refactor(api): drop cookie support for sudo mode (#2466)

fluxer_api/src/api/Config.ts

@@ -428,7 +428,6 @@ export function buildAPIConfigFromMaster(master: MasterConfig): APIConfig {
 			},
 			bluesky: master.auth.bluesky as BlueskyOAuthConfig,
 		},
-		cookie: master.cookie,
 		klipy: {
 			apiKey: master.integrations.klipy.api_key,
 		},

fluxer_api/src/api/auth/services/SudoVerificationService.ts

@@ -11,7 +11,6 @@ import * as AuthPassword from '../../auth/AuthPassword';
 import {SUDO_MODE_HEADER} from '../../middleware/SudoModeMiddleware';
 import type {User} from '../../models/User';
 import type {HonoEnv} from '../../types/HonoEnv';
-import {setSudoCookie} from '../../utils/SudoCookieUtils';
 import {getSudoModeService} from './SudoModeService';
 
 export interface SudoVerificationBody {
@@ -127,10 +126,6 @@ function setSudoTokenHeader(
 	const tokenToSet = result.sudoToken ?? ctx.req.header(SUDO_MODE_HEADER);
 	if (tokenToSet) {
 		ctx.header(SUDO_MODE_HEADER, tokenToSet);
-		const user = ctx.get('user');
-		if (user) {
-			setSudoCookie(ctx, tokenToSet, user.id.toString());
-		}
 	}
 }
 

fluxer_api/src/api/config/APIConfig.ts

@@ -281,10 +281,6 @@ export interface APIConfig {
 		};
 		bluesky: BlueskyOAuthConfig;
 	};
-	cookie: {
-		domain: string;
-		secure: boolean;
-	};
 	klipy: {
 		apiKey?: string;
 	};

fluxer_api/src/api/middleware/SudoModeMiddleware.ts

@@ -3,7 +3,6 @@
 import {createMiddleware} from 'hono/factory';
 import {getSudoModeService} from '../auth/services/SudoModeService';
 import type {HonoEnv} from '../types/HonoEnv';
-import {getSudoCookie} from '../utils/SudoCookieUtils';
 
 export const SUDO_MODE_HEADER = 'X-Fluxer-Sudo-Mode-JWT';
 export const SudoModeMiddleware = createMiddleware<HonoEnv>(async (ctx, next) => {
@@ -19,11 +18,7 @@ export const SudoModeMiddleware = createMiddleware<HonoEnv>(async (ctx, next) =>
 		await next();
 		return;
 	}
-	const sudoToken = ctx.req.header(SUDO_MODE_HEADER);
+	const tokenToVerify = ctx.req.header(SUDO_MODE_HEADER);
-	let tokenToVerify: string | undefined = sudoToken;
-	if (!tokenToVerify) {
-		tokenToVerify = getSudoCookie(ctx, user.id.toString());
-	}
 	if (!tokenToVerify) {
 		await next();
 		return;

fluxer_api/src/api/utils/SudoCookieUtils.ts

@@ -1,58 +0,0 @@
-// SPDX-License-Identifier: AGPL-3.0-or-later
-
-import type {Context} from 'hono';
-import {getCookie, setCookie} from 'hono/cookie';
-import {seconds} from 'itty-time';
-import {Config} from '../Config';
-import type {HonoEnv} from '../types/HonoEnv';
-
-const SUDO_COOKIE_PREFIX = '__flx_sudo';
-const SUDO_COOKIE_MAX_AGE = seconds('5 minutes');
-
-function getCookieDomain(): string {
-	const domain = Config.cookie.domain;
-	if (domain) {
-		return domain;
-	}
-	try {
-		const url = new URL(Config.endpoints.webApp);
-		const hostname = url.hostname;
-		const parts = hostname.split('.');
-		if (parts.length >= 2) {
-			return `.${parts.slice(-2).join('.')}`;
-		} else {
-			return hostname;
-		}
-	} catch {
-		return '';
-	}
-}
-
-function getSudoCookieOptions() {
-	return {
-		httpOnly: true,
-		secure: Config.cookie.secure,
-		sameSite: 'Strict' as const,
-		domain: getCookieDomain(),
-		path: '/',
-		maxAge: SUDO_COOKIE_MAX_AGE,
-	};
-}
-
-function sudoCookieName(userId?: string | number): string {
-	if (userId === undefined || userId === null) {
-		return SUDO_COOKIE_PREFIX;
-	}
-	return `${SUDO_COOKIE_PREFIX}_${userId}`;
-}
-
-export function setSudoCookie(ctx: Context<HonoEnv>, token: string, userId?: string | number): void {
-	const cookieName = sudoCookieName(userId);
-	const options = getSudoCookieOptions();
-	setCookie(ctx, cookieName, token, options);
-}
-
-export function getSudoCookie(ctx: Context<HonoEnv>, userId?: string | number): string | undefined {
-	const cookieName = sudoCookieName(userId);
-	return getCookie(ctx, cookieName);
-}

packages/config/src/ConfigLoader.ts

@@ -181,10 +181,6 @@ function defaultConfig(): MasterConfig {
 				keys: [],
 			},
 		},
-		cookie: {
-			domain: '',
-			secure: false,
-		},
 		integrations: {
 			email: {
 				enabled: false,

packages/config/src/MasterConfig.ts

@@ -203,10 +203,6 @@ export interface MasterConfig {
 			}>;
 		};
 	};
-	cookie: {
-		domain: string;
-		secure: boolean;
-	};
 	integrations: {
 		email: {
 			enabled: boolean;

packages/config/src/config_loader/EnvironmentOverrides.ts

@@ -371,8 +371,6 @@ const NAMED_FLUXER_ENV_OVERRIDES: Record<string, NamedEnvOverride> = {
 	FLUXER_PUSH_FCM_SERVICE_ACCOUNT_JSON_PATH: {path: ['integrations', 'push', 'fcm', 'service_account_json_path']},
 	FLUXER_PUSH_FCM_TOKEN_URI: {path: ['integrations', 'push', 'fcm', 'token_uri']},
 	FLUXER_PUSH_FCM_APPS: {path: ['integrations', 'push', 'fcm', 'apps'], parse: parseEnvValue},
-	FLUXER_COOKIE_DOMAIN: {path: ['cookie', 'domain']},
-	FLUXER_COOKIE_SECURE: {path: ['cookie', 'secure'], parse: parseEnvValue},
 	FLUXER_SELF_HOSTED: {path: ['instance', 'self_hosted'], parse: parseEnvValue},
 	FLUXER_AUTO_JOIN_INVITE_CODE: {path: ['instance', 'auto_join_invite_code']},
 	FLUXER_VISIONARIES_GUILD_ID: {path: ['instance', 'visionaries_guild_id']},