session.cookie.ts RawHistoryFolder

1import type { Cookies } from '@sveltejs/kit';
2import { dev } from '$app/environment';
3import { env } from '$env/dynamic/private';
4import { createLogger } from '$lib/utils/logger.server';
5
6const log = createLogger('session-cookie');
7
8// Helper function to determine cookie domain
9function getCookieDomain(): string | undefined {
10	// Allow explicit override via environment variable
11	const envDomain = env.COOKIE_DOMAIN;
12	if (envDomain) {
13		log.debug('Using COOKIE_DOMAIN from environment:', { domain: envDomain });
14		return envDomain;
15	}
16
17	if (!dev) {
18		// Check for Cloudflare Pages domain
19		if (env.CF_PAGES_URL) {
20			const url = env.CF_PAGES_URL;
21			log.debug('Cloudflare Pages URL:', { url });
22			// For preview deployments, use host-only cookie
23			if (env.CF_PAGES_BRANCH !== 'main') {
24				return undefined;
25			}
26			// For production on Cloudflare Pages, use host-only cookie (safest default)
27			// Set COOKIE_DOMAIN explicitly if cross-subdomain cookies are needed
28			return undefined;
29		}
30		// Production without explicit domain - use host-only cookie (safest default)
31		return undefined;
32	}
33	return undefined;
34}
35
36export function setSessionTokenCookie(
37	{ cookies }: { cookies: Cookies },
38	token: string,
39	expiresAt: number
40): void {
41	log.debug('Setting session cookie with expiry:', new Date(expiresAt));
42
43	const domain = getCookieDomain();
44	log.debug('Setting cookie for domain:', { domain });
45
46	cookies.set('session', token, {
47		httpOnly: true,
48		sameSite: 'lax',
49		secure: !dev,
50		domain,
51		expires: new Date(expiresAt),
52		path: '/'
53	});
54}
55
56export function deleteSessionTokenCookie({ cookies }: { cookies: Cookies }): void {
57	log.debug('Deleting session cookie');
58
59	const domain = getCookieDomain();
60	log.debug('Deleting cookie for domain:', { domain });
61
62	cookies.set('session', '', {
63		httpOnly: true,
64		sameSite: 'lax',
65		secure: !dev,
66		domain,
67		maxAge: 0,
68		path: '/'
69	});
70}
71
72export function getSessionTokenCookie({ cookies }: { cookies: Cookies }): string | undefined {
73	log.debug('Getting session cookie');
74	return cookies.get('session');
75}