Restore retry logic and SameSite=none cookies to fix redirect loops

app/(auth)/auth.config.ts

@@ -10,4 +10,32 @@ export const authConfig = {
     // while this file is also used in non-Node.js environments
   ],
   callbacks: {},
+  cookies: {
+    sessionToken: {
+      name: `next-auth.session-token`,
+      options: {
+        httpOnly: true,
+        sameSite: 'none',
+        path: '/',
+        secure: true,
+      },
+    },
+    callbackUrl: {
+      name: `next-auth.callback-url`,
+      options: {
+        sameSite: 'none',
+        path: '/',
+        secure: true,
+      },
+    },
+    csrfToken: {
+      name: `next-auth.csrf-token`,
+      options: {
+        httpOnly: true,
+        sameSite: 'none',
+        path: '/',
+        secure: true,
+      },
+    },
+  },
 } satisfies NextAuthConfig;

middleware.ts

@@ -25,10 +25,21 @@ export async function middleware(request: NextRequest) {
 
   if (!token) {
     const redirectUrl = encodeURIComponent(request.url);
+    
+    // Prevent redirect loops - after 3 attempts, just let the user through
+    const retryCount = request.cookies.get('auth-retry')?.value || '0';
+    if (parseInt(retryCount) > 2) {
+      // Clear retry count and continue without auth
+      const response = NextResponse.next();
+      response.cookies.delete('auth-retry');
+      return response;
+    }
 
-    return NextResponse.redirect(
+    const response = NextResponse.redirect(
       new URL(`/api/auth/guest?redirectUrl=${redirectUrl}`, request.url),
     );
+    response.cookies.set('auth-retry', String(parseInt(retryCount) + 1));
+    return response;
   }
 
   const isGuest = guestRegex.test(token?.email ?? '');