fix: cross-site cookie + auth-status open path for HF iframe

auth.py

@@ -21,7 +21,8 @@ COOKIE_NAME = 'auth'
 COOKIE_MAX_AGE = 60 * 60 * 24 * 30  # 30 days
 
 # paths that bypass auth
-OPEN_PATHS = {'/api/login', '/healthz', '/api/docs', '/openapi.json'}
+OPEN_PATHS = {'/api/login', '/api/logout', '/api/auth-status',
+              '/healthz', '/api/docs', '/openapi.json'}
 OPEN_PREFIXES = ('/static/',)
 
 _serializer = URLSafeTimedSerializer(SESSION_SECRET, salt='auth-cookie')
@@ -68,8 +69,9 @@ def register_auth_routes(app: FastAPI):
         if not secrets.compare_digest(password, APP_PASSWORD):
             return JSONResponse(status_code=401, content={'detail': 'wrong password'})
         response = JSONResponse({'ok': True})
+        # SameSite=None + Secure required so the cookie survives the HF iframe (cross-site).
         response.set_cookie(COOKIE_NAME, _sign(), max_age=COOKIE_MAX_AGE,
-                            httponly=True, samesite='lax', secure=False)
+                            httponly=True, samesite='none', secure=True)
         return response
 
     @app.post('/api/logout')

static/app.js

@@ -29,7 +29,7 @@ const API = {
 };
 
 async function jfetch(url, opts = {}) {
-  const o = Object.assign({ headers: { 'Content-Type': 'application/json' }, credentials: 'same-origin' }, opts);
+  const o = Object.assign({ headers: { 'Content-Type': 'application/json' }, credentials: 'include' }, opts);
   const r = await fetch(url, o);
   if (r.status === 401) {
     await showLoginModal();