plugin-ai-api 1.0.25 → 1.1.0

package/src/server/resource/ai-api-usage-groups.ts

@@ -0,0 +1,171 @@
+/**
+ * This file is part of the NocoBase (R) project.
+ * Copyright (c) 2020-2024 NocoBase Co., Ltd.
+ * Authors: NocoBase Team.
+ *
+ * This project is dual-licensed under AGPL-3.0 and NocoBase Commercial License.
+ * For more information, please refer to: https://www.nocobase.com/agreement.
+ */
+
+import { Context } from '@nocobase/actions';
+
+const USER_SUMMARY_FIELDS = ['id', 'username', 'nickname', 'email'];
+
+async function getByUser(ctx: Context, next: () => Promise<void>) {
+  const { userId } = ctx.action.params;
+  if (!userId) {
+    ctx.throw(400, 'userId is required');
+  }
+  const member = await ctx.db.getRepository('aiApiGroupMembers').findOne({
+    filter: { userId },
+    appends: ['group'],
+  });
+
+  if (member && member.get('group')) {
+    ctx.body = member.get('group');
+    return next();
+  }
+
+  const defaultGroup = await ctx.db.getRepository('aiApiUsageGroups').findOne({
+    filter: { isDefault: true },
+  });
+
+  if (!defaultGroup) {
+    ctx.throw(404, 'Default group not found');
+  }
+
+  ctx.body = defaultGroup;
+  return next();
+}
+
+async function listUnassignedUsers(ctx: Context, next: () => Promise<void>) {
+  const { page = 1, pageSize = 20, keyword } = ctx.action.params;
+
+  const memberRows = (await ctx.db.getRepository('aiApiGroupMembers').find({
+    fields: ['userId'],
+    pageSize: 10000,
+  })) as unknown[];
+  const assignedUserIds = memberRows.map((row) => {
+    const value = (row as Record<string, unknown>).get?.('userId') ?? (row as Record<string, unknown>).userId;
+    return String(value);
+  });
+
+  const where: Record<string, unknown> = {};
+  if (keyword) {
+    where.$or = [
+      { username: { $includes: keyword } },
+      { email: { $includes: keyword } },
+      { nickname: { $includes: keyword } },
+    ];
+  }
+  if (assignedUserIds.length > 0) {
+    where.id = { $notIn: assignedUserIds };
+  }
+
+  const repository = ctx.db.getRepository('users');
+  const [rows, count] = await repository.findAndCount({
+    filter: where,
+    fields: USER_SUMMARY_FIELDS,
+    page: Number(page),
+    pageSize: Number(pageSize),
+  });
+
+  ctx.body = { rows, count };
+  return next();
+}
+
+async function searchUsers(ctx: Context, next: () => Promise<void>) {
+  const { keyword, pageSize = 20 } = ctx.action.params;
+
+  const where: Record<string, unknown> = {};
+  if (keyword) {
+    where.$or = [
+      { username: { $includes: keyword } },
+      { email: { $includes: keyword } },
+      { nickname: { $includes: keyword } },
+    ];
+  }
+
+  const [rows, count] = await ctx.db.getRepository('users').findAndCount({
+    filter: where,
+    fields: USER_SUMMARY_FIELDS,
+    page: 1,
+    pageSize: Number(pageSize),
+  });
+
+  ctx.body = { rows, count };
+  return next();
+}
+
+async function addMember(ctx: Context, next: () => Promise<void>) {
+  const { groupId, userId } = ctx.action.params.values || ctx.action.params || {};
+  if (!groupId || !userId) {
+    ctx.throw(400, 'groupId and userId are required');
+  }
+
+  const group = await ctx.db.getRepository('aiApiUsageGroups').findOne({
+    filterByTk: groupId,
+  });
+  if (!group) {
+    ctx.throw(404, 'Usage group not found');
+  }
+  // The default group is a fallback, not a membership target: an explicit row would
+  // pin the user there and hide them from listUnassignedUsers forever.
+  if (group.get('isDefault')) {
+    ctx.throw(400, 'Cannot add members to the default group: users without another group use it automatically');
+  }
+
+  const existing = await ctx.db.getRepository('aiApiGroupMembers').findOne({
+    filter: { userId },
+  });
+  if (existing) {
+    ctx.throw(409, 'User already belongs to a group');
+  }
+
+  const member = await ctx.db.getRepository('aiApiGroupMembers').create({
+    values: { groupId, userId },
+  });
+  ctx.body = member;
+  return next();
+}
+
+async function removeMember(ctx: Context, next: () => Promise<void>) {
+  const { groupId, userId } = ctx.action.params.values || ctx.action.params || {};
+  if (!groupId || !userId) {
+    ctx.throw(400, 'groupId and userId are required');
+  }
+
+  const member = await ctx.db.getRepository('aiApiGroupMembers').findOne({
+    filter: { groupId, userId },
+  });
+  if (!member) {
+    ctx.throw(404, 'Member not found');
+  }
+
+  await ctx.db.getRepository('aiApiGroupMembers').destroy({
+    filterByTk: member.get('id'),
+  });
+  ctx.body = member;
+  return next();
+}
+
+export default {
+  name: 'aiApiUsageGroups',
+  actions: {
+    getByUser: {
+      handler: getByUser,
+    },
+    listUnassignedUsers: {
+      handler: listUnassignedUsers,
+    },
+    searchUsers: {
+      handler: searchUsers,
+    },
+    addMember: {
+      handler: addMember,
+    },
+    removeMember: {
+      handler: removeMember,
+    },
+  },
+};

package/src/server/routes/agent-completions.ts

@@ -19,6 +19,7 @@ import {
 import { resolveModelString } from '../utils/resolve-service';
 import { checkEmployeeAccess } from '../middleware/role-permission';
 import { enforceModelAccess } from '../utils/user-permissions';
+import { getAiApiConfig } from '../utils/request-cache';
 import { isStreamingRequested } from '../utils/streaming';
 import {
   AgentRuntimeContext,
@@ -89,7 +90,7 @@ export async function handleAgentCompletions(ctx: Context, plugin: PluginAiApiSe
   }
 
   // ─── Load config and validate AI Employee ─────────────────────────────────
-  const config = await ctx.db.getRepository('aiApiConfig').findOne();
+  const config = await getAiApiConfig(ctx);
   const defaultAiEmployee = config ? config.get('defaultAiEmployee') || config.defaultAiEmployee : null;
   if (!defaultAiEmployee) {
     ctx.status = 400;

package/src/server/routes/chat-completions.ts

@@ -26,8 +26,8 @@ import {
   isStreamingRequested,
   writeResponse,
 } from '../utils/streaming';
-import { checkEmployeeAccess } from '../middleware/role-permission';
 import { enforceModelAccess } from '../utils/user-permissions';
+import { getAiApiConfig } from '../utils/request-cache';
 import { extractProviderRequestId, normalizeUsage, setAiApiUsageResult, type Usage } from '../usage';
 import type PluginAiApiServer from '../plugin';
 import { AiApiQuotaError, markLlmProviderAttempted, prepareLlmBilling } from '../billing';
@@ -131,7 +131,7 @@ export async function handleChatCompletions(ctx: Context, plugin: PluginAiApiSer
     }
 
     // ─── Check whitelist (global config ∩ per-user grant) ───
-    const config = await ctx.db.getRepository('aiApiConfig').findOne();
+    const config = await getAiApiConfig(ctx);
     if (!(await enforceModelAccess(ctx, config?.enabledLlmServices, service, modelId))) {
       return;
     }
@@ -166,35 +166,10 @@ export async function handleChatCompletions(ctx: Context, plugin: PluginAiApiSer
     if (body.presence_penalty !== undefined) modelOptions.presencePenalty = body.presence_penalty;
     if (body.stop !== undefined) modelOptions.stop = body.stop;
 
-    // ─── Build system prompt from AI Employee ───
-    let systemPrompt = '';
-    if (config?.defaultAiEmployee) {
-      // Check role is allowed to use this employee
-      if (!checkEmployeeAccess(ctx, config.defaultAiEmployee)) {
-        ctx.status = 403;
-        ctx.body = toOpenAIError(
-          403,
-          `Role is not permitted to use AI Employee '${config.defaultAiEmployee}'. ` +
-            `An admin must grant access in Settings → Users & Permissions → [Role] → AI API.`,
-          'permission_denied',
-          'employee_not_permitted',
-        );
-        return;
-      }
-      const employee = await ctx.db.getRepository('aiEmployees').findOne({
-        filter: { username: config.defaultAiEmployee },
-      });
-      if (employee) {
-        systemPrompt = employee.about || employee.defaultPrompt || '';
-      }
-    }
-
-    // ─── Build messages (inject system prompt if not provided by client) ───
+    // Direct LLM mode ignores the default AI Employee: its prompt belongs to agent
+    // mode only. The model metadata system prompt is still applied later by
+    // prepareDirectLlmContext.
     let messages: OpenAIMessage[] = [...body.messages];
-    const hasSystemMessage = messages.some((m: any) => m.role === 'system');
-    if (systemPrompt && !hasSystemMessage) {
-      messages.unshift({ role: 'system', content: systemPrompt });
-    }
 
     // ─── Process file / file_url blocks through the file processor service ───
     messages = await Promise.all(
@@ -327,12 +302,14 @@ async function handleNonStreamingCompletion(
 
   ctx.status = 200;
   const toolCalls = normalizeToolCalls(result.tool_calls);
+  const providerFinishReason = extractFinishReason(result);
   ctx.body = toOpenAIResponse({
     id: completionId,
     model: modelName,
     content,
     usage: usage ?? { prompt_tokens: 0, completion_tokens: 0, total_tokens: 0 },
     toolCalls,
+    ...(providerFinishReason ? { finishReason: providerFinishReason } : {}),
   });
 }
 
@@ -369,8 +346,10 @@ async function handleStreamingCompletion(
 
   const requestAbort = createRequestAbortController(ctx);
   let usage: Usage | undefined;
+  let usageResponseMetadata: unknown;
   let providerRequestId: string | undefined;
-  let finishReason = 'stop';
+  let providerFinishReason: string | undefined;
+  let sawToolCalls = false;
   try {
     const stream = await chatModel.stream(messages, { ...providerRequestParameters, signal: requestAbort.signal });
 
@@ -401,7 +380,7 @@ async function handleStreamingCompletion(
       const toolCallChunks = normalizeToolCallChunks(chunk.tool_call_chunks);
       if (toolCallChunks.length) {
         markAiApiFirstProviderOutput(ctx);
-        finishReason = 'tool_calls';
+        sawToolCalls = true;
         await writeResponse(
           ctx,
           formatSSE(
@@ -414,8 +393,14 @@ async function handleStreamingCompletion(
         );
       }
       if (chunk.usage_metadata) {
-        usage = normalizeUsage(chunk.usage_metadata) ?? usage;
+        const normalized = normalizeUsage(chunk.usage_metadata);
+        if (normalized) {
+          usage = normalized;
+          usageResponseMetadata = chunk.response_metadata;
+        }
       }
+      const chunkFinishReason = extractFinishReason(chunk);
+      if (chunkFinishReason) providerFinishReason = chunkFinishReason;
       providerRequestId = providerRequestId ?? extractProviderRequestId(chunk);
     }
 
@@ -427,7 +412,7 @@ async function handleStreamingCompletion(
           id: completionId,
           model: modelName,
           delta: {},
-          finishReason,
+          finishReason: providerFinishReason ?? (sawToolCalls ? 'tool_calls' : 'stop'),
         }),
       ),
     );
@@ -447,7 +432,7 @@ async function handleStreamingCompletion(
 
     // Send [DONE]
     await writeResponse(ctx, formatSSEDone());
-    setAiApiUsageResult(ctx, usage, { gatewayResponseId: completionId, providerRequestId });
+    setAiApiUsageResult(ctx, usage, { gatewayResponseId: completionId, providerRequestId }, usageResponseMetadata);
     ctx.state.aiApiStreamResult = { succeeded: true, id: completionId };
   } catch (err) {
     const cancelled = isClientDisconnected(ctx, err);
@@ -464,7 +449,7 @@ async function handleStreamingCompletion(
         }),
       );
     }
-    setAiApiUsageResult(ctx, usage, { gatewayResponseId: completionId, providerRequestId });
+    setAiApiUsageResult(ctx, usage, { gatewayResponseId: completionId, providerRequestId }, usageResponseMetadata);
     ctx.state.aiApiStreamResult = {
       succeeded: false,
       id: completionId,
@@ -480,6 +465,24 @@ function getErrorMessage(error: unknown, fallback: string) {
   return error instanceof Error && error.message ? error.message : fallback;
 }
 
+/**
+ * Reads the provider's finish_reason from a LangChain result or stream chunk.
+ * LangChain surfaces it in response_metadata.finish_reason; some adapters put it
+ * in additional_kwargs.finish_reason instead. Returns undefined when the provider
+ * reported nothing, so callers can fall back to their own default.
+ */
+export function extractFinishReason(value: unknown): string | undefined {
+  if (!isRecord(value)) return undefined;
+  const candidates = [
+    isRecord(value.response_metadata) ? value.response_metadata.finish_reason : undefined,
+    isRecord(value.additional_kwargs) ? value.additional_kwargs.finish_reason : undefined,
+  ];
+  for (const candidate of candidates) {
+    if (typeof candidate === 'string' && candidate.length > 0) return candidate;
+  }
+  return undefined;
+}
+
 /**
  * Content block types every provider adapter in `@nocobase/plugin-ai` maps to a
  * native equivalent.

package/src/server/routes/completions.ts

@@ -23,7 +23,8 @@ import {
   isStreamingRequested,
   writeResponse,
 } from '../utils/streaming';
-import { getProviderRequestParameters, applyProviderRequestParameters } from './chat-completions';
+import { getProviderRequestParameters, applyProviderRequestParameters, extractFinishReason } from './chat-completions';
+import { getAiApiConfig } from '../utils/request-cache';
 import { extractProviderRequestId, normalizeUsage, setAiApiUsageResult, type Usage } from '../usage';
 import type PluginAiApiServer from '../plugin';
 import { AiApiQuotaError, markLlmProviderAttempted, prepareLlmBilling } from '../billing';
@@ -103,7 +104,7 @@ export async function handleCompletions(ctx: Context, plugin: PluginAiApiServer)
     }
 
     // ─── Check whitelist (global config ∩ per-user grant) ───
-    const config = await ctx.db.getRepository('aiApiConfig').findOne();
+    const config = await getAiApiConfig(ctx);
     if (!(await enforceModelAccess(ctx, config?.enabledLlmServices, service, modelId))) {
       return;
     }
@@ -134,20 +135,8 @@ export async function handleCompletions(ctx: Context, plugin: PluginAiApiServer)
           ? body.prompt.join('\n')
           : String(body.prompt);
 
-    // Inject system prompt from AI Employee if configured
-    const messages: OpenAIMessage[] = [];
-    if (config?.defaultAiEmployee) {
-      const employee = await ctx.db.getRepository('aiEmployees').findOne({
-        filter: { username: config.defaultAiEmployee },
-      });
-      if (employee) {
-        const systemPrompt = employee.about || employee.defaultPrompt || '';
-        if (systemPrompt) {
-          messages.push({ role: 'system', content: systemPrompt });
-        }
-      }
-    }
-    messages.push({ role: 'user', content: prompt });
+    // Direct LLM mode ignores the default AI Employee: its prompt belongs to agent mode only.
+    const messages: OpenAIMessage[] = [{ role: 'user', content: prompt }];
 
     const preparedContext = await prepareDirectLlmContext(ctx, {
       serviceName: service.name,
@@ -253,7 +242,7 @@ async function handleNonStreamingTextCompletion(
         text,
         index: 0,
         logprobs: null,
-        finish_reason: 'stop',
+        finish_reason: extractFinishReason(result) ?? 'stop',
       },
     ],
     usage: usage
@@ -288,7 +277,9 @@ async function handleStreamingTextCompletion(
 
   const requestAbort = createRequestAbortController(ctx);
   let usage: Usage | undefined;
+  let usageResponseMetadata: unknown;
   let providerRequestId: string | undefined;
+  let providerFinishReason: string | undefined;
   try {
     const stream = await chatModel.stream(messages, {
       ...providerRequestParameters,
@@ -329,8 +320,14 @@ async function handleStreamingTextCompletion(
         );
       }
       if (chunk.usage_metadata) {
-        usage = normalizeUsage(chunk.usage_metadata) ?? usage;
+        const normalized = normalizeUsage(chunk.usage_metadata);
+        if (normalized) {
+          usage = normalized;
+          usageResponseMetadata = chunk.response_metadata;
+        }
       }
+      const chunkFinishReason = extractFinishReason(chunk);
+      if (chunkFinishReason) providerFinishReason = chunkFinishReason;
       providerRequestId = providerRequestId ?? extractProviderRequestId(chunk);
     }
 
@@ -348,7 +345,7 @@ async function handleStreamingTextCompletion(
             text: '',
             index: 0,
             logprobs: null,
-            finish_reason: 'stop',
+            finish_reason: providerFinishReason ?? 'stop',
           },
         ],
         usage: null,
@@ -370,7 +367,7 @@ async function handleStreamingTextCompletion(
     }
 
     await writeResponse(ctx, formatSSEDone());
-    setAiApiUsageResult(ctx, usage, { gatewayResponseId: completionId, providerRequestId });
+    setAiApiUsageResult(ctx, usage, { gatewayResponseId: completionId, providerRequestId }, usageResponseMetadata);
     ctx.state.aiApiStreamResult = { succeeded: true, id: completionId };
   } catch (err) {
     const cancelled = isClientDisconnected(ctx, err);
@@ -386,7 +383,7 @@ async function handleStreamingTextCompletion(
         }),
       );
     }
-    setAiApiUsageResult(ctx, usage, { gatewayResponseId: completionId, providerRequestId });
+    setAiApiUsageResult(ctx, usage, { gatewayResponseId: completionId, providerRequestId }, usageResponseMetadata);
     ctx.state.aiApiStreamResult = {
       succeeded: false,
       id: completionId,

package/src/server/routes/embeddings.ts

@@ -11,6 +11,7 @@ import { Context } from '@nocobase/actions';
 import { toOpenAIError, toOpenAIEmbeddingsResponse } from '../utils/openai-format';
 import { resolveModelString } from '../utils/resolve-service';
 import { enforceModelAccess } from '../utils/user-permissions';
+import { getAiApiConfig } from '../utils/request-cache';
 import { setAiApiUsageUnavailable } from '../usage';
 import type PluginAiApiServer from '../plugin';
 
@@ -118,7 +119,7 @@ export async function handleEmbeddings(ctx: Context, plugin: PluginAiApiServer)
   // still enforced: an explicit deny must never be bypassed by an unreadable config.
   let globalEnabledServices: unknown = [];
   try {
-    const config = await ctx.db.getRepository('aiApiConfig').findOne();
+    const config = await getAiApiConfig(ctx);
     globalEnabledServices = config?.enabledLlmServices ?? [];
   } catch {
     // Config read failure: fail open on the global whitelist only.

package/src/server/routes/models.ts

@@ -10,6 +10,7 @@
 import { Context } from '@nocobase/actions';
 import { toOpenAIError } from '../utils/openai-format';
 import { isModelAllowed, isServiceAllowed, resolveUserAccessScope } from '../utils/user-permissions';
+import { getAiApiConfig } from '../utils/request-cache';
 import type PluginAiApiServer from '../plugin';
 
 /**
@@ -20,8 +21,8 @@ import type PluginAiApiServer from '../plugin';
  * so clients can copy-paste the ID directly into POST /v1/chat/completions
  * without needing to configure a defaultLlmService.
  *
- * The catalog is scoped to the caller: a user with an aiApiUserPermissions row only
- * sees the intersection of the global whitelist and their own grant.
+ * The catalog is scoped to the caller: it starts from the global whitelist and is
+ * narrowed by the caller's usage group settings (allowedLlmServices / allowedModels).
  *
  * Backward compatibility: resolveModelString() in resolve-service.ts still
  * accepts bare model IDs via its 3-tier fallback (defaultLlmService / single service).
@@ -251,7 +252,7 @@ function toPositiveInt(value: unknown): number | null {
 }
 
 async function getPluginConfig(ctx: Context) {
-  return ctx.db.getRepository('aiApiConfig').findOne();
+  return getAiApiConfig(ctx);
 }
 
 /**

package/src/server/routes/router.ts

@@ -20,6 +20,7 @@ import { createRateLimitMiddleware } from '../middleware/rate-limit';
 import { checkRolePermission } from '../middleware/role-permission';
 import { startUsageRecord, finishUsageRecord } from '../usage';
 import { isStreamingRequested } from '../utils/streaming';
+import { getAiApiConfig } from '../utils/request-cache';
 import type PluginAiApiServer from '../plugin';
 import { finalizeLlmBilling } from '../billing';
 import { finishAiApiObservation, startAiApiObservation } from '../utils/app-observability';
@@ -43,7 +44,7 @@ type DataWrappingContext = Context & { withoutDataWrapping?: boolean };
  * - OPTIONS preflight handling (204)
  * - X-Request-Id on every response
  * - Bearer token authentication
- * - Sliding window rate limiting (enforces rateLimitPerMinute from config)
+ * - Sliding window rate limiting (enforces rateLimitPerMinute from the user's usage group)
  * - Structured request logging via app.logger
  *
  * Supported endpoints:
@@ -353,7 +354,7 @@ export function normalizeMaxRequestBodyMb(value: unknown): number {
 async function resolveMaxBodyBytes(ctx: Context): Promise<number> {
   let configuredMb: unknown;
   try {
-    const config = await ctx.db.getRepository('aiApiConfig').findOne();
+    const config = await getAiApiConfig(ctx);
     configuredMb = config?.get('maxRequestBodyMb');
   } catch (err) {
     ctx.log?.warn?.('AI API: could not read maxRequestBodyMb, using default:', err);
@@ -431,7 +432,7 @@ async function resolveMode(ctx: Context): Promise<'llm' | 'agent'> {
   }
 
   try {
-    const config = await ctx.db.getRepository('aiApiConfig').findOne();
+    const config = await getAiApiConfig(ctx);
     if (config) {
       const dbMode = config.get('mode') || config.mode;
       if (dbMode === 'agent' || dbMode === 'llm') {