Updated files

app.py

@@ -92,24 +92,38 @@ security = HTTPBearer(auto_error=False)
 # Settings for Hugging Face Spaces: use /tmp dirs
 class Settings:
     def __init__(self):
+        # Detect if running in Hugging Face Spaces (PORT is set and not a typical local port)
+        port_env = os.environ.get('PORT')
+        self.is_spaces = port_env is not None and port_env not in ['8000', '5000', '8080']
         self.server = type('ServerSettings', (), {
-            'debug': False,
-            'host': '0.0.0.0',
-            'port': int(os.environ.get('PORT', 7860))  # Default to 7860 for HF Spaces
+            'debug': not self.is_spaces,
+            'host': '127.0.0.1',
+            'port': int(port_env) if port_env else 8000  # Default to 8000 for local
         })()
         self.security = type('SecuritySettings', (), {
             'cors_origins': ["*"],
             'cors_methods': ["*"],
             'cors_headers': ["*"]
         })()
+
     def get_static_dir(self):
-        return "/tmp/researchmate/static"
+        if self.is_spaces:
+            return "/tmp/researchmate/static"
+        return "src/static"
+
     def get_templates_dir(self):
-        return "src/templates"  # Templates can remain in src
+        # Templates can remain in src for both
+        return "src/templates"
+
     def get_upload_dir(self):
-        return "/tmp/researchmate/uploads"
+        if self.is_spaces:
+            return "/tmp/researchmate/uploads"
+        return "uploads"
+
     def get_logs_dir(self):
-        return "/tmp/researchmate/logs"
+        if self.is_spaces:
+            return "/tmp/researchmate/logs"
+        return "logs"
 
 settings = Settings()
 

data/active_sessions.json

@@ -1,7 +1,7 @@
 {
   "admin_user": {
-    "token": "eyJhbGciOiJIUzI1NiIsInR5cCI6IkpXVCJ9.eyJ1c2VyX2lkIjoiYWRtaW5fdXNlciIsInVzZXJuYW1lIjoiYWRtaW4iLCJleHAiOjE3NTI2MTI4NjR9.-4rWv6qNOaSp9kup3AjqbwhC_h5P6anYhxP6OfYoBWU",
-    "created_at": "2025-07-15T18:24:24.155119",
-    "last_activity": "2025-07-15T18:26:51.425464"
+    "token": "eyJhbGciOiJIUzI1NiIsInR5cCI6IkpXVCJ9.eyJ1c2VyX2lkIjoiYWRtaW5fdXNlciIsInVzZXJuYW1lIjoiYWRtaW4iLCJleHAiOjE3NTI2MTQwMzZ9.ymVeZ3z0Qiap57XjE2u8II_EXexLH49oM3shT7lXfJ0",
+    "created_at": "2025-07-15T18:43:56.569611",
+    "last_activity": "2025-07-15T18:43:58.764999"
   }
 }

src/static/js/main.js

@@ -21,8 +21,12 @@ function setAuthToken(token) {
     localStorage.setItem('authToken', token);
     localStorage.setItem('tokenTimestamp', Date.now().toString());
     
-    // Set cookie with HttpOnly equivalent behavior
-    document.cookie = `authToken=${token}; path=/; SameSite=Strict; Secure=${location.protocol === 'https:'}`;
+    // Set cookie with Secure flag only if using HTTPS
+    let cookie = `authToken=${token}; path=/; SameSite=Strict`;
+    if (location.protocol === 'https:') {
+        cookie += '; Secure';
+    }
+    document.cookie = cookie;
     
     // Reset activity tracking
     lastActivityTime = Date.now();