feat(chronicle): Phase 2 — Research & evidence

apps/chronicle/server/src/chronicle_server/app.py

@@ -9,12 +9,17 @@
 from starlette.middleware.base import BaseHTTPMiddleware, RequestResponseEndpoint
 
 from chronicle_server.archive import router as archive_router
+from chronicle_server.ask import router as ask_router
 from chronicle_server.auth import router as auth_router
 from chronicle_server.chronicle import router as chronicle_router
 from chronicle_server.config import ChronicleSettings
 from chronicle_server.db import create_pool, ensure_user, init_app_tables
+from chronicle_server.files import router as files_router
 from chronicle_server.health import router as health_router
+from chronicle_server.interpret import router as interpret_router
+from chronicle_server.search import router as search_router
 from chronicle_server.sources import router as sources_router
+from chronicle_server.workspaces import router as workspaces_router
 
 if TYPE_CHECKING:
     from collections.abc import AsyncIterator
@@ -27,9 +32,10 @@ class SecurityHeadersMiddleware(BaseHTTPMiddleware):
 
     async def dispatch(self, request: Request, call_next: RequestResponseEndpoint) -> Response:
         response = await call_next(request)
-        response.headers["X-Content-Type-Options"] = "nosniff"
-        response.headers["Referrer-Policy"] = "no-referrer"
-        response.headers["Content-Security-Policy"] = "default-src 'none'"
+        response.headers.setdefault("X-Content-Type-Options", "nosniff")
+        response.headers.setdefault("Referrer-Policy", "no-referrer")
+        # Preserve endpoint-specific CSP (e.g. preview sandbox) when already set.
+        response.headers.setdefault("Content-Security-Policy", "default-src 'none'")
         return response
 
 
@@ -62,7 +68,12 @@ async def lifespan(app: FastAPI) -> AsyncIterator[None]:
     app.include_router(archive_router, prefix="/api/archive")
     app.include_router(chronicle_router, prefix="/api/chronicle")
     app.include_router(health_router, prefix="/api/health")
+    app.include_router(search_router, prefix="/api")
+    app.include_router(interpret_router, prefix="/api")
     app.include_router(sources_router, prefix="/api")
+    app.include_router(files_router, prefix="/api")
+    app.include_router(ask_router, prefix="/api")
+    app.include_router(workspaces_router, prefix="/api")
     # Stash settings early so tests can inspect before lifespan if needed.
     app.state.settings = resolved
     return app