fix: wire cookieSecure in app.ts, revert core changes

Author: vhscom

apps/cloudflare-workers/src/app.ts

@@ -15,6 +15,7 @@ import {
 	defaultGetClientIp,
 	type RateLimitConfig,
 	securityHeaders,
+	tokenConfig,
 } from "@private-landing/core";
 import {
 	type CacheClientFactory,
@@ -132,6 +133,10 @@ const rateLimits = {
 } satisfies Record<string, RateLimitConfig>;
 
 // Global middleware
+app.use("*", async (ctx, next) => {
+	tokenConfig.cookieSecure = ctx.env.ENVIRONMENT !== "development";
+	await next();
+});
 app.use("*", securityHeaders);
 app.use("*", serveStatic({ cache: "key" }));
 

packages/control/src/types.ts

@@ -9,7 +9,6 @@
 import type { Env, Variables } from "@private-landing/types";
 
 export interface ControlBindings extends Env {
-	ENVIRONMENT?: string;
 	GATEWAY_URL?: string;
 	GATEWAY_TOKEN?: string;
 	CONTROL_ALLOWED_IPS?: string;

packages/core/src/auth/services/cached-session-service.ts

@@ -161,8 +161,8 @@ export function createCachedSessionService(
 				await cache.srem(userSessionsKey(state.userId), sessionId);
 			}
 
-			deleteCookie(ctx, "access_token", getAuthCookieSettings(ctx));
-			deleteCookie(ctx, "refresh_token", getAuthCookieSettings(ctx));
+			deleteCookie(ctx, "access_token", getAuthCookieSettings());
+			deleteCookie(ctx, "refresh_token", getAuthCookieSettings());
 		},
 
 		async endAllSessionsForUser(
@@ -179,8 +179,8 @@ export function createCachedSessionService(
 				await cache.del(userSessionsKey(userId));
 			}
 
-			deleteCookie(ctx, "access_token", getAuthCookieSettings(ctx));
-			deleteCookie(ctx, "refresh_token", getAuthCookieSettings(ctx));
+			deleteCookie(ctx, "access_token", getAuthCookieSettings());
+			deleteCookie(ctx, "refresh_token", getAuthCookieSettings());
 		},
 	};
 }

packages/core/src/auth/services/session-service.ts

@@ -309,8 +309,8 @@ export function createSessionService(
 				args: [sessionId],
 			});
 
-			deleteCookie(ctx, "access_token", getAuthCookieSettings(ctx));
-			deleteCookie(ctx, "refresh_token", getAuthCookieSettings(ctx));
+			deleteCookie(ctx, "access_token", getAuthCookieSettings());
+			deleteCookie(ctx, "refresh_token", getAuthCookieSettings());
 		},
 
 		async endAllSessionsForUser(
@@ -326,8 +326,8 @@ export function createSessionService(
 				args: [userId],
 			});
 
-			deleteCookie(ctx, "access_token", getAuthCookieSettings(ctx));
-			deleteCookie(ctx, "refresh_token", getAuthCookieSettings(ctx));
+			deleteCookie(ctx, "access_token", getAuthCookieSettings());
+			deleteCookie(ctx, "refresh_token", getAuthCookieSettings());
 		},
 	};
 }

packages/core/src/auth/utils/cookie.ts

@@ -22,10 +22,9 @@ export function setSecureCookie(
 	token: string,
 	maxAge: number,
 ): void {
-	const secure = ctx.env?.ENVIRONMENT === "production";
 	setCookie(ctx, name, token, {
 		httpOnly: true,
-		secure,
+		secure: tokenConfig.cookieSecure,
 		sameSite: tokenConfig.cookieSameSite,
 		path: "/",
 		maxAge,
@@ -37,11 +36,10 @@ export function setSecureCookie(
  * Used with deleteCookie to ensure consistent security settings.
  * @returns Cookie options with security settings
  */
-export function getAuthCookieSettings(ctx?: Context): CookieOptions {
-	const secure = ctx?.env?.ENVIRONMENT === "production";
+export function getAuthCookieSettings(): CookieOptions {
 	return {
 		httpOnly: true,
-		secure,
+		secure: tokenConfig.cookieSecure,
 		sameSite: tokenConfig.cookieSameSite,
 		path: "/",
 	};

packages/types/src/env.ts

@@ -18,4 +18,5 @@ export interface Env {
 	CACHE_TOKEN?: string;
 	AGENT_PROVISIONING_SECRET?: string;
 	WS_ALLOWED_ORIGINS?: string;
+	ENVIRONMENT?: string;
 }