feat: implement registration flow, backend auth services, and multi-agent response synthesizer

agents/synthesizer.py

@@ -16,13 +16,15 @@ from agents.state import CopilotState
 logger = structlog.get_logger(__name__)
 
 SYNTHESIZER_SYSTEM_PROMPT = """You are an Enterprise AI Copilot Assistant.
-Synthesize a clear, concise, and professional answer to the user's query based on the context and conversation history.
-
-Strict Response Guidelines:
-1. **Be Concise & Direct**: Answer the user's exact question in the VERY FIRST sentence. Do not add long generic intros or repeat capability lists unless explicitly asked.
-2. **Match Response Length**: For simple or short questions (e.g., "tell my name", "hi", "what is X"), give a short 1-2 sentence response. For complex analysis or document queries, provide detailed markdown formatting.
-3. **Use Conversation History**: Pay close attention to previous turns in CONVERSATION HISTORY (e.g., if the user previously stated their name, preferences, or topics, remember and use them).
-4. **Grounding**: Ground document answers strictly in RETRIEVED CONTEXT. Cite source documents clearly.
+Your primary job is to analyze and synthesize accurate answers using the provided context, web search results, or general knowledge.
+
+CRITICAL RULES FOR RESPONSES:
+1. **FULL DOCUMENT ACCESS**: When RETRIEVED CONTEXT is present, you HAVE FULL ACCESS to the user's uploaded file excerpts. NEVER state or claim that the document is "not publicly available", "private", or "unavailable".
+2. **NO NEGATIVE DISCLAIMERS**: NEVER say or output phrases like "There is no related content", "No specific internal document context was found", or "I could not find information" when answering general queries or web search questions. Simply answer the query directly and helpfully.
+3. **SUMMARIZATION**: If the user asks "Tell me about the contents of [document_name]" or asks what is in a document, summarize the key concepts, sections, and topics present in the Excerpts.
+4. **CONCISENESS**: Be direct. Answer the user's question in the very first paragraph. Use markdown bullet points and bold headers for clarity.
+5. **CITATIONS**: Reference document names, page numbers, or web sources clearly.
+6. **CONVERSATION MEMORY**: Use the CONVERSATION HISTORY to remember details the user shared (such as their name or previous topics).
 """
 
 # ── Built-in greeting responses for initial turn ────────────
@@ -38,7 +40,6 @@ def _extract_name_from_history(history: list) -> str | None:
     for msg in history:
         if msg.get("role") == "user":
             content = msg.get("content", "")
-            # Match "my name is X", "i am X", "im X", "call me X"
             match = re.search(r"\b(?:my name is|i am|i'm|call me)\s+([A-Za-z]+)", content, re.IGNORECASE)
             if match:
                 name = match.group(1).capitalize()
@@ -52,17 +53,17 @@ def _build_chunk_summary(chunks: list) -> str:
     if not chunks:
         return ""
 
-    summary_parts = ["📄 **Here's what I found in your documents:**\n"]
+    summary_parts = ["📄 **Here is what I extracted from your document:**\n"]
     for i, c in enumerate(chunks[:5], 1):
-        doc_name = c.get("document_name", "Unknown Document")
+        doc_name = c.get("document_name", "Uploaded Document")
         page = c.get("page", "N/A")
         text = c.get("text", "")
-        if len(text) > 300:
-            text = text[:300] + "..."
-        summary_parts.append(f"**{i}. {doc_name}** (Page {page})")
+        if len(text) > 350:
+            text = text[:350] + "..."
+        summary_parts.append(f"**Section {i} — {doc_name}** (Page {page})")
         summary_parts.append(f"> {text}\n")
 
-    summary_parts.append("\n---\n*💡 Tip: Set up your Groq API key in `.env` for full AI-powered analysis.*")
+    summary_parts.append("\n---\n*💡 Tip: Set up your free Groq API key in `.env` for AI-powered synthesis.*")
     return "\n".join(summary_parts)
 
 
@@ -82,12 +83,10 @@ async def synthesizer_node(state: CopilotState) -> CopilotState:
     # Format context for prompt
     context_str = ""
     if chunks:
-        context_str = "--- RETRIEVED CONTEXT ---\n"
+        context_str = "--- CONTEXT & SEARCH RESULTS ---\n"
         for i, c in enumerate(chunks, 1):
-            context_str += f"[{i}] File: {c.get('document_name')} (Page {c.get('page', 'N/A')})\n"
-            context_str += f"Content: {c.get('text')}\n\n"
-    elif routing != "direct":
-        context_str = "No specific internal document context was found for this query.\n"
+            context_str += f"[{i}] Source: {c.get('document_name')} (Page {c.get('page', 'N/A')})\n"
+            context_str += f"Excerpt: {c.get('text')}\n\n"
 
     # Format history
     history_str = ""

backend/app/api/v1/documents.py

@@ -125,6 +125,16 @@ async def upload_document(
     if doc_type not in valid_types:
         doc_type = "general"
 
+    # Enforce RBAC permissions on document category upload
+    if current_user.role == UserRole.EMPLOYEE and doc_type in {"hr", "finance", "legal"}:
+        raise HTTPException(
+            status_code=status.HTTP_403_FORBIDDEN,
+            detail={
+                "error": "permission_denied",
+                "message": f"Standard employees cannot upload restricted '{doc_type}' documents. Admin/Manager approval required.",
+            },
+        )
+
     # Save file to tenant disk location
     upload_dir = os.path.join(settings.UPLOAD_DIR, current_user.tenant_id)
     os.makedirs(upload_dir, exist_ok=True)

backend/app/main.py

@@ -173,14 +173,31 @@ def create_app() -> FastAPI:
 
         return diag_results
 
-    @app.get("/", tags=["Root"])
-    async def root():
-        return {
-            "name": "Enterprise AI Copilot Platform",
-            "version": "1.0.0",
-            "docs": "/docs",
-            "health": "/health",
-        }
+    # ── HuggingFace Static SPA Serving ────────────────────────────
+    import os
+    from fastapi.staticfiles import StaticFiles
+    from fastapi.responses import FileResponse
+
+    static_dir = os.path.abspath("/app/static")
+    if not os.path.exists(static_dir):
+        static_dir = os.path.abspath(os.path.join(os.path.dirname(__file__), "..", "..", "static"))
+
+    if os.path.exists(static_dir):
+        assets_dir = os.path.join(static_dir, "assets")
+        if os.path.exists(assets_dir):
+            app.mount("/assets", StaticFiles(directory=assets_dir), name="assets")
+
+        @app.get("/{full_path:path}", include_in_schema=False)
+        async def serve_spa(full_path: str):
+            if full_path.startswith("api/") or full_path in ["docs", "redoc", "openapi.json", "health"]:
+                return JSONResponse(status_code=404, content={"detail": "Not Found"})
+            file_path = os.path.join(static_dir, full_path)
+            if os.path.exists(file_path) and os.path.isfile(file_path):
+                return FileResponse(file_path)
+            index_path = os.path.join(static_dir, "index.html")
+            if os.path.exists(index_path):
+                return FileResponse(index_path)
+            return JSONResponse(status_code=404, content={"detail": "Not Found"})
 
     return app
 

backend/app/schemas/auth.py

@@ -15,6 +15,7 @@ class RegisterRequest(BaseModel):
     password: str
     full_name: str
     tenant_name: str         # Creates a new tenant for this user
+    role: Optional[UserRole] = None  # Optional role override (admin, hr, finance, employee)
 
     @field_validator("password")
     @classmethod

backend/app/services/auth_service.py

@@ -64,7 +64,7 @@ async def register_user(
         email=data.email,
         hashed_password=hash_password(data.password),
         full_name=data.full_name,
-        role=UserRole.ADMIN.value,
+        role=data.role.value if data.role else UserRole.ADMIN.value,
         tenant_id=tenant.id,
         is_active=True,
         is_verified=True,

frontend/src/components/layout/AppLayout.tsx

@@ -9,9 +9,9 @@ export default function AppLayout() {
       <Sidebar />
 
       {/* Main content */}
-      <div className="flex flex-col flex-1 min-w-0">
+      <div className="flex flex-col flex-1 min-w-0 h-full overflow-hidden">
         <Header />
-        <main className="flex-1 overflow-hidden">
+        <main className="flex-1 overflow-y-auto min-h-0">
           <Outlet />
         </main>
       </div>

frontend/src/pages/AdminPage.tsx

@@ -1,5 +1,5 @@
 import { useState, useEffect } from 'react';
-import { Shield, Users, FileText, UserPlus, RefreshCw, Lock, CheckCircle, XCircle } from 'lucide-react';
+import { Shield, Users, FileText, UserPlus, RefreshCw, Lock, CheckCircle, XCircle, Copy, Key } from 'lucide-react';
 import { adminApi } from '@/services/api';
 import { clsx } from 'clsx';
 import toast from 'react-hot-toast';
@@ -15,7 +15,7 @@ interface UserRecord {
 
 interface AuditRecord {
   id: string;
-  user_id: str;
+  user_id: string;
   action: string;
   agent_name?: string;
   outcome: string;
@@ -33,10 +33,12 @@ export default function AdminPage() {
 
   // Invite modal state
   const [showInviteModal, setShowInviteModal] = useState(false);
+  const [inviteSuccess, setInviteSuccess] = useState<{ email: string; password: string; role: string } | null>(null);
   const [inviteForm, setInviteForm] = useState({
     email: '',
     full_name: '',
     role: 'employee',
+    password: 'Welcome@123!',
   });
 
   const loadAdminData = async () => {
@@ -67,15 +69,29 @@ export default function AdminPage() {
     e.preventDefault();
     try {
       await adminApi.inviteUser(inviteForm);
-      toast.success(`User ${inviteForm.email} invited!`);
+      setInviteSuccess({
+        email: inviteForm.email,
+        password: inviteForm.password,
+        role: inviteForm.role,
+      });
       setShowInviteModal(false);
-      setInviteForm({ email: '', full_name: '', role: 'employee' });
       loadAdminData();
-    } catch {
-      toast.error('Failed to invite user.');
+    } catch (err: any) {
+      let msg = 'Failed to invite user.';
+      if (err?.response?.data?.detail?.message) {
+        msg = err.response.data.detail.message;
+      }
+      toast.error(msg);
     }
   };
 
+  const copyCredentials = () => {
+    if (!inviteSuccess) return;
+    const text = `Login Credentials for Enterprise AI Copilot:\nURL: http://localhost:3000/login\nEmail: ${inviteSuccess.email}\nPassword: ${inviteSuccess.password}\nRole: ${inviteSuccess.role}`;
+    navigator.clipboard.writeText(text);
+    toast.success('Credentials copied to clipboard!');
+  };
+
   return (
     <div className="p-6 lg:p-8 space-y-6 max-w-6xl mx-auto animate-fade-in">
       {/* Header */}
@@ -128,7 +144,10 @@ export default function AdminPage() {
           <div className="flex justify-between items-center">
             <h3 className="text-white font-medium text-sm">Active Workspace Users ({users.length})</h3>
             <button
-              onClick={() => setShowInviteModal(true)}
+              onClick={() => {
+                setInviteForm({ email: '', full_name: '', role: 'employee', password: 'Welcome@123!' });
+                setShowInviteModal(true);
+              }}
               className="flex items-center gap-2 px-3 py-2 rounded-lg bg-primary-600 hover:bg-primary-500 text-white text-xs font-semibold"
             >
               <UserPlus size={14} />
@@ -153,7 +172,13 @@ export default function AdminPage() {
                       <div className="text-xs text-dark-400">{u.email}</div>
                     </td>
                     <td className="p-3">
-                      <span className="text-xs px-2 py-0.5 rounded bg-dark-700 text-dark-300 font-semibold uppercase">
+                      <span className={clsx(
+                        'text-xs px-2 py-0.5 rounded font-semibold uppercase',
+                        u.role === 'admin' && 'bg-primary-500/20 text-primary-300 border border-primary-500/30',
+                        u.role === 'hr' && 'bg-pink-500/20 text-pink-300 border border-pink-500/30',
+                        u.role === 'finance' && 'bg-amber-500/20 text-amber-300 border border-amber-500/30',
+                        u.role === 'employee' && 'bg-dark-700 text-dark-300'
+                      )}>
                         {u.role}
                       </span>
                     </td>
@@ -237,7 +262,10 @@ export default function AdminPage() {
       {showInviteModal && (
         <div className="fixed inset-0 bg-black/60 backdrop-blur-sm flex items-center justify-center p-4 z-50">
           <form onSubmit={handleInvite} className="glass-card w-full max-w-md p-6 space-y-4">
-            <h3 className="text-white font-bold text-lg">Invite New User</h3>
+            <h3 className="text-white font-bold text-lg flex items-center gap-2">
+              <UserPlus size={18} className="text-primary-400" />
+              Invite New Team Member
+            </h3>
             <div>
               <label className="text-xs text-dark-300">Full Name</label>
               <input
@@ -245,6 +273,7 @@ export default function AdminPage() {
                 required
                 value={inviteForm.full_name}
                 onChange={(e) => setInviteForm({ ...inviteForm, full_name: e.target.value })}
+                placeholder="Jane Doe"
                 className="w-full px-3 py-2 bg-dark-800 border border-dark-600 rounded text-sm text-white mt-1"
               />
             </div>
@@ -255,27 +284,42 @@ export default function AdminPage() {
                 required
                 value={inviteForm.email}
                 onChange={(e) => setInviteForm({ ...inviteForm, email: e.target.value })}
+                placeholder="jane@company.com"
                 className="w-full px-3 py-2 bg-dark-800 border border-dark-600 rounded text-sm text-white mt-1"
               />
             </div>
             <div>
-              <label className="text-xs text-dark-300">Role</label>
+              <label className="text-xs text-dark-300">Assigned Role</label>
               <select
                 value={inviteForm.role}
                 onChange={(e) => setInviteForm({ ...inviteForm, role: e.target.value })}
                 className="w-full px-3 py-2 bg-dark-800 border border-dark-600 rounded text-sm text-white mt-1"
               >
-                <option value="employee">Employee</option>
-                <option value="hr">HR</option>
-                <option value="finance">Finance</option>
-                <option value="admin">Admin</option>
+                <option value="employee">👤 Employee (General Knowledge)</option>
+                <option value="hr">👔 HR Specialist (Policies & Handbooks)</option>
+                <option value="finance">💰 Finance Specialist (Financials & Sales)</option>
+                <option value="admin">👑 Admin (Full Workspace Control)</option>
               </select>
             </div>
+            <div>
+              <label className="text-xs text-dark-300 flex items-center justify-between">
+                <span>Temporary Password</span>
+                <span className="text-dark-500 font-normal text-xs">(Provide to employee to log in)</span>
+              </label>
+              <input
+                type="text"
+                required
+                minLength={8}
+                value={inviteForm.password}
+                onChange={(e) => setInviteForm({ ...inviteForm, password: e.target.value })}
+                className="w-full px-3 py-2 bg-dark-800 border border-dark-600 rounded text-sm text-white mt-1 font-mono"
+              />
+            </div>
             <div className="flex justify-end gap-3 mt-4">
               <button
                 type="button"
                 onClick={() => setShowInviteModal(false)}
-                className="px-4 py-2 rounded bg-dark-700 text-dark-300 text-xs font-semibold"
+                className="px-4 py-2 rounded bg-dark-700 text-dark-300 text-xs font-semibold hover:bg-dark-600"
               >
                 Cancel
               </button>
@@ -283,12 +327,49 @@ export default function AdminPage() {
                 type="submit"
                 className="px-4 py-2 rounded bg-primary-600 hover:bg-primary-500 text-white text-xs font-semibold"
               >
-                Send Invite
+                Create Account & Invite
               </button>
             </div>
           </form>
         </div>
       )}
+
+      {/* Invite Success Confirmation Modal */}
+      {inviteSuccess && (
+        <div className="fixed inset-0 bg-black/60 backdrop-blur-sm flex items-center justify-center p-4 z-50">
+          <div className="glass-card w-full max-w-md p-6 space-y-4 text-center">
+            <div className="w-12 h-12 rounded-full bg-green-500/20 border border-green-500/30 flex items-center justify-center mx-auto text-green-400">
+              <CheckCircle size={24} />
+            </div>
+            <h3 className="text-white font-bold text-lg">User Account Created!</h3>
+            <p className="text-dark-300 text-sm">
+              The employee account has been added to your workspace. Provide them with these credentials to log in:
+            </p>
+
+            <div className="bg-dark-800 p-4 rounded-lg border border-dark-600 text-left space-y-2 text-sm font-mono">
+              <div><span className="text-dark-400">Email:</span> <span className="text-white">{inviteSuccess.email}</span></div>
+              <div><span className="text-dark-400">Password:</span> <span className="text-primary-300">{inviteSuccess.password}</span></div>
+              <div><span className="text-dark-400">Role:</span> <span className="text-white capitalize">{inviteSuccess.role}</span></div>
+              <div><span className="text-dark-400">Login URL:</span> <span className="text-dark-300">http://localhost:3000/login</span></div>
+            </div>
+
+            <div className="flex gap-3 mt-4">
+              <button
+                onClick={copyCredentials}
+                className="flex-1 flex items-center justify-center gap-2 py-2 rounded bg-dark-700 hover:bg-dark-600 text-white text-xs font-semibold"
+              >
+                <Copy size={14} /> Copy Details
+              </button>
+              <button
+                onClick={() => setInviteSuccess(null)}
+                className="flex-1 py-2 rounded bg-primary-600 hover:bg-primary-500 text-white text-xs font-semibold"
+              >
+                Done
+              </button>
+            </div>
+          </div>
+        </div>
+      )}
     </div>
   );
 }

frontend/src/pages/DocumentsPage.tsx

@@ -5,6 +5,7 @@ import {
   Clock, RefreshCw, ChevronDown, AlertCircle, FileUp, MessageSquare,
 } from 'lucide-react';
 import { documentsApi } from '@/services/api';
+import { useAuthStore } from '@/store/authStore';
 import { clsx } from 'clsx';
 import toast from 'react-hot-toast';
 
@@ -70,6 +71,30 @@ function UploadZone({
     e.target.value = '';
   };
 
+  const userRole = useAuthStore.getState().user?.role || 'employee';
+
+  const categoryOptions = (() => {
+    if (userRole === 'admin') return [
+      { value: 'general', label: 'General' },
+      { value: 'hr', label: 'HR / Policy' },
+      { value: 'finance', label: 'Finance' },
+      { value: 'legal', label: 'Legal' },
+      { value: 'technical', label: 'Technical' },
+    ];
+    if (userRole === 'hr') return [
+      { value: 'general', label: 'General' },
+      { value: 'hr', label: 'HR / Policy' },
+    ];
+    if (userRole === 'finance') return [
+      { value: 'general', label: 'General' },
+      { value: 'finance', label: 'Finance' },
+    ];
+    return [
+      { value: 'general', label: 'General' },
+      { value: 'technical', label: 'Technical' },
+    ];
+  })();
+
   return (
     <div className="space-y-4">
       {/* Doc type selector */}
@@ -84,14 +109,17 @@ function UploadZone({
             }}
             className="appearance-none pl-3 pr-8 py-1.5 rounded-lg bg-dark-800 border border-dark-600 text-sm text-white focus:outline-none focus:ring-2 focus:ring-primary-500/30 cursor-pointer"
           >
-            <option value="general">General</option>
-            <option value="hr">HR / Policy</option>
-            <option value="finance">Finance</option>
-            <option value="legal">Legal</option>
-            <option value="technical">Technical</option>
+            {categoryOptions.map((opt) => (
+              <option key={opt.value} value={opt.value}>{opt.label}</option>
+            ))}
           </select>
           <ChevronDown size={14} className="absolute right-2 top-1/2 -translate-y-1/2 text-dark-400 pointer-events-none" />
         </div>
+        {userRole === 'employee' && (
+          <span className="text-xs text-amber-400 bg-amber-400/10 border border-amber-400/20 px-2 py-0.5 rounded">
+            🔒 Employee: Restricted to General/Tech docs (Admin approval required for HR/Finance)
+          </span>
+        )}
       </div>
 
       {/* Drop zone */}

frontend/src/pages/RegisterPage.tsx

@@ -1,6 +1,6 @@
 import { useState, FormEvent } from 'react';
 import { Link } from 'react-router-dom';
-import { Bot, Eye, EyeOff } from 'lucide-react';
+import { Bot, Eye, EyeOff, ChevronDown } from 'lucide-react';
 import { useAuthStore } from '@/store/authStore';
 import toast from 'react-hot-toast';
 
@@ -12,9 +12,10 @@ export default function RegisterPage() {
     email: '',
     password: '',
     tenant_name: '',
+    role: 'admin',
   });
 
-  const update = (key: keyof typeof form) => (e: React.ChangeEvent<HTMLInputElement>) => {
+  const update = (key: keyof typeof form) => (e: React.ChangeEvent<HTMLInputElement | HTMLSelectElement>) => {
     clearError();
     setForm((prev) => ({ ...prev, [key]: e.target.value }));
   };
@@ -22,7 +23,7 @@ export default function RegisterPage() {
   const handleSubmit = async (e: FormEvent) => {
     e.preventDefault();
     try {
-      await register(form);
+      await register(form as any);
       toast.success('Account created! Welcome aboard 🎉');
     } catch {
       // error shown in form
@@ -99,6 +100,27 @@ export default function RegisterPage() {
             />
           </div>
 
+          {/* User Role Selection */}
+          <div className="space-y-1.5">
+            <label className="text-sm font-medium text-dark-200" htmlFor="role">
+              Account Role
+            </label>
+            <div className="relative">
+              <select
+                id="role"
+                value={form.role}
+                onChange={update('role')}
+                className="input-glow w-full px-4 py-2.5 rounded-lg bg-dark-800 border border-dark-600 text-white text-sm appearance-none cursor-pointer"
+              >
+                <option value="admin">👑 Admin (Full Access)</option>
+                <option value="hr">👔 HR Specialist (Policies & Handbooks)</option>
+                <option value="finance">💰 Finance Specialist (Financials & Sales)</option>
+                <option value="employee">👤 Standard Employee (General Knowledge)</option>
+              </select>
+              <ChevronDown size={16} className="absolute right-3 top-1/2 -translate-y-1/2 text-dark-400 pointer-events-none" />
+            </div>
+          </div>
+
           {/* Password */}
           <div className="space-y-1.5">
             <label className="text-sm font-medium text-dark-200" htmlFor="reg-password">Password</label>
@@ -137,13 +159,9 @@ export default function RegisterPage() {
                 Creating account...
               </span>
             ) : (
-              'Create free account'
+              'Create account'
             )}
           </button>
-
-          <p className="text-xs text-dark-500 text-center">
-            You'll be the Admin of your company workspace.
-          </p>
         </form>
       </div>
     </div>