fix: cross-subdomain SSO auto-login for *arr services

- Set Domain=.sami on session + CSRF cookies so browsers send them to all subdomains
- This fixes Caddy forward_auth returning 401 for radarr/sonarr/prowlarr
- Fix login URL concatenation bug (radarr.samilogin -> radarr.sami/login)
- Fix getSetCookie() missing from _httpsFetch/_httpFetch response objects
- Fix array/string handling for set-cookie header in session-handlers fallback
- Refactor csrf-protection to createCSRFMiddleware() factory with cookieDomain support
- Pass renewCSRFToken through middleware deps chain to TOTP route

dashcaddy-api/csrf-protection.js

@@ -49,54 +49,72 @@ function parseCookie(cookieHeader) {
 }
 
 /**
- * Middleware to set CSRF cookie on requests.
- * Preserves existing nonce to avoid invalidating tokens the client has cached.
- * New nonce is generated only on first visit (no cookie) or after TOTP login
- * (which calls renewCSRFToken). If TOTP is disabled, the nonce is set once
- * and never changes.
+ * Create CSRF middleware with cookie domain support.
+ * When a TLD (e.g. ".sami") is provided, cookies are set with Domain=.sami
+ * so they are shared across all subdomains for forward_auth SSO.
+ * @param {Object} [options]
+ * @param {string} [options.cookieDomain] - e.g. ".sami" to share cookies across subdomains
+ * @returns {{ csrfCookieMiddleware: Function, renewCSRFToken: Function }}
  */
-function csrfCookieMiddleware(req, res, next) {
-  const cookies = parseCookie(req.headers.cookie);
-  const existingNonce = cookies[CSRF_COOKIE_NAME];
+function createCSRFMiddleware(options = {}) {
+  const { cookieDomain } = options;
 
-  // Reuse existing nonce; only generate fresh if no cookie exists yet
-  const csrfNonce = existingNonce || generateToken();
+  /**
+   * Middleware to set CSRF cookie on requests.
+   * Preserves existing nonce to avoid invalidating tokens the client has cached.
+   * New nonce is generated only on first visit (no cookie) or after TOTP login
+   * (which calls renewCSRFToken). If TOTP is disabled, the nonce is set once
+   * and never changes.
+   */
+  function csrfCookieMiddleware(req, res, next) {
+    const cookies = parseCookie(req.headers.cookie);
+    const existingNonce = cookies[CSRF_COOKIE_NAME];
 
-  // Store nonce + signature on request so endpoints can access them
-  req.csrfToken = signToken(csrfNonce);
-  req.csrfNonce = csrfNonce;
+    // Reuse existing nonce; only generate fresh if no cookie exists yet
+    const csrfNonce = existingNonce || generateToken();
 
-  // Only set cookie if it's new (avoids unnecessary Set-Cookie headers)
-  if (!existingNonce) {
-    res.cookie(CSRF_COOKIE_NAME, csrfNonce, {
-      httpOnly: false, // Must be readable by JavaScript for signing
-      secure: req.secure || req.protocol === 'https',
-      sameSite: 'strict',
-      path: '/',
-      maxAge: 365 * 24 * 60 * 60 * 1000 // 1 year (effectively permanent)
-    });
+    // Store nonce + signature on request so endpoints can access them
+    req.csrfToken = signToken(csrfNonce);
+    req.csrfNonce = csrfNonce;
+
+    // Only set cookie if it's new (avoids unnecessary Set-Cookie headers)
+    if (!existingNonce) {
+      const cookieOpts = {
+        httpOnly: false, // Must be readable by JavaScript for signing
+        secure: req.secure || req.protocol === 'https',
+        sameSite: 'strict',
+        path: '/',
+        maxAge: 365 * 24 * 60 * 60 * 1000 // 1 year (effectively permanent)
+      };
+      if (cookieDomain) cookieOpts.domain = cookieDomain;
+      res.cookie(CSRF_COOKIE_NAME, csrfNonce, cookieOpts);
+    }
+
+    next();
   }
 
-  next();
-}
+  /**
+   * Generate a fresh CSRF nonce and set it on the response.
+   * Called after TOTP login to rotate the token for the new session.
+   * @param {Object} res - Express response object
+   * @param {boolean} secure - Whether to set Secure flag on cookie
+   * @returns {string} The new CSRF signed token
+   */
+  function renewCSRFToken(res, secure) {
+    const csrfNonce = generateToken();
+    const cookieOpts = {
+      httpOnly: false,
+      secure: !!secure,
+      sameSite: 'strict',
+      path: '/',
+      maxAge: 365 * 24 * 60 * 60 * 1000
+    };
+    if (cookieDomain) cookieOpts.domain = cookieDomain;
+    res.cookie(CSRF_COOKIE_NAME, csrfNonce, cookieOpts);
+    return signToken(csrfNonce);
+  }
 
-/**
- * Generate a fresh CSRF nonce and set it on the response.
- * Called after TOTP login to rotate the token for the new session.
- * @param {Object} res - Express response object
- * @param {boolean} secure - Whether to set Secure flag on cookie
- * @returns {string} The new CSRF signed token
- */
-function renewCSRFToken(res, secure) {
-  const csrfNonce = generateToken();
-  res.cookie(CSRF_COOKIE_NAME, csrfNonce, {
-    httpOnly: false,
-    secure: !!secure,
-    sameSite: 'strict',
-    path: '/',
-    maxAge: 365 * 24 * 60 * 60 * 1000
-  });
-  return signToken(csrfNonce);
+  return { csrfCookieMiddleware, renewCSRFToken };
 }
 
 /**
@@ -194,6 +212,9 @@ function csrfValidationMiddleware(req, res, next) {
   }
 }
 
+// Default instance (no domain) for backward compatibility with tests
+const defaultInstance = createCSRFMiddleware();
+
 module.exports = {
   CSRF_TOKEN_LENGTH,
   CSRF_COOKIE_NAME,
@@ -201,7 +222,9 @@ module.exports = {
   generateToken,
   signToken,
   parseCookie,
-  csrfCookieMiddleware,
+  createCSRFMiddleware,
   csrfValidationMiddleware,
-  renewCSRFToken
+  // Default instance exports for backward compat
+  csrfCookieMiddleware: defaultInstance.csrfCookieMiddleware,
+  renewCSRFToken: defaultInstance.renewCSRFToken
 };