@lobehub/lobehub 2.0.0-next.221 → 2.0.0-next.223

package/packages/memory-user-memory/vitest.config.ts

@@ -1,7 +1,11 @@
+import { resolve } from 'node:path';
 import { defineConfig } from 'vitest/config';
 
 export default defineConfig({
   test: {
+    alias: {
+      '@': resolve(__dirname, '../../src'),
+    },
     coverage: {
       reporter: ['text', 'json', 'lcov', 'text-summary'],
     },

package/packages/model-runtime/src/providers/replicate/index.ts

@@ -160,7 +160,7 @@ export class LobeReplicateAI implements LobeRuntimeAI {
             '[Replicate createImage] Local URL detected, will fetch and upload as data',
           );
           try {
-            const { ssrfSafeFetch } = await import('ssrf-safe-fetch');
+            const { ssrfSafeFetch } = await import('@lobechat/ssrf-safe-fetch');
             const imageResponse = await ssrfSafeFetch(imageUrl);
             if (!imageResponse.ok) {
               throw new Error(

package/packages/ssrf-safe-fetch/index.test.ts

@@ -117,7 +117,7 @@ describe('ssrfSafeFetch', () => {
     });
 
     it('should allow private IPs when SSRF_ALLOW_PRIVATE_IP_ADDRESS is true', async () => {
-      process.env.SSRF_ALLOW_PRIVATE_IP_ADDRESS = 'true';
+      process.env.SSRF_ALLOW_PRIVATE_IP_ADDRESS = '1';
 
       const mockResponse = createMockResponse();
       mockFetch.mockResolvedValue(mockResponse);
@@ -277,7 +277,7 @@ describe('ssrfSafeFetch', () => {
   describe('integration scenarios', () => {
     it('should work with complex request configurations', async () => {
       process.env.SSRF_ALLOW_IP_ADDRESS_LIST = '127.0.0.1';
-      process.env.SSRF_ALLOW_PRIVATE_IP_ADDRESS = 'true';
+      process.env.SSRF_ALLOW_PRIVATE_IP_ADDRESS = '1';
 
       const mockResponse = createMockResponse({
         // @ts-ignore

package/packages/ssrf-safe-fetch/package.json

@@ -1,5 +1,5 @@
 {
-  "name": "ssrf-safe-fetch",
+  "name": "@lobechat/ssrf-safe-fetch",
   "version": "1.0.0",
   "private": true,
   "description": "SSRF-safe fetch implementation with browser/node conditional exports",
@@ -12,7 +12,8 @@
   },
   "main": "index.ts",
   "scripts": {
-    "test": "vitest run"
+    "test": "vitest run",
+    "test:coverage": "vitest --coverage --silent='passed-only'"
   },
   "dependencies": {
     "node-fetch": "^3.3.2",

package/packages/types/src/serverConfig.ts

@@ -49,7 +49,9 @@ export type ServerLanguageModel = Partial<Record<GlobalLLMProviderKey, ServerMod
 export interface GlobalServerConfig {
   aiProvider: ServerLanguageModel;
   defaultAgent?: PartialDeep<UserDefaultAgent>;
+  enableEmailVerification?: boolean;
   enableKlavis?: boolean;
+  enableMagicLink?: boolean;
   enableMarketTrustedClient?: boolean;
   enableUploadFileToServer?: boolean;
   enabledAccessCode?: boolean;

package/packages/utils/package.json

@@ -34,7 +34,7 @@
     "remark": "^15.0.1",
     "remark-gfm": "^4.0.1",
     "remark-html": "^16.0.1",
-    "ssrf-safe-fetch": "workspace:*",
+    "@lobechat/ssrf-safe-fetch": "workspace:*",
     "tokenx": "^1.2.1",
     "ua-parser-js": "^1.0.41",
     "uuid": "^11.1.0",

package/packages/utils/src/client/xor-obfuscation.test.ts

@@ -1,6 +1,6 @@
 import { describe, expect, it } from 'vitest';
 
-import { SECRET_XOR_KEY } from '@/const/auth';
+import { SECRET_XOR_KEY } from '@/envs/auth';
 
 import { obfuscatePayloadWithXOR } from './xor-obfuscation';
 
@@ -8,7 +8,7 @@ describe('xor-obfuscation', () => {
   describe('obfuscatePayloadWithXOR', () => {
     it('应该对简单字符串进行混淆并返回Base64字符串', () => {
       const payload = 'hello world';
-      const result = obfuscatePayloadWithXOR(payload);
+      const result = obfuscatePayloadWithXOR(payload, SECRET_XOR_KEY);
 
       // 验证返回值是字符串
       expect(typeof result).toBe('string');
@@ -22,7 +22,7 @@ describe('xor-obfuscation', () => {
 
     it('应该对JSON对象进行混淆', () => {
       const payload = { name: 'test', value: 123, active: true };
-      const result = obfuscatePayloadWithXOR(payload);
+      const result = obfuscatePayloadWithXOR(payload, SECRET_XOR_KEY);
 
       // 验证返回值是字符串
       expect(typeof result).toBe('string');
@@ -33,7 +33,7 @@ describe('xor-obfuscation', () => {
 
     it('应该对数组进行混淆', () => {
       const payload = [1, 2, 3, 'test', { nested: true }];
-      const result = obfuscatePayloadWithXOR(payload);
+      const result = obfuscatePayloadWithXOR(payload, SECRET_XOR_KEY);
 
       // 验证返回值是字符串
       expect(typeof result).toBe('string');
@@ -58,7 +58,7 @@ describe('xor-obfuscation', () => {
         tokens: ['abc123', 'def456'],
         metadata: null,
       };
-      const result = obfuscatePayloadWithXOR(payload);
+      const result = obfuscatePayloadWithXOR(payload, SECRET_XOR_KEY);
 
       // 验证返回值是字符串
       expect(typeof result).toBe('string');
@@ -69,8 +69,8 @@ describe('xor-obfuscation', () => {
 
     it('相同的输入应该产生相同的输出', () => {
       const payload = { test: 'consistent' };
-      const result1 = obfuscatePayloadWithXOR(payload);
-      const result2 = obfuscatePayloadWithXOR(payload);
+      const result1 = obfuscatePayloadWithXOR(payload, SECRET_XOR_KEY);
+      const result2 = obfuscatePayloadWithXOR(payload, SECRET_XOR_KEY);
 
       expect(result1).toBe(result2);
     });
@@ -79,15 +79,15 @@ describe('xor-obfuscation', () => {
       const payload1 = { test: 'value1' };
       const payload2 = { test: 'value2' };
 
-      const result1 = obfuscatePayloadWithXOR(payload1);
-      const result2 = obfuscatePayloadWithXOR(payload2);
+      const result1 = obfuscatePayloadWithXOR(payload1, SECRET_XOR_KEY);
+      const result2 = obfuscatePayloadWithXOR(payload2, SECRET_XOR_KEY);
 
       expect(result1).not.toBe(result2);
     });
 
     it('应该处理包含特殊字符的字符串', () => {
       const payload = 'Hello! @#$%^&*()_+-=[]{}|;:,.<>?/~`"\'\\';
-      const result = obfuscatePayloadWithXOR(payload);
+      const result = obfuscatePayloadWithXOR(payload, SECRET_XOR_KEY);
 
       // 验证返回值是字符串
       expect(typeof result).toBe('string');
@@ -98,7 +98,7 @@ describe('xor-obfuscation', () => {
 
     it('应该处理包含Unicode字符的字符串', () => {
       const payload = '你好世界 🌍 émojis 日本語 한국어';
-      const result = obfuscatePayloadWithXOR(payload);
+      const result = obfuscatePayloadWithXOR(payload, SECRET_XOR_KEY);
 
       // 验证返回值是字符串
       expect(typeof result).toBe('string');
@@ -109,7 +109,7 @@ describe('xor-obfuscation', () => {
 
     it('应该处理空字符串', () => {
       const payload = '';
-      const result = obfuscatePayloadWithXOR(payload);
+      const result = obfuscatePayloadWithXOR(payload, SECRET_XOR_KEY);
 
       // 验证返回值是字符串
       expect(typeof result).toBe('string');
@@ -120,7 +120,7 @@ describe('xor-obfuscation', () => {
 
     it('应该处理空对象', () => {
       const payload = {};
-      const result = obfuscatePayloadWithXOR(payload);
+      const result = obfuscatePayloadWithXOR(payload, SECRET_XOR_KEY);
 
       // 验证返回值是字符串
       expect(typeof result).toBe('string');
@@ -130,7 +130,7 @@ describe('xor-obfuscation', () => {
     });
 
     it('应该处理空数组', () => {
-      const result = obfuscatePayloadWithXOR([]);
+      const result = obfuscatePayloadWithXOR([], SECRET_XOR_KEY);
 
       // 验证返回值是字符串
       expect(typeof result).toBe('string');
@@ -141,7 +141,7 @@ describe('xor-obfuscation', () => {
 
     it('应该处理null值', () => {
       const payload = null;
-      const result = obfuscatePayloadWithXOR(payload);
+      const result = obfuscatePayloadWithXOR(payload, SECRET_XOR_KEY);
 
       // 验证返回值是字符串
       expect(typeof result).toBe('string');
@@ -152,7 +152,7 @@ describe('xor-obfuscation', () => {
 
     it('应该处理数字', () => {
       const payload = 42;
-      const result = obfuscatePayloadWithXOR(payload);
+      const result = obfuscatePayloadWithXOR(payload, SECRET_XOR_KEY);
 
       // 验证返回值是字符串
       expect(typeof result).toBe('string');
@@ -165,8 +165,8 @@ describe('xor-obfuscation', () => {
       const payloadTrue = true;
       const payloadFalse = false;
 
-      const resultTrue = obfuscatePayloadWithXOR(payloadTrue);
-      const resultFalse = obfuscatePayloadWithXOR(payloadFalse);
+      const resultTrue = obfuscatePayloadWithXOR(payloadTrue, SECRET_XOR_KEY);
+      const resultFalse = obfuscatePayloadWithXOR(payloadFalse, SECRET_XOR_KEY);
 
       // 验证返回值是字符串
       expect(typeof resultTrue).toBe('string');
@@ -189,7 +189,7 @@ describe('xor-obfuscation', () => {
         tab: 'col1\tcol2',
         unicode: '\u0041\u0042\u0043',
       };
-      const result = obfuscatePayloadWithXOR(payload);
+      const result = obfuscatePayloadWithXOR(payload, SECRET_XOR_KEY);
 
       // 验证返回值是字符串
       expect(typeof result).toBe('string');
@@ -200,7 +200,7 @@ describe('xor-obfuscation', () => {
 
     it('应该处理很长的字符串', () => {
       const payload = 'a'.repeat(10000);
-      const result = obfuscatePayloadWithXOR(payload);
+      const result = obfuscatePayloadWithXOR(payload, SECRET_XOR_KEY);
 
       // 验证返回值是字符串
       expect(typeof result).toBe('string');
@@ -216,8 +216,8 @@ describe('xor-obfuscation', () => {
       const shortPayload = 'short';
       const longPayload = 'this is a much longer string that should produce different output';
 
-      const shortResult = obfuscatePayloadWithXOR(shortPayload);
-      const longResult = obfuscatePayloadWithXOR(longPayload);
+      const shortResult = obfuscatePayloadWithXOR(shortPayload, SECRET_XOR_KEY);
+      const longResult = obfuscatePayloadWithXOR(longPayload, SECRET_XOR_KEY);
 
       // 较长的输入应该产生较长的输出
       expect(longResult.length).toBeGreaterThan(shortResult.length);
@@ -225,7 +225,7 @@ describe('xor-obfuscation', () => {
 
     it('应该验证输出是有效的Base64格式', () => {
       const payload = { test: 'base64 validation' };
-      const result = obfuscatePayloadWithXOR(payload);
+      const result = obfuscatePayloadWithXOR(payload, SECRET_XOR_KEY);
 
       // 验证Base64格式的正则表达式
       const base64Regex = /^[A-Za-z0-9+/]*={0,2}$/;
@@ -242,14 +242,14 @@ describe('xor-obfuscation', () => {
         },
       };
 
-      const result = obfuscatePayloadWithXOR(payload);
+      const result = obfuscatePayloadWithXOR(payload, SECRET_XOR_KEY);
       expect(typeof result).toBe('string');
       expect(() => atob(result)).not.toThrow();
     });
 
     it('应该对undefined值进行处理', () => {
       const payload = undefined;
-      const result = obfuscatePayloadWithXOR(payload);
+      const result = obfuscatePayloadWithXOR(payload, SECRET_XOR_KEY);
 
       // 验证返回值是字符串
       expect(typeof result).toBe('string');
@@ -268,7 +268,7 @@ describe('xor-obfuscation', () => {
         value: 123,
       };
 
-      const result = obfuscatePayloadWithXOR(payload);
+      const result = obfuscatePayloadWithXOR(payload, SECRET_XOR_KEY);
       expect(typeof result).toBe('string');
       expect(() => atob(result)).not.toThrow();
     });
@@ -279,7 +279,7 @@ describe('xor-obfuscation', () => {
 
       // 多次运行相同输入
       for (let i = 0; i < 10; i++) {
-        results.push(obfuscatePayloadWithXOR(payload));
+        results.push(obfuscatePayloadWithXOR(payload, SECRET_XOR_KEY));
       }
 
       // 所有结果应该相同
@@ -293,7 +293,7 @@ describe('xor-obfuscation', () => {
         name: 'date test',
       };
 
-      const result = obfuscatePayloadWithXOR(payload);
+      const result = obfuscatePayloadWithXOR(payload, SECRET_XOR_KEY);
       expect(typeof result).toBe('string');
       expect(() => atob(result)).not.toThrow();
     });
@@ -306,7 +306,7 @@ describe('xor-obfuscation', () => {
         normalKey: 'normal value',
       };
 
-      const result = obfuscatePayloadWithXOR(payload);
+      const result = obfuscatePayloadWithXOR(payload, SECRET_XOR_KEY);
       expect(typeof result).toBe('string');
       expect(() => atob(result)).not.toThrow();
     });
@@ -314,7 +314,7 @@ describe('xor-obfuscation', () => {
     it('应该验证混淆后的数据长度合理性', () => {
       const originalPayload = { test: 'length check' };
       const originalJSON = JSON.stringify(originalPayload);
-      const result = obfuscatePayloadWithXOR(originalPayload);
+      const result = obfuscatePayloadWithXOR(originalPayload, SECRET_XOR_KEY);
 
       // Base64 编码后的长度通常是原始长度的 4/3 倍（向上取整到4的倍数）
       const expectedMinLength = Math.ceil((originalJSON.length * 4) / 3 / 4) * 4;
@@ -323,7 +323,7 @@ describe('xor-obfuscation', () => {
 
     it('应该验证XOR操作的正确性（通过逆向操作）', () => {
       const originalPayload = { message: 'XOR test', value: 42 };
-      const obfuscatedResult = obfuscatePayloadWithXOR(originalPayload);
+      const obfuscatedResult = obfuscatePayloadWithXOR(originalPayload, SECRET_XOR_KEY);
 
       // 手动实现逆向操作来验证 XOR 操作的正确性
       const base64Decoded = atob(obfuscatedResult);
@@ -357,7 +357,7 @@ describe('xor-obfuscation', () => {
         [4, 5, 6],
       ];
 
-      const results = payloads.map((payload) => obfuscatePayloadWithXOR(payload));
+      const results = payloads.map((payload) => obfuscatePayloadWithXOR(payload, SECRET_XOR_KEY));
 
       // 验证所有结果都不相同
       for (let i = 0; i < results.length; i++) {

package/packages/utils/src/client/xor-obfuscation.ts

@@ -1,5 +1,3 @@
-import { SECRET_XOR_KEY } from '@/const/auth';
-
 /**
  * Convert string to Uint8Array (UTF-8 encoding)
  */
@@ -24,12 +22,13 @@ const xorProcess = (data: Uint8Array, key: Uint8Array): Uint8Array => {
 /**
  * Obfuscate payload with XOR and encode to Base64
  * @param payload The JSON object to obfuscate
+ * @param secretKey The key used for XOR obfuscation
  * @returns The obfuscated string encoded in Base64
  */
-export const obfuscatePayloadWithXOR = <T>(payload: T): string => {
+export const obfuscatePayloadWithXOR = <T>(payload: T, secretKey: string): string => {
   const jsonString = JSON.stringify(payload);
   const dataBytes = stringToUint8Array(jsonString);
-  const keyBytes = stringToUint8Array(SECRET_XOR_KEY);
+  const keyBytes = stringToUint8Array(secretKey);
 
   const xoredBytes = xorProcess(dataBytes, keyBytes);
 

package/packages/utils/src/imageToBase64.ts

@@ -48,7 +48,7 @@ export const imageUrlToBase64 = async (
 
     // Use SSRF-safe fetch on server-side to prevent SSRF attacks
     const res = isServer
-      ? await import('ssrf-safe-fetch').then((m) => m.ssrfSafeFetch(imageUrl))
+      ? await import('@lobechat/ssrf-safe-fetch').then((m) => m.ssrfSafeFetch(imageUrl))
       : await fetch(imageUrl);
 
     const blob = await res.blob();

package/packages/utils/src/server/__tests__/auth.test.ts

@@ -7,7 +7,7 @@ let mockEnableBetterAuth = false;
 let mockEnableClerk = false;
 let mockEnableNextAuth = false;
 
-vi.mock('@/const/auth', () => ({
+vi.mock('@/envs/auth', () => ({
   get enableBetterAuth() {
     return mockEnableBetterAuth;
   },

package/packages/utils/src/server/auth.ts

@@ -1,6 +1,6 @@
 import { headers } from 'next/headers';
 
-import { enableBetterAuth, enableClerk, enableNextAuth } from '@/const/auth';
+import { enableBetterAuth, enableClerk, enableNextAuth } from '@/envs/auth';
 
 export const getUserAuth = async () => {
   if (enableClerk) {

package/packages/utils/src/server/correctOIDCUrl.test.ts

@@ -338,9 +338,8 @@ describe('correctOIDCUrl', () => {
       const originalUrl = new URL('http://localhost:3000/auth/callback');
       const result = correctOIDCUrl(mockRequest, originalUrl);
 
-      // Should return original URL because example.com:8443 doesn't match configured APP_URL (https://example.com)
-      expect(result).toBe(originalUrl);
-      expect(result.toString()).toBe('http://localhost:3000/auth/callback');
+      // Should fall back to host header because example.com:8443 doesn't match configured APP_URL
+      expect(result.toString()).toBe('https://internal.com:3000/auth/callback');
     });
 
     it('should not need correction when URL hostname matches actual host', () => {
@@ -358,18 +357,18 @@ describe('correctOIDCUrl', () => {
   });
 
   describe('Open Redirect protection', () => {
-    it('should prevent redirection to malicious external domains', () => {
+    it('should prevent redirection to malicious external domains via x-forwarded-host', () => {
       (mockRequest.headers.get as any).mockImplementation((header: string) => {
-        if (header === 'host') return 'malicious.com';
+        if (header === 'host') return 'example.com';
+        if (header === 'x-forwarded-host') return 'malicious.com';
         return null;
       });
 
       const originalUrl = new URL('http://localhost:3000/auth/callback');
       const result = correctOIDCUrl(mockRequest, originalUrl);
 
-      // Should return original URL and not redirect to malicious.com
-      expect(result).toBe(originalUrl);
-      expect(result.toString()).toBe('http://localhost:3000/auth/callback');
+      // Should fall back to host header and not redirect to malicious.com
+      expect(result.toString()).toBe('http://example.com:3000/auth/callback');
     });
 
     it('should allow redirection to configured domain (example.com)', () => {
@@ -410,9 +409,9 @@ describe('correctOIDCUrl', () => {
       const originalUrl = new URL('http://localhost:3000/auth/callback');
       const result = correctOIDCUrl(mockRequest, originalUrl);
 
-      // Should return original URL and not redirect to evil.com
-      expect(result).toBe(originalUrl);
-      expect(result.toString()).toBe('http://localhost:3000/auth/callback');
+      // Should fall back to request host (example.com) and not redirect to evil.com
+      expect(result.toString()).toBe('http://example.com:3000/auth/callback');
+      expect(result.hostname).not.toBe('evil.com');
     });
 
     it('should allow localhost in development environment', () => {
@@ -437,30 +436,92 @@ describe('correctOIDCUrl', () => {
       delete process.env.APP_URL;
 
       (mockRequest.headers.get as any).mockImplementation((header: string) => {
-        if (header === 'host') return 'any-domain.com';
+        if (header === 'host') return 'example.com';
+        if (header === 'x-forwarded-host') return 'any-domain.com';
         return null;
       });
 
       const originalUrl = new URL('http://localhost:3000/auth/callback');
       const result = correctOIDCUrl(mockRequest, originalUrl);
 
-      // Should return original URL when APP_URL is not configured
-      expect(result).toBe(originalUrl);
-      expect(result.toString()).toBe('http://localhost:3000/auth/callback');
+      // Should fall back to host header when APP_URL is not configured and forwarded host is present
+      expect(result.toString()).toBe('http://example.com:3000/auth/callback');
     });
 
     it('should handle domains that look like subdomains but are not', () => {
       (mockRequest.headers.get as any).mockImplementation((header: string) => {
-        if (header === 'host') return 'fakeexample.com'; // Not a subdomain of example.com
+        if (header === 'host') return 'example.com';
+        if (header === 'x-forwarded-host') return 'fakeexample.com'; // Not a subdomain of example.com
         return null;
       });
 
       const originalUrl = new URL('http://localhost:3000/auth/callback');
       const result = correctOIDCUrl(mockRequest, originalUrl);
 
-      // Should prevent redirection to fake domain
-      expect(result).toBe(originalUrl);
-      expect(result.toString()).toBe('http://localhost:3000/auth/callback');
+      // Should fall back to host header
+      expect(result.toString()).toBe('http://example.com:3000/auth/callback');
+    });
+
+    it('should reject invalid forwarded protocol', () => {
+      (mockRequest.headers.get as any).mockImplementation((header: string) => {
+        if (header === 'host') return 'example.com';
+        if (header === 'x-forwarded-host') return 'example.com';
+        if (header === 'x-forwarded-proto') return 'javascript'; // Invalid protocol
+        return null;
+      });
+
+      const originalUrl = new URL('http://localhost:3000/auth/callback');
+      const result = correctOIDCUrl(mockRequest, originalUrl);
+
+      // Should fall back to http protocol from URL
+      expect(result.protocol).toBe('http:');
+      expect(result.toString()).toBe('http://example.com:3000/auth/callback');
+    });
+
+    it('should handle uppercase in forwarded protocol', () => {
+      (mockRequest.headers.get as any).mockImplementation((header: string) => {
+        if (header === 'host') return 'example.com';
+        if (header === 'x-forwarded-host') return 'example.com';
+        if (header === 'x-forwarded-proto') return 'HTTPS'; // Uppercase
+        return null;
+      });
+
+      const originalUrl = new URL('http://localhost:3000/auth/callback');
+      const result = correctOIDCUrl(mockRequest, originalUrl);
+
+      // Should normalize to lowercase
+      expect(result.protocol).toBe('https:');
+      expect(result.toString()).toBe('https://example.com:3000/auth/callback');
+    });
+
+    it('should handle multiple hosts in x-forwarded-host', () => {
+      (mockRequest.headers.get as any).mockImplementation((header: string) => {
+        if (header === 'host') return 'internal.com';
+        if (header === 'x-forwarded-host') return 'example.com,attacker.com'; // Multiple hosts
+        return null;
+      });
+
+      const originalUrl = new URL('http://localhost:3000/auth/callback');
+      const result = correctOIDCUrl(mockRequest, originalUrl);
+
+      // Should use the first (leftmost) host
+      expect(result.hostname).toBe('example.com');
+      expect(result.toString()).toBe('http://example.com:3000/auth/callback');
+    });
+
+    it('should fall back to request host when forwarded host is invalid', () => {
+      (mockRequest.headers.get as any).mockImplementation((header: string) => {
+        if (header === 'host') return 'example.com';
+        if (header === 'x-forwarded-host') return 'evil.com'; // Invalid
+        return null;
+      });
+
+      const originalUrl = new URL('http://localhost:3000/auth/callback');
+      const result = correctOIDCUrl(mockRequest, originalUrl);
+
+      // Should fall back to request host
+      expect(result.hostname).toBe('example.com');
+      expect(result.toString()).toBe('http://example.com:3000/auth/callback');
     });
   });
 });