@eeacms/volto-eea-chatbot 3.0.0 → 4.0.0

package/src/halloumi/middleware.test.js

@@ -1,19 +1,25 @@
-import middleware from './middleware';
+import fetch from 'node-fetch';
 import { isPathAllowed } from '../middleware';
 
-jest.mock('./generative');
+// Mock node-fetch
+jest.mock('node-fetch');
 
 describe('halloumi middleware', () => {
-  let req, res, next;
+  let req, res, next, middleware;
 
   beforeEach(() => {
+    fetch.mockReset();
+    // Clear the module cache so middleware is re-imported with current env vars
+    jest.resetModules();
+    // Re-mock after reset
+    jest.mock('node-fetch', () => jest.fn());
+
     req = {
       url: '/_ha/generate',
       method: 'POST',
       body: {
         sources: ['source1', 'source2'],
         answer: 'test answer',
-        maxContextSegments: 3,
       },
       headers: {},
       ip: '127.0.0.1',
@@ -30,23 +36,90 @@ describe('halloumi middleware', () => {
     jest.restoreAllMocks();
   });
 
-  it('returns error when LLMGW_TOKEN is missing', async () => {
-    const origToken = process.env.LLMGW_TOKEN;
-    const origUrl = process.env.LLMGW_URL;
-    delete process.env.LLMGW_TOKEN;
-    delete process.env.LLMGW_URL;
+  it('proxies request to rag-fact-checker and returns response', async () => {
+    process.env.RAG_FACT_CHECKER_URL = 'http://localhost:8000';
+    middleware = require('./middleware').default;
+    const mockedFetch = require('node-fetch');
+
+    const mockResponse = {
+      claims: [
+        {
+          startOffset: 0,
+          endOffset: 20,
+          segmentIds: ['0'],
+          score: 0.95,
+          rationale: 'Supported by source.',
+        },
+      ],
+      segments: { 0: { startOffset: 0, endOffset: 30 } },
+    };
+
+    mockedFetch.mockResolvedValue({
+      ok: true,
+      status: 200,
+      json: () => Promise.resolve(mockResponse),
+    });
+
+    await middleware(req, res, next);
+
+    expect(mockedFetch).toHaveBeenCalledWith(
+      'http://localhost:8000/halloumi/generate',
+      expect.objectContaining({
+        method: 'POST',
+        headers: { 'Content-Type': 'application/json' },
+        body: JSON.stringify({
+          answer: 'test answer',
+          sources: ['source1', 'source2'],
+          max_context_segments: 0,
+        }),
+      }),
+    );
+    expect(res.set).toHaveBeenCalledWith('Content-Type', 'application/json');
+    expect(res.send).toHaveBeenCalledWith(mockResponse);
+  });
+
+  it('returns 502 when rag-fact-checker is unreachable', async () => {
+    process.env.RAG_FACT_CHECKER_URL = 'http://localhost:8000';
+    middleware = require('./middleware').default;
+    const mockedFetch = require('node-fetch');
+
+    mockedFetch.mockRejectedValue(new Error('ECONNREFUSED'));
 
     await middleware(req, res, next);
 
-    expect(res.send).toHaveBeenCalledWith({
-      error: 'Invalid configuration: missing LLMGW_TOKEN or LLMGW_URL',
+    expect(res.status).toHaveBeenCalledWith(502);
+    expect(res.send).toHaveBeenCalledWith(
+      expect.objectContaining({
+        error: expect.stringContaining('Fact-checker unavailable'),
+      }),
+    );
+  });
+
+  it('returns error when rag-fact-checker responds with non-ok status', async () => {
+    process.env.RAG_FACT_CHECKER_URL = 'http://localhost:8000';
+    middleware = require('./middleware').default;
+    const mockedFetch = require('node-fetch');
+
+    mockedFetch.mockResolvedValue({
+      ok: false,
+      status: 500,
+      json: () => Promise.resolve({ detail: 'Internal server error' }),
     });
 
-    process.env.LLMGW_TOKEN = origToken;
-    process.env.LLMGW_URL = origUrl;
+    await middleware(req, res, next);
+
+    expect(res.status).toHaveBeenCalledWith(500);
+    expect(res.send).toHaveBeenCalledWith(
+      expect.objectContaining({
+        error: expect.stringContaining('Internal server error'),
+      }),
+    );
   });
 
   it('rejects disallowed paths with 404', async () => {
+    process.env.RAG_FACT_CHECKER_URL = 'http://localhost:8000';
+    middleware = require('./middleware').default;
+
     req.url = '/_ha/admin/config';
     req.method = 'POST';
 
@@ -57,6 +130,9 @@ describe('halloumi middleware', () => {
   });
 
   it('rejects allowed path with wrong HTTP method', async () => {
+    process.env.RAG_FACT_CHECKER_URL = 'http://localhost:8000';
+    middleware = require('./middleware').default;
+
     req.url = '/_ha/generate';
     req.method = 'GET';
 
@@ -65,100 +141,29 @@ describe('halloumi middleware', () => {
     expect(res.statusCode).toBe(404);
     expect(res.send).toHaveBeenCalledWith({ error: 'Not Found' });
   });
-});
-
-// These tests need a fresh module loaded with env vars set so that
-// LLMGW_TOKEN and LLMGW_URL are defined at module load time,
-// allowing the code to reach getVerifyClaimResponse.
-describe('halloumi middleware - dynamic import', () => {
-  const buildReq = () => ({
-    url: '/_ha/generate',
-    method: 'POST',
-    body: {
-      sources: ['source1', 'source2'],
-      answer: 'test answer',
-      maxContextSegments: 3,
-    },
-    headers: {},
-    ip: '127.0.0.1',
-  });
 
-  const buildRes = () => ({
-    send: jest.fn(),
-    set: jest.fn(),
-    status: jest.fn().mockReturnThis(),
-  });
-
-  it('sends response on successful getVerifyClaimResponse', async () => {
-    const origToken = process.env.LLMGW_TOKEN;
-    const origUrl = process.env.LLMGW_URL;
-    process.env.LLMGW_TOKEN = 'test-token';
-    process.env.LLMGW_URL = 'http://test-url';
-
-    jest.resetModules();
-
-    const mockGetVerifyClaimResponse = jest
-      .fn()
-      .mockResolvedValue({ claims: [], segments: {} });
-
-    jest.setMock('./generative', {
-      getVerifyClaimResponse: mockGetVerifyClaimResponse,
-    });
-
-    const middlewareMod = require('./middleware').default;
-
-    const req = buildReq();
-    const res = buildRes();
-
-    await middlewareMod(req, res, jest.fn());
-
-    expect(mockGetVerifyClaimResponse).toHaveBeenCalled();
-    expect(res.set).toHaveBeenCalledWith('Content-Type', 'application/json');
-    expect(res.send).toHaveBeenCalledWith({ claims: [], segments: {} });
-
-    process.env.LLMGW_TOKEN = origToken;
-    process.env.LLMGW_URL = origUrl;
-  });
+  it('uses default URL when RAG_FACT_CHECKER_URL is not set', async () => {
+    delete process.env.RAG_FACT_CHECKER_URL;
+    middleware = require('./middleware').default;
+    const mockedFetch = require('node-fetch');
 
-  it('handles errors from getVerifyClaimResponse', async () => {
-    const origToken = process.env.LLMGW_TOKEN;
-    const origUrl = process.env.LLMGW_URL;
-    process.env.LLMGW_TOKEN = 'test-token';
-    process.env.LLMGW_URL = 'http://test-url';
-
-    jest.resetModules();
-
-    const mockGetVerifyClaimResponse = jest
-      .fn()
-      .mockRejectedValue(new Error('LLM error'));
-
-    jest.setMock('./generative', {
-      getVerifyClaimResponse: mockGetVerifyClaimResponse,
+    mockedFetch.mockResolvedValue({
+      ok: true,
+      status: 200,
+      json: () => Promise.resolve({ claims: [], segments: {} }),
     });
 
-    const middlewareMod = require('./middleware').default;
-
-    const req = buildReq();
-    const res = buildRes();
-
-    await middlewareMod(req, res, jest.fn());
+    await middleware(req, res, next);
 
-    expect(res.status).toHaveBeenCalledWith(500);
-    expect(res.send).toHaveBeenCalledWith(
-      expect.objectContaining({ error: expect.stringContaining('LLM error') }),
+    expect(mockedFetch).toHaveBeenCalledWith(
+      'http://localhost:8000/halloumi/generate',
+      expect.any(Object),
     );
-
-    process.env.LLMGW_TOKEN = origToken;
-    process.env.LLMGW_URL = origUrl;
   });
 });
 
 describe('halloumi path allowlist', () => {
-  // Mirror of ALLOWED_HALLOUMI_PATHS from middleware.js
-  const ALLOWED_HALLOUMI_PATHS = [
-    { path: '/generate', methods: ['POST'] },
-    { path: '/classify', methods: ['POST'] },
-  ];
+  const ALLOWED_HALLOUMI_PATHS = [{ path: '/generate', methods: ['POST'] }];
 
   it('allows /generate with POST', () => {
     expect(isPathAllowed('/generate', 'POST', ALLOWED_HALLOUMI_PATHS)).toBe(
@@ -166,12 +171,6 @@ describe('halloumi path allowlist', () => {
     );
   });
 
-  it('allows /classify with POST', () => {
-    expect(isPathAllowed('/classify', 'POST', ALLOWED_HALLOUMI_PATHS)).toBe(
-      true,
-    );
-  });
-
   it('rejects /generate with wrong method', () => {
     expect(isPathAllowed('/generate', 'GET', ALLOWED_HALLOUMI_PATHS)).toBe(
       false,

package/src/middleware.js

@@ -289,7 +289,7 @@ export default async function middleware(req, res, next) {
 
   const reqUrl = `${process.env.ONYX_URL || ''}/api${path}`;
 
-  const api_key = process.env.ONYX_API_KEY;
+  const api_key = process.env.ONYX_API_KEY; //betterleaks:allow
   if (!api_key) {
     res.statusCode = 500;
     res.statusMessage = MSG_INVALID_CONFIGURATION;
@@ -300,7 +300,7 @@ export default async function middleware(req, res, next) {
   try {
     await send_onyx_request(req, res, {
       url: reqUrl,
-      api_key: api_key,
+      api_key: api_key, //betterleaks:allow
       is_related_question,
     });
   } catch (error) {

package/src/middleware.test.js

@@ -89,7 +89,7 @@ describe('src/middleware', () => {
   });
 
   it('proxies POST request with api_key and pipes response', async () => {
-    process.env.ONYX_API_KEY = 'test-key';
+    process.env.ONYX_API_KEY = 'test-key'; //betterleaks:allow
     process.env.ONYX_URL = 'http://localhost:3000';
 
     await middleware(req, res, next);
@@ -110,7 +110,7 @@ describe('src/middleware', () => {
   });
 
   it('handles related question paths', async () => {
-    process.env.ONYX_API_KEY = 'test-key';
+    process.env.ONYX_API_KEY = 'test-key'; //betterleaks:allow
     process.env.ONYX_URL = 'http://localhost:3000';
     req.url = '/_rq/chat/send-message';
 
@@ -124,7 +124,7 @@ describe('src/middleware', () => {
   });
 
   it('sends error response when fetch throws', async () => {
-    process.env.ONYX_API_KEY = 'test-key';
+    process.env.ONYX_API_KEY = 'test-key'; //betterleaks:allow
     process.env.ONYX_URL = 'http://localhost:3000';
 
     nodeFetch.mockRejectedValueOnce(
@@ -145,7 +145,7 @@ describe('src/middleware', () => {
   });
 
   it('handles error without response text', async () => {
-    process.env.ONYX_API_KEY = 'test-key';
+    process.env.ONYX_API_KEY = 'test-key'; //betterleaks:allow
     process.env.ONYX_URL = 'http://localhost:3000';
 
     nodeFetch.mockRejectedValueOnce(new Error('No response'));
@@ -162,7 +162,7 @@ describe('src/middleware', () => {
   });
 
   it('handles GET requests without body', async () => {
-    process.env.ONYX_API_KEY = 'test-key';
+    process.env.ONYX_API_KEY = 'test-key'; //betterleaks:allow
     process.env.ONYX_URL = 'http://localhost:3000';
     req.method = 'GET';
     req.url = '/_da/persona/1';
@@ -175,7 +175,7 @@ describe('src/middleware', () => {
   });
 
   it('uses mock create-chat-session when MOCK_LLM_FILE_PATH is set', async () => {
-    process.env.ONYX_API_KEY = 'test-key';
+    process.env.ONYX_API_KEY = 'test-key'; //betterleaks:allow
     process.env.ONYX_URL = 'http://localhost:3000';
     process.env.MOCK_LLM_FILE_PATH = '/tmp/mock.jsonl';
     req.url = '/_da/chat/create-chat-session';
@@ -189,7 +189,7 @@ describe('src/middleware', () => {
   });
 
   it('uses mock send-message with stream when MOCK_LLM_FILE_PATH is set', async () => {
-    process.env.ONYX_API_KEY = 'test-key';
+    process.env.ONYX_API_KEY = 'test-key'; //betterleaks:allow
     process.env.ONYX_URL = 'http://localhost:3000';
     process.env.MOCK_LLM_FILE_PATH = '/tmp/mock.jsonl';
     req.url = '/_da/chat/send-message';
@@ -223,7 +223,7 @@ describe('src/middleware', () => {
   });
 
   it('dumps LLM response when DUMP_LLM_FILE_PATH is set', async () => {
-    process.env.ONYX_API_KEY = 'test-key';
+    process.env.ONYX_API_KEY = 'test-key'; //betterleaks:allow
     process.env.ONYX_URL = 'http://localhost:3000';
     process.env.DUMP_LLM_FILE_PATH = '/tmp/dumped_response.jsonl';
 
@@ -236,7 +236,7 @@ describe('src/middleware', () => {
   });
 
   it('rejects disallowed paths with 404', async () => {
-    process.env.ONYX_API_KEY = 'test-key';
+    process.env.ONYX_API_KEY = 'test-key'; //betterleaks:allow
     process.env.ONYX_URL = 'http://localhost:3000';
     req.url = '/_da/admin/users/delete';
     req.method = 'POST';
@@ -249,7 +249,7 @@ describe('src/middleware', () => {
   });
 
   it('rejects allowed path with wrong HTTP method', async () => {
-    process.env.ONYX_API_KEY = 'test-key';
+    process.env.ONYX_API_KEY = 'test-key'; //betterleaks:allow
     process.env.ONYX_URL = 'http://localhost:3000';
     req.url = '/_da/persona';
     req.method = 'DELETE';
@@ -262,7 +262,7 @@ describe('src/middleware', () => {
   });
 
   it('rejects path traversal attempts', async () => {
-    process.env.ONYX_API_KEY = 'test-key';
+    process.env.ONYX_API_KEY = 'test-key'; //betterleaks:allow
     process.env.ONYX_URL = 'http://localhost:3000';
     req.url = '/_da/../../etc/passwd';
     req.method = 'GET';

package/src/halloumi/filtering.js

@@ -1,149 +0,0 @@
-import debug from 'debug';
-import fetch from 'node-fetch';
-
-const log = debug('halloumi');
-
-const LLMGW_URL = process.env.LLMGW_URL;
-const LLMGW_API_KEY = process.env.LLMGW_TOKEN;
-const MIN_CONTEXT_SENTENCES_FOR_FILTERING = 75;
-
-const filterModel = {
-  name: 'Inhouse-LLM/gpt-oss-120b',
-  apiUrl: `${LLMGW_URL}/chat/completions`,
-  apiKey: LLMGW_API_KEY,
-};
-
-export async function callLLM(apiUrl, apiKey, requestBody, { ip } = {}) {
-  const headers = {
-    'Content-Type': 'application/json',
-    accept: 'application/json',
-  };
-  if (apiKey) {
-    headers['Authorization'] = `Bearer ${apiKey}`;
-  }
-  if (ip) {
-    headers['X-Forwarded-For'] = ip;
-  }
-
-  const response = await fetch(apiUrl, {
-    method: 'POST',
-    headers,
-    body: JSON.stringify(requestBody),
-  });
-
-  return response.json();
-}
-
-function buildClaimFilterPrompt(sentences) {
-  const numberedSentences = sentences
-    .map((s, i) => `${i + 1}. "${s.trim()}"`)
-    .join('\n');
-
-  return `Given the following numbered sentences, identify which ones are NOT verifiable factual claims.
-
-Exclude sentences that are:
-- Greetings, preambles, or transitional phrases
-- Opinions, vague statements, or subjective assessments
-- Introductory sentences that set up a list or table
-- Sentences that merely restate or paraphrase the question
-- Conversational closers (e.g., "let me know if you need more")
-- Broad summaries that don't assert a specific fact
-- Disclaimers or meta-commentary about the response itself
-- Sentences that do not provide enough information to verify
-- Sentences that only mention a concept without providing specific information
-
-Respond with ONLY a comma-separated list of the sentence numbers to exclude. If none should be excluded, respond with "NONE".
-
-Sentences:
-${numberedSentences}`;
-}
-
-function buildContextFilterPrompt(contextSentences, claimSentences) {
-  const numberedContext = contextSentences
-    .map((s, i) => `${i + 1}. "${s.trim()}"`)
-    .join('\n');
-  const numberedClaims = claimSentences
-    .map((s, i) => `${i + 1}. "${s.trim()}"`)
-    .join('\n');
-
-  return `Given the following context sentences and claims, identify which context sentences are NOT relevant to verifying ANY of the claims.
-
-Context sentences:
-${numberedContext}
-
-Claims to verify:
-${numberedClaims}
-
-Respond with ONLY a comma-separated list of the context sentence numbers that are NOT relevant. If all are relevant, respond with "NONE".`;
-}
-
-/**
- * Parses a comma-separated list of indices from an LLM response.
- */
-export function parseExcludeIndices(content, maxIndex) {
-  const excludeIndices = new Set();
-  if (content.trim().toUpperCase() === 'NONE') {
-    return excludeIndices;
-  }
-  const matches = content.match(/\d+/g) || [];
-  for (const match of matches) {
-    const idx = parseInt(match, 10);
-    if (idx >= 1 && idx <= maxIndex) {
-      excludeIndices.add(idx);
-    }
-  }
-  return excludeIndices;
-}
-
-async function callFilterModel(prompt, { ip } = {}) {
-  const data = {
-    messages: [{ role: 'user', content: prompt }],
-    temperature: 0.0,
-    model: filterModel.name,
-  };
-  const jsonData = await callLLM(filterModel.apiUrl, filterModel.apiKey, data, {
-    ip,
-  });
-  return jsonData.choices?.[0]?.message?.content || '';
-}
-
-export async function excludeClaimSentences(sentences, { ip } = {}) {
-  if (sentences.length === 0) {
-    return new Set();
-  }
-
-  try {
-    const prompt = buildClaimFilterPrompt(sentences);
-    const content = await callFilterModel(prompt, { ip });
-    const excludedIndices = parseExcludeIndices(content, sentences.length);
-    log('Claim filter response', excludedIndices.size);
-    return excludedIndices;
-  } catch (error) {
-    log('Claim filter failed, skipping', error);
-    return new Set();
-  }
-}
-
-export async function excludeContextSentences(
-  contextSentences,
-  claimSentences,
-  { ip } = {},
-) {
-  if (contextSentences.length <= MIN_CONTEXT_SENTENCES_FOR_FILTERING) {
-    return new Set();
-  }
-
-  try {
-    const prompt = buildContextFilterPrompt(contextSentences, claimSentences);
-    const content = await callFilterModel(prompt, { ip });
-    const excludedIndices = parseExcludeIndices(
-      content,
-      contextSentences.length,
-    );
-    log('Context filter response', excludedIndices.size);
-    return excludedIndices;
-  } catch (error) {
-    log('Context filter failed, skipping', error);
-    return new Set();
-  }
-}