Fix: Add explicit CORS headers and improve file serving for report-demo route

chatkit/backend/app/main.py

@@ -271,9 +271,9 @@ async def serve_report_template():
 # Report Demo Route
 # =============================================================================
 
-@app.get("/report-demo")
+@app.get("/report-demo", response_class=Response)
 async def serve_report_demo():
-    """Serve the HTML report template demo."""
+    """Serve the HTML report template demo - publicly accessible."""
     # Try multiple possible locations (in order of preference)
     base_dir = Path(__file__).parent.parent  # /home/user/app in Docker
     possible_paths = [
@@ -288,11 +288,28 @@ async def serve_report_demo():
     
     for template_path in possible_paths:
         if template_path and template_path.exists():
-            return FileResponse(
-                template_path,
-                media_type="text/html",
-                headers={"Cache-Control": "public, max-age=3600"}
-            )
+            # Read file content and return with explicit headers
+            try:
+                content = template_path.read_text(encoding='utf-8')
+                return Response(
+                    content=content,
+                    media_type="text/html; charset=utf-8",
+                    headers={
+                        "Cache-Control": "public, max-age=3600",
+                        "X-Content-Type-Options": "nosniff",
+                        "Access-Control-Allow-Origin": "*",
+                    }
+                )
+            except Exception as e:
+                # If reading fails, try FileResponse as fallback
+                return FileResponse(
+                    template_path,
+                    media_type="text/html; charset=utf-8",
+                    headers={
+                        "Cache-Control": "public, max-age=3600",
+                        "Access-Control-Allow-Origin": "*",
+                    }
+                )
     
     # If not found, return helpful error message with debug info
     current_dir = base_dir
@@ -308,7 +325,8 @@ async def serve_report_demo():
     return Response(
         content=f"Report template not found.\nDebug info:\n{json.dumps(debug_info, indent=2)}",
         status_code=404,
-        media_type="text/plain"
+        media_type="text/plain",
+        headers={"Access-Control-Allow-Origin": "*"}
     )