upgraded to next 15 and react 19.

app/api/auth/login/route.ts

@@ -25,7 +25,8 @@ export async function POST(request: NextRequest) {
     const data = await res.json();
 
     // Set HTTP-only cookie instead of returning token
-    cookies().set('session_token', data.token, {
+    const cookieStore = await cookies();
+    cookieStore.set('session_token', data.token, {
       httpOnly: true,
       secure: process.env.NODE_ENV === 'production',
       sameSite: 'lax',

app/api/auth/logout/route.ts

@@ -2,6 +2,7 @@ import { NextResponse } from 'next/server';
 import { cookies } from 'next/headers';
 
 export async function POST() {
-  cookies().delete('session_token');
+  const cookieStore = await cookies();
+  cookieStore.delete('session_token');
   return NextResponse.json({ success: true });
 }

app/api/auth/me/route.ts

@@ -4,7 +4,8 @@ import { cookies } from 'next/headers';
 const API_BASE_URL = process.env.API_BASE_URL || process.env.NEXT_PUBLIC_API_BASE_URL;
 
 export async function GET(request: NextRequest) {
-  const token = cookies().get('session_token')?.value;
+  const cookieStore = await cookies();
+  const token = cookieStore.get('session_token')?.value;
 
   if (!token) {
     return NextResponse.json({ error: 'Unauthorized' }, { status: 401 });
@@ -16,7 +17,7 @@ export async function GET(request: NextRequest) {
     });
 
     if (!res.ok) {
-      cookies().delete('session_token');
+      cookieStore.delete('session_token');
       return NextResponse.json({ error: 'Session expired' }, { status: 401 });
     }
 

app/api/auth/register/route.ts

@@ -26,7 +26,8 @@ export async function POST(request: NextRequest) {
 
     // Set HTTP-only cookie on successful registration
     if (data.token) {
-      cookies().set('session_token', data.token, {
+      const cookieStore = await cookies();
+      cookieStore.set('session_token', data.token, {
         httpOnly: true,
         secure: process.env.NODE_ENV === 'production',
         sameSite: 'lax',