@atlasauth/nextjs 0.3.0 → 0.4.0

package/CHANGELOG.md

@@ -1,5 +1,11 @@
 # @atlasauth/nextjs changelog
 
+## 0.4.0 — 2026-10-23
+
+### Added
+
+- `withAccessToken(options, handler)`: wrap an App Router route handler so it runs only for a request with an Atlas-issued OAuth access token for your API (audience, scopes, DPoP); anything else gets 401/403 with the `WWW-Authenticate` challenge. Re-exports `createAccessTokenVerifier`, `protectedResourceMetadata`, `protectedResourceMetadataPath`.
+
 ## 0.3.0
 ### Added
 - **`getAtlasInitialState(options?)`** in `@atlasauth/nextjs/server` → `Promise<AtlasInitialState>`: the instance's

package/dist/access-token.d.ts

@@ -0,0 +1,16 @@
+import { type AccessTokenClaims, type AccessTokenVerifierOptions } from '@atlasauth/backend';
+export { createAccessTokenVerifier, protectedResourceMetadata, protectedResourceMetadataPath, type AccessTokenClaims, type AccessTokenResult, type AccessTokenVerifierOptions, } from '@atlasauth/backend';
+/** The verified token handed to a {@link withAccessToken} route handler. */
+export interface VerifiedAccessToken {
+    claims: AccessTokenClaims;
+    subject: string;
+    clientId: string | null;
+    scopes: string[];
+}
+/**
+ * Wrap a Next.js route handler (App Router, any runtime) so it only runs for a
+ * request carrying an Atlas-issued OAuth access token for YOUR API (audience,
+ * scopes, DPoP when bound). Anything else gets 401/403 with the RFC 6750 /
+ * RFC 9728 `WWW-Authenticate` challenge — what an MCP client needs to sign in.
+ */
+export declare function withAccessToken<Ctx = unknown>(options: AccessTokenVerifierOptions, handler: (request: Request, token: VerifiedAccessToken, ctx: Ctx) => Response | Promise<Response>): (request: Request, ctx: Ctx) => Promise<Response>;

package/dist/access-token.js

@@ -0,0 +1,29 @@
+"use strict";
+Object.defineProperty(exports, "__esModule", { value: true });
+exports.protectedResourceMetadataPath = exports.protectedResourceMetadata = exports.createAccessTokenVerifier = void 0;
+exports.withAccessToken = withAccessToken;
+const backend_1 = require("@atlasauth/backend");
+var backend_2 = require("@atlasauth/backend");
+Object.defineProperty(exports, "createAccessTokenVerifier", { enumerable: true, get: function () { return backend_2.createAccessTokenVerifier; } });
+Object.defineProperty(exports, "protectedResourceMetadata", { enumerable: true, get: function () { return backend_2.protectedResourceMetadata; } });
+Object.defineProperty(exports, "protectedResourceMetadataPath", { enumerable: true, get: function () { return backend_2.protectedResourceMetadataPath; } });
+/**
+ * Wrap a Next.js route handler (App Router, any runtime) so it only runs for a
+ * request carrying an Atlas-issued OAuth access token for YOUR API (audience,
+ * scopes, DPoP when bound). Anything else gets 401/403 with the RFC 6750 /
+ * RFC 9728 `WWW-Authenticate` challenge — what an MCP client needs to sign in.
+ */
+function withAccessToken(options, handler) {
+    const verify = (0, backend_1.createAccessTokenVerifier)(options);
+    return async (request, ctx) => {
+        const result = await verify({ method: request.method, url: request.url, headers: request.headers });
+        if (!result.ok) {
+            return new Response(JSON.stringify(result.error ? { error: result.error, error_description: result.description } : { error: 'unauthorized' }), {
+                status: result.status,
+                headers: { 'content-type': 'application/json', 'www-authenticate': result.wwwAuthenticate },
+            });
+        }
+        return handler(request, { claims: result.claims, subject: result.subject, clientId: result.clientId, scopes: result.scopes }, ctx);
+    };
+}
+//# sourceMappingURL=access-token.js.map

package/dist/access-token.js.map

@@ -0,0 +1 @@
+{"version":3,"file":"access-token.js","sourceRoot":"","sources":["../src/access-token.ts"],"names":[],"mappings":";;;AA6BA,0CAwBC;AArDD,gDAI4B;AAE5B,8CAO4B;AAN1B,oHAAA,yBAAyB,OAAA;AACzB,oHAAA,yBAAyB,OAAA;AACzB,wHAAA,6BAA6B,OAAA;AAc/B;;;;;GAKG;AACH,SAAgB,eAAe,CAC7B,OAAmC,EACnC,OAAiG;IAEjG,MAAM,MAAM,GAAG,IAAA,mCAAyB,EAAC,OAAO,CAAC,CAAC;IAClD,OAAO,KAAK,EAAE,OAAO,EAAE,GAAG,EAAE,EAAE;QAC5B,MAAM,MAAM,GAAG,MAAM,MAAM,CAAC,EAAE,MAAM,EAAE,OAAO,CAAC,MAAM,EAAE,GAAG,EAAE,OAAO,CAAC,GAAG,EAAE,OAAO,EAAE,OAAO,CAAC,OAAO,EAAE,CAAC,CAAC;QACpG,IAAI,CAAC,MAAM,CAAC,EAAE,EAAE,CAAC;YACf,OAAO,IAAI,QAAQ,CACjB,IAAI,CAAC,SAAS,CACZ,MAAM,CAAC,KAAK,CAAC,CAAC,CAAC,EAAE,KAAK,EAAE,MAAM,CAAC,KAAK,EAAE,iBAAiB,EAAE,MAAM,CAAC,WAAW,EAAE,CAAC,CAAC,CAAC,EAAE,KAAK,EAAE,cAAc,EAAE,CAC1G,EACD;gBACE,MAAM,EAAE,MAAM,CAAC,MAAM;gBACrB,OAAO,EAAE,EAAE,cAAc,EAAE,kBAAkB,EAAE,kBAAkB,EAAE,MAAM,CAAC,eAAe,EAAE;aAC5F,CACF,CAAC;QACJ,CAAC;QACD,OAAO,OAAO,CACZ,OAAO,EACP,EAAE,MAAM,EAAE,MAAM,CAAC,MAAM,EAAE,OAAO,EAAE,MAAM,CAAC,OAAO,EAAE,QAAQ,EAAE,MAAM,CAAC,QAAQ,EAAE,MAAM,EAAE,MAAM,CAAC,MAAM,EAAE,EACpG,GAAG,CACJ,CAAC;IACJ,CAAC,CAAC;AACJ,CAAC"}

package/dist/index.d.ts

@@ -1,3 +1,4 @@
 export * from './matcher';
 export * from './middleware';
 export * from './proxy';
+export * from './access-token';

package/dist/index.js

@@ -17,4 +17,5 @@ Object.defineProperty(exports, "__esModule", { value: true });
 __exportStar(require("./matcher"), exports);
 __exportStar(require("./middleware"), exports);
 __exportStar(require("./proxy"), exports);
+__exportStar(require("./access-token"), exports);
 //# sourceMappingURL=index.js.map

package/dist/index.js.map

@@ -1 +1 @@
-{"version":3,"file":"index.js","sourceRoot":"","sources":["../src/index.ts"],"names":[],"mappings":";;;;;;;;;;;;;;;;AAAA,4CAA0B;AAC1B,+CAA6B;AAC7B,0CAAwB"}
+{"version":3,"file":"index.js","sourceRoot":"","sources":["../src/index.ts"],"names":[],"mappings":";;;;;;;;;;;;;;;;AAAA,4CAA0B;AAC1B,+CAA6B;AAC7B,0CAAwB;AACxB,iDAA+B"}

package/package.json

@@ -1,6 +1,6 @@
 {
   "name": "@atlasauth/nextjs",
-  "version": "0.3.0",
+  "version": "0.4.0",
   "main": "./dist/index.js",
   "types": "./dist/index.d.ts",
   "exports": {
@@ -15,7 +15,7 @@
     "./package.json": "./package.json"
   },
   "dependencies": {
-    "@atlasauth/backend": "0.7.3"
+    "@atlasauth/backend": "0.15.0"
   },
   "peerDependencies": {
     "next": ">=13.4"