@artatol-acp/auth-nextjs 0.5.4 → 0.5.5

package/README.md

@@ -297,27 +297,46 @@ export function LoginForm() {
 }
 ```
 
-## Middleware (Optional)
+## Middleware (REQUIRED)
 
-Create `middleware.ts` for route protection:
+> **⚠️ IMPORTANT:** Middleware is **required** for automatic token refresh to work. Without it, users will be logged out when their access token expires (every 5 minutes).
+
+The middleware handles:
+- Automatic access token refresh using the refresh token
+- Route protection (redirect to login if not authenticated)
+- Token validation
+
+Create `middleware.ts` in your project root:
 
 ```typescript
 import { createACPAuthMiddleware } from '@artatol-acp/auth-nextjs/middleware';
-import { readFileSync } from 'fs';
 
-const publicKey = readFileSync('./keys/public.pem', 'utf-8');
-
-export const middleware = createACPAuthMiddleware({
-  jwtPublicKey: publicKey,
-  publicPaths: ['/login', '/register', '/forgot-password'],
+export default createACPAuthMiddleware({
+  baseUrl: process.env.ACP_AUTH_URL!,
+  jwtPublicKey: process.env.ACP_AUTH_JWT_PUBLIC_KEY!,
+  // Optional: customize public paths (defaults shown below)
+  publicPaths: ['/login', '/register', '/forgot-password', '/reset-password', '/verify-email', '/verify-2fa'],
   loginPath: '/login',
+  // Optional: cookie configuration for SSO
+  cookies: {
+    domain: process.env.NODE_ENV === 'production' ? '.yourdomain.com' : undefined,
+  },
 });
 
 export const config = {
-  matcher: ['/((?!api|_next/static|_next/image|favicon.ico).*)'],
+  matcher: ['/((?!_next/static|_next/image|favicon.ico).*)'],
 };
 ```
 
+### Why is middleware required?
+
+In Next.js App Router, cookies can only be modified in:
+- Route Handlers (`app/api/...`)
+- Server Actions
+- Middleware
+
+Server Components (pages) **cannot** set cookies. When a user's access token expires and they navigate to a page, the SDK cannot refresh the token from within the page render. The middleware intercepts the request **before** the page renders and handles the refresh.
+
 ## Environment Variables
 
 ```env

package/package.json

@@ -1,6 +1,6 @@
 {
   "name": "@artatol-acp/auth-nextjs",
-  "version": "0.5.4",
+  "version": "0.5.5",
   "description": "Next.js SDK for Artatol Cloud Platform Authentication with support for App Router, Server Actions, and Middleware",
   "type": "module",
   "main": "./dist/index.js",