chore: refactor sessions

packages/auth/server/lib/session/session-cookies.ts

@@ -1,13 +1,18 @@
 import type { Context } from 'hono';
 import { deleteCookie, getSignedCookie, setSignedCookie } from 'hono/cookie';
 
-import { getCookieDomain, useSecureCookies } from '@documenso/lib/constants/auth';
+import {
+  formatSecureCookieName,
+  getCookieDomain,
+  useSecureCookies,
+} from '@documenso/lib/constants/auth';
 import { appLog } from '@documenso/lib/utils/debugger';
 import { env } from '@documenso/lib/utils/env';
 
 import { generateSessionToken } from './session';
 
-export const sessionCookieName = 'sessionId';
+export const sessionCookieName = formatSecureCookieName('sessionId');
+export const csrfCookieName = formatSecureCookieName('csrfToken');
 
 const getAuthSecret = () => {
   const authSecret = env('NEXTAUTH_SECRET');
@@ -86,7 +91,7 @@ export const deleteSessionCookie = (c: Context) => {
 };
 
 export const getCsrfCookie = async (c: Context) => {
-  const csrfToken = await getSignedCookie(c, getAuthSecret(), 'csrfToken');
+  const csrfToken = await getSignedCookie(c, getAuthSecret(), csrfCookieName);
 
   return csrfToken || null;
 };
@@ -94,7 +99,7 @@ export const getCsrfCookie = async (c: Context) => {
 export const setCsrfCookie = async (c: Context) => {
   const csrfToken = generateSessionToken();
 
-  await setSignedCookie(c, 'csrfToken', csrfToken, getAuthSecret(), {
+  await setSignedCookie(c, csrfCookieName, csrfToken, getAuthSecret(), {
     ...sessionCookieOptions,
 
     // Explicity set to undefined for session lived cookie.

packages/auth/server/lib/utils/get-session.ts

@@ -7,7 +7,23 @@ import type { SessionValidationResult } from '../session/session';
 import { validateSessionToken } from '../session/session';
 import { getSessionCookie } from '../session/session-cookies';
 
-export const getSession = async (c: Context | Request): Promise<SessionValidationResult> => {
+export const getSession = async (c: Context | Request) => {
+  const { session, user } = await getOptionalSession(mapRequestToContextForCookie(c));
+
+  if (session && user) {
+    return { session, user };
+  }
+
+  if (c instanceof Request) {
+    throw new Error('Unauthorized');
+  }
+
+  throw new AppError(AuthenticationErrorCode.Unauthorized);
+};
+
+export const getOptionalSession = async (
+  c: Context | Request,
+): Promise<SessionValidationResult> => {
   const sessionId = await getSessionCookie(mapRequestToContextForCookie(c));
 
   if (!sessionId) {
@@ -21,20 +37,6 @@ export const getSession = async (c: Context | Request): Promise<SessionValidatio
   return await validateSessionToken(sessionId);
 };
 
-export const getRequiredSession = async (c: Context | Request) => {
-  const { session, user } = await getSession(mapRequestToContextForCookie(c));
-
-  if (session && user) {
-    return { session, user };
-  }
-
-  if (c instanceof Request) {
-    throw new Error('Unauthorized');
-  }
-
-  throw new AppError(AuthenticationErrorCode.Unauthorized);
-};
-
 /**
  * Todo: Rethink, this is pretty sketchy.
  */