plugin-ai-api 1.0.8 → 1.0.9

package/dist/externalVersion.js

@@ -16,8 +16,8 @@ module.exports = {
   "@nocobase/plugin-acl": "2.1.23",
   "@nocobase/server": "2.1.23",
   "dayjs": "1.11.13",
-  "@nocobase/database": "2.1.23",
   "@nocobase/actions": "2.1.23",
+  "@nocobase/database": "2.1.23",
   "@nocobase/resourcer": "2.1.23",
   "@nocobase/plugin-ai": "2.1.23"
 };

package/dist/server/collections/ai-api-usage-records.js

@@ -0,0 +1,63 @@
+/**
+ * This file is part of the NocoBase (R) project.
+ * Copyright (c) 2020-2024 NocoBase Co., Ltd.
+ * Authors: NocoBase Team.
+ *
+ * This project is dual-licensed under AGPL-3.0 and NocoBase Commercial License.
+ * For more information, please refer to: https://www.nocobase.com/agreement.
+ */
+
+var __defProp = Object.defineProperty;
+var __getOwnPropDesc = Object.getOwnPropertyDescriptor;
+var __getOwnPropNames = Object.getOwnPropertyNames;
+var __hasOwnProp = Object.prototype.hasOwnProperty;
+var __export = (target, all) => {
+  for (var name in all)
+    __defProp(target, name, { get: all[name], enumerable: true });
+};
+var __copyProps = (to, from, except, desc) => {
+  if (from && typeof from === "object" || typeof from === "function") {
+    for (let key of __getOwnPropNames(from))
+      if (!__hasOwnProp.call(to, key) && key !== except)
+        __defProp(to, key, { get: () => from[key], enumerable: !(desc = __getOwnPropDesc(from, key)) || desc.enumerable });
+  }
+  return to;
+};
+var __toCommonJS = (mod) => __copyProps(__defProp({}, "__esModule", { value: true }), mod);
+var ai_api_usage_records_exports = {};
+__export(ai_api_usage_records_exports, {
+  default: () => ai_api_usage_records_default
+});
+module.exports = __toCommonJS(ai_api_usage_records_exports);
+var import_database = require("@nocobase/database");
+var ai_api_usage_records_default = (0, import_database.defineCollection)({
+  name: "aiApiUsageRecords",
+  autoGenId: true,
+  fields: [
+    { name: "requestId", type: "string", unique: true, index: true },
+    { name: "userId", type: "string", index: true },
+    { name: "roleName", type: "string", index: true },
+    { name: "authType", type: "string", index: true },
+    { name: "oauthClientId", type: "string", allowNull: true, index: true },
+    { name: "oauthSubject", type: "string", allowNull: true },
+    { name: "oauthScopes", type: "json", allowNull: true },
+    { name: "endpoint", type: "string" },
+    { name: "mode", type: "string", allowNull: true },
+    { name: "model", type: "string", allowNull: true, index: true },
+    { name: "status", type: "string", index: true },
+    { name: "httpStatus", type: "integer", allowNull: true },
+    { name: "errorCode", type: "string", allowNull: true },
+    { name: "streaming", type: "boolean", defaultValue: false },
+    { name: "inputTokens", type: "integer", allowNull: true },
+    { name: "outputTokens", type: "integer", allowNull: true },
+    { name: "totalTokens", type: "integer", allowNull: true },
+    { name: "estimatedCost", type: "decimal", allowNull: true, precision: 20, scale: 8 },
+    { name: "currency", type: "string", allowNull: true },
+    { name: "providerRequestId", type: "string", allowNull: true },
+    { name: "requestMetadata", type: "jsonb", defaultValue: {} },
+    { name: "responseMetadata", type: "jsonb", defaultValue: {} },
+    { name: "startedAt", type: "datetimeTz", allowNull: true },
+    { name: "completedAt", type: "datetimeTz", allowNull: true },
+    { name: "durationMs", type: "integer", allowNull: true }
+  ]
+});

package/dist/server/middleware/role-permission.js

@@ -27,19 +27,28 @@ var __toCommonJS = (mod) => __copyProps(__defProp({}, "__esModule", { value: tru
 var role_permission_exports = {};
 __export(role_permission_exports, {
   checkEmployeeAccess: () => checkEmployeeAccess,
-  checkRolePermission: () => checkRolePermission
+  checkRolePermission: () => checkRolePermission,
+  invalidateRolePermissionCache: () => invalidateRolePermissionCache
 });
 module.exports = __toCommonJS(role_permission_exports);
 var import_openai_format = require("../utils/openai-format");
+const PERMISSION_TTL_MS = 15e3;
+const permissionCache = /* @__PURE__ */ new Map();
+function invalidateRolePermissionCache(roleName) {
+  if (roleName) permissionCache.delete(roleName);
+  else permissionCache.clear();
+}
 async function checkRolePermission(ctx) {
   var _a;
   const roleName = ((_a = ctx.state.currentRoles) == null ? void 0 : _a[0]) || "member";
   if (roleName === "root" || roleName === "admin") {
     return true;
   }
-  const record = await ctx.db.getRepository("aiApiRolePermissions").findOne({
-    filter: { roleName }
-  });
+  const cached = permissionCache.get(roleName);
+  const record = cached && cached.expiresAt > Date.now() ? cached.record : await ctx.db.getRepository("aiApiRolePermissions").findOne({ filter: { roleName } });
+  if (!cached || cached.expiresAt <= Date.now()) {
+    permissionCache.set(roleName, { record, expiresAt: Date.now() + PERMISSION_TTL_MS });
+  }
   if (!(record == null ? void 0 : record.enabled)) {
     ctx.status = 403;
     ctx.body = (0, import_openai_format.toOpenAIError)(
@@ -62,5 +71,6 @@ function checkEmployeeAccess(ctx, employeeUsername) {
 // Annotate the CommonJS export names for ESM import in node:
 0 && (module.exports = {
   checkEmployeeAccess,
-  checkRolePermission
+  checkRolePermission,
+  invalidateRolePermissionCache
 });

package/dist/server/plugin.js

@@ -44,6 +44,7 @@ var import_server = require("@nocobase/server");
 var import_router = require("./routes/router");
 var import_ai_api_config = __toESM(require("./resource/ai-api-config"));
 var import_rate_limiter = require("./utils/rate-limiter");
+var import_role_permission = require("./middleware/role-permission");
 var import_dayjs = __toESM(require("dayjs"));
 var import_utc = __toESM(require("dayjs/plugin/utc"));
 var import_timezone = __toESM(require("dayjs/plugin/timezone"));
@@ -61,8 +62,14 @@ class PluginAiApiServer extends import_server.Plugin {
   async beforeLoad() {
   }
   async load() {
-    this.app.use((0, import_router.createAiLlmRouter)(this), { before: "resourcer" });
+    this.app.use((0, import_router.createAiLlmRouter)(this), { after: "idp-oauth-resource-auth", before: "resourcer" });
     this.app.resourceManager.define(import_ai_api_config.default);
+    this.app.db.on("aiApiRolePermissions.afterSave", (model) => {
+      (0, import_role_permission.invalidateRolePermissionCache)(model.get("roleName"));
+    });
+    this.app.db.on("aiApiRolePermissions.afterDestroy", (model) => {
+      (0, import_role_permission.invalidateRolePermissionCache)(model.get("roleName"));
+    });
     this.app.acl.registerSnippet({
       name: `pm.${this.name}.configuration`,
       actions: ["aiApiConfig:*", "aiApiRolePermissions:*"]

package/dist/server/routes/auth.js

@@ -37,7 +37,7 @@ async function authenticateBearer(ctx) {
     ctx.status = 401;
     ctx.body = (0, import_openai_format.toOpenAIError)(
       401,
-      "Missing or invalid Authorization header. Expected: Bearer <api-key>",
+      "Missing or invalid Authorization header. Expected: Bearer <access-token>",
       "invalid_request_error",
       "invalid_api_key"
     );
@@ -50,11 +50,16 @@ async function authenticateBearer(ctx) {
     return false;
   }
   try {
-    const auth = ctx.app["authManager"];
-    if (!auth) {
-      ctx.status = 500;
-      ctx.body = (0, import_openai_format.toOpenAIError)(500, "Auth system not available", "server_error");
-      return false;
+    if (ctx.state.currentUser) {
+      if (!ctx.state.currentRole) {
+        const requestedRole = ctx.get("X-Role");
+        const rolesRepository2 = ctx.db.getRepository("users.roles", ctx.state.currentUser.id);
+        const roles2 = await rolesRepository2.find({ fields: ["name"] });
+        const roleNames2 = roles2.map((role) => role.name);
+        ctx.state.currentRole = roleNames2.includes(requestedRole) ? requestedRole : roleNames2[0];
+        ctx.state.currentRoles = ctx.state.currentRole ? [ctx.state.currentRole] : roleNames2;
+      }
+      return true;
     }
     const jwt = (_a = ctx.app["authManager"]) == null ? void 0 : _a.jwt;
     if (!jwt) {
@@ -75,6 +80,16 @@ async function authenticateBearer(ctx) {
       ctx.body = (0, import_openai_format.toOpenAIError)(401, "Invalid or expired API key", "invalid_request_error", "invalid_api_key");
       return false;
     }
+    if (!decoded.roleName) {
+      ctx.status = 401;
+      ctx.body = (0, import_openai_format.toOpenAIError)(
+        401,
+        "Token was not resolved by the NocoBase auth middleware",
+        "invalid_request_error",
+        "invalid_api_key"
+      );
+      return false;
+    }
     const user = await ctx.db.getRepository("users").findOne({
       filterByTk: decoded.userId
     });
@@ -84,7 +99,22 @@ async function authenticateBearer(ctx) {
       return false;
     }
     ctx.state.currentUser = user;
-    ctx.state.currentRoles = decoded.roleName ? [decoded.roleName] : ["member"];
+    const rolesRepository = ctx.db.getRepository("users.roles", user.id);
+    const roles = await rolesRepository.find({ fields: ["name"] });
+    const roleNames = roles.map((role) => role.name);
+    if (!roleNames.includes(decoded.roleName)) {
+      ctx.status = 403;
+      ctx.body = (0, import_openai_format.toOpenAIError)(
+        403,
+        "The API key role is no longer assigned to this user",
+        "permission_denied",
+        "role_not_permitted"
+      );
+      return false;
+    }
+    ctx.state.currentRole = decoded.roleName;
+    ctx.state.currentRoles = [decoded.roleName];
+    ctx.state.aiApiAuthType = "apiKey";
     if (!ctx.auth) {
       ctx.auth = {};
     }

package/dist/server/routes/router.js

@@ -49,11 +49,12 @@ var import_embeddings = require("./embeddings");
 var import_openai_format = require("../utils/openai-format");
 var import_rate_limit = require("../middleware/rate-limit");
 var import_role_permission = require("../middleware/role-permission");
+var import_usage = require("../usage");
 const API_PREFIX = "/api/ai-llm/v1";
 function createAiLlmRouter(plugin) {
   const checkRateLimit = (0, import_rate_limit.createRateLimitMiddleware)(plugin.rateLimiter);
   return async (ctx, next) => {
-    var _a;
+    var _a, _b;
     const { path, method } = ctx;
     if (!path.startsWith(API_PREFIX)) {
       return next();
@@ -100,6 +101,18 @@ function createAiLlmRouter(plugin) {
     }
     const model = ((_a = ctx.request.body) == null ? void 0 : _a.model) ?? "-";
     const t0 = Date.now();
+    let usageId;
+    try {
+      usageId = await (0, import_usage.startUsageRecord)(
+        ctx,
+        requestId,
+        subPath,
+        String(model),
+        Boolean((_b = ctx.request.body) == null ? void 0 : _b.stream)
+      );
+    } catch (usageError) {
+      ctx.log.error("AI API usage record could not be created:", usageError);
+    }
     try {
       if (method === "POST" && subPath === "/chat/completions") {
         const mode = await resolveMode(ctx);
@@ -166,6 +179,14 @@ function createAiLlmRouter(plugin) {
         ctx.status = 500;
         ctx.body = (0, import_openai_format.toOpenAIError)(500, err.message || "Internal server error", "server_error");
       }
+    } finally {
+      if (usageId !== void 0) {
+        try {
+          await (0, import_usage.finishUsageRecord)(ctx, usageId, t0, ctx.status >= 200 && ctx.status < 400 ? "succeeded" : "failed");
+        } catch (usageError) {
+          ctx.log.error("AI API usage record could not be finalized:", usageError);
+        }
+      }
     }
   };
 }

package/dist/server/usage.js

@@ -0,0 +1,80 @@
+/**
+ * This file is part of the NocoBase (R) project.
+ * Copyright (c) 2020-2024 NocoBase Co., Ltd.
+ * Authors: NocoBase Team.
+ *
+ * This project is dual-licensed under AGPL-3.0 and NocoBase Commercial License.
+ * For more information, please refer to: https://www.nocobase.com/agreement.
+ */
+
+var __defProp = Object.defineProperty;
+var __getOwnPropDesc = Object.getOwnPropertyDescriptor;
+var __getOwnPropNames = Object.getOwnPropertyNames;
+var __hasOwnProp = Object.prototype.hasOwnProperty;
+var __export = (target, all) => {
+  for (var name in all)
+    __defProp(target, name, { get: all[name], enumerable: true });
+};
+var __copyProps = (to, from, except, desc) => {
+  if (from && typeof from === "object" || typeof from === "function") {
+    for (let key of __getOwnPropNames(from))
+      if (!__hasOwnProp.call(to, key) && key !== except)
+        __defProp(to, key, { get: () => from[key], enumerable: !(desc = __getOwnPropDesc(from, key)) || desc.enumerable });
+  }
+  return to;
+};
+var __toCommonJS = (mod) => __copyProps(__defProp({}, "__esModule", { value: true }), mod);
+var usage_exports = {};
+__export(usage_exports, {
+  finishUsageRecord: () => finishUsageRecord,
+  startUsageRecord: () => startUsageRecord
+});
+module.exports = __toCommonJS(usage_exports);
+async function startUsageRecord(ctx, requestId, endpoint, model, streaming) {
+  var _a, _b;
+  const body = ctx.request.body || {};
+  const messages = Array.isArray(body.messages) ? body.messages : void 0;
+  const oauth = ctx.state.oauthPrincipal;
+  const record = await ctx.db.getRepository("aiApiUsageRecords").create({
+    values: {
+      requestId,
+      userId: String((_a = ctx.state.currentUser) == null ? void 0 : _a.id),
+      roleName: ctx.state.currentRole || ((_b = ctx.state.currentRoles) == null ? void 0 : _b[0]) || "unknown",
+      authType: ctx.state.aiApiAuthType || (oauth ? "oidc" : "session"),
+      oauthClientId: oauth == null ? void 0 : oauth.clientId,
+      oauthSubject: oauth == null ? void 0 : oauth.subject,
+      oauthScopes: oauth == null ? void 0 : oauth.scopes,
+      endpoint,
+      mode: ctx.get("X-AI-Mode") || void 0,
+      model: model === "-" ? void 0 : model,
+      status: "pending",
+      streaming,
+      startedAt: /* @__PURE__ */ new Date(),
+      requestMetadata: { messageCount: messages == null ? void 0 : messages.length, requestedMaxTokens: body.max_tokens }
+    }
+  });
+  return record.id;
+}
+async function finishUsageRecord(ctx, id, startedAt, status) {
+  var _a;
+  const response = ctx.body || {};
+  const usage = response.usage;
+  const values = {
+    status,
+    httpStatus: ctx.status,
+    errorCode: (_a = response.error) == null ? void 0 : _a.code,
+    inputTokens: usage == null ? void 0 : usage.prompt_tokens,
+    outputTokens: usage == null ? void 0 : usage.completion_tokens,
+    totalTokens: usage == null ? void 0 : usage.total_tokens,
+    providerRequestId: response.id,
+    completedAt: /* @__PURE__ */ new Date(),
+    durationMs: Date.now() - startedAt,
+    responseMetadata: { usageSource: usage ? "response" : "unavailable" }
+  };
+  await ctx.db.getRepository("aiApiUsageRecords").update({ filterByTk: id, values });
+}
+// Annotate the CommonJS export names for ESM import in node:
+0 && (module.exports = {
+  finishUsageRecord,
+  startUsageRecord
+});

package/package.json

@@ -1,6 +1,6 @@
 {
   "name": "plugin-ai-api",
-  "version": "1.0.8",
+  "version": "1.0.9",
   "main": "dist/server/index.js",
   "dependencies": {},
   "peerDependencies": {

package/src/server/collections/ai-api-usage-records.ts

@@ -0,0 +1,33 @@
+import { defineCollection } from '@nocobase/database';
+
+export default defineCollection({
+  name: 'aiApiUsageRecords',
+  autoGenId: true,
+  fields: [
+    { name: 'requestId', type: 'string', unique: true, index: true },
+    { name: 'userId', type: 'string', index: true },
+    { name: 'roleName', type: 'string', index: true },
+    { name: 'authType', type: 'string', index: true },
+    { name: 'oauthClientId', type: 'string', allowNull: true, index: true },
+    { name: 'oauthSubject', type: 'string', allowNull: true },
+    { name: 'oauthScopes', type: 'json', allowNull: true },
+    { name: 'endpoint', type: 'string' },
+    { name: 'mode', type: 'string', allowNull: true },
+    { name: 'model', type: 'string', allowNull: true, index: true },
+    { name: 'status', type: 'string', index: true },
+    { name: 'httpStatus', type: 'integer', allowNull: true },
+    { name: 'errorCode', type: 'string', allowNull: true },
+    { name: 'streaming', type: 'boolean', defaultValue: false },
+    { name: 'inputTokens', type: 'integer', allowNull: true },
+    { name: 'outputTokens', type: 'integer', allowNull: true },
+    { name: 'totalTokens', type: 'integer', allowNull: true },
+    { name: 'estimatedCost', type: 'decimal', allowNull: true, precision: 20, scale: 8 },
+    { name: 'currency', type: 'string', allowNull: true },
+    { name: 'providerRequestId', type: 'string', allowNull: true },
+    { name: 'requestMetadata', type: 'jsonb', defaultValue: {} },
+    { name: 'responseMetadata', type: 'jsonb', defaultValue: {} },
+    { name: 'startedAt', type: 'datetimeTz', allowNull: true },
+    { name: 'completedAt', type: 'datetimeTz', allowNull: true },
+    { name: 'durationMs', type: 'integer', allowNull: true },
+  ],
+});

package/src/server/middleware/role-permission.ts

@@ -1,66 +1,79 @@
-/**
- * This file is part of the NocoBase (R) project.
- * Copyright (c) 2020-2024 NocoBase Co., Ltd.
- * Authors: NocoBase Team.
- *
- * This project is dual-licensed under AGPL-3.0 and NocoBase Commercial License.
- * For more information, please refer to: https://www.nocobase.com/agreement.
- */
-
-import { Context } from '@nocobase/actions';
-import { toOpenAIError } from '../utils/openai-format';
-
-/**
- * Check whether the authenticated role is allowed to use the AI API.
- * Loads the permission record and stores it in ctx.state.aiApiRolePermission.
- *
- * Returns true if access is allowed (caller may proceed).
- * Returns false if access is denied (403 already written to ctx, caller must return).
- *
- * The 'root' and 'admin' roles always bypass the check.
- */
-export async function checkRolePermission(ctx: Context): Promise<boolean> {
-  const roleName = ctx.state.currentRoles?.[0] || 'member';
-
-  // root / admin always allowed
-  if (roleName === 'root' || roleName === 'admin') {
-    return true;
-  }
-
-  const record = await ctx.db.getRepository('aiApiRolePermissions').findOne({
-    filter: { roleName },
-  });
-
-  if (!record?.enabled) {
-    ctx.status = 403;
-    ctx.body = toOpenAIError(
-      403,
-      `Role '${roleName}' is not authorized to use the AI API. ` +
-        `An admin must enable access in Settings → Users & Permissions → [Role] → AI API.`,
-      'permission_denied',
-      'role_not_permitted',
-    );
-    return false;
-  }
-
-  // Store for downstream handlers
-  ctx.state.aiApiRolePermission = record;
-  return true;
-}
-
-/**
- * Check whether the current role is allowed to use a specific AI Employee.
- * Must be called after checkRolePermission (so ctx.state.aiApiRolePermission is set).
- *
- * Returns true when:
- * - Role is admin/root (no permission record stored)
- * - allowAllEmployees is true
- * - The employeeUsername is in the allowedEmployees list
- */
-export function checkEmployeeAccess(ctx: Context, employeeUsername: string): boolean {
-  const perm = ctx.state.aiApiRolePermission;
-  // admin/root paths have no record stored → always allowed
-  if (!perm) return true;
-  if (perm.allowAllEmployees) return true;
-  return ((perm.allowedEmployees as string[]) || []).includes(employeeUsername);
-}
+/**
+ * This file is part of the NocoBase (R) project.
+ * Copyright (c) 2020-2024 NocoBase Co., Ltd.
+ * Authors: NocoBase Team.
+ *
+ * This project is dual-licensed under AGPL-3.0 and NocoBase Commercial License.
+ * For more information, please refer to: https://www.nocobase.com/agreement.
+ */
+
+import { Context } from '@nocobase/actions';
+import { toOpenAIError } from '../utils/openai-format';
+
+const PERMISSION_TTL_MS = 15_000;
+const permissionCache = new Map<string, { record: any; expiresAt: number }>();
+
+export function invalidateRolePermissionCache(roleName?: string): void {
+  if (roleName) permissionCache.delete(roleName);
+  else permissionCache.clear();
+}
+
+/**
+ * Check whether the authenticated role is allowed to use the AI API.
+ * Loads the permission record and stores it in ctx.state.aiApiRolePermission.
+ *
+ * Returns true if access is allowed (caller may proceed).
+ * Returns false if access is denied (403 already written to ctx, caller must return).
+ *
+ * The 'root' and 'admin' roles always bypass the check.
+ */
+export async function checkRolePermission(ctx: Context): Promise<boolean> {
+  const roleName = ctx.state.currentRoles?.[0] || 'member';
+
+  // root / admin always allowed
+  if (roleName === 'root' || roleName === 'admin') {
+    return true;
+  }
+
+  const cached = permissionCache.get(roleName);
+  const record =
+    cached && cached.expiresAt > Date.now()
+      ? cached.record
+      : await ctx.db.getRepository('aiApiRolePermissions').findOne({ filter: { roleName } });
+  if (!cached || cached.expiresAt <= Date.now()) {
+    permissionCache.set(roleName, { record, expiresAt: Date.now() + PERMISSION_TTL_MS });
+  }
+
+  if (!record?.enabled) {
+    ctx.status = 403;
+    ctx.body = toOpenAIError(
+      403,
+      `Role '${roleName}' is not authorized to use the AI API. ` +
+        `An admin must enable access in Settings → Users & Permissions → [Role] → AI API.`,
+      'permission_denied',
+      'role_not_permitted',
+    );
+    return false;
+  }
+
+  // Store for downstream handlers
+  ctx.state.aiApiRolePermission = record;
+  return true;
+}
+
+/**
+ * Check whether the current role is allowed to use a specific AI Employee.
+ * Must be called after checkRolePermission (so ctx.state.aiApiRolePermission is set).
+ *
+ * Returns true when:
+ * - Role is admin/root (no permission record stored)
+ * - allowAllEmployees is true
+ * - The employeeUsername is in the allowedEmployees list
+ */
+export function checkEmployeeAccess(ctx: Context, employeeUsername: string): boolean {
+  const perm = ctx.state.aiApiRolePermission;
+  // admin/root paths have no record stored → always allowed
+  if (!perm) return true;
+  if (perm.allowAllEmployees) return true;
+  return ((perm.allowedEmployees as string[]) || []).includes(employeeUsername);
+}