refactor(auth): single-domain setup, remove cross-domain cookie hackery

install.sh

@@ -45,8 +45,8 @@ SMTP_PORT_DEFAULT="587"
 SMTP_USER_DEFAULT="post@2-4-h.app"
 IMAP_HOST_DEFAULT="imap.openxchange.eu"
 IMAP_PORT_DEFAULT="993"
-NEXTWKS_URL_DEFAULT="https://wks.lohmar.co.uk"
-AUTH_URL_DEFAULT="https://auth.lohmar.co.uk"
+NEXTWKS_URL_DEFAULT="https://app.nextwks.eu"
+AUTH_URL_DEFAULT="https://app.nextwks.eu/auth"
 
 # ============================================================
 # AUTO-CLONE: if running standalone (not from repo), clone first
@@ -239,7 +239,6 @@ oidc:
   client_id: "nextwks"
   client_secret: ""
   redirect_url: "${NEXTWKS_URL}/auth/callback"
-  domain: "${NEXTWKS_DOMAIN}"
 smtp:
   host: "${SMTP_HOST}"
   port: ${SMTP_PORT}

src/core/auth/oidc.go

@@ -17,7 +17,6 @@ type OIDCConfig struct {
 	ClientID     string
 	ClientSecret string
 	RedirectURL  string
-	Domain       string
 }
 
 // OIDCHandler handles OIDC authentication flows with Authelia.
@@ -48,7 +47,6 @@ func (h *OIDCHandler) LoginRedirect(w http.ResponseWriter, r *http.Request) {
 		Name:     "oidc_state",
 		Value:    state,
 		Path:     "/",
-		Domain:   h.config.Domain,
 		MaxAge:   300,
 		HttpOnly: true,
 		SameSite: http.SameSiteLaxMode,
@@ -57,7 +55,6 @@ func (h *OIDCHandler) LoginRedirect(w http.ResponseWriter, r *http.Request) {
 		Name:     "oidc_verifier",
 		Value:    verifier,
 		Path:     "/",
-		Domain:   h.config.Domain,
 		MaxAge:   300,
 		HttpOnly: true,
 		SameSite: http.SameSiteLaxMode,
@@ -134,7 +131,6 @@ func (h *OIDCHandler) Callback(w http.ResponseWriter, r *http.Request) {
 		Name:     "nextwks_session",
 		Value:    token,
 		Path:     "/",
-		Domain:   h.config.Domain,
 		MaxAge:   3600,
 		HttpOnly: true,
 		SameSite: http.SameSiteLaxMode,
@@ -230,7 +226,6 @@ func (h *OIDCHandler) AuthGateMiddleware(next http.Handler) http.Handler {
 		if !ok {
 			// Check if force-login is requested (after logout)
 			if _, ferr := r.Cookie("force_login"); ferr == nil {
-				http.SetCookie(w, &http.Cookie{Name: "force_login", Value: "", Path: "/", Domain: h.config.Domain, MaxAge: -1, HttpOnly: true})
 				h.LoginRedirectWithPrompt(w, r, "login")
 				return
 			}
@@ -248,8 +243,6 @@ func (h *OIDCHandler) LoginRedirectWithPrompt(w http.ResponseWriter, r *http.Req
 	verifier := generateToken(32)
 	challenge := pkceChallenge(verifier)
 
-	http.SetCookie(w, &http.Cookie{Name: "oidc_state", Value: state, Path: "/", Domain: h.config.Domain, MaxAge: 300, HttpOnly: true, SameSite: http.SameSiteLaxMode})
-	http.SetCookie(w, &http.Cookie{Name: "oidc_verifier", Value: verifier, Path: "/", Domain: h.config.Domain, MaxAge: 300, HttpOnly: true, SameSite: http.SameSiteLaxMode})
 
 	authURL := fmt.Sprintf(
 		"%s/api/oidc/authorize?prompt=%s&response_type=code&client_id=%s&redirect_uri=%s&scope=openid+profile+email&state=%s&nonce=%s&code_challenge=%s&code_challenge_method=S256",

src/core/config/config.go

@@ -47,11 +47,10 @@ type AutheliaConfig struct {
 
 // OIDCConfig holds the OIDC provider settings (Authelia).
 type OIDCConfig struct {
-	IssuerURL    string `yaml:"issuer_url"` // Public-facing URL users reach (e.g., https://auth.sechpoint.app)
+	IssuerURL    string `yaml:"issuer_url"` // Public-facing Authelia URL (e.g., https://app.nextwks.eu/auth)
 	ClientID     string `yaml:"client_id"`
 	ClientSecret string `yaml:"client_secret"`
 	RedirectURL  string `yaml:"redirect_url"`
-	Domain       string `yaml:"domain"`
 }
 
 type SMTPConfig struct {

src/main.go

@@ -93,7 +93,6 @@ func main() {
 		ClientID:     cfg.OIDC.ClientID,
 		ClientSecret: cfg.OIDC.ClientSecret,
 		RedirectURL:  cfg.OIDC.RedirectURL,
-		Domain:       cfg.OIDC.Domain,
 	}
 	oidcHandler := auth.NewOIDCHandler(oidcCfg, sessionStore)
 
@@ -132,7 +131,7 @@ func main() {
 		}
 		// First visit: clear cookie and redirect to Authelia logout
 		http.SetCookie(w, &http.Cookie{
-			Name: "nextwks_session", Value: "", Path: "/", Domain: cfg.OIDC.Domain,
+			Name: "nextwks_session", Value: "", Path: "/",
 			MaxAge: -1, HttpOnly: true, SameSite: http.SameSiteLaxMode,
 		})
 		logoutURL := fmt.Sprintf("%s/logout?rd=%s/auth/logout", cfg.OIDC.IssuerURL, cfg.OIDC.RedirectURL)