Skip to content

Bump and other fixes #161

New issue

Have a question about this project? Sign up for a free GitHub account to open an issue and contact its maintainers and the community.

Sign up for GitHub

By clicking “Sign up for GitHub”, you agree to our terms of service and privacy statement. We’ll occasionally send you account related emails.

Already on GitHub? Sign in to your account

Merged
eranco74 merged 1 commit into from
Aug 28, 2025
Merged

Bump and other fixes #161

Show file tree
Hide file tree
Changes from all commits
Commits
Show all changes
1 commit
Select commit
File filter

Filter by extension

Filter by extension
Conversations
Failed to load comments.
Loading
Jump to
Jump to file
Failed to load files.
Loading
Diff view
Diff view
4 changes: 2 additions & 2 deletions Containerfile.assisted-chat
View file
Open in desktop
Original file line number Diff line number Diff line change
@@ -1,6 +1,6 @@
# vim: set filetype=dockerfile
# This is the digest of quay.io/lightspeed-core/lightspeed-stack:dev-20250827-3e2d883
FROM quay.io/lightspeed-core/lightspeed-stack@sha256:0171ec44c1684e0eb2961366a0e0cfcf99be49f25a28248deccc38dceef068ca
# This is the digest of quay.io/lightspeed-core/lightspeed-stack:dev-20250828-691c83e
FROM quay.io/lightspeed-core/lightspeed-stack@sha256:f1ec2f3880b0da80279aee20abb1cb20d681b244c17133470bb9399a75bc423e

USER 1001

Expand Down
4 changes: 4 additions & 0 deletions assisted-chat-pod.yaml
View file
Open in desktop
Original file line number Diff line number Diff line change
Expand Up @@ -38,6 +38,10 @@ spec:
name: config
subPath: vertex-credentials.json
readOnly: true
- mountPath: /etc/tls/ca-bundle.pem
name: config
subPath: ca-bundle.pem
readOnly: true
- name: assisted-service-mcp
image: localhost/local-ai-chat-assisted-service-mcp:latest
env:
Expand Down
Empty file added config/ca-bundle.pem
View file
Open in desktop
Empty file.
2 changes: 1 addition & 1 deletion lightspeed-stack
Open in desktop
Submodule lightspeed-stack updated 4 files
+1 −2 src/auth/jwk_token.py
+14 −2 src/authorization/resolvers.py
+3 −12 tests/unit/auth/test_jwk_token.py
+16 −2 tests/unit/authorization/test_resolvers.py
2 changes: 1 addition & 1 deletion scripts/query.sh
View file
Open in desktop
Original file line number Diff line number Diff line change
Expand Up @@ -27,7 +27,7 @@ case "${QUERY_ENV:-}" in
esac

get_available_models() {
curl --silent --show-error -X 'GET' "${BASE_URL}/v1/models" -H 'accept: application/json'
curl --silent --show-error -X 'GET' "${BASE_URL}/v1/models" -H 'accept: application/json' -H "Authorization: Bearer ${OCM_TOKEN}"
}
Comment on lines 29 to 31
Copy link

@coderabbitai coderabbitai bot Aug 28, 2025

Choose a reason for hiding this comment

The reason will be displayed to describe this comment to others. Learn more.

🛠️ Refactor suggestion

Harden token handling and HTTP error checks for models call.

With set -u, ${OCM_TOKEN} unbound will abort; also no status handling here unlike other calls.

Apply:

 get_available_models() {
-    curl --silent --show-error -X 'GET' "${BASE_URL}/v1/models" -H 'accept: application/json' -H "Authorization: Bearer ${OCM_TOKEN}"
+    # Ensure token present (and fetch if not)
+    if [[ -z "${OCM_TOKEN:-}" ]]; then
+        if ! get_ocm_token; then
+            echo "Failed to get OCM token for models"
+            return 1
+        fi
+    fi
+    tmpfile=$(mktemp)
+    status=$(curl --silent --show-error --output "$tmpfile" --write-out "%{http_code}" \
+        -H 'accept: application/json' \
+        -H "Authorization: Bearer ${OCM_TOKEN}" \
+        "${BASE_URL}/v1/models")
+    body=$(cat "$tmpfile"); rm "$tmpfile"
+    if ! good_http_response "$status"; then
+        echo "Error: Failed to fetch models (HTTP $status)"
+        echo "Response: $body"
+        return 1
+    fi
+    echo "$body"
 }
📝 Committable suggestion

‼️ IMPORTANT
Carefully review the code before committing. Ensure that it accurately replaces the highlighted code, contains no missing lines, and has no issues with indentation. Thoroughly test & benchmark the code to ensure it meets the requirements.

Suggested change
get_available_models() {
curl --silent --show-error -X 'GET' "${BASE_URL}/v1/models" -H 'accept: application/json'
curl --silent --show-error -X 'GET' "${BASE_URL}/v1/models" -H 'accept: application/json' -H "Authorization: Bearer ${OCM_TOKEN}"
}
get_available_models() {
# Ensure token present (and fetch if not)
if [[ -z "${OCM_TOKEN:-}" ]]; then
if ! get_ocm_token; then
echo "Failed to get OCM token for models"
return 1
fi
fi
tmpfile=$(mktemp)
status=$(curl --silent --show-error --output "$tmpfile" --write-out "%{http_code}" \
-H 'accept: application/json' \
-H "Authorization: Bearer ${OCM_TOKEN}" \
"${BASE_URL}/v1/models")
body=$(cat "$tmpfile"); rm "$tmpfile"
if ! good_http_response "$status"; then
echo "Error: Failed to fetch models (HTTP $status)"
echo "Response: $body"
return 1
fi
echo "$body"
}


select_model() {
Expand Down
45 changes: 45 additions & 0 deletions template.yaml
View file
Open in desktop
Original file line number Diff line number Diff line change
Expand Up @@ -165,6 +165,51 @@ objects:
jwt_configuration:
user_id_claim: ${USER_ID_CLAIM}
username_claim: ${USERNAME_CLAIM}
role_rules:
- jsonpath: "$.realm_access.roles[*]"
operator: "contains"
value: "redhat:employees"
roles: ["redhat_employee"]
- jsonpath: "$.org_id"
operator: "in"
value: [["6405426"]]
roles: ["redhat_employee"]
- jsonpath: "$.is_internal"
operator: "equals"
value: [true]
roles: ["redhat_employee"]
authorization:
access_rules:
- role: redhat_employee
actions:
- get_models
# Temporarily we only want redhat employees to be able to use the service,
# uncomment when we want to allow all authenticated users
# - role: "*"
# actions:
- query
- streaming_query
- get_conversation
- list_conversations
- delete_conversation
- feedback
# "nobody" is a made up role, doesn't do anything but just good for being explicit
# about what is not allowed by anyone
- role: nobody
actions:
# This exposes the database password - once LSC fixes this issue we
# can allow this for employees
- get_config
# For now we don't want to let even administrators / employees access other users conversations
- query_other_conversations
- delete_other_conversations
- list_other_conversations
- read_other_conversations
# For k8s pod probes
- role: "*"
actions:
- info
- get_metrics
mcp_servers:
- name: mcp::assisted
url: "${MCP_SERVER_URL}"
Expand Down