github-starred/pangolin
2
0
Fork 0
mirror of https://github.com/fosrl/pangolin.git synced 2026-05-07 13:19:07 -05:00
Code Issues 564 Packages Projects Releases 72 Wiki Activity

[PR #2535] [MERGED] fix: correct session DELETE tautology and HTTP cookie domain interpolation #7819

New Issue
Closed
opened 2026-04-25 16:26:31 -05:00 by GiteaMirror · 0 comments
GiteaMirror commented 2026-04-25 16:26:31 -05:00
Owner
Copy Link

📋 Pull Request Information

Original PR: https://github.com/fosrl/pangolin/pull/2535
Author: @Abhinav-kodes
Created: 2/25/2026
Status: ✅ Merged
Merged: 2/25/2026
Merged by: @oschwartz10612

Base: dev ← Head: fix-resource-session-delete-cookie

📝 Commits (1)

  • c64dd14 fix: correct session DELETE tautology and HTTP cookie domain interpolation

📊 Changes

1 file changed (+2 additions, -2 deletions)

View changed files

📝 server/auth/sessions/resource.ts (+2 -2)

📄 Description

Community Contribution License Agreement

By creating this pull request, I grant the project maintainers an unlimited,
perpetual license to use, modify, and redistribute these contributions under any terms they
choose, including both the AGPLv3 and the Fossorial Commercial license terms. I
represent that I have the right to grant this license for all contributed content.

Description

Two bugs in server/auth/sessions/resource.ts with minimal, surgical fixes.
Changes are limited to two single-line corrections — no architecture changes, no new abstractions.

Closes #2534

Fix 1 — Session DELETE tautology

validateResourceSessionToken was deleting all rows in resourceSessions on any expiry because the WHERE clause compared the column to itself:

// Before — tautology, deletes everything
.where(eq(resourceSessions.sessionId, resourceSessions.sessionId)

// After — targets only the expired session
.where(eq(resourceSessions.sessionId, sessionId)

Fix 2 — HTTP cookie Domain broken template literal

serializeResourceSessionCookie had a missing { in the HTTP path:

// Before — sends literal string "$domain}" to browser
`... Domain=$domain}`

// After — correctly interpolates the domain variable
`... Domain=${domain}`

Testing

  • Verified expired session only deletes itself, not others
  • Verified HTTP resource cookie is correctly scoped to domain

🔄 This issue represents a GitHub Pull Request. It cannot be merged through Gitea due to API limitations.

## 📋 Pull Request Information **Original PR:** https://github.com/fosrl/pangolin/pull/2535 **Author:** [@Abhinav-kodes](https://github.com/Abhinav-kodes) **Created:** 2/25/2026 **Status:** ✅ Merged **Merged:** 2/25/2026 **Merged by:** [@oschwartz10612](https://github.com/oschwartz10612) **Base:** `dev` ← **Head:** `fix-resource-session-delete-cookie` --- ### 📝 Commits (1) - [`c64dd14`](https://github.com/fosrl/pangolin/commit/c64dd14b1a1fcc410c1adb6b02e063ce9d97c9b6) fix: correct session DELETE tautology and HTTP cookie domain interpolation ### 📊 Changes **1 file changed** (+2 additions, -2 deletions) <details> <summary>View changed files</summary> 📝 `server/auth/sessions/resource.ts` (+2 -2) </details> ### 📄 Description ## Community Contribution License Agreement By creating this pull request, I grant the project maintainers an unlimited, perpetual license to use, modify, and redistribute these contributions under any terms they choose, including both the AGPLv3 and the Fossorial Commercial license terms. I represent that I have the right to grant this license for all contributed content. ## Description Two bugs in `server/auth/sessions/resource.ts` with minimal, surgical fixes. Changes are limited to two single-line corrections — no architecture changes, no new abstractions. Closes #2534 ## Fix 1 — Session DELETE tautology `validateResourceSessionToken` was deleting all rows in `resourceSessions` on any expiry because the WHERE clause compared the column to itself: ```ts // Before — tautology, deletes everything .where(eq(resourceSessions.sessionId, resourceSessions.sessionId) // After — targets only the expired session .where(eq(resourceSessions.sessionId, sessionId) ``` ## Fix 2 — HTTP cookie Domain broken template literal `serializeResourceSessionCookie` had a missing `{` in the HTTP path: ```ts // Before — sends literal string "$domain}" to browser `... Domain=$domain}` // After — correctly interpolates the domain variable `... Domain=${domain}` ``` ## Testing - [x] Verified expired session only deletes itself, not others - [x] Verified HTTP resource cookie is correctly scoped to domain --- <sub>🔄 This issue represents a GitHub Pull Request. It cannot be merged through Gitea due to API limitations.</sub>
GiteaMirror added the pull-request label 2026-04-25 16:26:31 -05:00
Sign in to join this conversation.
No Branch/Tag Specified
Branches Tags
Labels
Clear labels
api
authentication
bug
config
dependencies
docker
documentation
enhancement
good first issue
help wanted
Improvement
Look Into
needs investigating
networking
new feature
non-critical bug
potential bug
pull-request
Mirrored from GitHub Pull Request
 question
reverse proxy
Security
stale
ui
wontfix
No Label pull-request
Milestone
No items
No Milestone
Projects
Clear projects
No project
Assignees
Clear assignees
GiteaMirror ninjasurge
No Assignees
1 Participants
Notifications
Due Date
No due date set.
Dependencies

No dependencies set.

Reference: github-starred/pangolin#7819
Delete Branch "%!s()"

Deleting a branch is permanent. Although the deleted branch may continue to exist for a short time before it actually gets removed, it CANNOT be undone in most cases. Continue?