ticket #94 attempt 1

devplacepy/routers/auth/login.py

@@ -11,6 +11,7 @@ from devplacepy.utils import (
     create_session,
     get_current_user,
     safe_next,
+    cookie_secure,
 )
 from devplacepy.seo import base_seo_context
 from devplacepy.models import LoginForm
@@ -102,7 +103,7 @@ async def login(request: Request, data: Annotated[LoginForm, Depends(json_or_for
         max_age=max_age,
         httponly=True,
         samesite="lax",
-        secure=False,
+        secure=cookie_secure(request),
     )
     logger.info(f"User {user['username']} logged in")
     audit.record(

devplacepy/routers/auth/signup.py

@@ -10,6 +10,7 @@ from devplacepy.utils import (
     create_session,
     get_current_user,
     register_account_async,
+    cookie_secure,
 )
 from devplacepy.seo import base_seo_context
 from devplacepy.models import SignupForm
@@ -100,7 +101,7 @@ async def signup(request: Request, data: Annotated[SignupForm, Depends(json_or_f
         max_age=max_age,
         httponly=True,
         samesite="lax",
-        secure=False,
+        secure=cookie_secure(request),
     )
     logger.info(f"User {username} signed up")
     audit.record(

devplacepy/static/js/VoteManager.js

@@ -5,18 +5,21 @@ import { OptimisticAction } from "./OptimisticAction.js";
 export class VoteManager extends OptimisticAction {
     constructor() {
         super();
-        this.initVoteButtons();
+        document.addEventListener("click", (event) => this.onClick(event));
     }
 
-    initVoteButtons() {
-        document.querySelectorAll('form[action^="/votes/"] button[type="submit"]').forEach((button) => {
-            const form = button.closest("form");
-            button.addEventListener("click", (event) => {
-                event.preventDefault();
-                event.stopPropagation();
-                this.cast(form, button);
-            });
-        });
+    onClick(event) {
+        const button = event.target.closest('form[action^="/votes/"] button[type="submit"]');
+        if (!button) {
+            return;
+        }
+        const form = button.closest("form");
+        if (!form) {
+            return;
+        }
+        event.preventDefault();
+        event.stopPropagation();
+        this.cast(form, button);
     }
 
     cast(form, button) {

devplacepy/templating.py

@@ -29,7 +29,7 @@ def is_self(user, uid) -> bool:
 def guest_disabled(user) -> Markup:
     if user:
         return Markup("")
-    return Markup(' disabled aria-disabled="true"')
+    return Markup(' disabled aria-disabled="true" title="Log in to vote"')
 
 
 def static_url(path) -> str:

tests/api/auth/test_login_cookie.py

@@ -1,18 +0,0 @@
-# retoor <retoor@molodetz.nl>
-
-import requests
-from tests.conftest import BASE_URL
-
-
-def test_login_session_cookie_missing_secure_flag(seeded_db):
-    s = requests.Session()
-    r = s.post(
-        f"{BASE_URL}/auth/login",
-        data={"email": "alice@test.devplace", "password": "secret123"},
-        allow_redirects=False,
-    )
-    set_cookie = r.headers.get("Set-Cookie", "")
-    assert "session=" in set_cookie, f"session cookie not found in Set-Cookie: {set_cookie}"
-    assert "HttpOnly" in set_cookie, f"HttpOnly not found in Set-Cookie: {set_cookie}"
-    assert "SameSite=Lax" in set_cookie, f"SameSite=Lax not found in Set-Cookie: {set_cookie}"
-    assert "Secure" not in set_cookie, f"Secure flag should be absent from Set-Cookie: {set_cookie}"