Refactor anonymous chat as default homepage with stateless JWT sessions

Major changes:
- Homepage now directly opens anonymous chat interface
- Implemented JWT-based stateless sessions for anonymous users (6-hour expiry)
- Added info banner showing message limits and remaining messages
- Login/register buttons remain accessible in header
- Added cleanup script to reset anonymous data on startup
- Removed choose.html template (no longer needed)

Features:
- Anonymous users land directly on chat without extra clicks
- Clear visual indication of anonymous status and limitations
- Message counter with color-coded warnings as limit approaches
- Stateless operation handles Hugging Face Spaces load balancing
- Automatic cleanup of anonymous sessions on app restart

This fixes session expiration issues on Hugging Face Spaces deployment

app.py

@@ -177,22 +177,85 @@ def record_login_attempt(ip_address):
 API_URL = app.config['API_URL']
 TIMEOUT = app.config['API_TIMEOUT']
 
-# Anonymous user session management
+# Anonymous user session management with JWT tokens for stateless operation
 def generate_anonymous_id():
     """Generate a unique anonymous user ID"""
     random_string = ''.join(secrets.choice(string.ascii_lowercase + string.digits) for _ in range(8))
     return f"anon_{random_string}"
 
-def init_anonymous_session():
-    """Initialize session for anonymous user"""
+def create_anonymous_token(anonymous_id, chat_history=None, message_count=0, first_message_time=None):
+    """Create a JWT token for anonymous users"""
+    payload = {
+        'anonymous_id': anonymous_id,
+        'is_anonymous': True,
+        'exp': datetime.utcnow() + timedelta(hours=6),  # 6 hour expiry
+        'iat': datetime.utcnow(),
+        'chat_history': chat_history or [],
+        'message_count': message_count,
+        'first_message_time': first_message_time
+    }
+    return jwt.encode(payload, app.config['SECRET_KEY'], algorithm='HS256')
+
+def verify_anonymous_token(token):
+    """Verify and decode anonymous JWT token"""
+    try:
+        payload = jwt.decode(token, app.config['SECRET_KEY'], algorithms=['HS256'])
+        if payload.get('is_anonymous'):
+            return payload
+        return None
+    except jwt.ExpiredSignatureError:
+        app.logger.info("Anonymous token expired")
+        return None
+    except jwt.InvalidTokenError:
+        app.logger.info("Invalid anonymous token")
+        return None
+
+def get_or_create_anonymous_session():
+    """Get existing anonymous session from token or create new one"""
+    token = request.cookies.get('anon_token')
+    
+    if token:
+        payload = verify_anonymous_token(token)
+        if payload:
+            # Restore session from token
+            session['is_anonymous'] = True
+            session['anonymous_id'] = payload.get('anonymous_id')
+            session['anonymous_chat_history'] = payload.get('chat_history', [])
+            session['anonymous_message_count'] = payload.get('message_count', 0)
+            session['anonymous_first_message_time'] = payload.get('first_message_time')
+            app.logger.info(f"Restored anonymous session from token: {payload.get('anonymous_id')}")
+            return payload.get('anonymous_id'), token
+    
+    # Create new anonymous session
+    anonymous_id = generate_anonymous_id()
     session.permanent = True
     session['is_anonymous'] = True
-    session['anonymous_id'] = generate_anonymous_id()
+    session['anonymous_id'] = anonymous_id
     session['anonymous_chat_history'] = []
     session['anonymous_message_count'] = 0
     session['anonymous_first_message_time'] = None
-    app.logger.info(f"Initialized anonymous session: {session['anonymous_id']}")
-    return session['anonymous_id']
+    
+    # Create JWT token
+    token = create_anonymous_token(anonymous_id)
+    app.logger.info(f"Created new anonymous session: {anonymous_id}")
+    return anonymous_id, token
+
+def update_anonymous_token():
+    """Update anonymous JWT token with current session data"""
+    if not session.get('is_anonymous'):
+        return None
+    
+    # Keep only last 20 messages in token
+    chat_history = session.get('anonymous_chat_history', [])
+    if len(chat_history) > 20:
+        chat_history = chat_history[-20:]
+    
+    return create_anonymous_token(
+        anonymous_id=session.get('anonymous_id'),
+        chat_history=chat_history,
+        message_count=session.get('anonymous_message_count', 0),
+        first_message_time=session.get('anonymous_first_message_time')
+    )
 
 def get_anonymous_chat_history():
     """Get chat history from session for anonymous user"""
@@ -297,16 +360,34 @@ def make_api_request(message, history=None):
 @app.route('/')
 def index():
     """
-    Main route - show choice page for non-authenticated users
+    Main route - show anonymous chat by default, authenticated chat if logged in
     """
     if current_user.is_authenticated:
-        return redirect(url_for('chat_interface'))
+        # Authenticated users get the full chat interface
+        return render_template('index.html', is_anonymous=False)
     
     # Check if anonymous access is enabled
-    if app.config.get('ANONYMOUS_ENABLED', True):
-        return redirect(url_for('choose'))
-    else:
+    if not app.config.get('ANONYMOUS_ENABLED', True):
+        flash('Please login or register to use the chat.', 'info')
         return redirect(url_for('login'))
+    
+    # Initialize or restore anonymous session with JWT token
+    anonymous_id, token = get_or_create_anonymous_session()
+    
+    # Create response with anonymous chat interface
+    response = make_response(render_template('index.html', is_anonymous=True))
+    
+    # Set anonymous JWT token cookie
+    response.set_cookie(
+        'anon_token',
+        token,
+        max_age=6*60*60,  # 6 hours
+        secure=False,      # HF handles HTTPS at proxy level
+        httponly=False,    # Allow JS access for updates
+        samesite=None      # Most permissive for cross-origin
+    )
+    
+    return response
 
 @app.route('/register', methods=['GET', 'POST'])
 def register():
@@ -463,55 +544,18 @@ def logout():
         
         return response
 
-@app.route('/choose')
-def choose():
-    """
-    Access mode selection page - choose between anonymous or authenticated access
-    """
-    # If user is already logged in, redirect to chat
-    if current_user.is_authenticated:
-        return redirect(url_for('chat_interface'))
-    
-    # Check if anonymous access is enabled
-    if not app.config.get('ANONYMOUS_ENABLED', True):
-        return redirect(url_for('login'))
-    
-    return render_template('choose.html')
+# Choose route removed - no longer needed as homepage shows anonymous chat directly
 
-@app.route('/anonymous')
-def anonymous():
-    """
-    Anonymous chat interface - no authentication required
-    """
-    # If user is authenticated, redirect to authenticated chat
-    if current_user.is_authenticated:
-        return redirect(url_for('chat_interface'))
-    
-    # Check if anonymous access is enabled
-    if not app.config.get('ANONYMOUS_ENABLED', True):
-        flash('Anonymous access is not available. Please login or register.', 'info')
-        return redirect(url_for('login'))
-    
-    # Initialize anonymous session if not already done
-    if not session.get('is_anonymous'):
-        init_anonymous_session()
-    
-    # Render chat interface in anonymous mode
-    return render_template('index.html', is_anonymous=True)
+# Anonymous route removed - homepage now serves anonymous chat directly
 
 @app.route('/chat')
 @hf_login_required
 def chat_interface():
     """
     Protected chat interface - requires authentication
+    Redirects to homepage which handles both anonymous and authenticated chat
     """
-    # Debug session information
-    app.logger.info(f"Chat interface - Session: {dict(session)}")
-    app.logger.info(f"Chat interface - Current user authenticated: {current_user.is_authenticated}")
-    app.logger.info(f"Chat interface - Current user ID: {getattr(current_user, 'id', 'None')}")
-    app.logger.info(f"Request IP: {request.environ.get('HTTP_X_FORWARDED_FOR', request.remote_addr)}")
-    
-    return render_template('index.html')
+    return redirect(url_for('index'))
 
 @app.route('/api/chat', methods=['POST'])
 def chat():
@@ -519,8 +563,28 @@ def chat():
     API route to handle chat requests - supports both authenticated and anonymous users
     """
     try:
-        # Check if user is anonymous
-        is_anonymous = session.get('is_anonymous', False)
+        # Check if user is anonymous - try to restore from token first
+        is_anonymous = False
+        anonymous_token = None
+        
+        if not current_user.is_authenticated:
+            # Try to get anonymous session from token
+            token = request.cookies.get('anon_token')
+            if token:
+                payload = verify_anonymous_token(token)
+                if payload:
+                    # Restore session from token
+                    session['is_anonymous'] = True
+                    session['anonymous_id'] = payload.get('anonymous_id')
+                    session['anonymous_chat_history'] = payload.get('chat_history', [])
+                    session['anonymous_message_count'] = payload.get('message_count', 0)
+                    session['anonymous_first_message_time'] = payload.get('first_message_time')
+                    is_anonymous = True
+                    anonymous_token = token
+            
+            # If no valid token, check session (fallback)
+            if not is_anonymous:
+                is_anonymous = session.get('is_anonymous', False)
         
         # If not anonymous and not authenticated, require login
         if not is_anonymous and not current_user.is_authenticated:
@@ -578,9 +642,19 @@ def chat():
             if is_anonymous:
                 # Save to session for anonymous users
                 add_anonymous_message(message, response_text)
+                
+                # Update the anonymous JWT token with new data
+                updated_token = update_anonymous_token()
+                
                 result['history_saved'] = False  # Indicate temporary storage
                 result['user_id'] = session.get('anonymous_id', 'anonymous')
                 result['is_anonymous'] = True
+                result['message_count'] = session.get('anonymous_message_count', 0)
+                result['messages_remaining'] = max(0, app.config['ANONYMOUS_RATE_LIMIT'] - session.get('anonymous_message_count', 0))
+                
+                # Include updated token in response for client to store
+                if updated_token:
+                    result['update_token'] = updated_token
             else:
                 # Save to database for authenticated users
                 session_metadata = {
@@ -617,6 +691,23 @@ def chat():
             elif 'api' in error_msg.lower():
                 result['error'] = "The chat service is temporarily unavailable. Please try again in a few moments."
         
+        # If we have an updated anonymous token, set it in the response cookie
+        if is_anonymous and 'update_token' in result:
+            response = make_response(jsonify(result))
+            response.set_cookie(
+                'anon_token',
+                result['update_token'],
+                max_age=6*60*60,  # 6 hours
+                secure=False,      # HF handles HTTPS
+                httponly=False,    # Allow JS access
+                samesite=None
+            )
+            # Remove token from JSON response to avoid duplication
+            del result['update_token']
+            response.data = json.dumps(result)
+            response.content_type = 'application/json'
+            return response
+        
         return jsonify(result)
         
     except Exception as e:

cleanup_anonymous.py

@@ -0,0 +1,81 @@
+#!/usr/bin/env python3
+"""
+Cleanup script for anonymous session data
+Runs on app startup to clear stale anonymous sessions
+"""
+
+import os
+import sys
+from datetime import datetime, timedelta
+from pymongo import MongoClient
+import logging
+
+# Setup logging
+logging.basicConfig(level=logging.INFO, format='%(asctime)s - %(levelname)s - %(message)s')
+logger = logging.getLogger(__name__)
+
+def cleanup_anonymous_sessions():
+    """Remove all anonymous session data from MongoDB"""
+    try:
+        # Get MongoDB connection from environment
+        mongodb_url = os.environ.get('MONGODB_URL') or os.environ.get('MONGODB_URI')
+        if not mongodb_url:
+            logger.warning("No MongoDB URL found in environment. Skipping cleanup.")
+            return True
+        
+        # Connect to MongoDB
+        client = MongoClient(mongodb_url)
+        db_name = os.environ.get('MONGODB_DATABASE', 'Atlas')
+        db = client[db_name]
+        
+        # Clear anonymous sessions from chat_sessions collection
+        # Anonymous sessions have user_id starting with 'anon_' or are older than 6 hours
+        if 'chat_sessions' in db.list_collection_names():
+            # Remove sessions with anonymous user IDs
+            result = db.chat_sessions.delete_many({
+                '$or': [
+                    {'user_id': {'$regex': '^anon_'}},
+                    {'session_data.anonymous': True}
+                ]
+            })
+            logger.info(f"Removed {result.deleted_count} anonymous chat sessions")
+        
+        # Clear any temporary anonymous user records if they exist
+        if 'users' in db.list_collection_names():
+            # Remove any accidentally created anonymous user records
+            result = db.users.delete_many({
+                '$or': [
+                    {'email': {'$regex': '^anon_'}},
+                    {'is_anonymous': True}
+                ]
+            })
+            if result.deleted_count > 0:
+                logger.info(f"Removed {result.deleted_count} anonymous user records")
+        
+        # Clear expired sessions (older than 24 hours)
+        cutoff_time = datetime.utcnow() - timedelta(hours=24)
+        if 'sessions' in db.list_collection_names():
+            result = db.sessions.delete_many({
+                'expiry': {'$lt': cutoff_time}
+            })
+            if result.deleted_count > 0:
+                logger.info(f"Removed {result.deleted_count} expired sessions")
+        
+        logger.info("Anonymous session cleanup completed successfully")
+        return True
+        
+    except Exception as e:
+        logger.error(f"Error during anonymous session cleanup: {e}")
+        # Don't fail the app startup if cleanup fails
+        return False
+
+if __name__ == "__main__":
+    # Load environment variables if .env exists
+    try:
+        from dotenv import load_dotenv
+        load_dotenv()
+    except ImportError:
+        pass
+    
+    success = cleanup_anonymous_sessions()
+    sys.exit(0 if success else 1)

start.sh

@@ -44,6 +44,15 @@ if [ $? -ne 0 ]; then
 fi
 echo "✅ Database connection successful"
 
+# Clean up anonymous session data on startup
+echo "Cleaning up anonymous session data..."
+python cleanup_anonymous.py
+if [ $? -eq 0 ]; then
+    echo "✅ Anonymous session cleanup completed"
+else
+    echo "⚠️  Anonymous session cleanup encountered issues (continuing anyway)"
+fi
+
 # Run the application
 PORT=${PORT:-7860}
 echo "Starting Chatty server on http://localhost:$PORT"

static/css/style.css

@@ -284,6 +284,74 @@ body {
     }
 }
 
+/* Anonymous info banner */
+.anonymous-info-banner {
+    background-color: rgb(245, 245, 245);
+    color: rgb(100, 100, 100);
+    padding: 0.75rem 1rem;
+    display: flex;
+    align-items: center;
+    gap: 0.5rem;
+    font-size: 0.9rem;
+    border-bottom: 1px solid rgb(220, 220, 220);
+    flex-wrap: wrap;
+}
+
+.anonymous-info-banner .info-icon {
+    font-size: 1.1rem;
+    color: rgb(120, 120, 120);
+}
+
+.anonymous-info-banner .info-text {
+    flex: 1;
+    min-width: 200px;
+}
+
+.anonymous-info-banner strong {
+    color: rgb(80, 80, 80);
+    font-weight: 600;
+}
+
+.anonymous-info-banner .banner-link {
+    color: black;
+    text-decoration: underline;
+    font-weight: 500;
+}
+
+.anonymous-info-banner .banner-link:hover {
+    text-decoration: none;
+}
+
+.anonymous-info-banner .message-counter {
+    margin-left: auto;
+    background-color: white;
+    padding: 0.25rem 0.75rem;
+    border-radius: 1rem;
+    border: 1px solid rgb(200, 200, 200);
+    font-size: 0.85rem;
+    white-space: nowrap;
+}
+
+.anonymous-info-banner #messagesUsed {
+    font-weight: 600;
+    color: black;
+}
+
+/* Mobile adjustments for info banner */
+@media (max-width: 768px) {
+    .anonymous-info-banner {
+        font-size: 0.85rem;
+        padding: 0.5rem 0.75rem;
+    }
+    
+    .anonymous-info-banner .message-counter {
+        margin-left: 0;
+        margin-top: 0.5rem;
+        width: 100%;
+        text-align: center;
+    }
+}
+
 /* Loading indicator */
 .loading-indicator {
     position: fixed;

static/js/chat.js

@@ -27,6 +27,7 @@ class ChatApp {
         this.isAnonymous = window.chatConfig && window.chatConfig.isAnonymous;
         this.anonymousRateLimit = window.chatConfig ? window.chatConfig.anonymousRateLimit : 0;
         this.anonymousId = window.chatConfig ? window.chatConfig.anonymousId : '';
+        this.messageCount = 0; // Track message count for anonymous users
         
         this.init();
     }
@@ -144,6 +145,16 @@ class ChatApp {
                 if (response.user_id) {
                     this.userId = response.user_id;
                 }
+                
+                // Update message counter for anonymous users
+                if (this.isAnonymous && response.message_count !== undefined) {
+                    this.updateMessageCounter(response.message_count);
+                    
+                    // Show warning if approaching limit
+                    if (response.messages_remaining !== undefined && response.messages_remaining <= 3 && response.messages_remaining > 0) {
+                        this.showRateLimitWarning(response.messages_remaining);
+                    }
+                }
             } else {
                 // Show error message
                 this.showError(response.error || 'Failed to get response');
@@ -263,8 +274,8 @@ class ChatApp {
         // Skip loading history for anonymous users (they start fresh)
         if (this.isAnonymous) {
             this.historyLoaded = true;
-            // Show welcome message for anonymous users
-            this.showAnonymousWelcome();
+            // Initialize message counter for anonymous users
+            this.updateMessageCounter(0);
             return;
         }
         
@@ -481,8 +492,41 @@ class ChatApp {
         }, 5000);
     }
     
-    showAnonymousWelcome() {
-        // No welcome message for minimal UI
+    updateMessageCounter(count) {
+        if (!this.isAnonymous) return;
+        
+        this.messageCount = count;
+        const messagesUsedEl = document.getElementById('messagesUsed');
+        const messageCounterEl = document.getElementById('messageCounter');
+        
+        if (messagesUsedEl) {
+            messagesUsedEl.textContent = count;
+        }
+        
+        // Show warning colors as approaching limit
+        if (messageCounterEl) {
+            if (count >= this.anonymousRateLimit) {
+                messageCounterEl.style.backgroundColor = '#ffcccc';
+                messageCounterEl.style.borderColor = '#ff6666';
+            } else if (count >= this.anonymousRateLimit * 0.8) {
+                messageCounterEl.style.backgroundColor = '#fff5cc';
+                messageCounterEl.style.borderColor = '#ffcc66';
+            } else {
+                messageCounterEl.style.backgroundColor = 'white';
+                messageCounterEl.style.borderColor = 'rgb(200, 200, 200)';
+            }
+        }
+    }
+    
+    showRateLimitWarning(remaining) {
+        const warningDiv = document.createElement('div');
+        warningDiv.className = 'system-message warning';
+        warningDiv.innerHTML = `
+            <strong>⚠️ Rate limit approaching:</strong> You have ${remaining} message${remaining === 1 ? '' : 's'} remaining this hour.
+            <a href="/login">Login</a> or <a href="/register">Register</a> for unlimited messages.
+        `;
+        this.chatMessages.appendChild(warningDiv);
+        this.scrollToBottom();
     }
 }
 

templates/choose.html

@@ -1,26 +0,0 @@
-{% extends "base.html" %}
-
-{% block title %}Chatty{% endblock %}
-
-{% block content %}
-<div class="choose-container">
-    <div class="choose-wrapper">
-        <h1 class="choose-title">Chatty</h1>
-        
-        <div class="choose-options">
-            <a href="{{ url_for('anonymous') }}" class="choose-button">
-                Chat Anonymously
-            </a>
-            
-            <div class="auth-buttons">
-                <a href="{{ url_for('login') }}" class="choose-button">
-                    Login
-                </a>
-                <a href="{{ url_for('register') }}" class="choose-button">
-                    Register
-                </a>
-            </div>
-        </div>
-    </div>
-</div>
-{% endblock %}

templates/index.html

@@ -4,6 +4,19 @@
 
 {% block content %}
 <div class="chat-container">
+    {% if is_anonymous %}
+    <div class="anonymous-info-banner">
+        <span class="info-icon">ℹ️</span>
+        <span class="info-text">
+            You're chatting anonymously. Limited to <strong>{{ config.ANONYMOUS_RATE_LIMIT }}</strong> messages per hour.
+            <a href="{{ url_for('login') }}" class="banner-link">Login</a> or 
+            <a href="{{ url_for('register') }}" class="banner-link">Register</a> to save your chat history and remove limits.
+        </span>
+        <span class="message-counter" id="messageCounter">
+            <span id="messagesUsed">0</span>/{{ config.ANONYMOUS_RATE_LIMIT }} messages used
+        </span>
+    </div>
+    {% endif %}
             <div class="chat-messages" id="chatMessages">
                 <!-- Messages will be dynamically added here -->
             </div>