Auto-deploy backend from GitHub Actions

app/api/v1/endpoints/learn.py

@@ -16,11 +16,32 @@ async def create_learning_deck(
     request: LearningDeckRequest,
     db_data: tuple[Client, str] = Depends(get_user_db_client),
 ):
+    db_client, user_id = db_data
     try:
-        # 1. Fetch existing skills from Neo4j to enforce Data Governance
+        # --- 1. MEMORY CHECK (ANTI-CHEAT) ---
+        # Did the user already scan this exact object under this exact lens?
+        past_scan = (
+            db_client.table("scans")
+            .select("learning_deck")
+            .eq("user_id", user_id)
+            .eq("object_name", request.object_name)
+            .eq("chosen_lens", request.chosen_lens)
+            .execute()
+        )
+
+        if past_scan.data:
+            # DUPLICATE FOUND: Return the old deck, bypass Gemini, save API costs!
+            saved_deck = past_scan.data[0]["learning_deck"]
+            return LearningDeckResponse(
+                concept_card=saved_deck.get("concept_card", {}),
+                real_world_card=saved_deck.get("real_world_card", {}),
+                challenge_card=saved_deck.get("challenge_card", {}),
+                is_memory=True,  # 🚀 Flag for the mobile UI
+            )
+
+        # --- 2. NEW DISCOVERY (Proceed normally) ---
         existing_skills = await get_existing_skills_for_strand(request.chosen_lens)
 
-        # 2. Generate the 3-Card Deck using Gemini
         deck = await generate_learning_deck(
             object_name=request.object_name,
             strand=request.chosen_lens,
@@ -29,6 +50,8 @@ async def create_learning_deck(
             existing_skills=existing_skills,
         )
 
+        # Ensure the flag is false for new generations
+        deck.is_memory = False
         return deck
 
     except HTTPException:

app/schemas/cards.py

@@ -54,3 +54,7 @@ class LearningDeckResponse(BaseModel):
     concept_card: CardConcept
     real_world_card: CardRealWorld
     challenge_card: CardChallenge
+    is_memory: bool = Field(
+        default=False,
+        description="True if retrieved from DB, False if newly generated by AI.",
+    )

app/services/gamification_service.py

@@ -14,8 +14,28 @@ def save_user_discovery(
 ) -> tuple[str, int]:
     """
     Saves the finalized scan, and triggers the Postgres RPC to update Streaks, XP, and the Skill Tree.
+    Includes strict Anti-Cheat validation.
     """
     try:
+        # --- ANTI-CHEAT DB CHECK ---
+        # Prevent hackers from hitting /save repeatedly for the same object+lens
+        past_scan = (
+            db_client.table("scans")
+            .select("id")
+            .eq("user_id", user_id)
+            .eq("object_name", request.object_name)
+            .eq("chosen_lens", request.chosen_lens)
+            .execute()
+        )
+
+        if past_scan.data:
+            # They already did this. Return the old ID and 0 XP. Do not insert duplicate data.
+            logger.warning(
+                f"Anti-Cheat: User {user_id} attempted to save duplicate scan ({request.object_name} + {request.chosen_lens})."
+            )
+            return past_scan.data[0]["id"], 0
+
+        # --- PROCEED WITH NEW SAVE ---
         # 1. Calculate actual XP server-side
         final_xp = (
             BASE_XP_PER_SCAN * 2
@@ -30,7 +50,7 @@ def save_user_discovery(
             "chosen_lens": request.chosen_lens,
             "image_url": request.image_url,
             "learning_deck": request.learning_deck,
-            "xp_awarded": final_xp,  # Use the secure server calculated XP
+            "xp_awarded": final_xp,
             "is_aligned_with_compass": request.is_aligned_with_compass,
         }
 
@@ -42,7 +62,7 @@ def save_user_discovery(
 
         scan_id = response.data[0]["id"]
 
-        # 4. 🚀 CRITICAL: Execute the Postgres Function to update Streaks and Profile XP
+        # 4. 🚀 Execute the Postgres Function to update Streaks and Profile XP
         db_client.rpc(
             "award_xp_and_update_streak",
             {
@@ -53,7 +73,6 @@ def save_user_discovery(
             },
         ).execute()
 
-        # 🚀 FIX: Return both the ID and the calculated XP securely
         return scan_id, final_xp
 
     except Exception as e:

app/services/llm_service.py

@@ -43,7 +43,6 @@ async def generate_discovery_from_image(
 ) -> DiscoverLLMResponse:
     try:
         image_b64 = base64.b64encode(image_bytes).decode("utf-8")
-        # Now passing the context
         prompt_text = VISION_DISCOVERY_PROMPT.format(
             grade_level=grade_level, active_quests_context=active_quests_context
         )
@@ -65,12 +64,28 @@ async def generate_discovery_from_image(
     except asyncio.TimeoutError:
         raise HTTPException(
             status_code=status.HTTP_504_GATEWAY_TIMEOUT,
-            detail="Vision AI timed out while analyzing the image. The image might be too complex or the network is slow.",
+            detail="Vision AI timed out while analyzing the image. The network might be slow.",
         )
     except Exception as e:
+        error_str = str(e)
+
+        # 1. Handle Rate Limits
+        if "429" in error_str or "RESOURCE_EXHAUSTED" in error_str:
+            raise HTTPException(
+                status_code=status.HTTP_429_TOO_MANY_REQUESTS,
+                detail="Scanner network congested. Please wait a few seconds and try scanning again.",
+            )
+
+        # 2. Handle Inappropriate Objects (NSFW, Violence, etc.)
+        if "SAFETY" in error_str or "FinishReason.SAFETY" in error_str:
+            raise HTTPException(
+                status_code=status.HTTP_400_BAD_REQUEST,
+                detail="System Override: Unidentified or Restricted Anomaly Detected. Scan Aborted.",
+            )
+
         raise HTTPException(
             status_code=status.HTTP_422_UNPROCESSABLE_ENTITY,
-            detail=f"AI Vision Processing Failed: {str(e)}",
+            detail=f"AI Vision Processing Failed: {error_str}",
         )
 
 
@@ -96,9 +111,18 @@ async def generate_holistic_pathfinder(
             detail="Pathfinder AI timed out. Please try again.",
         )
     except Exception as e:
+        error_str = str(e)
+
+        # 1. Handle Rate Limits
+        if "429" in error_str or "RESOURCE_EXHAUSTED" in error_str:
+            raise HTTPException(
+                status_code=status.HTTP_429_TOO_MANY_REQUESTS,
+                detail="Pathfinder generation is currently queued. Please try again in a moment.",
+            )
+
         raise HTTPException(
             status_code=status.HTTP_422_UNPROCESSABLE_ENTITY,
-            detail=f"Pathfinder generation failed: {str(e)}",
+            detail=f"Pathfinder generation failed: {error_str}",
         )