ticket #83 attempt 1

devplacepy/routers/auth/login.py

@@ -11,7 +11,6 @@ from devplacepy.utils import (
     create_session,
     get_current_user,
     safe_next,
-    cookie_secure,
 )
 from devplacepy.seo import base_seo_context
 from devplacepy.models import LoginForm
@@ -103,7 +102,7 @@ async def login(request: Request, data: Annotated[LoginForm, Depends(json_or_for
         max_age=max_age,
         httponly=True,
         samesite="lax",
-        secure=cookie_secure(request),
+        secure=False,
     )
     logger.info(f"User {user['username']} logged in")
     audit.record(

devplacepy/routers/auth/signup.py

@@ -10,7 +10,6 @@ from devplacepy.utils import (
     create_session,
     get_current_user,
     register_account_async,
-    cookie_secure,
 )
 from devplacepy.seo import base_seo_context
 from devplacepy.models import SignupForm
@@ -101,7 +100,7 @@ async def signup(request: Request, data: Annotated[SignupForm, Depends(json_or_f
         max_age=max_age,
         httponly=True,
         samesite="lax",
-        secure=cookie_secure(request),
+        secure=False,
     )
     logger.info(f"User {username} signed up")
     audit.record(

devplacepy/static/css/engagement.css

@@ -172,7 +172,6 @@
     text-align: left;
     cursor: pointer;
     overflow: hidden;
-    touch-action: manipulation;
 }
 
 .poll-option[disabled] {
@@ -183,10 +182,6 @@
     border-color: var(--border-light);
 }
 
-.poll-option:not([disabled]):active {
-    background-color: var(--bg-card-hover);
-}
-
 .poll-option.chosen {
     border-color: var(--accent);
 }

devplacepy/static/js/PollManager.js

@@ -5,8 +5,7 @@ import { OptimisticAction } from "./OptimisticAction.js";
 export class PollManager extends OptimisticAction {
     constructor() {
         super();
-        this.container = null;
-        document.addEventListener("pointerdown", (event) => this.onClick(event));
+        document.addEventListener("click", (event) => this.onClick(event));
         document.addEventListener("submit", (event) => this.onSubmit(event), true);
     }
 
@@ -43,8 +42,7 @@ export class PollManager extends OptimisticAction {
         }
         const pollUid = poll.dataset.pollUid;
         const optionUid = option.dataset.optionUid;
-        this.container = poll;
-        await this.submit(`/polls/${pollUid}/vote`, { option_uid: optionUid }, this.container, (result) => this.render(poll, result));
+        await this.submit(`/polls/${pollUid}/vote`, { option_uid: optionUid }, null, (result) => this.render(poll, result));
     }
 
     render(poll, result) {

tests/api/auth/test_login_cookie.py

@@ -0,0 +1,18 @@
+# retoor <retoor@molodetz.nl>
+
+import requests
+from tests.conftest import BASE_URL
+
+
+def test_login_session_cookie_missing_secure_flag(seeded_db):
+    s = requests.Session()
+    r = s.post(
+        f"{BASE_URL}/auth/login",
+        data={"email": "alice@test.devplace", "password": "secret123"},
+        allow_redirects=False,
+    )
+    set_cookie = r.headers.get("Set-Cookie", "")
+    assert "session=" in set_cookie, f"session cookie not found in Set-Cookie: {set_cookie}"
+    assert "HttpOnly" in set_cookie, f"HttpOnly not found in Set-Cookie: {set_cookie}"
+    assert "SameSite=Lax" in set_cookie, f"SameSite=Lax not found in Set-Cookie: {set_cookie}"
+    assert "Secure" not in set_cookie, f"Secure flag should be absent from Set-Cookie: {set_cookie}"