Proxy: allow denying /ai per project (capability check like /email)
維護者通常 1 天內回覆
還沒有人認領這個 Issue。
評估
- 難度
- 4/5
- 預估耗時
- 3-5 天
- 新手友好度
- 55/100
- Issue 類型
- 功能
- 描述清晰度
- 基本清楚
- 活躍度
- 活躍
- 技術堆疊
- typescript
研究方向
Start with platform/packages/proxy/src/index.ts, comparing the /ai usage check near line 288 with the /email capability gate near line 305; the provisioning path is also cited at platform/packages/api/src/provisioning/provision.ts. Choose and implement a way to deny project AI calls before model execution, then verify denied calls cannot reach the model while allowed projects still can.
由索引模型根據 Issue 內容生成。
描述
Request
Let an operator deny the proxy's /ai routes to a project (or at least honour the installation's ai capability there), the same way /email is already gated.
Why
We host agent-built apps in one Void project (lumi-apps) and serve them through our own dispatch Worker. Those apps must not use AI: our platform meters and approves every AI call, and an app calling Workers AI directly bypasses that. Other projects on the same installation do need AI, so turning it off installation-wide isn't an option.
Today every deployed Worker gets the __VOID_PROXY service binding plus __PROJECT_ID and __VOID_PROXY_TOKEN (platform/packages/api/src/provisioning/provision.ts:170-178 at v1.5.0), so app code can call /ai/* whether or not its manifest declares AI. The proxy checks PLATFORM_CAPABILITIES only for email (platform/packages/proxy/src/index.ts:305); /ai has only the monthly-usage block (index.ts:288), which is written asynchronously after usage is counted, so a plan quota limits spend but doesn't deny calls.
What would solve it
Any of these, in order of preference:
- A per-project capability setting (for example
void project capabilities set ai=false) that the proxy enforces on/aibefore running the model. - The proxy honouring the installation-level
aicapability on/ai, matching/email. - Not injecting
__VOID_PROXYinto Workers whose manifest uses none of the proxy-backed features.
Happy to test a pre-release. Related context: #692.
- 主要語言
- TypeScript
- 星號
- 627
- 分支
- 66
- 平均合併
- 14 小時 17 分鐘
- 30 天內合併 PR
- 200
環境準備
這個專案沒有提供開發容器、Dockerfile 或貢獻指南，環境需要你自己搭建：先看它的 README，通用步驟見我們的新手貢獻指南。
從這裡開始
- 先讀完整個 Issue，再讀專案的貢獻指南。
- 在 Issue 下留言說明你要接手 —— 這能避免兩個人做同樣的事。
- Fork 儲存庫，在一個分支上完成修改。
- 送出 Pull Request，並在描述裡引用這個 Issue 編號。
voidzero-dev/void 的其他 Issue
-
難度 4/5 3-5 天 新手友好度 48/100
voidzero-dev/void#717 ·
維護者通常 1 天內回覆
-
難度 5/5 一週以上 新手友好度 28/100
voidzero-dev/void#692 · 1 則留言 ·
維護者通常 1 天內回覆
-
難度 5/5 一週以上 新手友好度 30/100
voidzero-dev/void#689 ·
維護者通常 1 天內回覆
-
`withValidator({ body })` rejects the multipart bodies that `useForm` and `action()` send for files未關閉
難度 4/5 3-5 天 新手友好度 35/100
voidzero-dev/void#679 ·
維護者通常 1 天內回覆
-
難度 4/5 3-5 天 新手友好度 18/100
voidzero-dev/void#661 · 1 個 reaction ·
維護者通常 1 天內回覆
查看 voidzero-dev/void 的全部 Issue
相似的 Issue
-
難度 2/5 1-3 小時 新手友好度 78/100
vercel-labs/durable-harness#53 ·
維護者通常 1 天內回覆
-
[Bug]: Redesign tab bars ignore clicks on Linux: hidden chat layers keep window drag regions可能已有人在做 關聯的 PR 仍在進行中或已合併。 未關閉
難度 2/5 1-3 小時 新手友好度 82/100
維護者通常 1 天內回覆
-
experiência: a doc manda subir para o Micro do Supabase, mas não diz que exige plano pago nem quanto custa可能已有人在做 關聯的 PR 仍在進行中或已合併。 未關閉area/docs area/ui enhancement
難度 1/5 1-3 小時 新手友好度 88/100
melgarafael/DeskcommCRM#4098 ·
維護者通常 1 天內回覆
-
bug ready-for-agent
難度 2/5 1-3 小時 新手友好度 86/100
kerti/balances-v2#801 ·
維護者通常 1 天內回覆
-
lesson-submission pending-review
難度 1/5 1 小時以內 新手友好度 84/100
Ikalus1988/MisakaNet#4510 ·
維護者通常 1 天內回覆