Dasemu 359d4369e8 fix: session cookie secure flag was never true-to-request ...

cookie.secure was tied to NODE_ENV=production instead of whether the
request actually arrived over HTTPS, so in a production build the
admin login cookie was never stored at all when accessed over plain
HTTP (e.g. direct container access, or a proxy that doesn't terminate
TLS in front of the admin panel) — confirmed while deploying to
production, login returned 200 but no session persisted. "auto" uses
req.secure via the existing trust-proxy setting instead.

Co-Authored-By: Claude Sonnet 5 <noreply@anthropic.com>

2026-10-08 04:25:06 +02:00

..

src

fix: session cookie secure flag was never true-to-request

2026-10-08 04:25:06 +02:00

package.json

test: add vitest unit tests and Gitea Actions CI workflow

2026-10-08 03:13:04 +02:00

tsconfig.json

fix: exclude test files from the tsc build output

2026-10-08 03:14:09 +02:00