@auditauth/next 0.2.0-beta.3 → 0.2.0-beta.5

package/dist/facade/createAuditAuth.cjs

@@ -22,8 +22,8 @@ __export(createAuditAuth_exports, {
 });
 module.exports = __toCommonJS(createAuditAuth_exports);
 var import_headers = require("next/headers.js");
-var import_sdk = require("../sdk.js");
-var import_settings = require("../settings.js");
+var import_sdk = require("../sdk.cjs");
+var import_settings = require("../settings.cjs");
 function createAuditAuthNext(config) {
   const base = new URL(config.baseUrl);
   async function createInstance() {

package/dist/facade/index.cjs

@@ -15,8 +15,8 @@ var __reExport = (target, mod, secondTarget) => (__copyProps(target, mod, "defau
 var __toCommonJS = (mod) => __copyProps(__defProp({}, "__esModule", { value: true }), mod);
 var facade_exports = {};
 module.exports = __toCommonJS(facade_exports);
-__reExport(facade_exports, require("./createAuditAuth.js"), module.exports);
+__reExport(facade_exports, require("./createAuditAuth.cjs"), module.exports);
 // Annotate the CommonJS export names for ESM import in node:
 0 && (module.exports = {
-  ...require("./createAuditAuth.js")
+  ...require("./createAuditAuth.cjs")
 });

package/dist/guard.cjs

@@ -25,7 +25,7 @@ __export(guard_exports, {
 module.exports = __toCommonJS(guard_exports);
 var import_jsx_runtime = require("react/jsx-runtime");
 var import_react = require("react");
-var import_settings = require("./settings.js");
+var import_settings = require("./settings.cjs");
 const AuthContext = (0, import_react.createContext)(null);
 const useAuditAuth = () => {
   const ctx = (0, import_react.useContext)(AuthContext);

package/dist/helpers.cjs

@@ -23,7 +23,7 @@ __export(helpers_exports, {
   logout: () => logout
 });
 module.exports = __toCommonJS(helpers_exports);
-var import_settings = require("./settings.js");
+var import_settings = require("./settings.cjs");
 const login = () => {
   window.location.href = import_settings.SETTINGS.bff.paths.login;
 };

package/dist/index.cjs

@@ -28,11 +28,11 @@ __export(index_exports, {
   useAuditAuth: () => import_guard.useAuditAuth
 });
 module.exports = __toCommonJS(index_exports);
-var import_sdk = require("./sdk.js");
-var import_guard = require("./guard.js");
-var import_helpers = require("./helpers.js");
-var import_request = require("./request.js");
-__reExport(index_exports, require("./facade/index.js"), module.exports);
+var import_sdk = require("./sdk.cjs");
+var import_guard = require("./guard.cjs");
+var import_helpers = require("./helpers.cjs");
+var import_request = require("./request.cjs");
+__reExport(index_exports, require("./facade/index.cjs"), module.exports);
 // Annotate the CommonJS export names for ESM import in node:
 0 && (module.exports = {
   AuditAuthGuard,
@@ -42,5 +42,5 @@ __reExport(index_exports, require("./facade/index.js"), module.exports);
   login,
   logout,
   useAuditAuth,
-  ...require("./facade/index.js")
+  ...require("./facade/index.cjs")
 });

package/dist/request.cjs

@@ -23,7 +23,7 @@ __export(request_exports, {
 });
 module.exports = __toCommonJS(request_exports);
 var import_headers = require("next/headers.js");
-var import_settings = require("./settings.js");
+var import_settings = require("./settings.cjs");
 var import_headers2 = require("next/headers.js");
 var import_core = require("@auditauth/core");
 const getRequestOrigin = async () => {

package/dist/sdk.cjs

@@ -23,9 +23,12 @@ __export(sdk_exports, {
 });
 module.exports = __toCommonJS(sdk_exports);
 var import_server = require("next/server.js");
-var import_settings = require("./settings.js");
+var import_settings = require("./settings.cjs");
 var import_core = require("@auditauth/core");
 var import_node = require("@auditauth/node");
+const CALLBACK_CODE_COOKIE = "auditauth_last_code";
+const CALLBACK_CODE_TTL_SECONDS = 120;
+const callbackInFlight = /* @__PURE__ */ new Map();
 class AuditAuthNext {
   constructor(config, cookies) {
     if (!config.appId) throw new Error("Missing appId");
@@ -44,8 +47,32 @@ class AuditAuthNext {
       refresh: this.cookies.get(import_settings.SETTINGS.storage_keys.refresh)
     };
   }
+  isSecureCookie() {
+    return this.config.redirectUrl.startsWith("https://");
+  }
+  hasAuthCookies() {
+    const { access, refresh } = this.getCookieTokens();
+    return !!(access && refresh);
+  }
+  getLastAuthorizedCode() {
+    return this.cookies.get(CALLBACK_CODE_COOKIE);
+  }
+  setLastAuthorizedCode(code) {
+    this.cookies.set(CALLBACK_CODE_COOKIE, code, {
+      httpOnly: true,
+      sameSite: "lax",
+      secure: this.isSecureCookie(),
+      path: "/",
+      maxAge: CALLBACK_CODE_TTL_SECONDS
+    });
+  }
+  isDuplicateCodeError(error) {
+    if (!(error instanceof Error)) return false;
+    const message = error.message.toLowerCase();
+    return message.includes("code not found");
+  }
   setCookieTokens(params) {
-    const isSecure = this.config.redirectUrl.includes("https");
+    const isSecure = this.isSecureCookie();
     this.cookies.set(
       import_settings.SETTINGS.storage_keys.access,
       params.access_token,
@@ -102,36 +129,61 @@ class AuditAuthNext {
   }
   async callback(request) {
     const code = new URL(request.url).searchParams.get("code");
-    try {
-      const { data } = await (0, import_core.authorizeCode)({ code, client_type: "server" });
-      const session = {
-        user: data.user
-      };
-      const isSecure = this.config.redirectUrl.includes("http");
-      this.cookies.set(
-        import_settings.SETTINGS.storage_keys.session,
-        JSON.stringify(session),
-        {
-          httpOnly: true,
-          sameSite: "lax",
-          secure: isSecure,
-          path: "/",
-          maxAge: data.refresh_expires_seconds - 60
-        }
-      );
-      this.setCookieTokens({
-        access_token: data.access_token,
-        access_expires_seconds: data.access_expires_seconds,
-        refresh_token: data.refresh_token,
-        refresh_expires_seconds: data.refresh_expires_seconds
-      });
-      return { ok: true, url: this.config.redirectUrl };
-    } catch {
+    if (!code) {
       return {
         ok: false,
         url: `${import_settings.SETTINGS.domains.client}/auth/invalid?reason=wrong_config`
       };
     }
+    const lastAuthorizedCode = this.getLastAuthorizedCode();
+    if (lastAuthorizedCode === code && (this.hasSession() || this.hasAuthCookies())) {
+      return { ok: true, url: this.config.redirectUrl };
+    }
+    const inFlight = callbackInFlight.get(code);
+    if (inFlight) return inFlight;
+    const authorizeRequest = (async () => {
+      try {
+        const { data } = await (0, import_core.authorizeCode)({ code, client_type: "server" });
+        const session = {
+          user: data.user
+        };
+        const isSecure = this.isSecureCookie();
+        this.cookies.set(
+          import_settings.SETTINGS.storage_keys.session,
+          JSON.stringify(session),
+          {
+            httpOnly: true,
+            sameSite: "lax",
+            secure: isSecure,
+            path: "/",
+            maxAge: data.refresh_expires_seconds - 60
+          }
+        );
+        this.setCookieTokens({
+          access_token: data.access_token,
+          access_expires_seconds: data.access_expires_seconds,
+          refresh_token: data.refresh_token,
+          refresh_expires_seconds: data.refresh_expires_seconds
+        });
+        this.setLastAuthorizedCode(code);
+        return { ok: true, url: this.config.redirectUrl };
+      } catch (error) {
+        if (this.isDuplicateCodeError(error) && (this.hasSession() || this.hasAuthCookies() || this.getLastAuthorizedCode() === code)) {
+          this.setLastAuthorizedCode(code);
+          return { ok: true, url: this.config.redirectUrl };
+        }
+        return {
+          ok: false,
+          url: `${import_settings.SETTINGS.domains.client}/auth/invalid?reason=wrong_config`
+        };
+      }
+    })();
+    callbackInFlight.set(code, authorizeRequest);
+    try {
+      return await authorizeRequest;
+    } finally {
+      callbackInFlight.delete(code);
+    }
   }
   async logout() {
     const { access } = this.getCookieTokens();
@@ -252,8 +304,8 @@ class AuditAuthNext {
             ;
           case "refresh":
             {
-              const { ok: ok2 } = await this.refresh();
-              if (ok2) return import_server.NextResponse.redirect(redirectUrl || this.config.redirectUrl);
+              const { ok } = await this.refresh();
+              if (ok) return import_server.NextResponse.redirect(redirectUrl || this.config.redirectUrl);
               const url = await (0, import_core.buildAuthUrl)({ apiKey: this.config.apiKey, redirectUrl: `${this.config.baseUrl}/api/auditauth/callback` });
               return import_server.NextResponse.redirect(url);
             }
@@ -313,8 +365,8 @@ class AuditAuthNext {
           case "refresh":
             {
               const redirectUrl = req.nextUrl.searchParams.get("redirectUrl");
-              const { ok: ok2 } = await this.refresh();
-              if (ok2) return import_server.NextResponse.redirect(redirectUrl || this.config.redirectUrl);
+              const { ok } = await this.refresh();
+              if (ok) return import_server.NextResponse.redirect(redirectUrl || this.config.redirectUrl);
               return new Response("Session expired", { status: 401 });
             }
             ;

package/dist/sdk.d.cts

@@ -8,6 +8,11 @@ declare class AuditAuthNext {
     private cookies;
     constructor(config: AuditAuthConfig, cookies: CookieAdapter);
     private getCookieTokens;
+    private isSecureCookie;
+    private hasAuthCookies;
+    private getLastAuthorizedCode;
+    private setLastAuthorizedCode;
+    private isDuplicateCodeError;
     private setCookieTokens;
     private pushMetric;
     getSession(): SessionUser | null;

package/dist/sdk.d.ts

@@ -8,6 +8,11 @@ declare class AuditAuthNext {
     private cookies;
     constructor(config: AuditAuthConfig, cookies: CookieAdapter);
     private getCookieTokens;
+    private isSecureCookie;
+    private hasAuthCookies;
+    private getLastAuthorizedCode;
+    private setLastAuthorizedCode;
+    private isDuplicateCodeError;
     private setCookieTokens;
     private pushMetric;
     getSession(): SessionUser | null;

package/dist/sdk.js

@@ -10,6 +10,9 @@ import {
   sendMetrics
 } from "@auditauth/core";
 import { verifyRequest } from "@auditauth/node";
+const CALLBACK_CODE_COOKIE = "auditauth_last_code";
+const CALLBACK_CODE_TTL_SECONDS = 120;
+const callbackInFlight = /* @__PURE__ */ new Map();
 class AuditAuthNext {
   constructor(config, cookies) {
     if (!config.appId) throw new Error("Missing appId");
@@ -28,8 +31,32 @@ class AuditAuthNext {
       refresh: this.cookies.get(SETTINGS.storage_keys.refresh)
     };
   }
+  isSecureCookie() {
+    return this.config.redirectUrl.startsWith("https://");
+  }
+  hasAuthCookies() {
+    const { access, refresh } = this.getCookieTokens();
+    return !!(access && refresh);
+  }
+  getLastAuthorizedCode() {
+    return this.cookies.get(CALLBACK_CODE_COOKIE);
+  }
+  setLastAuthorizedCode(code) {
+    this.cookies.set(CALLBACK_CODE_COOKIE, code, {
+      httpOnly: true,
+      sameSite: "lax",
+      secure: this.isSecureCookie(),
+      path: "/",
+      maxAge: CALLBACK_CODE_TTL_SECONDS
+    });
+  }
+  isDuplicateCodeError(error) {
+    if (!(error instanceof Error)) return false;
+    const message = error.message.toLowerCase();
+    return message.includes("code not found");
+  }
   setCookieTokens(params) {
-    const isSecure = this.config.redirectUrl.includes("https");
+    const isSecure = this.isSecureCookie();
     this.cookies.set(
       SETTINGS.storage_keys.access,
       params.access_token,
@@ -86,36 +113,61 @@ class AuditAuthNext {
   }
   async callback(request) {
     const code = new URL(request.url).searchParams.get("code");
-    try {
-      const { data } = await authorizeCode({ code, client_type: "server" });
-      const session = {
-        user: data.user
-      };
-      const isSecure = this.config.redirectUrl.includes("http");
-      this.cookies.set(
-        SETTINGS.storage_keys.session,
-        JSON.stringify(session),
-        {
-          httpOnly: true,
-          sameSite: "lax",
-          secure: isSecure,
-          path: "/",
-          maxAge: data.refresh_expires_seconds - 60
-        }
-      );
-      this.setCookieTokens({
-        access_token: data.access_token,
-        access_expires_seconds: data.access_expires_seconds,
-        refresh_token: data.refresh_token,
-        refresh_expires_seconds: data.refresh_expires_seconds
-      });
-      return { ok: true, url: this.config.redirectUrl };
-    } catch {
+    if (!code) {
       return {
         ok: false,
         url: `${SETTINGS.domains.client}/auth/invalid?reason=wrong_config`
       };
     }
+    const lastAuthorizedCode = this.getLastAuthorizedCode();
+    if (lastAuthorizedCode === code && (this.hasSession() || this.hasAuthCookies())) {
+      return { ok: true, url: this.config.redirectUrl };
+    }
+    const inFlight = callbackInFlight.get(code);
+    if (inFlight) return inFlight;
+    const authorizeRequest = (async () => {
+      try {
+        const { data } = await authorizeCode({ code, client_type: "server" });
+        const session = {
+          user: data.user
+        };
+        const isSecure = this.isSecureCookie();
+        this.cookies.set(
+          SETTINGS.storage_keys.session,
+          JSON.stringify(session),
+          {
+            httpOnly: true,
+            sameSite: "lax",
+            secure: isSecure,
+            path: "/",
+            maxAge: data.refresh_expires_seconds - 60
+          }
+        );
+        this.setCookieTokens({
+          access_token: data.access_token,
+          access_expires_seconds: data.access_expires_seconds,
+          refresh_token: data.refresh_token,
+          refresh_expires_seconds: data.refresh_expires_seconds
+        });
+        this.setLastAuthorizedCode(code);
+        return { ok: true, url: this.config.redirectUrl };
+      } catch (error) {
+        if (this.isDuplicateCodeError(error) && (this.hasSession() || this.hasAuthCookies() || this.getLastAuthorizedCode() === code)) {
+          this.setLastAuthorizedCode(code);
+          return { ok: true, url: this.config.redirectUrl };
+        }
+        return {
+          ok: false,
+          url: `${SETTINGS.domains.client}/auth/invalid?reason=wrong_config`
+        };
+      }
+    })();
+    callbackInFlight.set(code, authorizeRequest);
+    try {
+      return await authorizeRequest;
+    } finally {
+      callbackInFlight.delete(code);
+    }
   }
   async logout() {
     const { access } = this.getCookieTokens();
@@ -236,8 +288,8 @@ class AuditAuthNext {
             ;
           case "refresh":
             {
-              const { ok: ok2 } = await this.refresh();
-              if (ok2) return NextResponse.redirect(redirectUrl || this.config.redirectUrl);
+              const { ok } = await this.refresh();
+              if (ok) return NextResponse.redirect(redirectUrl || this.config.redirectUrl);
               const url = await buildAuthUrl({ apiKey: this.config.apiKey, redirectUrl: `${this.config.baseUrl}/api/auditauth/callback` });
               return NextResponse.redirect(url);
             }
@@ -297,8 +349,8 @@ class AuditAuthNext {
           case "refresh":
             {
               const redirectUrl = req.nextUrl.searchParams.get("redirectUrl");
-              const { ok: ok2 } = await this.refresh();
-              if (ok2) return NextResponse.redirect(redirectUrl || this.config.redirectUrl);
+              const { ok } = await this.refresh();
+              if (ok) return NextResponse.redirect(redirectUrl || this.config.redirectUrl);
               return new Response("Session expired", { status: 401 });
             }
             ;

package/dist/settings.d.cts

@@ -18,7 +18,7 @@ declare const SETTINGS: {
         readonly client: "https://auditauth.com";
     } | {
         readonly api: "http://localhost:4000/v1";
-        readonly client: "http://localhost:3000";
+        readonly client: "https://localhost:3000";
     };
     readonly storage_keys: {
         readonly access: "auditauth_access";

package/dist/settings.d.ts

@@ -18,7 +18,7 @@ declare const SETTINGS: {
         readonly client: "https://auditauth.com";
     } | {
         readonly api: "http://localhost:4000/v1";
-        readonly client: "http://localhost:3000";
+        readonly client: "https://localhost:3000";
     };
     readonly storage_keys: {
         readonly access: "auditauth_access";

package/package.json

@@ -1,6 +1,6 @@
 {
   "name": "@auditauth/next",
-  "version": "0.2.0-beta.3",
+  "version": "0.2.0-beta.5",
   "description": "AuditAuth NextJS SDK",
   "license": "MIT",
   "author": "Nimibyte",
@@ -42,7 +42,7 @@
     "./package.json": "./package.json"
   },
   "scripts": {
-    "build": "tsup",
+    "build": "tsup && node ../../scripts/fix-cjs-relative-imports.mjs dist",
     "dev": "tsup --watch",
     "clean": "rm -rf dist",
     "prepack": "npm run build"
@@ -53,8 +53,8 @@
     "react-dom": ">=18"
   },
   "dependencies": {
-    "@auditauth/core": "^0.2.0-beta.3",
-    "@auditauth/node": "^0.2.0-beta.3"
+    "@auditauth/core": "^0.2.0-beta.5",
+    "@auditauth/node": "^0.2.0-beta.5"
   },
   "devDependencies": {
     "typescript": "^5.9.0",