fix: add temporary /api/debug/session to diagnose auth cookies

Co-authored-by: Cursor <cursoragent@cursor.com>

src/app/api/debug/session/route.ts

@@ -0,0 +1,57 @@
+import { NextRequest, NextResponse } from 'next/server';
+import { createServerClient } from '@supabase/ssr';
+
+/** Temporary login diagnostics — remove after auth is stable. */
+export async function GET(req: NextRequest) {
+  const cookieSummary = req.cookies.getAll().map((c) => ({
+    name: c.name,
+    len: c.value.length,
+    prefix: c.value.slice(0, 24),
+  }));
+
+  const supabase = createServerClient(
+    process.env.NEXT_PUBLIC_SUPABASE_URL!,
+    process.env.NEXT_PUBLIC_SUPABASE_ANON_KEY!,
+    {
+      cookies: {
+        getAll() {
+          return req.cookies.getAll();
+        },
+        setAll() {},
+      },
+    }
+  );
+
+  const sessionRes = await supabase.auth.getSession();
+  let userRes: Awaited<ReturnType<typeof supabase.auth.getUser>> | null = null;
+  let userErr: string | null = null;
+  try {
+    userRes = await supabase.auth.getUser();
+  } catch (e: unknown) {
+    userErr = e instanceof Error ? e.message : String(e);
+  }
+
+  return NextResponse.json({
+    ts: new Date().toISOString(),
+    commitHint: 'getSession-middleware',
+    cookies: cookieSummary,
+    session: {
+      hasSession: Boolean(sessionRes.data.session),
+      email: sessionRes.data.session?.user?.email ?? null,
+      role:
+        sessionRes.data.session?.user?.app_metadata?.role ||
+        sessionRes.data.session?.user?.user_metadata?.role ||
+        null,
+      error: sessionRes.error?.message ?? null,
+    },
+    user: {
+      hasUser: Boolean(userRes?.data?.user),
+      email: userRes?.data?.user?.email ?? null,
+      role:
+        userRes?.data?.user?.app_metadata?.role ||
+        userRes?.data?.user?.user_metadata?.role ||
+        null,
+      error: userRes?.error?.message ?? userErr,
+    },
+  });
+}

src/middleware.ts

@@ -63,6 +63,7 @@ export async function middleware(req: NextRequest) {
   const isPublic =
     path === '/login' ||
     path === '/api/health' ||
+    path === '/api/debug/session' ||
     path.startsWith('/api/webhooks/') ||
     path.startsWith('/api/cron/') ||
     path === '/_4v_attr.js' ||