dev_agentandClaude Opus 5.5
17d5152247
The auth routes no longer return 400 when the resolved request scheme differs from MEALQUEST_PUBLIC_URL's. If Docker's published-port path presents its bridge gateway instead of Traefik as the direct peer, the forwarded headers are rightly ignored, but sign-in must still work: the OIDC redirect URI and the Secure cookies are fixed by MEALQUEST_PUBLIC_URL, not by the request. internal/auth is back to its state before the trusted-proxy change; client IP and scheme resolution stays in the router. Add TestLoginThroughRouter: it wires the real auth flow and session manager through server.NewRouter, trusting Traefik only, and checks that a login from Traefik and from an untrusted peer both redirect with the redirect URI from MEALQUEST_PUBLIC_URL and set a Secure login cookie. Co-Authored-By: Claude Opus 5.5 <noreply@anthropic.com>