Update app.py

app.py

@@ -1,12 +1,11 @@
 """
-app.py — LibBee v3.5
+app.py — LibBee v3.6
 FastAPI entry point: CORS, middleware, lifespan, router mounting.
 
-Changes over v3.1:
-- Maintenance mode middleware now reads from JsonRuntimeStore (admin-editable)
-  instead of settings.maintenance_mode (env var, static at startup).
-- CORS origins updated: added ku-library.github.io.
-- Section headers added throughout.
+Changes over v3.5:
+- X-Frame-Options header REMOVED — SAMEORIGIN was blocking the HuggingFace
+  Space iframe preview. HF Spaces are sandboxed by HF itself.
+- All other security headers retained unchanged.
 """
 
 # ── Imports ────────────────────────────────────────────────────────────────────
@@ -124,7 +123,7 @@ async def lifespan(app: FastAPI):
 app = FastAPI(
     title="LibBee - KU Library AI",
     description="Khalifa University Library AI Assistant",
-    version="3.5.0",
+    version="3.6.0",
     lifespan=lifespan,
 )
 
@@ -147,21 +146,26 @@ app.add_middleware(
 )
 
 
-# ── Operational Guardrails Middleware ──────────────────────────────────────────
+# ── Security Headers Middleware ────────────────────────────────────────────────
 
 @app.middleware("http")
 async def security_headers(request: Request, call_next):
     """
     Add security headers to every response.
-    X-Content-Type-Options — prevents MIME sniffing
-    X-Frame-Options        — prevents clickjacking
-    Referrer-Policy        — limits referrer leakage
-    X-XSS-Protection       — legacy XSS filter (belt-and-braces)
-    Permissions-Policy     — disables unused browser features
+
+    X-Content-Type-Options  — prevents MIME sniffing
+    X-Frame-Options         — INTENTIONALLY OMITTED (v3.6):
+                              Setting SAMEORIGIN or DENY blocks the HuggingFace
+                              Space iframe preview. HF Spaces are sandboxed by
+                              HuggingFace's own iframe security model, so this
+                              header is not needed here.
+    Referrer-Policy         — limits referrer leakage
+    X-XSS-Protection        — legacy XSS filter (belt-and-braces)
+    Permissions-Policy      — disables unused browser features
     """
     response = await call_next(request)
     response.headers["X-Content-Type-Options"]  = "nosniff"
-    response.headers["X-Frame-Options"]          = "SAMEORIGIN"
+    # X-Frame-Options deliberately omitted — SAMEORIGIN breaks HF Space iframe
     response.headers["Referrer-Policy"]          = "strict-origin-when-cross-origin"
     response.headers["X-XSS-Protection"]         = "1; mode=block"
     response.headers["Permissions-Policy"]       = (
@@ -170,6 +174,8 @@ async def security_headers(request: Request, call_next):
     return response
 
 
+# ── Operational Guardrails Middleware ──────────────────────────────────────────
+
 @app.middleware("http")
 async def operational_guardrails(request: Request, call_next):
     settings = get_settings()
@@ -250,7 +256,7 @@ def health_check():
     settings = get_settings()
     return {
         "status": "ok",
-        "version": "3.5.0",
+        "version": "3.6.0",
         "service": "LibBee KU Library AI",
         "rag_ready": rag_service.is_ready(),
         "maintenance_mode": settings.maintenance_mode,