrisma()
+    const request = getRequest()
+    const session = await getServerSeam().requireAuth(request)
+    return prisma.comment.create({
+      data: {
+        ...data,
+        userId: session.user!.id!,
+        position: data.position as object,
+      },
+    })
+  })
+
+const ignoreSchema = z.object({ id: z.string() })
+
+export const ignoreCommentFn = createServerFn({ method: 'POST' })
+  .validator(ignoreSchema)
+  .handler(async ({ data }) => {
+    const prisma = await getPrisma()
+    const request = getRequest()
+    await getServerSeam().requireAuth(request)
+    await prisma.comment.update({ where: { id: data.id }, data: { resolved: true } })
+    return { success: true }
+  })
+
+const updateCommentSchema = z.object({
+  id: z.string(),
+  content: z.string().min(1).max(2000),
+})
+
+export const updateCommentFn = createServerFn({ method: 'POST' })
+  .validator(updateCommentSchema)
+  .handler(async ({ data }) => {
+    const prisma = await getPrisma()
+    const request = getRequest()
+    await getServerSeam().requireAuth(request)
+    return prisma.comment.update({ where: { id: data.id }, data: { content: data.content } })
+  })
+
+const resolveSchema = z.object({ id: z.string(), resolved: z.boolean() })
+
+export const resolveCommentFn = createServerFn({ method: 'POST' })
+  .validator(resolveSchema)
+  .handler(async ({ data }) => {
+    const prisma = await getPrisma()
+    const request = getRequest()
+    await getServerSeam().requireAuth(request)
+    await prisma.comment.update({ where: { id: data.id }, data: { resolved: data.resolved } })
+    return { success: true }
+  })