iatoolkit 2.46.0__tar.gz → 2.47.0__tar.gz

{iatoolkit-2.46.0/src/iatoolkit.egg-info → iatoolkit-2.47.0}/PKG-INFO

@@ -1,6 +1,6 @@
 Metadata-Version: 2.4
 Name: iatoolkit
-Version: 2.46.0
+Version: 2.47.0
 Summary: IAToolkit
 Author: Fernando Libedinsky
 License-Expression: MIT
@@ -51,6 +51,7 @@ Requires-Dist: langchain==0.3.19
 Requires-Dist: langchain-core==0.3.35
 Requires-Dist: langchain-text-splitters==0.3.6
 Requires-Dist: markdown2==2.5.3
+Requires-Dist: nh3==0.3.7
 Requires-Dist: openai==2.8.1
 Requires-Dist: openpyxl==3.1.5
 Requires-Dist: pandas==2.3.1

{iatoolkit-2.46.0 → iatoolkit-2.47.0}/requirements.txt

@@ -43,6 +43,7 @@ langchain==0.3.19
 langchain-core==0.3.35
 langchain-text-splitters==0.3.6
 markdown2==2.5.3
+nh3==0.3.7
 openai==2.8.1
 openpyxl==3.1.5
 pandas==2.3.1

{iatoolkit-2.46.0 → iatoolkit-2.47.0}/src/iatoolkit/__init__.py

@@ -3,7 +3,7 @@
 #
 # IAToolkit is open source software.
 
-__version__ = "2.46.0"
+__version__ = "2.47.0"
 
 # Expose main classes and functions at the top level of the package
 

iatoolkit-2.47.0/src/iatoolkit/common/url_safety.py

@@ -0,0 +1,163 @@
+# Copyright (c) 2024 Fernando Libedinsky
+# Product: IAToolkit
+#
+# IAToolkit is open source software.
+
+"""
+Shared SSRF guard for URLs that arrive from tenants or API callers and that the
+server will then connect to itself: task callback URLs, attachment downloads,
+MCP image fetches, and similar.
+
+Checking only literal IPs (``https://10.0.0.5/...``) is not enough - an
+attacker-controlled hostname can resolve to 10.x / 169.254.169.254 / ::1 just
+as well, and a public URL can 302 to one. This module therefore:
+
+* requires an absolute URL with an allowed scheme and a hostname;
+* rejects well-known local names (localhost, *.local, *.localhost, *.internal);
+* rejects literal IPs that are private, loopback, link-local, multicast,
+  reserved or unspecified;
+* resolves hostnames and rejects them when ANY resolved address falls in those
+  ranges (fail-closed on a private answer; fail-open only when the name cannot
+  be resolved at all, since that request could not have reached anything);
+* offers ``fetch_with_safe_redirects`` which never lets ``requests`` follow a
+  redirect blindly: every hop is re-validated with the same rules.
+
+Validate-then-connect still leaves a small DNS-rebinding window (the resolver
+may return a different address at connect time); closing it fully needs
+connection-level IP pinning, which is out of scope here. Callers should also
+disable redirects on the actual request or use ``fetch_with_safe_redirects``.
+"""
+
+from __future__ import annotations
+
+import ipaddress
+import socket
+from urllib.parse import ParseResult, urljoin, urlparse
+
+import requests
+
+from iatoolkit.common.exceptions import IAToolkitException
+
+_BLOCKED_HOSTNAMES = {"localhost", "localhost.localdomain"}
+_BLOCKED_HOST_SUFFIXES = (".local", ".localhost", ".internal")
+_REDIRECT_STATUSES = {301, 302, 303, 307, 308}
+
+
+def classify_ip(ip_value: ipaddress.IPv4Address | ipaddress.IPv6Address) -> str:
+    """'blocked' for loopback/link-local/multicast/reserved/unspecified,
+    'private' for RFC1918 & friends, 'public' otherwise."""
+    if (
+        ip_value.is_loopback
+        or ip_value.is_link_local
+        or ip_value.is_multicast
+        or ip_value.is_reserved
+        or ip_value.is_unspecified
+    ):
+        return "blocked"
+    if ip_value.is_private:
+        return "private"
+    # IPv4-mapped IPv6 (::ffff:10.0.0.1) must be judged by the embedded IPv4.
+    mapped = getattr(ip_value, "ipv4_mapped", None)
+    if mapped is not None:
+        return classify_ip(mapped)
+    return "public"
+
+
+def _to_ip_or_none(host: str):
+    try:
+        return ipaddress.ip_address(host)
+    except ValueError:
+        return None
+
+
+def resolve_host_classifications(hostname: str) -> list[str] | None:
+    """Resolves ``hostname`` and classifies every address. Returns None when the
+    name cannot be resolved (caller decides how to treat that)."""
+    try:
+        entries = socket.getaddrinfo(hostname, None)
+    except Exception:
+        return None
+
+    classifications: list[str] = []
+    for entry in entries:
+        sockaddr = entry[4]
+        if not sockaddr:
+            continue
+        ip_value = _to_ip_or_none(str(sockaddr[0]).split("%", 1)[0])
+        if ip_value is not None:
+            classifications.append(classify_ip(ip_value))
+    return classifications
+
+
+def assert_public_http_url(
+    url: str,
+    *,
+    allowed_schemes: tuple[str, ...] = ("https",),
+    error_type: IAToolkitException.ErrorType = IAToolkitException.ErrorType.INVALID_PARAMETER,
+    label: str = "URL",
+) -> ParseResult:
+    """
+    Raises IAToolkitException(error_type) unless ``url`` is an absolute URL with
+    an allowed scheme whose host is a public internet address (literal or via
+    DNS). Returns the parsed URL on success.
+    """
+    normalized = str(url or "").strip()
+    parsed = urlparse(normalized)
+    scheme = (parsed.scheme or "").strip().lower()
+    hostname = (parsed.hostname or "").strip().lower().rstrip(".")
+
+    if scheme not in allowed_schemes:
+        raise IAToolkitException(
+            error_type,
+            f"{label} must use {'/'.join(s.upper() for s in allowed_schemes)}.",
+        )
+    if not hostname:
+        raise IAToolkitException(error_type, f"{label} host is required.")
+    if hostname in _BLOCKED_HOSTNAMES or hostname.endswith(_BLOCKED_HOST_SUFFIXES):
+        raise IAToolkitException(error_type, f"{label} host is not allowed.")
+
+    ip_value = _to_ip_or_none(hostname)
+    if ip_value is not None:
+        if classify_ip(ip_value) != "public":
+            raise IAToolkitException(error_type, f"{label} host is not allowed.")
+        return parsed
+
+    classifications = resolve_host_classifications(hostname)
+    if classifications and any(kind != "public" for kind in classifications):
+        raise IAToolkitException(
+            error_type,
+            f"{label} host is not allowed (resolves to a private or reserved address).",
+        )
+    return parsed
+
+
+def fetch_with_safe_redirects(
+    url: str,
+    *,
+    allowed_schemes: tuple[str, ...] = ("https",),
+    error_type: IAToolkitException.ErrorType = IAToolkitException.ErrorType.INVALID_PARAMETER,
+    label: str = "URL",
+    max_redirects: int = 3,
+    **requests_kwargs,
+) -> requests.Response:
+    """
+    ``requests.get`` that validates the initial URL and every redirect hop with
+    ``assert_public_http_url`` instead of letting ``requests`` follow them
+    blindly (a public URL that 302s to http://169.254.169.254/ would otherwise
+    sail through). Extra kwargs (timeout, stream, headers, ...) are passed to
+    ``requests.get``; ``allow_redirects`` is always forced to False.
+    """
+    requests_kwargs.pop("allow_redirects", None)
+    current_url = str(url or "").strip()
+    for _ in range(max_redirects + 1):
+        assert_public_http_url(
+            current_url, allowed_schemes=allowed_schemes, error_type=error_type, label=label
+        )
+        response = requests.get(current_url, allow_redirects=False, **requests_kwargs)
+        location = response.headers.get("Location") if response.status_code in _REDIRECT_STATUSES else None
+        if not location:
+            return response
+        response.close()
+        current_url = urljoin(current_url, location)
+
+    raise IAToolkitException(error_type, f"{label} redirected too many times.")

{iatoolkit-2.46.0 → iatoolkit-2.47.0}/src/iatoolkit/common/util.py

@@ -9,7 +9,16 @@ from iatoolkit.common.exceptions import IAToolkitException
 from flask import request
 from injector import inject
 import os
-from jinja2 import Environment, FileSystemLoader
+from jinja2 import FileSystemLoader
+# Prompt templates are authored by tenant users through the GUI/API, not by the
+# operator running this server, so they must render in a sandbox: a plain
+# jinja2.Environment lets a template walk `cycler.__init__.__globals__.os` (or
+# any object's __class__/__mro__/__subclasses__) straight into the interpreter
+# and execute commands on the host. ImmutableSandboxedEnvironment blocks
+# underscore-prefixed attribute access, unsafe callables, and state-mutating
+# methods while leaving everything a prompt legitimately needs (variables,
+# loops, conditionals, filters, includes) intact.
+from jinja2.sandbox import ImmutableSandboxedEnvironment
 from datetime import datetime, date
 from decimal import Decimal
 import yaml
@@ -33,7 +42,7 @@ class Utility:
             template_dir = os.path.dirname(template_pathname)
             template_file = os.path.basename(template_pathname)
 
-            env = Environment(loader=FileSystemLoader(template_dir))
+            env = ImmutableSandboxedEnvironment(loader=FileSystemLoader(template_dir))
             template = env.get_template(template_file)
 
             # Explicit kwargs should win over client_data to preserve rich objects
@@ -71,7 +80,7 @@ class Utility:
             else:
                 loader = None  # Sin loader, no se pueden incluir plantillas desde archivos.
 
-            env = Environment(loader=loader)
+            env = ImmutableSandboxedEnvironment(loader=loader)
             template = env.from_string(template_string)
 
             # Explicit kwargs should win over client_data to preserve rich objects

{iatoolkit-2.46.0 → iatoolkit-2.47.0}/src/iatoolkit/infra/connectors/local_file_connector.py

@@ -37,9 +37,33 @@ class LocalFileConnector(FileConnector):
             raise IAToolkitException(IAToolkitException.ErrorType.FILE_IO_ERROR,
                                f"Error procesando el directorio {self.directory}: {e}")
 
+    def _resolve_within_root(self, file_path: str) -> str:
+        """
+        Maps a storage key / path onto the filesystem and refuses anything that
+        escapes the connector's root directory. `file_path` may be relative (a
+        storage key) or absolute (the `path` values list_files() hands back);
+        either way the real, symlink-resolved target must stay under root -
+        otherwise a caller-controlled key like `../../etc/passwd` or
+        `/proc/self/environ` turns this connector into an arbitrary file
+        read/write/delete on the host.
+        """
+        candidate = str(file_path or "").strip()
+        if not candidate or "\x00" in candidate:
+            raise IAToolkitException(IAToolkitException.ErrorType.INVALID_PARAMETER,
+                                     "Invalid storage path.")
+
+        root = os.path.realpath(self.directory)
+        target = candidate if os.path.isabs(candidate) else os.path.join(root, candidate)
+        resolved = os.path.realpath(target)
+        if resolved != root and not resolved.startswith(root + os.sep):
+            raise IAToolkitException(IAToolkitException.ErrorType.PERMISSION,
+                                     f"Storage path escapes the configured root directory: {file_path}")
+        return resolved
+
     def get_file_content(self, file_path: str) -> bytes:
+        full_path = self._resolve_within_root(file_path)
         try:
-            with open(file_path, 'rb') as f:
+            with open(full_path, 'rb') as f:
                 return f.read()
         except Exception as e:
             raise IAToolkitException(IAToolkitException.ErrorType.FILE_IO_ERROR,
@@ -47,7 +71,7 @@ class LocalFileConnector(FileConnector):
 
     def upload_file(self, file_path: str, content: bytes, content_type: str = None) -> None:
         # Nota: file_path debe ser relativo al directorio raíz configurado
-        full_path = os.path.join(self.directory, file_path)
+        full_path = self._resolve_within_root(file_path)
 
         # Asegurar que el directorio destino existe
         try:
@@ -59,7 +83,7 @@ class LocalFileConnector(FileConnector):
                                      f"Error escribiendo el archivo {file_path}: {e}")
 
     def delete_file(self, file_path: str) -> None:
-        full_path = os.path.join(self.directory, file_path)
+        full_path = self._resolve_within_root(file_path)
         try:
             if os.path.exists(full_path):
                 os.remove(full_path)

{iatoolkit-2.46.0 → iatoolkit-2.47.0}/src/iatoolkit/infra/llm_providers/openai_adapter.py

@@ -92,12 +92,16 @@ class OpenAIAdapter:
         Important cases:
         - Assistant messages with `tool_calls` must become top-level `function_call` items.
         - `function_call_output` items must not include internal-only fields such as `status`.
+        - Without `previous_response_id`, include client-side `context_history` before
+          the current turn so OpenAI can run from locally managed history if needed.
         - When continuing from a prior response with `previous_response_id`, tool follow-ups
           should only append the `function_call_output` items because the previous response
           already contains the originating user/assistant turns on OpenAI's side.
         """
-        _ = context_history
-        combined_input: List[Dict[str, Any]] = list(input_items or [])
+        combined_input: List[Dict[str, Any]] = []
+        if not previous_response_id:
+            combined_input.extend(context_history or [])
+        combined_input.extend(input_items or [])
 
         has_function_outputs = any(
             isinstance(item, dict) and item.get("type") == "function_call_output"

{iatoolkit-2.46.0 → iatoolkit-2.47.0}/src/iatoolkit/services/llm_client_service.py

@@ -12,6 +12,7 @@ from iatoolkit.common.model_registry import ModelRegistry
 from injector import inject
 import time
 import markdown2
+import nh3
 import os
 import logging
 import json
@@ -1393,10 +1394,19 @@ class llmClient:
 
         # Heurística simple: si contiene tags, lo tratamos como HTML ya renderizable
         if re.search(r"</?[a-zA-Z][\s\S]*>", answer):
-            return answer.replace("\n", "")
-
-        html_answer = markdown2.markdown(answer).replace("\n", "")
-        return html_answer
+            html_answer = answer.replace("\n", "")
+        else:
+            html_answer = markdown2.markdown(answer).replace("\n", "")
+
+        # The result is injected into the chat DOM as HTML (and stored, then shown
+        # again in the admin monitoring inspector). The model echoes whatever it
+        # was fed - SQL rows, RAG documents, tool results - so an <img onerror>,
+        # <svg onload> or javascript: link planted in tenant data would otherwise
+        # run in every viewer's browser, including admins'. nh3 is an allowlist
+        # sanitizer: it keeps the formatting markdown2 produces (headings, lists,
+        # tables, code, links, images) and strips scripts, event handlers,
+        # iframes/objects and javascript:/data: URLs.
+        return nh3.clean(html_answer)
 
     def format_plaintext(self, answer: str):
         if not answer:

iatoolkit-2.47.0/src/iatoolkit/services/operator_identity_service.py

@@ -0,0 +1,136 @@
+# Copyright (c) 2024 Fernando Libedinsky
+# Product: IAToolkit
+#
+# IAToolkit is open source software.
+
+import logging
+import os
+
+from injector import inject, singleton
+
+from iatoolkit.common.exceptions import IAToolkitException
+
+
+@singleton
+class OperatorIdentityService:
+    """Who operates this deployment, and who collects from it — two questions.
+
+    They were one, answered by one name, and that held only because on our own
+    deployment the answers coincide. They came apart the first time a customer ran
+    IAToolkit on its own infrastructure: that installation *is* operated by its
+    company — its accounts live there, its console belongs to it — and it collects
+    from nobody. The monthly close refused to run because it asked for a merchant
+    account that had no reason to exist.
+
+    So:
+
+    * **The operator** is identity. Where this deployment's own accounts live,
+      which company you must be signed into to reach the control center, and which
+      company the console leaves out of its own portfolio. Every installation has
+      one.
+    * **The billing company** is money. Whose merchant account charges a card,
+      whose bank details sign a transfer notice, whose Stripe configuration holds
+      the webhook secret. Only an installation that collects has one, and it
+      defaults to the operator because usually they are the same company — but not
+      always: the company that runs the deployment and the entity that issues the
+      invoices can be in different countries.
+
+    Lives in the core because the core, Enterprise and the website all ask it, and
+    a rule restated in three repositories drifts. Same reason ``ServiceModel`` is
+    here.
+    """
+
+    #: Identity. Read on every request that reaches the console.
+    SETTING_NAME = "IAT_OPERATOR_COMPANY"
+
+    #: Money. Optional: absent means "the operator collects", which is the common
+    #: case. Named separately so an installation that collects for a different
+    #: legal entity can say so, and so one that collects for nobody can leave it
+    #: empty instead of inventing a merchant.
+    BILLING_SETTING_NAME = "IAT_BILLING_COMPANY_SHORT_NAME"
+
+    #: Held on the class, not the instance. Callers that have a repository at hand
+    #: build their own instance rather than asking the injector, so an instance
+    #: cache resolved — and logged, and queried the database — once per request
+    #: instead of once per process.
+    _resolved: str | None = None
+
+    @classmethod
+    def reset_cache(cls) -> None:
+        """Forget the resolved name. For tests: it cannot change at runtime."""
+        OperatorIdentityService._resolved = None
+
+    @classmethod
+    def stated_name(cls) -> str:
+        """The operator, as this deployment names it. Empty when nothing names it.
+
+        For callers with no database at hand — and there is nothing to verify: an
+        explicitly configured name was never checked against the database, and a
+        company that does not exist cannot authenticate anyone.
+
+        Empty rather than a guess. The name of another deployment travelling into
+        this one is what made a monthly close resolve the payment configuration of
+        a company that was not there and mark every invoice failed.
+        """
+        return (os.getenv(cls.SETTING_NAME) or "").strip().lower()
+
+    @classmethod
+    def stated_billing_name(cls) -> str:
+        """Who collects, as this deployment names it. Empty when nobody does."""
+        explicit = (os.getenv(cls.BILLING_SETTING_NAME) or "").strip().lower()
+        return explicit or cls.stated_name()
+
+    @inject
+    def __init__(self):
+        # No database: since the legacy fallback went away there is nothing to
+        # verify. The answers are two environment variables and a cache.
+        pass
+
+    def company_short_name(self) -> str:
+        """The operator company, resolved once per process.
+
+        Cached because the answer cannot change without a deployment, and this is
+        read on paths that run per request.
+        """
+        if OperatorIdentityService._resolved:
+            return OperatorIdentityService._resolved
+
+        configured = self.stated_name()
+        if configured:
+            OperatorIdentityService._resolved = configured
+            logging.info("Operator company: '%s' (from %s).", configured, self.SETTING_NAME)
+            return configured
+
+        # Deliberately loud, and about identity rather than money: without this
+        # name nobody can be signed in as the operator and the console has no
+        # portfolio to show.
+        raise IAToolkitException(
+            IAToolkitException.ErrorType.CONFIG_ERROR,
+            f"This deployment does not say who operates it. Set {self.SETTING_NAME} "
+            f"to the short name of the company that runs it.",
+        )
+
+    def billing_company_short_name(self) -> str:
+        """The company whose merchant account collects.
+
+        Falls back to the operator, because usually they are the same company.
+        Asked for only where money moves — a card being charged, a transfer notice
+        being signed, a webhook secret being read — so an installation that
+        collects from nobody never has to answer it.
+        """
+        explicit = (os.getenv(self.BILLING_SETTING_NAME) or "").strip().lower()
+        if explicit:
+            return explicit
+
+        try:
+            return self.company_short_name()
+        except IAToolkitException:
+            # The message has to be about collecting, because that is what the
+            # caller was doing. Pointing at the operator setting here sends
+            # somebody to configure identity for a payment problem.
+            raise IAToolkitException(
+                IAToolkitException.ErrorType.CONFIG_ERROR,
+                f"This deployment has no company to collect with. Set "
+                f"{self.BILLING_SETTING_NAME} to the company whose merchant "
+                f"account charges, or {self.SETTING_NAME} if the operator collects.",
+            )

{iatoolkit-2.46.0 → iatoolkit-2.47.0}/src/iatoolkit/services/storage_service.py

@@ -234,8 +234,34 @@ class StorageService:
             logging.error(error_msg)
             raise IAToolkitException(IAToolkitException.ErrorType.FILE_IO_ERROR, error_msg)
 
+    @staticmethod
+    def _validate_storage_key(storage_key: str) -> str:
+        """
+        Defensive check shared by every read/delete: a storage key must never
+        walk up with `..` (or carry NUL bytes). Absolute paths are deliberately
+        left to the connector - LocalFileConnector confines them to its root,
+        and its list_files() legitimately hands back absolute paths that flow
+        into here. Callers that accept keys from untrusted input additionally
+        enforce the `companies/<tenant>/` prefix (see
+        AttachmentResolutionService._validate_existing_storage_key); this guard
+        is the floor that applies even to internally sourced keys.
+        """
+        normalized = str(storage_key or "").strip()
+        segments = normalized.replace("\\", "/").split("/")
+        if (
+            not normalized
+            or "\x00" in normalized
+            or any(segment in {".", ".."} for segment in segments)
+        ):
+            raise IAToolkitException(
+                IAToolkitException.ErrorType.INVALID_PARAMETER,
+                "Invalid storage key.",
+            )
+        return normalized
+
     def get_document_content(self, company_short_name: str, storage_key: str) -> bytes:
         """Retrieves raw content via the configured connector."""
+        storage_key = self._validate_storage_key(storage_key)
         try:
             connector = self._get_connector(company_short_name)
             return connector.get_file_content(storage_key)
@@ -247,6 +273,7 @@ class StorageService:
         """
         Deletes a document from the configured storage.
         """
+        storage_key = self._validate_storage_key(storage_key)
         try:
             connector = self._get_connector(company_short_name)
             connector.delete_file(storage_key)

{iatoolkit-2.46.0 → iatoolkit-2.47.0}/src/iatoolkit/static/js/chat_main.js

@@ -3,6 +3,65 @@ let isRequestInProgress = false;
 let abortController = null;
 let selectedPrompt = null; // Will hold a lightweight prompt object
 
+// Allowlist-style sanitizer for the HTML answer returned by the backend. The
+// server already sanitizes it (LLMClientService.format_html -> nh3), but this is
+// the last line before .append()/.html() parse it into the live DOM, and the
+// model echoes tenant data (SQL rows, RAG documents, tool results) where an
+// <img onerror> or javascript: link could be planted. Parses into an inert
+// document, drops executable elements, event-handler attributes and
+// script-bearing URLs, and returns the surviving markup.
+function sanitizeHtmlFragment(html) {
+    const source = String(html || '');
+    if (!source) return '';
+    if (typeof DOMParser === 'undefined') {
+        return $('<div>').text(source).html();
+    }
+
+    const BLOCKED_TAGS = new Set([
+        'script', 'style', 'iframe', 'frame', 'frameset', 'object', 'embed', 'applet',
+        'link', 'meta', 'base', 'form', 'input', 'button', 'textarea', 'select', 'option',
+        'svg', 'math', 'template', 'noscript',
+    ]);
+    const URL_ATTRS = new Set(['href', 'src', 'xlink:href', 'action', 'formaction', 'srcset', 'poster', 'background', 'data']);
+
+    const isUnsafeUrl = (value, attrName, tagName) => {
+        // Strip whitespace/control chars browsers ignore ("java\tscript:").
+        const normalized = String(value || '').replace(/[\u0000-\u0020\u007f-\u00a0]/g, '').toLowerCase();
+        if (normalized.startsWith('javascript:') || normalized.startsWith('vbscript:')) return true;
+        if (normalized.startsWith('data:')) {
+            return !(tagName === 'img' && attrName === 'src' && normalized.startsWith('data:image/'));
+        }
+        return false;
+    };
+
+    const doc = new DOMParser().parseFromString(source, 'text/html');
+    const walk = (node) => {
+        Array.from(node.children).forEach((el) => {
+            const tag = el.tagName.toLowerCase();
+            if (BLOCKED_TAGS.has(tag)) {
+                el.remove();
+                return;
+            }
+            Array.from(el.attributes).forEach((attr) => {
+                const name = attr.name.toLowerCase();
+                if (name.startsWith('on') || name === 'style' || name === 'srcdoc') {
+                    el.removeAttribute(attr.name);
+                    return;
+                }
+                if (URL_ATTRS.has(name) && isUnsafeUrl(attr.value, name, tag)) {
+                    el.removeAttribute(attr.name);
+                }
+            });
+            if (tag === 'a') {
+                el.setAttribute('rel', 'noopener noreferrer');
+            }
+            walk(el);
+        });
+    };
+    walk(doc.body);
+    return doc.body.innerHTML;
+}
+
 $(document).ready(function () {
     // Si viene un Token retornado por login con APY-KEY se gatilla el redeem a una sesion de flask
         if (window.redeemToken) {
@@ -177,7 +236,7 @@ function processBotResponse(responseData) {
     // A. Texto: Usamos 'answer' porque contiene el HTML procesado y limpio del backend.
     // Evitamos usar content_parts[type=text] porque contiene el JSON crudo del LLM.
     if (responseData.answer) {
-        answerSection.append(responseData.answer);
+        answerSection.append(sanitizeHtmlFragment(responseData.answer));
     }
 
     // B. Imágenes: Iteramos content_parts buscando SOLO imágenes para adjuntarlas.
@@ -207,7 +266,8 @@ function processBotResponse(responseData) {
                 toastr.error('Memoria no está disponible.');
                 return;
             }
-            const plainText = $('<div>').html(responseData.answer || '').text().trim();
+            // Even a detached element parses <img src onerror> and fires it - sanitize first.
+            const plainText = $('<div>').html(sanitizeHtmlFragment(responseData.answer || '')).text().trim();
             await window.saveItemToMemory({
                 item_type: 'chat_assistant_message',
                 content_text: plainText,

{iatoolkit-2.46.0 → iatoolkit-2.47.0}/src/iatoolkit/views/prompt_api_view.py

@@ -74,11 +74,31 @@ class PromptApiView(MethodView):
                 f"unexpected error getting company prompts: {e}")
             return jsonify({"error_message": str(e)}), 500
 
+    def _require_admin_auth(self, company_short_name: str) -> dict | tuple:
+        """
+        Prompt content is a Jinja template rendered server-side for every user
+        of the tenant, so writing it is an admin capability: even sandboxed, a
+        template author can shape what every agent says and does. Regular chat
+        users / plain API keys pass verify_for_company but must not get here.
+        """
+        auth_result = self.auth_service.verify_for_company(company_short_name)
+        if not auth_result.get("success"):
+            status_code = auth_result.get("status_code", 401)
+            if status_code == 403:
+                return jsonify({"error": "Forbidden"}), 403
+            return jsonify(auth_result), status_code
+
+        role = str(auth_result.get("user_role") or "").strip().lower()
+        if role not in {"admin", "owner"}:
+            return jsonify({"error": "Forbidden"}), 403
+
+        return auth_result
+
     def put(self, company_short_name, prompt_name):
         try:
-            auth_result = self.auth_service.verify_for_company(company_short_name)
-            if not auth_result.get("success"):
-                return jsonify(auth_result), 401
+            auth_result = self._require_admin_auth(company_short_name)
+            if isinstance(auth_result, tuple):
+                return auth_result
 
             data = request.get_json()
 
@@ -93,9 +113,9 @@ class PromptApiView(MethodView):
     def post(self, company_short_name, prompt_name=None):
         """Creates a new prompt."""
         try:
-            auth_result = self.auth_service.verify_for_company(company_short_name)
-            if not auth_result.get("success"):
-                return jsonify(auth_result), 401
+            auth_result = self._require_admin_auth(company_short_name)
+            if isinstance(auth_result, tuple):
+                return auth_result
 
             data = request.get_json() or {}