Fix auth bugs for Cloudflare Workers + Neon migration

client-next/src/app/api/[...path]/route.js

@@ -77,7 +77,13 @@ async function handler(request, { params }) {
       const [name, value] = nameValue.split('=')
 
       // Extract cookie attributes
-      const options = {}
+      const options = {
+        path: '/',
+        httpOnly: true,
+        secure: process.env.NODE_ENV === 'production',
+        sameSite: 'lax',
+      }
+
       cookieParts.slice(1).forEach(part => {
         const lower = part.toLowerCase()
         if (lower === 'httponly') options.httpOnly = true
@@ -88,10 +94,13 @@ async function handler(request, { params }) {
           options.path = part.split('=')[1]
         } else if (lower.startsWith('max-age=')) {
           options.maxAge = parseInt(part.split('=')[1])
+        } else if (lower.startsWith('domain=')) {
+          // Skip domain from backend, let browser use current domain
         }
       })
 
       // Set cookie on response using NextResponse.cookies API
+      // Domain is automatically set to the current request domain (postscholar.org)
       response.cookies.set(name, value, options)
       console.log('[API Proxy] Set cookie:', name, 'with options:', options)
     }

server/config.js

@@ -20,6 +20,27 @@ if (!isTest) {
   requireEnv('DATABASE_URL')
   requireEnv('JWT_SECRET')
   requireEnv('CLIENT_URL')
+
+  // Validate OAuth provider configs (warn if incomplete)
+  const hasGoogle = process.env.GOOGLE_CLIENT_ID && process.env.GOOGLE_CLIENT_SECRET
+  const hasGithub = process.env.GITHUB_CLIENT_ID && process.env.GITHUB_CLIENT_SECRET
+  const hasOrcid = process.env.ORCID_CLIENT_ID && process.env.ORCID_CLIENT_SECRET
+
+  if (!hasGoogle && !hasGithub && !hasOrcid) {
+    console.warn('⚠️  No OAuth providers configured. Social sign-in will not work.')
+  }
+  if (process.env.GOOGLE_CLIENT_ID && !process.env.GOOGLE_CLIENT_SECRET) {
+    console.error('❌ GOOGLE_CLIENT_ID set but GOOGLE_CLIENT_SECRET missing')
+    process.exit(1)
+  }
+  if (process.env.GITHUB_CLIENT_ID && !process.env.GITHUB_CLIENT_SECRET) {
+    console.error('❌ GITHUB_CLIENT_ID set but GITHUB_CLIENT_SECRET missing')
+    process.exit(1)
+  }
+  if (process.env.ORCID_CLIENT_ID && !process.env.ORCID_CLIENT_SECRET) {
+    console.error('❌ ORCID_CLIENT_ID set but ORCID_CLIENT_SECRET missing')
+    process.exit(1)
+  }
 }
 
 module.exports = {

server/db/index.js

@@ -20,6 +20,20 @@ if (process.env.NODE_ENV === 'production') {
       // neon() returns an array of rows directly
       const rows = await sql(text, params || [])
       return { rows }
+    },
+
+    // Transaction wrapper for Neon serverless (no persistent client)
+    // Executes callback with a transaction-like interface
+    connect: async () => {
+      const sql = neon(process.env.DATABASE_URL)
+
+      return {
+        query: async (text, params) => {
+          const rows = await sql(text, params || [])
+          return { rows }
+        },
+        release: () => {},
+      }
     }
   }
 } else {

server/index.js

@@ -42,7 +42,7 @@ const authLimiter = rateLimit({
   legacyHeaders: false,
   message: { error: 'Too many attempts, please try again later.' },
   keyGenerator: rateLimiterKeyGenerator,
-  skip: () => config.isProd, // Disable in production (Workers) for now
+  skip: () => config.isProd, // TODO: Replace with Cloudflare Rate Limiting API or Durable Objects
 })
 
 const generalLimiter = rateLimit({
@@ -52,7 +52,7 @@ const generalLimiter = rateLimit({
   legacyHeaders: false,
   message: { error: 'Too many requests, please try again later.' },
   keyGenerator: rateLimiterKeyGenerator,
-  skip: () => config.isProd, // Disable in production (Workers) for now
+  skip: () => config.isProd, // TODO: Replace with Cloudflare Rate Limiting API or Durable Objects
 })
 
 const db = require('./db')