calvin.erfmann/pangolin
1
0
Fork 0
mirror of https://github.com/fosrl/pangolin.git synced 2026-08-27 06:24:56 +02:00
Code Issues Packages Projects Releases Wiki Activity

Merge pull request #3643 from fosrl/dev

Browse Source 
1.22.0-s.1
This commit is contained in:
Owen Schwartz
2026-08-26 10:53:37 -04:00
committed by GitHub
parent f3474dac98 e57826d6e0
commit 5bdb12dafe
11 changed files with 51 additions and 42 deletions
Download Patch File Download Diff File Expand all files Collapse all files
server/db/pg/schema/schema.ts
+1 -1
View File
@@ -1984,7 +1984,7 @@ export const aiSessionLog = pgTable(
// were cut short at AI_SESSION_LOG_MAX_BODY_CHARS before storage.
truncated: boolean("truncated").notNull().default(false),
statusCode: integer("statusCode"),
createdAt: bigint("createdAt", { mode: "number" }).notNull() // epoch ms
createdAt: bigint("createdAt", { mode: "number" }).notNull() // epoch seconds
},
(t) => [
index("idx_ai_session_log_org_created").on(t.orgId, t.createdAt),
server/db/sqlite/schema/schema.ts
+1 -1
View File
@@ -1980,7 +1980,7 @@ export const aiSessionLog = sqliteTable(
.notNull()
.default(false),
statusCode: integer("statusCode"),
createdAt: integer("createdAt").notNull() // epoch ms
createdAt: integer("createdAt").notNull() // epoch seconds
},
(t) => [
index("idx_ai_session_log_org_created").on(t.orgId, t.createdAt),
server/lib/aiBudgetEnforcement.ts
+3 -1
View File
@@ -580,6 +580,8 @@ export async function recordUsage(input: UsageRecordInput): Promise<void> {
);
}
const timestamp = Math.floor(Date.now() / 1000);
usageRecordBuffer.push({
orgId: input.orgId,
providerId: input.providerId,
@@ -597,7 +599,7 @@ export async function recordUsage(input: UsageRecordInput): Promise<void> {
totalTokens,
costUsd: input.costUsd,
estimated: usage.estimated,
createdAt: input.createdAt ?? Date.now()
createdAt: input.createdAt ?? timestamp
});
// Flush immediately if buffer is full, otherwise schedule a flush
server/lib/domainUtils.ts
+1 -2
View File
@@ -52,8 +52,7 @@ export async function validateAndConstructDomain(
};
}
// Check if organization has access to domain
if (domainRes.orgDomains && domainRes.orgDomains.orgId !== orgId) {
if (!domainRes.orgDomains) {
return {
success: false,
error: `Organization does not have access to domain with ID ${domainId}`
server/private/routers/aiGateway/logAiSession.ts
+5 -6
View File
@@ -151,17 +151,14 @@ async function getRetentionDays(orgId: string): Promise<number> {
}
export async function cleanUpOldLogs(orgId: string, retentionDays: number) {
// calculateCutoffTimestamp returns a seconds-epoch cutoff (built for
// requestAuditLog.timestamp), but aiSessionLog.createdAt is ms-epoch to
// match aiUsageRecords - convert before comparing.
const cutoffTimestampMs = calculateCutoffTimestamp(retentionDays) * 1000;
const cutoffTimestamp = calculateCutoffTimestamp(retentionDays) * 1000;
try {
await logsDb
.delete(aiSessionLog)
.where(
and(
lt(aiSessionLog.createdAt, cutoffTimestampMs),
lt(aiSessionLog.createdAt, cutoffTimestamp),
eq(aiSessionLog.orgId, orgId)
)
);
@@ -243,6 +240,8 @@ export function logAiSession(data: {
);
}
const timestamp = Math.floor(Date.now() / 1000);
sessionLogBuffer.push({
sessionId: data.sessionId,
orgId: sanitizeString(data.orgId),
@@ -270,7 +269,7 @@ export function logAiSession(data: {
(normalizedRequestText?.truncated ?? false) ||
(normalizedResponseText?.truncated ?? false),
statusCode: data.statusCode,
createdAt: Date.now()
createdAt: timestamp
});
// Flush immediately if buffer is full, otherwise schedule a flush
server/routers/auditLogs/aiUsageAnalyticsShared.ts
+6 -6
View File
@@ -18,7 +18,7 @@ export const aiUsageAnalyticsFiltersQuery = z.object({
.refine((val) => !isNaN(Date.parse(val)), {
error: "timeStart must be a valid ISO date string"
})
.transform((val) => new Date(val).getTime())
.transform((val) => Math.floor(new Date(val).getTime() / 1000))
.prefault(() => getSevenDaysAgo().toISOString())
.openapi({
type: "string",
@@ -31,7 +31,7 @@ export const aiUsageAnalyticsFiltersQuery = z.object({
.refine((val) => !isNaN(Date.parse(val)), {
error: "timeEnd must be a valid ISO date string"
})
.transform((val) => new Date(val).getTime())
.transform((val) => Math.floor(new Date(val).getTime() / 1000))
.prefault(() => new Date().toISOString())
.openapi({
type: "string",
@@ -122,12 +122,12 @@ export function buildAiUsageWhere(
);
}
// Buckets createdAt (epoch ms) down to a per-day string, dialect-aware, same
// approach as the DATE_TRUNC/DATE branch in queryRequestAnalytics.ts.
// Buckets createdAt (epoch seconds) down to a per-day string, dialect-aware,
// same approach as the DATE_TRUNC/DATE branch in queryRequestAnalytics.ts.
export function dayBucketExpr() {
return driver === "pg"
? sql<string>`DATE_TRUNC('day', TO_TIMESTAMP(${aiUsageRecords.createdAt} / 1000.0))`
: sql<string>`DATE(${aiUsageRecords.createdAt} / 1000, 'unixepoch')`;
? sql<string>`DATE_TRUNC('day', TO_TIMESTAMP(${aiUsageRecords.createdAt}))`
: sql<string>`DATE(${aiUsageRecords.createdAt}, 'unixepoch')`;
}
export type DailyMetricRow<K extends string> = {
server/routers/auditLogs/queryAiSessionLog.ts
+2 -2
View File
@@ -32,7 +32,7 @@ export const queryAiSessionLogsQuery = z.strictObject({
.refine((val) => !isNaN(Date.parse(val)), {
error: "timeStart must be a valid ISO date string"
})
.transform((val) => new Date(val).getTime())
.transform((val) => Math.floor(new Date(val).getTime() / 1000))
.prefault(() => getSevenDaysAgo().toISOString())
.openapi({
type: "string",
@@ -45,7 +45,7 @@ export const queryAiSessionLogsQuery = z.strictObject({
.refine((val) => !isNaN(Date.parse(val)), {
error: "timeEnd must be a valid ISO date string"
})
.transform((val) => new Date(val).getTime())
.transform((val) => Math.floor(new Date(val).getTime() / 1000))
.optional()
.prefault(() => new Date().toISOString())
.openapi({
server/routers/auditLogs/queryAiUsageFilterOptions.ts
+2 -2
View File
@@ -30,14 +30,14 @@ const queryAiUsageFilterOptionsQuery = z.object({
.refine((val) => !isNaN(Date.parse(val)), {
error: "timeStart must be a valid ISO date string"
})
.transform((val) => new Date(val).getTime())
.transform((val) => Math.floor(new Date(val).getTime() / 1000))
.prefault(() => getSevenDaysAgo().toISOString()),
timeEnd: z
.string()
.refine((val) => !isNaN(Date.parse(val)), {
error: "timeEnd must be a valid ISO date string"
})
.transform((val) => new Date(val).getTime())
.transform((val) => Math.floor(new Date(val).getTime() / 1000))
.prefault(() => new Date().toISOString())
});
server/routers/external.ts
+15 -11
View File
@@ -66,6 +66,10 @@ import * as aiBudget from "@server/routers/aiBudget";
import * as virtualApiKey from "@server/routers/virtualApiKey";
import * as certificates from "@server/routers/certificates";
function rateLimitIdentityKey(value: unknown): string {
return typeof value === "string" ? value.trim().toLowerCase() : "";
}
// Root routes
export const unauthenticated = Router();
@@ -1927,7 +1931,7 @@ authRouter.put(
windowMs: 15 * 60 * 1000,
max: 15,
keyGenerator: (req) =>
`signup:${ipKeyGenerator(req.ip || "")}:${req.body.email}`,
`signup:${ipKeyGenerator(req.ip || "")}:${rateLimitIdentityKey(req.body.email)}`,
handler: (req, res, next) => {
const message = `You can only sign up ${15} times every ${15} minutes. Please try again later.`;
return next(createHttpError(HttpCode.TOO_MANY_REQUESTS, message));
@@ -1942,7 +1946,7 @@ authRouter.post(
windowMs: 15 * 60 * 1000,
max: 15,
keyGenerator: (req) =>
`login:${req.body.email || ipKeyGenerator(req.ip || "")}`,
`login:${rateLimitIdentityKey(req.body.email) || ipKeyGenerator(req.ip || "")}`,
handler: (req, res, next) => {
const message = `You can only log in ${15} times every ${15} minutes. Please try again later.`;
return next(createHttpError(HttpCode.TOO_MANY_REQUESTS, message));
@@ -1959,7 +1963,7 @@ authRouter.post(
windowMs: 15 * 60 * 1000,
max: 15,
keyGenerator: (req) =>
`lookupUser:${req.body.identifier || ipKeyGenerator(req.ip || "")}`,
`lookupUser:${rateLimitIdentityKey(req.body.identifier) || ipKeyGenerator(req.ip || "")}`,
handler: (req, res, next) => {
const message = `You can only lookup users ${15} times every ${15} minutes. Please try again later.`;
return next(createHttpError(HttpCode.TOO_MANY_REQUESTS, message));
@@ -2037,7 +2041,7 @@ authRouter.post(
windowMs: 15 * 60 * 1000,
max: 15,
keyGenerator: (req) => {
return `signup:${req.body.email || req.user?.userId || ipKeyGenerator(req.ip || "")}`;
return `signup:${rateLimitIdentityKey(req.body.email) || req.user?.userId || ipKeyGenerator(req.ip || "")}`;
},
handler: (req, res, next) => {
const message = `You can only enable 2FA ${15} times every ${15} minutes. Please try again later.`;
@@ -2053,7 +2057,7 @@ authRouter.post(
windowMs: 15 * 60 * 1000,
max: 15,
keyGenerator: (req) => {
return `signup:${req.body.email || req.user?.userId || ipKeyGenerator(req.ip || "")}`;
return `signup:${rateLimitIdentityKey(req.body.email) || req.user?.userId || ipKeyGenerator(req.ip || "")}`;
},
handler: (req, res, next) => {
const message = `You can only request a 2FA code ${15} times every ${15} minutes. Please try again later.`;
@@ -2085,7 +2089,7 @@ authRouter.post(
windowMs: 15 * 60 * 1000,
max: 15,
keyGenerator: (req) =>
`signup:${req.body.email || ipKeyGenerator(req.ip || "")}`,
`signup:${rateLimitIdentityKey(req.body.email) || ipKeyGenerator(req.ip || "")}`,
handler: (req, res, next) => {
const message = `You can only sign up ${15} times every ${15} minutes. Please try again later.`;
return next(createHttpError(HttpCode.TOO_MANY_REQUESTS, message));
@@ -2103,7 +2107,7 @@ authRouter.post(
windowMs: 15 * 60 * 1000,
max: 15,
keyGenerator: (req) =>
`requestEmailVerificationCode:${req.user?.email || ipKeyGenerator(req.ip || "")}`,
`requestEmailVerificationCode:${rateLimitIdentityKey(req.user?.email) || ipKeyGenerator(req.ip || "")}`,
handler: (req, res, next) => {
const message = `You can only request an email verification code ${15} times every ${15} minutes. Please try again later.`;
return next(createHttpError(HttpCode.TOO_MANY_REQUESTS, message));
@@ -2125,7 +2129,7 @@ authRouter.post(
windowMs: 15 * 60 * 1000,
max: 15,
keyGenerator: (req) =>
`requestPasswordReset:${req.body.email || ipKeyGenerator(req.ip || "")}`,
`requestPasswordReset:${rateLimitIdentityKey(req.body.email) || ipKeyGenerator(req.ip || "")}`,
handler: (req, res, next) => {
const message = `You can only request a password reset ${15} times every ${15} minutes. Please try again later.`;
return next(createHttpError(HttpCode.TOO_MANY_REQUESTS, message));
@@ -2141,7 +2145,7 @@ authRouter.post(
windowMs: 15 * 60 * 1000,
max: 15,
keyGenerator: (req) =>
`resetPassword:${req.body.email || ipKeyGenerator(req.ip || "")}`,
`resetPassword:${rateLimitIdentityKey(req.body.email) || ipKeyGenerator(req.ip || "")}`,
handler: (req, res, next) => {
const message = `You can only request a password reset ${15} times every ${15} minutes. Please try again later.`;
return next(createHttpError(HttpCode.TOO_MANY_REQUESTS, message));
@@ -2188,7 +2192,7 @@ authRouter.post(
windowMs: 15 * 60 * 1000,
max: 15,
keyGenerator: (req) =>
`authWithWhitelist:${ipKeyGenerator(req.ip || "")}:${req.body.email}:${req.params.resourceId}`,
`authWithWhitelist:${ipKeyGenerator(req.ip || "")}:${rateLimitIdentityKey(req.body.email)}:${req.params.resourceId}`,
handler: (req, res, next) => {
const message = `You can only request an email OTP ${15} times every ${15} minutes. Please try again later.`;
return next(createHttpError(HttpCode.TOO_MANY_REQUESTS, message));
@@ -2240,7 +2244,7 @@ authRouter.post(
windowMs: 15 * 60 * 1000, // 15 minutes
max: 10, // Allow 10 authentication attempts per 15 minutes per IP
keyGenerator: (req) => {
return `securityKeyAuth:${req.body.email || ipKeyGenerator(req.ip || "")}`;
return `securityKeyAuth:${rateLimitIdentityKey(req.body.email) || ipKeyGenerator(req.ip || "")}`;
},
handler: (req, res, next) => {
const message = `You can only attempt security key authentication ${10} times every ${15} minutes. Please try again later.`;
server/routers/org/getOrg.ts
+5 -3
View File
@@ -16,13 +16,12 @@ const getOrgSchema = z.strictObject({
});
export type GetOrgResponse = {
org: Org;
org: Omit<Org, "sshCaPrivateKey">;
};
const GetOrgResponseDataSchema = z.object({
org: z.object({}).passthrough()
});
registry.registerPath({
method: "get",
path: "/org/{orgId}",
@@ -76,9 +75,12 @@ export async function getOrg(
);
}
// sshCaPrivateKey is encrypted anyway but just to be safe
const { sshCaPrivateKey: _, ...orgWithoutPrivateKey } = org;
return response<GetOrgResponse>(res, {
data: {
org
org: orgWithoutPrivateKey
},
success: true,
error: false,
server/routers/siteResource/getSiteResource.ts
+10 -7
View File
@@ -18,7 +18,7 @@ const getSiteResourceParamsSchema = z.strictObject({
.pipe(z.int().positive().optional())
.optional(),
niceId: z.string().optional(),
orgId: z.string()
orgId: z.string().optional()
});
async function query(siteResourceId?: number, niceId?: string, orgId?: string) {
@@ -34,6 +34,13 @@ async function query(siteResourceId?: number, niceId?: string, orgId?: string) {
)
.limit(1);
return siteResource;
} else if (siteResourceId) {
const [siteResource] = await db
.select()
.from(siteResources)
.where(eq(siteResources.siteResourceId, siteResourceId))
.limit(1);
return siteResource;
} else if (niceId && orgId) {
const [siteResource] = await db
.select()
@@ -60,9 +67,7 @@ registry.registerPath({
tags: [OpenAPITags.PrivateResourceLegacy],
request: {
params: z.object({
siteResourceId: z.number(),
siteId: z.number(),
orgId: z.string()
siteResourceId: z.number()
})
},
responses: {
@@ -90,9 +95,7 @@ registry.registerPath({
tags: [OpenAPITags.PrivateResource],
request: {
params: z.object({
siteResourceId: z.number(),
siteId: z.number(),
orgId: z.string()
siteResourceId: z.number()
})
},
responses: {