fix: fix same origin error

frontend/app/admin/login/page.tsx

@@ -20,6 +20,7 @@ export default function LoginPage() {
     try {
       const r = await fetch("/api/admin/login", {
         method: "POST",
+        credentials: "same-origin",
         headers: { "Content-Type": "application/json" },
         body: JSON.stringify({ passcode }),
       });

frontend/app/admin/page.tsx

@@ -16,14 +16,14 @@ export default function AdminPage() {
 
   useEffect(() => {
     (async () => {
-      const r = await fetch("/api/admin/me");
+      const r = await fetch("/api/admin/me", { credentials: "same-origin" });
       if (!r.ok) router.replace("/admin/login");
       else setChecking(false);
     })();
   }, [router]);
 
   async function logout() {
-    await fetch("/api/admin/logout", { method: "POST" });
+    await fetch("/api/admin/logout", { method: "POST", credentials: "same-origin" });
     router.replace("/admin/login");
   }
 

frontend/app/api/admin/login/route.ts

@@ -0,0 +1,34 @@
+import { type NextRequest, NextResponse } from "next/server";
+import { backendUrl } from "@/lib/backend-url";
+
+export const dynamic = "force-dynamic";
+export const runtime = "nodejs";
+
+export async function POST(request: NextRequest) {
+  let response: Response;
+  try {
+    response = await fetch(`${backendUrl()}/admin/login`, {
+      method: "POST",
+      body: await request.text(),
+      headers: {
+        "content-type": request.headers.get("content-type") ?? "application/json",
+      },
+    });
+  } catch {
+    return NextResponse.json(
+      { detail: "Could not reach the backend admin login service." },
+      { status: 502 }
+    );
+  }
+
+  const headers = new Headers();
+  headers.set("content-type", response.headers.get("content-type") ?? "application/json");
+  const cookie = response.headers.get("set-cookie");
+  if (cookie) headers.set("set-cookie", cookie);
+
+  return new NextResponse(await response.text(), {
+    status: response.status,
+    headers,
+  });
+}
+

frontend/app/api/admin/logout/route.ts

@@ -0,0 +1,33 @@
+import { type NextRequest, NextResponse } from "next/server";
+import { backendUrl } from "@/lib/backend-url";
+
+export const dynamic = "force-dynamic";
+export const runtime = "nodejs";
+
+export async function POST(request: NextRequest) {
+  let response: Response;
+  try {
+    response = await fetch(`${backendUrl()}/admin/logout`, {
+      method: "POST",
+      headers: {
+        cookie: request.headers.get("cookie") ?? "",
+      },
+    });
+  } catch {
+    return NextResponse.json(
+      { detail: "Could not reach the backend admin logout service." },
+      { status: 502 }
+    );
+  }
+
+  const headers = new Headers();
+  headers.set("content-type", response.headers.get("content-type") ?? "application/json");
+  const cookie = response.headers.get("set-cookie");
+  if (cookie) headers.set("set-cookie", cookie);
+
+  return new NextResponse(await response.text(), {
+    status: response.status,
+    headers,
+  });
+}
+

frontend/app/api/admin/me/route.ts

@@ -0,0 +1,31 @@
+import { type NextRequest, NextResponse } from "next/server";
+import { backendUrl } from "@/lib/backend-url";
+
+export const dynamic = "force-dynamic";
+export const runtime = "nodejs";
+
+export async function GET(request: NextRequest) {
+  let response: Response;
+  try {
+    response = await fetch(`${backendUrl()}/admin/me`, {
+      headers: {
+        cookie: request.headers.get("cookie") ?? "",
+      },
+      cache: "no-store",
+    });
+  } catch {
+    return NextResponse.json(
+      { detail: "Could not reach the backend admin session service." },
+      { status: 502 }
+    );
+  }
+
+  return new NextResponse(await response.text(), {
+    status: response.status,
+    headers: {
+      "content-type": response.headers.get("content-type") ?? "application/json",
+      "cache-control": "no-store",
+    },
+  });
+}
+