fix: bypass WebSocket in all BaseHTTPMiddleware to prevent WS protocol breakage

Author: ishaanxgupta

src/api/middleware.py

@@ -29,6 +29,10 @@ class RequestContextMiddleware(BaseHTTPMiddleware):
     async def dispatch(
         self, request: Request, call_next: RequestResponseEndpoint,
     ) -> Response:
+        # Skip WebSocket connections — BaseHTTPMiddleware breaks WS protocol
+        if request.scope.get("type") == "websocket":
+            return await call_next(request)
+
         request_id = request.headers.get("X-Request-ID") or uuid.uuid4().hex
         request.state.request_id = request_id
 
@@ -53,6 +57,9 @@ class SecurityHeadersMiddleware(BaseHTTPMiddleware):
     async def dispatch(
         self, request: Request, call_next: RequestResponseEndpoint,
     ) -> Response:
+        if request.scope.get("type") == "websocket":
+            return await call_next(request)
+
         response = await call_next(request)
         response.headers["X-Content-Type-Options"] = "nosniff"
         response.headers["X-Frame-Options"] = "DENY"
@@ -70,6 +77,9 @@ class MaxBodySizeMiddleware(BaseHTTPMiddleware):
     async def dispatch(
         self, request: Request, call_next: RequestResponseEndpoint,
     ) -> Response:
+        if request.scope.get("type") == "websocket":
+            return await call_next(request)
+
         content_length = request.headers.get("content-length")
         if content_length and int(content_length) > settings.max_request_body_bytes:
             from fastapi.responses import JSONResponse
@@ -92,6 +102,9 @@ class PrometheusMiddleware(BaseHTTPMiddleware):
     async def dispatch(
         self, request: Request, call_next: RequestResponseEndpoint,
     ) -> Response:
+        if request.scope.get("type") == "websocket":
+            return await call_next(request)
+
         from src.config.metrics import METRICS
 
         # Normalise path to avoid high-cardinality (collapse IDs)
@@ -132,6 +145,9 @@ class AnalyticsMiddleware(BaseHTTPMiddleware):
     async def dispatch(
         self, request: Request, call_next: RequestResponseEndpoint,
     ) -> Response:
+        if request.scope.get("type") == "websocket":
+            return await call_next(request)
+
         from src.config.analytics import analytics
 
         start = time.perf_counter()

src/api/routes/auth.py

@@ -113,7 +113,8 @@ def verify_google_token(credential: str) -> dict:
         idinfo = id_token.verify_oauth2_token(
             credential,
             google_requests.Request(),
-            settings.google_client_id
+            settings.google_client_id,
+            clock_skew_in_seconds=60
         )
 
         # Check issuer

src/graph/neo4j_client.py

@@ -141,9 +141,21 @@ def initialize_date_nodes(self) -> None:
         UNWIND $dates AS date_str
         MERGE (d:{GraphSchema.LABEL_DATE} {{ {GraphSchema.PROP_DATE_VAL}: date_str }})
         """
+        dummy_query = f"""
+        CREATE (dummy:__Dummy__ {{
+            {GraphSchema.PROP_EVENT_NAME}: "",
+            {GraphSchema.PROP_DESC}: "",
+            {GraphSchema.PROP_YEAR}: "",
+            {GraphSchema.PROP_TIME}: "",
+            {GraphSchema.PROP_DATE_EXPRESSION}: "",
+            {GraphSchema.PROP_EMBEDDING}: []
+        }})
+        DELETE dummy
+        """
         with self._session() as session:
             session.run(query, dates=dates)
-        logger.info("Initialised %d date nodes.", len(dates))
+            session.run(dummy_query)
+        logger.info("Initialised %d date nodes and registered property keys.", len(dates))
 
     @_neo4j_retry()
     def create_user_node(self, user_id: str) -> None: