plugin-ai-api 1.0.24 → 1.0.28

package/src/locale/vi-VN.json

@@ -63,6 +63,7 @@
   "Input tokens": "Input token",
   "Output tokens": "Output token",
   "Total tokens": "Tổng token",
+  "Prompt cache tokens": "Prompt cache token",
   "Cost": "Chi phí",
   "Cost status": "Trạng thái chi phí",
   "Request ID": "Request ID",
@@ -98,6 +99,8 @@
   "Leave empty to not override": "Để trống nếu không override",
   "Total input + output token capacity reported to clients.": "Tổng dung lượng token (input + output) trả về cho client.",
   "Maximum output tokens reported to clients.": "Số token output tối đa trả về cho client.",
+  "Initial system prompt": "System prompt khởi tạo",
+  "Prepended as the first system message, before any system prompt sent by the client. If the client sends no system prompt, this becomes the system prompt sent to the provider.": "Được thêm vào làm system message đầu tiên, đứng trước mọi system prompt mà client gửi sang. Nếu client không gửi system prompt, đây sẽ là system prompt được gửi tới provider.",
   "AI API": "AI API",
   "Allow this role to use the AI API": "Cho phép vai trò này sử dụng AI API",
   "Allow all AI Employees": "Cho phép tất cả AI Employee",
@@ -105,15 +108,31 @@
   "Select allowed AI Employees": "Chọn AI Employee được phép",
   "Max request body size (MB)": "Giới hạn kích thước request body (MB)",
   "Raise this to accept inline base64 images. Base64 adds about 33% to the original file size.": "Tăng giá trị này để nhận ảnh base64 gửi trực tiếp. Base64 làm tăng khoảng 33% so với kích thước tệp gốc.",
-  "User LLM permissions": "Phân quyền LLM theo người dùng",
-  "Add permission": "Thêm phân quyền",
-  "Edit permission": "Sửa phân quyền",
-  "Delete this permission?": "Xoá phân quyền này?",
+  "Usage groups": "Nhóm usage",
+  "Add group": "Thêm nhóm",
+  "Edit group": "Sửa nhóm",
+  "Delete this group?": "Xóa nhóm này?",
+  "Mode": "Chế độ",
+  "Share": "Chia sẻ",
+  "Per user": "Theo người dùng",
+  "Rate limit per minute": "Giới hạn request/phút",
+  "Members": "Thành viên",
+  "Add member": "Thêm thành viên",
+  "Member added": "Đã thêm thành viên",
+  "Member removed": "Đã xóa thành viên",
+  "Remove member?": "Xóa thành viên?",
+  "Remove": "Xóa",
+  "Search group by user": "Tìm nhóm theo người dùng",
+  "User belongs to": "Người dùng thuộc nhóm",
+  "User not found": "Không tìm thấy người dùng",
+  "Default": "Mặc định",
   "Allowed LLM services": "Dịch vụ LLM được phép",
   "Allow all models": "Cho phép tất cả model",
   "Allowed models": "Model được phép",
-  "No service allowed": "Không được phép dịch vụ nào",
-  "All models of allowed services": "Tất cả model của các dịch vụ được phép",
-  "Users listed here are limited to the services selected below. Users without a record fall back to the general configuration.": "Người dùng có trong danh sách này chỉ được dùng các dịch vụ được chọn bên dưới. Người dùng không có bản ghi sẽ dùng theo cấu hình chung.",
-  "Only services also enabled in the general configuration take effect.": "Chỉ những dịch vụ đồng thời được bật trong cấu hình chung mới có hiệu lực."
+  "Model access": "Quyền truy cập model",
+  "All models": "Tất cả model",
+  "All services": "Tất cả dịch vụ",
+  "No models": "Không model nào",
+  "Leave empty to allow every service enabled in the general configuration.": "Để trống để cho phép mọi dịch vụ đang được bật trong cấu hình chung.",
+  "Users who do not belong to any other group automatically use this default group — no need to add members.": "Người dùng không thuộc nhóm nào khác sẽ tự động dùng nhóm mặc định này — không cần thêm thành viên."
 }

package/src/locale/zh-CN.json

@@ -63,6 +63,7 @@
   "Input tokens": "输入令牌",
   "Output tokens": "输出令牌",
   "Total tokens": "总令牌",
+  "Prompt cache tokens": "提示缓存令牌",
   "Cost": "费用",
   "Cost status": "费用状态",
   "Request ID": "请求 ID",
@@ -98,6 +99,8 @@
   "Leave empty to not override": "留空则不覆盖",
   "Total input + output token capacity reported to clients.": "返回给客户端的输入+输出 token 总容量。",
   "Maximum output tokens reported to clients.": "返回给客户端的最大输出 token 数。",
+  "Initial system prompt": "初始系统提示词",
+  "Prepended as the first system message, before any system prompt sent by the client. If the client sends no system prompt, this becomes the system prompt sent to the provider.": "作为第一条 system 消息插入到客户端发送的任何 system 提示词之前。如果客户端未发送 system 提示词，此提示词将作为发送给提供商的 system 提示词。",
   "AI API": "AI API",
   "Allow this role to use the AI API": "允许此角色使用 AI API",
   "Allow all AI Employees": "允许所有 AI 员工",
@@ -105,15 +108,31 @@
   "Select allowed AI Employees": "选择允许的 AI 员工",
   "Max request body size (MB)": "请求体大小上限（MB）",
   "Raise this to accept inline base64 images. Base64 adds about 33% to the original file size.": "调高此值以接收内联 base64 图片。base64 编码会使体积增加约 33%。",
-  "User LLM permissions": "用户 LLM 权限",
-  "Add permission": "添加权限",
-  "Edit permission": "编辑权限",
-  "Delete this permission?": "确定删除此权限？",
+  "Usage groups": "用量组",
+  "Add group": "添加分组",
+  "Edit group": "编辑分组",
+  "Delete this group?": "删除此分组？",
+  "Mode": "模式",
+  "Share": "共享",
+  "Per user": "按用户",
+  "Rate limit per minute": "每分钟速率限制",
+  "Members": "成员",
+  "Add member": "添加成员",
+  "Member added": "成员已添加",
+  "Member removed": "成员已移除",
+  "Remove member?": "移除成员？",
+  "Remove": "移除",
+  "Search group by user": "按用户搜索分组",
+  "User belongs to": "用户属于",
+  "User not found": "未找到用户",
+  "Default": "默认",
   "Allowed LLM services": "允许的 LLM 服务",
   "Allow all models": "允许所有模型",
   "Allowed models": "允许的模型",
-  "No service allowed": "未允许任何服务",
-  "All models of allowed services": "允许服务下的所有模型",
-  "Users listed here are limited to the services selected below. Users without a record fall back to the general configuration.": "此处列出的用户仅能使用下方所选的服务；没有记录的用户按通用配置处理。",
-  "Only services also enabled in the general configuration take effect.": "仅当服务同时在通用配置中启用时才会生效。"
+  "Model access": "模型访问",
+  "All models": "所有模型",
+  "All services": "所有服务",
+  "No models": "未允许任何模型",
+  "Leave empty to allow every service enabled in the general configuration.": "留空则允许通用配置中已启用的所有服务。",
+  "Users who do not belong to any other group automatically use this default group — no need to add members.": "不属于其他分组的用户会自动使用此默认分组，无需手动添加成员。"
 }

package/src/server/__tests__/billing-quota.test.ts

@@ -3,7 +3,7 @@ import { createMockDatabase, type Database } from '@nocobase/database';
 import { afterEach, beforeEach, describe, expect, it } from 'vitest';
 import { AiApiQuotaError, finalizeLlmBilling, markLlmProviderAttempted, prepareLlmBilling } from '../billing';
 
-describe('AI API user quota reservation', () => {
+describe('AI API group quota reservation', () => {
   let db: Database;
 
   beforeEach(async () => {
@@ -30,9 +30,12 @@ describe('AI API user quota reservation', () => {
       ],
     });
     db.collection({
-      name: 'aiApiUserQuotaPolicies',
+      name: 'aiApiUsageGroups',
       fields: [
-        { name: 'userId', type: 'bigInt' },
+        { name: 'name', type: 'string' },
+        { name: 'isDefault', type: 'boolean' },
+        { name: 'quotaMode', type: 'string' },
+        { name: 'rateLimitPerMinute', type: 'integer' },
         { name: 'enabled', type: 'boolean' },
         { name: 'periodType', type: 'string' },
         { name: 'timezone', type: 'string' },
@@ -42,12 +45,21 @@ describe('AI API user quota reservation', () => {
         { name: 'currency', type: 'string' },
         { name: 'rejectUnpricedModel', type: 'boolean' },
         { name: 'missingUsageBehavior', type: 'string' },
+        { name: 'contextOverflowBehavior', type: 'string' },
       ],
     });
     db.collection({
-      name: 'aiApiUserQuotaBuckets',
+      name: 'aiApiGroupMembers',
       fields: [
-        { name: 'policyId', type: 'bigInt' },
+        { name: 'groupId', type: 'bigInt' },
+        { name: 'userId', type: 'bigInt' },
+      ],
+      indexes: [{ fields: ['userId'], unique: true }],
+    });
+    db.collection({
+      name: 'aiApiGroupQuotaBuckets',
+      fields: [
+        { name: 'groupId', type: 'bigInt' },
         { name: 'userId', type: 'bigInt' },
         { name: 'periodStart', type: 'datetimeTz' },
         { name: 'periodEnd', type: 'datetimeTz' },
@@ -58,7 +70,7 @@ describe('AI API user quota reservation', () => {
         { name: 'reservedTokens', type: 'bigInt' },
         { name: 'reservedCost', type: 'decimal', precision: 20, scale: 8 },
       ],
-      indexes: [{ fields: ['policyId', 'periodStart'], unique: true }],
+      indexes: [{ fields: ['groupId', 'userId', 'periodStart'], unique: true }],
     });
     await db.sync({ force: true });
     await db.getRepository('aiApiConfig').create({
@@ -76,9 +88,12 @@ describe('AI API user quota reservation', () => {
         effectiveFrom: new Date('2020-01-01T00:00:00Z'),
       },
     });
-    await db.getRepository('aiApiUserQuotaPolicies').create({
+    const group = await db.getRepository('aiApiUsageGroups').create({
       values: {
-        userId: 7,
+        name: 'Default',
+        isDefault: true,
+        quotaMode: 'per_user',
+        rateLimitPerMinute: 60,
         enabled: true,
         periodType: 'monthly',
         timezone: 'UTC',
@@ -88,8 +103,12 @@ describe('AI API user quota reservation', () => {
         currency: 'USD',
         rejectUnpricedModel: true,
         missingUsageBehavior: 'use_reserved',
+        contextOverflowBehavior: 'reject',
       },
     });
+    await db.getRepository('aiApiGroupMembers').create({
+      values: { groupId: group.get('id'), userId: 7 },
+    });
   });
 
   afterEach(async () => {
@@ -126,7 +145,7 @@ describe('AI API user quota reservation', () => {
     );
     expect(finalized).toMatchObject({ estimatedCost: '0.00012500', costStatus: 'calculated' });
 
-    const bucket = await db.getRepository('aiApiUserQuotaBuckets').findOne();
+    const bucket = await db.getRepository('aiApiGroupQuotaBuckets').findOne();
     expect(String(bucket?.get('requestCount'))).toBe('1');
     expect(String(bucket?.get('totalTokens'))).toBe('15');
     expect(String(bucket?.get('reservedRequests'))).toBe('0');

package/src/server/__tests__/direct-llm-context.test.ts

@@ -1,6 +1,11 @@
 import type { Context } from '@nocobase/actions';
 import { describe, expect, it, vi } from 'vitest';
-import { DirectLlmContextError, prepareDirectLlmContext, type OpenAIMessage } from '../utils/direct-llm-context';
+import {
+  DirectLlmContextError,
+  prepareDirectLlmContext,
+  type OpenAIMessage,
+  parseImageDimensions,
+} from '../utils/direct-llm-context';
 
 function context({ behavior = 'reject', metadata = { contextWindow: 120, maxCompletionTokens: 40 } } = {}): Context {
   return {
@@ -12,11 +17,33 @@ function context({ behavior = 'reject', metadata = { contextWindow: 120, maxComp
             findOne: vi.fn().mockResolvedValue({ get: (key: string) => metadata[key as keyof typeof metadata] }),
           };
         }
-        if (name === 'aiApiUserQuotaPolicies') {
+        if (name === 'aiApiGroupMembers') {
           return {
-            findOne: vi
-              .fn()
-              .mockResolvedValue({ get: (key: string) => (key === 'contextOverflowBehavior' ? behavior : undefined) }),
+            findOne: vi.fn().mockResolvedValue(null),
+          };
+        }
+        if (name === 'aiApiUsageGroups') {
+          return {
+            findOne: vi.fn().mockResolvedValue({
+              get: (key?: string) => {
+                const record: Record<string, unknown> = {
+                  id: 1,
+                  name: 'Default',
+                  isDefault: true,
+                  quotaMode: 'per_user',
+                  rateLimitPerMinute: 60,
+                  enabled: true,
+                  periodType: 'monthly',
+                  timezone: 'UTC',
+                  currency: 'USD',
+                  rejectUnpricedModel: true,
+                  missingUsageBehavior: 'use_reserved',
+                  contextOverflowBehavior: behavior,
+                };
+                if (!key) return record;
+                return record[key];
+              },
+            }),
           };
         }
         return { findOne: vi.fn() };
@@ -34,6 +61,25 @@ function request(messages: OpenAIMessage[], tools?: unknown) {
   };
 }
 
+// A 1x1 PNG encoded as a base64 data URL.
+const ONE_PIXEL_PNG =
+  'data:image/png;base64,iVBORw0KGgoAAAANSUhEUgAAAAEAAAABCAIAAACQd1PeAAAADElEQVR4nGP4z8AAAAMBAQDJ/pLvAAAAAElFTkSuQmCC';
+
+// A tiny valid base64 PDF payload (PDF header + minimal content).
+const TINY_PDF_BASE64 = 'data:application/pdf;base64,JVBERi0xLjAKPDwKPiEKZW5kb2JqCmVuZG9iagpl';
+
+// A PNG header with 1280x720 dimensions. The pixel data is truncated/invalid,
+// but the header is valid enough for dimension parsing to succeed.
+const LARGE_PNG_HEADER_BASE64 =
+  'data:image/png;base64,iVBORw0KGgoAAAANSUhEUgAABQAAAALQCAYAAADPfd1WAAAABGdBTUEAALGPC/xhBQAAACBjSFJNAAB6JgAAgIQAAPoSAA';
+
+// The fixed conservative estimate used for http(s) image URLs.
+const VISION_HTTP_URL_ESTIMATE = 1024;
+
+function largeContext(): Context {
+  return context({ metadata: { contextWindow: 2000, maxCompletionTokens: 40 } });
+}
+
 describe('direct LLM context preparation', () => {
   it('uses reject when the user has no enabled policy', async () => {
     const ctx = context();
@@ -43,6 +89,33 @@ describe('direct LLM context preparation', () => {
           findOne: vi.fn().mockResolvedValue({ get: (key: string) => (key === 'contextWindow' ? 120 : 40) }),
         } as never;
       }
+      if (name === 'aiApiGroupMembers') {
+        return { findOne: vi.fn().mockResolvedValue(null) } as never;
+      }
+      if (name === 'aiApiUsageGroups') {
+        return {
+          findOne: vi.fn().mockResolvedValue({
+            get: (key?: string) => {
+              const record: Record<string, unknown> = {
+                id: 1,
+                name: 'Default',
+                isDefault: true,
+                quotaMode: 'per_user',
+                rateLimitPerMinute: 60,
+                enabled: true,
+                periodType: 'monthly',
+                timezone: 'UTC',
+                currency: 'USD',
+                rejectUnpricedModel: true,
+                missingUsageBehavior: 'use_reserved',
+                contextOverflowBehavior: 'reject',
+              };
+              if (!key) return record;
+              return record[key];
+            },
+          }),
+        } as never;
+      }
       return { findOne: vi.fn().mockResolvedValue(null) } as never;
     });
 
@@ -100,15 +173,57 @@ describe('direct LLM context preparation', () => {
     ).rejects.toMatchObject<Partial<DirectLlmContextError>>({ code: 'context_length_exceeded' });
   });
 
-  it('rejects image content until a model-specific estimator is available', async () => {
+  it('estimates vision tokens for a base64 image_url and allows small payloads', async () => {
+    const prepared = await prepareDirectLlmContext(
+      largeContext(),
+      request([{ role: 'user', content: [{ type: 'image_url', image_url: { url: ONE_PIXEL_PNG } }] }]),
+    );
+
+    expect(prepared.estimatedInputTokens).toBeGreaterThan(0);
+    expect(prepared.truncated).toBe(false);
+  });
+
+  it('estimates a fixed conservative token count for http(s) image_url URLs', async () => {
+    const prepared = await prepareDirectLlmContext(
+      largeContext(),
+      request([
+        { role: 'user', content: [{ type: 'image_url', image_url: { url: 'https://example.com/image.png' } }] },
+      ]),
+    );
+
+    expect(prepared.estimatedInputTokens).toBeGreaterThanOrEqual(VISION_HTTP_URL_ESTIMATE);
+    expect(prepared.truncated).toBe(false);
+  });
+
+  it('rejects a base64 image that exceeds the input budget', async () => {
+    // Large header claims 1000x1000, so vision estimate is 85 + 4 * 170 = 765 tokens,
+    // which easily exceeds the 80 token budget of the default test context.
+    await expect(
+      prepareDirectLlmContext(
+        context(),
+        request([{ role: 'user', content: [{ type: 'image_url', image_url: { url: LARGE_PNG_HEADER_BASE64 } }] }]),
+      ),
+    ).rejects.toMatchObject<Partial<DirectLlmContextError>>({ code: 'context_length_exceeded' });
+  });
+
+  it('estimates file block tokens from decoded base64 size', async () => {
+    const prepared = await prepareDirectLlmContext(
+      context(),
+      request([{ role: 'user', content: [{ type: 'file', file: { file_data: TINY_PDF_BASE64, filename: 'x.pdf' } }] }]),
+    );
+
+    expect(prepared.estimatedInputTokens).toBeGreaterThan(0);
+    expect(prepared.truncated).toBe(false);
+  });
+
+  it('rejects a base64 file that exceeds the input budget', async () => {
+    const largeBase64 = `data:application/pdf;base64,${Buffer.alloc(100_000).toString('base64')}`;
     await expect(
       prepareDirectLlmContext(
         context(),
-        request([
-          { role: 'user', content: [{ type: 'image_url', image_url: { url: 'https://example.test/image.png' } }] },
-        ]),
+        request([{ role: 'user', content: [{ type: 'file', file: { file_data: largeBase64, filename: 'x.pdf' } }] }]),
       ),
-    ).rejects.toMatchObject<Partial<DirectLlmContextError>>({ code: 'context_estimation_unsupported' });
+    ).rejects.toMatchObject<Partial<DirectLlmContextError>>({ code: 'context_length_exceeded' });
   });
 
   it('counts tool definitions as fixed input overhead', async () => {
@@ -122,4 +237,88 @@ describe('direct LLM context preparation', () => {
       ),
     ).rejects.toMatchObject<Partial<DirectLlmContextError>>({ code: 'context_length_exceeded' });
   });
+
+  it('prepends the initial system prompt before the client system prompt', async () => {
+    const clientMessages: OpenAIMessage[] = [
+      { role: 'system', content: 'Client system prompt' },
+      { role: 'user', content: 'hello' },
+    ];
+    const prepared = await prepareDirectLlmContext(
+      context({ metadata: { contextWindow: 120, maxCompletionTokens: 40, systemPrompt: 'Initial prompt' } }),
+      request(clientMessages),
+    );
+
+    expect(prepared.messages).toEqual([
+      { role: 'system', content: 'Initial prompt' },
+      { role: 'system', content: 'Client system prompt' },
+      { role: 'user', content: 'hello' },
+    ]);
+    expect(prepared.truncated).toBe(false);
+    expect(clientMessages).toHaveLength(2);
+  });
+
+  it('uses the initial system prompt as the only system message when the client sends none', async () => {
+    const prepared = await prepareDirectLlmContext(
+      context({ metadata: { contextWindow: 120, maxCompletionTokens: 40, systemPrompt: 'Initial prompt' } }),
+      request([{ role: 'user', content: 'hello' }]),
+    );
+
+    expect(prepared.messages).toEqual([
+      { role: 'system', content: 'Initial prompt' },
+      { role: 'user', content: 'hello' },
+    ]);
+  });
+
+  it('ignores a blank initial system prompt', async () => {
+    const messages = [{ role: 'user', content: 'hello' }];
+    const prepared = await prepareDirectLlmContext(
+      context({ metadata: { contextWindow: 120, maxCompletionTokens: 40, systemPrompt: '   ' } }),
+      request(messages),
+    );
+
+    expect(prepared.messages).toBe(messages);
+  });
+
+  it('counts the initial system prompt toward the input budget', async () => {
+    await expect(
+      prepareDirectLlmContext(
+        context({ metadata: { contextWindow: 120, maxCompletionTokens: 40, systemPrompt: 'x'.repeat(400) } }),
+        request([{ role: 'user', content: 'hello' }]),
+      ),
+    ).rejects.toMatchObject<Partial<DirectLlmContextError>>({ code: 'context_length_exceeded' });
+  });
+
+  it('keeps the initial system prompt when truncating oldest turns', async () => {
+    const messages: OpenAIMessage[] = [
+      { role: 'user', content: 'first '.repeat(30) },
+      { role: 'assistant', content: 'first answer '.repeat(20) },
+      { role: 'user', content: 'latest question' },
+    ];
+
+    const prepared = await prepareDirectLlmContext(
+      context({
+        behavior: 'truncate',
+        metadata: { contextWindow: 120, maxCompletionTokens: 40, systemPrompt: 'Initial prompt' },
+      }),
+      request(messages),
+    );
+
+    expect(prepared.truncated).toBe(true);
+    expect(prepared.messages).toEqual([{ role: 'system', content: 'Initial prompt' }, messages[2]]);
+  });
+});
+
+describe('image dimension parsing', () => {
+  it('parses PNG dimensions', () => {
+    // The shared 1x1 test PNG is a valid PNG with dimensions 1x1.
+    const base64 = ONE_PIXEL_PNG.split(',')[1];
+    const png = Buffer.from(base64, 'base64');
+    expect(parseImageDimensions(png)).toEqual({ width: 1, height: 1 });
+  });
+
+  it('parses JPEG dimensions without reading past width/height', () => {
+    // Minimal JPEG SOF0 segment: height 1024, width 1024.
+    const jpeg = Buffer.from([0xff, 0xd8, 0xff, 0xc0, 0x00, 0x0b, 0x08, 0x04, 0x00, 0x04, 0x00, 0x01, 0x22, 0x00]);
+    expect(parseImageDimensions(jpeg)).toEqual({ width: 1024, height: 1024 });
+  });
 });