@tiledesk/tiledesk-server 2.20.0 → 2.20.2

package/CHANGELOG.md

@@ -5,6 +5,16 @@
 🚀        IN PRODUCTION                        🚀
 (https://www.npmjs.com/package/@tiledesk/tiledesk-server/v/2.3.77) 
 
+# 2.21.0
+- Addressed and resolved a security vulnerability
+
+# 2.20.1
+- Fixed a security vulnerability on AI-related routes
+- Added authentication to `/openai` and `/url-preview` routes
+- Improved error response sanitization for LLM routes
+- Fixed cross-tenant access checks on integration routes
+- Disabled unused `/kbsettings` route
+
 # 2.20.0
 - Updated tybot-connector to 2.1.8
 - Improved flow attributes management

package/app.js

@@ -639,15 +639,16 @@ app.use('/:projectid/segments',[passport.authenticate(['basic', 'jwt'], { sessio
 app.use('/:projectid/tables', [passport.authenticate(['basic', 'jwt'], { session: false }), validtoken, roleChecker.hasRoleOrTypes('admin', ['bot','subscription'])], dataTable);
 
 app.use('/:projectid/llm', [passport.authenticate(['basic', 'jwt'], { session: false }), validtoken, roleChecker.hasRoleOrTypes('admin', ['bot','subscription'])], llm);
-app.use('/:projectid/openai', openai);
-app.use('/:projectid/url-preview', urlPreview);
+app.use('/:projectid/openai', [passport.authenticate(['basic', 'jwt'], { session: false }), validtoken, roleChecker.hasRoleOrTypes('admin', ['bot','subscription'])], openai);
+app.use('/:projectid/url-preview', [passport.authenticate(['basic', 'jwt'], { session: false }), validtoken, roleChecker.hasRoleOrTypes('guest', ['bot','subscription'])], urlPreview);
 app.use('/:projectid/quotes', [passport.authenticate(['basic', 'jwt'], { session: false }), validtoken, roleChecker.hasRoleOrTypes('agent', ['bot','subscription'])], quotes)
 
 app.use('/:projectid/integration', [passport.authenticate(['basic', 'jwt'], { session: false }), validtoken, roleChecker.hasRoleOrTypes('admin', ['bot','subscription'])], integration )
 
 app.use('/:projectid/mcp', [passport.authenticate(['basic', 'jwt'], { session: false }), validtoken, roleChecker.hasRoleOrTypes('admin', ['bot','subscription'])], mcp);
 
-app.use('/:projectid/kbsettings', [passport.authenticate(['basic', 'jwt'], { session: false }), validtoken, roleChecker.hasRoleOrTypes('agent', ['bot','subscription'])], kbsettings);
+// Disabled: superseded by /kb routes. Kept commented with gptkey stripped from responses.
+// app.use('/:projectid/kbsettings', [passport.authenticate(['basic', 'jwt'], { session: false }), validtoken, roleChecker.hasRoleOrTypes('agent', ['bot','subscription'])], kbsettings);
 app.use('/:projectid/kb/unanswered', [passport.authenticate(['basic', 'jwt'], { session: false }), validtoken, roleChecker.hasRoleOrTypes('admin', ['bot','subscription'])], unanswered);
 app.use('/:projectid/kb/answered', [passport.authenticate(['basic', 'jwt'], { session: false }), validtoken, roleChecker.hasRoleOrTypes('admin', ['bot','subscription'])], answered);
 app.use('/:projectid/kb', [passport.authenticate(['basic', 'jwt'], { session: false }), validtoken, roleChecker.hasRoleOrTypes('admin', ['bot','subscription'])], kb);

package/package.json

@@ -1,7 +1,7 @@
 {
   "name": "@tiledesk/tiledesk-server",
   "description": "The Tiledesk server module",
-  "version": "2.20.0",
+  "version": "2.20.2",
   "scripts": {
     "start": "node ./bin/www",
     "pretest": "mongodb-runner start",
@@ -49,7 +49,7 @@
     "@tiledesk/tiledesk-rasa-connector": "^1.0.10",
     "@tiledesk/tiledesk-sms-connector": "^0.1.13",
     "@tiledesk/tiledesk-telegram-connector": "^0.1.14",
-    "@tiledesk/tiledesk-tybot-connector": "^2.1.8",
+    "@tiledesk/tiledesk-tybot-connector": "^2.1.10",
     "@tiledesk/tiledesk-voice-twilio-connector": "^0.3.2",
     "@tiledesk/tiledesk-vxml-connector": "^0.1.91",
     "@tiledesk/tiledesk-whatsapp-connector": "1.0.26",

package/routes/integration.js

@@ -5,6 +5,11 @@ let Integration = require('../models/integrations');
 const cacheEnabler = require('../services/cacheEnabler');
 var cacheUtil = require('../utils/cacheUtil');
 const integrationEvent = require('../event/integrationEvent');
+const {
+    mergeIntegrationValue,
+    toPublicIntegration,
+    toPublicIntegrations
+} = require('../utils/maskIntegrationSecrets');
 
 
 // Get all integration for a project id 
@@ -24,7 +29,7 @@ router.get('/', async (req, res) => {
             winston.error("Error getting integrations: ", err);
             return res.status(500).send({ success: false, message: "Error getting integrations "});
         }
-        res.status(200).send(integrations);
+        res.status(200).send(toPublicIntegrations(integrations));
     })
     // without cache
     // Integration.find({ id_project: id_project }, (err, integrations) => {
@@ -41,14 +46,18 @@ router.get('/', async (req, res) => {
 router.get('/:integration_id', async (req, res) => {
     
     let integration_id = req.params.integration_id;
+    let id_project = req.projectid;
     winston.debug("Get integration with id " + integration_id);
 
-    Integration.findById(integration_id, (err, integration) => {
+    Integration.findOne({ _id: integration_id, id_project: id_project }, (err, integration) => {
         if (err) {
             winston.error("Error find integration by id: ", err);
             return res.status(404).send({ success: false, err: err });
         }
-        res.status(200).send(integration);
+        if (!integration) {
+            return res.status(404).send({ success: false, message: "Integration not found" });
+        }
+        res.status(200).send(toPublicIntegration(integration));
     })
 
 })
@@ -72,7 +81,7 @@ router.get('/name/:integration_name', async (req, res) => {
             return res.status(200).send("Integration not found");
         }
         
-        res.status(200).send(integration);
+        res.status(200).send(toPublicIntegration(integration));
     })
 })
 
@@ -82,13 +91,22 @@ router.post('/', async (req, res) => {
     let id_project = req.projectid;
     winston.debug("Add new integration ", req.body);
 
+    let existingIntegration;
+    try {
+        existingIntegration = await Integration.findOne({ id_project: id_project, name: req.body.name });
+    } catch (err) {
+        winston.error("Error finding existing integration ", err);
+        return res.status(500).send({ success: false, err: err });
+    }
 
     let newIntegration = {
         id_project: id_project,
         name: req.body.name
     }
-    if (req.body.value) {
-        newIntegration.value = req.body.value;
+    if (req.body.value !== undefined) {
+        newIntegration.value = existingIntegration?.value
+            ? mergeIntegrationValue(req.body.value, existingIntegration.value)
+            : req.body.value;
     }
 
     Integration.findOneAndUpdate({ id_project: id_project, name: req.body.name },  newIntegration, { new: true, upsert: true, setDefaultsOnInsert: false}, (err, savedIntegration) => {
@@ -107,7 +125,7 @@ router.post('/', async (req, res) => {
             }
         })
         
-        res.status(200).send(savedIntegration);
+        res.status(200).send(toPublicIntegration(savedIntegration));
     })
 
     // let newIntegration = new Integration({
@@ -144,19 +162,35 @@ router.put('/:integration_id', async (req, res) => {
 
     let id_project = req.projectid;
     let integration_id = req.params.integration_id;
+
+    let existingIntegration;
+    try {
+        existingIntegration = await Integration.findOne({ _id: integration_id, id_project: id_project });
+    } catch (err) {
+        winston.error("Error finding integration to update ", err);
+        return res.status(500).send({ success: false, error: err });
+    }
+    if (!existingIntegration) {
+        return res.status(404).send({ success: false, message: "Integration not found" });
+    }
     
     let update = {};
     if (req.body.name != undefined) {
         update.name = req.body.name;
     }
     if (req.body.value != undefined) {
-        update.value = req.body.value
+        update.value = existingIntegration.value
+            ? mergeIntegrationValue(req.body.value, existingIntegration.value)
+            : req.body.value;
     }
 
-    Integration.findByIdAndUpdate(integration_id, update, { new: true, upsert: true }, (err, savedIntegration) => {
+    Integration.findOneAndUpdate({ _id: integration_id, id_project: id_project }, update, { new: true }, (err, savedIntegration) => {
         if (err) {
             winston.error("Error find by id and update integration: ", err);
-            return res.status({ success: false, error: err })
+            return res.status(500).send({ success: false, error: err })
+        }
+        if (!savedIntegration) {
+            return res.status(404).send({ success: false, message: "Integration not found" });
         }
 
         Integration.find({ id_project: id_project }, (err, integrations) => {
@@ -167,7 +201,7 @@ router.put('/:integration_id', async (req, res) => {
             }
         })
 
-        res.status(200).send(savedIntegration);
+        res.status(200).send(toPublicIntegration(savedIntegration));
     })
 })
 
@@ -176,10 +210,13 @@ router.delete('/:integration_id', async (req, res) => {
     let id_project = req.projectid;
     let integration_id = req.params.integration_id;
 
-    Integration.findByIdAndDelete(integration_id, (err, result) => {
+    Integration.findOneAndDelete({ _id: integration_id, id_project: id_project }, (err, result) => {
         if (err) {
             winston.error("Error find by id and delete integration: ", err);
-            return res.status({ success: false, error: err })
+            return res.status(500).send({ success: false, error: err })
+        }
+        if (!result) {
+            return res.status(404).send({ success: false, message: "Integration not found" });
         }
 
         Integration.find({ id_project: id_project }, (err, integrations) => {

package/routes/kbsettings.js

@@ -1,215 +1,185 @@
 var express = require('express');
-var { KBSettings } = require('../models/kb_setting');
-// var { KB } = require('../models/kb_setting');
-// var KB = require('../models/kb_setting')
 var router = express.Router();
-var winston = require('../config/winston');
-const aiService = require('../services/aiService');
 
-router.get('/', async (req, res) => {
-    let project_id = req.projectid;
-
-    KBSettings.findOne({ id_project: project_id }, (err, kb_setting) => {
-        if (err) {
-            winston.error("find knoledge base settings error: ", err);
-            return res.status(500).send({ success: false, error: err });
-        } 
-        else if (!kb_setting) {
-            // Automatically creates the kb settings object if it does not exist
-            let new_settings = new KBSettings({
-                id_project: req.projectid
-            })
-            new_settings.save(function (err, savedKbSettings) {
-                if (err) {
-                    winston.error("save new kbs error: ", err);
-                    return res.status(500).send({ success: false, error: err});
-                } else {
-                    return res.status(200).send(savedKbSettings);
-                }
-            })
-        }
-        else {
-            return res.status(200).send(kb_setting)
-        }
-    })
-})
-
-
-// Never used?
-router.post('/', async (req, res) => {
-
-    let body = req.body;
-
-    let new_settings = new KBSettings({
-        id_project: req.projectid,
-        // gptkey: body.gptkey
-        // others params are set with default values
-    })
-
-    new_settings.save(function (err, savedKbSettings) {
-        if (err) {
-            winston.error("save new kbs error: ", err);
-            return res.status(500).send({ success: false, error: err});
-        } else {
-            return res.status(200).send(savedKbSettings);
-        }
-    })
-})
-
-router.put('/:settings_id', async (req, res) => {
-
-    let settings_id = req.params.settings_id;
-    let update = {};
-
-    if (req.body.gptkey != undefined) {
-        update.gptkey = req.body.gptkey
+// Route disabled — see app.js (/kbsettings superseded by /kb).
+// Never expose gptkey in HTTP responses.
+function stripGptkey(kb_setting) {
+    if (!kb_setting) {
+        return kb_setting;
     }
-    // check if it is eligible
-    // if (req.body.maxKbsNumber != undefined) {
-    //     update.maxKbsNumber = req.body.maxKbsNumber
-    // }
-    // if (req.body.maxPagesNumber != undefined) {
-    //     update.maxPagesNumber = req.body.maxPagesNumber
-    // }
-
-    winston.debug("update: ", update);
-    KBSettings.findByIdAndUpdate(settings_id, update, { new: true }, (err, settings) => {
-        if (err) {
-            winston.error("findByIdAndUpdate error: ", err);
-            res.status(500).send({ success: false, error: err });
-        } else {
-            res.status(200).send(settings);
-        }
-    })
-})
-
-router.delete('/:settings_id/:kb_id', async (req, res) => {
-    
-    let settings_id = req.params.settings_id;
-    let kb_id = req.params.kb_id;
-
-    KBSettings.findByIdAndUpdate(settings_id, { $pull: { kbs: { _id: kb_id }}}, { new: true}, (err, settings) => {
-        if (err) {
-            winston.error("delete kb from list error: ", err);
-            res.status(500).send({ success: false, error: err });
-        } else {
-            res.status(200).send(settings);
-        }
-    })
-
-})
-
-
-// PROXY PUGLIA AI - START
-router.post('/qa', async (req, res) => {
-    let data = req.body;
-    winston.debug("/qa data: ", data);
-
-    aiService.ask(data).then((resp) => {
-        winston.debug("qa resp: ", resp.data);
-        res.status(200).send(resp.data);
-    }).catch((err) => {
-        winston.error("qa err: ", err);
-        //let status = err.response.status;
-        //res.status(status).send({ statusText: err.response.statusText, detail: err.response.data.detail });
-        res.status(400).send({ success: false, error: err });
-    })
-})
-
-router.post('/startscrape', async (req, res) => {
-    
-    let data = req.body;
-    winston.debug("/startscrape data: ", data);
-
-    aiService.startScrape(data).then((resp) => {
-        winston.debug("startScrape resp: ", resp.data);
-        res.status(200).send(resp.data);
-    }).catch((err) => {
-        winston.error("startScrape err: ", err);
-        // let status = err.response.status;
-        // res.status(status).send({ statusText: err.response.statusText, detail: err.response.data.detail });
-        res.status(400).send({ success: false, error: err });
-    })
-})
-
-
-router.post('/checkstatus', async (req, res) => {
-
-    //let data = req.body;
-    winston.debug("/checkstatus req.body: ", req.body);
-
-    let full_url = req.body.full_url;
-    let data = {
-        url_list: [ req.body.full_url ]
-    }
-
-    aiService.checkStatus(data).then((resp) => {
-        winston.debug("checkStatus resp: ", resp);
-        winston.debug("checkStatus resp: ", resp.data);
-        winston.debug("checkStatus resp: ", resp.data[full_url]);
-
-        let response = resp.data[full_url];
-
-        let return_data = {
-            status_message: response.status_message
-        }
-
-        if (response.status_code === 3) {
-            return_data.status_code = 2;
-        }
-
-        if (response.status_code === 1 || response.status_code === 2 ) {
-            return_data.status_code = 1;
-        }
-
-        if (response.status_code === 0) {
-            return_data.status_code = 0;
-        }
-
-        if (!response.status_code) {
-            return_data.status_code = 0;
-        }
-
-        
-        res.status(200).send(return_data);
-    }).catch((err) => {
-        //winston.error("checkstatus err: ", err);
-
-        // let status = err.response?.status;
-        // res.status(status).send({ statusText: err.response?.statusText, detail: err.response?.data?.detail });
-        res.status(400).send({ success: false, error: err });
-    })
-})
-// PROXY PUGLIA AI - END
-
-router.post('/:settings_id', async (req, res) => {
-
-    let settings_id = req.params.settings_id;
-    let body = req.body;
-
-    KBSettings.findById(settings_id, (err, settings) => {
-        if (err) {
-            winston.error("find knoledge base error: ", err);
-            return res.status(500).send({ success: false, error: err});
-        } else {
-
-            let new_kb = {
-                name: body.name,
-                url: body.url
-            }
-            settings.kbs.push(new_kb);
-
-            KBSettings.findByIdAndUpdate( settings_id, settings, { new: true }, (err, savedSettings) => {
-                if (err) {
-                    winston.err("findByIdAndUpdate error: ", err);
-                    res.status(500).send({ success: false, error: err });
-                } else {
-                    res.status(200).send(savedSettings);
-                }
-            })
-        }
-    })
-})
-
-
-module.exports = router;
+    const obj = typeof kb_setting.toObject === 'function' ? kb_setting.toObject() : { ...kb_setting };
+    delete obj.gptkey;
+    return obj;
+}
+
+// var { KBSettings } = require('../models/kb_setting');
+// var winston = require('../config/winston');
+// const aiService = require('../services/aiService');
+// const { sanitizeAxiosError, axiosErrorStatus } = require('../utils/sanitizeAxiosError');
+//
+// router.get('/', async (req, res) => {
+//     let project_id = req.projectid;
+//
+//     KBSettings.findOne({ id_project: project_id }, (err, kb_setting) => {
+//         if (err) {
+//             winston.error("find knoledge base settings error: ", err);
+//             return res.status(500).send({ success: false, error: err });
+//         }
+//         else if (!kb_setting) {
+//             let new_settings = new KBSettings({
+//                 id_project: req.projectid
+//             })
+//             new_settings.save(function (err, savedKbSettings) {
+//                 if (err) {
+//                     winston.error("save new kbs error: ", err);
+//                     return res.status(500).send({ success: false, error: err});
+//                 } else {
+//                     return res.status(200).send(stripGptkey(savedKbSettings));
+//                 }
+//             })
+//         }
+//         else {
+//             return res.status(200).send(stripGptkey(kb_setting))
+//         }
+//     })
+// })
+//
+// router.post('/', async (req, res) => {
+//     let new_settings = new KBSettings({
+//         id_project: req.projectid
+//     })
+//
+//     new_settings.save(function (err, savedKbSettings) {
+//         if (err) {
+//             winston.error("save new kbs error: ", err);
+//             return res.status(500).send({ success: false, error: err});
+//         } else {
+//             return res.status(200).send(stripGptkey(savedKbSettings));
+//         }
+//     })
+// })
+//
+// router.put('/:settings_id', async (req, res) => {
+//     let settings_id = req.params.settings_id;
+//     let update = {};
+//
+//     if (req.body.gptkey != undefined) {
+//         update.gptkey = req.body.gptkey
+//     }
+//
+//     winston.debug("update: ", update);
+//     KBSettings.findByIdAndUpdate(settings_id, update, { new: true }, (err, settings) => {
+//         if (err) {
+//             winston.error("findByIdAndUpdate error: ", err);
+//             res.status(500).send({ success: false, error: err });
+//         } else {
+//             res.status(200).send(stripGptkey(settings));
+//         }
+//     })
+// })
+//
+// router.delete('/:settings_id/:kb_id', async (req, res) => {
+//     let settings_id = req.params.settings_id;
+//     let kb_id = req.params.kb_id;
+//
+//     KBSettings.findByIdAndUpdate(settings_id, { $pull: { kbs: { _id: kb_id }}}, { new: true}, (err, settings) => {
+//         if (err) {
+//             winston.error("delete kb from list error: ", err);
+//             res.status(500).send({ success: false, error: err });
+//         } else {
+//             res.status(200).send(stripGptkey(settings));
+//         }
+//     })
+// })
+//
+// router.post('/qa', async (req, res) => {
+//     let data = req.body;
+//     winston.debug("/qa data: ", data);
+//
+//     aiService.ask(data).then((resp) => {
+//         winston.debug("qa resp: ", resp.data);
+//         res.status(200).send(resp.data);
+//     }).catch((err) => {
+//         winston.error("qa err: ", sanitizeAxiosError(err));
+//         res.status(axiosErrorStatus(err, 400)).send({ success: false, error: sanitizeAxiosError(err) });
+//     })
+// })
+//
+// router.post('/startscrape', async (req, res) => {
+//     let data = req.body;
+//     winston.debug("/startscrape data: ", data);
+//
+//     aiService.startScrape(data).then((resp) => {
+//         winston.debug("startScrape resp: ", resp.data);
+//         res.status(200).send(resp.data);
+//     }).catch((err) => {
+//         winston.error("startScrape err: ", sanitizeAxiosError(err));
+//         res.status(axiosErrorStatus(err, 400)).send({ success: false, error: sanitizeAxiosError(err) });
+//     })
+// })
+//
+// router.post('/checkstatus', async (req, res) => {
+//     winston.debug("/checkstatus req.body: ", req.body);
+//
+//     let full_url = req.body.full_url;
+//     let data = {
+//         url_list: [ req.body.full_url ]
+//     }
+//
+//     aiService.checkStatus(data).then((resp) => {
+//         let response = resp.data[full_url];
+//
+//         let return_data = {
+//             status_message: response.status_message
+//         }
+//
+//         if (response.status_code === 3) {
+//             return_data.status_code = 2;
+//         }
+//
+//         if (response.status_code === 1 || response.status_code === 2 ) {
+//             return_data.status_code = 1;
+//         }
+//
+//         if (response.status_code === 0) {
+//             return_data.status_code = 0;
+//         }
+//
+//         if (!response.status_code) {
+//             return_data.status_code = 0;
+//         }
+//
+//         res.status(200).send(return_data);
+//     }).catch((err) => {
+//         res.status(axiosErrorStatus(err, 400)).send({ success: false, error: sanitizeAxiosError(err) });
+//     })
+// })
+//
+// router.post('/:settings_id', async (req, res) => {
+//     let settings_id = req.params.settings_id;
+//     let body = req.body;
+//
+//     KBSettings.findById(settings_id, (err, settings) => {
+//         if (err) {
+//             winston.error("find knoledge base error: ", err);
+//             return res.status(500).send({ success: false, error: err});
+//         } else {
+//             let new_kb = {
+//                 name: body.name,
+//                 url: body.url
+//             }
+//             settings.kbs.push(new_kb);
+//
+//             KBSettings.findByIdAndUpdate( settings_id, settings, { new: true }, (err, savedSettings) => {
+//                 if (err) {
+//                     winston.err("findByIdAndUpdate error: ", err);
+//                     res.status(500).send({ success: false, error: err });
+//                 } else {
+//                     res.status(200).send(stripGptkey(savedSettings));
+//                 }
+//             })
+//         }
+//     })
+// })
+
+module.exports = router;

package/routes/llm.js

@@ -7,6 +7,7 @@ const aiManager = require('../services/aiManager');
 const multer = require('multer');
 const fileUtils = require('../utils/fileUtils');
 const { MODELS_MULTIPLIER } = require('../utils/aiUtils');
+const { sanitizeAxiosError, axiosErrorStatus } = require('../utils/sanitizeAxiosError');
 
 let MAX_UPLOAD_FILE_SIZE = process.env.MAX_UPLOAD_FILE_SIZE;
 let uploadlimits = undefined;
@@ -133,9 +134,9 @@ router.post('/preview', async (req, res) => {
         } else if (err.response?.data?.detail?.answer) {
             res.status(400).send({ success: false, error: err.response.data.detail.answer, detail: err.response.data.detail });
         } else if (err.response?.data) {
-            res.status(500).send({ success: false, error: err.response.data });
+            res.status(axiosErrorStatus(err)).send({ success: false, error: sanitizeAxiosError(err) });
         } else {
-            res.status(500).send({ success: false, error: err });
+            res.status(axiosErrorStatus(err)).send({ success: false, error: sanitizeAxiosError(err) });
         }
     })
 
@@ -174,8 +175,8 @@ router.post('/transcription', upload.single('uploadFile'), async (req, res) => {
         winston.verbose("Transcript response: ", response.data);
         res.status(200).send({ text: response.data.text});
     }).catch((err) => {
-        winston.error("err: ", err.response?.data)
-        res.status(500).send({ success: false, error: err });
+        winston.error("transcription error: ", sanitizeAxiosError(err));
+        res.status(axiosErrorStatus(err)).send({ success: false, error: sanitizeAxiosError(err) });
     })
 
 })

package/routes/openai.js

@@ -1,90 +1,92 @@
 var express = require('express');
 var router = express.Router();
-var { KBSettings } = require('../models/kb_setting');
-var aiService = require('../services/aiService');
-var winston = require('../config/winston');
-const { QuoteManager } = require('../services/QuoteManager');
-const { MODELS_MULTIPLIER } = require('../utils/aiUtils');
 
-router.post('/', async (req, res) => {
-
-    let project_id = req.projectid;
-    let body = req.body;
-    let usePublicKey = false;
-    let publicKey = process.env.GPTKEY;
-    let gptkey = null;
-    let obj = { createdAt: new Date() };
-    let quoteManager = req.app.get('quote_manager');
-
-    KBSettings.findOne({ id_project: project_id }, async (err, kbSettings) => {
-
-        if (err) {
-            usePublicKey = true;
-            gptkey = publicKey;
-        }
-
-        if (kbSettings && kbSettings.gptkey) {
-            gptkey = kbSettings.gptkey;
-        } else {
-            usePublicKey = true;
-            gptkey = publicKey;
-        }
-
-        if (!gptkey) {
-            return res.status(400).send({ success: false, message: "Missing gptkey parameter" });
-        }
-
-        if (usePublicKey === true) {
-            let isAvailable = await quoteManager.checkQuote(req.project, obj, 'tokens');
-            if (isAvailable === false) {
-                return res.status(403).send({ success: false, message: "Tokens quota exceeded", error_code: 13001})
-            }
-        }
-        
-
-        let json = {
-            model: body.model,
-            messages: [
-                { role: "user", content: body.question }
-            ],
-            max_tokens: body.max_tokens,
-            temperature: body.temperature
-        }
-
-        let message = { role: "", content: "" };
-        if (body.context) {
-            message.role = "system";
-            message.content = body.context;
-            json.messages.unshift(message);
-        }
-
-        if (body.formatType && body.formatType !== 'none') {
-            json.response_format = { 
-                type: body.formatType 
-            }
-        }
-
-        let multiplier = MODELS_MULTIPLIER[json.model];
-        if (!multiplier) {
-            multiplier = 1;
-            winston.info("No multiplier found for AI model (openai) " + json.model)
-        }
-
-        aiService.completions(json, gptkey).then(async (response) => {
-            let data = { createdAt: new Date(), tokens: response.data.usage.total_tokens, multiplier: multiplier }
-            if (usePublicKey === true) {
-                let incremented_key = await quoteManager.incrementTokenCount(req.project, data);
-                winston.verbose("Tokens quota incremented for key " + incremented_key);
-            }
-
-            res.status(200).send(response.data);
-
-        }).catch((err) => {
-            // winston.error("completions error: ", err);
-            res.status(500).send(err)
-        })
-    })
-})
+// Disabled: POST / was unused (only Design Studio GPT Task preview, now deprecated).
+// Kept commented with sanitized error handling for potential future re-enablement.
+// var { KBSettings } = require('../models/kb_setting');
+// var aiService = require('../services/aiService');
+// const { MODELS_MULTIPLIER } = require('../utils/aiUtils');
+// const { sanitizeAxiosError, axiosErrorStatus } = require('../utils/sanitizeAxiosError');
+//
+// router.post('/', async (req, res) => {
+//
+//     let project_id = req.projectid;
+//     let body = req.body;
+//     let usePublicKey = false;
+//     let publicKey = process.env.GPTKEY;
+//     let gptkey = null;
+//     let obj = { createdAt: new Date() };
+//     let quoteManager = req.app.get('quote_manager');
+//
+//     KBSettings.findOne({ id_project: project_id }, async (err, kbSettings) => {
+//
+//         if (err) {
+//             usePublicKey = true;
+//             gptkey = publicKey;
+//         }
+//
+//         if (kbSettings && kbSettings.gptkey) {
+//             gptkey = kbSettings.gptkey;
+//         } else {
+//             usePublicKey = true;
+//             gptkey = publicKey;
+//         }
+//
+//         if (!gptkey) {
+//             return res.status(400).send({ success: false, message: "Missing gptkey parameter" });
+//         }
+//
+//         if (usePublicKey === true) {
+//             let isAvailable = await quoteManager.checkQuote(req.project, obj, 'tokens');
+//             if (isAvailable === false) {
+//                 return res.status(403).send({ success: false, message: "Tokens quota exceeded", error_code: 13001})
+//             }
+//         }
+//
+//
+//         let json = {
+//             model: body.model,
+//             messages: [
+//                 { role: "user", content: body.question }
+//             ],
+//             max_tokens: body.max_tokens,
+//             temperature: body.temperature
+//         }
+//
+//         let message = { role: "", content: "" };
+//         if (body.context) {
+//             message.role = "system";
+//             message.content = body.context;
+//             json.messages.unshift(message);
+//         }
+//
+//         if (body.formatType && body.formatType !== 'none') {
+//             json.response_format = {
+//                 type: body.formatType
+//             }
+//         }
+//
+//         let multiplier = MODELS_MULTIPLIER[json.model];
+//         if (!multiplier) {
+//             multiplier = 1;
+//             winston.info("No multiplier found for AI model (openai) " + json.model)
+//         }
+//
+//         aiService.completions(json, gptkey).then(async (response) => {
+//             let data = { createdAt: new Date(), tokens: response.data.usage.total_tokens, multiplier: multiplier }
+//             if (usePublicKey === true) {
+//                 let incremented_key = await quoteManager.incrementTokenCount(req.project, data);
+//                 winston.verbose("Tokens quota incremented for key " + incremented_key);
+//             }
+//
+//             res.status(200).send(response.data);
+//
+//         }).catch((err) => {
+//             winston.error("completions error: ", sanitizeAxiosError(err));
+//             res.status(axiosErrorStatus(err)).send({ success: false, error: sanitizeAxiosError(err) });
+//         })
+//     })
+// })
 
 router.post('/quotes', async (req, res) => {
 
@@ -106,56 +108,4 @@ router.post('/quotes', async (req, res) => {
     res.status(200).send({ message: "value incremented for key " + incremented_key, key: incremented_key, currentQuote: quote });
 })
 
-// router.get('/', async (req, res) => {
-
-//     let project_id = req.projectid;
-
-//     OpenaiKbs.find({ id_project: project_id }, (err, kbs) => {
-//         if (err) {
-//             console.error("find all kbs error: ", err);
-//             return res.status(500).send({ success: false, error: err });
-//         } else {
-//             return res.status(200).send(kbs);
-//         }
-//     })
-// })
-
-// router.post('/', async (req, res) => {
-
-//     let body = req.body;
-
-//     let new_kbs = new OpenaiKbs({
-//         name: body.name,
-//         url: body.url,
-//         id_project: req.projectid,
-//         gptkey: req.body.gptkey
-//     })
-
-//     new_kbs.save(function (err, savedKbs) {
-//         if (err) {
-//             console.error("save new kbs error: ", err);
-//             return res.status(500).send({ success: false, error: err});
-//         } else {
-//             return res.status(200).send(savedKbs);
-//         }
-//     })
-// })
-
-// router.put('/', async (req, res) => {
-//     // to be implemented
-// })
-
-// router.delete('/:kbs_id', async (req, res) => {
-//     let kbs_id = req.params.kbs_id;
-
-//     OpenaiKbs.findOneAndDelete( { _id: kbs_id }, (err, kbDeleted) => {
-//         if (err) {
-//             console.error("find one and delete kbs error: ", err);
-//             return res.status(500).send({ success: false, error: err});
-//         } else {
-//             return res.status(200).send({ success: true, message: 'Knowledge Base deleted successfully', openai_kb: kbDeleted });
-//         }
-//     })
-// })
-
-module.exports = router;
+module.exports = router;

package/routes/urlPreview.js

@@ -17,7 +17,7 @@ function isSafeUrl(rawUrl) {
   }
 }
 
-// POST /:projectid/url-preview — public endpoint (used by the widget without auth)
+// POST /:projectid/url-preview — requires JWT (widget sends tiledeskToken as guest)
 // Body: { "urls": ["https://example.com", "https://another.com"] }
 router.post('/', async (req, res) => {
   const urls = req.body.urls;

package/services/webhookService.js

@@ -53,7 +53,7 @@ class WebhookService {
             let token = await this.generateChatbotToken(chatbot);
 
             let url = TILEBOT_ENDPOINT + 'block/' + webhook.id_project + "/" + chatbot_id + "/" + webhook.block_id;
-            winston.info("Webhook chatbot URL: " + url);
+            winston.verbose("Webhook chatbot URL: " + url);
 
             payload.async = webhook.async;
             payload.token = token;

package/test/maskIntegrationSecrets.test.js

@@ -0,0 +1,95 @@
+const { expect } = require('chai');
+const {
+    maskApiKey,
+    isMaskedSecret,
+    maskIntegrationValue,
+    mergeIntegrationValue,
+    toPublicIntegration
+} = require('../utils/maskIntegrationSecrets');
+
+describe('maskIntegrationSecrets', () => {
+
+    it('masks api keys keeping prefix and suffix', () => {
+        expect(maskApiKey('sk-abc123nz2bVU')).to.equal('sk-********2bVU');
+        expect(maskApiKey('sk-xxxxxxxxxxx2bVU')).to.equal('sk-***********2bVU');
+    });
+
+    it('masks nested integration value fields', () => {
+        const value = {
+            apikey: 'sk-secretkey1234',
+            organization: 'MyCompany',
+            servers: [{
+                name: 'together',
+                url: 'https://api.together.xyz/v1/',
+                apikey: 'tgp_v1_abcdefgySDDG-Yw',
+                models: ['model-a']
+            }]
+        };
+
+        const masked = maskIntegrationValue(value);
+        expect(masked.organization).to.equal('MyCompany');
+        expect(masked.apikey).to.equal('sk-*********1234');
+        expect(masked.servers[0].apikey).to.equal('tgp***************G-Yw');
+        expect(masked.servers[0].models).to.deep.equal(['model-a']);
+    });
+
+    it('detects masked secrets', () => {
+        expect(isMaskedSecret('sk-***********2bVU')).to.be.true;
+        expect(isMaskedSecret('sk-real-key')).to.be.false;
+    });
+
+    it('preserves existing secrets when incoming value is masked', () => {
+        const existing = {
+            apikey: 'sk-real-key',
+            organization: 'MyCompany',
+            servers: [{
+                name: 'together',
+                apikey: 'tgp_v1_realkey',
+                url: 'https://api.together.xyz/v1/'
+            }]
+        };
+
+        const incoming = {
+            apikey: 'sk-***********2bVU',
+            organization: 'NewCompany',
+            servers: [{
+                name: 'together',
+                apikey: 'tgp*************D-Yw',
+                url: 'https://api.together.xyz/v1/'
+            }]
+        };
+
+        const merged = mergeIntegrationValue(incoming, existing);
+        expect(merged.apikey).to.equal('sk-real-key');
+        expect(merged.organization).to.equal('NewCompany');
+        expect(merged.servers[0].apikey).to.equal('tgp_v1_realkey');
+    });
+
+    it('replaces secrets when incoming value is not masked', () => {
+        const existing = {
+            apikey: 'sk-old-key'
+        };
+        const incoming = {
+            apikey: 'sk-new-key'
+        };
+
+        const merged = mergeIntegrationValue(incoming, existing);
+        expect(merged.apikey).to.equal('sk-new-key');
+    });
+
+    it('returns masked integration for public responses', () => {
+        const integration = {
+            _id: '656054000410fa00132e5dcc',
+            id_project: '656054000410fa00132e5dcc',
+            name: 'openai',
+            value: {
+                apikey: 'sk-secretkey1234',
+                organization: 'MyCompany'
+            }
+        };
+
+        const publicIntegration = toPublicIntegration(integration);
+        expect(publicIntegration.value.apikey).to.equal('sk-*********1234');
+        expect(publicIntegration.value.organization).to.equal('MyCompany');
+    });
+});

package/utils/assignmentContextUtil.js

@@ -38,7 +38,7 @@ function assignmentActorContext(req, defaultSource) {
       url: req.originalUrl
     });
   } else {
-    winston.info('assignmentActorContext actor resolution', {
+    winston.debug('assignmentActorContext actor resolution', {
       actor: actor,
       principal_id: projectUserUpdateContextUtil.resolveUserId(req.user),
       principal_name: req.user && req.user.name,

package/utils/maskIntegrationSecrets.js

@@ -0,0 +1,132 @@
+const SECRET_KEYS = new Set(['apikey', 'api_key']);
+
+const UNMASKED_START = 3;
+const UNMASKED_END = 4;
+
+function maskApiKey(key) {
+    if (typeof key !== 'string' || key.length === 0) {
+        return key;
+    }
+
+    if (key.length <= UNMASKED_START + UNMASKED_END) {
+        return '*'.repeat(key.length);
+    }
+
+    const start = key.slice(0, UNMASKED_START);
+    const end = key.slice(-UNMASKED_END);
+    const maskLength = key.length - UNMASKED_START - UNMASKED_END;
+    return start + '*'.repeat(maskLength) + end;
+}
+
+function isMaskedSecret(value) {
+    return typeof value === 'string' && value.includes('*');
+}
+
+function mergeSecretField(incoming, existing) {
+    if (incoming === undefined) {
+        return existing;
+    }
+    if (isMaskedSecret(incoming) && existing) {
+        return existing;
+    }
+    return incoming;
+}
+
+function maskIntegrationValue(value) {
+    if (value === null || value === undefined) {
+        return value;
+    }
+
+    if (Array.isArray(value)) {
+        return value.map(maskIntegrationValue);
+    }
+
+    if (typeof value !== 'object') {
+        return value;
+    }
+
+    const result = {};
+    for (const [key, val] of Object.entries(value)) {
+        if (SECRET_KEYS.has(key) && typeof val === 'string') {
+            result[key] = maskApiKey(val);
+        } else if (val !== null && typeof val === 'object') {
+            result[key] = maskIntegrationValue(val);
+        } else {
+            result[key] = val;
+        }
+    }
+    return result;
+}
+
+function mergeIntegrationValue(incoming, existing) {
+    if (!incoming) {
+        return incoming;
+    }
+    if (!existing) {
+        return incoming;
+    }
+
+    const merged = { ...existing, ...incoming };
+
+    if (incoming.apikey !== undefined) {
+        merged.apikey = mergeSecretField(incoming.apikey, existing.apikey);
+    }
+    if (incoming.api_key !== undefined) {
+        merged.api_key = mergeSecretField(incoming.api_key, existing.api_key);
+    }
+
+    if (Array.isArray(incoming.servers)) {
+        merged.servers = incoming.servers.map((server) => {
+            const existingServer = Array.isArray(existing.servers)
+                ? existing.servers.find((s) => s.name === server.name)
+                : undefined;
+
+            if (!existingServer) {
+                return server;
+            }
+
+            return {
+                ...existingServer,
+                ...server,
+                apikey: mergeSecretField(server.apikey, existingServer.apikey),
+                api_key: mergeSecretField(server.api_key, existingServer.api_key)
+            };
+        });
+    }
+
+    return merged;
+}
+
+function toIntegrationObject(integration) {
+    if (!integration) {
+        return integration;
+    }
+    return integration.toObject ? integration.toObject() : { ...integration };
+}
+
+function toPublicIntegration(integration) {
+    const obj = toIntegrationObject(integration);
+    if (!obj) {
+        return obj;
+    }
+    if (obj.value) {
+        obj.value = maskIntegrationValue(obj.value);
+    }
+    return obj;
+}
+
+function toPublicIntegrations(integrations) {
+    if (!Array.isArray(integrations)) {
+        return integrations;
+    }
+    return integrations.map(toPublicIntegration);
+}
+
+module.exports = {
+    maskApiKey,
+    isMaskedSecret,
+    maskIntegrationValue,
+    mergeIntegrationValue,
+    toPublicIntegration,
+    toPublicIntegrations
+};

package/utils/sanitizeAxiosError.js

@@ -0,0 +1,46 @@
+/**
+ * Returns a safe error payload for HTTP responses.
+ * Never pass raw AxiosError objects to res.send/res.json — toJSON() includes config.headers.
+ */
+function sanitizeAxiosError(err) {
+    if (!err) {
+        return { message: 'Request failed' };
+    }
+
+    const data = err.response?.data;
+
+    if (data?.error?.message) {
+        return { message: data.error.message };
+    }
+
+    if (typeof data?.detail === 'string') {
+        return { message: data.detail };
+    }
+
+    if (Array.isArray(data?.detail) && data.detail[0]?.msg) {
+        return { message: data.detail[0].msg };
+    }
+
+    if (data?.detail?.answer) {
+        return { message: data.detail.answer };
+    }
+
+    if (typeof data?.message === 'string') {
+        return { message: data.message };
+    }
+
+    if (typeof err.message === 'string') {
+        return { message: err.message };
+    }
+
+    return { message: 'Request failed' };
+}
+
+function axiosErrorStatus(err, defaultStatus) {
+    return err?.response?.status || defaultStatus || 500;
+}
+
+module.exports = {
+    sanitizeAxiosError,
+    axiosErrorStatus
+};