heygo/worker/auth.ts

export const AUTH_SESSION_COOKIE_NAME = 'heygo_session' as const;

export const AUTH_ENABLED_PROVIDERS = ['google', 'github'] as const;
export const AUTH_DISABLED_PROVIDERS = ['apple'] as const;

export type EnabledAuthProvider = (typeof AUTH_ENABLED_PROVIDERS)[number];
export type DisabledAuthProvider = (typeof AUTH_DISABLED_PROVIDERS)[number];
export type AuthProvider = EnabledAuthProvider | DisabledAuthProvider;

export interface AuthUser {
  id: string;
  email: string | null;
  name: string | null;
  imageUrl: string | null;
  role: 'user' | 'admin';
}

export interface AuthSession {
  id: string;
  userId: string;
  expiresAt: string;
}

const ENABLED_PROVIDER_SET = new Set<string>(AUTH_ENABLED_PROVIDERS);

export function isAuthProviderEnabled(provider: string): provider is EnabledAuthProvider {
  return ENABLED_PROVIDER_SET.has(provider);
}

export function getSessionCookieAttributes(requestUrl: string | URL): string[] {
  const url = typeof requestUrl === 'string' ? new URL(requestUrl) : requestUrl;
  const attributes = ['HttpOnly', 'Secure', 'SameSite=Lax', 'Path=/'];

  if (isHeygoProductionHost(url.hostname)) {
    attributes.push('Domain=.heygo.cc');
  }

  return attributes;
}

function isHeygoProductionHost(hostname: string): boolean {
  return hostname === 'heygo.cc' || hostname.endsWith('.heygo.cc');
}