Derive submission model name from verified repository URL

README.md

@@ -58,3 +58,5 @@ Limits: ZIP ≤8 GiB, expanded contents ≤24 GiB, each member ≤128 MiB, ≤40
 Local development of storage only: set `INTREAL_LOCAL_STORAGE=1` and `SUBMISSIONS_DIR` to a scratch directory. This never enables a fake sign-in and is ignored in a Space. Production OAuth must be tested on the Space before enabling real submissions. Use `python -m pytest tests` for backend checks.
 
 Storage admission checks account for the configured 32 GiB intake quota, existing files, pending reservations, and filesystem free space before receiving a ZIP. Disk-full/quota errors during upload are rejected and incomplete files removed. The form disables submission when full and directs users to `shaohanyu628@gmail.com` to request storage management and retry later. Filesystem capacity is not a direct measurement of the HF account-wide Hub storage quota; remote quota write failures are also handled.
+
+Submission model names are derived server-side from the verified HF repository URL; submitters do not enter a separate name.

static/submit.html

@@ -20,7 +20,6 @@
         <form id="submission-form">
           <fieldset id="submission-fields" disabled>
             <div class="form-grid">
-              <label class="field full"><span>Model name *</span><input name="model_name" required maxlength="160" placeholder="Your model name"></label>
               <label class="field full"><span>Hugging Face model URL *</span><input name="model_url" type="url" required maxlength="240" placeholder="https://huggingface.co/your-username/model-name"><small>Public, ungated, with weights and an open license. The owner must match your signed-in account.</small></label>
               <label class="field"><span>Hugging Face username *</span><input id="hf-username" name="username" readonly required autocomplete="off"><small>Automatically verified through Hugging Face sign-in.</small></label>
               <label class="field"><span>Contact email *</span><input name="email" type="email" required maxlength="254" autocomplete="email" placeholder="you@example.com"></label>

submission_backend.py

@@ -302,13 +302,11 @@ def install_submissions(app):
                 raise HTTPException(413, "Form data is too large.")
         try:
             body = json.loads(body_bytes)
-            name = body.get("model_name", "").strip()
-            if not 1 <= len(name) <= 160:
-                raise ValueError("Model name is required (maximum 160 characters).")
             email = validate_email(body.get("email", ""), check_deliverability=False).normalized
             if body.get("username") != user["username"]:
                 raise ValueError("Submitted HF username must match your signed-in account.")
             repo_id = model_id_from_url(body.get("model_url", ""), user["username"])
+            name = repo_id.split("/", 1)[1]
             filename = body.get("filename", "")
             if not filename.lower().endswith(".zip") or "/" in filename or "\\" in filename or len(filename) > 200:
                 raise ValueError("Choose a .zip archive.")

tests/test_submissions.py

@@ -116,7 +116,7 @@ def service(tmp_path, monkeypatch):
 
 
 def form(data):
-    return {'model_name': 'My model', 'model_url': 'https://huggingface.co/alice/model', 'username': 'alice', 'email': 'alice@example.com', 'filename': 'outputs.zip', 'size': len(data)}
+    return {'model_url': 'https://huggingface.co/alice/model', 'username': 'alice', 'email': 'alice@example.com', 'filename': 'outputs.zip', 'size': len(data)}
 
 
 def sign_in(client, username='alice'):
@@ -289,3 +289,13 @@ def test_disk_fills_during_upload_cleans_partial(service, monkeypatch):
     assert 'shaohanyu628@gmail.com' in response.json()['detail']
     assert not (root/sid/'outputs.zip.part').exists()
     assert not (root/sid/'outputs.zip').exists()
+
+
+def test_model_name_is_derived_and_not_user_controlled(service):
+    client, root = service
+    sign_in(client)
+    payload = form(archive_bytes()) | {'model_name': 'forged display name'}
+    response = client.post('/api/submissions', json=payload, headers={'X-CSRF-Token':'csrf-test'})
+    assert response.status_code == 200
+    record = json.loads((root / response.json()['id'] / 'metadata.json').read_text())
+    assert record['model_name'] == 'model'