merging changes

backend/app.py

@@ -44,6 +44,11 @@ SUPABASE_KEY = (
 )
 SUPABASE_CLAIMS_BUCKET = (os.getenv("SUPABASE_CLAIMS_BUCKET") or "").strip()
 SUPABASE_CLAIMS_PREFIX = (os.getenv("SUPABASE_CLAIMS_PREFIX") or "").strip().strip("/")
+SUPABASE_TAXONOMY_TABLES = (os.getenv("SUPABASE_TAXONOMY_TABLES") or "").strip().lower() in (
+    "1",
+    "true",
+    "yes",
+)
 
 _supabase_client = None
 
@@ -204,6 +209,44 @@ def _next_id(existing_ids: List[str], prefix: str) -> str:
 
 
 def _load_taxonomy() -> Tuple[Dict[str, str], Dict[str, str], Dict[str, str]]:
+    if SUPABASE_TAXONOMY_TABLES and _supabase_enabled():
+        sb = _get_supabase()
+        try:
+            sc_rows = sb.table("taxonomy_superclaims").select("id,text").execute().data or []
+            nc_rows = (
+                sb.table("taxonomy_subclaims")
+                .select("id,text,superclaim_id")
+                .execute()
+                .data
+                or []
+            )
+        except Exception as e:
+            raise HTTPException(status_code=500, detail=f"Supabase taxonomy table read failed: {e}") from e
+
+        super_norm = {}
+        for r in sc_rows:
+            if not isinstance(r, dict):
+                continue
+            sid = _normalize_superclaim_id(str(r.get("id") or "").strip())
+            txt = str(r.get("text") or "").strip()
+            if sid and txt:
+                super_norm[sid] = txt
+
+        codebook_norm = {}
+        map_norm = {}
+        for r in nc_rows:
+            if not isinstance(r, dict):
+                continue
+            nid = _normalize_subclaim_id(str(r.get("id") or "").strip())
+            txt = str(r.get("text") or "").strip()
+            sc = _normalize_superclaim_id(str(r.get("superclaim_id") or "").strip())
+            if nid and txt:
+                codebook_norm[nid] = txt
+            if nid and sc:
+                map_norm[nid] = sc
+
+        return codebook_norm, super_norm, map_norm
+
     codebook = _read_claim_json(CODEBOOK_NAME)
     superclaims = _read_claim_json(SUPERCLAIMS_NAME)
     claim_map = _read_claim_json(MAP_NAME)
@@ -350,6 +393,7 @@ class ProposalActionResponse(BaseModel):
 
 class ReviewerActionRequest(BaseModel):
     reviewer_name: str = Field(..., min_length=1, max_length=120)
+    skip_taxonomy_update: bool = False
 
 
 def _parse_ts_to_epoch(value: Any) -> float:
@@ -876,6 +920,18 @@ def apply_proposal(proposal_id: str, req: ReviewerActionRequest) -> ProposalActi
 
     codebook, superclaims, claim_map = _load_taxonomy()
 
+    # In "browser-writes-taxonomy" mode, the frontend will update Supabase tables directly.
+    # The backend should only mark/log the proposal as applied.
+    if req.skip_taxonomy_update:
+        now = time.time()
+        p.payload = {**p.payload, "appliedAt": now}
+        p.appliedBy = req.reviewer_name.strip()
+        p.appliedAt = now
+        if p.type in ("merge_subclaims", "merge_superclaims"):
+            _append_merge_event(p)
+        p = _upsert_proposal(p)
+        return ProposalActionResponse(ok=True, proposal=p)
+
     if p.type == "new_superclaim":
         text = str(p.payload.get("superclaimText") or "").strip()
         if not text:

backend/supabase_schema.sql

@@ -41,3 +41,59 @@ create table if not exists public.taxonomy_merge_log (
 
 alter table public.taxonomy_merge_log enable row level security;
 revoke all on public.taxonomy_merge_log from anon, authenticated;
+
+-- ============================================================================
+-- Public taxonomy tables (browser read/write, NO auth)
+--
+-- WARNING: The policies below intentionally allow anonymous users to mutate
+-- taxonomy. Only enable this for trusted/private deployments.
+-- ============================================================================
+
+create table if not exists public.taxonomy_superclaims (
+  id text primary key,
+  text text not null,
+  created_at timestamptz not null default now(),
+  updated_at timestamptz not null default now()
+);
+
+create table if not exists public.taxonomy_subclaims (
+  id text primary key,
+  text text not null,
+  superclaim_id text not null references public.taxonomy_superclaims(id) on update cascade on delete restrict,
+  created_at timestamptz not null default now(),
+  updated_at timestamptz not null default now()
+);
+
+create index if not exists taxonomy_subclaims_superclaim_idx
+  on public.taxonomy_subclaims (superclaim_id);
+
+alter table public.taxonomy_superclaims enable row level security;
+alter table public.taxonomy_subclaims enable row level security;
+
+-- Public read/write policies (anon + authenticated).
+drop policy if exists "public superclaims read" on public.taxonomy_superclaims;
+create policy "public superclaims read"
+  on public.taxonomy_superclaims for select
+  using (true);
+
+drop policy if exists "public superclaims write" on public.taxonomy_superclaims;
+create policy "public superclaims write"
+  on public.taxonomy_superclaims for all
+  using (true)
+  with check (true);
+
+drop policy if exists "public subclaims read" on public.taxonomy_subclaims;
+create policy "public subclaims read"
+  on public.taxonomy_subclaims for select
+  using (true);
+
+drop policy if exists "public subclaims write" on public.taxonomy_subclaims;
+create policy "public subclaims write"
+  on public.taxonomy_subclaims for all
+  using (true)
+  with check (true);
+
+-- Allow PostgREST access for anon/authenticated roles.
+grant usage on schema public to anon, authenticated;
+grant select, insert, update, delete on public.taxonomy_superclaims to anon, authenticated;
+grant select, insert, update, delete on public.taxonomy_subclaims to anon, authenticated;

index.html

@@ -5,8 +5,12 @@
   <title>Native Ads Claim Mapping</title>
   <meta name="viewport" content="width=device-width, initial-scale=1" />
   <!-- Optional: set to your deployed API origin when not using a same-origin /api rewrite (e.g. file:// or custom static hosting). Example: https://claims-backend-sigma.vercel.app -->
-  <meta name="claims-api-base" content="" />
+  <meta name="claims-api-base" content="https://claims-backend-sigma.vercel.app" />
+  <!-- Optional: enable browser write access to Supabase taxonomy tables -->
+  <meta name="supabase-url" content="" />
+  <meta name="supabase-anon-key" content="" />
   <link rel="stylesheet" href="styles.css" />
+  <script src="https://cdn.jsdelivr.net/npm/@supabase/supabase-js@2"></script>
 </head>
 <body>
   <main class="app">

script.js

@@ -701,6 +701,108 @@ function escapeHtml(s) {
 
 const REVIEWER_STORAGE_KEY = "CLAIMS_REVIEWER_NAME";
 
+function getSupabaseConfig() {
+  const metaUrl = document.querySelector('meta[name="supabase-url"]');
+  const metaKey = document.querySelector('meta[name="supabase-anon-key"]');
+  const url = (metaUrl && metaUrl.getAttribute("content")) || "";
+  const key = (metaKey && metaKey.getAttribute("content")) || "";
+  return { url: String(url || "").trim(), key: String(key || "").trim() };
+}
+
+function getSupabaseClient() {
+  const cfg = getSupabaseConfig();
+  if (!cfg.url || !cfg.key) return null;
+  if (typeof window === "undefined") return null;
+  if (!window.supabase || typeof window.supabase.createClient !== "function") return null;
+  try {
+    return window.supabase.createClient(cfg.url, cfg.key);
+  } catch {
+    return null;
+  }
+}
+
+function nextIdFromRows(rows, prefix) {
+  let max = 0;
+  for (const r of rows || []) {
+    const id = String(r?.id || "");
+    if (!id.startsWith(prefix)) continue;
+    const n = parseInt(id.slice(prefix.length), 10);
+    if (!Number.isNaN(n)) max = Math.max(max, n);
+  }
+  return `${prefix}${max + 1}`;
+}
+
+async function applyProposalToSupabaseTaxonomy(p) {
+  const sb = getSupabaseClient();
+  if (!sb) throw new Error("Supabase taxonomy config missing (set meta supabase-url and supabase-anon-key).");
+
+  const type = String(p?.type || "");
+  const payload = p?.payload || {};
+
+  if (type === "new_superclaim") {
+    const text = String(payload.superclaimText || "").trim();
+    if (!text) throw new Error("Missing superclaimText");
+
+    const { data: existing, error: selErr } = await sb
+      .from("taxonomy_superclaims")
+      .select("id")
+      .order("id", { ascending: false });
+    if (selErr) throw new Error(selErr.message || String(selErr));
+
+    const newId = nextIdFromRows(existing || [], "SC_");
+    const { error: insErr } = await sb.from("taxonomy_superclaims").insert({ id: newId, text });
+    if (insErr) throw new Error(insErr.message || String(insErr));
+    return;
+  }
+
+  if (type === "merge_subclaims") {
+    const canonical = String(payload.canonicalSubclaimId || "").trim();
+    const remove = String(payload.removeSubclaimId || "").trim();
+    if (!canonical || !remove || canonical === remove) throw new Error("Missing canonical/remove subclaim ids");
+
+    const { data: rows, error } = await sb
+      .from("taxonomy_subclaims")
+      .select("id,superclaim_id")
+      .in("id", [canonical, remove]);
+    if (error) throw new Error(error.message || String(error));
+    const canonRow = (rows || []).find((r) => String(r.id) === canonical);
+    const remRow = (rows || []).find((r) => String(r.id) === remove);
+    if (!canonRow || !remRow) throw new Error("Unknown subclaim id(s) in taxonomy_subclaims");
+    if (String(canonRow.superclaim_id) !== String(remRow.superclaim_id)) {
+      throw new Error("Refusing merge: subclaims are not mapped to the same superclaim.");
+    }
+
+    const { error: delErr } = await sb.from("taxonomy_subclaims").delete().eq("id", remove);
+    if (delErr) throw new Error(delErr.message || String(delErr));
+    return;
+  }
+
+  if (type === "merge_superclaims") {
+    const canonical = String(payload.canonicalSuperclaimId || "").trim();
+    const remove = String(payload.removeSuperclaimId || "").trim();
+    if (!canonical || !remove || canonical === remove) throw new Error("Missing canonical/remove superclaim ids");
+
+    const { data: rows, error } = await sb
+      .from("taxonomy_superclaims")
+      .select("id")
+      .in("id", [canonical, remove]);
+    if (error) throw new Error(error.message || String(error));
+    if (!Array.isArray(rows) || rows.length !== 2) throw new Error("Unknown superclaim id(s) in taxonomy_superclaims");
+
+    const { error: updErr } = await sb
+      .from("taxonomy_subclaims")
+      .update({ superclaim_id: canonical })
+      .eq("superclaim_id", remove);
+    if (updErr) throw new Error(updErr.message || String(updErr));
+
+    const { error: delErr } = await sb.from("taxonomy_superclaims").delete().eq("id", remove);
+    if (delErr) throw new Error(delErr.message || String(delErr));
+    return;
+  }
+
+  throw new Error(`Unsupported proposal type for browser taxonomy apply: ${type}`);
+}
+
 function getReviewerName() {
   const el = document.getElementById("reviewer-name");
   const fromInput = el && el.value != null ? String(el.value).trim() : "";
@@ -1064,8 +1166,10 @@ async function refreshPendingProposals() {
 
   const wrap = document.createElement("div");
   wrap.className = "proposal-list";
+  const byId = new Map();
 
   proposals.forEach((p) => {
+    if (p && p.id) byId.set(String(p.id), p);
     const card = document.createElement("article");
     card.className = "proposal-card";
     card.innerHTML = `
@@ -1107,9 +1211,19 @@ async function refreshPendingProposals() {
           el.disabled = false;
           return;
         }
-        await postJson(`/api/proposals/${encodeURIComponent(id)}/${action}`, {
-          reviewer_name: reviewer,
-        });
+        if (action === "apply" && getSupabaseClient()) {
+          const p = byId.get(String(id));
+          if (!p) throw new Error("Missing proposal payload in UI.");
+          await applyProposalToSupabaseTaxonomy(p);
+          await postJson(`/api/proposals/${encodeURIComponent(id)}/${action}`, {
+            reviewer_name: reviewer,
+            skip_taxonomy_update: true,
+          });
+        } else {
+          await postJson(`/api/proposals/${encodeURIComponent(id)}/${action}`, {
+            reviewer_name: reviewer,
+          });
+        }
         // Applying should also refresh claims data next run; for now just refresh the list.
         await refreshPendingProposals();
       } catch (e) {