From 9b5d0b1719d521237bc592670605d522ab60da67 Mon Sep 17 00:00:00 2001
From: CyberMind-FR <gandalf@Gk2.net>
Date: Sat, 11 Jul 2026 06:05:46 +0200
Subject: [PATCH] fix(auth): login failed on undefined _SESSIONS_FILE (dunder
 vs single-underscore mismatch)

Sessions file defined as __SESSIONS_FILE but referenced as _SESSIONS_FILE in
every handler -> NameError on session save/load, so valid logins failed and
/status 500d. Normalised all refs to _SESSIONS_FILE. Verified: login endpoint
returns proper JSON (401 on bad creds), sessions persist.
---
 packages/secubox-auth/api/main.py      | 8 ++++----
 packages/secubox-auth/debian/changelog | 9 +++++++++
 2 files changed, 13 insertions(+), 4 deletions(-)

diff --git a/packages/secubox-auth/api/main.py b/packages/secubox-auth/api/main.py
index 6b3e0ade..80cea8fc 100644
--- a/packages/secubox-auth/api/main.py
+++ b/packages/secubox-auth/api/main.py
@@ -110,7 +110,7 @@ try:
 except PermissionError:
     # Running as non-root in dev/test — caller is responsible for env-overriding to a writable path.
     pass
-__SESSIONS_FILE = Path(os.environ.get("SECUBOX_AUTH_SESSIONS", str(_DATA_DIR / "sessions.json")))
+_SESSIONS_FILE = Path(os.environ.get("SECUBOX_AUTH_SESSIONS", str(_DATA_DIR / "sessions.json")))
 _AUDIT_FILE    = Path(os.environ.get("SECUBOX_AUTH_AUDIT",    str(_DATA_DIR / "audit.log")))
 _TOTP_PENDING_FILE = Path(os.environ.get("SECUBOX_AUTH_TOTP_PENDING", str(_DATA_DIR / "totp-pending.json")))
 _USERS_FILE    = Path(os.environ.get("USERS_FILE", "/etc/secubox/users.json"))
@@ -120,16 +120,16 @@ _users_engine = _users_engine_mod.Engine(users_path=_USERS_FILE)
 
 
 def _read_sessions() -> list:
-    if not __SESSIONS_FILE.exists():
+    if not _SESSIONS_FILE.exists():
         return []
     try:
-        return json.loads(__SESSIONS_FILE.read_text())
+        return json.loads(_SESSIONS_FILE.read_text())
     except Exception:
         return []
 
 
 def _write_sessions(rows: list) -> None:
-    __SESSIONS_FILE.write_text(json.dumps(rows))
+    _SESSIONS_FILE.write_text(json.dumps(rows))
 
 
 def _append_audit(event: str, username: str, details: dict) -> None:
diff --git a/packages/secubox-auth/debian/changelog b/packages/secubox-auth/debian/changelog
index 14d1545e..ea98a47b 100644
--- a/packages/secubox-auth/debian/changelog
+++ b/packages/secubox-auth/debian/changelog
@@ -1,3 +1,12 @@
+secubox-auth (1.0.3-1~bookworm1) bookworm; urgency=medium
+
+  * fix: login failed and /status 500d with NameError: the sessions file was
+    defined as __SESSIONS_FILE (dunder) but every handler referenced
+    _SESSIONS_FILE (single underscore). Normalised to _SESSIONS_FILE so session
+    persistence + status work; logins succeed again.
+
+ -- Gerald KERMA <devel@cybermind.fr>  Fri, 11 Jul 2026 08:00:00 +0200
+
 secubox-auth (1.0.2-1~bookworm2) bookworm; urgency=medium
 
   * webui: hybrid-dark cyan reskin (WebUI Panel Guidelines) baked into the package.