@musnows/scriverse 0.3.10 → 0.4.0

package/dist/app.js

@@ -3,7 +3,7 @@ import multer from "multer";
 import mammoth from "mammoth";
 import { randomUUID } from "node:crypto";
 import { dirname, extname, join } from "node:path";
-import { mkdtempSync, mkdirSync, readFileSync, rmSync } from "node:fs";
+import { existsSync, mkdtempSync, mkdirSync, readFileSync, rmSync } from "node:fs";
 import { rm } from "node:fs/promises";
 import { tmpdir } from "node:os";
 import { z, ZodError } from "zod";
@@ -26,7 +26,7 @@ import { createRequestLoggingMiddleware, sanitizeRequestPath } from "./http-logg
 import { accountReference, logger, sanitizeError } from "./logger.js";
 import { runWithRequestActor } from "./request-context.js";
 import { APP_VERSION } from "./version.js";
-import { fullWorkModulePermissions } from "./work-permissions.js";
+import { fullWorkModulePermissions, proseReplacementPermissionModules } from "./work-permissions.js";
 import { clearSessionCookie, createCliApiScopeMiddleware, createUserSessionMiddleware, createWorkAuthorizationMiddleware, setSessionCookie, UserAuthService } from "./user-auth.js";
 const nonEmpty = z.string().trim().min(1);
 const identifier = z.string().trim().min(1).max(200);
@@ -35,6 +35,7 @@ const jsonObject = z.record(z.string(), z.unknown());
 const chapterTypeSchema = z.enum(["正文", "设定", "作者的话", "其他"]);
 const versionedEntityTypeSchema = z.enum(versionedEntityTypes);
 const maximumImportedTextLength = 20_000_000;
+const maximumKnowledgeSectionsLength = 4_000_000;
 const captchaFields = {
     captchaId: z.string().trim().min(1).max(200),
     captchaAnswer: z.string().trim().min(1).max(16)
@@ -68,7 +69,8 @@ const modulePermissionsSchema = z.object({
     relationships: moduleAccessSchema,
     outlines: moduleAccessSchema,
     reviews: moduleAccessSchema,
-    ai: moduleAccessSchema,
+    "ai-chat": moduleAccessSchema,
+    "ai-analysis": moduleAccessSchema,
     "ai-settings": moduleAccessSchema
 }).strict();
 const memberSchema = z.union([
@@ -80,7 +82,10 @@ const memberPermissionSchema = z.union([
     z.object({ role: memberRoleValueSchema }).strict()
 ]);
 const profileSchema = z.object({ displayName: z.string().trim().min(1).max(80) }).strict();
-const passwordChangeSchema = z.object({ currentPassword: z.string().max(200), newPassword: passwordSchema }).strict();
+const passwordChangeSchema = z.object({ currentPassword: z.string().max(200), newPassword: passwordSchema, passwordConfirmation: passwordSchema }).strict().refine((input) => input.newPassword === input.passwordConfirmation, {
+    path: ["passwordConfirmation"],
+    message: "两次输入的密码不一致"
+});
 const changeNoteSchema = z.string().trim().max(500).optional();
 const expectedVersionNoSchema = z.coerce.number().int().positive().optional();
 function validateImportedText(text) {
@@ -192,10 +197,24 @@ const relationshipSchema = z.object({
     confirmationStatus: z.enum(["pending", "confirmed", "rejected"]).optional(),
     locked: z.boolean().optional()
 });
+const knowledgeSectionSchema = z.object({
+    title: nonEmpty.max(200),
+    contentMarkdown: z.string().max(200_000).optional(),
+    summary: z.string().max(100_000).optional(),
+    sortOrder: z.number().int().min(0).max(100_000).optional()
+}).strict();
+const knowledgeSectionsSchema = knowledgeSectionSchema.array().max(200).superRefine((sections, context) => {
+    const totalLength = sections.reduce((total, section) => total + (section.contentMarkdown?.length ?? 0) + (section.summary?.length ?? 0), 0);
+    if (totalLength > maximumKnowledgeSectionsLength) {
+        context.addIssue({ code: z.ZodIssueCode.custom, message: "Markdown 章节总长度不能超过 4000000 个字符" });
+    }
+});
 const organizationSchema = z.object({
     name: nonEmpty.max(200),
     description: z.string().max(100_000).optional(),
     settings: z.array(z.string().trim().min(1).max(20_000)).max(200).optional(),
+    settingsMarkdown: z.string().max(200_000).optional(),
+    settingsSections: knowledgeSectionsSchema.optional(),
     memberIds: z.array(identifier).max(1000).optional()
 }).strict();
 const raceSchema = z.object({
@@ -203,6 +222,8 @@ const raceSchema = z.object({
     parentRaceId: identifier.nullable().optional(),
     description: z.string().max(100_000).optional(),
     settings: z.array(z.string().trim().min(1).max(20_000)).max(200).optional(),
+    settingsMarkdown: z.string().max(200_000).optional(),
+    settingsSections: knowledgeSectionsSchema.optional(),
     memberIds: z.array(identifier).max(1000).optional()
 }).strict();
 const chapterOutlineSchema = z.object({
@@ -379,6 +400,7 @@ export function createRuntime(options) {
         databasePath: options.databasePath,
         serveUi: options.serveUi ?? true,
         userAuthDisabled: options.disableUserAuth === true,
+        devAuthBypass: options.devAuthBypass === true,
         deploymentAuthEnabled: Boolean(options.security?.auth),
         sameOriginEnforced: options.security?.enforceSameOrigin ?? true
     });
@@ -389,6 +411,9 @@ export function createRuntime(options) {
     const attachmentStorage = new AttachmentStorage(options.attachmentDirectory ?? temporaryAttachmentRoot ?? join(dirname(options.databasePath), "attachments"));
     mkdirSync(attachmentStorage.temporaryDirectory, { recursive: true, mode: 0o700 });
     const auth = new UserAuthService(database);
+    const getDevelopmentUser = () => options.devAuthBypass
+        ? auth.listUsers().find((user) => user.status === "active") ?? null
+        : null;
     const store = new Store(database);
     const requestPermissions = (request, workId) => {
         if (!request.authUser)
@@ -438,6 +463,11 @@ export function createRuntime(options) {
     app.get("/api/auth/session", (request, response) => {
         const session = auth.authenticate(request);
         const registrationOpen = options.security?.allowRegistration === true;
+        const developmentUser = getDevelopmentUser();
+        if (!session && developmentUser) {
+            data(response, { authenticated: true, user: developmentUser, csrfToken: null, setupRequired: false, registrationOpen });
+            return;
+        }
         data(response, session
             ? { authenticated: true, user: session.user, csrfToken: session.csrfToken, setupRequired: false, registrationOpen }
             : { authenticated: false, user: null, csrfToken: null, setupRequired: !auth.hasUsers(), registrationOpen });
@@ -697,11 +727,14 @@ export function createRuntime(options) {
         if (extension !== ".txt" && extension !== ".docx") {
             throw new AppError(415, "UNSUPPORTED_FILE", "MVP 仅支持 TXT 和 DOCX 导入");
         }
+        const mode = parse(z.enum(["append", "overwrite"]), request.body.mode ?? "overwrite");
+        if (mode === "overwrite" && request.authUser) {
+            auth.assertWorkAccess(request.authUser, String(request.params.workId), { write: proseReplacementPermissionModules }, false, request.authMethod !== "api-key");
+        }
         const text = validateImportedText(extension === ".docx"
             ? await extractDocxText(request.file.buffer)
             : decodeUtf8ImportedText(request.file.buffer));
         const parsed = applyImportFileHints(parseNovelText(text), originalFileName);
-        const mode = parse(z.enum(["append", "overwrite"]), request.body.mode ?? "overwrite");
         const expectedVersionNo = parse(expectedVersionNoSchema, request.body.expectedVersionNo);
         data(response, store.importNovel(String(request.params.workId), originalFileName, extension.slice(1), parsed, mode, expectedVersionNo), 201);
     });
@@ -1129,7 +1162,10 @@ export function createRuntime(options) {
     });
     app.get("/api/works/:workId/tasks", (request, response) => {
         const pagination = parsePagination(request.query);
-        data(response, pagination ? store.listTasksPage(request.params.workId, pagination) : store.listTasks(request.params.workId));
+        const summary = request.query.view === "summary";
+        data(response, pagination
+            ? (summary ? store.listTaskSummariesPage(request.params.workId, pagination) : store.listTasksPage(request.params.workId, pagination))
+            : store.listTasks(request.params.workId));
     });
     app.post("/api/works/:workId/tasks", (request, response) => {
         const input = parse(z.object({ taskType: z.enum(["structure", "chapter-analysis", "character-extraction", "character-summary", "character-identity-audit", "timeline-analysis", "relationship-analysis", "worldview-analysis", "setting-extraction", "consistency-check", "report-update", "book-analysis"]), scope: jsonObject.optional() }), request.body);
@@ -1436,6 +1472,14 @@ export function createRuntime(options) {
             response.type("text/html").send(html);
         };
         app.get(["/", "/index.html"], sendIndexHtml);
+        const vditorPath = join(process.cwd(), "node_modules", "vditor", "dist");
+        if (existsSync(vditorPath)) {
+            app.use("/vendor/vditor/dist", express.static(vditorPath, {
+                index: false,
+                maxAge: 0,
+                setHeaders: (response) => response.setHeader("Cache-Control", "no-store")
+            }));
+        }
         app.use(express.static(publicPath, {
             index: false,
             maxAge: 0,