defenseunicorns / leapfrogai

Production-ready Generative AI for local, cloud native, airgap, and edge deployments.
https://leapfrog.ai
Apache License 2.0
243 stars 25 forks source link

chore(api): Verify that AuthModel's are not returned by the data layer #648

Open gphorvath opened 1 week ago

gphorvath commented 1 week ago

Describe what should be investigated or refactored

In each of the crud objects we process an AuthModel variant of a BaseModel type. If we inadvertently return the AuthModel type, this causes the user_id to propagate and potentially be returned by an endpoint. We create a work around by deleting user_id for purposes of Runs, but perhaps we can move the logic for checking user_id into the base_crud operation and handle it there to ensure we are properly returning BaseModel

Links to any relevant code

https://github.com/defenseunicorns/leapfrogai/blob/10795b34d1a90d57cb921507289988f8dab97cc7/src/leapfrogai_api/data/crud_run.py#L27

https://github.com/defenseunicorns/leapfrogai/blob/10795b34d1a90d57cb921507289988f8dab97cc7/src/leapfrogai_api/data/crud_run.py#L9

Additional context

Add any other context or screenshots about the technical debt here.