fix: simplify F95 cookie setup and constrain auth dialog layout

backend/tests/test_f95.py

@@ -214,6 +214,33 @@ def test_invalid_session_not_saved_or_echoed(cookie):
     assert "xf_user" not in error.value.detail
 
 
+@pytest.mark.parametrize(("values", "expected"), [
+    ({"xf_user": "123,remember"}, "xf_user=123%2Cremember"),
+    ({"xf_user": "123%2Cremember"}, "xf_user=123%2Cremember"),
+    ({"xf_session": "session-token"}, "xf_session=session-token"),
+    ({"xf_user": "remember", "xf_session": "session", "cf_clearance": "cf.signature=="},
+     "xf_user=remember; xf_session=session; cf_clearance=cf.signature=="),
+])
+def test_individual_cookie_values_preserve_encoded_and_decoded_devtools_values(values, expected):
+    user = SimpleNamespace(id=1, permissions=["games.upload"], f95_session=None)
+    db = SimpleNamespace(commit=AsyncMock())
+    asyncio.run(metadata.save_f95_session(metadata.F95SessionIn(**values), user, db))
+    assert open_session(1, user.f95_session) == (expected, "")
+
+
+@pytest.mark.parametrize("values", [
+    {"cf_clearance": "only-cloudflare"},
+    {"xf_user": "one; xf_session=two"},
+    {"xf_user": "one\nsecond-line"},
+])
+def test_individual_cookie_fields_reject_missing_login_and_multiple_values(values):
+    user = SimpleNamespace(id=1, permissions=["games.upload"], f95_session=None)
+    db = SimpleNamespace(commit=AsyncMock())
+    with pytest.raises(metadata.HTTPException):
+        asyncio.run(metadata.save_f95_session(metadata.F95SessionIn(**values), user, db))
+    assert user.f95_session is None
+
+
 @pytest.mark.parametrize("schema", [GameIn, GameUpdateIn])
 def test_cover_hash_cannot_be_a_path_or_arbitrary_blob(schema):
     for value in ("../cover.webp", "a" * 64 + ".html", "invalid"):