@artatol-acp/auth-nextjs 0.5.4 → 0.5.6

package/README.md

@@ -297,27 +297,46 @@ export function LoginForm() {
 }
 ```
 
-## Middleware (Optional)
+## Middleware (REQUIRED)
 
-Create `middleware.ts` for route protection:
+> **⚠️ IMPORTANT:** Middleware is **required** for automatic token refresh to work. Without it, users will be logged out when their access token expires (every 5 minutes).
+
+The middleware handles:
+- Automatic access token refresh using the refresh token
+- Route protection (redirect to login if not authenticated)
+- Token validation
+
+Create `middleware.ts` in your project root:
 
 ```typescript
 import { createACPAuthMiddleware } from '@artatol-acp/auth-nextjs/middleware';
-import { readFileSync } from 'fs';
 
-const publicKey = readFileSync('./keys/public.pem', 'utf-8');
-
-export const middleware = createACPAuthMiddleware({
-  jwtPublicKey: publicKey,
-  publicPaths: ['/login', '/register', '/forgot-password'],
+export default createACPAuthMiddleware({
+  baseUrl: process.env.ACP_AUTH_URL!,
+  jwtPublicKey: process.env.ACP_AUTH_JWT_PUBLIC_KEY!,
+  // Optional: customize public paths (defaults shown below)
+  publicPaths: ['/login', '/register', '/forgot-password', '/reset-password', '/verify-email', '/verify-2fa'],
   loginPath: '/login',
+  // Optional: cookie configuration for SSO
+  cookies: {
+    domain: process.env.NODE_ENV === 'production' ? '.yourdomain.com' : undefined,
+  },
 });
 
 export const config = {
-  matcher: ['/((?!api|_next/static|_next/image|favicon.ico).*)'],
+  matcher: ['/((?!_next/static|_next/image|favicon.ico).*)'],
 };
 ```
 
+### Why is middleware required?
+
+In Next.js App Router, cookies can only be modified in:
+- Route Handlers (`app/api/...`)
+- Server Actions
+- Middleware
+
+Server Components (pages) **cannot** set cookies. When a user's access token expires and they navigate to a page, the SDK cannot refresh the token from within the page render. The middleware intercepts the request **before** the page renders and handles the refresh.
+
 ## Environment Variables
 
 ```env

package/dist/proxy.d.ts

@@ -0,0 +1,16 @@
+import { NextRequest, NextResponse } from 'next/server';
+export type ACPAuthMiddlewareOptions = {
+    baseUrl: string;
+    apiKey?: string;
+    jwtPublicKey: string;
+    publicPaths?: string[];
+    loginPath?: string;
+    cookies?: {
+        domain?: string;
+        path?: string;
+        secure?: boolean;
+        sameSite?: 'strict' | 'lax' | 'none';
+    };
+};
+export declare function createACPAuthMiddleware(options: ACPAuthMiddlewareOptions): (request: NextRequest) => Promise<NextResponse<unknown>>;
+//# sourceMappingURL=proxy.d.ts.map

package/dist/proxy.d.ts.map

@@ -0,0 +1 @@
+{"version":3,"file":"proxy.d.ts","sourceRoot":"","sources":["../src/proxy.ts"],"names":[],"mappings":"AAAA,OAAO,EAAE,WAAW,EAAE,YAAY,EAAE,MAAM,aAAa,CAAC;AAGxD,MAAM,MAAM,wBAAwB,GAAG;IACrC,OAAO,EAAE,MAAM,CAAC;IAChB,MAAM,CAAC,EAAE,MAAM,CAAC;IAChB,YAAY,EAAE,MAAM,CAAC;IACrB,WAAW,CAAC,EAAE,MAAM,EAAE,CAAC;IACvB,SAAS,CAAC,EAAE,MAAM,CAAC;IACnB,OAAO,CAAC,EAAE;QACR,MAAM,CAAC,EAAE,MAAM,CAAC;QAChB,IAAI,CAAC,EAAE,MAAM,CAAC;QACd,MAAM,CAAC,EAAE,OAAO,CAAC;QACjB,QAAQ,CAAC,EAAE,QAAQ,GAAG,KAAK,GAAG,MAAM,CAAC;KACtC,CAAC;CACH,CAAC;AAIF,wBAAgB,uBAAuB,CAAC,OAAO,EAAE,wBAAwB,IAiB/B,SAAS,WAAW,oCA4F7D"}

package/dist/proxy.js

@@ -0,0 +1,117 @@
+import { NextResponse } from 'next/server';
+import { jwtVerify, importSPKI } from 'jose';
+let publicKey = null;
+export function createACPAuthMiddleware(options) {
+    const { baseUrl, apiKey, jwtPublicKey, publicPaths = ['/login', '/register', '/forgot-password', '/reset-password', '/verify-email', '/verify-2fa'], loginPath = '/login', cookies: cookieConfig = {}, } = options;
+    const { domain: cookieDomain, path: cookiePath = '/', secure = process.env.NODE_ENV === 'production', sameSite = 'lax', } = cookieConfig;
+    return async function acpAuthMiddleware(request) {
+        const { pathname } = request.nextUrl;
+        // Allow public paths
+        if (publicPaths.some((path) => pathname.startsWith(path))) {
+            return NextResponse.next();
+        }
+        // Allow API routes (they handle their own auth)
+        if (pathname.startsWith('/api/')) {
+            return NextResponse.next();
+        }
+        // Check for access token
+        const accessToken = request.cookies.get('access_token')?.value;
+        const refreshToken = request.cookies.get('refresh_token')?.value;
+        // If no access token, try to refresh
+        if (!accessToken) {
+            if (!refreshToken) {
+                // No tokens at all, redirect to login
+                const url = request.nextUrl.clone();
+                url.pathname = loginPath;
+                url.searchParams.set('from', pathname);
+                return NextResponse.redirect(url);
+            }
+            // Try to refresh
+            const newAccessToken = await tryRefresh(baseUrl, apiKey, refreshToken);
+            if (!newAccessToken) {
+                // Refresh failed, redirect to login
+                const url = request.nextUrl.clone();
+                url.pathname = loginPath;
+                url.searchParams.set('from', pathname);
+                return NextResponse.redirect(url);
+            }
+            // Set new access token cookie and continue
+            const response = NextResponse.next();
+            response.cookies.set('access_token', newAccessToken, {
+                httpOnly: true,
+                secure,
+                sameSite,
+                maxAge: 60 * 5, // 5 minutes
+                path: cookiePath,
+                ...(cookieDomain && { domain: cookieDomain }),
+            });
+            return response;
+        }
+        // Verify access token
+        try {
+            if (!publicKey) {
+                publicKey = await importSPKI(jwtPublicKey, 'EdDSA');
+            }
+            await jwtVerify(accessToken, publicKey, {
+                algorithms: ['EdDSA'],
+            });
+            return NextResponse.next();
+        }
+        catch {
+            // Token invalid or expired, try to refresh
+            if (!refreshToken) {
+                const url = request.nextUrl.clone();
+                url.pathname = loginPath;
+                url.searchParams.set('from', pathname);
+                return NextResponse.redirect(url);
+            }
+            const newAccessToken = await tryRefresh(baseUrl, apiKey, refreshToken);
+            if (!newAccessToken) {
+                // Refresh failed, redirect to login
+                const url = request.nextUrl.clone();
+                url.pathname = loginPath;
+                url.searchParams.set('from', pathname);
+                return NextResponse.redirect(url);
+            }
+            // Set new access token cookie and continue
+            const response = NextResponse.next();
+            response.cookies.set('access_token', newAccessToken, {
+                httpOnly: true,
+                secure,
+                sameSite,
+                maxAge: 60 * 5, // 5 minutes
+                path: cookiePath,
+                ...(cookieDomain && { domain: cookieDomain }),
+            });
+            return response;
+        }
+    };
+}
+async function tryRefresh(baseUrl, apiKey, refreshToken) {
+    try {
+        const response = await fetch(`${baseUrl}/refresh`, {
+            method: 'POST',
+            headers: {
+                'Content-Type': 'application/json',
+                ...(apiKey ? { 'X-API-Key': apiKey } : {}),
+                Cookie: `refresh_token=${refreshToken}`,
+            },
+        });
+        if (!response.ok) {
+            console.error('[ACP Auth Middleware] Refresh failed:', response.status);
+            return null;
+        }
+        const data = await response.json();
+        if (!data.success || !data.data?.accessToken) {
+            console.error('[ACP Auth Middleware] Invalid refresh response');
+            return null;
+        }
+        console.log('[ACP Auth Middleware] Token refreshed successfully');
+        return data.data.accessToken;
+    }
+    catch (error) {
+        console.error('[ACP Auth Middleware] Refresh error:', error);
+        return null;
+    }
+}
+//# sourceMappingURL=proxy.js.map

package/dist/proxy.js.map

@@ -0,0 +1 @@
+{"version":3,"file":"proxy.js","sourceRoot":"","sources":["../src/proxy.ts"],"names":[],"mappings":"AAAA,OAAO,EAAe,YAAY,EAAE,MAAM,aAAa,CAAC;AACxD,OAAO,EAAE,SAAS,EAAE,UAAU,EAAgB,MAAM,MAAM,CAAC;AAgB3D,IAAI,SAAS,GAAmB,IAAI,CAAC;AAErC,MAAM,UAAU,uBAAuB,CAAC,OAAiC;IACvE,MAAM,EACJ,OAAO,EACP,MAAM,EACN,YAAY,EACZ,WAAW,GAAG,CAAC,QAAQ,EAAE,WAAW,EAAE,kBAAkB,EAAE,iBAAiB,EAAE,eAAe,EAAE,aAAa,CAAC,EAC5G,SAAS,GAAG,QAAQ,EACpB,OAAO,EAAE,YAAY,GAAG,EAAE,GAC3B,GAAG,OAAO,CAAC;IAEZ,MAAM,EACJ,MAAM,EAAE,YAAY,EACpB,IAAI,EAAE,UAAU,GAAG,GAAG,EACtB,MAAM,GAAG,OAAO,CAAC,GAAG,CAAC,QAAQ,KAAK,YAAY,EAC9C,QAAQ,GAAG,KAAK,GACjB,GAAG,YAAY,CAAC;IAEjB,OAAO,KAAK,UAAU,iBAAiB,CAAC,OAAoB;QAC1D,MAAM,EAAE,QAAQ,EAAE,GAAG,OAAO,CAAC,OAAO,CAAC;QAErC,qBAAqB;QACrB,IAAI,WAAW,CAAC,IAAI,CAAC,CAAC,IAAI,EAAE,EAAE,CAAC,QAAQ,CAAC,UAAU,CAAC,IAAI,CAAC,CAAC,EAAE,CAAC;YAC1D,OAAO,YAAY,CAAC,IAAI,EAAE,CAAC;QAC7B,CAAC;QAED,gDAAgD;QAChD,IAAI,QAAQ,CAAC,UAAU,CAAC,OAAO,CAAC,EAAE,CAAC;YACjC,OAAO,YAAY,CAAC,IAAI,EAAE,CAAC;QAC7B,CAAC;QAED,yBAAyB;QACzB,MAAM,WAAW,GAAG,OAAO,CAAC,OAAO,CAAC,GAAG,CAAC,cAAc,CAAC,EAAE,KAAK,CAAC;QAC/D,MAAM,YAAY,GAAG,OAAO,CAAC,OAAO,CAAC,GAAG,CAAC,eAAe,CAAC,EAAE,KAAK,CAAC;QAEjE,qCAAqC;QACrC,IAAI,CAAC,WAAW,EAAE,CAAC;YACjB,IAAI,CAAC,YAAY,EAAE,CAAC;gBAClB,sCAAsC;gBACtC,MAAM,GAAG,GAAG,OAAO,CAAC,OAAO,CAAC,KAAK,EAAE,CAAC;gBACpC,GAAG,CAAC,QAAQ,GAAG,SAAS,CAAC;gBACzB,GAAG,CAAC,YAAY,CAAC,GAAG,CAAC,MAAM,EAAE,QAAQ,CAAC,CAAC;gBACvC,OAAO,YAAY,CAAC,QAAQ,CAAC,GAAG,CAAC,CAAC;YACpC,CAAC;YAED,iBAAiB;YACjB,MAAM,cAAc,GAAG,MAAM,UAAU,CAAC,OAAO,EAAE,MAAM,EAAE,YAAY,CAAC,CAAC;YACvE,IAAI,CAAC,cAAc,EAAE,CAAC;gBACpB,oCAAoC;gBACpC,MAAM,GAAG,GAAG,OAAO,CAAC,OAAO,CAAC,KAAK,EAAE,CAAC;gBACpC,GAAG,CAAC,QAAQ,GAAG,SAAS,CAAC;gBACzB,GAAG,CAAC,YAAY,CAAC,GAAG,CAAC,MAAM,EAAE,QAAQ,CAAC,CAAC;gBACvC,OAAO,YAAY,CAAC,QAAQ,CAAC,GAAG,CAAC,CAAC;YACpC,CAAC;YAED,2CAA2C;YAC3C,MAAM,QAAQ,GAAG,YAAY,CAAC,IAAI,EAAE,CAAC;YACrC,QAAQ,CAAC,OAAO,CAAC,GAAG,CAAC,cAAc,EAAE,cAAc,EAAE;gBACnD,QAAQ,EAAE,IAAI;gBACd,MAAM;gBACN,QAAQ;gBACR,MAAM,EAAE,EAAE,GAAG,CAAC,EAAE,YAAY;gBAC5B,IAAI,EAAE,UAAU;gBAChB,GAAG,CAAC,YAAY,IAAI,EAAE,MAAM,EAAE,YAAY,EAAE,CAAC;aAC9C,CAAC,CAAC;YACH,OAAO,QAAQ,CAAC;QAClB,CAAC;QAED,sBAAsB;QACtB,IAAI,CAAC;YACH,IAAI,CAAC,SAAS,EAAE,CAAC;gBACf,SAAS,GAAG,MAAM,UAAU,CAAC,YAAY,EAAE,OAAO,CAAC,CAAC;YACtD,CAAC;YAED,MAAM,SAAS,CAAC,WAAW,EAAE,SAAS,EAAE;gBACtC,UAAU,EAAE,CAAC,OAAO,CAAC;aACtB,CAAC,CAAC;YAEH,OAAO,YAAY,CAAC,IAAI,EAAE,CAAC;QAC7B,CAAC;QAAC,MAAM,CAAC;YACP,2CAA2C;YAC3C,IAAI,CAAC,YAAY,EAAE,CAAC;gBAClB,MAAM,GAAG,GAAG,OAAO,CAAC,OAAO,CAAC,KAAK,EAAE,CAAC;gBACpC,GAAG,CAAC,QAAQ,GAAG,SAAS,CAAC;gBACzB,GAAG,CAAC,YAAY,CAAC,GAAG,CAAC,MAAM,EAAE,QAAQ,CAAC,CAAC;gBACvC,OAAO,YAAY,CAAC,QAAQ,CAAC,GAAG,CAAC,CAAC;YACpC,CAAC;YAED,MAAM,cAAc,GAAG,MAAM,UAAU,CAAC,OAAO,EAAE,MAAM,EAAE,YAAY,CAAC,CAAC;YACvE,IAAI,CAAC,cAAc,EAAE,CAAC;gBACpB,oCAAoC;gBACpC,MAAM,GAAG,GAAG,OAAO,CAAC,OAAO,CAAC,KAAK,EAAE,CAAC;gBACpC,GAAG,CAAC,QAAQ,GAAG,SAAS,CAAC;gBACzB,GAAG,CAAC,YAAY,CAAC,GAAG,CAAC,MAAM,EAAE,QAAQ,CAAC,CAAC;gBACvC,OAAO,YAAY,CAAC,QAAQ,CAAC,GAAG,CAAC,CAAC;YACpC,CAAC;YAED,2CAA2C;YAC3C,MAAM,QAAQ,GAAG,YAAY,CAAC,IAAI,EAAE,CAAC;YACrC,QAAQ,CAAC,OAAO,CAAC,GAAG,CAAC,cAAc,EAAE,cAAc,EAAE;gBACnD,QAAQ,EAAE,IAAI;gBACd,MAAM;gBACN,QAAQ;gBACR,MAAM,EAAE,EAAE,GAAG,CAAC,EAAE,YAAY;gBAC5B,IAAI,EAAE,UAAU;gBAChB,GAAG,CAAC,YAAY,IAAI,EAAE,MAAM,EAAE,YAAY,EAAE,CAAC;aAC9C,CAAC,CAAC;YACH,OAAO,QAAQ,CAAC;QAClB,CAAC;IACH,CAAC,CAAC;AACJ,CAAC;AAED,KAAK,UAAU,UAAU,CACvB,OAAe,EACf,MAA0B,EAC1B,YAAoB;IAEpB,IAAI,CAAC;QACH,MAAM,QAAQ,GAAG,MAAM,KAAK,CAAC,GAAG,OAAO,UAAU,EAAE;YACjD,MAAM,EAAE,MAAM;YACd,OAAO,EAAE;gBACP,cAAc,EAAE,kBAAkB;gBAClC,GAAG,CAAC,MAAM,CAAC,CAAC,CAAC,EAAE,WAAW,EAAE,MAAM,EAAE,CAAC,CAAC,CAAC,EAAE,CAAC;gBAC1C,MAAM,EAAE,iBAAiB,YAAY,EAAE;aACxC;SACF,CAAC,CAAC;QAEH,IAAI,CAAC,QAAQ,CAAC,EAAE,EAAE,CAAC;YACjB,OAAO,CAAC,KAAK,CAAC,uCAAuC,EAAE,QAAQ,CAAC,MAAM,CAAC,CAAC;YACxE,OAAO,IAAI,CAAC;QACd,CAAC;QAED,MAAM,IAAI,GAAG,MAAM,QAAQ,CAAC,IAAI,EAAE,CAAC;QACnC,IAAI,CAAC,IAAI,CAAC,OAAO,IAAI,CAAC,IAAI,CAAC,IAAI,EAAE,WAAW,EAAE,CAAC;YAC7C,OAAO,CAAC,KAAK,CAAC,gDAAgD,CAAC,CAAC;YAChE,OAAO,IAAI,CAAC;QACd,CAAC;QAED,OAAO,CAAC,GAAG,CAAC,oDAAoD,CAAC,CAAC;QAClE,OAAO,IAAI,CAAC,IAAI,CAAC,WAAW,CAAC;IAC/B,CAAC;IAAC,OAAO,KAAK,EAAE,CAAC;QACf,OAAO,CAAC,KAAK,CAAC,sCAAsC,EAAE,KAAK,CAAC,CAAC;QAC7D,OAAO,IAAI,CAAC;IACd,CAAC;AACH,CAAC"}

package/package.json

@@ -1,6 +1,6 @@
 {
   "name": "@artatol-acp/auth-nextjs",
-  "version": "0.5.4",
+  "version": "0.5.6",
   "description": "Next.js SDK for Artatol Cloud Platform Authentication with support for App Router, Server Actions, and Middleware",
   "type": "module",
   "main": "./dist/index.js",
@@ -25,6 +25,10 @@
     "./middleware": {
       "import": "./dist/middleware.js",
       "types": "./dist/middleware.d.ts"
+    },
+    "./proxy": {
+      "import": "./dist/proxy.js",
+      "types": "./dist/proxy.d.ts"
     }
   },
   "files": [