Allow signed-in users to read shared sessions

README.md

@@ -43,7 +43,7 @@ Node health: `GET /health`. AI health is internal at `http://127.0.0.1:8000/heal
 
 Run one container with one Python worker: analysis jobs and retry payloads are in memory and are lost on restart. Temporary local files are ephemeral. Completed videos and `results.json` are stored in the private HF dataset; Node stores session metadata and frame indices in Supabase. Model constants are in `app.py`.
 
-Apply `../Database/migrations/20261016_node_analysis.sql` before analyses. It assumes the legacy actions table is empty. Secret-protected `/internal/analysis` routes authorize sessions and persist completion/failure.
+Apply `../Database/migrations/20261016_node_analysis.sql` before analyses. It assumes the legacy actions table is empty. Apply `../Database/migrations/20261016_action_reviews.sql` to enable saving coach scores and per-action annotation notes. Secret-protected `/internal/analysis` routes authorize sessions and persist completion/failure.
 
 ## Supabase dashboard setup
 

package.json

@@ -1,30 +1,30 @@
-{
-  "name": "sporalize-backend",
-  "private": true,
-  "version": "1.0.0",
-  "type": "module",
-  "scripts": {
-    "dev": "tsx watch src/server.ts",
-    "build": "tsc -p tsconfig.json",
-    "start": "python start.py"
-  },
-  "dependencies": {
-    "@supabase/supabase-js": "^2.57.0",
-    "bcryptjs": "^3.0.2",
-    "cookie-parser": "^1.4.7",
-    "cors": "^2.8.5",
-    "dotenv": "^16.6.1",
-    "express": "^5.1.0",
-    "express-rate-limit": "^8.1.0",
-    "helmet": "^8.1.0",
-    "zod": "^4.1.5"
-  },
-  "devDependencies": {
-    "@types/cookie-parser": "^1.4.9",
-    "@types/cors": "^2.8.19",
-    "@types/express": "^5.0.3",
-    "@types/node": "^22.16.5",
-    "tsx": "^4.20.5",
-    "typescript": "^5.8.3"
-  }
-}
+{
+  "name": "sporalize-backend",
+  "private": true,
+  "version": "1.0.0",
+  "type": "module",
+  "scripts": {
+    "dev": "tsx watch src/server.ts",
+    "build": "tsc -p tsconfig.json",
+    "start": "python start.py"
+  },
+  "dependencies": {
+    "@supabase/supabase-js": "^2.57.0",
+    "bcryptjs": "^3.0.2",
+    "cookie-parser": "^1.4.7",
+    "cors": "^2.8.5",
+    "dotenv": "^16.6.1",
+    "express": "^5.1.0",
+    "express-rate-limit": "^8.1.0",
+    "helmet": "^8.1.0",
+    "zod": "^4.1.5"
+  },
+  "devDependencies": {
+    "@types/cookie-parser": "^1.4.9",
+    "@types/cors": "^2.8.19",
+    "@types/express": "^5.0.3",
+    "@types/node": "^22.16.5",
+    "tsx": "^4.20.5",
+    "typescript": "^5.8.3"
+  }
+}

src/analysis.ts

@@ -62,7 +62,7 @@ export function analysisRouter(db: SupabaseClient, secret: string) {
     try {
       const sessionId = z.uuid().parse(req.params.sessionId);
       const { data, error } = await db.from("sessions").select("session_id,player_id,path,status,name,created_at")
-        .eq("session_id", sessionId).eq("user_id", res.locals.userId).maybeSingle();
+        .eq("session_id", sessionId).maybeSingle();
       if (error) return res.status(503).json({ error: "Unable to load session" });
       return data ? res.json(data) : res.sendStatus(404);
     } catch (error) { next(error); }

src/subscriptions.ts

@@ -1,72 +1,72 @@
-import { supabaseAdmin } from "./supabase.js";
-
-type AssignSubscriptionInput = {
-  userId: string;
-  subscriptionId: string;
-  startDate: string;
-  endDate: string;
-};
-
-/**
- * Persist a paid subscription after a payment provider's webhook has been
- * authenticated and its payment has been confirmed. Never call this directly
- * from a browser request.
- */
-export async function assignPaidSubscription(input: AssignSubscriptionInput) {
-  const { userId, subscriptionId, startDate, endDate } = input;
-  const isoDate = /^\d{4}-\d{2}-\d{2}$/;
-  if (!isoDate.test(startDate) || !isoDate.test(endDate) || endDate < startDate) {
-    throw new Error("Invalid subscription period.");
-  }
-
-  const { data: plan, error: planError } = await supabaseAdmin
-    .from("subscriptions")
-    .select("subscription_id")
-    .eq("subscription_id", subscriptionId)
-    .maybeSingle();
-  if (planError) throw new Error(`Unable to validate subscription plan: ${planError.message}`);
-  if (!plan) throw new Error("Subscription plan was not found.");
-
-  const { data, error } = await supabaseAdmin
-    .from("users_subscriptions")
-    .upsert({ user_id: userId, subscription_id: subscriptionId, startdate: startDate, enddate: endDate }, { onConflict: "user_id" })
-    .select("user_id,subscription_id,startdate,enddate")
-    .single();
-  if (error) throw new Error(`Unable to assign paid subscription: ${error.message}`);
-  accessCache.delete(userId);
-  accessRequests.delete(userId);
-  return data;
-}
-
-async function loadActiveSubscription(userId: string) {
-  const today = new Date().toISOString().slice(0, 10);
-  const { data: assignment, error } = await supabaseAdmin.from("users_subscriptions")
-    .select("subscription_id,startdate,enddate").eq("user_id", userId).maybeSingle();
-  if (error) throw new Error(`Unable to check subscription: ${error.message}`);
-  if (!assignment?.subscription_id || assignment.startdate > today || assignment.enddate < today) return null;
-
-  const { data: plan, error: planError } = await supabaseAdmin.from("subscriptions")
-    .select("subscription_id,plan,price").eq("subscription_id", assignment.subscription_id).maybeSingle();
-  if (planError) throw new Error(`Unable to load subscription plan: ${planError.message}`);
-  return plan ? { ...plan, startdate: assignment.startdate, enddate: assignment.enddate } : null;
-}
-
-// Brief, per-user cache shared by polling, media and session requests.
-const accessCache = new Map<string, { value: Awaited<ReturnType<typeof loadActiveSubscription>>; expires: number }>();
-const accessRequests = new Map<string, Promise<Awaited<ReturnType<typeof loadActiveSubscription>>>>();
-export async function activeSubscriptionFor(userId: string) {
-  const cached = accessCache.get(userId);
-  if (cached && cached.expires > Date.now()) return cached.value;
-  const existing = accessRequests.get(userId);
-  if (existing) return existing;
-  const pending = loadActiveSubscription(userId).then((value) => {
-    if (accessRequests.get(userId) === pending) {
-      if (accessCache.size >= 1000) accessCache.delete(accessCache.keys().next().value!);
-      const tomorrow = new Date(); tomorrow.setUTCHours(24, 0, 0, 0);
-      accessCache.set(userId, { value, expires: Math.min(Date.now() + 30_000, tomorrow.getTime()) });
-    }
-    return value;
-  }).finally(() => { if (accessRequests.get(userId) === pending) accessRequests.delete(userId); });
-  accessRequests.set(userId, pending);
-  return pending;
-}
+import { supabaseAdmin } from "./supabase.js";
+
+type AssignSubscriptionInput = {
+  userId: string;
+  subscriptionId: string;
+  startDate: string;
+  endDate: string;
+};
+
+/**
+ * Persist a paid subscription after a payment provider's webhook has been
+ * authenticated and its payment has been confirmed. Never call this directly
+ * from a browser request.
+ */
+export async function assignPaidSubscription(input: AssignSubscriptionInput) {
+  const { userId, subscriptionId, startDate, endDate } = input;
+  const isoDate = /^\d{4}-\d{2}-\d{2}$/;
+  if (!isoDate.test(startDate) || !isoDate.test(endDate) || endDate < startDate) {
+    throw new Error("Invalid subscription period.");
+  }
+
+  const { data: plan, error: planError } = await supabaseAdmin
+    .from("subscriptions")
+    .select("subscription_id")
+    .eq("subscription_id", subscriptionId)
+    .maybeSingle();
+  if (planError) throw new Error(`Unable to validate subscription plan: ${planError.message}`);
+  if (!plan) throw new Error("Subscription plan was not found.");
+
+  const { data, error } = await supabaseAdmin
+    .from("users_subscriptions")
+    .upsert({ user_id: userId, subscription_id: subscriptionId, startdate: startDate, enddate: endDate }, { onConflict: "user_id" })
+    .select("user_id,subscription_id,startdate,enddate")
+    .single();
+  if (error) throw new Error(`Unable to assign paid subscription: ${error.message}`);
+  accessCache.delete(userId);
+  accessRequests.delete(userId);
+  return data;
+}
+
+async function loadActiveSubscription(userId: string) {
+  const today = new Date().toISOString().slice(0, 10);
+  const { data: assignment, error } = await supabaseAdmin.from("users_subscriptions")
+    .select("subscription_id,startdate,enddate").eq("user_id", userId).maybeSingle();
+  if (error) throw new Error(`Unable to check subscription: ${error.message}`);
+  if (!assignment?.subscription_id || assignment.startdate > today || assignment.enddate < today) return null;
+
+  const { data: plan, error: planError } = await supabaseAdmin.from("subscriptions")
+    .select("subscription_id,plan,price").eq("subscription_id", assignment.subscription_id).maybeSingle();
+  if (planError) throw new Error(`Unable to load subscription plan: ${planError.message}`);
+  return plan ? { ...plan, startdate: assignment.startdate, enddate: assignment.enddate } : null;
+}
+
+// Brief, per-user cache shared by polling, media and session requests.
+const accessCache = new Map<string, { value: Awaited<ReturnType<typeof loadActiveSubscription>>; expires: number }>();
+const accessRequests = new Map<string, Promise<Awaited<ReturnType<typeof loadActiveSubscription>>>>();
+export async function activeSubscriptionFor(userId: string) {
+  const cached = accessCache.get(userId);
+  if (cached && cached.expires > Date.now()) return cached.value;
+  const existing = accessRequests.get(userId);
+  if (existing) return existing;
+  const pending = loadActiveSubscription(userId).then((value) => {
+    if (accessRequests.get(userId) === pending) {
+      if (accessCache.size >= 1000) accessCache.delete(accessCache.keys().next().value!);
+      const tomorrow = new Date(); tomorrow.setUTCHours(24, 0, 0, 0);
+      accessCache.set(userId, { value, expires: Math.min(Date.now() + 30_000, tomorrow.getTime()) });
+    }
+    return value;
+  }).finally(() => { if (accessRequests.get(userId) === pending) accessRequests.delete(userId); });
+  accessRequests.set(userId, pending);
+  return pending;
+}

start.py

@@ -1,55 +1,55 @@
-"""Run the public Node API and private Python worker as one service."""
-import os
-from pathlib import Path
-import signal
-import subprocess
-import sys
-import time
-
-from dotenv import load_dotenv
-
-
-def main():
-    root = Path(__file__).resolve().parent
-    load_dotenv(root / ".env")
-    port = int(os.environ.get("PORT", "4000"))
-    if not 1 <= port <= 65535 or port == 8000:
-        raise ValueError("PORT must be between 1 and 65535 and differ from AI port 8000")
-    env = dict(os.environ, PORT=str(port),
-               ANALYSIS_API_URL="http://127.0.0.1:8000",
-               BACKEND_INTERNAL_URL=f"http://127.0.0.1:{port}")
-    children = []
-    stopping = False
-
-    def stop(signum, frame):
-        nonlocal stopping
-        stopping = True
-
-    for sig in (signal.SIGINT, signal.SIGTERM):
-        signal.signal(sig, stop)
-    try:
-        children.append(subprocess.Popen([sys.executable, "-m", "uvicorn", "app:app",
-            "--host", "127.0.0.1", "--port", "8000", "--workers", "1"], cwd=root, env=env))
-        children.append(subprocess.Popen(["node", "dist/server.js"], cwd=root, env=env))
-        while not stopping:
-            for child in children:
-                if child.poll() is not None:
-                    print(f"Backend process {child.pid} exited ({child.returncode}); stopping service", flush=True)
-                    return child.returncode or 1
-            time.sleep(0.25)
-        return 0
-    finally:
-        for child in children:
-            if child.poll() is None:
-                child.terminate()
-        deadline = time.monotonic() + 15
-        for child in children:
-            try:
-                child.wait(timeout=max(0, deadline - time.monotonic()))
-            except subprocess.TimeoutExpired:
-                child.kill()
-                child.wait()
-
-
-if __name__ == "__main__":
-    sys.exit(main())
+"""Run the public Node API and private Python worker as one service."""
+import os
+from pathlib import Path
+import signal
+import subprocess
+import sys
+import time
+
+from dotenv import load_dotenv
+
+
+def main():
+    root = Path(__file__).resolve().parent
+    load_dotenv(root / ".env")
+    port = int(os.environ.get("PORT", "4000"))
+    if not 1 <= port <= 65535 or port == 8000:
+        raise ValueError("PORT must be between 1 and 65535 and differ from AI port 8000")
+    env = dict(os.environ, PORT=str(port),
+               ANALYSIS_API_URL="http://127.0.0.1:8000",
+               BACKEND_INTERNAL_URL=f"http://127.0.0.1:{port}")
+    children = []
+    stopping = False
+
+    def stop(signum, frame):
+        nonlocal stopping
+        stopping = True
+
+    for sig in (signal.SIGINT, signal.SIGTERM):
+        signal.signal(sig, stop)
+    try:
+        children.append(subprocess.Popen([sys.executable, "-m", "uvicorn", "app:app",
+            "--host", "127.0.0.1", "--port", "8000", "--workers", "1"], cwd=root, env=env))
+        children.append(subprocess.Popen(["node", "dist/server.js"], cwd=root, env=env))
+        while not stopping:
+            for child in children:
+                if child.poll() is not None:
+                    print(f"Backend process {child.pid} exited ({child.returncode}); stopping service", flush=True)
+                    return child.returncode or 1
+            time.sleep(0.25)
+        return 0
+    finally:
+        for child in children:
+            if child.poll() is None:
+                child.terminate()
+        deadline = time.monotonic() + 15
+        for child in children:
+            try:
+                child.wait(timeout=max(0, deadline - time.monotonic()))
+            except subprocess.TimeoutExpired:
+                child.kill()
+                child.wait()
+
+
+if __name__ == "__main__":
+    sys.exit(main())