From 12718eabbce30589ccdae0934e9f7ef29e4cc1fc Mon Sep 17 00:00:00 2001 From: Hampus Date: Sat, 5 Sep 2026 01:29:34 +0200 Subject: [PATCH] refactor(api): drop cookie support for sudo mode (#2466) --- fluxer_api/src/api/Config.ts | 1 - .../auth/services/SudoVerificationService.ts | 5 -- fluxer_api/src/api/config/APIConfig.ts | 4 -- .../src/api/middleware/SudoModeMiddleware.ts | 7 +-- fluxer_api/src/api/utils/SudoCookieUtils.ts | 58 ------------------- packages/config/src/ConfigLoader.ts | 4 -- packages/config/src/MasterConfig.ts | 4 -- .../src/config_loader/EnvironmentOverrides.ts | 2 - 8 files changed, 1 insertion(+), 84 deletions(-) delete mode 100644 fluxer_api/src/api/utils/SudoCookieUtils.ts diff --git a/fluxer_api/src/api/Config.ts b/fluxer_api/src/api/Config.ts index f7ba9c8c8..a75d21834 100644 --- a/fluxer_api/src/api/Config.ts +++ b/fluxer_api/src/api/Config.ts @@ -428,7 +428,6 @@ export function buildAPIConfigFromMaster(master: MasterConfig): APIConfig { }, bluesky: master.auth.bluesky as BlueskyOAuthConfig, }, - cookie: master.cookie, klipy: { apiKey: master.integrations.klipy.api_key, }, diff --git a/fluxer_api/src/api/auth/services/SudoVerificationService.ts b/fluxer_api/src/api/auth/services/SudoVerificationService.ts index 28cb79aac..f886d8207 100644 --- a/fluxer_api/src/api/auth/services/SudoVerificationService.ts +++ b/fluxer_api/src/api/auth/services/SudoVerificationService.ts @@ -11,7 +11,6 @@ import * as AuthPassword from '../../auth/AuthPassword'; import {SUDO_MODE_HEADER} from '../../middleware/SudoModeMiddleware'; import type {User} from '../../models/User'; import type {HonoEnv} from '../../types/HonoEnv'; -import {setSudoCookie} from '../../utils/SudoCookieUtils'; import {getSudoModeService} from './SudoModeService'; export interface SudoVerificationBody { @@ -127,10 +126,6 @@ function setSudoTokenHeader( const tokenToSet = result.sudoToken ?? ctx.req.header(SUDO_MODE_HEADER); if (tokenToSet) { ctx.header(SUDO_MODE_HEADER, tokenToSet); - const user = ctx.get('user'); - if (user) { - setSudoCookie(ctx, tokenToSet, user.id.toString()); - } } } diff --git a/fluxer_api/src/api/config/APIConfig.ts b/fluxer_api/src/api/config/APIConfig.ts index 6d1a5b744..dfd4132d0 100644 --- a/fluxer_api/src/api/config/APIConfig.ts +++ b/fluxer_api/src/api/config/APIConfig.ts @@ -281,10 +281,6 @@ export interface APIConfig { }; bluesky: BlueskyOAuthConfig; }; - cookie: { - domain: string; - secure: boolean; - }; klipy: { apiKey?: string; }; diff --git a/fluxer_api/src/api/middleware/SudoModeMiddleware.ts b/fluxer_api/src/api/middleware/SudoModeMiddleware.ts index fce3f5136..2c389239c 100644 --- a/fluxer_api/src/api/middleware/SudoModeMiddleware.ts +++ b/fluxer_api/src/api/middleware/SudoModeMiddleware.ts @@ -3,7 +3,6 @@ import {createMiddleware} from 'hono/factory'; import {getSudoModeService} from '../auth/services/SudoModeService'; import type {HonoEnv} from '../types/HonoEnv'; -import {getSudoCookie} from '../utils/SudoCookieUtils'; export const SUDO_MODE_HEADER = 'X-Fluxer-Sudo-Mode-JWT'; export const SudoModeMiddleware = createMiddleware(async (ctx, next) => { @@ -19,11 +18,7 @@ export const SudoModeMiddleware = createMiddleware(async (ctx, next) => await next(); return; } - const sudoToken = ctx.req.header(SUDO_MODE_HEADER); - let tokenToVerify: string | undefined = sudoToken; - if (!tokenToVerify) { - tokenToVerify = getSudoCookie(ctx, user.id.toString()); - } + const tokenToVerify = ctx.req.header(SUDO_MODE_HEADER); if (!tokenToVerify) { await next(); return; diff --git a/fluxer_api/src/api/utils/SudoCookieUtils.ts b/fluxer_api/src/api/utils/SudoCookieUtils.ts deleted file mode 100644 index 584f4bdd0..000000000 --- a/fluxer_api/src/api/utils/SudoCookieUtils.ts +++ /dev/null @@ -1,58 +0,0 @@ -// SPDX-License-Identifier: AGPL-3.0-or-later - -import type {Context} from 'hono'; -import {getCookie, setCookie} from 'hono/cookie'; -import {seconds} from 'itty-time'; -import {Config} from '../Config'; -import type {HonoEnv} from '../types/HonoEnv'; - -const SUDO_COOKIE_PREFIX = '__flx_sudo'; -const SUDO_COOKIE_MAX_AGE = seconds('5 minutes'); - -function getCookieDomain(): string { - const domain = Config.cookie.domain; - if (domain) { - return domain; - } - try { - const url = new URL(Config.endpoints.webApp); - const hostname = url.hostname; - const parts = hostname.split('.'); - if (parts.length >= 2) { - return `.${parts.slice(-2).join('.')}`; - } else { - return hostname; - } - } catch { - return ''; - } -} - -function getSudoCookieOptions() { - return { - httpOnly: true, - secure: Config.cookie.secure, - sameSite: 'Strict' as const, - domain: getCookieDomain(), - path: '/', - maxAge: SUDO_COOKIE_MAX_AGE, - }; -} - -function sudoCookieName(userId?: string | number): string { - if (userId === undefined || userId === null) { - return SUDO_COOKIE_PREFIX; - } - return `${SUDO_COOKIE_PREFIX}_${userId}`; -} - -export function setSudoCookie(ctx: Context, token: string, userId?: string | number): void { - const cookieName = sudoCookieName(userId); - const options = getSudoCookieOptions(); - setCookie(ctx, cookieName, token, options); -} - -export function getSudoCookie(ctx: Context, userId?: string | number): string | undefined { - const cookieName = sudoCookieName(userId); - return getCookie(ctx, cookieName); -} diff --git a/packages/config/src/ConfigLoader.ts b/packages/config/src/ConfigLoader.ts index 11d61eda8..c5b740178 100644 --- a/packages/config/src/ConfigLoader.ts +++ b/packages/config/src/ConfigLoader.ts @@ -181,10 +181,6 @@ function defaultConfig(): MasterConfig { keys: [], }, }, - cookie: { - domain: '', - secure: false, - }, integrations: { email: { enabled: false, diff --git a/packages/config/src/MasterConfig.ts b/packages/config/src/MasterConfig.ts index 236a9ef3b..a8162a85c 100644 --- a/packages/config/src/MasterConfig.ts +++ b/packages/config/src/MasterConfig.ts @@ -203,10 +203,6 @@ export interface MasterConfig { }>; }; }; - cookie: { - domain: string; - secure: boolean; - }; integrations: { email: { enabled: boolean; diff --git a/packages/config/src/config_loader/EnvironmentOverrides.ts b/packages/config/src/config_loader/EnvironmentOverrides.ts index 8df06bfba..251ac371a 100644 --- a/packages/config/src/config_loader/EnvironmentOverrides.ts +++ b/packages/config/src/config_loader/EnvironmentOverrides.ts @@ -371,8 +371,6 @@ const NAMED_FLUXER_ENV_OVERRIDES: Record = { FLUXER_PUSH_FCM_SERVICE_ACCOUNT_JSON_PATH: {path: ['integrations', 'push', 'fcm', 'service_account_json_path']}, FLUXER_PUSH_FCM_TOKEN_URI: {path: ['integrations', 'push', 'fcm', 'token_uri']}, FLUXER_PUSH_FCM_APPS: {path: ['integrations', 'push', 'fcm', 'apps'], parse: parseEnvValue}, - FLUXER_COOKIE_DOMAIN: {path: ['cookie', 'domain']}, - FLUXER_COOKIE_SECURE: {path: ['cookie', 'secure'], parse: parseEnvValue}, FLUXER_SELF_HOSTED: {path: ['instance', 'self_hosted'], parse: parseEnvValue}, FLUXER_AUTO_JOIN_INVITE_CODE: {path: ['instance', 'auto_join_invite_code']}, FLUXER_VISIONARIES_GUILD_ID: {path: ['instance', 'visionaries_guild_id']},