[CoreyLeath-code]

Summary

• require the existing bearer token for POST /predict, which invokes the model directly
• apply an independent rate limit to prediction requests
• reject NaN and infinite model features before tensor construction
• bound POST /infer prompts to 1–4,000 characters
• document the shared authentication requirement in the README and example environment
• add regression coverage for authorization and request validation

Validation

Repository CI will run the Python test suite, containerized ingestion smoke test, security audit, SAST, data validation, AWS telemetry checks, and benchmark workflow as configured.

Compatibility

/predict now intentionally fails closed with HTTP 503 until API_BEARER_TOKEN is configured, matching the established /infer contract.

Summary by CodeRabbit

• Security
  • /predict now requires bearer authentication and returns 503 when the shared token is not configured.
  • /predict is limited to 30 requests per minute.
• Validation
  • Prompts must contain 1–4,000 characters.
  • Non-finite numeric values are rejected in prediction requests.

[chatgpt-codex-connector]

Codex Review Summary: ✅ Completed

This comment shows the latest Codex review activity on this pull request.

Review	Status	Commit	Review trigger
📝 Code Review	✅ Completed 2026-11-13T16:27:34.307596Z	b331d45	PR opened

ℹ️ About Codex in GitHub

Your team has set up Codex to review pull requests in this repo. Reviews are triggered when you

• Open a pull request for review
• Mark a draft as ready
• Comment "@codex review" or "@codex security review".

Codex reacts with 👀 while any review is running, comments if it has suggestions, and reacts with 👍 once all reviews finish with no findings.

[coderabbitai]

Caution

Review failed

The pull request is closed.

Walkthrough

The API now validates prompt lengths and finite feature values. The /predict endpoint requires bearer authentication and applies a limit of 30 requests per minute. Tests and configuration documentation cover these changes.

Changes: API request controls

Layer / File(s)	Summary
Request validation api/main.py, tests/test_inference.py	PromptRequest.prompt must contain 1–4,000 characters. RequestModel rejects non-finite values. Tests check invalid prompt lengths and non-finite prediction features.
Prediction endpoint controls api/main.py, tests/test_auth.py, tests/test_predict.py, .env.example, README.md	/predict now requires bearer authentication and applies a limit of 30 requests per minute. Tests cover token configuration, missing or invalid tokens, and prediction responses. Both configuration references document the token requirement for /infer and /predict.

Estimated code review effort: 2 (Simple) | ~10 minutes

Change: Bug fix

Sequence Diagram(s)

sequenceDiagram
  participant Client
  participant predict
  participant _require_bearer
  participant Inference
  Client->>predict: POST /predict with request body
  predict->>_require_bearer: Check bearer token
  _require_bearer-->>predict: Authorize request
  predict->>Inference: Pass body.features

Loading

Suggested reviewers: copilot

Merge Risk: Low · up to b331d

Sending an extremely large numeric feature value to /predict may produce a server error instead of a clean 422 validation response. This is a narrow edge case with no data or security impact, so the change is mergeable, and a small follow-up fix is advisable.

- [ ] Autofix · Keep fixing CodeRabbit findings and required CI, and resolving merge conflicts

Thanks for using CodeRabbit! It's free for OSS, and your support helps us grow. If you like it, consider giving us a shout-out.

Share

• X
• Mastodon
• Reddit
• LinkedIn