Starter prompts follow the user's access #64

2026-10-16T20:34:43Z

KofTwentyTwo commented

2026-10-16 20:34:43 +00:00

(Migrated from github.com)

Part of KofTwentyTwo/Website-Backend#303.

GET /assistant/config now offers questions based on the signed-in user's current access. The existing profile.starterPrompts field remains string[]; no frontend or schema change is required.

Permitted configured prompts come first, followed by generated suggestions, with three prompts total. Configured lines declare their required tables using [blog_post] ... or [blog_post, page] ...; [none] ... declares no table dependency. Untagged lines are omitted, as documented in UPGRADE.md.

Every request rechecks table access, visible rows and eligible date fields through the same UI API tools the assistant uses. There is no generated-result or authorization cache, so access revocation, session/tool policy changes and removal of history availability cannot preserve stale suggestions. Selection is deterministic by user and UTC date while eligible data remains unchanged. Work uses at most six counts and three describes, three-second per-call timeouts and an eight-second budget checked between calls; it makes no model calls. Read failures omit generated/table-dependent suggestions while safe [none] prompts remain available.

The implementation also corrects describe_table to read the actual flat v1 metadata response. It still filters fields by AI exposure: hidden, password and NONE fields remain excluded. This correction is isolated in commit407bdcd; the prompt limit and fresh-access checks are in b250585. The branch incorporates develop2167b775, including the merged attachment and notification changes.

Validation: full Maven-wrapper verify on the integrated tree passed all eight reactor modules: 501 tests, zero failures/errors/skips, with every JaCoCo gate passing. Live-provider tests remain excluded by the repository's default live group setting; no paid-provider validation is claimed. Regression coverage includes the total prompt cap with denied configured lines, config after data-access revocation, changed session/tool policy, history removal, date-field revocation, newly empty visible data, deterministic ordering, bounded calls, flat response shape and retained field filtering. git diff --cached --check passed.

AI-assisted implementation and review used Claude, Codex and a narrowly tasked local model; findings were checked against source and tests.

Part of KofTwentyTwo/Website-Backend#303. `GET /assistant/config` now offers questions based on the signed-in user's current access. The existing `profile.starterPrompts` field remains `string[]`; no frontend or schema change is required. Permitted configured prompts come first, followed by generated suggestions, with **three prompts total**. Configured lines declare their required tables using `[blog_post] ...` or `[blog_post, page] ...`; `[none] ...` declares no table dependency. Untagged lines are omitted, as documented in UPGRADE.md. Every request rechecks table access, visible rows and eligible date fields through the same UI API tools the assistant uses. There is no generated-result or authorization cache, so access revocation, session/tool policy changes and removal of history availability cannot preserve stale suggestions. Selection is deterministic by user and UTC date while eligible data remains unchanged. Work uses at most six counts and three describes, three-second per-call timeouts and an eight-second budget checked between calls; it makes no model calls. Read failures omit generated/table-dependent suggestions while safe `[none]` prompts remain available. The implementation also corrects `describe_table` to read the actual flat v1 metadata response. It still filters fields by AI exposure: hidden, password and NONE fields remain excluded. This correction is isolated in commit407bdcd; the prompt limit and fresh-access checks are in b250585. The branch incorporates develop2167b775, including the merged attachment and notification changes. Validation: full Maven-wrapper verify on the integrated tree passed all eight reactor modules: **501 tests, zero failures/errors/skips**, with every JaCoCo gate passing. Live-provider tests remain excluded by the repository's default `live` group setting; no paid-provider validation is claimed. Regression coverage includes the total prompt cap with denied configured lines, config after data-access revocation, changed session/tool policy, history removal, date-field revocation, newly empty visible data, deterministic ordering, bounded calls, flat response shape and retained field filtering. `git diff --cached --check` passed. AI-assisted implementation and review used Claude, Codex and a narrowly tasked local model; findings were checked against source and tests.

Sign in to join this conversation.

1 Participants

Notifications

Due Date

No due date set.

Dependencies

No dependencies set.

Reference: QRun-IO/qbit-assistant#64