pass resolved config to CookieSessionStorage

Author: nicknisi

src/core/session/CookieSessionStorage.spec.ts

@@ -1,17 +1,18 @@
 import { CookieSessionStorage } from './CookieSessionStorage.js';
-
-// Mock config provider
-const createMockConfig = (overrides: Record<string, any> = {}) => ({
-  getValue: (key: string) => {
-    const defaults = {
-      cookieName: 'wos-session',
-      cookieSameSite: 'lax',
-      apiHttps: true,
-      cookieMaxAge: 60 * 60 * 24 * 400,
-      cookieDomain: undefined,
-    };
-    return overrides[key] ?? defaults[key as keyof typeof defaults];
-  },
+import type { AuthKitConfig } from '../config/types.js';
+
+// Mock config
+const createMockConfig = (overrides: Partial<AuthKitConfig> = {}): AuthKitConfig => ({
+  clientId: 'test-client-id',
+  apiKey: 'test-api-key',
+  redirectUri: 'https://example.com/callback',
+  cookiePassword: 'test-password-that-is-32-chars-long!!',
+  cookieName: 'wos-session',
+  cookieSameSite: 'lax',
+  apiHttps: true,
+  cookieMaxAge: 60 * 60 * 24 * 400,
+  cookieDomain: undefined,
+  ...overrides,
 });
 
 // Concrete implementation for testing the abstract class
@@ -24,7 +25,7 @@ class TestCookieSessionStorage extends CookieSessionStorage<string, string> {
 describe('CookieSessionStorage', () => {
   describe('constructor', () => {
     it('sets default cookie configuration', () => {
-      const storage = new TestCookieSessionStorage(createMockConfig() as any);
+      const storage = new TestCookieSessionStorage(createMockConfig());
 
       expect(storage['cookieName']).toBe('wos-session');
       expect(storage['cookieOptions']).toEqual({
@@ -39,87 +40,69 @@ describe('CookieSessionStorage', () => {
 
     it('uses custom cookie name from config', () => {
       const config = createMockConfig({ cookieName: 'custom-session' });
-      const storage = new TestCookieSessionStorage(config as any);
+      const storage = new TestCookieSessionStorage(config);
 
       expect(storage['cookieName']).toBe('custom-session');
     });
 
-    it('falls back to default cookie name when config returns falsy', () => {
-      const config = createMockConfig({ cookieName: '' });
-      const storage = new TestCookieSessionStorage(config as any);
-
-      expect(storage['cookieName']).toBe('wos_session');
-    });
-
     it('uses custom sameSite setting', () => {
       const config = createMockConfig({ cookieSameSite: 'strict' });
-      const storage = new TestCookieSessionStorage(config as any);
+      const storage = new TestCookieSessionStorage(config);
 
       expect(storage['cookieOptions'].sameSite).toBe('strict');
     });
 
-    it('uses custom security settings', () => {
-      const config = createMockConfig({ apiHttps: false });
-      const storage = new TestCookieSessionStorage(config as any);
+    it('infers secure=false from http redirectUri', () => {
+      const config = createMockConfig({ redirectUri: 'http://localhost:3000/callback' });
+      const storage = new TestCookieSessionStorage(config);
 
       expect(storage['cookieOptions'].secure).toBe(false);
     });
 
+    it('infers secure=true from https redirectUri', () => {
+      const config = createMockConfig({ redirectUri: 'https://example.com/callback' });
+      const storage = new TestCookieSessionStorage(config);
+
+      expect(storage['cookieOptions'].secure).toBe(true);
+    });
+
+    it('forces secure=true when sameSite is none', () => {
+      const config = createMockConfig({
+        cookieSameSite: 'none',
+        redirectUri: 'http://localhost:3000/callback',
+      });
+      const storage = new TestCookieSessionStorage(config);
+
+      expect(storage['cookieOptions'].secure).toBe(true);
+    });
+
     it('uses custom max age', () => {
       const customMaxAge = 60 * 60 * 24; // 1 day
       const config = createMockConfig({ cookieMaxAge: customMaxAge });
-      const storage = new TestCookieSessionStorage(config as any);
+      const storage = new TestCookieSessionStorage(config);
 
       expect(storage['cookieOptions'].maxAge).toBe(customMaxAge);
     });
 
-    it('uses default max age when config returns null', () => {
-      const config = createMockConfig({ cookieMaxAge: null });
-      const storage = new TestCookieSessionStorage(config as any);
-
-      expect(storage['cookieOptions'].maxAge).toBe(60 * 60 * 24 * 400);
-    });
-
     it('sets custom cookie domain', () => {
       const config = createMockConfig({ cookieDomain: '.example.com' });
-      const storage = new TestCookieSessionStorage(config as any);
+      const storage = new TestCookieSessionStorage(config);
 
       expect(storage['cookieOptions'].domain).toBe('.example.com');
     });
-
-    it('uses all default fallbacks', () => {
-      const config = createMockConfig({
-        cookieName: '',
-        cookieSameSite: null,
-        apiHttps: null,
-        cookieMaxAge: null,
-        cookieDomain: null,
-      });
-      const storage = new TestCookieSessionStorage(config as any);
-
-      expect(storage['cookieName']).toBe('wos_session');
-      expect(storage['cookieOptions']).toEqual({
-        path: '/',
-        httpOnly: true,
-        sameSite: 'lax',
-        secure: true,
-        maxAge: 60 * 60 * 24 * 400,
-        domain: undefined,
-      });
-    });
   });
 
   describe('abstract methods', () => {
     it('implements SessionStorage interface', () => {
-      const storage = new TestCookieSessionStorage(createMockConfig() as any);
+      const storage = new TestCookieSessionStorage(createMockConfig());
 
       expect(typeof storage.getSession).toBe('function');
       expect(typeof storage.saveSession).toBe('function');
       expect(typeof storage.clearSession).toBe('function');
     });
 
     it('concrete implementation works', async () => {
-      const storage = new TestCookieSessionStorage(createMockConfig() as any);
+      const storage = new TestCookieSessionStorage(createMockConfig());
 
       const session = await storage.getSession();
       expect(session).toBeNull();
@@ -137,14 +120,14 @@ describe('CookieSessionStorage', () => {
   describe('buildSetCookie', () => {
     it('capitalizes SameSite values for Safari compatibility', async () => {
       const testCases = [
-        { input: 'lax', expected: 'SameSite=Lax' },
-        { input: 'strict', expected: 'SameSite=Strict' },
-        { input: 'none', expected: 'SameSite=None' },
+        { input: 'lax' as const, expected: 'SameSite=Lax' },
+        { input: 'strict' as const, expected: 'SameSite=Strict' },
+        { input: 'none' as const, expected: 'SameSite=None' },
       ];
 
       for (const { input, expected } of testCases) {
         const config = createMockConfig({ cookieSameSite: input });
-        const storage = new TestCookieSessionStorage(config as any);
+        const storage = new TestCookieSessionStorage(config);
         const result = await storage.saveSession(undefined, 'test-data');
         expect(result.headers?.['Set-Cookie']).toContain(expected);
       }

src/core/session/CookieSessionStorage.ts

@@ -1,4 +1,4 @@
-import type { ConfigurationProvider } from '../config/ConfigurationProvider.js';
+import type { AuthKitConfig } from '../config/types.js';
 import type { HeadersBag, SessionStorage } from './types.js';
 
 export interface CookieOptions {
@@ -18,35 +18,31 @@ export abstract class CookieSessionStorage<TRequest, TResponse>
 {
   protected cookieName: string;
   protected readonly cookieOptions: CookieOptions;
-  protected config: ConfigurationProvider;
 
-  constructor(config: ConfigurationProvider) {
-    this.config = config;
-    this.cookieName = config.getValue('cookieName') || 'wos_session';
+  constructor(config: AuthKitConfig) {
+    this.cookieName = config.cookieName ?? 'wos_session';
 
-    // Infer secure flag from redirectUri if not explicitly set
-    let secure = config.getValue('apiHttps');
-    if (secure === undefined) {
-      const redirectUri = config.getValue('redirectUri');
-      if (redirectUri) {
-        try {
-          const url = new URL(redirectUri);
-          secure = url.protocol === 'https:';
-        } catch {
-          secure = true; // Default to secure if URL parsing fails
-        }
-      } else {
-        secure = true; // Default to secure if no redirectUri
+    const sameSite = config.cookieSameSite ?? 'lax';
+
+    // Infer secure flag from redirectUri protocol
+    // sameSite='none' requires secure=true (browser requirement)
+    let secure = true;
+    if (sameSite.toLowerCase() !== 'none') {
+      try {
+        const url = new URL(config.redirectUri);
+        secure = url.protocol === 'https:';
+      } catch {
+        // Invalid URL - keep secure=true (safer default)
       }
     }
 
     this.cookieOptions = {
       path: '/',
       httpOnly: true,
-      sameSite: config.getValue('cookieSameSite') ?? 'lax',
+      sameSite,
       secure,
-      maxAge: config.getValue('cookieMaxAge') || 60 * 60 * 24 * 400, // 400 days
-      domain: config.getValue('cookieDomain'),
+      maxAge: config.cookieMaxAge ?? 60 * 60 * 24 * 400, // 400 days
+      domain: config.cookieDomain,
     };
   }