lael-labs/t3code

apps/server/src/auth/EnvironmentAuth.ts+3−1

   const authenticateRequest = (
     request: HttpServerRequest.HttpServerRequest,
   ): Effect.Effect<AuthenticatedSession, ServerAuthCredentialError | ServerAuthInternalError> => {
-    const cookieToken = request.cookies[sessions.cookieName];
+    const cookieToken =
+      request.cookies[sessions.cookieName] ??
+      (sessions.legacyCookieName ? request.cookies[sessions.legacyCookieName] : undefined);
     const bearerToken = parseBearerToken(request);
     const dpopToken = parseDpopToken(request);
     const credential = cookieToken ?? bearerToken ?? dpopToken;

apps/server/src/auth/SessionStore.ts+7−2

 import {
   base64UrlDecodeUtf8,
   base64UrlEncode,
+  resolveLegacySessionCookieName,
   resolveSessionCookieName,
   signPayload,
   timingSafeEqualBase64Url,
   SessionStore,
   {
     readonly cookieName: string;
+    readonly legacyCookieName: string | undefined;
     readonly issue: (input?: {
       readonly ttl?: Duration.Duration;
       readonly subject?: string;
   const signingSecret = yield* secretStore.getOrCreateRandom(SIGNING_SECRET_NAME, 32);
   const connectedSessionsRef = yield* Ref.make(new Map<string, number>());
   const changesPubSub = yield* PubSub.unbounded<SessionCredentialChange>();
-  const cookieName = resolveSessionCookieName({
+  const cookieInput = {
     mode: serverConfig.mode,
     port: serverConfig.port,
     host: serverConfig.host,
     instanceKey: serverConfig.stateDir,
     development: serverConfig.devUrl !== undefined,
-  });
+  } as const;
+  const cookieName = resolveSessionCookieName(cookieInput);
+  const legacyCookieName = resolveLegacySessionCookieName(cookieInput);
   const emitUpsert = (clientSession: AuthClientSession) =>
     PubSub.publish(changesPubSub, {
   return SessionStore.of({
     cookieName,
+    legacyCookieName,
     issue,
     verify,
     issueWebSocketToken,

apps/server/src/auth/http.ts+35−12

   });
 }
+const appendSessionCookie = (cookieName: string, token: string, expiresAt: DateTime.DateTime) =>
+  Effect.fromResult(
+    Cookies.set(Cookies.empty, cookieName, token, {
+      expires: DateTime.toDate(expiresAt),
+      httpOnly: true,
+      path: "/",
+      sameSite: "lax",
+    }),
+  ).pipe(
+    Effect.catch(() => failEnvironmentInternal("browser_session_cookie_failed")),
+    Effect.flatMap((cookies) =>
+      HttpEffect.appendPreResponseHandler((_request, response) =>
+        Effect.succeed(HttpServerResponse.mergeCookies(response, cookies)),
+      ),
+    ),
+  );
 export const requireEnvironmentScope = Effect.fn("environment.auth.requireScope")(function* (
   scope: AuthEnvironmentScope,
 ) {
           function* (args) {
             yield* annotateEnvironmentRequest(args.endpoint.name);
             const request = yield* HttpServerRequest.HttpServerRequest;
-            return yield* serverAuth.getSessionState(request);
+            const result = yield* serverAuth.getSessionState(request);
+            const legacyToken =
+              sessions.legacyCookieName && !request.cookies[sessions.cookieName]
+                ? request.cookies[sessions.legacyCookieName]
+                : undefined;
+            if (
+              legacyToken &&
+              result.authenticated &&
+              result.sessionMethod === "browser-session-cookie" &&
+              result.expiresAt
+            ) {
+              yield* appendSessionCookie(sessions.cookieName, legacyToken, result.expiresAt);
+            }
+            return result;
           },
           Effect.catchIf(EnvironmentAuth.isServerAuthInternalError, (error) =>
             failEnvironmentInternal("internal_error", error),
               args.payload.credential,
               deriveAuthClientMetadata({ request }),
             );
-            const sessionCookies = yield* Effect.fromResult(
+            yield* appendSessionCookie(
-              Cookies.set(Cookies.empty, sessions.cookieName, result.sessionToken, {
+              sessions.cookieName,
-                expires: DateTime.toDate(result.response.expiresAt),
+              result.sessionToken,
-                httpOnly: true,
+              result.response.expiresAt,
-                path: "/",
-                sameSite: "lax",
-              }),
-            ).pipe(Effect.catch(() => failEnvironmentInternal("browser_session_cookie_failed")));
-            yield* HttpEffect.appendPreResponseHandler((_request, response) =>
-              Effect.succeed(HttpServerResponse.mergeCookies(response, sessionCookies)),
             );
             yield* appendCredentialResponseHeaders;
             return result.response;

apps/server/src/auth/utils.ts+10−0

@@ -48,6 +48,16 @@ export function resolveSessionCookieName(input: { · 47 unmodified lines
48	return `${SESSION_COOKIE_NAME}_${input.port}_${instanceHash}`;	48	return `${SESSION_COOKIE_NAME}_${input.port}_${instanceHash}`;
49	}	49	}
50		50
		51	export function resolveLegacySessionCookieName(input: {
		52	readonly mode: "web" \| "desktop";
		53	readonly host: string \| undefined;
		54	readonly development: boolean;
		55	}): string \| undefined {
		56	return input.mode === "web" && !input.development && isRemoteReachableHost(input.host)
		57	? SESSION_COOKIE_NAME
		58	: undefined;
		59	}
		60
51	export function isRemoteReachableHost(host: string \| undefined): boolean {	61	export function isRemoteReachableHost(host: string \| undefined): boolean {
52	if (host === "0.0.0.0" \|\| host === "::" \|\| host === "[::]") {	62	if (host === "0.0.0.0" \|\| host === "::" \|\| host === "[::]") {
53	return true;	63	return true;

apps/server/src/server.test.ts+18−0

@@ -1638,6 +1638,24 @@ it.layer(NodeServices.layer)("server router seam", (it) => { · 1637 unmodified lines
1638	}).pipe(Effect.provide(NodeHttpServer.layerTest)),	1638	}).pipe(Effect.provide(NodeHttpServer.layerTest)),
1639	);	1639	);
1640		1640
		1641	it.effect("migrates a valid legacy remote-web session cookie", () =>
		1642	Effect.gen(function* () {
		1643	yield* buildAppUnderTest({ config: { mode: "web", host: "192.168.1.50" } });
		1644
		1645	const { cookie } = yield* bootstrapBrowserSession();
		1646	const currentCookie = cookie?.split(";")[0] ?? "";
		1647	const legacyCookie = currentCookie.replace(/^t3_session_[^=]+=/, "t3_session=");
		1648	const sessionUrl = yield* getHttpServerUrl("/api/auth/session");
		1649	const response = yield* fetchEffect(sessionUrl, {
		1650	headers: { cookie: legacyCookie },
		1651	});
		1652	const body = yield* responseJsonEffect<{ readonly authenticated: boolean }>(response);
		1653
		1654	assert.equal(body.authenticated, true);
		1655	assert.match(response.headers["set-cookie"] ?? "", /^t3_session_[a-f0-9]{12}=/);
		1656	}).pipe(Effect.provide(NodeHttpServer.layerTest)),
		1657	);
		1658
1641	it.effect("exchanges a bootstrap grant for a scoped bearer access token", () =>	1659	it.effect("exchanges a bootstrap grant for a scoped bearer access token", () =>
1642	Effect.gen(function* () {	1660	Effect.gen(function* () {
1643	yield* buildAppUnderTest();	1661	yield* buildAppUnderTest();