Deploy GitHub snapshot to Hugging Face Space

.dockerignore

@@ -0,0 +1,13 @@
+.git
+.github
+.venv
+.pytest_cache
+.ruff_cache
+.mypy_cache
+__pycache__
+*.py[cod]
+*.log
+.env
+img
+tests
+scripts

.env.example

@@ -0,0 +1,22 @@
+APP_NAME=gungfi-webhook-be
+LOG_LEVEL=INFO
+
+# Keep this path aligned with the n8n template.
+WEBHOOK_PATH=/cloudinary-trigger
+
+# AI pipeline base URL. The app posts webhook data to /process.
+AI_PIPELINE_URL=https://be-aipipeline.bluecoast-4238dc8b.eastasia.azurecontainerapps.io
+AI_PIPELINE_TIMEOUT_SECONDS=60
+
+# Supabase REST API. Use a service role key on the backend only.
+SUPABASE_URL=https://your-project.supabase.co
+SUPABASE_SERVICE_ROLE_KEY=replace-me
+SUPABASE_TABLE=reports
+
+# Cloudinary webhook signature validation.
+# Cloudinary sends X-Cld-Signature and X-Cld-Timestamp.
+CLOUDINARY_API_SECRET=replace-me
+CLOUDINARY_CLOUD_NAME=replace-me
+CLOUDINARY_API_KEY=replace-me
+CLOUDINARY_SIGNATURE_REQUIRED=true
+CLOUDINARY_SIGNATURE_TOLERANCE_SECONDS=7200

.github/workflows/deploy-huggingface-space.yml

@@ -0,0 +1,100 @@
+name: Deploy to Hugging Face Spaces
+
+on:
+  push:
+    branches:
+      - main
+  workflow_dispatch:
+
+concurrency:
+  group: huggingface-space
+  cancel-in-progress: true
+
+jobs:
+  test-and-deploy:
+    runs-on: ubuntu-latest
+
+    steps:
+      - name: Checkout repository
+        uses: actions/checkout@v4
+        with:
+          fetch-depth: 0
+
+      - name: Install uv
+        uses: astral-sh/setup-uv@v5
+
+      - name: Set up Python
+        uses: actions/setup-python@v5
+        with:
+          python-version: "3.12"
+
+      - name: Install dependencies
+        run: uv sync --frozen
+
+      - name: Run tests
+        env:
+          APP_NAME: gungfi-webhook-be
+          LOG_LEVEL: INFO
+          WEBHOOK_PATH: /cloudinary-trigger
+          AI_PIPELINE_URL: http://be-aipipeline-jeki.indonesiacentral.azurecontainer.io:8000
+          AI_PIPELINE_TIMEOUT_SECONDS: 60
+          SUPABASE_URL: https://example.supabase.co
+          SUPABASE_SERVICE_ROLE_KEY: test-service-role-key
+          SUPABASE_TABLE: reports
+          CLOUDINARY_API_SECRET: test-cloudinary-secret
+          CLOUDINARY_SIGNATURE_REQUIRED: true
+          CLOUDINARY_SIGNATURE_TOLERANCE_SECONDS: 7200
+        run: uv run pytest
+
+      - name: Deploy to Hugging Face Space
+        env:
+          HF_USERNAME: ${{ secrets.HF_USERNAME }}
+          HF_TOKEN: ${{ secrets.HF_TOKEN }}
+          HF_SPACE_ID: ${{ secrets.HF_SPACE_ID }}
+        run: |
+          if [ -z "$HF_USERNAME" ] || [ -z "$HF_TOKEN" ] || [ -z "$HF_SPACE_ID" ]; then
+            echo "Missing one or more required secrets: HF_USERNAME, HF_TOKEN, HF_SPACE_ID"
+            exit 1
+          fi
+
+          SPACE_ID="$HF_SPACE_ID"
+          SPACE_ID="${SPACE_ID#https://huggingface.co/spaces/}"
+          SPACE_ID="${SPACE_ID#http://huggingface.co/spaces/}"
+          SPACE_ID="${SPACE_ID%/}"
+
+          if ! echo "$SPACE_ID" | grep -Eq '^[^/]+/[^/]+$'; then
+            echo "HF_SPACE_ID must be owner/space-name or a Hugging Face Space URL."
+            exit 1
+          fi
+
+          rm -rf hf-space
+          mkdir hf-space
+          git archive --format=tar HEAD | tar -x -C hf-space
+
+          oversized_files="$(find hf-space -type f -size +10M -print)"
+          if [ -n "$oversized_files" ]; then
+            echo "Hugging Face rejects regular Git files larger than 10 MiB."
+            echo "$oversized_files"
+            exit 1
+          fi
+
+          cd hf-space
+          git init -b main
+          git config user.name "github-actions[bot]"
+          git config user.email "41898282+github-actions[bot]@users.noreply.github.com"
+          git add -A
+          git commit -m "Deploy GitHub snapshot to Hugging Face Space"
+          git remote add huggingface "https://${HF_USERNAME}:${HF_TOKEN}@huggingface.co/spaces/${SPACE_ID}"
+
+          for attempt in 1 2 3 4 5; do
+            if git push --force huggingface HEAD:main; then
+              exit 0
+            fi
+
+            sleep_seconds=$((attempt * 30))
+            echo "Hugging Face push failed on attempt ${attempt}. Retrying in ${sleep_seconds}s..."
+            sleep "$sleep_seconds"
+          done
+
+          echo "Hugging Face deploy failed after 5 attempts."
+          exit 1

.gitignore

@@ -0,0 +1,9 @@
+.venv/
+__pycache__/
+*.py[cod]
+.pytest_cache/
+.ruff_cache/
+.mypy_cache/
+.env
+*.log
+img/

Dockerfile

@@ -0,0 +1,18 @@
+FROM python:3.12-slim
+
+ENV PYTHONDONTWRITEBYTECODE=1 \
+    PYTHONUNBUFFERED=1 \
+    UV_SYSTEM_PYTHON=1
+
+WORKDIR /app
+
+RUN pip install --no-cache-dir uv
+
+COPY pyproject.toml uv.lock ./
+RUN uv sync --frozen --no-dev
+
+COPY app ./app
+
+EXPOSE 7860
+
+CMD ["uv", "run", "uvicorn", "app.main:app", "--host", "0.0.0.0", "--port", "7860"]

IniBukanBuatHackathon.json

@@ -0,0 +1,236 @@
+{
+  "name": "My workflow",
+  "nodes": [
+    {
+      "parameters": {
+        "httpMethod": "POST",
+        "path": "cloudinary-trigger",
+        "options": {}
+      },
+      "name": "Cloudinary Webhook",
+      "type": "n8n-nodes-base.webhook",
+      "typeVersion": 1,
+      "position": [
+        3344,
+        992
+      ],
+      "id": "ca173e05-e036-48be-99ae-42ce18e457ed",
+      "webhookId": "e6dc3997-4c85-42fc-adde-396c60a64029"
+    },
+    {
+      "parameters": {
+        "mode": "runOnceForEachItem",
+        "jsCode": "const body = $input.item.json.body || {};\nconst context = body.context || {};\nconst custom = context.custom || {};\n\nreturn {\n  json: {\n    id: custom.Id || null,\n    latitude: custom.latitude || null,\n    longitude: custom.longitude || null,\n    description: custom.description || \"\",\n    before_img_url: body.secure_url || \"\"\n  }\n};"
+      },
+      "name": "Parse Data",
+      "type": "n8n-nodes-base.code",
+      "typeVersion": 2,
+      "position": [
+        3568,
+        992
+      ],
+      "id": "d9621bf8-aa4f-434c-992f-f2d0088a250d"
+    },
+    {
+      "parameters": {
+        "conditions": {
+          "boolean": [
+            {
+              "value1": "={{!!$node[\"Parse Data\"].json.id}}",
+              "value2": true
+            }
+          ]
+        }
+      },
+      "name": "Loop Protection",
+      "type": "n8n-nodes-base.if",
+      "typeVersion": 1,
+      "position": [
+        3792,
+        992
+      ],
+      "id": "fc38d8a7-421b-4239-8382-e7afa0feead2"
+    },
+    {
+      "parameters": {
+        "method": "POST",
+        "url": "http://be-aipipeline-jeki.indonesiacentral.azurecontainer.io:8000/process-url",
+        "sendBody": true,
+        "specifyBody": "json",
+        "jsonBody": "={\n  \"id\": \"{{$node[\"Parse Data\"].json.id}}\",\n  \"longitude\": {{$node[\"Parse Data\"].json.longitude}},\n  \"latitude\": {{$node[\"Parse Data\"].json.latitude}},\n  \"before_img_url\": \"{{$node[\"Parse Data\"].json.before_img_url}}\"\n}",
+        "options": {
+          "timeout": 60000
+        }
+      },
+      "name": "Trigger BE-AIPipeline",
+      "type": "n8n-nodes-base.httpRequest",
+      "typeVersion": 3,
+      "position": [
+        4016,
+        992
+      ],
+      "id": "8cef1520-4c71-44f4-96f9-8f1180a0ffa0",
+      "notes": "BE akan download image, process AI, UPDATE Supabase, lalu hapus temp file"
+    },
+    {
+      "parameters": {
+        "assignments": {
+          "assignments": [
+            {
+              "id": "id-1",
+              "name": "id",
+              "value": "={{ $('Parse Data').item.json.id }}",
+              "type": "string"
+            },
+            {
+              "id": "id-2",
+              "name": "destruct_class",
+              "value": "={{ $('Trigger BE-AIPipeline').item.json.classification.condition }}",
+              "type": "string"
+            },
+            {
+              "id": "id-3",
+              "name": "location_score",
+              "value": "={{ $('Trigger BE-AIPipeline').item.json.priority_score }}",
+              "type": "number"
+            },
+            {
+              "id": "id-4",
+              "name": "total_score",
+              "value": "={{ $('Trigger BE-AIPipeline').item.json.max_impact }}",
+              "type": "number"
+            },
+            {
+              "id": "id-5",
+              "name": "status",
+              "value": "complete",
+              "type": "string"
+            }
+          ]
+        },
+        "includeOtherFields": true,
+        "options": {}
+      },
+      "id": "5a218d30-f6f2-45ca-942f-c73d80e4b3f3",
+      "name": "Prepare Supabase Update Data",
+      "type": "n8n-nodes-base.set",
+      "typeVersion": 3.4,
+      "position": [
+        4240,
+        992
+      ]
+    },
+    {
+      "parameters": {
+        "operation": "update",
+        "tableId": "reports",
+        "filterType": "string",
+        "filterString": "={{ 'id=eq.' + $('Prepare Supabase Update Data').item.json.id }}",
+        "fieldsUi": {
+          "fieldValues": [
+            {
+              "fieldId": "destruct_class",
+              "fieldValue": "={{ $('Prepare Supabase Update Data').item.json.destruct_class }}"
+            },
+            {
+              "fieldId": "location_score",
+              "fieldValue": "={{ $('Prepare Supabase Update Data').item.json.location_score }}"
+            },
+            {
+              "fieldId": "total_score",
+              "fieldValue": "={{ $('Prepare Supabase Update Data').item.json.total_score }}"
+            },
+            {
+              "fieldId": "status",
+              "fieldValue": "={{ $('Prepare Supabase Update Data').item.json.status }}"
+            }
+          ]
+        }
+      },
+      "id": "49aeac17-9849-47ba-ba57-93173b6fdbf2",
+      "name": "Update Supabase Record",
+      "type": "n8n-nodes-base.supabase",
+      "typeVersion": 1,
+      "position": [
+        4464,
+        992
+      ],
+      "credentials": {
+        "supabaseApi": {
+          "id": "Ce7gSa8qnBBCcA3y",
+          "name": "Supabase account"
+        }
+      }
+    }
+  ],
+  "pinData": {},
+  "connections": {
+    "Cloudinary Webhook": {
+      "main": [
+        [
+          {
+            "node": "Parse Data",
+            "type": "main",
+            "index": 0
+          }
+        ]
+      ]
+    },
+    "Parse Data": {
+      "main": [
+        [
+          {
+            "node": "Loop Protection",
+            "type": "main",
+            "index": 0
+          }
+        ]
+      ]
+    },
+    "Loop Protection": {
+      "main": [
+        [
+          {
+            "node": "Trigger BE-AIPipeline",
+            "type": "main",
+            "index": 0
+          }
+        ]
+      ]
+    },
+    "Trigger BE-AIPipeline": {
+      "main": [
+        [
+          {
+            "node": "Prepare Supabase Update Data",
+            "type": "main",
+            "index": 0
+          }
+        ]
+      ]
+    },
+    "Prepare Supabase Update Data": {
+      "main": [
+        [
+          {
+            "node": "Update Supabase Record",
+            "type": "main",
+            "index": 0
+          }
+        ]
+      ]
+    }
+  },
+  "active": true,
+  "settings": {
+    "executionOrder": "v1",
+    "availableInMCP": false
+  },
+  "versionId": "f32ea910-f847-438f-aee1-657680d0cf9e",
+  "meta": {
+    "templateCredsSetupCompleted": true,
+    "instanceId": "ec50aa1d8c0e15b703de4ec09bc4ae99ba1d29b466ee546490a9882118ec4069"
+  },
+  "id": "BFLADivi1dvw4GiMd9fuK",
+  "tags": []
+}

README.md

@@ -0,0 +1,102 @@
+---
+title: Gungfi Webhook BE
+colorFrom: blue
+colorTo: green
+sdk: docker
+pinned: false
+---
+
+# Gungfi Webhook BE
+
+FastAPI backend pengganti workflow n8n `IniBukanBuatHackathon.json`.
+
+Flow yang dipertahankan:
+
+1. Terima Cloudinary webhook di `POST /cloudinary-trigger`.
+2. Parse `body.context.custom` menjadi `id`, `latitude`, `longitude`, `description`, dan `before_img_url`.
+3. Jalankan loop protection: kalau `Id` kosong, tidak meneruskan proses.
+4. Download image dari Cloudinary, lalu kirim multipart form-data ke BE AI Pipeline `POST /process`.
+5. Update Supabase tabel `reports` dengan `destruct_class`, `location_score`, `total_score`, dan `status=complete`.
+
+## Setup
+
+```powershell
+uv venv
+uv sync
+Copy-Item .env.example .env
+```
+
+Isi `.env`, terutama `SUPABASE_URL`, `SUPABASE_SERVICE_ROLE_KEY`, dan `CLOUDINARY_API_SECRET`.
+
+## Run
+
+```powershell
+uv run uvicorn app.main:app --host 0.0.0.0 --port 8000
+```
+
+Cloudinary notification URL:
+
+```text
+https://your-domain/cloudinary-trigger
+```
+
+Set URL tersebut sebagai global webhook Notification URL di Cloudinary Console, atau di upload preset yang dipakai aplikasi. Dengan begitu aplikasi upload tidak perlu mengirim parameter `notification_url` pada setiap request.
+
+## Test
+
+```powershell
+uv run pytest
+```
+
+## CI/CD ke Hugging Face Spaces
+
+Repository ini siap dideploy sebagai Docker Space. Buat Space di Hugging Face dengan SDK `Docker`, lalu tambahkan secret berikut di GitHub repository:
+
+```text
+HF_USERNAME=your-huggingface-username
+HF_TOKEN=hf_...
+HF_SPACE_ID=your-huggingface-username/your-space-name
+```
+
+Tambahkan juga environment variable aplikasi di Hugging Face Space settings:
+
+```text
+APP_NAME=gungfi-webhook-be
+LOG_LEVEL=INFO
+WEBHOOK_PATH=/cloudinary-trigger
+AI_PIPELINE_URL=https://be-aipipeline.bluecoast-4238dc8b.eastasia.azurecontainerapps.io
+AI_PIPELINE_TIMEOUT_SECONDS=60
+SUPABASE_URL=https://your-project.supabase.co
+SUPABASE_SERVICE_ROLE_KEY=replace-me
+SUPABASE_TABLE=reports
+CLOUDINARY_API_SECRET=replace-me
+CLOUDINARY_SIGNATURE_REQUIRED=true
+CLOUDINARY_SIGNATURE_TOLERANCE_SECONDS=7200
+```
+
+Setiap push ke branch `main` akan menjalankan test, lalu melakukan force-push isi repo ke Hugging Face Space.
+
+## Test Upload Cloudinary
+
+Tambahkan ini ke `.env`:
+
+```text
+CLOUDINARY_CLOUD_NAME=...
+CLOUDINARY_API_KEY=...
+CLOUDINARY_API_SECRET=...
+```
+
+Untuk test upload file `img/DSC06041.JPG` ke Cloudinary:
+
+```powershell
+uv run python scripts/upload_cloudinary_test.py
+```
+
+Kalau ingin Cloudinary memanggil FastAPI lokal, expose dulu server lokal ke HTTPS publik:
+
+```powershell
+uv run uvicorn app.main:app --host 127.0.0.1 --port 8000
+ngrok http 8000
+```
+
+Setelah dapat URL HTTPS dari tunnel, set global webhook Notification URL atau upload preset Notification URL di Cloudinary ke `https://your-tunnel-url/cloudinary-trigger`, lalu jalankan lagi script upload Cloudinary.

app/__init__.py

@@ -0,0 +1 @@
+"""Gungfi webhook backend."""

app/cloudinary.py

@@ -0,0 +1,61 @@
+import hashlib
+import hmac
+import time
+
+from fastapi import HTTPException, Request, status
+
+from app.config import Settings
+
+
+SIGNATURE_HEADER = "x-cld-signature"
+TIMESTAMP_HEADER = "x-cld-timestamp"
+
+
+def verify_notification_signature(raw_body: bytes, signature: str, timestamp: str, api_secret: str) -> bool:
+    signed = raw_body + timestamp.encode("utf-8") + api_secret.encode("utf-8")
+    sha1_digest = hashlib.sha1(signed).hexdigest()
+    sha256_digest = hashlib.sha256(signed).hexdigest()
+    return hmac.compare_digest(signature, sha1_digest) or hmac.compare_digest(signature, sha256_digest)
+
+
+async def enforce_cloudinary_signature(request: Request, settings: Settings) -> bytes:
+    raw_body = await request.body()
+    if not settings.cloudinary_signature_required:
+        return raw_body
+
+    if not settings.cloudinary_api_secret:
+        raise HTTPException(
+            status_code=status.HTTP_500_INTERNAL_SERVER_ERROR,
+            detail="Cloudinary signature validation is required but CLOUDINARY_API_SECRET is not configured.",
+        )
+
+    signature = request.headers.get(SIGNATURE_HEADER)
+    timestamp = request.headers.get(TIMESTAMP_HEADER)
+    if not signature or not timestamp:
+        raise HTTPException(
+            status_code=status.HTTP_401_UNAUTHORIZED,
+            detail="Missing Cloudinary signature headers.",
+        )
+
+    try:
+        timestamp_int = int(timestamp)
+    except ValueError as exc:
+        raise HTTPException(
+            status_code=status.HTTP_401_UNAUTHORIZED,
+            detail="Invalid Cloudinary timestamp.",
+        ) from exc
+
+    age = abs(int(time.time()) - timestamp_int)
+    if age > settings.cloudinary_signature_tolerance_seconds:
+        raise HTTPException(
+            status_code=status.HTTP_401_UNAUTHORIZED,
+            detail="Expired Cloudinary signature.",
+        )
+
+    if not verify_notification_signature(raw_body, signature, timestamp, settings.cloudinary_api_secret):
+        raise HTTPException(
+            status_code=status.HTTP_401_UNAUTHORIZED,
+            detail="Invalid Cloudinary signature.",
+        )
+
+    return raw_body

app/config.py

@@ -0,0 +1,36 @@
+from functools import lru_cache
+
+from pydantic import AnyHttpUrl, Field, PositiveInt, field_validator
+from pydantic_settings import BaseSettings, SettingsConfigDict
+
+
+class Settings(BaseSettings):
+    model_config = SettingsConfigDict(env_file=".env", env_file_encoding="utf-8", extra="ignore")
+
+    app_name: str
+    log_level: str
+    webhook_path: str
+
+    ai_pipeline_url: AnyHttpUrl
+    ai_pipeline_timeout_seconds: PositiveInt
+
+    supabase_url: AnyHttpUrl
+    supabase_service_role_key: str = Field(repr=False)
+    supabase_table: str
+
+    cloudinary_api_secret: str = Field(repr=False)
+    cloudinary_signature_required: bool
+    cloudinary_signature_tolerance_seconds: PositiveInt
+
+    @field_validator("webhook_path")
+    @classmethod
+    def normalize_webhook_path(cls, value: str) -> str:
+        value = value.strip()
+        if not value:
+            raise ValueError("WEBHOOK_PATH cannot be empty")
+        return value if value.startswith("/") else f"/{value}"
+
+
+@lru_cache
+def get_settings() -> Settings:
+    return Settings()

app/main.py

@@ -0,0 +1,50 @@
+import logging
+
+from fastapi import Depends, FastAPI, Request, status
+
+from app.cloudinary import enforce_cloudinary_signature
+from app.config import Settings, get_settings
+from app.models import HealthResponse, WebhookAcceptedResponse
+from app.services import PipelineClient, SupabaseClient
+from app.workflow import parse_cloudinary_payload, run_webhook_workflow
+
+
+def create_app() -> FastAPI:
+    settings = get_settings()
+    logging.basicConfig(level=settings.log_level.upper())
+
+    app = FastAPI(title=settings.app_name)
+
+    @app.get("/health", response_model=HealthResponse)
+    async def health(settings: Settings = Depends(get_settings)) -> HealthResponse:
+        return HealthResponse(status="ok", app=settings.app_name)
+
+    @app.post(
+        settings.webhook_path,
+        response_model=WebhookAcceptedResponse,
+        status_code=status.HTTP_202_ACCEPTED,
+    )
+    async def cloudinary_trigger(
+        request: Request,
+        settings: Settings = Depends(get_settings),
+    ) -> WebhookAcceptedResponse:
+        raw_body = await enforce_cloudinary_signature(request, settings)
+        parsed = parse_cloudinary_payload(raw_body)
+
+        if not parsed.id:
+            return WebhookAcceptedResponse(status="skipped", id=None)
+
+        pipeline_client = PipelineClient(settings)
+        supabase_client = SupabaseClient(settings)
+        await run_webhook_workflow(parsed, pipeline_client, supabase_client)
+
+        return WebhookAcceptedResponse(
+            status="complete",
+            id=parsed.id,
+            pipeline_url=settings.ai_pipeline_url,
+        )
+
+    return app
+
+
+app = create_app()

app/models.py

@@ -0,0 +1,53 @@
+from typing import Any
+
+from pydantic import BaseModel, ConfigDict, Field, HttpUrl
+
+
+class ParsedWebhookData(BaseModel):
+    id: str | None = None
+    latitude: float | None = None
+    longitude: float | None = None
+    description: str = ""
+    before_img_url: str = ""
+
+
+class PipelineRequest(BaseModel):
+    lan: float
+    lon: float
+    img_location: str
+
+
+class PipelineClassification(BaseModel):
+    model_config = ConfigDict(extra="allow")
+
+    condition: str
+
+
+class PipelineResponse(BaseModel):
+    model_config = ConfigDict(extra="allow")
+
+    classification: PipelineClassification
+    priority_score: float
+    max_impact: float
+
+
+class SupabaseUpdate(BaseModel):
+    destruct_class: str
+    location_score: float
+    total_score: float
+    status: str = "complete"
+
+
+class WebhookEnvelope(BaseModel):
+    body: dict[str, Any] = Field(default_factory=dict)
+
+
+class HealthResponse(BaseModel):
+    status: str
+    app: str
+
+
+class WebhookAcceptedResponse(BaseModel):
+    status: str
+    id: str | None = None
+    pipeline_url: HttpUrl | None = None

app/services.py

@@ -0,0 +1,120 @@
+from urllib.parse import quote, urlparse
+
+import httpx
+from fastapi import HTTPException, status
+
+from app.config import Settings
+from app.models import PipelineRequest, PipelineResponse, SupabaseUpdate
+
+
+class PipelineClient:
+    _image_field_names = ("image", "file", "img")
+
+    def __init__(self, settings: Settings) -> None:
+        self._base_url = str(settings.ai_pipeline_url).rstrip("/")
+        self._timeout = settings.ai_pipeline_timeout_seconds
+
+    async def process_url(self, payload: PipelineRequest) -> PipelineResponse:
+        async with httpx.AsyncClient(timeout=self._timeout) as client:
+            image = await self._download_image(client, payload.img_location)
+
+            try:
+                response = await self._post_process_form(client, payload, image)
+            except httpx.HTTPError as exc:
+                raise HTTPException(
+                    status_code=status.HTTP_502_BAD_GATEWAY,
+                    detail=f"AI pipeline request failed: {exc}",
+                ) from exc
+
+        return PipelineResponse.model_validate(response.json())
+
+    async def _download_image(self, client: httpx.AsyncClient, image_url: str) -> tuple[str, bytes, str]:
+        try:
+            response = await client.get(image_url, follow_redirects=True)
+            response.raise_for_status()
+        except httpx.HTTPError as exc:
+            raise HTTPException(
+                status_code=status.HTTP_502_BAD_GATEWAY,
+                detail=f"Failed to download Cloudinary image: {exc}",
+            ) from exc
+
+        content = response.content
+        if not content:
+            raise HTTPException(
+                status_code=status.HTTP_502_BAD_GATEWAY,
+                detail="Downloaded Cloudinary image is empty.",
+            )
+
+        content_type = response.headers.get("content-type", "application/octet-stream").split(";")[0]
+        filename = _filename_from_url(image_url)
+        return filename, content, content_type
+
+    async def _post_process_form(
+        self,
+        client: httpx.AsyncClient,
+        payload: PipelineRequest,
+        image: tuple[str, bytes, str],
+    ) -> httpx.Response:
+        last_response: httpx.Response | None = None
+        data = {
+            "lan": str(payload.lan),
+            "lon": str(payload.lon),
+        }
+
+        for field_name in self._image_field_names:
+            filename, content, content_type = image
+            files = {
+                field_name: (filename, content, content_type),
+            }
+            response = await client.post(f"{self._base_url}/process", data=data, files=files)
+            if response.status_code != 422:
+                response.raise_for_status()
+                return response
+
+            last_response = response
+
+        if last_response is not None:
+            last_response.raise_for_status()
+
+        raise HTTPException(
+            status_code=status.HTTP_502_BAD_GATEWAY,
+            detail="AI pipeline did not return a response.",
+        )
+
+
+def _filename_from_url(image_url: str) -> str:
+    path = urlparse(image_url).path
+    filename = path.rsplit("/", 1)[-1].strip()
+    return filename or "cloudinary-image.jpg"
+
+
+class SupabaseClient:
+    def __init__(self, settings: Settings) -> None:
+        if not settings.supabase_url or not settings.supabase_service_role_key:
+            raise HTTPException(
+                status_code=status.HTTP_500_INTERNAL_SERVER_ERROR,
+                detail="Supabase is not configured.",
+            )
+
+        self._base_url = str(settings.supabase_url).rstrip("/")
+        self._table = settings.supabase_table
+        self._headers = {
+            "apikey": settings.supabase_service_role_key,
+            "Authorization": f"Bearer {settings.supabase_service_role_key}",
+            "Content-Type": "application/json",
+            "Prefer": "return=minimal",
+        }
+
+    async def update_report(self, report_id: str, payload: SupabaseUpdate) -> None:
+        encoded_id = quote(report_id, safe="")
+        url = f"{self._base_url}/rest/v1/{self._table}?id=eq.{encoded_id}"
+
+        async with httpx.AsyncClient(timeout=30) as client:
+            try:
+                response = await client.patch(url, headers=self._headers, json=payload.model_dump())
+                response.raise_for_status()
+            except httpx.HTTPError as exc:
+                raise HTTPException(
+                    status_code=status.HTTP_502_BAD_GATEWAY,
+                    detail=f"Supabase update failed: {exc}",
+                ) from exc

app/workflow.py

@@ -0,0 +1,73 @@
+import json
+from typing import Any
+
+from fastapi import HTTPException, status
+
+from app.models import ParsedWebhookData, PipelineRequest, PipelineResponse, SupabaseUpdate
+from app.services import PipelineClient, SupabaseClient
+
+
+def parse_cloudinary_payload(raw_body: bytes) -> ParsedWebhookData:
+    try:
+        payload = json.loads(raw_body.decode("utf-8"))
+    except json.JSONDecodeError as exc:
+        raise HTTPException(
+            status_code=status.HTTP_400_BAD_REQUEST,
+            detail="Invalid JSON payload.",
+        ) from exc
+
+    body = payload.get("body", payload)
+    if not isinstance(body, dict):
+        body = {}
+
+    context = _as_dict(body.get("context"))
+    custom = _as_dict(context.get("custom"))
+
+    return ParsedWebhookData(
+        id=custom.get("Id") or None,
+        latitude=_to_float_or_none(custom.get("latitude")),
+        longitude=_to_float_or_none(custom.get("longitude")),
+        description=custom.get("description") or "",
+        before_img_url=body.get("secure_url") or "",
+    )
+
+
+async def run_webhook_workflow(
+    parsed: ParsedWebhookData,
+    pipeline_client: PipelineClient,
+    supabase_client: SupabaseClient,
+) -> PipelineResponse | None:
+    if not parsed.id:
+        return None
+
+    pipeline_response = await pipeline_client.process_url(
+        PipelineRequest(
+            lan=parsed.latitude,
+            lon=parsed.longitude,
+            img_location=parsed.before_img_url,
+        )
+    )
+
+    await supabase_client.update_report(
+        parsed.id,
+        SupabaseUpdate(
+            destruct_class=pipeline_response.classification.condition,
+            location_score=pipeline_response.priority_score,
+            total_score=pipeline_response.max_impact,
+        ),
+    )
+
+    return pipeline_response
+
+
+def _as_dict(value: Any) -> dict[str, Any]:
+    return value if isinstance(value, dict) else {}
+
+
+def _to_float_or_none(value: Any) -> float | None:
+    if value is None or value == "":
+        return None
+    try:
+        return float(value)
+    except (TypeError, ValueError):
+        return None

pyproject.toml

@@ -0,0 +1,22 @@
+[project]
+name = "gungfi-webhook-be"
+version = "0.1.0"
+description = "FastAPI backend for forwarding Cloudinary webhooks to the AI pipeline and Supabase."
+readme = "README.md"
+requires-python = ">=3.12"
+dependencies = [
+    "fastapi>=0.115.0",
+    "httpx>=0.27.0",
+    "pydantic-settings>=2.6.0",
+    "uvicorn[standard]>=0.30.0",
+]
+
+[dependency-groups]
+dev = [
+    "pytest>=8.3.0",
+    "respx>=0.21.1",
+]
+
+[tool.pytest.ini_options]
+testpaths = ["tests"]
+pythonpath = ["."]

scripts/upload_cloudinary_test.py

@@ -0,0 +1,72 @@
+import hashlib
+import os
+import sys
+import time
+from pathlib import Path
+
+import httpx
+from dotenv import load_dotenv
+
+
+def main() -> int:
+    load_dotenv()
+
+    image_path = Path(os.getenv("CLOUDINARY_TEST_IMAGE", "img/DSC06041.jpg"))
+    cloud_name = os.getenv("CLOUDINARY_CLOUD_NAME")
+    api_key = os.getenv("CLOUDINARY_API_KEY")
+    api_secret = os.getenv("CLOUDINARY_API_SECRET")
+    missing = [
+        name
+        for name, value in {
+            "CLOUDINARY_CLOUD_NAME": cloud_name,
+            "CLOUDINARY_API_KEY": api_key,
+            "CLOUDINARY_API_SECRET": api_secret,
+        }.items()
+        if not value
+    ]
+    if missing:
+        print(f"Missing env: {', '.join(missing)}", file=sys.stderr)
+        return 1
+
+    if not image_path.exists():
+        print(f"Image not found: {image_path}", file=sys.stderr)
+        return 1
+
+    timestamp = str(int(time.time()))
+    params: dict[str, str] = {
+        "api_key": api_key,
+        "context": "Id=test-fastapi-webhook|latitude=-6.200000|longitude=106.816666|description=fastapi webhook smoke test",
+        "timestamp": timestamp,
+    }
+
+    params["signature"] = sign_upload_params(params, api_secret)
+
+    url = f"https://api.cloudinary.com/v1_1/{cloud_name}/image/upload"
+    with image_path.open("rb") as image:
+        files = {"file": (image_path.name, image, "image/jpeg")}
+        response = httpx.post(url, data=params, files=files, timeout=120)
+
+    if response.is_error:
+        print(f"Cloudinary upload failed: HTTP {response.status_code}", file=sys.stderr)
+        print(response.text, file=sys.stderr)
+        return 1
+
+    data = response.json()
+    print("Upload OK")
+    print(f"public_id: {data.get('public_id')}")
+    print(f"secure_url: {data.get('secure_url')}")
+    return 0
+
+
+def sign_upload_params(params: dict[str, str], api_secret: str) -> str:
+    signable = {
+        key: value
+        for key, value in params.items()
+        if key not in {"api_key", "file", "resource_type", "cloud_name", "signature"} and value
+    }
+    payload = "&".join(f"{key}={signable[key]}" for key in sorted(signable))
+    return hashlib.sha1(f"{payload}{api_secret}".encode("utf-8")).hexdigest()
+
+
+if __name__ == "__main__":
+    raise SystemExit(main())

tests/test_workflow.py

@@ -0,0 +1,186 @@
+import hashlib
+import json
+import time
+
+import httpx
+import respx
+from fastapi.testclient import TestClient
+
+from app.cloudinary import verify_notification_signature
+from app.config import Settings, get_settings
+from app.main import create_app
+from app.models import ParsedWebhookData, PipelineRequest
+from app.services import PipelineClient
+from app.workflow import parse_cloudinary_payload
+
+
+def test_parse_cloudinary_payload_matches_n8n_template() -> None:
+    raw = json.dumps(
+        {
+            "body": {
+                "secure_url": "https://res.cloudinary.com/demo/image/upload/sample.jpg",
+                "context": {
+                    "custom": {
+                        "Id": "report-1",
+                        "latitude": "-6.2",
+                        "longitude": "106.8",
+                        "description": "jalan rusak",
+                    }
+                },
+            }
+        }
+    ).encode()
+
+    parsed = parse_cloudinary_payload(raw)
+
+    assert parsed.id == "report-1"
+    assert parsed.latitude == -6.2
+    assert parsed.longitude == 106.8
+    assert parsed.description == "jalan rusak"
+    assert parsed.before_img_url == "https://res.cloudinary.com/demo/image/upload/sample.jpg"
+
+
+def test_cloudinary_signature_verification_uses_raw_body_timestamp_and_secret() -> None:
+    raw_body = b'{"public_id":"sample"}'
+    timestamp = "1315060510"
+    secret = "abcd"
+    signature = hashlib.sha1(raw_body + timestamp.encode() + secret.encode()).hexdigest()
+
+    assert verify_notification_signature(raw_body, signature, timestamp, secret)
+
+
+def test_webhook_skips_missing_id_without_external_calls() -> None:
+    app = create_app()
+    app.dependency_overrides[get_settings] = lambda: Settings(
+        app_name="gungfi-webhook-be",
+        log_level="INFO",
+        webhook_path="/cloudinary-trigger",
+        ai_pipeline_url="https://pipeline.example.com",
+        ai_pipeline_timeout_seconds=60,
+        cloudinary_api_secret="secret",
+        cloudinary_signature_required=True,
+        cloudinary_signature_tolerance_seconds=7200,
+        supabase_url="https://example.supabase.co",
+        supabase_service_role_key="service-role",
+        supabase_table="reports",
+    )
+    client = TestClient(app)
+    body = json.dumps({"body": {"context": {"custom": {}}, "secure_url": ""}}, separators=(",", ":")).encode()
+    timestamp = str(int(time.time()))
+    signature = hashlib.sha1(body + timestamp.encode() + b"secret").hexdigest()
+
+    response = client.post(
+        "/cloudinary-trigger",
+        content=body,
+        headers={
+            "content-type": "application/json",
+            "x-cld-signature": signature,
+            "x-cld-timestamp": timestamp,
+        },
+    )
+
+    assert response.status_code == 202
+    assert response.json() == {"status": "skipped", "id": None, "pipeline_url": None}
+
+
+def test_webhook_workflow_sends_process_payload() -> None:
+    from app.workflow import run_webhook_workflow
+
+    class FakePipelineClient:
+        payload = None
+
+        async def process_url(self, payload):
+            self.payload = payload
+            return type(
+                "PipelineResponse",
+                (),
+                {
+                    "classification": type("Classification", (), {"condition": "rusak"})(),
+                    "priority_score": 0.8,
+                    "max_impact": 0.9,
+                },
+            )()
+
+    class FakeSupabaseClient:
+        async def update_report(self, report_id, payload):
+            self.report_id = report_id
+            self.payload = payload
+
+    pipeline_client = FakePipelineClient()
+    supabase_client = FakeSupabaseClient()
+
+    import anyio
+
+    anyio.run(
+        run_webhook_workflow,
+        ParsedWebhookData(
+            id="report-1",
+            latitude=-6.2,
+            longitude=106.8,
+            before_img_url="https://res.cloudinary.com/demo/image/upload/sample.jpg",
+        ),
+        pipeline_client,
+        supabase_client,
+    )
+
+    assert pipeline_client.payload.model_dump() == {
+        "lan": -6.2,
+        "lon": 106.8,
+        "img_location": "https://res.cloudinary.com/demo/image/upload/sample.jpg",
+    }
+
+
+@respx.mock
+def test_pipeline_client_downloads_image_and_posts_multipart_to_process() -> None:
+    settings = Settings(
+        app_name="gungfi-webhook-be",
+        log_level="INFO",
+        webhook_path="/cloudinary-trigger",
+        ai_pipeline_url="https://pipeline.example.com",
+        ai_pipeline_timeout_seconds=60,
+        cloudinary_api_secret="secret",
+        cloudinary_signature_required=True,
+        cloudinary_signature_tolerance_seconds=7200,
+        supabase_url="https://example.supabase.co",
+        supabase_service_role_key="service-role",
+        supabase_table="reports",
+    )
+    image_route = respx.get("https://res.cloudinary.com/demo/image/upload/sample.jpg").mock(
+        return_value=httpx.Response(200, content=b"fake-image-bytes", headers={"content-type": "image/jpeg"})
+    )
+
+    def handle_process_request(request: httpx.Request) -> httpx.Response:
+        body = request.content
+        assert "multipart/form-data" in request.headers["content-type"]
+        assert b'name="lan"' in body
+        assert b"-6.2" in body
+        assert b'name="lon"' in body
+        assert b"106.8" in body
+        assert b'name="image"; filename="sample.jpg"' in body
+        assert b"fake-image-bytes" in body
+        return httpx.Response(
+            200,
+            json={
+                "classification": {"condition": "rusak", "confidence": 0.9, "probabilities": {}},
+                "priority_score": 0.8,
+                "max_impact": 0.9,
+            },
+        )
+
+    route = respx.post("https://pipeline.example.com/process").mock(
+        side_effect=handle_process_request,
+    )
+
+    import anyio
+
+    anyio.run(
+        PipelineClient(settings).process_url,
+        PipelineRequest(
+            lan=-6.2,
+            lon=106.8,
+            img_location="https://res.cloudinary.com/demo/image/upload/sample.jpg",
+        ),
+    )
+
+    assert image_route.called
+    assert route.called