fix(auth): correct local cookie security configuration

validation-suite/frontend/atlas/app/api/v1/[...path]/route.ts

@@ -0,0 +1,41 @@
+import { cookies } from "next/headers";
+import { NextRequest, NextResponse } from "next/server";
+import { AUTH_COOKIE_NAME } from "@/lib/auth";
+
+const mercuryBase = `${process.env.MERCURY_INTERNAL_URL ?? "http://mercury-api:8000"}/api/v1`;
+
+async function forward(request: NextRequest, method: string, path: string[]) {
+  const cookieStore = await cookies();
+  const token = cookieStore.get(AUTH_COOKIE_NAME)?.value;
+  if (!token) {
+    return NextResponse.json({ detail: "Not authenticated" }, { status: 401 });
+  }
+  const url = new URL(`${mercuryBase}/${path.join("/")}${request.nextUrl.search}`);
+  const headers = new Headers(request.headers);
+  headers.set("Authorization", `Bearer ${token}`);
+  headers.delete("host");
+  headers.delete("cookie");
+  const init: RequestInit = { method, headers };
+  if (method !== "GET" && method !== "HEAD") {
+    init.body = await request.text();
+  }
+  const response = await fetch(url, init);
+  const contentType = response.headers.get("content-type") ?? "";
+  if (contentType.includes("application/json")) {
+    return NextResponse.json(await response.json(), { status: response.status });
+  }
+  return new NextResponse(response.body, { status: response.status, headers: { "content-type": contentType } });
+}
+
+export async function GET(request: NextRequest, { params }: { params: Promise<{ path: string[] }> }) {
+  return forward(request, "GET", (await params).path);
+}
+export async function POST(request: NextRequest, { params }: { params: Promise<{ path: string[] }> }) {
+  return forward(request, "POST", (await params).path);
+}
+export async function PUT(request: NextRequest, { params }: { params: Promise<{ path: string[] }> }) {
+  return forward(request, "PUT", (await params).path);
+}
+export async function DELETE(request: NextRequest, { params }: { params: Promise<{ path: string[] }> }) {
+  return forward(request, "DELETE", (await params).path);
+}