deploy: sync backend to Space root (learn-lesson HF cache fix)

app/core/config.py

@@ -13,12 +13,6 @@ class Settings(BaseSettings):
     app_name: str = "AI Exam Success API"
     app_version: str = "0.1.0"
     environment: str = "development"
-
-    @property
-    def is_production(self) -> bool:
-        """Single source for production-only cookie and security behaviour."""
-        return self.environment.strip().casefold() == "production"
-
     database_url: str = f"sqlite:///{BACKEND_DIR / 'exam_success_dev.db'}"
     # Dev defaults stay small; production .env should raise these for 1k+ concurrent students.
     database_pool_size: int = Field(
@@ -310,6 +304,11 @@ class Settings(BaseSettings):
         extra="ignore",
     )
 
+    @property
+    def is_production(self) -> bool:
+        """True when ENVIRONMENT is production (case-insensitive)."""
+        return self.environment.strip().casefold() == "production"
+
     @property
     def cors_origin_list(self) -> list[str]:
         origins = [origin.strip() for origin in self.cors_origins.split(",") if origin.strip()]

app/routes/auth.py

@@ -267,12 +267,18 @@ def _auth_redirect_for_user(user: User, next_path: str) -> RedirectResponse:
 
 
 def _is_production_environment(settings: object | None = None) -> bool:
-    """Resolve production safely even if an older Settings build lacks is_production."""
+    """Resolve production even if an older Settings build lacks is_production."""
     active = settings or get_settings()
-    flag = getattr(active, "is_production", None)
+    try:
+        flag = getattr(active, "is_production", None)
+    except AttributeError:
+        flag = None
     if isinstance(flag, bool):
-        return flag
-    return str(getattr(active, "environment", "") or "").strip().casefold() == "production"
+        production = flag
+    else:
+        production = str(getattr(active, "environment", "") or "").strip().casefold() == "production"
+    logger.debug("[FIX] media-auth cookie production=%s", production)
+    return production
 
 
 def _set_media_auth_cookie(

tests/test_media_auth_cookie.py

@@ -0,0 +1,52 @@
+"""Regression tests for signup media-cookie setup.
+
+CI failed because `_set_media_auth_cookie` read `settings.is_production`
+while `Settings` only exposed `environment`.
+"""
+
+from __future__ import annotations
+
+from types import SimpleNamespace
+
+from fastapi import Response
+
+
+def test_settings_exposes_is_production_from_environment() -> None:
+    from app.core.config import Settings
+
+    assert Settings(environment="production").is_production is True
+    assert Settings(environment="PRODUCTION").is_production is True
+    assert Settings(environment="development").is_production is False
+    assert Settings(environment=" staging ").is_production is False
+
+
+def test_signup_sets_media_cookie_without_crashing(auth_client) -> None:
+    response = auth_client.post(
+        "/auth/signup",
+        json={
+            "name": "Cookie Student",
+            "email": "media-cookie-fix@example.test",
+            "password": "Pass123!beta",
+        },
+    )
+    assert response.status_code == 201, response.text
+    assert response.json()["access_token"]
+    cookie = response.headers.get("set-cookie", "")
+    assert "docdoe_media_token=" in cookie
+    assert "secure" not in cookie.lower()
+
+
+def test_media_cookie_is_secure_when_environment_is_production() -> None:
+    from app.routes.auth import _set_media_auth_cookie
+
+    response = Response()
+    _set_media_auth_cookie(
+        response,
+        "token-value",
+        3600,
+        settings=SimpleNamespace(environment="production"),
+    )
+    cookie = response.headers.get("set-cookie", "")
+    assert "docdoe_media_token=token-value" in cookie
+    assert "samesite=none" in cookie.lower()
+    assert "secure" in cookie.lower()