23a707e175
All checks were successful
build-and-release / build (push) Successful in 4m14s
- Chat and ticket-creation endpoints now scope lookups/attribution to the authenticated JWT identity instead of trusting a client-supplied user_id in the request body (IDOR) - Add per-user in-memory rate limiter on AI-generation endpoints to guard against unbounded LLM-cost abuse - Bind confirm_action to the authenticated user for audit logging - Bump vulnerable transitive dependencies via cargo update Co-Authored-By: Claude Sonnet 5 <noreply@anthropic.com>
29 lines
699 B
Rust
29 lines
699 B
Rust
use axum::{
|
|
extract::{Extension, State},
|
|
Json,
|
|
};
|
|
|
|
use crate::{
|
|
auth::AuthUser,
|
|
chat::models::{ChatMessageRequest, ChatMessageResponse},
|
|
error::AppError,
|
|
state::AppState,
|
|
};
|
|
|
|
pub async fn message(
|
|
State(state): State<AppState>,
|
|
Extension(auth_user): Extension<AuthUser>,
|
|
Json(request): Json<ChatMessageRequest>,
|
|
) -> Result<Json<ChatMessageResponse>, AppError> {
|
|
if request.message.trim().is_empty() {
|
|
return Err(AppError::BadRequest(
|
|
"message must not be empty".to_string(),
|
|
));
|
|
}
|
|
|
|
let response = state
|
|
.chat_orchestrator
|
|
.handle_chat(request, &auth_user.user_id)
|
|
.await?;
|
|
Ok(Json(response))
|
|
}
|