fix: auth bypass, SPA serving, and provider improvements (#97)

* feat(chat): polish syntax highlighting and tool payload rendering (#94)

* [verified] feat(chat): polish syntax highlighting and tool payload rendering

* [verified] fix(chat): tighten large tool payload rendering

* docs: update data volume path in Docker docs

Align documentation with docker-compose.yml change:
hermes-web-ui-data -> hermes-web-ui, /app/dist/data -> /root/.hermes-web-ui

Co-Authored-By: Claude Opus 4.6 <noreply@anthropic.com>

* refactor: bundle server build and restructure service modules

- Add build-server.mjs script for standalone server compilation
- Add logger service with structured output
- Restructure auth, gateway-manager, hermes-cli, hermes services
- Update docker-compose volume mount path
- Update tsconfig and entry point for bundled server

Co-Authored-By: Claude Opus 4.6 <noreply@anthropic.com>

* refactor: separate controllers from routes and centralize route registration

- Extract business logic from route handlers into controllers/
- Add centralized route registry in routes/index.ts with public/auth/protected layers
- Replace global auth whitelist with sequential middleware registration
- Extract shared helpers to services/config-helpers.ts
- Allow custom provider name to be user-editable in ProviderFormModal
- Deduplicate custom providers by poolKey instead of base_url in getAvailable

Co-Authored-By: Claude Opus 4.6 <noreply@anthropic.com>

* fix: auth bypass via path case, SPA serving, and provider improvements

- Fix auth bypass: path case-insensitive check for /api, /v1, /upload
- Fix SPA returning 401: skip auth for non-API paths (static files)
- Fix profile switch: use local loading state instead of shared store ref
- Auto-append /v1 to base_url when fetching models (frontend + backend)
- Guard .env writing to built-in providers only
- Add builtin field to provider presets, enable base_url input in form
- Print auth token to console on startup (pino only writes to file)

Co-Authored-By: Claude Opus 4.6 <noreply@anthropic.com>

---------

Co-authored-by: Zhicheng Han <43314240+hanzckernel@users.noreply.github.com>
Co-authored-by: Claude Opus 4.6 <noreply@anthropic.com>
This commit is contained in:
ekko
2026-04-21 12:35:48 +08:00
committed by GitHub
parent 21296a416b
commit 477af66232
65 changed files with 2743 additions and 2621 deletions
@@ -2,7 +2,7 @@
import { computed } from 'vue'
import { useI18n } from 'vue-i18n'
import MarkdownIt from 'markdown-it'
import hljs from 'highlight.js'
import { handleCodeBlockCopyClick, renderHighlightedCodeBlock } from './highlight'
const props = defineProps<{ content: string }>()
const { t } = useI18n()
@@ -12,22 +12,19 @@ const md: MarkdownIt = new MarkdownIt({
linkify: true,
typographer: true,
highlight(str: string, lang: string): string {
if (lang && hljs.getLanguage(lang)) {
try {
return `<pre class="hljs-code-block"><div class="code-header"><span class="code-lang">${lang}</span><button class="copy-btn" onclick="navigator.clipboard.writeText(this.closest('.hljs-code-block').querySelector('code').textContent)">${t('common.copy')}</button></div><code class="hljs language-${lang}">${hljs.highlight(str, { language: lang, ignoreIllegals: true }).value}</code></pre>`
} catch {
// fall through
}
}
return `<pre class="hljs-code-block"><div class="code-header"><button class="copy-btn" onclick="navigator.clipboard.writeText(this.closest('.hljs-code-block').querySelector('code').textContent)">${t('common.copy')}</button></div><code class="hljs">${md.utils.escapeHtml(str)}</code></pre>`
return renderHighlightedCodeBlock(str, lang, t('common.copy'))
},
})
const renderedHtml = computed(() => md.render(props.content))
function handleMarkdownClick(event: MouseEvent): void {
void handleCodeBlockCopyClick(event)
}
</script>
<template>
<div class="markdown-body" v-html="renderedHtml"></div>
<div class="markdown-body" v-html="renderedHtml" @click="handleMarkdownClick"></div>
</template>
<style lang="scss">
@@ -121,88 +118,4 @@ const renderedHtml = computed(() => md.render(props.content))
margin: 12px 0;
}
}
.hljs-code-block {
margin: 8px 0;
border-radius: $radius-sm;
overflow: hidden;
background: $code-bg;
border: 1px solid $border-color;
.code-header {
display: flex;
justify-content: space-between;
align-items: center;
padding: 6px 12px;
background: rgba(0, 0, 0, 0.03);
border-bottom: 1px solid $border-color;
.code-lang {
font-size: 11px;
color: $text-muted;
text-transform: uppercase;
}
.copy-btn {
font-size: 11px;
color: $text-muted;
background: none;
border: none;
cursor: pointer;
padding: 2px 6px;
border-radius: 3px;
transition: all $transition-fast;
&:hover {
color: $text-primary;
background: rgba(0, 0, 0, 0.05);
}
}
}
code.hljs {
display: block;
padding: 12px;
font-family: $font-code;
font-size: 13px;
line-height: 1.5;
overflow-x: auto;
}
}
// highlight.js theme override — pure ink B&W
.hljs {
color: #2a2a2a;
background: none;
}
.hljs-keyword,
.hljs-selector-tag { color: #1a1a1a; font-weight: 600; }
.hljs-string,
.hljs-attr { color: #555555; }
.hljs-number { color: #333333; }
.hljs-comment { color: #999999; font-style: italic; }
.hljs-built_in { color: #444444; }
.hljs-type { color: #3a3a3a; }
.hljs-variable { color: #1a1a1a; }
.hljs-title,
.hljs-title\.function_ { color: #1a1a1a; }
.hljs-params { color: #2a2a2a; }
.hljs-meta { color: #999999; }
// Dark mode highlight.js — inverted pure ink
.dark .hljs { color: #d0d0d0; }
.dark .hljs-keyword,
.dark .hljs-selector-tag { color: #f0f0f0; font-weight: 600; }
.dark .hljs-string,
.dark .hljs-attr { color: #aaaaaa; }
.dark .hljs-number { color: #cccccc; }
.dark .hljs-comment { color: #666666; font-style: italic; }
.dark .hljs-built_in { color: #bbbbbb; }
.dark .hljs-type { color: #c6c6c6; }
.dark .hljs-variable { color: #f0f0f0; }
.dark .hljs-title,
.dark .hljs-title\.function_ { color: #f0f0f0; }
.dark .hljs-params { color: #d0d0d0; }
.dark .hljs-meta { color: #666666; }
</style>