botrun-horse 2.29.2 → 2.30.0

package/botrun-c/firebase.json

@@ -0,0 +1,46 @@
+{
+  "firestore": {
+    "rules": "firestore.rules"
+  },
+  "hosting": {
+    "public": "out",
+    "ignore": [
+      "firebase.json",
+      "**/.*",
+      "**/node_modules/**"
+    ],
+    "rewrites": [
+      {
+        "source": "/api/**",
+        "run": {
+          "serviceId": "confidential-botrun",
+          "region": "asia-east1"
+        }
+      },
+      {
+        "source": "**",
+        "destination": "/index.html"
+      }
+    ],
+    "headers": [
+      {
+        "source": "**",
+        "headers": [
+          {
+            "key": "Cache-Control",
+            "value": "no-cache, no-store, must-revalidate"
+          }
+        ]
+      },
+      {
+        "source": "**/*.@(jpg|jpeg|gif|png|svg|webp|js|css)",
+        "headers": [
+          {
+            "key": "Cache-Control",
+            "value": "public, max-age=31536000, immutable"
+          }
+        ]
+      }
+    ]
+  }
+}

package/botrun-c/firestore-init-data.json

@@ -0,0 +1,40 @@
+{
+  "system": {
+    "allowedUsers": {
+      "emails": [
+        "bohachu@gmail.com",
+        "cbh@cameo.tw"
+      ],
+      "updatedAt": "2025-10-18T12:00:00Z",
+      "updatedBy": "system-init"
+    }
+  },
+  "users": {
+    "bohachu@gmail.com": {
+      "email": "bohachu@gmail.com",
+      "allowedService": "botrun-j-53288a47",
+      "serviceUrl": "https://botrun-j-53288a47-36186877499.asia-east1.run.app",
+      "bucketName": "botrun-j-53288a47",
+      "bucketHash": "53288a47",
+      "role": "doctor",
+      "displayName": "Bohachu",
+      "loginMethods": ["google"],
+      "createdAt": "2025-10-18T12:00:00Z",
+      "createdBy": "system-init",
+      "active": true
+    },
+    "cbh@cameo.tw": {
+      "email": "cbh@cameo.tw",
+      "allowedService": "botrun-j-aee12461",
+      "serviceUrl": "https://botrun-j-aee12461-36186877499.asia-east1.run.app",
+      "bucketName": "botrun-j-aee12461",
+      "bucketHash": "aee12461",
+      "role": "doctor",
+      "displayName": "CBH",
+      "loginMethods": ["google"],
+      "createdAt": "2025-10-18T12:00:00Z",
+      "createdBy": "system-init",
+      "active": true
+    }
+  }
+}

package/botrun-c/firestore.indexes.json

@@ -0,0 +1,55 @@
+{
+  "indexes": [
+    {
+      "collectionGroup": "billing-records",
+      "queryScope": "COLLECTION",
+      "fields": [
+        {
+          "fieldPath": "userId",
+          "order": "ASCENDING"
+        },
+        {
+          "fieldPath": "timestamp",
+          "order": "DESCENDING"
+        }
+      ]
+    },
+    {
+      "collectionGroup": "billing-records",
+      "queryScope": "COLLECTION",
+      "fields": [
+        {
+          "fieldPath": "userId",
+          "order": "ASCENDING"
+        },
+        {
+          "fieldPath": "date",
+          "order": "DESCENDING"
+        },
+        {
+          "fieldPath": "endpoint",
+          "order": "ASCENDING"
+        }
+      ]
+    },
+    {
+      "collectionGroup": "billing-records",
+      "queryScope": "COLLECTION",
+      "fields": [
+        {
+          "fieldPath": "userId",
+          "order": "ASCENDING"
+        },
+        {
+          "fieldPath": "yearMonth",
+          "order": "DESCENDING"
+        },
+        {
+          "fieldPath": "model",
+          "order": "ASCENDING"
+        }
+      ]
+    }
+  ],
+  "fieldOverrides": []
+}

package/botrun-c/firestore.rules

@@ -0,0 +1,53 @@
+rules_version = '2';
+service cloud.firestore {
+  match /databases/{database}/documents {
+
+    // 簡化版：任何 Gmail 登入即可使用系統
+    // Firestore 僅用於管理追蹤，不影響登入權限
+
+    // 使用者資料（僅供管理員管理，前端不讀取）
+    match /users/{email} {
+      // 只有 super admin 可以讀寫（用於管理追蹤）
+      allow read, write: if request.auth.token.email in [
+        'bohachu@gmail.com',
+        'cbh@cameo.tw'
+      ];
+    }
+
+    // 審計日誌（只能新增，不能修改或刪除）
+    match /audit_logs/{logId} {
+      allow read: if request.auth.token.email in [
+        'bohachu@gmail.com',
+        'cbh@cameo.tw'
+      ];
+      allow create: if request.auth != null;
+      allow update, delete: if false;
+    }
+
+    // Rate Limit 計數器（後端專用，前端不可存取）
+    match /rate_limit_counters/{counterId} {
+      allow read, write: if false;  // 完全禁止前端存取
+    }
+
+    // 使用者訂閱方案（後端專用）
+    match /user_plans/{userId} {
+      allow read: if request.auth.uid == userId || request.auth.token.email in [
+        'bohachu@gmail.com',
+        'cbh@cameo.tw'
+      ];
+      allow write: if request.auth.token.email in [
+        'bohachu@gmail.com',
+        'cbh@cameo.tw'
+      ];
+    }
+
+    // 使用者訂閱資料（後端專用，前端僅可讀取自己的資料）
+    match /user_subscriptions/{userId} {
+      allow read: if request.auth.uid == userId || request.auth.token.email in [
+        'bohachu@gmail.com',
+        'cbh@cameo.tw'
+      ];
+      allow write: if false;  // 完全由後端控制，前端不可寫入
+    }
+  }
+}

package/botrun-c/fix-codex-permissions.sh

@@ -0,0 +1,56 @@
+#!/bin/bash
+
+echo "🔧 修正 Codex 權限和 PATH 設定..."
+
+# 1. 修正檔案權限（改為當前使用者）
+echo "✓ 修正檔案權限..."
+sudo chown -R 40gpu:staff /Users/40gpu/.npm-global/lib/node_modules/@openai
+sudo chmod +x /Users/40gpu/.npm-global/lib/node_modules/@openai/codex/bin/codex.js
+
+# 2. 檢查並新增 PATH 設定
+echo "✓ 檢查 PATH 設定..."
+NPM_BIN_PATH="/Users/40gpu/.npm-global/bin"
+
+if [[ ":$PATH:" != *":$NPM_BIN_PATH:"* ]]; then
+    echo "  → 偵測到 npm global bin 不在 PATH 中"
+
+    # 根據當前 shell 決定設定檔
+    if [[ "$SHELL" == *"zsh"* ]]; then
+        CONFIG_FILE="$HOME/.zshrc"
+        echo "  → 使用 zsh，將寫入 $CONFIG_FILE"
+    else
+        CONFIG_FILE="$HOME/.bashrc"
+        echo "  → 使用 bash，將寫入 $CONFIG_FILE"
+    fi
+
+    # 新增 PATH 設定（如果尚未存在）
+    if ! grep -q "npm-global/bin" "$CONFIG_FILE" 2>/dev/null; then
+        echo "" >> "$CONFIG_FILE"
+        echo "# NPM Global Bin Path" >> "$CONFIG_FILE"
+        echo "export PATH=\"$NPM_BIN_PATH:\$PATH\"" >> "$CONFIG_FILE"
+        echo "  ✓ 已新增 PATH 設定到 $CONFIG_FILE"
+    else
+        echo "  → PATH 設定已存在於 $CONFIG_FILE"
+    fi
+
+    # 立即載入設定
+    export PATH="$NPM_BIN_PATH:$PATH"
+    echo "  ✓ 已在當前 session 載入 PATH"
+else
+    echo "  → npm global bin 已在 PATH 中"
+fi
+
+# 3. 驗證安裝
+echo ""
+echo "✨ 驗證安裝結果："
+echo "📦 安裝版本："
+npm list -g @openai/codex
+echo ""
+echo "🔍 執行檔位置："
+which codex || echo "  ⚠️  找不到 codex（請重新開啟終端機）"
+echo ""
+echo "📌 版本測試："
+codex --version 2>/dev/null || echo "  ⚠️  請執行 'source ~/.zshrc' 或重新開啟終端機"
+echo ""
+echo "✅ 完成！如果仍無法執行，請執行："
+echo "   source ~/.zshrc   # 或重新開啟終端機"

package/botrun-c/gcs-lifecycle-30day-retention.json

@@ -0,0 +1,12 @@
+{
+  "rule": [
+    {
+      "action": {
+        "type": "Delete"
+      },
+      "condition": {
+        "daysSinceCustomTime": 30
+      }
+    }
+  ]
+}