feat(feedback): thumbs up/down on answers (MCP + chat) with an answer_log table

.env.example

@@ -184,3 +184,21 @@ OWASP_WARMUP=1
 
 # Remote MCP server: how many questions may be answered at the same time (each in its own thread).
 OPENCRE_MCP_ASK_CONCURRENCY=8
+
+# --- Accounts and roles (web chatbot and MCP share one model; see docs/roles.md) ---
+# Two roles: "user" = any account on an allowed domain; "admin" = the named accounts below.
+# Leave ADMIN_EMAILS unset for the old behaviour (LOGIN_ALLOWED_EMAILS is the one allowlist, all admins).
+# ADMIN_EMAILS=alice@owasp.org,bob@owasp.org
+# LOGIN_ALLOWED_DOMAINS=owasp.org
+
+# --- Per-account question limits (chatbot + MCP ask; shared through Redis) ---
+# Defaults per account: 5 / minute, 40 / hour, 150 / day; admins x4. Uncomment to change.
+# RATE_LIMIT_PER_MINUTE=5
+# RATE_LIMIT_PER_HOUR=40
+# RATE_LIMIT_PER_DAY=150
+# RATE_LIMIT_ADMIN_MULTIPLIER=4
+# RATE_LIMIT_EXEMPT_EMAILS=evalbot@owasp.org
+# RATE_LIMIT_ENABLED=0   # switch limits off
+
+# Warm each web worker in the background at start so the first chat is not slow (the MCP server always does).
+# OWASP_WARMUP_WEB=1

application/__init__.py

@@ -92,4 +92,8 @@ def create_app(mode: str = "production", conf: any = None) -> Any:
     compress.init_app(app)
     cache.init_app(app)
 
+    if mode != "test":
+        from application.utils.comprehension.shared import start_background_warm_up
+
+        start_background_warm_up(app)  # no-op unless OWASP_WARMUP_WEB=1
     return app

application/database/db.py

@@ -321,6 +321,29 @@ class AdminRuntimeSettingAudit(BaseModel):  # type: ignore
     __table_args__ = (sqla.Index("ix_admin_runtime_setting_audit_key", "key"),)
 
 
+class AnswerLog(BaseModel):  # type: ignore
+    """Every answer the system gives, with an optional thumbs up/down from the asker."""
+
+    __tablename__ = "answer_log"
+    id = sqla.Column(sqla.String, primary_key=True, default=generate_uuid)
+    created_at = sqla.Column(sqla.DateTime, nullable=False)
+    source = sqla.Column(sqla.String, nullable=False)  # "mcp" | "chat"
+    question = sqla.Column(sqla.Text, nullable=False)
+    answer = sqla.Column(sqla.Text, nullable=True)
+    citations = sqla.Column(sqla.Text, nullable=True)  # JSON list of urls
+    channel = sqla.Column(sqla.String, nullable=True)
+    flags = sqla.Column(sqla.String, nullable=True)  # active OWASP_CX_* flags
+    latency_ms = sqla.Column(sqla.Integer, nullable=True)
+    rating = sqla.Column(sqla.String, nullable=True)  # "up" | "down"
+    comment = sqla.Column(sqla.Text, nullable=True)
+    rated_at = sqla.Column(sqla.DateTime, nullable=True)
+
+    __table_args__ = (
+        sqla.Index("ix_answer_log_created_at", "created_at"),
+        sqla.Index("ix_answer_log_rating", "rating"),
+    )
+
+
 class User(BaseModel):  # type: ignore
     """Persisted account identity for OIDC login (issue #586, RFC #876 TODO 1).
 

application/frontend/src/components/DocumentNode/DocumentNode.tsx

@@ -36,7 +36,8 @@ export interface DocumentNode {
 const linkTypesToNest = [TYPE_IS_PART_OF, TYPE_RELATED, TYPE_AUTOLINKED_TO];
 const linkTypesExcludedInNesting = [TYPE_CONTAINS];
 const linkTypesExcludedWhenNestingRelatedTo = [TYPE_RELATED, TYPE_IS_PART_OF, TYPE_CONTAINS];
-const linkDisplayOrder = [TYPE_LINKED_TO, TYPE_AUTOLINKED_TO, TYPE_CONTAINS, TYPE_IS_PART_OF, TYPE_RELATED];
+// "Related" is more useful than the hierarchy, so it comes before "child of".
+const linkDisplayOrder = [TYPE_LINKED_TO, TYPE_AUTOLINKED_TO, TYPE_CONTAINS, TYPE_RELATED, TYPE_IS_PART_OF];
 
 export const DocumentNode: FunctionComponent<DocumentNode> = ({
   node,

application/frontend/src/pages/Admin/Admin.test.tsx

@@ -122,6 +122,38 @@ describe('Admin', () => {
     expect(JSON.parse(put!.init.body)).toEqual({ interval_minutes: 30, enabled: true });
   });
 
+  it('edits project authority weights and saves only the changed ones', async () => {
+    loggedIn();
+    const calls: { url: string; init?: any }[] = [];
+    (global as any).fetch = jest.fn((url: string, init?: any) => {
+      calls.push({ url: String(url), init });
+      if (String(url).endsWith('/admin/authority') && init?.method === 'PUT') {
+        return jsonRes({ weights: { 'www-project-ai-exchange': 1.2 } });
+      }
+      if (String(url).endsWith('/admin/authority')) {
+        return jsonRes({
+          projects: [
+            { slug: 'www-project-ai-exchange', name: 'ai exchange', weight: 1 },
+            { slug: 'AISVS', name: 'aisvs', weight: 1 },
+          ],
+        });
+      }
+      return jsonRes({});
+    });
+    const { getByText, findByLabelText, findByText } = render(
+      <MemoryRouter>
+        <Admin />
+      </MemoryRouter>
+    );
+    fireEvent.click(getByText('Authority'));
+    const input = (await findByLabelText('www-project-ai-exchange weight')) as HTMLInputElement;
+    fireEvent.change(input, { target: { value: '1.2' } });
+    fireEvent.click(getByText(/^Save/));
+    expect(await findByText(/1 project weight\(s\) saved/)).toBeTruthy();
+    const put = calls.find((c) => c.init?.method === 'PUT');
+    expect(JSON.parse(put!.init.body)).toEqual({ weights: { 'www-project-ai-exchange': 1.2 } });
+  });
+
   it('loads import runs and links to MyOpenCRE', async () => {
     loggedIn();
     (global as any).fetch = jest.fn((url: string) => {

application/frontend/src/pages/Admin/Admin.tsx

@@ -13,6 +13,7 @@ type Tab =
   | 'pipeline'
   | 'oie'
   | 'schedule'
+  | 'authority'
   | 'graph'
   | 'workbench'
   | 'myopencre'
@@ -23,6 +24,10 @@ const TAB_META: Record<Tab, { label: string; sub: string }> = {
   config: { label: 'Config values', sub: 'Process env vs .env — admin only.' },
   pipeline: { label: 'Pipeline', sub: 'Jobs, stage logs, ingest.' },
   oie: { label: 'OIE queue', sub: 'RQ / OIE worker status.' },
+  authority: {
+    label: 'Authority',
+    sub: 'Feature or soften projects. 1 = neutral; above 1 = always list the closest passage among the references; below 1 = rank lower; 0 = hidden.',
+  },
   schedule: { label: 'Schedules', sub: 'How often the ingestion jobs run — change or switch off.' },
   graph: { label: 'Review', sub: 'Staged links — expand section text, accept/reject.' },
   workbench: { label: 'Workbench', sub: 'Accepted targets and re-ingest.' },
@@ -182,6 +187,7 @@ export const Admin = () => {
     { id: 'pipeline', label: 'Pipeline', group: 'Ops' },
     { id: 'oie', label: 'OIE queue', group: 'Ops' },
     { id: 'schedule', label: 'Schedules', group: 'Ops' },
+    { id: 'authority', label: 'Authority', group: 'Ops' },
     { id: 'graph', label: 'Review', group: 'Ops' },
     { id: 'workbench', label: 'Workbench', group: 'Ops' },
     { id: 'myopencre', label: 'MyOpenCRE', group: 'Apps' },
@@ -234,6 +240,7 @@ export const Admin = () => {
           {tab === 'pipeline' && <PipelineTab origin={origin} />}
           {tab === 'oie' && <OieQueueTab origin={origin} />}
           {tab === 'schedule' && <ScheduleTab origin={origin} />}
+          {tab === 'authority' && <AuthorityTab origin={origin} />}
           {tab === 'graph' && <GraphManagementTab origin={origin} />}
           {tab === 'workbench' && <WorkbenchTab origin={origin} />}
           {tab === 'myopencre' && (
@@ -1074,6 +1081,109 @@ type ScheduleJob = {
   last_run: { status?: string; started_at?: string } | null;
 };
 
+type AuthorityRow = { slug: string; name: string; weight: number };
+
+function AuthorityTab({ origin }: { origin: string }) {
+  const [rows, setRows] = useState<AuthorityRow[]>([]);
+  const [draft, setDraft] = useState<Record<string, string>>({});
+  const [filter, setFilter] = useState('');
+  const [error, setError] = useState<string | null>(null);
+  const [notice, setNotice] = useState<string | null>(null);
+  const [busy, setBusy] = useState(false);
+
+  const load = useCallback(() => {
+    fetch(`${origin}/admin/authority`)
+      .then(async (res) => {
+        const body = await readJson(res);
+        if (!res.ok) throw new Error(apiError(body, res));
+        const list: AuthorityRow[] = body.projects || [];
+        setRows(list);
+        setDraft(Object.fromEntries(list.map((r) => [r.slug, String(r.weight)])));
+        setError(null);
+      })
+      .catch((err) => setError(String(err)));
+  }, [origin]);
+
+  useEffect(() => {
+    load();
+  }, [load]);
+
+  const changed = rows.filter((r) => Number(draft[r.slug]) !== r.weight);
+
+  const save = async () => {
+    setBusy(true);
+    setNotice(null);
+    setError(null);
+    try {
+      const weights = Object.fromEntries(changed.map((r) => [r.slug, Number(draft[r.slug])]));
+      const res = await fetch(`${origin}/admin/authority`, {
+        method: 'PUT',
+        headers: mutHeaders({ 'Content-Type': 'application/json' }),
+        body: JSON.stringify({ weights }),
+      });
+      const body = await readJson(res);
+      if (!res.ok) throw new Error(apiError(body, res));
+      setNotice(`${changed.length} project weight(s) saved; effective within 30 seconds`);
+      load();
+    } catch (err) {
+      setError(String(err));
+    } finally {
+      setBusy(false);
+    }
+  };
+
+  const shown = rows
+    .filter((r) => !filter || r.slug.toLowerCase().includes(filter.toLowerCase()))
+    .sort((a, b) => Number(b.weight !== 1) - Number(a.weight !== 1) || a.slug.localeCompare(b.slug));
+
+  return (
+    <div>
+      {error ? <Message negative content={error} /> : null}
+      {notice ? <Message positive content={notice} /> : null}
+      <p>
+        Above 1 never changes the answer itself: the project&apos;s closest passage is added to the references
+        when it is reasonably relevant (1.15 is strict, 1.3 is looser). Below 1 pushes a project down in the
+        ranking and 0 hides it. Questions that name a project are not affected.
+      </p>
+      <input
+        aria-label="filter projects"
+        placeholder="Filter projects"
+        value={filter}
+        onChange={(e) => setFilter(e.target.value)}
+      />{' '}
+      <Button primary size="small" disabled={!changed.length || busy} onClick={save}>
+        Save {changed.length ? `(${changed.length})` : ''}
+      </Button>
+      <table className="admin-table" data-testid="authority-table">
+        <thead>
+          <tr>
+            <th>project</th>
+            <th>weight</th>
+          </tr>
+        </thead>
+        <tbody>
+          {shown.map((r) => (
+            <tr key={r.slug}>
+              <td className="mono">{r.slug}</td>
+              <td>
+                <input
+                  type="number"
+                  step={0.05}
+                  min={0}
+                  max={3}
+                  aria-label={`${r.slug} weight`}
+                  value={draft[r.slug] ?? ''}
+                  onChange={(e) => setDraft({ ...draft, [r.slug]: e.target.value })}
+                />
+              </td>
+            </tr>
+          ))}
+        </tbody>
+      </table>
+    </div>
+  );
+}
+
 function ScheduleTab({ origin }: { origin: string }) {
   const [jobs, setJobs] = useState<ScheduleJob[]>([]);
   const [draft, setDraft] = useState<Record<string, { interval: string; enabled: boolean }>>({});

application/frontend/src/pages/chatbot/chatbot.scss

@@ -70,11 +70,9 @@ h1.ui.header.chatbot-title {
   margin-bottom: 1rem !important;
 }
 
-.chatbot-toolbar {
-  display: flex;
-  justify-content: center;
-  margin: 0 auto 0.5rem;
-  max-width: 960px;
+.chat-continue {
+  margin: 0.25rem 0 0.5rem;
+  text-align: left;
 }
 
 /* Tablet & below */
@@ -477,3 +475,26 @@ h1.ui.header.chatbot-title {
     transform: translateX(-50%) translateY(0);
   }
 }
+
+.rate-answer {
+  display: flex;
+  gap: 0.25rem;
+  margin-top: 0.5rem;
+
+  .rate-btn {
+    background: none;
+    border: 1px solid transparent;
+    border-radius: 4px;
+    cursor: pointer;
+    padding: 0.2rem 0.4rem;
+
+    &:hover {
+      border-color: #c8cdd3;
+    }
+
+    &.is-selected {
+      background: #e8f0fe;
+      border-color: #7ba3f0;
+    }
+  }
+}