plugin-ai-api 1.0.25 → 1.1.0

package/src/locale/vi-VN.json

@@ -99,6 +99,8 @@
   "Leave empty to not override": "Để trống nếu không override",
   "Total input + output token capacity reported to clients.": "Tổng dung lượng token (input + output) trả về cho client.",
   "Maximum output tokens reported to clients.": "Số token output tối đa trả về cho client.",
+  "Initial system prompt": "System prompt khởi tạo",
+  "Prepended as the first system message, before any system prompt sent by the client. If the client sends no system prompt, this becomes the system prompt sent to the provider.": "Được thêm vào làm system message đầu tiên, đứng trước mọi system prompt mà client gửi sang. Nếu client không gửi system prompt, đây sẽ là system prompt được gửi tới provider.",
   "AI API": "AI API",
   "Allow this role to use the AI API": "Cho phép vai trò này sử dụng AI API",
   "Allow all AI Employees": "Cho phép tất cả AI Employee",
@@ -106,15 +108,31 @@
   "Select allowed AI Employees": "Chọn AI Employee được phép",
   "Max request body size (MB)": "Giới hạn kích thước request body (MB)",
   "Raise this to accept inline base64 images. Base64 adds about 33% to the original file size.": "Tăng giá trị này để nhận ảnh base64 gửi trực tiếp. Base64 làm tăng khoảng 33% so với kích thước tệp gốc.",
-  "User LLM permissions": "Phân quyền LLM theo người dùng",
-  "Add permission": "Thêm phân quyền",
-  "Edit permission": "Sửa phân quyền",
-  "Delete this permission?": "Xoá phân quyền này?",
+  "Usage groups": "Nhóm usage",
+  "Add group": "Thêm nhóm",
+  "Edit group": "Sửa nhóm",
+  "Delete this group?": "Xóa nhóm này?",
+  "Mode": "Chế độ",
+  "Share": "Chia sẻ",
+  "Per user": "Theo người dùng",
+  "Rate limit per minute": "Giới hạn request/phút",
+  "Members": "Thành viên",
+  "Add member": "Thêm thành viên",
+  "Member added": "Đã thêm thành viên",
+  "Member removed": "Đã xóa thành viên",
+  "Remove member?": "Xóa thành viên?",
+  "Remove": "Xóa",
+  "Search group by user": "Tìm nhóm theo người dùng",
+  "User belongs to": "Người dùng thuộc nhóm",
+  "User not found": "Không tìm thấy người dùng",
+  "Default": "Mặc định",
   "Allowed LLM services": "Dịch vụ LLM được phép",
   "Allow all models": "Cho phép tất cả model",
   "Allowed models": "Model được phép",
-  "No service allowed": "Không được phép dịch vụ nào",
-  "All models of allowed services": "Tất cả model của các dịch vụ được phép",
-  "Users listed here are limited to the services selected below. Users without a record fall back to the general configuration.": "Người dùng có trong danh sách này chỉ được dùng các dịch vụ được chọn bên dưới. Người dùng không có bản ghi sẽ dùng theo cấu hình chung.",
-  "Only services also enabled in the general configuration take effect.": "Chỉ những dịch vụ đồng thời được bật trong cấu hình chung mới có hiệu lực."
+  "Model access": "Quyền truy cập model",
+  "All models": "Tất cả model",
+  "All services": "Tất cả dịch vụ",
+  "No models": "Không model nào",
+  "Leave empty to allow every service enabled in the general configuration.": "Để trống để cho phép mọi dịch vụ đang được bật trong cấu hình chung.",
+  "Users who do not belong to any other group automatically use this default group — no need to add members.": "Người dùng không thuộc nhóm nào khác sẽ tự động dùng nhóm mặc định này — không cần thêm thành viên."
 }

package/src/locale/zh-CN.json

@@ -99,6 +99,8 @@
   "Leave empty to not override": "留空则不覆盖",
   "Total input + output token capacity reported to clients.": "返回给客户端的输入+输出 token 总容量。",
   "Maximum output tokens reported to clients.": "返回给客户端的最大输出 token 数。",
+  "Initial system prompt": "初始系统提示词",
+  "Prepended as the first system message, before any system prompt sent by the client. If the client sends no system prompt, this becomes the system prompt sent to the provider.": "作为第一条 system 消息插入到客户端发送的任何 system 提示词之前。如果客户端未发送 system 提示词，此提示词将作为发送给提供商的 system 提示词。",
   "AI API": "AI API",
   "Allow this role to use the AI API": "允许此角色使用 AI API",
   "Allow all AI Employees": "允许所有 AI 员工",
@@ -106,15 +108,31 @@
   "Select allowed AI Employees": "选择允许的 AI 员工",
   "Max request body size (MB)": "请求体大小上限（MB）",
   "Raise this to accept inline base64 images. Base64 adds about 33% to the original file size.": "调高此值以接收内联 base64 图片。base64 编码会使体积增加约 33%。",
-  "User LLM permissions": "用户 LLM 权限",
-  "Add permission": "添加权限",
-  "Edit permission": "编辑权限",
-  "Delete this permission?": "确定删除此权限？",
+  "Usage groups": "用量组",
+  "Add group": "添加分组",
+  "Edit group": "编辑分组",
+  "Delete this group?": "删除此分组？",
+  "Mode": "模式",
+  "Share": "共享",
+  "Per user": "按用户",
+  "Rate limit per minute": "每分钟速率限制",
+  "Members": "成员",
+  "Add member": "添加成员",
+  "Member added": "成员已添加",
+  "Member removed": "成员已移除",
+  "Remove member?": "移除成员？",
+  "Remove": "移除",
+  "Search group by user": "按用户搜索分组",
+  "User belongs to": "用户属于",
+  "User not found": "未找到用户",
+  "Default": "默认",
   "Allowed LLM services": "允许的 LLM 服务",
   "Allow all models": "允许所有模型",
   "Allowed models": "允许的模型",
-  "No service allowed": "未允许任何服务",
-  "All models of allowed services": "允许服务下的所有模型",
-  "Users listed here are limited to the services selected below. Users without a record fall back to the general configuration.": "此处列出的用户仅能使用下方所选的服务；没有记录的用户按通用配置处理。",
-  "Only services also enabled in the general configuration take effect.": "仅当服务同时在通用配置中启用时才会生效。"
+  "Model access": "模型访问",
+  "All models": "所有模型",
+  "All services": "所有服务",
+  "No models": "未允许任何模型",
+  "Leave empty to allow every service enabled in the general configuration.": "留空则允许通用配置中已启用的所有服务。",
+  "Users who do not belong to any other group automatically use this default group — no need to add members.": "不属于其他分组的用户会自动使用此默认分组，无需手动添加成员。"
 }

package/src/server/__tests__/billing-quota.test.ts

@@ -3,7 +3,7 @@ import { createMockDatabase, type Database } from '@nocobase/database';
 import { afterEach, beforeEach, describe, expect, it } from 'vitest';
 import { AiApiQuotaError, finalizeLlmBilling, markLlmProviderAttempted, prepareLlmBilling } from '../billing';
 
-describe('AI API user quota reservation', () => {
+describe('AI API group quota reservation', () => {
   let db: Database;
 
   beforeEach(async () => {
@@ -30,9 +30,12 @@ describe('AI API user quota reservation', () => {
       ],
     });
     db.collection({
-      name: 'aiApiUserQuotaPolicies',
+      name: 'aiApiUsageGroups',
       fields: [
-        { name: 'userId', type: 'bigInt' },
+        { name: 'name', type: 'string' },
+        { name: 'isDefault', type: 'boolean' },
+        { name: 'quotaMode', type: 'string' },
+        { name: 'rateLimitPerMinute', type: 'integer' },
         { name: 'enabled', type: 'boolean' },
         { name: 'periodType', type: 'string' },
         { name: 'timezone', type: 'string' },
@@ -42,12 +45,21 @@ describe('AI API user quota reservation', () => {
         { name: 'currency', type: 'string' },
         { name: 'rejectUnpricedModel', type: 'boolean' },
         { name: 'missingUsageBehavior', type: 'string' },
+        { name: 'contextOverflowBehavior', type: 'string' },
       ],
     });
     db.collection({
-      name: 'aiApiUserQuotaBuckets',
+      name: 'aiApiGroupMembers',
       fields: [
-        { name: 'policyId', type: 'bigInt' },
+        { name: 'groupId', type: 'bigInt' },
+        { name: 'userId', type: 'bigInt' },
+      ],
+      indexes: [{ fields: ['userId'], unique: true }],
+    });
+    db.collection({
+      name: 'aiApiGroupQuotaBuckets',
+      fields: [
+        { name: 'groupId', type: 'bigInt' },
         { name: 'userId', type: 'bigInt' },
         { name: 'periodStart', type: 'datetimeTz' },
         { name: 'periodEnd', type: 'datetimeTz' },
@@ -58,7 +70,7 @@ describe('AI API user quota reservation', () => {
         { name: 'reservedTokens', type: 'bigInt' },
         { name: 'reservedCost', type: 'decimal', precision: 20, scale: 8 },
       ],
-      indexes: [{ fields: ['policyId', 'periodStart'], unique: true }],
+      indexes: [{ fields: ['groupId', 'userId', 'periodStart'], unique: true }],
     });
     await db.sync({ force: true });
     await db.getRepository('aiApiConfig').create({
@@ -76,9 +88,12 @@ describe('AI API user quota reservation', () => {
         effectiveFrom: new Date('2020-01-01T00:00:00Z'),
       },
     });
-    await db.getRepository('aiApiUserQuotaPolicies').create({
+    const group = await db.getRepository('aiApiUsageGroups').create({
       values: {
-        userId: 7,
+        name: 'Default',
+        isDefault: true,
+        quotaMode: 'per_user',
+        rateLimitPerMinute: 60,
         enabled: true,
         periodType: 'monthly',
         timezone: 'UTC',
@@ -88,8 +103,12 @@ describe('AI API user quota reservation', () => {
         currency: 'USD',
         rejectUnpricedModel: true,
         missingUsageBehavior: 'use_reserved',
+        contextOverflowBehavior: 'reject',
       },
     });
+    await db.getRepository('aiApiGroupMembers').create({
+      values: { groupId: group.get('id'), userId: 7 },
+    });
   });
 
   afterEach(async () => {
@@ -126,7 +145,7 @@ describe('AI API user quota reservation', () => {
     );
     expect(finalized).toMatchObject({ estimatedCost: '0.00012500', costStatus: 'calculated' });
 
-    const bucket = await db.getRepository('aiApiUserQuotaBuckets').findOne();
+    const bucket = await db.getRepository('aiApiGroupQuotaBuckets').findOne();
     expect(String(bucket?.get('requestCount'))).toBe('1');
     expect(String(bucket?.get('totalTokens'))).toBe('15');
     expect(String(bucket?.get('reservedRequests'))).toBe('0');

package/src/server/__tests__/direct-llm-context.test.ts

@@ -17,11 +17,33 @@ function context({ behavior = 'reject', metadata = { contextWindow: 120, maxComp
             findOne: vi.fn().mockResolvedValue({ get: (key: string) => metadata[key as keyof typeof metadata] }),
           };
         }
-        if (name === 'aiApiUserQuotaPolicies') {
+        if (name === 'aiApiGroupMembers') {
           return {
-            findOne: vi
-              .fn()
-              .mockResolvedValue({ get: (key: string) => (key === 'contextOverflowBehavior' ? behavior : undefined) }),
+            findOne: vi.fn().mockResolvedValue(null),
+          };
+        }
+        if (name === 'aiApiUsageGroups') {
+          return {
+            findOne: vi.fn().mockResolvedValue({
+              get: (key?: string) => {
+                const record: Record<string, unknown> = {
+                  id: 1,
+                  name: 'Default',
+                  isDefault: true,
+                  quotaMode: 'per_user',
+                  rateLimitPerMinute: 60,
+                  enabled: true,
+                  periodType: 'monthly',
+                  timezone: 'UTC',
+                  currency: 'USD',
+                  rejectUnpricedModel: true,
+                  missingUsageBehavior: 'use_reserved',
+                  contextOverflowBehavior: behavior,
+                };
+                if (!key) return record;
+                return record[key];
+              },
+            }),
           };
         }
         return { findOne: vi.fn() };
@@ -67,6 +89,33 @@ describe('direct LLM context preparation', () => {
           findOne: vi.fn().mockResolvedValue({ get: (key: string) => (key === 'contextWindow' ? 120 : 40) }),
         } as never;
       }
+      if (name === 'aiApiGroupMembers') {
+        return { findOne: vi.fn().mockResolvedValue(null) } as never;
+      }
+      if (name === 'aiApiUsageGroups') {
+        return {
+          findOne: vi.fn().mockResolvedValue({
+            get: (key?: string) => {
+              const record: Record<string, unknown> = {
+                id: 1,
+                name: 'Default',
+                isDefault: true,
+                quotaMode: 'per_user',
+                rateLimitPerMinute: 60,
+                enabled: true,
+                periodType: 'monthly',
+                timezone: 'UTC',
+                currency: 'USD',
+                rejectUnpricedModel: true,
+                missingUsageBehavior: 'use_reserved',
+                contextOverflowBehavior: 'reject',
+              };
+              if (!key) return record;
+              return record[key];
+            },
+          }),
+        } as never;
+      }
       return { findOne: vi.fn().mockResolvedValue(null) } as never;
     });
 
@@ -188,6 +237,75 @@ describe('direct LLM context preparation', () => {
       ),
     ).rejects.toMatchObject<Partial<DirectLlmContextError>>({ code: 'context_length_exceeded' });
   });
+
+  it('prepends the initial system prompt before the client system prompt', async () => {
+    const clientMessages: OpenAIMessage[] = [
+      { role: 'system', content: 'Client system prompt' },
+      { role: 'user', content: 'hello' },
+    ];
+    const prepared = await prepareDirectLlmContext(
+      context({ metadata: { contextWindow: 120, maxCompletionTokens: 40, systemPrompt: 'Initial prompt' } }),
+      request(clientMessages),
+    );
+
+    expect(prepared.messages).toEqual([
+      { role: 'system', content: 'Initial prompt' },
+      { role: 'system', content: 'Client system prompt' },
+      { role: 'user', content: 'hello' },
+    ]);
+    expect(prepared.truncated).toBe(false);
+    expect(clientMessages).toHaveLength(2);
+  });
+
+  it('uses the initial system prompt as the only system message when the client sends none', async () => {
+    const prepared = await prepareDirectLlmContext(
+      context({ metadata: { contextWindow: 120, maxCompletionTokens: 40, systemPrompt: 'Initial prompt' } }),
+      request([{ role: 'user', content: 'hello' }]),
+    );
+
+    expect(prepared.messages).toEqual([
+      { role: 'system', content: 'Initial prompt' },
+      { role: 'user', content: 'hello' },
+    ]);
+  });
+
+  it('ignores a blank initial system prompt', async () => {
+    const messages = [{ role: 'user', content: 'hello' }];
+    const prepared = await prepareDirectLlmContext(
+      context({ metadata: { contextWindow: 120, maxCompletionTokens: 40, systemPrompt: '   ' } }),
+      request(messages),
+    );
+
+    expect(prepared.messages).toBe(messages);
+  });
+
+  it('counts the initial system prompt toward the input budget', async () => {
+    await expect(
+      prepareDirectLlmContext(
+        context({ metadata: { contextWindow: 120, maxCompletionTokens: 40, systemPrompt: 'x'.repeat(400) } }),
+        request([{ role: 'user', content: 'hello' }]),
+      ),
+    ).rejects.toMatchObject<Partial<DirectLlmContextError>>({ code: 'context_length_exceeded' });
+  });
+
+  it('keeps the initial system prompt when truncating oldest turns', async () => {
+    const messages: OpenAIMessage[] = [
+      { role: 'user', content: 'first '.repeat(30) },
+      { role: 'assistant', content: 'first answer '.repeat(20) },
+      { role: 'user', content: 'latest question' },
+    ];
+
+    const prepared = await prepareDirectLlmContext(
+      context({
+        behavior: 'truncate',
+        metadata: { contextWindow: 120, maxCompletionTokens: 40, systemPrompt: 'Initial prompt' },
+      }),
+      request(messages),
+    );
+
+    expect(prepared.truncated).toBe(true);
+    expect(prepared.messages).toEqual([{ role: 'system', content: 'Initial prompt' }, messages[2]]);
+  });
 });
 
 describe('image dimension parsing', () => {

package/src/server/__tests__/file-processor.test.ts

@@ -0,0 +1,225 @@
+import dns from 'dns';
+import { afterEach, describe, expect, it, vi } from 'vitest';
+import {
+  FileProcessorError,
+  fetchFileAsBase64,
+  httpFileUrlFetcher,
+  isBlockedAddress,
+  type FileProcessorContext,
+} from '../services/file-processor';
+
+const PUBLIC_ADDRESS = { address: '93.184.216.34', family: 4 };
+
+function mockDnsLookup(...results: Array<Array<{ address: string; family: number }>>) {
+  const spy = vi.spyOn(dns.promises, 'lookup');
+  for (const addresses of results) {
+    // The overloaded lookup signatures defeat vitest's inferred mock value type.
+    spy.mockResolvedValueOnce(addresses as never);
+  }
+  spy.mockRejectedValue(new Error('unexpected dns lookup'));
+  return spy;
+}
+
+function mockFetch(...responses: Response[]) {
+  const fetchMock = vi.fn();
+  for (const response of responses) {
+    fetchMock.mockResolvedValueOnce(response);
+  }
+  fetchMock.mockRejectedValue(new Error('unexpected fetch'));
+  vi.stubGlobal('fetch', fetchMock);
+  return fetchMock;
+}
+
+function okResponse(body: string, contentType = 'text/plain') {
+  return new Response(body, {
+    status: 200,
+    headers: { 'content-type': contentType, 'content-length': String(Buffer.byteLength(body)) },
+  });
+}
+
+function redirectResponse(location: string, status = 302) {
+  return new Response(null, { status, headers: { location } });
+}
+
+afterEach(() => {
+  vi.restoreAllMocks();
+  vi.unstubAllGlobals();
+});
+
+describe('isBlockedAddress', () => {
+  it('blocks private, loopback, link-local and reserved IPv4 ranges', () => {
+    expect(isBlockedAddress('0.0.0.0')).toBe(true);
+    expect(isBlockedAddress('10.0.0.1')).toBe(true);
+    expect(isBlockedAddress('100.64.0.1')).toBe(true);
+    expect(isBlockedAddress('100.127.255.255')).toBe(true);
+    expect(isBlockedAddress('127.0.0.1')).toBe(true);
+    expect(isBlockedAddress('169.254.169.254')).toBe(true);
+    expect(isBlockedAddress('172.16.0.1')).toBe(true);
+    expect(isBlockedAddress('172.31.255.255')).toBe(true);
+    expect(isBlockedAddress('192.0.0.1')).toBe(true);
+    expect(isBlockedAddress('192.168.0.10')).toBe(true);
+    expect(isBlockedAddress('198.18.0.1')).toBe(true);
+    expect(isBlockedAddress('198.19.0.1')).toBe(true);
+    expect(isBlockedAddress('224.0.0.1')).toBe(true);
+    expect(isBlockedAddress('255.255.255.255')).toBe(true);
+  });
+
+  it('allows public IPv4 addresses at the range boundaries', () => {
+    expect(isBlockedAddress('8.8.8.8')).toBe(false);
+    expect(isBlockedAddress('100.63.255.255')).toBe(false);
+    expect(isBlockedAddress('100.128.0.0')).toBe(false);
+    expect(isBlockedAddress('172.15.255.255')).toBe(false);
+    expect(isBlockedAddress('172.32.0.0')).toBe(false);
+    expect(isBlockedAddress('192.167.0.1')).toBe(false);
+    expect(isBlockedAddress('198.17.255.255')).toBe(false);
+    expect(isBlockedAddress('198.20.0.0')).toBe(false);
+  });
+
+  it('blocks unspecified, loopback, ULA, link-local and multicast IPv6 addresses', () => {
+    expect(isBlockedAddress('::')).toBe(true);
+    expect(isBlockedAddress('::1')).toBe(true);
+    expect(isBlockedAddress('fc00::1')).toBe(true);
+    expect(isBlockedAddress('fd12:3456::1')).toBe(true);
+    expect(isBlockedAddress('fe80::1')).toBe(true);
+    expect(isBlockedAddress('febf::1')).toBe(true);
+    expect(isBlockedAddress('ff02::1')).toBe(true);
+  });
+
+  it('blocks IPv6 forms that embed blocked IPv4 addresses', () => {
+    expect(isBlockedAddress('::ffff:127.0.0.1')).toBe(true);
+    expect(isBlockedAddress('::ffff:10.0.0.1')).toBe(true);
+    expect(isBlockedAddress('::ffff:169.254.169.254')).toBe(true);
+    expect(isBlockedAddress('::10.0.0.1')).toBe(true);
+    expect(isBlockedAddress('64:ff9b::7f00:1')).toBe(true);
+  });
+
+  it('allows public IPv6 addresses', () => {
+    expect(isBlockedAddress('2001:4860:4860::8888')).toBe(false);
+    expect(isBlockedAddress('2606:4700:4700::1111')).toBe(false);
+    expect(isBlockedAddress('::ffff:8.8.8.8')).toBe(false);
+    expect(isBlockedAddress('64:ff9b::808:808')).toBe(false);
+  });
+
+  it('blocks unparseable input defensively', () => {
+    expect(isBlockedAddress('')).toBe(true);
+    expect(isBlockedAddress('not-an-ip')).toBe(true);
+    expect(isBlockedAddress('1::2::3')).toBe(true);
+    expect(isBlockedAddress('1.2.3')).toBe(true);
+    expect(isBlockedAddress('1.2.3.256')).toBe(true);
+  });
+});
+
+describe('fetchFileAsBase64 SSRF protection', () => {
+  it('blocks hosts that resolve to private addresses before fetching', async () => {
+    const lookupSpy = mockDnsLookup([{ address: '169.254.169.254', family: 4 }]);
+    const fetchMock = mockFetch();
+    await expect(fetchFileAsBase64('https://evil.example.com/latest/meta-data')).rejects.toMatchObject({
+      code: 'blocked_host',
+    });
+    expect(lookupSpy).toHaveBeenCalledWith('evil.example.com', { all: true });
+    expect(fetchMock).not.toHaveBeenCalled();
+  });
+
+  it('blocks when any resolved address is private', async () => {
+    mockDnsLookup([PUBLIC_ADDRESS, { address: '10.0.0.1', family: 4 }]);
+    const fetchMock = mockFetch();
+    await expect(fetchFileAsBase64('https://dual.example.com/file')).rejects.toMatchObject({
+      code: 'blocked_host',
+    });
+    expect(fetchMock).not.toHaveBeenCalled();
+  });
+
+  it('fetches files from public hosts', async () => {
+    mockDnsLookup([PUBLIC_ADDRESS]);
+    const fetchMock = mockFetch(okResponse('hello world'));
+    const result = await fetchFileAsBase64('https://example.com/doc.txt');
+    expect(fetchMock).toHaveBeenCalledWith(
+      'https://example.com/doc.txt',
+      expect.objectContaining({ redirect: 'manual' }),
+    );
+    expect(result.mimeType).toBe('text/plain');
+    expect(result.filename).toBe('doc.txt');
+    expect(result.fileData).toBe(`data:text/plain;base64,${Buffer.from('hello world').toString('base64')}`);
+  });
+
+  it('blocks redirects that point at private hosts', async () => {
+    const lookupSpy = mockDnsLookup([PUBLIC_ADDRESS], [{ address: '127.0.0.1', family: 4 }]);
+    const fetchMock = mockFetch(redirectResponse('http://internal.example/secret'));
+    await expect(fetchFileAsBase64('https://example.com/file')).rejects.toMatchObject({ code: 'blocked_host' });
+    expect(fetchMock).toHaveBeenCalledTimes(1);
+    expect(lookupSpy).toHaveBeenCalledTimes(2);
+  });
+
+  it('follows redirects to allowed public hosts', async () => {
+    mockDnsLookup([PUBLIC_ADDRESS], [{ address: '104.16.0.1', family: 4 }]);
+    const fetchMock = mockFetch(redirectResponse('https://cdn.example.com/doc.txt', 301), okResponse('payload'));
+    const result = await fetchFileAsBase64('https://example.com/doc.txt');
+    expect(fetchMock).toHaveBeenCalledTimes(2);
+    expect(result.fileData).toBe(`data:text/plain;base64,${Buffer.from('payload').toString('base64')}`);
+    expect(result.filename).toBe('doc.txt');
+  });
+
+  it('resolves relative redirect locations against the current URL', async () => {
+    mockDnsLookup([PUBLIC_ADDRESS], [PUBLIC_ADDRESS]);
+    const fetchMock = mockFetch(redirectResponse('/moved/doc.txt'), okResponse('data'));
+    await fetchFileAsBase64('https://example.com/doc.txt');
+    expect(fetchMock).toHaveBeenLastCalledWith(
+      'https://example.com/moved/doc.txt',
+      expect.objectContaining({ redirect: 'manual' }),
+    );
+  });
+
+  it('blocks literal private IP hosts without DNS lookup or fetch', async () => {
+    const lookupSpy = vi.spyOn(dns.promises, 'lookup');
+    const fetchMock = mockFetch();
+    await expect(fetchFileAsBase64('http://192.168.0.10/x')).rejects.toMatchObject({ code: 'blocked_host' });
+    expect(lookupSpy).not.toHaveBeenCalled();
+    expect(fetchMock).not.toHaveBeenCalled();
+  });
+
+  it('blocks bracketed IPv6 loopback literals', async () => {
+    const fetchMock = mockFetch();
+    await expect(fetchFileAsBase64('http://[::1]/x')).rejects.toMatchObject({ code: 'blocked_host' });
+    expect(fetchMock).not.toHaveBeenCalled();
+  });
+
+  it('stops after the redirect limit', async () => {
+    const lookupSpy = vi.spyOn(dns.promises, 'lookup');
+    lookupSpy.mockResolvedValue([PUBLIC_ADDRESS] as never);
+    const fetchMock = vi.fn().mockResolvedValue(redirectResponse('https://example.com/loop'));
+    vi.stubGlobal('fetch', fetchMock);
+    await expect(fetchFileAsBase64('https://example.com/loop', { maxRedirects: 3 })).rejects.toMatchObject({
+      code: 'too_many_redirects',
+    });
+    expect(fetchMock).toHaveBeenCalledTimes(4);
+  });
+
+  it('reports DNS failures as fetch_failed', async () => {
+    const lookupSpy = vi.spyOn(dns.promises, 'lookup');
+    lookupSpy.mockRejectedValue(new Error('getaddrinfo ENOTFOUND'));
+    const fetchMock = mockFetch();
+    await expect(fetchFileAsBase64('https://no-such-host.example/x')).rejects.toMatchObject({
+      code: 'fetch_failed',
+    });
+    expect(fetchMock).not.toHaveBeenCalled();
+  });
+
+  it('keeps the existing URL validation errors', async () => {
+    await expect(fetchFileAsBase64('not a url')).rejects.toMatchObject({ code: 'invalid_url' });
+    await expect(fetchFileAsBase64('ftp://example.com/file')).rejects.toMatchObject({
+      code: 'unsupported_protocol',
+    });
+  });
+
+  it('surfaces blocked hosts through the httpFileUrlFetcher processor', async () => {
+    const fetchMock = mockFetch();
+    const context = { ctx: {} } as unknown as FileProcessorContext;
+    await expect(
+      httpFileUrlFetcher.process({ type: 'file_url', file_url: { url: 'http://10.0.0.5/data.pdf' } }, context),
+    ).rejects.toBeInstanceOf(FileProcessorError);
+    await expect(
+      httpFileUrlFetcher.process({ type: 'file_url', file_url: { url: 'http://10.0.0.5/data.pdf' } }, context),
+    ).rejects.toMatchObject({ code: 'blocked_host' });
+    expect(fetchMock).not.toHaveBeenCalled();
+  });
+});

package/src/server/__tests__/models.test.ts

@@ -21,7 +21,7 @@ function permissionLookupFailureContext() {
       getRepository: (name: string) => {
         if (name === 'aiApiConfig') return { findOne: vi.fn(async () => null) };
         if (name === 'llmServices') return { find: vi.fn(async () => []) };
-        if (name === 'aiApiUserPermissions') {
+        if (name === 'aiApiGroupMembers') {
           return { findOne: vi.fn(async () => Promise.reject(new Error('permission database unavailable'))) };
         }
         return { find: vi.fn(async () => []) };