deploy: labeling server

src/aamcq/annotation/api.py

@@ -80,6 +80,17 @@ def create_app(
     app.state.max_labels_per_annotator = max_labels_per_annotator
     app.state.access_password = access_password
 
+    @app.middleware("http")
+    async def _deny_framing(request, call_next):
+        # Block any browser from rendering us inside an iframe. The HF
+        # Spaces outer page (huggingface.co/spaces/...) embeds us that
+        # way and its script-load cycle double-fires our password
+        # prompt. Users should visit the direct *.hf.space URL instead.
+        response = await call_next(request)
+        response.headers["X-Frame-Options"] = "DENY"
+        response.headers["Content-Security-Policy"] = "frame-ancestors 'none'"
+        return response
+
     def get_conn() -> sqlite3.Connection:
         return app.state.conn