latest changes before server transfer

server/authRoutes.js

@@ -27,6 +27,7 @@ router.get('/api/auth/session', (req, res) => {
 // Sign in anonymously (POST)
 router.post('/api/auth/signin-anonymous', async (req, res) => {
   const userId = generateUniqueId(); // Generate unique ID for anonymous user
+  console.error('??????????????? signing-in as anonymous', userId);
 
   try {
     // Insert the anonymous user into the database (no sensitive data, just ID)
@@ -43,7 +44,8 @@ router.post('/api/auth/signin-anonymous', async (req, res) => {
     );
 
     // Set the JWT in an httpOnly cookie for better security
-    res.cookie('token', token, { httpOnly: true });
+    res.cookie('token', token, { httpOnly: true, secure: true });
+    console.error('!!!!!!!!!!!!!!! signed-in as anonymous', userId, token);
 
     res.status(200).json({ message: 'Anonymous user signed in' });
   } catch (error) {
@@ -64,7 +66,7 @@ router.post('/api/auth/refresh-token', (req, res) => {
       process.env.JWT_SECRET,
       { expiresIn: '1h' }
     );
-    res.cookie('token', newToken, { httpOnly: true });
+    res.cookie('token', newToken, { httpOnly: true, secure: true });
     res.json({ message: 'Token refreshed' });
   } catch (error) {
     res.status(403).send('Invalid refresh token');
@@ -80,7 +82,7 @@ passport.use(
     {
       clientID: process.env.GOOGLE_CLIENT_ID,
       clientSecret: process.env.GOOGLE_CLIENT_SECRET,
-      callbackURL: '/api/auth/google/callback',
+      callbackURL: process.env.GOOGLE_REDIRECT_URI,
     },
     async (accessToken, refreshToken, profile, done) => {
       const googleId = profile.id; // This is the unique ID from Google
@@ -123,14 +125,14 @@ router.get(
     const token = req.user; // Passport's Google strategy should return the JWT
 
     // Set the JWT in an httpOnly cookie
-    res.cookie('token', token, { httpOnly: true });
+    res.cookie('token', token, { httpOnly: true, secure: true });
 
     // Redirect to the frontend dashboard or a secure page without the token in the URL
     res.redirect('/dashboard');
   }
 );
 
-// Example of a protected route (no need for query token)
+// Example of a protected route (no neeaxios.d for query token)
 router.get('/dashboard', (req, res) => {
   // Extract token from cookies (JWT is automatically sent as a cookie)
   const token = req.cookies.token;