plugin-ai-api 1.0.7 → 1.0.9

package/dist/server/utils/ai-employee-runtime.js

@@ -0,0 +1,59 @@
+/**
+ * This file is part of the NocoBase (R) project.
+ * Copyright (c) 2020-2024 NocoBase Co., Ltd.
+ * Authors: NocoBase Team.
+ *
+ * This project is dual-licensed under AGPL-3.0 and NocoBase Commercial License.
+ * For more information, please refer to: https://www.nocobase.com/agreement.
+ */
+
+var __defProp = Object.defineProperty;
+var __getOwnPropDesc = Object.getOwnPropertyDescriptor;
+var __getOwnPropNames = Object.getOwnPropertyNames;
+var __hasOwnProp = Object.prototype.hasOwnProperty;
+var __export = (target, all) => {
+  for (var name in all)
+    __defProp(target, name, { get: all[name], enumerable: true });
+};
+var __copyProps = (to, from, except, desc) => {
+  if (from && typeof from === "object" || typeof from === "function") {
+    for (let key of __getOwnPropNames(from))
+      if (!__hasOwnProp.call(to, key) && key !== except)
+        __defProp(to, key, { get: () => from[key], enumerable: !(desc = __getOwnPropDesc(from, key)) || desc.enumerable });
+  }
+  return to;
+};
+var __toCommonJS = (mod) => __copyProps(__defProp({}, "__esModule", { value: true }), mod);
+var ai_employee_runtime_exports = {};
+__export(ai_employee_runtime_exports, {
+  createAIEmployeeOptions: () => createAIEmployeeOptions,
+  getAgentRuntimeLifecycle: () => getAgentRuntimeLifecycle,
+  loadAIEmployeeConstructor: () => loadAIEmployeeConstructor
+});
+module.exports = __toCommonJS(ai_employee_runtime_exports);
+function getAgentRuntimeLifecycle(ctx) {
+  return ctx.app.agentRuntimeLifecycle;
+}
+let cachedConstructor = null;
+async function loadAIEmployeeConstructor() {
+  if (cachedConstructor) return cachedConstructor;
+  const modulePath = "@nocobase/plugin-ai/dist/server/ai-employees/ai-employee.js";
+  const module2 = await import(
+    /* webpackIgnore: true */
+    modulePath
+  );
+  if (typeof module2.AIEmployee !== "function") {
+    throw new Error("AIEmployee class is not exported by the installed plugin-ai runtime.");
+  }
+  cachedConstructor = module2.AIEmployee;
+  return cachedConstructor;
+}
+function createAIEmployeeOptions(ctx, employee, sessionId, model) {
+  return { ctx, employee, sessionId, webSearch: false, model, legacy: false };
+}
+// Annotate the CommonJS export names for ESM import in node:
+0 && (module.exports = {
+  createAIEmployeeOptions,
+  getAgentRuntimeLifecycle,
+  loadAIEmployeeConstructor
+});

package/package.json

@@ -1,6 +1,6 @@
 {
   "name": "plugin-ai-api",
-  "version": "1.0.7",
+  "version": "1.0.9",
   "main": "dist/server/index.js",
   "dependencies": {},
   "peerDependencies": {

package/src/server/__tests__/agent-completions.test.ts

@@ -0,0 +1,26 @@
+import type { Context } from '@nocobase/actions';
+import { createAIEmployeeOptions } from '../utils/ai-employee-runtime';
+
+describe('AI API agent completions', () => {
+  it('creates the object-shaped options required by AIEmployee', () => {
+    const ctx = { app: {}, db: {} } as Context;
+    const employee = { username: 'support-agent' };
+
+    const options = createAIEmployeeOptions(ctx, employee, 'session-1', {
+      llmService: 'internal-deepseek',
+      model: 'deepseek-r1',
+    });
+
+    expect(options).toEqual({
+      ctx,
+      employee,
+      sessionId: 'session-1',
+      webSearch: false,
+      model: {
+        llmService: 'internal-deepseek',
+        model: 'deepseek-r1',
+      },
+      legacy: false,
+    });
+  });
+});

package/src/server/collections/ai-api-usage-records.ts

@@ -0,0 +1,33 @@
+import { defineCollection } from '@nocobase/database';
+
+export default defineCollection({
+  name: 'aiApiUsageRecords',
+  autoGenId: true,
+  fields: [
+    { name: 'requestId', type: 'string', unique: true, index: true },
+    { name: 'userId', type: 'string', index: true },
+    { name: 'roleName', type: 'string', index: true },
+    { name: 'authType', type: 'string', index: true },
+    { name: 'oauthClientId', type: 'string', allowNull: true, index: true },
+    { name: 'oauthSubject', type: 'string', allowNull: true },
+    { name: 'oauthScopes', type: 'json', allowNull: true },
+    { name: 'endpoint', type: 'string' },
+    { name: 'mode', type: 'string', allowNull: true },
+    { name: 'model', type: 'string', allowNull: true, index: true },
+    { name: 'status', type: 'string', index: true },
+    { name: 'httpStatus', type: 'integer', allowNull: true },
+    { name: 'errorCode', type: 'string', allowNull: true },
+    { name: 'streaming', type: 'boolean', defaultValue: false },
+    { name: 'inputTokens', type: 'integer', allowNull: true },
+    { name: 'outputTokens', type: 'integer', allowNull: true },
+    { name: 'totalTokens', type: 'integer', allowNull: true },
+    { name: 'estimatedCost', type: 'decimal', allowNull: true, precision: 20, scale: 8 },
+    { name: 'currency', type: 'string', allowNull: true },
+    { name: 'providerRequestId', type: 'string', allowNull: true },
+    { name: 'requestMetadata', type: 'jsonb', defaultValue: {} },
+    { name: 'responseMetadata', type: 'jsonb', defaultValue: {} },
+    { name: 'startedAt', type: 'datetimeTz', allowNull: true },
+    { name: 'completedAt', type: 'datetimeTz', allowNull: true },
+    { name: 'durationMs', type: 'integer', allowNull: true },
+  ],
+});

package/src/server/middleware/role-permission.ts

@@ -1,66 +1,79 @@
-/**
- * This file is part of the NocoBase (R) project.
- * Copyright (c) 2020-2024 NocoBase Co., Ltd.
- * Authors: NocoBase Team.
- *
- * This project is dual-licensed under AGPL-3.0 and NocoBase Commercial License.
- * For more information, please refer to: https://www.nocobase.com/agreement.
- */
-
-import { Context } from '@nocobase/actions';
-import { toOpenAIError } from '../utils/openai-format';
-
-/**
- * Check whether the authenticated role is allowed to use the AI API.
- * Loads the permission record and stores it in ctx.state.aiApiRolePermission.
- *
- * Returns true if access is allowed (caller may proceed).
- * Returns false if access is denied (403 already written to ctx, caller must return).
- *
- * The 'root' and 'admin' roles always bypass the check.
- */
-export async function checkRolePermission(ctx: Context): Promise<boolean> {
-  const roleName = ctx.state.currentRoles?.[0] || 'member';
-
-  // root / admin always allowed
-  if (roleName === 'root' || roleName === 'admin') {
-    return true;
-  }
-
-  const record = await ctx.db.getRepository('aiApiRolePermissions').findOne({
-    filter: { roleName },
-  });
-
-  if (!record?.enabled) {
-    ctx.status = 403;
-    ctx.body = toOpenAIError(
-      403,
-      `Role '${roleName}' is not authorized to use the AI API. ` +
-        `An admin must enable access in Settings → Users & Permissions → [Role] → AI API.`,
-      'permission_denied',
-      'role_not_permitted',
-    );
-    return false;
-  }
-
-  // Store for downstream handlers
-  ctx.state.aiApiRolePermission = record;
-  return true;
-}
-
-/**
- * Check whether the current role is allowed to use a specific AI Employee.
- * Must be called after checkRolePermission (so ctx.state.aiApiRolePermission is set).
- *
- * Returns true when:
- * - Role is admin/root (no permission record stored)
- * - allowAllEmployees is true
- * - The employeeUsername is in the allowedEmployees list
- */
-export function checkEmployeeAccess(ctx: Context, employeeUsername: string): boolean {
-  const perm = ctx.state.aiApiRolePermission;
-  // admin/root paths have no record stored → always allowed
-  if (!perm) return true;
-  if (perm.allowAllEmployees) return true;
-  return ((perm.allowedEmployees as string[]) || []).includes(employeeUsername);
-}
+/**
+ * This file is part of the NocoBase (R) project.
+ * Copyright (c) 2020-2024 NocoBase Co., Ltd.
+ * Authors: NocoBase Team.
+ *
+ * This project is dual-licensed under AGPL-3.0 and NocoBase Commercial License.
+ * For more information, please refer to: https://www.nocobase.com/agreement.
+ */
+
+import { Context } from '@nocobase/actions';
+import { toOpenAIError } from '../utils/openai-format';
+
+const PERMISSION_TTL_MS = 15_000;
+const permissionCache = new Map<string, { record: any; expiresAt: number }>();
+
+export function invalidateRolePermissionCache(roleName?: string): void {
+  if (roleName) permissionCache.delete(roleName);
+  else permissionCache.clear();
+}
+
+/**
+ * Check whether the authenticated role is allowed to use the AI API.
+ * Loads the permission record and stores it in ctx.state.aiApiRolePermission.
+ *
+ * Returns true if access is allowed (caller may proceed).
+ * Returns false if access is denied (403 already written to ctx, caller must return).
+ *
+ * The 'root' and 'admin' roles always bypass the check.
+ */
+export async function checkRolePermission(ctx: Context): Promise<boolean> {
+  const roleName = ctx.state.currentRoles?.[0] || 'member';
+
+  // root / admin always allowed
+  if (roleName === 'root' || roleName === 'admin') {
+    return true;
+  }
+
+  const cached = permissionCache.get(roleName);
+  const record =
+    cached && cached.expiresAt > Date.now()
+      ? cached.record
+      : await ctx.db.getRepository('aiApiRolePermissions').findOne({ filter: { roleName } });
+  if (!cached || cached.expiresAt <= Date.now()) {
+    permissionCache.set(roleName, { record, expiresAt: Date.now() + PERMISSION_TTL_MS });
+  }
+
+  if (!record?.enabled) {
+    ctx.status = 403;
+    ctx.body = toOpenAIError(
+      403,
+      `Role '${roleName}' is not authorized to use the AI API. ` +
+        `An admin must enable access in Settings → Users & Permissions → [Role] → AI API.`,
+      'permission_denied',
+      'role_not_permitted',
+    );
+    return false;
+  }
+
+  // Store for downstream handlers
+  ctx.state.aiApiRolePermission = record;
+  return true;
+}
+
+/**
+ * Check whether the current role is allowed to use a specific AI Employee.
+ * Must be called after checkRolePermission (so ctx.state.aiApiRolePermission is set).
+ *
+ * Returns true when:
+ * - Role is admin/root (no permission record stored)
+ * - allowAllEmployees is true
+ * - The employeeUsername is in the allowedEmployees list
+ */
+export function checkEmployeeAccess(ctx: Context, employeeUsername: string): boolean {
+  const perm = ctx.state.aiApiRolePermission;
+  // admin/root paths have no record stored → always allowed
+  if (!perm) return true;
+  if (perm.allowAllEmployees) return true;
+  return ((perm.allowedEmployees as string[]) || []).includes(employeeUsername);
+}

package/src/server/plugin.ts

@@ -1,89 +1,99 @@
-/**
- * This file is part of the NocoBase (R) project.
- * Copyright (c) 2020-2024 NocoBase Co., Ltd.
- * Authors: NocoBase Team.
- *
- * This project is dual-licensed under AGPL-3.0 and NocoBase Commercial License.
- * For more information, please refer to: https://www.nocobase.com/agreement.
- */
-
-import { Plugin } from '@nocobase/server';
-import { createAiLlmRouter } from './routes/router';
-import aiApiConfigResource from './resource/ai-api-config';
-import { RateLimiter } from './utils/rate-limiter';
-
-// Ensure dayjs timezone + utc plugins are loaded.
-// Some Docker builds ship an older @nocobase/utils whose dayjs.js does not
-// extend the 'timezone' plugin, causing utcOffset(value) to behave as a
-// getter (returns a number) instead of a setter (returns a dayjs instance).
-// That breaks parse-filter.js's utc2unit() → "m.startOf is not a function".
-// Extending here patches the shared CommonJS dayjs module instance for the
-// entire Node.js process before any AIEmployee call is made.
-import dayjsLib from 'dayjs';
-import utcPlugin from 'dayjs/plugin/utc';
-import timezonePlugin from 'dayjs/plugin/timezone';
-(dayjsLib as any).extend(utcPlugin);
-(dayjsLib as any).extend(timezonePlugin);
-
-export class PluginAiApiServer extends Plugin {
-  /**
-   * Singleton rate limiter — lives for the entire plugin lifetime, shared across all requests.
-   * Uses a 1-minute sliding window to enforce rateLimitPerMinute from aiApiConfig.
-   */
-  rateLimiter = new RateLimiter(60_000);
-
-  private gcInterval: NodeJS.Timeout | null = null;
-
-  async afterAdd() {}
-
-  async beforeLoad() {}
-
-  async load() {
-    // 1. Register raw Koa middleware for OpenAI-compatible endpoints
-    //    Must run before 'resourcer' so URL paths match OpenAI convention
-    this.app.use(createAiLlmRouter(this), { before: 'resourcer' });
-
-    // 2. Register admin config resource
-    this.app.resourceManager.define(aiApiConfigResource);
-
-    // 3. Set ACL permissions for admin config + role permissions management
-    this.app.acl.registerSnippet({
-      name: `pm.${this.name}.configuration`,
-      actions: ['aiApiConfig:*', 'aiApiRolePermissions:*'],
-    });
-
-    // 4. GC the rate limiter every 5 minutes to evict stale user entries.
-    //    .unref() prevents this timer from keeping the process alive on shutdown.
-    this.gcInterval = setInterval(() => this.rateLimiter.gc(), 5 * 60 * 1000);
-    this.gcInterval.unref();
-  }
-
-  async install() {
-    // Create default config record on first install
-    const existing = await this.db.getRepository('aiApiConfig').findOne();
-    if (!existing) {
-      await this.db.getRepository('aiApiConfig').create({
-        values: {
-          defaultAiEmployee: '',
-          enabledLlmServices: [],
-          rateLimitPerMinute: 60,
-        },
-      });
-    }
-  }
-
-  async afterEnable() {}
-
-  async afterDisable() {}
-
-  async remove() {
-    // Clean up the GC timer so we don't leak resources during hot-reload
-    if (this.gcInterval) {
-      clearInterval(this.gcInterval);
-      this.gcInterval = null;
-    }
-    this.rateLimiter.clear();
-  }
-}
-
-export default PluginAiApiServer;
+/**
+ * This file is part of the NocoBase (R) project.
+ * Copyright (c) 2020-2024 NocoBase Co., Ltd.
+ * Authors: NocoBase Team.
+ *
+ * This project is dual-licensed under AGPL-3.0 and NocoBase Commercial License.
+ * For more information, please refer to: https://www.nocobase.com/agreement.
+ */
+
+import { Plugin } from '@nocobase/server';
+import { createAiLlmRouter } from './routes/router';
+import aiApiConfigResource from './resource/ai-api-config';
+import { RateLimiter } from './utils/rate-limiter';
+import { invalidateRolePermissionCache } from './middleware/role-permission';
+
+// Ensure dayjs timezone + utc plugins are loaded.
+// Some Docker builds ship an older @nocobase/utils whose dayjs.js does not
+// extend the 'timezone' plugin, causing utcOffset(value) to behave as a
+// getter (returns a number) instead of a setter (returns a dayjs instance).
+// That breaks parse-filter.js's utc2unit() → "m.startOf is not a function".
+// Extending here patches the shared CommonJS dayjs module instance for the
+// entire Node.js process before any AIEmployee call is made.
+import dayjsLib from 'dayjs';
+import utcPlugin from 'dayjs/plugin/utc';
+import timezonePlugin from 'dayjs/plugin/timezone';
+(dayjsLib as any).extend(utcPlugin);
+(dayjsLib as any).extend(timezonePlugin);
+
+export class PluginAiApiServer extends Plugin {
+  /**
+   * Singleton rate limiter — lives for the entire plugin lifetime, shared across all requests.
+   * Uses a 1-minute sliding window to enforce rateLimitPerMinute from aiApiConfig.
+   */
+  rateLimiter = new RateLimiter(60_000);
+
+  private gcInterval: NodeJS.Timeout | null = null;
+
+  async afterAdd() {}
+
+  async beforeLoad() {}
+
+  async load() {
+    // 1. Register raw Koa middleware for OpenAI-compatible endpoints
+    //    Must run before 'resourcer' so URL paths match OpenAI convention
+    // OIDC access tokens must first pass through plugin-idp-oauth, which validates
+    // issuer/audience/scope and rewrites them to a NocoBase internal token.
+    this.app.use(createAiLlmRouter(this), { after: 'idp-oauth-resource-auth', before: 'resourcer' });
+
+    // 2. Register admin config resource
+    this.app.resourceManager.define(aiApiConfigResource);
+
+    this.app.db.on('aiApiRolePermissions.afterSave', (model) => {
+      invalidateRolePermissionCache(model.get('roleName'));
+    });
+    this.app.db.on('aiApiRolePermissions.afterDestroy', (model) => {
+      invalidateRolePermissionCache(model.get('roleName'));
+    });
+
+    // 3. Set ACL permissions for admin config + role permissions management
+    this.app.acl.registerSnippet({
+      name: `pm.${this.name}.configuration`,
+      actions: ['aiApiConfig:*', 'aiApiRolePermissions:*'],
+    });
+
+    // 4. GC the rate limiter every 5 minutes to evict stale user entries.
+    //    .unref() prevents this timer from keeping the process alive on shutdown.
+    this.gcInterval = setInterval(() => this.rateLimiter.gc(), 5 * 60 * 1000);
+    this.gcInterval.unref();
+  }
+
+  async install() {
+    // Create default config record on first install
+    const existing = await this.db.getRepository('aiApiConfig').findOne();
+    if (!existing) {
+      await this.db.getRepository('aiApiConfig').create({
+        values: {
+          defaultAiEmployee: '',
+          enabledLlmServices: [],
+          rateLimitPerMinute: 60,
+        },
+      });
+    }
+  }
+
+  async afterEnable() {}
+
+  async afterDisable() {}
+
+  async remove() {
+    // Clean up the GC timer so we don't leak resources during hot-reload
+    if (this.gcInterval) {
+      clearInterval(this.gcInterval);
+      this.gcInterval = null;
+    }
+    this.rateLimiter.clear();
+  }
+}
+
+export default PluginAiApiServer;