forked from bai/curriculum-project-hub
feat: update .gitignore, remove unused API interfaces, and add local dev scripts for bootstrap and seeding connections
This commit is contained in:
@@ -4,6 +4,7 @@ dist/
|
||||
.env
|
||||
.env.*
|
||||
!.env.example
|
||||
.secrets/
|
||||
admin-web/node_modules/
|
||||
admin-web/build/
|
||||
admin-web/.svelte-kit/
|
||||
|
||||
@@ -145,27 +145,6 @@ export interface SessionSummary {
|
||||
updatedAt: string;
|
||||
}
|
||||
|
||||
export interface OrgModelRow {
|
||||
id: string;
|
||||
modelId: string;
|
||||
label: string;
|
||||
toolCapable: boolean;
|
||||
sortKey: string;
|
||||
createdAt: string;
|
||||
updatedAt: string;
|
||||
}
|
||||
|
||||
export interface OrgRoleRow {
|
||||
id: string;
|
||||
roleId: string;
|
||||
label: string;
|
||||
defaultModelId: string | null;
|
||||
systemPrompt: string | null;
|
||||
tools: string[] | null;
|
||||
createdAt: string;
|
||||
updatedAt: string;
|
||||
}
|
||||
|
||||
export interface ProviderConnection {
|
||||
organizationId: string;
|
||||
providerId: string;
|
||||
@@ -269,22 +248,6 @@ export const api = {
|
||||
return get(`${orgBase(slug)}/usage${qs ? `?${qs}` : ''}`) as Promise<UsageReport>;
|
||||
},
|
||||
|
||||
models: (slug: string) => get(`${orgBase(slug)}/models`) as Promise<{ models: OrgModelRow[] }>,
|
||||
createModel: (slug: string, body: { modelId: string; label: string; toolCapable?: boolean; sortKey?: string }) =>
|
||||
post(`${orgBase(slug)}/models`, body) as Promise<OrgModelRow>,
|
||||
updateModel: (slug: string, id: string, body: { label?: string; toolCapable?: boolean; sortKey?: string; modelId?: string }) =>
|
||||
patch(`${orgBase(slug)}/models/${id}`, body) as Promise<OrgModelRow>,
|
||||
deleteModel: (slug: string, id: string) =>
|
||||
del(`${orgBase(slug)}/models/${id}`),
|
||||
|
||||
roles: (slug: string) => get(`${orgBase(slug)}/roles`) as Promise<{ roles: OrgRoleRow[] }>,
|
||||
createRole: (slug: string, body: { roleId: string; label: string; defaultModelId?: string | null; systemPrompt?: string | null; tools?: string[] | null }) =>
|
||||
post(`${orgBase(slug)}/roles`, body) as Promise<OrgRoleRow>,
|
||||
updateRole: (slug: string, id: string, body: { label?: string; defaultModelId?: string | null; systemPrompt?: string | null; tools?: string[] | null; roleId?: string }) =>
|
||||
patch(`${orgBase(slug)}/roles/${id}`, body) as Promise<OrgRoleRow>,
|
||||
deleteRole: (slug: string, id: string) =>
|
||||
del(`${orgBase(slug)}/roles/${id}`),
|
||||
|
||||
provider: (slug: string) => get(`${orgBase(slug)}/provider-connection`) as Promise<ProviderConnection>,
|
||||
setProvider: (slug: string, body: { mode: string; providerId?: string; baseUrl?: string | null; authToken?: string | null }) =>
|
||||
put(`${orgBase(slug)}/provider-connection`, body) as Promise<ProviderConnection>
|
||||
|
||||
@@ -9,8 +9,6 @@
|
||||
| 'members'
|
||||
| 'teams'
|
||||
| 'projects'
|
||||
| 'models'
|
||||
| 'roles'
|
||||
| 'provider'
|
||||
| 'menu'
|
||||
| 'logout'
|
||||
@@ -51,18 +49,6 @@
|
||||
d="M3.75 6.75A2.25 2.25 0 016 4.5h3.379c.6 0 1.175.238 1.6.66l.842.84c.424.423 1 .66 1.6.66H18A2.25 2.25 0 0120.25 9v8.25A2.25 2.25 0 0118 19.5H6a2.25 2.25 0 01-2.25-2.25V6.75z"
|
||||
/>
|
||||
</svg>
|
||||
{:else if name === 'models'}
|
||||
<svg class={className} viewBox="0 0 24 24" fill="none" stroke="currentColor" stroke-width="1.75">
|
||||
<path stroke-linecap="round" stroke-linejoin="round" d="M4.5 12l7.5-7.5L19.5 12 12 19.5 4.5 12z" />
|
||||
</svg>
|
||||
{:else if name === 'roles'}
|
||||
<svg class={className} viewBox="0 0 24 24" fill="none" stroke="currentColor" stroke-width="1.75">
|
||||
<path
|
||||
stroke-linecap="round"
|
||||
stroke-linejoin="round"
|
||||
d="M9.813 15.904L9 18.75l-.813-2.846a4.5 4.5 0 00-3.09-3.09L2.25 12l2.846-.813a4.5 4.5 0 003.09-3.09L9 5.25l.813 2.846a4.5 4.5 0 003.09 3.09L15.75 12l-2.846.813a4.5 4.5 0 00-3.09 3.09z"
|
||||
/>
|
||||
</svg>
|
||||
{:else if name === 'provider'}
|
||||
<svg class={className} viewBox="0 0 24 24" fill="none" stroke="currentColor" stroke-width="1.75">
|
||||
<path stroke-linecap="round" stroke-linejoin="round" d="M13.19 8.688a4.5 4.5 0 016.364 6.364l-3.182 3.182a4.5 4.5 0 01-6.364-6.364" />
|
||||
|
||||
@@ -1,148 +0,0 @@
|
||||
<script lang="ts">
|
||||
import { Checkbox, Label } from 'bits-ui';
|
||||
import type { OrgRoleRow, OrgModelRow } from '$lib/api';
|
||||
import { api } from '$lib/api';
|
||||
import { fmtDate } from '$lib/format';
|
||||
import { TOOL_OPTIONS } from '$lib/constants';
|
||||
import SelectField from '$lib/components/SelectField.svelte';
|
||||
import CheckboxControl from '$lib/components/CheckboxControl.svelte';
|
||||
import Icon from '$lib/components/Icon.svelte';
|
||||
import { toastError, toastSuccess } from '$lib/toast';
|
||||
|
||||
let {
|
||||
r,
|
||||
models,
|
||||
slug,
|
||||
onremoved,
|
||||
onupdated
|
||||
}: {
|
||||
r: OrgRoleRow;
|
||||
models: OrgModelRow[];
|
||||
slug: string;
|
||||
onremoved: () => void;
|
||||
onupdated: (updated: OrgRoleRow) => void;
|
||||
} = $props();
|
||||
|
||||
const initial = {
|
||||
roleId: r.roleId,
|
||||
label: r.label,
|
||||
defaultModelId: r.defaultModelId ?? '',
|
||||
systemPrompt: r.systemPrompt ?? '',
|
||||
unrestricted: r.tools === null,
|
||||
tools: r.tools ?? []
|
||||
};
|
||||
let roleId = $state(initial.roleId);
|
||||
let label = $state(initial.label);
|
||||
let defaultModelId = $state(initial.defaultModelId);
|
||||
let systemPrompt = $state(initial.systemPrompt);
|
||||
let unrestricted = $state(initial.unrestricted);
|
||||
let selectedTools = $state<string[]>([...initial.tools]);
|
||||
let saving = $state(false);
|
||||
|
||||
async function save() {
|
||||
saving = true;
|
||||
const tools = unrestricted ? null : selectedTools;
|
||||
try {
|
||||
const updated = await api.updateRole(slug, r.id, {
|
||||
roleId: roleId.trim(),
|
||||
label: label.trim(),
|
||||
defaultModelId: defaultModelId === '' ? null : defaultModelId,
|
||||
systemPrompt: systemPrompt === '' ? null : systemPrompt,
|
||||
tools
|
||||
});
|
||||
onupdated(updated);
|
||||
toastSuccess('角色已保存');
|
||||
} catch (err) {
|
||||
toastError(err instanceof Error ? err.message : String(err));
|
||||
} finally {
|
||||
saving = false;
|
||||
}
|
||||
}
|
||||
|
||||
const groupedTools = TOOL_OPTIONS.reduce(
|
||||
(acc, t) => {
|
||||
(acc[t.group] ??= []).push(t);
|
||||
return acc;
|
||||
},
|
||||
{} as Record<string, typeof TOOL_OPTIONS>
|
||||
);
|
||||
|
||||
const modelItems = $derived([
|
||||
{ value: '', label: '（使用清单中的首个模型）' },
|
||||
...models.map((m) => ({ value: m.modelId, label: `${m.label}（${m.modelId}）` }))
|
||||
]);
|
||||
</script>
|
||||
|
||||
<div class="saas-card-pad">
|
||||
<div class="mb-4 flex flex-wrap items-center gap-2">
|
||||
<span class="saas-badge-primary font-mono">/{roleId || r.roleId}</span>
|
||||
<span class="text-sm text-surface-700">{label || r.label}</span>
|
||||
</div>
|
||||
|
||||
<div class="grid grid-cols-1 gap-4 md:grid-cols-2">
|
||||
<div>
|
||||
<Label.Root for="role-id-{r.id}" class="saas-label">角色 ID</Label.Root>
|
||||
<input id="role-id-{r.id}" class="saas-input font-mono text-sm" bind:value={roleId} />
|
||||
</div>
|
||||
<div>
|
||||
<Label.Root for="role-label-{r.id}" class="saas-label">显示名</Label.Root>
|
||||
<input id="role-label-{r.id}" class="saas-input" bind:value={label} />
|
||||
</div>
|
||||
</div>
|
||||
|
||||
<div class="mt-4">
|
||||
<p class="saas-label">默认模型</p>
|
||||
<SelectField items={modelItems} bind:value={defaultModelId} />
|
||||
</div>
|
||||
|
||||
<div class="mt-4">
|
||||
<span class="saas-label">工具白名单</span>
|
||||
<label class="mb-3 flex cursor-pointer items-center gap-2 border border-surface-300 bg-surface-100 px-3 py-2">
|
||||
<CheckboxControl bind:checked={unrestricted} />
|
||||
<span class="text-sm">不限（使用全部注册工具）</span>
|
||||
</label>
|
||||
<div class="space-y-3 {unrestricted ? 'pointer-events-none opacity-40' : ''}">
|
||||
<Checkbox.Group bind:value={selectedTools} disabled={unrestricted}>
|
||||
{#each Object.entries(groupedTools) as [group, tools]}
|
||||
<div>
|
||||
<p class="mb-1.5 text-xs font-semibold uppercase tracking-wide text-surface-600">{group}</p>
|
||||
<div class="grid grid-cols-1 gap-1.5 sm:grid-cols-2">
|
||||
{#each tools as t}
|
||||
<label class="flex cursor-pointer items-center gap-2 px-2 py-1.5 text-sm hover:bg-surface-100">
|
||||
<Checkbox.Root class="saas-checkbox" value={t.id} id={`tool-${r.id}-${t.id}`}>
|
||||
{#snippet children({ checked })}
|
||||
{#if checked}
|
||||
<Icon name="check" class="h-3.5 w-3.5" />
|
||||
{/if}
|
||||
{/snippet}
|
||||
</Checkbox.Root>
|
||||
<span>{t.label}</span>
|
||||
</label>
|
||||
{/each}
|
||||
</div>
|
||||
</div>
|
||||
{/each}
|
||||
</Checkbox.Group>
|
||||
</div>
|
||||
</div>
|
||||
|
||||
<div class="mt-4">
|
||||
<Label.Root for="role-prompt-{r.id}" class="saas-label">系统提示词</Label.Root>
|
||||
<textarea
|
||||
id="role-prompt-{r.id}"
|
||||
class="saas-textarea"
|
||||
rows="4"
|
||||
placeholder="系统提示词（可选）。会话开始时注入，定义智能体人格/指令。"
|
||||
bind:value={systemPrompt}
|
||||
></textarea>
|
||||
</div>
|
||||
|
||||
<div class="mt-4 flex flex-wrap items-center gap-3 border-t border-surface-100 pt-4">
|
||||
<span class="text-xs text-surface-600">更新于 {fmtDate(r.updatedAt)}</span>
|
||||
<div class="flex-1"></div>
|
||||
<button class="saas-btn-danger" onclick={onremoved}>删除角色</button>
|
||||
<button class="saas-btn-primary" onclick={save} disabled={saving}>
|
||||
{saving ? '保存中…' : '保存'}
|
||||
</button>
|
||||
</div>
|
||||
</div>
|
||||
@@ -23,8 +23,6 @@
|
||||
{ key: 'members', label: '成员', icon: 'members' as const },
|
||||
{ key: 'teams', label: '团队', icon: 'teams' as const },
|
||||
{ key: 'projects', label: '项目', icon: 'projects' as const },
|
||||
{ key: 'models', label: '模型', icon: 'models' as const },
|
||||
{ key: 'roles', label: '角色', icon: 'roles' as const },
|
||||
{ key: 'provider', label: '供应方', icon: 'provider' as const }
|
||||
];
|
||||
|
||||
|
||||
+5
-3
@@ -35,14 +35,16 @@
|
||||
"check": "tsc -p tsconfig.json --noEmit",
|
||||
"audit:production": "npm audit --omit=dev --audit-level=high",
|
||||
"prisma:generate": "prisma generate --schema prisma/schema.prisma",
|
||||
"prisma:validate": "DATABASE_URL=${DATABASE_URL:-postgresql://stub:stub@127.0.0.1:5432/stub} prisma validate --schema prisma/schema.prisma",
|
||||
"prisma:migrate": "DATABASE_URL=${DATABASE_URL:-postgresql://paradigm:paradigm@127.0.0.1:5432/paradigm} prisma migrate deploy --schema prisma/schema.prisma",
|
||||
"prisma:validate": "prisma validate --schema prisma/schema.prisma",
|
||||
"prisma:migrate": "prisma migrate deploy --schema prisma/schema.prisma",
|
||||
"secrets:rotate-kek": "node dist/deployment/rotate-secret-kek.js",
|
||||
"agent-config": "node dist/deployment/agent-config-cli.js",
|
||||
"silo:bootstrap": "node dist/deployment/bootstrap-silo-cli.js",
|
||||
"silo:restore-preflight": "node dist/deployment/restore-preflight.js",
|
||||
"deploy": "bash deploy/deploy_platform.sh",
|
||||
"test": "vitest run",
|
||||
"test:watch": "vitest"
|
||||
"test:watch": "vitest",
|
||||
"admin:dev": "npm run dev --prefix admin-web",
|
||||
"admin:build": "npm run build --prefix admin-web"
|
||||
}
|
||||
}
|
||||
|
||||
@@ -0,0 +1,76 @@
|
||||
/**
|
||||
* Local dev bootstrap for an Alpha Silo on Windows / non-systemd hosts.
|
||||
*
|
||||
* The production bootstrap-silo CLI is Linux-only (requires root uid 0,
|
||||
* systemctl, root-owned files). This script calls the same
|
||||
* `bootstrapAlphaSilo` invariants directly, sourcing credentials from the
|
||||
* local `.env` and the dev keyring. Idempotent: re-running is a no-op once
|
||||
* the Silo Organization exists.
|
||||
*
|
||||
* Usage: npx tsx scripts/dev-bootstrap-silo.ts
|
||||
*/
|
||||
import "dotenv/config";
|
||||
import { PrismaClient } from "@prisma/client";
|
||||
import { bootstrapAlphaSilo } from "../src/deployment/bootstrap-silo.js";
|
||||
import { loadLocalSecretKeyring, LocalSecretEnvelope } from "../src/security/secretEnvelope.js";
|
||||
|
||||
function requiredEnv(name: string): string {
|
||||
const v = process.env[name]?.trim();
|
||||
if (v === undefined || v === "") throw new Error(`missing required env: ${name}`);
|
||||
return v;
|
||||
}
|
||||
|
||||
async function main(): Promise<void> {
|
||||
const databaseUrl = requiredEnv("DATABASE_URL");
|
||||
const keyring = await loadLocalSecretKeyring();
|
||||
const secrets = new LocalSecretEnvelope(keyring);
|
||||
const prisma = new PrismaClient({ datasources: { db: { url: databaseUrl } }, log: [] });
|
||||
|
||||
const organizationId = requiredEnv("HUB_SILO_ORGANIZATION_ID");
|
||||
const feishuAppId = requiredEnv("FEISHU_APP_ID");
|
||||
const feishuAppSecret = requiredEnv("FEISHU_APP_SECRET");
|
||||
const feishuBotOpenId = requiredEnv("FEISHU_BOT_OPEN_ID");
|
||||
const providerAuthToken = requiredEnv("ANTHROPIC_AUTH_TOKEN");
|
||||
const providerBaseUrl = process.env["ANTHROPIC_BASE_URL"]?.trim() || "https://openrouter.ai/api";
|
||||
const anthropicApiKey = process.env["ANTHROPIC_API_KEY"]?.trim() || "";
|
||||
|
||||
try {
|
||||
const result = await bootstrapAlphaSilo(
|
||||
prisma,
|
||||
secrets,
|
||||
{
|
||||
organization: {
|
||||
id: organizationId,
|
||||
slug: "local-dev",
|
||||
name: "Local Dev Silo",
|
||||
},
|
||||
owner: {
|
||||
openId: feishuBotOpenId,
|
||||
displayName: "Local Dev Owner",
|
||||
},
|
||||
feishu: {
|
||||
appId: feishuAppId,
|
||||
appSecret: feishuAppSecret,
|
||||
botOpenId: feishuBotOpenId,
|
||||
},
|
||||
provider: {
|
||||
providerId: "openrouter",
|
||||
baseUrl: providerBaseUrl,
|
||||
authToken: providerAuthToken,
|
||||
...(anthropicApiKey !== "" ? { anthropicApiKey } : {}),
|
||||
},
|
||||
},
|
||||
// Skip live network probes in local dev — Feishu/OpenRouter reachability
|
||||
// is not required to seed the encrypted envelope rows.
|
||||
{ feishu: async () => {}, provider: async () => {} },
|
||||
);
|
||||
console.log("bootstrap result:", JSON.stringify(result, null, 2));
|
||||
} finally {
|
||||
await prisma.$disconnect();
|
||||
}
|
||||
}
|
||||
|
||||
main().catch((error: unknown) => {
|
||||
console.error("[dev-bootstrap-silo] failed:", error instanceof Error ? error.message : String(error));
|
||||
process.exitCode = 1;
|
||||
});
|
||||
@@ -0,0 +1,84 @@
|
||||
/**
|
||||
* Local dev seed for an existing Organization that predates the ADR-0024
|
||||
* secret-envelope plane (e.g. the legacy `org_default` from the tenant-root
|
||||
* migration). Creates ACTIVE Feishu Application + Provider (BYOK openrouter)
|
||||
* connections with encrypted envelopes, using the local dev keyring.
|
||||
*
|
||||
* Idempotent: re-running rotates a new secret version if the connection
|
||||
* already exists.
|
||||
*
|
||||
* Usage: npx tsx scripts/dev-seed-connections.ts
|
||||
*/
|
||||
import "dotenv/config";
|
||||
import { PrismaClient } from "@prisma/client";
|
||||
import { FeishuApplicationConnectionService } from "../src/connections/feishuApplicationConnections.js";
|
||||
import { ProviderConnectionService } from "../src/connections/providerConnections.js";
|
||||
import { loadLocalSecretKeyring, LocalSecretEnvelope } from "../src/security/secretEnvelope.js";
|
||||
|
||||
function requiredEnv(name: string): string {
|
||||
const v = process.env[name]?.trim();
|
||||
if (v === undefined || v === "") throw new Error(`missing required env: ${name}`);
|
||||
return v;
|
||||
}
|
||||
|
||||
async function main(): Promise<void> {
|
||||
const databaseUrl = requiredEnv("DATABASE_URL");
|
||||
const organizationId = requiredEnv("HUB_SILO_ORGANIZATION_ID");
|
||||
const keyring = await loadLocalSecretKeyring();
|
||||
const secrets = new LocalSecretEnvelope(keyring);
|
||||
const prisma = new PrismaClient({ datasources: { db: { url: databaseUrl } }, log: [] });
|
||||
|
||||
const feishuAppId = requiredEnv("FEISHU_APP_ID");
|
||||
const feishuAppSecret = requiredEnv("FEISHU_APP_SECRET");
|
||||
const feishuBotOpenId = requiredEnv("FEISHU_BOT_OPEN_ID");
|
||||
const providerAuthToken = requiredEnv("ANTHROPIC_AUTH_TOKEN");
|
||||
const providerBaseUrl = process.env["ANTHROPIC_BASE_URL"]?.trim() || "https://openrouter.ai/api";
|
||||
const anthropicApiKey = process.env["ANTHROPIC_API_KEY"]?.trim() || "";
|
||||
|
||||
// Pick an existing active OWNER/ADMIN as the actor for the audit rows.
|
||||
const actor = await prisma.organizationMembership.findFirst({
|
||||
where: { organizationId, role: { in: ["OWNER", "ADMIN"] }, revokedAt: null },
|
||||
select: { userId: true },
|
||||
});
|
||||
if (actor === null) throw new Error(`no active OWNER/ADMIN membership on ${organizationId}; seed a member first`);
|
||||
const actorUserId = actor.userId;
|
||||
console.log("actor:", actorUserId);
|
||||
|
||||
try {
|
||||
const feishuService = new FeishuApplicationConnectionService(
|
||||
prisma,
|
||||
secrets,
|
||||
async () => {}, // skip live Feishu probe in local dev
|
||||
);
|
||||
const feishuResult = await feishuService.rotateCustomerApplication({
|
||||
organizationId,
|
||||
actorUserId,
|
||||
appId: feishuAppId,
|
||||
appSecret: feishuAppSecret,
|
||||
botOpenId: feishuBotOpenId,
|
||||
});
|
||||
console.log("feishu connection:", JSON.stringify(feishuResult, null, 2));
|
||||
|
||||
const providerService = new ProviderConnectionService(
|
||||
prisma,
|
||||
secrets,
|
||||
async () => {}, // skip live OpenRouter probe in local dev
|
||||
);
|
||||
const providerResult = await providerService.rotateByok({
|
||||
organizationId,
|
||||
actorUserId,
|
||||
providerId: "openrouter",
|
||||
baseUrl: providerBaseUrl,
|
||||
authToken: providerAuthToken,
|
||||
...(anthropicApiKey !== "" ? { anthropicApiKey } : {}),
|
||||
});
|
||||
console.log("provider connection:", JSON.stringify(providerResult, null, 2));
|
||||
} finally {
|
||||
await prisma.$disconnect();
|
||||
}
|
||||
}
|
||||
|
||||
main().catch((error: unknown) => {
|
||||
console.error("[dev-seed-connections] failed:", error instanceof Error ? error.message : String(error));
|
||||
process.exitCode = 1;
|
||||
});
|
||||
Reference in New Issue
Block a user