810: Split session and non-session routes (#811)

.gitattributes

@@ -1,5 +1,5 @@
 # Always use LF for line endings
 * text eol=lf
-# Apart from font files
+# Apart from font files and images
 *.[ot]tf binary
 *.png -text

backend/.env.example

@@ -1,2 +1,3 @@
 OPENAI_API_KEY=YOUR_API_KEY
 SESSION_SECRET=YOUR_SESSION_SECRET
+CORS_ALLOW_ORIGIN=http://localhost:5173

backend/Dockerfile

@@ -5,4 +5,4 @@ RUN npm ci
 COPY . .
 EXPOSE 3001
 RUN npm run build
-CMD ["node", "--import=tsx/esm", "./build/server.js"]
+CMD ["node", "--import=tsx", "./src/server.ts"]

backend/docker-compose.yml

@@ -1,8 +1,10 @@
 services:
   prompt-injection-api:
     environment:
-      NODE_ENV: development
+      NODE_ENV: ${NODE_ENV:-development}
       OPENAI_API_KEY: ${OPENAI_API_KEY}
+      SESSION_SECRET: ${SESSION_SECRET}
+      CORS_ALLOW_ORIGIN: '${CORS_ALLOW_ORIGIN:-*}'
       PORT: 3001
     build: .
     image: 'scottlogic/prompt-injection-api'

backend/package.json

@@ -3,7 +3,7 @@
 	"version": "0.1.0",
 	"type": "module",
 	"scripts": {
-		"build": "tsc",
+		"build": "tsc --noEmit",
 		"dev": "tsx watch -r dotenv/config src/server.ts",
 		"start": "tsx -r dotenv/config src/server.ts",
 		"docker:start": "docker compose up -d",
@@ -23,8 +23,7 @@
 		"memorystore": "^1.6.7",
 		"openai": "^4.19.0",
 		"openai-chat-tokens": "^0.2.8",
-		"pdf-parse": "^1.1.1",
-		"react": "^18.2.0"
+		"pdf-parse": "^1.1.1"
 	},
 	"devDependencies": {
 		"@jest/globals": "^29.7.0",

backend/src/app.ts

@@ -1,74 +1,16 @@
 import cors from 'cors';
-import dotenv from 'dotenv';
 import express from 'express';
-import session from 'express-session';
-import memoryStoreFactory from 'memorystore';
-import { fileURLToPath } from 'node:url';
 
-import { importMetaUrl } from './importMetaUtils';
-import { ChatModel, defaultChatModel } from './models/chat';
-import { LevelState, getInitialLevelStates } from './models/level';
-import { router } from './router';
+import nonSessionRoutes from './nonSessionRoutes';
+import sessionRoutes from './sessionRoutes';
 
-dotenv.config();
-
-declare module 'express-session' {
-	interface Session {
-		initialised: boolean;
-		chatModel: ChatModel;
-		levelState: LevelState[];
-	}
-}
-
-const app = express();
-const isProd = app.get('env') === 'production';
-
-// for parsing application/json
-app.use(express.json());
-
-// use session storage - currently in-memory, but in future use Redis in prod builds
-const maxAge = 60 * 60 * 1000 * (isProd ? 1 : 8); //1 hour in prod, 8hrs in dev
-const sessionOpts: session.SessionOptions = {
-	store: new (memoryStoreFactory(session))({
-		checkPeriod: maxAge,
-	}),
-	secret: process.env.SESSION_SECRET ?? 'secret',
-	name: 'prompt-injection.sid',
-	resave: false,
-	saveUninitialized: true,
-	cookie: {
-		secure: isProd,
-		maxAge,
-	},
-};
-
-app.use(session(sessionOpts));
-
-app.use(
-	cors({
-		credentials: true,
-		origin: true,
-	})
-);
-
-app.use((req, _res, next) => {
-	// initialise session variables first time
-	if (!req.session.initialised) {
-		req.session.chatModel = defaultChatModel;
-		req.session.levelState = getInitialLevelStates();
-		req.session.initialised = true;
-	}
-	next();
-});
-
-app.use('/', router);
-
-// serve the documents folder
-app.use(
-	'/documents',
-	express.static(
-		fileURLToPath(new URL('../resources/documents', importMetaUrl()))
+export default express()
+	.use(express.json())
+	.use(
+		cors({
+			origin: process.env.CORS_ALLOW_ORIGIN,
+			credentials: true,
+		})
 	)
-);
-
-export default app;
+	.use('/', nonSessionRoutes)
+	.use('/', sessionRoutes);

backend/src/document.ts

@@ -1,9 +1,9 @@
-import * as fs from 'fs';
 import { CSVLoader } from 'langchain/document_loaders/fs/csv';
 import { DirectoryLoader } from 'langchain/document_loaders/fs/directory';
 import { PDFLoader } from 'langchain/document_loaders/fs/pdf';
 import { TextLoader } from 'langchain/document_loaders/fs/text';
 import { RecursiveCharacterTextSplitter } from 'langchain/text_splitter';
+import * as fs from 'node:fs';
 
 import { DocumentMeta } from './models/document';
 import { LEVEL_NAMES } from './models/level';
@@ -28,6 +28,7 @@ async function getDocuments(filePath: string) {
 		'.csv': (path: string) => new CSVLoader(path),
 	});
 	const docs = await loader.load();
+	console.debug(`${docs.length} documents found`);
 
 	// split the documents into chunks
 	const textSplitter = new RecursiveCharacterTextSplitter({

backend/src/langchain.ts

@@ -20,11 +20,12 @@ import {
 
 // store vectorised documents for each level as array
 const vectorisedDocuments = (() => {
-	let docs: DocumentsVector[] = [];
+	const docs: DocumentsVector[] = [];
 	return {
 		get: () => docs,
 		set: (newDocs: DocumentsVector[]) => {
-			docs = newDocs;
+			while (docs.length > 0) docs.pop();
+			docs.push(...newDocs);
 		},
 	};
 })();

backend/src/models/chat.ts

@@ -149,21 +149,16 @@ export type {
 	ChatDefenceReport,
 	ChatGptReply,
 	ChatMalicious,
+	ChatModel,
+	ChatModelConfiguration,
 	ChatResponse,
 	LevelHandlerResponse,
 	ChatHttpResponse,
 	ChatHistoryMessage,
+	SingleDefenceReport,
 	TransformedChatMessage,
 	FunctionCallResponse,
 	ToolCallResponse,
 	MessageTransformation,
 };
-export {
-	CHAT_MODELS,
-	CHAT_MESSAGE_TYPE,
-	MODEL_CONFIG,
-	ChatModel,
-	ChatModelConfiguration,
-	defaultChatModel,
-	SingleDefenceReport,
-};
+export { CHAT_MODELS, CHAT_MESSAGE_TYPE, MODEL_CONFIG, defaultChatModel };

backend/src/nonSessionRoutes.ts

@@ -0,0 +1,21 @@
+import express from 'express';
+import { fileURLToPath } from 'node:url';
+
+import { handleGetDocuments } from './controller/documentController';
+import { handleHealthCheck } from './controller/healthController';
+import { handleGetSystemRoles } from './controller/systemRoleController';
+import { importMetaUrl } from './importMetaUtils';
+
+const router = express.Router();
+
+router.use(
+	'/documents',
+	express.static(
+		fileURLToPath(new URL('../resources/documents', importMetaUrl()))
+	)
+);
+router.get('/documents', handleGetDocuments);
+router.get('/health', handleHealthCheck);
+router.get('/systemRoles', handleGetSystemRoles);
+
+export default router;

backend/src/openai.ts

@@ -101,7 +101,7 @@ const getOpenAIKey = (() => {
 			openAIKey = process.env.OPENAI_API_KEY;
 			if (!openAIKey) {
 				throw new Error(
-					'OpenAI API key not found in environment vars - cannot continue!'
+					'OPENAI_API_KEY not found in environment vars, cannot continue!'
 				);
 			}
 		}