plugin-ai-api 1.0.20 → 1.0.23

package/src/server/__tests__/app-observability.test.ts

@@ -0,0 +1,98 @@
+import type { Context } from '@nocobase/actions';
+import {
+  addAiApiUsage,
+  finishAiApiObservation,
+  markAiApiFirstProviderOutput,
+  startAiApiObservation,
+} from '../utils/app-observability';
+
+const CONTRACT_SYMBOL = Symbol.for('nocobase.app-observability.contract');
+
+function createContext(contract?: object): Context {
+  const app = {
+    logger: { warn: vi.fn() },
+    ...(contract ? { [CONTRACT_SYMBOL]: contract } : {}),
+  };
+  return { app, state: {} } as unknown as Context;
+}
+
+describe('AI API app observability bridge', () => {
+  it('is a no-op when observability is absent', () => {
+    const ctx = createContext();
+    expect(() => {
+      startAiApiObservation(ctx, {
+        service: 'llm.chat',
+        operation: '/chat/completions',
+        streaming: true,
+        mode: 'llm',
+      });
+      markAiApiFirstProviderOutput(ctx);
+      addAiApiUsage(ctx, { prompt_tokens: 2, completion_tokens: 3 });
+      finishAiApiObservation(ctx, { status: 'succeeded' });
+    }).not.toThrow();
+  });
+
+  it('records TTFT, normalized usage and finalizes exactly once', () => {
+    const handle = {
+      markFirstByte: vi.fn(),
+      addInputTokens: vi.fn(),
+      addOutputTokens: vi.fn(),
+      finish: vi.fn(),
+    };
+    const start = vi.fn(() => handle);
+    const ctx = createContext({ start });
+
+    startAiApiObservation(ctx, {
+      service: 'llm.agent',
+      operation: '/chat/completions',
+      streaming: true,
+      model: 'service/model',
+      mode: 'agent',
+    });
+    markAiApiFirstProviderOutput(ctx);
+    addAiApiUsage(ctx, { prompt_tokens: 11, completion_tokens: 7 });
+    finishAiApiObservation(ctx, { status: 'succeeded' });
+    finishAiApiObservation(ctx, { status: 'failed' });
+
+    expect(start).toHaveBeenCalledWith(
+      expect.objectContaining({
+        service: 'llm.agent',
+        streaming: true,
+        attributes: expect.objectContaining({ mode: 'agent', model: 'service/model' }),
+      }),
+    );
+    expect(handle.markFirstByte).toHaveBeenCalledTimes(1);
+    expect(handle.addInputTokens).toHaveBeenCalledWith(11);
+    expect(handle.addOutputTokens).toHaveBeenCalledWith(7);
+    expect(handle.finish).toHaveBeenCalledTimes(1);
+    expect(handle.finish).toHaveBeenCalledWith({ status: 'succeeded' });
+  });
+
+  it('fails open when contract callbacks throw', () => {
+    const ctx = createContext({
+      start: () => ({
+        markFirstByte: () => {
+          throw new Error('ttft failed');
+        },
+        addInputTokens: () => {
+          throw new Error('tokens failed');
+        },
+        addOutputTokens: () => {},
+        finish: () => {
+          throw new Error('finish failed');
+        },
+      }),
+    });
+    expect(() => {
+      startAiApiObservation(ctx, {
+        service: 'llm.completion',
+        operation: '/completions',
+        streaming: true,
+        mode: 'llm',
+      });
+      markAiApiFirstProviderOutput(ctx);
+      addAiApiUsage(ctx, { prompt_tokens: 1, completion_tokens: null });
+      finishAiApiObservation(ctx, { status: 'failed', errorCode: 'stream_error' });
+    }).not.toThrow();
+  });
+});

package/src/server/__tests__/models.test.ts

@@ -0,0 +1,116 @@
+/**
+ * This file is part of the NocoBase (R) project.
+ * Copyright (c) 2020-2024 NocoBase Co., Ltd.
+ * Authors: NocoBase Team.
+ *
+ * This project is dual-licensed under AGPL-3.0 and NocoBase Commercial License.
+ * For more information, please refer to: https://www.nocobase.com/agreement.
+ */
+
+import { Context } from '@nocobase/actions';
+import { describe, expect, it, vi } from 'vitest';
+import { buildModelObject, handleGetModel, handleListModels } from '../routes/models';
+
+const CREATED = 1_700_000_000;
+
+function permissionLookupFailureContext() {
+  const ctx = {
+    app: { name: 'main', pm: { get: () => ({}) } },
+    state: { currentUser: { id: 1 } },
+    db: {
+      getRepository: (name: string) => {
+        if (name === 'aiApiConfig') return { findOne: vi.fn(async () => null) };
+        if (name === 'llmServices') return { find: vi.fn(async () => []) };
+        if (name === 'aiApiUserPermissions') {
+          return { findOne: vi.fn(async () => Promise.reject(new Error('permission database unavailable'))) };
+        }
+        return { find: vi.fn(async () => []) };
+      },
+    },
+    log: { error: vi.fn(), warn: vi.fn() },
+    status: 0,
+    body: undefined,
+  } as unknown as Context;
+  return ctx;
+}
+
+describe('buildModelObject', () => {
+  it('returns the base OpenAI model shape with no override', () => {
+    const model = buildModelObject('svc/gpt-4o', CREATED, 'My Service');
+    expect(model).toEqual({
+      id: 'svc/gpt-4o',
+      object: 'model',
+      created: CREATED,
+      owned_by: 'My Service',
+    });
+    // No override → no context_window / active field is added.
+    expect(model).not.toHaveProperty('context_window');
+    expect(model).not.toHaveProperty('active');
+  });
+
+  it('emits context window under both context_window and context_length', () => {
+    const model = buildModelObject('svc/m', CREATED, 'Svc', { contextWindow: 100_000 });
+    expect(model.context_window).toBe(100_000);
+    expect(model.context_length).toBe(100_000);
+  });
+
+  it('overrides owned_by, display name and description', () => {
+    const model = buildModelObject('svc/m', CREATED, 'Svc', {
+      ownedByOverride: 'Acme',
+      displayName: 'Acme Turbo',
+      description: 'Fast model',
+    });
+    expect(model.owned_by).toBe('Acme');
+    expect(model.display_name).toBe('Acme Turbo');
+    expect(model.name).toBe('Acme Turbo');
+    expect(model.description).toBe('Fast model');
+  });
+
+  it('falls back to the service label when ownedByOverride is empty', () => {
+    const model = buildModelObject('svc/m', CREATED, 'Svc', { ownedByOverride: '' });
+    expect(model.owned_by).toBe('Svc');
+  });
+
+  it('emits max_completion_tokens only when positive', () => {
+    expect(buildModelObject('svc/m', CREATED, 'Svc', { maxCompletionTokens: 4096 }).max_completion_tokens).toBe(4096);
+    expect(buildModelObject('svc/m', CREATED, 'Svc', { maxCompletionTokens: 0 })).not.toHaveProperty(
+      'max_completion_tokens',
+    );
+    expect(buildModelObject('svc/m', CREATED, 'Svc', { maxCompletionTokens: null })).not.toHaveProperty(
+      'max_completion_tokens',
+    );
+  });
+
+  it('ignores non-positive or non-integer context windows', () => {
+    expect(buildModelObject('svc/m', CREATED, 'Svc', { contextWindow: 0 })).not.toHaveProperty('context_window');
+    expect(buildModelObject('svc/m', CREATED, 'Svc', { contextWindow: -5 })).not.toHaveProperty('context_window');
+    expect(buildModelObject('svc/m', CREATED, 'Svc', { contextWindow: null })).not.toHaveProperty('context_window');
+  });
+
+  it('surfaces active flag whenever an override row exists', () => {
+    expect(buildModelObject('svc/m', CREATED, 'Svc', { enabled: true }).active).toBe(true);
+    expect(buildModelObject('svc/m', CREATED, 'Svc', { enabled: false }).active).toBe(false);
+    // Override present with enabled undefined → treated as active.
+    expect(buildModelObject('svc/m', CREATED, 'Svc', { contextWindow: 10 }).active).toBe(true);
+  });
+});
+
+describe('model catalog permission lookup failures', () => {
+  it('returns a retryable 503 when listing models', async () => {
+    const ctx = permissionLookupFailureContext();
+
+    await handleListModels(ctx, undefined as never);
+
+    expect(ctx.status).toBe(503);
+    expect(ctx.body).toMatchObject({ error: { code: 'permission_check_failed' } });
+  });
+
+  it('returns a retryable 503 when retrieving a model', async () => {
+    const ctx = permissionLookupFailureContext();
+
+    await handleGetModel(ctx, 'openai/gpt-4o', undefined as never);
+
+    expect(ctx.status).toBe(503);
+    expect(ctx.body).toMatchObject({ error: { code: 'permission_check_failed' } });
+  });
+});

package/src/server/__tests__/openai-format.test.ts

@@ -1,4 +1,4 @@
-import { toOpenAIResponse, toOpenAIStreamChunk } from '../utils/openai-format';
+import { toOpenAIResponse, toOpenAIStreamChunk, toOpenAIUsageChunk } from '../utils/openai-format';
 import { isStreamingRequested } from '../utils/streaming';
 import { applyProviderRequestParameters, getProviderRequestParameters } from '../routes/chat-completions';
 
@@ -52,6 +52,57 @@ describe('AI API OpenAI tool-call formatting', () => {
   });
 });
 
+describe('AI API OpenAI usage-only streaming chunks', () => {
+  it('includes a null usage field for normal chunks', () => {
+    const chunk = toOpenAIStreamChunk({
+      id: 'chatcmpl-1',
+      model: 'service/model',
+      delta: { content: 'Hello' },
+    });
+
+    expect(chunk.choices).toHaveLength(1);
+    expect(chunk).toHaveProperty('usage', null);
+  });
+
+  it('includes a null usage field for finish chunks', () => {
+    const chunk = toOpenAIStreamChunk({
+      id: 'chatcmpl-1',
+      model: 'service/model',
+      delta: {},
+      finishReason: 'stop',
+    });
+
+    expect(chunk.choices[0].finish_reason).toBe('stop');
+    expect(chunk).toHaveProperty('usage', null);
+  });
+
+  it('formats a usage-only chat completion chunk with an empty choices array', () => {
+    const chunk = toOpenAIUsageChunk({
+      id: 'chatcmpl-1',
+      model: 'service/model',
+      usage: { prompt_tokens: 8, completion_tokens: 3, total_tokens: 11 },
+      object: 'chat.completion.chunk',
+    });
+
+    expect(chunk.object).toBe('chat.completion.chunk');
+    expect(chunk.choices).toEqual([]);
+    expect(chunk.usage).toEqual({ prompt_tokens: 8, completion_tokens: 3, total_tokens: 11 });
+  });
+
+  it('formats a usage-only legacy text completion chunk', () => {
+    const chunk = toOpenAIUsageChunk({
+      id: 'cmpl-1',
+      model: 'service/model',
+      usage: { prompt_tokens: 2, completion_tokens: 5, total_tokens: 7 },
+      object: 'text_completion',
+    });
+
+    expect(chunk.object).toBe('text_completion');
+    expect(chunk.choices).toEqual([]);
+    expect(chunk.usage).toEqual({ prompt_tokens: 2, completion_tokens: 5, total_tokens: 7 });
+  });
+});
+
 describe('AI API provider parameter forwarding', () => {
   it('forwards model and tool-call parameters not managed by the gateway', () => {
     const parameters = getProviderRequestParameters({

package/src/server/__tests__/permission-sync.test.ts

@@ -0,0 +1,109 @@
+/**
+ * This file is part of the NocoBase (R) project.
+ * Copyright (c) 2020-2024 NocoBase Co., Ltd.
+ * Authors: NocoBase Team.
+ *
+ * This project is dual-licensed under AGPL-3.0 and NocoBase Commercial License.
+ * For more information, please refer to: https://www.nocobase.com/agreement.
+ */
+
+import { Context } from '@nocobase/actions';
+import { beforeEach, describe, expect, it, vi } from 'vitest';
+import { PluginAiApiServer } from '../plugin';
+import { invalidateUserPermissionCache, resolveUserAccessScope } from '../utils/user-permissions';
+
+/**
+ * Covers the cross-node half of permission revocation.
+ *
+ * syncMessageManager hardcodes `skipSelf: true` (sync-message-manager.ts:59,73), so the node
+ * that writes the change never receives its own broadcast. That makes two things load-bearing
+ * and easy to regress: the writer must invalidate its own cache locally, and every other node
+ * must invalidate on receipt. Neither is observable from a single-node test of the cache alone.
+ */
+function mockContext(userId: number, row: unknown) {
+  const findOne = vi.fn(async () => row);
+  const ctx = {
+    state: { currentUser: { id: userId } },
+    db: { getRepository: () => ({ findOne }) },
+    app: { name: 'main' },
+    log: { warn: vi.fn(), error: vi.fn() },
+  } as unknown as Context;
+  return { ctx, findOne };
+}
+
+function row(values: Record<string, unknown>) {
+  return { get: (key: string) => values[key] };
+}
+
+beforeEach(() => {
+  invalidateUserPermissionCache();
+});
+
+describe('cross-node permission invalidation', () => {
+  it("drops the receiving node's cached scope", async () => {
+    const plugin = Object.create(PluginAiApiServer.prototype) as PluginAiApiServer;
+    const { ctx, findOne } = mockContext(1, row({ allowedLlmServices: ['openai'] }));
+
+    await resolveUserAccessScope(ctx);
+    await resolveUserAccessScope(ctx);
+    expect(findOne).toHaveBeenCalledTimes(1);
+
+    await plugin.handleSyncMessage({ type: 'invalidateUserPermissions', userId: 1 });
+
+    await resolveUserAccessScope(ctx);
+    expect(findOne).toHaveBeenCalledTimes(2);
+  });
+
+  it('ignores unrelated message types and other users', async () => {
+    const plugin = Object.create(PluginAiApiServer.prototype) as PluginAiApiServer;
+    const { ctx, findOne } = mockContext(1, row({ allowedLlmServices: ['openai'] }));
+    await resolveUserAccessScope(ctx);
+
+    await plugin.handleSyncMessage({ type: 'somethingElse', userId: 1 });
+    await plugin.handleSyncMessage({ type: 'invalidateUserPermissions', userId: 2 });
+
+    await resolveUserAccessScope(ctx);
+    expect(findOne).toHaveBeenCalledTimes(1);
+  });
+
+  it('tolerates a malformed message instead of throwing into the subscriber', async () => {
+    const plugin = Object.create(PluginAiApiServer.prototype) as PluginAiApiServer;
+    await expect(plugin.handleSyncMessage(undefined as never)).resolves.toBeUndefined();
+    await expect(plugin.handleSyncMessage({} as never)).resolves.toBeUndefined();
+  });
+
+  it('invalidates locally as well as broadcasting, since the publisher is skipped', async () => {
+    const plugin = Object.create(PluginAiApiServer.prototype) as PluginAiApiServer;
+    const sendSyncMessage = vi.fn(async () => undefined);
+    Object.assign(plugin, { sendSyncMessage });
+
+    const { ctx, findOne } = mockContext(1, row({ allowedLlmServices: ['openai'] }));
+    await resolveUserAccessScope(ctx);
+    expect(findOne).toHaveBeenCalledTimes(1);
+
+    // revokeUserPermissions is private; reach it the way the db hook does.
+    (plugin as unknown as { revokeUserPermissions: (id: unknown, tx?: unknown) => void }).revokeUserPermissions(1);
+
+    // Local cache cleared without any message coming back to us.
+    await resolveUserAccessScope(ctx);
+    expect(findOne).toHaveBeenCalledTimes(2);
+    expect(sendSyncMessage).toHaveBeenCalledWith(
+      { type: 'invalidateUserPermissions', userId: 1 },
+      { transaction: undefined },
+    );
+  });
+
+  it('defers the broadcast to the transaction so other nodes cannot re-cache the old row', async () => {
+    const plugin = Object.create(PluginAiApiServer.prototype) as PluginAiApiServer;
+    const sendSyncMessage = vi.fn(async () => undefined);
+    Object.assign(plugin, { sendSyncMessage });
+    const transaction = { id: 'tx-1' };
+
+    (plugin as unknown as { revokeUserPermissions: (id: unknown, tx?: unknown) => void }).revokeUserPermissions(
+      7,
+      transaction,
+    );
+
+    expect(sendSyncMessage).toHaveBeenCalledWith({ type: 'invalidateUserPermissions', userId: 7 }, { transaction });
+  });
+});