From 6f38343133c4fe6581c38fdeab2fa072efcd2c4c Mon Sep 17 00:00:00 2001
From: Gaurav Vaidya <gaurav@renci.org>
Date: Mon, 12 Oct 2026 00:44:20 -0400
Subject: [PATCH 1/4] Let handlers write a top-level JSON list

Tornado's write() refuses a list ("Lists not accepted for security
reasons"), a guard against JSON hijacking through <script> tags in very
old browsers. That made GET /get_allowed_conflations return HTTP 500,
and made POST /get_setid answer with an object keyed "0", "1", ...
instead of the list NodeNorm Redis returns. NodeNormalizationBaseHandler
now encodes a list the way Tornado encodes a dict, so every handler can
finish() one.

/get_allowed_conflations keeps its {"conflations": [...]} wrapper, which
is the shape NodeNorm Redis returns; only its comment changes.

Co-Authored-By: Claude Opus 5.5 <noreply@anthropic.com>
---
 src/nodenorm/handlers/base.py        | 11 +++++++++++
 src/nodenorm/handlers/conflations.py |  2 +-
 tests/test_base_handler.py           | 25 +++++++++++++++++++++++++
 3 files changed, 37 insertions(+), 1 deletion(-)
 create mode 100644 tests/test_base_handler.py

diff --git a/src/nodenorm/handlers/base.py b/src/nodenorm/handlers/base.py
index c070773..aafa4a6 100644
--- a/src/nodenorm/handlers/base.py
+++ b/src/nodenorm/handlers/base.py
@@ -2,6 +2,7 @@
 
 import json
 
+import tornado.escape
 from biothings.web.handlers import BaseHandler
 from tornado.web import HTTPError
 
@@ -53,3 +54,13 @@ def load_json_body(self):
             return json.loads(self.request.body)
         except (json.JSONDecodeError, UnicodeDecodeError) as error:
             raise HTTPError(detail=f"The body is not valid JSON: {error}", status_code=400)
+
+    def write(self, chunk):
+        # Tornado refuses a top-level list ("Lists not accepted for security reasons"), a guard
+        # against JSON hijacking through <script> tags in very old browsers. This is a public
+        # JSON API that allows any origin anyway, and NodeNorm Redis returns lists, so encode a
+        # list the way Tornado encodes a dict.
+        if isinstance(chunk, list):
+            self.set_header("Content-Type", "application/json; charset=UTF-8")
+            chunk = tornado.escape.json_encode(chunk)
+        super().write(chunk)
diff --git a/src/nodenorm/handlers/conflations.py b/src/nodenorm/handlers/conflations.py
index cebc8ba..d2c494b 100644
--- a/src/nodenorm/handlers/conflations.py
+++ b/src/nodenorm/handlers/conflations.py
@@ -7,7 +7,7 @@ class ValidConflationsHandler(NodeNormalizationBaseHandler):
     name = "allowed-conflations"
 
     async def get(self):
-        # Wrapped in an object, as NodeNorm Redis does. Tornado also refuses to write a bare list.
+        # Wrapped in an object, as NodeNorm Redis does.
         self.finish({"conflations": ALLOWED_CONFLATIONS})
 
     async def head(self):
diff --git a/tests/test_base_handler.py b/tests/test_base_handler.py
new file mode 100644
index 0000000..37da79b
--- /dev/null
+++ b/tests/test_base_handler.py
@@ -0,0 +1,25 @@
+import json
+
+import tornado.web
+from tornado.testing import AsyncHTTPTestCase
+
+from nodenorm.handlers.base import NodeNormalizationBaseHandler
+
+
+class ListHandler(NodeNormalizationBaseHandler):
+    async def get(self):
+        self.finish([{"curie": "MESH:D014867"}, {"curie": "NCIT:C34373"}])
+
+
+class TestWriteList(AsyncHTTPTestCase):
+    """Tornado's own write() raises on a list, which made /get_allowed_conflations return HTTP 500."""
+
+    def get_app(self) -> tornado.web.Application:
+        return tornado.web.Application([(r"/list", ListHandler)])
+
+    def test_a_list_is_written_as_json(self):
+        response = self.fetch("/list")
+
+        assert response.code == 200
+        assert response.headers["Content-Type"] == "application/json; charset=UTF-8"
+        assert json.loads(response.body) == [{"curie": "MESH:D014867"}, {"curie": "NCIT:C34373"}]

From 16d99c9bf94f99aaa0628ea567ac6e48ef68e023 Mon Sep 17 00:00:00 2001
From: Gaurav Vaidya <gaurav@renci.org>
Date: Mon, 12 Oct 2026 00:44:56 -0400
Subject: [PATCH 2/4] Return POST /get_setid results as a list, as NodeNorm
 Redis does

POST /get_setid answered with an object keyed "0", "1", ... because
Tornado would not write a list. Now that the base handler can, it
returns the list of SetIDResponse objects in input order, which is what
NodeNorm Redis returns and what the OpenAPI document now says. This is
a breaking change for any client that reads body["0"].

The "if not set_identifiers: 500" check after the loop could never fire
(the body is already known to be non-empty and each set appends one
result), so it is gone.

The unit test that mounts the handler with a fake generate_setid() used
to assign the module attribute and never put it back, so under
pytest-randomly the fake could leak into tests/test_set_identifiers.py.
It now patches with unittest.mock and undoes the patch after each test.

Co-Authored-By: Claude Opus 5.5 <noreply@anthropic.com>
---
 src/nodenorm/handlers/set_identifiers.py | 14 +++------
 src/nodenorm/webapp/openapi.json         |  8 ++---
 tests/test_babel_endpoints.py            | 12 +++----
 tests/test_openapi.py                    | 40 +++++++++++++++++++++---
 tests/test_set_identifiers.py            |  8 ++---
 5 files changed, 55 insertions(+), 27 deletions(-)

diff --git a/src/nodenorm/handlers/set_identifiers.py b/src/nodenorm/handlers/set_identifiers.py
index 52aacf2..e77feb3 100644
--- a/src/nodenorm/handlers/set_identifiers.py
+++ b/src/nodenorm/handlers/set_identifiers.py
@@ -70,19 +70,15 @@ async def post(self):
 
         release = self.select_babel_release(self.get_query_argument("babel_version", None))
 
-        # We have to make a minor change to the API to ensure we're avoiding a security concern
-        # enforced by tornado, so we return a dictionary here instead of a list
-        set_identifiers = {}
-        for index, group in enumerate(post_body):
+        # One SetIDResponse per input set, in order, as NodeNorm Redis returns.
+        set_identifiers = []
+        for group in post_body:
             curies = group.get("curies", [])
             conflations = group.get("conflations", [])
-            set_identifiers[index] = await generate_setid(
-                self.biothings, curies, conflations, search_indices=release.search_indices
+            set_identifiers.append(
+                await generate_setid(self.biothings, curies, conflations, search_indices=release.search_indices)
             )
 
-        if not set_identifiers:
-            raise HTTPError(detail="Error occurred during processing.", status_code=500)
-
         self.finish(set_identifiers)
 
 
diff --git a/src/nodenorm/webapp/openapi.json b/src/nodenorm/webapp/openapi.json
index 37f4c6d..de6f91a 100644
--- a/src/nodenorm/webapp/openapi.json
+++ b/src/nodenorm/webapp/openapi.json
@@ -411,7 +411,7 @@
       "post": {
         "summary": "Normalize and deduplicate several sets of identifiers and return a hash for each set.",
         "tags": ["translator"],
-        "description": "Returns one set ID per input set, keyed by the set's position in the request as a string (\"0\", \"1\", ...). Select one Babel release for the entire batch with the optional babel_version query parameter.",
+        "description": "Returns one set ID per input set, in the order the sets were given. Select one Babel release for the entire batch with the optional babel_version query parameter.",
         "operationId": "get_setid_post",
         "requestBody": {
           "required": true,
@@ -434,12 +434,12 @@
         },
         "responses": {
           "200": {
-            "description": "One set ID per input set, keyed by its index",
+            "description": "One set ID per input set",
             "content": {
               "application/json": {
                 "schema": {
-                  "type": "object",
-                  "additionalProperties": {"$ref": "#/components/schemas/SetIDResponse"}
+                  "type": "array",
+                  "items": {"$ref": "#/components/schemas/SetIDResponse"}
                 }
               }
             },
diff --git a/tests/test_babel_endpoints.py b/tests/test_babel_endpoints.py
index a53ee6e..fe90c05 100644
--- a/tests/test_babel_endpoints.py
+++ b/tests/test_babel_endpoints.py
@@ -177,11 +177,11 @@ def test_setid_post_selects_one_release_for_all_groups_and_conflation(self):
         )
         body = self.assert_selected_release(response, OLD_VERSION)
 
-        assert set(body) == {"0", "1"}
-        assert body["0"]["normalized_curies"] == ["OLD:1", "OLD:2"]
-        assert body["0"]["normalized_string"] == "OLD:1||OLD:2"
-        assert body["1"]["normalized_curies"] == ["OLD:P2"]
-        assert body["1"]["conflations"] == ["GeneProtein"]
+        assert len(body) == 2
+        assert body[0]["normalized_curies"] == ["OLD:1", "OLD:2"]
+        assert body[0]["normalized_string"] == "OLD:1||OLD:2"
+        assert body[1]["normalized_curies"] == ["OLD:P2"]
+        assert body[1]["conflations"] == ["GeneProtein"]
         assert len(self.client.calls) == 3
         assert all(operation == "msearch" and call["index"] == [OLD_INDEX] for operation, call in self.client.calls)
         assert self.namespace.elasticsearch.indices == [DEFAULT_INDEX]
@@ -195,7 +195,7 @@ def test_setid_post_defaults_to_configured_release(self):
         )
 
         body = self.assert_selected_release(response, DEFAULT_VERSION)
-        assert body["0"]["normalized_curies"] == ["NEW:1"]
+        assert body[0]["normalized_curies"] == ["NEW:1"]
 
     def test_setid_rejects_unsupported_release_before_lookup(self):
         self.assert_unsupported(self.fetch("/get_setid?curie=INPUT:1&babel_version=unknown"))
diff --git a/tests/test_openapi.py b/tests/test_openapi.py
index 131a2fa..030e3b2 100644
--- a/tests/test_openapi.py
+++ b/tests/test_openapi.py
@@ -242,8 +242,8 @@ def test_post_reports_an_unknown_conflation(self):
 
         assert response.code == 200
         result = json.loads(response.body)
-        jsonschema.validate(result["0"], SPEC["components"]["schemas"]["SetIDResponse"])
-        assert "Bogus" in result["0"]["error"]
+        jsonschema.validate(result[0], SPEC["components"]["schemas"]["SetIDResponse"])
+        assert "Bogus" in result[0]["error"]
 
     def test_post_answers_a_set_with_no_curies(self):
         # The other early return in generate_setid(); it too used to return the dataclass (HTTP 500).
@@ -253,8 +253,8 @@ def test_post_answers_a_set_with_no_curies(self):
 
         assert response.code == 200
         result = json.loads(response.body)
-        jsonschema.validate(result["0"], SPEC["components"]["schemas"]["SetIDResponse"])
-        assert result["0"]["normalized_curies"] == [] and result["0"]["setid"] is None
+        jsonschema.validate(result[0], SPEC["components"]["schemas"]["SetIDResponse"])
+        assert result[0]["normalized_curies"] == [] and result[0]["setid"] is None
 
     def test_post_rejects_a_body_that_is_not_an_array_of_objects(self):
         # A single object was the documented body before; it used to fail with a 500.
@@ -446,3 +446,35 @@ def test_post_rejects_a_body_that_is_not_a_json_object(self):
         # Each of these used to fail with a 500.
         for body in ('["MESH:D014867"]', "not json", b'{"curies": ["\xff"]}'):
             assert self.fetch("/get_normalized_nodes", method="POST", body=body).code == 400, body
+
+
+async def fake_generate_setid(biothings, curies, conflations, search_indices=None):
+    return dataclasses.asdict(SetIDResponse(curies=curies, conflations=conflations, normalized_curies=sorted(curies)))
+
+
+class TestSetIdentifierPost(AsyncHTTPTestCase):
+    """Regression: POST returned an index-keyed object because Tornado refused to write a list."""
+
+    def setUp(self):
+        # Patched per test and undone afterwards: assigning the module attribute instead would leak
+        # the fake into tests/test_set_identifiers.py whenever pytest-randomly runs it later.
+        patcher = mock.patch("nodenorm.handlers.set_identifiers.generate_setid", fake_generate_setid)
+        patcher.start()
+        self.addCleanup(patcher.stop)
+        super().setUp()
+
+    def get_app(self) -> tornado.web.Application:
+        app = tornado.web.Application([(r"/get_setid", SetIdentifierHandler)])
+        app.biothings = SimpleNamespace(elasticsearch=SimpleNamespace(babel=RELEASES))
+        return app
+
+    def test_returns_one_response_per_set_as_a_list(self):
+        sets = [{"curies": ["MESH:D014867"]}, {"curies": ["NCIT:C34373"], "conflations": ["GeneProtein"]}]
+        response = self.fetch("/get_setid", method="POST", body=json.dumps(sets))
+
+        assert response.code == 200
+        assert response.headers["Content-Type"].startswith("application/json")
+        body = json.loads(response.body)
+        assert isinstance(body, list) and [r["curies"] for r in body] == [s["curies"] for s in sets]
+        for result in body:
+            jsonschema.validate(result, SPEC["components"]["schemas"]["SetIDResponse"])
diff --git a/tests/test_set_identifiers.py b/tests/test_set_identifiers.py
index 2d82983..f5dc253 100644
--- a/tests/test_set_identifiers.py
+++ b/tests/test_set_identifiers.py
@@ -95,9 +95,9 @@ def test_post_endpoint(self):
         response = yield http_client.fetch(url, self.stop, method="POST", headers=headers, body=body, request_timeout=0)
         body = json.loads(response.body.decode("utf-8"))
 
-        # One SetIDResponse per input set, keyed by the set's index in the request.
-        expected_body = {
-            "0": {
+        # One SetIDResponse per input set, as a list (matching NodeNorm Redis).
+        expected_body = [
+            {
                 "curies": ["MESH:D014867", "NCIT:C34373", "UNII:63M8RYN44N", "RUBBISH:1234"],
                 "conflations": ["GeneProtein", "DrugChemical"],
                 "error": None,
@@ -105,5 +105,5 @@ def test_post_endpoint(self):
                 "normalized_string": "CHEBI:15377||MONDO:0004976||RUBBISH:1234",
                 "setid": "uuid:771d3c09-9a8c-5c46-8b85-97f481a90d40",
             }
-        }
+        ]
         assert json.loads(response.body.decode("utf-8")) == expected_body

From 89f7fec1944cd971313446369618ddbc13be3526 Mon Sep 17 00:00:00 2001
From: gaurav <gaurav@ggvaidya.com>
Date: Wed, 14 Oct 2026 13:11:52 -0400
Subject: [PATCH 3/4] Test that an empty POST /get_setid body gets a 400

This commit used to add the POST /get_setid body checks themselves: a
body that wasn't valid JSON, was a single object, or held anything
other than objects reached group.get() and failed with HTTP 500. #42
now makes those checks (through load_json_body()) and tests them, so
after rebasing onto it all that is left is the empty-body case, which
its test didn't cover.

Co-Authored-By: Claude Opus 5.5 <noreply@anthropic.com>
---
 tests/test_openapi.py | 9 ++++++++-
 1 file changed, 8 insertions(+), 1 deletion(-)

diff --git a/tests/test_openapi.py b/tests/test_openapi.py
index 030e3b2..eb659fc 100644
--- a/tests/test_openapi.py
+++ b/tests/test_openapi.py
@@ -258,7 +258,14 @@ def test_post_answers_a_set_with_no_curies(self):
 
     def test_post_rejects_a_body_that_is_not_an_array_of_objects(self):
         # A single object was the documented body before; it used to fail with a 500.
-        for body in ('{"curies": ["MESH:D014867"]}', '["MESH:D014867"]', "[]", "not json", b'[{"curies": ["\xff"]}]'):
+        for body in (
+            '{"curies": ["MESH:D014867"]}',
+            '["MESH:D014867"]',
+            "[]",
+            "not json",
+            "",
+            b'[{"curies": ["\xff"]}]',
+        ):
             assert self.fetch("/get_setid", method="POST", body=body).code == 400, body
 
 

From bc8fb4152d65201f1bd362043cbe1e71ede779f3 Mon Sep 17 00:00:00 2001
From: Gaurav Vaidya <gaurav@renci.org>
Date: Mon, 12 Oct 2026 00:45:30 -0400
Subject: [PATCH 4/4] Normalize the sets in one POST /get_setid concurrently

Each set awaited its own Elasticsearch lookups before the next began,
so a POST with many sets took one round trip per set in series. The sets
are independent, so asyncio.gather() now runs them together; it returns
the results in input order.

This raises the number of concurrent Elasticsearch requests one POST
can make, in proportion to the number of sets (see #22 on how much load
the cluster takes). It is a separate commit so it can be dropped on its
own if that is a concern.

Co-Authored-By: Claude Opus 5.5 <noreply@anthropic.com>
---
 src/nodenorm/handlers/set_identifiers.py | 20 +++++++++++++-------
 1 file changed, 13 insertions(+), 7 deletions(-)

diff --git a/src/nodenorm/handlers/set_identifiers.py b/src/nodenorm/handlers/set_identifiers.py
index e77feb3..1f95384 100644
--- a/src/nodenorm/handlers/set_identifiers.py
+++ b/src/nodenorm/handlers/set_identifiers.py
@@ -1,5 +1,6 @@
 # set_id.py
 # Code related to generating IDs for sets (as in https://github.com/TranslatorSRI/NodeNormalization/issues/256).
+import asyncio
 import dataclasses
 import logging
 import uuid
@@ -70,14 +71,19 @@ async def post(self):
 
         release = self.select_babel_release(self.get_query_argument("babel_version", None))
 
-        # One SetIDResponse per input set, in order, as NodeNorm Redis returns.
-        set_identifiers = []
-        for group in post_body:
-            curies = group.get("curies", [])
-            conflations = group.get("conflations", [])
-            set_identifiers.append(
-                await generate_setid(self.biothings, curies, conflations, search_indices=release.search_indices)
+        # One SetIDResponse per input set, in order, as NodeNorm Redis returns. The sets are
+        # independent, so their Elasticsearch lookups run concurrently.
+        set_identifiers = await asyncio.gather(
+            *(
+                generate_setid(
+                    self.biothings,
+                    group.get("curies", []),
+                    group.get("conflations", []),
+                    search_indices=release.search_indices,
+                )
+                for group in post_body
             )
+        )
 
         self.finish(set_identifiers)