flo-bit.dev
[READ-ONLY] Mirror of https://github.com/flo-bit/svelte-cloudflare-statusphere.
statusphere.atmo.tools
atproto
cloudflare-workers
oauth
svelte
add scope cookie
author
Florian
date
(Mar 1, 2026, 11:22 PM +0100)
commit
483f2d0c
483f2d0cae576fe196db078501fb8b33c9deeda4
parent
7c74a0a8
7c74a0a8ef8cc27859f96e8a5871ba7769b540e8
+18
-3
+1
src/lib/atproto/server/oauth.remote.ts
+1
src/lib/atproto/server/oauth.remote.ts
+10
src/lib/atproto/server/session.ts
+10
src/lib/atproto/server/session.ts
···
4
4
import type { OAuthSession } from '@atcute/oauth-node-client';
5
5
import { createOAuthClient } from './oauth';
6
6
import { getSignedCookie } from './signed-cookie';
7
+
import { scope } from '../metadata';
7
8
8
9
export type SessionLocals = {
9
10
session: OAuthSession | null;
···
26
27
return { session: null, client: null, did: null };
27
28
}
28
29
30
+
// If permissions changed since login, invalidate the session
31
+
const savedScope = getSignedCookie(cookies, 'scope');
32
+
if (savedScope !== null && savedScope !== scope) {
33
+
cookies.delete('did', { path: '/' });
34
+
cookies.delete('scope', { path: '/' });
35
+
return { session: null, client: null, did: null };
36
+
}
37
+
29
38
try {
30
39
const oauth = createOAuthClient(env);
31
40
const session = await oauth.restore(did);
···
38
47
} catch (e) {
39
48
console.error('Failed to restore session:', e);
40
49
cookies.delete('did', { path: '/' });
50
+
cookies.delete('scope', { path: '/' });
41
51
return { session: null, client: null, did: null };
42
52
}
43
53
}
+7
-3
src/routes/(oauth)/oauth/callback/+server.ts
+7
-3
src/routes/(oauth)/oauth/callback/+server.ts
···
1
1
import { redirect } from '@sveltejs/kit';
2
2
import { createOAuthClient } from '$lib/atproto/server/oauth';
3
3
import { setSignedCookie } from '$lib/atproto/server/signed-cookie';
4
+
import { scope } from '$lib/atproto/metadata';
4
5
import { dev } from '$app/environment';
5
6
import type { RequestHandler } from './$types';
6
7
···
12
13
try {
13
14
const { session } = await oauth.callback(url.searchParams);
14
15
15
-
setSignedCookie(cookies, 'did', session.did, {
16
+
const cookieOpts = {
16
17
path: '/',
17
18
httpOnly: true,
18
19
secure: !dev,
19
-
sameSite: 'lax',
20
+
sameSite: 'lax' as const,
20
21
maxAge: 60 * 60 * 24 * 180 // 180 days
21
-
});
22
+
};
23
+
24
+
setSignedCookie(cookies, 'did', session.did, cookieOpts);
25
+
setSignedCookie(cookies, 'scope', scope, cookieOpts);
22
26
} catch (e) {
23
27
console.error('OAuth callback failed:', e);
24
28
redirect(303, '/?error=auth_failed');