nolo-cli 0.1.13 → 0.1.14

package/database/server/upload.ts

@@ -0,0 +1,159 @@
+// 文件路径: database/server/upload.ts
+import { Request } from "bun";
+import { saveBufferAsFile, FileMetadata } from "./fileService";
+
+/**
+ * 检查请求方法是否为 POST
+ */
+const validateRequestMethod = (method: string): Response | null => {
+  if (method !== "POST") {
+    return new Response(JSON.stringify({ error: "Method not allowed" }), {
+      status: 405,
+      headers: { "Content-Type": "application/json" },
+    });
+  }
+  return null;
+};
+
+/**
+ * 从 URL / metadata / userId 中解析 tenantId
+ */
+const resolveTenantId = (params: {
+  explicitTenantId?: string | null;
+  userId?: string | null;
+  clientMetadata?: Record<string, any> | null;
+}): string | undefined => {
+  const { explicitTenantId, userId, clientMetadata } = params;
+
+  if (explicitTenantId && explicitTenantId.trim()) return explicitTenantId;
+  if (clientMetadata?.tenantId && String(clientMetadata.tenantId).trim()) {
+    return String(clientMetadata.tenantId).trim();
+  }
+  if (userId && userId.trim()) return userId;
+
+  return undefined;
+};
+
+/**
+ * 处理文件上传请求
+ *
+ * 支持的 FormData 字段：
+ * - file      : File (必需)
+ * - metadata  : string(JSON) (可选，来自前端 uploadFileAction)
+ * - customKey : string (可选，作为 ownerDbKey 的候选值)
+ * - userId    : string (可选，上传者)
+ * - tenantId  : string (可选，显式指定租户)
+ * - ownerType : string (可选)
+ * - ownerId   : string (可选)
+ */
+export const handleUpload = async (req: Request): Promise<Response> => {
+  try {
+    const methodValidation = validateRequestMethod(req.method);
+    if (methodValidation) return methodValidation;
+
+    const formData = await req.formData();
+    const file = formData.get("file") as File | null;
+    if (!file) {
+      return new Response(JSON.stringify({ error: "No file uploaded" }), {
+        status: 400,
+        headers: { "Content-Type": "application/json" },
+      });
+    }
+
+    const metadataRaw = formData.get("metadata");
+    const customKeyRaw = formData.get("customKey");
+    const userIdRaw = formData.get("userId");
+    const tenantIdRaw = formData.get("tenantId");
+    const ownerTypeRaw = formData.get("ownerType");
+    const ownerIdRaw = formData.get("ownerId");
+
+    let clientMetadata: Record<string, any> | null = null;
+    if (typeof metadataRaw === "string") {
+      try {
+        clientMetadata = JSON.parse(metadataRaw);
+      } catch (e) {
+        console.warn("[handleUpload] Failed to parse metadata JSON:", e);
+      }
+    }
+
+    const customKey =
+      typeof customKeyRaw === "string"
+        ? customKeyRaw
+        : undefined;
+
+    const userId =
+      typeof userIdRaw === "string"
+        ? userIdRaw
+        : clientMetadata?.userId ?? undefined;
+
+    const explicitTenantId =
+      typeof tenantIdRaw === "string" ? tenantIdRaw : undefined;
+
+    const ownerType =
+      typeof ownerTypeRaw === "string"
+        ? ownerTypeRaw
+        : clientMetadata?.ownerType;
+
+    const ownerId =
+      typeof ownerIdRaw === "string"
+        ? ownerIdRaw
+        : clientMetadata?.ownerId ?? userId;
+
+    const tenantId = resolveTenantId({
+      explicitTenantId,
+      userId,
+      clientMetadata,
+    });
+
+    const clientProvidedId =
+      clientMetadata && typeof clientMetadata.id === "string"
+        ? clientMetadata.id
+        : undefined;
+
+    const buffer = Buffer.from(await file.arrayBuffer());
+
+    const { fileId, metadata } = await saveBufferAsFile(buffer, {
+      tenantId: tenantId || "default",
+      originalName: file.name || "upload",
+      mimeType: file.type || "application/octet-stream",
+
+      ownerType: ownerType || (userId ? "user" : "system"),
+      ownerId: ownerId,
+      uploadedBy: userId,
+      // 这里的 ownerDbKey 是“业务记录的 dbKey”，比如 profile/key/page key
+      ownerDbKey: customKey ?? clientMetadata?.ownerDbKey,
+      source: clientMetadata?.source || "user-upload",
+      model: clientMetadata?.model,
+      prompt: clientMetadata?.prompt,
+      tags: clientMetadata?.tags,
+
+      clientMetadata,
+      clientProvidedId,
+    });
+
+    const responseBody = {
+      message: "File uploaded successfully",
+      fileId,
+      metadata,
+    };
+
+    return new Response(JSON.stringify(responseBody), {
+      status: 200,
+      headers: {
+        "Content-Type": "application/json",
+      },
+    });
+  } catch (error: any) {
+    console.error("[handleUpload] File upload error:", error);
+    return new Response(
+      JSON.stringify({
+        error: "Failed to upload file",
+        details: error?.message || "Unknown error",
+      }),
+      {
+        status: 500,
+        headers: { "Content-Type": "application/json" },
+      }
+    );
+  }
+};

package/database/server/write.ts

@@ -0,0 +1,494 @@
+// 文件路径: packages/database/server/write.ts
+
+import { logger } from "auth/server/shared";
+import { deductUserBalance } from "auth/server/deduct";
+import { DataType } from "create/types";
+import serverDb, { ensureServerDbOpen } from "./db";
+import { handleToken, handleCybot } from "./dataHandlers";
+import { handleTransaction } from "./handleTransaction";
+import { handleToken as handleAuthToken } from "auth/server/token";
+import {
+  CYBOT_READONLY_MESSAGE,
+  isCybotReadOnlyMutation,
+} from "./cybotReadonly";
+import { invalidatePublicAgentsCache } from "ai/agent/server/fetchPublicAgents";
+import { emitSpaceMemberAddedNotification } from "server/handlers/notificationEmitter";
+import { canWriteRecord } from "./writeAuthority";
+import { canWriteSpaceMemberRecord, parseSpaceMemberKey } from "./spaceMemberAuthority";
+import {
+  bootstrapReplicatedTable,
+  findActiveLiveShareByTable,
+  patchShareMeta,
+  reconcileReplicaTable,
+  replicateSharedTableMutation,
+} from "../../share/server/tableReplication";
+
+const getRequestOrigin = (req: any): string => {
+  try {
+    return new URL(req?.url ?? "").origin.replace(/\/+$/, "");
+  } catch {
+    return "";
+  }
+};
+
+const getForwardHeaders = (req: any): Record<string, string> => {
+  const headers: Record<string, string> = {
+    "Content-Type": "application/json",
+  };
+  const authHeader =
+    typeof req?.headers?.authorization === "string"
+      ? req.headers.authorization
+      : typeof req?.headers?.Authorization === "string"
+        ? req.headers.Authorization
+        : "";
+  if (authHeader) {
+    headers.Authorization = authHeader;
+  }
+  return headers;
+};
+
+const normalizeShareMetaTableOwner = (tableDbKey: string) => {
+  const parts = tableDbKey.split("-");
+  if (parts.length >= 3 && parts[0] === "meta") {
+    return parts[1];
+  }
+  return "";
+};
+
+const normalizeOriginServer = (value: unknown) =>
+  typeof value === "string" && value.trim()
+    ? value.trim().replace(/\/+$/, "")
+    : "";
+
+const bootstrapLiveShareFromWrite = async (
+  req: any,
+  customKey: string,
+  data: Record<string, any>,
+  actionUserId: string
+) => {
+  if (
+    typeof data?.meta?.mode !== "string" ||
+    data.meta.mode !== "live" ||
+    typeof data?.meta?.tableDbKey !== "string" ||
+    typeof data?.type !== "string" ||
+    data.type !== DataType.TABLE
+  ) {
+    return;
+  }
+
+  const tableDbKey = data.meta.tableDbKey;
+  const tableOwnerId =
+    typeof data.meta.tableOwnerId === "string"
+      ? data.meta.tableOwnerId
+      : normalizeShareMetaTableOwner(tableDbKey);
+  if (!tableOwnerId || !tableDbKey) {
+    return;
+  }
+
+  const replicaServers = Array.isArray(data.meta.replicaServers)
+    ? data.meta.replicaServers
+        .map((server) =>
+          typeof server === "string" ? server.replace(/\/+$/, "") : ""
+        )
+        .filter(Boolean)
+    : [];
+  if (replicaServers.length === 0) {
+    return;
+  }
+
+  const originServer = normalizeOriginServer(data.meta.originServer);
+  const requestOrigin = normalizeOriginServer(getRequestOrigin(req));
+  if (!originServer || originServer !== requestOrigin) {
+    return;
+  }
+
+  await bootstrapReplicatedTable({
+    shareDbKey: customKey,
+    shareRecord: data,
+    tableDbKey,
+    tableOwnerId,
+    originServer: requestOrigin,
+    replicaServers,
+    thunkApi: null,
+    putRecordToServer: async (server, dbKey, record) => {
+      try {
+        const response = await fetch(`${server}/api/v1/db/write/`, {
+          method: "POST",
+          headers: getForwardHeaders(req),
+          body: JSON.stringify({
+            data: record,
+            customKey: dbKey,
+            userId: record?.userId ?? record?.tenantId ?? actionUserId,
+          }),
+        });
+        return {
+          ok: response.ok,
+          status: response.status,
+          detail: response.ok ? "" : await response.text(),
+        };
+      } catch (error: any) {
+        return {
+          ok: false,
+          detail: error?.message ?? "Replica bootstrap request failed",
+        };
+      }
+    },
+    patchShareMeta,
+  });
+};
+
+export const handleWrite = async (req: any, res: any) => {
+  // 1. 鉴权：从 token 中还原用户
+  req.user = await handleAuthToken(req, res);
+
+  const { user } = req;
+  const actionUserId = user?.userId;
+
+  const { userId, data, customKey, indexKeys } = req.body ?? {};
+
+  // 基本参数校验
+  if (!data || !customKey) {
+    logger.warn({
+      event: "write_invalid_payload",
+      actionUserId,
+      body: req.body,
+    });
+    return res.status(400).json({
+      message: "Invalid payload: missing data or customKey",
+    });
+  }
+
+  if (isCybotReadOnlyMutation({ dbKey: customKey, dataType: data.type })) {
+    logger.warn({
+      event: "cybot_write_blocked",
+      actionUserId,
+      customKey,
+      dataType: data.type,
+    });
+    return res.status(403).json({
+      message: CYBOT_READONLY_MESSAGE,
+      error: "cybot_readonly",
+    });
+  }
+
+  const saveUserId = userId || data.userId;
+  const writeAuthority = canWriteRecord({
+    dbKey: customKey,
+    actionUserId,
+    record: {
+      ...data,
+      userId: saveUserId,
+    },
+  });
+  const isSpaceMemberWrite = parseSpaceMemberKey(customKey) !== null;
+
+  // 禁止写入 local 用户数据
+  if (saveUserId === "local") {
+    logger.warn({
+      event: "local_write_rejected",
+      actionUserId,
+    });
+    return res.status(400).json({
+      message: "local data is not allowed.",
+    });
+  }
+
+  // ⭐ 确保 LevelDB 已打开（后面要 get/put）
+  await ensureServerDbOpen();
+
+  // 校验当前操作用户是否存在
+  const userExist = await serverDb.get(`user:${actionUserId}`);
+  if (!userExist) {
+    logger.warn({
+      event: "write_permission_denied",
+      actionUserId,
+      targetUserId: saveUserId,
+      dataType: data.type,
+      error: "用户不存在",
+    });
+    return res.status(403).json({
+      message: "操作不被允许：用户不存在",
+      error: "用户不存在",
+    });
+  }
+
+  const canManageSpaceMember =
+    isSpaceMemberWrite &&
+    (await canWriteSpaceMemberRecord({
+      dbKey: customKey,
+      actionUserId,
+    }));
+
+  if ((!writeAuthority.isAllowed && !canManageSpaceMember) || !userExist) {
+    logger.warn({
+      event: "write_permission_denied",
+      actionUserId,
+      targetUserId: saveUserId,
+      keyOwnerId: writeAuthority.keyOwnerId,
+      recordOwnerId: writeAuthority.recordOwnerId,
+      canManageSpaceMember,
+      dataType: data.type,
+      error: `用户 ${actionUserId} 无权写入 key ${customKey}`,
+    });
+    return res.status(403).json({
+      message: `操作不被允许：用户 ${actionUserId} 无权写入 key ${customKey}`,
+      error: `无权写入，当前用户：${actionUserId}，keyOwner：${writeAuthority.keyOwnerId}, recordOwner：${writeAuthority.recordOwnerId}`,
+    });
+  }
+
+  try {
+    const dataType: DataType = data.type;
+    let result;
+
+    switch (dataType) {
+      case DataType.TRANSACTION: {
+        result = await handleTransaction(data, res, customKey, actionUserId);
+        break;
+      }
+
+      case DataType.TOKEN: {
+        result = await handleToken(data, res, userId, customKey, actionUserId, deductUserBalance);
+        break;
+      }
+
+      case DataType.CYBOT: {
+        result = await handleCybot(data, res, customKey);
+        break;
+      }
+
+      default: {
+        // ✅ 统一简单类型的写入逻辑（直接写 KV）
+        if (
+          dataType === DataType.AGENT ||
+          dataType === DataType.MSG ||
+          dataType === DataType.DOC ||
+          dataType === DataType.DIALOG ||
+          dataType === DataType.NOTIFICATION ||
+          dataType === DataType.SPACE ||
+          dataType === DataType.SETTING ||
+          dataType === DataType.TABLE ||
+          dataType === DataType.TABLE_ROW ||
+          dataType === DataType.EMAIL ||
+          dataType === DataType.IMAGE ||
+          dataType === DataType.APP
+        ) {
+          if (dataType === DataType.SPACE) {
+            console.log("Creating space with key:", customKey);
+          }
+
+          if (isSpaceMemberWrite && !data.userId) {
+            const parsedMemberKey = parseSpaceMemberKey(customKey);
+            if (parsedMemberKey) {
+              data.userId = parsedMemberKey.memberUserId;
+            }
+          }
+
+          // Generic author enrichment (fallback if frontend didn't provide)
+          if (user) {
+            if (!data.authorName) data.authorName = user.name || user.username || "Anonymous";
+            if (!data.authorAvatar) data.authorAvatar = user.avatar;
+          }
+
+          // Write data + optional index keys (frontend-driven)
+          if (Array.isArray(indexKeys) && indexKeys.length > 0) {
+            // Validate indexKeys — server stays dumb but safe
+            const shareToken = customKey.startsWith("share-")
+              ? customKey.slice("share-".length)
+              : "";
+            if (!shareToken) {
+              return res.status(400).json({ error: "indexKeys only allowed for share keys" });
+            }
+            for (const ik of indexKeys) {
+              if (typeof ik !== "string" || !ik.startsWith("shareidx-")) {
+                return res.status(400).json({ error: "indexKey must start with shareidx-" });
+              }
+              if (!ik.endsWith(`-${shareToken}`)) {
+                return res.status(400).json({ error: "indexKey token mismatch" });
+              }
+              // Ownership guard: owner-{userId} and creator-{userId} must match authenticated user
+              const ownerPrefix = `shareidx-owner-${actionUserId}-`;
+              if (ik.startsWith("shareidx-owner-") && !ik.startsWith(ownerPrefix)) {
+                return res.status(403).json({ error: "indexKey owner mismatch" });
+              }
+              const creatorPrefix = `shareidx-community-creator-${actionUserId}-`;
+              if (ik.startsWith("shareidx-community-creator-") && !ik.startsWith(creatorPrefix)) {
+                return res.status(403).json({ error: "indexKey creator mismatch" });
+              }
+            }
+
+            const batch = serverDb.batch();
+            batch.put(customKey, data);
+            for (const ik of indexKeys) {
+              batch.put(ik, customKey);
+            }
+            await batch.write();
+          } else {
+            await serverDb.put(customKey, data);
+          }
+
+          if (
+            customKey.startsWith("share-") &&
+            data?.type === DataType.TABLE
+          ) {
+            await bootstrapLiveShareFromWrite(req, customKey, data as Record<string, any>, actionUserId);
+          }
+
+          if (isSpaceMemberWrite) {
+            await emitSpaceMemberAddedNotification({
+              actionUserId,
+              customKey,
+              data,
+            });
+          }
+
+          if (
+            (dataType === DataType.TABLE || dataType === DataType.TABLE_ROW) &&
+            typeof data?.tenantId === "string" &&
+            typeof data?.tableId === "string"
+          ) {
+            await replicateSharedTableMutation({
+              mutation: {
+                kind: "write",
+                dbKey: customKey,
+                data,
+                dataType,
+                tenantId: data.tenantId,
+                tableId: data.tableId,
+              },
+              originServer: getRequestOrigin(req),
+              replicaServers: [],
+              findActiveLiveShare: findActiveLiveShareByTable,
+              putMutationToReplica: async (server, mutation) => {
+                try {
+                  const response = await fetch(`${server}/api/v1/db/write/`, {
+                    method: "POST",
+                    headers: getForwardHeaders(req),
+                    body: JSON.stringify({
+                      data: mutation.data,
+                      customKey: mutation.dbKey,
+                      userId:
+                        mutation.data?.userId ??
+                        mutation.data?.tenantId ??
+                        actionUserId,
+                    }),
+                  });
+                  return {
+                    ok: response.ok,
+                    status: response.status,
+                    detail: response.ok ? "" : await response.text(),
+                  };
+                } catch (error: any) {
+                  return {
+                    ok: false,
+                    detail: error?.message ?? "Replica write request failed",
+                  };
+                }
+              },
+              reconcileReplicaTable: async ({
+                shareDbKey,
+                tableDbKey,
+                tableOwnerId,
+                replicaServers,
+              }) => {
+                const resolvedTableDbKey =
+                  tableDbKey || `meta-${data.tenantId}-${data.tableId}`;
+                const resolvedTableOwnerId = tableOwnerId || data.tenantId;
+                await reconcileReplicaTable({
+                  shareDbKey,
+                  tableDbKey: resolvedTableDbKey,
+                  tableOwnerId: resolvedTableOwnerId,
+                  originServer: getRequestOrigin(req),
+                  replicaServers,
+                  thunkApi: null,
+                  putRecordToServer: async (server, dbKey, record) => {
+                    try {
+                      const response = await fetch(`${server}/api/v1/db/write/`, {
+                        method: "POST",
+                        headers: getForwardHeaders(req),
+                        body: JSON.stringify({
+                          data: record,
+                          customKey: dbKey,
+                          userId:
+                            record?.userId ?? record?.tenantId ?? actionUserId,
+                        }),
+                      });
+                      return {
+                        ok: response.ok,
+                        status: response.status,
+                        detail: response.ok ? "" : await response.text(),
+                      };
+                    } catch (error: any) {
+                      return {
+                        ok: false,
+                        detail: error?.message ?? "Replica reconcile request failed",
+                      };
+                    }
+                  },
+                  resetReplicaTable: async (server, tableDbKey) => {
+                    try {
+                      const response = await fetch(
+                        `${server}/api/v1/db/delete/${encodeURIComponent(tableDbKey)}?type=table`,
+                        {
+                          method: "DELETE",
+                          headers: getForwardHeaders(req),
+                        }
+                      );
+                      return {
+                        ok: response.ok,
+                        status: response.status,
+                        detail: response.ok ? "" : await response.text(),
+                      };
+                    } catch (error: any) {
+                      return {
+                        ok: false,
+                        detail: error?.message ?? "Replica table reset failed",
+                      };
+                    }
+                  },
+                  patchShareMeta,
+                });
+              },
+              patchShareMeta,
+            });
+          }
+
+          if (customKey.startsWith("agent-pub-") || customKey.startsWith("cybot-pub-")) {
+            invalidatePublicAgentsCache();
+          }
+
+          result = res.status(200).json({
+            message: "Data written to file successfully.",
+            id: customKey,
+            dbKey: customKey,
+            ...data,
+          });
+        }
+        break;
+      }
+    }
+
+    if (result) return result;
+
+    // data.type 不在已知列表中
+    logger.warn({
+      event: "write_invalid_data_type",
+      actionUserId,
+      targetUserId: saveUserId,
+      dataType,
+    });
+
+    return res.status(400).json({
+      message: "Invalid data type",
+    });
+  } catch (error) {
+    logger.error({
+      event: "write_failed",
+      error,
+      data: { id: customKey, dbKey: customKey, type: data.type },
+    });
+    return res.status(500).json({
+      message: "Failed to write data",
+      error,
+    });
+  }
+};