memind/server/portal-auth-session-helpers.mjs

import {
  AUTH_COOKIE,
  clearSessionCookie,
  parseCookies,
} from '../auth.mjs';
import {
  clearUserLogoutCookies,
  resolveCookieDomainForRequest,
  USER_COOKIE,
  userLoginCookies,
} from '../user-auth.mjs';

export function createPortalAuthSessionHelpers({
  isSecureRequest,
  getLegacyAuth = () => null,
  getUserAuth = () => null,
  logger = console,
} = {}) {
  if (typeof isSecureRequest !== 'function') {
    throw new Error(
      'createPortalAuthSessionHelpers requires isSecureRequest',
    );
  }

  function legacySessionToken(req) {
    return parseCookies(req.get('cookie'))[AUTH_COOKIE];
  }

  function userToken(req) {
    return parseCookies(req.get('cookie'))[USER_COOKIE];
  }

  function setUserLoginCookies(res, req, token) {
    res.set(
      'Set-Cookie',
      userLoginCookies(
        token,
        isSecureRequest(req),
        resolveCookieDomainForRequest(req),
      ),
    );
  }

  function clearUserLoginCookies(res, req) {
    const secure = isSecureRequest(req);
    const domain = resolveCookieDomainForRequest(req);
    const cookies = clearUserLogoutCookies(secure, domain);
    if (getLegacyAuth()) {
      cookies.push(clearSessionCookie(secure));
    }
    res.set('Set-Cookie', cookies);
  }

  async function attachUserSession(req, _res, next) {
    const userAuth = getUserAuth();
    if (!userAuth) return next();
    const token = userToken(req);
    req.userToken = token;
    try {
      req.userSession = token
        ? await userAuth.verify(token)
        : null;
      req.userSessionError = null;
    } catch (error) {
      req.userSession = null;
      req.userSessionError = error;
      logger.error(
        '[Auth] session verify failed:',
        error instanceof Error ? error.message : error,
      );
    }
    return next();
  }

  return {
    legacySessionToken,
    userToken,
    setUserLoginCookies,
    clearUserLoginCookies,
    attachUserSession,
  };
}