fix: decode production admin session cookie

src/lib/proxy-access.test.ts

@@ -1,5 +1,5 @@
 import { describe, expect, it } from "vitest";
-import { shouldRedirectAdminRequest } from "./proxy-access";
+import { shouldRedirectAdminRequest, usesSecureAuthCookie } from "./proxy-access";
 
 describe("shouldRedirectAdminRequest", () => {
   it("redirects anonymous admin requests before rendering", () => {
@@ -12,3 +12,10 @@ describe("shouldRedirectAdminRequest", () => {
     expect(shouldRedirectAdminRequest("/news", null)).toBe(false);
   });
 });
+
+describe("usesSecureAuthCookie", () => {
+  it("matches Auth.js production cookie naming", () => {
+    expect(usesSecureAuthCookie("production")).toBe(true);
+    expect(usesSecureAuthCookie("development")).toBe(false);
+  });
+});

src/lib/proxy-access.ts

@@ -2,6 +2,10 @@ export interface ProxyToken {
   rank?: unknown;
 }
 
+export function usesSecureAuthCookie(environment: string | undefined): boolean {
+  return environment === "production";
+}
+
 export function shouldRedirectAdminRequest(pathname: string, token: ProxyToken | null): boolean {
   if (pathname !== "/admin" && !pathname.startsWith("/admin/")) return false;
   return token === null;