server.py

#!/usr/bin/env python3
"""Hardened static file server for the SZL Cosmos Space.

Serves the vendored 3D hologram (same directory, same port as
`python -m http.server 7860`) but adds security response headers on every
response:
  - Content-Security-Policy   (sane static policy, tuned to this page's assets)
  - Strict-Transport-Security (max-age=31536000; includeSubDomains)
  - X-Content-Type-Options    (nosniff)
  - Referrer-Policy           (strict-origin-when-cross-origin)

Additive / non-breaking. The CSP permits every resource this Space actually
uses (inline scripts incl. the ES-module importmap, inline styles, vendored
Three.js + postprocessing modules, the data: favicon, the local
data/org_nodes.json fetch, and the live /healthz + /lambda + /khipu/ledger +
verify fetches to a11oy / killinchu / a-11-oy.com), so the hologram and the live
HUD keep working. Everything else is 'self' — zero CDN.
"""
import functools
from http.server import SimpleHTTPRequestHandler, ThreadingHTTPServer

PORT = 7860
DIRECTORY = "/app"

CONTENT_SECURITY_POLICY = (
    "default-src 'self'; "
    "base-uri 'self'; "
    "object-src 'none'; "
    "script-src 'self' 'unsafe-inline'; "
    "style-src 'self' 'unsafe-inline'; "
    "img-src 'self' data: blob:; "
    "font-src 'self'; "
    "connect-src 'self' https://szlholdings-a11oy.hf.space "
    "https://szlholdings-killinchu.hf.space https://a-11-oy.com; "
    "frame-ancestors 'self' https://huggingface.co https://*.hf.space https://*.huggingface.co"
)


class HardenedHandler(SimpleHTTPRequestHandler):
    def end_headers(self):
        self.send_header("Content-Security-Policy", CONTENT_SECURITY_POLICY)
        self.send_header(
            "Strict-Transport-Security", "max-age=31536000; includeSubDomains"
        )
        self.send_header("X-Content-Type-Options", "nosniff")
        self.send_header("Referrer-Policy", "strict-origin-when-cross-origin")
        super().end_headers()


if __name__ == "__main__":
    handler = functools.partial(HardenedHandler, directory=DIRECTORY)
    httpd = ThreadingHTTPServer(("0.0.0.0", PORT), handler)
    print(f"Serving hardened static site from {DIRECTORY} on 0.0.0.0:{PORT}", flush=True)
    try:
        httpd.serve_forever()
    except KeyboardInterrupt:
        httpd.server_close()