ticket #102 attempt 1

devplacepy/routers/auth/login.py

@@ -11,6 +11,7 @@ from devplacepy.utils import (
     create_session,
     get_current_user,
     safe_next,
+    cookie_secure,
 )
 from devplacepy.seo import base_seo_context
 from devplacepy.models import LoginForm
@@ -102,7 +103,7 @@ async def login(request: Request, data: Annotated[LoginForm, Depends(json_or_for
         max_age=max_age,
         httponly=True,
         samesite="lax",
-        secure=False,
+        secure=cookie_secure(request),
     )
     logger.info(f"User {user['username']} logged in")
     audit.record(

devplacepy/routers/auth/signup.py

@@ -10,6 +10,7 @@ from devplacepy.utils import (
     create_session,
     get_current_user,
     register_account_async,
+    cookie_secure,
 )
 from devplacepy.seo import base_seo_context
 from devplacepy.models import SignupForm
@@ -100,7 +101,7 @@ async def signup(request: Request, data: Annotated[SignupForm, Depends(json_or_f
         max_age=max_age,
         httponly=True,
         samesite="lax",
-        secure=False,
+        secure=cookie_secure(request),
     )
     logger.info(f"User {username} signed up")
     audit.record(

devplacepy/services/xmlrpc/__init__.py

@@ -2,8 +2,10 @@
 
 from __future__ import annotations
 
+import socket
 import subprocess
 import sys
+import time
 
 from devplacepy.config import XMLRPC_BIND, XMLRPC_PORT
 from devplacepy.services.base import BaseService
@@ -25,20 +27,48 @@ class XmlrpcService(BaseService):
     def __init__(self) -> None:
         super().__init__("xmlrpc", interval_seconds=XMLRPC_INTERVAL_SECONDS)
         self._process: subprocess.Popen | None = None
+        self._last_stderr: str | None = None
 
     def _alive(self) -> bool:
         return self._process is not None and self._process.poll() is None
 
     def _spawn(self) -> None:
+        self._last_stderr = None
         self._process = subprocess.Popen(
             [sys.executable, "-m", SERVER_MODULE],
             stdout=subprocess.DEVNULL,
-            stderr=subprocess.DEVNULL,
+            stderr=subprocess.PIPE,
         )
         self.log(
-            f"Forking XML-RPC server started (pid {self._process.pid}) on "
+            f"Forking XML-RPC server spawning (pid {self._process.pid}) on "
             f"{XMLRPC_BIND}:{XMLRPC_PORT}"
         )
+        time.sleep(0.5)
+        if self._process.poll() is not None:
+            stderr_data = self._process.communicate()[1]
+            if stderr_data:
+                self._last_stderr = stderr_data.decode("utf-8", errors="replace")
+            self.log(
+                f"Forking XML-RPC server died after spawn (pid {self._process.pid}, "
+                f"exit code {self._process.returncode})"
+            )
+            if self._last_stderr:
+                for line in self._last_stderr.strip().split("\n"):
+                    self.log(f"  stderr: {line}")
+            return
+        try:
+            sock = socket.create_connection((XMLRPC_BIND, XMLRPC_PORT), timeout=1)
+            sock.close()
+        except (OSError, socket.timeout):
+            self.log(
+                f"Forking XML-RPC server not yet ready (pid {self._process.pid}) "
+                f"on {XMLRPC_BIND}:{XMLRPC_PORT}"
+            )
+        else:
+            self.log(
+                f"Forking XML-RPC server started (pid {self._process.pid}) on "
+                f"{XMLRPC_BIND}:{XMLRPC_PORT}"
+            )
 
     def _terminate(self) -> None:
         if not self._alive():
@@ -65,6 +95,13 @@ class XmlrpcService(BaseService):
             self.log(f"XML-RPC server healthy (pid {self._process.pid})")
             return
         self.log("XML-RPC server not running, starting it")
+        if self._process is not None:
+            self.log(
+                f"Previous process exited with code {self._process.returncode}"
+            )
+            if self._last_stderr:
+                for line in self._last_stderr.strip().split("\n"):
+                    self.log(f"  last stderr: {line}")
         self._spawn()
 
     def collect_metrics(self) -> dict:

devplacepy/services/xmlrpc/server.py

@@ -3,6 +3,7 @@
 from __future__ import annotations
 
 import logging
+import sys
 from socketserver import ForkingMixIn
 from xmlrpc.server import SimpleXMLRPCDispatcher, SimpleXMLRPCRequestHandler, SimpleXMLRPCServer
 
@@ -116,6 +117,9 @@ def main() -> None:
         server.serve_forever()
     except KeyboardInterrupt:
         logger.info("XML-RPC server interrupted")
+    except Exception:
+        logging.exception("XML-RPC server crashed with unhandled exception")
+        sys.exit(1)
     finally:
         server.server_close()
 

tests/api/auth/test_login_cookie.py

@@ -1,18 +0,0 @@
-# retoor <retoor@molodetz.nl>
-
-import requests
-from tests.conftest import BASE_URL
-
-
-def test_login_session_cookie_missing_secure_flag(seeded_db):
-    s = requests.Session()
-    r = s.post(
-        f"{BASE_URL}/auth/login",
-        data={"email": "alice@test.devplace", "password": "secret123"},
-        allow_redirects=False,
-    )
-    set_cookie = r.headers.get("Set-Cookie", "")
-    assert "session=" in set_cookie, f"session cookie not found in Set-Cookie: {set_cookie}"
-    assert "HttpOnly" in set_cookie, f"HttpOnly not found in Set-Cookie: {set_cookie}"
-    assert "SameSite=Lax" in set_cookie, f"SameSite=Lax not found in Set-Cookie: {set_cookie}"
-    assert "Secure" not in set_cookie, f"Secure flag should be absent from Set-Cookie: {set_cookie}"