feat(t131): AI 設定合併成一把金鑰——聊天與萃取共用，Claude 為選填加強

leo：「拿到一把就很難了，還要拿兩把。一律規定先輸入 gemini api key，如果想要強化本地萃取，可以選擇 claude……前面那個，聊天和萃都一次設好，後面那把，不填就是 gemini」＋「重點是更好的模型萃取知識更能抓重點，不然他也不知道加強什麼」（文案講感覺得到的差別）＋「本地如果有裝 claude，掃到，只要一個 checkbox 就好」（daemon 偵測回報，沒偵測到就停用選項）。 - POST/GET /portal/admin/ai（一次寫 chat-key 與 extractor）＋/portal/daemon/report-capabilities - 舊 chat-key/extractor 端點保留相容；UI 兩區合併成「AI 設定」 t131 新測 7 條全綠（總體 229 passed／9 紅皆 pre-existing：HTML shell 搬遷×2、library-map 未實作×6、 executor 零件×1）。（實作＝子 CC；驗證+commit＝總管）
2026-07-29 15:28:10 +08:00
parent 0860e84d22
commit 9d38d580f2
4 changed files with 412 additions and 127 deletions
@@ -838,10 +838,149 @@ portalRouter.post('/portal/daemon/config', (c) =>
  }),
 );

-// POST /portal/admin/chat-key — body {key}。站內啟用 AI 問答（t53，leo 07-25：
-// 「他進到網站要去給 gemini API Key」——不再回安裝器）。手法＝G10 直嵌同款：
-// 改寫 tenant 的 rag_chat workflow 記錄，把 x-goog-api-key 換成實值（KV 覆寫＝重推）。
-// 金鑰只過境不落 log；admin 閘（與庫登記同級）。
+// ── t131 合併 AI 設定（Gemini API Key 同時設 chat＋extractor；has_claude 由 daemon 回報）─────
+// KV key = {tenant}:portal:ai_config，存在 WEBHOOKS KV。
+// KV key = {tenant}:portal:daemon_caps，存 daemon 回報的能力（TTL 7 天）。
+
+interface AiConfig {
+  gemini_api_key?: string;
+  use_claude_for_extract?: boolean;
+}
+interface DaemonCapabilities {
+  has_claude: boolean;
+  daemon_version?: string;
+  os?: string;
+}
+
+function aiConfigKey(env: Bindings): string { return `${portalTenant(env)}:portal:ai_config`; }
+function daemonCapsKey(env: Bindings): string { return `${portalTenant(env)}:portal:daemon_caps`; }
+
+async function getAiConfig(env: Bindings): Promise<AiConfig | null> {
+  const raw = await env.WEBHOOKS.get(aiConfigKey(env), 'text');
+  if (!raw) return null;
+  try { return JSON.parse(raw) as AiConfig; } catch { return null; }
+}
+async function getDaemonCaps(env: Bindings): Promise<DaemonCapabilities | null> {
+  const raw = await env.WEBHOOKS.get(daemonCapsKey(env), 'text');
+  if (!raw) return null;
+  try { return JSON.parse(raw) as DaemonCapabilities; } catch { return null; }
+}
+
+// 將 ai_config 同步回 extractor_config（daemon/config 讀 extractor_config，保持相容）。
+async function syncExtractorFromAiConfig(env: Bindings, cfg: AiConfig): Promise<void> {
+  const exCfg: ExtractorConfig = {
+    engine: cfg.use_claude_for_extract ? 'claude' : 'gemma',
+  };
+  if (!cfg.use_claude_for_extract && cfg.gemini_api_key) {
+    exCfg.gemini_api_key = cfg.gemini_api_key;
+  }
+  await env.WEBHOOKS.put(extractorConfigKey(env), JSON.stringify(exCfg));
+}
+
+// POST /portal/admin/ai — body {gemini_api_key?, use_claude_for_extract?}（t131）。
+// 同時設定 AI 問答金鑰（chat）與萃取引擎（extractor）。admin 閘。
+portalRouter.post('/portal/admin/ai', (c) =>
+  run(c, async () => {
+    const auth = await requirePortalAdmin(c);
+    if (!auth.ok) return auth.res;
+    const body = (await c.req.json().catch(() => null)) as { gemini_api_key?: string; use_claude_for_extract?: boolean } | null;
+    const newKey = String(body?.gemini_api_key ?? '').trim();
+    const useClause = typeof body?.use_claude_for_extract === 'boolean' ? body.use_claude_for_extract : undefined;
+
+    // 讀現有設定做合併（留空欄位＝不變更）
+    const existing = await getAiConfig(c.env) ?? {};
+    const merged: AiConfig = {
+      gemini_api_key: newKey || existing.gemini_api_key,
+      use_claude_for_extract: useClause !== undefined ? useClause : (existing.use_claude_for_extract ?? false),
+    };
+    if (!merged.gemini_api_key) return c.json({ error: '請貼上你的 Gemini API Key' }, 400);
+
+    // 更新 chat（rag_chat workflow）——容忍 404（workflow 未安裝時暫存，安裝後再寫入）
+    if (newKey) {
+      const tenant = portalTenant(c.env);
+      const kvKey = `${tenant}:wf:rag_chat`;
+      const raw = await c.env.WEBHOOKS.get(kvKey, 'text');
+      if (raw) {
+        try {
+          const record = JSON.parse(raw) as Record<string, unknown>;
+          const visit = (o: unknown): void => {
+            if (Array.isArray(o)) { o.forEach(visit); return; }
+            if (o && typeof o === 'object') {
+              const rec = o as Record<string, unknown>;
+              for (const k of Object.keys(rec)) {
+                if (k.toLowerCase() === 'x-goog-api-key') { rec[k] = newKey; }
+                else visit(rec[k]);
+              }
+            }
+          };
+          visit(record['graph']);
+          visit(record['config']);
+          await c.env.WEBHOOKS.put(kvKey, JSON.stringify(record));
+        } catch { /* 工作流記錄損壞時靜默略過，金鑰仍存 ai_config */ }
+      }
+      // 若 rag_chat 不存在（raw===null），跳過，等 acr init 安裝後再用舊 chat-key 端點補入
+    }
+
+    // 存合併設定
+    await c.env.WEBHOOKS.put(aiConfigKey(c.env), JSON.stringify(merged));
+    // 同步回 extractor_config（daemon/config 走這個）
+    await syncExtractorFromAiConfig(c.env, merged);
+
+    return c.json({
+      success: true,
+      has_key: true,
+      use_claude_for_extract: merged.use_claude_for_extract ?? false,
+    });
+  }),
+);
+
+// GET /portal/admin/ai — 回 has_key/use_claude_for_extract/claude_available（t131）。
+portalRouter.get('/portal/admin/ai', (c) =>
+  run(c, async () => {
+    const auth = await requirePortalAdmin(c);
+    if (!auth.ok) return auth.res;
+    const cfg = await getAiConfig(c.env);
+    const caps = await getDaemonCaps(c.env);
+    return c.json({
+      success: true,
+      has_key: !!(cfg?.gemini_api_key),
+      use_claude_for_extract: cfg?.use_claude_for_extract ?? false,
+      claude_available: caps?.has_claude ?? false,
+    });
+  }),
+);
+
+// POST /portal/daemon/report-capabilities — body {email, password, has_claude, daemon_version?, os?}（t131）。
+// daemon 連線成功後回報本機能力；認證同 /portal/daemon/config（帳密）。
+// ⚠️ daemon 端改動屬 arcrun-rag repo，本端只做「收端點＋存 KV＋供 GET /portal/admin/ai 用」。
+portalRouter.post('/portal/daemon/report-capabilities', (c) =>
+  run(c, async () => {
+    const body = (await c.req.json().catch(() => null)) as { email?: string; password?: string; has_claude?: boolean; daemon_version?: string; os?: string } | null;
+    const email = String(body?.email ?? '').trim().toLowerCase();
+    const password = String(body?.password ?? '');
+    if (!email || !password) return c.json({ error: 'email 與 password 必填' }, 400);
+    if (await isLocked(c.env, email)) return c.json({ error: '登入失敗次數過多', }, 429);
+    const recordId = await findUserRecordId(c.env, email);
+    const rec = recordId ? await getRecordById(c.env, recordId) : null;
+    if (!rec) { await recordLoginFail(c.env, email); return c.json({ error: 'email 或密碼錯誤' }, 401); }
+    if ((rec.values.status ?? '') !== 'active') return c.json({ error: '帳號已停用' }, 403);
+    if (!(await verifyPassword(password, rec.values.password_hash ?? ''))) {
+      await recordLoginFail(c.env, email); return c.json({ error: 'email 或密碼錯誤' }, 401);
+    }
+    await clearLoginFail(c.env, email);
+    const caps: DaemonCapabilities = {
+      has_claude: body?.has_claude === true,
+      ...(body?.daemon_version ? { daemon_version: String(body.daemon_version) } : {}),
+      ...(body?.os ? { os: String(body.os) } : {}),
+    };
+    const TTL_7D = 7 * 24 * 60 * 60;
+    await c.env.WEBHOOKS.put(daemonCapsKey(c.env), JSON.stringify(caps), { expirationTtl: TTL_7D });
+    return c.json({ success: true });
+  }),
+);
+
+// POST /portal/admin/chat-key — body {key}。保留舊端點相容（新 UI 走 /portal/admin/ai）。
+// 舊版 setup checklist / 舊 UI 仍走這裡；只更新 rag_chat workflow，不同步 ai_config。
 portalRouter.post('/portal/admin/chat-key', (c) =>
  run(c, async () => {
    const auth = await requirePortalAdmin(c);
@@ -881,6 +1020,7 @@ portalRouter.post('/portal/admin/chat-key', (c) =>
 );

 // POST /portal/admin/extractor — body {engine, gemini_api_key?, llm_model?}（t122）。
+// 保留舊端點相容（新 UI 走 /portal/admin/ai）。
 // admin 閘（同 chat-key 等級）。金鑰不落 log；存 WEBHOOKS KV。
 portalRouter.post('/portal/admin/extractor', (c) =>
  run(c, async () => {
@@ -904,6 +1044,7 @@ portalRouter.post('/portal/admin/extractor', (c) =>
 );

 // GET /portal/admin/extractor — 回 engine + has_key（不回金鑰明文）（t122）。
+// 保留舊端點相容（新 UI 走 /portal/admin/ai）。
 portalRouter.get('/portal/admin/extractor', (c) =>
  run(c, async () => {
    const auth = await requirePortalAdmin(c);
@@ -556,5 +556,165 @@ describe('GET /portal（P4 admin 頁 HTML 殼）', () => {
    // t114：無「登記到目錄」按鈕
    expect(html).not.toContain('lib-adopt');
    expect(html).not.toContain('登記到目錄');
+    // t131：合併 AI 設定（舊兩區塊已移除）
+    expect(html).toContain('st-ai-panel');
+    expect(html).toContain('st-ai-key');
+    expect(html).toContain('st-ai-use-claude');
+    expect(html).not.toContain('st-extractor-panel');
+    expect(html).not.toContain('st-key-save'); // 舊 chat-key 存檔鈕已移除
+  });
+});
+
+// ═══════════════ 8. t131 合併 AI 設定 ═══════════════
+
+describe('/portal/admin/ai + /portal/daemon/report-capabilities（t131）', () => {
+  const USER_EMAIL = 'ai-test@example.com';
+  const USER_PW = 'unit-test-pw-1';
+  const USER_RECORD = 'rec_ai_user';
+  const AI_CONFIG_KEY = 'leo:portal:ai_config';
+  const EXTRACTOR_KV_KEY = 'leo:portal:extractor_config';
+  const DAEMON_CAPS_KEY = 'leo:portal:daemon_caps';
+
+  function aiAdminVals(): Record<string, string> {
+    return { email: USER_EMAIL, display_name: 'AI 測試 admin', status: 'active', role: 'admin', password_hash: storedHash };
+  }
+
+  // 與全域 seedAdminSession 相同格式（JSON.stringify({record_id})），fetchMock 由各測試自行 mock
+  async function seedAiSession(token = 'tok-ai-admin', recordId = USER_RECORD) {
+    await env.SESSIONS_KV.put(`portal_sess:${token}`, JSON.stringify({ record_id: recordId }));
+  }
+
+  function mockAiRecord(recordId = USER_RECORD) {
+    fetchMock.get(KBDB).intercept({ path: `/records/${recordId}`, method: 'GET' }).reply(200, {
+      success: true,
+      record: { record_id: recordId, template_id: 'tpl_pu', values: aiAdminVals() },
+    });
+  }
+
+  function mockEmailLookup(email: string, recordId: string | null) {
+    const needle = new URLSearchParams({ page_name: email }).toString();
+    fetchMock.get(KBDB).intercept({
+      path: (p: string) => p.startsWith('/entries?') && p.includes(needle) && p.includes(encodeURIComponent(NS)),
+      method: 'GET',
+    }).reply(200, { success: true, entries: recordId ? [{ content: recordId }] : [], count: recordId ? 1 : 0 });
+  }
+
+  afterEach(async () => {
+    await env.WEBHOOKS.delete(AI_CONFIG_KEY);
+    await env.WEBHOOKS.delete(EXTRACTOR_KV_KEY);
+    await env.WEBHOOKS.delete(DAEMON_CAPS_KEY);
+  });
+
+  it('POST /ai — 首次設定：同時寫 ai_config＋extractor_config＋更新 rag_chat workflow', async () => {
+    const ragChatKey = 'leo:wf:rag_chat';
+    const workflow = { graph: { nodes: [{ config: { 'x-goog-api-key': '{{credential.gemini}}' } }] }, config: {} };
+    await env.WEBHOOKS.put(ragChatKey, JSON.stringify(workflow));
+    await seedAiSession();
+    mockAiRecord();
+    const res = await json('POST', '/portal/admin/ai',
+      { gemini_api_key: 'AIza-new-key-123', use_claude_for_extract: false },
+      { Authorization: 'Bearer tok-ai-admin' }
+    );
+    expect(res.status).toBe(200);
+    const data = (await res.json()) as { success: boolean; has_key: boolean; use_claude_for_extract: boolean };
+    expect(data.success).toBe(true);
+    expect(data.has_key).toBe(true);
+    expect(data.use_claude_for_extract).toBe(false);
+
+    const stored = JSON.parse((await env.WEBHOOKS.get(AI_CONFIG_KEY, 'text')) ?? '{}');
+    expect(stored.gemini_api_key).toBe('AIza-new-key-123');
+    expect(stored.use_claude_for_extract).toBe(false);
+
+    const exCfg = JSON.parse((await env.WEBHOOKS.get(EXTRACTOR_KV_KEY, 'text')) ?? '{}');
+    expect(exCfg.engine).toBe('gemma');
+    expect(exCfg.gemini_api_key).toBe('AIza-new-key-123');
+
+    const updated = JSON.parse((await env.WEBHOOKS.get(ragChatKey, 'text')) ?? '{}') as typeof workflow;
+    expect((updated.graph as { nodes: Array<{ config: Record<string, string> }> }).nodes[0].config['x-goog-api-key']).toBe('AIza-new-key-123');
+    await env.WEBHOOKS.delete(ragChatKey);
+  });
+
+  it('POST /ai — rag_chat 不存在時不報錯（容忍，金鑰存 ai_config 即可）', async () => {
+    await seedAiSession();
+    mockAiRecord();
+    const res = await json('POST', '/portal/admin/ai',
+      { gemini_api_key: 'AIza-no-workflow-key' },
+      { Authorization: 'Bearer tok-ai-admin' }
+    );
+    expect(res.status).toBe(200);
+    const data = (await res.json()) as { success: boolean; has_key: boolean };
+    expect(data.success).toBe(true);
+    expect(data.has_key).toBe(true);
+    const stored = JSON.parse((await env.WEBHOOKS.get(AI_CONFIG_KEY, 'text')) ?? '{}');
+    expect(stored.gemini_api_key).toBe('AIza-no-workflow-key');
+  });
+
+  it('POST /ai — use_claude_for_extract=true：extractor engine=claude，不附 gemini_api_key', async () => {
+    await seedAiSession();
+    mockAiRecord();
+    const res = await json('POST', '/portal/admin/ai',
+      { gemini_api_key: 'AIza-key-888', use_claude_for_extract: true },
+      { Authorization: 'Bearer tok-ai-admin' }
+    );
+    expect(res.status).toBe(200);
+    const data = (await res.json()) as { success: boolean; use_claude_for_extract: boolean };
+    expect(data.use_claude_for_extract).toBe(true);
+    const exCfg = JSON.parse((await env.WEBHOOKS.get(EXTRACTOR_KV_KEY, 'text')) ?? '{}');
+    expect(exCfg.engine).toBe('claude');
+    expect('gemini_api_key' in exCfg).toBe(false);
+  });
+
+  it('GET /ai — 不回明文金鑰；has_key=true；claude_available 依 daemon_caps', async () => {
+    await env.WEBHOOKS.put(AI_CONFIG_KEY, JSON.stringify({ gemini_api_key: 'AIza-secret-456', use_claude_for_extract: false }));
+    await env.WEBHOOKS.put(DAEMON_CAPS_KEY, JSON.stringify({ has_claude: true }));
+    await seedAiSession();
+    mockAiRecord();
+    const res = await json('GET', '/portal/admin/ai', undefined, { Authorization: 'Bearer tok-ai-admin' });
+    expect(res.status).toBe(200);
+    const data = (await res.json()) as { success: boolean; has_key: boolean; use_claude_for_extract: boolean; claude_available: boolean };
+    expect(data.has_key).toBe(true);
+    expect(data.use_claude_for_extract).toBe(false);
+    expect(data.claude_available).toBe(true);
+    const raw = JSON.stringify(data);
+    expect(raw).not.toContain('AIza-secret-456');
+    expect(raw).not.toContain('gemini_api_key');
+  });
+
+  it('GET /ai — 沒有 daemon_caps → claude_available=false', async () => {
+    await env.WEBHOOKS.put(AI_CONFIG_KEY, JSON.stringify({ gemini_api_key: 'AIza-key-777' }));
+    await seedAiSession();
+    mockAiRecord();
+    const res = await json('GET', '/portal/admin/ai', undefined, { Authorization: 'Bearer tok-ai-admin' });
+    expect(res.status).toBe(200);
+    const data = (await res.json()) as { claude_available: boolean };
+    expect(data.claude_available).toBe(false);
+  });
+
+  it('POST /portal/daemon/report-capabilities — 有 claude：daemon_caps 寫入 has_claude=true', async () => {
+    mockEmailLookup(USER_EMAIL, USER_RECORD);
+    mockAiRecord();
+    const res = await json('POST', '/portal/daemon/report-capabilities', {
+      email: USER_EMAIL, password: USER_PW, has_claude: true, daemon_version: '1.2.0', os: 'darwin',
+    });
+    expect(res.status).toBe(200);
+    const data = (await res.json()) as { success: boolean };
+    expect(data.success).toBe(true);
+    const caps = JSON.parse((await env.WEBHOOKS.get(DAEMON_CAPS_KEY, 'text')) ?? '{}');
+    expect(caps.has_claude).toBe(true);
+    expect(caps.daemon_version).toBe('1.2.0');
+  });
+
+  it('舊端點 /portal/admin/chat-key 仍可用（相容）', async () => {
+    const ragChatKey = 'leo:wf:rag_chat';
+    const workflow = { graph: { nodes: [{ config: { 'x-goog-api-key': 'old' } }] }, config: {} };
+    await env.WEBHOOKS.put(ragChatKey, JSON.stringify(workflow));
+    await seedAiSession();
+    mockAiRecord();
+    const res = await json('POST', '/portal/admin/chat-key', { key: 'AIza-compat-key' }, { Authorization: 'Bearer tok-ai-admin' });
+    expect(res.status).toBe(200);
+    const data = (await res.json()) as { success: boolean; replaced: number };
+    expect(data.success).toBe(true);
+    expect(data.replaced).toBeGreaterThan(0);
+    await env.WEBHOOKS.delete(ragChatKey);
  });
 });