fix: auth bypass, SPA serving, and provider improvements (#97)

* feat(chat): polish syntax highlighting and tool payload rendering (#94) * [verified] feat(chat): polish syntax highlighting and tool payload rendering * [verified] fix(chat): tighten large tool payload rendering * docs: update data volume path in Docker docs Align documentation with docker-compose.yml change: hermes-web-ui-data -> hermes-web-ui, /app/dist/data -> /root/.hermes-web-ui Co-Authored-By: Claude Opus 4.6 <noreply@anthropic.com> * refactor: bundle server build and restructure service modules - Add build-server.mjs script for standalone server compilation - Add logger service with structured output - Restructure auth, gateway-manager, hermes-cli, hermes services - Update docker-compose volume mount path - Update tsconfig and entry point for bundled server Co-Authored-By: Claude Opus 4.6 <noreply@anthropic.com> * refactor: separate controllers from routes and centralize route registration - Extract business logic from route handlers into controllers/ - Add centralized route registry in routes/index.ts with public/auth/protected layers - Replace global auth whitelist with sequential middleware registration - Extract shared helpers to services/config-helpers.ts - Allow custom provider name to be user-editable in ProviderFormModal - Deduplicate custom providers by poolKey instead of base_url in getAvailable Co-Authored-By: Claude Opus 4.6 <noreply@anthropic.com> * fix: auth bypass via path case, SPA serving, and provider improvements - Fix auth bypass: path case-insensitive check for /api, /v1, /upload - Fix SPA returning 401: skip auth for non-API paths (static files) - Fix profile switch: use local loading state instead of shared store ref - Auto-append /v1 to base_url when fetching models (frontend + backend) - Guard .env writing to built-in providers only - Add builtin field to provider presets, enable base_url input in form - Print auth token to console on startup (pino only writes to file) Co-Authored-By: Claude Opus 4.6 <noreply@anthropic.com> --------- Co-authored-by: Zhicheng Han <43314240+hanzckernel@users.noreply.github.com> Co-authored-by: Claude Opus 4.6 <noreply@anthropic.com>
2026-04-21 12:35:48 +08:00
parent 21296a416b
commit 477af66232
65 changed files with 2743 additions and 2621 deletions
@@ -0,0 +1,46 @@
+import { writeFile } from 'fs/promises'
+import { join } from 'path'
+import { safeReadFile, safeStat, getHermesDir } from '../../services/config-helpers'
+
+export async function get(ctx: any) {
+  const hd = getHermesDir()
+  const memoryPath = join(hd, 'memories', 'MEMORY.md')
+  const userPath = join(hd, 'memories', 'USER.md')
+  const soulPath = join(hd, 'SOUL.md')
+  const [memory, user, soul, memoryStat, userStat, soulStat] = await Promise.all([
+    safeReadFile(memoryPath), safeReadFile(userPath), safeReadFile(soulPath),
+    safeStat(memoryPath), safeStat(userPath), safeStat(soulPath),
+  ])
+  ctx.body = {
+    memory: memory || '', user: user || '', soul: soul || '',
+    memory_mtime: memoryStat?.mtime || null, user_mtime: userStat?.mtime || null, soul_mtime: soulStat?.mtime || null,
+  }
+}
+
+export async function save(ctx: any) {
+  const { section, content } = ctx.request.body as { section: string; content: string }
+  if (!section || !content) {
+    ctx.status = 400
+    ctx.body = { error: 'Missing section or content' }
+    return
+  }
+  if (section !== 'memory' && section !== 'user' && section !== 'soul') {
+    ctx.status = 400
+    ctx.body = { error: 'Section must be "memory", "user", or "soul"' }
+    return
+  }
+  let filePath: string
+  if (section === 'soul') {
+    filePath = join(getHermesDir(), 'SOUL.md')
+  } else {
+    const fileName = section === 'memory' ? 'MEMORY.md' : 'USER.md'
+    filePath = join(getHermesDir(), 'memories', fileName)
+  }
+  try {
+    await writeFile(filePath, content, 'utf-8')
+    ctx.body = { success: true }
+  } catch (err: any) {
+    ctx.status = 500
+    ctx.body = { error: err.message }
+  }
+}