fix anon challenges on mobile

It should just work now.

app/controllers/Challenge.scala

@@ -42,28 +42,12 @@ object Challenge extends LilaController {
         else if (isForMe(c)) Direction.In.some
         else none
       val json = env.jsonView.show(c, version, direction)
-      challengeAnonOwnerCookie(c) flatMap { cookieOption =>
-        negotiate(
-          html = fuccess {
-            Ok(mine.fold(html.challenge.mine.apply _, html.challenge.theirs.apply _)(c, json))
-          },
-          api = _ => Ok(json).fuccess
-        ) map { res =>
-            cookieOption.fold(res) { res.withCookies(_) }
-          }
-      }
-    }
-
-  private def challengeAnonOwnerCookie(c: ChallengeModel)(implicit ctx: Context): Fu[Option[Cookie]] =
-    (c.accepted && c.challengerIsAnon) ?? GameRepo.game(c.id).map {
-      _ map { game =>
-        implicit val req = ctx.req
-        LilaCookie.cookie(
-          AnonCookie.name,
-          game.player(c.finalColor).id,
-          maxAge = AnonCookie.maxAge.some,
-          httpOnly = false.some)
-      }
+      negotiate(
+        html = fuccess {
+          Ok(mine.fold(html.challenge.mine.apply _, html.challenge.theirs.apply _)(c, json))
+        },
+        api = _ => Ok(json).fuccess
+      ) flatMap withChallengeAnonCookie(mine && c.challengerIsAnon, c, true)
     }
 
   private def isMine(challenge: ChallengeModel)(implicit ctx: Context) = challenge.challenger match {
@@ -78,9 +62,9 @@ object Challenge extends LilaController {
     OptionFuResult(env.api byId id) { c =>
       isForMe(c) ?? env.api.accept(c, ctx.me).flatMap {
         case Some(pov) => negotiate(
-          html = Setup.redirectPov(pov).fuccess,
-          api = apiVersion =>
-            Env.api.roundApi.player(pov, apiVersion) map { Ok(_) })
+          html = Redirect(routes.Round.watcher(pov.game.id, "white")).fuccess,
+          api = apiVersion => Env.api.roundApi.player(pov, apiVersion) map { Ok(_) }
+        ) flatMap withChallengeAnonCookie(ctx.isAnon, c, false)
         case None => negotiate(
           html = Redirect(routes.Round.watcher(c.id, "white")).fuccess,
           api = _ => notFoundJson("Someone else accepted the challenge"))
@@ -88,6 +72,22 @@ object Challenge extends LilaController {
     }
   }
 
+  private def withChallengeAnonCookie(cond: Boolean, c: ChallengeModel, owner: Boolean)(res: Result)(implicit ctx: Context): Fu[Result] =
+    cond ?? {
+      GameRepo.game(c.id).map {
+        _ map { game =>
+          implicit val req = ctx.req
+          LilaCookie.cookie(
+            AnonCookie.name,
+            game.player(owner.fold(c.finalColor, !c.finalColor)).id,
+            maxAge = AnonCookie.maxAge.some,
+            httpOnly = true.some)
+        }
+      }
+    } map { cookieOption =>
+      cookieOption.fold(res) { res.withCookies(_) }
+    }
+
   def decline(id: String) = Auth { implicit ctx =>
     me =>
       OptionFuResult(env.api byId id) { c =>

app/controllers/Round.scala

@@ -146,13 +146,13 @@ object Round extends LilaController with TheftPrevention {
   }
 
   def watch(pov: Pov, userTv: Option[UserModel] = None)(implicit ctx: Context): Fu[Result] =
-    negotiate(
-      html =
-        if (getBool("sudo") && isGranted(_.SuperAdmin)) Redirect(routes.Round.player(pov.fullId)).fuccess
-        else if (pov.game.replayable) Analyse.replay(pov, userTv = userTv)
-        else playablePovForReq(pov.game) match {
-          case Some(player) if userTv.isEmpty => renderPlayer(pov withColor player.color)
-          case _ if HTTPRequest.isHuman(ctx.req) =>
+    playablePovForReq(pov.game) match {
+      case Some(player) if userTv.isEmpty => renderPlayer(pov withColor player.color)
+      case _ => negotiate(
+        html = {
+          if (getBool("sudo") && isGranted(_.SuperAdmin)) Redirect(routes.Round.player(pov.fullId)).fuccess
+          else if (pov.game.replayable) Analyse.replay(pov, userTv = userTv)
+          else if (HTTPRequest.isHuman(ctx.req))
             myTour(pov.game.tournamentId, false) zip
               (pov.game.simulId ?? Env.simul.repo.find) zip
               Env.game.crosstableApi(pov.game) zip
@@ -160,7 +160,7 @@ object Round extends LilaController with TheftPrevention {
                 case (((tour, simul), crosstable), data) =>
                   Ok(html.round.watcher(pov, data, tour, simul, crosstable, userTv = userTv))
               }
-          case _ => // web crawlers don't need the full thing
+          else // web crawlers don't need the full thing
             GameRepo.initialFen(pov.game.id) zip
               Env.game.crosstableApi(pov.game) map {
                 case (initialFen, crosstable) =>
@@ -168,8 +168,9 @@ object Round extends LilaController with TheftPrevention {
                   Ok(html.round.watcherBot(pov, initialFen, pgn, crosstable))
               }
         },
-      api = apiVersion => Env.api.roundApi.watcher(pov, apiVersion, tv = none) map { Ok(_) }
-    ) map NoCache
+        api = apiVersion => Env.api.roundApi.watcher(pov, apiVersion, tv = none) map { Ok(_) }
+      ) map NoCache
+    }
 
   private def myTour(tourId: Option[String], withStanding: Boolean)(implicit ctx: Context): Fu[Option[MiniStanding]] =
     tourId ?? { tid =>

app/controllers/Setup.scala

@@ -197,12 +197,12 @@ object Setup extends LilaController with TheftPrevention {
 
   private[controllers] def redirectPov(pov: Pov)(implicit ctx: Context) = {
     implicit val req = ctx.req
-    val redir = Redirect(routes.Round.player(pov.fullId))
+    val redir = Redirect(routes.Round.watcher(pov.game.id, "white"))
     if (ctx.isAuth) redir
     else redir withCookies LilaCookie.cookie(
       AnonCookie.name,
       pov.playerId,
       maxAge = AnonCookie.maxAge.some,
-      httpOnly = false.some)
+      httpOnly = true.some)
   }
 }

app/controllers/TheftPrevention.scala

@@ -20,8 +20,7 @@ private[controllers] trait TheftPrevention {
       case (Some(playerId), Some(userId)) =>
         playerId != userId && !(ctx.me ?? Granter.superAdmin)
       case (None, _) =>
-        lila.api.Mobile.Api.requestVersion(ctx.req).isEmpty &&
-          ctx.req.cookies.get(AnonCookie.name).map(_.value) != Some(pov.playerId)
+        !ctx.req.cookies.get(AnonCookie.name).map(_.value).contains(pov.playerId)
     }
   }
 

modules/challenge/src/main/Joiner.scala

@@ -6,7 +6,7 @@ import akka.pattern.ask
 import chess.format.Forsyth
 import chess.format.Forsyth.SituationPlus
 import chess.{ Situation, Mode }
-import lila.game.{ GameRepo, Game, Pov, Source, Player, AnonCookie, PerfPicker }
+import lila.game.{ GameRepo, Game, Pov, Source, Player, PerfPicker }
 import lila.user.{ User, UserRepo }
 
 private[challenge] final class Joiner(onStart: String => Unit) {