feat: update swagger, secure cookie

server/src/api/controllers/authController.js

@@ -118,7 +118,9 @@ export function logout(req, res) {
       })
       return
     }
-    res.redirect('/login')
+    res.status(200).json({
+      message: 'logged out',
+    })
   })
 }
 

server/src/config.js

@@ -8,5 +8,6 @@ export default {
   dockerNetwork: get('DOCKER_NETWORK', 'linux-odyssey-players'),
   isProduction: process.env.NODE_ENV === 'production',
   hostPwd: get('HOST_PWD', ''),
-  expiry: get('EXPIRY', 1000 * 60 * 60),
+  containerExpiry: get('EXPIRY', 1000 * 60 * 60),
+  sessionMaxAge: get('SESSION_MAX_AGE', 1000 * 60 * 60 * 24 * 7),
 }

server/src/middleware/session.js

@@ -7,8 +7,12 @@ export default session({
   secret: config.jwtSecret,
   resave: false,
   saveUninitialized: false,
+  rolling: true,
   cookie: {
     httpOnly: true,
+    secure: config.isProduction,
+    sameSite: 'strict',
+    maxAge: config.sessionMaxAge,
   },
   store: MongoStore.create({
     mongoUrl: config.db,

server/src/utils/auth.js

@@ -24,7 +24,7 @@ export function genJWT(payload) {
     jwt.sign(
       payload,
       config.jwtSecret,
-      { expiresIn: config.expiry },
+      { expiresIn: config.containerExpiry },
       (err, token) => {
         if (err) {
           reject(err)

server/swagger.yaml

@@ -285,7 +285,7 @@ paths:
                     type: string
                     example: Logged out successfully
 
-  /auth/check:
+  /auth/check-username:
     get:
       summary: Check if the username is already taken
       parameters:
@@ -319,6 +319,21 @@ paths:
                     type: string
                     example: Username is already taken
 
+  /auth/check-session:
+    get:
+      summary: Check if the session is valid
+      responses:
+        '200':
+          description: Result
+          content:
+            application/json:
+              schema:
+                type: object
+                properties:
+                  loggedIn:
+                    type: boolean
+                    example: true
+
   /quests:
     get:
       summary: Get quests list