Feat/api server (#9855)

* feat: add api server This reverts commit c76aa03566. * update yarn.lock * fix: correct import paths in ToolSettings component Update import paths for PreprocessSettings and WebSearchSettings to reference correct locations in DocProcessSettings and WebSearchSettings directories. * feat(settings): add API server settings link and route * fix(auth): improve authorization handling and error responses * feat(chat): enhance model validation and logging for chat completions feat(models): improve logging for model retrieval and filtering feat(utils): add model ID validation and support for OpenAI providers * feat(api-server): refactor config loading and remove unused ToolSettings component * refactor(ApiServerService): simplify config retrieval and improve error handling in ApiServerSettings * fix(mcp): remove unnecessary await in listTools return statement * refactor(ApiServerSettings): replace window.message with window.toast for notifications --------- Co-authored-by: kangfenmao <kangfenmao@qq.com>
2025-09-11 09:51:29 +08:00
parent d6a320490a
commit 2e31a5bbcb
23 changed files with 2725 additions and 2 deletions
@@ -0,0 +1,62 @@
+import crypto from 'crypto'
+import { NextFunction, Request, Response } from 'express'
+
+import { config } from '../config'
+
+export const authMiddleware = async (req: Request, res: Response, next: NextFunction) => {
+  const auth = req.header('Authorization') || ''
+  const xApiKey = req.header('x-api-key') || ''
+
+  // Fast rejection if neither credential header provided
+  if (!auth && !xApiKey) {
+    return res.status(401).json({ error: 'Unauthorized: missing credentials' })
+  }
+
+  let token: string | undefined
+
+  // Prefer Bearer if well‑formed
+  if (auth) {
+    const trimmed = auth.trim()
+    const bearerPrefix = /^Bearer\s+/i
+    if (bearerPrefix.test(trimmed)) {
+      const candidate = trimmed.replace(bearerPrefix, '').trim()
+      if (!candidate) {
+        return res.status(401).json({ error: 'Unauthorized: empty bearer token' })
+      }
+      token = candidate
+    }
+  }
+
+  // Fallback to x-api-key if token still not resolved
+  if (!token && xApiKey) {
+    if (!xApiKey.trim()) {
+      return res.status(401).json({ error: 'Unauthorized: empty x-api-key' })
+    }
+    token = xApiKey.trim()
+  }
+
+  if (!token) {
+    // At this point we had at least one header, but none yielded a usable token
+    return res.status(401).json({ error: 'Unauthorized: invalid credentials format' })
+  }
+
+  const { apiKey } = await config.get()
+
+  if (!apiKey) {
+    // If server not configured, treat as forbidden (or could be 500). Choose 403 to avoid leaking config state.
+    return res.status(403).json({ error: 'Forbidden' })
+  }
+
+  // Timing-safe compare when lengths match, else immediate forbidden
+  if (token.length !== apiKey.length) {
+    return res.status(403).json({ error: 'Forbidden' })
+  }
+
+  const tokenBuf = Buffer.from(token)
+  const keyBuf = Buffer.from(apiKey)
+  if (!crypto.timingSafeEqual(tokenBuf, keyBuf)) {
+    return res.status(403).json({ error: 'Forbidden' })
+  }
+
+  return next()
+}
@@ -0,0 +1,21 @@
+import { NextFunction, Request, Response } from 'express'
+
+import { loggerService } from '../../services/LoggerService'
+
+const logger = loggerService.withContext('ApiServerErrorHandler')
+
+// eslint-disable-next-line @typescript-eslint/no-unused-vars
+export const errorHandler = (err: Error, _req: Request, res: Response, _next: NextFunction) => {
+  logger.error('API Server Error:', err)
+
+  // Don't expose internal errors in production
+  const isDev = process.env.NODE_ENV === 'development'
+
+  res.status(500).json({
+    error: {
+      message: isDev ? err.message : 'Internal server error',
+      type: 'server_error',
+      ...(isDev && { stack: err.stack })
+    }
+  })
+}
@@ -0,0 +1,206 @@
+import { Express } from 'express'
+import swaggerJSDoc from 'swagger-jsdoc'
+import swaggerUi from 'swagger-ui-express'
+
+import { loggerService } from '../../services/LoggerService'
+
+const logger = loggerService.withContext('OpenAPIMiddleware')
+
+const swaggerOptions: swaggerJSDoc.Options = {
+  definition: {
+    openapi: '3.0.0',
+    info: {
+      title: 'Cherry Studio API',
+      version: '1.0.0',
+      description: 'OpenAI-compatible API for Cherry Studio with additional Cherry-specific endpoints',
+      contact: {
+        name: 'Cherry Studio',
+        url: 'https://github.com/CherryHQ/cherry-studio'
+      }
+    },
+    servers: [
+      {
+        url: 'http://localhost:23333',
+        description: 'Local development server'
+      }
+    ],
+    components: {
+      securitySchemes: {
+        BearerAuth: {
+          type: 'http',
+          scheme: 'bearer',
+          bearerFormat: 'JWT',
+          description: 'Use the API key from Cherry Studio settings'
+        }
+      },
+      schemas: {
+        Error: {
+          type: 'object',
+          properties: {
+            error: {
+              type: 'object',
+              properties: {
+                message: { type: 'string' },
+                type: { type: 'string' },
+                code: { type: 'string' }
+              }
+            }
+          }
+        },
+        ChatMessage: {
+          type: 'object',
+          properties: {
+            role: {
+              type: 'string',
+              enum: ['system', 'user', 'assistant', 'tool']
+            },
+            content: {
+              oneOf: [
+                { type: 'string' },
+                {
+                  type: 'array',
+                  items: {
+                    type: 'object',
+                    properties: {
+                      type: { type: 'string' },
+                      text: { type: 'string' },
+                      image_url: {
+                        type: 'object',
+                        properties: {
+                          url: { type: 'string' }
+                        }
+                      }
+                    }
+                  }
+                }
+              ]
+            },
+            name: { type: 'string' },
+            tool_calls: {
+              type: 'array',
+              items: {
+                type: 'object',
+                properties: {
+                  id: { type: 'string' },
+                  type: { type: 'string' },
+                  function: {
+                    type: 'object',
+                    properties: {
+                      name: { type: 'string' },
+                      arguments: { type: 'string' }
+                    }
+                  }
+                }
+              }
+            }
+          }
+        },
+        ChatCompletionRequest: {
+          type: 'object',
+          required: ['model', 'messages'],
+          properties: {
+            model: {
+              type: 'string',
+              description: 'The model to use for completion, in format provider:model-id'
+            },
+            messages: {
+              type: 'array',
+              items: { $ref: '#/components/schemas/ChatMessage' }
+            },
+            temperature: {
+              type: 'number',
+              minimum: 0,
+              maximum: 2,
+              default: 1
+            },
+            max_tokens: {
+              type: 'integer',
+              minimum: 1
+            },
+            stream: {
+              type: 'boolean',
+              default: false
+            },
+            tools: {
+              type: 'array',
+              items: {
+                type: 'object',
+                properties: {
+                  type: { type: 'string' },
+                  function: {
+                    type: 'object',
+                    properties: {
+                      name: { type: 'string' },
+                      description: { type: 'string' },
+                      parameters: { type: 'object' }
+                    }
+                  }
+                }
+              }
+            }
+          }
+        },
+        Model: {
+          type: 'object',
+          properties: {
+            id: { type: 'string' },
+            object: { type: 'string', enum: ['model'] },
+            created: { type: 'integer' },
+            owned_by: { type: 'string' }
+          }
+        },
+        MCPServer: {
+          type: 'object',
+          properties: {
+            id: { type: 'string' },
+            name: { type: 'string' },
+            command: { type: 'string' },
+            args: {
+              type: 'array',
+              items: { type: 'string' }
+            },
+            env: { type: 'object' },
+            disabled: { type: 'boolean' }
+          }
+        }
+      }
+    },
+    security: [
+      {
+        BearerAuth: []
+      }
+    ]
+  },
+  apis: ['./src/main/apiServer/routes/*.ts', './src/main/apiServer/app.ts']
+}
+
+export function setupOpenAPIDocumentation(app: Express) {
+  try {
+    const specs = swaggerJSDoc(swaggerOptions)
+
+    // Serve OpenAPI JSON
+    app.get('/api-docs.json', (_req, res) => {
+      res.setHeader('Content-Type', 'application/json')
+      res.send(specs)
+    })
+
+    // Serve Swagger UI
+    app.use(
+      '/api-docs',
+      swaggerUi.serve,
+      swaggerUi.setup(specs, {
+        customCss: `
+        .swagger-ui .topbar { display: none; }
+        .swagger-ui .info .title { color: #1890ff; }
+      `,
+        customSiteTitle: 'Cherry Studio API Documentation'
+      })
+    )
+
+    logger.info('OpenAPI documentation setup complete')
+    logger.info('Documentation available at /api-docs')
+    logger.info('OpenAPI spec available at /api-docs.json')
+  } catch (error) {
+    logger.error('Failed to setup OpenAPI documentation:', error as Error)
+  }
+}