Delete main.py

main.py

@@ -1,723 +0,0 @@
-"""
-Eatlytic v4 — Modular FastAPI Application
-=========================================
-Architecture:
-  app/models/db.py        — SQLite schema, connection, caching
-  app/services/auth.py    — User accounts, OTP, sessions
-  app/services/payments.py— Razorpay integration (real payments)
-  app/services/image.py   — Blur detection + Wiener deblurring pipeline
-  app/services/ocr.py     — EasyOCR wrapper, label detection
-  app/services/llm.py     — LLM abstraction, food DB population
-  app/routes/auth.py      — /auth/* endpoints
-  app/routes/payments.py  — /payments/* endpoints
-  app/routes/food_db.py   — /food-db/* endpoints (Phase 2 moat)
-  app/routes/benchmarks.py— /benchmarks/* endpoints (accuracy system)
-  main.py                 — app factory, legacy routes, startup
-
-Run: uvicorn main:app --host 0.0.0.0 --port 7860
-Test: pytest tests/ -v
-"""
-
-import os
-import re
-import json
-import asyncio
-import logging
-import hashlib
-import datetime
-import secrets
-from io import BytesIO
-
-from fastapi import FastAPI, File, UploadFile, Form, Request, HTTPException, Security
-from fastapi.middleware.cors import CORSMiddleware
-from fastapi.responses import FileResponse, JSONResponse, Response
-from fastapi.security import APIKeyHeader
-from slowapi import Limiter, _rate_limit_exceeded_handler
-from slowapi.util import get_remote_address
-from slowapi.errors import RateLimitExceeded
-
-# ── DuckDuckGo: guarded import ─────────────────────────────────────────
-try:
-    from duckduckgo_search import DDGS as _DDGS; _DDGS_OK = True
-except Exception:
-    _DDGS = None; _DDGS_OK = False
-
-logging.basicConfig(level=logging.INFO)
-logger = logging.getLogger(__name__)
-
-# ── App factory ────────────────────────────────────────────────────────
-limiter = Limiter(key_func=get_remote_address)
-app     = FastAPI(title="Eatlytic v4 — Food Intelligence", version="4.0")
-app.state.limiter = limiter
-app.add_exception_handler(RateLimitExceeded, _rate_limit_exceeded_handler)
-
-_ALLOWED_ORIGIN = os.environ.get("ALLOWED_ORIGIN", "*")
-app.add_middleware(
-    CORSMiddleware,
-    allow_origins     = [_ALLOWED_ORIGIN],
-    allow_methods     = ["GET", "POST", "DELETE", "PATCH"],
-    allow_headers     = ["*"],
-    allow_credentials = _ALLOWED_ORIGIN != "*",
-)
-
-# ── DB init at startup ─────────────────────────────────────────────────
-from app.models.db import init_db, db_conn
-init_db()
-
-# ── Import + mount modular routers ────────────────────────────────────
-from app.routes.auth       import router as auth_router
-from app.routes.payments   import router as payments_router
-from app.routes.food_db    import router as food_db_router
-from app.routes.benchmarks import router as benchmarks_router
-
-app.include_router(auth_router)
-app.include_router(payments_router)
-app.include_router(food_db_router)
-app.include_router(benchmarks_router)
-
-# ── Import services ────────────────────────────────────────────────────
-from app.services.image import (
-    validate_image, assess_image_quality, deblur_and_enhance,
-    image_to_b64, ocr_quality_score,
-)
-from app.services.ocr import run_ocr, detect_label_presence
-from app.services.llm import (
-    analyse_label, upsert_food_product, MEDICAL_DISCLAIMER, LANGUAGE_MAP
-)
-from app.services.auth import (
-    get_user_from_token, check_and_increment_scan_user,
-    update_streak_user,
-)
-
-FREE_SCAN_LIMIT = int(os.environ.get("FREE_SCAN_LIMIT", "10"))
-GROQ_API_KEY    = os.environ.get("GROQ_API_KEY", "")
-api_key_header  = APIKeyHeader(name="X-API-Key", auto_error=False)
-
-
-# ── Auth helpers ───────────────────────────────────────────────────────
-def _get_request_user(request: Request):
-    """Extract authenticated user from Bearer token (optional)."""
-    auth  = request.headers.get("Authorization", "")
-    token = auth.removeprefix("Bearer ").strip() if auth.startswith("Bearer ") else None
-    return get_user_from_token(token) if token else None
-
-
-def _device_key(request: Request) -> str:
-    ip = request.client.host if request.client else "unknown"
-    ua = request.headers.get("user-agent", "")
-    return hashlib.md5(f"{ip}:{ua}".encode()).hexdigest()[:16]
-
-
-def _ensure_device(device_key: str):
-    try:
-        with db_conn() as conn:
-            conn.execute("INSERT OR IGNORE INTO devices(device_key) VALUES(?)", (device_key,))
-    except Exception:
-        pass
-
-
-def _check_scan_quota(user, device_key: str) -> dict:
-    """Check quota for authenticated user; fall back to device for anonymous."""
-    if user:
-        return check_and_increment_scan_user(user["id"])
-    # Legacy anonymous path
-    month_key = datetime.date.today().isoformat()[:7]
-    _ensure_device(device_key)
-    with db_conn() as conn:
-        row = conn.execute(
-            "SELECT is_pro, month, scan_count FROM devices WHERE device_key=?", (device_key,)
-        ).fetchone()
-        if not row:
-            return {"allowed": False, "scans_used": 0, "scans_remaining": 0, "is_pro": False}
-        if row["month"] != month_key:
-            conn.execute("UPDATE devices SET month=?, scan_count=0 WHERE device_key=?",
-                         (month_key, device_key))
-            count = 0
-        else:
-            count = row["scan_count"]
-        if row["is_pro"]:
-            conn.execute("UPDATE devices SET scan_count=scan_count+1 WHERE device_key=?", (device_key,))
-            return {"allowed": True, "scans_used": count+1, "scans_remaining": 9999, "is_pro": True}
-        if count >= FREE_SCAN_LIMIT:
-            return {"allowed": False, "scans_used": count, "scans_remaining": 0, "is_pro": False}
-        conn.execute("UPDATE devices SET scan_count=scan_count+1 WHERE device_key=?", (device_key,))
-        new = count + 1
-        return {"allowed": True, "scans_used": new,
-                "scans_remaining": FREE_SCAN_LIMIT - new, "is_pro": False}
-
-
-def _get_live_search(query: str) -> str:
-    if not _DDGS_OK:
-        return "Web search unavailable."
-    try:
-        with _DDGS() as ddgs:
-            results = [f"{r['title']}: {r['body']}" for r in ddgs.text(query, max_results=3)]
-        return "\n".join(results) if results else "No web data."
-    except Exception as exc:
-        logger.warning("Web search: %s", exc)
-        return "No web data."
-
-
-def _verify_api_key(api_key: str = Security(api_key_header)):
-    if not api_key:
-        return None
-    with db_conn() as conn:
-        row = conn.execute(
-            "SELECT * FROM api_keys WHERE api_key=? AND active=1", (api_key,)
-        ).fetchone()
-    return dict(row) if row else None
-
-
-# ══════════════════════════════════════════════════════════════════════
-#  CORE ROUTES
-# ══════════════════════════════════════════════════════════════════════
-
-@app.get("/")
-async def home():
-    return FileResponse("index.html")
-
-
-@app.get("/health")
-async def health():
-    return {"status": "ok", "version": "4.0", "db": "sqlite-wal"}
-
-
-@app.post("/check-image")
-@limiter.limit("30/minute")
-async def check_image(request: Request, image: UploadFile = File(...)):
-    content = await image.read()
-    content = validate_image(content)
-    return assess_image_quality(content)
-
-
-@app.post("/enhance-preview")
-@limiter.limit("20/minute")
-async def enhance_preview(request: Request, image: UploadFile = File(...)):
-    content = await image.read()
-    content = validate_image(content)
-    quality = assess_image_quality(content)
-    if not quality["is_blurry"]:
-        return JSONResponse({"deblurred": False, "message": "Image already clear.", "quality": quality})
-    enhanced, method_log = deblur_and_enhance(content, quality["blur_severity"])
-    return JSONResponse({"deblurred": True, "image_b64": image_to_b64(enhanced),
-                         "method_log": method_log, "quality_before": quality})
-
-
-@app.post("/ocr")
-@limiter.limit("20/minute")
-async def perform_ocr(request: Request, image: UploadFile = File(...),
-                      language: str = Form("en")):
-    content = await image.read()
-    content = validate_image(content)
-    return run_ocr(content, language)
-
-
-@app.post("/analyze")
-@limiter.limit("15/minute")
-async def analyze_product(
-    request          : Request,
-    persona          : str        = Form(...),
-    age_group        : str        = Form("adult"),
-    product_category : str        = Form("general"),
-    language         : str        = Form("en"),
-    extracted_text   : str        = Form(None),
-    image            : UploadFile = File(...),
-):
-    if not GROQ_API_KEY:
-        return JSONResponse({"error": "Server error: GROQ_API_KEY not set"})
-
-    user       = _get_request_user(request)
-    device_key = _device_key(request)
-    scan_check = _check_scan_quota(user, device_key)
-
-    if not scan_check["allowed"]:
-        return JSONResponse(status_code=402, content={
-            "error"      : "scan_limit_reached",
-            "message"    : f"You've used all {FREE_SCAN_LIMIT} free scans this month.",
-            "upgrade_url": "/payments/create-order",
-        })
-
-    try:
-        content = await image.read()
-        content = validate_image(content)          # ← 10MB limit enforcement
-        quality = assess_image_quality(content)
-        blur_info = {"detected": quality["is_blurry"], "severity": quality["blur_severity"],
-                     "score": quality["blur_score"], "deblurred": False,
-                     "method_log": None, "image_b64": None, "ocr_source": "original"}
-        working = content
-
-        if quality["is_blurry"]:
-            try:
-                enhanced, method_log = deblur_and_enhance(content, quality["blur_severity"])
-                if (ocr_quality_score(run_ocr(enhanced, language)) >=
-                        ocr_quality_score(run_ocr(content, language)) * 0.85):
-                    working                 = enhanced
-                    blur_info["deblurred"]  = True
-                    blur_info["method_log"] = method_log
-                    blur_info["image_b64"]  = image_to_b64(enhanced)
-                    blur_info["ocr_source"] = "deblurred"
-                    extracted_text          = None
-            except Exception as exc:
-                logger.warning("Deblur failed: %s", exc)
-
-        if not extracted_text:
-            ocr_result     = run_ocr(working, language)
-            extracted_text = ocr_result["text"]
-            ocr_word_count = ocr_result["word_count"]
-        else:
-            ocr_word_count = len(extracted_text.split())
-
-        if not extracted_text or ocr_word_count == 0:
-            return JSONResponse({"error": "no_text",
-                "message": "No text found. Make sure the label side is facing the camera.",
-                "tip": "flip_product"})
-
-        label_check = detect_label_presence(extracted_text)
-        if not label_check["has_label"]:
-            tip = label_check["suggestion"] or "flip_product"
-            msg = ("This looks like the front of the product. Flip it over and scan the back label."
-                   if tip == "wrong_side" else "Could not find nutrition or ingredient information.")
-            return JSONResponse({"error": "no_label", "message": msg, "tip": tip,
-                                 "front_words_found": label_check.get("front_hits", [])})
-
-        # Allergen check
-        allergen_warning = ""
-        owner_id = user["id"] if user else None
-        try:
-            with db_conn() as conn:
-                row = conn.execute(
-                    "SELECT allergens,conditions FROM allergen_profiles WHERE device_key=?",
-                    (device_key,)
-                ).fetchone()
-            if row:
-                tl       = extracted_text.lower()
-                triggered = [a for a in json.loads(row["allergens"] or "[]") if a.lower() in tl] + \
-                            [c for c in json.loads(row["conditions"] or "[]") if c.lower() in tl]
-                if triggered:
-                    allergen_warning = f"⚠️ ALLERGEN ALERT — may contain: {', '.join(triggered)}"
-        except Exception as exc:
-            logger.warning("Allergen check: %s", exc)
-
-        # Web search (non-blocking)
-        web_context = await asyncio.to_thread(
-            _get_live_search, f"health analysis ingredients {extracted_text[:120]}")
-
-        # LLM analysis
-        result = await analyse_label(
-            extracted_text, persona, age_group, product_category,
-            language, web_context, blur_info, label_check.get("confidence", "medium")
-        )
-        result["allergen_warning"] = allergen_warning
-        result["blur_info"]        = blur_info
-        result["scan_meta"]        = scan_check
-
-        # Auto-log to daily tracker
-        today = datetime.date.today().isoformat()
-        nutr  = {n["name"].lower(): float(n.get("value", 0))
-                 for n in result.get("nutrient_breakdown", [])
-                 if isinstance(n.get("value"), (int, float))}
-        cal  = nutr.get("energy", nutr.get("calories", nutr.get("calorie", 0)))
-        prot = nutr.get("protein", 0)
-        carb = nutr.get("carbohydrate", nutr.get("carbs", 0))
-        fat  = nutr.get("fat", 0)
-        sod  = nutr.get("sodium", 0)
-        fib  = nutr.get("fiber", nutr.get("fibre", 0))
-        sug  = nutr.get("sugar", nutr.get("sugars", 0))
-
-        with db_conn() as conn:
-            conn.execute(
-                """INSERT INTO daily_logs(user_id,device_key,log_date,meal_name,
-                   calories,protein,carbs,fat,sodium,fiber,sugar,source) VALUES(?,?,?,?,?,?,?,?,?,?,?,?)""",
-                (owner_id, device_key, today, result.get("product_name","Scanned item"),
-                 cal, prot, carb, fat, sod, fib, sug, "scan")
-            )
-            conn.execute(
-                """INSERT INTO scans(user_id,device_key,product_name,score,verdict,
-                   calories,protein,carbs,fat,sodium,fiber,sugar,persona,language,analysis_json)
-                   VALUES(?,?,?,?,?,?,?,?,?,?,?,?,?,?,?)""",
-                (owner_id, device_key, result.get("product_name","Unknown"),
-                 result.get("score", 0), result.get("verdict", ""),
-                 cal, prot, carb, fat, sod, fib, sug, persona, language,
-                 json.dumps({k: v for k, v in result.items()
-                             if k not in ("blur_info","scan_meta","allergen_warning")}))
-            )
-
-        # Phase 2: populate proprietary food database
-        try:
-            upsert_food_product(
-                name=result.get("product_name", ""),
-                nutrients=result.get("nutrient_breakdown", []),
-                score=result.get("score", 0),
-                ingredients_raw=extracted_text,
-                category=result.get("product_category", ""),
-                source="llm_scan",
-            )
-        except Exception as exc:
-            logger.warning("Food DB upsert: %s", exc)
-
-        # Update streak
-        if user:
-            update_streak_user(user["id"])
-        else:
-            # Legacy device streak
-            from app.services.auth import update_streak_user as _upd
-            try:
-                _ensure_device(device_key)
-                today_d   = datetime.date.today().isoformat()
-                yesterday = (datetime.date.today() - datetime.timedelta(days=1)).isoformat()
-                with db_conn() as conn:
-                    row = conn.execute(
-                        "SELECT streak_days, last_scan_date FROM devices WHERE device_key=?",
-                        (device_key,)
-                    ).fetchone()
-                    if row and row["last_scan_date"] != today_d:
-                        streak = (row["streak_days"] + 1) if row["last_scan_date"] == yesterday else 1
-                        conn.execute(
-                            "UPDATE devices SET streak_days=?, last_scan_date=? WHERE device_key=?",
-                            (streak, today_d, device_key)
-                        )
-            except Exception:
-                pass
-
-        return JSONResponse(result)
-
-    except ValueError as exc:
-        return JSONResponse({"error": str(exc)}, status_code=400)
-    except Exception as exc:
-        logger.error("Analysis error: %s", exc, exc_info=True)
-        return JSONResponse({"error": f"Scan failed: {str(exc)[:140]}. Please try again."})
-
-
-@app.get("/scan-status")
-async def scan_status(request: Request):
-    user       = _get_request_user(request)
-    device_key = _device_key(request)
-    _ensure_device(device_key)
-    month_key  = datetime.date.today().isoformat()[:7]
-
-    if user:
-        from app.models.db import db_conn as _db
-        with _db() as conn:
-            row = conn.execute(
-                "SELECT is_pro, scan_month, scan_count_month, streak_days FROM users WHERE id=?",
-                (user["id"],)
-            ).fetchone()
-        if not row or row["scan_month"] != month_key:
-            return {"scans_used": 0, "scans_remaining": FREE_SCAN_LIMIT,
-                    "is_pro": False, "limit": FREE_SCAN_LIMIT, "streak": 0}
-        used = row["scan_count_month"]
-        return {"scans_used": used,
-                "scans_remaining": 9999 if row["is_pro"] else max(0, FREE_SCAN_LIMIT - used),
-                "is_pro": bool(row["is_pro"]), "limit": FREE_SCAN_LIMIT,
-                "streak": row["streak_days"],
-                "authenticated": True}
-
-    with db_conn() as conn:
-        row = conn.execute(
-            "SELECT is_pro, month, scan_count, streak_days FROM devices WHERE device_key=?",
-            (device_key,)
-        ).fetchone()
-    if not row or row["month"] != month_key:
-        return {"scans_used": 0, "scans_remaining": FREE_SCAN_LIMIT,
-                "is_pro": False, "limit": FREE_SCAN_LIMIT, "streak": 0, "authenticated": False}
-    used = row["scan_count"]
-    return {"scans_used": used,
-            "scans_remaining": 9999 if row["is_pro"] else max(0, FREE_SCAN_LIMIT - used),
-            "is_pro": bool(row["is_pro"]), "limit": FREE_SCAN_LIMIT,
-            "streak": row["streak_days"], "authenticated": False}
-
-
-@app.post("/activate-pro")
-async def activate_pro_legacy(request: Request, payment_id: str = Form(...)):
-    """
-    LEGACY endpoint kept for backward compat.
-    Real payment flow: POST /payments/create-order → Razorpay modal → POST /payments/verify
-    """
-    if payment_id.startswith("demo_"):
-        logger.warning("DEMO payment ID used — no real money charged")
-    device_key = _device_key(request)
-    _ensure_device(device_key)
-    with db_conn() as conn:
-        conn.execute("UPDATE devices SET is_pro=1 WHERE device_key=?", (device_key,))
-    return {"status": "activated",
-            "message": "Pro activated. NOTE: Use /payments/create-order for real billing.",
-            "real_billing_endpoint": "/payments/create-order"}
-
-
-@app.post("/onboarding-complete")
-async def onboarding_complete(
-    request  : Request,
-    persona  : str   = Form("General Adult"),
-    language : str   = Form("en"),
-    tdee     : float = Form(0),
-    allergens: str   = Form("[]"),
-):
-    user       = _get_request_user(request)
-    device_key = _device_key(request)
-    _ensure_device(device_key)
-    user_id    = user["id"] if user else None
-    with db_conn() as conn:
-        conn.execute("UPDATE devices SET onboarding_done=1,persona=?,language=?,tdee=? WHERE device_key=?",
-                     (persona, language, tdee, device_key))
-        if user_id:
-            conn.execute("UPDATE users SET onboarding_done=1,persona=?,language=?,tdee=? WHERE id=?",
-                         (persona, language, tdee, user_id))
-        conn.execute(
-            "INSERT OR REPLACE INTO allergen_profiles(device_key,user_id,allergens) VALUES(?,?,?)",
-            (device_key, user_id, allergens)
-        )
-    return {"status": "ok"}
-
-
-@app.get("/daily-summary")
-async def daily_summary(request: Request, date: str = None):
-    user        = _get_request_user(request)
-    device_key  = _device_key(request)
-    target_date = date or datetime.date.today().isoformat()
-
-    user_id = user["id"] if user else None
-    with db_conn() as conn:
-        if user_id:
-            dev = conn.execute("SELECT tdee FROM users WHERE id=?", (user_id,)).fetchone()
-        else:
-            dev = conn.execute("SELECT tdee FROM devices WHERE device_key=?", (device_key,)).fetchone()
-
-        # Fetch from either user_id or device_key
-        clause = "user_id=?" if user_id else "device_key=?"
-        param  = user_id or device_key
-        row  = conn.execute(
-            f"""SELECT SUM(calories) cal, SUM(protein) prot, SUM(carbs) carb,
-                       SUM(fat) fat, SUM(sodium) sod, SUM(fiber) fib, SUM(sugar) sug, COUNT(*) items
-                FROM daily_logs WHERE {clause} AND log_date=?""",
-            (param, target_date)
-        ).fetchone()
-        log_items = conn.execute(
-            f"""SELECT id, meal_name, calories, protein, carbs, fat, sodium, source, logged_at
-                FROM daily_logs WHERE {clause} AND log_date=? ORDER BY logged_at DESC""",
-            (param, target_date)
-        ).fetchall()
-
-    tdee   = float((dev and dev["tdee"]) or 2000) or 2000
-    totals = {k: round(row[k] or 0, 1)
-              for k in ("cal","prot","carb","fat","sod","fib","sug")}
-    t = {"calories": round(tdee), "protein": 56,
-         "carbs": round(tdee*.5/4), "fat": round(tdee*.3/9),
-         "sodium": 2300, "fiber": 28, "sugar": 50}
-    pct = {k: min(100, round(totals.get(k, 0) / v * 100)) if v else 0
-           for k, v in (("cal","calories"),("prot","protein"),
-                        ("carb","carbs"),("fat","fat"))}
-
-    cal_left  = max(0, t["calories"] - totals["cal"])
-    prot_left = max(0, t["protein"]  - totals["prot"])
-    suggestion = ""
-    if cal_left < 200:   suggestion = "🎯 Almost at your calorie target — great tracking!"
-    elif prot_left > 20: suggestion = f"💪 {round(prot_left)}g protein left. Try: eggs, dal, paneer."
-    elif cal_left > 600: suggestion = f"🍽 {round(cal_left)} kcal remaining — a balanced meal fits well."
-
-    return {"date": target_date, "totals": totals, "targets": t, "pct": pct,
-            "suggestion": suggestion, "items": row["items"] or 0,
-            "log": [dict(r) for r in log_items]}
-
-
-@app.post("/daily-log")
-@limiter.limit("30/minute")
-async def daily_log(
-    request  : Request,
-    meal_name: str   = Form(...),
-    calories : float = Form(0),
-    protein  : float = Form(0),
-    carbs    : float = Form(0),
-    fat      : float = Form(0),
-    sodium   : float = Form(0),
-    fiber    : float = Form(0),
-    sugar    : float = Form(0),
-    source   : str   = Form("manual"),
-    log_date : str   = Form(None),
-):
-    user        = _get_request_user(request)
-    device_key  = _device_key(request)
-    target_date = log_date or datetime.date.today().isoformat()
-    user_id     = user["id"] if user else None
-    _ensure_device(device_key)
-    with db_conn() as conn:
-        conn.execute(
-            "INSERT INTO daily_logs(user_id,device_key,log_date,meal_name,calories,protein,carbs,fat,sodium,fiber,sugar,source) VALUES(?,?,?,?,?,?,?,?,?,?,?,?)",
-            (user_id, device_key, target_date, meal_name, calories, protein, carbs, fat, sodium, fiber, sugar, source)
-        )
-    return {"status": "logged", "date": target_date, "meal": meal_name}
-
-
-@app.delete("/daily-log/{log_id}")
-async def delete_log(request: Request, log_id: int):
-    device_key = _device_key(request)
-    with db_conn() as conn:
-        conn.execute("DELETE FROM daily_logs WHERE id=? AND device_key=?", (log_id, device_key))
-    return {"status": "deleted", "id": log_id}
-
-
-@app.get("/allergen-profile")
-async def get_allergen_profile(request: Request):
-    device_key = _device_key(request)
-    with db_conn() as conn:
-        row = conn.execute(
-            "SELECT allergens, conditions FROM allergen_profiles WHERE device_key=?", (device_key,)
-        ).fetchone()
-    if not row:
-        return {"allergens": [], "conditions": []}
-    return {"allergens": json.loads(row["allergens"] or "[]"),
-            "conditions": json.loads(row["conditions"] or "[]")}
-
-
-@app.post("/allergen-profile")
-async def set_allergen_profile(request: Request, allergens: str = Form("[]"),
-                               conditions: str = Form("[]")):
-    device_key = _device_key(request)
-    _ensure_device(device_key)
-    with db_conn() as conn:
-        conn.execute(
-            "INSERT OR REPLACE INTO allergen_profiles(device_key,allergens,conditions,updated_at) VALUES(?,?,?,datetime('now'))",
-            (device_key, allergens, conditions)
-        )
-    return {"status": "saved"}
-
-
-@app.post("/nps")
-async def submit_nps(request: Request, score: int = Form(...), comment: str = Form("")):
-    if not 0 <= score <= 10:
-        return JSONResponse({"error": "Score must be 0-10"}, status_code=400)
-    user       = _get_request_user(request)
-    device_key = _device_key(request)
-    with db_conn() as conn:
-        conn.execute(
-            "INSERT INTO nps_responses(device_key,user_id,score,comment) VALUES(?,?,?,?)",
-            (device_key, user["id"] if user else None, score, comment[:500])
-        )
-    return {"status": "thank_you"}
-
-
-@app.get("/admin/analytics")
-async def admin_analytics(admin_token: str = ""):
-    if admin_token != os.environ.get("ADMIN_TOKEN", "changeme"):
-        raise HTTPException(status_code=403, detail="Invalid token")
-    today = datetime.date.today().isoformat()
-    mkey  = today[:7]
-    with db_conn() as conn:
-        dau  = conn.execute("SELECT COUNT(DISTINCT COALESCE(user_id,device_key)) FROM scans WHERE DATE(scanned_at)=?", (today,)).fetchone()[0]
-        mau  = conn.execute("SELECT COUNT(DISTINCT COALESCE(user_id,device_key)) FROM scans WHERE strftime('%Y-%m',scanned_at)=?", (mkey,)).fetchone()[0]
-        tot  = conn.execute("SELECT COUNT(*) FROM scans").fetchone()[0]
-        avg_s= conn.execute("SELECT AVG(score) FROM scans").fetchone()[0]
-        avg_n= conn.execute("SELECT AVG(score) FROM nps_responses").fetchone()[0]
-        npc  = conn.execute("SELECT COUNT(*) FROM nps_responses").fetchone()[0]
-        users= conn.execute("SELECT COUNT(*) FROM users").fetchone()[0]
-        top  = conn.execute("SELECT product_name,COUNT(*) c FROM scans GROUP BY product_name ORDER BY c DESC LIMIT 10").fetchall()
-        food_ct = conn.execute("SELECT COUNT(*) FROM food_products").fetchone()[0]
-        verified= conn.execute("SELECT COUNT(*) FROM food_products WHERE verified=1").fetchone()[0]
-    return {"dau": dau, "mau": mau, "total_scans": tot, "total_users": users,
-            "avg_score": round(avg_s or 0, 2), "avg_nps": round(avg_n or 0, 2),
-            "nps_count": npc, "dau_mau": round(dau/mau*100,1) if mau else 0,
-            "food_db": {"total": food_ct, "verified": verified},
-            "top_products": [{"name": r[0], "scans": r[1]} for r in top]}
-
-
-@app.post("/admin/create-api-key")
-async def create_api_key_endpoint(admin_token: str = Form(...),
-                                   client_name: str = Form(...),
-                                   plan: str = Form("business")):
-    if admin_token != os.environ.get("ADMIN_TOKEN", "changeme"):
-        raise HTTPException(status_code=403, detail="Invalid admin token")
-    key = "eak_" + secrets.token_urlsafe(32)
-    with db_conn() as conn:
-        conn.execute("INSERT INTO api_keys(api_key,client_name,plan) VALUES(?,?,?)",
-                     (key, client_name, plan))
-    return {"api_key": key, "client": client_name, "plan": plan}
-
-
-@app.post("/generate-share-card")
-@limiter.limit("20/minute")
-async def generate_share_card(
-    request: Request, product_name: str = Form(...),
-    score: int = Form(...), verdict: str = Form(...),
-    top_warning: str = Form(""), top_pro: str = Form(""),
-):
-    from PIL import Image, ImageDraw, ImageFont
-    W, H  = 1080, 1080
-    img   = Image.new("RGB", (W, H), (15, 17, 23))
-    draw  = ImageDraw.Draw(img)
-    font  = ImageFont.load_default()
-    s_rgb = (34,197,94) if score>=7 else (245,158,11) if score>=4 else (239,68,68)
-    def centered(text, y, fill):
-        try:   tw = font.getbbox(text)[2] - font.getbbox(text)[0]
-        except: tw = len(text) * 6
-        draw.text(((W-tw)//2, y), text, fill=fill, font=font)
-    draw.ellipse([340,160,740,560], outline=s_rgb, width=18)
-    centered(str(score), 340, s_rgb); centered("/10", 430, (100,116,139))
-    pname = product_name[:38] + ("…" if len(product_name)>38 else "")
-    centered(pname, 600, (255,255,255)); centered(verdict[:50], 650, (148,163,184))
-    if top_pro:
-        draw.rectangle([60,700,1020,760], fill=(15,60,40))
-        centered(f"✓ {top_pro[:65]}", 718, (74,222,128))
-    if top_warning:
-        draw.rectangle([60,775,1020,840], fill=(124,29,29))
-        centered(f"⚠ {top_warning[:65]}", 795, (252,165,165))
-    centered("eatlytic.com  •  scan any food label, no barcode needed", 1000, (71,85,105))
-    draw.text((40, 1050), MEDICAL_DISCLAIMER[:90], fill=(50,50,60), font=font)
-    buf = BytesIO(); img.save(buf, format="PNG", optimize=True); buf.seek(0)
-    return Response(content=buf.getvalue(), media_type="image/png",
-                    headers={"Content-Disposition": "attachment; filename=eatlytic-scan.png"})
-
-
-@app.post("/export-pdf")
-@limiter.limit("10/minute")
-async def export_pdf(request: Request, analysis_json: str = Form(...)):
-    try:
-        data = json.loads(analysis_json)
-    except Exception:
-        return JSONResponse({"error": "Invalid JSON"}, status_code=400)
-    try:
-        from reportlab.lib.pagesizes import A4
-        from reportlab.lib.styles import getSampleStyleSheet, ParagraphStyle
-        from reportlab.platypus import SimpleDocTemplate, Paragraph, Spacer, Table, TableStyle
-        from reportlab.lib import colors as rl; from reportlab.lib.units import cm
-    except ImportError:
-        return JSONResponse({"error": "reportlab not installed"}, status_code=501)
-    buf  = BytesIO()
-    doc  = SimpleDocTemplate(buf, pagesize=A4, rightMargin=2*cm, leftMargin=2*cm,
-                              topMargin=2*cm, bottomMargin=2*cm)
-    stys = getSampleStyleSheet(); story = []
-    story.append(Paragraph("Eatlytic Food Label Analysis", stys["Title"]))
-    story.append(Paragraph(f"Product: {data.get('product_name','Unknown')}", stys["Heading2"]))
-    story.append(Paragraph(MEDICAL_DISCLAIMER,
-                            ParagraphStyle("d", parent=stys["Normal"], fontSize=8, textColor=rl.grey)))
-    story.append(Spacer(1,.4*cm))
-    score = data.get("score",0); sc = "22c55e" if score>=7 else "f59e0b" if score>=4 else "ef4444"
-    story.append(Paragraph(f"<font color='#{sc}'>Health Score: {score}/10 — {data.get('verdict','')}</font>", stys["Heading1"]))
-    if data.get("summary"):
-        story.append(Paragraph("Summary", stys["Heading2"]))
-        story.append(Paragraph(data["summary"], stys["Normal"]))
-    nutrients = data.get("nutrient_breakdown",[])
-    if nutrients:
-        story.append(Paragraph("Nutrient Breakdown", stys["Heading2"]))
-        td = [["Nutrient","Amount","Rating"]] + [
-            [str(n.get("name","")), f"{n.get('value','')} {n.get('unit','')}".strip(),
-             str(n.get("rating","")).upper()] for n in nutrients]
-        tbl = Table(td, colWidths=[6*cm,4*cm,4*cm])
-        tbl.setStyle(TableStyle([
-            ("BACKGROUND",(0,0),(-1,0),rl.HexColor("1D9E75")),("TEXTCOLOR",(0,0),(-1,0),rl.white),
-            ("FONTSIZE",(0,0),(-1,-1),10),("BACKGROUND",(0,1),(-1,-1),rl.HexColor("f8faf8")),
-            ("GRID",(0,0),(-1,-1),.4,rl.HexColor("d0d8d4")),
-            ("TOPPADDING",(0,0),(-1,-1),6),("BOTTOMPADDING",(0,0),(-1,-1),6),
-            ("LEFTPADDING",(0,0),(-1,-1),8),("RIGHTPADDING",(0,0),(-1,-1),8),
-        ])); story.append(tbl)
-    if data.get("pros"):
-        story.append(Paragraph("Benefits", stys["Heading2"]))
-        [story.append(Paragraph(f"✓ {p}", stys["Normal"])) for p in data["pros"]]
-    if data.get("cons"):
-        story.append(Paragraph("Concerns", stys["Heading2"]))
-        [story.append(Paragraph(f"✗ {c}", stys["Normal"])) for c in data["cons"]]
-    try:
-        doc.build(story)
-    except Exception as exc:
-        return JSONResponse({"error": f"PDF failed: {exc}"}, status_code=500)
-    buf.seek(0); safe = data.get("product_name","scan").replace(" ","-")[:40]
-    return Response(content=buf.getvalue(), media_type="application/pdf",
-                    headers={"Content-Disposition": f"attachment; filename=eatlytic-{safe}.pdf"})