@oneaccount/express 0.1.1 → 0.1.2

package/dist/middleware/auth.js

@@ -85,8 +85,29 @@ function createAuthMiddleware(config) {
     const jwksUrl = config.jwksUrl ||
         `${config.accountProUrl || "https://myaccount.one"}/.well-known/jwks.json`;
     const cookieName = config.cookieName || "auth_token";
+    const autoSetCookie = config.autoSetCookie !== false; // Default to true
     return async function authMiddleware(req, res, next) {
         req.oneAccount = { user: null };
+        // Auto-set cookie from ?token= query parameter (SSO redirect handling)
+        if (autoSetCookie && req.query?.token && typeof req.query.token === 'string') {
+            const tokenFromUrl = req.query.token;
+            // Set the cookie
+            res.cookie(cookieName, tokenFromUrl, {
+                httpOnly: true,
+                secure: process.env.NODE_ENV === 'production',
+                maxAge: 30 * 24 * 60 * 60 * 1000, // 30 days
+                sameSite: 'lax',
+                path: '/',
+            });
+            // Build redirect URL without the token parameter
+            const url = new URL(req.originalUrl || req.url, `${req.protocol}://${req.get('host')}`);
+            url.searchParams.delete('token');
+            const redirectPath = url.pathname + url.search;
+            if (config.debug) {
+                console.log(`[OneAccount] Auto-set cookie from URL token, redirecting to ${redirectPath}`);
+            }
+            return res.redirect(redirectPath);
+        }
         let token = null;
         const authHeader = req.headers.authorization;
         if (authHeader?.startsWith("Bearer ")) {

package/dist/types/index.d.ts

@@ -25,6 +25,14 @@ export interface OneAccountConfig {
     cacheMaxAge?: number;
     debug?: boolean;
     cookieName?: string;
+    /**
+     * Automatically set auth cookie from ?token= URL parameter (SSO redirect handling).
+     * When enabled (default: true), the middleware will:
+     * 1. Detect ?token= in the URL
+     * 2. Set it as an HttpOnly cookie
+     * 3. Redirect to the same URL without the token parameter
+     */
+    autoSetCookie?: boolean;
 }
 export interface StripeConnectStatus {
     hasAccount: boolean;

package/package.json

@@ -1,6 +1,6 @@
 {
   "name": "@oneaccount/express",
-  "version": "0.1.1",
+  "version": "0.1.2",
   "description": "OneAccount SDK for Express.js - Authentication, entitlements, and Stripe Connect",
   "main": "dist/index.js",
   "types": "dist/index.d.ts",