totem-llm 0.1.0

package/server/models/temporaryAuthToken.js

@@ -0,0 +1,104 @@
+const { makeJWT } = require("../utils/http");
+const prisma = require("../utils/prisma");
+
+/**
+ * Temporary auth tokens are used for simple SSO.
+ * They simply enable the ability for a time-based token to be used in the query of the /sso/login URL
+ * to login as a user without the need of a username and password. These tokens are single-use and expire.
+ */
+const TemporaryAuthToken = {
+  expiry: 1000 * 60 * 6, // 1 hour
+  tablename: "temporary_auth_tokens",
+  writable: [],
+
+  makeTempToken: () => {
+    const uuidAPIKey = require("uuid-apikey");
+    return `allm-tat-${uuidAPIKey.create().apiKey}`;
+  },
+
+  /**
+   * Issues a temporary auth token for a user via its ID.
+   * @param {number} userId
+   * @returns {Promise<{token: string|null, error: string | null}>}
+   */
+  issue: async function (userId = null) {
+    if (!userId)
+      throw new Error("User ID is required to issue a temporary auth token.");
+    await this.invalidateUserTokens(userId);
+
+    try {
+      const token = this.makeTempToken();
+      const expiresAt = new Date(Date.now() + this.expiry);
+      await prisma.temporary_auth_tokens.create({
+        data: {
+          token,
+          expiresAt,
+          userId: Number(userId),
+        },
+      });
+
+      return { token, error: null };
+    } catch (error) {
+      console.error("FAILED TO CREATE TEMPORARY AUTH TOKEN.", error.message);
+      return { token: null, error: error.message };
+    }
+  },
+
+  /**
+   * Invalidates (deletes) all temporary auth tokens for a user via their ID.
+   * @param {number} userId
+   * @returns {Promise<boolean>}
+   */
+  invalidateUserTokens: async function (userId) {
+    if (!userId)
+      throw new Error(
+        "User ID is required to invalidate temporary auth tokens."
+      );
+    await prisma.temporary_auth_tokens.deleteMany({
+      where: { userId: Number(userId) },
+    });
+    return true;
+  },
+
+  /**
+   * Validates a temporary auth token and returns the session token
+   * to be set in the browser localStorage for authentication.
+   * @param {string} publicToken - the token to validate against
+   * @returns {Promise<{sessionToken: string|null, token: import("@prisma/client").temporary_auth_tokens & {user: import("@prisma/client").users} | null, error: string | null}>}
+   */
+  validate: async function (publicToken = "") {
+    /** @type {import("@prisma/client").temporary_auth_tokens & {user: import("@prisma/client").users} | undefined | null} **/
+    let token;
+
+    try {
+      if (!publicToken)
+        throw new Error(
+          "Public token is required to validate a temporary auth token."
+        );
+      token = await prisma.temporary_auth_tokens.findUnique({
+        where: { token: String(publicToken) },
+        include: { user: true },
+      });
+      if (!token) throw new Error("Invalid token.");
+      if (token.expiresAt < new Date()) throw new Error("Token expired.");
+      if (token.user.suspended) throw new Error("User account suspended.");
+
+      // Create a new session token for the user valid for 30 days
+      const sessionToken = makeJWT(
+        { id: token.user.id, username: token.user.username },
+        process.env.JWT_EXPIRY
+      );
+
+      return { sessionToken, token, error: null };
+    } catch (error) {
+      console.error("FAILED TO VALIDATE TEMPORARY AUTH TOKEN.", error.message);
+      return { sessionToken: null, token: null, error: error.message };
+    } finally {
+      // Delete the token after it has been used under all circumstances if it was retrieved
+      if (token)
+        await prisma.temporary_auth_tokens.delete({ where: { id: token.id } });
+    }
+  },
+};
+
+module.exports = { TemporaryAuthToken };

package/server/models/user.js

@@ -0,0 +1,381 @@
+const { Prisma } = require("@prisma/client");
+const prisma = require("../utils/prisma");
+const { EventLogs } = require("./eventLogs");
+
+/**
+ * @typedef {Object} User
+ * @property {number} id
+ * @property {string} username
+ * @property {string} password
+ * @property {string} pfpFilename
+ * @property {string} role
+ * @property {boolean} suspended
+ * @property {number|null} dailyMessageLimit
+ */
+
+const User = {
+  usernameRegex: new RegExp(/^[a-z][a-z0-9._@-]*$/),
+  writable: [
+    // Used for generic updates so we can validate keys in request body
+    "username",
+    "password",
+    "pfpFilename",
+    "role",
+    "suspended",
+    "dailyMessageLimit",
+    "bio",
+  ],
+  validations: {
+    /**
+     * Unix-style username regex:
+     * - Must start with a lowercase letter
+     * - Can contain lowercase letters, digits, underscores, hyphens, @ signs, and periods
+     * - 2-32 characters long
+     */
+    username: (newValue = "") => {
+      try {
+        const username = String(newValue);
+        if (username.length > 32)
+          throw new Error("Username cannot be longer than 32 characters");
+        if (username.length < 2)
+          throw new Error("Username must be at least 2 characters");
+        if (!User.usernameRegex.test(username))
+          throw new Error(
+            "Username must start with a lowercase letter and only contain lowercase letters, numbers, underscores, hyphens, and periods"
+          );
+        return username;
+      } catch (e) {
+        throw new Error(e.message);
+      }
+    },
+    role: (role = "default") => {
+      const VALID_ROLES = ["default", "admin", "manager"];
+      if (!VALID_ROLES.includes(role)) {
+        throw new Error(
+          `Invalid role. Allowed roles are: ${VALID_ROLES.join(", ")}`
+        );
+      }
+      return String(role);
+    },
+    dailyMessageLimit: (dailyMessageLimit = null) => {
+      if (dailyMessageLimit === null) return null;
+      const limit = Number(dailyMessageLimit);
+      if (isNaN(limit) || limit < 1) {
+        throw new Error(
+          "Daily message limit must be null or a number greater than or equal to 1"
+        );
+      }
+      return limit;
+    },
+    bio: (bio = "") => {
+      if (!bio || typeof bio !== "string") return "";
+      if (bio.length > 1000)
+        throw new Error("Bio cannot be longer than 1,000 characters");
+      return String(bio);
+    },
+  },
+  // validations for the above writable fields.
+  castColumnValue: function (key, value) {
+    switch (key) {
+      case "suspended":
+        return Number(Boolean(value));
+      case "dailyMessageLimit":
+        return value === null ? null : Number(value);
+      default:
+        return String(value);
+    }
+  },
+
+  filterFields: function (user = {}) {
+    const {
+      password: _password,
+      web_push_subscription_config: _web_push_subscription_config,
+      ...rest
+    } = user;
+    return { ...rest };
+  },
+  _identifyErrorAndFormatMessage: function (error) {
+    if (error instanceof Prisma.PrismaClientKnownRequestError) {
+      // P2002 is the unique constraint violation error code
+      if (error.code === "P2002") {
+        const target = error.meta?.target;
+        return `A user with that ${target?.join(", ")} already exists`;
+      }
+    }
+    return error.message;
+  },
+
+  create: async function ({
+    username,
+    password,
+    role = "default",
+    dailyMessageLimit = null,
+    bio = "",
+  }) {
+    const passwordCheck = this.checkPasswordComplexity(password);
+    if (!passwordCheck.checkedOK) {
+      return { user: null, error: passwordCheck.error };
+    }
+
+    try {
+      // Validate username format (validation function handles all checks)
+      const validatedUsername = this.validations.username(username);
+
+      const bcrypt = require("bcryptjs");
+      const hashedPassword = bcrypt.hashSync(password, 10);
+      const user = await prisma.users.create({
+        data: {
+          username: validatedUsername,
+          password: hashedPassword,
+          role: this.validations.role(role),
+          bio: this.validations.bio(bio),
+          dailyMessageLimit:
+            this.validations.dailyMessageLimit(dailyMessageLimit),
+        },
+      });
+      return { user: this.filterFields(user), error: null };
+    } catch (error) {
+      console.error("FAILED TO CREATE USER.", error.message);
+      return { user: null, error: this._identifyErrorAndFormatMessage(error) };
+    }
+  },
+  // Log the changes to a user object, but omit sensitive fields
+  // that are not meant to be logged.
+  loggedChanges: function (updates, prev = {}) {
+    const changes = {};
+    const sensitiveFields = ["password"];
+
+    Object.keys(updates).forEach((key) => {
+      if (!sensitiveFields.includes(key) && updates[key] !== prev[key]) {
+        changes[key] = `${prev[key]} => ${updates[key]}`;
+      }
+    });
+
+    return changes;
+  },
+
+  update: async function (userId, updates = {}) {
+    try {
+      if (!userId) throw new Error("No user id provided for update");
+      const currentUser = await prisma.users.findUnique({
+        where: { id: parseInt(userId) },
+      });
+      if (!currentUser) return { success: false, error: "User not found" };
+
+      // We previously had more lenient username validation, but now with more strict validation
+      // we dont want to break existing users by changing non-username fields.
+      // If they are not explictly changing the username, do not attempt to validate it.
+      if (updates.hasOwnProperty("username")) {
+        if (updates.username === currentUser.username) delete updates.username;
+      }
+
+      // Removes non-writable fields for generic updates
+      // and force-casts to the proper type;
+      Object.entries(updates).forEach(([key, value]) => {
+        if (this.writable.includes(key)) {
+          if (this.validations.hasOwnProperty(key)) {
+            updates[key] = this.validations[key](
+              this.castColumnValue(key, value)
+            );
+          } else {
+            updates[key] = this.castColumnValue(key, value);
+          }
+          return;
+        }
+        delete updates[key];
+      });
+
+      if (Object.keys(updates).length === 0)
+        return { success: false, error: "No valid updates applied." };
+
+      // Handle password specific updates
+      if (updates.hasOwnProperty("password")) {
+        const passwordCheck = this.checkPasswordComplexity(updates.password);
+        if (!passwordCheck.checkedOK) {
+          return { success: false, error: passwordCheck.error };
+        }
+        const bcrypt = require("bcryptjs");
+        updates.password = bcrypt.hashSync(updates.password, 10);
+      }
+
+      const user = await prisma.users.update({
+        where: { id: parseInt(userId) },
+        data: updates,
+      });
+
+      await EventLogs.logEvent(
+        "user_updated",
+        {
+          username: user.username,
+          changes: this.loggedChanges(updates, currentUser),
+        },
+        userId
+      );
+      return { success: true, error: null };
+    } catch (error) {
+      console.error("FAILED TO UPDATE USER.", error.message);
+      return {
+        success: false,
+        error: this._identifyErrorAndFormatMessage(error),
+      };
+    }
+  },
+
+  /**
+   * Explicit direct update of user object.
+   * Only use this method when directly setting a key value
+   * that takes no user input for the keys being modified.
+   * @param {number} id - The id of the user to update.
+   * @param {Object} data - The data to update the user with.
+   * @returns {Promise<Object>} The updated user object.
+   */
+  _update: async function (id = null, data = {}) {
+    if (!id) throw new Error("No user id provided for update");
+
+    try {
+      const user = await prisma.users.update({
+        where: { id },
+        data,
+      });
+      return { user, message: null };
+    } catch (error) {
+      console.error(error.message);
+      return { user: null, message: error.message };
+    }
+  },
+
+  /**
+   * Get all users that match the given clause without filtering the fields.
+   * Internal use only - do not use this method for user-input flows
+   * @param {Object} clause - The clause to filter the users by.
+   * @param {number|null} limit - The maximum number of users to return.
+   * @returns {Promise<Array<User>>} The users that match the given clause.
+   */
+  _where: async function (clause = {}, limit = null) {
+    try {
+      const users = await prisma.users.findMany({
+        where: clause,
+        ...(limit !== null ? { take: limit } : {}),
+      });
+      return users;
+    } catch (error) {
+      console.error(error.message);
+      return [];
+    }
+  },
+
+  /**
+   * Returns a user object based on the clause provided.
+   * @param {Object} clause - The clause to use to find the user.
+   * @returns {Promise<import("@prisma/client").users|null>} The user object or null if not found.
+   */
+  get: async function (clause = {}) {
+    try {
+      const user = await prisma.users.findFirst({ where: clause });
+      return user ? this.filterFields({ ...user }) : null;
+    } catch (error) {
+      console.error(error.message);
+      return null;
+    }
+  },
+  // Returns user object with all fields
+  _get: async function (clause = {}) {
+    try {
+      const user = await prisma.users.findFirst({ where: clause });
+      return user ? { ...user } : null;
+    } catch (error) {
+      console.error(error.message);
+      return null;
+    }
+  },
+
+  count: async function (clause = {}) {
+    try {
+      const count = await prisma.users.count({ where: clause });
+      return count;
+    } catch (error) {
+      console.error(error.message);
+      return 0;
+    }
+  },
+
+  delete: async function (clause = {}) {
+    try {
+      await prisma.users.deleteMany({ where: clause });
+      return true;
+    } catch (error) {
+      console.error(error.message);
+      return false;
+    }
+  },
+
+  where: async function (clause = {}, limit = null) {
+    try {
+      const users = await prisma.users.findMany({
+        where: clause,
+        ...(limit !== null ? { take: limit } : {}),
+      });
+      return users.map((usr) => this.filterFields(usr));
+    } catch (error) {
+      console.error(error.message);
+      return [];
+    }
+  },
+
+  checkPasswordComplexity: function (passwordInput = "") {
+    const passwordComplexity = require("joi-password-complexity");
+    // Can be set via ENV variable on boot. No frontend config at this time.
+    // Docs: https://www.npmjs.com/package/joi-password-complexity
+    const complexityOptions = {
+      min: process.env.PASSWORDMINCHAR || 8,
+      max: process.env.PASSWORDMAXCHAR || 250,
+      lowerCase: process.env.PASSWORDLOWERCASE || 0,
+      upperCase: process.env.PASSWORDUPPERCASE || 0,
+      numeric: process.env.PASSWORDNUMERIC || 0,
+      symbol: process.env.PASSWORDSYMBOL || 0,
+      // reqCount should be equal to how many conditions you are testing for (1-4)
+      requirementCount: process.env.PASSWORDREQUIREMENTS || 0,
+    };
+
+    const complexityCheck = passwordComplexity(
+      complexityOptions,
+      "password"
+    ).validate(passwordInput);
+    if (complexityCheck.hasOwnProperty("error")) {
+      let myError = "";
+      let prepend = "";
+      for (let i = 0; i < complexityCheck.error.details.length; i++) {
+        myError += prepend + complexityCheck.error.details[i].message;
+        prepend = ", ";
+      }
+      return { checkedOK: false, error: myError };
+    }
+
+    return { checkedOK: true, error: "No error." };
+  },
+
+  /**
+   * Check if a user can send a chat based on their daily message limit.
+   * This limit is system wide and not per workspace and only applies to
+   * multi-user mode AND non-admin users.
+   * @param {User} user The user object record.
+   * @returns {Promise<boolean>} True if the user can send a chat, false otherwise.
+   */
+  canSendChat: async function (user) {
+    const { ROLES } = require("../utils/middleware/multiUserProtected");
+    if (!user || user.dailyMessageLimit === null || user.role === ROLES.admin)
+      return true;
+
+    const { WorkspaceChats } = require("./workspaceChats");
+    const currentChatCount = await WorkspaceChats.count({
+      user_id: user.id,
+      createdAt: {
+        gte: new Date(new Date() - 24 * 60 * 60 * 1000), // 24 hours
+      },
+    });
+
+    return currentChatCount < user.dailyMessageLimit;
+  },
+};
+
+module.exports = { User };

package/server/models/vectors.js

@@ -0,0 +1,79 @@
+const prisma = require("../utils/prisma");
+const { Document } = require("./documents");
+
+const DocumentVectors = {
+  bulkInsert: async function (vectorRecords = []) {
+    if (vectorRecords.length === 0) return;
+
+    try {
+      const inserts = [];
+      vectorRecords.forEach((record) => {
+        inserts.push(
+          prisma.document_vectors.create({
+            data: {
+              docId: record.docId,
+              vectorId: record.vectorId,
+            },
+          })
+        );
+      });
+      await prisma.$transaction(inserts);
+      return { documentsInserted: inserts.length };
+    } catch (error) {
+      console.error("Bulk insert failed", error);
+      return { documentsInserted: 0 };
+    }
+  },
+
+  where: async function (clause = {}, limit) {
+    try {
+      const results = await prisma.document_vectors.findMany({
+        where: clause,
+        take: limit || undefined,
+      });
+      return results;
+    } catch (error) {
+      console.error("Where query failed", error);
+      return [];
+    }
+  },
+
+  deleteForWorkspace: async function (workspaceId) {
+    const documents = await Document.forWorkspace(workspaceId);
+    const docIds = [...new Set(documents.map((doc) => doc.docId))];
+
+    try {
+      await prisma.document_vectors.deleteMany({
+        where: { docId: { in: docIds } },
+      });
+      return true;
+    } catch (error) {
+      console.error("Delete for workspace failed", error);
+      return false;
+    }
+  },
+
+  deleteIds: async function (ids = []) {
+    try {
+      await prisma.document_vectors.deleteMany({
+        where: { id: { in: ids } },
+      });
+      return true;
+    } catch (error) {
+      console.error("Delete IDs failed", error);
+      return false;
+    }
+  },
+
+  delete: async function (clause = {}) {
+    try {
+      await prisma.document_vectors.deleteMany({ where: clause });
+      return true;
+    } catch (error) {
+      console.error("Delete failed", error);
+      return false;
+    }
+  },
+};
+
+module.exports = { DocumentVectors };