propro-utils 1.5.22 → 1.5.24

package/package.json

@@ -1,6 +1,6 @@
 {
   "name": "propro-utils",
-  "version": "1.5.22",
+  "version": "1.5.24",
   "description": "Auth middleware for propro-auth",
   "main": "src/index.js",
   "scripts": {

package/src/server/middleware/cookieUtils.js

@@ -1,3 +1,10 @@
+/**
+ * Authentication Cookies Module
+ * This module provides functions for setting and clearing authentication cookies.
+ */
+
+const { URL } = require('url');
+
 /**
  * Sets the authentication cookies in the response object.
  *
@@ -11,85 +18,134 @@ const setAuthCookies = (res, tokens, account, user, appUrl) => {
   if (!tokens || !tokens.refresh || !tokens.access) {
     throw new Error('Invalid tokens object');
   }
-
   if (!account) {
     throw new Error('Invalid account object');
   }
-
   if (!user) {
     throw new Error('Invalid user object');
   }
-  const currentDateTime = new Date();
 
+  const currentDateTime = new Date();
   const refreshMaxAge =
     new Date(tokens.refresh.expires).getTime() - currentDateTime.getTime();
   const accessMaxAge =
     new Date(tokens.access.expires).getTime() - currentDateTime.getTime();
 
-  let domain = appUrl ? new URL(appUrl).hostname : undefined;
-
-  if (domain.includes('mapmap.app')) {
-    domain = '.mapmap.app';
+  // Determine the domain
+  let domain;
+  try {
+    domain = appUrl ? new URL(appUrl).hostname : undefined;
+    if (domain && domain.includes('mapmap.app')) {
+      domain = '.mapmap.app';
+    }
+  } catch (error) {
+    console.error('Invalid appUrl:', error);
+    domain = undefined;
   }
 
+  // Define common cookie attributes
   const commonAttributes = {
-    // secure: process.env.NODE_ENV === 'production',
-    secure: true,
-    sameSite: 'None',
-    // path: '/',
+    secure: process.env.NODE_ENV === 'production',
+    sameSite: process.env.NODE_ENV === 'production' ? 'None' : 'Lax',
     domain: domain,
   };
 
-  res.cookie('x-refresh-token', tokens.refresh.token, {
-    httpOnly: true,
-    maxAge: refreshMaxAge,
-    ...commonAttributes,
-  });
+  if (commonAttributes.sameSite === 'None') {
+    commonAttributes.secure = true;
+  }
 
-  res.cookie('x-access-token', tokens.access.token, {
-    httpOnly: true,
-    maxAge: accessMaxAge,
-    ...commonAttributes,
-  });
+  const httpOnlyCookies = [
+    {
+      name: 'x-refresh-token',
+      value: tokens.refresh.token,
+      maxAge: refreshMaxAge,
+    },
+    {
+      name: 'x-access-token',
+      value: tokens.access.token,
+      maxAge: accessMaxAge,
+    },
+  ];
 
-  res.cookie('user', JSON.stringify(user), {
-    maxAge: refreshMaxAge,
-    ...commonAttributes,
+  httpOnlyCookies.forEach(cookie => {
+    res.cookie(cookie.name, cookie.value, {
+      ...commonAttributes,
+      httpOnly: true,
+      maxAge: cookie.maxAge,
+    });
   });
 
-  res.cookie('account', JSON.stringify(account), {
-    maxAge: refreshMaxAge,
-    ...commonAttributes,
-  });
+  const sanitizedUser = { ...user };
+  delete sanitizedUser.password;
 
-  res.cookie(
-    'has_account_token',
-    JSON.stringify({ value: 'true', expires: accessMaxAge }),
+  const regularCookies = [
     {
+      name: 'user',
+      value: JSON.stringify(sanitizedUser),
+      maxAge: refreshMaxAge,
+    },
+    { name: 'account', value: JSON.stringify(account), maxAge: refreshMaxAge },
+    {
+      name: 'has_account_token',
+      value: JSON.stringify({ value: 'true', expires: accessMaxAge }),
       maxAge: accessMaxAge,
+    },
+  ];
+
+  regularCookies.forEach(cookie => {
+    res.cookie(cookie.name, cookie.value, {
       ...commonAttributes,
-    }
-  );
+      maxAge: cookie.maxAge,
+    });
+  });
+
+  console.log('Setting auth cookies');
+  console.log('tokens', tokens);
+  console.log('account', account);
+  console.log('sanitizedUser', sanitizedUser);
 };
 
-const clearAuthCookies = res => {
+/**
+ * Clears all authentication cookies from the response object.
+ *
+ * @param {Object} res - The response object.
+ * @param {string} appUrl - The URL of the client application.
+ */
+const clearAuthCookies = (res, appUrl) => {
+  let domain;
+  try {
+    domain = appUrl ? new URL(appUrl).hostname : undefined;
+    if (domain && domain.includes('mapmap.app')) {
+      domain = '.mapmap.app';
+    }
+  } catch (error) {
+    console.error('Invalid appUrl:', error);
+    domain = undefined;
+  }
+
   const commonAttributes = {
-    secure: true,
-    sameSite: 'None',
-    domain: process.env.APP_URL
-      ? new URL(process.env.APP_URL).hostname
-      : undefined,
+    secure: process.env.NODE_ENV === 'production',
+    sameSite: process.env.NODE_ENV === 'production' ? 'None' : 'Lax',
+    domain: domain,
   };
 
-  [
+  if (commonAttributes.sameSite === 'None') {
+    commonAttributes.secure = true;
+  }
+
+  const cookieNames = [
     'x-refresh-token',
     'x-access-token',
     'user',
     'account',
     'has_account_token',
-  ].forEach(cookieName => {
+  ];
+
+  cookieNames.forEach(cookieName => {
     res.clearCookie(cookieName, commonAttributes);
   });
+
+  console.log('Cleared auth cookies');
 };
 
 module.exports = {