🔥 CRITICAL FIX: Magic Link Session Issue

Cookie present but session validation fails

Root Cause Identified

The Problem:

✅ Rork IS sending cookies (credentials: 'include' is working)
✅ Cookies ARE reaching the server (cookie header present)
❌ BUT base44.auth.me() returns NULL (session not recognized)

This means the magic link authentication is NOT setting a valid session cookie.

The Fix: Add Delay + Retry Logic

Solution: Wait for session to be established before validating

• After calling /auth/magic-link, wait 2-3 seconds

• Then validate the session with retry logic

• If validation fails, retry up to 3 times with delays

Complete Fixed Flow for Rork

// ✅ FIXED: Merchant Login with Session Validation
async function merchantLogin(email, otpCode) {
  try {
    // Step 1: Verify OTP
    console.log('Step 1: Verifying OTP...');
    const verifyResponse = await fetch(
      'https://your-app.base44.com/functions/verifyMerchantOTP',
      {
        method: 'POST',
        headers: { 'Content-Type': 'application/json' },
        body: JSON.stringify({ email, code: otpCode })
      }
    );
    
    const verifyData = await verifyResponse.json();
    
    if (!verifyData.success) {
      throw new Error(verifyData.error || 'OTP verification failed');
    }
    
    const { magicLinkToken } = verifyData;
    console.log('✅ OTP verified, magic link token received');
    
    // Step 2: Authenticate with magic link
    console.log('Step 2: Authenticating with magic link...');
    const magicLinkResponse = await fetch(
      `https://your-app.base44.com/auth/magic-link?token=${magicLinkToken}`,
      {
        method: 'GET',
        credentials: 'include' // CRITICAL
      }
    );
    
    if (!magicLinkResponse.ok) {
      throw new Error('Magic link authentication failed');
    }
    
    console.log('✅ Magic link auth completed');
    
    // Step 3: CRITICAL - Wait for session to be established
    console.log('Step 3: Waiting for session to be established...');
    await new Promise(resolve => setTimeout(resolve, 2000)); // 2 second delay
    
    // Step 4: Validate session with retries
    console.log('Step 4: Validating session...');
    let user = null;
    let attempts = 0;
    const maxAttempts = 3;
    
    while (!user && attempts < maxAttempts) {
      attempts++;
      console.log(`Validation attempt ${attempts}/${maxAttempts}...`);
      
      try {
        const validationResponse = await fetch(
          'https://your-app.base44.com/functions/testMagicLinkAuth',
          {
            method: 'GET',
            credentials: 'include' // CRITICAL
          }
        );
        
        const validationData = await validationResponse.json();
        
        if (validationData.authenticated && validationData.user) {
          user = validationData.user;
          console.log('✅ Session validated successfully!');
          break;
        } else {
          console.log(`⚠️ Attempt ${attempts} failed:, validationData.error`);
          
          // Wait before retry (exponential backoff)
          if (attempts < maxAttempts) {
            const delayMs = 1000 * attempts; // 1s, 2s, 3s
            console.log(`Waiting ${delayMs}ms before retry...`);
            await new Promise(resolve => setTimeout(resolve, delayMs));
          }
        }
      } catch (validationError) {
        console.error(`Validation attempt ${attempts} error:, validationError.message`);
      }
    }
    
    if (!user) {
      throw new Error('Session validation failed after ' + maxAttempts + ' attempts');
    }
    
    console.log('🎉 Login successful!');
    return user;
    
  } catch (error) {
    console.error('❌ Login failed:', error.message);
    throw error;
  }
}

Alternative: Use testMagicLinkAuth Endpoint

We created a dedicated test endpoint that provides detailed diagnostics:

Use Test Endpoint

// Use dedicated test endpoint for immediate validation
async function validateSessionAfterMagicLink() {
  const response = await fetch(
    'https://your-app.base44.com/functions/testMagicLinkAuth',
    {
      method: 'GET',
      credentials: 'include'
    }
  );
  
  const result = await response.json();
  
  if (result.authenticated) {
    console.log('✅ Session valid:', result.user);
    return result.user;
  } else {
    console.error('❌ Session invalid:', result.error);
    console.log('Debug:', result.debug);
    return null;
  }
}

Troubleshooting Checklist

1. Check Magic Link Response

Verify /auth/magic-link returns 200 OK (not 302 redirect or error)

2. Check Response Headers

Look for Set-Cookie header in the magic link response

3. Add Delay After Magic Link

Wait 2-3 seconds after magic link before making first API call

4. Use testMagicLinkAuth

Call /functions/testMagicLinkAuth immediately after magic link to verify session

5. Check Browser Console

Look for CORS errors or cookie blocking warnings

6. Verify App URL

Make sure the Base44 app URL matches the domain in cookies

Debug Tools Available

Session Validator

Test if your current session is valid

Auth Debugger

Step-by-step auth flow testing

Test Magic Link Endpoint

Direct endpoint to test session after magic link