fix: session cookie over plain http, console onboarding gate, webkit qa coverage

Browse Source

- the session cookie was Secure whenever NODE_ENV=production, so a production build on http://localhost got no cookie back in Safari: every page after signup looked signed-out. It is now Secure only when X-Forwarded-Proto says https, or when COOKIE_SECURE=1.
- /app and /app/[id] now require an analyst and a Jev key, the same rule /api/analyze enforces with a 412. Closing the guide mid-way used to leave a console that could not run anything.
- Playwright runs the production server (pree2e builds first) and gains a webkit project for session survival; chromium-only QA could never see a Secure-cookie rejection.
- tests-e2e/session.spec.ts pins both; .env.example gains COOKIE_SECURE and stops shipping a blank APP_SECRET.
- e2e: 21 passed (setup, chromium, webkit, mobile).

Co-Authored-By: Claude Opus 4.7 <noreply@anthropic.com>

...

This commit is contained in:

ahmed mohammed

2026-09-22 10:45:12 +03:00

co-authored by Claude Opus 4.7

parent 5160a00db5

commit 2ebfcfb7a6

13 changed files with 124 additions and 12 deletions

Show all changes Ignore whitespace when comparing lines Ignore changes in amount of whitespace Ignore changes in whitespace at EOL

Download Patch File Download Diff File Expand all files Collapse all files

.qa-data/qai.db

BIN

Binary file not shown.

.qa-data/qai.db-shm

BIN

Binary file not shown.

.qa-data/qai.db-wal

BIN

Binary file not shown.