sync: 172 file da Baida98/AI@789d6ce1 (2026-08-22 17:41 UTC) [deploy-all]

api/admin_state.py

@@ -0,0 +1,75 @@
+"""Stato operativo amministrativo protetto da JWT Supabase admin."""
+from __future__ import annotations
+
+from datetime import datetime, timedelta, timezone
+from typing import Any
+
+from fastapi import APIRouter, Depends, Query
+
+from .auth_guard import require_admin_user
+from .private_state import _MAX_TASK_PAGE, _as_epoch_ms, _call, _json_object
+
+router = APIRouter(
+    prefix="/api/admin/state",
+    tags=["admin"],
+    dependencies=[Depends(require_admin_user)],
+)
+
+
+@router.get("/sessions")
+async def admin_sessions(
+    max_age_ms: int = Query(default=300_000, ge=10_000, le=3_600_000),
+    limit: int = Query(default=100, ge=1, le=200),
+) -> dict[str, object]:
+    cutoff = (datetime.now(timezone.utc) - timedelta(milliseconds=max_age_ms)).isoformat()
+
+    def operation(client: Any):
+        return client.table("agent_tasks").select("task_id,context,updated_at").eq("status", "__session__").gte("updated_at", cutoff).order("updated_at", desc=True).limit(limit).execute()
+
+    result = await _call(operation)
+    sessions = []
+    for row in result.data or []:
+        context = _json_object(row.get("context"))
+        session_id = str(context.get("sessionId") or row.get("task_id") or "").strip()
+        if not session_id:
+            continue
+        claimed = context.get("claimedFiles")
+        sessions.append({
+            "session_id": session_id,
+            "session_name": str(context.get("sessionName") or session_id)[:160],
+            "sprint": str(context["sprint"])[:120] if context.get("sprint") else None,
+            "claimed_files": [str(item)[:300] for item in claimed[:100]] if isinstance(claimed, list) else [],
+            "last_heartbeat": _as_epoch_ms(context.get("lastHeartbeat")) or _as_epoch_ms(row.get("updated_at")),
+            "current_task": str(context["currentTask"])[:500] if context.get("currentTask") else None,
+        })
+    return {"sessions": sessions}
+
+
+@router.get("/tasks")
+async def admin_tasks(
+    limit: int = Query(default=20, ge=1, le=_MAX_TASK_PAGE),
+    offset: int = Query(default=0, ge=0, le=10_000),
+    status: str | None = Query(default=None, max_length=64),
+) -> dict[str, object]:
+    normalized_status = status.strip().upper() if status else ""
+
+    def operation(client: Any):
+        query = client.table("agent_tasks").select("task_id,goal,status,updated_at").neq("status", "__session__").neq("status", "__config__")
+        if normalized_status:
+            query = query.eq("status", normalized_status)
+        page = query.order("updated_at", desc=True).range(offset, offset + limit - 1).execute()
+        all_statuses = client.table("agent_tasks").select("status").neq("status", "__session__").neq("status", "__config__").limit(2_000).execute()
+        return page, all_statuses
+
+    page, all_statuses = await _call(operation)
+    counts: dict[str, int] = {}
+    for row in all_statuses.data or []:
+        key = str(row.get("status") or "UNKNOWN").upper()
+        counts[key] = counts.get(key, 0) + 1
+    tasks = [{
+        "task_id": str(row.get("task_id") or ""),
+        "goal": str(row.get("goal") or "")[:1_000],
+        "status": str(row.get("status") or "UNKNOWN"),
+        "updated_at": _as_epoch_ms(row.get("updated_at")),
+    } for row in page.data or []]
+    return {"tasks": tasks, "counts": counts, "offset": offset, "limit": limit}

api/auth_guard.py

@@ -33,7 +33,7 @@ from __future__ import annotations
 import logging
 import os
 from enum import IntEnum
-from typing import Optional
+from typing import Optional, Any
 
 from fastapi import Depends, Header, HTTPException, Request
 
@@ -187,6 +187,66 @@ def _check_rate_limit(
     return _inmem_rate_check(key, limit, int(_RATE_WINDOW_S))
 
 
+async def require_supabase_user(request: Request) -> dict[str, Any]:
+    """Valida il Bearer JWT tramite Supabase Auth e restituisce il profilo minimo.
+
+    La chiave Supabase resta server-side; il JWT arriva esclusivamente nell'header
+    Authorization del chiamante e non viene scritto nei log.
+    """
+    import httpx
+
+    authorization = request.headers.get("Authorization", "")
+    if not authorization.lower().startswith("bearer "):
+        raise HTTPException(status_code=401, detail="Bearer token richiesto")
+    jwt = authorization[7:].strip()
+    if not jwt:
+        raise HTTPException(status_code=401, detail="Bearer token non valido")
+
+    supabase_url = os.getenv("SUPABASE_URL", "").rstrip("/")
+    api_key = os.getenv("SUPABASE_SERVICE_ROLE_KEY") or os.getenv("SUPABASE_KEY", "")
+    if not supabase_url or not api_key:
+        raise HTTPException(status_code=503, detail="Autenticazione Supabase non configurata")
+
+    try:
+        async with httpx.AsyncClient(timeout=5) as client:
+            response = await client.get(
+                f"{supabase_url}/auth/v1/user",
+                headers={
+                    "apikey": api_key,
+                    "Authorization": f"Bearer {jwt}",
+                    "Accept": "application/json",
+                },
+            )
+    except httpx.HTTPError as exc:
+        logger.warning("supabase user validation unavailable: %s", type(exc).__name__)
+        raise HTTPException(status_code=503, detail="Autenticazione temporaneamente non disponibile") from exc
+
+    if response.status_code != 200:
+        raise HTTPException(status_code=401, detail="Sessione Supabase non valida o scaduta")
+    try:
+        user = response.json()
+    except ValueError as exc:
+        raise HTTPException(status_code=401, detail="Risposta autenticazione non valida") from exc
+    if not isinstance(user, dict) or not user.get("id"):
+        raise HTTPException(status_code=401, detail="Utente Supabase non valido")
+    return user
+
+
+async def require_admin_user(request: Request) -> dict[str, Any]:
+    """Richiede un JWT Supabase con app_metadata.role=admin.
+
+    app_metadata è server-controlled; user_metadata non viene mai considerato
+    per autorizzare l’area amministrativa.
+    """
+    user = await require_supabase_user(request)
+    app_metadata = user.get("app_metadata") or {}
+    roles = app_metadata.get("roles") or []
+    is_admin = app_metadata.get("role") == "admin" or "admin" in roles
+    if not is_admin:
+        raise HTTPException(status_code=403, detail="Membership amministrativa richiesta")
+    return user
+
+
 class AuthRole(IntEnum):
     """Gerarchia ruoli: USER < MACHINE < OPERATOR < ADMIN."""
     USER     = 0

api/me_tasks.py

@@ -0,0 +1,117 @@
+"""Task personali del prodotto pubblico.
+
+Tutte le query applicano owner_id derivato dal JWT Supabase verificato. Il client
+non può scegliere o sostituire il proprietario nel body o nella query.
+"""
+from __future__ import annotations
+
+import asyncio
+import logging
+from typing import Any
+from uuid import UUID
+
+from fastapi import APIRouter, Depends, HTTPException, Query
+from pydantic import BaseModel, Field
+
+from .auth_guard import require_supabase_user
+from .state import sb
+
+_logger = logging.getLogger("agente_ai.api.me_tasks")
+router = APIRouter(prefix="/api/me/tasks", tags=["me"])
+
+
+class TaskCreate(BaseModel):
+    goal: str = Field(min_length=1, max_length=10_000)
+
+
+class TaskUpdate(BaseModel):
+    status: str = Field(pattern="^(queued|in_progress|done|failed|cancelled)$")
+
+
+_ALLOWED = "id,goal,status,created_at,updated_at"
+
+
+def _owner(user: dict[str, Any]) -> str:
+    return str(user["id"])
+
+
+def _client():
+    client = sb()
+    if client is None:
+        raise HTTPException(status_code=503, detail="Database non configurato")
+    return client
+
+
+@router.get("")
+async def list_my_tasks(
+    user: dict[str, Any] = Depends(require_supabase_user),
+    limit: int = Query(50, ge=1, le=100),
+    offset: int = Query(0, ge=0),
+) -> dict[str, Any]:
+    client = _client()
+    owner_id = _owner(user)
+
+    def operation():
+        return client.table("user_agent_tasks").select(_ALLOWED).eq("owner_id", owner_id).order("updated_at", desc=True).range(offset, offset + limit - 1).execute()
+
+    try:
+        result = await asyncio.to_thread(operation)
+        return {"tasks": result.data or [], "offset": offset, "limit": limit}
+    except Exception as exc:
+        _logger.warning("list own tasks failed: %s", type(exc).__name__)
+        raise HTTPException(status_code=503, detail="Task personali temporaneamente non disponibili") from exc
+
+
+@router.post("", status_code=201)
+async def create_my_task(
+    body: TaskCreate,
+    user: dict[str, Any] = Depends(require_supabase_user),
+) -> dict[str, Any]:
+    client = _client()
+    owner_id = _owner(user)
+
+    def operation():
+        return client.table("user_agent_tasks").insert({"owner_id": owner_id, "goal": body.goal.strip(), "status": "queued"}).select(_ALLOWED).single().execute()
+
+    try:
+        result = await asyncio.to_thread(operation)
+        if not result.data:
+            raise HTTPException(status_code=502, detail="Task personale non creato")
+        return result.data
+    except HTTPException:
+        raise
+    except Exception as exc:
+        _logger.warning("create own task failed: %s", type(exc).__name__)
+        raise HTTPException(status_code=503, detail="Task personale temporaneamente non disponibile") from exc
+
+
+@router.patch("/{task_id}")
+async def update_my_task(
+    task_id: UUID,
+    body: TaskUpdate,
+    user: dict[str, Any] = Depends(require_supabase_user),
+) -> dict[str, Any]:
+    client = _client()
+    owner_id = _owner(user)
+
+    def operation():
+        return client.table("user_agent_tasks").update({"status": body.status}).eq("id", str(task_id)).eq("owner_id", owner_id).select(_ALLOWED).maybe_single().execute()
+
+    try:
+        result = await asyncio.to_thread(operation)
+        if not result.data:
+            raise HTTPException(status_code=404, detail="Task personale non trovato")
+        return result.data
+    except HTTPException:
+        raise
+    except Exception as exc:
+        _logger.warning("update own task failed: %s", type(exc).__name__)
+        raise HTTPException(status_code=503, detail="Task personale temporaneamente non disponibile") from exc
+
+
+@router.post("/{task_id}/cancel")
+async def cancel_my_task(
+    task_id: UUID,
+    user: dict[str, Any] = Depends(require_supabase_user),
+) -> dict[str, Any]:
+    return await update_my_task(task_id, TaskUpdate(status="cancelled"), user)

api/public_status.py

@@ -0,0 +1,53 @@
+"""DTO pubblico e sanificato dello stato del servizio.
+
+Questa route non legge agent_tasks, sessioni operative o log. La tabella
+public_dashboard_snapshot viene aggiornata dal backend con service_role e letta
+qui tramite una whitelist di campi.
+"""
+from __future__ import annotations
+
+import asyncio
+import logging
+from typing import Any
+
+from fastapi import APIRouter, HTTPException
+
+from .state import sb
+
+_logger = logging.getLogger("agente_ai.api.public_status")
+router = APIRouter(prefix="/api/public", tags=["public"])
+
+_PUBLIC_FIELDS = (
+    "singleton,service_status,active_sessions,queued_tasks,in_progress_tasks,"
+    "app_version,updated_at"
+)
+
+
+@router.get("/status")
+async def public_status() -> dict[str, Any]:
+    """Restituisce esclusivamente lo snapshot deliberatamente pubblico."""
+    client = sb()
+    if client is None:
+        raise HTTPException(status_code=503, detail="Public status non configurato")
+
+    def operation():
+        return client.table("public_dashboard_snapshot").select(_PUBLIC_FIELDS).eq("singleton", True).limit(1).execute()
+
+    try:
+        result = await asyncio.to_thread(operation)
+    except Exception as exc:
+        _logger.warning("public status snapshot unavailable: %s", type(exc).__name__)
+        raise HTTPException(status_code=503, detail="Public status temporaneamente non disponibile") from exc
+
+    row = (result.data or [None])[0]
+    if not row:
+        raise HTTPException(status_code=503, detail="Public status snapshot non inizializzato")
+
+    return {
+        "service_status": str(row.get("service_status") or "unknown"),
+        "active_sessions": int(row.get("active_sessions") or 0),
+        "queued_tasks": int(row.get("queued_tasks") or 0),
+        "in_progress_tasks": int(row.get("in_progress_tasks") or 0),
+        "app_version": row.get("app_version"),
+        "updated_at": row.get("updated_at"),
+    }

main.py

@@ -145,6 +145,9 @@ _ROUTER_MAP = {
     "skills": "skills",
     "private_state": "private_state",
     "auth": "auth_managed",
+    "public_status": "public_status",
+    "me_tasks": "me_tasks",
+    "admin_state": "admin_state",
     # ── Aggiunti ROUTER-COMPLETE (29 moduli orfani rimontati) ─────────────────
     "agent_checkpoint": "agent_checkpoint",
     "agent_telemetry": "agent_telemetry",

tests/test_public_personal_boundary.py

@@ -0,0 +1,42 @@
+from pathlib import Path
+
+from api.me_tasks import TaskCreate, TaskUpdate, _owner
+from api.public_status import _PUBLIC_FIELDS
+
+ROOT = Path(__file__).resolve().parents[2]
+MIGRATION = ROOT / "supabase/migrations/20260822_public_personal_state_phase1.sql"
+
+
+def test_public_status_whitelist_contains_no_operational_columns():
+    assert "service_status" in _PUBLIC_FIELDS
+    assert "active_sessions" in _PUBLIC_FIELDS
+    assert "context" not in _PUBLIC_FIELDS
+    assert "goal" not in _PUBLIC_FIELDS
+    assert "agent_tasks" not in _PUBLIC_FIELDS
+
+
+def test_personal_task_owner_is_derived_from_verified_user():
+    assert _owner({"id": "user-a", "user_metadata": {"id": "user-b"}}) == "user-a"
+
+
+def test_task_models_boundaries():
+    task = TaskCreate(goal="  test goal  ")
+    assert task.goal == "  test goal  "
+    assert TaskUpdate(status="cancelled").status == "cancelled"
+
+
+def test_migration_keeps_operational_table_closed_to_client_roles():
+    sql = MIGRATION.read_text()
+    sql_without_comments = "\n".join(line for line in sql.splitlines() if not line.lstrip().startswith("--"))
+    assert "public.agent_tasks" not in sql_without_comments
+    assert "REVOKE ALL PRIVILEGES ON TABLE public.user_agent_tasks FROM PUBLIC, anon, authenticated" in sql
+    assert "GRANT SELECT, INSERT, UPDATE, DELETE ON TABLE public.user_agent_tasks TO authenticated" in sql
+    assert "CREATE POLICY \"user_agent_tasks_read_own\"" in sql
+    assert "CREATE TABLE IF NOT EXISTS public.public_dashboard_snapshot" in sql
+
+
+def test_admin_role_uses_app_metadata_not_user_metadata():
+    source = (ROOT / "backend/api/auth_guard.py").read_text()
+    assert "app_metadata" in source
+    admin_source = source[source.index("async def require_admin_user"):source.index("class AuthRole")]
+    assert "user.get(\"user_metadata\")" not in admin_source