Fix a GitHub Issue

/ork:fix-issue 123

Issue #123: "Login fails intermittently on mobile Safari"
  Labels: bug, auth, P1  |  Comments: 4  |  Assignee: none

Fix approach:

  [1] Proper fix     — Full investigation, root cause analysis, tests
  [2] Quick fix      — Minimal change, skip deep analysis
  [3] Investigate    — Analysis only, no code changes yet
  [4] Hotfix         — Emergency patch, skip PR review

> 1

/ork:fix-issue 123 (Proper fix)
    |
    |  Phase 1-3: Parallel analysis
    |
    |---> debug-investigator ----------------------------------+
    |      Model: opus                                         |
    |      Skills injected:                                    |
    |        root-cause-analysis                              |
    |        pwa-patterns                                        |
    |        auth-patterns                                     |
    |      Actions:                                            |
    |        - Read issue body + all 4 comments                |
    |        - Trace auth flow: login endpoint -> cookie ->    |
    |          session validation -> response                  |
    |        - Search codebase for cookie/session config       |
    |        - Check Safari-specific edge cases                |
    |                                                          |
    |---> memory search ----------------------------------------+|
    |      Query: "Safari" + "cookie" + "authentication"       ||
    |      Result: Found 2 past observations                   ||
    |        [GRAPH] SameSite-cookie (Pattern)                 ||
    |          -> CAUSED -> intermittent-auth-failures         ||
    |          Observation: "Safari rejects SameSite=None      ||
    |          without Secure flag on localhost"               ||
    |                                                         ||
    +---> git blame analysis ----------------------------------+||
           Files: auth/middleware.py, auth/config.py           |||
           Result: cookie config last changed 12 days ago      |||
             commit a3f8c2d: "chore: update cookie defaults"   |||
                                                               |||
    <-------------- Analysis complete <------------------------+++

Root Cause Analysis — Issue #123
=====================================================

Symptom:
  Login fails intermittently on mobile Safari.

Root Cause:
  The session cookie is set with SameSite=Lax (the default
  after commit a3f8c2d), but the login endpoint redirects
  through an OAuth callback that crosses origin boundaries.
  Safari treats cross-origin redirects as "unsafe" navigation
  and strips SameSite=Lax cookies from the request. This
  causes the session validation middleware to reject the
  request because the cookie is missing.

Why Intermittent:
  The failure only occurs when the user arrives from an
  external link (cross-origin navigation). Users who type
  the URL directly or use a bookmark (same-origin navigation)
  get SameSite=Lax cookies attached normally. This explains
  the ~70% success rate: most users navigate directly.

Affected Code:
  File: app/auth/config.py:18
    SESSION_COOKIE_SAMESITE = "lax"  # Changed from "none"
    SESSION_COOKIE_SECURE = True

  File: app/auth/middleware.py:42
    No fallback when cookie is missing from redirect flow.

Confidence: HIGH (memory corroborated, git blame confirmed)

Posted to issue #123:
  "Root cause identified: SameSite=Lax cookie stripped during
   cross-origin OAuth redirect on Safari. Fix in progress."

# app/auth/config.py (before)
SESSION_COOKIE_SAMESITE = "lax"
SESSION_COOKIE_SECURE = True

# app/auth/config.py (after)
SESSION_COOKIE_SAMESITE = "none"
SESSION_COOKIE_SECURE = True  # Required when SameSite=None

# app/auth/middleware.py (added fallback)
async def validate_session(request: Request):
    session_id = request.cookies.get("session_id")

    # Fallback: check Authorization header when cookie is missing.
    # This handles cross-origin redirects where Safari strips cookies.
    if not session_id:
        auth_header = request.headers.get("Authorization")
        if auth_header and auth_header.startswith("Bearer "):
            session_id = await resolve_session_from_token(
                auth_header.removeprefix("Bearer ")
            )

    if not session_id:
        raise HTTPException(status_code=401, detail="Session required")

    return await get_session(session_id)

# tests/auth/test_safari_cookie.py
import pytest
from httpx import AsyncClient

@pytest.mark.asyncio
async def test_login_with_cross_origin_redirect(client: AsyncClient):
    """Regression test for issue #123: Safari strips SameSite cookies
    on cross-origin OAuth redirect."""
    # Simulate a request without session cookie (as Safari would send)
    response = await client.get(
        "/protected/resource",
        headers={"Authorization": "Bearer valid-session-token"},
    )
    assert response.status_code == 200

@pytest.mark.asyncio
async def test_login_without_cookie_or_header(client: AsyncClient):
    """Verify that missing both cookie and header returns 401."""
    response = await client.get("/protected/resource")
    assert response.status_code == 401

@pytest.mark.asyncio
async def test_samesite_cookie_attribute(client: AsyncClient):
    """Verify cookie is set with SameSite=None; Secure."""
    response = await client.post("/auth/login", json={
        "email": "test@example.com",
        "password": "test-password",
    })
    cookie_header = response.headers.get("set-cookie", "")
    assert "SameSite=None" in cookie_header
    assert "Secure" in cookie_header

/ork:verify

Verification Results (targeted)
=====================================================

  Tests:     10/10   3 new + 22 existing passed, 0 failed
  Security:  10/10   SameSite=None with Secure flag validated
  Quality:    9/10   Clean diff, minimal blast radius

  Overall:   9.7/10

/ork:commit

Commit message:
  fix(auth): handle Safari SameSite cookie policy on cross-origin redirect

  Safari strips SameSite=Lax cookies during cross-origin OAuth redirects,
  causing intermittent login failures. Restore SameSite=None (with Secure)
  and add Authorization header fallback in session middleware.

  Closes #123

  Co-Authored-By: Claude <noreply@anthropic.com>

Proceed? [Y/n]

/ork:create-pr

Created PR #89: fix(auth): handle Safari SameSite cookie policy

  ## Summary
  - Restore SameSite=None on session cookie for cross-origin compat
  - Add Authorization header fallback in session middleware
  - 3 regression tests for the Safari-specific failure

  ## Root Cause
  Safari strips SameSite=Lax cookies on cross-origin OAuth redirects.
  See issue #123 for full investigation.

  ## Test Plan
  - [x] Regression test: cross-origin redirect without cookie
  - [x] Regression test: missing both cookie and header -> 401
  - [x] Regression test: SameSite=None; Secure attribute verified
  - [x] Security validation: SameSite=None is safe with Secure flag
  - [ ] Manual: test on mobile Safari via BrowserStack

  Closes #123

  https://github.com/your-org/your-repo/pull/89