parththakkar106andClaude Opus 5
1dd31086c1
AI Chat is a plain scratchpad for talking to a model directly — no story context, scripts or world state — for poking at models, prompts and endpoints without starting an adventure. Power users only: the router 404s (rather than 403s) for everyone else and the nav link is hidden. The conversation lives in localStorage, so there's no new table or migration. is_power_user() now also returns True in local mode: it's the operator's own machine and their own key, the same reasoning that makes the provider debug log local-only. Alongside that, the rule keeping the shared demo key off paid models now lives in exactly one place. It had been duplicated into the chat router, which is how one copy eventually drifts: - resolve_provider_config() takes an optional model_override and is the only place the whitelist is applied, so turns, AI Chat and the connection test all inherit it. An override is a per-request preference, never a grant. - ProviderConfig.__post_init__ refuses to exist when api_key is the demo key and the model isn't whitelisted. It keys on the key itself rather than the using_demo flag, so a mislabelled config can't slip past, and it raises so a future path that bypasses the resolver fails loudly instead of billing. - The demo branch still pins endpoint_url too — a user-controlled endpoint would leak the key itself, which is worse than spending it. Provider gained chat(messages, ...) beside generate(), both delegating to a shared _stream(url, body); completion-mode endpoints get the messages flattened into a labelled transcript. Settings' /models fetch moved to list_endpoint_models() and is shared with /api/chat/config. Tests: 10 new in tests/test_chat.py (70 total). These deliberately do not stub resolve_provider_config — the point is to exercise the real BYOK-vs-demo decision and assert on what the provider actually received: off-whitelist override pinned, off-whitelist Settings.model pinned, redirected endpoint pinned, BYOK passed through untouched. Co-Authored-By: Claude Opus 5 <noreply@anthropic.com> Claude-Session: https://claude.ai/code/session_014FGY1yvzSeKgTtRfeVtDmx
120 lines
3.8 KiB
Python
120 lines
3.8 KiB
Python
import os
|
|
from pathlib import Path
|
|
|
|
from fastapi import FastAPI
|
|
from fastapi.middleware.cors import CORSMiddleware
|
|
from fastapi.staticfiles import StaticFiles
|
|
from starlette.exceptions import HTTPException as StarletteHTTPException
|
|
|
|
from .auth import MULTI_USER
|
|
from .database import engine
|
|
from .limits import BodySizeLimitMiddleware
|
|
from .migrations import bootstrap
|
|
from .routers import adventures, auth, chat, debug, scenarios, scripts, settings, story_cards
|
|
from .seed import seed_public_scenarios
|
|
|
|
bootstrap(engine)
|
|
seed_public_scenarios(engine)
|
|
|
|
# Production serves the SPA same-origin, so CORS only matters for the Vite dev
|
|
# server; AIDND_CORS_ORIGINS overrides for any other cross-origin setup.
|
|
CORS_ORIGINS = [
|
|
o.strip()
|
|
for o in os.environ.get("AIDND_CORS_ORIGINS", "").split(",")
|
|
if o.strip()
|
|
] or ["http://localhost:5173", "http://127.0.0.1:5173"]
|
|
|
|
# The interactive API docs stay local-only: in multi-user mode they just hand
|
|
# strangers a map of the API surface.
|
|
app = FastAPI(
|
|
title="AI D&D",
|
|
docs_url=None if MULTI_USER else "/docs",
|
|
redoc_url=None,
|
|
openapi_url=None if MULTI_USER else "/openapi.json",
|
|
)
|
|
|
|
app.add_middleware(
|
|
CORSMiddleware,
|
|
allow_origins=CORS_ORIGINS,
|
|
allow_methods=["*"],
|
|
allow_headers=["*"],
|
|
)
|
|
|
|
app.add_middleware(BodySizeLimitMiddleware)
|
|
|
|
|
|
class SecurityHeadersMiddleware:
|
|
"""Standard hardening headers on every response. Pure ASGI (wraps `send`)
|
|
so SSE streams pass through unbuffered. The CSP allows exactly what the
|
|
SPA uses: same-origin everything, inline styles (React), Google Fonts."""
|
|
|
|
_HEADERS = [
|
|
(b"x-content-type-options", b"nosniff"),
|
|
(b"referrer-policy", b"same-origin"),
|
|
(b"x-frame-options", b"DENY"),
|
|
(
|
|
b"content-security-policy",
|
|
b"default-src 'self'; "
|
|
b"script-src 'self'; "
|
|
b"style-src 'self' 'unsafe-inline' https://fonts.googleapis.com; "
|
|
b"font-src https://fonts.gstatic.com; "
|
|
b"img-src 'self' data:; "
|
|
b"connect-src 'self'; "
|
|
b"frame-ancestors 'none'",
|
|
),
|
|
]
|
|
|
|
def __init__(self, app):
|
|
self.app = app
|
|
|
|
async def __call__(self, scope, receive, send):
|
|
if scope["type"] != "http":
|
|
return await self.app(scope, receive, send)
|
|
|
|
async def send_with_headers(message):
|
|
if message["type"] == "http.response.start":
|
|
message.setdefault("headers", [])
|
|
message["headers"] = list(message["headers"]) + self._HEADERS
|
|
await send(message)
|
|
|
|
await self.app(scope, receive, send_with_headers)
|
|
|
|
|
|
app.add_middleware(SecurityHeadersMiddleware)
|
|
|
|
app.include_router(auth.router)
|
|
app.include_router(scenarios.router)
|
|
app.include_router(adventures.router)
|
|
app.include_router(story_cards.router)
|
|
app.include_router(scripts.router)
|
|
app.include_router(settings.router)
|
|
app.include_router(chat.router)
|
|
app.include_router(debug.router)
|
|
|
|
|
|
@app.get("/api/health")
|
|
def health():
|
|
return {"ok": True}
|
|
|
|
|
|
# In production, serve the built frontend (frontend/dist) as static files.
|
|
class SPAStaticFiles(StaticFiles):
|
|
"""Serve index.html for unknown paths so client-side routes (/play/3)
|
|
survive a page reload. API routes are matched before this mount."""
|
|
|
|
async def get_response(self, path, scope):
|
|
try:
|
|
response = await super().get_response(path, scope)
|
|
except StarletteHTTPException as exc:
|
|
if exc.status_code != 404:
|
|
raise
|
|
return await super().get_response("index.html", scope)
|
|
if response.status_code == 404:
|
|
return await super().get_response("index.html", scope)
|
|
return response
|
|
|
|
|
|
frontend_dist = Path(__file__).resolve().parent.parent.parent / "frontend" / "dist"
|
|
if frontend_dist.is_dir():
|
|
app.mount("/", SPAStaticFiles(directory=frontend_dist, html=True), name="frontend")
|