API-details.md

🧠 Multi-User, Multi-Session Flow for Vulnerability Chatbot

🔐 1. User Login (SSO)

• User logs in via Azure AD / Okta / Google SSO
• Frontend receives and stores JWT token
• Token is sent with every API request for authorization

Authorization: Bearer <jwt_token>

---

📁 2. Document Upload & Session Creation

• User selects a vulnerability report PDF
• Frontend generates a unique session_id using UUID:

const session_id = uuidv4();

• API Call to upload PDF:

POST /uploadpdf

Headers:

Authorization: Bearer <jwt_token>

Form Data:

Field	Type	Required	Description
user_id	string	✅	Unique user identifier (from SSO)
session_id	string	✅	Unique session identifier (UUIDv4)
file	UploadFile	✅	The vulnerability report in PDF format

Response (200 OK):

{
  "vulnerabilities": [
    {
      "type": "SQL Injection",
      "occurrences": 3,
      "severity": "High"
    },
    {
      "type": "Cross-Site Scripting",
      "occurrences": 2,
      "severity": "Medium"
    }
  ]
}

---

💬 3. Chat with Bot Per Vulnerability

• User selects a vulnerability to discuss (e.g., SQL Injection)
• Enters a message/question

POST /chat

Headers:

Authorization: Bearer <jwt_token>

Form Data:

Field	Type	Required	Description
user_id	string	✅	User identifier
session_id	string	✅	Session under which the chat is taking place
vulnerability	string	✅	Name of the vulnerability (e.g., SQL Injection)
message	string	✅	The user’s question or input for the bot

Response (200 OK):

{
  "response": "The SQL Injection occurs on line 45 due to unsanitized input. Use parameterized queries to fix it.",
  "chat_history": [
    { "role": "user", "content": "How to fix this?" },
    { "role": "assistant", "content": "Use parameterized queries..." }
  ]
}

---

🔄 Optional: Reset Session Memory

POST /reset

Form Data:

Field	Type	Required	Description
user_id	string	✅	User ID
session_id	string	✅	Session to clear

Response:

{ "message": "Session memory cleared." }

---

📌 Memory Structure

loaded_chunks = {
  user_id: {
    session_id: {
      vulnerability: chunk_text
    }
  }
}

chat_memory = {
  user_id: {
    session_id: {
      vulnerability: [chat_history]
    }
  }
}

---

✅ Best Practices

• Generate session_id at document upload time
• Use uuidv4() for uniqueness
• Keep user authentication separate from session lifecycle
• Use JWT for all user-authenticated API access
• Persist chat memory and chunks if long-term access is needed