plugin-ai-api 1.0.15 → 1.0.21

package/dist/server/validation.js

@@ -0,0 +1,120 @@
+/**
+ * This file is part of the NocoBase (R) project.
+ * Copyright (c) 2020-2024 NocoBase Co., Ltd.
+ * Authors: NocoBase Team.
+ *
+ * This project is dual-licensed under AGPL-3.0 and NocoBase Commercial License.
+ * For more information, please refer to: https://www.nocobase.com/agreement.
+ */
+
+var __create = Object.create;
+var __defProp = Object.defineProperty;
+var __getOwnPropDesc = Object.getOwnPropertyDescriptor;
+var __getOwnPropNames = Object.getOwnPropertyNames;
+var __getProtoOf = Object.getPrototypeOf;
+var __hasOwnProp = Object.prototype.hasOwnProperty;
+var __export = (target, all) => {
+  for (var name in all)
+    __defProp(target, name, { get: all[name], enumerable: true });
+};
+var __copyProps = (to, from, except, desc) => {
+  if (from && typeof from === "object" || typeof from === "function") {
+    for (let key of __getOwnPropNames(from))
+      if (!__hasOwnProp.call(to, key) && key !== except)
+        __defProp(to, key, { get: () => from[key], enumerable: !(desc = __getOwnPropDesc(from, key)) || desc.enumerable });
+  }
+  return to;
+};
+var __toESM = (mod, isNodeMode, target) => (target = mod != null ? __create(__getProtoOf(mod)) : {}, __copyProps(
+  // If the importer is in node compatibility mode or this is not an ESM
+  // file that has been converted to a CommonJS file using a Babel-
+  // compatible transform (i.e. "__esModule" has not been set), then set
+  // "default" to the CommonJS "module.exports" for node compatibility.
+  isNodeMode || !mod || !mod.__esModule ? __defProp(target, "default", { value: mod, enumerable: true }) : target,
+  mod
+));
+var __toCommonJS = (mod) => __copyProps(__defProp({}, "__esModule", { value: true }), mod);
+var validation_exports = {};
+__export(validation_exports, {
+  validateModelMetadata: () => validateModelMetadata,
+  validateModelPrice: () => validateModelPrice,
+  validateQuotaPolicy: () => validateQuotaPolicy
+});
+module.exports = __toCommonJS(validation_exports);
+var import_dayjs = __toESM(require("dayjs"));
+function requireNonNegativeDecimal(value, field) {
+  const normalized = String(value ?? "").trim();
+  if (!/^\d+(?:\.\d+)?$/.test(normalized)) {
+    throw new Error(`${field} must be a non-negative decimal.`);
+  }
+}
+function requireNonNegativeIntegerOrNull(value, field) {
+  if (value === null || value === void 0 || value === "") return;
+  const parsed = Number(value);
+  if (!Number.isSafeInteger(parsed) || parsed < 0) throw new Error(`${field} must be a non-negative integer.`);
+}
+async function validateModelPrice(db, model) {
+  requireNonNegativeDecimal(model.get("inputPricePerMillionTokens"), "inputPricePerMillionTokens");
+  requireNonNegativeDecimal(model.get("outputPricePerMillionTokens"), "outputPricePerMillionTokens");
+  requireNonNegativeDecimal(model.get("fixedCostPerRequest") ?? 0, "fixedCostPerRequest");
+  const effectiveFrom = new Date(String(model.get("effectiveFrom")));
+  const effectiveToValue = model.get("effectiveTo");
+  const effectiveTo = effectiveToValue ? new Date(String(effectiveToValue)) : void 0;
+  if (Number.isNaN(effectiveFrom.getTime())) throw new Error("effectiveFrom must be a valid date.");
+  if (effectiveTo && (Number.isNaN(effectiveTo.getTime()) || effectiveTo <= effectiveFrom)) {
+    throw new Error("effectiveTo must be later than effectiveFrom.");
+  }
+  if (model.get("enabled") === false) return;
+  const overlapFilter = {
+    llmService: model.get("llmService"),
+    model: model.get("model"),
+    enabled: true,
+    effectiveFrom: { $lt: effectiveTo ?? /* @__PURE__ */ new Date("9999-12-31T23:59:59.999Z") },
+    $or: [{ effectiveTo: null }, { effectiveTo: { $gt: effectiveFrom } }]
+  };
+  if (model.get("id")) overlapFilter.id = { $ne: model.get("id") };
+  const overlap = await db.getRepository("aiApiModelPrices").findOne({
+    filter: overlapFilter
+  });
+  if (overlap) throw new Error("An enabled price already overlaps this effective period.");
+}
+function requirePositiveIntegerOrNull(value, field) {
+  if (value === null || value === void 0 || value === "") return;
+  const parsed = Number(value);
+  if (!Number.isSafeInteger(parsed) || parsed <= 0) throw new Error(`${field} must be a positive integer.`);
+}
+function validateModelMetadata(model) {
+  if (!String(model.get("llmService") ?? "").trim()) throw new Error("llmService is required.");
+  if (!String(model.get("model") ?? "").trim()) throw new Error("model is required.");
+  requirePositiveIntegerOrNull(model.get("contextWindow"), "contextWindow");
+  requirePositiveIntegerOrNull(model.get("maxCompletionTokens"), "maxCompletionTokens");
+  const contextWindow = model.get("contextWindow");
+  const maxCompletionTokens = model.get("maxCompletionTokens");
+  if (contextWindow !== null && contextWindow !== void 0 && contextWindow !== "" && maxCompletionTokens !== null && maxCompletionTokens !== void 0 && maxCompletionTokens !== "" && Number(maxCompletionTokens) > Number(contextWindow)) {
+    throw new Error("maxCompletionTokens cannot exceed contextWindow.");
+  }
+}
+function validateQuotaPolicy(model) {
+  if (!["daily", "monthly"].includes(String(model.get("periodType")))) {
+    throw new Error("periodType must be daily or monthly.");
+  }
+  if (!["allow", "use_reserved"].includes(String(model.get("missingUsageBehavior")))) {
+    throw new Error("missingUsageBehavior must be allow or use_reserved.");
+  }
+  try {
+    (0, import_dayjs.default)().tz(String(model.get("timezone") || "UTC"));
+  } catch {
+    throw new Error("timezone must be a valid IANA timezone.");
+  }
+  requireNonNegativeIntegerOrNull(model.get("requestLimit"), "requestLimit");
+  requireNonNegativeIntegerOrNull(model.get("totalTokenLimit"), "totalTokenLimit");
+  if (model.get("costLimit") !== null && model.get("costLimit") !== void 0) {
+    requireNonNegativeDecimal(model.get("costLimit"), "costLimit");
+  }
+}
+// Annotate the CommonJS export names for ESM import in node:
+0 && (module.exports = {
+  validateModelMetadata,
+  validateModelPrice,
+  validateQuotaPolicy
+});

package/dist/swagger.js

@@ -277,6 +277,13 @@ var swagger_default = {
           rateLimitPerMinute: {
             type: "integer",
             description: "Max requests per minute per user (0 = unlimited)"
+          },
+          maxRequestBodyMb: {
+            type: "integer",
+            minimum: 1,
+            maximum: 100,
+            default: 10,
+            description: "Max request body size in megabytes. Requests above this return 413. The gateway buffers each body in memory, so values above 100 are rejected."
           }
         }
       },
@@ -289,11 +296,35 @@ var swagger_default = {
           owned_by: { type: "string" }
         }
       },
+      ContentBlock: {
+        type: "object",
+        description: "A multimodal content block. Only text and image_url blocks are forwarded to the provider; any other type is rejected with 400 unsupported_content_block.",
+        properties: {
+          type: { type: "string", enum: ["text", "image_url"] },
+          text: { type: "string" },
+          image_url: {
+            type: "object",
+            properties: {
+              url: {
+                type: "string",
+                description: "An https URL or a base64 data URL, e.g. data:image/png;base64,iVBORw0KGgo...",
+                example: "data:image/png;base64,iVBORw0KGgo..."
+              },
+              detail: { type: "string", enum: ["auto", "low", "high"] }
+            },
+            required: ["url"]
+          }
+        },
+        required: ["type"]
+      },
       ChatMessage: {
         type: "object",
         properties: {
           role: { type: "string", enum: ["system", "user", "assistant", "tool"] },
-          content: { type: "string" },
+          content: {
+            description: 'Plain text, or an array of content blocks for multimodal requests. Inline base64 images inflate the payload by about 33%; see "Max request body size" in the gateway settings.',
+            oneOf: [{ type: "string" }, { type: "array", items: { $ref: "#/components/schemas/ContentBlock" } }]
+          },
           name: { type: "string" },
           tool_call_id: { type: "string" },
           tool_calls: { type: "array", items: { $ref: "#/components/schemas/ToolCall" } }

package/package.json

@@ -1,6 +1,6 @@
 {
   "name": "plugin-ai-api",
-  "version": "1.0.15",
+  "version": "1.0.21",
   "main": "dist/server/index.js",
   "dependencies": {},
   "peerDependencies": {

package/src/client/components/AiApiRolePermissions.tsx

@@ -1,169 +1,11 @@
-/**
- * This file is part of the NocoBase (R) project.
- * Copyright (c) 2020-2024 NocoBase Co., Ltd.
- * Authors: NocoBase Team.
- *
- * This project is dual-licensed under AGPL-3.0 and NocoBase Commercial License.
- * For more information, please refer to: https://www.nocobase.com/agreement.
- */
-
-import React, { useEffect, useState } from 'react';
-import { useApp } from '@nocobase/client-v2';
-import { Card, Switch, Select, Space, Typography, Spin, Divider } from 'antd';
-
-const { Text } = Typography;
-
-interface AiEmployee {
-  username: string;
-  nickname: string;
-}
-
-interface RolePermRecord {
-  id?: number;
-  roleName: string;
-  enabled: boolean;
-  allowAllEmployees: boolean;
-  allowedEmployees: string[];
-}
-
-/**
- * Permission tab shown in Settings → Users & Permissions → [Role] → "AI API" tab.
- * Lets admins control whether a role can use the AI API and which AI Employees it may access.
- */
-export function AiApiRolePermissions({ role }: { role: any }) {
-  const api = useApp().apiClient;
-  const [loading, setLoading] = useState(true);
-  const [saving, setSaving] = useState(false);
-  const [employees, setEmployees] = useState<AiEmployee[]>([]);
-  const [record, setRecord] = useState<RolePermRecord | null>(null);
-
-  const roleName = role?.name;
-
-  useEffect(() => {
-    if (!roleName) return;
-    loadData();
-    // eslint-disable-next-line react-hooks/exhaustive-deps
-  }, [roleName]);
-
-  const loadData = async () => {
-    setLoading(true);
-    try {
-      const [permRes, empRes] = await Promise.all([
-        api.request({
-          url: 'aiApiRolePermissions',
-          params: { filter: { roleName }, paginate: false },
-        }),
-        api.request({ url: 'aiEmployees:list', params: { paginate: false } }),
-      ]);
-
-      const existing = permRes?.data?.data?.[0];
-      setRecord(
-        existing
-          ? {
-              id: existing.id,
-              roleName: existing.roleName,
-              enabled: !!existing.enabled,
-              allowAllEmployees: existing.allowAllEmployees !== false,
-              allowedEmployees: existing.allowedEmployees || [],
-            }
-          : {
-              roleName,
-              enabled: false,
-              allowAllEmployees: true,
-              allowedEmployees: [],
-            },
-      );
-
-      setEmployees(
-        (empRes?.data?.data || []).map((e: any) => ({
-          username: e.username,
-          nickname: e.nickname || e.username,
-        })),
-      );
-    } catch (err) {
-      console.error('Failed to load AI API role permissions:', err);
-    } finally {
-      setLoading(false);
-    }
-  };
-
-  const save = async (patch: Partial<RolePermRecord>) => {
-    if (!record) return;
-    const next = { ...record, ...patch };
-    setRecord(next);
-    setSaving(true);
-    try {
-      if (next.id) {
-        await api.request({
-          url: `aiApiRolePermissions/${next.id}`,
-          method: 'PUT',
-          data: next,
-        });
-      } else {
-        const res = await api.request({
-          url: 'aiApiRolePermissions',
-          method: 'POST',
-          data: next,
-        });
-        const created = res?.data?.data;
-        if (created?.id) {
-          setRecord({ ...next, id: created.id });
-        }
-      }
-    } catch (err) {
-      console.error('Failed to save AI API role permissions:', err);
-      // Revert on error
-      setRecord(record);
-    } finally {
-      setSaving(false);
-    }
-  };
-
-  if (loading) return <Spin />;
-
-  return (
-    <Card bordered={false}>
-      <Space direction="vertical" style={{ width: '100%' }} size="middle">
-        <Space>
-          <Switch checked={!!record?.enabled} loading={saving} onChange={(checked) => save({ enabled: checked })} />
-          <Text strong>Allow this role to use the AI API</Text>
-        </Space>
-
-        {record?.enabled && (
-          <>
-            <Divider style={{ margin: '8px 0' }} />
-            <Space>
-              <Switch
-                checked={!!record?.allowAllEmployees}
-                loading={saving}
-                onChange={(checked) => save({ allowAllEmployees: checked })}
-              />
-              <Text>Allow all AI Employees</Text>
-            </Space>
-
-            {!record?.allowAllEmployees && (
-              <div>
-                <Text type="secondary" style={{ display: 'block', marginBottom: 8 }}>
-                  Select which AI Employees this role may use:
-                </Text>
-                <Select
-                  mode="multiple"
-                  allowClear
-                  style={{ width: '100%', maxWidth: 480 }}
-                  placeholder="Select allowed AI Employees"
-                  value={record?.allowedEmployees || []}
-                  options={employees.map((e) => ({
-                    label: `${e.nickname} (${e.username})`,
-                    value: e.username,
-                  }))}
-                  onChange={(vals) => save({ allowedEmployees: vals })}
-                  disabled={saving}
-                />
-              </div>
-            )}
-          </>
-        )}
-      </Space>
-    </Card>
-  );
-}
+/**
+ * This file is part of the NocoBase (R) project.
+ * Copyright (c) 2020-2024 NocoBase Co., Ltd.
+ * Authors: NocoBase Team.
+ *
+ * This project is dual-licensed under AGPL-3.0 and NocoBase Commercial License.
+ * For more information, please refer to: https://www.nocobase.com/agreement.
+ */
+
+// Implementation lives in client-v2; imports may only flow v1 -> v2, never back.
+export { AiApiRolePermissions } from '../../client-v2/components/AiApiRolePermissions';

package/src/client/locale.ts

@@ -1,21 +1,11 @@
-/**
- * This file is part of the NocoBase (R) project.
- * Copyright (c) 2020-2024 NocoBase Co., Ltd.
- * Authors: NocoBase Team.
- *
- * This project is dual-licensed under AGPL-3.0 and NocoBase Commercial License.
- * For more information, please refer to: https://www.nocobase.com/agreement.
- */
-
-import { tExpr as _tExpr, useFlowEngine } from '@nocobase/flow-engine';
-// @ts-ignore
-import pkg from './../../package.json';
-
-export function useT() {
-  const engine = useFlowEngine();
-  return (str: string) => engine.context.t(str, { ns: [pkg.name, 'client'] });
-}
-
-export function tExpr(key: string) {
-  return _tExpr(key, { ns: [pkg.name, 'client'] });
-}
+/**
+ * This file is part of the NocoBase (R) project.
+ * Copyright (c) 2020-2024 NocoBase Co., Ltd.
+ * Authors: NocoBase Team.
+ *
+ * This project is dual-licensed under AGPL-3.0 and NocoBase Commercial License.
+ * For more information, please refer to: https://www.nocobase.com/agreement.
+ */
+
+// Implementation lives in client-v2; imports may only flow v1 -> v2, never back.
+export { tExpr, useT } from '../client-v2/locale';

package/src/client/plugin.tsx

@@ -1,48 +1,82 @@
-/**
- * This file is part of the NocoBase (R) project.
- * Copyright (c) 2020-2024 NocoBase Co., Ltd.
- * Authors: NocoBase Team.
- *
- * This project is dual-licensed under AGPL-3.0 and NocoBase Commercial License.
- * For more information, please refer to: https://www.nocobase.com/agreement.
- */
-
-import { Plugin, lazy } from '@nocobase/client';
-import PluginACLClient from '@nocobase/plugin-acl/client';
-import React from 'react';
-
-const AiApiConfigPage = React.lazy(() => import('./AiApiConfigPage'));
-const { AiApiRolePermissions } = lazy(() => import('./components/AiApiRolePermissions'), 'AiApiRolePermissions');
-
-export class PluginAiApiClient extends Plugin {
-  async load() {
-    this.app.pluginSettingsManager.add('ai-api', {
-      icon: 'ApiOutlined',
-      title: this.t('AI API Gateway'),
-      aclSnippet: 'pm.ai-api.configuration',
-    });
-
-    this.app.pluginSettingsManager.add('ai-api.config', {
-      title: this.t('Configuration'),
-      Component: AiApiConfigPage,
-    });
-
-    // Add "AI API" tab in Settings → Users & Permissions → [Role]
-    const aclPlugin = this.app.pm.get(PluginACLClient);
-    if (aclPlugin?.settingsUI) {
-      aclPlugin.settingsUI.addPermissionsTab(({ t, TabLayout, activeRole }) => ({
-        key: 'aiApi',
-        label: 'AI API',
-        sort: 25,
-        children: (
-          <TabLayout>
-            <AiApiRolePermissions role={activeRole} />
-          </TabLayout>
-        ),
-      }));
-    }
-  }
-
-}
-
-export default PluginAiApiClient;
+/**
+ * This file is part of the NocoBase (R) project.
+ * Copyright (c) 2020-2024 NocoBase Co., Ltd.
+ * Authors: NocoBase Team.
+ *
+ * This project is dual-licensed under AGPL-3.0 and NocoBase Commercial License.
+ * For more information, please refer to: https://www.nocobase.com/agreement.
+ */
+
+import { Plugin, lazy } from '@nocobase/client';
+import PluginACLClient from '@nocobase/plugin-acl/client';
+import { AI_API_ACL_SNIPPET } from '../constants';
+import React from 'react';
+
+const AiApiConfigPage = React.lazy(() => import('../client-v2/pages/GeneralPage'));
+const AiApiModelPricingPage = React.lazy(() => import('../client-v2/pages/ModelPricingPage'));
+const AiApiModelMetadataPage = React.lazy(() => import('../client-v2/pages/ModelMetadataPage'));
+const AiApiUserQuotasPage = React.lazy(() => import('../client-v2/pages/UserQuotasPage'));
+const AiApiUsagePage = React.lazy(() => import('../client-v2/pages/UsagePage'));
+const { AiApiRolePermissions } = lazy(() => import('./components/AiApiRolePermissions'), 'AiApiRolePermissions');
+
+export class PluginAiApiClient extends Plugin {
+  async load() {
+    this.app.pluginSettingsManager.add('ai-api', {
+      icon: 'ApiOutlined',
+      title: this.t('AI API Gateway'),
+      aclSnippet: AI_API_ACL_SNIPPET,
+    });
+
+    this.app.pluginSettingsManager.add('ai-api.config', {
+      title: this.t('Configuration'),
+      Component: AiApiConfigPage,
+      aclSnippet: AI_API_ACL_SNIPPET,
+      sort: 1,
+    });
+
+    this.app.pluginSettingsManager.add('ai-api.model-pricing', {
+      title: this.t('Model pricing'),
+      Component: AiApiModelPricingPage,
+      aclSnippet: AI_API_ACL_SNIPPET,
+      sort: 2,
+    });
+
+    this.app.pluginSettingsManager.add('ai-api.model-metadata', {
+      title: this.t('Model metadata'),
+      Component: AiApiModelMetadataPage,
+      aclSnippet: AI_API_ACL_SNIPPET,
+      sort: 3,
+    });
+
+    this.app.pluginSettingsManager.add('ai-api.user-quotas', {
+      title: this.t('User quotas'),
+      Component: AiApiUserQuotasPage,
+      aclSnippet: AI_API_ACL_SNIPPET,
+      sort: 4,
+    });
+
+    this.app.pluginSettingsManager.add('ai-api.usage', {
+      title: this.t('Usage'),
+      Component: AiApiUsagePage,
+      aclSnippet: AI_API_ACL_SNIPPET,
+      sort: 5,
+    });
+
+    // Add "AI API" tab in Settings → Users & Permissions → [Role]
+    const aclPlugin = this.app.pm.get(PluginACLClient);
+    if (aclPlugin?.settingsUI) {
+      aclPlugin.settingsUI.addPermissionsTab(({ t, TabLayout, activeRole }) => ({
+        key: 'aiApi',
+        label: t('AI API', { ns: ['plugin-ai-api', 'client'] }),
+        sort: 25,
+        children: (
+          <TabLayout>
+            <AiApiRolePermissions role={activeRole} />
+          </TabLayout>
+        ),
+      }));
+    }
+  }
+}
+
+export default PluginAiApiClient;

package/src/client-v2/__tests__/settings-registration.test.tsx

@@ -0,0 +1,58 @@
+/**
+ * This file is part of the NocoBase (R) project.
+ * Copyright (c) 2020-2024 NocoBase Co., Ltd.
+ * Authors: NocoBase Team.
+ *
+ * This project is dual-licensed under AGPL-3.0 and NocoBase Commercial License.
+ * For more information, please refer to: https://www.nocobase.com/agreement.
+ */
+
+import { createMockClient } from '@nocobase/client-v2';
+import { AI_API_ACL_SNIPPET } from '../../constants';
+import { PluginAiApiClient } from '../plugin';
+
+/**
+ * Guards the settings registration itself rather than any page's contents.
+ *
+ * Two regressions are cheap to reintroduce and invisible until a non-admin logs in:
+ * omitting `aclSnippet` makes addPageTabItem default to `pm.ai-api.<key>`, a snippet the
+ * server never registers, and omitting `sort` silently reorders the tabs alphabetically.
+ */
+describe('AI API v2 settings registration', () => {
+  async function loadPlugin() {
+    const app = createMockClient();
+    await new PluginAiApiClient({}, app).load();
+    return app;
+  }
+
+  it('registers every page under the one snippet the server exposes', async () => {
+    const app = await loadPlugin();
+    const menu = app.pluginSettingsManager.get('ai-api', false);
+
+    expect(menu?.aclSnippet).toBe(AI_API_ACL_SNIPPET);
+    for (const child of menu?.children ?? []) {
+      expect(app.pluginSettingsManager.getAclSnippet(child.name), child.name).toBe(AI_API_ACL_SNIPPET);
+    }
+  });
+
+  it('hides the menu and every tab when the role denies that snippet', async () => {
+    const app = await loadPlugin();
+    app.pluginSettingsManager.setAclSnippets([`!${AI_API_ACL_SNIPPET}`]);
+
+    expect(app.pluginSettingsManager.get('ai-api')).toBeNull();
+    expect(app.pluginSettingsManager.getList().map((item) => item.name)).not.toContain('ai-api');
+  });
+
+  it('keeps registration order instead of sorting tabs by name', async () => {
+    const app = await loadPlugin();
+    app.pluginSettingsManager.setAclSnippets([]);
+
+    expect(app.pluginSettingsManager.get('ai-api')?.children?.map((item) => item.name)).toEqual([
+      'ai-api.index',
+      'ai-api.model-pricing',
+      'ai-api.model-metadata',
+      'ai-api.user-quotas',
+      'ai-api.usage',
+    ]);
+  });
+});