@useatlas/create 0.0.6 → 0.0.7

package/templates/nextjs-standalone/src/lib/providers.ts

@@ -2,18 +2,24 @@
  * Multi-provider LLM configuration.
  *
  * Set ATLAS_PROVIDER and the corresponding API key in your .env.
- * Supports Anthropic, OpenAI, AWS Bedrock, Ollama, and Vercel AI Gateway.
+ * Supports Anthropic, OpenAI, AWS Bedrock, Ollama, OpenAI-compatible
+ * (vLLM, TGI, LiteLLM, etc.), and Vercel AI Gateway.
+ *
+ * Enterprise workspaces can override the platform default via
+ * workspace-level model configuration (see ee/src/platform/model-routing.ts).
  */
 
+import { createAnthropic } from "@ai-sdk/anthropic";
 import { anthropic } from "@ai-sdk/anthropic";
 import { createOpenAI, openai } from "@ai-sdk/openai";
 import { bedrock } from "@ai-sdk/amazon-bedrock";
 import { bedrockAnthropic } from "@ai-sdk/amazon-bedrock/anthropic";
 import { gateway } from "ai";
 import type { LanguageModel } from "ai";
+import type { ModelConfigProvider } from "@useatlas/types";
 
 /** Provider strings accepted in ATLAS_PROVIDER. */
-type ConfigProvider = "anthropic" | "openai" | "bedrock" | "ollama" | "gateway";
+type ConfigProvider = "anthropic" | "openai" | "bedrock" | "ollama" | "openai-compatible" | "gateway";
 
 /** Resolved provider type (bedrock splits into bedrock vs bedrock-anthropic). */
 export type ProviderType = ConfigProvider | "bedrock-anthropic";
@@ -23,14 +29,16 @@ const VALID_PROVIDERS: ReadonlySet<ConfigProvider> = new Set([
   "openai",
   "bedrock",
   "ollama",
+  "openai-compatible",
   "gateway",
 ]);
 
-const PROVIDER_DEFAULTS: Record<ConfigProvider, string> = {
+const PROVIDER_DEFAULTS: Record<ConfigProvider, string | undefined> = {
   anthropic: "claude-opus-4-6",
   openai: "gpt-4o",
   bedrock: "anthropic.claude-opus-4-6-v1:0",
   ollama: "llama3.1",
+  "openai-compatible": undefined,
   gateway: "anthropic/claude-opus-4.6",
 };
 
@@ -57,20 +65,27 @@ function resolveProvider(): { provider: ConfigProvider; modelId: string } {
   // Safe: validated by VALID_PROVIDERS.has() above
   const provider = raw as ConfigProvider;
   const modelId = process.env.ATLAS_MODEL ?? PROVIDER_DEFAULTS[provider];
+  if (!modelId) {
+    throw new Error(
+      `ATLAS_MODEL is required when using the "${provider}" provider. ` +
+        "Set it to the model ID served by your inference server (e.g. ATLAS_MODEL=llama3.1)."
+    );
+  }
   return { provider, modelId };
 }
 
-export function getProviderType(): ProviderType {
-  const { provider, modelId } = resolveProvider();
-  if (provider === "bedrock" && isBedrockAnthropicModel(modelId)) {
-    return "bedrock-anthropic";
-  }
-  return provider;
-}
-
-export function getModel(): LanguageModel {
-  const { provider, modelId } = resolveProvider();
+// ---------------------------------------------------------------------------
+// Shared model builder — single source of truth for provider→SDK mapping
+// ---------------------------------------------------------------------------
 
+/**
+ * Build a LanguageModel from an explicit provider + model ID pair.
+ * Both `getModel()` and `getModelForConfig()` delegate to this.
+ *
+ * @throws {Error} When required env vars are missing for the given provider
+ *   (`OPENAI_COMPATIBLE_BASE_URL` for openai-compatible, `AI_GATEWAY_API_KEY` for gateway).
+ */
+function buildModel(provider: ConfigProvider, modelId: string): LanguageModel {
   switch (provider) {
     case "anthropic":
       return anthropic(modelId);
@@ -86,10 +101,30 @@ export function getModel(): LanguageModel {
     case "ollama": {
       const ollama = createOpenAI({
         baseURL: process.env.OLLAMA_BASE_URL ?? "http://localhost:11434/v1",
+        // createOpenAI throws LoadAPIKeyError if no apiKey is provided and
+        // OPENAI_API_KEY is unset. Local servers don't need authentication.
+        apiKey: "not-needed",
       });
       return ollama(modelId);
     }
 
+    case "openai-compatible": {
+      const baseURL = process.env.OPENAI_COMPATIBLE_BASE_URL;
+      if (!baseURL) {
+        throw new Error(
+          "OPENAI_COMPATIBLE_BASE_URL is required when using the openai-compatible provider. " +
+            "Set it to the base URL of your inference server (e.g. http://localhost:8000/v1)."
+        );
+      }
+      const compatible = createOpenAI({
+        baseURL,
+        // createOpenAI throws LoadAPIKeyError if no apiKey is provided and
+        // OPENAI_API_KEY is unset. Most local servers ignore the header.
+        apiKey: process.env.OPENAI_COMPATIBLE_API_KEY ?? "not-needed",
+      });
+      return compatible(modelId);
+    }
+
     case "gateway":
       if (!process.env.AI_GATEWAY_API_KEY) {
         throw new Error(
@@ -105,3 +140,143 @@ export function getModel(): LanguageModel {
     }
   }
 }
+
+// ---------------------------------------------------------------------------
+// Resolve provider type
+// ---------------------------------------------------------------------------
+
+/**
+ * Map a config-level provider to its runtime ProviderType.
+ * Bedrock models using Anthropic's API get `bedrock-anthropic` for
+ * cache-control and prompt formatting decisions.
+ */
+function resolveProviderType(provider: ConfigProvider, modelId: string): ProviderType {
+  if (provider === "bedrock" && isBedrockAnthropicModel(modelId)) {
+    return "bedrock-anthropic";
+  }
+  return provider;
+}
+
+export function getProviderType(): ProviderType {
+  const { provider, modelId } = resolveProvider();
+  return resolveProviderType(provider, modelId);
+}
+
+export function getModel(): LanguageModel {
+  const { provider, modelId } = resolveProvider();
+  return buildModel(provider, modelId);
+}
+
+/**
+ * Create a model + provider type from explicit provider/model values.
+ *
+ * Used by the SaaS hot-reload path to resolve the model from settings
+ * without mutating process.env. Falls back to env vars / defaults for
+ * any value that is undefined.
+ */
+export function getModelForConfig(
+  providerOverride?: string,
+  modelOverride?: string,
+): { model: LanguageModel; providerType: ProviderType; modelId: string } {
+  const raw = providerOverride ?? process.env.ATLAS_PROVIDER ?? getDefaultProvider();
+  if (!VALID_PROVIDERS.has(raw as ConfigProvider)) {
+    throw new Error(
+      `Unknown provider "${raw}". Supported: ${[...VALID_PROVIDERS].join(", ")}`
+    );
+  }
+  const provider = raw as ConfigProvider;
+  const modelId = modelOverride ?? process.env.ATLAS_MODEL ?? PROVIDER_DEFAULTS[provider];
+  if (!modelId) {
+    throw new Error(
+      `ATLAS_MODEL is required when using the "${provider}" provider. ` +
+        "Set it to the model ID served by your inference server (e.g. ATLAS_MODEL=llama3.1)."
+    );
+  }
+
+  return {
+    model: buildModel(provider, modelId),
+    providerType: resolveProviderType(provider, modelId),
+    modelId,
+  };
+}
+
+// ── Workspace-level model resolution ────────────────────────────────
+
+/**
+ * Map a workspace ModelConfigProvider to a ProviderType for cache control
+ * and system prompt formatting. Workspace providers are a subset of the
+ * platform providers — we map them to the corresponding ProviderType.
+ */
+function workspaceProviderType(provider: ModelConfigProvider): ProviderType {
+  switch (provider) {
+    case "anthropic":
+      return "anthropic";
+    case "openai":
+      return "openai";
+    case "azure-openai":
+    case "custom":
+      return "openai-compatible";
+    default: {
+      const _exhaustive: never = provider;
+      throw new Error(`Unknown workspace provider: ${_exhaustive}`);
+    }
+  }
+}
+
+/**
+ * Create a LanguageModel from a workspace-level model configuration.
+ * Uses the provider's SDK with the workspace's own API key and settings.
+ */
+export function getModelFromWorkspaceConfig(config: {
+  provider: ModelConfigProvider;
+  model: string;
+  apiKey: string;
+  baseUrl: string | null;
+}): LanguageModel {
+  switch (config.provider) {
+    case "anthropic": {
+      const client = createAnthropic({ apiKey: config.apiKey });
+      return client(config.model);
+    }
+
+    case "openai": {
+      const client = createOpenAI({ apiKey: config.apiKey });
+      return client(config.model);
+    }
+
+    case "azure-openai": {
+      if (!config.baseUrl) {
+        throw new Error("Base URL is required for the azure-openai provider.");
+      }
+      const client = createOpenAI({
+        apiKey: config.apiKey,
+        baseURL: config.baseUrl,
+      });
+      return client(config.model);
+    }
+
+    case "custom": {
+      if (!config.baseUrl) {
+        throw new Error("Base URL is required for the custom provider.");
+      }
+      const client = createOpenAI({
+        apiKey: config.apiKey,
+        baseURL: config.baseUrl,
+      });
+      return client(config.model);
+    }
+
+    default: {
+      const _exhaustive: never = config.provider;
+      throw new Error(`Unknown workspace provider: ${_exhaustive}`);
+    }
+  }
+}
+
+/**
+ * Get the ProviderType for a workspace-level model configuration.
+ * Used for cache control and system prompt formatting decisions.
+ */
+export function getWorkspaceProviderType(provider: ModelConfigProvider): ProviderType {
+  return workspaceProviderType(provider);
+}

package/templates/nextjs-standalone/src/lib/rls.ts

@@ -14,7 +14,7 @@
  * - Injection runs after plugin beforeQuery hooks — plugins cannot strip RLS
  */
 
-import { Parser } from "node-sql-parser";
+import { Parser, type Select } from "node-sql-parser";
 import type { RLSConfig } from "@atlas/api/lib/config";
 import type { AtlasUser } from "@atlas/api/lib/auth/types";
 import type { DBType } from "@atlas/api/lib/db/connection";
@@ -64,19 +64,27 @@ export interface RLSFilter {
    *  Pre-escaping is required because node-sql-parser's sqlify emits
    *  single_quote_string values literally without escaping. */
   value: string;
+  /** Array of resolved claim values for IN-list conditions. When set,
+   *  takes precedence over `value`. Each element is already SQL-escaped. */
+  values?: string[];
+}
+
+/** A group of filters from a single RLS policy — ANDed together. */
+export interface RLSFilterGroup {
+  filters: RLSFilter[];
 }
 
 /**
  * Match RLS policies against the tables in a query and resolve claim values.
  *
- * Returns either `{ filters }` on success or `{ error }` when the query
- * should be blocked (missing user, missing claims, etc.).
+ * Returns either `{ groups, combineWith }` on success or `{ error }` when
+ * the query should be blocked (missing user, missing claims, etc.).
  */
 export function resolveRLSFilters(
   user: AtlasUser | undefined,
   queriedTables: Set<string>,
   config: RLSConfig,
-): { filters: RLSFilter[] } | { error: string } {
+): { groups: RLSFilterGroup[]; combineWith: "and" | "or" } | { error: string } {
   if (!user) {
     return {
       error:
@@ -91,8 +99,8 @@ export function resolveRLSFilters(
     };
   }
 
-  const filters: RLSFilter[] = [];
-  const seen = new Set<string>();
+  const groups: RLSFilterGroup[] = [];
+  const combineWith = config.combineWith;
 
   for (const policy of config.policies) {
     // Match queried tables against policy tables
@@ -107,39 +115,89 @@ export function resolveRLSFilters(
 
     if (matchingTables.size === 0) continue;
 
-    // Resolve claim value — fail-closed on missing claims
-    const rawValue = resolveClaimPath(user.claims, policy.claim);
-    if (rawValue === undefined || rawValue === null) {
-      return {
-        error: `RLS policy requires claim "${policy.claim}" but it is missing from the user's claims. Query blocked.`,
-      };
-    }
+    // Normalize conditions: single column/claim → conditions array
+    const conditions = policy.conditions ?? (() => {
+      if (!policy.column || !policy.claim) {
+        // Should be unreachable after Zod validation, but fail-closed if it isn't.
+        return [{ column: "__INVALID__", claim: "__INVALID__" }];
+      }
+      return [{ column: policy.column, claim: policy.claim }];
+    })();
+
+    const filters: RLSFilter[] = [];
+
+    for (const condition of conditions) {
+      // Resolve claim value — fail-closed on missing claims
+      const rawValue = resolveClaimPath(user.claims, condition.claim);
+      if (rawValue === undefined || rawValue === null) {
+        return {
+          error: `RLS policy requires claim "${condition.claim}" but it is missing from the user's claims. Query blocked.`,
+        };
+      }
+
+      // Reject object-typed claims (not arrays) — would produce "[object Object]"
+      if (typeof rawValue === "object" && !Array.isArray(rawValue)) {
+        return {
+          error: `RLS policy claim "${condition.claim}" resolved to an object instead of a scalar or array. Use a more specific claim path (e.g. "${condition.claim}.id"). Query blocked.`,
+        };
+      }
 
-    // SQL-escape single quotes and convert to string
-    const strValue = String(rawValue).replace(/'/g, "''");
+      if (Array.isArray(rawValue)) {
+        // Empty array → fail-closed (no values to match against)
+        if (rawValue.length === 0) {
+          return {
+            error: `RLS policy claim "${condition.claim}" resolved to an empty array. Query blocked (fail-closed).`,
+          };
+        }
+        // Validate array elements are primitives — objects would produce "[object Object]"
+        for (const v of rawValue) {
+          if (v === null || v === undefined) {
+            return {
+              error: `RLS policy claim "${condition.claim}" contains a null/undefined array element. Query blocked (fail-closed).`,
+            };
+          }
+          if (typeof v === "object") {
+            return {
+              error: `RLS policy claim "${condition.claim}" contains a non-primitive array element. Array values must be strings, numbers, or booleans. Query blocked.`,
+            };
+          }
+        }
+        const escapedValues = rawValue.map((v) => String(v).replace(/'/g, "''"));
+        for (const table of matchingTables) {
+          filters.push({
+            table,
+            column: condition.column,
+            value: escapedValues[0],
+            values: escapedValues,
+          });
+        }
+      } else {
+        // Scalar claim: SQL-escape single quotes and convert to string
+        const strValue = String(rawValue).replace(/'/g, "''");
+        for (const table of matchingTables) {
+          filters.push({ table, column: condition.column, value: strValue });
+        }
+      }
+    }
 
-    for (const table of matchingTables) {
-      const key = `${table}:${policy.column}`;
-      if (seen.has(key)) continue;
-      seen.add(key);
-      filters.push({ table, column: policy.column, value: strValue });
+    if (filters.length > 0) {
+      groups.push({ filters });
     }
   }
 
-  return { filters };
+  return { groups, combineWith };
 }
 
 // ---------------------------------------------------------------------------
 // AST-based WHERE injection
 // ---------------------------------------------------------------------------
 
-/* eslint-disable @typescript-eslint/no-explicit-any */
-
 /**
  * Walk the AST's FROM array to build a map of table_name → alias.
  * If a table has no alias, it maps to the table name itself.
  */
 function extractTableAliasMap(
+  // eslint-disable-next-line @typescript-eslint/no-explicit-any -- avoids narrowing boilerplate across the BaseFrom | Join | TableExpr | Dual union members
   from: any[],
   cteNames: Set<string>,
 ): Map<string, string> {
@@ -156,7 +214,7 @@ function extractTableAliasMap(
 }
 
 /** Collect CTE names from the WITH clause. */
-function collectCTENames(ast: any): Set<string> {
+function collectCTENames(ast: Select): Set<string> {
   const names = new Set<string>();
   if (Array.isArray(ast.with)) {
     for (const cte of ast.with) {
@@ -167,19 +225,39 @@ function collectCTENames(ast: any): Set<string> {
   return names;
 }
 
-/** Build a column_ref → value equality condition AST node. */
-function buildEqCondition(tableRef: string, column: string, value: string) {
+/** Build an AST condition node for a single RLS filter (= or IN). */
+function buildCondition(tableRef: string, filter: RLSFilter) {
+  if (filter.values && filter.values.length > 0) {
+    // IN-list for array claims
+    return {
+      type: "binary_expr",
+      operator: "IN",
+      left: {
+        type: "column_ref",
+        table: tableRef,
+        column: filter.column,
+      },
+      right: {
+        type: "expr_list",
+        value: filter.values.map((v) => ({
+          type: "single_quote_string",
+          value: v,
+        })),
+      },
+    };
+  }
+  // Equality for scalar claims
   return {
     type: "binary_expr",
     operator: "=",
     left: {
       type: "column_ref",
       table: tableRef,
-      column: column,
+      column: filter.column,
     },
     right: {
       type: "single_quote_string",
-      value,
+      value: filter.value,
     },
   };
 }
@@ -187,10 +265,15 @@ function buildEqCondition(tableRef: string, column: string, value: string) {
 /**
  * Recursively inject RLS conditions into a SELECT AST node.
  * Handles: FROM tables, CTEs, UNIONs, and WHERE-clause subqueries.
+ *
+ * Conditions within a single policy group are ANDed. Groups are combined
+ * using the `combineWith` operator (AND or OR).
  */
 function injectIntoSelectAST(
+  // eslint-disable-next-line @typescript-eslint/no-explicit-any -- AST is mutated in place with hand-constructed condition nodes that don't conform to Binary type, and direct property assignment bypasses type narrowing
   ast: any,
-  filters: RLSFilter[],
+  groups: RLSFilterGroup[],
+  combineWith: "and" | "or",
   dialect: string,
 ): void {
   const cteNames = collectCTENames(ast);
@@ -200,7 +283,7 @@ function injectIntoSelectAST(
     for (const cte of ast.with) {
       const cteAst = cte?.stmt?.ast ?? cte?.stmt;
       if (cteAst && cteAst.type === "select") {
-        injectIntoSelectAST(cteAst, filters, dialect);
+        injectIntoSelectAST(cteAst, groups, combineWith, dialect);
       }
     }
   }
@@ -210,23 +293,48 @@ function injectIntoSelectAST(
   if (Array.isArray(from) && from.length > 0) {
     const aliasMap = extractTableAliasMap(from, cteNames);
 
-    let rlsCondition: any = null;
-    for (const filter of filters) {
-      const alias = aliasMap.get(filter.table.toLowerCase());
-      if (!alias) continue;
-
-      const condition = buildEqCondition(alias, filter.column, filter.value);
-      rlsCondition = rlsCondition
-        ? {
-            type: "binary_expr",
-            operator: "AND",
-            left: rlsCondition,
-            right: condition,
-          }
-        : condition;
+    // Build per-policy-group conditions
+    // eslint-disable-next-line @typescript-eslint/no-explicit-any -- constructed AST condition nodes don't match Binary type exactly
+    const groupConditions: any[] = [];
+    for (const group of groups) {
+      // eslint-disable-next-line @typescript-eslint/no-explicit-any -- accumulated binary_expr nodes built from plain objects
+      let groupCondition: any = null;
+      for (const filter of group.filters) {
+        const alias = aliasMap.get(filter.table.toLowerCase());
+        if (!alias) continue;
+
+        const condition = buildCondition(alias, filter);
+        groupCondition = groupCondition
+          ? {
+              type: "binary_expr",
+              operator: "AND",
+              left: groupCondition,
+              right: condition,
+            }
+          : condition;
+      }
+      if (groupCondition) groupConditions.push(groupCondition);
     }
 
-    if (rlsCondition) {
+    // Combine groups with AND or OR
+    if (groupConditions.length > 0) {
+      const combineOp = combineWith === "or" ? "OR" : "AND";
+      let rlsCondition = groupConditions[0];
+      for (let i = 1; i < groupConditions.length; i++) {
+        rlsCondition = {
+          type: "binary_expr",
+          operator: combineOp,
+          left: rlsCondition,
+          right: groupConditions[i],
+        };
+      }
+
+      // When using OR with multiple groups, wrap in parens to prevent
+      // precedence issues with the existing WHERE clause
+      if (combineWith === "or" && groupConditions.length > 1) {
+        rlsCondition.parentheses = true;
+      }
+
       ast.where = ast.where
         ? {
             type: "binary_expr",
@@ -241,19 +349,19 @@ function injectIntoSelectAST(
     for (const entry of from) {
       const subAst = entry?.expr?.ast;
       if (subAst && subAst.type === "select") {
-        injectIntoSelectAST(subAst, filters, dialect);
+        injectIntoSelectAST(subAst, groups, combineWith, dialect);
       }
     }
   }
 
   // Recurse into subqueries within the WHERE clause
   if (ast.where) {
-    walkWhereForSubqueries(ast.where, filters, dialect);
+    walkWhereForSubqueries(ast.where, groups, combineWith, dialect);
   }
 
   // Handle UNION (recursively inject into _next)
   if (ast._next) {
-    injectIntoSelectAST(ast._next, filters, dialect);
+    injectIntoSelectAST(ast._next, groups, combineWith, dialect);
   }
 }
 
@@ -262,50 +370,54 @@ function injectIntoSelectAST(
  * Injects RLS conditions into any nested SELECT statements.
  */
 function walkWhereForSubqueries(
+  // eslint-disable-next-line @typescript-eslint/no-explicit-any -- recursive duck-typed traversal of AST nodes; a union type would require discriminant checks at each step that would obscure the traversal logic
   node: any,
-  filters: RLSFilter[],
+  groups: RLSFilterGroup[],
+  combineWith: "and" | "or",
   dialect: string,
 ): void {
   if (!node || typeof node !== "object") return;
 
   // Subquery in WHERE (e.g., WHERE id IN (SELECT ...))
   if (node.ast && typeof node.ast === "object" && node.ast.type === "select") {
-    injectIntoSelectAST(node.ast, filters, dialect);
+    injectIntoSelectAST(node.ast, groups, combineWith, dialect);
   }
 
   // Recurse into binary expression children
-  if (node.left) walkWhereForSubqueries(node.left, filters, dialect);
-  if (node.right) walkWhereForSubqueries(node.right, filters, dialect);
+  if (node.left) walkWhereForSubqueries(node.left, groups, combineWith, dialect);
+  if (node.right) walkWhereForSubqueries(node.right, groups, combineWith, dialect);
 
   // Recurse into expr_list values (e.g., IN (...subquery...))
   if (node.type === "expr_list" && Array.isArray(node.value)) {
     for (const v of node.value) {
-      walkWhereForSubqueries(v, filters, dialect);
+      walkWhereForSubqueries(v, groups, combineWith, dialect);
     }
   }
 }
 
-/* eslint-enable @typescript-eslint/no-explicit-any */
-
 /**
  * Inject RLS WHERE conditions into a validated SQL query via AST manipulation.
  *
  * The input SQL must be a single SELECT statement that has already passed
  * validateSQL(). The output is a syntactically valid SQL string with RLS
- * conditions AND-ed into the WHERE clause.
+ * conditions injected into the WHERE clause.
  *
  * @param sql - Validated SQL string (single SELECT).
- * @param filters - RLS filters to inject.
+ * @param groups - RLS filter groups to inject. Conditions within a group are
+ *   ANDed; groups are combined using `combineWith`.
+ * @param combineWith - How to combine conditions from different policies.
  * @param dbType - Database type for parser dialect selection.
  * @returns Modified SQL string with RLS conditions.
  * @throws Error if AST parsing or regeneration fails.
  */
 export function injectRLSConditions(
   sql: string,
-  filters: RLSFilter[],
+  groups: RLSFilterGroup[],
+  combineWith: "and" | "or",
   dbType: DBType,
 ): string {
-  if (filters.length === 0) return sql;
+  const allFilters = groups.flatMap((g) => g.filters);
+  if (allFilters.length === 0) return sql;
 
   const dialect = parserDatabase(dbType);
   const ast = parser.astify(sql.trim().replace(/;\s*$/, ""), {
@@ -313,7 +425,7 @@ export function injectRLSConditions(
   });
   const stmt = Array.isArray(ast) ? ast[0] : ast;
 
-  injectIntoSelectAST(stmt, filters, dialect);
+  injectIntoSelectAST(stmt, groups, combineWith, dialect);
 
   const result = parser.sqlify(stmt, { database: dialect });
   log.debug({ originalLength: sql.length, resultLength: result.length }, "RLS conditions injected into SQL");