@becklyn/deployment-protection 0.4.1 → 0.4.2

package/README.md

@@ -214,10 +214,20 @@ x-vercel-protection-bypass: <VERCEL_AUTOMATION_BYPASS_SECRET>
 
 Or query:
 
+```text
+https://app.example/?x-vercel-protection-bypass=<secret>
+```
+
+A valid bypass query param redirects to the same path without the secret and sets the signed `__becklyn_dp_session` cookie, so later requests stay authenticated. You do not need `x-vercel-set-bypass-cookie` for that.
+
+Optional Vercel-compatible helper — also persist the raw bypass secret as `__becklyn_dp_bypass`:
+
 ```text
 https://app.example/?x-vercel-protection-bypass=<secret>&x-vercel-set-bypass-cookie=true
 ```
 
+The header form stays one-shot (no cookies) so CI/Playwright can send it on each request.
+
 When platform Deployment Protection is disabled, **this package** enforces the bypass secret so CI/Playwright keep working the same way.
 
 ## Behaviour
@@ -225,9 +235,10 @@ When platform Deployment Protection is disabled, **this package** enforces the b
 1. Disabled / misconfigured → pass through
 2. Internal Vercel OAuth routes → handled by the package (proxy start or direct OAuth / handoff)
 3. Login form `POST` → validate username/password, set signed HttpOnly session cookie
-4. Valid bypass header/query/cookie → allow (optionally set cookies)
-5. Valid session cookie → allow
-6. Else → HTML login page (password and/or Sign in with Vercel)
+4. Valid bypass header → allow this request
+5. Valid bypass query param → set `__becklyn_dp_session`, redirect to the cleaned URL
+6. Valid session or bypass cookie → allow
+7. Else → HTML login page (password and/or Sign in with Vercel)
 
 Session cookie: `__becklyn_dp_session` (HMAC-SHA256, 14 days by default).
 

package/dist/cjs/handler.d.ts.map

@@ -1 +1 @@
-{"version":3,"file":"handler.d.ts","sourceRoot":"","sources":["../../src/handler.ts"],"names":[],"mappings":"AAyBA,OAAO,KAAK,EAA8B,2BAA2B,EAAE,MAAM,SAAS,CAAC;AA4RvF;;GAEG;AACH,wBAAsB,0BAA0B,CAC5C,OAAO,EAAE,OAAO,EAChB,OAAO,GAAE,2BAAgC,GAC1C,OAAO,CAAC,QAAQ,GAAG,IAAI,CAAC,CAqD1B"}
+{"version":3,"file":"handler.d.ts","sourceRoot":"","sources":["../../src/handler.ts"],"names":[],"mappings":"AA0BA,OAAO,KAAK,EAA8B,2BAA2B,EAAE,MAAM,SAAS,CAAC;AAqSvF;;GAEG;AACH,wBAAsB,0BAA0B,CAC5C,OAAO,EAAE,OAAO,EAChB,OAAO,GAAE,2BAAgC,GAC1C,OAAO,CAAC,QAAQ,GAAG,IAAI,CAAC,CAoD1B"}

package/dist/cjs/handler.js

@@ -37,11 +37,20 @@ function redirect(request, location, status = 302) {
         },
     });
 }
+/**
+ * Prefer the dedicated session secret; fall back to the automation bypass secret
+ * so a query-param bypass can still persist `__becklyn_dp_session` when no
+ * username/password or explicit HMAC secret is configured.
+ */
+function signingSecret(config) {
+    return config.secret ?? config.bypassSecret;
+}
 async function attachSession(response, config, method, subject, secure) {
-    if (!config.secret) {
+    const secret = signingSecret(config);
+    if (!secret) {
         return response;
     }
-    const token = await (0, session_1.createSessionToken)(config.secret, method, subject, config.sessionTtlSeconds);
+    const token = await (0, session_1.createSessionToken)(secret, method, subject, config.sessionTtlSeconds);
     const opts = (0, session_1.sessionCookieOptions)(config.sessionTtlSeconds, secure);
     (0, vercel_oauth_1.appendSetCookie)(response, constants_1.SESSION_COOKIE_NAME, token, opts);
     return response;
@@ -57,10 +66,12 @@ async function handleBypass(request, config) {
     const setCookieMode = (0, bypass_1.shouldSetBypassCookie)(request);
     const url = new URL(request.url);
     const hadQueryBypass = url.searchParams.has(constants_1.BYPASS_HEADER);
-    const hadSetCookieQuery = url.searchParams.has("x-vercel-set-bypass-cookie");
+    const hadSetCookieQuery = url.searchParams.has(constants_1.SET_BYPASS_COOKIE_HEADER);
+    // Query-param bypass (and the Vercel set-cookie helper) persist auth, then
+    // strip secrets from the URL. Header-only automation stays one-shot.
     if (hadQueryBypass || hadSetCookieQuery || setCookieMode) {
         url.searchParams.delete(constants_1.BYPASS_HEADER);
-        url.searchParams.delete("x-vercel-set-bypass-cookie");
+        url.searchParams.delete(constants_1.SET_BYPASS_COOKIE_HEADER);
         const response = redirect(request, url.pathname + url.search + url.hash);
         const secure = isSecureRequest(request);
         if (setCookieMode || hadSetCookieQuery) {
@@ -72,6 +83,7 @@ async function handleBypass(request, config) {
                 sameSite: setCookieMode === "samesitenone" ? "none" : "lax",
             });
         }
+        // Always persist a signed session when the bypass secret arrived via query.
         await attachSession(response, config, "bypass", "automation", secure);
         return { kind: "respond", response };
     }
@@ -233,8 +245,9 @@ async function handleDeploymentProtection(request, options = {}) {
     if (bypass.kind === "allow") {
         return null;
     }
-    if (config.secret) {
-        const session = await (0, session_1.verifySessionToken)(config.secret, (0, vercel_oauth_1.readCookie)(request, constants_1.SESSION_COOKIE_NAME));
+    const secret = signingSecret(config);
+    if (secret) {
+        const session = await (0, session_1.verifySessionToken)(secret, (0, vercel_oauth_1.readCookie)(request, constants_1.SESSION_COOKIE_NAME));
         if (session) {
             return null;
         }

package/dist/cjs/middleware.d.ts.map

@@ -1 +1 @@
-{"version":3,"file":"middleware.d.ts","sourceRoot":"","sources":["../../src/middleware.ts"],"names":[],"mappings":"AAAA,OAAO,EAAE,KAAK,WAAW,EAAE,YAAY,EAAE,MAAM,aAAa,CAAC;AAE7D,OAAO,KAAK,EAAE,2BAA2B,EAAE,MAAM,SAAS,CAAC;AAE3D,KAAK,cAAc,GAAG,CAClB,OAAO,EAAE,WAAW,EACpB,KAAK,CAAC,EAAE,OAAO,KAEb,QAAQ,GACR,YAAY,GACZ,OAAO,CAAC,QAAQ,GAAG,YAAY,GAAG,SAAS,GAAG,IAAI,CAAC,GACnD,SAAS,GACT,IAAI,CAAC;AAEX,MAAM,MAAM,4BAA4B,GAClC,EAAE,GACF,CAAC,2BAA2B,CAAC,GAC7B,CAAC,cAAc,CAAC,GAChB,CAAC,cAAc,EAAE,2BAA2B,CAAC,CAAC;AA8DpD;;;;;;;;;;;;;;;;;;;;;;;;;;;;GA4BG;AACH,wBAAgB,wBAAwB,CAAC,GAAG,IAAI,EAAE,4BAA4B,IAgBtE,SAAS,WAAW,EACpB,QAAQ,OAAO,KAChB,OAAO,CAAC,QAAQ,GAAG,YAAY,CAAC,CActC"}
+{"version":3,"file":"middleware.d.ts","sourceRoot":"","sources":["../../src/middleware.ts"],"names":[],"mappings":"AAAA,OAAO,EAAE,KAAK,WAAW,EAAE,YAAY,EAAE,MAAM,aAAa,CAAC;AAE7D,OAAO,KAAK,EAAE,2BAA2B,EAAE,MAAM,SAAS,CAAC;AAE3D,KAAK,cAAc,GAAG,CAClB,OAAO,EAAE,WAAW,EACpB,KAAK,CAAC,EAAE,OAAO,KAEb,QAAQ,GACR,YAAY,GACZ,OAAO,CAAC,QAAQ,GAAG,YAAY,GAAG,SAAS,GAAG,IAAI,CAAC,GACnD,SAAS,GACT,IAAI,CAAC;AAEX,MAAM,MAAM,4BAA4B,GAClC,EAAE,GACF,CAAC,2BAA2B,CAAC,GAC7B,CAAC,cAAc,CAAC,GAChB,CAAC,cAAc,EAAE,2BAA2B,CAAC,CAAC;AA8JpD;;;;;;;;;;;;;;;;;;;;;;;;;;;;GA4BG;AACH,wBAAgB,wBAAwB,CAAC,GAAG,IAAI,EAAE,4BAA4B,IAgBtE,SAAS,WAAW,EACpB,QAAQ,OAAO,KAChB,OAAO,CAAC,QAAQ,GAAG,YAAY,CAAC,CActC"}

package/dist/cjs/middleware.js

@@ -9,12 +9,95 @@ function isOptions(value) {
         !Array.isArray(value) &&
         typeof value !== "function");
 }
+function decodeCookieValue(value) {
+    try {
+        return decodeURIComponent(value);
+    }
+    catch {
+        return value;
+    }
+}
+function parseSetCookie(header) {
+    const parts = header
+        .split(";")
+        .map(part => part.trim())
+        .filter(Boolean);
+    const first = parts.shift();
+    if (!first) {
+        return null;
+    }
+    const separator = first.indexOf("=");
+    if (separator <= 0) {
+        return null;
+    }
+    const parsed = {
+        name: first.slice(0, separator),
+        value: decodeCookieValue(first.slice(separator + 1)),
+    };
+    for (const part of parts) {
+        const [rawKey, ...rest] = part.split("=");
+        const key = rawKey?.toLowerCase();
+        const attrValue = rest.join("=");
+        if (key === "httponly") {
+            parsed.httpOnly = true;
+        }
+        else if (key === "secure") {
+            parsed.secure = true;
+        }
+        else if (key === "path") {
+            parsed.path = attrValue;
+        }
+        else if (key === "max-age") {
+            const maxAge = Number(attrValue);
+            if (!Number.isNaN(maxAge)) {
+                parsed.maxAge = maxAge;
+            }
+        }
+        else if (key === "samesite") {
+            const sameSite = attrValue.toLowerCase();
+            if (sameSite === "lax" || sameSite === "strict" || sameSite === "none") {
+                parsed.sameSite = sameSite;
+            }
+        }
+    }
+    return parsed;
+}
+function readSetCookieHeaders(headers) {
+    if (typeof headers.getSetCookie === "function") {
+        const cookies = headers.getSetCookie();
+        if (cookies.length > 0) {
+            return cookies;
+        }
+    }
+    const single = headers.get("set-cookie");
+    return single ? [single] : [];
+}
+/**
+ * Next.js middleware only reliably applies cookies set via `NextResponse.cookies`.
+ * Copying raw `Set-Cookie` headers onto a redirect is ignored by the runtime.
+ */
+function applyCookies(from, to) {
+    for (const header of readSetCookieHeaders(from.headers)) {
+        const cookie = parseSetCookie(header);
+        if (!cookie) {
+            continue;
+        }
+        to.cookies.set(cookie.name, cookie.value, {
+            httpOnly: cookie.httpOnly,
+            secure: cookie.secure,
+            path: cookie.path,
+            maxAge: cookie.maxAge,
+            sameSite: cookie.sameSite,
+        });
+    }
+}
 function toNextResponse(request, response) {
     const location = response.headers.get("Location");
     if (location && response.status >= 300 && response.status < 400) {
         // Always resolve against the incoming request so relative Locations never reach Next.
         const redirectResponse = server_1.NextResponse.redirect(new URL(location, request.url), response.status);
         copyHeaders(response, redirectResponse, /* skipLocation */ true);
+        applyCookies(response, redirectResponse);
         return redirectResponse;
     }
     const nextResponse = new server_1.NextResponse(response.body, {
@@ -22,22 +105,14 @@ function toNextResponse(request, response) {
         statusText: response.statusText,
     });
     copyHeaders(response, nextResponse, false);
+    applyCookies(response, nextResponse);
     return nextResponse;
 }
 function copyHeaders(from, to, skipLocation) {
-    const setCookies = typeof from.headers.getSetCookie === "function" ? from.headers.getSetCookie() : [];
-    if (setCookies.length > 0) {
-        for (const cookie of setCookies) {
-            to.headers.append("Set-Cookie", cookie);
-        }
-    }
     from.headers.forEach((value, key) => {
         const lower = key.toLowerCase();
         if (lower === "set-cookie") {
-            // Already copied via getSetCookie when available; fall back otherwise.
-            if (setCookies.length === 0) {
-                to.headers.append("Set-Cookie", value);
-            }
+            // Applied via NextResponse.cookies so the middleware runtime honors them.
             return;
         }
         if (skipLocation && lower === "location") {

package/dist/edge.mjs

@@ -728,16 +728,15 @@ function redirect(request, location, status = 302) {
     }
   });
 }
+function signingSecret(config) {
+  return config.secret ?? config.bypassSecret;
+}
 async function attachSession(response, config, method, subject, secure) {
-  if (!config.secret) {
+  const secret = signingSecret(config);
+  if (!secret) {
     return response;
   }
-  const token = await createSessionToken(
-    config.secret,
-    method,
-    subject,
-    config.sessionTtlSeconds
-  );
+  const token = await createSessionToken(secret, method, subject, config.sessionTtlSeconds);
   const opts = sessionCookieOptions(config.sessionTtlSeconds, secure);
   appendSetCookie(response, SESSION_COOKIE_NAME, token, opts);
   return response;
@@ -753,10 +752,10 @@ async function handleBypass(request, config) {
   const setCookieMode = shouldSetBypassCookie(request);
   const url = new URL(request.url);
   const hadQueryBypass = url.searchParams.has(BYPASS_HEADER);
-  const hadSetCookieQuery = url.searchParams.has("x-vercel-set-bypass-cookie");
+  const hadSetCookieQuery = url.searchParams.has(SET_BYPASS_COOKIE_HEADER);
   if (hadQueryBypass || hadSetCookieQuery || setCookieMode) {
     url.searchParams.delete(BYPASS_HEADER);
-    url.searchParams.delete("x-vercel-set-bypass-cookie");
+    url.searchParams.delete(SET_BYPASS_COOKIE_HEADER);
     const response = redirect(request, url.pathname + url.search + url.hash);
     const secure = isSecureRequest(request);
     if (setCookieMode || hadSetCookieQuery) {
@@ -928,11 +927,9 @@ async function handleDeploymentProtection(request, options = {}) {
   if (bypass.kind === "allow") {
     return null;
   }
-  if (config.secret) {
-    const session = await verifySessionToken(
-      config.secret,
-      readCookie(request, SESSION_COOKIE_NAME)
-    );
+  const secret = signingSecret(config);
+  if (secret) {
+    const session = await verifySessionToken(secret, readCookie(request, SESSION_COOKIE_NAME));
     if (session) {
       return null;
     }

package/dist/es/handler.d.ts.map

@@ -1 +1 @@
-{"version":3,"file":"handler.d.ts","sourceRoot":"","sources":["../../src/handler.ts"],"names":[],"mappings":"AAyBA,OAAO,KAAK,EAA8B,2BAA2B,EAAE,MAAM,SAAS,CAAC;AA4RvF;;GAEG;AACH,wBAAsB,0BAA0B,CAC5C,OAAO,EAAE,OAAO,EAChB,OAAO,GAAE,2BAAgC,GAC1C,OAAO,CAAC,QAAQ,GAAG,IAAI,CAAC,CAqD1B"}
+{"version":3,"file":"handler.d.ts","sourceRoot":"","sources":["../../src/handler.ts"],"names":[],"mappings":"AA0BA,OAAO,KAAK,EAA8B,2BAA2B,EAAE,MAAM,SAAS,CAAC;AAqSvF;;GAEG;AACH,wBAAsB,0BAA0B,CAC5C,OAAO,EAAE,OAAO,EAChB,OAAO,GAAE,2BAAgC,GAC1C,OAAO,CAAC,QAAQ,GAAG,IAAI,CAAC,CAoD1B"}

package/dist/es/handler.js

@@ -1,6 +1,6 @@
 import { isValidBypass, readBypassCookie, readBypassToken, shouldSetBypassCookie } from "./bypass";
 import { hasPasswordAuth, hasVercelAuth, hasVercelDirectAuth, hasVercelProxyAuth, isProtectionActive, resolveConfig, } from "./config";
-import { BYPASS_COOKIE_NAME, BYPASS_HEADER, OAUTH_NONCE_COOKIE, OAUTH_RETURN_COOKIE, OAUTH_VERIFIER_COOKIE, SESSION_COOKIE_NAME, VERCEL_AUTHORIZE_PATH, VERCEL_CALLBACK_PATH, } from "./constants";
+import { BYPASS_COOKIE_NAME, BYPASS_HEADER, OAUTH_NONCE_COOKIE, OAUTH_RETURN_COOKIE, OAUTH_VERIFIER_COOKIE, SESSION_COOKIE_NAME, SET_BYPASS_COOKIE_HEADER, VERCEL_AUTHORIZE_PATH, VERCEL_CALLBACK_PATH, } from "./constants";
 import { timingSafeEqualString } from "./crypto";
 import { buildProxyStartUrl, verifyHandoffToken } from "./handoff";
 import { renderLoginPage } from "./login-page";
@@ -34,11 +34,20 @@ function redirect(request, location, status = 302) {
         },
     });
 }
+/**
+ * Prefer the dedicated session secret; fall back to the automation bypass secret
+ * so a query-param bypass can still persist `__becklyn_dp_session` when no
+ * username/password or explicit HMAC secret is configured.
+ */
+function signingSecret(config) {
+    return config.secret ?? config.bypassSecret;
+}
 async function attachSession(response, config, method, subject, secure) {
-    if (!config.secret) {
+    const secret = signingSecret(config);
+    if (!secret) {
         return response;
     }
-    const token = await createSessionToken(config.secret, method, subject, config.sessionTtlSeconds);
+    const token = await createSessionToken(secret, method, subject, config.sessionTtlSeconds);
     const opts = sessionCookieOptions(config.sessionTtlSeconds, secure);
     appendSetCookie(response, SESSION_COOKIE_NAME, token, opts);
     return response;
@@ -54,10 +63,12 @@ async function handleBypass(request, config) {
     const setCookieMode = shouldSetBypassCookie(request);
     const url = new URL(request.url);
     const hadQueryBypass = url.searchParams.has(BYPASS_HEADER);
-    const hadSetCookieQuery = url.searchParams.has("x-vercel-set-bypass-cookie");
+    const hadSetCookieQuery = url.searchParams.has(SET_BYPASS_COOKIE_HEADER);
+    // Query-param bypass (and the Vercel set-cookie helper) persist auth, then
+    // strip secrets from the URL. Header-only automation stays one-shot.
     if (hadQueryBypass || hadSetCookieQuery || setCookieMode) {
         url.searchParams.delete(BYPASS_HEADER);
-        url.searchParams.delete("x-vercel-set-bypass-cookie");
+        url.searchParams.delete(SET_BYPASS_COOKIE_HEADER);
         const response = redirect(request, url.pathname + url.search + url.hash);
         const secure = isSecureRequest(request);
         if (setCookieMode || hadSetCookieQuery) {
@@ -69,6 +80,7 @@ async function handleBypass(request, config) {
                 sameSite: setCookieMode === "samesitenone" ? "none" : "lax",
             });
         }
+        // Always persist a signed session when the bypass secret arrived via query.
         await attachSession(response, config, "bypass", "automation", secure);
         return { kind: "respond", response };
     }
@@ -230,8 +242,9 @@ export async function handleDeploymentProtection(request, options = {}) {
     if (bypass.kind === "allow") {
         return null;
     }
-    if (config.secret) {
-        const session = await verifySessionToken(config.secret, readCookie(request, SESSION_COOKIE_NAME));
+    const secret = signingSecret(config);
+    if (secret) {
+        const session = await verifySessionToken(secret, readCookie(request, SESSION_COOKIE_NAME));
         if (session) {
             return null;
         }

package/dist/es/middleware.d.ts.map

@@ -1 +1 @@
-{"version":3,"file":"middleware.d.ts","sourceRoot":"","sources":["../../src/middleware.ts"],"names":[],"mappings":"AAAA,OAAO,EAAE,KAAK,WAAW,EAAE,YAAY,EAAE,MAAM,aAAa,CAAC;AAE7D,OAAO,KAAK,EAAE,2BAA2B,EAAE,MAAM,SAAS,CAAC;AAE3D,KAAK,cAAc,GAAG,CAClB,OAAO,EAAE,WAAW,EACpB,KAAK,CAAC,EAAE,OAAO,KAEb,QAAQ,GACR,YAAY,GACZ,OAAO,CAAC,QAAQ,GAAG,YAAY,GAAG,SAAS,GAAG,IAAI,CAAC,GACnD,SAAS,GACT,IAAI,CAAC;AAEX,MAAM,MAAM,4BAA4B,GAClC,EAAE,GACF,CAAC,2BAA2B,CAAC,GAC7B,CAAC,cAAc,CAAC,GAChB,CAAC,cAAc,EAAE,2BAA2B,CAAC,CAAC;AA8DpD;;;;;;;;;;;;;;;;;;;;;;;;;;;;GA4BG;AACH,wBAAgB,wBAAwB,CAAC,GAAG,IAAI,EAAE,4BAA4B,IAgBtE,SAAS,WAAW,EACpB,QAAQ,OAAO,KAChB,OAAO,CAAC,QAAQ,GAAG,YAAY,CAAC,CActC"}
+{"version":3,"file":"middleware.d.ts","sourceRoot":"","sources":["../../src/middleware.ts"],"names":[],"mappings":"AAAA,OAAO,EAAE,KAAK,WAAW,EAAE,YAAY,EAAE,MAAM,aAAa,CAAC;AAE7D,OAAO,KAAK,EAAE,2BAA2B,EAAE,MAAM,SAAS,CAAC;AAE3D,KAAK,cAAc,GAAG,CAClB,OAAO,EAAE,WAAW,EACpB,KAAK,CAAC,EAAE,OAAO,KAEb,QAAQ,GACR,YAAY,GACZ,OAAO,CAAC,QAAQ,GAAG,YAAY,GAAG,SAAS,GAAG,IAAI,CAAC,GACnD,SAAS,GACT,IAAI,CAAC;AAEX,MAAM,MAAM,4BAA4B,GAClC,EAAE,GACF,CAAC,2BAA2B,CAAC,GAC7B,CAAC,cAAc,CAAC,GAChB,CAAC,cAAc,EAAE,2BAA2B,CAAC,CAAC;AA8JpD;;;;;;;;;;;;;;;;;;;;;;;;;;;;GA4BG;AACH,wBAAgB,wBAAwB,CAAC,GAAG,IAAI,EAAE,4BAA4B,IAgBtE,SAAS,WAAW,EACpB,QAAQ,OAAO,KAChB,OAAO,CAAC,QAAQ,GAAG,YAAY,CAAC,CActC"}

package/dist/es/middleware.js

@@ -6,12 +6,95 @@ function isOptions(value) {
         !Array.isArray(value) &&
         typeof value !== "function");
 }
+function decodeCookieValue(value) {
+    try {
+        return decodeURIComponent(value);
+    }
+    catch {
+        return value;
+    }
+}
+function parseSetCookie(header) {
+    const parts = header
+        .split(";")
+        .map(part => part.trim())
+        .filter(Boolean);
+    const first = parts.shift();
+    if (!first) {
+        return null;
+    }
+    const separator = first.indexOf("=");
+    if (separator <= 0) {
+        return null;
+    }
+    const parsed = {
+        name: first.slice(0, separator),
+        value: decodeCookieValue(first.slice(separator + 1)),
+    };
+    for (const part of parts) {
+        const [rawKey, ...rest] = part.split("=");
+        const key = rawKey?.toLowerCase();
+        const attrValue = rest.join("=");
+        if (key === "httponly") {
+            parsed.httpOnly = true;
+        }
+        else if (key === "secure") {
+            parsed.secure = true;
+        }
+        else if (key === "path") {
+            parsed.path = attrValue;
+        }
+        else if (key === "max-age") {
+            const maxAge = Number(attrValue);
+            if (!Number.isNaN(maxAge)) {
+                parsed.maxAge = maxAge;
+            }
+        }
+        else if (key === "samesite") {
+            const sameSite = attrValue.toLowerCase();
+            if (sameSite === "lax" || sameSite === "strict" || sameSite === "none") {
+                parsed.sameSite = sameSite;
+            }
+        }
+    }
+    return parsed;
+}
+function readSetCookieHeaders(headers) {
+    if (typeof headers.getSetCookie === "function") {
+        const cookies = headers.getSetCookie();
+        if (cookies.length > 0) {
+            return cookies;
+        }
+    }
+    const single = headers.get("set-cookie");
+    return single ? [single] : [];
+}
+/**
+ * Next.js middleware only reliably applies cookies set via `NextResponse.cookies`.
+ * Copying raw `Set-Cookie` headers onto a redirect is ignored by the runtime.
+ */
+function applyCookies(from, to) {
+    for (const header of readSetCookieHeaders(from.headers)) {
+        const cookie = parseSetCookie(header);
+        if (!cookie) {
+            continue;
+        }
+        to.cookies.set(cookie.name, cookie.value, {
+            httpOnly: cookie.httpOnly,
+            secure: cookie.secure,
+            path: cookie.path,
+            maxAge: cookie.maxAge,
+            sameSite: cookie.sameSite,
+        });
+    }
+}
 function toNextResponse(request, response) {
     const location = response.headers.get("Location");
     if (location && response.status >= 300 && response.status < 400) {
         // Always resolve against the incoming request so relative Locations never reach Next.
         const redirectResponse = NextResponse.redirect(new URL(location, request.url), response.status);
         copyHeaders(response, redirectResponse, /* skipLocation */ true);
+        applyCookies(response, redirectResponse);
         return redirectResponse;
     }
     const nextResponse = new NextResponse(response.body, {
@@ -19,22 +102,14 @@ function toNextResponse(request, response) {
         statusText: response.statusText,
     });
     copyHeaders(response, nextResponse, false);
+    applyCookies(response, nextResponse);
     return nextResponse;
 }
 function copyHeaders(from, to, skipLocation) {
-    const setCookies = typeof from.headers.getSetCookie === "function" ? from.headers.getSetCookie() : [];
-    if (setCookies.length > 0) {
-        for (const cookie of setCookies) {
-            to.headers.append("Set-Cookie", cookie);
-        }
-    }
     from.headers.forEach((value, key) => {
         const lower = key.toLowerCase();
         if (lower === "set-cookie") {
-            // Already copied via getSetCookie when available; fall back otherwise.
-            if (setCookies.length === 0) {
-                to.headers.append("Set-Cookie", value);
-            }
+            // Applied via NextResponse.cookies so the middleware runtime honors them.
             return;
         }
         if (skipLocation && lower === "location") {

package/dist/storybook.mjs

@@ -728,16 +728,15 @@ function redirect(request, location, status = 302) {
     }
   });
 }
+function signingSecret(config) {
+  return config.secret ?? config.bypassSecret;
+}
 async function attachSession(response, config, method, subject, secure) {
-  if (!config.secret) {
+  const secret = signingSecret(config);
+  if (!secret) {
     return response;
   }
-  const token = await createSessionToken(
-    config.secret,
-    method,
-    subject,
-    config.sessionTtlSeconds
-  );
+  const token = await createSessionToken(secret, method, subject, config.sessionTtlSeconds);
   const opts = sessionCookieOptions(config.sessionTtlSeconds, secure);
   appendSetCookie(response, SESSION_COOKIE_NAME, token, opts);
   return response;
@@ -753,10 +752,10 @@ async function handleBypass(request, config) {
   const setCookieMode = shouldSetBypassCookie(request);
   const url = new URL(request.url);
   const hadQueryBypass = url.searchParams.has(BYPASS_HEADER);
-  const hadSetCookieQuery = url.searchParams.has("x-vercel-set-bypass-cookie");
+  const hadSetCookieQuery = url.searchParams.has(SET_BYPASS_COOKIE_HEADER);
   if (hadQueryBypass || hadSetCookieQuery || setCookieMode) {
     url.searchParams.delete(BYPASS_HEADER);
-    url.searchParams.delete("x-vercel-set-bypass-cookie");
+    url.searchParams.delete(SET_BYPASS_COOKIE_HEADER);
     const response = redirect(request, url.pathname + url.search + url.hash);
     const secure = isSecureRequest(request);
     if (setCookieMode || hadSetCookieQuery) {
@@ -928,11 +927,9 @@ async function handleDeploymentProtection(request, options = {}) {
   if (bypass.kind === "allow") {
     return null;
   }
-  if (config.secret) {
-    const session = await verifySessionToken(
-      config.secret,
-      readCookie(request, SESSION_COOKIE_NAME)
-    );
+  const secret = signingSecret(config);
+  if (secret) {
+    const session = await verifySessionToken(secret, readCookie(request, SESSION_COOKIE_NAME));
     if (session) {
       return null;
     }

package/package.json

@@ -1,6 +1,6 @@
 {
     "name": "@becklyn/deployment-protection",
-    "version": "0.4.1",
+    "version": "0.4.2",
     "license": "MIT",
     "description": "Simple shared username/password + Sign in with Vercel gate for Next.js and Storybook deployments",
     "homepage": "https://github.com/Becklyn-Studios/ts-libs/tree/main/packages/deployment-protection",
@@ -11,9 +11,9 @@
     "scripts": {
         "lint": "eslint . --max-warnings 0 && prettier --check \"./**/*.{ts,tsx,md,json,mjs}\"",
         "fix": "eslint . --fix && prettier --write \"./**/*.{ts,tsx,md,json,mjs}\"",
-        "test": "npm run build && vitest run",
+        "test": "vitest run",
         "build": "rm -rf dist && tsc -p tsconfig-es.json && tsc -p tsconfig-cjs.json && node ./scripts/build-edge-bundles.mjs",
-        "prepublishOnly": "npm run lint && npm run test"
+        "prepublishOnly": "npm run lint && npm run build && npm run test"
     },
     "devDependencies": {
         "@becklyn/eslint": "*",