ducoterra
03d26255c6
Phase 49 (owner request, chat 2026-08-28: "The git sources page should remove local directory and should instead accept a tarball or zipfile upload which it will unpack and scan … reuploading the same tarball should not create a new folder, but should unpack and overwrite the previously unpacked content" — design confirmed in the same conversation): * POST /api/git-sources/upload (admin-only, require_admin): accepts .tar/.tar.gz/.tgz/.zip, streams it with the BOR_UPLOAD_MAX_MB cap (bounds BOTH the compressed upload and the total extracted bytes — zip-bomb guard), safely unpacks (absolute/traversal/symlink/hardlink escape and device/FIFO members rejected), and atomically swaps the content in over BOR_UPLOAD_DIR/<name>/ (name = filename minus the archive suffix — no missing window, a failed upload never touches the existing folder/row/KB). The git_sources row is upserted by path (kind='local', no duplicates, added_at preserved), the models are checked fail-fast (503 sanitized when down — the folder/row stay committed and the next sync/re-upload retries idempotently), and the source is scanned synchronously in the request (single-source import_sources prune=True + change-gated KB overview), answering 200 with the sync-style counts. One upload at a time (409); the request session is released before the scan so a concurrent TRUNCATE cannot deadlock against it. * app/rag/archive_upload.py: ArchiveUploadError, ARCHIVE_SUFFIXES, archive_source_name (safe-name derivation), unpack_archive (guarded zip/tar extraction with the extracted-byte cap, no partial state), swap_in (atomic replace with restore-on-failure) — fully unit-tested. * app/config.py + .env.example: BOR_UPLOAD_DIR (default ~/bor-sources/uploads, deliberately separate from the git checkouts) and BOR_UPLOAD_MAX_MB (default 512; a validator fails loud at startup on <= 0). * python-multipart added to the dependencies — FastAPI's required multipart parser (an A2 implementation detail, phase locked decision). * The Sources page: the phase-38 "Add a local directory" form is removed; #archive-upload-form takes its place (labeled file input, "Upload & scan" button, the §7.4 never-stale lifecycle, inline role=alert error, role=status count line); hint + table caption updated. The POST /api/git-sources kind=local API contract is UNCHANGED — a plain directory is still registrable via the API, and existing Local rows list/remove/sync exactly as before. * The phase-38 story E2E (test_local_directory_sources.py) is rewritten API-driven — the form it drove is gone; its acceptance stands. * The story E2E (test_archive_upload_sources.py): the swap, upload→scan→list (the deterministic "Uploading…" in-flight state, the Local row, /api/docs + the RAG catalog), same-filename re-upload (in-place replace, prune, no duplicate row, v2-only folder), the 422 inline error + recovery (the form is not wedged), and the anonymous gate + 403. * README: the archive-upload section (formats, naming rule, in-place replace, both new settings), the local-directory form removal noted, config reference rows for BOR_UPLOAD_DIR / BOR_UPLOAD_MAX_MB. Gates: unit+integration green, app/ coverage 99%, the story E2E green in isolation, the regression suites (git sources admin, local directory sources, sync button, import documents, nav rename, smoke, shared header) green in isolation, ruff + pyright clean. Note: per this phase's file-level staging, frontend/assets/styles.css also carries the small same-day in-flight owner rework already in the working tree (the .sign-in-mobile companion rule for the phase-48 mobile sign-in copy); the phase-49 change is the upload form's block.
58 lines
1.7 KiB
TOML
58 lines
1.7 KiB
TOML
[project]
|
|
name = "brain-of-reese"
|
|
version = "0.1.0"
|
|
description = "Brain of Reese — a chippy RAG chatbot that answers questions about Reese's Homelab and Deployments, powered by self-hosted models."
|
|
readme = "README.md"
|
|
requires-python = ">=3.12"
|
|
dependencies = [
|
|
# --- Web framework ---
|
|
"fastapi>=0.115,<1.0",
|
|
"uvicorn[standard]>=0.30,<1.0",
|
|
"pydantic>=2.7,<3.0",
|
|
"pydantic-settings>=2.3,<3.0",
|
|
"python-dotenv>=1.0,<2.0",
|
|
# --- Database (PostgreSQL 17 + pgvector) ---
|
|
"sqlalchemy>=2.0,<2.1",
|
|
"alembic>=1.13,<2.0",
|
|
"psycopg[binary]>=3.1,<4.0",
|
|
"pgvector>=0.3,<1.0",
|
|
# --- LLM client (OpenAI-compatible, self-hosted "aipi") ---
|
|
"httpx>=0.27,<1.0",
|
|
"openai>=1.40,<3.0",
|
|
# Phase 16: starlette's SessionMiddleware signs the session cookie with
|
|
# itsdangerous — an OPTIONAL starlette extra ("full") since starlette 1.x,
|
|
# so the app declares it directly (narrower than starlette[full]).
|
|
"itsdangerous>=2.2,<3.0",
|
|
# Phase 49: FastAPI's multipart parser for the archive upload form
|
|
# (POST /api/git-sources/upload) — an A2 FastAPI implementation detail,
|
|
# not a new architectural anchor (phase 49 locked decisions).
|
|
"python-multipart>=0.0.9,<0.1",
|
|
]
|
|
|
|
[dependency-groups]
|
|
dev = [
|
|
"debugpy>=1.8",
|
|
"ruff>=0.5",
|
|
"pyright>=1.1",
|
|
"pytest>=8.2",
|
|
"pytest-cov>=5.0",
|
|
"playwright>=1.45",
|
|
]
|
|
|
|
[tool.ruff]
|
|
line-length = 100
|
|
target-version = "py312"
|
|
|
|
[tool.ruff.lint]
|
|
select = ["E", "F", "W", "I", "UP", "B", "SIM"]
|
|
|
|
[tool.pyright]
|
|
pythonVersion = "3.12"
|
|
typeCheckingMode = "standard"
|
|
include = ["app", "scripts", "alembic", "tests"]
|
|
|
|
[tool.pytest.ini_options]
|
|
testpaths = ["tests/unit", "tests/integration"]
|
|
pythonpath = ["."]
|
|
addopts = "-q"
|