ticket #83 attempt 1

devplacepy/routers/auth/login.py

@@ -11,7 +11,6 @@ from devplacepy.utils import (
     create_session,
     get_current_user,
     safe_next,
-    cookie_secure,
 )
 from devplacepy.seo import base_seo_context
 from devplacepy.models import LoginForm
@@ -103,7 +102,7 @@ async def login(request: Request, data: Annotated[LoginForm, Depends(json_or_for
         max_age=max_age,
         httponly=True,
         samesite="lax",
-        secure=cookie_secure(request),
+        secure=False,
     )
     logger.info(f"User {user['username']} logged in")
     audit.record(

devplacepy/routers/auth/signup.py

@@ -10,7 +10,6 @@ from devplacepy.utils import (
     create_session,
     get_current_user,
     register_account_async,
-    cookie_secure,
 )
 from devplacepy.seo import base_seo_context
 from devplacepy.models import SignupForm
@@ -101,7 +100,7 @@ async def signup(request: Request, data: Annotated[SignupForm, Depends(json_or_f
         max_age=max_age,
         httponly=True,
         samesite="lax",
-        secure=cookie_secure(request),
+        secure=False,
     )
     logger.info(f"User {username} signed up")
     audit.record(

devplacepy/templates/_comment.html

@@ -1,4 +1,4 @@
-{% macro comment_cell(item, depth, parent_author=None, parent_url=None) %}
+{% macro comment_cell(item, depth, parent_author=None) %}
 <div class="comment" style="--comment-depth: {{ depth }};" data-depth="{{ depth }}">
     <div class="comment-votes" role="group" aria-label="Comment votes">
         <form method="POST" action="/votes/comment/{{ item.comment['uid'] }}">
@@ -26,7 +26,6 @@
         {% endif %}
         <div class="comment-actions">
             <button type="button" class="comment-action-btn" data-action="reply"{{ guest_disabled(user) }}><span class="icon">💬</span><span class="label"> Reply</span></button>
-            <button type="button" class="comment-action-btn" data-share="{{ parent_url }}#comment-{{ item.comment['uid'] }}"><span class="icon">&#x1F517;</span><span class="label"> Share</span></button>
             {% if owns(item.comment, user) %}
             <button type="button" class="comment-action-btn" data-action="edit" data-edit-url="/comments/edit/{{ item.comment['uid'] }}"><span class="icon">✏️</span><span class="label"> Edit</span></button>
             <form method="POST" action="/comments/delete/{{ item.comment['uid'] }}" class="inline-form comment-delete-form" data-comment-uid="{{ item.comment['uid'] }}">
@@ -40,21 +39,21 @@
 </div>
 {% endmacro %}
 
-{% macro render_comment(item, depth=0, parent_url=None) %}
+{% macro render_comment(item, depth=0) %}
 {% set max_depth = 2 %}
 {% set visual_depth = depth if depth < max_depth else max_depth %}
-{% call comment_cell(item, visual_depth, parent_url=parent_url) %}
+{% call comment_cell(item, visual_depth) %}
     {% if item.children %}
     {% if depth < max_depth %}
     <div class="comment-replies">
         {% for child in item.children %}
-        {{ render_comment(child, depth + 1, parent_url) }}
+        {{ render_comment(child, depth + 1) }}
         {% endfor %}
     </div>
     {% else %}
     <div class="comment-replies comment-replies-flat">
         {% for child in item.children %}
-        {{ render_comment_flat(child, max_depth, item.author, parent_url) }}
+        {{ render_comment_flat(child, max_depth, item.author) }}
         {% endfor %}
     </div>
     {% endif %}
@@ -62,9 +61,9 @@
 {% endcall %}
 {% endmacro %}
 
-{% macro render_comment_flat(item, depth, parent_author, parent_url=None) %}
-{% call comment_cell(item, depth, parent_author, parent_url=parent_url) %}{% endcall %}
+{% macro render_comment_flat(item, depth, parent_author) %}
+{% call comment_cell(item, depth, parent_author) %}{% endcall %}
 {% for child in item.children %}
-{{ render_comment_flat(child, depth, item.author, parent_url) }}
+{{ render_comment_flat(child, depth, item.author) }}
 {% endfor %}
 {% endmacro %}

devplacepy/templates/_comment_section.html

@@ -3,10 +3,8 @@
 
     {% from "_comment.html" import render_comment with context %}
 
-    {% set parent_url = resolve_object_url(target_type, target_uid) %}
-
     {% for item in comments %}
-    {{ render_comment(item, 0, parent_url) }}
+    {{ render_comment(item, 0) }}
     {% else %}
     <p class="no-comments-msg">No comments yet. Start the discussion.</p>
     {% endfor %}

devplacepy/templating.py

@@ -9,7 +9,6 @@ from devplacepy.cache import TTLCache
 from devplacepy.config import STATIC_VERSION, TEMPLATES_DIR, TEMPLATE_AUTO_RELOAD, PRESENCE_TIMEOUT_SECONDS
 from devplacepy.constants import TOPICS, REACTION_EMOJI
 from devplacepy.database import get_int_setting, get_setting, get_table
-from devplacepy.database.content import resolve_object_url
 from devplacepy.avatar import avatar_url, avatar_seed
 from devplacepy.utils import format_date as _format_date
 from devplacepy.utils import time_ago as _time_ago
@@ -50,7 +49,6 @@ templates.env.globals["is_self"] = is_self
 templates.env.globals["guest_disabled"] = guest_disabled
 templates.env.globals["is_online"] = presence.is_online
 templates.env.globals["presence_timeout"] = PRESENCE_TIMEOUT_SECONDS
-templates.env.globals["resolve_object_url"] = resolve_object_url
 
 from devplacepy.docs_devrant import devrant_endpoints
 

tests/api/auth/test_login_cookie.py

@@ -0,0 +1,18 @@
+# retoor <retoor@molodetz.nl>
+
+import requests
+from tests.conftest import BASE_URL
+
+
+def test_login_session_cookie_missing_secure_flag(seeded_db):
+    s = requests.Session()
+    r = s.post(
+        f"{BASE_URL}/auth/login",
+        data={"email": "alice@test.devplace", "password": "secret123"},
+        allow_redirects=False,
+    )
+    set_cookie = r.headers.get("Set-Cookie", "")
+    assert "session=" in set_cookie, f"session cookie not found in Set-Cookie: {set_cookie}"
+    assert "HttpOnly" in set_cookie, f"HttpOnly not found in Set-Cookie: {set_cookie}"
+    assert "SameSite=Lax" in set_cookie, f"SameSite=Lax not found in Set-Cookie: {set_cookie}"
+    assert "Secure" not in set_cookie, f"Secure flag should be absent from Set-Cookie: {set_cookie}"