Spaces:
Sleeping
Sleeping
Commit History
-
Fix live gaps: auditor copy, direct Ask answers, Ask metadata UI, audit tax detection
Aissugur Kurganbekov +1: Claude Opus 4.8- Landing/Auth/Overview copy -> evidence-backed finance auditor positioning (index.html title+meta, AuthScreen, Overview hero eyebrow/body/footer). - New extractors.py: deterministic regex extraction of common finance fields (total, due date, terms, tax, invoice no, late fee, overdue, uptime). Ask now returns a crisp grounded answer ("The total amount due is $2,413.98.") and falls back to focused-span extraction; values are verbatim, citations unchanged. - Ask metadata panel (question type, evidence, confidence, retrieved/cited, latency) rendered below each answer. - Audit: detect structured fields via the same extractors and fuzzy clauses via keyword scan instead of the retrieval gate -- fixes "No tax / VAT found" on "Tax (8.25%) $183.98" and a parallel false-negative on the contract liability clause. Audit is now fully deterministic. Backwards compatible (Ask, audit, evaluate, auth, scoping unchanged in shape). Verified: 59 backend tests pass, frontend builds, evalua…40c5ba0
-
Audit-driven hardening + Google sign-in
Aissugur Kurganbekov +1: Claude Opus 4.8Security (from a multi-agent audit): - CRITICAL: never sign JWTs with a shared constant. AUTH_SECRET_KEY is required in production and a random EPHEMERAL key in dev, so a default deploy can't run on a public, forgeable secret. - Fix cross-user history leak: QA rows now carry user_id and /history is scoped to the asker, so questions over shared demo docs no longer leak across users. - Require auth on /evaluate and /demo/seed (resource-amplification guard). - Guest accounts use CSPRNG creds (crypto.getRandomValues) independent of the email; add a token-type claim; guard citations against a deleted parent doc. Feature: "Continue with Google" (Google Identity Services ID-token flow): - POST /auth/google verifies the ID token (google-auth: aud + iss + email_verified) and get-or-creates the user; password_hash is now nullable for OAuth-only accounts. Gated on GOOGLE_CLIENT_ID (button hidden when unset); /health exposes google_client_id. UX/a11y: honest "session expired" messa…90adb95 -
Add user accounts: registration, login (JWT + bcrypt), per-user documents
Aissugur Kurganbekov +1: Claude Opus 4.8Backend: - User model + nullable owner_id on Document (NULL = shared demo/eval docs). - security.py (bcrypt via passlib, PyJWT HS256) and auth.py (/auth/register, /auth/login, /auth/me + get_current_user). Generic 401 with a dummy-hash compare on miss (no user enumeration), 409 on duplicate, EmailStr validation. - /documents*, /ask, /history now require a Bearer token and are scoped to the user's own docs + shared demo docs; cross-user access returns 404 (never leaking ids). /health, /evaluate, /demo/seed stay public. AUTH_SECRET_KEY is env-driven (prod hard-fail, dev default + warning). - conftest authed-by-default so the 12 existing API tests are unchanged; new test_auth.py (register/login/me/protected/per-user isolation). 38 tests pass, live end-to-end verified. Frontend: - Split-layout AuthScreen (sign in / sign up toggle, validation, show/hide password, "Continue with the demo" guest path) in the light theme. - api.js routes every request through a Bearer wrapper …165a274