Update api/server.py

api/server.py

@@ -26,12 +26,12 @@ from api.clare_core import (
 # Paths / Constants
 # ----------------------------
 API_DIR = os.path.dirname(__file__)
-REPO_ROOT = os.path.abspath(os.path.join(API_DIR, ".."))
 
 MODULE10_PATH = os.path.join(API_DIR, "module10_responsible_ai.pdf")
 MODULE10_DOC_TYPE = "Literature Review / Paper"
 
-WEB_DIST = os.path.join(os.path.dirname(__file__), "..", "web", "build")
+# Vite build output in your repo is "web/build"
+WEB_DIST = os.path.abspath(os.path.join(API_DIR, "..", "web", "build"))
 WEB_INDEX = os.path.join(WEB_DIST, "index.html")
 WEB_ASSETS = os.path.join(WEB_DIST, "assets")
 
@@ -40,8 +40,7 @@ WEB_ASSETS = os.path.join(WEB_DIST, "assets")
 # ----------------------------
 app = FastAPI(title="Clare API")
 
-# If later you split FE/BE domain, this prevents CORS headaches.
-# For same-origin (Docker Space) it doesn't hurt.
+# Same-origin for Docker Space doesn't need CORS, but leaving it open helps if you later split FE/BE.
 app.add_middleware(
     CORSMiddleware,
     allow_origins=["*"],
@@ -53,12 +52,11 @@ app.add_middleware(
 # ----------------------------
 # Static hosting (Vite build)
 # ----------------------------
-# Vite build typically outputs: web/dist/index.html + web/dist/assets/*
-# We mount /assets so <script src="/assets/..."> works.
+# Mount /assets so <script src="/assets/..."> works.
 if os.path.isdir(WEB_ASSETS):
     app.mount("/assets", StaticFiles(directory=WEB_ASSETS), name="assets")
 
-# Optionally also serve other static files in dist root (favicon, etc.)
+# Optional: serve other static files in build root (e.g., favicon) under /static
 if os.path.isdir(WEB_DIST):
     app.mount("/static", StaticFiles(directory=WEB_DIST), name="static")
 
@@ -68,7 +66,7 @@ def index():
     if os.path.exists(WEB_INDEX):
         return FileResponse(WEB_INDEX)
     return JSONResponse(
-        {"detail": "web/dist not found. Build frontend first (web/dist/index.html)."},
+        {"detail": "web/build not found. Build frontend first (web/build/index.html)."},
         status_code=500,
     )
 
@@ -76,7 +74,6 @@ def index():
 # ----------------------------
 # In-memory session store (MVP)
 # ----------------------------
-# Production -> Redis / DB
 SESSIONS: Dict[str, Dict] = {}
 
 
@@ -231,8 +228,10 @@ async def upload(
 
     sess = _get_session(user_id)
 
-    # Save to /tmp
-    tmp_path = f"/tmp/{file.filename}"
+    # Save to /tmp (sanitize filename)
+    safe_name = os.path.basename(file.filename).replace("..", "_")
+    tmp_path = os.path.join("/tmp", safe_name)
+
     content = await file.read()
     with open(tmp_path, "wb") as f:
         f.write(content)
@@ -310,13 +309,17 @@ def memoryline(user_id: str):
 @app.get("/{full_path:path}")
 def spa_fallback(full_path: str, request: Request):
     # Do not hijack API/static paths
-    if full_path.startswith("api/") or full_path.startswith("assets/") or full_path.startswith("static/"):
+    if (
+        full_path.startswith("api/")
+        or full_path.startswith("assets/")
+        or full_path.startswith("static/")
+    ):
         return JSONResponse({"detail": "Not Found"}, status_code=404)
 
     if os.path.exists(WEB_INDEX):
         return FileResponse(WEB_INDEX)
 
     return JSONResponse(
-        {"detail": "web/dist not found. Build frontend first."},
+        {"detail": "web/build not found. Build frontend first (web/build/index.html)."},
         status_code=500,
     )