plugin-ai-api 1.0.8 → 1.0.9

package/src/server/plugin.ts

@@ -1,89 +1,99 @@
-/**
- * This file is part of the NocoBase (R) project.
- * Copyright (c) 2020-2024 NocoBase Co., Ltd.
- * Authors: NocoBase Team.
- *
- * This project is dual-licensed under AGPL-3.0 and NocoBase Commercial License.
- * For more information, please refer to: https://www.nocobase.com/agreement.
- */
-
-import { Plugin } from '@nocobase/server';
-import { createAiLlmRouter } from './routes/router';
-import aiApiConfigResource from './resource/ai-api-config';
-import { RateLimiter } from './utils/rate-limiter';
-
-// Ensure dayjs timezone + utc plugins are loaded.
-// Some Docker builds ship an older @nocobase/utils whose dayjs.js does not
-// extend the 'timezone' plugin, causing utcOffset(value) to behave as a
-// getter (returns a number) instead of a setter (returns a dayjs instance).
-// That breaks parse-filter.js's utc2unit() → "m.startOf is not a function".
-// Extending here patches the shared CommonJS dayjs module instance for the
-// entire Node.js process before any AIEmployee call is made.
-import dayjsLib from 'dayjs';
-import utcPlugin from 'dayjs/plugin/utc';
-import timezonePlugin from 'dayjs/plugin/timezone';
-(dayjsLib as any).extend(utcPlugin);
-(dayjsLib as any).extend(timezonePlugin);
-
-export class PluginAiApiServer extends Plugin {
-  /**
-   * Singleton rate limiter — lives for the entire plugin lifetime, shared across all requests.
-   * Uses a 1-minute sliding window to enforce rateLimitPerMinute from aiApiConfig.
-   */
-  rateLimiter = new RateLimiter(60_000);
-
-  private gcInterval: NodeJS.Timeout | null = null;
-
-  async afterAdd() {}
-
-  async beforeLoad() {}
-
-  async load() {
-    // 1. Register raw Koa middleware for OpenAI-compatible endpoints
-    //    Must run before 'resourcer' so URL paths match OpenAI convention
-    this.app.use(createAiLlmRouter(this), { before: 'resourcer' });
-
-    // 2. Register admin config resource
-    this.app.resourceManager.define(aiApiConfigResource);
-
-    // 3. Set ACL permissions for admin config + role permissions management
-    this.app.acl.registerSnippet({
-      name: `pm.${this.name}.configuration`,
-      actions: ['aiApiConfig:*', 'aiApiRolePermissions:*'],
-    });
-
-    // 4. GC the rate limiter every 5 minutes to evict stale user entries.
-    //    .unref() prevents this timer from keeping the process alive on shutdown.
-    this.gcInterval = setInterval(() => this.rateLimiter.gc(), 5 * 60 * 1000);
-    this.gcInterval.unref();
-  }
-
-  async install() {
-    // Create default config record on first install
-    const existing = await this.db.getRepository('aiApiConfig').findOne();
-    if (!existing) {
-      await this.db.getRepository('aiApiConfig').create({
-        values: {
-          defaultAiEmployee: '',
-          enabledLlmServices: [],
-          rateLimitPerMinute: 60,
-        },
-      });
-    }
-  }
-
-  async afterEnable() {}
-
-  async afterDisable() {}
-
-  async remove() {
-    // Clean up the GC timer so we don't leak resources during hot-reload
-    if (this.gcInterval) {
-      clearInterval(this.gcInterval);
-      this.gcInterval = null;
-    }
-    this.rateLimiter.clear();
-  }
-}
-
-export default PluginAiApiServer;
+/**
+ * This file is part of the NocoBase (R) project.
+ * Copyright (c) 2020-2024 NocoBase Co., Ltd.
+ * Authors: NocoBase Team.
+ *
+ * This project is dual-licensed under AGPL-3.0 and NocoBase Commercial License.
+ * For more information, please refer to: https://www.nocobase.com/agreement.
+ */
+
+import { Plugin } from '@nocobase/server';
+import { createAiLlmRouter } from './routes/router';
+import aiApiConfigResource from './resource/ai-api-config';
+import { RateLimiter } from './utils/rate-limiter';
+import { invalidateRolePermissionCache } from './middleware/role-permission';
+
+// Ensure dayjs timezone + utc plugins are loaded.
+// Some Docker builds ship an older @nocobase/utils whose dayjs.js does not
+// extend the 'timezone' plugin, causing utcOffset(value) to behave as a
+// getter (returns a number) instead of a setter (returns a dayjs instance).
+// That breaks parse-filter.js's utc2unit() → "m.startOf is not a function".
+// Extending here patches the shared CommonJS dayjs module instance for the
+// entire Node.js process before any AIEmployee call is made.
+import dayjsLib from 'dayjs';
+import utcPlugin from 'dayjs/plugin/utc';
+import timezonePlugin from 'dayjs/plugin/timezone';
+(dayjsLib as any).extend(utcPlugin);
+(dayjsLib as any).extend(timezonePlugin);
+
+export class PluginAiApiServer extends Plugin {
+  /**
+   * Singleton rate limiter — lives for the entire plugin lifetime, shared across all requests.
+   * Uses a 1-minute sliding window to enforce rateLimitPerMinute from aiApiConfig.
+   */
+  rateLimiter = new RateLimiter(60_000);
+
+  private gcInterval: NodeJS.Timeout | null = null;
+
+  async afterAdd() {}
+
+  async beforeLoad() {}
+
+  async load() {
+    // 1. Register raw Koa middleware for OpenAI-compatible endpoints
+    //    Must run before 'resourcer' so URL paths match OpenAI convention
+    // OIDC access tokens must first pass through plugin-idp-oauth, which validates
+    // issuer/audience/scope and rewrites them to a NocoBase internal token.
+    this.app.use(createAiLlmRouter(this), { after: 'idp-oauth-resource-auth', before: 'resourcer' });
+
+    // 2. Register admin config resource
+    this.app.resourceManager.define(aiApiConfigResource);
+
+    this.app.db.on('aiApiRolePermissions.afterSave', (model) => {
+      invalidateRolePermissionCache(model.get('roleName'));
+    });
+    this.app.db.on('aiApiRolePermissions.afterDestroy', (model) => {
+      invalidateRolePermissionCache(model.get('roleName'));
+    });
+
+    // 3. Set ACL permissions for admin config + role permissions management
+    this.app.acl.registerSnippet({
+      name: `pm.${this.name}.configuration`,
+      actions: ['aiApiConfig:*', 'aiApiRolePermissions:*'],
+    });
+
+    // 4. GC the rate limiter every 5 minutes to evict stale user entries.
+    //    .unref() prevents this timer from keeping the process alive on shutdown.
+    this.gcInterval = setInterval(() => this.rateLimiter.gc(), 5 * 60 * 1000);
+    this.gcInterval.unref();
+  }
+
+  async install() {
+    // Create default config record on first install
+    const existing = await this.db.getRepository('aiApiConfig').findOne();
+    if (!existing) {
+      await this.db.getRepository('aiApiConfig').create({
+        values: {
+          defaultAiEmployee: '',
+          enabledLlmServices: [],
+          rateLimitPerMinute: 60,
+        },
+      });
+    }
+  }
+
+  async afterEnable() {}
+
+  async afterDisable() {}
+
+  async remove() {
+    // Clean up the GC timer so we don't leak resources during hot-reload
+    if (this.gcInterval) {
+      clearInterval(this.gcInterval);
+      this.gcInterval = null;
+    }
+    this.rateLimiter.clear();
+  }
+}
+
+export default PluginAiApiServer;

package/src/server/routes/auth.ts

@@ -1,111 +1,142 @@
-/**
- * This file is part of the NocoBase (R) project.
- * Copyright (c) 2020-2024 NocoBase Co., Ltd.
- * Authors: NocoBase Team.
- *
- * This project is dual-licensed under AGPL-3.0 and NocoBase Commercial License.
- * For more information, please refer to: https://www.nocobase.com/agreement.
- */
-
-import { Context, Next } from '@nocobase/actions';
-import { toOpenAIError } from '../utils/openai-format';
-
-/**
- * Authentication middleware for /api/ai-llm/v1/* routes.
- *
- * Validates Bearer token against NocoBase's apiKeys collection.
- * Sets ctx.state.currentUser for downstream handlers.
- */
-export async function authenticateBearer(ctx: Context): Promise<boolean> {
-  const authHeader = ctx.get('Authorization') || '';
-  if (!authHeader.startsWith('Bearer ')) {
-    ctx.status = 401;
-    ctx.body = toOpenAIError(
-      401,
-      'Missing or invalid Authorization header. Expected: Bearer <api-key>',
-      'invalid_request_error',
-      'invalid_api_key',
-    );
-    return false;
-  }
-
-  const token = authHeader.substring(7).trim();
-  if (!token) {
-    ctx.status = 401;
-    ctx.body = toOpenAIError(401, 'API key is empty', 'invalid_request_error', 'invalid_api_key');
-    return false;
-  }
-
-  try {
-    // Use NocoBase's auth system directly to validate the token.
-    // NocoBase API keys are JWT tokens signed with the app secret.
-    // We decode them directly via authManager.jwt rather than going through
-    // the full NocoBase auth middleware stack (which requires being inside
-    // the resourcer pipeline, but we run before it).
-    const auth = ctx.app['authManager'];
-    if (!auth) {
-      ctx.status = 500;
-      ctx.body = toOpenAIError(500, 'Auth system not available', 'server_error');
-      return false;
-    }
-
-    // Try to authenticate using the token as a NocoBase JWT/API token
-    // NocoBase API keys are essentially JWT tokens signed with the app secret
-    const jwt = ctx.app['authManager']?.jwt;
-    if (!jwt) {
-      ctx.status = 500;
-      ctx.body = toOpenAIError(500, 'JWT system not available', 'server_error');
-      return false;
-    }
-
-    let decoded: any;
-    try {
-      decoded = await jwt.decode(token);
-    } catch (e) {
-      ctx.status = 401;
-      ctx.body = toOpenAIError(401, 'Incorrect API key provided', 'invalid_request_error', 'invalid_api_key');
-      return false;
-    }
-
-    if (!decoded || !decoded.userId) {
-      ctx.status = 401;
-      ctx.body = toOpenAIError(401, 'Invalid or expired API key', 'invalid_request_error', 'invalid_api_key');
-      return false;
-    }
-
-    // Load user
-    const user = await ctx.db.getRepository('users').findOne({
-      filterByTk: decoded.userId,
-    });
-
-    if (!user) {
-      ctx.status = 401;
-      ctx.body = toOpenAIError(401, 'User not found for this API key', 'invalid_request_error', 'invalid_api_key');
-      return false;
-    }
-
-    // Set user context for downstream handlers
-    ctx.state.currentUser = user;
-    ctx.state.currentRoles = decoded.roleName ? [decoded.roleName] : ['member'];
-
-    // Also set ctx.auth for AIEmployee compatibility.
-    // Only expose non-sensitive fields — exclude password, token, 2FA secrets, etc.
-    if (!ctx.auth) {
-      (ctx as any).auth = {};
-    }
-    const SAFE_USER_FIELDS = new Set(['id', 'username', 'nickname', 'email', 'createdAt', 'updatedAt']);
-    const rawUser = user.toJSON?.() ?? {};
-    const safeUser: Record<string, any> = { id: user.id };
-    for (const field of SAFE_USER_FIELDS) {
-      if (rawUser[field] !== undefined) safeUser[field] = rawUser[field];
-    }
-    (ctx as any).auth.user = safeUser;
-
-    return true;
-  } catch (err) {
-    ctx.log.error('AI API auth error:', err);
-    ctx.status = 401;
-    ctx.body = toOpenAIError(401, 'Authentication failed', 'invalid_request_error', 'invalid_api_key');
-    return false;
-  }
-}
+/**
+ * This file is part of the NocoBase (R) project.
+ * Copyright (c) 2020-2024 NocoBase Co., Ltd.
+ * Authors: NocoBase Team.
+ *
+ * This project is dual-licensed under AGPL-3.0 and NocoBase Commercial License.
+ * For more information, please refer to: https://www.nocobase.com/agreement.
+ */
+
+import { Context } from '@nocobase/actions';
+import { toOpenAIError } from '../utils/openai-format';
+
+/**
+ * Authentication middleware for /api/ai-llm/v1/* routes.
+ *
+ * Resolve the principal prepared by NocoBase auth/ACL middleware. OIDC resource
+ * authentication rewrites the external access token to an internal session token
+ * and sets currentUser before this gateway runs. API keys are the one case where
+ * we still need to decode the token locally because they are signed directly by
+ * NocoBase and carry a fixed roleName.
+ */
+export async function authenticateBearer(ctx: Context): Promise<boolean> {
+  const authHeader = ctx.get('Authorization') || '';
+  if (!authHeader.startsWith('Bearer ')) {
+    ctx.status = 401;
+    ctx.body = toOpenAIError(
+      401,
+      'Missing or invalid Authorization header. Expected: Bearer <access-token>',
+      'invalid_request_error',
+      'invalid_api_key',
+    );
+    return false;
+  }
+
+  const token = authHeader.substring(7).trim();
+  if (!token) {
+    ctx.status = 401;
+    ctx.body = toOpenAIError(401, 'API key is empty', 'invalid_request_error', 'invalid_api_key');
+    return false;
+  }
+
+  try {
+    if (ctx.state.currentUser) {
+      if (!ctx.state.currentRole) {
+        const requestedRole = ctx.get('X-Role');
+        const rolesRepository = ctx.db.getRepository('users.roles', ctx.state.currentUser.id);
+        const roles = await rolesRepository.find({ fields: ['name'] });
+        const roleNames = roles.map((role: { name: string }) => role.name);
+        ctx.state.currentRole = roleNames.includes(requestedRole) ? requestedRole : roleNames[0];
+        ctx.state.currentRoles = ctx.state.currentRole ? [ctx.state.currentRole] : roleNames;
+      }
+      return true;
+    }
+
+    // Try to authenticate using the token as a NocoBase JWT/API token
+    // NocoBase API keys are essentially JWT tokens signed with the app secret
+    const jwt = ctx.app['authManager']?.jwt;
+    if (!jwt) {
+      ctx.status = 500;
+      ctx.body = toOpenAIError(500, 'JWT system not available', 'server_error');
+      return false;
+    }
+
+    let decoded: { userId?: string | number; roleName?: string; temp?: boolean };
+    try {
+      decoded = await jwt.decode(token);
+    } catch (e) {
+      ctx.status = 401;
+      ctx.body = toOpenAIError(401, 'Incorrect API key provided', 'invalid_request_error', 'invalid_api_key');
+      return false;
+    }
+
+    if (!decoded || !decoded.userId) {
+      ctx.status = 401;
+      ctx.body = toOpenAIError(401, 'Invalid or expired API key', 'invalid_request_error', 'invalid_api_key');
+      return false;
+    }
+
+    // This fallback is for API keys only. A normal login/OIDC token should have
+    // been resolved by NocoBase auth middleware and must not be treated as the
+    // member role merely because it has no roleName claim.
+    if (!decoded.roleName) {
+      ctx.status = 401;
+      ctx.body = toOpenAIError(
+        401,
+        'Token was not resolved by the NocoBase auth middleware',
+        'invalid_request_error',
+        'invalid_api_key',
+      );
+      return false;
+    }
+
+    const user = await ctx.db.getRepository('users').findOne({
+      filterByTk: decoded.userId,
+    });
+
+    if (!user) {
+      ctx.status = 401;
+      ctx.body = toOpenAIError(401, 'User not found for this API key', 'invalid_request_error', 'invalid_api_key');
+      return false;
+    }
+
+    // Set user context for downstream handlers
+    ctx.state.currentUser = user;
+    const rolesRepository = ctx.db.getRepository('users.roles', user.id);
+    const roles = await rolesRepository.find({ fields: ['name'] });
+    const roleNames = roles.map((role: { name: string }) => role.name);
+    if (!roleNames.includes(decoded.roleName)) {
+      ctx.status = 403;
+      ctx.body = toOpenAIError(
+        403,
+        'The API key role is no longer assigned to this user',
+        'permission_denied',
+        'role_not_permitted',
+      );
+      return false;
+    }
+    ctx.state.currentRole = decoded.roleName;
+    ctx.state.currentRoles = [decoded.roleName];
+    ctx.state.aiApiAuthType = 'apiKey';
+
+    // Also set ctx.auth for AIEmployee compatibility.
+    // Only expose non-sensitive fields — exclude password, token, 2FA secrets, etc.
+    if (!ctx.auth) {
+      (ctx as any).auth = {};
+    }
+    const SAFE_USER_FIELDS = new Set(['id', 'username', 'nickname', 'email', 'createdAt', 'updatedAt']);
+    const rawUser = user.toJSON?.() ?? {};
+    const safeUser: Record<string, any> = { id: user.id };
+    for (const field of SAFE_USER_FIELDS) {
+      if (rawUser[field] !== undefined) safeUser[field] = rawUser[field];
+    }
+    (ctx as any).auth.user = safeUser;
+
+    return true;
+  } catch (err) {
+    ctx.log.error('AI API auth error:', err);
+    ctx.status = 401;
+    ctx.body = toOpenAIError(401, 'Authentication failed', 'invalid_request_error', 'invalid_api_key');
+    return false;
+  }
+}