fix: more robust cookie session

src/app.js

@@ -8,6 +8,10 @@ const apiRouter = require('./routes');
 function createApp() {
   const app = express();
 
+  // Behind Traefik: without this, req.protocol/req.secure ignore
+  // X-Forwarded-Proto and always report the plain-HTTP hop to the container.
+  app.set('trust proxy', 1);
+
   app.get('/health', (req, res) => res.status(200).json({ status: 'ok' }));
 
   app.use(express.json());

src/auth/routes.js

@@ -83,7 +83,13 @@ router.get(
       code_challenge_method: 'S256',
     });
 
-    res.redirect(authUrl.href);
+    // Force the session write to complete (and surface any store error)
+    // before sending the redirect, instead of relying on express-session's
+    // implicit save-on-response-end behavior.
+    req.session.save((err) => {
+      if (err) throw err;
+      res.redirect(authUrl.href);
+    });
   })
 );
 
@@ -97,6 +103,12 @@ router.get(
     const oidcConfig = getOidcConfig();
     const pending = req.session.oidc;
     if (!pending) {
+      console.warn(
+        '[auth] /auth/callback reached with no pending OIDC state.',
+        'sessionID:', req.sessionID,
+        'cookie header present:', Boolean(req.headers.cookie),
+        'session keys:', Object.keys(req.session || {}),
+      );
       return res.status(400).send('Session de connexion expirée, réessayez.');
     }