+5 -6

src/webapp/hooks/useAuth.tsx

View file Reviewed

··· 49 49 // Give it time for cookies to be properly set 50 50 if (query.isError && !query.isLoading && pathname !== '/') { 51 51 // Add a small delay for Safari iOS cookie handling 52 52 - const isSafariIOS = 53 53 - /iPad|iPhone|iPod/.test(navigator.userAgent) && 54 54 - /Safari/.test(navigator.userAgent) && 55 55 - !/Chrome/.test(navigator.userAgent); 56 56 - 52 52 + const isSafariIOS = /iPad|iPhone|iPod/.test(navigator.userAgent) && 53 53 + /Safari/.test(navigator.userAgent) && 54 54 + !/Chrome/.test(navigator.userAgent); 55 55 + 57 56 if (isSafariIOS) { 58 57 setTimeout(() => { 59 58 // Re-check auth status before logging out ··· 62 61 logout(); 63 62 } 64 63 }); 65 65 - }, 2000); // Increase to 2 seconds for PWA context 64 64 + }, 1000); 66 65 } else { 67 66 logout(); 68 67 }

-4

src/webapp/lib/auth/dal.ts

View file Reviewed

··· 1 1 import type { GetProfileResponse } from '@/api-client/ApiClient'; 2 2 import { cache } from 'react'; 3 3 - import { isPWA } from './pwa-cookie-handler'; 4 3 5 4 const appUrl = process.env.NEXT_PUBLIC_APP_URL || 'http://127.0.0.1:4000'; 6 5 ··· 21 20 const response = await fetch(`${appUrl}/api/auth/me`, { 22 21 method: 'GET', 23 22 credentials: 'include', // HttpOnly cookies sent automatically 24 24 - headers: { 25 25 - 'X-PWA-Context': isPWA() ? 'true' : 'false', 26 26 - }, 27 23 }); 28 24 29 25 if (!response.ok) {

-33

src/webapp/lib/auth/pwa-cookie-handler.ts

Reviewed

··· 1 1 - export const isPWA = () => { 2 2 - if (typeof window === 'undefined') return false; 3 3 - 4 4 - return ( 5 5 - window.matchMedia('(display-mode: standalone)').matches || 6 6 - (window.navigator as any).standalone === true 7 7 - ); 8 8 - }; 9 9 - 10 10 - export const setCookieForPWA = ( 11 11 - name: string, 12 12 - value: string, 13 13 - days: number = 7, 14 14 - ) => { 15 15 - if (isPWA()) { 16 16 - const expires = new Date(); 17 17 - expires.setTime(expires.getTime() + days * 24 * 60 * 60 * 1000); 18 18 - document.cookie = `${name}=${value};expires=${expires.toUTCString()};path=/;secure;samesite=lax`; 19 19 - } 20 20 - }; 21 21 - 22 22 - export const getCookieForPWA = (name: string): string | null => { 23 23 - if (isPWA()) { 24 24 - const nameEQ = name + '='; 25 25 - const ca = document.cookie.split(';'); 26 26 - for (let i = 0; i < ca.length; i++) { 27 27 - let c = ca[i]; 28 28 - while (c.charAt(0) === ' ') c = c.substring(1, c.length); 29 29 - if (c.indexOf(nameEQ) === 0) return c.substring(nameEQ.length, c.length); 30 30 - } 31 31 - } 32 32 - return null; 33 33 - };

+2 -38

src/webapp/services/auth/CookieAuthService.client.ts

View file Reviewed

··· 1 1 - import { 2 2 - isPWA, 3 3 - getCookieForPWA, 4 4 - setCookieForPWA, 5 5 - } from '@/lib/auth/pwa-cookie-handler'; 6 6 - 7 1 const appUrl = process.env.NEXT_PUBLIC_APP_URL || 'http://127.0.0.1:4000'; 8 2 9 3 export class ClientCookieAuthService { 10 10 - // Note: With HttpOnly cookies, we cannot read tokens from document.cookie in regular browser 11 11 - // But in PWA context, we may need to handle cookies differently 4 4 + // Note: With HttpOnly cookies, we cannot read tokens from document.cookie 5 5 + // The browser automatically sends cookies with requests using credentials: 'include' 12 6 // All auth logic (checking status, refreshing tokens) is handled by /api/auth/me endpoint 13 7 14 14 - // Check if we have any auth indicators (for PWA context) 15 15 - static hasAuthIndicators(): boolean { 16 16 - if (isPWA()) { 17 17 - return !!( 18 18 - getCookieForPWA('accessToken') || getCookieForPWA('refreshToken') 19 19 - ); 20 20 - } 21 21 - // In regular browser, we can't check HttpOnly cookies 22 22 - return true; // Let the server-side check handle it 23 23 - } 24 24 - 25 8 // Clear cookies via API (logout) 26 9 static async clearTokens(): Promise<void> { 27 10 try { 28 11 const response = await fetch(`${appUrl}/api/auth/logout`, { 29 12 method: 'POST', 30 13 credentials: 'include', 31 31 - headers: { 32 32 - 'X-PWA-Context': isPWA() ? 'true' : 'false', 33 33 - }, 34 14 }); 35 15 36 16 if (!response.ok) { ··· 38 18 'Logout API call failed, but continuing with client-side logout', 39 19 ); 40 20 } 41 41 - 42 42 - // In PWA context, also clear any client-side cookies 43 43 - if (isPWA()) { 44 44 - document.cookie = 45 45 - 'accessToken=; expires=Thu, 01 Jan 1970 00:00:00 UTC; path=/; secure; samesite=lax'; 46 46 - document.cookie = 47 47 - 'refreshToken=; expires=Thu, 01 Jan 1970 00:00:00 UTC; path=/; secure; samesite=lax'; 48 48 - } 49 21 } catch (error) { 50 22 console.error('Logout API call failed:', error); 51 23 // Don't throw - we still want to clear the UI state 52 52 - 53 53 - // Still try to clear PWA cookies on error 54 54 - if (isPWA()) { 55 55 - document.cookie = 56 56 - 'accessToken=; expires=Thu, 01 Jan 1970 00:00:00 UTC; path=/; secure; samesite=lax'; 57 57 - document.cookie = 58 58 - 'refreshToken=; expires=Thu, 01 Jan 1970 00:00:00 UTC; path=/; secure; samesite=lax'; 59 59 - } 60 24 } 61 25 } 62 26 }