1
import { generateSignedCookie } from "hono/cookie";
2
 
3
import {
4
  AUTH_COOKIE_PREFIX,
5
  OIDC_TX_COOKIE_NAME,
6
  SESSION_COOKIE_HEADER_NAME,
7
} from "@/worker/auth/cookies";
8
import {
9
  deriveTransactionCookieSecret,
10
  encodeTransactionPayload,
11
  type TransactionPayload,
12
} from "@/worker/auth/oidc";
13
 
14
export function sessionCookieHeader(token: string): string {
15
  return `${SESSION_COOKIE_HEADER_NAME}=${token}`;
16
}
17
 
18
export function extractSessionToken(setCookieHeader: string | null): string | null {
19
  if (!setCookieHeader) return null;
20
  const pattern = new RegExp(`${SESSION_COOKIE_HEADER_NAME}=(goc_sess_[^;]+)`);
21
  return pattern.exec(setCookieHeader)?.[1] ?? null;
22
}
23
 
24
export async function oidcTransactionCookieHeader(
25
  clientSecret: string,
26
  payload: TransactionPayload
27
): Promise<string> {
28
  const signingSecret = await deriveTransactionCookieSecret(clientSecret);
29
  const setCookie = await generateSignedCookie(
30
    OIDC_TX_COOKIE_NAME,
31
    encodeTransactionPayload(payload),
32
    signingSecret,
33
    { prefix: AUTH_COOKIE_PREFIX }
34
  );
35
  return setCookie.split(";")[0] ?? "";
36
}