Add HF Spaces specific session configuration

Based on HF official recommendations and security practices:
- Use environment-specific session middleware config
- HF Spaces: same_site='none', https_only=True, custom cookie name
- Add detailed HF Spaces session debugging with cookies and headers
- Shorter session expiry for HF Spaces (1 hour vs 24 hours)
- Explicit path and domain settings for HF proxy compatibility

This addresses known HF Spaces proxy/middleware session issues.

backend/app.py

@@ -56,14 +56,34 @@ app.add_middleware(
 )
 
 # Add session middleware (second, so auth can read session data)
+# HF Spaces specific session configuration
 session_secret = os.getenv("SESSION_SECRET_KEY") or secrets.token_urlsafe(32)
-app.add_middleware(
-    SessionMiddleware, 
-    secret_key=session_secret,
-    max_age=86400,  # 24 hours
-    same_site="lax",  # Better for OAuth redirects
-    https_only=False,  # Will be True in production via reverse proxy
-)
+
+# Detect if running in HF Spaces and adjust session config accordingly
+from utils.environment import is_huggingface_space
+if is_huggingface_space():
+    # HF Spaces optimized session configuration
+    logger.info("🏗️ Configuring session middleware for HF Spaces environment")
+    app.add_middleware(
+        SessionMiddleware,
+        secret_key=session_secret,
+        max_age=3600,  # Shorter expiry for HF Spaces (1 hour)
+        same_site="none",  # More permissive for HF Spaces proxy
+        https_only=True,  # HF Spaces uses HTTPS
+        session_cookie="hf_session",  # Custom cookie name for HF Spaces
+        path="/",  # Explicit path
+        domain=None,  # Let HF Spaces handle domain
+    )
+else:
+    # Local development session configuration
+    logger.info("🏠 Configuring session middleware for local development")
+    app.add_middleware(
+        SessionMiddleware, 
+        secret_key=session_secret,
+        max_age=86400,  # 24 hours for local dev
+        same_site="lax",  # Better for OAuth redirects
+        https_only=False,  # HTTP for local dev
+    )
 
 # Add conditional authentication middleware (after session)
 # TEMPORARILY DISABLED for debugging session issues

backend/dependencies.py

@@ -120,8 +120,31 @@ def get_current_user_optional(request: Request) -> Optional[Dict[str, Any]]:
         else:
             # Add detailed debugging for session contents
             session_keys = list(request.session.keys()) if hasattr(request.session, 'keys') else []
-            logger.debug(f"🔍 No user found in session for {request.url.path}. Session keys: {session_keys}")
-            logger.debug(f"🔍 Full session contents: {dict(request.session) if hasattr(request.session, 'keys') else 'no session'}")
+            logger.warning(f"🔍 No user found in session for {request.url.path}. Session keys: {session_keys}")
+            
+            # HF Spaces specific debugging
+            from utils.environment import is_huggingface_space
+            if is_huggingface_space():
+                # Log HF-specific session debugging info
+                cookies = request.cookies
+                logger.warning(f"🍪 HF Spaces cookies: {list(cookies.keys())}")
+                logger.warning(f"🍪 Session cookie present: {'hf_session' in cookies}")
+                
+                # Check if session middleware is properly initialized
+                session_data = dict(request.session) if hasattr(request.session, 'keys') else {}
+                logger.warning(f"🔍 HF Session data: {session_data}")
+                
+                # Check request headers that might affect session
+                relevant_headers = {
+                    'host': request.headers.get('host'),
+                    'x-forwarded-for': request.headers.get('x-forwarded-for'),
+                    'x-forwarded-proto': request.headers.get('x-forwarded-proto'),
+                    'user-agent': request.headers.get('user-agent', '')[:50] + '...',
+                }
+                logger.warning(f"🔍 HF Request headers: {relevant_headers}")
+            else:
+                logger.debug(f"🔍 Full session contents: {dict(request.session) if hasattr(request.session, 'keys') else 'no session'}")
+            
             return None
     except Exception as e:
         logger.error(f"Session access failed: {e}")