From b69c59ff08b1a16474aaf7ca3ff14f315903108b Mon Sep 17 00:00:00 2001
From: Trezy <tre@trezy.com>
Date: Thu, 19 Mar 2026 12:24:19 -0500
Subject: [PATCH] fix: allow HappyView redirect cookie to be read appropriately

---
 src/auth/routes.rs | 7 +++----
 1 file changed, 3 insertions(+), 4 deletions(-)

diff --git a/src/auth/routes.rs b/src/auth/routes.rs
index 0df3788..045f661 100644
--- a/src/auth/routes.rs
+++ b/src/auth/routes.rs
@@ -47,14 +47,13 @@ async fn login(
         .map_err(|e| AppError::Internal(format!("OAuth authorize failed: {e}")))?;
 
     // Store the redirect URI in a cookie if provided
+    // Must use SameSite=None for cross-origin requests (e.g., Pentaract calling HappyView)
     let jar = if let Some(redirect_uri) = query.redirect_uri {
         let mut cookie = Cookie::new(REDIRECT_COOKIE_NAME, redirect_uri);
         cookie.set_path("/");
         cookie.set_http_only(true);
-        cookie.set_same_site(axum_extra::extract::cookie::SameSite::Lax);
-        if state.config.public_url.starts_with("https") {
-            cookie.set_secure(true);
-        }
+        cookie.set_same_site(axum_extra::extract::cookie::SameSite::None);
+        cookie.set_secure(true); // Required when SameSite=None
         jar.add(cookie)
     } else {
         jar
-- 
2.51.2