Update app.py

app.py

@@ -9,6 +9,8 @@ import requests
 import urllib.parse
 from flask import Flask, request, jsonify, Response
 from flask_cors import CORS
+from flask_limiter import Limiter
+from flask_limiter.util import get_remote_address
 from datetime import datetime
 from dotenv import load_dotenv
 from llama_cpp import Llama
@@ -35,6 +37,14 @@ load_dotenv()
 app = Flask(__name__)
 CORS(app)
 
+# --- Rate Limiting ---
+limiter = Limiter(
+    get_remote_address,
+    app=app,
+    default_limits=["200 per day", "50 per hour"],
+    storage_uri="memory://",
+)
+
 # --- Configuration & Model Selection ---
 OLLAMA_URL = "http://localhost:11434"
 HF_FALLBACK_REPO = "TheBloke/TinyLlama-1.1B-Chat-v1.0-GGUF"
@@ -200,25 +210,28 @@ search_manager = SearchManager()
 def detect_tools(message):
     message = message.lower().strip()
     tools = []
+    
+    # Explicit search intent keywords
     search_keywords = [
-        "search", "latest", "news", "find out", "who is", "what is the current", 
-        "research", "browse", "today", "current", "facts", "data", "tell me about",
-        "what happened", "weather", "stock", "price", "how many", "who won",
-        "generate video", "create video", "make a video", "video about",
-        "temperature", "forecast", "update", "recent", "now", "happening",
-        "look up", "check", "get info", "information about", "details on",
-        "what's", "whats", "how's", "hows", "where is", "when did", "why did",
-        "did ", "does ", "is ", "are ", "was ", "were ", "will ", "can ", "could ",
-        "2024", "2025", "2026", "yesterday", "tomorrow", "this week", "this month"
+        "search", "look up", "find information about", "latest news", "current weather"
     ]
-    if any(kw in message for kw in search_keywords):
+    
+    # Check for years only if other indicators are present
+    has_year = any(yr in message for yr in ["2024", "2025", "2026"])
+    search_indicators = ["who ", "what ", "when ", "where ", "how ", "news", "weather", "stock", "price"]
+    
+    if any(kw in message for kw in search_keywords) or (has_year and any(si in message for si in search_indicators)):
         tools.append("search")
+    
+    # Refined search detection for questions
     question_starters = ["who ", "what ", "when ", "where ", "why ", "how "]
     if any(message.startswith(kw) for kw in question_starters):
         if "search" not in tools:
+            # Avoid triggering search for personal questions
             personal_words = ["you", "your", "we", "our", "i ", "my ", "me "]
             if not any(pw in message for pw in personal_words):
                 tools.append("search")
+                
     image_keywords = ["image", "draw", "visualize", "photo", "paint", "picture", "generate image"]
     if any(kw in message for kw in image_keywords) or ("create" in message and "image" in message) or ("make" in message and "image" in message):
         tools.append("image")
@@ -264,8 +277,14 @@ def clean_search_query(query):
 
 def get_time_response(message):
     message = message.lower()
-    time_keywords = ["time", "date", "today", "now", "clock", "day"]
-    if any(re.search(rf"\b{word}\b", message) for word in time_keywords):
+    # ONLY exact phrases or specific combinations
+    time_phrases = ["what time is it", "current time", "what's the date", "whats the date"]
+    
+    # Require at least 2 time-related words using regex boundaries
+    time_words = ["time", "date", "clock", "hour", "minute"]
+    word_matches = [word for word in time_words if re.search(rf"\b{word}\b", message)]
+    
+    if any(phrase in message for phrase in time_phrases) or len(word_matches) >= 2:
         now = datetime.now()
         return f"The current time is **{now.strftime('%H:%M:%S')}**. Today is **{now.strftime('%A, %Y-%m-%d')}**."
     return None
@@ -292,6 +311,7 @@ def login():
     return jsonify({"user": {"username": data.get("username", "Guest"), "messages_used": 0}}), 200
 
 @app.route('/api/search', methods=['POST'])
+@limiter.limit("5 per minute")
 def search_api():
     try:
         data = request.json or {}
@@ -313,6 +333,7 @@ def search_api():
         return jsonify({"error": "Search service temporarily unavailable", "success": False}), 500
 
 @app.route('/api/chat', methods=['POST'])
+@limiter.limit("10 per minute")
 def chat():
     data = request.json or {}
     message = data.get("message", "").strip()
@@ -352,8 +373,19 @@ def chat():
     dynamic_system_prompt += f"\n[Active Mode]: {mode.upper()} - {selected_mode_instruction}"
     if is_deep_research:
         dynamic_system_prompt += "\n[DEEP RESEARCH ACTIVE]: Use a multi-step reasoning approach. Analyze thoroughly."
+    
+    # Task 8: Memory injection security
     if memory:
-        dynamic_system_prompt += f"\n[User Memory]: {json.dumps(memory)}"
+        sanitized_memory = {}
+        for k, v in memory.items():
+            # Disallow sensitive keys
+            if k.lower() in ["role", "system", "instruction"]:
+                continue
+            # Sanitize values: strip [, ], <, > and limit length
+            clean_val = str(v).replace("[", "").replace("]", "").replace("<", "").replace(">", "")[:100]
+            sanitized_memory[k] = clean_val
+        if sanitized_memory:
+            dynamic_system_prompt += f"\n[User Memory]: {json.dumps(sanitized_memory)}"
 
     full_prompt = f"{message}"
     if attachments:
@@ -365,6 +397,9 @@ def chat():
         # Step 1: Attempt Colab (Ollama) - Skip if on HF Space to save time
         if not IS_HF_SPACE:
             try:
+                # Task 6: Connection check before request
+                requests.head(OLLAMA_URL, timeout=2)
+                
                 logger.info("Attempting Colab (Ollama) streaming...")
                 messages = [{"role": "system", "content": dynamic_system_prompt}]
                 for h in history:
@@ -372,10 +407,12 @@ def chat():
                     ollama_role = "assistant" if role == "ai" else "user"
                     messages.append({"role": ollama_role, "content": h.get('content', '')})
                 messages.append({"role": "user", "content": full_prompt})
+                
+                # Task 6: Increase timeout to 30 seconds
                 response = requests.post(
                     f"{OLLAMA_URL}/api/chat",
                     json={"model": "phi3:mini", "messages": messages, "stream": True, "options": {"num_ctx": 1024, "num_predict": 512}},
-                    timeout=5,
+                    timeout=30,
                     stream=True
                 )
                 if response.status_code == 200:
@@ -432,40 +469,49 @@ def generate_video_ai():
     if not prompt:
         return jsonify({"error": "No prompt provided"}), 400
     
-    # List of stable HF Spaces to try in sequence
+    # Task 7: List of stable HF Spaces to try in sequence
     video_spaces = [
         "ali-vilas/text-to-video-ms-1.7b",
         "fffiloni/zeroscope-v2-xl",
         "damo-vilab/modelscope-text-to-video"
     ]
     
-    last_err = None
-    for space in video_spaces:
-        try:
-            logger.info(f"🎬 Attempting Video Gen via {space} for: {prompt}")
-            client = Client(space)
-            result = client.predict(prompt, api_name="/predict")
+    # Try the first space, if it fails or blocks connections, fallback to Pollinations
+    space = video_spaces[0]
+    try:
+        logger.info(f"🎬 Attempting Video Gen via {space} for: {prompt}")
+        client = Client(space)
+        result = client.predict(prompt, api_name="/predict")
+        
+        # result is a URL from Gradio Client, not necessarily a local path
+        if result:
+            output_filename = f"ai_video_{uuid.uuid4().hex}.mp4"
+            output_path = os.path.join(OUTPUT_DIR, output_filename)
             
-            if result and os.path.exists(result):
-                output_filename = f"ai_video_{uuid.uuid4().hex}.mp4"
-                output_path = os.path.join(OUTPUT_DIR, output_filename)
+            # If it's a URL, download it; if it's a local path (some clients return paths), copy it
+            if result.startswith("http"):
+                resp = requests.get(result, stream=True)
+                with open(output_path, 'wb') as f:
+                    shutil.copyfileobj(resp.raw, f)
+            elif os.path.exists(result):
                 shutil.copy(result, output_path)
-                return jsonify({
-                    "status": "success",
-                    "video_url": f"/static/outputs/{output_filename}",
-                    "provider": space,
-                    "prompt": prompt
-                })
-        except Exception as e:
-            logger.warning(f"⚠️ Space {space} failed: {str(e)}")
-            last_err = str(e)
-            continue # Try next space
+            else:
+                raise Exception("Invalid result from Gradio Client")
+
+            return jsonify({
+                "status": "success",
+                "video_url": f"/static/outputs/{output_filename}",
+                "provider": space,
+                "prompt": prompt
+            })
+    except Exception as e:
+        logger.warning(f"⚠️ Space {space} failed: {str(e)}")
+        # Task 7: Immediate fallback to Pollinations if Gradio fails
 
-    # Final Fallback: Pollinations "Motion Image" (Dynamic Image sequence that looks like video)
+    # Fallback: Pollinations "Motion Image"
     try:
-        logger.info(f"🚀 All video spaces failed. Falling back to Pollinations Motion for: {prompt}")
+        logger.info(f"🚀 Video space failed or blocked. Falling back to Pollinations Motion for: {prompt}")
         seed = int(time.time())
-        # We use a high-quality pollinations image as a "Motion Card" if video is down
         motion_url = f"https://image.pollinations.ai/prompt/{requests.utils.quote(prompt)}?seed={seed}&nologo=true&width=1024&height=576"
         return jsonify({
             "status": "success",
@@ -476,9 +522,11 @@ def generate_video_ai():
         })
     except Exception as e:
         logger.error(f"❌ All video methods failed: {e}")
-        return jsonify({"error": "AI Video service is currently overloaded. Please try again in a moment."}), 503
+        # Task 11: Fix typo in error message
+        return jsonify({"error": "Our video generation servers are temporarily unavailable. Please try again later."}), 503
 
 @app.route('/api/image', methods=['POST'])
+@limiter.limit("5 per minute")
 def generate_image():
     data = request.json or {}
     prompt = data.get("prompt", "").strip()
@@ -501,18 +549,23 @@ def analyze_file():
     file = request.files['file']
     filename = file.filename
     ext = filename.split('.')[-1].lower()
+    
+    # Task 10: Use independent copy of file stream
+    file_bytes = io.BytesIO(file.read())
+    
     try:
         text_content = ""
         if ext == 'pdf':
-            with pdfplumber.open(file) as pdf:
+            with pdfplumber.open(file_bytes) as pdf:
                 text_content = "\n".join([page.extract_text() for page in pdf.pages if page.extract_text()])
         elif ext == 'docx':
-            doc = docx.Document(file)
+            doc = docx.Document(file_bytes)
             text_content = "\n".join([para.text for para in doc.paragraphs])
         elif ext == 'txt':
-            text_content = file.read().decode('utf-8', errors='ignore')
+            file_bytes.seek(0)
+            text_content = file_bytes.read().decode('utf-8', errors='ignore')
         elif ext in ['png', 'jpg', 'jpeg', 'webp']:
-            img = Image.open(file)
+            img = Image.open(file_bytes)
             text_content = pytesseract.image_to_string(img)
         else:
             return jsonify({"error": f"Unsupported file type: {ext}"}), 400