feat: pin semantic-backend v1.2, set /semantic route, and harden container permissions

Dockerfile

@@ -11,7 +11,10 @@ RUN apt-get update && apt-get install -y --no-install-recommends \
     curl \
     && rm -rf /var/lib/apt/lists/*
 
-RUN useradd -m -u 1000 user
+RUN useradd -m -u 1000 user && \
+    mkdir -p /tmp/hf /tmp/p2 && \
+    chown -R user:user /tmp/hf /tmp/p2 && \
+    chmod 777 /tmp/hf /tmp/p2
 USER user
 ENV HOME=/home/user \
     PATH=/home/user/.local/bin:$PATH

main.py

@@ -54,9 +54,9 @@ class RequestLimitMiddleware(BaseHTTPMiddleware):
 
 app = FastAPI(
     title="HF Backend",
-    docs_url="/docs",
-    redoc_url="/redoc",
-    openapi_url="/openapi.json",
+    docs_url=None,
+    redoc_url=None,
+    openapi_url=None,
 )
 
 app.add_middleware(RequestLimitMiddleware, max_size=max_body_size, timeout=request_timeout)

registry.py

@@ -1,4 +1,3 @@
 PROJECT_REGISTRY = {
     "/semantic": "semantic_backend.router:router",
-    "/sementic": "semantic_backend.router:router",
 }

requirements.in

@@ -2,4 +2,4 @@ fastapi
 uvicorn[standard]
 pydantic
 starlette
-git+https://github.com/rachit-mangawa/Semantic-Comment-Analyze.git@v1.1#subdirectory=backend
+git+https://github.com/rachit-mangawa/Semantic-Comment-Analyze.git@v1.2#subdirectory=backend

requirements.txt

@@ -1,6 +1,8 @@
---extra-index-url https://download.pytorch.org/whl/cpu
 # This file was autogenerated by uv via the following command:
-#    uv pip compile requirements.in -o requirements.txt --python-version 3.11 --python-platform linux
+#    uv pip compile requirements.in -o requirements.txt --python-version 3.11 --python-platform linux --extra-index-url https://download.pytorch.org/whl/cpu --emit-index-url
+--index-url https://pypi.org/simple
+--extra-index-url https://download.pytorch.org/whl/cpu
+
 annotated-doc==0.0.5
     # via
     #   fastapi
@@ -118,7 +120,7 @@ scipy==1.17.1
     # via
     #   scikit-learn
     #   sentence-transformers
-semantic-backend @ git+https://github.com/rachit-mangawa/Semantic-Comment-Analyze.git@a123207a1239cb9ff59a09e597fe80dfc635aeec#subdirectory=backend
+semantic-backend @ git+https://github.com/rachit-mangawa/Semantic-Comment-Analyze.git@480d2c3203f4773e805f8f58e63c1f1be315d6d1#subdirectory=backend
     # via -r requirements.in
 sentence-transformers==6.2.0
     # via semantic-backend
@@ -141,9 +143,7 @@ tokenizers==0.23.3
     #   sentence-transformers
     #   transformers
 torch==2.14.1+cpu
-    # via
-    #   semantic-backend
-    #   sentence-transformers
+    # via sentence-transformers
 tqdm==4.66.5
     # via
     #   huggingface-hub
@@ -178,13 +178,10 @@ typing-inspection==0.4.4
 tzdata==2026.5
     # via python-dateutil
 uvicorn==0.54.0
-    # via
-    #   -r requirements.in
-    #   semantic-backend
+    # via -r requirements.in
 uvloop==0.23.0
     # via uvicorn
 watchfiles==1.3.0
     # via uvicorn
 websockets==17.3
     # via uvicorn
-

tests/test_host.py

@@ -1,53 +1,39 @@
 import asyncio
+import logging
 import os
 import sys
-
-root_dir = os.path.abspath(os.path.join(os.path.dirname(__file__), ".."))
-if root_dir not in sys.path:
-    sys.path.insert(0, root_dir)
-
-import logging
 import types
 import pytest
 from fastapi import APIRouter
 from fastapi.testclient import TestClient
 
+root_dir = os.path.abspath(os.path.join(os.path.dirname(__file__), ".."))
+if root_dir not in sys.path:
+    sys.path.insert(0, root_dir)
+
 
 def create_mock_modules():
-    p1 = types.ModuleType("mock_p1")
-    p1_router_mod = types.ModuleType("mock_p1.router")
-    r1 = APIRouter()
+    sem = types.ModuleType("mock_semantic")
+    sem_router_mod = types.ModuleType("mock_semantic.router")
+    r = APIRouter()
 
-    @r1.get("/ping")
-    def ping_p1():
-        return {"project": "p1", "status": "ok"}
+    @r.get("/ping")
+    def ping():
+        return {"project": "semantic", "status": "ok"}
 
-    @r1.post("/echo")
-    def echo_p1(data: dict):
-        return {"project": "p1", "echo": data}
+    @r.post("/echo")
+    def echo(data: dict):
+        return {"project": "semantic", "echo": data}
 
-    @r1.get("/slow")
-    async def slow_p1():
+    @r.get("/slow")
+    async def slow():
         await asyncio.sleep(0.5)
         return {"status": "finished"}
 
-    p1_router_mod.router = r1
-    p1.router = p1_router_mod
-    sys.modules["mock_p1"] = p1
-    sys.modules["mock_p1.router"] = p1_router_mod
-
-    p2 = types.ModuleType("mock_p2")
-    p2_router_mod = types.ModuleType("mock_p2.router")
-    r2 = APIRouter()
-
-    @r2.get("/ping")
-    def ping_p2():
-        return {"project": "p2", "status": "ok"}
-
-    p2_router_mod.router = r2
-    p2.router = p2_router_mod
-    sys.modules["mock_p2"] = p2
-    sys.modules["mock_p2.router"] = p2_router_mod
+    sem_router_mod.router = r
+    sem.router = sem_router_mod
+    sys.modules["mock_semantic"] = sem
+    sys.modules["mock_semantic.router"] = sem_router_mod
 
 
 def test_host_with_mocks(monkeypatch, caplog):
@@ -60,9 +46,8 @@ def test_host_with_mocks(monkeypatch, caplog):
 
     import registry
     registry.PROJECT_REGISTRY = {
-        "/project-1": "mock_p1.router:router",
-        "/project-2": "mock_p2.router:router",
-        "/project-3": "nonexistent_module.router:router",
+        "/semantic": "mock_semantic.router:router",
+        "/broken": "nonexistent_module.router:router",
     }
 
     if "main" in sys.modules:
@@ -72,58 +57,56 @@ def test_host_with_mocks(monkeypatch, caplog):
         import main
         client = TestClient(main.app)
 
-    assert "[/project-1] Successfully mounted at /project-1" in caplog.text
-    assert "[/project-2] Successfully mounted at /project-2" in caplog.text
-    assert "[/project-3] Failed to mount router" in caplog.text
+    assert "[/semantic] Successfully mounted at /semantic" in caplog.text
+    assert "[/broken] Failed to mount router" in caplog.text
 
     res_health = client.get("/health")
     assert res_health.status_code == 200
     health_data = res_health.json()
     assert health_data["status"] == "degraded"
-    assert "/project-1" in health_data["loaded"]
-    assert "/project-2" in health_data["loaded"]
-    assert "/project-3" in health_data["failed"]
+    assert "/semantic" in health_data["loaded"]
+    assert "/broken" in health_data["failed"]
 
-    res_p1 = client.get("/project-1/ping")
-    assert res_p1.status_code == 200
-    assert res_p1.json() == {"project": "p1", "status": "ok"}
+    # Verify GET / returns same info as /health
+    res_root = client.get("/")
+    assert res_root.status_code == 200
+    assert res_root.json() == health_data
 
-    res_p2 = client.get("/project-2/ping")
-    assert res_p2.status_code == 200
-    assert res_p2.json() == {"project": "p2", "status": "ok"}
+    res_sem = client.get("/semantic/ping")
+    assert res_sem.status_code == 200
+    assert res_sem.json() == {"project": "semantic", "status": "ok"}
 
     for doc_url in ["/docs", "/redoc", "/openapi.json"]:
         assert client.get(doc_url).status_code == 404
 
     cors_allowed = client.get(
-        "/project-1/ping",
+        "/semantic/ping",
         headers={"Origin": "https://allowed.com"}
     )
     assert cors_allowed.status_code == 200
     assert cors_allowed.headers.get("access-control-allow-origin") == "https://allowed.com"
 
     cors_rejected = client.get(
-        "/project-1/ping",
+        "/semantic/ping",
         headers={"Origin": "https://disallowed.com"}
     )
     assert cors_rejected.headers.get("access-control-allow-origin") is None
 
     oversized_data = {"text": "a" * 2000}
-    res_oversized = client.post("/project-1/echo", json=oversized_data)
+    res_oversized = client.post("/semantic/echo", json=oversized_data)
     assert res_oversized.status_code == 413
 
-    res_slow = client.get("/project-1/slow")
+    res_slow = client.get("/semantic/slow")
     assert res_slow.status_code == 504
 
 
 def test_kill_switch(monkeypatch):
     create_mock_modules()
-    monkeypatch.setenv("DISABLE_PROJECTS", "project-2")
+    monkeypatch.setenv("DISABLE_PROJECTS", "semantic")
 
     import registry
     registry.PROJECT_REGISTRY = {
-        "/project-1": "mock_p1.router:router",
-        "/project-2": "mock_p2.router:router",
+        "/semantic": "mock_semantic.router:router",
     }
 
     if "main" in sys.modules:
@@ -134,12 +117,10 @@ def test_kill_switch(monkeypatch):
 
     res_health = client.get("/health")
     health_data = res_health.json()
-    assert "/project-1" in health_data["loaded"]
-    assert "/project-2" not in health_data["loaded"]
-    assert "/project-2" not in health_data["failed"]
+    assert "/semantic" not in health_data["loaded"]
+    assert "/semantic" not in health_data["failed"]
 
-    assert client.get("/project-1/ping").status_code == 200
-    assert client.get("/project-2/ping").status_code == 404
+    assert client.get("/semantic/ping").status_code == 404
 
 
 def test_healthy_status_when_all_load(monkeypatch):
@@ -148,8 +129,7 @@ def test_healthy_status_when_all_load(monkeypatch):
 
     import registry
     registry.PROJECT_REGISTRY = {
-        "/project-1": "mock_p1.router:router",
-        "/project-2": "mock_p2.router:router",
+        "/semantic": "mock_semantic.router:router",
     }
 
     if "main" in sys.modules:
@@ -161,3 +141,33 @@ def test_healthy_status_when_all_load(monkeypatch):
     res_health = client.get("/health")
     assert res_health.status_code == 200
     assert res_health.json()["status"] == "healthy"
+    assert "/semantic" in res_health.json()["loaded"]
+
+    res_root = client.get("/")
+    assert res_root.status_code == 200
+    assert res_root.json() == res_health.json()
+
+
+def test_real_registry():
+    import importlib
+    import registry
+    importlib.reload(registry)
+    assert list(registry.PROJECT_REGISTRY.keys()) == ["/semantic"]
+    assert registry.PROJECT_REGISTRY["/semantic"] == "semantic_backend.router:router"
+
+    if "main" in sys.modules:
+        del sys.modules["main"]
+
+    import main
+    client = TestClient(main.app)
+
+    res = client.get("/health")
+    assert res.status_code == 200
+    data = res.json()
+    assert data["status"] == "healthy"
+    assert "/semantic" in data["loaded"]
+    assert not data["failed"]
+
+    res_root = client.get("/")
+    assert res_root.status_code == 200
+    assert res_root.json() == data