4c48a5cf94
Security:
- admin.py: move api_key from URL query params to POST body (litellm/models, tts/voices) — prevents key logging
- admin.py: sanitize exception messages in voice discovery — log internally, return generic errors
- teach.py: log LLM errors server-side, show friendly message to user
- nextcloud.py: normalize path with posixpath.normpath to prevent ../ traversal
- auth.py: check_rate_limit now accepts user param — admins/moderators/unthrottled always exempt
Performance:
- teach.py: make /chat endpoint async, use litellm.acompletion() — no longer blocks a uvicorn thread per request
Features:
- users: add is_unthrottled column (DB migration in setup_pgvector)
- admin.py: PUT /users/{id}/unthrottle endpoint
- AdminPage.jsx: Unlimited/Throttle toggle button per user, shows "unlimited" badge
- Rate limit messages improved with user-friendly context
Co-Authored-By: Claude Sonnet 4.6 <noreply@anthropic.com>
32 lines
1.1 KiB
Python
32 lines
1.1 KiB
Python
from datetime import datetime
|
|
|
|
from sqlalchemy import Column, Integer, String, DateTime
|
|
from sqlalchemy.orm import relationship
|
|
|
|
from app.database import Base
|
|
|
|
|
|
class User(Base):
|
|
__tablename__ = "users"
|
|
|
|
id = Column(Integer, primary_key=True, index=True)
|
|
email = Column(String, unique=True, index=True, nullable=False)
|
|
hashed_password = Column(String, nullable=False)
|
|
name = Column(String, nullable=False)
|
|
role = Column(String, default="user") # admin, moderator, user
|
|
is_unthrottled = Column(Integer, default=0) # 1 = exempt from rate limits
|
|
created_at = Column(DateTime, default=datetime.utcnow)
|
|
|
|
documents = relationship("PDFDocument", back_populates="user")
|
|
quizzes = relationship("Quiz", back_populates="user")
|
|
attempts = relationship("QuizAttempt", back_populates="user")
|
|
reminders = relationship("ReminderSchedule", back_populates="user")
|
|
favorites = relationship("Favorite", back_populates="user", cascade="all, delete-orphan")
|
|
|
|
@property
|
|
def is_admin(self):
|
|
return self.role == "admin"
|
|
|
|
@property
|
|
def is_moderator(self):
|
|
return self.role in ("admin", "moderator")
|