Publish curated Unraid-AppOps-Gateway source from 034c9f844d2455850ba37b31379b7edaa786583e

backend/app/services/safety_center_service.py

@@ -17,13 +17,14 @@ from ..core.redaction import redact_message
 from ..core.time import utc_now
 from ..db.models import App, AppSetting, AuditEvent, Connector, DiscoveryRun, JobRun, Policy, Secret
 from . import ai_remediation_planner, ai_security_reviewer
+from .exposure_preferences import get_exposure_preferences
 from .audit_logger import log_event
 
 logger = logging.getLogger(__name__)
 
 DEFAULT_CACHE_TTL_SECONDS = 60
 CACHE_KEY = 'safety-dashboard-v1'
-CACHE_SCHEMA_VERSION = 2
+CACHE_SCHEMA_VERSION = 3
 CACHE_SETTING_KEY = 'safety_center:dashboard_cache'
 DEFAULT_PERSISTENT_CACHE_MAX_STALE_SECONDS = 900
 
@@ -486,6 +487,8 @@ def _source_signature(session: Session) -> str:
         }
         for item in session.exec(select(AppSetting)).all()
         if item.key != CACHE_SETTING_KEY
+        and not item.key.startswith('ai:chat:')
+        and item.key != 'ai:modelforge:last_inference'
         and not item.key.startswith('ai_security:review_cache')
         and item.key not in {'media_pipeline:summary_cache', 'network_exposure:cache'}
         and (not item.is_secret or item.key.startswith('safety_center:'))
@@ -518,6 +521,7 @@ def _source_signature(session: Session) -> str:
     latest_audit_timestamp = session.exec(select(func.max(AuditEvent.timestamp)).where(non_safety_audit)).one()
     signature_payload = {
         'cacheSchemaVersion': CACHE_SCHEMA_VERSION,
+        'exposurePreferences': get_exposure_preferences(session).model_dump(),
         'policies': sorted(policies, key=lambda item: item['id']),
         'connectors': sorted(connectors, key=lambda item: item['id']),
         'apps': sorted(apps, key=lambda item: item['id']),
@@ -734,7 +738,10 @@ def get_dashboard(session: Session, force_refresh: bool = False) -> dict[str, An
     try:
         payload = _payload(session)
     except Exception as exc:
-        if _dashboard_cache:
+        # A stale dashboard must still match the current configuration. In
+        # particular it cannot bring back suppressed ACL warnings after a
+        # diagnostics preference change.
+        if _dashboard_cache and _dashboard_cache.get('signature') == signature:
             return _with_cache_metadata(
                 _dashboard_cache['payload'],
                 hit=True,