Feat/ask ai widget serving - #9
Merged
Merged
Conversation
Tier 6 (SQLite backend, core auth only) and Tier 7 (distribution, Docker, migration DX) are specced. Three of their stated premises were checked against cryden v2.5.0 and this repo, and did not hold: - The shipped-events table is shipped_log_events, not cloud_log_shipments. - Cryden's SQLite migrations are not consolidated — they are 0001-0007, the same count and filenames as its Postgres set, so the copy is a straight 7-for-7 mirror. The instruction to keep cryden's filenames stands; the reason is self-containment, not divergence. - This repo has no migration runner at all today (cmd/ holds only grant-operator, no embed.FS in any non-test file, CI applies migrations with psql), so Tier 7's runner is greenfield rather than an extension — which turns its "not a second implementation" caution into the design. Co-Authored-By: Claude Code <noreply@anthropic.com>
askai.Service turns the LLM provider and read-only database stored in the settings table into the ai.LLMProvider/ai.QueryableStore pair cryden's widget.Config needs, and answers a question as one owner. Settings are read per question; the built pair is cached on a SHA-256 digest of them, so a saved change takes effect on the next question rather than at a restart, and a cache key never holds a credential. Co-Authored-By: Claude Code <noreply@anthropic.com>
POST /v1/ask-ai is gated on RequireAuth rather than RequireAdmin, which is the shape of the feature and not an oversight: the widget answers questions about the caller's own account, so its owner id comes from the verified token and from nowhere else. It is read-only. Co-Authored-By: Claude Code <noreply@anthropic.com>
Spec 1.7, additive: the POST /ask-ai path with its four error statuses and an AskAIAnswer schema, plus a README section on why this route is authenticated rather than admin-only. No existing path, field or status code changed. Co-Authored-By: Claude Code <noreply@anthropic.com>
Tier 4 Stage 2 said the widget GET returns no snippet because the URL in one would name an endpoint this repo does not serve. It serves one now, so that reason is dead in both places it was written. The conclusion stands on a different one: the markup belongs to the console. The same pass corrects two claims about unwired providers. Co-Authored-By: Claude Code <noreply@anthropic.com>
Closes NEXT.md's Tier 4 carry-forward in all three places it was written, and corrects that tier's own heading there: "all behind RequireAdmin" was never true of this item. PROGRESS.md gains the session entry, including the origin-path bug the tests caught and the per-user rate limit still owed. Co-Authored-By: Claude Code <noreply@anthropic.com>
This file contains hidden or bidirectional Unicode text that may be interpreted or compiled differently than what appears below. To review, open the file in an editor that reveals hidden Unicode characters.
Learn more about bidirectional Unicode characters
Sign up for free
to join this conversation on GitHub.
Already have an account?
Sign in to comment
1 participant
Add this suggestion to a batch that can be applied as a single commit.This suggestion is invalid because no changes were made to the code.Suggestions cannot be applied while the pull request is closed.Suggestions cannot be applied while viewing a subset of changes.Only one suggestion per line can be applied in a batch.Add this suggestion to a batch that can be applied as a single commit.Applying suggestions on deleted lines is not supported.You must change the existing code in this line in order to create a valid suggestion.Outdated suggestions cannot be applied.This suggestion has been applied or marked resolved.Suggestions cannot be applied from pending reviews.Suggestions cannot be applied on multi-line comments.Suggestions cannot be applied while the pull request is queued to merge.Suggestion cannot be applied right now. Please check back later.
No description provided.