fix: refactor cookie settings for Home Assistant i-frame login (#7741)

frontend/app/composables/use-auth-backend.ts

@@ -1,6 +1,7 @@
 import { ref, computed } from "vue";
 import type { UserOut } from "~/lib/api/types/user";
 import { clearAllStores } from "~/composables/store";
+import { getTokenCookieOptions } from "~/composables/use-token-cookie";
 
 interface AuthData {
   value: UserOut | null;
@@ -30,10 +31,7 @@ export const useAuthBackend = function (): AuthState {
 
   const runtimeConfig = useRuntimeConfig();
   const tokenName = runtimeConfig.public.AUTH_TOKEN;
-  const tokenCookie = useCookie(tokenName, {
-    maxAge: $appInfo.tokenTime * 60 * 60,
-    secure: $appInfo.production && window?.location?.protocol === "https:",
-  });
+  const tokenCookie = useCookie(tokenName, getTokenCookieOptions());
 
   function setToken(token: string | null) {
     tokenCookie.value = token;

frontend/app/composables/use-token-cookie.ts

@@ -0,0 +1,9 @@
+export function getTokenCookieOptions(): Parameters<typeof useCookie>[1] {
+  const isSecureConnection = useNuxtApp().$appInfo.production && window?.location?.protocol === "https:";
+  return {
+    maxAge: useNuxtApp().$appInfo.tokenTime * 60 * 60,
+    secure: isSecureConnection,
+    sameSite: isSecureConnection ? "none" : "lax",
+    partitioned: isSecureConnection,
+  };
+}

frontend/app/plugins/axios.ts

@@ -1,5 +1,6 @@
 import axios from "axios";
 import { alert } from "~/composables/use-toast";
+import { getTokenCookieOptions } from "~/composables/use-token-cookie";
 
 declare module "axios" {
   interface AxiosRequestConfig {
@@ -42,7 +43,7 @@ export default defineNuxtPlugin(() => {
       // If we receive a 401 Unauthorized response, clear the token cookie and redirect to login
       if (error?.response?.status === 401) {
         // If tokenCookie is not set, we may just be an unauthenticated user using the wrong API, so don't redirect
-        const tokenCookie = useCookie(tokenName);
+        const tokenCookie = useCookie(tokenName, getTokenCookieOptions());
         if (tokenCookie.value) {
           tokenCookie.value = null;