From 72670c2a2d625d74d97725095395dd19a5220a76 Mon Sep 17 00:00:00 2001 From: Matthew Rollinson Date: Tue, 21 Apr 2026 09:30:47 +0100 Subject: [PATCH] feat(vendors): add Directus and Medusa to the cookie registry Directus ships two necessary auth cookies (directus_session_token, directus_refresh_token) when an authenticated user is present. Medusa v2 defaults to JWT-in-localStorage (medusa_auth_token) rather than cookies. connect.sid is included for sites that opt into the non-default session auth mode. Also fixes the Available Vendors list in configuration.md, which was missing youtube, vimeo, cloudflare, and cloudflare-turnstile that had been added to the registry previously. --- docs/guide/configuration.md | 2 +- src/runtime/utils/vendor-registry.ts | 18 ++++++++++++++++++ 2 files changed, 19 insertions(+), 1 deletion(-) diff --git a/docs/guide/configuration.md b/docs/guide/configuration.md index b7e7cd0..9de8517 100644 --- a/docs/guide/configuration.md +++ b/docs/guide/configuration.md @@ -89,7 +89,7 @@ Configuration for the `` component and `useCookiePolicy()` com Vendor IDs to include in the cookie policy table. Each must match an ID in the built-in vendor registry. -Available vendors: `google-tag-manager`, `google-analytics`, `google-ads`, `meta-pixel`, `posthog`, `linkedin-insight`, `tiktok-pixel`, `microsoft-clarity`, `hotjar`, `intercom`, `hubspot`, `stripe`. +Available vendors: `google-tag-manager`, `google-analytics`, `google-ads`, `meta-pixel`, `posthog`, `linkedin-insight`, `tiktok-pixel`, `microsoft-clarity`, `hotjar`, `intercom`, `hubspot`, `stripe`, `youtube`, `vimeo`, `cloudflare`, `cloudflare-turnstile`, `directus`, `medusa`. #### `cookiePolicy.cookies` diff --git a/src/runtime/utils/vendor-registry.ts b/src/runtime/utils/vendor-registry.ts index 2221347..175630e 100644 --- a/src/runtime/utils/vendor-registry.ts +++ b/src/runtime/utils/vendor-registry.ts @@ -170,4 +170,22 @@ export const vendorRegistry: VendorDefinition[] = [ { name: '__cf_bm', vendor: 'Cloudflare Turnstile', category: 'necessary', purpose: 'Bot management cookie used to distinguish between humans and bots.', duration: '30 minutes', type: 'HTTP' }, ], }, + { + id: 'directus', + name: 'Directus', + privacyPolicyUrl: 'https://directus.io/privacy', + cookies: [ + { name: 'directus_session_token', vendor: 'Directus', category: 'necessary', purpose: 'Stores the signed session JWT for an authenticated Directus user so the backend can identify them across requests.', duration: '1 day', type: 'HTTP' }, + { name: 'directus_refresh_token', vendor: 'Directus', category: 'necessary', purpose: 'Long-lived token used to silently refresh the access token without requiring re-authentication.', duration: '7 days', type: 'HTTP' }, + ], + }, + { + id: 'medusa', + name: 'Medusa', + privacyPolicyUrl: 'https://medusajs.com/privacy', + cookies: [ + { name: 'medusa_auth_token', vendor: 'Medusa', category: 'necessary', purpose: 'Stores the authenticated customer\'s JWT so their session persists across page loads on the storefront.', duration: 'Persistent', type: 'HTML Local Storage' }, + { name: 'connect.sid', vendor: 'Medusa', category: 'necessary', purpose: 'Express session identifier. Only set when the Medusa backend is configured with session auth (non-default).', duration: 'Session', type: 'HTTP' }, + ], + }, ]