Fix cookie setting by serving index directly

- Serve index.html directly instead of redirect to prevent cookie loss
- Set auth cookies via both HTTP headers and JavaScript
- Add debug logging for cookie verification
- Inject session heartbeat script directly into HTML
- Avoid redirect loops in HF Spaces iframe environment

api.py

@@ -1521,42 +1521,64 @@ def login():
                 return redirect(next_page)
             print("Redirecting to index.html")
             
-            # Redirect to index.html with session cookie explicitly set
-            print("Redirecting to index.html with explicit session cookie")
+            # Serve index.html directly with cookies to avoid redirect issues
+            print("Serving index.html directly with auth cookies")
             
-            response = make_response(redirect(url_for('serve_index_html')))
+            # Read index.html file
+            index_path = os.path.join(app.static_folder, 'index.html')
+            try:
+                with open(index_path, 'r', encoding='utf-8') as f:
+                    html = f.read()
+            except Exception as e:
+                print(f"[DEBUG] Failed to read index.html: {e}")
+                return "Error loading page", 500
+
+            # Add session debug script
+            debug_script = f"""
+            <script>
+            // Debug session and cookies
+            console.log('Session debug - user_id: {user.id}, username: {username}');
+            document.cookie = 'auth_user_id={user.id}; path=/; SameSite=None';
+            document.cookie = 'auth_username={username}; path=/; SameSite=None';
+            console.log('Cookies set via JS:', document.cookie);
             
-            # Force set session cookie manually for HF Spaces
-            session_cookie_name = app.config.get('SESSION_COOKIE_NAME', 'session')
-            if hasattr(session, 'sid'):
-                response.set_cookie(
-                    session_cookie_name,
-                    session.sid,
-                    httponly=False,
-                    secure=False,
-                    samesite=None,
-                    path='/',
-                    domain=None
-                )
+            // Session heartbeat
+            setInterval(function() {{
+                fetch('/api/heartbeat', {{
+                    method: 'POST',
+                    credentials: 'include'
+                }}).catch(function(error) {{
+                    console.log('Heartbeat failed:', error);
+                }});
+            }}, 30000);
+            </script>
+            """
+            
+            # Insert script before </body>
+            if '</body>' in html:
+                html = html.replace('</body>', debug_script + '\n</body>')
+            else:
+                html += debug_script
+            
+            response = make_response(html)
+            response.headers['Content-Type'] = 'text/html; charset=utf-8'
             
-            # Also set a simple auth cookie as backup
+            # Set cookies in response headers as well
             response.set_cookie(
                 'auth_user_id',
                 str(user.id),
                 httponly=False,
                 secure=False,
-                samesite=None,
-                path='/',
-                domain=None
+                samesite='None',
+                path='/'
             )
             response.set_cookie(
                 'auth_username', 
                 username,
                 httponly=False,
                 secure=False,
-                samesite=None,
-                path='/',
-                domain=None
+                samesite='None',
+                path='/'
             )
             
             response.headers['Cache-Control'] = 'no-cache, no-store, must-revalidate'