@musnows/scriverse 0.5.2 → 0.5.4

package/dist/app.js

@@ -28,7 +28,7 @@ import { currentRequestActor, runWithRequestActor } from "./request-context.js";
 import { APP_VERSION } from "./version.js";
 import { fullWorkModulePermissions, proseReplacementPermissionModules } from "./work-permissions.js";
 import { CollaborationPresence, editorPageKey, entityEditorPageKey, modulePageKey, pageLabelForKey, presencePageKinds } from "./collaboration-presence.js";
-import { clearSessionCookie, createCliApiScopeMiddleware, createUserSessionMiddleware, createWorkAuthorizationMiddleware, setSessionCookie, UserAuthService } from "./user-auth.js";
+import { clearSessionCookie, createCliApiScopeMiddleware, createUserSessionMiddleware, createWorkAuthorizationMiddleware, relationshipAnalysisReadModules, setSessionCookie, UserAuthService } from "./user-auth.js";
 const nonEmpty = z.string().trim().min(1);
 const identifier = z.string().trim().min(1).max(200);
 const optionalStrings = z.array(z.string()).optional();
@@ -274,6 +274,7 @@ const providerSchema = z.object({
     name: nonEmpty.max(200),
     baseUrl: z.string().url().refine((value) => value.startsWith("http://") || value.startsWith("https://"), "接口地址必须使用 HTTP 或 HTTPS"),
     apiKey: nonEmpty.max(10_000),
+    protocol: z.enum(["openai-chat-completions", "anthropic-messages"]).optional(),
     status: z.enum(["enabled", "disabled"]).optional(),
     note: z.string().max(10_000).optional(),
     concurrencyLimit: z.number().int().min(1).max(100).optional(),
@@ -379,8 +380,8 @@ const relationshipAnalysisScopeSchema = z.object({
     }
 });
 const analysisTaskSchema = z.union([
-    z.object({ taskType: z.literal("relationship-analysis"), scope: relationshipAnalysisScopeSchema.optional() }).strict(),
-    z.object({ taskType: analysisTaskTypeSchema, scope: jsonObject.optional() }).strict().superRefine((input, context) => {
+    z.object({ taskType: z.literal("relationship-analysis"), scope: relationshipAnalysisScopeSchema.optional(), modelId: identifier.optional() }).strict(),
+    z.object({ taskType: analysisTaskTypeSchema, scope: jsonObject.optional(), modelId: identifier.optional() }).strict().superRefine((input, context) => {
         if (input.scope?.includeAllSettings !== undefined) {
             context.addIssue({ code: z.ZodIssueCode.custom, path: ["scope", "includeAllSettings"], message: "包含所有设定仅支持人物关系分析" });
         }
@@ -570,7 +571,24 @@ export function createRuntime(options) {
         return auth.workModulePermissions(request.authUser, resolvedWorkId, request.authMethod !== "api-key") ?? fullWorkModulePermissions();
     };
     const captcha = new ImageCaptchaService({ revealAnswer: options.revealCaptchaAnswer === true });
-    const ai = new AiManager(store, new CredentialVault(options.masterSecret), options.fetchImpl ?? fetch, options.security ? (url) => assertSafeAiEndpoint(url, options.security?.allowPrivateAiEndpoints) : undefined);
+    const ai = new AiManager(store, new CredentialVault(options.masterSecret), options.fetchImpl ?? fetch, options.security ? (url) => assertSafeAiEndpoint(url, options.security?.allowPrivateAiEndpoints) : undefined, (task, actor) => {
+        if (task.taskType !== "relationship-analysis")
+            return;
+        const requiredModules = relationshipAnalysisReadModules(task.scope);
+        if (requiredModules.length === 0)
+            return;
+        const creator = actor ? null : database.get("SELECT created_by_user_id FROM analysis_tasks WHERE id = ?", String(task.id));
+        const userId = actor?.userId ?? (typeof creator?.created_by_user_id === "string" ? creator.created_by_user_id : null);
+        if (!userId)
+            return;
+        const user = auth.getUser(userId);
+        if (user.status !== "active")
+            throw new AppError(403, "WORK_ACCESS_DENIED", "任务创建者已无法访问这部作品");
+        auth.assertWorkAccess(user, String(task.workId), {
+            read: requiredModules,
+            write: ["ai-analysis"]
+        }, false, actor?.allowAdminAccess ?? false);
+    });
     const app = express();
     const upload = multer({
         storage: multer.memoryStorage(),
@@ -601,6 +619,7 @@ export function createRuntime(options) {
             status: "ok",
             version: APP_VERSION,
             protocol: "openai-chat-completions",
+            protocols: ["openai-chat-completions", "anthropic-messages"],
             development: options.developmentServer === true
         });
     });
@@ -1417,9 +1436,22 @@ export function createRuntime(options) {
     });
     app.post("/api/works/:workId/tasks", (request, response) => {
         const input = parse(analysisTaskSchema, request.body);
-        data(response, redactTaskCharacterNames(store.createTask(request.params.workId, input), requestPermissions(request, request.params.workId)), 201);
+        data(response, redactTaskCharacterNames(ai.createTask(request.params.workId, input), requestPermissions(request, request.params.workId)), 201);
     });
     app.post("/api/works/:workId/tasks/auto-run", (request, response) => {
+        const permissions = requestPermissions(request, request.params.workId);
+        for (const taskId of store.listOldestPendingTaskIds(request.params.workId, store.countPendingTasks(request.params.workId))) {
+            const task = store.getTask(taskId);
+            if (task.taskType !== "relationship-analysis")
+                continue;
+            const deniedModules = relationshipAnalysisReadModules(task.scope).filter((module) => permissions[module] === "none");
+            if (deniedModules.length > 0) {
+                throw new AppError(403, "WORK_MODULE_READ_DENIED", "你没有读取待运行定向人物关系分析所需资料模块的权限", {
+                    taskId,
+                    modules: deniedModules
+                });
+            }
+        }
         data(response, ai.startAutoRunBatch(request.params.workId));
     });
     app.get("/api/tasks/:taskId/detail", (request, response) => data(response, redactTaskCharacterNames(store.getTaskDetail(request.params.taskId), requestPermissions(request))));
@@ -1438,7 +1470,20 @@ export function createRuntime(options) {
     app.get("/api/tasks/:taskId/trace/calls/:callId", (request, response) => data(response, ai.getTaskTraceCall(request.params.taskId, request.params.callId)));
     app.post("/api/tasks/:taskId/run", async (request, response) => {
         const input = parse(z.object({ modelId: identifier.optional() }), request.body ?? {});
-        data(response, redactTaskCharacterNames(await ai.runTask(request.params.taskId, input.modelId), requestPermissions(request)));
+        const task = store.getTask(request.params.taskId);
+        if (task.taskType === "relationship-analysis") {
+            const permissions = requestPermissions(request, String(task.workId));
+            const deniedModules = relationshipAnalysisReadModules(task.scope).filter((module) => permissions[module] === "none");
+            if (deniedModules.length > 0) {
+                throw new AppError(403, "WORK_MODULE_READ_DENIED", "你没有读取本次定向人物关系分析所需资料模块的权限", {
+                    modules: deniedModules
+                });
+            }
+        }
+        data(response, redactTaskCharacterNames(await ai.runTask(request.params.taskId, input.modelId, request.authUser ? {
+            userId: request.authUser.userId,
+            allowAdminAccess: request.authMethod !== "api-key"
+        } : undefined), requestPermissions(request)));
     });
     app.post("/api/tasks/:taskId/cancel", (request, response) => data(response, redactTaskCharacterNames(ai.cancelTask(request.params.taskId), requestPermissions(request))));
     app.get("/api/platform/ai/providers", (request, response) => {