16

app.py

@@ -4,19 +4,28 @@ import os, re, logging, threading
 from datetime import datetime, timezone
 from functools import wraps
 from flask import Flask, render_template, request, redirect, url_for, session, jsonify, flash
+from werkzeug.middleware.proxy_fix import ProxyFix
 
 # ===== Logging =====
 logging.basicConfig(level=logging.INFO, format="%(asctime)s | %(levelname)s | %(message)s")
 log = logging.getLogger("papua-app")
 
 # ===== Flask =====
-# >> PAKAI folder 'frontend' (sesuai struktur kamu)
+# Template ada di 'frontend/' sesuai struktur kamu
 app = Flask(__name__, template_folder="frontend", static_folder="static")
-SESSION_SECURE = os.getenv("SESSION_COOKIE_SECURE", "true").lower() in ("1","true","yes")
+
+# TRUST reverse proxy di HF (agar proto https & host benar → cookie Secure & redirect aman)
+app.wsgi_app = ProxyFix(app.wsgi_app, x_for=1, x_proto=1, x_host=1)
+
+# Session config: aman untuk iframe (Spaces) agar cookie tidak ditolak browser
 app.config.update(
     SECRET_KEY=os.getenv("SECRET_KEY", "dev-secret-change-me"),
-    SESSION_COOKIE_SAMESITE="Lax",
-    SESSION_COOKIE_SECURE=SESSION_SECURE,
+    SESSION_COOKIE_NAME="hfspace_session",
+    SESSION_COOKIE_SAMESITE="None",   # penting: iframe = third-party context
+    SESSION_COOKIE_SECURE=True,       # wajib True kalau SAMESITE=None
+    SESSION_COOKIE_HTTPONLY=True,
+    SESSION_COOKIE_PATH="/",
+    PREFERRED_URL_SCHEME="https",
 )
 
 # ===== DB: SQLAlchemy (Supabase Postgres / SQLite fallback) =====
@@ -28,7 +37,7 @@ if not DATABASE_URL:
     DATABASE_URL = "sqlite:////tmp/app.db"
     log.warning("[DB] DATABASE_URL tidak diset; pakai SQLite /tmp/app.db")
 else:
-    # normalisasi skema → psycopg2
+    # normalisasi skema ke psycopg2 driver
     if DATABASE_URL.startswith("postgres://"):
         DATABASE_URL = DATABASE_URL.replace("postgres://", "postgresql+psycopg2://", 1)
     elif DATABASE_URL.startswith("postgresql://"):
@@ -94,7 +103,7 @@ def prenorm(text: str) -> str:
 from transformers import AutoTokenizer, AutoModelForSeq2SeqLM
 from peft import PeftModel
 
-# Untuk uji UI cepat gunakan mt5-small & kosongkan adapter, lalu ganti ke model kamu
+# Mulai dengan model kecil agar UI/DB bisa diuji cepat; ganti ke model kamu setelahnya
 BASE_MODEL_ID = os.getenv("BASE_MODEL_ID", "google/mt5-small")
 ADAPTER_ID    = os.getenv("ADAPTER_ID", "")
 DEVICE        = "cuda" if os.getenv("DEVICE", "cpu") == "cuda" else "cpu"
@@ -144,6 +153,17 @@ def _err(e):
     log.exception("Unhandled error")
     return "Internal Server Error", 500
 
+# ===== Debug endpoints untuk cek session cookie =====
+@app.get("/debug/session/set")
+def dbg_set():
+    session["uid"] = "test-user"
+    session["email"] = "test@example.com"
+    return {"ok": True, "set": True}
+
+@app.get("/debug/session/get")
+def dbg_get():
+    return {"uid": session.get("uid"), "email": session.get("email")}
+
 # ===== Routes =====
 @app.get("/health")
 @app.get("/ping")