fix: Forward Set-Cookie and strip Bearer token

[edwinjosechittilappilly]

frontend/app/api/[...path]/route.ts: Ensure Set-Cookie headers from proxied responses are forwarded explicitly by iterating response.headers.getSetCookie() and appending each cookie to responseHeaders (entries() may omit them). This preserves cookies for proxied streaming responses.

src/session_manager.py: Accept Authorization headers with a "Bearer " prefix by stripping the prefix before calling jwt.decode. This prevents passing the literal "Bearer ..." string to the decoder and fixes token verification failures when Bearer tokens are used.

[Copilot]

Pull request overview

This PR improves auth/session interoperability between the Next.js proxy layer and the Python backend by ensuring cookies and Bearer tokens are handled correctly during proxying and JWT verification.

Changes:

• Forward Set-Cookie headers explicitly in the Next.js proxy route using response.headers.getSetCookie().
• Strip the "Bearer " prefix in SessionManager.verify_token() before calling jwt.decode() to support Authorization-style tokens.

Reviewed changes

Copilot reviewed 2 out of 2 changed files in this pull request and generated 1 comment.

File	Description
src/session_manager.py	Strips Bearer prefix before JWT decoding to prevent verification failures.
frontend/app/api/[...path]/route.ts	Ensures proxied Set-Cookie headers are preserved (including for streaming responses).

Comments suppressed due to low confidence (1)

src/session_manager.py:226

• verify_token() now accepts Authorization-style values by stripping the Bearer prefix, but this behavior isn't currently covered by a unit/integration test. Adding a test that verify_token("Bearer <jwt>") successfully decodes the same as the raw JWT would prevent regressions (especially since the cookie value is stored as Bearer ...).

            raw = token[7:] if token.startswith("Bearer ") else token
            payload = jwt.decode(
                raw,
                self.public_key,
                algorithms=[self.algorithm],
                audience=["opensearch", "openrag"],
            )

---

💡 Add Copilot custom instructions for smarter, more guided reviews. Learn how to get started.

[Copilot]

Avoid the hard-coded slice length (token[7:]) when stripping the Bearer prefix. Since the project requires Python >= 3.13, using token.removeprefix("Bearer ") (optionally combined with a .strip() if desired) makes the intent clearer and removes the magic number.

Suggested change

	raw = token[7:] if token.startswith("Bearer ") else token
	raw = token.removeprefix("Bearer ")

[mfortman11]

agree w/ this

[edwinjosechittilappilly]

Done