anythingllm: LOCAL_AI base path + püsiv SIG_KEY/SALT + validatedRequest patch (vigane JWT ei kukuta)

third/server/anythingllm/docker-compose.yml

@@ -14,6 +14,8 @@ services:
       - /data/docker/anythingllm/logs:/app/server/logs
       - /backups/docker/anythingllm:/backups
       - /etc/localtime:/etc/localtime:ro
+      # [PARANDUS] vigane JWT ei kukuta protsessi (upstream bug)
+      - /opt/docker-compose/third/server/anythingllm/patches/validatedRequest.js:/app/server/utils/middleware/validatedRequest.js:ro
     environment:
       - TZ=Europe/Tallinn
       # Üldine
@@ -28,6 +30,9 @@ services:
       
       # Autentimine (muuda kindlasti ära!)
       - JWT_SECRET=muuda-see-samuti-turvaliseks
+      # Krüpteerimisvõti (PEAB olema püsiv; muidu recreate kaotab selle ja tokenid ei dekrüpteeru)
+      - SIG_KEY=17b99fb1b44ded94d62d30cb84c9ba6e7db04544294618c94ad81f477a3f05cc
+      - SIG_SALT=7566630e1904fe44b8a27042fe5209144c0377579ac59a2625b3b0d84dc76127
       
       # Andmebaas (AnythingLLM-i enda SQLite, mitte vektorbaas)
       - DATA_DIR=/app/server/storage
@@ -36,6 +41,10 @@ services:
       - LLM_PROVIDER=ollama
       - OLLAMA_BASE_PATH=http://host.docker.internal:11434
       - GENERIC_OPENAI_BASE_PATH=http://host.docker.internal:8070/v1
+      # LocalAI provider (workspace'id on provider=localai -> llama.cpp :8070 OpenAI-ühilduv)
+      - LOCAL_AI_BASE_PATH=http://host.docker.internal:8070/v1
+      - LOCAL_AI_MODEL_PREF=GPT-OSS
+      - LOCAL_AI_MODEL_TOKEN_LIMIT=16384
       #- OLLAMA_MODEL_PREF=qwen2.5:14b-instruct
       - OLLAMA_MODEL_PREF=qwen3:30b-fast
       #- OLLAMA_MODEL_TOKEN_LIMIT=8192

third/server/anythingllm/patches/validatedRequest.js

@@ -0,0 +1,119 @@
+const { SystemSettings } = require("../../models/systemSettings");
+const { User } = require("../../models/user");
+const { EncryptionManager } = require("../EncryptionManager");
+const { decodeJWT } = require("../http");
+const { UserMetaCache } = require("../userLocale");
+const EncryptionMgr = new EncryptionManager();
+
+async function validatedRequest(request, response, next) {
+  const multiUserMode = await SystemSettings.isMultiUserMode();
+  response.locals.multiUserMode = multiUserMode;
+  if (multiUserMode)
+    return await validateMultiUserRequest(request, response, next);
+
+  // When in development passthrough auth token for ease of development.
+  // Or if the user simply did not set an Auth token or JWT Secret
+  if (
+    process.env.NODE_ENV === "development" ||
+    !process.env.AUTH_TOKEN ||
+    !process.env.JWT_SECRET
+  ) {
+    UserMetaCache.setFromRequest(request);
+    next();
+    return;
+  }
+
+  if (!process.env.AUTH_TOKEN) {
+    response.status(401).json({
+      error: "You need to set an AUTH_TOKEN environment variable.",
+    });
+    return;
+  }
+
+  const auth = request.header("Authorization");
+  const token = auth ? auth.split(" ")[1] : null;
+
+  if (!token) {
+    response.status(401).json({
+      error: "No auth token found.",
+    });
+    return;
+  }
+
+  const bcrypt = require("bcryptjs");
+  const { p } = decodeJWT(token);
+
+  if (p === null || !/\w{32}:\w{32}/.test(p)) {
+    response.status(401).json({
+      error: "Token expired or failed validation.",
+    });
+    return;
+  }
+
+  // Since the blame of this comment we have been encrypting the `p` property of JWTs with the persistent
+  // encryptionManager PEM's. This prevents us from storing the `p` unencrypted in the JWT itself, which could
+  // be unsafe. As a consequence, existing JWTs with invalid `p` values that do not match the regex
+  // in ln:44 will be marked invalid so they can be logged out and forced to log back in and obtain an encrypted token.
+  // This kind of methodology only applies to single-user password mode.
+  // [PARANDUS 2026-09-26] Käsitle käsitlemata erand: vigane/aegunud JWT (nt vana
+  // krüptovõtmega) ei tohi protsessi kukutada. Tagasta 401.
+  try {
+    const _decrypted = EncryptionMgr.decrypt(p);
+    if (
+      !_decrypted ||
+      !bcrypt.compareSync(_decrypted, bcrypt.hashSync(process.env.AUTH_TOKEN, 10))
+    ) {
+      response.status(401).json({ error: "Invalid auth credentials." });
+      return;
+    }
+  } catch (e) {
+    response.status(401).json({ error: "Invalid auth credentials." });
+    return;
+  }
+
+  UserMetaCache.setFromRequest(request);
+  next();
+}
+
+async function validateMultiUserRequest(request, response, next) {
+  const auth = request.header("Authorization");
+  const token = auth ? auth.split(" ")[1] : null;
+
+  if (!token) {
+    response.status(401).json({
+      error: "No auth token found.",
+    });
+    return;
+  }
+
+  const valid = decodeJWT(token);
+  if (!valid || !valid.id) {
+    response.status(401).json({
+      error: "Invalid auth token.",
+    });
+    return;
+  }
+
+  const user = await User.get({ id: valid.id });
+  if (!user) {
+    response.status(401).json({
+      error: "Invalid auth for user.",
+    });
+    return;
+  }
+
+  if (user.suspended) {
+    response.status(401).json({
+      error: "User is suspended from system",
+    });
+    return;
+  }
+
+  response.locals.user = user;
+  UserMetaCache.setFromRequest(request, user.id);
+  next();
+}
+
+module.exports = {
+  validatedRequest,
+};