38 lines
959 B
TypeScript
38 lines
959 B
TypeScript
import { NextResponse } from "next/server";
|
|
|
|
export async function POST(req: Request) {
|
|
const { token, role } = await req.json();
|
|
|
|
if (!token) {
|
|
return NextResponse.json({ ok: false }, { status: 400 });
|
|
}
|
|
|
|
const res = NextResponse.json({ ok: true });
|
|
|
|
// Server-readable, JS-unreadable
|
|
res.cookies.set("bb_access_token", token, {
|
|
httpOnly: true,
|
|
secure: process.env.NODE_ENV === "production",
|
|
sameSite: "lax",
|
|
path: "/",
|
|
});
|
|
|
|
// Optional: for quick middleware role checks (not “secure” by itself)
|
|
if (role) {
|
|
res.cookies.set("bb_role", role, {
|
|
httpOnly: false,
|
|
secure: process.env.NODE_ENV === "production",
|
|
sameSite: "lax",
|
|
path: "/",
|
|
});
|
|
}
|
|
|
|
return res;
|
|
}
|
|
|
|
export async function DELETE() {
|
|
const res = NextResponse.json({ ok: true });
|
|
res.cookies.set("bb_access_token", "", { path: "/", maxAge: 0 });
|
|
res.cookies.set("bb_role", "", { path: "/", maxAge: 0 });
|
|
return res;
|
|
} |