parththakkar106andClaude Opus 5
1dd31086c1
AI Chat is a plain scratchpad for talking to a model directly — no story context, scripts or world state — for poking at models, prompts and endpoints without starting an adventure. Power users only: the router 404s (rather than 403s) for everyone else and the nav link is hidden. The conversation lives in localStorage, so there's no new table or migration. is_power_user() now also returns True in local mode: it's the operator's own machine and their own key, the same reasoning that makes the provider debug log local-only. Alongside that, the rule keeping the shared demo key off paid models now lives in exactly one place. It had been duplicated into the chat router, which is how one copy eventually drifts: - resolve_provider_config() takes an optional model_override and is the only place the whitelist is applied, so turns, AI Chat and the connection test all inherit it. An override is a per-request preference, never a grant. - ProviderConfig.__post_init__ refuses to exist when api_key is the demo key and the model isn't whitelisted. It keys on the key itself rather than the using_demo flag, so a mislabelled config can't slip past, and it raises so a future path that bypasses the resolver fails loudly instead of billing. - The demo branch still pins endpoint_url too — a user-controlled endpoint would leak the key itself, which is worse than spending it. Provider gained chat(messages, ...) beside generate(), both delegating to a shared _stream(url, body); completion-mode endpoints get the messages flattened into a labelled transcript. Settings' /models fetch moved to list_endpoint_models() and is shared with /api/chat/config. Tests: 10 new in tests/test_chat.py (70 total). These deliberately do not stub resolve_provider_config — the point is to exercise the real BYOK-vs-demo decision and assert on what the provider actually received: off-whitelist override pinned, off-whitelist Settings.model pinned, redirected endpoint pinned, BYOK passed through untouched. Co-Authored-By: Claude Opus 5 <noreply@anthropic.com> Claude-Session: https://claude.ai/code/session_014FGY1yvzSeKgTtRfeVtDmx
75 lines
3.8 KiB
Bash
75 lines
3.8 KiB
Bash
# Environment variables read by the backend.
|
|
#
|
|
# NOTE: the app reads real environment variables — it does NOT auto-load this
|
|
# file. Set them in your shell, in docker-compose.yml, or in your host's
|
|
# dashboard. This file is documentation (and a template for deploy configs).
|
|
|
|
# Absolute path for the SQLite database file. Parent directory is created if
|
|
# missing. Default when unset: backend/data.db
|
|
# Docker compose sets this to /data/data.db (a named volume).
|
|
AIDND_DB_PATH=
|
|
|
|
# ---------------------------------------------------------------------------
|
|
# Phase 9 — production hardening
|
|
# ---------------------------------------------------------------------------
|
|
|
|
# Switch from SQLite to a server database (hosted deploys use Neon Postgres).
|
|
# Any SQLAlchemy URL; postgres:// and postgresql:// schemes are rewritten to
|
|
# the psycopg3 driver automatically. The platform-conventional DATABASE_URL
|
|
# is honored too (AIDND_DATABASE_URL wins if both are set). Unset = SQLite.
|
|
AIDND_DATABASE_URL=
|
|
|
|
# Comma-separated list of allowed CORS origins. Only needed when the frontend
|
|
# is served from a different origin than the API; the production build is
|
|
# served same-origin by FastAPI, so hosted deploys can leave this unset.
|
|
# Default: http://localhost:5173,http://127.0.0.1:5173 (the Vite dev server).
|
|
AIDND_CORS_ORIGINS=
|
|
|
|
# ---------------------------------------------------------------------------
|
|
# Phase 8 — optional accounts & multi-user (all optional; defaults keep the
|
|
# app in frictionless single-user "local mode")
|
|
# ---------------------------------------------------------------------------
|
|
|
|
# "1"/"true" turns on multi-user mode: guest sessions via signed cookies,
|
|
# register/login UI, per-user data. Leave unset for local installs.
|
|
AIDND_MULTI_USER=
|
|
|
|
# Secret for signing session cookies and encrypting stored API keys at rest.
|
|
# If unset in local mode, one is auto-generated into `secret.key` next to the
|
|
# database (fine for local/docker-volume runs). REQUIRED when
|
|
# AIDND_MULTI_USER is on — the app refuses to start without it, because a
|
|
# regenerated secret on an ephemeral hosted filesystem would log out every
|
|
# user on each deploy. Generate one:
|
|
# python -c "import secrets; print(secrets.token_urlsafe(48))"
|
|
AIDND_SECRET_KEY=
|
|
|
|
# Session cookie Secure flag (HTTPS-only). Defaults to on when
|
|
# AIDND_MULTI_USER is on, off otherwise — set 0/1 only to override (e.g. 0
|
|
# when testing multi-user mode over plain http on a LAN address).
|
|
AIDND_COOKIE_SECURE=
|
|
|
|
# --- Shared demo key (BYOK fallback; only active when AIDND_MULTI_USER=1) ---
|
|
# Users with no API key of their own get this server-funded endpoint with a
|
|
# model whitelist and a per-day turn cap. Unset = no demo, users must bring
|
|
# their own key. Memory bank/auto-summarization are disabled on demo turns.
|
|
AIDND_DEMO_API_KEY=
|
|
# Default endpoint if unset: https://openrouter.ai/api/v1
|
|
AIDND_DEMO_ENDPOINT_URL=
|
|
# Comma-separated model whitelist. Default: google/gemma-4-26b-a4b-it:free
|
|
AIDND_DEMO_MODELS=
|
|
# Successful AI turns per user per day on the demo key. Default: 20
|
|
AIDND_DEMO_TURNS_PER_DAY=
|
|
# Comma-separated emails of "power users" (trusted testers) who bypass the daily
|
|
# demo cap entirely — unmetered turns on the shared demo key — and get the AI Chat
|
|
# page (a plain scratchpad for talking to a model, hidden from everyone else).
|
|
# Registered accounts only (guests have no email). Matched case-insensitively.
|
|
# Local (single-user) installs are always treated as power users.
|
|
AIDND_POWER_USERS=
|
|
|
|
# The AI endpoint/API key/model are NOT env vars — they are configured at
|
|
# runtime in the app's Settings page and stored (encrypted) in the database.
|
|
#
|
|
# Rate limits, request size limits, and per-user row caps are hardcoded with
|
|
# generous values (see backend/app/limits.py) and active only in multi-user
|
|
# mode — local installs are never throttled.
|