Your sign-in code for ' + (appName || 'PedAI') + ' is:
' + - '' + code + '
' + - 'It expires in ' + TTL_MINUTES + ' minutes and can be used once.
' + - 'If you did not ask to sign in, ignore this message ' + - 'and nothing will happen.
'; +// The address is the one thing here that did not come from us, and it is +// written into HTML, so it is escaped. The code cannot carry markup — it is six +// digits from a generator — but escaping only the interesting half is how the +// other half becomes interesting later. +function escapeHtml(value) { + return String(value == null ? '' : value) + .replace(/&/g, '&').replace(//g, '>') + .replace(/"/g, '"').replace(/'/g, '''); +} + +/** + * The body of the sign-in code email. + * + * Written for someone holding a phone in one hand: the code is the only thing + * on the screen that is large, it sits in a box of its own so it is obvious + * what to copy, and it is monospaced so a 0 cannot be mistaken for an O while + * being retyped. Everything else is quiet. + * + * It names the address the code signs into. A code that arrives at a shared + * mailbox, or to someone with two accounts, is otherwise a number with no + * indication of what it opens — and it is the one detail that lets a person + * notice a sign-in they did not start. + * + * Goes inside emailWrapper with the other mail, which supplies the wordmark, + * the rules and the footer — including the line about ignoring it, which is why + * there is not a second one here. + */ +function emailBody(code, appName, email) { + var name = escapeHtml(appName || 'PedAI'); + return '' + + 'Sign in to ' + name + '
' + + (email + ? '' + + 'Enter this code to sign in as ' + escapeHtml(email) + '.
' + : 'Enter this code to sign in.
') + + + // A table, not a div: Outlook ignores padding and border-radius on a div, + // and this box is the whole point of the message. + '| ' + + '' + escapeHtml(code) + '' + + ' |
' + + 'It expires in ' + TTL_MINUTES + ' minutes and can be used once.
'; } module.exports = { issue, consume, sweep, generate, normalise, emailBody, diff --git a/src/utils/webSearch.js b/src/utils/webSearch.js index 233cfb5a..cd7b4311 100644 --- a/src/utils/webSearch.js +++ b/src/utils/webSearch.js @@ -22,11 +22,26 @@ var PROVIDERS = ['tavily', 'serper', 'brave', 'exa', 'searxng']; var MAX_RESULTS = 8; var TIMEOUT_MS = 15000; +// One key per provider. There used to be a single websearch.api_key shared by +// all of them, so trying a different provider meant pasting a new key over the +// working one and pasting the old one back to return — and the two are not +// interchangeable, so a wrong pairing fails as an authentication error that +// looks like a dead provider. +// +// The shared key is still read as a fallback: it is whatever was configured +// before this, and for the provider that was selected at the time it is the +// right key. The first save under a provider writes its own. +function keySetting(provider) { + return 'websearch.api_key.' + provider; +} + async function settings() { + var provider = String(await db.getSetting('websearch.provider', 'tavily') || 'tavily'); + var own = String(await db.getSetting(keySetting(provider), '') || ''); return { enabled: String(await db.getSetting('websearch.enabled', 'false')) === 'true', - provider: String(await db.getSetting('websearch.provider', 'tavily') || 'tavily'), - apiKey: String(await db.getSetting('websearch.api_key', '') || ''), + provider: provider, + apiKey: own || String(await db.getSetting('websearch.api_key', '') || ''), // SearXNG has no key; it needs somewhere to reach instead. baseUrl: String(await db.getSetting('websearch.base_url', '') || '') }; @@ -177,4 +192,4 @@ function formatForPrompt(results) { }).join('\n\n'); } -module.exports = { search, isAvailable, settings, formatForPrompt, PROVIDERS, MAX_RESULTS }; +module.exports = { search, isAvailable, settings, formatForPrompt, keySetting, PROVIDERS, MAX_RESULTS }; diff --git a/test/web-search.test.js b/test/web-search.test.js index 2578426f..31d73582 100644 --- a/test/web-search.test.js +++ b/test/web-search.test.js @@ -168,8 +168,10 @@ test('the key is masked on read and preserved when left blank', () => { // Both keys, one rule: never send a key back, enough tail to recognise it. assert.match(admin, /\['websearch\.api_key', 'pubmed\.api_key'\]\.forEach/); assert.match(admin, /if \(out\[k\]\) out\[k\] = '••••••••' \+ out\[k\]\.slice\(-4\);/); - // Changing the provider must not silently wipe a working key. - assert.match(admin, /if \(key && key\.indexOf\('•'\) === -1\) await db\.setSetting\('websearch\.api_key'/); + // Changing the provider must not silently wipe a working key — now literally: + // each provider has its own slot, so switching does not overwrite anything. + assert.match(admin, /if \(key && key\.indexOf\('•'\) === -1\) \{/); + assert.match(admin, /db\.setSetting\(webSearchLib\.keySetting\(provider\), key\.slice\(0, 400\)\)/); assert.match(admin, /if \(pmKey && pmKey\.indexOf\('•'\) === -1\) await db\.setSetting\('pubmed\.api_key'/); assert.match(admin, /if \(providers\.indexOf\(provider\) === -1\)/, 'and the provider is validated'); }); @@ -246,3 +248,45 @@ test('the admin can choose it, and the server accepts what the admin can choose' assert.ok(lib.PROVIDERS.includes(provider), provider + ' is offered in the admin but rejected by the server'); } }); + +// ---- one key per provider -------------------------------------------------- +// There used to be a single websearch.api_key shared by all of them, so trying +// a different provider meant pasting a new key over the working one and pasting +// the old one back to return. The keys are not interchangeable, so a wrong +// pairing fails as an authentication error that looks like a dead provider. + +test('each provider keeps its own key', () => { + const lib = load({}, async () => ({ ok: true, json: async () => ({}) })); + assert.equal(lib.keySetting('exa'), 'websearch.api_key.exa'); + assert.equal(lib.keySetting('tavily'), 'websearch.api_key.tavily'); + assert.notEqual(lib.keySetting('exa'), lib.keySetting('tavily')); +}); + +test('the selected provider gets its own key, not another provider\'s', async () => { + let seen = null; + const lib = load({ + 'websearch.enabled': 'true', 'websearch.provider': 'exa', + 'websearch.api_key.exa': 'exa-key', 'websearch.api_key.tavily': 'tavily-key' + }, async (url, options) => { seen = options; return { ok: true, status: 200, json: async () => ({ results: [] }) }; }); + await lib.search('x'); + assert.equal(seen.headers['x-api-key'], 'exa-key'); + assert.equal((await lib.settings()).apiKey, 'exa-key'); +}); + +test('a key saved before per-provider slots still works', async () => { + // Whatever was configured before this change is the right key for whichever + // provider was selected at the time, so the old shared slot is the fallback. + const lib = load({ + 'websearch.enabled': 'true', 'websearch.provider': 'tavily', 'websearch.api_key': 'legacy' + }, async () => ({ ok: true, status: 200, json: async () => ({ results: [] }) })); + assert.equal((await lib.settings()).apiKey, 'legacy'); + assert.equal(await lib.isAvailable(), true); +}); + +test('a provider-specific key wins over the shared one', async () => { + const lib = load({ + 'websearch.enabled': 'true', 'websearch.provider': 'exa', + 'websearch.api_key': 'legacy', 'websearch.api_key.exa': 'the-exa-one' + }, async () => ({ ok: true, status: 200, json: async () => ({ results: [] }) })); + assert.equal((await lib.settings()).apiKey, 'the-exa-one'); +});