Merge branch 'feature/admin-user' of https://github.com/the1daBread/project-nomad into dev

admin/app/utils/cookie_security.ts

@@ -0,0 +1,10 @@
+/**
+ * Decide whether cookies should be marked Secure from the public URL users visit.
+ */
+export function shouldUseSecureCookies(publicUrl: string): boolean {
+  try {
+    return new URL(publicUrl).protocol === 'https:'
+  } catch {
+    return false
+  }
+}

admin/config/app.ts

@@ -1,7 +1,7 @@
 import env from '#start/env'
-import app from '@adonisjs/core/services/app'
 import { Secret } from '@adonisjs/core/helpers'
 import { defineConfig } from '@adonisjs/core/http'
+import { shouldUseSecureCookies } from '../app/utils/cookie_security.js'
 
 /**
  * The app key is used for encrypting cookies, generating signed URLs,
@@ -11,6 +11,7 @@ import { defineConfig } from '@adonisjs/core/http'
  * changed. Therefore it is recommended to keep the app key secure.
  */
 export const appKey = new Secret(env.get('APP_KEY'))
+const secureCookies = shouldUseSecureCookies(env.get('URL'))
 
 /**
  * The configuration settings used by the HTTP server
@@ -34,7 +35,7 @@ export const http = defineConfig({
     path: '/',
     maxAge: '2h',
     httpOnly: true,
-    secure: app.inProduction,
+    secure: secureCookies,
     sameSite: 'lax',
   },
 })

admin/config/session.ts

@@ -1,7 +1,9 @@
 import env from '#start/env'
-import app from '@adonisjs/core/services/app'
+import { shouldUseSecureCookies } from '../app/utils/cookie_security.js'
 import { defineConfig, stores } from '@adonisjs/session'
 
+const secureCookies = shouldUseSecureCookies(env.get('URL'))
+
 const sessionConfig = defineConfig({
   enabled: true,
   cookieName: 'nomad-admin-session',
@@ -22,7 +24,7 @@ const sessionConfig = defineConfig({
   cookie: {
     path: '/',
     httpOnly: true,
-    secure: app.inProduction,
+    secure: secureCookies,
     sameSite: 'lax',
   },
 

admin/tests/unit/cookie_security.spec.ts

@@ -0,0 +1,20 @@
+import * as assert from 'node:assert/strict'
+import { test } from 'node:test'
+
+import { shouldUseSecureCookies } from '../../app/utils/cookie_security.js'
+
+test('enables secure cookies for HTTPS public URLs', () => {
+  assert.equal(shouldUseSecureCookies('https://nomad.example.com'), true)
+  assert.equal(shouldUseSecureCookies('https://nomad.example.com:8443/admin'), true)
+})
+
+test('disables secure cookies for HTTP public URLs', () => {
+  assert.equal(shouldUseSecureCookies('http://home'), false)
+  assert.equal(shouldUseSecureCookies('http://localhost:8080'), false)
+  assert.equal(shouldUseSecureCookies('http://192.168.1.10:8080'), false)
+})
+
+test('disables secure cookies when the public URL is invalid', () => {
+  assert.equal(shouldUseSecureCookies('replaceme'), false)
+  assert.equal(shouldUseSecureCookies(''), false)
+})