feat(oauth): make Campsite API session cookie name configurable

Allow per-environment overrides of the Campsite session cookie used by
the web UI and mono OAuth store, defaulting to _campsite_api_session.

Author: benjamin-747

common/src/config/mod.rs

@@ -660,6 +660,14 @@ pub struct OauthConfig {
     #[serde(default)]
     pub api_store_backend: OauthApiStoreBackend,
     pub allowed_cors_origins: Vec<String>,
+    #[serde(default = "default_campsite_api_session_cookie")]
+    pub campsite_api_session_cookie: String,
+}
+
+pub const DEFAULT_CAMPSITE_API_SESSION_COOKIE: &str = "_campsite_api_session";
+
+fn default_campsite_api_session_cookie() -> String {
+    DEFAULT_CAMPSITE_API_SESSION_COOKIE.to_string()
 }
 
 #[derive(Serialize, Deserialize, Debug, Clone, Copy, PartialEq, Eq)]
@@ -685,6 +693,7 @@ impl Default for OauthConfig {
             .into_iter()
             .map(|s| s.to_string())
             .collect(),
+            campsite_api_session_cookie: default_campsite_api_session_cookie(),
         }
     }
 }

docker/demo/.env.example

@@ -99,6 +99,7 @@ MEGA_BUILD__ENABLE_BUILD=true
 MEGA_BUILD__ORION_SERVER=http://orion_server:8004
 
 MEGA_OAUTH__CAMPSITE_API_DOMAIN=http://api.gitmono.local:18080
+MEGA_OAUTH__CAMPSITE_API_SESSION_COOKIE=_campsite_api_session
 MEGA_OAUTH__UI_DOMAIN=http://app.gitmono.local
 MEGA_OAUTH__COOKIE_DOMAIN=gitmono.local
 MEGA_OAUTH__ALLOWED_CORS_ORIGINS="http://app.gitmono.local"

docker/demo/docker-compose.demo.yml

@@ -150,6 +150,7 @@ services:
 
       # Campsite integration (OAuth / SSO etc.)
       MEGA_OAUTH__CAMPSITE_API_DOMAIN: ${MEGA_OAUTH__CAMPSITE_API_DOMAIN:-http://campsite_api:8080}
+      MEGA_OAUTH__CAMPSITE_API_SESSION_COOKIE: ${MEGA_OAUTH__CAMPSITE_API_SESSION_COOKIE:-_campsite_api_session}
       MEGA_OAUTH__UI_DOMAIN: ${MEGA_OAUTH__UI_DOMAIN:-http://app.gitmono.local}
       MEGA_OAUTH__COOKIE_DOMAIN: ${MEGA_OAUTH__COOKIE_DOMAIN:-localhost}
       # Note: allowed_cors_origins expects an array format in TOML

docker/deployment/.env.example

@@ -92,6 +92,7 @@ MEGA_BUILD__ENABLE_BUILD=true
 MEGA_BUILD__ORION_SERVER=http://orion_server:8004
 
 MEGA_OAUTH__CAMPSITE_API_DOMAIN=http://api.gitmono.local:18080
+MEGA_OAUTH__CAMPSITE_API_SESSION_COOKIE=_campsite_api_session
 MEGA_OAUTH__UI_DOMAIN=http://app.gitmono.local
 MEGA_OAUTH__COOKIE_DOMAIN=gitmono.local
 MEGA_OAUTH__ALLOWED_CORS_ORIGINS="http://app.gitmono.local"

mono/src/api/oauth/api_store.rs

@@ -16,7 +16,7 @@ pub enum OAuthApiStore {
 }
 
 impl OAuthApiStore {
-    pub fn session_cookie_name(&self) -> &'static str {
+    pub fn session_cookie_name(&self) -> &str {
         match self {
             OAuthApiStore::Campsite(store) => store.session_cookie_name(),
             OAuthApiStore::Tinyship(store) => store.session_cookie_name(),

mono/src/api/oauth/campsite_store.rs

@@ -12,13 +12,11 @@ use tower_sessions::{
 
 use crate::api::oauth::model::{CampsiteUserJson, LoginUser};
 
-static CAMPSITE_API_COOKIE: &str = "_campsite_api_session";
-
 #[derive(Debug, Clone)]
 pub struct CampsiteApiStore {
     client: Arc<Client>,
-    // cookie_store: Arc<Jar>,
     api_base_url: String,
+    session_cookie: String,
 }
 
 #[async_trait]
@@ -41,18 +39,19 @@ impl SessionStore for CampsiteApiStore {
 }
 
 impl CampsiteApiStore {
-    pub fn session_cookie_name(&self) -> &'static str {
-        CAMPSITE_API_COOKIE
+    pub fn session_cookie_name(&self) -> &str {
+        &self.session_cookie
     }
 
-    pub fn new(api_base_url: String) -> Self {
+    pub fn new(api_base_url: String, session_cookie: String) -> Self {
         let client = Client::builder()
             .no_proxy()
             .build()
             .expect("Failed to build client");
         Self {
             client: Arc::new(client),
             api_base_url,
+            session_cookie,
         }
     }
 
@@ -68,7 +67,10 @@ impl CampsiteApiStore {
         let resp = self
             .client
             .get(url)
-            .header(COOKIE, format!("{}={}", CAMPSITE_API_COOKIE, cookie_value))
+            .header(
+                COOKIE,
+                format!("{}={}", self.session_cookie_name(), cookie_value),
+            )
             .send()
             .await
             .context("failed to send request to campsite API")?;

mono/src/server/http_server.rs

@@ -396,9 +396,12 @@ pub async fn app(ctx: AppContext, host: String, port: u16) -> Router {
         git_object_cache,
         build_dispatch,
         Some(match oauth_config.api_store_backend {
-            common::config::OauthApiStoreBackend::Campsite => {
-                OAuthApiStore::Campsite(CampsiteApiStore::new(oauth_config.campsite_api_domain))
-            }
+            common::config::OauthApiStoreBackend::Campsite => OAuthApiStore::Campsite(
+                CampsiteApiStore::new(
+                    oauth_config.campsite_api_domain.clone(),
+                    oauth_config.campsite_api_session_cookie.clone(),
+                ),
+            ),
             common::config::OauthApiStoreBackend::Tinyship => {
                 OAuthApiStore::Tinyship(TinyshipApiStore::new(oauth_config.tinyship_api_domain))
             }

mono/tests/campsite_api_store_tests.rs

@@ -41,8 +41,9 @@ use common::*;
 use qlean::{Distro, GuestArch, Image, ImageConfig, MachineConfig, with_machine};
 use serde_json::Value;
 
+use common::config::DEFAULT_CAMPSITE_API_SESSION_COOKIE;
+
 const TEST_COOKIE: &str = "test_session_cookie";
-const CAMPSITE_API_COOKIE_NAME: &str = "_campsite_api_session";
 
 // ============================================================================
 // Test phases - directly calling Campsite API
@@ -54,7 +55,7 @@ async fn call_campsite_api(
     cookie: Option<&str>,
 ) -> Result<(u16, Value)> {
     let cookie_arg = cookie
-        .map(|c| format!("Cookie: {}={}", CAMPSITE_API_COOKIE_NAME, c))
+        .map(|c| format!("Cookie: {}={}", DEFAULT_CAMPSITE_API_SESSION_COOKIE, c))
         .unwrap_or_default();
 
     let cmd = if cookie.is_some() {

mono/tests/login_user_extractor_tests.rs

@@ -36,6 +36,7 @@ use std::time::Duration;
 
 use anyhow::{Context, Result};
 use common::*;
+use common::config::DEFAULT_CAMPSITE_API_SESSION_COOKIE;
 use qlean::{Distro, GuestArch, Image, ImageConfig, MachineConfig, with_machine};
 use serde_json::Value;
 
@@ -47,11 +48,11 @@ const CAMPSITE_API_PORT: u16 = 8080;
 
 /// Call Campsite API /v1/users/me endpoint
 async fn call_users_me(vm: &mut qlean::Machine, cookie: &str) -> Result<(u16, Option<Value>)> {
-    // Format cookie with prefix: _campsite_api_session=<value>
+    // Format cookie with prefix: {session_cookie}=<value>
     let cookie_header = if cookie.is_empty() {
         "".to_string()
     } else {
-        format!("_campsite_api_session={}", cookie)
+        format!("{}={}", DEFAULT_CAMPSITE_API_SESSION_COOKIE, cookie)
     };
 
     let cmd = if cookie.is_empty() {

moon/apps/web/.env.runtime

@@ -12,7 +12,8 @@
 # Provide the real values at runtime (ECS task definition / Cloud Run env):
 #   NEXT_PUBLIC_API_URL, NEXT_PUBLIC_INTERNAL_API_URL, NEXT_PUBLIC_MONO_API_URL,
 #   NEXT_PUBLIC_ORION_API_URL, NEXT_PUBLIC_AUTH_URL, NEXT_PUBLIC_WEB_URL,
-#   NEXT_PUBLIC_SYNC_URL, NEXT_PUBLIC_CRATES_PRO_URL
+#   NEXT_PUBLIC_SYNC_URL, NEXT_PUBLIC_CRATES_PRO_URL,
+#   NEXT_PUBLIC_CAMPSITE_API_SESSION_COOKIE
 # =============================================================================
 
 NEXT_PUBLIC_API_URL=https://rt-api.placeholder.local
@@ -23,3 +24,4 @@ NEXT_PUBLIC_AUTH_URL=https://rt-auth.placeholder.local
 NEXT_PUBLIC_WEB_URL=https://rt-web.placeholder.local
 NEXT_PUBLIC_SYNC_URL=wss://rt-sync.placeholder.local
 NEXT_PUBLIC_CRATES_PRO_URL=https://rt-crates-pro.placeholder.local
+NEXT_PUBLIC_CAMPSITE_API_SESSION_COOKIE=__rt_campsite_api_session_cookie__