Keysat
988a3cca9a
Multi-user authorization hardening from a full security evaluation (EVALUATION.md):
- P0: /api/settings/{export,import}-db are now admin-only. Previously any signed-in user could download the whole instance DB (all bcrypt hashes + plaintext AI keys) or replace it wholesale. Per-user CSV export/import stays open.
- AI custom-URL providers (Ollama, OpenAI-compatible) are now admin-only, and every server fetch to a user-supplied URL passes through assertSafeProviderUrl (blocks link-local/cloud-metadata; private LAN allowed by design). Fixed-URL cloud providers stay per-user. Removed the dead legacy /api/ai/config route.
- Dev: fixed broken quick-start (added npm run create-admin; rewrote README; dropped dead CLAUDE_API_KEY) and the export-db 0-byte path resolution (resolveDatabasePath now matches Prisma).
ExVer bumped to 1.1.0:8 (no schema/data migration). Tests 197 pass, build green, tsc clean.
39 lines
1.1 KiB
TypeScript
39 lines
1.1 KiB
TypeScript
import type { LLMProvider, ProviderId } from '../types';
|
|
import { ollama } from './ollama';
|
|
import { claude } from './claude';
|
|
import { openai, openaiCompatible } from './openai';
|
|
import { gemini } from './gemini';
|
|
|
|
const ALL: Record<ProviderId, LLMProvider> = {
|
|
claude,
|
|
openai,
|
|
'openai-compatible': openaiCompatible,
|
|
gemini,
|
|
ollama,
|
|
};
|
|
|
|
export function getProvider(id: string): LLMProvider | null {
|
|
return (ALL as Record<string, LLMProvider | undefined>)[id] ?? null;
|
|
}
|
|
|
|
/**
|
|
* True for providers that take a user-supplied base URL (Ollama,
|
|
* OpenAI-compatible). Configuring these is admin-only — a non-admin pointing
|
|
* the server at an arbitrary URL is the SSRF actor vector (EVALUATION.md P1).
|
|
* The fixed-URL cloud providers (claude/openai/gemini) stay per-user.
|
|
*/
|
|
export function isCustomUrlProvider(id: string): boolean {
|
|
return !!getProvider(id)?.requiresBaseUrl;
|
|
}
|
|
|
|
/** Stable list for UI dropdowns. Order matches the Settings select. */
|
|
export const PROVIDER_ORDER: ProviderId[] = [
|
|
'claude',
|
|
'openai',
|
|
'openai-compatible',
|
|
'gemini',
|
|
'ollama',
|
|
];
|
|
|
|
export const PROVIDERS = ALL;
|