@seamless-auth/express 0.0.2-beta.4 → 0.0.2-beta.5

package/dist/index.js

@@ -4,12 +4,13 @@ import cookieParser from "cookie-parser";
 
 // src/internal/cookie.ts
 import jwt from "jsonwebtoken";
-function setSessionCookie(res, payload, ttlSeconds = 300, name = "sa_session") {
+function setSessionCookie(res, payload, domain, ttlSeconds = 300, name = "sa_session") {
   const COOKIE_SECRET2 = process.env.SEAMLESS_COOKIE_SIGNING_KEY;
   if (!COOKIE_SECRET2) {
     console.warn("[SeamlessAuth] Missing SEAMLESS_COOKIE_SIGNING_KEY env var!");
     throw new Error("Missing required env SEAMLESS_COOKIE_SIGNING_KEY");
   }
+  console.debug("[SeamlessAuth] Domain check... ", domain);
   const token = jwt.sign(payload, COOKIE_SECRET2, {
     algorithm: "HS256",
     expiresIn: `${ttlSeconds}s`
@@ -19,16 +20,18 @@ function setSessionCookie(res, payload, ttlSeconds = 300, name = "sa_session") {
     secure: process.env.NODE_ENV === "production",
     sameSite: process.env.NODE_ENV === "production" ? "none" : "lax",
     path: "/",
+    domain,
     maxAge: ttlSeconds * 1e3
   });
 }
 function clearSessionCookie(res, domain, name = "sa_session") {
   res.clearCookie(name, { domain, path: "/" });
 }
-function clearAllCookies(res, accesscookieName, registrationCookieName, refreshCookieName) {
-  res.clearCookie(accesscookieName, { path: "/" });
-  res.clearCookie(registrationCookieName, { path: "/" });
-  res.clearCookie(refreshCookieName, { path: "/" });
+function clearAllCookies(res, domain, accesscookieName, registrationCookieName, refreshCookieName) {
+  console.debug("[SeamlessAuth] clearing cookies");
+  res.clearCookie(accesscookieName, { domain, path: "/" });
+  res.clearCookie(registrationCookieName, { domain, path: "/" });
+  res.clearCookie(refreshCookieName, { domain, path: "/" });
 }
 
 // src/internal/authFetch.ts
@@ -171,7 +174,8 @@ function createEnsureCookiesMiddleware(opts) {
     "/logout": { name: opts.accesscookieName, required: true },
     "/users/me": { name: opts.accesscookieName, required: true }
   };
-  return async function ensureCookies(req, res, next, cookieDomain = "") {
+  return async function ensureCookies(req, res, next, cookieDomain = opts.cookieDomain || "") {
+    console.debug("[SeamlessAuth] Ensuring cookies domain...", cookieDomain);
     const match = Object.entries(COOKIE_REQUIREMENTS).find(
       ([path]) => req.path.startsWith(path)
     );
@@ -191,6 +195,7 @@ function createEnsureCookiesMiddleware(opts) {
         if (!refreshed?.token) {
           clearAllCookies(
             res,
+            cookieDomain,
             name,
             opts.registrationCookieName,
             opts.refreshCookieName
@@ -205,12 +210,14 @@ function createEnsureCookiesMiddleware(opts) {
             token: refreshed.token,
             roles: refreshed.roles
           },
+          cookieDomain,
           refreshed.ttl,
           name
         );
         setSessionCookie(
           res,
           { sub: refreshed.sub, refreshToken: refreshed.refreshToken },
+          cookieDomain,
           refreshed.refreshTtl,
           opts.refreshCookieName
         );
@@ -260,6 +267,7 @@ function createSeamlessAuthServer(opts) {
   r.use(cookieParser());
   const {
     authServerUrl,
+    cookieDomain = "",
     accesscookieName = "seamless-access",
     registrationCookieName = "seamless-ephemeral",
     refreshCookieName = "seamless-refresh",
@@ -279,6 +287,7 @@ function createSeamlessAuthServer(opts) {
   r.use(
     createEnsureCookiesMiddleware({
       authServerUrl,
+      cookieDomain,
       accesscookieName,
       registrationCookieName,
       refreshCookieName,
@@ -311,7 +320,13 @@ function createSeamlessAuthServer(opts) {
     if (verified.sub !== data.sub) {
       throw new Error("Signature mismatch with data payload");
     }
-    setSessionCookie(res, { sub: data.sub }, data.ttl, preAuthCookieName);
+    setSessionCookie(
+      res,
+      { sub: data.sub },
+      cookieDomain,
+      data.ttl,
+      preAuthCookieName
+    );
     res.status(204).end();
   }
   async function register(req, res) {
@@ -321,7 +336,13 @@ function createSeamlessAuthServer(opts) {
     });
     const data = await up.json();
     if (!up.ok) return res.status(up.status).json(data);
-    setSessionCookie(res, { sub: data.sub }, data.ttl, registrationCookieName);
+    setSessionCookie(
+      res,
+      { sub: data.sub },
+      cookieDomain,
+      data.ttl,
+      registrationCookieName
+    );
     res.status(200).json(data).end();
   }
   async function finishLogin(req, res) {
@@ -344,12 +365,14 @@ function createSeamlessAuthServer(opts) {
     setSessionCookie(
       res,
       { sub: data.sub, roles: data.roles },
+      cookieDomain,
       data.ttl,
       accesscookieName
     );
     setSessionCookie(
       res,
       { sub: data.sub, refreshToken: data.refreshToken },
+      cookieDomain,
       data.refreshTtl,
       refreshCookieName
     );
@@ -369,6 +392,7 @@ function createSeamlessAuthServer(opts) {
     setSessionCookie(
       res,
       { sub: data.sub, roles: data.roles },
+      cookieDomain,
       data.ttl,
       accesscookieName
     );
@@ -380,6 +404,7 @@ function createSeamlessAuthServer(opts) {
     });
     clearAllCookies(
       res,
+      cookieDomain,
       accesscookieName,
       registrationCookieName,
       refreshCookieName
@@ -391,7 +416,7 @@ function createSeamlessAuthServer(opts) {
       method: "GET"
     });
     const data = await up.json();
-    clearSessionCookie(res, preAuthCookieName);
+    clearSessionCookie(res, cookieDomain, preAuthCookieName);
     if (!data.user) return res.status(401).json({ error: "unauthenticated" });
     res.json({ user: data.user });
   }
@@ -452,12 +477,14 @@ function requireAuth(cookieName = "seamless-access", refreshCookieName = "seamle
             token: refreshed.token,
             roles: refreshed.roles
           },
+          cookieDomain,
           refreshed.ttl,
           cookieName
         );
         setSessionCookie(
           res,
           { sub: refreshed.sub, refreshToken: refreshed.refreshToken },
+          req.hostname,
           refreshed.refreshTtl,
           refreshCookieName
         );

package/package.json

@@ -1,6 +1,6 @@
 {
   "name": "@seamless-auth/express",
-  "version": "0.0.2-beta.4",
+  "version": "0.0.2-beta.5",
   "description": "Express adapter for Seamless Auth passwordless authentication",
   "license": "MIT",
   "type": "module",
@@ -8,7 +8,7 @@
   "types": "./dist/index.d.ts",
   "author": "Fells Code LLC",
   "scripts": {
-    "build": "tsup src/index.ts --format esm --out-dir dist --dts --splitting",
+    "build": "tsup src/index.ts --format esm --out-dir dist --splitting",
     "dev": "tsc --watch"
   },
   "repository": {