Fix middleware order and session access issues

- Reorder middleware stack: Session -> UsageTracking -> Auth -> CORS
- Fix session access in authentication middleware with try-catch
- Add proper error handling for session not available scenarios
- Ensure SessionMiddleware runs before ConditionalAuthMiddleware

backend/app.py

@@ -44,27 +44,27 @@ logger = logging.getLogger("agent_monitoring_server")
 # Create FastAPI app
 app = FastAPI(title="Agent Monitoring System", version="1.0.0")
 
-# Add session middleware (required for OAuth)
-session_secret = os.getenv("SESSION_SECRET_KEY") or secrets.token_urlsafe(32)
+# Add CORS middleware (first, so it's outermost)
 app.add_middleware(
-    SessionMiddleware, 
-    secret_key=session_secret,
-    max_age=86400,  # 24 hours
+    CORSMiddleware,
+    allow_origins=["*"],
+    allow_credentials=True,
+    allow_methods=["*"],
+    allow_headers=["*"],
 )
 
-# Add usage tracking middleware (before auth, to track all requests)
-app.add_middleware(UsageTrackingMiddleware)
-
 # Add conditional authentication middleware
 app.add_middleware(ConditionalAuthMiddleware)
 
-# Add CORS middleware
+# Add usage tracking middleware (after auth, to track authenticated requests)
+app.add_middleware(UsageTrackingMiddleware)
+
+# Add session middleware (last, so it's innermost and processes requests first)
+session_secret = os.getenv("SESSION_SECRET_KEY") or secrets.token_urlsafe(32)
 app.add_middleware(
-    CORSMiddleware,
-    allow_origins=["*"],
-    allow_credentials=True,
-    allow_methods=["*"],
-    allow_headers=["*"],
+    SessionMiddleware, 
+    secret_key=session_secret,
+    max_age=86400,  # 24 hours
 )
 
 # Mount datasets directory for accessing json files

backend/middleware/auth.py

@@ -122,7 +122,13 @@ class ConditionalAuthMiddleware(BaseHTTPMiddleware):
         3. Authorization header
         """
         # Check if user info is in session (our own auth)
-        user = request.session.get("user") if hasattr(request, "session") else None
+        user = None
+        try:
+            user = request.session.get("user")
+        except (AttributeError, AssertionError):
+            # Session middleware not available or not configured
+            logger.debug("Session not available for authentication check")
+            user = None
         
         # In HF Spaces, check for __sign parameter which indicates HF has pre-authenticated the user
         if not user and is_huggingface_space():
@@ -139,8 +145,10 @@ class ConditionalAuthMiddleware(BaseHTTPMiddleware):
                     "auth_method": "hf_sign"
                 }
                 # Store in session for future requests
-                if hasattr(request, "session"):
+                try:
                     request.session["user"] = user
+                except (AttributeError, AssertionError):
+                    logger.debug("Cannot store user in session - session middleware not available")
                 logger.info("User authenticated via HF __sign parameter")
         
         # Check Authorization header as fallback

backend/routers/auth.py

@@ -22,7 +22,12 @@ router = APIRouter(prefix="/auth", tags=["authentication"])
 async def auth_status(request: Request):
     """Get authentication status and configuration."""
     config = get_oauth_config()
-    user = getattr(request.state, "user", None) or (request.session.get("user") if hasattr(request, "session") else None)
+    user = getattr(request.state, "user", None)
+    if not user:
+        try:
+            user = request.session.get("user")
+        except (AttributeError, AssertionError):
+            user = None
     
     return {
         "auth_enabled": should_enable_auth(),
@@ -170,7 +175,12 @@ async def get_current_user(request: Request):
     if not should_enable_auth():
         return {"message": "Authentication disabled in local development"}
     
-    user = getattr(request.state, "user", None) or request.session.get("user")
+    user = getattr(request.state, "user", None)
+    if not user:
+        try:
+            user = request.session.get("user")
+        except (AttributeError, AssertionError):
+            user = None
     if not user:
         raise HTTPException(status_code=401, detail="Not authenticated")