Express login session only lasts one page view

In the code below, when I visit / the first time (not logged onto FB) I'm redirected to the /login page, as expected.

Then I login onto facebook and I'm then taken to /, as expected

If I then refresh the page (while on /) I'm taken back the /login page, as if the session is already over.

It looks like for every new page view of / I'm always asked to login every time.

What am I doing wrong ?

(for testing purposes I'm not yet using a real database and have just set up this preliminary user.js one for the sake of the session..)

user.js

import fs from 'fs'

if (!fs.existsSync('./user.json')) {
  fs.writeFileSync('./user.json', JSON.stringify(null))
}

export default {

  query(facebookId) {
    let user = JSON.parse(fs.readFileSync('./user.json', 'utf8'));

    if (user && user.facebookId === facebookId) {
      return user
    }

    return null
  },

  save(user) {
    fs.writeFileSync('./user.json', JSON.stringify(user, null, 2))
    return user
  },

  delete() {
    fs.writeFileSync('./user.json', JSON.stringify(null, null, 2))
    return true
  }
}

server.js

import { Strategy as FacebookStrategy } from 'passport-facebook'
import express                          from 'express'
import passport                         from 'passport'
import session                          from 'express-session'
import fetch                            from 'node-fetch'
import { fileURLToPath }                from 'url'
import { dirname }                      from 'path'
import cors                             from 'cors'
import cookieParser                     from 'cookie-parser'
import { ensureLoggedIn }               from 'connect-ensure-login'
import FB                               from './fb'
import USER                             from './user'
import bodyParser                       from 'body-parser'

const jsonParser = bodyParser.json()
    
const {
  PORT,
  INSTAGRAM_USER_ID,
  FACEBOOK_APP_ID,
  FACEBOOK_APP_SECRET,
  FACEBOOK_PAGE_NAME
} = process.env

const __filename = fileURLToPath(import.meta.url)
const __dirname = dirname(__filename)

const app = express()

app.use(cors({
   origin: '*',
   credentials: true,
   optionSuccessStatus: 200
}))

app.use(function(req, res, next) {
  res.header('Access-Control-Allow-Origin', `http://localhost:${PORT}`)
  res.header('Access-Control-Allow-Headers', 'Origin, X-Requested-With, Content-Type, Accept, Authorization')
  res.header('Access-Control-Allow-Methods', 'POST, GET')
  next()
})

app.use(cookieParser())
app.use(bodyParser.json({limit: "50mb"}));
app.use(bodyParser.urlencoded({limit: "50mb", extended: true, parameterLimit:50000}))
app.use(session({ secret: 'googoogaga', resave: false, saveUninitialized: false }))
app.use(passport.initialize())
app.use(passport.session())

passport.use(new facebookStrategy({
  clientID        : FACEBOOK_APP_ID,
  clientSecret    : FACEBOOK_APP_SECRET,
  callbackURL     : `http://localhost:${PORT}/facebook/callback`,
  profileFields: ['id', 'displayName']

}, function(accessToken, refreshToken, profile, done) {

    let user = USER.query(profile.id)

    if (user) {
      return done(null, user)
    } else {
      user = USER.save({
        facebookId: profile.id,
        accessToken
      })
      return done(null, user);
    }

}));

passport.serializeUser(function(user, done) {
    done(null, user);
});

passport.deserializeUser(function(user, done) {
    done(null, user);
});
    
app.get('/auth/facebook', passport.authenticate('facebook', { scope:'email,instagram_basic,pages_show_list' }));

app.get('/facebook/callback', passport.authenticate('facebook', {
  successRedirect : '/',
  failureRedirect : '/login'
}));

app.get('/login', (req,res) => {
  res.sendFile(__dirname + '/public/login.html');
})

app.get('/', ensureLoggedIn('/login'), (req,res) => {
  res.status(200).send({ user: req.user })
})

app.get('/logout', function(req, res){
  req.session.destroy(()=>{
    USER.delete()
    res.redirect('/login')
  })
})  

app.listen(PORT)