astro-tractstack 2.2.3 → 2.2.4

package/package.json

@@ -1,6 +1,6 @@
 {
   "name": "astro-tractstack",
-  "version": "2.2.3",
+  "version": "2.2.4",
   "description": "Astro integration for TractStack - the free web press by At Risk Media",
   "type": "module",
   "main": "dist/index.js",

package/templates/src/pages/api/auth/logout.ts

@@ -1,28 +1,17 @@
 import type { APIRoute } from '@/types/astro';
 
-export const POST: APIRoute = async ({ cookies }) => {
+export const POST: APIRoute = async ({ cookies, url }) => {
   try {
-    const goBackend =
-      import.meta.env.PUBLIC_GO_BACKEND || 'http://localhost:8080';
-    let rootDomain: string | undefined;
+    const isLocalhost =
+      url.hostname === 'localhost' || url.hostname === '127.0.0.1';
 
-    try {
-      const url = new URL(goBackend);
-      // Only set domain for non-localhost to preserve local dev behavior
-      if (url.hostname !== 'localhost' && url.hostname !== '127.0.0.1') {
-        rootDomain = url.hostname;
-      }
-    } catch (e) {
-      console.warn('Logout: Failed to parse backend URL for cookie domain', e);
-    }
-
-    // Determine the options ONCE to prevent overwriting
-    const cookieOptions: any = { path: '/' };
-    if (rootDomain) {
-      cookieOptions.domain = rootDomain;
-    }
+    const cookieOptions: any = {
+      path: '/',
+      secure: !isLocalhost,
+      httpOnly: true,
+      sameSite: 'lax',
+    };
 
-    // Execute deletion with the single, correct configuration
     cookies.delete('admin_auth', cookieOptions);
     cookies.delete('editor_auth', cookieOptions);