calvin.erfmann/pangolin
1
0
Fork 0
mirror of https://github.com/fosrl/pangolin.git synced 2026-08-01 18:20:35 +02:00
Code Issues Packages Projects Releases Wiki Activity

add targets and refactor endpoints

Browse Source
This commit is contained in:
miloschwartz
2026-07-31 17:36:04 -04:00
parent 573747c237
commit 28430dde74
31 changed files with 741 additions and 490 deletions
Download Patch File Download Diff File Expand all files Collapse all files
server/routers/aiProvider/createAiModel.ts
+3 -9
View File
@@ -15,7 +15,6 @@ import {
} from "@server/routers/aiProvider/validation";
const paramsSchema = z.strictObject({
orgId: z.string().nonempty(),
providerId: z.coerce.number().int().positive()
});
@@ -33,7 +32,7 @@ const bodySchema = z
registry.registerPath({
method: "put",
path: "/org/{orgId}/ai-provider/{providerId}/model",
path: "/ai-provider/{providerId}/model",
description: "Create an AI model under a provider.",
tags: [OpenAPITags.AiModel],
request: {
@@ -79,7 +78,7 @@ export async function createAiModel(
);
}
const { orgId, providerId } = parsedParams.data;
const { providerId } = parsedParams.data;
const { modelKey, name, budgetAmount, budgetUnit, enabled } =
parsedBody.data;
@@ -89,12 +88,7 @@ export async function createAiModel(
: await db
.select()
.from(aiProviders)
.where(
and(
eq(aiProviders.providerId, providerId),
eq(aiProviders.orgId, orgId)
)
)
.where(eq(aiProviders.providerId, providerId))
.limit(1);
if (!provider) {
server/routers/aiProvider/createAiProvider.ts
+10 -1
View File
@@ -15,6 +15,7 @@ import {
aiAuthTypeSchema,
aiBudgetUnitSchema,
aiProviderTypeSchema,
aiRoutingModeSchema,
refineBudgetFields,
refineProviderUpstreamFields
} from "@server/routers/aiProvider/validation";
@@ -30,6 +31,7 @@ const bodySchema = z
upstreamUrl: z.url().optional().nullable(),
apiKey: z.string().optional(),
authType: aiAuthTypeSchema.optional().nullable(),
routingMode: aiRoutingModeSchema.optional(),
skipTlsVerification: z.boolean().optional(),
budgetAmount: z.number().positive().optional().nullable(),
budgetUnit: aiBudgetUnitSchema.optional().nullable(),
@@ -95,6 +97,7 @@ export async function createAiProvider(
upstreamUrl,
apiKey,
authType,
routingMode,
skipTlsVerification,
budgetAmount,
budgetUnit,
@@ -105,6 +108,8 @@ export async function createAiProvider(
const encryptedApiKey = apiKey ? encrypt(apiKey, key) : null;
const apiKeyLastChars = apiKey ? apiKey.slice(-4) : null;
const now = Date.now();
const resolvedRoutingMode =
type === "custom" ? (routingMode ?? "url") : "url";
const [provider] = await db
.insert(aiProviders)
@@ -112,10 +117,14 @@ export async function createAiProvider(
orgId,
name,
type,
upstreamUrl: upstreamUrl ?? null,
upstreamUrl:
resolvedRoutingMode === "target"
? null
: (upstreamUrl ?? null),
apiKey: encryptedApiKey,
apiKeyLastChars,
authType: authType ?? null,
routingMode: resolvedRoutingMode,
skipTlsVerification: skipTlsVerification ?? false,
budgetAmount: budgetAmount ?? null,
budgetUnit: budgetUnit ?? null,
server/routers/aiProvider/deleteAiModel.ts
+6 -25
View File
@@ -1,23 +1,21 @@
import { Request, Response, NextFunction } from "express";
import { z } from "zod";
import { aiModels, aiProviders, db } from "@server/db";
import { aiModels, db } from "@server/db";
import response from "@server/lib/response";
import HttpCode from "@server/types/HttpCode";
import createHttpError from "http-errors";
import logger from "@server/logger";
import { fromError } from "zod-validation-error";
import { OpenAPITags, registry } from "@server/openApi";
import { and, eq } from "drizzle-orm";
import { eq } from "drizzle-orm";
const paramsSchema = z.strictObject({
orgId: z.string().nonempty(),
providerId: z.coerce.number().int().positive(),
modelId: z.coerce.number().int().positive()
});
registry.registerPath({
method: "delete",
path: "/org/{orgId}/ai-provider/{providerId}/model/{modelId}",
path: "/ai-model/{modelId}",
description: "Delete an AI model.",
tags: [OpenAPITags.AiModel],
request: {
@@ -46,22 +44,12 @@ export async function deleteAiModel(
);
}
const { orgId, providerId, modelId } = parsedParams.data;
const { modelId } = parsedParams.data;
const [existing] = await db
.select({ modelId: aiModels.modelId })
.from(aiModels)
.innerJoin(
aiProviders,
eq(aiModels.providerId, aiProviders.providerId)
)
.where(
and(
eq(aiModels.modelId, modelId),
eq(aiModels.providerId, providerId),
eq(aiProviders.orgId, orgId)
)
)
.where(eq(aiModels.modelId, modelId))
.limit(1);
if (!existing) {
@@ -73,14 +61,7 @@ export async function deleteAiModel(
);
}
await db
.delete(aiModels)
.where(
and(
eq(aiModels.modelId, modelId),
eq(aiModels.providerId, providerId)
)
);
await db.delete(aiModels).where(eq(aiModels.modelId, modelId));
return response(res, {
data: null,
server/routers/aiProvider/deleteAiProvider.ts
+5 -16
View File
@@ -7,16 +7,15 @@ import createHttpError from "http-errors";
import logger from "@server/logger";
import { fromError } from "zod-validation-error";
import { OpenAPITags, registry } from "@server/openApi";
import { and, eq } from "drizzle-orm";
import { eq } from "drizzle-orm";
const paramsSchema = z.strictObject({
orgId: z.string().nonempty(),
providerId: z.coerce.number().int().positive()
});
registry.registerPath({
method: "delete",
path: "/org/{orgId}/ai-provider/{providerId}",
path: "/ai-provider/{providerId}",
description: "Delete an AI provider.",
tags: [OpenAPITags.AiProvider],
request: {
@@ -45,17 +44,12 @@ export async function deleteAiProvider(
);
}
const { orgId, providerId } = parsedParams.data;
const { providerId } = parsedParams.data;
const [existing] = await db
.select({ providerId: aiProviders.providerId })
.from(aiProviders)
.where(
and(
eq(aiProviders.providerId, providerId),
eq(aiProviders.orgId, orgId)
)
)
.where(eq(aiProviders.providerId, providerId))
.limit(1);
if (!existing) {
@@ -69,12 +63,7 @@ export async function deleteAiProvider(
await db
.delete(aiProviders)
.where(
and(
eq(aiProviders.providerId, providerId),
eq(aiProviders.orgId, orgId)
)
);
.where(eq(aiProviders.providerId, providerId));
return response(res, {
data: null,
server/routers/aiProvider/getAiModel.ts
+7 -20
View File
@@ -1,24 +1,22 @@
import { Request, Response, NextFunction } from "express";
import { z } from "zod";
import { aiModels, aiProviders, db } from "@server/db";
import { aiModels, db } from "@server/db";
import response from "@server/lib/response";
import HttpCode from "@server/types/HttpCode";
import createHttpError from "http-errors";
import logger from "@server/logger";
import { fromError } from "zod-validation-error";
import { OpenAPITags, registry } from "@server/openApi";
import { and, eq } from "drizzle-orm";
import { eq } from "drizzle-orm";
import type { GetAiModelResponse } from "@server/routers/aiProvider/types";
const paramsSchema = z.strictObject({
orgId: z.string().nonempty(),
providerId: z.coerce.number().int().positive(),
modelId: z.coerce.number().int().positive()
});
registry.registerPath({
method: "get",
path: "/org/{orgId}/ai-provider/{providerId}/model/{modelId}",
path: "/ai-model/{modelId}",
description: "Get an AI model by ID.",
tags: [OpenAPITags.AiModel],
request: {
@@ -47,27 +45,16 @@ export async function getAiModel(
);
}
const { orgId, providerId, modelId } = parsedParams.data;
const { modelId } = parsedParams.data;
const [model] =
req.aiModel && req.aiModel.modelId === modelId
? [req.aiModel]
: await db
.select({ model: aiModels })
.select()
.from(aiModels)
.innerJoin(
aiProviders,
eq(aiModels.providerId, aiProviders.providerId)
)
.where(
and(
eq(aiModels.modelId, modelId),
eq(aiModels.providerId, providerId),
eq(aiProviders.orgId, orgId)
)
)
.limit(1)
.then((rows) => rows.map((r) => r.model));
.where(eq(aiModels.modelId, modelId))
.limit(1);
if (!model) {
return next(
server/routers/aiProvider/getAiProvider.ts
+4 -10
View File
@@ -7,18 +7,17 @@ import createHttpError from "http-errors";
import logger from "@server/logger";
import { fromError } from "zod-validation-error";
import { OpenAPITags, registry } from "@server/openApi";
import { and, eq } from "drizzle-orm";
import { eq } from "drizzle-orm";
import type { GetAiProviderResponse } from "@server/routers/aiProvider/types";
import { toPublicAiProvider } from "@server/routers/aiProvider/types";
const paramsSchema = z.strictObject({
orgId: z.string().nonempty(),
providerId: z.coerce.number().int().positive()
});
registry.registerPath({
method: "get",
path: "/org/{orgId}/ai-provider/{providerId}",
path: "/ai-provider/{providerId}",
description: "Get an AI provider by ID.",
tags: [OpenAPITags.AiProvider],
request: {
@@ -47,7 +46,7 @@ export async function getAiProvider(
);
}
const { orgId, providerId } = parsedParams.data;
const { providerId } = parsedParams.data;
const [provider] =
req.aiProvider && req.aiProvider.providerId === providerId
@@ -55,12 +54,7 @@ export async function getAiProvider(
: await db
.select()
.from(aiProviders)
.where(
and(
eq(aiProviders.providerId, providerId),
eq(aiProviders.orgId, orgId)
)
)
.where(eq(aiProviders.providerId, providerId))
.limit(1);
if (!provider) {
server/routers/aiProvider/listAiModels.ts
+3 -9
View File
@@ -11,7 +11,6 @@ import { and, asc, eq, like, sql } from "drizzle-orm";
import type { ListAiModelsResponse } from "@server/routers/aiProvider/types";
const paramsSchema = z.strictObject({
orgId: z.string().nonempty(),
providerId: z.coerce.number().int().positive()
});
@@ -45,7 +44,7 @@ const listSchema = z.object({
registry.registerPath({
method: "get",
path: "/org/{orgId}/ai-provider/{providerId}/models",
path: "/ai-provider/{providerId}/models",
description: "List AI models for a provider.",
tags: [OpenAPITags.AiModel],
request: {
@@ -85,7 +84,7 @@ export async function listAiModels(
);
}
const { orgId, providerId } = parsedParams.data;
const { providerId } = parsedParams.data;
const [provider] =
req.aiProvider && req.aiProvider.providerId === providerId
@@ -93,12 +92,7 @@ export async function listAiModels(
: await db
.select({ providerId: aiProviders.providerId })
.from(aiProviders)
.where(
and(
eq(aiProviders.providerId, providerId),
eq(aiProviders.orgId, orgId)
)
)
.where(eq(aiProviders.providerId, providerId))
.limit(1);
if (!provider) {
server/routers/aiProvider/types.ts
+3 -1
View File
@@ -3,6 +3,7 @@ import type { PaginatedResponse } from "@server/types/Pagination";
import {
resolveAiProviderConfig,
type AiProviderAuthType,
type AiProviderRoutingMode,
type AiProviderType
} from "@server/lib/aiProviderDefaults";
@@ -40,7 +41,8 @@ export function toPublicAiProvider(provider: AiProvider): AiProviderPublic {
const resolved = resolveAiProviderConfig({
type: provider.type as AiProviderType,
upstreamUrl: provider.upstreamUrl,
authType: provider.authType as AiProviderAuthType | null
authType: provider.authType as AiProviderAuthType | null,
routingMode: provider.routingMode as AiProviderRoutingMode | null
});
return {
server/routers/aiProvider/updateAiModel.ts
+8 -26
View File
@@ -1,6 +1,6 @@
import { Request, Response, NextFunction } from "express";
import { z } from "zod";
import { aiModels, aiProviders, db } from "@server/db";
import { aiModels, db } from "@server/db";
import response from "@server/lib/response";
import HttpCode from "@server/types/HttpCode";
import createHttpError from "http-errors";
@@ -15,8 +15,6 @@ import {
} from "@server/routers/aiProvider/validation";
const paramsSchema = z.strictObject({
orgId: z.string().nonempty(),
providerId: z.coerce.number().int().positive(),
modelId: z.coerce.number().int().positive()
});
@@ -34,7 +32,7 @@ const bodySchema = z
registry.registerPath({
method: "post",
path: "/org/{orgId}/ai-provider/{providerId}/model/{modelId}",
path: "/ai-model/{modelId}",
description: "Update an AI model.",
tags: [OpenAPITags.AiModel],
request: {
@@ -80,28 +78,17 @@ export async function updateAiModel(
);
}
const { orgId, providerId, modelId } = parsedParams.data;
const { modelId } = parsedParams.data;
const body = parsedBody.data;
const [existing] =
req.aiModel && req.aiModel.modelId === modelId
? [req.aiModel]
: await db
.select({ model: aiModels })
.select()
.from(aiModels)
.innerJoin(
aiProviders,
eq(aiModels.providerId, aiProviders.providerId)
)
.where(
and(
eq(aiModels.modelId, modelId),
eq(aiModels.providerId, providerId),
eq(aiProviders.orgId, orgId)
)
)
.limit(1)
.then((rows) => rows.map((r) => r.model));
.where(eq(aiModels.modelId, modelId))
.limit(1);
if (!existing) {
return next(
@@ -121,7 +108,7 @@ export async function updateAiModel(
.from(aiModels)
.where(
and(
eq(aiModels.providerId, providerId),
eq(aiModels.providerId, existing.providerId),
eq(aiModels.modelKey, body.modelKey),
ne(aiModels.modelId, modelId)
)
@@ -161,12 +148,7 @@ export async function updateAiModel(
const [model] = await db
.update(aiModels)
.set(updateData)
.where(
and(
eq(aiModels.modelId, modelId),
eq(aiModels.providerId, providerId)
)
)
.where(eq(aiModels.modelId, modelId))
.returning();
return response<CreateOrEditAiModelResponse>(res, {
server/routers/aiProvider/updateAiProvider.ts
+41 -48
View File
@@ -7,7 +7,7 @@ import createHttpError from "http-errors";
import logger from "@server/logger";
import { fromError } from "zod-validation-error";
import { OpenAPITags, registry } from "@server/openApi";
import { and, eq } from "drizzle-orm";
import { eq } from "drizzle-orm";
import { encrypt } from "@server/lib/crypto";
import config from "@server/lib/config";
import type { CreateOrEditAiProviderResponse } from "@server/routers/aiProvider/types";
@@ -16,16 +16,16 @@ import {
aiAuthTypeSchema,
aiBudgetUnitSchema,
aiProviderTypeSchema,
aiRoutingModeSchema,
refineBudgetFields,
refineProviderUpstreamFields
} from "@server/routers/aiProvider/validation";
import {
providerRequiresUpstreamUrl,
type AiProviderType
import type {
AiProviderRoutingMode,
AiProviderType
} from "@server/lib/aiProviderDefaults";
const paramsSchema = z.strictObject({
orgId: z.string().nonempty(),
providerId: z.coerce.number().int().positive()
});
@@ -35,6 +35,7 @@ const bodySchema = z
upstreamUrl: z.url().optional().nullable(),
apiKey: z.string().optional(),
authType: aiAuthTypeSchema.optional().nullable(),
routingMode: aiRoutingModeSchema.optional(),
skipTlsVerification: z.boolean().optional(),
budgetAmount: z.number().positive().optional().nullable(),
budgetUnit: aiBudgetUnitSchema.optional().nullable(),
@@ -46,7 +47,7 @@ const bodySchema = z
registry.registerPath({
method: "post",
path: "/org/{orgId}/ai-provider/{providerId}",
path: "/ai-provider/{providerId}",
description: "Update an AI provider.",
tags: [OpenAPITags.AiProvider],
request: {
@@ -92,7 +93,7 @@ export async function updateAiProvider(
);
}
const { orgId, providerId } = parsedParams.data;
const { providerId } = parsedParams.data;
const body = parsedBody.data;
const [existing] =
@@ -101,12 +102,7 @@ export async function updateAiProvider(
: await db
.select()
.from(aiProviders)
.where(
and(
eq(aiProviders.providerId, providerId),
eq(aiProviders.orgId, orgId)
)
)
.where(eq(aiProviders.providerId, providerId))
.limit(1);
if (!existing) {
@@ -119,6 +115,11 @@ export async function updateAiProvider(
}
const providerType = existing.type as AiProviderType;
const nextRoutingMode: AiProviderRoutingMode =
providerType === "custom"
? ((body.routingMode ??
existing.routingMode) as AiProviderRoutingMode)
: "url";
const nextUpstreamUrl =
body.upstreamUrl !== undefined
? body.upstreamUrl
@@ -126,38 +127,33 @@ export async function updateAiProvider(
const nextAuthType =
body.authType !== undefined ? body.authType : existing.authType;
if (
providerRequiresUpstreamUrl(providerType) ||
body.upstreamUrl !== undefined ||
body.authType !== undefined
) {
const validation = z
.object({
type: aiProviderTypeSchema,
upstreamUrl: z.string().nullable().optional(),
authType: aiAuthTypeSchema.nullable().optional()
})
.superRefine((data, ctx) =>
refineProviderUpstreamFields(data, ctx)
)
.safeParse({
type: providerType,
upstreamUrl: nextUpstreamUrl,
authType: nextAuthType
});
const validation = z
.object({
type: aiProviderTypeSchema,
upstreamUrl: z.string().nullable().optional(),
authType: aiAuthTypeSchema.nullable().optional(),
routingMode: aiRoutingModeSchema.optional()
})
.superRefine((data, ctx) => refineProviderUpstreamFields(data, ctx))
.safeParse({
type: providerType,
upstreamUrl: nextUpstreamUrl,
authType: nextAuthType,
routingMode: nextRoutingMode
});
if (!validation.success) {
return next(
createHttpError(
HttpCode.BAD_REQUEST,
fromError(validation.error).toString()
)
);
}
if (!validation.success) {
return next(
createHttpError(
HttpCode.BAD_REQUEST,
fromError(validation.error).toString()
)
);
}
const updateData: Partial<typeof aiProviders.$inferInsert> = {
updatedAt: Date.now()
updatedAt: Date.now(),
routingMode: nextRoutingMode
};
if (body.name !== undefined) {
@@ -175,7 +171,9 @@ export async function updateAiProvider(
if (body.budgetUnit !== undefined) {
updateData.budgetUnit = body.budgetUnit;
}
if (body.upstreamUrl !== undefined) {
if (nextRoutingMode === "target") {
updateData.upstreamUrl = null;
} else if (body.upstreamUrl !== undefined) {
updateData.upstreamUrl = body.upstreamUrl;
}
if (body.authType !== undefined) {
@@ -191,12 +189,7 @@ export async function updateAiProvider(
const [provider] = await db
.update(aiProviders)
.set(updateData)
.where(
and(
eq(aiProviders.providerId, providerId),
eq(aiProviders.orgId, orgId)
)
)
.where(eq(aiProviders.providerId, providerId))
.returning();
return response<CreateOrEditAiProviderResponse>(res, {
server/routers/aiProvider/validation.ts
+19 -2
View File
@@ -2,6 +2,7 @@ import { z } from "zod";
import {
providerRequiresUpstreamUrl,
type AiBudgetUnit,
type AiProviderRoutingMode,
type AiProviderType
} from "@server/lib/aiProviderDefaults";
@@ -21,6 +22,8 @@ export const aiBudgetUnitSchema = z.enum(["usd", "tokens"]);
export const aiAuthTypeSchema = z.enum(["bearer"]);
export const aiRoutingModeSchema = z.enum(["url", "target"]);
export function refineBudgetFields(
data: {
budgetAmount?: number | null;
@@ -47,10 +50,24 @@ export function refineProviderUpstreamFields(
type: AiProviderType;
upstreamUrl?: string | null;
authType?: "bearer" | null;
routingMode?: AiProviderRoutingMode | null;
},
ctx: z.RefinementCtx
) {
if (providerRequiresUpstreamUrl(data.type) && !data.upstreamUrl) {
const routingMode = data.routingMode ?? "url";
if (data.type !== "custom" && routingMode === "target") {
ctx.addIssue({
code: "custom",
message: "routingMode target is only allowed for custom providers",
path: ["routingMode"]
});
}
if (
providerRequiresUpstreamUrl(data.type, routingMode) &&
!data.upstreamUrl
) {
ctx.addIssue({
code: "custom",
message: `upstreamUrl is required for ${data.type} providers`,
@@ -58,7 +75,7 @@ export function refineProviderUpstreamFields(
});
}
if (data.type === "custom" && !data.authType) {
if (data.type === "custom" && routingMode === "url" && !data.authType) {
ctx.addIssue({
code: "custom",
message: "authType is required for custom providers",
server/routers/external.ts
+25 -16
View File
@@ -1385,16 +1385,31 @@ authenticated.get(
);
authenticated.get(
"/org/:orgId/ai-provider/:providerId",
verifyOrgAccess,
"/ai-provider/:providerId",
verifyAiProviderAccess,
verifyUserHasAction(ActionsEnum.getAiProvider),
aiProvider.getAiProvider
);
authenticated.put(
"/ai-provider/:providerId/target",
verifyAiProviderAccess,
verifySiteAccess,
verifyLimits,
verifyUserHasAction(ActionsEnum.createTarget),
logActionAudit(ActionsEnum.createTarget),
target.createTarget
);
authenticated.get(
"/ai-provider/:providerId/targets",
verifyAiProviderAccess,
verifyUserHasAction(ActionsEnum.listTargets),
target.listTargets
);
authenticated.post(
"/org/:orgId/ai-provider/:providerId",
verifyOrgAccess,
"/ai-provider/:providerId",
verifyAiProviderAccess,
verifyUserHasAction(ActionsEnum.updateAiProvider),
logActionAudit(ActionsEnum.updateAiProvider),
@@ -1402,8 +1417,7 @@ authenticated.post(
);
authenticated.delete(
"/org/:orgId/ai-provider/:providerId",
verifyOrgAccess,
"/ai-provider/:providerId",
verifyAiProviderAccess,
verifyUserHasAction(ActionsEnum.deleteAiProvider),
logActionAudit(ActionsEnum.deleteAiProvider),
@@ -1411,8 +1425,7 @@ authenticated.delete(
);
authenticated.put(
"/org/:orgId/ai-provider/:providerId/model",
verifyOrgAccess,
"/ai-provider/:providerId/model",
verifyAiProviderAccess,
verifyUserHasAction(ActionsEnum.createAiModel),
logActionAudit(ActionsEnum.createAiModel),
@@ -1420,24 +1433,21 @@ authenticated.put(
);
authenticated.get(
"/org/:orgId/ai-provider/:providerId/models",
verifyOrgAccess,
"/ai-provider/:providerId/models",
verifyAiProviderAccess,
verifyUserHasAction(ActionsEnum.listAiModels),
aiProvider.listAiModels
);
authenticated.get(
"/org/:orgId/ai-provider/:providerId/model/:modelId",
verifyOrgAccess,
"/ai-model/:modelId",
verifyAiModelAccess,
verifyUserHasAction(ActionsEnum.getAiModel),
aiProvider.getAiModel
);
authenticated.post(
"/org/:orgId/ai-provider/:providerId/model/:modelId",
verifyOrgAccess,
"/ai-model/:modelId",
verifyAiModelAccess,
verifyUserHasAction(ActionsEnum.updateAiModel),
logActionAudit(ActionsEnum.updateAiModel),
@@ -1445,8 +1455,7 @@ authenticated.post(
);
authenticated.delete(
"/org/:orgId/ai-provider/:providerId/model/:modelId",
verifyOrgAccess,
"/ai-model/:modelId",
verifyAiModelAccess,
verifyUserHasAction(ActionsEnum.deleteAiModel),
logActionAudit(ActionsEnum.deleteAiModel),
server/routers/integration.ts
+24 -16
View File
@@ -1386,16 +1386,30 @@ authenticated.get(
);
authenticated.get(
"/org/:orgId/ai-provider/:providerId",
verifyApiKeyOrgAccess,
"/ai-provider/:providerId",
verifyApiKeyAiProviderAccess,
verifyApiKeyHasAction(ActionsEnum.getAiProvider),
aiProvider.getAiProvider
);
authenticated.put(
"/ai-provider/:providerId/target",
verifyApiKeyAiProviderAccess,
verifyLimits,
verifyApiKeyHasAction(ActionsEnum.createTarget),
logActionAudit(ActionsEnum.createTarget),
target.createTarget
);
authenticated.get(
"/ai-provider/:providerId/targets",
verifyApiKeyAiProviderAccess,
verifyApiKeyHasAction(ActionsEnum.listTargets),
target.listTargets
);
authenticated.post(
"/org/:orgId/ai-provider/:providerId",
verifyApiKeyOrgAccess,
"/ai-provider/:providerId",
verifyApiKeyAiProviderAccess,
verifyApiKeyHasAction(ActionsEnum.updateAiProvider),
logActionAudit(ActionsEnum.updateAiProvider),
@@ -1403,8 +1417,7 @@ authenticated.post(
);
authenticated.delete(
"/org/:orgId/ai-provider/:providerId",
verifyApiKeyOrgAccess,
"/ai-provider/:providerId",
verifyApiKeyAiProviderAccess,
verifyApiKeyHasAction(ActionsEnum.deleteAiProvider),
logActionAudit(ActionsEnum.deleteAiProvider),
@@ -1412,8 +1425,7 @@ authenticated.delete(
);
authenticated.put(
"/org/:orgId/ai-provider/:providerId/model",
verifyApiKeyOrgAccess,
"/ai-provider/:providerId/model",
verifyApiKeyAiProviderAccess,
verifyApiKeyHasAction(ActionsEnum.createAiModel),
logActionAudit(ActionsEnum.createAiModel),
@@ -1421,24 +1433,21 @@ authenticated.put(
);
authenticated.get(
"/org/:orgId/ai-provider/:providerId/models",
verifyApiKeyOrgAccess,
"/ai-provider/:providerId/models",
verifyApiKeyAiProviderAccess,
verifyApiKeyHasAction(ActionsEnum.listAiModels),
aiProvider.listAiModels
);
authenticated.get(
"/org/:orgId/ai-provider/:providerId/model/:modelId",
verifyApiKeyOrgAccess,
"/ai-model/:modelId",
verifyApiKeyAiModelAccess,
verifyApiKeyHasAction(ActionsEnum.getAiModel),
aiProvider.getAiModel
);
authenticated.post(
"/org/:orgId/ai-provider/:providerId/model/:modelId",
verifyApiKeyOrgAccess,
"/ai-model/:modelId",
verifyApiKeyAiModelAccess,
verifyApiKeyHasAction(ActionsEnum.updateAiModel),
logActionAudit(ActionsEnum.updateAiModel),
@@ -1446,8 +1455,7 @@ authenticated.post(
);
authenticated.delete(
"/org/:orgId/ai-provider/:providerId/model/:modelId",
verifyApiKeyOrgAccess,
"/ai-model/:modelId",
verifyApiKeyAiModelAccess,
verifyApiKeyHasAction(ActionsEnum.deleteAiModel),
logActionAudit(ActionsEnum.deleteAiModel),
server/routers/newt/buildConfiguration.ts
+10 -6
View File
@@ -15,7 +15,7 @@ import {
} from "@server/db";
import logger from "@server/logger";
import { initPeerAddHandshake, updatePeer } from "../olm/peers";
import { eq, and, inArray } from "drizzle-orm";
import { eq, and, inArray, or, isNotNull, sql } from "drizzle-orm";
import config from "@server/lib/config";
import { decrypt } from "@server/lib/crypto";
import {
@@ -211,7 +211,8 @@ export async function buildClientConfigurationForNewtClient(
// call rather than letting each resource fetch its own — with thousands
// of resources this avoids a concurrent DB/cache stampede for what is
// often the very same (e.g. wildcard) certificate.
const certByDomain = await batchFetchCertsForSiteResources(allSiteResources);
const certByDomain =
await batchFetchCertsForSiteResources(allSiteResources);
const resourceTargetsArr = await Promise.all(
allSiteResources.map((resource) =>
@@ -240,7 +241,7 @@ export async function buildTargetConfigurationForNewtClient(
version?: string | null,
remoteExitNodeId?: string
) {
// Get all enabled targets with their resource mode information
// Get enabled HTTP/TCP/UDP targets for resources and AI providers
const allTargets = await db
.select({
resourceId: targets.resourceId,
@@ -250,15 +251,18 @@ export async function buildTargetConfigurationForNewtClient(
port: targets.port,
internalPort: targets.internalPort,
enabled: targets.enabled,
mode: resources.mode
mode: sql<string>`COALESCE(${resources.mode}, ${targets.mode})`.mapWith(
String
)
})
.from(targets)
.innerJoin(resources, eq(targets.resourceId, resources.resourceId))
.leftJoin(resources, eq(targets.resourceId, resources.resourceId))
.where(
and(
eq(targets.siteId, siteId),
eq(targets.enabled, true),
inArray(targets.mode, ["http", "udp", "tcp"])
inArray(targets.mode, ["http", "udp", "tcp"]),
or(isNotNull(targets.resourceId), isNotNull(targets.providerId))
)
);
server/routers/target/createTarget.ts
+163 -31
View File
@@ -6,7 +6,14 @@ import {
TargetHealthCheck,
targetHealthCheck
} from "@server/db";
import { newts, resources, sites, Target, targets } from "@server/db";
import {
aiProviders,
newts,
resources,
sites,
Target,
targets
} from "@server/db";
import response from "@server/lib/response";
import HttpCode from "@server/types/HttpCode";
import createHttpError from "http-errors";
@@ -29,10 +36,19 @@ import { generateId } from "@server/auth/sessions/app";
import config from "@server/lib/config";
import { sendBrowserGatewayTargets } from "@server/routers/newt/targets";
const createTargetParamsSchema = z.strictObject({
const resourceTargetParamsSchema = z.strictObject({
resourceId: z.coerce.number().int().positive()
});
const providerTargetParamsSchema = z.strictObject({
providerId: z.coerce.number().int().positive()
});
const createTargetParamsSchema = z.union([
resourceTargetParamsSchema,
providerTargetParamsSchema
]);
const createTargetSchema = z
.strictObject({
siteId: z.int().positive(),
@@ -95,7 +111,7 @@ registry.registerPath({
description: "Create a target for a resource.",
tags: [OpenAPITags.PublicResourceLegacy],
request: {
params: createTargetParamsSchema,
params: resourceTargetParamsSchema,
body: {
content: {
"application/json": {
@@ -128,7 +144,40 @@ registry.registerPath({
description: "Create a target for a resource.",
tags: [OpenAPITags.PublicResource, OpenAPITags.Target],
request: {
params: createTargetParamsSchema,
params: resourceTargetParamsSchema,
body: {
content: {
"application/json": {
schema: createTargetSchema
}
}
}
},
responses: {
200: {
description: "Successful response",
content: {
"application/json": {
schema: z.object({
data: z.record(z.string(), z.any()).nullable(),
success: z.boolean(),
error: z.boolean(),
message: z.string(),
status: z.number()
})
}
}
}
}
});
registry.registerPath({
method: "put",
path: "/ai-provider/{providerId}/target",
description: "Create a target for an AI provider.",
tags: [OpenAPITags.AiProvider],
request: {
params: providerTargetParamsSchema,
body: {
content: {
"application/json": {
@@ -183,21 +232,74 @@ export async function createTarget(
);
}
const { resourceId } = parsedParams.data;
let resource: typeof resources.$inferSelect | undefined;
let provider: typeof aiProviders.$inferSelect | undefined;
// get the resource
const [resource] = await db
.select()
.from(resources)
.where(eq(resources.resourceId, resourceId));
if ("providerId" in parsedParams.data) {
const { providerId } = parsedParams.data;
[provider] =
req.aiProvider && req.aiProvider.providerId === providerId
? [req.aiProvider]
: await db
.select()
.from(aiProviders)
.where(eq(aiProviders.providerId, providerId))
.limit(1);
if (!resource) {
return next(
createHttpError(
HttpCode.NOT_FOUND,
`Resource with ID ${resourceId} not found`
)
);
if (!provider) {
return next(
createHttpError(
HttpCode.NOT_FOUND,
`AI provider with ID ${providerId} not found`
)
);
}
if (provider.routingMode !== "target") {
return next(
createHttpError(
HttpCode.BAD_REQUEST,
"AI provider must use target routing mode"
)
);
}
if (provider.type !== "custom") {
return next(
createHttpError(
HttpCode.BAD_REQUEST,
"Only custom AI providers support targets"
)
);
}
if (
targetData.method &&
!["http", "https"].includes(targetData.method.toLowerCase())
) {
return next(
createHttpError(
HttpCode.BAD_REQUEST,
"AI provider target method must be http or https"
)
);
}
} else {
const { resourceId } = parsedParams.data;
[resource] = await db
.select()
.from(resources)
.where(eq(resources.resourceId, resourceId))
.limit(1);
if (!resource) {
return next(
createHttpError(
HttpCode.NOT_FOUND,
`Resource with ID ${resourceId} not found`
)
);
}
}
const siteId = targetData.siteId;
@@ -217,6 +319,24 @@ export async function createTarget(
);
}
if (provider && site.orgId && site.orgId !== provider.orgId) {
return next(
createHttpError(
HttpCode.BAD_REQUEST,
"Site must belong to the AI provider organization"
)
);
}
const resourceId = resource?.resourceId ?? null;
const providerId = provider?.providerId ?? null;
const targetMode = provider
? "http"
: (targetData.mode ?? resource?.mode ?? "http");
const targetMethod = provider
? (targetData.method?.toLowerCase() ?? "https")
: targetData.method;
const plainToken = generateId(48);
const encryptedToken = encrypt(
plainToken,
@@ -230,20 +350,24 @@ export async function createTarget(
const existingTargets = await trx
.select()
.from(targets)
.where(eq(targets.resourceId, resourceId));
.where(
providerId
? eq(targets.providerId, providerId)
: eq(targets.resourceId, resourceId!)
);
const existingTarget = existingTargets.find(
(target) =>
target.ip === targetData.ip &&
target.port === targetData.port &&
target.method === targetData.method &&
target.method === targetMethod &&
target.siteId === targetData.siteId
);
if (existingTarget) {
// log a warning
logger.warn(
`Target with IP ${targetData.ip}, port ${targetData.port}, method ${targetData.method} already exists for resource ID ${resourceId}`
`Target with IP ${targetData.ip}, port ${targetData.port}, method ${targetMethod} already exists for ${providerId ? `AI provider ID ${providerId}` : `resource ID ${resourceId}`}`
);
}
@@ -252,10 +376,10 @@ export async function createTarget(
.insert(targets)
.values({
resourceId,
providerId,
...targetData,
mode: (targetData.mode ??
resource.mode ??
"http") as Target["mode"],
mode: targetMode as Target["mode"],
method: targetMethod,
priority: targetData.priority || 100
})
.returning();
@@ -289,13 +413,12 @@ export async function createTarget(
.insert(targets)
.values({
resourceId,
providerId,
siteId: site.siteId,
ip: targetData.ip,
mode: (targetData.mode ??
resource.mode ??
"http") as Target["mode"],
mode: targetMode as Target["mode"],
authToken: encryptedToken,
method: targetData.method,
method: targetMethod,
port: targetData.port,
internalPort,
enabled: targetData.enabled,
@@ -321,10 +444,12 @@ export async function createTarget(
healthCheck = await trx
.insert(targetHealthCheck)
.values({
orgId: resource.orgId,
orgId: provider?.orgId ?? resource!.orgId,
targetId: newTarget[0].targetId,
siteId: targetData.siteId,
name: `Resource ${resource.name} - ${targetData.ip}:${targetData.port}`,
name: provider
? `AI Provider ${provider.name} - ${targetData.ip}:${targetData.port}`
: `Resource ${resource!.name} - ${targetData.ip}:${targetData.port}`,
hcEnabled: targetData.hcEnabled ?? false,
hcPath: targetData.hcPath ?? null,
hcScheme: targetData.hcScheme ?? null,
@@ -399,10 +524,17 @@ export async function createTarget(
newt.newtId,
newTarget,
healthCheck,
resource.mode === "udp" ? "udp" : "tcp",
provider
? "tcp"
: (resource!.mode as string) === "udp"
? "udp"
: "tcp",
newt.version
);
} else if (["ssh", "rdp", "vnc"].includes(newTarget[0].mode)) {
} else if (
!provider &&
["ssh", "rdp", "vnc"].includes(newTarget[0].mode)
) {
await sendBrowserGatewayTargets(
newt.newtId,
newTarget,
server/routers/target/deleteTarget.ts
+53 -27
View File
@@ -79,38 +79,54 @@ export async function deleteTarget(
)
);
}
// get the resource
const [resource] = await db
.select()
.from(resources)
.where(eq(resources.resourceId, deletedTarget.resourceId!));
if (!resource) {
if (
(!deletedTarget.resourceId && !deletedTarget.providerId) ||
(deletedTarget.resourceId && deletedTarget.providerId)
) {
return next(
createHttpError(
HttpCode.NOT_FOUND,
`Resource with ID ${deletedTarget.resourceId} not found`
HttpCode.INTERNAL_SERVER_ERROR,
`Target with ID ${targetId} has invalid ownership`
)
);
}
// check if there are other targets on the resource
const otherTargets = await db
.select()
.from(targets)
.where(
and(
eq(targets.resourceId, resource.resourceId),
ne(targets.targetId, targetId)
)
);
let resource: typeof resources.$inferSelect | undefined;
if (deletedTarget.resourceId) {
[resource] = await db
.select()
.from(resources)
.where(eq(resources.resourceId, deletedTarget.resourceId))
.limit(1);
if (otherTargets.length == 0) {
// set the resource status
await db
.update(resources)
.set({ health: "unknown" })
.where(eq(resources.resourceId, resource.resourceId));
if (!resource) {
return next(
createHttpError(
HttpCode.NOT_FOUND,
`Resource with ID ${deletedTarget.resourceId} not found`
)
);
}
// check if there are other targets on the resource
const otherTargets = await db
.select()
.from(targets)
.where(
and(
eq(targets.resourceId, resource.resourceId),
ne(targets.targetId, targetId)
)
);
if (otherTargets.length == 0) {
// set the resource status
await db
.update(resources)
.set({ health: "unknown" })
.where(eq(resources.resourceId, resource.resourceId));
}
}
const [site] = await db
@@ -137,16 +153,26 @@ export async function deleteTarget(
.where(eq(newts.siteId, site.siteId))
.limit(1);
if (["http", "tcp", "udp"].includes(deletedTarget.mode)) {
if (
deletedTarget.providerId ||
["http", "tcp", "udp"].includes(deletedTarget.mode)
) {
await removeTargets(
newt.newtId,
// [deletedTarget],
[], // deleting the target from newt causes issues because we cant unbind the port. this needs to be fixed in newt before we can do this
[deletedHealthCheck],
resource.mode === "udp" ? "udp" : "tcp",
deletedTarget.providerId
? "tcp"
: (resource!.mode as string) === "udp"
? "udp"
: "tcp",
newt.version
);
} else if (["ssh", "rdp", "vnc"].includes(deletedTarget.mode)) {
} else if (
!deletedTarget.providerId &&
["ssh", "rdp", "vnc"].includes(deletedTarget.mode)
) {
await removeBrowserGatewayTarget(
newt.newtId,
deletedTarget.targetId,
server/routers/target/listTargets.ts
+53 -8
View File
@@ -10,10 +10,19 @@ import { fromError } from "zod-validation-error";
import logger from "@server/logger";
import { OpenAPITags, registry } from "@server/openApi";
const listTargetsParamsSchema = z.strictObject({
const resourceTargetsParamsSchema = z.strictObject({
resourceId: z.coerce.number().int().positive()
});
const providerTargetsParamsSchema = z.strictObject({
providerId: z.coerce.number().int().positive()
});
const listTargetsParamsSchema = z.union([
resourceTargetsParamsSchema,
providerTargetsParamsSchema
]);
const listTargetsSchema = z.strictObject({
limit: z
.string()
@@ -29,7 +38,7 @@ const listTargetsSchema = z.strictObject({
.pipe(z.int().nonnegative())
});
function queryTargets(resourceId: number) {
function queryTargets(owner: { resourceId: number } | { providerId: number }) {
const baseQuery = db
.select({
targetId: targets.targetId,
@@ -39,6 +48,7 @@ function queryTargets(resourceId: number) {
port: targets.port,
enabled: targets.enabled,
resourceId: targets.resourceId,
providerId: targets.providerId,
siteId: targets.siteId,
siteType: sites.type,
siteName: sites.name,
@@ -71,7 +81,11 @@ function queryTargets(resourceId: number) {
targetHealthCheck,
eq(targetHealthCheck.targetId, targets.targetId)
)
.where(eq(targets.resourceId, resourceId));
.where(
"providerId" in owner
? eq(targets.providerId, owner.providerId)
: eq(targets.resourceId, owner.resourceId)
);
return baseQuery;
}
@@ -94,7 +108,7 @@ registry.registerPath({
description: "List targets for a resource.",
tags: [OpenAPITags.PublicResourceLegacy],
request: {
params: listTargetsParamsSchema,
params: resourceTargetsParamsSchema,
query: listTargetsSchema
},
responses: {
@@ -121,7 +135,34 @@ registry.registerPath({
description: "List targets for a resource.",
tags: [OpenAPITags.PublicResource, OpenAPITags.Target],
request: {
params: listTargetsParamsSchema,
params: resourceTargetsParamsSchema,
query: listTargetsSchema
},
responses: {
200: {
description: "Successful response",
content: {
"application/json": {
schema: z.object({
data: z.record(z.string(), z.any()).nullable(),
success: z.boolean(),
error: z.boolean(),
message: z.string(),
status: z.number()
})
}
}
}
}
});
registry.registerPath({
method: "get",
path: "/ai-provider/{providerId}/targets",
description: "List targets for an AI provider.",
tags: [OpenAPITags.AiProvider],
request: {
params: providerTargetsParamsSchema,
query: listTargetsSchema
},
responses: {
@@ -168,14 +209,18 @@ export async function listTargets(
)
);
}
const { resourceId } = parsedParams.data;
const owner = parsedParams.data;
const ownerCondition =
"providerId" in owner
? eq(targets.providerId, owner.providerId)
: eq(targets.resourceId, owner.resourceId);
const baseQuery = queryTargets(resourceId);
const baseQuery = queryTargets(owner);
const countQuery = db
.select({ count: sql<number>`cast(count(*) as integer)` })
.from(targets)
.where(eq(targets.resourceId, resourceId));
.where(ownerCondition);
const targetsList = await baseQuery.limit(limit).offset(offset);
const totalCountResult = await countQuery;
server/routers/target/updateTarget.ts
+90 -16
View File
@@ -1,7 +1,7 @@
import { Request, Response, NextFunction } from "express";
import { z } from "zod";
import { db, targetHealthCheck } from "@server/db";
import { newts, resources, sites, targets } from "@server/db";
import { aiProviders, newts, resources, sites, targets } from "@server/db";
import { eq } from "drizzle-orm";
import response from "@server/lib/response";
import HttpCode from "@server/types/HttpCode";
@@ -147,21 +147,68 @@ export async function updateTarget(
);
}
// get the resource
const [resource] = await db
.select()
.from(resources)
.where(eq(resources.resourceId, target.resourceId!));
if (!resource) {
if (
(!target.resourceId && !target.providerId) ||
(target.resourceId && target.providerId)
) {
return next(
createHttpError(
HttpCode.NOT_FOUND,
`Resource with ID ${target.resourceId} not found`
HttpCode.INTERNAL_SERVER_ERROR,
`Target with ID ${targetId} has invalid ownership`
)
);
}
let resource: typeof resources.$inferSelect | undefined;
let provider: typeof aiProviders.$inferSelect | undefined;
if (target.resourceId) {
[resource] = await db
.select()
.from(resources)
.where(eq(resources.resourceId, target.resourceId))
.limit(1);
if (!resource) {
return next(
createHttpError(
HttpCode.NOT_FOUND,
`Resource with ID ${target.resourceId} not found`
)
);
}
} else {
[provider] = await db
.select()
.from(aiProviders)
.where(eq(aiProviders.providerId, target.providerId!))
.limit(1);
if (!provider) {
return next(
createHttpError(
HttpCode.NOT_FOUND,
`AI provider with ID ${target.providerId} not found`
)
);
}
if (
parsedBody.data.method !== undefined &&
(!parsedBody.data.method ||
!["http", "https"].includes(
parsedBody.data.method.toLowerCase()
))
) {
return next(
createHttpError(
HttpCode.BAD_REQUEST,
"AI provider target method must be http or https"
)
);
}
}
const [site] = await db
.select()
.from(sites)
@@ -177,6 +224,15 @@ export async function updateTarget(
);
}
if (provider && site.orgId && site.orgId !== provider.orgId) {
return next(
createHttpError(
HttpCode.BAD_REQUEST,
"Site must belong to the AI provider organization"
)
);
}
const { internalPort, targetIps } = await pickPort(site.siteId!, db);
if (!internalPort) {
@@ -221,8 +277,13 @@ export async function updateTarget(
}
const pathMatchTypeRemoved = parsedBody.data.pathMatchType === null;
const nextMode =
parsedBody.data.mode === null ? undefined : parsedBody.data.mode;
const nextMode = provider
? parsedBody.data.mode !== undefined
? "http"
: undefined
: parsedBody.data.mode === null
? undefined
: parsedBody.data.mode;
let updatedTarget: any;
let updatedHc: any;
@@ -233,7 +294,10 @@ export async function updateTarget(
siteId: parsedBody.data.siteId,
ip: parsedBody.data.ip,
mode: nextMode,
method: parsedBody.data.method,
method:
provider && parsedBody.data.method
? parsedBody.data.method.toLowerCase()
: parsedBody.data.method,
port: parsedBody.data.port,
internalPort,
enabled: parsedBody.data.enabled,
@@ -368,15 +432,25 @@ export async function updateTarget(
.where(eq(newts.siteId, site.siteId))
.limit(1);
if (["http", "tcp", "udp"].includes(updatedTarget.mode)) {
if (
provider ||
["http", "tcp", "udp"].includes(updatedTarget.mode)
) {
await addTargets(
newt.newtId,
[updatedTarget],
[updatedHc],
resource.mode === "udp" ? "udp" : "tcp",
provider
? "tcp"
: (resource!.mode as string) === "udp"
? "udp"
: "tcp",
newt.version
);
} else if (["ssh", "rdp", "vnc"].includes(updatedTarget.mode)) {
} else if (
!provider &&
["ssh", "rdp", "vnc"].includes(updatedTarget.mode)
) {
await sendBrowserGatewayTargets(
newt.newtId,
[updatedTarget],