GET /health → { ok: true }
POST /auth/session → set token; accepts JSON { token } or Authorization: Bearer <token>
GET /auth/session → read session; returns { exists, updatedAt, token? }
DELETE /auth/session → clear session and cookie

Frontend usage

After login in host app:

await fetch("http://localhost:7000/auth/session", {
  method: "POST",
  headers: { "Content-Type": "application/json" },
  body: JSON.stringify({ token }),
  credentials: "include",
});

In iframe app (ragflow) to read the token (if EXPOSE_TOKEN=true):

const res = await fetch("http://localhost:7000/auth/session", {
  credentials: "include",
});
const data = await res.json();
const token = data.token; // may be undefined if EXPOSE_TOKEN=false

Alternatively, keep EXPOSE_TOKEN=false and use a backend that reads the cookie server-side. Or pass the token via your iframe-bridge/Penpal channel.