Fix credentialed Space requests and isolate Google PKCE verifiers

README.md

@@ -104,3 +104,11 @@ When a payment provider is added, the server-side webhook flow should:
 3. Call `assignPaidSubscription` from `src/subscriptions.ts` with the paid period dates.
 
 That helper upserts the user's single current plan in `users_subscriptions`. The existing access check then opens Labs, session details, and analysis automatically. The browser return page must not assign access by itself. Store provider payment references/idempotency records when the provider integration is implemented.
+
+## Browser requests through the Space edge
+
+The frontend sends JSON as `text/plain` and carries PUT/PATCH/DELETE through POST with an `_method` query parameter because the Space edge can omit credential headers on preflight responses. Express checks the frontend Origin before restoring the method, parses the JSON with the same body-size limit, and retains route authentication. Internal AI requests remain standard JSON. Do not remove the Origin check or use this transport for internal routes.
+
+Google PKCE verifiers are stored in a short-lived HttpOnly, SameSite=Lax cookie tied to the initiating browser. Allow the backend callback and its `?next=**` variant in Supabase's redirect list. Cross-site session cookies still require the browser to allow cookies for the Space.
+
+Cross-origin video uploads do not attach upload-progress listeners, since those also trigger preflight. Uploads still go directly to the Space and can be cancelled; processing progress remains available after acceptance.

src/server.ts

@@ -9,7 +9,7 @@ import { z } from "zod";
 import { env } from "./config.js";
 import { analysisRouter } from "./analysis.js";
 import { authenticatedUser, clearSessionCookies, safeRedirect, setSessionCookies } from "./auth.js";
-import { hashPassword, supabaseAdmin, supabaseAuth, syncProfile, userHasPassword, userPayload } from "./supabase.js";
+import { hashPassword, oauthClient, supabaseAdmin, supabaseAuth, syncProfile, userHasPassword, userPayload } from "./supabase.js";
 
 const app = express();
 app.disable("x-powered-by");
@@ -21,7 +21,7 @@ app.use(cors({
   methods: ["GET", "POST", "PUT", "PATCH", "DELETE", "OPTIONS"],
 }));
 app.use("/internal/analysis", analysisRouter(supabaseAdmin, env.ANALYSIS_PROXY_SECRET));
-app.use(express.json({ limit: "32kb" }));
+app.use(express.json({ limit: "32kb", type: ["application/json", "text/plain"] }));
 app.use(cookieParser());
 app.use((req, res, next) => {
   if (["GET", "HEAD", "OPTIONS"].includes(req.method)) return next();
@@ -29,6 +29,21 @@ app.use((req, res, next) => {
   return next();
 });
 
+// Browser POST transport avoids HF edge preflight handling. Origin checks above
+// still apply before restoring the method, and every route retains its auth gate.
+app.use((req, res, next) => {
+  if (req.query._method === undefined) return next();
+  if (req.method !== "POST" || !req.path.startsWith("/api/") ||
+      typeof req.query._method !== "string" || !["PUT", "PATCH", "DELETE"].includes(req.query._method)) {
+    return res.status(400).json({ error: "Invalid request method." });
+  }
+  req.method = req.query._method;
+  const target = new URL(req.originalUrl, "http://localhost");
+  target.searchParams.delete("_method");
+  req.url = req.originalUrl = target.pathname + target.search;
+  return next();
+});
+
 const authLimiter = rateLimit({ windowMs: 15 * 60 * 1000, limit: 25, standardHeaders: "draft-8", legacyHeaders: false });
 const signupSchema = z.object({ fname: z.string().trim().min(1).max(100), lname: z.string().trim().min(1).max(100), email: z.string().trim().toLowerCase().email().max(255), password: z.string().min(8).max(128), academy: z.string().trim().max(150).optional() });
 const loginSchema = z.object({ email: z.string().trim().toLowerCase().email(), password: z.string().min(1).max(128) });
@@ -303,7 +318,7 @@ app.post("/api/auth/login", authLimiter, async (req, res, next) => {
 app.get("/api/auth/google", authLimiter, async (req, res, next) => {
   try {
     const redirect = typeof req.query.redirect === "string" ? req.query.redirect : "/labs";
-    const { data, error } = await supabaseAuth.auth.signInWithOAuth({ provider: "google", options: { redirectTo: `${env.BACKEND_URL}/api/auth/callback?next=${encodeURIComponent(redirect)}` } });
+    const { data, error } = await oauthClient(req, res).auth.signInWithOAuth({ provider: "google", options: { redirectTo: `${env.BACKEND_URL}/api/auth/callback?next=${encodeURIComponent(redirect)}` } });
     if (error || !data.url) return res.status(502).json({ error: "Google sign-in is currently unavailable." });
     return res.redirect(data.url);
   } catch (error) { next(error); }
@@ -315,7 +330,7 @@ app.get("/api/auth/callback", async (req, res, next) => {
     // Explicitly terminate any fragment from an unexpected implicit-flow
     // response so access tokens cannot be inherited by this redirect URL.
     if (!code) return res.redirect(`${env.FRONTEND_URL}/login?error=oauth_callback_failed#`);
-    const { data, error } = await supabaseAuth.auth.exchangeCodeForSession(code);
+    const { data, error } = await oauthClient(req, res).auth.exchangeCodeForSession(code);
     if (error || !data.user || !data.session) return res.redirect(`${env.FRONTEND_URL}/login?error=oauth_callback_failed`);
     await syncProfile(data.user);
     setSessionCookies(res, data.session);
@@ -447,7 +462,9 @@ async function proxyAnalysisRequest(req: Request, res: Response) {
   }
 
   const hasBody = req.method !== "GET" && req.method !== "HEAD";
-  const body = !hasBody ? undefined : req.is("application/json")
+  const isJson = Boolean(req.is(["application/json", "text/plain"]));
+  if (isJson) headers.set("content-type", "application/json");
+  const body = !hasBody ? undefined : isJson
     ? JSON.stringify(req.body ?? {})
     : req as unknown as BodyInit;
   const init: RequestInit & { duplex?: "half" } = {

src/supabase.ts

@@ -1,7 +1,29 @@
 import { createClient, type User } from "@supabase/supabase-js";
 import bcrypt from "bcryptjs";
 import { randomBytes } from "node:crypto";
-import { env } from "./config.js";
+import type { Request, Response } from "express";
+import { env, isProduction } from "./config.js";
+
+// Bind Google's PKCE verifier to the initiating browser, not a shared client's
+// in-memory store (which concurrent logins can overwrite or a restart can lose).
+export function oauthClient(req: Request, res: Response) {
+  const cookieName = "sp_oauth_verifier";
+  const options = { httpOnly: true, secure: isProduction, sameSite: "lax" as const, path: "/api/auth" };
+  return createClient(env.SUPABASE_URL, env.SUPABASE_ANON_KEY, {
+    auth: {
+      autoRefreshToken: false, persistSession: true, detectSessionInUrl: false, flowType: "pkce",
+      storage: {
+        getItem: (key) => key.endsWith("-code-verifier") ? req.cookies?.[cookieName] ?? null : null,
+        setItem: (key, value) => {
+          if (key.endsWith("-code-verifier")) res.cookie(cookieName, value, { ...options, maxAge: 10 * 60 * 1000 });
+        },
+        removeItem: (key) => {
+          if (key.endsWith("-code-verifier")) res.clearCookie(cookieName, options);
+        },
+      },
+    },
+  });
+}
 
 export const supabaseAuth = createClient(env.SUPABASE_URL, env.SUPABASE_ANON_KEY, {
   // OAuth returns a one-time code for the backend callback to exchange, rather