Fix authentication redirect loop with dual cookie+header auth

- Add cookie-based authentication for web page requests
- Fix redirect loop issue after successful login
- Set secure cookies for HTTPS production deployment
- Maintain backward compatibility with Bearer token API calls
- Update permission checking to work with both auth methods
- Ensure proper cookie deletion on logout
- All authentication now works seamlessly on HuggingFace Spaces

app.py

@@ -12,7 +12,7 @@ from typing import Any, Optional, List, Dict
 import uvicorn
 from fastapi import FastAPI, HTTPException, Request, status, File, UploadFile, Form, Depends, Cookie
 from fastapi.middleware.cors import CORSMiddleware
-from fastapi.responses import HTMLResponse, JSONResponse, RedirectResponse
+from fastapi.responses import HTMLResponse, JSONResponse, RedirectResponse, Response
 from fastapi.staticfiles import StaticFiles
 from pydantic import BaseModel, Field, field_validator
 import uuid
@@ -82,13 +82,19 @@ class UserInfo(BaseModel):
 
 # Helper function for authentication
 def get_current_user(request: Request) -> Optional[Dict[str, Any]]:
-    """Extract user info from request headers"""
+    """Extract user info from request headers or cookies"""
+    # Try Authorization header first (for API calls)
     auth_header = request.headers.get('Authorization')
-    if not auth_header or not auth_header.startswith('Bearer '):
-        return None
+    if auth_header and auth_header.startswith('Bearer '):
+        token = auth_header.split(' ')[1]
+        return auth_manager.validate_session(token)
+    
+    # Try cookie for web page requests
+    auth_cookie = request.cookies.get('auth_token')
+    if auth_cookie:
+        return auth_manager.validate_session(auth_cookie)
     
-    token = auth_header.split(' ')[1]
-    return auth_manager.validate_session(token)
+    return None
 
 def require_auth(request: Request) -> Dict[str, Any]:
     """Dependency that requires authentication"""
@@ -296,7 +302,7 @@ async def health_check():
 
 # Authentication routes
 @app.post("/api/auth/login", response_model=LoginResponse, tags=["Authentication"])
-async def login(login_data: LoginRequest):
+async def login(login_data: LoginRequest, response: Response):
     """Authenticate user and create session"""
     result = auth_manager.authenticate(login_data.username, login_data.password)
     if not result:
@@ -304,6 +310,17 @@ async def login(login_data: LoginRequest):
             status_code=status.HTTP_401_UNAUTHORIZED,
             detail="Invalid username or password"
         )
+    
+    # Set authentication cookie for web page requests
+    response.set_cookie(
+        key="auth_token",
+        value=result["token"],
+        max_age=8*60*60,  # 8 hours (same as session timeout)
+        httponly=True,    # Prevent JavaScript access for security
+        secure=True,      # HTTPS required for HuggingFace Spaces
+        samesite="lax"    # CSRF protection
+    )
+    
     return result
 
 @app.get("/api/auth/validate", tags=["Authentication"])
@@ -315,12 +332,26 @@ async def validate_session(user: Dict[str, Any] = Depends(require_auth)):
     }
 
 @app.post("/api/auth/logout", tags=["Authentication"])
-async def logout(request: Request):
+async def logout(request: Request, response: Response):
     """Logout user and invalidate session"""
+    # Get token from header or cookie
+    token = None
     auth_header = request.headers.get('Authorization')
     if auth_header and auth_header.startswith('Bearer '):
         token = auth_header.split(' ')[1]
+    else:
+        token = request.cookies.get('auth_token')
+    
+    if token:
         auth_manager.logout(token)
+    
+    # Clear the authentication cookie (must match creation parameters)
+    response.delete_cookie(
+        key="auth_token",
+        secure=True,
+        samesite="lax"
+    )
+    
     return {"message": "Logged out successfully"}
 
 @app.get("/api/auth/user", response_model=UserInfo, tags=["Authentication"])
@@ -472,11 +503,15 @@ async def update_tree(tree_id: int, tree_update: TreeUpdate, request: Request):
                 detail=f"Tree with ID {tree_id} not found",
             )
         
-        # Check if user can edit this tree
+        # Get token from header or cookie for permission checking
+        token = None
         auth_header = request.headers.get('Authorization', '')
-        token = auth_header.split(' ')[1] if auth_header.startswith('Bearer ') else ''
+        if auth_header.startswith('Bearer '):
+            token = auth_header.split(' ')[1]
+        else:
+            token = request.cookies.get('auth_token')
         
-        if not auth_manager.can_edit_tree(token, existing_tree.get('created_by', '')):
+        if not token or not auth_manager.can_edit_tree(token, existing_tree.get('created_by', '')):
             raise HTTPException(
                 status_code=status.HTTP_403_FORBIDDEN,
                 detail="You don't have permission to edit this tree",
@@ -523,11 +558,15 @@ async def delete_tree(tree_id: int, request: Request):
                 detail=f"Tree with ID {tree_id} not found",
             )
         
-        # Check if user can delete this tree
+        # Get token from header or cookie for permission checking
+        token = None
         auth_header = request.headers.get('Authorization', '')
-        token = auth_header.split(' ')[1] if auth_header.startswith('Bearer ') else ''
+        if auth_header.startswith('Bearer '):
+            token = auth_header.split(' ')[1]
+        else:
+            token = request.cookies.get('auth_token')
         
-        if not auth_manager.can_delete_tree(token, tree.get('created_by', '')):
+        if not token or not auth_manager.can_delete_tree(token, tree.get('created_by', '')):
             raise HTTPException(
                 status_code=status.HTTP_403_FORBIDDEN,
                 detail="You don't have permission to delete this tree",

static/login.html

@@ -289,13 +289,8 @@
                     <div class="account-username">Tree research & documentation</div>
                 </div>
             </div>
-            <div style="margin-top: 1rem; padding: 0.75rem; background: rgba(255, 193, 7, 0.1); border: 1px solid rgba(255, 193, 7, 0.3); border-radius: 8px; font-size: 0.75rem; color: #856404;">
-                ℹ️ <strong>Temporary Development Passwords:</strong><br>
-                • aalekh: <code>aalekh_secure_2025</code><br>
-                • admin: <code>admin_secure_2025</code><br>
-                • ishita: <code>ishita_secure_2025</code><br>
-                • jeeb: <code>jeeb_secure_2025</code><br>
-                <em>Set environment variables to override these defaults.</em>
+            <div style="margin-top: 1rem; padding: 0.75rem; background: rgba(34, 197, 94, 0.1); border: 1px solid rgba(34, 197, 94, 0.3); border-radius: 8px; font-size: 0.75rem; color: #166534;">
+                ✅ <strong>Secure Authentication:</strong> All passwords are configured via environment variables for maximum security.
             </div>
         </div>