Skip to content

fix: cookie based auth for storybook #1675

New issue

Have a question about this project? Sign up for a free GitHub account to open an issue and contact its maintainers and the community.

Sign up for GitHub

By clicking “Sign up for GitHub”, you agree to our terms of service and privacy statement. We’ll occasionally send you account related emails.

Already on GitHub? Sign in to your account

Open
ThomasRooney wants to merge 2 commits into
base: main
Choose a base branch
from
Open

fix: cookie based auth for storybook #1675

Show file tree
Hide file tree
Changes from all commits
Commits
Show all changes
2 commits
Select commit Hold shift + click to select a range
2aa8505
fix: cookie based auth for storybook
ThomasRooney Feb 23, 2026
38bf940
chore: lint
ThomasRooney Feb 23, 2026
File filter

Filter by extension

Filter by extension
Conversations
Failed to load comments.
Loading
Jump to
Jump to file
Failed to load files.
Loading
Diff view
Diff view
5 changes: 5 additions & 0 deletions elements/src/server.ts
View file
Open in desktop
Original file line number Diff line number Diff line change
Expand Up @@ -67,9 +67,14 @@ const sessionHandler: ServerHandler<SessionHandlerOptions> = async (
return
}

const cookie = Array.isArray(req.headers.cookie)
? req.headers.cookie[0]
: req.headers.cookie

const result = await createChatSession({
projectSlug,
options,
cookie,
})

res.writeHead(result.status, result.headers)
Expand Down
13 changes: 12 additions & 1 deletion elements/src/server/core.ts
View file
Open in desktop
Original file line number Diff line number Diff line change
Expand Up @@ -29,6 +29,11 @@ export interface SessionHandlerOptions {
export interface CreateSessionRequest {
projectSlug: string
options: SessionHandlerOptions
/**
* Optional cookie header to forward for session-based auth.
* Used when no API key is configured (e.g. local Storybook dev).
*/
cookie?: string
}

export interface CreateSessionResponse {
Expand Down Expand Up @@ -57,7 +62,13 @@ export async function createChatSession(
headers: {
'Content-Type': 'application/json',
'Gram-Project': request.projectSlug,
'Gram-Key': request.options.apiKey ?? process.env.GRAM_API_KEY ?? '',
...(request.options.apiKey || process.env.GRAM_API_KEY
? {
'Gram-Key':
request.options.apiKey ?? process.env.GRAM_API_KEY ?? '',
}
: {}),
Comment on lines +65 to +70
Copy link
Contributor

@devin-ai-integration devin-ai-integration bot Feb 23, 2026

Choose a reason for hiding this comment

The reason will be displayed to describe this comment to others. Learn more.

🟡 Mismatch between || (condition) and ?? (value) causes empty Gram-Key header when apiKey is empty string

When request.options.apiKey is an empty string "" and process.env.GRAM_API_KEY is a valid key, the condition and value expressions disagree on which to use.

Root Cause

The condition on line 65 uses || (which treats "" as falsy):

request.options.apiKey || process.env.GRAM_API_KEY

This correctly evaluates to the env var value (truthy), so the branch is entered.

But the value on line 66 uses ?? (which treats "" as non-nullish):

request.options.apiKey ?? process.env.GRAM_API_KEY ?? ''

This evaluates to "" because ?? only falls through on null/undefined, not empty string.

So the header Gram-Key: "" is sent instead of Gram-Key: "valid-key". This means the API request would fail authentication when it should have succeeded using the environment variable.

Impact: If a user passes apiKey: "" (e.g., explicitly unsetting it) while GRAM_API_KEY env var is set, the request sends an empty Gram-Key header instead of using the env var, causing auth failure.

Suggested change
...(request.options.apiKey || process.env.GRAM_API_KEY
? { 'Gram-Key': request.options.apiKey ?? process.env.GRAM_API_KEY ?? '' }
: {}),
...(request.options.apiKey || process.env.GRAM_API_KEY
? { 'Gram-Key': request.options.apiKey || process.env.GRAM_API_KEY || '' }
: {}),
Open in Devin Review

Was this helpful? React with 👍 or 👎 to provide feedback.

...(request.cookie ? { Cookie: request.cookie } : {}),
},
})

Expand Down