set separate auth cookie for each provider

fixes the issue were uppyAuthToken cookie gets overridden by
the most recent provider token. As a result thumbnail endpoint
may return 401 for previously authed providers

packages/@uppy/companion/src/server/controllers/logout.js

@@ -11,11 +11,7 @@ function logout (req, res) {
 
   if (req.uppy.providerTokens[providerName]) {
     delete req.uppy.providerTokens[providerName]
-    tokenService.addToCookies(
-      res,
-      tokenService.generateToken(req.uppy.providerTokens, req.uppy.options.secret),
-      req.uppy.options
-    )
+    tokenService.removeFromCookies(res, req.uppy.options, req.uppy.provider.authProviderName)
   }
 
   if (session.grant) {

packages/@uppy/companion/src/server/controllers/send-token.js

@@ -16,7 +16,7 @@ const oAuthState = require('../helpers/oauth-state')
 module.exports = function sendToken (req, res, next) {
   const uppyAuthToken = req.uppy.authToken
   // add the token to cookies for thumbnail/image requests
-  tokenService.addToCookies(res, uppyAuthToken, req.uppy.options)
+  tokenService.addToCookies(res, uppyAuthToken, req.uppy.options, req.uppy.provider.authProvider)
 
   const state = (req.session.grant || {}).state
   if (state) {

packages/@uppy/companion/src/server/helpers/jwt.js

@@ -29,8 +29,9 @@ module.exports.verifyToken = (token, secret) => {
  * @param {object} res
  * @param {string} token
  * @param {object=} uppyOptions
+ * @param {string} providerName
  */
-module.exports.addToCookies = (res, token, uppyOptions) => {
+module.exports.addToCookies = (res, token, uppyOptions, providerName) => {
   const cookieOptions = {
     maxAge: 1000 * 60 * 60 * 24 * 30, // would expire after 30 days
     httpOnly: true
@@ -40,5 +41,24 @@ module.exports.addToCookies = (res, token, uppyOptions) => {
     cookieOptions.domain = uppyOptions.cookieDomain
   }
   // send signed token to client.
-  res.cookie('uppyAuthToken', token, cookieOptions)
+  res.cookie(`uppyAuthToken--${providerName}`, token, cookieOptions)
+}
+
+/**
+ *
+ * @param {object} res
+ * @param {object=} uppyOptions
+ * @param {string} providerName
+ */
+module.exports.removeFromCookies = (res, uppyOptions, providerName) => {
+  const cookieOptions = {
+    maxAge: 1000 * 60 * 60 * 24 * 30, // would expire after 30 days
+    httpOnly: true
+  }
+
+  if (uppyOptions.cookieDomain) {
+    cookieOptions.domain = uppyOptions.cookieDomain
+  }
+
+  res.clearCookie(`uppyAuthToken--${providerName}`, cookieOptions)
 }

packages/@uppy/companion/src/server/middlewares.js

@@ -38,6 +38,6 @@ exports.gentleVerifyToken = (req, res, next) => {
 }
 
 exports.cookieAuthToken = (req, res, next) => {
-  req.uppy.authToken = req.cookies.uppyAuthToken
+  req.uppy.authToken = req.cookies[`uppyAuthToken--${req.uppy.provider.authProvider}`]
   return next()
 }

packages/@uppy/companion/test/__tests__/companion.js

@@ -80,7 +80,7 @@ describe('test authentication', () => {
       .get(`/drive/send-token?uppyAuthToken=${token}`)
       .expect(200)
       .expect((res) => {
-        const authToken = res.header['set-cookie'][0].split(';')[0].split('uppyAuthToken=')[1]
+        const authToken = res.header['set-cookie'][0].split(';')[0].split('uppyAuthToken--google=')[1]
         expect(authToken).toEqual(token)
         // see mock ../../src/server/helpers/oauth-state above for http://localhost:3020
         const body = `