Merge branch 'matt/add-cert-to-env' into matt/fix-batch-get

Author: mjaydenkim

frontend/package.json

@@ -3,7 +3,6 @@
   "version": "1.0.0",
   "description": "",
   "main": "index.js",
-  "proxy": "${REACT_APP_SERVER_URL}",
   "dependencies": {
     "@emotion/react": "^11.13.5",
     "@emotion/styled": "^11.13.5",

frontend/src/components/AuthManager/AuthManager.tsx

@@ -77,13 +77,8 @@ const AuthManager = () => {
 
   // Common logic to complete login from a JWT issued by the backend
   const completeLoginFromToken = (serverJWT: string) => {
-    // Store JWT in encrypted cookie (matching Google OAuth pattern)
     setCookie('jwt', serverJWT);
-
-    // Decode JWT to get user info
     const decoded: any = jwtDecode(serverJWT);
-
-    // Set auth state
     setId(decoded.id);
     localStorage.setItem('userId', decoded.id);
     localStorage.setItem('userType', decoded.userType);
@@ -122,8 +117,6 @@ const AuthManager = () => {
         }
       );
 
-      console.log('SSO callback response:', response);
-
       if (!response.ok) {
         throw new Error('Failed to fetch SSO profile');
       }
@@ -193,8 +186,6 @@ const AuthManager = () => {
     }
 
     if (authParam === 'sso_success') {
-      // Prefer stateless flow if backend supplied a JWT in the URL. This avoids
-      // relying on third-party cookies between Netlify (frontend) and Vercel (backend).
       if (tokenParam) {
         completeLoginFromToken(tokenParam);
       } else {

server/src/auth/passport-sso.ts

@@ -10,7 +10,7 @@ interface SamlProfile extends Profile {
   email?: string;
 }
 
-// Load IdP certificate, necessary to authenticate with Cornell's SSO/SAML system
+// Load IdP certificate, necessary to authenticate with Cornell's SSO/SAML system. Get from Cornell IT or ask a previous developer.
 const idpCertPath =
   process.env.SAML_IDP_CERT_PATH || './config/cornell-idp-test.crt';
 let idpCert = '';

server/src/auth/session.ts

@@ -24,11 +24,8 @@ export const sessionMiddleware = session({
   name: 'carriage.sid', // Custom session cookie name
   cookie: {
     httpOnly: true,
-    secure: true, // HTTPS only in production
-    // In production the frontend (Netlify) and backend (Vercel) are on different sites,
-    // so we must allow the session cookie to be sent on cross-site XHR/fetch requests.
-    // SameSite=Lax works for localhost (same-site) but *blocks* these requests in prod.
-    sameSite: 'none',
+    secure: process.env.NODE_ENV === 'production', // HTTPS only in production
+    sameSite: process.env.NODE_ENV === 'production' ? 'none' : 'lax',
     maxAge: sessionTTL,
   },
 });

server/src/router/sso.ts

@@ -119,26 +119,18 @@ router.post(
         lastName: samlUser.lastName,
       };
       req.session.authMethod = 'sso';
-      // CRITICAL: Store the validated userType in session for /profile endpoint
+      // Store the validated userType in session for /profile endpoint
       req.session.userType = userType;
-      console.log('[SSO Callback] Stored userType in session:', userType);
 
-      // Generate JWT with same payload format as Google OAuth
       const token = sign({ id: user.id, userType }, JWT_SECRET, {
         expiresIn: '7d',
       });
-      console.log('[SSO Callback] Generated JWT for user ID:', user.id);
 
-      // Build redirect URL with auth + token parameters.
-      // Avoid relying on Node's URL parsing; instead handle query separator manually
-      // so this works whether or not redirectUri already has query params.
       const separator = redirectUri.includes('?') ? '&' : '?';
       const redirectWithToken = `${redirectUri}${separator}auth=sso_success&token=${encodeURIComponent(
         token
       )}`;
 
-      // Redirect back to frontend with JWT so it can complete login without relying on
-      // server-side session cookies (which are third-party between Netlify and Vercel).
       res.redirect(redirectWithToken);
     } catch (err) {
       console.error('SSO callback error:', err);