apunkt/SurfSense
1
0
Fork 0
mirror of https://github.com/MODSetter/SurfSense.git synced 2026-07-20 23:21:06 +02:00
Code Issues Projects Releases Packages Wiki Activity

fix(models): require sessions for personal connection writes

Browse source
This commit is contained in:
Anish Sarkar 2026-06-20 01:58:06 +05:30
parent 1f9cf326e5
commit 3a0cd8c8cf
1 changed files with 25 additions and 4 deletions
Download patch file Download diff file Expand all files Collapse all files

29
surfsense_backend/app/routes/model_connections_routes.py
View file

@ -42,7 +42,7 @@ from app.services.model_connection_service import (
verify_connection, verify_connection,
) )
from app.services.provider_registry import REGISTRY from app.services.provider_registry import REGISTRY
from app.users import get_auth_context from app.users import get_auth_context, require_session_context
from app.utils.rbac import check_permission from app.utils.rbac import check_permission
router = APIRouter() router = APIRouter()
@ -257,7 +257,7 @@ async def _default_unset_roles(
@router.get("/model-providers", response_model=list[ModelProviderRead]) @router.get("/model-providers", response_model=list[ModelProviderRead])
async def list_model_providers(auth: AuthContext = Depends(get_auth_context)): async def list_model_providers(auth: AuthContext = Depends(require_session_context)):
del auth del auth
local_only = {"ollama_chat", "lm_studio"} local_only = {"ollama_chat", "lm_studio"}
return [ return [
@ -301,6 +301,7 @@ async def _assert_connection_access(
auth: AuthContext, auth: AuthContext,
conn: Connection, conn: Connection,
permission: str = Permission.LLM_CONFIGS_CREATE.value, permission: str = Permission.LLM_CONFIGS_CREATE.value,
allow_spaceless_pat: bool = False,
) -> None: ) -> None:
user = auth.user user = auth.user
if conn.search_space_id: if conn.search_space_id:
@ -316,16 +317,21 @@ async def _assert_connection_access(
raise HTTPException( raise HTTPException(
status_code=403, detail="Connection does not belong to user" status_code=403, detail="Connection does not belong to user"
) )
if auth.is_gated and not allow_spaceless_pat:
raise HTTPException(
status_code=403,
detail="Managing personal model connections requires an interactive session",
)
@router.get("/global-llm-config-status") @router.get("/global-llm-config-status")
async def global_llm_config_status(auth: AuthContext = Depends(get_auth_context)): async def global_llm_config_status(auth: AuthContext = Depends(require_session_context)):
del auth del auth
return {"exists": config.GLOBAL_LLM_CONFIG_FILE_EXISTS} return {"exists": config.GLOBAL_LLM_CONFIG_FILE_EXISTS}
@router.get("/global-model-connections", response_model=list[ConnectionRead]) @router.get("/global-model-connections", response_model=list[ConnectionRead])
async def list_global_connections(auth: AuthContext = Depends(get_auth_context)): async def list_global_connections(auth: AuthContext = Depends(require_session_context)):
del auth del auth
models_by_connection: dict[int, list[dict]] = {} models_by_connection: dict[int, list[dict]] = {}
for model in config.GLOBAL_MODELS: for model in config.GLOBAL_MODELS:
@ -380,6 +386,11 @@ async def create_connection(
Permission.LLM_CONFIGS_CREATE.value, Permission.LLM_CONFIGS_CREATE.value,
"You don't have permission to create model connections in this search space", "You don't have permission to create model connections in this search space",
) )
elif auth.is_gated:
raise HTTPException(
status_code=403,
detail="Managing personal model connections requires an interactive session",
)
payload = data.model_dump(exclude={"search_space_id", "models"}) payload = data.model_dump(exclude={"search_space_id", "models"})
conn = Connection( conn = Connection(
@ -425,6 +436,11 @@ async def preview_connection_models(
Permission.LLM_CONFIGS_CREATE.value, Permission.LLM_CONFIGS_CREATE.value,
"You don't have permission to create model connections in this search space", "You don't have permission to create model connections in this search space",
) )
elif auth.is_gated:
raise HTTPException(
status_code=403,
detail="Testing personal model connections requires an interactive session",
)
draft = Connection( draft = Connection(
provider=data.provider, provider=data.provider,
@ -460,6 +476,11 @@ async def test_preview_connection_model(
Permission.LLM_CONFIGS_CREATE.value, Permission.LLM_CONFIGS_CREATE.value,
"You don't have permission to create model connections in this search space", "You don't have permission to create model connections in this search space",
) )
elif auth.is_gated:
raise HTTPException(
status_code=403,
detail="Testing personal model connections requires an interactive session",
)
model_id = data.model_id.strip() model_id = data.model_id.strip()
if not model_id: if not model_id: