feat(ai): job-shaped AI service with OpenAI-compatible backend, extraction-first; stop extracting every inbox document twice (#1740)

* feat(ai): job-shaped AI service with OpenAI-compatible backend, extraction-first; stop extracting every inbox document twice Sovereign plan WS1 PR1 (#1406 Tier 2, extraction-first, aligned with the AI surface audit). lib/ai grows a job-shaped service (generateText / generateStructured / extractFromDocument; no streaming members yet, see plan rule R3): - services/anthropic-family delegates to the existing createAiClient() and sends the exact request literals the inbox extractor sent before (request-shape tests deep-equal them), so hosted Bedrock stays byte-identical. - services/openai-compatible talks to any chat-completions endpoint (BYO Swedish provider) via Vercel AI SDK 6.x, exact-pinned and guarded: images as parts, PDFs rasterized with poppler (AI_PDF_MODE) or sent natively, AI_VISION / AI_STRICT_JSON declared, honest skips (ai_no_vision, pdf_rasterizer_missing) instead of fake failures. - config.ts: AI_PROVIDER/AI_BASE_URL/AI_API_KEY/AI_MODEL and per-tier AI_*_MODEL with the legacy BEDROCK_* names kept as the same overrides; getAiStatus() is the single source of truth for "is AI wired up". - provider.ts: openai-compatible in the auto-detect chain (after Bedrock and the direct API); createAiClient() refuses it loudly. Document extraction moves onto the service and gets the audit's fixes: - Inbox documents were extracted TWICE (pipeline A ran inside uploadDocument() before the inbox row existed, so its dedupe branch never fired; 3 707 + 1 666 calls / 30 d). The inbox now declares extractionOwner on the upload, the extension yields, and the inbox mirrors its single outcome onto document_attachments from every writer (sync, deferred, attach, retry, MCP). - Every "no extraction will ever happen" outcome is stamped (skipped:no_ai_entitlement / ai_unconfigured / system_generated / ...); the status route maps the quiet ones to 'disabled' on the first poll instead of a 30 s client timeout. Prod showed 309 of the 327 never-extracted uploads were the paywall working silently. - Self-generated documents (our own invoice PDFs, payout files) are no longer OCR'd. - Agent invoke answers 503 ai_unconfigured when the deployment has no assistant backend, distinct from the paywall. Guard: new direct-ai-client antipattern check (shrink-only allowlist of the pre-abstraction SDK callers) plus exact pins for @anthropic-ai/sdk, ai and @ai-sdk/openai-compatible. Verified: 15 958 unit tests green, guards, lint ratchet, typecheck, and a live smoke against hosted Bedrock through the new service (ping, streamed tool turn, thinking+cache, PDF extraction). Co-Authored-By: Claude Fable 5 <noreply@anthropic.com> * feat(ai): make AI_API_KEY optional for OpenAI-compatible endpoints (keyless local model servers) A local model server (llama.cpp's server, Ollama /v1, LM Studio, vLLM) usually has no auth. Before, the OpenAI-compatible backend required both AI_BASE_URL and AI_API_KEY to count as configured, so running Accounted on a local model meant setting a meaningless placeholder key. - resolveAiProvider / hasAiCredentials: a base URL alone is now enough. - services/openai-compatible: only send Authorization: Bearer when AI_API_KEY is set, so a keyless server is never handed an empty bearer; a hosted provider that needs a key still sets it. - Docs (SELF-HOSTING Option 3: local-model example, key marked optional), DECISIONS. Verified: with no AI_API_KEY, just AI_BASE_URL + AI_MODEL, getAiStatus() reports configured=true / provider=openai-compatible (live). lib/ai suite 71 green; tsc, guards, lint clean. Bedrock/Anthropic logic unchanged. Co-Authored-By: Claude Fable 5 <noreply@anthropic.com> --------- Co-authored-by: Jakob Wennberg <311770904+jakobwennberg-oss@users.noreply.github.com> Co-authored-by: Claude Fable 5 <noreply@anthropic.com>
2026-08-20 19:39:08 +02:00
parent fbf47649f2
commit c7a75d069d
37 changed files with 2865 additions and 335 deletions
@@ -50,6 +50,13 @@ vi.mock('@/lib/agent/intents/registry', () => ({
  getIntent: (...args: unknown[]) => getIntentMock(...args),
 }))

+// Deployment-level AI availability (distinct from the per-company paywall).
+// Default: available, so the ownership tests below exercise the real flow.
+const aiStatusMock = vi.fn()
+vi.mock('@/lib/ai', () => ({
+  getAiStatus: () => aiStatusMock(),
+}))
+
 const runChatTurnMock = vi.fn()
 vi.mock('@/lib/agent/chat/run-turn', () => ({
  runChatTurn: (...args: unknown[]) => runChatTurnMock(...args),
@@ -92,6 +99,7 @@ beforeEach(() => {
  checkRateMock.mockResolvedValue({ ok: true })
  getIntentMock.mockReturnValue({ id: 'general.help', sheetTitle: 'Assistenten' })
  runChatTurnMock.mockResolvedValue(undefined)
+  aiStatusMock.mockReturnValue({ configured: true, assistantAvailable: true, provider: 'bedrock' })
 })

 describe('POST /api/agent/invoke', () => {
@@ -119,6 +127,20 @@ describe('POST /api/agent/invoke', () => {
    expect(status).toBe(400)
  })

+  // A self-host without an AI key, or on an OpenAI-compatible endpoint the
+  // chat loop does not speak yet: say so up front with a distinct code, never
+  // open a stream that dies on the first model call, never confuse it with
+  // the paywall.
+  it('returns 503 ai_unconfigured when the deployment has no assistant backend', async () => {
+    aiStatusMock.mockReturnValue({ configured: false, assistantAvailable: false, provider: 'bedrock' })
+    enqueuePreamble()
+    const res = await POST(createMockRequest('/api/agent/invoke', { method: 'POST', body: body() }))
+    const { status, body: json } = await parseJsonResponse<{ error: string; code: string }>(res)
+    expect(status).toBe(503)
+    expect(json.code).toBe('ai_unconfigured')
+    expect(runChatTurnMock).not.toHaveBeenCalled()
+  })
+
  it('returns 403 when the user is not a member of the company', async () => {
    enqueue({ data: null }) // company_members: no row
    const res = await POST(createMockRequest('/api/agent/invoke', { method: 'POST', body: body() }))
@@ -7,6 +7,7 @@ import { getActiveCompanyId } from '@/lib/company/context'
 import { getIntent } from '@/lib/agent/intents/registry'
 import { checkAgentRateLimit, agentRateLimitResponseBody } from '@/lib/rate-limits/agent'
 import { runChatTurn, friendlyModelError } from '@/lib/agent/chat/run-turn'
+import { getAiStatus } from '@/lib/ai'
 import { guardSandbox } from '@/lib/sandbox/guard'
 import { requireCapability } from '@/lib/entitlements/has-capability'
 import { CAPABILITY } from '@/lib/entitlements/keys'
@@ -117,6 +118,20 @@ export async function POST(request: Request) {
  const capBlocked = await requireCapability(supabase, companyId, CAPABILITY.ai)
  if (capBlocked) return capBlocked

+  // Distinct from the paywall: the deployment has no AI backend the chat
+  // loop can run on (no credentials, or an OpenAI-compatible endpoint, which
+  // the loop does not speak yet). Answer up front instead of opening a
+  // stream that dies on the first model call.
+  if (!getAiStatus().assistantAvailable) {
+    return NextResponse.json(
+      {
+        error: 'Assistenten är inte konfigurerad på den här installationen.',
+        code: 'ai_unconfigured',
+      },
+      { status: 503 },
+    )
+  }
+
  // Resolve the conversation BEFORE any side effect below (the onboarding
  // intake stamp): a request that is about to be rejected must not write.
  let conversationId = body.conversation_id ?? null
@@ -0,0 +1,100 @@
+import { describe, it, expect, vi, beforeEach } from 'vitest'
+import { createQueuedMockSupabase, createMockRequest, parseJsonResponse } from '@/tests/helpers'
+
+const { supabase, enqueue, reset } = createQueuedMockSupabase()
+
+let unauthorized = false
+vi.mock('@/lib/api/with-route-context', () => ({
+  withRouteContext: (_op: string, handler: (req: unknown, ctx: unknown, extra: unknown) => unknown) => {
+    return async (req: unknown, extra: unknown) => {
+      if (unauthorized) {
+        return new Response(JSON.stringify({ error: 'Unauthorized' }), { status: 401 })
+      }
+      return handler(req, { supabase, companyId: 'company-1', user: { id: 'user-1' } }, extra)
+    }
+  },
+}))
+
+const aiStatusMock = vi.fn()
+vi.mock('@/lib/ai', () => ({
+  getAiStatus: () => aiStatusMock(),
+}))
+
+import { GET, deriveExtractionStatus } from '../route'
+
+const params = { params: Promise.resolve({ id: 'doc-1' }) }
+
+beforeEach(() => {
+  vi.clearAllMocks()
+  reset()
+  unauthorized = false
+  aiStatusMock.mockReturnValue({ configured: true })
+})
+
+describe('deriveExtractionStatus', () => {
+  const base = { extracted_at: '2026-08-20T10:00:00Z', extracted_data: null, extraction_model: null }
+
+  it('is running while unstamped on a configured deployment', () => {
+    expect(deriveExtractionStatus({ ...base, extracted_at: null }, true)).toBe('running')
+  })
+
+  // The self-host "no key yet" case: answer on the first poll, no 30 s hang.
+  it('is disabled while unstamped on an unconfigured deployment', () => {
+    expect(deriveExtractionStatus({ ...base, extracted_at: null }, false)).toBe('disabled')
+  })
+
+  it('is succeeded when data landed', () => {
+    expect(deriveExtractionStatus({ ...base, extracted_data: { a: 1 } }, true)).toBe('succeeded')
+  })
+
+  it('maps the quiet skips (paywall, unconfigured, sandbox, opt-out, system) to disabled', () => {
+    for (const m of [
+      'skipped:no_ai_entitlement',
+      'skipped:ai_unconfigured',
+      'skipped:sandbox',
+      'skipped:client_opt_out',
+      'skipped:system_generated',
+    ]) {
+      expect(deriveExtractionStatus({ ...base, extraction_model: m }, true)).toBe('disabled')
+    }
+  })
+
+  it('maps every other skip to unsupported and failures to failed', () => {
+    expect(deriveExtractionStatus({ ...base, extraction_model: 'skipped:unsupported_mime' }, true)).toBe('unsupported')
+    expect(deriveExtractionStatus({ ...base, extraction_model: 'skipped:ai_no_vision' }, true)).toBe('unsupported')
+    expect(deriveExtractionStatus({ ...base, extraction_model: 'failed:no_raw_text' }, true)).toBe('failed')
+    expect(deriveExtractionStatus({ ...base, extraction_model: null }, true)).toBe('failed')
+  })
+})
+
+describe('GET /api/documents/:id/extraction-status', () => {
+  it('returns 401 when unauthenticated', async () => {
+    unauthorized = true
+    const res = await GET(createMockRequest('/api/documents/doc-1/extraction-status'), params)
+    const { status } = await parseJsonResponse(res)
+    expect(status).toBe(401)
+  })
+
+  it('returns 404 for an unknown document', async () => {
+    enqueue({ data: null })
+    const res = await GET(createMockRequest('/api/documents/doc-1/extraction-status'), params)
+    const { status } = await parseJsonResponse(res)
+    expect(status).toBe(404)
+  })
+
+  it('returns the derived status', async () => {
+    enqueue({ data: { id: 'doc-1', extracted_at: '2026-08-20T10:00:00Z', extracted_data: null, extraction_model: 'skipped:no_ai_entitlement' } })
+    const res = await GET(createMockRequest('/api/documents/doc-1/extraction-status'), params)
+    const { status, body } = await parseJsonResponse<{ data: { status: string } }>(res)
+    expect(status).toBe(200)
+    expect(body.data.status).toBe('disabled')
+  })
+
+  it('answers disabled immediately on an unconfigured deployment', async () => {
+    aiStatusMock.mockReturnValue({ configured: false })
+    enqueue({ data: { id: 'doc-1', extracted_at: null, extracted_data: null, extraction_model: null } })
+    const res = await GET(createMockRequest('/api/documents/doc-1/extraction-status'), params)
+    const { body } = await parseJsonResponse<{ data: { status: string } }>(res)
+    expect(body.data.status).toBe('disabled')
+  })
+})
@@ -1,5 +1,6 @@
 import { NextResponse } from 'next/server'
 import { withRouteContext } from '@/lib/api/with-route-context'
+import { getAiStatus } from '@/lib/ai'
 import { getErrorMessage as getUserErrorMessage } from '@/lib/errors/get-error-message'

 // GET /api/documents/:id/extraction-status
@@ -9,15 +10,47 @@ import { getErrorMessage as getUserErrorMessage } from '@/lib/errors/get-error-m
 // touching storage (no signed URL creation per poll).
 //
 // Derived status:
-//   running     : extracted_at IS NULL (pipeline hasn't stamped yet)
+//   running     : extracted_at IS NULL and this deployment has AI configured
+//                 (the pipeline hasn't stamped yet)
 //   succeeded   : extracted_at IS NOT NULL AND extracted_data IS NOT NULL
-//   unsupported : extraction_model = 'skipped:*' (HEIC, ZIP, …)
+//   disabled    : no extraction will ever happen for this document and that
+//                 is not the document's fault: AI is not configured on this
+//                 deployment (extracted_at NULL + unconfigured, or stamped
+//                 skipped:ai_unconfigured), the company is not entitled to
+//                 AI extraction (skipped:no_ai_entitlement), a sandbox or
+//                 client opt-out, or a document the system generated itself
+//                 (skipped:system_generated). The UI shows nothing.
+//   unsupported : any other skipped:* (HEIC, ZIP, no vision model, …)
 //   failed      : extracted_at IS NOT NULL AND extracted_data IS NULL AND
 //                 extraction_model = 'failed:*'
-//   disabled    : the document-extraction extension isn't enabled (column
-//                 stays untouched indefinitely). Client times out and shows
-//                 a quiet fallback. We don't distinguish this from running
-//                 server-side: the client decides based on elapsed time.
+//
+// Before extraction was stamped on every outcome, free-tier uploads and
+// unconfigured self-hosts left the column NULL forever and the client had to
+// decide "disabled" by timing out after 30 s. It still keeps that timeout as
+// the last resort (the document-extraction extension may be switched off).
+export type DocumentExtractionStatus = 'running' | 'succeeded' | 'failed' | 'unsupported' | 'disabled'
+
+const QUIET_SKIPS = new Set([
+  'skipped:ai_unconfigured',
+  'skipped:no_ai_entitlement',
+  'skipped:sandbox',
+  'skipped:client_opt_out',
+  'skipped:system_generated',
+])
+
+export function deriveExtractionStatus(row: {
+  extracted_at: string | null
+  extracted_data: unknown
+  extraction_model: string | null
+}, aiConfigured: boolean): DocumentExtractionStatus {
+  if (!row.extracted_at) return aiConfigured ? 'running' : 'disabled'
+  if (row.extracted_data) return 'succeeded'
+  const model = row.extraction_model ?? ''
+  if (QUIET_SKIPS.has(model)) return 'disabled'
+  if (model.startsWith('skipped:')) return 'unsupported'
+  return 'failed'
+}
+
 export const GET = withRouteContext<{ params: Promise<{ id: string }> }>(
  'document.extraction_status',
  async (_request, { supabase, companyId }, { params }) => {
@@ -33,27 +66,19 @@ export const GET = withRouteContext<{ params: Promise<{ id: string }> }>(
    if (error) return NextResponse.json({ error: getUserErrorMessage(error) }, { status: 500 })
    if (!data) return NextResponse.json({ error: 'Not found' }, { status: 404 })

-    const extractedAt = data.extracted_at as string | null
-    const extractedData = data.extracted_data as Record<string, unknown> | null
-    const model = data.extraction_model as string | null
-
-    let status: 'running' | 'succeeded' | 'failed' | 'unsupported'
-    if (!extractedAt) {
-      status = 'running'
-    } else if (extractedData) {
-      status = 'succeeded'
-    } else if (model?.startsWith('skipped:')) {
-      status = 'unsupported'
-    } else {
-      status = 'failed'
+    const row = {
+      extracted_at: data.extracted_at as string | null,
+      extracted_data: data.extracted_data as Record<string, unknown> | null,
+      extraction_model: data.extraction_model as string | null,
    }
+    const status = deriveExtractionStatus(row, getAiStatus().configured)

    return NextResponse.json({
      data: {
        id: data.id,
        status,
-        extracted_at: extractedAt,
-        extraction_model: model,
+        extracted_at: row.extracted_at,
+        extraction_model: row.extraction_model,
      },
    })
  }