ticket #57 attempt 1

devplacepy/routers/auth/login.py

@@ -11,6 +11,7 @@ from devplacepy.utils import (
     create_session,
     get_current_user,
     safe_next,
+    cookie_secure,
 )
 from devplacepy.seo import base_seo_context
 from devplacepy.models import LoginForm
@@ -102,7 +103,7 @@ async def login(request: Request, data: Annotated[LoginForm, Depends(json_or_for
         max_age=max_age,
         httponly=True,
         samesite="lax",
-        secure=False,
+        secure=cookie_secure(request),
     )
     logger.info(f"User {user['username']} logged in")
     audit.record(

devplacepy/routers/auth/signup.py

@@ -10,6 +10,7 @@ from devplacepy.utils import (
     create_session,
     get_current_user,
     register_account_async,
+    cookie_secure,
 )
 from devplacepy.seo import base_seo_context
 from devplacepy.models import SignupForm
@@ -100,7 +101,7 @@ async def signup(request: Request, data: Annotated[SignupForm, Depends(json_or_f
         max_age=max_age,
         httponly=True,
         samesite="lax",
-        secure=False,
+        secure=cookie_secure(request),
     )
     logger.info(f"User {username} signed up")
     audit.record(

devplacepy/static/js/CommentManager.js

@@ -8,6 +8,11 @@ export class CommentManager {
         this.initCommentReply();
         this.initCommentEdit();
         this.initCommentDelete();
+        document.addEventListener("paste", (event) => {
+            const textarea = event.target.closest("form textarea[name='body'], form textarea[name='content']");
+            if (!textarea) return;
+            this._onPaste(event, textarea);
+        });
     }
 
     initCommentDelete() {
@@ -208,4 +213,41 @@ export class CommentManager {
             if (btn) btn.disabled = true;
         });
     }
+
+    _onPaste(event, textarea) {
+        const items = event.clipboardData?.items;
+        if (!items) return;
+        for (const item of items) {
+            if (item.kind === "file" && item.type.startsWith("image/")) {
+                event.preventDefault();
+                const file = item.getAsFile();
+                const namedFile = new File([file], file.name || "clipboard.png", { type: file.type });
+                this._uploadImage(namedFile, textarea);
+                break;
+            }
+        }
+    }
+
+    async _uploadImage(file, textarea) {
+        const formData = new FormData();
+        formData.append("file", file, file.name);
+        try {
+            const response = await fetch("/uploads/upload", {
+                method: "POST",
+                headers: {
+                    "Accept": "application/json",
+                    "X-Requested-With": "fetch",
+                },
+                body: formData,
+            });
+            if (!response.ok) {
+                const data = await response.json().catch(() => ({}));
+                throw new Error(data.error || `Upload failed (${response.status})`);
+            }
+            const result = await response.json();
+            window.TextInput.insertAtCursor(textarea, `![](${result.url})`);
+        } catch (err) {
+            Http.notifyError(err.message);
+        }
+    }
 }

devplacepy/static/js/IssueReporter.js

@@ -12,6 +12,48 @@ export class IssueReporter {
             event.preventDefault();
             this.submit(form);
         });
+        document.addEventListener("paste", (event) => {
+            const textarea = event.target.closest("form[data-issue-create] [name='description']");
+            if (!textarea) return;
+            this._onPaste(event, textarea);
+        });
+    }
+
+    _onPaste(event, textarea) {
+        const items = event.clipboardData?.items;
+        if (!items) return;
+        for (const item of items) {
+            if (item.kind === "file" && item.type.startsWith("image/")) {
+                event.preventDefault();
+                const file = item.getAsFile();
+                const namedFile = new File([file], file.name || "clipboard.png", { type: file.type });
+                this._uploadImage(namedFile, textarea);
+                break;
+            }
+        }
+    }
+
+    async _uploadImage(file, textarea) {
+        const formData = new FormData();
+        formData.append("file", file, file.name);
+        try {
+            const response = await fetch("/uploads/upload", {
+                method: "POST",
+                headers: {
+                    "Accept": "application/json",
+                    "X-Requested-With": "fetch",
+                },
+                body: formData,
+            });
+            if (!response.ok) {
+                const data = await response.json().catch(() => ({}));
+                throw new Error(data.error || `Upload failed (${response.status})`);
+            }
+            const result = await response.json();
+            window.TextInput.insertAtCursor(textarea, `![](${result.url})`);
+        } catch (err) {
+            Http.notifyError(err.message);
+        }
     }
 
     async submit(form) {

tests/api/auth/test_login_cookie.py

@@ -1,18 +0,0 @@
-# retoor <retoor@molodetz.nl>
-
-import requests
-from tests.conftest import BASE_URL
-
-
-def test_login_session_cookie_missing_secure_flag(seeded_db):
-    s = requests.Session()
-    r = s.post(
-        f"{BASE_URL}/auth/login",
-        data={"email": "alice@test.devplace", "password": "secret123"},
-        allow_redirects=False,
-    )
-    set_cookie = r.headers.get("Set-Cookie", "")
-    assert "session=" in set_cookie, f"session cookie not found in Set-Cookie: {set_cookie}"
-    assert "HttpOnly" in set_cookie, f"HttpOnly not found in Set-Cookie: {set_cookie}"
-    assert "SameSite=Lax" in set_cookie, f"SameSite=Lax not found in Set-Cookie: {set_cookie}"
-    assert "Secure" not in set_cookie, f"Secure flag should be absent from Set-Cookie: {set_cookie}"

tests/api/uploads/upload.py

@@ -240,3 +240,17 @@ def test_delete_own_allowed_other_user_forbidden(app_server):
     bob = _session_uploads()
     assert bob.delete(f"{BASE_URL}/uploads/delete/{uid}").status_code == 403
     assert alice.delete(f"{BASE_URL}/uploads/delete/{uid}").status_code == 200
+
+
+def test_paste_image_upload_returns_url(app_server):
+    s = _session_uploads()
+    r = s.post(
+        f"{BASE_URL}/uploads/upload",
+        files={"file": ("clipboard.png", _png_bytes_uploads(), "image/png")},
+    )
+    assert r.status_code == 201, r.text
+    data = r.json()
+    assert "url" in data
+    assert data["url"].startswith("/static/uploads/attachments/")
+    assert data["uid"]
+    assert data["is_image"] is True

venv/bin/python

@@ -0,0 +1 @@
+python3

venv/bin/python3

@@ -0,0 +1 @@
+/usr/bin/python3

venv/bin/python3.11

@@ -0,0 +1 @@
+python3

venv/lib64

@@ -0,0 +1 @@
+lib

venv/pyvenv.cfg

@@ -0,0 +1,5 @@
+home = /usr/bin
+include-system-site-packages = false
+version = 3.11.2
+executable = /usr/bin/python3.11
+command = /usr/bin/python3 -m venv /workspace/repo/venv