plugin-ai-api 1.1.1 → 1.1.2

package/dist/server/middleware/response-record-resource.js

@@ -0,0 +1,66 @@
+/**
+ * This file is part of the NocoBase (R) project.
+ * Copyright (c) 2020-2024 NocoBase Co., Ltd.
+ * Authors: NocoBase Team.
+ *
+ * This project is dual-licensed under AGPL-3.0 and NocoBase Commercial License.
+ * For more information, please refer to: https://www.nocobase.com/agreement.
+ */
+
+var __defProp = Object.defineProperty;
+var __getOwnPropDesc = Object.getOwnPropertyDescriptor;
+var __getOwnPropNames = Object.getOwnPropertyNames;
+var __hasOwnProp = Object.prototype.hasOwnProperty;
+var __export = (target, all) => {
+  for (var name in all)
+    __defProp(target, name, { get: all[name], enumerable: true });
+};
+var __copyProps = (to, from, except, desc) => {
+  if (from && typeof from === "object" || typeof from === "function") {
+    for (let key of __getOwnPropNames(from))
+      if (!__hasOwnProp.call(to, key) && key !== except)
+        __defProp(to, key, { get: () => from[key], enumerable: !(desc = __getOwnPropDesc(from, key)) || desc.enumerable });
+  }
+  return to;
+};
+var __toCommonJS = (mod) => __copyProps(__defProp({}, "__esModule", { value: true }), mod);
+var response_record_resource_exports = {};
+__export(response_record_resource_exports, {
+  RESPONSE_RECORD_COLLECTION: () => RESPONSE_RECORD_COLLECTION,
+  blockResponseRecordResource: () => blockResponseRecordResource,
+  targetsResponseRecordCollection: () => targetsResponseRecordCollection
+});
+module.exports = __toCommonJS(response_record_resource_exports);
+const RESPONSE_RECORD_COLLECTION = "aiApiResponseRecords";
+function routeCandidates(ctx) {
+  var _a, _b;
+  const params = (_a = ctx.action) == null ? void 0 : _a.params;
+  const candidates = [(_b = ctx.action) == null ? void 0 : _b.resourceName, params == null ? void 0 : params.resourceName, params == null ? void 0 : params.associatedName, params == null ? void 0 : params.targetCollection];
+  return candidates.filter((value) => typeof value === "string").flatMap((value) => value.split("."));
+}
+function targetsResponseRecordCollection(ctx) {
+  var _a, _b;
+  const repositoryContext = ctx;
+  if (repositoryContext.getCurrentRepository) {
+    try {
+      if (((_b = (_a = repositoryContext.getCurrentRepository()) == null ? void 0 : _a.targetCollection) == null ? void 0 : _b.name) === RESPONSE_RECORD_COLLECTION) return true;
+    } catch {
+    }
+  }
+  return routeCandidates(ctx).includes(RESPONSE_RECORD_COLLECTION);
+}
+function blockResponseRecordResource() {
+  return async (ctx, next) => {
+    if (targetsResponseRecordCollection(ctx)) {
+      ctx.throw(404, "Not Found");
+      return;
+    }
+    await next();
+  };
+}
+// Annotate the CommonJS export names for ESM import in node:
+0 && (module.exports = {
+  RESPONSE_RECORD_COLLECTION,
+  blockResponseRecordResource,
+  targetsResponseRecordCollection
+});

package/dist/server/middleware/role-permission.js

@@ -35,38 +35,63 @@ var import_openai_format = require("../utils/openai-format");
 const PERMISSION_TTL_MS = 15e3;
 const permissionCache = /* @__PURE__ */ new Map();
 function invalidateRolePermissionCache(roleName) {
-  if (roleName) permissionCache.delete(roleName);
-  else permissionCache.clear();
+  if (!roleName) {
+    permissionCache.clear();
+    return;
+  }
+  const suffix = `:role:${roleName}`;
+  for (const key of permissionCache.keys()) {
+    if (key.endsWith(suffix)) permissionCache.delete(key);
+  }
 }
-async function checkRolePermission(ctx) {
-  var _a;
-  const roleName = ((_a = ctx.state.currentRoles) == null ? void 0 : _a[0]) || "member";
-  if (roleName === "root" || roleName === "admin") {
-    return true;
+function unwrapRecord(raw) {
+  if (!raw) return null;
+  if (typeof raw.get === "function") {
+    const model = raw;
+    return {
+      roleName: model.get("roleName"),
+      enabled: model.get("enabled"),
+      allowAllEmployees: model.get("allowAllEmployees"),
+      allowedEmployees: model.get("allowedEmployees")
+    };
   }
-  const cached = permissionCache.get(roleName);
-  const record = cached && cached.expiresAt > Date.now() ? cached.record : await ctx.db.getRepository("aiApiRolePermissions").findOne({ filter: { roleName } });
-  if (!cached || cached.expiresAt <= Date.now()) {
-    permissionCache.set(roleName, { record, expiresAt: Date.now() + PERMISSION_TTL_MS });
+  return raw;
+}
+async function loadRolePermission(ctx, roleName) {
+  var _a;
+  const cacheKey = `${((_a = ctx.app) == null ? void 0 : _a.name) ?? "main"}:role:${roleName}`;
+  const cached = permissionCache.get(cacheKey);
+  if (cached && cached.expiresAt > Date.now()) {
+    return cached.record;
   }
-  if (!(record == null ? void 0 : record.enabled)) {
+  const record = unwrapRecord(await ctx.db.getRepository("aiApiRolePermissions").findOne({ filter: { roleName } }));
+  permissionCache.set(cacheKey, { record, expiresAt: Date.now() + PERMISSION_TTL_MS });
+  return record;
+}
+async function checkRolePermission(ctx) {
+  var _a;
+  const roleNames = ((_a = ctx.state.currentRoles) == null ? void 0 : _a.length) ? ctx.state.currentRoles : [ctx.state.currentRole || "member"];
+  const records = (await Promise.all(roleNames.map((name) => loadRolePermission(ctx, name)))).filter(
+    (record) => !!(record == null ? void 0 : record.enabled)
+  );
+  if (!records.length) {
     ctx.status = 403;
     ctx.body = (0, import_openai_format.toOpenAIError)(
       403,
-      `Role '${roleName}' is not authorized to use the AI API. An admin must enable access in Settings \u2192 Users & Permissions \u2192 [Role] \u2192 AI API.`,
+      `None of the roles [${roleNames.join(", ")}] is authorized to use the AI API. An admin must enable access in Settings \u2192 Users & Permissions \u2192 [Role] \u2192 AI API.`,
       "permission_denied",
       "role_not_permitted"
     );
     return false;
   }
-  ctx.state.aiApiRolePermission = record;
+  ctx.state.aiApiRolePermissions = records;
   return true;
 }
 function checkEmployeeAccess(ctx, employeeUsername) {
-  const perm = ctx.state.aiApiRolePermission;
-  if (!perm) return true;
-  if (perm.allowAllEmployees) return true;
-  return (perm.allowedEmployees || []).includes(employeeUsername);
+  const perms = ctx.state.aiApiRolePermissions || [];
+  return perms.some(
+    (perm) => perm.allowAllEmployees || (perm.allowedEmployees || []).includes(employeeUsername)
+  );
 }
 // Annotate the CommonJS export names for ESM import in node:
 0 && (module.exports = {

package/dist/server/migrations/20260901000000-remove-default-group-members.js

@@ -0,0 +1,60 @@
+/**
+ * This file is part of the NocoBase (R) project.
+ * Copyright (c) 2020-2024 NocoBase Co., Ltd.
+ * Authors: NocoBase Team.
+ *
+ * This project is dual-licensed under AGPL-3.0 and NocoBase Commercial License.
+ * For more information, please refer to: https://www.nocobase.com/agreement.
+ */
+
+var __defProp = Object.defineProperty;
+var __getOwnPropDesc = Object.getOwnPropertyDescriptor;
+var __getOwnPropNames = Object.getOwnPropertyNames;
+var __hasOwnProp = Object.prototype.hasOwnProperty;
+var __export = (target, all) => {
+  for (var name in all)
+    __defProp(target, name, { get: all[name], enumerable: true });
+};
+var __copyProps = (to, from, except, desc) => {
+  if (from && typeof from === "object" || typeof from === "function") {
+    for (let key of __getOwnPropNames(from))
+      if (!__hasOwnProp.call(to, key) && key !== except)
+        __defProp(to, key, { get: () => from[key], enumerable: !(desc = __getOwnPropDesc(from, key)) || desc.enumerable });
+  }
+  return to;
+};
+var __toCommonJS = (mod) => __copyProps(__defProp({}, "__esModule", { value: true }), mod);
+var remove_default_group_members_exports = {};
+__export(remove_default_group_members_exports, {
+  default: () => RemoveDefaultGroupMembers
+});
+module.exports = __toCommonJS(remove_default_group_members_exports);
+var import_server = require("@nocobase/server");
+class RemoveDefaultGroupMembers extends import_server.Migration {
+  // afterSync: aiApiGroupMembers / aiApiUsageGroups must be registered and synced.
+  on = "afterSync";
+  async up() {
+    const groupCollection = this.db.getCollection("aiApiUsageGroups");
+    const memberCollection = this.db.getCollection("aiApiGroupMembers");
+    if (!groupCollection || !memberCollection) return;
+    if (!await groupCollection.existsInDb() || !await memberCollection.existsInDb()) return;
+    const defaultGroup = await this.db.getRepository("aiApiUsageGroups").findOne({
+      filter: { isDefault: true }
+    });
+    if (!defaultGroup) return;
+    const groupId = defaultGroup.get("id");
+    const members = await this.db.getRepository("aiApiGroupMembers").find({
+      filter: { groupId }
+    });
+    for (const member of members) {
+      await this.db.getRepository("aiApiGroupMembers").destroy({ filterByTk: member.get("id") });
+    }
+    if (members.length) {
+      this.app.logger.info(
+        `[ai-api] Removed ${members.length} explicit member row(s) from the default usage group; those users now fall back to it implicitly.`
+      );
+    }
+  }
+  async down() {
+  }
+}

package/dist/server/migrations/20260902000000-seed-default-role-permissions.js

@@ -0,0 +1,55 @@
+/**
+ * This file is part of the NocoBase (R) project.
+ * Copyright (c) 2020-2024 NocoBase Co., Ltd.
+ * Authors: NocoBase Team.
+ *
+ * This project is dual-licensed under AGPL-3.0 and NocoBase Commercial License.
+ * For more information, please refer to: https://www.nocobase.com/agreement.
+ */
+
+var __defProp = Object.defineProperty;
+var __getOwnPropDesc = Object.getOwnPropertyDescriptor;
+var __getOwnPropNames = Object.getOwnPropertyNames;
+var __hasOwnProp = Object.prototype.hasOwnProperty;
+var __export = (target, all) => {
+  for (var name in all)
+    __defProp(target, name, { get: all[name], enumerable: true });
+};
+var __copyProps = (to, from, except, desc) => {
+  if (from && typeof from === "object" || typeof from === "function") {
+    for (let key of __getOwnPropNames(from))
+      if (!__hasOwnProp.call(to, key) && key !== except)
+        __defProp(to, key, { get: () => from[key], enumerable: !(desc = __getOwnPropDesc(from, key)) || desc.enumerable });
+  }
+  return to;
+};
+var __toCommonJS = (mod) => __copyProps(__defProp({}, "__esModule", { value: true }), mod);
+var seed_default_role_permissions_exports = {};
+__export(seed_default_role_permissions_exports, {
+  default: () => SeedDefaultRolePermissions
+});
+module.exports = __toCommonJS(seed_default_role_permissions_exports);
+var import_server = require("@nocobase/server");
+class SeedDefaultRolePermissions extends import_server.Migration {
+  // afterSync: aiApiRolePermissions must be registered and synced before we write to it.
+  on = "afterSync";
+  async up() {
+    const collection = this.db.getCollection("aiApiRolePermissions");
+    if (!collection || !await collection.existsInDb()) return;
+    const repository = this.db.getRepository("aiApiRolePermissions");
+    const rolesToSeed = [
+      { roleName: "root", enabled: true, allowAllEmployees: true, allowedEmployees: [] },
+      { roleName: "admin", enabled: true, allowAllEmployees: true, allowedEmployees: [] }
+    ];
+    for (const values of rolesToSeed) {
+      const existing = await repository.findOne({ filter: { roleName: values.roleName } });
+      if (existing) continue;
+      await repository.create({ values });
+      this.app.logger.info(
+        `[ai-api] Seeded aiApiRolePermissions for role ${values.roleName} (the built-in bypass was removed).`
+      );
+    }
+  }
+  async down() {
+  }
+}

package/dist/server/migrations/20260903000000-seed-sample-response-records.js

@@ -0,0 +1,170 @@
+/**
+ * This file is part of the NocoBase (R) project.
+ * Copyright (c) 2020-2024 NocoBase Co., Ltd.
+ * Authors: NocoBase Team.
+ *
+ * This project is dual-licensed under AGPL-3.0 and NocoBase Commercial License.
+ * For more information, please refer to: https://www.nocobase.com/agreement.
+ */
+
+var __defProp = Object.defineProperty;
+var __getOwnPropDesc = Object.getOwnPropertyDescriptor;
+var __getOwnPropNames = Object.getOwnPropertyNames;
+var __hasOwnProp = Object.prototype.hasOwnProperty;
+var __export = (target, all) => {
+  for (var name in all)
+    __defProp(target, name, { get: all[name], enumerable: true });
+};
+var __copyProps = (to, from, except, desc) => {
+  if (from && typeof from === "object" || typeof from === "function") {
+    for (let key of __getOwnPropNames(from))
+      if (!__hasOwnProp.call(to, key) && key !== except)
+        __defProp(to, key, { get: () => from[key], enumerable: !(desc = __getOwnPropDesc(from, key)) || desc.enumerable });
+  }
+  return to;
+};
+var __toCommonJS = (mod) => __copyProps(__defProp({}, "__esModule", { value: true }), mod);
+var seed_sample_response_records_exports = {};
+__export(seed_sample_response_records_exports, {
+  default: () => SeedSampleResponseRecord
+});
+module.exports = __toCommonJS(seed_sample_response_records_exports);
+var import_server = require("@nocobase/server");
+const SAMPLE_IDS = ["resp_sample_welcome", "resp_sample_followup"];
+class SeedSampleResponseRecord extends import_server.Migration {
+  on = "afterSync";
+  async up() {
+    const collection = this.db.getCollection("aiApiResponseRecords");
+    if (!collection || !await collection.existsInDb()) return;
+    if (process.env.NODE_ENV === "production" && process.env.AI_API_SEED_SAMPLE_RESPONSES !== "true") {
+      this.app.logger.info(
+        "[ai-api] Skipped sample response records in production (set AI_API_SEED_SAMPLE_RESPONSES=true to enable)."
+      );
+      return;
+    }
+    const rootUser = await this.db.getRepository("users").findOne({ filter: { "roles.name": "root" } });
+    if (!rootUser) {
+      this.app.logger.warn("[ai-api] Skipped sample response records because no root user exists.");
+      return;
+    }
+    const repository = this.db.getRepository("aiApiResponseRecords");
+    const now = Math.floor(Date.now() / 1e3);
+    const expiresAt = new Date(Date.now() + 30 * 24 * 60 * 60 * 1e3);
+    const firstOutput = {
+      id: SAMPLE_IDS[0],
+      object: "response",
+      created_at: now,
+      completed_at: now,
+      status: "completed",
+      error: null,
+      incomplete_details: null,
+      instructions: null,
+      max_output_tokens: null,
+      model: "sample/gpt-4",
+      output: [
+        {
+          id: "msg_sample_welcome",
+          type: "message",
+          status: "completed",
+          role: "assistant",
+          content: [
+            {
+              type: "output_text",
+              text: "Hello! Welcome to the NocoBase AI API. How can I help you today?",
+              annotations: []
+            }
+          ]
+        }
+      ],
+      output_text: "Hello! Welcome to the NocoBase AI API. How can I help you today?",
+      parallel_tool_calls: true,
+      previous_response_id: null,
+      reasoning: null,
+      service_tier: "default",
+      temperature: null,
+      text: null,
+      tool_choice: "auto",
+      tools: [],
+      top_p: null,
+      truncation: "disabled",
+      usage: {
+        input_tokens: 15,
+        input_tokens_details: { cached_tokens: 0 },
+        output_tokens: 20,
+        output_tokens_details: { reasoning_tokens: 0 },
+        total_tokens: 35
+      },
+      metadata: { sample: "true", purpose: "documentation" }
+    };
+    const firstValues = {
+      responseId: SAMPLE_IDS[0],
+      userId: rootUser.get("id"),
+      model: firstOutput.model,
+      input: "Hello! I am testing the Responses API.",
+      output: firstOutput,
+      previousResponseId: null,
+      metadata: firstOutput.metadata,
+      expiresAt
+    };
+    const secondOutput = {
+      ...firstOutput,
+      id: SAMPLE_IDS[1],
+      created_at: now + 60,
+      completed_at: now + 60,
+      output: [
+        {
+          id: "msg_sample_followup",
+          type: "message",
+          status: "completed",
+          role: "assistant",
+          content: [
+            {
+              type: "output_text",
+              text: "I can help with questions, code, data analysis, and more.",
+              annotations: []
+            }
+          ]
+        }
+      ],
+      output_text: "I can help with questions, code, data analysis, and more.",
+      previous_response_id: SAMPLE_IDS[0],
+      usage: {
+        input_tokens: 25,
+        input_tokens_details: { cached_tokens: 0 },
+        output_tokens: 15,
+        output_tokens_details: { reasoning_tokens: 0 },
+        total_tokens: 40
+      }
+    };
+    const secondValues = {
+      responseId: SAMPLE_IDS[1],
+      userId: rootUser.get("id"),
+      model: secondOutput.model,
+      input: "What can you help me with?",
+      output: secondOutput,
+      previousResponseId: SAMPLE_IDS[0],
+      metadata: secondOutput.metadata,
+      expiresAt
+    };
+    const candidates = [firstValues, secondValues];
+    await this.db.sequelize.transaction(async (transaction) => {
+      for (const values of candidates) {
+        const exists = await repository.findOne({ filter: { responseId: values.responseId }, transaction });
+        if (!exists) {
+          await repository.create({ values, transaction });
+        }
+      }
+    });
+    this.app.logger.info("[ai-api] Seeded sample Responses API records for the root user.");
+  }
+  async down() {
+    const repository = this.db.getRepository("aiApiResponseRecords");
+    const records = await repository.find({ filter: { responseId: { $in: SAMPLE_IDS } } });
+    for (const record of records) {
+      const metadata = record.get("metadata");
+      if (metadata && typeof metadata === "object" && metadata.sample === "true") {
+        await repository.destroy({ filterByTk: record.get("id") });
+      }
+    }
+  }
+}

package/dist/server/plugin.js

@@ -44,10 +44,11 @@ var import_server = require("@nocobase/server");
 var import_router = require("./routes/router");
 var import_ai_api_config = __toESM(require("./resource/ai-api-config"));
 var import_ai_api_usage_monitor = __toESM(require("./resource/ai-api-usage-monitor"));
-var import_ai_api_usage_groups = __toESM(require("./resource/ai-api-usage-groups"));
 var import_rate_limiter = require("./utils/rate-limiter");
 var import_role_permission = require("./middleware/role-permission");
+var import_response_record_resource = require("./middleware/response-record-resource");
 var import_user_permissions = require("./utils/user-permissions");
+var import_response_store = require("./utils/response-store");
 var import_validation = require("./validation");
 var import_constants = require("../constants");
 var import_file_processor = require("./services/file-processor");
@@ -68,6 +69,7 @@ class PluginAiApiServer extends import_server.Plugin {
    */
   fileProcessorService = new import_file_processor.FileProcessorService();
   gcInterval = null;
+  responseCleanupInterval = null;
   async afterAdd() {
   }
   async beforeLoad() {
@@ -77,6 +79,9 @@ class PluginAiApiServer extends import_server.Plugin {
     this.app.db.on("aiApiModelMetadata.beforeSave", (model) => {
       (0, import_validation.validateModelMetadata)(model);
     });
+    this.app.db.on("aiApiVirtualModels.beforeSave", (model) => {
+      (0, import_validation.validateVirtualModel)(model);
+    });
     this.app.db.on("aiApiUsageGroups.beforeSave", async (model, options) => {
       (0, import_validation.validateQuotaPolicy)(model);
       if (model.get("isDefault")) {
@@ -94,6 +99,16 @@ class PluginAiApiServer extends import_server.Plugin {
     this.app.db.on("aiApiGroupMembers.beforeSave", async (model, options) => {
       const userId = model.get("userId");
       if (!userId) return;
+      const targetGroupId = model.get("groupId");
+      if (targetGroupId) {
+        const targetGroup = await this.db.getRepository("aiApiUsageGroups").findOne({
+          filterByTk: targetGroupId,
+          transaction: options == null ? void 0 : options.transaction
+        });
+        if (targetGroup == null ? void 0 : targetGroup.get("isDefault")) {
+          throw new Error("Cannot add members to the default group: users without another group use it automatically.");
+        }
+      }
       const existing = await this.db.getRepository("aiApiGroupMembers").findOne({
         filter: { userId },
         transaction: options == null ? void 0 : options.transaction
@@ -110,18 +125,9 @@ class PluginAiApiServer extends import_server.Plugin {
         filter: { groupId: model.get("id") },
         transaction: options == null ? void 0 : options.transaction
       });
-      if (members.length === 0) return;
-      const defaultGroup = await this.db.getRepository("aiApiUsageGroups").findOne({
-        filter: { isDefault: true },
-        transaction: options == null ? void 0 : options.transaction
-      });
-      if (!defaultGroup) {
-        throw new Error("Default usage group is missing; cannot reassign members.");
-      }
       for (const member of members) {
-        await this.db.getRepository("aiApiGroupMembers").update({
+        await this.db.getRepository("aiApiGroupMembers").destroy({
           filterByTk: member.get("id"),
-          values: { groupId: defaultGroup.get("id") },
           transaction: options == null ? void 0 : options.transaction
         });
       }
@@ -141,12 +147,16 @@ class PluginAiApiServer extends import_server.Plugin {
     this.app.use((0, import_router.createAiLlmRouter)(this), { after: "idp-oauth-resource-auth", before: "resourcer" });
     this.app.resourceManager.define(import_ai_api_config.default);
     this.app.resourceManager.define(import_ai_api_usage_monitor.default);
-    this.app.resourceManager.define(import_ai_api_usage_groups.default);
-    this.app.db.on("aiApiRolePermissions.afterSave", (model) => {
-      (0, import_role_permission.invalidateRolePermissionCache)(model.get("roleName"));
+    this.app.resourceManager.use((0, import_response_record_resource.blockResponseRecordResource)(), {
+      tag: "aiApiResponseRecordsPrivate",
+      after: "auth",
+      before: "acl"
     });
-    this.app.db.on("aiApiRolePermissions.afterDestroy", (model) => {
-      (0, import_role_permission.invalidateRolePermissionCache)(model.get("roleName"));
+    this.app.db.on("aiApiRolePermissions.afterSave", (model, options) => {
+      this.invalidateRolePermissionSync(model.get("roleName"), options == null ? void 0 : options.transaction);
+    });
+    this.app.db.on("aiApiRolePermissions.afterDestroy", (model, options) => {
+      this.invalidateRolePermissionSync(model.get("roleName"), options == null ? void 0 : options.transaction);
     });
     this.app.db.on("aiApiUsageGroups.afterSave", (model, options) => {
       this.invalidateGroupAccess(model.get("id"), options == null ? void 0 : options.transaction);
@@ -161,6 +171,7 @@ class PluginAiApiServer extends import_server.Plugin {
         "aiApiRolePermissions:*",
         "aiApiModelPrices:*",
         "aiApiModelMetadata:*",
+        "aiApiVirtualModels:*",
         "aiApiUsageGroups:*",
         "aiApiGroupMembers:*",
         "aiApiGroupQuotaBuckets:list",
@@ -172,6 +183,21 @@ class PluginAiApiServer extends import_server.Plugin {
     });
     this.gcInterval = setInterval(() => this.rateLimiter.gc(), 5 * 60 * 1e3);
     this.gcInterval.unref();
+    this.cleanupResponseRecords();
+    this.responseCleanupInterval = setInterval(() => this.cleanupResponseRecords(), 24 * 60 * 60 * 1e3);
+    this.responseCleanupInterval.unref();
+  }
+  /**
+   * Drop a role's cached permission record on every node.
+   *
+   * Mirrors invalidateGroupAccess: the local call is not redundant because
+   * syncMessageManager hardcodes skipSelf, so the publishing node never receives
+   * its own message. Passing the transaction defers the broadcast until the
+   * write commits, so other nodes cannot re-read the old row and re-cache it.
+   */
+  invalidateRolePermissionSync(roleName, transaction) {
+    (0, import_role_permission.invalidateRolePermissionCache)(roleName);
+    this.sendSyncMessage({ type: "invalidateRolePermission", roleName }, { transaction });
   }
   /**
    * Drop a group's cached model-access scope on every node.
@@ -190,6 +216,8 @@ class PluginAiApiServer extends import_server.Plugin {
   async handleSyncMessage(message) {
     if ((message == null ? void 0 : message.type) === "invalidateGroupAccess") {
       (0, import_user_permissions.invalidateGroupAccessCache)(message.groupId);
+    } else if ((message == null ? void 0 : message.type) === "invalidateRolePermission") {
+      (0, import_role_permission.invalidateRolePermissionCache)(message.roleName);
     }
   }
   async install() {
@@ -205,6 +233,16 @@ class PluginAiApiServer extends import_server.Plugin {
         }
       });
     }
+    for (const roleName of ["root", "admin"]) {
+      const perm = await this.db.getRepository("aiApiRolePermissions").findOne({
+        filter: { roleName }
+      });
+      if (!perm) {
+        await this.db.getRepository("aiApiRolePermissions").create({
+          values: { roleName, enabled: true, allowAllEmployees: true, allowedEmployees: [] }
+        });
+      }
+    }
     const defaultGroup = await this.db.getRepository("aiApiUsageGroups").findOne({
       filter: { isDefault: true }
     });
@@ -232,6 +270,14 @@ class PluginAiApiServer extends import_server.Plugin {
       });
     }
   }
+  async cleanupResponseRecords() {
+    try {
+      const deleted = await (0, import_response_store.cleanupExpiredResponseRecords)({ db: this.db });
+      if (deleted > 0) this.app.logger.info(`[ai-api] Cleaned up ${deleted} expired response records`);
+    } catch (error) {
+      this.app.logger.warn("[ai-api] Failed to clean up expired response records:", error);
+    }
+  }
   async afterEnable() {
   }
   async afterDisable() {
@@ -241,6 +287,10 @@ class PluginAiApiServer extends import_server.Plugin {
       clearInterval(this.gcInterval);
       this.gcInterval = null;
     }
+    if (this.responseCleanupInterval) {
+      clearInterval(this.responseCleanupInterval);
+      this.responseCleanupInterval = null;
+    }
     this.rateLimiter.clear();
   }
 }