fix: detect deployed Auth.js session cookie

src/lib/proxy-access.test.ts

@@ -1,5 +1,5 @@
 import { describe, expect, it } from "vitest";
-import { shouldRedirectAdminRequest, usesSecureAuthCookie } from "./proxy-access";
+import { authSessionCookieName, shouldRedirectAdminRequest } from "./proxy-access";
 
 describe("shouldRedirectAdminRequest", () => {
   it("redirects anonymous admin requests before rendering", () => {
@@ -13,9 +13,17 @@ describe("shouldRedirectAdminRequest", () => {
   });
 });
 
-describe("usesSecureAuthCookie", () => {
-  it("matches Auth.js production cookie naming", () => {
-    expect(usesSecureAuthCookie("production")).toBe(true);
-    expect(usesSecureAuthCookie("development")).toBe(false);
+describe("authSessionCookieName", () => {
+  it("detects secure and unprefixed Auth.js cookies from the request", () => {
+    expect(authSessionCookieName(["__Secure-authjs.session-token"])).toBe("__Secure-authjs.session-token");
+    expect(authSessionCookieName(["authjs.session-token"])).toBe("authjs.session-token");
+  });
+
+  it("detects a chunked production session cookie", () => {
+    expect(authSessionCookieName(["__Secure-authjs.session-token.0", "__Secure-authjs.session-token.1"])).toBe("__Secure-authjs.session-token");
+  });
+
+  it("returns null when no session cookie exists", () => {
+    expect(authSessionCookieName(["theme"])).toBeNull();
   });
 });