Delete app.py

app.py

@@ -1,154 +0,0 @@
-from __future__ import annotations
-
-import os
-import secrets
-from pathlib import Path
-
-# ZeroGPU: import spaces before other GPU-sensitive modules.
-try:
-    import spaces
-except ImportError:  # Local lint/test fallback; ZeroGPU provides the real package.
-    class _SpacesFallback:
-        @staticmethod
-        def GPU(*args, **kwargs):
-            def deco(fn):
-                return fn
-            return deco
-    spaces = _SpacesFallback()
-import gradio as gr
-import uvicorn
-from fastapi import FastAPI, Request
-from fastapi.middleware.cors import CORSMiddleware
-from fastapi.responses import JSONResponse, FileResponse
-from starlette.middleware.base import BaseHTTPMiddleware
-from starlette.middleware.sessions import SessionMiddleware
-
-from bh56_core import BH56_VERSION, STORE, admin_auth
-from bh56_ui import BASE_CSS, PAGE_JS, build_admin_ui, build_student_ui
-
-
-os.environ.setdefault("GRADIO_ANALYTICS_ENABLED", "False")
-os.environ.setdefault("HF_HUB_DISABLE_TELEMETRY", "1")
-os.environ.setdefault("TOKENIZERS_PARALLELISM", "false")
-
-SESSION_SECRET = os.getenv("BH56_SESSION_SECRET", "")
-if not SESSION_SECRET:
-    # A Space Secret is strongly recommended. This runtime-only value is safer
-    # than hardcoding a secret in a public Space, but sessions reset on restart.
-    SESSION_SECRET = secrets.token_urlsafe(48)
-    print("[BH56 security] BH56_SESSION_SECRET is not configured; using a temporary runtime secret.")
-
-MAIN_ADMIN_PASSWORD = os.getenv("BH56_MAIN_ADMIN_PASSWORD", "")
-if not MAIN_ADMIN_PASSWORD:
-    print("[BH56 security] BH56_MAIN_ADMIN_PASSWORD is not configured. /admin login will not accept the main account until it is set as a Space Secret.")
-
-app = FastAPI(
-    title=f"Artificial Chachma (AC) {BH56_VERSION}",
-    docs_url=None,
-    redoc_url=None,
-    openapi_url=None,
-)
-app.add_middleware(SessionMiddleware, secret_key=SESSION_SECRET, https_only=True, same_site="lax", max_age=1800)
-
-# Keep CORS restrictive. Embedding the page in an iframe does not require broad
-# cross-origin API access. Add origins only when a separate trusted frontend
-# truly needs XHR access.
-allowed_origins = [x.strip() for x in os.getenv("BH56_CORS_ORIGINS", "https://5bcheder.com,https://www.5bcheder.com").split(",") if x.strip()]
-app.add_middleware(
-    CORSMiddleware,
-    allow_origins=allowed_origins,
-    allow_credentials=True,
-    allow_methods=["GET", "POST"],
-    allow_headers=["Content-Type", "Authorization", "X-Requested-With"],
-)
-
-
-class SecurityHeadersMiddleware(BaseHTTPMiddleware):
-    async def dispatch(self, request: Request, call_next):
-        response = await call_next(request)
-        frame_ancestors = os.getenv(
-            "BH56_FRAME_ANCESTORS",
-            "'self' https://huggingface.co https://*.huggingface.co https://5bcheder.com https://www.5bcheder.com https://*.hf.space",
-        )
-        response.headers["X-Content-Type-Options"] = "nosniff"
-        response.headers["Referrer-Policy"] = "strict-origin-when-cross-origin"
-        response.headers["Permissions-Policy"] = "geolocation=(self), microphone=(self), camera=()"
-        response.headers["Content-Security-Policy"] = f"frame-ancestors {frame_ancestors};"
-        response.headers["Cache-Control"] = "no-store" if request.url.path.startswith("/admin") else "private, max-age=0"
-        return response
-
-
-app.add_middleware(SecurityHeadersMiddleware)
-
-
-ICON_PATH = Path(__file__).with_name("ac_app_icon.png")
-
-@app.get("/ac_app_icon.png", include_in_schema=False)
-def ac_app_icon():
-    return FileResponse(str(ICON_PATH), media_type="image/png", headers={"Cache-Control":"public, max-age=86400"})
-
-@app.get("/health")
-def health():
-    return JSONResponse({
-        "ok": True,
-        "name": "Artificial Chachma (AC)",
-        "version": BH56_VERSION,
-        "persistent_storage": STORE.persistent_enabled,
-    })
-
-
-student_ui = build_student_ui()
-admin_ui = build_admin_ui()
-
-# IMPORTANT: mount /admin first. Then mount the student app at /. This keeps the
-# student URL clean while still providing a separate protected admin URL.
-app = gr.mount_gradio_app(
-    app,
-    admin_ui,
-    path="/admin",
-    auth=admin_auth,
-    auth_message="AC Admin — authorized administrators only.",
-    footer_links=[],
-    show_error=False,
-    max_file_size="25mb",
-    enable_monitoring=False,
-    mcp_server=False,
-    ssr_mode=False,
-    pwa=True,
-    favicon_path=str(ICON_PATH),
-    theme=gr.themes.Soft(),
-    css=BASE_CSS,
-    js=PAGE_JS,
-)
-app = gr.mount_gradio_app(
-    app,
-    student_ui,
-    path="/",
-    footer_links=[],
-    show_error=False,
-    max_file_size="25mb",
-    enable_monitoring=False,
-    mcp_server=False,
-    ssr_mode=False,
-    pwa=True,
-    favicon_path=str(ICON_PATH),
-    theme=gr.themes.Soft(primary_hue="blue"),
-    css=BASE_CSS,
-    js=PAGE_JS,
-)
-
-
-# With custom FastAPI mounting, some ZeroGPU runtimes do not see the normal
-# Blocks.launch() startup hook. This guarded call reports decorated @spaces.GPU
-# functions to ZeroGPU when the helper is available, and is harmless otherwise.
-try:
-    import spaces.zero as _spaces_zero
-    if hasattr(_spaces_zero, "startup"):
-        _spaces_zero.startup()
-except Exception as exc:
-    print(f"[BH56 ZeroGPU] startup report note: {exc}")
-
-
-if __name__ == "__main__":
-    port = int(os.getenv("GRADIO_SERVER_PORT", os.getenv("PORT", "7860")))
-    uvicorn.run(app, host="0.0.0.0", port=port, log_level="info")