fix(auctions): let the theme choice cookie through

src/server.ts

@@ -181,7 +181,9 @@ export function createApp(deps: Deps) {
     for (const [name, value] of Object.entries(SECURITY_HEADERS))
       c.header(name, name === 'content-security-policy' && frames.length ? value.replace('frame-src ', `frame-src ${frames.join(' ')} `) : value)
     // Belt and braces: only the sign-in and account routes set a cookie, and only after you press Sign in.
-    if (!deps.accounts || !COOKIE_PATHS.test(c.req.path)) c.res.headers.delete('set-cookie')
+    // The one exception is the auction house's color theme choice (aa_theme), set when a visitor picks it.
+    const auctionTheme = isAuctionHost(c.req.header('host')) && c.req.path.startsWith('/theme/')
+    if (!auctionTheme && (!deps.accounts || !COOKIE_PATHS.test(c.req.path))) c.res.headers.delete('set-cookie')
   })
 
   const auctionApp = deps.auctions ? createAuctionApp(deps.auctions) : null

test/auctions.test.ts

@@ -1,5 +1,6 @@
 import { describe, expect, it } from 'bun:test'
 import { AuctionHouse, createAuctionApp, isAuctionHost } from '../src/auctions.js'
+import { createApp } from '../src/server.js'
 
 const png = Uint8Array.from(Buffer.from('iVBORw0KGgoAAAANSUhEUgAAAAEAAAABCAQAAAC1HAwCAAAAC0lEQVR42mP8/x8AAwMCAO+/l0sAAAAASUVORK5CYII=', 'base64'))
 
@@ -100,4 +101,16 @@ describe('Art Auctions House', () => {
     expect(bogus.headers.get('set-cookie')).toBeNull()
     house.db.close()
   })
+
+  it('lets the theme cookie through the pit.world app, and only on the auction theme route', async () => {
+    const house = new AuctionHouse()
+    const app = createApp({ keys: {}, auctions: house })
+    const pick = await app.fetch(new Request('https://auctions.pit.world/theme/blue?back=%2F', { headers: { host: 'auctions.pit.world' } }))
+    expect(pick.status).toBe(303)
+    expect(pick.headers.get('set-cookie')).toContain('aa_theme=blue')
+    const page = await app.fetch(new Request('https://auctions.pit.world/', { headers: { host: 'auctions.pit.world', cookie: 'aa_theme=blue' } }))
+    expect(page.headers.get('set-cookie')).toBeNull()
+    expect(await page.text()).toContain('data-theme="blue"')
+    house.db.close()
+  })
 })