From faa8216716fba09e0010a63ee3a834cff33235d9 Mon Sep 17 00:00:00 2001
From: dimitar <taratur@gmail.com>
Date: Wed, 29 Jul 2026 19:56:16 +0200
Subject: [PATCH] fix: set cookie path to / so admin API routes receive the
 session

Cookie path was /admin, but admin API routes live under /api/admin/.
Browser only sends cookies to paths matching the cookie's path, so
all API calls were unauthenticated. Changed path to / for both
cookie creation (login) and deletion (logout).
---
 src/app/api/admin/logout/route.ts | 2 +-
 src/lib/admin-session.ts          | 2 +-
 2 files changed, 2 insertions(+), 2 deletions(-)

diff --git a/src/app/api/admin/logout/route.ts b/src/app/api/admin/logout/route.ts
index 15c0cb7..1509e95 100644
--- a/src/app/api/admin/logout/route.ts
+++ b/src/app/api/admin/logout/route.ts
@@ -8,7 +8,7 @@ export async function POST() {
     httpOnly: true,
     secure: process.env.NODE_ENV === "production",
     sameSite: "lax",
-    path: "/admin",
+    path: "/",
     maxAge: 0,
   });
   return res;
diff --git a/src/lib/admin-session.ts b/src/lib/admin-session.ts
index 0d2b7a9..fdc0f07 100644
--- a/src/lib/admin-session.ts
+++ b/src/lib/admin-session.ts
@@ -69,7 +69,7 @@ export function cookieOptions(value: string) {
     httpOnly: true,
     secure: process.env.NODE_ENV === "production",
     sameSite: "lax" as const,
-    path: "/admin",
+    path: "/",
   };
 }