feat: ship self-hosted KOC LOOP workflows

lib/user-auth.ts

@@ -1,6 +1,8 @@
-import { env } from "cloudflare:workers";
+import { getRuntimeEnv } from "./runtime-env";
 import { ensureSchema, getRawDb } from "./mvp-db";
 
+const env = getRuntimeEnv();
+
 export type UserRole = "super_admin" | "admin" | "user";
 
 export type AuthUser = {
@@ -15,7 +17,7 @@ export type RequestPrincipal =
 
 const SESSION_COOKIE = "koc_session";
 const SESSION_MAX_AGE_SECONDS = 60 * 60 * 24 * 7;
-// Cloudflare Workers caps PBKDF2 at 100,000 iterations.
+// Keep existing password records compatible while using a production-safe cost.
 const PASSWORD_ITERATIONS = 100_000;
 
 function bytesToHex(bytes: Uint8Array) {
@@ -198,6 +200,15 @@ export function clearSessionCookie(secure = true) {
     .join("; ");
 }
 
+export function requestUsesHttps(request: Request) {
+  const forwardedProtocol = request.headers
+    .get("x-forwarded-proto")
+    ?.split(",")[0]
+    ?.trim()
+    .toLowerCase();
+  return forwardedProtocol === "https" || new URL(request.url).protocol === "https:";
+}
+
 export async function createSession(userId: string) {
   const tokenBytes = new Uint8Array(32);
   crypto.getRandomValues(tokenBytes);