Deploy backend from GitHub 28569ae75e2626967d5da9227e391b2d7576d82b

backend/app/core/config.py

@@ -1,17 +1,16 @@
 """
 Configuration module for the LLM Misuse Detection backend.
-Reads all settings from environment variables.
-
-Env vars: FIREBASE_PROJECT_ID, FIREBASE_CREDENTIALS_JSON,
-          REDIS_URL, HF_API_KEY, GROQ_API_KEY,
-          SENTRY_DSN, CORS_ORIGINS
+NOTE on HF Inference API (updated July 2025):
+  The old api-inference.huggingface.co returns 410 for most models.
+  Use router.huggingface.co/hf-inference instead.
 """
 from pydantic_settings import BaseSettings
 from typing import Optional, List
 
+_HF_ROUTER = "https://router.huggingface.co/hf-inference/models"
+
 
 class Settings(BaseSettings):
-    # Application
     APP_NAME: str = "LLM Misuse Detector"
     DEBUG: bool = False
 
@@ -22,23 +21,23 @@ class Settings(BaseSettings):
     # Redis
     REDIS_URL: str = "redis://localhost:6379/0"
 
-    # CORS – defaults include both production frontend and local dev
+    # CORS
     CORS_ORIGINS: str = "https://security-three-mu.vercel.app,http://localhost:3000"
 
-    # HuggingFace Inference API
+    # HuggingFace
     HF_API_KEY: str = ""
-    HF_DETECTOR_PRIMARY: str = "https://api-inference.huggingface.co/models/desklib/ai-text-detector-v1.01"
-    HF_DETECTOR_FALLBACK: str = "https://api-inference.huggingface.co/models/fakespot-ai/roberta-base-ai-text-detection-v1"
-    HF_EMBEDDINGS_PRIMARY: str = "https://api-inference.huggingface.co/models/sentence-transformers/all-mpnet-base-v2"
-    HF_EMBEDDINGS_FALLBACK: str = "https://api-inference.huggingface.co/models/sentence-transformers/all-MiniLM-L6-v2"
-    HF_HARM_CLASSIFIER: str = "https://api-inference.huggingface.co/models/facebook/roberta-hate-speech-dynabench-r4-target"
+    HF_DETECTOR_PRIMARY: str = f"{_HF_ROUTER}/roberta-base-openai-detector"
+    HF_DETECTOR_FALLBACK: str = f"{_HF_ROUTER}/Hello-SimpleAI/chatgpt-detector-roberta"
+    HF_EMBEDDINGS_PRIMARY: str = f"{_HF_ROUTER}/sentence-transformers/all-MiniLM-L6-v2"
+    HF_EMBEDDINGS_FALLBACK: str = f"{_HF_ROUTER}/sentence-transformers/paraphrase-MiniLM-L3-v2"
+    HF_HARM_CLASSIFIER: str = f"{_HF_ROUTER}/facebook/roberta-hate-speech-dynabench-r4-target"
 
     # Groq
     GROQ_API_KEY: str = ""
     GROQ_MODEL: str = "llama-3.3-70b-versatile"
     GROQ_BASE_URL: str = "https://api.groq.com/openai/v1"
 
-    # Vector DB (Qdrant Cloud)
+    # Qdrant
     QDRANT_URL: str = "http://localhost:6333"
     QDRANT_API_KEY: Optional[str] = None
     QDRANT_COLLECTION: str = "sentinel_embeddings"
@@ -55,10 +54,7 @@ class Settings(BaseSettings):
     WEIGHT_STYLOMETRY: float = 0.10
     WEIGHT_WATERMARK: float = 0.05
 
-    # Cost control
     PERPLEXITY_THRESHOLD: float = 0.3
-
-    # Rate limiting
     RATE_LIMIT_PER_MINUTE: int = 30
 
     @property

backend/app/db/firestore.py

@@ -1,13 +1,13 @@
 """
 Firebase Admin SDK initialisation and Firestore client.
 
-Priority for credentials (in order):
-  1. FIREBASE_CREDENTIALS_JSON env var  – JSON string of the service account
-     (paste the whole file contents as a single escaped string in Render/CI)
-  2. GOOGLE_APPLICATION_CREDENTIALS env var – path to the JSON file on disk
-     (recommended for local development)
+Fixes:
+  - Handles escaped newlines in private_key when FIREBASE_CREDENTIALS_JSON
+    is pasted as a single-line string (\\n must become \n for JWT signing).
 
-Call `get_db()` anywhere to obtain the Firestore async client.
+Priority for credentials:
+  1. FIREBASE_CREDENTIALS_JSON env var (JSON string, production)
+  2. GOOGLE_APPLICATION_CREDENTIALS env var (path to file, local dev)
 """
 import json
 import os
@@ -16,11 +16,26 @@ import firebase_admin
 from firebase_admin import credentials, firestore
 
 from backend.app.core.config import settings
+from backend.app.core.logging import get_logger
+
+logger = get_logger(__name__)
 
 _app: firebase_admin.App | None = None
 _db = None
 
 
+def _fix_private_key(cred_dict: dict) -> dict:
+    """
+    When a service account JSON is pasted as a single-line env var, the
+    private_key newlines get double-escaped as \\n instead of \n.
+    This causes 'Invalid JWT Signature' errors at runtime.
+    Fix: replace literal \\n with real newline in private_key only.
+    """
+    if "private_key" in cred_dict:
+        cred_dict["private_key"] = cred_dict["private_key"].replace("\\n", "\n")
+    return cred_dict
+
+
 def init_firebase() -> None:
     """Initialise the Firebase Admin SDK (idempotent)."""
     global _app, _db
@@ -28,11 +43,10 @@ def init_firebase() -> None:
         return
 
     if settings.FIREBASE_CREDENTIALS_JSON:
-        # Credentials supplied as a JSON string (production / Render)
         cred_dict = json.loads(settings.FIREBASE_CREDENTIALS_JSON)
+        cred_dict = _fix_private_key(cred_dict)
         cred = credentials.Certificate(cred_dict)
     elif os.getenv("GOOGLE_APPLICATION_CREDENTIALS"):
-        # Path to JSON file on disk (local dev)
         cred = credentials.ApplicationDefault()
     else:
         raise RuntimeError(
@@ -45,10 +59,10 @@ def init_firebase() -> None:
         {"projectId": settings.FIREBASE_PROJECT_ID},
     )
     _db = firestore.client()
+    logger.info("Firebase Admin SDK initialised", project=settings.FIREBASE_PROJECT_ID)
 
 
 def get_db():
-    """Return the Firestore client. Call init_firebase() first."""
     if _db is None:
         raise RuntimeError("Firestore not initialised. Call init_firebase() on startup.")
     return _db