CRISPR MVP: Cas9 knockout gRNA designer (sign-in gated, free for accounts)

dee/server.py

@@ -37,6 +37,7 @@ from typing import Any, Dict, List, Optional
 from flask import Flask, Response, jsonify, request, send_file, send_from_directory
 
 from dee import auth as _auth
+from dee.core.crispr import find_guides as _find_crispr_guides, guides_to_csv_rows as _crispr_csv_rows
 from dee.core.codon import (
     DEFAULT_FORBIDDEN_SITES,
     pcr_metrics,
@@ -761,6 +762,146 @@ def create_app() -> Flask:
             return jsonify({"error": "unknown job"}), 404
         return jsonify(job.public())
 
+    # ================================================================= CRISPR
+    # Cas9 gRNA design for knockout applications. MVP scope: pasted DNA
+    # → ranked SpCas9 guides with Doench-style heuristic on-target
+    # scoring. Sign-in gated (free for any account); anonymous users
+    # get a 403 with a sign-in CTA so the frontend can route them to
+    # /signin instead of the engine's trial gate. Whole-genome off-target,
+    # Cas12a, base editors, and HDR donor design are deferred — see
+    # dee/core/crispr.py module docstring for the full scope ladder.
+
+    @app.post("/api/crispr/design")
+    def crispr_design() -> Response:
+        # Sign-in gate. Distinct from the trial timer (which is per-anon-
+        # session): CRISPR requires an account, no anonymous use. The
+        # 403 carries kind="signin_required" so static auth.js can route
+        # the parent window to /signin instead of showing the trial modal.
+        auth = _auth.get_auth()
+        if auth.anonymous:
+            return jsonify({
+                "error": (
+                    "CRISPR design requires a free account. "
+                    "Sign in or create one to keep going."
+                ),
+                "kind": "signin_required",
+                "signup_url": "https://turingdna.com/signin/?from=crispr",
+            }), 403
+
+        body = request.get_json(force=True, silent=True) or {}
+        seq = (body.get("sequence") or "").strip()
+        if not seq:
+            return jsonify({"error": "missing 'sequence'"}), 400
+
+        # Bound the input so a 10 MB paste doesn't tie up the worker.
+        # 1 Mbp covers any reasonable cloning-scale region (largest
+        # human genes are ~2.4 Mbp, but at that scale you'd use a
+        # whole-genome tool, not a paste box).
+        if len(seq) > 1_000_000:
+            return jsonify({
+                "error": (
+                    "Sequence too long. Cap is 1 Mbp — paste just the "
+                    "gene / region you're editing, not a whole "
+                    "chromosome."
+                ),
+                "kind": "input_too_large",
+            }), 400
+
+        try:
+            max_results = int(body.get("max_results", 50))
+        except (TypeError, ValueError):
+            max_results = 50
+        max_results = max(1, min(500, max_results))  # bound
+
+        try:
+            min_score = float(body.get("min_score", 0.0))
+        except (TypeError, ValueError):
+            min_score = 0.0
+        min_score = max(0.0, min(1.0, min_score))
+
+        try:
+            guides = _find_crispr_guides(
+                seq, max_results=max_results, min_score=min_score,
+            )
+        except ValueError as exc:
+            return jsonify({"error": str(exc), "kind": "validation"}), 400
+        except Exception as exc:  # noqa: BLE001
+            logger.exception("CRISPR design failed.")
+            return jsonify({
+                "error": f"{type(exc).__name__}: {exc}",
+                "kind": "internal",
+            }), 500
+
+        # Flatten dataclasses into plain dicts for JSON.
+        return jsonify({
+            "input_length": len(seq.strip()),
+            "n_guides":     len(guides),
+            "guides": [
+                {
+                    "rank":            g.rank,
+                    "strand":          g.strand,
+                    "position":        g.position,
+                    "spacer":          g.spacer,
+                    "pam":             g.pam,
+                    "target_context":  g.target_context,
+                    "on_target_score": g.on_target_score,
+                    "gc_pct":          g.gc_pct,
+                    "flag_high_gc":    g.flag_high_gc,
+                    "flag_low_gc":     g.flag_low_gc,
+                    "flag_polyT":      g.flag_polyT,
+                    "notes":           g.notes,
+                }
+                for g in guides
+            ],
+        })
+
+    @app.post("/api/crispr/download")
+    def crispr_download() -> Response:
+        """Return the CSV body for a fresh design. We re-design from the
+        sequence on download rather than caching per-job to avoid a
+        whole job-state layer for what's essentially a pure function
+        of the input. Same sign-in gate as /api/crispr/design."""
+        auth = _auth.get_auth()
+        if auth.anonymous:
+            return jsonify({"error": "signin_required"}), 403
+
+        body = request.get_json(force=True, silent=True) or {}
+        seq = (body.get("sequence") or "").strip()
+        if not seq:
+            return jsonify({"error": "missing 'sequence'"}), 400
+        if len(seq) > 1_000_000:
+            return jsonify({"error": "input_too_large"}), 400
+
+        try:
+            max_results = int(body.get("max_results", 50))
+        except (TypeError, ValueError):
+            max_results = 50
+        max_results = max(1, min(500, max_results))
+
+        try:
+            guides = _find_crispr_guides(seq, max_results=max_results)
+        except ValueError as exc:
+            return jsonify({"error": str(exc)}), 400
+
+        import csv as _csv
+        from io import StringIO as _SIO
+        sio = _SIO()
+        # Excel-friendly: UTF-8 BOM + comma separator (same convention
+        # as the directed-evolution library exports — see codon.py).
+        sio.write("")
+        writer = _csv.writer(sio)
+        for row in _crispr_csv_rows(guides):
+            writer.writerow(row)
+        body_bytes = sio.getvalue().encode("utf-8")
+
+        from flask import make_response as _mr
+        resp = _mr(body_bytes)
+        resp.headers["Content-Type"] = "text/csv; charset=utf-8"
+        resp.headers["Content-Disposition"] = (
+            f'attachment; filename="turingdna_crispr_guides.csv"'
+        )
+        return resp
+
     # NOTE: /api/library, /api/library/<filename> (GET + DELETE), and
     # /api/shutdown were removed on 2026-05-26 per SECURITY_AUDIT findings
     # C2 + C3.