feat(api): production security, cors hardening, latency optimizations, postman artifacts & frontend documentation

ai-patient-onboarding/app/main.py

@@ -23,19 +23,47 @@ app = FastAPI(
     lifespan=lifespan,
 )
 
-# Enable CORS for React Web & Mobile clients
+from uuid import uuid4
+from fastapi import Request
+from fastapi.responses import JSONResponse
+from app.config import CORS_ORIGINS
+
+# Global Exception Handler (Hides Stack Traces in Production)
+@app.exception_handler(Exception)
+async def global_exception_handler(request: Request, exc: Exception):
+    import traceback
+    print(f"[Unhandled Server Error] Path: {request.url.path} Error: {exc}")
+    traceback.print_exc()
+    return JSONResponse(
+        status_code=500,
+        content={
+            "success": False,
+            "error": {
+                "code": "INTERNAL_SERVER_ERROR",
+                "message": "An unexpected internal server error occurred. Please contact system administration.",
+            }
+        }
+    )
+
+# Security Headers & Request Correlation Middleware
+@app.middleware("http")
+async def security_and_request_id_middleware(request: Request, call_next):
+    request_id = request.headers.get("X-Request-ID") or f"req_{uuid4().hex[:12]}"
+    response = await call_next(request)
+    response.headers["X-Request-ID"] = request_id
+    response.headers["X-Content-Type-Options"] = "nosniff"
+    response.headers["X-Frame-Options"] = "DENY"
+    response.headers["Referrer-Policy"] = "strict-origin-when-cross-origin"
+    return response
+
+# Enable Production-Safe CORS for React Web & Mobile clients (Outermost Layer)
 app.add_middleware(
     CORSMiddleware,
-    allow_origins=[
-        "https://onboarding.skyheal.ai",
-        "http://localhost:5173",
-        "http://127.0.0.1:5173",
-        "*",
-    ],
+    allow_origins=CORS_ORIGINS,
     allow_credentials=True,
     allow_methods=["*"],
     allow_headers=["*"],
-    expose_headers=["*"],
+    expose_headers=["X-Request-ID"],
 )
 
 app.include_router(onboarding_router)