ResiMuze

-- Ownership chain: every resource traces back to a verified user
-- AI is never invoked until ownership is confirmed at the route level

-- 1. authenticateToken verifies JWT
-- 2. verifyProjectOwner confirms user → project → property chain
-- 3. Only then is the prompt built from validated DB records

router.get('/property/:id/recommendations',
  authenticateToken,          -- verified identity
  async (req, res) => {
    const ent = await getEntitlements(req.user.userId);
    if (!ent.features.market_insights)
      return res.status(403).json({ code: 'FEATURE_GATED' });

    const property = await verifyPropertyAccess(
      req.params.id, req.user.userId  -- ownership confirmed
    );

    // AI prompt built from DB records only — no user text
    const insights = await getInsights(property, req.user.userId);
    const parsed   = await callGeminiJson(prompt, 8192, true);
    res.json(parsed);
  }
);

// Entitlement check → rate limit check → AI call
// All three must pass. Each is independently configurable.

const ent = await getEntitlements(userId);
if (!ent.features.ai_assistant)
  return res.status(403).json({ code: 'FEATURE_GATED' });

const rl = await checkGeminiLimit(userId);  // DB-backed counter
if (!rl.allowed)
  return res.status(429).json({
    code: 'RATE_LIMITED',
    retryAfter: rl.retryAfter   // ISO timestamp of next window
  });

// Rate limits are admin-configurable without redeployment
// GET /api/admin/settings  → current effective limits
// PUT /api/admin/settings  → { rate_limit_gemini_per_user_per_day: 20 }
// Stored in app_settings table, cached 60s, invalidated on save

// No automated award logic exists anywhere in the codebase.
// The only path to a status change is an explicit user action.

// AI produces analysis — stored, displayed, never acted upon
const analysis = await callGeminiJson(BID_ANALYSIS_PROMPT);
await db.run(
  'UPDATE scope_sheets SET ai_analysis = ? WHERE id = ?',
  [JSON.stringify(analysis), scopeId]
);

// Award requires deliberate user PUT with status payload
router.put('/bids/:id', authenticateToken, async (req, res) => {
  if (!await checkOwnership(res,
    verifyBidOwner(req.params.id, req.user.userId))) return;

  // status: 'accepted' | 'rejected' | 'pending' | 'under_review'
  // No field defaults to 'accepted'. No auto-selection logic.
  const { status } = req.body;
  // ...
});