@musnows/scriverse 0.5.2 → 0.5.3

package/dist/app.js

@@ -28,7 +28,7 @@ import { currentRequestActor, runWithRequestActor } from "./request-context.js";
 import { APP_VERSION } from "./version.js";
 import { fullWorkModulePermissions, proseReplacementPermissionModules } from "./work-permissions.js";
 import { CollaborationPresence, editorPageKey, entityEditorPageKey, modulePageKey, pageLabelForKey, presencePageKinds } from "./collaboration-presence.js";
-import { clearSessionCookie, createCliApiScopeMiddleware, createUserSessionMiddleware, createWorkAuthorizationMiddleware, setSessionCookie, UserAuthService } from "./user-auth.js";
+import { clearSessionCookie, createCliApiScopeMiddleware, createUserSessionMiddleware, createWorkAuthorizationMiddleware, relationshipAnalysisReadModules, setSessionCookie, UserAuthService } from "./user-auth.js";
 const nonEmpty = z.string().trim().min(1);
 const identifier = z.string().trim().min(1).max(200);
 const optionalStrings = z.array(z.string()).optional();
@@ -379,8 +379,8 @@ const relationshipAnalysisScopeSchema = z.object({
     }
 });
 const analysisTaskSchema = z.union([
-    z.object({ taskType: z.literal("relationship-analysis"), scope: relationshipAnalysisScopeSchema.optional() }).strict(),
-    z.object({ taskType: analysisTaskTypeSchema, scope: jsonObject.optional() }).strict().superRefine((input, context) => {
+    z.object({ taskType: z.literal("relationship-analysis"), scope: relationshipAnalysisScopeSchema.optional(), modelId: identifier.optional() }).strict(),
+    z.object({ taskType: analysisTaskTypeSchema, scope: jsonObject.optional(), modelId: identifier.optional() }).strict().superRefine((input, context) => {
         if (input.scope?.includeAllSettings !== undefined) {
             context.addIssue({ code: z.ZodIssueCode.custom, path: ["scope", "includeAllSettings"], message: "包含所有设定仅支持人物关系分析" });
         }
@@ -570,7 +570,24 @@ export function createRuntime(options) {
         return auth.workModulePermissions(request.authUser, resolvedWorkId, request.authMethod !== "api-key") ?? fullWorkModulePermissions();
     };
     const captcha = new ImageCaptchaService({ revealAnswer: options.revealCaptchaAnswer === true });
-    const ai = new AiManager(store, new CredentialVault(options.masterSecret), options.fetchImpl ?? fetch, options.security ? (url) => assertSafeAiEndpoint(url, options.security?.allowPrivateAiEndpoints) : undefined);
+    const ai = new AiManager(store, new CredentialVault(options.masterSecret), options.fetchImpl ?? fetch, options.security ? (url) => assertSafeAiEndpoint(url, options.security?.allowPrivateAiEndpoints) : undefined, (task, actor) => {
+        if (task.taskType !== "relationship-analysis")
+            return;
+        const requiredModules = relationshipAnalysisReadModules(task.scope);
+        if (requiredModules.length === 0)
+            return;
+        const creator = actor ? null : database.get("SELECT created_by_user_id FROM analysis_tasks WHERE id = ?", String(task.id));
+        const userId = actor?.userId ?? (typeof creator?.created_by_user_id === "string" ? creator.created_by_user_id : null);
+        if (!userId)
+            return;
+        const user = auth.getUser(userId);
+        if (user.status !== "active")
+            throw new AppError(403, "WORK_ACCESS_DENIED", "任务创建者已无法访问这部作品");
+        auth.assertWorkAccess(user, String(task.workId), {
+            read: requiredModules,
+            write: ["ai-analysis"]
+        }, false, actor?.allowAdminAccess ?? false);
+    });
     const app = express();
     const upload = multer({
         storage: multer.memoryStorage(),
@@ -1417,9 +1434,22 @@ export function createRuntime(options) {
     });
     app.post("/api/works/:workId/tasks", (request, response) => {
         const input = parse(analysisTaskSchema, request.body);
-        data(response, redactTaskCharacterNames(store.createTask(request.params.workId, input), requestPermissions(request, request.params.workId)), 201);
+        data(response, redactTaskCharacterNames(ai.createTask(request.params.workId, input), requestPermissions(request, request.params.workId)), 201);
     });
     app.post("/api/works/:workId/tasks/auto-run", (request, response) => {
+        const permissions = requestPermissions(request, request.params.workId);
+        for (const taskId of store.listOldestPendingTaskIds(request.params.workId, store.countPendingTasks(request.params.workId))) {
+            const task = store.getTask(taskId);
+            if (task.taskType !== "relationship-analysis")
+                continue;
+            const deniedModules = relationshipAnalysisReadModules(task.scope).filter((module) => permissions[module] === "none");
+            if (deniedModules.length > 0) {
+                throw new AppError(403, "WORK_MODULE_READ_DENIED", "你没有读取待运行定向人物关系分析所需资料模块的权限", {
+                    taskId,
+                    modules: deniedModules
+                });
+            }
+        }
         data(response, ai.startAutoRunBatch(request.params.workId));
     });
     app.get("/api/tasks/:taskId/detail", (request, response) => data(response, redactTaskCharacterNames(store.getTaskDetail(request.params.taskId), requestPermissions(request))));
@@ -1438,7 +1468,20 @@ export function createRuntime(options) {
     app.get("/api/tasks/:taskId/trace/calls/:callId", (request, response) => data(response, ai.getTaskTraceCall(request.params.taskId, request.params.callId)));
     app.post("/api/tasks/:taskId/run", async (request, response) => {
         const input = parse(z.object({ modelId: identifier.optional() }), request.body ?? {});
-        data(response, redactTaskCharacterNames(await ai.runTask(request.params.taskId, input.modelId), requestPermissions(request)));
+        const task = store.getTask(request.params.taskId);
+        if (task.taskType === "relationship-analysis") {
+            const permissions = requestPermissions(request, String(task.workId));
+            const deniedModules = relationshipAnalysisReadModules(task.scope).filter((module) => permissions[module] === "none");
+            if (deniedModules.length > 0) {
+                throw new AppError(403, "WORK_MODULE_READ_DENIED", "你没有读取本次定向人物关系分析所需资料模块的权限", {
+                    modules: deniedModules
+                });
+            }
+        }
+        data(response, redactTaskCharacterNames(await ai.runTask(request.params.taskId, input.modelId, request.authUser ? {
+            userId: request.authUser.userId,
+            allowAdminAccess: request.authMethod !== "api-key"
+        } : undefined), requestPermissions(request)));
     });
     app.post("/api/tasks/:taskId/cancel", (request, response) => data(response, redactTaskCharacterNames(ai.cancelTask(request.params.taskId), requestPermissions(request))));
     app.get("/api/platform/ai/providers", (request, response) => {