_bj`vdZddlmZddlZddlZddlmZmZddlmZddl m Z ddl m Z m Z mZddlmZdd lmZdd lmZdd lmZej0d Zej0d ZeeZe ddgZd.dZd/dZd0dZ d1dZ!d2dZ"ejGdd3dZ$ejGdd3dZ%ejGdd3dZ&ejGdejOdd3dZ(ejGdd4dZ)ejGd d5d!Z*ejGd"d5d#Z+ejGd$d5d%Z,ejGd&d5d'Z-d6d(Z.hd)Z/d7d*Z0ejGd+d8d,Z1ejOd+d9d-Z2y):uy routes/peoplehub_external.py ============================= Server-side proxy for the three external People Hub POST APIs. The browser *could* call them directly, but proxying through our backend gives us: • a single CORS-allowed origin • centralized retry/timeout behaviour • the ability to mirror the raw payload into our local data/{access_key}/ folder for audit / session-resume / fraud-correlation • room to inject candidate context into downstream calls later Each endpoint preserves the upstream payload verbatim under `data` so the frontend can store it in localStorage exactly as required by the spec. ) annotationsN)datetimetimezone)Path)Any) APIRouter HTTPExceptionstatus) JSONResponse)settings) peoplehub_api) get_loggerz ^[A-Za-z0-9][A-Za-z0-9_-]{1,63}$z^[A-Za-z0-9_-]{1,64}$z /api/externalexternal)prefixtagscdjd|xsdDxsd}tjdz |z }|jdd|S)Nc3JK|]}|js|dvs|yw)z-_N)isalnum).0cs t/Users/priyanka/Documents/AI_Agent_Assessment/pepole_hub_candidate/people_hub_candidate/routes/peoplehub_external.py z_audit_dir../s"V8QYY[AQUI18s## anonymous by_access_keyT)parentsexist_ok)joinr DATA_DIRmkdir) access_keysafeps r _audit_dirr$.sN 77Vz8[8V V eZeDO+d2AGGD4G( Hcf tjtjj j dd}t ||d|dz }|jtj|dtdd y #t$r!}tjd ||Yd }~y d }~wwxYw) z=Best-effort write of the upstream response to disk for audit.:-__.jsonFindentdefault ensure_asciiutf-8encodingzmirror %s failed (ignored): %sN)rnowrutc isoformatreplacer$ write_textjsondumpsstr Exceptionlogdebug)r!kindpayloadtspathexcs r_mirrorrC5s? \\(,, ' 1 1 3 ; ;C E*%4&2$e(<<  71cPUVahi ? 2D#>>?sBB B0B++B0c  t|ddrtj|jnd} t j |j dtd}t|dkDr|dddt|dz d z}tjd |j||j|j||jxsd tjd |j|y#t$rt|j }YwxYw#t$r!}tj!d ||Yd}~yd}~wwxYw)uJPretty-print the upstream response for one of our external API proxies. Pairs with `_log_outgoing_request` so each round-trip is visible in the server log: [API SPEC SUMMARY — KIND] … ← outgoing request line [API SPEC SAMPLE — KIND] {…JSON…} ← outgoing request body [UPSTREAM RESPONSE — KIND] status=200 ok=true url=… data={…} Critical when debugging the session-end chain — without this we couldn't tell whether the upstream actually accepted the rolePlayId we sent, or what scoring the upstream returned. urlNz(no-url)r+Fr,…(+ chars truncated)uD[UPSTREAM RESPONSE — %s] ak=%s status=%s ok=%s url=%s error=%sz(none)u ──────────── [UPSTREAM RESPONSE BODY — %s] ──────────── %s ──────────────────────────────────────────────u3[UPSTREAM RESPONSE — %s] log formatter failed: %s)getattrph _safe_log_urlrEr8r9datar:r;lenr<infoupper status_codeokerrorwarning)r>r!resultrE payload_strrBs r_log_upstream_responserV?s"!V.5feT.Jbvzz*PZ +**V[[CV[\K { d "%et,s;7G$7N6OO`/aaK  R JJL     II  LL $H   Y JJL    +fkk*K +( V I4QTUUVs;.D'C/BD/D DDD D=D88D=c0|jrtj|jnd}t||||j|j ||j |jrtj|j nd|jrtj|j nd|jd}t||d|i|d|jrd}n'd|j cxkrd krnn |j }nd }t|| S) u Build the JSON envelope returned to the browser. The raw upstream URL is mirrored to disk for audit but never echoed back to the browser — that would leak internal infrastructure details (host, path) into the client. The browser only sees `kind`. rFN)rQrPr>rLis_empty candidaterRrE)requestresponseiii)contentrP) rErJrKrVrQrPrLis_empty_responseextract_candidate_summaryrRrCr )rTr!r> audit_urlbody http_statuss r_payload_responsercps17   ,I 4V4 ++>Dii--fkk:UFLii55fkkBUY D J5)*<$OPyy "" (S (((  + >>r%c|xsdj}|sttjdtj |sttjd|S)Nrzaccess_key is requiredz access_key has an invalid format)stripr r HTTP_400_BAD_REQUEST_ACCESS_KEY_RE fullmatchr!keys r _validate_keyrksS   " " $C F779QRR  # #C (F779[\\ Jr%z/login/{access_key}cXt|}ttj||dS)u Proxy → POST {PEOPLEHUB_BASE_URL}/login/by-accesskey/{access_key} The frontend must store the entire `data` payload in localStorage and use `current_stage` (extracted defensively) to decide where to navigate. login)rkrcrJrmris rexternal_loginrns%  #C RXXc]C 99r%z/roleplays/{access_key}cXt|}ttj||dS)u Proxy → POST {PEOPLEHUB_BASE_URL}/roleplays/by-accesskey/{access_key} `data` is the raw API output (typically a list of role-play challenges or `{ data: [...] }`). The frontend should render an empty-state UI when `is_empty=true`. roleplays)rkrcrJrpris rexternal_roleplaysrqs&  #C R\\#.[ AAr%z/coding/{access_key}cXt|}ttj||dS)uX Proxy → POST {PEOPLEHUB_BASE_URL}/codingassessment/by-accesskey/{access_key} coding)rkrcrJcoding_assessmentris rexternal_codingrus(  #C R11#6X FFr%z/assessment/{access_key}cXt|}ttj||dS)u$ Proxy → POST {assess_base}/test/gsonTestResponse.jsp?accesskey={access_key} Returns all sections + questions for the candidate's current assessment test. `data.caseStudyQuestDis` being empty means use sections[0].questions (MCQ). `data.caseStudyQuestDis` having items means use those (descriptive/case study). Both GET and POST are accepted on the proxy so existing frontend code keeps working; the upstream JSP is always called with POST (the only method it accepts — calling GET upstream returns HTTP 405). assessment)rkrcrJget_assessmentris rrxrxs(  #C R..s3S, GGr%z(/assessment/submit/{access_key}/{testid}ct|}|r,tjt|j st t jdttj|t|j |dS)uU Proxy → POST {assess_base}/test/updateAssessmentScoreApi.jsp ?accesskey={access_key}&testid={testid} Called ONLY on the final Submit Assessment action — never on every Next click. (Per-question saves go to /assessment/answer/{access_key}.) Responds with totalScore + resultStatus from upstream. testid has an invalid formatassessment_submit) rk _TESTID_RErhr:rer r rfrcrJsubmit_assessment_score)r!testidrjs rsubmit_assessmentrso  #C --c&k.?.?.ABF779WXX  ""3F (9(9(;<  r%z/assessment/answer/{access_key}c Kt|}|xsi}t|jddj}|rtj |st tjdt|jddj}t|jddj}t|jddj}t|jddj}|jd |jd d}|d}|st tjd |sd }tj|||||t|| } t| |dSw)u Proxy → POST {assess_base}/test/updateAssessmentApi.jsp Per-question save invoked on every Next button click. Body fields: accesskey, sectionid, questionid, question_flag, counter, Answer, testid The frontend builds this body via PHConfig.buildAnswerBody(). Returns the upstream envelope verbatim under `data` so the caller can update its `counter`, `sectionid`, `questionid`, `question_flag` state from `data.data.*`. r~rrz questionid sectionid question_flag0counterAnsweranswerzquestionid is required1)r!rrrrrr~assessment_answer) rkr:getrer|rhr r rfrJupdate_assessment_answerrc) r!rarjr~rrrrrrTs rrrsV  #C :2D(B' ( . . 0F --f5F779WXXr2399;Jb1288:I#67==?MB/0668GHHXtxx"'=>F ~ F779QRR   ( (#6{F VS*= >>sFF z/coding/submit/{access_key}cKt|}t|xsi}||d<|jdd|jdtjt j jt|jdtr-|djd||djd|dtd||tj||} t|dz }|jr%tj |j#d ng}t|t$s|g}t|}||d<tjt j j|d <|j&|d <|j)||j+tj,|d t.dd t7||dS#t0$r }t2j5d|Yd}~1d}~wwxYww)uW Proxy → POST {PEOPLEHUB_BASE_URL}/coding/submit Called by the coding editor when the candidate clicks "Submit Answer" on a single question. Body shape (per the upstream Postman sample): { "kind": "coding_submit", "access_key": "", "received_at": "", "request": { "access_key": "", "candidate_id": "", "question_id": , "question_text": "...", "language": "python|java|...", "code": "", "submitted_at": "" } } Upstream response: { "status": true, "message": "Coding submission saved successfully", "data": { "id": , "kind": "coding_submit", "accessKey": "...", "questionId": , ... } } Beyond proxying, this handler also mirrors the request locally under data/by_access_key/{key}/coding_submit.json so the per-candidate audit trail matches what the upstream API received. r!r> coding_submit received_atrZ submitted_atr!r?zcoding_submit.jsonr0r1saved_atupstream_statusr+Fr,z)coding_submit mirror failed (ignored): %sN)rkdict setdefaultrr3rr4r5 isinstancer_log_outgoing_requestrJ submit_codingr$existsr8loads read_textlistrPappendr7r9r:r;r<r=rc r!rarjr?rTrAexistingrecordrBs rrrsF  #C4:2G GL v/ }hll8<<&@&J&J&LM'++i($/ %%lc: %%ngm6LM/38   g >F D#!55CG;;=4::dnngn>?VX(D) zHg%(|%-\\(,,%?%I%I%Kz%+%7%7 !  8AsQVWbij VS/ :: D =sCCDs1C#H &C*G H  H&H<H HH z/roleplay/save/{access_key}cKt|}t|xsi}td||tj||} t |dz }|j r%tj|jdng}t|ts|g}t|}||d<tjtjj!|d<|j"|d<|j%||j'tj(|d t*d dt3||dS#t,$r }t.j1d |Yd }~1d }~wwxYww)u] Proxy → POST {PEOPLEHUB_BASE_URL}/roleplay/save Called when the candidate ends a role play session. Body shape per the upstream contract: { "kind": "roleplay", "access_key": "", "received_at": "", "request": { "scenario": { "id": "2", "title": "..." }, "session_id": "...", "duration_seconds": 14, "turns_completed": 0, "mode": "voice", "end_reason": "completed" } } Response (loose, opaque): { "status": "success", "message": "saved", "saved": true } Beyond proxying, this handler also mirrors the request locally under data/by_access_key/{key}/roleplay.json — same as /results/{key}/roleplay used for audit / resume. roleplay_saverz roleplay.jsonr0r1r!rrr+Fr,z$roleplay mirror failed (ignored): %sN)rkrrrJ save_roleplayr$rr8rrrrrr3rr4r5rPrr7r9r:r;r<r=rcrs rrr_s+8  #C4:2G/38   g >F ?#0CG;;=4::dnngn>?VX(D) zHg"|'||HLL9CCEz$*$6$6 !  8AsQVWbij VS/ :: ? 8#>>?0?E%C*D9, E%9 E"EE%E""E%z/roleplay/report/{access_key}cKt|}t|xsi}td||tj||} t |dz }|j r%tj|jdng}t|ts|g}t|}||d<tjtjj!|d<|j"|d<|j%||j'tj(|d t*d dt3||dS#t,$r }t.j1d |Yd }~1d }~wwxYww)uD Proxy → POST {PEOPLEHUB_BASE_URL}/roleplay/report Called immediately after the role play report is generated on the frontend. The body mirrors the upstream contract documented in the Postman sample: { "kind": "roleplay", "access_key": "", "received_at": "", "request": { "scenario": { "id": "2", "title": "Java Technical Interview", "description": "...", "context": "...", "category": "technical", "cat_label": "Technical", "learner_role": "Interviewer", "learner_emoji": "...", "ai_character": "...", "ai_emoji": "...", "ai_personality": "...", "difficulty": "Advanced", "turns": 8 }, "session_id": "...", "duration_seconds": 0, "turns_completed": 0, "mode": "voice|video|text", "end_reason": "completed|time_expired|abandoned", "report": { ... full generated report ... } } } Beyond proxying, this handler also mirrors the request locally under data/by_access_key/{key}/roleplay_report.json for audit / resume. roleplay_reportrzroleplay_report.jsonr0r1r!rrr+Fr,z+roleplay_report mirror failed (ignored): %sN)rkrrrJsave_roleplay_reportr$rr8rrrrrr3rr4r5rPrr7r9r:r;r<r=rcrs rrrs2P  #C4:2G+S':  $ $W EF F#!77CG;;=4::dnngn>?VX(D) zHg"|'||HLL9CCEz$*$6$6 !  8AsQVWbij VS*; << F ?EEFrc&t|xsi}t|jdtr|jdni}d|d|d|jd|jdd|jd|jdd|jd |jd d |jd |jd d |jd |jd d|jd|jdg}tj d|j dj|tj d|j tj|dtdy)uPretty-print a request body that the frontend just sent us. Two parts get logged: 1. A single-line summary banner that surfaces the most-grepped identifiers (rolePlayId, session_id, mode, end_reason, …) so that "is rolePlayId being sent?" can be answered with one `grep` over the log file — no scrolling through 200 lines of pretty-printed JSON. 2. The full body, dumped as-is (no extra `request` wrapper). The previous version nested the entire body under another `"request"` key, which made fields like `rolePlayId` appear two levels deep in the output and easy to miss during review. Sensitive fields are redacted via `_safe_for_log`. rZzkind=z access_key=z rolePlayId= rolePlayIdzid=idz session_id= session_idzmode=modez end_reason= end_reasonzturns_completed=turns_completedu[API SPEC SUMMARY — %s] %s u ──────────── [API SPEC SAMPLE — %s] ──────────── %s ──────────────────────────────────────────────r+Fr,N) _safe_for_logrrrr<rNrOrr8r9r:)r>r!rar"inner summary_bitss rrrs^$  $D$.dhhy.A4#HDHHY bE v j\" dhh|UYY|-DEFG dhhtUYYt_- ./ eii dhh|.DEFG  &$((6"2345 eii dhh|.DEFG 599%6AR8STUV LHH +TZZ\388L;QR HH U  43UC r%>jwttokenpasswordph_token authorizationct|trVi}|jD]?\}}t|tr|j t vrd||<2t |||<A|St|tr|Dcgc] }t |c}St|tr&t|dkDr|dddt|dz dzS|Scc}w)zARecursively scrub auth tokens and clip oversized values for logs.z rFNrGrH) rritemsr:lower _REDACT_KEYSrrrM)objoutkvs rrrs#tIIKDAq!S!aggi<&?%A&q)A   #t*-.#Q a #..#sC45DzeCHtO#44EFFF J/s;Cz/results/{access_key}/{kind}cKt|}hd}||vrttjdt |||xsit ||dz } |j r%tj|jdng}t|ts|g}t|xsi}||d<tjt j"j%|d<|j'||j)tj*|dt,d dt.j1d ||t3|d t3|d S#t$rg}YwxYww)u Persist a JSON document under data/by_access_key/{access_key}/{kind}.json `kind` must be one of: roleplay, coding, fraud, session, end_session, coding_submit, coding_final. Side effects: • Appends `body` (with access_key + saved_at) to the per-candidate file. • Logs the request as a clearly-marked "API SPEC SAMPLE" so the backend dev has a copy-pasteable view of what the frontend is sending — auth tokens scrubbed, large strings truncated. >fraudrssessionroleplay end_session coding_finalrrz unknown kindr*r0r1r!rr+Fr,z#[results] %s/%s appended (%d total)T)rQcount)rkr r rfrr$rr8rrrrr;rrr3rr4r5rr7r9r:r<rNrM)r!r>rarjallowedrArrs r save_resultsr"s5  #C"G 7F77HH$TZR0 c?vU^ +DCG;;=4::dnngn>?VX(D) zH$*" FF<#<< 5??AF: OOFOODJJx3US^eOfHH 2Cs8}MX // s,AE$A EB6E$ E!E$ E!!E$c<Kt|}t||dz }|jsdgdS tj|j d}d|dS#t $r1}tjd|||dgt|dcYd }~Sd }~wwxYww) z=Load all persisted results of a given kind for an access_key.r*T)rQrLr0r1z[results] %s/%s read error: %sF)rQrLrRN) rkr$rr8rrr;r<rSr:)r!r>rjrArLrBs r load_resultsrLs  #C c?vU^ +D ;;=B''<zz$..'.:; %% < 4c4ER#c(;;r:r?rrNone)r>r:r!r:rT ph.ApiResultrr)rTrr!r:r>r:rr )r!r:rr:)r!r:)r!r:r~r:)r!r:rar)r>r:r!r:rarrr)rrrr)r!r:r>r:rar)r!r:r>r:)3__doc__ __future__rr8rerrpathlibrtypingrfastapirr r fastapi.responsesr configr servicesr rJ utils.loggerrcompilergr|__name__r<routerr$rCrVrcrkpostrnrqrurrxrrrrrrrrrrr%rrs# '44*(#?@45  / =  ?.Vb"?P "#:$: &' B( B #$G%G '( &' H() H  789& ./,?0,?^ *+A;,A;H *+2;,2;j ,-==.==J0fI " +,&0-&0R *+ &, &r%