From fedb782b693d2b86de1ffc000b2f1edcb8f8ee86 Mon Sep 17 00:00:00 2001
From: NguyenND <ngodanguyen@gmail.com>
Date: Fri, 26 Jun 2026 13:48:47 -0400
Subject: [PATCH] Jun 26 - Update AI Analysis History viewable for every user,
 removable only for Admin

---
 routes/ai_summary.py      | 13 ++++---------
 templates/ai_summary.html | 12 ++++++++----
 2 files changed, 12 insertions(+), 13 deletions(-)

diff --git a/routes/ai_summary.py b/routes/ai_summary.py
index 2051517..f296076 100644
--- a/routes/ai_summary.py
+++ b/routes/ai_summary.py
@@ -35,9 +35,7 @@ SUPPORTED_EXT = {".txt", ".md", ".csv", ".pdf", ".doc", ".docx", ".xlsx", ".xls"
 def ai_summary():
     user       = session["user"]
     criteria   = get_all_criteria()
-    history    = get_ai_analysis_history(
-        user_id=(None if user["role"] == "admin" else user["id"])
-    )
+    history    = get_ai_analysis_history(user_id=None)
     groq_key   = get_setting("groq.api_key", "")
     groq_model = get_setting("groq.model", GROQ_MODELS[0])
     return render_template("ai_summary.html",
@@ -366,9 +364,6 @@ def analysis_detail(analysis_id):
     record = get_ai_analysis_detail(analysis_id)
     if not record:
         return jsonify({"error": "Not found"}), 404
-    user = session["user"]
-    if user["role"] != "admin" and record["user_id"] != user["id"]:
-        return jsonify({"error": "Access denied"}), 403
     return jsonify({
         "id":                record["id"],
         "username":          record.get("username"),
@@ -384,12 +379,12 @@ def analysis_detail(analysis_id):
 @ai_summary_bp.route("/history/<int:analysis_id>/delete", methods=["POST"])
 @login_required
 def delete_analysis(analysis_id):
+    user = session["user"]
+    if user["role"] != "admin":
+        return jsonify({"error": "Access denied"}), 403
     record = get_ai_analysis_detail(analysis_id)
     if not record:
         return jsonify({"error": "Not found"}), 404
-    user = session["user"]
-    if user["role"] != "admin" and record["user_id"] != user["id"]:
-        return jsonify({"error": "Access denied"}), 403
     delete_ai_analysis(analysis_id)
     log_action(user["id"], "DELETE_AI_ANALYSIS", "ai_analysis_log", analysis_id,
                f"Deleted AI analysis id={analysis_id}.")
diff --git a/templates/ai_summary.html b/templates/ai_summary.html
index 2073920..b1f62c3 100644
--- a/templates/ai_summary.html
+++ b/templates/ai_summary.html
@@ -128,7 +128,7 @@
           <thead>
             <tr>
               <th>Date</th>
-              {% if is_admin %}<th>User</th>{% endif %}
+              <th>User</th>
               <th>Files</th>
               <th>Verdict</th>
             </tr>
@@ -137,7 +137,7 @@
             {% for h in history %}
             <tr class="history-row" data-id="{{ h.id }}" style="cursor:pointer" title="Click to view result">
               <td class="nowrap text-muted">{{ h.analyzed_at.strftime('%Y-%m-%d %H:%M') if h.analyzed_at else '—' }}</td>
-              {% if is_admin %}<td class="text-muted">{{ h.username or '—' }}</td>{% endif %}
+              <td class="text-muted">{{ h.username or '—' }}</td>
               <td class="text-muted">{{ h.file_names[:50] }}{% if h.file_names|length > 50 %}…{% endif %}</td>
               <td>
                 {% if h.verdict %}
@@ -148,7 +148,7 @@
               </td>
             </tr>
             {% else %}
-            <tr><td colspan="{{ 5 if is_admin else 4 }}" style="padding:2.5rem 1rem;text-align:center">
+            <tr><td colspan="4" style="padding:2.5rem 1rem;text-align:center">
               <div style="font-size:2rem;margin-bottom:.5rem">🤖</div>
               <p class="text-muted" style="margin:0 0 .75rem">No analyses yet. Upload a document above to get started.</p>
               <button class="btn btn-primary btn-sm" onclick="document.getElementById('ai-files').scrollIntoView({behavior:'smooth'});document.getElementById('ai-files').focus()">Start Analyzing</button>
@@ -256,6 +256,8 @@
 <script src="https://cdnjs.cloudflare.com/ajax/libs/marked/9.1.6/marked.min.js"></script>
 
 <script>
+var IS_ADMIN = {{ 'true' if is_admin else 'false' }};
+
 /* ─── Markdown renderer config ──────────────────────────────── */
 marked.setOptions({ breaks: true, gfm: true });
 
@@ -483,7 +485,9 @@ document.querySelectorAll('.history-row').forEach(function(row) {
 
         document.getElementById('hist-body').innerHTML =
           renderAI(d.summary_text || '');
-        document.getElementById('btn-delete-analysis').style.display = '';
+        if (IS_ADMIN) {
+          document.getElementById('btn-delete-analysis').style.display = '';
+        }
       })
       .catch(function() {
         document.getElementById('hist-body').textContent = 'Failed to load analysis.';