From 015fc9ef92e256ddd0760e466deb9b74bbab4c0c Mon Sep 17 00:00:00 2001
From: Max <shadow.iqka@qq.com>
Date: Wed, 4 Feb 2026 20:55:53 +0800
Subject: [PATCH] Add secure_cookie field to EntryConfig API response

- Add SecureCookie field to EntryConfig struct for frontend access
- Add GetCookieName helper to response package for dynamic cookie names
- Update guard.go to use GetCookieName instead of hardcoded __Host- prefix
- Pass secure_cookie setting to /user/entry API response

Co-authored-by: Cursor <cursoragent@cursor.com>
---
 openapi/oauth/guard.go       | 9 ++++++---
 openapi/response/response.go | 9 +++++++++
 openapi/user/entry.go        | 3 +++
 openapi/user/types.go        | 1 +
 4 files changed, 19 insertions(+), 3 deletions(-)

diff --git a/openapi/oauth/guard.go b/openapi/oauth/guard.go
index c9695790..c29449a8 100644
--- a/openapi/oauth/guard.go
+++ b/openapi/oauth/guard.go
@@ -109,7 +109,8 @@ func (s *Service) tryAutoRefreshToken(c *gin.Context, _ *types.TokenClaims) {
 func (s *Service) getAccessToken(c *gin.Context) string {
 	token := c.GetHeader("Authorization")
 	if token == "" {
-		cookie, err := c.Cookie("__Host-access_token")
+		cookieName := response.GetCookieName("access_token")
+		cookie, err := c.Cookie(cookieName)
 		if err != nil {
 			return ""
 		}
@@ -176,7 +177,8 @@ func (s *Service) GetAccessToken(c *gin.Context) string {
 func (s *Service) getRefreshToken(c *gin.Context) string {
 	token := c.GetHeader("Authorization")
 	if token == "" {
-		cookie, err := c.Cookie("__Host-refresh_token")
+		cookieName := response.GetCookieName("refresh_token")
+		cookie, err := c.Cookie(cookieName)
 		if err != nil {
 			return ""
 		}
@@ -200,7 +202,8 @@ func (s *Service) getSessionID(c *gin.Context) string {
 	}
 
 	// 1. Try to get Session ID from cookies first
-	if sid, err := c.Cookie("__Host-session_id"); err == nil && sid != "" {
+	cookieName := response.GetCookieName("session_id")
+	if sid, err := c.Cookie(cookieName); err == nil && sid != "" {
 		return sid
 	}
 
diff --git a/openapi/response/response.go b/openapi/response/response.go
index 7969c2f4..3286716d 100644
--- a/openapi/response/response.go
+++ b/openapi/response/response.go
@@ -25,6 +25,15 @@ func IsSecureCookieEnabled() bool {
 	return secureCookieEnabled == nil || *secureCookieEnabled
 }
 
+// GetCookieName returns the correct cookie name based on secure cookie setting
+// If secure cookie is enabled, it returns "__Host-" + name, otherwise just name
+func GetCookieName(name string) string {
+	if IsSecureCookieEnabled() {
+		return "__Host-" + name
+	}
+	return name
+}
+
 // Type aliases for OAuth types to simplify usage
 type (
 	// Core response types
diff --git a/openapi/user/entry.go b/openapi/user/entry.go
index 2e49886c..4c289c6f 100644
--- a/openapi/user/entry.go
+++ b/openapi/user/entry.go
@@ -45,6 +45,9 @@ func getEntryConfig(c *gin.Context) {
 	// Create public config without sensitive data (deep copy to avoid modifying global config)
 	publicConfig := createPublicEntryConfig(config)
 
+	// Add secure_cookie setting from OAuth config
+	publicConfig.SecureCookie = response.IsSecureCookieEnabled()
+
 	// Return the entry configuration
 	response.RespondWithSuccess(c, response.StatusOK, publicConfig)
 }
diff --git a/openapi/user/types.go b/openapi/user/types.go
index ae88e03f..30c6d57c 100644
--- a/openapi/user/types.go
+++ b/openapi/user/types.go
@@ -112,6 +112,7 @@ type EntryConfig struct {
 	InviteRequired bool              `json:"invite_required,omitempty"` // From register config
 	Invite         *InvitePageConfig `json:"invite,omitempty"`          // Invite code page configuration
 	ThirdParty     *ThirdParty       `json:"third_party,omitempty"`
+	SecureCookie   bool              `json:"secure_cookie"` // Whether secure cookie is enabled (for frontend JWT verification)
 }
 
 // MessengerConfig represents the messenger configuration for user registration