ticket #74 attempt 1

devplacepy/database/notifications.py

@@ -18,6 +18,7 @@ NOTIFICATION_TYPES = [
     {"key": "reminder", "label": "Reminders", "description": "A reminder or scheduled task you asked Devii to run fires"},
     {"key": "harvest_stolen", "label": "Farm raids", "description": "Someone steals a ready build from your Code Farm"},
     {"key": "award", "label": "Awards", "description": "Someone gives you an award on your profile"},
+    {"key": "admin_alert", "label": "Admin alerts", "description": "System alerts requiring admin attention"},
 ]
 
 

devplacepy/routers/auth/login.py

@@ -11,6 +11,7 @@ from devplacepy.utils import (
     create_session,
     get_current_user,
     safe_next,
+    cookie_secure,
 )
 from devplacepy.seo import base_seo_context
 from devplacepy.models import LoginForm
@@ -102,7 +103,7 @@ async def login(request: Request, data: Annotated[LoginForm, Depends(json_or_for
         max_age=max_age,
         httponly=True,
         samesite="lax",
-        secure=False,
+        secure=cookie_secure(request),
     )
     logger.info(f"User {user['username']} logged in")
     audit.record(

devplacepy/routers/auth/signup.py

@@ -10,6 +10,7 @@ from devplacepy.utils import (
     create_session,
     get_current_user,
     register_account_async,
+    cookie_secure,
 )
 from devplacepy.seo import base_seo_context
 from devplacepy.models import SignupForm
@@ -100,7 +101,7 @@ async def signup(request: Request, data: Annotated[SignupForm, Depends(json_or_f
         max_age=max_age,
         httponly=True,
         samesite="lax",
-        secure=False,
+        secure=cookie_secure(request),
     )
     logger.info(f"User {username} signed up")
     audit.record(

devplacepy/routers/devii.py

@@ -23,6 +23,7 @@ from devplacepy.utils import (
     require_user,
 )
 from devplacepy.services.audit import record as audit
+from devplacepy.services.devii.quota import notify_admins_quota_blocked
 
 logger = logging.getLogger("devii.router")
 
@@ -279,6 +280,7 @@ async def devii_ws(websocket: WebSocket):
                         summary=f"AI request by {username or owner_id} blocked - 24h quota reached",
                         metadata={"limit_usd": limit, "owner_kind": owner_kind},
                     )
+                    notify_admins_quota_blocked(owner_kind, owner_id, username)
                     await websocket.send_json(
                         {
                             "type": "error",

devplacepy/services/devii/quota.py

@@ -0,0 +1,26 @@
+# retoor <retoor@molodetz.nl>
+
+import logging
+
+from devplacepy.database import get_table
+from devplacepy.utils.notifications import create_notification
+
+logger = logging.getLogger("devii.quota")
+
+ADMIN_ALERT_TYPE = "admin_alert"
+
+
+def notify_admins_quota_blocked(owner_kind: str, owner_id: str, username: str) -> None:
+    if owner_kind != "user":
+        return
+    admins = get_table("users").find(role="Admin")
+    for admin in admins:
+        if admin["uid"] == owner_id:
+            continue
+        create_notification(
+            admin["uid"],
+            ADMIN_ALERT_TYPE,
+            f"User {username} blocked - 24h AI quota reached",
+            owner_id,
+            "/admin/users",
+        )

devplacepy/services/telegram/bridge.py

@@ -10,6 +10,7 @@ from typing import Any
 
 from devplacepy.database import get_table
 from devplacepy.services.audit import record as audit
+from devplacepy.services.devii.quota import notify_admins_quota_blocked
 from devplacepy.services.manager import service_manager
 from devplacepy.utils import is_admin, is_primary_admin
 
@@ -400,6 +401,7 @@ class TelegramBridge:
                 summary=f"Telegram AI request by {user.get('username', owner_id)} blocked - 24h quota reached",
                 metadata={"limit_usd": limit},
             )
+            notify_admins_quota_blocked("user", owner_id, user.get("username", ""))
             await self._service.send(
                 chat_id, "Your daily AI quota is reached (100%). Please try again later."
             )

tests/api/auth/test_login_cookie.py

@@ -1,18 +0,0 @@
-# retoor <retoor@molodetz.nl>
-
-import requests
-from tests.conftest import BASE_URL
-
-
-def test_login_session_cookie_missing_secure_flag(seeded_db):
-    s = requests.Session()
-    r = s.post(
-        f"{BASE_URL}/auth/login",
-        data={"email": "alice@test.devplace", "password": "secret123"},
-        allow_redirects=False,
-    )
-    set_cookie = r.headers.get("Set-Cookie", "")
-    assert "session=" in set_cookie, f"session cookie not found in Set-Cookie: {set_cookie}"
-    assert "HttpOnly" in set_cookie, f"HttpOnly not found in Set-Cookie: {set_cookie}"
-    assert "SameSite=Lax" in set_cookie, f"SameSite=Lax not found in Set-Cookie: {set_cookie}"
-    assert "Secure" not in set_cookie, f"Secure flag should be absent from Set-Cookie: {set_cookie}"