mirror of
https://github.com/Haidra-Org/AI-Horde.git
synced 2026-11-06 05:17:31 +00:00
tazlin
579f40d6c0
A request ID is a bearer token: anyone holding it can poll progress and collect results, and that is intentional. It also meant the prompt and parameters behind a request were unreadable to the client that submitted them, and that the owner of a shared key could enumerate every request ID funded through that key from their own account view. This adds a credentialed read of the submission, and closes the enumeration path at the same time so the new read cannot widen it. - Add GET /v2/generate/request/<id> and /v2/generate/text/request/<id>. The response has the shape of the generation input so it can be posted back to the async endpoint as-is; defaults the Horde filled in come back filled, and source images come back as their storage references rather than base64 - assert_submitting_key decides who may read: a personal key reads requests it submitted and requests submitted through its own shared keys, a shared key reads only what it submitted, and the anonymous key is refused. Any other key gets 403 NotRequestOwner - WaitingPrompt.get_submitted_request rebuilds the body from the row, with image and text overrides restoring n, seed, seed_variation and softprompt from their own columns. derive_submitted_request_model derives the response models from the input models, dropping dry_run, allow_downgrade, replacement_filter and style, which leave no trace on the row - Account views no longer list shared-key-funded request IDs in active_generations, even for moderators. Cache keys for those views are versioned so entries written before this change are ignored, and refresh_cache clears the new keys - GET /v2/sharedkeys/<id> accepts the owner's personal key and then adds an active_usage summary (request, queued, processing and finished counts) without IDs or contents. Credentialed lookups bypass the shared response cache and every response is Cache-Control: private, no-store - Add a partial index on waiting_prompts.sharedkey_id, declared in the ORM and built concurrently in sql_statements/5.1.12.txt, so the usage summary is one indexed SELECT - Document both endpoints in README_integration.md, register NotRequestOwner in KNOWN_RC and README_return_codes.md, and cover the key check, body reconstruction, privacy and cache isolation in tests
4 lines
95 B
Plaintext
4 lines
95 B
Plaintext
SPDX-FileCopyrightText: Tazlin <tazlin@haidra.net>
|
|
|
|
SPDX-License-Identifier: AGPL-3.0-or-later
|