Move __main__.py to paskia package, use samesite=strict for cookies.

paskia/fastapi/mainapp.py

@@ -12,7 +12,7 @@ from paskia import authcode, globals
 from paskia.db import start_background, stop_background
 from paskia.db.logging import configure_db_logging
 from paskia.fastapi import admin, api, auth_host, oid, ws
-from paskia.fastapi.__main__ import DEVMODE
+from paskia.__main__ import DEVMODE
 from paskia.fastapi.logging import AccessLogMiddleware, configure_access_logging
 from paskia.fastapi.session import AUTH_COOKIE
 from paskia.util import hostutil, passphrase, vitedev

paskia/fastapi/session.py

@@ -70,7 +70,7 @@ def set_session_cookie(response: Response, token: str) -> None:
         httponly=True,
         secure=True,
         path="/",
-        samesite="lax",
+        samesite="strict",
     )
 
 
@@ -84,5 +84,5 @@ def clear_session_cookie(response: Response) -> None:
         httponly=True,
         secure=True,
         path="/",
-        samesite="lax",
+        samesite="strict",
     )

pyproject.toml

@@ -86,7 +86,7 @@ dev = [
 ]
 
 [project.scripts]
-paskia = "paskia.fastapi.__main__:main"
+paskia = "paskia.__main__:main"
 
 [tool.hatch.build]
 artifacts = ["paskia/frontend-build"]