Stop the session secret and the bundle cache from logging people out

[percolator]

Follow-up to #12, from a console trace showing POST /api/sessions succeeding and every GET for the session it just created answering 401.

The session secret was being regenerated

That signature — a cookie accepted by one request and rejected moments later — cannot be expiry and cannot be the volume. /api/health confirms storage: persistent, so the data directory is writable and the secret file does persist.

resolved_session_secret was a plain @property, so it ran on every request, and its create path checked whether the file existed and then wrote it:

if secret_file.exists(): ...read...
generated = secrets.token_urlsafe(48)
secret_file.write_text(generated)   # truncates

Three ways that ends in mismatched cookies:

• Concurrent callers with no file yet each generate their own and overwrite the last. A test driving twelve at once against the old code produced six different secrets from one cold start. The Join view fires /state, /join-url, /qr.svg and /participants almost simultaneously, which is exactly that burst.
• write_text truncates, so a concurrent reader sees an empty file and generates yet another.
• An unreadable file — one left by an image that ran as a different uid — hit except OSError: pass and fell through to a per-process random secret, silently.

Now created with O_EXCL, so exactly one caller wins and the rest adopt its value, and cached per process. The last-resort random secret is logged as an error instead of used in silence.

Diagnosis from outside the container: /api/health gains instance and secret (a truncated SHA-256 — 32 bits of a 384-bit token, enough to compare, useless for forging). If either changes between two calls to the same URL, processes disagree and logins will fail at random. The same line is logged at startup.

Missing bundles returned index.html

The other half of the same trace:

Failed to load module script: Expected a JavaScript-or-Wasm module script
but the server responded with a MIME type of "text/html"

Angular fingerprints its bundles and index.html names the set belonging to one build, so a cached index.html outlives the deploy that produced it and asks for chunks the new build lacks. The SPA fallback answered those with index.html, turning a missing file into a MIME error that names nothing useful.

A path whose last segment has an extension now 404s when absent, and index.html is served no-cache. Fingerprinted bundles are immutable. Both e2e specs were confirmed to fail against the previous behaviour with the reported symptom before the fix.

Sessions no longer lapse mid-lecture

The window was 12 hours from login, so a teacher who prepared the evening before was signed out by lecture time. It is now a week, measured from last use: a request carrying a cookie older than a day re-issues it.

Renewal is a middleware, not part of the current_user dependency. FastAPI merges a dependency's response headers only when the endpoint returns data to serialise — a returned Response is used as-is (routing.py:712). Setting the cookie in the dependency works for every JSON endpoint and silently does nothing for qr.svg and the SPA fallback, so the projected Join view would quietly stop renewing. Verified against a minimal app; pinned by a test that renews through qr.svg.

Also: SignatureExpired subclasses BadSignature, so catching only the latter reported every routine expiry as Invalid session — the message that means the secret is wrong. Expiry now says Session expired, and Invalid session keeps its narrower, more interesting meaning.

Tests

78 backend, 5 frontend unit, 8 browser specs. New: test_session_secret.py (including the concurrent cold start), test_session_cookie.py (valid, expired, wrong-secret, absent, renewal through a Response-returning endpoint), asset-serving.spec.mjs.

Not addressed here

Whether more than one process serves the deployed app — the instance/secret fields answer that once this is deployed, and it would be a Serve scaling question rather than a code one.

---

Generated by Claude Code