Fix CSRF token and session config for HF Spaces

config.py

@@ -2,18 +2,26 @@ import os
 from dotenv import load_dotenv
 
 basedir = os.path.abspath(os.path.dirname(__file__))
-# Load .env file only if not on Render
-if not os.environ.get('RENDER'):
+# Load .env file only if not on Render or Hugging Face
+if not os.environ.get('RENDER') and not os.environ.get('SPACE_ID'):
     load_dotenv(os.path.join(basedir, '.env'))
 
 # Set Flask app for CLI commands (needed for flask db upgrade)
 os.environ.setdefault('FLASK_APP', 'run.py')
 
+# Check if running in production (Render or HF Spaces)
+IS_PRODUCTION = os.environ.get('RENDER') or os.environ.get('SPACE_ID')
+
 class Config:
-    SECRET_KEY = os.environ.get('FLASK_SECRET_KEY') or 'dev-secret-key-change-in-production-2024'
+    SECRET_KEY = os.environ.get('FLASK_SECRET_KEY') or os.environ.get('SECRET_KEY') or 'dev-secret-key-change-in-production-2024'
     SQLALCHEMY_DATABASE_URI = os.environ.get('DATABASE_URL') or \
-        'sqlite:///' + os.path.join(basedir, 'app.db')
+        'sqlite:///' + os.path.join(basedir, 'instance', 'app.db')
     SQLALCHEMY_TRACK_MODIFICATIONS = False
+    
+    # WTF CSRF Settings
+    WTF_CSRF_ENABLED = True
+    WTF_CSRF_TIME_LIMIT = 3600  # 1 hour token validity
+    WTF_CSRF_SSL_STRICT = False  # Allow CSRF over HTTP for development
 
     # Session configuration
     SESSION_COOKIE_HTTPONLY = True
@@ -24,11 +32,11 @@ class Config:
     SESSION_COOKIE_NAME = 'learning_path_session'  # Custom session cookie name
     
     # Ensure cookies work with OAuth redirects in production
-    if os.environ.get('RENDER'):
+    if IS_PRODUCTION:
         SESSION_COOKIE_SECURE = True       # Cookie only over HTTPS
-        SESSION_COOKIE_SAMESITE = 'None'   # Allow cross-site OAuth redirect
+        SESSION_COOKIE_SAMESITE = 'Lax'    # Lax works better for same-site forms
         REMEMBER_COOKIE_SECURE = True
-        REMEMBER_COOKIE_SAMESITE = 'None'
+        REMEMBER_COOKIE_SAMESITE = 'Lax'
     else:
         # Local development - allow HTTP cookies
         SESSION_COOKIE_SECURE = False