feat: enhance session management by adding secure cookie handling based on HTTPS detection

frontend/lib/session.ts

@@ -30,7 +30,7 @@ export function getSecretKey(): Uint8Array {
 }
 
 /** Creates and stores a session JWT in an httpOnly cookie. */
-export async function createSession(payload: SessionPayload): Promise<void> {
+export async function createSession(payload: SessionPayload, secure?: boolean): Promise<void> {
   const expiresAt = new Date(Date.now() + SESSION_DURATION_MS)
   const token = await new SignJWT({ ...payload })
     .setProtectedHeader({ alg: 'HS256' })
@@ -38,10 +38,14 @@ export async function createSession(payload: SessionPayload): Promise<void> {
     .setExpirationTime(expiresAt)
     .sign(getSecretKey())
 
+  // If the caller explicitly passes a value, honour it.
+  // Otherwise fall back to NODE_ENV (safe default for fully-HTTPS deploys).
+  const isSecure = secure !== undefined ? secure : process.env.NODE_ENV === 'production'
+
   const cookieStore = await cookies()
   cookieStore.set(SESSION_COOKIE, token, {
     httpOnly: true,
-    secure: process.env.NODE_ENV === 'production',
+    secure: isSecure,
     sameSite: 'lax',
     expires: expiresAt,
     path: '/',