feat: SSO via shared session with dbx-main, sub-path hosting at /orderlist

app/main.py

@@ -31,9 +31,18 @@ async def health_db():
     status_code = 200 if ok else 503
     return JSONResponse({"ok": ok, "detail": msg}, status_code=status_code)
 
-# Session middleware for OAuth
-# In production, use a secure secret key from environment variables
-app.add_middleware(SessionMiddleware, secret_key=os.getenv("SESSION_SECRET_KEY", "super-secret-key"))
+# ---- Session middleware ----
+# dbx-main 과 SSO 하려면 SESSION_SECRET_KEY 와 SESSION_COOKIE_NAME 을
+# 두 앱이 동일하게 맞춰야 한다. 그래야 dbx-main 이 발급한 세션 쿠키를
+# OMS 가 그대로 읽을 수 있다.
+app.add_middleware(
+    SessionMiddleware,
+    secret_key=os.getenv("SESSION_SECRET_KEY", "super-secret-key"),
+    session_cookie=os.getenv("SESSION_COOKIE_NAME", "session"),
+    same_site=os.getenv("SESSION_SAME_SITE", "lax"),
+    https_only=os.getenv("SESSION_HTTPS_ONLY", "0") == "1",
+    max_age=int(os.getenv("SESSION_MAX_AGE", str(60 * 60 * 24 * 14))),  # 14d
+)
 
 # Include routers
 app.include_router(auth_router)