CSP fix: explicit script-src unsafe-eval + allow HF iframe (serve.py)

serve.py

@@ -88,6 +88,39 @@ except Exception as exc:  # noqa: BLE001
     log.warning("Could not adjust TrustedHostMiddleware: %s", exc)
 
 
+# Final response headers for HF iframe + CSP (runs outermost when added last)
+from starlette.middleware.base import BaseHTTPMiddleware
+from starlette.requests import Request as StarletteRequest
+from starlette.responses import Response as StarletteResponse
+
+
+class HfBrowserCompatMiddleware(BaseHTTPMiddleware):
+    CSP = (
+        "default-src 'self'; "
+        "script-src 'self' 'unsafe-inline' 'unsafe-eval' https://cdn.jsdelivr.net blob:; "
+        "style-src 'self' 'unsafe-inline' https://fonts.googleapis.com; "
+        "font-src 'self' https://fonts.gstatic.com data:; "
+        "img-src 'self' data: https: blob:; "
+        "connect-src 'self' https: wss: ws:; "
+        "worker-src 'self' blob:; "
+        "frame-ancestors 'self' https://huggingface.co https://*.huggingface.co https://*.hf.space; "
+        "base-uri 'self'; "
+        "object-src 'none'"
+    )
+
+    async def dispatch(self, request: StarletteRequest, call_next):
+        response: StarletteResponse = await call_next(request)
+        # Remove frame deny so Space can load in HF shell iframe
+        if "x-frame-options" in response.headers:
+            del response.headers["x-frame-options"]
+        response.headers["Content-Security-Policy"] = self.CSP
+        response.headers.setdefault("X-Content-Type-Options", "nosniff")
+        return response
+
+
+app.add_middleware(HfBrowserCompatMiddleware)
+
+
 def _strip_root_routes() -> None:
     """main_api_app registers GET / — remove so frontend can own the landing page."""
     kept = []