push

web-server/server.js

@@ -18,6 +18,7 @@ const agentPackageDir = path.resolve(process.env.AGENT_PACKAGE_DIR || path.join(
 const authCookieName = 'robot_installer_session';
 const sessionMaxAgeMs = Number(process.env.SESSION_MAX_AGE_MS || 1000 * 60 * 60 * 8);
 const authSecret = process.env.AUTH_SECRET || process.env.SESSION_SECRET || 'robot-installer-dev-secret';
+const secureSessionCookie = getBooleanEnv(process.env.SESSION_COOKIE_SECURE, process.env.NODE_ENV === 'production');
 const publicApiCorsOrigins = getCsvEnv(process.env.WEB_CLIENT_ORIGINS || process.env.PUBLIC_API_CORS_ORIGINS, [
   'https://robot.installer',
   'http://localhost:5173',
@@ -28,6 +29,10 @@ const agentVersionCollator = new Intl.Collator('en', {
   sensitivity: 'base'
 });
 
+app.get('/healthz', (req, res) => {
+  res.status(200).json({ status: 'ok' });
+});
+
 fs.mkdirSync(uploadDir, { recursive: true });
 fs.mkdirSync(agentPackageDir, { recursive: true });
 
@@ -156,6 +161,11 @@ function getCsvEnv(value, fallback) {
     .filter(Boolean);
 }
 
+function getBooleanEnv(value, fallback) {
+  if (value === undefined || value === null || value === '') return fallback;
+  return ['1', 'true', 'yes', 'on'].includes(String(value).toLowerCase());
+}
+
 function isPublicApiCorsPath(pathname) {
   return pathname === '/api/apps'
     || pathname.startsWith('/api/apps/')
@@ -345,7 +355,7 @@ function setAuthCookie(res, user) {
     httpOnly: true,
     maxAge: sessionMaxAgeMs,
     sameSite: 'lax',
-    secure: process.env.NODE_ENV === 'production'
+    secure: secureSessionCookie
   });
 }
 
@@ -353,7 +363,7 @@ function clearAuthCookie(res) {
   res.clearCookie(authCookieName, {
     httpOnly: true,
     sameSite: 'lax',
-    secure: process.env.NODE_ENV === 'production'
+    secure: secureSessionCookie
   });
 }