fix: use requestIsSecure(r) consistently for cookie Secure flag

[Copilot]

Summary

• What changed: cluster_selector.go cookie creation now uses requestIsSecure(r) instead of r.TLS != nil for the Secure flag.
• Why it changed: r.TLS != nil only detects direct TLS; it misses requests proxied over HTTPS where X-Forwarded-Proto: https is set. requestIsSecure() already handles both cases and was already used correctly in auth.go.
• Risk level: Low — one-line behavioural change; expands (never restricts) when Secure is set.

// before
Secure: r.TLS != nil,

// after
Secure: requestIsSecure(r),  // also covers X-Forwarded-Proto: https

auth.go (writeAuthCookie / clearAuthCookie) was already correct — no changes there.

Validation

• npm run lint
• npm run test:go
• npm run test:web
• npm run test:e2e
• npm run test:predictor
• npm run verify:release
• npm run verify:changelog
• npm run verify:api-contract
• npm run verify:docs
• npm run verify:doc-impact
• npm run build

Security and operations impact

• Auth/RBAC behavior changed (explain)
• Terminal policy changed (explain)
• Audit schema/behavior changed (explain)
• Kubernetes manifests changed (explain)
• Documentation updated for behavior/configuration changes (explain)
• Implementation program status/scope updated when roadmap epics changed (explain)

Rollout and rollback

• Rollout steps: Drop-in replacement; no config or deployment changes required.
• Rollback steps: Revert the single-line change in cluster_selector.go.

Summary by CodeRabbit

• Bug Fixes
  • Improved security detection for cluster-selection cookie handling to ensure consistent secure transport identification across requests.

[coderabbitai]

Important

Review skipped

Draft detected.

Please check the settings in the CodeRabbit UI or the .coderabbit.yaml file in this repository. To trigger a single review, invoke the @coderabbitai review command.

⚙️ Run configuration

Configuration used: defaults

Review profile: CHILL

Plan: Pro Plus

Run ID: d0850a00-4dae-419e-b92f-3d9cabb5ce72

You can disable this status message by setting the reviews.review_status to false in the CodeRabbit configuration file.

Use the checkbox below for a quick retry:

• ✅ Review completed - (🔄 Check again to review again)

✨ Finishing Touches

🧪 Generate unit tests (beta)

• Create PR with unit tests
• Commit unit tests in branch copilot/fix-cookie-secure-configuration

---

_{Comment @coderabbitai help to get the list of available commands and usage tips.}

[Copilot]

Copilot encountered an error and was unable to review this pull request. You can try again by re-requesting a review.

[Copilot]

Copilot encountered an error and was unable to review this pull request. You can try again by re-requesting a review.