ticket #44 attempt 2

devplacepy/routers/auth/login.py

@@ -11,6 +11,7 @@ from devplacepy.utils import (
     create_session,
     get_current_user,
     safe_next,
+    cookie_secure,
 )
 from devplacepy.seo import base_seo_context
 from devplacepy.models import LoginForm
@@ -102,7 +103,7 @@ async def login(request: Request, data: Annotated[LoginForm, Depends(json_or_for
         max_age=max_age,
         httponly=True,
         samesite="lax",
-        secure=False,
+        secure=cookie_secure(request),
     )
     logger.info(f"User {user['username']} logged in")
     audit.record(

devplacepy/routers/auth/signup.py

@@ -10,6 +10,7 @@ from devplacepy.utils import (
     create_session,
     get_current_user,
     register_account_async,
+    cookie_secure,
 )
 from devplacepy.seo import base_seo_context
 from devplacepy.models import SignupForm
@@ -100,7 +101,7 @@ async def signup(request: Request, data: Annotated[SignupForm, Depends(json_or_f
         max_age=max_age,
         httponly=True,
         samesite="lax",
-        secure=False,
+        secure=cookie_secure(request),
     )
     logger.info(f"User {username} signed up")
     audit.record(

devplacepy/static/css/devii.css

@@ -115,7 +115,6 @@ devii-terminal.devii-state-fullscreen .devii-window {
 }
 
 devii-terminal.devii-state-normal .devii-window {
-  resize: both;
 }
 devii-terminal.devii-state-normal .devii-titlebar {
   cursor: move;

devplacepy/static/js/DeviiTerminal.js

@@ -86,6 +86,7 @@ export class DeviiTerminal {
     }
 
     _canOpenOnGesture() {
+        if (this.element && this.element.state !== "closed") return false;
         if (document.querySelector(".modal-overlay.visible")) return false;
         if (document.querySelector(".dialog-overlay.visible")) return false;
         if (document.querySelector(".context-menu.visible")) return false;

devplacepy/static/js/components/FloatingWindow.js

@@ -297,8 +297,8 @@ export default class FloatingWindow extends Component {
     if (!this.geometry) return;
     const g = this.geometry;
     const safeHeight = this._safeViewport.height;
-    g.width = Math.min(g.width, window.innerWidth - 16);
+    g.width = Math.max(320, Math.min(g.width, window.innerWidth - 16));
-    g.height = Math.min(g.height, safeHeight - 16);
+    g.height = Math.max(220, Math.min(g.height, safeHeight - 16));
     g.left = Math.max(8, Math.min(g.left, window.innerWidth - g.width - 8));
     g.top = Math.max(8, Math.min(g.top, safeHeight - g.height - 8));
   }
@@ -409,8 +409,8 @@ export default class FloatingWindow extends Component {
     this._ro = new ResizeObserver(() => {
       if (this.state === "normal" && this.geometry && !this._drag) {
         const rect = this.win.getBoundingClientRect();
-        this.geometry.width = Math.round(rect.width);
+        this.geometry.width = Math.max(320, Math.round(rect.width));
-        this.geometry.height = Math.round(rect.height);
+        this.geometry.height = Math.max(220, Math.round(rect.height));
         this._persistGeometry();
       }
       this._syncControls();

tests/api/auth/test_login_cookie.py

@@ -1,18 +0,0 @@
-# retoor <retoor@molodetz.nl>
-
-import requests
-from tests.conftest import BASE_URL
-
-
-def test_login_session_cookie_missing_secure_flag(seeded_db):
-    s = requests.Session()
-    r = s.post(
-        f"{BASE_URL}/auth/login",
-        data={"email": "alice@test.devplace", "password": "secret123"},
-        allow_redirects=False,
-    )
-    set_cookie = r.headers.get("Set-Cookie", "")
-    assert "session=" in set_cookie, f"session cookie not found in Set-Cookie: {set_cookie}"
-    assert "HttpOnly" in set_cookie, f"HttpOnly not found in Set-Cookie: {set_cookie}"
-    assert "SameSite=Lax" in set_cookie, f"SameSite=Lax not found in Set-Cookie: {set_cookie}"
-    assert "Secure" not in set_cookie, f"Secure flag should be absent from Set-Cookie: {set_cookie}"