deploy: sync backend to Space root (learn-lesson HF cache fix)

app/routes/auth.py

@@ -269,14 +269,14 @@ def _auth_redirect_for_user(user: User, next_path: str) -> RedirectResponse:
 def _is_production_environment(settings: object | None = None) -> bool:
     """Resolve production even if an older Settings build lacks is_production."""
     active = settings or get_settings()
-    try:
-        flag = getattr(active, "is_production", None)
-    except AttributeError:
-        flag = None
+    flag = getattr(active, "is_production", None)
     if isinstance(flag, bool):
         production = flag
     else:
-        production = str(getattr(active, "environment", "") or "").strip().casefold() == "production"
+        environment = str(getattr(active, "environment", "") or "").strip().casefold()
+        # Unknown environment fails closed so a missing flag cannot mint a
+        # non-Secure cookie that browsers would still send.
+        production = True if not environment else environment == "production"
     logger.debug("[FIX] media-auth cookie production=%s", production)
     return production
 

tests/test_media_auth_cookie.py

@@ -11,6 +11,25 @@ from types import SimpleNamespace
 from fastapi import Response
 
 
+def _media_cookie_flags(header: str) -> dict[str, object]:
+    """Parse Set-Cookie attributes so JWT contents cannot fake flags."""
+    parts = [part.strip() for part in header.split(";") if part.strip()]
+    assert parts, f"empty Set-Cookie header: {header!r}"
+    name, _, value = parts[0].partition("=")
+    flags: dict[str, str | bool] = {}
+    for part in parts[1:]:
+        key, separator, raw = part.partition("=")
+        flags[key.casefold()] = raw if separator else True
+    return {
+        "name": name,
+        "value": value,
+        "httponly": "httponly" in flags,
+        "secure": "secure" in flags,
+        "path": str(flags.get("path", "")),
+        "samesite": str(flags.get("samesite", "")).casefold(),
+    }
+
+
 def test_settings_exposes_is_production_from_environment() -> None:
     from app.core.config import Settings
 
@@ -20,7 +39,7 @@ def test_settings_exposes_is_production_from_environment() -> None:
     assert Settings(environment=" staging ").is_production is False
 
 
-def test_signup_sets_media_cookie_without_crashing(auth_client) -> None:
+def test_signup_sets_dev_media_cookie_flags(auth_client) -> None:
     response = auth_client.post(
         "/auth/signup",
         json={
@@ -31,12 +50,35 @@ def test_signup_sets_media_cookie_without_crashing(auth_client) -> None:
     )
     assert response.status_code == 201, response.text
     assert response.json()["access_token"]
-    cookie = response.headers.get("set-cookie", "")
-    assert "docdoe_media_token=" in cookie
-    assert "secure" not in cookie.lower()
+    cookie = _media_cookie_flags(response.headers.get("set-cookie", ""))
+    assert cookie["name"] == "docdoe_media_token"
+    assert cookie["httponly"] is True
+    assert cookie["secure"] is False
+    assert cookie["path"] == "/generated"
+    assert cookie["samesite"] == "lax"
 
 
-def test_media_cookie_is_secure_when_environment_is_production() -> None:
+def test_media_cookie_uses_settings_is_production() -> None:
+    from app.core.config import Settings
+    from app.routes.auth import _set_media_auth_cookie
+
+    response = Response()
+    _set_media_auth_cookie(
+        response,
+        "token-value",
+        3600,
+        settings=Settings(environment="production"),
+    )
+    cookie = _media_cookie_flags(response.headers.get("set-cookie", ""))
+    assert cookie["name"] == "docdoe_media_token"
+    assert cookie["value"] == "token-value"
+    assert cookie["httponly"] is True
+    assert cookie["secure"] is True
+    assert cookie["path"] == "/generated"
+    assert cookie["samesite"] == "none"
+
+
+def test_media_cookie_falls_back_to_environment_when_flag_missing() -> None:
     from app.routes.auth import _set_media_auth_cookie
 
     response = Response()
@@ -46,7 +88,25 @@ def test_media_cookie_is_secure_when_environment_is_production() -> None:
         3600,
         settings=SimpleNamespace(environment="production"),
     )
-    cookie = response.headers.get("set-cookie", "")
-    assert "docdoe_media_token=token-value" in cookie
-    assert "samesite=none" in cookie.lower()
-    assert "secure" in cookie.lower()
+    cookie = _media_cookie_flags(response.headers.get("set-cookie", ""))
+    assert cookie["httponly"] is True
+    assert cookie["secure"] is True
+    assert cookie["path"] == "/generated"
+    assert cookie["samesite"] == "none"
+
+
+def test_unknown_environment_fails_closed_to_secure_cookie() -> None:
+    from app.routes.auth import _set_media_auth_cookie
+
+    response = Response()
+    _set_media_auth_cookie(
+        response,
+        "token-value",
+        3600,
+        settings=SimpleNamespace(),
+    )
+    cookie = _media_cookie_flags(response.headers.get("set-cookie", ""))
+    assert cookie["secure"] is True
+    assert cookie["samesite"] == "none"
+    assert cookie["httponly"] is True
+    assert cookie["path"] == "/generated"