Attempt to mitigate errors w/ HTTPS

config.py

@@ -5,14 +5,14 @@ class Settings(BaseSettings):
     port: int = 5000
     db_url: str
     fernet_key: str
-    cookie_httponly: bool = False
+    cookie_httponly: bool = True
     frontend_url: str
     boss_url: str
     boss_aes_key: str
     boss_hmac_key: str
     
     model_config = SettingsConfigDict(env_file=".env", extra="ignore")
-    cookie_secure: bool = False
+    cookie_secure: bool = True
 
 settings = Settings()
 cipher = Fernet(settings.fernet_key.encode())

database.py

@@ -23,6 +23,7 @@ class Session(Base):
 engine = create_engine(settings.db_url, pool_pre_ping=True)
 SessionLocal = sessionmaker(autocommit=False, autoflush=False, bind=engine)
 
+# TODO: look into why this is being called twice on startup
 def init_db():
     try:
         Base.metadata.create_all(bind=engine)
@@ -34,4 +35,4 @@ def init_db():
         print(f"database setup error: {str(e)}")
         raise
 
-init_db()
+init_db()

main.py

@@ -10,17 +10,6 @@ from services.boss_retrieval import process_boss_file
 from contextlib import asynccontextmanager
 import asyncio
 
-app = FastAPI()
-
-app.add_middleware(
-    CORSMiddleware,
-    allow_origins=[settings.frontend_url], 
-    allow_credentials=True,
-    allow_methods=["*"],
-    allow_headers=["*"],
-    expose_headers=["Set-Cookie"],
-)
-
 async def boss_worker_loop():
     print("background worker started")
     while True:
@@ -29,10 +18,6 @@ async def boss_worker_loop():
             process_boss_file()
         except Exception as e:
             print(f"worker error: {e}")
-        
-        # TODO: actually sync to what schedule says.
-        # for now its set to 1hr just incase pretendo fuckery happens
-        # (such as rotation ending)
         await asyncio.sleep(3600)
 
 @asynccontextmanager
@@ -44,6 +29,15 @@ async def lifespan(app: FastAPI):
 
 app = FastAPI(lifespan=lifespan)
 
+app.add_middleware(
+    CORSMiddleware,
+    allow_origins=[settings.frontend_url], 
+    allow_credentials=True,
+    allow_methods=["*"],
+    allow_headers=["*"],
+    expose_headers=["Set-Cookie"],
+)
+
 @app.middleware("http")
 async def force_cors_on_errors(request: Request, call_next):
     response = await call_next(request)

routes/sso.py

@@ -83,8 +83,8 @@ async def login(
             key="session_id",
             value=active_session.id,
             httponly=settings.cookie_httponly,
-            secure=False,
+            secure=settings.cookie_secure,
-            samesite="lax",
+            samesite="none",
             path="/",
             max_age=cookie_age,
             domain=None