feat: moving cookie related logic to cookieAdapter.ts

src/session-adapters/cookieAdapter.ts

@@ -1,6 +1,7 @@
 import { expireCookie, getCookie, setCookie, verifyData } from '../utils'
 import jwt from 'jsonwebtoken'
 import { Adapter } from './publicAdapter'
+import { isAppSession } from '../session'
 
 const clientSecret = process.env['CLIENT_SECRET'] || ''
 
@@ -19,41 +20,49 @@ const createScopedKey = ({
 // We do not use `clientId` in cookie adapter,
 // because different plugins will have different domain names,
 // and it's enough to differentiate these cookie values.
+
+const sessionKey = 'sb.auth'
+//NOTE: possibly cookieAdapter can become createCookieAdapter(key: string)
+
 export const cookieAdapter: Adapter = {
-  getItem: ({ req, spaceId, userId, key }) => {
-    const cookie = getCookie(req, createScopedKey({ spaceId, userId, key }))
+  getSession: ({ req, spaceId, userId }) => {
+    const cookie = getCookie(
+      req,
+      createScopedKey({ spaceId, userId, key: sessionKey }),
+    )
 
     if (!cookie) {
       return undefined
     }
 
     const verifiedData = verifyData(clientSecret, cookie)
-    if (!verifiedData) {
+
+    if (!isAppSession(verifiedData)) {
       return undefined
-    } else {
-      return verifiedData as string
     }
+
+    return verifiedData
   },
 
-  setItem: ({ res, spaceId, userId, key, value }) => {
+  setSession: ({ res, spaceId, userId, session }) => {
     const expires = new Date()
     expires.setDate(expires.getDate() + 7)
 
-    const signedData = jwt.sign({ data: value }, clientSecret)
+    const signedData = jwt.sign({ data: session }, clientSecret)
     setCookie(
       res,
-      createScopedKey({ spaceId, userId, key }),
+      createScopedKey({ spaceId, userId, key: sessionKey }),
       signedData,
       expires,
     )
     return true
   },
 
-  hasItem: async (params) =>
-    (await cookieAdapter.getItem(params)) !== undefined,
+  hasSession: async (params) =>
+    (await cookieAdapter.getSession(params)) !== undefined,
 
-  removeItem: ({ res, spaceId, userId, key }) => {
-    expireCookie(res, createScopedKey({ spaceId, userId, key }))
+  removeSession: ({ res, spaceId, userId }) => {
+    expireCookie(res, createScopedKey({ spaceId, userId, key: sessionKey }))
     return true
   },
 }

src/session-adapters/internalAdapter.ts

@@ -13,7 +13,6 @@ import {
 } from '../utils'
 import { AppSession } from '../session/types'
 import { AuthHandlerParams } from '../storyblok-auth-api'
-import { sessionIdentifier } from '../session/sessionIdentifier'
 
 export type InternalAdapter = {
   // session
@@ -52,7 +51,7 @@ type CreateInternalAdapter = ({
   res,
   adapter,
 }: {
-  params: Pick<AuthHandlerParams, 'clientId' | 'clientSecret' | 'sessionKey'>
+  params: Pick<AuthHandlerParams, 'clientId' | 'clientSecret'>
   req: http.IncomingMessage
   res: http.ServerResponse
   adapter: Adapter
@@ -64,65 +63,76 @@ export const createInternalAdapter: CreateInternalAdapter = ({
   res,
   adapter,
 }) => {
-  const sessionKey = sessionIdentifier(params.sessionKey)
-
   return {
     getSession: async ({ spaceId, userId }) => {
-      const session = await adapter.getItem({
-        req,
-        res,
-        clientId: params.clientId,
-        spaceId,
-        userId,
-        key: sessionKey,
-      })
-      if (!session) {
-        return undefined
-      }
       try {
-        return JSON.parse(session) as AppSession
-      } catch (err) {
+        const session = await adapter.getSession({
+          req,
+          res,
+          clientId: params.clientId,
+          spaceId,
+          userId,
+        })
+
+        if (!session) {
+          return undefined
+        }
+
+        return session
+      } catch (e) {
+        console.log('Retrieving the session failed: ', e)
         return undefined
       }
     },
 
     setSession: async ({ spaceId, userId, session }) => {
       try {
-        return await adapter.setItem({
+        const isSessionSet = await adapter.setSession({
           req,
           res,
           clientId: params.clientId,
           spaceId,
           userId,
-          key: sessionKey,
-          value: JSON.stringify(session),
+          session,
         })
-      } catch (err) {
+
+        return isSessionSet
+      } catch (e) {
+        console.log('Setting the session failed: ', e)
         return false
       }
     },
 
-    hasSession: ({ spaceId, userId }) =>
-      adapter.hasItem({
-        req,
-        res,
-        clientId: params.clientId,
-        spaceId,
-        userId,
-        key: sessionKey,
-      }),
+    hasSession: async ({ spaceId, userId }) => {
+      try {
+        const hasSession = await adapter.hasSession({
+          req,
+          res,
+          clientId: params.clientId,
+          spaceId,
+          userId,
+        })
+
+        return hasSession
+      } catch (e) {
+        console.log('Session could not be found: ', e)
+        return false
+      }
+    },
 
     removeSession: async ({ spaceId, userId }) => {
       try {
-        return await adapter.removeItem({
+        const sessionRemoved = await adapter.removeSession({
           req,
           res,
           clientId: params.clientId,
           spaceId,
           userId,
-          key: sessionKey,
         })
-      } catch (err) {
+
+        return sessionRemoved
+      } catch (e) {
+        console.log('Removing the session failed: ', e)
         return false
       }
     },
@@ -133,15 +143,15 @@ export const createInternalAdapter: CreateInternalAdapter = ({
       return true
     },
 
-    getCallbackData() {
+    getCallbackData: () => {
       const cookie = getCookie(req, callbackCookieName)
       const data = verifyData(params.clientSecret, cookie || '') as
         | CallbackCookieData
         | undefined
       return data
     },
 
-    removeCallbackData() {
+    removeCallbackData: () => {
       expireCookie(res, callbackCookieName)
       return true
     },

src/session-adapters/publicAdapter.ts

@@ -1,42 +1,33 @@
 import { IncomingMessage, ServerResponse } from 'node:http'
+import { AppSession } from '../session'
 
 export type MaybePromise<T> = T | Promise<T>
 
 export type Adapter = {
-  getItem: (params: {
-    req: IncomingMessage
-    res: ServerResponse
-    clientId: string
-    spaceId: string
-    userId: string
-    key: string
-  }) => MaybePromise<string | undefined>
+  getSession: GetSession
+  setSession: SetSession
+  removeSession: RemoveSession
+  hasSession: HasSession
+}
 
-  setItem: (params: {
-    req: IncomingMessage
-    res: ServerResponse
-    clientId: string
-    spaceId: string
-    userId: string
-    key: string
-    value: string
-  }) => MaybePromise<boolean>
+type BaseSessionParams = {
+  req: IncomingMessage
+  res: ServerResponse
+  clientId: string
+  spaceId: string
+  userId: string
+}
 
-  removeItem: (params: {
-    req: IncomingMessage
-    res: ServerResponse
-    clientId: string
-    spaceId: string
-    userId: string
-    key: string
-  }) => MaybePromise<boolean>
+type GetSession = (
+  params: BaseSessionParams,
+) => MaybePromise<AppSession | undefined>
 
-  hasItem: (params: {
-    req: IncomingMessage
-    res: ServerResponse
-    clientId: string
-    spaceId: string
-    userId: string
-    key: string
-  }) => MaybePromise<boolean>
-}
+type SetSession = (
+  params: BaseSessionParams & {
+    session: AppSession
+  },
+) => MaybePromise<boolean>
+
+type RemoveSession = (params: BaseSessionParams) => MaybePromise<boolean>
+
+type HasSession = (params: BaseSessionParams) => MaybePromise<boolean>

src/session/sessionStore.ts

@@ -7,6 +7,7 @@ import { refreshStoredAppSession } from './refreshStoredAppSession'
 import { cookieAdapter } from '../session-adapters/cookieAdapter'
 import { createInternalAdapter } from '../session-adapters/internalAdapter'
 import { IncomingMessage } from 'http'
+import { getQueryFromUrl } from '../utils/query-params/get-query-string'
 
 export const getSessionStore: AppSessionCookieStoreFactory =
   (params) =>
@@ -46,27 +47,36 @@ export const inferSessionQuery = (
   if (!req.url) {
     return
   }
-  const url = new URL(req.url)
-  const spaceId = url.searchParams.get('space_id')
-  const userId = url.searchParams.get('user_id')
-  if (spaceId && userId) {
-    return {
-      spaceId,
-      userId,
-    }
+
+  const sessionFromUrl = getSessionFromUrl(req.url)
+
+  if (sessionFromUrl) {
+    return sessionFromUrl
   }
 
   if (req.headers.referer) {
-    const refererUrl = new URL(req.url)
-    const spaceId = refererUrl.searchParams.get('space_id')
-    const userId = refererUrl.searchParams.get('user_id')
-    if (spaceId && userId) {
-      return {
-        spaceId,
-        userId,
-      }
-    }
+    return getSessionFromUrl(req.headers.referer)
   }
 
   return undefined
 }
+
+const getSessionFromUrl = (url: string): AppSessionQuery | undefined => {
+  const query = getQueryFromUrl(url)
+
+  if (!query) {
+    return undefined
+  }
+
+  const spaceId = query.get('space_id')
+  const userId = query.get('user_id')
+
+  if (!spaceId || !userId) {
+    return undefined
+  }
+
+  return {
+    spaceId,
+    userId,
+  }
+}

src/storyblok-auth-api/ResponseElement.ts

@@ -1,7 +1,6 @@
 /**
  * This object describes an HTTP response in a framework-agnostic way.
  * The idea is to create one function that parses an incoming HTTP message into a `ResponseElement`.
- * This `ResponseElement` is then fed into a _reconciler_ that writes the required changes into an HTTP response.
  */
 export type ResponseElement = {
   type: 'success' | 'error' | 'configuration-error'

src/utils/cookie/changedCookieHeaderValue/changedCookieHeaderValue.ts

@@ -12,7 +12,7 @@ export const changedCookieHeaderValue = (
   return [
     `${name}=${value}`,
     'path=/',
-    expires ? `Expires=${expires.toISOString()}; ` : undefined,
+    expires ? `Expires=${expires}; ` : undefined,
     'samesite=none',
     'secure',
     'httponly',