Update app.py

app.py

@@ -1,14 +1,34 @@
 # -*- coding: utf-8 -*-
 """
-Mahoon Legal AI — Causal-only Generation + Hybrid RAG + W&B Training + Weight Tuning
+Mahoon Legal AI — Causal-only Generation + Hybrid RAG + W&B + ZeroGPU + Role Gating
+safari-shojaei-goldasteh-dr.pasandi
+
+- تب «مشاوره» برای همه تعاملی است.
+- تب‌های «ایندکس»، «ساخت دیتاست»، «پاکسازی»، «آموزش»، «Weight Tuning» برای بازدیدکننده فقط نمایشی‌اند؛
+  و سمت‌سرور نیز گِیت نقش دارد (ادمین/بازدیدکننده).
+
 پیش‌نیازها:
-- golden_builder.py
-- weights_sweep.py
-- Secrets: WANDB_API_KEY
+- golden_builder.py , weights_sweep.py
+- Settings → Secrets: WANDB_API_KEY (در صورت استفاده از W&B)
+- Settings → Environment Variables: ADMIN_USERS (مثلاً: haji-mammad, teammate1)
+- requirements.txt (ZeroGPU-ready) شامل spaces>=0.42.0
 """
 
 from __future__ import annotations
-import os, sys, re, json, time, pickle, zipfile, warnings
+
+# --- Telemetry hard-off + ZeroGPU SDK (must be before chroma import) ---
+import os, logging
+os.environ["CHROMA_TELEMETRY_ENABLED"] = "false"
+os.environ["ANONYMIZED_TELEMETRY"] = "false"
+
+import spaces  # ZeroGPU SDK
+
+# (اختیاری) کاهش نویز لاگ‌ها
+logging.getLogger("chromadb").setLevel(logging.ERROR)
+logging.getLogger("posthog").setLevel(logging.CRITICAL)
+# -----------------------------------------------------------------------
+
+import sys, re, json, time, pickle, zipfile, warnings
 from dataclasses import dataclass, field
 from pathlib import Path
 from typing import List, Dict, Optional
@@ -21,19 +41,35 @@ from sklearn.model_selection import train_test_split
 import gradio as gr
 warnings.filterwarnings("ignore")
 
-# ====== ML & NLP ======
+# ====== Transformers ======
 import transformers as tf
 from transformers import (
     AutoTokenizer, AutoModelForCausalLM,
     Trainer, TrainingArguments, EarlyStoppingCallback
 )
 
-# RAG stack
+# ====== RAG stack ======
 import chromadb
-from chromadb.config import Settings  # <-- برای خاموش کردن Telemetry
+from chromadb.config import Settings
 from rank_bm25 import BM25Okapi
 from sentence_transformers import CrossEncoder, SentenceTransformer, util as st_util
 
+# ---- Monkeypatch Chroma telemetry (fallback) ----
+try:
+    import chromadb.telemetry as _ctel
+    try: _ctel.client = None
+    except Exception: pass
+    for _n in ("capture", "capture_event"):
+        if hasattr(_ctel, _n):
+            try: setattr(_ctel, _n, lambda *a, **k: None)
+            except Exception: pass
+    if hasattr(_ctel, "Telemetry"):
+        try: _ctel.Telemetry().capture = lambda *a, **k: None
+        except Exception: pass
+except Exception:
+    pass
+# -------------------------------------------------
+
 # ========= Persian normalization =========
 ZWNJ = "\u200c"
 AR_DIGITS = "٠١٢٣٤٥٦٧٨٩"
@@ -57,8 +93,8 @@ def normalize_fa(s: str) -> str:
 @dataclass
 class ModelConfig:
     model_name: str = "Qwen/Qwen2.5-7B-Instruct"
-    max_input_length: int = 4096
-    max_new_tokens: int = 512
+    max_input_length: int = 3072
+    max_new_tokens: int = 256
     temperature: float = 0.7
     top_p: float = 0.9
     do_sample: bool = True
@@ -68,9 +104,9 @@ class ModelConfig:
 class RAGConfig:
     persist_dir: str = "./chroma_db"
     collection: str = "legal_articles"
-    top_k: int = 8
-    similarity_threshold: float = 0.60
-    context_char_limit: int = 280
+    top_k: int = 6
+    similarity_threshold: float = 0.68
+    context_char_limit: int = 260
     enable: bool = True
     reranker_name: str = "Alibaba-NLP/gte-multilingual-reranker-base"
 
@@ -95,7 +131,7 @@ class TrainConfig:
     save_total_limit: int = 2
     report_to: str = "wandb"
     max_grad_norm: float = 1.0
-    use_4bit: bool = True
+    use_4bit: bool = False
     max_seq_len: int = 2048
 
 @dataclass
@@ -129,6 +165,23 @@ def log_deps():
     except Exception as e:
         print("[deps] warn:", e, flush=True)
 
+# ==========================
+# Role gating helpers
+# ==========================
+def _get_username(request: gr.Request) -> str | None:
+    try:
+        return getattr(request, "username", None)
+    except Exception:
+        return None
+
+def is_admin(request: gr.Request) -> bool:
+    uname = _get_username(request)
+    if not uname:
+        return False
+    author = os.getenv("SPACE_AUTHOR_NAME", "").strip()
+    allow = {u.strip() for u in os.getenv("ADMIN_USERS", "").split(",") if u.strip()}
+    return (uname == author) or (uname in allow)
+
 # ==========================
 # RAG: Chroma + BM25 + CrossEncoder reranker
 # ==========================
@@ -144,7 +197,6 @@ class LegalRAG:
 
     def init(self):
         Path(self.cfg.persist_dir).mkdir(parents=True, exist_ok=True)
-        # خاموش کردن تله‌متری Chroma
         self.client = chromadb.PersistentClient(
             path=self.cfg.persist_dir,
             settings=Settings(anonymized_telemetry=False)
@@ -154,13 +206,12 @@ class LegalRAG:
         except Exception:
             try: self.collection = self.client.get_collection(self.cfg.collection)
             except Exception: self.collection = self.client.create_collection(self.cfg.collection)
-        # reranker
+
         try:
-            dev = "cuda" if torch.cuda.is_available() else "cpu"
-            self.reranker = CrossEncoder(self.cfg.reranker_name, device=dev)
+            self.reranker = CrossEncoder(self.cfg.reranker_name, device="cpu")
         except Exception:
             self.reranker = None
-        # BM25
+
         if Path(self.bm25_path).exists():
             with open(self.bm25_path, "rb") as f:
                 obj = pickle.load(f)
@@ -174,7 +225,6 @@ class LegalRAG:
             pickle.dump({"bm25": self.bm25, "ids": self.bm25_ids}, f)
 
     def index_jsonl(self, jsonl_path: str, id_key="article_id", text_key="text"):
-        """ایندکس با تضمین یکتایی ID: ارقام Normalize و در صورت تکرار، پسوند __dN اضافه می‌شود."""
         if not self.collection: self.init()
 
         seen: Dict[str, int] = {}
@@ -224,7 +274,7 @@ class LegalRAG:
         if not self.collection: return []
         qn = normalize_fa(query)
 
-        # Dense via Chroma
+        # Dense
         try:
             res = self.collection.query(
                 query_texts=[qn],
@@ -265,10 +315,14 @@ class LegalRAG:
         merged = [a for a in pool.values() if a.get("text") and len(a["text"]) > 15]
         merged = [a for a in merged if a.get("similarity", 0) >= self.cfg.similarity_threshold]
 
-        # rerank
+        # rerank (GPU only during predict)
         if merged and self.reranker:
             pairs = [(qn, a["text"]) for a in merged]
-            scores = self.reranker.predict(pairs)
+            try:
+                with spaces.GPU(duration=30):
+                    scores = self.reranker.predict(pairs)
+            except Exception:
+                scores = self.reranker.predict(pairs)
             for a, s in zip(merged, scores): a["score"] = float(s)
             merged = sorted(merged, key=lambda x: x.get("score", 0), reverse=True)[: self.cfg.top_k]
         else:
@@ -318,7 +372,7 @@ def ensure_chroma_ready(persist_dir="./chroma_db", collection="legal_articles")
     return "پایگاه RAG موجود نیست و منبع خامی هم برای ساخت پیدا نشد."
 
 # ==========================
-# Loader + Generator (Causal-only)
+# Loader + Generator (Causal-only, ZeroGPU)
 # ==========================
 class CausalLoader:
     def __init__(self, mcfg: ModelConfig):
@@ -330,15 +384,20 @@ class CausalLoader:
         self.tokenizer = AutoTokenizer.from_pretrained(model_name, use_fast=True)
         if self.tokenizer.pad_token is None and hasattr(self.tokenizer, "eos_token"):
             self.tokenizer.pad_token = self.tokenizer.eos_token
-        kwargs = {}
-        if torch.cuda.is_available():
-            kwargs["device_map"] = "auto"
-            kwargs["torch_dtype"] = torch.bfloat16 if bf16_supported() else torch.float16
-            kwargs["low_cpu_mem_usage"] = True  # <-- امن‌سازی حافظه
-        self.model = AutoModelForCausalLM.from_pretrained(model_name, **kwargs)
-        if self.cfg.gradient_checkpointing and hasattr(self.model, "gradient_checkpointing_enable"):
-            try: self.model.gradient_checkpointing_enable()
-            except Exception: pass
+
+        try:
+            with spaces.GPU(duration=90):
+                kwargs = {"low_cpu_mem_usage": True}
+                if torch.cuda.is_available():
+                    kwargs["device_map"] = "auto"
+                    kwargs["torch_dtype"] = torch.bfloat16 if bf16_supported() else torch.float16
+                self.model = AutoModelForCausalLM.from_pretrained(model_name, **kwargs)
+                if self.cfg.gradient_checkpointing and hasattr(self.model, "gradient_checkpointing_enable"):
+                    try: self.model.gradient_checkpointing_enable()
+                    except Exception: pass
+        except Exception:
+            self.model = AutoModelForCausalLM.from_pretrained(model_name, low_cpu_mem_usage=True)
+
         return self
 
 class Generator:
@@ -353,16 +412,34 @@ class Generator:
         if context: parts.append(f"<|system|>\nاز منابع زیر استفاده کن و استنادی پاسخ بده:\n{context}")
         parts.append(f"<|user|>\n{question}")
         prompt = "\n".join(parts) + "\n<|assistant|>\n"
-        enc = self.tk(prompt, return_tensors="pt", truncation=True, max_length=self.cfg.max_input_length).to(self.model.device)
-        with torch.no_grad():
-            out = self.model.generate(
-                **enc,
-                max_new_tokens=self.cfg.max_new_tokens,
-                do_sample=self.cfg.do_sample,
-                temperature=self.cfg.temperature,
-                top_p=self.cfg.top_p,
-                pad_token_id=self.tk.pad_token_id or self.tk.eos_token_id,
-            )
+
+        enc = self.tk(prompt, return_tensors="pt", truncation=True, max_length=self.cfg.max_input_length)
+
+        try:
+            with spaces.GPU(duration=60):
+                dev_model = next(self.model.parameters()).device if hasattr(self.model, "parameters") else "cpu"
+                inputs = {k: v.to(dev_model) for k, v in enc.items()}
+                with torch.no_grad():
+                    out = self.model.generate(
+                        **inputs,
+                        max_new_tokens=self.cfg.max_new_tokens,
+                        do_sample=self.cfg.do_sample,
+                        temperature=self.cfg.temperature,
+                        top_p=self.cfg.top_p,
+                        pad_token_id=self.tk.pad_token_id or self.tk.eos_token_id,
+                    )
+        except Exception:
+            inputs = {k: v for k, v in enc.items()}
+            with torch.no_grad():
+                out = self.model.generate(
+                    **inputs,
+                    max_new_tokens=min(self.cfg.max_new_tokens, 256),
+                    do_sample=self.cfg.do_sample,
+                    temperature=self.cfg.temperature,
+                    top_p=self.cfg.top_p,
+                    pad_token_id=self.tk.pad_token_id or self.tk.eos_token_id,
+                )
+
         return self.tk.decode(out[0], skip_special_tokens=True)
 
 # ==========================
@@ -538,7 +615,7 @@ def deduplicate_jsonl(in_path: str, out_path: str, sim_threshold: float = 0.90,
     return len(kept)
 
 # ==========================
-# App (Gradio)
+# App (Gradio) + Role Gating
 # ==========================
 class LegalApp:
     def __init__(self, scfg: Optional[SystemConfig] = None):
@@ -554,7 +631,7 @@ class LegalApp:
             if p: paths.append(p)
         return paths
 
-    # Core
+    # Core (مشاوره/لود آزاد است)
     def load(self, model_name: str):
         self.loader = CausalLoader(self.scfg.model).load(model_name)
         self.gen = Generator(self.loader, self.scfg.model)
@@ -568,7 +645,10 @@ class LegalApp:
                 msg_rag = f"RAG خطا: {e}"
         return f"مدل بارگذاری شد: {model_name}\n{msg_rag}"
 
-    def build_index(self, laws_file: gr.File, id_key: str, text_key: str):
+    # --- گیت سمت‌سرور: فقط ادمین ---
+    def build_index(self, laws_file: gr.File, id_key: str, text_key: str, request: gr.Request):
+        if not is_admin(request):
+            return "🔒 این عملیات فقط برای مدیران فعال است."
         if not self.scfg.rag.enable: return "RAG غیرفعال است."
         try:
             self.rag.init()
@@ -578,28 +658,32 @@ class LegalApp:
         except Exception as e:
             return f"خطا در ایندکس: {e}"
 
-    def answer(self, question: str, system_prompt: str, use_rag: bool, max_new_tokens: int, temperature: float, top_p: float):
-        if not question.strip(): return "لطفاً سوال خود را وارد کنید.", ""
-        if not self.gen: return "ابتدا مدل را بارگذاری کنید.", ""
-        self.scfg.model.max_new_tokens = int(max_new_tokens)
-        self.scfg.model.temperature = float(temperature)
-        self.scfg.model.top_p = float(top_p)
-
-        arts = self.rag.retrieve(question) if (use_rag and self.scfg.rag.enable and self.rag.collection) else []
-        # محدودسازی رفرنس‌ها
-        max_refs = 4
-        if arts: arts = arts[:max_refs]
-        ctx = self.rag.build_context(arts) if arts else ""
-        ans = self.gen.generate(question, ctx, system_prompt)
-
-        refs = ""
-        if arts:
-            refs = "\n\n" + "\n".join([f"**ماده {a['article_id']}** (شباهت: {a.get('similarity',0):.2f})\n{a['text'][:320]}..." for a in arts])
-        return ans, refs
+    def build_dataset(self, raw_file, text_key: str, model_ckpt: str, batch_size: int, max_samples: int | None, request: gr.Request):
+        if not is_admin(request):
+            return None, "🔒 این عملیات فقط برای مدیران فعال است."
+        try:
+            from golden_builder import load_json_or_jsonl, save_jsonl, GoldenBuilder
+        except Exception as e:
+            return None, f"❌ golden_builder.py یافت نشد/قابل import نیست: {e}"
+        path = getattr(raw_file, "name", None) or getattr(raw_file, "path", None)
+        if not path: return None, "⚠️ فایل ورودی معتبر نیست."
+        try:
+            data = load_json_or_jsonl(path)
+            if max_samples and int(max_samples) > 0: data = data[:int(max_samples)]
+            gb = GoldenBuilder(model_name=model_ckpt)
+            rows = gb.build(data, text_key=text_key, batch_size=int(batch_size))
+            out_dir = "/tmp/mahoon_datasets"; Path(out_dir).mkdir(parents=True, exist_ok=True)
+            out_path = f"{out_dir}/golden_{os.path.basename(path)}.jsonl"
+            save_jsonl(rows, out_path)
+            return out_path, f"✅ {len(rows)} رکورد تولید شد."
+        except Exception as e:
+            return None, f"❌ خطا در ساخت دیتاست: {e}"
 
     def train(self, model_name: str, files: List[gr.File], use_rag: bool, epochs: int, batch: int, lr: float,
               use_wandb: bool, wandb_project: str, wandb_entity: str, run_name: str,
-              progress=gr.Progress(track_tqdm=True)):
+              progress=gr.Progress(track_tqdm=True), request: gr.Request = None):
+        if not is_admin(request):
+            return "🔒 این عملیات فقط برای مدیران فعال است."
         progress(0.05, desc="راه‌اندازی")
         self.scfg.train.epochs = int(epochs)
         self.scfg.train.batch_size = int(batch)
@@ -623,28 +707,9 @@ class LegalApp:
         progress(0.95, desc="ذخیرهٔ آرتیفکت‌ها")
         return f"✅ آموزش کامل شد و در {self.scfg.train.output_dir} ذخیره شد."
 
-    # Dataset Builder
-    def build_dataset(self, raw_file, text_key: str, model_ckpt: str, batch_size: int, max_samples: int | None):
-        try:
-            from golden_builder import load_json_or_jsonl, save_jsonl, GoldenBuilder
-        except Exception as e:
-            return None, f"❌ golden_builder.py یافت نشد/قابل import نیست: {e}"
-        path = getattr(raw_file, "name", None) or getattr(raw_file, "path", None)
-        if not path: return None, "⚠️ فایل ورودی معتبر نیست."
-        try:
-            data = load_json_or_jsonl(path)
-            if max_samples and int(max_samples) > 0: data = data[:int(max_samples)]
-            gb = GoldenBuilder(model_name=model_ckpt)
-            rows = gb.build(data, text_key=text_key, batch_size=int(batch_size))
-            out_dir = "/tmp/mahoon_datasets"; Path(out_dir).mkdir(parents=True, exist_ok=True)
-            out_path = f"{out_dir}/golden_{os.path.basename(path)}.jsonl"
-            save_jsonl(rows, out_path)
-            return out_path, f"✅ {len(rows)} رکورد تولید شد."
-        except Exception as e:
-            return None, f"❌ خطا در ساخت دیتاست: {e}"
-
-    # Weight Tuning (W&B Sweep)
-    def run_weight_tune(self, f, tk, ms, runs, bs, proj, ent):
+    def run_weight_tune(self, f, tk, ms, runs, bs, proj, ent, request: gr.Request):
+        if not is_admin(request):
+            return "🔒 این عملیات فقط برای مدیران فعال است."
         p = getattr(f, "name", None) or getattr(f, "path", None)
         if not p:
             return "⚠️ فایل داده نامعتبر است."
@@ -661,8 +726,9 @@ class LegalApp:
         except Exception as e:
             return f"❌ خطا در اجرای Sweep: {e}"
 
-    # Pull بهترین وزن‌ها از W&B و ذخیره در legal_entity_weights.json
-    def apply_best_weights(self, wandb_project: str, wandb_entity: str, metric: str = "pass_rate"):
+    def apply_best_weights(self, wandb_project: str, wandb_entity: str, metric: str = "pass_rate", request: gr.Request = None):
+        if request is not None and not is_admin(request):
+            return "🔒 این عملیات فقط برای مدیران فعال است."
         try:
             import wandb, json as _json
         except Exception as e:
@@ -699,6 +765,25 @@ class LegalApp:
         rid = getattr(best_run, "id", "unknown")
         return f"✅ وزن‌ها اعمال شد از Run `{rid}` با {metric}={best_val:.4f}. فایل: `legal_entity_weights.json`"
 
+    # Consultation (عمومی)
+    def answer(self, question: str, system_prompt: str, use_rag: bool, max_new_tokens: int, temperature: float, top_p: float):
+        if not question.strip(): return "لطفاً سوال خود را وارد کنید.", ""
+        if not self.gen: return "ابتدا مدل را بارگذاری کنید.", ""
+        self.scfg.model.max_new_tokens = int(max_new_tokens)
+        self.scfg.model.temperature = float(temperature)
+        self.scfg.model.top_p = float(top_p)
+
+        arts = self.rag.retrieve(question) if (use_rag and self.scfg.rag.enable and self.rag.collection) else []
+        max_refs = 4
+        if arts: arts = arts[:max_refs]
+        ctx = self.rag.build_context(arts) if arts else ""
+        ans = self.gen.generate(question, ctx, system_prompt)
+
+        refs = ""
+        if arts:
+            refs = "\n\n" + "\n".join([f"**ماده {a['article_id']}** (شباهت: {a.get('similarity',0):.2f})\n{a['text'][:320]}..." for a in arts])
+        return ans, refs
+
     # UI
     def build_ui(self):
         log_deps()
@@ -713,15 +798,18 @@ class LegalApp:
             "Mistral-7B Instruct (v0.3)": "mistralai/Mistral-7B-Instruct-v0.3",
         }
 
-        with gr.Blocks(title="ماحون — مشاور حقوقی (Causal-only)") as app:
+        with gr.Blocks(title="ماحون — مشاور حقوقی (Causal-only, ZeroGPU)") as app:
+            # بنر نقش
+            role_banner = gr.Markdown()
+
             gr.Markdown("""
             <div style='text-align:center;padding:18px'>
-              <h1 style='margin-bottom:4px'>ماحون — Persian Legal (Causal-only)</h1>
+              <h1 style='margin-bottom:4px'>ماحون — Persian Legal (Causal-only, ZeroGPU)</h1>
               <p style='color:#666'>Hybrid RAG • Qwen/Llama/Mistral • Dataset Ops • W&B Training • Weight Tuning</p>
             </div>
             """)
 
-            # --- Tab: Consultation ---
+            # --- Tab: Consultation (interactive for all) ---
             with gr.Tab("مشاوره"):
                 with gr.Row():
                     gen_model_dd = gr.Dropdown(choices=list(default_gen_models.keys()), value="Qwen2.5-7B Instruct", label="مدل تولید")
@@ -754,15 +842,16 @@ class LegalApp:
                 ask_btn = gr.Button("پرسش", variant="primary")
                 answer = gr.Markdown(label="پاسخ"); refs = gr.Markdown(label="مواد قانونی مرتبط")
 
-            # --- Tab: Indexing ---
+            # --- Tab: Indexing (view-only for visitors) ---
             with gr.Tab("ایندکس قوانین"):
                 gr.Markdown("فایل JSONL قوانین را بارگذاری و ایندکس کنید (کلیدها: `article_id`, `text`).")
                 laws_file = gr.File(label="فایل JSONL قوانین", file_types=[".jsonl"])
                 id_key = gr.Textbox(value="article_id", label="کلید شناسه ماده")
                 text_key = gr.Textbox(value="text", label="کلید متن ماده")
                 index_btn = gr.Button("ایندکس‌سازی قوانین"); index_status = gr.Textbox(label="وضعیت ایندکس", interactive=False)
+                index_widgets = [laws_file, id_key, text_key, index_btn]
 
-            # --- Tab: Dataset Builder ---
+            # --- Tab: Dataset Builder (view-only for visitors) ---
             with gr.Tab("ساخت دیتاست"):
                 gr.Markdown("فایل خام (JSON/JSONL) → خروجی JSONL سازگار با `{input, output}` (از golden_builder).")
                 raw_file = gr.File(label="فایل خام", file_types=[".json",".jsonl"])
@@ -779,8 +868,9 @@ class LegalApp:
                 build_btn = gr.Button("ساخت دیتاست", variant="primary")
                 out_file = gr.File(label="دانلود خروجی JSONL", interactive=False)
                 build_status = gr.Textbox(label="وضعیت", interactive=False)
+                builder_widgets = [raw_file, ds_text_key, model_ckpt, ds_batch_size, max_samples, build_btn]
 
-            # --- Tab: Dataset Cleaning ---
+            # --- Tab: Dataset Cleaning (view-only for visitors) ---
             with gr.Tab("پاکسازی دیتاست"):
                 gr.Markdown("نرمال‌سازی فارسی + حذف تکراری‌های معنایی (cosine). ورودی: JSONL `{input, output}`.")
                 raw_ds = gr.File(label="JSONL ورودی", file_types=[".jsonl"])
@@ -788,8 +878,9 @@ class LegalApp:
                 clean_btn = gr.Button("اجرای پاکسازی", variant="primary")
                 cleaned_out = gr.File(label="دانلود JSONL پاک", interactive=False)
                 clean_status = gr.Markdown()
+                clean_widgets = [raw_ds, sim_th, clean_btn]
 
-            # --- Tab: Training (W&B integrated) ---
+            # --- Tab: Training (view-only for visitors) ---
             with gr.Tab("آموزش"):
                 gr.Markdown("SFT/LoRA روی مدل‌های causal (فقط `{input, output}`) + W&B logging.")
                 with gr.Row():
@@ -806,7 +897,6 @@ class LegalApp:
                     model_train_id = gr.Textbox(value="AI-Hoosh/HAKIM-7B", label="HF Model ID (قابل ویرایش)")
                 use_rag_train = gr.Checkbox(value=True, label="RAG-enhanced Training")
 
-                # W&B controls
                 use_wandb = gr.Checkbox(value=True, label="W&B logging فعال باشد؟")
                 wandb_project = gr.Textbox(value="mahoon-legal-ai", label="WANDB_PROJECT")
                 wandb_entity = gr.Textbox(value="", label="WANDB_ENTITY (اختیاری)")
@@ -820,8 +910,10 @@ class LegalApp:
                     lr = gr.Number(value=2e-4, label="learning rate")
                 train_btn = gr.Button("شروع آموزش", variant="primary")
                 train_status = gr.Textbox(label="وضعیت آموزش", interactive=False)
+                train_widgets = [model_train_dd, model_train_id, use_rag_train, use_wandb, wandb_project, wandb_entity,
+                                 run_name, train_files, epochs, batch, lr, train_btn]
 
-            # --- Tab: Weight Tuning ---
+            # --- Tab: Weight Tuning (view-only for visitors) ---
             with gr.Tab("Weight Tuning"):
                 gr.Markdown("تیون خودکار وزن‌های موجودیت با W&B Sweep. ابتدا در Settings→Secrets مقدار `WANDB_API_KEY` را ست کنید.")
                 tune_file = gr.File(label="فایل داده (JSON/JSONL)", file_types=[".json",".jsonl"])
@@ -838,8 +930,10 @@ class LegalApp:
                 gr.Markdown("اعمال خودکار بهترین وزن‌ها از داشبورد W&B (بر اساس بالاترین `pass_rate`).")
                 metric_dd = gr.Dropdown(choices=["pass_rate"], value="pass_rate", label="متریک انتخاب بهترین Run")
                 apply_btn = gr.Button("اعمال بهترین وزن‌ها از W&B", variant="secondary")
+                tuning_widgets = [tune_file, tune_text_key, tune_max_samples, tune_runs, tune_batch,
+                                  tune_proj, tune_entity, run_tune, metric_dd, apply_btn]
 
-            # ---- Events ----
+            # ---- Events (مشاوره آزاد / عملیاتِ ادمینی با گیت) ----
             def _resolve_gen(choice: str, override: str) -> str:
                 return override.strip() if override.strip() else default_gen_models[choice]
 
@@ -851,62 +945,79 @@ class LegalApp:
                 self.scfg.rag.similarity_threshold = float(th)
                 return self.load(_resolve_gen(choice, override))
 
+            def _whoami(request: gr.Request):
+                u = _get_username(request) or "Visitor"
+                return f"👤 کاربر: **{u}** — دسترسی: {'مدیریتی' if is_admin(request) else 'بازدیدکننده (فقط مشاهده)'}"
+
             load_btn.click(_on_load,
                            inputs=[gen_model_dd, gen_model_id, use_rag, persist_dir, collection, top_k, threshold],
                            outputs=status)
 
-            ask_btn.click(lambda q, sys_p, rag, mnt, t, p: self.answer(q, sys_p, rag, mnt, t, p),
+            ask_btn.click(self.answer,
                           inputs=[question, system_prompt, use_rag, max_new_tokens, temperature, top_p],
                           outputs=[answer, refs])
 
-            index_btn.click(lambda f, ik, tk: self.build_index(f, ik, tk),
-                            inputs=[laws_file, id_key, text_key], outputs=index_status)
+            # ادمینی: استفاده از request injection (Gradio به‌طور خودکار تزریق می‌کند)
+            def _index_handler(f, ik, tk, request: gr.Request):
+                return self.build_index(f, ik, tk, request)
+            index_btn.click(_index_handler, inputs=[laws_file, id_key, text_key], outputs=index_status)
 
-            build_btn.click(lambda rf, tk, ckpt, bs, mx: self.build_dataset(rf, tk, ckpt, bs, mx),
+            def _build_ds_handler(rf, tk, ckpt, bs, mx, request: gr.Request):
+                return self.build_dataset(rf, tk, ckpt, bs, mx, request)
+            build_btn.click(_build_ds_handler,
                             inputs=[raw_file, ds_text_key, model_ckpt, ds_batch_size, max_samples],
                             outputs=[out_file, build_status])
 
-            def _map_profile_to_id(profile: str, current_id: str) -> str:
-                if current_id.strip(): return current_id.strip()
-                if "Dorna" in profile: return "PartAI/Dorna-Llama3-8B-Instruct"
-                if "PersianQA" in profile: return "zpm/Llama-3.1-PersianQA"
-                if "HAKIM" in profile: return "AI-Hoosh/HAKIM-7B"
-                if "Hooshvareh" in profile: return "HooshvareLab/llama-fa-7b-instruct"
-                return "PartAI/Dorna-Llama3-8B-Instruct"
-
-            train_btn.click(
-                lambda prof, mid, files, rg, e, b, l, uw, wp, we, rn:
-                    self.train(_map_profile_to_id(prof, mid), files, rg, e, b, l, uw, wp, we, rn),
-                inputs=[model_train_dd, model_train_id, train_files, use_rag_train, epochs, batch, lr,
-                        use_wandb, wandb_project, wandb_entity, run_name],
-                outputs=train_status
-            )
-
-            clean_btn.click(
-                lambda f, th: (
-                    (lambda _p, _out:
-                        ( _out,
-                          f"✅ دیتاست پاک شد. تعداد رکوردهای نهایی: **{deduplicate_jsonl(_p, _out, sim_threshold=float(th))}**" )
-                    )(
-                        getattr(f, "name", None) or getattr(f, "path", None),
-                        f"/tmp/cleaned_{int(time.time())}.jsonl"
-                    ) if (getattr(f, 'name', None) or getattr(f, 'path', None)) else (None, "⚠️ فایل نامعتبر.")
-                ),
-                inputs=[raw_ds, sim_th],
-                outputs=[cleaned_out, clean_status]
-            )
-
-            run_tune.click(
-                lambda f, tk, ms, runs, bs, proj, ent: self.run_weight_tune(f, tk, ms, runs, bs, proj, ent),
-                inputs=[tune_file, tune_text_key, tune_max_samples, tune_runs, tune_batch, tune_proj, tune_entity],
-                outputs=tune_status
-            )
+            def _train_handler(prof, mid, files, rg, e, b, l, uw, wp, we, rn, request: gr.Request):
+                def _map_profile_to_id(profile: str, current_id: str) -> str:
+                    if current_id.strip(): return current_id.strip()
+                    if "Dorna" in profile: return "PartAI/Dorna-Llama3-8B-Instruct"
+                    if "PersianQA" in profile: return "zpm/Llama-3.1-PersianQA"
+                    if "HAKIM" in profile: return "AI-Hoosh/HAKIM-7B"
+                    if "Hooshvareh" in profile: return "HooshvareLab/llama-fa-7b-instruct"
+                    return "PartAI/Dorna-Llama3-8B-Instruct"
+                model_id = _map_profile_to_id(prof, mid)
+                return self.train(model_id, files, rg, e, b, l, uw, wp, we, rn, request=request)
+            train_btn.click(_train_handler,
+                            inputs=[model_train_dd, model_train_id, train_files, use_rag_train, epochs, batch, lr,
+                                    use_wandb, wandb_project, wandb_entity, run_name],
+                            outputs=train_status)
+
+            def _clean_handler(f, th):
+                p = getattr(f, "name", None) or getattr(f, "path", None)
+                if not p: return None, "⚠️ فایل نامعتبر."
+                outp = f"/tmp/cleaned_{int(time.time())}.jsonl"
+                n = deduplicate_jsonl(p, outp, sim_threshold=float(th))
+                return outp, f"✅ دیتاست پاک شد. تعداد رکوردهای نهایی: **{n}**"
+            clean_btn.click(_clean_handler, inputs=[raw_ds, sim_th], outputs=[cleaned_out, clean_status])
+
+            def _tune_handler(f, tk, ms, runs, bs, proj, ent, request: gr.Request):
+                return self.run_weight_tune(f, tk, ms, runs, bs, proj, ent, request)
+            run_tune.click(_tune_handler,
+                           inputs=[tune_file, tune_text_key, tune_max_samples, tune_runs, tune_batch, tune_proj, tune_entity],
+                           outputs=tune_status)
+
+            def _apply_best_handler(proj, ent, m, request: gr.Request):
+                return self.apply_best_weights(proj, ent, m, request)
+            apply_btn.click(_apply_best_handler,
+                            inputs=[tune_proj, tune_entity, metric_dd],
+                            outputs=tune_status)
+
+            # --- Lock non-consultation tabs for visitors on load ---
+            def _gate_all(request: gr.Request):
+                admin = is_admin(request)
+                role_txt = f"👤 کاربر: **{_get_username(request) or 'Visitor'}** — دسترسی: {'مدیریتی' if admin else 'بازدیدکننده (فقط مشاهده)'}"
+                if not admin:
+                    lock = gr.update(interactive=False)
+                    updates = [lock] * (len(index_widgets) + len(builder_widgets) + len(clean_widgets) + len(train_widgets) + len(tuning_widgets))
+                else:
+                    unlock = gr.update(interactive=True)
+                    updates = [unlock] * (len(index_widgets) + len(builder_widgets) + len(clean_widgets) + len(train_widgets) + len(tuning_widgets))
+                return [role_txt] + updates
 
-            apply_btn.click(
-                lambda proj, ent, m: self.apply_best_weights(proj, ent, m),
-                inputs=[tune_proj, tune_entity, metric_dd],
-                outputs=tune_status
-            )
+            app.load(_whoami, inputs=None, outputs=role_banner)
+            app.load(_gate_all, inputs=None,
+                     outputs=[role_banner] + index_widgets + builder_widgets + clean_widgets + train_widgets + tuning_widgets)
 
         return app
 
@@ -917,7 +1028,7 @@ if __name__ == "__main__":
     app = LegalApp()
     ui = app.build_ui()
     try:
-        ui = ui.queue()  # بدون پارامتر سفارشی؛ پایدارتر
+        ui = ui.queue()  # پایدار برای ZeroGPU
     except TypeError:
         pass
     ui.launch(server_name="0.0.0.0", server_port=7860, ssr_mode=False)