Update openspace/dashboard_server.py

openspace/dashboard_server.py

@@ -71,7 +71,12 @@ def create_app() -> Flask:
         expected_key = os.environ.get("OPENSPACE_API_KEY")
         if expected_key:
             auth_header = request.headers.get("Authorization")
-            if not auth_header or auth_header != f"Bearer {expected_key}":
+            x_api_key = request.headers.get("X-API-Key")
+            
+            is_valid_auth = auth_header and auth_header == f"Bearer {expected_key}"
+            is_valid_x = x_api_key and x_api_key == expected_key
+            
+            if not (is_valid_auth or is_valid_x):
                 abort(401, description="Unauthorized: Invalid or missing API Key")
 
     @app.route(f"{API_PREFIX}/health", methods=["GET"])
@@ -182,6 +187,95 @@ def create_app() -> Flask:
             abort(404, description=f"Unknown skill_id: {skill_id}")
         return jsonify(_load_skill_source(record))
 
+    @app.route(f"{API_PREFIX}/artifacts/stage", methods=["POST"])
+    def stage_artifact() -> Any:
+        if 'files' not in request.files:
+            abort(400, description="No files part in the request")
+        
+        files = request.files.getlist('files')
+        if not files:
+            abort(400, description="No files selected for uploading")
+            
+        import uuid
+        artifact_id = f"art_{uuid.uuid4().hex[:8]}"
+        stage_dir = PROJECT_ROOT / "skills" / artifact_id
+        stage_dir.mkdir(parents=True, exist_ok=True)
+        
+        saved_count = 0
+        for file in files:
+            if file.filename:
+                # Need to handle nested paths like sub/file.txt
+                # request.files filename could contain slashes if using webkitRelativePath
+                # But typically multipart form-data filename is just the basename
+                # However client.py sets: filename="{rel_path}"
+                safe_path = (stage_dir / file.filename).resolve()
+                if stage_dir not in safe_path.parents and safe_path != stage_dir:
+                    continue
+                safe_path.parent.mkdir(parents=True, exist_ok=True)
+                file.save(str(safe_path))
+                saved_count += 1
+                
+        return jsonify({
+            "artifact_id": artifact_id,
+            "stats": {"file_count": saved_count}
+        })
+
+    @app.route(f"{API_PREFIX}/records", methods=["POST"])
+    def create_record() -> Any:
+        data = request.json
+        if not data:
+            abort(400, description="Invalid JSON payload")
+            
+        artifact_id = data.get("artifact_id")
+        if not artifact_id:
+            abort(400, description="Missing artifact_id")
+            
+        stage_dir = PROJECT_ROOT / "skills" / artifact_id
+        if not stage_dir.exists():
+            abort(404, description="Artifact not found")
+            
+        # The skill folder name should ideally be the skill name
+        skill_name = data.get("name", artifact_id)
+        final_dir = PROJECT_ROOT / "skills" / skill_name
+        
+        # If final_dir exists, we might need to overwrite or abort
+        if final_dir.exists() and final_dir != stage_dir:
+            import shutil
+            shutil.rmtree(final_dir, ignore_errors=True)
+            
+        try:
+            stage_dir.rename(final_dir)
+        except OSError:
+            import shutil
+            shutil.copytree(stage_dir, final_dir, dirs_exist_ok=True)
+            shutil.rmtree(stage_dir, ignore_errors=True)
+            
+        # Register the skill using SkillRegistry
+        from openspace.skill_engine import SkillRegistry
+        registry = SkillRegistry([PROJECT_ROOT / "skills"])
+        meta = registry.register_skill_dir(final_dir)
+        
+        if not meta:
+            abort(400, description="Failed to register skill (missing SKILL.md or invalid)")
+            
+        store = _get_store()
+        
+        # Sync to DB
+        import asyncio
+        loop = asyncio.new_event_loop()
+        asyncio.set_event_loop(loop)
+        try:
+            loop.run_until_complete(store.sync_from_registry([meta]))
+        finally:
+            loop.close()
+            
+        return jsonify({
+            "status": "success",
+            "skill_id": meta.skill_id,
+            "name": meta.name,
+            "local_path": str(final_dir)
+        })
+
     @app.route(f"{API_PREFIX}/workflows", methods=["GET"])
     def list_workflows() -> Any:
         items = [_build_workflow_summary(path) for path in _discover_workflow_dirs()]