Use session.get("language", "en") for safer language access

[DogukanUrker]

Problem

Throughout the application, session["language"] is accessed directly in many places. If the session is malformed or the language key is missing (e.g., after a session corruption, migration, or edge case), this raises a KeyError that results in a 500 Internal Server Error.

Affected files (partial list):

• app/utils/delete.py — flash_message calls
• app/routes/login.py — flash_message calls
• app/routes/signup.py — flash_message calls
• app/routes/dashboard.py — flash_message calls
• app/routes/set_language.py — flash_message calls
• app/routes/change_username.py — flash_message calls
• app/routes/change_profile_picture.py — flash_message calls
• app/routes/verify_user.py — flash_message calls
• And more...

Requirements

Replace all instances of session["language"] with session.get("language", "en") to gracefully fall back to English when the session language is missing.

This is a low-risk defensive coding improvement that prevents 500 errors in edge cases.

[DogukanUrker]

🤖 AI-generated implementation plan — local LLM (ornith-35b) via Hermes Agent.
Not human-reviewed. Do NOT merge or act on this without human approval.

Problem

Direct dictionary access session["language"] raises KeyError when the session is malformed, corrupted, or the language key is missing — causing 500 Internal Server Error responses. This affects 39 call sites across 14 files in the application.

Current state in main

• 14 files contain session["language"] (39 total occurrences)
• 7 files already use the safe pattern session.get("language", "en")
• app/utils/route_guards.py:34 — already uses session.get("language", "en") ✅
• app/utils/context_processor/translations.py:19 — already uses session.get("language", "en") ✅
• app/routes/logout.py:25 — already uses session.get("language", "en") ✅
• app/routes/change_password.py:81 — already uses session.get("language", "en") ✅
• app/utils/before_request/browser_language.py — sets the session key (not a read concern)

Files still using unsafe access (39 occurrences):

File	Occurrences
app/routes/password_reset.py	8
app/routes/signup.py	6
app/routes/login.py	3
app/routes/edit_post.py	3
app/routes/change_password.py	4
app/routes/change_username.py	2
app/routes/change_profile_picture.py	1
app/routes/create_post.py	2
app/routes/post.py	1
app/routes/set_language.py	1
app/routes/verify_user.py	2
app/utils/delete.py	3
app/utils/before_request/browser_language.py	4 (write-only, not a concern)

Root cause

The application uses session["language"] (bracket notation) in 39 places where session.get("language", "en") would be safer. When a session is corrupted, migrated, or the key is somehow absent, the bracket access raises KeyError → 500 error. The context processor and route guards have already been updated to use .get(), but many route handlers were not.

Proposed fix

Replace all 39 instances of session["language"] (read access only) with session.get("language", "en") across the 12 affected files.

Note: app/utils/before_request/browser_language.py lines 21, 24, 29, 32 are write operations (session["language"] = ...) and should NOT be changed — they are setting the key, not reading it.

Files to change:

1. app/routes/password_reset.py — 8 occurrences (lines 65, 74, 87, 95, 102, 166, 175)
2. app/routes/signup.py — 6 occurrences (lines 95, 160, 169, 178, 187, 197)
3. app/routes/login.py — 3 occurrences (lines 67, 79, 93)
4. app/routes/edit_post.py — 3 occurrences (lines 67, 91, 108)
5. app/routes/change_password.py — 4 occurrences (lines 52, 62, 70, 96)
6. app/routes/change_username.py — 2 occurrences (lines 76, 86)
7. app/routes/change_profile_picture.py — 1 occurrence (line 59)
8. app/routes/create_post.py — 2 occurrences (lines 52, 90)
9. app/routes/post.py — 1 occurrence (line 83)
10. app/routes/set_language.py — 1 occurrence (line 27)
11. app/routes/verify_user.py — 2 occurrences (lines 67, 75)
12. app/utils/delete.py — 3 occurrences (lines 58, 92, 137)

Do NOT change: app/utils/before_request/browser_language.py (write-only assignments).

Files to change

• app/routes/password_reset.py — replace session["language"] → session.get("language", "en") (8 changes)
• app/routes/signup.py — replace session["language"] → session.get("language", "en") (6 changes)
• app/routes/login.py — replace session["language"] → session.get("language", "en") (3 changes)
• app/routes/edit_post.py — replace session["language"] → session.get("language", "en") (3 changes)
• app/routes/change_password.py — replace session["language"] → session.get("language", "en") (4 changes)
• app/routes/change_username.py — replace session["language"] → session.get("language", "en") (2 changes)
• app/routes/change_profile_picture.py — replace session["language"] → session.get("language", "en") (1 change)
• app/routes/create_post.py — replace session["language"] → session.get("language", "en") (2 changes)
• app/routes/post.py — replace session["language"] → session.get("language", "en") (1 change)
• app/routes/set_language.py — replace session["language"] → session.get("language", "en") (1 change)
• app/routes/verify_user.py — replace session["language"] → session.get("language", "en") (2 changes)
• app/utils/delete.py — replace session["language"] → session.get("language", "en") (3 changes)

Test plan

1. Run existing test suite: make test — all tests should pass
2. Run lint: make lint — no new lint errors
3. Manual verification: verify grep -rn 'session\["language"\]' app/ returns 0 matches (excluding browser_language.py write operations)
4. Consider adding a test in tests/e2e/ that:
   • Creates a session without a language key
   • Triggers a flash_message call path
   • Asserts no 500 error occurs

Risks & edge cases

• Low risk — this is a pure defensive improvement. session.get("language", "en") returns the same value as session["language"] when the key exists, and falls back to "en" when it doesn't.
• No auth/security implications — the language value is only used for translation lookup, not authorization.
• browser_language.py writes — intentionally left unchanged since they are assignments, not reads.
• set_language.py:21 — session["language"] = language is a write, leave as-is.

Out of scope

• Adding new features or changing translation logic
• Modifying browser_language.py write operations
• Database migrations or session store changes
• Adding new tests (mentioned in test plan as optional enhancement)