siftlode/backend/app/routes/debug_sessions.py

"""Debug sessions (E16): Start → reproduce → Stop, the screenshots, and the evidence under review.

The session itself — what tags a request, its cap, its level — is `app/debugsession.py`. These routes
are the user's handle on their OWN sessions only: another user's id 404s (`owned_or_404`), including
for an admin, who reads everyone's lines in the diagnostics console instead. The shared demo account
cannot record: its log would interleave every visitor under one account.

Screenshots arrive as a raw image body (`image/png`, `image/jpeg`, `image/webp`), not a multipart
form — one image per request, capped while it arrives, and kept only if its bytes really are one of
those types, whatever the Content-Type claimed.
"""

from datetime import datetime, timezone

from fastapi import APIRouter, Depends, HTTPException, Request, Response
from pydantic import BaseModel
from sqlalchemy import select
from sqlalchemy.exc import IntegrityError
from sqlalchemy.orm import Session

from app import debugsession, logs, logsink
from app.auth import require_human
from app.db import get_db
from app.models import DebugScreenshot, DebugSession, User
from app.routes._common import capped_body, not_found, owned_or_404
from app.utils import iso

router = APIRouter(prefix="/api/debug-sessions", tags=["diagnostics"])
log = logs.get_logger(__name__)

# Sessions listed in Settings → Diagnosztika, newest first: enough to reach last week's unsent draft.
LIST_MAX = 20


class StartIn(BaseModel):
    level: debugsession.SessionLevel


def _view(db: Session, session: DebugSession) -> dict:
    return debugsession.serialize(session, debugsession.screenshot_count(db, session)) or {}


@router.post("")
def start_session(
    body: StartIn,
    user: User = Depends(require_human),
    db: Session = Depends(get_db),
) -> dict:
    """Start recording, or join the recording already running (another tab started it)."""
    try:
        session = debugsession.start(db, user, body.level)
        db.commit()
    except IntegrityError:
        # A concurrent Start won the one-open-per-user index: join that one.
        db.rollback()
        session = debugsession.open_session(db, user)
        if session is None:
            raise HTTPException(status_code=409, detail={"code": "session_conflict"})
    # The rest of THIS request is part of the session too.
    level, until = debugsession.level_for(user, session)
    logs.set_user(user.id, level, until, session.id)
    log.info(
        "debug session started",
        extra=logs.event("debug.session.started", level=session.level, until=iso(session.until)),
    )
    return {"ok": True, "session": _view(db, session)}


@router.post("/{sid}/stop")
def stop_session(
    sid: str, user: User = Depends(require_human), db: Session = Depends(get_db)
) -> dict:
    session = owned_or_404(db, DebugSession, sid, user, what="debug_session")
    if session.ended_at is None:
        # Logged BEFORE the session closes, while this request still carries its tag: the last line
        # of the evidence is the Stop itself.
        log.info("debug session stopped", extra=logs.event("debug.session.stopped"))
        # Past its cap it had already ended on its own; a late Stop must not rename that.
        live = session.until > datetime.now(timezone.utc)
        reason = debugsession.EndReason.STOPPED if live else debugsession.EndReason.EXPIRED
        debugsession.end(session, reason)
        db.commit()
    return {"ok": True, "session": _view(db, session)}


@router.get("")
def list_sessions(user: User = Depends(require_human), db: Session = Depends(get_db)) -> dict:
    sessions = db.scalars(
        select(DebugSession)
        .where(DebugSession.user_id == user.id)
        .order_by(DebugSession.started_at.desc())
        .limit(LIST_MAX)
    ).all()
    return {"items": [_view(db, s) for s in sessions]}


@router.get("/{sid}")
def get_session(
    sid: str, user: User = Depends(require_human), db: Session = Depends(get_db)
) -> dict:
    return _view(db, owned_or_404(db, DebugSession, sid, user, what="debug_session"))


@router.get("/{sid}/events")
def session_events(
    sid: str, user: User = Depends(require_human), db: Session = Depends(get_db)
) -> dict:
    """The rows an issue from this session would carry — browser and server, in time order."""
    session = owned_or_404(db, DebugSession, sid, user, what="debug_session")
    rows, total = debugsession.bundle(db, session)
    return {"items": [logsink.serialize(r) for r in rows], "total": total}


# --- screenshots ---------------------------------------------------------------------------
def _shot_view(shot: DebugScreenshot) -> dict:
    return {"id": shot.id, "mime": shot.mime, "size": shot.size, "created_at": iso(shot.created_at)}


@router.get("/{sid}/screenshots")
def list_screenshots(
    sid: str, user: User = Depends(require_human), db: Session = Depends(get_db)
) -> dict:
    session = owned_or_404(db, DebugSession, sid, user, what="debug_session")
    return {"items": [_shot_view(s) for s in debugsession.screenshots(db, session)]}


def _upload_target(
    sid: str, user: User = Depends(require_human), db: Session = Depends(get_db)
) -> DebugSession:
    return owned_or_404(db, DebugSession, sid, user, what="debug_session")


async def _image_body(request: Request) -> bytes:
    return await capped_body(request, debugsession.SCREENSHOT_MAX_BYTES)


@router.post("/{sid}/screenshots")
def add_screenshot(
    # The owner check FIRST: dependencies resolve in order, so a stranger's upload is refused
    # before a byte of it is read.
    session: DebugSession = Depends(_upload_target),
    data: bytes = Depends(_image_body),
    db: Session = Depends(get_db),
) -> dict:
    try:
        shot = debugsession.add_screenshot(db, session, data)
    except debugsession.ScreenshotRefused as exc:
        raise HTTPException(
            status_code=422, detail={"code": "screenshot_refused", "reason": exc.code}
        ) from exc
    db.commit()
    return {"ok": True, "screenshot": _shot_view(shot)}


def _session_screenshot(db: Session, sid: str, shot_id: int, user: User) -> DebugScreenshot:
    session = owned_or_404(db, DebugSession, sid, user, what="debug_session")
    shot = db.get(DebugScreenshot, shot_id)
    if shot is None or shot.session_id != session.id:
        raise not_found("screenshot")
    return shot


@router.get("/{sid}/screenshots/{shot_id}")
def get_screenshot(
    sid: str, shot_id: int, user: User = Depends(require_human), db: Session = Depends(get_db)
) -> Response:
    shot = _session_screenshot(db, sid, shot_id, user)
    # `nosniff`: the type was checked against the bytes at upload, and the browser must not guess.
    return Response(
        content=shot.data,
        media_type=shot.mime,
        headers={"Cache-Control": "private, max-age=3600", "X-Content-Type-Options": "nosniff"},
    )


@router.delete("/{sid}/screenshots/{shot_id}")
def delete_screenshot(
    sid: str, shot_id: int, user: User = Depends(require_human), db: Session = Depends(get_db)
) -> dict:
    shot = _session_screenshot(db, sid, shot_id, user)
    db.delete(shot)
    db.commit()
    return {"ok": True, "deleted": shot_id}