30426d21 · permissionBRICK/SillyTavern

.gitignore+3 -0 Viewed

 /vectors/
 /cache/
 public/css/user.css
+public/error/
 /plugins/
 /data
 /default/scaffold

 /certs
 .aider*
 .env
+/StartDev.bat

default/config.yaml+1 -1 Viewed

 ## Set to a positive number to expire session after a certain time of inactivity
 ## Set to 0 to expire session when the browser is closed
 ## Set to a negative number to disable session expiration
-sessionTimeout: 86400
+sessionTimeout: -1
 # Used to sign session cookies. Will be auto-generated if not set
 cookieSecret: ''
 # Disable CSRF protection - NOT RECOMMENDED

default/user.css → default/public/css/user.css+0 -0 Viewed

default/public/error/forbidden-by-whitelist.html+22 -0 Viewed

+<!DOCTYPE html>
+<html>
+<head>
+    <title>Forbidden</title>
+</head>
+<body>
+    <h1>Forbidden</h1>
+    <p>
+        If you are the system administrator, add your IP address to the
+        whitelist or disable whitelist mode by editing
+        <code>config.yaml</code> in the root directory of your installation.
+    </p>
+    <hr />
+    <p>
+        <em>Connection from {{ipDetails}} has been blocked. This attempt
+            has been logged.</em>
+    </p>
+</body>
+</html>

default/public/error/unauthorized.html+17 -0 Viewed

+<!DOCTYPE html>
+<html>
+<head>
+    <title>Unauthorized</title>
+</head>
+<body>
+    <h1>Unauthorized</h1>
+    <p>
+        If you are the system administrator, you can configure the
+        <code>basicAuthUser</code> credentials by editing
+        <code>config.yaml</code> in the root directory of your installation.
+    </p>
+</body>
+</html>

default/public/error/url-not-found.html+15 -0 Viewed

+<!DOCTYPE html>
+<html>
+<head>
+    <title>Not found</title>
+</head>
+<body>
+    <h1>Not found</h1>
+    <p>
+        The requested URL was not found on this server.
+    </p>
+</body>
+</html>

index.d.ts+18 -8 Viewed

 import { UserDirectoryList, User } from "./src/users";
+import { CsrfSyncedToken } from "csrf-sync";
 declare global {
+    declare namespace CookieSessionInterfaces {
+        export interface CookieSessionObject {
+            /**
+             * The CSRF token for the session.
+             */
+            csrfToken: CsrfSyncedToken;
+            /**
+             * Authenticated user handle.
+             */
+            handle: string;
+            /**
+             * Last time the session was extended.
+             */
+            touch: number;
+        }
+    }
     namespace Express {
         export interface Request {
             user: {

      */
     var DATA_ROOT: string;
+}
-declare module 'express-session' {
-    export interface SessionData {
-      handle: string;
-      touch: number;
-      // other properties...
-    }
-  }

package-lock.json+5 -5 Viewed

                 "cookie-parser": "^1.4.6",
                 "cookie-session": "^2.1.0",
                 "cors": "^2.8.5",
-                "csrf-csrf": "^2.2.3",
+                "csrf-sync": "^4.0.3",
                 "diff-match-patch": "^1.0.5",
                 "dompurify": "^3.1.7",
                 "droll": "^0.2.1",

                 "node": "*"
+            }
         },
-        "node_modules/csrf-csrf": {
+        "node_modules/csrf-sync": {
-            "version": "2.2.4",
+            "version": "4.0.3",
-            "resolved": "https://registry.npmjs.org/csrf-csrf/-/csrf-csrf-2.2.4.tgz",
+            "resolved": "https://registry.npmjs.org/csrf-sync/-/csrf-sync-4.0.3.tgz",
-            "integrity": "sha512-LuhBmy5RfRmEfeqeYqgaAuS1eDpVtKZB/Eiec9xiKQLBynJxrGVRdM2yRT/YMl1Njo/yKh2L9AYsIwSlTPnx2A==",
+            "integrity": "sha512-wXzltBBzt/7imzDt6ZT7G/axQG7jo4Sm0uXDUzFY8hR59qhDHdjqpW2hojS4oAVIZDzwlMQloIVCTJoDDh0wwA==",
             "license": "ISC",
             "dependencies": {
                 "http-errors": "^2.0.0"

package.json+1 -1 Viewed

         "cookie-parser": "^1.4.6",
         "cookie-session": "^2.1.0",
         "cors": "^2.8.5",
-        "csrf-csrf": "^2.2.3",
+        "csrf-sync": "^4.0.3",
         "diff-match-patch": "^1.0.5",
         "dompurify": "^3.1.7",
         "droll": "^0.2.1",

post-install.js+50 -10 Viewed

  * Creates the default config files if they don't exist yet.
  */
 function createDefaultFiles() {
-    const files = {
+    /**
-        config: './config.yaml',
+     * @typedef DefaultItem
-        user: './public/css/user.css',
+     * @type {object}
-    };
+     * @property {'file' | 'directory'} type - Whether the item should be copied as a single file or merged into a directory structure.
+     * @property {string} defaultPath - The path to the default item (typically in `default/`).
+     * @property {string} productionPath - The path to the copied item for production use.
+     */
+    /** @type {DefaultItem[]} */
+    const defaultItems = [
+        {
+            type: 'file',
+            defaultPath: './default/config.yaml',
+            productionPath: './config.yaml',
+        },
+        {
+            type: 'directory',
+            defaultPath: './default/public/',
+            productionPath: './public/',
+        },
+    ];
-    for (const file of Object.values(files)) {
+    for (const defaultItem of defaultItems) {
         try {
-            if (!fs.existsSync(file)) {
+            if (defaultItem.type === 'file') {
-                const defaultFilePath = path.join('./default', path.parse(file).base);
+                if (!fs.existsSync(defaultItem.productionPath)) {
-                fs.copyFileSync(defaultFilePath, file);
+                    fs.copyFileSync(
-                console.log(color.green(`Created default file: ${file}`));
+                        defaultItem.defaultPath,
+                        defaultItem.productionPath,
+                    );
+                    console.log(
+                        color.green(`Created default file: ${defaultItem.productionPath}`),
+                    );
+                }
+            } else if (defaultItem.type === 'directory') {
+                fs.cpSync(defaultItem.defaultPath, defaultItem.productionPath, {
+                    force: false, // Don't overwrite existing files!
+                    recursive: true,
+                });
+                console.log(
+                    color.green(`Synchronized missing files: ${defaultItem.productionPath}`),
+                );
+            } else {
+                throw new Error(
+                    'FATAL: Unexpected default file format in `post-install.js#createDefaultFiles()`.',
+                );
+            }
         } catch (error) {
-            console.error(color.red(`FATAL: Could not write default file: ${file}`), error);
+            console.error(
+                color.red(
+                    `FATAL: Could not write default ${defaultItem.type}: ${defaultItem.productionPath}`,
+                ),
+                error,
+            );
+        }
+    }
+}

server.js+39 -18 Viewed

 // express/server related library imports
 import cors from 'cors';
-import { doubleCsrf } from 'csrf-csrf';
+import { csrfSync } from 'csrf-sync';
 import express from 'express';
 import compression from 'compression';
-import cookieParser from 'cookie-parser';
 import cookieSession from 'cookie-session';
 import multer from 'multer';
 import responseTime from 'response-time';

 import { loadPlugins } from './src/plugin-loader.js';
 import {
     initUserStorage,
-    getCsrfSecret,
     getCookieSecret,
     getCookieSessionName,
     getAllEnabledUsers,

     forwardFetchResponse,
     removeColorFormatting,
     getSeparator,
+    safeReadFileSync,
 } from './src/util.js';
 import { UPLOADS_DIRECTORY } from './src/constants.js';
 import { ensureThumbnailCache } from './src/endpoints/thumbnails.js';

+}
 function getSessionCookieAge() {
-    // Defaults to 24 hours in seconds if not set
+    // Defaults to "no expiration" if not set
-    const configValue = getConfigValue('sessionTimeout', 24 * 60 * 60);
+    const configValue = getConfigValue('sessionTimeout', -1);
     // Convert to milliseconds
     if (configValue > 0) {

 // CSRF Protection //
 if (!disableCsrf) {
-    const COOKIES_SECRET = getCookieSecret();
+    const csrfSyncProtection = csrfSync({
+        getTokenFromState: (req) => {
-    const { generateToken, doubleCsrfProtection } = doubleCsrf({
+            if (!req.session) {
-        getSecret: getCsrfSecret,
+                console.error('(CSRF error) getTokenFromState: Session object not initialized');
-        cookieName: 'X-CSRF-Token',
+                return;
-        cookieOptions: {
+            }
-            sameSite: 'strict',
+            return req.session.csrfToken;
-            secure: false,
+        },
+        getTokenFromRequest: (req) => {
+            return req.headers['x-csrf-token']?.toString();
+        },
+        storeTokenInState: (req, token) => {
+            if (!req.session) {
+                console.error('(CSRF error) storeTokenInState: Session object not initialized');
+                return;
+            }
+            req.session.csrfToken = token;
         },
-        size: 64,
+        size: 32,
-        getTokenFromRequest: (req) => req.headers['x-csrf-token'],
     });
     app.get('/csrf-token', (req, res) => {
         res.json({
-            'token': generateToken(res, req),
+            'token': csrfSyncProtection.generateToken(req),
         });
     });
-    app.use(cookieParser(COOKIES_SECRET));
+    // Customize the error message
-    app.use(doubleCsrfProtection);
+    csrfSyncProtection.invalidCsrfTokenError.message = color.red('Invalid CSRF token. Please refresh the page and try again.');
+    csrfSyncProtection.invalidCsrfTokenError.stack = undefined;
+    app.use(csrfSyncProtection.csrfSynchronisedProtection);
 } else {
     console.warn('\nCSRF protection is disabled. This will make your server vulnerable to CSRF attacks.\n');
     app.get('/csrf-token', (req, res) => {

+    }
+}
+/**
+ * Registers a not-found error response if a not-found error page exists. Should only be called after all other middlewares have been registered.
+ */
+function apply404Middleware() {
+    const notFoundWebpage = safeReadFileSync('./public/error/url-not-found.html') ?? '';
+    app.use((req, res) => {
+        res.status(404).send(notFoundWebpage);
+    });
+}
 // User storage module needs to be initialized before starting the server
 initUserStorage(dataRoot)
     .then(ensurePublicDirectoriesExist)

     .then(migrateSystemPrompts)
     .then(verifySecuritySettings)
     .then(preSetupTasks)
+    .then(apply404Middleware)
     .finally(startServer);

src/endpoints/backends/chat-completions.js+10 -0 Viewed

     getTiktokenTokenizer,
     sentencepieceTokenizers,
     TEXT_COMPLETION_MODELS,
+    webTokenizers,
+    getWebTokenizer,
 } from '../tokenizers.js';
 const API_OPENAI = 'https://api.openai.com/v1';

                 return response.send({});
+            }
             encodeFunction = (text) => new Uint32Array(instance.encodeIds(text));
+        } else if (webTokenizers.includes(model)) {
+            const tokenizer = getWebTokenizer(model);
+            const instance = await tokenizer?.get();
+            if (!instance) {
+                console.warn('Tokenizer not initialized:', model);
+                return response.send({});
+            }
+            encodeFunction = (text) => new Uint32Array(instance.encode(text));
         } else {
             const tokenizer = getTiktokenTokenizer(model);
             encodeFunction = (tokenizer.encode.bind(tokenizer));

src/endpoints/tokenizers.js+42 -0 Viewed

     'jamba',
 ];
+export const webTokenizers = [
+    'claude',
+    'llama3',
+    'command-r',
+    'qwen2',
+    'nemo',
+    'deepseek',
+];
 /**
  * Gets the Sentencepiece tokenizer by the model name.
  * @param {string} model Sentencepiece model name

+}
 /**
+ * Gets the Web tokenizer by the model name.
+ * @param {string} model Web tokenizer model name
+ * @returns {WebTokenizer|null} Web tokenizer
+ */
+export function getWebTokenizer(model) {
+    if (model.includes('llama3')) {
+        return llama3_tokenizer;
+    }
+    if (model.includes('claude')) {
+        return claude_tokenizer;
+    }
+    if (model.includes('command-r')) {
+        return commandTokenizer;
+    }
+    if (model.includes('qwen2')) {
+        return qwen2Tokenizer;
+    }
+    if (model.includes('nemo')) {
+        return nemoTokenizer;
+    }
+    if (model.includes('deepseek')) {
+        return deepseekTokenizer;
+    }
+    return null;
+}
+/**
  * Counts the token ids for the given text using the Sentencepiece tokenizer.
  * @param {SentencePieceTokenizer} tokenizer Sentencepiece tokenizer
  * @param {string} text Text to tokenize

src/endpoints/users-private.js+1 -0 Viewed

+        }
         request.session.handle = null;
+        request.session.csrfToken = null;
         request.session = null;
         return response.sendStatus(204);
     } catch (error) {

src/middleware/basicAuth.js+4 -3 Viewed

 import { Buffer } from 'node:buffer';
 import storage from 'node-persist';
 import { getAllUserHandles, toKey, getPasswordHash } from '../users.js';
-import { getConfig, getConfigValue } from '../util.js';
+import { getConfig, getConfigValue, safeReadFileSync } from '../util.js';
 const PER_USER_BASIC_AUTH = getConfigValue('perUserBasicAuth', false);
 const ENABLE_ACCOUNTS = getConfigValue('enableUserAccounts', false);
+const basicAuthMiddleware = async function (request, response, callback) {
+    const unauthorizedWebpage = safeReadFileSync('./public/error/unauthorized.html') ?? '';
     const unauthorizedResponse = (res) => {
         res.set('WWW-Authenticate', 'Basic realm="SillyTavern", charset="UTF-8"');
-    return res.status(401).send('Authentication required');
+        return res.status(401).send(unauthorizedWebpage);
     };
-const basicAuthMiddleware = async function (request, response, callback) {
     const config = getConfig();
     const authHeader = request.headers.authorization;

src/middleware/whitelist.js+16 -5 Viewed

 import path from 'node:path';
 import fs from 'node:fs';
 import process from 'node:process';
+import Handlebars from 'handlebars';
 import ipMatching from 'ip-matching';
 import { getIpFromRequest } from '../express-common.js';
-import { color, getConfigValue } from '../util.js';
+import { color, getConfigValue, safeReadFileSync } from '../util.js';
 const whitelistPath = path.join(process.cwd(), './whitelist.txt');
 const enableForwardedWhitelist = getConfigValue('enableForwardedWhitelist', false);

  * @returns {import('express').RequestHandler} The middleware function
  */
 export default function whitelistMiddleware(whitelistMode, listen) {
+    const forbiddenWebpage = Handlebars.compile(
+        safeReadFileSync('./public/error/forbidden-by-whitelist.html') ?? '',
+    );
     return function (req, res, next) {
         const clientIp = getIpFromRequest(req);
         const forwardedIp = getForwardedIp(req);
+        const userAgent = req.headers['user-agent'];
         if (listen && !knownIPs.has(clientIp)) {
-            const userAgent = req.headers['user-agent'];
             console.log(color.yellow(`New connection from ${clientIp}; User Agent: ${userAgent}\n`));
             knownIPs.add(clientIp);

             || forwardedIp && whitelistMode === true && !whitelist.some(x => ipMatching.matches(forwardedIp, ipMatching.getMatch(x)))
         ) {
             // Log the connection attempt with real IP address
-            const ipDetails = forwardedIp ? `${clientIp} (forwarded from ${forwardedIp})` : clientIp;
+            const ipDetails = forwardedIp
-            console.log(color.red('Forbidden: Connection attempt from ' + ipDetails + '. If you are attempting to connect, please add your IP address in whitelist or disable whitelist mode in config.yaml in root of SillyTavern folder.\n'));
+                ? `${clientIp} (forwarded from ${forwardedIp})`
-            return res.status(403).send('<b>Forbidden</b>: Connection attempt from <b>' + ipDetails + '</b>. If you are attempting to connect, please add your IP address in whitelist or disable whitelist mode in config.yaml in root of SillyTavern folder.');
+                : clientIp;
+            console.log(
+                color.red(
+                    `Blocked connection from ${clientIp}; User Agent: ${userAgent}\n\tTo allow this connection, add its IP address to the whitelist or disable whitelist mode by editing config.yaml in the root directory of your SillyTavern installation.\n`,
+                ),
+            );
+            return res.status(403).send(forbiddenWebpage({ ipDetails }));
+        }
         next();
     };

src/util.js+11 -0 Viewed

         return this.map[Symbol.iterator]();
+    }
+}
+/**
+ * A 'safe' version of `fs.readFileSync()`. Returns the contents of a file if it exists, falling back to a default value if not.
+ * @param {string} filePath Path of the file to be read.
+ * @param {Parameters<typeof fs.readFileSync>[1]} options Options object to pass through to `fs.readFileSync()` (default: `{ encoding: 'utf-8' }`).
+ * @returns The contents at `filePath` if it exists, or `null` if not.
+ */
+export function safeReadFileSync(filePath, options = { encoding: 'utf-8' }) {
+    if (fs.existsSync(filePath)) return fs.readFileSync(filePath, options);
+    return null;
+}

Merge branch 'staging' into woo-yeah