Final SaaS Security & Asset Support

backend/src/api/routes/auth.py

@@ -6,7 +6,8 @@ from pydantic import BaseModel, EmailStr
 
 from backend.src.db.session import get_db
 from backend.src.models.user import User
-from backend.src.utils.auth import get_password_hash, verify_password, create_access_token
+# generate_api_key ko import kiya 👇
+from backend.src.utils.auth import get_password_hash, verify_password, create_access_token, generate_api_key
 
 router = APIRouter()
 
@@ -16,12 +17,18 @@ class UserCreate(BaseModel):
     password: str
     full_name: str | None = None
 
+# Response model ko extend kiya taake registration par API Key nazar aaye
+class RegistrationResponse(BaseModel):
+    access_token: str
+    token_type: str
+    api_key: str # User ko registeration par hi uski chabi mil jayegi 🔑
+
 class Token(BaseModel):
     access_token: str
     token_type: str
 
 # --- 1. Registration Endpoint ---
-@router.post("/auth/register", response_model=Token)
+@router.post("/auth/register", response_model=RegistrationResponse)
 async def register(user_in: UserCreate, db: AsyncSession = Depends(get_db)):
     # Check agar email pehle se exist karta hai
     result = await db.execute(select(User).where(User.email == user_in.email))
@@ -33,28 +40,34 @@ async def register(user_in: UserCreate, db: AsyncSession = Depends(get_db)):
             detail="Email already registered"
         )
     
-    # Naya User Banao
+    # Naya User Banao + API Key Generate Karo (🔐)
     new_user = User(
         email=user_in.email,
         hashed_password=get_password_hash(user_in.password),
-        full_name=user_in.full_name
+        full_name=user_in.full_name,
+        api_key=generate_api_key(), # <--- Yeh line jadoo karegi
+        allowed_domains="*" # Default: Har jagah allow karo, user baad mein settings se lock kar lega
     )
+    
     db.add(new_user)
     await db.commit()
     await db.refresh(new_user)
     
     # Direct Login Token do
     access_token = create_access_token(data={"sub": str(new_user.id)})
-    return {"access_token": access_token, "token_type": "bearer"}
+    
+    return {
+        "access_token": access_token, 
+        "token_type": "bearer",
+        "api_key": new_user.api_key # Registeration ke waqt hi key show kar di
+    }
 
 # --- 2. Login Endpoint ---
 @router.post("/auth/login", response_model=Token)
 async def login(form_data: OAuth2PasswordRequestForm = Depends(), db: AsyncSession = Depends(get_db)):
-    # User dhoondo
-    result = await db.execute(select(User).where(User.email == form_data.username)) # OAuth2 form mein email 'username' field mein hota hai
+    result = await db.execute(select(User).where(User.email == form_data.username)) 
     user = result.scalars().first()
     
-    # Password check karo
     if not user or not verify_password(form_data.password, user.hashed_password):
         raise HTTPException(
             status_code=status.HTTP_401_UNAUTHORIZED,
@@ -62,6 +75,5 @@ async def login(form_data: OAuth2PasswordRequestForm = Depends(), db: AsyncSessi
             headers={"WWW-Authenticate": "Bearer"},
         )
     
-    # Token generate karo
     access_token = create_access_token(data={"sub": str(user.id)})
     return {"access_token": access_token, "token_type": "bearer"}

backend/src/api/routes/chat.py

@@ -1,50 +1,58 @@
-
-from fastapi import APIRouter, Depends, HTTPException
+from fastapi import APIRouter, Depends, HTTPException, Request
 from sqlalchemy.ext.asyncio import AsyncSession
+from sqlalchemy.future import select
 from backend.src.db.session import get_db
 from backend.src.schemas.chat import ChatRequest, ChatResponse
 from backend.src.services.chat_service import process_chat
-from backend.src.core.config import settings
-
-# --- Security Imports ---
-from backend.src.api.routes.deps import get_current_user
 from backend.src.models.user import User
 
 router = APIRouter()
 
 @router.post("/chat", response_model=ChatResponse)
 async def chat_endpoint(
-    request: ChatRequest, 
-    db: AsyncSession = Depends(get_db),
-    current_user: User = Depends(get_current_user) # <-- User Logged in hai
+    request_body: ChatRequest, 
+    request: Request, # Browser headers read karne ke liye
+    db: AsyncSession = Depends(get_db)
 ):
-    """
-    Protected Chat Endpoint.
-    Only accessible with a valid JWT Token.
-    """
     try:
-        # User ki ID token se aayegi (Secure)
-        # Session ID user maintain kar sakta hai taake alag-alag chats yaad rahein
-        user_id = str(current_user.id)
-        session_id = request.session_id or user_id # Fallback
+        # 1. API Key se Bot Owner (User) ko dhoondo
+        stmt = select(User).where(User.api_key == request_body.api_key)
+        result = await db.execute(stmt)
+        bot_owner = result.scalars().first()
+
+        if not bot_owner:
+            raise HTTPException(status_code=401, detail="Invalid API Key. Unauthorized access.")
+
+        # 2. DOMAIN LOCK LOGIC (Whitelisting)
+        # Browser automatically 'origin' ya 'referer' header bhejta hai
+        client_origin = request.headers.get("origin") or request.headers.get("referer") or ""
+        
+        if bot_owner.allowed_domains != "*":
+            allowed = [d.strip() for d in bot_owner.allowed_domains.split(",")]
+            # Check if client_origin contains any of the allowed domains
+            is_authorized = any(domain in client_origin for domain in allowed)
+            
+            if not is_authorized:
+                print(f"🚫 Blocked unauthorized domain: {client_origin}")
+                raise HTTPException(status_code=403, detail="Domain not authorized to use this bot.")
+
+        # 3. Process Chat (Using the bot_owner's credentials)
+        session_id = request_body.session_id or f"guest_{bot_owner.id}"
         
-        # --- FIX IS HERE: 'user_id' pass kiya ja raha hai ---
         response_text = await process_chat(
-            message=request.message,
+            message=request_body.message,
             session_id=session_id,
-            user_id=user_id, # <--- Ye hum bhool gaye thay
+            user_id=str(bot_owner.id), # Owner ki ID use hogi DB lookup ke liye
             db=db
         )
         
         return ChatResponse(
             response=response_text,
             session_id=session_id,
-            # 'provider' ab chat_service se aayega, humein yahan hardcode nahi karna
             provider="omni_agent" 
         )
         
+    except HTTPException as he: raise he
     except Exception as e:
-        print(f"Error in chat endpoint: {e}")
-        import traceback
-        traceback.print_exc() # Poora error print karega
-        raise HTTPException(status_code=500, detail=str(e))
+        print(f"❌ Chat Error: {e}")
+        raise HTTPException(status_code=500, detail="AI Service Interrupted.")

backend/src/api/routes/settings.py

@@ -1,4 +1,5 @@
 
+# ---  ---
 import json
 from fastapi import APIRouter, Depends, HTTPException, status
 from sqlalchemy.ext.asyncio import AsyncSession

backend/src/core/config.py

@@ -1,4 +1,4 @@
-
+# --- EXTERNAL IMPORTS ---
 import os
 from pydantic_settings import BaseSettings, SettingsConfigDict
 from functools import lru_cache

backend/src/db/session.py

@@ -1,3 +1,4 @@
+# --- EXTERNAL IMPORTS ---
 from sqlalchemy.ext.asyncio import create_async_engine, AsyncSession, async_sessionmaker
 from sqlalchemy import create_engine
 from backend.src.core.config import settings

backend/src/main.py

@@ -1,3 +1,4 @@
+# --- EXTERNAL IMPORTS ---
 import os
 from fastapi import FastAPI
 from fastapi.staticfiles import StaticFiles # <--- New Import

backend/src/models/user.py

@@ -1,4 +1,4 @@
-from sqlalchemy import Column, Integer, String, DateTime, Boolean, Text # Text add kiya
+from sqlalchemy import Column, Integer, String, DateTime, Boolean, Text
 from sqlalchemy.sql import func
 from backend.src.db.base import Base
 
@@ -11,7 +11,14 @@ class User(Base):
     full_name = Column(String, nullable=True)
     is_active = Column(Boolean, default=True)
     
-    # --- NEW: Bot Customization ---
+    # --- SaaS SECURITY & IDENTIFICATION (New 🔐) ---
+    # Har user ki apni unique API Key hogi
+    api_key = Column(String, unique=True, index=True, nullable=True)
+    # Konsi website par bot chal sakta hai (e.g., "usamatechodyssey.github.io")
+    # Default "*" ka matlab hai abhi har jagah chalega, baad mein lock kar sakte hain
+    allowed_domains = Column(String, default="*") 
+
+    # --- Bot Customization ---
     bot_name = Column(String, default="Support Agent")
     bot_instruction = Column(Text, default="You are a helpful customer support agent. Only answer questions related to the provided data.")
     

backend/src/schemas/chat.py

@@ -1,15 +1,12 @@
 from pydantic import BaseModel
 from typing import Optional
 
-# User jab sawal bhejegaecho $GOOGLE_API_KEY
 class ChatRequest(BaseModel):
     message: str
-    # Isay Optional bana diya. Default value None hai.
+    api_key: str  # <--- Unique key for security 🔑
     session_id: Optional[str] = None 
 
-# Server jab jawab dega
 class ChatResponse(BaseModel):
     response: str
-    # Yahan bhi Optional, kyunki guest ke paas ID nahi hogi
     session_id: Optional[str] = None 
     provider: str

backend/src/services/chat_service.py

@@ -1,182 +1,4 @@
 
-# import json
-# from sqlalchemy.ext.asyncio import AsyncSession
-# from sqlalchemy.future import select
-
-# # --- Model Imports ---
-# from backend.src.models.chat import ChatHistory
-# from backend.src.models.integration import UserIntegration
-
-# # --- Dynamic Factory & Tool Imports ---
-# from backend.src.services.llm.factory import get_llm_model
-# from backend.src.services.vector_store.qdrant_adapter import get_vector_store
-# from backend.src.services.security.pii_scrubber import PIIScrubber
-
-# # --- Agents ---
-# from backend.src.services.tools.secure_agent import get_secure_agent 
-# from backend.src.services.tools.nosql_agent import get_nosql_agent 
-# from backend.src.services.tools.cms_agent import get_cms_agent
-
-# # --- Router ---
-# from backend.src.services.routing.semantic_router import SemanticRouter
-
-# # --- LangChain Core ---
-# from langchain_core.messages import HumanMessage, AIMessage
-# from langchain_core.prompts import ChatPromptTemplate, MessagesPlaceholder
-
-# # ==========================================
-# # HELPER FUNCTIONS (UPDATED STRICT LOGIC)
-# # ==========================================
-
-# async def get_user_integrations(user_id: str, db: AsyncSession) -> dict:
-#     if not user_id: return {}
-    
-#     query = select(UserIntegration).where(UserIntegration.user_id == user_id, UserIntegration.is_active == True)
-#     result = await db.execute(query)
-#     integrations = result.scalars().all()
-    
-#     settings = {}
-#     for i in integrations:
-#         try:
-#             creds = json.loads(i.credentials)
-#             creds['provider'] = i.provider
-#             creds['schema_map'] = i.schema_map if i.schema_map else {}
-            
-#             # --- 🔥 FIX: NO DEFAULT DESCRIPTION ---
-#             # Agar DB mein description NULL hai, to NULL hi rehne do.
-#             # Hum isay Router mein add hi nahi karenge.
-#             creds['description'] = i.profile_description 
-            
-#             settings[i.provider] = creds
-#         except (json.JSONDecodeError, TypeError):
-#             continue
-#     return settings
-
-# async def save_chat_to_db(db: AsyncSession, session_id: str, human_msg: str, ai_msg: str, provider: str):
-#     if not session_id: return
-#     safe_human = PIIScrubber.scrub(human_msg)
-#     safe_ai = PIIScrubber.scrub(ai_msg)
-#     new_chat = ChatHistory(
-#         session_id=session_id, human_message=safe_human, ai_message=safe_ai, provider=provider
-#     )
-#     db.add(new_chat)
-#     await db.commit()
-
-# async def get_chat_history(session_id: str, db: AsyncSession):
-#     if not session_id: return []
-#     query = select(ChatHistory).where(ChatHistory.session_id == session_id).order_by(ChatHistory.timestamp.asc())
-#     result = await db.execute(query)
-#     return result.scalars().all()
-
-# OMNI_SUPPORT_PROMPT = "You are OmniAgent. Answer based on the provided context or chat history."
-
-# # ==========================================
-# # MAIN CHAT LOGIC
-# # ==========================================
-# async def process_chat(message: str, session_id: str, user_id: str, db: AsyncSession):
-    
-#     # 1. User Settings
-#     user_settings = await get_user_integrations(user_id, db)
-    
-#     # 2. LLM Check
-#     llm_creds = user_settings.get('groq') or user_settings.get('openai')
-#     if not llm_creds:
-#         return "Please configure your AI Model in Settings."
-
-#     # 3. Build Tool Map for Router (STRICT FILTERING)
-#     tools_map = {}
-#     for provider, config in user_settings.items():
-#         if provider in ['sanity', 'sql', 'mongodb']:
-#             # 🔥 Check: Agar Description hai, tabhi Router mein daalo
-#             if config.get('description'):
-#                 tools_map[provider] = config['description']
-#             else:
-#                 print(f"⚠️ [Router] Skipping {provider} - No Description found.")
-
-#     # 4. SEMANTIC DECISION
-#     selected_provider = None
-#     if tools_map:
-#         router = SemanticRouter()
-#         selected_provider = router.route(message, tools_map)
-#     else:
-#         print("⚠️ [Router] No active tools with descriptions found.")
-    
-#     response_text = ""
-#     provider_name = "general_chat"
-
-#     # 5. Route to Winner
-#     if selected_provider:
-#         print(f"👉 [Router] Selected Tool: {selected_provider.upper()}")
-#         try:
-#             if selected_provider == 'sanity':
-#                 schema = user_settings['sanity'].get('schema_map', {})
-#                 agent = get_cms_agent(user_id=user_id, schema_map=schema, llm_credentials=llm_creds)
-#                 res = await agent.ainvoke({"input": message})
-#                 response_text = str(res.get('output', ''))
-#                 provider_name = "cms_agent"
-
-#             elif selected_provider == 'sql':
-#                 role = "admin" if user_id == '99' else "customer"
-#                 agent = get_secure_agent(int(user_id), role, user_settings['sql'], llm_credentials=llm_creds)
-#                 res = await agent.ainvoke({"input": message})
-#                 response_text = str(res.get('output', ''))
-#                 provider_name = "sql_agent"
-
-#             elif selected_provider == 'mongodb':
-#                 agent = get_nosql_agent(user_id, user_settings['mongodb'], llm_credentials=llm_creds)
-#                 res = await agent.ainvoke({"input": message})
-#                 response_text = str(res.get('output', ''))
-#                 provider_name = "nosql_agent"
-
-#             # Anti-Hallucination
-#             if not response_text or "error" in response_text.lower():
-#                 response_text = "" # Trigger Fallback
-
-#         except Exception as e:
-#             print(f"❌ [Router] Execution Failed: {e}")
-#             response_text = "" 
-
-#     # 6. Fallback / RAG
-#     if not response_text:
-#         print("👉 [Router] Fallback to RAG/General Chat...")
-#         try:
-#             llm = get_llm_model(credentials=llm_creds)
-            
-#             context = ""
-#             if 'qdrant' in user_settings:
-#                 try:
-#                     vector_store = get_vector_store(credentials=user_settings['qdrant'])
-#                     docs = await vector_store.asimilarity_search(message, k=3)
-#                     if docs:
-#                         context = "\n\n".join([d.page_content for d in docs])
-#                 except Exception as e:
-#                     print(f"⚠️ RAG Warning: {e}")
-            
-#             system_instruction = OMNI_SUPPORT_PROMPT
-#             if context: system_instruction = f"Context:\n{context}"
-
-#             history = await get_chat_history(session_id, db)
-#             formatted_history = []
-#             for chat in history:
-#                 formatted_history.append(HumanMessage(content=chat.human_message))
-#                 if chat.ai_message: formatted_history.append(AIMessage(content=chat.ai_message))
-
-#             prompt = ChatPromptTemplate.from_messages([
-#                 ("system", system_instruction),
-#                 MessagesPlaceholder(variable_name="chat_history"),
-#                 ("human", "{question}")
-#             ])
-#             chain = prompt | llm
-            
-#             ai_response = await chain.ainvoke({"chat_history": formatted_history, "question": message})
-#             response_text = ai_response.content
-#             provider_name = "rag_fallback"
-
-#         except Exception as e:
-#             response_text = "I am currently unable to process your request."
-
-#     await save_chat_to_db(db, session_id, message, response_text, provider_name)
-#     return response_text
 import json
 from sqlalchemy.ext.asyncio import AsyncSession
 from sqlalchemy.future import select
@@ -386,213 +208,3 @@ async def process_chat(message: str, session_id: str, user_id: str, db: AsyncSes
     # 7. Save to DB
     await save_chat_to_db(db, session_id, message, response_text, provider_name)
     return response_text
-# import json
-# from sqlalchemy.ext.asyncio import AsyncSession
-# from sqlalchemy.future import select
-
-# # --- Model Imports ---
-# from backend.src.models.chat import ChatHistory
-# from backend.src.models.integration import UserIntegration
-# from backend.src.models.user import User  # Added User model for Bot Persona
-
-# # --- Dynamic Factory & Tool Imports ---
-# from backend.src.services.llm.factory import get_llm_model
-# from backend.src.services.vector_store.qdrant_adapter import get_vector_store
-# from backend.src.services.security.pii_scrubber import PIIScrubber
-
-# # --- Agents ---
-# from backend.src.services.tools.secure_agent import get_secure_agent 
-# from backend.src.services.tools.nosql_agent import get_nosql_agent 
-# from backend.src.services.tools.cms_agent import get_cms_agent
-
-# # --- Router ---
-# from backend.src.services.routing.semantic_router import SemanticRouter
-
-# # --- LangChain Core ---
-# from langchain_core.messages import HumanMessage, AIMessage
-# from langchain_core.prompts import ChatPromptTemplate, MessagesPlaceholder
-
-# # ==========================================
-# # HELPER FUNCTIONS
-# # ==========================================
-
-# async def get_user_integrations(user_id: str, db: AsyncSession) -> dict:
-#     """Fetches active integrations and filters valid descriptions."""
-#     if not user_id: return {}
-    
-#     query = select(UserIntegration).where(UserIntegration.user_id == user_id, UserIntegration.is_active == True)
-#     result = await db.execute(query)
-#     integrations = result.scalars().all()
-    
-#     settings = {}
-#     for i in integrations:
-#         try:
-#             creds = json.loads(i.credentials)
-#             creds['provider'] = i.provider
-#             creds['schema_map'] = i.schema_map if i.schema_map else {}
-            
-#             # --- STRICT CHECK ---
-#             # Agar Description NULL hai to dictionary mein mat daalo
-#             # Taake Router confuse na ho
-#             if i.profile_description:
-#                 creds['description'] = i.profile_description
-            
-#             settings[i.provider] = creds
-#         except (json.JSONDecodeError, TypeError):
-#             continue
-#     return settings
-
-# async def save_chat_to_db(db: AsyncSession, session_id: str, human_msg: str, ai_msg: str, provider: str):
-#     """Saves chat history with PII redaction."""
-#     if not session_id: return
-#     safe_human = PIIScrubber.scrub(human_msg)
-#     safe_ai = PIIScrubber.scrub(ai_msg)
-#     new_chat = ChatHistory(
-#         session_id=session_id, human_message=safe_human, ai_message=safe_ai, provider=provider
-#     )
-#     db.add(new_chat)
-#     await db.commit()
-
-# async def get_chat_history(session_id: str, db: AsyncSession):
-#     """Retrieves past conversation history."""
-#     if not session_id: return []
-#     query = select(ChatHistory).where(ChatHistory.session_id == session_id).order_by(ChatHistory.timestamp.asc())
-#     result = await db.execute(query)
-#     return result.scalars().all()
-
-# async def get_bot_persona(user_id: str, db: AsyncSession):
-#     """Fetches custom Bot Name and Instructions from User table."""
-#     try:
-#         result = await db.execute(select(User).where(User.id == int(user_id)))
-#         user = result.scalars().first()
-#         if user:
-#             return {
-#                 "name": getattr(user, "bot_name", "OmniAgent"),
-#                 "instruction": getattr(user, "bot_instruction", "You are a helpful AI assistant.")
-#             }
-#     except Exception:
-#         pass
-#     return {"name": "OmniAgent", "instruction": "You are a helpful AI assistant."}
-
-# # ==========================================
-# # MAIN CHAT LOGIC
-# # ==========================================
-# async def process_chat(message: str, session_id: str, user_id: str, db: AsyncSession):
-    
-#     # 1. Fetch User Settings & Persona
-#     user_settings = await get_user_integrations(user_id, db)
-#     bot_persona = await get_bot_persona(user_id, db)
-    
-#     # 2. LLM Check
-#     llm_creds = user_settings.get('groq') or user_settings.get('openai')
-#     if not llm_creds:
-#         return "Please configure your AI Model in Settings."
-
-#     # 3. Build Tool Map for Router (STRICT FILTERING)
-#     tools_map = {}
-#     for provider, config in user_settings.items():
-#         if provider in ['sanity', 'sql', 'mongodb']:
-#             # Sirf tab add karo agar description exist karti hai
-#             if config.get('description'):
-#                 tools_map[provider] = config['description']
-#             else:
-#                 print(f"⚠️ [Router] Skipping {provider} - No Description found.")
-
-#     # 4. SEMANTIC DECISION (Router)
-#     selected_provider = None
-#     if tools_map:
-#         router = SemanticRouter() # Singleton Instance
-#         selected_provider = router.route(message, tools_map)
-#     else:
-#         print("⚠️ [Router] No active tools with descriptions found.")
-    
-#     response_text = ""
-#     provider_name = "general_chat"
-
-#     # 5. Route to Winner (Tool Execution)
-#     if selected_provider:
-#         print(f"👉 [Router] Selected Tool: {selected_provider.upper()}")
-#         try:
-#             if selected_provider == 'sanity':
-#                 schema = user_settings['sanity'].get('schema_map', {})
-#                 agent = get_cms_agent(user_id=user_id, schema_map=schema, llm_credentials=llm_creds)
-#                 res = await agent.ainvoke({"input": message})
-#                 response_text = str(res.get('output', ''))
-#                 provider_name = "cms_agent"
-
-#             elif selected_provider == 'sql':
-#                 role = "admin" if user_id == '99' else "customer"
-#                 agent = get_secure_agent(int(user_id), role, user_settings['sql'], llm_credentials=llm_creds)
-#                 res = await agent.ainvoke({"input": message})
-#                 response_text = str(res.get('output', ''))
-#                 provider_name = "sql_agent"
-
-#             elif selected_provider == 'mongodb':
-#                 agent = get_nosql_agent(user_id, user_settings['mongodb'], llm_credentials=llm_creds)
-#                 res = await agent.ainvoke({"input": message})
-#                 response_text = str(res.get('output', ''))
-#                 provider_name = "nosql_agent"
-
-#             # Anti-Hallucination Check
-#             if not response_text or "error" in response_text.lower():
-#                 print(f"⚠️ [Router] Tool {selected_provider} failed/empty. Triggering Fallback.")
-#                 response_text = "" # Clears response to trigger fallback below
-
-#         except Exception as e:
-#             print(f"❌ [Router] Execution Failed: {e}")
-#             response_text = "" 
-
-#     # 6. Fallback / RAG (General Chat)
-#     if not response_text:
-#         print("👉 [Router] Fallback to RAG/General Chat...")
-#         try:
-#             llm = get_llm_model(credentials=llm_creds)
-            
-#             # Context from Vector DB
-#             context = ""
-#             if 'qdrant' in user_settings:
-#                 try:
-#                     vector_store = get_vector_store(credentials=user_settings['qdrant'])
-#                     docs = await vector_store.asimilarity_search(message, k=3)
-#                     if docs:
-#                         context = "\n\n".join([d.page_content for d in docs])
-#                 except Exception as e:
-#                     print(f"⚠️ RAG Warning: {e}")
-            
-#             # --- DYNAMIC SYSTEM PROMPT (PERSONA) ---
-#             system_instruction = f"""
-#             IDENTITY: You are '{bot_persona['name']}'.
-#             MISSION: {bot_persona['instruction']}
-            
-#             CONTEXT FROM KNOWLEDGE BASE:
-#             {context if context else "No specific documents found."}
-            
-#             Answer the user's question based on the context above or your general knowledge if permitted by your mission.
-#             """
-
-#             # History Load
-#             history = await get_chat_history(session_id, db)
-#             formatted_history = []
-#             for chat in history:
-#                 formatted_history.append(HumanMessage(content=chat.human_message))
-#                 if chat.ai_message: formatted_history.append(AIMessage(content=chat.ai_message))
-
-#             # LLM Call
-#             prompt = ChatPromptTemplate.from_messages([
-#                 ("system", system_instruction),
-#                 MessagesPlaceholder(variable_name="chat_history"),
-#                 ("human", "{question}")
-#             ])
-#             chain = prompt | llm
-            
-#             ai_response = await chain.ainvoke({"chat_history": formatted_history, "question": message})
-#             response_text = ai_response.content
-#             provider_name = "rag_fallback"
-
-#         except Exception as e:
-#             print(f"❌ Fallback Error: {e}")
-#             response_text = "I am currently unable to process your request. Please check your AI configuration."
-
-#     # 7. Save to DB
-#     await save_chat_to_db(db, session_id, message, response_text, provider_name)
-#     return response_text

backend/src/utils/auth.py

@@ -1,9 +1,10 @@
+import secrets # Cryptographically strong random numbers generate karne ke liye
 from passlib.context import CryptContext
 from datetime import datetime, timedelta
 from jose import jwt
 from backend.src.core.config import settings
 
-# Password Hasher (Bcrypt)
+# Password Hasher (Bcrypt/Argon2)
 pwd_context = CryptContext(schemes=["argon2"], deprecated="auto")
 
 # JWT Configuration
@@ -24,7 +25,16 @@ def create_access_token(data: dict):
     expire = datetime.utcnow() + timedelta(minutes=ACCESS_TOKEN_EXPIRE_MINUTES)
     to_encode.update({"exp": expire})
     
-    # Secret Key config se lenge (Ensure karein ke config mein ho)
     secret_key = settings.SECRET_KEY
     encoded_jwt = jwt.encode(to_encode, secret_key, algorithm=ALGORITHM)
-    return encoded_jwt
+    return encoded_jwt
+
+# --- NEW: SaaS API KEY GENERATOR (🔐) ---
+def generate_api_key():
+    """
+    Ek unique aur secure API Key banata hai.
+    Format: omni_as87d... (64 characters long)
+    """
+    # 32 bytes ka random token jo URL-safe string ban jayega
+    random_string = secrets.token_urlsafe(32)
+    return f"omni_{random_string}"

backend/src/utils/security.py

@@ -1,3 +1,4 @@
+# --- EXTERNAL IMPORTS ---
 from cryptography.fernet import Fernet
 import base64
 

requirements.txt

@@ -1,3 +1,4 @@
+# Requirements for the project
 accelerate==1.12.0
 aiofiles==25.1.0
 aiohappyeyeballs==2.6.1

static/widget.js

@@ -1,55 +1,70 @@
 (function() {
     // ----------------------------------------------------
-    // 1. CONFIGURATION
+    // 1. CONFIGURATION: Security & Metadata
     // ----------------------------------------------------
     const scriptTag = document.currentScript;
     
-    const USER_ID = scriptTag.getAttribute("data-user-id"); 
+    // Ab hum User ID nahi, balki secure API Key mangenge 🔑
+    const API_KEY = scriptTag.getAttribute("data-api-key"); 
     const API_URL = scriptTag.getAttribute("data-api-url");
-    const THEME_COLOR = scriptTag.getAttribute("data-theme-color") || "#007bff";
+    const THEME_COLOR = scriptTag.getAttribute("data-theme-color") || "#FF0000"; // Default Red for your theme
 
-    if (!USER_ID || !API_URL) {
-        console.error("OmniAgent Widget Error: data-user-id or data-api-url is missing!");
+    if (!API_KEY || !API_URL) {
+        console.error("OmniAgent Security Error: data-api-key or data-api-url is missing!");
         return;
     }
 
     const CHAT_SESSION_ID = "omni_session_" + Math.random().toString(36).slice(2, 11); 
 
     // ----------------------------------------------------
-    // 2. STYLES
+    // 2. STYLES: UI & Responsive Design
     // ----------------------------------------------------
     const style = document.createElement('style');
     style.innerHTML = `
         #omni-widget-container {
-            position: fixed; bottom: 20px; right: 20px; z-index: 999999; font-family: 'Segoe UI', Roboto, Helvetica, Arial, sans-serif;
+            position: fixed; bottom: 20px; right: 20px; z-index: 999999; 
+            font-family: 'Segoe UI', Roboto, Helvetica, Arial, sans-serif;
         }
         #omni-chat-btn {
             background: ${THEME_COLOR}; color: white; border: none; padding: 15px; border-radius: 50%;
-            cursor: pointer; box-shadow: 0 4px 12px rgba(0,0,0,0.4); width: 60px; height: 60px; font-size: 24px;
-            display: flex; align-items: center; justify-content: center; transition: transform 0.2s;
+            cursor: pointer; box-shadow: 0 4px 15px rgba(0,0,0,0.3); width: 60px; height: 60px; font-size: 24px;
+            display: flex; align-items: center; justify-content: center; transition: all 0.3s cubic-bezier(0.175, 0.885, 0.32, 1.275);
         }
-        #omni-chat-btn:hover { transform: scale(1.1); }
+        #omni-chat-btn:hover { transform: scale(1.1) rotate(5deg); }
+        
         #omni-chat-window {
-            display: none; width: 350px; height: 500px; background: white; border-radius: 12px;
-            box-shadow: 0 10px 30px rgba(0,0,0,0.5); flex-direction: column; overflow: hidden;
-            margin-bottom: 15px; border: 1px solid #ddd;
+            display: none; width: 370px; height: 550px; background: white; border-radius: 16px;
+            box-shadow: 0 12px 40px rgba(0,0,0,0.2); flex-direction: column; overflow: hidden;
+            margin-bottom: 20px; border: 1px solid #f0f0f0; animation: omniSlideUp 0.4s ease;
+        }
+        
+        @keyframes omniSlideUp {
+            from { opacity: 0; transform: translateY(30px); }
+            to { opacity: 1; transform: translateY(0); }
         }
+
         #omni-header { 
-            background: ${THEME_COLOR}; color: white; padding: 15px; font-weight: 600; display: flex; 
-            justify-content: space-between; align-items: center;
+            background: ${THEME_COLOR}; color: white; padding: 18px; font-weight: 600; display: flex; 
+            justify-content: space-between; align-items: center; letter-spacing: 0.5px;
         }
-        #omni-messages { flex: 1; padding: 15px; overflow-y: auto; background: #f9f9f9; display: flex; flex-direction: column; }
-        #omni-input-area { display: flex; border-top: 1px solid #ddd; background: white; }
-        #omni-input { flex: 1; padding: 12px; border: none; outline: none; font-size: 14px; }
-        #omni-send { background: transparent; border: none; color: ${THEME_COLOR}; font-weight: bold; cursor: pointer; padding: 0 15px; font-size: 20px; }
-        .omni-msg { margin: 8px 0; padding: 10px 14px; border-radius: 15px; max-width: 85%; font-size: 14px; word-wrap: break-word; }
-        .omni-msg.user { background: ${THEME_COLOR}; color: white; align-self: flex-end; border-bottom-right-radius: 2px; }
-        .omni-msg.bot { background: #eef2f7; color: #333; align-self: flex-start; border-bottom-left-radius: 2px; border: 1px solid #d1d9e6; }
+        #omni-messages { flex: 1; padding: 20px; overflow-y: auto; background: #ffffff; display: flex; flex-direction: column; }
+        #omni-input-area { display: flex; border-top: 1px solid #eee; background: #fff; padding: 10px; }
+        #omni-input { flex: 1; padding: 12px; border: 1px solid #eee; border-radius: 25px; outline: none; font-size: 14px; background: #f8f9fa; }
+        #omni-send { background: transparent; border: none; color: ${THEME_COLOR}; font-weight: bold; cursor: pointer; padding: 0 12px; font-size: 22px; }
+        
+        .omni-msg { margin: 10px 0; padding: 12px 16px; border-radius: 18px; max-width: 85%; font-size: 14px; line-height: 1.5; word-wrap: break-word; position: relative; }
+        .omni-msg.user { background: ${THEME_COLOR}; color: white; align-self: flex-end; border-bottom-right-radius: 2px; box-shadow: 0 4px 10px rgba(0,0,0,0.1); }
+        .omni-msg.bot { background: #f0f2f5; color: #1c1e21; align-self: flex-start; border-bottom-left-radius: 2px; }
+        
+        /* Custom Scrollbar */
+        #omni-messages::-webkit-scrollbar { width: 5px; }
+        #omni-messages::-webkit-scrollbar-track { background: #f1f1f1; }
+        #omni-messages::-webkit-scrollbar-thumb { background: #ccc; border-radius: 10px; }
     `;
     document.head.appendChild(style);
 
     // ----------------------------------------------------
-    // 3. UI LOGIC (Pehle Define Karen)
+    // 3. UI LOGIC: Global Toggle Function
     // ----------------------------------------------------
     window.toggleOmniChat = function() {
         const win = document.getElementById('omni-chat-window');
@@ -62,7 +77,7 @@
     };
 
     // ----------------------------------------------------
-    // 4. HTML STRUCTURE
+    // 4. HTML STRUCTURE: Dynamic Insertion
     // ----------------------------------------------------
     const container = document.createElement('div');
     container.id = 'omni-widget-container';
@@ -70,12 +85,15 @@
     container.innerHTML = `
         <div id="omni-chat-window">
             <div id="omni-header">
-                <span>AI Support Agent</span>
-                <span style="cursor:pointer; font-size: 22px; line-height: 20px;" onclick="window.toggleOmniChat()">×</span>
+                <div style="display:flex; align-items:center; gap:10px;">
+                    <div style="width:10px; height:10px; background:#2ecc71; border-radius:50%;"></div>
+                    <span>AI Knowledge Assistant</span>
+                </div>
+                <span style="cursor:pointer; font-size: 24px; font-weight:300;" onclick="window.toggleOmniChat()">×</span>
             </div>
             <div id="omni-messages"></div>
             <div id="omni-input-area">
-                <input type="text" id="omni-input" placeholder="Ask me anything..." autocomplete="off" />
+                <input type="text" id="omni-input" placeholder="Type a message..." autocomplete="off" />
                 <button id="omni-send">➤</button>
             </div>
         </div>
@@ -85,7 +103,7 @@
     document.body.appendChild(container);
 
     // ----------------------------------------------------
-    // 5. CHAT FUNCTIONALITY
+    // 5. CHAT ENGINE: Fetch & Security Headers
     // ----------------------------------------------------
     const inputField = document.getElementById('omni-input');
     const sendButton = document.getElementById('omni-send');
@@ -94,9 +112,10 @@
     function addMessage(text, sender) {
         const div = document.createElement('div');
         div.className = `omni-msg ${sender}`;
+        // URL auto-linking logic
         div.innerHTML = text.replace(/(https?:\/\/[^\s]+)/g, '<a href="$1" target="_blank" style="color:inherit; text-decoration:underline;">$1</a>');
         messagesContainer.appendChild(div);
-        messagesContainer.scrollTop = messagesContainer.scrollHeight;
+        messagesContainer.scrollTo({ top: messagesContainer.scrollHeight, behavior: 'smooth' });
     }
 
     async function sendMessage() {
@@ -106,40 +125,53 @@
         addMessage(text, 'user');
         inputField.value = '';
         
-        // Show Loading State
+        // Loading dots logic
         const loadingDiv = document.createElement('div');
         loadingDiv.className = 'omni-msg bot';
-        loadingDiv.innerHTML = '...';
+        loadingDiv.innerHTML = '<span class="omni-dots">...</span>';
         messagesContainer.appendChild(loadingDiv);
+        messagesContainer.scrollTop = messagesContainer.scrollHeight;
 
         try {
             const response = await fetch(`${API_URL}/api/v1/chat`, {
                 method: 'POST',
-                headers: { 'Content-Type': 'application/json' },
+                headers: { 
+                    'Content-Type': 'application/json'
+                },
                 body: JSON.stringify({
                     message: text,
                     session_id: CHAT_SESSION_ID,
-                    user_id: USER_ID 
+                    api_key: API_KEY // 🔑 Secure Auth
                 })
             });
+
             const data = await response.json();
             messagesContainer.removeChild(loadingDiv);
-            addMessage(data.response || data.message || "No response received", 'bot'); 
+
+            if (response.status === 401) {
+                addMessage("🚫 Security Error: Invalid API Key.", 'bot');
+            } else if (response.status === 403) {
+                addMessage("🚫 Security Error: Domain not authorized.", 'bot');
+            } else {
+                addMessage(data.response || "I couldn't process that. Please try again.", 'bot'); 
+            }
+
         } catch (error) {
-            messagesContainer.removeChild(loadingDiv);
-            addMessage("Connection error. Please try again.", 'bot');
+            if (loadingDiv.parentNode) messagesContainer.removeChild(loadingDiv);
+            addMessage("📡 Connection lost. Is the AI server online?", 'bot');
             console.error("OmniAgent API Error:", error);
         }
     }
 
+    // Event Listeners
     sendButton.addEventListener('click', sendMessage);
     inputField.addEventListener('keypress', (e) => { 
         if(e.key === 'Enter') { sendMessage(); }
     });
 
-    // Welcome Message
+    // Initial Welcome (AI Persona)
     setTimeout(() => {
-        addMessage("Hello! How can I assist you with the SDD-RI Book today?", "bot");
-    }, 1000);
+        addMessage("Hello! I am your AI assistant. How can I help you today?", "bot");
+    }, 1500);
 
 })();