ticket #99 attempt 1

devplacepy/models.py

@@ -258,13 +258,13 @@ class NotificationDefaultForm(BaseModel):
 class AiCorrectionForm(BaseModel):
     enabled: bool = False
     sync: bool = False
-    prompt: str = Field(default=DEFAULT_CORRECTION_PROMPT, max_length=20000)
+    prompt: str = Field(default=DEFAULT_CORRECTION_PROMPT)
 
 
 class AiModifierForm(BaseModel):
     enabled: bool = False
     sync: bool = False
-    prompt: str = Field(default=DEFAULT_MODIFIER_PROMPT, max_length=20000)
+    prompt: str = Field(default=DEFAULT_MODIFIER_PROMPT)
 
 
 class InteractionsForm(BaseModel):

devplacepy/routers/auth/login.py

@@ -11,6 +11,7 @@ from devplacepy.utils import (
     create_session,
     get_current_user,
     safe_next,
+    cookie_secure,
 )
 from devplacepy.seo import base_seo_context
 from devplacepy.models import LoginForm
@@ -102,7 +103,7 @@ async def login(request: Request, data: Annotated[LoginForm, Depends(json_or_for
         max_age=max_age,
         httponly=True,
         samesite="lax",
-        secure=False,
+        secure=cookie_secure(request),
     )
     logger.info(f"User {user['username']} logged in")
     audit.record(

devplacepy/routers/auth/signup.py

@@ -10,6 +10,7 @@ from devplacepy.utils import (
     create_session,
     get_current_user,
     register_account_async,
+    cookie_secure,
 )
 from devplacepy.seo import base_seo_context
 from devplacepy.models import SignupForm
@@ -100,7 +101,7 @@ async def signup(request: Request, data: Annotated[SignupForm, Depends(json_or_f
         max_age=max_age,
         httponly=True,
         samesite="lax",
-        secure=False,
+        secure=cookie_secure(request),
     )
     logger.info(f"User {username} signed up")
     audit.record(

devplacepy/services/devii/actions/ai_correction_actions.py

@@ -61,7 +61,7 @@ AI_CORRECTION_ACTIONS: tuple[Action, ...] = (
             ),
             arg(
                 "prompt",
-                "The correction instruction (max 20000 chars). Omit to keep the current one.",
+                "The correction instruction. Omit to keep the current one.",
             ),
         ),
     ),

devplacepy/services/devii/actions/ai_modifier_actions.py

@@ -64,7 +64,7 @@ AI_MODIFIER_ACTIONS: tuple[Action, ...] = (
             ),
             arg(
                 "prompt",
-                "The modifier instruction (max 20000 chars). Omit to keep the current one.",
+                "The modifier instruction. Omit to keep the current one.",
             ),
         ),
     ),

devplacepy/services/devii/ai_correction/controller.py

@@ -70,7 +70,7 @@ class AiCorrectionController:
         if prompt_raw is None:
             prompt = user.get("ai_correction_prompt") or DEFAULT_CORRECTION_PROMPT
         else:
-            prompt = str(prompt_raw).strip()[:20000] or DEFAULT_CORRECTION_PROMPT
+            prompt = str(prompt_raw).strip() or DEFAULT_CORRECTION_PROMPT
         get_table("users").update(
             {
                 "uid": self._owner_id,

devplacepy/services/devii/ai_modifier/controller.py

@@ -70,7 +70,7 @@ class AiModifierController:
         if prompt_raw is None:
             prompt = user.get("ai_modifier_prompt") or DEFAULT_MODIFIER_PROMPT
         else:
-            prompt = str(prompt_raw).strip()[:20000] or DEFAULT_MODIFIER_PROMPT
+            prompt = str(prompt_raw).strip() or DEFAULT_MODIFIER_PROMPT
         get_table("users").update(
             {
                 "uid": self._owner_id,

devplacepy/templates/profile.html

@@ -226,7 +226,7 @@
                     <option value="sync" {% if ai_correction_sync %}selected{% endif %}>Synchronously (wait while saving)</option>
                 </select>
             </div>
-            <textarea data-ai-correction-prompt class="input-sm ai-correction-prompt" maxlength="20000" rows="3" aria-label="AI content correction prompt">{{ ai_correction_prompt }}</textarea>
+            <textarea data-ai-correction-prompt class="input-sm ai-correction-prompt" rows="3" aria-label="AI content correction prompt">{{ ai_correction_prompt }}</textarea>
             <div class="customization-row">
                 <button type="button" class="btn btn-sm btn-primary" data-ai-correction-save>Save</button>
                 <span class="ai-correction-status" data-ai-correction-status role="status" aria-live="polite"></span>
@@ -251,7 +251,7 @@
                     <option value="sync" {% if ai_modifier_sync %}selected{% endif %}>Synchronously (wait while saving)</option>
                 </select>
             </div>
-            <textarea data-ai-modifier-prompt class="input-sm ai-correction-prompt" maxlength="20000" rows="3" aria-label="AI modifier prompt">{{ ai_modifier_prompt }}</textarea>
+            <textarea data-ai-modifier-prompt class="input-sm ai-correction-prompt" rows="3" aria-label="AI modifier prompt">{{ ai_modifier_prompt }}</textarea>
             <div class="customization-row">
                 <button type="button" class="btn btn-sm btn-primary" data-ai-modifier-save>Save</button>
                 <span class="ai-correction-status" data-ai-modifier-status role="status" aria-live="polite"></span>

tests/api/auth/test_login_cookie.py

@@ -1,18 +0,0 @@
-# retoor <retoor@molodetz.nl>
-
-import requests
-from tests.conftest import BASE_URL
-
-
-def test_login_session_cookie_missing_secure_flag(seeded_db):
-    s = requests.Session()
-    r = s.post(
-        f"{BASE_URL}/auth/login",
-        data={"email": "alice@test.devplace", "password": "secret123"},
-        allow_redirects=False,
-    )
-    set_cookie = r.headers.get("Set-Cookie", "")
-    assert "session=" in set_cookie, f"session cookie not found in Set-Cookie: {set_cookie}"
-    assert "HttpOnly" in set_cookie, f"HttpOnly not found in Set-Cookie: {set_cookie}"
-    assert "SameSite=Lax" in set_cookie, f"SameSite=Lax not found in Set-Cookie: {set_cookie}"
-    assert "Secure" not in set_cookie, f"Secure flag should be absent from Set-Cookie: {set_cookie}"