mirror of
https://github.com/civitai/civitai.git
synced 2026-09-20 22:08:18 +08:00
Justin Maier
4e01aa5a68
Adds the Retool API migration foundation and ships endpoints for all 14
moderator workflows that previously ran raw SQL from Retool. Every action
goes through a typed handler, applies a per-action rate limit, and emits
a ClickHouse audit row before responding.
Foundation
- defineRetoolEndpoint + retoolAction registry helper (auth + rate
limit + dispatch + audit) at src/server/utils/retool-endpoint.ts
- Tracker.retoolAudit() emits to default.retoolAuditLog in ClickHouse
- SUPER_ADMIN_USER_IDS env allowlist gates privileged actions
- RETOOL_ENDPOINT.RATE_LIMIT redis namespace
Endpoints (under src/pages/api/mod/retool/)
- model.ts bump (Group 13)
- review.ts setExclude, delete (Group 5)
- comment.ts bulkDelete, removeAsTos (Groups 3, 4)
- user.ts clearProfile, mute, unmute, updateIdentity*,
toggleModerator* (Groups 1, 6, 7, 8)
- image.ts tagVote, setNsfwLevel (Groups 11, 12)
- cosmetic.ts assignByTarget, unassign + Cosmetic CRUD
(Groups 9, 10)
- homeblock.ts create, update, delete, reorder (Group 14)
* privileged — requires SUPER_ADMIN_USER_IDS allowlist
Group 2 (UserLink cleanup) folded directly into the ban pipeline in
user.service.toggleBan rather than exposed as an endpoint.
New service functions back every action; no endpoint touches dbWrite
directly. Highlights:
- bumpModel with the 3-call cache fan-out
- bulkSetCommentTosViolation + new bulkSetCommentV2TosViolation
mirroring the legacy setTosViolationHandler flow
- forceUpdateUserIdentity bypasses the email-overwrite guard
- assignCosmeticByTarget resolves collection / userIds targets and
supports dryRun previews
Tests: 10 vitest cases on the registry helper cover auth, role gate,
privileged allowlist, rate limit, schema validation, and audit
emission (success + error paths).
Docs: docs/features/retool-api.md (auth, request shape, examples,
audit schema, how-to-add-a-new-action). Plan doc with full design
discussion in docs/plans/retool-api-migration.md.
Closes the parent migration ticket
https://app.clickup.com/t/868jk3qh8
Co-Authored-By: Claude Opus 4.7 (1M context) <noreply@anthropic.com>