@auditauth/next 0.1.9 → 0.2.0-beta.2

package/README.md

@@ -1,3 +1,134 @@
 # @auditauth/next
 
-Official AuditAuth SDK for Next.js (App Router).
+`@auditauth/next` is the AuditAuth integration for Next.js App Router. It
+provides route handlers, auth middleware, protected server handlers, session
+helpers, and authenticated fetch wrappers.
+
+## Install
+
+Install the package in your Next.js application.
+
+```bash
+npm install @auditauth/next
+```
+
+## Create the AuditAuth provider
+
+Create one shared instance with `createAuditAuthNext()`.
+
+```ts
+// src/providers/auth.ts
+import { createAuditAuthNext } from '@auditauth/next'
+
+export const auditauth = createAuditAuthNext({
+  apiKey: process.env.AUDITAUTH_API_KEY!,
+  appId: process.env.AUDITAUTH_APP_ID!,
+  baseUrl: 'http://localhost:3000',
+  redirectUrl: 'http://localhost:3000/private',
+})
+```
+
+## Register auth API handlers
+
+Expose the SDK handlers through a catch-all route.
+
+```ts
+// src/app/api/auditauth/[...auditauth]/route.ts
+import { auditauth } from '@/providers/auth'
+
+export const { GET, POST } = auditauth.handlers
+```
+
+The handler covers these endpoints:
+
+- `GET /api/auditauth/login`
+- `GET /api/auditauth/callback`
+- `GET /api/auditauth/logout`
+- `GET /api/auditauth/portal`
+- `GET /api/auditauth/session`
+- `GET /api/auditauth/refresh`
+- `POST /api/auditauth/metrics`
+
+## Protect private routes with middleware
+
+Call `auditauth.middleware()` on route groups that require authentication.
+
+```ts
+// src/proxy.ts
+import { NextResponse, type NextRequest } from 'next/server'
+import { auditauth } from '@/providers/auth'
+
+export async function proxy(request: NextRequest) {
+  if (request.nextUrl.pathname.startsWith('/private')) {
+    return auditauth.middleware(request)
+  }
+
+  return NextResponse.next()
+}
+```
+
+## Access session data in server components
+
+Use `auditauth.getSession()` in server components, route handlers, or server
+actions.
+
+```ts
+const session = await auditauth.getSession()
+if (!session) return null
+```
+
+## Protect custom route handlers
+
+Wrap handlers with `auditauth.withAuthRequest()` to enforce token validation and
+inject the verified token payload.
+
+```ts
+import { auditauth } from '@/providers/auth'
+import { NextResponse } from 'next/server'
+
+export const GET = auditauth.withAuthRequest(async (_req, _ctx, session) => {
+  return NextResponse.json({ email: session.email })
+})
+```
+
+## Call protected APIs from the server
+
+Use `auditauth.fetch()` for server-side requests with automatic refresh and
+request metrics.
+
+```ts
+const response = await auditauth.fetch('https://api.example.com/private')
+```
+
+## Client helpers
+
+For client-side navigation shortcuts, import these helpers:
+
+- `login()`
+- `logout()`
+- `goToPortal()`
+
+You can also use `AuditAuthGuard` and `useAuditAuth` to gate client-rendered
+UI sections.
+
+## Compatibility
+
+This package requires:
+
+- Node.js `>=18.18.0`
+- Next.js `>=13`
+- React `>=18`
+- React DOM `>=18`
+
+## Resources
+
+- Repository: https://github.com/nimibyte/auditauth-sdk
+- Documentation: https://docs.auditauth.com
+
+## Example
+
+See `examples/next` for a complete App Router integration.
+
+## License
+
+MIT

package/dist/facade/createAuditAuth.d.ts

@@ -0,0 +1,29 @@
+import type { NextRequest } from 'next/server.js';
+import { NextResponse } from 'next/server.js';
+import type { AuditAuthConfig, SessionUser } from '@auditauth/core';
+import type { AuditAuthTokenPayload } from '@auditauth/node';
+type AuditAuthNextFacade = {
+    handlers: {
+        GET: (req: NextRequest, ctx: {
+            params: Promise<{
+                auditauth: string[];
+            }>;
+        }) => Promise<Response>;
+        POST: (req: NextRequest, ctx: {
+            params: Promise<{
+                auditauth: string[];
+            }>;
+        }) => Promise<Response>;
+    };
+    middleware: (req: NextRequest) => Promise<NextResponse>;
+    getSession: () => Promise<SessionUser | null>;
+    hasSession: () => Promise<boolean>;
+    fetch: (url: string, init?: RequestInit) => Promise<Response>;
+    getLoginUrl: () => URL;
+    getLogoutUrl: () => URL;
+    getPortalUrl: () => URL;
+    withAuthRequest: <C>(handler: (req: NextRequest, ctx: C, session: AuditAuthTokenPayload) => Promise<Response>) => (req: NextRequest, ctx: C) => Promise<Response>;
+};
+declare function createAuditAuthNext(config: AuditAuthConfig): AuditAuthNextFacade;
+export type { AuditAuthNextFacade };
+export { createAuditAuthNext };

package/dist/facade/createAuditAuth.js

@@ -0,0 +1,52 @@
+import { cookies } from 'next/headers.js';
+import { AuditAuthNext } from '../sdk.js';
+import { SETTINGS } from '../settings.js';
+function createAuditAuthNext(config) {
+    const base = new URL(config.baseUrl);
+    async function createInstance() {
+        const store = await cookies();
+        return new AuditAuthNext(config, {
+            get: (name) => store.get(name)?.value,
+            set: (name, value, options) => store.set(name, value, options),
+            remove: (name) => store.delete(name),
+        });
+    }
+    return {
+        handlers: {
+            GET: async (req, ctx) => {
+                const instance = await createInstance();
+                return instance.getHandlers().GET(req, ctx);
+            },
+            POST: async (req, ctx) => {
+                const instance = await createInstance();
+                return instance.getHandlers().POST(req, ctx);
+            },
+        },
+        middleware: async (req) => {
+            const instance = await createInstance();
+            return instance.middleware(req);
+        },
+        getSession: async () => {
+            const instance = await createInstance();
+            return instance.getSession();
+        },
+        hasSession: async () => {
+            const instance = await createInstance();
+            return instance.hasSession();
+        },
+        fetch: async (url, init) => {
+            const instance = await createInstance();
+            return instance.fetch(url, init);
+        },
+        withAuthRequest: (handler) => {
+            return async (req, ctx) => {
+                const instance = await createInstance();
+                return instance.withAuthRequest(handler)(req, ctx);
+            };
+        },
+        getLoginUrl: () => new URL(SETTINGS.bff.paths.login, base),
+        getLogoutUrl: () => new URL(SETTINGS.bff.paths.logout, base),
+        getPortalUrl: () => new URL(SETTINGS.bff.paths.portal, base),
+    };
+}
+export { createAuditAuthNext };

package/dist/facade/index.d.ts

@@ -0,0 +1 @@
+export * from './createAuditAuth.js';

package/dist/facade/index.js

@@ -0,0 +1 @@
+export * from './createAuditAuth.js';

package/dist/guard.d.ts

@@ -1,4 +1,4 @@
-import { SessionUser } from "./types";
+import { SessionUser } from "@auditauth/core";
 type AuthContextValue = {
     user: SessionUser;
 };

package/dist/guard.js

@@ -1,7 +1,7 @@
 'use client';
 import { jsx as _jsx } from "react/jsx-runtime";
 import { createContext, useContext, useEffect, useMemo, useState } from "react";
-import { SETTINGS } from "./settings";
+import { SETTINGS } from './settings.js';
 const AuthContext = createContext(null);
 const useAuditAuth = () => {
     const ctx = useContext(AuthContext);

package/dist/helpers.js

@@ -1,7 +1,7 @@
 /* -------------------------------------------------------------------------- */
 /*                             CLIENT SHORTCUTS                               */
 /* -------------------------------------------------------------------------- */
-import { SETTINGS } from "./settings";
+import { SETTINGS } from './settings.js';
 const login = () => {
     window.location.href = SETTINGS.bff.paths.login;
 };

package/dist/index.d.ts

@@ -1,5 +1,6 @@
-export { AuditAuthNext } from './sdk';
-export { AuditAuthGuard, useAuditAuth } from './guard';
-export { login, logout, goToPortal } from './helpers';
-export { auditauthFetch } from './request';
-export type * from './types';
+export { AuditAuthNext } from './sdk.js';
+export { AuditAuthGuard, useAuditAuth } from './guard.js';
+export { login, logout, goToPortal } from './helpers.js';
+export { auditauthFetch } from './request.js';
+export type * from './types.js';
+export * from './facade/index.js';

package/dist/index.js

@@ -1,4 +1,5 @@
-export { AuditAuthNext } from './sdk';
-export { AuditAuthGuard, useAuditAuth } from './guard';
-export { login, logout, goToPortal } from './helpers';
-export { auditauthFetch } from './request';
+export { AuditAuthNext } from './sdk.js';
+export { AuditAuthGuard, useAuditAuth } from './guard.js';
+export { login, logout, goToPortal } from './helpers.js';
+export { auditauthFetch } from './request.js';
+export * from './facade/index.js';

package/dist/request.js

@@ -1,10 +1,25 @@
 'use server';
-import { cookies } from "next/headers";
-import { SETTINGS } from "./settings";
+import { cookies } from 'next/headers.js';
+import { SETTINGS } from './settings.js';
+import { headers } from 'next/headers.js';
+import { refreshTokens } from "@auditauth/core";
+const getRequestOrigin = async () => {
+    const h = await headers();
+    const proto = h.get('x-forwarded-proto') ??
+        (process.env.NODE_ENV === 'production' ? 'https' : 'http');
+    const host = h.get('x-forwarded-host') ??
+        h.get('host');
+    if (!host) {
+        throw new Error('Cannot resolve request origin');
+    }
+    return `${proto}://${host}`;
+};
 const auditauthFetch = async (url, init = {}) => {
     const cookieManager = await cookies();
-    const access_token = cookieManager.get(SETTINGS.cookies.access.name);
-    const refresh_token = cookieManager.get(SETTINGS.cookies.refresh.name);
+    const origin = await getRequestOrigin();
+    const access_token = cookieManager.get(SETTINGS.storage_keys.access)?.value;
+    const refresh_token = cookieManager.get(SETTINGS.storage_keys.refresh)?.value;
+    const session_id = cookieManager.get(SETTINGS.storage_keys.session_id)?.value;
     const doFetch = (token) => fetch(url, {
         ...init,
         headers: {
@@ -13,21 +28,14 @@ const auditauthFetch = async (url, init = {}) => {
         },
     });
     const start = performance.now();
-    let response = await doFetch(access_token?.value);
+    let response = await doFetch(access_token);
     if (response.status === 401 && refresh_token) {
-        const refreshResponse = await fetch(`${SETTINGS.domains.api}/auth/refresh`, {
-            method: 'POST',
-            headers: { 'Content-Type': 'application/json' },
-            body: JSON.stringify({
-                refresh_token,
-                client_type: 'server',
-            }),
-        });
-        if (!refreshResponse.ok)
+        const refreshData = await refreshTokens({ refresh_token, client_type: 'server' });
+        if (!refreshData) {
             return response;
-        const data = await refreshResponse.json();
-        if (data?.access_token && data?.refresh_token) {
-            response = await doFetch(data.access_token);
+        }
+        if (refreshData.access_token && refreshData.refresh_token) {
+            response = await doFetch(refreshData.access_token);
         }
     }
     queueMicrotask(() => {
@@ -42,10 +50,10 @@ const auditauthFetch = async (url, init = {}) => {
                 duration_ms: Math.round(performance.now() - start),
             },
         };
-        fetch(`${SETTINGS.bff.paths.metrics}`, {
+        fetch(`${origin}${SETTINGS.bff.paths.metrics}`, {
             method: 'POST',
             headers: { 'Content-Type': 'application/json' },
-            body: JSON.stringify({ ...payload }),
+            body: JSON.stringify({ ...payload, session_id }),
         }).catch(() => { });
     });
     return response;

package/dist/sdk.d.ts

@@ -1,36 +1,24 @@
-import { NextRequest, NextResponse } from "next/server";
-import { AuditAuthConfig, CookieAdapter, Metric, SessionUser } from "./types";
+import { NextRequest, NextResponse } from 'next/server.js';
+import type { CookieAdapter } from './types.js';
+import { AuditAuthConfig, SessionUser } from '@auditauth/core';
+import { AuditAuthTokenPayload } from "@auditauth/node";
 declare class AuditAuthNext {
     private config;
     private cookies;
     constructor(config: AuditAuthConfig, cookies: CookieAdapter);
-    verifyAccessToken(token: string): Promise<boolean>;
     private getCookieTokens;
     private setCookieTokens;
+    private pushMetric;
     getSession(): SessionUser | null;
     hasSession(): boolean;
-    private buildAuthUrl;
-    callback(request: NextRequest): Promise<{
-        ok: boolean;
-        url: string;
-    }>;
-    logout(): Promise<void>;
-    getPortalUrl(): Promise<{
-        ok: boolean;
-        url: null;
-        reason: string;
-    } | {
-        ok: boolean;
-        url: string;
-        reason: null;
-    }>;
-    private refreshRequest;
-    request(url: string, init?: RequestInit): Promise<Response>;
-    metrics(payload: Metric): Promise<Response>;
-    private pushMetric;
-    refresh(): Promise<{
-        ok: boolean;
-    }>;
+    getLoginUrl(): URL;
+    getLogoutUrl(): URL;
+    getPortalUrl(): URL;
+    private callback;
+    private logout;
+    withAuthRequest<C>(handler: (req: NextRequest, ctx: C, session: AuditAuthTokenPayload) => Promise<Response>): (req: NextRequest, ctx: C) => Promise<Response>;
+    fetch(url: string, init?: RequestInit): Promise<Response>;
+    private refresh;
     middleware(request: NextRequest): Promise<NextResponse<unknown>>;
     getHandlers(): {
         GET: (req: NextRequest, ctx: {
@@ -38,7 +26,7 @@ declare class AuditAuthNext {
                 auditauth: string[];
             }>;
         }) => Promise<Response>;
-        POST: (req: Request, ctx: {
+        POST: (req: NextRequest, ctx: {
             params: Promise<{
                 auditauth: string[];
             }>;

package/dist/sdk.js

@@ -1,14 +1,8 @@
 'use server';
-import { NextResponse } from "next/server";
-import { importSPKI, jwtVerify } from 'jose';
-import { SETTINGS } from "./settings";
-/* -------------------------------------------------------------------------- */
-/*                                    KEYS                                    */
-/* -------------------------------------------------------------------------- */
-let cachedKey = null;
-/* -------------------------------------------------------------------------- */
-/*                               MAIN CLASS                                   */
-/* -------------------------------------------------------------------------- */
+import { NextResponse } from 'next/server.js';
+import { SETTINGS } from './settings.js';
+import { buildAuthUrl, authorizeCode, revokeSession, buildPortalUrl, refreshTokens, sendMetrics, } from '@auditauth/core';
+import { verifyRequest } from "@auditauth/node";
 class AuditAuthNext {
     constructor(config, cookies) {
         if (!config.appId)
@@ -25,40 +19,22 @@ class AuditAuthNext {
         this.config = config;
         this.cookies = cookies;
     }
-    /* ------------------------------------------------------------------------ */
-    /*                             AUTH PRIMITIVES                              */
-    /* ------------------------------------------------------------------------ */
-    async verifyAccessToken(token) {
-        try {
-            cachedKey =
-                cachedKey ||
-                    await importSPKI(SETTINGS.jwt_public_key, 'RS256');
-            await jwtVerify(token, cachedKey, {
-                issuer: SETTINGS.jwt_issuer,
-                audience: this.config.appId,
-            });
-            return true;
-        }
-        catch {
-            return false;
-        }
-    }
     getCookieTokens() {
         return {
-            access: this.cookies.get(SETTINGS.cookies.access.name),
-            refresh: this.cookies.get(SETTINGS.cookies.refresh.name),
+            access: this.cookies.get(SETTINGS.storage_keys.access),
+            refresh: this.cookies.get(SETTINGS.storage_keys.refresh),
         };
     }
     setCookieTokens(params) {
         const isSecure = this.config.redirectUrl.includes('https');
-        this.cookies.set(SETTINGS.cookies.access.name, params.access_token, {
+        this.cookies.set(SETTINGS.storage_keys.access, params.access_token, {
             httpOnly: true,
             sameSite: 'lax',
             secure: isSecure,
             path: '/',
             maxAge: params.access_expires_seconds - 60,
         });
-        this.cookies.set(SETTINGS.cookies.refresh.name, params.refresh_token, {
+        this.cookies.set(SETTINGS.storage_keys.refresh, params.refresh_token, {
             httpOnly: true,
             sameSite: 'lax',
             secure: isSecure,
@@ -66,135 +42,91 @@ class AuditAuthNext {
             maxAge: params.refresh_expires_seconds - 60,
         });
     }
-    /* ------------------------------------------------------------------------ */
-    /*                              SESSION HELPERS                             */
-    /* ------------------------------------------------------------------------ */
+    pushMetric(payload) {
+        const session_id = this.cookies.get(SETTINGS.storage_keys.session_id);
+        queueMicrotask(() => {
+            fetch(`${this.config.baseUrl}${SETTINGS.bff.paths.metrics}`, {
+                method: 'POST',
+                headers: { 'Content-Type': 'application/json' },
+                body: JSON.stringify({ ...payload, session_id }),
+            }).catch(() => { });
+        });
+    }
     getSession() {
-        return JSON.parse(this.cookies.get(SETTINGS.cookies.session.name) || '{}')?.user || null;
+        return JSON.parse(this.cookies.get(SETTINGS.storage_keys.session) || '{}')?.user || null;
     }
     hasSession() {
-        return !!this.cookies.get(SETTINGS.cookies.session.name);
+        return !!this.cookies.get(SETTINGS.storage_keys.session);
     }
-    /* ------------------------------------------------------------------------ */
-    /*                              AUTH FLOWS                                  */
-    /* ------------------------------------------------------------------------ */
-    async buildAuthUrl() {
-        const response = await fetch(`${SETTINGS.domains.api}/apps/login`, {
-            method: 'POST',
-            headers: { 'x-api-key': this.config.apiKey },
-        });
-        if (!response.ok) {
-            throw new Error('invalid_app');
-        }
-        const { code, redirectUrl } = await response.json();
-        const url = new URL(redirectUrl);
-        url.searchParams.set('code', code);
+    getLoginUrl() {
+        const url = new URL(SETTINGS.bff.paths.login, this.config.baseUrl);
+        return url;
+    }
+    getLogoutUrl() {
+        const url = new URL(SETTINGS.bff.paths.logout, this.config.baseUrl);
+        return url;
+    }
+    getPortalUrl() {
+        const url = new URL(SETTINGS.bff.paths.portal, this.config.baseUrl);
         return url;
     }
     async callback(request) {
         const code = new URL(request.url).searchParams.get('code');
-        if (!code) {
-            return {
-                ok: false,
-                url: `${SETTINGS.domains.client}/auth/invalid?reason=wrong_config`,
+        try {
+            const { data } = await authorizeCode({ code, client_type: 'server' });
+            const session = {
+                user: data.user,
             };
+            const isSecure = this.config.redirectUrl.includes('http');
+            this.cookies.set(SETTINGS.storage_keys.session, JSON.stringify(session), {
+                httpOnly: true,
+                sameSite: 'lax',
+                secure: isSecure,
+                path: '/',
+                maxAge: data.refresh_expires_seconds - 60,
+            });
+            this.setCookieTokens({
+                access_token: data.access_token,
+                access_expires_seconds: data.access_expires_seconds,
+                refresh_token: data.refresh_token,
+                refresh_expires_seconds: data.refresh_expires_seconds,
+            });
+            return { ok: true, url: this.config.redirectUrl };
         }
-        const response = await fetch(`${SETTINGS.domains.api}/auth/authorize`, {
-            method: 'POST',
-            headers: { 'Content-Type': 'application/json' },
-            body: JSON.stringify({ code, client_type: 'server' }),
-        });
-        if (!response.ok) {
+        catch {
             return {
                 ok: false,
-                url: `${SETTINGS.domains.client}/auth/invalid?reason=unauthorized`,
+                url: `${SETTINGS.domains.client}/auth/invalid?reason=wrong_config`,
             };
         }
-        const result = await response.json();
-        const session = {
-            user: {
-                _id: result.user._id.toString(),
-                email: result.user.email,
-                avatar: result.user.avatar,
-                name: result.user.name,
-            },
-        };
-        const isSecure = this.config.redirectUrl.includes('http');
-        this.cookies.set(SETTINGS.cookies.session.name, JSON.stringify(session), {
-            httpOnly: true,
-            sameSite: 'lax',
-            secure: isSecure,
-            path: '/',
-            maxAge: result.refresh_expires_seconds - 60,
-        });
-        this.setCookieTokens({
-            access_token: result.access_token,
-            access_expires_seconds: result.access_expires_seconds,
-            refresh_token: result.refresh_token,
-            refresh_expires_seconds: result.refresh_expires_seconds,
-        });
-        return { ok: true, url: this.config.redirectUrl };
     }
     async logout() {
         const { access } = this.getCookieTokens();
-        if (access) {
-            await fetch(`${SETTINGS.domains.api}/auth/revoke`, {
-                method: 'PATCH',
-                headers: { Authorization: `Bearer ${access}` },
-            }).catch(() => { });
-        }
-        this.cookies.remove(SETTINGS.cookies.access.name);
-        this.cookies.remove(SETTINGS.cookies.refresh.name);
-        this.cookies.remove(SETTINGS.cookies.session.name);
+        this.cookies.remove(SETTINGS.storage_keys.access);
+        this.cookies.remove(SETTINGS.storage_keys.refresh);
+        this.cookies.remove(SETTINGS.storage_keys.session);
+        if (!access)
+            return;
+        await revokeSession({ access_token: access }).catch(() => { });
     }
-    async getPortalUrl() {
-        const { access } = this.getCookieTokens();
-        const res = await fetch(`${SETTINGS.domains.api}/portal/exchange`, {
-            method: 'GET',
-            headers: {
-                Authorization: `Bearer ${access}`,
-            },
-        });
-        if (!res.ok && res.status === 401) {
-            return { ok: false, url: null, reason: 'unathorized' };
-        }
-        else if (!res.ok) {
-            return { ok: false, url: null, reason: 'fail' };
-        }
-        const body = await res.json();
-        return {
-            ok: true,
-            url: `${body.redirectUrl}?code=${body.code}&redirectUrl=${this.config.redirectUrl}`,
-            reason: null,
+    withAuthRequest(handler) {
+        return async (req, ctx) => {
+            try {
+                const session = await verifyRequest({
+                    request: req,
+                    appId: this.config.appId,
+                });
+                return handler(req, ctx, session);
+            }
+            catch (err) {
+                return NextResponse.json({ error: 'Unauthorized' }, { status: 401 });
+            }
         };
     }
-    /* ------------------------------------------------------------------------ */
-    /*                              REFRESH FLOW                                 */
-    /* ------------------------------------------------------------------------ */
-    async refreshRequest(refreshToken) {
-        try {
-            const response = await fetch(`${SETTINGS.domains.api}/auth/refresh`, {
-                method: 'POST',
-                headers: { 'Content-Type': 'application/json' },
-                body: JSON.stringify({
-                    refresh_token: refreshToken,
-                    client_type: 'server',
-                }),
-            });
-            if (!response.ok)
-                return null;
-            return response.json();
-        }
-        catch {
-            return null;
-        }
-    }
-    /* ------------------------------------------------------------------------ */
-    /*                         REQUEST WITH AUTO-REFRESH                         */
-    /* ------------------------------------------------------------------------ */
-    async request(url, init = {}) {
+    async fetch(url, init = {}) {
         const { access, refresh } = this.getCookieTokens();
-        const doFetch = (token) => fetch(url, {
+        const finalUrl = url.startsWith('http') ? url : `${this.config.baseUrl}${url}`;
+        const doFetch = (token) => fetch(finalUrl, {
             ...init,
             headers: {
                 ...init.headers,
@@ -204,9 +136,12 @@ class AuditAuthNext {
         const start = performance.now();
         let res = await doFetch(access);
         if (res.status === 401 && refresh) {
-            const data = await this.refreshRequest(refresh);
-            if (data?.access_token && data?.refresh_token) {
-                res = await doFetch(data.access_token);
+            const refreshData = await refreshTokens({ refresh_token: refresh, client_type: 'server' });
+            if (!refreshData) {
+                return res;
+            }
+            if (refreshData.access_token && refreshData.refresh_token) {
+                res = await doFetch(refreshData.access_token);
             }
         }
         this.pushMetric({
@@ -222,54 +157,29 @@ class AuditAuthNext {
         });
         return res;
     }
-    /* ------------------------------------------------------------------------ */
-    /*                                METRICS                                    */
-    /* ------------------------------------------------------------------------ */
-    async metrics(payload) {
-        await fetch(`${SETTINGS.domains.api}/metrics`, {
-            method: 'POST',
-            headers: {
-                'Content-Type': 'application/json',
-                'x-auditauth-app': this.config.appId,
-                'x-auditauth-key': this.config.apiKey,
-            },
-            body: JSON.stringify({ ...payload }),
-        });
-        return new Response(null, { status: 204 });
-    }
-    pushMetric(payload) {
-        const session_id = this.cookies.get(SETTINGS.cookies.session_id.name);
-        queueMicrotask(() => {
-            fetch(`${this.config.baseUrl}${SETTINGS.bff.paths.metrics}`, {
-                method: 'POST',
-                headers: { 'Content-Type': 'application/json' },
-                body: JSON.stringify({ ...payload, session_id }),
-            }).catch(() => { });
-        });
-    }
-    /* ------------------------------------------------------------------------ */
-    /*                                METRICS                                    */
-    /* ------------------------------------------------------------------------ */
     async refresh() {
         const { refresh } = this.getCookieTokens();
         if (!refresh)
             return { ok: false };
-        const result = await this.refreshRequest(refresh);
+        const result = await refreshTokens({ refresh_token: refresh, client_type: 'server' });
         if (!result)
             return { ok: false };
-        this.setCookieTokens(result);
+        const { access_token, refresh_token, access_expires_seconds, refresh_expires_seconds } = result;
+        this.setCookieTokens({
+            access_token,
+            access_expires_seconds,
+            refresh_token,
+            refresh_expires_seconds,
+        });
         return { ok: true };
     }
-    /* ------------------------------------------------------------------------ */
-    /*                               MIDDLEWARE                                  */
-    /* ------------------------------------------------------------------------ */
     async middleware(request) {
         const { access, refresh } = this.getCookieTokens();
         const url = request.nextUrl;
         if (access && refresh) {
-            const sid = this.cookies.get(SETTINGS.cookies.session_id.name);
+            const sid = this.cookies.get(SETTINGS.storage_keys.session_id);
             if (!sid) {
-                this.cookies.set(SETTINGS.cookies.session_id.name, crypto.randomUUID(), {
+                this.cookies.set(SETTINGS.storage_keys.session_id, crypto.randomUUID(), {
                     httpOnly: true,
                     sameSite: 'lax',
                     secure: this.config.baseUrl.startsWith('https'),
@@ -287,15 +197,17 @@ class AuditAuthNext {
             });
             return NextResponse.next();
         }
-        if (!refresh)
+        if (!refresh) {
+            if (request.method !== 'GET') {
+                return NextResponse.json({ error: 'Unauthorized' }, { status: 401 });
+            }
             return NextResponse.redirect(new URL(SETTINGS.bff.paths.login, request.url));
-        if (refresh && !access)
+        }
+        if (refresh && !access) {
             return NextResponse.redirect(new URL(`${SETTINGS.bff.paths.refresh}?redirectUrl=${url}`, request.url));
+        }
         return NextResponse.next();
     }
-    /* ------------------------------------------------------------------------ */
-    /*                               BFF HANDLERS                               */
-    /* ------------------------------------------------------------------------ */
     getHandlers() {
         return {
             GET: async (req, ctx) => {
@@ -304,7 +216,7 @@ class AuditAuthNext {
                 switch (action) {
                     case 'login':
                         {
-                            const url = await this.buildAuthUrl();
+                            const url = await buildAuthUrl({ apiKey: this.config.apiKey, redirectUrl: `${this.config.baseUrl}/api/auditauth/callback` });
                             return NextResponse.redirect(url);
                         }
                         ;
@@ -313,7 +225,7 @@ class AuditAuthNext {
                             const { ok } = await this.refresh();
                             if (ok)
                                 return NextResponse.redirect(redirectUrl || this.config.redirectUrl);
-                            const url = await this.buildAuthUrl();
+                            const url = await buildAuthUrl({ apiKey: this.config.apiKey, redirectUrl: `${this.config.baseUrl}/api/auditauth/callback` });
                             return NextResponse.redirect(url);
                         }
                         ;
@@ -331,10 +243,16 @@ class AuditAuthNext {
                         ;
                     case 'portal':
                         {
-                            const { ok, url } = await this.getPortalUrl();
-                            return ok && url
-                                ? NextResponse.redirect(url)
-                                : NextResponse.redirect(`${SETTINGS.domains.client}/auth/invalid`);
+                            const { access } = this.getCookieTokens();
+                            try {
+                                if (!access)
+                                    throw new Error('Not auth token');
+                                const url = await buildPortalUrl({ access_token: access, redirectUrl: this.config.redirectUrl });
+                                return NextResponse.redirect(url);
+                            }
+                            catch (err) {
+                                return NextResponse.redirect(`${SETTINGS.domains.client}/auth/invalid`);
+                            }
                         }
                         ;
                     case 'session':
@@ -354,10 +272,34 @@ class AuditAuthNext {
             },
             POST: async (req, ctx) => {
                 const action = (await ctx.params).auditauth[0];
-                if (action === 'metrics') {
-                    return this.metrics(await req.json());
+                switch (action) {
+                    case 'metrics':
+                        {
+                            const payload = await req.json();
+                            await sendMetrics({
+                                payload,
+                                appId: this.config.appId,
+                                apiKey: this.config.apiKey,
+                            });
+                            return new Response(null, { status: 204 });
+                        }
+                        ;
+                    case 'refresh':
+                        {
+                            const redirectUrl = req.nextUrl.searchParams.get('redirectUrl');
+                            const { ok } = await this.refresh();
+                            if (ok)
+                                return NextResponse.redirect(redirectUrl || this.config.redirectUrl);
+                            return new Response('Session expired', { status: 401 });
+                        }
+                        ;
+                    default:
+                        {
+                            return new Response('not found', { status: 404 });
+                        }
+                        ;
                 }
-                return new Response('not found', { status: 404 });
+                ;
             },
         };
     }

package/dist/settings.d.ts

@@ -1,10 +1,4 @@
 declare const SETTINGS: {
-    readonly jwt_public_key: "-----BEGIN PUBLIC KEY-----\nMIIBIjANBgkqhkiG9w0BAQEFAAOCAQ8AMIIBCgKCAQEAs2EYs4Q9OyjNuAEPqb4j\nIzc52JdfVcNvEbG43Xp8B2kI9QxwRyX7rtFSwKowj3W1BlCLaTIMK3TafWOf9QwH\nfemuL9Ni37PFcGptzpyuoCYYA650EuD82PENcO49lsObvty2cuXxQszbPPvAecm4\nJ/XG70td/W1UwbjAJcdmp8ktZGYR0JXM37hYA9Xq/aKwu7d0FTL6WdKTvt3L5VxL\nF6WNyLs65ZSbu+j8UEkwmoJ9h9Y0mLQmFtmkoh/HWOFyFDnBNiJX0vRb++RhJw6w\ncrSbqpbTu7z4vIep5lgSOut39P273SVTQZ3cGQIS+605Ur5wjkkSzzaJV1QLBBR9\nAQIDAQAB\n-----END PUBLIC KEY-----\n";
-    readonly jwt_issuer: "https://api.auditauth.com";
-    readonly domains: {
-        readonly api: "https://api.auditauth.com/v1";
-        readonly client: "https://auditauth.com";
-    };
     readonly bff: {
         readonly paths: {
             readonly callback: "/api/auditauth/callback";
@@ -14,21 +8,24 @@ declare const SETTINGS: {
             readonly portal: "/api/auditauth/portal";
             readonly session: "/api/auditauth/session";
             readonly refresh: "/api/auditauth/refresh";
+            readonly proxy: "/api/auditauth/proxy";
         };
     };
-    readonly cookies: {
-        readonly access: {
-            readonly name: "auditauth_access";
-        };
-        readonly session: {
-            readonly name: "auditauth_session";
-        };
-        readonly refresh: {
-            readonly name: "auditauth_refresh";
-        };
-        readonly session_id: {
-            readonly name: "auditauth_sid";
-        };
+    readonly jwt_public_key: "-----BEGIN PUBLIC KEY-----\nMIIBIjANBgkqhkiG9w0BAQEFAAOCAQ8AMIIBCgKCAQEAs2EYs4Q9OyjNuAEPqb4j\nIzc52JdfVcNvEbG43Xp8B2kI9QxwRyX7rtFSwKowj3W1BlCLaTIMK3TafWOf9QwH\nfemuL9Ni37PFcGptzpyuoCYYA650EuD82PENcO49lsObvty2cuXxQszbPPvAecm4\nJ/XG70td/W1UwbjAJcdmp8ktZGYR0JXM37hYA9Xq/aKwu7d0FTL6WdKTvt3L5VxL\nF6WNyLs65ZSbu+j8UEkwmoJ9h9Y0mLQmFtmkoh/HWOFyFDnBNiJX0vRb++RhJw6w\ncrSbqpbTu7z4vIep5lgSOut39P273SVTQZ3cGQIS+605Ur5wjkkSzzaJV1QLBBR9\nAQIDAQAB\n-----END PUBLIC KEY-----\n";
+    readonly jwt_issuer: "https://api.auditauth.com";
+    readonly domains: {
+        readonly api: "https://api.auditauth.com/v1";
+        readonly client: "https://auditauth.com";
+    } | {
+        readonly api: "http://localhost:4000/v1";
+        readonly client: "http://localhost:3000";
+    };
+    readonly storage_keys: {
+        readonly access: "auditauth_access";
+        readonly session: "auditauth_session";
+        readonly refresh: "auditauth_refresh";
+        readonly session_id: "auditauth_sid";
+        readonly sync: "__auditauth_sync__";
     };
 };
 export { SETTINGS };

package/dist/settings.js

@@ -1,12 +1,6 @@
+import { CORE_SETTINGS } from '@auditauth/core';
 const SETTINGS = {
-    jwt_public_key: "-----BEGIN PUBLIC KEY-----\nMIIBIjANBgkqhkiG9w0BAQEFAAOCAQ8AMIIBCgKCAQEAs2EYs4Q9OyjNuAEPqb4j\nIzc52JdfVcNvEbG43Xp8B2kI9QxwRyX7rtFSwKowj3W1BlCLaTIMK3TafWOf9QwH\nfemuL9Ni37PFcGptzpyuoCYYA650EuD82PENcO49lsObvty2cuXxQszbPPvAecm4\nJ/XG70td/W1UwbjAJcdmp8ktZGYR0JXM37hYA9Xq/aKwu7d0FTL6WdKTvt3L5VxL\nF6WNyLs65ZSbu+j8UEkwmoJ9h9Y0mLQmFtmkoh/HWOFyFDnBNiJX0vRb++RhJw6w\ncrSbqpbTu7z4vIep5lgSOut39P273SVTQZ3cGQIS+605Ur5wjkkSzzaJV1QLBBR9\nAQIDAQAB\n-----END PUBLIC KEY-----\n",
-    jwt_issuer: "https://api.auditauth.com",
-    domains: {
-        api: 'https://api.auditauth.com/v1',
-        client: 'https://auditauth.com',
-        // api: 'http://localhost:4000/v1',
-        // client: 'http://localhost:3000',
-    },
+    ...CORE_SETTINGS,
     bff: {
         paths: {
             callback: '/api/auditauth/callback',
@@ -16,21 +10,8 @@ const SETTINGS = {
             portal: '/api/auditauth/portal',
             session: '/api/auditauth/session',
             refresh: '/api/auditauth/refresh',
+            proxy: '/api/auditauth/proxy',
         }
     },
-    cookies: {
-        access: {
-            name: 'auditauth_access',
-        },
-        session: {
-            name: 'auditauth_session',
-        },
-        refresh: {
-            name: 'auditauth_refresh',
-        },
-        session_id: {
-            name: 'auditauth_sid',
-        }
-    }
 };
 export { SETTINGS };

package/dist/types.d.ts

@@ -1,23 +1,4 @@
-type AuditAuthConfig = {
-    apiKey: string;
-    redirectUrl: string;
-    baseUrl: string;
-    appId: string;
-};
-type CredentialResponse = {
-    access_token: string;
-    access_expires_seconds: number;
-    refresh_token: string;
-    refresh_expires_seconds: number;
-};
-type SessionUser = {
-    _id: string;
-    name: string;
-    email: string;
-    avatar: {
-        url: string | null;
-    };
-};
+import { SessionUser } from "@auditauth/core";
 type Session = {
     user: SessionUser;
 };
@@ -28,28 +9,9 @@ type CookieOptions = {
     path?: string;
     maxAge?: number;
 };
-type RequestMethod = 'GET' | 'POST' | 'PUT' | 'PATCH' | 'DELETE';
-type Metric = {
-    event_type: 'request';
-    runtime: 'browser' | 'server';
-    target: {
-        type: 'api';
-        method: RequestMethod;
-        path: string;
-        status: number;
-        duration_ms: number;
-    };
-} | {
-    event_type: 'navigation';
-    runtime: 'browser' | 'server';
-    target: {
-        type: 'page';
-        path: string;
-    };
-};
 type CookieAdapter = {
     get: (name: string) => string | undefined;
     set: (name: string, value: string, options?: CookieOptions) => void;
     remove: (name: string) => void;
 };
-export type { AuditAuthConfig, CredentialResponse, SessionUser, Session, RequestMethod, Metric, CookieOptions, CookieAdapter, };
+export type { Session, CookieOptions, CookieAdapter, };

package/package.json

@@ -1,15 +1,36 @@
 {
   "name": "@auditauth/next",
-  "version": "0.1.9",
-  "description": "Official AuditAuth SDK for Next.js",
+  "version": "0.2.0-beta.2",
+  "description": "AuditAuth NextJS SDK",
   "license": "MIT",
   "author": "Nimibyte",
+  "engines": {
+    "node": ">=18.18.0"
+  },
+  "repository": {
+    "type": "git",
+    "url": "https://github.com/nimibyte/auditauth-sdk.git"
+  },
+  "homepage": "https://docs.auditauth.com",
+  "bugs": {
+    "url": "https://github.com/nimibyte/auditauth-sdk/issues"
+  },
+  "keywords": [
+    "authentication",
+    "auth",
+    "oauth",
+    "identity",
+    "jwt",
+    "security",
+    "auditauth"
+  ],
   "type": "module",
   "main": "dist/index.js",
   "types": "dist/index.d.ts",
   "files": [
     "dist"
   ],
+  "sideEffects": false,
   "exports": {
     ".": {
       "types": "./dist/index.d.ts",
@@ -18,8 +39,8 @@
   },
   "scripts": {
     "build": "tsc -p tsconfig.build.json",
-    "prepublishOnly": "npm run build",
-    "dev": "tsc -p tsconfig.build.json --watch"
+    "dev": "tsc -p tsconfig.build.json --watch",
+    "clean": "rm -rf dist"
   },
   "peerDependencies": {
     "next": ">=13",
@@ -27,12 +48,13 @@
     "react-dom": ">=18"
   },
   "dependencies": {
-    "jose": "^5.2.0"
+    "@auditauth/core": "^0.2.0-beta.2",
+    "@auditauth/node": "^0.2.0-beta.2"
   },
   "devDependencies": {
-    "@types/node": "^25.0.9",
+    "typescript": "^5.9.0",
+    "@types/node": "^20",
     "@types/react": "^19.2.8",
-    "@types/react-dom": "^19.2.3",
-    "typescript": "^5.9.3"
+    "@types/react-dom": "^19.2.3"
   }
 }

package/LICENSE

@@ -1,21 +0,0 @@
-MIT License
-
-Copyright (c) 2026 Nimibyte
-
-Permission is hereby granted, free of charge, to any person obtaining a copy
-of this software and associated documentation files (the "Software"), to deal
-in the Software without restriction, including without limitation the rights
-to use, copy, modify, merge, publish, distribute, sublicense, and/or sell
-copies of the Software, and to permit persons to whom the Software is
-furnished to do so, subject to the following conditions:
-
-The above copyright notice and this permission notice shall be included in all
-copies or substantial portions of the Software.
-
-THE SOFTWARE IS PROVIDED "AS IS", WITHOUT WARRANTY OF ANY KIND, EXPRESS OR
-IMPLIED, INCLUDING BUT NOT LIMITED TO THE WARRANTIES OF MERCHANTABILITY,
-FITNESS FOR A PARTICULAR PURPOSE AND NONINFRINGEMENT. IN NO EVENT SHALL THE
-AUTHORS OR COPYRIGHT HOLDERS BE LIABLE FOR ANY CLAIM, DAMAGES OR OTHER
-LIABILITY, WHETHER IN AN ACTION OF CONTRACT, TORT OR OTHERWISE, ARISING FROM,
-OUT OF OR IN CONNECTION WITH THE SOFTWARE OR THE USE OR OTHER DEALINGS IN THE
-SOFTWARE.