add app

.gitignore

@@ -0,0 +1 @@
+.env

README.md

@@ -1,14 +1,46 @@
 ---
-title: Request Moderator
-emoji: 😻
-colorFrom: blue
-colorTo: yellow
+title: Hugging Science Requests Review
+emoji: 🔬
+colorFrom: indigo
+colorTo: purple
 sdk: gradio
-sdk_version: 6.20.0
-python_version: '3.13'
+sdk_version: 5.9.1
 app_file: app.py
 pinned: false
-license: apache-2.0
+hf_oauth: true
+hf_oauth_scopes:
+  - profile
 ---
 
-Check out the configuration reference at https://huggingface.co/docs/hub/spaces-config-reference
+# Hugging Science — requests review
+
+Standalone moderation tool for huggingscience.co, decoupled from the site's
+own deploy. It works alongside the existing `hugging-science/feedback-api`
+Space (see `../feedback-api/`), not instead of it:
+
+1. `FeedbackWidget` on the site POSTs every submission to
+   `hugging-science-feedback-api.hf.space/submit`, same as before.
+2. That Space now routes `type: "feedback"` to `feedback.jsonl` (unchanged)
+   and everything else — `dataset`/`model`/`organization`/`blog`/`challenge`
+   — to a new `requests.jsonl`, both in the `hugging-science/request` dataset.
+3. **This Space** reads `requests.jsonl`, lets the site owner approve or
+   reject each pending row, and on approve opens a GitHub pull request
+   against [`georgiachanning/huggingscience-dot-co`](https://github.com/georgiachanning/huggingscience-dot-co)
+   adding the entry to the right `src/data/*.js` file. The site owner still
+   reviews and merges that PR by hand — this tool only removes the manual
+   data-entry step, not the final review.
+
+## Required Space secrets
+
+| Secret | Purpose |
+| --- | --- |
+| `GITHUB_TOKEN` | Fine-grained PAT scoped to `georgiachanning/huggingscience-dot-co` with `contents:write` + `pull-requests:write`. |
+| `HF_TOKEN` | Write-scoped HF token for the `hugging-science` org, used to read/update `requests.jsonl`. |
+| `ADMIN_USERS` | Comma-separated Hugging Face usernames allowed into the admin UI. |
+
+## Optional Space variables
+
+| Variable | Default | Purpose |
+| --- | --- | --- |
+| `HF_DATASET_REPO` | `hugging-science/request` | Dataset repo holding both `feedback.jsonl` and `requests.jsonl`. |
+| `GITHUB_REPO` | `georgiachanning/huggingscience-dot-co` | Repo that approved requests open PRs against. |

about.py

@@ -0,0 +1,13 @@
+import os
+
+from dotenv import load_dotenv
+
+load_dotenv()
+
+DATASET_REPO = os.environ.get("HF_DATASET_REPO", "hugging-science/request")
+REQUESTS_FILE = "requests.jsonl"
+TOKEN = os.environ.get("HF_TOKEN")
+
+ADMIN_USERS = {u.strip() for u in os.environ.get("ADMIN_USERS", "").split(",") if u.strip()}
+GITHUB_REPO = os.environ.get("GITHUB_REPO", "georgiachanning/huggingscience-dot-co")
+GITHUB_API = "https://api.github.com"

app.py

@@ -0,0 +1,191 @@
+"""Hugging Science requests review — Gradio admin UI.
+
+Ingestion happens in the separate feedback-api Space (/submit), which writes
+non-"feedback" submissions into requests.jsonl in the hugging-science/feedback
+dataset. This Space only reads that file and lets the site owner approve
+(-> opens a GitHub PR) or reject each pending request.
+"""
+
+import gradio as gr
+
+import formatters
+import github_pr
+import submissions
+from about import ADMIN_USERS
+
+# Types that map onto a src/data/*.js file and can go through the PR flow.
+PR_TYPES = list(formatters.TARGETS.keys())  # organization, model, dataset, blog
+# Everything else (e.g. "challenge") is acknowledge/reject only.
+
+FIELD_VISIBILITY = {
+    "organization": {"id", "name", "link", "description", "tags"},
+    "model": {"id", "slug", "name", "orgId", "entry_type", "description", "tags"},
+    "dataset": {"id", "slug", "orgId", "entry_type", "description", "tags"},
+    "blog": {"id", "title", "slug", "orgId", "date", "excerpt", "link", "tags", "featured", "upvotes"},
+}
+
+ALL_FIELD_KEYS = [
+    "id", "name", "title", "slug", "orgId", "entry_type",
+    "description", "excerpt", "link", "date", "featured", "upvotes", "tags",
+]
+
+
+def is_admin(profile: gr.OAuthProfile | None) -> bool:
+    return profile is not None and profile.username in ADMIN_USERS
+
+
+def _guess_slug(title: str | None) -> str:
+    if title and "/" in title:
+        return title.strip()
+    return ""
+
+
+def pending_choices():
+    rows = submissions.list_submissions(status="pending")
+    return [(f"[{r['type']}] {r['title'] or r['description'][:40]}", r["id"]) for r in rows]
+
+
+def history_rows():
+    rows = [r for r in submissions.list_submissions() if r["status"] != "pending"]
+    return [
+        [r["type"], r["title"], r["status"], r.get("reviewed_at"), r.get("pr_url") or r.get("reject_reason")]
+        for r in rows
+    ]
+
+
+def load_submission(submission_id: str):
+    """Populate the detail panel + editable fields for a selected submission."""
+    if not submission_id:
+        return (gr.update(value=""), *[gr.update(visible=False) for _ in ALL_FIELD_KEYS], gr.update(visible=False))
+
+    row = submissions.get_submission(submission_id)
+    if row is None:
+        return (gr.update(value="Not found."), *[gr.update(visible=False) for _ in ALL_FIELD_KEYS], gr.update(visible=False))
+
+    detail_md = (
+        f"**Type:** {row['type']}  \n"
+        f"**Title/link:** {row['title'] or '_none given_'}  \n"
+        f"**Submitted:** {row['submitted_at']} via {row['source']}  \n\n"
+        f"{row['description']}"
+    )
+
+    visible = FIELD_VISIBILITY.get(row["type"], set())
+    guessed_slug = _guess_slug(row["title"])
+    defaults = {
+        "id": guessed_slug.replace("/", "-").lower(),
+        "name": row["title"] or "",
+        "title": row["title"] or "",
+        "slug": guessed_slug,
+        "description": row["description"],
+        "excerpt": row["description"],
+        "link": row["title"] if row["title"] and row["title"].startswith("http") else "",
+    }
+    field_updates = []
+    for key in ALL_FIELD_KEYS:
+        if key in visible:
+            field_updates.append(gr.update(visible=True, value=defaults.get(key, "" if key != "tags" else [])))
+        else:
+            field_updates.append(gr.update(visible=False))
+
+    show_pr_button = row["type"] in PR_TYPES
+    return (gr.update(value=detail_md), *field_updates, gr.update(visible=show_pr_button))
+
+
+with gr.Blocks(title="Hugging Science — requests review") as demo:
+    gr.Markdown("## Hugging Science — requests review")
+    login_btn = gr.LoginButton()
+
+    with gr.Column(visible=False) as admin_panel:
+        with gr.Tab("Pending"):
+            refresh_btn = gr.Button("Refresh")
+            pending_dd = gr.Dropdown(label="Pending requests", choices=[], interactive=True)
+            detail = gr.Markdown()
+
+            with gr.Group():
+                f_id = gr.Textbox(label="id", visible=False)
+                f_name = gr.Textbox(label="name", visible=False)
+                f_title = gr.Textbox(label="title", visible=False)
+                f_slug = gr.Textbox(label="slug (org/repo)", visible=False)
+                f_orgId = gr.Textbox(label="orgId", visible=False)
+                f_entry_type = gr.Textbox(label="type (e.g. Genomics, Foundation Model)", visible=False)
+                f_description = gr.Textbox(label="description", lines=3, visible=False)
+                f_excerpt = gr.Textbox(label="excerpt", lines=3, visible=False)
+                f_link = gr.Textbox(label="link", visible=False)
+                f_date = gr.Textbox(label="date (YYYY-MM-DD)", visible=False)
+                f_featured = gr.Checkbox(label="featured", visible=False)
+                f_upvotes = gr.Number(label="upvotes", visible=False)
+                f_tags = gr.CheckboxGroup(label="tags", choices=formatters.VALID_TAGS, visible=False)
+
+            all_fields = [f_id, f_name, f_title, f_slug, f_orgId, f_entry_type,
+                          f_description, f_excerpt, f_link, f_date, f_featured, f_upvotes, f_tags]
+
+            with gr.Row():
+                approve_btn = gr.Button("Approve → open PR", variant="primary", visible=False)
+                reject_reason = gr.Textbox(label="Reject reason (optional)", scale=2)
+                reject_btn = gr.Button("Reject", variant="stop")
+
+            result_md = gr.Markdown()
+
+            def do_refresh():
+                return gr.update(choices=pending_choices(), value=None)
+
+            refresh_btn.click(do_refresh, outputs=pending_dd)
+            demo.load(do_refresh, outputs=pending_dd)
+
+            pending_dd.change(load_submission, inputs=pending_dd, outputs=[detail, *all_fields, approve_btn])
+
+            def do_approve(submission_id, id_, name, title, slug, org_id, entry_type,
+                            description, excerpt, link, date, featured, upvotes, tags):
+                row = submissions.get_submission(submission_id)
+                if row is None:
+                    return "Submission not found.", gr.update(choices=pending_choices())
+                fields = {
+                    "id": id_, "name": name, "title": title, "slug": slug, "orgId": org_id or None,
+                    "type": entry_type, "description": description, "excerpt": excerpt,
+                    "link": link, "date": date, "featured": featured, "upvotes": upvotes,
+                    "tags": tags or [],
+                }
+                missing = formatters.missing_fields(row["type"], fields)
+                if missing:
+                    return f"Missing required fields: {', '.join(missing)}", gr.update()
+                try:
+                    pr_url = github_pr.open_pr_for_submission(row, fields)
+                except Exception as exc:  # surfaced to the reviewer, not swallowed
+                    return f"Failed to open PR: {exc}", gr.update()
+                submissions.mark_approved(submission_id, pr_url)
+                return f"Approved — [PR opened]({pr_url})", gr.update(choices=pending_choices(), value=None)
+
+            approve_btn.click(
+                do_approve,
+                inputs=[pending_dd, *all_fields],
+                outputs=[result_md, pending_dd],
+            )
+
+            def do_reject(submission_id, reason):
+                if not submission_id:
+                    return "Nothing selected.", gr.update()
+                submissions.mark_rejected(submission_id, reason or None)
+                return "Rejected.", gr.update(choices=pending_choices(), value=None)
+
+            reject_btn.click(do_reject, inputs=[pending_dd, reject_reason], outputs=[result_md, pending_dd])
+
+        with gr.Tab("History"):
+            history_refresh = gr.Button("Refresh")
+            history_df = gr.Dataframe(
+                headers=["type", "title", "status", "reviewed_at", "pr_url / reason"],
+                interactive=False,
+            )
+            history_refresh.click(lambda: history_rows(), outputs=history_df)
+            demo.load(lambda: history_rows(), outputs=history_df)
+
+    unauthorized = gr.Markdown("Log in with an allow-listed Hugging Face account to review requests.")
+
+    def toggle_panel(profile: gr.OAuthProfile | None):
+        admin = is_admin(profile)
+        return gr.update(visible=admin), gr.update(visible=not admin)
+
+    demo.load(toggle_panel, outputs=[admin_panel, unauthorized])
+
+
+if __name__ == "__main__":
+    demo.launch()

formatters.py

@@ -0,0 +1,136 @@
+"""Turn an approved submission into a src/data/*.js entry + a text splice.
+
+The site's data files (src/data/organizations.js, models.js, datasets.js,
+blogs.js) are hand-formatted flat JS arrays, not JSON — see the real
+examples this module's tests are based on. Rather than parsing/rewriting
+the whole file as an AST, we do a plain text insertion, since the existing
+formatting is simple and consistent: 2-space indent for `{`/`}`, 4-space
+indent for fields, `description`/`excerpt` always on their own line.
+"""
+
+import json
+
+# Canonical tag list — mirrors src/data/themes.js themeIds.
+VALID_TAGS = [
+    "biology", "chemistry", "physics", "medicine", "mathematics",
+    "engineering", "earth-science", "astronomy", "genomics",
+    "biotechnology", "materials-science", "climate", "energy",
+    "ecology", "conservation", "benchmark", "scientific-reasoning",
+]
+
+# type -> (file path relative to repo root, exported array name, required fields)
+TARGETS = {
+    "organization": ("src/data/organizations.js", "organizations",
+                      ["id", "name", "link", "tags"]),
+    "model": ("src/data/models.js", "models",
+              ["id", "slug", "name", "orgId", "type", "description", "tags"]),
+    "dataset": ("src/data/datasets.js", "datasets",
+                ["id", "slug", "orgId", "type", "description", "tags"]),
+    "blog": ("src/data/blogs.js", "blogs",
+             ["id", "title", "slug", "orgId", "date", "excerpt", "link", "tags"]),
+}
+
+
+def target_file(type_: str) -> str:
+    return TARGETS[type_][0]
+
+
+def missing_fields(type_: str, fields: dict) -> list[str]:
+    _, _, required = TARGETS[type_]
+    return [f for f in required if not fields.get(f)]
+
+
+def _js_string(value) -> str:
+    return json.dumps(value)
+
+
+def render_entry(type_: str, fields: dict) -> str:
+    """Render a single object literal matching the existing file style."""
+    if type_ == "organization":
+        lines = [
+            "  {",
+            f'    id: {_js_string(fields["id"])},',
+            f'    name: {_js_string(fields["name"])},',
+            f'    logo: getOrgLogo({_js_string(fields["id"])}),',
+            "    description:",
+            f'      {_js_string(fields.get("description", ""))},',
+            f'    link: {_js_string(fields["link"])},',
+            f'    tags: {json.dumps(fields["tags"])},',
+            "  },",
+        ]
+    elif type_ == "model":
+        lines = [
+            "  {",
+            f'    id: {_js_string(fields["id"])},',
+            f'    slug: {_js_string(fields["slug"])},',
+            f'    name: {_js_string(fields["name"])},',
+            f'    orgId: {_js_string(fields["orgId"])},',
+            f'    type: {_js_string(fields["type"])},',
+            "    description:",
+            f'      {_js_string(fields["description"])},',
+            f'    tags: {json.dumps(fields["tags"])},',
+            "  },",
+        ]
+    elif type_ == "dataset":
+        lines = [
+            "  {",
+            f'    id: {_js_string(fields["id"])},',
+            f'    slug: {_js_string(fields["slug"])},',
+            f'    orgId: {_js_string(fields["orgId"])},',
+            f'    type: {_js_string(fields["type"])},',
+            "    description:",
+            f'      {_js_string(fields["description"])},',
+            f'    tags: {json.dumps(fields["tags"])},',
+            "  },",
+        ]
+    elif type_ == "blog":
+        lines = [
+            "  {",
+            f'    id: {_js_string(fields["id"])},',
+            f'    title: {_js_string(fields["title"])},',
+            f'    slug: {_js_string(fields["slug"])},',
+            f'    orgId: {_js_string(fields["orgId"]) if fields.get("orgId") else "null"},',
+            f'    date: {_js_string(fields["date"])},',
+            "    excerpt:",
+            f'      {_js_string(fields["excerpt"])},',
+            f'    link: {_js_string(fields["link"])},',
+            f'    tags: {json.dumps(fields["tags"])},',
+            f'    featured: {"true" if fields.get("featured") else "false"},',
+        ]
+        if fields.get("upvotes") is not None:
+            lines.append(f'    upvotes: {int(fields["upvotes"])},')
+        lines.append("  },")
+    else:
+        raise ValueError(f"Unknown submission type: {type_}")
+
+    return "\n".join(lines)
+
+
+def insert_entry(file_content: str, type_: str, entry_block: str, org_id: str | None) -> str:
+    """Insert entry_block into file_content, grouped near org_id's other
+    entries when found, otherwise right after the array's opening line."""
+    _, array_name, _ = TARGETS[type_]
+    lines = file_content.split("\n")
+    opening = f"export const {array_name} = ["
+
+    insert_at = None
+    if org_id:
+        for i, line in enumerate(lines):
+            if f'orgId: "{org_id}"' in line:
+                # walk forward to this object's closing "  },"
+                for j in range(i + 1, len(lines)):
+                    if lines[j] == "  },":
+                        insert_at = j + 1
+                        break
+                # keep scanning in case a later group is a better (last) match
+    if insert_at is None:
+        for i, line in enumerate(lines):
+            if line.strip() == opening:
+                insert_at = i + 1
+                break
+
+    if insert_at is None:
+        raise ValueError(f"Could not find `{opening}` in target file")
+
+    new_lines = lines[:insert_at] + entry_block.split("\n") + lines[insert_at:]
+    return "\n".join(new_lines)

github_pr.py

@@ -0,0 +1,119 @@
+"""Open a GitHub PR against the website repo for an approved submission.
+
+The site owner still reviews and merges the PR by hand — this only removes
+the manual data-entry step of splicing a new object into the right
+src/data/*.js array.
+"""
+
+import base64
+import os
+
+import requests
+
+import formatters
+from about import GITHUB_API, GITHUB_REPO
+
+
+def _headers() -> dict:
+    token = os.environ["GITHUB_TOKEN"]
+    return {
+        "Authorization": f"Bearer {token}",
+        "Accept": "application/vnd.github+json",
+        "X-GitHub-Api-Version": "2022-11-28",
+    }
+
+
+def _default_branch() -> str:
+    resp = requests.get(f"{GITHUB_API}/repos/{GITHUB_REPO}", headers=_headers())
+    resp.raise_for_status()
+    return resp.json()["default_branch"]
+
+
+def _get_file(path: str, ref: str) -> tuple[str, str]:
+    """Return (content, sha) of a file at ref."""
+    resp = requests.get(
+        f"{GITHUB_API}/repos/{GITHUB_REPO}/contents/{path}",
+        headers=_headers(),
+        params={"ref": ref},
+    )
+    resp.raise_for_status()
+    data = resp.json()
+    content = base64.b64decode(data["content"]).decode("utf-8")
+    return content, data["sha"]
+
+
+def _create_branch(branch: str, from_sha: str) -> None:
+    resp = requests.post(
+        f"{GITHUB_API}/repos/{GITHUB_REPO}/git/refs",
+        headers=_headers(),
+        json={"ref": f"refs/heads/{branch}", "sha": from_sha},
+    )
+    resp.raise_for_status()
+
+
+def _branch_sha(branch: str) -> str:
+    resp = requests.get(
+        f"{GITHUB_API}/repos/{GITHUB_REPO}/git/ref/heads/{branch}", headers=_headers()
+    )
+    resp.raise_for_status()
+    return resp.json()["object"]["sha"]
+
+
+def _update_file(path: str, branch: str, new_content: str, sha: str, message: str) -> None:
+    resp = requests.put(
+        f"{GITHUB_API}/repos/{GITHUB_REPO}/contents/{path}",
+        headers=_headers(),
+        json={
+            "message": message,
+            "content": base64.b64encode(new_content.encode("utf-8")).decode("ascii"),
+            "sha": sha,
+            "branch": branch,
+        },
+    )
+    resp.raise_for_status()
+
+
+def _open_pr(branch: str, base: str, title: str, body: str) -> str:
+    resp = requests.post(
+        f"{GITHUB_API}/repos/{GITHUB_REPO}/pulls",
+        headers=_headers(),
+        json={"title": title, "head": branch, "base": base, "body": body},
+    )
+    resp.raise_for_status()
+    return resp.json()["html_url"]
+
+
+def open_pr_for_submission(submission: dict, fields: dict) -> str:
+    """Splice the approved entry into the right data file and open a PR.
+
+    `submission` is the row from submissions.py; `fields` are the
+    reviewer-filled values matching formatters.TARGETS[type_]'s schema.
+    """
+    type_ = submission["type"]
+    file_path = formatters.target_file(type_)
+    entry_block = formatters.render_entry(type_, fields)
+    org_id = fields.get("orgId")
+
+    base = _default_branch()
+    base_sha = _branch_sha(base)
+
+    slug = fields.get("id", submission["id"][:8])
+    branch = f"add/{type_}-{slug}"
+    _create_branch(branch, base_sha)
+
+    content, sha = _get_file(file_path, branch)
+    new_content = formatters.insert_entry(content, type_, entry_block, org_id)
+    _update_file(
+        file_path, branch, new_content, sha,
+        message=f"Add {type_}: {fields.get('name') or fields.get('title') or slug}",
+    )
+
+    title = f"Add {type_}: {fields.get('name') or fields.get('title') or slug}"
+    body = (
+        f"Auto-generated from a huggingscience.co submission via the review Space.\n\n"
+        f"- **Submission id:** `{submission['id']}`\n"
+        f"- **Submitted at:** {submission['submitted_at']}\n"
+        f"- **Source:** {submission['source']}\n\n"
+        f"**Original description:**\n{submission['description']}\n"
+    )
+    return _open_pr(branch, base, title, body)

requirements.txt

@@ -0,0 +1,4 @@
+gradio[oauth]>=5.0.0
+huggingface_hub>=0.25.0
+requests>=2.31.0
+dotenv

submissions.py

@@ -0,0 +1,83 @@
+"""Requests queue backed by the existing hugging-science/feedback HF Dataset.
+
+`requests.jsonl` holds rows written by the feedback-api Space's /submit
+endpoint for every non-"feedback" type (dataset/model/organization/blog/
+challenge). Ingestion happens there, not here — this module only reads that
+file and updates a row's status when the reviewer approves/rejects it.
+"""
+
+import json
+import threading
+from datetime import datetime, timezone
+
+from huggingface_hub import HfApi
+from huggingface_hub.utils import EntryNotFoundError
+
+from about import DATASET_REPO, REQUESTS_FILE, TOKEN
+
+_api = HfApi(token=TOKEN)
+_lock = threading.Lock()
+
+
+def _now() -> str:
+    return datetime.now(timezone.utc).isoformat()
+
+
+def _read_all() -> list[dict]:
+    try:
+        path = _api.hf_hub_download(
+            repo_id=DATASET_REPO, repo_type="dataset", filename=REQUESTS_FILE
+        )
+    except EntryNotFoundError:
+        return []
+    with open(path, encoding="utf-8") as f:
+        return [json.loads(line) for line in f if line.strip()]
+
+
+def _write_all(rows: list[dict]) -> None:
+    content = "\n".join(json.dumps(row) for row in rows) + "\n"
+    _api.upload_file(
+        path_or_fileobj=content.encode("utf-8"),
+        path_in_repo=REQUESTS_FILE,
+        repo_id=DATASET_REPO,
+        repo_type="dataset",
+        commit_message="Update requests queue",
+    )
+
+
+def list_submissions(status: str | None = None) -> list[dict]:
+    rows = _read_all()
+    if status is None:
+        return rows
+    return [r for r in rows if r["status"] == status]
+
+
+def get_submission(submission_id: str) -> dict | None:
+    for row in _read_all():
+        if row["id"] == submission_id:
+            return row
+    return None
+
+
+def mark_approved(submission_id: str, pr_url: str) -> None:
+    with _lock:
+        rows = _read_all()
+        for row in rows:
+            if row["id"] == submission_id:
+                row["status"] = "approved"
+                row["reviewed_at"] = _now()
+                row["pr_url"] = pr_url
+                break
+        _write_all(rows)
+
+
+def mark_rejected(submission_id: str, reason: str | None) -> None:
+    with _lock:
+        rows = _read_all()
+        for row in rows:
+            if row["id"] == submission_id:
+                row["status"] = "rejected"
+                row["reviewed_at"] = _now()
+                row["reject_reason"] = reason
+                break
+        _write_all(rows)