Update via HuggingFace Tool

app/auth.py

@@ -7,7 +7,7 @@ from fastapi import HTTPException, Request, status
 from starlette.middleware.sessions import SessionMiddleware
 from starlette.responses import JSONResponse, HTMLResponse
 from starlette.types import ASGIApp, Receive, Scope, Send
-from itsdangerous import URLSafeTimedSerializer, BadSignature
+from itsdangerous import URLSafeSerializer, BadSignature
 import secrets
 import time
 from typing import Optional, Callable
@@ -15,12 +15,18 @@ from app.config import settings
 
 
 # Session serializer for decoding cookies in middleware
+# Must match Starlette's SessionMiddleware exactly
 def get_session_serializer():
-    """Create a serializer matching SessionMiddleware's format"""
-    return URLSafeTimedSerializer(
+    """Create a serializer matching SessionMiddleware's format exactly"""
+    # Starlette uses URLSafeSerializer (not URLSafeTimedSerializer)
+    # with these exact parameters
+    return URLSafeSerializer(
         settings.SESSION_SECRET_KEY,
         salt="cookie-session",
-        signer_kwargs={"key_derivation": "hmac", "digest_method": "sha1"}
+        signer_kwargs={
+            "key_derivation": "hmac",
+            "digest_method": "sha1"
+        }
     )
 
 
@@ -30,9 +36,10 @@ def decode_session_cookie(cookie_value: str) -> dict:
         return {}
     try:
         serializer = get_session_serializer()
-        # max_age matches the session max_age
-        return serializer.loads(cookie_value, max_age=settings.SESSION_EXPIRE_HOURS * 3600)
-    except (BadSignature, Exception):
+        return serializer.loads(cookie_value)
+    except (BadSignature, Exception) as e:
+        # Log error for debugging but don't crash
+        print(f"Session decode error: {e}")
         return {}
 
 
@@ -87,9 +94,11 @@ class AuthMiddleware:
     
     IMPORTANT: This middleware decodes the session cookie directly because
     SessionMiddleware hasn't run yet when this middleware executes.
+    Starlette middleware runs in REVERSE order - so AuthMiddleware (added first)
+    runs BEFORE SessionMiddleware (added second).
     """
     
-    # Paths that don't require authentication
+    # Paths that don't require authentication (exact match)
     PUBLIC_PATHS = [
         "/login",
         "/api/auth/login",
@@ -121,7 +130,12 @@ class AuthMiddleware:
             await self.app(scope, receive, send)
             return
         
-        # Allow public paths (but NOT root "/")
+        # Allow root path "/" - the dashboard handles its own auth check
+        if path == "/":
+            await self.app(scope, receive, send)
+            return
+        
+        # Allow public paths
         if path in self.PUBLIC_PATHS:
             await self.app(scope, receive, send)
             return
@@ -151,13 +165,13 @@ class AuthMiddleware:
                 await self.app(scope, receive, send)
                 return
         
-        # Unauthorized - redirect to login for HTML requests
+        # Unauthorized - return appropriate response
         accept = headers.get(b"accept", b"").decode("utf-8", errors="ignore")
         
         # Check if this is an API request or browser request
         is_api_request = path.startswith("/api/") or "application/json" in accept
         
-        if is_api_request and not "text/html" in accept:
+        if is_api_request and "text/html" not in accept:
             # API request - return JSON error
             response = JSONResponse(
                 {"detail": "Authentication required", "login_url": "/login"},
@@ -228,7 +242,7 @@ def get_login_html(error: str = None) -> str:
         }}
         .login-icon {{ 
             font-size: 3rem; 
-            margin-bottom: 20px;
+            margin-bottom: 20px; 
             display: block;
             text-align: center;
         }}
@@ -334,17 +348,18 @@ def get_login_html(error: str = None) -> str:
                 
                 const response = await fetch('/api/auth/login', {{
                     method: 'POST',
-                    body: formData
+                    body: formData,
+                    credentials: 'same-origin'
                 }});
                 
                 const data = await response.json();
                 
                 if (response.ok && data.success) {{
                     btnText.textContent = 'Success!';
-                    // Wait a moment for cookie to be set, then redirect
+                    // Wait for cookie to be fully set, then redirect
                     setTimeout(() => {{
-                        window.location.href = '/';
-                    }}, 100);
+                        window.location.replace('/');
+                    }}, 200);
                 }} else {{
                     throw new Error(data.detail || 'Authentication failed');
                 }}
@@ -362,4 +377,4 @@ def get_login_html(error: str = None) -> str:
         document.getElementById('password').focus();
     </script>
 </body>
-</html>'''
+</html>'''