fix: decode production admin session cookie

src/proxy.ts

@@ -1,6 +1,6 @@
 import { type NextRequest, NextResponse } from "next/server";
 import { getToken } from "next-auth/jwt";
-import { shouldRedirectAdminRequest } from "@/lib/proxy-access";
+import { shouldRedirectAdminRequest, usesSecureAuthCookie } from "@/lib/proxy-access";
 
 // Edge proxy (formerly "middleware"): Prisma can't run here, so we only forward
 // the request path (so server components / the access guard can read it via
@@ -9,7 +9,9 @@ import { shouldRedirectAdminRequest } from "@/lib/proxy-access";
 export async function proxy(req: NextRequest) {
   if (req.nextUrl.pathname === "/admin" || req.nextUrl.pathname.startsWith("/admin/")) {
     const secret = process.env.AUTH_SECRET;
-    const token = secret ? await getToken({ req, secret }) : null;
+    const token = secret
+      ? await getToken({ req, secret, secureCookie: usesSecureAuthCookie(process.env.NODE_ENV) })
+      : null;
     if (shouldRedirectAdminRequest(req.nextUrl.pathname, token)) {
       return NextResponse.redirect(new URL("/login", req.url));
     }