feat: restrict backup archive download to primary admin and hide admin-hidden projects from other admins
DevPlace CI / test (push) Failing after 22m57s
DevPlace CI / test (push) Failing after 22m57s
- Add `get_admin_uids()` and `get_primary_admin_uid()` to database.py for resolving the earliest-created admin - Modify `can_view_project()` in content.py so a project hidden by an admin is invisible to other admins (both web UI and REST API) - Update `_download_url()` and `_backup_payload()` in admin/backups.py to accept a `can_download` flag, gating the download endpoint with `is_primary_admin()` - Remove `role` from `_user_facts()` in docs_live.py to avoid leaking admin status in live docs - Update doc summaries in docs_api.py to reflect the new admin-visibility and backup-download semantics
This commit is contained in:
@@ -88,9 +88,6 @@ LLM_API_KEY = str(
|
||||
if not LLM_API_KEY:
|
||||
LLM_API_KEY = str(uuid.uuid4())
|
||||
|
||||
DEEPSEEK_ENDPOINT = "https://api.deepseek.com/chat/completions"
|
||||
DEEPSEEK_MODEL = "deepseek-v4-flash"
|
||||
|
||||
_BOOT_DT = datetime.now().astimezone()
|
||||
BOOT_DATETIME = _BOOT_DT.isoformat()
|
||||
BOOT_DAY_NAME = _BOOT_DT.strftime("%A")
|
||||
@@ -1047,7 +1044,6 @@ def get_backends() -> list[Backend]:
|
||||
if _backends is None:
|
||||
_backends = [
|
||||
Backend("molodetz", LLM_ENDPOINT, MODEL, LLM_API_KEY, True),
|
||||
Backend("deepseek", DEEPSEEK_ENDPOINT, DEEPSEEK_MODEL, os.getenv("DEEPSEEK_API_KEY"), False),
|
||||
]
|
||||
return _backends
|
||||
|
||||
|
||||
@@ -674,8 +674,6 @@ API_KEY = (
|
||||
or str(uuid.uuid4())
|
||||
)
|
||||
|
||||
DEEPSEEK_ENDPOINT = "https://api.deepseek.com/chat/completions"
|
||||
DEEPSEEK_MODEL = "deepseek-v4-flash"
|
||||
|
||||
_BOOT_DT = datetime.now().astimezone()
|
||||
BOOT_DATETIME = _BOOT_DT.isoformat()
|
||||
@@ -932,7 +930,6 @@ def get_backends() -> list[Backend]:
|
||||
if _backends is None:
|
||||
_backends = [
|
||||
Backend("molodetz", LLM_ENDPOINT, MODEL, API_KEY, True),
|
||||
Backend("deepseek", DEEPSEEK_ENDPOINT, DEEPSEEK_MODEL, os.getenv("DEEPSEEK_API_KEY"), False),
|
||||
]
|
||||
return _backends
|
||||
|
||||
|
||||
Reference in New Issue
Block a user