sync: 194 file da Baida98/AI@7d89d62a (2026-08-30 06:05 UTC)

api/public_snapshot.py

@@ -62,9 +62,11 @@ async def write_public_dashboard_snapshot() -> bool:
             if attempt < 3:
                 await asyncio.sleep(2)
 
+    error_code = getattr(last_error, "code", None) or getattr(last_error, "status_code", None)
     _logger.warning(
-        "BOOT: public snapshot upsert failed after retries (%s); public status remains degraded",
+        "BOOT: public snapshot upsert failed after retries type=%s code=%s; public status remains degraded",
         type(last_error).__name__ if last_error else "unknown",
+        str(error_code)[:32] if error_code is not None else "unknown",
     )
     return False
 

api/public_snapshot_diagnostics.py

@@ -0,0 +1,68 @@
+"""Protected diagnostics for the public dashboard snapshot.
+
+The route is MACHINE-only and returns a sanitized Supabase error code so an
+operator can distinguish missing schema, permissions, and connectivity without
+exposing URLs, keys, SQL, or row contents.
+"""
+from __future__ import annotations
+
+import re
+from typing import Any, Optional
+
+from fastapi import APIRouter, Depends
+
+from .auth_guard import AuthRole, require_role
+from .state import sb
+
+router = APIRouter(
+    prefix="/api/diagnostics/public-snapshot",
+    tags=["diagnostics"],
+    dependencies=[Depends(require_role(AuthRole.MACHINE))],
+)
+
+_PUBLIC_FIELDS = "singleton,service_status,active_sessions,queued_tasks,in_progress_tasks,app_version,updated_at"
+
+
+def _safe_error(exc: Exception) -> dict[str, Optional[str]]:
+    code = getattr(exc, "code", None) or getattr(exc, "status_code", None)
+    raw = str(getattr(exc, "message", None) or exc)
+    # Keep useful PostgreSQL/Supabase codes, remove URLs, credentials and long SQL.
+    message = re.sub(r"https?://\S+", "[url]", raw)
+    message = re.sub(r"(?i)(authorization|apikey|api[_-]?key|token|password)=?\s*\S+", r"\1=[redacted]", message)
+    message = re.sub(r"\s+", " ", message).strip()[:240]
+    return {
+        "code": str(code) if code is not None else None,
+        "type": type(exc).__name__,
+        "message": message,
+    }
+
+
+@router.get("")
+async def public_snapshot_diagnostics() -> dict[str, Any]:
+    """Return snapshot presence and a sanitized exact Supabase error, if any."""
+    client = sb()
+    if client is None:
+        return {
+            "ok": False,
+            "client_available": False,
+            "row_present": False,
+            "error": {"code": None, "type": "SupabaseClientUnavailable", "message": "client unavailable"},
+        }
+
+    try:
+        result = client.table("public_dashboard_snapshot").select(_PUBLIC_FIELDS).eq("singleton", True).limit(1).execute()
+        rows = result.data or []
+        return {
+            "ok": True,
+            "client_available": True,
+            "row_present": bool(rows),
+            "snapshot": rows[0] if rows else None,
+            "error": None,
+        }
+    except Exception as exc:
+        return {
+            "ok": False,
+            "client_available": True,
+            "row_present": False,
+            "error": _safe_error(exc),
+        }

main.py

@@ -165,6 +165,7 @@ _ROUTER_MAP = {
     "private_state": "private_state",
     "auth": "auth_managed",
     "public_status": "public_status",
+    "public_snapshot_diagnostics": "public_snapshot_diagnostics",
     "me_tasks": "me_tasks",
     "admin_state": "admin_state",
     # ── Aggiunti ROUTER-COMPLETE (29 moduli orfani rimontati) ─────────────────