Add Supabase-backed auth/history and speech-to-text APIs

README.md

@@ -15,6 +15,13 @@ This folder is prepared to be pushed as a standalone Hugging Face Docker Space.
 It exposes a Flask API for:
 - `POST /api/v1/ask`
 - `POST /api/v1/upload`
+- `POST /api/v1/auth/signup`
+- `POST /api/v1/auth/login`
+- `GET /api/v1/auth/profile`
+- `GET /api/v1/history`
+- `POST /api/v1/history`
+- `DELETE /api/v1/history/<entry_id>`
+- `POST /api/v1/speech-to-text`
 - `GET /api/status`
 
 ## Space Secrets
@@ -22,6 +29,9 @@ It exposes a Flask API for:
 Set these in your Hugging Face Space settings:
 
 - `GROQ_API_KEY`: required
+- `SUPABASE_URL`: required for auth/history
+- `SUPABASE_SERVICE_ROLE_KEY`: required for auth/history using `public.user`
+- `APP_AUTH_SECRET`: required for signing backend auth tokens
 
 Optional variables:
 
@@ -30,6 +40,22 @@ Optional variables:
 - `MODEL_DOWNLOAD_URL=https://.../efficientnet_b0.pt`
 - `CLASSES_PATH=/app/models/classes.json`
 - `UPLOAD_FOLDER=/tmp/agrogpt_uploads`
+- `SUPABASE_HISTORY_TABLE=chat_history`
+- `GROQ_TRANSCRIBE_MODEL=whisper-large-v3-turbo`
+- `AUTH_TOKEN_MAX_AGE_SECONDS=604800`
+
+## Supabase Table (History)
+
+Create a table named `chat_history` (or set `SUPABASE_HISTORY_TABLE`) with columns:
+
+- `id uuid primary key default gen_random_uuid()`
+- `user_id integer not null` (references `public.user.id`)
+- `entry_type text not null default 'ask'`
+- `question text`
+- `answer text`
+- `created_at timestamptz default now()`
+
+Auth endpoints in this backend use your existing `public.user` table (`email` + `password_hash`) and return a backend Bearer token.
 
 ## Model Size Strategy
 

app.py

@@ -2,10 +2,13 @@ import os
 import sys
 import platform
 import tempfile
+import requests
 from flask import Flask, request, jsonify
 from flask_cors import CORS
 import threading
 from werkzeug.utils import secure_filename
+from werkzeug.security import generate_password_hash, check_password_hash
+from itsdangerous import URLSafeTimedSerializer, BadSignature, SignatureExpired
 import uuid
 
 # Import the new model functionality and prompts
@@ -19,9 +22,22 @@ CORS(app)
 # Configuration for file uploads
 UPLOAD_FOLDER = os.getenv("UPLOAD_FOLDER", os.path.join(tempfile.gettempdir(), "agrogpt_uploads"))
 ALLOWED_EXTENSIONS = {'png', 'jpg', 'jpeg', 'gif', 'bmp'}
+ALLOWED_AUDIO_EXTENSIONS = {'wav', 'mp3', 'm4a', 'ogg', 'webm', 'flac', 'aac'}
 app.config['UPLOAD_FOLDER'] = UPLOAD_FOLDER
 app.config['MAX_CONTENT_LENGTH'] = 16 * 1024 * 1024  # 16MB max file size
 
+# Supabase and speech configuration
+SUPABASE_URL = os.getenv("SUPABASE_URL", "").rstrip("/")
+SUPABASE_ANON_KEY = os.getenv("SUPABASE_ANON_KEY", "")
+SUPABASE_SERVICE_ROLE_KEY = os.getenv("SUPABASE_SERVICE_ROLE_KEY", "")
+SUPABASE_HISTORY_TABLE = os.getenv("SUPABASE_HISTORY_TABLE", "chat_history")
+GROQ_API_KEY = os.getenv("GROQ_API_KEY", "")
+GROQ_TRANSCRIBE_MODEL = os.getenv("GROQ_TRANSCRIBE_MODEL", "whisper-large-v3-turbo")
+APP_AUTH_SECRET = os.getenv("APP_AUTH_SECRET", GROQ_API_KEY or "agrogpt-dev-secret")
+AUTH_TOKEN_MAX_AGE_SECONDS = int(os.getenv("AUTH_TOKEN_MAX_AGE_SECONDS", "604800"))
+
+token_serializer = URLSafeTimedSerializer(APP_AUTH_SECRET)
+
 # Create uploads directory if it doesn't exist
 os.makedirs(UPLOAD_FOLDER, exist_ok=True)
 
@@ -32,6 +48,145 @@ status_message = "Initializing..."
 def allowed_file(filename):
     return '.' in filename and filename.rsplit('.', 1)[1].lower() in ALLOWED_EXTENSIONS
 
+def allowed_audio_file(filename):
+    return '.' in filename and filename.rsplit('.', 1)[1].lower() in ALLOWED_AUDIO_EXTENSIONS
+
+def supabase_enabled() -> bool:
+    return bool(SUPABASE_URL and (SUPABASE_ANON_KEY or SUPABASE_SERVICE_ROLE_KEY))
+
+def supabase_api_key() -> str:
+    return SUPABASE_SERVICE_ROLE_KEY or SUPABASE_ANON_KEY
+
+def supabase_headers() -> dict:
+    api_key = supabase_api_key()
+    headers = {
+        "apikey": api_key,
+        "Authorization": f"Bearer {api_key}",
+        "Content-Type": "application/json"
+    }
+    return headers
+
+def extract_bearer_token() -> str | None:
+    auth_header = request.headers.get("Authorization", "")
+    if auth_header.lower().startswith("bearer "):
+        return auth_header.split(" ", 1)[1].strip() or None
+    return None
+
+def create_auth_token(user_row: dict) -> str:
+    return token_serializer.dumps({
+        "user_id": user_row["id"],
+        "email": user_row.get("email", "")
+    })
+
+def decode_auth_token(token: str):
+    try:
+        payload = token_serializer.loads(token, max_age=AUTH_TOKEN_MAX_AGE_SECONDS)
+        return payload, None
+    except SignatureExpired:
+        return None, "Session expired"
+    except BadSignature:
+        return None, "Invalid token"
+
+def sanitize_user(user_row: dict) -> dict:
+    return {
+        "id": user_row.get("id"),
+        "email": user_row.get("email"),
+        "full_name": user_row.get("full_name"),
+        "profession": user_row.get("profession")
+    }
+
+def find_user_by_email(email: str):
+    if not supabase_enabled():
+        return None, "Supabase is not configured"
+
+    try:
+        res = requests.get(
+            f"{SUPABASE_URL}/rest/v1/user",
+            headers=supabase_headers(),
+            params={
+                "select": "id,email,full_name,profession,password_hash",
+                "email": f"eq.{email}",
+                "limit": "1"
+            },
+            timeout=15
+        )
+        if res.status_code >= 400:
+            return None, f"Failed to query user ({res.status_code})"
+
+        rows = res.json() if res.content else []
+        if not rows:
+            return None, None
+
+        return rows[0], None
+    except Exception as e:
+        return None, f"Failed to query user: {str(e)}"
+
+def find_user_by_id(user_id: int):
+    if not supabase_enabled():
+        return None, "Supabase is not configured"
+
+    try:
+        res = requests.get(
+            f"{SUPABASE_URL}/rest/v1/user",
+            headers=supabase_headers(),
+            params={
+                "select": "id,email,full_name,profession,password_hash",
+                "id": f"eq.{user_id}",
+                "limit": "1"
+            },
+            timeout=15
+        )
+        if res.status_code >= 400:
+            return None, f"Failed to load profile ({res.status_code})"
+
+        rows = res.json() if res.content else []
+        if not rows:
+            return None, "User not found"
+        return rows[0], None
+    except Exception as e:
+        return None, f"Failed to load profile: {str(e)}"
+
+def get_authenticated_user(optional: bool = False):
+    user_token = extract_bearer_token()
+    if not user_token:
+        if optional:
+            return None, None
+        return None, "Missing Bearer token"
+
+    claims, token_error = decode_auth_token(user_token)
+    if token_error:
+        return None, token_error
+
+    user_row, user_error = find_user_by_id(claims.get("user_id"))
+    if user_error:
+        return None, user_error
+
+    return user_row, None
+
+def save_history_entry(user_id: int, question: str, answer_text: str):
+    if not supabase_enabled() or not user_id:
+        return
+
+    payload = {
+        "user_id": user_id,
+        "entry_type": "ask",
+        "question": question,
+        "answer": answer_text
+    }
+
+    try:
+        requests.post(
+            f"{SUPABASE_URL}/rest/v1/{SUPABASE_HISTORY_TABLE}",
+            headers={
+                **supabase_headers(),
+                "Prefer": "return=minimal"
+            },
+            json=payload,
+            timeout=15
+        )
+    except Exception as e:
+        print(f"Warning: Failed to store history entry: {e}", flush=True)
+
 def print_header() -> None:
     print("AgroGPT Mobile Backend starting...", flush=True)
     print(f"Python: {platform.python_version()} ({sys.executable})", flush=True)
@@ -135,7 +290,12 @@ def index():
         "endpoints": {
             "health": "/api/status",
             "ask_question": "/api/v1/ask",
-            "analyze_image": "/api/v1/upload"
+            "analyze_image": "/api/v1/upload",
+            "signup": "/api/v1/auth/signup",
+            "login": "/api/v1/auth/login",
+            "profile": "/api/v1/auth/profile",
+            "history": "/api/v1/history",
+            "speech_to_text": "/api/v1/speech-to-text"
         }
     })
 
@@ -182,6 +342,12 @@ def ask_question_v1():
         
         if "error" in response_json:
             return api_error("Error from AI model", details=response_json["error"], status_code=500)
+
+        # Optional history persistence when a valid auth token is provided.
+        user_data, _ = get_authenticated_user(optional=True)
+        if user_data and user_data.get("id"):
+                answer_text = format_to_rich_text(response_json)
+                save_history_entry(user_data["id"], question, answer_text)
             
         return api_success(response_json)
         
@@ -229,6 +395,278 @@ def upload_image_v1():
     
     return api_error("Invalid file type")
 
+@app.route('/api/v1/auth/signup', methods=['POST'])
+def auth_signup_v1():
+    if not supabase_enabled():
+        return api_error("Supabase is not configured", status_code=500)
+
+    data = request.get_json() or {}
+    email = (data.get("email") or "").strip().lower()
+    password = data.get("password") or ""
+    full_name = (data.get("full_name") or "").strip()
+    profession = (data.get("profession") or "").strip()
+
+    if not email or not password:
+        return api_error("Email and password are required")
+
+    existing_user, query_error = find_user_by_email(email)
+    if query_error:
+        return api_error("Signup failed", details=query_error, status_code=500)
+    if existing_user:
+        return api_error("Signup failed", details="Email already exists", status_code=409)
+
+    payload = [{
+        "email": email,
+        "full_name": full_name,
+        "profession": profession,
+        "password_hash": generate_password_hash(password)
+    }]
+
+    try:
+        res = requests.post(
+            f"{SUPABASE_URL}/rest/v1/user",
+            headers=supabase_headers(),
+            params={
+                "select": "id,email,full_name,profession"
+            },
+            json=payload,
+            timeout=20
+        )
+        body = res.json() if res.content else []
+        if res.status_code >= 400:
+            return api_error("Signup failed", details=body, status_code=res.status_code)
+        if not body:
+            return api_error("Signup failed", details="User creation returned empty response", status_code=500)
+
+        user_row = body[0]
+        token = create_auth_token(user_row)
+        return jsonify({
+            "status": "success",
+            "message": "Signup successful",
+            "data": {
+                "token": token,
+                "user": sanitize_user(user_row)
+            }
+        })
+    except Exception as e:
+        return api_error("Signup request failed", details=str(e), status_code=500)
+
+@app.route('/api/v1/auth/login', methods=['POST'])
+def auth_login_v1():
+    if not supabase_enabled():
+        return api_error("Supabase is not configured", status_code=500)
+
+    data = request.get_json() or {}
+    email = (data.get("email") or "").strip().lower()
+    password = data.get("password") or ""
+
+    if not email or not password:
+        return api_error("Email and password are required")
+
+    user_row, query_error = find_user_by_email(email)
+    if query_error:
+        return api_error("Login failed", details=query_error, status_code=500)
+    if not user_row:
+        return api_error("Login failed", details="Invalid email or password", status_code=401)
+
+    if not check_password_hash(user_row.get("password_hash") or "", password):
+        return api_error("Login failed", details="Invalid email or password", status_code=401)
+
+    token = create_auth_token(user_row)
+    return jsonify({
+        "status": "success",
+        "message": "Login successful",
+        "data": {
+            "token": token,
+            "user": sanitize_user(user_row)
+        }
+    })
+
+@app.route('/api/v1/auth/profile', methods=['GET'])
+def auth_profile_v1():
+    if not supabase_enabled():
+        return api_error("Supabase is not configured", status_code=500)
+
+    user_data, err = get_authenticated_user()
+    if err:
+        return api_error("Unauthorized", details=err, status_code=401)
+
+    return jsonify({
+        "status": "success",
+        "data": {
+            "user": sanitize_user(user_data)
+        }
+    })
+
+@app.route('/api/v1/history', methods=['GET'])
+def history_list_v1():
+    if not supabase_enabled():
+        return api_error("Supabase is not configured", status_code=500)
+
+    user_data, err = get_authenticated_user()
+    if err:
+        return api_error("Unauthorized", details=err, status_code=401)
+
+    limit = request.args.get("limit", "30")
+    try:
+        limit_int = max(1, min(int(limit), 100))
+    except ValueError:
+        limit_int = 30
+
+    try:
+        res = requests.get(
+            f"{SUPABASE_URL}/rest/v1/{SUPABASE_HISTORY_TABLE}",
+            headers=supabase_headers(),
+            params={
+                "select": "id,entry_type,question,answer,created_at",
+                "user_id": f"eq.{user_data['id']}",
+                "order": "created_at.desc",
+                "limit": str(limit_int)
+            },
+            timeout=20
+        )
+        body = res.json() if res.content else []
+        if res.status_code >= 400:
+            return api_error("Failed to fetch history", details=body, status_code=res.status_code)
+
+        return jsonify({
+            "status": "success",
+            "data": {
+                "items": body
+            }
+        })
+    except Exception as e:
+        return api_error("History query failed", details=str(e), status_code=500)
+
+@app.route('/api/v1/history', methods=['POST'])
+def history_create_v1():
+    if not supabase_enabled():
+        return api_error("Supabase is not configured", status_code=500)
+
+    user_data, err = get_authenticated_user()
+    if err:
+        return api_error("Unauthorized", details=err, status_code=401)
+
+    data = request.get_json() or {}
+    question = (data.get("question") or "").strip()
+    answer = (data.get("answer") or "").strip()
+    entry_type = (data.get("entry_type") or "ask").strip()[:30]
+
+    if not question and not answer:
+        return api_error("Either question or answer is required")
+
+    payload = {
+        "user_id": user_data["id"],
+        "entry_type": entry_type,
+        "question": question,
+        "answer": answer
+    }
+
+    try:
+        res = requests.post(
+            f"{SUPABASE_URL}/rest/v1/{SUPABASE_HISTORY_TABLE}",
+            headers={
+                **supabase_headers(),
+                "Prefer": "return=representation"
+            },
+            json=payload,
+            timeout=20
+        )
+        body = res.json() if res.content else []
+        if res.status_code >= 400:
+            return api_error("Failed to save history", details=body, status_code=res.status_code)
+
+        return jsonify({
+            "status": "success",
+            "data": {
+                "item": body[0] if body else payload
+            }
+        })
+    except Exception as e:
+        return api_error("History save failed", details=str(e), status_code=500)
+
+@app.route('/api/v1/history/<entry_id>', methods=['DELETE'])
+def history_delete_v1(entry_id):
+    if not supabase_enabled():
+        return api_error("Supabase is not configured", status_code=500)
+
+    user_data, err = get_authenticated_user()
+    if err:
+        return api_error("Unauthorized", details=err, status_code=401)
+
+    try:
+        res = requests.delete(
+            f"{SUPABASE_URL}/rest/v1/{SUPABASE_HISTORY_TABLE}",
+            headers=supabase_headers(),
+            params={
+                "id": f"eq.{entry_id}",
+                "user_id": f"eq.{user_data['id']}"
+            },
+            timeout=20
+        )
+        if res.status_code >= 400:
+            body = res.json() if res.content else {}
+            return api_error("Failed to delete history", details=body, status_code=res.status_code)
+
+        return jsonify({
+            "status": "success",
+            "message": "History item deleted"
+        })
+    except Exception as e:
+        return api_error("History delete failed", details=str(e), status_code=500)
+
+@app.route('/api/v1/speech-to-text', methods=['POST'])
+def speech_to_text_v1():
+    if not GROQ_API_KEY:
+        return api_error("Speech service unavailable", details="GROQ_API_KEY is not configured", status_code=503)
+
+    if 'audio' not in request.files:
+        return api_error("No audio file provided")
+
+    audio_file = request.files['audio']
+    if not audio_file or audio_file.filename == '':
+        return api_error("No audio file selected")
+
+    if not allowed_audio_file(audio_file.filename):
+        return api_error("Invalid audio file type")
+
+    language = (request.form.get("language") or "en").strip()[:10]
+    filename = secure_filename(audio_file.filename)
+
+    try:
+        files = {
+            "file": (filename, audio_file.stream, audio_file.mimetype or "application/octet-stream")
+        }
+        data = {
+            "model": GROQ_TRANSCRIBE_MODEL,
+            "language": language,
+            "response_format": "json"
+        }
+        headers = {
+            "Authorization": f"Bearer {GROQ_API_KEY}"
+        }
+
+        res = requests.post(
+            "https://api.groq.com/openai/v1/audio/transcriptions",
+            headers=headers,
+            files=files,
+            data=data,
+            timeout=45
+        )
+
+        body = res.json() if res.content else {}
+        if res.status_code >= 400:
+            return api_error("Speech transcription failed", details=body, status_code=res.status_code)
+
+        return jsonify({
+            "status": "success",
+            "data": {
+                "text": body.get("text", "")
+            }
+        })
+    except Exception as e:
+        return api_error("Speech transcription request failed", details=str(e), status_code=500)
+
 def main():
     print_header()
     check_backend_status()