feat(hf-space): enforce submission cooldown and switch leaderboard reads to boto3

- add 8-hour per-track submission cooldown checks in submit flow
- add helper to fetch last submission timestamp from S3 metadata objects
- replace pandas+s3fs leaderboard reads with boto3 get_object + in-memory CSV parsing (Avoids 403 Forbidden error)
- change leaderboard config paths to S3 keys (bucket configured separately)
- remove s3fs dependency from hf_space requirements
- grant hf-space IAM user s3:ListBucket on submissions prefixes for cooldown lookup

app.py

@@ -1,7 +1,10 @@
+import io
 import tempfile
 import zipfile
+from datetime import datetime, timezone
 from pathlib import Path
 
+import boto3
 import gradio as gr
 import numpy as np
 import pandas as pd
@@ -9,14 +12,18 @@ from config import (
     ACTIVITY_DATASET_SIZE,
     ACTIVITY_LEADERBOARD_S3,
     REQUIRED_ACTIVITY_COLUMNS,
+    S3_BUCKET,
     STRUCTURE_DATASET_SIZE,
     STRUCTURE_LEADERBOARD_S3,
+    TIME_BETWEEN_SUBMISSIONS,
 )
 from gradio.themes.utils import sizes
 from gradio_leaderboard import Leaderboard
 from loguru import logger
-from models import Submission
-from submission_store import upload_submission
+from models import Submission, _safeify_username
+from submission_store import _fetch_last_submission_date, upload_submission
+
+s3_client = boto3.client("s3", region_name="us-east-1")
 
 
 def make_user_clickable(name: str) -> str:
@@ -48,6 +55,7 @@ def _collapse_mean_std(df: pd.DataFrame, metrics: list[str]) -> pd.DataFrame:
 
     Returns:
         DataFrame with combined columns replacing the original pairs.
+
     """
     df = df.copy()
     for metric in metrics:
@@ -55,19 +63,35 @@ def _collapse_mean_std(df: pd.DataFrame, metrics: list[str]) -> pd.DataFrame:
         std_col = f"{metric}_std"
         if mean_col in df.columns and std_col in df.columns:
             df[metric] = (
-                df[mean_col].map(_fmt_metric)
-                + "±"
-                + df[std_col].map(_fmt_metric)
+                df[mean_col].map(_fmt_metric) + "±" + df[std_col].map(_fmt_metric)
             )
             df = df.drop(columns=[mean_col, std_col])
     return df
 
 
 _ACTIVITY_EMPTY = pd.DataFrame(
-    columns=["rank", "username", "Submitted", "MAE", "RAE", "R2", "Spearman ρ", "Kendall's τ"]
+    columns=[
+        "rank",
+        "username",
+        "Submitted",
+        "MAE",
+        "RAE",
+        "R2",
+        "Spearman ρ",
+        "Kendall's τ",
+    ]
 )
 _STRUCTURE_EMPTY = pd.DataFrame(
-    columns=["rank", "username", "Submitted", "model_report_link", "LDDT-PLI", "BiSyRMSD", "Ligand RMSD", "LDDT-LP"]
+    columns=[
+        "rank",
+        "username",
+        "Submitted",
+        "model_report_link",
+        "LDDT-PLI",
+        "BiSyRMSD",
+        "Ligand RMSD",
+        "LDDT-LP",
+    ]
 )
 
 
@@ -75,12 +99,16 @@ def _prepare_activity_df(df: pd.DataFrame) -> pd.DataFrame:
     """Sort, collapse, and rename activity leaderboard columns (no HTML)."""
     df = df.sort_values("RAE_mean", ascending=True).reset_index(drop=True)
     df = _collapse_mean_std(df, ["MAE", "RAE", "R2", "Spearman_R", "Kendall's_Tau"])
-    df = df.rename(columns={
-        "Spearman_R": "Spearman ρ",
-        "Kendall's_Tau": "Kendall's τ",
-        "submitted_at": "Submitted",
-    })
-    df["Submitted"] = pd.to_datetime(df["Submitted"], utc=True).dt.strftime("%Y-%m-%d %H:%M UTC")
+    df = df.rename(
+        columns={
+            "Spearman_R": "Spearman ρ",
+            "Kendall's_Tau": "Kendall's τ",
+            "submitted_at": "Submitted",
+        }
+    )
+    df["Submitted"] = pd.to_datetime(df["Submitted"], utc=True).dt.strftime(
+        "%Y-%m-%d %H:%M UTC"
+    )
     return df
 
 
@@ -89,7 +117,9 @@ def _prepare_structure_df(df: pd.DataFrame) -> pd.DataFrame:
     df = df.sort_values("LDDT-PLI_mean", ascending=False).reset_index(drop=True)
     df = _collapse_mean_std(df, ["LDDT-PLI", "BiSyRMSD", "Ligand_RMSD", "LDDT-LP"])
     df = df.rename(columns={"Ligand_RMSD": "Ligand RMSD", "submitted_at": "Submitted"})
-    df["Submitted"] = pd.to_datetime(df["Submitted"], utc=True).dt.strftime("%Y-%m-%d %H:%M UTC")
+    df["Submitted"] = pd.to_datetime(df["Submitted"], utc=True).dt.strftime(
+        "%Y-%m-%d %H:%M UTC"
+    )
     df["model_report_link"] = df["model_report_link"].fillna("")
     return df
 
@@ -98,7 +128,11 @@ def load_activity_leaderboard() -> pd.DataFrame:
     """Load the activity leaderboard from S3."""
     logger.info("Refreshing activity leaderboard...")
     try:
-        df = pd.read_csv(ACTIVITY_LEADERBOARD_S3)
+        obj = s3_client.get_object(
+            Bucket=S3_BUCKET,
+            Key=ACTIVITY_LEADERBOARD_S3,
+        )
+        df = pd.read_csv(io.BytesIO(obj["Body"].read()))
     except Exception as exc:
         logger.warning("Could not load activity leaderboard: {}", exc)
         return _ACTIVITY_EMPTY
@@ -112,7 +146,11 @@ def load_structure_leaderboard() -> pd.DataFrame:
     """Load the structure leaderboard from S3."""
     logger.info("Refreshing structure leaderboard...")
     try:
-        df = pd.read_csv(STRUCTURE_LEADERBOARD_S3)
+        obj = s3_client.get_object(
+            Bucket=S3_BUCKET,
+            Key=STRUCTURE_LEADERBOARD_S3,
+        )
+        df = pd.read_csv(io.BytesIO(obj["Body"].read()))
     except Exception as exc:
         logger.warning("Could not load structure leaderboard: {}", exc)
         return _STRUCTURE_EMPTY
@@ -126,7 +164,11 @@ def load_structure_leaderboard() -> pd.DataFrame:
 def download_activity_leaderboard() -> str:
     """Write the activity leaderboard to a temp CSV and return the file path."""
     try:
-        df = pd.read_csv(ACTIVITY_LEADERBOARD_S3)
+        obj = s3_client.get_object(
+            Bucket=S3_BUCKET,
+            Key=ACTIVITY_LEADERBOARD_S3,
+        )
+        df = pd.read_csv(io.BytesIO(obj["Body"].read()))
     except Exception as exc:
         logger.warning("Could not load activity leaderboard for download: {}", exc)
         df = _ACTIVITY_EMPTY
@@ -141,7 +183,11 @@ def download_activity_leaderboard() -> str:
 def download_structure_leaderboard() -> str:
     """Write the structure leaderboard to a temp CSV and return the file path."""
     try:
-        df = pd.read_csv(STRUCTURE_LEADERBOARD_S3)
+        obj = s3_client.get_object(
+            Bucket=S3_BUCKET,
+            Key=STRUCTURE_LEADERBOARD_S3,
+        )
+        df = pd.read_csv(io.BytesIO(obj["Body"].read()))
     except Exception as exc:
         logger.warning("Could not load structure leaderboard for download: {}", exc)
         df = _STRUCTURE_EMPTY
@@ -153,6 +199,24 @@ def download_structure_leaderboard() -> str:
         return f.name
 
 
+def _format_submission_time_message(last_submission: datetime, track: str) -> str:
+    """Format a message indicating when the user can next submit next."""
+    track_name = "an activity" if track == "activity" else "a structure"
+    next_submission_time = last_submission + pd.Timedelta(
+        seconds=TIME_BETWEEN_SUBMISSIONS
+    )
+    time_remaining = next_submission_time - datetime.now(timezone.utc)
+    seconds_left = max(0, int(time_remaining.total_seconds()))
+    hours, rem = divmod(seconds_left, 3600)
+    minutes, seconds = divmod(rem, 60)
+    wait_str = f"{hours:02d}:{minutes:02d}:{seconds:02d}"
+    return (
+        f"Error: You submitted {track_name} prediction on "
+        f"{last_submission.strftime('%Y-%m-%d %H:%M:%S (UTC)')}.\n"
+        f"Please wait {wait_str} before submitting again."
+    )
+
+
 def submit_predictions(
     username,
     user_alias,
@@ -239,6 +303,23 @@ def submit_predictions(
             return gr.update(
                 value="Error: pEC50 column contains infinite values.", visible=True
             )
+        last_submission = _fetch_last_submission_date(
+            "activity", _safeify_username(username.strip())
+        )
+        logger.info(
+            f"Last submission date for user {username.strip()!r}: {last_submission}"
+        )
+        if (
+            last_submission
+            and (datetime.now(timezone.utc) - last_submission).total_seconds()
+            < TIME_BETWEEN_SUBMISSIONS
+        ):
+            return gr.update(
+                value=_format_submission_time_message(
+                    last_submission, track="activity"
+                ),
+                visible=True,
+            )
 
     elif track_select == "Structure Prediction":
         if file_path.suffix.lower() != ".zip":
@@ -257,6 +338,23 @@ def submit_predictions(
                 value=f"Error: Expected {STRUCTURE_DATASET_SIZE} files in zip, got {n_files}.",
                 visible=True,
             )
+        last_submission = _fetch_last_submission_date(
+            "structure", _safeify_username(username.strip())
+        )
+        logger.info(
+            f"Last submission date for user {username.strip()!r}: {last_submission}"
+        )
+        if (
+            last_submission
+            and (datetime.now(timezone.utc) - last_submission).total_seconds()
+            < TIME_BETWEEN_SUBMISSIONS
+        ):
+            return gr.update(
+                value=_format_submission_time_message(
+                    last_submission, track="structure"
+                ),
+                visible=True,
+            )
 
     # --- build submission model and persist to S3 ---
     submission = Submission(

config.py

@@ -5,8 +5,8 @@ import os
 ACTIVITY_DATASET_SIZE = 531
 STRUCTURE_DATASET_SIZE = 125
 REQUIRED_ACTIVITY_COLUMNS = {"SMILES", "Molecule Name", "pEC50"}
+TIME_BETWEEN_SUBMISSIONS = 28800  # 8 hours in seconds
 
 S3_BUCKET: str = os.environ.get("S3_BUCKET", "")
-ACTIVITY_LEADERBOARD_S3 = f"s3://{S3_BUCKET}/leaderboard/interim/activity/leaderboard_latest.csv"
-
-STRUCTURE_LEADERBOARD_S3 = f"s3://{S3_BUCKET}/leaderboard/interim/structure/leaderboard_latest.csv"
+ACTIVITY_LEADERBOARD_S3 = "leaderboard/interim/activity/leaderboard_latest.csv"
+STRUCTURE_LEADERBOARD_S3 = "leaderboard/interim/structure/leaderboard_latest.csv"

requirements.txt

@@ -8,5 +8,4 @@ scikit-learn
 loguru
 statsmodels
 tqdm
-boto3
-s3fs
+boto3

submission_store.py

@@ -19,8 +19,8 @@ AWS_ACCESS_KEY_ID / AWS_SECRET_ACCESS_KEY / AWS_DEFAULT_REGION
     Standard boto3 credentials — set via HuggingFace Space secrets.
 """
 
-import json
 import os
+from datetime import datetime, timezone
 from pathlib import Path
 
 import boto3
@@ -89,3 +89,54 @@ def upload_submission(submission: Submission, file_path: Path) -> Submission:
         )
 
     return submission
+
+
+def _fetch_last_submission_date(track: str, user_id: str) -> datetime | None:
+    """Fetch the submission date of the most recent submission for a track and user.
+
+    Args:
+        track (str): The track name (e.g., "activity" or "structure").
+        user_id (str): The user ID to check for previous submissions.
+
+    Returns:
+        datetime | None: The submission date of the most recent submission, or None if
+                         no previous submissions are found.
+
+    """
+    bucket = os.environ.get("S3_BUCKET")
+    if not bucket:
+        logger.warning(
+            "S3_BUCKET not set — cannot fetch last submission date. "
+            "Set S3_BUCKET and AWS credentials as Space secrets to enable this feature."
+        )
+        return None
+
+    s3 = boto3.client("s3")
+    prefix = f"submissions/{track}/{user_id}/"
+    try:
+        response = s3.list_objects_v2(Bucket=bucket, Prefix=prefix)
+        if response["IsTruncated"]:  # Unlikely to be > 1000 submissions per user
+            logger.warning(
+                f"ListObjectsV2 response truncated for prefix {prefix!r}. "
+                "Only the first 1000 objects will be considered."
+            )
+        if "Contents" not in response:
+            return None  # No submissions found
+
+        logger.info(
+            f"Found {len(response['Contents'])} objects under prefix {prefix!r}."
+        )
+        submission_dates = []
+        for obj in response["Contents"]:
+            if obj["Key"].endswith("metadata.json"):
+                submission_dates.append(obj["LastModified"])
+
+        if not submission_dates:  # Shouldn't be possible
+            logger.warning(f"No metadata.json files found under prefix {prefix!r}.")
+            return None
+
+        return max(submission_dates).astimezone(timezone.utc)
+
+    except Exception as exc:
+        logger.error(f"Failed to fetch last submission date for {user_id!r}: {exc}")
+        return None