Upload 23 files

app/core/auth.py

@@ -0,0 +1,37 @@
+from typing import Literal
+
+from fastapi import Header, HTTPException
+from pydantic import BaseModel
+
+
+class AuthUser(BaseModel):
+    username: str
+    role: Literal["admin", "sensitive_admin"]
+
+
+def issue_token(user: AuthUser) -> str:
+    return f"dev-token::{user.username}::{user.role}"
+
+
+def parse_token(token: str) -> AuthUser | None:
+    parts = token.split("::")
+    if len(parts) != 3 or parts[0] != "dev-token":
+        return None
+
+    username = parts[1]
+    role = parts[2]
+    if role not in {"admin", "sensitive_admin"}:
+        return None
+
+    return AuthUser(username=username, role=role)
+
+
+def get_current_web_user(authorization: str | None = Header(default=None)) -> AuthUser:
+    if not authorization or not authorization.lower().startswith("bearer "):
+        raise HTTPException(status_code=401, detail="Missing bearer token")
+
+    token = authorization[7:]
+    user = parse_token(token)
+    if user is None:
+        raise HTTPException(status_code=401, detail="Invalid token")
+    return user

app/core/config.py

@@ -0,0 +1,21 @@
+import os
+from pydantic import BaseModel
+from pydantic_settings import BaseSettings
+
+
+class Settings(BaseSettings):
+    app_name: str = "G-Solution Backend"
+    api_prefix: str = "/api/v1"
+    mongo_uri: str = "mongodb://localhost:27017"
+    mongo_db: str = "g_solution"
+    storage_dir: str = "storage/screenshots"
+    media_prefix: str = "/media"
+    hf_token: str = ""
+
+    class Config:
+        env_file = ".env"
+        env_file_encoding = "utf-8"
+        case_sensitive = False
+
+
+settings = Settings()

app/core/db.py

@@ -0,0 +1,32 @@
+from motor.motor_asyncio import AsyncIOMotorClient, AsyncIOMotorDatabase
+
+from app.core.config import settings
+
+_client: AsyncIOMotorClient | None = None
+
+
+def get_db() -> AsyncIOMotorDatabase:
+    global _client
+    if _client is None:
+        _client = AsyncIOMotorClient(settings.mongo_uri)
+    return _client[settings.mongo_db]
+
+
+async def ensure_indexes() -> None:
+    db = get_db()
+    await db.devices.create_index("device_id", unique=True)
+    await db.policies.create_index("device_id", unique=True)
+    await db.key_states.create_index("device_id", unique=True)
+    await db.key_states.create_index("expires_at")
+    await db.key_states.create_index("lock_until")
+    await db.violations.create_index("device_id")
+    await db.violations.create_index("timestamp")
+    await db.violations.create_index("expires_at")
+    await db.screenshot_audit.create_index("created_at")
+    await db.alert_audit.create_index("created_at")
+    await db.alert_audit.create_index("type")
+    await db.url_verdicts.create_index("url", unique=True)
+    await db.url_verdicts.create_index("verdict")
+    await db.game_lock_reviews.create_index("review_id", unique=True)
+    await db.game_lock_reviews.create_index("status")
+    await db.game_lock_reviews.create_index("created_at")

app/main.py

@@ -0,0 +1,36 @@
+from fastapi import FastAPI
+from fastapi.middleware.cors import CORSMiddleware
+from fastapi.staticfiles import StaticFiles
+
+from app.core.config import settings
+from app.core.db import ensure_indexes
+from app.routers import alerts, auth, devices, keys, policy, reviews, screenshots
+
+app = FastAPI(title=settings.app_name)
+
+app.add_middleware(
+    CORSMiddleware,
+    allow_origins=["*"],
+    allow_credentials=True,
+    allow_methods=["*"],
+    allow_headers=["*"],
+)
+
+app.include_router(auth.router, prefix=settings.api_prefix)
+app.include_router(devices.router, prefix=settings.api_prefix)
+app.include_router(policy.router, prefix=settings.api_prefix)
+app.include_router(screenshots.router, prefix=settings.api_prefix)
+app.include_router(keys.router, prefix=settings.api_prefix)
+app.include_router(alerts.router, prefix=settings.api_prefix)
+app.include_router(reviews.router, prefix=settings.api_prefix)
+app.mount(settings.media_prefix, StaticFiles(directory=settings.storage_dir), name="media")
+
+
+@app.on_event("startup")
+async def on_startup() -> None:
+    await ensure_indexes()
+
+
+@app.get("/health")
+def health() -> dict[str, str]:
+    return {"status": "ok"}

app/models/schemas.py

@@ -0,0 +1,142 @@
+from datetime import datetime, timedelta, timezone
+from typing import Literal
+
+from pydantic import BaseModel, Field
+
+
+class LoginRequest(BaseModel):
+    username: str
+    password: str
+
+
+class LoginResponse(BaseModel):
+    token: str
+    role: Literal["admin", "sensitive_admin"] = "admin"
+    expires_in_seconds: int = 3600
+
+
+class RegisterDeviceRequest(BaseModel):
+    device_id: str
+    hostname: str
+    os_version: str
+    agent_version: str
+
+
+class RegisterDeviceResponse(BaseModel):
+    registered: bool = True
+    session_token: str
+
+
+class HeartbeatRequest(BaseModel):
+    device_id: str
+    active_restriction_window: bool
+    uptime_seconds: int = 0
+
+
+class HeartbeatResponse(BaseModel):
+    accepted: bool = True
+    server_time: datetime = Field(default_factory=lambda: datetime.now(timezone.utc))
+
+
+class DeviceStatusRow(BaseModel):
+    device_id: str
+    hostname: str
+    agent_version: str
+    os_version: str
+    last_heartbeat_at: datetime | None = None
+    active_restriction_window: bool = False
+
+
+class TimeWindow(BaseModel):
+    day_of_week: Literal["mon", "tue", "wed", "thu", "fri", "sat", "sun"]
+    start: str = Field(description="HH:MM")
+    end: str = Field(description="HH:MM")
+
+
+class DevicePolicy(BaseModel):
+    blocked_executables: list[str] = []
+    blocked_domains: list[str] = []
+    restriction_windows: list[TimeWindow] = []
+
+
+class UpdatePolicyRequest(BaseModel):
+    device_id: str
+    policy: DevicePolicy
+
+
+class ScreenshotIngestResponse(BaseModel):
+    screenshot_id: str
+    queued: bool = True
+
+
+class ViolationScreenshot(BaseModel):
+    screenshot_id: str
+    device_id: str
+    timestamp: str
+    filename: str
+    created_at: str
+    image_url: str
+    confidence: float
+    reason: str
+    visibility_scope: Literal["admin", "sensitive_admin"] = "admin"
+    ocr_urls: list[str] = []
+
+
+class GameReviewItem(BaseModel):
+    review_id: str
+    screenshot_id: str
+    device_id: str
+    timestamp: str
+    status: Literal["pending", "approved", "rejected"]
+    reason: str
+    ocr_urls: list[str] = []
+    created_at: datetime
+
+
+class GameReviewDecisionRequest(BaseModel):
+    review_id: str
+    approve_lock: bool
+
+
+class GameReviewDecisionResponse(BaseModel):
+    updated: bool
+
+
+class KeyGenerateRequest(BaseModel):
+    device_id: str
+
+
+class KeyGenerateResponse(BaseModel):
+    device_id: str
+    key: str
+    expires_at: datetime
+
+
+class KeyValidateRequest(BaseModel):
+    device_id: str
+    key: str
+
+
+class KeyValidateResponse(BaseModel):
+    valid: bool
+    lock_until: datetime | None = None
+
+
+class AlertEvent(BaseModel):
+    device_id: str
+    type: Literal[
+        "wrong_key",
+        "policy_violation",
+        "process_killed",
+        "info",
+        "device_status",
+        "sensitive_detected",
+        "game_lock_review_required",
+        "game_lock_review_decision",
+    ]
+    message: str
+    created_at: datetime = Field(default_factory=lambda: datetime.now(timezone.utc))
+
+
+def lock_until_5_minutes() -> datetime:
+    return datetime.now(timezone.utc) + timedelta(minutes=5)

app/routers/__init__.py

@@ -0,0 +1,3 @@
+from app.routers import alerts, auth, devices, keys, policy, reviews, screenshots
+
+__all__ = ["auth", "devices", "policy", "screenshots", "keys", "alerts", "reviews"]

app/routers/alerts.py

@@ -0,0 +1,33 @@
+from fastapi import APIRouter, WebSocket, WebSocketDisconnect
+
+from app.services.alert_hub import alert_hub
+
+router = APIRouter(prefix="/alerts", tags=["alerts"])
+
+
+@router.websocket("/ws/admin")
+async def ws_admin(websocket: WebSocket) -> None:
+    await alert_hub.connect_admin(websocket)
+    try:
+        while True:
+            message = await websocket.receive_text()
+            if message == "ping":
+                await websocket.send_text("pong")
+    except WebSocketDisconnect:
+        alert_hub.disconnect_admin(websocket)
+    except Exception:
+        alert_hub.disconnect_admin(websocket)
+
+
+@router.websocket("/ws/device/{device_id}")
+async def ws_device(websocket: WebSocket, device_id: str) -> None:
+    await alert_hub.connect_device(device_id, websocket)
+    try:
+        while True:
+            message = await websocket.receive_text()
+            if message == "ping":
+                await websocket.send_text("pong")
+    except WebSocketDisconnect:
+        alert_hub.disconnect_device(device_id, websocket)
+    except Exception:
+        alert_hub.disconnect_device(device_id, websocket)

app/routers/auth.py

@@ -0,0 +1,19 @@
+from fastapi import APIRouter, HTTPException
+
+from app.core.auth import AuthUser, issue_token
+from app.models.schemas import LoginRequest, LoginResponse
+
+router = APIRouter(prefix="/auth", tags=["auth"])
+
+
+@router.post("/login", response_model=LoginResponse)
+def login(payload: LoginRequest) -> LoginResponse:
+    if payload.username == "admin" and payload.password == "admin123":
+        user = AuthUser(username="admin", role="admin")
+        return LoginResponse(token=issue_token(user), role=user.role)
+
+    if payload.username == "admin_sensitive" and payload.password == "safe123":
+        user = AuthUser(username="admin_sensitive", role="sensitive_admin")
+        return LoginResponse(token=issue_token(user), role=user.role)
+
+    raise HTTPException(status_code=401, detail="Invalid credentials")

app/routers/devices.py

@@ -0,0 +1,74 @@
+from datetime import datetime, timedelta, timezone
+
+from fastapi import APIRouter
+
+from app.models.schemas import (
+    DeviceStatusRow,
+    HeartbeatRequest,
+    HeartbeatResponse,
+    RegisterDeviceRequest,
+    RegisterDeviceResponse,
+)
+from app.services.alert_hub import alert_hub
+from app.services.repos import device_repo
+
+router = APIRouter(prefix="/devices", tags=["devices"])
+
+
+@router.post("/register", response_model=RegisterDeviceResponse)
+async def register_device(payload: RegisterDeviceRequest) -> RegisterDeviceResponse:
+    await device_repo.upsert(
+        {
+            **payload.model_dump(),
+            "active_restriction_window": False,
+            "last_heartbeat_at": None,
+            "uptime_seconds": 0,
+        }
+    )
+    return RegisterDeviceResponse(session_token=f"session-{payload.device_id}")
+
+
+@router.post("/heartbeat", response_model=HeartbeatResponse)
+async def heartbeat(payload: HeartbeatRequest) -> HeartbeatResponse:
+    now = datetime.now(timezone.utc)
+    await device_repo.heartbeat(
+        payload.device_id,
+        payload.active_restriction_window,
+        payload.uptime_seconds,
+    )
+    await alert_hub.broadcast_admin(
+        {
+            "type": "device_status",
+            "device_id": payload.device_id,
+            "message": "Device heartbeat received",
+            "active_restriction_window": payload.active_restriction_window,
+            "uptime_seconds": payload.uptime_seconds,
+            "last_heartbeat_at": now.isoformat(),
+            "is_online": True,
+        }
+    )
+    return HeartbeatResponse()
+
+
+@router.get("")
+async def list_devices() -> list[dict[str, str | bool]]:
+    now = datetime.now(timezone.utc)
+    online_threshold = now - timedelta(seconds=90)
+    rows = await device_repo.list()
+    return [
+        DeviceStatusRow(
+            device_id=row.get("device_id", ""),
+            hostname=row.get("hostname", ""),
+            agent_version=row.get("agent_version", ""),
+            os_version=row.get("os_version", ""),
+            last_heartbeat_at=row.get("last_heartbeat_at"),
+            active_restriction_window=bool(row.get("active_restriction_window", False)),
+        ).model_dump()
+        | {
+            "is_online": bool(
+                isinstance(row.get("last_heartbeat_at"), datetime)
+                and row.get("last_heartbeat_at") >= online_threshold
+            )
+        }
+        for row in rows
+    ]

app/routers/keys.py

@@ -0,0 +1,33 @@
+from fastapi import APIRouter
+from datetime import datetime, timezone
+
+from app.models.schemas import KeyGenerateRequest, KeyGenerateResponse, KeyValidateRequest, KeyValidateResponse
+from app.services.alert_hub import alert_hub
+from app.services.key_service import key_service
+from app.core.db import get_db
+
+router = APIRouter(prefix="/keys", tags=["keys"])
+
+
+@router.post("/generate", response_model=KeyGenerateResponse)
+async def generate_key(payload: KeyGenerateRequest) -> KeyGenerateResponse:
+    key, expires_at = await key_service.generate(payload.device_id)
+    return KeyGenerateResponse(device_id=payload.device_id, key=key, expires_at=expires_at)
+
+
+@router.post("/validate", response_model=KeyValidateResponse)
+async def validate_key(payload: KeyValidateRequest) -> KeyValidateResponse:
+    valid, lock_until, attempts = await key_service.validate(payload.device_id, payload.key)
+    if not valid:
+        event = {
+            "type": "wrong_key",
+            "device_id": payload.device_id,
+            "attempts": attempts,
+            "message": "Wrong key attempt detected. Local UI locked for 5 minutes.",
+            "created_at": datetime.now(timezone.utc),
+        }
+        await get_db().alert_audit.insert_one(event)
+        await alert_hub.broadcast_admin(
+            event
+        )
+    return KeyValidateResponse(valid=valid, lock_until=lock_until)

app/routers/policy.py

@@ -0,0 +1,20 @@
+from fastapi import APIRouter
+
+from app.models.schemas import DevicePolicy, UpdatePolicyRequest
+from app.services.repos import policy_repo
+
+router = APIRouter(prefix="/policy", tags=["policy"])
+
+
+@router.post("/update")
+async def update_policy(payload: UpdatePolicyRequest) -> dict[str, str]:
+    await policy_repo.set(payload.device_id, payload.policy.model_dump())
+    return {"status": "updated"}
+
+
+@router.get("/{device_id}", response_model=DevicePolicy)
+async def get_policy(device_id: str) -> DevicePolicy:
+    doc = await policy_repo.get(device_id)
+    if doc is None:
+        return DevicePolicy()
+    return DevicePolicy(**doc.get("policy", {}))

app/routers/reviews.py

@@ -0,0 +1,52 @@
+from fastapi import APIRouter, Depends, HTTPException
+
+from app.core.auth import AuthUser, get_current_web_user
+from app.models.schemas import GameReviewDecisionRequest, GameReviewDecisionResponse, GameReviewItem
+from app.services.alert_hub import alert_hub
+from app.services.repos import review_repo
+
+router = APIRouter(prefix="/reviews", tags=["reviews"])
+
+
+def _require_admin(user: AuthUser) -> None:
+    if user.role != "admin":
+        raise HTTPException(status_code=403, detail="Only admin account can review game lock requests")
+
+
+@router.get("/pending", response_model=list[GameReviewItem])
+async def list_pending_reviews(user: AuthUser = Depends(get_current_web_user)) -> list[GameReviewItem]:
+    _require_admin(user)
+    rows = await review_repo.list_pending()
+    return [
+        GameReviewItem(
+            review_id=str(row.get("review_id", "")),
+            screenshot_id=str(row.get("screenshot_id", "")),
+            device_id=str(row.get("device_id", "")),
+            timestamp=str(row.get("timestamp", "")),
+            status=str(row.get("status", "pending")),
+            reason=str(row.get("reason", "")),
+            ocr_urls=[str(x) for x in row.get("ocr_urls", [])],
+            created_at=row.get("created_at"),
+        )
+        for row in rows
+    ]
+
+
+@router.post("/decision", response_model=GameReviewDecisionResponse)
+async def decide_review(
+    payload: GameReviewDecisionRequest,
+    user: AuthUser = Depends(get_current_web_user),
+) -> GameReviewDecisionResponse:
+    _require_admin(user)
+    updated = await review_repo.decide(payload.review_id, payload.approve_lock, user.username)
+    if updated:
+        await alert_hub.broadcast_admin(
+            {
+                "type": "game_lock_review_decision",
+                "device_id": "n/a",
+                "message": "Admin submitted lock decision",
+                "review_id": payload.review_id,
+                "approve_lock": payload.approve_lock,
+            }
+        )
+    return GameReviewDecisionResponse(updated=updated)

app/routers/screenshots.py

@@ -0,0 +1,226 @@
+import asyncio
+import uuid
+from datetime import datetime, timedelta, timezone
+
+from fastapi import APIRouter, Depends, File, Form, UploadFile
+
+from app.core.auth import AuthUser, get_current_web_user
+from app.core.config import settings
+from app.models.schemas import ScreenshotIngestResponse, ViolationScreenshot
+from app.services.alert_hub import alert_hub
+from app.services.classifier import (
+    classify_game_with_ocr_llm,
+    classify_sensitive_content,
+)
+from app.services.policy_window import is_restriction_active
+from app.services.repos import (
+    audit_repo,
+    policy_repo,
+    review_repo,
+    url_verdict_repo,
+    violation_repo,
+)
+from app.services.storage import storage_service
+
+router = APIRouter(prefix="/screenshots", tags=["screenshots"])
+
+
+async def _cleanup_expired_violations() -> None:
+    expired = await violation_repo.list_expired()
+    for row in expired:
+        absolute_path = row.get("absolute_path")
+        if isinstance(absolute_path, str):
+            storage_service.delete(absolute_path)
+    await violation_repo.delete_expired()
+
+
+@router.post("/ingest", response_model=ScreenshotIngestResponse)
+async def ingest_screenshot(
+    device_id: str = Form(...),
+    timestamp: str = Form(...),
+    suspected_game: bool = Form(False),
+    file: UploadFile = File(...),
+) -> ScreenshotIngestResponse:
+    screenshot_id = str(uuid.uuid4())
+    _, absolute_path, stored_name = await storage_service.save_upload(file)
+
+    try:
+        moment = datetime.fromisoformat(timestamp.replace("Z", "+00:00"))
+    except ValueError:
+        moment = datetime.now(timezone.utc)
+    policy_doc = await policy_repo.get(device_id)
+    policy_payload = policy_doc.get("policy", {}) if policy_doc else {}
+    windows = policy_payload.get("restriction_windows", [])
+    if not is_restriction_active(windows, moment):
+        storage_service.delete(absolute_path)
+        await audit_repo.log(
+            {
+                "screenshot_id": screenshot_id,
+                "device_id": device_id,
+                "timestamp": timestamp,
+                "filename": file.filename or "unknown.png",
+                "action": "deleted_outside_window",
+                "reason": "outside_restriction_window",
+                "created_at": datetime.now(timezone.utc),
+            }
+        )
+        return ScreenshotIngestResponse(screenshot_id=screenshot_id)
+
+    game_task = asyncio.to_thread(
+        classify_game_with_ocr_llm,
+        absolute_path,
+        file.filename or "capture.png",
+        suspected_game,
+    )
+    sensitive_task = asyncio.to_thread(
+        classify_sensitive_content,
+        absolute_path,
+        file.filename or "capture.png",
+    )
+    game_raw, sensitive_raw = await asyncio.gather(game_task, sensitive_task, return_exceptions=True)
+
+    if isinstance(game_raw, Exception):
+        game_result = {
+            "verdict": "not_game",
+            "confidence": 0.1,
+            "reason": "game-check-error",
+            "urls": [],
+            "source": "error-fallback",
+        }
+    else:
+        game_result = game_raw
+
+    if isinstance(sensitive_raw, Exception):
+        sensitive_detected, sensitive_confidence, sensitive_reason = (False, 0.0, "sensitive-check-error")
+    else:
+        sensitive_detected, sensitive_confidence, sensitive_reason = sensitive_raw
+
+    ocr_urls = [str(x) for x in game_result.get("urls", [])]
+
+    cached_game_url = await url_verdict_repo.get_cached_game_url(ocr_urls)
+    if cached_game_url:
+        game_result = {
+            **game_result,
+            "verdict": "game",
+            "confidence": 0.99,
+            "reason": f"cached-game-url:{cached_game_url}",
+            "source": "url-cache",
+        }
+
+    verdict = str(game_result.get("verdict", "not_game"))
+    confidence = float(game_result.get("confidence", 0.1))
+    reason = str(game_result.get("reason", "no-game-evidence"))
+
+    if sensitive_detected:
+        image_url = f"{settings.media_prefix}/{stored_name}"
+        await violation_repo.insert(
+            {
+                "screenshot_id": screenshot_id,
+                "device_id": device_id,
+                "timestamp": timestamp,
+                "filename": file.filename or "unknown.png",
+                "created_at": datetime.now(timezone.utc).isoformat(),
+                "image_url": image_url,
+                "confidence": sensitive_confidence,
+                "reason": sensitive_reason,
+                "absolute_path": absolute_path,
+                "visibility_scope": "sensitive_admin",
+                "ocr_urls": ocr_urls,
+                "expires_at": datetime.now(timezone.utc) + timedelta(hours=24),
+            }
+        )
+        await alert_hub.broadcast_admin(
+            {
+                "type": "sensitive_detected",
+                "device_id": device_id,
+                "message": "Sensitive content detected. Routed to sensitive admin scope.",
+                "visibility_scope": "sensitive_admin",
+            }
+        )
+        await _cleanup_expired_violations()
+        return ScreenshotIngestResponse(screenshot_id=screenshot_id)
+
+    if verdict == "game":
+        await url_verdict_repo.upsert_game_urls(ocr_urls, source=str(game_result.get("source", "llm")))
+
+    if verdict == "not_game":
+        storage_service.delete(absolute_path)
+        await audit_repo.log(
+            {
+                "screenshot_id": screenshot_id,
+                "device_id": device_id,
+                "timestamp": timestamp,
+                "filename": file.filename or "unknown.png",
+                "action": "deleted_non_violation",
+                "reason": reason,
+                "created_at": datetime.now(timezone.utc),
+            }
+        )
+        return ScreenshotIngestResponse(screenshot_id=screenshot_id)
+
+    image_url = f"{settings.media_prefix}/{stored_name}"
+    await violation_repo.insert(
+        {
+            "screenshot_id": screenshot_id,
+            "device_id": device_id,
+            "timestamp": timestamp,
+            "filename": file.filename or "unknown.png",
+            "created_at": datetime.now(timezone.utc).isoformat(),
+            "image_url": image_url,
+            "confidence": confidence,
+            "reason": reason,
+            "absolute_path": absolute_path,
+            "visibility_scope": "admin",
+            "ocr_urls": ocr_urls,
+            "expires_at": datetime.now(timezone.utc) + timedelta(hours=24),
+        }
+    )
+
+    if verdict == "uncertain":
+        review_id = str(uuid.uuid4())
+        await review_repo.create_pending(
+            {
+                "review_id": review_id,
+                "screenshot_id": screenshot_id,
+                "device_id": device_id,
+                "timestamp": timestamp,
+                "status": "pending",
+                "reason": reason,
+                "ocr_urls": ocr_urls,
+                "created_at": datetime.now(timezone.utc),
+            }
+        )
+        await alert_hub.broadcast_admin(
+            {
+                "type": "game_lock_review_required",
+                "device_id": device_id,
+                "message": "Model uncertain. Admin confirmation is required before lock.",
+                "review_id": review_id,
+                "screenshot_id": screenshot_id,
+                "ocr_urls": ocr_urls,
+            }
+        )
+
+    await _cleanup_expired_violations()
+    return ScreenshotIngestResponse(screenshot_id=screenshot_id)
+
+
+@router.get("/violations", response_model=list[ViolationScreenshot])
+async def list_violations(user: AuthUser = Depends(get_current_web_user)) -> list[ViolationScreenshot]:
+    await _cleanup_expired_violations()
+    rows = await violation_repo.list_active(user.role)
+    return [
+        ViolationScreenshot(
+            screenshot_id=row.get("screenshot_id", ""),
+            device_id=row.get("device_id", ""),
+            timestamp=row.get("timestamp", ""),
+            filename=row.get("filename", ""),
+            created_at=row.get("created_at", ""),
+            image_url=row.get("image_url", ""),
+            confidence=float(row.get("confidence", 0.0)),
+            reason=row.get("reason", ""),
+            visibility_scope=row.get("visibility_scope", "admin"),
+            ocr_urls=[str(x) for x in row.get("ocr_urls", [])],
+        )
+        for row in rows
+    ]

app/services/alert_hub.py

@@ -0,0 +1,48 @@
+from collections import defaultdict
+from typing import Any
+
+from fastapi import WebSocket
+
+
+class AlertHub:
+    def __init__(self) -> None:
+        self.admin_clients: set[WebSocket] = set()
+        self.device_clients: dict[str, set[WebSocket]] = defaultdict(set)
+
+    async def connect_admin(self, websocket: WebSocket) -> None:
+        await websocket.accept()
+        self.admin_clients.add(websocket)
+
+    async def connect_device(self, device_id: str, websocket: WebSocket) -> None:
+        await websocket.accept()
+        self.device_clients[device_id].add(websocket)
+
+    def disconnect_admin(self, websocket: WebSocket) -> None:
+        self.admin_clients.discard(websocket)
+
+    def disconnect_device(self, device_id: str, websocket: WebSocket) -> None:
+        if device_id in self.device_clients:
+            self.device_clients[device_id].discard(websocket)
+
+    async def broadcast_admin(self, payload: dict[str, Any]) -> None:
+        stale: list[WebSocket] = []
+        for client in self.admin_clients:
+            try:
+                await client.send_json(payload)
+            except Exception:
+                stale.append(client)
+        for client in stale:
+            self.disconnect_admin(client)
+
+    async def send_device(self, device_id: str, payload: dict[str, Any]) -> None:
+        stale: list[WebSocket] = []
+        for client in self.device_clients.get(device_id, set()):
+            try:
+                await client.send_json(payload)
+            except Exception:
+                stale.append(client)
+        for client in stale:
+            self.disconnect_device(device_id, client)
+
+
+alert_hub = AlertHub()

app/services/classifier.py

@@ -0,0 +1,361 @@
+from __future__ import annotations
+
+import json
+import os
+import re
+from pathlib import Path
+from typing import Any
+from urllib.parse import urlparse
+
+from app.core.config import settings
+
+MODELS_DIR = Path(__file__).resolve().parents[2] / "models"
+NSFW_CONFIG_PATH = MODELS_DIR / "config.json"
+NSFW_WEIGHTS_PATH = MODELS_DIR / "model.safetensors"
+NSFW_THRESHOLD = 0.75
+
+LLM_MODELS = [
+    os.getenv("GAME_LLM_MODEL", "Qwen/Qwen2.5-7B-Instruct"),
+    "microsoft/Phi-3.5-mini-instruct",
+]
+LLM_MAX_CHARS = 3000
+
+_nsfw_runtime: dict[str, Any] | None = None
+_nsfw_error: str | None = None
+_ocr_reader: Any | None = None
+_ocr_error: str | None = None
+
+GAME_KEYWORDS = {
+    "valorant",
+    "steam",
+    "roblox",
+    "league",
+    "dota",
+    "cs2",
+    "minecraft",
+    "epicgames",
+    "riot",
+    "crazygames",
+    "y8",
+    "miniclip",
+}
+
+SENSITIVE_KEYWORDS = {
+    "porn",
+    "sex",
+    "xxx",
+    "nsfw",
+    "adult",
+    "nude",
+    "erotic",
+}
+
+URL_REGEX = re.compile(r"(?:https?://)?(?:www\.)?[a-zA-Z0-9.-]+\.[a-zA-Z]{2,}(?:/[^\s]*)?")
+
+GAME_PROMPT = """
+You are a strict classifier for parental-control screenshots.
+Input fields:
+- suspected_game_signal: boolean
+- extracted_urls: list of urls/domains from OCR
+- ocr_text: raw OCR text from screenshot
+Task:
+- Decide if screenshot likely indicates gaming/web-game activity.
+- Return only compact JSON with this schema:
+{
+  "verdict": "game" | "not_game" | "uncertain",
+  "confidence": 0.0-1.0,
+  "reason": "short reason"
+}
+Rules:
+- If clear game domain or game UI terms appear, lean game.
+- If evidence is weak or contradictory, return uncertain.
+- Never output markdown, prose, or extra keys.
+""".strip()
+
+
+def classify_screenshot(file_path: str, filename: str, suspected_game: bool) -> tuple[bool, float, str]:
+    game_result = classify_game_with_ocr_llm(file_path, filename, suspected_game)
+    verdict = game_result["verdict"]
+    confidence = float(game_result["confidence"])
+    reason = str(game_result["reason"])
+    if verdict == "game":
+        return True, confidence, reason
+    if verdict == "uncertain":
+        return True, max(confidence, 0.51), "uncertain-review"
+    return False, confidence, reason
+
+
+def classify_game_with_ocr_llm(file_path: str, filename: str, suspected_game: bool) -> dict[str, Any]:
+    ocr_text, urls = extract_ocr_text_and_urls(file_path)
+    llm = _classify_game_with_llm(ocr_text, urls, suspected_game)
+    if llm is not None:
+        return {
+            "verdict": llm["verdict"],
+            "confidence": llm["confidence"],
+            "reason": llm["reason"],
+            "ocr_text": ocr_text,
+            "urls": urls,
+            "source": llm.get("source", "llm"),
+        }
+
+    # Fallback heuristic path when model call is unavailable.
+    text_lower = ocr_text.lower()
+    keyword_hit = any(word in text_lower for word in GAME_KEYWORDS)
+    domain_hit = any(_domain_from_url(url) in GAME_KEYWORDS for url in urls)
+    if domain_hit or (suspected_game and keyword_hit):
+        return {
+            "verdict": "game",
+            "confidence": 0.78,
+            "reason": "ocr-keyword-heuristic",
+            "ocr_text": ocr_text,
+            "urls": urls,
+            "source": "heuristic",
+        }
+
+    if suspected_game:
+        return {
+            "verdict": "uncertain",
+            "confidence": 0.55,
+            "reason": "signal-without-clear-ocr",
+            "ocr_text": ocr_text,
+            "urls": urls,
+            "source": "heuristic",
+        }
+
+    return {
+        "verdict": "not_game",
+        "confidence": 0.2,
+        "reason": "no-game-evidence",
+        "ocr_text": ocr_text,
+        "urls": urls,
+        "source": "heuristic",
+    }
+
+
+def extract_ocr_text_and_urls(file_path: str) -> tuple[str, list[str]]:
+    reader = _load_ocr_reader()
+    if reader is None:
+        return "", []
+
+    try:
+        results = reader.readtext(file_path, detail=0, paragraph=True)
+        ocr_text = "\n".join(str(x) for x in results).strip()
+    except Exception:
+        return "", []
+
+    raw_urls = URL_REGEX.findall(ocr_text)
+    normalized = []
+    for value in raw_urls:
+        item = value.strip().rstrip(".,)")
+        if not item:
+            continue
+        if not item.startswith("http://") and not item.startswith("https://"):
+            item = f"https://{item}"
+        normalized.append(item.lower())
+
+    # Keep order stable while deduplicating.
+    urls: list[str] = []
+    seen: set[str] = set()
+    for item in normalized:
+        if item in seen:
+            continue
+        seen.add(item)
+        urls.append(item)
+
+    return ocr_text[:LLM_MAX_CHARS], urls
+
+
+def _load_ocr_reader() -> Any | None:
+    global _ocr_reader
+    global _ocr_error
+
+    if _ocr_reader is not None:
+        return _ocr_reader
+    if _ocr_error is not None:
+        return None
+
+    try:
+        import easyocr
+
+        _ocr_reader = easyocr.Reader(["en"], gpu=False)
+        return _ocr_reader
+    except Exception as exc:
+        _ocr_error = str(exc)
+        return None
+
+
+def _classify_game_with_llm(ocr_text: str, urls: list[str], suspected_game: bool) -> dict[str, Any] | None:
+    if not ocr_text and not urls:
+        return None
+
+    user_payload = {
+        "suspected_game_signal": suspected_game,
+        "extracted_urls": urls,
+        "ocr_text": ocr_text,
+    }
+
+    try:
+        from huggingface_hub import InferenceClient
+    except Exception:
+        return None
+
+    token = settings.hf_token
+    prompt_messages = [
+        {"role": "system", "content": GAME_PROMPT},
+        {"role": "user", "content": json.dumps(user_payload, ensure_ascii=True)},
+    ]
+
+    for model_name in LLM_MODELS:
+        try:
+            client = InferenceClient(model=model_name, token=token or None)
+            response = client.chat_completion(
+                messages=prompt_messages,
+                max_tokens=160,
+                temperature=0.1,
+                top_p=0.9,
+            )
+            content = ""
+            if response.choices:
+                content = response.choices[0].message.content or ""
+            parsed = _parse_llm_json(content)
+            if parsed is None:
+                continue
+            parsed["source"] = f"llm:{model_name}"
+            return parsed
+        except Exception:
+            continue
+
+    return None
+
+
+def _parse_llm_json(content: str) -> dict[str, Any] | None:
+    if not content:
+        return None
+
+    text = content.strip()
+    try:
+        data = json.loads(text)
+    except json.JSONDecodeError:
+        match = re.search(r"\{.*\}", text, re.DOTALL)
+        if not match:
+            return None
+        try:
+            data = json.loads(match.group(0))
+        except json.JSONDecodeError:
+            return None
+
+    verdict = str(data.get("verdict", "")).lower()
+    if verdict not in {"game", "not_game", "uncertain"}:
+        return None
+
+    confidence_raw = data.get("confidence", 0.5)
+    try:
+        confidence = float(confidence_raw)
+    except (TypeError, ValueError):
+        confidence = 0.5
+
+    confidence = max(0.0, min(1.0, confidence))
+    reason = str(data.get("reason", "llm-decision"))[:200]
+
+    return {"verdict": verdict, "confidence": confidence, "reason": reason}
+
+
+def _domain_from_url(url: str) -> str:
+    parsed = urlparse(url)
+    host = parsed.netloc or parsed.path
+    host = host.lower().replace("www.", "")
+    parts = host.split(".")
+    if not parts:
+        return host
+    return parts[0]
+
+
+def classify_sensitive_content(file_path: str, filename: str) -> tuple[bool, float, str]:
+    # First pass with image model inference; fallback to keyword signal only if unavailable.
+    model_result = _classify_sensitive_with_model(file_path)
+    if model_result is not None:
+        return model_result
+
+    name_text = f"{Path(file_path).name} {filename}".lower()
+    keyword_hit = any(word in name_text for word in SENSITIVE_KEYWORDS)
+    if keyword_hit:
+        return True, 0.65, "sensitive-keyword-fallback"
+    return False, 0.05, "no-sensitive-signal"
+
+
+def _load_nsfw_runtime() -> dict[str, Any] | None:
+    global _nsfw_runtime
+    global _nsfw_error
+
+    if _nsfw_runtime is not None:
+        return _nsfw_runtime
+    if _nsfw_error is not None:
+        return None
+
+    try:
+        import timm
+        import torch
+        from PIL import Image
+        from safetensors.torch import load_file
+
+        if not NSFW_CONFIG_PATH.exists() or not NSFW_WEIGHTS_PATH.exists():
+            _nsfw_error = "missing-local-model-files"
+            return None
+
+        config_data = json.loads(NSFW_CONFIG_PATH.read_text(encoding="utf-8"))
+        architecture = str(config_data.get("architecture", "vit_tiny_patch16_384"))
+        num_classes = int(config_data.get("num_classes", 2))
+        label_names = [str(x).lower() for x in config_data.get("label_names", ["nsfw", "sfw"])]
+        pretrained_cfg = config_data.get("pretrained_cfg", {})
+
+        model = timm.create_model(architecture, pretrained=False, num_classes=num_classes).eval()
+        state_dict = load_file(str(NSFW_WEIGHTS_PATH), device="cpu")
+        model.load_state_dict(state_dict, strict=False)
+
+        # Use local config for preprocessing so inference does not depend on remote metadata.
+        model.pretrained_cfg = {**getattr(model, "pretrained_cfg", {}), **pretrained_cfg, "label_names": label_names}
+
+        data_config = timm.data.resolve_model_data_config(model)
+        transforms = timm.data.create_transform(**data_config, is_training=False)
+
+        _nsfw_runtime = {
+            "torch": torch,
+            "Image": Image,
+            "model": model,
+            "transforms": transforms,
+            "label_names": [str(x).lower() for x in label_names],
+        }
+        return _nsfw_runtime
+    except Exception as exc:
+        _nsfw_error = str(exc)
+        return None
+
+
+def _classify_sensitive_with_model(file_path: str) -> tuple[bool, float, str] | None:
+    runtime = _load_nsfw_runtime()
+    if runtime is None:
+        return None
+
+    torch = runtime["torch"]
+    Image = runtime["Image"]
+    model = runtime["model"]
+    transforms = runtime["transforms"]
+    label_names = runtime["label_names"]
+
+    with Image.open(file_path) as img:
+        img = img.convert("RGB")
+        with torch.no_grad():
+            output = model(transforms(img).unsqueeze(0)).softmax(dim=-1).cpu()[0]
+
+    scores = [float(x) for x in output.tolist()]
+    nsfw_score = _extract_nsfw_score(scores, label_names)
+    return (nsfw_score >= NSFW_THRESHOLD, nsfw_score, "timm-marqo-nsfw")
+
+
+def _extract_nsfw_score(scores: list[float], labels: list[str]) -> float:
+    for idx, label in enumerate(labels):
+        if "nsfw" in label:
+            return scores[idx]
+    if len(scores) >= 2:
+        return scores[1]
+    return scores[0] if scores else 0.0

app/services/key_service.py

@@ -0,0 +1,92 @@
+import secrets
+from hashlib import sha256
+from datetime import datetime, timedelta, timezone
+
+from app.services.repos import key_state_repo
+
+
+def _hash_key(raw: str) -> str:
+    return sha256(raw.encode("utf-8")).hexdigest()
+
+
+class KeyService:
+    def __init__(self, *, ttl_seconds: int = 60, lock_minutes: int = 5) -> None:
+        self.ttl_seconds = ttl_seconds
+        self.lock_minutes = lock_minutes
+
+    async def generate(self, device_id: str) -> tuple[str, datetime]:
+        key = secrets.token_urlsafe(8)
+        expires_at = datetime.now(timezone.utc) + timedelta(seconds=self.ttl_seconds)
+        await key_state_repo.upsert(
+            device_id,
+            {
+                "key_hash": _hash_key(key),
+                "expires_at": expires_at,
+                "wrong_attempts": 0,
+                "lock_until": None,
+            },
+        )
+        return key, expires_at
+
+    async def validate(self, device_id: str, candidate: str) -> tuple[bool, datetime | None, int]:
+        state = await key_state_repo.get(device_id)
+        now = datetime.now(timezone.utc)
+
+        if state is None:
+            lock_until = now + timedelta(minutes=self.lock_minutes)
+            await key_state_repo.upsert(
+                device_id,
+                {
+                    "wrong_attempts": 1,
+                    "lock_until": lock_until,
+                    "expires_at": now,
+                    "key_hash": "",
+                },
+            )
+            return False, lock_until, 1
+
+        lock_until_value = state.get("lock_until")
+        if isinstance(lock_until_value, datetime) and now < lock_until_value:
+            return False, lock_until_value, int(state.get("wrong_attempts", 0))
+
+        expires_at = state.get("expires_at")
+        if not isinstance(expires_at, datetime) or now > expires_at:
+            lock_until = now + timedelta(minutes=self.lock_minutes)
+            attempts = int(state.get("wrong_attempts", 0)) + 1
+            await key_state_repo.upsert(
+                device_id,
+                {
+                    "wrong_attempts": attempts,
+                    "lock_until": lock_until,
+                    "expires_at": now,
+                },
+            )
+            return False, lock_until, attempts
+
+        candidate_hash = _hash_key(candidate)
+        expected_hash = str(state.get("key_hash", ""))
+        if not secrets.compare_digest(candidate_hash, expected_hash):
+            attempts = int(state.get("wrong_attempts", 0)) + 1
+            lock_until = now + timedelta(minutes=self.lock_minutes)
+            await key_state_repo.upsert(
+                device_id,
+                {
+                    "wrong_attempts": attempts,
+                    "lock_until": lock_until,
+                },
+            )
+            return False, lock_until, attempts
+
+        await key_state_repo.upsert(
+            device_id,
+            {
+                "wrong_attempts": 0,
+                "lock_until": None,
+                "expires_at": now,
+                "key_hash": "",
+            },
+        )
+        return True, None, 0
+
+
+key_service = KeyService()

app/services/policy_window.py

@@ -0,0 +1,55 @@
+from datetime import datetime
+from typing import Any
+
+_DAY_INDEX = {
+    "mon": 0,
+    "tue": 1,
+    "wed": 2,
+    "thu": 3,
+    "fri": 4,
+    "sat": 5,
+    "sun": 6,
+}
+
+
+def _parse_hhmm(value: str) -> tuple[int, int]:
+    hour_text, minute_text = value.split(":", 1)
+    return int(hour_text), int(minute_text)
+
+
+def _minutes_of_day(moment: datetime) -> int:
+    return moment.hour * 60 + moment.minute
+
+
+def is_restriction_active(windows: list[dict[str, Any]], moment: datetime) -> bool:
+    if not windows:
+        return False
+
+    weekday = moment.weekday()
+    now_minutes = _minutes_of_day(moment)
+
+    for window in windows:
+        day = window.get("day_of_week")
+        start = str(window.get("start", "00:00"))
+        end = str(window.get("end", "00:00"))
+        if day not in _DAY_INDEX:
+            continue
+
+        start_h, start_m = _parse_hhmm(start)
+        end_h, end_m = _parse_hhmm(end)
+        start_minutes = start_h * 60 + start_m
+        end_minutes = end_h * 60 + end_m
+        window_day = _DAY_INDEX[day]
+
+        if start_minutes <= end_minutes:
+            if weekday == window_day and start_minutes <= now_minutes <= end_minutes:
+                return True
+            continue
+
+        # Overnight window: e.g. 22:00 -> 02:00
+        if weekday == window_day and now_minutes >= start_minutes:
+            return True
+        if weekday == (window_day + 1) % 7 and now_minutes <= end_minutes:
+            return True
+
+    return False

app/services/repos.py

@@ -0,0 +1,190 @@
+from datetime import datetime, timezone
+from typing import Any
+
+from app.core.db import get_db
+
+
+def _clean(doc: dict[str, Any] | None) -> dict[str, Any] | None:
+    if doc is None:
+        return None
+    doc.pop("_id", None)
+    return doc
+
+
+class DeviceRepo:
+    async def upsert(self, data: dict[str, Any]) -> None:
+        db = get_db()
+        await db.devices.update_one(
+            {"device_id": data["device_id"]},
+            {"$set": {**data, "updated_at": datetime.now(timezone.utc)}},
+            upsert=True,
+        )
+
+    async def list(self) -> list[dict[str, Any]]:
+        db = get_db()
+        rows = await db.devices.find({}, {"_id": 0}).to_list(length=200)
+        return rows
+
+    async def heartbeat(self, device_id: str, active_restriction_window: bool, uptime_seconds: int) -> None:
+        db = get_db()
+        now = datetime.now(timezone.utc)
+        await db.devices.update_one(
+            {"device_id": device_id},
+            {
+                "$set": {
+                    "device_id": device_id,
+                    "active_restriction_window": active_restriction_window,
+                    "uptime_seconds": uptime_seconds,
+                    "last_heartbeat_at": now,
+                    "updated_at": now,
+                }
+            },
+            upsert=True,
+        )
+
+
+class PolicyRepo:
+    async def set(self, device_id: str, policy: dict[str, Any]) -> None:
+        db = get_db()
+        await db.policies.update_one(
+            {"device_id": device_id},
+            {
+                "$set": {
+                    "device_id": device_id,
+                    "policy": policy,
+                    "updated_at": datetime.now(timezone.utc),
+                }
+            },
+            upsert=True,
+        )
+
+    async def get(self, device_id: str) -> dict[str, Any] | None:
+        db = get_db()
+        doc = await db.policies.find_one({"device_id": device_id}, {"_id": 0})
+        return _clean(doc)
+
+
+class ViolationRepo:
+    async def insert(self, doc: dict[str, Any]) -> None:
+        db = get_db()
+        await db.violations.insert_one(doc)
+
+    async def list_active(self, visibility_scope: str) -> list[dict[str, Any]]:
+        db = get_db()
+        now = datetime.now(timezone.utc)
+        query = {"expires_at": {"$gt": now}, "visibility_scope": visibility_scope}
+        rows = (
+            await db.violations.find(query, {"_id": 0})
+            .sort("timestamp", -1)
+            .to_list(length=500)
+        )
+        return rows
+
+    async def list_expired(self) -> list[dict[str, Any]]:
+        db = get_db()
+        now = datetime.now(timezone.utc)
+        return await db.violations.find({"expires_at": {"$lte": now}}).to_list(length=500)
+
+    async def delete_expired(self) -> int:
+        db = get_db()
+        now = datetime.now(timezone.utc)
+        result = await db.violations.delete_many({"expires_at": {"$lte": now}})
+        return result.deleted_count
+
+
+class AuditRepo:
+    async def log(self, doc: dict[str, Any]) -> None:
+        db = get_db()
+        await db.screenshot_audit.insert_one(doc)
+
+
+class KeyStateRepo:
+    async def get(self, device_id: str) -> dict[str, Any] | None:
+        db = get_db()
+        doc = await db.key_states.find_one({"device_id": device_id})
+        return _clean(doc)
+
+    async def upsert(self, device_id: str, patch: dict[str, Any]) -> None:
+        db = get_db()
+        await db.key_states.update_one(
+            {"device_id": device_id},
+            {
+                "$set": {
+                    **patch,
+                    "device_id": device_id,
+                    "updated_at": datetime.now(timezone.utc),
+                }
+            },
+            upsert=True,
+        )
+
+
+class UrlVerdictRepo:
+    async def get_cached_game_url(self, urls: list[str]) -> str | None:
+        if not urls:
+            return None
+        db = get_db()
+        doc = await db.url_verdicts.find_one(
+            {"url": {"$in": urls}, "verdict": "game"},
+            {"_id": 0, "url": 1},
+        )
+        if not doc:
+            return None
+        return str(doc.get("url", ""))
+
+    async def upsert_game_urls(self, urls: list[str], source: str) -> None:
+        if not urls:
+            return
+        db = get_db()
+        now = datetime.now(timezone.utc)
+        for url in urls:
+            await db.url_verdicts.update_one(
+                {"url": url},
+                {
+                    "$set": {
+                        "url": url,
+                        "verdict": "game",
+                        "source": source,
+                        "updated_at": now,
+                    }
+                },
+                upsert=True,
+            )
+
+
+class ReviewRepo:
+    async def create_pending(self, doc: dict[str, Any]) -> None:
+        db = get_db()
+        await db.game_lock_reviews.insert_one(doc)
+
+    async def list_pending(self, limit: int = 200) -> list[dict[str, Any]]:
+        db = get_db()
+        rows = (
+            await db.game_lock_reviews.find({"status": "pending"}, {"_id": 0})
+            .sort("created_at", -1)
+            .to_list(length=limit)
+        )
+        return rows
+
+    async def decide(self, review_id: str, approve_lock: bool, decided_by: str) -> bool:
+        db = get_db()
+        result = await db.game_lock_reviews.update_one(
+            {"review_id": review_id, "status": "pending"},
+            {
+                "$set": {
+                    "status": "approved" if approve_lock else "rejected",
+                    "decided_by": decided_by,
+                    "decided_at": datetime.now(timezone.utc),
+                }
+            },
+        )
+        return result.modified_count > 0
+
+
+device_repo = DeviceRepo()
+policy_repo = PolicyRepo()
+violation_repo = ViolationRepo()
+audit_repo = AuditRepo()
+key_state_repo = KeyStateRepo()
+url_verdict_repo = UrlVerdictRepo()
+review_repo = ReviewRepo()

app/services/storage.py

@@ -0,0 +1,30 @@
+from pathlib import Path
+from uuid import uuid4
+
+from fastapi import UploadFile
+
+from app.core.config import settings
+
+
+class StorageService:
+    def __init__(self, base_dir: str) -> None:
+        self.base_dir = Path(base_dir)
+        self.base_dir.mkdir(parents=True, exist_ok=True)
+
+    async def save_upload(self, file: UploadFile) -> tuple[str, str, str]:
+        extension = Path(file.filename or "capture.png").suffix or ".png"
+        image_id = str(uuid4())
+        stored_name = f"{image_id}{extension}"
+        target_path = self.base_dir / stored_name
+
+        content = await file.read()
+        target_path.write_bytes(content)
+        return image_id, str(target_path), stored_name
+
+    def delete(self, absolute_path: str) -> None:
+        target = Path(absolute_path)
+        if target.exists():
+            target.unlink()
+
+
+storage_service = StorageService(settings.storage_dir)

models/config.json

@@ -0,0 +1,37 @@
+{
+  "architecture": "vit_tiny_patch16_384",
+  "num_classes": 2,
+  "num_features": 192,
+  "global_pool": "token",
+  "label_names": [
+    "NSFW",
+    "SFW"
+  ],
+  "pretrained_cfg": {
+    "tag": "augreg_in21k_ft_in1k",
+    "custom_load": true,
+    "input_size": [
+      3,
+      384,
+      384
+    ],
+    "fixed_input_size": true,
+    "interpolation": "bicubic",
+    "crop_pct": 1.0,
+    "crop_mode": "center",
+    "mean": [
+      0.5,
+      0.5,
+      0.5
+    ],
+    "std": [
+      0.5,
+      0.5,
+      0.5
+    ],
+    "num_classes": 1000,
+    "pool_size": null,
+    "first_conv": "patch_embed.proj",
+    "classifier": "head"
+  }
+}

models/model.safetensors

@@ -0,0 +1,3 @@
+version https://git-lfs.github.com/spec/v1
+oid sha256:6bf2e0f64a1d20169736c2836e3a787b12379fdc08ba87f7d94a7a3d58eeefce
+size 22404720

requirements.txt

@@ -0,0 +1,14 @@
+fastapi==0.115.0
+uvicorn[standard]==0.30.6
+pydantic==2.9.2
+pydantic-settings==2.1.0
+python-multipart==0.0.12
+motor==3.6.0
+pymongo==4.9.1
+python-dotenv==1.0.1
+Pillow==10.4.0
+timm==1.0.9
+torch==2.4.1
+safetensors==0.4.5
+easyocr==1.7.1
+huggingface_hub==0.24.7