f3bbd53afa
Remove code with no live references, each confirmed dead via AST reference analysis (no production callers and no importers), not just text search: - chunk_belongs_to_document plus its dedicated tests and the now-orphaned _insert_chunk test helper. The preview-target route already does a single-query membership check and deliberately never called this helper. - ingestion-progress.tsx and use-ingestion-events.ts (its only importer). Superseded by the aggregate ingestion toast stack; zero importers. - Unreferenced tests/fixtures/rag-preview sample files and their generator. No behavior change. The only non-deletion edits reword two comments that referenced the removed helper.
97 lines
4 KiB
Python
97 lines
4 KiB
Python
# SPDX-License-Identifier: AGPL-3.0-only
|
|
# Copyright 2026-present the Unsloth AI Inc. team. All rights reserved. See /studio/LICENSE.AGPL-3.0
|
|
|
|
"""Subject-scoped authorization for RAG document preview routes.
|
|
|
|
Used by `/api/rag/documents/{document_id}/file` and
|
|
`/api/rag/documents/{document_id}/preview-target` to enforce that the
|
|
current authenticated subject is allowed to see a given document and
|
|
chunk. Existence and authorization failures collapse to a single 404
|
|
so the API does not leak document IDs to a non-owner.
|
|
"""
|
|
|
|
from __future__ import annotations
|
|
|
|
import sqlite3
|
|
|
|
from fastapi import HTTPException
|
|
|
|
from storage.studio_db import get_connection
|
|
|
|
_NOT_FOUND_DETAIL = "Document not found"
|
|
|
|
|
|
def document_for_subject_or_404(
|
|
document_id: str,
|
|
current_subject: str,
|
|
) -> sqlite3.Row:
|
|
"""Return the `rag_documents` row if `current_subject` may access it.
|
|
|
|
Authorization rules:
|
|
|
|
- KB documents: the document's KB must have
|
|
`rag_knowledge_bases.owner_user_id == current_subject`. A KB with a
|
|
NULL owner is not accessible through this helper (legacy pre-auth
|
|
rows must be migrated or accessed via admin tooling).
|
|
|
|
- Thread documents: thread-scoped RAG documents are gated by an
|
|
explicit single-user invariant for Studio's current release. The
|
|
`chat_threads` table does not yet carry an `owner_user_id` column,
|
|
so we cannot bind a thread to a specific subject in the schema.
|
|
The helper still requires (a) an authenticated subject (enforced
|
|
by the route's `Depends(get_current_subject)`) and (b) that the
|
|
referenced thread actually exists in `chat_threads`. A missing
|
|
thread row collapses to 404 so a non-existent thread cannot
|
|
silently grant access through a dangling `thread_id`.
|
|
# TODO(thread-owner): once `chat_threads.owner_user_id` exists, join
|
|
# through it like KB docs and drop the single-user invariant. Update
|
|
# `tests/test_rag_authorization.py::test_thread_doc_other_user_404`
|
|
# to assert per-user isolation rather than thread existence.
|
|
|
|
Both not-found and not-authorized raise `HTTPException(404)` with the
|
|
same detail string. Callers must NOT distinguish the two cases in
|
|
their response, to avoid leaking document existence to a non-owner.
|
|
|
|
Returns the document row so the caller can read `stored_path`,
|
|
`filename`, `content_type`, etc. without re-querying.
|
|
"""
|
|
if not document_id or not current_subject:
|
|
raise HTTPException(status_code = 404, detail = _NOT_FOUND_DETAIL)
|
|
|
|
with get_connection() as conn:
|
|
row = conn.execute(
|
|
"SELECT * FROM rag_documents WHERE id = ?",
|
|
(document_id,),
|
|
).fetchone()
|
|
if row is None:
|
|
raise HTTPException(status_code = 404, detail = _NOT_FOUND_DETAIL)
|
|
|
|
kb_id = row["kb_id"]
|
|
thread_id = row["thread_id"]
|
|
|
|
if kb_id is not None:
|
|
owner_row = conn.execute(
|
|
"SELECT owner_user_id FROM rag_knowledge_bases WHERE id = ?",
|
|
(kb_id,),
|
|
).fetchone()
|
|
if owner_row is None:
|
|
raise HTTPException(status_code = 404, detail = _NOT_FOUND_DETAIL)
|
|
owner = owner_row["owner_user_id"]
|
|
if owner is None or owner != current_subject:
|
|
raise HTTPException(status_code = 404, detail = _NOT_FOUND_DETAIL)
|
|
return row
|
|
|
|
if thread_id is not None:
|
|
# Single-user invariant (see TODO above): require the thread row to
|
|
# exist; an unknown thread_id is not-found, not a silent grant.
|
|
thread_row = conn.execute(
|
|
"SELECT id FROM chat_threads WHERE id = ?",
|
|
(thread_id,),
|
|
).fetchone()
|
|
if thread_row is None:
|
|
raise HTTPException(status_code = 404, detail = _NOT_FOUND_DETAIL)
|
|
return row
|
|
|
|
# Docs must belong to a KB or a thread (DB CHECK enforces XOR on insert);
|
|
# a row satisfying neither is corrupt — treat as 404.
|
|
raise HTTPException(status_code = 404, detail = _NOT_FOUND_DETAIL)
|