ticket #66 attempt 1

devplacepy/routers/auth/login.py

@@ -11,6 +11,7 @@ from devplacepy.utils import (
     create_session,
     get_current_user,
     safe_next,
+    cookie_secure,
 )
 from devplacepy.seo import base_seo_context
 from devplacepy.models import LoginForm
@@ -102,7 +103,7 @@ async def login(request: Request, data: Annotated[LoginForm, Depends(json_or_for
         max_age=max_age,
         httponly=True,
         samesite="lax",
-        secure=False,
+        secure=cookie_secure(request),
     )
     logger.info(f"User {user['username']} logged in")
     audit.record(

devplacepy/routers/auth/signup.py

@@ -10,6 +10,7 @@ from devplacepy.utils import (
     create_session,
     get_current_user,
     register_account_async,
+    cookie_secure,
 )
 from devplacepy.seo import base_seo_context
 from devplacepy.models import SignupForm
@@ -100,7 +101,7 @@ async def signup(request: Request, data: Annotated[SignupForm, Depends(json_or_f
         max_age=max_age,
         httponly=True,
         samesite="lax",
-        secure=False,
+        secure=cookie_secure(request),
     )
     logger.info(f"User {username} signed up")
     audit.record(

devplacepy/static/css/gists.css

@@ -328,3 +328,44 @@
         padding: 0.75rem;
     }
 }
+
+/* ---- Markdown source/preview toggle ---- */
+.gist-markdown-toggle .gist-md-tabbar {
+    display: flex;
+    gap: 0;
+    border-bottom: 1px solid var(--border);
+    margin-bottom: 0;
+}
+
+.gist-markdown-toggle .gist-md-tab {
+    padding: 0.5em 1em;
+    cursor: pointer;
+    color: var(--text-muted);
+    border: 1px solid transparent;
+    border-bottom: none;
+    border-radius: var(--radius) var(--radius) 0 0;
+    background: transparent;
+    font-size: 0.875rem;
+}
+
+.gist-markdown-toggle .gist-md-tab.active {
+    color: var(--text-primary);
+    background: var(--bg-card);
+    border-color: var(--border) var(--border) transparent;
+}
+
+.gist-markdown-toggle .tab-pane {
+    display: none;
+}
+
+.gist-markdown-toggle .tab-pane.active {
+    display: block;
+}
+
+.gist-markdown-toggle .gist-markdown-preview {
+    padding: 1em;
+    border: 1px solid var(--border);
+    border-radius: 0 0 var(--radius) var(--radius);
+    min-height: 4em;
+    background: var(--bg-card);
+}

devplacepy/templates/gist_detail.html

@@ -35,6 +35,23 @@
 
         {% if gist['language'] == 'markdown_rendered' %}
         <div class="gist-rendered-content rendered-content">{{ render_content(gist['source_code'], author_is_admin=is_admin(author)) }}</div>
+        {% elif gist['language'] == 'markdown' %}
+        <div class="gist-code-block gist-markdown-toggle" data-tabs>
+            <nav class="gist-md-tabbar" role="tablist">
+                <button type="button" class="gist-md-tab" data-tab="source" role="tab">Source</button>
+                <button type="button" class="gist-md-tab" data-tab="preview" role="tab">Preview</button>
+            </nav>
+            <div data-tab-pane="source" class="tab-pane active" role="tabpanel">
+                <div class="gist-code-header">
+                    <span class="gist-language-name">{{ language_name(gist['language']) }}</span>
+                    <button type="button" class="gist-copy-btn" data-copy="gist-code-content">Copy</button>
+                </div>
+                <pre><code id="gist-code-content" class="language-markdown">{{ gist['source_code'] }}</code></pre>
+            </div>
+            <div data-tab-pane="preview" class="tab-pane gist-markdown-preview rendered-content" role="tabpanel">
+                {{ render_content(gist['source_code'], author_is_admin=is_admin(author)) }}
+            </div>
+        </div>
         {% else %}
         <div class="gist-code-block">
             <div class="gist-code-header">

tests/api/auth/test_login_cookie.py

@@ -1,18 +0,0 @@
-# retoor <retoor@molodetz.nl>
-
-import requests
-from tests.conftest import BASE_URL
-
-
-def test_login_session_cookie_missing_secure_flag(seeded_db):
-    s = requests.Session()
-    r = s.post(
-        f"{BASE_URL}/auth/login",
-        data={"email": "alice@test.devplace", "password": "secret123"},
-        allow_redirects=False,
-    )
-    set_cookie = r.headers.get("Set-Cookie", "")
-    assert "session=" in set_cookie, f"session cookie not found in Set-Cookie: {set_cookie}"
-    assert "HttpOnly" in set_cookie, f"HttpOnly not found in Set-Cookie: {set_cookie}"
-    assert "SameSite=Lax" in set_cookie, f"SameSite=Lax not found in Set-Cookie: {set_cookie}"
-    assert "Secure" not in set_cookie, f"Secure flag should be absent from Set-Cookie: {set_cookie}"