openlearn-next 0.7.10 → 0.7.12

package/dist/server.cjs

@@ -3304,6 +3304,95 @@ var init_ai_event_bus = __esm({
   }
 });
 
+// packages/core/di/ai-provider-resolver.ts
+function hasOwnerColumns(db2) {
+  try {
+    const cols = db2.prepare("PRAGMA table_info(ai_providers)").all();
+    return cols.some((c) => c.name === "owner_id");
+  } catch {
+    return false;
+  }
+}
+function resolveAccessibleAiProvider(db2, options = {}) {
+  const { providerId, userId, lang = "zh" } = options;
+  const supportsOwner = hasOwnerColumns(db2);
+  let provider;
+  if (providerId) {
+    const row = supportsOwner ? db2.prepare(
+      "SELECT id, name, api_url, api_key, model_name, owner_id, is_shared, created_at, updated_at FROM ai_providers WHERE id = ?"
+    ).get(providerId) : db2.prepare("SELECT id, name, api_url, api_key, model_name FROM ai_providers WHERE id = ?").get(providerId);
+    if (!row) {
+      throw new AiProviderError(
+        lang === "zh" ? "\u672A\u627E\u5230\u6307\u5B9A\u7684 AI \u63D0\u4F9B\u5546" : "Specified AI Provider not found",
+        404,
+        "PROVIDER_NOT_FOUND"
+      );
+    }
+    if (supportsOwner) {
+      const isShared = Number(row.is_shared) === 1 || row.owner_id === null;
+      const isOwner = Boolean(userId && row.owner_id === userId);
+      if (!isShared && !isOwner) {
+        throw new AiProviderError(
+          lang === "zh" ? "\u65E0\u6743\u4F7F\u7528\u8BE5 AI \u63D0\u4F9B\u5546\uFF08\u975E\u672C\u4EBA\u79C1\u6709\u4E14\u672A\u5171\u4EAB\uFF09" : "Forbidden: You do not have access to this private AI provider",
+          403,
+          "PROVIDER_ACCESS_DENIED"
+        );
+      }
+    }
+    provider = row;
+  } else {
+    if (!supportsOwner) {
+      provider = db2.prepare(
+        "SELECT id, name, api_url, api_key, model_name FROM ai_providers WHERE api_key IS NOT NULL AND api_key != '' ORDER BY created_at DESC LIMIT 1"
+      ).get();
+    } else if (userId) {
+      provider = db2.prepare(
+        `SELECT id, name, api_url, api_key, model_name, owner_id, is_shared, created_at, updated_at
+           FROM ai_providers
+           WHERE (owner_id = ? OR is_shared = 1 OR owner_id IS NULL)
+             AND api_key IS NOT NULL AND api_key != ''
+           ORDER BY (CASE WHEN owner_id = ? THEN 0 WHEN is_shared = 1 THEN 1 ELSE 2 END), created_at DESC
+           LIMIT 1`
+      ).get(userId, userId);
+    } else {
+      provider = db2.prepare(
+        `SELECT id, name, api_url, api_key, model_name, owner_id, is_shared, created_at, updated_at
+           FROM ai_providers
+           WHERE (is_shared = 1 OR owner_id IS NULL)
+             AND api_key IS NOT NULL AND api_key != ''
+           ORDER BY (CASE WHEN is_shared = 1 THEN 0 ELSE 1 END), created_at DESC
+           LIMIT 1`
+      ).get();
+    }
+  }
+  if (provider?.api_key) {
+    provider.api_key = decryptApiKey(provider.api_key);
+  }
+  if (!provider || !provider.api_key || !provider.api_key.trim()) {
+    throw new AiProviderError(
+      lang === "zh" ? "\u672A\u68C0\u6D4B\u5230\u53EF\u7528\u7684 AI \u63D0\u4F9B\u5546\u3002\u8BF7\u524D\u5F80\u914D\u7F6E\u5927\u6A21\u578B\u670D\u52A1\u3002" : "No active AI Provider configured. Please add and configure an AI Provider in settings.",
+      400,
+      "NO_AI_PROVIDER"
+    );
+  }
+  return provider;
+}
+var AiProviderError;
+var init_ai_provider_resolver = __esm({
+  "packages/core/di/ai-provider-resolver.ts"() {
+    "use strict";
+    init_api_key_crypto();
+    AiProviderError = class extends Error {
+      constructor(message, status = 400, code = "AI_PROVIDER_ERROR") {
+        super(message);
+        this.name = "AiProviderError";
+        this.status = status;
+        this.code = code;
+      }
+    };
+  }
+});
+
 // packages/core/di/ai-service.ts
 var AIService;
 var init_ai_service = __esm({
@@ -3312,6 +3401,7 @@ var init_ai_service = __esm({
     init_provider_gateway();
     init_ai_event_bus();
     init_api_key_crypto();
+    init_ai_provider_resolver();
     AIService = class {
       constructor(db2) {
         this.db = db2;
@@ -3359,16 +3449,11 @@ var init_ai_service = __esm({
         this._contextDelegates.unregister?.(id);
       }
       async generateText(prompt, options) {
-        const provider = this.db.prepare(
-          "SELECT id, name, api_url, api_key, model_name FROM ai_providers WHERE api_key IS NOT NULL AND api_key != '' LIMIT 1"
-        ).get();
-        if (!provider || !provider.api_key) {
-          throw new Error("\u672A\u68C0\u6D4B\u5230\u53EF\u7528\u7684 AI \u63D0\u4F9B\u5546\u3002\u8BF7\u524D\u5F80\u300C\u7CFB\u7EDF\u7BA1\u7406 -> AI \u63D0\u4F9B\u5546\u7BA1\u7406\u300D\u6DFB\u52A0\u5E76\u914D\u7F6E\u5927\u6A21\u578B\u670D\u52A1\u3002");
-        }
-        const apiKey = decryptApiKey(provider.api_key);
-        if (!apiKey || !apiKey.trim()) {
-          throw new Error("AI Provider API Key \u89E3\u5BC6\u4E3A\u7A7A\uFF0C\u8BF7\u524D\u5F80\u300C\u7CFB\u7EDF\u7BA1\u7406 -> AI \u63D0\u4F9B\u5546\u7BA1\u7406\u300D\u91CD\u65B0\u4FDD\u5B58\u5BC6\u94A5\u3002");
-        }
+        const provider = resolveAccessibleAiProvider(this.db, {
+          userId: options?.userId,
+          providerId: options?.providerId
+        });
+        const apiKey = provider.api_key;
         if (looksLikeCiphertext(apiKey)) {
           throw new Error(
             "AI Provider API Key \u89E3\u5BC6\u5931\u8D25\uFF1AENCRYPTION_KEY \u4E0E\u52A0\u5BC6\u65F6\u4E0D\u4E00\u81F4\uFF08\u5E38\u89C1\u4E8E PM2 \u5C06 ENCRYPTION_KEY \u7F6E\u7A7A\u6216\u5BC6\u94A5\u88AB\u8F6E\u6362\uFF09\u3002\u8BF7\u6062\u590D\u539F ENCRYPTION_KEY\uFF0C\u6216\u524D\u5F80\u300C\u7CFB\u7EDF\u7BA1\u7406 -> AI \u63D0\u4F9B\u5546\u7BA1\u7406\u300D\u91CD\u65B0\u4FDD\u5B58 API Key\u3002"
@@ -9211,6 +9296,7 @@ var init_di = __esm({
     init_storage_service();
     init_ai_service();
     init_courseware_runtime_script_registry();
+    init_ai_provider_resolver();
     init_container();
   }
 });
@@ -13409,8 +13495,8 @@ var ManagementPlugin = {
     });
     await commandBus.registerHandler(classTemplateDownloadCmd, {
       async execute() {
-        const headers = "Class Name,Class Desc,Student Name,Student Email";
-        const sampleRow = "Class 101,Introduction to English,John Doe,john@example.com\nClass 101,Introduction to English,Jane Smith,jane@example.com";
+        const headers = "Class Name,Class Desc,Student Number,Student Name,Student Email,Initial Password,Student Notes,Gender";
+        const sampleRow = "Class 101,Introduction to English,20260101,John Doe,john@example.com,,,Male\nClass 101,Introduction to English,20260102,Jane Smith,jane@example.com,,,Female";
         const content = `${headers}
 ${sampleRow}`;
         const fileId = (0, import_uuid4.v7)();
@@ -13442,8 +13528,8 @@ ${sampleRow}`;
     });
     await commandBus.registerHandler(studentTemplateDownloadCmd, {
       async execute() {
-        const headers = "Student Name,Student Email";
-        const sampleRow = "Alice Cooper,alice@example.com\nBob Dylan,bob@example.com";
+        const headers = "Student Number,Student Name,Student Email,Initial Password,Student Notes,Gender";
+        const sampleRow = "20260101,Alice Cooper,alice@example.com,,,Male\n20260102,Bob Dylan,bob@example.com,,,Female";
         const content = `${headers}
 ${sampleRow}`;
         const fileId = (0, import_uuid4.v7)();
@@ -21204,7 +21290,7 @@ var import_node_fs11 = __toESM(require("node:fs"), 1);
 var import_node_path13 = __toESM(require("node:path"), 1);
 var import_node_url5 = require("node:url");
 var import_meta7 = {};
-var FALLBACK_VERSION = "0.7.10";
+var FALLBACK_VERSION = "0.7.12";
 function readPlatformVersion() {
   const bases = [];
   if (typeof __dirname !== "undefined") bases.push(__dirname);
@@ -32769,6 +32855,299 @@ var import_helmet = __toESM(require("helmet"), 1);
 
 // server/security/rate-limit.ts
 var import_express_rate_limit = __toESM(require("express-rate-limit"), 1);
+
+// server/security/route-scope.ts
+var AUTH_MIDDLEWARE_MARKER = Symbol.for("openlearn.routeScope.authMiddleware");
+var DATA_SCOPE_MARKER = Symbol.for("openlearn.routeScope.dataScope");
+function markAuthMiddleware(middleware, roles) {
+  Object.defineProperty(middleware, AUTH_MIDDLEWARE_MARKER, {
+    value: { roles: [...roles] },
+    enumerable: false,
+    configurable: true
+  });
+  return middleware;
+}
+function markDataScopeMiddleware(middleware, scope) {
+  Object.defineProperty(middleware, DATA_SCOPE_MARKER, {
+    value: scope,
+    enumerable: false,
+    configurable: true
+  });
+  return middleware;
+}
+function readMarker(handle, marker) {
+  if (typeof handle !== "function") return void 0;
+  return handle[marker];
+}
+function collectAuthRoutes(app) {
+  const router = app._router ?? app.router;
+  const stack = router?.stack ?? [];
+  const result = [];
+  for (const layer of stack) {
+    const route = layer?.route;
+    if (!route) continue;
+    const handles = (route.stack ?? []).map((entry) => entry.handle);
+    const authMeta = handles.map((handle) => readMarker(handle, AUTH_MIDDLEWARE_MARKER)).find(Boolean);
+    if (!authMeta) continue;
+    const scope = handles.map((handle) => readMarker(handle, DATA_SCOPE_MARKER)).find(Boolean);
+    const methods = Object.keys(route.methods ?? {}).filter((method) => method !== "_all" && route.methods[method]).map((method) => method.toUpperCase());
+    for (const method of methods) {
+      result.push({
+        method,
+        path: String(route.path),
+        scope,
+        roles: [...authMeta.roles]
+      });
+    }
+  }
+  return result;
+}
+function isWhitelisted(route, whitelist) {
+  return whitelist.some(
+    (entry) => entry.method.toUpperCase() === route.method && normalizePath2(entry.path) === normalizePath2(route.path)
+  );
+}
+function normalizePath2(path48) {
+  if (!path48) return "/";
+  return path48.endsWith("/") && path48.length > 1 ? path48.slice(0, -1) : path48;
+}
+function auditRouteScopes(app, whitelist = []) {
+  const declared = [];
+  const roleGated = [];
+  const undeclared = [];
+  for (const route of collectAuthRoutes(app)) {
+    if (route.scope) {
+      declared.push(route);
+      continue;
+    }
+    if (route.roles.length > 0) {
+      roleGated.push(route);
+      continue;
+    }
+    if (isWhitelisted(route, whitelist)) continue;
+    undeclared.push(route);
+  }
+  return { declared, roleGated, undeclared };
+}
+function formatRouteScopeViolation(route) {
+  return `${route.method} ${route.path}`;
+}
+function assertRouteDataScopes(app, options = {}) {
+  const logger2 = options.logger ?? console;
+  const audit = auditRouteScopes(app, options.whitelist ?? []);
+  if (audit.undeclared.length > 0) {
+    const lines = audit.undeclared.map(formatRouteScopeViolation);
+    const message = `[RouteScope] ${audit.undeclared.length} \u4E2A\u5DF2\u8BA4\u8BC1\u8DEF\u7531\u672A\u58F0\u660E\u6570\u636E\u8303\u56F4\uFF08requireScopedAuth\uFF09\uFF1A
+  - ${lines.join("\n  - ")}`;
+    if (options.enforce) {
+      logger2.error(message);
+      throw new Error(message);
+    }
+    logger2.warn(message);
+  }
+  if (audit.declared.length > 0) {
+    logger2.info?.(
+      `[RouteScope] \u5DF2\u58F0\u660E\u6570\u636E\u8303\u56F4 ${audit.declared.length} \u6761\uFF0C\u89D2\u8272\u95E8\u7981\u8DEF\u7531 ${audit.roleGated.length} \u6761\uFF0C\u672A\u58F0\u660E ${audit.undeclared.length} \u6761\uFF08\u767D\u540D\u5355 ${options.whitelist?.length ?? 0} \u6761\uFF09\u3002`
+    );
+  }
+  return audit;
+}
+
+// server/utils/password-gate.ts
+var PASSWORD_GATE_SKIP_ENV = "OPENLEARN_SKIP_PASSWORD_CHANGE_GATE";
+var PASSWORD_GATE_SKIP_ENV_ALIAS = "DEV_BYPASS_PASSWORD_CHANGE_GATE";
+var productionWarningEmitted = false;
+function isTruthyFlag2(value) {
+  if (typeof value !== "string") return false;
+  const normalized = value.trim().toLowerCase();
+  return normalized === "1" || normalized === "true";
+}
+function isPasswordChangeGateSkipped(env = process.env) {
+  const requested = isTruthyFlag2(env[PASSWORD_GATE_SKIP_ENV]) || isTruthyFlag2(env[PASSWORD_GATE_SKIP_ENV_ALIAS]);
+  if (!requested) return false;
+  if ((env.NODE_ENV ?? "") === "production") {
+    if (!productionWarningEmitted) {
+      productionWarningEmitted = true;
+      console.warn(
+        `[SECURITY] ${PASSWORD_GATE_SKIP_ENV}/${PASSWORD_GATE_SKIP_ENV_ALIAS} \u5DF2\u914D\u7F6E\uFF0C\u4F46\u751F\u4EA7\u73AF\u5883\uFF08NODE_ENV=production\uFF09\u4E25\u683C\u5FFD\u7565\u8BE5\u5F00\u5173\uFF1A\u5F3A\u5236\u6539\u5BC6\u9632\u7EBF\u4E0D\u5931\u6548\u3002\u8BF7\u7ACB\u5373\u4ECE\u751F\u4EA7\u73AF\u5883\u79FB\u9664\u8BE5\u53D8\u91CF\u3002`
+      );
+    }
+    return false;
+  }
+  return true;
+}
+
+// server/services/session-role.ts
+var SESSION_ROLE_WHITELIST = /* @__PURE__ */ new Set(["administrator", "teacher", "student", "anonymous"]);
+function resolveSessionRole(session) {
+  if (!session) return "anonymous";
+  for (const candidate of [session.subRole, session.role]) {
+    if (typeof candidate !== "string" || candidate.length === 0) continue;
+    const normalized = candidate === "admin" ? "administrator" : candidate;
+    if (SESSION_ROLE_WHITELIST.has(normalized)) return normalized;
+  }
+  return "anonymous";
+}
+function isAdministrator(session) {
+  return resolveSessionRole(session) === "administrator";
+}
+
+// server/middleware/auth.ts
+var SESSION_REFRESH_INTERVAL_MS = 5 * 60 * 1e3;
+function getValidSession(token) {
+  let sessionRow;
+  try {
+    sessionRow = kernelContainer.db.prepare("SELECT * FROM client_sessions WHERE id = ?").get(token);
+  } catch {
+    return null;
+  }
+  if (!sessionRow) return null;
+  const now = Date.now();
+  if (sessionRow.expires_at && sessionRow.expires_at < now) {
+    kernelContainer.db.prepare("DELETE FROM client_sessions WHERE id = ?").run(token);
+    return null;
+  }
+  const idleTimeout = 24 * 60 * 60 * 1e3;
+  if (sessionRow.updated_at && now - sessionRow.updated_at > idleTimeout) {
+    kernelContainer.db.prepare("DELETE FROM client_sessions WHERE id = ?").run(token);
+    return null;
+  }
+  if (!sessionRow.updated_at || now - sessionRow.updated_at > SESSION_REFRESH_INTERVAL_MS) {
+    kernelContainer.db.prepare("UPDATE client_sessions SET updated_at = ? WHERE id = ?").run(now, token);
+  }
+  let session;
+  try {
+    session = JSON.parse(sessionRow.session_data);
+  } catch {
+    return null;
+  }
+  if (session && !session.userId && session.studentId) {
+    session.userId = session.studentId;
+  }
+  if (session.role && !["teacher", "student", "administrator", "admin"].includes(session.role)) {
+    session.role = "anonymous";
+  }
+  return session;
+}
+function getCookieToken(req) {
+  const rc = req.headers.cookie;
+  if (!rc) return null;
+  const parts = rc.split(";");
+  for (const part of parts) {
+    const trimmed2 = part.trim();
+    if (trimmed2.startsWith("edu_os_token=")) {
+      return trimmed2.substring("edu_os_token=".length);
+    }
+  }
+  return null;
+}
+function getActorId(req) {
+  const token = getCookieToken(req);
+  if (!token) return "anonymous";
+  try {
+    const session = getValidSession(token);
+    if (!session) return "anonymous";
+    const role = resolveSessionRole(session);
+    const rawUserId = session.userId || session.studentId || "demo";
+    const safeUserId = String(rawUserId).replace(/[:\s]/g, "_").slice(0, 64);
+    return `user:${safeUserId}:${role}`;
+  } catch {
+    return "anonymous";
+  }
+}
+function requireAuth(...roles) {
+  const middleware = (req, res, next) => {
+    const token = getCookieToken(req);
+    if (!token) return res.status(401).json({ success: false, error: "Authentication required" });
+    const session = getValidSession(token);
+    if (!session) return res.status(401).json({ success: false, error: "Session expired or invalid" });
+    if (roles.length > 0) {
+      const userRole = resolveSessionRole(session);
+      const effectiveRoles = roles.map((r) => r === "admin" ? "administrator" : r);
+      if (!effectiveRoles.includes(userRole)) {
+        return res.status(403).json({ success: false, error: `Role ${session.role} not allowed. Required: ${roles.join(", ")}` });
+      }
+    }
+    req.session = session;
+    next();
+  };
+  return markAuthMiddleware(middleware, roles);
+}
+var PASSWORD_CHANGE_EXEMPT_PATHS = /* @__PURE__ */ new Set([
+  "/api/auth/change-password",
+  "/api/auth/logout",
+  "/api/auth/session",
+  "/api/auth/me",
+  "/api/client-errors"
+]);
+function enforcePasswordChanged(req, res, next) {
+  if (process.env.PLAYWRIGHT_TEST) {
+    return next();
+  }
+  if (isPasswordChangeGateSkipped()) {
+    return next();
+  }
+  const path48 = req.path || "";
+  if (!path48.startsWith("/api/")) {
+    return next();
+  }
+  if (PASSWORD_CHANGE_EXEMPT_PATHS.has(path48)) {
+    return next();
+  }
+  const token = getCookieToken(req);
+  if (token) {
+    const session = getValidSession(token);
+    if (session && session.mustChangePassword) {
+      res.status(403).json({
+        success: false,
+        code: "FORBIDDEN_DEFAULT_PASSWORD",
+        error: "Default password must be changed first"
+      });
+      return;
+    }
+  }
+  next();
+}
+function socketAuthMiddleware(socket, next) {
+  try {
+    const cookieHeader = socket.handshake.headers.cookie;
+    let token = null;
+    if (cookieHeader) {
+      const parts = cookieHeader.split(";");
+      for (const part of parts) {
+        const trimmed2 = part.trim();
+        if (trimmed2.startsWith("edu_os_token=")) {
+          token = trimmed2.substring("edu_os_token=".length);
+          break;
+        }
+      }
+    }
+    if (!token && socket.handshake.auth?.token) {
+      token = socket.handshake.auth.token;
+    }
+    if (process.env.NODE_ENV === "test" && !token) {
+      return next();
+    }
+    if (!token) {
+      return next(new Error("Authentication required: missing edu_os_token"));
+    }
+    const session = getValidSession(token);
+    if (!session) {
+      return next(new Error("Authentication required: session expired or invalid"));
+    }
+    if (session.mustChangePassword && !isPasswordChangeGateSkipped()) {
+      return next(new Error("FORBIDDEN_DEFAULT_PASSWORD"));
+    }
+    socket.data.session = session;
+    socket.data.userId = session.userId;
+    socket.data.role = session.role;
+    next();
+  } catch (err) {
+    next(new Error(`Authentication error: ${err.message}`));
+  }
+}
+
+// server/security/rate-limit.ts
 function loginRateLimitKey(req) {
   const body = req.body ?? {};
   const raw = body.username ?? body.studentId ?? body.studentName ?? "";
@@ -32785,6 +33164,18 @@ function writeRateLimitKey(req) {
     return ip;
   }
 }
+function sessionRateLimitKey(req) {
+  try {
+    const token = getCookieToken(req);
+    const session = token ? getValidSession(token) : null;
+    if (session) {
+      const identity = String(session.userId || session.studentId || session.username || "").trim();
+      if (identity) return `session:${identity.slice(0, 64)}`;
+    }
+  } catch {
+  }
+  return `ip:${writeRateLimitKey(req)}`;
+}
 var limiterValidation = {
   xForwardedForHeader: false,
   trustProxy: false,
@@ -32823,6 +33214,17 @@ function createAiLimiter(max) {
     validate: limiterValidation
   });
 }
+function createSessionWriteLimiter(max) {
+  return (0, import_express_rate_limit.default)({
+    windowMs: 60 * 1e3,
+    max,
+    keyGenerator: sessionRateLimitKey,
+    message: { error: "\u8BF7\u6C42\u8FC7\u4E8E\u9891\u7E41\uFF0C\u8BF7\u7A0D\u540E\u518D\u8BD5\u3002Too many requests, please try again later." },
+    standardHeaders: true,
+    legacyHeaders: false,
+    validate: limiterValidation
+  });
+}
 
 // server/security/trust-proxy.ts
 function resolveTrustProxy(raw) {
@@ -34199,297 +34601,6 @@ function startBackupScheduler(deps) {
   };
 }
 
-// server/security/route-scope.ts
-var AUTH_MIDDLEWARE_MARKER = Symbol.for("openlearn.routeScope.authMiddleware");
-var DATA_SCOPE_MARKER = Symbol.for("openlearn.routeScope.dataScope");
-function markAuthMiddleware(middleware, roles) {
-  Object.defineProperty(middleware, AUTH_MIDDLEWARE_MARKER, {
-    value: { roles: [...roles] },
-    enumerable: false,
-    configurable: true
-  });
-  return middleware;
-}
-function markDataScopeMiddleware(middleware, scope) {
-  Object.defineProperty(middleware, DATA_SCOPE_MARKER, {
-    value: scope,
-    enumerable: false,
-    configurable: true
-  });
-  return middleware;
-}
-function readMarker(handle, marker) {
-  if (typeof handle !== "function") return void 0;
-  return handle[marker];
-}
-function collectAuthRoutes(app) {
-  const router = app._router ?? app.router;
-  const stack = router?.stack ?? [];
-  const result = [];
-  for (const layer of stack) {
-    const route = layer?.route;
-    if (!route) continue;
-    const handles = (route.stack ?? []).map((entry) => entry.handle);
-    const authMeta = handles.map((handle) => readMarker(handle, AUTH_MIDDLEWARE_MARKER)).find(Boolean);
-    if (!authMeta) continue;
-    const scope = handles.map((handle) => readMarker(handle, DATA_SCOPE_MARKER)).find(Boolean);
-    const methods = Object.keys(route.methods ?? {}).filter((method) => method !== "_all" && route.methods[method]).map((method) => method.toUpperCase());
-    for (const method of methods) {
-      result.push({
-        method,
-        path: String(route.path),
-        scope,
-        roles: [...authMeta.roles]
-      });
-    }
-  }
-  return result;
-}
-function isWhitelisted(route, whitelist) {
-  return whitelist.some(
-    (entry) => entry.method.toUpperCase() === route.method && normalizePath2(entry.path) === normalizePath2(route.path)
-  );
-}
-function normalizePath2(path48) {
-  if (!path48) return "/";
-  return path48.endsWith("/") && path48.length > 1 ? path48.slice(0, -1) : path48;
-}
-function auditRouteScopes(app, whitelist = []) {
-  const declared = [];
-  const roleGated = [];
-  const undeclared = [];
-  for (const route of collectAuthRoutes(app)) {
-    if (route.scope) {
-      declared.push(route);
-      continue;
-    }
-    if (route.roles.length > 0) {
-      roleGated.push(route);
-      continue;
-    }
-    if (isWhitelisted(route, whitelist)) continue;
-    undeclared.push(route);
-  }
-  return { declared, roleGated, undeclared };
-}
-function formatRouteScopeViolation(route) {
-  return `${route.method} ${route.path}`;
-}
-function assertRouteDataScopes(app, options = {}) {
-  const logger2 = options.logger ?? console;
-  const audit = auditRouteScopes(app, options.whitelist ?? []);
-  if (audit.undeclared.length > 0) {
-    const lines = audit.undeclared.map(formatRouteScopeViolation);
-    const message = `[RouteScope] ${audit.undeclared.length} \u4E2A\u5DF2\u8BA4\u8BC1\u8DEF\u7531\u672A\u58F0\u660E\u6570\u636E\u8303\u56F4\uFF08requireScopedAuth\uFF09\uFF1A
-  - ${lines.join("\n  - ")}`;
-    if (options.enforce) {
-      logger2.error(message);
-      throw new Error(message);
-    }
-    logger2.warn(message);
-  }
-  if (audit.declared.length > 0) {
-    logger2.info?.(
-      `[RouteScope] \u5DF2\u58F0\u660E\u6570\u636E\u8303\u56F4 ${audit.declared.length} \u6761\uFF0C\u89D2\u8272\u95E8\u7981\u8DEF\u7531 ${audit.roleGated.length} \u6761\uFF0C\u672A\u58F0\u660E ${audit.undeclared.length} \u6761\uFF08\u767D\u540D\u5355 ${options.whitelist?.length ?? 0} \u6761\uFF09\u3002`
-    );
-  }
-  return audit;
-}
-
-// server/utils/password-gate.ts
-var PASSWORD_GATE_SKIP_ENV = "OPENLEARN_SKIP_PASSWORD_CHANGE_GATE";
-var PASSWORD_GATE_SKIP_ENV_ALIAS = "DEV_BYPASS_PASSWORD_CHANGE_GATE";
-var productionWarningEmitted = false;
-function isTruthyFlag2(value) {
-  if (typeof value !== "string") return false;
-  const normalized = value.trim().toLowerCase();
-  return normalized === "1" || normalized === "true";
-}
-function isPasswordChangeGateSkipped(env = process.env) {
-  const requested = isTruthyFlag2(env[PASSWORD_GATE_SKIP_ENV]) || isTruthyFlag2(env[PASSWORD_GATE_SKIP_ENV_ALIAS]);
-  if (!requested) return false;
-  if ((env.NODE_ENV ?? "") === "production") {
-    if (!productionWarningEmitted) {
-      productionWarningEmitted = true;
-      console.warn(
-        `[SECURITY] ${PASSWORD_GATE_SKIP_ENV}/${PASSWORD_GATE_SKIP_ENV_ALIAS} \u5DF2\u914D\u7F6E\uFF0C\u4F46\u751F\u4EA7\u73AF\u5883\uFF08NODE_ENV=production\uFF09\u4E25\u683C\u5FFD\u7565\u8BE5\u5F00\u5173\uFF1A\u5F3A\u5236\u6539\u5BC6\u9632\u7EBF\u4E0D\u5931\u6548\u3002\u8BF7\u7ACB\u5373\u4ECE\u751F\u4EA7\u73AF\u5883\u79FB\u9664\u8BE5\u53D8\u91CF\u3002`
-      );
-    }
-    return false;
-  }
-  return true;
-}
-
-// server/services/session-role.ts
-var SESSION_ROLE_WHITELIST = /* @__PURE__ */ new Set(["administrator", "teacher", "student", "anonymous"]);
-function resolveSessionRole(session) {
-  if (!session) return "anonymous";
-  for (const candidate of [session.subRole, session.role]) {
-    if (typeof candidate !== "string" || candidate.length === 0) continue;
-    const normalized = candidate === "admin" ? "administrator" : candidate;
-    if (SESSION_ROLE_WHITELIST.has(normalized)) return normalized;
-  }
-  return "anonymous";
-}
-function isAdministrator(session) {
-  return resolveSessionRole(session) === "administrator";
-}
-
-// server/middleware/auth.ts
-var SESSION_REFRESH_INTERVAL_MS = 5 * 60 * 1e3;
-function getValidSession(token) {
-  let sessionRow;
-  try {
-    sessionRow = kernelContainer.db.prepare("SELECT * FROM client_sessions WHERE id = ?").get(token);
-  } catch {
-    return null;
-  }
-  if (!sessionRow) return null;
-  const now = Date.now();
-  if (sessionRow.expires_at && sessionRow.expires_at < now) {
-    kernelContainer.db.prepare("DELETE FROM client_sessions WHERE id = ?").run(token);
-    return null;
-  }
-  const idleTimeout = 24 * 60 * 60 * 1e3;
-  if (sessionRow.updated_at && now - sessionRow.updated_at > idleTimeout) {
-    kernelContainer.db.prepare("DELETE FROM client_sessions WHERE id = ?").run(token);
-    return null;
-  }
-  if (!sessionRow.updated_at || now - sessionRow.updated_at > SESSION_REFRESH_INTERVAL_MS) {
-    kernelContainer.db.prepare("UPDATE client_sessions SET updated_at = ? WHERE id = ?").run(now, token);
-  }
-  let session;
-  try {
-    session = JSON.parse(sessionRow.session_data);
-  } catch {
-    return null;
-  }
-  if (session && !session.userId && session.studentId) {
-    session.userId = session.studentId;
-  }
-  if (session.role && !["teacher", "student", "administrator", "admin"].includes(session.role)) {
-    session.role = "anonymous";
-  }
-  return session;
-}
-function getCookieToken(req) {
-  const rc = req.headers.cookie;
-  if (!rc) return null;
-  const parts = rc.split(";");
-  for (const part of parts) {
-    const trimmed2 = part.trim();
-    if (trimmed2.startsWith("edu_os_token=")) {
-      return trimmed2.substring("edu_os_token=".length);
-    }
-  }
-  return null;
-}
-function getActorId(req) {
-  const token = getCookieToken(req);
-  if (!token) return "anonymous";
-  try {
-    const session = getValidSession(token);
-    if (!session) return "anonymous";
-    const role = resolveSessionRole(session);
-    const rawUserId = session.userId || session.studentId || "demo";
-    const safeUserId = String(rawUserId).replace(/[:\s]/g, "_").slice(0, 64);
-    return `user:${safeUserId}:${role}`;
-  } catch {
-    return "anonymous";
-  }
-}
-function requireAuth(...roles) {
-  const middleware = (req, res, next) => {
-    const token = getCookieToken(req);
-    if (!token) return res.status(401).json({ success: false, error: "Authentication required" });
-    const session = getValidSession(token);
-    if (!session) return res.status(401).json({ success: false, error: "Session expired or invalid" });
-    if (roles.length > 0) {
-      const userRole = resolveSessionRole(session);
-      const effectiveRoles = roles.map((r) => r === "admin" ? "administrator" : r);
-      if (!effectiveRoles.includes(userRole)) {
-        return res.status(403).json({ success: false, error: `Role ${session.role} not allowed. Required: ${roles.join(", ")}` });
-      }
-    }
-    req.session = session;
-    next();
-  };
-  return markAuthMiddleware(middleware, roles);
-}
-var PASSWORD_CHANGE_EXEMPT_PATHS = /* @__PURE__ */ new Set([
-  "/api/auth/change-password",
-  "/api/auth/logout",
-  "/api/auth/session",
-  "/api/auth/me",
-  "/api/client-errors"
-]);
-function enforcePasswordChanged(req, res, next) {
-  if (process.env.PLAYWRIGHT_TEST) {
-    return next();
-  }
-  if (isPasswordChangeGateSkipped()) {
-    return next();
-  }
-  const path48 = req.path || "";
-  if (!path48.startsWith("/api/")) {
-    return next();
-  }
-  if (PASSWORD_CHANGE_EXEMPT_PATHS.has(path48)) {
-    return next();
-  }
-  const token = getCookieToken(req);
-  if (token) {
-    const session = getValidSession(token);
-    if (session && session.mustChangePassword) {
-      res.status(403).json({
-        success: false,
-        code: "FORBIDDEN_DEFAULT_PASSWORD",
-        error: "Default password must be changed first"
-      });
-      return;
-    }
-  }
-  next();
-}
-function socketAuthMiddleware(socket, next) {
-  try {
-    const cookieHeader = socket.handshake.headers.cookie;
-    let token = null;
-    if (cookieHeader) {
-      const parts = cookieHeader.split(";");
-      for (const part of parts) {
-        const trimmed2 = part.trim();
-        if (trimmed2.startsWith("edu_os_token=")) {
-          token = trimmed2.substring("edu_os_token=".length);
-          break;
-        }
-      }
-    }
-    if (!token && socket.handshake.auth?.token) {
-      token = socket.handshake.auth.token;
-    }
-    if (process.env.NODE_ENV === "test" && !token) {
-      return next();
-    }
-    if (!token) {
-      return next(new Error("Authentication required: missing edu_os_token"));
-    }
-    const session = getValidSession(token);
-    if (!session) {
-      return next(new Error("Authentication required: session expired or invalid"));
-    }
-    if (session.mustChangePassword && !isPasswordChangeGateSkipped()) {
-      return next(new Error("FORBIDDEN_DEFAULT_PASSWORD"));
-    }
-    socket.data.session = session;
-    socket.data.userId = session.userId;
-    socket.data.role = session.role;
-    next();
-  } catch (err) {
-    next(new Error(`Authentication error: ${err.message}`));
-  }
-}
-
 // server/middleware/csrf.ts
 var WRITE_METHODS = /* @__PURE__ */ new Set(["POST", "PUT", "PATCH", "DELETE"]);
 var EXEMPT_PREFIXES = [
@@ -38406,9 +38517,12 @@ var generateStudentNumber = (db2) => {
   return `S${nextSeq.toString().padStart(3, "0")}`;
 };
 
+// server/services/ai-provider-resolver.ts
+init_ai_provider_resolver();
+
 // server/routes/os.ts
 function registerOsRoutes(ctx) {
-  const { app, runGeminiAgentChat: runGeminiAgentChat2, runOpenAIAgentChat: runOpenAIAgentChat2, activityRegistry, aiLimiter } = ctx;
+  const { app, runOpenAIAgentChat: runOpenAIAgentChat2, activityRegistry, aiLimiter } = ctx;
   app.get("/api/ping", (_req, res) => {
     res.json({ ok: true, ts: Date.now() });
   });
@@ -38627,13 +38741,10 @@ function registerOsRoutes(ctx) {
       }
       let callerRole;
       let userId;
-      const token = getCookieToken(req);
-      if (token) {
-        const session = getValidSession(token);
-        if (session) {
-          callerRole = session.role;
-          userId = session.userId;
-        }
+      const session = req.session || (getCookieToken(req) ? getValidSession(getCookieToken(req)) : null);
+      if (session) {
+        callerRole = session.role;
+        userId = session.userId || session.username;
       }
       const convKey = `agent:${userId || "anonymous"}:${currentLessonId || "global"}`;
       const MEMORY_TURNS = 20;
@@ -38643,19 +38754,17 @@ function registerOsRoutes(ctx) {
         content: r.content
       }));
       let provider;
-      if (providerId) {
-        provider = kernelContainer.db.prepare("SELECT id, name, api_url, api_key, model_name FROM ai_providers WHERE id = ?").get(providerId);
-      } else {
-        provider = kernelContainer.db.prepare(
-          "SELECT id, name, api_url, api_key, model_name FROM ai_providers WHERE api_key IS NOT NULL AND api_key != '' LIMIT 1"
-        ).get();
-      }
-      if (provider?.api_key) provider.api_key = decryptApiKey(provider.api_key);
-      if (!provider || !provider.api_key || !provider.api_key.trim()) {
-        return res.status(400).json({
+      try {
+        provider = resolveAccessibleAiProvider(kernelContainer.db, {
+          providerId,
+          userId,
+          lang
+        });
+      } catch (err) {
+        return res.status(err.status || 400).json({
           success: false,
-          error: "NO_AI_PROVIDER",
-          message: lang === "zh" ? "\u672A\u68C0\u6D4B\u5230\u53EF\u7528\u7684 AI \u63D0\u4F9B\u5546\u3002\u8BF7\u524D\u5F80\u300C\u7CFB\u7EDF\u7BA1\u7406 -> AI \u63D0\u4F9B\u5546\u7BA1\u7406\u300D\u6DFB\u52A0\u5E76\u914D\u7F6E\u5927\u6A21\u578B\u670D\u52A1\u3002" : 'No active AI Provider configured. Please add and configure an AI Provider in "System Management -> AI Provider Management".'
+          error: err.code || "NO_AI_PROVIDER",
+          message: err.message
         });
       }
       const actorId = getActorId(req);
@@ -42119,7 +42228,7 @@ Provide a short, friendly, and helpful hint (1-2 sentences) directly related to
    * 的按学科硬编码字符串拼接，与课题内容无关。此方法用真实的 LLM 调用取代它。
    */
   async generateOutlineWithAi(params) {
-    const { title, category, description, timeline, lang = "zh" } = params;
+    const { title, category, description, timeline, lang = "zh", providerId, userId } = params;
     const trimmedTitle = (title || "").trim();
     if (!trimmedTitle) {
       const err = new Error(lang === "zh" ? "\u8BFE\u7A0B\u8BFE\u9898\u4E0D\u80FD\u4E3A\u7A7A" : "Course title is required");
@@ -42159,7 +42268,12 @@ ${timelineText}` : "- \u8BFE\u5802\u65F6\u95F4\u8F74\u73AF\u8282\uFF1A\uFF08\u65
    - \`## \u{1F4E5} \u8BFE\u540E\u4F5C\u4E1A\`\uFF1A\u4E00\u4EFD\u660E\u786E\u7684\u8BFE\u540E\u4EFB\u52A1\u4E0E\u63D0\u4EA4\u8981\u6C42\u3002
 4. \u5185\u5BB9\u5FC5\u987B\u7D27\u6263\u8BFE\u9898\u672C\u8EAB\uFF0C\u7981\u6B62\u4F7F\u7528"\u516C\u5F0F A""\u6A21\u5757 1"\u4E4B\u7C7B\u7684\u5360\u4F4D\u7B26\u6216\u4E0E\u8BFE\u9898\u65E0\u5173\u7684\u901A\u7528\u5957\u8BDD\u3002
 5. \u7BC7\u5E45\u63A7\u5236\u5728 600-1000 \u5B57\uFF0C\u8BED\u8A00${lang === "zh" ? "\u4F7F\u7528\u7B80\u4F53\u4E2D\u6587" : "use English"}\u3002`;
-    const raw = await this.aiService.generateText(prompt, { temperature: 0.6, maxTokens: 2048 });
+    const raw = await this.aiService.generateText(prompt, {
+      temperature: 0.6,
+      maxTokens: 2048,
+      userId,
+      providerId
+    });
     const outline = stripReasoningArtifacts(stripOuterCodeFence(String(raw || "").trim()));
     if (!outline) {
       const err = new Error(
@@ -42423,13 +42537,17 @@ function registerLessonsRoutes(ctx) {
     safeAiLimiter,
     async (req, res) => {
       try {
-        const { title, category, description, timeline, lang } = req.body || {};
+        const { title, category, description, timeline, lang, providerId } = req.body || {};
+        const session = req.session;
+        const userId = session?.userId || session?.username;
         const content = await lessonService.generateOutlineWithAi({
           title,
           category,
           description,
           timeline,
-          lang
+          lang,
+          providerId,
+          userId
         });
         res.json({ success: true, content });
       } catch (e) {
@@ -48515,7 +48633,7 @@ var ScheduleService = class {
    * Timetable OCR 课表图像识别与数据清洗
    */
   async processTimetableOcr(imageBase64, options = {}) {
-    const { lang = "zh", providerId } = options;
+    const { lang = "zh", providerId, userId } = options;
     if (!imageBase64) {
       throw new Error("imageBase64 is required");
     }
@@ -48546,21 +48664,11 @@ var ScheduleService = class {
 
 \u8FD4\u56DE\u683C\u5F0F\u793A\u4F8B\uFF1A
 [{"dayOfWeek":1,"periodNumber":1,"className":"\u9AD8\u4E00(13)","subject":"\u4FE1\u606F","timeSlot":"08:00-08:40","location":"312","teacherName":""}]`;
-    let provider;
-    if (providerId) {
-      provider = this.db.prepare("SELECT id, name, api_url, api_key, model_name FROM ai_providers WHERE id = ?").get(providerId);
-    }
-    if (!provider) {
-      provider = this.db.prepare(
-        "SELECT id, name, api_url, api_key, model_name FROM ai_providers WHERE api_key IS NOT NULL AND api_key != '' ORDER BY created_at DESC LIMIT 1"
-      ).get();
-    }
-    if (provider?.api_key) provider.api_key = decryptApiKey(provider.api_key);
-    if (!provider || !provider.api_key || !provider.api_key.trim()) {
-      throw new Error(
-        lang === "zh" ? "\u672A\u68C0\u6D4B\u5230\u53EF\u7528\u7684 AI \u63D0\u4F9B\u5546\u3002\u8BF7\u524D\u5F80\u300C\u7CFB\u7EDF\u7BA1\u7406 -> AI \u63D0\u4F9B\u5546\u7BA1\u7406\u300D\u6DFB\u52A0\u5E76\u914D\u7F6E\u5927\u6A21\u578B\u670D\u52A1\u3002" : 'No AI provider configured. Please add and configure an AI Provider in "System Management -> AI Provider Management".'
-      );
-    }
+    const provider = resolveAccessibleAiProvider(this.db, {
+      providerId,
+      userId,
+      lang
+    });
     let chatUrl = provider.api_url.trim();
     if (!chatUrl.endsWith("/chat/completions")) {
       chatUrl = chatUrl.endsWith("/") ? chatUrl + "chat/completions" : chatUrl + "/chat/completions";
@@ -48776,7 +48884,9 @@ function registerSchedulesRoutes(ctx) {
     const startTime = Date.now();
     try {
       const { imageBase64, lang = "zh", providerId } = req.body;
-      const result = await scheduleService.processTimetableOcr(imageBase64, { lang, providerId });
+      const session = req.session;
+      const userId = session?.userId || session?.username;
+      const result = await scheduleService.processTimetableOcr(imageBase64, { lang, providerId, userId });
       res.json({
         success: true,
         entries: result.entries,
@@ -49162,7 +49272,7 @@ var GradingService = class {
   }
   // ── 6. AI 学期综合总评评语生成 ────────────────────────────────────────────────
   async generateSemesterAiEvaluation(params) {
-    const { classId, studentId, semesterName = "2026\u5E74\u6625\u5B63\u5B66\u671F", providerId } = params;
+    const { classId, studentId, semesterName = "2026\u5E74\u6625\u5B63\u5B66\u671F", providerId, userId } = params;
     const student = this.db.prepare("SELECT name FROM students WHERE id = ?").get(studentId);
     if (!student) {
       throw new Error("Student not found");
@@ -49220,13 +49330,10 @@ ${examsText}
    - \u6307\u51FA\u5176\u53EF\u4EE5\u6539\u8FDB\u7684\u5730\u65B9\uFF08\u5982\u8FDB\u5EA6\u843D\u540E\u3001\u8003\u8BD5\u53D1\u6325\u4E0D\u4F73\u7B49\uFF09\uFF0C\u8BED\u6C14\u8981\u975E\u5E38\u6E29\u67D4\u3001\u59D4\u5A49\uFF0C\u7ED9\u4E88\u5176\u4FE1\u5FC3\u3002
    - \u5BF9\u672A\u6765\u7684\u671F\u8BB8\uFF0C\u6FC0\u52B1\u5B66\u751F\u5728\u4E0B\u5B66\u671F\u7EE7\u7EED\u52AA\u529B\u3002
 3. \u957F\u5EA6\u63A7\u5236\u5728 150-250 \u5B57\u4E4B\u95F4\u3002\u4E0D\u8981\u5305\u542B\u4EFB\u4F55 Markdown \u683C\u5F0F\uFF0C\u53EA\u8FD4\u56DE\u7EAF\u6587\u672C\u8BC4\u8BED\u3002`;
-    const provider = providerId ? this.db.prepare("SELECT id, name, api_url, api_key, model_name FROM ai_providers WHERE id = ?").get(providerId) : this.db.prepare(
-      "SELECT id, name, api_url, api_key, model_name FROM ai_providers WHERE api_key IS NOT NULL AND api_key != '' LIMIT 1"
-    ).get();
-    if (provider?.api_key) provider.api_key = decryptApiKey(provider.api_key);
-    if (!provider || !provider.api_key || !provider.api_key.trim()) {
-      throw new Error("\u672A\u68C0\u6D4B\u5230\u53EF\u7528\u7684 AI \u63D0\u4F9B\u5546\u3002\u8BF7\u524D\u5F80\u300C\u7CFB\u7EDF\u7BA1\u7406 -> AI \u63D0\u4F9B\u5546\u7BA1\u7406\u300D\u6DFB\u52A0\u5E76\u914D\u7F6E\u5927\u6A21\u578B\u670D\u52A1\u3002");
-    }
+    const provider = resolveAccessibleAiProvider(this.db, {
+      providerId,
+      userId
+    });
     let chatUrl = provider.api_url.trim();
     if (!chatUrl.endsWith("/chat/completions")) {
       chatUrl = chatUrl.endsWith("/") ? chatUrl + "chat/completions" : chatUrl + "/chat/completions";
@@ -49499,11 +49606,14 @@ function registerGradingRoutes(ctx) {
         const { classId, studentId } = req.params;
         if (gate(req, res, classId, "staff")) return;
         const { semesterName = "2026\u5E74\u6625\u5B63\u5B66\u671F", providerId } = req.body;
+        const session = req.session;
+        const userId = session?.userId || session?.username;
         const aiEvaluation = await gradingService.generateSemesterAiEvaluation({
           classId,
           studentId,
           semesterName,
-          providerId
+          providerId,
+          userId
         });
         res.json({ success: true, aiEvaluation });
       } catch (e) {
@@ -49931,7 +50041,8 @@ async function pluginApiGatewayMiddleware(req, res, next) {
     }
   }
   const clientIp = req.ip || req.socket?.remoteAddress || "unknown-ip";
-  const rateLimitKey = `${clientIp}:${resolvedUuid || pluginId}:${method}:${normalizedSubPath}`;
+  const identityKey = auth.isAuthenticated ? `u:${String(auth.userId || auth.username || auth.actorId).slice(0, 64)}` : `ip:${clientIp}`;
+  const rateLimitKey = `${identityKey}:${resolvedUuid || pluginId}:${method}:${normalizedSubPath}`;
   const windowMs = matchedRule?.rateLimit?.windowMs ?? 60 * 1e3;
   const maxRequests = matchedRule?.rateLimit?.max ?? 120;
   if (!rateLimiter.consume(rateLimitKey, maxRequests, windowMs)) {
@@ -50920,16 +51031,9 @@ function listInstalledManifestVersions() {
   return installed;
 }
 function registerPluginsRoutes(ctx) {
-  const {
-    app,
-    aiLimiter,
-    buildOpenAITools: buildOpenAITools2,
-    executeAgentToolCall: executeAgentToolCall2,
-    buildOpenAIChatUrl: buildOpenAIChatUrl2,
-    runGeminiAgentChat: runGeminiAgentChat2,
-    runOpenAIAgentChat: runOpenAIAgentChat2
-  } = ctx;
-  const safeAiLimiter = typeof aiLimiter === "function" ? aiLimiter : (_req, _res, next) => next();
+  const { app, aiLimiter } = ctx;
+  const noopMiddleware = (_req, _res, next) => next();
+  const safeAiLimiter = typeof aiLimiter === "function" ? aiLimiter : noopMiddleware;
   app.get("/api/docs/plugin-guide", (req, res) => {
     try {
       const docPath = import_path22.default.join(process.cwd(), "docs_plugin_guide.md");
@@ -51965,9 +52069,13 @@ function registerPluginsRoutes(ctx) {
     }
   });
   app.all("/api/plugins/:pluginId/*", pluginApiGatewayMiddleware);
-  app.get("/api/ai-providers", requireAuth("teacher", "administrator"), (req, res) => {
+  app.get("/api/ai-providers", requireScopedAuth("self", "teacher", "administrator"), (req, res) => {
     try {
-      const providers = kernelContainer.db.prepare("SELECT * FROM ai_providers ORDER BY created_at DESC").all();
+      const session = req.session;
+      const currentUserId = session?.userId || session?.username;
+      const providers = kernelContainer.db.prepare(
+        "SELECT id, name, api_url, api_key, model_name, owner_id, is_shared, created_at, updated_at FROM ai_providers WHERE (owner_id = ? OR is_shared = 1) ORDER BY created_at DESC"
+      ).all(currentUserId);
       const masked = providers.map((p) => {
         let apiKey;
         try {
@@ -51975,54 +52083,122 @@ function registerPluginsRoutes(ctx) {
         } catch {
           apiKey = "[UNDECRYPTABLE]";
         }
-        return { ...p, api_key: apiKey };
+        return {
+          ...p,
+          api_key: apiKey,
+          is_shared: Number(p.is_shared) === 1
+        };
       });
       res.json(masked);
     } catch (e) {
       sendSafeError(res, e);
     }
   });
-  app.post("/api/ai-providers", requireAuth("administrator"), (req, res) => {
+  app.post("/api/ai-providers", requireScopedAuth("self", "teacher", "administrator"), (req, res) => {
     try {
-      const { name, api_url, api_key, model_name } = req.body;
+      const session = req.session;
+      const currentUserId = session?.userId || session?.username;
+      const isAdmin = isAdministrator2(session);
+      const { name, api_url, api_key, model_name, is_shared } = req.body;
       if (!name || !api_url || !model_name) {
         return res.status(400).json({ error: "Missing name, api_url or model_name" });
       }
+      const wantsShared = is_shared === 1 || is_shared === true || is_shared === "1";
+      if (wantsShared && !isAdmin) {
+        return res.status(403).json({ error: "Only administrators can create platform shared providers" });
+      }
       const id = "prov_" + Date.now();
       const now = Date.now();
       const encryptedKey = api_key ? encryptApiKey(api_key) : "";
       kernelContainer.db.prepare(
-        "INSERT INTO ai_providers (id, name, api_url, api_key, model_name, created_at, updated_at) VALUES (?, ?, ?, ?, ?, ?, ?)"
-      ).run(id, name, api_url, encryptedKey, model_name, now, now);
+        "INSERT INTO ai_providers (id, name, api_url, api_key, model_name, owner_id, is_shared, created_at, updated_at) VALUES (?, ?, ?, ?, ?, ?, ?, ?, ?)"
+      ).run(
+        id,
+        name.trim(),
+        api_url.trim(),
+        encryptedKey,
+        model_name.trim(),
+        currentUserId,
+        wantsShared && isAdmin ? 1 : 0,
+        now,
+        now
+      );
       res.json({ success: true, id });
     } catch (e) {
       sendSafeError(res, e);
     }
   });
-  app.put("/api/ai-providers/:id", requireAuth("administrator"), (req, res) => {
+  app.put("/api/ai-providers/:id", requireScopedAuth("self", "teacher", "administrator"), (req, res) => {
     try {
-      const { name, api_url, api_key, model_name } = req.body;
+      const session = req.session;
+      const currentUserId = session?.userId || session?.username;
+      const isAdmin = isAdministrator2(session);
+      const { name, api_url, api_key, model_name, is_shared } = req.body;
       if (!name || !api_url || !model_name) {
         return res.status(400).json({ error: "Missing name, api_url or model_name" });
       }
+      const existing = kernelContainer.db.prepare("SELECT id, api_key, owner_id, is_shared FROM ai_providers WHERE id = ?").get(req.params.id);
+      if (!existing) {
+        return res.status(404).json({ error: "AI provider not found" });
+      }
+      const isExistingShared = Number(existing.is_shared) === 1;
+      if (isExistingShared) {
+        if (!isAdmin) {
+          return res.status(403).json({ error: "Forbidden: Only administrators can modify platform shared providers" });
+        }
+      } else {
+        if (existing.owner_id !== currentUserId) {
+          return res.status(403).json({
+            error: "Forbidden: You do not have permission to modify another user's private AI provider"
+          });
+        }
+      }
+      let nextShared = existing.is_shared ?? 0;
+      if (is_shared !== void 0) {
+        const wantsShared = is_shared === 1 || is_shared === true || is_shared === "1";
+        if (wantsShared !== (Number(existing.is_shared) === 1)) {
+          if (!isAdmin) {
+            return res.status(403).json({ error: "Forbidden: Only administrators can change platform shared status" });
+          }
+          nextShared = wantsShared ? 1 : 0;
+        }
+      }
       const now = Date.now();
       let finalKey;
       if (api_key && api_key.trim() !== "" && !api_key.includes("****")) {
         finalKey = encryptApiKey(api_key);
       } else {
-        const existing = kernelContainer.db.prepare("SELECT api_key FROM ai_providers WHERE id = ?").get(req.params.id);
         finalKey = existing?.api_key || "";
       }
       kernelContainer.db.prepare(
-        "UPDATE ai_providers SET name = ?, api_url = ?, api_key = ?, model_name = ?, updated_at = ? WHERE id = ?"
-      ).run(name, api_url, finalKey, model_name, now, req.params.id);
+        "UPDATE ai_providers SET name = ?, api_url = ?, api_key = ?, model_name = ?, is_shared = ?, updated_at = ? WHERE id = ?"
+      ).run(name.trim(), api_url.trim(), finalKey, model_name.trim(), nextShared, now, req.params.id);
       res.json({ success: true });
     } catch (e) {
       sendSafeError(res, e);
     }
   });
-  app.delete("/api/ai-providers/:id", requireAuth("administrator"), (req, res) => {
+  app.delete("/api/ai-providers/:id", requireScopedAuth("self", "teacher", "administrator"), (req, res) => {
     try {
+      const session = req.session;
+      const currentUserId = session?.userId || session?.username;
+      const isAdmin = isAdministrator2(session);
+      const existing = kernelContainer.db.prepare("SELECT id, owner_id, is_shared FROM ai_providers WHERE id = ?").get(req.params.id);
+      if (!existing) {
+        return res.status(404).json({ error: "AI provider not found" });
+      }
+      const isExistingShared = Number(existing.is_shared) === 1;
+      if (isExistingShared) {
+        if (!isAdmin) {
+          return res.status(403).json({ error: "Forbidden: Only administrators can delete platform shared providers" });
+        }
+      } else {
+        if (existing.owner_id !== currentUserId) {
+          return res.status(403).json({
+            error: "Forbidden: You do not have permission to delete another user's private AI provider"
+          });
+        }
+      }
       kernelContainer.db.prepare("DELETE FROM ai_providers WHERE id = ?").run(req.params.id);
       res.json({ success: true });
     } catch (e) {
@@ -52105,65 +52281,82 @@ function registerPluginsRoutes(ctx) {
       sendSafeError(res, e);
     }
   });
-  app.post("/api/ai-providers/test", requireAuth("administrator"), safeAiLimiter, async (req, res) => {
-    try {
-      const { api_url, api_key: providedKey, model_name } = req.body;
-      if (!api_url || !model_name) {
-        return res.status(400).json({ error: "api_url and model_name are required" });
-      }
-      let api_key = "";
-      if (providedKey && providedKey.includes("****")) {
-        const existing = kernelContainer.db.prepare("SELECT api_key FROM ai_providers WHERE api_url = ? AND model_name = ? LIMIT 1").get(api_url, model_name);
-        api_key = existing ? decryptApiKey(existing.api_key) : "";
-      } else if (providedKey) {
-        api_key = providedKey.includes(":") ? decryptApiKey(providedKey) : providedKey;
-      }
-      let cleanUrl = api_url.trim();
-      if (!cleanUrl.endsWith("/chat/completions")) {
-        cleanUrl = cleanUrl.endsWith("/") ? cleanUrl + "chat/completions" : cleanUrl + "/chat/completions";
-      }
-      const urlSafety = isSafeExternalUrl(cleanUrl);
-      if (!urlSafety.safe) {
-        return res.status(400).json({ error: `Blocked unsafe AI provider URL: ${urlSafety.reason}` });
-      }
-      let response;
+  app.post(
+    "/api/ai-providers/test",
+    requireScopedAuth("self", "teacher", "administrator"),
+    safeAiLimiter,
+    async (req, res) => {
       try {
-        response = await fetchWithSafeRedirects(cleanUrl, {
-          method: "POST",
-          headers: {
-            "Content-Type": "application/json",
-            Authorization: `Bearer ${api_key || ""}`
-          },
-          body: JSON.stringify({
-            model: model_name,
-            messages: [{ role: "user", content: "Say connected" }],
-            max_tokens: 5
-          }),
-          timeoutMs: 1e4
-        });
-      } catch (err) {
-        const isTimeout = err instanceof AIFetchTimeoutError || err?.name === "TimeoutError" || err?.name === "AbortError" || /abort|timeout/i.test(err?.message ?? "");
-        if (isTimeout) {
-          return res.status(504).json({
+        const session = req.session;
+        const currentUserId = session?.userId || session?.username;
+        const { api_url, api_key: providedKey, model_name, id } = req.body;
+        if (!api_url || !model_name) {
+          return res.status(400).json({ error: "api_url and model_name are required" });
+        }
+        let api_key = "";
+        if (providedKey && providedKey.includes("****")) {
+          let existing;
+          if (id) {
+            existing = kernelContainer.db.prepare("SELECT api_key FROM ai_providers WHERE id = ? AND (owner_id = ? OR is_shared = 1)").get(id, currentUserId);
+          } else {
+            existing = kernelContainer.db.prepare(
+              "SELECT api_key FROM ai_providers WHERE api_url = ? AND model_name = ? AND (owner_id = ? OR is_shared = 1) LIMIT 1"
+            ).get(api_url, model_name, currentUserId);
+          }
+          if (!existing) {
+            return res.status(403).json({ error: "Forbidden: Cannot access key for this provider" });
+          }
+          api_key = decryptApiKey(existing.api_key);
+        } else if (providedKey) {
+          api_key = providedKey.includes(":") ? decryptApiKey(providedKey) : providedKey;
+        }
+        let cleanUrl = api_url.trim();
+        if (!cleanUrl.endsWith("/chat/completions")) {
+          cleanUrl = cleanUrl.endsWith("/") ? cleanUrl + "chat/completions" : cleanUrl + "/chat/completions";
+        }
+        const urlSafety = isSafeExternalUrl(cleanUrl);
+        if (!urlSafety.safe) {
+          return res.status(400).json({ error: `Blocked unsafe AI provider URL: ${urlSafety.reason}` });
+        }
+        let response;
+        try {
+          response = await fetchWithSafeRedirects(cleanUrl, {
+            method: "POST",
+            headers: {
+              "Content-Type": "application/json",
+              Authorization: `Bearer ${api_key || ""}`
+            },
+            body: JSON.stringify({
+              model: model_name,
+              messages: [{ role: "user", content: "Say connected" }],
+              max_tokens: 5
+            }),
+            timeoutMs: 1e4
+          });
+        } catch (err) {
+          const isTimeout = err instanceof AIFetchTimeoutError || err?.name === "TimeoutError" || err?.name === "AbortError" || /abort|timeout/i.test(err?.message ?? "");
+          if (isTimeout) {
+            return res.status(504).json({
+              success: false,
+              error: "AI Provider request timed out after 10000ms. Please verify the URL or provider availability."
+            });
+          }
+          throw err;
+        }
+        const responseText = await response.text();
+        if (response.ok) {
+          res.json({ success: true, message: "Successfully connected and received response." });
+        } else {
+          res.status(response.status).json({
             success: false,
-            error: "AI Provider request timed out after 10000ms. Please verify the URL or provider availability."
+            error: `API responded with status ${response.status}: ${responseText.slice(0, 200)}`
           });
         }
-        throw err;
-      }
-      const responseText = await response.text();
-      if (response.ok) {
-        res.json({ success: true, message: "Successfully connected and received response." });
-      } else {
-        res.status(response.status).json({
-          success: false,
-          error: `API responded with status ${response.status}: ${responseText.slice(0, 200)}`
-        });
+      } catch (e) {
+        sendSafeError(res, e, 500, "Connection failed");
       }
-    } catch (e) {
-      sendSafeError(res, e, 500, "Connection failed");
     }
-  });
+  );
 }
 
 // server/services/assessment-service.ts
@@ -58608,12 +58801,16 @@ async function startServer() {
   const defaultWriteLimit = process.env.PLAYWRIGHT_TEST ? 1e4 : isDev ? 600 : 180;
   const writeLimiter = createWriteLimiter(defaultWriteLimit);
   const viewStateLimiter = createWriteLimiter(process.env.PLAYWRIGHT_TEST ? 1e4 : isDev ? 600 : 120);
+  const pluginApiLimiter = createSessionWriteLimiter(process.env.PLAYWRIGHT_TEST ? 1e4 : 600);
   const aiLimiter = createAiLimiter(process.env.PLAYWRIGHT_TEST ? 1e3 : 10);
   app.use((req, res, next) => {
     if (req.method === "POST" || req.method === "PUT" || req.method === "DELETE") {
       if (/^\/api\/classroom\/sessions\/[^/]+\/view-state\/?$/.test(req.path)) {
         return viewStateLimiter(req, res, next);
       }
+      if (req.path.startsWith("/api/plugins/")) {
+        return pluginApiLimiter(req, res, next);
+      }
       return writeLimiter(req, res, next);
     }
     next();