@musnows/scriverse 0.5.1 → 0.5.3

package/dist/app.js

@@ -28,7 +28,7 @@ import { currentRequestActor, runWithRequestActor } from "./request-context.js";
 import { APP_VERSION } from "./version.js";
 import { fullWorkModulePermissions, proseReplacementPermissionModules } from "./work-permissions.js";
 import { CollaborationPresence, editorPageKey, entityEditorPageKey, modulePageKey, pageLabelForKey, presencePageKinds } from "./collaboration-presence.js";
-import { clearSessionCookie, createCliApiScopeMiddleware, createUserSessionMiddleware, createWorkAuthorizationMiddleware, setSessionCookie, UserAuthService } from "./user-auth.js";
+import { clearSessionCookie, createCliApiScopeMiddleware, createUserSessionMiddleware, createWorkAuthorizationMiddleware, relationshipAnalysisReadModules, setSessionCookie, UserAuthService } from "./user-auth.js";
 const nonEmpty = z.string().trim().min(1);
 const identifier = z.string().trim().min(1).max(200);
 const optionalStrings = z.array(z.string()).optional();
@@ -358,7 +358,7 @@ const contextSchema = z.object({
 });
 const analysisTaskTypeSchema = z.enum(["structure", "chapter-analysis", "character-extraction", "character-summary", "character-identity-audit", "timeline-analysis", "worldview-analysis", "setting-extraction", "consistency-check", "report-update", "book-analysis"]);
 const relationshipAnalysisScopeSchema = z.object({
-    type: z.enum(["chapter", "book"]),
+    type: z.enum(["chapter", "book", "settings"]),
     chapterId: identifier.optional(),
     includeAllSettings: z.boolean().optional(),
     additionalPrompt: z.string().trim().max(10_000).optional(),
@@ -379,8 +379,8 @@ const relationshipAnalysisScopeSchema = z.object({
     }
 });
 const analysisTaskSchema = z.union([
-    z.object({ taskType: z.literal("relationship-analysis"), scope: relationshipAnalysisScopeSchema.optional() }).strict(),
-    z.object({ taskType: analysisTaskTypeSchema, scope: jsonObject.optional() }).strict().superRefine((input, context) => {
+    z.object({ taskType: z.literal("relationship-analysis"), scope: relationshipAnalysisScopeSchema.optional(), modelId: identifier.optional() }).strict(),
+    z.object({ taskType: analysisTaskTypeSchema, scope: jsonObject.optional(), modelId: identifier.optional() }).strict().superRefine((input, context) => {
         if (input.scope?.includeAllSettings !== undefined) {
             context.addIssue({ code: z.ZodIssueCode.custom, path: ["scope", "includeAllSettings"], message: "包含所有设定仅支持人物关系分析" });
         }
@@ -434,16 +434,84 @@ function redactRaceMembers(record, permissions) {
 function redactOrganizationMembers(record, permissions) {
     return permissions.characters === "none" ? { ...record, memberIds: [], members: [] } : record;
 }
+const taskResultPermissionModules = {
+    "chapter-analysis": "prose",
+    "character-extraction": "characters",
+    "character-summary": "characters",
+    "character-identity-audit": "reviews",
+    "timeline-analysis": "timeline",
+    "relationship-analysis": "relationships",
+    "worldview-analysis": "settings",
+    "setting-extraction": "settings",
+    "consistency-check": "reviews",
+    "book-analysis": "prose",
+    structure: "outlines",
+    "report-update": "prose"
+};
+function requiredTaskResultModule(taskType) {
+    return taskResultPermissionModules[String(taskType)];
+}
 function redactTaskCharacterNames(record, permissions) {
     const { scopeSummaryWithoutCharacterNames, ...result } = record;
-    if (permissions.characters !== "none")
-        return result;
-    if (typeof scopeSummaryWithoutCharacterNames === "string")
-        result.scopeSummary = scopeSummaryWithoutCharacterNames;
-    const scope = recordValue(result.scope);
-    if (scope) {
-        const { targetCharacters: _targetCharacters, ...redactedScope } = scope;
-        result.scope = redactedScope;
+    const proseRestricted = permissions.prose === "none";
+    const proseScope = recordValue(result.scope);
+    const selectionScopeRestricted = proseRestricted
+        && (proseScope?.type === "selection" || String(result.scopeSummary ?? "").startsWith("选定内容："));
+    if (selectionScopeRestricted) {
+        if (proseScope) {
+            const { selection: _selection, ...redactedScope } = proseScope;
+            result.scope = redactedScope;
+        }
+        result.scopeSummary = "选定内容（正文读取权限受限）";
+        if (Array.isArray(result.scopeDetails)) {
+            result.scopeDetails = result.scopeDetails.map((item) => {
+                const detail = recordValue(item);
+                return detail?.type === "selection" ? { type: "selection", restricted: true } : item;
+            });
+        }
+    }
+    const characterRestricted = permissions.characters === "none";
+    if (characterRestricted) {
+        if (!selectionScopeRestricted && typeof scopeSummaryWithoutCharacterNames === "string")
+            result.scopeSummary = scopeSummaryWithoutCharacterNames;
+        const scope = recordValue(result.scope);
+        if (scope) {
+            const { targetCharacters: _targetCharacters, ...redactedScope } = scope;
+            result.scope = redactedScope;
+        }
+        const taskResult = recordValue(result.result);
+        if (taskResult) {
+            const redactedTaskResult = { ...taskResult };
+            if (Array.isArray(taskResult.relationshipResults)) {
+                redactedTaskResult.relationshipResults = taskResult.relationshipResults.map((value) => {
+                    const relationship = recordValue(value);
+                    if (!relationship)
+                        return value;
+                    const { fromCharacterName: _fromCharacterName, toCharacterName: _toCharacterName, ...redactedRelationship } = relationship;
+                    return redactedRelationship;
+                });
+            }
+            const analysisTarget = recordValue(taskResult.analysisTarget);
+            if (analysisTarget) {
+                const { characterNames: _characterNames, ...redactedAnalysisTarget } = analysisTarget;
+                redactedTaskResult.analysisTarget = redactedAnalysisTarget;
+            }
+            result.result = redactedTaskResult;
+        }
+    }
+    const resultSummary = recordValue(result.resultSummary);
+    const characterSensitiveTask = ["character-extraction", "character-summary", "character-identity-audit", "relationship-analysis"]
+        .includes(String(result.taskType));
+    const requiredResultModule = requiredTaskResultModule(result.taskType);
+    const resultRestricted = requiredResultModule !== undefined && permissions[requiredResultModule] === "none";
+    if (resultSummary && (resultRestricted || (characterRestricted && characterSensitiveTask))) {
+        result.resultSummary = {
+            ...resultSummary,
+            analysisContent: `${String(resultSummary.title ?? "AI 分析")}；范围：${String(result.scopeSummary ?? "未指定")}`,
+            summary: "当前账号缺少相关资料的读取权限，无法展示对应的可读结论。",
+            sections: [],
+            restricted: true
+        };
     }
     return result;
 }
@@ -502,7 +570,24 @@ export function createRuntime(options) {
         return auth.workModulePermissions(request.authUser, resolvedWorkId, request.authMethod !== "api-key") ?? fullWorkModulePermissions();
     };
     const captcha = new ImageCaptchaService({ revealAnswer: options.revealCaptchaAnswer === true });
-    const ai = new AiManager(store, new CredentialVault(options.masterSecret), options.fetchImpl ?? fetch, options.security ? (url) => assertSafeAiEndpoint(url, options.security?.allowPrivateAiEndpoints) : undefined);
+    const ai = new AiManager(store, new CredentialVault(options.masterSecret), options.fetchImpl ?? fetch, options.security ? (url) => assertSafeAiEndpoint(url, options.security?.allowPrivateAiEndpoints) : undefined, (task, actor) => {
+        if (task.taskType !== "relationship-analysis")
+            return;
+        const requiredModules = relationshipAnalysisReadModules(task.scope);
+        if (requiredModules.length === 0)
+            return;
+        const creator = actor ? null : database.get("SELECT created_by_user_id FROM analysis_tasks WHERE id = ?", String(task.id));
+        const userId = actor?.userId ?? (typeof creator?.created_by_user_id === "string" ? creator.created_by_user_id : null);
+        if (!userId)
+            return;
+        const user = auth.getUser(userId);
+        if (user.status !== "active")
+            throw new AppError(403, "WORK_ACCESS_DENIED", "任务创建者已无法访问这部作品");
+        auth.assertWorkAccess(user, String(task.workId), {
+            read: requiredModules,
+            write: ["ai-analysis"]
+        }, false, actor?.allowAdminAccess ?? false);
+    });
     const app = express();
     const upload = multer({
         storage: multer.memoryStorage(),
@@ -1349,20 +1434,54 @@ export function createRuntime(options) {
     });
     app.post("/api/works/:workId/tasks", (request, response) => {
         const input = parse(analysisTaskSchema, request.body);
-        data(response, redactTaskCharacterNames(store.createTask(request.params.workId, input), requestPermissions(request, request.params.workId)), 201);
+        data(response, redactTaskCharacterNames(ai.createTask(request.params.workId, input), requestPermissions(request, request.params.workId)), 201);
     });
     app.post("/api/works/:workId/tasks/auto-run", (request, response) => {
+        const permissions = requestPermissions(request, request.params.workId);
+        for (const taskId of store.listOldestPendingTaskIds(request.params.workId, store.countPendingTasks(request.params.workId))) {
+            const task = store.getTask(taskId);
+            if (task.taskType !== "relationship-analysis")
+                continue;
+            const deniedModules = relationshipAnalysisReadModules(task.scope).filter((module) => permissions[module] === "none");
+            if (deniedModules.length > 0) {
+                throw new AppError(403, "WORK_MODULE_READ_DENIED", "你没有读取待运行定向人物关系分析所需资料模块的权限", {
+                    taskId,
+                    modules: deniedModules
+                });
+            }
+        }
         data(response, ai.startAutoRunBatch(request.params.workId));
     });
+    app.get("/api/tasks/:taskId/detail", (request, response) => data(response, redactTaskCharacterNames(store.getTaskDetail(request.params.taskId), requestPermissions(request))));
+    app.get("/api/tasks/:taskId/result", (request, response) => {
+        const task = store.getTaskResultPayload(request.params.taskId);
+        const permissions = requestPermissions(request);
+        const requiredModule = requiredTaskResultModule(task.taskType);
+        if (requiredModule && permissions[requiredModule] === "none") {
+            throw new AppError(403, "WORK_MODULE_READ_DENIED", "你没有读取该分析结果对应资料模块的权限");
+        }
+        const redacted = redactTaskCharacterNames(task, permissions);
+        data(response, { taskId: task.id, result: redacted.result });
+    });
     app.get("/api/tasks/:taskId", (request, response) => data(response, redactTaskCharacterNames(store.getTask(request.params.taskId), requestPermissions(request))));
     app.get("/api/tasks/:taskId/trace", (request, response) => data(response, ai.getTaskTrace(request.params.taskId)));
-    app.get("/api/tasks/:taskId/trace/calls/:callId", (request, response) => {
-        const full = parse(z.enum(["true", "false"]).default("false"), request.query.full ?? "false") === "true";
-        data(response, ai.getTaskTraceCall(request.params.taskId, request.params.callId, full));
-    });
+    app.get("/api/tasks/:taskId/trace/calls/:callId", (request, response) => data(response, ai.getTaskTraceCall(request.params.taskId, request.params.callId)));
     app.post("/api/tasks/:taskId/run", async (request, response) => {
         const input = parse(z.object({ modelId: identifier.optional() }), request.body ?? {});
-        data(response, redactTaskCharacterNames(await ai.runTask(request.params.taskId, input.modelId), requestPermissions(request)));
+        const task = store.getTask(request.params.taskId);
+        if (task.taskType === "relationship-analysis") {
+            const permissions = requestPermissions(request, String(task.workId));
+            const deniedModules = relationshipAnalysisReadModules(task.scope).filter((module) => permissions[module] === "none");
+            if (deniedModules.length > 0) {
+                throw new AppError(403, "WORK_MODULE_READ_DENIED", "你没有读取本次定向人物关系分析所需资料模块的权限", {
+                    modules: deniedModules
+                });
+            }
+        }
+        data(response, redactTaskCharacterNames(await ai.runTask(request.params.taskId, input.modelId, request.authUser ? {
+            userId: request.authUser.userId,
+            allowAdminAccess: request.authMethod !== "api-key"
+        } : undefined), requestPermissions(request)));
     });
     app.post("/api/tasks/:taskId/cancel", (request, response) => data(response, redactTaskCharacterNames(ai.cancelTask(request.params.taskId), requestPermissions(request))));
     app.get("/api/platform/ai/providers", (request, response) => {