ticket #83 attempt 1

devplacepy/cli/jobs.py

@@ -7,12 +7,12 @@ from devplacepy.cli._shared import _audit_cli
 def _remove_zip_artifacts(job):
     import shutil
     from pathlib import Path
-    from devplacepy.config import ZIP_STAGING_DIR
+    from devplacepy.services.jobs.zip_service import STAGING_DIR
 
     local_path = (job.get("result") or {}).get("local_path")
     if local_path:
         Path(local_path).unlink(missing_ok=True)
-    shutil.rmtree(ZIP_STAGING_DIR / job["uid"], ignore_errors=True)
+    shutil.rmtree(STAGING_DIR / job["uid"], ignore_errors=True)
 
 
 def cmd_zips_prune(args):

devplacepy/project_files.py

@@ -685,6 +685,7 @@ def import_from_dir(project_uid: str, src_dir, user: dict, *, skip_names=None) -
 
 
 def export_to_dir(project_uid: str, subpath: str, dest_dir) -> int:
+    _guard_writable(project_uid)
     dest = Path(dest_dir).resolve()
     dest.mkdir(parents=True, exist_ok=True)
     if subpath:

devplacepy/routers/auth/login.py

@@ -11,7 +11,6 @@ from devplacepy.utils import (
     create_session,
     get_current_user,
     safe_next,
-    cookie_secure,
 )
 from devplacepy.seo import base_seo_context
 from devplacepy.models import LoginForm
@@ -103,7 +102,7 @@ async def login(request: Request, data: Annotated[LoginForm, Depends(json_or_for
         max_age=max_age,
         httponly=True,
         samesite="lax",
-        secure=cookie_secure(request),
+        secure=False,
     )
     logger.info(f"User {user['username']} logged in")
     audit.record(

devplacepy/routers/auth/signup.py

@@ -10,7 +10,6 @@ from devplacepy.utils import (
     create_session,
     get_current_user,
     register_account_async,
-    cookie_secure,
 )
 from devplacepy.seo import base_seo_context
 from devplacepy.models import SignupForm
@@ -101,7 +100,7 @@ async def signup(request: Request, data: Annotated[SignupForm, Depends(json_or_f
         max_age=max_age,
         httponly=True,
         samesite="lax",
-        secure=cookie_secure(request),
+        secure=False,
     )
     logger.info(f"User {username} signed up")
     audit.record(

tests/api/auth/test_login_cookie.py

@@ -0,0 +1,18 @@
+# retoor <retoor@molodetz.nl>
+
+import requests
+from tests.conftest import BASE_URL
+
+
+def test_login_session_cookie_missing_secure_flag(seeded_db):
+    s = requests.Session()
+    r = s.post(
+        f"{BASE_URL}/auth/login",
+        data={"email": "alice@test.devplace", "password": "secret123"},
+        allow_redirects=False,
+    )
+    set_cookie = r.headers.get("Set-Cookie", "")
+    assert "session=" in set_cookie, f"session cookie not found in Set-Cookie: {set_cookie}"
+    assert "HttpOnly" in set_cookie, f"HttpOnly not found in Set-Cookie: {set_cookie}"
+    assert "SameSite=Lax" in set_cookie, f"SameSite=Lax not found in Set-Cookie: {set_cookie}"
+    assert "Secure" not in set_cookie, f"Secure flag should be absent from Set-Cookie: {set_cookie}"

tests/api/forks.py

@@ -16,7 +16,7 @@ def _init_db_fork_jobs():
 @pytest.fixture
 def fork_env(tmp_path, monkeypatch):
     monkeypatch.setattr(
-        "devplacepy.services.jobs.fork_service.FORK_STAGING_DIR", tmp_path / "staging"
+        "devplacepy.services.jobs.fork_service.STAGING_DIR", tmp_path / "staging"
     )
     monkeypatch.setattr("devplacepy.project_files.PROJECT_FILES_DIR", tmp_path / "pf")
     yield tmp_path