Serve public vectors through direct signed CDN downloads

backend/app.py

@@ -20,7 +20,7 @@ import httpx
 from dotenv import load_dotenv
 from fastapi import Depends, FastAPI, Header, HTTPException, Request
 from fastapi.middleware.cors import CORSMiddleware
-from fastapi.responses import StreamingResponse
+from fastapi.responses import RedirectResponse, StreamingResponse
 from starlette.background import BackgroundTask
 from pydantic import BaseModel, ConfigDict, Field, model_validator
 
@@ -153,9 +153,28 @@ def terminology_asset(asset_path: str):
     # HTTPX strips Authorization on cross-origin CDN redirects. Neither the HF
     # token nor provider keys are forwarded to the browser.
     client = httpx.Client(timeout=60, follow_redirects=True)
+    url = f"https://huggingface.co/datasets/{repo}/resolve/{revision}/{asset_path}"
+    public = os.getenv("PIPELINE_PUBLIC_ACCESS", "").lower() == "true"
+    if public and asset_path.endswith(".f32"):
+        # Let the CDN serve large vectors directly. Only the temporary link to
+        # this file reaches the browser; the HF access token stays server-side.
+        try:
+            resolved = client.head(url, headers=headers, follow_redirects=False)
+            location = resolved.headers.get("location", "")
+            target = httpx.URL(location)
+            trusted = target.scheme == "https" and any(
+                target.host == domain or target.host.endswith("." + domain)
+                for domain in ("hf.co", "huggingface.co"))
+            if resolved.is_redirect and trusted:
+                client.close()
+                # Signed links expire: cache the verified bytes in the browser,
+                # never the redirect itself.
+                return RedirectResponse(location, status_code=307, headers={"Cache-Control": "no-store"})
+        except (httpx.HTTPError, httpx.InvalidURL):
+            pass  # Retain streaming as a fallback when resolution is unavailable.
     try:
         response = client.send(client.build_request("GET",
-            f"https://huggingface.co/datasets/{repo}/resolve/{revision}/{asset_path}", headers=headers), stream=True)
+            url, headers=headers), stream=True)
     except httpx.HTTPError:
         client.close()
         raise HTTPException(502, "The terminology download could not be reached. Please retry.") from None
@@ -177,7 +196,6 @@ def terminology_asset(asset_path: str):
             close()
 
     # Public mode permits shared caching; authenticated deployments stay private.
-    public = os.getenv("PIPELINE_PUBLIC_ACCESS", "").lower() == "true"
     cache_control = ("public, max-age=60" if asset_path.endswith("manifest.json") else "public, max-age=31536000, immutable") if public else "private, no-store"
     return StreamingResponse(chunks(), media_type="application/json" if asset_path.endswith("manifest.json") else "application/octet-stream",
                              headers={"Cache-Control": cache_control, "X-Content-Type-Options": "nosniff"},