fix: auth bypass, SPA serving, and provider improvements (#97)

* feat(chat): polish syntax highlighting and tool payload rendering (#94) * [verified] feat(chat): polish syntax highlighting and tool payload rendering * [verified] fix(chat): tighten large tool payload rendering * docs: update data volume path in Docker docs Align documentation with docker-compose.yml change: hermes-web-ui-data -> hermes-web-ui, /app/dist/data -> /root/.hermes-web-ui Co-Authored-By: Claude Opus 4.6 <noreply@anthropic.com> * refactor: bundle server build and restructure service modules - Add build-server.mjs script for standalone server compilation - Add logger service with structured output - Restructure auth, gateway-manager, hermes-cli, hermes services - Update docker-compose volume mount path - Update tsconfig and entry point for bundled server Co-Authored-By: Claude Opus 4.6 <noreply@anthropic.com> * refactor: separate controllers from routes and centralize route registration - Extract business logic from route handlers into controllers/ - Add centralized route registry in routes/index.ts with public/auth/protected layers - Replace global auth whitelist with sequential middleware registration - Extract shared helpers to services/config-helpers.ts - Allow custom provider name to be user-editable in ProviderFormModal - Deduplicate custom providers by poolKey instead of base_url in getAvailable Co-Authored-By: Claude Opus 4.6 <noreply@anthropic.com> * fix: auth bypass via path case, SPA serving, and provider improvements - Fix auth bypass: path case-insensitive check for /api, /v1, /upload - Fix SPA returning 401: skip auth for non-API paths (static files) - Fix profile switch: use local loading state instead of shared store ref - Auto-append /v1 to base_url when fetching models (frontend + backend) - Guard .env writing to built-in providers only - Add builtin field to provider presets, enable base_url input in form - Print auth token to console on startup (pino only writes to file) Co-Authored-By: Claude Opus 4.6 <noreply@anthropic.com> --------- Co-authored-by: Zhicheng Han <43314240+hanzckernel@users.noreply.github.com> Co-authored-by: Claude Opus 4.6 <noreply@anthropic.com>
2026-04-21 12:35:48 +08:00
parent 21296a416b
commit 477af66232
65 changed files with 2743 additions and 2621 deletions
@@ -0,0 +1,106 @@
+import hljs from 'highlight.js'
+
+const LANGUAGE_ALIASES: Record<string, string> = {
+  shellscript: 'bash',
+  sh: 'bash',
+  zsh: 'bash',
+  yml: 'yaml',
+  vue: 'xml',
+}
+
+function escapeHtml(value: string): string {
+  return value
+    .replaceAll('&', '&amp;')
+    .replaceAll('<', '&lt;')
+    .replaceAll('>', '&gt;')
+    .replaceAll('"', '&quot;')
+    .replaceAll("'", '&#39;')
+}
+
+function sanitizeLanguageClass(value: string): string {
+  return value.replace(/[^a-z0-9_-]/gi, '-') || 'plain'
+}
+
+export function normalizeHighlightLanguage(lang?: string): string {
+  const normalized = lang?.trim().toLowerCase() || ''
+  return LANGUAGE_ALIASES[normalized] || normalized
+}
+
+export function inferStructuredLanguage(content: string): string | undefined {
+  try {
+    JSON.parse(content)
+    return 'json'
+  } catch {
+    return undefined
+  }
+}
+
+type RenderHighlightedCodeBlockOptions = {
+  maxHighlightLength?: number
+}
+
+export function renderHighlightedCodeBlock(
+  content: string,
+  lang: string | undefined,
+  copyLabel: string,
+  options: RenderHighlightedCodeBlockOptions = {},
+): string {
+  const requestedLanguage = lang?.trim().toLowerCase() || ''
+  const normalizedLanguage = normalizeHighlightLanguage(requestedLanguage)
+  const highlightLimit = options.maxHighlightLength ?? Number.POSITIVE_INFINITY
+
+  let highlighted = ''
+  let codeClassLanguage = normalizedLanguage || requestedLanguage || 'plain'
+  let labelLanguage = requestedLanguage
+
+  try {
+    if (normalizedLanguage && hljs.getLanguage(normalizedLanguage) && content.length <= highlightLimit) {
+      highlighted = hljs.highlight(content, {
+        language: normalizedLanguage,
+        ignoreIllegals: true,
+      }).value
+      codeClassLanguage = normalizedLanguage
+    } else {
+      highlighted = escapeHtml(content)
+      if (!labelLanguage) {
+        labelLanguage = 'text'
+      }
+    }
+  } catch {
+    highlighted = escapeHtml(content)
+    if (!labelLanguage) {
+      labelLanguage = 'text'
+    }
+  }
+
+  const languageLabelHtml = labelLanguage
+    ? `<span class="code-lang">${escapeHtml(labelLanguage)}</span>`
+    : ''
+
+  return `<pre class="hljs-code-block"><div class="code-header">${languageLabelHtml}<button type="button" class="copy-btn" data-copy-code="true">${escapeHtml(copyLabel)}</button></div><code class="hljs language-${sanitizeLanguageClass(codeClassLanguage)}">${highlighted}</code></pre>`
+}
+
+export async function copyTextToClipboard(text: string): Promise<void> {
+  try {
+    await navigator.clipboard?.writeText?.(text)
+  } catch {
+    // Ignore clipboard failures; the code block still renders safely.
+  }
+}
+
+export async function handleCodeBlockCopyClick(event: MouseEvent): Promise<void> {
+  const target = event.target
+  if (!(target instanceof HTMLElement)) return
+
+  const button = target.closest<HTMLElement>('[data-copy-code="true"]')
+  if (!button) return
+
+  event.preventDefault()
+
+  const block = button.closest('.hljs-code-block')
+  const code = block?.querySelector('code')
+  const text = code?.textContent ?? ''
+  if (!text) return
+
+  await copyTextToClipboard(text)
+}