@akinon/next 2.0.104-rc.0 → 2.0.104-rc.1

package/CHANGELOG.md

@@ -1,5 +1,13 @@
 # @akinon/next
 
+## 2.0.104-rc.1
+
+### Patch Changes
+
+- 1595d45: ZERO-4866: Fix register getting stuck with no error after successful signup
+
+  The login/register credentials provider threw an uncaught SyntaxError whenever the backend returned a non-JSON body (e.g. an HTML error page on a 500/502), surfacing NextAuth's opaque "Configuration" error instead of a usable one; it also only ever read one Set-Cookie response header, missing the osessionid/csrftoken cookie depending on header order, and dropped the session entirely after register/OTP since those flows upgrade the existing anonymous osessionid in place instead of rotating it. getCaptcha also threw when the backend had no reCAPTCHA site key configured. All four are fixed: JSON parsing failures throw a clean auth error, every Set-Cookie header is read, the pre-request session id is used as a fallback after register/OTP, and a missing site key now falls back to an empty string.
+
 ## 2.0.104-rc.0
 
 ### Patch Changes

package/api/auth.ts

@@ -225,12 +225,31 @@ const getDefaultAuthConfig = () => {
               }
             );
 
-            const body = (await request.json()) as {
+            let body: {
               key: string;
               non_field_errors: string[];
               redirect_url: string;
             };
 
+            try {
+              body = await request.json();
+            } catch {
+              // Backend returned a non-JSON body (e.g. an HTML error page on
+              // a 500/502) — surface a clean auth error instead of letting
+              // the SyntaxError bubble up as an opaque "Configuration" error
+              // (ZERO-4866).
+              logger.warn(
+                `Login/Register response was not valid JSON (status ${request.status})`,
+                { userIp }
+              );
+              throwAuthError([
+                {
+                  type: 'non_field_errors',
+                  data: ['Something went wrong. Please try again later.']
+                }
+              ]);
+            }
+
             return { request, body };
           };
 
@@ -274,17 +293,32 @@ const getDefaultAuthConfig = () => {
 
           let sessionId = '';
           let rotatedCsrfToken = '';
-          const setCookieHeader = apiRequest.headers.get('set-cookie');
-          if (setCookieHeader) {
-            sessionId =
-              setCookieHeader
-                .match(/osessionid=\w+/)?.[0]
-                .replace(/osessionid=/, '') || '';
-            rotatedCsrfToken =
-              setCookieHeader
-                .match(/csrftoken=[^;,\s]+/)?.[0]
-                .replace(/csrftoken=/, '') || '';
+          // Headers.get('set-cookie') only ever returns ONE of potentially
+          // several Set-Cookie response headers (csrftoken, osessionid,
+          // sessionid, ...) — getSetCookie() (when available) returns all of
+          // them, so the osessionid/csrftoken cookies aren't missed
+          // depending on header order (ZERO-4866).
+          const setCookieHeaders =
+            typeof apiRequest.headers.getSetCookie === 'function'
+              ? apiRequest.headers.getSetCookie()
+              : [apiRequest.headers.get('set-cookie')].filter(Boolean);
+
+          for (const cookieHeader of setCookieHeaders) {
+            if (!sessionId) {
+              const sessionMatch = cookieHeader?.match(/osessionid=\w+/)?.[0];
+              if (sessionMatch) {
+                sessionId = sessionMatch.replace('osessionid=', '');
+              }
+            }
+            if (!rotatedCsrfToken) {
+              const csrfMatch = cookieHeader?.match(/csrftoken=[^;,\s]+/)?.[0];
+              if (csrfMatch) {
+                rotatedCsrfToken = csrfMatch.replace('csrftoken=', '');
+              }
+            }
+          }
 
+          if (sessionId) {
             logger.debug(`Login/Register session id: ${sessionId}`);
           } else {
             logger.warn('No set-cookie header found in response');
@@ -341,8 +375,14 @@ const getDefaultAuthConfig = () => {
             }
           }
 
+          // Register/OTP responses don't rotate the session cookie — the
+          // backend upgrades the shopper's existing anonymous osessionid in
+          // place instead of issuing a new one, so no Set-Cookie is present
+          // here. Falling back to the pre-request session id keeps this
+          // working for those flows (login always rotates it, so sessionId
+          // still wins there) (ZERO-4866).
           const currentUser = await getCurrentUser(
-            sessionId,
+            sessionId || existingSessionId || '',
             cookieStore.get('pz-currency')?.value ?? ''
           );
           return currentUser;
@@ -531,12 +571,31 @@ const defaultNextAuthOptionsV4 = (req: any, res: any) => {
               }
             );
 
-            const body = (await request.json()) as {
+            let body: {
               key: string;
               non_field_errors: string[];
               redirect_url: string;
             };
 
+            try {
+              body = await request.json();
+            } catch {
+              // Backend returned a non-JSON body (e.g. an HTML error page on
+              // a 500/502) — surface a clean auth error instead of letting
+              // the SyntaxError bubble up as an opaque "Configuration" error
+              // (ZERO-4866).
+              logger.warn(
+                `Login/Register response was not valid JSON (status ${request.status})`,
+                { userIp }
+              );
+              throwAuthError([
+                {
+                  type: 'non_field_errors',
+                  data: ['Something went wrong. Please try again later.']
+                }
+              ]);
+            }
+
             return { request, body };
           };
 
@@ -579,13 +638,25 @@ const defaultNextAuthOptionsV4 = (req: any, res: any) => {
           logger.debug(`Login/Register response: ${JSON.stringify(response)}`);
 
           let sessionId = '';
-          const setCookieHeader = apiRequest.headers.get('set-cookie');
-          if (setCookieHeader) {
-            sessionId =
-              setCookieHeader
-                .match(/osessionid=\w+/)?.[0]
-                .replace(/osessionid=/, '') || '';
+          // Headers.get('set-cookie') only ever returns ONE of potentially
+          // several Set-Cookie response headers (csrftoken, osessionid,
+          // sessionid, ...) — getSetCookie() (when available) returns all of
+          // them, so the actual osessionid cookie isn't missed depending on
+          // header order (ZERO-4866).
+          const setCookieHeaders =
+            typeof apiRequest.headers.getSetCookie === 'function'
+              ? apiRequest.headers.getSetCookie()
+              : [apiRequest.headers.get('set-cookie')].filter(Boolean);
+
+          for (const cookieHeader of setCookieHeaders) {
+            const match = cookieHeader?.match(/osessionid=\w+/)?.[0];
+            if (match) {
+              sessionId = match.replace('osessionid=', '');
+              break;
+            }
+          }
 
+          if (sessionId) {
             logger.debug(`Login/Register session id: ${sessionId}`);
           } else {
             logger.warn('No set-cookie header found in response');
@@ -625,8 +696,14 @@ const defaultNextAuthOptionsV4 = (req: any, res: any) => {
             }
           }
 
+          // Register/OTP responses don't rotate the session cookie — the
+          // backend upgrades the shopper's existing anonymous osessionid in
+          // place instead of issuing a new one, so no Set-Cookie is present
+          // here. Falling back to the pre-request session id keeps this
+          // working for those flows (login always rotates it, so sessionId
+          // still wins there) (ZERO-4866).
           const currentUser = await getCurrentUser(
-            sessionId,
+            sessionId || req.cookies['osessionid'] || '',
             req.cookies['pz-currency'] ?? ''
           );
           return currentUser;

package/data/client/user.ts

@@ -22,7 +22,12 @@ const userApi = api.injectEndpoints({
     getCaptcha: build.query<GetCaptchaResponse, void>({
       query: () => buildClientRequestUrl(user.captcha),
       transformResponse: (response: { html: string }) => {
-        const siteKey = response.html.match(/data-sitekey="([^"]+)"/i)[1];
+        // Falls back to '' instead of throwing when the backend has no
+        // reCAPTCHA site key configured (data-sitekey="") — an empty
+        // siteKey is handled by the caller, whereas a thrown error here
+        // isn't (ZERO-4866).
+        const siteKey =
+          response.html.match(/data-sitekey="([^"]+)"/i)?.[1] || '';
 
         const csrfTokenMatch = response.html.match(
           /name=['|"]csrfmiddlewaretoken['|"] value=['|"][^'"]+/gi

package/package.json

@@ -1,7 +1,7 @@
 {
   "name": "@akinon/next",
   "description": "Core package for Project Zero Next",
-  "version": "2.0.104-rc.0",
+  "version": "2.0.104-rc.1",
   "private": false,
   "license": "MIT",
   "bin": {
@@ -36,7 +36,7 @@
     "set-cookie-parser": "2.6.0"
   },
   "devDependencies": {
-    "@akinon/eslint-plugin-projectzero": "2.0.104-rc.0",
+    "@akinon/eslint-plugin-projectzero": "2.0.104-rc.1",
     "@babel/core": "7.26.10",
     "@babel/preset-env": "7.26.9",
     "@babel/preset-typescript": "7.27.0",