feat(den): add org-managed llm provider library (#1343)

* feat(den): add org-managed llm provider library

Let Den admins curate shared providers and models with encrypted credentials, then let the app connect through the existing add-provider flow. This keeps org-wide model access consistent without requiring per-user OAuth setup.

* docs(den): prefer longer db encryption keys

* fix(den): pass db encryption key through local dev

---------

Co-authored-by: src-opn <src-opn@users.noreply.github.com>
This commit is contained in:
Source Open
2026-04-06 10:17:21 -07:00
committed by GitHub
parent b3afb8a176
commit 0589897b2f
40 changed files with 5714 additions and 91 deletions

View File

@@ -14,6 +14,9 @@ const apiPort = process.env.DEN_API_PORT?.trim() || process.env.DEN_CONTROLLER_P
const workerProxyPort = process.env.DEN_WORKER_PROXY_PORT?.trim() || "8789"
const webPort = process.env.DEN_WEB_PORT?.trim() || "3005"
const databaseUrl = process.env.DATABASE_URL?.trim() || "mysql://root:password@127.0.0.1:3306/openwork_den"
const dbEncryptionKey =
process.env.DEN_DB_ENCRYPTION_KEY?.trim() ||
"local-dev-db-encryption-key-please-change-1234567890"
function detectWebOrigins() {
const origins = new Set([
@@ -196,6 +199,7 @@ async function main() {
...process.env,
OPENWORK_DEV_MODE: process.env.OPENWORK_DEV_MODE?.trim() || "1",
DATABASE_URL: databaseUrl,
DEN_DB_ENCRYPTION_KEY: dbEncryptionKey,
BETTER_AUTH_SECRET: process.env.BETTER_AUTH_SECRET?.trim() || "local-dev-secret-not-for-production-use!!",
BETTER_AUTH_URL: process.env.BETTER_AUTH_URL?.trim() || `http://localhost:${webPort}`,
DEN_BETTER_AUTH_TRUSTED_ORIGINS: process.env.DEN_BETTER_AUTH_TRUSTED_ORIGINS?.trim() || webOrigins,