fix(F163.1): proxy Set-Cookies URL-resolved active site — close cross-tenant desync

/admin/{slug}/... injected cms-active-org/cms-active-site only on the forwarded
REQUEST, so client-side /api/* calls (which carry no slug) sent the STALE browser
cookie → the site picker + page data resolved a DIFFERENT tenant than the URL.
2026-07-16 incident: /admin/broberg-ai/lighthouse showed the sanneandersen picker
+ sanneandersen Lighthouse data while URL/sidebar rendered broberg-ai — two tenants
on one screen.

proxy.ts now persists the URL-resolved site to the RESPONSE cookie jar (same opts
as /admin/switch/[slug]), making the URL slug authoritative on every request; cookie
drift self-heals on the next slug URL load. The ?site= API override stays request-only
(per-call override for token callers, not a UI switch) — scoping preserved.

Sealed by src/lib/__tests__/proxy-slug-cookie.test.ts (red→green: fails with the fix
disabled; ?site= + reserved routes correctly do NOT persist the cookie).

Co-Authored-By: Claude Opus 4.8 <noreply@anthropic.com>

Author: Christian Broberg

packages/cms-admin/src/lib/__tests__/proxy-slug-cookie.test.ts

@@ -0,0 +1,84 @@
+/**
+ * Regression seal for the 2026-07-16 cross-tenant desync: the F146 URL site
+ * router (`/admin/{slug}/...`) injected `cms-active-site` only on the forwarded
+ * REQUEST, never on the RESPONSE. So server-rendered parts of the page resolved
+ * the URL's site while every CLIENT-side /api/* call (which carries no slug)
+ * sent the STALE browser cookie → the site picker showed sanneandersen while the
+ * page (URL broberg-ai) rendered broberg-ai content. Two tenants on one screen.
+ *
+ * The fix: when the active site comes from the URL slug, proxy must Set-Cookie
+ * it on the response so the browser jar follows the URL. This test fails if that
+ * wiring breaks again. It also pins the deliberate SCOPING: the `?site=` API
+ * override must NOT mutate the persistent cookie.
+ */
+import { describe, it, expect, vi, beforeAll } from 'vitest';
+import { NextRequest } from 'next/server';
+import { SignJWT } from 'jose';
+
+// Mock the registry proxy.ts dynamically imports (./lib/site-registry). Two orgs,
+// each owning one site — the exact shape of the real leak.
+vi.mock('../site-registry', () => {
+  const registry = {
+    orgs: [
+      { id: 'org-broberg', name: 'Broberg', sites: [{ id: 'broberg-ai', name: 'Broberg.ai' }] },
+      { id: 'org-sanne', name: 'Sanne', sites: [{ id: 'sanneandersen', name: 'Sanne Andersen' }] },
+    ],
+    defaultOrgId: 'org-broberg',
+    defaultSiteId: 'broberg-ai',
+  };
+  return {
+    loadRegistry: vi.fn(async () => registry),
+    findSite: (reg: typeof registry, orgId: string, siteId: string) =>
+      reg.orgs.find((o) => o.id === orgId)?.sites.find((s) => s.id === siteId) ?? null,
+  };
+});
+
+const SECRET = new TextEncoder().encode('cms-dev-secret-change-me-in-production');
+let sessionCookie = '';
+
+beforeAll(async () => {
+  const jwt = await new SignJWT({ sub: 'u1', email: 'cb@webhouse.dk', name: 'CB', role: 'admin' })
+    .setProtectedHeader({ alg: 'HS256' })
+    .setExpirationTime('1h')
+    .sign(SECRET);
+  sessionCookie = `cms-session=${jwt}`;
+});
+
+async function run(url: string, cookie: string) {
+  const { proxy } = await import('../../proxy');
+  const req = new NextRequest(new URL(url), { headers: { cookie } });
+  return proxy(req);
+}
+
+describe('proxy — F146 slug router persists active-site to the browser cookie', () => {
+  it('navigating to /admin/{slug}/... Set-Cookies the URL site over a stale cookie', async () => {
+    // Browser jar still says sanneandersen; the URL says broberg-ai. URL wins.
+    const res = await run(
+      'https://webhouse.app/admin/broberg-ai/lighthouse',
+      `${sessionCookie}; cms-active-org=org-sanne; cms-active-site=sanneandersen`,
+    );
+    expect(res.cookies.get('cms-active-site')?.value).toBe('broberg-ai');
+    expect(res.cookies.get('cms-active-org')?.value).toBe('org-broberg');
+  });
+
+  it('sets the cookie even when the browser had no active-site yet', async () => {
+    const res = await run('https://webhouse.app/admin/broberg-ai/content', sessionCookie);
+    expect(res.cookies.get('cms-active-site')?.value).toBe('broberg-ai');
+  });
+
+  it('does NOT touch the persistent cookie for a reserved (non-slug) admin route', async () => {
+    const res = await run(
+      'https://webhouse.app/admin/lighthouse',
+      `${sessionCookie}; cms-active-site=sanneandersen`,
+    );
+    expect(res.cookies.get('cms-active-site')).toBeUndefined();
+  });
+
+  it('does NOT persist the cookie for a ?site= API override (per-call, not a UI switch)', async () => {
+    const res = await run(
+      'https://webhouse.app/api/admin/site-config?site=broberg-ai',
+      `${sessionCookie}; cms-active-site=sanneandersen`,
+    );
+    expect(res.cookies.get('cms-active-site')).toBeUndefined();
+  });
+});

packages/cms-admin/src/proxy.ts

@@ -125,6 +125,7 @@ export async function proxy(request: NextRequest) {
   // keeps the pretty `/admin/{slug}/` URL. Reserved segments (content,
   // settings, …) and unknown slugs fall through untouched.
   let slugRewriteUrl: URL | null = null;
+  let slugActive: { orgId: string; siteId: string } | null = null;
   if (isAdminPath) {
     const parsed = parseSiteSlugPath(pathname);
     if (parsed) {
@@ -140,6 +141,14 @@ export async function proxy(request: NextRequest) {
             const cleaned = stripActiveSiteCookies(requestHeaders.get("cookie") ?? "");
             const injected = `cms-active-org=${org.id}; cms-active-site=${parsed.slug}`;
             requestHeaders.set("cookie", cleaned ? `${cleaned}; ${injected}` : injected);
+            // Also persist to the browser's cookie jar on the RESPONSE (below).
+            // Injecting only on the forwarded request fixes server-rendered
+            // components, but every CLIENT-side /api/* call carries no slug and
+            // sends the STALE browser cookie → the picker + page data resolve a
+            // DIFFERENT tenant than the URL (cross-tenant desync: the 2026-07-16
+            // broberg-ai/sanneandersen leak). The URL is authoritative, so the
+            // browser cookie must follow it.
+            slugActive = { orgId: org.id, siteId: parsed.slug };
             // Rewrite to the slug-stripped path so existing routes render.
             slugRewriteUrl = new URL(parsed.rest, request.url);
             slugRewriteUrl.search = request.nextUrl.search;
@@ -155,10 +164,24 @@ export async function proxy(request: NextRequest) {
   // resolved above we rewrite to the slug-stripped path; otherwise pass
   // through unchanged. Both carry the augmented requestHeaders (cookies +
   // x-pathname). All success-paths below go through this.
-  const forwardOk = () =>
-    slugRewriteUrl
+  const forwardOk = () => {
+    const res = slugRewriteUrl
       ? NextResponse.rewrite(slugRewriteUrl, { request: { headers: requestHeaders } })
       : NextResponse.next({ request: { headers: requestHeaders } });
+    // When the active site was resolved from the URL slug, write it to the
+    // browser's cookie jar too (same opts as /admin/switch/[slug]) so later
+    // CLIENT-side /api/* calls — which carry no slug — resolve the SAME tenant
+    // as the URL. Without this the cookie drifts from the URL and two tenants
+    // render on one screen. Scoped to the slug path only: the ?site= API
+    // override deliberately does NOT mutate the persistent cookie (it's a
+    // per-call override for token callers, not a UI site switch).
+    if (slugActive) {
+      const opts = { path: "/", maxAge: 60 * 60 * 24 * 365, sameSite: "lax" as const };
+      res.cookies.set("cms-active-org", slugActive.orgId, opts);
+      res.cookies.set("cms-active-site", slugActive.siteId, opts);
+    }
+    return res;
+  };
 
   // `?site=<id>` URL override for /api/* routes.
   //