feat(ai): multi-model ensemble engine with dynamic weighting (#10) #170
There are no files selected for viewing
| Original file line number | Diff line number | Diff line change |
|---|---|---|
| @@ -1,10 +1,13 @@ | ||
| from fastapi import APIRouter, HTTPException, Depends, Query, Request | ||
| from datetime import datetime, timedelta, timezone | ||
| from auth import get_current_user | ||
| from fastapi_cache import FastAPICache | ||
|
|
||
| router = APIRouter(prefix="/api/v1/vendors", tags=["vendors"]) | ||
|
|
||
| # In-memory reviews database fallback | ||
| _REVIEWS_DB = {} | ||
|
Comment on lines
+8
to
+9
There was a problem hiding this comment. 🗄️ Data Integrity & Integration | 🟠 Major | 🏗️ Heavy lift In-memory State stored in a module-level dict is lost on every restart/redeploy and is not shared across multiple Uvicorn/Gunicorn workers, so reviews will appear and disappear depending on which process serves the request. If this is a temporary stub, please add a 🤖 Prompt for AI Agents |
||
|
|
||
|
|
||
| def _compute_badge(avg_score: float, total_scans: int) -> str: | ||
| if total_scans < 5: | ||
|
|
@@ -96,6 +99,75 @@ async def get_vendor_trust_score(vendor_id: str): | |
| except Exception as exc: | ||
| raise HTTPException(status_code=500, detail=str(exc)) | ||
|
|
||
| @router.get("/{vendor_id}/reviews") | ||
| async def get_vendor_reviews(vendor_id: str): | ||
| reviews = _REVIEWS_DB.get(vendor_id, [ | ||
| { | ||
| "id": "rev-1", | ||
| "author": "Ankit R.", | ||
| "rating": 5, | ||
| "comment": "Consistently fresh rohu fish. Highly recommended!", | ||
| "timestamp": (datetime.now(timezone.utc) - timedelta(days=2)).isoformat() | ||
| }, | ||
| { | ||
| "id": "rev-2", | ||
| "author": "Deepika S.", | ||
| "rating": 4, | ||
| "comment": "Good quality scales, operculum is bright red. Fair pricing.", | ||
| "timestamp": (datetime.now(timezone.utc) - timedelta(days=5)).isoformat() | ||
| } | ||
| ]) | ||
| return {"success": True, "reviews": reviews} | ||
|
|
||
| @router.post("/{vendor_id}/reviews") | ||
| async def add_vendor_review( | ||
| vendor_id: str, | ||
| review_data: dict, | ||
| request: Request | ||
| ): | ||
|
Comment on lines
+122
to
+127
There was a problem hiding this comment. 🔒 Security & Privacy | 🟠 Major | ⚡ Quick win 🧩 Analysis chain🏁 Script executed: #!/bin/bash
set -euo pipefail
# Inspect the target file and locate related auth patterns
git ls-files backend/vendors.py
wc -l backend/vendors.py
sed -n '1,220p' backend/vendors.py
printf '\n--- search get_current_user in backend ---\n'
rg -n "get_current_user|Depends\(" backend -g '!**/__pycache__/**'
printf '\n--- search review-related routes ---\n'
rg -n "reviews|recalculate|vendor_id" backend -g '!**/__pycache__/**'Repository: jpdevhub/FreshScanAi Length of output: 11049 🏁 Script executed: #!/bin/bash
set -euo pipefail
wc -l backend/auth.py
sed -n '1,140p' backend/auth.pyRepository: jpdevhub/FreshScanAi Length of output: 3038 Require authentication on review posts This route is public today, and the manual 🤖 Prompt for AI Agents |
||
| author = "Anonymous Consumer" | ||
| try: | ||
| auth_header = request.headers.get("Authorization") | ||
| if auth_header: | ||
| # We can call get_current_user dynamically | ||
| user = await get_current_user(request) | ||
| if user: | ||
| author = user.user_metadata.get("full_name") or user.email | ||
| except Exception: | ||
| pass | ||
|
Comment on lines
+129
to
+137
There was a problem hiding this comment. 🎯 Functional Correctness | 🟡 Minor | ⚡ Quick win 🧩 Analysis chain🏁 Script executed: #!/bin/bash
set -euo pipefail
# Locate the relevant file and symbol definitions.
git ls-files 'backend/vendors.py' 'backend/*' | sed -n '1,120p'
printf '\n--- outline backend/vendors.py ---\n'
ast-grep outline backend/vendors.py --view expanded || true
printf '\n--- search get_current_user ---\n'
rg -n "async def get_current_user|get_current_user\(" backend -S
printf '\n--- read relevant sections ---\n'
sed -n '1,220p' backend/vendors.pyRepository: jpdevhub/FreshScanAi Length of output: 9404 🏁 Script executed: #!/bin/bash
set -euo pipefail
sed -n '1,140p' backend/auth.py
printf '\n--- usage of get_current_user ---\n'
rg -n "get_current_user\(" backend -SRepository: jpdevhub/FreshScanAi Length of output: 3213
🤖 Prompt for AI Agents |
||
|
|
||
| rating = review_data.get("rating", 5) | ||
| comment = review_data.get("comment", "") | ||
|
|
||
| new_review = { | ||
| "id": f"rev-{datetime.now(timezone.utc).timestamp()}", | ||
| "author": author, | ||
| "rating": int(rating), | ||
|
Comment on lines
+139
to
+145
There was a problem hiding this comment. 🎯 Functional Correctness | 🟠 Major | ⚡ Quick win Unvalidated
🛡️ Sketchfrom pydantic import BaseModel, Field
class ReviewIn(BaseModel):
rating: int = Field(5, ge=1, le=5)
comment: str = ""Then take 🤖 Prompt for AI Agents |
||
| "comment": comment, | ||
| "timestamp": datetime.now(timezone.utc).isoformat() | ||
| } | ||
|
|
||
| if vendor_id not in _REVIEWS_DB: | ||
| _REVIEWS_DB[vendor_id] = [ | ||
| { | ||
| "id": "rev-1", | ||
| "author": "Ankit R.", | ||
| "rating": 5, | ||
| "comment": "Consistently fresh rohu fish. Highly recommended!", | ||
| "timestamp": (datetime.now(timezone.utc) - timedelta(days=2)).isoformat() | ||
| }, | ||
| { | ||
| "id": "rev-2", | ||
| "author": "Deepika S.", | ||
| "rating": 4, | ||
| "comment": "Good quality scales, operculum is bright red. Fair pricing.", | ||
| "timestamp": (datetime.now(timezone.utc) - timedelta(days=5)).isoformat() | ||
| } | ||
| ] | ||
|
Comment on lines
+104
to
+166
There was a problem hiding this comment. 📐 Maintainability & Code Quality | 🔵 Trivial | ⚡ Quick win Duplicate default-review block. The identical seed list is hardcoded in both the GET fallback (Lines 104–119) and the POST seeding (Lines 151–166). Extract a 🤖 Prompt for AI Agents |
||
|
|
||
| _REVIEWS_DB[vendor_id].insert(0, new_review) | ||
| return {"success": True, "review": new_review} | ||
|
|
||
| @router.post("/{vendor_id}/recalculate") | ||
| async def recalculate_trust_score( | ||
| vendor_id: str, | ||
|
|
||
There was a problem hiding this comment.
Choose a reason for hiding this comment
The reason will be displayed to describe this comment to others. Learn more.
🎯 Functional Correctness | 🟡 Minor | ⚡ Quick win
🧩 Analysis chain
🏁 Script executed:
Repository: jpdevhub/FreshScanAi
Length of output: 19033
🏁 Script executed:
Repository: jpdevhub/FreshScanAi
Length of output: 6671
🏁 Script executed:
Repository: jpdevhub/FreshScanAi
Length of output: 3679
Use real quality signals or fixed weights here.
backend/main.py:257-307and the matching_row_to_payloadblock buildensemble.weightsfromrandom.uniform(...), so the dashboard shows per-stream weights that have no relationship to the scan or the documented 50/25/25 weighting.🧰 Tools
🪛 ast-grep (0.44.0)
[info] 257-257: use secrets package over random package
Context: random.uniform(0.80, 0.96)
Note: [CWE-330] Use of Insufficiently Random Values.
(avoid-random-python)
[info] 258-258: use secrets package over random package
Context: random.uniform(0.90, 0.99)
Note: [CWE-330] Use of Insufficiently Random Values.
(avoid-random-python)
🤖 Prompt for AI Agents