@exulu/backend 3.3.0 → 3.4.0

package/dist/index.js

@@ -14,7 +14,6 @@ import {
   ExuluTool,
   KB_EDITOR_TOOL_ID,
   LITELLM_UI_PATH,
-  LiteLLMAdminError,
   OAUTH_CALLBACK_PATH,
   PreviewRenderError,
   ResolveModelError,
@@ -88,10 +87,12 @@ import {
   verifyCredentialNonce,
   waitForLiteLLMReady,
   withRetry
-} from "./chunk-5FTX543Z.js";
+} from "./chunk-UIIUBZCO.js";
 import {
-  findLiteLLMModel
-} from "./chunk-7CCMW3IW.js";
+  LiteLLMAdminError,
+  findLiteLLMModel,
+  resolveLiteLLMTarget
+} from "./chunk-NUVMV5FC.js";
 
 // src/index.ts
 import "dotenv/config";
@@ -1216,15 +1217,7 @@ async function resolveEmbedder(input) {
       `LiteLLM is not ready: ${err.message}`
     );
   }
-  const host = process.env.LITELLM_HOST ?? "127.0.0.1";
-  const port = process.env.LITELLM_PORT ?? "4000";
-  const masterKey = process.env.LITELLM_MASTER_KEY;
-  if (!masterKey) {
-    throw new ResolveEmbedderError(
-      "LITELLM_NOT_CONFIGURED",
-      "LITELLM_MASTER_KEY is required when EXULU_USE_LITELLM=true"
-    );
-  }
+  const { baseUrl, authHeaders } = resolveLiteLLMTarget();
   const resolvedUserId = user?.id ?? userId;
   if (resolvedUserId) await provisionDefaultUserBudget(resolvedUserId);
   const { dimensionality, maxChunkSize, maxBatchSize } = getEmbeddingModelInfo(model);
@@ -1245,12 +1238,12 @@ async function resolveEmbedder(input) {
     routine_name: routine?.name,
     context_name: contextName
   });
-  const endpoint = `http://${host}:${port}/v1/embeddings`;
+  const endpoint = `${baseUrl}/v1/embeddings`;
   const embedBatch = async (batch) => {
     const res = await fetch(endpoint, {
       method: "POST",
       headers: {
-        Authorization: `Bearer ${masterKey}`,
+        ...authHeaders,
         "Content-Type": "application/json"
       },
       body: JSON.stringify({
@@ -6199,20 +6192,25 @@ async function encryptString(string) {
   const hash = await bcrypt.hash(string, SALT_ROUNDS);
   return hash;
 }
-var generateApiKey = async (name, email) => {
+var generateApiKey = async (name, email, options) => {
   const { db } = await postgresClient();
   email = String(email).trim().toLowerCase();
+  const superAdmin = options?.superAdmin ?? true;
+  const roleName = options?.roleName ?? "admin";
+  const rolePermissions = options?.rolePermissions ?? {
+    agents: "write",
+    workflows: "write",
+    variables: "write",
+    users: "write"
+  };
   console.log("[EXULU] Inserting default user and admin role.");
-  const existingRole = await db.from("roles").where({ name: "admin" }).first();
+  const existingRole = await db.from("roles").where({ name: roleName }).first();
   let roleId;
   if (!existingRole) {
-    console.log("[EXULU] Creating default admin role.");
+    console.log(`[EXULU] Creating default ${roleName} role.`);
     const role = await db.from("roles").insert({
-      name: "admin",
-      agents: "write",
-      workflows: "write",
-      variables: "write",
-      users: "write"
+      name: roleName,
+      ...rolePermissions
     }).returning("id");
     roleId = role[0].id;
   } else {
@@ -6228,7 +6226,7 @@ var generateApiKey = async (name, email) => {
     await db.from("users").insert({
       name,
       email,
-      super_admin: true,
+      super_admin: superAdmin,
       createdAt: /* @__PURE__ */ new Date(),
       updatedAt: /* @__PURE__ */ new Date(),
       type: "api",
@@ -6800,6 +6798,9 @@ function createMutations(table, contexts, tools, config) {
         }
         throw new Error("Only the creator can edit this private record");
       }
+      if (record.created_by != null && String(record.created_by) === String(user.id)) {
+        return true;
+      }
       if (record.rights_mode === "users") {
         const rbacRecord = await db.from("rbac").where({
           entity: table.name.singular,
@@ -12866,7 +12867,7 @@ type LiteLLMModel {
 }
 `;
   resolvers.Query["litellmCatalog"] = async () => {
-    const { fetchLiteLLMCatalog } = await import("./catalog-UGTDNMDM.js");
+    const { fetchLiteLLMCatalog } = await import("./catalog-PZTI2MJZ.js");
     return fetchLiteLLMCatalog();
   };
   resolvers.Query["workflowSchedule"] = async (_, args, context, info) => {
@@ -14828,11 +14829,8 @@ var TranscriptionError = class extends Error {
   }
 };
 async function transcribeAudio(args) {
-  const host = process.env.LITELLM_HOST ?? "127.0.0.1";
-  const port = process.env.LITELLM_PORT ?? "4000";
-  const masterKey = process.env.LITELLM_MASTER_KEY;
+  const { baseUrl, authHeaders } = resolveLiteLLMTarget();
   const model = process.env.TRANSCRIPTION_MODEL;
-  if (!masterKey) throw new Error("LITELLM_MASTER_KEY is not set");
   if (!model) throw new Error("TRANSCRIPTION_MODEL is not set");
   const form = new FormData();
   form.append(
@@ -14842,9 +14840,9 @@ async function transcribeAudio(args) {
   );
   form.append("model", model);
   if (args.language) form.append("language", args.language);
-  const res = await fetch(`http://${host}:${port}/v1/audio/transcriptions`, {
+  const res = await fetch(`${baseUrl}/v1/audio/transcriptions`, {
     method: "POST",
-    headers: { Authorization: `Bearer ${masterKey}` },
+    headers: { ...authHeaders },
     body: form
   });
   if (!res.ok) {
@@ -14867,12 +14865,9 @@ var SpeechError = class extends Error {
   }
 };
 async function synthesizeSpeech(args) {
-  const host = process.env.LITELLM_HOST ?? "127.0.0.1";
-  const port = process.env.LITELLM_PORT ?? "4000";
-  const masterKey = process.env.LITELLM_MASTER_KEY;
+  const { baseUrl, authHeaders } = resolveLiteLLMTarget();
   const model = process.env.TTS_MODEL;
   const voice = process.env.TTS_VOICE;
-  if (!masterKey) throw new Error("LITELLM_MASTER_KEY is not set");
   if (!model) throw new Error("TTS_MODEL is not set");
   if (!voice) throw new Error("TTS_VOICE is not set");
   const body = {
@@ -14881,10 +14876,10 @@ async function synthesizeSpeech(args) {
     voice,
     response_format: "mp3"
   };
-  const res = await fetch(`http://${host}:${port}/v1/audio/speech`, {
+  const res = await fetch(`${baseUrl}/v1/audio/speech`, {
     method: "POST",
     headers: {
-      Authorization: `Bearer ${masterKey}`,
+      ...authHeaders,
       "Content-Type": "application/json"
     },
     body: JSON.stringify(body)
@@ -14908,13 +14903,6 @@ var ImageGenerationError = class extends Error {
     this.name = "ImageGenerationError";
   }
 };
-var resolveProxyConfig = () => {
-  const host = process.env.LITELLM_HOST ?? "127.0.0.1";
-  const port = process.env.LITELLM_PORT ?? "4000";
-  const masterKey = process.env.LITELLM_MASTER_KEY;
-  if (!masterKey) throw new Error("LITELLM_MASTER_KEY is not set");
-  return { host, port, masterKey };
-};
 var normalizeDataEntries = async (data) => {
   const out = [];
   for (const entry of data) {
@@ -14951,7 +14939,7 @@ var normalizeDataEntries = async (data) => {
 async function generateImage(args) {
   if (!args.model) throw new Error("model is required");
   if (!args.prompt) throw new Error("prompt is required");
-  const cfg = resolveProxyConfig();
+  const { baseUrl, authHeaders } = resolveLiteLLMTarget();
   const body = {
     model: args.model,
     prompt: args.prompt
@@ -14959,10 +14947,10 @@ async function generateImage(args) {
   if (args.size) body.size = args.size;
   if (args.quality) body.quality = args.quality;
   if (args.n) body.n = args.n;
-  const res = await fetch(`http://${cfg.host}:${cfg.port}/v1/images/generations`, {
+  const res = await fetch(`${baseUrl}/v1/images/generations`, {
     method: "POST",
     headers: {
-      Authorization: `Bearer ${cfg.masterKey}`,
+      ...authHeaders,
       "Content-Type": "application/json"
     },
     body: JSON.stringify(body),
@@ -14990,7 +14978,7 @@ async function editImage(args) {
   if (!args.references || args.references.length === 0) {
     throw new Error("at least one reference image is required");
   }
-  const cfg = resolveProxyConfig();
+  const { baseUrl, authHeaders } = resolveLiteLLMTarget();
   const form = new FormData();
   form.append("model", args.model);
   form.append("prompt", args.prompt);
@@ -15012,9 +15000,9 @@ async function editImage(args) {
       args.mask.filename
     );
   }
-  const res = await fetch(`http://${cfg.host}:${cfg.port}/v1/images/edits`, {
+  const res = await fetch(`${baseUrl}/v1/images/edits`, {
     method: "POST",
-    headers: { Authorization: `Bearer ${cfg.masterKey}` },
+    headers: { ...authHeaders },
     body: form,
     signal: args.signal
   });
@@ -15161,6 +15149,9 @@ See docs/superpowers/specs/2026-05-31-in-chat-image-generation-design.md for the
 // src/exulu/routes.ts
 import { resolve as resolvePath } from "path";
 
+// src/exulu/litellm/passthrough-allowlist.ts
+var isLiteLLMPassthroughPathAllowed = (path2) => path2.startsWith("/v1/") || path2 === "/model/info";
+
 // src/exulu/litellm/usage-view.ts
 var DAY_MS = 24 * 60 * 60 * 1e3;
 var DATE_ONLY_RE = /^\d{4}-\d{2}-\d{2}$/;
@@ -17377,7 +17368,7 @@ ${style.markdown}` : params.prompt;
       return;
     }
     const user = authenticationResult.user;
-    if (!req.path.startsWith("/v1/")) {
+    if (!isLiteLLMPassthroughPathAllowed(req.path)) {
       res.status(403).json({
         detail: `Path ${req.path} is not exposed through the Exulu LiteLLM proxy.`
       });
@@ -23395,15 +23386,7 @@ async function resolveOcr(input) {
       `LiteLLM is not ready: ${err.message}`
     );
   }
-  const host = process.env.LITELLM_HOST ?? "127.0.0.1";
-  const port = process.env.LITELLM_PORT ?? "4000";
-  const masterKey = process.env.LITELLM_MASTER_KEY;
-  if (!masterKey) {
-    throw new ResolveOcrError(
-      "LITELLM_NOT_CONFIGURED",
-      "LITELLM_MASTER_KEY is required when EXULU_USE_LITELLM=true"
-    );
-  }
+  const { baseUrl, authHeaders } = resolveLiteLLMTarget();
   const resolvedUserId = user?.id ?? userId;
   if (resolvedUserId) await provisionDefaultUserBudget(resolvedUserId);
   const role = user?.role;
@@ -23423,12 +23406,12 @@ async function resolveOcr(input) {
     routine_name: routine?.name,
     context_name: contextName
   });
-  const endpoint = `http://${host}:${port}/v1/ocr`;
+  const endpoint = `${baseUrl}/v1/ocr`;
   const ocr = async (document, opts) => {
     const res = await fetch(endpoint, {
       method: "POST",
       headers: {
-        Authorization: `Bearer ${masterKey}`,
+        ...authHeaders,
         "Content-Type": "application/json"
       },
       body: JSON.stringify({

package/package.json

@@ -1,7 +1,7 @@
 {
   "name": "@exulu/backend",
   "author": "Qventu Bv.",
-  "version": "3.3.0",
+  "version": "3.4.0",
   "main": "./dist/index.js",
   "private": false,
   "publishConfig": {