ci(release): publish latest release

Author: hello-happy-puppy

RELEASE

@@ -1,6 +1,6 @@
 IPFS hash of the deployment:
-- CIDv0: `QmdDx5deWHGDuMypAwMLmaRE34Gxyr6CeyKSLoECMepymr`
-- CIDv1: `bafybeig5e7qt2nzdxmxfwobch2bemw724ebwkvfy7mcrv6kr5sxevhaioe`
+- CIDv0: `QmcZ2EpEkvWShf9tY3n46zV2aBASUSAHf2872B52oazFDT`
+- CIDv1: `bafybeigtf3xbx7aeslzboofkhy5hqoratz3msbl4cojm6pe6itmbprrtyi`
 
 The latest release is always mirrored at [app.uniswap.org](https://app.uniswap.org).
 
@@ -10,5 +10,5 @@ You can also access the Uniswap Interface from an IPFS gateway.
 Your Uniswap settings are never remembered across different URLs.
 
 IPFS gateways:
-- https://bafybeig5e7qt2nzdxmxfwobch2bemw724ebwkvfy7mcrv6kr5sxevhaioe.ipfs.dweb.link/
-- [ipfs://QmdDx5deWHGDuMypAwMLmaRE34Gxyr6CeyKSLoECMepymr/](ipfs://QmdDx5deWHGDuMypAwMLmaRE34Gxyr6CeyKSLoECMepymr/)
+- https://bafybeigtf3xbx7aeslzboofkhy5hqoratz3msbl4cojm6pe6itmbprrtyi.ipfs.dweb.link/
+- [ipfs://QmcZ2EpEkvWShf9tY3n46zV2aBASUSAHf2872B52oazFDT/](ipfs://QmcZ2EpEkvWShf9tY3n46zV2aBASUSAHf2872B52oazFDT/)

VERSION

@@ -1 +1 @@
-web/5.153.5
+web/5.153.6

apps/web/functions/cookie-utils.test.ts

@@ -0,0 +1,70 @@
+import { rewriteProxiedCookie, rewriteProxiedCookies } from 'functions/cookie-utils'
+
+describe('rewriteProxiedCookie', () => {
+  describe('SameSite pass-through', () => {
+    it('preserves SameSite=None (session cookies minted by platform-service, INC-344)', () => {
+      const result = rewriteProxiedCookie('x-session-id=abc123; Path=/; Secure; HttpOnly; SameSite=None')
+      expect(result).toBe('x-session-id=abc123; Path=/; Secure; HttpOnly; SameSite=None')
+    })
+
+    it('preserves SameSite=Lax', () => {
+      const result = rewriteProxiedCookie('x-device-id=dev456; Path=/; Secure; HttpOnly; SameSite=Lax')
+      expect(result).toBe('x-device-id=dev456; Path=/; Secure; HttpOnly; SameSite=Lax')
+    })
+
+    it('preserves SameSite=Strict on arbitrary cookies', () => {
+      const result = rewriteProxiedCookie('other=value; Path=/; Secure; SameSite=Strict')
+      expect(result).toBe('other=value; Path=/; Secure; SameSite=Strict')
+    })
+
+    it('does not add SameSite when the backend omits it', () => {
+      const result = rewriteProxiedCookie('other=value; Path=/; Secure')
+      expect(result).not.toContain('SameSite')
+    })
+  })
+
+  describe('Domain and prefix stripping', () => {
+    it('strips Domain and keeps SameSite untouched', () => {
+      const result = rewriteProxiedCookie('x-session-id=abc123; Domain=.uniswap.org; Path=/; Secure; SameSite=None')
+      expect(result).not.toContain('Domain')
+      expect(result).toContain('SameSite=None')
+    })
+
+    it('strips __Secure- prefix without touching other attributes', () => {
+      const result = rewriteProxiedCookie('__Secure-x-session-id=abc123; Path=/; Secure; SameSite=None')
+      expect(result).toBe('x-session-id=abc123; Path=/; Secure; SameSite=None')
+    })
+
+    it('strips __Host- prefix and Domain', () => {
+      const result = rewriteProxiedCookie('__Host-other=value; Domain=.uniswap.org; Path=/; Secure; SameSite=Strict')
+      expect(result).toBe('other=value; Path=/; Secure; SameSite=Strict')
+    })
+
+    it('leaves a plain cookie without Domain or prefixes unchanged', () => {
+      const result = rewriteProxiedCookie('other=value')
+      expect(result).toBe('other=value')
+    })
+  })
+})
+
+describe('rewriteProxiedCookies', () => {
+  it('returns the response unchanged when there are no Set-Cookie headers', () => {
+    const response = new Response('body', { status: 200 })
+    expect(rewriteProxiedCookies(response)).toBe(response)
+  })
+
+  it('rewrites multiple cookies, preserving each SameSite as sent', () => {
+    const headers = new Headers()
+    headers.append('Set-Cookie', 'x-session-id=abc; Domain=.uniswap.org; Path=/; Secure; HttpOnly; SameSite=None')
+    headers.append('Set-Cookie', 'other=value; Path=/; Secure; SameSite=Strict')
+    const response = new Response('body', { status: 200, headers })
+
+    const rewritten = rewriteProxiedCookies(response)
+    const cookies = rewritten.headers.getSetCookie()
+
+    expect(cookies).toEqual([
+      'x-session-id=abc; Path=/; Secure; HttpOnly; SameSite=None',
+      'other=value; Path=/; Secure; SameSite=Strict',
+    ])
+  })
+})

apps/web/functions/cookie-utils.ts

@@ -15,8 +15,12 @@
  * Transformations:
  * 1. Strips __Host- and __Secure- prefixes from cookie names
  * 2. Removes Domain attribute (lets browser default to request origin)
- * 3. Ensures SameSite=Lax
- * 4. Keeps Secure flag (both Vercel and Cloudflare serve over HTTPS)
+ *
+ * SameSite (and every other attribute) passes through untouched — cookie
+ * policy is owned by entry-gateway/platform-service, not this proxy.
+ * Platform-service mints session cookies `SameSite=None; Secure` so iframe
+ * embeds keep their session (INC-344); overriding SameSite here would
+ * silently undo that in every environment served through this proxy.
  */
 export function rewriteProxiedCookie(cookie: string): string {
   let rewritten = cookie
@@ -25,25 +29,16 @@ export function rewriteProxiedCookie(cookie: string): string {
   // Only touch the name portion (before first '=') to avoid corrupting values.
   const nameEndIndex = rewritten.indexOf('=')
   if (nameEndIndex > 0) {
-    const cookieName = rewritten.substring(0, nameEndIndex)
-    const strippedName = cookieName.replace(/^(__Host-|__Secure-)/, '')
-    if (strippedName !== cookieName) {
-      rewritten = strippedName + rewritten.substring(nameEndIndex)
+    const rawName = rewritten.substring(0, nameEndIndex)
+    const cookieName = rawName.replace(/^(__Host-|__Secure-)/, '')
+    if (cookieName !== rawName) {
+      rewritten = cookieName + rewritten.substring(nameEndIndex)
     }
   }
 
   // Remove Domain attribute (e.g., Domain=.uniswap.org)
   rewritten = rewritten.replace(/Domain=[^;]+;?\s?/gi, '')
 
-  // Handle SameSite attribute — ensure Lax
-  if (rewritten.includes('SameSite=')) {
-    rewritten = rewritten.replace(/SameSite=\w+/gi, 'SameSite=Lax')
-  } else if (rewritten.includes('Path=')) {
-    rewritten = rewritten.replace(/(Path=[^;]+)/, 'SameSite=Lax; $1')
-  } else {
-    rewritten = `${rewritten}; SameSite=Lax`
-  }
-
   return rewritten
 }