@appconda/nextjs 1.0.86 → 1.0.88

package/dist/lib/jwt.js

@@ -0,0 +1,102 @@
+import jwt from "jsonwebtoken";
+import { symmetricDecrypt, symmetricEncrypt } from "./crypto";
+import { getEnv } from "./env";
+export const createToken = (userId, userEmail, options = {}) => {
+    const encryptedUserId = symmetricEncrypt(userId, getEnv().ENCRYPTION_KEY);
+    return jwt.sign({ id: encryptedUserId }, getEnv().NEXTAUTH_SECRET + userEmail, options);
+};
+export const createTokenForLinkSurvey = (surveyId, userEmail) => {
+    const encryptedEmail = symmetricEncrypt(userEmail, getEnv().ENCRYPTION_KEY);
+    return jwt.sign({ email: encryptedEmail }, getEnv().NEXTAUTH_SECRET + surveyId);
+};
+export const createEmailToken = (email) => {
+    const encryptedEmail = symmetricEncrypt(email, getEnv().ENCRYPTION_KEY);
+    return jwt.sign({ email: encryptedEmail }, getEnv().NEXTAUTH_SECRET);
+};
+export const getEmailFromEmailToken = (token) => {
+    const payload = jwt.verify(token, getEnv().NEXTAUTH_SECRET);
+    try {
+        // Try to decrypt first (for newer tokens)
+        const decryptedEmail = symmetricDecrypt(payload.email, getEnv().ENCRYPTION_KEY);
+        return decryptedEmail;
+    }
+    catch {
+        // If decryption fails, return the original email (for older tokens)
+        return payload.email;
+    }
+};
+export const createInviteToken = (inviteId, email, options = {}) => {
+    const encryptedInviteId = symmetricEncrypt(inviteId, getEnv().ENCRYPTION_KEY);
+    const encryptedEmail = symmetricEncrypt(email, getEnv().ENCRYPTION_KEY);
+    return jwt.sign({ inviteId: encryptedInviteId, email: encryptedEmail }, getEnv().NEXTAUTH_SECRET, options);
+};
+export const verifyTokenForLinkSurvey = (token, surveyId) => {
+    try {
+        const { email } = jwt.verify(token, getEnv().NEXTAUTH_SECRET + surveyId);
+        try {
+            // Try to decrypt first (for newer tokens)
+            const decryptedEmail = symmetricDecrypt(email, getEnv().ENCRYPTION_KEY);
+            return decryptedEmail;
+        }
+        catch {
+            // If decryption fails, return the original email (for older tokens)
+            return email;
+        }
+    }
+    catch (err) {
+        return null;
+    }
+};
+export const verifyToken = async (token) => {
+    // First decode to get the ID
+    const decoded = jwt.decode(token);
+    const payload = decoded;
+    const { id } = payload;
+    if (!id) {
+        throw new Error("Token missing required field: id");
+    }
+    // Try to decrypt the ID (for newer tokens), if it fails use the ID as-is (for older tokens)
+    let decryptedId;
+    try {
+        decryptedId = symmetricDecrypt(id, getEnv().ENCRYPTION_KEY);
+    }
+    catch {
+        decryptedId = id;
+    }
+    // If no email provided, look up the user
+    const foundUser = null; /* await prisma.user.findUnique({
+      where: { id: decryptedId },
+    }); */
+    if (!foundUser) {
+        throw new Error("User not found");
+    }
+    const userEmail = foundUser.email;
+    return { id: decryptedId, email: userEmail };
+};
+export const verifyInviteToken = (token) => {
+    try {
+        const decoded = jwt.decode(token);
+        const payload = decoded;
+        const { inviteId, email } = payload;
+        let decryptedInviteId;
+        let decryptedEmail;
+        try {
+            // Try to decrypt first (for newer tokens)
+            decryptedInviteId = symmetricDecrypt(inviteId, getEnv().ENCRYPTION_KEY);
+            decryptedEmail = symmetricDecrypt(email, getEnv().ENCRYPTION_KEY);
+        }
+        catch {
+            // If decryption fails, use original values (for older tokens)
+            decryptedInviteId = inviteId;
+            decryptedEmail = email;
+        }
+        return {
+            inviteId: decryptedInviteId,
+            email: decryptedEmail,
+        };
+    }
+    catch (error) {
+        console.error(`Error verifying invite token: ${error}`);
+        throw new Error("Invalid or expired invite token");
+    }
+};

package/package.json

@@ -2,7 +2,7 @@
   "name": "@appconda/nextjs",
   "homepage": "https://appconda.io/support",
   "description": "Appconda is an open-source self-hosted backend server that abstract and simplify complex and repetitive development tasks behind a very simple REST API",
-  "version": "1.0.86",
+  "version": "1.0.88",
   "license": "BSD-3-Clause",
   "main": "dist/index.js",
   "types": "dist/index.d.ts",
@@ -24,6 +24,7 @@
   "jsdelivr": "dist/iife/sdk.js",
   "unpkg": "dist/iife/sdk.js",
   "dependencies": {
+    "jsonwebtoken": "^9.0.2",
     "next": "^15.2.3",
     "next-auth": "^4.24.11",
     "next-safe-action": "^7.10.4",

package/src/actions/actionClient.ts

@@ -27,7 +27,7 @@ export const actionClient = createSafeActionClient({
 });
 
 export const authenticatedActionClient = actionClient.use(async ({ next }) => {
-  const session = await getServerSession(authOptions);
+  const session = await getServerSession(authOptions());
   if (!session?.user) {
     throw new AuthenticationError("Not authenticated");
   }

package/src/actions/auth.ts

@@ -2,5 +2,5 @@ import { getServerSession } from "next-auth"
 import { authOptions } from "./authOptions";
 
 export const auth = async ()=> {
-    return await getServerSession(authOptions);
+    return await getServerSession(authOptions());
 }

package/src/actions/authOptions.ts

@@ -1,20 +1,20 @@
-import type {  NextAuthOptions } from "next-auth";
+import type { NextAuthOptions } from "next-auth";
 import CredentialsProvider from "next-auth/providers/credentials";
 import { cookies } from "next/headers";
 import { getAppcondaClient } from "../getAppcondaClient";
 import { Account } from "../modules/account/service";
-//import { getEnv } from "../lib/env";
+import { getEnv } from "../lib/env";
 import { getSDKForCurrentUser } from "../getSDKForCurrentUser";
 import { Query } from "../query";
 
-const getEnv = () => {
+/* const getEnv = () => {
   return {
     APPCONDA_ENDPOINT: 'process.env.APPCONDA_ENDPOINT',
     APPCONDA_CLIENT_ENDPOINT: 'process.env.APPCONDA_CLIENT_ENDPOINT',
     _SERVICE_TOKEN: 'process.env._SERVICE_TOKEN',
     ENTERPRISE_LICENSE_KEY: 'process.env.ENTERPRISE_LICENSE_KEY',
   };
-};
+}; */
 
 export async function signIn({ userName, password }: { userName: string, password: string }) {
   const adminClient = await getAppcondaClient();
@@ -36,210 +36,219 @@ export async function signIn({ userName, password }: { userName: string, passwor
 
 }
 
-export const authOptions: NextAuthOptions = {
-  providers: [
-    CredentialsProvider({
-      id: "credentials",
-      // The name to display on the sign in form (e.g. "Sign in with...")
-      name: "Credentials",
-      // The credentials is used to generate a suitable form on the sign in page.
-      // You can specify whatever fields you are expecting to be submitted.
-      // e.g. domain, username, password, 2FA token, etc.
-      // You can pass any HTML attribute to the <input> tag through the object.
-      credentials: {
-        email: {
-          label: "Email Address",
-          type: "email",
-          placeholder: "Your email address",
+export const authOptions = (() => {
+  let options = null;
+
+  return () => {
+    if (options == null) {
+      options = {
+        providers: [
+          CredentialsProvider({
+            id: "credentials",
+            // The name to display on the sign in form (e.g. "Sign in with...")
+            name: "Credentials",
+            // The credentials is used to generate a suitable form on the sign in page.
+            // You can specify whatever fields you are expecting to be submitted.
+            // e.g. domain, username, password, 2FA token, etc.
+            // You can pass any HTML attribute to the <input> tag through the object.
+            credentials: {
+              email: {
+                label: "Email Address",
+                type: "email",
+                placeholder: "Your email address",
+              },
+              password: {
+                label: "Password",
+                type: "password",
+                placeholder: "Your password",
+              },
+              totpCode: { label: "Two-factor Code", type: "input", placeholder: "Code from authenticator app" },
+              backupCode: { label: "Backup Code", type: "input", placeholder: "Two-factor backup code" },
+            },
+            async authorize(credentials, _req) {
+              let user;
+              const appcondaSession = await signIn({ userName: credentials?.email as string, password: credentials?.password as string });
+
+              console.log(credentials);
+              /*  try {
+                 user = await prisma.user.findUnique({
+                   where: {
+                     email: credentials?.email,
+                   },
+                 });
+               } catch (e) {
+                 console.error(e);
+                 throw Error("Internal server error. Please try again later");
+               }
+               if (!user || !credentials) {
+                 throw new Error("Invalid credentials");
+               }
+               if (!user.password) {
+                 throw new Error("Invalid credentials");
+               }
+       
+               const isValid = await verifyPassword(credentials.password, user.password);
+       
+               if (!isValid) {
+                 throw new Error("Invalid credentials");
+               }
+       
+               if (user.twoFactorEnabled && credentials.backupCode) {
+                 if (!ENCRYPTION_KEY) {
+                   console.error("Missing encryption key; cannot proceed with backup code login.");
+                   throw new Error("Internal Server Error");
+                 }
+       
+                 if (!user.backupCodes) throw new Error("No backup codes found");
+       
+                 const backupCodes = JSON.parse(symmetricDecrypt(user.backupCodes, ENCRYPTION_KEY));
+       
+                 // check if user-supplied code matches one
+                 const index = backupCodes.indexOf(credentials.backupCode.replaceAll("-", ""));
+                 if (index === -1) throw new Error("Invalid backup code");
+       
+                 // delete verified backup code and re-encrypt remaining
+                 backupCodes[index] = null;
+                 await prisma.user.update({
+                   where: {
+                     id: user.id,
+                   },
+                   data: {
+                     backupCodes: symmetricEncrypt(JSON.stringify(backupCodes), ENCRYPTION_KEY),
+                   },
+                 });
+               } else if (user.twoFactorEnabled) {
+                 if (!credentials.totpCode) {
+                   throw new Error("second factor required");
+                 }
+       
+                 if (!user.twoFactorSecret) {
+                   throw new Error("Internal Server Error");
+                 }
+       
+                 if (!ENCRYPTION_KEY) {
+                   throw new Error("Internal Server Error");
+                 }
+       
+                 const secret = symmetricDecrypt(user.twoFactorSecret, ENCRYPTION_KEY);
+                 if (secret.length !== 32) {
+                   throw new Error("Internal Server Error");
+                 }
+       
+                 const isValidToken = (await import("./totp")).totpAuthenticatorCheck(credentials.totpCode, secret);
+                 if (!isValidToken) {
+                   throw new Error("Invalid second factor code");
+                 }
+               } */
+
+              console.log("asafdf")
+
+              return {
+                id: appcondaSession.userId,
+                email: appcondaSession.providerUid,
+                emailVerified: true,
+                imageUrl: "",
+              };
+            },
+          }),
+          CredentialsProvider({
+            id: "token",
+            // The name to display on the sign in form (e.g. "Sign in with...")
+            name: "Token",
+            // The credentials is used to generate a suitable form on the sign in page.
+            // You can specify whatever fields you are expecting to be submitted.
+            // e.g. domain, username, password, 2FA token, etc.
+            // You can pass any HTML attribute to the <input> tag through the object.
+            credentials: {
+              token: {
+                label: "Verification Token",
+                type: "string",
+              },
+            },
+            async authorize(credentials, _req) {
+
+              let user;
+              /*  try {
+                 if (!credentials?.token) {
+                   throw new Error("Token not found");
+                 }
+                 const { id } = await verifyToken(credentials?.token);
+                 user = await prisma.user.findUnique({
+                   where: {
+                     id: id,
+                   },
+                 });
+               } catch (e) {
+                 console.error(e);
+                 throw new Error("Either a user does not match the provided token or the token is invalid");
+               }
+       
+               if (!user) {
+                 throw new Error("Either a user does not match the provided token or the token is invalid");
+               }
+       
+               if (user.emailVerified) {
+                 throw new Error("Email already verified");
+               }
+       
+               user = await updateUser(user.id, { emailVerified: new Date() }); */
+
+              return user || null;
+            },
+          }),
+          // Conditionally add enterprise SSO providers
+          ...(getEnv().ENTERPRISE_LICENSE_KEY ? [] : []),
+        ],
+        callbacks: {
+          async jwt({ token }) {
+
+            const { users } = await getSDKForCurrentUser();
+            const userList = await users.list([Query.equal("email", token.email!)])
+
+            const user = userList.users[0] ?? {};
+
+            /*  const existingUser = await getUserByEmail(token?.email!);
+       
+             if (!existingUser) {
+               return token;
+             } */
+
+            return {
+              ...token,
+              //@ts-ignore
+              profile: { id: user.$id, ...user },
+            };
+          },
+          async session({ session, token }) {
+            //@ts-ignore
+            session.user.id = token?.id;
+            //@ts-ignore
+            session.user = token.profile;
+
+            return session;
+          },
+          //@ts-ignore
+          async signIn({ user, account }: { user: any; account: Account | null }) {
+            /*   if (account?.provider === "credentials" || account?.provider === "token") {
+                // check if user's email is verified or not
+                if (!user.emailVerified && !EMAIL_VERIFICATION_DISABLED) {
+                  throw new Error("Email Verification is Pending");
+                }
+                return true;
+              }
+              if (ENTERPRISE_LICENSE_KEY) {
+                return handleSSOCallback({ user, account });
+              } */
+            return true;
+          },
         },
-        password: {
-          label: "Password",
-          type: "password",
-          placeholder: "Your password",
+        pages: {
+          signIn: "/auth/login",
+          signOut: "/auth/logout",
+          error: "/auth/login", // Error code passed in query string as ?error=
         },
-        totpCode: { label: "Two-factor Code", type: "input", placeholder: "Code from authenticator app" },
-        backupCode: { label: "Backup Code", type: "input", placeholder: "Two-factor backup code" },
-      },
-      async authorize(credentials, _req) {
-        let user;
-        const appcondaSession = await signIn({ userName: credentials?.email as string, password: credentials?.password as string });
-
-        console.log(credentials);
-        /*  try {
-           user = await prisma.user.findUnique({
-             where: {
-               email: credentials?.email,
-             },
-           });
-         } catch (e) {
-           console.error(e);
-           throw Error("Internal server error. Please try again later");
-         }
-         if (!user || !credentials) {
-           throw new Error("Invalid credentials");
-         }
-         if (!user.password) {
-           throw new Error("Invalid credentials");
-         }
- 
-         const isValid = await verifyPassword(credentials.password, user.password);
- 
-         if (!isValid) {
-           throw new Error("Invalid credentials");
-         }
- 
-         if (user.twoFactorEnabled && credentials.backupCode) {
-           if (!ENCRYPTION_KEY) {
-             console.error("Missing encryption key; cannot proceed with backup code login.");
-             throw new Error("Internal Server Error");
-           }
- 
-           if (!user.backupCodes) throw new Error("No backup codes found");
- 
-           const backupCodes = JSON.parse(symmetricDecrypt(user.backupCodes, ENCRYPTION_KEY));
- 
-           // check if user-supplied code matches one
-           const index = backupCodes.indexOf(credentials.backupCode.replaceAll("-", ""));
-           if (index === -1) throw new Error("Invalid backup code");
- 
-           // delete verified backup code and re-encrypt remaining
-           backupCodes[index] = null;
-           await prisma.user.update({
-             where: {
-               id: user.id,
-             },
-             data: {
-               backupCodes: symmetricEncrypt(JSON.stringify(backupCodes), ENCRYPTION_KEY),
-             },
-           });
-         } else if (user.twoFactorEnabled) {
-           if (!credentials.totpCode) {
-             throw new Error("second factor required");
-           }
- 
-           if (!user.twoFactorSecret) {
-             throw new Error("Internal Server Error");
-           }
- 
-           if (!ENCRYPTION_KEY) {
-             throw new Error("Internal Server Error");
-           }
- 
-           const secret = symmetricDecrypt(user.twoFactorSecret, ENCRYPTION_KEY);
-           if (secret.length !== 32) {
-             throw new Error("Internal Server Error");
-           }
- 
-           const isValidToken = (await import("./totp")).totpAuthenticatorCheck(credentials.totpCode, secret);
-           if (!isValidToken) {
-             throw new Error("Invalid second factor code");
-           }
-         } */
-
-        console.log("asafdf")
-
-        return {
-          id: appcondaSession.userId,
-          email: appcondaSession.providerUid,
-          emailVerified: true,
-          imageUrl: "",
-        };
-      },
-    }),
-    CredentialsProvider({
-      id: "token",
-      // The name to display on the sign in form (e.g. "Sign in with...")
-      name: "Token",
-      // The credentials is used to generate a suitable form on the sign in page.
-      // You can specify whatever fields you are expecting to be submitted.
-      // e.g. domain, username, password, 2FA token, etc.
-      // You can pass any HTML attribute to the <input> tag through the object.
-      credentials: {
-        token: {
-          label: "Verification Token",
-          type: "string",
-        },
-      },
-      async authorize(credentials, _req) {
-
-        let user;
-        /*  try {
-           if (!credentials?.token) {
-             throw new Error("Token not found");
-           }
-           const { id } = await verifyToken(credentials?.token);
-           user = await prisma.user.findUnique({
-             where: {
-               id: id,
-             },
-           });
-         } catch (e) {
-           console.error(e);
-           throw new Error("Either a user does not match the provided token or the token is invalid");
-         }
- 
-         if (!user) {
-           throw new Error("Either a user does not match the provided token or the token is invalid");
-         }
- 
-         if (user.emailVerified) {
-           throw new Error("Email already verified");
-         }
- 
-         user = await updateUser(user.id, { emailVerified: new Date() }); */
-
-        return user || null;
-      },
-    }),
-    // Conditionally add enterprise SSO providers
-    ...(getEnv().ENTERPRISE_LICENSE_KEY ? [] : []),
-  ],
-  callbacks: {
-    async jwt({ token }) {
-
-      const { users } = await getSDKForCurrentUser();
-      const userList = await users.list([Query.equal("email", token.email!)])
-    
-      const user = userList.users[0] ?? {};
-
-      /*  const existingUser = await getUserByEmail(token?.email!);
- 
-       if (!existingUser) {
-         return token;
-       } */
-
-      return {
-        ...token,
-        //@ts-ignore
-        profile: { id: user.$id, ...user },
-      };
-    },
-    async session({ session, token }) {
-      //@ts-ignore
-      session.user.id = token?.id;
-      //@ts-ignore
-      session.user = token.profile;
-
-      return session;
-    },
-    //@ts-ignore
-    async signIn({ user, account }: { user: any; account: Account | null }) {
-      /*   if (account?.provider === "credentials" || account?.provider === "token") {
-          // check if user's email is verified or not
-          if (!user.emailVerified && !EMAIL_VERIFICATION_DISABLED) {
-            throw new Error("Email Verification is Pending");
-          }
-          return true;
-        }
-        if (ENTERPRISE_LICENSE_KEY) {
-          return handleSSOCallback({ user, account });
-        } */
-      return true;
-    },
-  },
-  pages: {
-    signIn: "/auth/login",
-    signOut: "/auth/logout",
-    error: "/auth/login", // Error code passed in query string as ?error=
-  },
-};
+      }
+    }
+    return options;
+  }
+})();

package/src/index.ts

@@ -40,3 +40,4 @@ export { getAppcondaClient } from './getAppcondaClient';
 export * from './modules';
 export type { SafeActionFn } from 'next-safe-action'; 
 export * from './actions';
+export * from './lib';