46 lines
1.4 KiB
TypeScript
46 lines
1.4 KiB
TypeScript
import { addHTTPMiddleware } from "#pikku/pikku-types.gen.js"
|
|
import { authBearer, cors } from '@pikku/core/middleware'
|
|
import { betterAuthStatelessSession } from '@pikku/better-auth'
|
|
|
|
addHTTPMiddleware('*', [
|
|
// Stateless: reads the signed session cookie cache (needs session.cookieCache
|
|
// in auth.wiring) instead of services.auth(), which is tree-shaken off the RPC
|
|
// bundle on the deployed CF Worker (betterAuthSession 500s there with
|
|
// "services.auth is not a function").
|
|
betterAuthStatelessSession({
|
|
mapSession: ({ user }) => ({
|
|
userId: user.id,
|
|
name: user.name,
|
|
role: user.role,
|
|
type: user.type,
|
|
}),
|
|
}),
|
|
// External consoles (sandbox/woven-build view) can't carry the session cookie,
|
|
// so they authenticate with `Authorization: Bearer <PIKKU_CONSOLE_TOKEN>`. The
|
|
// CLI normally emits this alongside its session middleware, but our own global
|
|
// session middleware makes it step aside (pikku#754) — so add the console-token
|
|
// bridge here or console:* RPCs 403 in the sandbox.
|
|
authBearer({
|
|
token: {
|
|
secretId: 'PIKKU_CONSOLE_TOKEN',
|
|
userSession: { userId: 'pikku-console-token' },
|
|
},
|
|
}),
|
|
])
|
|
|
|
const frontendOrigins = [
|
|
'http://localhost:3001',
|
|
'http://127.0.0.1:3001',
|
|
]
|
|
|
|
if (process.env.DOMAIN) {
|
|
frontendOrigins.push(`https://${process.env.DOMAIN}`)
|
|
}
|
|
|
|
addHTTPMiddleware('*', [
|
|
cors({
|
|
origin: frontendOrigins,
|
|
credentials: true,
|
|
}),
|
|
])
|