Update app.py

app.py

@@ -1,6 +1,6 @@
 """
 ORBIT – Flask Application (SaaS Edition)
-Backend: Google OAuth · SQLite · Multi-provider LLM routing
+Backend: Google OAuth · SQLite/PostgreSQL · Multi-provider LLM routing
 """
 import os
 import json
@@ -30,6 +30,15 @@ app.config.from_object(Config)
 CORS(app)
 db.init_app(app)
 
+# ── FIX IFRAME & SECURITY HEADERS ───────────────────────────────────────────
+@app.after_request
+def add_header(response):
+    # Mengizinkan domain .my.id lo untuk membungkus app ini dalam iframe
+    response.headers['Content-Security-Policy'] = "frame-ancestors 'self' https://orbit-ai.my.id https://*.my.id"
+    # Menghapus batasan X-Frame-Options agar bisa tampil di domain luar
+    response.headers.pop('X-Frame-Options', None)
+    return response
+
 # ── OAuth Setup ─────────────────────────────────────────────────────────────
 oauth = OAuth(app)
 google = oauth.register(
@@ -276,7 +285,7 @@ def api_chat():
         headers = {
             "Content-Type": "application/json",
             "Authorization": f"Bearer {api_key}",
-            "HTTP-Referer": "https://orbit-assistant.app",
+            "HTTP-Referer": "https://orbit-ai.my.id",
             "X-Title": "ORBIT Educational Assistant",
         }
         composed = [{"role": "system", "content": SYSTEM_PROMPT}]
@@ -428,6 +437,4 @@ if __name__ == "__main__":
     # Cetak info untuk log server
     print(f"[ORBIT] Starting server on port {port}...")
     
-    # Pada produksi, debug harus False. 
-    # Kita set False secara manual atau pastikan Config.DEBUG di config.py adalah False
-    app.run(host="0.0.0.0", port=port, debug=False)
+    app.run(host="0.0.0.0", port=port, debug=False)