deploy: sync backend to Space root (learn-lesson HF cache fix)

app/main.py

@@ -6,7 +6,7 @@ import time
 from fastapi import FastAPI, Request
 from fastapi.exceptions import RequestValidationError
 from fastapi.middleware.cors import CORSMiddleware
-from fastapi.responses import JSONResponse
+from fastapi.responses import JSONResponse, Response
 from starlette.exceptions import HTTPException as StarletteHTTPException
 
 from app.core import rate_limiter
@@ -540,6 +540,35 @@ async def rate_limit_middleware(request: Request, call_next):
     return await call_next(request)
 
 
+@app.middleware("http")
+async def credentialed_cors_preflight(request: Request, call_next):
+    """Answer OPTIONS with Allow-Credentials so browser signup is not blocked.
+
+    Hugging Face and some Starlette paths return an empty credentials header on
+    preflight. Chrome then rejects fetch({ credentials: 'include' }) from
+    docdoe.in to the Space, and the student only sees 'could not create account'.
+    """
+    if request.method == "OPTIONS":
+        origin = request.headers.get("Origin", "")
+        if origin in settings.cors_origin_list:
+            requested = request.headers.get(
+                "Access-Control-Request-Headers",
+                "authorization,content-type",
+            )
+            return Response(
+                status_code=200,
+                headers={
+                    "Access-Control-Allow-Origin": origin,
+                    "Access-Control-Allow-Credentials": "true",
+                    "Access-Control-Allow-Methods": "GET,POST,PUT,PATCH,DELETE,OPTIONS",
+                    "Access-Control-Allow-Headers": requested,
+                    "Access-Control-Max-Age": "600",
+                    "Vary": "Origin",
+                },
+            )
+    return await call_next(request)
+
+
 STATUS_CODE_MAP = {
     400: "BAD_REQUEST",
     401: "UNAUTHORIZED",