fix: preserve custom cookies when setting headers in ExpressServer

AdminForth/1900/image

Author: yaroslav8765

adminforth/servers/express.ts

@@ -763,7 +763,12 @@ class ExpressServer implements IExpressHttpServer {
       }
 
       response.headers.forEach(([name, value]) => {
-        res.setHeader(name, value);
+        // setHeader replaces previous value, so cookies set by hooks would be lost behind auth cookie
+        if (name.toLowerCase() === 'set-cookie') {
+          res.append(name, value);
+        } else {
+          res.setHeader(name, value);
+        }
       });
       res.status(response.status);
       if (response.message) {

tests/jest_tests/logout_hook.test.ts

@@ -75,6 +75,20 @@ describe('auth.beforeLogout', () => {
     expect(res.headers['set-cookie'][0]).toContain('Expires=Thu, 01 Jan 1970 00:00:00 GMT');
   });
 
+  it('can remove custom cookies together with auth cookie', async () => {
+    hooks.push(async ({ adminforth, extra }) => {
+      adminforth.auth.removeCustomCookie({ response: extra.response, name: 'plugin_state' });
+    });
+
+    const res = await logout(await loginCookie());
+
+    const brandSlug = admin.config.customization.brandNameSlug;
+    expect(res.headers['set-cookie']).toEqual([
+      expect.stringContaining(`adminforth_${brandSlug}_plugin_state=;`),
+      expect.stringContaining(`adminforth_${brandSlug}_jwt=;`),
+    ]);
+  });
+
   it('clears auth cookie and runs remaining hooks when a hook throws', async () => {
     const called: string[] = [];
     hooks.push(