Serve HUD from FastAPI + lock CORS to HF Space URL

app/main.py

@@ -31,6 +31,7 @@ main.py
 from fastapi import FastAPI
 from fastapi import UploadFile, File, Form
 from fastapi.middleware.cors import CORSMiddleware
+from fastapi.responses import FileResponse
 import tempfile
 import os
 from src.classifier import predict_aircraft
@@ -52,10 +53,12 @@ app = FastAPI()
 # allow_headers=["*"]  → accept any headers the browser sends with the request
 app.add_middleware(
     CORSMiddleware,
-    allow_origins=["*"],
+    allow_origins=["https://eakempreet-atas.hf.space"],
     allow_methods=["*"],
     allow_headers=["*"],
 )
+# Now that the HUD is served from the same Space, no other origin needs access
+# This prevents random websites from hitting your /analyze endpoint
 
 
 # Function to take the inputs

frontend/atas_hud_v11.html

@@ -584,7 +584,7 @@ async function startSimulation() {
 
   try {
     // 4. Fire to FastAPI Backend
-    const response = await fetch('http://localhost:8000/analyze', {
+    const response = await fetch('https://eakempreet-atas.hf.space/analyze', {
         method: 'POST',
         body: formData
     });