plugin-ai-api 1.0.20 → 1.0.23

package/src/server/__tests__/user-permissions.test.ts

@@ -0,0 +1,284 @@
+/**
+ * This file is part of the NocoBase (R) project.
+ * Copyright (c) 2020-2024 NocoBase Co., Ltd.
+ * Authors: NocoBase Team.
+ *
+ * This project is dual-licensed under AGPL-3.0 and NocoBase Commercial License.
+ * For more information, please refer to: https://www.nocobase.com/agreement.
+ */
+
+import { Context } from '@nocobase/actions';
+import { beforeEach, describe, expect, it, vi } from 'vitest';
+import {
+  buildAccessScope,
+  enforceModelAccess,
+  invalidateUserPermissionCache,
+  isModelAllowed,
+  isServiceAllowed,
+  resolveUserAccessScope,
+} from '../utils/user-permissions';
+
+const OPENAI = { name: 'openai', title: 'OpenAI' };
+const ANTHROPIC = { name: 'anthropic', title: 'Anthropic' };
+
+/** Sequelize instances only expose columns via .get(); rows must be shaped that way. */
+function row(values: Record<string, unknown>) {
+  return { get: (key: string) => values[key] };
+}
+
+function mockContext(options: { userId?: number | null; row?: unknown; throws?: boolean; appName?: string } = {}) {
+  const findOne = vi.fn(async () => {
+    if (options.throws) throw new Error('collection unavailable');
+    return options.row ?? null;
+  });
+  const ctx = {
+    state: { currentUser: options.userId === null ? undefined : { id: options.userId ?? 1 } },
+    db: { getRepository: () => ({ findOne }) },
+    app: { name: options.appName ?? 'main' },
+    log: { warn: vi.fn(), error: vi.fn() },
+    status: 200,
+    body: undefined,
+  } as unknown as Context;
+  return { ctx, findOne };
+}
+
+beforeEach(() => {
+  invalidateUserPermissionCache();
+});
+
+describe('buildAccessScope', () => {
+  it('treats a missing row as "no user-level narrowing"', () => {
+    const scope = buildAccessScope(null);
+    expect(scope.hasUserRecord).toBe(false);
+    expect(scope.denyAll).toBe(false);
+    expect(scope.allowedServices).toBeNull();
+  });
+
+  it('marks a disabled row as deny-all', () => {
+    const scope = buildAccessScope(row({ enabled: false, allowedLlmServices: ['openai'] }));
+    expect(scope.denyAll).toBe(true);
+    expect(scope.allowedServices).toEqual([]);
+  });
+
+  it('reads columns through .get() rather than plain property access', () => {
+    const scope = buildAccessScope(
+      row({ allowedLlmServices: ['openai'], allowAllModels: false, allowedModels: ['openai/gpt-4o'] }),
+    );
+    expect(scope.allowedServices).toEqual(['openai']);
+    expect(scope.allowAllModels).toBe(false);
+    expect(scope.allowedModels.has('openai/gpt-4o')).toBe(true);
+  });
+
+  it('defaults allowAllModels to true when the column is unset', () => {
+    expect(buildAccessScope(row({ allowedLlmServices: [] })).allowAllModels).toBe(true);
+  });
+
+  it('discards non-string entries in the json arrays', () => {
+    const scope = buildAccessScope(
+      row({ allowedLlmServices: ['openai', null, 42, ''], allowedModels: [{}, 'openai/gpt-4o'] }),
+    );
+    expect(scope.allowedServices).toEqual(['openai']);
+    expect([...scope.allowedModels]).toEqual(['openai/gpt-4o']);
+  });
+});
+
+describe('isServiceAllowed', () => {
+  const noRecord = buildAccessScope(null);
+
+  it('leaves behaviour unchanged for a user with no record', () => {
+    expect(isServiceAllowed(noRecord, ['openai'], OPENAI)).toBe(true);
+    expect(isServiceAllowed(noRecord, ['openai'], ANTHROPIC)).toBe(false);
+    expect(isServiceAllowed(noRecord, [], ANTHROPIC)).toBe(true);
+  });
+
+  it('denies everything when the record is disabled', () => {
+    const scope = buildAccessScope(row({ enabled: false, allowedLlmServices: ['openai'] }));
+    expect(isServiceAllowed(scope, ['openai'], OPENAI)).toBe(false);
+  });
+
+  it('denies everything when the service list is empty', () => {
+    const scope = buildAccessScope(row({ allowedLlmServices: [] }));
+    expect(isServiceAllowed(scope, ['openai'], OPENAI)).toBe(false);
+    expect(isServiceAllowed(scope, [], OPENAI)).toBe(false);
+  });
+
+  it('never widens the global whitelist (strict subset)', () => {
+    const scope = buildAccessScope(row({ allowedLlmServices: ['openai', 'anthropic'] }));
+    expect(isServiceAllowed(scope, ['openai'], OPENAI)).toBe(true);
+    // Granted to the user, but absent from the global whitelist → still denied.
+    expect(isServiceAllowed(scope, ['openai'], ANTHROPIC)).toBe(false);
+  });
+
+  it('matches a service by title as well as by name', () => {
+    const byTitle = buildAccessScope(row({ allowedLlmServices: ['OpenAI'] }));
+    expect(isServiceAllowed(byTitle, ['OpenAI'], OPENAI)).toBe(true);
+    expect(isServiceAllowed(byTitle, [], OPENAI)).toBe(true);
+    expect(isServiceAllowed(byTitle, [], ANTHROPIC)).toBe(false);
+  });
+
+  it('narrows within an empty global whitelist', () => {
+    const scope = buildAccessScope(row({ allowedLlmServices: ['openai'] }));
+    expect(isServiceAllowed(scope, [], OPENAI)).toBe(true);
+    expect(isServiceAllowed(scope, [], ANTHROPIC)).toBe(false);
+  });
+
+  it('tolerates a null or malformed global whitelist', () => {
+    expect(isServiceAllowed(noRecord, null, OPENAI)).toBe(true);
+    expect(isServiceAllowed(noRecord, 'openai', OPENAI)).toBe(true);
+  });
+});
+
+describe('isModelAllowed', () => {
+  it('allows every model when the user has no record', () => {
+    expect(isModelAllowed(buildAccessScope(null), 'openai/gpt-4o')).toBe(true);
+  });
+
+  it('allows every model of the granted services when allowAllModels is true', () => {
+    const scope = buildAccessScope(row({ allowedLlmServices: ['openai'], allowAllModels: true }));
+    expect(isModelAllowed(scope, 'openai/anything')).toBe(true);
+  });
+
+  it('restricts to the listed models when allowAllModels is false', () => {
+    const scope = buildAccessScope(
+      row({ allowedLlmServices: ['openai'], allowAllModels: false, allowedModels: ['openai/gpt-4o'] }),
+    );
+    expect(isModelAllowed(scope, 'openai/gpt-4o')).toBe(true);
+    expect(isModelAllowed(scope, 'openai/gpt-4o-mini')).toBe(false);
+  });
+
+  it('denies every model when the record is disabled', () => {
+    const scope = buildAccessScope(row({ enabled: false, allowAllModels: true }));
+    expect(isModelAllowed(scope, 'openai/gpt-4o')).toBe(false);
+  });
+});
+
+describe('resolveUserAccessScope', () => {
+  it('returns the no-record scope for an unauthenticated context', async () => {
+    const { ctx, findOne } = mockContext({ userId: null });
+    expect((await resolveUserAccessScope(ctx)).hasUserRecord).toBe(false);
+    expect(findOne).not.toHaveBeenCalled();
+  });
+
+  it('caches the scope per user instead of querying on every request', async () => {
+    const { ctx, findOne } = mockContext({ row: row({ allowedLlmServices: ['openai'] }) });
+    await resolveUserAccessScope(ctx);
+    await resolveUserAccessScope(ctx);
+    expect(findOne).toHaveBeenCalledTimes(1);
+  });
+
+  it('re-queries after the cache is invalidated for that user', async () => {
+    const { ctx, findOne } = mockContext({ userId: 7, row: row({ allowedLlmServices: ['openai'] }) });
+    await resolveUserAccessScope(ctx);
+    invalidateUserPermissionCache(7);
+    await resolveUserAccessScope(ctx);
+    expect(findOne).toHaveBeenCalledTimes(2);
+  });
+
+  it('keeps other users cached when one user is invalidated', async () => {
+    const first = mockContext({ userId: 1, row: row({ allowedLlmServices: ['openai'] }) });
+    const second = mockContext({ userId: 2, row: row({ allowedLlmServices: ['openai'] }) });
+    await resolveUserAccessScope(first.ctx);
+    await resolveUserAccessScope(second.ctx);
+    invalidateUserPermissionCache(2);
+    await resolveUserAccessScope(first.ctx);
+    expect(first.findOne).toHaveBeenCalledTimes(1);
+  });
+
+  it('fails closed when the collection is unavailable', async () => {
+    const { ctx } = mockContext({ throws: true });
+    const scope = await resolveUserAccessScope(ctx);
+    // Treating a failed lookup as "no record" would silently lift every user's restrictions
+    // during a rolling upgrade where the table does not exist yet.
+    expect(scope.lookupFailed).toBe(true);
+    expect(scope.denyAll).toBe(true);
+    expect(ctx.log.error).toHaveBeenCalled();
+  });
+
+  it('denies every service and model when the lookup failed', async () => {
+    const { ctx } = mockContext({ throws: true });
+    const scope = await resolveUserAccessScope(ctx);
+    expect(isServiceAllowed(scope, [], OPENAI)).toBe(false);
+    expect(isModelAllowed(scope, 'openai/gpt-4o')).toBe(false);
+  });
+
+  it('does not cache a failed lookup', async () => {
+    const { ctx, findOne } = mockContext({ throws: true });
+    await resolveUserAccessScope(ctx);
+    await resolveUserAccessScope(ctx);
+    expect(findOne).toHaveBeenCalledTimes(2);
+  });
+
+  it('does not share a cache entry between apps with the same user id', async () => {
+    const main = mockContext({ userId: 1, appName: 'main', row: row({ allowedLlmServices: ['openai'] }) });
+    const sub = mockContext({ userId: 1, appName: 'sub', row: row({ allowedLlmServices: ['anthropic'] }) });
+    await resolveUserAccessScope(main.ctx);
+    const subScope = await resolveUserAccessScope(sub.ctx);
+    // Sub-apps share this process but have separate databases, so user 1 in "sub" is a
+    // different person than user 1 in "main" and must not inherit their grant.
+    expect(sub.findOne).toHaveBeenCalledTimes(1);
+    expect(subScope.allowedServices).toEqual(['anthropic']);
+  });
+
+  it('invalidates a user across every app', async () => {
+    const main = mockContext({ userId: 1, appName: 'main', row: row({ allowedLlmServices: ['openai'] }) });
+    const sub = mockContext({ userId: 1, appName: 'sub', row: row({ allowedLlmServices: ['openai'] }) });
+    await resolveUserAccessScope(main.ctx);
+    await resolveUserAccessScope(sub.ctx);
+    invalidateUserPermissionCache(1);
+    await resolveUserAccessScope(main.ctx);
+    await resolveUserAccessScope(sub.ctx);
+    expect(main.findOne).toHaveBeenCalledTimes(2);
+    expect(sub.findOne).toHaveBeenCalledTimes(2);
+  });
+
+  it('does not invalidate a user whose id is a suffix of another', async () => {
+    const first = mockContext({ userId: 1, row: row({ allowedLlmServices: ['openai'] }) });
+    const second = mockContext({ userId: 21, row: row({ allowedLlmServices: ['openai'] }) });
+    await resolveUserAccessScope(first.ctx);
+    await resolveUserAccessScope(second.ctx);
+    invalidateUserPermissionCache(1);
+    await resolveUserAccessScope(second.ctx);
+    expect(second.findOne).toHaveBeenCalledTimes(1);
+  });
+});
+
+describe('enforceModelAccess', () => {
+  it('passes a permitted service and model through untouched', async () => {
+    const { ctx } = mockContext({ row: row({ allowedLlmServices: ['openai'] }) });
+    expect(await enforceModelAccess(ctx, ['openai'], OPENAI, 'gpt-4o')).toBe(true);
+    expect(ctx.status).toBe(200);
+  });
+
+  it('returns 403 model_not_available for a denied service', async () => {
+    const { ctx } = mockContext({ row: row({ allowedLlmServices: ['openai'] }) });
+    expect(await enforceModelAccess(ctx, ['openai', 'anthropic'], ANTHROPIC, 'claude')).toBe(false);
+    expect(ctx.status).toBe(403);
+    // `permission_denied` is what every other 403 in this plugin reports; keeping the type
+    // consistent means OpenAI clients can branch on it uniformly.
+    expect(ctx.body).toMatchObject({ error: { code: 'model_not_available', type: 'permission_denied' } });
+  });
+
+  it('returns 403 model_not_available for a denied model of a granted service', async () => {
+    const { ctx } = mockContext({
+      row: row({ allowedLlmServices: ['openai'], allowAllModels: false, allowedModels: ['openai/gpt-4o'] }),
+    });
+    expect(await enforceModelAccess(ctx, ['openai'], OPENAI, 'gpt-4o-mini')).toBe(false);
+    expect(ctx.status).toBe(403);
+    expect(ctx.body).toMatchObject({ error: { code: 'model_not_available', type: 'permission_denied' } });
+  });
+
+  it('denies a user-granted service that the global whitelist excludes', async () => {
+    const { ctx } = mockContext({ row: row({ allowedLlmServices: ['anthropic'] }) });
+    expect(await enforceModelAccess(ctx, ['openai'], ANTHROPIC, 'claude')).toBe(false);
+    expect(ctx.status).toBe(403);
+  });
+
+  it('returns a retryable 503 rather than allowing access when the lookup fails', async () => {
+    const { ctx } = mockContext({ throws: true });
+    expect(await enforceModelAccess(ctx, [], OPENAI, 'gpt-4o')).toBe(false);
+    // 503 not 403: the failure is ours, so clients should back off rather than treat the
+    // grant as permanently revoked.
+    expect(ctx.status).toBe(503);
+    expect(ctx.body).toMatchObject({ error: { code: 'permission_check_failed' } });
+  });
+});

package/src/server/collections/ai-api-config.ts

@@ -41,6 +41,12 @@ export default defineCollection({
       defaultValue: 60,
       comment: 'Max requests per user per minute',
     },
+    {
+      name: 'maxRequestBodyMb',
+      type: 'integer',
+      defaultValue: 10,
+      comment: 'Max request body size in MB. Raise this to accept inline base64 images in vision requests.',
+    },
     {
       name: 'quotaEnabled',
       type: 'boolean',

package/src/server/collections/ai-api-model-metadata.ts

@@ -0,0 +1,72 @@
+/**
+ * This file is part of the NocoBase (R) project.
+ * Copyright (c) 2020-2024 NocoBase Co., Ltd.
+ * Authors: NocoBase Team.
+ *
+ * This project is dual-licensed under AGPL-3.0 and NocoBase Commercial License.
+ * For more information, please refer to: https://www.nocobase.com/agreement.
+ */
+
+import { defineCollection } from '@nocobase/database';
+
+/**
+ * Per-model metadata overrides surfaced through the OpenAI-compatible GET /v1/models
+ * endpoint. Lets an admin correct or supply values that the upstream provider either
+ * reports incorrectly (e.g. an inflated context window) or omits entirely.
+ *
+ * A row is keyed by (llmService, model). All override fields are nullable — a null
+ * value means "do not override this attribute", so an admin can override just the
+ * context window without touching anything else.
+ */
+export default defineCollection({
+  name: 'aiApiModelMetadata',
+  autoGenId: true,
+  fields: [
+    { name: 'llmService', type: 'string', allowNull: false, index: true },
+    { name: 'model', type: 'string', allowNull: false, index: true },
+    {
+      name: 'contextWindow',
+      type: 'integer',
+      allowNull: true,
+      comment:
+        'Override for the model context window (input+output token capacity). Returned as context_window / context_length.',
+    },
+    {
+      name: 'maxCompletionTokens',
+      type: 'integer',
+      allowNull: true,
+      comment: 'Override for the maximum output tokens. Returned as max_completion_tokens.',
+    },
+    {
+      name: 'ownedByOverride',
+      type: 'string',
+      allowNull: true,
+      comment: 'Override for the owned_by field in the OpenAI model object.',
+    },
+    {
+      name: 'displayName',
+      type: 'string',
+      allowNull: true,
+      comment: 'Friendly display name returned as display_name / name in the model object.',
+    },
+    {
+      name: 'description',
+      type: 'text',
+      allowNull: true,
+      comment: 'Human-readable description returned as description in the model object.',
+    },
+    {
+      name: 'enabled',
+      type: 'boolean',
+      defaultValue: true,
+      index: true,
+      comment: 'When false, the model is hidden from /v1/models and reported as active:false.',
+    },
+  ],
+  indexes: [
+    {
+      fields: ['llmService', 'model'],
+      unique: true,
+    },
+  ],
+});

package/src/server/collections/ai-api-user-permissions.ts

@@ -0,0 +1,46 @@
+/**
+ * This file is part of the NocoBase (R) project.
+ * Copyright (c) 2020-2024 NocoBase Co., Ltd.
+ * Authors: NocoBase Team.
+ *
+ * This project is dual-licensed under AGPL-3.0 and NocoBase Commercial License.
+ * For more information, please refer to: https://www.nocobase.com/agreement.
+ */
+
+import { defineCollection } from '@nocobase/database';
+
+export default defineCollection({
+  name: 'aiApiUserPermissions',
+  autoGenId: true,
+  fields: [
+    { name: 'userId', type: 'bigInt', allowNull: false, index: true },
+    {
+      name: 'user',
+      type: 'belongsTo',
+      target: 'users',
+      targetKey: 'id',
+      foreignKey: 'userId',
+      constraints: false,
+    },
+    { name: 'enabled', type: 'boolean', defaultValue: true, index: true },
+    {
+      name: 'allowedLlmServices',
+      type: 'json',
+      defaultValue: [],
+      comment: 'LLM service names/titles this user may use. Empty means the user is denied every service.',
+    },
+    { name: 'allowAllModels', type: 'boolean', defaultValue: true },
+    {
+      name: 'allowedModels',
+      type: 'json',
+      defaultValue: [],
+      comment: 'Array of "serviceName/modelId" this user may use (when allowAllModels=false)',
+    },
+  ],
+  indexes: [
+    {
+      fields: ['userId'],
+      unique: true,
+    },
+  ],
+});

package/src/server/plugin.ts

@@ -8,12 +8,16 @@
  */
 
 import { Plugin } from '@nocobase/server';
-import { createAiLlmRouter } from './routes/router';
+import type { Transactionable } from '@nocobase/database';
+import { createAiLlmRouter, AI_LLM_PREFIX } from './routes/router';
 import aiApiConfigResource from './resource/ai-api-config';
 import aiApiUsageMonitorResource from './resource/ai-api-usage-monitor';
+import aiApiUserPermissionsResource from './resource/ai-api-user-permissions';
 import { RateLimiter } from './utils/rate-limiter';
 import { invalidateRolePermissionCache } from './middleware/role-permission';
-import { validateModelPrice, validateQuotaPolicy } from './validation';
+import { invalidateUserPermissionCache } from './utils/user-permissions';
+import { validateModelPrice, validateModelMetadata, validateQuotaPolicy } from './validation';
+import { AI_API_ACL_SNIPPET, AI_API_USER_PERMISSIONS_SNIPPET } from '../constants';
 
 // Ensure dayjs timezone + utc plugins are loaded.
 // Some Docker builds ship an older @nocobase/utils whose dayjs.js does not
@@ -43,13 +47,31 @@ export class PluginAiApiServer extends Plugin {
     this.app.db.on('aiApiModelPrices.beforeSave', async (model) => {
       await validateModelPrice(this.db, model);
     });
+    this.app.db.on('aiApiModelMetadata.beforeSave', (model) => {
+      validateModelMetadata(model);
+    });
     this.app.db.on('aiApiUserQuotaPolicies.beforeSave', (model) => {
       validateQuotaPolicy(model);
     });
   }
 
   async load() {
-    // 1. Register raw Koa middleware for OpenAI-compatible endpoints
+    // 1. Claim body parsing for our own routes before the core bodyParser runs.
+    //    Core registers koa-bodyparser with a global REQUEST_BODY_LIMIT (10mb by
+    //    default) much earlier in the stack, so without this the gateway's own
+    //    configurable limit is unreachable: an oversized vision request would be
+    //    rejected by core with a non-OpenAI error shape. `disableBodyParser` makes
+    //    koa-bodyparser skip the request, leaving ctx.request.body undefined so
+    //    createAiLlmRouter reads and caps the raw stream itself.
+    this.app.use(
+      async (ctx, next) => {
+        if (ctx.path.startsWith(AI_LLM_PREFIX)) ctx.disableBodyParser = true;
+        await next();
+      },
+      { tag: 'aiApiDisableBodyParser', before: 'bodyParser' },
+    );
+
+    // 2. Register raw Koa middleware for OpenAI-compatible endpoints
     //    Must run before 'resourcer' so URL paths match OpenAI convention
     // OIDC access tokens must first pass through plugin-idp-oauth, which validates
     // issuer/audience/scope and rewrites them to a NocoBase internal token.
@@ -58,6 +80,7 @@ export class PluginAiApiServer extends Plugin {
     // 2. Register admin config resource
     this.app.resourceManager.define(aiApiConfigResource);
     this.app.resourceManager.define(aiApiUsageMonitorResource);
+    this.app.resourceManager.define(aiApiUserPermissionsResource);
 
     this.app.db.on('aiApiRolePermissions.afterSave', (model) => {
       invalidateRolePermissionCache(model.get('roleName'));
@@ -66,13 +89,21 @@ export class PluginAiApiServer extends Plugin {
       invalidateRolePermissionCache(model.get('roleName'));
     });
 
+    this.app.db.on('aiApiUserPermissions.afterSave', (model, options) => {
+      this.revokeUserPermissions(model.get('userId'), options?.transaction);
+    });
+    this.app.db.on('aiApiUserPermissions.afterDestroy', (model, options) => {
+      this.revokeUserPermissions(model.get('userId'), options?.transaction);
+    });
+
     // 3. Set ACL permissions for admin config + role permissions management
     this.app.acl.registerSnippet({
-      name: `pm.${this.name}.configuration`,
+      name: AI_API_ACL_SNIPPET,
       actions: [
         'aiApiConfig:*',
         'aiApiRolePermissions:*',
         'aiApiModelPrices:*',
+        'aiApiModelMetadata:*',
         'aiApiUserQuotaPolicies:*',
         'aiApiUserQuotaBuckets:list',
         'aiApiUserQuotaBuckets:get',
@@ -82,12 +113,42 @@ export class PluginAiApiServer extends Plugin {
       ],
     });
 
+    // Per-user LLM grants are a separate child permission: handing out model access is a
+    // stronger capability than editing gateway settings, so it ticks independently.
+    // The wildcard also covers `listUsers`, which backs the page's user picker — without it
+    // the page would depend on `pm.plugin-users` and break for a role holding only this snippet.
+    this.app.acl.registerSnippet({
+      name: AI_API_USER_PERMISSIONS_SNIPPET,
+      actions: ['aiApiUserPermissions:*'],
+    });
+
     // 4. GC the rate limiter every 5 minutes to evict stale user entries.
     //    .unref() prevents this timer from keeping the process alive on shutdown.
     this.gcInterval = setInterval(() => this.rateLimiter.gc(), 5 * 60 * 1000);
     this.gcInterval.unref();
   }
 
+  /**
+   * Drop a user's cached LLM scope on every node.
+   *
+   * The local call is not redundant: syncMessageManager hardcodes skipSelf, so the publishing
+   * node never receives its own message. Passing the transaction defers the broadcast until
+   * the write commits, so other nodes cannot re-read the old row and re-cache it.
+   */
+  private revokeUserPermissions(userId: unknown, transaction?: Transactionable['transaction']) {
+    invalidateUserPermissionCache(userId as string | number | bigint);
+    this.sendSyncMessage({ type: 'invalidateUserPermissions', userId }, { transaction });
+  }
+
+  /**
+   * Received only on the *other* nodes (skipSelf), so this must not re-broadcast.
+   */
+  async handleSyncMessage(message: { type?: string; userId?: unknown }) {
+    if (message?.type === 'invalidateUserPermissions') {
+      invalidateUserPermissionCache(message.userId as string | number | bigint);
+    }
+  }
+
   async install() {
     // Create default config record on first install
     const existing = await this.db.getRepository('aiApiConfig').findOne();

package/src/server/resource/ai-api-config.ts

@@ -8,6 +8,24 @@
  */
 
 import { ResourceOptions } from '@nocobase/resourcer';
+import { MAX_REQUEST_BODY_MB_LIMIT } from '../routes/router';
+
+const DEFAULT_MAX_REQUEST_BODY_MB = 10;
+
+/**
+ * The gateway buffers each request body in memory, so an out-of-range value
+ * here is a denial-of-service footgun rather than a harmless setting.
+ */
+function coerceMaxRequestBodyMb(value: unknown): number {
+  const mb = Number(value);
+  if (!Number.isSafeInteger(mb) || mb <= 0) {
+    throw new Error(`maxRequestBodyMb must be a positive integer (1-${MAX_REQUEST_BODY_MB_LIMIT}).`);
+  }
+  if (mb > MAX_REQUEST_BODY_MB_LIMIT) {
+    throw new Error(`maxRequestBodyMb cannot exceed ${MAX_REQUEST_BODY_MB_LIMIT}.`);
+  }
+  return mb;
+}
 
 /**
  * Resource for managing AI API configuration via NocoBase admin UI.
@@ -29,6 +47,7 @@ const aiApiConfigResource: ResourceOptions = {
             defaultLlmService: '',
             enabledLlmServices: [],
             rateLimitPerMinute: 60,
+            maxRequestBodyMb: 10,
             quotaEnabled: false,
             defaultReservationOutputTokens: 4096,
             options: {},
@@ -52,6 +71,7 @@ const aiApiConfigResource: ResourceOptions = {
             defaultLlmService: values.defaultLlmService ?? '',
             enabledLlmServices: values.enabledLlmServices ?? [],
             rateLimitPerMinute: values.rateLimitPerMinute ?? 60,
+            maxRequestBodyMb: coerceMaxRequestBodyMb(values.maxRequestBodyMb ?? DEFAULT_MAX_REQUEST_BODY_MB),
             quotaEnabled: values.quotaEnabled ?? false,
             defaultReservationOutputTokens: values.defaultReservationOutputTokens ?? 4096,
             options: values.options ?? {},
@@ -64,6 +84,9 @@ const aiApiConfigResource: ResourceOptions = {
         if (values.defaultLlmService !== undefined) updateData.defaultLlmService = values.defaultLlmService;
         if (values.enabledLlmServices !== undefined) updateData.enabledLlmServices = values.enabledLlmServices;
         if (values.rateLimitPerMinute !== undefined) updateData.rateLimitPerMinute = values.rateLimitPerMinute;
+        if (values.maxRequestBodyMb !== undefined) {
+          updateData.maxRequestBodyMb = coerceMaxRequestBodyMb(values.maxRequestBodyMb);
+        }
         if (values.quotaEnabled !== undefined) updateData.quotaEnabled = values.quotaEnabled;
         if (values.defaultReservationOutputTokens !== undefined) {
           updateData.defaultReservationOutputTokens = values.defaultReservationOutputTokens;

package/src/server/resource/ai-api-user-permissions.ts

@@ -0,0 +1,76 @@
+/**
+ * This file is part of the NocoBase (R) project.
+ * Copyright (c) 2020-2024 NocoBase Co., Ltd.
+ * Authors: NocoBase Team.
+ *
+ * This project is dual-licensed under AGPL-3.0 and NocoBase Commercial License.
+ * For more information, please refer to: https://www.nocobase.com/agreement.
+ */
+
+import type { ResourceOptions } from '@nocobase/resourcer';
+
+const MAX_PAGE_SIZE = 100;
+
+/**
+ * Minimal user directory for the permission page's user picker.
+ *
+ * The page is gated by AI_API_USER_PERMISSIONS_SNIPPET, but `users:list` belongs to
+ * `pm.plugin-users`. Calling it would force every permission admin to also be a user admin,
+ * so this action exposes only the identity fields the picker renders — never password hashes,
+ * roles or any other user column.
+ */
+const aiApiUserPermissionsResource: ResourceOptions = {
+  name: 'aiApiUserPermissions',
+  actions: {
+    async listUsers(ctx, next) {
+      const params = ctx.action.params || {};
+      const keyword = typeof params.keyword === 'string' ? params.keyword.trim() : '';
+      const page = Math.max(1, Number(params.page) || 1);
+      const pageSize = Math.min(MAX_PAGE_SIZE, Math.max(1, Number(params.pageSize) || 50));
+
+      const filter: Record<string, unknown> = keyword
+        ? {
+            $or: [
+              { nickname: { $includes: keyword } },
+              { username: { $includes: keyword } },
+              { email: { $includes: keyword } },
+            ],
+          }
+        : {};
+
+      // A user already holding a grant is excluded so the picker cannot produce a duplicate
+      // that the unique index on userId would reject at save time.
+      if (params.excludeGranted) {
+        const granted = await ctx.db.getRepository('aiApiUserPermissions').find({ fields: ['userId'] });
+        const ids = granted.map((row) => row.get('userId')).filter((id) => id !== null && id !== undefined);
+        if (ids.length) filter.id = { $notIn: ids };
+      }
+
+      const [rows, count] = await ctx.db.getRepository('users').findAndCount({
+        filter,
+        fields: ['id', 'nickname', 'username', 'email'],
+        sort: ['nickname', 'id'],
+        offset: (page - 1) * pageSize,
+        limit: pageSize,
+      });
+
+      // Use the canonical { rows, ...meta } action shape. NocoBase's dataWrapping
+      // middleware turns this into { data, meta } on the wire; returning that wire
+      // shape here would make it wrap a second time.
+      ctx.body = {
+        rows: rows.map((row) => ({
+          id: row.get('id'),
+          nickname: row.get('nickname'),
+          username: row.get('username'),
+          email: row.get('email'),
+        })),
+        count,
+        page,
+        pageSize,
+      };
+      await next();
+    },
+  },
+};
+
+export default aiApiUserPermissionsResource;