[Maeumjigi 毕业设计开发日志 #19] 自动化评测报告生成与 FastAPI PostgreSQL 401 鉴权故障排查

Mid-May 2026 was supposed to be a calm interval after wrapping up our 2nd fine-tuning (fine_tuning_2). Instead, May 17th hit our team with a relentless double challenge: condensing hundreds of raw inference metrics into an automated technical report, while simultaneously battling a cryptic HTTP 401 Unauthorized cascading error across our newly integrated FastAPI and PostgreSQL backend.

Here is the complete post-mortem of how we automated our reporting and systematically neutralized the backend authentication breakdown.

1. Autonomous Fine-Tuning Evaluation Reporting

Analyzing the 2nd fine-tuning results required processing hundreds of inference samples across multiple checkpoint variants (comparing Alpha values: 16, 32, and 64). Doing this manually was mathematically unfeasible given our capstone deadlines.

We engineered a structured prompt document (report_prompt.md) that guided Claude Code to analyze raw JSON evaluation matrices and automatically synthesize an executive technical report:

# Excerpt from report_prompt.md
1. Parse evaluation metrics (BERTScore, ROUGE-L, Perplexity) from /eval/results_alpha_*.json.
2. Group model variants by empathy score, conversational naturalness, and safety compliance.
3. Highlight critical failure cases (e.g., hyper-formal robotic apologies vs conversational warmth).
4. Output the synthesis directly into a publication-ready Word document structure.

The AI agent generated fine_tuning_2_report.docx in under 3 minutes, complete with comparative analysis tables and qualitative excerpt breakdowns.

---

2. The Nightmare of HTTP 401 Unauthorized in PostgreSQL

With reporting streamlined, we restored our staging database dump (backup.sql) into a local PostgreSQL instance to test end-to-end user session persistence. Although the database restored with zero SQL syntax errors, our Next.js frontend crashed into an inescapable login loop:

INFO: 127.0.0.1:54322 - "POST /auth/login HTTP/1.1" 401 Unauthorized
DETAIL: {"error": "Invalid credentials or malformed signature"}

Even with verified test credentials (test@maeumjigi.kr / Password123!), the FastAPI authentication service persistently rejected every login handshake.

sequenceDiagram
    autonumber
    actor Client as Next.js Web Client
    participant API as FastAPI Gateway (/auth/login)
    participant DB as PostgreSQL Database
    participant Auth as Passlib Bcrypt Verifier

    Client->>API: POST /auth/login {email, password}
    API->>DB: SELECT id, password_hash FROM users WHERE email=...
    DB-->>API: Returns $2a$12$... hash string
    API->>Auth: bcrypt.verify("Password123!", db_hash)
    Note over Auth: Trap 1: Salt algorithm mismatch ($2a$ vs $2b$)!
    Auth-->>API: Verification Failed (False)
    API-->>Client: 401 Unauthorized

---

3. Root Cause Investigation & debug_login.py

To isolate whether the breakdown stemmed from frontend CORS headers, database corruption, or JWT secret misconfigurations, we wrote a standalone diagnostic script: debug_login.py.

# Standalone authentication diagnostic utility: debug_login.py
import sys
from passlib.context import CryptContext
from sqlalchemy import create_engine, text

DATABASE_URL = "postgresql://postgres:secret@localhost:5432/maeumjigi"
pwd_context = CryptContext(schemes=["bcrypt"], deprecated="auto")

def diagnose_user_auth(email: str, raw_pass: str):
    engine = create_engine(DATABASE_URL)
    with engine.connect() as conn:
        result = conn.execute(text("SELECT password_hash FROM users WHERE email = :e"), {"e": email}).fetchone()
        if not result:
            print("[FAIL] User not found in database!")
            return
        
        stored_hash = result[0]
        print(f"[INFO] Retrieved hash: {stored_hash[:15]}...")
        
        # Verify hash algorithm version compatibility
        is_valid = pwd_context.verify(raw_pass, stored_hash)
        print(f"[RESULT] Password Match Status: {is_valid}")

if __name__ == "__main__":
    diagnose_user_auth("test@maeumjigi.kr", "Password123!")

Running this diagnostic exposed three compounding bugs:

Failure Vector	Technical Root Cause	Resolution Applied
Bcrypt Salt Version	Database dump contained $2a$ hashes from older PHP/Node seeds; modern passlib expected $2b$.	Configured pwd_context = CryptContext(schemes=["bcrypt"], bcrypt__ident="2b", deprecated="auto").
JWT Secret Encoding	Secret string was loaded via .env with trailing newline `

, breaking HMAC-SHA256 signature checks. | Sanitized key ingestion: SECRET_KEY = os.getenv("JWT_SECRET").strip().encode('utf-8'). | | **CORS Preflight** | Chrome browser blocked Authorization: Bearerheaders during OPTIONS preflight checks. | Explicitly registeredCORSMiddlewarewithallow_headers=[""]andexpose_headers=[""]`. |

Within 45 minutes of targeted refactoring, login latency dropped to 42ms with a 100% success rate!

---

4. Architectural Expansion: Exploring Hybrid Knowledge Graphs

Resolving backend stability opened room for deeper architectural exploration. During clinical evaluation of our 2nd fine-tuned model, we noticed an intrinsic weakness shared by all parametric LLMs: factual hallucinations during multi-hop crisis reasoning.

flowchart TD
    subgraph User_Query ["User Input: Complex Crisis State"]
        U["I stopped taking my SSRI antidepressants 3 days ago and feel severe tremors."]
    end

    subgraph Hybrid_Architecture ["Hybrid Symbolic-Neural Architecture"]
        U --> KG_Extractor[Clinical Entity & Relation Extractor]
        KG_Extractor -->|Cypher Query| KG[(Neo4j Medical Knowledge Graph)]
        KG -->|Verified Triples: SSRI -> Discontinuation Syndrome| Context_Injector[Clinical Context Injector]
        
        U --> Direct_Prompt[Empathetic System Prompt]
        Direct_Prompt & Context_Injector --> FineTuned_LLM[Fine-Tuned Qwen / Llama 3.1]
    end

    subgraph Verified_Output ["Safety-Compliant Response"]
        FineTuned_LLM --> Output["Empathetic validation + Immediate medical warning regarding SSRI discontinuation syndrome."]
    end

By drafting chatbot_design_prompt.md, we laid the theoretical foundation for blending parametric LLM conversational empathy with deterministic Knowledge Graph validation.

---

5. Day 19 Key Engineering Takeaways

1. Automated Documentation: Reduced model benchmarking documentation turnaround from 6 hours to under 3 minutes using structured prompts and AI agents.
2. Hardened Authentication: Diagnosed and permanently resolved bcrypt salt mismatches and CORS header traps across PostgreSQL and FastAPI.
3. Hybrid AI Vision: Established the conceptual design for integrating symbolic Knowledge Graphs to eliminate clinical hallucinations in mental health counseling.

In Dev Log #20, we explore the completion of our 3rd fine-tuning cycle and the rollout of live community board features!