liuyu/nofx
1
0
Fork 0
mirror of https://github.com/NoFxAiOS/nofx.git synced 2026-07-07 13:00:59 +08:00
Code Issues Packages Projects Releases Wiki Activity

fix(telegram): newLLMClient uses bound user's model, not any user's model

Browse Source 
GetAnyEnabled() searched across all users in DB — if user B has an
enabled model, bot could use their API key while acting as user A.

Now uses GetDefault(botUserID) which only looks up the bound user's
enabled model, matching the same user scope as all API calls.
This commit is contained in:
tinkle-community
2026-03-08 18:31:05 +08:00
parent 13d70d2598
commit 97f309c9b5
1 changed files with 7 additions and 7 deletions
Download Patch File Download Diff File Expand all files Collapse all files

14
telegram/bot.go
View File

@@ -90,7 +90,7 @@ func runBot(token string, cfg *config.Config, st *store.Store) bool {
// Wire the AI agent manager. API docs are auto-generated from registered routes.
agents := agent.NewManager(cfg.APIServerPort, botToken, botUserID,
func() mcp.AIClient { return newLLMClient(st) },
func() mcp.AIClient { return newLLMClient(st, botUserID) },
api.GetAPIDocs(),
)
@@ -209,12 +209,12 @@ func sendMsg(bot *tgbotapi.BotAPI, chatID int64, text string) {
bot.Send(msg) //nolint:errcheck
}
// newLLMClient builds an LLM client for the agent.
// Priority: DB-configured model (Web UI) > environment variables.
// newLLMClient builds an LLM client for the agent using the bound user's enabled model.
// Priority: bound user's DB model > environment variables.
// Uses provider-specific constructors to ensure correct default base URLs and models.
func newLLMClient(st *store.Store) mcp.AIClient {
// 1. Try any enabled model from DB (user configured via Web UI, any user_id)
if model, err := st.AIModel().GetAnyEnabled(); err == nil {
func newLLMClient(st *store.Store, userID string) mcp.AIClient {
// 1. Try the bound user's enabled model from DB (configured via Web UI)
if model, err := st.AIModel().GetDefault(userID); err == nil {
apiKey := string(model.APIKey)
if apiKey != "" {
client := clientForProvider(model.Provider)
@@ -225,7 +225,7 @@ func newLLMClient(st *store.Store) mcp.AIClient {
}
logger.Warnf("Telegram: DB model found (provider=%s) but API key is empty after decryption", model.Provider)
} else {
logger.Warnf("Telegram: no enabled model in DB (%v), trying env vars", err)
logger.Warnf("Telegram: no enabled model for user %s (%v), trying env vars", userID, err)
}
// 2. Fall back to environment variables