Update app.py

app.py

@@ -62,10 +62,10 @@ ALLOWED_MODELS: frozenset[str] = frozenset(
 )
 
 HTTP_TIMEOUT = httpx.Timeout(
-    connect=10.0,
-    read=120.0,
-    write=30.0,
-    pool=10.0,
+    connect=float(os.environ.get("PROXY_CONNECT_TIMEOUT", "10")),
+    read=float(os.environ.get("PROXY_READ_TIMEOUT", "120")),
+    write=float(os.environ.get("PROXY_WRITE_TIMEOUT", "30")),
+    pool=float(os.environ.get("PROXY_POOL_TIMEOUT", "10")),
 )
 
 # ---------------------------------------------------------------------------
@@ -80,9 +80,16 @@ app = FastAPI(
     redoc_url=None,
 )
 
+# ["*"]
+cors_origins = [
+    origin.strip()
+    for origin in os.environ.get("CORS_ALLOW_ORIGINS", "*").split(",")
+    if origin.strip()
+]
+
 app.add_middleware(
     CORSMiddleware,
-    allow_origins=["*"],
+    allow_origins=cors_origins,
     allow_credentials=False,
     allow_methods=["GET", "POST", "OPTIONS"],
     allow_headers=["*"],
@@ -104,10 +111,14 @@ def _parse_json_body(body: bytes) -> dict[str, Any]:
 def _parse_model(body: bytes) -> str:
     """Extract model parameter and map obsolete legacy parameters cleanly."""
     data = _parse_json_body(body)
-    model = str(data.get("model", "")).strip()
-    
-    if not model or model in ("openai/gpt-oss-20b", "scikit-plots/gpt-oss-20b"):
-        return DEFAULT_MODEL
+    model = str(data.get("model", "")).strip() or DEFAULT_MODEL
+
+    if model not in ALLOWED_MODELS:
+        raise HTTPException(
+            status_code=400,
+            detail=f"Unsupported model: {model}",
+        )
+
     return model
 
 
@@ -213,7 +224,10 @@ async def _forward(body: bytes, request: Request | None = None) -> Response:
             try:
                 async with httpx.AsyncClient(timeout=HTTP_TIMEOUT) as client:
                     async with client.stream(
-                        "POST", url, content=updated_body, headers=headers
+                        "POST",
+                        url,
+                        content=updated_body,
+                        headers=headers,
                     ) as hf_resp:
                         
                         if hf_resp.status_code >= 400:
@@ -276,7 +290,11 @@ async def _forward(body: bytes, request: Request | None = None) -> Response:
     # Non-streaming processing block
     try:
         async with httpx.AsyncClient(timeout=HTTP_TIMEOUT) as client:
-            hf_resp = await client.post(url, content=updated_body, headers=headers)
+            hf_resp = await client.post(
+                url,
+                content=updated_body,
+                headers=headers,
+            )
     except httpx.HTTPError as exc:
         return _map_httpx_exception(exc)
 
@@ -291,7 +309,10 @@ async def _forward(body: bytes, request: Request | None = None) -> Response:
     return Response(
         content=hf_resp.content,
         status_code=hf_resp.status_code,
-        media_type=hf_resp.headers.get("content-type", "application/json"),
+        media_type=hf_resp.headers.get(
+            "content-type",
+            "application/json",
+        ),
     )
 
 # ---------------------------------------------------------------------------