WIP

apps/web/lib/metadata.ts

@@ -28,7 +28,6 @@ export const prepareRootMetadata = (recipe: RootMetadataRecipe): Metadata => ({
       {
         rel: "icon-mask",
         url: "/safari-pinned-tab.svg",
-        // @ts-expect-error TODO available in the never Next.js version
         color: "#000000",
       },
       {

apps/web/pages/[user].tsx

@@ -2,7 +2,6 @@ import type { DehydratedState } from "@tanstack/react-query";
 import classNames from "classnames";
 import type { GetServerSideProps, InferGetServerSidePropsType } from "next";
 import Link from "next/link";
-import { setCsrfToken } from "pages/api/auth/csrf";
 import { Toaster } from "react-hot-toast";
 import type { z } from "zod";
 
@@ -12,6 +11,7 @@ import {
   useEmbedStyles,
   useIsEmbed,
 } from "@calcom/embed-core/embed-iframe";
+import { setCsrfToken } from "@calcom/features/auth/lib/set-csrf-token";
 import OrganizationMemberAvatar from "@calcom/features/ee/organizations/components/OrganizationMemberAvatar";
 import { getSlugOrRequestedSlug } from "@calcom/features/ee/organizations/lib/orgDomains";
 import { orgDomainConfig } from "@calcom/features/ee/organizations/lib/orgDomains";

apps/web/pages/[user]/[type].tsx

@@ -1,9 +1,9 @@
 import type { GetServerSidePropsContext } from "next";
-import { setCsrfToken } from "pages/api/auth/csrf";
 import { z } from "zod";
 
 import { Booker } from "@calcom/atoms";
 import { getServerSession } from "@calcom/features/auth/lib/getServerSession";
+import { setCsrfToken } from "@calcom/features/auth/lib/set-csrf-token";
 import { getBookerWrapperClasses } from "@calcom/features/bookings/Booker/utils/getBookerWrapperClasses";
 import { BookerSeo } from "@calcom/features/bookings/components/BookerSeo";
 import {

apps/web/pages/api/auth/csrf.ts

@@ -1,21 +1,6 @@
-import { serialize } from "cookie";
-import { randomBytes } from "crypto";
-import type { ServerResponse } from "http";
 import type { NextApiRequest, NextApiResponse } from "next";
 
-export const setCsrfToken = (res: ServerResponse) => {
-  const token = randomBytes(28).toString("hex");
-  res.setHeader(
-    "Set-Cookie",
-    serialize("csrf_token", token, {
-      httpOnly: false, // important for reading cookie on the client
-      maxAge: undefined, // expire with session
-      sameSite: "strict",
-      path: "/",
-      secure: process.env.NODE_ENV === "production",
-    })
-  );
-};
+import { setCsrfToken } from "@calcom/features/auth/lib/set-csrf-token";
 
 export default function handler(req: NextApiRequest, res: NextApiResponse) {
   console.log("✨ Getting CSRF token...");

apps/web/pages/auth/login.tsx

@@ -5,7 +5,6 @@ import type { GetServerSidePropsContext } from "next";
 import { getCsrfToken, signIn } from "next-auth/react";
 import Link from "next/link";
 import { useRouter } from "next/navigation";
-import { setCsrfToken } from "pages/api/auth/csrf";
 import type { CSSProperties } from "react";
 import { useState } from "react";
 import { FormProvider, useForm } from "react-hook-form";
@@ -15,6 +14,7 @@ import { z } from "zod";
 import { SAMLLogin } from "@calcom/features/auth/SAMLLogin";
 import { ErrorCode } from "@calcom/features/auth/lib/ErrorCode";
 import { getServerSession } from "@calcom/features/auth/lib/getServerSession";
+import { setCsrfToken } from "@calcom/features/auth/lib/set-csrf-token";
 import { isSAMLLoginEnabled, samlProductID, samlTenantID } from "@calcom/features/ee/sso/lib/saml";
 import { WEBAPP_URL, WEBSITE_URL, HOSTED_CAL_FEATURES } from "@calcom/lib/constants";
 import { getSafeRedirectUrl } from "@calcom/lib/getSafeRedirectUrl";

packages/features/auth/lib/set-csrf-token.ts

@@ -0,0 +1,17 @@
+import { serialize } from "cookie";
+import { randomBytes } from "crypto";
+import type { ServerResponse } from "http";
+
+export const setCsrfToken = (res: ServerResponse) => {
+  const token = randomBytes(28).toString("hex");
+  res.setHeader(
+    "Set-Cookie",
+    serialize("csrf_token", token, {
+      httpOnly: false, // important for reading cookie on the client
+      maxAge: undefined, // expire with session
+      sameSite: "strict",
+      path: "/",
+      secure: process.env.NODE_ENV === "production",
+    })
+  );
+};

turbo.json

@@ -219,6 +219,7 @@
     "CLOSECOM_API_KEY",
     "CRON_API_KEY",
     "CRON_ENABLE_APP_SYNC",
+    "CSRF_SECRET",
     "DAILY_API_KEY",
     "DAILY_SCALE_PLAN",
     "DEBUG",
@@ -334,7 +335,6 @@
     "ZOHOCRM_CLIENT_ID",
     "ZOHOCRM_CLIENT_SECRET",
     "ZOOM_CLIENT_ID",
-    "ZOOM_CLIENT_SECRET",
-    "CSRF_SECRET"
+    "ZOOM_CLIENT_SECRET"
   ]
 }

yarn.lock

@@ -3546,7 +3546,7 @@ __metadata:
     "@types/react-dom": ^18.0.9
     eslint: ^8.34.0
     eslint-config-next: ^13.2.1
-    next: ^13.5.4
+    next: ^13.4.6
     next-auth: ^4.22.1
     postcss: ^8.4.18
     react: ^18.2.0
@@ -17211,6 +17211,7 @@ __metadata:
     tsc-absolute: ^1.0.0
     turbo: ^1.10.1
     typescript: ^4.9.4
+    universal-cookie: ^6.1.1
     vitest: ^0.34.3
     vitest-fetch-mock: ^0.2.2
     vitest-mock-extended: ^1.1.3