30 lines
1.3 KiB
TypeScript
30 lines
1.3 KiB
TypeScript
import { configManager } from '@/lib/admin/config-manager';
|
|
|
|
const DEFAULT_SCOPES = 'openid email profile';
|
|
|
|
/**
|
|
* Resolve the OAuth scopes to request at authorize time.
|
|
*
|
|
* Reads admin override / OAUTH_SCOPES / OAUTH_EXTRA_SCOPES at call time so
|
|
* runtime env vars (and admin dashboard changes) take effect without a rebuild.
|
|
* Server-only: callers in the browser must read `oauthScopes` from /api/config.
|
|
*/
|
|
export function getOauthScopes(): string {
|
|
const explicit = configManager.get<string>('oauthScopes', '');
|
|
if (explicit) return explicit;
|
|
const extra = configManager.get<string>('oauthExtraScopes', '');
|
|
return extra ? `${DEFAULT_SCOPES} ${extra}`.trim() : DEFAULT_SCOPES;
|
|
}
|
|
export const REFRESH_TOKEN_COOKIE = 'jmap_rt';
|
|
export const REFRESH_TOKEN_SERVER_COOKIE = 'jmap_rts';
|
|
|
|
/** Get the cookie name for a given account slot. Slot 0 uses the legacy name. */
|
|
export function refreshTokenCookieName(slot: number): string {
|
|
return slot === 0 ? REFRESH_TOKEN_COOKIE : `${REFRESH_TOKEN_COOKIE}_${slot}`;
|
|
}
|
|
|
|
/** Companion cookie storing which server entry id minted the refresh token at this slot. */
|
|
export function refreshTokenServerCookieName(slot: number): string {
|
|
return slot === 0 ? REFRESH_TOKEN_SERVER_COOKIE : `${REFRESH_TOKEN_SERVER_COOKIE}_${slot}`;
|
|
}
|