Files
petal/internal/suggestions/chat.go
T
prosolis 6901cdbbe4 Multi-user groundwork: request-scoped user identity
Petal ran as a single hardcoded user, with db.LocalUserID named directly
at ~35 query sites. That made the caller's identity a compile-time
constant scattered across every package — nothing a real login could
replace without touching all of them.

New internal/auth moves it into the request context:

  - Middleware(Resolver) resolves the caller once per API request
  - handlers read auth.UserID(r.Context()) instead of naming a user
  - Resolver is the seam an Authentik session check drops into
  - StaticResolver(db.LocalUserID) keeps Petal single-user today

Behavior is unchanged. UserID returns "" rather than panicking when the
middleware is absent, so a mis-wired route fails closed: every query is
WHERE user_id = ?, which then matches nothing.

main.go splits /api into a public group (/health, /version) and an
authenticated group for everything else — a monitoring probe must not
need a session.

Two pre-existing access-control gaps fixed while threading, both
harmless with one user and not with two:

  - setStatus (accept/dismiss) updated a suggestion by bare id with no
    ownership check at all
  - listForDoc/fetchPending read a document's suggestions by doc_id
    alone; a suggestion quotes the sentence it corrects, so that leaked
    the source prose

Both now scope through documents.user_id.

Tests: internal/auth covers the context round-trip, the absent-context
case, and both 401 paths. Two-user isolation suites in docs and
suggestions mount the same routers twice behind two resolvers over one
database and assert a stranger gets 404 on every id-taking path, sees
nothing in list/search, and leaves the owner's data untouched.

Those suites earned their keep immediately: docs.fetch gained a userID
parameter but kept binding db.LocalUserID in the query. Unused
parameters are legal Go, so it compiled clean, vet was silent, and every
existing test passed while the lookup stayed unscoped.

Still global, out of scope and flagged in BUILD_PLAN.md: the image store
has no per-user association, and frontend localStorage keys are
per-browser rather than per-account.
2026-07-26 21:42:37 -07:00

128 lines
4.3 KiB
Go

package suggestions
import (
"database/sql"
"encoding/json"
"errors"
"net/http"
"strings"
"github.com/go-chi/chi/v5"
"gitea.parodia.dev/drwily/petal/internal/auth"
"gitea.parodia.dev/drwily/petal/internal/httputil"
"gitea.parodia.dev/drwily/petal/internal/llm"
)
// chatRequest is the body the AskPetal panel posts: the full conversation so
// far. The suggestion context is loaded server-side and never trusted from the
// client (spec Note #10).
type chatRequest struct {
Messages []llm.Message `json:"messages"`
}
// chat streams an Ask Petal conversational reply over SSE. It loads the
// suggestion and its parent document's surrounding paragraph, injects them as
// the tutor system prompt, then relays the model's tokens to the browser as
// `data:` events. History persistence lives entirely in the client.
func (h *Handler) chat(w http.ResponseWriter, r *http.Request) {
sugID := chi.URLParam(r, "id")
var body chatRequest
if err := json.NewDecoder(r.Body).Decode(&body); err != nil {
httputil.ErrorJSON(w, http.StatusBadRequest, "invalid request body")
return
}
// One query for the suggestion fields and the parent document's plain text,
// scoped to the local user so a stray id can't read another user's doc.
var (
original, replacement, explanation, typ string
fromPos int
contentText string
)
err := h.DB.QueryRow(
`SELECT s.original, s.replacement, s.explanation, s.type, s.from_pos, d.content_text
FROM suggestions s
JOIN documents d ON d.id = s.doc_id
WHERE s.id = ? AND d.user_id = ?`,
sugID, auth.UserID(r.Context()),
).Scan(&original, &replacement, &explanation, &typ, &fromPos, &contentText)
if errors.Is(err, sql.ErrNoRows) {
httputil.ErrorJSON(w, http.StatusNotFound, "suggestion not found")
return
}
if err != nil {
httputil.ServerError(w, err)
return
}
paragraph := surroundingParagraph(contentText, fromPos)
systemPrompt := llm.AskPetalSystemPrompt(original, replacement, typ, explanation, paragraph)
// SSE requires an unbuffered, flushable writer. chi's middleware writers pass
// Flush through; bail with a plain error if somehow they don't.
flusher, ok := w.(http.Flusher)
if !ok {
httputil.ServerError(w, errors.New("streaming unsupported"))
return
}
ch, err := llm.StreamAskPetal(r.Context(), h.Client, systemPrompt, body.Messages)
if err != nil {
// The stream never opened (e.g. LLM unreachable) — a normal JSON error is
// still appropriate since we haven't written SSE headers yet.
httputil.ErrorJSON(w, http.StatusBadGateway, "chat failed: "+err.Error())
return
}
w.Header().Set("Content-Type", "text/event-stream")
w.Header().Set("Cache-Control", "no-cache")
w.Header().Set("Connection", "keep-alive")
w.Header().Set("X-Accel-Buffering", "no") // disable proxy buffering (e.g. nginx)
w.WriteHeader(http.StatusOK)
flusher.Flush()
for chunk := range ch {
writeSSE(w, "token", map[string]string{"text": chunk})
flusher.Flush()
}
// Signal a clean end so the client can stop reading without waiting on EOF.
writeSSE(w, "done", map[string]bool{"done": true})
flusher.Flush()
}
// writeSSE emits one named SSE event with a JSON data payload. JSON-encoding the
// data keeps token text (which may contain newlines) from breaking SSE framing.
func writeSSE(w http.ResponseWriter, event string, data any) {
payload, err := json.Marshal(data)
if err != nil {
return
}
_, _ = w.Write([]byte("event: " + event + "\ndata: "))
_, _ = w.Write(payload)
_, _ = w.Write([]byte("\n\n"))
}
// surroundingParagraph returns the paragraph of contentText containing the
// plain-text offset from. Tiptap flattens blocks with blank-line separators, so
// paragraphs are bounded by "\n\n". When the offset is unknown (original wasn't
// located, from == -1) it falls back to the latency-capped document so the tutor
// still has context to work with.
func surroundingParagraph(contentText string, from int) string {
if from < 0 || from > len(contentText) {
return strings.TrimSpace(llm.TruncateDoc(contentText))
}
start := strings.LastIndex(contentText[:from], "\n\n")
if start < 0 {
start = 0
} else {
start += 2
}
end := len(contentText)
if rel := strings.Index(contentText[from:], "\n\n"); rel >= 0 {
end = from + rel
}
return strings.TrimSpace(contentText[start:end])
}