Complete Phase 7: session users, RBAC, training export, and UAT hardening.

Per-browser session isolation, role-based upload, false-positive training export, admin diagnostics, enhanced health, and UAT checklist.

Co-authored-by: Cursor <cursoragent@cursor.com>

.env.example

@@ -32,3 +32,8 @@
 # Department export API (optional — FR-08)
 # DEPT_API_URL=https://dept.example.gov/api/changes
 # DEPT_API_KEY=your-api-key
+
+# DDA admin account (optional — UAT / ops)
+# DDA_ADMIN_EMAIL=admin@example.com
+# DDA_ADMIN_PASSWORD=change-me
+# DDA_TRAINING_EXPORT_KEY=secret-key-for-fp-export

DEPLOYMENT.md

@@ -140,11 +140,33 @@ Set these in each Space’s **Settings → Repository secrets / Variables** if n
 | `DATABASE_URL` | PostgreSQL instead of SQLite (optional) |
 | `SMTP_USER` / `SMTP_PASS` | Email notifications via Gmail SMTP |
 | `EMAIL_API_URL` | Custom email API (default in code) |
+| `DEPT_API_URL` / `DEPT_API_KEY` | Departmental submit API (optional) |
+| `DDA_ADMIN_EMAIL` / `DDA_ADMIN_PASSWORD` | Seed admin user on dev (role: admin) |
+| `DDA_TRAINING_EXPORT_KEY` | Header `X-DDA-Training-Key` for false-positive export |
 
 Dev Space can omit `SECRET_KEY` (login is disabled on both Spaces).
 
 ---
 
+## UAT checklist (satdetect-dev)
+
+Run before promoting any DDA feature to production:
+
+1. **Health** — `GET /health` returns `status: ok`, `appMode: dda`, `dda.libraryImages` ≥ 0
+2. **Library** — Upload GeoTIFF to year folder; Refresh shows image; thumb loads
+3. **Compare** — Select T1/T2; Run Detection completes (async job or sync fallback)
+4. **Viewer** — Slider / T1 / T2 / Overlay modes; click region to locate
+5. **Review** — Confirm and False Positive; Export confirmed CSV; Submit confirmed
+6. **Reports** — PDF download; `/dda/reports/{id}` page; email link (if SMTP configured)
+7. **Session isolation** — Two browsers see separate history (per-session cookie)
+8. **Admin** — `GET /api/dda/admin/status` (analyst+); stale job reconcile after restart
+9. **Training export** — Mark false positives → `GET /api/dda/training/export` (admin or export key)
+10. **Security** — Path traversal blocked (`../` in library path); upload size limit enforced
+
+Sign-off: DDA stakeholder approves sample runs on dev Space before any push to `satdetect` production.
+
+---
+
 ## Quick reference
 
 ```powershell

DEV_SETUP.md

@@ -158,6 +158,8 @@ Expected: `"appMode": "dda"`, `"status": "ok"`.
 3. **Reports** — history, PDF download, browser report at `/dda/reports/{id}`.
 4. **Bell icon** — in-app notifications for completed jobs.
 5. **Review (FR-08)** — Confirm / False Positive per region, export confirmed CSV, submit to dept API (`DEPT_API_URL`).
+6. **Session users** — Each browser gets isolated history via `dda_session_id` cookie (no login required).
+7. **Admin** — Optional `DDA_ADMIN_EMAIL` / `DDA_ADMIN_PASSWORD` for admin role; `GET /api/dda/admin/status`.
 
 ---
 

Dockerfile

@@ -21,7 +21,7 @@ WORKDIR /app
 
 # Build-time info + cache-bust:
 # Changing APP_BUILD forces Docker to re-run subsequent layers (including pip install).
-ARG APP_BUILD=36
+ARG APP_BUILD=37
 ENV MAX_GEOTIFF_MB=5120
 ENV APP_BUILD=${APP_BUILD}
 ENV GDAL_CONFIG=/usr/bin/gdal-config

app/dda/admin_routes.py

@@ -0,0 +1,97 @@
+"""DDA admin diagnostics and maintenance (Phase 7)."""
+from __future__ import annotations
+
+import logging
+import shutil
+from datetime import datetime, timedelta, timezone
+
+from fastapi import APIRouter, Depends, HTTPException, Query, Request
+from sqlalchemy.orm import Session
+
+from ..database import DATA_DIR, get_db
+from ..models import DetectionRun, User
+from .dda_auth import current_dda_user, get_user_role, require_min_role
+from .job_runner import is_job_runner_busy, reconcile_stale_jobs
+from .local_library import scan_images
+from .models import DetectionJob, RegionReview
+
+logger = logging.getLogger(__name__)
+router = APIRouter()
+
+
+def _require_dda():
+    from .config import IS_DDA_MODE
+    if not IS_DDA_MODE:
+        raise HTTPException(status_code=404, detail="DDA mode is not enabled")
+
+
+@router.get("/admin/status")
+def admin_status(
+    request: Request,
+    db: Session = Depends(get_db),
+    user: User = Depends(current_dda_user),
+):
+    """System status for UAT / ops (analyst+)."""
+    _require_dda()
+    require_min_role(user, db, "analyst")
+
+    runs = db.query(DetectionRun).count()
+    jobs_queued = db.query(DetectionJob).filter(DetectionJob.status == "queued").count()
+    jobs_running = db.query(DetectionJob).filter(DetectionJob.status == "running").count()
+    fp_count = db.query(RegionReview).filter(RegionReview.status == "false_positive").count()
+
+    disk = shutil.disk_usage(DATA_DIR)
+    return {
+        "role": get_user_role(db, user),
+        "libraryImages": len(scan_images()),
+        "detectionRuns": runs,
+        "jobsQueued": jobs_queued,
+        "jobsRunning": jobs_running,
+        "runnerBusy": is_job_runner_busy(),
+        "falsePositiveArchive": fp_count,
+        "dataDir": str(DATA_DIR),
+        "diskFreeGb": round(disk.free / (1024 ** 3), 2),
+        "diskTotalGb": round(disk.total / (1024 ** 3), 2),
+    }
+
+
+@router.post("/admin/reconcile-jobs")
+def admin_reconcile_jobs(
+    request: Request,
+    db: Session = Depends(get_db),
+    user: User = Depends(current_dda_user),
+):
+    _require_dda()
+    require_min_role(user, db, "admin")
+    fixed = reconcile_stale_jobs(db)
+    return {"ok": True, "staleRunningFixed": fixed}
+
+
+@router.delete("/admin/purge-runs")
+def admin_purge_old_runs(
+    request: Request,
+    days: int = Query(90, ge=7, le=3650),
+    db: Session = Depends(get_db),
+    user: User = Depends(current_dda_user),
+):
+    """Delete detection runs older than N days (admin only)."""
+    _require_dda()
+    require_min_role(user, db, "admin")
+    cutoff = datetime.now(timezone.utc) - timedelta(days=days)
+    old = db.query(DetectionRun).filter(DetectionRun.created_at < cutoff).all()
+    count = 0
+    overlays_root = DATA_DIR
+    for run in old:
+        db.query(RegionReview).filter(RegionReview.run_id == run.id).delete()
+        for job in db.query(DetectionJob).filter(DetectionJob.run_id == run.id).all():
+            job.run_id = None
+        for path_attr in ("overlay_path", "before_full_path", "before_thumb_path", "after_thumb_path", "after_full_path"):
+            path_val = getattr(run, path_attr, None)
+            if path_val:
+                f = overlays_root / path_val
+                if f.exists():
+                    f.unlink(missing_ok=True)
+        db.delete(run)
+        count += 1
+    db.commit()
+    return {"ok": True, "purgedRuns": count, "olderThanDays": days}

app/dda/bootstrap.py

@@ -5,12 +5,15 @@ from sqlalchemy import text as sa_text
 
 from ..database import engine
 from .config import IS_DDA_MODE, ensure_library_dirs, ensure_local_year_folders, is_hf_hosted
+from .admin_routes import router as admin_router
 from .jobs_routes import router as jobs_router
 from .library_routes import router as library_router
 from .local_routes import router as local_router
 from .reports_routes import router as reports_router
 from .review_routes import router as review_router
+from .training_routes import router as training_router
 from .seed import seed_delhi_hierarchy
+from .dda_auth import seed_dda_admin
 
 logger = logging.getLogger(__name__)
 
@@ -47,6 +50,7 @@ def init_dda_database():
     db = SessionLocal()
     try:
         seed_delhi_hierarchy(db)
+        seed_dda_admin(db)
         from .job_runner import reconcile_stale_jobs
         reconcile_stale_jobs(db)
     finally:
@@ -73,5 +77,7 @@ def setup_dda(app: FastAPI) -> None:
     app.include_router(jobs_router, prefix="/api/dda", tags=["dda-jobs"])
     app.include_router(reports_router, prefix="/api/dda", tags=["dda-reports"])
     app.include_router(review_router, prefix="/api/dda", tags=["dda-review"])
+    app.include_router(training_router, prefix="/api/dda", tags=["dda-training"])
+    app.include_router(admin_router, prefix="/api/dda", tags=["dda-admin"])
     app.include_router(local_router, prefix="/api/dda", tags=["dda-local"])
-    logger.info("APP_MODE=dda — DDA routes enabled (library, jobs, reports, review, local folder)")
+    logger.info("APP_MODE=dda — DDA routes enabled (library, jobs, reports, review, training, admin, local)")

app/dda/dda_auth.py

@@ -0,0 +1,140 @@
+"""DDA session users and RBAC (Phase 7)."""
+from __future__ import annotations
+
+import os
+from typing import Iterable, Optional
+
+from fastapi import Depends, HTTPException, Request
+from sqlalchemy.orm import Session
+
+from ..auth import get_or_create_guest_user, get_user_by_id, get_user_from_token
+from ..database import get_db
+from ..models import User
+
+DDA_SESSION_COOKIE = "dda_session_id"
+COOKIE_NAME = "satellite_token"
+
+ROLE_RANK = {
+    "viewer": 0,
+    "uploader": 1,
+    "analyst": 2,
+    "admin": 3,
+}
+
+TRAINING_EXPORT_KEY = os.environ.get("DDA_TRAINING_EXPORT_KEY", "").strip()
+
+
+def _session_email(session_id: str) -> str:
+    safe = "".join(c for c in session_id if c.isalnum() or c in "-_")[:64]
+    return f"session-{safe}@dda.local"
+
+
+def get_user_role(db: Session, user: User) -> str:
+    role = getattr(user, "role", None)
+    if role:
+        return str(role)
+    try:
+        from sqlalchemy import text as sa_text
+        row = db.execute(
+            sa_text("SELECT role FROM users WHERE id = :uid"),
+            {"uid": user.id},
+        ).fetchone()
+        if row and row[0]:
+            return str(row[0])
+    except Exception:
+        pass
+    return "analyst"
+
+
+def get_dda_user(request: Request, db: Session) -> User:
+    """Resolve user: JWT login > per-browser session > shared guest."""
+    auth_header = request.headers.get("authorization", "")
+    if auth_header.lower().startswith("bearer "):
+        token = auth_header.split(" ", 1)[1].strip()
+        user = get_user_from_token(token, db)
+        if user:
+            return user
+
+    token = request.cookies.get(COOKIE_NAME)
+    if token:
+        user = get_user_from_token(token, db)
+        if user and not user.email.startswith("__guest__"):
+            return user
+
+    session_id = request.cookies.get(DDA_SESSION_COOKIE)
+    if session_id:
+        email = _session_email(session_id)
+        from ..auth import get_user_by_email, get_password_hash
+        user = get_user_by_email(db, email)
+        if user:
+            return user
+        user = User(
+            email=email,
+            hashed_password=get_password_hash("session-not-used"),
+            full_name=f"Session {session_id[:8]}",
+        )
+        db.add(user)
+        db.commit()
+        db.refresh(user)
+        try:
+            from sqlalchemy import text as sa_text
+            db.execute(
+                sa_text("UPDATE users SET role = 'analyst' WHERE id = :uid"),
+                {"uid": user.id},
+            )
+            db.commit()
+        except Exception:
+            db.rollback()
+        return user
+
+    return get_or_create_guest_user(db)
+
+
+def current_dda_user(request: Request, db: Session = Depends(get_db)) -> User:
+    return get_dda_user(request, db)
+
+
+def require_min_role(user: User, db: Session, minimum: str) -> None:
+    role = get_user_role(db, user)
+    need = ROLE_RANK.get(minimum, 99)
+    have = ROLE_RANK.get(role, 0)
+    if have < need:
+        raise HTTPException(
+            status_code=403,
+            detail=f"Role '{role}' cannot perform this action (requires {minimum} or higher).",
+        )
+
+
+def require_admin_or_key(request: Request, user: User, db: Session) -> None:
+    key = request.headers.get("x-dda-training-key", "").strip()
+    if TRAINING_EXPORT_KEY and key == TRAINING_EXPORT_KEY:
+        return
+    require_min_role(user, db, "admin")
+
+
+def seed_dda_admin(db: Session) -> None:
+    """Optional admin account from env (dev/UAT)."""
+    email = os.environ.get("DDA_ADMIN_EMAIL", "").strip()
+    password = os.environ.get("DDA_ADMIN_PASSWORD", "").strip()
+    if not email or not password:
+        return
+    from ..auth import get_password_hash, get_user_by_email
+    user = get_user_by_email(db, email)
+    if not user:
+        user = User(
+            email=email,
+            hashed_password=get_password_hash(password),
+            full_name=os.environ.get("DDA_ADMIN_NAME", "DDA Admin"),
+        )
+        db.add(user)
+        db.commit()
+        db.refresh(user)
+    try:
+        from sqlalchemy import text as sa_text
+        db.execute(
+            sa_text("UPDATE users SET role = 'admin' WHERE id = :uid"),
+            {"uid": user.id},
+        )
+        db.commit()
+    except Exception:
+        db.rollback()

app/dda/detect_service.py

@@ -79,10 +79,17 @@ def run_detection_and_save(
     notify_email: Optional[str] = None,
     max_size: Optional[int] = None,
     geo_bounds_path: Optional[Path] = None,
+    user_id: Optional[int] = None,
 ) -> dict:
     from ..detection_engine import run_detection
 
-    user = get_or_create_guest_user(db)
+    if user_id:
+        from ..auth import get_user_by_id
+        user = get_user_by_id(db, user_id)
+        if not user:
+            user = get_or_create_guest_user(db)
+    else:
+        user = get_or_create_guest_user(db)
     detection_sensitivity = max(0.0, min(1.0, float(detection_sensitivity)))
     if min_region_area is not None:
         min_region_area = int(max(50, min(10000, min_region_area)))

app/dda/job_runner.py

@@ -84,6 +84,7 @@ def _run_job_sync(job_id: int) -> None:
             notify_email=job.notify_email or params.get("notify_email"),
             max_size=get_detection_max_side(),
             geo_bounds_path=base_file,
+            user_id=job.created_by,
         )
 
         job.status = "completed"

app/dda/jobs_routes.py

@@ -5,12 +5,12 @@ import json
 import logging
 from typing import Optional
 
-from fastapi import APIRouter, Depends, Form, HTTPException, Query
+from fastapi import APIRouter, Depends, Form, HTTPException, Query, Request
 from sqlalchemy.orm import Session
 
-from ..auth import get_or_create_guest_user
 from ..database import get_db
-from ..models import DetectionRun
+from ..models import DetectionRun, User
+from .dda_auth import current_dda_user
 from .job_runner import (
     create_local_folder_job,
     enqueue_detection_job,
@@ -44,6 +44,7 @@ async def create_job(
     min_region_area: Optional[int] = Form(150),
     notify_email: Optional[str] = Form(None),
     db: Session = Depends(get_db),
+    user: User = Depends(current_dda_user),
 ):
     """Queue async detection from local library paths. Returns immediately with jobId."""
     _require_dda()
@@ -68,7 +69,6 @@ async def create_job(
             detail="Another detection job is already running. Wait for it to finish, then try again.",
         )
 
-    user = get_or_create_guest_user(db)
     if not title.strip():
         from pathlib import Path
         title = f"{Path(base_norm).name} vs {Path(comp_norm).name}"
@@ -99,9 +99,8 @@ async def create_job(
 
 
 @router.get("/jobs/{job_id}")
-def get_job(job_id: int, db: Session = Depends(get_db)):
+def get_job(job_id: int, db: Session = Depends(get_db), user: User = Depends(current_dda_user)):
     _require_dda()
-    user = get_or_create_guest_user(db)
     job = db.query(DetectionJob).filter(DetectionJob.id == job_id).first()
     if not job:
         raise HTTPException(status_code=404, detail="Job not found")
@@ -173,12 +172,12 @@ def list_jobs(
     status: Optional[str] = Query(None),
     limit: int = Query(20, ge=1, le=100),
     db: Session = Depends(get_db),
+    user: User = Depends(current_dda_user),
 ):
     """Recent detection jobs for in-app notifications / reports feed (FR-05 partial)."""
     _require_dda()
     from .job_runner import reconcile_stale_jobs
     reconcile_stale_jobs(db)
-    user = get_or_create_guest_user(db)
     q = db.query(DetectionJob).filter(DetectionJob.created_by == user.id)
     if status:
         q = q.filter(DetectionJob.status == status)

app/dda/local_routes.py

@@ -3,12 +3,14 @@ import logging
 from pathlib import Path
 from typing import Optional
 
-from fastapi import APIRouter, Depends, File, Form, HTTPException, Query, UploadFile
+from fastapi import APIRouter, Depends, File, Form, HTTPException, Query, Request, UploadFile
 from fastapi.responses import FileResponse
 from PIL import Image
 from sqlalchemy.orm import Session
 
 from ..database import get_db
+from ..models import User
+from .dda_auth import current_dda_user, require_min_role
 from .detect_service import run_detection_and_save
 from .geotiff_io import load_rgb_pil
 
@@ -140,11 +142,15 @@ def local_thumb(path: str = Query(...)):
 
 @router.post("/local/upload")
 async def local_upload(
+    request: Request,
     file: UploadFile = File(...),
     year: int = Form(...),
+    db: Session = Depends(get_db),
+    user: User = Depends(current_dda_user),
 ):
     """Upload GeoTIFF into persistent library_sources/YEAR/ (required on HF)."""
     _require_dda()
+    require_min_role(user, db, "uploader")
     if year < 1990 or year > 2100:
         raise HTTPException(status_code=400, detail="year must be between 1990 and 2100")
 
@@ -199,6 +205,7 @@ def local_rescan():
 
 @router.post("/detect/from-library")
 async def detect_from_library(
+    request: Request,
     base_path: str = Form(...),
     comparison_path: str = Form(...),
     method: str = Form("AI-Based Deep Learning"),
@@ -211,6 +218,7 @@ async def detect_from_library(
     min_region_area: Optional[int] = Form(150),
     notify_email: Optional[str] = Form(None),
     db: Session = Depends(get_db),
+    user: User = Depends(current_dda_user),
 ):
     """Run change detection on two library images by relative path (e.g. 2025/aerial.tif)."""
     _require_dda()
@@ -262,6 +270,7 @@ async def detect_from_library(
             notify_email=notify_email,
             max_size=max_side,
             geo_bounds_path=base_file,
+            user_id=user.id,
         )
     except Exception as exc:
         logger.exception("Library detection failed for %s vs %s", base_norm, comp_norm)

app/dda/reports_routes.py

@@ -9,10 +9,10 @@ from fastapi.responses import Response
 from pydantic import BaseModel, EmailStr
 from sqlalchemy.orm import Session
 
-from ..auth import get_or_create_guest_user
 from ..database import get_db
-from ..models import DetectionRun
+from ..models import DetectionRun, User
 from ..notifier import send_notification
+from .dda_auth import current_dda_user
 from .config import get_public_base_url
 from .report_pdf import build_report_dict, generate_report_pdf
 from .review_service import load_regions, merge_reviews
@@ -38,10 +38,9 @@ def _get_user_run(db: Session, run_id: int, user_id: int) -> DetectionRun:
 
 
 @router.get("/reports/{run_id}")
-def get_report(run_id: int, db: Session = Depends(get_db)):
+def get_report(run_id: int, db: Session = Depends(get_db), user: User = Depends(current_dda_user)):
     """JSON payload for the standalone report page and API clients."""
     _require_dda()
-    user = get_or_create_guest_user(db)
     run = _get_user_run(db, run_id, user.id)
     regions = merge_reviews(db, run.id, load_regions(run))
     data = build_report_dict(run, include_overlay_b64=True, regions=regions)
@@ -50,10 +49,9 @@ def get_report(run_id: int, db: Session = Depends(get_db)):
 
 
 @router.get("/reports/{run_id}/pdf")
-def download_report_pdf(run_id: int, db: Session = Depends(get_db)):
+def download_report_pdf(run_id: int, db: Session = Depends(get_db), user: User = Depends(current_dda_user)):
     """Download detection report as PDF."""
     _require_dda()
-    user = get_or_create_guest_user(db)
     run = _get_user_run(db, run_id, user.id)
     regions = merge_reviews(db, run.id, load_regions(run))
     try:
@@ -75,10 +73,9 @@ class ReportNotifyBody(BaseModel):
 
 
 @router.post("/reports/{run_id}/notify")
-def notify_report(run_id: int, body: ReportNotifyBody, db: Session = Depends(get_db)):
+def notify_report(run_id: int, body: ReportNotifyBody, db: Session = Depends(get_db), user: User = Depends(current_dda_user)):
     """Email report summary with link to the browser report page."""
     _require_dda()
-    user = get_or_create_guest_user(db)
     run = _get_user_run(db, run_id, user.id)
     regions = merge_reviews(db, run.id, load_regions(run))
     report_url = f"{get_public_base_url()}/dda/reports/{run.id}"

app/dda/review_routes.py

@@ -9,9 +9,9 @@ from fastapi.responses import Response
 from pydantic import BaseModel
 from sqlalchemy.orm import Session
 
-from ..auth import get_or_create_guest_user
 from ..database import get_db
-from ..models import DetectionRun
+from ..models import DetectionRun, User
+from .dda_auth import current_dda_user
 from .dept_export import ExportResult, get_exporter, regions_to_csv_rows
 from .review_service import (
     filter_regions_by_review,
@@ -53,10 +53,10 @@ def patch_region_review(
     region_id: int,
     body: RegionReviewBody,
     db: Session = Depends(get_db),
+    user: User = Depends(current_dda_user),
 ):
     """Mark a region as confirmed or false positive."""
     _require_dda()
-    user = get_or_create_guest_user(db)
     run = _get_user_run(db, run_id, user.id)
     if body.reviewStatus not in ("confirmed", "false_positive", "pending"):
         raise HTTPException(status_code=400, detail="reviewStatus must be confirmed, false_positive, or pending")
@@ -74,9 +74,8 @@ def patch_region_review(
 
 
 @router.get("/reports/{run_id}/review-summary")
-def get_review_summary(run_id: int, db: Session = Depends(get_db)):
+def get_review_summary(run_id: int, db: Session = Depends(get_db), user: User = Depends(current_dda_user)):
     _require_dda()
-    user = get_or_create_guest_user(db)
     run = _get_user_run(db, run_id, user.id)
     regions = merge_reviews(db, run.id, load_regions(run))
     return {"runId": run.id, "summary": review_summary(regions)}
@@ -87,10 +86,10 @@ def export_csv(
     run_id: int,
     confirmed: int = Query(0, ge=0, le=1),
     db: Session = Depends(get_db),
+    user: User = Depends(current_dda_user),
 ):
     """Export regions as CSV. Use ?confirmed=1 for confirmed-only."""
     _require_dda()
-    user = get_or_create_guest_user(db)
     run = _get_user_run(db, run_id, user.id)
     regions = merge_reviews(db, run.id, load_regions(run))
     if confirmed:
@@ -108,10 +107,9 @@ def export_csv(
 
 
 @router.post("/reports/{run_id}/submit")
-def submit_confirmed(run_id: int, db: Session = Depends(get_db)):
+def submit_confirmed(run_id: int, db: Session = Depends(get_db), user: User = Depends(current_dda_user)):
     """Submit confirmed regions to departmental API (or file fallback)."""
     _require_dda()
-    user = get_or_create_guest_user(db)
     run = _get_user_run(db, run_id, user.id)
     regions = merge_reviews(db, run.id, load_regions(run))
     confirmed = filter_regions_by_review(regions, "confirmed")

app/dda/training_routes.py

@@ -0,0 +1,95 @@
+"""False-positive training archive export (FR-08 Phase 2 / Phase 7)."""
+from __future__ import annotations
+
+import csv
+import io
+import json
+import logging
+
+from fastapi import APIRouter, Depends, Query, Request
+from fastapi.responses import Response
+from sqlalchemy.orm import Session
+
+from ..database import get_db
+from ..models import DetectionRun, User
+from .dda_auth import current_dda_user, require_admin_or_key
+from .geo_regions import region_lat_lng
+from .models import RegionReview
+from .review_service import load_regions
+
+logger = logging.getLogger(__name__)
+router = APIRouter()
+
+
+def _require_dda():
+    from .config import IS_DDA_MODE
+    if not IS_DDA_MODE:
+        from fastapi import HTTPException
+        raise HTTPException(status_code=404, detail="DDA mode is not enabled")
+
+
+@router.get("/training/export")
+def export_false_positives(
+    request: Request,
+    fmt: str = Query("csv"),
+    db: Session = Depends(get_db),
+    user: User = Depends(current_dda_user),
+):
+    """Export all false-positive regions for model training (admin or export key)."""
+    _require_dda()
+    require_admin_or_key(request, user, db)
+
+    if fmt not in ("csv", "json"):
+        from fastapi import HTTPException
+        raise HTTPException(status_code=400, detail="fmt must be csv or json")
+
+    reviews = (
+        db.query(RegionReview)
+        .filter(RegionReview.status == "false_positive")
+        .order_by(RegionReview.reviewed_at.desc())
+        .all()
+    )
+    rows = []
+    for rev in reviews:
+        run = db.query(DetectionRun).filter(DetectionRun.id == rev.run_id).first()
+        if not run:
+            continue
+        regions = load_regions(run)
+        region = next((r for r in regions if int(r.get("id", -1)) == rev.region_id), None)
+        if not region:
+            continue
+        lat, lng = region_lat_lng(region)
+        rows.append({
+            "runId": run.id,
+            "runTitle": run.title,
+            "regionId": rev.region_id,
+            "ddaChangeType": region.get("ddaChangeType") or region.get("objectType"),
+            "internalType": region.get("internalObjectType") or region.get("objectType"),
+            "confidence": region.get("confidence"),
+            "areaPx": region.get("area"),
+            "latitude": lat,
+            "longitude": lng,
+            "notes": rev.notes or "",
+            "reviewedAt": rev.reviewed_at.isoformat() if rev.reviewed_at else None,
+        })
+
+    if fmt == "json":
+        return {"count": len(rows), "falsePositives": rows}
+
+    buf = io.StringIO()
+    writer = csv.writer(buf)
+    writer.writerow([
+        "run_id", "run_title", "region_id", "dda_change_type", "internal_type",
+        "confidence", "area_px", "latitude", "longitude", "notes", "reviewed_at",
+    ])
+    for r in rows:
+        writer.writerow([
+            r["runId"], r["runTitle"], r["regionId"], r["ddaChangeType"], r["internalType"],
+            r.get("confidence"), r.get("areaPx"), r.get("latitude"), r.get("longitude"),
+            r.get("notes"), r.get("reviewedAt"),
+        ])
+    return Response(
+        content=buf.getvalue(),
+        media_type="text/csv",
+        headers={"Content-Disposition": 'attachment; filename="dda_false_positives.csv"'},
+    )

app/main.py

@@ -8,7 +8,7 @@ from pathlib import Path
 from typing import Optional
 
 from sqlalchemy import text as sa_text
-from fastapi import FastAPI, Depends, File, Form, HTTPException, UploadFile
+from fastapi import FastAPI, Depends, File, Form, HTTPException, Request, UploadFile
 from fastapi.responses import FileResponse, HTMLResponse, JSONResponse
 from fastapi.staticfiles import StaticFiles
 from pydantic import BaseModel
@@ -75,10 +75,31 @@ except Exception as e:
     import logging
     logging.getLogger("uvicorn.error").warning("Startup migration skipped: %s", e)
 
-app = FastAPI(title="AI Change Detection", version="2.3.0-dda" if IS_DDA_MODE else "2.2.0")
+app = FastAPI(title="AI Change Detection", version="2.4.0-dda" if IS_DDA_MODE else "2.2.0")
 setup_dda(app)
 
 
+if IS_DDA_MODE:
+    from .dda.dda_auth import DDA_SESSION_COOKIE
+
+    @app.middleware("http")
+    async def dda_session_middleware(request: Request, call_next):
+        session_id = request.cookies.get(DDA_SESSION_COOKIE)
+        new_session = not session_id
+        if new_session:
+            session_id = str(uuid.uuid4())
+        response = await call_next(request)
+        if new_session:
+            response.set_cookie(
+                DDA_SESSION_COOKIE,
+                session_id,
+                httponly=True,
+                max_age=60 * 60 * 24 * 30,
+                samesite="lax",
+            )
+        return response
+
+
 @app.get("/health")
 def health():
     """Health check + AdaptFormer model status (HF Spaces + diagnostics)."""
@@ -86,14 +107,25 @@ def health():
     from .model_inference import get_model_status
 
     model = get_model_status()
-    return {
+    payload = {
         "status": "ok" if model.get("available") else "degraded",
-        "version": "2.3.0-dda" if IS_DDA_MODE else "2.2.1",
+        "version": "2.4.0-dda" if IS_DDA_MODE else "2.2.1",
         "appMode": "dda" if IS_DDA_MODE else "legacy",
         "spaceId": os.environ.get("SPACE_ID", ""),
         "server_time_ist": _isoformat_ist(datetime.now(timezone.utc)),
         "adaptFormer": model,
     }
+    if IS_DDA_MODE:
+        try:
+            from .dda.job_runner import is_job_runner_busy
+            from .dda.local_library import scan_images
+            payload["dda"] = {
+                "libraryImages": len(scan_images()),
+                "jobRunnerBusy": is_job_runner_busy(),
+            }
+        except Exception as exc:
+            payload["dda"] = {"error": str(exc)[:200]}
+    return payload
 
 
 @app.on_event("startup")
@@ -448,9 +480,14 @@ def serve_overlay(path: str):
 # --- History ---
 @app.get("/api/history")
 def history(
+    request: Request,
     db: Session = Depends(get_db),
 ):
-    user = get_or_create_guest_user(db)
+    if IS_DDA_MODE:
+        from .dda.dda_auth import get_dda_user
+        user = get_dda_user(request, db)
+    else:
+        user = get_or_create_guest_user(db)
     runs = db.query(DetectionRun).filter(DetectionRun.user_id == user.id).order_by(DetectionRun.created_at.desc()).limit(100).all()
     return [
         {
@@ -475,10 +512,15 @@ def history(
 @app.get("/api/history/{run_id}")
 def get_run(
     run_id: int,
+    request: Request,
     db: Session = Depends(get_db),
 ):
     """Fetch a single run by id for opening from history (result view with slider, table, zoom)."""
-    user = get_or_create_guest_user(db)
+    if IS_DDA_MODE:
+        from .dda.dda_auth import get_dda_user
+        user = get_dda_user(request, db)
+    else:
+        user = get_or_create_guest_user(db)
     run = db.query(DetectionRun).filter(DetectionRun.id == run_id, DetectionRun.user_id == user.id).first()
     if not run:
         raise HTTPException(status_code=404, detail="Run not found")
@@ -545,9 +587,15 @@ def notify_run(
 @app.delete("/api/history/{run_id}")
 def delete_run(
     run_id: int,
+    request: Request,
     db: Session = Depends(get_db),
 ):
-    user = get_or_create_guest_user(db)
+    if IS_DDA_MODE:
+        from .dda.dda_auth import get_dda_user, require_min_role
+        user = get_dda_user(request, db)
+        require_min_role(user, db, "analyst")
+    else:
+        user = get_or_create_guest_user(db)
     run = db.query(DetectionRun).filter(DetectionRun.id == run_id, DetectionRun.user_id == user.id).first()
     if not run:
         raise HTTPException(status_code=404, detail="Run not found")

app/models.py

@@ -16,6 +16,7 @@ class User(Base):
     email = Column(String(255), unique=True, index=True, nullable=False)
     hashed_password = Column(String(255), nullable=False)
     full_name = Column(String(255), default="")
+    role = Column(String(32), default="analyst")
     created_at = Column(DateTime, default=_utcnow)
 
     detections = relationship("DetectionRun", back_populates="user", order_by="desc(DetectionRun.created_at)")