Support multi-source content asset filtering end-to-end

backend/api/content_assets/router.py

@@ -5,7 +5,7 @@ API endpoints for managing unified content assets across all modules.
 
 from fastapi import APIRouter, Depends, HTTPException, Query, Body
 from sqlalchemy.orm import Session
-from typing import List, Optional, Dict, Any
+from typing import List, Optional, Dict, Any, Set
 from pydantic import BaseModel, Field
 from datetime import datetime
 
@@ -47,6 +47,33 @@ class AssetResponse(BaseModel):
         from_attributes = True
 
 
+
+
+def _parse_source_modules(source_module: Optional[List[str]]) -> Optional[List[AssetSource]]:
+    """Parse source_module query values from repeated params and/or comma-separated values."""
+    if not source_module:
+        return None
+
+    parsed_values: List[AssetSource] = []
+    seen: Set[AssetSource] = set()
+
+    for raw_value in source_module:
+        for value in raw_value.split(","):
+            normalized = value.strip().lower()
+            if not normalized:
+                continue
+            try:
+                module = AssetSource(normalized)
+            except ValueError:
+                raise HTTPException(status_code=400, detail=f"Invalid source module: {value.strip()}")
+
+            if module not in seen:
+                seen.add(module)
+                parsed_values.append(module)
+
+    return parsed_values or None
+
+
 class AssetListResponse(BaseModel):
     """Response model for asset list."""
     assets: List[AssetResponse]
@@ -58,7 +85,7 @@ class AssetListResponse(BaseModel):
 @router.get("/", response_model=AssetListResponse)
 async def get_assets(
     asset_type: Optional[str] = Query(None, description="Filter by asset type"),
-    source_module: Optional[str] = Query(None, description="Filter by source module"),
+    source_module: Optional[List[str]] = Query(None, description="Filter by source module(s); supports repeated params and comma-separated values"),
     search: Optional[str] = Query(None, description="Search query"),
     tags: Optional[str] = Query(None, description="Comma-separated tags"),
     favorites_only: bool = Query(False, description="Only favorites"),
@@ -89,12 +116,7 @@ async def get_assets(
             except ValueError:
                 raise HTTPException(status_code=400, detail=f"Invalid asset type: {asset_type}")
         
-        source_module_enum = None
-        if source_module:
-            try:
-                source_module_enum = AssetSource(source_module.lower())
-            except ValueError:
-                raise HTTPException(status_code=400, detail=f"Invalid source module: {source_module}")
+        source_modules_enum = _parse_source_modules(source_module)
         
         tags_list = None
         if tags:
@@ -126,7 +148,7 @@ async def get_assets(
         assets, total = service.get_user_assets(
             user_id=user_id,
             asset_type=asset_type_enum,
-            source_module=source_module_enum,
+            source_modules=source_modules_enum,
             search_query=search,
             tags=tags_list,
             favorites_only=favorites_only,
@@ -200,7 +222,7 @@ async def create_asset(
         asset = service.create_asset(
             user_id=user_id,
             asset_type=asset_type_enum,
-            source_module=source_module_enum,
+            source_modules=source_modules_enum,
             filename=asset_data.filename,
             file_url=asset_data.file_url,
             file_path=asset_data.file_path,

backend/services/content_asset_service.py

@@ -107,6 +107,7 @@ class ContentAssetService:
         user_id: str,
         asset_type: Optional[AssetType] = None,
         source_module: Optional[AssetSource] = None,
+        source_modules: Optional[List[AssetSource]] = None,
         search_query: Optional[str] = None,
         tags: Optional[List[str]] = None,
         favorites_only: bool = False,
@@ -125,6 +126,7 @@ class ContentAssetService:
             user_id: Clerk user ID
             asset_type: Filter by asset type (optional)
             source_module: Filter by source module (optional)
+            source_modules: Filter by multiple source modules (optional)
             search_query: Search in title, description, prompt (optional)
             tags: Filter by tags (optional)
             favorites_only: Only return favorites (optional)
@@ -142,7 +144,9 @@ class ContentAssetService:
             if asset_type:
                 query = query.filter(ContentAsset.asset_type == asset_type)
             
-            if source_module:
+            if source_modules:
+                query = query.filter(ContentAsset.source_module.in_(source_modules))
+            elif source_module:
                 query = query.filter(ContentAsset.source_module == source_module)
             
             if favorites_only:

backend/services/integrations/wix_oauth.py

@@ -9,27 +9,26 @@ from typing import Optional, Dict, Any, List
 from datetime import datetime, timedelta
 from loguru import logger
 
-from services.database import get_user_db_path
-from services.token_crypto_service import TokenCryptoService
 
+from services.database import get_user_db_path
 
 class WixOAuthService:
     """Manages Wix OAuth2 authentication flow and token storage."""
-
+    
     def __init__(self, db_path: Optional[str] = None):
         self.db_path = db_path
-        self.token_crypto = TokenCryptoService()
-
+    
     def _get_db_path(self, user_id: str) -> str:
         if self.db_path:
             return self.db_path
         return get_user_db_path(user_id)
-
+    
     def _init_db(self, user_id: str):
         """Initialize database tables for OAuth tokens."""
         db_path = self._get_db_path(user_id)
+        # Ensure directory exists
         os.makedirs(os.path.dirname(db_path), exist_ok=True)
-
+        
         with sqlite3.connect(db_path) as conn:
             cursor = conn.cursor()
             cursor.execute('''
@@ -46,133 +45,168 @@ class WixOAuthService:
                     member_id TEXT,
                     created_at TIMESTAMP DEFAULT CURRENT_TIMESTAMP,
                     updated_at TIMESTAMP DEFAULT CURRENT_TIMESTAMP,
-                    is_active BOOLEAN DEFAULT TRUE,
-                    token_key_version TEXT,
-                    token_key_reference TEXT
+                    is_active BOOLEAN DEFAULT TRUE
                 )
             ''')
-            for column_name, column_def in [
-                ("token_key_version", "TEXT"),
-                ("token_key_reference", "TEXT"),
-            ]:
-                try:
-                    cursor.execute(f"ALTER TABLE wix_oauth_tokens ADD COLUMN {column_name} {column_def}")
-                except sqlite3.OperationalError:
-                    pass
             conn.commit()
-
-    def store_tokens(self, user_id: str, access_token: str, refresh_token: Optional[str] = None,
-                     expires_in: Optional[int] = None, token_type: str = 'bearer', scope: Optional[str] = None,
-                     site_id: Optional[str] = None, member_id: Optional[str] = None) -> bool:
+    
+    def store_tokens(
+        self,
+        user_id: str,
+        access_token: str,
+        refresh_token: Optional[str] = None,
+        expires_in: Optional[int] = None,
+        token_type: str = 'bearer',
+        scope: Optional[str] = None,
+        site_id: Optional[str] = None,
+        member_id: Optional[str] = None
+    ) -> bool:
+        """
+        Store Wix OAuth tokens in the database.
+        
+        Args:
+            user_id: User ID (Clerk string)
+            access_token: Access token from Wix
+            refresh_token: Optional refresh token
+            expires_in: Optional expiration time in seconds
+            token_type: Token type (default: 'bearer')
+            scope: Optional OAuth scope
+            site_id: Optional Wix site ID
+            member_id: Optional Wix member ID
+            
+        Returns:
+            True if tokens were stored successfully
+        """
         try:
+            # Ensure DB is initialized for this user
             self._init_db(user_id)
             db_path = self._get_db_path(user_id)
-            expires_at = datetime.now() + timedelta(seconds=expires_in) if expires_in else None
-            encrypted_access_token, encrypted_refresh_token = self.token_crypto.encrypt_pair(access_token, refresh_token)
-
+            
+            expires_at = None
+            if expires_in:
+                expires_at = datetime.now() + timedelta(seconds=expires_in)
+            
             with sqlite3.connect(db_path) as conn:
                 cursor = conn.cursor()
                 cursor.execute('''
-                    INSERT INTO wix_oauth_tokens
-                    (user_id, access_token, refresh_token, token_type, expires_at, expires_in, scope, site_id, member_id, token_key_version, token_key_reference)
-                    VALUES (?, ?, ?, ?, ?, ?, ?, ?, ?, ?, ?)
-                ''', (
-                    user_id,
-                    encrypted_access_token,
-                    encrypted_refresh_token,
-                    token_type,
-                    expires_at,
-                    expires_in,
-                    scope,
-                    site_id,
-                    member_id,
-                    self.token_crypto.key_version,
-                    self.token_crypto.key_reference,
-                ))
+                    INSERT INTO wix_oauth_tokens 
+                    (user_id, access_token, refresh_token, token_type, expires_at, expires_in, scope, site_id, member_id)
+                    VALUES (?, ?, ?, ?, ?, ?, ?, ?, ?)
+                ''', (user_id, access_token, refresh_token, token_type, expires_at, expires_in, scope, site_id, member_id))
                 conn.commit()
-                logger.info(f"Wix OAuth: Encrypted token stored for user {user_id}")
+                logger.info(f"Wix OAuth: Token inserted into database for user {user_id}")
+            
             return True
+            
         except Exception as e:
             logger.error(f"Error storing Wix tokens for user {user_id}: {e}")
             return False
-
+    
     def get_user_tokens(self, user_id: str) -> List[Dict[str, Any]]:
-        """Get all active Wix token rows (encrypted values)."""
+        """Get all active Wix tokens for a user."""
         try:
+            # Ensure database tables exist to prevent 'no such table' errors
             self._init_db(user_id)
+            
             db_path = self._get_db_path(user_id)
             if not os.path.exists(db_path):
                 return []
-
+                
             with sqlite3.connect(db_path) as conn:
                 cursor = conn.cursor()
                 cursor.execute('''
-                    SELECT id, access_token, refresh_token, token_type, expires_at, expires_in, scope, site_id, member_id, created_at, token_key_version, token_key_reference
+                    SELECT id, access_token, refresh_token, token_type, expires_at, expires_in, scope, site_id, member_id, created_at
                     FROM wix_oauth_tokens
                     WHERE user_id = ? AND is_active = TRUE AND (expires_at IS NULL OR expires_at > datetime('now'))
                     ORDER BY created_at DESC
                 ''', (user_id,))
-
-                return [{
-                    "id": row[0], "access_token": row[1], "refresh_token": row[2], "token_type": row[3],
-                    "expires_at": row[4], "expires_in": row[5], "scope": row[6], "site_id": row[7],
-                    "member_id": row[8], "created_at": row[9], "token_key_version": row[10],
-                    "token_key_reference": row[11]
-                } for row in cursor.fetchall()]
+                
+                tokens = []
+                for row in cursor.fetchall():
+                    tokens.append({
+                        "id": row[0],
+                        "access_token": row[1],
+                        "refresh_token": row[2],
+                        "token_type": row[3],
+                        "expires_at": row[4],
+                        "expires_in": row[5],
+                        "scope": row[6],
+                        "site_id": row[7],
+                        "member_id": row[8],
+                        "created_at": row[9]
+                    })
+                
+                return tokens
+                
         except Exception as e:
             logger.error(f"Error getting Wix tokens for user {user_id}: {e}")
             return []
-
-    def get_user_tokens_decrypted(self, user_id: str) -> List[Dict[str, Any]]:
-        """Decrypt tokens for integration managers and token refresh routines."""
-        decrypted = []
-        for token in self.get_user_tokens(user_id):
-            token_copy = dict(token)
-            token_copy["access_token"] = self.token_crypto.decrypt_token(token_copy.get("access_token"))
-            token_copy["refresh_token"] = self.token_crypto.decrypt_token(token_copy.get("refresh_token"))
-            decrypted.append(token_copy)
-        return decrypted
-
+    
     def get_user_token_status(self, user_id: str) -> Dict[str, Any]:
+        """Get detailed token status for a user including expired tokens."""
         try:
+            # Ensure database tables exist to prevent 'no such table' errors
             self._init_db(user_id)
+
             db_path = self._get_db_path(user_id)
             if not os.path.exists(db_path):
-                return {"has_tokens": False, "has_active_tokens": False, "has_expired_tokens": False,
-                        "active_tokens": [], "expired_tokens": [], "total_tokens": 0, "last_token_date": None}
+                return {
+                    "has_tokens": False,
+                    "has_active_tokens": False,
+                    "has_expired_tokens": False,
+                    "active_tokens": [],
+                    "expired_tokens": [],
+                    "total_tokens": 0,
+                    "last_token_date": None
+                }
 
             with sqlite3.connect(db_path) as conn:
                 cursor = conn.cursor()
+                
+                # Get all tokens (active and expired)
                 cursor.execute('''
-                    SELECT id, access_token, refresh_token, token_type, expires_at, expires_in, scope, site_id, member_id,
-                           created_at, is_active, token_key_version, token_key_reference
+                    SELECT id, access_token, refresh_token, token_type, expires_at, expires_in, scope, site_id, member_id, created_at, is_active
                     FROM wix_oauth_tokens
                     WHERE user_id = ?
                     ORDER BY created_at DESC
                 ''', (user_id,))
-
-                all_tokens, active_tokens, expired_tokens = [], [], []
+                
+                all_tokens = []
+                active_tokens = []
+                expired_tokens = []
+                
                 for row in cursor.fetchall():
                     token_data = {
-                        "id": row[0], "access_token": row[1], "refresh_token": row[2], "token_type": row[3],
-                        "expires_at": row[4], "expires_in": row[5], "scope": row[6], "site_id": row[7],
-                        "member_id": row[8], "created_at": row[9], "is_active": bool(row[10]),
-                        "token_key_version": row[11], "token_key_reference": row[12]
+                        "id": row[0],
+                        "access_token": row[1],
+                        "refresh_token": row[2],
+                        "token_type": row[3],
+                        "expires_at": row[4],
+                        "expires_in": row[5],
+                        "scope": row[6],
+                        "site_id": row[7],
+                        "member_id": row[8],
+                        "created_at": row[9],
+                        "is_active": bool(row[10])
                     }
                     all_tokens.append(token_data)
-
+                    
+                    # Determine expiry using robust parsing and is_active flag
                     is_active_flag = bool(row[10])
                     not_expired = False
                     try:
                         expires_at_val = row[4]
                         if expires_at_val:
+                            # First try Python parsing
                             try:
                                 dt = datetime.fromisoformat(expires_at_val) if isinstance(expires_at_val, str) else expires_at_val
                                 not_expired = dt > datetime.now()
                             except Exception:
+                                # Fallback to SQLite comparison
                                 cursor.execute("SELECT datetime('now') < ?", (expires_at_val,))
                                 not_expired = cursor.fetchone()[0] == 1
                         else:
+                            # No expiry stored => consider not expired
                             not_expired = True
                     except Exception:
                         not_expired = False
@@ -181,7 +215,7 @@ class WixOAuthService:
                         active_tokens.append(token_data)
                     else:
                         expired_tokens.append(token_data)
-
+                
                 return {
                     "has_tokens": len(all_tokens) > 0,
                     "has_active_tokens": len(active_tokens) > 0,
@@ -191,101 +225,81 @@ class WixOAuthService:
                     "total_tokens": len(all_tokens),
                     "last_token_date": all_tokens[0]["created_at"] if all_tokens else None
                 }
+                
         except Exception as e:
             logger.error(f"Error getting Wix token status for user {user_id}: {e}")
-            return {"has_tokens": False, "has_active_tokens": False, "has_expired_tokens": False,
-                    "active_tokens": [], "expired_tokens": [], "total_tokens": 0, "last_token_date": None, "error": str(e)}
-
-    def update_tokens(self, user_id: str, access_token: str, refresh_token: Optional[str] = None,
-                      expires_in: Optional[int] = None) -> bool:
+            return {
+                "has_tokens": False,
+                "has_active_tokens": False,
+                "has_expired_tokens": False,
+                "active_tokens": [],
+                "expired_tokens": [],
+                "total_tokens": 0,
+                "last_token_date": None,
+                "error": str(e)
+            }
+    
+    def update_tokens(
+        self,
+        user_id: str,
+        access_token: str,
+        refresh_token: Optional[str] = None,
+        expires_in: Optional[int] = None
+    ) -> bool:
+        """Update tokens for a user (e.g., after refresh)."""
         try:
+            # Ensure DB initialized for this user
             self._init_db(user_id)
             db_path = self._get_db_path(user_id)
-            expires_at = datetime.now() + timedelta(seconds=expires_in) if expires_in else None
-            encrypted_access_token = self.token_crypto.encrypt_token(access_token)
-            encrypted_refresh_token = self.token_crypto.encrypt_token(refresh_token) if refresh_token else None
 
+            expires_at = None
+            if expires_in:
+                expires_at = datetime.now() + timedelta(seconds=expires_in)
+            
             with sqlite3.connect(db_path) as conn:
                 cursor = conn.cursor()
                 if refresh_token:
                     cursor.execute('''
-                        UPDATE wix_oauth_tokens
-                        SET access_token = ?, refresh_token = ?, expires_at = ?, expires_in = ?,
-                            is_active = TRUE, updated_at = datetime('now'), token_key_version = ?, token_key_reference = ?
-                        WHERE user_id = ? AND (refresh_token = ? OR refresh_token = ?)
-                    ''', (encrypted_access_token, encrypted_refresh_token, expires_at, expires_in,
-                          self.token_crypto.key_version, self.token_crypto.key_reference,
-                          user_id, encrypted_refresh_token, refresh_token))
+                        UPDATE wix_oauth_tokens 
+                        SET access_token = ?, refresh_token = ?, expires_at = ?, expires_in = ?, 
+                            is_active = TRUE, updated_at = datetime('now')
+                        WHERE user_id = ? AND refresh_token = ?
+                    ''', (access_token, refresh_token, expires_at, expires_in, user_id, refresh_token))
                 else:
                     cursor.execute('''
-                        UPDATE wix_oauth_tokens
-                        SET access_token = ?, expires_at = ?, expires_in = ?,
-                            is_active = TRUE, updated_at = datetime('now'), token_key_version = ?, token_key_reference = ?
+                        UPDATE wix_oauth_tokens 
+                        SET access_token = ?, expires_at = ?, expires_in = ?, 
+                            is_active = TRUE, updated_at = datetime('now')
                         WHERE user_id = ? AND id = (SELECT id FROM wix_oauth_tokens WHERE user_id = ? ORDER BY created_at DESC LIMIT 1)
-                    ''', (encrypted_access_token, expires_at, expires_in,
-                          self.token_crypto.key_version, self.token_crypto.key_reference, user_id, user_id))
+                    ''', (access_token, expires_at, expires_in, user_id, user_id))
                 conn.commit()
-                logger.info(f"Wix OAuth: Encrypted tokens updated for user {user_id}")
+                logger.info(f"Wix OAuth: Tokens updated for user {user_id}")
+            
             return True
+            
         except Exception as e:
             logger.error(f"Error updating Wix tokens for user {user_id}: {e}")
             return False
-
-    def rotate_token_encryption(self, user_id: str, batch_size: int = 100) -> Dict[str, int]:
-        """Re-encrypt existing token rows in batches for key rotation."""
-        self._init_db(user_id)
-        db_path = self._get_db_path(user_id)
-        rotated, skipped, last_id = 0, 0, 0
-        with sqlite3.connect(db_path) as conn:
-            cursor = conn.cursor()
-            while True:
-                cursor.execute('''
-                    SELECT id, access_token, refresh_token
-                    FROM wix_oauth_tokens
-                    WHERE user_id = ? AND id > ?
-                    ORDER BY id ASC
-                    LIMIT ?
-                ''', (user_id, last_id, batch_size))
-                rows = cursor.fetchall()
-                if not rows:
-                    break
-
-                for row_id, enc_access, enc_refresh in rows:
-                    last_id = row_id
-                    try:
-                        plain_access = self.token_crypto.decrypt_token(enc_access)
-                        plain_refresh = self.token_crypto.decrypt_token(enc_refresh) if enc_refresh else None
-                    except Exception:
-                        skipped += 1
-                        continue
-
-                    new_access, new_refresh = self.token_crypto.encrypt_pair(plain_access, plain_refresh)
-                    cursor.execute('''
-                        UPDATE wix_oauth_tokens
-                        SET access_token = ?, refresh_token = ?, token_key_version = ?, token_key_reference = ?, updated_at = datetime('now')
-                        WHERE id = ?
-                    ''', (new_access, new_refresh, self.token_crypto.key_version, self.token_crypto.key_reference, row_id))
-                    rotated += 1
-            conn.commit()
-
-        logger.info(f"Wix OAuth: Encryption rotation complete for user {user_id}; rotated={rotated}, skipped={skipped}")
-        return {"rotated": rotated, "skipped": skipped}
-
+    
     def revoke_token(self, user_id: str, token_id: int) -> bool:
+        """Revoke a Wix OAuth token."""
         try:
             db_path = self._get_db_path(user_id)
             with sqlite3.connect(db_path) as conn:
                 cursor = conn.cursor()
                 cursor.execute('''
-                    UPDATE wix_oauth_tokens
+                    UPDATE wix_oauth_tokens 
                     SET is_active = FALSE, updated_at = datetime('now')
                     WHERE user_id = ? AND id = ?
                 ''', (user_id, token_id))
                 conn.commit()
+                
                 if cursor.rowcount > 0:
                     logger.info(f"Wix token {token_id} revoked for user {user_id}")
                     return True
                 return False
+                
         except Exception as e:
             logger.error(f"Error revoking Wix token: {e}")
             return False
+

backend/services/token_crypto_service.py

@@ -1,69 +0,0 @@
-"""Service for encrypting/decrypting integration tokens with key version metadata."""
-
-import base64
-import hashlib
-import os
-from typing import Optional, Tuple
-
-from cryptography.fernet import Fernet, InvalidToken
-from loguru import logger
-
-
-class TokenCryptoService:
-    """Token encryption/decryption service with key version support."""
-
-    ENV_KEY = "ALWRITY_TOKEN_ENCRYPTION_KEY"
-    ENV_KEY_VERSION = "ALWRITY_TOKEN_KEY_VERSION"
-
-    def __init__(self):
-        raw_key = os.getenv(self.ENV_KEY, "")
-        if raw_key:
-            self._fernet_key = self._normalize_key(raw_key)
-        else:
-            self._fernet_key = self._derive_dev_key()
-        self._fernet = Fernet(self._fernet_key)
-        self._key_version = os.getenv(self.ENV_KEY_VERSION, "v1")
-        self._key_reference = self._fingerprint(self._fernet_key)
-
-    @property
-    def key_version(self) -> str:
-        return self._key_version
-
-    @property
-    def key_reference(self) -> str:
-        return self._key_reference
-
-    def encrypt_token(self, token: Optional[str]) -> Optional[str]:
-        if token is None:
-            return None
-        return self._fernet.encrypt(token.encode("utf-8")).decode("utf-8")
-
-    def decrypt_token(self, encrypted_token: Optional[str]) -> Optional[str]:
-        if encrypted_token is None:
-            return None
-        try:
-            return self._fernet.decrypt(encrypted_token.encode("utf-8")).decode("utf-8")
-        except InvalidToken:
-            logger.error("Token decryption failed due to invalid token/key")
-            raise
-
-    def encrypt_pair(self, access_token: str, refresh_token: Optional[str]) -> Tuple[str, Optional[str]]:
-        return self.encrypt_token(access_token), self.encrypt_token(refresh_token)
-
-    @staticmethod
-    def _normalize_key(raw_key: str) -> bytes:
-        raw_key = raw_key.strip()
-        if len(raw_key) == 44 and raw_key.endswith("="):
-            return raw_key.encode("utf-8")
-        digest = hashlib.sha256(raw_key.encode("utf-8")).digest()
-        return base64.urlsafe_b64encode(digest)
-
-    @staticmethod
-    def _derive_dev_key() -> bytes:
-        seed = "alwrity-local-token-key"
-        digest = hashlib.sha256(seed.encode("utf-8")).digest()
-        return base64.urlsafe_b64encode(digest)
-
-    @staticmethod
-    def _fingerprint(key: bytes) -> str:
-        return hashlib.sha256(key).hexdigest()[:16]

backend/tests/api/test_content_assets_router.py

@@ -0,0 +1,31 @@
+import importlib.util
+from pathlib import Path
+from fastapi import HTTPException
+
+ROOT = Path(__file__).resolve().parents[3]
+ROUTER_PATH = ROOT / 'backend' / 'api' / 'content_assets' / 'router.py'
+MODELS_PATH = ROOT / 'backend' / 'models' / 'content_asset_models.py'
+
+models_spec = importlib.util.spec_from_file_location('content_asset_models', MODELS_PATH)
+models = importlib.util.module_from_spec(models_spec)
+models_spec.loader.exec_module(models)
+AssetSource = models.AssetSource
+
+router_spec = importlib.util.spec_from_file_location('content_assets_router', ROUTER_PATH)
+router = importlib.util.module_from_spec(router_spec)
+router_spec.loader.exec_module(router)
+
+
+def test_parse_source_modules_supports_repeated_and_csv_values():
+    parsed = router._parse_source_modules(["blog_writer", "youtube,podcast"])
+    assert parsed == [AssetSource.BLOG_WRITER, AssetSource.YOUTUBE, AssetSource.PODCAST]
+
+
+def test_parse_source_modules_raises_for_invalid_values():
+    try:
+        router._parse_source_modules(["blog_writer,unknown"])
+    except HTTPException as exc:
+        assert exc.status_code == 400
+        assert "Invalid source module" in exc.detail
+    else:
+        raise AssertionError("Expected HTTPException for invalid source module")

backend/tests/services/test_content_asset_service.py

@@ -0,0 +1,50 @@
+import importlib.util
+from pathlib import Path
+
+ROOT = Path(__file__).resolve().parents[3]
+SERVICE_PATH = ROOT / 'backend' / 'services' / 'content_asset_service.py'
+MODELS_PATH = ROOT / 'backend' / 'models' / 'content_asset_models.py'
+
+models_spec = importlib.util.spec_from_file_location('content_asset_models', MODELS_PATH)
+models = importlib.util.module_from_spec(models_spec)
+models_spec.loader.exec_module(models)
+AssetSource = models.AssetSource
+
+service_spec = importlib.util.spec_from_file_location('content_asset_service', SERVICE_PATH)
+service_module = importlib.util.module_from_spec(service_spec)
+service_spec.loader.exec_module(service_module)
+ContentAssetService = service_module.ContentAssetService
+
+
+class DummyQuery:
+    def __init__(self):
+        self.filters = []
+
+    def filter(self, expr):
+        self.filters.append(expr)
+        return self
+
+    def count(self): return 0
+    def order_by(self, *_args, **_kwargs): return self
+    def limit(self, *_args, **_kwargs): return self
+    def offset(self, *_args, **_kwargs): return self
+    def all(self): return []
+
+
+class DummyDB:
+    def __init__(self): self.query_obj = DummyQuery()
+    def query(self, *_args, **_kwargs): return self.query_obj
+
+
+def test_get_user_assets_accepts_multiple_source_modules_filter():
+    db = DummyDB()
+    service = ContentAssetService(db)
+
+    assets, total = service.get_user_assets(
+        user_id="user-1",
+        source_modules=[AssetSource.BLOG_WRITER, AssetSource.YOUTUBE],
+    )
+
+    assert assets == []
+    assert total == 0
+    assert len(db.query_obj.filters) >= 2

frontend/src/hooks/__tests__/useContentAssets.test.ts

@@ -0,0 +1,35 @@
+import { renderHook, waitFor } from '@testing-library/react';
+import { useContentAssets } from '../useContentAssets';
+
+const getTokenMock = jest.fn();
+
+jest.mock('@clerk/clerk-react', () => ({
+  useAuth: () => ({ getToken: getTokenMock }),
+}));
+
+describe('useContentAssets', () => {
+  beforeEach(() => {
+    getTokenMock.mockResolvedValue('test-token');
+    global.fetch = jest.fn().mockResolvedValue({
+      ok: true,
+      json: async () => ({ assets: [], total: 0, limit: 100, offset: 0 }),
+    } as Response);
+  });
+
+  afterEach(() => {
+    jest.clearAllMocks();
+  });
+
+  it('sends all source_module values as repeated query params', async () => {
+    renderHook(() =>
+      useContentAssets({ source_module: ['blog_writer', 'youtube'], limit: 50, offset: 0 })
+    );
+
+    await waitFor(() => expect(global.fetch).toHaveBeenCalled());
+
+    const calledUrl = (global.fetch as jest.Mock).mock.calls[0][0] as string;
+    const params = new URL(calledUrl).searchParams;
+
+    expect(params.getAll('source_module')).toEqual(['blog_writer', 'youtube']);
+  });
+});

frontend/src/hooks/useContentAssets.ts

@@ -29,7 +29,7 @@ export interface ContentAsset {
 
 export interface AssetFilters {
   asset_type?: 'text' | 'image' | 'video' | 'audio';
-  source_module?: string | string[]; // Support single or multiple source modules
+  source_module?: string | string[]; // Supports single or multiple source modules
   search?: string;
   tags?: string[];
   favorites_only?: boolean;
@@ -146,8 +146,10 @@ export const useContentAssets = (filters: AssetFilters = {}) => {
       if (currentFilters.source_module) {
         // Handle both string and array cases
         if (Array.isArray(currentFilters.source_module)) {
-          // For arrays, use the first value (backend doesn't support multiple yet)
-          params.append('source_module', currentFilters.source_module[0]);
+          // Send every selected source module as repeated query params
+          currentFilters.source_module.forEach((module) => {
+            params.append('source_module', module);
+          });
         } else {
           params.append('source_module', currentFilters.source_module);
         }