From d385337a36b765e2e18003143291fba76f8b9adf Mon Sep 17 00:00:00 2001
From: Michael Pilosov <consistentbayes@gmail.com>
Date: Tue, 21 Apr 2026 21:54:50 -0600
Subject: [PATCH] require dataset selection before submit

Client-side: disable the form submit button until the picker writes a
dataset_id. Server-side: reject posts where dataset_id is present but
empty, instead of silently defaulting to make_s_curve.
---
 app/web/main.py                  | 26 ++++++++++++++++++++++----
 app/web/static/dataset-picker.js |  6 ++++++
 app/web/templates/index.html     |  6 +++---
 3 files changed, 31 insertions(+), 7 deletions(-)

diff --git a/app/web/main.py b/app/web/main.py
index 8836d72..fc5702b 100644
--- a/app/web/main.py
+++ b/app/web/main.py
@@ -594,14 +594,32 @@ async def submit(request: Request) -> HTMLResponse:
         )
 
     # Dataset came from the picker via dataset_id; fall back to explicit
-    # generator_path / generator_kwargs if a client posts those directly.
-    dataset_id = data.get("dataset_id") or ""
-    if dataset_id and dataset_id in DATASET_META:
+    # generator_path / generator_kwargs only when dataset_id is absent entirely
+    # (API consumers). UI form posts always carry the key, so an empty value
+    # means the user hit submit without picking — reject rather than silently
+    # defaulting to s_curve.
+    if "dataset_id" in data:
+        dataset_id = data.get("dataset_id") or ""
+        if not dataset_id:
+            return HTMLResponse(
+                "<div class='flash err'>pick a dataset first (§ 1 above)</div>",
+                status_code=400,
+            )
+        if dataset_id not in DATASET_META:
+            return HTMLResponse(
+                f"<div class='flash err'>unknown dataset: {dataset_id}</div>",
+                status_code=400,
+            )
         meta = DATASET_META[dataset_id]
         generator_path = meta["path"]
         generator_kwargs = dict(meta["kwargs"])
     else:
-        generator_path = data.get("generator_path") or "sklearn.datasets.make_s_curve"
+        generator_path = data.get("generator_path") or ""
+        if not generator_path:
+            return HTMLResponse(
+                "<div class='flash err'>missing dataset_id or generator_path</div>",
+                status_code=400,
+            )
         raw_kwargs = data.get("generator_kwargs") or ""
         try:
             generator_kwargs = json.loads(raw_kwargs) if raw_kwargs else {}
diff --git a/app/web/static/dataset-picker.js b/app/web/static/dataset-picker.js
index b15d4e0..80716c9 100644
--- a/app/web/static/dataset-picker.js
+++ b/app/web/static/dataset-picker.js
@@ -231,10 +231,16 @@ async function main() {
     updateContinue();
   }
 
+  const formSubmitBtn = document.querySelector('#run-form button.submit');
   function updateContinue() {
     continueBtn.disabled = !selectedId;
     continueBtn.title = selectedId ? '' : 'pick a dataset first';
+    if (formSubmitBtn) {
+      formSubmitBtn.disabled = !selectedId;
+      formSubmitBtn.title = selectedId ? '' : 'pick a dataset first';
+    }
   }
+  updateContinue();
 
   const nInputs = document.querySelectorAll('input[name="n"]');
   function applyN(n) {
diff --git a/app/web/templates/index.html b/app/web/templates/index.html
index 32da13f..3d589f2 100644
--- a/app/web/templates/index.html
+++ b/app/web/templates/index.html
@@ -4,7 +4,7 @@
   <meta charset="utf-8" />
   <meta name="viewport" content="width=device-width,initial-scale=1" />
   <title>embedding notebook — web1</title>
-  <link rel="stylesheet" href="/static/style.css?v=5" />
+  <link rel="stylesheet" href="/static/style.css?v=6" />
   <script src="https://unpkg.com/htmx.org@2.0.4"></script>
   <script type="importmap">
   {
@@ -193,8 +193,8 @@
   <span><span class="k">web</span> · scientific instrument · port 8001</span>
 </footer>
 
-<script src="/static/theme.js"></script>
-<script type="module" src="/static/dataset-picker.js"></script>
+<script src="/static/theme.js?v=6"></script>
+<script type="module" src="/static/dataset-picker.js?v=6"></script>
 
 </body>
 </html>