From 74d8a1dcf9820bad2426feb15bc35dc417d8c454 Mon Sep 17 00:00:00 2001
From: Adam Soltys <adam@coinos.io>
Date: Wed, 4 Mar 2026 23:17:25 -0800
Subject: pass origin

---
 src/lib/passkey.ts                        |  8 +++++---
 src/routes/(app)/ecash/post/+server.ts    | 11 -----------
 src/routes/amber/[id]/[pubkey]/+server.ts |  6 ------
 src/routes/passkey/[...path]/+server.ts   | 25 -------------------------
 4 files changed, 5 insertions(+), 45 deletions(-)
 delete mode 100644 src/routes/(app)/ecash/post/+server.ts
 delete mode 100644 src/routes/amber/[id]/[pubkey]/+server.ts
 delete mode 100644 src/routes/passkey/[...path]/+server.ts

(limited to 'src')

diff --git a/src/lib/passkey.ts b/src/lib/passkey.ts
index 7c9e98cc..3d7b7272 100644
--- a/src/lib/passkey.ts
+++ b/src/lib/passkey.ts
@@ -14,9 +14,10 @@ export async function registerPasskey(
   token?: string,
 ): Promise<{ prfKey: ArrayBuffer; credentialId: string }> {
   const headers = token ? authHeader(token) : undefined;
-  const options = await post("/passkey/register/options", {}, headers);
+  const origin = window.location.origin;
+  const options = await post("/passkey/register/options", { origin }, headers);
   const registration = await startRegistration({ optionsJSON: options });
-  await post("/passkey/register/verify", registration, headers);
+  await post("/passkey/register/verify", { ...registration, origin }, headers);
   const prfKey = await deriveKey(registration.id);
   return { prfKey, credentialId: registration.id };
 }
@@ -26,7 +27,8 @@ export async function loginWithPasskey(): Promise<{
   challengeId: string;
   prfKey: ArrayBuffer;
 }> {
-  const { challengeId, ...options } = await post("/passkey/login/options", {});
+  const origin = window.location.origin;
+  const { challengeId, ...options } = await post("/passkey/login/options", { origin });
   const authentication = await startAuthentication({ optionsJSON: options });
   const prfKey = await deriveKey(authentication.id);
   return { credential: authentication, challengeId, prfKey };
diff --git a/src/routes/(app)/ecash/post/+server.ts b/src/routes/(app)/ecash/post/+server.ts
deleted file mode 100644
index 371582bc..00000000
--- a/src/routes/(app)/ecash/post/+server.ts
+++ /dev/null
@@ -1,11 +0,0 @@
-import { json } from "@sveltejs/kit";
-
-export async function POST({ fetch, request }) {
-  const { target, payload } = await request.json();
-  const res = await fetch(target, {
-    method: "POST",
-    body: JSON.stringify(payload),
-    headers: { "Content-Type": "application/json" },
-  });
-  return json(res);
-}
diff --git a/src/routes/amber/[id]/[pubkey]/+server.ts b/src/routes/amber/[id]/[pubkey]/+server.ts
deleted file mode 100644
index e0c67145..00000000
--- a/src/routes/amber/[id]/[pubkey]/+server.ts
+++ /dev/null
@@ -1,6 +0,0 @@
-import { json } from "@sveltejs/kit";
-
-export async function GET({ params }) {
-  console.log(params);
-  return json({});
-}
diff --git a/src/routes/passkey/[...path]/+server.ts b/src/routes/passkey/[...path]/+server.ts
deleted file mode 100644
index 0c2154d2..00000000
--- a/src/routes/passkey/[...path]/+server.ts
+++ /dev/null
@@ -1,25 +0,0 @@
-import { PUBLIC_COINOS_URL as base } from "$env/static/public";
-import { auth } from "$lib/utils";
-
-export async function POST({ cookies, fetch, params, request, url }) {
-  const { path } = params;
-  const headers: Record<string, string> = { "Content-Type": "application/json" };
-
-  // Use Authorization header from request if present, otherwise fall back to cookie
-  const authHeader = request.headers.get("authorization");
-  if (authHeader) {
-    headers.authorization = authHeader;
-  } else {
-    const token = cookies.get("token");
-    if (token) Object.assign(headers, auth(cookies));
-  }
-
-  const body = await request.json();
-  body.origin = url.origin;
-
-  return fetch(`${base}/passkey/${path}`, {
-    method: "POST",
-    body: JSON.stringify(body),
-    headers,
-  });
-}
-- 
cgit v1.2.3