mirror of
https://github.com/twentyhq/twenty.git
synced 2026-09-22 21:46:17 -04:00
Félix Malfait
d2d3e500b8
Cookie-based web sessions have been running in production long enough to become the only web login path, ahead of deprecating JWT for the web app. JWT stays for OAuth/apps, and as the fallback credential for clients that predate the session cookie. - Removed `AUTH_COOKIE_SESSIONS_ENABLED` and every branch behind it: `UserSessionCookieService` and `UserSessionService` now always issue and read the session cookie. - Removed `isCookieSessionEnabled` from client config (entity, service, generated schema artifacts) and from the front end: the `isCookieSessionEnabled` atom is gone, `CookieSessionBootEffect` always probes, and `SettingsProfileDevicesSection` no longer skips its query. - Dropped the CI env plumbing and the `ci:auth-cookie-sessions` label, so the server integration suite runs against sessions like production. - Removed the config overrides and the disabled-path cases from the session integration suites and the CSRF middleware unit test. Existing instances with a DB override row for the key keep it in `core.keyValuePair`, where it is simply never read. Generated files were edited by hand since codegen needs a running server; the schema drift check in CI is the verification.