The previous commit shipped Firestore rules that reference an org_id claim
nothing issues yet, and an org_id filter nothing writes yet - this is the
commit that makes both real. Backend half of SAAS_PLAN.md B2/B2b/B2c.
Data model: organizations/{org_id} and org_members/{uid} are new
collections (models.py OrganizationRecord/OrgMember). org_id is now an
Optional field on NodeRecord, SystemRecord, CallRecord, IncidentRecord,
AlertRule, and AlertEvent - optional because every existing document
predates it; scripts/backfill_org_id.py (written, not run - it touches
production Firestore and Firebase Auth claims) is what closes that gap
later. plan_id/subscription_status/stripe_* on OrganizationRecord are
deliberately None: no billing or pricing model has been decided, so this is
a seam, not a promise. app/internal/tenancy.py holds FOUNDING_ORG_ID, the
org every pre-tenancy document and every legacy enrollment path resolves
into.
Where org_id comes from, end to end: a customer's node enrolls with a
per-org token (new enrollment_tokens/{token_hash} collection, minted via
POST /org/enrollment-tokens - new routers/org.py) instead of the old
fleet-wide ENROLLMENT_TOKEN, which still works as a fallback that resolves
to FOUNDING_ORG_ID so an already-deployed node's .env doesn't start failing
today. The node's org_id then flows onto every call it produces
(mqtt_handler.py's call_start/call_end, upload.py's /upload handler all
resolve it from the node doc), and onto every incident correlated from
those calls (incident_correlator.py's _create_incident/_create_master_incident).
That last one is the part that isn't just a read filter: _build_context's
`all_active = collection_list("incidents", status="active")` fed every
correlation candidate - fast-path talkgroup match, unit-continuity,
disambiguation - from the entire incidents collection, unscoped. Without
scoping it to the call's own org_id, a call from org A could link into an
incident org B already owns, which is a cross-tenant data merge at
correlation time, not just an over-broad read. Same shape of bug in
alerter.py: rule matching pulled every enabled alert_rule regardless of
org, so org A's keyword rule could fire (and POST org A's Discord webhook)
on org B's radio traffic. Both now resolve org_id from the call doc itself
rather than threading a new parameter through every caller.
Every list/get route gained org scoping via a new resolve_caller_org_id()
helper in internal/auth.py, which handles the three credential shapes those
routes accept (service key, node api_key, Firebase user) uniformly and
returns None (unrestricted) for the service key and platform admins -
preserving today's single-org behaviour exactly while closing the leak for
everyone else: GET /nodes, /systems, /calls, /incidents, /alerts,
/alert-rules. Write routes for nodes/systems (approve, create, delete, etc.)
deliberately stay platform-admin-only for now rather than being loosened to
org-owner/operator - that's a real gap called out in SAAS_PLAN.md 2.4's
"should be" column, but it's a separate authorization redesign the 12-item
build order doesn't actually enumerate, and doing it half-considered here
risked being exactly the "half-applied filter is worse than none" failure
mode the plan warns about. Today's founding org keeps working unchanged;
loosening node/system management to org owners is follow-up work, flagged
rather than guessed at.
Also closed the four spend/access-attack routes SAAS_PLAN.md B2c called out
by file and line: POST /calls/{id}/reprocess is now admin-only (was any
signed-in viewer looping the Whisper+Gemini pipeline for free - DEFERRED.md
had this as a live, independent-of-SaaS exploit) plus a per-call rate
limiter as a second guard; POST /alerts/{id}/acknowledge now checks the
alert's org_id; GET /admin/features moved from require_firebase_token to
require_admin_token; and trips.py's four unauthenticated mutation routes
(create_trip, update_trip_tags, create_event, update_event) are now
restricted to the founding org (or the bot's service key, or a platform
admin) - trips has no org_id of its own and isn't getting one, since
[[trips-feature-intentional]] says it's an internal utility riding along on
this stack, not a tenant-scoped product surface.
New public-but-scoped seam: POST /auth/signup (routers/links.py, alongside
the existing /auth/link* routes) provisions an organizations doc and an
owner org_members doc for a just-created Firebase user, then sets their
org_id/org_role claims - idempotent, so a double-submit doesn't create two
orgs. This is the only route that turns "has a Firebase account" into "can
read anything," which is what the frontend AuthProvider no-claim guard
(next commit) is built around.
Also new: GET/PATCH /org for the organization profile (closes the disabled
"Save changes" button noted in DEFERRED.md - there was no organizations
concept to save into before this), and POST /waitlist (public, source-IP
rate-limited, not coupled to any plan or tier - the commercial model is
still an open decision per SAAS_PLAN.md section 6).
Verified: all touched files py_compile clean; c2-core pytest is 69
passed / 10 failed, matching the documented pre-existing baseline exactly
(DEFERRED.md - mqtt_handler/node_sweeper test-vs-code drift, unrelated to
this change) - no new failures. flake8 --max-line-length=120 shows no new
violations in any touched file (checked each new E501/E221/E30x against
`git diff` to confirm it predates this commit); c2-core has no CI lint gate
regardless (CLAUDE.md - flake8 only runs in Client CI).
No new environment variables. Firestore composite indexes for the queries
this introduces were already shipped in the previous commit
(infra/firestore/firestore.indexes.json).
Co-Authored-By: Claude Opus 5 <noreply@anthropic.com>
217 lines
8.1 KiB
Python
217 lines
8.1 KiB
Python
import uuid
|
|
from fastapi import APIRouter, HTTPException, Depends, Query
|
|
from pydantic import BaseModel
|
|
from typing import Dict, Optional
|
|
from app.models import SystemCreate, SystemRecord
|
|
from app.internal import firestore as fstore
|
|
from app.internal.auth import (
|
|
require_admin_token,
|
|
require_node_service_or_firebase_token,
|
|
resolve_caller_org_id,
|
|
bootstrap_limiter,
|
|
)
|
|
from app.internal.tenancy import FOUNDING_ORG_ID
|
|
|
|
router = APIRouter(prefix="/systems", tags=["systems"])
|
|
|
|
|
|
class VocabularyTermBody(BaseModel):
|
|
term: str
|
|
|
|
|
|
class TenCodesBody(BaseModel):
|
|
ten_codes: Dict[str, str]
|
|
|
|
|
|
class AiFlagsBody(BaseModel):
|
|
stt_enabled: Optional[bool] = None
|
|
correlation_enabled: Optional[bool] = None
|
|
|
|
|
|
@router.get("")
|
|
async def list_systems(decoded: dict = Depends(require_node_service_or_firebase_token)):
|
|
org_id = await resolve_caller_org_id(decoded)
|
|
if org_id is None: # service key or platform admin — unrestricted, matches prior behaviour
|
|
return await fstore.collection_list("systems")
|
|
return await fstore.collection_list("systems", org_id=org_id)
|
|
|
|
|
|
@router.get("/{system_id}")
|
|
async def get_system(system_id: str, decoded: dict = Depends(require_node_service_or_firebase_token)):
|
|
system = await fstore.doc_get("systems", system_id)
|
|
if not system:
|
|
raise HTTPException(404, f"System '{system_id}' not found.")
|
|
org_id = await resolve_caller_org_id(decoded)
|
|
if org_id is not None and system.get("org_id") != org_id:
|
|
raise HTTPException(404, f"System '{system_id}' not found.")
|
|
return system
|
|
|
|
|
|
@router.post("", status_code=201)
|
|
async def create_system(
|
|
body: SystemCreate,
|
|
org_id: Optional[str] = Query(None, description="Platform-admin only — defaults to the founding org."),
|
|
_: dict = Depends(require_admin_token),
|
|
):
|
|
system_id = str(uuid.uuid4())
|
|
doc = SystemRecord(system_id=system_id, org_id=org_id or FOUNDING_ORG_ID, **body.model_dump())
|
|
await fstore.doc_set("systems", system_id, doc.model_dump(), merge=False)
|
|
return doc
|
|
|
|
|
|
@router.put("/{system_id}")
|
|
async def update_system(system_id: str, body: SystemCreate, _: dict = Depends(require_admin_token)):
|
|
existing = await fstore.doc_get("systems", system_id)
|
|
if not existing:
|
|
raise HTTPException(404, f"System '{system_id}' not found.")
|
|
await fstore.doc_update("systems", system_id, body.model_dump())
|
|
return {**existing, **body.model_dump()}
|
|
|
|
|
|
@router.delete("/{system_id}", status_code=204)
|
|
async def delete_system(system_id: str, _: dict = Depends(require_admin_token)):
|
|
existing = await fstore.doc_get("systems", system_id)
|
|
if not existing:
|
|
raise HTTPException(404, f"System '{system_id}' not found.")
|
|
await fstore.doc_delete("systems", system_id)
|
|
|
|
|
|
# ── Per-system AI flag overrides ──────────────────────────────────────────────
|
|
|
|
@router.put("/{system_id}/ai-flags")
|
|
async def update_system_ai_flags(
|
|
system_id: str,
|
|
body: AiFlagsBody,
|
|
_: dict = Depends(require_admin_token),
|
|
):
|
|
"""
|
|
Set per-system AI flag overrides. Only fields included in the body are
|
|
written; omitted fields remain unchanged (or absent, meaning inherit global).
|
|
Pass null to clear an override and fall back to the global flag.
|
|
"""
|
|
existing = await fstore.doc_get("systems", system_id)
|
|
if not existing:
|
|
raise HTTPException(404, f"System '{system_id}' not found.")
|
|
|
|
current: dict = existing.get("ai_flags") or {}
|
|
for field, value in body.model_dump(exclude_unset=True).items():
|
|
if value is None:
|
|
current.pop(field, None) # clear override → inherit global
|
|
else:
|
|
current[field] = value
|
|
|
|
await fstore.doc_update("systems", system_id, {"ai_flags": current})
|
|
return {"ok": True, "ai_flags": current}
|
|
|
|
|
|
# ── Ten-codes endpoints ────────────────────────────────────────────────────────
|
|
|
|
@router.get("/{system_id}/ten-codes")
|
|
async def get_ten_codes(system_id: str):
|
|
"""Return the ten-code dictionary for a system."""
|
|
system = await fstore.doc_get("systems", system_id)
|
|
if not system:
|
|
raise HTTPException(404, f"System '{system_id}' not found.")
|
|
return {"ten_codes": system.get("ten_codes") or {}}
|
|
|
|
|
|
@router.put("/{system_id}/ten-codes")
|
|
async def update_ten_codes(
|
|
system_id: str,
|
|
body: TenCodesBody,
|
|
_: dict = Depends(require_admin_token),
|
|
):
|
|
"""Replace the ten-code dictionary for a system."""
|
|
existing = await fstore.doc_get("systems", system_id)
|
|
if not existing:
|
|
raise HTTPException(404, f"System '{system_id}' not found.")
|
|
await fstore.doc_update("systems", system_id, {"ten_codes": body.ten_codes})
|
|
return {"ok": True, "ten_codes": body.ten_codes}
|
|
|
|
|
|
# ── Vocabulary endpoints ───────────────────────────────────────────────────────
|
|
|
|
@router.get("/{system_id}/vocabulary")
|
|
async def get_vocabulary(system_id: str):
|
|
"""Return approved vocabulary and pending induction suggestions."""
|
|
existing = await fstore.doc_get("systems", system_id)
|
|
if not existing:
|
|
raise HTTPException(404, f"System '{system_id}' not found.")
|
|
from app.internal.vocabulary_learner import get_vocabulary as _get
|
|
return await _get(system_id)
|
|
|
|
|
|
@router.post("/{system_id}/vocabulary/bootstrap", status_code=202)
|
|
async def bootstrap_vocabulary(
|
|
system_id: str,
|
|
decoded: dict = Depends(require_admin_token),
|
|
):
|
|
"""Trigger a one-shot GPT-4o bootstrap to seed the vocabulary from local knowledge."""
|
|
existing = await fstore.doc_get("systems", system_id)
|
|
if not existing:
|
|
raise HTTPException(404, f"System '{system_id}' not found.")
|
|
bootstrap_limiter.check(system_id)
|
|
from app.internal.vocabulary_learner import bootstrap_system_vocabulary
|
|
terms = await bootstrap_system_vocabulary(system_id)
|
|
return {"added": len(terms), "terms": terms}
|
|
|
|
|
|
@router.post("/{system_id}/vocabulary/terms")
|
|
async def add_vocabulary_term(
|
|
system_id: str,
|
|
body: VocabularyTermBody,
|
|
_: dict = Depends(require_admin_token),
|
|
):
|
|
"""Manually add a term to the approved vocabulary."""
|
|
existing = await fstore.doc_get("systems", system_id)
|
|
if not existing:
|
|
raise HTTPException(404, f"System '{system_id}' not found.")
|
|
from app.internal.vocabulary_learner import add_term
|
|
await add_term(system_id, body.term.strip())
|
|
return {"ok": True}
|
|
|
|
|
|
@router.delete("/{system_id}/vocabulary/terms")
|
|
async def remove_vocabulary_term(
|
|
system_id: str,
|
|
body: VocabularyTermBody,
|
|
_: dict = Depends(require_admin_token),
|
|
):
|
|
"""Remove a term from the approved vocabulary."""
|
|
existing = await fstore.doc_get("systems", system_id)
|
|
if not existing:
|
|
raise HTTPException(404, f"System '{system_id}' not found.")
|
|
from app.internal.vocabulary_learner import remove_term
|
|
await remove_term(system_id, body.term)
|
|
return {"ok": True}
|
|
|
|
|
|
@router.post("/{system_id}/vocabulary/pending/approve")
|
|
async def approve_pending(
|
|
system_id: str,
|
|
body: VocabularyTermBody,
|
|
_: dict = Depends(require_admin_token),
|
|
):
|
|
"""Move a pending induction suggestion into the approved vocabulary."""
|
|
existing = await fstore.doc_get("systems", system_id)
|
|
if not existing:
|
|
raise HTTPException(404, f"System '{system_id}' not found.")
|
|
from app.internal.vocabulary_learner import approve_pending_term
|
|
await approve_pending_term(system_id, body.term)
|
|
return {"ok": True}
|
|
|
|
|
|
@router.post("/{system_id}/vocabulary/pending/dismiss")
|
|
async def dismiss_pending(
|
|
system_id: str,
|
|
body: VocabularyTermBody,
|
|
_: dict = Depends(require_admin_token),
|
|
):
|
|
"""Dismiss a pending induction suggestion without adding it."""
|
|
existing = await fstore.doc_get("systems", system_id)
|
|
if not existing:
|
|
raise HTTPException(404, f"System '{system_id}' not found.")
|
|
from app.internal.vocabulary_learner import dismiss_pending_term
|
|
await dismiss_pending_term(system_id, body.term)
|
|
return {"ok": True}
|