propro-utils 1.6.7 → 1.6.9

package/package.json

@@ -1,6 +1,6 @@
 {
   "name": "propro-utils",
-  "version": "1.6.7",
+  "version": "1.6.9",
   "description": "Auth middleware for propro-auth",
   "main": "src/index.js",
   "scripts": {

package/src/server/middleware/cookieUtils.js

@@ -124,12 +124,8 @@ const setAuthCookies = async (res, tokens, account, user, appUrl) => {
       isSecureConnection = false;
     }
     if (domain?.includes("propro.so")) {
-      // Handle both main domain and subdomains of propro.so
-      if (domain.startsWith("short.")) {
-        domain = "short.propro.so";
-      } else {
-        domain = "propro.so";
-      }
+      // Always set cookies on the root domain for all propro.so subdomains
+      domain = ".propro.so";
     }
 
     console.log("Cookie configuration:", {
@@ -138,6 +134,7 @@ const setAuthCookies = async (res, tokens, account, user, appUrl) => {
       protocol: urlObj.protocol,
       originalUrl: appUrl,
       processedUrl: processedAppUrl,
+      hostname: urlObj.hostname,
     });
   } catch (error) {
     console.error("Invalid appUrl:", { error, appUrl });
@@ -154,6 +151,8 @@ const setAuthCookies = async (res, tokens, account, user, appUrl) => {
     sameSite: isSecureConnection ? "None" : "Lax",
     domain,
     path: "/",
+    httpOnly: false,
+    expires: new Date(Date.now() + 365 * 24 * 60 * 60 * 1000), // 1 year expiry as fallback
   };
 
   console.log("Cookie attributes:", commonAttributes);
@@ -163,11 +162,13 @@ const setAuthCookies = async (res, tokens, account, user, appUrl) => {
       value: tokens.refresh.token,
       maxAge: refreshMaxAge,
       httpOnly: true,
+      secure: isSecureConnection,
     },
     "x-access-token": {
       value: tokens.access.token,
       maxAge: accessMaxAge,
       httpOnly: true,
+      secure: isSecureConnection,
     },
   };
 
@@ -179,14 +180,20 @@ const setAuthCookies = async (res, tokens, account, user, appUrl) => {
     user: {
       value: safeStringify(sanitizedUser),
       maxAge: refreshMaxAge,
+      httpOnly: false,
+      secure: isSecureConnection,
     },
     account: {
       value: safeStringify(sanitizedAccount),
       maxAge: refreshMaxAge,
+      httpOnly: false,
+      secure: isSecureConnection,
     },
     has_account_token: {
       value: JSON.stringify({ value: "true", expires: accessMaxAge }),
       maxAge: accessMaxAge,
+      httpOnly: false,
+      secure: isSecureConnection,
     },
   };
 
@@ -265,12 +272,8 @@ const clearAuthCookies = async (res, appUrl) => {
       isSecureConnection = false;
     }
     if (domain?.includes("propro.so")) {
-      // Handle both main domain and subdomains of propro.so
-      if (domain.startsWith("short.")) {
-        domain = "short.propro.so";
-      } else {
-        domain = "propro.so";
-      }
+      // Always set cookies on the root domain for all propro.so subdomains
+      domain = ".propro.so";
     }
 
     console.log("Clear cookies configuration:", {
@@ -279,6 +282,7 @@ const clearAuthCookies = async (res, appUrl) => {
       protocol: urlObj.protocol,
       originalUrl: appUrl,
       processedUrl: processedAppUrl,
+      hostname: urlObj.hostname,
     });
   } catch (error) {
     console.error("Invalid appUrl:", error);
@@ -291,6 +295,8 @@ const clearAuthCookies = async (res, appUrl) => {
     sameSite: isSecureConnection ? "None" : "Lax",
     domain,
     path: "/",
+    httpOnly: false,
+    expires: new Date(0), // Set expiry to past date to ensure cookie is removed
   };
 
   console.log("Clear cookie attributes:", commonAttributes);