Upload folder using huggingface_hub

backend/app/models.py

@@ -85,7 +85,8 @@ class Sighting(Base):
     lng: Mapped[float | None] = mapped_column(Float, default=None)
     spotted_at: Mapped[dt.datetime | None] = mapped_column(DateTime, default=None)
 
-    reporter_contact: Mapped[str | None] = mapped_column(String(255), default=None)
+    # Chiffré au repos (PII du trouveur) → Text : le blob « enc1:… » dépasse 255 car.
+    reporter_contact: Mapped[str | None] = mapped_column(Text, default=None)
 
     # open | linked | dismissed
     status: Mapped[str] = mapped_column(String(20), default="open")
@@ -190,7 +191,8 @@ class ContactLead(Base):
     sighting_id: Mapped[int | None] = mapped_column(
         ForeignKey("sightings.id"), default=None
     )
-    finder_contact: Mapped[str | None] = mapped_column(String(255), default=None)
+    # Chiffré au repos (PII du trouveur) → Text : le blob « enc1:… » dépasse 255 car.
+    finder_contact: Mapped[str | None] = mapped_column(Text, default=None)
     message: Mapped[str | None] = mapped_column(Text, default=None)
     confidence: Mapped[float | None] = mapped_column(Float, default=None)
     created_at: Mapped[dt.datetime] = mapped_column(DateTime, default=_now)

backend/app/routers/admin.py

@@ -225,7 +225,7 @@ def overview(db: Session = Depends(get_db)):
             "photos": [storage.photo_url(p) for p in c.photos],
             "leads": [
                 {"ref": make_ref("lead", le.id),
-                 "contact": le.finder_contact, "message": le.message,
+                 "contact": crypto.decrypt_str(le.finder_contact), "message": le.message,
                  "confidence": le.confidence, "created_at": str(le.created_at)}
                 for le in c.leads
             ],
@@ -293,7 +293,7 @@ def lookup_event(ref: str, db: Session = Depends(get_db)):
             "name": c.name, "status": c.status, "email": c.email, "phone": crypto.decrypt_str(c.phone),
             "description": c.description, "created_at": str(c.created_at),
             "photos": [storage.photo_url(p) for p in c.photos],
-            "leads": [{"ref": make_ref("lead", le.id), "contact": le.finder_contact,
+            "leads": [{"ref": make_ref("lead", le.id), "contact": crypto.decrypt_str(le.finder_contact),
                        "message": le.message, "created_at": str(le.created_at)}
                       for le in c.leads],
         }
@@ -303,7 +303,7 @@ def lookup_event(ref: str, db: Session = Depends(get_db)):
             raise HTTPException(404, "Événement introuvable")
         return {
             "ref": make_ref("sighting", s.id), "type": "sighting", "id": s.id,
-            "status": s.status, "reporter_contact": s.reporter_contact,
+            "status": s.status, "reporter_contact": crypto.decrypt_str(s.reporter_contact),
             "lat": s.lat, "lng": s.lng, "matched_cat_id": s.matched_cat_id,
             "confidence": s.matched_confidence, "created_at": str(s.created_at),
             "photos": [storage.photo_url(p) for p in s.photos],
@@ -317,7 +317,7 @@ def lookup_event(ref: str, db: Session = Depends(get_db)):
         "cat_id": le.cat_id, "cat_ref": make_ref("cat", le.cat_id) if le.cat_id else None,
         "sighting_id": le.sighting_id,
         "sighting_ref": make_ref("sighting", le.sighting_id) if le.sighting_id else None,
-        "finder_contact": le.finder_contact, "message": le.message,
+        "finder_contact": crypto.decrypt_str(le.finder_contact), "message": le.message,
         "confidence": le.confidence, "created_at": str(le.created_at),
         "photos": [storage.photo_url(p) for p in (le.sighting.photos if le.sighting else [])],
     }

backend/app/routers/sightings.py

@@ -17,7 +17,7 @@ from fastapi import (APIRouter, BackgroundTasks, Depends, File, Form, Header,
 from sqlalchemy import select
 from sqlalchemy.orm import Session
 
-from .. import config, mailer, matching, models, ratelimit, schemas, serialize, storage
+from .. import config, crypto, mailer, matching, models, ratelimit, schemas, serialize, storage
 from ..database import SessionLocal, get_db
 from ..geo import approx_coord
 from ..refs import make_ref
@@ -114,9 +114,9 @@ def _analyze_sighting_bg(sighting_id: int, radius_km: float | None = None) -> No
             s.matched_confidence = float(cands[0]["similarity"])
         db.commit()
         # Accusé au trouveur (privé) une fois l'analyse faite → reflète le vrai résultat.
-        if s.reporter_contact and "@" in s.reporter_contact:
-            _send_sighting_confirmation(s.reporter_contact, bool(cands),
-                                        make_ref("sighting", s.id))
+        _rep = crypto.decrypt_str(s.reporter_contact)   # chiffré au repos
+        if _rep and "@" in _rep:
+            _send_sighting_confirmation(_rep, bool(cands), make_ref("sighting", s.id))
     except Exception:
         db.rollback()
         # État terminal de repli (0 candidat) pour débloquer le sondage.
@@ -155,8 +155,9 @@ def create_sighting(
     storage.guard_count(photos)
     real = [f for f in photos if f and f.filename]
     ratelimit.enforce_daily_image_quota(request, len(real))   # quota 50/jour/IP
-    # Clamp anti-500 Postgres : reporter_contact = VARCHAR(255) (saisie libre).
-    _reporter = serialize.clip(reporter_email, 255)
+    # Clamp anti-500 Postgres, puis CHIFFREMENT au repos : le courriel du trouveur
+    # est de la PII de tiers — un dump de la base ne doit pas l'exposer.
+    _reporter = crypto.encrypt_str(serialize.clip(reporter_email, 255))
     sighting = models.Sighting(
         description=serialize.clip_description(description), lat=approx_coord(lat), lng=approx_coord(lng),
         reporter_contact=_reporter,
@@ -294,10 +295,13 @@ def leave_lead(
     ))
     _contact = (payload.finder_contact or "").strip() or None
     _message = (payload.message or "").strip() or None
+    # Déduplication : le contact est CHIFFRÉ au repos et Fernet n'est pas
+    # déterministe (même texte → chiffré différent). On compare donc les valeurs
+    # DÉCHIFFRÉES, pas les blobs.
     dup = next(
         (le for le in existing
          if le.cat_id == cat.id
-         and (le.finder_contact or None) == _contact
+         and (crypto.decrypt_str(le.finder_contact) or None) == _contact
          and (le.message or None) == _message),
         None,
     )
@@ -315,7 +319,8 @@ def leave_lead(
 
     lead = models.ContactLead(
         cat_id=cat.id, sighting_id=s.id,
-        finder_contact=_contact, message=_message,
+        # PII de tiers → chiffrée au repos (déchiffrée à l'affichage propriétaire/admin).
+        finder_contact=crypto.encrypt_str(_contact), message=_message,
         confidence=s.matched_confidence,
     )
     db.add(lead)

backend/app/serialize.py

@@ -10,7 +10,7 @@ from __future__ import annotations
 import json
 import re
 
-from . import models, schemas, storage
+from . import crypto, models, schemas, storage
 
 # La description est saisie librement par le propriétaire et MONTRÉE au trouveur.
 # La promesse de confidentialité = le trouveur ne voit jamais le contact du
@@ -142,7 +142,7 @@ def sighting_out(s: models.Sighting) -> schemas.SightingOut:
         lat=s.lat,
         lng=s.lng,
         spotted_at=s.spotted_at,
-        reporter_contact=s.reporter_contact,
+        reporter_contact=crypto.decrypt_str(s.reporter_contact),
         status=s.status,
         created_at=s.created_at,
         photos=[photo_out(p) for p in s.photos],
@@ -199,7 +199,7 @@ def lead_out(le: models.ContactLead) -> schemas.LeadOut:
         photo_url = storage.photo_url(s.photos[0])
     return schemas.LeadOut(
         id=le.id,
-        finder_contact=le.finder_contact,
+        finder_contact=crypto.decrypt_str(le.finder_contact),
         message=le.message,
         confidence=le.confidence,
         created_at=le.created_at,

backend/migrations/versions/d5a1c8b73e90_widen_contacts_text.py

@@ -0,0 +1,57 @@
+"""widen reporter_contact / finder_contact to Text (contacts chiffrés — fix 500 Postgres)
+
+Revision ID: d5a1c8b73e90
+Revises: c9a4e7f21b56
+Create Date: 2026-07-26 00:00:00.000000
+
+Les coordonnées du TROUVEUR (courriel d'accusé de réception et contact laissé au
+propriétaire) sont de la PII de tiers : elles sont désormais chiffrées au repos
+(Fernet → « enc1:… », 125 à 425 caractères selon la saisie). Les colonnes étaient
+restées en VARCHAR(255) : sur Postgres (Neon), tout INSERT aurait levé
+`StringDataRightTruncation` → 500. Même classe de bug que cats.phone
+(migration e7d9c1f0a2b3). On élargit les deux colonnes en Text.
+"""
+from typing import Sequence, Union
+
+import sqlalchemy as sa
+from alembic import op
+
+# revision identifiers, used by Alembic.
+revision: str = 'd5a1c8b73e90'
+down_revision: Union[str, Sequence[str], None] = 'c9a4e7f21b56'
+branch_labels: Union[str, Sequence[str], None] = None
+depends_on: Union[str, Sequence[str], None] = None
+
+
+def upgrade() -> None:
+    with op.batch_alter_table('sightings', schema=None) as batch_op:
+        batch_op.alter_column(
+            'reporter_contact',
+            existing_type=sa.String(length=255),
+            type_=sa.Text(),
+            existing_nullable=True,
+        )
+    with op.batch_alter_table('contact_leads', schema=None) as batch_op:
+        batch_op.alter_column(
+            'finder_contact',
+            existing_type=sa.String(length=255),
+            type_=sa.Text(),
+            existing_nullable=True,
+        )
+
+
+def downgrade() -> None:
+    with op.batch_alter_table('sightings', schema=None) as batch_op:
+        batch_op.alter_column(
+            'reporter_contact',
+            existing_type=sa.Text(),
+            type_=sa.String(length=255),
+            existing_nullable=True,
+        )
+    with op.batch_alter_table('contact_leads', schema=None) as batch_op:
+        batch_op.alter_column(
+            'finder_contact',
+            existing_type=sa.Text(),
+            type_=sa.String(length=255),
+            existing_nullable=True,
+        )