cohabit/website
5
0
Fork 0
Code Issues Pull requests Actions Packages Projects Releases Wiki Activity

fix(api): 🐛 3rd party cookies maybe blocked when opening magic link

Browse source
This commit is contained in:
Julien Oculi 2024-06-20 14:52:16 +02:00
parent 3adc705e25
commit 7568cb43a6
1 changed files with 15 additions and 5 deletions
Show stats Download patch file Download diff file Expand all files Collapse all files

20
routes/api/magiclink/index.ts
View file

@ -4,7 +4,7 @@ import 'npm:iterator-polyfill'
import { FreshContext } from '$fresh/server.ts'
import { Contact, type Mail, send } from '@cohabit/cohamail/mod.ts'
import { magicLinkTemplate } from '@cohabit/cohamail/templates/mod.ts'
import { SessionHandlers } from '../../../src/session/mod.ts'
import { SessionHandlers, SessionStore } from '../../../src/session/mod.ts'
import { respondApi } from '../../../src/utils.ts'
import { sleep } from '@jotsr/delayed'
import { User } from '@cohabit/ressources_manager/src/models/mod.ts'
@ -39,7 +39,7 @@ export const handler: SessionHandlers = {
// generate magic link
const token = crypto.randomUUID()
const endpoint =
`${ctx.url.origin}/api/magiclink?token=${token}&redirect=/profil`
`${ctx.url.origin}/api/magiclink?token=${token}&session=${ctx.state.session.uuid}&redirect=/profil`
// save token to session
ctx.state.session.flash<MagicLinkInfos>(`MAGIC_LINK__${token}`, {
@ -72,11 +72,21 @@ export const handler: SessionHandlers = {
async GET(request, ctx) {
const token = ctx.url.searchParams.get('token')
const redirect = ctx.url.searchParams.get('redirect')
const sessionId = ctx.url.searchParams.get('session')
// no token
if (token === null) {
return respondApi('error', 'no token provided', 400)
// no token or sessionId
if (token === null || sessionId === null) {
return respondApi('error', 'no token or session provided', 400)
}
// set session if 3rd party cookies was blocked
ctx.state.session = ctx.state.session ?? SessionStore.getSession(sessionId)
// no session available
if (ctx.state.session === null) {
return respondApi('error', 'no session datas', 401)
}
// wrong or timeout token
const entry = ctx.state.session.get<MagicLinkInfos>(`MAGIC_LINK__${token}`)