Huey Bookbot chatflow runtime: option matching, direct service calls, CSRF fix#579
Merged
Huey Bookbot chatflow runtime: option matching, direct service calls, CSRF fix#579
Conversation
![chatgpt-codex-connector[bot]](https://avatars.githubusercontent.com/in/1144995?s=60&v=4){kind=small}
There was a problem hiding this comment.
💡 Codex Review
Here are some automated review suggestions for this pull request.
Reviewed commit: f21106fb6b
ℹ️ About Codex in GitHub
Your team has set up Codex to review pull requests in this repo. Reviews are triggered when you
- Open a pull request for review
- Mark a draft as ready
- Comment "@codex review".
If Codex has suggestions, it will comment; otherwise it will react with 👍.
Codex can also answer questions or update the PR. Try commenting "@codex address that feedback".
- Store inline question options in _current_options (not just CMS-sourced), fixing cascading failures where age/reading answers stored as raw strings instead of full option dicts with typed fields like age_number - Add internal API handler registry for direct service-layer calls, bypassing HTTP auth for anonymous chatbot sessions (e.g. /v1/recommend) - Fix broken import in _find_matching_connection (app.crud.chat → chat_repo) - Resolve school name server-side from school_wriveted_id during session start - Add CEL functions for hue profile aggregation (merge, top_keys) - Expand seed fixtures with book catalog, themes, and flow_file loading
- Safely parse and clamp limit param in recommend handler (1-50) - Point api service WRIVETED_INTERNAL_API at internal:8888, not itself - Always write _current_options (even empty) to clear stale options from previous questions, preventing incorrect option reuse
CSRF: Accept header-only X-CSRF-Token when cookie is absent due to SameSite restrictions in cross-origin deployments. CORS prevents unauthorized origins from obtaining the token. Set SameSite=none (with Secure) for production cookies to enable cross-origin sending. Seed script: Use SET CONSTRAINTS ALL DEFERRED when reconciling booklist items to avoid IntegrityError on the unique order_id constraint after drag-and-drop reordering.
Add back containers diagram, scrubbed dataset link, API consumer list, joined-table inheritance docs link, ACL code example, Firebase console link, get_auth_token.py reference, and cloudrun role SQL setup.
Eliminate code duplication in chat_runtime.py: - Replace 9 inline input_request dict constructions with _build_input_request() - Replace 4 duplicate question-processing blocks with _resolve_question_node() - Collapse identical random/non-random CMS branches - Fix MESSAGE→QUESTION path to process question nodes properly - Fix get_initial_node to handle CMS question nodes correctly
Match the public /v1/recommend endpoint's HueyOutput contract so response_mapping for "query" works via both HTTP and direct paths.
hardbyte
force-pushed
the
feat/huey-bookbot-chatflow
branch
from
54ccd3a to
623d0ed
Compare
This file contains hidden or bidirectional Unicode text that may be interpreted or compiled differently than what appears below. To review, open the file in an editor that reveals hidden Unicode characters.
Learn more about bidirectional Unicode characters
Sign up for free
to join this conversation on GitHub.
Already have an account?
Sign in to comment
1 participant
Add this suggestion to a batch that can be applied as a single commit.This suggestion is invalid because no changes were made to the code.Suggestions cannot be applied while the pull request is closed.Suggestions cannot be applied while viewing a subset of changes.Only one suggestion per line can be applied in a batch.Add this suggestion to a batch that can be applied as a single commit.Applying suggestions on deleted lines is not supported.You must change the existing code in this line in order to create a valid suggestion.Outdated suggestions cannot be applied.This suggestion has been applied or marked resolved.Suggestions cannot be applied from pending reviews.Suggestions cannot be applied on multi-line comments.Suggestions cannot be applied while the pull request is queued to merge.Suggestion cannot be applied right now. Please check back later.
Summary
Extends the chat runtime to fully support the Huey Bookbot reading-preference flow end-to-end, including CMS-sourced questions with dynamic options, hue-based book recommendations, and cross-origin CSRF validation for production deployments.
Chat runtime (
chat_runtime.py)system._current_optionssoprocess_response()can return the complete option (with fields likeage_number,hue_map) instead of just the label textprocess_node()to fetch content and resolve options for CMS-sourced questions encountered during node chaining{{context.school_name}}etc. in question promptsbook_listmessage type by resolving source variable to book dataAction processor (
action_processor.py)/v1/recommend), bypass HTTP and call the service layer directly — avoids auth requirements for anonymous chatbot sessions and eliminates HTTP overheadsubstitute_objectinstead ofsubstitute_variablesinset_variableactions to preserve ints, dicts, lists_set_nested_valueforresponse_mappingpaths liketemp.book_countNew: Internal API handler registry (
internal_api_handlers.py)/v1/recommendhandler callingget_recommendations_with_fallbackdirectlyCEL evaluator
top_keys(dict, n)function for ranking hue profile keys by weightVariable resolver
substitute_objectnow preserves typed values (int, dict, list) when the entire string is a single{{var}}referenceCSRF cross-origin fix (
csrf.py,chat.py)X-CSRF-Tokenwhen cookie is absent due to SameSite restrictions in cross-origin deploymentsSameSite=none(withSecure) for production cookies403 - CSRF token missing in cookieon production chatflow pagesOther
chat.py: Look up school name fromschool_wriveted_idin initial state::jsonbcast syntax for SQLAlchemy parameter parsingWRIVETED_INTERNAL_APISET CONSTRAINTS ALL DEFERREDfor booklist items; extended fixtures with CMS content and flow JSON loadingTest plan
poetry run pytest app/tests/unit/ -x)top_keysCEL function testspython scripts/test_huey_flow_e2e.py)bash scripts/integration-tests.sh)