WIP checkpoint of the gitmost AI-chat backend (plan stages A + B1 + B3a). The agent acts under the requesting user's JWT (Docmost CASL enforces page access); the external service-account /mcp endpoint is untouched. LLM provider config (A2-A4): - integrations/crypto: AES-256-GCM SecretBoxService (key derived from APP_SECRET, per-record salt/iv; clear error on rotation instead of crashing). - ai_provider_credentials table/repo/types: encrypted API key stored outside workspace settings/baseFields, write-only (never returned by any endpoint). - integrations/ai: per-workspace AI SDK v6 provider driver (openai/gemini/ollama), admin-gated GET(masked)/PATCH(write-only key)/Test endpoints; settings.ai.provider holds non-secret config incl. systemPrompt. Removed unused AI_* env getters (DB is the single source of truth). Chat module (A1, A5-A8): - ai_chats/ai_chat_messages repos (workspace-scoped, soft-delete, tsv never selected). - core/ai-chat: CRUD + POST /ai-chat/stream (Fastify hijack + AI SDK v6 pipeUIMessageStreamToResponse, abort on disconnect, persist user/assistant msgs). - Agent loop: streamText + stepCountIs(8); read tools searchPages/getPage via a per-request DocmostClient over loopback REST under the user's minted access token. - Gate settings.ai.chat (+ 503 when provider unconfigured); buildSystemPrompt with a non-removable safety/anti-prompt-injection framework. Per-user rate limit. Per-user auth (B1): - @docmost/mcp DocmostClient gains an additive getToken variant (carry a user JWT, re-fetch on 401) and exports DocmostClient; the email/password service-account path (external /mcp, stdio) is unchanged. Agent-edit provenance backbone (B3a): - Migration: pages/page_history (last_updated_source, last_updated_ai_chat_id) and comments (created_source, ai_chat_id, resolved_source). - Signed actor/aiChatId claim in the collab token; onAuthenticate propagates it, onStoreDocument writes it with a sticky agent marker, saveHistory copies it. Migrations auto-run on boot (additive). Write tools, frontend, RAG and external MCP servers are not in this checkpoint. Co-Authored-By: Claude Opus 4.8 (1M context) <noreply@anthropic.com>
106 lines
3.6 KiB
TypeScript
106 lines
3.6 KiB
TypeScript
import { Module } from '@nestjs/common';
|
|
import { APP_INTERCEPTOR } from '@nestjs/core';
|
|
import { AppController } from './app.controller';
|
|
import { AppService } from './app.service';
|
|
import { EnvironmentService } from './integrations/environment/environment.service';
|
|
import { AuditActorInterceptor } from './common/interceptors/audit-actor.interceptor';
|
|
import { CoreModule } from './core/core.module';
|
|
import { EnvironmentModule } from './integrations/environment/environment.module';
|
|
import { CollaborationModule } from './collaboration/collaboration.module';
|
|
import { WsModule } from './ws/ws.module';
|
|
import { DatabaseModule } from '@docmost/db/database.module';
|
|
import { StorageModule } from './integrations/storage/storage.module';
|
|
import { MailModule } from './integrations/mail/mail.module';
|
|
import { QueueModule } from './integrations/queue/queue.module';
|
|
import { StaticModule } from './integrations/static/static.module';
|
|
import { EventEmitterModule } from '@nestjs/event-emitter';
|
|
import { HealthModule } from './integrations/health/health.module';
|
|
import { ExportModule } from './integrations/export/export.module';
|
|
import { ImportModule } from './integrations/import/import.module';
|
|
import { SecurityModule } from './integrations/security/security.module';
|
|
import { TelemetryModule } from './integrations/telemetry/telemetry.module';
|
|
import { RedisModule } from '@nestjs-labs/nestjs-ioredis';
|
|
import { RedisConfigService } from './integrations/redis/redis-config.service';
|
|
import { CacheModule } from '@nestjs/cache-manager';
|
|
import KeyvRedis from '@keyv/redis';
|
|
import { LoggerModule } from './common/logger/logger.module';
|
|
import { ClsModule } from 'nestjs-cls';
|
|
import { NoopAuditModule } from './integrations/audit/audit.module';
|
|
import { ThrottleModule } from './integrations/throttle/throttle.module';
|
|
import { McpModule } from './integrations/mcp/mcp.module';
|
|
import { AiModule } from './integrations/ai/ai.module';
|
|
import { AiChatModule } from './core/ai-chat/ai-chat.module';
|
|
|
|
const enterpriseModules = [];
|
|
try {
|
|
// eslint-disable-next-line @typescript-eslint/no-require-imports
|
|
if (require('./ee/ee.module')?.EeModule) {
|
|
// eslint-disable-next-line @typescript-eslint/no-require-imports
|
|
enterpriseModules.push(require('./ee/ee.module')?.EeModule);
|
|
}
|
|
} catch (err) {
|
|
if (process.env.CLOUD === 'true') {
|
|
console.warn('Failed to load enterprise modules. Exiting program.\n', err);
|
|
process.exit(1);
|
|
}
|
|
}
|
|
|
|
@Module({
|
|
imports: [
|
|
ClsModule.forRoot({
|
|
global: true,
|
|
middleware: { mount: true },
|
|
}),
|
|
LoggerModule,
|
|
NoopAuditModule,
|
|
CoreModule,
|
|
DatabaseModule,
|
|
EnvironmentModule,
|
|
RedisModule.forRootAsync({
|
|
useClass: RedisConfigService,
|
|
}),
|
|
CacheModule.registerAsync({
|
|
isGlobal: true,
|
|
useFactory: async (environmentService: EnvironmentService) => {
|
|
const redisUrl = environmentService.getRedisUrl();
|
|
|
|
return {
|
|
ttl: 5 * 1000,
|
|
stores: [new KeyvRedis(redisUrl)],
|
|
};
|
|
},
|
|
inject: [EnvironmentService],
|
|
}),
|
|
CollaborationModule,
|
|
WsModule,
|
|
QueueModule,
|
|
StaticModule,
|
|
HealthModule,
|
|
ImportModule,
|
|
ExportModule,
|
|
StorageModule.forRootAsync({
|
|
imports: [EnvironmentModule],
|
|
}),
|
|
MailModule.forRootAsync({
|
|
imports: [EnvironmentModule],
|
|
}),
|
|
EventEmitterModule.forRoot(),
|
|
SecurityModule,
|
|
TelemetryModule,
|
|
ThrottleModule,
|
|
McpModule,
|
|
AiModule,
|
|
AiChatModule,
|
|
...enterpriseModules,
|
|
],
|
|
controllers: [AppController],
|
|
providers: [
|
|
AppService,
|
|
{
|
|
provide: APP_INTERCEPTOR,
|
|
useClass: AuditActorInterceptor,
|
|
},
|
|
],
|
|
})
|
|
export class AppModule {}
|