@ossy/platform 3.9.0 → 3.11.1

package/src/user-app-settings.js

@@ -1,35 +1,96 @@
 export const USER_SETTINGS_COOKIE = 'x-ossy-user-settings'
+export const WORKSPACE_ID_COOKIE = 'x-ossy-workspace-id'
 export const AUTH_COOKIE = 'auth'
 
 const USER_SETTINGS_MAX_AGE_MS = 2147483647
 const AUTH_MAX_AGE_MS = 14 * 24 * 60 * 60 * 1000
 
+const signedCookieOpts = {
+  httpOnly: true,
+  signed: true,
+  path: '/',
+}
+
+function settingsCookieExpires () {
+  return new Date(Date.now() + USER_SETTINGS_MAX_AGE_MS)
+}
+
 export function readUserAppSettings (req) {
   return JSON.parse(req.signedCookies?.[USER_SETTINGS_COOKIE] || '{}')
 }
 
+/**
+ * Active workspace id: dedicated cookie (select-workspace / sign-in) wins over the
+ * legacy field inside x-ossy-user-settings. Shell Sync PATCH must not clobber the
+ * dedicated cookie — see mergeUserAppSettingsCookie.
+ */
+export function readWorkspaceIdFromCookies (req) {
+  const dedicated = req.signedCookies?.[WORKSPACE_ID_COOKIE]
+  if (dedicated && typeof dedicated === 'string' && dedicated !== 'undefined') {
+    return dedicated
+  }
+  const fromSettings = readUserAppSettings(req).workspaceId
+  if (fromSettings && typeof fromSettings === 'string' && fromSettings !== 'undefined') {
+    return fromSettings
+  }
+  return undefined
+}
+
+export function setWorkspaceIdCookie (res, workspaceId) {
+  res.cookie(WORKSPACE_ID_COOKIE, String(workspaceId), {
+    ...signedCookieOpts,
+    expires: settingsCookieExpires(),
+  })
+}
+
+export function clearWorkspaceIdCookie (res) {
+  const clearOpts = { httpOnly: true, path: '/' }
+  res.clearCookie(WORKSPACE_ID_COOKIE, clearOpts)
+  res.clearCookie(WORKSPACE_ID_COOKIE, { ...clearOpts, signed: true })
+  res.cookie(WORKSPACE_ID_COOKIE, '', {
+    ...clearOpts,
+    signed: true,
+    expires: new Date(0),
+  })
+}
+
 export function mergeUserAppSettingsCookie (req, res, partial) {
-  const updated = { ...readUserAppSettings(req), ...partial }
+  const current = readUserAppSettings(req)
+  const updated = { ...current, ...partial }
+  const explicitWorkspaceId = Object.prototype.hasOwnProperty.call(partial, 'workspaceId')
+
+  if (explicitWorkspaceId) {
+    if (partial.workspaceId) {
+      setWorkspaceIdCookie(res, partial.workspaceId)
+      updated.workspaceId = partial.workspaceId
+    } else {
+      clearWorkspaceIdCookie(res)
+      delete updated.workspaceId
+    }
+  } else {
+    // Shell Sync and similar patches omit workspaceId. Never rewrite it from the
+    // request's cookie snapshot — an in-flight PATCH started before select-workspace
+    // would otherwise clobber the newly selected workspace (Switch workspace e2e flake).
+    delete updated.workspaceId
+  }
+
   res.cookie(USER_SETTINGS_COOKIE, JSON.stringify(updated), {
-    httpOnly: true,
-    signed: true,
-    path: '/',
-    expires: new Date(Date.now() + USER_SETTINGS_MAX_AGE_MS),
+    ...signedCookieOpts,
+    expires: settingsCookieExpires(),
   })
 }
 
 export function clearWorkspaceFromUserAppSettings (req, res) {
   const settings = readUserAppSettings(req)
   delete settings.workspaceId
+  clearWorkspaceIdCookie(res)
   if (Object.keys(settings).length === 0) {
     res.clearCookie(USER_SETTINGS_COOKIE, { httpOnly: true, signed: true, path: '/' })
     return
   }
   res.cookie(USER_SETTINGS_COOKIE, JSON.stringify(settings), {
-    httpOnly: true,
-    signed: true,
-    path: '/',
-    expires: new Date(Date.now() + USER_SETTINGS_MAX_AGE_MS),
+    ...signedCookieOpts,
+    expires: settingsCookieExpires(),
   })
 }
 

package/src/verify-sign-in-session.js

@@ -0,0 +1,24 @@
+import { ActionService } from './actions/action.service.js'
+import { mergeUserAppSettingsCookie, setAuthCookie } from './user-app-settings.js'
+
+/**
+ * Set auth (and optional single-workspace default) cookies after verify-sign-in.
+ *
+ * @param {import('express').Request} req
+ * @param {import('express').Response} res
+ * @param {{ sub: string, token: string }} session
+ */
+export async function applyVerifySignInSessionCookies (req, res, { sub, token }) {
+  setAuthCookie(res, token)
+  try {
+    const workspaces = await ActionService.invoke('@ossy/workspaces/actions/list', {
+      payload: { userId: sub },
+      req,
+    })
+    if (workspaces.length === 1) {
+      mergeUserAppSettingsCookie(req, res, { workspaceId: workspaces[0].id })
+    }
+  } catch {
+    // Cookie for the session is enough; workspace default is best-effort.
+  }
+}