Update auth/security.py

auth/security.py

@@ -1,186 +1,326 @@
-"""
-auth/security.py
-Enterprise Authentication Security Layer
-Basyx Whisper V10.1
-"""
+from fastapi import FastAPI, UploadFile, File, Form, Request
+from fastapi.responses import FileResponse, JSONResponse
+from contextlib import asynccontextmanager
+import os
+import uuid
+import asyncio
+import gradio as gr
 
-from datetime import datetime, timedelta, timezone
-from typing import Optional, Dict, Any
+# ==============================
+# LOGGER + QUEUE
+# ==============================
+from utils.logger import logger
+from utils.job_queue import start_worker, create_job, get_job
+from ingestion.resolver import resolve_input
+
+# ==============================
+# AUTH SYSTEM
+# ==============================
+from auth.routes import router as auth_router
+from auth.database import Base, engine
+
+# ==============================
+# CORE PIPELINE
+# ==============================
+from utils.transcription import transcribe_video
+from utils.srt import generate_srt
+from utils.render import render_subtitles
+from utils.highlights import detect_highlights
+from utils.viral_scorer import score_clip
+from utils.director import rewrite_script, viral_score
+from utils.engagement import simulate_retention
+from utils.platform import adapt_platform
+from utils.persona import predict_audience
+from utils.clipper import create_clips
+from utils.autonomous_engine import run_autonomous_engine
+
+# ==============================
+# PUBLISHER
+# ==============================
+from publisher.publisher_ai import autonomous_loop
+from publisher.scheduler_engine import init_scheduler
+from publisher.platform_dispatcher import dispatch_publish
+from publisher.bulk import execute as bulk_execute
+from publisher.metadata_engine import generate_metadata
+from publisher.thumbnail_engine import generate_thumbnail
+
+# ==============================
+# SAFETY PATCH: bcrypt/passlib crash shield
+# ==============================
+import passlib
+try:
+    import bcrypt  # noqa
+except Exception as e:
+    logger.warning(f"bcrypt import issue detected (ignored at runtime startup): {e}")
+
+# ==============================
+# INIT
+# ==============================
+UPLOAD_DIR = "jobs"
+os.makedirs(UPLOAD_DIR, exist_ok=True)
+
+
+# ==============================
+# LIFECYCLE (HARDENED)
+# ==============================
+@asynccontextmanager
+async def lifespan(app: FastAPI):
+    logger.info("Starting Basyx Whisper V10.1")
 
-from jose import JWTError, jwt
-from passlib.context import CryptContext
+    try:
+        Base.metadata.create_all(bind=engine)
+    except Exception as e:
+        logger.error(f"DB init failed: {e}")
+        raise
 
-from utils.logger import logger
+    start_worker()
+    init_scheduler()
 
-# ==========================================================
-# SECURITY CONSTANTS
-# ==========================================================
+    try:
+        asyncio.create_task(autonomous_loop())
+    except Exception as e:
+        logger.error(f"autonomous_loop failed to start: {e}")
 
-# IMPORTANT:
-# Replace ONLY via environment variable in production.
-# No fallback assumptions allowed.
-import os
+    yield
 
-JWT_SECRET_KEY = os.environ.get("JWT_SECRET_KEY")
-if not JWT_SECRET_KEY:
-    raise RuntimeError("JWT_SECRET_KEY environment variable is required")
+    logger.info("Shutdown complete")
 
-JWT_ALGORITHM = "HS256"
-ACCESS_TOKEN_EXPIRE_MINUTES = int(
-    os.environ.get("ACCESS_TOKEN_EXPIRE_MINUTES", "60")
-)
 
-# bcrypt safe configuration
-pwd_context = CryptContext(
-    schemes=["bcrypt"],
-    deprecated="auto",
+app = FastAPI(
+    title="Basyx Whisper V10.1 Autonomous Operator",
+    lifespan=lifespan,
 )
 
-# ==========================================================
-# PASSWORD UTILITIES
-# ==========================================================
+app.include_router(auth_router)
+
+# ==============================
+# TASK REGISTRY
+# ==============================
+VALID_TASKS = {
+    "autonomous",
+    "auto-publish",
+    "publish",
+    "bulk-publish",
+    "generate-metadata",
+    "generate-thumbnail",
+    "schedule-post",
+    "transcribe",
+    "subtitles",
+    "render",
+    "highlights",
+    "viral-score",
+    "strategy",
+    "batch",
+    "clips",
+}
+
+
+def normalize_task(task: str):
+    task = task.lower().replace("_", "-")
+    if task not in VALID_TASKS:
+        raise Exception(f"Unknown task: {task}")
+    return task
+
+
+# ==============================
+# SAFE INPUT RESOLVER (FIXED)
+# ==============================
+async def safe_resolve(file, source):
+    try:
+        if not file and not source:
+            return None
 
+        upload_file = file if isinstance(file, UploadFile) else None
 
-def _sanitize_password(password: str) -> bytes:
-    """
-    bcrypt only supports 72 bytes.
+        return await asyncio.to_thread(
+            resolve_input,
+            source,
+            upload_file,
+        )
 
-    Enterprise rule:
-    - Never silently fail
-    - Deterministically truncate
-    """
+    except Exception as e:
+        logger.error(f"resolve_input failed: {str(e)}")
+        return None
 
-    if not isinstance(password, str):
-        raise TypeError("Password must be string")
 
-    encoded = password.encode("utf-8")
+# ==============================
+# EXECUTION ENGINE
+# ==============================
+async def execute_task(video_path, task, payload=None, webhook=None):
 
-    if len(encoded) > 72:
-        logger.warning("Password exceeded bcrypt limit — truncated safely")
-        encoded = encoded[:72]
+    payload = payload or {}
+    logger.info(f"[TASK] {task}")
 
-    return encoded
+    if task == "bulk-publish":
+        return await bulk_execute(payload), None
 
+    if task not in ["bulk-publish", "schedule-post"] and not video_path:
+        return {"error": "No valid input resolved"}, None
 
-def hash_password(password: str) -> str:
-    """
-    Secure password hashing
-    """
+    if task == "autonomous":
+        return await asyncio.to_thread(run_autonomous_engine, video_path), None
 
-    try:
-        safe_password = _sanitize_password(password)
-        return pwd_context.hash(safe_password)
-    except Exception as e:
-        logger.exception("Password hashing failed")
-        raise RuntimeError("Password hashing failure") from e
+    if task == "auto-publish":
+        auto = await asyncio.to_thread(run_autonomous_engine, video_path)
+        return await dispatch_publish(variants=auto.get("all_variants", [])), None
 
+    if task == "publish":
+        return await dispatch_publish(video_path=video_path, payload=payload), None
 
-def verify_password(plain_password: str, hashed_password: str) -> bool:
-    """
-    Verify password against stored hash
-    """
+    if task == "generate-metadata":
+        return generate_metadata(video_path), None
 
-    try:
-        safe_password = _sanitize_password(plain_password)
-        return pwd_context.verify(safe_password, hashed_password)
-    except Exception:
-        logger.warning("Password verification failed")
-        return False
+    if task == "generate-thumbnail":
+        output_path = os.path.join(UPLOAD_DIR, f"{uuid.uuid4()}.jpg")
+        thumb = generate_thumbnail(video_path, output=output_path)
+        return {"thumbnail": thumb}, output_path
 
+    if task == "batch":
+        job_id = create_job(video_path, webhook=webhook)
+        return {"status": "queued", "job_id": job_id}, None
 
-# ==========================================================
-# JWT TOKEN MANAGEMENT
-# ==========================================================
+    if task == "transcribe":
+        words = await asyncio.to_thread(transcribe_video, video_path)
+        return {"words": words}, None
 
+    if task == "subtitles":
+        words = await asyncio.to_thread(transcribe_video, video_path)
+        return {"srt": generate_srt(words)}, None
 
-def create_access_token(
-    subject: str,
-    additional_claims: Optional[Dict[str, Any]] = None,
-) -> str:
-    """
-    Create signed JWT access token
-    """
+    if task == "render":
+        words = await asyncio.to_thread(transcribe_video, video_path)
+        srt = generate_srt(words)
 
-    if not subject:
-        raise ValueError("Token subject required")
+        output = os.path.join(UPLOAD_DIR, f"{uuid.uuid4()}_render.mp4")
 
-    expire = datetime.now(timezone.utc) + timedelta(
-        minutes=ACCESS_TOKEN_EXPIRE_MINUTES
-    )
+        await asyncio.to_thread(render_subtitles, video_path, srt, output)
 
-    payload: Dict[str, Any] = {
-        "sub": subject,
-        "exp": expire,
-        "iat": datetime.now(timezone.utc),
-        "type": "access",
-    }
+        return {"status": "render_complete"}, output
 
-    if additional_claims:
-        payload.update(additional_claims)
+    if task == "highlights":
+        words = await asyncio.to_thread(transcribe_video, video_path)
+        highlights = detect_highlights(words) or []
+        clips = create_clips(video_path, highlights)
 
-    token = jwt.encode(
-        payload,
-        JWT_SECRET_KEY,
-        algorithm=JWT_ALGORITHM,
-    )
+        return {"clips_created": len(clips)}, (clips[0] if clips else None)
+
+    if task == "clips":
+        words = await asyncio.to_thread(transcribe_video, video_path)
+        highlights = detect_highlights(words) or []
+        return {"clips": create_clips(video_path, highlights)}, None
+
+    if task == "viral-score":
+        words = await asyncio.to_thread(transcribe_video, video_path)
+        segments = detect_highlights(words) or []
+        return {"scores": [score_clip(s) for s in segments]}, None
 
-    return token
+    if task == "strategy":
+        words = await asyncio.to_thread(transcribe_video, video_path)
 
+        script = rewrite_script(words)
+        persona = predict_audience(words)
+        curve = simulate_retention(words)
 
-def decode_access_token(token: str) -> Optional[Dict[str, Any]]:
-    """
-    Decode and validate JWT token
-    """
+        return {
+            "hook": script["hook"],
+            "persona": persona,
+            "viral_score": viral_score(curve),
+            "platforms": {
+                "tiktok": adapt_platform(script, "tiktok"),
+                "reels": adapt_platform(script, "reels"),
+            },
+        }, None
+
+    return {"error": "Task execution failed"}, None
+
+
+# ==============================
+# ROUTER
+# ==============================
+@app.post("/execute/{task_name}")
+async def execute_router(
+    request: Request,
+    task_name: str,
+    file: UploadFile = File(None),
+    url_input: str = Form(None),
+    source: str = Form(None),
+    webhook: str = Form(None),
+):
 
     try:
-        payload = jwt.decode(
-            token,
-            JWT_SECRET_KEY,
-            algorithms=[JWT_ALGORITHM],
-        )
+        task = normalize_task(task_name)
+        payload = {}
 
-        if payload.get("type") != "access":
-            logger.warning("Invalid token type")
-            return None
+        if request.headers.get("content-type", "").startswith("application/json"):
+            payload = await request.json()
 
-        return payload
+        video_path = await safe_resolve(file, url_input or source)
 
-    except JWTError:
-        logger.warning("JWT decode failed")
-        return None
+        result, output = await execute_task(video_path, task, payload, webhook)
 
+        if output and isinstance(output, str) and os.path.exists(output):
+            return FileResponse(output)
 
-# ==========================================================
-# AUTH HELPER FUNCTIONS
-# ==========================================================
+        return {"task": task, "result": result}
 
+    except Exception as e:
+        logger.exception(e)
+        return JSONResponse({"error": str(e)}, status_code=500)
 
-def get_subject_from_token(token: str) -> Optional[str]:
-    """
-    Extract user identity from token
-    """
 
-    payload = decode_access_token(token)
+# ==============================
+# HEALTH
+# ==============================
+@app.get("/api/health")
+def health():
+    return {"status": "online", "version": "V10.1"}
+
+
+@app.get("/api/status/{job_id}")
+def status(job_id: str):
+    return get_job(job_id) or {"error": "Job not found"}
 
-    if not payload:
-        return None
 
-    return payload.get("sub")
+# ==============================
+# GRADIO UI
+# ==============================
+async def ui_handler(video, task, webhook, url_input):
 
+    source = url_input or video
+    video_path = await safe_resolve(video, source)
 
-# ==========================================================
-# HEALTH CHECK (DEBUG SAFE)
-# ==========================================================
+    result, output = await execute_task(
+        video_path,
+        normalize_task(task),
+        {},
+        webhook,
+    )
+
+    return str(result), output
+
+
+with gr.Blocks() as demo:
+    gr.Markdown("# 🚀 Basyx Whisper V10.1 Stable Operator")
+
+    video_input = gr.Video()
+    url_input = gr.Textbox(label="Video URL")
 
+    task_dropdown = gr.Dropdown(
+        choices=list(VALID_TASKS),
+        value="autonomous",
+    )
+
+    webhook_input = gr.Textbox(label="Webhook")
+
+    run_btn = gr.Button("Execute")
 
-def security_status() -> dict:
-    """
-    Internal verification helper.
-    Safe for health diagnostics.
-    """
+    output_box = gr.Textbox()
+    video_output = gr.Video()
+
+    run_btn.click(
+        ui_handler,
+        [video_input, task_dropdown, webhook_input, url_input],
+        [output_box, video_output],
+    )
 
-    return {
-        "jwt_algorithm": JWT_ALGORITHM,
-        "token_expire_minutes": ACCESS_TOKEN_EXPIRE_MINUTES,
-        "bcrypt_scheme": pwd_context.schemes(),
-    }
+app = gr.mount_gradio_app(app, demo, path="/")