Merge branch 'devel' of https://github.com/VulcanJS/Vulcan into devel

VulcanJS · Oct 7, 2020 · 78d0e99 · 78d0e99
2 parents 695d499 + b0ca4a2
commit 78d0e99
Show file tree

Hide file tree

Showing 3 changed files with 22 additions and 28 deletions.
diff --git a/package-lock.json b/package-lock.json
diff --git a/packages/vulcan-accounts/imports/helpers.js b/packages/vulcan-accounts/imports/helpers.js
@@ -6,12 +6,12 @@ try {
 }
 export const loginButtonsSession = Accounts._loginButtonsSession;
 export const STATES = {
-  SIGN_IN: Symbol('SIGN_IN'),
-  SIGN_UP: Symbol('SIGN_UP'),
-  PROFILE: Symbol('PROFILE'),
-  PASSWORD_CHANGE: Symbol('PASSWORD_CHANGE'),
-  PASSWORD_RESET: Symbol('PASSWORD_RESET'),
-  ENROLL_ACCOUNT: Symbol('ENROLL_ACCOUNT')
+  SIGN_IN: Symbol.for('SIGN_IN'),
+  SIGN_UP: Symbol.for('SIGN_UP'),
+  PROFILE: Symbol.for('PROFILE'),
+  PASSWORD_CHANGE: Symbol.for('PASSWORD_CHANGE'),
+  PASSWORD_RESET: Symbol.for('PASSWORD_RESET'),
+  ENROLL_ACCOUNT: Symbol.for('ENROLL_ACCOUNT')
 };
 
 export function getLoginServices() {

diff --git a/packages/vulcan-users/lib/server/mutations.js b/packages/vulcan-users/lib/server/mutations.js
@@ -87,13 +87,25 @@ const specificResolvers = {
       if (!email) {
         throw new Error('Invalid email');
       }
-      return await authenticateWithPassword(email, password);
+      const authResult = await authenticateWithPassword(email, password);
+      // set an HTTP-only cookie so the user is authenticated
+      const { /*userId,*/ token } = authResult;
+      const tokenCookie = {
+        path: '/',
+        httpOnly: true,
+        secure: process.env.NODE_ENV === 'development' ? false : true,
+        // expires: //
+        //sameSite: ''
+      };
+      context.req.res.cookie('meteor_login_token', token, tokenCookie);
+      return authResult;
     },
     async logout(root, args, context) {
       if (!(context && context.userId)) {
         throw new Error('User already logged out');
       }
       const { userId } = context;
+      context.req.res.clearCookie('meteor_login_token');
       return await logout(userId);
     },
     async signup(root, args, context) {