mirror of
https://github.com/DayuanJiang/next-ai-draw-io.git
synced 2026-10-07 18:27:47 +08:00
dayuan.jiang
d5f31cb253
Found by the second PR review: - With AWS_BEARER_TOKEN_BEDROCK set on the server, a request with the user's AWS keys ran on the server's token: the Bedrock SDK prefers it. Checked with Bedrock: invalid user keys used to get an answer. - An OpenAI key with the official URL filled in (the settings form does that) went to the Responses API. Back to main's rule: a configured base URL uses Chat Completions. - A user's Ollama key went to the server's OLLAMA_BASE_URL, for chat and for the model list. Like every other provider, it goes to the user's base URL or Ollama Cloud. - The server's keyless Ollama and EdgeOne were not counted in the quota. - AI_MODEL models on the server's keys ran on any provider with a server key, not only on AI_PROVIDER. - A user's Azure key without a base URL used the server's resource name. - The admin panel's Test button failed whenever access codes were set. - DeepSeek's errors in the stream (plain text) were shown as they were, without a hint and also on the server's keys. Bedrock's throttling in the stream was not recognised as a rate limit. - The EdgeOne function accepted text/plain; x=application/json, which other sites can send without a CORS preflight. - Desktop app: a launch that found the old port taken for a moment (the previous version still quitting after an update) remembered the new port for good. The new port is kept only when Windows reserves the old one. A failed read of the presets file moved it aside as corrupt, and a save could then replace the presets. Switching presets on the same port now reloads the page. The dev launcher no longer misses a preset change made before or during a restart.
71 lines
2.6 KiB
TypeScript
71 lines
2.6 KiB
TypeScript
import { POST as validateModel } from "@/app/api/validate-model/route"
|
|
import { checkAdminAuth } from "@/lib/admin/auth"
|
|
import {
|
|
AdminProviderSchema,
|
|
loadAdminProviders,
|
|
mergeSecrets,
|
|
} from "@/lib/admin/providers"
|
|
|
|
export const runtime = "nodejs"
|
|
export const dynamic = "force-dynamic"
|
|
|
|
// Test a model with the client's CURRENT provider state (which may be
|
|
// unsaved). Secret fields arrive either as plaintext (newly typed) or as
|
|
// masked {isSet} markers, which are resolved against settings.json — so
|
|
// testing works both before and after saving.
|
|
export async function POST(req: Request) {
|
|
const authError = checkAdminAuth(req)
|
|
if (authError) return authError
|
|
|
|
let body: { provider?: unknown; modelId?: string }
|
|
try {
|
|
body = await req.json()
|
|
} catch {
|
|
return Response.json({ error: "Invalid JSON body" }, { status: 400 })
|
|
}
|
|
|
|
const parsed = AdminProviderSchema.safeParse(body.provider)
|
|
if (!parsed.success || !body.modelId) {
|
|
return Response.json(
|
|
{ valid: false, error: "Invalid provider or model" },
|
|
{ status: 400 },
|
|
)
|
|
}
|
|
|
|
// SECURITY: a stored secret is only resolved from an {isSet} marker if
|
|
// the endpoint it would be sent to (provider + baseUrl) still matches
|
|
// the stored entry. Otherwise a tampered baseUrl could exfiltrate the
|
|
// stored key to an arbitrary host. Mismatches must re-supply plaintext.
|
|
const stored = loadAdminProviders().find((p) => p.id === parsed.data.id)
|
|
const sameEndpoint =
|
|
stored &&
|
|
stored.provider === parsed.data.provider &&
|
|
(stored.baseUrl ?? "") === (parsed.data.baseUrl ?? "") &&
|
|
(stored.awsRegion ?? "") === (parsed.data.awsRegion ?? "")
|
|
const [resolved] = mergeSecrets(
|
|
[parsed.data],
|
|
sameEndpoint && stored ? [stored] : [],
|
|
)
|
|
|
|
return validateModel(
|
|
new Request(new URL("/api/validate-model", req.url), {
|
|
method: "POST",
|
|
headers: {
|
|
"Content-Type": "application/json",
|
|
// Checked again there, in place of an access code
|
|
"x-admin-password": req.headers.get("x-admin-password") || "",
|
|
},
|
|
body: JSON.stringify({
|
|
provider: resolved.provider,
|
|
apiKey: resolved.apiKey,
|
|
baseUrl: resolved.baseUrl,
|
|
modelId: body.modelId,
|
|
awsAccessKeyId: resolved.awsAccessKeyId,
|
|
awsSecretAccessKey: resolved.awsSecretAccessKey,
|
|
awsRegion: resolved.awsRegion,
|
|
vertexApiKey: resolved.vertexApiKey,
|
|
}),
|
|
}),
|
|
)
|
|
}
|