tylerg/auth-yes
1
0
Fork 0
Code Issues Pull Requests Actions Packages Projects Releases Wiki Activity

feat(api): support Authorization: Bearer <session_id> in addition to Cookie headers for agent queries

Browse Source
This commit is contained in:
Tyler Gillispie 2026-08-24 23:29:39 -07:00
parent 85772659b7
commit 80cab8454e
1 changed files with 20 additions and 4 deletions
Show Stats Download Patch File Download Diff File Expand all files Collapse all files

24
server/auth-session.ts
View File

@ -49,11 +49,27 @@ export function getCookieDomain(customRpId?: string): string | undefined {
* Necessary because Chromium Android can send both a host-only and a wildcard cookie simultaneously.
*/
export function extractAllSessionIds(c: Context): string[] {
const candidates: string[] = [];
// 1. Check Authorization: Bearer <token>
const authHeader = c.req.header("authorization") || "";
if (authHeader.startsWith("Bearer ")) {
const bearerToken = authHeader.substring(7).trim();
if (bearerToken) candidates.push(bearerToken);
}
// 2. Check Cookie header
const cookieHeader = c.req.header("cookie") || "";
if (!cookieHeader) return [];
return [...cookieHeader.matchAll(/(?:^|;\s*)session_id=([^;]+)/g)]
.map((m) => decodeURIComponent(m[1].trim()))
.filter(Boolean);
if (cookieHeader) {
const cookieMatches = [
...cookieHeader.matchAll(/(?:^|;\s*)session_id=([^;]+)/g),
]
.map((m) => decodeURIComponent(m[1].trim()))
.filter(Boolean);
candidates.push(...cookieMatches);
}
return candidates;
}
export async function getAuthenticatedUser(