From cc71ba3a0dc8d2f62795427c91c2414dddbe812b Mon Sep 17 00:00:00 2001 From: aiirvizionz Date: Sat, 1 Aug 2026 07:58:43 -0600 Subject: [PATCH] fix(auth): preserve padded message cookie values --- src/app/api/chat/messages/[id]/route.js | 3 ++- src/app/api/chat/messages/[id]/route.test.js | 12 ++++++++++++ 2 files changed, 14 insertions(+), 1 deletion(-) diff --git a/src/app/api/chat/messages/[id]/route.js b/src/app/api/chat/messages/[id]/route.js index b7d3a4d..0c6c10c 100644 --- a/src/app/api/chat/messages/[id]/route.js +++ b/src/app/api/chat/messages/[id]/route.js @@ -28,7 +28,8 @@ async function authenticateUser(request) { return null; } - const token = sessionCookie.split('=')[1]; + const separatorIndex = sessionCookie.indexOf('='); + const token = separatorIndex >= 0 ? sessionCookie.slice(separatorIndex + 1) : ''; if (!token) { return null; } diff --git a/src/app/api/chat/messages/[id]/route.test.js b/src/app/api/chat/messages/[id]/route.test.js index 262ac91..5ae0714 100644 --- a/src/app/api/chat/messages/[id]/route.test.js +++ b/src/app/api/chat/messages/[id]/route.test.js @@ -102,6 +102,18 @@ describe('GET /api/chat/messages/[id]', () => { expect(mocks.messageEq).toHaveBeenCalledWith('id', 'message-1'); }); + it('preserves padded auth cookie values when verifying the session', async () => { + const { GET } = await import('./route.js'); + await GET( + new Request('https://qrypt.chat/api/chat/messages/message-1', { + headers: { cookie: 'sb-access-token=valid-token==' } + }), + { params: Promise.resolve({ id: 'message-1' }) } + ); + + expect(mocks.authGetUser).toHaveBeenCalledWith('valid-token=='); + }); + it('rejects missing async route params before authentication', async () => { const { GET } = await import('./route.js'); const response = await GET(new Request('https://qrypt.chat/api/chat/messages/'), {