admin / Synapse-Cortex

import os
from contextlib import asynccontextmanager
from pathlib import Path

from alembic import command
from alembic.config import Config
from fastapi import FastAPI, Request
from fastapi.responses import RedirectResponse
from fastapi.staticfiles import StaticFiles
from starlette.middleware.sessions import SessionMiddleware

from . import models
from .database import Base, DATABASE_URL, SessionLocal, engine
from .paths import STATIC_DIR
from .routers import admin, assets, auth, ingest, settings, setup, sla_policies, tickets, web

SECRET_KEY = os.getenv("SECRET_KEY", "change-me-in-production")

# Routes reachable before a global admin exists / before login.
OPEN_PATH_PREFIXES = ("/setup", "/login", "/static", "/health")

# Once True (an admin has been created), we never need to hit the DB again
# on every single request just to check first-run state.
_admin_exists_cache = False

REPO_ROOT = Path(__file__).resolve().parent.parent


def run_migrations() -> None:
    """Bring the schema up to date.

    Production always runs against Postgres via real Alembic migrations
    (the DDL uses Postgres-only features: native ENUM types, a partial
    unique index). The create_all() fallback exists only so this app stays
    runnable against SQLite for local/dev smoke testing without a Postgres
    server on hand — it is never taken when DATABASE_URL points at Postgres.
    """
    if DATABASE_URL.startswith("postgresql"):
        alembic_cfg = Config(str(REPO_ROOT / "alembic.ini"))
        alembic_cfg.set_main_option("script_location", str(REPO_ROOT / "alembic"))
        command.upgrade(alembic_cfg, "head")
    else:
        Base.metadata.create_all(bind=engine)


@asynccontextmanager
async def lifespan(app: FastAPI):
    run_migrations()
    yield


app = FastAPI(title="Synapse-Cortex", version="1.0.0", lifespan=lifespan)
app.add_middleware(SessionMiddleware, secret_key=SECRET_KEY, same_site="lax")
app.mount("/static", StaticFiles(directory=str(STATIC_DIR)), name="static")


@app.middleware("http")
async def first_run_gate(request: Request, call_next):
    """Force a redirect to /setup until a global admin account exists."""
    global _admin_exists_cache

    path = request.url.path

    if not _admin_exists_cache:
        db = SessionLocal()
        try:
            admin = (
                db.query(models.User)
                .filter(models.User.role == models.UserRole.GLOBAL_ADMIN)
                .first()
            )
            _admin_exists_cache = admin is not None
        finally:
            db.close()

        if not _admin_exists_cache and not path.startswith(OPEN_PATH_PREFIXES):
            return RedirectResponse(url="/setup")

    return await call_next(request)


app.include_router(setup.router)
app.include_router(auth.router)
app.include_router(web.router)
app.include_router(tickets.router)
app.include_router(assets.router)
app.include_router(sla_policies.router)
app.include_router(settings.router)
app.include_router(admin.router)
app.include_router(ingest.router)


@app.get("/health")
def health():
    return {"status": "ok"}