Skip to content

Commit 91e03ba

Browse files
ralyodioclaude
ralyodio
and
claude
authored
Derive the Supabase auth cookie name from NEXT_PUBLIC_SUPABASE_URL (#261)
Five API routes read the session cookie by its cloud-derived name sb-xydzwxwsbgmznthiiscl-auth-token. supabase-js names it after the first host label of the project URL, so once the project lives at supabase.qrypt.chat the cookie is sb-supabase-auth-token and those routes would treat every user as logged out. Compute it from the URL instead. Co-authored-by: Claude Fable 5.1 <noreply@anthropic.com>
1 parent a9e9938 commit 91e03ba

13 files changed

Lines changed: 53 additions & 27 deletions

File tree

‎src/app/api/auth/backup-pin/route.js‎

Lines changed: 3 additions & 2 deletions
Original file line numberDiff line numberDiff line change
@@ -5,6 +5,7 @@ import { NextResponse } from 'next/server';
55
import { randomBytes, scrypt as scryptCallback } from 'node:crypto';
66
import { promisify } from 'node:util';
77
import { createClient } from '@supabase/supabase-js';
8+
import { supabaseAuthCookieName } from '@/lib/supabase/auth-cookie.js';
89
import { createServiceRoleClient } from '@/lib/supabase/service-role.js';
910

1011
// node:crypto is required for scrypt, so pin this route to the Node runtime.
@@ -65,9 +66,9 @@ async function authenticateUser(request) {
6566

6667
let accessToken = null;
6768

68-
if (cookies['sb-xydzwxwsbgmznthiiscl-auth-token']) {
69+
if (cookies[supabaseAuthCookieName()]) {
6970
try {
70-
let tokenData = cookies['sb-xydzwxwsbgmznthiiscl-auth-token'];
71+
let tokenData = cookies[supabaseAuthCookieName()];
7172
if (tokenData.startsWith('base64-')) {
7273
tokenData = Buffer.from(tokenData.substring(7), 'base64').toString('utf-8');
7374
}

‎src/app/api/auth/backup-pin/route.test.js‎

Lines changed: 4 additions & 3 deletions
Original file line numberDiff line numberDiff line change
@@ -1,3 +1,4 @@
1+
import { supabaseAuthCookieName } from '@/lib/supabase/auth-cookie.js';
12
import { beforeEach, describe, expect, it, vi } from 'vitest';
23

34
import { createHash } from 'node:crypto';
@@ -83,7 +84,7 @@ describe('backup PIN cookie authentication', () => {
8384
const response = await GET(
8485
new Request('https://qrypt.chat/api/auth/backup-pin', {
8586
headers: {
86-
cookie: `sb-xydzwxwsbgmznthiiscl-auth-token=${cookieValue('access-token')};session=ignored`
87+
cookie: `${supabaseAuthCookieName()}=${cookieValue('access-token')};session=ignored`
8788
}
8889
})
8990
);
@@ -99,7 +100,7 @@ describe('backup PIN cookie authentication', () => {
99100
const response = await GET(
100101
new Request('https://qrypt.chat/api/auth/backup-pin', {
101102
headers: {
102-
cookie: `sb-xydzwxwsbgmznthiiscl-auth-token=${paddedCookieValue()}`
103+
cookie: `${supabaseAuthCookieName()}=${paddedCookieValue()}`
103104
}
104105
})
105106
);
@@ -130,7 +131,7 @@ describe('backup PIN cookie authentication', () => {
130131
new Request('https://qrypt.chat/api/auth/backup-pin', {
131132
headers: {
132133
authorization: 'Bearer ',
133-
cookie: `sb-xydzwxwsbgmznthiiscl-auth-token=${cookieValue('cookie-token')}`
134+
cookie: `${supabaseAuthCookieName()}=${cookieValue('cookie-token')}`
134135
}
135136
})
136137
);

‎src/app/api/auth/key-backup/route.js‎

Lines changed: 3 additions & 2 deletions
Original file line numberDiff line numberDiff line change
@@ -3,6 +3,7 @@
33

44
import { NextResponse } from 'next/server';
55
import { createClient } from '@supabase/supabase-js';
6+
import { supabaseAuthCookieName } from '@/lib/supabase/auth-cookie.js';
67
import { createServiceRoleClient } from '@/lib/supabase/service-role.js';
78

89
// Lazy service role client creation
@@ -61,9 +62,9 @@ async function authenticateUser(request) {
6162
let accessToken = null;
6263

6364
// Try Supabase-specific cookies first
64-
if (cookies['sb-xydzwxwsbgmznthiiscl-auth-token']) {
65+
if (cookies[supabaseAuthCookieName()]) {
6566
try {
66-
let tokenData = cookies['sb-xydzwxwsbgmznthiiscl-auth-token'];
67+
let tokenData = cookies[supabaseAuthCookieName()];
6768
if (tokenData.startsWith('base64-')) {
6869
tokenData = Buffer.from(tokenData.substring(7), 'base64').toString('utf-8');
6970
}

‎src/app/api/auth/key-backup/route.test.js‎

Lines changed: 4 additions & 3 deletions
Original file line numberDiff line numberDiff line change
@@ -1,3 +1,4 @@
1+
import { supabaseAuthCookieName } from '@/lib/supabase/auth-cookie.js';
12
import { beforeEach, describe, expect, it, vi } from 'vitest';
23

34
const mocks = vi.hoisted(() => ({
@@ -85,7 +86,7 @@ describe('key backup cookie authentication', () => {
8586
const response = await GET(
8687
new Request('https://qrypt.chat/api/auth/key-backup', {
8788
headers: {
88-
cookie: `sb-xydzwxwsbgmznthiiscl-auth-token=${cookieValue('access-token')};session=ignored`
89+
cookie: `${supabaseAuthCookieName()}=${cookieValue('access-token')};session=ignored`
8990
}
9091
})
9192
);
@@ -107,7 +108,7 @@ describe('key backup cookie authentication', () => {
107108
const response = await GET(
108109
new Request('https://qrypt.chat/api/auth/key-backup', {
109110
headers: {
110-
cookie: `sb-xydzwxwsbgmznthiiscl-auth-token=${paddedCookieValue()}`
111+
cookie: `${supabaseAuthCookieName()}=${paddedCookieValue()}`
111112
}
112113
})
113114
);
@@ -136,7 +137,7 @@ describe('key backup cookie authentication', () => {
136137
new Request('https://qrypt.chat/api/auth/key-backup', {
137138
headers: {
138139
authorization: 'Bearer ',
139-
cookie: `sb-xydzwxwsbgmznthiiscl-auth-token=${cookieValue('cookie-token')}`
140+
cookie: `${supabaseAuthCookieName()}=${cookieValue('cookie-token')}`
140141
}
141142
})
142143
);

‎src/app/api/auth/salt/route.test.js‎

Lines changed: 3 additions & 2 deletions
Original file line numberDiff line numberDiff line change
@@ -1,3 +1,4 @@
1+
import { supabaseAuthCookieName } from '@/lib/supabase/auth-cookie.js';
12
import { beforeEach, describe, expect, it, vi } from 'vitest';
23

34
const mocks = vi.hoisted(() => ({
@@ -71,7 +72,7 @@ describe('salt cookie authentication', () => {
7172
const response = await GET(
7273
new Request('https://qrypt.chat/api/auth/salt', {
7374
headers: {
74-
cookie: `sb-xydzwxwsbgmznthiiscl-auth-token=${cookieValue('access-token')};session=ignored`
75+
cookie: `${supabaseAuthCookieName()}=${cookieValue('access-token')};session=ignored`
7576
}
7677
})
7778
);
@@ -104,7 +105,7 @@ describe('salt cookie authentication', () => {
104105
new Request('https://qrypt.chat/api/auth/salt', {
105106
headers: {
106107
authorization: 'Bearer ',
107-
cookie: `sb-xydzwxwsbgmznthiiscl-auth-token=${cookieValue('cookie-token')}`
108+
cookie: `${supabaseAuthCookieName()}=${cookieValue('cookie-token')}`
108109
}
109110
})
110111
);

‎src/app/api/chat/conversations/[id]/participants/route.js‎

Lines changed: 3 additions & 2 deletions
Original file line numberDiff line numberDiff line change
@@ -3,6 +3,7 @@
33

44
import { NextResponse } from 'next/server';
55
import { createClient } from '@supabase/supabase-js';
6+
import { supabaseAuthCookieName } from '@/lib/supabase/auth-cookie.js';
67
import { createServiceRoleClient } from '@/lib/supabase/service-role.js';
78

89
// Lazy service role client creation
@@ -50,10 +51,10 @@ async function authenticateUser(request) {
5051
console.log('🔐 Available cookies:', Object.keys(cookies));
5152

5253
// Try Supabase-specific cookies first
53-
if (cookies['sb-xydzwxwsbgmznthiiscl-auth-token']) {
54+
if (cookies[supabaseAuthCookieName()]) {
5455
console.log('🔐 Found Supabase auth token cookie');
5556
try {
56-
let tokenData = cookies['sb-xydzwxwsbgmznthiiscl-auth-token'];
57+
let tokenData = cookies[supabaseAuthCookieName()];
5758
if (tokenData.startsWith('base64-')) {
5859
tokenData = Buffer.from(tokenData.substring(7), 'base64').toString('utf-8');
5960
}

‎src/app/api/chat/conversations/[id]/participants/route.test.js‎

Lines changed: 2 additions & 1 deletion
Original file line numberDiff line numberDiff line change
@@ -1,3 +1,4 @@
1+
import { supabaseAuthCookieName } from '@/lib/supabase/auth-cookie.js';
12
import { beforeEach, describe, expect, it, vi } from 'vitest';
23

34
const mocks = vi.hoisted(() => ({
@@ -126,7 +127,7 @@ describe('GET /api/chat/conversations/[id]/participants', () => {
126127
const { GET } = await import('./route.js');
127128
const response = await GET(
128129
new Request('https://qrypt.chat/api/chat/conversations/conversation-1/participants', {
129-
headers: { cookie: `sb-xydzwxwsbgmznthiiscl-auth-token=${paddedCookieValue()}` }
130+
headers: { cookie: `${supabaseAuthCookieName()}=${paddedCookieValue()}` }
130131
}),
131132
{ params: Promise.resolve({ id: 'conversation-1' }) }
132133
);

‎src/app/api/crypto/public-keys/all/route.js‎

Lines changed: 3 additions & 2 deletions
Original file line numberDiff line numberDiff line change
@@ -1,5 +1,6 @@
11
import { NextResponse } from 'next/server';
22
import { createClient } from '@supabase/supabase-js';
3+
import { supabaseAuthCookieName } from '@/lib/supabase/auth-cookie.js';
34

45
// Regular (anon) client used ONLY to validate the caller's JWT. Never use the
56
// service-role key for auth checks.
@@ -33,9 +34,9 @@ async function authenticateUser(request) {
3334
let accessToken = null;
3435

3536
// Supabase-specific auth cookie first
36-
if (cookies['sb-xydzwxwsbgmznthiiscl-auth-token']) {
37+
if (cookies[supabaseAuthCookieName()]) {
3738
try {
38-
let tokenData = cookies['sb-xydzwxwsbgmznthiiscl-auth-token'];
39+
let tokenData = cookies[supabaseAuthCookieName()];
3940
if (tokenData.startsWith('base64-')) {
4041
tokenData = Buffer.from(tokenData.substring(7), 'base64').toString('utf-8');
4142
}

‎src/app/api/crypto/public-keys/all/route.test.js‎

Lines changed: 2 additions & 1 deletion
Original file line numberDiff line numberDiff line change
@@ -1,3 +1,4 @@
1+
import { supabaseAuthCookieName } from '@/lib/supabase/auth-cookie.js';
12
import { beforeEach, describe, expect, it, vi } from 'vitest';
23

34
const mocks = vi.hoisted(() => ({
@@ -32,7 +33,7 @@ describe('all public keys cookie authentication', () => {
3233
const response = await GET(
3334
new Request('https://qrypt.chat/api/crypto/public-keys/all', {
3435
headers: {
35-
cookie: 'sb-xydzwxwsbgmznthiiscl-auth-token=base64-eyJhY2Nlc3NfdG9rZW4iOiJhYmMiLCJwYWRkaW5nIjoieCJ9==',
36+
cookie: `${supabaseAuthCookieName()}=base64-eyJhY2Nlc3NfdG9rZW4iOiJhYmMiLCJwYWRkaW5nIjoieCJ9==`,
3637
},
3738
}),
3839
);

‎src/app/api/crypto/public-keys/route.js‎

Lines changed: 3 additions & 2 deletions
Original file line numberDiff line numberDiff line change
@@ -3,6 +3,7 @@
33

44
import { NextResponse } from 'next/server';
55
import { createClient } from '@supabase/supabase-js';
6+
import { supabaseAuthCookieName } from '@/lib/supabase/auth-cookie.js';
67
import { createServiceRoleClient } from '@/lib/supabase/service-role.js';
78

89
// Lazy service role client creation
@@ -65,9 +66,9 @@ async function authenticateUser(request) {
6566
let accessToken = null;
6667

6768
// Try Supabase-specific cookies first
68-
if (cookies['sb-xydzwxwsbgmznthiiscl-auth-token']) {
69+
if (cookies[supabaseAuthCookieName()]) {
6970
try {
70-
let tokenData = cookies['sb-xydzwxwsbgmznthiiscl-auth-token'];
71+
let tokenData = cookies[supabaseAuthCookieName()];
7172
if (tokenData.startsWith('base64-')) {
7273
tokenData = Buffer.from(tokenData.substring(7), 'base64').toString('utf-8');
7374
}

0 commit comments

Comments
 (0)