@auditauth/next 0.1.0

package/LICENSE

@@ -0,0 +1,21 @@
+MIT License
+
+Copyright (c) 2026 Nimibyte
+
+Permission is hereby granted, free of charge, to any person obtaining a copy
+of this software and associated documentation files (the "Software"), to deal
+in the Software without restriction, including without limitation the rights
+to use, copy, modify, merge, publish, distribute, sublicense, and/or sell
+copies of the Software, and to permit persons to whom the Software is
+furnished to do so, subject to the following conditions:
+
+The above copyright notice and this permission notice shall be included in all
+copies or substantial portions of the Software.
+
+THE SOFTWARE IS PROVIDED "AS IS", WITHOUT WARRANTY OF ANY KIND, EXPRESS OR
+IMPLIED, INCLUDING BUT NOT LIMITED TO THE WARRANTIES OF MERCHANTABILITY,
+FITNESS FOR A PARTICULAR PURPOSE AND NONINFRINGEMENT. IN NO EVENT SHALL THE
+AUTHORS OR COPYRIGHT HOLDERS BE LIABLE FOR ANY CLAIM, DAMAGES OR OTHER
+LIABILITY, WHETHER IN AN ACTION OF CONTRACT, TORT OR OTHERWISE, ARISING FROM,
+OUT OF OR IN CONNECTION WITH THE SOFTWARE OR THE USE OR OTHER DEALINGS IN THE
+SOFTWARE.

package/README.md

@@ -0,0 +1,3 @@
+# @auditauth/next
+
+Official AuditAuth SDK for Next.js (App Router).

package/dist/guard.d.ts

@@ -0,0 +1,10 @@
+import { SessionUser } from "./types";
+type AuthContextValue = {
+    user: SessionUser | null;
+};
+declare const useAuditAuth: () => AuthContextValue;
+type AuditAuthGuardProps = {
+    children: React.ReactNode;
+};
+declare const AuditAuthGuard: (props: AuditAuthGuardProps) => import("react/jsx-runtime").JSX.Element | null;
+export { AuditAuthGuard, useAuditAuth };

package/dist/guard.js

@@ -0,0 +1,49 @@
+'use client';
+import { jsx as _jsx } from "react/jsx-runtime";
+import { createContext, useContext, useEffect, useMemo, useState } from "react";
+import { SETTINGS } from "./settings";
+const AuthContext = createContext(null);
+const useAuditAuth = () => {
+    const ctx = useContext(AuthContext);
+    if (!ctx) {
+        throw new Error('useAuditAuth must be used within AuditAuthProvider');
+    }
+    return ctx;
+};
+const AuditAuthGuard = (props) => {
+    const [user, setUser] = useState(null);
+    useEffect(() => {
+        let cancelled = false;
+        const checkSession = async () => {
+            try {
+                const response = await fetch(SETTINGS.bff.paths.session, {
+                    credentials: 'include',
+                    cache: 'no-store',
+                });
+                if (cancelled)
+                    return;
+                if (!response.ok) {
+                    window.location.href = SETTINGS.bff.paths.login;
+                    return;
+                }
+                const data = await response.json();
+                setUser(data.user);
+            }
+            catch {
+                window.location.href = SETTINGS.bff.paths.login;
+                return;
+            }
+        };
+        checkSession();
+        return () => {
+            cancelled = true;
+        };
+    }, []);
+    const value = useMemo(() => ({
+        user,
+    }), [user]);
+    if (!user)
+        return null;
+    return (_jsx(AuthContext.Provider, { value: value, children: props.children }));
+};
+export { AuditAuthGuard, useAuditAuth };

package/dist/index.d.ts

@@ -0,0 +1,3 @@
+export { AuditAuthNext, goToPortal, login, logout } from './sdk';
+export { AuditAuthGuard, useAuditAuth } from './guard';
+export type * from './types';

package/dist/index.js

@@ -0,0 +1,2 @@
+export { AuditAuthNext, goToPortal, login, logout } from './sdk';
+export { AuditAuthGuard, useAuditAuth } from './guard';

package/dist/sdk.d.ts

@@ -0,0 +1,48 @@
+import { NextRequest, NextResponse } from "next/server";
+import { AuditAuthConfig, CookieAdapter, Metric, SessionUser } from "./types";
+declare class AuditAuthNext {
+    private config;
+    private cookies;
+    constructor(config: AuditAuthConfig, cookies: CookieAdapter);
+    private verifyAccessToken;
+    private getCookieTokens;
+    private setCookieTokens;
+    getSession(): SessionUser | null;
+    hasSession(): boolean;
+    private buildAuthUrl;
+    callback(request: NextRequest): Promise<{
+        ok: boolean;
+        url: string;
+    }>;
+    logout(): Promise<void>;
+    getPortalUrl(): Promise<{
+        ok: boolean;
+        url: null;
+        reason: string;
+    } | {
+        ok: boolean;
+        url: string;
+        reason: null;
+    }>;
+    private refresh;
+    request(path: string, init?: RequestInit): Promise<Response>;
+    private pushMetric;
+    middleware(_request: NextRequest): Promise<NextResponse<unknown>>;
+    getHandlers(): {
+        GET: (req: NextRequest, ctx: {
+            params: Promise<{
+                auditauth: string[];
+            }>;
+        }) => Promise<Response>;
+        POST: (req: Request, ctx: {
+            params: Promise<{
+                auditauth: string[];
+            }>;
+        }) => Promise<Response>;
+    };
+    metrics(payload: Metric): Promise<Response>;
+}
+declare const login: () => void;
+declare const logout: () => void;
+declare const goToPortal: () => void;
+export { AuditAuthNext, login, logout, goToPortal };

package/dist/sdk.js

@@ -0,0 +1,298 @@
+import { NextResponse } from "next/server";
+import { importSPKI, jwtVerify } from 'jose';
+import { SETTINGS } from "./settings";
+/* -------------------------------------------------------------------------- */
+/*                                    KEYS                                    */
+/* -------------------------------------------------------------------------- */
+let cachedKey = null;
+/* -------------------------------------------------------------------------- */
+/*                               MAIN CLASS                                   */
+/* -------------------------------------------------------------------------- */
+class AuditAuthNext {
+    constructor(config, cookies) {
+        if (!cookies.get || !cookies.set) {
+            throw new Error('Missing cookie adapter');
+        }
+        this.config = config;
+        this.cookies = cookies;
+    }
+    /* ------------------------------------------------------------------------ */
+    /*                             AUTH PRIMITIVES                               */
+    /* ------------------------------------------------------------------------ */
+    async verifyAccessToken(token) {
+        try {
+            cachedKey =
+                cachedKey ||
+                    await importSPKI(SETTINGS.jwt_public_key, 'RS256');
+            await jwtVerify(token, cachedKey, {
+                issuer: SETTINGS.jwt_issuer,
+                audience: this.config.appId,
+            });
+            return true;
+        }
+        catch {
+            return false;
+        }
+    }
+    getCookieTokens() {
+        return {
+            access: this.cookies.get(SETTINGS.cookies.access.name),
+            refresh: this.cookies.get(SETTINGS.cookies.refresh.name),
+        };
+    }
+    setCookieTokens(tokens) {
+        this.cookies.set(SETTINGS.cookies.access.name, tokens.at, SETTINGS.cookies.access.config);
+        this.cookies.set(SETTINGS.cookies.refresh.name, tokens.rt, SETTINGS.cookies.refresh.config);
+    }
+    /* ------------------------------------------------------------------------ */
+    /*                              SESSION HELPERS                              */
+    /* ------------------------------------------------------------------------ */
+    getSession() {
+        return JSON.parse(this.cookies.get(SETTINGS.cookies.session.name) || '{}')?.user || null;
+    }
+    hasSession() {
+        return !!this.cookies.get(SETTINGS.cookies.session.name);
+    }
+    /* ------------------------------------------------------------------------ */
+    /*                              AUTH FLOWS                                   */
+    /* ------------------------------------------------------------------------ */
+    async buildAuthUrl() {
+        const response = await fetch(`${SETTINGS.domains.api}/apps/login`, {
+            method: 'POST',
+            headers: { 'x-api-key': this.config.apiKey },
+        });
+        if (!response.ok) {
+            throw new Error('invalid_app');
+        }
+        const { code, redirectUrl } = await response.json();
+        const url = new URL(redirectUrl);
+        url.searchParams.set('code', code);
+        return url;
+    }
+    async callback(request) {
+        const code = new URL(request.url).searchParams.get('code');
+        if (!code) {
+            return {
+                ok: false,
+                url: `${SETTINGS.domains.client}/auth/invalid?reason=wrong_config`,
+            };
+        }
+        const response = await fetch(`${SETTINGS.domains.api}/auth/authorize`, {
+            method: 'POST',
+            headers: { 'Content-Type': 'application/json' },
+            body: JSON.stringify({ code, client_type: 'server' }),
+        });
+        if (!response.ok) {
+            return {
+                ok: false,
+                url: `${SETTINGS.domains.client}/auth/invalid?reason=unauthorized`,
+            };
+        }
+        const result = await response.json();
+        const session = {
+            user: {
+                _id: result.user._id.toString(),
+                email: result.user.email,
+                avatar: result.user.avatar,
+                name: result.user.name,
+            },
+        };
+        this.cookies.set(SETTINGS.cookies.session.name, JSON.stringify(session), SETTINGS.cookies.session.config);
+        this.setCookieTokens({
+            at: result.access_token,
+            rt: result.refresh_token,
+        });
+        return { ok: true, url: this.config.redirectUrl };
+    }
+    async logout() {
+        const { access } = this.getCookieTokens();
+        if (access) {
+            await fetch(`${SETTINGS.domains.api}/auth/revoke`, {
+                method: 'GET',
+                headers: { Authorization: `Bearer ${access}` },
+            }).catch(() => { });
+        }
+        this.cookies.remove(SETTINGS.cookies.access.name);
+        this.cookies.remove(SETTINGS.cookies.refresh.name);
+        this.cookies.remove(SETTINGS.cookies.session.name);
+    }
+    async getPortalUrl() {
+        const { access } = this.getCookieTokens();
+        const res = await fetch(`${SETTINGS.domains.api}/portal/exchange`, {
+            method: 'GET',
+            headers: {
+                Authorization: `Bearer ${access}`,
+            },
+        });
+        if (!res.ok && res.status === 401) {
+            return { ok: false, url: null, reason: 'unathorized' };
+        }
+        else if (!res.ok) {
+            return { ok: false, url: null, reason: 'fail' };
+        }
+        const body = await res.json();
+        return { ok: true, url: `${body.redirectUrl}?code=${body.code}&redirectUrl=${this.config.redirectUrl}`, reason: null };
+    }
+    /* ------------------------------------------------------------------------ */
+    /*                              REFRESH FLOW                                 */
+    /* ------------------------------------------------------------------------ */
+    async refresh(refreshToken) {
+        try {
+            const response = await fetch(`${SETTINGS.domains.api}/auth/refresh`, {
+                method: 'POST',
+                headers: { 'Content-Type': 'application/json' },
+                body: JSON.stringify({
+                    refresh_token: refreshToken,
+                    client_type: 'server',
+                }),
+            });
+            if (!response.ok)
+                return null;
+            return response.json();
+        }
+        catch {
+            return null;
+        }
+    }
+    /* ------------------------------------------------------------------------ */
+    /*                         REQUEST WITH AUTO-REFRESH                         */
+    /* ------------------------------------------------------------------------ */
+    async request(path, init = {}) {
+        const { access, refresh } = this.getCookieTokens();
+        const doFetch = (token) => fetch(`${this.config.requestUrl}${path}`, {
+            ...init,
+            headers: {
+                ...init.headers,
+                ...(token ? { Authorization: `Bearer ${token}` } : {}),
+            },
+        });
+        const start = performance.now();
+        let res = await doFetch(access);
+        // Attempt refresh once on 401
+        if (res.status === 401 && refresh) {
+            const data = await this.refresh(refresh);
+            if (data?.access_token && data?.refresh_token) {
+                this.setCookieTokens({
+                    at: data.access_token,
+                    rt: data.refresh_token,
+                });
+                res = await doFetch(data.access_token);
+            }
+        }
+        this.pushMetric({
+            event_type: 'request',
+            runtime: 'server',
+            target: {
+                type: 'api',
+                method: init.method || 'GET',
+                path,
+                status: res.status,
+                duration_ms: Math.round(performance.now() - start),
+            },
+        });
+        return res;
+    }
+    /* ------------------------------------------------------------------------ */
+    /*                                METRICS                                    */
+    /* ------------------------------------------------------------------------ */
+    pushMetric(payload) {
+        let sid = this.cookies.get(SETTINGS.cookies.session_id.name);
+        if (!sid) {
+            sid = 's_' + crypto.randomUUID();
+            this.cookies.set(SETTINGS.cookies.session_id.name, sid, SETTINGS.cookies.session_id.config);
+        }
+        queueMicrotask(() => {
+            fetch(`${this.config.baseUrl}${SETTINGS.bff.paths.metrics}`, {
+                method: 'POST',
+                headers: { 'Content-Type': 'application/json' },
+                body: JSON.stringify({ ...payload, session_id: sid }),
+            }).catch(() => { });
+        });
+    }
+    /* ------------------------------------------------------------------------ */
+    /*                               MIDDLEWARE                                  */
+    /* ------------------------------------------------------------------------ */
+    async middleware(_request) {
+        const { access, refresh } = this.getCookieTokens();
+        if (access && await this.verifyAccessToken(access)) {
+            return NextResponse.next();
+        }
+        if (refresh) {
+            const data = await this.refresh(refresh);
+            if (data?.access_token && data?.refresh_token) {
+                this.setCookieTokens({
+                    at: data.access_token,
+                    rt: data.refresh_token,
+                });
+            }
+        }
+        return NextResponse.next();
+    }
+    /* ------------------------------------------------------------------------ */
+    /*                               BFF HANDLERS                                */
+    /* ------------------------------------------------------------------------ */
+    getHandlers() {
+        return {
+            GET: async (req, ctx) => {
+                const action = (await ctx.params).auditauth[0];
+                switch (action) {
+                    case 'login':
+                        return NextResponse.redirect(await this.buildAuthUrl());
+                    case 'callback': {
+                        const result = await this.callback(req);
+                        return NextResponse.redirect(result.url);
+                    }
+                    case 'logout':
+                        await this.logout();
+                        return NextResponse.redirect(this.config.redirectUrl);
+                    case 'portal': {
+                        const result = await this.getPortalUrl();
+                        return result.ok && result.url
+                            ? NextResponse.redirect(result.url)
+                            : NextResponse.redirect(`${SETTINGS.domains.client}/auth/invalid`);
+                    }
+                    case 'session': {
+                        const user = this.getSession();
+                        if (!user)
+                            return new NextResponse(null, { status: 401 });
+                        return NextResponse.json({ user });
+                    }
+                    default:
+                        return new Response('not found', { status: 404 });
+                }
+            },
+            POST: async (req, ctx) => {
+                const action = (await ctx.params).auditauth[0];
+                if (action === 'metrics') {
+                    return this.metrics(await req.json());
+                }
+                return new Response('not found', { status: 404 });
+            },
+        };
+    }
+    async metrics(payload) {
+        await fetch(`${SETTINGS.domains.api}/metrics`, {
+            method: 'POST',
+            headers: {
+                'Content-Type': 'application/json',
+                'x-auditauth-app': this.config.appId,
+                'x-auditauth-key': this.config.apiKey,
+            },
+            body: JSON.stringify(payload),
+        });
+        return new Response(null, { status: 204 });
+    }
+}
+/* -------------------------------------------------------------------------- */
+/*                             CLIENT SHORTCUTS                               */
+/* -------------------------------------------------------------------------- */
+const login = () => {
+    window.location.href = SETTINGS.bff.paths.login;
+};
+const logout = () => {
+    window.location.href = SETTINGS.bff.paths.logout;
+};
+const goToPortal = () => {
+    window.location.href = SETTINGS.bff.paths.portal;
+};
+export { AuditAuthNext, login, logout, goToPortal };

package/dist/settings.d.ts

@@ -0,0 +1,61 @@
+declare const SETTINGS: {
+    readonly jwt_public_key: "-----BEGIN PUBLIC KEY-----\nMIIBIjANBgkqhkiG9w0BAQEFAAOCAQ8AMIIBCgKCAQEAs2EYs4Q9OyjNuAEPqb4j\nIzc52JdfVcNvEbG43Xp8B2kI9QxwRyX7rtFSwKowj3W1BlCLaTIMK3TafWOf9QwH\nfemuL9Ni37PFcGptzpyuoCYYA650EuD82PENcO49lsObvty2cuXxQszbPPvAecm4\nJ/XG70td/W1UwbjAJcdmp8ktZGYR0JXM37hYA9Xq/aKwu7d0FTL6WdKTvt3L5VxL\nF6WNyLs65ZSbu+j8UEkwmoJ9h9Y0mLQmFtmkoh/HWOFyFDnBNiJX0vRb++RhJw6w\ncrSbqpbTu7z4vIep5lgSOut39P273SVTQZ3cGQIS+605Ur5wjkkSzzaJV1QLBBR9\nAQIDAQAB\n-----END PUBLIC KEY-----\n";
+    readonly jwt_issuer: "https://api.auditauth.com";
+    readonly domains: {
+        readonly api: "http://localhost:4000/v1";
+        readonly client: "http://localhost:3000";
+    };
+    readonly bff: {
+        readonly paths: {
+            readonly callback: "/api/auditauth/callback";
+            readonly metrics: "/api/auditauth/metrics";
+            readonly login: "/api/auditauth/login";
+            readonly logout: "/api/auditauth/logout";
+            readonly portal: "/api/auditauth/portal";
+            readonly session: "/api/auditauth/session";
+        };
+    };
+    readonly cookies: {
+        readonly access: {
+            readonly name: "auditauth_access";
+            readonly config: {
+                readonly httpOnly: true;
+                readonly sameSite: "lax";
+                readonly secure: false;
+                readonly path: "/";
+                readonly maxAge: number;
+            };
+        };
+        readonly session: {
+            readonly name: "auditauth_session";
+            readonly config: {
+                readonly maxAge: number;
+                readonly httpOnly: true;
+                readonly secure: false;
+                readonly path: "/";
+                readonly sameSite: "lax";
+            };
+        };
+        readonly refresh: {
+            readonly name: "auditauth_refresh";
+            readonly config: {
+                readonly httpOnly: true;
+                readonly sameSite: "lax";
+                readonly secure: false;
+                readonly path: "/";
+                readonly maxAge: number;
+            };
+        };
+        readonly session_id: {
+            readonly name: "auditauth_sid";
+            readonly config: {
+                readonly httpOnly: false;
+                readonly sameSite: "lax";
+                readonly secure: false;
+                readonly path: "/";
+                readonly maxAge: number;
+            };
+        };
+    };
+};
+export { SETTINGS };

package/dist/settings.js

@@ -0,0 +1,61 @@
+const SETTINGS = {
+    jwt_public_key: "-----BEGIN PUBLIC KEY-----\nMIIBIjANBgkqhkiG9w0BAQEFAAOCAQ8AMIIBCgKCAQEAs2EYs4Q9OyjNuAEPqb4j\nIzc52JdfVcNvEbG43Xp8B2kI9QxwRyX7rtFSwKowj3W1BlCLaTIMK3TafWOf9QwH\nfemuL9Ni37PFcGptzpyuoCYYA650EuD82PENcO49lsObvty2cuXxQszbPPvAecm4\nJ/XG70td/W1UwbjAJcdmp8ktZGYR0JXM37hYA9Xq/aKwu7d0FTL6WdKTvt3L5VxL\nF6WNyLs65ZSbu+j8UEkwmoJ9h9Y0mLQmFtmkoh/HWOFyFDnBNiJX0vRb++RhJw6w\ncrSbqpbTu7z4vIep5lgSOut39P273SVTQZ3cGQIS+605Ur5wjkkSzzaJV1QLBBR9\nAQIDAQAB\n-----END PUBLIC KEY-----\n",
+    jwt_issuer: "https://api.auditauth.com",
+    domains: {
+        api: 'http://localhost:4000/v1',
+        client: 'http://localhost:3000',
+    },
+    bff: {
+        paths: {
+            callback: '/api/auditauth/callback',
+            metrics: '/api/auditauth/metrics',
+            login: '/api/auditauth/login',
+            logout: '/api/auditauth/logout',
+            portal: '/api/auditauth/portal',
+            session: '/api/auditauth/session',
+        }
+    },
+    cookies: {
+        access: {
+            name: 'auditauth_access',
+            config: {
+                httpOnly: true,
+                sameSite: 'lax',
+                secure: false,
+                path: '/',
+                maxAge: 60 * 15,
+            }
+        },
+        session: {
+            name: 'auditauth_session',
+            config: {
+                maxAge: 60 * 60 * 24,
+                httpOnly: true,
+                secure: false,
+                path: "/",
+                sameSite: "lax",
+            },
+        },
+        refresh: {
+            name: 'auditauth_refresh',
+            config: {
+                httpOnly: true,
+                sameSite: 'lax',
+                secure: false,
+                path: '/',
+                maxAge: 60 * 60 * 24,
+            }
+        },
+        session_id: {
+            name: 'auditauth_sid',
+            config: {
+                httpOnly: false,
+                sameSite: 'lax',
+                secure: false,
+                path: '/',
+                maxAge: 60 * 60,
+            }
+        }
+    }
+};
+export { SETTINGS };

package/dist/types.d.ts

@@ -0,0 +1,50 @@
+type AuditAuthConfig = {
+    requestUrl: string;
+    apiKey: string;
+    redirectUrl: string;
+    baseUrl: string;
+    appId: string;
+};
+type SessionUser = {
+    _id: string;
+    name: string;
+    email: string;
+    avatar: {
+        url: string | null;
+    };
+};
+type Session = {
+    user: SessionUser;
+};
+type CookieOptions = {
+    httpOnly?: boolean;
+    secure?: boolean;
+    sameSite?: 'lax' | 'strict' | 'none';
+    path?: string;
+    maxAge?: number;
+};
+type RequestMethod = 'GET' | 'POST' | 'PUT' | 'PATCH' | 'DELETE';
+type Metric = {
+    event_type: 'request';
+    runtime: 'browser' | 'server';
+    target: {
+        type: 'api';
+        method: RequestMethod;
+        path: string;
+        status: number;
+        duration_ms: number;
+    };
+} | {
+    event_type: 'navigation';
+    runtime: 'browser' | 'server';
+    target: {
+        type: 'page';
+        path: string;
+    };
+};
+type CookieAdapter = {
+    get: (name: string) => string | undefined;
+    set: (name: string, value: string, options?: CookieOptions) => void;
+    remove: (name: string) => void;
+};
+export type { AuditAuthConfig, SessionUser, Session, RequestMethod, Metric, CookieOptions, CookieAdapter, };

package/dist/types.js

@@ -0,0 +1 @@
+export {};

package/package.json

@@ -0,0 +1,38 @@
+{
+  "name": "@auditauth/next",
+  "version": "0.1.0",
+  "description": "Official AuditAuth SDK for Next.js",
+  "license": "MIT",
+  "author": "Nimibyte",
+  "type": "module",
+  "main": "dist/index.js",
+  "types": "dist/index.d.ts",
+  "files": [
+    "dist"
+  ],
+  "exports": {
+    ".": {
+      "types": "./dist/index.d.ts",
+      "default": "./dist/index.js"
+    }
+  },
+  "scripts": {
+    "build": "tsc -p tsconfig.build.json",
+    "prepublishOnly": "npm run build"
+  },
+  "peerDependencies": {
+    "next": ">=13",
+    "react": ">=18",
+    "react-dom": ">=18"
+  },
+  "dependencies": {
+    "crypto": "^1.0.1",
+    "jose": "^5.2.0"
+  },
+  "devDependencies": {
+    "@types/node": "^25.0.9",
+    "@types/react": "^19.2.8",
+    "@types/react-dom": "^19.2.3",
+    "typescript": "^5.9.3"
+  }
+}