Update main.py

main.py

@@ -38,20 +38,21 @@ def _get_pinecone(api_key: str) -> Pinecone:
     _pinecone_pool.move_to_end(api_key)
     return _pinecone_pool[api_key]
 
-# Cloudinary helpers — credentials injected per-call, never globally configured.
-# This is the ONLY safe pattern when multiple users share one server process.
-def _cld_upload(tmp_path: str, folder: str, creds: dict):
+# ── Cloudinary: credentials injected per-call, NEVER globally configured.
+# If cloudinary.config() is called once, it applies to the whole process —
+# User A's credentials would bleed into User B's request under concurrency.
+def _cld_upload(tmp_path, folder, creds):
     return cloudinary.uploader.upload(
         tmp_path, folder=folder,
         api_key=creds["api_key"], api_secret=creds["api_secret"], cloud_name=creds["cloud_name"],
     )
 
-def _cld_ping(creds: dict):
+def _cld_ping(creds):
     return cloudinary.api.ping(
         api_key=creds["api_key"], api_secret=creds["api_secret"], cloud_name=creds["cloud_name"],
     )
 
-def _cld_root_folders(creds: dict):
+def _cld_root_folders(creds):
     return cloudinary.api.root_folders(
         api_key=creds["api_key"], api_secret=creds["api_secret"], cloud_name=creds["cloud_name"],
     )
@@ -93,9 +94,9 @@ def get_cloudinary_creds(env_url: str) -> dict:
 async def verify_keys(pinecone_key: str = Form(""), cloudinary_url: str = Form("")):
     if cloudinary_url:
         try:
-            creds = get_cloudinary_creds(cloudinary_url)
-            if not creds.get("cloud_name"): raise ValueError("bad url")
-            await asyncio.to_thread(_cld_ping, creds)
+            creds_v = get_cloudinary_creds(cloudinary_url)
+            if not creds_v.get("cloud_name"): raise ValueError("bad url")
+            await asyncio.to_thread(_cld_ping, creds_v)
         except HTTPException: raise
         except Exception:
             raise HTTPException(400, "Invalid Cloudinary Environment URL.")
@@ -120,13 +121,12 @@ async def verify_keys(pinecone_key: str = Form(""), cloudinary_url: str = Form("
 # ══════════════════════════════════════════════════════════════════
 @app.post("/api/upload")
 async def upload_new_images(files: List[UploadFile] = File(...), folder_name: str = Form(...), detect_faces: bool = Form(True), user_pinecone_key: str = Form(""), user_cloudinary_url: str = Form("")):
-    # Frontend always sends the correct keys (guest keys = hardcoded in App.jsx,
-    # PRO keys = from Supabase). Backend never falls back to env vars here.
-    actual_pc_key  = (user_pinecone_key  or "").strip()
-    actual_cld_url = (user_cloudinary_url or "").strip()
-
+    # DEFENSIVE FIX: The 'or ""' ensures it never becomes None, preventing 500 crashes
+    actual_pc_key = user_pinecone_key or os.getenv("DEFAULT_PINECONE_KEY", "")
+    actual_cld_url = user_cloudinary_url or os.getenv("DEFAULT_CLOUDINARY_URL", "")
+    
     if not actual_pc_key or not actual_cld_url:
-        raise HTTPException(400, "API keys missing. Configure them in Settings or check the app.")
+        raise HTTPException(400, "API Keys are missing. If you are a guest, the server is missing its DEFAULT_ secrets in Hugging Face.")
 
     folder = standardize_category_name(folder_name)
     uploaded_urls = []
@@ -135,8 +135,8 @@ async def upload_new_images(files: List[UploadFile] = File(...), folder_name: st
     if not creds.get("cloud_name"):
         raise HTTPException(400, "Invalid Cloudinary URL format.")
         
-    pc       = _get_pinecone(actual_pc_key)
-    idx_obj  = pc.Index(IDX_OBJECTS)
+    pc = _get_pinecone(actual_pc_key)
+    idx_obj = pc.Index(IDX_OBJECTS)
     idx_face = pc.Index(IDX_FACES)
 
     for file in files:
@@ -144,7 +144,7 @@ async def upload_new_images(files: List[UploadFile] = File(...), folder_name: st
         try:
             with open(tmp_path, "wb") as buf:
                 shutil.copyfileobj(file.file, buf)
-
+                
             res = await asyncio.to_thread(_cld_upload, tmp_path, folder, creds)
             image_url = res["secure_url"]
             uploaded_urls.append(image_url)
@@ -176,9 +176,9 @@ async def upload_new_images(files: List[UploadFile] = File(...), folder_name: st
 # ══════════════════════════════════════════════════════════════════
 @app.post("/api/search")
 async def search_database(file: UploadFile = File(...), detect_faces: bool = Form(True), user_pinecone_key: str = Form(""), user_cloudinary_url: str = Form("")):
-    actual_pc_key = (user_pinecone_key or "").strip()
+    actual_pc_key = user_pinecone_key or os.getenv("DEFAULT_PINECONE_KEY", "")
     if not actual_pc_key:
-        raise HTTPException(400, "Pinecone key missing.")
+        raise HTTPException(400, "Pinecone Key is missing. If you are a guest, the server is missing its DEFAULT_PINECONE_KEY in Hugging Face.")
 
     tmp_path = f"temp_uploads/query_{uuid.uuid4().hex}_{sanitize_filename(file.filename)}"
     try:
@@ -205,8 +205,37 @@ async def search_database(file: UploadFile = File(...), detect_faces: bool = For
                 
             out = []
             for match in res.get("matches", []):
-                caption = "👤 Verified Identity" if vec_dict["type"] == "face" else match["metadata"].get("folder", "🎯 Object Match")
-                out.append({"url": match["metadata"].get("url", ""), "score": match["score"], "caption": caption})
+                score = match["score"]
+                is_face = vec_dict["type"] == "face"
+
+                # ── Score filtering ──────────────────────────────────────
+                # Face lane: RetinaFace+GhostFaceNet 512-D cosine similarity.
+                # Raw scores cluster around 0.3-0.5 for same person; anything
+                # below 0.30 is noise. We remap to 75-99% for the UI.
+                if is_face:
+                    RAW_THRESHOLD = 0.30
+                    if score < RAW_THRESHOLD:
+                        continue
+                    ui_score = 0.75 + ((score - RAW_THRESHOLD) / (1.0 - RAW_THRESHOLD)) * 0.24
+                    ui_score = min(0.99, ui_score)
+                else:
+                    # Object lane: SigLIP+DINOv2 1536-D fused cosine similarity.
+                    # These vectors are dense and high-dimensional — even completely
+                    # different images can score 0.70-0.80 just by chance.
+                    # 0.82+ = genuinely similar images (same animal, same scene type)
+                    # 0.70-0.82 = loosely related (outdoor vs outdoor, animal vs animal)
+                    # < 0.70 = unrelated — hard filter these out entirely
+                    MIN_OBJECT_SCORE = 0.70
+                    if score < MIN_OBJECT_SCORE:
+                        continue
+                    ui_score = score
+
+                caption = "👤 Verified Identity" if is_face else match["metadata"].get("folder", "🎯 Object Match")
+                out.append({
+                    "url":     match["metadata"].get("url", ""),
+                    "score":   round(ui_score, 4),
+                    "caption": caption,
+                })
             return out
 
         nested = await asyncio.gather(*[_query_one(v) for v in vectors])
@@ -233,7 +262,7 @@ async def search_database(file: UploadFile = File(...), detect_faces: bool = For
 # ══════════════════════════════════════════════════════════════════
 @app.post("/api/categories")
 async def get_categories(user_cloudinary_url: str = Form("")):
-    actual_cld_url = (user_cloudinary_url or "").strip()
+    actual_cld_url = user_cloudinary_url or os.getenv("DEFAULT_CLOUDINARY_URL", "")
     if not actual_cld_url:
         return {"categories": []}