totem-llm 0.1.0

package/server/utils/middleware/multiUserProtected.js

@@ -0,0 +1,107 @@
+const { SystemSettings } = require("../../models/systemSettings");
+const { userFromSession } = require("../http");
+const ROLES = {
+  all: "<all>",
+  admin: "admin",
+  manager: "manager",
+  default: "default",
+};
+const DEFAULT_ROLES = [ROLES.admin, ROLES.admin];
+
+/**
+ * Explicitly check that single user mode is enabled as well as that the
+ * requesting user has the appropriate role to modify or call the URL.
+ * @returns {function}
+ */
+async function isSingleUserMode(_request, response, next) {
+  const multiUserMode = await SystemSettings.isMultiUserMode();
+  if (multiUserMode) return response.sendStatus(401).end();
+  next();
+  return;
+}
+
+/**
+ * Explicitly check that multi user mode is enabled as well as that the
+ * requesting user has the appropriate role to modify or call the URL.
+ * @param {string[]} allowedRoles - The roles that are allowed to access the route
+ * @returns {function}
+ */
+function strictMultiUserRoleValid(allowedRoles = DEFAULT_ROLES) {
+  return async (request, response, next) => {
+    // If the access-control is allowable for all - skip validations and continue;
+    if (allowedRoles.includes(ROLES.all)) {
+      next();
+      return;
+    }
+
+    const multiUserMode =
+      response.locals?.multiUserMode ??
+      (await SystemSettings.isMultiUserMode());
+    if (!multiUserMode) return response.sendStatus(401).end();
+
+    const user =
+      response.locals?.user ?? (await userFromSession(request, response));
+    if (allowedRoles.includes(user?.role)) {
+      next();
+      return;
+    }
+    return response.sendStatus(401).end();
+  };
+}
+
+/**
+ * Apply role permission checks IF the current system is in multi-user mode.
+ * This is relevant for routes that are shared between MUM and single-user mode.
+ * @param {string[]} allowedRoles - The roles that are allowed to access the route
+ * @returns {function}
+ */
+function flexUserRoleValid(allowedRoles = DEFAULT_ROLES) {
+  return async (request, response, next) => {
+    // If the access-control is allowable for all - skip validations and continue;
+    // It does not matter if multi-user or not.
+    if (allowedRoles.includes(ROLES.all)) {
+      next();
+      return;
+    }
+
+    // Bypass if not in multi-user mode
+    const multiUserMode =
+      response.locals?.multiUserMode ??
+      (await SystemSettings.isMultiUserMode());
+    if (!multiUserMode) {
+      next();
+      return;
+    }
+
+    const user =
+      response.locals?.user ?? (await userFromSession(request, response));
+    if (allowedRoles.includes(user?.role)) {
+      next();
+      return;
+    }
+    return response.sendStatus(401).end();
+  };
+}
+
+// Middleware check on a public route if the instance is in a valid
+// multi-user set up.
+async function isMultiUserSetup(_request, response, next) {
+  const multiUserMode = await SystemSettings.isMultiUserMode();
+  if (!multiUserMode) {
+    response.status(403).json({
+      error: "Invalid request",
+    });
+    return;
+  }
+
+  next();
+  return;
+}
+
+module.exports = {
+  ROLES,
+  isSingleUserMode,
+  strictMultiUserRoleValid,
+  flexUserRoleValid,
+  isMultiUserSetup,
+};

package/server/utils/middleware/requireFeature.js

@@ -0,0 +1,46 @@
+/**
+ * requireFeature(key) — Totem LLM build-time feature gate middleware
+ *
+ * Returns a 404 for any route that belongs to a feature disabled in the
+ * current TOTEM_BUILD_PROFILE. This keeps API surface consistent with
+ * the frontend: if the UI is hidden, the API is unavailable too.
+ *
+ * Usage (in an endpoints file):
+ *   const { requireFeature } = require("../utils/middleware/requireFeature");
+ *
+ *   function myEndpoints(app) {
+ *     if (!app) return;
+ *     app.use("/my-feature", requireFeature("myFeature"));
+ *     app.get("/my-feature", ...);
+ *   }
+ *
+ * Note: Because this is open-source, this middleware is a UX guard, not a
+ * security boundary. For paid/licensed features, add a separate license-check
+ * middleware on top of this one.
+ */
+
+const { resolveFeatures } = require("../../../totem.features.cjs");
+
+// Resolve once at startup — not per-request — since the value is build-time.
+let _resolvedFeatures = null;
+function getFeatures() {
+  if (!_resolvedFeatures) _resolvedFeatures = resolveFeatures();
+  return _resolvedFeatures;
+}
+
+/**
+ * @param {string} key - Feature key from totem.features.js
+ * @returns {import("express").RequestHandler}
+ */
+function requireFeature(key) {
+  return function totemFeatureGate(_req, res, next) {
+    const features = getFeatures();
+    const feature = features[key];
+    if (!feature || !feature.enabled) {
+      return res.sendStatus(404).end();
+    }
+    next();
+  };
+}
+
+module.exports = { requireFeature };

package/server/utils/middleware/simpleSSOEnabled.js

@@ -0,0 +1,84 @@
+const { SystemSettings } = require("../../models/systemSettings");
+
+/**
+ * Checks if simple SSO is enabled for issuance of temporary auth tokens.
+ * Note: This middleware must be called after `validApiKey`.
+ * @param {import("express").Request} request
+ * @param {import("express").Response} response
+ * @param {import("express").NextFunction} next
+ * @returns {void}
+ */
+async function simpleSSOEnabled(_, response, next) {
+  if (!("SIMPLE_SSO_ENABLED" in process.env)) {
+    return response
+      .status(403)
+      .send(
+        "Simple SSO is not enabled. It must be enabled to validate or issue temporary auth tokens."
+      );
+  }
+
+  // If the multi-user mode response local is not set, we need to check if it's enabled.
+  if (!("multiUserMode" in response.locals)) {
+    const multiUserMode = await SystemSettings.isMultiUserMode();
+    response.locals.multiUserMode = multiUserMode;
+  }
+
+  if (!response.locals.multiUserMode) {
+    return response
+      .status(403)
+      .send(
+        "Multi-User mode is not enabled. It must be enabled to use Simple SSO."
+      );
+  }
+
+  next();
+}
+
+/**
+ * Checks if simple SSO login is disabled by checking if the
+ * SIMPLE_SSO_NO_LOGIN environment variable is set as well as
+ * SIMPLE_SSO_ENABLED is set.
+ *
+ * This check should only be run when in multi-user mode when used.
+ * @returns {boolean}
+ */
+function simpleSSOLoginDisabled() {
+  return (
+    "SIMPLE_SSO_ENABLED" in process.env && "SIMPLE_SSO_NO_LOGIN" in process.env
+  );
+}
+
+/**
+ * Middleware that checks if simple SSO login is disabled by checking if the
+ * SIMPLE_SSO_NO_LOGIN environment variable is set as well as
+ * SIMPLE_SSO_ENABLED is set.
+ *
+ * This middleware will 403 if SSO is enabled and no login is allowed and
+ * the system is in multi-user mode. Otherwise, it will call next.
+ *
+ * @param {import("express").Request} request
+ * @param {import("express").Response} response
+ * @param {import("express").NextFunction} next
+ * @returns {void}
+ */
+async function simpleSSOLoginDisabledMiddleware(_, response, next) {
+  if (!("multiUserMode" in response.locals)) {
+    const multiUserMode = await SystemSettings.isMultiUserMode();
+    response.locals.multiUserMode = multiUserMode;
+  }
+
+  if (response.locals.multiUserMode && simpleSSOLoginDisabled()) {
+    response.status(403).json({
+      success: false,
+      error: "Login via credentials has been disabled by the administrator.",
+    });
+    return;
+  }
+  next();
+}
+
+module.exports = {
+  simpleSSOEnabled,
+  simpleSSOLoginDisabled,
+  simpleSSOLoginDisabledMiddleware,
+};

package/server/utils/middleware/validApiKey.js

@@ -0,0 +1,29 @@
+const { ApiKey } = require("../../models/apiKeys");
+const { SystemSettings } = require("../../models/systemSettings");
+
+async function validApiKey(request, response, next) {
+  const multiUserMode = await SystemSettings.isMultiUserMode();
+  response.locals.multiUserMode = multiUserMode;
+
+  const auth = request.header("Authorization");
+  const bearerKey = auth ? auth.split(" ")[1] : null;
+  if (!bearerKey) {
+    response.status(403).json({
+      error: "No valid api key found.",
+    });
+    return;
+  }
+
+  if (!(await ApiKey.get({ secret: bearerKey }))) {
+    response.status(403).json({
+      error: "No valid api key found.",
+    });
+    return;
+  }
+
+  next();
+}
+
+module.exports = {
+  validApiKey,
+};

package/server/utils/middleware/validBrowserExtensionApiKey.js

@@ -0,0 +1,51 @@
+const {
+  BrowserExtensionApiKey,
+} = require("../../models/browserExtensionApiKey");
+const { SystemSettings } = require("../../models/systemSettings");
+const { User } = require("../../models/user");
+
+async function validBrowserExtensionApiKey(request, response, next) {
+  const multiUserMode = await SystemSettings.isMultiUserMode();
+  response.locals.multiUserMode = multiUserMode;
+
+  const auth = request.header("Authorization");
+  const bearerKey = auth ? auth.split(" ")[1] : null;
+  if (!bearerKey) {
+    response.status(403).json({
+      error: "No valid API key found.",
+    });
+    return;
+  }
+
+  const apiKey = await BrowserExtensionApiKey.validate(bearerKey);
+  if (!apiKey) {
+    response.status(403).json({
+      error: "No valid API key found.",
+    });
+    return;
+  }
+
+  if (multiUserMode) {
+    const user = await User.get({ id: apiKey.user_id });
+    if (!user) {
+      response.status(403).json({
+        error: "User not found.",
+      });
+      return;
+    }
+
+    if (user.suspended) {
+      response.status(401).json({
+        error: "User is suspended from system",
+      });
+      return;
+    }
+
+    response.locals.user = user;
+  }
+
+  response.locals.apiKey = apiKey;
+  next();
+}
+
+module.exports = { validBrowserExtensionApiKey };

package/server/utils/middleware/validWorkspace.js

@@ -0,0 +1,52 @@
+const { Workspace } = require("../../models/workspace");
+const { WorkspaceThread } = require("../../models/workspaceThread");
+const { userFromSession, multiUserMode } = require("../http");
+
+// Will pre-validate and set the workspace for a request if the slug is provided in the URL path.
+async function validWorkspaceSlug(request, response, next) {
+  const { slug } = request.params;
+  const user = await userFromSession(request, response);
+  const workspace = multiUserMode(response)
+    ? await Workspace.getWithUser(user, { slug })
+    : await Workspace.get({ slug });
+
+  if (!workspace) {
+    response.status(404).send("Workspace does not exist.");
+    return;
+  }
+
+  response.locals.workspace = workspace;
+  next();
+}
+
+// Will pre-validate and set the workspace AND a thread for a request if the slugs are provided in the URL path.
+async function validWorkspaceAndThreadSlug(request, response, next) {
+  const { slug, threadSlug } = request.params;
+  const user = await userFromSession(request, response);
+  const workspace = multiUserMode(response)
+    ? await Workspace.getWithUser(user, { slug })
+    : await Workspace.get({ slug });
+
+  if (!workspace) {
+    response.status(404).send("Workspace does not exist.");
+    return;
+  }
+
+  const thread = await WorkspaceThread.get({
+    slug: threadSlug,
+    user_id: user?.id || null,
+  });
+  if (!thread) {
+    response.status(404).send("Workspace thread does not exist.");
+    return;
+  }
+
+  response.locals.workspace = workspace;
+  response.locals.thread = thread;
+  next();
+}
+
+module.exports = {
+  validWorkspaceSlug,
+  validWorkspaceAndThreadSlug,
+};

package/server/utils/middleware/validatedRequest.js

@@ -0,0 +1,111 @@
+const { SystemSettings } = require("../../models/systemSettings");
+const { User } = require("../../models/user");
+const { EncryptionManager } = require("../EncryptionManager");
+const { decodeJWT } = require("../http");
+const EncryptionMgr = new EncryptionManager();
+
+async function validatedRequest(request, response, next) {
+  const multiUserMode = await SystemSettings.isMultiUserMode();
+  response.locals.multiUserMode = multiUserMode;
+  if (multiUserMode)
+    return await validateMultiUserRequest(request, response, next);
+
+  // When in development passthrough auth token for ease of development.
+  // Or if the user simply did not set an Auth token or JWT Secret
+  if (
+    process.env.NODE_ENV === "development" ||
+    !process.env.AUTH_TOKEN ||
+    !process.env.JWT_SECRET
+  ) {
+    next();
+    return;
+  }
+
+  if (!process.env.AUTH_TOKEN) {
+    response.status(401).json({
+      error: "You need to set an AUTH_TOKEN environment variable.",
+    });
+    return;
+  }
+
+  const auth = request.header("Authorization");
+  const token = auth ? auth.split(" ")[1] : null;
+
+  if (!token) {
+    response.status(401).json({
+      error: "No auth token found.",
+    });
+    return;
+  }
+
+  const bcrypt = require("bcryptjs");
+  const { p } = decodeJWT(token);
+
+  if (p === null || !/\w{32}:\w{32}/.test(p)) {
+    response.status(401).json({
+      error: "Token expired or failed validation.",
+    });
+    return;
+  }
+
+  // Since the blame of this comment we have been encrypting the `p` property of JWTs with the persistent
+  // encryptionManager PEM's. This prevents us from storing the `p` unencrypted in the JWT itself, which could
+  // be unsafe. As a consequence, existing JWTs with invalid `p` values that do not match the regex
+  // in ln:44 will be marked invalid so they can be logged out and forced to log back in and obtain an encrypted token.
+  // This kind of methodology only applies to single-user password mode.
+  if (
+    !bcrypt.compareSync(
+      EncryptionMgr.decrypt(p),
+      bcrypt.hashSync(process.env.AUTH_TOKEN, 10)
+    )
+  ) {
+    response.status(401).json({
+      error: "Invalid auth credentials.",
+    });
+    return;
+  }
+
+  next();
+}
+
+async function validateMultiUserRequest(request, response, next) {
+  const auth = request.header("Authorization");
+  const token = auth ? auth.split(" ")[1] : null;
+
+  if (!token) {
+    response.status(401).json({
+      error: "No auth token found.",
+    });
+    return;
+  }
+
+  const valid = decodeJWT(token);
+  if (!valid || !valid.id) {
+    response.status(401).json({
+      error: "Invalid auth token.",
+    });
+    return;
+  }
+
+  const user = await User.get({ id: valid.id });
+  if (!user) {
+    response.status(401).json({
+      error: "Invalid auth for user.",
+    });
+    return;
+  }
+
+  if (user.suspended) {
+    response.status(401).json({
+      error: "User is suspended from system",
+    });
+    return;
+  }
+
+  response.locals.user = user;
+  next();
+}
+
+module.exports = {
+  validatedRequest,
+};

package/server/utils/middleware/workspaceDeletionProtection.js

@@ -0,0 +1,18 @@
+/**
+ * A simple middleware that blocks workspace deletion routes when the
+ * `WORKSPACE_DELETION_PROTECTION` environment variable is set AT ALL.
+ * @param {Request} request - The request object.
+ * @param {Response} response - The response object.
+ * @param {NextFunction} next - The next function.
+ */
+function workspaceDeletionProtection(_request, response, next) {
+  if (!("WORKSPACE_DELETION_PROTECTION" in process.env)) return next();
+  return response.status(403).json({
+    success: false,
+    error: "Workspace deletion is blocked by the system administrator.",
+  });
+}
+
+module.exports = {
+  workspaceDeletionProtection,
+};

package/server/utils/prisma/PRISMA.md

@@ -0,0 +1,47 @@
+# Prisma Setup and Usage Guide
+
+This guide will help you set up and use Prisma for the project. Prisma is a powerful ORM for Node.js and TypeScript, helping developers build faster and make fewer errors. Follow the guide to understand how to use Prisma and the scripts available in the project to manage the Prisma setup.
+
+## Setting Up Prisma
+
+To get started with setting up Prisma, you should run the setup script from the project root directory:
+
+```sh
+yarn setup
+```
+
+This script will install the necessary node modules in both the server and frontend directories, set up the environment files, and set up Prisma (generate client, run migrations, and seed the database).
+
+## Prisma Scripts
+
+In the project root's `package.json`, there are several scripts set up to help you manage Prisma:
+
+- **prisma:generate**: Generates the Prisma client.
+- **prisma:migrate**: Runs the migrations to ensure the database is in sync with the schema.
+- **prisma:seed**: Seeds the database with initial data.
+- **prisma:setup**: A convenience script that runs `prisma:generate`, `prisma:migrate`, and `prisma:seed` in sequence.
+- **sqlite:migrate**: (To be run from the `server` directory) This script is for users transitioning from the old SQLite custom ORM setup to Prisma and will migrate all existing data over to Prisma. If you're a new user, your setup will already use Prisma.
+
+To run any of these scripts, use `yarn` followed by the script name from the project root directory. For example:
+
+```sh
+yarn prisma:setup
+```
+
+## Manual Prisma Commands
+
+While the scripts should cover most of your needs, you may sometimes want to run Prisma commands manually. Here are some commands you might find useful, along with their descriptions:
+
+- `npx prisma introspect`: Introspects the database to update the Prisma schema by reading the schema of the existing database.
+- `npx prisma generate`: Generates the Prisma client.
+- `npx prisma migrate dev --name init`: Ensures the database is in sync with the schema, naming the migration 'init'.
+- `npx prisma migrate reset`: Resets the database, deleting all data and recreating the schema.
+
+These commands should be run from the `server` directory, where the Prisma schema is located.
+
+## Notes
+
+- Always make sure to run scripts from the root level to avoid path issues.
+- Before running migrations, ensure that the Prisma schema is correctly defined to prevent data loss or corruption.
+- If you are adding a new feature or making changes that require a change in the database schema, create a new migration rather than editing existing migrations.
+- For users transitioning from the old SQLite ORM, navigate to the `server` directory and run the `sqlite:migrate` script to smoothly transition to Prisma. If you're setting up the project fresh, this step is unnecessary as the setup will already be using Prisma.

package/server/utils/prisma/index.js

@@ -0,0 +1,13 @@
+const { PrismaClient } = require("@prisma/client");
+
+// npx prisma introspect
+// npx prisma generate
+// npx prisma migrate dev --name init -> ensures that db is in sync with schema
+// npx prisma migrate reset -> resets the db
+
+const logLevels = ["error", "info", "warn"]; // add "query" to debug query logs
+const prisma = new PrismaClient({
+  log: logLevels,
+});
+
+module.exports = prisma;