Restrict and implement session data deletion

app.py

@@ -444,6 +444,89 @@ def session_row(session_id, user_id):
     return row
 
 
+def result_action_id(session_id, index):
+    digest = hashlib.sha256(f"{session_id}:{index}".encode()).hexdigest()
+    return f"{digest[:8]}-{digest[8:12]}-5{digest[13:16]}-8{digest[17:20]}-{digest[20:32]}"
+
+
+def owned_session_row(session_id, user_id):
+    row = backend(f"/{session_id}", user_id)
+    if row.get("user_id") != user_id:
+        raise HTTPException(404, "Session not found")
+    return row
+
+
+def upload_session_results(path_in_repo, payload, commit_message):
+    from io import BytesIO
+
+    hub().upload_file(
+        path_or_fileobj=BytesIO(payload),
+        path_in_repo=path_in_repo,
+        repo_id=os.environ["STORAGE_REPO_ID"],
+        repo_type="dataset",
+        commit_message=commit_message,
+    )
+
+
+@app.delete("/api/sessions/{session_id}/actions/{action_id}")
+def delete_action(session_id: UUID, action_id: UUID, request: Request):
+    row = owned_session_row(session_id, request.state.user_id)
+    if row.get("path") != f"sessions/{session_id}":
+        raise HTTPException(409, "Session results are not available")
+
+    result_path = f'{row["path"]}/results.json'
+    downloaded_path = hf_hub_download(
+        repo_id=os.environ["STORAGE_REPO_ID"], repo_type="dataset",
+        filename=result_path, token=os.environ["HF_TOKEN"],
+    )
+    original_payload = Path(downloaded_path).read_bytes()
+    reports = json.loads(original_payload.decode("utf-8"))
+    matching_index = next((
+        index for index, report in enumerate(reports)
+        if not report.get("error") and not report.get("_deleted")
+        and result_action_id(session_id, index) == str(action_id)
+    ), None)
+    if matching_index is None:
+        raise HTTPException(404, "Action not found")
+
+    # Keep a tombstone so action IDs based on pipeline report indexes remain
+    # stable for every action that follows the deleted one.
+    reports[matching_index]["_deleted"] = True
+    updated_reports = reports
+    updated_payload = json.dumps(json_value(updated_reports), allow_nan=False).encode("utf-8")
+    upload_session_results(result_path, updated_payload, f"Delete action {action_id}")
+    try:
+        backend(f"/{session_id}/actions/{action_id}", request.state.user_id, "DELETE")
+    except Exception:
+        try:
+            upload_session_results(result_path, original_payload, f"Restore action {action_id} after delete failure")
+        except Exception:
+            logger.exception("Could not restore session results after action deletion failed: session=%s action=%s", session_id, action_id)
+        raise
+    return {"ok": True}
+
+
+@app.delete("/api/sessions/{session_id}")
+def delete_session(session_id: UUID, request: Request):
+    row = owned_session_row(session_id, request.state.user_id)
+    expected_path = f"sessions/{session_id}"
+    storage_path = row.get("path")
+    if storage_path is not None and storage_path != expected_path:
+        raise HTTPException(409, "Session uses a different storage layout")
+
+    if storage_path == expected_path:
+        prefix = f"{storage_path}/"
+        existing_files = hub().list_repo_files(repo_id=os.environ["STORAGE_REPO_ID"], repo_type="dataset")
+        if any(file_path.startswith(prefix) for file_path in existing_files):
+            hub().delete_folder(
+                repo_id=os.environ["STORAGE_REPO_ID"], repo_type="dataset",
+                path_in_repo=storage_path, commit_message=f"Delete session {session_id}",
+            )
+
+    backend(f"/{session_id}", request.state.user_id, "DELETE")
+    return {"ok": True}
+
+
 @app.get("/api/sessions/{session_id}")
 def results(session_id: UUID, request: Request):
     row = session_row(session_id, request.state.user_id)
@@ -465,6 +548,8 @@ def results(session_id: UUID, request: Request):
     fps_values = [float(report.get("fps") or 30) for report in reports if report.get("fps")]
     actions, failed = [], []
     for index, report in enumerate(reports):
+        if report.get("_deleted"):
+            continue
         start = int(report.get("start_frame") or 0)
         end = int(report.get("end_frame") or start)
         action_fps = float(report.get("fps") or (fps_values[0] if fps_values else 30))
@@ -509,8 +594,7 @@ def results(session_id: UUID, request: Request):
             "url": f"/storage/{session_id}/videos/{filename}",
             "poster": f"/storage/{session_id}/posters/camera_{camera_id}.webp"}
             for camera_id, filename in camera_files]
-        digest = hashlib.sha256(f"{session_id}:{index}".encode()).hexdigest()
-        action_id = f"{digest[:8]}-{digest[8:12]}-5{digest[13:16]}-8{digest[17:20]}-{digest[20:32]}"
+        action_id = result_action_id(session_id, index)
         actions.append({"id": action_id, "label": label,
             "start": str(start), "end": str(end), "fps": action_fps,
             "startFrame": start, "endFrame": end, "startSeconds": start / action_fps,
@@ -537,6 +621,7 @@ def results(session_id: UUID, request: Request):
         created_at = created_at.replace(tzinfo=timezone.utc)
     return {"id": str(session_id), "playerId": row["player_id"], "playerName": "",
         "name": row.get("name", "Analysis session"),
+        "isOwner": row.get("user_id") == request.state.user_id,
         "createdAt": int(created_at.timestamp() * 1000),
         "targetSize": [0, 0], "cameraCount": len(camera_files), "actions": actions, "failedActions": failed}
 

src/analysis.ts

@@ -87,12 +87,49 @@ export function analysisRouter(db: SupabaseClient, secret: string) {
   router.get("/:sessionId", async (req, res, next) => {
     try {
       const sessionId = z.uuid().parse(req.params.sessionId);
-      const { data, error } = await db.from("sessions").select("session_id,player_id,path,status,name,created_at")
+      const { data, error } = await db.from("sessions").select("session_id,player_id,user_id,path,status,name,created_at")
         .eq("session_id", sessionId).maybeSingle();
       if (error) return res.status(503).json({ error: "Unable to load session" });
       return data ? res.json(data) : res.sendStatus(404);
     } catch (error) { next(error); }
   });
+  router.delete("/:sessionId/actions/:actionId", async (req, res, next) => {
+    try {
+      const sessionId = z.uuid().parse(req.params.sessionId);
+      const actionId = z.uuid().parse(req.params.actionId);
+      const userId = res.locals.userId as string;
+      const { data: session, error: sessionError } = await db.from("sessions")
+        .select("session_id").eq("session_id", sessionId).eq("user_id", userId).maybeSingle();
+      if (sessionError) return res.status(503).json({ error: "Unable to verify session ownership." });
+      if (!session) return res.status(404).json({ error: "Session not found." });
+
+      const { data: action, error } = await db.from("actions").delete()
+        .eq("action_id", actionId).eq("session_id", sessionId).select("action_id").maybeSingle();
+      if (error) return res.status(503).json({ error: "Unable to delete action." });
+      if (!action) return res.status(404).json({ error: "Action not found." });
+      return res.sendStatus(204);
+    } catch (error) { next(error); }
+  });
+  router.delete("/:sessionId", async (req, res, next) => {
+    try {
+      const sessionId = z.uuid().parse(req.params.sessionId);
+      const userId = res.locals.userId as string;
+      const { data: session, error: sessionError } = await db.from("sessions")
+        .select("session_id").eq("session_id", sessionId).eq("user_id", userId).maybeSingle();
+      if (sessionError) return res.status(503).json({ error: "Unable to verify session ownership." });
+      if (!session) return res.status(404).json({ error: "Session not found." });
+
+      // The schema keeps actions when a session row is removed, so explicitly
+      // delete them first. Their annotations and feedback cascade from actions.
+      const { error: actionsError } = await db.from("actions").delete().eq("session_id", sessionId);
+      if (actionsError) return res.status(503).json({ error: "Unable to remove session actions." });
+      const { data: deleted, error } = await db.from("sessions").delete()
+        .eq("session_id", sessionId).eq("user_id", userId).select("session_id").maybeSingle();
+      if (error) return res.status(503).json({ error: "Unable to delete session." });
+      if (!deleted) return res.status(404).json({ error: "Session not found." });
+      return res.sendStatus(204);
+    } catch (error) { next(error); }
+  });
   router.put("/:sessionId", async (req, res, next) => {
     try {
       const sessionId = z.uuid().parse(req.params.sessionId);