fix(knowledge-base): split aggregate stats from gated filesystem paths - #85
Merged
Merged
Conversation
GET /knowledge-base was gated entirely behind platform.manage_infra
because its response includes pubmed_root/index_root, absolute internal
filesystem paths. But generate_report.py's knowledge_base_section_html
calls this route with no Authorization header at all (it has no way to
authenticate itself) and only ever reads the aggregate fields --
abstract/domain counts, index size, rag_status -- never the two path
fields. The blanket gate meant the AI Knowledge Base section of the
ecosystem report always failed with a 401, every single generation,
not just under load (confirmed live: curl returned 401 in 8ms).
Same PUBLIC_FIELDS-style split already used by routes_dashboard.py's
GET /dashboard/summary ("knowledge" section): the route no longer hard-
Depends() on require_permission, instead always computes and returns
the aggregate fields, and includes pubmed_root/index_root only when
the caller's own token carries platform.manage_infra (checked via a
non-raising _has_permission, same pattern as routes_dashboard.py's
own private helper of the same name -- duplicated rather than shared,
matching that module's existing convention).
Test changes: added TestKnowledgeBasePublicFields (test_main.py) for
the new split (200 without a token, aggregate fields present, paths
null; paths populated with a valid platform.manage_infra token; a
different permission still yields null paths). Removed /knowledge-base
from TestPlatformManageInfraAuth's gated-routes list and
TestOverGateRegressionGuard.STILL_GATED, since it's no longer a plain
401-without-token case -- both updated with dated notes explaining why,
matching this file's existing convention for the 2026-09-02/09-03
decisions. test_routes_llm.py's existing /knowledge-base tests
(always sent with a sufficient token) are unaffected and still pass.
Verified: full backend suite (1722 tests) passes. Live: unauthenticated
curl to /knowledge-base now returns real aggregate data (28.1M
abstracts, 282 domains, 288 FAISS indexes, 234.38 GB) with pubmed_root/
index_root null; an authenticated platform.manage_infra request gets
the same data plus both real paths. Re-ran generate_report.py end to
end -- AI Knowledge Base section now renders all four stat cards with
real data instead of "Could not reach control center for knowledge
base stats."
Co-Authored-By: Claude Sonnet 5 <noreply@anthropic.com>
Claude-Session: https://claude.ai/code/session_011MvEwFRKwmMy94dReYy9LL
This file contains hidden or bidirectional Unicode text that may be interpreted or compiled differently than what appears below. To review, open the file in an editor that reveals hidden Unicode characters.
Learn more about bidirectional Unicode characters
Sign up for free
to join this conversation on GitHub.
Already have an account?
Sign in to comment
1 participant
Add this suggestion to a batch that can be applied as a single commit.This suggestion is invalid because no changes were made to the code.Suggestions cannot be applied while the pull request is closed.Suggestions cannot be applied while viewing a subset of changes.Only one suggestion per line can be applied in a batch.Add this suggestion to a batch that can be applied as a single commit.Applying suggestions on deleted lines is not supported.You must change the existing code in this line in order to create a valid suggestion.Outdated suggestions cannot be applied.This suggestion has been applied or marked resolved.Suggestions cannot be applied from pending reviews.Suggestions cannot be applied on multi-line comments.Suggestions cannot be applied while the pull request is queued to merge.Suggestion cannot be applied right now. Please check back later.
Summary
GET /knowledge-basewas gated entirely behindplatform.manage_infrabecause its response includespubmed_root/index_root(absolute internal filesystem paths). Butgenerate_report.py'sknowledge_base_section_htmlcalls this route with noAuthorizationheader at all (it has no way to authenticate itself) and only ever reads the aggregate fields — abstract/domain counts, index size,rag_status— never the two path fields. The blanket gate meant the AI Knowledge Base section of the ecosystem report always failed with a 401, every generation, not just under load (confirmed live:curlreturned 401 in 8ms).PUBLIC_FIELDS-style split already used byroutes_dashboard.py'sGET /dashboard/summary("knowledge" section): the route no longer hard-Depends()s onrequire_permission, instead always computes and returns the aggregate fields, and includespubmed_root/index_rootonly when the caller's own token carriesplatform.manage_infra(checked via a non-raising_has_permission, matching that module's own private helper of the same name/shape).Test plan
TestKnowledgeBasePublicFields(test_main.py): 200 without a token with aggregate fields present and paths null; paths populated with a validplatform.manage_infratoken; a different permission still yields null paths./knowledge-basefromTestPlatformManageInfraAuth's gated-routes list andTestOverGateRegressionGuard.STILL_GATED, with dated notes explaining why (matching this file's existing convention for the 2026-09-02/09-03 decisions).test_routes_llm.py's existing/knowledge-basetests (always sent with a sufficient token) unaffected, still pass.curl /knowledge-basenow returns real aggregate data (28.1M abstracts, 282 domains, 288 FAISS indexes, 234.38 GB) with paths null; authenticated request gets the same data plus both real paths.generate_report.pyend to end — AI Knowledge Base section now renders all four stat cards with real data instead of the fallback message.🤖 Generated with Claude Code
https://claude.ai/code/session_011MvEwFRKwmMy94dReYy9LL