fix(auth): dual-read session_challange and session_challenge cookie names

[thekauer]

Problem

The Neon Auth server has historically set a session-challenge cookie under the misspelled name session_challange. The server is now correcting the spelling to session_challenge and dual-writes both names during a transition window — see databricks-eng/neon-cloud#6472. This SDK still hard-coded the legacy name; it needs to read either so old and new server builds in the field both work.

Summary of changes

• Add NEON_AUTH_LEGACY_SESSION_CHALLANGE_COOKIE_NAME for the misspelled name.
• Switch NEON_AUTH_SESSION_CHALLENGE_COOKIE_NAME value to the correctly-spelled session_challenge (the constant identifier was already correctly spelled).
• In packages/auth/src/server/middleware/oauth.ts, dual-read inline at both call sites (needsSessionVerification and exchangeOAuthToken): try the new name first, fall back to legacy via ??.
• Tests cover legacy fallback (both needsSessionVerification and exchangeOAuthToken), new-name happy path, and both-present preferring new name.
• packages/auth/src/server/proxy/response.ts audited and is name-agnostic — it allowlists Set-Cookie as a header type and pass-through copies cookies without inspecting their names. No change needed there. Existing response.test.ts fixtures continue to use session_challange since they represent old-server output the SDK should still handle.
• Existing processor.test.ts:65 fixture also kept on session_challange for the same reason.

Verification

Ran in packages/auth:

• vitest run over the four touched/adjacent test files (oauth.test.ts, processor.test.ts, response.test.ts, handler.test.ts) — 60/60 pass, including 4 new tests for dual-read.
• Full vitest run suite — 151/151 pass; two pre-existing test-file failures (src/index.test.ts, src/core/adapter-core.test.ts) are unrelated, caused by workspace deps @neondatabase/internal / @neondatabase/auth-ui not being built locally (no pnpm build), and reproduce on main.
• eslint on the three changed files — clean.
• tsc --noEmit against the three changed files — no errors. Same workspace-dep issues affect typecheck across the package; they are pre-existing.

Follow-up

Once all production Neon Auth deployments have shipped the dual-write change (databricks-eng/neon-cloud#6472), the legacy constant + fallback can be dropped. Patch release recommended after merge per the original feedback thread.

[vercel]

The latest updates on your projects. Learn more about Vercel for GitHub.

Project	Deployment	Actions	Updated (UTC)
neon-auth-nextjs	Ready	Preview, Comment	Jun 30, 2026 1:28pm
react-neon-js	Ready	Preview, Comment	Jun 30, 2026 1:28pm

2 Skipped Deployments

Project	Deployment	Actions	Updated (UTC)
neon-auth-magic-link-example	Ignored	Preview	Jun 30, 2026 1:28pm
react-auth-external-ui	Ignored		Jun 30, 2026 1:28pm

[thekauer]

Rebased onto main (was 6 commits behind) to clear staleness; no conflicts. The oauth unit tests pass locally (18/18, including the new dual-read cookie cases). Real CI was already green; the only red checks are Vercel and the claude-review bot, which are infra/bot noise.

Ready for review. Heads up though: this is a coordinated change that tracks neon-cloud#6472 (the session_challange -> session_challenge cookie-name spelling fix on the server side). Please do not merge it before the neon-cloud server change is out, otherwise the dual-read has nothing to coordinate with. Review now, hold the merge until #6472 lands.