From df8b8f2bee7e3f2ba3b3e358bcf2a4eb230cb18f Mon Sep 17 00:00:00 2001 From: Paul Lizer Date: Tue, 13 Jan 2026 15:37:27 -0500 Subject: [PATCH 1/8] v0.235.003 (#591) MIME-Version: 1.0 Content-Type: text/plain; charset=UTF-8 Content-Transfer-Encoding: 8bit * creating workflows * fraud analyssis * support agents * update * fix * updated demo * Swagger lite (#469) * Development (#467) * upgrade to v0.229.060 (#459) * Update release notes to show support for GPT-5 * Documented support for gpt-image-1 * Update config.py * remove documentation folder * Documentation and message table support (#444) * Develop demo docs and import markdown table support * fixed enhanced citations for groups and public workspaces * Updated to support showing public workspaces in scope * Update config.py * fix docs * Updated RELEASE_NOTES * docs demos for public workspaces * V0.229 bug fixes (v0.229.019) (#448) * Development (#445) * Update release notes to show support for GPT-5 * Documented support for gpt-image-1 * Update config.py * remove documentation folder * Documentation and message table support (#444) * Develop demo docs and import markdown table support * fixed enhanced citations for groups and public workspaces * Updated to support showing public workspaces in scope * Update config.py * fix docs * Updated RELEASE_NOTES * video indexer config details, doc intel test button fix, move multimedia configs to search and extract * improved header security * updated versions * moved * Update EXTERNAL_HEALTH_CHECK_DUPLICATION_FIX.md * added pdfs * v0.229.019 bug fixes upgrade to v0.229.058 (#452) * all urls in chat open in new tabs * consolidated admin settings for improved navigation * added left hand nav admin settings menus * added left hand menu options for workspaces * Added debug logging to video indexer processes * readme and functional test * Workspace Scope in Chat affects Prompts * Create WORKSPACE_SCOPE_PROMPTS_FIX.md * time based turn off for debug and file process logging * improve saving in admin settings * update to v0.229.058 * Update RELEASE_NOTES.md * Update RELEASE_NOTES.md * Popup modal for Health Check config * Added Health Check config guide * Chat page top nav bug (#458) * initial fix * fixed top nav chat up bug * notes for v0.229.060 * file location fix * Update config.py * Update RELEASE_NOTES.md * moved to correct location * Fixed enhanced citations CSP bug Simple Chat implemented improved security which negatively impacted enhanced citations. * Updated release notes * updated version and tests * swagger support for all endpoints and added swagger search * added wide screen support for chats when collapsing side bar * v0.230.001 features * adding support for xlsm, Macro Excel files. * moved into features * initial * added readme * removed html code * Update config.py (#477) Updated else if for AUTHORITY * Initial Setup for Pages documentation (#479) * setup folders and base files * setting up files * architecture diagrams * updated to libdoc * libdoc updates * updating side bar * removed loops * editing side bar * Created Simple Chat Jekyll theme * Update config.py (#477) (#478) Updated else if for AUTHORITY Co-authored-by: Patrick C Davis <82388365+Patrick-Davis-MSFT@users.noreply.github.com> * Updating architectures * Update README.md --------- Co-authored-by: Patrick C Davis <82388365+Patrick-Davis-MSFT@users.noreply.github.com> * initial * added to base * adding real data endpoints * Update route_backend_control_center.py * added individual charts * fix for bug 485 * added document metrics * added links to control center * debug * added date * fixed bugs due to branch descrepancies * added Azure SQL Driver Docker File * added documentation for docker_fileSession updates * Redis Managed Identity Azure Government Support Changes * Stop tracking ignored folders * updated gitignore * added sort by to table for user management * storage account size processing * Front end now shows storage account sizing * export user management list to csv * adding group management * fixing swagger generation * fix * Added inline dynamic property generation * added YAML support * Improved muiltform vs app/json detection * added Control Center Admin role ControlCenterAdmin * ai search sizing is working for groups * group refresh fixed * added group data fix * group table refresh * updated export to include group docs * adding public workspace management * removed sample data and consolidated row generators * Changed both caching helper functions to use the existing update_document() function from functions_documents.py instead of direct upsert. * removed workflow, will work on that in different branch * Document Set Fingerprinting, Scope-Aware Cache Key Generation, Event-Based Invalidation I've successfully implemented Document Set Fingerprint + Event-Based Cache Invalidation with deterministic sorting and Score Normalization. * added debug logging * setup cache feature and ttl time to admin app settings * removed cosmos level ttl * Keyvault for secrets (#492) * add crude keyvault base impl * upd actions for MAG * add settings to fix * upd secret naming convention * upd auth types to include conn string/basic(un/pw) * fix method name * add get agent helper * add ui trigger word and get agent helper * upd function imports * upd agents call * add desc of plugins * fix for admin modal loading * upd default agent handling * rmv unneeded file * rmv extra imp statements * add new cosmos container script * upd instructions for consistency of code * adds safe calls for akv functions * adds akv to personal agents * fix for user agents boot issue * fix global set * upd azure function plugin to super init * upd to clean imports * add keyvault to global actions loading * add plugin loading docs * rmv secret leak via logging * rmv displaying of token in logs * fix not loading global actions for personal agents * rmv unsupported characters from logging * fix chat links in dark mode * chg order of css for links in dark mode * fix chat color * add default plugin print logging * rmv default check for nonsql plugins * upd requirements * add keyvault and dynamic addsetting ui * fix for agents/plugins with invalid akv chars * add imp to appins logging * add security tab UI + key vault UI * add keyvault settings * fix for copilot findings. * fix for resaving plugin without changing secret --------- Co-authored-by: Bionic711 * Feature/remove abp for pr (#510) * add crude keyvault base impl * upd secret naming convention * upd auth types to include conn string/basic(un/pw) * add ui trigger word and get agent helper * adds safe calls for akv functions * add keyvault to global actions loading * rmv secret leak via logging * fix chat links in dark mode * chg order of css for links in dark mode * fix chat color * add keyvault and dynamic addsetting ui * fix for agents/plugins with invalid akv chars * add security tab UI + key vault UI * fix for resaving plugin without changing secret * init azure billing plugin * add app settings cache * upd to azure billing plugin * upd to msgraph plugin * init community customizations * add module * add key vault config modal * add logging and functions to math * rmv extra telemetry, add appcache * upd billing plugin * add/upd key vault, admin settings, agents, max tokens * Remove abp for pr * disable static logging for development * rmv dup import * add note on pass * added notes * rmv dup decl * add semicolon * rmv unused variable add agent name to log * add actions migration back in * add notes and copilot fixes --------- Co-authored-by: Bionic711 * Feature/group agents actions (#521) * add crude keyvault base impl * upd actions for MAG * add settings to fix * upd secret naming convention * upd auth types to include conn string/basic(un/pw) * fix method name * add get agent helper * add ui trigger word and get agent helper * upd function imports * upd agents call * add desc of plugins * fix for admin modal loading * upd default agent handling * rmv unneeded file * rmv extra imp statements * add new cosmos container script * upd instructions for consistency of code * adds safe calls for akv functions * adds akv to personal agents * fix for user agents boot issue * fix global set * upd azure function plugin to super init * upd to clean imports * add keyvault to global actions loading * add plugin loading docs * rmv secret leak via logging * rmv displaying of token in logs * fix not loading global actions for personal agents * rmv unsupported characters from logging * fix chat links in dark mode * chg order of css for links in dark mode * fix chat color * add default plugin print logging * rmv default check for nonsql plugins * upd requirements * add keyvault and dynamic addsetting ui * fix for agents/plugins with invalid akv chars * add imp to appins logging * add security tab UI + key vault UI * add keyvault settings * fix for copilot findings. * fix for resaving plugin without changing secret * init azure billing plugin * add app settings cache * upd to azure billing plugin * upd to msgraph plugin * init community customizations * add module * add key vault config modal * add logging and functions to math * rmv extra telemetry, add appcache * upd billing plugin * add/upd key vault, admin settings, agents, max tokens * Remove abp for pr * disable static logging for development * rmv dup import * add note on pass * added notes * rmv dup decl * add semicolon * rmv unused variable add agent name to log * add actions migration back in * add notes and copilot fixes * add group agents/actions * add branch for testing/rmv old branch * bug fixes, group agent modifications, rmv client validation * rmv ajv * upd from copilot --------- Co-authored-by: Bionic711 * Add cosmos activity logs container configuration * incorporate branch updates Add 372 fix 489 * Support deployment via AZD UP (#530) * Update devcontainer configuration for support of AZD * Move to module based bicep files * Add Azure deployment configuration and update Bicep modules for service outputs * Enhance Azure deployment process by adding predeploy hooks for Docker image management and updating Bicep modules to include managed identity client ID and container registry outputs. * Add deployment script for creating and storing Azure AD client secret in Key Vault * Update Azure Dev CLI feature version to latest in devcontainer configuration * Remove deprecated Bicep files and parameter configurations for cleaner deployment structure * Refactor Bicep modules for improved diagnostics and role assignments - Updated appService.bicep to conditionally import diagnostic settings based on enableDiagLogging parameter. - Changed Azure Cosmos DB authentication type to managed identity and removed key-based authentication settings. - Enhanced appServiceAuthentication.bicep by removing unnecessary parameters and configuring Key Vault reference for client secret. - Modified appServicePlan.bicep to conditionally import diagnostic settings. - Refactored azureContainerRegistry-existing.bicep to deploy role assignment to the ACR's resource group. - Updated azureContainerRegistry.bicep to conditionally import diagnostic settings. - Enhanced contentSafety.bicep with conditional diagnostic settings import. - Updated cosmosDb.bicep to include a new database and container, and added role assignments for managed identity. - Refactored documentIntelligence.bicep to conditionally import diagnostic settings. - Enhanced enterpriseApplication.bicep by adding additional required resource access scopes. - Updated keyVault.bicep to conditionally import diagnostic settings and adjusted enterprise app parameters. - Refactored openAI.bicep to conditionally import diagnostic settings. - Enhanced redisCache.bicep with conditional diagnostic settings import. - Updated search.bicep to conditionally import diagnostic settings. - Refactored speechService.bicep to conditionally import diagnostic settings. - Enhanced storageAccount.bicep with conditional diagnostic settings import. - Added main.parameters.json for parameter management. - Introduced azureContainerRegistry-roleAssignment.bicep for managing ACR role assignments. * Add custom subdomain names for document intelligence, OpenAI, and speech services * Fix casing for hostingMode property in search service configuration * Enhance storage account configuration by enabling hierarchical namespace and setting public access to 'None' for document containers * Add enterprise app permissions module for resource access management * Fixed ExternalApi configuration to valid guid and set value to a unique name * Add Init Script to Configure Entra Application * Fix spelling error * fix failure in hostingMode value * configure managed identity for contentSafety * update readme to support new AZD deployment solution * Video Indexer, Multi-Modal Enhancements, Scope Bug ## PR Summary: Video Indexer Multi-Modal Enhancements ### Overview This PR introduces significant enhancements to video processing and image analysis capabilities, focusing on multi-modal AI features and improved metadata handling. **Version updated from 0.233.167 to 0.233.172**. ### ๐ŸŽฏ Key Features #### 1. **Multi-Modal Vision Analysis for Images** - Added AI-powered vision analysis for uploaded images using GPT-4 Vision or similar models - Extracts comprehensive image insights including: - AI-generated descriptions - Object detection - Text extraction from images (OCR) - Detailed visual analysis - New admin setting: `enable_multimodal_vision` to control feature availability - Vision analysis results stored in document metadata and included in AI Search indexing - Connection testing endpoint added for vision model validation #### 2. **Enhanced Document Metadata Citations** - Implemented metadata-based citations that surface document keywords, abstracts, and vision analysis - New citation types displayed with distinct visual indicators: - **Keywords**: Tagged with `bi-tags` icon, labeled as "Metadata" - **Abstract**: Document summaries included as contextual citations - **Vision Analysis**: AI-generated image insights labeled as "AI Vision" - Metadata content passed to AI models as additional context for more informed responses - Special modal view for metadata citations (separate from standard document citations) #### 3. **Image Message UI Improvements** - Enhanced display for user-uploaded images vs AI-generated images - Added "View Text" button for uploaded images with extracted content or vision analysis - Collapsible info sections showing: - Extracted OCR text from Document Intelligence - AI Vision Analysis results - Proper avatar distinction between uploaded and generated images - Improved metadata tracking with `is_user_upload` flag #### 4. **Video Indexer Configuration Updates** - **BREAKING CHANGE**: Removed API key authentication support - Now exclusively uses **Managed Identity authentication** for Video Indexer - Updated admin UI documentation to guide managed identity setup: - Enable system-assigned managed identity on App Service - Assign "Video Indexer Restricted Viewer" role - Configure required ARM settings (subscription ID, resource group, account name) - Improved validation for required Video Indexer settings - Enhanced error messaging for missing configuration #### 5. **Search Scope Improvements** - Fixed search behavior when `document_scope='all'` to properly include group documents - Added `active_group_id` to search context when document scope is 'all' and groups are enabled - Conditional group index searching - only queries group index when `active_group_id` is present - Prevents unnecessary searches and potential errors when groups aren't in use #### 6. **Image Context in Conversation History** - Enhanced conversation history to include rich image context for AI models - Extracts and includes: - OCR text from Document Intelligence (up to max content length) - AI Vision analysis (description, objects, text) - Structured prompt formatting for multimodal understanding - **Important**: Base64 image data excluded from conversation history to prevent token overflow - Only metadata and extracted insights passed to models for efficient token usage ### ๐Ÿ”ง Technical Improvements #### Backend Changes - **route_backend_chats.py**: - Added metadata citation extraction logic (~150 lines) - Enhanced conversation history building for image uploads - Improved search argument handling for group contexts - **functions_documents.py**: - New `analyze_image_with_vision_model()` function for AI vision analysis - Enhanced `get_document_metadata_for_citations()` integration - Vision analysis now runs BEFORE chunk saving to include insights in AI Search indexing - Removed redundant blob storage for vision JSON (stored in document metadata) - **route_backend_settings.py**: - New `_test_multimodal_vision_connection()` endpoint for testing vision models - Supports both APIM and direct Azure OpenAI endpoints - Test uses 1x1 pixel sample image for validation - **functions_search.py**: - Added conditional logic for group search execution - Prevents empty `active_group_id` from causing search errors #### Frontend Changes - **chat-messages.js** (~275 lines changed): - Enhanced `appendMessage()` to handle uploaded image metadata - New `toggleImageInfo()` functionality for expandable image details - Improved citation rendering with metadata type indicators - Debug logging for image message processing - **chat-citations.js** (~70 lines added): - New `showMetadataModal()` function for displaying keywords/abstracts/vision analysis - Enhanced citation click handling to detect metadata citations - Separate modal styling and behavior for metadata vs document citations - **admin_settings.html**: - Complete redesign of Video Indexer configuration section - Removed all API key references - Added managed identity setup instructions with step-by-step guidance - Updated configuration display to show resource group and subscription ID - **_video_indexer_info.html**: - Updated modal content to clarify managed identity requirement - Added warning banner about authentication type - Enhanced configuration display with ARM resource details ### ๐Ÿ“Š Files Changed - **16 files** modified - **+1,063 insertions**, **-412 deletions** - Net change: **+651 lines** ### ๐Ÿงช Testing Considerations - Test multi-modal vision analysis with various image types - Validate metadata citations appear correctly in chat responses - Verify Video Indexer works with managed identity authentication - Test search scope behavior with and without groups enabled - Validate image upload UI shows extracted text and vision analysis - Confirm conversation history properly handles image context without token overflow ### ๐Ÿ” Security & Performance - Managed identity authentication improves security posture (no stored API keys) - Image base64 data excluded from conversation history prevents token exhaustion - Metadata citations add minimal overhead while providing rich context - Vision analysis runs efficiently during document processing pipeline ### ๐Ÿ“ Configuration Required Admins must configure: 1. Enable `enable_multimodal_vision` in admin settings 2. Select vision-capable model (e.g., `gpt-4o`, `gpt-4-vision-preview`) 3. For Video Indexer: Configure managed identity and ARM resource details 4. Enable `enable_extract_meta_data` to surface metadata citations --- This PR significantly enhances the application's multi-modal capabilities, providing users with richer context from images and documents while maintaining efficient token usage and robust security practices. * Conversation Management Features (#532) New Features 1. Pin Conversations Users can pin important conversations to keep them at the top of the list Pinned conversations display a pin icon (๐Ÿ“Œ) in the conversation header and details modal Pin icon appears before the conversation title Bulk pin/unpin operations available in multi-select mode Pinned conversations always appear first, sorted by most recent activity 2. Hide Conversations Users can hide conversations to declutter their workspace without deleting them Hidden conversations display an eye-slash icon (๐Ÿ‘๏ธโ€๐Ÿ—จ๏ธ) in the conversation header and details modal Eye-slash icon appears next to the pin icon (if pinned) Bulk hide/unhide operations available in multi-select mode Toggle visibility of hidden conversations using the eye icon in the sidebar 3. Two-Tier Conversation Search Quick Search (Sidebar) Instant title-based filtering of conversations Search icon in sidebar activates inline search input Real-time filtering as you type Clear button to reset search Expand button to open advanced search modal Advanced Search (Modal) Full-text search across all message content Multiple filter options: Date range (from/to) Chat type (personal/group/public) Classifications (multi-select) Has uploaded files Has generated images Pagination (20 results per page) Message snippets with highlighted search terms (50 chars before/after match) Click to navigate directly to specific messages Search history tracking (last 20 searches) Clickable search history to repeat searches 4. Message Highlighting & Navigation Search results highlight matched text in yellow (amber in dark mode) Smooth scroll animation to navigate to specific messages Pulse animation draws attention to the target message Highlights persist for 30 seconds before auto-clearing Works across conversation switches 5. Multi-Select Mode Select multiple conversations for bulk operations Visual checkboxes appear when entering selection mode Bulk actions available: Pin/unpin selected conversations Hide/unhide selected conversations Delete selected conversations Selection mode accessible from conversation dropdown menu Auto-exit after 30 seconds of inactivity 6. Enhanced Conversation Details Modal Displays pin icon if conversation is pinned Displays eye-slash icon if conversation is hidden Shows both icons at the top of the modal (next to title) Status section shows visual badges for pinned/hidden state Comprehensive metadata display Technical Implementation Frontend Changes chat-conversations.js: Core conversation management, quick search, pin/hide functionality chat-search-modal.js (NEW): Advanced search modal implementation chat-sidebar-conversations.js: Sidebar search synchronization, hidden conversation handling chat-messages.js: Message highlighting, smooth scroll, search highlight persistence chat-conversation-details.js: Updated to show pin/hidden icons in modal chats.css: Styles for search highlights and message pulse animations HTML Templates: Added search modal, updated navigation icons Backend Changes route_backend_conversations.py: /api/search_conversations - Full-text search with filters and pagination /api/conversations/classifications - Get unique classification values /api/user-settings/search-history - GET/POST/DELETE endpoints for search history /api/conversations/{id}/pin - Toggle pin status /api/conversations/{id}/hide - Toggle hide status Bulk operations for pin/hide/delete functions_settings.py: Search history management functions * Message management (#553) * added message masking mask selected content of message or an entire message * fixed citation border * enabled streaming * image gen with streaming * added reasoning support * added reasoning to agents * agent support * fixed key bug * disable group create and fixed model fetch * updated config * fixed support for workspace search for streaming * fix bug with sidebar update * fixed gpt-5 vision processing bug * metadata works with all messages now * fixed debug_print bug * added reasoning effort to agents and fixed agent validation * fixed file metadata loading bug * fixed llm streaming when working with group workspace data * fixed cosmos container config error * added delete message and fixed message threading * retry bug fixes * fixed message threading order * moved message buttons to menu * fixed bug for conversation history that included inactive threads * added css styling for urls for dark mode * fixed bug with newly created messages not showing metadata or deleting * improved search times by 100x * added token collect to messages supports models and agents * added streaming for agents along with token collection * added embedding token tracking * added document creation/deletion and token tracking to activity log * adding conversations to activity logs * added activity log viewer with filters, search, and export * added support for agents in edit and retry messages * Configure Application from AZD Up command (#548) * Add Cosmos DB post-configuration script and update requirements - Initial POC * post deploy configure services in cosmosdb * refactor to prevent post deploy configuration + begin support of key based auth. * Add additional parameter validation for creating entra app * Refactor Bicep modules for improved authentication and key management - Added keyVault-Secrets.bicep module for storing secrets in Key Vault. - Modified keyVault.bicep to remove enterprise app client secret handling and commented out managed identity role assignments. - Removed openAI-existing.bicep and refactored openAI.bicep to handle model deployments dynamically. - Added setPermissions.bicep for managing role assignments for various resources. - Updated postconfig.py to reflect changes in environment variable handling for authentication type. * Refactor Bicep modules to conditionally add settings based on authentication type and enable resource declarations for services * initial support for VideoIndexer service * Refactor Bicep modules to enhance VideoIndexer service integration and update diagnostic settings configurations * move from using chainguard-dev builder image to python slim image. * Updates to support post deployment app config * Add post-deployment permissions script for CosmosDB and update authentication type handling * fix typo in enhanced citation deployment config * Refactor Dockerfile to use Python 3.13-slim and streamline build process * restart web application after deployment settings applied * remove setting for disableLocalAuth * update to latest version of bicep deployment * remove dead code * code cleanup / formatting * removed unnecessary content from readme.md * fix token scope for commericial search service * set permission correctly for lookup of openAI models * fixes required to configure search with managed identity * Adds Azure Billing Plugin in Community Customizations (#546) * add crude keyvault base impl * upd actions for MAG * add settings to fix * upd secret naming convention * upd auth types to include conn string/basic(un/pw) * fix method name * add get agent helper * add ui trigger word and get agent helper * upd function imports * upd agents call * add desc of plugins * fix for admin modal loading * upd default agent handling * rmv unneeded file * rmv extra imp statements * add new cosmos container script * upd instructions for consistency of code * adds safe calls for akv functions * adds akv to personal agents * fix for user agents boot issue * fix global set * upd azure function plugin to super init * upd to clean imports * add keyvault to global actions loading * add plugin loading docs * rmv secret leak via logging * rmv displaying of token in logs * fix not loading global actions for personal agents * rmv unsupported characters from logging * fix chat links in dark mode * chg order of css for links in dark mode * fix chat color * add default plugin print logging * rmv default check for nonsql plugins * upd requirements * add keyvault and dynamic addsetting ui * fix for agents/plugins with invalid akv chars * add imp to appins logging * add security tab UI + key vault UI * add keyvault settings * fix for copilot findings. * fix for resaving plugin without changing secret * init azure billing plugin * add app settings cache * upd to azure billing plugin * upd to msgraph plugin * init community customizations * add module * add key vault config modal * add logging and functions to math * rmv extra telemetry, add appcache * upd billing plugin * add/upd key vault, admin settings, agents, max tokens * Remove abp for pr * disable static logging for development * rmv dup import * add note on pass * added notes * rmv dup decl * add semicolon * rmv unused variable add agent name to log * add actions migration back in * add notes and copilot fixes * add abp back in * upd abp/seperate graph from query * rmv missed merge lines * fix for AL * upd for consistency testing * upd abp to community * fix copilot findings #1 * fix plotting conflict * fix exception handling * fix static max function invokes * rmv unneeded decl * rmv unneeded imports * fix grouping dimensions * fix abp copilot suggestions #2 * simplify methods for message reload * upd dockerfile to google distroless * add pipelines * add modifications to container * upd to build * add missing arg * add arg for major/minor/patch python version * upd python paths and pip install * add perms to /app for user * chg back to root * rmv python3 * rmv not built python * add shared * add path and home * upd for stdlib paths * fix user input filesystem path vulns * fix to consecutive dots * upd pipeline to include branch name in image * add abp to deploy * upd instructions name/rmv abp from deploy * fix pipeline * mov back to Comm Cust for main inclusion --------- Co-authored-by: Bionic711 * Security/container build (#549) * upd dockerfile to google distroless * add pipelines * add modifications to container * upd to build * add missing arg * add arg for major/minor/patch python version * upd python paths and pip install * add perms to /app for user * chg back to root * rmv python3 * rmv not built python * add shared * add path and home * upd for stdlib paths * fix user input filesystem path vulns * fix to consecutive dots --------- Co-authored-by: Bionic711 * Feature/speech managed identity (#543) * Bugfix - deleted duplicate enable_external_healthcheck entry * Feature - updated Speech Service to use Managed Identity in addition to the key, added MAG functionality via Azure Speech SDK since the Fast Transcription API is not available in MAG, updated Admin Setup Walkthrough so it goes to the right place in the settings when Next is clicked, updated Speech requirements in Walkthrough, rewrote Admin Configuration docs, updated/corrected Managed Identity roles in Setup Instructions Special docs. * Update application/single_app/templates/admin_settings.html Co-authored-by: Copilot <175728472+Copilot@users.noreply.github.com> * Update application/single_app/functions_settings.py Co-authored-by: Copilot <175728472+Copilot@users.noreply.github.com> * Update application/single_app/functions_documents.py Co-authored-by: Copilot <175728472+Copilot@users.noreply.github.com> * Update application/single_app/functions_documents.py Co-authored-by: Copilot <175728472+Copilot@users.noreply.github.com> --------- Co-authored-by: Paul Lizer Co-authored-by: Copilot <175728472+Copilot@users.noreply.github.com> * Banner text color picker from Vivien (#555) * Classification text color picker * Line endings * Remove opencensus * Add flask instrumentation * Add troubleshooting doc * Add troubleshooting doc * Control center (#567) * added group status (active, locked, upload disabled, and inactive) Adds Azure Billing Plugin in Community Customizations * added bulk member upload via csv for groups * add document metadata modified activity log tracking * activity logging for members deleted from groups * added group activity timeline * added notification system * added notifications for document upload to workspaces * fixed badge sizing * fixed url link * fixed badge to not show with zero notifications * Updated notification system * Updated approval system * updated approval workflow * updated notification workflow * Fixed set active bug on my public workspace page * Added user retention policy, updated user profile page with dashboards, retention config, and more. * adding speed to text for chat UI * updated the speech wave form and input field * updated to transcribe entire recording * fixed bug creating new conversation with auto-send * add mic permissions * added stream token tracking * Added public workspace reporting * Updated AI search sizing analysis * added management for public workspaces * improved public workspace management includes stats and bulk actions * updated groups dashboard for owners and admins with stats and bulk actions * added voice for ai to talk with users in chats * Auto Voice Response * for speech service, added 429 randomized response pattern to prevent thunder herding * updated admin settings for speech services and fixed dark mode for raw log viewing * updated video extraction card * Added Control Center Admin and Dashboard Reader roles * updated feedback and safety decorators so admins work unless required then those roles must be used * Updated and Validated logic for admin roles; control center, safety, and feedback * added support for control center admin and dashboard reader * Development (#566) * Banner text color picker from Vivien (#555) * Classification text color picker * Line endings * Remove opencensus * Add flask instrumentation * Add troubleshooting doc * Add troubleshooting doc --------- Co-authored-by: Ed Clark <107473135+clarked-msft@users.noreply.github.com> Co-authored-by: Ed Clark Co-authored-by: Bionic711 <13358952+Bionic711@users.noreply.github.com> * updated tool tip to better inform user on status of ai response * improve query parameters detection for swagger * updated visual cue showing the ai is talking to the user * moved duplicates to shared js * replaced alert with toast. * fixed and added log_event to exceptions * added @user_required and improved swagger generation * Update route_frontend_profile.py * fixed swagger generation bug on affecting two apis * returned keyvault to admin settings ui * Fixed bug when running local js --------- Co-authored-by: Ed Clark <107473135+clarked-msft@users.noreply.github.com> Co-authored-by: Ed Clark Co-authored-by: Bionic711 <13358952+Bionic711@users.noreply.github.com> * Adding release notes * fixed debug_debug_print * Updated README * Update README.md * accepted changes * removed files * GitHub Actions workflow that runs Python compilation checks on all Python files in the single_app * Upated to v0.235.002 * removed debug test file * Updated to v0.235.003 --------- Co-authored-by: Patrick C Davis <82388365+Patrick-Davis-MSFT@users.noreply.github.com> Co-authored-by: Bionic711 Co-authored-by: cjackson202 <134412115+cjackson202@users.noreply.github.com> Co-authored-by: Bionic711 Co-authored-by: Bionic711 <13358952+Bionic711@users.noreply.github.com> Co-authored-by: Steve Carroll <37545884+SteveCInVA@users.noreply.github.com> Co-authored-by: Xeelee33 Co-authored-by: Copilot <175728472+Copilot@users.noreply.github.com> Co-authored-by: Ed Clark <107473135+clarked-msft@users.noreply.github.com> Co-authored-by: Ed Clark --- application/single_app/config.py | 2 +- .../single_app/debug_inspect_source.py | 87 ------------------- 2 files changed, 1 insertion(+), 88 deletions(-) delete mode 100644 application/single_app/debug_inspect_source.py diff --git a/application/single_app/config.py b/application/single_app/config.py index 2573b720..32f95593 100644 --- a/application/single_app/config.py +++ b/application/single_app/config.py @@ -88,7 +88,7 @@ EXECUTOR_TYPE = 'thread' EXECUTOR_MAX_WORKERS = 30 SESSION_TYPE = 'filesystem' -VERSION = "0.235.002" +VERSION = "0.235.003" SECRET_KEY = os.getenv('SECRET_KEY', 'dev-secret-key-change-in-production') diff --git a/application/single_app/debug_inspect_source.py b/application/single_app/debug_inspect_source.py deleted file mode 100644 index 3af472ed..00000000 --- a/application/single_app/debug_inspect_source.py +++ /dev/null @@ -1,87 +0,0 @@ -#!/usr/bin/env python3 -""" -Debug script to see what inspect.getsource returns for chat_stream_api -""" - -import sys -import os -sys.path.append(os.path.dirname(os.path.abspath(__file__))) - -# Set environment to avoid missing env vars -os.environ['FLASK_ENV'] = 'development' -if not os.environ.get('SECRET_KEY'): - os.environ['SECRET_KEY'] = 'test-key' - -from config import * -from route_backend_chats import register_backend_chats_routes -import inspect -import textwrap - -# Create a minimal Flask app -app = Flask(__name__) -app.config.update(CONFIG_DEFAULTS) - -# Register routes to get the function -register_backend_chats_routes(app) - -# Find the chat_stream_api function -for rule in app.url_map.iter_rules(): - if rule.rule == '/api/chat/stream': - endpoint = rule.endpoint - func = app.view_functions[endpoint] - - print(f"Found function: {func.__name__}") - print(f"Endpoint: {endpoint}") - print("\n" + "="*80) - print("RAW SOURCE from inspect.getsource():") - print("="*80) - - try: - raw_source = inspect.getsource(func) - print(repr(raw_source[:200])) # First 200 chars - print("\n") - - print("="*80) - print("AFTER textwrap.dedent():") - print("="*80) - dedented = textwrap.dedent(raw_source) - print(repr(dedented[:200])) - print("\n") - - print("="*80) - print("AFTER MANUAL MIN-INDENT REMOVAL:") - print("="*80) - lines = dedented.split('\n') - if lines: - min_indent = float('inf') - for line in lines: - if line.strip(): - indent = len(line) - len(line.lstrip()) - min_indent = min(min_indent, indent) - - if min_indent > 0 and min_indent != float('inf'): - dedented = '\n'.join(line[min_indent:] if len(line) > min_indent else line for line in lines) - - print(repr(dedented[:200])) - print("\n") - - print("="*80) - print("AFTER lstrip():") - print("="*80) - final = dedented.lstrip() - print(repr(final[:200])) - print("\n") - - print("="*80) - print("FIRST LINE:") - print("="*80) - first_line = final.split('\n')[0] if final else '' - print(f"First line: {repr(first_line)}") - print(f"Starts with whitespace: {first_line and first_line[0] in (' ', '\t')}") - - except Exception as e: - print(f"Error: {e}") - import traceback - traceback.print_exc() - - break From ce140f5c01b1f3fef204934c17c2ca07d3286237 Mon Sep 17 00:00:00 2001 From: Paul Lizer Date: Thu, 15 Jan 2026 09:55:55 -0500 Subject: [PATCH 2/8] fixed disable group creation bug --- application/single_app/config.py | 2 +- .../route_frontend_admin_settings.py | 3 +- .../single_app/templates/control_center.html | 2 +- .../DISABLE_GROUP_CREATION_SETTING_FIX.md | 105 ++++++++ .../test_disable_group_creation_fix.py | 225 ++++++++++++++++++ 5 files changed, 334 insertions(+), 3 deletions(-) create mode 100644 docs/fixes/DISABLE_GROUP_CREATION_SETTING_FIX.md create mode 100644 functional_tests/test_disable_group_creation_fix.py diff --git a/application/single_app/config.py b/application/single_app/config.py index 32f95593..916f0491 100644 --- a/application/single_app/config.py +++ b/application/single_app/config.py @@ -88,7 +88,7 @@ EXECUTOR_TYPE = 'thread' EXECUTOR_MAX_WORKERS = 30 SESSION_TYPE = 'filesystem' -VERSION = "0.235.003" +VERSION = "0.235.005" SECRET_KEY = os.getenv('SECRET_KEY', 'dev-secret-key-change-in-production') diff --git a/application/single_app/route_frontend_admin_settings.py b/application/single_app/route_frontend_admin_settings.py index 8cdf2236..838a565c 100644 --- a/application/single_app/route_frontend_admin_settings.py +++ b/application/single_app/route_frontend_admin_settings.py @@ -593,7 +593,8 @@ def is_valid_url(url): # Workspaces 'enable_user_workspace': form_data.get('enable_user_workspace') == 'on', 'enable_group_workspaces': form_data.get('enable_group_workspaces') == 'on', - 'enable_group_creation': form_data.get('enable_group_creation') == 'on', + # disable_group_creation is inverted: when checked (on), enable_group_creation = False + 'enable_group_creation': form_data.get('disable_group_creation') != 'on', 'enable_public_workspaces': form_data.get('enable_public_workspaces') == 'on', 'enable_file_sharing': form_data.get('enable_file_sharing') == 'on', 'enable_file_processing_logs': enable_file_processing_logs, diff --git a/application/single_app/templates/control_center.html b/application/single_app/templates/control_center.html index 1dbe4ae8..8b9beb7a 100644 --- a/application/single_app/templates/control_center.html +++ b/application/single_app/templates/control_center.html @@ -874,7 +874,7 @@
-
diff --git a/docs/fixes/DISABLE_GROUP_CREATION_SETTING_FIX.md b/docs/fixes/DISABLE_GROUP_CREATION_SETTING_FIX.md new file mode 100644 index 00000000..b2d2868a --- /dev/null +++ b/docs/fixes/DISABLE_GROUP_CREATION_SETTING_FIX.md @@ -0,0 +1,105 @@ +# Disable Group Creation Setting Fix + +**Version:** 0.235.005 +**Fixed in:** 0.235.004, 0.235.005 +**Issue Type:** Bug Fix + +## Problem Description + +The "Disable Group Creation" setting was not being saved from either the Admin Settings page (`admin_settings.html`) or the Control Center page (`control_center.html`). Even when the setting was manually changed in Cosmos DB to `false`, users could not create groups because the setting always appeared to be "on" (disabled). + +### Issue 1: Form Field Name Mismatch (Fixed in 0.235.004) + +The HTML form field in `admin_settings.html` was named `disable_group_creation`, but the backend code in `route_frontend_admin_settings.py` was reading `enable_group_creation`. This mismatch meant: + +1. The form submitted `disable_group_creation=on` when the toggle was checked +2. The backend looked for `enable_group_creation` which was never present in the form data +3. The expression `form_data.get('enable_group_creation') == 'on'` always evaluated to `False` +4. This meant `enable_group_creation` was always set to `False`, effectively disabling group creation regardless of the toggle state + +### Issue 2: Missing onclick Handler (Fixed in 0.235.005) + +The Control Center's "Save Settings" button had no `onclick` handler. The `GroupManager.bindEvents()` function was supposed to attach an event listener, but `GroupManager.init()` was never called, so the binding never occurred. + +## Solution + +### Fix 1: Backend Form Field Reading (0.235.004) + +Modified the backend to correctly read the `disable_group_creation` form field and invert its value to set `enable_group_creation`: + +**Before (Incorrect):** +```python +'enable_group_creation': form_data.get('enable_group_creation') == 'on', +``` + +**After (Fixed):** +```python +# disable_group_creation is inverted: when checked (on), enable_group_creation = False +'enable_group_creation': form_data.get('disable_group_creation') != 'on', +``` + +### Fix 2: Add onclick Handler (0.235.005) + +Added inline `onclick` handler to the Save Settings button: + +**Before:** +```html + @@ -4688,5 +4688,18 @@
${title}
} } }; + +// Initialize GroupManager when DOM is ready +document.addEventListener('DOMContentLoaded', function() { + // Small delay to ensure control-center.js has initialized window.controlCenter first + setTimeout(function() { + if (typeof GroupManager !== 'undefined' && GroupManager.init) { + GroupManager.init(); + console.log('GroupManager initialized successfully'); + } else { + console.error('GroupManager not available for initialization'); + } + }, 200); +}); {% endblock %} \ No newline at end of file From 9b9644e5a2afa2aa3bde87b7625e42ebc133699e Mon Sep 17 00:00:00 2001 From: Paul Lizer Date: Thu, 15 Jan 2026 10:36:20 -0500 Subject: [PATCH 4/8] fixed control center access to not require admin role when enabling controlcenteradmin role --- ...n_of_feature_documentation.instructions.md | 2 +- ...ation_of_fix_documentation.instructions.md | 2 +- application/single_app/config.py | 2 +- .../single_app/functions_authentication.py | 64 ++-- .../route_frontend_control_center.py | 20 +- .../single_app/templates/_sidebar_nav.html | 20 +- .../single_app/templates/_top_nav.html | 7 +- .../VIDEO_INDEXER_DUAL_AUTHENTICATION.md | 149 --------- .../MULTIMODAL_VISION_SETTINGS_SAVE_FIX.md | 159 ---------- ...EO_INDEXER_API_KEY_TOKEN_GENERATION_FIX.md | 199 ------------ .../fixes/VISION_MODEL_DETECTION_EXPANSION.md | 185 ----------- .../CONTROL_CENTER_ACCESS_LOGIC_FIX.md | 125 ++++++++ .../DISABLE_GROUP_CREATION_SETTING_FIX.md | 4 +- .../test_control_center_access_logic.py | 293 ++++++++++++++++++ 14 files changed, 500 insertions(+), 731 deletions(-) delete mode 100644 docs/explanation/features/VIDEO_INDEXER_DUAL_AUTHENTICATION.md delete mode 100644 docs/explanation/fixes/MULTIMODAL_VISION_SETTINGS_SAVE_FIX.md delete mode 100644 docs/explanation/fixes/VIDEO_INDEXER_API_KEY_TOKEN_GENERATION_FIX.md delete mode 100644 docs/explanation/fixes/VISION_MODEL_DETECTION_EXPANSION.md create mode 100644 docs/explanation/fixes/v0.235.010/CONTROL_CENTER_ACCESS_LOGIC_FIX.md rename docs/{fixes => explanation/fixes/v0.235.010}/DISABLE_GROUP_CREATION_SETTING_FIX.md (98%) create mode 100644 functional_tests/test_control_center_access_logic.py diff --git a/.github/instructions/location_of_feature_documentation.instructions.md b/.github/instructions/location_of_feature_documentation.instructions.md index ced7cb42..57a5c05f 100644 --- a/.github/instructions/location_of_feature_documentation.instructions.md +++ b/.github/instructions/location_of_feature_documentation.instructions.md @@ -7,7 +7,7 @@ applyTo: '**' ## Documentation Directory All new feature documentation should be placed in: ``` -..\docs\features\ +..\docs\explanation\features\ ``` ## File Naming Convention diff --git a/.github/instructions/location_of_fix_documentation.instructions.md b/.github/instructions/location_of_fix_documentation.instructions.md index f3eaee3a..311db387 100644 --- a/.github/instructions/location_of_fix_documentation.instructions.md +++ b/.github/instructions/location_of_fix_documentation.instructions.md @@ -7,7 +7,7 @@ applyTo: '**' ## Documentation Directory All bug fixes and issue resolution documentation should be placed in: ``` -..\docs\fixes\ +..\docs\explanation\fixes\ ``` ## File Naming Convention diff --git a/application/single_app/config.py b/application/single_app/config.py index 712f96bb..650393e6 100644 --- a/application/single_app/config.py +++ b/application/single_app/config.py @@ -88,7 +88,7 @@ EXECUTOR_TYPE = 'thread' EXECUTOR_MAX_WORKERS = 30 SESSION_TYPE = 'filesystem' -VERSION = "0.235.009" +VERSION = "0.235.012" SECRET_KEY = os.getenv('SECRET_KEY', 'dev-secret-key-change-in-production') diff --git a/application/single_app/functions_authentication.py b/application/single_app/functions_authentication.py index f3fd1ce9..e4bcf480 100644 --- a/application/single_app/functions_authentication.py +++ b/application/single_app/functions_authentication.py @@ -731,10 +731,17 @@ def control_center_required(access_level='admin'): Args: access_level: 'admin' for full admin access, 'dashboard' for dashboard-only access - Access logic: + Access logic when require_member_of_control_center_admin is ENABLED: - ControlCenterAdmin role โ†’ Full access to everything (admin + dashboard) - - ControlCenterDashboardReader role โ†’ Dashboard access only - - Regular admins โ†’ Access when role requirements are disabled (default) + - ControlCenterDashboardReader role โ†’ Dashboard access only (if that setting is also enabled) + - Regular Admin role โ†’ NO access (must have ControlCenterAdmin) + - ControlCenterAdmin role is REQUIRED - having it without the setting enabled does nothing + + Access logic when require_member_of_control_center_admin is DISABLED (default): + - Regular Admin role โ†’ Full access to dashboard + management + activity logs + - ControlCenterAdmin role โ†’ IGNORED (role feature not enabled) + - ControlCenterDashboardReader role โ†’ Dashboard access only (if that setting is enabled) + - Non-admins โ†’ NO access """ def decorator(f): @wraps(f) @@ -744,37 +751,46 @@ def decorated_function(*args, **kwargs): require_member_of_control_center_admin = settings.get("require_member_of_control_center_admin", False) require_member_of_control_center_dashboard_reader = settings.get("require_member_of_control_center_dashboard_reader", False) - has_admin_role = 'roles' in user and 'ControlCenterAdmin' in user['roles'] + has_control_center_admin_role = 'roles' in user and 'ControlCenterAdmin' in user['roles'] has_dashboard_reader_role = 'roles' in user and 'ControlCenterDashboardReader' in user['roles'] + has_regular_admin_role = 'roles' in user and 'Admin' in user['roles'] - # ControlCenterAdmin always has full access - if has_admin_role: - return f(*args, **kwargs) - - # For dashboard access, check if DashboardReader role grants access - if access_level == 'dashboard': - if require_member_of_control_center_dashboard_reader and has_dashboard_reader_role: - return f(*args, **kwargs) - - # Check if role requirements are enforced + # Check if ControlCenterAdmin role requirement is enforced if require_member_of_control_center_admin: - # Admin role required but user doesn't have it + # ControlCenterAdmin role is REQUIRED for access + # Only ControlCenterAdmin role grants full access + if has_control_center_admin_role: + return f(*args, **kwargs) + + # For dashboard access, check if DashboardReader role grants access + if access_level == 'dashboard': + if require_member_of_control_center_dashboard_reader and has_dashboard_reader_role: + return f(*args, **kwargs) + + # User doesn't have ControlCenterAdmin role, deny access + # Note: Regular Admin role does NOT grant access when this setting is enabled is_api_request = (request.accept_mimetypes.accept_json and not request.accept_mimetypes.accept_html) or request.path.startswith('/api/') if is_api_request: return jsonify({"error": "Forbidden", "message": "Insufficient permissions (ControlCenterAdmin role required)"}), 403 else: return "Forbidden: ControlCenterAdmin role required", 403 - if access_level == 'dashboard' and require_member_of_control_center_dashboard_reader: - # Dashboard reader role required but user doesn't have it - is_api_request = (request.accept_mimetypes.accept_json and not request.accept_mimetypes.accept_html) or request.path.startswith('/api/') - if is_api_request: - return jsonify({"error": "Forbidden", "message": "Insufficient permissions (ControlCenterDashboardReader role required)"}), 403 - else: - return "Forbidden: ControlCenterDashboardReader role required", 403 + # ControlCenterAdmin requirement is NOT enforced (default behavior) + # Only regular Admin role grants access - ControlCenterAdmin role is IGNORED + if has_regular_admin_role: + return f(*args, **kwargs) - # No role requirements enabled โ†’ allow all admins (default behavior) - return f(*args, **kwargs) + # For dashboard-only access, check if DashboardReader role is enabled and user has it + if access_level == 'dashboard': + if require_member_of_control_center_dashboard_reader and has_dashboard_reader_role: + return f(*args, **kwargs) + + # User is not an admin and doesn't have special roles - deny access + is_api_request = (request.accept_mimetypes.accept_json and not request.accept_mimetypes.accept_html) or request.path.startswith('/api/') + if is_api_request: + return jsonify({"error": "Forbidden", "message": "Insufficient permissions (Admin role required)"}), 403 + else: + return "Forbidden: Admin role required", 403 return decorated_function return decorator diff --git a/application/single_app/route_frontend_control_center.py b/application/single_app/route_frontend_control_center.py index 7215a60a..c5f3f44b 100644 --- a/application/single_app/route_frontend_control_center.py +++ b/application/single_app/route_frontend_control_center.py @@ -28,14 +28,30 @@ def control_center(): stats = get_control_center_statistics() # Check user's role for frontend conditional rendering + # Determine if user has full admin access (can see all tabs) user = session.get('user', {}) - has_admin_role = 'ControlCenterAdmin' in user.get('roles', []) + user_roles = user.get('roles', []) + require_member_of_control_center_admin = settings.get("require_member_of_control_center_admin", False) + + # User has full admin access based on which role requirement is active: + # - When require_member_of_control_center_admin is ENABLED: Only ControlCenterAdmin role grants access + # - When require_member_of_control_center_admin is DISABLED: Only regular Admin role grants access + has_control_center_admin_role = 'ControlCenterAdmin' in user_roles + has_regular_admin_role = 'Admin' in user_roles + + # Full admin access means they can see dashboard + management tabs + activity logs + if require_member_of_control_center_admin: + # ControlCenterAdmin role is required - only that role grants full access + has_full_admin_access = has_control_center_admin_role + else: + # ControlCenterAdmin requirement is disabled - only regular Admin role grants full access + has_full_admin_access = has_regular_admin_role return render_template('control_center.html', app_settings=public_settings, settings=public_settings, statistics=stats, - has_control_center_admin=has_admin_role) + has_control_center_admin=has_full_admin_access) except Exception as e: debug_print(f"Error loading control center: {e}") flash(f"Error loading control center: {str(e)}", "error") diff --git a/application/single_app/templates/_sidebar_nav.html b/application/single_app/templates/_sidebar_nav.html index 8fd83cfa..531f4074 100644 --- a/application/single_app/templates/_sidebar_nav.html +++ b/application/single_app/templates/_sidebar_nav.html @@ -484,8 +484,11 @@ {% endif %} - - {% if request.endpoint == 'control_center' and ((session.get('user') and 'ControlCenterAdmin' in session['user']['roles']) or (app_settings.require_member_of_control_center_dashboard_reader and session.get('user') and 'ControlCenterDashboardReader' in session['user']['roles']) or ('Admin' in session['user']['roles'] and not app_settings.require_member_of_control_center_admin and not app_settings.require_member_of_control_center_dashboard_reader)) %} + + + + + {% if request.endpoint == 'control_center' and ((app_settings.require_member_of_control_center_admin and session.get('user') and 'ControlCenterAdmin' in session['user']['roles']) or (app_settings.require_member_of_control_center_dashboard_reader and session.get('user') and 'ControlCenterDashboardReader' in session['user']['roles']) or (not app_settings.require_member_of_control_center_admin and 'Admin' in session['user']['roles'])) %}
@@ -513,8 +516,10 @@ Dashboard - {# Only show admin tabs if user has ControlCenterAdmin role #} - {% if session.get('user') and 'ControlCenterAdmin' in session['user']['roles'] %} + {# Only show admin tabs if user has full admin access based on settings #} + {# When require_member_of_control_center_admin is ENABLED: need ControlCenterAdmin role #} + {# When DISABLED: need regular Admin role #} + {% if (app_settings.require_member_of_control_center_admin and session.get('user') and 'ControlCenterAdmin' in session['user']['roles']) or (not app_settings.require_member_of_control_center_admin and session.get('user') and 'Admin' in session['user']['roles']) %}
  • User Management @@ -687,8 +692,11 @@ App Settings
    • {% endif %} - {# Control Center - accessible to admins OR users with ControlCenter roles #} - {% if (session.get('user') and 'ControlCenterAdmin' in session['user']['roles']) or (app_settings.require_member_of_control_center_dashboard_reader and session.get('user') and 'ControlCenterDashboardReader' in session['user']['roles']) or ('Admin' in session['user']['roles'] and not app_settings.require_member_of_control_center_admin and not app_settings.require_member_of_control_center_dashboard_reader) %} + {# Control Center - access based on role requirements #} + {# When require_member_of_control_center_admin ENABLED: only ControlCenterAdmin role grants access #} + {# When DISABLED (default): only regular Admin role grants access #} + {# DashboardReader role grants dashboard-only access when that setting is enabled #} + {% if (app_settings.require_member_of_control_center_admin and session.get('user') and 'ControlCenterAdmin' in session['user']['roles']) or (app_settings.require_member_of_control_center_dashboard_reader and session.get('user') and 'ControlCenterDashboardReader' in session['user']['roles']) or (not app_settings.require_member_of_control_center_admin and 'Admin' in session['user']['roles']) %}
  • Control Center
    • diff --git a/application/single_app/templates/_top_nav.html b/application/single_app/templates/_top_nav.html index db09b671..cd7e2258 100644 --- a/application/single_app/templates/_top_nav.html +++ b/application/single_app/templates/_top_nav.html @@ -191,8 +191,11 @@ App Settings {% endif %} - {# Control Center - accessible to admins OR users with ControlCenter roles #} - {% if (session.get('user') and 'ControlCenterAdmin' in session['user']['roles']) or (app_settings.require_member_of_control_center_dashboard_reader and session.get('user') and 'ControlCenterDashboardReader' in session['user']['roles']) or ('Admin' in session['user']['roles'] and not app_settings.require_member_of_control_center_admin and not app_settings.require_member_of_control_center_dashboard_reader) %} + {# Control Center - access based on role requirements #} + {# When require_member_of_control_center_admin ENABLED: only ControlCenterAdmin role grants access #} + {# When DISABLED (default): only regular Admin role grants access #} + {# DashboardReader role grants dashboard-only access when that setting is enabled #} + {% if (app_settings.require_member_of_control_center_admin and session.get('user') and 'ControlCenterAdmin' in session['user']['roles']) or (app_settings.require_member_of_control_center_dashboard_reader and session.get('user') and 'ControlCenterDashboardReader' in session['user']['roles']) or (not app_settings.require_member_of_control_center_admin and 'Admin' in session['user']['roles']) %}
  • Control Center
    • diff --git a/docs/explanation/features/VIDEO_INDEXER_DUAL_AUTHENTICATION.md b/docs/explanation/features/VIDEO_INDEXER_DUAL_AUTHENTICATION.md deleted file mode 100644 index cd1d3ff6..00000000 --- a/docs/explanation/features/VIDEO_INDEXER_DUAL_AUTHENTICATION.md +++ /dev/null @@ -1,149 +0,0 @@ -# Video Indexer Dual Authentication Support - -## Feature Overview -Added comprehensive support for both API key and managed identity authentication methods for Azure Video Indexer integration. - -**Implemented in version:** 0.229.064 -**Fixed in version:** 0.229.065 - -## Background -Previously, the Video Indexer integration only supported managed identity authentication despite having API key fields in the admin UI. This feature implements full dual authentication support, allowing users to choose between: -- **Managed Identity**: Uses Azure ARM token-based authentication, generates access token via ARM API -- **API Key**: Uses subscription key to generate access token via Video Indexer auth endpoint - -## Technical Implementation - -### 1. Authentication Functions (`functions_authentication.py`) -- **New Function**: `get_video_indexer_account_token()` - Main entry point that branches based on authentication type -- **Enhanced Function**: `get_video_indexer_api_key_token()` - Uses API key to generate access token via Video Indexer auth endpoint -- **Enhanced Function**: `get_video_indexer_managed_identity_token()` - Handles ARM token acquisition and generates access token via ARM API - -#### Authentication Flow -```python -auth_type = settings.get("video_indexer_authentication_type", "managed_identity") - -if auth_type == "key": - return get_video_indexer_api_key_token(settings, video_id) -else: - return get_video_indexer_managed_identity_token(settings, video_id) -``` - -#### API Key Token Generation -```python -# Generate access token using API key -api_url = "https://api.videoindexer.ai" -auth_url = f"{api_url}/auth/{location}/Accounts/{account_id}/AccessToken" -headers = {"Ocp-Apim-Subscription-Key": api_key} -params = {"allowEdit": "true"} -response = requests.get(auth_url, headers=headers, params=params) -access_token = response.text.strip('"') -``` - -### 2. Video Processing Updates (`functions_documents.py`) -Updated all Video Indexer API calls to use access tokens for authentication: - -#### Authentication Pattern (Both Methods) -Both API key and managed identity authentication now return an access token that is used consistently across all Video Indexer API calls: -- Uses `accessToken` query parameter in all API requests -- No headers required for authentication after token is generated -- Token is generated once per operation and reused for upload, polling, and deletion - -#### API Key Flow -1. API key โ†’ Video Indexer auth endpoint โ†’ Access token -2. Access token โ†’ Video Indexer API calls (upload, poll, delete) - -#### Managed Identity Flow -1. Managed identity โ†’ ARM API โ†’ Access token -2. Access token โ†’ Video Indexer API calls (upload, poll, delete) - -#### Affected Operations -- Video upload and processing: `?accessToken={token}` -- Processing status polling: `?accessToken={token}` -- Video deletion: `?accessToken={token}` -- Video validation: Uses same access token pattern - -### 3. Admin UI Controls (`admin_settings.html`) -Added authentication type selector with conditional field visibility: - -#### New Controls -- **Authentication Type Dropdown**: Select between "Managed Identity" and "API Key" -- **Conditional Field Visibility**: - - API key field shown only when "API Key" selected - - ARM fields shown only when "Managed Identity" selected - -#### JavaScript Behavior -- Dynamic show/hide of relevant fields based on selection -- Seamless user experience with real-time form updates - -### 4. Backend Form Handling (`route_frontend_admin_settings.py`) -Updated form processing to capture and save the authentication type setting. - -### 5. Default Settings (`functions_settings.py`) -Added `video_indexer_authentication_type` with default value `"managed_identity"` to maintain backward compatibility. - -## Usage Instructions - -### Configuring API Key Authentication -1. Navigate to Admin Settings โ†’ Video Indexer -2. Select "API Key" from Authentication Type dropdown -3. Enter your Video Indexer subscription key -4. API key fields will be automatically shown -5. Save settings - -### Configuring Managed Identity Authentication -1. Navigate to Admin Settings โ†’ Video Indexer -2. Select "Managed Identity" from Authentication Type dropdown -3. Configure ARM resource management settings -4. Managed identity fields will be automatically shown -5. Save settings - -## Configuration Options - -### API Key Method -- **video_indexer_authentication_type**: `"key"` -- **video_indexer_key**: Your subscription key -- **video_indexer_account_id**: Your account ID -- **video_indexer_location**: Your region - -### Managed Identity Method -- **video_indexer_authentication_type**: `"managed_identity"` -- **video_indexer_arm_access_token**: Auto-acquired -- **video_indexer_account_id**: Your account ID -- **video_indexer_location**: Your region - -## Benefits -- **Flexibility**: Choose authentication method based on security requirements -- **Backward Compatibility**: Existing managed identity setups continue working -- **Security**: Support for both enterprise (managed identity) and development (API key) scenarios -- **User Experience**: Intuitive admin interface with contextual field visibility - -## Testing Coverage -Comprehensive functional testing validates: -- โœ… Settings configuration and defaults -- โœ… Authentication function branching logic -- โœ… Video processing API call adaptations -- โœ… Admin UI control behavior and visibility -- โœ… Backend form processing integration - -## Integration Points -- **Azure Video Indexer API**: Dual authentication support -- **Azure ARM API**: Managed identity token acquisition -- **Admin Settings UI**: Authentication method selection -- **Cosmos DB**: Settings persistence -- **Application Logging**: Authentication method tracking - -## Dependencies -- Azure Video Indexer service -- Azure ARM API (for managed identity) -- DefaultAzureCredential (for managed identity) -- Bootstrap CSS framework (for UI) - -## Known Limitations -- Authentication type cannot be changed during video processing -- API key method requires manual key management and rotation -- Managed identity requires proper Azure RBAC permissions - -## Future Enhancements -- Authentication method validation and testing within admin UI -- Automatic fallback between authentication methods -- Enhanced logging for authentication troubleshooting \ No newline at end of file diff --git a/docs/explanation/fixes/MULTIMODAL_VISION_SETTINGS_SAVE_FIX.md b/docs/explanation/fixes/MULTIMODAL_VISION_SETTINGS_SAVE_FIX.md deleted file mode 100644 index 9730a31e..00000000 --- a/docs/explanation/fixes/MULTIMODAL_VISION_SETTINGS_SAVE_FIX.md +++ /dev/null @@ -1,159 +0,0 @@ -# Multi-Modal Vision Settings Not Saving Fix - -**Version**: 0.229.090 -**Date**: November 21, 2025 -**Issue**: Multi-modal vision toggle and model selection reverted when saving admin settings - -## Problem - -When users enabled multi-modal vision analysis and selected a vision model in the admin settings, clicking "Save Settings" would cause the values to revert to their previous state. The settings appeared to save momentarily but would reset on page reload or when navigating away. - -**User Report**: "i tested the multi-modal model in app settings but when i click save it reverts so its not saving" - -## Root Cause - -The backend form processing code in `route_frontend_admin_settings.py` was not extracting and saving the new multi-modal vision fields from the form data. When the settings were saved to Cosmos DB, these fields were omitted: - -- `enable_multimodal_vision` (checkbox) -- `multimodal_vision_model` (dropdown selection) - -The HTML form had the correct `name` attributes: -```html - -