use cookie-based implementation

agent_manager/__init__.py

@@ -146,7 +146,6 @@ STRUCTURED_CHAT = StructuredChatWrapper(CHAT)
 SESSION_AGENTS = {}
 
 def set_session_agent(session_key):
-	print(f"New session created: {session_key}")
 	memory = InMemorySaver()
 	agent = create_agent(
 		model=STRUCTURED_CHAT,
@@ -155,45 +154,31 @@ def set_session_agent(session_key):
 	)
 	SESSION_AGENTS[session_key] = agent
 
-def get_or_create_agent(session, chat_session):
-	"""Get the agent for this session or create a new one."""
-	session_key = session.session_key
-
-	if not session_key:
-		session.create()
-		session_key = session.session_key
-		set_session_agent(session_key)
-
-	cache_key = f"chat_session_{session_key}"
-	print(f"chat_session_{session_key}")
-	# Check if session key exists in cache
-	cached_chat_session = cache.get(cache_key)
-
-	if cached_chat_session is not None:
-		# Session key exists in cache
-		if cached_chat_session != chat_session:
-			# Chat session is different, update to new session agent
-			set_session_agent(session_key)
-			# Update cache with new chat_session
-			cache.set(cache_key, chat_session)
-		# If chat_session is the same, continue without changes
-	else:
-		# Session key doesn't exist, add it to cache
-		cache.set(cache_key, chat_session)
+def get_or_create_agent(chat_session):
+    """Get or create an agent keyed by the provided chat_session token."""
+    # Normalize to string to avoid type-mismatch keys
+    session_key = str(chat_session) if chat_session else None
+
+    if not session_key:
+        session_key = str(uuid.uuid4())
+
+    if session_key not in SESSION_AGENTS:
+        set_session_agent(session_key)
+        cache.set(f"chat_session_{session_key}", True)
 
-	print(SESSION_AGENTS)
-	return SESSION_AGENTS.get(session_key)
+    return SESSION_AGENTS.get(session_key), session_key
 
 
 def get_agent(session_id: str):
     """Return an existing agent for a session, or None if expired/closed."""
     return SESSION_AGENTS.get(session_id)
 
-def end_session(session):
+def end_session(chat_session):
     """Delete an agent session to free memory."""
-    session_key = session.session_key
-    if session_key in SESSION_AGENTS:
+    session_key = str(chat_session) if chat_session is not None else None
+    if session_key and session_key in SESSION_AGENTS:
         del SESSION_AGENTS[session_key]
+        cache.delete(f"chat_session_{session_key}")
         return True
     return False
 

api/views.py

@@ -4,6 +4,7 @@ from rest_framework.permissions import AllowAny
 from rest_framework.response import Response
 from rest_framework import status
 from agent_manager import get_or_create_agent, end_session, get_message_list
+from django.conf import settings
 
 @csrf_exempt
 @permission_classes([AllowAny])
@@ -16,7 +17,8 @@ def hello(request):
 @api_view(['POST'])
 def chat(request):
 	"""Start or continue an existing chat session."""
-	chat_session = request.data.get("chatSession")
+	# Prefer secure HttpOnly cookie for session tracking
+	cookie_session = request.COOKIES.get("gm_session")
 	message = request.data.get("message")
 
 	if not message:
@@ -25,15 +27,15 @@ def chat(request):
 			"response": "Invalid message."
 		}, status=status.HTTP_400_BAD_REQUEST)
 
-	agent = get_or_create_agent(request.session, chat_session)
+	# Use cookie if present; otherwise create a new session
+	agent, session_key = get_or_create_agent(cookie_session)
 
 	mode = request.data.get("mode")
 	tone = request.data.get("tone")
 	messages = get_message_list(mode, tone, message)
 
-	print("Message:", message, "Session Key:", request.session.session_key)
 	result = agent.invoke({ "messages": messages },
-		config={ "configurable": {"thread_id": request.session.session_key } }
+		config={ "configurable": {"thread_id": session_key } }
 	)
 
 	last_message = result.get('messages', [])[-1] if result.get('messages') else None
@@ -44,20 +46,37 @@ def chat(request):
 			"response": "Server Error"
 		}, status=status.HTTP_500_INTERNAL_SERVER_ERROR)
 
-	return Response({
+	resp = Response({
 		"status": "success",
 		"response": last_message.content
 	}, status=status.HTTP_200_OK)
 
+	# If cookie was missing, set it now with secure attributes
+	if not cookie_session:
+		secure = True if settings.MODE == 'production' else False
+		samesite = 'None' if settings.MODE == 'production' else 'Lax'
+		resp.set_cookie(
+			"gm_session",
+			value=session_key,
+			httponly=True,
+			secure=secure,
+			samesite=samesite,
+			max_age=60 * 60 * 24
+		)
+
+	return resp
+
 @csrf_exempt
 @permission_classes([AllowAny])
 @api_view(['POST'])
 def end(request):
     """End and delete the chat session."""
-    if end_session(request.session):
-        request.session.flush()
-        return Response({"status": "success", "message": "Session ended successfully"})
-
+    cookie_session = request.COOKIES.get("gm_session")
+    if end_session(cookie_session):
+        resp = Response({"status": "success", "message": "Session ended successfully"})
+        # Clear cookie
+        resp.delete_cookie("gm_session")
+        return resp
     return Response({
         "status": "error",
         "response": "No active session."

backend/settings.py

@@ -44,12 +44,12 @@ CORS_ALLOW_ALL_ORIGINS = False if MODE == 'production' else True
 
 
 SESSION_COOKIE_HTTPONLY = True
-SESSION_COOKIE_SECURE = False if MODE == 'production' else True # use False only for local dev (no HTTPS)
+SESSION_COOKIE_SECURE = True if MODE == 'production' else False # secure cookies only over HTTPS in production
 SESSION_EXPIRE_AT_BROWSER_CLOSE = True
 SESSION_COOKIE_AGE = 60 * 60 * 24  # 1 day
 
 CSRF_COOKIE_HTTPONLY = True
-CSRF_COOKIE_SECURE = False if MODE == 'production' else True
+CSRF_COOKIE_SECURE = True if MODE == 'production' else False
 CSRF_TRUSTED_ORIGINS = [
     origin.strip()
     for origin in os.environ.get("CSRF_TRUSTED_ORIGINS", "").split(",")
@@ -60,9 +60,9 @@ CSRF_TRUSTED_ORIGINS = [
 	'http://localhost:3000'
 	]
 
-SECURE_SSL_REDIRECT = False if MODE == 'production' else True
+SECURE_SSL_REDIRECT = True if MODE == 'production' else False
 
-SECURE_CONTENT_TYPE_NOSNIFF = False if MODE == 'production' else True
+SECURE_CONTENT_TYPE_NOSNIFF = True if MODE == 'production' else False
 
 # HSTS settings - only enable in production with proper HTTPS configuration
 # WARNING: Once enabled, browsers will remember this for SECURE_HSTS_SECONDS seconds