fix: bypass auth in dev mode and add mock session for development

Add DEV_MODE env var check to return mock admin session when auth is
unavailable, hostname-based middleware bypass for dev domain, and
window.location.href for login redirect to ensure cookies are sent.

Co-Authored-By: Claude Opus 4.6 <noreply@anthropic.com>

docker-compose.yml

@@ -68,6 +68,8 @@ services:
     image: forgejo.wulfconsulting.cloud/lorentz/quest-vorteq:dev
     container_name: vorteq-dev
     restart: unless-stopped
+    extra_hosts:
+      - "wi-e10test:10.77.0.217"
     networks:
       - web
     environment:
@@ -77,6 +79,12 @@ services:
       REDIS_URL: redis://redis:6379/0
       BETTER_AUTH_SECRET: ${DEV_AUTH_SECRET}
       BETTER_AUTH_URL: https://${DEV_DOMAIN}
+      MSSQL_HOST: ${DB_HOST}
+      MSSQL_DATABASE: Epicor10Live
+      MSSQL_USER: ${DB_USERNAME_RO}
+      MSSQL_PASSWORD: ${DB_PASSWORD_RO}
+      MSSQL_PORT: "1433"
+      PORTAL_DB_NAME: ${DB_DATABASE}
       PORT: 3000
     labels:
       - "traefik.enable=true"

src/lib/permissions.ts

@@ -325,6 +325,9 @@ export const PermissionRules = {
  * Returns a mock admin session for development mode
  */
 async function getDevSession(): Promise<QuestSession> {
+  // Check if user has already selected a company via the session cookie
+  const sessionData = await getQuestSessionData();
+
   // Try to find the admin user in the database
   const adminUser = await db.auth_user.findFirst({
     where: { email: 'admin@vorteq.com' },
@@ -344,9 +347,14 @@ async function getDevSession(): Promise<QuestSession> {
       where: { id: adminUser.auth_user_type_id },
     });
 
-    const activeCompany = adminUser.quest_user.companies.find(
+    // Use company from session cookie if set, otherwise first active company
-      (c: (typeof adminUser.quest_user.companies)[0]) => c.company.is_active
+    let activeCompanyId = sessionData.activeCompanyId;
-    );
+    if (!activeCompanyId) {
+      const activeCompany = adminUser.quest_user.companies.find(
+        (c: (typeof adminUser.quest_user.companies)[0]) => c.company.is_active
+      );
+      activeCompanyId = activeCompany?.company.id;
+    }
 
     return {
       user: {
@@ -355,7 +363,7 @@ async function getDevSession(): Promise<QuestSession> {
         name: adminUser.name,
       },
       questUserId: adminUser.quest_user.id,
-      activeCompanyId: activeCompany?.company.id,
+      activeCompanyId,
       isSubUser: false,
       permissionRules: Object.values(PermissionRules),
       userType: userType?.name || 'Super Admin',