From ed632f686d494c33865ceb1a527fa3ca61c5eb3c Mon Sep 17 00:00:00 2001
From: vegard <vnotnes@pm.me>
Date: Thu, 19 Mar 2026 03:35:10 +0000
Subject: [PATCH] Cookie-domene .synops.no for subdomain-deling +
 workspace.synops.no
MIME-Version: 1.0
Content-Type: text/plain; charset=UTF-8
Content-Transfer-Encoding: 8bit

Auth-cookies settes på .synops.no slik at de deles mellom
synops.no, workspace.synops.no, og fremtidige subdomener.
Caddy proxyer workspace.synops.no til SvelteKit.

Co-Authored-By: Claude Opus 4.6 (1M context) <noreply@anthropic.com>
---
 frontend/src/auth.ts | 14 ++++++++++++++
 1 file changed, 14 insertions(+)

diff --git a/frontend/src/auth.ts b/frontend/src/auth.ts
index 5400bc1..ce0016e 100644
--- a/frontend/src/auth.ts
+++ b/frontend/src/auth.ts
@@ -56,6 +56,20 @@ async function syncUsername(accessToken: string, username: string): Promise<void
 
 export const { handle, signIn, signOut } = SvelteKitAuth({
 	trustHost: true,
+	cookies: {
+		sessionToken: {
+			name: '__Secure-authjs.session-token',
+			options: { domain: '.synops.no', path: '/', sameSite: 'lax', secure: true, httpOnly: true },
+		},
+		callbackUrl: {
+			name: '__Secure-authjs.callback-url',
+			options: { domain: '.synops.no', path: '/', sameSite: 'lax', secure: true, httpOnly: true },
+		},
+		csrfToken: {
+			name: '__Host-authjs.csrf-token',
+			options: { path: '/', sameSite: 'lax', secure: true, httpOnly: true },
+		},
+	},
 	providers: [
 		{
 			id: 'authentik',