fix(cloudflare): replace process.env with SvelteKit env modules

commit: 293f7fed042ca1bea935d2186030d3087e3fec51
author: bnema · 9mo ago · 2026-01-18 22:08 UTC
parent: 13a549c
signature: GPG VerifiedCD88F9E564E0102646FB6077A1A07C7C7C3E349D · arch-gpg Verified for the committer email

2 files · +11 -9

M src/lib/api/session.cookie.ts +9 -7

@@ -1,4 +1,6 @@
1	1		import type { Cookies } from '@sveltejs/kit';
	2	+	import { dev } from '$app/environment';
	3	+	import { env } from '$env/dynamic/private';
2	4		import { createLogger } from '$lib/utils/logger.server';
3	5
4	6		const log = createLogger('session-cookie');

@@ -6,19 +8,19 @@ const log = createLogger('session-cookie');
6	8		// Helper function to determine cookie domain
7	9		function getCookieDomain(): string \| undefined {
8	10		// Allow explicit override via environment variable
9		-	const envDomain = process.env.COOKIE_DOMAIN;
	11	+	const envDomain = env.COOKIE_DOMAIN;
10	12		if (envDomain) {
11	13		log.debug('Using COOKIE_DOMAIN from environment:', { domain: envDomain });
12	14		return envDomain;
13	15		}
14	16
15		-	if (process.env.NODE_ENV === 'production') {
	17	+	if (!dev) {
16	18		// Check for Cloudflare Pages domain
17		-	if (process.env.CF_PAGES_URL) {
18		-	const url = process.env.CF_PAGES_URL;
	19	+	if (env.CF_PAGES_URL) {
	20	+	const url = env.CF_PAGES_URL;
19	21		log.debug('Cloudflare Pages URL:', { url });
20	22		// For preview deployments, use host-only cookie
21		-	if (process.env.CF_PAGES_BRANCH !== 'main') {
	23	+	if (env.CF_PAGES_BRANCH !== 'main') {
22	24		return undefined;
23	25		}
24	26		// For production on Cloudflare Pages, use host-only cookie (safest default)

@@ -44,7 +46,7 @@ export function setSessionTokenCookie(
44	46		cookies.set('session', token, {
45	47		httpOnly: true,
46	48		sameSite: 'lax',
47		-	secure: process.env.NODE_ENV === 'production',
	49	+	secure: !dev,
48	50		domain,
49	51		expires: new Date(expiresAt),
50	52		path: '/'

@@ -60,7 +62,7 @@ export function deleteSessionTokenCookie({ cookies }: { cookies: Cookies }): voi
60	62		cookies.set('session', '', {
61	63		httpOnly: true,
62	64		sameSite: 'lax',
63		-	secure: process.env.NODE_ENV === 'production',
	65	+	secure: !dev,
64	66		domain,
65	67		maxAge: 0,
66	68		path: '/'

 import type { Cookies } from '@sveltejs/kit';
+import { dev } from '$app/environment';
+import { env } from '$env/dynamic/private';
 import { createLogger } from '$lib/utils/logger.server';
 const log = createLogger('session-cookie');
 // Helper function to determine cookie domain
 function getCookieDomain(): string | undefined {
 	// Allow explicit override via environment variable
-	const envDomain = process.env.COOKIE_DOMAIN;
+	const envDomain = env.COOKIE_DOMAIN;
 	if (envDomain) {
 		log.debug('Using COOKIE_DOMAIN from environment:', { domain: envDomain });
 		return envDomain;
 	}
-	if (process.env.NODE_ENV === 'production') {
+	if (!dev) {
 		// Check for Cloudflare Pages domain
-		if (process.env.CF_PAGES_URL) {
+		if (env.CF_PAGES_URL) {
-			const url = process.env.CF_PAGES_URL;
+			const url = env.CF_PAGES_URL;
 			log.debug('Cloudflare Pages URL:', { url });
 			// For preview deployments, use host-only cookie
-			if (process.env.CF_PAGES_BRANCH !== 'main') {
+			if (env.CF_PAGES_BRANCH !== 'main') {
 				return undefined;
 			}
 			// For production on Cloudflare Pages, use host-only cookie (safest default)
 	cookies.set('session', token, {
 		httpOnly: true,
 		sameSite: 'lax',
-		secure: process.env.NODE_ENV === 'production',
+		secure: !dev,
 		domain,
 		expires: new Date(expiresAt),
 		path: '/'
 	cookies.set('session', '', {
 		httpOnly: true,
 		sameSite: 'lax',
-		secure: process.env.NODE_ENV === 'production',
+		secure: !dev,
 		domain,
 		maxAge: 0,
 		path: '/'

M src/lib/utils/turnstile.server.ts +2 -2

@@ -1,8 +1,8 @@
1	1		import { TURNSTILE_SECRET_KEY } from '$env/static/private';
	2	+	import { dev } from '$app/environment';
2	3		import { createLogger } from './logger.server';
3	4
4	5		const log = createLogger('turnstile');
5		-	const isDev = process.env.NODE_ENV === 'development';
6	6
7	7		interface TurnstileVerifyResponse {
8	8		success: boolean;

@@ -15,7 +15,7 @@ interface TurnstileVerifyResponse {
15	15
16	16		export async function validateTurnstileToken(token: string, remoteip?: string): Promise<boolean> {
17	17		// Always return true in development mode
18		-	if (isDev) {
	18	+	if (dev) {
19	19		log.debug('Development mode: bypassing Turnstile validation');
20	20		return true;
21	21		}

 import { TURNSTILE_SECRET_KEY } from '$env/static/private';
+import { dev } from '$app/environment';
 import { createLogger } from './logger.server';
 const log = createLogger('turnstile');
-const isDev = process.env.NODE_ENV === 'development';
 interface TurnstileVerifyResponse {
 	success: boolean;
 export async function validateTurnstileToken(token: string, remoteip?: string): Promise<boolean> {
 	// Always return true in development mode
-	if (isDev) {
+	if (dev) {
 		log.debug('Development mode: bypassing Turnstile validation');
 		return true;
 	}