nxtgauge-ai-assistant

ashwin/nxtgauge-ai-assistant

Fork 0

Commit graph

Author	SHA1	Message	Date
Ashwin Kumar Sivakumar	23a707e175	Fix security audit findings: IDOR, rate limiting, action audit trail All checks were successful build-and-release / build (push) Successful in 4m14s Details - Chat and ticket-creation endpoints now scope lookups/attribution to the authenticated JWT identity instead of trusting a client-supplied user_id in the request body (IDOR) - Add per-user in-memory rate limiter on AI-generation endpoints to guard against unbounded LLM-cost abuse - Bind confirm_action to the authenticated user for audit logging - Bump vulnerable transitive dependencies via cargo update Co-Authored-By: Claude Sonnet 5 <noreply@anthropic.com>	2026-07-23 17:32:01 +05:30
Ashwin Kumar Sivakumar	e33ed2192c	Update workflows and source files	2026-07-02 06:51:03 +05:30
Tracewebstudio Dev	4505d8987e	feat: add Ask Ash AI assistant implementation - Add LiteLLM provider with LLM_PROVIDER env var support - Add Fake LLM provider for testing - Add action registry with 17 AI actions - Add permission checker with role verification - Add UI events in chat responses (fill_form, open_preview, etc) - Add versioned prompt files system - Add confirm action endpoint - Add 80 unit tests New endpoints: - POST /api/ai/actions/confirm New files: - src/handlers/actions.rs - src/handlers/confirm_action.rs - src/services/action_confirmation.rs - src/prompts.rs - src/tests.rs - prompts/v1/*.txt	2026-06-14 20:28:17 +02:00

Author

SHA1

Message

Date

Ashwin Kumar Sivakumar

23a707e175

Fix security audit findings: IDOR, rate limiting, action audit trail

build-and-release / build (push) Successful in 4m14s

Details

- Chat and ticket-creation endpoints now scope lookups/attribution to
  the authenticated JWT identity instead of trusting a client-supplied
  user_id in the request body (IDOR)
- Add per-user in-memory rate limiter on AI-generation endpoints to
  guard against unbounded LLM-cost abuse
- Bind confirm_action to the authenticated user for audit logging
- Bump vulnerable transitive dependencies via cargo update

Co-Authored-By: Claude Sonnet 5 <noreply@anthropic.com>

2026-07-23 17:32:01 +05:30

Ashwin Kumar Sivakumar

e33ed2192c

Update workflows and source files

2026-07-02 06:51:03 +05:30

Tracewebstudio Dev

4505d8987e

feat: add Ask Ash AI assistant implementation

- Add LiteLLM provider with LLM_PROVIDER env var support
- Add Fake LLM provider for testing
- Add action registry with 17 AI actions
- Add permission checker with role verification
- Add UI events in chat responses (fill_form, open_preview, etc)
- Add versioned prompt files system
- Add confirm action endpoint
- Add 80 unit tests

New endpoints:
- POST /api/ai/actions/confirm

New files:
- src/handlers/actions.rs
- src/handlers/confirm_action.rs
- src/services/action_confirmation.rs
- src/prompts.rs
- src/tests.rs
- prompts/v1/*.txt

2026-06-14 20:28:17 +02:00

3 commits