Fix session management and login redirect issues

app.py

@@ -41,7 +41,19 @@ load_dotenv()
 
 # Initialize Flask app
 app = Flask(__name__, static_folder='app/static', template_folder='app/templates')
-app.secret_key = os.urandom(24)
+
+# FIX: Proper session configuration for HuggingFace Spaces
+app.secret_key = os.environ.get('SECRET_KEY', 'your-secret-key-here-change-this-in-production')
+app.config['SESSION_TYPE'] = 'filesystem'
+app.config['SESSION_PERMANENT'] = False
+app.config['SESSION_USE_SIGNER'] = True
+app.config['SESSION_KEY_PREFIX'] = 'face_attendance:'
+app.config['PERMANENT_SESSION_LIFETIME'] = 1800  # 30 minutes
+
+# Additional session security for container environments
+app.config['SESSION_COOKIE_SECURE'] = False  # Set to True in production with HTTPS
+app.config['SESSION_COOKIE_HTTPONLY'] = True
+app.config['SESSION_COOKIE_SAMESITE'] = 'Lax'
 
 # MongoDB Connection
 try:
@@ -669,16 +681,29 @@ def register():
 def login():
     student_id = request.form.get('student_id')
     password = request.form.get('password')
+    
+    if not student_id or not password:
+        flash('Please enter both student ID and password.', 'danger')
+        return redirect(url_for('login_page'))
+    
     student = students_collection.find_one({'student_id': student_id})
 
-    if student and student['password'] == password:
+    if student and student.get('password') == password:
+        # FIX: Clear any existing session data first
+        session.clear()
+        
+        # Set session data
         session['logged_in'] = True
         session['user_type'] = 'student'
         session['student_id'] = student_id
         session['name'] = student.get('name')
+        session.permanent = True  # Make session permanent
+        
+        print(f"Login successful for student: {student_id}")  # Debug log
         flash('Login successful!', 'success')
         return redirect(url_for('dashboard'))
     else:
+        print(f"Login failed for student: {student_id}")  # Debug log
         flash('Invalid credentials. Please try again.', 'danger')
         return redirect(url_for('login_page'))
 
@@ -729,11 +754,16 @@ def face_login():
                 similarity = cosine_similarity([test_features], [ref_features])[0][0]
                 distance = 1 - similarity
                 
-                if distance < 0.4:  # FIXED: removed HTML entity
+                if distance < 0.4:
+                    # FIX: Clear existing session and set new session data
+                    session.clear()
                     session['logged_in'] = True
                     session['user_type'] = face_role
                     session[id_field] = user[id_field]
                     session['name'] = user.get('name')
+                    session.permanent = True  # Make session permanent
+                    
+                    print(f"Face login successful for {face_role}: {user[id_field]}")  # Debug log
                     flash('Face login successful!', 'success')
                     return redirect(url_for(dashboard_route))
                     
@@ -741,6 +771,7 @@ def face_login():
                 print(f"Error processing user {user.get(id_field)}: {e}")
                 continue
 
+        print("Face login failed - face not recognized")  # Debug log
         flash('Face not recognized. Please try again or contact admin.', 'danger')
         return redirect(url_for('login_page'))
         
@@ -784,10 +815,14 @@ def auto_face_login():
                 distance = 1 - similarity
                 
                 if distance < 0.4:  # FIXED: removed HTML entity
+                    # FIX: Clear existing session and set new session data
+                    session.clear()
                     session['logged_in'] = True
                     session['user_type'] = face_role
                     session[id_field] = user[id_field]
                     session['name'] = user.get('name')
+                    session.permanent = True  # Make session permanent
+                    
                     return jsonify({
                         'success': True,
                         'message': f'Welcome {user["name"]}! Redirecting...',
@@ -813,15 +848,35 @@ def attendance_page():
 
 @app.route('/dashboard')
 def dashboard():
-    if 'logged_in' not in session or session.get('user_type') != 'student':
+    print(f"Dashboard access - Session data: {dict(session)}")  # Debug log
+    
+    # Check if user is logged in
+    if not session.get('logged_in') or session.get('user_type') != 'student':
+        print("Dashboard access denied - redirecting to login")  # Debug log
+        flash('Please log in to access the dashboard.', 'warning')
         return redirect(url_for('login_page'))
+    
     student_id = session.get('student_id')
+    if not student_id:
+        print("Dashboard access denied - no student_id in session")  # Debug log
+        session.clear()
+        return redirect(url_for('login_page'))
+    
     student = students_collection.find_one({'student_id': student_id})
+    if not student:
+        print(f"Dashboard access denied - student not found: {student_id}")  # Debug log
+        session.clear()
+        return redirect(url_for('login_page'))
+    
+    # Process face image for display
     if student and 'face_image' in student and student['face_image']:
         face_image_base64 = base64.b64encode(student['face_image']).decode('utf-8')
         mime_type = student.get('face_image_type', 'image/jpeg')
         student['face_image_url'] = f"data:{mime_type};base64,{face_image_base64}"
+    
     attendance_records = list(attendance_collection.find({'student_id': student_id}).sort('date', -1))
+    
+    print(f"Dashboard loaded successfully for student: {student_id}")  # Debug log
     return render_template('dashboard.html', student=student, attendance_records=attendance_records)
 
 @app.route('/mark-attendance', methods=['POST'])
@@ -1116,28 +1171,56 @@ def teacher_register():
 def teacher_login():
     teacher_id = request.form.get('teacher_id')
     password = request.form.get('password')
+    
+    if not teacher_id or not password:
+        flash('Please enter both teacher ID and password.', 'danger')
+        return redirect(url_for('teacher_login_page'))
+    
     teacher = teachers_collection.find_one({'teacher_id': teacher_id})
-    if teacher and teacher['password'] == password:
+    if teacher and teacher.get('password') == password:
+        # FIX: Clear any existing session data first
+        session.clear()
+        
         session['logged_in'] = True
         session['user_type'] = 'teacher'
         session['teacher_id'] = teacher_id
         session['name'] = teacher.get('name')
+        session.permanent = True  # Make session permanent
+        
+        print(f"Teacher login successful for: {teacher_id}")  # Debug log
         flash('Login successful!', 'success')
         return redirect(url_for('teacher_dashboard'))
     else:
+        print(f"Teacher login failed for: {teacher_id}")  # Debug log
         flash('Invalid credentials. Please try again.', 'danger')
         return redirect(url_for('teacher_login_page'))
 
 @app.route('/teacher_dashboard')
 def teacher_dashboard():
-    if 'logged_in' not in session or session.get('user_type') != 'teacher':
+    print(f"Teacher Dashboard access - Session data: {dict(session)}")  # Debug log
+    
+    if not session.get('logged_in') or session.get('user_type') != 'teacher':
+        print("Teacher dashboard access denied - redirecting to login")  # Debug log
         return redirect(url_for('teacher_login_page'))
+    
     teacher_id = session.get('teacher_id')
+    if not teacher_id:
+        print("Teacher dashboard access denied - no teacher_id in session")  # Debug log
+        session.clear()
+        return redirect(url_for('teacher_login_page'))
+    
     teacher = teachers_collection.find_one({'teacher_id': teacher_id})
+    if not teacher:
+        print(f"Teacher dashboard access denied - teacher not found: {teacher_id}")  # Debug log
+        session.clear()
+        return redirect(url_for('teacher_login_page'))
+    
     if teacher and 'face_image' in teacher and teacher['face_image']:
         face_image_base64 = base64.b64encode(teacher['face_image']).decode('utf-8')
         mime_type = teacher.get('face_image_type', 'image/jpeg')
         teacher['face_image_url'] = f"data:{mime_type};base64,{face_image_base64}"
+    
+    print(f"Teacher dashboard loaded successfully for: {teacher_id}")  # Debug log
     return render_template('teacher_dashboard.html', teacher=teacher)
 
 @app.route('/teacher_logout')