@memori.ai/memori-react 9.0.0-alpha.2 → 9.0.0-alpha.21

package/src/helpers/credits.ts

@@ -1,23 +1,37 @@
 // POST http://localhost:3000/api/verify-tokens operation=session_creation userID=585ec0ff-e805-495e-b8fc-5b0b8dd288ff tenant=aisuru-staging-tokenized.aclambda.online
+export type CreditsOperation =
+  | 'twin_creation'
+  | 'session_creation'
+  | 'import_document'
+  // accepted by the API and normalized to session_creation
+  | 'dt_session_creation';
+
 export const getCredits = async ({
   operation = 'session_creation',
   baseUrl,
   userID,
   userName,
   tenant,
+  characters,
 }: {
-  operation?: string;
+  operation?: CreditsOperation;
   baseUrl: string;
   userID?: string | null;
   userName?: string | null;
   tenant: string;
+  characters?: number;
 }): Promise<{
   enough: boolean;
   required: number;
+  tokens?: number;
 }> => {
   if (!userID && !userName) {
     throw new Error('Either userID or userName must be provided');
   }
+  if (operation === 'import_document' && characters == null) {
+    throw new Error('characters must be provided for import_document');
+  }
+
   const resp = await fetch(`${baseUrl}/api/verify-tokens`, {
     method: 'POST',
     headers: {
@@ -28,6 +42,7 @@ export const getCredits = async ({
       userID,
       userName,
       tenant,
+      ...(operation === 'import_document' ? { characters } : {}),
     }),
   });
 

package/src/helpers/media.test.ts

@@ -43,10 +43,46 @@ describe('Media URL helper', () => {
         resourceURI:
           'https://api.lorem.space/image/game?w=150&h=220&hash=8B7BCDC2',
         apiURL: 'https://backend.memori.ai/api/v2',
+        sessionID: sessionID,
       })
     ).toBe('https://api.lorem.space/image/game?w=150&h=220&hash=8B7BCDC2');
   });
 
+  it('appends session ID for aisuru.ai asset URLs', () => {
+    expect(
+      getResourceUrl({
+        resourceURI:
+          'https://backend-ws-bologna.aisuru.ai/api/v2/asset/ad10ce11-914b-4b9b-a033-ba06cb4b4042.pdf',
+        sessionID: sessionID,
+      })
+    ).toBe(
+      `https://backend-ws-bologna.aisuru.ai/api/v2/asset/ad10ce11-914b-4b9b-a033-ba06cb4b4042.pdf/${sessionID}`
+    );
+  });
+
+  it('appends session ID for /api/v2/asset/ paths on unknown hosts', () => {
+    expect(
+      getResourceUrl({
+        resourceURI:
+          'https://custom-backend.example.com/api/v2/asset/abc123.pdf',
+        sessionID: sessionID,
+      })
+    ).toBe(
+      `https://custom-backend.example.com/api/v2/asset/abc123.pdf/${sessionID}`
+    );
+  });
+
+  it('appends session ID when resource host matches apiURL host', () => {
+    expect(
+      getResourceUrl({
+        resourceURI: 'https://my-api.example.com/files/doc.pdf',
+        sessionID: sessionID,
+        apiURL: 'https://my-api.example.com/api/v2',
+      })
+    ).toBe(`https://my-api.example.com/files/doc.pdf/${sessionID}`);
+  });
+
+
   it('Get correct URL for old memoriai/memory media', async () => {
     expect(
       getResourceUrl({

package/src/helpers/media.ts

@@ -6,6 +6,38 @@ export interface ResourceURLParams {
   apiURL?: string;
   tenantID?: string;
 }
+
+/**
+ * Whether this HTTP(S) URL should get a session ID appended for auth.
+ * Matches Memori asset API paths on any host, known Memori/AIsuru hosts,
+ * and the configured API host — instead of a hard hostname allowlist only.
+ */
+const shouldAppendSessionId = (
+  resourceURI: string,
+  apiURL?: string
+): boolean => {
+  const url = new URL(resourceURI);
+  const { hostname, pathname } = url;
+
+  // Memori asset endpoints require session auth regardless of host
+  // (e.g. backend-ws-bologna.aisuru.ai/api/v2/asset/…)
+  if (/\/api\/v\d+\/asset\//i.test(pathname)) {
+    return true;
+  }
+
+  if (apiURL) {
+    try {
+      if (new URL(apiURL).hostname === hostname) {
+        return true;
+      }
+    } catch {
+      // ignore invalid apiURL
+    }
+  }
+
+  return false;
+};
+
 export const getResourceUrl = ({
   type,
   resourceURI,
@@ -30,21 +62,16 @@ export const getResourceUrl = ({
     } else if (
       (resourceURI.startsWith('https://') ||
         resourceURI.startsWith('http://')) &&
-      (new URL(resourceURI).hostname.includes('memori.ai') ||
-        new URL(resourceURI).hostname.includes('aclambda.online') ||
-        new URL(resourceURI).hostname.includes('localhost'))
+      shouldAppendSessionId(resourceURI, apiURL)
     ) {
-      return `${resourceURI}${
-        resourceURI.endsWith('/') || !sessionID ? '' : '/'
-      }${sessionID || ''}`;
+      return `${resourceURI}${resourceURI.endsWith('/') || !sessionID ? '' : '/'
+        }${sessionID || ''}`;
     } else if (resourceURI.startsWith('cloud://')) {
-      return `${
-        apiURL?.replace(/v2/, 'v1') || ''
-      }/CloudAsset/${resourceURI.replace('cloud://', '')}`;
+      return `${apiURL?.replace(/v2/, 'v1') || ''
+        }/CloudAsset/${resourceURI.replace('cloud://', '')}`;
     } else if (resourceURI.startsWith('guid://')) {
-      return `${
-        apiURL?.replace(/v2/, 'v1') || ''
-      }/GuidAsset/${resourceURI.replace('guid://', '')}`;
+      return `${apiURL?.replace(/v2/, 'v1') || ''
+        }/GuidAsset/${resourceURI.replace('guid://', '')}`;
     } else {
       return resourceURI || defaultUri;
     }

package/src/helpers/message.test.ts

@@ -1,4 +1,24 @@
-import { renderMsg, stripAttachmentTags, stripAllInternalTags } from './message';
+import {
+  renderMsg,
+  sanitizeMsg,
+  stripAttachmentTags,
+  stripAllInternalTags,
+} from './message';
+
+describe('sanitizeMsg', () => {
+  it('strips onerror from partner XSS img payload', () => {
+    const payload =
+      '<img src="immagine-inesistente.jpg" onerror="alert(\'XSS Eseguito!\')">';
+    const result = sanitizeMsg(payload);
+    expect(result).toBe('<img src="immagine-inesistente.jpg">');
+    expect(result).not.toMatch(/onerror/i);
+  });
+
+  it('strips svg onload handlers', () => {
+    const result = sanitizeMsg('<svg onload="alert(1)"></svg>');
+    expect(result).not.toMatch(/onload/i);
+  });
+});
 
 describe('renderMsg', () => {
   it('should render message with reasoning and output tag adjacent correctly', () => {
@@ -11,6 +31,13 @@ describe('renderMsg', () => {
       '<details class="memori-think"><summary>Reasoning...</summary>L\'utente vuole che io elenchi i parametri dell\'ALBERO ESISTENTE.</details>\n\n<output class="rails-query" style="display:none">\nproject = Project.find("68d99b05783713e16737d32b")\n</output>\n\n<p>Recupero tutti i 7 parametri dell\'ALBERO ESISTENTE...</p>'
     );
   });
+
+  it('strips onerror from XSS img payload in rendered output', () => {
+    const payload =
+      '<img src="immagine-inesistente.jpg" onerror="alert(\'XSS Eseguito!\')">';
+    const result = renderMsg(payload, false, 'Reasoning...', false);
+    expect(result.text).not.toMatch(/onerror/i);
+  });
 });
 
 describe('stripAttachmentTags', () => {

package/src/helpers/message.ts

@@ -85,6 +85,9 @@ export const truncateMessage = (message: string) => {
   return truncatedMessage;
 };
 
+export const sanitizeMsg = (msg: string) =>
+  DOMPurify.sanitize(msg, { ADD_ATTR: ['target'] });
+
 export const renderMsg = (
   text: string,
   useMathFormatting = false,
@@ -111,6 +114,21 @@ export const renderMsg = (
         /<output\s+class\s*=\s*["\']memori-artifact["\'][^>]*data-mimetype\s*=\s*["\']([^"']+)["\'][^>]*>([\s\S]*?)(?:<\/output>|$)/gi,
         ''
       )
+      // Preferred: data-action="update" on memori-artifact
+      .replaceAll(
+        /<output\s+class\s*=\s*["\']memori-artifact["\'][^>]*data-action\s*=\s*["\']update["\'][^>]*>([\s\S]*?)(?:<\/output>|$)/gi,
+        ''
+      )
+      // data-action may appear before class
+      .replaceAll(
+        /<output\s+[^>]*data-action\s*=\s*["\']update["\'][^>]*class\s*=\s*["\'][^"']*memori-artifact[^"']*["\'][^>]*>([\s\S]*?)(?:<\/output>|$)/gi,
+        ''
+      )
+      // Legacy class name
+      .replaceAll(
+        /<output\s+class\s*=\s*["\']memori-artifact-update["\'][^>]*>([\s\S]*?)(?:<\/output>|$)/gi,
+        ''
+      )
       .replaceAll(/```markdown([^```]+)```/g, '$1')
       .replaceAll('($', '( $')
       .replaceAll(':$', ': $')
@@ -196,9 +214,6 @@ export const renderMsg = (
     return { text: finalText };
   } catch (e) {
     console.error('Error rendering message:', e);
-    return { text };
+    return { text: sanitizeMsg(text) };
   }
 };
-
-export const sanitizeMsg = (msg: string) =>
-  DOMPurify.sanitize(msg, { ADD_ATTR: ['target'] });

package/src/helpers/nats/getNatsConfig.ts

@@ -0,0 +1,145 @@
+// helpers/nats/getNatsConfig.ts - Fetch NATS connection params (url + token)
+// from the backend, using the same baseUrl already used for /api/tts and /api/stt.
+
+/**
+ * Connection parameters returned by `GET /api/nats?sessionId=<uuid>`.
+ */
+export interface NatsConfig {
+  /** WebSocket URL of the NATS server (e.g. wss://nats.hz.slnode.net:8080). */
+  url: string;
+  /** Bearer token used to authenticate the WebSocket connection. */
+  token: string;
+  /**
+   * JetStream stream that stores session events. When set, the client consumes
+   * via JetStream instead of core NATS subscribe.
+   */
+  stream?: string;
+  /**
+   * Optional durable consumer name. When omitted, an ordered ephemeral consumer
+   * filtered to the session subject is used.
+   */
+  consumer?: string;
+  /**
+   * Subject to subscribe or filter on. Defaults to `sessions.<sessionId>` when omitted.
+   */
+  subject?: string;
+}
+
+function readStringField(
+  raw: Record<string, unknown>,
+  ...keys: string[]
+): string | undefined {
+  for (const key of keys) {
+    const value = raw[key];
+    if (typeof value === 'string' && value.length > 0) {
+      return value;
+    }
+  }
+  return undefined;
+}
+
+function readBooleanField(
+  raw: Record<string, unknown>,
+  ...keys: string[]
+): boolean | undefined {
+  for (const key of keys) {
+    const value = raw[key];
+    if (typeof value === 'boolean') {
+      return value;
+    }
+  }
+  return undefined;
+}
+
+/**
+ * Normalizes raw `/api/nats` payloads (camelCase or snake_case) into {@link NatsConfig}.
+ */
+export function parseNatsConfig(raw: Record<string, unknown>): NatsConfig {
+  const url = readStringField(raw, 'url');
+  const token = readStringField(raw, 'token');
+
+  if (!url || !token) {
+    throw new Error('Invalid response from NATS config service');
+  }
+
+  const useJetStream = readBooleanField(raw, 'useJetStream', 'use_jetstream');
+  const stream = readStringField(raw, 'stream', 'streamName', 'stream_name');
+  const consumer = readStringField(
+    raw,
+    'consumer',
+    'consumerName',
+    'consumer_name',
+    'durableName',
+    'durable_name'
+  );
+  const subject = readStringField(
+    raw,
+    'subject',
+    'filterSubject',
+    'filter_subject'
+  );
+
+  if (useJetStream && !stream) {
+    throw new Error('Invalid response from NATS config service: JetStream enabled but stream missing');
+  }
+
+  return {
+    url,
+    token,
+    ...(stream ? { stream } : {}),
+    ...(consumer ? { consumer } : {}),
+    ...(subject ? { subject } : {}),
+  };
+}
+
+/**
+ * Fetch the NATS connection config for a given session.
+ *
+ * Mirrors the error-handling style of the tts/stt helpers: the backend may
+ * answer with 400 (sessionId missing), 404 (invalid session) or 500 (NATS
+ * config missing). Any non-ok response throws with a descriptive message.
+ *
+ * @param baseUrl Same baseUrl used for `/api/tts` and `/api/stt`.
+ * @param sessionId Current session UUID.
+ * @param signal Optional AbortSignal to cancel the request.
+ */
+export async function getNatsConfig(
+  baseUrl: string,
+  sessionId: string,
+  signal?: AbortSignal
+): Promise<NatsConfig> {
+  if (!sessionId) {
+    throw new Error('Missing sessionId for NATS config request');
+  }
+
+  const response = await fetch(
+    `${baseUrl}/api/nats?sessionId=${encodeURIComponent(sessionId)}`,
+    { signal }
+  );
+
+  if (!response.ok) {
+    const errorData = await response.json().catch(() => ({} as any));
+
+    switch (response.status) {
+      case 400:
+        throw new Error(
+          errorData.error || 'NATS config error: missing sessionId'
+        );
+      case 404:
+        throw new Error(
+          errorData.error || 'NATS config error: invalid session'
+        );
+      case 500:
+        throw new Error(
+          errorData.error || 'NATS config error: NATS configuration missing'
+        );
+      default:
+        throw new Error(
+          errorData.error || `NATS config error: ${response.status}`
+        );
+    }
+  }
+
+  const data = (await response.json()) as Record<string, unknown>;
+  return parseNatsConfig(data);
+}

package/src/helpers/nats/isSessionExpiredError.test.ts

@@ -0,0 +1,38 @@
+import {
+  isSessionExpiredNatsError,
+  isSessionExpiredNatsResponse,
+} from './isSessionExpiredError';
+
+describe('isSessionExpiredNatsError', () => {
+  it('detects session not found from EnterTextAsync NATS error', () => {
+    expect(
+      isSessionExpiredNatsError({
+        eventType: 'error',
+        errorCode: 'EnterTextAsync Error',
+        errorMessage:
+          'Session with ID "c681a10b-37c1-4783-af3b-ecb592b93036" not found',
+        correlationID: 'f85a6882-92e1-4e18-9fb7-29d3bc06fd7b',
+      })
+    ).toBe(true);
+  });
+
+  it('detects SESSION_EXPIRED result code on dialog response', () => {
+    expect(
+      isSessionExpiredNatsResponse({
+        eventType: 'dialog_text_entered_response',
+        resultCode: -103,
+        correlationID: 'abc',
+      })
+    ).toBe(true);
+  });
+
+  it('ignores unrelated NATS errors', () => {
+    expect(
+      isSessionExpiredNatsError({
+        eventType: 'error',
+        errorCode: 'SomeOtherError',
+        errorMessage: 'Something went wrong',
+      })
+    ).toBe(false);
+  });
+});

package/src/helpers/nats/isSessionExpiredError.ts

@@ -0,0 +1,51 @@
+import type {
+  NatsDialogResponseEvent,
+  NatsErrorEvent,
+} from './useNatsSession';
+
+/** Backend result codes for missing / expired sessions. */
+const SESSION_NOT_FOUND = -101;
+const SESSION_EXPIRED = -103;
+
+const SESSION_NOT_FOUND_MESSAGE =
+  /session\s+with\s+id\s+["']?[^"']+["']?\s+not\s+found/i;
+
+function isExpiredResultCode(resultCode?: number): boolean {
+  return (
+    resultCode === 404 ||
+    resultCode === SESSION_EXPIRED ||
+    resultCode === SESSION_NOT_FOUND
+  );
+}
+
+function isExpiredErrorMessage(message?: string): boolean {
+  if (!message) return false;
+  return SESSION_NOT_FOUND_MESSAGE.test(message);
+}
+
+/** True when a NATS `error` event indicates the active session is gone or expired. */
+export function isSessionExpiredNatsError(event: NatsErrorEvent): boolean {
+  if (isExpiredResultCode(event.errorCode as number | undefined)) {
+    return true;
+  }
+
+  if (typeof event.errorCode === 'string') {
+    const code = event.errorCode.toUpperCase();
+    if (code.includes('SESSION_EXPIRED') || code.includes('SESSION_NOT_FOUND')) {
+      return true;
+    }
+  }
+
+  return isExpiredErrorMessage(event.errorMessage);
+}
+
+/** True when a NATS dialog response reports a missing or expired session. */
+export function isSessionExpiredNatsResponse(
+  event: NatsDialogResponseEvent
+): boolean {
+  if (isExpiredResultCode(event.resultCode)) {
+    return true;
+  }
+
+  return isExpiredErrorMessage(event.resultMessage);
+}

package/src/helpers/nats/useNats.ts

@@ -0,0 +1,124 @@
+// helpers/nats/useNats.ts - Orchestrates NATS config retrieval + subscription.
+//
+// Additive to the existing HTTP flow: text is sent via `postEnterTextAsync`;
+// this hook *receives* asynchronous events on the session channel (progress /
+// dialog.text_entered_response / error).
+import { useEffect, useRef, useState, useCallback } from 'react';
+import { getNatsConfig, NatsConfig } from './getNatsConfig';
+import {
+  useNatsSession,
+  NatsSessionEvent,
+  NatsProgressEvent,
+  NatsDialogResponseEvent,
+  NatsErrorEvent,
+} from './useNatsSession';
+
+export interface UseNatsOptions {
+  /** Same baseUrl used for /api/tts and /api/stt. */
+  baseUrl: string;
+  /** Current session UUID. Subscription is skipped while undefined. */
+  sessionId?: string;
+  /** `progress` events (e.g. to feed the typing indicator). */
+  onProgress?: (event: NatsProgressEvent) => void;
+  /** `dialog.text_entered_response` events (optional live updates). */
+  onDialogResponse?: (event: NatsDialogResponseEvent) => void;
+  /** `error` events (logging / user notification). */
+  onError?: (event: NatsErrorEvent) => void;
+}
+
+/**
+ * Subscribe to the NATS session channel and dispatch decoded events to the
+ * provided callbacks. Config is fetched from `/api/nats`; the subscription
+ * lifecycle (cleanup on unmount, reconnect on sessionId change) is handled by
+ * `useNatsSession`.
+ */
+export function useNats({
+  baseUrl,
+  sessionId,
+  onProgress,
+  onDialogResponse,
+  onError,
+}: UseNatsOptions) {
+  const [config, setConfig] = useState<NatsConfig | null>(null);
+  const [configError, setConfigError] = useState<Error | null>(null);
+
+  // Keep callbacks in refs so the dispatcher identity stays stable.
+  const onProgressRef = useRef(onProgress);
+  const onDialogResponseRef = useRef(onDialogResponse);
+  const onErrorRef = useRef(onError);
+  useEffect(() => {
+    onProgressRef.current = onProgress;
+    onDialogResponseRef.current = onDialogResponse;
+    onErrorRef.current = onError;
+  }, [onProgress, onDialogResponse, onError]);
+
+  // Fetch connection config whenever the active session changes.
+  useEffect(() => {
+    if (!sessionId) {
+      console.debug('[NATS] no sessionId, skipping config fetch');
+      setConfig(null);
+      setConfigError(null);
+      return;
+    }
+
+    const controller = new AbortController();
+    let cancelled = false;
+
+    console.info(
+      '[NATS] fetching config from',
+      `${baseUrl}/api/nats`,
+      'for session',
+      sessionId
+    );
+    getNatsConfig(baseUrl, sessionId, controller.signal)
+      .then(cfg => {
+        if (!cancelled) {
+          console.info('[NATS] config received', {
+            url: cfg.url,
+            jetStream: !!cfg.stream,
+            stream: cfg.stream,
+          });
+          setConfig(cfg);
+          setConfigError(null);
+        }
+      })
+      .catch(err => {
+        if (!cancelled && err?.name !== 'AbortError') {
+          console.error('[NATS] config error', err);
+          setConfig(null);
+          setConfigError(err instanceof Error ? err : new Error(String(err)));
+        }
+      });
+
+    return () => {
+      cancelled = true;
+      controller.abort();
+    };
+  }, [baseUrl, sessionId]);
+
+  const handleMessage = useCallback((event: NatsSessionEvent) => {
+    console.debug('[NATS] dispatching event', { eventType: event.eventType });
+    switch (event.eventType) {
+      case 'progress':
+        onProgressRef.current?.(event);
+        break;
+      case 'dialog_text_entered_response':
+        onDialogResponseRef.current?.(event);
+        break;
+      case 'error':
+        onErrorRef.current?.(event);
+        break;
+      default:
+        console.warn('Unknown NATS event', event);
+    }
+  }, []);
+
+  useNatsSession(sessionId, config ?? undefined, handleMessage);
+
+  return {
+    /** True once connection config has been retrieved. */
+    connected: !!config,
+    /** Last config-retrieval error, if any. */
+    configError,
+  };
+}