Commit Graph

23 Commits

Author SHA1 Message Date
hailin 6476bd868f feat(llm-gateway): 新增对外 LLM API 代理服务 — 完整的监管注入、内容审查和管理后台
## 新增微服务: llm-gateway (端口 3008)

对外提供与 Anthropic/OpenAI 完全兼容的 API 接口,中间拦截实现:
- API Key 认证:由我们分配 Key 给外部用户,SHA-256 哈希存储
- System Prompt 注入:在请求转发前注入监管合规内容(支持 prepend/append)
- 内容审查过滤:对用户消息进行关键词/正则匹配,支持 block/warn/log 三种动作
- 用量记录:异步批量写入,跟踪 token 消耗和费用估算
- 审计日志:记录每次请求的来源 IP、过滤状态、注入状态等
- 速率限制:基于内存滑动窗口的 RPM 限制

### 技术选型
- Fastify (非 NestJS):纯代理场景无需 DI 容器,路由开销 ~2ms
- SSE 流式管道:零缓冲直通,支持 Anthropic streaming 和 OpenAI streaming
- 规则缓存:30 秒 TTL,避免每次请求查库

### API 端点
- POST /v1/messages — Anthropic Messages API 代理(流式+非流式)
- POST /v1/embeddings — OpenAI Embeddings API 代理
- POST /v1/chat/completions — OpenAI Chat Completions API 代理
- GET /health — 健康检查

## 数据库 (5 张新表)

- gateway_api_keys: 外部用户 API Key(权限、限速、预算、过期时间)
- gateway_injection_rules: 监管内容注入规则(位置、匹配模型、匹配 Key)
- gateway_content_rules: 内容审查规则(关键词/正则、block/warn/log)
- gateway_usage_logs: Token 用量记录(按 Key、模型、提供商统计)
- gateway_audit_logs: 请求审计日志(IP、过滤状态、注入状态)

## Admin 后端 (conversation-service)

4 个 NestJS 控制器,挂载在 /conversations/admin/gateway/ 下:
- AdminGatewayKeysController: Key 的 CRUD + toggle
- AdminGatewayInjectionRulesController: 注入规则 CRUD + toggle
- AdminGatewayContentRulesController: 内容审查规则 CRUD + toggle
- AdminGatewayDashboardController: 仪表盘汇总、用量查询、审计日志查询

5 个 ORM 实体文件对应 5 张数据库表。

## Admin 前端 (admin-client)

新增 features/llm-gateway 模块,Tabs 布局包含 5 个管理面板:
- API Key Tab: 创建/删除/启停 Key,创建时一次性显示完整 Key
- 注入规则 Tab: 配置监管内容(前置/追加到 system prompt)
- 内容审查 Tab: 配置关键词/正则过滤规则
- 用量统计 Tab: 查看 token 消耗、费用、响应时间
- 审计日志 Tab: 查看请求记录、过滤命中、注入状态

菜单项: GatewayOutlined + "LLM 网关",位于"系统总监"和"数据分析"之间。

## 基础设施

- docker-compose.yml: 新增 llm-gateway 服务定义
- kong.yml: 新增 /v1/messages、/v1/embeddings、/v1/chat/completions 路由
  - 超时设置 300 秒(LLM 长响应)
  - CORS 新增 X-Api-Key、anthropic-version、anthropic-beta 头
- init-db.sql: 新增 5 张 gateway 表的建表语句

## 架构说明

内部服务(conversation-service、knowledge-service、evolution-service)继续直连 API,
llm-gateway 仅服务外部用户。两者通过共享 PostgreSQL 数据库关联配置。

Co-Authored-By: Claude Opus 4.6 <noreply@anthropic.com>
2026-02-25 22:32:25 -08:00
hailin 15d42315ed fix(docling): align volume mount with HF default cache path
Build preloads models to /root/.cache/huggingface (HF default).
Volume must mount there too, not a separate /models path.
Remove HF_HOME env override to keep paths consistent.

Co-Authored-By: Claude Opus 4.6 <noreply@anthropic.com>
2026-02-07 07:38:28 -08:00
hailin 73dee93d19 feat(docling): persist model cache via Docker volume
- Add docling_models volume mounted at /models in container
- Set HF_HOME=/models/huggingface at runtime (via docker-compose env)
- Models download once → persist in volume → survive container rebuilds
- Build-time preload uses || to not block build if network unavailable

Co-Authored-By: Claude Opus 4.6 <noreply@anthropic.com>
2026-02-07 07:18:14 -08:00
hailin 57d21526a5 feat(knowledge): add Docling document parsing microservice
Add IBM Docling as a Python FastAPI microservice for high-quality document
parsing with table structure recognition (TableFormer ~94% accuracy) and
OCR support, replacing pdf-parse/mammoth as the primary text extractor.

Architecture:
- New docling-service (Python FastAPI, port 3007) in Docker network
- knowledge-service calls docling-service via HTTP POST multipart/form-data
- Graceful fallback: if Docling fails, falls back to pdf-parse/mammoth
- Text/Markdown files skip Docling (no benefit for plain text)

Changes:
- New: packages/services/docling-service/ (main.py, Dockerfile, requirements.txt)
- docker-compose.yml: add docling-service, wire DOCLING_SERVICE_URL to
  knowledge-service, add missing FILE_SERVICE_URL to conversation-service
- text-extraction.service.ts: inject ConfigService, add extractViaDocling()
  with automatic fallback to legacy extractors
- .env.example: add FILE_SERVICE_PORT/URL and DOCLING_SERVICE_PORT/URL

Inter-service communication map:
  conversation-service → file-service (FILE_SERVICE_URL, attachments)
  conversation-service → knowledge-service (KNOWLEDGE_SERVICE_URL, RAG)
  knowledge-service → docling-service (DOCLING_SERVICE_URL, document parsing)

Co-Authored-By: Claude Opus 4.6 <noreply@anthropic.com>
2026-02-07 05:24:10 -08:00
hailin e1e9ba1a77 feat(multi-tenant): add super admin module and user profile pages
- Add SuperAdmin module for tenant management (CRUD, suspend/activate)
- Add tenant management REST API (/super-admin/tenants/*)
- Add user profile menu in ChatSidebar with dropdown
- Add ProfilePage and BindPhonePage for user account management
- Update init-db.sql with tenant_id columns for all 16 tables
- Add database seed script (scripts/seed.ts) with ts-node
- Integrate db:seed into deploy.sh rebuild command

Co-Authored-By: Claude Opus 4.5 <noreply@anthropic.com>
2026-01-26 06:41:11 -08:00
hailin 931055b51f feat(admin): add conversation management with device tracking display
## Backend (conversation-service)
- Add AdminConversationController with JWT auth for admin API
- Endpoints: list conversations, by user, detail, messages, statistics
- Support filtering by status, userId, date range, conversion
- Add JWT_SECRET environment variable to docker-compose.yml
- Add jsonwebtoken dependency for admin token verification

## Frontend (admin-client)
### New Features:
- Add conversations feature module with:
  - API layer (conversations.api.ts)
  - React Query hooks (useConversations.ts)
  - ConversationsPage with full management UI

### User Management Enhancement:
- Add "最近咨询记录" section in user detail drawer
- Display device info for each conversation:
  - IP address with region
  - User-Agent (parsed to browser/OS)
  - Device fingerprint
- Show conversation status, conversion status, message count

### Navigation:
- Add "对话管理" menu item with MessageOutlined icon
- Add /conversations route

## Files Added:
- admin-conversation.controller.ts (backend admin API)
- conversations feature folder (frontend)
  - infrastructure/conversations.api.ts
  - application/useConversations.ts
  - presentation/pages/ConversationsPage.tsx

Co-Authored-By: Claude Opus 4.5 <noreply@anthropic.com>
2026-01-25 10:04:17 -08:00
hailin d3d2944b03 fix(docker): add JWT_SECRET to evolution-service environment
Both user-service and evolution-service need the same JWT_SECRET
to verify admin tokens correctly.

Co-Authored-By: Claude Opus 4.5 <noreply@anthropic.com>
2026-01-25 09:15:50 -08:00
hailin 71b98c2d07 fix(docker): pass OPENAI_BASE_URL to knowledge-service container
Co-Authored-By: Claude Opus 4.5 <noreply@anthropic.com>
2026-01-23 05:46:03 -08:00
hailin 8b99021e0e feat(deploy): auto-init database with pgvector support
- Change PostgreSQL image from postgres:15-alpine to pgvector/pgvector:pg15
- Add init_database() function to auto-detect and initialize database
- Add 'db init' command for manual database initialization
- Database init runs automatically on first 'start all' deployment
- Includes admin account creation and pgvector extension verification

Co-Authored-By: Claude Opus 4.5 <noreply@anthropic.com>
2026-01-23 04:28:51 -08:00
hailin d4925719fc feat(multimodal): add file upload and image support for chat
- Add MinIO object storage to docker-compose infrastructure
- Create file-service microservice for upload management with presigned URLs
- Add files table to database schema
- Update nginx and Kong for MinIO proxy routes
- Implement file upload UI in chat InputArea with drag-and-drop
- Add attachment preview in MessageBubble component
- Update conversation-service to handle multimodal messages
- Add Claude Vision API integration for image analysis

Co-Authored-By: Claude Opus 4.5 <noreply@anthropic.com>
2026-01-10 05:34:41 -08:00
hailin 223aa25af1 fix(docker): add health check endpoints and fix IPv6 issue
- Add /health endpoints to all NestJS services (user, payment, knowledge, conversation, evolution)
- Fix nginx healthcheck to use 127.0.0.1 instead of localhost (IPv6 issue)
- Add healthcheck configuration to docker-compose for all backend services
- Use start_period to allow services time to initialize before health checks

Co-Authored-By: Claude Opus 4.5 <noreply@anthropic.com>
2026-01-10 02:13:42 -08:00
hailin 7f2fc153b5 refactor: simplify Anthropic client config using baseURL
Remove https-proxy-agent dependency since ANTHROPIC_BASE_URL already
supports pointing to a proxy server directly.

Co-Authored-By: Claude Opus 4.5 <noreply@anthropic.com>
2026-01-09 20:45:44 -08:00
hailin c6c9623f36 feat(conversation): add proxy support for Anthropic API
- Add https-proxy-agent dependency
- Configure httpAgent in ClaudeAgentService when ANTHROPIC_PROXY_URL is set
- Add ANTHROPIC_PROXY_URL environment variable to docker-compose.yml

Co-Authored-By: Claude Opus 4.5 <noreply@anthropic.com>
2026-01-09 20:34:13 -08:00
hailin b4a84b76fc refactor(kong): use DB-less mode with declarative config
- Remove kong-database, kong-migrations, kong-init services
- Use KONG_DATABASE=off with declarative config file
- Add kong/kong.yml with all services, routes, and plugins
- Remove kong_data volume (no longer needed)

Co-Authored-By: Claude Opus 4.5 <noreply@anthropic.com>
2026-01-09 19:36:06 -08:00
hailin fd4f23accc refactor: move Kong config to kong/ directory
Organize infrastructure configs properly:
- nginx/ for Nginx configuration
- kong/ for Kong configuration

Co-Authored-By: Claude Opus 4.5 <noreply@anthropic.com>
2026-01-09 19:34:04 -08:00
hailin 2512848d6c refactor(kong): consolidate Kong configuration into single init script
- Update init-kong.sh with complete service/route configuration
- Add CORS plugin configuration with all required headers
- Add timeout settings (120s for conversation-service)
- Simplify docker-compose kong-init to use the script
- Add kong-migrations service for database bootstrap

Co-Authored-By: Claude Opus 4.5 <noreply@anthropic.com>
2026-01-09 19:27:26 -08:00
hailin 92e2b7e445 fix: add CORS_ORIGINS env for conversation-service websocket
Allow production domain https://iconsulting.szaiai.com for WebSocket CORS

Co-Authored-By: Claude Opus 4.5 <noreply@anthropic.com>
2026-01-09 11:01:19 -08:00
hailin c9b5c4d2d7 fix: add POSTGRES_* environment variables for TypeORM
TypeORM config reads individual POSTGRES_HOST, POSTGRES_PORT, etc.
environment variables instead of DATABASE_URL. Added these variables
to all backend services in docker-compose.yml.

Co-Authored-By: Claude Opus 4.5 <noreply@anthropic.com>
2026-01-09 10:46:16 -08:00
hailin cc3de9244c fix: 修改nginx SSL端口为18443避免冲突
Co-Authored-By: Claude Opus 4.5 <noreply@anthropic.com>
2026-01-09 07:53:33 -08:00
hailin f273e7be8d feat: 傻瓜式nginx反向代理配置
- Docker nginx使用8080端口避免与系统nginx冲突
- 启动nginx时自动配置系统nginx反向代理
- 支持Debian/Ubuntu和CentOS/RHEL两种配置目录
- 自动测试配置并重载nginx

Co-Authored-By: Claude Opus 4.5 <noreply@anthropic.com>
2026-01-09 07:51:49 -08:00
hailin f0f098b769 fix: 使用正确的 Kong 官方镜像 kong:3.4
- 从 kong/kong-gateway:3.4 改为 kong:3.4 (官方镜像)
- 参考: https://hub.docker.com/_/kong

Co-Authored-By: Claude Opus 4.5 <noreply@anthropic.com>
2026-01-09 07:32:06 -08:00
hailin 2a3681347d fix: 修复 Kong 镜像名称和移除废弃的 version 属性
- 将 kong:3.4-alpine 改为 kong/kong-gateway:3.4
- 移除 docker-compose.yml 中废弃的 version 属性

Co-Authored-By: Claude Opus 4.5 <noreply@anthropic.com>
2026-01-09 07:26:28 -08:00
hailin a7add8ff90 Initial commit: iConsulting 香港移民咨询智能客服系统
项目架构:
- Monorepo (pnpm + Turborepo)
- 后端: NestJS 微服务 + Claude Agent SDK
- 前端: React + Vite + Ant Design

包含服务:
- conversation-service: 对话服务 (Claude AI)
- user-service: 用户认证服务
- payment-service: 支付服务 (支付宝/微信/Stripe)
- knowledge-service: 知识库服务 (RAG + Neo4j)
- evolution-service: 自我进化服务
- web-client: 用户前端
- admin-client: 管理后台

基础设施:
- PostgreSQL + Redis + Neo4j
- Kong API Gateway
- Nginx 反向代理
- Docker Compose 部署配置

Co-Authored-By: Claude Opus 4.5 <noreply@anthropic.com>
2026-01-09 00:01:12 -08:00