Merge branch 'main' of https://git.coastit.co.za/caitlin/CRM_ENVR

src/app/api/auth/login/route.ts

@@ -10,6 +10,7 @@ import {
   isAccountLocked,
   createSession,
   setSessionContext,
+  SESSION_COOKIE,
 } from "@/lib/auth"
 
 export async function POST(request: NextRequest) {
@@ -106,12 +107,19 @@ export async function POST(request: NextRequest) {
       true
     )
 
-    await createSession(dbUser.id, dbUser.role_name)
+    const token = await createSession(dbUser.id, dbUser.role_name)
     await setSessionContext(dbUser.id, ipAddress)
 
     const user = mapDbUserToSessionUser(dbUser)
 
-    return NextResponse.json({ user }, { status: 200 })
+    const response = NextResponse.json({ user }, { status: 200 })
+    response.cookies.set(SESSION_COOKIE, token, {
+      httpOnly: true,
+      secure: process.env.NODE_ENV === "production",
+      sameSite: "strict",
+      path: "/",
+    })
+    return response
   } catch (error) {
     console.error("Login error:", error)
     return NextResponse.json(

src/app/api/auth/logout/route.ts

@@ -1,10 +1,17 @@
 import { NextResponse } from "next/server"
-import { destroySession } from "@/lib/auth"
+import { SESSION_COOKIE } from "@/lib/auth"
 
 export async function POST() {
   try {
-    await destroySession()
-    return NextResponse.json({ success: true }, { status: 200 })
+    const response = NextResponse.json({ success: true }, { status: 200 })
+    response.cookies.set(SESSION_COOKIE, "", {
+      httpOnly: true,
+      secure: process.env.NODE_ENV === "production",
+      sameSite: "strict",
+      path: "/",
+      maxAge: 0,
+    })
+    return response
   } catch (error) {
     console.error("Logout error:", error)
     return NextResponse.json(