# MC 900254 — Stage dev-login ekran (2026-08-26)

# MC #900254 — Stage dev-login ekran (2026-08-26)

**Task:** [Bilko][H][STAGE] Dev-login forma (email+secret) preko postojećeg test/session endpointa — CEO nalog 26.08. ~00:45 (brana preskočena CEO riječju).

## Zašto
CEO testira stage bez CIAM-a; konzolni snippet (verifikovan Playwrightom, radi) je preklimav za ljudsku upotrebu.

## Dizajn (John, pinovan)
- `apps/web/app/(auth)/dev-login/page.tsx` — server komponenta, `export const dynamic = 'force-dynamic'`, gate: `process.env.ENABLE_DEV_LOGIN === '1'` inače `notFound()`. **NE** NEXT_PUBLIC_ (build-time inline bi procurio u demo/prod — ista slika se promotuje).
- Klijent forma (zaseban fajl, ne export iz page): email (default `proba@bilko.cloud`) + secret → POST `{NEXT_PUBLIC_API_URL}/api/v1/auth/test/session` `{testSecret, testEmail}` → `sessionStorage.setItem('bilko_access_token', tokens.accessToken)` + `document.cookie='bilko_refresh_token='+tokens.refreshToken+'; path=/; secure; samesite=lax'` → `location.href='/dashboard'`. (Edge middleware provjerava samo postojanje cookieja — middleware.ts:43-50.)
- `/dev-login` dodati u PUBLIC paths listu `middleware.ts` (~:19) — inače edge vrati na /login.
- Dvostruka brava: prod API nema secret (endpoint 404), demo web nema ENABLE_DEV_LOGIN (stranica 404).
- Poslije mergea: John setuje `ENABLE_DEV_LOGIN=1` samo na bilko-web-stage.

<!-- ALAI-MC:900254:BEFORE -->