From edec2d72d4a64c948f53d6eba6f911815354a168 Mon Sep 17 00:00:00 2001
From: Hermes <hermes@buzzbee.dev>
Date: Sat, 1 Aug 2026 03:57:53 +0000
Subject: [PATCH] =?UTF-8?q?T11/Bug=20#1:=20fix=20login=20persistence=20?=
 =?UTF-8?q?=E2=80=94=20setCookie=20on=20/api/auth/credentials?=
MIME-Version: 1.0
Content-Type: text/plain; charset=UTF-8
Content-Transfer-Encoding: 8bit

Server now sets the session cookie on successful login. SPA at same
origin includes the cookie on every subsequent request, so the auth
middleware can verify and the user is no longer bounced back to /login.

Parent: t_e1cbd87d (T10 test report)
---
 apps/api/src/routes/auth.ts | 16 ++++++++++++++++
 1 file changed, 16 insertions(+)

diff --git a/apps/api/src/routes/auth.ts b/apps/api/src/routes/auth.ts
index 6f827b3..5cf3b09 100644
--- a/apps/api/src/routes/auth.ts
+++ b/apps/api/src/routes/auth.ts
@@ -1,4 +1,5 @@
 import { Hono } from "hono";
+import { setCookie } from "hono/cookie";
 import bcrypt from "bcryptjs";
 import { db, users } from "@project-e/db";
 import { count, eq } from "drizzle-orm";
@@ -36,6 +37,13 @@ authRoutes.post("/credentials", async (c) => {
     }
 
     const token = await createToken({ id: user.id, email: user.email, name: user.name });
+    setCookie(c, "session", token, {
+      httpOnly: true,
+      secure: false,
+      sameSite: "Lax",
+      path: "/",
+      maxAge: 30 * 24 * 60 * 60,
+    });
     return c.json({
       user: { id: user.id, email: user.email, name: user.name },
       token,
@@ -122,6 +130,14 @@ authRoutes.post("/passkey/authenticate", async (c) => {
     if (!user) {
       return c.json({ error: { code: "UNAUTHORIZED", message: "Passkey not found" } }, 401);
     }
+    const token = await createToken({ id: user.id, email: user.email, name: user.name });
+    setCookie(c, "session", token, {
+      httpOnly: true,
+      secure: false,
+      sameSite: "Lax",
+      path: "/",
+      maxAge: 30 * 24 * 60 * 60,
+    });
 
     return c.json({
       user: {