Upload 38 files

app.py

@@ -18,17 +18,21 @@ logging.basicConfig(level=logging.INFO)
 logger = logging.getLogger(__name__)
 
 app = Flask(__name__)
+
+# ------------------------------------------------------------
+# Critical session cookie settings for HTTPS (Hugging Face Spaces)
+# ------------------------------------------------------------
 app.config.update(
     SECRET_KEY=os.environ.get('SECRET_KEY', secrets.token_urlsafe(32)),
-    SESSION_COOKIE_SECURE=False,
+    SESSION_COOKIE_SECURE=True,               # Required for HTTPS
     SESSION_COOKIE_HTTPONLY=True,
-    SESSION_COOKIE_SAMESITE='Lax',
+    SESSION_COOKIE_SAMESITE='None',           # Allow cross-site (needed for Spaces)
     PERMANENT_SESSION_LIFETIME=timedelta(hours=24),
     SESSION_COOKIE_NAME='tmc_session',
-    WTF_CSRF_CHECK_DEFAULT=False   # Disable global CSRF for API endpoints; we use @csrf.exempt
+    WTF_CSRF_CHECK_DEFAULT=False              # Disable global CSRF (we use per‑route exemption)
 )
 
-# CORS with credentials support
+# CORS with credentials support – allow your Space domain or '*' for testing
 CORS(app, supports_credentials=True, origins=["https://moderator404-chatbot.hf.space"])
 csrf = CSRFProtect(app)
 limiter = Limiter(key_func=get_remote_address, app=app, default_limits=["1000 per hour", "100 per minute"])
@@ -38,17 +42,16 @@ rag_helper = RAGHelper(use_vector_search=True)
 
 # ---------- Hugging Face Inference Providers (OpenAI-compatible) ----------
 HF_TOKEN = os.environ.get('HF_TOKEN')
-HUGGINGFACE_MODEL = "google/gemma-4-26B-A4B-it:novita"
+HUGGINGFACE_MODEL = "google/gemma-4-26B-A4B-it:novita"   # or any other supported model
 API_BASE_URL = "https://router.huggingface.co/v1"
 
-# Initialize client only if token exists
 if HF_TOKEN and HF_TOKEN != "dummy":
     hf_client = OpenAI(base_url=API_BASE_URL, api_key=HF_TOKEN)
 else:
     hf_client = None
     logger.warning("HF_TOKEN not set. Using mock responses only.")
 
-# ---------- Mock response fallback ----------
+# ---------- Mock response fallback (for when HF API is unavailable) ----------
 def mock_response(message, rag_context, ticket_context):
     msg_lower = message.lower()
     if rag_context:
@@ -232,7 +235,6 @@ def products():
 
 @app.route('/chat')
 def chat():
-    # Cache busting for static files
     cache_bust = int(time.time())
     return render_template('chat.html', configured_model=chatbot.get_configured_model(), cache_bust=cache_bust)
 
@@ -456,5 +458,12 @@ def get_product_specs(product_name):
             return jsonify({'success': True, 'specifications': f.read()})
     return jsonify({'success': False, 'error': 'Product not found'}), 404
 
+# -------------------------------------------------------------------
+# Debug endpoint (optional)
+# -------------------------------------------------------------------
+@app.route('/api/debug-headers')
+def debug_headers():
+    return jsonify(dict(request.headers))
+
 if __name__ == '__main__':
     app.run(host='0.0.0.0', port=7860, debug=False)

scripts/init_database.py

@@ -3,12 +3,14 @@ from .database import DatabaseManager
 
 def init_sample_data():
     db = DatabaseManager()
-    admin = db.create_user('admin@toomanycables.com', 'Admin', 'User', 'CHANGE_ME_ADMIN_PASSWORD', company='Too Many Cables')
+    # Admin user – change password after first login!
+    admin = db.create_user('admin@admin.com', 'Admin', 'User', 'Admin', company='Too Many Cables')
     if admin:
         with db.get_connection() as conn:
             conn.execute("UPDATE users SET role = 'admin' WHERE id = ?", (admin,))
             conn.commit()
-        print("Admin created with password 'CHANGE_ME_ADMIN_PASSWORD'. Change it immediately via UI or DB.")
+        print("Admin created with password 'CHANGE_ME_ADMIN_PASSWORD'")
+    # Sample customer
     db.create_user('customer@example.com', 'John', 'Customer', 'customer123', company='Example Corp')
     print("Sample data initialized.")