Feature/ai assistant

.gcloudignore

@@ -0,0 +1,20 @@
+*
+!deploy/
+!deploy/**
+!codehive-backend/
+!codehive-backend/**
+!codehive-worker/
+!codehive-worker/**
+
+.env
+.env.*
+**/.env
+**/.env.*
+**/.DS_Store
+**/build/
+**/bin/
+**/.gradle/
+**/graphify-out/
+**/*.drawio
+**/*.graphml
+**/__pycache__/

codehive-backend/.dockerignore

@@ -0,0 +1,8 @@
+*
+!gradlew
+!settings.gradle.kts
+!build.gradle.kts
+!gradle/
+!src/
+src/test/
+**/.DS_Store

codehive-backend/Dockerfile

@@ -0,0 +1,16 @@
+FROM eclipse-temurin:21-jdk AS build
+WORKDIR /workspace
+COPY gradlew settings.gradle.kts build.gradle.kts ./
+COPY gradle gradle
+COPY src src
+RUN sh ./gradlew --no-daemon bootJar
+
+FROM eclipse-temurin:21-jre
+RUN useradd --uid 10001 --create-home codehive
+WORKDIR /app
+COPY --from=build /workspace/build/libs/*-SNAPSHOT.jar app.jar
+# Entities store LocalDateTime and the browser reads those values as local time.
+ENV TZ=America/Mexico_City
+USER 10001
+EXPOSE 8080
+ENTRYPOINT ["java", "-XX:MaxRAMPercentage=75", "-jar", "app.jar"]

codehive-backend/build.gradle.kts

@@ -25,6 +25,9 @@ dependencies {
 	implementation("org.springframework.boot:spring-boot-starter-web")
 	implementation("org.springframework.boot:spring-boot-starter-websocket")
 	implementation("org.springframework.boot:spring-boot-starter-validation")
+	implementation("org.springframework.ai:spring-ai-starter-model-google-genai:1.1.8")
+	// Public custom HTTP transport support is needed to prevent hidden POST retries.
+	implementation("com.google.genai:google-genai:1.76.0")
 	developmentOnly("org.springframework.boot:spring-boot-devtools")
 	developmentOnly("org.springframework.boot:spring-boot-docker-compose")
 
@@ -67,7 +70,6 @@ dependencies {
 
 tasks.withType<Test> {
 	useJUnitPlatform()
-	finalizedBy(tasks.jacocoTestReport) // Generate coverage report after tests
 
 	// Show test results in console
 	testLogging {
@@ -94,6 +96,55 @@ tasks.withType<Test> {
 	}))
 }
 
+val postgresAssistantTest by tasks.registering(Test::class) {
+	description = "Runs assistant integration checks against an isolated PostgreSQL database"
+	group = "verification"
+	testClassesDirs = sourceSets.test.get().output.classesDirs
+	classpath = sourceSets.test.get().runtimeClasspath
+	filter {
+		includeTestsMatching("*AssistantTransactionServiceIntegrationTest")
+		includeTestsMatching("*AssistantControllerIntegrationTest")
+		includeTestsMatching("*AssistantPostgresSchemaIntegrationTest")
+        includeTestsMatching("*AssistantUsagePostgresIntegrationTest")
+	}
+	val databaseUrl = providers.environmentVariable("CODEHIVE_ASSISTANT_TEST_DATABASE_URL")
+	val databasePassword = providers.environmentVariable("CODEHIVE_ASSISTANT_TEST_DATABASE_PASSWORD")
+	doFirst {
+		require(databaseUrl.isPresent && databasePassword.isPresent) {
+			"Set CODEHIVE_ASSISTANT_TEST_DATABASE_URL and CODEHIVE_ASSISTANT_TEST_DATABASE_PASSWORD for a disposable PostgreSQL database"
+		}
+	}
+	systemProperty("spring.datasource.url", databaseUrl.orNull ?: "")
+	systemProperty("spring.datasource.username", providers.environmentVariable("CODEHIVE_ASSISTANT_TEST_DATABASE_USERNAME").orNull ?: "postgres")
+	systemProperty("spring.datasource.password", databasePassword.orNull ?: "")
+	systemProperty("spring.datasource.driver-class-name", "org.postgresql.Driver")
+	systemProperty("spring.jpa.database-platform", "org.hibernate.dialect.PostgreSQLDialect")
+	systemProperty("spring.jpa.hibernate.ddl-auto", "create-drop")
+	systemProperty("spring.flyway.enabled", "false")
+	systemProperty("spring.ai.model.chat", "none")
+}
+
+tasks.test {
+	finalizedBy(tasks.jacocoTestReport) // Generate coverage report after standard tests only
+	useJUnitPlatform {
+		excludeTags("postgres-assistant", "live-assistant")
+	}
+}
+
+val liveAssistantTest by tasks.registering(Test::class) {
+	description = "Runs synthetic assistant safety fixtures against explicitly configured Gemini"
+	group = "verification"
+	testClassesDirs = sourceSets.test.get().output.classesDirs
+	classpath = sourceSets.test.get().runtimeClasspath
+	filter.includeTestsMatching("*LiveAssistantQualificationTest")
+	systemProperty("spring.ai.model.chat", "google-genai")
+	systemProperty("assistant.model-timeout-seconds",
+		providers.environmentVariable("ASSISTANT_MODEL_TIMEOUT_SECONDS").orNull ?: "20")
+	providers.environmentVariable("CODEHIVE_ASSISTANT_LIVE_MODEL").orNull?.let {
+		systemProperty("spring.ai.google.genai.chat.options.model", it)
+	}
+}
+
 tasks.jacocoTestReport {
 	dependsOn(tasks.test) // Tests are required to run before generating the report
 	reports {

codehive-backend/docker-compose.yaml

@@ -19,8 +19,9 @@ services:
       - "15672:15672"
 
   minio:
-    image: "minio/minio:RELEASE.2025-09-07T16-13-09Z-cpuv1"
+    image: "cgr.dev/chainguard/minio:latest"
     container_name: "minio"
+    user: root
     command: 'server /data --console-address ":9001"'
     ports:
       - "9000:9000"
@@ -37,7 +38,7 @@ services:
       retries: 5
 
   minio-init:
-    image: "minio/mc:latest"
+    image: "cgr.dev/chainguard/minio-client:latest-dev"
     container_name: "minio-init"
     depends_on:
       minio:

codehive-backend/src/main/java/com/github/codehive/config/AssistantFoundationConfig.java

@@ -0,0 +1,14 @@
+package com.github.codehive.config;
+
+import java.time.Clock;
+
+import org.springframework.context.annotation.Bean;
+import org.springframework.context.annotation.Configuration;
+
+@Configuration
+public class AssistantFoundationConfig {
+    @Bean("assistantClock")
+    Clock assistantClock() {
+        return Clock.systemUTC();
+    }
+}

codehive-backend/src/main/java/com/github/codehive/config/AssistantGoogleGenAiConfiguration.java

@@ -0,0 +1,88 @@
+package com.github.codehive.config;
+
+import java.io.IOException;
+import java.time.Duration;
+
+import org.springframework.boot.autoconfigure.condition.ConditionalOnProperty;
+import org.springframework.boot.context.properties.bind.Binder;
+import org.springframework.context.annotation.Bean;
+import org.springframework.context.annotation.Configuration;
+import org.springframework.core.env.Environment;
+import org.springframework.ai.model.google.genai.autoconfigure.chat.GoogleGenAiConnectionProperties;
+import org.springframework.util.StringUtils;
+import org.springframework.retry.support.RetryTemplate;
+
+import com.google.auth.oauth2.GoogleCredentials;
+import com.google.genai.Client;
+import com.google.genai.types.HttpOptions;
+import com.google.genai.types.HttpRetryOptions;
+import com.google.genai.types.ClientOptions;
+
+import okhttp3.OkHttpClient;
+import okhttp3.RequestBody;
+import okhttp3.MediaType;
+import okio.BufferedSink;
+
+/** Spring's retry setting does not control retries inside the Google SDK. */
+@Configuration(proxyBeanMethods = false)
+@ConditionalOnProperty(name = "spring.ai.model.chat", havingValue = "google-genai")
+public class AssistantGoogleGenAiConfiguration {
+    @Bean
+    public RetryTemplate assistantModelRetryTemplate() {
+        return RetryTemplate.builder().maxAttempts(1).build();
+    }
+
+    @Bean(destroyMethod = "close")
+    public Client assistantGoogleGenAiClient(Environment environment) throws IOException {
+        var properties = Binder.get(environment)
+                .bind(GoogleGenAiConnectionProperties.CONFIG_PREFIX, GoogleGenAiConnectionProperties.class)
+                .orElseGet(GoogleGenAiConnectionProperties::new);
+        String baseUrl = environment.getProperty("assistant.google-genai.base-url", "");
+        HttpOptions.Builder httpOptions = HttpOptions.builder()
+                .retryOptions(HttpRetryOptions.builder().attempts(1).build());
+        if (StringUtils.hasText(baseUrl)) httpOptions.baseUrl(baseUrl);
+        return clientBuilder(properties).httpOptions(httpOptions.build())
+                .clientOptions(ClientOptions.builder().customHttpClient(singleAttemptHttpClient()).build())
+                .build();
+    }
+
+    private OkHttpClient singleAttemptHttpClient() {
+        return new OkHttpClient.Builder()
+                .connectTimeout(Duration.ZERO).readTimeout(Duration.ZERO).writeTimeout(Duration.ZERO)
+                .retryOnConnectionFailure(false).followRedirects(false).followSslRedirects(false)
+                .addInterceptor(chain -> {
+                    var request = chain.request();
+                    var body = request.body();
+                    if (body != null) {
+                        // OkHttp can otherwise replay a POST after a 503 with Retry-After: 0.
+                        RequestBody singleAttempt = new RequestBody() {
+                            @Override public MediaType contentType() { return body.contentType(); }
+                            @Override public long contentLength() throws IOException { return body.contentLength(); }
+                            @Override public void writeTo(BufferedSink sink) throws IOException { body.writeTo(sink); }
+                            @Override public boolean isOneShot() { return true; }
+                        };
+                        request = request.newBuilder().method(request.method(), singleAttempt).build();
+                    }
+                    return chain.proceed(request);
+                }).build();
+    }
+
+    private Client.Builder clientBuilder(GoogleGenAiConnectionProperties properties) throws IOException {
+        Client.Builder builder = Client.builder();
+        boolean hasVertexConfig = StringUtils.hasText(properties.getProjectId())
+                && StringUtils.hasText(properties.getLocation());
+        if (!properties.isVertexAi() && StringUtils.hasText(properties.getApiKey())) {
+            return builder.apiKey(properties.getApiKey()).vertexAI(false);
+        }
+        if (!hasVertexConfig) {
+            throw new IllegalStateException("Google GenAI requires an API key or Vertex AI project and location");
+        }
+        builder.project(properties.getProjectId()).location(properties.getLocation()).vertexAI(true);
+        if (properties.getCredentialsUri() != null) {
+            try (var input = properties.getCredentialsUri().getInputStream()) {
+                builder.credentials(GoogleCredentials.fromStream(input));
+            }
+        }
+        return builder;
+    }
+}

codehive-backend/src/main/java/com/github/codehive/config/MinioConfig.java

@@ -3,6 +3,7 @@
 import org.springframework.beans.factory.annotation.Value;
 import org.springframework.context.annotation.Bean;
 import org.springframework.context.annotation.Configuration;
+import org.springframework.util.StringUtils;
 
 import io.minio.MinioClient;
 
@@ -17,13 +18,18 @@ public class MinioConfig {
     @Value("${minio.secretKey}")
     private String minioSecretKey;
 
+    @Value("${minio.region:}")
+    private String minioRegion;
+
     @Bean
     MinioClient minioClient() {
-        return MinioClient.builder()
+        MinioClient.Builder builder = MinioClient.builder()
                 .endpoint(minioUrl)
-                .credentials(
-                        minioAccessKey,
-                        minioSecretKey)
-                .build();
+                .credentials(minioAccessKey, minioSecretKey);
+        // Skips GetBucketLocation, which Cloud Storage denies without storage.buckets.get.
+        if (StringUtils.hasText(minioRegion)) {
+            builder.region(minioRegion);
+        }
+        return builder.build();
     }
 }

codehive-backend/src/main/java/com/github/codehive/config/WebSocketConfig.java

@@ -7,6 +7,7 @@
 import org.springframework.web.socket.config.annotation.WebSocketHandlerRegistry;
 
 import com.github.codehive.websocket.CsvProgressWebSocketHandler;
+import com.github.codehive.websocket.WebSocketTicketHandshakeInterceptor;
 
 @Configuration
 @EnableWebSocket
@@ -16,14 +17,18 @@ public class WebSocketConfig implements WebSocketConfigurer {
     private String allowedOrigins;
 
     private final CsvProgressWebSocketHandler csvProgressHandler;
+    private final WebSocketTicketHandshakeInterceptor ticketInterceptor;
 
-    public WebSocketConfig(CsvProgressWebSocketHandler csvProgressHandler) {
+    public WebSocketConfig(CsvProgressWebSocketHandler csvProgressHandler,
+                           WebSocketTicketHandshakeInterceptor ticketInterceptor) {
         this.csvProgressHandler = csvProgressHandler;
+        this.ticketInterceptor = ticketInterceptor;
     }
 
     @Override
     public void registerWebSocketHandlers(WebSocketHandlerRegistry registry) {
         registry.addHandler(csvProgressHandler, "/ws/csv-progress")
+                .addInterceptors(ticketInterceptor)
                 .setAllowedOrigins(allowedOrigins.split("\\s*,\\s*"));
     }
 }

codehive-backend/src/main/java/com/github/codehive/controller/AdminAssistantUsageController.java

@@ -0,0 +1,64 @@
+package com.github.codehive.controller;
+import java.util.UUID;
+import org.springframework.web.bind.annotation.*;
+import org.springframework.security.core.Authentication;
+import org.springframework.security.access.prepost.PreAuthorize;
+import com.github.codehive.service.assistant.AssistantUsageService;
+import com.github.codehive.service.assistant.AssistantUsageService.Audience;
+import com.github.codehive.repository.AssistantUsageRepository.Dimension;
+import com.github.codehive.model.request.assistant.AssistantUsageQuery;
+import com.github.codehive.model.dto.assistant.usage.AssistantUsageDTO.*;
+import com.github.codehive.model.response.SuccessResponse;
+@io.swagger.v3.oas.annotations.tags.Tag(name = "AdminAssistantUsage", description = "Content-free assistant usage, historical ledger counts and measured provider work")
+@io.swagger.v3.oas.annotations.responses.ApiResponses({
+    @io.swagger.v3.oas.annotations.responses.ApiResponse(responseCode = "200", description = "Usage retrieved"),
+    @io.swagger.v3.oas.annotations.responses.ApiResponse(responseCode = "400", description = "Invalid dates, page or filter"),
+    @io.swagger.v3.oas.annotations.responses.ApiResponse(responseCode = "403", description = "Caller lacks ownership, role or required scope"),
+    @io.swagger.v3.oas.annotations.responses.ApiResponse(responseCode = "404", description = "Requested resource not found")
+})
+@RestController
+@PreAuthorize("hasAuthority('ADMIN') and hasAuthority('CHECK_ANALYTICS')")
+public class AdminAssistantUsageController {
+    private final AssistantUsageService usage;
+    public AdminAssistantUsageController(AssistantUsageService usage) { this.usage=usage; }
+    @GetMapping("/api/admin/assistant-usage")
+    @io.swagger.v3.oas.annotations.Operation(summary = "Get global AI usage")
+    public SuccessResponse<Summary> summary(@org.springdoc.core.annotations.ParameterObject @ModelAttribute AssistantUsageQuery query, Authentication auth) {
+        var access=usage.authorize(Audience.ADMIN,auth.getName(),null,null,null,query,false);
+        return new SuccessResponse<>("Assistant usage retrieved",usage.summary(access));
+    }
+    @GetMapping("/api/admin/assistant-usage/users")
+    @PreAuthorize("hasAuthority('ADMIN') and hasAuthority('CHECK_ANALYTICS') and hasAuthority('VIEW_USERS')")
+    @io.swagger.v3.oas.annotations.Operation(summary = "List AI usage by user")
+    public SuccessResponse<Breakdown> users(@org.springdoc.core.annotations.ParameterObject @ModelAttribute AssistantUsageQuery query, Authentication auth) {
+        var access=usage.authorize(Audience.ADMIN,auth.getName(),null,null,null,query,true);
+        return new SuccessResponse<>("Assistant usage retrieved",usage.rows(access,Dimension.USERS,query));
+    }
+    @GetMapping("/api/admin/users/{userId}/assistant-usage")
+    @PreAuthorize("hasAuthority('ADMIN') and hasAuthority('CHECK_ANALYTICS') and hasAuthority('VIEW_USERS')")
+    @io.swagger.v3.oas.annotations.Operation(summary = "Get user AI usage")
+    public SuccessResponse<Summary> userSummary(@PathVariable UUID userId, @org.springdoc.core.annotations.ParameterObject @ModelAttribute AssistantUsageQuery query, Authentication auth) {
+        var access=usage.authorize(Audience.ADMIN,auth.getName(),userId,null,null,query,true);
+        return new SuccessResponse<>("Assistant usage retrieved",usage.summary(access));
+    }
+    @GetMapping("/api/admin/users/{userId}/assistant-usage/groups")
+    @PreAuthorize("hasAuthority('ADMIN') and hasAuthority('CHECK_ANALYTICS') and hasAuthority('VIEW_USERS')")
+    @io.swagger.v3.oas.annotations.Operation(summary = "List user AI usage by group")
+    public SuccessResponse<Breakdown> userGroups(@PathVariable UUID userId, @org.springdoc.core.annotations.ParameterObject @ModelAttribute AssistantUsageQuery query, Authentication auth) {
+        var access=usage.authorize(Audience.ADMIN,auth.getName(),userId,null,null,query,true);
+        return new SuccessResponse<>("Assistant usage retrieved",usage.rows(access,Dimension.GROUPS,query));
+    }
+    @GetMapping("/api/admin/users/{userId}/assistant-usage/groups/{groupId}/assignments")
+    @PreAuthorize("hasAuthority('ADMIN') and hasAuthority('CHECK_ANALYTICS') and hasAuthority('VIEW_USERS')")
+    @io.swagger.v3.oas.annotations.Operation(summary = "List user AI usage and quota by assignment")
+    public SuccessResponse<Breakdown> userAssignments(@PathVariable UUID userId, @PathVariable UUID groupId, @org.springdoc.core.annotations.ParameterObject @ModelAttribute AssistantUsageQuery query, Authentication auth) {
+        var access=usage.authorize(Audience.ADMIN,auth.getName(),userId,groupId,null,query,true);
+        return new SuccessResponse<>("Assistant usage retrieved",usage.rows(access,Dimension.ASSIGNMENTS,query));
+    }
+    @GetMapping("/api/admin/assistant-usage/models")
+    @io.swagger.v3.oas.annotations.Operation(summary = "List measured provider model and stage usage")
+    public SuccessResponse<Models> models(@org.springdoc.core.annotations.ParameterObject @ModelAttribute AssistantUsageQuery query, Authentication auth) {
+        var access=usage.authorize(Audience.ADMIN,auth.getName(),null,null,null,query,false);
+        return new SuccessResponse<>("Assistant usage retrieved",usage.models(access));
+    }
+}