kavachos 0.2.0 → 0.2.1

package/dist/auth/index.js

@@ -1062,8 +1062,16 @@ async function parseBody(request) {
     };
   }
 }
-function buildSetCookie(name, value, maxAge, path = "/") {
-  return `${name}=${encodeURIComponent(value)}; HttpOnly; Secure; SameSite=Lax; Path=${path}; Max-Age=${maxAge}`;
+function buildSetCookie(name, value, maxAge, path = "/", secure = true) {
+  const parts = [
+    `${name}=${encodeURIComponent(value)}`,
+    "HttpOnly",
+    "SameSite=Lax",
+    `Path=${path}`,
+    `Max-Age=${maxAge}`
+  ];
+  if (secure) parts.splice(1, 0, "Secure");
+  return parts.join("; ");
 }
 
 // src/auth/admin-plugin.ts
@@ -5084,7 +5092,8 @@ function oauth(config) {
             if (userId !== "__pending__") {
               const { session, token } = await sessionManager.create(userId);
               const maxAge = Math.floor((session.expiresAt.getTime() - Date.now()) / 1e3);
-              const cookie = buildSetCookie("kavach_session", token, maxAge);
+              const isSecure = baseUrl.startsWith("https://");
+              const cookie = buildSetCookie("kavach_session", token, maxAge, "/", isSecure);
               const userInfo = encodeURIComponent(JSON.stringify({ id: userId, email }));
               const callbackUrl = `${baseUrl}/?auth_user=${userInfo}`;
               return new Response(null, {
@@ -5388,13 +5397,14 @@ function createGithubProvider(config) {
     });
     return `${AUTHORIZATION_URL3}?${params.toString()}`;
   }
-  async function exchangeCode(code, _codeVerifier, redirectUri) {
+  async function exchangeCode(code, codeVerifier, redirectUri) {
     const effectiveRedirectUri = config.redirectUri ?? redirectUri;
     const body = new URLSearchParams({
       client_id: config.clientId,
       client_secret: config.clientSecret,
       code,
-      redirect_uri: effectiveRedirectUri
+      redirect_uri: effectiveRedirectUri,
+      code_verifier: codeVerifier
     });
     const response = await fetch(TOKEN_URL3, {
       method: "POST",
@@ -5690,14 +5700,15 @@ function createLinkedInProvider(config) {
     });
     return `${AUTHORIZATION_URL6}?${params.toString()}`;
   }
-  async function exchangeCode(code, _codeVerifier, redirectUri) {
+  async function exchangeCode(code, codeVerifier, redirectUri) {
     const effectiveRedirectUri = config.redirectUri ?? redirectUri;
     const body = new URLSearchParams({
       grant_type: "authorization_code",
       client_id: config.clientId,
       client_secret: config.clientSecret,
       code,
-      redirect_uri: effectiveRedirectUri
+      redirect_uri: effectiveRedirectUri,
+      code_verifier: codeVerifier
     });
     const response = await fetch(TOKEN_URL6, {
       method: "POST",
@@ -5881,14 +5892,15 @@ function createSlackProvider(config) {
     });
     return `${AUTHORIZATION_URL8}?${params.toString()}`;
   }
-  async function exchangeCode(code, _codeVerifier, redirectUri) {
+  async function exchangeCode(code, codeVerifier, redirectUri) {
     const effectiveRedirectUri = config.redirectUri ?? redirectUri;
     const body = new URLSearchParams({
       grant_type: "authorization_code",
       client_id: config.clientId,
       client_secret: config.clientSecret,
       code,
-      redirect_uri: effectiveRedirectUri
+      redirect_uri: effectiveRedirectUri,
+      code_verifier: codeVerifier
     });
     const response = await fetch(TOKEN_URL8, {
       method: "POST",
@@ -10000,7 +10012,13 @@ function passkey(config) {
                   status: 200,
                   headers: {
                     "Content-Type": "application/json",
-                    "Set-Cookie": buildSetCookie("kavach_session", token, maxAge)
+                    "Set-Cookie": buildSetCookie(
+                      "kavach_session",
+                      token,
+                      maxAge,
+                      "/",
+                      (ctx.config.baseUrl ?? "").startsWith("https://")
+                    )
                   }
                 }
               );