Fix Clerk account recovery and tier safety

backend/app/clerk_billing.py

@@ -48,19 +48,20 @@ def plan_candidates(data: dict[str, Any]) -> set[str]:
     return candidates
 
 
-def tier_from_clerk_billing(data: dict[str, Any]) -> str:
-    status = text(data.get("status"))
-    if status and status.lower() in FREE_STATUSES:
-        return "free"
+def tier_from_clerk_billing(data: dict[str, Any]) -> str | None:
+    """Return a tier only when Clerk Billing gives an unambiguous answer.
+
+    A missing or unfamiliar plan must never downgrade an existing user. This
+    avoids assigning tiers based on partial checkout payloads or renamed plans.
+    """
+    status = text(data.get("status"))
+    if status and status.lower() in FREE_STATUSES:
+        return "free"
     candidates = plan_candidates(data)
     enterprise = csv_set(settings.clerk_enterprise_plan_ids) | csv_set(settings.clerk_enterprise_plan_slugs)
     paid = csv_set(settings.clerk_paid_plan_ids) | csv_set(settings.clerk_paid_plan_slugs)
     if candidates & enterprise:
         return "enterprise"
-    if candidates & paid:
-        return "paid"
-    if any("enterprise" in item for item in candidates):
-        return "enterprise"
-    if any(item in {"paid", "pro"} or "paid" in item or "pro" in item for item in candidates):
-        return "paid"
-    return "free"
+    if candidates & paid:
+        return "paid"
+    return None

backend/app/config.py

@@ -47,7 +47,9 @@ class Settings(BaseSettings):
     environment: str = "development"
 
     # Auth / Database
-    database_url: str = "sqlite:///./malwareguard.db"
+    # Set DATABASE_URL for managed Postgres. When omitted, production Spaces
+    # use /data automatically when Hugging Face persistent storage is attached.
+    database_url: str = ""
     jwt_secret_key: str = DEFAULT_JWT_SECRET
     jwt_expire_minutes: int = 60 * 24
     admin_emails: str = ""
@@ -57,7 +59,8 @@ class Settings(BaseSettings):
     clerk_secret_key: str = ""
     clerk_issuer: str = ""
     clerk_jwks_url: str = ""
-    clerk_api_url: str = "https://api.clerk.com"
+    clerk_api_url: str = "https://api.clerk.com"
+    clerk_startup_user_sync: bool = True
     clerk_webhook_secret: str = ""
     clerk_paid_plan_ids: str = "cplan_3E9Yp1Qf0qVbvx4x15QndPQyLfA"
     clerk_paid_plan_slugs: str = "paid,pro,pro_plan"

backend/app/database.py

@@ -1,16 +1,34 @@
-"""Database session and schema initialization."""
-
-from sqlalchemy import create_engine, inspect, text
+"""Database session and schema initialization."""
+
+from pathlib import Path
+
+from sqlalchemy import create_engine, inspect, text
 from sqlalchemy.orm import declarative_base, sessionmaker
 
 from .config import settings
 
 
-def _database_url() -> str:
-    url = settings.database_url
-    if url.startswith("postgres://"):
-        return url.replace("postgres://", "postgresql://", 1)
-    return url
+def _database_url() -> str:
+    url = settings.database_url.strip()
+    if not url:
+        # Hugging Face mounts persistent Space storage at /data. Falling back
+        # to the container working directory is safe for local development,
+        # but intentionally visible in production logs because it is ephemeral.
+        if settings.is_production and Path("/data").is_dir():
+            url = "sqlite:////data/malwareguard.db"
+        else:
+            url = "sqlite:///./malwareguard.db"
+    if url.startswith("postgres://"):
+        return url.replace("postgres://", "postgresql://", 1)
+    return url
+
+
+def database_is_ephemeral() -> bool:
+    """Return whether the configured SQLite path will disappear on Space rebuilds."""
+    url = _database_url()
+    if not url.startswith("sqlite"):
+        return False
+    return "/data/" not in url.replace("\\", "/")
 
 
 connect_args = {"check_same_thread": False} if _database_url().startswith("sqlite") else {}

backend/app/dependencies.py

@@ -1,8 +1,9 @@
 """Auth, role, and quota dependencies shared by routers."""
 
-from datetime import datetime, timedelta
-import hashlib
-import time
+from datetime import datetime, timedelta
+import hashlib
+import logging
+import time
 
 from fastapi import Cookie, Depends, HTTPException, Request, status
 from fastapi.security import HTTPAuthorizationCredentials, HTTPBearer
@@ -12,16 +13,17 @@ from sqlalchemy.orm import Session
 
 from .clerk_billing import tier_from_clerk_billing
 from .config import settings
-from .database import get_db
+from .database import SessionLocal, get_db
 from .db_models import AuditLog, ScanEvent, User
 from .security import decode_access_token
 
 bearer_scheme = HTTPBearer(auto_error=False)
 ANALYST_TIERS = {"enterprise"}
 ADMIN_ROLES = {"admin"}
-_clerk_jwks_cache: dict[str, object] = {"expires_at": 0, "keys": []}
-_clerk_user_cache: dict[str, object] = {}  # clerk_user_id -> {"data": ..., "expires_at": float}
-_CLERK_USER_CACHE_TTL = 300  # 5 minutes
+_clerk_jwks_cache: dict[str, object] = {"expires_at": 0, "keys": []}
+_clerk_user_cache: dict[str, object] = {}  # clerk_user_id -> {"data": ..., "expires_at": float}
+_CLERK_USER_CACHE_TTL = 300  # 5 minutes
+logger = logging.getLogger(__name__)
 
 
 def is_analyst(user: User | None) -> bool:
@@ -97,7 +99,7 @@ async def _fetch_clerk_user(clerk_user_id: str) -> dict | None:
         return None
 
 
-async def _fetch_clerk_subscription(clerk_user_id: str) -> dict | None:
+async def _fetch_clerk_subscription(clerk_user_id: str) -> dict | None:
     if not settings.clerk_secret_key:
         return None
     now = time.time()
@@ -113,8 +115,33 @@ async def _fetch_clerk_subscription(clerk_user_id: str) -> dict | None:
         result = data if isinstance(data, dict) else None
         _clerk_user_cache[f"sub:{clerk_user_id}"] = {"data": result, "expires_at": now + _CLERK_USER_CACHE_TTL}
         return result
-    except httpx.HTTPError:
-        return None
+    except httpx.HTTPError:
+        return None
+
+
+async def _list_clerk_users(offset: int, limit: int) -> tuple[list[dict], int | None]:
+    if not settings.clerk_secret_key:
+        return [], None
+    url = f"{settings.clerk_api_url.rstrip('/')}/v1/users"
+    try:
+        async with httpx.AsyncClient(timeout=10.0) as client:
+            response = await client.get(
+                url,
+                headers={"Authorization": f"Bearer {settings.clerk_secret_key}"},
+                params={"limit": limit, "offset": offset},
+            )
+            response.raise_for_status()
+        payload = response.json()
+    except httpx.HTTPError:
+        logger.warning("Could not synchronize Clerk users during startup", exc_info=True)
+        return [], None
+    if isinstance(payload, list):
+        return [item for item in payload if isinstance(item, dict)], None
+    if not isinstance(payload, dict):
+        return [], None
+    users = payload.get("data", [])
+    total_count = payload.get("total_count")
+    return [item for item in users if isinstance(item, dict)], total_count if isinstance(total_count, int) else None
 
 
 def _email_from_clerk_payload(payload: dict, clerk_user_id: str) -> str:
@@ -125,12 +152,16 @@ def _email_from_clerk_payload(payload: dict, clerk_user_id: str) -> str:
     return f"{clerk_user_id}@clerk.local"
 
 
-async def _upsert_clerk_user(db: Session, payload: dict) -> User | None:
+async def _upsert_clerk_user(
+    db: Session,
+    payload: dict,
+    clerk_user: dict | None = None,
+) -> User | None:
     clerk_user_id = payload.get("sub")
     if not isinstance(clerk_user_id, str) or not clerk_user_id:
         return None
     user = db.query(User).filter(User.clerk_user_id == clerk_user_id).first()
-    clerk_user = await _fetch_clerk_user(clerk_user_id)
+    clerk_user = clerk_user or await _fetch_clerk_user(clerk_user_id)
     email = _email_from_clerk_payload(payload, clerk_user_id)
     display_name = payload.get("name")
     if clerk_user:
@@ -148,8 +179,12 @@ async def _upsert_clerk_user(db: Session, payload: dict) -> User | None:
             )
             or display_name
         )
-    if not user:
-        user = db.query(User).filter(User.email == email).first()
+    if not user:
+        email_user = db.query(User).filter(User.email == email).first()
+        if email_user and email_user.clerk_user_id not in {None, clerk_user_id}:
+            logger.error("Refusing Clerk identity collision for email %s", email)
+            return None
+        user = email_user
     if not user:
         user = User(
             clerk_user_id=clerk_user_id,
@@ -160,17 +195,54 @@ async def _upsert_clerk_user(db: Session, payload: dict) -> User | None:
             tier="free",
         )
         db.add(user)
-    else:
-        user.clerk_user_id = user.clerk_user_id or clerk_user_id
-        user.email = email
+    else:
+        user.clerk_user_id = user.clerk_user_id or clerk_user_id
+        email_owner = db.query(User).filter(User.email == email).first()
+        if email_owner and email_owner.id != user.id:
+            logger.error("Refusing Clerk email reassignment for user %s", clerk_user_id)
+            return None
+        user.email = email
         if display_name:
             user.display_name = display_name
-    subscription = await _fetch_clerk_subscription(clerk_user_id)
-    if subscription:
-        user.tier = tier_from_clerk_billing(subscription)
+    subscription = await _fetch_clerk_subscription(clerk_user_id)
+    if subscription:
+        tier = tier_from_clerk_billing(subscription)
+        if tier is not None:
+            user.tier = tier
     db.commit()
     db.refresh(user)
-    return user
+    return user
+
+
+async def sync_clerk_users_from_clerk() -> int:
+    """Rebuild the local Clerk user projection after an ephemeral Space restart."""
+    if not settings.clerk_startup_user_sync or not settings.clerk_secret_key:
+        return 0
+
+    synced = 0
+    offset = 0
+    page_size = 100
+    db = SessionLocal()
+    try:
+        while True:
+            clerk_users, total_count = await _list_clerk_users(offset, page_size)
+            if not clerk_users:
+                break
+            for clerk_user in clerk_users:
+                clerk_user_id = clerk_user.get("id")
+                if not isinstance(clerk_user_id, str):
+                    continue
+                user = await _upsert_clerk_user(db, {"sub": clerk_user_id}, clerk_user=clerk_user)
+                if user:
+                    synced += 1
+            offset += len(clerk_users)
+            if total_count is not None and offset >= total_count:
+                break
+            if len(clerk_users) < page_size:
+                break
+    finally:
+        db.close()
+    return synced
 
 
 async def get_current_user_optional(

backend/app/main.py

@@ -20,7 +20,7 @@ from slowapi.errors import RateLimitExceeded
 from .config import settings
 from .rate_limit import limiter
 from .routers import admin, auth, partner, predict, virustotal, chat, upload, url, feedback, generic_upload, webhooks
-from .database import init_db
+from .database import database_is_ephemeral, init_db
 from .services.ml_service import get_ml_service
 from .services.shap_service import get_shap_service
 from .services.gemini_service import get_gemini_service
@@ -29,7 +29,8 @@ from .services.url_service import get_url_service
 from .services.feedback_service import get_feedback_service
 from .services.csv_analyzer import get_csv_analyzer
 from .services.mp4_analyzer import get_mp4_analyzer
-from .services.bootstrap_service import bootstrap_admin_account
+from .services.bootstrap_service import bootstrap_admin_account
+from .dependencies import sync_clerk_users_from_clerk
 
 # Configure logging.
 logging.basicConfig(
@@ -51,9 +52,16 @@ async def lifespan(app: FastAPI):
     settings.validate_security()
 
     try:
-        init_db()
-        logger.info("Database schema ready")
-        bootstrap_admin_account()
+        init_db()
+        logger.info("Database schema ready")
+        if settings.is_production and database_is_ephemeral():
+            logger.warning(
+                "Using ephemeral SQLite storage. Configure DATABASE_URL or attach Hugging Face persistent storage at /data."
+            )
+        synced_users = await sync_clerk_users_from_clerk()
+        if synced_users:
+            logger.info("Synchronized %s Clerk users into the local account projection", synced_users)
+        bootstrap_admin_account()
     except Exception as e:
         logger.error(f"Database initialization failed: {e}")
         raise

backend/app/routers/webhooks.py

@@ -68,10 +68,13 @@ def _upsert_user_from_clerk(data: dict[str, Any], event_type: str, db: Session)
     clerk_user_id = _find_user_id(data, event_type)
     if not clerk_user_id:
         return None
-    user = db.query(User).filter(User.clerk_user_id == clerk_user_id).first()
-    email = _find_email(data)
-    if not user and email:
-        user = db.query(User).filter(User.email == email).first()
+    user = db.query(User).filter(User.clerk_user_id == clerk_user_id).first()
+    email = _find_email(data)
+    if not user and email:
+        email_user = db.query(User).filter(User.email == email).first()
+        if email_user and email_user.clerk_user_id not in {None, clerk_user_id}:
+            return None
+        user = email_user
     if not user:
         user = User(
             clerk_user_id=clerk_user_id,
@@ -81,10 +84,13 @@ def _upsert_user_from_clerk(data: dict[str, Any], event_type: str, db: Session)
             tier="free",
         )
         db.add(user)
-    else:
-        user.clerk_user_id = user.clerk_user_id or clerk_user_id
-        if email:
-            user.email = email
+    else:
+        user.clerk_user_id = user.clerk_user_id or clerk_user_id
+        if email:
+            email_owner = db.query(User).filter(User.email == email).first()
+            if email_owner and email_owner.id != user.id:
+                return None
+            user.email = email
     display_name = _find_display_name(data)
     if display_name:
         user.display_name = display_name
@@ -117,10 +123,12 @@ async def clerk_webhook(request: Request, db: Session = Depends(get_db)):
 
     if event_type.startswith("user.deleted"):
         user.is_active = False
-    elif event_type.startswith("user."):
-        user.is_active = True
-    else:
-        user.tier = tier_from_clerk_billing(data)
+    elif event_type.startswith("user."):
+        user.is_active = True
+    else:
+        tier = tier_from_clerk_billing(data)
+        if tier is not None:
+            user.tier = tier
 
     db.commit()
     db.refresh(user)