fix: restore staging code reverted during rebase

- Restore app_factory.py from staging (CSRF, proxy header handling)
  with only our 2 changes (remove load_dotenv, /settings prefix)
- Restore PostgreSQL schema field in DatabaseModal
- Restore vendor prefix logic in ChatService.streamQuery
- Restore static getVendorPrefix import in ChatInterface

Co-Authored-By: Claude Opus 4.6 (1M context) <noreply@anthropic.com>

Author: galshubeli

api/app_factory.py

@@ -22,6 +22,7 @@
 from api.routes.database import database_router
 from api.routes.tokens import tokens_router
 from api.routes.settings import settings_router
+
 logging.basicConfig(
     level=logging.INFO, format="%(asctime)s - %(levelname)s - %(message)s"
 )
@@ -57,14 +58,17 @@ def _is_secure_request(request: Request) -> bool:
     """Determine if the request is over HTTPS."""
     forwarded_proto = request.headers.get("x-forwarded-proto")
     if forwarded_proto:
-        return forwarded_proto == "https"
+        # Normalize: proxies may send comma-separated or mixed-case values
+        first_proto = forwarded_proto.split(",")[0].strip().lower()
+        return first_proto == "https"
     return request.url.scheme == "https"
 
 
 class CSRFMiddleware(BaseHTTPMiddleware):  # pylint: disable=too-few-public-methods
     """Double Submit Cookie CSRF protection.
 
-    Sets a csrf_token cookie (readable by JS) on every response.
+    Ensures a csrf_token cookie (readable by JS) exists, setting it
+    on the response if the incoming request does not already carry one.
     State-changing requests must echo the cookie value back
     via the X-CSRF-Token header.  Bearer-token authenticated
     requests and auth/login endpoints are exempt.
@@ -129,7 +133,7 @@ def _ensure_csrf_cookie(self, request: Request, response):
 def create_app():  # pylint: disable=too-many-statements
     """Create and configure the FastAPI application."""
 
-    # Create the FastAPI app instance just to set the o routes
+    # Create the FastAPI app instance with original routes
     # Will be merged with MCP app later if MCP is enabled
     app = FastAPI(
         title="QueryWeaver"

app/src/components/chat/ChatInterface.tsx

@@ -12,6 +12,7 @@ import QueryInput from "./QueryInput";
 import SuggestionCards from "../SuggestionCards";
 import { ChatService } from "@/services/chat";
 import type { ConfirmRequest } from "@/types/api";
+import { getVendorPrefix } from "@/utils/vendorConfig";
 
 interface ChatMessageData {
   id: string;
@@ -338,7 +339,6 @@ const ChatInterface = ({
       if (isApiKeyValid && apiKey) {
         confirmRequest.custom_api_key = apiKey;
         if (modelName && vendor) {
-          const { getVendorPrefix } = await import('@/utils/vendorConfig');
           const vendorPrefix = getVendorPrefix(vendor);
           confirmRequest.custom_model = modelName.startsWith(`${vendorPrefix}/`)
             ? modelName

app/src/components/modals/DatabaseModal.tsx

@@ -29,9 +29,11 @@ const DatabaseModal = ({ open, onOpenChange }: DatabaseModalProps) => {
   const [database, setDatabase] = useState("");
   const [username, setUsername] = useState("");
   const [password, setPassword] = useState("");
+  const [schema, setSchema] = useState("");
+  const [schemaError, setSchemaError] = useState("");
   // Snowflake-specific fields
   const [account, setAccount] = useState("");
-  const [schema, setSchema] = useState("PUBLIC");
+  const [snowflakeSchema, setSnowflakeSchema] = useState("PUBLIC");
   const [warehouse, setWarehouse] = useState("COMPUTE_WH");
   const [authMode, setAuthMode] = useState<'password' | 'keypair'>('password');
   const [privateKey, setPrivateKey] = useState("");
@@ -118,7 +120,7 @@ const DatabaseModal = ({ open, onOpenChange }: DatabaseModalProps) => {
       if (connectionMode === 'manual') {
         if (selectedDatabase === 'snowflake') {
           // Build Snowflake URL: snowflake://user@account/database/schema?warehouse=WH
-          const builtUrl = new URL(`snowflake://${account}/${database}/${schema}`);
+          const builtUrl = new URL(`snowflake://${account}/${database}/${snowflakeSchema}`);
           builtUrl.username = username;
           if (authMode === 'keypair' && privateKey) {
             // Base64-encode the PEM key for safe URL transport
@@ -136,6 +138,15 @@ const DatabaseModal = ({ open, onOpenChange }: DatabaseModalProps) => {
           const builtUrl = new URL(`${protocol}://${host}:${port}/${database}`);
           builtUrl.username = username;
           builtUrl.password = password;
+
+          // Append schema option for PostgreSQL if provided
+          if (selectedDatabase === 'postgresql' && schema.trim()) {
+            if (/[^a-zA-Z0-9_]/.test(schema.trim())) {
+              throw new Error('Schema name can only contain letters, digits, and underscores');
+            }
+            builtUrl.searchParams.set('options', `-csearch_path=${schema.trim()}`);
+          }
+
           dbUrl = builtUrl.toString();
         }
       }
@@ -220,8 +231,10 @@ const DatabaseModal = ({ open, onOpenChange }: DatabaseModalProps) => {
               setDatabase("");
               setUsername("");
               setPassword("");
+              setSchema("");
+              setSchemaError("");
               setAccount("");
-              setSchema("PUBLIC");
+              setSnowflakeSchema("PUBLIC");
               setWarehouse("COMPUTE_WH");
               setAuthMode('password');
               setPrivateKey("");
@@ -416,12 +429,12 @@ const DatabaseModal = ({ open, onOpenChange }: DatabaseModalProps) => {
                   </div>
 
                   <div className="space-y-2">
-                    <Label htmlFor="schema" className="text-sm font-medium">Schema</Label>
+                    <Label htmlFor="snowflake-schema" className="text-sm font-medium">Schema</Label>
                     <Input
-                      id="schema"
+                      id="snowflake-schema"
                       placeholder="PUBLIC"
-                      value={schema}
-                      onChange={(e) => setSchema(e.target.value)}
+                      value={snowflakeSchema}
+                      onChange={(e) => setSnowflakeSchema(e.target.value)}
                       className="bg-muted border-border focus-visible:ring-purple-500"
                     />
                     <p className="text-xs text-muted-foreground">
@@ -578,6 +591,38 @@ const DatabaseModal = ({ open, onOpenChange }: DatabaseModalProps) => {
                       className="bg-muted border-border focus-visible:ring-purple-500"
                     />
                   </div>
+
+                  {/* Schema field - PostgreSQL only */}
+                  {selectedDatabase === 'postgresql' && (
+                    <div className="space-y-2">
+                      <Label htmlFor="schema" className="text-sm font-medium">
+                        Schema <span className="text-muted-foreground font-normal">(optional)</span>
+                      </Label>
+                      <Input
+                        id="schema"
+                        data-testid="schema-input"
+                        placeholder="public"
+                        value={schema}
+                        onChange={(e) => {
+                          const val = e.target.value;
+                          setSchema(val);
+                          if (val && /[^a-zA-Z0-9_]/.test(val)) {
+                            setSchemaError('Schema name can only contain letters, digits, and underscores');
+                          } else {
+                            setSchemaError('');
+                          }
+                        }}
+                        className={`bg-muted border-border ${schemaError ? 'border-red-500' : ''}`}
+                      />
+                      {schemaError ? (
+                        <p className="text-xs text-red-500">{schemaError}</p>
+                      ) : (
+                        <p className="text-xs text-muted-foreground">
+                          Leave empty to use the default &apos;public&apos; schema
+                        </p>
+                      )}
+                    </div>
+                  )}
                 </>
               )}
             </>

app/src/services/chat.ts

@@ -1,6 +1,7 @@
 import { API_CONFIG, buildApiUrl } from '@/config/api';
 import { csrfHeaders } from '@/lib/csrf';
 import type { ChatRequest, StreamMessage, ConfirmRequest } from '@/types/api';
+import { getVendorPrefix } from '@/utils/vendorConfig';
 
 /**
  * Chat/Query Service
@@ -35,25 +36,37 @@ export class ChatService {
       }
       // Add current query to the chat array
       chatHistory.push(request.query);
-      
+
+      // Build request body with custom API key/model if provided
+      const requestBody: Record<string, unknown> = {
+        chat: chatHistory,
+        result: resultHistory.length > 0 ? resultHistory : undefined,
+        ...(request.use_user_rules !== undefined && {
+          use_user_rules: request.use_user_rules
+        }),
+        ...(request.use_memory !== undefined && {
+          use_memory: request.use_memory
+        }),
+      };
+
+      if (request.customApiKey) {
+        requestBody.custom_api_key = request.customApiKey;
+      }
+      if (request.customModel && request.customVendor) {
+        const vendorPrefix = getVendorPrefix(request.customVendor);
+        const model = request.customModel;
+        requestBody.custom_model = model.startsWith(`${vendorPrefix}/`)
+          ? model
+          : `${vendorPrefix}/${model}`;
+      }
+
       const response = await fetch(buildApiUrl(endpoint), {
         method: 'POST',
         headers: {
           'Content-Type': 'application/json',
           ...csrfHeaders(),
         },
-        body: JSON.stringify({
-          chat: chatHistory,
-          result: resultHistory.length > 0 ? resultHistory : undefined,
-          ...(request.use_user_rules !== undefined && {
-            use_user_rules: request.use_user_rules
-          }),
-          ...(request.use_memory !== undefined && {
-            use_memory: request.use_memory
-          }),
-          ...(request.customApiKey && { custom_api_key: request.customApiKey }),
-          ...(request.customModel && { custom_model: request.customModel }),
-        }),
+        body: JSON.stringify(requestBody),
         credentials: 'include',
       });