temp fix

.gitea/workflows/ci-cd.yaml

@@ -79,6 +79,9 @@ jobs:
       - name: Checkout code
         uses: actions/checkout@v4
 
+      - name: pin rancher host
+        run: echo "192.168.4.43 rancher.yohler.net" >> /etc/hosts
+
       - name: Set environment variables
         run: |
           if [ "${{ github.ref }}" == "refs/heads/main" ]; then

k8s/overlays/dev/configmap.yaml

@@ -6,8 +6,8 @@ metadata:
 data:
   vite_api_domain: "https://dev.flexxon.app"
   vite_website_domain: "https://dev.flexxon.app"
-  supertokens_uri: "http://192.168.0.50:30568"
-  pocketbase_url: "http://192.168.0.50:30096"
+  supertokens_uri: "http://192.168.4.43:30568"
+  pocketbase_url: "http://192.168.4.43:30096"
   vite_spotify_client_id: "3ffde6b594e84460b3d4b329b8919277"
   vite_spotify_redirect_uri: "https://dev.flexxon.app/api/spotify/callback"
   s3_endpoint: "https://s3.yohler.net"

k8s/overlays/prod/configmap.yaml

@@ -6,8 +6,8 @@ metadata:
 data:
   vite_api_domain: "https://flexxon.app"
   vite_website_domain: "https://flexxon.app"
-  supertokens_uri: "http://192.168.0.50:30568"
-  pocketbase_url: "http://192.168.0.50:30097"
+  supertokens_uri: "http://192.168.4.43:30568"
+  pocketbase_url: "http://192.168.4.43:30097"
   vite_spotify_client_id: "3ffde6b594e84460b3d4b329b8919277"
   vite_spotify_redirect_uri: "https://flexxon.app/api/spotify/callback"
   s3_endpoint: "https://s3.yohler.net"

src/app/routes/__root.tsx

@@ -4,6 +4,7 @@ import {
   Outlet,
   Scripts,
   createRootRouteWithContext,
+  isRedirect,
 } from "@tanstack/react-router";
 import * as React from "react";
 import { DefaultCatchBoundary } from "@/components/DefaultCatchBoundary";
@@ -124,6 +125,8 @@ export const Route = createRootRouteWithContext<{
       );
       return { auth };
     } catch (error: any) {
+      if (isRedirect(error) || error instanceof Response) throw error;
+
       if (typeof window !== 'undefined') {
         const { doesSessionExist, attemptRefreshingSession } = await import('supertokens-web-js/recipe/session');
 

src/app/routes/refresh-session.tsx

@@ -29,9 +29,16 @@ function RouteComponent() {
           const urlParams = new URLSearchParams(window.location.search);
           const redirect = urlParams.get('redirect');
 
-          if (redirect && !redirect.includes('_serverFn') && !redirect.includes('/api/')) {
+          const safe =
+            redirect &&
+            redirect.startsWith('/') &&
+            !redirect.startsWith('/refresh-session') &&
+            !redirect.includes('_serverFn') &&
+            !redirect.includes('/api/');
+
+          if (safe) {
             logger.info("Refresh session route: redirecting to", redirect);
-            window.location.href = decodeURIComponent(redirect);
+            window.location.href = redirect;
           } else {
             logger.info("Refresh session route: redirecting to home");
             window.location.href = '/';

src/features/players/server.ts

@@ -1,5 +1,6 @@
 import { setUserMetadata, superTokensFunctionMiddleware, getSessionContext } from "@/utils/supertokens";
 import { createServerFn } from "@tanstack/react-start";
+import { isRedirect } from "@tanstack/react-router";
 import { Player, playerInputSchema, playerUpdateSchema, PlayerStats } from "@/features/players/types";
 import { Match } from "@/features/matches/types";
 import { pbAdmin } from "@/lib/pocketbase/client";
@@ -26,13 +27,8 @@ export const fetchMe = createServerFn()
           phone: context.phone
         };
       } catch (error: any) {
-        // logger.info("FetchMe: Session error", error)
-        if (error?.response?.status === 401) {
-          const errorData = error?.response?.data;
-          if (errorData?.error === "SESSION_REFRESH_REQUIRED") {
-            throw error;
-          }
-        }
+        if (isRedirect(error) || error instanceof Response) throw error;
+
         return { user: undefined, roles: [], metadata: {}, phone: undefined };
       }
     })

src/lib/supertokens/server.ts

@@ -25,7 +25,7 @@ export const backendConfig = (): TypeInput => {
         cookieSameSite: "lax",
         cookieSecure: process.env.NODE_ENV === "production",
         cookieDomain: process.env.COOKIE_DOMAIN || undefined,
-        olderCookieDomain: undefined,
+        olderCookieDomain: process.env.OLDER_COOKIE_DOMAIN ?? "",
         antiCsrf: process.env.NODE_ENV === "production" ? "VIA_TOKEN" : "NONE",
 
         // Debug only

src/lib/tanstack-query/utils/to-server-result.ts

@@ -2,6 +2,7 @@ import { logger } from "../../logger";
 import { ErrorType, ServerError, ServerResult } from "../types";
 import { pbAdmin } from "../../pocketbase/client";
 import { getRequest } from "@tanstack/react-start/server";
+import { isRedirect } from "@tanstack/react-router";
 
 export const createServerError = (
   type: ErrorType,
@@ -26,6 +27,8 @@ export const toServerResult = async <T>(
     const data = await serverFn();
     return { success: true, data };
   } catch (error) {
+    if (isRedirect(error) || error instanceof Response) throw error;
+
     const duration = Date.now() - startTime;
     logger.error('Server Fn Error', error);
 

src/utils/supertokens.ts

@@ -14,6 +14,8 @@ import { serverFnLoggingMiddleware } from "./activities";
 import { pbAdmin } from "@/lib/pocketbase/client";
 const logger = new Logger("Middleware");
 
+export const PUBLIC_ROUTES = ["/login", "/logout", "/refresh-session"];
+
 const verifySuperTokensSession = async (
   request: Request
 ) => {
@@ -57,10 +59,16 @@ export const getSessionContext = createServerOnlyFn(async (request: Request, opt
     }
 
     const url = new URL(request.url);
-    const from = encodeURIComponent(url.pathname + url.search);
+
+    if (PUBLIC_ROUTES.some((route) => url.pathname.startsWith(route))) {
+      throw new Error("Unauthenticated");
+    }
+
+    const from = url.pathname + url.search;
+
     throw redirect({
       to: "/refresh-session",
-      search: { redirect: from }
+      search: from === "/" ? {} : { redirect: from },
     });
   }