propro-utils 1.6.6 → 1.6.8

package/package.json

@@ -1,6 +1,6 @@
 {
   "name": "propro-utils",
-  "version": "1.6.6",
+  "version": "1.6.8",
   "description": "Auth middleware for propro-auth",
   "main": "src/index.js",
   "scripts": {

package/src/server/middleware/cookieUtils.js

@@ -100,6 +100,7 @@ const setAuthCookies = async (res, tokens, account, user, appUrl) => {
 
   // Domain configuration
   let domain;
+  let isSecureConnection = false;
   try {
     // Handle URLs that don't include the protocol
     let processedAppUrl = appUrl;
@@ -111,24 +112,37 @@ const setAuthCookies = async (res, tokens, account, user, appUrl) => {
       processedAppUrl = `https://${appUrl}`;
     }
 
-    domain = processedAppUrl ? new URL(processedAppUrl).hostname : undefined;
+    const urlObj = new URL(processedAppUrl);
+    domain = urlObj.hostname;
+    isSecureConnection = urlObj.protocol === "https:";
+
     if (domain?.includes("mapmap.app")) {
       domain = ".mapmap.app";
     }
     if (domain?.includes("localhost")) {
       domain = undefined;
+      isSecureConnection = false;
     }
     if (domain?.includes("propro.so")) {
       // Handle both main domain and subdomains of propro.so
       if (domain.startsWith("short.")) {
-        domain = "short.propro.so";
+        domain = ".short.propro.so";
       } else {
-        domain = "propro.so";
+        domain = ".propro.so";
       }
     }
+
+    console.log("Cookie configuration:", {
+      domain,
+      isSecure: isSecureConnection,
+      protocol: urlObj.protocol,
+      originalUrl: appUrl,
+      processedUrl: processedAppUrl,
+    });
   } catch (error) {
     console.error("Invalid appUrl:", { error, appUrl });
     domain = undefined;
+    isSecureConnection = false;
   }
 
   // Determine if we're in a local development environment
@@ -136,22 +150,28 @@ const setAuthCookies = async (res, tokens, account, user, appUrl) => {
     !domain || domain === "localhost" || domain.includes("localhost");
 
   const commonAttributes = {
-    secure: !isLocalhost, // Only require secure for non-localhost environments
-    sameSite: isLocalhost ? "Lax" : "None", // Use Lax for localhost, None for production
+    secure: isSecureConnection,
+    sameSite: isSecureConnection ? "None" : "Lax",
     domain,
     path: "/",
+    httpOnly: false,
+    expires: new Date(Date.now() + 365 * 24 * 60 * 60 * 1000),
   };
 
+  console.log("Cookie attributes:", commonAttributes);
+
   const httpOnlyCookies = {
     "x-refresh-token": {
       value: tokens.refresh.token,
       maxAge: refreshMaxAge,
       httpOnly: true,
+      secure: isSecureConnection,
     },
     "x-access-token": {
       value: tokens.access.token,
       maxAge: accessMaxAge,
       httpOnly: true,
+      secure: isSecureConnection,
     },
   };
 
@@ -163,14 +183,20 @@ const setAuthCookies = async (res, tokens, account, user, appUrl) => {
     user: {
       value: safeStringify(sanitizedUser),
       maxAge: refreshMaxAge,
+      httpOnly: false,
+      secure: isSecureConnection,
     },
     account: {
       value: safeStringify(sanitizedAccount),
       maxAge: refreshMaxAge,
+      httpOnly: false,
+      secure: isSecureConnection,
     },
     has_account_token: {
       value: JSON.stringify({ value: "true", expires: accessMaxAge }),
       maxAge: accessMaxAge,
+      httpOnly: false,
+      secure: isSecureConnection,
     },
   };
 
@@ -225,6 +251,7 @@ const setAuthCookies = async (res, tokens, account, user, appUrl) => {
  */
 const clearAuthCookies = async (res, appUrl) => {
   let domain;
+  let isSecureConnection = false;
   try {
     // Handle URLs that don't include the protocol
     let processedAppUrl = appUrl;
@@ -236,12 +263,16 @@ const clearAuthCookies = async (res, appUrl) => {
       processedAppUrl = `https://${appUrl}`;
     }
 
-    domain = processedAppUrl ? new URL(processedAppUrl).hostname : undefined;
+    const urlObj = new URL(processedAppUrl);
+    domain = urlObj.hostname;
+    isSecureConnection = urlObj.protocol === "https:";
+
     if (domain?.includes("mapmap.app")) {
       domain = ".mapmap.app";
     }
     if (domain?.includes("localhost")) {
       domain = undefined;
+      isSecureConnection = false;
     }
     if (domain?.includes("propro.so")) {
       // Handle both main domain and subdomains of propro.so
@@ -251,22 +282,31 @@ const clearAuthCookies = async (res, appUrl) => {
         domain = "propro.so";
       }
     }
+
+    console.log("Clear cookies configuration:", {
+      domain,
+      isSecure: isSecureConnection,
+      protocol: urlObj.protocol,
+      originalUrl: appUrl,
+      processedUrl: processedAppUrl,
+    });
   } catch (error) {
     console.error("Invalid appUrl:", error);
     domain = undefined;
+    isSecureConnection = false;
   }
 
-  // Determine if we're in a local development environment
-  const isLocalhost =
-    !domain || domain === "localhost" || domain.includes("localhost");
-
   const commonAttributes = {
-    secure: !isLocalhost, // Only require secure for non-localhost environments
-    sameSite: isLocalhost ? "Lax" : "None", // Use Lax for localhost, None for production
+    secure: isSecureConnection,
+    sameSite: isSecureConnection ? "None" : "Lax",
     domain,
     path: "/",
+    httpOnly: false,
+    expires: new Date(0),
   };
 
+  console.log("Clear cookie attributes:", commonAttributes);
+
   const cookieNames = [
     "x-refresh-token",
     "x-access-token",