Update app.py

app.py

@@ -24,15 +24,16 @@ logger = logging.getLogger(__name__)
 
 app = Flask(__name__)
 
-# ---------- CORS and session ----------
-CORS(app, resources={r"/*": {"origins": "*"}}, supports_credentials=False,
+# ---------- CORS and session (FIXED for cross‑origin iframe) ----------
+CORS(app, resources={r"/*": {"origins": "*"}}, supports_credentials=True,
      allow_headers=["Content-Type", "Authorization"], methods=["GET", "POST", "OPTIONS"])
 
 app.config.update(
     SECRET_KEY=os.environ.get('SECRET_KEY', secrets.token_urlsafe(32)),
-    SESSION_COOKIE_SECURE=os.environ.get('FLASK_ENV') == 'production',
+    SESSION_COOKIE_SECURE=os.environ.get('FLASK_ENV') == 'production',  # True on Hugging Face Spaces (HTTPS)
     SESSION_COOKIE_HTTPONLY=True,
-    SESSION_COOKIE_SAMESITE='Lax',
+    SESSION_COOKIE_SAMESITE='None',          # Required for cross‑origin iframe
+    SESSION_COOKIE_DOMAIN='.hf.space',       # Allows cookie across all Spaces subdomains
     PERMANENT_SESSION_LIFETIME=timedelta(hours=24),
     SESSION_COOKIE_NAME='tmc_session',
     WTF_CSRF_TIME_LIMIT=3600
@@ -142,20 +143,44 @@ def security_headers():
 
 @app.after_request
 def after_request(response):
+    """Add security headers and dynamic CORS (allows credentials)"""
     response.headers['X-Content-Type-Options'] = 'nosniff'
     response.headers['X-Frame-Options'] = 'DENY'
     response.headers['X-XSS-Protection'] = '1; mode=block'
     if request.is_secure:
         response.headers['Strict-Transport-Security'] = 'max-age=31536000; includeSubDomains'
     response.headers['Content-Security-Policy'] = "default-src 'self'; script-src 'self' 'unsafe-inline'; style-src 'self' 'unsafe-inline'"
-    response.headers['Access-Control-Allow-Origin'] = '*'
-    response.headers['Access-Control-Allow-Methods'] = 'GET, POST, OPTIONS'
+    
+    # CORS for credentialed requests – echo the actual origin
+    origin = request.headers.get('Origin')
+    if origin and (origin.endswith('.hf.space') or origin == 'https://moderator404-chatbot.hf.space'):
+        response.headers['Access-Control-Allow-Origin'] = origin
+        response.headers['Access-Control-Allow-Credentials'] = 'true'
+    else:
+        response.headers['Access-Control-Allow-Origin'] = '*'
+    
+    response.headers['Access-Control-Allow-Methods'] = 'GET, POST, OPTIONS, PUT, DELETE'
     response.headers['Access-Control-Allow-Headers'] = 'Content-Type, Authorization'
     response.headers['Access-Control-Max-Age'] = '86400'
+    
     if session.get('session_id'):
         refresh_session_timeout()
     return response
 
+# ---------- RAG initialization ----------
+logger.info("Initializing RAG system...")
+try:
+    rag_helper = RAGHelper(use_vector_search=True)
+    logger.info(f"RAG system initialized successfully! Vector search: {rag_helper.use_vector_search}")
+    if rag_helper.use_vector_search and rag_helper.vector_rag:
+        logger.info("Building vector index...")
+        index_stats = rag_helper.ensure_vector_index()
+        logger.info(f"Vector index status: {index_stats}")
+except Exception as e:
+    logger.error(f"RAG initialization failed: {e}")
+    logger.info("Creating fallback RAG helper without vector search")
+    rag_helper = RAGHelper(use_vector_search=False)
+
 # ---------- ChatBot class ----------
 class ChatBot:
     def __init__(self, db_manager, configured_model="mistral:7b"):
@@ -213,7 +238,6 @@ class ChatBot:
     def detect_corruption_patterns(self, text):
         if not text or len(text) < 5:
             return False, "Too short"
-        import re
         if re.match(r'^(.)\1{6,}', text.strip()):
             return True, "Repetitive single character"
         unique_chars = len(set(text.replace(' ', '').replace('\n', '')))
@@ -284,7 +308,6 @@ class ChatBot:
 
     def _generate_conversation_summary(self, text):
         try:
-            # Simple fallback – original used Ollama, we use mock
             return self._generate_simple_summary(text)
         except Exception:
             return "Conversation summary unavailable"
@@ -303,7 +326,6 @@ class ChatBot:
             if esc.get('needs_escalation'):
                 self._escalate_ticket(details['ticket_id'], f"Pre-check: {'; '.join(esc.get('reasons', []))}")
                 return
-            # For HF version, we skip the AI call and use rule-based fallback
             self._execute_ai_ticket_decision(ticket_number, "", details)
         except Exception as e:
             logger.error(f"AI decision error: {e}")
@@ -440,7 +462,7 @@ class ChatBot:
             return [truncated]
         return []
 
-    # ---------- REPLACED SEND_MESSAGE (HF InferenceClient) ----------
+    # ---------- SEND_MESSAGE (Hugging Face InferenceClient) ----------
     def send_message(self, message, conversation_id=None, user_id=None, session_id=None):
         start_time = time.time()
         if conversation_id is None:
@@ -590,7 +612,7 @@ class ChatBot:
 chatbot = ChatBot(db)
 chatbot.configured_model = chatbot.load_configured_model()
 
-# ---------- All original security functions (unchanged) ----------
+# ---------- Security functions (unchanged) ----------
 def check_level2_patterns(text):
     text_lower = text.lower()
     patterns = [
@@ -601,23 +623,16 @@ def check_level2_patterns(text):
         r'pretend\s+(you\s+are|to\s+be)\s+(a\s+)?(different|unrestricted|unfiltered)',
         r'roleplay\s+as',
         r'simulate\s+(being\s+)?a\s+(different|unrestricted)',
-        r'\bdan\b',
-        r'do\s+anything\s+now',
+        r'\bdan\b', r'do\s+anything\s+now',
         r'ignore\s+your\s+(programming|guidelines|restrictions)',
         r'break\s+(free|out)\s+(of|from)\s+your\s+(constraints|limitations)',
-        r'new\s+instructions?:',
-        r'system\s+(override|prompt|message):',
-        r'developer\s+mode',
-        r'admin\s+mode',
-        r'root\s+access',
+        r'new\s+instructions?:', r'system\s+(override|prompt|message):',
+        r'developer\s+mode', r'admin\s+mode', r'root\s+access',
         r'show\s+me\s+your\s+(instructions?|prompt|system\s+message)',
         r'what\s+(are\s+)?your\s+(instructions?|guidelines|rules)',
         r'reveal\s+your\s+(prompt|system\s+message)',
-        r'output\s+in\s+code\s+block',
-        r'respond\s+only\s+with',
-        r'answer\s+as\s+if',
-        r'hypothetically',
-        r'for\s+educational\s+purposes',
+        r'output\s+in\s+code\s+block', r'respond\s+only\s+with',
+        r'answer\s+as\s+if', r'hypothetically', r'for\s+educational\s+purposes',
         r'</system>', r'<system>', r'\[system\]', r'\[/system\]',
         r'\\n\\nsystem:', r'assistant:', r'human:'
     ]
@@ -638,14 +653,9 @@ def check_level3_ai_analysis(text):
         score, err = analyze_input_with_ai(text)
         if err:
             return None, err
-        if score is not None:
-            if score >= 5:
-                return None, "Your input violates our usage guidelines."
-            else:
-                return text, None
-        else:
-            logger.warning("AI Level 3 analysis failed, allowing input")
-            return text, None
+        if score is not None and score >= 5:
+            return None, "Your input violates our usage guidelines."
+        return text, None
     except Exception as e:
         logger.error(f"AI Level 3 analysis error: {e}")
         return text, None
@@ -672,11 +682,9 @@ def validate_and_sanitize_input(text, max_length=5000):
     elif level >= 5:
         filtered, err = check_level2_patterns(text)
         if err:
-            logger.warning(f"Level 5 layer 1 blocked: {err}")
             return None, err
         filtered, err = check_level3_ai_analysis(text)
         if err:
-            logger.warning(f"Level 5 layer 2 blocked: {err}")
             return None, err
     return text, None
 
@@ -726,15 +734,12 @@ def check_ai_security_violations(text):
     return text, None
 
 def analyze_input_with_ai(user_input):
-    # For HF version we return a safe score (2) to avoid blocking
     return 2, None
 
 def get_ai_security_analysis(prompt):
-    # Placeholder – return safe score
     return 2
 
 def analyze_output_with_ai(ai_response):
-    # Placeholder – return safe score
     return 2, None
 
 def check_output_content_moderation(ai_response):
@@ -742,7 +747,7 @@ def check_output_content_moderation(ai_response):
     if level >= 4:
         score, err = analyze_output_with_ai(ai_response)
         if err:
-            logger.warning(f"Output analysis failed, allowing response")
+            logger.warning("Output analysis failed, allowing response")
             return ai_response, None
         if score is not None and score >= 5:
             return None, "Restricted Output Detected, please try another question or contact support@tmc.local"
@@ -1027,7 +1032,7 @@ def health_check():
 
 @app.route('/api/health/ollama')
 def ollama_health_check():
-    return jsonify({'ollama_healthy': True, 'timestamp': datetime.now().isoformat(), 'message': 'Ollama is not used (Hugging Face backend)', 'recommendation': 'All good!'})
+    return jsonify({'ollama_healthy': True, 'timestamp': datetime.now().isoformat(), 'message': 'Ollama not used (Hugging Face backend)', 'recommendation': 'All good!'})
 
 @app.route('/api/knowledge-base/stats')
 def kb_stats():
@@ -1265,8 +1270,7 @@ def admin_reply_ticket(ticket_id):
     internal = data.get('is_internal', False)
     if not msg:
         return jsonify({'success': False, 'error': 'Message required'}), 400
-    uid = session.get('user_id')
-    db.add_ticket_update(ticket_id, uid, msg, 'admin_reply', is_internal=internal)
+    db.add_ticket_update(ticket_id, session.get('user_id'), msg, 'admin_reply', is_internal=internal)
     return jsonify({'success': True})
 
 @app.route('/api/admin/tickets/stats')
@@ -1372,7 +1376,7 @@ def get_product_specs(product_name):
         return jsonify({'success': False, 'error': 'Product not found'}), 404
     with open(path, 'r', encoding='utf-8') as f:
         content = f.read()
-    # extract relevant section if multiple products share the same file
+    # Extract relevant section if multiple products share the same file
     if product_name in ['usb-c-cable', 'usb-c-standard', 'usb-c-to-usb-a']:
         sections = content.split('##')
         for s in sections: