Function setSessionCookie

server/src/middleware/auth.ts:552–560

* Helper to set the session cookie with consistent options

(res: Response, sealedSession: string)

 * Helper to set the session cookie with consistent options
 */
function setSessionCookie(res: Response, sealedSession: string) {
  res.cookie('wos-session', sealedSession, {
    httpOnly: true,
    secure: process.env.NODE_ENV === 'production' && !ALLOW_INSECURE_COOKIES,
    sameSite: 'lax',
    path: '/',
    maxAge: 7 * 24 * 60 * 60 * 1000, // 7 days
  });
}

// Static admin API key for internal tooling (bypasses WorkOS)
const ADMIN_API_KEY = process.env.ADMIN_API_KEY;