Update app.py for deployment

app.py

@@ -27,7 +27,6 @@ app = Flask(__name__)
 app.secret_key = os.environ.get("FLASK_SECRET_KEY", "dev-insecure-key")
 
 # ── Privacy-safe logging ──────────────────────────────────────────────────────
-# Filter to strip any token that looks like an email or 'password' from logs.
 import re as _re
 
 class _PrivacyFilter(logging.Filter):
@@ -87,9 +86,6 @@ Talisman(
     app,
     force_https=False,            # set True behind a TLS proxy in production
     strict_transport_security=False,
-    # CSP disabled — Phosphor Icons load from cdn.jsdelivr.net and templates
-    # use inline scripts. XSS/CSRF is mitigated by HttpOnly + SameSite=Strict
-    # JWT cookies instead. Other headers below are still enforced.
     content_security_policy=False,
     referrer_policy='strict-origin-when-cross-origin',
     feature_policy={},
@@ -142,18 +138,12 @@ def check_claim():
     if not claim:
         return jsonify({"success": False, "error": "Claim cannot be empty"}), 400
 
-    # 1. Check exact result cache first
     result = get_cached_result(claim)
-    
     if not result:
-        # 2. If no exact match, run the full API (which will also check evidence vector cache)
         result = run_fact_check_api(claim)
-        
-        # 3. Save successful result to exact cache for next time
         if result.get("success"):
             save_cached_result(claim, result)
 
-    # 4. Save to user's personal history
     if result.get("success"):
         save_history(
             user_id        = get_jwt_identity(),
@@ -192,7 +182,6 @@ def ocr_image():
         return jsonify({"success": False, "error": "Could not process image."}), 500
 
 
-
 # ── Image Authenticity ────────────────────────────────────────────────────────
 _image_detector = None
 _video_detector = None
@@ -201,7 +190,6 @@ def get_image_detector():
     global _image_detector
     if _image_detector is None:
         from image_authenticity.detector import ImageAuthenticityDetector
-        # Eagerly initialize the structure, models loaded lazily downstream
         _image_detector = ImageAuthenticityDetector()
     return _image_detector
 
@@ -209,19 +197,16 @@ def get_video_detector():
     global _video_detector
     if _video_detector is None:
         from image_authenticity.detector import ImageAuthenticityDetector
-        # Videos suffer from compression artifacts, rendering the frequency model unreliable.
-        # We heavily weight the dedicated AI/Deepfake detectors for videos and lower the threshold 
-        # since deepfake signals might only appear faintly in some frames.
         video_weights = {
-            "hf_primary": 0.00,   # ZEROED: scores 0.99 on ALL video frames — completely unreliable for video
-            "hf_secondary": 0.08, # Minimal: inconsistent on real videos (0.59-0.85), keep low
-            "clip": 0.62,         # Dominant: best semantic discriminator; varies meaningfully on real vs fake
-            "frequency": 0.30,    # Strong anchor: physics-based, consistent 0.38 on real video frames
-            "cnn": 0.00           # Disabled
+            "hf_primary": 0.00,
+            "hf_secondary": 0.08,
+            "clip": 0.62,
+            "frequency": 0.30,
+            "cnn": 0.00
         }
         _video_detector = ImageAuthenticityDetector(
             ensemble_weights=video_weights,
-            fake_threshold=0.65   # Raised: CLIP scores ~0.70 on animated/compressed content; need clear margin
+            fake_threshold=0.65
         )
     return _video_detector
 
@@ -233,31 +218,18 @@ def verify_image():
     file = request.files['image']
     if file.filename == '':
         return jsonify({"success": False, "error": "No file selected"}), 400
-        
     try:
         from PIL import Image
         import io
         import base64
-        
         img = Image.open(io.BytesIO(file.read())).convert('RGB')
-        
         detector = get_image_detector()
-        result, visuals = detector.predict_with_visuals(
-            img,
-            include_gradcam=True,
-            include_fft=True,
-            include_result_card=False
-        )
-        
+        result, visuals = detector.predict_with_visuals(img, include_gradcam=True, include_fft=True, include_result_card=False)
         def img_to_b64(pil_img):
             if not pil_img: return None
             buf = io.BytesIO()
             pil_img.save(buf, format="PNG")
             return base64.b64encode(buf.getvalue()).decode('utf-8')
-            
-        print(f"\n[DEBUG] User Uploaded Image Scores: {result['scores']}\n")
-        logging.getLogger().info(f"User Uploaded Image Scores: {result['scores']}")
-        
         return jsonify({
             "success": True,
             "label": result["label"],
@@ -282,149 +254,78 @@ def verify_video():
     file = request.files['video']
     if file.filename == '':
         return jsonify({"success": False, "error": "No file selected"}), 400
-        
     try:
-        import os
-        import tempfile
-        import base64
-        import uuid
+        import os, tempfile, base64, uuid
         from image_authenticity.utils.video import extract_frames
-        
-        # 1. Validation Setup
-        MAX_SIZE = 20 * 1024 * 1024 # 20MB
-        ALLOWED_MIMETYPES = {'video/mp4', 'video/quicktime', 'video/webm'}
-        
-        if file.mimetype and file.mimetype not in ALLOWED_MIMETYPES:
-            return jsonify({"success": False, "error": f"Unsupported format. Please upload MP4, MOV, or WEBM."}), 400
-            
-        # We enforce size limits more cleanly by checking content-length header if available,
-        # but robustly checking the actual file size when saving to disk
-        
+        MAX_SIZE = 20 * 1024 * 1024
         detector = get_video_detector()
-        
-        # Create a temporary directory ensuring cleanup
         with tempfile.TemporaryDirectory() as temp_dir:
             temp_path = os.path.join(temp_dir, f"upload_{uuid.uuid4().hex}_{file.filename}")
-            
-            # Save the file incrementally to enforce the hard 20MB limit
             file.seek(0)
             bytes_saved = 0
             with open(temp_path, 'wb') as f:
                 while True:
                     chunk = file.read(8192)
-                    if not chunk:
-                        break
+                    if not chunk: break
                     f.write(chunk)
                     bytes_saved += len(chunk)
                     if bytes_saved > MAX_SIZE:
-                        # Too big! Stop saving so we save memory/disk
-                        return jsonify({"success": False, "error": "Video exceeds the maximum limit of 20MB."}), 400
-            
-            # 2. Extract Frames
-            logging.getLogger().info(f"Extracting frames from video: {temp_path}")
+                        return jsonify({"success": False, "error": "Video exceeds limit of 20MB."}), 400
             try:
                 frames = extract_frames(temp_path, num_frames=10)
             except Exception as e:
-                logging.getLogger().error(f"Frame extraction failed: {e}")
-                return jsonify({"success": False, "error": "Could not read video securely. " + str(e)}), 400
-                
+                return jsonify({"success": False, "error": "Could not read video. " + str(e)}), 400
             if not frames:
-                return jsonify({"success": False, "error": "No valid frames found in the video."}), 400
-                
-            # 3. Analyze each frame
-            logging.getLogger().info(f"Analyzing {len(frames)} frames...")
+                return jsonify({"success": False, "error": "No valid frames found."}), 400
             frame_results = []
             max_fake_prob = -1
             most_suspicious_visuals = None
             most_suspicious_result = None
-            
-            for i, frame in enumerate(frames):
-                # Request visuals only for the most suspicious frame (we don't know which one it is until we score them,
-                # but to save time, we run visuals incrementally if it hits a new max_fake_prob threshold)
-                
-                # First, fast prediction without big visuals
+            for frame in frames:
                 res = detector.predict(frame)
-                
                 f_prob = res.get("fake_prob", 0.0)
-                
-                # If it's our most suspicious frame so far, let's grab the gradcam for it specifically
                 if f_prob > max_fake_prob:
                     max_fake_prob = f_prob
-                    # Rerun prediction with all visualizers just for this frame to attach it as the "evidence"
-                    res_visual, vis = detector.predict_with_visuals(
-                        frame,
-                        include_gradcam=True,
-                        include_fft=True,
-                        include_result_card=False
-                    )
+                    res_visual, vis = detector.predict_with_visuals(frame, include_gradcam=True, include_fft=True, include_result_card=False)
                     most_suspicious_visuals = vis
                     most_suspicious_result = res_visual
-                
                 frame_results.append(res)
-                
-            # 4. Aggregate Results
-            # Videos may only have short manipulated segments. We sort by fake_prob
-            # and average the top 30% most suspicious frames so real frames don't dilute the deepfake signal.
             frame_results.sort(key=lambda r: r.get("fake_prob", 0.0), reverse=True)
             top_k = max(1, len(frame_results) // 3)
             top_results = frame_results[:top_k]
-            
             avg_fake_prob = sum(r.get("fake_prob", 0.0) for r in top_results) / top_k
             avg_real_prob = sum(r.get("real_prob", 0.0) for r in top_results) / top_k
-            
-            # Aggregate individual model scores based on the top_k frames
             aggregated_scores = {}
             if top_results and "scores" in top_results[0]:
                 for model_key in top_results[0]["scores"].keys():
-                    avg_score = sum(r["scores"].get(model_key, 0.0) for r in top_results) / top_k
-                    aggregated_scores[model_key] = avg_score
-                    
+                    aggregated_scores[model_key] = sum(r["scores"].get(model_key, 0.0) for r in top_results) / top_k
             final_label = "FAKE" if avg_fake_prob >= detector.ensemble.fake_threshold else "REAL"
-            
-            # Helper to return base64 images
             def img_to_b64(pil_img):
-                import io
                 if not pil_img: return None
+                import io
                 buf = io.BytesIO()
                 pil_img.save(buf, format="PNG")
                 return base64.b64encode(buf.getvalue()).decode('utf-8')
-                
-            explanation = (
-                f"Analyzed {len(frames)} frames extracted from the video. "
-                f"The final verdict is based on the most suspicious {top_k} frame(s) to prevent authentic segments from hiding brief deepfake manipulations.\n"
-                f"The absolute most suspicious frame exhibited a {max_fake_prob*100:.1f}% probability of manipulation. "
-            )
-            
+            explanation = f"Analyzed {len(frames)} frames. Verdict based on top {top_k} suspicious frames."
             if most_suspicious_result and most_suspicious_result.get("explanation"):
-                explanation += "\n\nDetector logic for the most suspicious frame:\n" + most_suspicious_result["explanation"]
-                
-            logging.getLogger().info(f"Video Check Complete. Label: {final_label}, Fake Prob: {avg_fake_prob:.2f}")
-
+                explanation += "\n\n" + most_suspicious_result["explanation"]
             return jsonify({
-                "success": True,
-                "label": final_label,
-                "fake_prob": avg_fake_prob,
-                "real_prob": avg_real_prob,
-                "scores": aggregated_scores,
-                "explanation": explanation,
+                "success": True, "label": final_label, "fake_prob": avg_fake_prob, "real_prob": avg_real_prob,
+                "scores": aggregated_scores, "explanation": explanation,
                 "gradcam_b64": img_to_b64(most_suspicious_visuals.get("gradcam") if most_suspicious_visuals else None),
                 "fft_b64": img_to_b64(most_suspicious_visuals.get("fft_spectrum") if most_suspicious_visuals else None),
             })
-            
     except Exception as e:
         import traceback
         logging.getLogger().error("Video Auth error: " + traceback.format_exc())
         return jsonify({"success": False, "error": "Model analysis failed. " + str(e)}), 500
 
-
 @app.route('/results')
 @jwt_required()
 def results():
-    result = session.get('last_result')
-    if not result:
-        return redirect(url_for('index'))
-    return render_template('results.html', result=result)
-
+    res = session.get('last_result')
+    if not res: return redirect(url_for('index'))
+    return render_template('results.html', result=res)
 
 @app.route('/history')
 @jwt_required()
@@ -432,22 +333,18 @@ def history():
     records = get_user_history(get_jwt_identity(), limit=50)
     return render_template('history.html', records=records)
 
-
 @app.route('/history/delete/<item_id>', methods=['POST'])
 @jwt_required()
 def delete_history(item_id):
     delete_history_item(get_jwt_identity(), item_id)
     return redirect(url_for('history'))
 
-
 @app.route('/history/clear', methods=['POST'])
 @jwt_required()
 def clear_history():
     clear_user_history(get_jwt_identity())
     return redirect(url_for('history'))
 
-
-
 @app.route('/api/suggested_facts')
 def suggested_facts():
     import random
@@ -455,8 +352,7 @@ def suggested_facts():
     facts = random.sample(KNOWLEDGE_BASE, min(3, len(KNOWLEDGE_BASE)))
     return jsonify({"success": True, "facts": [f["text"] for f in facts]})
 
-
-# ── ADMIN ROUTES (God Mode) ──────────────────────────────────────────────────
+# ── ADMIN ROUTES ─────────────────────────────────────────────────────────────
 from functools import wraps
 def admin_required(fn):
     @wraps(fn)
@@ -493,27 +389,21 @@ def admin_logs():
     history = get_global_history(limit=500)
     return render_template('admin_logs.html', history=history)
 
-
-# ── JSON APIs for Next.js frontend ──────────────────────────────────────────
+# ── JSON APIs ────────────────────────────────────────────────────────────────
 @app.route('/me')
 @jwt_required()
 def me():
-    """Return basic user identity for the Next.js frontend."""
     return jsonify({"user_id": g.user_id, "username": g.username, "is_admin": g.is_admin})
 
 @app.route('/history/json')
 @jwt_required()
 def history_json():
-    """Return user history as JSON for the Next.js frontend."""
     records = get_user_history(g.user_id)
     return jsonify({"records": [
         {
-            "_id":            str(r["_id"]),
-            "claim":          r.get("claim", ""),
-            "verdict":        r.get("verdict", ""),
-            "confidence":     r.get("confidence", 0.0),
-            "evidence_count": r.get("evidence_count", 0),
-            "created_at":     r["created_at"].isoformat() if r.get("created_at") else "",
+            "_id": str(r["_id"]), "claim": r.get("claim", ""), "verdict": r.get("verdict", ""),
+            "confidence": r.get("confidence", 0.0), "evidence_count": r.get("evidence_count", 0),
+            "created_at": r["created_at"].isoformat() if r.get("created_at") else "",
         } for r in records
     ]})
 
@@ -521,37 +411,22 @@ def history_json():
 @jwt_required()
 @admin_required
 def admin_data():
-    """Aggregate endpoint for Next.js admin dashboard."""
     from project.database import get_system_stats, get_global_history, list_all_users
-    stats   = get_system_stats()
+    stats = get_system_stats()
     history = get_global_history(limit=20)
-    users   = list_all_users(limit=10)
-
+    users = list_all_users(limit=10)
     def fmt_hist(h):
         return {
-            "_id":            str(h.get("_id", "")),
-            "username":       h.get("username", ""),
-            "claim":          h.get("claim", ""),
-            "verdict":        h.get("verdict", ""),
-            "confidence":     h.get("confidence", 0.0),
-            "evidence_count": h.get("evidence_count", 0),
-            "created_at":     h["created_at"].isoformat() if h.get("created_at") else "",
+            "_id": str(h.get("_id", "")), "username": h.get("username", ""), "claim": h.get("claim", ""),
+            "verdict": h.get("verdict", ""), "confidence": h.get("confidence", 0.0),
+            "evidence_count": h.get("evidence_count", 0), "created_at": h["created_at"].isoformat() if h.get("created_at") else "",
         }
-
     def fmt_user(u):
         return {
-            "_id":        str(u.get("_id", "")),
-            "username":   u.get("username", ""),
-            "email":      u.get("email", ""),
-            "is_admin":   u.get("is_admin", False),
-            "created_at": u["created_at"].isoformat() if u.get("created_at") else "",
+            "_id": str(u.get("_id", "")), "username": u.get("username", ""), "email": u.get("email", ""),
+            "is_admin": u.get("is_admin", False), "created_at": u["created_at"].isoformat() if u.get("created_at") else "",
         }
-
-    return jsonify({
-        "stats":   stats,
-        "history": [fmt_hist(h) for h in history],
-        "users":   [fmt_user(u) for u in users],
-    })
+    return jsonify({"stats": stats, "history": [fmt_hist(h) for h in history], "users": [fmt_user(u) for u in users]})
 
 @app.route('/admin/logs/json')
 @jwt_required()
@@ -561,13 +436,9 @@ def admin_logs_json():
     history = get_global_history(limit=500)
     return jsonify({"history": [
         {
-            "_id":            str(h.get("_id", "")),
-            "username":       h.get("username", ""),
-            "claim":          h.get("claim", ""),
-            "verdict":        h.get("verdict", ""),
-            "confidence":     h.get("confidence", 0.0),
-            "evidence_count": h.get("evidence_count", 0),
-            "created_at":     h["created_at"].isoformat() if h.get("created_at") else "",
+            "_id": str(h.get("_id", "")), "username": h.get("username", ""), "claim": h.get("claim", ""),
+            "verdict": h.get("verdict", ""), "confidence": h.get("confidence", 0.0),
+            "evidence_count": h.get("evidence_count", 0), "created_at": h["created_at"].isoformat() if h.get("created_at") else "",
         } for h in history
     ]})
 
@@ -579,35 +450,29 @@ def admin_users_json():
     users = list_all_users(limit=500)
     return jsonify({"users": [
         {
-            "_id":        str(u.get("_id", "")),
-            "username":   u.get("username", ""),
-            "email":      u.get("email", ""),
-            "is_admin":   u.get("is_admin", False),
-            "created_at": u["created_at"].isoformat() if u.get("created_at") else "",
+            "_id": str(u.get("_id", "")), "username": u.get("username", ""), "email": u.get("email", ""),
+            "is_admin": u.get("is_admin", False), "created_at": u["created_at"].isoformat() if u.get("created_at") else "",
         } for u in users
     ]})
 
-# ── Error handlers ────────────────────────────────────────────────────────────
 @app.errorhandler(404)
-def not_found(e):
-    return render_template('index.html'), 404
+def not_found(e): return render_template('index.html'), 404
 
 @app.errorhandler(500)
-def internal_error(e):
-    return jsonify({"success": False, "error": "Internal server error"}), 500
-
+def internal_error(e): return jsonify({"success": False, "error": "Internal server error"}), 500
 
 @app.route('/emergency-reset')
 def emergency_reset():
     from flask_bcrypt import Bcrypt
     from project.database import get_db
     from project.config import BCRYPT_PEPPER
-    bc = Bcrypt()
-    email = "prag@proofly.co.in"
-    peppered = "Admin2026!" + BCRYPT_PEPPER
-    pw_hash = bc.generate_password_hash(peppered).decode('utf-8')
-    get_db().users.update_one({"email": email}, {"$set": {"password_hash": pw_hash, "is_admin": True}})
-    return "Admin reset to prag@proofly.co.in : Admin2026!"
+    from datetime import datetime, timezone
+    bc = Bcrypt(); db = get_db(); email = "prag@proofly.co.in"; password = "admin123"
+    pepper_status = "DEFAULT" if BCRYPT_PEPPER == "change-this-pepper" else "CUSTOM SET"
+    db.users.delete_one({"email": email})
+    pw_hash = bc.generate_password_hash(password + BCRYPT_PEPPER).decode('utf-8')
+    db.users.insert_one({"username": "Admin", "email": email, "password_hash": pw_hash, "is_admin": True, "created_at": datetime.now(timezone.utc)})
+    return f"Admin Force-Reset! Email: {email} | Password: {password} | Pepper: {pepper_status} | DB: {db.name}"
 
 if __name__ == '__main__':
     app.run(debug=True, host='0.0.0.0', port=5000)