05/24 Fix bugs

app.py

@@ -21,7 +21,13 @@ def create_app():
     app = Flask(__name__)
 
     # ── Secret key for session management ─────────────────────────────────────
-    app.secret_key = os.environ.get("SECRET_KEY", os.urandom(32))
+    secret_key = os.environ.get("SECRET_KEY")
+    if not secret_key:
+        logger.warning(
+            "SECRET_KEY not set in environment. Sessions will break across "
+            "Gunicorn workers. Set SECRET_KEY in .env before deploying."
+        )
+    app.secret_key = secret_key or os.urandom(32)
 
     # ── Session timeout (30 minutes) ──────────────────────────────────────────
     from datetime import timedelta
@@ -60,6 +66,10 @@ def create_app():
     app.register_blueprint(ai_summary_bp)
     app.register_blueprint(bid_tracker_bp)
 
+    # ── CSRF protection (Flask-WTF) ────────────────────────────────────────────
+    from flask_wtf.csrf import CSRFProtect
+    CSRFProtect(app)
+
     # ── Template context processors ────────────────────────────────────────────
     from flask import session, redirect, url_for, g
     import functools
@@ -101,7 +111,4 @@ def create_app():
 # ─── Dev entry point ──────────────────────────────────────────────────────────
 if __name__ == "__main__":
     application = create_app()
-    application.run(debug=False, host="0.0.0.0", port=5000)
-
-# Gunicorn entry point
-application = create_app()
+    application.run(debug=False, host="0.0.0.0", port=5000)