From 3af3431da40e77264d7c117dacb92b57f4864b6d Mon Sep 17 00:00:00 2001
From: jp170na <jan.ptak@student.tuke.sk>
Date: Fri, 14 Aug 2026 23:45:15 +0200
Subject: [PATCH] main

---
 app/main.py | 64 ++++++++++++++++++++++++++++++++++++++++++-----------
 1 file changed, 51 insertions(+), 13 deletions(-)

diff --git a/app/main.py b/app/main.py
index 53bf975..750201a 100644
--- a/app/main.py
+++ b/app/main.py
@@ -6,8 +6,13 @@ import sys
 from contextlib import asynccontextmanager
 from pathlib import Path
 
-from fastapi import FastAPI
-from fastapi.middleware.cors import CORSMiddleware
+from fastapi import (
+    FastAPI,
+    Request,
+)
+from fastapi.middleware.cors import (
+    CORSMiddleware,
+)
 
 
 PROJECT_ROOT = Path(__file__).resolve().parents[1]
@@ -38,18 +43,8 @@ OPENWEBUI_ORIGIN = (
 async def lifespan(
     _: FastAPI,
 ):
-    # Bez správne nakonfigurovanej security
-    # aplikáciu nespustíme.
     validate_security_configuration()
 
-    # Predhriatie embedding modelu je
-    # optimalizácia, nie podmienka samotného
-    # spustenia HTTP API.
-    #
-    # Ak warm-up zlyhá, API zostane dostupné.
-    # Retrieval endpoint následne vráti
-    # kontrolovanú chybu 503, ak embeddingový
-    # model skutočne nebude dostupný.
     try:
         await asyncio.to_thread(
             embed_query,
@@ -76,6 +71,13 @@ app = FastAPI(
     ),
     version="0.9.0",
     lifespan=lifespan,
+
+    # Interaktívne Swagger/ReDoc rozhrania
+    # nepotrebujeme vystavovať.
+    # /openapi.json zostáva dostupné,
+    # pretože ho používa OpenWebUI.
+    docs_url=None,
+    redoc_url=None,
 )
 
 
@@ -90,11 +92,47 @@ app.add_middleware(
         "POST",
         "OPTIONS",
     ],
-    allow_headers=["*"],
+    allow_headers=[
+        "Authorization",
+        "Content-Type",
+        "X-API-Key",
+    ],
     allow_private_network=True,
 )
 
 
+@app.middleware(
+    "http"
+)
+async def add_security_headers(
+    request: Request,
+    call_next,
+):
+    response = await call_next(
+        request
+    )
+
+    # API odpovede obsahujú retrieval kontext,
+    # preto ich nechceme ukladať do cache.
+    response.headers[
+        "Cache-Control"
+    ] = "no-store"
+
+    response.headers[
+        "X-Content-Type-Options"
+    ] = "nosniff"
+
+    response.headers[
+        "Referrer-Policy"
+    ] = "no-referrer"
+
+    response.headers[
+        "X-Frame-Options"
+    ] = "DENY"
+
+    return response
+
+
 app.include_router(
     router
 )