Cambios actualizados para los ultimos cambios

Author: Osaron

chatbot/public/app.js

@@ -128,6 +128,11 @@ function appendErrorCard(type) {
         icon    = '⚠️';
         title   = 'AI Token Quota Reached';
         desc    = 'The OpenAI token quota for this account has been exhausted. Please contact your Zters IT administrator to top up the API credits.';
+    } else if (type === 'auth_error') {
+        variant = 'auth';
+        icon    = '🔑';
+        title   = 'BookStack API Token Expired';
+        desc    = 'The API token used to authenticate with the Zters knowledge base has expired or is no longer valid. Please contact your Zters IT administrator to generate a new token.';
     } else if (type === 'bookstack_error') {
         variant = 'connection';
         icon    = '🔌';
@@ -319,9 +324,9 @@ async function handleChatRequest(message, isSystemCommand = false) {
                             botMsgDiv.innerHTML = marked.parse(fullResponse);
                             scrollToBottom();
                         }
-                        else if (data.type === 'quota_error' || data.type === 'bookstack_error') {
+                        else if (data.type === 'quota_error' || data.type === 'bookstack_error' || data.type === 'auth_error') {
                             removeStatus();
-                            botMsgDiv.remove(); // remove empty bot placeholder
+                            botMsgDiv.remove();
                             appendErrorCard(data.type);
                         }
                         else if (data.type === 'error') {

chatbot/public/styles.css

@@ -869,6 +869,16 @@ a:hover { text-decoration: underline; }
 .error-card.generic .error-title { color: #f87171; }
 .error-card.generic .error-desc  { color: #fca5a5; }
 
+/* — BookStack API token expired — blue/indigo */
+.error-card.auth {
+    background: rgba(99, 102, 241, 0.12);
+    border-color: rgba(99, 102, 241, 0.35);
+    border-left: 4px solid #6366f1;
+    color: #a5b4fc;
+}
+.error-card.auth .error-title { color: #a5b4fc; }
+.error-card.auth .error-desc  { color: #c7d2fe; }
+
 /* Light-mode overrides for error cards */
 body.light-theme .error-card.quota {
     background: #fffbeb;
@@ -878,6 +888,14 @@ body.light-theme .error-card.quota {
 body.light-theme .error-card.quota .error-title { color: #92400e; }
 body.light-theme .error-card.quota .error-desc  { color: #b45309; }
 
+body.light-theme .error-card.auth {
+    background: #eef2ff;
+    border-color: #a5b4fc;
+    color: #3730a3;
+}
+body.light-theme .error-card.auth .error-title { color: #3730a3; }
+body.light-theme .error-card.auth .error-desc  { color: #4338ca; }
+
 body.light-theme .error-card.connection,
 body.light-theme .error-card.generic {
     background: #fef2f2;

chatbot/server.js

@@ -34,31 +34,39 @@ const bookstackApi = axios.create({
   timeout: 7000  // 7 s — fast-fail when VPN is off
 });
 
-// Pre-flight connectivity check — run before every chat request
-// Returns true if BookStack is reachable, false otherwise.
+// Pre-flight connectivity check — run before every chat request.
+// Returns { ok: true } if reachable, or { ok: false, reason: 'auth' | 'connection' }.
 async function checkBookStackConnectivity() {
   try {
     await bookstackApi.get('/books', { params: { count: 1 } });
-    return true;
+    return { ok: true };
   } catch (err) {
     const status = err.response?.status;
-    // 403 = server is up but VPN / access is blocked
-    // 401 = bad token (treat as unreachable — user can't get docs either)
-    // 5xx, network codes = server down / VPN not connected
+
+    // 401 = API token expired or invalid (different from VPN/connection issue)
+    if (status === 401) {
+      console.warn('BookStack connectivity check failed — 401 Unauthorized (token expired or invalid)');
+      return { ok: false, reason: 'auth' };
+    }
+
+    // 403 = server reachable but access blocked (VPN not connected)
+    // Network codes = server unreachable (VPN down, server offline)
+    // 5xx = server error
     if (
       err.code === 'ECONNREFUSED' ||
       err.code === 'ENOTFOUND'    ||
       err.code === 'ETIMEDOUT'    ||
       err.code === 'ECONNRESET'   ||
       err.code === 'ECONNABORTED' ||
-      status === 401 || status === 403 ||
+      status === 403              ||
       (status && status >= 500)
     ) {
       console.warn(`BookStack connectivity check failed — code: ${err.code || status}`);
-      return false;
+      return { ok: false, reason: 'connection' };
     }
-    // Unknown error — assume reachable so we don't block on transient issues
-    return true;
+
+    // Unknown error — assume reachable to avoid blocking on transient issues
+    return { ok: true };
   }
 }
 
@@ -205,9 +213,10 @@ app.post('/api/chat', async (req, res) => {
 
   try {
     // ── Pre-flight: verify BookStack is reachable before doing anything ──
-    const bookStackOnline = await checkBookStackConnectivity();
-    if (!bookStackOnline) {
-      res.write(`data: ${JSON.stringify({ type: 'bookstack_error', content: 'Cannot reach BookStack' })}\n\n`);
+    const connectivity = await checkBookStackConnectivity();
+    if (!connectivity.ok) {
+      const errType = connectivity.reason === 'auth' ? 'auth_error' : 'bookstack_error';
+      res.write(`data: ${JSON.stringify({ type: errType, content: connectivity.reason })}\n\n`);
       res.end();
       return;
     }

faq_document.md

@@ -0,0 +1,45 @@
+# 🤖 Zters BookStack AI Chatbot - FAQ & Strategy Document
+
+This document answers key questions regarding the deployment, security, maintenance, and future integrations of the newly developed BookStack AI Chatbot for the Zters organization.
+
+---
+
+### 1. Can this chat be integrated into another app (e.g., CUBE)? How do we manage its deployment?
+
+**Yes, the chatbot is highly modular and built with integration in mind.** You have two primary approaches for integrating this into CUBE (or any other internal portal):
+
+*   **Approach A: UI Widget (Iframe/Embedded):** You can host the current Docker container centrally on an internal server. Within CUBE, you can simply embed the `localhost:3000` (or its production equivalent) using an `<iframe>` or a sliding side-panel widget that floats over the CUBE interface.
+*   **Approach B: Headless Backend (API Integration):** CUBE's developers can build their own native chat UI inside CUBE and simply send HTTP `POST` requests directly to the Chatbot's backend (`/api/chat`). The backend will handle the RAG pipeline (retrieving BookStack context and calling OpenAI) and return the response.
+
+**Deployment Management:**
+You should deploy the Docker container on a centralized server (e.g., AWS EC2, ECS, or an internal Linux host) alongside a Reverse Proxy like Nginx. The Docker Compose setup provided makes it easy to orchestrate. If using Approach B, you will need to configure **CORS** in `server.js` to allow the CUBE domain to interact with your API.
+
+---
+
+### 2. What are the security measures for this given that it uses the OpenAI API?
+
+> [!IMPORTANT]
+> The most critical rule of AI architecture is maintaining a secure boundary between the client UI and the LLM provider.
+
+*   **Zero Frontend Exposure**: Your OpenAI API key and your BookStack credentials are **never** shipped to the user's browser. They exist strictly as environmental variables (`.env`) locked inside the Docker backend.
+*   **Data Privacy**: By default, OpenAI **does not** use data submitted via their enterprise API (unlike consumer ChatGPT) to train their models. Your internal documentation remains your intellectual property.
+*   **Current Security Gap (Action Required)**: Currently, anyone who accesses `http://your-server-ip:3000` has access to query BookStack through the bot. Before full production deployment into existing apps like CUBE, you should protect the `/api/chat` route. This is typically done by passing a Zters JWT (JSON Web Token) or SSO cookie from CUBE to verify the user is logged into the Zters network before the backend processes the request.
+
+---
+
+### 3. ⏰ Maintenance Reminder: The BookStack API Key
+
+> [!WARNING]
+> Your BookStack API Key (`BOOKSTACK_TOKEN_ID` and `BOOKSTACK_TOKEN_SECRET`) has been configured to expire in exactly **1 Month**. 
+
+When this expires, the AI will lose the ability to fetch context and will start failing to answer queries about Zters systems. 
+**Action item:** Open BookStack Admin configuration, generate a permanent service-account API key (or one with a longer lifespan), and update the `.env` file containing the credentials. Remember to run `docker compose restart` after changing `.env` variables!
+
+---
+
+### 4. What else should Developers and Managers know about this tool?
+
+*   **Hallucination Handling & Fallbacks**: The system has a specific "multi-query fallback" algorithm explicitly built into `server.js`. If the AI suspects the initial BookStack keyword search failed, it automatically extracts clearer noun-keywords and tries a secondary search. However, if BookStack lacks documentation on a subject, the AI is instructed to honestly say "I don't know" rather than guess.
+*   **Stateless Architecture**: The backend remembers the last 10 messages of *the active session* passing from the browser. However, if a user refreshes their browser, the history resets. There is no database storing user chat logs.
+*   **Operating Costs**: Generative AI via API incurs costs per token. Using GPT-4o with extensive RAG (Retrieval-Augmented Generation) uses thousands of tokens per query securely fed from your BookStack pages. Managers should monitor the OpenAI billing dashboard to ensure usage scales appropriately with internal adoption.
+*   **Documentation formatting**: The AI extracts markdown directly from BookStack. The better your BookStack pages are formatted (with clear `H1/H2` tags, bullet points, and clean tables), the more accurate the AI's answers will be!