Update main.py

main.py

@@ -891,7 +891,7 @@ def submit_quiz_attempt(quiz_id):
 
 
 # Modified speak_notes endpoint with ElevenLabs Studio API and chunking
-@app.route('/api/tutor/notes/<uuid:notes_id>/speak', methods=['POST'])  # Changed to POST since it creates resources
+@app.route('/api/tutor/notes/<uuid:notes_id>/speak', methods=['POST'])
 def speak_notes(notes_id):
     user, error = verify_token(request.headers.get('Authorization'))
     if error:
@@ -901,81 +901,103 @@ def speak_notes(notes_id):
         return jsonify({'error': 'Backend service unavailable'}), 503
 
     try:
+        # Verify note ownership first
+        note_res = supabase.table('notes') \
+            .select('user_id, content, tts_audio_url') \
+            .eq('id', notes_id) \
+            .eq('user_id', user.id) \  # Critical RLS check
+            .maybe_single() \
+            .execute()
+
+        if not note_res.data:
+            return jsonify({'error': 'Note not found or unauthorized'}), 404
+
         # Check user status and credits
-        profile_res = supabase.table('profiles').select('credits', 'suspended').eq('id', user.id).single().execute()
+        profile_res = supabase.table('profiles') \
+            .select('credits, suspended') \
+            .eq('id', user.id) \
+            .single().execute()
+            
         if profile_res.data['suspended']:
             return jsonify({'error': 'Account suspended'}), 403
         if profile_res.data['credits'] < 5:
             return jsonify({'error': 'Insufficient credits (Need 5)'}), 402
 
-        # Fetch notes content
-        notes_res = supabase.table('notes').select('content, tts_audio_url').eq('id', notes_id).single().execute()
-        if not notes_res.data:
-            return jsonify({'error': 'Notes not found'}), 404
-            
         # Return existing audio if available
-        if notes_res.data.get('tts_audio_url'):
+        if note_res.data.get('tts_audio_url'):
             return jsonify({
                 'success': True,
-                'audio_url': notes_res.data['tts_audio_url'],
+                'audio_url': note_res.data['tts_audio_url'],
                 'message': 'Using existing audio file'
             })
 
-        notes_content = notes_res.data['content']
+        notes_content = note_res.data['content']
         if not notes_content:
             return jsonify({'error': 'Notes content is empty'}), 400
 
         # --- Generate TTS Audio with chunking ---
-        start_time = time.time()
-        logging.info(f"Generating TTS for user {user.id}, notes: {notes_id}")
-        
-        # Chunk text if too long (ElevenLabs limit is ~2500 chars for best quality)
-        CHUNK_SIZE = 2000  # Conservative chunk size
+        CHUNK_SIZE = 2000
         chunks = [notes_content[i:i+CHUNK_SIZE] for i in range(0, len(notes_content), CHUNK_SIZE)]
         
         audio_bytes = b""
         for chunk in chunks:
             try:
-                # Using ElevenLabs Studio API with streaming
                 chunk_audio = elevenlabs_client.generate(
                     text=chunk,
-                    voice="Rachel",  # Default voice
+                    voice="Rachel",
                     model="eleven_multilingual_v2",
                     stream=True
                 )
                 audio_bytes += b"".join(chunk_audio)
             except Exception as e:
                 logging.error(f"Error generating chunk: {str(e)}")
-                raise RuntimeError(f"Failed to generate audio chunk: {str(e)}")
+                raise RuntimeError(f"Audio generation failed: {str(e)}")
 
         if not audio_bytes:
             raise RuntimeError("Generated empty audio file")
 
-        logging.info(f"TTS generation took {time.time() - start_time:.2f}s")
-
-        # --- Save to Supabase Storage ---
+        # --- Save to Supabase Storage with RLS compliance ---
         bucket_name = 'notes-audio'
-        destination_path = f'users/{user.id}/{notes_id}.mp3'
+        file_path = f'{user.id}/{notes_id}.mp3'
         
-        with tempfile.NamedTemporaryFile(delete=False, suffix=".mp3") as tmp_file:
-            tmp_file.write(audio_bytes)
-            tmp_path = tmp_file.name
-
         try:
-            # Upload with proper content type
-            audio_url = upload_to_supabase_storage(
-                bucket_name,
-                tmp_path,
-                destination_path,
-                "audio/mpeg"
+            # Upload with owner metadata for RLS
+            upload_res = supabase.storage.from_(bucket_name).upload(
+                path=file_path,
+                file=audio_bytes,
+                file_options={
+                    'content-type': 'audio/mpeg',
+                    'cache-control': '3600',
+                    'upsert': 'true',
+                    'owner': user.id  # Essential for RLS policies
+                }
             )
-
-            # Update database
-            supabase.table('notes').update({'tts_audio_url': audio_url}).eq('id', notes_id).execute()
             
-            # Deduct credits
+            if upload_res.error:
+                raise ConnectionError(upload_res.error.message)
+
+            # Get public URL
+            audio_url = supabase.storage.from_(bucket_name).get_public_url(file_path)
+
+            # Update notes table with verification
+            update_res = supabase.table('notes') \
+                .update({'tts_audio_url': audio_url}) \
+                .eq('id', notes_id) \
+                .eq('user_id', user.id) \  # Double-check ownership
+                .execute()
+                
+            if update_res.error:
+                raise ConnectionError(update_res.error.message)
+
+            # Deduct credits with verification
             new_credits = profile_res.data['credits'] - 5
-            supabase.table('profiles').update({'credits': new_credits}).eq('id', user.id).execute()
+            credit_res = supabase.table('profiles') \
+                .update({'credits': new_credits}) \
+                .eq('id', user.id) \
+                .execute()
+                
+            if credit_res.error:
+                raise ConnectionError(credit_res.error.message)
 
             return jsonify({
                 'success': True,
@@ -983,11 +1005,13 @@ def speak_notes(notes_id):
                 'remaining_credits': new_credits
             })
 
-        finally:
-            os.remove(tmp_path)
+        except Exception as upload_error:
+            # Clean up failed upload
+            supabase.storage.from_(bucket_name).remove([file_path])
+            raise upload_error
 
     except Exception as e:
-        logging.error(f"Error in speak_notes: {traceback.format_exc()}")
+        logging.error(f"Speak error: {traceback.format_exc()}")
         return jsonify({'error': str(e)}), 500
 
 # New endpoint to view existing audio URL