From 2f2aee6e7b47718582f26804ff598c1c8e9e857d Mon Sep 17 00:00:00 2001 From: Anthony Ettinger Date: Tue, 3 Nov 2026 06:17:51 +0000 Subject: [PATCH] fix(auctions): let the theme choice cookie through the pit.world header guard Co-Authored-By: Claude Opus 5.5 --- src/server.ts | 4 +++- test/auctions.test.ts | 13 +++++++++++++ 2 files changed, 16 insertions(+), 1 deletion(-) diff --git a/src/server.ts b/src/server.ts index 8479396..7b932be 100644 --- a/src/server.ts +++ b/src/server.ts @@ -181,7 +181,9 @@ export function createApp(deps: Deps) { for (const [name, value] of Object.entries(SECURITY_HEADERS)) c.header(name, name === 'content-security-policy' && frames.length ? value.replace('frame-src ', `frame-src ${frames.join(' ')} `) : value) // Belt and braces: only the sign-in and account routes set a cookie, and only after you press Sign in. - if (!deps.accounts || !COOKIE_PATHS.test(c.req.path)) c.res.headers.delete('set-cookie') + // The one exception is the auction house's color theme choice (aa_theme), set when a visitor picks it. + const auctionTheme = isAuctionHost(c.req.header('host')) && c.req.path.startsWith('/theme/') + if (!auctionTheme && (!deps.accounts || !COOKIE_PATHS.test(c.req.path))) c.res.headers.delete('set-cookie') }) const auctionApp = deps.auctions ? createAuctionApp(deps.auctions) : null diff --git a/test/auctions.test.ts b/test/auctions.test.ts index 302fa5f..4826f72 100644 --- a/test/auctions.test.ts +++ b/test/auctions.test.ts @@ -1,5 +1,6 @@ import { describe, expect, it } from 'bun:test' import { AuctionHouse, createAuctionApp, isAuctionHost } from '../src/auctions.js' +import { createApp } from '../src/server.js' const png = Uint8Array.from(Buffer.from('iVBORw0KGgoAAAANSUhEUgAAAAEAAAABCAQAAAC1HAwCAAAAC0lEQVR42mP8/x8AAwMCAO+/l0sAAAAASUVORK5CYII=', 'base64')) @@ -100,4 +101,16 @@ describe('Art Auctions House', () => { expect(bogus.headers.get('set-cookie')).toBeNull() house.db.close() }) + + it('lets the theme cookie through the pit.world app, and only on the auction theme route', async () => { + const house = new AuctionHouse() + const app = createApp({ keys: {}, auctions: house }) + const pick = await app.fetch(new Request('https://auctions.pit.world/theme/blue?back=%2F', { headers: { host: 'auctions.pit.world' } })) + expect(pick.status).toBe(303) + expect(pick.headers.get('set-cookie')).toContain('aa_theme=blue') + const page = await app.fetch(new Request('https://auctions.pit.world/', { headers: { host: 'auctions.pit.world', cookie: 'aa_theme=blue' } })) + expect(page.headers.get('set-cookie')).toBeNull() + expect(await page.text()).toContain('data-theme="blue"') + house.db.close() + }) })