add auth

trauma/api/message/ai/prompts.py

@@ -111,10 +111,6 @@ Je moet een antwoord genereren aan de gebruiker waarin je aangeeft dat je geschi
 
 You must determine whether the user's request is valid. Provide your answer in the [is_valid] field in JSON format.
 
-## Context
-
-You are Bennie, an AI assistant specializing in trauma-related therapy and mental health provider recommendations. Your expertise includes trauma treatment types (EMDR, pre-verbal EMDR, Slapende Honden method), age-specific therapy needs, and special cases like transgender-related trauma or low IQ (LVB) therapy.
-
 ## Data
 
 **User Request**:  
@@ -139,13 +135,10 @@ You are Bennie, an AI assistant specializing in trauma-related therapy and menta
 
 ## Instructions for Filling JSON
 
-The field is considered valid (`is_valid = true`) if the user's message is:
-- trauma-related therapy and mental health provider recommendations 
-- trauma treatment types (EMDR, pre-verbal EMDR, Slapende Honden method)
-- age-specific therapy needs
-- special cases like transgender-related trauma or low IQ (LVB) therapy
-
-In the other cases, `is_valid` must be set to `false`.
+The field is considered valid (`is_valid = true`) if:
+- The user describes the patient, their data, illness, treatment method, etc.
+- The user's request relates to a medical topic.
+- The user's request is a valid response to the assistant's question.
 
 [/INST]"""
     generate_invalid_response = """## Taak

trauma/api/message/views.py

@@ -18,7 +18,7 @@ from trauma.core.wrappers import TraumaResponseWrapper
 @message_router.get('/{chatId}/all')
 async def get_all_chat_messages(
         chatId: str,
-        account: AccountModel = Depends(PermissionDependency([AccountType.Admin]))
+        account: AccountModel = Depends(PermissionDependency([AccountType.Admin, AccountType.User])),
 ) -> AllMessageWrapper:
     messages, _ = await get_all_chat_messages_obj(chatId, account)
     response = AllMessageResponse(

trauma/core/security.py

@@ -44,6 +44,8 @@ class PermissionDependency:
 
         except JWTError:
             raise HTTPException(status_code=403, detail="Permission denied")
+        except Exception:
+            raise HTTPException(status_code=403, detail="Permission denied")
 
     @staticmethod
     async def get_account_by_id(account_id: str) -> dict: