fix(auth): écritures profil qui pendent + middleware auth inopérant

[Tbeaumont79]

Symptômes (constatés par le fondateur et reproduits)

• /profil affichait « Impossible de charger ton profil » pour un visiteur non connecté (au lieu de rediriger vers /connexion).
• Toutes les écritures (PUT /api/profile, POST experiences/skills, import) pendaient indéfiniment en build de prod — l'édition de profil était inutilisable.

Causes

1. getAuthSession → toWebRequest(event) : convertir l'événement H3 en Request touche au flux du corps ; le readBody(event) qui suit dans les handlers PUT/POST attend un corps déjà verrouillé → hang. Les GET (sans corps) passaient, d'où le symptôme asymétrique. Fix : passer event.headers directement (comme le middleware serveur le fait déjà).
2. Middleware de navigation auth : il testait la truthiness de l'atom nanostores de useAuth() — un objet, toujours vrai → aucune redirection, jamais. Fix : vérification réelle de session via GET /api/auth/get-session (cookies transférés en SSR).

Vérification (build de prod + Postgres réel)

• PUT /api/profile → 200 en ~20 ms (avant : timeout 12 s) ; POST expériences/compétences → 200 ; relecture GET OK.
• /profil sans cookie → 302 /connexion ; avec session → 200.
• ✅ lint · ✅ typecheck · ✅ 56 tests

🤖 Generated with Claude Code

Summary by CodeRabbit

Bug Fixes

• Enhanced authentication reliability by migrating from hook-based session checks to a dedicated session endpoint, with proper cookie header forwarding during server-side rendering
• Resolved potential request timeout issues in session utilities by optimizing event header processing, preventing body locking conflicts in PUT/POST handlers

[coderabbitai]

No actionable comments were generated in the recent review. 🎉

ℹ️ Recent review info

⚙️ Run configuration

Configuration used: defaults

Review profile: CHILL

Plan: Pro

Run ID: d3a3aec9-0981-49a5-973f-3347db64b59b

📥 Commits

Reviewing files that changed from the base of the PR and between 002fe77 and f42c768.

📒 Files selected for processing (2)

• apps/app/middleware/auth.ts
• apps/app/server/utils/session.ts

---

📝 Walkthrough

Walkthrough

The PR refactors authentication session handling by updating the server-side session utility to retrieve sessions using direct event headers instead of web request conversion, and modifies the middleware to call the session endpoint directly with proper cookie forwarding for SSR instead of relying on the useAuth() hook.

Changes

Authentication Session Handling

Layer / File(s)	Summary
Server session utility refactoring apps/app/server/utils/session.ts	getAuthSession now retrieves Better Auth sessions using event.headers directly instead of converting via toWebRequest(event), which prevents body-locking issues in PUT/POST handlers. Documentation updated to reflect this behavior.
Middleware authentication check via endpoint apps/app/middleware/auth.ts	Auth middleware replaces useAuth() hook session checks with direct /api/auth/get-session endpoint calls. SSR requests forward the incoming cookie header; client navigation performs the same fetch without custom headers. Missing or errored sessions redirect to /connexion.

Estimated code review effort

🎯 2 (Simple) | ⏱️ ~12 minutes

Poem

🐰 A rabbit hops through session calls,
No hooks to halt in auth's great halls,
Direct the headers, cookies true,
SSR and client paths break through!
Body safe from locks so deep, 🍃

🚥 Pre-merge checks | ✅ 5

✅ Passed checks (5 passed)

Check name	Status	Explanation
Title check	✅ Passed	The title directly describes the two main fixes: profile writes hanging and non-functional auth middleware, matching the core changes in the changeset.
Description check	✅ Passed	The description comprehensively covers objectives, causes, and verification results, but lacks explicit checklist completion status and some required template sections.
Docstring Coverage	✅ Passed	Docstring coverage is 100.00% which is sufficient. The required threshold is 80.00%.
Linked Issues check	✅ Passed	Check skipped because no linked issues were found for this pull request.
Out of Scope Changes check	✅ Passed	Check skipped because no linked issues were found for this pull request.

_{✏️ Tip: You can configure your own custom pre-merge checks in the settings.}

✨ Finishing Touches

📝 Generate docstrings

• Create stacked PR
• Commit on current branch

🧪 Generate unit tests (beta)

• Create PR with unit tests
• Commit unit tests in branch fix/profile-writes-hang

---

Thanks for using CodeRabbit! It's free for OSS, and your support helps us grow. If you like it, consider giving us a shout-out.

❤️ Share

• X
• Mastodon
• Reddit
• LinkedIn

_{Comment @coderabbitai help to get the list of available commands and usage tips.}

[netlify]

✅ Deploy Preview for monumental-speculoos-a69398 ready!

Name	Link
🔨 Latest commit	f42c768
🔍 Latest deploy log	https://app.netlify.com/projects/monumental-speculoos-a69398/deploys/6a299dfd7413fb0008aeec7c
😎 Deploy Preview	https://deploy-preview-19--monumental-speculoos-a69398.netlify.app
📱 Preview on mobile	Toggle QR Code... Use your smartphone camera to open QR code link.

---

To edit notification comments on pull requests, go to your Netlify project configuration.