Update app.py

app.py

@@ -24,7 +24,7 @@ logger = logging.getLogger(__name__)
 
 app = Flask(__name__)
 
-# ---------- CORS and session (unchanged) ----------
+# ---------- CORS and session ----------
 CORS(app, resources={r"/*": {"origins": "*"}}, supports_credentials=False,
      allow_headers=["Content-Type", "Authorization"], methods=["GET", "POST", "OPTIONS"])
 
@@ -56,7 +56,7 @@ if not HF_TOKEN:
     hf_client = None
 else:
     hf_client = OpenAI(base_url="https://router.huggingface.co/v1", api_key=HF_TOKEN)
-HF_MODEL = "google/gemma-2-2b-it:featherless-ai"
+HF_MODEL = "google/gemma-2-2b-it:featherless-ai"   # or "google/gemma-2-2b-it"
 
 def mock_response(message, rag_context, ticket_context):
     msg_lower = message.lower()
@@ -72,10 +72,72 @@ def mock_response(message, rag_context, ticket_context):
         return "Hello! I'm TMCBot. How can I help you today?"
     return "I'm here to help with cables, orders, and technical support. Could you provide more details?"
 
-# ---------- Database and RAG (unchanged) ----------
+# ---------- Database and RAG ----------
 db = DatabaseManager()
 rag_helper = RAGHelper(use_vector_search=True)
 
+# ---------- Authentication helpers (must be defined before routes) ----------
+def is_authenticated():
+    session_id = session.get('session_id')
+    user_id = session.get('user_id')
+    if not session_id or not user_id:
+        return False
+    user = db.get_user_by_session(session_id)
+    return user and user['id'] == user_id
+
+def refresh_session_timeout():
+    if 'session_id' in session:
+        session.permanent = True
+
+def require_auth(f):
+    @wraps(f)
+    def decorated_function(*args, **kwargs):
+        if not is_authenticated():
+            return jsonify({'success': False, 'error': 'Authentication required'}), 401
+        return f(*args, **kwargs)
+    return decorated_function
+
+def require_role(required_role):
+    def decorator(f):
+        @wraps(f)
+        def decorated_function(*args, **kwargs):
+            user_id = session.get('user_id')
+            if not user_id:
+                return jsonify({'error': 'Authentication required'}), 401
+            user_role = db.get_user_role(user_id)
+            allowed_roles = ['admin'] if required_role == 'admin' else ['admin', 'staff', 'user']
+            if user_role not in allowed_roles:
+                logger.warning(f"Unauthorized role access attempt: user {user_id}, role {user_role}, required {required_role}")
+                return jsonify({'error': 'Insufficient privileges'}), 403
+            return f(*args, **kwargs)
+        return decorated_function
+    return decorator
+
+def require_resource_ownership(resource_type):
+    def decorator(f):
+        @wraps(f)
+        def decorated_function(*args, **kwargs):
+            user_id = session.get('user_id')
+            if not user_id:
+                return jsonify({'error': 'Authentication required'}), 401
+            resource_id = kwargs.get('ticket_id') or kwargs.get('conversation_id')
+            if not resource_id:
+                data = request.get_json() if request.is_json else {}
+                resource_id = data.get('ticket_id') or data.get('conversation_id')
+            if not resource_id:
+                return jsonify({'error': 'Resource ID required'}), 400
+            if resource_type == 'ticket':
+                if not db.user_owns_ticket(user_id, resource_id):
+                    logger.warning(f"Unauthorized ticket access attempt: user {user_id}, ticket {resource_id}")
+                    return jsonify({'error': 'Access denied'}), 403
+            elif resource_type == 'conversation':
+                if not db.user_owns_conversation(user_id, resource_id):
+                    logger.warning(f"Unauthorized conversation access attempt: user {user_id}, conversation {resource_id}")
+                    return jsonify({'error': 'Access denied'}), 403
+            return f(*args, **kwargs)
+        return decorated_function
+    return decorator
+
 # ---------- ChatBot class (original, with send_message replaced) ----------
 class ChatBot:
     def __init__(self, db_manager, configured_model="mistral:7b"):
@@ -543,6 +605,14 @@ Summary:"""
     def create_ticket_from_chat(self, user_id, subject, description, category, priority, conversation_id):
         return self.db_manager.create_support_ticket(user_id, subject, description, category, conversation_id, priority)
 
+    def get_available_models(self):
+        # For HF version, we don't have models list; return a placeholder
+        return [HF_MODEL]
+
+    def check_ollama_health(self):
+        # Not needed for HF version, but kept for compatibility
+        return True
+
 # ------------------------------------------------------------------
 # End of ChatBot class
 # ------------------------------------------------------------------
@@ -741,9 +811,8 @@ IMPORTANT: Respond with ONLY the number (1-10). Do not include any explanation,
         return None, None
 
 def get_ai_security_analysis(prompt):
-    # In the HF version, we can call the router for security analysis.
-    # However, to avoid recursive calls, we'll fall back to a simple rule-based score.
-    # For a production system, you could call a dedicated security model, but here we return 2 (safe).
+    # For the HF version, we can call the router for security analysis.
+    # To avoid recursive calls, we fall back to a simple rule-based score.
     logger.info("Security analysis using rule-based fallback (safe score 2)")
     return 2
 
@@ -866,6 +935,7 @@ def admin():
     return redirect(url_for('admin_tickets'))
 
 @app.route('/admin/tickets')
+@require_role('admin')
 def admin_tickets():
     return render_template('admin_tickets.html')
 
@@ -1072,8 +1142,8 @@ def get_conversations():
 @app.route('/api/health')
 def health_check():
     try:
-        response = requests.get("http://localhost:11434/api/tags", timeout=5)
-        ollama_status = response.status_code == 200
+        # For HF version, ollama is not used; return a placeholder
+        ollama_status = True
     except:
         ollama_status = False
     try: