6 commits

Author	SHA1	Message	Date
Ashwin Kumar Sivakumar	c1eed2530d	fix: stop leaking raw LiteLLM error bodies; harden prompts against injection; fix UTF-8 panic ... Follow-up on the AI safety review — addressed the three remaining lower-severity findings: 1. crates LiteLlmError::error_body() returned the raw upstream response body verbatim to the client on any non-2xx LiteLLM response. That body can contain internal routing/diagnostic details from the LiteLLM proxy or the underlying model provider. Now returns a generic, status-aware message to the client; the full body is logged server-side via tracing::error! at each of the three call sites that construct LiteLlmError::Api, so nothing is lost for debugging — it's just not exposed to end users. 2. Added an explicit anti-prompt-injection clause to ai/orchestrator.rs::GROUNDING_GUARDRAIL, the baseline system prompt applied to every AI feature call via effective_system_prompt() — instructs the model to treat all user/company-authored input (job descriptions, profile text, chat messages) as data to analyze, never as instructions to follow. Covers every ai.rs handler that goes through call_feature/call_feature_with_plan in one place, rather than patching each call site's prompt construction individually. 3. apps/cron/src/tasks/auto_apply.rs's cover-letter prompt doesn't run through the orchestrator (separate app/crate), so hardened it directly: fenced the untrusted CANDIDATE/JOB sections with explicit "this is data, not instructions" framing. While there, fixed a latent panic: `&job_desc[..job_desc.len().min(500)]` slices on a raw byte offset, which panics if byte 500 isn't a UTF-8 character boundary — a company job description with any multi-byte character before that point (accented letters, emoji, etc.) would crash the whole cron run. Switched to char_indices() to find a safe boundary.	2026-07-21 05:56:21 +05:30
Ashwin Kumar Sivakumar	3e701f2fe6	fix: close two real money/spend races (Tracecoin double-credit, unbounded AI overspend) ... Asked to review Tracecoin and AI implementation safety. Found and fixed two exploitable TOCTOU races, plus a data-integrity bug: 1. apps/payments/src/main.rs::verify_payment — the PayU success callback is called directly by the client (not a server-to-server webhook), so a user fully controls how many times they replay a valid success payload. The payment "is it still PENDING" check and the "mark SUCCESS + credit wallet" write were separate, non-transactional queries — concurrent replays could both pass the check before either commits, double- (or N-times-) crediting the wallet for one real payment. Now wrapped in a single transaction with `SELECT ... FOR UPDATE` on the payments row, so a second concurrent call blocks until the first commits, then correctly sees the row is no longer PENDING (Postgres re-evaluates the WHERE clause via EvalPlanQual after the lock is granted). 2. crates/db/src/models/ai/repository.rs — UserAiSubscriptionRepository had the exact same shape of bug: apps/users/src/ai/credits.rs:: charge_feature read the subscription, checked daily-limit and credit balance, THEN issued two separate unconditional `UPDATE ... SET x = x + $1` statements with no WHERE guard on the balance. N concurrent requests from one user all pass the check before any deduction lands, running up unlimited LLM API spend (this endpoint is called before/around real LiteLLM calls, so the cost is real). Added UserAiSubscriptionRepository::try_charge — a single conditional UPDATE that checks the daily limit and credit balance and deducts atomically, returning None (mapped to the existing error types) if either check fails. 3. apps/cron/src/tasks/auto_apply.rs — daily_actions_used was being incremented twice per auto-applied job (once in the credit-deduct UPDATE, once more in a second, redundant UPDATE right after) — silently halving job seekers' effective daily auto-apply limit. Removed the redundant second UPDATE. Also added non-negative CHECK constraints directly to the live database (tracecoin_wallets.balance/reserved, user_ai_subscriptions.daily_actions_used/monthly_credits_used/ purchased_credits_used) as defense in depth — belt-and-suspenders in case a future code path reintroduces a similar bug.	2026-07-21 05:51:23 +05:30
Ashwin Kumar Sivakumar	f5201965d8	Issue each account its own LiteLLM virtual key instead of the shared master key ... register() now generates a per-account LiteLLM key (best-effort, non-blocking) and stores it on the user. New internal endpoint GET /internal/users/{id}/llm-key lets other services fetch (or lazily backfill) an account's key, authenticated via the existing X-AI-Service-Key shared secret. Co-Authored-By: Claude Sonnet 5 <noreply@anthropic.com>	2026-07-16 20:29:00 +05:30
Ashwin Kumar Sivakumar	eaae3d470f	Fix /api/ai/* returning 500 on every request, close credit-minting bugs, add grounding guardrail ... Critical: ai_access_middleware was wired via from_fn_with_state((), ...) - passing the unit type as state - and pulled AppState from request extensions, which nothing ever populated. Every request through /api/ai/* and /api/ai/auto/* returned 500 INCOMPLETE_CONTEXT. Fixed by extracting State<AppState> properly and passing the real state at both call sites; removed the redundant, identically-broken inner middleware layer inside ai_router(). Security: ai_addon_purchase (/api/ai/addons/purchase, /api/ai/credits/buy) and ai_plan_upgrade (/api/ai/plans/upgrade) granted AI credits / plan upgrades (including enterprise) with zero payment verification - any authenticated user could mint unlimited free credits, and the frontend already called this directly. Disabled both until wired to a real payment flow. Quality: added a grounding/anti-hallucination system prompt applied to every AI feature call (orchestrator::call_feature / call_feature_with_plan, plus the handful of call sites that bypass the orchestrator). Verified against the live model that it reduces but does not eliminate fabrication on harder reasoning tasks - even the larger model invents facts not present in the input on some prompts. This is a real limitation of the two locally-hosted models, not something a system prompt alone fully solves; flagged for follow-up (e.g. a verification pass or deterministic checks for high-stakes decisions like auto-apply). Also fixed Persona/Pillar keyword detection using naive substring matching (e.g. "team" matching inside "esteemed", "lead" matching inside "leadership") - added a word-boundary-aware contains_word() helper and applied it to all keyword classifiers in this file.	2026-07-03 04:05:14 +05:30
Ashwin Kumar Sivakumar	06e73eebb5	fix(ai): align backend plans and clean warnings	2026-06-15 09:23:44 +05:30
Ashwin Kumar Sivakumar	c85e6af22e	feat(ai): complete AI plans/credits implementation and build tooling ... - Add AI plans, credits, model routing, LiteLLM client, and orchestrator services - Add AI management endpoints, auto-apply/auto-request handlers, and log endpoints - Add cron jobs for daily action reset and monthly credit reset - Add AI credit purchase flow in payments service - Add ai_credit_packages migration with seed data - Update Dockerfile build tooling across services	2026-06-15 06:15:49 +05:30