deploy: update habadashi_login

app.py

@@ -216,6 +216,8 @@ def get_current_user(request: Request):
     token = request.cookies.get("sb_access_token")
 
     if not token:
+        print("[AUTH_CHECK] No sb_access_token cookie – unauthenticated access")
+        log_event("auth", "unauthenticated_access", level="INFO", metadata={"path": str(request.url.path)})
         return None
     
     try:
@@ -244,7 +246,7 @@ def get_current_user(request: Request):
         return user_dict
         
     except Exception as e:
-        print(f"[AUTH_CHECK] Failed: {e}")
+        print(f"[AUTH_CHECK] Token verify failed: {e}")
         log_event("auth", "token_verify_fail", level="WARNING", metadata={"error": str(e)})
         return None
 
@@ -293,9 +295,7 @@ if private_app_dir:
                 if user_ctx and isinstance(user_ctx, dict):
                     org_id = user_ctx.get("org_id")
                     org_name = user_ctx.get("org_name")
-                    print(f"[ORG_CONTEXT] get_org_for_storage: org_id={org_id!r} org_name={org_name!r}")
                     return {"org_id": org_id, "org_name": org_name}
-                print(f"[ORG_CONTEXT] get_org_for_storage: no user_ctx")
                 return None
 
             set_org_context_getter(get_org_for_storage)
@@ -323,13 +323,26 @@ async def root(user=Depends(get_current_user)):
     return RedirectResponse(url="/login/")
 
 @app.get("/logout")
-async def logout():
-    """Logout route - clear cookie and redirect to login"""
+async def logout(request: Request):
+    """Logout route - clear cookie and redirect to login.
+    Also serves as force-logout endpoint when session is expired/invalid.
+    """
     user = get_user_context()
-    print(f"[ROUTE] /logout accessed")
-    log_event("auth", "logout", user_override=user)
+    token = request.cookies.get("sb_access_token")
+    forced = request.query_params.get("forced", "0")
+    print(f"[ROUTE] /logout accessed forced={forced}")
+    if forced == "1":
+        log_event("auth", "force_logout", user_override=user, metadata={"reason": "session_expired"})
+    else:
+        log_event("auth", "logout", user_override=user)
+    # Supabase セッション失効（トークンがある場合）
+    if token:
+        try:
+            supabase.auth.sign_out()
+        except Exception:
+            pass
     response = RedirectResponse(url="/login/")
-    response.delete_cookie("sb_access_token")
+    response.delete_cookie("sb_access_token", path="/", samesite="none")
     return response
 
 @app.get("/healthz")

login.py

@@ -105,7 +105,8 @@ def create_login_ui(handle_login_fn):
             js="""(token) => {
                 if (!token || token === "") return;
 
-                // Set cookie
+                // Set cookie: max-age=3600 は Supabase JWT の標準有効期限に合わせた値。
+                // セッション延長には Supabase refresh_token による更新が必要（中長期対応候補）。
                 document.cookie = `sb_access_token=${token}; path=/; max-age=3600; SameSite=None; Secure;`;
 
                 console.log("Cookie set, redirecting...");