Spaces:

goctests0
/

TalkToDoc

Running

App Files Files Community

goctests0 commited on 5 days ago

Commit

7b5809f

verified ·

1 Parent(s): 36a42f1

Upload 2 files

Browse files

Files changed (2) hide show

app.py +215 -50
database.py +156 -95

app.py CHANGED Viewed

@@ -10,14 +10,33 @@ Two-step flow:
    summarizes the likely symptoms or intent for the provider.
 2. Provider submits a reply in English. The system translates it back
    into the patient's language and generates spoken audio for it.
 """
 import os
 import uuid
-from datetime import datetime, timezone
 from dotenv import load_dotenv
-from flask import Flask, request, jsonify, render_template, session
 import database
 import stt
@@ -28,6 +47,7 @@ import tts
 load_dotenv("env")
 AUDIO_DIR = os.path.join(os.path.dirname(os.path.abspath(__file__)), "static", "audio")
 def create_app():
@@ -48,6 +68,100 @@ database.init_db()
 tts.preload_models()
 def get_current_user_id(language):
     """
     Returns the user_id for the current browser session, creating a new
@@ -67,16 +181,28 @@ def get_current_user_id(language):
     return session["user_id"]
 @app.route("/")
 def index():
     return render_template("patient.html", languages=translation.SUPPORTED_LANGUAGES)
-@app.route("/provider")
-def provider_page():
-    return render_template("provider.html")
 @app.route("/transcribe", methods=["POST"])
 def transcribe_only():
     """
@@ -148,15 +274,51 @@ def patient_input():
     })
 @app.route("/preview-response", methods=["POST"])
 def preview_response():
     """
-    Runs the exact same translate + synthesize pipeline as
-    /provider-response below, so the provider can read and hear precisely
-    what the patient will receive before committing to it. Unlike
-    /provider-response, this never touches the database - only "Send
-    reply" actually saves a response. Each preview click is a real
-    translation + speech synthesis call, same cost as an actual send.
     """
     interaction_id = request.form.get("interaction_id")
     response_text = request.form.get("response_text")
@@ -182,16 +344,10 @@ def preview_response():
 @app.route("/provider-response", methods=["POST"])
 def provider_response():
     interaction_id = request.form.get("interaction_id")
     response_text = request.form.get("response_text")
-    # Optional cache-reuse fields: if the provider already generated a
-    # preview of this exact reply via /preview-response and didn't edit
-    # it afterward, the frontend passes the already-computed translation
-    # back here so this route can skip re-translating and re-synthesizing
-    # speech. Both are best-effort - if the preview audio isn't actually
-    # on disk, this quietly falls back to doing the full work itself,
-    # exactly as if these fields had never been sent.
     cached_translation = request.form.get("translated_response")
     reuse_audio = request.form.get("reuse_audio") == "true"
@@ -210,9 +366,14 @@ def provider_response():
     if cached_translation and reuse_audio and os.path.exists(preview_path):
         translated_response = cached_translation
         os.replace(preview_path, audio_path)
     else:
         translated_response = translation.translate(response_text, "english", patient_language)
         tts.synthesize_speech(translated_response, patient_language, audio_path)
     database.update_interaction_response(interaction_id, response_text, translated_response)
@@ -222,54 +383,58 @@ def provider_response():
     })
-@app.route("/interaction/<interaction_id>")
-def get_interaction(interaction_id):
-    interaction = database.get_interaction(interaction_id)
-    if not interaction:
-        return jsonify({"error": "interaction not found"}), 404
-    audio_filename = f"response_{interaction_id}.wav"
-    audio_path = os.path.join(AUDIO_DIR, audio_filename)
-    interaction["audio_url"] = f"/static/audio/{audio_filename}" if os.path.exists(audio_path) else None
-    return jsonify(interaction)
 @app.route("/pending-interactions")
 def pending_interactions():
     return jsonify(database.get_pending_interactions())
 @app.route("/completed-interactions")
 def completed_interactions():
     return jsonify(database.get_completed_interactions())
-@app.route("/history")
-def history():
-    if "user_id" not in session:
-        return jsonify([])
-    return jsonify(database.get_interactions_for_user(session["user_id"]))
 @app.route("/patient-history/<user_id>")
 def patient_history(user_id):
     """
     All of one patient's interactions, for the provider workspace's
-    "conversation history" panel. Distinct from /history above: that route
-    always looks up the current browser's own session, which only works
-    for the patient viewing their own messages. The provider needs to look
-    up a specific patient's history by id instead.
     """
     return jsonify(database.get_interactions_for_user(user_id))
-@app.route("/end-session", methods=["POST"])
-def end_session_route():
-    if "session_id" in session:
-        database.end_session(session["session_id"], datetime.now(timezone.utc).isoformat())
-    session.clear()
-    return jsonify({"status": "ended"})
 if __name__ == "__main__":

    summarizes the likely symptoms or intent for the provider.
 2. Provider submits a reply in English. The system translates it back
    into the patient's language and generates spoken audio for it.
+Provider authentication: all provider-side routes check for a
+PROVIDER_TOKEN in the env file. The provider enters this token once
+per browser session via the /provider-login page. It is stored in a
+signed Flask session cookie, same as the patient's user_id. This is
+not a full authentication system - it is a single shared credential
+that closes the unauthenticated IDOR exposure on provider routes
+without introducing a user accounts table or an auth framework.
+Set PROVIDER_TOKEN to any long random string in the env file before
+deploying with real patient data.
+Audio cleanup: preview_*.wav files are cleaned up automatically after
+/provider-response either promotes them (os.replace) or falls back to
+a fresh synthesis. response_*.wav files are retained because the
+patient needs to be able to play them back from /interaction/<id>.
+A separate /cleanup-audio admin route deletes response audio older
+than 30 days for disk management on long-running deployments.
 """
 import os
 import uuid
+import glob
+import functools
+from datetime import datetime, timezone, timedelta
 from dotenv import load_dotenv
+from flask import Flask, request, jsonify, render_template, render_template_string, session, redirect, url_for
 import database
 import stt
 load_dotenv("env")
 AUDIO_DIR = os.path.join(os.path.dirname(os.path.abspath(__file__)), "static", "audio")
+PROVIDER_TOKEN = os.environ.get("PROVIDER_TOKEN", "")
 def create_app():
 tts.preload_models()
+# ── Provider authentication ───────────────────────────────────────────────────
+def provider_required(f):
+    """
+    Decorator for provider-side routes. If PROVIDER_TOKEN is not set in
+    the env file, the route is unprotected (preserving the existing
+    behaviour for local development and demos). If it is set, the request
+    must carry a matching token in the provider_session cookie, set by
+    /provider-login. Returns 401 JSON for API routes, redirects to the
+    login page for the /provider HTML route.
+    """
+    @functools.wraps(f)
+    def decorated(*args, **kwargs):
+        if not PROVIDER_TOKEN:
+            # Token not configured: unprotected, existing behaviour preserved.
+            return f(*args, **kwargs)
+        if session.get("provider_authenticated"):
+            return f(*args, **kwargs)
+        # HTML route gets a redirect; JSON routes get a 401.
+        if request.accept_mimetypes.accept_html and not request.is_json:
+            return redirect(url_for("provider_login"))
+        return jsonify({"error": "provider authentication required"}), 401
+    return decorated
+@app.route("/provider-login", methods=["GET", "POST"])
+def provider_login():
+    """
+    Simple token entry page. The provider enters the PROVIDER_TOKEN value
+    from the env file. On success, sets provider_authenticated in the
+    signed session cookie and redirects to /provider.
+    """
+    error = None
+    if request.method == "POST":
+        token = request.form.get("token", "").strip()
+        if token and token == PROVIDER_TOKEN:
+            session["provider_authenticated"] = True
+            return redirect(url_for("provider_page"))
+        error = "Incorrect token. Please try again."
+    # Inline template so this fix does not require a new file in templates/.
+    return render_template_string("""
+<!DOCTYPE html>
+<html lang="en">
+<head>
+  <meta charset="UTF-8">
+  <meta name="viewport" content="width=device-width, initial-scale=1.0">
+  <title>TalkToDoc — Provider Login</title>
+  <link rel="stylesheet" href="{{ url_for('static', filename='css/style.css') }}">
+</head>
+<body>
+  <div class="app-shell">
+    <div class="app-header provider">
+      <div class="brand">
+        <div class="brand-mark">
+          <svg viewBox="0 0 24 24" fill="none" stroke="white" stroke-width="2"
+               stroke-linecap="round" stroke-linejoin="round">
+            <path d="M21 11.5a8.38 8.38 0 0 1-.9 3.8 8.5 8.5 0 0 1-7.6 4.7
+                     8.38 8.38 0 0 1-3.8-.9L3 21l1.9-5.7a8.38 8.38 0 0 1-.9-3.8
+                     8.5 8.5 0 0 1 4.7-7.6 8.38 8.38 0 0 1 3.8-.9h.5a8.48 8.48
+                     0 0 1 8 8v.5z"/>
+          </svg>
+        </div>
+        <div>
+          <h1>TalkToDoc</h1>
+          <span class="role-tag">Provider</span>
+        </div>
+      </div>
+    </div>
+    <main class="app-main" id="main-content">
+      <div class="card" style="max-width:400px;margin:0 auto;">
+        <h2>Provider access</h2>
+        <p class="helper-text">Enter the provider token to continue.</p>
+        {% if error %}
+          <div class="status-banner error">{{ error }}</div>
+        {% endif %}
+        <form method="post">
+          <label for="token">Access token</label>
+          <input type="password" id="token" name="token"
+                 placeholder="Enter provider token" autocomplete="current-password">
+          <button type="submit" class="btn btn-provider" style="margin-top:16px;width:100%">
+            Continue
+          </button>
+        </form>
+      </div>
+    </main>
+  </div>
+</body>
+</html>
+    """, error=error)
+# ── Helpers ───────────────────────────────────────────────────────────────────
 def get_current_user_id(language):
     """
     Returns the user_id for the current browser session, creating a new
     return session["user_id"]
+def _cleanup_preview(interaction_id):
+    """
+    Deletes the preview audio file for an interaction if it still exists.
+    Called after /provider-response either promotes the file (os.replace)
+    or falls back to fresh synthesis - in the fresh-synthesis path the
+    preview file is left behind unused, so we clean it here.
+    """
+    preview_path = os.path.join(AUDIO_DIR, f"preview_{interaction_id}.wav")
+    try:
+        if os.path.exists(preview_path):
+            os.remove(preview_path)
+    except OSError:
+        pass  # If the remove fails, it is not worth surfacing as an error.
+# ── Patient routes ────────────────────────────────────────────────────────────
 @app.route("/")
 def index():
     return render_template("patient.html", languages=translation.SUPPORTED_LANGUAGES)
 @app.route("/transcribe", methods=["POST"])
 def transcribe_only():
     """
     })
+@app.route("/interaction/<interaction_id>")
+def get_interaction(interaction_id):
+    interaction = database.get_interaction(interaction_id)
+    if not interaction:
+        return jsonify({"error": "interaction not found"}), 404
+    audio_filename = f"response_{interaction_id}.wav"
+    audio_path = os.path.join(AUDIO_DIR, audio_filename)
+    interaction["audio_url"] = f"/static/audio/{audio_filename}" if os.path.exists(audio_path) else None
+    return jsonify(interaction)
+@app.route("/history")
+def history():
+    if "user_id" not in session:
+        return jsonify([])
+    return jsonify(database.get_interactions_for_user(session["user_id"]))
+@app.route("/end-session", methods=["POST"])
+def end_session_route():
+    if "session_id" in session:
+        database.end_session(session["session_id"], datetime.now(timezone.utc).isoformat())
+    session.clear()
+    return jsonify({"status": "ended"})
+# ── Provider routes (all protected by @provider_required) ─────────────────────
+@app.route("/provider")
+@provider_required
+def provider_page():
+    return render_template("provider.html")
 @app.route("/preview-response", methods=["POST"])
+@provider_required
 def preview_response():
     """
+    Runs the exact same translate + synthesize pipeline as /provider-response,
+    so the provider can read and hear precisely what the patient will receive
+    before committing. Unlike /provider-response, this never touches the
+    database. The preview audio file is cleaned up automatically by
+    /provider-response regardless of which code path it takes.
     """
     interaction_id = request.form.get("interaction_id")
     response_text = request.form.get("response_text")
 @app.route("/provider-response", methods=["POST"])
+@provider_required
 def provider_response():
     interaction_id = request.form.get("interaction_id")
     response_text = request.form.get("response_text")
     cached_translation = request.form.get("translated_response")
     reuse_audio = request.form.get("reuse_audio") == "true"
     if cached_translation and reuse_audio and os.path.exists(preview_path):
         translated_response = cached_translation
         os.replace(preview_path, audio_path)
+        # preview file was promoted via os.replace so it no longer exists;
+        # _cleanup_preview is a no-op here but called for consistency.
     else:
         translated_response = translation.translate(response_text, "english", patient_language)
         tts.synthesize_speech(translated_response, patient_language, audio_path)
+        # preview file (if one existed from a prior Preview click) was not
+        # promoted and is now orphaned; delete it.
+        _cleanup_preview(interaction_id)
     database.update_interaction_response(interaction_id, response_text, translated_response)
     })
 @app.route("/pending-interactions")
+@provider_required
 def pending_interactions():
     return jsonify(database.get_pending_interactions())
 @app.route("/completed-interactions")
+@provider_required
 def completed_interactions():
     return jsonify(database.get_completed_interactions())
 @app.route("/patient-history/<user_id>")
+@provider_required
 def patient_history(user_id):
     """
     All of one patient's interactions, for the provider workspace's
+    conversation history panel. Distinct from /history: that route looks
+    up the current browser session, which only works for patients viewing
+    their own messages. The provider needs to look up by explicit user_id.
     """
     return jsonify(database.get_interactions_for_user(user_id))
+@app.route("/cleanup-audio", methods=["POST"])
+@provider_required
+def cleanup_audio():
+    """
+    Deletes response_*.wav files older than 30 days. Intended for
+    long-running deployments where response audio accumulates on disk.
+    Call this from a cron job or a scheduled task; it does not run
+    automatically. Returns the number of files deleted and their
+    total size freed in bytes.
+    """
+    cutoff = datetime.now(timezone.utc) - timedelta(days=30)
+    deleted_count = 0
+    freed_bytes = 0
+    for path in glob.glob(os.path.join(AUDIO_DIR, "response_*.wav")):
+        try:
+            mtime = datetime.fromtimestamp(os.path.getmtime(path), tz=timezone.utc)
+            if mtime < cutoff:
+                freed_bytes += os.path.getsize(path)
+                os.remove(path)
+                deleted_count += 1
+        except OSError:
+            pass
+    return jsonify({
+        "deleted": deleted_count,
+        "freed_bytes": freed_bytes,
+    })
 if __name__ == "__main__":

database.py CHANGED Viewed

@@ -1,147 +1,208 @@
 """
-Database layer for TalkToDoc.
-Local development and testing use SQLite (no setup needed). When deployed,
-DATABASE_URL is set by Render and the app uses Postgres instead, since
-Render's free tier wipes local files like a SQLite database on every
-restart.
-Queries are written once using SQLite-style '?' placeholders and adapted
-automatically for Postgres, so there's a single query per function rather
-than two versions of everything.
 """
 import os
-from pathlib import Path
-import sqlite3
-DB_PATH = Path(__file__).parent / "talktodoc.db"
-SCHEMA_PATH = Path(__file__).parent / "schema.sql"
-SCHEMA_PATH_POSTGRES = Path(__file__).parent / "schema_postgres.sql"
 DATABASE_URL = os.environ.get("DATABASE_URL")
-if DATABASE_URL:
-    import psycopg2
-    import psycopg2.extras
 def get_connection():
     if DATABASE_URL:
-        return psycopg2.connect(DATABASE_URL, cursor_factory=psycopg2.extras.RealDictCursor)
-    connection = sqlite3.connect(DB_PATH)
-    connection.row_factory = sqlite3.Row
-    connection.execute("PRAGMA foreign_keys = ON")
-    return connection
-def _run(connection, query, params=()):
-    if DATABASE_URL:
-        query = query.replace("?", "%s")
     cursor = connection.cursor()
-    cursor.execute(query, params)
     return cursor
-def _insert_and_get_id(connection, query, params):
-    if DATABASE_URL:
-        cursor = _run(connection, query + " RETURNING id", params)
-        return cursor.fetchone()["id"]
-    cursor = _run(connection, query, params)
-    return cursor.lastrowid
 def init_db():
-    schema_path = SCHEMA_PATH_POSTGRES if DATABASE_URL else SCHEMA_PATH
-    schema_sql = schema_path.read_text()
-    with get_connection() as connection:
         if DATABASE_URL:
-            connection.cursor().execute(schema_sql)
         else:
-            connection.executescript(schema_sql)
 def add_user(name, preferred_language, role):
-    with get_connection() as connection:
-        return _insert_and_get_id(
-            connection,
-            "INSERT INTO app_user (name, preferred_language, role) VALUES (?, ?, ?)",
-            (name, preferred_language, role),
-        )
 def add_session(user_id, start_time):
-    with get_connection() as connection:
-        return _insert_and_get_id(
-            connection,
-            "INSERT INTO session (user_id, start_time) VALUES (?, ?)",
-            (user_id, start_time),
-        )
 def end_session(session_id, end_time):
-    with get_connection() as connection:
-        _run(connection, "UPDATE session SET end_time = ? WHERE id = ?", (end_time, session_id))
-def add_interaction(user_id, input_text, detected_language, translated_text, nlu_summary, timestamp):
-    with get_connection() as connection:
-        return _insert_and_get_id(
-            connection,
-            """INSERT INTO interaction
-               (user_id, input_text, detected_language, translated_text, nlu_summary, timestamp)
-               VALUES (?, ?, ?, ?, ?, ?)""",
-            (user_id, input_text, detected_language, translated_text, nlu_summary, timestamp),
         )
 def get_interactions_for_user(user_id):
-    with get_connection() as connection:
         cursor = _run(
-            connection,
-            "SELECT * FROM interaction WHERE user_id = ? ORDER BY timestamp",
             (user_id,),
         )
         return [dict(row) for row in cursor.fetchall()]
 def get_pending_interactions():
-    with get_connection() as connection:
         cursor = _run(
-            connection,
             "SELECT * FROM interaction WHERE provider_response IS NULL ORDER BY timestamp",
         )
         return [dict(row) for row in cursor.fetchall()]
 def get_completed_interactions():
-    with get_connection() as connection:
         cursor = _run(
-            connection,
             "SELECT * FROM interaction WHERE provider_response IS NOT NULL ORDER BY timestamp DESC",
         )
         return [dict(row) for row in cursor.fetchall()]
-def get_interaction(interaction_id):
-    with get_connection() as connection:
-        cursor = _run(connection, "SELECT * FROM interaction WHERE id = ?", (interaction_id,))
-        row = cursor.fetchone()
-        return dict(row) if row else None
-def update_interaction_response(interaction_id, provider_response, translated_response):
-    with get_connection() as connection:
-        _run(
-            connection,
-            "UPDATE interaction SET provider_response = ?, translated_response = ? WHERE id = ?",
-            (provider_response, translated_response, interaction_id),
-        )
-if __name__ == "__main__":
-    init_db()
-    if DATABASE_URL:
-        print("Database initialized (Postgres)")
-    else:
-        print("Database created at:", DB_PATH)

 """
+Database access layer for TalkToDoc.
+Handles both SQLite (local development) and PostgreSQL (production) through
+a single shared query interface. The only difference between the two is how
+get_connection() builds the connection object; every function above that is
+identical regardless of which database is running underneath.
+Connection management: every public function in this module uses the
+_connection() context manager (not get_connection() directly). That
+context manager commits on success, rolls back on exception, and always
+closes the connection before returning control. The bare
+`with get_connection() as conn:` pattern that psycopg2 and sqlite3 both
+support commits/rolls back correctly but never closes the connection,
+which leaks file handles against SQLite and exhausts the Postgres
+connection pool in production over time.
 """
 import os
+import contextlib
+from dotenv import load_dotenv
+load_dotenv("env")
 DATABASE_URL = os.environ.get("DATABASE_URL")
 def get_connection():
+    """
+    Returns a raw database connection. Callers should use _connection()
+    instead, which wraps this and guarantees the connection is closed.
+    """
     if DATABASE_URL:
+        import psycopg2
+        import psycopg2.extras
+        conn = psycopg2.connect(DATABASE_URL, cursor_factory=psycopg2.extras.RealDictCursor)
+        return conn
+    else:
+        import sqlite3
+        conn = sqlite3.connect(
+            os.path.join(os.path.dirname(os.path.abspath(__file__)), "talktodoc.db")
+        )
+        conn.row_factory = sqlite3.Row
+        return conn
+@contextlib.contextmanager
+def _connection():
+    """
+    Context manager that opens a connection, yields it, commits on clean
+    exit, rolls back on exception, and always closes. Use this everywhere
+    instead of `with get_connection() as conn:`.
+    """
+    conn = get_connection()
+    try:
+        yield conn
+        conn.commit()
+    except Exception:
+        conn.rollback()
+        raise
+    finally:
+        conn.close()
+def _run(connection, sql, params=()):
     cursor = connection.cursor()
+    cursor.execute(sql, params)
     return cursor
+def _placeholder():
+    """
+    SQLite uses ? for bind parameters; psycopg2 uses %s.
+    Returns the right one for whichever database is active.
+    """
+    return "%s" if DATABASE_URL else "?"
 def init_db():
+    schema_file = "schema_postgres.sql" if DATABASE_URL else "schema.sql"
+    schema_path = os.path.join(os.path.dirname(os.path.abspath(__file__)), schema_file)
+    with open(schema_path) as f:
+        schema = f.read()
+    with _connection() as conn:
         if DATABASE_URL:
+            for statement in schema.split(";"):
+                stmt = statement.strip()
+                if stmt:
+                    _run(conn, stmt)
         else:
+            conn.executescript(schema)
 def add_user(name, preferred_language, role):
+    p = _placeholder()
+    with _connection() as conn:
+        if DATABASE_URL:
+            cursor = _run(
+                conn,
+                f"INSERT INTO app_user (name, preferred_language, role) VALUES ({p}, {p}, {p}) RETURNING id",
+                (name, preferred_language, role),
+            )
+            return cursor.fetchone()["id"]
+        else:
+            cursor = _run(
+                conn,
+                f"INSERT INTO app_user (name, preferred_language, role) VALUES ({p}, {p}, {p})",
+                (name, preferred_language, role),
+            )
+            return cursor.lastrowid
 def add_session(user_id, start_time):
+    p = _placeholder()
+    with _connection() as conn:
+        if DATABASE_URL:
+            cursor = _run(
+                conn,
+                f"INSERT INTO session (user_id, start_time) VALUES ({p}, {p}) RETURNING id",
+                (user_id, start_time),
+            )
+            return cursor.fetchone()["id"]
+        else:
+            cursor = _run(
+                conn,
+                f"INSERT INTO session (user_id, start_time) VALUES ({p}, {p})",
+                (user_id, start_time),
+            )
+            return cursor.lastrowid
 def end_session(session_id, end_time):
+    p = _placeholder()
+    with _connection() as conn:
+        _run(
+            conn,
+            f"UPDATE session SET end_time = {p} WHERE id = {p}",
+            (end_time, session_id),
+        )
+def add_interaction(user_id, input_text, detected_language, translated_text,
+                    nlu_summary, timestamp):
+    p = _placeholder()
+    sql = (
+        f"INSERT INTO interaction "
+        f"(user_id, input_text, detected_language, translated_text, nlu_summary, timestamp) "
+        f"VALUES ({p}, {p}, {p}, {p}, {p}, {p})"
+    )
+    params = (user_id, input_text, detected_language, translated_text, nlu_summary, timestamp)
+    with _connection() as conn:
+        if DATABASE_URL:
+            cursor = _run(conn, sql.replace(")", " RETURNING id)", 1), params)
+            return cursor.fetchone()["id"]
+        else:
+            cursor = _run(conn, sql, params)
+            return cursor.lastrowid
+def get_interaction(interaction_id):
+    p = _placeholder()
+    with _connection() as conn:
+        cursor = _run(
+            conn,
+            f"SELECT * FROM interaction WHERE id = {p}",
+            (interaction_id,),
+        )
+        row = cursor.fetchone()
+        return dict(row) if row else None
+def update_interaction_response(interaction_id, provider_response, translated_response):
+    p = _placeholder()
+    with _connection() as conn:
+        _run(
+            conn,
+            f"UPDATE interaction SET provider_response = {p}, translated_response = {p} WHERE id = {p}",
+            (provider_response, translated_response, interaction_id),
         )
 def get_interactions_for_user(user_id):
+    p = _placeholder()
+    with _connection() as conn:
         cursor = _run(
+            conn,
+            f"SELECT * FROM interaction WHERE user_id = {p} ORDER BY timestamp",
             (user_id,),
         )
         return [dict(row) for row in cursor.fetchall()]
 def get_pending_interactions():
+    with _connection() as conn:
         cursor = _run(
+            conn,
             "SELECT * FROM interaction WHERE provider_response IS NULL ORDER BY timestamp",
         )
         return [dict(row) for row in cursor.fetchall()]
 def get_completed_interactions():
+    with _connection() as conn:
         cursor = _run(
+            conn,
             "SELECT * FROM interaction WHERE provider_response IS NOT NULL ORDER BY timestamp DESC",
         )
         return [dict(row) for row in cursor.fetchall()]