Upload 9 files

.env.example

@@ -1,11 +1,15 @@
-ENVIRONMENT=development
+ENVIRONMENT=production
 ORIGIN_TOKEN=replace-with-the-same-random-value-as-worker-HF_ORIGIN_TOKEN
 OPENAI_API_KEY=
 ANTHROPIC_API_KEY=
 PRIMO_API_KEY=
 ADMIN_PASSWORD=replace-with-a-strong-admin-password
-CLOUDFLARE_WORKER_URL=https://REPLACE-WITH-YOUR-WORKER.workers.dev
+CLOUDFLARE_WORKER_URL=https://steep-haze-e1f8.nikeshn.workers.dev
 CLOUDFLARE_ADMIN_TOKEN=replace-with-the-same-random-value-as-worker-ADMIN_TOKEN
+LIBCAL_CLIENT_ID=
+LIBCAL_CLIENT_SECRET=
+LIBCAL_EVENTS_CLIENT_ID=
+LIBCAL_EVENTS_CLIENT_SECRET=
 CONTACT_EMAIL=libse@ku.ac.ae
 RUNTIME_DIR=./libbee_runtime
-ALLOWED_CORS_ORIGINS=http://localhost:8080,http://127.0.0.1:5500
+ALLOWED_CORS_ORIGINS=

README.md

@@ -8,7 +8,7 @@ app_file: app.py
 pinned: false
 ---
 
-# LibBee private origin v4.0
+# LibBee private origin v4.1 — no custom domain
 
 This Hugging Face Space is the private application origin behind the Cloudflare Worker. Browsers must not call `/agent`, `/search`, or `/feedback` directly. Those routes require `X-LibBee-Origin-Token`, which the Worker adds server-side.
 
@@ -17,8 +17,11 @@ This Hugging Face Space is the private application origin behind the Cloudflare
 - `ORIGIN_TOKEN`: a new random secret; must match the Worker's `HF_ORIGIN_TOKEN`.
 - `OPENAI_API_KEY`: required for the default model, classification, embeddings, and RAG.
 - `ADMIN_PASSWORD`: strong password for `/admin`.
-- `CLOUDFLARE_WORKER_URL`: the deployed Worker URL or custom domain; used for live LibCal data and the server-side analytics proxy.
-- `CLOUDFLARE_ADMIN_TOKEN`: must match the Worker's `ADMIN_TOKEN`; never sent to browser JavaScript.
+- `CLOUDFLARE_WORKER_URL`: `https://steep-haze-e1f8.nikeshn.workers.dev`; returned only to an authenticated admin browser with a short-lived token.
+- `CLOUDFLARE_ADMIN_TOKEN`: must match the Worker's `ADMIN_TOKEN`; used to sign 90-second read-only browser tokens. The permanent value is never returned to JavaScript.
+- `LIBCAL_CLIENT_ID` and `LIBCAL_CLIENT_SECRET`: used by HF to fetch live hours directly.
+
+If events use separate credentials, also set `LIBCAL_EVENTS_CLIENT_ID` and `LIBCAL_EVENTS_CLIENT_SECRET`; otherwise the main LibCal credentials are reused.
 
 Optional secrets: `ANTHROPIC_API_KEY` and `PRIMO_API_KEY`.
 
@@ -32,6 +35,8 @@ Use persistent HF storage and keep `RUNTIME_DIR=/data/libbee_runtime` so runtime
 - The signed FAISS/BM25 cache is ignored if it was modified or if no origin secret is configured.
 - Raw scrape dumps are kept in `data/knowledge_raw_archive` but excluded from indexing. Curated, review-dated files are indexed.
 - Persistent analytics is written by the Worker, not by the browser or the HF origin.
+- A logged-in admin browser receives only an HMAC-signed `analytics:read` token that expires after 90 seconds; Worker write endpoints reject it.
+- Live LibCal requests originate from HF, avoiding the unavailable HF-to-`workers.dev` loop.
 
 ## Local checks