Function signInSession

e2e/targets/selfhost.ts:26–46

(
  baseUrl: string,
  credentials: { readonly email: string; readonly password: string },
)

// `origin` header is required — Better Auth rejects state-changing requests
// without it.
export const signInSession = async (
  baseUrl: string,
  credentials: { readonly email: string; readonly password: string },
): Promise<{
  readonly cookieHeader: string;
  readonly cookies: ReadonlyArray<{ readonly name: string; readonly value: string }>;
}> => {
  const response = await fetch(new URL("/api/auth/sign-in/email", baseUrl), {
    method: "POST",
    headers: { "content-type": "application/json", origin: new URL(baseUrl).origin },
    body: JSON.stringify(credentials),
    redirect: "manual",
  });
  const pairs = (response.headers.getSetCookie?.() ?? []).map((c) => c.split(";")[0]!.trim());
  if (pairs.length === 0) throw new Error(`selfhost: sign-in set no cookie (${response.status})`);
  const cookies = pairs.map((pair) => {
    const eq = pair.indexOf("=");
    return { name: pair.slice(0, eq), value: pair.slice(eq + 1) };
  });
  return { cookieHeader: pairs.join("; "), cookies };
};

// Headless MCP OAuth consent. The self-host serving layer forces
// `prompt=consent` on every MCP authorize (src/auth/force-mcp-consent), so an