Session (no env needed):
- SESSION_COOKIE_DOMAIN env removed. Config.SessionCookieParentDomain()
derives the cookie Domain from WEB_ORIGIN + PUBLIC_API_URL, which the
API already requires: sibling hosts of one parent (descrybe.io +
api.descrybe.io) share the parent domain so SvelteKit SSR (/admin
gate, user switching) receives the session cookie; localhost, IPs,
same-host, and unrelated hosts stay host-only. Deploying the new build
is the whole fix — nothing to configure.
AI generation prompt page:
- Each section now embeds its formula editor next to the per-language
prompt instructions: Title = full title formula builder (preview,
elements, separator, variable selector, custom variables), Description
= description formula sections editor (type + instructions + export
id, drag reorder), Meta = meta title / meta description formula
fields. One Save writes categories.prompt + title_template +
description_template together; Assign copies all three to the
selected categories.
- New $lib/categories/formula-variables.ts loads every usable field for
the builder: custom variables (/api/variables), company attributes
(/api/attributes — attribute_key, name, unit, example), and standard
fields (/api/standard-fields). Used by both the prompt page and the
title-formula page (which previously ignored attributes).
Verified locally: svelte-check clean for changed files, unit tests pass,
and the full save contract exercised over HTTP as the page does it
(login → load variables/attributes/standard-fields → PATCH prompt +
title-formula + description-formula → round-trip read), then the test
category restored via repair-category-prompts.
Co-Authored-By: Claude Fable 5 <noreply@anthropic.com>
Production splits web (descrybe.io) and API (api.descrybe.io). The session
cookie was host-only for api.descrybe.io, so the browser never sent it to
the web host. The /admin SvelteKit SSR gate (fetchMeStaff in
+layout.server.ts) forwards the incoming cookie header to /api/auth/me —
with no cookie to forward it always got 401 and bounced every successful
login back to /login?next=/admin (login POST 200, /me 200 from the
browser, /me 401 from the web server).
New SESSION_COOKIE_DOMAIN env (default empty = host-only, local dev
unchanged) sets the session cookie Domain attribute; set it to the parent
domain (descrybe.io) in production so both hosts receive the cookie.
Leading dot is normalized away. CSRF needs no change — it already seeds
cross-origin via the X-CSRF-Token response header.
Co-Authored-By: Claude Fable 5 <noreply@anthropic.com>
greeneclipseandClaude Fable 5