fix(admin): keep universe route authenticated

src/lib/components/admin/AdminSegmentedController.svelte

@@ -14,7 +14,7 @@
 	const navItems: NavItem[] = [
 		{ value: 'dashboard', label: 'Dashboard', href: '/admin', icon: '📊' },
 		{ value: 'projects', label: 'Projects', href: '/admin/projects', icon: '💼' },
-		{ value: 'universe', label: 'Universe', href: '/admin/posts', icon: '🌟' },
+		{ value: 'universe', label: 'Universe', href: '/admin/universe', icon: '🌟' },
 		{ value: 'media', label: 'Media', href: '/admin/media', icon: '🖼️' }
 	]
 
@@ -27,9 +27,9 @@
 			? 'dashboard'
 			: currentPath.startsWith('/admin/projects')
 				? 'projects'
-				: currentPath.startsWith('/admin/posts')
+			: currentPath.startsWith('/admin/posts') || currentPath.startsWith('/admin/universe')
-					? 'universe'
+				? 'universe'
-					: currentPath.startsWith('/admin/media')
+				: currentPath.startsWith('/admin/media')
 						? 'media'
 						: ''
 	)

src/lib/server/admin/session.ts

@@ -112,7 +112,7 @@ export function readSessionToken(token: string | undefined): SessionUser | null
 export function setSessionCookie(cookies: Cookies, user: SessionUser) {
 	const token = createSessionToken(user)
 	cookies.set(SESSION_COOKIE_NAME, token, {
-		path: '/admin',
+		path: '/',
 		httpOnly: true,
 		secure: !dev,
 		sameSite: 'lax',
@@ -122,7 +122,7 @@ export function setSessionCookie(cookies: Cookies, user: SessionUser) {
 
 export function clearSessionCookie(cookies: Cookies) {
 	cookies.delete(SESSION_COOKIE_NAME, {
-		path: '/admin'
+		path: '/'
 	})
 }
 

src/routes/admin/+layout.server.ts

@@ -1,6 +1,6 @@
 import { redirect } from '@sveltejs/kit'
 import type { LayoutServerLoad } from './$types'
-import { getSessionUser } from '$lib/server/admin/session'
+import { getSessionUser, setSessionCookie } from '$lib/server/admin/session'
 
 const LOGIN_PATH = '/admin/login'
 const DASHBOARD_PATH = '/admin'
@@ -13,6 +13,11 @@ export const load = (async (event) => {
 	const user = getSessionUser(event.cookies)
 	const pathname = event.url.pathname
 
+	if (user) {
+		// Refresh cookie with updated attributes (e.g., widened path)
+		setSessionCookie(event.cookies, user)
+	}
+
 	if (!user && !isLoginRoute(pathname)) {
 		throw redirect(303, LOGIN_PATH)
 	}

src/routes/admin/universe/+page.server.ts

@@ -0,0 +1 @@
+export { load } from '../posts/+page.server'

src/routes/admin/universe/+page.svelte

@@ -0,0 +1,9 @@
+<script lang="ts">
+	import PostsPage from '../posts/+page.svelte'
+	import type { PageData } from '../posts/$types'
+
+	export let data: PageData
+	export let form: any
+</script>
+
+<PostsPage {data} {form} />