101 lines
4.2 KiB
JavaScript
101 lines
4.2 KiB
JavaScript
#!/usr/bin/env node
|
|
/*
|
|
* sync-keys.js — seed every active member's chat key into LibreChat's
|
|
* per-user key store so members NEVER see an API-key prompt.
|
|
*
|
|
* keys[name="Inference Co-op"] <- {apiKey: <sk>} (chat endpoint)
|
|
* pluginauths[mcp:inference-image] <- IC_API_KEY (image MCP)
|
|
*
|
|
* Values are encrypted with the SAME crypto LibreChat uses (data-schemas
|
|
* encrypt(): AES-256-CBC, CREDS_KEY/CREDS_IV from the app process env), so
|
|
* LibreChat decrypts them natively.
|
|
*
|
|
* Run: cd /app/code/librechat/api && node /app/data/sync-keys.js
|
|
* (requires CLOUDRON_MONGODB_URL in the environment — present in `cloudron exec`)
|
|
* Idempotent: safe to run repeatedly (e.g. nightly steward cron or after
|
|
* onboarding).
|
|
*/
|
|
const fs = require("fs");
|
|
const os = require("os");
|
|
const path = require("path");
|
|
|
|
// --- env assembly: exec sessions lack the app's process env ---------------
|
|
function loadEnvFile(p) {
|
|
try {
|
|
for (const line of fs.readFileSync(p, "utf8").split("\n")) {
|
|
const m = line.match(/^([A-Za-z_][A-Za-z0-9_]*)=(.*)$/);
|
|
if (m && process.env[m[1]] === undefined) process.env[m[1]] = m[2].replace(/^["']|["']$/g, "");
|
|
}
|
|
} catch (e) { /* optional */ }
|
|
}
|
|
loadEnvFile("/app/data/env");
|
|
try { // CREDS_KEY / CREDS_IV / MONGODB live in the app process env
|
|
for (const line of fs.readFileSync("/proc/1/environ", "utf8").split("\0")) {
|
|
const m = line.match(/^([A-Z_][A-Z0-9_]*)=(.*)$/);
|
|
if (m && process.env[m[1]] === undefined) process.env[m[1]] = m[2];
|
|
}
|
|
} catch (e) { /* optional */ }
|
|
|
|
const MONGO_URL = process.env.CLOUDRON_MONGODB_URL || process.env.MONGODB_URL;
|
|
const PORTAL_URL = process.env.PORTAL_URL || "https://portal.inference.coop";
|
|
const SYNC_TOKEN = process.env.LIBRECHAT_SYNC_TOKEN || "";
|
|
const ENDPOINT_NAME = "Inference Co-op";
|
|
const MCP_PLUGIN_KEY = "mcp:inference-image";
|
|
const MCP_AUTH_FIELD = "IC_API_KEY";
|
|
|
|
if (!MONGO_URL) { console.error("FATAL: no MongoDB URL in environment"); process.exit(1); }
|
|
if (!SYNC_TOKEN) { console.error("FATAL: LIBRECHAT_SYNC_TOKEN not set"); process.exit(1); }
|
|
|
|
// data-schemas resolves CREDS_KEY/CREDS_IV at require time — env is ready above
|
|
const { encrypt } = require("/app/code/librechat/node_modules/@librechat/data-schemas");
|
|
const mongoose = require("/app/code/librechat/node_modules/mongoose");
|
|
|
|
(async () => {
|
|
// 1. Fetch active members' chat keys from the portal (dedicated sync token)
|
|
const res = await fetch(`${PORTAL_URL}/admin/librechat/keys`, {
|
|
headers: { "X-Sync-Token": SYNC_TOKEN },
|
|
});
|
|
if (!res.ok) {
|
|
console.error(`FATAL: portal key feed returned ${res.status}`);
|
|
process.exit(1);
|
|
}
|
|
const { members } = await res.json();
|
|
console.log(`portal feed: ${members.length} active member key(s)`);
|
|
|
|
await mongoose.connect(MONGO_URL);
|
|
const db = mongoose.connection.db;
|
|
const users = db.collection("users");
|
|
const keys = db.collection("keys");
|
|
const auths = db.collection("pluginauths");
|
|
|
|
let seeded = 0, skipped = 0;
|
|
for (const m of members) {
|
|
const email = String(m.email || "").toLowerCase();
|
|
const sk = String(m.key || "");
|
|
if (!email || !sk) continue;
|
|
const user = await users.findOne({
|
|
email: { $regex: new RegExp(`^${email.replace(/[.*+?^${}()|[\]\\]/g, "\\$&")}$`, "i") },
|
|
});
|
|
if (!user) { skipped++; continue; } // not logged in to the sandbox yet
|
|
const uid = user._id;
|
|
// chat endpoint key: value is a JSON object string, same shape the UI saves
|
|
const encChat = await encrypt(JSON.stringify({ apiKey: sk }));
|
|
await keys.updateOne(
|
|
{ userId: uid, name: ENDPOINT_NAME },
|
|
{ $set: { userId: uid, name: ENDPOINT_NAME, value: encChat } },
|
|
{ upsert: true }
|
|
);
|
|
// image MCP credential
|
|
const encImage = await encrypt(sk);
|
|
await auths.updateOne(
|
|
{ userId: uid, pluginKey: MCP_PLUGIN_KEY, authField: MCP_AUTH_FIELD },
|
|
{ $set: { userId: uid, pluginKey: MCP_PLUGIN_KEY, authField: MCP_AUTH_FIELD, value: encImage } },
|
|
{ upsert: true }
|
|
);
|
|
seeded++;
|
|
console.log(`seeded ${email} (user ${String(uid).slice(-6)})`);
|
|
}
|
|
console.log(`done: ${seeded} seeded, ${skipped} skipped (no sandbox account yet)`);
|
|
await mongoose.disconnect();
|
|
})().catch((e) => { console.error("FATAL:", e); process.exit(1); });
|