bert.hausmans
513ca519b2
Backend: - CookieBearerToken middleware reads httpOnly cookie and injects Authorization header before Sanctum validates (prepended to API middleware group) - SetAuthCookie trait provides cookie creation/expiry helpers with per-app cookie names (crewli_admin_token, crewli_app_token, crewli_portal_token) - LoginController sets token via Set-Cookie, removes it from JSON body - LogoutController expires the auth cookie on logout - AuthRefreshController (POST /auth/refresh) rotates tokens with new cookie - InvitationController accept also sets token via cookie, not JSON body - All cookies: httpOnly, SameSite=Strict, Secure (in production) Frontend (all three SPAs): - Removed all localStorage token storage (apps/app, apps/portal) - Removed all JS-readable cookie token storage (apps/admin) - Removed Authorization: Bearer header interceptors from axios - Auth stores now rely on GET /auth/me to validate httpOnly cookie - Admin app: new Pinia auth store replaces useCookie-based auth pattern - withCredentials: true ensures browser sends cookies automatically Fixes security findings A13-1 (localStorage tokens) and A13-2 (admin cookie flags). Tokens are now invisible to JavaScript. Co-Authored-By: Claude Opus 4.6 (1M context) <noreply@anthropic.com>
29 lines
672 B
TypeScript
29 lines
672 B
TypeScript
import { useAuthStore } from '@/stores/useAuthStore'
|
|
import { computed } from 'vue'
|
|
|
|
export interface AuthOrganisationSummary {
|
|
id: string
|
|
name: string
|
|
slug: string
|
|
role: string
|
|
}
|
|
|
|
export interface AuthUserCookie {
|
|
id: string
|
|
name: string
|
|
email: string
|
|
roles?: string[]
|
|
organisations?: AuthOrganisationSummary[]
|
|
}
|
|
|
|
/**
|
|
* First organisation from the auth store (set at login). Super-admins still need an organisation context for nested event routes.
|
|
*/
|
|
export function useCurrentOrganisationId() {
|
|
const authStore = useAuthStore()
|
|
|
|
const organisationId = computed(() => authStore.user?.organisations?.[0]?.id ?? null)
|
|
|
|
return { organisationId }
|
|
}
|