mirrors/pikasTech-HWLAB
1
0
Fork 0
Code Issues Pull Requests Actions Packages Projects Releases Wiki Activity

fix: allow opencode iframe session cookies

Browse Source
This commit is contained in:
UniDesk Codex
2026-06-30 02:34:31 +08:00
parent bb75ba23ba
commit bc582a64ec
2 changed files with 24 additions and 10 deletions
Download Patch File Download Diff File Expand all files Collapse all files
deploy/deploy.yaml
+1
View File
@@ -738,6 +738,7 @@ lanes:
HWLAB_CLOUD_DB_CONTRACT: v03-redacted-presence-only HWLAB_CLOUD_DB_CONTRACT: v03-redacted-presence-only
HWLAB_ACCESS_CONTROL_REQUIRED: "1" HWLAB_ACCESS_CONTROL_REQUIRED: "1"
HWLAB_SESSION_COOKIE_DOMAIN: .pikapython.com HWLAB_SESSION_COOKIE_DOMAIN: .pikapython.com
HWLAB_SESSION_COOKIE_SAMESITE: None
HWLAB_BOOTSTRAP_ADMIN_ID: usr_v03_admin HWLAB_BOOTSTRAP_ADMIN_ID: usr_v03_admin
HWLAB_BOOTSTRAP_ADMIN_USERNAME: admin HWLAB_BOOTSTRAP_ADMIN_USERNAME: admin
HWLAB_BOOTSTRAP_ADMIN_DISPLAY_NAME: HWLAB v0.3 Admin HWLAB_BOOTSTRAP_ADMIN_DISPLAY_NAME: HWLAB v0.3 Admin
internal/cloud/access-control.ts
+23 -10
View File
@@ -17,14 +17,14 @@ import { createUserBillingClient } from "./user-billing-client.ts";
const SESSION_COOKIE = "hwlab_session"; const SESSION_COOKIE = "hwlab_session";
const SESSION_MAX_AGE_SECONDS = 60 * 60 * 24; const SESSION_MAX_AGE_SECONDS = 60 * 60 * 24;
const SESSION_COOKIE_SAMESITE = "Lax"; const SESSION_COOKIE_SAMESITE = "Lax";
function buildSessionCookie(token, maxAge, { secure = false, domain = "" } = {}) { function buildSessionCookie(token, maxAge, { secure = false, domain = "", sameSite = SESSION_COOKIE_SAMESITE } = {}) {
return `${SESSION_COOKIE}=${encodeURIComponent(token)}; ${sessionCookieAttributes(maxAge, { secure, domain })}`; return `${SESSION_COOKIE}=${encodeURIComponent(token)}; ${sessionCookieAttributes(maxAge, { secure, domain, sameSite })}`;
} }
function buildClearSessionCookie({ secure = false, domain = "" } = {}) { function buildClearSessionCookie({ secure = false, domain = "", sameSite = SESSION_COOKIE_SAMESITE } = {}) {
return `${SESSION_COOKIE}=; ${sessionCookieAttributes(0, { secure, domain })}`; return `${SESSION_COOKIE}=; ${sessionCookieAttributes(0, { secure, domain, sameSite })}`;
} }
function sessionCookieAttributes(maxAge, { secure = false, domain = "" } = {}) { function sessionCookieAttributes(maxAge, { secure = false, domain = "", sameSite = SESSION_COOKIE_SAMESITE } = {}) {
return ["Path=/", "HttpOnly", secure ? "Secure" : "", sessionCookieDomainAttribute(domain), `SameSite=${SESSION_COOKIE_SAMESITE}`, `Max-Age=${maxAge}`] return ["Path=/", "HttpOnly", secure ? "Secure" : "", sessionCookieDomainAttribute(domain), `SameSite=${normalizeSessionCookieSameSite(sameSite)}`, `Max-Age=${maxAge}`]
.filter(Boolean) .filter(Boolean)
.join("; "); .join("; ");
} }
@@ -37,6 +37,17 @@ function normalizeSessionCookieDomain(value) {
if (!domain) return ""; if (!domain) return "";
return /^\.?[a-z0-9](?:[a-z0-9-]{0,61}[a-z0-9])?(?:\.[a-z0-9](?:[a-z0-9-]{0,61}[a-z0-9])?)+$/u.test(domain) ? domain : ""; return /^\.?[a-z0-9](?:[a-z0-9-]{0,61}[a-z0-9])?(?:\.[a-z0-9](?:[a-z0-9-]{0,61}[a-z0-9])?)+$/u.test(domain) ? domain : "";
} }
function normalizeSessionCookieSameSite(value) {
const normalized = String(value ?? "").trim().toLowerCase();
if (normalized === "none") return "None";
if (normalized === "strict") return "Strict";
if (normalized === "lax") return "Lax";
return SESSION_COOKIE_SAMESITE;
}
function sessionCookieSameSiteForResponse(env, secure) {
const sameSite = normalizeSessionCookieSameSite(env.HWLAB_SESSION_COOKIE_SAMESITE);
return sameSite === "None" && !secure ? SESSION_COOKIE_SAMESITE : sameSite;
}
const API_KEY_PREFIX = "hwl_live_"; const API_KEY_PREFIX = "hwl_live_";
const API_KEY_RANDOM_BYTES = 32; const API_KEY_RANDOM_BYTES = 32;
const API_KEY_DEFAULT_NAME = "Default API key"; const API_KEY_DEFAULT_NAME = "Default API key";
@@ -2474,17 +2485,19 @@ function parseCookie(value) { return Object.fromEntries(String(value ?? "").spli
function setSessionCookie(response, token, maxAge, request, env = process.env) { function setSessionCookie(response, token, maxAge, request, env = process.env) {
const secure = shouldUseSecureSessionCookie(request, env); const secure = shouldUseSecureSessionCookie(request, env);
const domain = normalizeSessionCookieDomain(env.HWLAB_SESSION_COOKIE_DOMAIN); const domain = normalizeSessionCookieDomain(env.HWLAB_SESSION_COOKIE_DOMAIN);
const sameSite = sessionCookieSameSiteForResponse(env, secure);
const cookies = domain const cookies = domain
? [buildSessionCookie(token, maxAge, { secure, domain }), buildClearSessionCookie({ secure })] ? [buildSessionCookie(token, maxAge, { secure, domain, sameSite }), buildClearSessionCookie({ secure, sameSite })]
: [buildSessionCookie(token, maxAge, { secure })]; : [buildSessionCookie(token, maxAge, { secure, sameSite })];
response.setHeader("set-cookie", cookies); response.setHeader("set-cookie", cookies);
} }
function clearSessionCookie(response, request, env = process.env) { function clearSessionCookie(response, request, env = process.env) {
const secure = shouldUseSecureSessionCookie(request, env); const secure = shouldUseSecureSessionCookie(request, env);
const domain = normalizeSessionCookieDomain(env.HWLAB_SESSION_COOKIE_DOMAIN); const domain = normalizeSessionCookieDomain(env.HWLAB_SESSION_COOKIE_DOMAIN);
const sameSite = sessionCookieSameSiteForResponse(env, secure);
const cookies = domain const cookies = domain
? [buildClearSessionCookie({ secure, domain }), buildClearSessionCookie({ secure })] ? [buildClearSessionCookie({ secure, domain, sameSite }), buildClearSessionCookie({ secure, sameSite })]
: [buildClearSessionCookie({ secure })]; : [buildClearSessionCookie({ secure, sameSite })];
response.setHeader("set-cookie", cookies); response.setHeader("set-cookie", cookies);
} }
function shouldUseSecureSessionCookie(request, env = process.env) { function shouldUseSecureSessionCookie(request, env = process.env) {