image genreation normal user permission fix

UNDER-OBSERVATION.md

@@ -101,10 +101,18 @@ The logout was NOT caused by backend issues or container restarts. It was caused
 **RESOLVED** - Auth state stable, backend permissions correct, useLocation fix preserved.
 
 **ADDITIONAL FIX (Dec 10, 2025 - Evening):**
-- Fixed image generation task progress polling 403 errors
-- Root cause: `IsSystemAccountOrDeveloper` was still in class-level permissions
-- Solution: Moved to `get_permissions()` method to allow action-level overrides
-- `task_progress` and `get_image_generation_settings` now accessible to all authenticated users
-- Save/test operations still restricted to system accounts
+1. **Permission Fix**: Fixed image generation task progress polling 403 errors
+   - Root cause: `IsSystemAccountOrDeveloper` was still in class-level permissions
+   - Solution: Moved to `get_permissions()` method to allow action-level overrides
+   - `task_progress` and `get_image_generation_settings` now accessible to all authenticated users
+   - Save/test operations still restricted to system accounts
 
-**Monitor for 48 hours** - Watch for any recurrence of useLocation errors or auth issues after container restarts.
+2. **System Account Fallback**: Fixed "Image generation settings not found" for normal users
+   - Root cause: IntegrationSettings are account-specific - normal users don't have their own settings
+   - Only super user account (aws-admin) has configured API keys
+   - Solution: Added fallback to system account (aws-admin) settings in `process_image_generation_queue` task
+   - When user's account doesn't have IntegrationSettings, falls back to system account
+   - Allows normal users to use centralized API keys managed by super users
+   - Files modified: `backend/igny8_core/ai/tasks.py`
+
+**Monitor for 48 hours** - Watch for any recurrence of useLocation errors or auth issues after container restarts. Test image generation with normal user accounts (paid-2).

backend/igny8_core/ai/tasks.py

@@ -182,6 +182,7 @@ def process_image_generation_queue(self, image_ids: list, account_id: int = None
     results = []
     
     # Get image generation settings from IntegrationSettings
+    # Normal users use system account settings (aws-admin) via fallback
     logger.info("[process_image_generation_queue] Step 1: Loading image generation settings")
     try:
         image_settings = IntegrationSettings.objects.get(
@@ -189,8 +190,29 @@ def process_image_generation_queue(self, image_ids: list, account_id: int = None
             integration_type='image_generation',
             is_active=True
         )
+        logger.info(f"[process_image_generation_queue] Image generation settings found for account {account.id}")
         config = image_settings.config or {}
-        logger.info(f"[process_image_generation_queue] Image generation settings found. Config keys: {list(config.keys())}")
+    except IntegrationSettings.DoesNotExist:
+        # Fallback to system account (aws-admin) settings
+        logger.info(f"[process_image_generation_queue] No settings for account {account.id}, falling back to system account")
+        from igny8_core.auth.models import Account
+        try:
+            system_account = Account.objects.get(slug='aws-admin')
+            image_settings = IntegrationSettings.objects.get(
+                account=system_account,
+                integration_type='image_generation',
+                is_active=True
+            )
+            logger.info(f"[process_image_generation_queue] Using system account (aws-admin) settings")
+            config = image_settings.config or {}
+        except (Account.DoesNotExist, IntegrationSettings.DoesNotExist):
+            logger.error("[process_image_generation_queue] ERROR: Image generation settings not found in system account either")
+            return {'success': False, 'error': 'Image generation settings not found'}
+    except Exception as e:
+        logger.error(f"[process_image_generation_queue] ERROR loading image generation settings: {e}", exc_info=True)
+        return {'success': False, 'error': f'Error loading image generation settings: {str(e)}'}
+    
+    logger.info(f"[process_image_generation_queue] Image generation settings loaded. Config keys: {list(config.keys())}")
     logger.info(f"[process_image_generation_queue] Full config: {config}")
     
     # Get provider and model from config (respect user settings)
@@ -214,16 +236,10 @@ def process_image_generation_queue(self, image_ids: list, account_id: int = None
     logger.info(f"  - Image format: {image_format}")
     logger.info(f"  - Desktop enabled: {desktop_enabled}")
     logger.info(f"  - Mobile enabled: {mobile_enabled}")
-    except IntegrationSettings.DoesNotExist:
-        logger.error("[process_image_generation_queue] ERROR: Image generation settings not found")
-        logger.error(f"[process_image_generation_queue] Account: {account.id if account else 'None'}, integration_type: 'image_generation'")
-        return {'success': False, 'error': 'Image generation settings not found'}
-    except Exception as e:
-        logger.error(f"[process_image_generation_queue] ERROR loading image generation settings: {e}", exc_info=True)
-        return {'success': False, 'error': f'Error loading image generation settings: {str(e)}'}
     
     # Get provider API key (using same approach as test image generation)
     # Note: API key is stored as 'apiKey' (camelCase) in IntegrationSettings.config
+    # Normal users use system account settings (aws-admin) via fallback
     logger.info(f"[process_image_generation_queue] Step 2: Loading {provider.upper()} API key")
     try:
         provider_settings = IntegrationSettings.objects.get(
@@ -231,7 +247,27 @@ def process_image_generation_queue(self, image_ids: list, account_id: int = None
             integration_type=provider,  # Use the provider from settings
             is_active=True
         )
-        logger.info(f"[process_image_generation_queue] {provider.upper()} integration settings found")
+        logger.info(f"[process_image_generation_queue] {provider.upper()} integration settings found for account {account.id}")
+    except IntegrationSettings.DoesNotExist:
+        # Fallback to system account (aws-admin) settings
+        logger.info(f"[process_image_generation_queue] No {provider.upper()} settings for account {account.id}, falling back to system account")
+        from igny8_core.auth.models import Account
+        try:
+            system_account = Account.objects.get(slug='aws-admin')
+            provider_settings = IntegrationSettings.objects.get(
+                account=system_account,
+                integration_type=provider,
+                is_active=True
+            )
+            logger.info(f"[process_image_generation_queue] Using system account (aws-admin) {provider.upper()} settings")
+        except (Account.DoesNotExist, IntegrationSettings.DoesNotExist):
+            logger.error(f"[process_image_generation_queue] ERROR: {provider.upper()} integration settings not found in system account either")
+            return {'success': False, 'error': f'{provider.upper()} integration not found or not active'}
+    except Exception as e:
+        logger.error(f"[process_image_generation_queue] ERROR getting {provider.upper()} API key: {e}", exc_info=True)
+        return {'success': False, 'error': f'Error retrieving {provider.upper()} API key: {str(e)}'}
+    
+    # Extract API key from provider settings
     logger.info(f"[process_image_generation_queue] {provider.upper()} config keys: {list(provider_settings.config.keys()) if provider_settings.config else 'None'}")
     
     api_key = provider_settings.config.get('apiKey') if provider_settings.config else None
@@ -243,13 +279,6 @@ def process_image_generation_queue(self, image_ids: list, account_id: int = None
     # Log API key presence (but not the actual key for security)
     api_key_preview = f"{api_key[:10]}...{api_key[-4:]}" if len(api_key) > 14 else "***"
     logger.info(f"[process_image_generation_queue] {provider.upper()} API key retrieved successfully (length: {len(api_key)}, preview: {api_key_preview})")
-    except IntegrationSettings.DoesNotExist:
-        logger.error(f"[process_image_generation_queue] ERROR: {provider.upper()} integration settings not found")
-        logger.error(f"[process_image_generation_queue] Account: {account.id if account else 'None'}, integration_type: '{provider}'")
-        return {'success': False, 'error': f'{provider.upper()} integration not found or not active'}
-    except Exception as e:
-        logger.error(f"[process_image_generation_queue] ERROR getting {provider.upper()} API key: {e}", exc_info=True)
-        return {'success': False, 'error': f'Error retrieving {provider.upper()} API key: {str(e)}'}
     
     # Get image prompt template (has placeholders: {image_type}, {post_title}, {image_prompt})
     try:

backend/igny8_core/modules/system/integration_views.py

@@ -838,7 +838,9 @@ class IntegrationSettingsViewSet(viewsets.ViewSet):
     
     @action(detail=False, methods=['get'], url_path='image_generation', url_name='image_generation_settings')
     def get_image_generation_settings(self, request):
-        """Get image generation settings for current account"""
+        """Get image generation settings for current account
+        Normal users fallback to system account (aws-admin) settings
+        """
         account = getattr(request, 'account', None)
         
         if not account:
@@ -863,11 +865,44 @@ class IntegrationSettingsViewSet(viewsets.ViewSet):
         
         try:
             from .models import IntegrationSettings
+            from igny8_core.auth.models import Account
+            
+            # Try to get settings for user's account first
+            try:
                 integration = IntegrationSettings.objects.get(
                     account=account,
                     integration_type='image_generation',
                     is_active=True
                 )
+                logger.info(f"[get_image_generation_settings] Found settings for account {account.id}")
+            except IntegrationSettings.DoesNotExist:
+                # Fallback to system account (aws-admin) settings - normal users use centralized settings
+                logger.info(f"[get_image_generation_settings] No settings for account {account.id}, falling back to system account")
+                try:
+                    system_account = Account.objects.get(slug='aws-admin')
+                    integration = IntegrationSettings.objects.get(
+                        account=system_account,
+                        integration_type='image_generation',
+                        is_active=True
+                    )
+                    logger.info(f"[get_image_generation_settings] Using system account (aws-admin) settings")
+                except (Account.DoesNotExist, IntegrationSettings.DoesNotExist):
+                    logger.error("[get_image_generation_settings] No image generation settings found in system account either")
+                    # Return default settings instead of error
+                    return success_response(
+                        data={
+                            'config': {
+                                'provider': 'openai',
+                                'model': 'dall-e-3',
+                                'image_type': 'realistic',
+                                'max_in_article_images': 2,
+                                'image_format': 'webp',
+                                'desktop_enabled': True,
+                                'mobile_enabled': True,
+                            }
+                        },
+                        request=request
+                    )
             
             config = integration.config or {}