plugin-ai-api 1.0.25 → 1.1.0

package/dist/server/utils/user-permissions.js

@@ -28,73 +28,60 @@ var user_permissions_exports = {};
 __export(user_permissions_exports, {
   buildAccessScope: () => buildAccessScope,
   enforceModelAccess: () => enforceModelAccess,
-  invalidateUserPermissionCache: () => invalidateUserPermissionCache,
+  invalidateGroupAccessCache: () => invalidateGroupAccessCache,
   isModelAllowed: () => isModelAllowed,
   isServiceAllowed: () => isServiceAllowed,
   resolveUserAccessScope: () => resolveUserAccessScope
 });
 module.exports = __toCommonJS(user_permissions_exports);
 var import_openai_format = require("./openai-format");
+var import_request_cache = require("./request-cache");
 const SCOPE_TTL_MS = 15e3;
 const scopeCache = /* @__PURE__ */ new Map();
-const NO_RECORD_SCOPE = {
-  hasUserRecord: false,
-  denyAll: false,
-  allowedServices: null,
+const OPEN_SCOPE = {
+  allowedServices: [],
   allowAllModels: true,
   allowedModels: /* @__PURE__ */ new Set(),
   lookupFailed: false
 };
-const LOOKUP_FAILED_SCOPE = { ...NO_RECORD_SCOPE, denyAll: true, lookupFailed: true };
-function invalidateUserPermissionCache(userId) {
-  if (userId === void 0 || userId === null) {
+const LOOKUP_FAILED_SCOPE = { ...OPEN_SCOPE, lookupFailed: true };
+function invalidateGroupAccessCache(groupId) {
+  if (groupId === void 0 || groupId === null) {
     scopeCache.clear();
     return;
   }
-  const suffix = `:${userId}`;
+  const suffix = `:group:${groupId}`;
   for (const key of scopeCache.keys()) {
     if (key.endsWith(suffix)) scopeCache.delete(key);
   }
 }
-function valueOf(row, name) {
-  if (!row) return void 0;
-  const candidate = row;
-  if (typeof candidate.get === "function") return candidate.get(name);
-  return row[name];
-}
 function toStringArray(value) {
   if (!Array.isArray(value)) return [];
   return value.filter((item) => typeof item === "string" && item.length > 0);
 }
-function buildAccessScope(row) {
-  if (!row) return NO_RECORD_SCOPE;
-  if (valueOf(row, "enabled") === false) {
-    return { ...NO_RECORD_SCOPE, hasUserRecord: true, denyAll: true, allowedServices: [] };
-  }
+function buildAccessScope(group) {
   return {
-    hasUserRecord: true,
-    denyAll: false,
-    allowedServices: toStringArray(valueOf(row, "allowedLlmServices")),
-    allowAllModels: valueOf(row, "allowAllModels") !== false,
-    allowedModels: new Set(toStringArray(valueOf(row, "allowedModels"))),
+    groupId: group.id,
+    allowedServices: toStringArray(group.allowedLlmServices),
+    allowAllModels: group.allowAllModels !== false,
+    allowedModels: new Set(toStringArray(group.allowedModels)),
     lookupFailed: false
   };
 }
 async function resolveUserAccessScope(ctx) {
   var _a, _b, _c, _d;
   const userId = (_a = ctx.state.currentUser) == null ? void 0 : _a.id;
-  if (userId === void 0 || userId === null) return NO_RECORD_SCOPE;
-  const key = `${((_b = ctx.app) == null ? void 0 : _b.name) ?? "main"}:${userId}`;
-  const cached = scopeCache.get(key);
-  if (cached && cached.expiresAt > Date.now()) return cached.scope;
-  let scope;
+  let group;
   try {
-    const row = await ctx.db.getRepository("aiApiUserPermissions").findOne({ filter: { userId } });
-    scope = buildAccessScope(row);
+    group = await (0, import_request_cache.resolveRequestUserGroup)(ctx, userId);
   } catch (err) {
-    (_d = (_c = ctx.log) == null ? void 0 : _c.error) == null ? void 0 : _d.call(_c, "AI API user permissions lookup failed, denying access:", err);
+    (_c = (_b = ctx.log) == null ? void 0 : _b.error) == null ? void 0 : _c.call(_b, "AI API group access lookup failed, denying access:", err);
     return LOOKUP_FAILED_SCOPE;
   }
+  const key = `${((_d = ctx.app) == null ? void 0 : _d.name) ?? "main"}:group:${group.id}`;
+  const cached = scopeCache.get(key);
+  if (cached && cached.expiresAt > Date.now()) return cached.scope;
+  const scope = buildAccessScope(group);
   scopeCache.set(key, { scope, expiresAt: Date.now() + SCOPE_TTL_MS });
   return scope;
 }
@@ -102,15 +89,14 @@ function matchesService(list, serviceName, serviceTitle) {
   return list.some((entry) => entry === serviceName || entry === serviceTitle);
 }
 function isServiceAllowed(scope, globalEnabledServices, service) {
-  if (scope.denyAll) return false;
+  if (scope.lookupFailed) return false;
   const globalList = toStringArray(globalEnabledServices);
   if (globalList.length && !matchesService(globalList, service.name, service.title)) return false;
-  if (!scope.hasUserRecord) return true;
-  return matchesService(scope.allowedServices ?? [], service.name, service.title);
+  if (!scope.allowedServices.length) return true;
+  return matchesService(scope.allowedServices, service.name, service.title);
 }
 function isModelAllowed(scope, fullModelId) {
-  if (scope.denyAll) return false;
-  if (!scope.hasUserRecord) return true;
+  if (scope.lookupFailed) return false;
   if (scope.allowAllModels) return true;
   return scope.allowedModels.has(fullModelId);
 }
@@ -153,7 +139,7 @@ async function enforceModelAccess(ctx, globalEnabledServices, service, modelId)
 0 && (module.exports = {
   buildAccessScope,
   enforceModelAccess,
-  invalidateUserPermissionCache,
+  invalidateGroupAccessCache,
   isModelAllowed,
   isServiceAllowed,
   resolveUserAccessScope

package/dist/server/validation.js

@@ -88,6 +88,10 @@ function validateModelMetadata(model) {
   if (!String(model.get("model") ?? "").trim()) throw new Error("model is required.");
   requirePositiveIntegerOrNull(model.get("contextWindow"), "contextWindow");
   requirePositiveIntegerOrNull(model.get("maxCompletionTokens"), "maxCompletionTokens");
+  const systemPrompt = model.get("systemPrompt");
+  if (systemPrompt !== null && systemPrompt !== void 0 && typeof systemPrompt !== "string") {
+    throw new Error("systemPrompt must be a string.");
+  }
   const contextWindow = model.get("contextWindow");
   const maxCompletionTokens = model.get("maxCompletionTokens");
   if (contextWindow !== null && contextWindow !== void 0 && contextWindow !== "" && maxCompletionTokens !== null && maxCompletionTokens !== void 0 && maxCompletionTokens !== "" && Number(maxCompletionTokens) > Number(contextWindow)) {
@@ -98,6 +102,9 @@ function validateQuotaPolicy(model) {
   if (!["daily", "monthly"].includes(String(model.get("periodType")))) {
     throw new Error("periodType must be daily or monthly.");
   }
+  if (!["share", "per_user"].includes(String(model.get("quotaMode")))) {
+    throw new Error("quotaMode must be share or per_user.");
+  }
   if (!["allow", "use_reserved"].includes(String(model.get("missingUsageBehavior")))) {
     throw new Error("missingUsageBehavior must be allow or use_reserved.");
   }

package/dist/swagger.js

@@ -78,7 +78,7 @@ var swagger_default = {
       get: {
         tags: ["ai-llm"],
         summary: "List available models",
-        description: "Returns the LLM models available to the authenticated caller across registered services. Model IDs are formatted as `serviceName/modelId`.\n\nThe catalog is user-scoped: it starts from `enabledLlmServices` in the AI API configuration, then narrows to the caller's `aiApiUserPermissions` record when one exists. A user grant can only narrow the global whitelist, never widen it, so two users may receive different lists from the same request.",
+        description: "Returns the LLM models available to the authenticated caller across registered services. Model IDs are formatted as `serviceName/modelId`.\n\nThe catalog is user-scoped: it starts from `enabledLlmServices` in the AI API configuration, then narrows to the caller's usage group settings (`allowedLlmServices` / `allowedModels`). Group settings can only narrow the global whitelist, never widen it, so two users may receive different lists from the same request.",
         security: [{ BearerAuth: [] }],
         responses: {
           200: {
@@ -268,16 +268,15 @@ var swagger_default = {
             enum: ["llm", "agent"],
             description: "Default AI mode"
           },
-          defaultAiEmployee: { type: "string", description: "Default AI employee name" },
+          defaultAiEmployee: {
+            type: "string",
+            description: "Default AI employee name (agent mode only; direct LLM mode ignores it)"
+          },
           defaultLlmService: { type: "string", description: "Default LLM service name" },
           enabledLlmServices: {
             type: "array",
             items: { type: "string" },
-            description: "List of enabled LLM service names. This is the outer bound for every caller; per-user `aiApiUserPermissions` records can only narrow it further."
-          },
-          rateLimitPerMinute: {
-            type: "integer",
-            description: "Max requests per minute per user (0 = unlimited)"
+            description: "List of enabled LLM service names. This is the outer bound for every caller; usage group settings can only narrow it further."
           },
           maxRequestBodyMb: {
             type: "integer",

package/package.json

@@ -1,6 +1,6 @@
 {
   "name": "plugin-ai-api",
-  "version": "1.0.25",
+  "version": "1.1.0",
   "main": "dist/server/index.js",
   "dependencies": {},
   "peerDependencies": {

package/src/client/__tests__/settings-registration.test.tsx

@@ -9,7 +9,7 @@
 
 import { Application } from '@nocobase/client';
 import { describe, expect, it } from 'vitest';
-import { AI_API_ACL_SNIPPET, AI_API_USER_PERMISSIONS_SNIPPET } from '../../constants';
+import { AI_API_ACL_SNIPPET } from '../../constants';
 import { PluginAiApiClient } from '../plugin';
 
 describe('AI API v1 settings registration', () => {
@@ -29,41 +29,18 @@ describe('AI API v1 settings registration', () => {
       'ai-api.config',
       'ai-api.model-pricing',
       'ai-api.model-metadata',
-      'ai-api.user-permissions',
-      'ai-api.user-quotas',
+      'ai-api.usage-groups',
       'ai-api.usage',
     ]);
-    expect(app.pluginSettingsManager.getAclSnippet('ai-api.user-permissions')).toBe(AI_API_USER_PERMISSIONS_SNIPPET);
-    expect(app.pluginSettingsManager.getRoutePath('ai-api.user-permissions')).toBe(
-      '/admin/settings/ai-api/user-permissions',
-    );
-    expect(app.pluginSettingsManager.getList().map((item) => item.name)).not.toContain('ai-api-user-permissions');
+    for (const child of menu?.children ?? []) {
+      expect(app.pluginSettingsManager.getAclSnippet(child.name), child.name).toBe(AI_API_ACL_SNIPPET);
+    }
   });
 
-  it('requires access to the legacy parent before exposing the user permissions tab', async () => {
+  it('hides the whole settings surface when the snippet is denied', async () => {
     const app = await loadPlugin();
     app.pluginSettingsManager.setAclSnippets([`!${AI_API_ACL_SNIPPET}`]);
 
     expect(app.pluginSettingsManager.getList()).toEqual([]);
   });
-
-  it('hides only the user permissions tab when its own snippet is denied', async () => {
-    const app = await loadPlugin();
-    app.pluginSettingsManager.setAclSnippets([`!${AI_API_USER_PERMISSIONS_SNIPPET}`]);
-
-    expect(app.pluginSettingsManager.get('ai-api')?.children?.map((item) => item.name)).toEqual([
-      'ai-api.config',
-      'ai-api.model-pricing',
-      'ai-api.model-metadata',
-      'ai-api.user-quotas',
-      'ai-api.usage',
-    ]);
-  });
-
-  it('hides both settings surfaces when both snippets are denied', async () => {
-    const app = await loadPlugin();
-    app.pluginSettingsManager.setAclSnippets([`!${AI_API_ACL_SNIPPET}`, `!${AI_API_USER_PERMISSIONS_SNIPPET}`]);
-
-    expect(app.pluginSettingsManager.getList()).toEqual([]);
-  });
 });

package/src/client/plugin.tsx

@@ -9,14 +9,13 @@
 
 import { Plugin, lazy } from '@nocobase/client';
 import PluginACLClient from '@nocobase/plugin-acl/client';
-import { AI_API_ACL_SNIPPET, AI_API_USER_PERMISSIONS_SNIPPET } from '../constants';
+import { AI_API_ACL_SNIPPET } from '../constants';
 import React from 'react';
 
 const AiApiConfigPage = React.lazy(() => import('../client-v2/pages/GeneralPage'));
 const AiApiModelPricingPage = React.lazy(() => import('../client-v2/pages/ModelPricingPage'));
 const AiApiModelMetadataPage = React.lazy(() => import('../client-v2/pages/ModelMetadataPage'));
-const AiApiUserPermissionsPage = React.lazy(() => import('../client-v2/pages/UserPermissionsPage'));
-const AiApiUserQuotasPage = React.lazy(() => import('../client-v2/pages/UserQuotasPage'));
+const AiApiUsageGroupsPage = React.lazy(() => import('../client-v2/pages/UsageGroupsPage'));
 const AiApiUsagePage = React.lazy(() => import('../client-v2/pages/UsagePage'));
 const { AiApiRolePermissions } = lazy(() => import('./components/AiApiRolePermissions'), 'AiApiRolePermissions');
 
@@ -49,19 +48,9 @@ export class PluginAiApiClient extends Plugin {
       sort: 3,
     });
 
-    // Keep the legacy settings layout aligned with client-v2. The v1 settings
-    // manager evaluates the parent ACL first, so this tab additionally requires
-    // access to the AI API settings parent even though it keeps its own snippet.
-    this.app.pluginSettingsManager.add('ai-api.user-permissions', {
-      title: this.t('User LLM permissions'),
-      Component: AiApiUserPermissionsPage,
-      aclSnippet: AI_API_USER_PERMISSIONS_SNIPPET,
-      sort: 4,
-    });
-
-    this.app.pluginSettingsManager.add('ai-api.user-quotas', {
-      title: this.t('User quotas'),
-      Component: AiApiUserQuotasPage,
+    this.app.pluginSettingsManager.add('ai-api.usage-groups', {
+      title: this.t('Usage groups'),
+      Component: AiApiUsageGroupsPage,
       aclSnippet: AI_API_ACL_SNIPPET,
       sort: 5,
     });

package/src/client-v2/__tests__/settings-registration.test.tsx

@@ -8,7 +8,7 @@
  */
 
 import { createMockClient } from '@nocobase/client-v2';
-import { AI_API_ACL_SNIPPET, AI_API_USER_PERMISSIONS_SNIPPET } from '../../constants';
+import { AI_API_ACL_SNIPPET } from '../../constants';
 import { PluginAiApiClient } from '../plugin';
 
 /**
@@ -18,10 +18,8 @@ import { PluginAiApiClient } from '../plugin';
  * omitting `aclSnippet` makes addPageTabItem default to `pm.ai-api.<key>`, a snippet the
  * server never registers, and omitting `sort` silently reorders the tabs alphabetically.
  *
- * The tabs deliberately span two snippets: everything sits under AI_API_ACL_SNIPPET except
- * user permissions, which is gated separately so granting it does not also grant gateway
- * configuration. Each snippet is evaluated independently, so denying one leaves the other's
- * tabs — and therefore the menu — reachable.
+ * Every tab sits under AI_API_ACL_SNIPPET — model access is managed on the usage groups
+ * page, so there is no longer a separately-gated permissions tab.
  */
 describe('AI API v2 settings registration', () => {
   async function loadPlugin() {
@@ -36,41 +34,18 @@ describe('AI API v2 settings registration', () => {
 
     expect(menu?.aclSnippet).toBe(AI_API_ACL_SNIPPET);
     for (const child of menu?.children ?? []) {
-      expect(app.pluginSettingsManager.getAclSnippet(child.name), child.name).toBe(
-        child.name === 'ai-api.user-permissions' ? AI_API_USER_PERMISSIONS_SNIPPET : AI_API_ACL_SNIPPET,
-      );
+      expect(app.pluginSettingsManager.getAclSnippet(child.name), child.name).toBe(AI_API_ACL_SNIPPET);
     }
   });
 
-  it('leaves only the separately-gated tab when the main snippet is denied', async () => {
+  it('hides the menu and every tab when the snippet is denied', async () => {
     const app = await loadPlugin();
     app.pluginSettingsManager.setAclSnippets([`!${AI_API_ACL_SNIPPET}`]);
 
-    // User permissions carries its own snippet, so it survives on its own merit and keeps the
-    // menu reachable. That separation is the point: a role can be allowed to hand out model
-    // access without also being allowed to reconfigure the gateway.
-    expect(app.pluginSettingsManager.get('ai-api')?.children?.map((item) => item.name)).toEqual([
-      'ai-api.user-permissions',
-    ]);
-  });
-
-  it('hides the menu and every tab when both snippets are denied', async () => {
-    const app = await loadPlugin();
-    app.pluginSettingsManager.setAclSnippets([`!${AI_API_ACL_SNIPPET}`, `!${AI_API_USER_PERMISSIONS_SNIPPET}`]);
-
     expect(app.pluginSettingsManager.get('ai-api')).toBeNull();
     expect(app.pluginSettingsManager.getList().map((item) => item.name)).not.toContain('ai-api');
   });
 
-  it('hides only the user permissions tab when its own snippet is denied', async () => {
-    const app = await loadPlugin();
-    app.pluginSettingsManager.setAclSnippets([`!${AI_API_USER_PERMISSIONS_SNIPPET}`]);
-
-    const children = app.pluginSettingsManager.get('ai-api')?.children?.map((item) => item.name) ?? [];
-    expect(children).not.toContain('ai-api.user-permissions');
-    expect(children).toContain('ai-api.user-quotas');
-  });
-
   it('keeps registration order instead of sorting tabs by name', async () => {
     const app = await loadPlugin();
     app.pluginSettingsManager.setAclSnippets([]);
@@ -79,8 +54,7 @@ describe('AI API v2 settings registration', () => {
       'ai-api.index',
       'ai-api.model-pricing',
       'ai-api.model-metadata',
-      'ai-api.user-permissions',
-      'ai-api.user-quotas',
+      'ai-api.usage-groups',
       'ai-api.usage',
     ]);
   });

package/src/client-v2/locale.ts

@@ -7,13 +7,15 @@
  * For more information, please refer to: https://www.nocobase.com/agreement.
  */
 
+import { useCallback } from 'react';
 import { tExpr as _tExpr, useFlowEngine } from '@nocobase/flow-engine';
 // @ts-ignore
 import pkg from './../../package.json';
 
 export function useT() {
   const engine = useFlowEngine();
-  return (str: string) => engine.context.t(str, { ns: [pkg.name, 'client'] });
+  // Stable identity so callers can safely list `t` in hook dependency arrays.
+  return useCallback((str: string) => engine.context.t(str, { ns: [pkg.name, 'client'] }), [engine]);
 }
 
 export function tExpr(key: string) {

package/src/client-v2/pages/GeneralPage.tsx

@@ -9,7 +9,6 @@ interface GeneralSettings {
   defaultAiEmployee?: string;
   defaultLlmService?: string;
   enabledLlmServices: string[];
-  rateLimitPerMinute: number;
   maxRequestBodyMb: number;
   quotaEnabled: boolean;
   defaultReservationOutputTokens: number;
@@ -28,7 +27,6 @@ interface AiEmployee {
 const defaults: GeneralSettings = {
   mode: 'llm',
   enabledLlmServices: [],
-  rateLimitPerMinute: 60,
   maxRequestBodyMb: 10,
   quotaEnabled: false,
   defaultReservationOutputTokens: 4096,
@@ -123,9 +121,6 @@ export default function GeneralPage() {
             />
           </Form.Item>
         ) : null}
-        <Form.Item name="rateLimitPerMinute" label={t('Rate Limit')} rules={[{ required: true }]}>
-          <InputNumber min={1} style={{ width: '100%' }} />
-        </Form.Item>
         <Form.Item
           name="maxRequestBodyMb"
           label={t('Max request body size (MB)')}

package/src/client-v2/pages/ModelMetadataPage.tsx

@@ -28,6 +28,7 @@ interface ModelMetadata {
   ownedByOverride?: string | null;
   displayName?: string | null;
   description?: string | null;
+  systemPrompt?: string | null;
   enabled: boolean;
 }
 
@@ -136,6 +137,7 @@ export default function ModelMetadataPage() {
       ownedByOverride: values.ownedByOverride?.trim() || null,
       displayName: values.displayName?.trim() || null,
       description: values.description?.trim() || null,
+      systemPrompt: values.systemPrompt?.trim() || null,
     };
     setSaving(true);
     try {
@@ -171,6 +173,14 @@ export default function ModelMetadataPage() {
     { title: t('Max completion tokens'), dataIndex: 'maxCompletionTokens', key: 'maxCompletionTokens', width: 170 },
     { title: t('Owned by'), dataIndex: 'ownedByOverride', key: 'ownedByOverride', width: 140 },
     { title: t('Display name'), dataIndex: 'displayName', key: 'displayName', width: 160 },
+    {
+      title: t('Initial system prompt'),
+      dataIndex: 'systemPrompt',
+      key: 'systemPrompt',
+      width: 220,
+      ellipsis: true,
+      render: (value?: string | null) => value || '-',
+    },
     {
       title: t('Status'),
       dataIndex: 'enabled',
@@ -209,7 +219,7 @@ export default function ModelMetadataPage() {
         </Button>
       }
     >
-      <Table rowKey="id" columns={columns} dataSource={rows} loading={loading} scroll={{ x: 1200 }} />
+      <Table rowKey="id" columns={columns} dataSource={rows} loading={loading} scroll={{ x: 1450 }} />
       <Modal
         title={editing ? t('Edit override') : t('Add override')}
         open={open}
@@ -270,6 +280,15 @@ export default function ModelMetadataPage() {
           <Form.Item name="description" label={t('Description')}>
             <Input.TextArea rows={3} />
           </Form.Item>
+          <Form.Item
+            name="systemPrompt"
+            label={t('Initial system prompt')}
+            tooltip={t(
+              'Prepended as the first system message, before any system prompt sent by the client. If the client sends no system prompt, this becomes the system prompt sent to the provider.',
+            )}
+          >
+            <Input.TextArea rows={4} placeholder={t('Leave empty to not override')} />
+          </Form.Item>
           <Form.Item name="enabled" label={t('Enabled')} valuePropName="checked">
             <Switch />
           </Form.Item>