fix(api): support shared session cookie domain

apps/api/src/security/sessionCookies.ts

@@ -1,4 +1,4 @@
-import type { Response } from 'express'
+import type { CookieOptions, Response } from 'express'
 import type { ActorType } from './tokens'
 
 const COOKIE_NAMES: Record<ActorType, string> = {
@@ -11,21 +11,23 @@ export function getSessionCookieName(actorType: ActorType) {
   return COOKIE_NAMES[actorType]
 }
 
-export function setSessionCookie(res: Response, actorType: ActorType, token: string, maxAgeMs?: number) {
-  res.cookie(getSessionCookieName(actorType), token, {
+function getSessionCookieOptions(actorType: ActorType, maxAgeMs?: number): CookieOptions {
+  const domain = process.env.SESSION_COOKIE_DOMAIN?.trim()
+
+  return {
     httpOnly: true,
     secure: process.env.NODE_ENV === 'production',
     sameSite: actorType === 'admin' ? 'strict' : 'lax',
     path: '/',
-    maxAge: maxAgeMs,
-  })
+    ...(domain ? { domain } : {}),
+    ...(maxAgeMs !== undefined ? { maxAge: maxAgeMs } : {}),
+  }
+}
+
+export function setSessionCookie(res: Response, actorType: ActorType, token: string, maxAgeMs?: number) {
+  res.cookie(getSessionCookieName(actorType), token, getSessionCookieOptions(actorType, maxAgeMs))
 }
 
 export function clearSessionCookie(res: Response, actorType: ActorType) {
-  res.clearCookie(getSessionCookieName(actorType), {
-    httpOnly: true,
-    secure: process.env.NODE_ENV === 'production',
-    sameSite: actorType === 'admin' ? 'strict' : 'lax',
-    path: '/',
-  })
+  res.clearCookie(getSessionCookieName(actorType), getSessionCookieOptions(actorType))
 }