cookie handling

src/services/management/management-auth.ts

@@ -25,7 +25,11 @@ export function authenticateManager(email: string, password: string) {
 export async function createManagerSession() {
   const config = getManagerConfig();
   const value = `${config.adminEmail.trim().toLowerCase()}.${Date.now()}`;
-  (await cookies()).set(COOKIE_NAME, `${value}.${signature(value, config.authSecret)}`, {
+  const store = await cookies();
+  // Remove sessions issued by older builds with Path=/manager. Browsers can
+  // retain both cookies, and the stale one may be selected first on /manager.
+  store.set(COOKIE_NAME, "", { path: "/manager", maxAge: 0 });
+  store.set(COOKIE_NAME, `${value}.${signature(value, config.authSecret)}`, {
     httpOnly: true,
     sameSite: "strict",
     secure: isSecureDeployment(),
@@ -37,7 +41,9 @@ export async function createManagerSession() {
 }
 
 export async function clearManagerSession() {
-  (await cookies()).delete(COOKIE_NAME);
+  const store = await cookies();
+  store.delete(COOKIE_NAME);
+  store.set(COOKIE_NAME, "", { path: "/manager", maxAge: 0 });
 }
 
 export async function isManagerAuthenticated() {