feat: restrict iframe embedding to huggingface.co

When ALLOW_IFRAME=true, instead of allowing all origins, now specifically
allows embedding only from https://huggingface.co and 'self'.

This enables embedding the chat UI on pages like huggingface.co/papers
while maintaining security by blocking embedding from other origins.

src/hooks.server.ts

@@ -284,8 +284,13 @@ export const handle: Handle = async ({ event, resolve }) => {
 			// Update request context with status code
 			updateRequestContext({ statusCode: response.status });
 
-			// Add CSP header to disallow framing if ALLOW_IFRAME is not "true"
-			if (config.ALLOW_IFRAME !== "true") {
+			// Add CSP header to control iframe embedding
+			if (config.ALLOW_IFRAME === "true") {
+				response.headers.append(
+					"Content-Security-Policy",
+					"frame-ancestors 'self' https://huggingface.co;"
+				);
+			} else {
 				response.headers.append("Content-Security-Policy", "frame-ancestors 'none';");
 			}
 

svelte.config.js

@@ -37,7 +37,8 @@ const config = {
 		},
 		csp: {
 			directives: {
-				...(process.env.ALLOW_IFRAME === "true" ? {} : { "frame-ancestors": ["'none'"] }),
+				"frame-ancestors":
+					process.env.ALLOW_IFRAME === "true" ? ["'self'", "https://huggingface.co"] : ["'none'"],
 			},
 		},
 		alias: {