@exulu/backend 1.21.0 → 1.22.0

package/CHANGELOG.md

@@ -1,6 +1,6 @@
-# [1.21.0](https://github.com/Qventu/exulu-backend/compare/v1.20.0...v1.21.0) (2025-08-30)
+# [1.22.0](https://github.com/Qventu/exulu-backend/compare/v1.21.0...v1.22.0) (2025-09-03)
 
 
 ### Features
 
-* items as graphql endpoints ([ceca823](https://github.com/Qventu/exulu-backend/commit/ceca8236e788bda71786c1445836875aa4d644a5))
+* improved UI layout for chat interface ([4802a3c](https://github.com/Qventu/exulu-backend/commit/4802a3c0ac3eb21fc6a0f492f8786de341bd7103))

package/dist/index.cjs

@@ -2583,7 +2583,7 @@ var vectorSearch = async ({
     items
   };
 };
-var RBACResolver = async (db3, table, entityName, resourceId, rights_mode) => {
+var RBACResolver = async (db3, entityName, resourceId, rights_mode) => {
   const rbacRecords = await db3.from("rbac").where({
     entity: entityName,
     target_resource_id: resourceId
@@ -2821,7 +2821,7 @@ type PageInfo {
         const resourceId = parent.id;
         const entityName = table.name.singular;
         const rights_mode = parent.rights_mode;
-        return RBACResolver(db3, table, entityName, resourceId, rights_mode);
+        return RBACResolver(db3, entityName, resourceId, rights_mode);
       };
     }
   }
@@ -3319,8 +3319,6 @@ var ExuluAgent2 = class {
       // append the new message to the previous messages:
       messages: [...previousMessagesContent, message]
     });
-    console.log("[EXULU] Model provider key", providerApiKey);
-    console.log("[EXULU] Tool configs", toolConfigs);
     const result = (0, import_ai.streamText)({
       model,
       // Should be a LanguageModelV1
@@ -3344,11 +3342,13 @@ var ExuluAgent2 = class {
           "[EXULU] chat stream finished.",
           messages2
         );
-        await saveChat({
-          session,
-          user,
-          messages: messages2
-        });
+        if (session) {
+          await saveChat({
+            session,
+            user,
+            messages: messages2
+          });
+        }
         if (statistics) {
           await updateStatistic({
             name: "count",
@@ -4904,6 +4904,8 @@ Mood: friendly and intelligent.
       const agentInstance = await db3.from("agents").where({
         id: instance
       }).first();
+      const agentRbac = await RBACResolver(db3, "agent", agentInstance.id, agentInstance.rights_mode || "private");
+      agentInstance.RBAC = agentRbac;
       if (!agentInstance) {
         res.status(400).json({
           message: "Agent instance not found."
@@ -4942,6 +4944,86 @@ Mood: friendly and intelligent.
         return;
       }
       const user = authenticationResult.user;
+      const agentIsPublic = agentInstance.rights_mode === "public";
+      const agentByUsers = agentInstance.rights_mode === "users";
+      const agentByRoles = agentInstance.rights_mode === "roles";
+      const isAgentCreator = agentInstance.created_by === user.id;
+      const isAdmin = user.super_admin;
+      const isApi = user.type === "api";
+      let hasAccessToAgent = "none";
+      if (agentIsPublic || isAgentCreator || isAdmin || isApi) {
+        hasAccessToAgent = "write";
+      }
+      if (agentByUsers) {
+        hasAccessToAgent = agentInstance.RBAC?.users?.find((x) => x.id === user.id)?.rights || "none";
+        if (!hasAccessToAgent || hasAccessToAgent === "none" || hasAccessToAgent === "read") {
+          res.status(410).json({
+            message: `Your current user ${user.id} does not have access to this agent.`
+          });
+          return;
+        }
+      }
+      if (agentByRoles) {
+        hasAccessToAgent = agentInstance.RBAC?.roles?.find((x) => x.id === user.role?.id)?.rights || "none";
+        if (!hasAccessToAgent || hasAccessToAgent === "none" || hasAccessToAgent === "read") {
+          res.status(410).json({
+            message: `Your current role ${user.role?.name} does not have access to this agent.`
+          });
+          return;
+        }
+      }
+      let hasAccessToSession = "none";
+      ;
+      if (headers.session) {
+        const session = await db3.from("agents").where({
+          id: instance
+        }).first();
+        const sessionIsPublic = agentInstance.rights_mode === "public";
+        const sessionByUsers = agentInstance.rights_mode === "users";
+        const sessionByRoles = agentInstance.rights_mode === "roles";
+        const isSessionCreator = agentInstance.created_by === user.id;
+        const isAdmin2 = user.super_admin;
+        const isApi2 = user.type === "api";
+        if (sessionIsPublic || isSessionCreator || isAdmin2 || isApi2) {
+          hasAccessToSession = "write";
+        }
+        if (sessionByUsers) {
+          hasAccessToSession = session.RBAC?.users?.find((x) => x.id === user.id)?.rights || "none";
+          if (!hasAccessToSession || hasAccessToSession === "none" || hasAccessToSession === "read") {
+            res.status(410).json({
+              message: `Your current user ${user.id} does not have access to this session.`
+            });
+            return;
+          }
+        }
+        if (sessionByRoles) {
+          hasAccessToSession = session.RBAC?.roles?.find((x) => x.id === user.role?.id)?.rights || "none";
+          if (!hasAccessToSession || hasAccessToSession === "none" || hasAccessToSession === "read") {
+            res.status(410).json({
+              message: `Your current role ${user.role?.name} does not have access to this session.`
+            });
+            return;
+          }
+        }
+      }
+      if (!hasAccessToAgent || hasAccessToAgent === "none") {
+        res.status(410).json({
+          message: "You don't have access to this agent."
+        });
+        return;
+      }
+      if (!hasAccessToSession || hasAccessToSession === "none") {
+        res.status(410).json({
+          message: "You don't have access to this session."
+        });
+        return;
+      }
+      if (headers.session && !hasAccessToSession) {
+        res.status(410).json({
+          message: "You don't have access to this session."
+        });
+        return;
+      }
       if (user.type !== "api" && !user.super_admin && req.body.resourceId !== user.id) {
         res.status(400).json({
           message: "The provided user id in the resourceId field is not the same as the authenticated user. Only super admins and API users can impersonate other users."

package/dist/index.d.cts

@@ -245,20 +245,21 @@ interface ExuluWorkflow {
     id: string;
     name: string;
     description?: string;
-    rights_mode?: 'private' | 'users' | 'roles' | 'public';
-    RBAC?: {
-        users?: Array<{
-            id: string;
-            rights: 'read' | 'write';
-        }>;
-        roles?: Array<{
-            id: string;
-            rights: 'read' | 'write';
-        }>;
-    };
+    rights_mode?: ExuluRightsMode;
+    RBAC?: ExuluRBAC;
     variables?: WorkflowVariable[];
     steps_json?: WorkflowStep[];
 }
+interface ExuluRBAC {
+    users?: Array<{
+        id: string;
+        rights: 'read' | 'write';
+    }>;
+    roles?: Array<{
+        id: string;
+        rights: 'read' | 'write';
+    }>;
+}
 type ExuluEvalRunnerInstance = {
     name: string;
     description: string;

package/dist/index.d.ts

@@ -245,20 +245,21 @@ interface ExuluWorkflow {
     id: string;
     name: string;
     description?: string;
-    rights_mode?: 'private' | 'users' | 'roles' | 'public';
-    RBAC?: {
-        users?: Array<{
-            id: string;
-            rights: 'read' | 'write';
-        }>;
-        roles?: Array<{
-            id: string;
-            rights: 'read' | 'write';
-        }>;
-    };
+    rights_mode?: ExuluRightsMode;
+    RBAC?: ExuluRBAC;
     variables?: WorkflowVariable[];
     steps_json?: WorkflowStep[];
 }
+interface ExuluRBAC {
+    users?: Array<{
+        id: string;
+        rights: 'read' | 'write';
+    }>;
+    roles?: Array<{
+        id: string;
+        rights: 'read' | 'write';
+    }>;
+}
 type ExuluEvalRunnerInstance = {
     name: string;
     description: string;

package/dist/index.js

@@ -2542,7 +2542,7 @@ var vectorSearch = async ({
     items
   };
 };
-var RBACResolver = async (db3, table, entityName, resourceId, rights_mode) => {
+var RBACResolver = async (db3, entityName, resourceId, rights_mode) => {
   const rbacRecords = await db3.from("rbac").where({
     entity: entityName,
     target_resource_id: resourceId
@@ -2780,7 +2780,7 @@ type PageInfo {
         const resourceId = parent.id;
         const entityName = table.name.singular;
         const rights_mode = parent.rights_mode;
-        return RBACResolver(db3, table, entityName, resourceId, rights_mode);
+        return RBACResolver(db3, entityName, resourceId, rights_mode);
       };
     }
   }
@@ -3278,8 +3278,6 @@ var ExuluAgent2 = class {
       // append the new message to the previous messages:
       messages: [...previousMessagesContent, message]
     });
-    console.log("[EXULU] Model provider key", providerApiKey);
-    console.log("[EXULU] Tool configs", toolConfigs);
     const result = streamText({
       model,
       // Should be a LanguageModelV1
@@ -3303,11 +3301,13 @@ var ExuluAgent2 = class {
           "[EXULU] chat stream finished.",
           messages2
         );
-        await saveChat({
-          session,
-          user,
-          messages: messages2
-        });
+        if (session) {
+          await saveChat({
+            session,
+            user,
+            messages: messages2
+          });
+        }
         if (statistics) {
           await updateStatistic({
             name: "count",
@@ -4863,6 +4863,8 @@ Mood: friendly and intelligent.
       const agentInstance = await db3.from("agents").where({
         id: instance
       }).first();
+      const agentRbac = await RBACResolver(db3, "agent", agentInstance.id, agentInstance.rights_mode || "private");
+      agentInstance.RBAC = agentRbac;
       if (!agentInstance) {
         res.status(400).json({
           message: "Agent instance not found."
@@ -4901,6 +4903,86 @@ Mood: friendly and intelligent.
         return;
       }
       const user = authenticationResult.user;
+      const agentIsPublic = agentInstance.rights_mode === "public";
+      const agentByUsers = agentInstance.rights_mode === "users";
+      const agentByRoles = agentInstance.rights_mode === "roles";
+      const isAgentCreator = agentInstance.created_by === user.id;
+      const isAdmin = user.super_admin;
+      const isApi = user.type === "api";
+      let hasAccessToAgent = "none";
+      if (agentIsPublic || isAgentCreator || isAdmin || isApi) {
+        hasAccessToAgent = "write";
+      }
+      if (agentByUsers) {
+        hasAccessToAgent = agentInstance.RBAC?.users?.find((x) => x.id === user.id)?.rights || "none";
+        if (!hasAccessToAgent || hasAccessToAgent === "none" || hasAccessToAgent === "read") {
+          res.status(410).json({
+            message: `Your current user ${user.id} does not have access to this agent.`
+          });
+          return;
+        }
+      }
+      if (agentByRoles) {
+        hasAccessToAgent = agentInstance.RBAC?.roles?.find((x) => x.id === user.role?.id)?.rights || "none";
+        if (!hasAccessToAgent || hasAccessToAgent === "none" || hasAccessToAgent === "read") {
+          res.status(410).json({
+            message: `Your current role ${user.role?.name} does not have access to this agent.`
+          });
+          return;
+        }
+      }
+      let hasAccessToSession = "none";
+      ;
+      if (headers.session) {
+        const session = await db3.from("agents").where({
+          id: instance
+        }).first();
+        const sessionIsPublic = agentInstance.rights_mode === "public";
+        const sessionByUsers = agentInstance.rights_mode === "users";
+        const sessionByRoles = agentInstance.rights_mode === "roles";
+        const isSessionCreator = agentInstance.created_by === user.id;
+        const isAdmin2 = user.super_admin;
+        const isApi2 = user.type === "api";
+        if (sessionIsPublic || isSessionCreator || isAdmin2 || isApi2) {
+          hasAccessToSession = "write";
+        }
+        if (sessionByUsers) {
+          hasAccessToSession = session.RBAC?.users?.find((x) => x.id === user.id)?.rights || "none";
+          if (!hasAccessToSession || hasAccessToSession === "none" || hasAccessToSession === "read") {
+            res.status(410).json({
+              message: `Your current user ${user.id} does not have access to this session.`
+            });
+            return;
+          }
+        }
+        if (sessionByRoles) {
+          hasAccessToSession = session.RBAC?.roles?.find((x) => x.id === user.role?.id)?.rights || "none";
+          if (!hasAccessToSession || hasAccessToSession === "none" || hasAccessToSession === "read") {
+            res.status(410).json({
+              message: `Your current role ${user.role?.name} does not have access to this session.`
+            });
+            return;
+          }
+        }
+      }
+      if (!hasAccessToAgent || hasAccessToAgent === "none") {
+        res.status(410).json({
+          message: "You don't have access to this agent."
+        });
+        return;
+      }
+      if (!hasAccessToSession || hasAccessToSession === "none") {
+        res.status(410).json({
+          message: "You don't have access to this session."
+        });
+        return;
+      }
+      if (headers.session && !hasAccessToSession) {
+        res.status(410).json({
+          message: "You don't have access to this session."
+        });
+        return;
+      }
       if (user.type !== "api" && !user.super_admin && req.body.resourceId !== user.id) {
         res.status(400).json({
           message: "The provided user id in the resourceId field is not the same as the authenticated user. Only super admins and API users can impersonate other users."

package/package.json

@@ -1,7 +1,7 @@
 {
   "name": "@exulu/backend",
   "author": "Qventu Bv.",
-  "version": "1.21.0",
+  "version": "1.22.0",
   "main": "./dist/index.js",
   "private": false,
   "publishConfig": {

package/types/models/agent-session.ts

@@ -6,6 +6,13 @@ export interface AgentSession {
     agentId: string;
     resourceId: string;
     title: string;
+    created_by: string;
+    rights_mode: 'private' | 'users' | 'roles' | 'public' | 'project'
+    RBAC?: {
+        type?: string;
+        users?: Array<{ id: string; rights: 'read' | 'write' }>;
+        roles?: Array<{ id: string; rights: 'read' | 'write' }>;
+    };
 }
 export interface AgentMessage {
     id: string;

package/types/models/agent.ts

@@ -38,6 +38,7 @@ export interface Agent {
     }
     // New RBAC fields
     rights_mode?: 'private' | 'users' | 'roles' | 'public';
+    created_by?: string;
     RBAC?: {
         type?: string;
         users?: Array<{ id: string; rights: 'read' | 'write' }>;