}
+ if (created && created.data) return created;
+ return { data: created };
+ } catch (error) {
+ console.error("Backend unavailable, falling back to mock:", error);
+ await delay(800);
+ return createTicketMock(ticketData);
}
},
diff --git a/Frontend/src/store/authStore.js b/Frontend/src/store/authStore.js
index 4e6014f48f280c34f58ece3c44427653016ac702..6300b695f4f11e96f48926cacb0f54c2da15f9b8 100644
--- a/Frontend/src/store/authStore.js
+++ b/Frontend/src/store/authStore.js
@@ -1,8 +1,40 @@
import { create } from 'zustand';
import { persist } from 'zustand/middleware';
import { supabase } from '../lib/supabaseClient';
+import { API_CONFIG } from '../config';
import useTicketStore from './ticketStore';
+const BACKEND_URL = API_CONFIG.BACKEND_URL;
+
+const verifyServerCookieSession = async () => {
+ try {
+ const res = await fetch(`${BACKEND_URL}/auth/me`, {
+ method: 'GET',
+ credentials: 'include',
+ headers: { Accept: 'application/json' },
+ });
+ if (!res.ok) return null;
+ const body = await res.json();
+ return body?.user || null;
+ } catch (e) {
+ console.warn('Server cookie session check failed:', e?.message || e);
+ return null;
+ }
+};
+
+const mirrorBackendAuth = async (path, payload) => {
+ try {
+ await fetch(`${BACKEND_URL}${path}`, {
+ method: 'POST',
+ credentials: 'include',
+ headers: { 'Content-Type': 'application/json' },
+ body: JSON.stringify(payload),
+ });
+ } catch (e) {
+ console.warn(`Backend auth ${path} failed:`, e?.message || e);
+ }
+};
+
let currentUserPromise = null;
const useAuthStore = create(
@@ -89,6 +121,13 @@ const useAuthStore = create(
currentUserPromise = (async () => {
try {
set({ isCheckingSession: true });
+ const cookieUser = await verifyServerCookieSession();
+ if (cookieUser) {
+ set({ user: cookieUser });
+ get().getProfile(cookieUser);
+ return cookieUser;
+ }
+
const { data: { user }, error } = await supabase.auth.getUser();
if (error) throw error;
@@ -117,6 +156,8 @@ const useAuthStore = create(
set({ loading: true });
console.log("Attempting login for:", email);
try {
+ await mirrorBackendAuth('/auth/login', { email, password });
+
const { data, error } = await supabase.auth.signInWithPassword({
email,
password,
@@ -205,6 +246,14 @@ const useAuthStore = create(
console.log("Starting signup for:", email);
try {
+ await mirrorBackendAuth('/auth/signup', {
+ email,
+ password,
+ full_name: fullName,
+ role,
+ company,
+ });
+
// 1. Auth Signup with Metadata
console.log("Step 1: Auth.signUp...");
const { data, error } = await supabase.auth.signUp({
@@ -245,6 +294,15 @@ const useAuthStore = create(
logout: async () => {
set({ loading: true });
try {
+ try {
+ await fetch(`${BACKEND_URL}/auth/logout`, {
+ method: 'POST',
+ credentials: 'include',
+ });
+ } catch (e) {
+ console.warn('Backend cookie logout failed:', e?.message || e);
+ }
+
const { error } = await supabase.auth.signOut();
if (error) throw error;
set({ user: null, profile: null });
@@ -305,8 +363,7 @@ const useAuthStore = create(
{
name: 'auth-storage',
partialize: (state) => ({
- // We keep profile persisted for quick UI transitions,
- // but session is handled by Supabase cookie/localStorage
+ // Profile only — JWT session lives in HttpOnly cookies (issue #130)
profile: state.profile
}),
}
diff --git a/Frontend/src/store/ticketStore.js b/Frontend/src/store/ticketStore.js
index 1b88dddfb0ff1fde84d53e9acc671109045d36d9..c3efe714f56fa44a197c0777e48dbf79265b2c06 100644
--- a/Frontend/src/store/ticketStore.js
+++ b/Frontend/src/store/ticketStore.js
@@ -27,30 +27,41 @@ const useTicketStore = create(
})),
addTicket: (ticket) => set((state) => {
return {
- tickets: [...state.tickets, ticket]
+ tickets: [ticket, ...state.tickets]
};
}),
- updateTicket: (ticketId, updates) => set((state) => {
-// eslint-disable-next-line no-unused-vars
- const existingTicket = state.tickets.find(t => t.ticket_id === ticketId);
- const updatedTickets = state.tickets.map(t => t.ticket_id === ticketId ? { ...t, ...updates } : t);
- const shouldUpdateActive = state.activeTicket?.ticket_id === ticketId;
-
+ upsertTicket: (ticket) => set((state) => {
+ const ticketId = ticket?.id ?? ticket?.ticket_id;
+ if (!ticketId) return state;
+ const exists = state.tickets.some(t => (t.id ?? t.ticket_id) === ticketId);
+ const tickets = exists
+ ? state.tickets.map(t => (t.id ?? t.ticket_id) === ticketId ? { ...t, ...ticket } : t)
+ : [ticket, ...state.tickets];
+ const shouldUpdateActive = (state.activeTicket?.id ?? state.activeTicket?.ticket_id) === ticketId;
+ return {
+ tickets,
+ activeTicket: shouldUpdateActive ? { ...state.activeTicket, ...ticket } : state.activeTicket
+ };
+ }),
+ removeTicket: (ticketId) => set((state) => ({
+ tickets: state.tickets.filter(t => (t.id ?? t.ticket_id) !== ticketId),
+ activeTicket: (state.activeTicket?.id ?? state.activeTicket?.ticket_id) === ticketId
+ ? null
+ : state.activeTicket
+ })),
+ updateTicket: (ticketId, updates) => set((state) => {
+// eslint-disable-next-line no-unused-vars
+ const existingTicket = state.tickets.find(t => (t.id ?? t.ticket_id) === ticketId);
+ const updatedTickets = state.tickets.map(t => ((t.id ?? t.ticket_id) === ticketId) ? { ...t, ...updates } : t);
+ const shouldUpdateActive = ((state.activeTicket?.id ?? state.activeTicket?.ticket_id) === ticketId);
return {
tickets: updatedTickets,
activeTicket: shouldUpdateActive ? { ...state.activeTicket, ...updates } : state.activeTicket
};
}),
-
- removeTicket: (ticketId) => set((state) => ({
- tickets: state.tickets.filter(t => t.ticket_id !== ticketId),
- activeTicket: state.activeTicket?.ticket_id === ticketId
- ? null
- : state.activeTicket
-})),
appendMessage: (ticketId, message) => set((state) => {
const updatedTickets = state.tickets.map(t =>
t.ticket_id === ticketId
diff --git a/Frontend/src/user/components/RecentTickets.jsx b/Frontend/src/user/components/RecentTickets.jsx
index b60a70ddf1893fd577087ad1675841059e40cf40..eb8d7d67e33f1e8525cda128ecabf298d59ad72b 100644
--- a/Frontend/src/user/components/RecentTickets.jsx
+++ b/Frontend/src/user/components/RecentTickets.jsx
@@ -150,6 +150,11 @@ const RecentTickets = () => {
{ticket.summary || ticket.subject || ticket.description || "No description provided"}
+ {ticket?.metadata?.translation?.translated && (
+
+ Translated from {ticket.metadata.translation.source_language_name || ticket.metadata.translation.source_language || 'Unknown'}
+
+ )}
{getStatusBadge(ticket.status)}
diff --git a/Frontend/src/user/pages/AutoResolveChat.jsx b/Frontend/src/user/pages/AutoResolveChat.jsx
index d8863209b8b4e69d6e8fcc8a7482be584e339d05..f1fae74896b76cb83721e914e9b25611cb8938f9 100644
--- a/Frontend/src/user/pages/AutoResolveChat.jsx
+++ b/Frontend/src/user/pages/AutoResolveChat.jsx
@@ -19,6 +19,7 @@ const AutoResolveChat = () => {
const { aiTicket } = useTicketStore();
const navigate = useNavigate();
const [messages, setMessages] = useState([]);
+ const [steps, setSteps] = useState([]);
const [isThinking, setIsThinking] = useState(false);
const [isFinal, setIsFinal] = useState(false);
const [inputText, setInputText] = useState('');
@@ -77,7 +78,7 @@ const AutoResolveChat = () => {
}
if (newSteps.length >= 2) {
- // Steps parsed successfully; welcome message sent below
+ setSteps(newSteps);
} else {
const sentences = response
.replace(/\*\*/g, '')
@@ -87,7 +88,12 @@ const AutoResolveChat = () => {
.slice(0, 4);
if (sentences.length >= 2) {
- // Plan parsed but not rendered; welcome message sent below
+ const sentenceSteps = sentences.map((s, i) => ({
+ id: i + 1,
+ task: s,
+ completed: false
+ }));
+ setSteps(sentenceSteps);
} else {
throw new Error("Could not parse steps from AI response.");
}
@@ -197,6 +203,12 @@ const AutoResolveChat = () => {
else recognition.start();
};
+ const toggleStep = (stepId) => {
+ setSteps(prev => prev.map(step =>
+ step.id === stepId ? { ...step, completed: !step.completed } : step
+ ));
+ };
+
if (!aiTicket) return null;
return (
@@ -249,6 +261,48 @@ const AutoResolveChat = () => {
+ {/* Troubleshooting Steps */}
+ {steps.length > 0 && (
+
+
+
+ Troubleshooting Plan
+
+
+
+ {steps.map((step) => (
+
toggleStep(step.id)}
+ className={`w-full text-left flex items-center gap-3 p-3 rounded-xl border transition-all duration-300 ${
+ step.completed
+ ? 'bg-emerald-100 border-emerald-200 opacity-60'
+ : 'bg-white border-slate-100 hover:border-emerald-200 hover:bg-emerald-50/50'
+ }`}
+ >
+
+ {step.completed ? (
+ {step.id}
+ )}
+
+
+ {step.task}
+
+
+ ))}
+
+
{
const processOCR = async (imageFile) => {
setIsOcrLoading(true);
try {
+ const { default: Tesseract } = await import('tesseract.js');
const { data: { text } } = await Tesseract.recognize(imageFile, 'eng');
setExtractedOCR(text.trim());
} catch (err) {
diff --git a/Frontend/src/user/pages/MyTickets.jsx b/Frontend/src/user/pages/MyTickets.jsx
index 47b952b887cf925f0eca691116864b2b12cb9290..94baf3a499ee494f60e71e3cda0d6ae0f11aac13 100644
--- a/Frontend/src/user/pages/MyTickets.jsx
+++ b/Frontend/src/user/pages/MyTickets.jsx
@@ -120,6 +120,14 @@ function MyTickets() {
return 'text-gray-600';
};
+ const getTranslationInfo = (ticket) => {
+ const t = ticket?.metadata?.translation;
+ if (!t?.translated) return null;
+ return {
+ sourceLanguageName: t.source_language_name || t.source_language || 'Unknown',
+ };
+ };
+
return (
{/* Header section */}
@@ -317,6 +325,11 @@ function MyTickets() {
{ticket.summary || ticket.subject || ticket.description || "No subject"}
+ {getTranslationInfo(ticket) && (
+
+ Translated from {getTranslationInfo(ticket).sourceLanguageName}
+
+ )}
diff --git a/Frontend/src/user/pages/TicketDetail.jsx b/Frontend/src/user/pages/TicketDetail.jsx
index e2b66f667686e65e78b1059bbffa030d383fd31c..445f1d4105209d2b3751a5ca979d0c873f1d9330 100644
--- a/Frontend/src/user/pages/TicketDetail.jsx
+++ b/Frontend/src/user/pages/TicketDetail.jsx
@@ -22,6 +22,7 @@ const TicketDetail = () => {
const [isReopening, setIsReopening] = useState(false);
const [showCsat, setShowCsat] = useState(false);
const [csatHasBeenDismissed, setCsatHasBeenDismissed] = useState(false);
+ const [showOriginalText, setShowOriginalText] = useState(false);
useEffect(() => {
window.scrollTo(0, 0);
@@ -122,6 +123,10 @@ const TicketDetail = () => {
const solutionSteps = Array.isArray(ticket.solution_steps) ? ticket.solution_steps : [];
const isAutoResolved = ticket.auto_resolve === true;
const confidenceScore = ticket.metadata?.confidence ?? ticket.routing_confidence ?? 0.92;
+ const translationMeta = ticket.metadata?.translation;
+ const originalTextMeta = ticket.metadata?.original_text;
+ const isTranslated = Boolean(translationMeta?.translated && originalTextMeta?.description);
+ const sourceLanguageName = translationMeta?.source_language_name || translationMeta?.source_language || 'Unknown';
const handleReopen = async () => {
@@ -184,6 +189,27 @@ const TicketDetail = () => {
{/* LEFT SIDE (Main Content) */}
+ {isTranslated && (
+
+
+
+ Translated from {sourceLanguageName}
+
+
setShowOriginalText(prev => !prev)}
+ className="text-xs font-bold text-sky-700 hover:text-sky-900"
+ >
+ {showOriginalText ? "View English" : "View Original"}
+
+
+ {originalTextMeta?.description}
+
+ )}
+
+ )}
{/* Card 1: Ticket Timeline */}
diff --git a/Frontend/vite.config.js b/Frontend/vite.config.js
index d9048b718cda48dbe657e892a9f5b407eb2b73fc..4232886f5e1cccfa7b5fa4edcdff334225b6fb26 100644
--- a/Frontend/vite.config.js
+++ b/Frontend/vite.config.js
@@ -15,6 +15,6 @@ export default defineConfig({
},
},
build: {
- sourcemap: true
+ sourcemap: 'hidden'
}
})
diff --git a/MobileApp/.env.example b/MobileApp/.env.example
new file mode 100644
index 0000000000000000000000000000000000000000..06941cb5a1d88b4dd8368dcbf337d4a428d07770
--- /dev/null
+++ b/MobileApp/.env.example
@@ -0,0 +1,2 @@
+EXPO_PUBLIC_SUPABASE_URL=https://your-project-ref.supabase.co
+EXPO_PUBLIC_SUPABASE_ANON_KEY=your-supabase-anon-key
diff --git a/MobileApp/src/lib/supabase.js b/MobileApp/src/lib/supabase.js
index b41c7624f814ef6f3b4d3ecedd6fda1357d7f093..493e14574ebff9e4e0834a2b30c1640ad303f2a9 100644
--- a/MobileApp/src/lib/supabase.js
+++ b/MobileApp/src/lib/supabase.js
@@ -2,8 +2,14 @@ import 'react-native-url-polyfill/auto';
import { createClient } from '@supabase/supabase-js';
import AsyncStorage from '@react-native-async-storage/async-storage';
-const supabaseUrl = 'https://aejuenhqciagpntcqoir.supabase.co';
-const supabaseKey = 'eyJhbGciOiJIUzI1NiIsInR5cCI6IkpXVCJ9.eyJpc3MiOiJzdXBhYmFzZSIsInJlZiI6ImFlanVlbmhxY2lhZ3BudGNxb2lyIiwicm9sZSI6ImFub24iLCJpYXQiOjE3NzIzODQwNzgsImV4cCI6MjA4Nzk2MDA3OH0.-OxgEW5t4alPGlzV_JZDRZcLsQbbMap6jiWjfAVkMMY';
+const supabaseUrl = process.env.EXPO_PUBLIC_SUPABASE_URL;
+const supabaseKey = process.env.EXPO_PUBLIC_SUPABASE_ANON_KEY;
+
+if (!supabaseUrl || !supabaseKey) {
+ throw new Error(
+ 'Missing Supabase mobile config. Set EXPO_PUBLIC_SUPABASE_URL and EXPO_PUBLIC_SUPABASE_ANON_KEY in MobileApp/.env or EAS secrets.'
+ );
+}
export const supabase = createClient(supabaseUrl, supabaseKey, {
auth: {
diff --git a/MobileApp/src/screens/auth/LoginScreen.js b/MobileApp/src/screens/auth/LoginScreen.js
index f9181ad0be8da60d314eb24992a9d344e9b85740..28c99959a5b663cffcff1a4dce7ea92692b29526 100644
--- a/MobileApp/src/screens/auth/LoginScreen.js
+++ b/MobileApp/src/screens/auth/LoginScreen.js
@@ -5,6 +5,7 @@ import {
ScrollView, StatusBar, Animated,
} from 'react-native';
import { supabase } from '../../lib/supabase';
+import { backendLogin, backendLogout } from '../../lib/authBackend';
import { COLORS, SHADOWS } from '../../styles/theme';
import { Lock, Mail, Eye, EyeOff, Zap, ArrowRight, ShieldCheck } from 'lucide-react-native';
import { LinearGradient } from 'expo-linear-gradient';
@@ -52,6 +53,7 @@ const LoginScreen = () => {
}
setLoading(true);
try {
+ await backendLogin(email, password);
const { data, error } = await supabase.auth.signInWithPassword({ email, password });
if (error) throw error;
diff --git a/MobileApp/src/screens/user/ProfileScreen.js b/MobileApp/src/screens/user/ProfileScreen.js
index 6d0129f294f266f70dc7aa20d78d7680dec08c1d..f80d435b7637ba36231ed5b172e3d5d14d32987e 100644
--- a/MobileApp/src/screens/user/ProfileScreen.js
+++ b/MobileApp/src/screens/user/ProfileScreen.js
@@ -5,6 +5,7 @@ import {
} from 'react-native';
import { SafeAreaView } from 'react-native-safe-area-context';
import { supabase } from '../../lib/supabase';
+import { backendLogout } from '../../lib/authBackend';
import { COLORS, SHADOWS } from '../../styles/theme';
import {
User, Mail, Building2, ShieldCheck, Calendar, Ticket, Zap,
@@ -226,6 +227,7 @@ const ProfileScreen = () => {
const handleLogout = async () => {
try {
Haptics.impactAsync(Haptics.ImpactFeedbackStyle.Medium);
+ await backendLogout();
// Forcefully wipe all Supabase session keys from AsyncStorage first to trigger instant navigation resetting
const keys = await AsyncStorage.getAllKeys();
const supabaseKeys = keys.filter(k => k.startsWith('sb-') || k.includes('supabase'));
@@ -236,6 +238,7 @@ const ProfileScreen = () => {
} catch (e) {
console.warn("Logout error, forcing full wipe:", e);
await AsyncStorage.clear();
+ await supabase.auth.signOut();
}
};
diff --git a/README.md b/README.md
index 2bab4698c523f08a3f25758043868d901a80c484..80cc6cfa61a48f74dd15ba78e639f849d4097b3b 100644
--- a/README.md
+++ b/README.md
@@ -58,7 +58,9 @@ pinned: false
## 🌟 GSSoC '26 Contributor & Community Campaign
-We are extremely proud to be part of the **GirlScript Summer of Code (GSSoC) 2026**! To support the project and get real-time open-source project updates, please make sure you participate in our community campaign:
+We are extremely proud to be part of the **GirlScript Summer of Code (GSSoC) 2026**! To ensure high-quality contributions and maximum rewards for both developers and mentors, please review our official [GSSoC Mentorship Guide & Review Standard](MENTORSHIP.md).
+
+To support the project and get real-time open-source project updates, please make sure you participate in our community campaign:
diff --git a/backend/.env.example b/backend/.env.example
index f7247e9925ad9b8fdd63ba3a40ae7fc0ba3ede72..cbb9e617c5b0f9de47207c90277f8aa76bdfb2db 100644
--- a/backend/.env.example
+++ b/backend/.env.example
@@ -1,18 +1,106 @@
-# Supabase Configuration
-SUPABASE_URL=https://your-project.supabase.co
-SUPABASE_SERVICE_KEY=your-service-key
+# =============================================================================
+# HELPDESK.AI Backend — Environment Variable Reference
+# =============================================================================
+# Copy this file to `backend/.env` and fill in the values appropriate for your
+# environment. NEVER commit a populated `.env` file to source control.
+#
+# All variables are read via `os.environ.get(...)` / `os.getenv(...)` in the
+# backend codebase. Defaults shown below match the values used in code.
+# =============================================================================
+
+
+# -----------------------------------------------------------------------------
+# Supabase (Database + Auth + Storage)
+# -----------------------------------------------------------------------------
+# Required for: ticket persistence, RAG knowledge base, SLA escalation,
+# auto-close cron job, notification routing, company settings seeding.
+#
+# Service-role key is required for backend (bypasses RLS). NEVER expose this
+# key to the frontend — use the anon key on the client side instead.
+SUPABASE_URL=https://YOUR-PROJECT-REF.supabase.co
+SUPABASE_SERVICE_KEY=
+# Anon key — required for /auth/login cookie bridge (issue #130). Safe for backend proxy only.
+SUPABASE_ANON_KEY=
+# Some newer services (auto_close, notification_routing, sla_service)
+# also accept SUPABASE_SERVICE_ROLE_KEY as an alias. Set both for safety.
+SUPABASE_SERVICE_ROLE_KEY=
+
+
+# -----------------------------------------------------------------------------
+# Google Gemini (LLM)
+# -----------------------------------------------------------------------------
+# Required for: auto-resolve chat, summary generation, advanced classification.
+# If unset, GeminiService will initialize in disabled mode and downstream
+# endpoints that depend on it will return graceful fallback responses.
+GEMINI_API_KEY=
-# Startup Mode
-# Set ALLOW_DEGRADED_STARTUP=1 to allow backend startup even if duplicate/RAG models fail to load
-# Useful for offline/dev environments where model downloads may not be available
-ALLOW_DEGRADED_STARTUP=0
-# Sentence Transformers Model Path
-# Provide a local path to the sentence-transformers model to avoid downloading from HuggingFace
-# If not set, model will be downloaded from HuggingFace (requires internet)
-# Example: ./models/all-MiniLM-L6-v2 or /opt/models/all-MiniLM-L6-v2
+# -----------------------------------------------------------------------------
+# AI Model Artifacts
+# -----------------------------------------------------------------------------
+# Path to a local sentence-transformer model directory used by RAG and
+# duplicate detection. If unset, the services will attempt to download the
+# default model on first run (requires internet access).
SENTENCE_TRANSFORMER_MODEL_PATH=
-# Readiness Check
-# Set REQUIRE_SUPABASE=true to include Supabase configuration in the strict readiness gate
+
+# -----------------------------------------------------------------------------
+# Startup / Health-Check Behaviour
+# -----------------------------------------------------------------------------
+# Controls strict startup validation. When `0` (default), the backend will
+# REFUSE to start if core classifier assets are missing — this prevents the
+# silent "Unknown" classification fallback documented in ISSUE_DEBUG_FINDINGS.
+# Set to `1` only for local development without the full model bundle.
+ALLOW_DEGRADED_STARTUP=0
+
+# When `true`, startup will hard-fail if Supabase credentials are missing.
+# Default `false` allows the backend to run in "no-persistence" mode for tests.
REQUIRE_SUPABASE=false
+
+# Slack Alerts
+SLACK_WEBHOOK_URL=https://hooks.slack.com/services/xxx/yyy/zzz
+
+# -----------------------------------------------------------------------------
+# Health-Check Probe (Docker / Kubernetes)
+# -----------------------------------------------------------------------------
+HEALTHCHECK_URL=http://127.0.0.1:7860/ready
+HEALTHCHECK_TIMEOUT_SECONDS=3
+
+
+# -----------------------------------------------------------------------------
+# SLA Escalation Background Worker
+# -----------------------------------------------------------------------------
+SLA_ESCALATION_ENABLED=true
+SLA_ESCALATION_INTERVAL_SECONDS=300
+
+
+# -----------------------------------------------------------------------------
+# Auto-Close Cron Job (Issue #41)
+# -----------------------------------------------------------------------------
+AUTO_CLOSE_ENABLED=true
+AUTO_CLOSE_DAYS=7
+# Standard 5-field cron expression. Default: 02:00 UTC every day.
+AUTO_CLOSE_CRON_SCHEDULE=0 2 * * *
+
+
+# -----------------------------------------------------------------------------
+# Notification Routing Middleware (Issue #41)
+# -----------------------------------------------------------------------------
+# Accepted values: debug, info, warning
+NOTIFICATION_ROUTING_LOG_LEVEL=info
+
+
+# -----------------------------------------------------------------------------
+# Generic Environment Flag
+# -----------------------------------------------------------------------------
+# Set to `development` to enable extra debug logging in some services.
+ENV=production
+
+
+# -----------------------------------------------------------------------------
+# Redis Inference Cache (Issue #131)
+# -----------------------------------------------------------------------------
+# When true, cache DistilBERT classifications and sentence-transformer embeddings.
+USE_REDIS_CACHE=false
+REDIS_URL=redis://127.0.0.1:6379/0
+REDIS_CACHE_TTL_SECONDS=3600
diff --git a/backend/Dockerfile b/backend/Dockerfile
index 79a8bbe08fc8811d5448ecaa66ab50738a8a04a0..3395cd97c41ef83ceee3747f2c48cf902091a6c4 100644
--- a/backend/Dockerfile
+++ b/backend/Dockerfile
@@ -1,36 +1,40 @@
-# Use an official Python runtime as a parent image
-FROM python:3.10-slim
+# syntax=docker/dockerfile:1
-LABEL version="1.1.1" rebuild_trigger="2026-03-08-2032"
+FROM python:3.10-slim AS builder
-# Set the working directory to /app
-WORKDIR /app
-
-# Install system dependencies required for EasyOCR and OpenCV
-RUN apt-get update && apt-get install -y \
- libgl1 \
- libglib2.0-0 \
+WORKDIR /build
+RUN apt-get update && apt-get install -y --no-install-recommends \
git \
&& rm -rf /var/lib/apt/lists/*
-# Copy the requirements file into the container
COPY requirements.txt .
+RUN pip install --no-cache-dir --prefix=/install -r requirements.txt
+
+FROM python:3.10-slim AS runtime
-# Install dependencies (no-cache-dir keeps the docker image smaller)
-RUN pip install --no-cache-dir -r requirements.txt
+LABEL org.opencontainers.image.title="helpdesk-backend"
+LABEL org.opencontainers.image.description="HELPDESK.AI FastAPI backend (multi-stage)"
-# Copy all the remaining files into the container as a 'backend' directory
-# This allows absolute imports like 'from backend.services...' to work perfectly
+WORKDIR /app
+
+RUN apt-get update && apt-get install -y --no-install-recommends \
+ libgl1 \
+ libglib2.0-0 \
+ && rm -rf /var/lib/apt/lists/* \
+ && useradd --create-home --shell /usr/sbin/nologin appuser
+
+COPY --from=builder /install /usr/local
COPY . /app/backend
-# Tell Python where to look for modules (so it can find the 'backend' folder)
-ENV PYTHONPATH=/app
+ENV PYTHONPATH=/app \
+ PYTHONDONTWRITEBYTECODE=1 \
+ PYTHONUNBUFFERED=1
-# Expose port 7860 (Hugging Face Spaces default)
EXPOSE 7860
HEALTHCHECK --interval=30s --timeout=5s --start-period=120s --retries=3 \
CMD ["python", "backend/healthcheck.py"]
-# Run the FastAPI server via Uvicorn
+USER appuser
+
CMD ["uvicorn", "backend.main:app", "--host", "0.0.0.0", "--port", "7860"]
diff --git a/backend/auth/crypto.py b/backend/auth/crypto.py
index aa355c6acf1c4fd3e593ea35ca4c9565d36af153..a868ffa4e927ce737c19621d5a846b38513a971c 100644
--- a/backend/auth/crypto.py
+++ b/backend/auth/crypto.py
@@ -1,98 +1,218 @@
import os
-import hashlib
import base64
-from cryptography.hazmat.primitives.ciphers.aead import AESGCM
-
-# Initialize AESGCM with 32-byte key derived from secret key
-SECRET_KEY = os.environ.get("DB_ENCRYPTION_SECRET_KEY")
-
-_cipher = None
-if SECRET_KEY:
- # Hash secret key to ensure it is exactly 32 bytes (256 bits)
- key_bytes = hashlib.sha256(SECRET_KEY.encode()).digest()
- _cipher = AESGCM(key_bytes)
-else:
- print("[WARNING] DB_ENCRYPTION_SECRET_KEY not set. Data encryption is disabled (degraded mode).")
-
-def encrypt(plain_text: str) -> str:
- """Encrypt plain text using AES-256 GCM and return base64 encoded string."""
- if not _cipher or not plain_text:
- return plain_text
+import logging
+import hashlib
+from typing import Any
+
+# Configure logger
+logger = logging.getLogger(__name__)
+logger.setLevel(logging.WARNING)
+
+if not logger.handlers:
+ handler = logging.StreamHandler()
+ formatter = logging.Formatter("[Crypto] %(asctime)s - %(levelname)s - %(message)s")
+ handler.setFormatter(formatter)
+ logger.addHandler(handler)
+
+CRYPTOGRAPHY_AVAILABLE = False
+_aesgcm = None
+ENCRYPTION_ENABLED = False
+
+try:
+ from cryptography.hazmat.primitives.ciphers.aead import AESGCM
+ CRYPTOGRAPHY_AVAILABLE = True
+except ImportError:
+ logger.warning("The 'cryptography' library is not available. Running with database encryption disabled.")
+
+# Key Parsing logic: supporting urlsafe-b64, hex, and SHA-256 stretching
+def derive_cryptographic_key(raw_key: str | None) -> bytes | None:
+ if not raw_key:
+ return None
+
+ # 1. Try URL-safe Base64 decode
try:
- # Generate 12-byte random nonce for GCM
- nonce = os.urandom(12)
- encrypted_bytes = _cipher.encrypt(nonce, plain_text.encode(), None)
- # Combine nonce and ciphertext and encode as base64
- combined = nonce + encrypted_bytes
- return base64.b64encode(combined).decode('utf-8')
- except Exception as e:
- print(f"[Crypto Error] Encryption failed: {e}")
- return plain_text
+ # Pad string appropriately if needed
+ padded = raw_key + "=" * ((4 - len(raw_key) % 4) % 4)
+ decoded = base64.urlsafe_b64decode(padded.encode('utf-8'))
+ if len(decoded) == 32:
+ return decoded
+ except Exception:
+ pass
-def decrypt(cipher_text: str) -> str:
- """Decrypt base64 encoded ciphertext using AES-256 GCM and return plain text."""
- if not _cipher or not cipher_text:
- return cipher_text
+ # 2. Try hex decode
try:
- # Check if cipher_text looks like base64
+ decoded = bytes.fromhex(raw_key)
+ if len(decoded) == 32:
+ return decoded
+ except Exception:
+ pass
+
+ # 3. Fall back to SHA-256 stretch
+ return hashlib.sha256(raw_key.encode('utf-8')).digest()
+
+
+# Initialize Key and AESGCM instance
+if CRYPTOGRAPHY_AVAILABLE:
+ SECRET_KEY_ENV_VAR = "DB_ENCRYPTION_SECRET_KEY"
+ raw_secret_key = os.environ.get(SECRET_KEY_ENV_VAR)
+
+ if raw_secret_key:
try:
- combined = base64.b64decode(cipher_text.encode('utf-8'))
- except Exception:
- return cipher_text # Return as-is if not valid base64
-
- if len(combined) < 12:
- return cipher_text # Not enough bytes for nonce
-
- nonce = combined[:12]
- ciphertext = combined[12:]
- decrypted_bytes = _cipher.decrypt(nonce, ciphertext, None)
- return decrypted_bytes.decode('utf-8')
- except Exception as e:
- # If decryption fails, it might be unencrypted plaintext (graceful degrade for old records)
- return cipher_text
+ key_bytes = derive_cryptographic_key(raw_secret_key)
+ if key_bytes:
+ _aesgcm = AESGCM(key_bytes)
+ ENCRYPTION_ENABLED = True
+ logger.info("Database encryption key loaded and active.")
+ else:
+ logger.warning("Could not derive key from DB_ENCRYPTION_SECRET_KEY. Database encryption disabled.")
+ except Exception as e:
+ logger.warning(f"Failed to initialize AESGCM: {e}. Database encryption disabled.")
+ else:
+ logger.warning("DB_ENCRYPTION_SECRET_KEY is not set in environment. Running with database encryption disabled.")
+
+# Tag prefix for identifying encrypted data
+PREFIX = "enc:v1:"
-def apply_db_encryption_patch():
- """Apply transparent monkeypatch to Postgrest/Supabase client execute method for 'tickets' table."""
+def encrypt_value(value: str) -> str:
+ """Encrypt a string value using AES-256-GCM. Returns 'enc:v1:
'."""
+ if not ENCRYPTION_ENABLED or _aesgcm is None:
+ return value
+ if not isinstance(value, str):
+ return value
+ # Double-encryption protection: if already encrypted, return as-is
+ if value.startswith(PREFIX):
+ return value
+
try:
- from postgrest._sync.request_builder import SyncQueryRequestBuilder
+ # Generate 12-byte secure random nonce
+ nonce = os.urandom(12)
+ plaintext_bytes = value.encode('utf-8')
+ # Encrypt (combines ciphertext and tag automatically in cryptography's AESGCM)
+ ciphertext = _aesgcm.encrypt(nonce, plaintext_bytes, None)
+ # Store nonce + ciphertext together
+ payload = nonce + ciphertext
+ encoded = base64.b64encode(payload).decode('utf-8')
+ return f"{PREFIX}{encoded}"
+ except Exception as e:
+ logger.error(f"Encryption failed: {e}")
+ return value
+
+def decrypt_value(value: str) -> str:
+ """Decrypt a string value that starts with 'enc:v1:'."""
+ if not ENCRYPTION_ENABLED or _aesgcm is None:
+ return value
+ if not isinstance(value, str):
+ return value
+ # Graceful pass-through for legacy/plaintext rows
+ if not value.startswith(PREFIX):
+ return value
- _original_execute = SyncQueryRequestBuilder.execute
-
- def custom_execute(self):
- path_str = getattr(self.request.path, "path", "")
- table_name = path_str.split('/')[-1]
-
- if table_name == "tickets":
- payload = self.request.json
- if isinstance(payload, dict):
- for field in ["contact_email", "description", "raw_text"]:
- if field in payload and payload[field] is not None:
- payload[field] = encrypt(str(payload[field]))
- elif isinstance(payload, list):
- for item in payload:
- if isinstance(item, dict):
- for field in ["contact_email", "description", "raw_text"]:
- if field in item and item[field] is not None:
- item[field] = encrypt(str(item[field]))
-
- res = _original_execute(self)
-
- if table_name == "tickets" and res and hasattr(res, "data"):
- data = res.data
- if isinstance(data, dict):
- for field in ["contact_email", "description", "raw_text"]:
- if field in data and data[field] is not None:
- data[field] = decrypt(str(data[field]))
- elif isinstance(data, list):
- for item in data:
- if isinstance(item, dict):
- for field in ["contact_email", "description", "raw_text"]:
- if field in item and item[field] is not None:
- item[field] = decrypt(str(item[field]))
-
- return res
-
- SyncQueryRequestBuilder.execute = custom_execute
- print("[Crypto] Supabase database encryption patch applied successfully.")
+ try:
+ encoded_str = value[len(PREFIX):]
+ payload = base64.b64decode(encoded_str)
+ if len(payload) < 12:
+ return value
+ nonce = payload[:12]
+ ciphertext = payload[12:]
+ decrypted_bytes = _aesgcm.decrypt(nonce, ciphertext, None)
+ return decrypted_bytes.decode('utf-8')
except Exception as e:
- print(f"[Crypto WARNING] Failed to apply database encryption patch: {e}")
+ logger.error(f"Decryption failed: {e}")
+ return value
+
+# ORM Payload Processing Helpers
+TARGET_FIELDS = {"contact_email", "description", "raw_text"}
+
+def encrypt_row(row: dict) -> dict:
+ if not isinstance(row, dict):
+ return row
+ new_row = dict(row)
+ for field in TARGET_FIELDS:
+ if field in new_row and new_row[field] is not None:
+ new_row[field] = encrypt_value(str(new_row[field]))
+ return new_row
+
+def decrypt_row(row: dict) -> dict:
+ if not isinstance(row, dict):
+ return row
+ new_row = dict(row)
+ for field in TARGET_FIELDS:
+ if field in new_row and new_row[field] is not None:
+ new_row[field] = decrypt_value(str(new_row[field]))
+ return new_row
+
+def encrypt_payload(payload: Any) -> Any:
+ if isinstance(payload, list):
+ return [encrypt_row(row) for row in payload]
+ elif isinstance(payload, dict):
+ return encrypt_row(payload)
+ return payload
+
+def decrypt_payload(payload: Any) -> Any:
+ if isinstance(payload, list):
+ return [decrypt_row(row) for row in payload]
+ elif isinstance(payload, dict):
+ return decrypt_row(payload)
+ return payload
+
+# Transparent client query wrapper proxy
+class WrappedRequestBuilder:
+ def __init__(self, builder: Any, table_name: str):
+ object.__setattr__(self, "_builder", builder)
+ object.__setattr__(self, "_table_name", table_name)
+
+ def insert(self, json: Any, *args, **kwargs) -> "WrappedRequestBuilder":
+ if self._table_name == "tickets":
+ json = encrypt_payload(json)
+ res = self._builder.insert(json, *args, **kwargs)
+ return WrappedRequestBuilder(res, self._table_name)
+
+ def update(self, json: Any, *args, **kwargs) -> "WrappedRequestBuilder":
+ if self._table_name == "tickets":
+ json = encrypt_payload(json)
+ res = self._builder.update(json, *args, **kwargs)
+ return WrappedRequestBuilder(res, self._table_name)
+
+ def execute(self, *args, **kwargs) -> Any:
+ res = self._builder.execute(*args, **kwargs)
+ if self._table_name == "tickets" and res and hasattr(res, "data"):
+ res.data = decrypt_payload(res.data)
+ return res
+
+ def __getattr__(self, name: str) -> Any:
+ attr = getattr(self._builder, name)
+ if callable(attr):
+ def wrapper(*args, **kwargs):
+ res = attr(*args, **kwargs)
+ if res is self._builder:
+ return self
+ if hasattr(res, "execute") or hasattr(res, "table") or hasattr(res, "insert"):
+ return WrappedRequestBuilder(res, self._table_name)
+ return res
+ return wrapper
+ return attr
+
+ def __setattr__(self, name: str, value: Any) -> None:
+ setattr(self._builder, name, value)
+
+
+def wrap_client(client: Any) -> Any:
+ """Wraps a Supabase client's table method for transparent tickets encryption."""
+ if client is None:
+ return None
+
+ # Avoid double wrapping
+ if hasattr(client, "_wrapped_by_crypto"):
+ return client
+
+ original_table = client.table
+
+ def wrapped_table(table_name: str, *args, **kwargs) -> Any:
+ builder = original_table(table_name, *args, **kwargs)
+ if table_name == "tickets":
+ return WrappedRequestBuilder(builder, table_name)
+ return builder
+
+ client.table = wrapped_table
+ client._wrapped_by_crypto = True
+ return client
diff --git a/backend/main.py b/backend/main.py
index 52be65ea4019bdcd55fedc1932930ba788e0b3b6..904004b5c927c722202ca82a4bb01523b18d611b 100644
--- a/backend/main.py
+++ b/backend/main.py
@@ -8,6 +8,7 @@ import os
import sys
import uuid
import json
+import re
import datetime
import traceback
import warnings
@@ -19,9 +20,8 @@ from contextlib import asynccontextmanager
warnings.filterwarnings("ignore", message="'pin_memory'")
# HF Rebuild Trigger: 2026-03-08-2030
-from fastapi import FastAPI, Depends, Header, HTTPException, Request, Response
+from fastapi import FastAPI, Depends, HTTPException, Request
from slowapi import Limiter, _rate_limit_exceeded_handler
-from prometheus_client import generate_latest, CONTENT_TYPE_LATEST
from slowapi.util import get_remote_address
from slowapi.errors import RateLimitExceeded
from fastapi.middleware.cors import CORSMiddleware
@@ -36,13 +36,12 @@ from dotenv import load_dotenv
env_path = Path(__file__).parent / '.env'
load_dotenv(dotenv_path=env_path)
-# Apply database encryption for PII fields
-try:
- from backend.auth.crypto import apply_db_encryption_patch
- apply_db_encryption_patch()
-except Exception as e:
- print(f"[WARNING] Database encryption patch initialization failed: {e}")
+# CI smoke tests allow degraded startup so the app can import without heavy ML assets.
+ALLOW_DEGRADED_STARTUP = os.environ.get("ALLOW_DEGRADED_STARTUP", "0") == "1"
+
+def _startup_fatal(message: str) -> None:
+ print(f"[Startup-FATAL] {message}")
# Initialize Supabase Client (Service Role for backend bypass)
try:
@@ -53,7 +52,8 @@ try:
print("[ERROR] SUPABASE_URL or SUPABASE_SERVICE_KEY not set in backend/.env")
supabase = None
else:
- supabase = create_client(url, key)
+ from backend.auth.crypto import wrap_client
+ supabase = wrap_client(create_client(url, key))
except (ImportError, Exception) as e:
print(f"[WARNING] Supabase initialization failed: {e}")
supabase = None
@@ -65,16 +65,14 @@ sys.path.insert(0, os.path.abspath(os.path.join(os.path.dirname(__file__), "..")
from backend.services.classifier_service import ClassifierService
from backend.services.classifier_v2 import classifier_v2
from backend.services.classifier_v3 import classifier_v3 # V3 Power Model
+from backend.services.audit_service import AuditLogService, AuditLogAccessError
+from backend.services.onnx_service import onnx_classifier
from backend.services.ner_service import NERService
from backend.services.duplicate_service import DuplicateService
from backend.services.rag_service import RagService
-from backend.services.sla_service import (
- calculate_sla_breach_at,
- calculate_sla_response_at,
- classify_sla_status,
- load as load_sla_service,
- run_sla_escalation_loop,
-)
+from backend.services.sla_engine import SLAEngine, compute_sla_breach_at, get_sla_policy
+from backend.services.redis_cache import redis_cache
+from backend.auth_cookie import router as auth_cookie_router, get_current_user # noqa: F401
# ---------------------------------------------------------------------------
@@ -123,13 +121,62 @@ def detect_semantic_duplicate(text: str, *, company_id: str | None, threshold: f
duplicate_result["parent_ticket_id"] = duplicate_result.get("duplicate_ticket_id")
duplicate_result["is_potential_duplicate"] = duplicate_result.get("is_duplicate", False)
return duplicate_result
+
+
+def classify_ticket_text(text: str) -> dict:
+ """Run the local classifier cascade with ONNX as the offline fallback path."""
+ cached = redis_cache.get_classification(text)
+ if cached:
+ return cached
+
+ result = _classify_ticket_text_uncached(text)
+ redis_cache.set_classification(text, result)
+ return result
+
+
+def _classify_ticket_text_uncached(text: str) -> dict:
+ try:
+ classification_v3_res = classifier_v3.predict(text)
+ if "error" not in classification_v3_res:
+ cat = classification_v3_res.get("Category", {}).get("prediction", "Unknown")
+ sub = classification_v3_res.get("Subcategory", {}).get("prediction", "Unknown")
+ pri = classification_v3_res.get("priority", {}).get("prediction", "Medium")
+ conf = classification_v3_res.get("Category", {}).get("confidence", 0.0)
+
+ from backend.services.classifier_service import TEAM_MAP, AUTO_RESOLVE_SUBS
+ return {
+ "category": cat,
+ "subcategory": sub,
+ "priority": pri,
+ "auto_resolve": sub in AUTO_RESOLVE_SUBS,
+ "assigned_team": TEAM_MAP.get(cat, "General Support"),
+ "confidence": float(conf),
+ }
+ except Exception:
+ traceback.print_exc()
+
+ try:
+ onnx_result = onnx_classifier.predict(text)
+ if onnx_result:
+ return onnx_result
+ except Exception as error:
+ print(f"[ONNX] Fallback classification skipped: {error}")
+
+ try:
+ return classifier_service.predict(text)
+ except Exception:
+ traceback.print_exc()
+ return {
+ "category": "Unknown", "subcategory": "Unknown", "priority": "Medium",
+ "auto_resolve": False, "assigned_team": "General Support", "confidence": 0.0,
+ }
+
class TicketRequest(BaseModel):
text: str
image_base64: str = ""
image_text: str = "" # Keep for backward compatibility
user_id: str | None = None
company: str | None = None
- company_id: str | None = None
image_url: str | None = None
confidence_threshold: float = 0.20
duplicate_sensitivity: float = 0.85
@@ -149,10 +196,6 @@ class TicketSaveRequest(BaseModel):
image_url: str | None = None
company: str | None = None
company_id: str | None = None
- description_vector: list[float] | None = None
- is_potential_duplicate: bool = False
- parent_ticket_id: str | None = None
- sla_response_due_at: str | None = None
sla_breach_at: str
sla_status: str | None = None
escalation_level: int = 0
@@ -168,8 +211,6 @@ class TicketSaveRequest(BaseModel):
class DuplicateInfo(BaseModel):
is_duplicate: bool
duplicate_ticket_id: str | None = None
- parent_ticket_id: str | None = None
- is_potential_duplicate: bool = False
similarity: float = 0.0
@@ -191,8 +232,6 @@ class TicketResponse(BaseModel):
entities: list[EntityInfo]
duplicate_ticket: DuplicateInfo
confidence: float
- is_potential_duplicate: bool = False
- parent_ticket_id: str | None = None
needs_review: bool = False
reasoning: str = ""
decision_factors: list[str] = []
@@ -202,6 +241,10 @@ class TicketResponse(BaseModel):
timeline: dict = {} # Map of step_name: timestamp
env_metadata: dict = {} # IP, Hostname, Browser/OS
sla_breach_at: str | None = None
+ original_text: str | None = None
+ source_language: str = "en"
+ source_language_name: str = "English"
+ was_translated: bool = False
version: str = "2.1.0-Neural-Diagnostic"
@@ -229,6 +272,24 @@ class TicketRecord(BaseModel):
timeline: dict = {} # Milestones: created, analyzed, triaged, routed, in_progress, resolved
+class AuditLogProfile(BaseModel):
+ full_name: str | None = None
+ email: str | None = None
+ profile_picture: str | None = None
+
+
+class AuditLogRecord(BaseModel):
+ id: str
+ ticket_id: str
+ company_id: str
+ performed_by: str | None = None
+ action: str
+ old_value: dict | list | str | None = None
+ new_value: dict | list | str | None = None
+ created_at: str
+ performed_by_profile: AuditLogProfile | None = None
+
+
# --- In-Memory Database (to be replaced with SQL later) ---
TICKETS_DB: list[TicketRecord] = []
@@ -247,10 +308,14 @@ class ReadinessResponse(BaseModel):
# ---------------------------------------------------------------------------
# Service singletons
# ---------------------------------------------------------------------------
+from backend.services.semantic_duplicate_service import SemanticDuplicateService
+
classifier_service = ClassifierService()
ner_service = NERService()
duplicate_service = DuplicateService()
rag_service = RagService()
+sla_engine = SLAEngine(supabase_client=None) # Will be reassigned after supabase init
+semantic_dupe_service = SemanticDuplicateService(supabase_client=None) # wired in lifespan
try:
from backend.services.gemini_service import GeminiService
@@ -264,6 +329,82 @@ try:
except ImportError:
ocr_service = None
+LANGUAGE_NAMES = {
+ "en": "English",
+ "es": "Spanish",
+ "de": "German",
+ "hi": "Hindi",
+ "fr": "French",
+ "it": "Italian",
+ "pt": "Portuguese",
+ "ja": "Japanese",
+ "ko": "Korean",
+ "zh": "Chinese",
+ "ar": "Arabic",
+ "ru": "Russian",
+}
+
+def _heuristic_language_detection(text: str) -> dict:
+ sample = (text or "").strip()
+ if not sample:
+ return {"code": "en", "name": "English"}
+ ascii_chars = sum(1 for c in sample if ord(c) < 128)
+ ratio = ascii_chars / max(len(sample), 1)
+ if ratio > 0.97:
+ return {"code": "en", "name": "English"}
+ return {"code": "unknown", "name": "Unknown"}
+
+def detect_and_translate_ticket_text(text: str) -> dict:
+ original_text = (text or "").strip()
+ if not original_text:
+ return {
+ "text_for_analysis": text or "",
+ "source_language": "en",
+ "source_language_name": "English",
+ "was_translated": False,
+ "original_text": "",
+ "metadata":{},
+ }
+
+ detected = _heuristic_language_detection(original_text)
+ if gemini_service and getattr(gemini_service, "_initialized", False):
+ detected = gemini_service.detect_language(original_text)
+
+ source_code = str(detected.get("code", "en")).lower()
+ source_name = detected.get("name") or LANGUAGE_NAMES.get(source_code, source_code.upper())
+ if source_code in ("en", "eng"):
+ return {
+ "text_for_analysis": original_text,
+ "source_language": "en",
+ "source_language_name": "English",
+ "was_translated": False,
+ "original_text": original_text,
+ "metadata":{},
+ }
+
+ translated_text = original_text
+ if gemini_service and getattr(gemini_service, "_initialized", False):
+ translated_text = gemini_service.translate_to_english(original_text, source_name)
+
+ if not translated_text or translated_text.strip() == original_text:
+ return {
+ "text_for_analysis": original_text,
+ "source_language": source_code,
+ "source_language_name": source_name,
+ "was_translated": False,
+ "original_text": original_text,
+ "metadata":{},
+ }
+
+ return {
+ "text_for_analysis": translated_text.strip(),
+ "source_language": source_code,
+ "source_language_name": source_name,
+ "was_translated": True,
+ "original_text": original_text,
+ "metadata":{},
+ }
+
# ---------------------------------------------------------------------------
# Lifespan (startup / shutdown)
@@ -273,12 +414,16 @@ async def lifespan(app: FastAPI):
"""Load all models at startup."""
print("[Startup] Loading AI models ...")
try:
- classifier_service.load()
+ redis_cache.connect()
except Exception as e:
+ print(f"[WARNING] Redis cache not available: {e}")
+ try:
+ classifier_service.load()
+ except FileNotFoundError as e:
print(f"[WARNING] Classifier not loaded: {e}")
try:
ner_service.load()
- except Exception as e:
+ except FileNotFoundError as e:
print(f"[WARNING] NER not loaded: {e}")
try:
duplicate_service.load()
@@ -288,50 +433,39 @@ async def lifespan(app: FastAPI):
rag_service.load()
except Exception as e:
print(f"[WARNING] RAG service not loaded: {e}")
+ try:
+ onnx_classifier.load()
+ except Exception as e:
+ print(f"[WARNING] ONNX classifier fallback not loaded: {e}")
if gemini_service:
print(f"[Startup] Gemini Service: {'Initialized' if gemini_service._initialized else 'FAILED (Key missing or SDK error)'}")
else:
print("[Startup] Gemini Service: NOT LOADED (Import failed)")
- print("[Startup] Classifier V2 Shadow: Ready.")
- print("[Startup] Ready.")
- # Strict health checks: fail loudly when core model assets are unavailable.
- # Set ALLOW_DEGRADED_STARTUP=1 to permit degraded startup for local/dev convenience.
- try:
- strict_mode = os.environ.get("ALLOW_DEGRADED_STARTUP", "0") != "1"
- except Exception:
- strict_mode = True
+ # Wire services with supabase client
+ sla_engine.supabase = supabase
+ semantic_dupe_service.supabase = supabase
- classifier_loaded_flag = getattr(classifier_service, "_loaded", False)
- ner_loaded_flag = getattr(ner_service, "_loaded", False)
+ # Pre-load embedding model so first ticket save is fast
+ try:
+ semantic_dupe_service.load()
+ print(f"[Startup] Semantic Duplicate Detection: {'Loaded' if semantic_dupe_service._loaded else 'Failed (model missing)'}")
+ except Exception as e:
+ print(f"[Startup] Semantic Duplicate Detection load error: {e}")
+ print(f"[Startup] SLA Engine: {'Initialized' if supabase else 'Offline (no DB)'}")
- if strict_mode and not classifier_loaded_flag:
- raise RuntimeError("[Startup-FATAL] Classifier assets not loaded. Set ALLOW_DEGRADED_STARTUP=1 to bypass.")
+ # Start background SLA checker as an async task (every 5 minutes)
+ if supabase:
+ from backend.sla_checker import sla_checker_loop_async
+ asyncio.create_task(sla_checker_loop_async(supabase, interval_seconds=300))
+ print("[Startup] SLA background checker started (interval=300s)")
- sla_task = None
- try:
- if supabase and os.environ.get("SLA_ESCALATION_ENABLED", "true").lower() == "true":
- notification_router = None
- try:
- from backend.services.notification_routing import load as load_notification_router
- notification_router = load_notification_router()
- except Exception as e:
- print(f"[WARNING] Notification router not loaded for SLA service: {e}")
- sla_service = load_sla_service(supabase, notification_router)
- interval = int(os.environ.get("SLA_ESCALATION_INTERVAL_SECONDS", "300"))
- sla_task = asyncio.create_task(run_sla_escalation_loop(sla_service, interval_seconds=interval))
- print(f"[Startup] SLA escalation loop enabled ({interval}s interval).")
-
- yield
- finally:
- if sla_task:
- sla_task.cancel()
- try:
- await sla_task
- except asyncio.CancelledError:
- pass
- print("[Shutdown] Cleaning up ...")
+ print("[Startup] Classifier V2 Shadow: Ready.")
+ print(f"[Startup] ONNX MiniLM Fallback: {'READY' if getattr(onnx_classifier, '_loaded', False) else 'DEGRADED (artifacts missing)'}")
+ print("[Startup] Ready.")
+ yield
+ print("[Shutdown] Cleaning up ...")
# ---------------------------------------------------------------------------
@@ -362,6 +496,8 @@ app.add_middleware(
allow_headers=["*"],
)
+app.include_router(auth_cookie_router)
+
# ---------------------------------------------------------------------------
# Root & Health check
@@ -448,17 +584,6 @@ async def root():
"""
-async def verify_metrics_token(x_metrics_token: str | None = Header(default=None)):
- expected_token = os.environ.get("METRICS_TOKEN")
- if expected_token and x_metrics_token != expected_token:
- raise HTTPException(status_code=403, detail="Forbidden")
-
-
-@app.get("/metrics", dependencies=[Depends(verify_metrics_token)])
-def metrics():
- return Response(content=generate_latest(), media_type=CONTENT_TYPE_LATEST)
-
-
@app.get("/health", response_model=HealthResponse)
async def health_check():
return HealthResponse(
@@ -471,29 +596,18 @@ async def health_check():
@app.get("/ready", response_model=ReadinessResponse)
async def readiness_check():
require_supabase = os.environ.get("REQUIRE_SUPABASE", "false").lower() == "true"
- allow_degraded = os.environ.get("ALLOW_DEGRADED_STARTUP", "0") == "1"
-
checks = {
"api": True,
"classifier_loaded": classifier_service._loaded,
"ner_loaded": ner_service._loaded,
- "duplicate_index_loaded": duplicate_service.is_available(),
- "rag_loaded": rag_service.is_available(),
+ "duplicate_index_loaded": duplicate_service._loaded,
+ "rag_loaded": rag_service._loaded,
}
if require_supabase:
checks["supabase_configured"] = supabase is not None
- # In degraded mode, duplicate and RAG services are optional
- if allow_degraded:
- required_checks = {k: v for k, v in checks.items() if k not in ["duplicate_index_loaded", "rag_loaded"]}
- all_required_pass = all(required_checks.values())
-
- if all_required_pass:
- return ReadinessResponse(status="ready", checks=checks)
- else:
- # Strict mode: all checks must pass
- if all(checks.values()):
- return ReadinessResponse(status="ready", checks=checks)
+ if all(checks.values()):
+ return ReadinessResponse(status="ready", checks=checks)
return JSONResponse(
status_code=503,
@@ -634,31 +748,6 @@ async def get_tickets(company_id: str | None = None):
res = query.execute()
return res.data
-@app.get("/tickets/search")
-async def search_tickets(q: str | None = None, company_id: str | None = None, limit: int = 50, offset: int = 0):
- """Search tickets using tenant-safe full-text search."""
- if not supabase:
- raise HTTPException(status_code=500, detail="Database connection not initialized")
-
- if not q:
- raise HTTPException(status_code=400, detail="Search query is required")
- if not company_id:
- raise HTTPException(status_code=400, detail="company_id is required for tenant-safe search")
-
- try:
- result = supabase.rpc(
- "search_tickets",
- {
- "query_text": q,
- "company_id": company_id,
- "limit_rows": limit,
- "offset_rows": offset,
- },
- ).execute()
- return result.data or []
- except Exception as e:
- raise HTTPException(status_code=500, detail=f"Search failed: {e}")
-
@app.post("/tickets/save")
async def save_ticket(request_body: TicketSaveRequest):
"""
@@ -669,64 +758,80 @@ async def save_ticket(request_body: TicketSaveRequest):
raise HTTPException(status_code=500, detail="Supabase connection not initialized.")
logger = logging.getLogger(__name__)
- try:
- final_data = request_body.dict()
-
- # Resolve tenant linkage from user profile with authorization validation.
- profile = {}
- if request_body.user_id:
- try:
- profile_res = (
- supabase.table("profiles")
- .select("company_id, company")
- .eq("id", request_body.user_id)
- .single()
- .execute()
- )
- profile = profile_res.data or {}
- if not profile:
- raise HTTPException(status_code=404, detail="User profile not found")
-
- # SELF-HEALING: If company_id is null in database but company name exists, resolve it!
- if not profile.get("company_id") and profile.get("company"):
- try:
- comp_name = profile.get("company").strip()
- comp_res = (
- supabase.table("companies")
- .select("id")
- .ilike("name", comp_name)
- .execute()
- )
- if comp_res.data:
- resolved_company_id = comp_res.data[0]["id"]
- # Backfill the profile table in real-time
- supabase.table("profiles").update({"company_id": resolved_company_id}).eq("id", request_body.user_id).execute()
- profile["company_id"] = resolved_company_id
- logger.info(f"[SELF-HEALING] Backfilled company_id={resolved_company_id} for user={request_body.user_id}")
- except Exception as healing_err:
- logger.warning(f"[SELF-HEALING WARNING] Failed to backfill company_id: {healing_err}")
- except HTTPException:
- raise
- except Exception as profile_error:
- user_hash = hashlib.sha256(str(request_body.user_id).encode()).hexdigest()[:8]
- logger.error(f"Tenant resolution error for user {user_hash}: {profile_error}")
- raise HTTPException(status_code=503, detail="Failed to resolve tenant linkage") from profile_error
-
- # Validate tenant consistency and authorization.
- profile_company_id = profile.get("company_id")
- if final_data.get("company_id"):
- # User provided company_id: verify it matches their profile.
- if profile_company_id and final_data["company_id"] != profile_company_id:
- user_hash = hashlib.sha256(str(request_body.user_id).encode()).hexdigest()[:8]
- logger.warning(f"Tenant mismatch: user {user_hash} attempted {final_data['company_id']}, assigned to {profile_company_id}")
- raise HTTPException(status_code=403, detail="User not authorized for this tenant")
- elif profile_company_id:
- # Backfill company_id from profile.
- final_data["company_id"] = profile_company_id
- elif request_body.user_id:
- # User has no tenant assignment.
- raise HTTPException(status_code=400, detail="User has no tenant assignment")
+ final_data = request_body.model_dump()
+ original_subject = final_data.get("subject", "") or ""
+ original_description = final_data.get("description", "") or ""
+
+ # Detect language and translate subject/description into English before downstream routing/indexing.
+ translation_probe_text = (original_description.strip() or original_subject.strip())
+ translation_ctx = detect_and_translate_ticket_text(translation_probe_text)
+ metadata = final_data.get("metadata") or {}
+ if translation_ctx["was_translated"]:
+ translated_subject = gemini_service.translate_to_english(original_subject, translation_ctx["source_language_name"]) if original_subject else original_subject
+ translated_description = gemini_service.translate_to_english(original_description, translation_ctx["source_language_name"]) if original_description else original_description
+ final_data["subject"] = translated_subject or original_subject
+ final_data["description"] = translated_description or original_description
+ metadata["original_text"] = {
+ "subject": original_subject,
+ "description": original_description,
+ }
+ metadata["translation"] = {
+ "translated": bool(translation_ctx["was_translated"]),
+ "source_language": translation_ctx["source_language"],
+ "source_language_name": translation_ctx["source_language_name"],
+ }
+ final_data["metadata"] = metadata
+
+ # Backfill SLA deadlines/status when the client omits or sends empty values.
+ priority_key = str(final_data.get("priority") or "medium").lower().strip()
+ now_utc = datetime.datetime.now(datetime.timezone.utc)
+
+ if not str(final_data.get("sla_breach_at") or "").strip():
+ final_data["sla_breach_at"] = compute_sla_breach_at(priority_key, now_utc)
+
+ if not str(final_data.get("sla_response_due_at") or "").strip():
+ policy = get_sla_policy(priority_key)
+ response_hours = max(1, int(round(float(policy["max_hours"]) * 0.25)))
+ response_due_at = now_utc + datetime.timedelta(hours=response_hours)
+ final_data["sla_response_due_at"] = response_due_at.isoformat()
+
+ if not str(final_data.get("sla_status") or "").strip():
+ final_data["sla_status"] = "ACTIVE"
+ # Resolve tenant linkage from user profile with authorization validation.
+ profile = {}
+ if request_body.user_id:
+ try:
+ profile_res = (
+ supabase.table("profiles")
+ .select("company_id, company")
+ .eq("id", request_body.user_id)
+ .single()
+ .execute()
+ )
+ profile = profile_res.data or {}
+ if not profile:
+ raise HTTPException(status_code=404, detail="User profile not found")
+ except HTTPException:
+ raise
+ except Exception as profile_error:
+ logger.error(f"Tenant resolution error for user {request_body.user_id}: {profile_error}")
+ raise HTTPException(status_code=503, detail="Failed to resolve tenant linkage") from profile_error
+
+ # Validate tenant consistency and authorization.
+ profile_company_id = profile.get("company_id")
+ if final_data.get("company_id"):
+ # User provided company_id: verify it matches their profile.
+ if profile_company_id and final_data["company_id"] != profile_company_id:
+ logger.warning(f"Tenant mismatch: user {request_body.user_id} attempted {final_data['company_id']}, assigned to {profile_company_id}")
+ raise HTTPException(status_code=403, detail="User not authorized for this tenant")
+ elif profile_company_id:
+ # Backfill company_id from profile.
+ final_data["company_id"] = profile_company_id
+ elif request_body.user_id:
+ # User has no tenant assignment.
+ raise HTTPException(status_code=400, detail="User has no tenant assignment")
+ try:
# Backfill company name if missing.
if not final_data.get("company") and profile.get("company"):
final_data["company"] = profile["company"]
@@ -752,19 +857,28 @@ async def save_ticket(request_body: TicketSaveRequest):
"is_potential_duplicate": False,
"similarity": 0.0,
}
+ user_hash = hashlib.sha256(str(request_body.user_id).encode()).hexdigest()[:8]
+ logger.info(f"Tenant linkage: user_hash={user_hash}, company_id={final_data.get('company_id')}")
- if duplicate_text:
- duplicate_result = detect_semantic_duplicate(
- duplicate_text,
- company_id=final_data.get("company_id"),
- threshold=duplicate_threshold,
- )
- final_data["description_vector"] = duplicate_service.generate_embedding(duplicate_text)
- else:
- final_data["description_vector"] = None
- final_data["is_potential_duplicate"] = duplicate_result.get("is_potential_duplicate", False)
- final_data["parent_ticket_id"] = duplicate_result.get("parent_ticket_id")
+ # Semantic duplicate check BEFORE inserting the ticket
+ # This allows us to warn the user before confirming
+ duplicate_check_result = None
+ try:
+ dupe_text = (request_body.description or request_body.subject or "").strip()
+ if dupe_text:
+ duplicate_check_result = await semantic_dupe_service.check_duplicate(
+ text=dupe_text,
+ company_id=final_data.get("company_id"),
+ )
+ if duplicate_check_result["is_duplicate"]:
+ logger.info(
+ f"[DUPLICATE] Ticket flagged as potential duplicate of "
+ f"{duplicate_check_result['duplicate_ticket_id']} "
+ f"(similarity: {duplicate_check_result['similarity']})"
+ )
+ except Exception as e:
+ logger.warning(f"[DUPLICATE] Semantic check error (non-fatal): {e}")
# --- Sanitize payload to only include valid Supabase DB columns ---
# Extra AI telemetry and non-existent schema fields are merged into the metadata JSONB column
@@ -772,13 +886,14 @@ async def save_ticket(request_body: TicketSaveRequest):
VALID_TICKET_COLUMNS = {
"user_id", "subject", "description", "category", "subcategory",
"priority", "assigned_team", "status", "auto_resolve", "is_duplicate",
- "confidence", "image_url", "company", "company_id", "sla_breach_at", "metadata",
+ "confidence", "image_url", "company", "company_id",
+ "sla_breach_at", "sla_response_due_at", "sla_status", "escalation_level", "metadata",
}
# Merge any extra telemetry and SLA/duplicate fields into metadata before filtering
existing_metadata = final_data.get("metadata") or {}
extra_keys = (
"entities", "solution_steps", "ocr_text", "needs_review", "routing_confidence",
- "is_potential_duplicate", "parent_ticket_id", "sla_response_due_at", "sla_status", "escalation_level"
+ "is_potential_duplicate", "parent_ticket_id"
)
for extra_key in extra_keys:
if extra_key in final_data and final_data[extra_key] not in (None, "", [], {}):
@@ -795,19 +910,29 @@ async def save_ticket(request_body: TicketSaveRequest):
ticket_id = res.data[0]["id"]
- duplicate_indexed = True
- duplicate_index_warning = None
+ # If duplicate detected, link parent ticket
+ if duplicate_check_result and duplicate_check_result["is_duplicate"]:
+ try:
+ supabase.table("tickets").update({
+ "is_potential_duplicate": True,
+ "parent_ticket_id": duplicate_check_result["duplicate_ticket_id"],
+ }).eq("id", ticket_id).execute()
+ except Exception as e:
+ logger.warning(f"[DUPLICATE] Failed to link parent ticket: {e}")
+
+ # Index the new ticket's embedding for future duplicate checks
+ embedding_indexed = False
+ description_text = (request_body.description or "").strip()
+ subject_text = (request_body.subject or "").strip()
+ duplicate_text = description_text or subject_text
if duplicate_text:
try:
+ # Both: old in-memory index (for backward compat) and new pgvector index
duplicate_service.add_ticket(str(ticket_id), duplicate_text)
+ asyncio.create_task(semantic_dupe_service.index_ticket(ticket_id, duplicate_text))
+ embedding_indexed = True
except Exception as index_error:
- duplicate_indexed = False
- duplicate_index_warning = "Duplicate index update failed."
- print(f"[WARNING] {duplicate_index_warning} ticket_id={ticket_id} error={index_error}")
- else:
- duplicate_indexed = False
- duplicate_index_warning = "Duplicate index update skipped: no description or subject text was provided."
- print(f"[WARNING] {duplicate_index_warning}")
+ logger.warning(f"[INDEX] Failed to index ticket {ticket_id}: {index_error}")
# Add initial system diagnostic message
msg = "Our Neural Engine has successfully triaged your issue and routed it to the designated team."
@@ -825,12 +950,14 @@ async def save_ticket(request_body: TicketSaveRequest):
response = {
"status": "success",
"ticket_id": ticket_id,
- "duplicate_indexed": duplicate_indexed,
- "is_potential_duplicate": final_data["is_potential_duplicate"],
- "parent_ticket_id": final_data["parent_ticket_id"],
+ "duplicate_indexed": embedding_indexed,
}
- if duplicate_index_warning:
- response["duplicate_index_warning"] = duplicate_index_warning
+ if duplicate_check_result and duplicate_check_result["is_duplicate"]:
+ response["duplicate_warning"] = True
+ response["parent_ticket_id"] = duplicate_check_result["duplicate_ticket_id"]
+ response["parent_subject"] = duplicate_check_result.get("parent_subject")
+ response["similarity"] = duplicate_check_result["similarity"]
+ response["candidates"] = duplicate_check_result.get("candidates", [])
return response
except Exception as e:
@@ -838,17 +965,70 @@ async def save_ticket(request_body: TicketSaveRequest):
raise HTTPException(status_code=500, detail=str(e))
@app.get("/tickets/{ticket_id}")
-async def get_ticket_by_id(ticket_id: str):
+async def get_ticket_by_id(
+ request: Request,
+ ticket_id: str,
+):
"""Fetch single persistent ticket."""
if not supabase:
raise HTTPException(status_code=500, detail="Database connection not initialized")
-
+
+ # Guard route overlap where '/tickets/search' may be matched here first.
+ if ticket_id == "search":
+ return await search_tickets(
+ q=request.query_params.get("q", ""),
+ company_id=request.query_params.get("company_id"),
+ )
+
res = supabase.table("tickets").select("*").eq("id", ticket_id).single().execute()
if not res.data:
raise HTTPException(status_code=404, detail="Ticket not found")
return res.data
+@app.get("/tickets/{ticket_id}/audit_logs", response_model=list[AuditLogRecord])
+async def get_ticket_audit_logs(ticket_id: str, company_id: str):
+ """Return a company-scoped chronological audit trail for a ticket."""
+ if not supabase:
+ raise HTTPException(status_code=500, detail="Database connection not initialized")
+
+ try:
+ service = AuditLogService(supabase)
+ return service.get_ticket_audit_logs(ticket_id, company_id)
+ except AuditLogAccessError as err:
+ raise HTTPException(status_code=err.status_code, detail=err.detail)
+
+
+@app.get("/tickets/search")
+async def search_tickets(q: str, company_id: str | None = None):
+ """Search tickets by query text, optionally scoped by company_id."""
+ if not supabase:
+ raise HTTPException(status_code=500, detail="Database connection not initialized")
+ query_text = (q or "").strip()
+ if not query_text:
+ raise HTTPException(status_code=400, detail="Query text is required")
+
+ try:
+ rpc_res = supabase.rpc(
+ "search_tickets",
+ {"query_text": query_text, "company_id": company_id},
+ ).execute()
+ return rpc_res.data or []
+ except Exception:
+ # Fallback for environments without RPC function support.
+ fallback = supabase.table("tickets").select("*").order("created_at", desc=True).execute()
+ rows = fallback.data or []
+ lowered = query_text.lower()
+ filtered = [
+ row for row in rows
+ if lowered in str(row.get("subject", "")).lower()
+ or lowered in str(row.get("description", "")).lower()
+ ]
+ if company_id:
+ filtered = [row for row in filtered if row.get("company_id") == company_id]
+ return filtered
+
+
@app.post("/tickets", response_model=TicketRecord)
async def create_ticket(ticket: TicketRecord):
"""Save a new ticket into the system."""
@@ -887,11 +1067,6 @@ async def analyze_ticket(request_body: TicketRequest, request: Request):
Main endpoint for analyzing a new ticket using the cascade of local AI models.
"""
text = request_body.text
-
- settings = get_system_settings(request_body.company_id)
- confidence_threshold = settings["ai_confidence_threshold"]
- duplicate_sensitivity = settings["duplicate_sensitivity"]
- enable_auto_resolve = settings["enable_auto_resolve"]
# Grab client metadata
client_ip = request.client.host if request.client else "unknown"
@@ -924,6 +1099,8 @@ async def analyze_only(request_body: TicketRequest):
and duplicate check before committing to a ticket creation.
"""
text = request_body.text
+ translation_ctx = detect_and_translate_ticket_text(text)
+ text = translation_ctx["text_for_analysis"]
print(f"[AI] Starting Analysis (READ-ONLY) for: {text[:50]}...")
settings = get_system_settings(request_body.company)
confidence_threshold = settings["ai_confidence_threshold"]
@@ -968,6 +1145,10 @@ async def analyze_only(request_body: TicketRequest):
is_potential_duplicate=False,
parent_ticket_id=None,
sla_breach_at=_sla_breach.isoformat().replace("+00:00", "Z"),
+ original_text=request_body.text,
+ source_language=translation_ctx["source_language"],
+ source_language_name=translation_ctx["source_language_name"],
+ was_translated=translation_ctx["was_translated"],
)
# --- Context & Environment ---
@@ -1000,36 +1181,7 @@ async def analyze_only(request_body: TicketRequest):
summary = text[:100] + ("…" if len(text) > 100 else "")
# --- Classification ---
- try:
- classification_v3_res = classifier_v3.predict(text)
- if "error" in classification_v3_res:
- # Fallback to V1
- classification = classifier_service.predict(text)
- else:
- # Parse V3 output
- cat = classification_v3_res.get("Category", {}).get("prediction", "Unknown")
- sub = classification_v3_res.get("Subcategory", {}).get("prediction", "Unknown")
- pri = classification_v3_res.get("priority", {}).get("prediction", "Medium")
- conf = classification_v3_res.get("Category", {}).get("confidence", 0.0)
-
- from backend.services.classifier_service import TEAM_MAP, AUTO_RESOLVE_SUBS
- assigned_team = TEAM_MAP.get(cat, "General Support")
- auto_resolve = sub in AUTO_RESOLVE_SUBS
-
- classification = {
- "category": cat,
- "subcategory": sub,
- "priority": pri,
- "auto_resolve": auto_resolve,
- "assigned_team": assigned_team,
- "confidence": float(conf)
- }
- except Exception as e:
- traceback.print_exc()
- classification = {
- "category": "Unknown", "subcategory": "Unknown", "priority": "Medium",
- "auto_resolve": False, "assigned_team": "General Support", "confidence": 0.0,
- }
+ classification = classify_ticket_text(text)
timeline["ai_analyzed"] = get_now_ist()
timeline["triaged"] = get_now_ist()
@@ -1043,21 +1195,10 @@ async def analyze_only(request_body: TicketRequest):
timeline["metadata_harvested"] = get_now_ist()
# --- Duplicate detection ---
- duplicate_threshold = get_duplicate_threshold(request_body.company_id, duplicate_sensitivity)
try:
- dup_result = detect_semantic_duplicate(
- text,
- company_id=request_body.company_id,
- threshold=duplicate_threshold,
- )
+ dup_result = duplicate_service.check_duplicate(text, threshold=request_body.duplicate_sensitivity)
except Exception:
- dup_result = {
- "is_duplicate": False,
- "duplicate_ticket_id": None,
- "parent_ticket_id": None,
- "is_potential_duplicate": False,
- "similarity": 0.0,
- }
+ dup_result = {"is_duplicate": False, "duplicate_ticket_id": None, "similarity": 0.0}
# --- RAG Knowledge Base Check ---
rag_match = None
@@ -1073,7 +1214,7 @@ async def analyze_only(request_body: TicketRequest):
# --- Reasoning ---
decision_factors = []
- if classification["confidence"] > confidence_threshold:
+ if classification["confidence"] > request_body.confidence_threshold:
decision_factors.append(f"High confidence match for '{classification['subcategory']}'")
if entities:
decision_factors.append(f"Detected entities: {', '.join([e['text'] for e in entities[:2]])}")
@@ -1083,14 +1224,6 @@ async def analyze_only(request_body: TicketRequest):
decision_factors.append(f"Found solution article: '{rag_match['title']}'")
reasoning = f"Categorized as '{classification['category']}' - {classification['subcategory']}."
- if (
- enable_auto_resolve
- and classification["confidence"] >= confidence_threshold
- and classification["auto_resolve"]
- ):
- classification["auto_resolve"] = True
- else:
- classification["auto_resolve"] = False
if classification["auto_resolve"]:
reasoning += " Flagged for AI auto-resolution via Knowledge Base." if rag_match else " Flagged for auto-resolution."
@@ -1100,8 +1233,10 @@ async def analyze_only(request_body: TicketRequest):
if gemini_service and gemini_service._initialized:
summary = gemini_service.get_summary(text)
- # Convert priority to the SLA resolution target timestamp for preview.
- sla_breach_dt = calculate_sla_breach_at(classification["priority"])
+ # Convert priority to SLA breached timestamp (for preview)
+ hours_map = {"Critical": 2, "High": 8, "Medium": 24, "Low": 72}
+ sla_hours = hours_map.get(classification["priority"], 72)
+ sla_breach_dt = datetime.datetime.utcnow() + datetime.timedelta(hours=sla_hours)
return TicketResponse(
ticket_id=str(uuid.uuid4()), # Temporary ID
@@ -1114,17 +1249,21 @@ async def analyze_only(request_body: TicketRequest):
entities=[EntityInfo(**e) for e in entities],
duplicate_ticket=DuplicateInfo(**dup_result),
confidence=classification["confidence"],
- needs_review=classification["confidence"] < confidence_threshold,
+ needs_review=classification["confidence"] < 0.20,
reasoning=reasoning,
decision_factors=decision_factors,
image_description=gemini_analysis["image_description"],
ocr_text=gemini_analysis["ocr_text"],
- highlights=entities, # Use entities as highlights for now
+ highlights=[e.get("text", "") for e in entities], # Use entity texts as highlights for now
timeline=timeline,
env_metadata=env_metadata,
is_potential_duplicate=dup_result.get("is_potential_duplicate", False),
parent_ticket_id=dup_result.get("parent_ticket_id"),
- sla_breach_at=sla_breach_dt.isoformat().replace("+00:00", "Z")
+ sla_breach_at=sla_breach_dt.isoformat().replace("+00:00", "Z"),
+ original_text=translation_ctx["original_text"],
+ source_language=translation_ctx["source_language"],
+ source_language_name=translation_ctx["source_language_name"],
+ was_translated=translation_ctx["was_translated"],
)
@app.post("/ai/analyze_stream")
@@ -1143,11 +1282,7 @@ async def analyze_stream(request_body: TicketRequest):
"model_version": "3.0.0-PRO",
"api_endpoint": "/ai/analyze_stream"
}
- timeline = {"received": get_now_ist()}
- settings = get_system_settings(request_body.company_id)
- confidence_threshold = settings["ai_confidence_threshold"]
- duplicate_sensitivity = settings["duplicate_sensitivity"]
- enable_auto_resolve = settings["enable_auto_resolve"]
+ timeline = {"received": get_now_ist()}
# 1. Reading
yield f"data: {json.dumps({'step': 'Reading your message', 'status': 'in_progress'})}\n\n"
@@ -1175,33 +1310,7 @@ async def analyze_stream(request_body: TicketRequest):
# 3. Classification
yield f"data: {json.dumps({'step': 'Detecting category and priority', 'status': 'in_progress'})}\n\n"
await asyncio.sleep(0.2)
- try:
- classification_v3_res = classifier_v3.predict(text)
- if "error" in classification_v3_res:
- classification = classifier_service.predict(text)
- else:
- cat = classification_v3_res.get("Category", {}).get("prediction", "Unknown")
- sub = classification_v3_res.get("Subcategory", {}).get("prediction", "Unknown")
- pri = classification_v3_res.get("priority", {}).get("prediction", "Medium")
- conf = classification_v3_res.get("Category", {}).get("confidence", 0.0)
-
- from backend.services.classifier_service import TEAM_MAP, AUTO_RESOLVE_SUBS
- assigned_team = TEAM_MAP.get(cat, "General Support")
- auto_resolve = sub in AUTO_RESOLVE_SUBS
-
- classification = {
- "category": cat,
- "subcategory": sub,
- "priority": pri,
- "auto_resolve": auto_resolve,
- "assigned_team": assigned_team,
- "confidence": float(conf)
- }
- except Exception as e:
- classification = {
- "category": "Unknown", "subcategory": "Unknown", "priority": "Medium",
- "auto_resolve": False, "assigned_team": "General Support", "confidence": 0.0,
- }
+ classification = classify_ticket_text(text)
timeline["ai_analyzed"] = get_now_ist()
timeline["triaged"] = get_now_ist()
@@ -1209,20 +1318,9 @@ async def analyze_stream(request_body: TicketRequest):
yield f"data: {json.dumps({'step': 'Checking duplicate issues', 'status': 'in_progress'})}\n\n"
await asyncio.sleep(0.2)
try:
- duplicate_threshold = get_duplicate_threshold(request_body.company_id, duplicate_sensitivity)
- dup_result = detect_semantic_duplicate(
- text,
- company_id=request_body.company_id,
- threshold=duplicate_threshold,
- )
+ dup_result = duplicate_service.check_duplicate(text, threshold=request_body.duplicate_sensitivity)
except Exception:
- dup_result = {
- "is_duplicate": False,
- "duplicate_ticket_id": None,
- "parent_ticket_id": None,
- "is_potential_duplicate": False,
- "similarity": 0.0,
- }
+ dup_result = {"is_duplicate": False, "duplicate_ticket_id": None, "similarity": 0.0}
# 5. RAG / Solutions
yield f"data: {json.dumps({'step': 'Finding possible solutions', 'status': 'in_progress'})}\n\n"
@@ -1238,7 +1336,7 @@ async def analyze_stream(request_body: TicketRequest):
pass
decision_factors = []
- if classification["confidence"] > confidence_threshold:
+ if classification["confidence"] > request_body.confidence_threshold:
decision_factors.append(f"High confidence match for '{classification['subcategory']}'")
if entities:
decision_factors.append(f"Detected entities: {', '.join([e['text'] for e in entities[:2]])}")
@@ -1247,8 +1345,6 @@ async def analyze_stream(request_body: TicketRequest):
if rag_match:
decision_factors.append(f"Found solution article: '{rag_match['title']}'")
- if not enable_auto_resolve:
- classification["auto_resolve"] = False
reasoning = f"Categorized as '{classification['category']}' - {classification['subcategory']}."
if classification["auto_resolve"]:
reasoning += " Flagged for AI auto-resolution via Knowledge Base." if rag_match else " Flagged for auto-resolution."
@@ -1258,7 +1354,9 @@ async def analyze_stream(request_body: TicketRequest):
if gemini_service and gemini_service._initialized:
summary = gemini_service.get_summary(text)
- sla_breach_dt = calculate_sla_breach_at(classification["priority"])
+ hours_map = {"Critical": 2, "High": 8, "Medium": 24, "Low": 72}
+ sla_hours = hours_map.get(classification["priority"], 72)
+ sla_breach_dt = datetime.datetime.utcnow() + datetime.timedelta(hours=sla_hours)
ticket_response_dict = {
"ticket_id": str(uuid.uuid4()),
@@ -1271,17 +1369,15 @@ async def analyze_stream(request_body: TicketRequest):
"entities": [e for e in entities],
"duplicate_ticket": dup_result,
"confidence": classification["confidence"],
- "needs_review": classification["confidence"] < confidence_threshold,
+ "needs_review": classification["confidence"] < 0.20,
"reasoning": reasoning,
"decision_factors": decision_factors,
"image_description": gemini_analysis["image_description"],
"ocr_text": gemini_analysis["ocr_text"],
- "highlights": entities,
+ "highlights": [e.get("text", "") for e in entities],
"timeline": timeline,
"env_metadata": env_metadata,
- "is_potential_duplicate": dup_result.get("is_potential_duplicate", False),
- "parent_ticket_id": dup_result.get("parent_ticket_id"),
- "sla_breach_at": sla_breach_dt.isoformat().replace("+00:00", "Z")
+ "sla_breach_at": sla_breach_dt.isoformat() + "Z"
}
# 6. Final Result
@@ -1313,3 +1409,258 @@ async def analyze_ticket_v2(request: TicketRequest):
}
except Exception as e:
raise HTTPException(status_code=500, detail=str(e))
+
+
+# ---------------------------------------------------------------------------
+# SLA Engine Endpoints
+# ---------------------------------------------------------------------------
+
+class SLAStatsResponse(BaseModel):
+ total: int = 0
+ active: int = 0
+ breached: int = 0
+ warning: int = 0
+ met: int = 0
+ breach_rate: float = 0.0
+ by_priority: dict = {}
+
+
+@app.get("/sla/stats", response_model=SLAStatsResponse)
+async def sla_stats():
+ """Get aggregated SLA dashboard statistics across all tickets."""
+ if not supabase:
+ raise HTTPException(status_code=503, detail="Database not connected")
+ stats = await sla_engine.get_dashboard_stats()
+ if "error" in stats:
+ raise HTTPException(status_code=500, detail=stats["error"])
+ return stats
+
+
+class SLATicketInfo(BaseModel):
+ id: str
+ ticket_id: str | None = None
+ subject: str | None = None
+ summary: str | None = None
+ priority: str = "medium"
+ status: str | None = None
+ assigned_team: str | None = None
+ sla_status: str = "active"
+ escalation_level: int = 0
+ remaining_seconds: int = 0
+ created_at: str | None = None
+ sla_breach_at: str | None = None
+ sla_warning_at: str | None = None
+ last_escalated_at: str | None = None
+
+
+@app.get("/sla/tickets")
+async def sla_tickets(
+ status: str | None = None,
+ priority: str | None = None,
+ limit: int = 100,
+ offset: int = 0,
+):
+ """
+ List tickets with SLA status. Filter by sla_status and/or priority.
+ """
+ if not supabase:
+ raise HTTPException(status_code=503, detail="Database not connected")
+
+ query = (
+ supabase.table("tickets")
+ .select("id, ticket_id, subject, summary, priority, status, assigned_team, sla_status, escalation_level, remaining_seconds, created_at, sla_breach_at, sla_warning_at, last_escalated_at")
+ .order("created_at", desc=True)
+ )
+
+ if status and status != "all":
+ query = query.eq("sla_status", status)
+ if priority and priority != "all":
+ query = query.eq("priority", priority.capitalize())
+
+ query = query.range(offset, offset + limit - 1)
+ res = query.execute()
+ return {"tickets": res.data or [], "total": len(res.data or [])}
+
+
+class EscalationLogEntry(BaseModel):
+ id: str
+ ticket_id: str | None = None
+ ticket_subject: str = ""
+ priority: str = "medium"
+ sla_status: str = ""
+ escalation_level: int = 0
+ remaining_seconds: int = 0
+ assigned_team: str = ""
+ notification_channels: list = []
+ triggered_at: str | None = None
+ resolved_at: str | None = None
+ notes: str = ""
+
+
+@app.get("/sla/escalations")
+async def sla_escalations(limit: int = 50, offset: int = 0):
+ """Fetch escalation log history."""
+ if not supabase:
+ raise HTTPException(status_code=503, detail="Database not connected")
+
+ try:
+ res = (
+ supabase.table("escalation_logs")
+ .select("*")
+ .order("triggered_at", desc=True)
+ .range(offset, offset + limit - 1)
+ .execute()
+ )
+ return {"escalations": res.data or [], "total": len(res.data or [])}
+ except Exception as e:
+ # Table might not exist yet
+ print(f"[SLA] Escalation logs query failed: {e}")
+ return {"escalations": [], "total": 0}
+
+
+class SLAPolicyInfo(BaseModel):
+ id: str
+ priority: str
+ max_hours: int
+ warning_pct: float
+ auto_escalate: bool
+ l2_after_minutes: int
+ l3_after_minutes: int
+
+
+@app.get("/sla/policies")
+async def sla_policies():
+ """Get configured SLA policies."""
+ if not supabase:
+ # Return defaults from code
+ policies = []
+ for pri, cfg in sla_engine.SLA_POLICIES.items() if hasattr(sla_engine, 'SLA_POLICIES') else SLA_POLICIES.items():
+ policies.append({
+ "priority": pri,
+ "max_hours": cfg["max_hours"],
+ "warning_pct": cfg["warning_pct"],
+ "auto_escalate": cfg["auto_escalate_on_breach"],
+ "l2_after_minutes": cfg["l2_escalation_mins"],
+ "l3_after_minutes": cfg["l3_escalation_mins"],
+ })
+ return {"policies": policies}
+
+ try:
+ res = supabase.table("sla_policies").select("*").execute()
+ return {"policies": res.data or []}
+ except Exception as e:
+ print(f"[SLA] Policies query failed: {e}")
+ return {"policies": []}
+
+
+@app.post("/sla/check")
+async def trigger_sla_check():
+ """Manually trigger an SLA evaluation cycle (admin)."""
+ if not supabase:
+ raise HTTPException(status_code=503, detail="Database not connected")
+
+ asyncio.create_task(sla_engine.check_all_active_tickets())
+ return {"status": "triggered", "message": "SLA check cycle started in background"}
+
+
+# ---------------------------------------------------------------------------
+# Semantic Duplicate Detection Endpoints
+# ---------------------------------------------------------------------------
+
+@app.post("/ai/check_duplicate")
+async def check_duplicate_endpoint(
+ body: TicketRequest,
+ company_id: str | None = None,
+):
+ """
+ Check a ticket text for potential duplicates using semantic vector search.
+ Returns top candidates with similarity scores.
+ """
+ text = (body.text or "").strip()
+ if not text:
+ raise HTTPException(status_code=400, detail="No text provided")
+
+ threshold = body.duplicate_sensitivity if hasattr(body, 'duplicate_sensitivity') else None
+ result = await semantic_dupe_service.check_duplicate(
+ text=text,
+ company_id=company_id or body.company,
+ threshold=threshold,
+ )
+ return result
+
+
+@app.post("/ai/reindex_embeddings")
+async def reindex_embeddings():
+ """Re-generate vector embeddings for all tickets."""
+ result = await semantic_dupe_service.reindex_all()
+ return result
+
+
+@app.get("/system/settings")
+async def get_system_settings_endpoint():
+ """Fetch all system settings."""
+ if not supabase:
+ raise HTTPException(status_code=503, detail="Database not connected")
+ try:
+ res = supabase.table("system_settings").select("*").execute()
+ settings = {}
+ for row in res.data or []:
+ settings[row["key"]] = row["value"]
+ return settings
+ except Exception as e:
+ logger.warning(f"[SETTINGS] Query failed: {e}")
+ return {}
+
+
+@app.patch("/system/settings")
+async def update_system_settings(body: dict):
+ """Update a specific system setting."""
+ if not supabase:
+ raise HTTPException(status_code=503, detail="Database not connected")
+ key = body.get("key")
+ value = body.get("value")
+ if not key or value is None:
+ raise HTTPException(status_code=400, detail="key and value required")
+ try:
+ supabase.table("system_settings").upsert({
+ "key": key,
+ "value": value,
+ "updated_at": datetime.datetime.utcnow().isoformat() + "Z",
+ }).execute()
+ return {"status": "updated", "key": key}
+ except Exception as e:
+ raise HTTPException(status_code=500, detail=str(e))
+
+
+@app.get("/sla/tickets/{ticket_id}")
+async def sla_ticket_detail(ticket_id: str):
+ """Get detailed SLA info for a specific ticket."""
+ if not supabase:
+ raise HTTPException(status_code=503, detail="Database not connected")
+
+ # Fetch ticket
+ res = supabase.table("tickets").select("*").eq("id", ticket_id).single().execute()
+ if not res.data:
+ raise HTTPException(status_code=404, detail="Ticket not found")
+
+ ticket = res.data
+ result = sla_engine.evaluate_ticket(ticket)
+
+ # Fetch escalation history for this ticket
+ try:
+ esc_res = (
+ supabase.table("escalation_logs")
+ .select("*")
+ .eq("ticket_id", ticket_id)
+ .order("triggered_at", desc=True)
+ .execute()
+ )
+ escalations = esc_res.data or []
+ except Exception:
+ escalations = []
+
+ return {
+ "ticket": ticket,
+ "sla_evaluation": result,
+ "escalations": escalations,
+ }
diff --git a/backend/requirements.txt b/backend/requirements.txt
index 027a7ecfa63483eb6b341c26c4b095262fa00321..0ec23b13046705677428103b048ab20fe0a53130 100644
--- a/backend/requirements.txt
+++ b/backend/requirements.txt
@@ -4,6 +4,8 @@ datasets>=2.14.0
pandas>=2.0.0
scikit-learn>=1.3.0
sentence-transformers>=2.2.0
+onnxruntime>=1.17.0
+tokenizers>=0.15.0
fastapi>=0.104.0
uvicorn>=0.24.0
openpyxl>=3.1.0
@@ -15,4 +17,9 @@ easyocr
slowapi>=0.1.9
supabase==2.22.4
storage3==2.22.4
-prometheus-client>=0.17.0
+redis>=5.0.0
+pytest
+pytest-asyncio
+httpx
+cryptography>=42.0.0
+
diff --git a/backend/services/classifier_service.py b/backend/services/classifier_service.py
index 724c96394e0bd562e17b554e37c585564aca81cc..4ebf523750fd6794f2ad730539fc442959a2b69a 100644
--- a/backend/services/classifier_service.py
+++ b/backend/services/classifier_service.py
@@ -6,27 +6,20 @@ Priority and other fields are derived from the category mapping.
import os
import json
-import torch
-import torch.nn.functional as F
-from transformers import DistilBertTokenizerFast, DistilBertForSequenceClassification
-import time
-from prometheus_client import Counter, Histogram
-
-# Prometheus metrics for tracking model performance
-MODEL_PREDICTIONS_TOTAL = Counter(
- "model_predictions_total",
- "Total count of DistilBERT predictions",
- ["status"]
-)
-
-MODEL_PREDICTION_LATENCY = Histogram(
- "model_prediction_latency_seconds",
- "Latency of DistilBERT prediction in seconds",
- buckets=(0.05, 0.1, 0.25, 0.5, 0.75, 1.0, 2.5, 5.0, 10.0)
-)
+try:
+ import torch
+ import torch.nn.functional as F
+ from transformers import DistilBertTokenizerFast, DistilBertForSequenceClassification
+ _HAS_TORCH = True
+except Exception: # pragma: no cover - optional CI/runtime dependency
+ torch = None
+ F = None
+ DistilBertTokenizerFast = None
+ DistilBertForSequenceClassification = None
+ _HAS_TORCH = False
SAVE_DIR = os.path.join(os.path.dirname(os.path.abspath(__file__)), "..", "models", "classifier")
-DEVICE = torch.device("cuda" if torch.cuda.is_available() else "cpu")
+DEVICE = torch.device("cuda" if torch and torch.cuda.is_available() else "cpu") if _HAS_TORCH else None
MAX_LEN = 128
# Priority mapping based on sub-category severity
@@ -72,26 +65,19 @@ class ClassifierService:
if self._loaded:
return
+ if not _HAS_TORCH:
+ # Degraded environment: ML runtime not available. Delay failure until predict is called.
+ print("[INFO] ML runtime not available; classifier will remain unloaded until dependencies are installed.")
+ return
+
abs_dir = os.path.abspath(SAVE_DIR)
- safetensors_path = os.path.join(abs_dir, "model.safetensors")
- if not os.path.exists(safetensors_path):
+ if not os.path.exists(os.path.join(abs_dir, "model.safetensors")):
raise FileNotFoundError(
f"Classifier model not found at {abs_dir}. "
"Please ensure model files are present."
)
- with open(safetensors_path, "rb") as f:
- header = f.read(512)
- if (
- b"version https://git-lfs.github.com/spec" in header
- or b"oid sha256:" in header
- ):
- raise FileNotFoundError(
- f"Classifier model at {abs_dir} is a Git LFS placeholder, not the actual model. "
- "Please pull the LFS assets."
- )
-
# Load label mappings
with open(os.path.join(abs_dir, "id2label.json"), "r") as f:
self.id2label = json.load(f)
@@ -113,74 +99,65 @@ class ClassifierService:
"""
Predict category, subcategory, priority, auto_resolve, assigned_team, and confidence.
"""
- start_time = time.time()
- try:
- self.load()
-
- encoding = self.tokenizer(
- text,
- truncation=True,
- padding="max_length",
- max_length=MAX_LEN,
- return_tensors="pt",
- )
- input_ids = encoding["input_ids"].to(DEVICE)
- attention_mask = encoding["attention_mask"].to(DEVICE)
-
- with torch.no_grad():
- outputs = self.model(input_ids=input_ids, attention_mask=attention_mask)
- logits = outputs.logits
- probs = F.softmax(logits, dim=1)
- confidence, pred_idx = torch.max(probs, dim=1)
-
- pred_idx = pred_idx.item()
- confidence = round(confidence.item(), 4)
-
- # Decode the combined label "Category | SubCategory"
- combined_label = self.id2label.get(str(pred_idx), "Unknown | Unknown")
- parts = combined_label.split(" | ", 1)
- category = parts[0].strip() if len(parts) > 0 else "Unknown"
- subcategory = parts[1].strip() if len(parts) > 1 else "Unknown"
-
- # Derive priority
- priority = PRIORITY_MAP.get(subcategory, "Medium")
-
- # Derive assigned team
- assigned_team = TEAM_MAP.get(category, "General Support")
-
- # Derive auto_resolve
- auto_resolve = subcategory in AUTO_RESOLVE_SUBS
-
- # --- Regex Override Layer (Boost for Technical Keywords) ---
- tech_keywords = {
- "Network": ["IP address", "hostname", "connection", "network", "bandwidth", "DNS", "firewall", "VPN", "Connectivity", "Latency", "Routing", "Spikes"],
- "Software": ["crash", "load", "website", "application", "error", "bug", "failing", "software", "SQL", "Cluster", "Database", "Production", "Latency"],
- "Access": ["login", "password", "access", "authentication", "account", "permission", "MFA", "OAuth"]
- }
-
- lower_text = text.lower()
- for cat, keywords in tech_keywords.items():
- if any(k.lower() in lower_text for k in keywords):
- # If current prediction is generic, or we have a high-value technical keyword
- if category == "General" or confidence < 0.9:
- category = cat
- assigned_team = TEAM_MAP.get(cat, "General Support")
- # Boost confidence significantly for verified technical signals
- confidence = max(confidence, 0.92)
- break
-
- MODEL_PREDICTIONS_TOTAL.labels(status="success").inc()
- return {
- "category": category,
- "subcategory": subcategory,
- "priority": priority,
- "auto_resolve": auto_resolve,
- "assigned_team": assigned_team,
- "confidence": confidence,
- }
- except Exception as e:
- MODEL_PREDICTIONS_TOTAL.labels(status="failure").inc()
- raise e
- finally:
- duration = time.time() - start_time
- MODEL_PREDICTION_LATENCY.observe(duration)
+ self.load()
+
+ encoding = self.tokenizer(
+ text,
+ truncation=True,
+ padding="max_length",
+ max_length=MAX_LEN,
+ return_tensors="pt",
+ )
+ input_ids = encoding["input_ids"].to(DEVICE)
+ attention_mask = encoding["attention_mask"].to(DEVICE)
+
+ with torch.no_grad():
+ outputs = self.model(input_ids=input_ids, attention_mask=attention_mask)
+ logits = outputs.logits
+ probs = F.softmax(logits, dim=1)
+ confidence, pred_idx = torch.max(probs, dim=1)
+
+ pred_idx = pred_idx.item()
+ confidence = round(confidence.item(), 4)
+
+ # Decode the combined label "Category | SubCategory"
+ combined_label = self.id2label.get(str(pred_idx), "Unknown | Unknown")
+ parts = combined_label.split(" | ", 1)
+ category = parts[0].strip() if len(parts) > 0 else "Unknown"
+ subcategory = parts[1].strip() if len(parts) > 1 else "Unknown"
+
+ # Derive priority
+ priority = PRIORITY_MAP.get(subcategory, "Medium")
+
+ # Derive assigned team
+ assigned_team = TEAM_MAP.get(category, "General Support")
+
+ # Derive auto_resolve
+ auto_resolve = subcategory in AUTO_RESOLVE_SUBS
+
+ # --- Regex Override Layer (Boost for Technical Keywords) ---
+ tech_keywords = {
+ "Network": ["IP address", "hostname", "connection", "network", "bandwidth", "DNS", "firewall", "VPN", "Connectivity", "Latency", "Routing", "Spikes"],
+ "Software": ["crash", "load", "website", "application", "error", "bug", "failing", "software", "SQL", "Cluster", "Database", "Production", "Latency"],
+ "Access": ["login", "password", "access", "authentication", "account", "permission", "MFA", "OAuth"]
+ }
+
+ lower_text = text.lower()
+ for cat, keywords in tech_keywords.items():
+ if any(k.lower() in lower_text for k in keywords):
+ # If current prediction is generic, or we have a high-value technical keyword
+ if category == "General" or confidence < 0.9:
+ category = cat
+ assigned_team = TEAM_MAP.get(cat, "General Support")
+ # Boost confidence significantly for verified technical signals
+ confidence = max(confidence, 0.92)
+ break
+
+ return {
+ "category": category,
+ "subcategory": subcategory,
+ "priority": priority,
+ "auto_resolve": auto_resolve,
+ "assigned_team": assigned_team,
+ "confidence": confidence,
+ }
diff --git a/backend/services/classifier_v2.py b/backend/services/classifier_v2.py
index 6fcfca6f5e2a36ed7111513477a159a95a347d70..c6955edc8c87a7ce86431a62c8d8bdb395fd95e0 100644
--- a/backend/services/classifier_v2.py
+++ b/backend/services/classifier_v2.py
@@ -1,89 +1,109 @@
import os
-import torch
-import torch.nn as nn
import pickle
import json
-from transformers import DistilBertTokenizerFast, DistilBertModel
+try:
+ import torch
+ import torch.nn as nn
+ from transformers import DistilBertTokenizerFast, DistilBertModel
+ _HAS_TORCH = True
+except Exception: # pragma: no cover - optional runtime dependency
+ torch = None
+ nn = None
+ DistilBertTokenizerFast = None
+ DistilBertModel = None
+ _HAS_TORCH = False
# Paths
BASE_DIR = os.path.dirname(os.path.dirname(os.path.abspath(__file__)))
MODEL_DIR = os.path.join(BASE_DIR, "models", "classifier-v2")
# We must use the exact same class definition as trainer_v2
-class MultiOutputClassifierV2(nn.Module):
- def __init__(self, num_labels_per_output: dict):
- super().__init__()
- self.bert = DistilBertModel.from_pretrained("distilbert-base-uncased")
- hidden = self.bert.config.hidden_size
- self.dropout = nn.Dropout(0.2)
- self.heads = nn.ModuleDict()
- for name, n_labels in num_labels_per_output.items():
- self.heads[name] = nn.Linear(hidden, n_labels)
+if _HAS_TORCH:
+ class MultiOutputClassifierV2(nn.Module):
+ def __init__(self, num_labels_per_output: dict):
+ super().__init__()
+ self.bert = DistilBertModel.from_pretrained("distilbert-base-uncased")
+ hidden = self.bert.config.hidden_size
+ self.dropout = nn.Dropout(0.2)
+ self.heads = nn.ModuleDict()
+ for name, n_labels in num_labels_per_output.items():
+ self.heads[name] = nn.Linear(hidden, n_labels)
- def forward(self, input_ids, attention_mask):
- outputs = self.bert(input_ids=input_ids, attention_mask=attention_mask)
- cls_output = outputs.last_hidden_state[:, 0]
- cls_output = self.dropout(cls_output)
- logits = {name: head(cls_output) for name, head in self.heads.items()}
- return logits
+ def forward(self, input_ids, attention_mask):
+ outputs = self.bert(input_ids=input_ids, attention_mask=attention_mask)
+ cls_output = outputs.last_hidden_state[:, 0]
+ cls_output = self.dropout(cls_output)
+ logits = {name: head(cls_output) for name, head in self.heads.items()}
+ return logits
-class ClassifierServiceV2:
- def __init__(self):
- self.device = torch.device("cuda" if torch.cuda.is_available() else "cpu")
-
- # 1. Load Config
- config_path = os.path.join(MODEL_DIR, "model_config.json")
- if not os.path.exists(config_path):
- self.model = None
- print(f"[WARN] V2 Model config not found at {config_path}")
- return
+ class ClassifierServiceV2:
+ def __init__(self):
+ self.device = torch.device("cuda" if torch.cuda.is_available() else "cpu")
+
+ # 1. Load Config
+ config_path = os.path.join(MODEL_DIR, "model_config.json")
+ if not os.path.exists(config_path):
+ self.model = None
+ print(f"[WARN] V2 Model config not found at {config_path}")
+ return
- with open(config_path, "r") as f:
- self.num_labels = json.load(f)
+ with open(config_path, "r") as f:
+ self.num_labels = json.load(f)
- # 2. Load Encoders
- with open(os.path.join(MODEL_DIR, "label_encoders.pkl"), "rb") as f:
- self.label_encoders = pickle.load(f)
+ # 2. Load Encoders
+ with open(os.path.join(MODEL_DIR, "label_encoders.pkl"), "rb") as f:
+ self.label_encoders = pickle.load(f)
- # 3. Load Model
- self.model = MultiOutputClassifierV2(self.num_labels).to(self.device)
- model_path = os.path.join(MODEL_DIR, "model.pt")
- self.model.load_state_dict(torch.load(model_path, map_location=self.device))
- self.model.eval()
+ # 3. Load Model
+ self.model = MultiOutputClassifierV2(self.num_labels).to(self.device)
+ model_path = os.path.join(MODEL_DIR, "model.pt")
+ self.model.load_state_dict(torch.load(model_path, map_location=self.device))
+ self.model.eval()
- # 4. Load Tokenizer
- self.tokenizer = DistilBertTokenizerFast.from_pretrained(MODEL_DIR)
- print("[SUCCESS] Classifier Service V2 (Shadow) Loaded Successfully.")
+ # 4. Load Tokenizer
+ self.tokenizer = DistilBertTokenizerFast.from_pretrained(MODEL_DIR)
+ print("[SUCCESS] Classifier Service V2 (Shadow) Loaded Successfully.")
- def predict(self, text: str):
- if self.model is None:
- return {"error": "V2 Model not initialized"}
+ def predict(self, text: str):
+ if self.model is None:
+ return {"error": "V2 Model not initialized"}
- inputs = self.tokenizer(
- text,
- return_tensors="pt",
- truncation=True,
- padding=True,
- max_length=256 # V2 uses 256
- ).to(self.device)
+ inputs = self.tokenizer(
+ text,
+ return_tensors="pt",
+ truncation=True,
+ padding=True,
+ max_length=256 # V2 uses 256
+ ).to(self.device)
- with torch.no_grad():
- logits = self.model(inputs["input_ids"], inputs["attention_mask"])
+ with torch.no_grad():
+ logits = self.model(inputs["input_ids"], inputs["attention_mask"])
+
+ results = {}
+ for col, le in self.label_encoders.items():
+ probs = torch.softmax(logits[col], dim=1)
+ conf, pred_idx = torch.max(probs, dim=1)
+ results[col] = {
+ "prediction": le.inverse_transform([pred_idx.item()])[0],
+ "confidence": float(conf.item())
+ }
- results = {}
- for col, le in self.label_encoders.items():
- probs = torch.softmax(logits[col], dim=1)
- conf, pred_idx = torch.max(probs, dim=1)
- results[col] = {
- "prediction": le.inverse_transform([pred_idx.item()])[0],
- "confidence": float(conf.item())
- }
-
- # Map V2 'Priority' (capitalized) to generic response
- if "Priority" in results:
- results["priority"] = results.pop("Priority")
+ # Map V2 'Priority' (capitalized) to generic response
+ if "Priority" in results:
+ results["priority"] = results.pop("Priority")
+
+ return results
+
+ # Singleton instance
+ classifier_v2 = ClassifierServiceV2()
+else:
+ class ClassifierServiceV2:
+ def __init__(self):
+ self.model = None
+ self.tokenizer = None
+ self.label_encoders = {}
- return results
+ def predict(self, text: str):
+ return {"error": "V2 model not available in this environment"}
-# Singleton instance
-classifier_v2 = ClassifierServiceV2()
+ classifier_v2 = ClassifierServiceV2()
diff --git a/backend/services/classifier_v3.py b/backend/services/classifier_v3.py
index 49703314f2effe93adc3720117e7c707c2edef0f..55b1981402386d37722b642b4fd57bf11366f8fc 100644
--- a/backend/services/classifier_v3.py
+++ b/backend/services/classifier_v3.py
@@ -1,75 +1,95 @@
import os
-import torch
-import torch.nn as nn
import pickle
import json
-from transformers import BertTokenizerFast, BertModel
+try:
+ import torch
+ import torch.nn as nn
+ from transformers import BertTokenizerFast, BertModel
+ _HAS_TORCH = True
+except Exception: # pragma: no cover - optional runtime dependency
+ torch = None
+ nn = None
+ BertTokenizerFast = None
+ BertModel = None
+ _HAS_TORCH = False
# Paths
BASE_DIR = os.path.dirname(os.path.dirname(os.path.abspath(__file__)))
MODEL_DIR = os.path.join(BASE_DIR, "models", "classifier-v3")
-class MultiOutputClassifierV3(nn.Module):
- def __init__(self, num_labels_per_output: dict):
- super().__init__()
- self.bert = BertModel.from_pretrained("bert-base-uncased")
- hidden = self.bert.config.hidden_size
- self.dropout = nn.Dropout(0.3)
- self.heads = nn.ModuleDict()
- for name, n_labels in num_labels_per_output.items():
- self.heads[name] = nn.Sequential(
- nn.Linear(hidden, 256),
- nn.ReLU(),
- nn.Dropout(0.1),
- nn.Linear(256, n_labels)
- )
+if _HAS_TORCH:
+ class MultiOutputClassifierV3(nn.Module):
+ def __init__(self, num_labels_per_output: dict):
+ super().__init__()
+ self.bert = BertModel.from_pretrained("bert-base-uncased")
+ hidden = self.bert.config.hidden_size
+ self.dropout = nn.Dropout(0.3)
+ self.heads = nn.ModuleDict()
+ for name, n_labels in num_labels_per_output.items():
+ self.heads[name] = nn.Sequential(
+ nn.Linear(hidden, 256),
+ nn.ReLU(),
+ nn.Dropout(0.1),
+ nn.Linear(256, n_labels)
+ )
- def forward(self, input_ids, attention_mask):
- outputs = self.bert(input_ids=input_ids, attention_mask=attention_mask)
- pooled_output = outputs.pooler_output
- pooled_output = self.dropout(pooled_output)
- logits = {name: head(pooled_output) for name, head in self.heads.items()}
- return logits
+ def forward(self, input_ids, attention_mask):
+ outputs = self.bert(input_ids=input_ids, attention_mask=attention_mask)
+ pooled_output = outputs.pooler_output
+ pooled_output = self.dropout(pooled_output)
+ logits = {name: head(pooled_output) for name, head in self.heads.items()}
+ return logits
-class ClassifierServiceV3:
- def __init__(self):
- self.device = torch.device("cuda" if torch.cuda.is_available() else "cpu")
- self.model = None
-
- config_path = os.path.join(MODEL_DIR, "model_config.json")
- if not os.path.exists(config_path):
- print(f"[V3 Service] Model not found yet at {MODEL_DIR}")
- return
+ class ClassifierServiceV3:
+ def __init__(self):
+ self.device = torch.device("cuda" if torch.cuda.is_available() else "cpu")
+ self.model = None
+
+ config_path = os.path.join(MODEL_DIR, "model_config.json")
+ if not os.path.exists(config_path):
+ print(f"[V3 Service] Model not found yet at {MODEL_DIR}")
+ return
- with open(config_path, "r") as f:
- self.num_labels = json.load(f)
+ with open(config_path, "r") as f:
+ self.num_labels = json.load(f)
- with open(os.path.join(MODEL_DIR, "label_encoders.pkl"), "rb") as f:
- self.label_encoders = pickle.load(f)
+ with open(os.path.join(MODEL_DIR, "label_encoders.pkl"), "rb") as f:
+ self.label_encoders = pickle.load(f)
- self.model = MultiOutputClassifierV3(self.num_labels).to(self.device)
- self.model.load_state_dict(torch.load(os.path.join(MODEL_DIR, "model.pt"), map_location=self.device))
- self.model.eval()
+ self.model = MultiOutputClassifierV3(self.num_labels).to(self.device)
+ self.model.load_state_dict(torch.load(os.path.join(MODEL_DIR, "model.pt"), map_location=self.device))
+ self.model.eval()
- self.tokenizer = BertTokenizerFast.from_pretrained(MODEL_DIR)
- print("[INFO] Classifier Service V3 (Power Model) Loaded.")
+ self.tokenizer = BertTokenizerFast.from_pretrained(MODEL_DIR)
+ print("[INFO] Classifier Service V3 (Power Model) Loaded.")
- def predict(self, text: str):
- if self.model is None: return {"error": "V3 Model not loaded"}
- inputs = self.tokenizer(text, return_tensors="pt", truncation=True, padding=True, max_length=256).to(self.device)
- with torch.no_grad():
- logits = self.model(inputs["input_ids"], inputs["attention_mask"])
+ def predict(self, text: str):
+ if self.model is None: return {"error": "V3 Model not loaded"}
+ inputs = self.tokenizer(text, return_tensors="pt", truncation=True, padding=True, max_length=256).to(self.device)
+ with torch.no_grad():
+ logits = self.model(inputs["input_ids"], inputs["attention_mask"])
+
+ results = {}
+ for col, le in self.label_encoders.items():
+ probs = torch.softmax(logits[col], dim=1)
+ conf, pred_idx = torch.max(probs, dim=1)
+ results[col] = {
+ "prediction": le.inverse_transform([pred_idx.item()])[0],
+ "confidence": float(conf.item())
+ }
- results = {}
- for col, le in self.label_encoders.items():
- probs = torch.softmax(logits[col], dim=1)
- conf, pred_idx = torch.max(probs, dim=1)
- results[col] = {
- "prediction": le.inverse_transform([pred_idx.item()])[0],
- "confidence": float(conf.item())
- }
-
- if "Priority" in results: results["priority"] = results.pop("Priority")
- return results
+ if "Priority" in results: results["priority"] = results.pop("Priority")
+ return results
+
+ classifier_v3 = ClassifierServiceV3()
+else:
+ class ClassifierServiceV3:
+ def __init__(self):
+ self.model = None
+ self.tokenizer = None
+ self.label_encoders = {}
+
+ def predict(self, text: str):
+ return {"error": "V3 model not available in this environment"}
-classifier_v3 = ClassifierServiceV3()
+ classifier_v3 = ClassifierServiceV3()
diff --git a/backend/services/duplicate_service.py b/backend/services/duplicate_service.py
index 6a15487323cc905301cef9ec43eac58ee5fbd498..75732b46922951a3917b9c58a1e6c107cf1d3210 100644
--- a/backend/services/duplicate_service.py
+++ b/backend/services/duplicate_service.py
@@ -7,7 +7,13 @@ import uuid
import os
from typing import Any
-from sentence_transformers import SentenceTransformer, util
+try:
+ from sentence_transformers import SentenceTransformer, util
+ _HAS_SENTENCE = True
+except Exception: # pragma: no cover - optional runtime dependency
+ SentenceTransformer = None
+ util = None
+ _HAS_SENTENCE = False
SIMILARITY_THRESHOLD = 0.70
@@ -32,6 +38,17 @@ class DuplicateService:
return
print("[DuplicateService] Loading model...")
+ if not _HAS_SENTENCE:
+ allow_degraded = os.environ.get("ALLOW_DEGRADED_STARTUP", "0") == "1"
+ self._load_failed = True
+ print("[DuplicateService] sentence-transformers not installed")
+ if allow_degraded:
+ print("[DuplicateService] DEGRADED: Continuing without model (ALLOW_DEGRADED_STARTUP=1)")
+ self.model = None
+ self._loaded = False
+ return
+ else:
+ raise ImportError("sentence-transformers is required for DuplicateService")
try:
# Check if a local model path is provided
model_path = os.environ.get("SENTENCE_TRANSFORMER_MODEL_PATH")
@@ -101,12 +118,20 @@ class DuplicateService:
def generate_embedding(self, text: str) -> list[float] | None:
"""Generate a 384-d embedding for the provided ticket text."""
+ from backend.services.redis_cache import redis_cache
+
+ cached = redis_cache.get_embedding(text)
+ if cached is not None:
+ return cached
+
self.load()
if not self.is_available():
return None
embedding = self.model.encode(text, convert_to_tensor=False, normalize_embeddings=True)
- return [float(value) for value in embedding.tolist()]
+ values = [float(value) for value in embedding.tolist()]
+ redis_cache.set_embedding(text, values)
+ return values
def _build_result(
self,
diff --git a/backend/services/gemini_service.py b/backend/services/gemini_service.py
index 882aeac8e8c5854ad50ea843a4ff6f3d8c691f16..5ad827f2892aeabe4ebb72e3ae4cfe98d9156457 100644
--- a/backend/services/gemini_service.py
+++ b/backend/services/gemini_service.py
@@ -2,6 +2,7 @@ import os
import base64
import io
import re
+import json
from PIL import Image
from google import genai
from dotenv import load_dotenv
@@ -222,3 +223,65 @@ class GeminiService:
except Exception as e:
print(f"[GeminiService] Bug Analysis Error: {e}")
return f"Diagnostic analysis failed: {str(e)}"
+
+ def detect_language(self, text: str) -> dict:
+ """
+ Detect language for the given text. Returns ISO-ish language code and English language name.
+ """
+ if not text or not text.strip():
+ return {"code": "en", "name": "English"}
+ if not self._initialized:
+ return {"code": "en", "name": "English"}
+
+ try:
+ prompt = (
+ "Detect the natural language of the following user message. "
+ "Return strict JSON only with keys: code, name. "
+ "Example: {\"code\":\"es\",\"name\":\"Spanish\"}.\n\n"
+ f"Text:\n{text}"
+ )
+ response = self.client.models.generate_content(
+ model=self.model_name,
+ contents=prompt
+ )
+ raw = (response.text or "").strip()
+ match = re.search(r"\{.*\}", raw, re.DOTALL)
+ parsed = json.loads(match.group(0) if match else raw)
+ code = str(parsed.get("code", "en")).lower()
+ name = str(parsed.get("name", "English"))
+ if not code:
+ code = "en"
+ if not name:
+ name = "English"
+ return {"code": code, "name": name}
+ except Exception as e:
+ print(f"[GeminiService] Language detection error: {e}")
+ return {"code": "en", "name": "English"}
+
+ def translate_to_english(self, text: str, source_language: str | None = None) -> str:
+ """
+ Translate user text to English while preserving technical terms.
+ """
+ if not text or not text.strip():
+ return text
+ if not self._initialized:
+ return text
+
+ try:
+ lang_hint = f"Source language: {source_language}. " if source_language else ""
+ prompt = (
+ "Translate the following support ticket text to natural, concise English. "
+ "Preserve technical terms, error codes, product names, and formatting. "
+ "Return only translated text with no prefix or explanation. "
+ f"{lang_hint}\n\n"
+ f"Text:\n{text}"
+ )
+ response = self.client.models.generate_content(
+ model=self.model_name,
+ contents=prompt
+ )
+ translated = (response.text or "").strip()
+ return translated or text
+ except Exception as e:
+ print(f"[GeminiService] Translation error: {e}")
+ return text
diff --git a/backend/services/ner_service.py b/backend/services/ner_service.py
index 931ac6bb5857179d476090e238aa3deb3bca5162..1e98d384d6ef6737c2298faec1ba42fc001e221f 100644
--- a/backend/services/ner_service.py
+++ b/backend/services/ner_service.py
@@ -5,12 +5,20 @@ Labels follow pattern: B-B-ENTITY_TYPE, I-B-ENTITY_TYPE, O
import os
import json
-import torch
-import torch.nn.functional as F
-from transformers import DistilBertTokenizerFast, DistilBertForTokenClassification
+try:
+ import torch
+ import torch.nn.functional as F
+ from transformers import DistilBertTokenizerFast, DistilBertForTokenClassification
+ _HAS_TORCH = True
+except Exception: # pragma: no cover - optional runtime dependency
+ torch = None
+ F = None
+ DistilBertTokenizerFast = None
+ DistilBertForTokenClassification = None
+ _HAS_TORCH = False
SAVE_DIR = os.path.join(os.path.dirname(os.path.abspath(__file__)), "..", "models", "ner")
-DEVICE = torch.device("cuda" if torch.cuda.is_available() else "cpu")
+DEVICE = torch.device("cuda" if torch and torch.cuda.is_available() else "cpu") if _HAS_TORCH else None
MAX_LEN = 128
import re
@@ -41,6 +49,10 @@ class NERService:
if self._loaded:
return
+ if not _HAS_TORCH:
+ print("[INFO] NER runtime not available; NER model will remain unloaded until dependencies are installed.")
+ return
+
abs_dir = os.path.abspath(SAVE_DIR)
if not os.path.exists(os.path.join(abs_dir, "model.safetensors")):
diff --git a/backend/services/rag_service.py b/backend/services/rag_service.py
index 089231489e082dd097ba59b08eb6d377c7e7f036..5099234809843d18c77008729d18b55ee1edea06 100644
--- a/backend/services/rag_service.py
+++ b/backend/services/rag_service.py
@@ -1,5 +1,10 @@
import os
-from sentence_transformers import SentenceTransformer
+try:
+ from sentence_transformers import SentenceTransformer
+ _HAS_SENTENCE = True
+except Exception: # pragma: no cover - optional runtime dependency
+ SentenceTransformer = None
+ _HAS_SENTENCE = False
from supabase import create_client, Client
from dotenv import load_dotenv
@@ -27,6 +32,17 @@ class RagService:
return
print("[RAG] Loading SentenceTransformer for Knowledge Base...")
+ if not _HAS_SENTENCE:
+ allow_degraded = os.environ.get("ALLOW_DEGRADED_STARTUP", "0") == "1"
+ self._load_failed = True
+ print("[RAG] sentence-transformers not installed")
+ if allow_degraded:
+ print("[RAG] DEGRADED: Continuing without model (ALLOW_DEGRADED_STARTUP=1)")
+ self.model = None
+ self._loaded = False
+ return
+ else:
+ raise ImportError("sentence-transformers is required for RagService")
try:
# Check if a local model path is provided
model_path = os.environ.get("SENTENCE_TRANSFORMER_MODEL_PATH")
diff --git a/backend/services/sla_service.py b/backend/services/sla_service.py
index e65e802d80eb703c5a2dc3ff791fae5f49f3369f..0163a2373d4a9b37f069fbeca372b957748782f3 100644
--- a/backend/services/sla_service.py
+++ b/backend/services/sla_service.py
@@ -14,6 +14,10 @@ import os
from datetime import datetime, timedelta, timezone
from typing import Any, Callable, Optional
+from fastapi import BackgroundTasks
+
+from backend.sla_checker import dispatch_slack_alert
+
try:
from dotenv import load_dotenv
except ImportError:
@@ -110,11 +114,12 @@ class SlaEscalationService:
now_fn: Callable[[], datetime] = _utc_now,
notification_router: Any = None,
):
- self.supabase = supabase_client
+ from backend.auth.crypto import wrap_client
+ self.supabase = wrap_client(supabase_client)
self.now_fn = now_fn
self.notification_router = notification_router
- def run_once(self) -> dict[str, int | str]:
+ def run_once(self, background_tasks: BackgroundTasks | None = None) -> dict[str, int | str]:
stats: dict[str, int | str] = {
"processed_count": 0,
"breached_count": 0,
@@ -136,7 +141,7 @@ class SlaEscalationService:
if not self._should_breach(ticket, now):
stats["skipped_count"] = int(stats["skipped_count"]) + 1
continue
- self._breach_ticket(ticket, now)
+ self._breach_ticket(ticket, now, background_tasks=background_tasks)
stats["breached_count"] = int(stats["breached_count"]) + 1
except Exception as exc:
stats["error_count"] = int(stats["error_count"]) + 1
@@ -169,7 +174,13 @@ class SlaEscalationService:
return False
return classify_sla_status(ticket.get("sla_breach_at"), now) == "BREACHED"
- def _breach_ticket(self, ticket: dict[str, Any], now: datetime) -> None:
+ def _breach_ticket(
+ self,
+ ticket: dict[str, Any],
+ now: datetime,
+ *,
+ background_tasks: BackgroundTasks | None = None,
+ ) -> None:
ticket_id = str(ticket.get("id"))
company_id = ticket.get("company_id")
escalation_level = int(ticket.get("escalation_level") or 0) + 1
@@ -185,6 +196,7 @@ class SlaEscalationService:
self._insert_audit_log(ticket, escalation_level, timestamp)
self._emit_system_message(ticket, escalation_level, timestamp)
+ self._dispatch_breach_alert(ticket, now, background_tasks=background_tasks)
logger.warning(
"SLA breached | ticket_id=%s | company_id=%s | priority=%s | level=%s",
@@ -194,6 +206,31 @@ class SlaEscalationService:
escalation_level,
)
+ def _dispatch_breach_alert(
+ self,
+ ticket: dict[str, Any],
+ breach_time: datetime,
+ *,
+ background_tasks: BackgroundTasks | None = None,
+ ) -> None:
+ ticket_id = str(ticket.get("id") or "")
+ subject = str(ticket.get("subject") or "Untitled ticket")
+ category = str(ticket.get("priority") or "Uncategorized")
+ assignee = str(ticket.get("assigned_team") or "Unassigned")
+
+ if background_tasks is not None:
+ background_tasks.add_task(
+ dispatch_slack_alert,
+ ticket_id,
+ subject,
+ category,
+ assignee,
+ breach_time,
+ )
+ return
+
+ dispatch_slack_alert(ticket_id, subject, category, assignee, breach_time)
+
def _insert_audit_log(self, ticket: dict[str, Any], escalation_level: int, timestamp: str) -> None:
ticket_id = str(ticket.get("id"))
self.supabase.table("audit_logs").insert(
diff --git a/backend/services/slack_notifier.py b/backend/services/slack_notifier.py
index 738a35672eba32f6d4764dc422264f356d6bb400..328e3a1c7dd398428001b7f03a1619e7e81fd5a3 100644
--- a/backend/services/slack_notifier.py
+++ b/backend/services/slack_notifier.py
@@ -48,9 +48,9 @@ def build_slack_payload(ticket: dict[str, Any]) -> dict:
ticket_id = str(ticket.get("id", "???"))
ticket_ref = f"#T-{ticket_id[-4:]}" if len(ticket_id) >= 4 else f"#T-{ticket_id}"
subject = ticket.get("subject") or "Untitled ticket"
- priority = str(ticket.get("priority", "unknown")).upper()
+ priority = str(ticket.get("priority") or "unknown").upper()
assigned_team = ticket.get("assigned_team") or "Unassigned"
- company = ticket.get("company") or ticket.get("company_id") or "Unknown"
+ company = ticket.get("company") or ticket.get("company_id") or "UNKNOWN"
breach_at = ticket.get("sla_breach_at") or "N/A"
# Color based on priority
diff --git a/backend/tests/conftest.py b/backend/tests/conftest.py
index da1f3bc4c2ae419200d7aaa2119bc260dccd8653..c4f96ca4e6a97fd9386990c5f90bd80d31ee2fd8 100644
--- a/backend/tests/conftest.py
+++ b/backend/tests/conftest.py
@@ -272,6 +272,7 @@ def mock_ai_services(request):
"test_redis_cache.py",
"test_semantic_duplicates.py",
"test_auth_cookie.py",
+ "test_mobile_supabase_env.py",
}:
yield
return
diff --git a/backend/tests/test_crypto.py b/backend/tests/test_crypto.py
index 87a645bf028d1ecf30f94d0594d381f4372f7777..06b33ce020f292f4036fcb768de962e758043859 100644
--- a/backend/tests/test_crypto.py
+++ b/backend/tests/test_crypto.py
@@ -1,69 +1,163 @@
import os
import unittest
+import base64
from unittest.mock import patch, MagicMock
-# Set test key
-os.environ["DB_ENCRYPTION_SECRET_KEY"] = "super-secret-test-key-32-bytes"
+# Import the crypto module under test
+import backend.auth.crypto as crypto
-from backend.auth.crypto import encrypt, decrypt, apply_db_encryption_patch
-apply_db_encryption_patch()
+class TestCryptographicHooks(unittest.TestCase):
+
+ def test_key_derivation_formats(self):
+ """Test urlsafe-b64, hex, and SHA-256 stretch key parsing."""
+ # 1. Test URL-safe Base64 key parsing (exactly 32 bytes once decoded)
+ dummy_32bytes = os.urandom(32)
+ b64_key = base64.urlsafe_b64encode(dummy_32bytes).decode('utf-8')
+ derived = crypto.derive_cryptographic_key(b64_key)
+ self.assertEqual(derived, dummy_32bytes)
-from supabase import create_client
+ # 2. Test Hex key parsing (exactly 32 bytes once decoded)
+ hex_key = dummy_32bytes.hex()
+ derived_hex = crypto.derive_cryptographic_key(hex_key)
+ self.assertEqual(derived_hex, dummy_32bytes)
-class TestCryptoPII(unittest.TestCase):
- def test_aes_encryption_decryption(self):
- plain = "sensitive PII text"
- enc = encrypt(plain)
- self.assertNotEqual(plain, enc)
-
- dec = decrypt(enc)
- self.assertEqual(plain, dec)
-
- def test_graceful_decrypt_plaintext(self):
- # Decrypting plain text should just return it as-is
- plain = "not encrypted text"
- dec = decrypt(plain)
- self.assertEqual(plain, dec)
+ # 3. Test SHA-256 stretch parsing for arbitrary strings
+ raw_key = "my-secret-bounty-key-stretch-test"
+ derived_stretch = crypto.derive_cryptographic_key(raw_key)
+ self.assertEqual(len(derived_stretch), 32)
- @patch("httpx.Client.send")
- def test_transparent_hooks(self, mock_send):
- import httpx
- # Initialize client with dummy credentials
- client = create_client("https://dummy.supabase.co", "apikey")
- builder = client.table("tickets")
-
- # Test Insert Hook
- payload = {
- "contact_email": "pii@email.com",
- "description": "My secret PII",
- "raw_text": "Sensitive raw PII"
- }
+ def test_encrypt_decrypt_roundtrip(self):
+ """Test successful AES-256-GCM encryption and decryption round-trip."""
+ # Force active encryption state by mocking AESGCM with a stretched key
+ dummy_key = crypto.derive_cryptographic_key("test-key")
+ from cryptography.hazmat.primitives.ciphers.aead import AESGCM
+ mock_aesgcm = AESGCM(dummy_key)
- # Mock httpx Response returning encrypted data from server
- mock_response = httpx.Response(
- status_code=201,
- json=[{
- "id": "1",
- "contact_email": encrypt("pii@email.com"),
- "description": encrypt("My secret PII"),
- "raw_text": encrypt("Sensitive raw PII")
- }],
- request=httpx.Request("POST", "https://dummy.supabase.co")
- )
- mock_send.return_value = mock_response
-
- # Call query
- res = builder.insert(payload).execute()
+ with patch.object(crypto, "ENCRYPTION_ENABLED", True), \
+ patch.object(crypto, "_aesgcm", mock_aesgcm):
+
+ plaintext = "Secure GDPR/HIPAA ticket content."
+ ciphertext = crypto.encrypt_value(plaintext)
+
+ # Verify prefix
+ self.assertTrue(ciphertext.startswith("enc:v1:"))
+ self.assertNotEqual(plaintext, ciphertext)
+
+ # Decrypt back
+ decrypted = crypto.decrypt_value(ciphertext)
+ self.assertEqual(decrypted, plaintext)
+
+ def test_double_encryption_protection(self):
+ """Test that calling encrypt twice does not double-encrypt the data (no-op)."""
+ dummy_key = crypto.derive_cryptographic_key("test-key")
+ from cryptography.hazmat.primitives.ciphers.aead import AESGCM
+ mock_aesgcm = AESGCM(dummy_key)
- # Verify write payload got encrypted before sending
- self.assertNotEqual(payload["contact_email"], "pii@email.com")
- self.assertTrue(payload["contact_email"].strip() != "")
+ with patch.object(crypto, "ENCRYPTION_ENABLED", True), \
+ patch.object(crypto, "_aesgcm", mock_aesgcm):
+
+ plaintext = "Double encrypt check."
+ first_encryption = crypto.encrypt_value(plaintext)
+ second_encryption = crypto.encrypt_value(first_encryption)
+
+ self.assertEqual(first_encryption, second_encryption)
+
+ def test_selectivity_of_field_hooks(self):
+ """Verify only contact_email, description, and raw_text are encrypted."""
+ dummy_key = crypto.derive_cryptographic_key("test-key")
+ from cryptography.hazmat.primitives.ciphers.aead import AESGCM
+ mock_aesgcm = AESGCM(dummy_key)
- # Verify read response got decrypted
- self.assertEqual(res.data[0]["contact_email"], "pii@email.com")
- self.assertEqual(res.data[0]["description"], "My secret PII")
- self.assertEqual(res.data[0]["raw_text"], "Sensitive raw PII")
+ with patch.object(crypto, "ENCRYPTION_ENABLED", True), \
+ patch.object(crypto, "_aesgcm", mock_aesgcm):
+
+ payload = {
+ "id": 123,
+ "subject": "System crash",
+ "contact_email": "user@domain.com",
+ "description": "Critical exception in auth service",
+ "raw_text": "Sensitive logs and stack traces",
+ "company_id": "company-99",
+ "priority": "critical"
+ }
+
+ encrypted_payload = crypto.encrypt_payload(payload)
+
+ # Target fields must be encrypted
+ self.assertTrue(encrypted_payload["contact_email"].startswith("enc:v1:"))
+ self.assertTrue(encrypted_payload["description"].startswith("enc:v1:"))
+ self.assertTrue(encrypted_payload["raw_text"].startswith("enc:v1:"))
+
+ # Non-target fields must remain untouched
+ self.assertEqual(encrypted_payload["id"], 123)
+ self.assertEqual(encrypted_payload["subject"], "System crash")
+ self.assertEqual(encrypted_payload["company_id"], "company-99")
+ self.assertEqual(encrypted_payload["priority"], "critical")
+
+ # Decrypt back
+ decrypted_payload = crypto.decrypt_payload(encrypted_payload)
+ self.assertEqual(decrypted_payload, payload)
+
+ def test_graceful_degrade_when_no_key_is_set(self):
+ """Verify database actions fall back to plaintext pass-through when encryption is disabled."""
+ with patch.object(crypto, "ENCRYPTION_ENABLED", False), \
+ patch.object(crypto, "_aesgcm", None):
+
+ plaintext = "Normal plaintext content."
+ encrypted = crypto.encrypt_value(plaintext)
+ decrypted = crypto.decrypt_value(encrypted)
+
+ self.assertEqual(encrypted, plaintext)
+ self.assertEqual(decrypted, plaintext)
+ # Test selectivity on row also passes through unchanged
+ payload = {
+ "contact_email": "test@test.com",
+ "description": "normal text"
+ }
+ encrypted_payload = crypto.encrypt_payload(payload)
+ self.assertEqual(encrypted_payload, payload)
-if __name__ == "__main__":
- unittest.main()
+ def test_legacy_data_pass_through_on_read(self):
+ """Verify that existing legacy plaintext database values are read as-is without errors."""
+ dummy_key = crypto.derive_cryptographic_key("test-key")
+ from cryptography.hazmat.primitives.ciphers.aead import AESGCM
+ mock_aesgcm = AESGCM(dummy_key)
+
+ with patch.object(crypto, "ENCRYPTION_ENABLED", True), \
+ patch.object(crypto, "_aesgcm", mock_aesgcm):
+
+ legacy_plaintext = "Old plaintext ticket from database."
+ decrypted = crypto.decrypt_value(legacy_plaintext)
+ self.assertEqual(decrypted, legacy_plaintext)
+
+ def test_transparent_client_wrapping(self):
+ """Test that the WrappedRequestBuilder hooks execute queries correctly."""
+ dummy_key = crypto.derive_cryptographic_key("test-key")
+ from cryptography.hazmat.primitives.ciphers.aead import AESGCM
+ mock_aesgcm = AESGCM(dummy_key)
+
+ with patch.object(crypto, "ENCRYPTION_ENABLED", True), \
+ patch.object(crypto, "_aesgcm", mock_aesgcm):
+
+ # Mock table/builder response
+ mock_builder = MagicMock()
+ mock_builder.insert.return_value = mock_builder
+ mock_builder.execute.return_value = MagicMock(data=[
+ {"description": crypto.encrypt_value("Success")}
+ ])
+
+ wrapped = crypto.WrappedRequestBuilder(mock_builder, "tickets")
+
+ # Test insert wraps the payload
+ payload = {"description": "Sensitive content"}
+ res = wrapped.insert(payload)
+
+ # The underlying mock insert should receive the encrypted description
+ mock_builder.insert.assert_called_once()
+ called_arg = mock_builder.insert.call_args[0][0]
+ self.assertTrue(called_arg["description"].startswith("enc:v1:"))
+
+ # Test execute decrypts the returned data
+ exec_res = res.execute()
+ self.assertEqual(exec_res.data[0]["description"], "Success")
diff --git a/backend/tests/test_mobile_supabase_env.py b/backend/tests/test_mobile_supabase_env.py
new file mode 100644
index 0000000000000000000000000000000000000000..d660db8ebbb340bbc49038734aeced8f8996a89a
--- /dev/null
+++ b/backend/tests/test_mobile_supabase_env.py
@@ -0,0 +1,37 @@
+from pathlib import Path
+
+
+def test_mobile_supabase_client_reads_expo_env_vars():
+ source = (
+ Path(__file__).resolve().parents[2]
+ / "MobileApp"
+ / "src"
+ / "lib"
+ / "supabase.js"
+ ).read_text(encoding="utf-8")
+
+ assert "process.env.EXPO_PUBLIC_SUPABASE_URL" in source
+ assert "process.env.EXPO_PUBLIC_SUPABASE_ANON_KEY" in source
+ assert "createClient(supabaseUrl, supabaseKey" in source
+
+
+def test_mobile_supabase_client_does_not_hardcode_project_credentials():
+ source = (
+ Path(__file__).resolve().parents[2]
+ / "MobileApp"
+ / "src"
+ / "lib"
+ / "supabase.js"
+ ).read_text(encoding="utf-8")
+
+ assert "aejuenhqciagpntcqoir.supabase.co" not in source
+ assert "eyJhbGciOiJIUzI1NiIsInR5cCI6IkpXVCJ9" not in source
+
+
+def test_mobile_env_example_documents_required_keys():
+ source = (
+ Path(__file__).resolve().parents[2] / "MobileApp" / ".env.example"
+ ).read_text(encoding="utf-8")
+
+ assert "EXPO_PUBLIC_SUPABASE_URL=" in source
+ assert "EXPO_PUBLIC_SUPABASE_ANON_KEY=" in source
diff --git a/requirements.txt b/requirements.txt
index 027a7ecfa63483eb6b341c26c4b095262fa00321..0ec23b13046705677428103b048ab20fe0a53130 100644
--- a/requirements.txt
+++ b/requirements.txt
@@ -4,6 +4,8 @@ datasets>=2.14.0
pandas>=2.0.0
scikit-learn>=1.3.0
sentence-transformers>=2.2.0
+onnxruntime>=1.17.0
+tokenizers>=0.15.0
fastapi>=0.104.0
uvicorn>=0.24.0
openpyxl>=3.1.0
@@ -15,4 +17,9 @@ easyocr
slowapi>=0.1.9
supabase==2.22.4
storage3==2.22.4
-prometheus-client>=0.17.0
+redis>=5.0.0
+pytest
+pytest-asyncio
+httpx
+cryptography>=42.0.0
+
diff --git a/supabase/functions/send-user-approval-email/index.ts b/supabase/functions/send-user-approval-email/index.ts
index baee5ce55a7db5512a9338a02c1cceb45a5daeee..9b599d0356a34910bb17469ad2e83b74cb7de248 100644
--- a/supabase/functions/send-user-approval-email/index.ts
+++ b/supabase/functions/send-user-approval-email/index.ts
@@ -1,69 +1,144 @@
-import { serve } from 'https://deno.land/std@0.168.0/http/server.ts';
+import { serve } from "https://deno.land/std@0.177.0/http/server.ts";
const corsHeaders = {
- 'Access-Control-Allow-Origin': '*',
- 'Access-Control-Allow-Methods': 'POST, OPTIONS',
- 'Access-Control-Allow-Headers': 'authorization, x-client-info, apikey, content-type',
+ "Access-Control-Allow-Origin": "*",
+ "Access-Control-Allow-Methods": "POST, OPTIONS",
+ "Access-Control-Allow-Headers":
+ "authorization, x-client-info, apikey, content-type",
};
+const RESEND_API_KEY = Deno.env.get("RESEND_API_KEY") || "";
+const FROM_EMAIL =
+ Deno.env.get("APPROVAL_FROM_EMAIL") ||
+ Deno.env.get("RESEND_FROM_EMAIL") ||
+ "HELPDESK.AI ";
+const DASHBOARD_URL =
+ Deno.env.get("FRONTEND_DASHBOARD_URL") ||
+ Deno.env.get("FRONTEND_URL") ||
+ "https://helpdeskaiv1.vercel.app/dashboard";
+
+function buildApprovalHtml(name: string, company: string): string {
+ const safeName = name || "there";
+ const safeCompany = company || "your organization";
+ return `
+
+
+
+
+
+
+ HELPDESK.AI
+ Account Approved
+
+
+
+
+ Hello ${safeName},
+
+ Your account for ${safeCompany} has been approved by your administrator.
+ You can now sign in and access your dashboard.
+
+
+
+
+
+
+ © 2026 HELPDESK.AI
+
+
+
+
+
+`;
+}
+
serve(async (req) => {
- // Handle CORS preflight requests
- if (req.method === 'OPTIONS') {
- return new Response(null, { status: 204, headers: corsHeaders });
- }
+ if (req.method === "OPTIONS") {
+ return new Response(null, { status: 204, headers: corsHeaders });
+ }
- try {
- const { userId, email, name, company } = await req.json();
+ try {
+ const { userId, email, name, company } = await req.json();
- if (!email) {
- throw new Error('Email is required');
- }
+ if (!email) {
+ throw new Error("Email is required");
+ }
- // Initialize Resend or another mail provider (Assuming user configures this later)
- // const RESEND_API_KEY = Deno.env.get('RESEND_API_KEY');
- // Currently simulating a successfully sent email.
+ if (!RESEND_API_KEY) {
+ console.warn(
+ `[send-user-approval-email] RESEND_API_KEY missing — cannot send to ${email}`,
+ );
+ return new Response(
+ JSON.stringify({
+ success: false,
+ error: "RESEND_API_KEY is not configured",
+ userId: userId ?? null,
+ }),
+ {
+ status: 503,
+ headers: { ...corsHeaders, "Content-Type": "application/json" },
+ },
+ );
+ }
+
+ console.log(
+ `[send-user-approval-email] Sending approval email to ${email} (user=${userId ?? "unknown"})`,
+ );
- console.log(`Sending approval email to ${email} for user ${name} in company ${company}...`);
+ const res = await fetch("https://api.resend.com/emails", {
+ method: "POST",
+ headers: {
+ "Content-Type": "application/json",
+ Authorization: `Bearer ${RESEND_API_KEY}`,
+ },
+ body: JSON.stringify({
+ from: FROM_EMAIL,
+ to: [email],
+ subject: "Account Approved — Welcome to HELPDESK.AI",
+ html: buildApprovalHtml(name, company),
+ }),
+ });
- // The email content could be sent via Resend:
- /*
- const res = await fetch('https://api.resend.com/emails', {
- method: 'POST',
- headers: {
- 'Content-Type': 'application/json',
- 'Authorization': `Bearer ${RESEND_API_KEY}`,
- },
- body: JSON.stringify({
- from: 'HelpDesk.ai ',
- to: [email],
- subject: 'Account Approved! Welcome to HelpDesk.ai',
- html: `
- Hello ${name},
- Your account for ${company} has been approved by your administrator!
- You can now log in to the system and access your dashboard.
- Go to Dashboard
- `
- })
- });
- */
+ const data = await res.json();
- return new Response(
- JSON.stringify({
- success: true,
- message: `Approval email simulated for ${email}`
- }),
- {
- status: 200,
- headers: { ...corsHeaders, 'Content-Type': 'application/json' }
- }
- );
- } catch (error) {
- return new Response(
- JSON.stringify({ error: error.message }),
- {
- status: 400,
- headers: { ...corsHeaders, 'Content-Type': 'application/json' }
- }
- );
+ if (!res.ok) {
+ console.error("[send-user-approval-email] Resend error:", data);
+ return new Response(
+ JSON.stringify({
+ success: false,
+ error: data?.message || "Failed to send approval email",
+ details: data,
+ }),
+ {
+ status: res.status,
+ headers: { ...corsHeaders, "Content-Type": "application/json" },
+ },
+ );
}
+
+ return new Response(
+ JSON.stringify({
+ success: true,
+ message: `Approval email sent to ${email}`,
+ resendId: data?.id ?? null,
+ }),
+ {
+ status: 200,
+ headers: { ...corsHeaders, "Content-Type": "application/json" },
+ },
+ );
+ } catch (error) {
+ const message = error instanceof Error ? error.message : String(error);
+ return new Response(JSON.stringify({ success: false, error: message }), {
+ status: 400,
+ headers: { ...corsHeaders, "Content-Type": "application/json" },
+ });
+ }
});
diff --git a/supabase/migrations/20260522080000_add_sla_escalation.sql b/supabase/migrations/20260522080000_add_sla_escalation.sql
index f5ad2bf7335f7d433af2aed55703585672755b5f..34248dbdb93cd9f8011f34c4dc2b57836bdace46 100644
--- a/supabase/migrations/20260522080000_add_sla_escalation.sql
+++ b/supabase/migrations/20260522080000_add_sla_escalation.sql
@@ -43,7 +43,7 @@ CREATE POLICY "Service role full audit access" ON audit_logs
CREATE POLICY "Admins can view own company audit logs" ON audit_logs
FOR SELECT USING (
company_id IN (
- SELECT company_id FROM user_companies WHERE user_id = auth.uid()
+ SELECT company_id FROM profiles WHERE id = auth.uid()
)
);
diff --git a/supabase/migrations/20260531_add_company_settings.sql b/supabase/migrations/20260531_add_company_settings.sql
index fd4c57390af67ed3298cd53189cdceb7a6893925..dab8ceb7186c5791311c06c59453dfa2471c8f28 100644
--- a/supabase/migrations/20260531_add_company_settings.sql
+++ b/supabase/migrations/20260531_add_company_settings.sql
@@ -17,6 +17,23 @@ CREATE TABLE system_settings (
admin_alerts BOOLEAN NOT NULL DEFAULT TRUE,
digest_frequency TEXT NOT NULL DEFAULT 'daily' CHECK (digest_frequency IN ('daily', 'weekly')),
updated_at TIMESTAMPTZ NOT NULL DEFAULT NOW()
+-- Create system_settings table for storing per-company system configuration
+
+-- NOTE: migration filename contains 'add_company_settings'. The migration now creates
+-- `system_settings` per the unified schema; filename unchanged for migration ordering.
+
+CREATE TABLE IF NOT EXISTS system_settings (
+ company_id UUID PRIMARY KEY,
+ ai_confidence_threshold FLOAT DEFAULT 0.80,
+ duplicate_sensitivity FLOAT DEFAULT 0.85,
+ enable_auto_resolve BOOLEAN DEFAULT FALSE,
+ auto_close_enabled BOOLEAN DEFAULT TRUE,
+ auto_close_days INTEGER DEFAULT 7,
+ email_notifications BOOLEAN DEFAULT TRUE,
+ admin_alerts BOOLEAN DEFAULT TRUE,
+ digest_frequency TEXT DEFAULT 'daily',
+ created_at TIMESTAMPTZ DEFAULT NOW(),
+ updated_at TIMESTAMPTZ DEFAULT NOW()
);
-- Enable Row Level Security
@@ -37,6 +54,49 @@ CREATE POLICY "Company members can manage own settings" ON system_settings
)
);
+CREATE POLICY "Admins can view own company settings" ON system_settings
+ FOR SELECT USING (
+ company_id IN (
+ SELECT company_id FROM profiles
+ WHERE id = auth.uid()
+ AND role IN ('admin', 'super_admin', 'master_admin')
+ )
+ );
+
+-- Admins can create and update settings for their own company from the dashboard.
+CREATE POLICY "Admins can insert own company settings" ON system_settings
+ FOR INSERT WITH CHECK (
+ company_id IN (
+ SELECT company_id FROM profiles
+ WHERE id = auth.uid()
+ AND role IN ('admin', 'super_admin', 'master_admin')
+ )
+ );
+
+CREATE POLICY "Admins can update own company settings" ON system_settings
+ FOR UPDATE USING (
+ company_id IN (
+ SELECT company_id FROM profiles
+ WHERE id = auth.uid()
+ AND role IN ('admin', 'super_admin', 'master_admin')
+ )
+ )
+ WITH CHECK (
+ company_id IN (
+ SELECT company_id FROM profiles
+ WHERE id = auth.uid()
+ AND role IN ('admin', 'super_admin', 'master_admin')
+ )
+ );
+
+CREATE OR REPLACE FUNCTION update_timestamp()
+RETURNS TRIGGER AS $$
+BEGIN
+ NEW.updated_at = NOW();
+ RETURN NEW;
+END;
+$$ LANGUAGE plpgsql;
+
-- Trigger to auto-update updated_at on modification
CREATE OR REPLACE FUNCTION update_system_settings_timestamp()
RETURNS TRIGGER LANGUAGE plpgsql AS $$