mirror of
https://github.com/dadosfera/maestro.git
synced 2026-11-07 05:39:07 +00:00
Claude
9c8c761529
Apps behind an nginx auth_request (Orchest / Intelligence / Process) rely on the ddf-* cookies and on GET /auth/me. Several problems made them lose the session or show 500 pages: - Cookies were written with a hard-coded Domain=.dadosfera.ai in every environment, so a staging login overwrote the production session (and vice versa) in the same browser. Names now take AUTH_COOKIE_SUFFIX and the domain comes from COOKIE_DOMAIN (staging: -stg / .stg.dadosfera.ai). - maxAge was the token's absolute epoch (~56 years). It is now a real duration, SESSION_COOKIE_MAX_AGE_DAYS (default 30). - /auth/me answered 500 when a refresh failed for anything but NotAuthorizedException, when the refreshed token failed validation, or when DUC hung (no deadline). It now answers 401 and expires the dead cookies for definitive failures, 503 for DUC transport errors/timeouts (AUTH_RPC_TIMEOUT_MS, default 10s), keeps 403 answers instead of masking them with a refresh, refreshes when only the refresh cookie is left, and stops logging request headers (they contain the cookies). - /auth/refresh-access-token rewrites all three cookies from the session the frontend just proved valid, healing stale cookies from another login or environment. /auth/sign-out expires all three and always responds. Helm values wire the new variables for prd and stg. Co-Authored-By: Claude Fable 5.1 <noreply@anthropic.com> Claude-Session: https://claude.ai/code/session_01AUEXmydTBX9G2CGJ97YQKL