MythEclipse/zeavis-edu
1
0
Fork 0
Code Issues Pull Requests Packages Projects Releases Wiki Activity

fix(auth): replace deprecated set.redirect with manual 302 Location header

Browse Source 
Elysia's set.redirect returns 200 OK instead of 302 redirect on the
current version. Use set.status = 302 + set.headers['Location'] instead
for both /auth/google (Google OAuth redirect) and /auth/google/callback
(all redirect paths: errors, success token delivery).

Co-Authored-By: Claude <noreply@anthropic.com>
This commit is contained in:
MythEclipse
2026-06-15 22:06:59 +07:00
co-authored by Claude
parent 4b1d70d1c4
commit d47c73308e
1 changed files with 12 additions and 6 deletions
Download Patch File Download Diff File Expand all files Collapse all files
apps/api/src/routes/auth.ts
+12 -6
View File
@@ -186,7 +186,8 @@ export const authRoutes = new Elysia({ prefix: '/api/v1/auth' })
prompt: 'select_account',
});
set.redirect = `https://accounts.google.com/o/oauth2/v2/auth?${params.toString()}`;
set.status = 302;
set.headers['Location'] = `https://accounts.google.com/o/oauth2/v2/auth?${params.toString()}`;
})
.get('/google/callback', async ({ query, set, request }) => {
if (!env.googleOAuthEnabled) {
@@ -199,7 +200,8 @@ export const authRoutes = new Elysia({ prefix: '/api/v1/auth' })
// User denied or Google returned an error
if (error || !code) {
set.redirect = `${env.webAppUrl}/login?error=${encodeURIComponent(error ?? 'missing_code')}`;
set.status = 302;
set.headers['Location'] = `${env.webAppUrl}/login?error=${encodeURIComponent(error ?? 'missing_code')}`;
return;
}
@@ -210,13 +212,15 @@ export const authRoutes = new Elysia({ prefix: '/api/v1/auth' })
idPayload = decodeGoogleIdToken(tokens.id_token);
} catch (err) {
const msg = err instanceof Error ? err.message : 'Google auth failed';
set.redirect = `${env.webAppUrl}/login?error=${encodeURIComponent(msg)}`;
set.status = 302;
set.headers['Location'] = `${env.webAppUrl}/login?error=${encodeURIComponent(msg)}`;
return;
}
// Validate email
if (!idPayload.email_verified || !idPayload.email) {
set.redirect = `${env.webAppUrl}/login?error=${encodeURIComponent('Email not verified by Google')}`;
set.status = 302;
set.headers['Location'] = `${env.webAppUrl}/login?error=${encodeURIComponent('Email not verified by Google')}`;
return;
}
@@ -256,8 +260,10 @@ export const authRoutes = new Elysia({ prefix: '/api/v1/auth' })
authCounter.labels('login', 'true').inc();
// Redirect to web app with token in URL for localStorage fallback
set.redirect = `${env.webAppUrl}/login?token=${encodeURIComponent(token)}`;
set.status = 302;
set.headers['Location'] = `${env.webAppUrl}/login?token=${encodeURIComponent(token)}`;
} catch (err) {
set.redirect = `${env.webAppUrl}/login?error=${encodeURIComponent('Database unavailable')}`;
set.status = 302;
set.headers['Location'] = `${env.webAppUrl}/login?error=${encodeURIComponent('Database unavailable')}`;
}
});