nodebb-plugin-pdf-secure2 1.4.3 → 1.5.1

package/.claude/settings.local.json

@@ -5,7 +5,12 @@
       "WebFetch(domain:github.com)",
       "Bash(dir:*)",
       "Bash(npm pack:*)",
-      "Bash(tar:*)"
+      "Bash(tar:*)",
+      "Bash(grep:*)",
+      "Bash(find /c/Users/kadir/OneDrive/Masaüstü/Projeler/nodebb-plugin-pdf-secure/nodebb-plugin-pdf-secure -type f \\\\\\(-name *.conf -o -name *.config -o -name *nginx* -o -name *apache* \\\\\\))",
+      "Bash(xargs ls:*)",
+      "WebSearch",
+      "WebFetch(domain:community.nodebb.org)"
     ]
   }
 }

package/lib/controllers.js

@@ -7,6 +7,7 @@ const pdfHandler = require('./pdf-handler');
 const geminiChat = require('./gemini-chat');
 const groups = require.main.require('./src/groups');
 const db = require.main.require('./src/database');
+const topicAccess = require('./topic-access');
 
 const Controllers = module.exports;
 
@@ -26,6 +27,12 @@ const QUOTAS = {
 
 // Apply admin-configured quota settings (called from library.js on init)
 Controllers.initQuotaSettings = function (settings) {
+	console.log('[PDF-Secure][DEBUG] initQuotaSettings called, settings:', JSON.stringify({
+		quotaPremiumTokens: settings?.quotaPremiumTokens,
+		quotaVipTokens: settings?.quotaVipTokens,
+		quotaWindowHours: settings?.quotaWindowHours,
+		geminiApiKey: settings?.geminiApiKey ? '***SET***' : '***EMPTY***',
+	}));
 	if (!settings) return;
 	const premiumTokens = parseInt(settings.quotaPremiumTokens, 10);
 	const vipTokens = parseInt(settings.quotaVipTokens, 10);
@@ -38,6 +45,7 @@ Controllers.initQuotaSettings = function (settings) {
 		QUOTAS.premium.window = windowMs;
 		QUOTAS.vip.window = windowMs;
 	}
+	console.log('[PDF-Secure][DEBUG] Final QUOTAS after init:', JSON.stringify(QUOTAS));
 };
 
 // DB-backed sliding window rate limiter
@@ -53,15 +61,17 @@ async function checkRateLimit(uid, tier) {
 		await db.sortedSetRemoveRangeByScore(key, '-inf', windowStart);
 		// Count remaining entries in window
 		const count = await db.sortedSetCard(key);
+		console.log('[PDF-Secure][DEBUG] checkRateLimit uid=%s tier=%s count=%d max=%d', uid, tier, count, rateConfig.max);
 		if (count >= rateConfig.max) {
+			console.log('[PDF-Secure][DEBUG] Rate limit BLOCKED uid=%s (%d >= %d)', uid, count, rateConfig.max);
 			return { allowed: false, used: count, max: rateConfig.max };
 		}
 		// Add current request (unique member via timestamp + random suffix)
 		await db.sortedSetAdd(key, now, `${now}:${crypto.randomBytes(4).toString('hex')}`);
 		return { allowed: true, used: count + 1, max: rateConfig.max };
 	} catch (err) {
-		// Graceful degradation: allow request if DB fails
-		return { allowed: true, used: 0, max: rateConfig.max };
+		console.error('[PDF-Secure][DEBUG] Rate limit DB ERROR:', err.message, err.stack);
+		return { allowed: false, used: 0, max: rateConfig.max };
 	}
 }
 
@@ -70,21 +80,29 @@ async function checkRateLimit(uid, tier) {
 function sumTokensFromMembers(members) {
 	let total = 0;
 	for (const m of members) {
-		const parts = (typeof m === 'string' ? m : m.value || '').split(':');
-		total += parseInt(parts[2], 10) || 0;
+		const raw = typeof m === 'string' ? m : m.value || '';
+		const parts = raw.split(':');
+		const tokenVal = parseInt(parts[2], 10) || 0;
+		total += tokenVal;
+		// Log each member for debugging (only if suspicious values)
+		if (tokenVal > 50000 || tokenVal < 0 || isNaN(parseInt(parts[2], 10))) {
+			console.log('[PDF-Secure][DEBUG] sumTokens UNUSUAL member: raw="%s" parts=%j tokenVal=%d', raw, parts, tokenVal);
+		}
 	}
 	return total;
 }
 
 // Token-based 4-hour sliding window quota (DB-backed sorted set)
 // Read-only check — does NOT add entries (call recordQuotaUsage after AI response)
-// Returns { allowed, used, max, resetsIn }
+// Returns { allowed, used, max, resetsIn, dbError }
 async function checkQuota(uid, tier) {
 	const cfg = QUOTAS[tier] || QUOTAS.premium;
 	const key = `pdf-secure:quota:${uid}`;
 	const now = Date.now();
 	const windowStart = now - cfg.window;
 
+	console.log('[PDF-Secure][DEBUG] checkQuota START uid=%s tier=%s key=%s max=%d window=%dms', uid, tier, key, cfg.max, cfg.window);
+
 	try {
 		// Remove expired entries outside the 4-hour window
 		await db.sortedSetRemoveRangeByScore(key, '-inf', windowStart);
@@ -92,21 +110,33 @@ async function checkQuota(uid, tier) {
 		const members = await db.getSortedSetRange(key, 0, -1);
 		const totalTokens = sumTokensFromMembers(members);
 
+		console.log('[PDF-Secure][DEBUG] checkQuota uid=%s members=%d totalTokens=%d max=%d', uid, members.length, totalTokens, cfg.max);
+		// Log first 5 members for debugging
+		if (members.length > 0) {
+			console.log('[PDF-Secure][DEBUG] checkQuota uid=%s sample members: %j', uid, members.slice(0, 5));
+		}
+
 		// Calculate resetsIn from oldest entry
 		let resetsIn = 0;
 		if (members.length > 0) {
 			const oldest = await db.getSortedSetRangeWithScores(key, 0, 0);
 			if (oldest && oldest.length > 0) {
 				resetsIn = Math.max(0, (oldest[0].score + cfg.window) - now);
+				console.log('[PDF-Secure][DEBUG] checkQuota uid=%s oldestScore=%d resetsIn=%dms (%s min)', uid, oldest[0].score, resetsIn, Math.round(resetsIn / 60000));
 			}
 		}
 
 		if (totalTokens >= cfg.max) {
+			console.log('[PDF-Secure][DEBUG] checkQuota BLOCKED uid=%s totalTokens=%d >= max=%d', uid, totalTokens, cfg.max);
 			return { allowed: false, used: totalTokens, max: cfg.max, resetsIn };
 		}
+		console.log('[PDF-Secure][DEBUG] checkQuota ALLOWED uid=%s totalTokens=%d < max=%d', uid, totalTokens, cfg.max);
 		return { allowed: true, used: totalTokens, max: cfg.max, resetsIn };
 	} catch (err) {
-		return { allowed: true, used: 0, max: cfg.max, resetsIn: 0 };
+		console.error('[PDF-Secure][DEBUG] checkQuota DB ERROR uid=%s:', uid, err.message, err.stack);
+		// Fail-open on DB error: allow the request but log the issue
+		// Previously this was fail-closed which caused "kota doldu" on any DB hiccup
+		return { allowed: true, used: 0, max: cfg.max, resetsIn: 0, dbError: true };
 	}
 }
 
@@ -116,10 +146,13 @@ async function recordQuotaUsage(uid, tier, tokensUsed) {
 	const cfg = QUOTAS[tier] || QUOTAS.premium;
 	const key = `pdf-secure:quota:${uid}`;
 	const now = Date.now();
+	const member = `${now}:${crypto.randomBytes(4).toString('hex')}:${tokensUsed}`;
+
+	console.log('[PDF-Secure][DEBUG] recordQuotaUsage uid=%s tier=%s tokensUsed=%d member=%s', uid, tier, tokensUsed, member);
 
 	try {
 		// Add entry with token count encoded in member string
-		await db.sortedSetAdd(key, now, `${now}:${crypto.randomBytes(4).toString('hex')}:${tokensUsed}`);
+		await db.sortedSetAdd(key, now, member);
 
 		// Re-read total for accurate response
 		const members = await db.getSortedSetRange(key, 0, -1);
@@ -133,8 +166,10 @@ async function recordQuotaUsage(uid, tier, tokensUsed) {
 			}
 		}
 
+		console.log('[PDF-Secure][DEBUG] recordQuotaUsage uid=%s afterRecord: totalTokens=%d members=%d max=%d', uid, totalTokens, members.length, cfg.max);
 		return { used: totalTokens, max: cfg.max, resetsIn };
 	} catch (err) {
+		console.error('[PDF-Secure][DEBUG] recordQuotaUsage DB ERROR uid=%s:', uid, err.message, err.stack);
 		return { used: 0, max: cfg.max, resetsIn: 0 };
 	}
 }
@@ -146,6 +181,8 @@ async function getQuotaUsage(uid, tier) {
 	const now = Date.now();
 	const windowStart = now - cfg.window;
 
+	console.log('[PDF-Secure][DEBUG] getQuotaUsage uid=%s tier=%s', uid, tier);
+
 	try {
 		await db.sortedSetRemoveRangeByScore(key, '-inf', windowStart);
 		const members = await db.getSortedSetRange(key, 0, -1);
@@ -157,8 +194,10 @@ async function getQuotaUsage(uid, tier) {
 				resetsIn = Math.max(0, (oldest[0].score + cfg.window) - now);
 			}
 		}
+		console.log('[PDF-Secure][DEBUG] getQuotaUsage uid=%s result: used=%d max=%d members=%d resetsIn=%dms', uid, totalTokens, cfg.max, members.length, resetsIn);
 		return { used: totalTokens, max: cfg.max, resetsIn };
 	} catch (err) {
+		console.error('[PDF-Secure][DEBUG] getQuotaUsage DB ERROR uid=%s:', uid, err.message, err.stack);
 		return { used: 0, max: cfg.max, resetsIn: 0 };
 	}
 }
@@ -222,13 +261,17 @@ Controllers.servePdfBinary = async function (req, res) {
 };
 
 Controllers.handleChat = async function (req, res) {
+	console.log('[PDF-Secure][DEBUG] handleChat START uid=%s body.filename=%s', req.uid, req.body?.filename);
+
 	// Authentication gate
 	if (!req.uid) {
+		console.log('[PDF-Secure][DEBUG] handleChat REJECTED: not authenticated');
 		return res.status(401).json({ error: 'Authentication required' });
 	}
 
 	// Check AI availability
 	if (!geminiChat.isAvailable()) {
+		console.log('[PDF-Secure][DEBUG] handleChat REJECTED: AI not available (no API key?)');
 		return res.status(503).json({ error: 'AI chat is not configured' });
 	}
 
@@ -240,32 +283,47 @@ Controllers.handleChat = async function (req, res) {
 		groups.isMember(req.uid, 'VIP'),
 	]);
 	const isPremium = isAdmin || isGlobalMod || isPremiumMember || isVipMember;
+	console.log('[PDF-Secure][DEBUG] handleChat uid=%s groups: isAdmin=%s isGlobalMod=%s isPremium=%s isVip=%s', req.uid, isAdmin, isGlobalMod, isPremiumMember, isVipMember);
 	if (!isPremium) {
+		console.log('[PDF-Secure][DEBUG] handleChat REJECTED: not premium uid=%s', req.uid);
 		return res.status(403).json({ error: 'Bu özellik Premium/VIP üyelere özeldir.' });
 	}
 
 	const isVip = isVipMember || isAdmin;
 	const tier = isVip ? 'vip' : 'premium';
+	console.log('[PDF-Secure][DEBUG] handleChat uid=%s tier=%s isAdmin=%s', req.uid, tier, isAdmin);
+
+	// Quota check (admins bypass for testing)
+	let quotaResult;
+	if (isAdmin) {
+		const cfg = QUOTAS[tier] || QUOTAS.premium;
+		quotaResult = { allowed: true, used: 0, max: cfg.max, resetsIn: 0 };
+		console.log('[PDF-Secure][DEBUG] handleChat uid=%s ADMIN BYPASS - skipping quota/rate checks', req.uid);
+	} else {
+		// 4-hour rolling window quota check (visible to user in quota bar)
+		quotaResult = await checkQuota(req.uid, tier);
+		console.log('[PDF-Secure][DEBUG] handleChat uid=%s quotaResult: %j', req.uid, quotaResult);
+		if (!quotaResult.allowed) {
+			console.log('[PDF-Secure][DEBUG] handleChat REJECTED: quota exhausted uid=%s used=%d max=%d', req.uid, quotaResult.used, quotaResult.max);
+			return res.status(429).json({
+				error: 'Mesaj kotanız doldu.',
+				quotaExhausted: true,
+				quota: { used: quotaResult.used, max: quotaResult.max, resetsIn: quotaResult.resetsIn },
+				tier,
+			});
+		}
 
-	// 4-hour rolling window quota check (visible to user in quota bar)
-	const quotaResult = await checkQuota(req.uid, tier);
-	if (!quotaResult.allowed) {
-		return res.status(429).json({
-			error: 'Mesaj kotanız doldu.',
-			quotaExhausted: true,
-			quota: { used: quotaResult.used, max: quotaResult.max, resetsIn: quotaResult.resetsIn },
-			tier,
-		});
-	}
-
-	// Spam rate limiting (DB-backed 60s sliding window, not shown in UI)
-	const rateResult = await checkRateLimit(req.uid, tier);
-	if (!rateResult.allowed) {
-		return res.status(429).json({ error: 'Çok hızlı mesaj gönderiyorsunuz. Lütfen biraz bekleyin.', quota: { used: quotaResult.used, max: quotaResult.max, resetsIn: quotaResult.resetsIn } });
+		// Spam rate limiting (DB-backed 60s sliding window, not shown in UI)
+		const rateResult = await checkRateLimit(req.uid, tier);
+		if (!rateResult.allowed) {
+			console.log('[PDF-Secure][DEBUG] handleChat REJECTED: rate limit uid=%s', req.uid);
+			return res.status(429).json({ error: 'Çok hızlı mesaj gönderiyorsunuz. Lütfen biraz bekleyin.', quota: { used: quotaResult.used, max: quotaResult.max, resetsIn: quotaResult.resetsIn } });
+		}
 	}
 
 	// Body validation
-	const { filename, question, history } = req.body;
+	const { filename, question, history, tid, detailMode } = req.body;
+	const useDetailMode = tier === 'vip' && detailMode === true;
 
 	if (!filename || typeof filename !== 'string') {
 		return res.status(400).json({ error: 'Missing or invalid filename' });
@@ -275,6 +333,12 @@ Controllers.handleChat = async function (req, res) {
 		return res.status(400).json({ error: 'Invalid filename' });
 	}
 
+	// Topic-level access control
+	const accessResult = await topicAccess.validate(req.uid, tid, safeName);
+	if (!accessResult.allowed) {
+		return res.status(403).json({ error: accessResult.reason || 'Access denied' });
+	}
+
 	const trimmedQuestion = typeof question === 'string' ? question.trim() : '';
 	if (!trimmedQuestion || trimmedQuestion.length > 2000) {
 		return res.status(400).json({ error: 'Question is required (max 2000 characters)' });
@@ -312,36 +376,48 @@ Controllers.handleChat = async function (req, res) {
 	}
 
 	try {
-		const result = await geminiChat.chat(safeName, trimmedQuestion, history || [], tier);
+		console.log('[PDF-Secure][DEBUG] handleChat calling geminiChat.chat uid=%s file=%s question="%s" historyLen=%d tier=%s detailMode=%s',
+			req.uid, safeName, trimmedQuestion.slice(0, 80), (history || []).length, tier, useDetailMode);
+		const result = await geminiChat.chat(safeName, trimmedQuestion, history || [], tier, useDetailMode);
 		// Record actual token usage after successful AI response
 		// Sanitize: clamp to [0, 1000000] to prevent NaN/negative/absurd values
+		const rawTokens = result.tokensUsed;
 		const tokensUsed = Math.max(0, Math.min(parseInt(result.tokensUsed, 10) || 0, 1000000));
+		console.log('[PDF-Secure][DEBUG] handleChat AI SUCCESS uid=%s rawTokens=%s parsedTokens=%d answerLen=%d suspicious=%s',
+			req.uid, rawTokens, tokensUsed, (result.text || '').length, result.suspicious);
 		const updatedQuota = await recordQuotaUsage(req.uid, tier, tokensUsed);
+		console.log('[PDF-Secure][DEBUG] handleChat RESPONSE uid=%s quota: used=%d max=%d', req.uid, updatedQuota.used, updatedQuota.max);
 		return res.json({
 			answer: result.text,
 			injectionWarning: result.suspicious || false,
 			quota: updatedQuota,
 		});
 	} catch (err) {
-		console.error('[PDF-Secure] Chat error:', err.message, err.status || '', err.code || '');
+		console.error('[PDF-Secure][DEBUG] handleChat ERROR uid=%s:', req.uid, err.message, 'status=', err.status || 'none', 'code=', err.code || 'none');
+		console.error('[PDF-Secure][DEBUG] handleChat ERROR stack:', err.stack);
 		// On error, no tokens were used — return pre-call quota
 		const quota = { used: quotaResult.used, max: quotaResult.max, resetsIn: quotaResult.resetsIn };
 
 		if (err.message === 'File not found') {
+			console.log('[PDF-Secure][DEBUG] handleChat returning 404 PDF not found');
 			return res.status(404).json({ error: 'PDF bulunamadı.', quota });
 		}
 		if (err.message === 'PDF too large for AI chat') {
+			console.log('[PDF-Secure][DEBUG] handleChat returning 413 PDF too large');
 			const sizeMsg = tier === 'premium'
 				? 'Bu PDF, Premium limiti (20MB) aşıyor. VIP üyelikle 50MB\'a kadar PDF\'lerle sohbet edebilirsiniz.'
 				: 'Bu PDF çok büyük. AI chat için maksimum dosya boyutu 50MB.';
 			return res.status(413).json({ error: sizeMsg, quota, showUpgrade: tier === 'premium' });
 		}
 		if (err.status === 429 || err.message.includes('rate limit') || err.message.includes('quota')) {
+			console.log('[PDF-Secure][DEBUG] handleChat returning 429 Gemini rate limit/quota');
 			return res.status(429).json({ error: 'AI servisi şu an yoğun. Lütfen birkaç saniye sonra tekrar deneyin.', quota });
 		}
 		if (err.status === 401 || err.status === 403 || err.message.includes('API key')) {
+			console.log('[PDF-Secure][DEBUG] handleChat returning 503 API key/auth issue');
 			return res.status(503).json({ error: 'AI servisi yapılandırma hatası. Yöneticiyle iletişime geçin.', quota });
 		}
+		console.log('[PDF-Secure][DEBUG] handleChat returning 500 generic error');
 		return res.status(500).json({ error: 'AI yanıt veremedi. Lütfen tekrar deneyin.', quota });
 	}
 };
@@ -356,10 +432,12 @@ setInterval(() => {
 	}
 }, 5 * 60 * 1000).unref();
 Controllers.getSuggestions = async function (req, res) {
+	console.log('[PDF-Secure][DEBUG] getSuggestions START uid=%s filename=%s', req.uid, req.query?.filename);
 	if (!req.uid) {
 		return res.status(401).json({ error: 'Authentication required' });
 	}
 	if (!geminiChat.isAvailable()) {
+		console.log('[PDF-Secure][DEBUG] getSuggestions REJECTED: AI not available');
 		return res.status(503).json({ error: 'AI chat is not configured' });
 	}
 
@@ -370,6 +448,7 @@ Controllers.getSuggestions = async function (req, res) {
 		groups.isMember(req.uid, 'Premium'),
 		groups.isMember(req.uid, 'VIP'),
 	]);
+	console.log('[PDF-Secure][DEBUG] getSuggestions uid=%s groups: admin=%s gmod=%s premium=%s vip=%s', req.uid, isAdmin, isGlobalMod, isPremiumMember, isVipMember);
 	if (!isAdmin && !isGlobalMod && !isPremiumMember && !isVipMember) {
 		return res.status(403).json({ error: 'Premium/VIP only' });
 	}
@@ -385,7 +464,7 @@ Controllers.getSuggestions = async function (req, res) {
 	}
 	suggestionsRateLimit.set(req.uid, now);
 
-	const { filename } = req.query;
+	const { filename, tid } = req.query;
 	if (!filename || typeof filename !== 'string') {
 		return res.status(400).json({ error: 'Missing filename' });
 	}
@@ -394,12 +473,54 @@ Controllers.getSuggestions = async function (req, res) {
 		return res.status(400).json({ error: 'Invalid filename' });
 	}
 
+	// Topic-level access control
+	const accessResult = await topicAccess.validate(req.uid, tid, safeName);
+	if (!accessResult.allowed) {
+		return res.status(403).json({ error: accessResult.reason || 'Access denied' });
+	}
+
 	try {
-		const suggestions = await geminiChat.generateSuggestions(safeName);
+		console.log('[PDF-Secure][DEBUG] getSuggestions calling generateSuggestions file=%s tier=%s', safeName, tier);
+		const suggestions = await geminiChat.generateSuggestions(safeName, tier);
 		const quotaUsage = await getQuotaUsage(req.uid, tier);
+		console.log('[PDF-Secure][DEBUG] getSuggestions SUCCESS uid=%s suggestions=%d quota: used=%d max=%d', req.uid, suggestions.length, quotaUsage.used, quotaUsage.max);
 		return res.json({ suggestions, quota: quotaUsage });
 	} catch (err) {
-		console.error('[PDF-Secure] Suggestions error:', err.message);
+		console.error('[PDF-Secure][DEBUG] getSuggestions ERROR uid=%s:', req.uid, err.message, err.stack);
 		return res.json({ suggestions: [] });
 	}
 };
+
+// Admin: reset quota for a specific user or all users
+Controllers.resetQuota = async function (req, res) {
+	console.log('[PDF-Secure][DEBUG] resetQuota called by uid=%s body=%j', req.uid, req.body);
+	if (!req.uid) {
+		return res.status(401).json({ error: 'Authentication required' });
+	}
+
+	const isAdmin = await groups.isMember(req.uid, 'administrators');
+	if (!isAdmin) {
+		console.log('[PDF-Secure][DEBUG] resetQuota REJECTED: uid=%s not admin', req.uid);
+		return res.status(403).json({ error: 'Admin only' });
+	}
+
+	const targetUid = parseInt(req.body.uid, 10);
+
+	try {
+		if (targetUid > 0) {
+			// Reset specific user's quota and rate limit
+			console.log('[PDF-Secure][DEBUG] resetQuota deleting quota+ratelimit for uid=%s (requested by admin uid=%s)', targetUid, req.uid);
+			await db.delete(`pdf-secure:quota:${targetUid}`);
+			await db.delete(`pdf-secure:ratelimit:${targetUid}`);
+			return res.json({ success: true, message: `UID ${targetUid} kotası sıfırlandı.` });
+		}
+		// No uid specified: reset the calling admin's own quota
+		console.log('[PDF-Secure][DEBUG] resetQuota deleting own quota+ratelimit for admin uid=%s', req.uid);
+		await db.delete(`pdf-secure:quota:${req.uid}`);
+		await db.delete(`pdf-secure:ratelimit:${req.uid}`);
+		return res.json({ success: true, message: 'Kendi kotanız sıfırlandı.' });
+	} catch (err) {
+		console.error('[PDF-Secure][DEBUG] resetQuota ERROR:', err.message, err.stack);
+		return res.status(500).json({ error: 'Kota sıfırlama hatası.' });
+	}
+};