heygo/worker/routes/api.auth.ts

import { AUTH_SESSION_COOKIE_NAME, getCurrentUser, getSessionCookieAttributes } from '../auth';
import type { Env } from '../env';

export async function handleAuthApi(request: Request, env: Env): Promise<Response | null> {
  const url = new URL(request.url);

  if (url.pathname === '/api/auth/logout') {
    if (request.method !== 'POST') {
      return Response.json({ error: 'Method not allowed' }, { status: 405 });
    }

    const cookieAttrs = getSessionCookieAttributes(request.url, env.COOKIE_DOMAIN);
    const expired = new Date(0).toUTCString();
    const cookieValue = `${AUTH_SESSION_COOKIE_NAME}=; Expires=${expired}; ${cookieAttrs.join('; ')}`;
    return Response.json(
      { ok: true },
      {
        headers: {
          'Set-Cookie': cookieValue,
          'Cache-Control': 'no-store',
        },
      },
    );
  }

  if (url.pathname !== '/api/auth/me') {
    return null;
  }

  if (request.method !== 'GET') {
    return Response.json({ error: 'Method not allowed' }, { status: 405 });
  }

  const user = await getCurrentUser(request, env);
  const publicBaseUrl = env.APP_BASE_URL;
  const privateBaseUrl = buildPrivateBaseUrl(url, env);
  if (!user) {
    return Response.json({ user: null, publicBaseUrl, privateBaseUrl }, { status: 200 });
  }

  return Response.json({
    user: {
      id: user.id,
      email: user.email,
      name: user.name,
      imageUrl: user.imageUrl,
      role: user.role,
    },
    publicBaseUrl,
    privateBaseUrl,
  });
}

function buildPrivateBaseUrl(requestUrl: URL, env: Env): string {
  if (env.PRIVATE_HOST === '*' || env.PRIVATE_HOST === '' || env.PRIVATE_HOST === requestUrl.host) {
    return requestUrl.origin;
  }

  const publicBaseUrl = new URL(env.APP_BASE_URL);
  if (env.PRIVATE_HOST === publicBaseUrl.host || env.PRIVATE_HOST === publicBaseUrl.hostname) {
    return publicBaseUrl.origin;
  }

  return `${publicBaseUrl.protocol}//${env.PRIVATE_HOST}`;
}