kinemotion 0.60.0__tar.gz → 0.61.0__tar.gz

{kinemotion-0.60.0 → kinemotion-0.61.0}/.github/workflows/deploy-backend.yml

@@ -134,7 +134,7 @@ jobs:
             --allow-unauthenticated
             --service-account=kinemotion-backend-runtime@${{ env.GCP_PROJECT_ID }}.iam.gserviceaccount.com
             --set-env-vars=CORS_ORIGINS=https://kinemotion.vercel.app,JSON_LOGS=true,LOG_LEVEL=INFO
-            --set-secrets=SUPABASE_URL=SUPABASE_URL:latest,SUPABASE_ANON_KEY=SUPABASE_ANON_KEY:latest,R2_ENDPOINT=R2_ENDPOINT:latest,R2_ACCESS_KEY=R2_ACCESS_KEY:latest,R2_SECRET_KEY=R2_SECRET_KEY:latest,R2_BUCKET_NAME=R2_BUCKET_NAME:latest
+            --set-secrets=SUPABASE_URL=SUPABASE_URL:latest,SUPABASE_PUBLISHABLE_KEY=SUPABASE_PUBLISHABLE_KEY:latest,SUPABASE_SECRET_KEY=SUPABASE_SECRET_KEY:latest,R2_ENDPOINT=R2_ENDPOINT:latest,R2_ACCESS_KEY=R2_ACCESS_KEY:latest,R2_SECRET_KEY=R2_SECRET_KEY:latest,R2_BUCKET_NAME=R2_BUCKET_NAME:latest
 
       - name: Verify deployment health
         run: |

{kinemotion-0.60.0 → kinemotion-0.61.0}/CHANGELOG.md

@@ -7,6 +7,19 @@ and this project adheres to [Semantic Versioning](https://semver.org/spec/v2.0.0
 
 <!-- version list -->
 
+## kinemotion-v0.61.0 (2025-12-15)
+
+### Feat
+
+- update Supabase integration to use modern API keys
+- update frontend to use modern Supabase publishable key
+
+## kinemotion-v0.60.1 (2025-12-15)
+
+### Fix
+
+- prevent auth_duration_ms from polluting non-auth logs
+
 ## kinemotion-v0.60.0 (2025-12-15)
 
 ### Feat

{kinemotion-0.60.0 → kinemotion-0.61.0}/PKG-INFO

@@ -1,6 +1,6 @@
 Metadata-Version: 2.4
 Name: kinemotion
-Version: 0.60.0
+Version: 0.61.0
 Summary: Video-based kinematic analysis for athletic performance
 Project-URL: Homepage, https://github.com/feniix/kinemotion
 Project-URL: Repository, https://github.com/feniix/kinemotion

{kinemotion-0.60.0 → kinemotion-0.61.0}/backend/pyproject.toml

@@ -80,7 +80,7 @@ filterwarnings = [
 ]
 
 [tool.ruff]
-line-length = 88
+line-length = 99
 target-version = "py310"
 
 [tool.ruff.lint]

{kinemotion-0.60.0 → kinemotion-0.61.0}/backend/src/kinemotion_backend/analysis_api.py

@@ -118,9 +118,7 @@ async def get_user_analysis_sessions(
             )
 
         db_client = get_database_client()
-        sessions = await db_client.get_user_analysis_sessions(
-            user_id=user_id, limit=limit
-        )
+        sessions = await db_client.get_user_analysis_sessions(user_id=user_id, limit=limit)
 
         logger.info(
             "user_analysis_sessions_api_retrieved",
@@ -164,9 +162,7 @@ async def get_analysis_session(
     """
     try:
         db_client = get_database_client()
-        session = await db_client.get_analysis_session(
-            session_id=session_id, user_id=user_id
-        )
+        session = await db_client.get_analysis_session(session_id=session_id, user_id=user_id)
 
         if not session:
             raise HTTPException(
@@ -185,9 +181,7 @@ async def get_analysis_session(
         )
 
         session_with_feedback = AnalysisSessionWithFeedback(**session)
-        session_with_feedback.feedback = [
-            CoachFeedbackResponse(**fb) for fb in feedback
-        ]
+        session_with_feedback.feedback = [CoachFeedbackResponse(**fb) for fb in feedback]
 
         return session_with_feedback
 

{kinemotion-0.60.0 → kinemotion-0.61.0}/backend/src/kinemotion_backend/app/config.py

@@ -31,9 +31,7 @@ class Settings:
     R2_SECRET_KEY: str = os.getenv("R2_SECRET_KEY", "")
     R2_BUCKET_NAME: str = os.getenv("R2_BUCKET_NAME", "kinemotion")
     R2_PUBLIC_BASE_URL: str = os.getenv("R2_PUBLIC_BASE_URL", "").rstrip("/")
-    R2_PRESIGN_EXPIRATION_S: int = int(
-        os.getenv("R2_PRESIGN_EXPIRATION_S", "604800")
-    )  # 7 days
+    R2_PRESIGN_EXPIRATION_S: int = int(os.getenv("R2_PRESIGN_EXPIRATION_S", "604800"))  # 7 days
 
     # Security settings
     TESTING: bool = os.getenv("TESTING", "").lower() == "true"

{kinemotion-0.60.0 → kinemotion-0.61.0}/backend/src/kinemotion_backend/app/main.py

@@ -114,18 +114,14 @@ def _add_exception_handlers(app: FastAPI) -> None:
     from fastapi import HTTPException, Request
     from fastapi.responses import JSONResponse
 
-    async def http_exception_handler(
-        request: Request, exc: HTTPException
-    ) -> JSONResponse:
+    async def http_exception_handler(request: Request, exc: HTTPException) -> JSONResponse:
         """Handle HTTP exceptions."""
         return JSONResponse(
             status_code=exc.status_code,
             content={"message": exc.detail},
         )
 
-    async def general_exception_handler(
-        request: Request, exc: Exception
-    ) -> JSONResponse:
+    async def general_exception_handler(request: Request, exc: Exception) -> JSONResponse:
         """Handle general exceptions."""
         logger.error(f"Unhandled exception: {exc}", exc_info=True)
         return JSONResponse(

{kinemotion-0.60.0 → kinemotion-0.61.0}/backend/src/kinemotion_backend/app.py

@@ -118,9 +118,7 @@ class R2StorageClient:
         self.public_base_url = (os.getenv("R2_PUBLIC_BASE_URL") or "").rstrip("/")
         # Fallback: presigned URL expiration seconds (default 7 days, S3 max)
         try:
-            self.presign_expiration_s = int(
-                os.getenv("R2_PRESIGN_EXPIRATION_S") or "604800"
-            )
+            self.presign_expiration_s = int(os.getenv("R2_PRESIGN_EXPIRATION_S") or "604800")
         except ValueError:
             self.presign_expiration_s = 604800
 
@@ -171,9 +169,7 @@ class R2StorageClient:
         normalized_key = key.lstrip("/")
         if self.public_base_url:
             return f"{self.public_base_url}/{normalized_key}"
-        return self.generate_presigned_url(
-            normalized_key, expiration=self.presign_expiration_s
-        )
+        return self.generate_presigned_url(normalized_key, expiration=self.presign_expiration_s)
 
     def upload_file(self, local_path: str, remote_key: str) -> str:
         """Upload file to R2 storage.
@@ -386,8 +382,7 @@ def _validate_video_file(file: UploadFile) -> None:
     file_ext = Path(file.filename).suffix.lower()
     if file_ext not in valid_extensions:
         raise ValueError(
-            f"Invalid video format: {file_ext}. "
-            f"Supported formats: {', '.join(valid_extensions)}"
+            f"Invalid video format: {file_ext}. Supported formats: {', '.join(valid_extensions)}"
         )
 
     # Check file size (max 500MB for practical limits)
@@ -650,9 +645,7 @@ async def analyze_video(
             upload_start = time.time()
             r2_video_key = f"videos/{jump_type}/{upload_id}{upload_suffix}"
             try:
-                original_video_url = r2_client.upload_file(
-                    temp_video_path, r2_video_key
-                )
+                original_video_url = r2_client.upload_file(temp_video_path, r2_video_key)
                 upload_duration = time.time() - upload_start
                 logger.info(
                     "timing_r2_input_video_upload",
@@ -700,8 +693,7 @@ async def analyze_video(
             timing_breakdown = metrics["metadata"]["processing"]["timing_breakdown_ms"]
             # Normalize keys: remove special chars, spaces → underscores, lowercase
             normalized_timings = {
-                re.sub(r"[^\w\s]", "", stage).lower().replace(" ", "_")
-                + "_ms": duration
+                re.sub(r"[^\w\s]", "", stage).lower().replace(" ", "_") + "_ms": duration
                 for stage, duration in timing_breakdown.items()
             }
             # Log each timing stage as a separate event for granular monitoring
@@ -728,9 +720,7 @@ async def analyze_video(
             try:
                 results_upload_start = time.time()
                 results_json = json.dumps(metrics, indent=2)
-                results_url = r2_client.put_object(
-                    r2_results_key, results_json.encode()
-                )
+                results_url = r2_client.put_object(r2_results_key, results_json.encode())
                 results_upload_duration = time.time() - results_upload_start
                 logger.info(
                     "timing_r2_results_upload",
@@ -740,9 +730,7 @@ async def analyze_video(
                 )
             except OSError as e:
                 # Log error but don't fail - results still available in response
-                logger.warning(
-                    "r2_results_upload_failed", error=str(e), key=r2_results_key
-                )
+                logger.warning("r2_results_upload_failed", error=str(e), key=r2_results_key)
 
             # Upload Debug Video if it was created
             if (
@@ -892,9 +880,7 @@ async def analyze_video(
                 Path(temp_video_path).unlink()
                 logger.debug("temp_file_cleaned", path=temp_video_path)
             except OSError as e:
-                logger.warning(
-                    "temp_file_cleanup_failed", path=temp_video_path, error=str(e)
-                )
+                logger.warning("temp_file_cleanup_failed", path=temp_video_path, error=str(e))
 
         # Clean up temporary debug video file
         if temp_debug_video_path and Path(temp_debug_video_path).exists():

{kinemotion-0.60.0 → kinemotion-0.61.0}/backend/src/kinemotion_backend/auth.py

@@ -110,9 +110,7 @@ class SupabaseAuth:
         # Fallback: Verify via Supabase Auth server (works for all projects)
         return self._verify_via_auth_server(token, start_time)
 
-    def _verify_via_auth_server(
-        self, token: str, overall_start_time: float
-    ) -> dict[str, Any]:
+    def _verify_via_auth_server(self, token: str, overall_start_time: float) -> dict[str, Any]:
         """Verify token by calling Supabase Auth server.
 
         This is the recommended fallback for HS256 tokens per Supabase docs.

{kinemotion-0.60.0 → kinemotion-0.61.0}/backend/src/kinemotion_backend/database.py

@@ -15,13 +15,24 @@ class DatabaseClient:
     def __init__(self) -> None:
         """Initialize Supabase client."""
         self.supabase_url = os.getenv("SUPABASE_URL", "")
-        self.supabase_key = os.getenv("SUPABASE_ANON_KEY", "")
+
+        # Prefer modern keys, fall back to legacy for compatibility
+        self.supabase_key = (
+            os.getenv("SUPABASE_PUBLISHABLE_KEY")
+            or os.getenv("SUPABASE_SECRET_KEY")
+            or os.getenv("SUPABASE_ANON_KEY")
+            or os.getenv("SUPABASE_KEY")
+        )
 
         if not self.supabase_url:
             raise ValueError("SUPABASE_URL must be set")
 
         if not self.supabase_key:
-            raise ValueError("SUPABASE_ANON_KEY must be set")
+            raise ValueError(
+                "No Supabase API key found. Set one of: "
+                "SUPABASE_PUBLISHABLE_KEY, SUPABASE_SECRET_KEY, "
+                "SUPABASE_ANON_KEY, or SUPABASE_KEY"
+            )
 
         self.client: Client = create_client(self.supabase_url, self.supabase_key)
         logger.info("database_client_initialized", supabase_url=self.supabase_url)
@@ -70,9 +81,7 @@ class DatabaseClient:
                 "upload_id": upload_id,
             }
 
-            response = (
-                self.client.table("analysis_sessions").insert(session_data).execute()
-            )
+            response = self.client.table("analysis_sessions").insert(session_data).execute()
 
             if response.data:
                 session_data = response.data[0]
@@ -140,9 +149,7 @@ class DatabaseClient:
             )
             raise
 
-    async def get_analysis_session(
-        self, session_id: str, user_id: str
-    ) -> dict[str, Any] | None:
+    async def get_analysis_session(self, session_id: str, user_id: str) -> dict[str, Any] | None:
         """Get a specific analysis session.
 
         Args:
@@ -160,9 +167,7 @@ class DatabaseClient:
                 self.client.table("analysis_sessions")
                 .select("*")
                 .eq("id", session_id)
-                .eq(
-                    "user_id", user_id
-                )  # Ensure user can only access their own sessions
+                .eq("user_id", user_id)  # Ensure user can only access their own sessions
                 .single()
                 .execute()
             )
@@ -217,9 +222,7 @@ class DatabaseClient:
                 "tags": tags or [],
             }
 
-            response = (
-                self.client.table("coach_feedback").insert(feedback_data).execute()
-            )
+            response = self.client.table("coach_feedback").insert(feedback_data).execute()
 
             if response.data:
                 feedback_data = response.data[0]
@@ -246,9 +249,7 @@ class DatabaseClient:
             )
             raise
 
-    async def get_session_feedback(
-        self, analysis_session_id: str
-    ) -> list[dict[str, Any]]:
+    async def get_session_feedback(self, analysis_session_id: str) -> list[dict[str, Any]]:
         """Get all feedback for an analysis session.
 
         Args:

{kinemotion-0.60.0 → kinemotion-0.61.0}/backend/src/kinemotion_backend/middleware.py

@@ -19,9 +19,7 @@ try:
     supabase_auth = SupabaseAuth()
     logger.info("supabase_auth_initialized")
 except ValueError:
-    logger.warning(
-        "supabase_auth_not_configured", message="Supabase credentials not provided"
-    )
+    logger.warning("supabase_auth_not_configured", message="Supabase credentials not provided")
 
 
 class RequestLoggingMiddleware(BaseHTTPMiddleware):
@@ -62,11 +60,10 @@ class RequestLoggingMiddleware(BaseHTTPMiddleware):
                 user_email = supabase_auth.get_user_email(token)
                 auth_duration_ms = (time.time() - auth_start) * 1000
 
-                # Bind user info to logging context
+                # Bind user info to logging context (auth_duration_ms only in auth event)
                 structlog.contextvars.bind_contextvars(
                     user_id=user_id,
                     user_email=user_email,
-                    auth_duration_ms=round(auth_duration_ms, 2),
                 )
 
                 # Store in request state for use in endpoints
@@ -75,8 +72,6 @@ class RequestLoggingMiddleware(BaseHTTPMiddleware):
 
                 logger.info(
                     "user_authenticated",
-                    user_id=user_id,
-                    email=user_email,
                     auth_duration_ms=round(auth_duration_ms, 2),
                 )
             except Exception as e:

{kinemotion-0.60.0 → kinemotion-0.61.0}/backend/src/kinemotion_backend/models/database.py

@@ -14,15 +14,11 @@ class AnalysisSessionCreate(BaseModel):
     quality_preset: str = Field(
         ..., description="Analysis quality: 'fast', 'balanced', or 'accurate'"
     )
-    original_video_url: str | None = Field(
-        None, description="R2 URL for original video"
-    )
+    original_video_url: str | None = Field(None, description="R2 URL for original video")
     debug_video_url: str | None = Field(None, description="R2 URL for debug video")
     results_json_url: str | None = Field(None, description="R2 URL for results JSON")
     analysis_data: dict[str, Any] = Field(..., description="Analysis results as JSON")
-    processing_time_s: float | None = Field(
-        None, description="Processing time in seconds"
-    )
+    processing_time_s: float | None = Field(None, description="Processing time in seconds")
     upload_id: str | None = Field(None, description="Upload ID from analysis system")
 
     @field_validator("jump_type")
@@ -65,9 +61,7 @@ class CoachFeedbackCreate(BaseModel):
     analysis_session_id: UUID = Field(..., description="ID of the analysis session")
     notes: str | None = Field(None, description="Coach notes about the analysis")
     rating: int | None = Field(None, ge=1, le=5, description="Rating from 1-5")
-    tags: list[str] = Field(
-        default_factory=list, description="Tags for categorizing feedback"
-    )
+    tags: list[str] = Field(default_factory=list, description="Tags for categorizing feedback")
 
     @field_validator("rating")
     @classmethod

{kinemotion-0.60.0 → kinemotion-0.61.0}/backend/src/kinemotion_backend/models/responses.py

@@ -14,9 +14,7 @@ class ValidationIssue(BaseModel):
 class ValidationResults(BaseModel):
     """Validation results from analysis."""
 
-    status: str = Field(
-        ..., description="Status: PASS, FAIL, WARNING, or PASS_WITH_WARNINGS"
-    )
+    status: str = Field(..., description="Status: PASS, FAIL, WARNING, or PASS_WITH_WARNINGS")
     issues: list[ValidationIssue] = Field(
         default_factory=list, description="List of validation issues"
     )
@@ -26,9 +24,7 @@ class MetricsData(BaseModel):
     """Analysis metrics with optional metadata and validation."""
 
     data: dict[str, Any] | None = Field(None, description="Actual metric values")
-    metadata: dict[str, Any] | None = Field(
-        None, description="Metric metadata and descriptions"
-    )
+    metadata: dict[str, Any] | None = Field(None, description="Metric metadata and descriptions")
     validation: ValidationResults | None = Field(
         None, description="Validation results for metrics"
     )

{kinemotion-0.60.0 → kinemotion-0.61.0}/backend/src/kinemotion_backend/models/storage.py

@@ -21,9 +21,7 @@ class R2StorageClient:
         self.public_base_url = (os.getenv("R2_PUBLIC_BASE_URL") or "").rstrip("/")
         # Fallback: presigned URL expiration seconds (default 7 days, S3 max)
         try:
-            self.presign_expiration_s = int(
-                os.getenv("R2_PRESIGN_EXPIRATION_S") or "604800"
-            )
+            self.presign_expiration_s = int(os.getenv("R2_PRESIGN_EXPIRATION_S") or "604800")
         except ValueError:
             self.presign_expiration_s = 604800
 
@@ -74,9 +72,7 @@ class R2StorageClient:
         normalized_key = key.lstrip("/")
         if self.public_base_url:
             return f"{self.public_base_url}/{normalized_key}"
-        return self.generate_presigned_url(
-            normalized_key, expiration=self.presign_expiration_s
-        )
+        return self.generate_presigned_url(normalized_key, expiration=self.presign_expiration_s)
 
     def upload_file(self, local_path: str, remote_key: str) -> str:
         """Upload file to R2 storage.

kinemotion-0.61.0/backend/src/kinemotion_backend/routes/health.py

@@ -0,0 +1,53 @@
+"""Health check routes for kinemotion backend."""
+
+import os
+from datetime import datetime, timezone
+from importlib.metadata import version
+
+import structlog
+from fastapi import APIRouter
+
+logger = structlog.get_logger()
+router = APIRouter(tags=["Health"])
+
+
+@router.get("/health")
+async def health_check() -> dict[str, str | bool]:
+    """Health check endpoint.
+
+    Returns:
+        Dict with health status information
+    """
+    # Check R2 configuration
+    r2_configured = bool(
+        os.getenv("R2_ENDPOINT") and os.getenv("R2_ACCESS_KEY") and os.getenv("R2_SECRET_KEY")
+    )
+
+    # Get kinemotion version safely
+    try:
+        kinemotion_version = version("kinemotion")
+    except Exception:
+        kinemotion_version = "unknown"
+
+    # Check database connection
+    database_connected = False
+    try:
+        from kinemotion_backend.database import get_database_client
+
+        db_client = get_database_client()
+        # Test database with a simple query
+        db_client.client.table("analysis_sessions").select("id").limit(1).execute()
+        database_connected = True
+    except Exception as db_error:
+        logger.warning("database_health_check_failed", error=str(db_error))
+
+    return {
+        "status": "healthy",
+        "service": "kinemotion-backend",
+        "version": "0.1.0",
+        "environment": os.getenv("ENVIRONMENT", "development"),
+        "kinemotion_version": kinemotion_version,
+        "timestamp": datetime.now(timezone.utc).isoformat(),
+        "r2_configured": r2_configured,
+        "database_connected": database_connected,
+    }

{kinemotion-0.60.0 → kinemotion-0.61.0}/backend/src/kinemotion_backend/services/analysis_service.py

@@ -110,9 +110,7 @@ class AnalysisService:
                 temp_debug = tempfile.NamedTemporaryFile(suffix=".mp4", delete=False)
                 temp_debug_video_path = temp_debug.name
                 temp_debug.close()
-                logger.info(
-                    "debug_video_path_created", debug_video_path=temp_debug_video_path
-                )
+                logger.info("debug_video_path_created", debug_video_path=temp_debug_video_path)
 
             # Process video with detailed timing
             logger.info("video_processing_started")

{kinemotion-0.60.0 → kinemotion-0.61.0}/backend/src/kinemotion_backend/services/storage_service.py

@@ -24,9 +24,7 @@ class StorageService:
         """
         return self.client.upload_file(local_path, remote_key)
 
-    async def upload_analysis_results(
-        self, results: dict[str, Any], remote_key: str
-    ) -> str:
+    async def upload_analysis_results(self, results: dict[str, Any], remote_key: str) -> str:
         """Upload analysis results as JSON to R2 storage.
 
         Args:
@@ -41,9 +39,7 @@ class StorageService:
         results_json = json.dumps(results, indent=2).encode("utf-8")
         return self.client.put_object(remote_key, results_json)
 
-    async def generate_unique_key(
-        self, filename: str, user_id: str | None = None
-    ) -> str:
+    async def generate_unique_key(self, filename: str, user_id: str | None = None) -> str:
         """Generate unique storage key for uploaded file.
 
         Args:

{kinemotion-0.60.0 → kinemotion-0.61.0}/backend/src/kinemotion_backend/services/validation.py

@@ -21,8 +21,7 @@ def validate_video_file(file: UploadFile) -> None:
     file_ext = Path(file.filename).suffix.lower()
     if file_ext not in valid_extensions:
         raise ValueError(
-            f"Invalid video format: {file_ext}. "
-            f"Supported formats: {', '.join(valid_extensions)}"
+            f"Invalid video format: {file_ext}. Supported formats: {', '.join(valid_extensions)}"
         )
 
     # Check file size if available (UploadFile.size is often None in test client)

kinemotion-0.61.0/backend/supabase-schema.sql

@@ -0,0 +1,70 @@
+
+-- Enable required extensions
+CREATE EXTENSION IF NOT EXISTS "uuid-ossp";
+
+-- Analysis Sessions Table
+CREATE TABLE IF NOT EXISTS analysis_sessions (
+    id UUID PRIMARY KEY DEFAULT uuid_generate_v4(),
+    user_id UUID NOT NULL REFERENCES auth.users(id) ON DELETE CASCADE,
+    jump_type VARCHAR(50) NOT NULL CHECK (jump_type IN ('cmj', 'drop_jump')),
+    quality_preset VARCHAR(20) NOT NULL CHECK (quality_preset IN ('fast', 'balanced', 'accurate')),
+    original_video_url TEXT,
+    debug_video_url TEXT,
+    results_json_url TEXT,
+    analysis_data JSONB NOT NULL,
+    processing_time_s FLOAT,
+    upload_id VARCHAR(50),
+    created_at TIMESTAMP WITH TIME ZONE DEFAULT NOW(),
+    updated_at TIMESTAMP WITH TIME ZONE DEFAULT NOW()
+);
+
+-- Coach Feedback Table
+CREATE TABLE IF NOT EXISTS coach_feedback (
+    id UUID PRIMARY KEY DEFAULT uuid_generate_v4(),
+    analysis_session_id UUID NOT NULL REFERENCES analysis_sessions(id) ON DELETE CASCADE,
+    coach_user_id UUID NOT NULL REFERENCES auth.users(id) ON DELETE CASCADE,
+    notes TEXT,
+    rating INTEGER CHECK (rating >= 1 AND rating <= 5),
+    tags TEXT[] DEFAULT '{}',
+    created_at TIMESTAMP WITH TIME ZONE DEFAULT NOW(),
+    updated_at TIMESTAMP WITH TIME ZONE DEFAULT NOW()
+);
+
+-- Create indexes for performance
+CREATE INDEX IF NOT EXISTS idx_analysis_sessions_user_id ON analysis_sessions(user_id);
+CREATE INDEX IF NOT EXISTS idx_analysis_sessions_created_at ON analysis_sessions(created_at DESC);
+CREATE INDEX IF NOT EXISTS idx_coach_feedback_analysis_session_id ON coach_feedback(analysis_session_id);
+CREATE INDEX IF NOT EXISTS idx_coach_feedback_coach_user_id ON coach_feedback(coach_user_id);
+
+-- Enable Row Level Security
+ALTER TABLE analysis_sessions ENABLE ROW LEVEL SECURITY;
+ALTER TABLE coach_feedback ENABLE ROW LEVEL SECURITY;
+
+-- RLS Policy: Users can only see their own analysis sessions
+CREATE POLICY "users_can_read_own_sessions" ON analysis_sessions
+    FOR SELECT
+    USING (auth.uid() = user_id);
+
+CREATE POLICY "users_can_create_own_sessions" ON analysis_sessions
+    FOR INSERT
+    WITH CHECK (auth.uid() = user_id);
+
+-- RLS Policy: Coaches can read feedback for their own analyses or sessions they're coaching
+CREATE POLICY "coaches_can_read_feedback" ON coach_feedback
+    FOR SELECT
+    USING (
+        auth.uid() = coach_user_id OR
+        auth.uid() IN (
+            SELECT user_id FROM analysis_sessions
+            WHERE id = coach_feedback.analysis_session_id
+        )
+    );
+
+CREATE POLICY "coaches_can_create_feedback" ON coach_feedback
+    FOR INSERT
+    WITH CHECK (auth.uid() = coach_user_id);
+
+CREATE POLICY "coaches_can_update_own_feedback" ON coach_feedback
+    FOR UPDATE
+    USING (auth.uid() = coach_user_id)
+    WITH CHECK (auth.uid() = coach_user_id);

{kinemotion-0.60.0 → kinemotion-0.61.0}/backend/tests/conftest.py

@@ -97,8 +97,7 @@ def mock_kinemotion_analysis(
             "kinemotion_backend.services.storage_service.StorageService.upload_video"
         )
         upload_results_patch = (
-            "kinemotion_backend.services.storage_service."
-            "StorageService.upload_analysis_results"
+            "kinemotion_backend.services.storage_service.StorageService.upload_analysis_results"
         )
         with (
             patch(cmj_patch) as mock_cmj,

{kinemotion-0.60.0 → kinemotion-0.61.0}/backend/tests/test_error_handling.py

@@ -162,15 +162,11 @@ def test_multiple_errors_sequential(
     files_valid = {"file": ("test.mp4", BytesIO(sample_video_bytes), "video/mp4")}
 
     # First request with invalid file
-    response1 = client.post(
-        "/api/analyze", files=files_invalid, data={"jump_type": "cmj"}
-    )
+    response1 = client.post("/api/analyze", files=files_invalid, data={"jump_type": "cmj"})
     assert response1.status_code == 422
 
     # Second request with valid file
-    response2 = client.post(
-        "/api/analyze", files=files_valid, data={"jump_type": "cmj"}
-    )
+    response2 = client.post("/api/analyze", files=files_valid, data={"jump_type": "cmj"})
     assert response2.status_code == 200
 
 
@@ -220,9 +216,7 @@ def test_keyboard_interrupt_returns_500(
         cmj_patch = "kinemotion_backend.services.video_processor.process_cmj_video"
         with patch(cmj_patch) as mock_cmj:
             mock_cmj.side_effect = KeyboardInterrupt()
-            response = client.post(
-                "/api/analyze", files=files, data={"jump_type": "cmj"}
-            )
+            response = client.post("/api/analyze", files=files, data={"jump_type": "cmj"})
 
         assert response.status_code == 500
     except KeyboardInterrupt:

{kinemotion-0.60.0 → kinemotion-0.61.0}/backend/tests/test_r2_integration.py

@@ -154,9 +154,7 @@ def test_r2_upload_file_success() -> None:
         with patch("kinemotion_backend.models.storage.boto3.client") as mock_boto3:
             mock_s3 = MagicMock()
             mock_boto3.return_value = mock_s3
-            mock_s3.generate_presigned_url.return_value = (
-                "https://r2.example.com/presigned-url"
-            )
+            mock_s3.generate_presigned_url.return_value = "https://r2.example.com/presigned-url"
 
             client = R2StorageClient()
             url = client.upload_file("/tmp/test.mp4", "videos/test.mp4")
@@ -252,9 +250,7 @@ def test_get_object_url_with_custom_expiration() -> None:
         with patch("kinemotion_backend.models.storage.boto3.client") as mock_boto3:
             mock_s3 = MagicMock()
             mock_boto3.return_value = mock_s3
-            mock_s3.generate_presigned_url.return_value = (
-                "https://r2.example.com/presigned"
-            )
+            mock_s3.generate_presigned_url.return_value = "https://r2.example.com/presigned"
 
             client = R2StorageClient()
             url = client.get_object_url("videos/test.mp4")
@@ -416,9 +412,7 @@ def test_r2_put_object_success() -> None:
         with patch("kinemotion_backend.models.storage.boto3.client") as mock_boto3:
             mock_s3 = MagicMock()
             mock_boto3.return_value = mock_s3
-            mock_s3.generate_presigned_url.return_value = (
-                "https://r2.example.com/presigned-url"
-            )
+            mock_s3.generate_presigned_url.return_value = "https://r2.example.com/presigned-url"
 
             client = R2StorageClient()
             url = client.put_object("results/test.json", b'{"status": "ok"}')