plugin-ai-api 1.0.3 → 1.0.6

package/src/server/middleware/rate-limit.ts

@@ -0,0 +1,70 @@
+/**
+ * This file is part of the NocoBase (R) project.
+ * Copyright (c) 2020-2024 NocoBase Co., Ltd.
+ * Authors: NocoBase Team.
+ *
+ * This project is dual-licensed under AGPL-3.0 and NocoBase Commercial License.
+ * For more information, please refer to: https://www.nocobase.com/agreement.
+ */
+
+import { Context } from '@nocobase/actions';
+import { RateLimiter } from '../utils/rate-limiter';
+import { toOpenAIError } from '../utils/openai-format';
+
+/**
+ * Creates a rate-limiting check function for use in the AI API router.
+ *
+ * Must be called AFTER authenticateBearer() so ctx.state.currentUser is set.
+ * Reads rateLimitPerMinute from aiApiConfig on each request (cheap single-row read,
+ * allows config changes to take effect immediately without restart).
+ * Falls back to 60 req/min if the config record is missing or the field is 0/null.
+ *
+ * Returns false (and writes the 429 response) when the rate limit is exceeded.
+ * Returns true when the request is allowed.
+ *
+ * Sets OpenAI-compatible rate limit response headers on every request:
+ *   X-RateLimit-Limit: <limit>
+ *   X-RateLimit-Remaining: <remaining> (on 429: 0)
+ *   Retry-After: <seconds>  (on 429 only)
+ */
+export function createRateLimitMiddleware(limiter: RateLimiter) {
+  return async (ctx: Context): Promise<boolean> => {
+    const userId = ctx.state.currentUser?.id;
+    // Auth runs before this; if somehow missing, fail open (don't block the request).
+    if (userId === undefined || userId === null) return true;
+
+    let limit = 60;
+    try {
+      const config = await ctx.db.getRepository('aiApiConfig').findOne();
+      const configLimit = config?.rateLimitPerMinute;
+      if (configLimit && configLimit > 0) {
+        limit = configLimit;
+      }
+    } catch (configErr) {
+      // Config read failure: fail open — don't block legitimate requests
+      // Log at WARN so admins can detect DB connectivity issues
+      ctx.app?.logger?.warn('[ai-api] Rate limit config read failed, using default (60/min)', configErr);
+    }
+
+    const result = limiter.check(userId, limit);
+
+    if (!result.allowed) {
+      const retryAfterSec = Math.ceil((result as any).retryAfterMs / 1000);
+      ctx.set('Retry-After', String(retryAfterSec));
+      ctx.set('X-RateLimit-Limit', String(limit));
+      ctx.set('X-RateLimit-Remaining', '0');
+      ctx.status = 429;
+      ctx.body = toOpenAIError(
+        429,
+        `Rate limit exceeded. You have used all ${limit} requests allowed per minute. ` +
+          `Please wait ${retryAfterSec} second${retryAfterSec !== 1 ? 's' : ''} before retrying.`,
+        'requests',
+        'rate_limit_exceeded',
+      );
+      return false;
+    }
+
+    ctx.set('X-RateLimit-Limit', String(limit));
+    return true;
+  };
+}

package/src/server/middleware/role-permission.ts

@@ -0,0 +1,66 @@
+/**
+ * This file is part of the NocoBase (R) project.
+ * Copyright (c) 2020-2024 NocoBase Co., Ltd.
+ * Authors: NocoBase Team.
+ *
+ * This project is dual-licensed under AGPL-3.0 and NocoBase Commercial License.
+ * For more information, please refer to: https://www.nocobase.com/agreement.
+ */
+
+import { Context } from '@nocobase/actions';
+import { toOpenAIError } from '../utils/openai-format';
+
+/**
+ * Check whether the authenticated role is allowed to use the AI API.
+ * Loads the permission record and stores it in ctx.state.aiApiRolePermission.
+ *
+ * Returns true if access is allowed (caller may proceed).
+ * Returns false if access is denied (403 already written to ctx, caller must return).
+ *
+ * The 'root' and 'admin' roles always bypass the check.
+ */
+export async function checkRolePermission(ctx: Context): Promise<boolean> {
+  const roleName = ctx.state.currentRoles?.[0] || 'member';
+
+  // root / admin always allowed
+  if (roleName === 'root' || roleName === 'admin') {
+    return true;
+  }
+
+  const record = await ctx.db.getRepository('aiApiRolePermissions').findOne({
+    filter: { roleName },
+  });
+
+  if (!record?.enabled) {
+    ctx.status = 403;
+    ctx.body = toOpenAIError(
+      403,
+      `Role '${roleName}' is not authorized to use the AI API. ` +
+        `An admin must enable access in Settings → Users & Permissions → [Role] → AI API.`,
+      'permission_denied',
+      'role_not_permitted',
+    );
+    return false;
+  }
+
+  // Store for downstream handlers
+  ctx.state.aiApiRolePermission = record;
+  return true;
+}
+
+/**
+ * Check whether the current role is allowed to use a specific AI Employee.
+ * Must be called after checkRolePermission (so ctx.state.aiApiRolePermission is set).
+ *
+ * Returns true when:
+ * - Role is admin/root (no permission record stored)
+ * - allowAllEmployees is true
+ * - The employeeUsername is in the allowedEmployees list
+ */
+export function checkEmployeeAccess(ctx: Context, employeeUsername: string): boolean {
+  const perm = ctx.state.aiApiRolePermission;
+  // admin/root paths have no record stored → always allowed
+  if (!perm) return true;
+  if (perm.allowAllEmployees) return true;
+  return ((perm.allowedEmployees as string[]) || []).includes(employeeUsername);
+}

package/src/server/plugin.ts

@@ -0,0 +1,89 @@
+/**
+ * This file is part of the NocoBase (R) project.
+ * Copyright (c) 2020-2024 NocoBase Co., Ltd.
+ * Authors: NocoBase Team.
+ *
+ * This project is dual-licensed under AGPL-3.0 and NocoBase Commercial License.
+ * For more information, please refer to: https://www.nocobase.com/agreement.
+ */
+
+import { Plugin } from '@nocobase/server';
+import { createAiLlmRouter } from './routes/router';
+import aiApiConfigResource from './resource/ai-api-config';
+import { RateLimiter } from './utils/rate-limiter';
+
+// Ensure dayjs timezone + utc plugins are loaded.
+// Some Docker builds ship an older @nocobase/utils whose dayjs.js does not
+// extend the 'timezone' plugin, causing utcOffset(value) to behave as a
+// getter (returns a number) instead of a setter (returns a dayjs instance).
+// That breaks parse-filter.js's utc2unit() → "m.startOf is not a function".
+// Extending here patches the shared CommonJS dayjs module instance for the
+// entire Node.js process before any AIEmployee call is made.
+import dayjsLib from 'dayjs';
+import utcPlugin from 'dayjs/plugin/utc';
+import timezonePlugin from 'dayjs/plugin/timezone';
+(dayjsLib as any).extend(utcPlugin);
+(dayjsLib as any).extend(timezonePlugin);
+
+export class PluginAiApiServer extends Plugin {
+  /**
+   * Singleton rate limiter — lives for the entire plugin lifetime, shared across all requests.
+   * Uses a 1-minute sliding window to enforce rateLimitPerMinute from aiApiConfig.
+   */
+  rateLimiter = new RateLimiter(60_000);
+
+  private gcInterval: NodeJS.Timeout | null = null;
+
+  async afterAdd() {}
+
+  async beforeLoad() {}
+
+  async load() {
+    // 1. Register raw Koa middleware for OpenAI-compatible endpoints
+    //    Must run before 'resourcer' so URL paths match OpenAI convention
+    this.app.use(createAiLlmRouter(this), { before: 'resourcer' });
+
+    // 2. Register admin config resource
+    this.app.resourceManager.define(aiApiConfigResource);
+
+    // 3. Set ACL permissions for admin config + role permissions management
+    this.app.acl.registerSnippet({
+      name: `pm.${this.name}.configuration`,
+      actions: ['aiApiConfig:*', 'aiApiRolePermissions:*'],
+    });
+
+    // 4. GC the rate limiter every 5 minutes to evict stale user entries.
+    //    .unref() prevents this timer from keeping the process alive on shutdown.
+    this.gcInterval = setInterval(() => this.rateLimiter.gc(), 5 * 60 * 1000);
+    this.gcInterval.unref();
+  }
+
+  async install() {
+    // Create default config record on first install
+    const existing = await this.db.getRepository('aiApiConfig').findOne();
+    if (!existing) {
+      await this.db.getRepository('aiApiConfig').create({
+        values: {
+          defaultAiEmployee: '',
+          enabledLlmServices: [],
+          rateLimitPerMinute: 60,
+        },
+      });
+    }
+  }
+
+  async afterEnable() {}
+
+  async afterDisable() {}
+
+  async remove() {
+    // Clean up the GC timer so we don't leak resources during hot-reload
+    if (this.gcInterval) {
+      clearInterval(this.gcInterval);
+      this.gcInterval = null;
+    }
+    this.rateLimiter.clear();
+  }
+}
+
+export default PluginAiApiServer;

package/src/server/resource/ai-api-config.ts

@@ -0,0 +1,74 @@
+/**
+ * This file is part of the NocoBase (R) project.
+ * Copyright (c) 2020-2024 NocoBase Co., Ltd.
+ * Authors: NocoBase Team.
+ *
+ * This project is dual-licensed under AGPL-3.0 and NocoBase Commercial License.
+ * For more information, please refer to: https://www.nocobase.com/agreement.
+ */
+
+import { ResourceOptions } from '@nocobase/resourcer';
+
+/**
+ * Resource for managing AI API configuration via NocoBase admin UI.
+ * Singleton config pattern (same as aiSettings in plugin-ai).
+ *
+ * Uses custom action name 'save' instead of 'update' because NocoBase's
+ * built-in middleware requires filter/filterByTk for the standard 'update' action.
+ */
+const aiApiConfigResource: ResourceOptions = {
+  name: 'aiApiConfig',
+  actions: {
+    async get(ctx, next) {
+      let config = await ctx.db.getRepository('aiApiConfig').findOne();
+      if (!config) {
+        config = await ctx.db.getRepository('aiApiConfig').create({
+          values: {
+            mode: 'llm',
+            defaultAiEmployee: '',
+            defaultLlmService: '',
+            enabledLlmServices: [],
+            rateLimitPerMinute: 60,
+            options: {},
+          },
+        });
+      }
+      ctx.body = config;
+      await next();
+    },
+
+    async save(ctx, next) {
+      const values = ctx.action.params.values || (ctx.request.body as any) || {};
+      const repo = ctx.db.getRepository('aiApiConfig');
+      let config = await repo.findOne();
+
+      if (!config) {
+        config = await repo.create({
+          values: {
+            mode: values.mode ?? 'llm',
+            defaultAiEmployee: values.defaultAiEmployee ?? '',
+            defaultLlmService: values.defaultLlmService ?? '',
+            enabledLlmServices: values.enabledLlmServices ?? [],
+            rateLimitPerMinute: values.rateLimitPerMinute ?? 60,
+            options: values.options ?? {},
+          },
+        });
+      } else {
+        const updateData: Record<string, any> = {};
+        if (values.mode !== undefined) updateData.mode = values.mode;
+        if (values.defaultAiEmployee !== undefined) updateData.defaultAiEmployee = values.defaultAiEmployee;
+        if (values.defaultLlmService !== undefined) updateData.defaultLlmService = values.defaultLlmService;
+        if (values.enabledLlmServices !== undefined) updateData.enabledLlmServices = values.enabledLlmServices;
+        if (values.rateLimitPerMinute !== undefined) updateData.rateLimitPerMinute = values.rateLimitPerMinute;
+        if (values.options !== undefined) updateData.options = values.options;
+
+        await config.update(updateData);
+      }
+
+      ctx.body = config;
+      await next();
+    },
+  },
+};
+
+export default aiApiConfigResource;