From 3cef279d2ddfe2a8bc1d004d525054b3473bebab Mon Sep 17 00:00:00 2001
From: Stefan Lazic <s.lazic@edynamix.com>
Date: Sat, 5 Sep 2026 09:32:14 +0100
Subject: [PATCH] Revert "Redirect loop fix"

This reverts commit 8fddde6d4b0853d2ff97e73a16e002610ef701de.
---
 .../__tests__/management-auth.test.ts         | 53 -------------------
 src/services/management/management-auth.ts    |  7 +--
 2 files changed, 2 insertions(+), 58 deletions(-)
 delete mode 100644 src/services/management/__tests__/management-auth.test.ts

diff --git a/src/services/management/__tests__/management-auth.test.ts b/src/services/management/__tests__/management-auth.test.ts
deleted file mode 100644
index f5b5282..0000000
--- a/src/services/management/__tests__/management-auth.test.ts
+++ /dev/null
@@ -1,53 +0,0 @@
-import { afterEach, describe, expect, it, vi } from "vitest";
-
-const cookieSet = vi.hoisted(() => vi.fn());
-
-vi.mock("next/headers", () => ({
-  cookies: vi.fn(async () => ({ set: cookieSet })),
-}));
-
-import { createManagerSession } from "../management-auth";
-
-describe("Manager session cookie", () => {
-  const originalAppUrl = process.env.NEXT_PUBLIC_APP_URL;
-  const originalAdminEmail = process.env.MANAGER_ADMIN_EMAIL;
-  const originalAuthSecret = process.env.MANAGER_AUTH_SECRET;
-
-  afterEach(() => {
-    if (originalAppUrl === undefined) delete process.env.NEXT_PUBLIC_APP_URL;
-    else process.env.NEXT_PUBLIC_APP_URL = originalAppUrl;
-    if (originalAdminEmail === undefined) delete process.env.MANAGER_ADMIN_EMAIL;
-    else process.env.MANAGER_ADMIN_EMAIL = originalAdminEmail;
-    if (originalAuthSecret === undefined) delete process.env.MANAGER_AUTH_SECRET;
-    else process.env.MANAGER_AUTH_SECRET = originalAuthSecret;
-    cookieSet.mockReset();
-  });
-
-  it("does not mark the cookie Secure for an HTTP deployment", async () => {
-    process.env.NEXT_PUBLIC_APP_URL = "http://manager.example.com";
-    process.env.MANAGER_ADMIN_EMAIL = "admin@example.com";
-    process.env.MANAGER_AUTH_SECRET = "test-secret";
-
-    await createManagerSession();
-
-    expect(cookieSet).toHaveBeenCalledWith(
-      "nextchair_manager_session",
-      expect.any(String),
-      expect.objectContaining({ secure: false, path: "/" }),
-    );
-  });
-
-  it("marks the cookie Secure for an HTTPS deployment", async () => {
-    process.env.NEXT_PUBLIC_APP_URL = "https://manager.example.com";
-    process.env.MANAGER_ADMIN_EMAIL = "admin@example.com";
-    process.env.MANAGER_AUTH_SECRET = "test-secret";
-
-    await createManagerSession();
-
-    expect(cookieSet).toHaveBeenCalledWith(
-      "nextchair_manager_session",
-      expect.any(String),
-      expect.objectContaining({ secure: true, path: "/" }),
-    );
-  });
-});
diff --git a/src/services/management/management-auth.ts b/src/services/management/management-auth.ts
index c3960e7..fada80a 100644
--- a/src/services/management/management-auth.ts
+++ b/src/services/management/management-auth.ts
@@ -1,6 +1,5 @@
 import { createHmac, timingSafeEqual } from "node:crypto";
 import { cookies } from "next/headers";
-import { isSecureDeployment } from "@/lib/security/cookie-security";
 import { getManagerConfig } from "./manager-config";
 
 const COOKIE_NAME = "nextchair_manager_session";
@@ -28,10 +27,8 @@ export async function createManagerSession() {
   (await cookies()).set(COOKIE_NAME, `${value}.${signature(value, config.authSecret)}`, {
     httpOnly: true,
     sameSite: "strict",
-    secure: isSecureDeployment(),
-    // The Manager UI is under /manager, but its authenticated API is under
-    // /api/manager, so the cookie must cover both paths.
-    path: "/",
+    secure: process.env.NODE_ENV === "production",
+    path: "/manager",
     maxAge: 60 * 60 * 8,
   });
 }