0.9.0: Introducing dynamic ingest secret

.env.template

@@ -1,6 +1,7 @@
 REPO_NAME=MyRepo
 REPO_URL=https://github.com/user/MyRepo.git
 REPO_PATH=./examples
+INGEST_SECRET=9640f515-fd2c-4403-845f-71b25fc9086c
 OPENAI_API_KEY=XXX
 MODEL_TYPE_INFERENCE=gpt-4o-mini
 MODEL_TYPE_EMBEDDING=text-embedding-3-small

README.md

@@ -130,6 +130,7 @@ make dev
 - [x] API data chat
 - [x] GitHub Actions release
 - [ ] Secure ingestion endpoint (/api/ingest)
+- [ ] Secure RepoChat with optional password
 
 ## Why not use Vercel ?
 

action/index.js

@@ -6,18 +6,24 @@ import { Container, createClient } from '@scaleway/sdk';
 
 const providers = ['scaleway'];
 
+function uuidv4() {
+  return "10000000-1000-4000-8000-100000000000".replace(/[018]/g, c =>
+    (+c ^ crypto.getRandomValues(new Uint8Array(1))[0] & 15 >> +c / 4).toString(16)
+  );
+}
+
 function isValidFile(filePath) {
   return fs.statSync(filePath).isFile() && !path.basename(filePath).startsWith('.');
 }
 
-async function sendFileToApi(filePath, apiUrl) {
+async function sendFileToApi(filePath, apiUrl, ingestSecret) {
   const content = fs.readFileSync(filePath, { encoding: 'base64' });
   const metadata = { 'source': path.basename(filePath) };
   const payload = { 'content': content, 'metadata': metadata };
 
   try {
     console.log(`Sending: ${filePath}`);
-    const response = await axios.post(apiUrl, payload, { headers: { 'Content-Type': 'application/json' } });
+    const response = await axios.post(apiUrl, payload, { headers: { 'Content-Type': 'application/json', 'X-Ingest-Secret': ingestSecret } });
     return response;
   } catch (error) {
     console.error(`Error sending file: ${error.message}`);
@@ -34,7 +40,7 @@ function isExcluded(filePath, excludeFiles) {
 
 async function processFile(filePath, apiUrl) {
   console.log(`Sending file: ${filePath}`);
-  const response = await sendFileToApi(filePath, apiUrl);
+  const response = await sendFileToApi(filePath, apiUrl, ingestSecret);
   if (response.status === 200) {
     console.log(`Successfully ingested: ${filePath}`);
   } else {
@@ -86,6 +92,7 @@ try {
   const providerProjectId = core.getInput('provider_project_id');
   const providerDefaultRegion = core.getInput('provider_default_region');
   const providerDefaultZone = core.getInput('provider_default_zone');
+  const ingestSecret = uuidv4();
 
   // Check required parameters
   if (!dirsToScan) {
@@ -176,6 +183,7 @@ try {
         OPENAI_API_KEY: openaiApiKey,
         MODEL_TYPE_INFERENCE: openaiModelTypeInference,
         MODEL_TYPE_EMBEDDING: openaiModelTypeEmbedding,
+        INGEST_SECRET: ingestSecret,
         REPO_NAME: process.env.GITHUB_REPOSITORY,
         REPO_URL: `https://github.com/${process.env.GITHUB_REPOSITORY}`,
         MODE: 'api'
@@ -247,7 +255,7 @@ try {
       // Wait for settings endpoint to be available
       const settingsEndpoint = 'https://' + containerEndpoint + '/api/settings';
       try {
-        console.log('Checking settings endpoint:', settingsEndpoint);
+        console.log('Checking settings endpoint...');
         const startTime = Date.now();
         const timeout = 30000; // 30 seconds timeout
 

api.docker-compose.yml

@@ -6,6 +6,7 @@ services:
       REPO_NAME: ${REPO_NAME}
       REPO_URL: ${REPO_URL}
       OPENAI_API_KEY: ${OPENAI_API_KEY}
+      INGEST_SECRET: ${INGEST_SECRET}
       MODEL_TYPE_INFERENCE: ${MODEL_TYPE_INFERENCE}
       MODEL_TYPE_EMBEDDING: ${MODEL_TYPE_EMBEDDING}
       CLEAR_DB_AT_RESTART: ${CLEAR_DB_AT_RESTART}

api/config.py

@@ -11,6 +11,7 @@
 REPO_NAME = os.environ['REPO_NAME'].strip()
 REPO_URL = os.getenv('REPO_URL', '').strip()
 REPO_PATH = os.getenv('REPO_PATH', '').strip()
+INGEST_SECRET = os.environ['INGEST_SECRET'].strip()
 OPEN_AI_API_KEY = os.environ['OPENAI_API_KEY'].strip()
 MODEL_TYPE_INFERENCE = os.environ['MODEL_TYPE_INFERENCE'].strip()
 MODEL_TYPE_EMBEDDING = os.environ['MODEL_TYPE_EMBEDDING'].strip()

api/index.py

@@ -3,7 +3,7 @@
 import binascii
 import shutil
 import logging
-from fastapi import FastAPI, HTTPException
+from fastapi import FastAPI, HTTPException, Header
 from pydantic import BaseModel
 from api.dir_loader import DirLoader
 from api.api_loader import APILoader
@@ -14,6 +14,7 @@
     MODEL_TYPE_INFERENCE,
     MODEL_TYPE_EMBEDDING,
     PERSIST_DIRECTORY,
+    INGEST_SECRET,
     REPO_NAME,
     REPO_PATH,
     REPO_URL,
@@ -88,9 +89,11 @@ class IngestData(BaseModel):
     metadata: dict
 
 @app.post("/api/ingest")
-async def ingest(data: IngestData):
+async def ingest(data: IngestData, x_ingest_secret: str = Header(..., alias="X-Ingest-Secret")):
     if MODE != "api":
-        raise HTTPException(status_code=400, detail="Ingestion is only available in API mode")
+        raise HTTPException(status_code=400, detail="Ingestion is only available in API mode (set env MODE=api)")
+    if x_ingest_secret != INGEST_SECRET:
+        raise HTTPException(status_code=401, detail="Invalid ingest secret")
     try:
         decoded_content = base64.b64decode(data.content).decode('utf-8')
         if not decoded_content.strip():

app/app/page.jsx

@@ -37,7 +37,7 @@ export default function Home() {
             </div>
           </div>
           <footer className="w-full text-center py-4 text-white bg-transparent">
-            <p>Made by <a href="https://github.com/flavienbwk/repochat-action" target="_blank" rel="noopener noreferrer" className="underline">flavienbwk</a></p>
+            <p>Deployed with <a href="https://github.com/flavienbwk/repochat-action" target="_blank" rel="noopener noreferrer" className="underline">RepoChat</a></p>
           </footer>
         </div>
       </body>

dir.docker-compose.yml

@@ -7,6 +7,7 @@ services:
       REPO_URL: ${REPO_URL}
       REPO_PATH: ${REPO_PATH}
       OPENAI_API_KEY: ${OPENAI_API_KEY}
+      INGEST_SECRET: ${INGEST_SECRET}
       MODEL_TYPE_INFERENCE: ${MODEL_TYPE_INFERENCE}
       MODEL_TYPE_EMBEDDING: ${MODEL_TYPE_EMBEDDING}
       CLEAR_DB_AT_RESTART: ${CLEAR_DB_AT_RESTART}