@becklyn/deployment-protection 0.4.1 → 0.4.3

package/README.md

@@ -214,10 +214,20 @@ x-vercel-protection-bypass: <VERCEL_AUTOMATION_BYPASS_SECRET>
 
 Or query:
 
+```text
+https://app.example/?x-vercel-protection-bypass=<secret>
+```
+
+A valid bypass query param redirects to the same path without the secret and sets the signed `__becklyn_dp_session` cookie, so later requests stay authenticated. You do not need `x-vercel-set-bypass-cookie` for that.
+
+Optional Vercel-compatible helper — also persist the raw bypass secret as `__becklyn_dp_bypass`:
+
 ```text
 https://app.example/?x-vercel-protection-bypass=<secret>&x-vercel-set-bypass-cookie=true
 ```
 
+The header form stays one-shot (no cookies) so CI/Playwright can send it on each request.
+
 When platform Deployment Protection is disabled, **this package** enforces the bypass secret so CI/Playwright keep working the same way.
 
 ## Behaviour
@@ -225,11 +235,12 @@ When platform Deployment Protection is disabled, **this package** enforces the b
 1. Disabled / misconfigured → pass through
 2. Internal Vercel OAuth routes → handled by the package (proxy start or direct OAuth / handoff)
 3. Login form `POST` → validate username/password, set signed HttpOnly session cookie
-4. Valid bypass header/query/cookie → allow (optionally set cookies)
-5. Valid session cookie → allow
-6. Else → HTML login page (password and/or Sign in with Vercel)
+4. Valid bypass header → allow this request
+5. Valid bypass query param → set `__becklyn_dp_session`, redirect to the cleaned URL
+6. Valid session or bypass cookie → allow
+7. Else → HTML login page (password and/or Sign in with Vercel)
 
-Session cookie: `__becklyn_dp_session` (HMAC-SHA256, 14 days by default).
+Session cookie: `__becklyn_dp_session` (HMAC-SHA256, 14 days by default). On HTTPS it is `HttpOnly; Secure; SameSite=None` so a logged-in session is sent when the preview is embedded in a third-party iframe (e.g. Contentful live preview). On HTTP (localhost) it stays `SameSite=Lax` because browsers reject `SameSite=None` without `Secure`.
 
 ## Disable without code changes
 
@@ -272,6 +283,8 @@ Recommended matcher (must be pasted as a string literal in your middleware/proxy
 - Do not put the raw handoff secret in query strings — only signatures/tokens.
 - Turn off paid Vercel Password Protection / seat-heavy sharing once this is live; keep `VERCEL_AUTOMATION_BYPASS_SECRET` configured for tooling.
 - Middleware is a convenience edge check — do not treat it as the only control for highly sensitive data.
+- `__becklyn_dp_session` is `SameSite=None` on HTTPS so third-party iframes can send it. That cookie only decides whether the preview may load; apps must still CSRF-protect their own state-changing endpoints. OAuth state/PKCE cookies stay `SameSite=Lax`.
+- Safari (and some Chrome third-party-cookie settings) may still block unpartitioned third-party cookies even with `SameSite=None`.
 
 ## License
 

package/dist/cjs/handler.d.ts.map

@@ -1 +1 @@
-{"version":3,"file":"handler.d.ts","sourceRoot":"","sources":["../../src/handler.ts"],"names":[],"mappings":"AAyBA,OAAO,KAAK,EAA8B,2BAA2B,EAAE,MAAM,SAAS,CAAC;AA4RvF;;GAEG;AACH,wBAAsB,0BAA0B,CAC5C,OAAO,EAAE,OAAO,EAChB,OAAO,GAAE,2BAAgC,GAC1C,OAAO,CAAC,QAAQ,GAAG,IAAI,CAAC,CAqD1B"}
+{"version":3,"file":"handler.d.ts","sourceRoot":"","sources":["../../src/handler.ts"],"names":[],"mappings":"AA0BA,OAAO,KAAK,EAA8B,2BAA2B,EAAE,MAAM,SAAS,CAAC;AAqSvF;;GAEG;AACH,wBAAsB,0BAA0B,CAC5C,OAAO,EAAE,OAAO,EAChB,OAAO,GAAE,2BAAgC,GAC1C,OAAO,CAAC,QAAQ,GAAG,IAAI,CAAC,CAoD1B"}

package/dist/cjs/handler.js

@@ -37,11 +37,20 @@ function redirect(request, location, status = 302) {
         },
     });
 }
+/**
+ * Prefer the dedicated session secret; fall back to the automation bypass secret
+ * so a query-param bypass can still persist `__becklyn_dp_session` when no
+ * username/password or explicit HMAC secret is configured.
+ */
+function signingSecret(config) {
+    return config.secret ?? config.bypassSecret;
+}
 async function attachSession(response, config, method, subject, secure) {
-    if (!config.secret) {
+    const secret = signingSecret(config);
+    if (!secret) {
         return response;
     }
-    const token = await (0, session_1.createSessionToken)(config.secret, method, subject, config.sessionTtlSeconds);
+    const token = await (0, session_1.createSessionToken)(secret, method, subject, config.sessionTtlSeconds);
     const opts = (0, session_1.sessionCookieOptions)(config.sessionTtlSeconds, secure);
     (0, vercel_oauth_1.appendSetCookie)(response, constants_1.SESSION_COOKIE_NAME, token, opts);
     return response;
@@ -57,10 +66,12 @@ async function handleBypass(request, config) {
     const setCookieMode = (0, bypass_1.shouldSetBypassCookie)(request);
     const url = new URL(request.url);
     const hadQueryBypass = url.searchParams.has(constants_1.BYPASS_HEADER);
-    const hadSetCookieQuery = url.searchParams.has("x-vercel-set-bypass-cookie");
+    const hadSetCookieQuery = url.searchParams.has(constants_1.SET_BYPASS_COOKIE_HEADER);
+    // Query-param bypass (and the Vercel set-cookie helper) persist auth, then
+    // strip secrets from the URL. Header-only automation stays one-shot.
     if (hadQueryBypass || hadSetCookieQuery || setCookieMode) {
         url.searchParams.delete(constants_1.BYPASS_HEADER);
-        url.searchParams.delete("x-vercel-set-bypass-cookie");
+        url.searchParams.delete(constants_1.SET_BYPASS_COOKIE_HEADER);
         const response = redirect(request, url.pathname + url.search + url.hash);
         const secure = isSecureRequest(request);
         if (setCookieMode || hadSetCookieQuery) {
@@ -72,6 +83,7 @@ async function handleBypass(request, config) {
                 sameSite: setCookieMode === "samesitenone" ? "none" : "lax",
             });
         }
+        // Always persist a signed session when the bypass secret arrived via query.
         await attachSession(response, config, "bypass", "automation", secure);
         return { kind: "respond", response };
     }
@@ -233,8 +245,9 @@ async function handleDeploymentProtection(request, options = {}) {
     if (bypass.kind === "allow") {
         return null;
     }
-    if (config.secret) {
-        const session = await (0, session_1.verifySessionToken)(config.secret, (0, vercel_oauth_1.readCookie)(request, constants_1.SESSION_COOKIE_NAME));
+    const secret = signingSecret(config);
+    if (secret) {
+        const session = await (0, session_1.verifySessionToken)(secret, (0, vercel_oauth_1.readCookie)(request, constants_1.SESSION_COOKIE_NAME));
         if (session) {
             return null;
         }

package/dist/cjs/middleware.d.ts.map

@@ -1 +1 @@
-{"version":3,"file":"middleware.d.ts","sourceRoot":"","sources":["../../src/middleware.ts"],"names":[],"mappings":"AAAA,OAAO,EAAE,KAAK,WAAW,EAAE,YAAY,EAAE,MAAM,aAAa,CAAC;AAE7D,OAAO,KAAK,EAAE,2BAA2B,EAAE,MAAM,SAAS,CAAC;AAE3D,KAAK,cAAc,GAAG,CAClB,OAAO,EAAE,WAAW,EACpB,KAAK,CAAC,EAAE,OAAO,KAEb,QAAQ,GACR,YAAY,GACZ,OAAO,CAAC,QAAQ,GAAG,YAAY,GAAG,SAAS,GAAG,IAAI,CAAC,GACnD,SAAS,GACT,IAAI,CAAC;AAEX,MAAM,MAAM,4BAA4B,GAClC,EAAE,GACF,CAAC,2BAA2B,CAAC,GAC7B,CAAC,cAAc,CAAC,GAChB,CAAC,cAAc,EAAE,2BAA2B,CAAC,CAAC;AA8DpD;;;;;;;;;;;;;;;;;;;;;;;;;;;;GA4BG;AACH,wBAAgB,wBAAwB,CAAC,GAAG,IAAI,EAAE,4BAA4B,IAgBtE,SAAS,WAAW,EACpB,QAAQ,OAAO,KAChB,OAAO,CAAC,QAAQ,GAAG,YAAY,CAAC,CActC"}
+{"version":3,"file":"middleware.d.ts","sourceRoot":"","sources":["../../src/middleware.ts"],"names":[],"mappings":"AAAA,OAAO,EAAE,KAAK,WAAW,EAAE,YAAY,EAAE,MAAM,aAAa,CAAC;AAE7D,OAAO,KAAK,EAAE,2BAA2B,EAAE,MAAM,SAAS,CAAC;AAE3D,KAAK,cAAc,GAAG,CAClB,OAAO,EAAE,WAAW,EACpB,KAAK,CAAC,EAAE,OAAO,KAEb,QAAQ,GACR,YAAY,GACZ,OAAO,CAAC,QAAQ,GAAG,YAAY,GAAG,SAAS,GAAG,IAAI,CAAC,GACnD,SAAS,GACT,IAAI,CAAC;AAEX,MAAM,MAAM,4BAA4B,GAClC,EAAE,GACF,CAAC,2BAA2B,CAAC,GAC7B,CAAC,cAAc,CAAC,GAChB,CAAC,cAAc,EAAE,2BAA2B,CAAC,CAAC;AA8JpD;;;;;;;;;;;;;;;;;;;;;;;;;;;;GA4BG;AACH,wBAAgB,wBAAwB,CAAC,GAAG,IAAI,EAAE,4BAA4B,IAgBtE,SAAS,WAAW,EACpB,QAAQ,OAAO,KAChB,OAAO,CAAC,QAAQ,GAAG,YAAY,CAAC,CActC"}

package/dist/cjs/middleware.js

@@ -9,12 +9,95 @@ function isOptions(value) {
         !Array.isArray(value) &&
         typeof value !== "function");
 }
+function decodeCookieValue(value) {
+    try {
+        return decodeURIComponent(value);
+    }
+    catch {
+        return value;
+    }
+}
+function parseSetCookie(header) {
+    const parts = header
+        .split(";")
+        .map(part => part.trim())
+        .filter(Boolean);
+    const first = parts.shift();
+    if (!first) {
+        return null;
+    }
+    const separator = first.indexOf("=");
+    if (separator <= 0) {
+        return null;
+    }
+    const parsed = {
+        name: first.slice(0, separator),
+        value: decodeCookieValue(first.slice(separator + 1)),
+    };
+    for (const part of parts) {
+        const [rawKey, ...rest] = part.split("=");
+        const key = rawKey?.toLowerCase();
+        const attrValue = rest.join("=");
+        if (key === "httponly") {
+            parsed.httpOnly = true;
+        }
+        else if (key === "secure") {
+            parsed.secure = true;
+        }
+        else if (key === "path") {
+            parsed.path = attrValue;
+        }
+        else if (key === "max-age") {
+            const maxAge = Number(attrValue);
+            if (!Number.isNaN(maxAge)) {
+                parsed.maxAge = maxAge;
+            }
+        }
+        else if (key === "samesite") {
+            const sameSite = attrValue.toLowerCase();
+            if (sameSite === "lax" || sameSite === "strict" || sameSite === "none") {
+                parsed.sameSite = sameSite;
+            }
+        }
+    }
+    return parsed;
+}
+function readSetCookieHeaders(headers) {
+    if (typeof headers.getSetCookie === "function") {
+        const cookies = headers.getSetCookie();
+        if (cookies.length > 0) {
+            return cookies;
+        }
+    }
+    const single = headers.get("set-cookie");
+    return single ? [single] : [];
+}
+/**
+ * Next.js middleware only reliably applies cookies set via `NextResponse.cookies`.
+ * Copying raw `Set-Cookie` headers onto a redirect is ignored by the runtime.
+ */
+function applyCookies(from, to) {
+    for (const header of readSetCookieHeaders(from.headers)) {
+        const cookie = parseSetCookie(header);
+        if (!cookie) {
+            continue;
+        }
+        to.cookies.set(cookie.name, cookie.value, {
+            httpOnly: cookie.httpOnly,
+            secure: cookie.secure,
+            path: cookie.path,
+            maxAge: cookie.maxAge,
+            sameSite: cookie.sameSite,
+        });
+    }
+}
 function toNextResponse(request, response) {
     const location = response.headers.get("Location");
     if (location && response.status >= 300 && response.status < 400) {
         // Always resolve against the incoming request so relative Locations never reach Next.
         const redirectResponse = server_1.NextResponse.redirect(new URL(location, request.url), response.status);
         copyHeaders(response, redirectResponse, /* skipLocation */ true);
+        applyCookies(response, redirectResponse);
         return redirectResponse;
     }
     const nextResponse = new server_1.NextResponse(response.body, {
@@ -22,22 +105,14 @@ function toNextResponse(request, response) {
         statusText: response.statusText,
     });
     copyHeaders(response, nextResponse, false);
+    applyCookies(response, nextResponse);
     return nextResponse;
 }
 function copyHeaders(from, to, skipLocation) {
-    const setCookies = typeof from.headers.getSetCookie === "function" ? from.headers.getSetCookie() : [];
-    if (setCookies.length > 0) {
-        for (const cookie of setCookies) {
-            to.headers.append("Set-Cookie", cookie);
-        }
-    }
     from.headers.forEach((value, key) => {
         const lower = key.toLowerCase();
         if (lower === "set-cookie") {
-            // Already copied via getSetCookie when available; fall back otherwise.
-            if (setCookies.length === 0) {
-                to.headers.append("Set-Cookie", value);
-            }
+            // Applied via NextResponse.cookies so the middleware runtime honors them.
             return;
         }
         if (skipLocation && lower === "location") {

package/dist/cjs/session.d.ts

@@ -3,7 +3,7 @@ export declare function createSessionToken(secret: string, method: AuthMethod, s
 export declare function verifySessionToken(secret: string, token: string | undefined | null): Promise<SessionPayload | null>;
 export declare function sessionCookieOptions(maxAge: number, secure: boolean): {
     httpOnly: boolean;
-    sameSite: "lax";
+    sameSite: "none" | "lax";
     secure: boolean;
     path: string;
     maxAge: number;

package/dist/cjs/session.d.ts.map

@@ -1 +1 @@
-{"version":3,"file":"session.d.ts","sourceRoot":"","sources":["../../src/session.ts"],"names":[],"mappings":"AACA,OAAO,KAAK,EAAE,UAAU,EAAE,cAAc,EAAE,MAAM,SAAS,CAAC;AAyB1D,wBAAsB,kBAAkB,CACpC,MAAM,EAAE,MAAM,EACd,MAAM,EAAE,UAAU,EAClB,OAAO,EAAE,MAAM,EACf,UAAU,EAAE,MAAM,GACnB,OAAO,CAAC,MAAM,CAAC,CASjB;AAED,wBAAsB,kBAAkB,CACpC,MAAM,EAAE,MAAM,EACd,KAAK,EAAE,MAAM,GAAG,SAAS,GAAG,IAAI,GACjC,OAAO,CAAC,cAAc,GAAG,IAAI,CAAC,CA4BhC;AAED,wBAAgB,oBAAoB,CAAC,MAAM,EAAE,MAAM,EAAE,MAAM,EAAE,OAAO;;;;;;EAQnE"}
+{"version":3,"file":"session.d.ts","sourceRoot":"","sources":["../../src/session.ts"],"names":[],"mappings":"AACA,OAAO,KAAK,EAAE,UAAU,EAAE,cAAc,EAAE,MAAM,SAAS,CAAC;AAyB1D,wBAAsB,kBAAkB,CACpC,MAAM,EAAE,MAAM,EACd,MAAM,EAAE,UAAU,EAClB,OAAO,EAAE,MAAM,EACf,UAAU,EAAE,MAAM,GACnB,OAAO,CAAC,MAAM,CAAC,CASjB;AAED,wBAAsB,kBAAkB,CACpC,MAAM,EAAE,MAAM,EACd,KAAK,EAAE,MAAM,GAAG,SAAS,GAAG,IAAI,GACjC,OAAO,CAAC,cAAc,GAAG,IAAI,CAAC,CA4BhC;AAED,wBAAgB,oBAAoB,CAAC,MAAM,EAAE,MAAM,EAAE,MAAM,EAAE,OAAO;;cAKrB,MAAM,GAAG,KAAK;;;;EAK5D"}

package/dist/cjs/session.js

@@ -56,7 +56,9 @@ async function verifySessionToken(secret, token) {
 function sessionCookieOptions(maxAge, secure) {
     return {
         httpOnly: true,
-        sameSite: "lax",
+        // SameSite=None; Secure is required for third-party iframes (e.g. Contentful).
+        // Browsers reject SameSite=None without Secure, so HTTP (localhost) stays Lax.
+        sameSite: (secure ? "none" : "lax"),
         secure,
         path: "/",
         maxAge,

package/dist/cjs/vercel-oauth.d.ts.map

@@ -1 +1 @@
-{"version":3,"file":"vercel-oauth.d.ts","sourceRoot":"","sources":["../../src/vercel-oauth.ts"],"names":[],"mappings":"AASA,OAAO,KAAK,EAAE,0BAA0B,EAAE,MAAM,SAAS,CAAC;AAE1D,MAAM,WAAW,mBAAmB;IAChC,YAAY,EAAE,MAAM,CAAC;IACrB,UAAU,EAAE,MAAM,CAAC;IACnB,QAAQ,CAAC,EAAE,MAAM,CAAC;IAClB,UAAU,EAAE,MAAM,CAAC;IACnB,KAAK,CAAC,EAAE,MAAM,CAAC;IACf,aAAa,CAAC,EAAE,MAAM,CAAC;CAC1B;AAED,MAAM,WAAW,cAAc;IAC3B,GAAG,CAAC,EAAE,MAAM,CAAC;IACb,IAAI,CAAC,EAAE,MAAM,CAAC;IACd,KAAK,CAAC,EAAE,MAAM,CAAC;IACf,kBAAkB,CAAC,EAAE,MAAM,CAAC;CAC/B;AAED,MAAM,WAAW,sBAAsB;IACnC;;;OAGG;IACH,YAAY,CAAC,EAAE,MAAM,CAAC;CACzB;AAgBD,wBAAsB,4BAA4B,CAC9C,OAAO,EAAE,OAAO,EAChB,MAAM,EAAE,0BAA0B,EAClC,QAAQ,EAAE,MAAM,EAChB,OAAO,CAAC,EAAE,sBAAsB,GACjC,OAAO,CAAC,QAAQ,CAAC,CAsCnB;AAED,wBAAsB,kBAAkB,CACpC,OAAO,EAAE,OAAO,EAChB,MAAM,EAAE,0BAA0B,EAClC,IAAI,EAAE,MAAM,EACZ,YAAY,EAAE,MAAM,EACpB,OAAO,CAAC,EAAE,sBAAsB,GACjC,OAAO,CAAC,mBAAmB,CAAC,CA6B9B;AAED,wBAAsB,mBAAmB,CAAC,WAAW,EAAE,MAAM,GAAG,OAAO,CAAC,cAAc,CAAC,CAYtF;AAED,wBAAgB,UAAU,CAAC,OAAO,EAAE,OAAO,EAAE,IAAI,EAAE,MAAM,GAAG,MAAM,GAAG,IAAI,CAgBxE;AAED,wBAAsB,gBAAgB,CAAC,OAAO,EAAE,OAAO,EAAE,KAAK,EAAE,MAAM,GAAG,IAAI,GAAG,OAAO,CAAC,OAAO,CAAC,CAO/F;AAED,wBAAgB,kBAAkB,CAAC,OAAO,EAAE,MAAM,GAAG,SAAS,GAAG,MAAM,GAAG,IAAI,CAqB7E;AAED,wBAAgB,iBAAiB,CAAC,QAAQ,EAAE,QAAQ,EAAE,MAAM,EAAE,OAAO,GAAG,IAAI,CAkB3E;AAED,wBAAgB,eAAe,CAC3B,QAAQ,EAAE,QAAQ,EAClB,IAAI,EAAE,MAAM,EACZ,KAAK,EAAE,MAAM,EACb,OAAO,EAAE;IACL,QAAQ,CAAC,EAAE,OAAO,CAAC;IACnB,MAAM,CAAC,EAAE,OAAO,CAAC;IACjB,QAAQ,CAAC,EAAE,KAAK,GAAG,QAAQ,GAAG,MAAM,CAAC;IACrC,IAAI,CAAC,EAAE,MAAM,CAAC;IACd,MAAM,CAAC,EAAE,MAAM,CAAC;CACnB,GACF,IAAI,CAwBN"}
+{"version":3,"file":"vercel-oauth.d.ts","sourceRoot":"","sources":["../../src/vercel-oauth.ts"],"names":[],"mappings":"AASA,OAAO,KAAK,EAAE,0BAA0B,EAAE,MAAM,SAAS,CAAC;AAE1D,MAAM,WAAW,mBAAmB;IAChC,YAAY,EAAE,MAAM,CAAC;IACrB,UAAU,EAAE,MAAM,CAAC;IACnB,QAAQ,CAAC,EAAE,MAAM,CAAC;IAClB,UAAU,EAAE,MAAM,CAAC;IACnB,KAAK,CAAC,EAAE,MAAM,CAAC;IACf,aAAa,CAAC,EAAE,MAAM,CAAC;CAC1B;AAED,MAAM,WAAW,cAAc;IAC3B,GAAG,CAAC,EAAE,MAAM,CAAC;IACb,IAAI,CAAC,EAAE,MAAM,CAAC;IACd,KAAK,CAAC,EAAE,MAAM,CAAC;IACf,kBAAkB,CAAC,EAAE,MAAM,CAAC;CAC/B;AAED,MAAM,WAAW,sBAAsB;IACnC;;;OAGG;IACH,YAAY,CAAC,EAAE,MAAM,CAAC;CACzB;AAgBD,wBAAsB,4BAA4B,CAC9C,OAAO,EAAE,OAAO,EAChB,MAAM,EAAE,0BAA0B,EAClC,QAAQ,EAAE,MAAM,EAChB,OAAO,CAAC,EAAE,sBAAsB,GACjC,OAAO,CAAC,QAAQ,CAAC,CAsCnB;AAED,wBAAsB,kBAAkB,CACpC,OAAO,EAAE,OAAO,EAChB,MAAM,EAAE,0BAA0B,EAClC,IAAI,EAAE,MAAM,EACZ,YAAY,EAAE,MAAM,EACpB,OAAO,CAAC,EAAE,sBAAsB,GACjC,OAAO,CAAC,mBAAmB,CAAC,CA6B9B;AAED,wBAAsB,mBAAmB,CAAC,WAAW,EAAE,MAAM,GAAG,OAAO,CAAC,cAAc,CAAC,CAYtF;AAED,wBAAgB,UAAU,CAAC,OAAO,EAAE,OAAO,EAAE,IAAI,EAAE,MAAM,GAAG,MAAM,GAAG,IAAI,CAgBxE;AAED,wBAAsB,gBAAgB,CAAC,OAAO,EAAE,OAAO,EAAE,KAAK,EAAE,MAAM,GAAG,IAAI,GAAG,OAAO,CAAC,OAAO,CAAC,CAO/F;AAED,wBAAgB,kBAAkB,CAAC,OAAO,EAAE,MAAM,GAAG,SAAS,GAAG,MAAM,GAAG,IAAI,CAqB7E;AAED,wBAAgB,iBAAiB,CAAC,QAAQ,EAAE,QAAQ,EAAE,MAAM,EAAE,OAAO,GAAG,IAAI,CAkB3E;AAQD,wBAAgB,eAAe,CAC3B,QAAQ,EAAE,QAAQ,EAClB,IAAI,EAAE,MAAM,EACZ,KAAK,EAAE,MAAM,EACb,OAAO,EAAE;IACL,QAAQ,CAAC,EAAE,OAAO,CAAC;IACnB,MAAM,CAAC,EAAE,OAAO,CAAC;IACjB,QAAQ,CAAC,EAAE,KAAK,GAAG,QAAQ,GAAG,MAAM,CAAC;IACrC,IAAI,CAAC,EAAE,MAAM,CAAC;IACd,MAAM,CAAC,EAAE,MAAM,CAAC;CACnB,GACF,IAAI,CAsBN"}

package/dist/cjs/vercel-oauth.js

@@ -151,6 +151,11 @@ function clearOAuthCookies(response, secure) {
         appendSetCookie(response, name, "", expired);
     }
 }
+const SAME_SITE_LABEL = {
+    lax: "Lax",
+    strict: "Strict",
+    none: "None",
+};
 function appendSetCookie(response, name, value, options) {
     const parts = [`${name}=${encodeURIComponent(value)}`];
     if (options.maxAge !== undefined) {
@@ -164,7 +169,7 @@ function appendSetCookie(response, name, value, options) {
         parts.push("Secure");
     }
     if (options.sameSite) {
-        parts.push(`SameSite=${options.sameSite === "none" ? "None" : options.sameSite[0].toUpperCase()}${options.sameSite.slice(1)}`);
+        parts.push(`SameSite=${SAME_SITE_LABEL[options.sameSite]}`);
     }
     response.headers.append("Set-Cookie", parts.join("; "));
 }

package/dist/edge.mjs

@@ -534,7 +534,9 @@ async function verifySessionToken(secret, token) {
 function sessionCookieOptions(maxAge, secure) {
   return {
     httpOnly: true,
-    sameSite: "lax",
+    // SameSite=None; Secure is required for third-party iframes (e.g. Contentful).
+    // Browsers reject SameSite=None without Secure, so HTTP (localhost) stays Lax.
+    sameSite: secure ? "none" : "lax",
     secure,
     path: "/",
     maxAge
@@ -682,6 +684,11 @@ function clearOAuthCookies(response, secure) {
     appendSetCookie(response, name, "", expired);
   }
 }
+var SAME_SITE_LABEL = {
+  lax: "Lax",
+  strict: "Strict",
+  none: "None"
+};
 function appendSetCookie(response, name, value, options) {
   const parts = [`${name}=${encodeURIComponent(value)}`];
   if (options.maxAge !== void 0) {
@@ -695,9 +702,7 @@ function appendSetCookie(response, name, value, options) {
     parts.push("Secure");
   }
   if (options.sameSite) {
-    parts.push(
-      `SameSite=${options.sameSite === "none" ? "None" : options.sameSite[0].toUpperCase()}${options.sameSite.slice(1)}`
-    );
+    parts.push(`SameSite=${SAME_SITE_LABEL[options.sameSite]}`);
   }
   response.headers.append("Set-Cookie", parts.join("; "));
 }
@@ -728,16 +733,15 @@ function redirect(request, location, status = 302) {
     }
   });
 }
+function signingSecret(config) {
+  return config.secret ?? config.bypassSecret;
+}
 async function attachSession(response, config, method, subject, secure) {
-  if (!config.secret) {
+  const secret = signingSecret(config);
+  if (!secret) {
     return response;
   }
-  const token = await createSessionToken(
-    config.secret,
-    method,
-    subject,
-    config.sessionTtlSeconds
-  );
+  const token = await createSessionToken(secret, method, subject, config.sessionTtlSeconds);
   const opts = sessionCookieOptions(config.sessionTtlSeconds, secure);
   appendSetCookie(response, SESSION_COOKIE_NAME, token, opts);
   return response;
@@ -753,10 +757,10 @@ async function handleBypass(request, config) {
   const setCookieMode = shouldSetBypassCookie(request);
   const url = new URL(request.url);
   const hadQueryBypass = url.searchParams.has(BYPASS_HEADER);
-  const hadSetCookieQuery = url.searchParams.has("x-vercel-set-bypass-cookie");
+  const hadSetCookieQuery = url.searchParams.has(SET_BYPASS_COOKIE_HEADER);
   if (hadQueryBypass || hadSetCookieQuery || setCookieMode) {
     url.searchParams.delete(BYPASS_HEADER);
-    url.searchParams.delete("x-vercel-set-bypass-cookie");
+    url.searchParams.delete(SET_BYPASS_COOKIE_HEADER);
     const response = redirect(request, url.pathname + url.search + url.hash);
     const secure = isSecureRequest(request);
     if (setCookieMode || hadSetCookieQuery) {
@@ -928,11 +932,9 @@ async function handleDeploymentProtection(request, options = {}) {
   if (bypass.kind === "allow") {
     return null;
   }
-  if (config.secret) {
-    const session = await verifySessionToken(
-      config.secret,
-      readCookie(request, SESSION_COOKIE_NAME)
-    );
+  const secret = signingSecret(config);
+  if (secret) {
+    const session = await verifySessionToken(secret, readCookie(request, SESSION_COOKIE_NAME));
     if (session) {
       return null;
     }

package/dist/es/handler.d.ts.map

@@ -1 +1 @@
-{"version":3,"file":"handler.d.ts","sourceRoot":"","sources":["../../src/handler.ts"],"names":[],"mappings":"AAyBA,OAAO,KAAK,EAA8B,2BAA2B,EAAE,MAAM,SAAS,CAAC;AA4RvF;;GAEG;AACH,wBAAsB,0BAA0B,CAC5C,OAAO,EAAE,OAAO,EAChB,OAAO,GAAE,2BAAgC,GAC1C,OAAO,CAAC,QAAQ,GAAG,IAAI,CAAC,CAqD1B"}
+{"version":3,"file":"handler.d.ts","sourceRoot":"","sources":["../../src/handler.ts"],"names":[],"mappings":"AA0BA,OAAO,KAAK,EAA8B,2BAA2B,EAAE,MAAM,SAAS,CAAC;AAqSvF;;GAEG;AACH,wBAAsB,0BAA0B,CAC5C,OAAO,EAAE,OAAO,EAChB,OAAO,GAAE,2BAAgC,GAC1C,OAAO,CAAC,QAAQ,GAAG,IAAI,CAAC,CAoD1B"}

package/dist/es/handler.js

@@ -1,6 +1,6 @@
 import { isValidBypass, readBypassCookie, readBypassToken, shouldSetBypassCookie } from "./bypass";
 import { hasPasswordAuth, hasVercelAuth, hasVercelDirectAuth, hasVercelProxyAuth, isProtectionActive, resolveConfig, } from "./config";
-import { BYPASS_COOKIE_NAME, BYPASS_HEADER, OAUTH_NONCE_COOKIE, OAUTH_RETURN_COOKIE, OAUTH_VERIFIER_COOKIE, SESSION_COOKIE_NAME, VERCEL_AUTHORIZE_PATH, VERCEL_CALLBACK_PATH, } from "./constants";
+import { BYPASS_COOKIE_NAME, BYPASS_HEADER, OAUTH_NONCE_COOKIE, OAUTH_RETURN_COOKIE, OAUTH_VERIFIER_COOKIE, SESSION_COOKIE_NAME, SET_BYPASS_COOKIE_HEADER, VERCEL_AUTHORIZE_PATH, VERCEL_CALLBACK_PATH, } from "./constants";
 import { timingSafeEqualString } from "./crypto";
 import { buildProxyStartUrl, verifyHandoffToken } from "./handoff";
 import { renderLoginPage } from "./login-page";
@@ -34,11 +34,20 @@ function redirect(request, location, status = 302) {
         },
     });
 }
+/**
+ * Prefer the dedicated session secret; fall back to the automation bypass secret
+ * so a query-param bypass can still persist `__becklyn_dp_session` when no
+ * username/password or explicit HMAC secret is configured.
+ */
+function signingSecret(config) {
+    return config.secret ?? config.bypassSecret;
+}
 async function attachSession(response, config, method, subject, secure) {
-    if (!config.secret) {
+    const secret = signingSecret(config);
+    if (!secret) {
         return response;
     }
-    const token = await createSessionToken(config.secret, method, subject, config.sessionTtlSeconds);
+    const token = await createSessionToken(secret, method, subject, config.sessionTtlSeconds);
     const opts = sessionCookieOptions(config.sessionTtlSeconds, secure);
     appendSetCookie(response, SESSION_COOKIE_NAME, token, opts);
     return response;
@@ -54,10 +63,12 @@ async function handleBypass(request, config) {
     const setCookieMode = shouldSetBypassCookie(request);
     const url = new URL(request.url);
     const hadQueryBypass = url.searchParams.has(BYPASS_HEADER);
-    const hadSetCookieQuery = url.searchParams.has("x-vercel-set-bypass-cookie");
+    const hadSetCookieQuery = url.searchParams.has(SET_BYPASS_COOKIE_HEADER);
+    // Query-param bypass (and the Vercel set-cookie helper) persist auth, then
+    // strip secrets from the URL. Header-only automation stays one-shot.
     if (hadQueryBypass || hadSetCookieQuery || setCookieMode) {
         url.searchParams.delete(BYPASS_HEADER);
-        url.searchParams.delete("x-vercel-set-bypass-cookie");
+        url.searchParams.delete(SET_BYPASS_COOKIE_HEADER);
         const response = redirect(request, url.pathname + url.search + url.hash);
         const secure = isSecureRequest(request);
         if (setCookieMode || hadSetCookieQuery) {
@@ -69,6 +80,7 @@ async function handleBypass(request, config) {
                 sameSite: setCookieMode === "samesitenone" ? "none" : "lax",
             });
         }
+        // Always persist a signed session when the bypass secret arrived via query.
         await attachSession(response, config, "bypass", "automation", secure);
         return { kind: "respond", response };
     }
@@ -230,8 +242,9 @@ export async function handleDeploymentProtection(request, options = {}) {
     if (bypass.kind === "allow") {
         return null;
     }
-    if (config.secret) {
-        const session = await verifySessionToken(config.secret, readCookie(request, SESSION_COOKIE_NAME));
+    const secret = signingSecret(config);
+    if (secret) {
+        const session = await verifySessionToken(secret, readCookie(request, SESSION_COOKIE_NAME));
         if (session) {
             return null;
         }

package/dist/es/middleware.d.ts.map

@@ -1 +1 @@
-{"version":3,"file":"middleware.d.ts","sourceRoot":"","sources":["../../src/middleware.ts"],"names":[],"mappings":"AAAA,OAAO,EAAE,KAAK,WAAW,EAAE,YAAY,EAAE,MAAM,aAAa,CAAC;AAE7D,OAAO,KAAK,EAAE,2BAA2B,EAAE,MAAM,SAAS,CAAC;AAE3D,KAAK,cAAc,GAAG,CAClB,OAAO,EAAE,WAAW,EACpB,KAAK,CAAC,EAAE,OAAO,KAEb,QAAQ,GACR,YAAY,GACZ,OAAO,CAAC,QAAQ,GAAG,YAAY,GAAG,SAAS,GAAG,IAAI,CAAC,GACnD,SAAS,GACT,IAAI,CAAC;AAEX,MAAM,MAAM,4BAA4B,GAClC,EAAE,GACF,CAAC,2BAA2B,CAAC,GAC7B,CAAC,cAAc,CAAC,GAChB,CAAC,cAAc,EAAE,2BAA2B,CAAC,CAAC;AA8DpD;;;;;;;;;;;;;;;;;;;;;;;;;;;;GA4BG;AACH,wBAAgB,wBAAwB,CAAC,GAAG,IAAI,EAAE,4BAA4B,IAgBtE,SAAS,WAAW,EACpB,QAAQ,OAAO,KAChB,OAAO,CAAC,QAAQ,GAAG,YAAY,CAAC,CActC"}
+{"version":3,"file":"middleware.d.ts","sourceRoot":"","sources":["../../src/middleware.ts"],"names":[],"mappings":"AAAA,OAAO,EAAE,KAAK,WAAW,EAAE,YAAY,EAAE,MAAM,aAAa,CAAC;AAE7D,OAAO,KAAK,EAAE,2BAA2B,EAAE,MAAM,SAAS,CAAC;AAE3D,KAAK,cAAc,GAAG,CAClB,OAAO,EAAE,WAAW,EACpB,KAAK,CAAC,EAAE,OAAO,KAEb,QAAQ,GACR,YAAY,GACZ,OAAO,CAAC,QAAQ,GAAG,YAAY,GAAG,SAAS,GAAG,IAAI,CAAC,GACnD,SAAS,GACT,IAAI,CAAC;AAEX,MAAM,MAAM,4BAA4B,GAClC,EAAE,GACF,CAAC,2BAA2B,CAAC,GAC7B,CAAC,cAAc,CAAC,GAChB,CAAC,cAAc,EAAE,2BAA2B,CAAC,CAAC;AA8JpD;;;;;;;;;;;;;;;;;;;;;;;;;;;;GA4BG;AACH,wBAAgB,wBAAwB,CAAC,GAAG,IAAI,EAAE,4BAA4B,IAgBtE,SAAS,WAAW,EACpB,QAAQ,OAAO,KAChB,OAAO,CAAC,QAAQ,GAAG,YAAY,CAAC,CActC"}

package/dist/es/middleware.js

@@ -6,12 +6,95 @@ function isOptions(value) {
         !Array.isArray(value) &&
         typeof value !== "function");
 }
+function decodeCookieValue(value) {
+    try {
+        return decodeURIComponent(value);
+    }
+    catch {
+        return value;
+    }
+}
+function parseSetCookie(header) {
+    const parts = header
+        .split(";")
+        .map(part => part.trim())
+        .filter(Boolean);
+    const first = parts.shift();
+    if (!first) {
+        return null;
+    }
+    const separator = first.indexOf("=");
+    if (separator <= 0) {
+        return null;
+    }
+    const parsed = {
+        name: first.slice(0, separator),
+        value: decodeCookieValue(first.slice(separator + 1)),
+    };
+    for (const part of parts) {
+        const [rawKey, ...rest] = part.split("=");
+        const key = rawKey?.toLowerCase();
+        const attrValue = rest.join("=");
+        if (key === "httponly") {
+            parsed.httpOnly = true;
+        }
+        else if (key === "secure") {
+            parsed.secure = true;
+        }
+        else if (key === "path") {
+            parsed.path = attrValue;
+        }
+        else if (key === "max-age") {
+            const maxAge = Number(attrValue);
+            if (!Number.isNaN(maxAge)) {
+                parsed.maxAge = maxAge;
+            }
+        }
+        else if (key === "samesite") {
+            const sameSite = attrValue.toLowerCase();
+            if (sameSite === "lax" || sameSite === "strict" || sameSite === "none") {
+                parsed.sameSite = sameSite;
+            }
+        }
+    }
+    return parsed;
+}
+function readSetCookieHeaders(headers) {
+    if (typeof headers.getSetCookie === "function") {
+        const cookies = headers.getSetCookie();
+        if (cookies.length > 0) {
+            return cookies;
+        }
+    }
+    const single = headers.get("set-cookie");
+    return single ? [single] : [];
+}
+/**
+ * Next.js middleware only reliably applies cookies set via `NextResponse.cookies`.
+ * Copying raw `Set-Cookie` headers onto a redirect is ignored by the runtime.
+ */
+function applyCookies(from, to) {
+    for (const header of readSetCookieHeaders(from.headers)) {
+        const cookie = parseSetCookie(header);
+        if (!cookie) {
+            continue;
+        }
+        to.cookies.set(cookie.name, cookie.value, {
+            httpOnly: cookie.httpOnly,
+            secure: cookie.secure,
+            path: cookie.path,
+            maxAge: cookie.maxAge,
+            sameSite: cookie.sameSite,
+        });
+    }
+}
 function toNextResponse(request, response) {
     const location = response.headers.get("Location");
     if (location && response.status >= 300 && response.status < 400) {
         // Always resolve against the incoming request so relative Locations never reach Next.
         const redirectResponse = NextResponse.redirect(new URL(location, request.url), response.status);
         copyHeaders(response, redirectResponse, /* skipLocation */ true);
+        applyCookies(response, redirectResponse);
         return redirectResponse;
     }
     const nextResponse = new NextResponse(response.body, {
@@ -19,22 +102,14 @@ function toNextResponse(request, response) {
         statusText: response.statusText,
     });
     copyHeaders(response, nextResponse, false);
+    applyCookies(response, nextResponse);
     return nextResponse;
 }
 function copyHeaders(from, to, skipLocation) {
-    const setCookies = typeof from.headers.getSetCookie === "function" ? from.headers.getSetCookie() : [];
-    if (setCookies.length > 0) {
-        for (const cookie of setCookies) {
-            to.headers.append("Set-Cookie", cookie);
-        }
-    }
     from.headers.forEach((value, key) => {
         const lower = key.toLowerCase();
         if (lower === "set-cookie") {
-            // Already copied via getSetCookie when available; fall back otherwise.
-            if (setCookies.length === 0) {
-                to.headers.append("Set-Cookie", value);
-            }
+            // Applied via NextResponse.cookies so the middleware runtime honors them.
             return;
         }
         if (skipLocation && lower === "location") {

package/dist/es/session.d.ts

@@ -3,7 +3,7 @@ export declare function createSessionToken(secret: string, method: AuthMethod, s
 export declare function verifySessionToken(secret: string, token: string | undefined | null): Promise<SessionPayload | null>;
 export declare function sessionCookieOptions(maxAge: number, secure: boolean): {
     httpOnly: boolean;
-    sameSite: "lax";
+    sameSite: "none" | "lax";
     secure: boolean;
     path: string;
     maxAge: number;

package/dist/es/session.d.ts.map

@@ -1 +1 @@
-{"version":3,"file":"session.d.ts","sourceRoot":"","sources":["../../src/session.ts"],"names":[],"mappings":"AACA,OAAO,KAAK,EAAE,UAAU,EAAE,cAAc,EAAE,MAAM,SAAS,CAAC;AAyB1D,wBAAsB,kBAAkB,CACpC,MAAM,EAAE,MAAM,EACd,MAAM,EAAE,UAAU,EAClB,OAAO,EAAE,MAAM,EACf,UAAU,EAAE,MAAM,GACnB,OAAO,CAAC,MAAM,CAAC,CASjB;AAED,wBAAsB,kBAAkB,CACpC,MAAM,EAAE,MAAM,EACd,KAAK,EAAE,MAAM,GAAG,SAAS,GAAG,IAAI,GACjC,OAAO,CAAC,cAAc,GAAG,IAAI,CAAC,CA4BhC;AAED,wBAAgB,oBAAoB,CAAC,MAAM,EAAE,MAAM,EAAE,MAAM,EAAE,OAAO;;;;;;EAQnE"}
+{"version":3,"file":"session.d.ts","sourceRoot":"","sources":["../../src/session.ts"],"names":[],"mappings":"AACA,OAAO,KAAK,EAAE,UAAU,EAAE,cAAc,EAAE,MAAM,SAAS,CAAC;AAyB1D,wBAAsB,kBAAkB,CACpC,MAAM,EAAE,MAAM,EACd,MAAM,EAAE,UAAU,EAClB,OAAO,EAAE,MAAM,EACf,UAAU,EAAE,MAAM,GACnB,OAAO,CAAC,MAAM,CAAC,CASjB;AAED,wBAAsB,kBAAkB,CACpC,MAAM,EAAE,MAAM,EACd,KAAK,EAAE,MAAM,GAAG,SAAS,GAAG,IAAI,GACjC,OAAO,CAAC,cAAc,GAAG,IAAI,CAAC,CA4BhC;AAED,wBAAgB,oBAAoB,CAAC,MAAM,EAAE,MAAM,EAAE,MAAM,EAAE,OAAO;;cAKrB,MAAM,GAAG,KAAK;;;;EAK5D"}

package/dist/es/session.js

@@ -51,7 +51,9 @@ export async function verifySessionToken(secret, token) {
 export function sessionCookieOptions(maxAge, secure) {
     return {
         httpOnly: true,
-        sameSite: "lax",
+        // SameSite=None; Secure is required for third-party iframes (e.g. Contentful).
+        // Browsers reject SameSite=None without Secure, so HTTP (localhost) stays Lax.
+        sameSite: (secure ? "none" : "lax"),
         secure,
         path: "/",
         maxAge,

package/dist/es/vercel-oauth.d.ts.map

@@ -1 +1 @@
-{"version":3,"file":"vercel-oauth.d.ts","sourceRoot":"","sources":["../../src/vercel-oauth.ts"],"names":[],"mappings":"AASA,OAAO,KAAK,EAAE,0BAA0B,EAAE,MAAM,SAAS,CAAC;AAE1D,MAAM,WAAW,mBAAmB;IAChC,YAAY,EAAE,MAAM,CAAC;IACrB,UAAU,EAAE,MAAM,CAAC;IACnB,QAAQ,CAAC,EAAE,MAAM,CAAC;IAClB,UAAU,EAAE,MAAM,CAAC;IACnB,KAAK,CAAC,EAAE,MAAM,CAAC;IACf,aAAa,CAAC,EAAE,MAAM,CAAC;CAC1B;AAED,MAAM,WAAW,cAAc;IAC3B,GAAG,CAAC,EAAE,MAAM,CAAC;IACb,IAAI,CAAC,EAAE,MAAM,CAAC;IACd,KAAK,CAAC,EAAE,MAAM,CAAC;IACf,kBAAkB,CAAC,EAAE,MAAM,CAAC;CAC/B;AAED,MAAM,WAAW,sBAAsB;IACnC;;;OAGG;IACH,YAAY,CAAC,EAAE,MAAM,CAAC;CACzB;AAgBD,wBAAsB,4BAA4B,CAC9C,OAAO,EAAE,OAAO,EAChB,MAAM,EAAE,0BAA0B,EAClC,QAAQ,EAAE,MAAM,EAChB,OAAO,CAAC,EAAE,sBAAsB,GACjC,OAAO,CAAC,QAAQ,CAAC,CAsCnB;AAED,wBAAsB,kBAAkB,CACpC,OAAO,EAAE,OAAO,EAChB,MAAM,EAAE,0BAA0B,EAClC,IAAI,EAAE,MAAM,EACZ,YAAY,EAAE,MAAM,EACpB,OAAO,CAAC,EAAE,sBAAsB,GACjC,OAAO,CAAC,mBAAmB,CAAC,CA6B9B;AAED,wBAAsB,mBAAmB,CAAC,WAAW,EAAE,MAAM,GAAG,OAAO,CAAC,cAAc,CAAC,CAYtF;AAED,wBAAgB,UAAU,CAAC,OAAO,EAAE,OAAO,EAAE,IAAI,EAAE,MAAM,GAAG,MAAM,GAAG,IAAI,CAgBxE;AAED,wBAAsB,gBAAgB,CAAC,OAAO,EAAE,OAAO,EAAE,KAAK,EAAE,MAAM,GAAG,IAAI,GAAG,OAAO,CAAC,OAAO,CAAC,CAO/F;AAED,wBAAgB,kBAAkB,CAAC,OAAO,EAAE,MAAM,GAAG,SAAS,GAAG,MAAM,GAAG,IAAI,CAqB7E;AAED,wBAAgB,iBAAiB,CAAC,QAAQ,EAAE,QAAQ,EAAE,MAAM,EAAE,OAAO,GAAG,IAAI,CAkB3E;AAED,wBAAgB,eAAe,CAC3B,QAAQ,EAAE,QAAQ,EAClB,IAAI,EAAE,MAAM,EACZ,KAAK,EAAE,MAAM,EACb,OAAO,EAAE;IACL,QAAQ,CAAC,EAAE,OAAO,CAAC;IACnB,MAAM,CAAC,EAAE,OAAO,CAAC;IACjB,QAAQ,CAAC,EAAE,KAAK,GAAG,QAAQ,GAAG,MAAM,CAAC;IACrC,IAAI,CAAC,EAAE,MAAM,CAAC;IACd,MAAM,CAAC,EAAE,MAAM,CAAC;CACnB,GACF,IAAI,CAwBN"}
+{"version":3,"file":"vercel-oauth.d.ts","sourceRoot":"","sources":["../../src/vercel-oauth.ts"],"names":[],"mappings":"AASA,OAAO,KAAK,EAAE,0BAA0B,EAAE,MAAM,SAAS,CAAC;AAE1D,MAAM,WAAW,mBAAmB;IAChC,YAAY,EAAE,MAAM,CAAC;IACrB,UAAU,EAAE,MAAM,CAAC;IACnB,QAAQ,CAAC,EAAE,MAAM,CAAC;IAClB,UAAU,EAAE,MAAM,CAAC;IACnB,KAAK,CAAC,EAAE,MAAM,CAAC;IACf,aAAa,CAAC,EAAE,MAAM,CAAC;CAC1B;AAED,MAAM,WAAW,cAAc;IAC3B,GAAG,CAAC,EAAE,MAAM,CAAC;IACb,IAAI,CAAC,EAAE,MAAM,CAAC;IACd,KAAK,CAAC,EAAE,MAAM,CAAC;IACf,kBAAkB,CAAC,EAAE,MAAM,CAAC;CAC/B;AAED,MAAM,WAAW,sBAAsB;IACnC;;;OAGG;IACH,YAAY,CAAC,EAAE,MAAM,CAAC;CACzB;AAgBD,wBAAsB,4BAA4B,CAC9C,OAAO,EAAE,OAAO,EAChB,MAAM,EAAE,0BAA0B,EAClC,QAAQ,EAAE,MAAM,EAChB,OAAO,CAAC,EAAE,sBAAsB,GACjC,OAAO,CAAC,QAAQ,CAAC,CAsCnB;AAED,wBAAsB,kBAAkB,CACpC,OAAO,EAAE,OAAO,EAChB,MAAM,EAAE,0BAA0B,EAClC,IAAI,EAAE,MAAM,EACZ,YAAY,EAAE,MAAM,EACpB,OAAO,CAAC,EAAE,sBAAsB,GACjC,OAAO,CAAC,mBAAmB,CAAC,CA6B9B;AAED,wBAAsB,mBAAmB,CAAC,WAAW,EAAE,MAAM,GAAG,OAAO,CAAC,cAAc,CAAC,CAYtF;AAED,wBAAgB,UAAU,CAAC,OAAO,EAAE,OAAO,EAAE,IAAI,EAAE,MAAM,GAAG,MAAM,GAAG,IAAI,CAgBxE;AAED,wBAAsB,gBAAgB,CAAC,OAAO,EAAE,OAAO,EAAE,KAAK,EAAE,MAAM,GAAG,IAAI,GAAG,OAAO,CAAC,OAAO,CAAC,CAO/F;AAED,wBAAgB,kBAAkB,CAAC,OAAO,EAAE,MAAM,GAAG,SAAS,GAAG,MAAM,GAAG,IAAI,CAqB7E;AAED,wBAAgB,iBAAiB,CAAC,QAAQ,EAAE,QAAQ,EAAE,MAAM,EAAE,OAAO,GAAG,IAAI,CAkB3E;AAQD,wBAAgB,eAAe,CAC3B,QAAQ,EAAE,QAAQ,EAClB,IAAI,EAAE,MAAM,EACZ,KAAK,EAAE,MAAM,EACb,OAAO,EAAE;IACL,QAAQ,CAAC,EAAE,OAAO,CAAC;IACnB,MAAM,CAAC,EAAE,OAAO,CAAC;IACjB,QAAQ,CAAC,EAAE,KAAK,GAAG,QAAQ,GAAG,MAAM,CAAC;IACrC,IAAI,CAAC,EAAE,MAAM,CAAC;IACd,MAAM,CAAC,EAAE,MAAM,CAAC;CACnB,GACF,IAAI,CAsBN"}

package/dist/es/vercel-oauth.js

@@ -141,6 +141,11 @@ export function clearOAuthCookies(response, secure) {
         appendSetCookie(response, name, "", expired);
     }
 }
+const SAME_SITE_LABEL = {
+    lax: "Lax",
+    strict: "Strict",
+    none: "None",
+};
 export function appendSetCookie(response, name, value, options) {
     const parts = [`${name}=${encodeURIComponent(value)}`];
     if (options.maxAge !== undefined) {
@@ -154,7 +159,7 @@ export function appendSetCookie(response, name, value, options) {
         parts.push("Secure");
     }
     if (options.sameSite) {
-        parts.push(`SameSite=${options.sameSite === "none" ? "None" : options.sameSite[0].toUpperCase()}${options.sameSite.slice(1)}`);
+        parts.push(`SameSite=${SAME_SITE_LABEL[options.sameSite]}`);
     }
     response.headers.append("Set-Cookie", parts.join("; "));
 }

package/dist/storybook.mjs

@@ -534,7 +534,9 @@ async function verifySessionToken(secret, token) {
 function sessionCookieOptions(maxAge, secure) {
   return {
     httpOnly: true,
-    sameSite: "lax",
+    // SameSite=None; Secure is required for third-party iframes (e.g. Contentful).
+    // Browsers reject SameSite=None without Secure, so HTTP (localhost) stays Lax.
+    sameSite: secure ? "none" : "lax",
     secure,
     path: "/",
     maxAge
@@ -682,6 +684,11 @@ function clearOAuthCookies(response, secure) {
     appendSetCookie(response, name, "", expired);
   }
 }
+var SAME_SITE_LABEL = {
+  lax: "Lax",
+  strict: "Strict",
+  none: "None"
+};
 function appendSetCookie(response, name, value, options) {
   const parts = [`${name}=${encodeURIComponent(value)}`];
   if (options.maxAge !== void 0) {
@@ -695,9 +702,7 @@ function appendSetCookie(response, name, value, options) {
     parts.push("Secure");
   }
   if (options.sameSite) {
-    parts.push(
-      `SameSite=${options.sameSite === "none" ? "None" : options.sameSite[0].toUpperCase()}${options.sameSite.slice(1)}`
-    );
+    parts.push(`SameSite=${SAME_SITE_LABEL[options.sameSite]}`);
   }
   response.headers.append("Set-Cookie", parts.join("; "));
 }
@@ -728,16 +733,15 @@ function redirect(request, location, status = 302) {
     }
   });
 }
+function signingSecret(config) {
+  return config.secret ?? config.bypassSecret;
+}
 async function attachSession(response, config, method, subject, secure) {
-  if (!config.secret) {
+  const secret = signingSecret(config);
+  if (!secret) {
     return response;
   }
-  const token = await createSessionToken(
-    config.secret,
-    method,
-    subject,
-    config.sessionTtlSeconds
-  );
+  const token = await createSessionToken(secret, method, subject, config.sessionTtlSeconds);
   const opts = sessionCookieOptions(config.sessionTtlSeconds, secure);
   appendSetCookie(response, SESSION_COOKIE_NAME, token, opts);
   return response;
@@ -753,10 +757,10 @@ async function handleBypass(request, config) {
   const setCookieMode = shouldSetBypassCookie(request);
   const url = new URL(request.url);
   const hadQueryBypass = url.searchParams.has(BYPASS_HEADER);
-  const hadSetCookieQuery = url.searchParams.has("x-vercel-set-bypass-cookie");
+  const hadSetCookieQuery = url.searchParams.has(SET_BYPASS_COOKIE_HEADER);
   if (hadQueryBypass || hadSetCookieQuery || setCookieMode) {
     url.searchParams.delete(BYPASS_HEADER);
-    url.searchParams.delete("x-vercel-set-bypass-cookie");
+    url.searchParams.delete(SET_BYPASS_COOKIE_HEADER);
     const response = redirect(request, url.pathname + url.search + url.hash);
     const secure = isSecureRequest(request);
     if (setCookieMode || hadSetCookieQuery) {
@@ -928,11 +932,9 @@ async function handleDeploymentProtection(request, options = {}) {
   if (bypass.kind === "allow") {
     return null;
   }
-  if (config.secret) {
-    const session = await verifySessionToken(
-      config.secret,
-      readCookie(request, SESSION_COOKIE_NAME)
-    );
+  const secret = signingSecret(config);
+  if (secret) {
+    const session = await verifySessionToken(secret, readCookie(request, SESSION_COOKIE_NAME));
     if (session) {
       return null;
     }

package/package.json

@@ -1,6 +1,6 @@
 {
     "name": "@becklyn/deployment-protection",
-    "version": "0.4.1",
+    "version": "0.4.3",
     "license": "MIT",
     "description": "Simple shared username/password + Sign in with Vercel gate for Next.js and Storybook deployments",
     "homepage": "https://github.com/Becklyn-Studios/ts-libs/tree/main/packages/deployment-protection",
@@ -11,9 +11,9 @@
     "scripts": {
         "lint": "eslint . --max-warnings 0 && prettier --check \"./**/*.{ts,tsx,md,json,mjs}\"",
         "fix": "eslint . --fix && prettier --write \"./**/*.{ts,tsx,md,json,mjs}\"",
-        "test": "npm run build && vitest run",
+        "test": "vitest run",
         "build": "rm -rf dist && tsc -p tsconfig-es.json && tsc -p tsconfig-cjs.json && node ./scripts/build-edge-bundles.mjs",
-        "prepublishOnly": "npm run lint && npm run test"
+        "prepublishOnly": "npm run lint && npm run build && npm run test"
     },
     "devDependencies": {
         "@becklyn/eslint": "*",