Publish curated Unraid-AppOps-Gateway source from 034c9f844d2455850ba37b31379b7edaa786583e

backend/app/services/ai_security_reviewer.py

@@ -31,6 +31,7 @@ from ..schemas.ai_security import (
 from .audit_logger import log_event
 from .policy_engine import evaluate_policy
 from .secret_store import list_secret_status, secret_storage_status
+from .exposure_preferences import get_exposure_preferences
 
 
 SOURCE_NAMES = ('inventory', 'portainer', 'unraid', 'npm', 'authentik', 'secret_storage', 'policies', 'audit', 'media_pipeline')
@@ -39,7 +40,7 @@ MUTATING_TOKENS = ('delete', 'remove', 'prune', 'format', 'stop', 'redeploy', 'c
 COVERAGE_CATEGORIES = {'coverage', 'connector_config'}
 _REVIEW_CACHE_TTL_SECONDS = 30
 _SNAPSHOT_MAX_WORKERS = 10
-_PERSISTENT_CACHE_SCHEMA_VERSION = 2
+_PERSISTENT_CACHE_SCHEMA_VERSION = 3
 _PERSISTENT_CACHE_PREFIX = 'ai_security:review_cache'
 _SOURCE_SIGNATURE_CACHE_KEYS = {'media_pipeline:summary_cache', 'network_exposure:cache', 'safety_center:dashboard_cache'}
 _PERSISTENT_CACHE_MAX_STALE_SECONDS = 300
@@ -59,7 +60,8 @@ def _review_cache_key(session: Session, scope: SecurityReviewScope) -> str:
         db_key = str(getattr(bind, 'url', 'default'))
     except Exception:  # noqa: BLE001
         db_key = 'default'
-    return f'{db_key}:{scope}'
+    acl_checks = get_exposure_preferences(session).nginxAccessListChecksEnabled
+    return f'{db_key}:{scope}:acl-checks={acl_checks}'
 
 
 def _parse_utc(value: str) -> datetime:
@@ -113,7 +115,10 @@ def _source_signature(session: Session, scope: SecurityReviewScope) -> str:
             'status': item.value_json.get('status') if isinstance(item.value_json, dict) else None,
         }
         for item in session.exec(select(AppSetting)).all()
-        if not _is_source_signature_cache_key(item.key) and (not item.is_secret or item.key.startswith('ai_security:'))
+        if not _is_source_signature_cache_key(item.key)
+        and not item.key.startswith('ai:chat:')
+        and item.key != 'ai:modelforge:last_inference'
+        and (not item.is_secret or item.key.startswith('ai_security:'))
     ]
     secret_rows = [
         {'id': item.id, 'name': item.name, 'updatedAt': item.updated_at.isoformat() if item.updated_at else None, 'usedBy': item.used_by_json}
@@ -138,6 +143,7 @@ def _source_signature(session: Session, scope: SecurityReviewScope) -> str:
     signature_payload = {
         'cacheSchemaVersion': _PERSISTENT_CACHE_SCHEMA_VERSION,
         'scope': scope,
+        'exposurePreferences': get_exposure_preferences(session).model_dump(),
         'policies': sorted(policies, key=lambda item: item['id']),
         'connectors': sorted(connectors, key=lambda item: item['id']),
         'apps': sorted(apps, key=lambda item: item['id']),
@@ -621,7 +627,9 @@ def _exposure_findings(session: Session, data: dict[str, Any]) -> list[SecurityF
         warning_type = str(warning.get('type'))
         if warning_type not in mapping or warning_type in seen:
             continue
-        if warning_type == 'public_host_without_access_list' and unprotected_auth_domains is not None:
+        if warning_type == 'public_host_without_access_list' and (
+            unprotected_auth_domains is not None or not get_exposure_preferences(session).nginxAccessListChecksEnabled
+        ):
             continue
         seen.add(warning_type)
         finding_id, title, severity = mapping[warning_type]