-
Notifications
You must be signed in to change notification settings - Fork 0
02: backend-setup #1
New issue
Have a question about this project? Sign up for a free GitHub account to open an issue and contact its maintainers and the community.
By clicking “Sign up for GitHub”, you agree to our terms of service and privacy statement. We’ll occasionally send you account related emails.
Already on GitHub? Sign in to your account
Changes from all commits
File filter
Filter by extension
Conversations
Jump to
Diff view
Diff view
There are no files selected for viewing
| Original file line number | Diff line number | Diff line change |
|---|---|---|
| @@ -0,0 +1,72 @@ | ||
| # Python | ||
| __pycache__/ | ||
| *.py[cod] | ||
| *.pyo | ||
| *.pyd | ||
| .Python | ||
| *.egg | ||
| *.egg-info/ | ||
| dist/ | ||
| build/ | ||
| eggs/ | ||
| parts/ | ||
| var/ | ||
| sdist/ | ||
| develop-eggs/ | ||
| .installed.cfg | ||
| lib/ | ||
| lib64/ | ||
|
|
||
| # Virtual Environment | ||
| venv/ | ||
| .venv/ | ||
| env/ | ||
| ENV/ | ||
|
|
||
| # Environment Variables | ||
| .env | ||
| .env.local | ||
| .env.development | ||
| .env.production | ||
|
|
||
| # Next.js | ||
| .next/ | ||
| out/ | ||
| node_modules/ | ||
| npm-debug.log* | ||
| yarn-debug.log* | ||
| yarn-error.log* | ||
| pnpm-debug.log* | ||
|
|
||
| # Build | ||
| dist/ | ||
| build/ | ||
|
|
||
| # Database | ||
| *.db | ||
| *.sqlite | ||
| *.sqlite3 | ||
|
|
||
| # Logs | ||
| logs/ | ||
| *.log | ||
|
|
||
| # OS | ||
| .DS_Store | ||
| Thumbs.db | ||
| desktop.ini | ||
|
|
||
| # IDE | ||
| .vscode/settings.json | ||
| .idea/ | ||
| *.swp | ||
| *.swo | ||
|
|
||
| # Exports | ||
| backend/exports/ | ||
|
|
||
| # Prisma | ||
| prisma/dev.db | ||
|
|
||
| # pnpm | ||
| .pnpm-store/ | ||
| Original file line number | Diff line number | Diff line change |
|---|---|---|
| @@ -0,0 +1,18 @@ | ||
| APP_NAME=Inferix | ||
| APP_ENV=development | ||
| APP_PORT=8000 | ||
| DEBUG=True | ||
|
|
||
| DATABASE_URL=postgresql://dummy:dummy@localhost/inferix | ||
|
|
||
| OLLAMA_BASE_URL=http://localhost:11434 | ||
| OLLAMA_MODEL_1=gemma:2b | ||
| OLLAMA_MODEL_2=phi3:mini | ||
| OLLAMA_MODEL_3=llama3.2:3b | ||
|
|
||
| CLERK_SECRET_KEY=dummy_secret_key | ||
| CLERK_PUBLISHABLE_KEY=dummy_publishable_key | ||
|
|
||
| ALLOWED_ORIGINS=http://localhost:3000 | ||
|
|
||
| EXPORT_DIR=./exports | ||
|
Comment on lines
+1
to
+18
There was a problem hiding this comment. Choose a reason for hiding this commentThe reason will be displayed to describe this comment to others. Learn more. Do not commit This file is the downstream consequence of the git tracking issue flagged in See the 🧰 Tools🪛 dotenv-linter (4.0.0)[warning] 2-2: [UnorderedKey] The APP_ENV key should go before the APP_NAME key (UnorderedKey) [warning] 14-14: [UnorderedKey] The CLERK_PUBLISHABLE_KEY key should go before the CLERK_SECRET_KEY key (UnorderedKey) 🤖 Prompt for AI Agents |
||
| Original file line number | Diff line number | Diff line change |
|---|---|---|
| @@ -0,0 +1,24 @@ | ||
| # App | ||
| APP_NAME=Inferix | ||
| APP_ENV=development | ||
| APP_PORT=8000 | ||
| DEBUG=True | ||
|
|
||
| # Database — NeonDB | ||
| DATABASE_URL=your_neondb_connection_string_here | ||
|
|
||
| # Ollama | ||
| OLLAMA_BASE_URL=http://localhost:11434 | ||
| OLLAMA_MODEL_1=gemma:2b | ||
| OLLAMA_MODEL_2=phi3:mini | ||
| OLLAMA_MODEL_3=llama3.2:3b | ||
|
|
||
| # Auth — Clerk | ||
| CLERK_SECRET_KEY=your_clerk_secret_key_here | ||
| CLERK_PUBLISHABLE_KEY=your_clerk_publishable_key_here | ||
|
|
||
| # CORS | ||
| ALLOWED_ORIGINS=http://localhost:3000 | ||
|
|
||
| # Export | ||
| EXPORT_DIR=./exports |
| Original file line number | Diff line number | Diff line change | ||||
|---|---|---|---|---|---|---|
| @@ -0,0 +1,40 @@ | ||||||
| from pydantic_settings import BaseSettings | ||||||
| from typing import List | ||||||
|
|
||||||
| class Settings(BaseSettings): | ||||||
| # App | ||||||
| APP_NAME: str = "Inferix" | ||||||
| APP_ENV: str = "development" | ||||||
| APP_PORT: int = 8000 | ||||||
| DEBUG: bool = True | ||||||
|
There was a problem hiding this comment. Choose a reason for hiding this commentThe reason will be displayed to describe this comment to others. Learn more.
If this service is ever deployed without an explicit 🔒 Proposed fix- DEBUG: bool = True
+ DEBUG: bool = False📝 Committable suggestion
Suggested change
🤖 Prompt for AI Agents |
||||||
|
|
||||||
| # Database | ||||||
| DATABASE_URL: str | ||||||
|
|
||||||
| # Ollama | ||||||
| OLLAMA_BASE_URL: str = "http://localhost:11434" | ||||||
| OLLAMA_MODEL_1: str = "gemma:2b" | ||||||
| OLLAMA_MODEL_2: str = "phi3:mini" | ||||||
| OLLAMA_MODEL_3: str = "llama3.2:3b" | ||||||
|
|
||||||
| # Auth - Clerk | ||||||
| CLERK_SECRET_KEY: str | ||||||
| CLERK_PUBLISHABLE_KEY: str | ||||||
|
|
||||||
| # CORS | ||||||
| ALLOWED_ORIGINS: str = "http://localhost:3000" | ||||||
|
|
||||||
| # Export | ||||||
| EXPORT_DIR: str = "./exports" | ||||||
|
|
||||||
| @property | ||||||
| def OLLAMA_MODELS(self) -> List[str]: | ||||||
| return [ | ||||||
| self.OLLAMA_MODEL_1, | ||||||
| self.OLLAMA_MODEL_2, | ||||||
| self.OLLAMA_MODEL_3 | ||||||
| ] | ||||||
|
|
||||||
| model_config = {"env_file": ".env", "extra": "ignore"} | ||||||
|
|
||||||
| settings = Settings() | ||||||
| Original file line number | Diff line number | Diff line change |
|---|---|---|
| @@ -0,0 +1,3 @@ | ||
| from fastapi import APIRouter | ||
|
|
||
| router = APIRouter() |
| Original file line number | Diff line number | Diff line change |
|---|---|---|
| @@ -0,0 +1,3 @@ | ||
| from fastapi import APIRouter | ||
|
|
||
| router = APIRouter() |
| Original file line number | Diff line number | Diff line change |
|---|---|---|
| @@ -0,0 +1,3 @@ | ||
| from fastapi import APIRouter | ||
|
|
||
| router = APIRouter() |
| Original file line number | Diff line number | Diff line change |
|---|---|---|
| @@ -0,0 +1,3 @@ | ||
| from fastapi import APIRouter | ||
|
|
||
| router = APIRouter() |
| Original file line number | Diff line number | Diff line change |
|---|---|---|
| @@ -0,0 +1,3 @@ | ||
| from fastapi import APIRouter | ||
|
|
||
| router = APIRouter() |
| Original file line number | Diff line number | Diff line change |
|---|---|---|
| @@ -0,0 +1,3 @@ | ||
| from fastapi import APIRouter | ||
|
|
||
| router = APIRouter() |
| Original file line number | Diff line number | Diff line change |
|---|---|---|
| @@ -0,0 +1,3 @@ | ||
| from fastapi import APIRouter | ||
|
|
||
| router = APIRouter() |
| Original file line number | Diff line number | Diff line change |
|---|---|---|
| @@ -0,0 +1,3 @@ | ||
| from fastapi import APIRouter | ||
|
|
||
| router = APIRouter() |
| Original file line number | Diff line number | Diff line change |
|---|---|---|
| @@ -0,0 +1,3 @@ | ||
| from fastapi import APIRouter | ||
|
|
||
| router = APIRouter() |
| Original file line number | Diff line number | Diff line change | ||||||||||||||||||||||||||||
|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|
| @@ -0,0 +1,56 @@ | ||||||||||||||||||||||||||||||
| from fastapi import FastAPI | ||||||||||||||||||||||||||||||
| from fastapi.middleware.cors import CORSMiddleware | ||||||||||||||||||||||||||||||
| from contextlib import asynccontextmanager | ||||||||||||||||||||||||||||||
| from app.core.config import settings | ||||||||||||||||||||||||||||||
| from app.routers import ( | ||||||||||||||||||||||||||||||
| chat, benchmark, compare, | ||||||||||||||||||||||||||||||
| models, templates, report, | ||||||||||||||||||||||||||||||
| export, ai, voice | ||||||||||||||||||||||||||||||
| ) | ||||||||||||||||||||||||||||||
|
|
||||||||||||||||||||||||||||||
| @asynccontextmanager | ||||||||||||||||||||||||||||||
| async def lifespan(app: FastAPI): | ||||||||||||||||||||||||||||||
| print(f"🚀 Inferix Backend starting on port {settings.APP_PORT}") | ||||||||||||||||||||||||||||||
| print(f"🤖 Ollama URL: {settings.OLLAMA_BASE_URL}") | ||||||||||||||||||||||||||||||
| yield | ||||||||||||||||||||||||||||||
| print("🛑 Inferix Backend shutting down...") | ||||||||||||||||||||||||||||||
|
|
||||||||||||||||||||||||||||||
| app = FastAPI( | ||||||||||||||||||||||||||||||
| title="Inferix API", | ||||||||||||||||||||||||||||||
| description="Privacy-first, offline AI playground backend", | ||||||||||||||||||||||||||||||
| version="0.1.0", | ||||||||||||||||||||||||||||||
| lifespan=lifespan | ||||||||||||||||||||||||||||||
| ) | ||||||||||||||||||||||||||||||
|
|
||||||||||||||||||||||||||||||
| # CORS | ||||||||||||||||||||||||||||||
| app.add_middleware( | ||||||||||||||||||||||||||||||
| CORSMiddleware, | ||||||||||||||||||||||||||||||
| allow_origins=[settings.ALLOWED_ORIGINS], | ||||||||||||||||||||||||||||||
| allow_credentials=True, | ||||||||||||||||||||||||||||||
| allow_methods=["*"], | ||||||||||||||||||||||||||||||
| allow_headers=["*"], | ||||||||||||||||||||||||||||||
| ) | ||||||||||||||||||||||||||||||
|
Comment on lines
+26
to
+32
There was a problem hiding this comment. Choose a reason for hiding this commentThe reason will be displayed to describe this comment to others. Learn more. CORS is overly permissive: wildcard The FastAPI documentation explicitly states that none of Restrict to the specific methods and headers this API actually needs: 🔒 Proposed fix app.add_middleware(
CORSMiddleware,
allow_origins=[settings.ALLOWED_ORIGINS],
allow_credentials=True,
- allow_methods=["*"],
- allow_headers=["*"],
+ allow_methods=["GET", "POST", "PUT", "DELETE", "OPTIONS"],
+ allow_headers=["Authorization", "Content-Type"],
)📝 Committable suggestion
Suggested change
🤖 Prompt for AI Agents |
||||||||||||||||||||||||||||||
|
|
||||||||||||||||||||||||||||||
| # Routers | ||||||||||||||||||||||||||||||
| app.include_router(chat.router, prefix="/api/chat", tags=["Chat"]) | ||||||||||||||||||||||||||||||
| app.include_router(benchmark.router, prefix="/api/benchmark", tags=["Benchmark"]) | ||||||||||||||||||||||||||||||
| app.include_router(compare.router, prefix="/api/compare", tags=["Compare"]) | ||||||||||||||||||||||||||||||
| app.include_router(models.router, prefix="/api/models", tags=["Models"]) | ||||||||||||||||||||||||||||||
| app.include_router(templates.router, prefix="/api/templates", tags=["Templates"]) | ||||||||||||||||||||||||||||||
| app.include_router(report.router, prefix="/api/report", tags=["Report"]) | ||||||||||||||||||||||||||||||
| app.include_router(export.router, prefix="/api/export", tags=["Export"]) | ||||||||||||||||||||||||||||||
| app.include_router(ai.router, prefix="/api/ai", tags=["AI"]) | ||||||||||||||||||||||||||||||
| app.include_router(voice.router, prefix="/api/voice", tags=["Voice"]) | ||||||||||||||||||||||||||||||
|
|
||||||||||||||||||||||||||||||
| @app.get("/") | ||||||||||||||||||||||||||||||
| async def root(): | ||||||||||||||||||||||||||||||
| return { | ||||||||||||||||||||||||||||||
| "app": "Inferix", | ||||||||||||||||||||||||||||||
| "version": "0.1.0", | ||||||||||||||||||||||||||||||
| "status": "running", | ||||||||||||||||||||||||||||||
| "docs": "/docs" | ||||||||||||||||||||||||||||||
| } | ||||||||||||||||||||||||||||||
|
|
||||||||||||||||||||||||||||||
| @app.get("/health") | ||||||||||||||||||||||||||||||
| async def health(): | ||||||||||||||||||||||||||||||
| return {"status": "healthy"} | ||||||||||||||||||||||||||||||
| Original file line number | Diff line number | Diff line change | ||||
|---|---|---|---|---|---|---|
| @@ -0,0 +1,32 @@ | ||||||
| # Framework | ||||||
| fastapi | ||||||
| uvicorn[standard] | ||||||
|
|
||||||
| # LangChain + Ollama | ||||||
| langchain | ||||||
| langchain-ollama | ||||||
| langchain-community | ||||||
|
|
||||||
| # Database | ||||||
| prisma | ||||||
| asyncpg | ||||||
|
|
||||||
| # AI/ML | ||||||
| psutil | ||||||
|
|
||||||
| # Auth | ||||||
| python-jose[cryptography] | ||||||
|
There was a problem hiding this comment. Choose a reason for hiding this commentThe reason will be displayed to describe this comment to others. Learn more. 🧩 Analysis chain🌐 Web query:
💡 Result: CVE-2024-33663 is an algorithm-confusion vulnerability in the Python library python-jose that affects versions up to and including 3.3.0, where handling of OpenSSH ECDSA keys (and other key formats) can allow an attacker to confuse the algorithm expected during JWT verification [1]. Impact (what can go wrong) If an attacker can influence what key material and algorithm are used during JWT verification, the algorithm confusion can undermine signature validation and lead to authentication bypass / forged JWT acceptance; multiple vulnerability databases describe it as enabling bypass of authentication/signature verification under the affected conditions [1][2][3]. Affected versions python-jose through 3.3.0 is listed as affected [1][4]. Fix / remediation The package advisory data indicates the issue is fixed in python-jose 3.4.0 (and later), with affected versions introduced through 3.3.0 and fixed at 3.4.0 [4]. The upstream release notes for 3.4.0 explicitly state “Fix for CVE-2024-33663 - signing JWT with public key is now forbidden” [5]. Practical guidance 1) Upgrade python-jose to at least 3.4.0 (prefer the latest available) [4][6]. 2) If you cannot upgrade immediately, ensure your JWT verification logic strictly uses the intended algorithm(s) and key type for verification, and do not accept attacker-controlled algorithm/key-type combinations (the issue is fundamentally about algorithm enforcement during verification) [1][2]. References (evidence) - NVD entry summarizing the issue and affected scope (python-jose through 3.3.0; algorithm confusion with OpenSSH ECDSA and other formats) [1]. - pypa advisory database record for PYSEC-2024-232 (CVE-2024-33663), including the fixed version boundary at 3.4.0 [4]. - Upstream python-jose 3.4.0 release notes mentioning the specific fix for CVE-2024-33663 [5]. Citations:
🌐 Web query:
💡 Result: CVE-2024-33664 is a denial-of-service (DoS) vulnerability in the python-jose library, nicknamed a "JWT bomb." It affects versions up to and including 3.3.0. Attackers can cause resource consumption by crafting a JSON Web Encryption (JWE) token with a high compression ratio, leading to excessive memory and processing time during decoding.[1][2][3] CVSS v3.1 base score: 5.3 (Medium), with vector AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:L.[1][4] The vulnerability was reported in GitHub issue Citations:
🏁 Script executed: cat -n backend/requirements.txt | head -30Repository: ASHUTOSH-KUMAR-RAO/Inferix Length of output: 567 Upgrade CVE-2024-33663 is an algorithm confusion vulnerability in python-jose ≤ 3.3.0 that affects JWT signature verification, particularly with OpenSSH ECDSA keys. An attacker with access to the public key can forge JWT signatures and bypass authentication. CVE-2024-33664 is a denial-of-service vulnerability ("JWT bomb") in python-jose ≤ 3.3.0 where crafted JWE tokens with high compression ratios cause excessive memory and CPU consumption. Both vulnerabilities are fixed in python-jose 3.4.0 (released February 14, 2025). 📌 Proposed fix-python-jose[cryptography]
+python-jose[cryptography]>=3.4.0📝 Committable suggestion
Suggested change
🤖 Prompt for AI Agents |
||||||
| httpx | ||||||
|
|
||||||
| # Utils | ||||||
| python-dotenv | ||||||
| python-multipart | ||||||
| pydantic | ||||||
| pydantic-settings | ||||||
|
|
||||||
| # Export | ||||||
| reportlab | ||||||
| markdown | ||||||
|
|
||||||
| # Voice | ||||||
| SpeechRecognition | ||||||
There was a problem hiding this comment.
Choose a reason for hiding this comment
The reason will be displayed to describe this comment to others. Learn more.
backend/.envis tracked despite the.envgitignore rule.The pattern
.envon line 27 should matchbackend/.envin any subdirectory, yetbackend/.envis committed in this PR. This typically means the file was staged withgit add -for was tracked before the.gitignorewas applied. Once a file is tracked by Git,.gitignoreno longer prevents changes from being staged — meaning if a developer later writes real Clerk keys or database credentials intobackend/.env, those secrets will be committed automatically.Remove the file from tracking immediately:
Use
backend/.env.example(already in the repo per the AI summary) for documentation of required keys, and keep real.envfiles untracked.🤖 Prompt for AI Agents