omnigateway 0.12.0 → 0.12.1

package/bin/omni.js

@@ -37474,7 +37474,7 @@ function createServiceDeps(input2) {
 }
 
 // apps/cli/src/version.ts
-var VERSION = "0.12.0";
+var VERSION = "0.12.1";
 
 // apps/cli/src/commands/service.ts
 function gatewayArgv(root) {

package/gateway.js

@@ -56081,8 +56081,16 @@ function readCookie(request2, name) {
   }
   return null;
 }
-function sessionCookie(request2, token, maxAge) {
-  const secure = new URL(request2.url).protocol === "https:" ? ["Secure"] : [];
+function forwardedProto(request2) {
+  const header = request2.headers.get("x-forwarded-proto");
+  if (header === null)
+    return null;
+  return header.split(",")[0]?.trim().toLowerCase() ?? null;
+}
+function sessionCookie(request2, baseUrl, token, maxAge) {
+  const configured2 = URL.canParse(baseUrl) ? new URL(baseUrl).protocol === "https:" : false;
+  const https = configured2 || forwardedProto(request2) === "https" || new URL(request2.url).protocol === "https:";
+  const secure = https ? ["Secure"] : [];
   return [
     `${ADMIN_COOKIE}=${token}`,
     "Path=/",
@@ -56409,7 +56417,7 @@ function adminRoutes(deps) {
     if (token === null)
       throw new GatewayError("INTERNAL", "could not create admin session");
     logger2.info("admin setup completed");
-    set2.headers["set-cookie"] = sessionCookie(request2, token, Math.floor(deps.sessionTtlMs / 1000));
+    set2.headers["set-cookie"] = sessionCookie(request2, deps.baseUrl, token, Math.floor(deps.sessionTtlMs / 1000));
     return { ok: true };
   }).post("/api/login", async ({ request: request2, set: set2 }) => {
     const body2 = await readJsonRecord(request2);
@@ -56421,13 +56429,13 @@ function adminRoutes(deps) {
       throw new GatewayError("AUTH", "invalid password");
     }
     logger2.info("admin login succeeded");
-    set2.headers["set-cookie"] = sessionCookie(request2, token, Math.floor(deps.sessionTtlMs / 1000));
+    set2.headers["set-cookie"] = sessionCookie(request2, deps.baseUrl, token, Math.floor(deps.sessionTtlMs / 1000));
     return { ok: true };
   }).post("/api/logout", async ({ request: request2, set: set2 }) => {
     const token = readCookie(request2, ADMIN_COOKIE);
     if (token !== null)
       await deps.admin.logout(token);
-    set2.headers["set-cookie"] = sessionCookie(request2, "", 0);
+    set2.headers["set-cookie"] = sessionCookie(request2, deps.baseUrl, "", 0);
     return { ok: true };
   }).get("/api/credentials", async ({ request: request2 }) => {
     await requireReader(request2, deps.admin);
@@ -56692,13 +56700,13 @@ function clientRoutes(deps) {
       throw new GatewayError("AUTH", "invalid api key");
     }
     logger2.info("client login succeeded");
-    set2.headers["set-cookie"] = sessionCookie(request2, token, Math.floor(deps.sessionTtlMs / 1000));
+    set2.headers["set-cookie"] = sessionCookie(request2, deps.baseUrl, token, Math.floor(deps.sessionTtlMs / 1000));
     return { ok: true };
   }).post("/api/client/logout", async ({ request: request2, set: set2 }) => {
     const token = readCookie(request2, ADMIN_COOKIE);
     if (token !== null)
       await deps.admin.logout(token);
-    set2.headers["set-cookie"] = sessionCookie(request2, "", 0);
+    set2.headers["set-cookie"] = sessionCookie(request2, deps.baseUrl, "", 0);
     return { ok: true };
   }).get("/api/client/summary", async ({ request: request2 }) => {
     const apiKeyId = await requireClient(request2, deps.admin);
@@ -62294,7 +62302,7 @@ function createRing(limits = DEFAULT_RING_LIMITS) {
 }
 
 // apps/gateway/src/version.ts
-var VERSION = "0.12.0";
+var VERSION = "0.12.1";
 
 // apps/gateway/src/app.ts
 var ADMIN_SESSION_TTL_MS = 12 * 60 * 60 * 1000;
@@ -62458,6 +62466,7 @@ function createApp(deps) {
     store: deps.store,
     admin,
     sessionTtlMs: ADMIN_SESSION_TTL_MS,
+    baseUrl: deps.baseUrl,
     ...deps.dayOffsetMinutes === undefined ? {} : { dayOffsetMinutes: deps.dayOffsetMinutes },
     now,
     logger: logger2

package/package.json

@@ -1,6 +1,6 @@
 {
   "name": "omnigateway",
-  "version": "0.12.0",
+  "version": "0.12.1",
   "description": "Self-hosted AI gateway with Anthropic- and OpenAI-compatible APIs, an admin console, and a CLI",
   "license": "MIT",
   "author": "Harismawan <mail@harismawan.com>",