Upload app.py

app.py

@@ -160,6 +160,10 @@ def _load_url_model():
                     _url_bundle = joblib.load(model_path)
 
 
+def _normalize_url_string(url: str) -> str:
+    return (url or "").strip().rstrip("/")
+
+
 @app.get("/")
 def root():
     return {"status": "ok", "backend": "url-only"}
@@ -188,6 +192,28 @@ def predict_url(payload: PredictUrlPayload):
         if not url_str:
             return JSONResponse(status_code=400, content={"error": "Empty url"})
 
+        # URL-level override via CSV lists (normalized exact match, ignoring trailing slash)
+        norm_url = _normalize_url_string(url_str)
+        phishy_set = { _normalize_url_string(u) for u in phishy_list }
+        legit_set = { _normalize_url_string(u) for u in legit_list }
+
+        if norm_url in phishy_set or norm_url in legit_set:
+            phish_is_positive = True if URL_POSITIVE_CLASS_ENV == "" else (URL_POSITIVE_CLASS_ENV == "PHISH")
+            label = "PHISH" if norm_url in phishy_set else "LEGIT"
+            predicted_label = 1 if ((label == "PHISH") == phish_is_positive) else 0
+            phish_proba = 0.99 if label == "PHISH" else 0.01
+            score = phish_proba if label == "PHISH" else (1.0 - phish_proba)
+            return {
+                "label": label,
+                "predicted_label": int(predicted_label),
+                "score": float(score),
+                "phishing_probability": float(phish_proba),
+                "backend": str(model_type),
+                "threshold": 0.5,
+                "url_col": url_col,
+                "override": {"reason": "csv_url_match"},
+            }
+
         # Known-host override (suffix match)
         host = (urlparse(url_str).hostname or "").lower()
         if host and host_map: