plugin-ai-api 1.0.20 → 1.0.21

package/dist/server/utils/app-observability.js

@@ -0,0 +1,110 @@
+/**
+ * This file is part of the NocoBase (R) project.
+ * Copyright (c) 2020-2024 NocoBase Co., Ltd.
+ * Authors: NocoBase Team.
+ *
+ * This project is dual-licensed under AGPL-3.0 and NocoBase Commercial License.
+ * For more information, please refer to: https://www.nocobase.com/agreement.
+ */
+
+var __defProp = Object.defineProperty;
+var __getOwnPropDesc = Object.getOwnPropertyDescriptor;
+var __getOwnPropNames = Object.getOwnPropertyNames;
+var __hasOwnProp = Object.prototype.hasOwnProperty;
+var __export = (target, all) => {
+  for (var name in all)
+    __defProp(target, name, { get: all[name], enumerable: true });
+};
+var __copyProps = (to, from, except, desc) => {
+  if (from && typeof from === "object" || typeof from === "function") {
+    for (let key of __getOwnPropNames(from))
+      if (!__hasOwnProp.call(to, key) && key !== except)
+        __defProp(to, key, { get: () => from[key], enumerable: !(desc = __getOwnPropDesc(from, key)) || desc.enumerable });
+  }
+  return to;
+};
+var __toCommonJS = (mod) => __copyProps(__defProp({}, "__esModule", { value: true }), mod);
+var app_observability_exports = {};
+__export(app_observability_exports, {
+  addAiApiUsage: () => addAiApiUsage,
+  finishAiApiObservation: () => finishAiApiObservation,
+  markAiApiFirstProviderOutput: () => markAiApiFirstProviderOutput,
+  setAiApiObservationOutcome: () => setAiApiObservationOutcome,
+  startAiApiObservation: () => startAiApiObservation
+});
+module.exports = __toCommonJS(app_observability_exports);
+const CONTRACT_SYMBOL = Symbol.for("nocobase.app-observability.contract");
+const NOOP_HANDLE = {
+  markFirstByte() {
+  },
+  addInputTokens() {
+  },
+  addOutputTokens() {
+  },
+  finish() {
+  }
+};
+function state(ctx) {
+  return ctx.state;
+}
+function safely(ctx, callback) {
+  var _a, _b, _c;
+  try {
+    callback();
+  } catch (error) {
+    (_c = (_b = (_a = ctx.app) == null ? void 0 : _a.logger) == null ? void 0 : _b.warn) == null ? void 0 : _c.call(_b, "[ai-api] App observability callback failed", { error });
+  }
+}
+function startAiApiObservation(ctx, input) {
+  let handle = NOOP_HANDLE;
+  safely(ctx, () => {
+    const contract = ctx.app[CONTRACT_SYMBOL];
+    if (!contract || typeof contract.start !== "function") return;
+    const candidate = contract.start({
+      service: input.service,
+      operation: input.operation,
+      streaming: input.streaming,
+      attributes: {
+        mode: input.mode,
+        endpoint: input.operation,
+        ...input.model ? { model: input.model } : {}
+      }
+    });
+    if (candidate && typeof candidate.finish === "function") handle = candidate;
+  });
+  state(ctx).aiApiObservabilityHandle = handle;
+}
+function markAiApiFirstProviderOutput(ctx) {
+  safely(ctx, () => {
+    var _a;
+    return (_a = state(ctx).aiApiObservabilityHandle) == null ? void 0 : _a.markFirstByte();
+  });
+}
+function addAiApiUsage(ctx, usage) {
+  if (!usage) return;
+  safely(ctx, () => {
+    const handle = state(ctx).aiApiObservabilityHandle;
+    if (usage.prompt_tokens !== null) handle == null ? void 0 : handle.addInputTokens(usage.prompt_tokens);
+    if (usage.completion_tokens !== null) handle == null ? void 0 : handle.addOutputTokens(usage.completion_tokens);
+  });
+}
+function setAiApiObservationOutcome(ctx, outcome) {
+  state(ctx).aiApiObservabilityOutcome = outcome;
+}
+function finishAiApiObservation(ctx, fallback) {
+  const current = state(ctx);
+  const handle = current.aiApiObservabilityHandle;
+  if (!handle) return;
+  current.aiApiObservabilityHandle = void 0;
+  const outcome = current.aiApiObservabilityOutcome ?? fallback;
+  current.aiApiObservabilityOutcome = void 0;
+  safely(ctx, () => handle.finish(outcome));
+}
+// Annotate the CommonJS export names for ESM import in node:
+0 && (module.exports = {
+  addAiApiUsage,
+  finishAiApiObservation,
+  markAiApiFirstProviderOutput,
+  setAiApiObservationOutcome,
+  startAiApiObservation
+});

package/dist/server/utils/streaming.js

@@ -26,18 +26,30 @@ var __copyProps = (to, from, except, desc) => {
 var __toCommonJS = (mod) => __copyProps(__defProp({}, "__esModule", { value: true }), mod);
 var streaming_exports = {};
 __export(streaming_exports, {
+  AiApiClientDisconnectedError: () => AiApiClientDisconnectedError,
   createRequestAbortController: () => createRequestAbortController,
+  isClientDisconnected: () => isClientDisconnected,
   isStreamingRequested: () => isStreamingRequested,
   writeResponse: () => writeResponse
 });
 module.exports = __toCommonJS(streaming_exports);
+class AiApiClientDisconnectedError extends Error {
+  code = "client_disconnected";
+  constructor() {
+    super("Client disconnected");
+    this.name = "AiApiClientDisconnectedError";
+  }
+}
+function isClientDisconnected(ctx, error) {
+  return ctx.req.aborted === true || error instanceof AiApiClientDisconnectedError;
+}
 function isStreamingRequested(value) {
   return value !== false;
 }
 function createRequestAbortController(ctx) {
   const controller = new AbortController();
   const abort = () => {
-    if (!ctx.res.writableEnded) controller.abort(new Error("Client disconnected"));
+    if (!ctx.res.writableEnded) controller.abort(new AiApiClientDisconnectedError());
   };
   ctx.req.once("aborted", abort);
   ctx.res.once("close", abort);
@@ -74,7 +86,9 @@ function waitForDrain(ctx) {
 }
 // Annotate the CommonJS export names for ESM import in node:
 0 && (module.exports = {
+  AiApiClientDisconnectedError,
   createRequestAbortController,
+  isClientDisconnected,
   isStreamingRequested,
   writeResponse
 });

package/dist/server/validation.js

@@ -36,6 +36,7 @@ var __toESM = (mod, isNodeMode, target) => (target = mod != null ? __create(__ge
 var __toCommonJS = (mod) => __copyProps(__defProp({}, "__esModule", { value: true }), mod);
 var validation_exports = {};
 __export(validation_exports, {
+  validateModelMetadata: () => validateModelMetadata,
   validateModelPrice: () => validateModelPrice,
   validateQuotaPolicy: () => validateQuotaPolicy
 });
@@ -77,6 +78,22 @@ async function validateModelPrice(db, model) {
   });
   if (overlap) throw new Error("An enabled price already overlaps this effective period.");
 }
+function requirePositiveIntegerOrNull(value, field) {
+  if (value === null || value === void 0 || value === "") return;
+  const parsed = Number(value);
+  if (!Number.isSafeInteger(parsed) || parsed <= 0) throw new Error(`${field} must be a positive integer.`);
+}
+function validateModelMetadata(model) {
+  if (!String(model.get("llmService") ?? "").trim()) throw new Error("llmService is required.");
+  if (!String(model.get("model") ?? "").trim()) throw new Error("model is required.");
+  requirePositiveIntegerOrNull(model.get("contextWindow"), "contextWindow");
+  requirePositiveIntegerOrNull(model.get("maxCompletionTokens"), "maxCompletionTokens");
+  const contextWindow = model.get("contextWindow");
+  const maxCompletionTokens = model.get("maxCompletionTokens");
+  if (contextWindow !== null && contextWindow !== void 0 && contextWindow !== "" && maxCompletionTokens !== null && maxCompletionTokens !== void 0 && maxCompletionTokens !== "" && Number(maxCompletionTokens) > Number(contextWindow)) {
+    throw new Error("maxCompletionTokens cannot exceed contextWindow.");
+  }
+}
 function validateQuotaPolicy(model) {
   if (!["daily", "monthly"].includes(String(model.get("periodType")))) {
     throw new Error("periodType must be daily or monthly.");
@@ -97,6 +114,7 @@ function validateQuotaPolicy(model) {
 }
 // Annotate the CommonJS export names for ESM import in node:
 0 && (module.exports = {
+  validateModelMetadata,
   validateModelPrice,
   validateQuotaPolicy
 });

package/dist/swagger.js

@@ -277,6 +277,13 @@ var swagger_default = {
           rateLimitPerMinute: {
             type: "integer",
             description: "Max requests per minute per user (0 = unlimited)"
+          },
+          maxRequestBodyMb: {
+            type: "integer",
+            minimum: 1,
+            maximum: 100,
+            default: 10,
+            description: "Max request body size in megabytes. Requests above this return 413. The gateway buffers each body in memory, so values above 100 are rejected."
           }
         }
       },
@@ -289,11 +296,35 @@ var swagger_default = {
           owned_by: { type: "string" }
         }
       },
+      ContentBlock: {
+        type: "object",
+        description: "A multimodal content block. Only text and image_url blocks are forwarded to the provider; any other type is rejected with 400 unsupported_content_block.",
+        properties: {
+          type: { type: "string", enum: ["text", "image_url"] },
+          text: { type: "string" },
+          image_url: {
+            type: "object",
+            properties: {
+              url: {
+                type: "string",
+                description: "An https URL or a base64 data URL, e.g. data:image/png;base64,iVBORw0KGgo...",
+                example: "data:image/png;base64,iVBORw0KGgo..."
+              },
+              detail: { type: "string", enum: ["auto", "low", "high"] }
+            },
+            required: ["url"]
+          }
+        },
+        required: ["type"]
+      },
       ChatMessage: {
         type: "object",
         properties: {
           role: { type: "string", enum: ["system", "user", "assistant", "tool"] },
-          content: { type: "string" },
+          content: {
+            description: 'Plain text, or an array of content blocks for multimodal requests. Inline base64 images inflate the payload by about 33%; see "Max request body size" in the gateway settings.',
+            oneOf: [{ type: "string" }, { type: "array", items: { $ref: "#/components/schemas/ContentBlock" } }]
+          },
           name: { type: "string" },
           tool_call_id: { type: "string" },
           tool_calls: { type: "array", items: { $ref: "#/components/schemas/ToolCall" } }

package/package.json

@@ -1,6 +1,6 @@
 {
   "name": "plugin-ai-api",
-  "version": "1.0.20",
+  "version": "1.0.21",
   "main": "dist/server/index.js",
   "dependencies": {},
   "peerDependencies": {

package/src/client/components/AiApiRolePermissions.tsx

@@ -1,169 +1,11 @@
-/**
- * This file is part of the NocoBase (R) project.
- * Copyright (c) 2020-2024 NocoBase Co., Ltd.
- * Authors: NocoBase Team.
- *
- * This project is dual-licensed under AGPL-3.0 and NocoBase Commercial License.
- * For more information, please refer to: https://www.nocobase.com/agreement.
- */
-
-import React, { useEffect, useState } from 'react';
-import { useApp } from '@nocobase/client-v2';
-import { Card, Switch, Select, Space, Typography, Spin, Divider } from 'antd';
-
-const { Text } = Typography;
-
-interface AiEmployee {
-  username: string;
-  nickname: string;
-}
-
-interface RolePermRecord {
-  id?: number;
-  roleName: string;
-  enabled: boolean;
-  allowAllEmployees: boolean;
-  allowedEmployees: string[];
-}
-
-/**
- * Permission tab shown in Settings → Users & Permissions → [Role] → "AI API" tab.
- * Lets admins control whether a role can use the AI API and which AI Employees it may access.
- */
-export function AiApiRolePermissions({ role }: { role: any }) {
-  const api = useApp().apiClient;
-  const [loading, setLoading] = useState(true);
-  const [saving, setSaving] = useState(false);
-  const [employees, setEmployees] = useState<AiEmployee[]>([]);
-  const [record, setRecord] = useState<RolePermRecord | null>(null);
-
-  const roleName = role?.name;
-
-  useEffect(() => {
-    if (!roleName) return;
-    loadData();
-    // eslint-disable-next-line react-hooks/exhaustive-deps
-  }, [roleName]);
-
-  const loadData = async () => {
-    setLoading(true);
-    try {
-      const [permRes, empRes] = await Promise.all([
-        api.request({
-          url: 'aiApiRolePermissions',
-          params: { filter: { roleName }, paginate: false },
-        }),
-        api.request({ url: 'aiEmployees:list', params: { paginate: false } }),
-      ]);
-
-      const existing = permRes?.data?.data?.[0];
-      setRecord(
-        existing
-          ? {
-              id: existing.id,
-              roleName: existing.roleName,
-              enabled: !!existing.enabled,
-              allowAllEmployees: existing.allowAllEmployees !== false,
-              allowedEmployees: existing.allowedEmployees || [],
-            }
-          : {
-              roleName,
-              enabled: false,
-              allowAllEmployees: true,
-              allowedEmployees: [],
-            },
-      );
-
-      setEmployees(
-        (empRes?.data?.data || []).map((e: any) => ({
-          username: e.username,
-          nickname: e.nickname || e.username,
-        })),
-      );
-    } catch (err) {
-      console.error('Failed to load AI API role permissions:', err);
-    } finally {
-      setLoading(false);
-    }
-  };
-
-  const save = async (patch: Partial<RolePermRecord>) => {
-    if (!record) return;
-    const next = { ...record, ...patch };
-    setRecord(next);
-    setSaving(true);
-    try {
-      if (next.id) {
-        await api.request({
-          url: `aiApiRolePermissions/${next.id}`,
-          method: 'PUT',
-          data: next,
-        });
-      } else {
-        const res = await api.request({
-          url: 'aiApiRolePermissions',
-          method: 'POST',
-          data: next,
-        });
-        const created = res?.data?.data;
-        if (created?.id) {
-          setRecord({ ...next, id: created.id });
-        }
-      }
-    } catch (err) {
-      console.error('Failed to save AI API role permissions:', err);
-      // Revert on error
-      setRecord(record);
-    } finally {
-      setSaving(false);
-    }
-  };
-
-  if (loading) return <Spin />;
-
-  return (
-    <Card bordered={false}>
-      <Space direction="vertical" style={{ width: '100%' }} size="middle">
-        <Space>
-          <Switch checked={!!record?.enabled} loading={saving} onChange={(checked) => save({ enabled: checked })} />
-          <Text strong>Allow this role to use the AI API</Text>
-        </Space>
-
-        {record?.enabled && (
-          <>
-            <Divider style={{ margin: '8px 0' }} />
-            <Space>
-              <Switch
-                checked={!!record?.allowAllEmployees}
-                loading={saving}
-                onChange={(checked) => save({ allowAllEmployees: checked })}
-              />
-              <Text>Allow all AI Employees</Text>
-            </Space>
-
-            {!record?.allowAllEmployees && (
-              <div>
-                <Text type="secondary" style={{ display: 'block', marginBottom: 8 }}>
-                  Select which AI Employees this role may use:
-                </Text>
-                <Select
-                  mode="multiple"
-                  allowClear
-                  style={{ width: '100%', maxWidth: 480 }}
-                  placeholder="Select allowed AI Employees"
-                  value={record?.allowedEmployees || []}
-                  options={employees.map((e) => ({
-                    label: `${e.nickname} (${e.username})`,
-                    value: e.username,
-                  }))}
-                  onChange={(vals) => save({ allowedEmployees: vals })}
-                  disabled={saving}
-                />
-              </div>
-            )}
-          </>
-        )}
-      </Space>
-    </Card>
-  );
-}
+/**
+ * This file is part of the NocoBase (R) project.
+ * Copyright (c) 2020-2024 NocoBase Co., Ltd.
+ * Authors: NocoBase Team.
+ *
+ * This project is dual-licensed under AGPL-3.0 and NocoBase Commercial License.
+ * For more information, please refer to: https://www.nocobase.com/agreement.
+ */
+
+// Implementation lives in client-v2; imports may only flow v1 -> v2, never back.
+export { AiApiRolePermissions } from '../../client-v2/components/AiApiRolePermissions';

package/src/client/locale.ts

@@ -1,21 +1,11 @@
-/**
- * This file is part of the NocoBase (R) project.
- * Copyright (c) 2020-2024 NocoBase Co., Ltd.
- * Authors: NocoBase Team.
- *
- * This project is dual-licensed under AGPL-3.0 and NocoBase Commercial License.
- * For more information, please refer to: https://www.nocobase.com/agreement.
- */
-
-import { tExpr as _tExpr, useFlowEngine } from '@nocobase/flow-engine';
-// @ts-ignore
-import pkg from './../../package.json';
-
-export function useT() {
-  const engine = useFlowEngine();
-  return (str: string) => engine.context.t(str, { ns: [pkg.name, 'client'] });
-}
-
-export function tExpr(key: string) {
-  return _tExpr(key, { ns: [pkg.name, 'client'] });
-}
+/**
+ * This file is part of the NocoBase (R) project.
+ * Copyright (c) 2020-2024 NocoBase Co., Ltd.
+ * Authors: NocoBase Team.
+ *
+ * This project is dual-licensed under AGPL-3.0 and NocoBase Commercial License.
+ * For more information, please refer to: https://www.nocobase.com/agreement.
+ */
+
+// Implementation lives in client-v2; imports may only flow v1 -> v2, never back.
+export { tExpr, useT } from '../client-v2/locale';

package/src/client/plugin.tsx

@@ -9,10 +9,12 @@
 
 import { Plugin, lazy } from '@nocobase/client';
 import PluginACLClient from '@nocobase/plugin-acl/client';
+import { AI_API_ACL_SNIPPET } from '../constants';
 import React from 'react';
 
 const AiApiConfigPage = React.lazy(() => import('../client-v2/pages/GeneralPage'));
 const AiApiModelPricingPage = React.lazy(() => import('../client-v2/pages/ModelPricingPage'));
+const AiApiModelMetadataPage = React.lazy(() => import('../client-v2/pages/ModelMetadataPage'));
 const AiApiUserQuotasPage = React.lazy(() => import('../client-v2/pages/UserQuotasPage'));
 const AiApiUsagePage = React.lazy(() => import('../client-v2/pages/UsagePage'));
 const { AiApiRolePermissions } = lazy(() => import('./components/AiApiRolePermissions'), 'AiApiRolePermissions');
@@ -22,35 +24,42 @@ export class PluginAiApiClient extends Plugin {
     this.app.pluginSettingsManager.add('ai-api', {
       icon: 'ApiOutlined',
       title: this.t('AI API Gateway'),
-      aclSnippet: 'pm.ai-api.configuration',
+      aclSnippet: AI_API_ACL_SNIPPET,
     });
 
     this.app.pluginSettingsManager.add('ai-api.config', {
       title: this.t('Configuration'),
       Component: AiApiConfigPage,
-      aclSnippet: 'pm.ai-api.configuration',
+      aclSnippet: AI_API_ACL_SNIPPET,
       sort: 1,
     });
 
     this.app.pluginSettingsManager.add('ai-api.model-pricing', {
       title: this.t('Model pricing'),
       Component: AiApiModelPricingPage,
-      aclSnippet: 'pm.ai-api.configuration',
+      aclSnippet: AI_API_ACL_SNIPPET,
       sort: 2,
     });
 
+    this.app.pluginSettingsManager.add('ai-api.model-metadata', {
+      title: this.t('Model metadata'),
+      Component: AiApiModelMetadataPage,
+      aclSnippet: AI_API_ACL_SNIPPET,
+      sort: 3,
+    });
+
     this.app.pluginSettingsManager.add('ai-api.user-quotas', {
       title: this.t('User quotas'),
       Component: AiApiUserQuotasPage,
-      aclSnippet: 'pm.ai-api.configuration',
-      sort: 3,
+      aclSnippet: AI_API_ACL_SNIPPET,
+      sort: 4,
     });
 
     this.app.pluginSettingsManager.add('ai-api.usage', {
       title: this.t('Usage'),
       Component: AiApiUsagePage,
-      aclSnippet: 'pm.ai-api.configuration',
-      sort: 4,
+      aclSnippet: AI_API_ACL_SNIPPET,
+      sort: 5,
     });
 
     // Add "AI API" tab in Settings → Users & Permissions → [Role]
@@ -58,7 +67,7 @@ export class PluginAiApiClient extends Plugin {
     if (aclPlugin?.settingsUI) {
       aclPlugin.settingsUI.addPermissionsTab(({ t, TabLayout, activeRole }) => ({
         key: 'aiApi',
-        label: 'AI API',
+        label: t('AI API', { ns: ['plugin-ai-api', 'client'] }),
         sort: 25,
         children: (
           <TabLayout>

package/src/client-v2/__tests__/settings-registration.test.tsx

@@ -0,0 +1,58 @@
+/**
+ * This file is part of the NocoBase (R) project.
+ * Copyright (c) 2020-2024 NocoBase Co., Ltd.
+ * Authors: NocoBase Team.
+ *
+ * This project is dual-licensed under AGPL-3.0 and NocoBase Commercial License.
+ * For more information, please refer to: https://www.nocobase.com/agreement.
+ */
+
+import { createMockClient } from '@nocobase/client-v2';
+import { AI_API_ACL_SNIPPET } from '../../constants';
+import { PluginAiApiClient } from '../plugin';
+
+/**
+ * Guards the settings registration itself rather than any page's contents.
+ *
+ * Two regressions are cheap to reintroduce and invisible until a non-admin logs in:
+ * omitting `aclSnippet` makes addPageTabItem default to `pm.ai-api.<key>`, a snippet the
+ * server never registers, and omitting `sort` silently reorders the tabs alphabetically.
+ */
+describe('AI API v2 settings registration', () => {
+  async function loadPlugin() {
+    const app = createMockClient();
+    await new PluginAiApiClient({}, app).load();
+    return app;
+  }
+
+  it('registers every page under the one snippet the server exposes', async () => {
+    const app = await loadPlugin();
+    const menu = app.pluginSettingsManager.get('ai-api', false);
+
+    expect(menu?.aclSnippet).toBe(AI_API_ACL_SNIPPET);
+    for (const child of menu?.children ?? []) {
+      expect(app.pluginSettingsManager.getAclSnippet(child.name), child.name).toBe(AI_API_ACL_SNIPPET);
+    }
+  });
+
+  it('hides the menu and every tab when the role denies that snippet', async () => {
+    const app = await loadPlugin();
+    app.pluginSettingsManager.setAclSnippets([`!${AI_API_ACL_SNIPPET}`]);
+
+    expect(app.pluginSettingsManager.get('ai-api')).toBeNull();
+    expect(app.pluginSettingsManager.getList().map((item) => item.name)).not.toContain('ai-api');
+  });
+
+  it('keeps registration order instead of sorting tabs by name', async () => {
+    const app = await loadPlugin();
+    app.pluginSettingsManager.setAclSnippets([]);
+
+    expect(app.pluginSettingsManager.get('ai-api')?.children?.map((item) => item.name)).toEqual([
+      'ai-api.index',
+      'ai-api.model-pricing',
+      'ai-api.model-metadata',
+      'ai-api.user-quotas',
+      'ai-api.usage',
+    ]);
+  });
+});