Updated core interest management endpoints:
- server/api/create-interest.ts
- server/api/update-interest.ts
- server/api/delete-interest.ts
- Created server/utils/auth.ts with dual auth support
Next: Update ALL remaining API endpoints systematically
## **Session Management Improvements:**
### **OIDC Configuration (nuxt.config.ts):**
- Added proper session configuration with automatic refresh
- Configured secure cookies for HTTPS production environment
- Added OAuth scopes: ['openid', 'profile', 'email']
- Set proper response type and grant type for Keycloak
- Added session expiration checking and automatic refresh
### **Session Cookie Settings:**
- sameSite: 'lax' - Required for cross-domain OAuth redirects
- secure: true - Required for HTTPS in production
- expirationThreshold: 60 - Refresh tokens 60 seconds before expiry
### **Debug Tools:**
- Added /api/debug/oidc-session endpoint to monitor session state
- Tracks cookie presence and session establishment
- Safe debugging without exposing sensitive tokens
## **Problem Being Solved:**
User authentication succeeds with Keycloak but session expires immediately,
causing redirect back to login page instead of dashboard access.
## **Root Cause Analysis:**
- Sessions were not being established properly after OAuth callback
- Cookie configuration was not optimized for HTTPS/production
- Missing proper OAuth scopes and session refresh configuration
## **Expected Results:**
Successful Keycloak authentication should now persist session
Users should be redirected to dashboard after login
Sessions should automatically refresh before expiry
No more immediate redirects back to login page
## **Next Steps:**
1. Rebuild container in Portainer with these session fixes
2. Test authentication flow end-to-end
3. Use debug endpoint to verify session establishment
4. Monitor container logs for OIDC session activity
Matt