mirror of
https://github.com/DayuanJiang/next-ai-draw-io.git
synced 2026-10-12 20:49:53 +08:00
fix: older defects (batch C) and the second batch's review
Chats: - New Chat right after an answer saves that chat once. Saves run one at a time and read the chat on screen when their turn comes; a save scheduled for a chat that is no longer on screen is dropped. A chat whose id was still on its way to the URL no longer comes back after New Chat (the next answer went into it). - Crossing the 768 px breakpoint keeps the chat panel: a streaming answer, unsaved messages and attachments stay. The panel gets the sizes of each side, and a panel collapsed on desktop opens on mobile. - The chat's export waits for its own reply: an edit's history export still on its way no longer answers it with the older diagram, and two file saves at once no longer swap results. - A second edit in one answer is previewed on the first edit's result. - Stop also ends a running screenshot check; a chat that cannot be saved (storage full) can be left with "Continue without saving". - Small diagrams with shapes count as diagrams; the tool card no longer crashes on malformed operations. Quota and providers: - Requests that reach the server's own endpoints count toward the quota: EdgeOne (always its own endpoint now), a private base URL whatever key header is sent, keyless Ollama without a URL. With the quota on, a redirect is followed only to a public address. The output cap applies to these requests too. - Stop records the tokens of the steps that finished; the screenshot check counts its tokens without counting a request. - EdgeOne configured only by AI_PROVIDER works, also in the admin Test, which forwards the access code. Azure set up only in the admin panel works in chat. The Test sends a Bedrock session token. - The admin panel's Test of an entry without a URL uses the server's URL as the server does (no private address check for it); the admin panel no longer writes an Ollama URL. MCP server: - Write tools and start_session run one at a time, so two at once never drop each other's change; a cancelled call waiting its turn is skipped. get_diagram and export_diagram keep the session they started with. - Export to .drawio first gets the user's latest edits from the browser. - History thumbnails: one that arrives after the next AI write is dropped; a sync reply keeps the image; a version that changed only page settings is its own entry. - A diagram over the 10 MB limit is saved without its image, or the user is told to download it (the server now answers 413 instead of cutting the connection). - Labels holding text like id='1' or parent='1' are no longer read as attributes (a layer or a parent was deleted). A broken bare <mxGraphModel> file is refused. - After a sync reply the tab no longer sends its autosave copy again. Desktop and files: - A newer switch of the same preset is not rolled back by an older one that failed. .env values with escaped quotes are read whole. - MCP saved files: a file that could not be read stays protected while a folder without permission hides it, and is saved again once deleted. - The desktop app reports "no chats" only when the count was read and no model settings are stored.
This commit is contained in:
dayuan.jiang
@@ -8,10 +8,11 @@ import { getAIModel } from "@/lib/ai-providers"
|
||||
// No saved admin providers
|
||||
vi.mock("@/lib/admin/settings", () => ({ loadSettings: () => ({}) }))
|
||||
|
||||
// Treat every URL as public so no test hits DNS
|
||||
// Every URL is public (no DNS in tests), unless a test says otherwise
|
||||
const privateUrls = vi.hoisted(() => ({ all: false }))
|
||||
vi.mock("@/lib/ssrf-protection", async (importOriginal) => ({
|
||||
...(await importOriginal<typeof import("@/lib/ssrf-protection")>()),
|
||||
isPrivateUrl: async () => false,
|
||||
isPrivateUrl: async () => privateUrls.all,
|
||||
}))
|
||||
|
||||
afterEach(() => {
|
||||
@@ -163,6 +164,120 @@ describe("chat requests to a client base URL", () => {
|
||||
})
|
||||
})
|
||||
|
||||
describe("testing EdgeOne", () => {
|
||||
// The request validate-model sends to the EdgeOne function
|
||||
const capture = () => {
|
||||
const calls: Array<{ url: string; headers: Headers }> = []
|
||||
vi.stubGlobal(
|
||||
"fetch",
|
||||
vi.fn(async (url: string, init?: RequestInit) => {
|
||||
calls.push({
|
||||
url: String(url),
|
||||
headers: new Headers(init?.headers),
|
||||
})
|
||||
throw new Error("no network in tests")
|
||||
}),
|
||||
)
|
||||
return calls
|
||||
}
|
||||
|
||||
it("calls the site's own function, also without a base URL", async () => {
|
||||
// The admin panel's Test sends none; a relative one cannot be fetched
|
||||
const calls = capture()
|
||||
await validateModel(
|
||||
new Request("http://localhost/api/validate-model", {
|
||||
method: "POST",
|
||||
headers: {
|
||||
"Content-Type": "application/json",
|
||||
origin: "https://draw.example",
|
||||
},
|
||||
body: JSON.stringify({
|
||||
provider: "edgeone",
|
||||
modelId: "@tx/deepseek-ai/deepseek-v3-0324",
|
||||
baseUrl: "https://elsewhere.example/api/edgeai",
|
||||
}),
|
||||
}),
|
||||
)
|
||||
expect(calls[0]?.url).toBe(
|
||||
"https://draw.example/api/edgeai/chat/completions",
|
||||
)
|
||||
})
|
||||
|
||||
it("passes the admin's access code and cookies on", async () => {
|
||||
// The EdgeOne function checks the access code too
|
||||
process.env.ADMIN_PASSWORD = "admin-pw"
|
||||
try {
|
||||
const calls = capture()
|
||||
await testModel(
|
||||
new Request("http://localhost/api/admin/test-model", {
|
||||
method: "POST",
|
||||
headers: {
|
||||
"Content-Type": "application/json",
|
||||
"x-admin-password": "admin-pw",
|
||||
"x-access-code": "visitor-code",
|
||||
cookie: "eo_token=t",
|
||||
origin: "https://draw.example",
|
||||
},
|
||||
body: JSON.stringify({
|
||||
provider: {
|
||||
id: "p1",
|
||||
provider: "edgeone",
|
||||
models: ["@tx/deepseek-ai/deepseek-v3-0324"],
|
||||
},
|
||||
modelId: "@tx/deepseek-ai/deepseek-v3-0324",
|
||||
}),
|
||||
}),
|
||||
)
|
||||
expect(calls[0]?.url).toBe(
|
||||
"https://draw.example/api/edgeai/chat/completions",
|
||||
)
|
||||
expect(calls[0]?.headers.get("x-access-code")).toBe("visitor-code")
|
||||
expect(calls[0]?.headers.get("cookie")).toBe("eo_token=t")
|
||||
} finally {
|
||||
delete process.env.ADMIN_PASSWORD
|
||||
}
|
||||
})
|
||||
})
|
||||
|
||||
describe("the admin Test of the server's own base URL", () => {
|
||||
const test = (headers: Record<string, string>) =>
|
||||
validateModel(
|
||||
new Request("http://localhost/api/validate-model", {
|
||||
method: "POST",
|
||||
headers: { "Content-Type": "application/json", ...headers },
|
||||
body: JSON.stringify({
|
||||
provider: "openai",
|
||||
apiKey: "panel-key",
|
||||
modelId: "gpt-5.5",
|
||||
baseUrl: "http://10.0.0.5:8000/v1",
|
||||
serverBaseUrl: true,
|
||||
}),
|
||||
}),
|
||||
)
|
||||
|
||||
it("tests it as chat uses it: an internal address is allowed", async () => {
|
||||
// ALLOW_PRIVATE_URLS=false guards URLs users type, not the server's
|
||||
process.env.ALLOW_PRIVATE_URLS = "false"
|
||||
process.env.OPENAI_BASE_URL = "http://10.0.0.5:8000/v1"
|
||||
process.env.ADMIN_PASSWORD = "admin-pw"
|
||||
privateUrls.all = true
|
||||
try {
|
||||
streamReply({ role: "assistant", content: "OK" })
|
||||
const admin = await (
|
||||
await test({ "x-admin-password": "admin-pw" })
|
||||
).json()
|
||||
expect(admin.valid).toBe(true)
|
||||
// Anyone else claiming it is still refused
|
||||
const other = await test({})
|
||||
expect(other.status).toBe(400)
|
||||
} finally {
|
||||
privateUrls.all = false
|
||||
delete process.env.OPENAI_BASE_URL
|
||||
delete process.env.ADMIN_PASSWORD
|
||||
}
|
||||
})
|
||||
})
|
||||
|
||||
describe("the admin panel's Test button", () => {
|
||||
it("works when access codes are set", async () => {
|
||||
// The admin password stands in for the visitor access code
|
||||
|
||||
Reference in New Issue
Block a user