fix: fix cookie issue

frontend/app/admin/page.tsx

@@ -17,7 +17,8 @@ export default function AdminPage() {
   useEffect(() => {
     (async () => {
       const r = await fetch("/api/admin/me", { credentials: "same-origin" });
-      if (!r.ok) router.replace("/admin/login");
+      const session = r.ok ? await r.json().catch(() => null) : null;
+      if (!session?.authenticated) router.replace("/admin/login");
       else setChecking(false);
     })();
   }, [router]);

frontend/app/api/admin/login/route.ts

@@ -4,6 +4,16 @@ import { backendUrl } from "@/lib/backend-url";
 export const dynamic = "force-dynamic";
 export const runtime = "nodejs";
 
+const ADMIN_COOKIE = "admin_session";
+const SESSION_MAX_AGE = 60 * 60 * 12;
+
+function sessionValue(setCookie: string | null) {
+  const pair = setCookie?.split(";")[0] ?? "";
+  const [name, ...valueParts] = pair.split("=");
+  if (name !== ADMIN_COOKIE || valueParts.length === 0) return null;
+  return valueParts.join("=");
+}
+
 export async function POST(request: NextRequest) {
   let response: Response;
   try {
@@ -21,14 +31,24 @@ export async function POST(request: NextRequest) {
     );
   }
 
-  const headers = new Headers();
-  headers.set("content-type", response.headers.get("content-type") ?? "application/json");
-  const cookie = response.headers.get("set-cookie");
-  if (cookie) headers.set("set-cookie", cookie);
-
-  return new NextResponse(await response.text(), {
+  const body = response.ok ? JSON.stringify({ ok: true }) : await response.text();
+  const nextResponse = new NextResponse(body, {
     status: response.status,
-    headers,
+    headers: {
+      "content-type": response.headers.get("content-type") ?? "application/json",
+    },
   });
-}
 
+  const value = sessionValue(response.headers.get("set-cookie"));
+  if (response.ok && value) {
+    nextResponse.cookies.set(ADMIN_COOKIE, value, {
+      httpOnly: true,
+      sameSite: "lax",
+      secure: request.nextUrl.protocol === "https:",
+      maxAge: SESSION_MAX_AGE,
+      path: "/",
+    });
+  }
+
+  return nextResponse;
+}

frontend/app/api/admin/logout/route.ts

@@ -4,6 +4,8 @@ import { backendUrl } from "@/lib/backend-url";
 export const dynamic = "force-dynamic";
 export const runtime = "nodejs";
 
+const ADMIN_COOKIE = "admin_session";
+
 export async function POST(request: NextRequest) {
   let response: Response;
   try {
@@ -20,14 +22,19 @@ export async function POST(request: NextRequest) {
     );
   }
 
-  const headers = new Headers();
-  headers.set("content-type", response.headers.get("content-type") ?? "application/json");
-  const cookie = response.headers.get("set-cookie");
-  if (cookie) headers.set("set-cookie", cookie);
-
-  return new NextResponse(await response.text(), {
+  const nextResponse = new NextResponse(await response.text(), {
     status: response.status,
-    headers,
+    headers: {
+      "content-type": response.headers.get("content-type") ?? "application/json",
+    },
+  });
+  nextResponse.cookies.set(ADMIN_COOKIE, "", {
+    httpOnly: true,
+    sameSite: "lax",
+    secure: request.nextUrl.protocol === "https:",
+    maxAge: 0,
+    path: "/",
   });
-}
 
+  return nextResponse;
+}

frontend/app/api/admin/me/route.ts

@@ -20,6 +20,13 @@ export async function GET(request: NextRequest) {
     );
   }
 
+  if (response.status === 401 || response.status === 403) {
+    return NextResponse.json(
+      { authenticated: false },
+      { status: 200, headers: { "cache-control": "no-store" } }
+    );
+  }
+
   return new NextResponse(await response.text(), {
     status: response.status,
     headers: {
@@ -28,4 +35,3 @@ export async function GET(request: NextRequest) {
     },
   });
 }
-