h

app/api/auth.py

@@ -81,6 +81,23 @@ async def handle_auth(request: Request, req: AuthRequest):
     if "token" in data:
         log.info("[auth] token present (len=%d)", len(str(data["token"])))
 
+    # Normalize response: promote access_token / session to top level
+    # if the edge function wrapped them inside a "data" key
+    if "access_token" not in data and "session" not in data:
+        nested = data.get("data")
+        if isinstance(nested, dict):
+            if "access_token" in nested:
+                data["access_token"] = nested["access_token"]
+                log.info("[auth] Promoted access_token from data.%s", "access_token")
+            if "session" in nested and isinstance(nested["session"], dict):
+                data["session"] = nested["session"]
+                log.info("[auth] Promoted session from data.session")
+            if "user" in nested and isinstance(nested["user"], dict) and "user_id" not in data:
+                uid = nested["user"].get("id") or nested["user"].get("user_id") or nested["user"].get("sub")
+                if uid:
+                    data["user_id"] = uid
+                    log.info("[auth] Promoted user_id from data.user")
+
     return data
 
 

app/services/evaluator.py

@@ -168,39 +168,55 @@ async def ai_evaluate_code_fix(challenge_id: str, fixed_code: str, team_role: st
 
     print(f"[ai-evaluate-code-fix] challenge={challenge_id} lang={language}")
 
-    try:
-        async with httpx.AsyncClient(timeout=60) as client:
-            resp = await client.post(
-                GROQ_API_URL,
-                json={
-                    "model": "llama-3.3-70b-versatile",
-                    "messages": [
-                        {"role": "system", "content": "أنت مقيّم أكواد أمني. أعد JSON فقط."},
-                        {"role": "user", "content": eval_prompt},
-                    ],
-                    "temperature": 0.2,
-                    "max_tokens": 1024,
-                },
-                headers={
-                    "Content-Type": "application/json",
-                    "Authorization": f"Bearer {GROQ_API_KEY}",
-                },
-            )
-    except Exception as e:
-        return {"secured": False, "feedback": f"AI request failed: {e}"}
+    async def _call_ai(api_url: str, api_key: str, model: str) -> Optional[dict]:
+        """Call an AI provider and return parsed evaluation dict, or None on failure."""
+        try:
+            async with httpx.AsyncClient(timeout=60) as client:
+                resp = await client.post(
+                    api_url,
+                    json={
+                        "model": model,
+                        "messages": [
+                            {"role": "system", "content": "أنت مقيّم أكواد أمني. أعد JSON فقط."},
+                            {"role": "user", "content": eval_prompt},
+                        ],
+                        "temperature": 0.2,
+                        "max_tokens": 1024,
+                    },
+                    headers={
+                        "Content-Type": "application/json",
+                        "Authorization": f"Bearer {api_key}",
+                    },
+                )
+        except Exception:
+            return None
 
-    if resp.status_code != 200:
-        return {"secured": False, "feedback": f"AI evaluation error: {resp.status_code}"}
+        if resp.status_code != 200:
+            print(f"[ai-evaluate-code-fix] {api_url} returned {resp.status_code}")
+            return None
 
-    try:
-        content = resp.json()["choices"][0]["message"]["content"]
-        evaluation = parse_json_safe(content)
-    except Exception as e:
-        return {"secured": False, "feedback": f"AI response parse failed: {e}"}
+        try:
+            content = resp.json()["choices"][0]["message"]["content"]
+            evaluation = parse_json_safe(content)
+        except Exception:
+            return None
+
+        if not isinstance(evaluation, dict):
+            return None
+        return evaluation
+
+    # Tier 1: Groq
+    evaluation = await _call_ai(GROQ_API_URL, GROQ_API_KEY, "llama-3.3-70b-versatile")
+    if evaluation is not None:
+        return evaluation
+
+    # Tier 2: Mistral (fallback)
+    print("[ai-evaluate-code-fix] Groq failed, trying Mistral...")
+    evaluation = await _call_ai(MISTRAL_API_URL, MISTRAL_API_KEY, MISTRAL_MODEL)
+    if evaluation is not None:
+        return evaluation
 
-    if not isinstance(evaluation, dict):
-        return {"secured": False, "feedback": "AI response was not a JSON object"}
-    return evaluation
+    return {"secured": False, "feedback": "AI evaluation error: 401"}
 
 
 async def evaluate_code_fix(req, background_tasks: BackgroundTasks) -> dict: