From ec334bbed47e5dd637b2960d0bfef3d083d77924 Mon Sep 17 00:00:00 2001 From: yohlo Date: Sat, 11 Jul 2026 13:11:45 -0700 Subject: [PATCH] auth fix? --- src/app/routes/__root.tsx | 3 +++ src/app/routes/refresh-session.tsx | 11 +++++++++-- src/features/players/server.ts | 10 +++------- src/lib/supertokens/server.ts | 2 +- .../tanstack-query/utils/to-server-result.ts | 3 +++ src/utils/supertokens.ts | 18 +++++++++++++----- 6 files changed, 32 insertions(+), 15 deletions(-) diff --git a/src/app/routes/__root.tsx b/src/app/routes/__root.tsx index 91ae9de..ee41176 100644 --- a/src/app/routes/__root.tsx +++ b/src/app/routes/__root.tsx @@ -4,6 +4,7 @@ import { Outlet, Scripts, createRootRouteWithContext, + isRedirect, } from "@tanstack/react-router"; import * as React from "react"; import { DefaultCatchBoundary } from "@/components/DefaultCatchBoundary"; @@ -124,6 +125,8 @@ export const Route = createRootRouteWithContext<{ ); return { auth }; } catch (error: any) { + if (isRedirect(error) || error instanceof Response) throw error; + if (typeof window !== 'undefined') { const { doesSessionExist, attemptRefreshingSession } = await import('supertokens-web-js/recipe/session'); diff --git a/src/app/routes/refresh-session.tsx b/src/app/routes/refresh-session.tsx index 9d627ed..270990c 100644 --- a/src/app/routes/refresh-session.tsx +++ b/src/app/routes/refresh-session.tsx @@ -29,9 +29,16 @@ function RouteComponent() { const urlParams = new URLSearchParams(window.location.search); const redirect = urlParams.get('redirect'); - if (redirect && !redirect.includes('_serverFn') && !redirect.includes('/api/')) { + const safe = + redirect && + redirect.startsWith('/') && + !redirect.startsWith('/refresh-session') && + !redirect.includes('_serverFn') && + !redirect.includes('/api/'); + + if (safe) { logger.info("Refresh session route: redirecting to", redirect); - window.location.href = decodeURIComponent(redirect); + window.location.href = redirect; } else { logger.info("Refresh session route: redirecting to home"); window.location.href = '/'; diff --git a/src/features/players/server.ts b/src/features/players/server.ts index 56874e1..d89baff 100644 --- a/src/features/players/server.ts +++ b/src/features/players/server.ts @@ -1,5 +1,6 @@ import { setUserMetadata, superTokensFunctionMiddleware, getSessionContext } from "@/utils/supertokens"; import { createServerFn } from "@tanstack/react-start"; +import { isRedirect } from "@tanstack/react-router"; import { Player, playerInputSchema, playerUpdateSchema, PlayerStats } from "@/features/players/types"; import { Match } from "@/features/matches/types"; import { pbAdmin } from "@/lib/pocketbase/client"; @@ -26,13 +27,8 @@ export const fetchMe = createServerFn() phone: context.phone }; } catch (error: any) { - // logger.info("FetchMe: Session error", error) - if (error?.response?.status === 401) { - const errorData = error?.response?.data; - if (errorData?.error === "SESSION_REFRESH_REQUIRED") { - throw error; - } - } + if (isRedirect(error) || error instanceof Response) throw error; + return { user: undefined, roles: [], metadata: {}, phone: undefined }; } }) diff --git a/src/lib/supertokens/server.ts b/src/lib/supertokens/server.ts index f5119ab..beb534d 100644 --- a/src/lib/supertokens/server.ts +++ b/src/lib/supertokens/server.ts @@ -25,7 +25,7 @@ export const backendConfig = (): TypeInput => { cookieSameSite: "lax", cookieSecure: process.env.NODE_ENV === "production", cookieDomain: process.env.COOKIE_DOMAIN || undefined, - olderCookieDomain: undefined, + olderCookieDomain: process.env.OLDER_COOKIE_DOMAIN ?? "", antiCsrf: process.env.NODE_ENV === "production" ? "VIA_TOKEN" : "NONE", // Debug only diff --git a/src/lib/tanstack-query/utils/to-server-result.ts b/src/lib/tanstack-query/utils/to-server-result.ts index d910b37..af6c3dc 100644 --- a/src/lib/tanstack-query/utils/to-server-result.ts +++ b/src/lib/tanstack-query/utils/to-server-result.ts @@ -2,6 +2,7 @@ import { logger } from "../../logger"; import { ErrorType, ServerError, ServerResult } from "../types"; import { pbAdmin } from "../../pocketbase/client"; import { getRequest } from "@tanstack/react-start/server"; +import { isRedirect } from "@tanstack/react-router"; export const createServerError = ( type: ErrorType, @@ -26,6 +27,8 @@ export const toServerResult = async ( const data = await serverFn(); return { success: true, data }; } catch (error) { + if (isRedirect(error) || error instanceof Response) throw error; + const duration = Date.now() - startTime; logger.error('Server Fn Error', error); diff --git a/src/utils/supertokens.ts b/src/utils/supertokens.ts index faeba78..8b95a3b 100644 --- a/src/utils/supertokens.ts +++ b/src/utils/supertokens.ts @@ -14,6 +14,8 @@ import { serverFnLoggingMiddleware } from "./activities"; import { pbAdmin } from "@/lib/pocketbase/client"; const logger = new Logger("Middleware"); +export const PUBLIC_ROUTES = ["/login", "/logout", "/refresh-session"]; + const verifySuperTokensSession = async ( request: Request ) => { @@ -55,12 +57,18 @@ export const getSessionContext = createServerOnlyFn(async (request: Request, opt if (options?.isServerFunction) { throw new Error("SESSION_REFRESH_REQUIRED"); } - + const url = new URL(request.url); - const from = encodeURIComponent(url.pathname + url.search); - throw redirect({ - to: "/refresh-session", - search: { redirect: from } + + if (PUBLIC_ROUTES.some((route) => url.pathname.startsWith(route))) { + throw new Error("Unauthenticated"); + } + + const from = url.pathname + url.search; + + throw redirect({ + to: "/refresh-session", + search: from === "/" ? {} : { redirect: from }, }); }