@auditauth/next 0.2.0-beta.4 → 0.2.0-beta.5

package/dist/sdk.cjs

@@ -26,6 +26,9 @@ var import_server = require("next/server.js");
 var import_settings = require("./settings.cjs");
 var import_core = require("@auditauth/core");
 var import_node = require("@auditauth/node");
+const CALLBACK_CODE_COOKIE = "auditauth_last_code";
+const CALLBACK_CODE_TTL_SECONDS = 120;
+const callbackInFlight = /* @__PURE__ */ new Map();
 class AuditAuthNext {
   constructor(config, cookies) {
     if (!config.appId) throw new Error("Missing appId");
@@ -44,8 +47,32 @@ class AuditAuthNext {
       refresh: this.cookies.get(import_settings.SETTINGS.storage_keys.refresh)
     };
   }
+  isSecureCookie() {
+    return this.config.redirectUrl.startsWith("https://");
+  }
+  hasAuthCookies() {
+    const { access, refresh } = this.getCookieTokens();
+    return !!(access && refresh);
+  }
+  getLastAuthorizedCode() {
+    return this.cookies.get(CALLBACK_CODE_COOKIE);
+  }
+  setLastAuthorizedCode(code) {
+    this.cookies.set(CALLBACK_CODE_COOKIE, code, {
+      httpOnly: true,
+      sameSite: "lax",
+      secure: this.isSecureCookie(),
+      path: "/",
+      maxAge: CALLBACK_CODE_TTL_SECONDS
+    });
+  }
+  isDuplicateCodeError(error) {
+    if (!(error instanceof Error)) return false;
+    const message = error.message.toLowerCase();
+    return message.includes("code not found");
+  }
   setCookieTokens(params) {
-    const isSecure = this.config.redirectUrl.includes("https");
+    const isSecure = this.isSecureCookie();
     this.cookies.set(
       import_settings.SETTINGS.storage_keys.access,
       params.access_token,
@@ -102,36 +129,61 @@ class AuditAuthNext {
   }
   async callback(request) {
     const code = new URL(request.url).searchParams.get("code");
-    try {
-      const { data } = await (0, import_core.authorizeCode)({ code, client_type: "server" });
-      const session = {
-        user: data.user
-      };
-      const isSecure = this.config.redirectUrl.includes("http");
-      this.cookies.set(
-        import_settings.SETTINGS.storage_keys.session,
-        JSON.stringify(session),
-        {
-          httpOnly: true,
-          sameSite: "lax",
-          secure: isSecure,
-          path: "/",
-          maxAge: data.refresh_expires_seconds - 60
-        }
-      );
-      this.setCookieTokens({
-        access_token: data.access_token,
-        access_expires_seconds: data.access_expires_seconds,
-        refresh_token: data.refresh_token,
-        refresh_expires_seconds: data.refresh_expires_seconds
-      });
-      return { ok: true, url: this.config.redirectUrl };
-    } catch {
+    if (!code) {
       return {
         ok: false,
         url: `${import_settings.SETTINGS.domains.client}/auth/invalid?reason=wrong_config`
       };
     }
+    const lastAuthorizedCode = this.getLastAuthorizedCode();
+    if (lastAuthorizedCode === code && (this.hasSession() || this.hasAuthCookies())) {
+      return { ok: true, url: this.config.redirectUrl };
+    }
+    const inFlight = callbackInFlight.get(code);
+    if (inFlight) return inFlight;
+    const authorizeRequest = (async () => {
+      try {
+        const { data } = await (0, import_core.authorizeCode)({ code, client_type: "server" });
+        const session = {
+          user: data.user
+        };
+        const isSecure = this.isSecureCookie();
+        this.cookies.set(
+          import_settings.SETTINGS.storage_keys.session,
+          JSON.stringify(session),
+          {
+            httpOnly: true,
+            sameSite: "lax",
+            secure: isSecure,
+            path: "/",
+            maxAge: data.refresh_expires_seconds - 60
+          }
+        );
+        this.setCookieTokens({
+          access_token: data.access_token,
+          access_expires_seconds: data.access_expires_seconds,
+          refresh_token: data.refresh_token,
+          refresh_expires_seconds: data.refresh_expires_seconds
+        });
+        this.setLastAuthorizedCode(code);
+        return { ok: true, url: this.config.redirectUrl };
+      } catch (error) {
+        if (this.isDuplicateCodeError(error) && (this.hasSession() || this.hasAuthCookies() || this.getLastAuthorizedCode() === code)) {
+          this.setLastAuthorizedCode(code);
+          return { ok: true, url: this.config.redirectUrl };
+        }
+        return {
+          ok: false,
+          url: `${import_settings.SETTINGS.domains.client}/auth/invalid?reason=wrong_config`
+        };
+      }
+    })();
+    callbackInFlight.set(code, authorizeRequest);
+    try {
+      return await authorizeRequest;
+    } finally {
+      callbackInFlight.delete(code);
+    }
   }
   async logout() {
     const { access } = this.getCookieTokens();
@@ -252,8 +304,8 @@ class AuditAuthNext {
             ;
           case "refresh":
             {
-              const { ok: ok2 } = await this.refresh();
-              if (ok2) return import_server.NextResponse.redirect(redirectUrl || this.config.redirectUrl);
+              const { ok } = await this.refresh();
+              if (ok) return import_server.NextResponse.redirect(redirectUrl || this.config.redirectUrl);
               const url = await (0, import_core.buildAuthUrl)({ apiKey: this.config.apiKey, redirectUrl: `${this.config.baseUrl}/api/auditauth/callback` });
               return import_server.NextResponse.redirect(url);
             }
@@ -313,8 +365,8 @@ class AuditAuthNext {
           case "refresh":
             {
               const redirectUrl = req.nextUrl.searchParams.get("redirectUrl");
-              const { ok: ok2 } = await this.refresh();
-              if (ok2) return import_server.NextResponse.redirect(redirectUrl || this.config.redirectUrl);
+              const { ok } = await this.refresh();
+              if (ok) return import_server.NextResponse.redirect(redirectUrl || this.config.redirectUrl);
               return new Response("Session expired", { status: 401 });
             }
             ;

package/dist/sdk.d.cts

@@ -8,6 +8,11 @@ declare class AuditAuthNext {
     private cookies;
     constructor(config: AuditAuthConfig, cookies: CookieAdapter);
     private getCookieTokens;
+    private isSecureCookie;
+    private hasAuthCookies;
+    private getLastAuthorizedCode;
+    private setLastAuthorizedCode;
+    private isDuplicateCodeError;
     private setCookieTokens;
     private pushMetric;
     getSession(): SessionUser | null;

package/dist/sdk.d.ts

@@ -8,6 +8,11 @@ declare class AuditAuthNext {
     private cookies;
     constructor(config: AuditAuthConfig, cookies: CookieAdapter);
     private getCookieTokens;
+    private isSecureCookie;
+    private hasAuthCookies;
+    private getLastAuthorizedCode;
+    private setLastAuthorizedCode;
+    private isDuplicateCodeError;
     private setCookieTokens;
     private pushMetric;
     getSession(): SessionUser | null;

package/dist/sdk.js

@@ -10,6 +10,9 @@ import {
   sendMetrics
 } from "@auditauth/core";
 import { verifyRequest } from "@auditauth/node";
+const CALLBACK_CODE_COOKIE = "auditauth_last_code";
+const CALLBACK_CODE_TTL_SECONDS = 120;
+const callbackInFlight = /* @__PURE__ */ new Map();
 class AuditAuthNext {
   constructor(config, cookies) {
     if (!config.appId) throw new Error("Missing appId");
@@ -28,8 +31,32 @@ class AuditAuthNext {
       refresh: this.cookies.get(SETTINGS.storage_keys.refresh)
     };
   }
+  isSecureCookie() {
+    return this.config.redirectUrl.startsWith("https://");
+  }
+  hasAuthCookies() {
+    const { access, refresh } = this.getCookieTokens();
+    return !!(access && refresh);
+  }
+  getLastAuthorizedCode() {
+    return this.cookies.get(CALLBACK_CODE_COOKIE);
+  }
+  setLastAuthorizedCode(code) {
+    this.cookies.set(CALLBACK_CODE_COOKIE, code, {
+      httpOnly: true,
+      sameSite: "lax",
+      secure: this.isSecureCookie(),
+      path: "/",
+      maxAge: CALLBACK_CODE_TTL_SECONDS
+    });
+  }
+  isDuplicateCodeError(error) {
+    if (!(error instanceof Error)) return false;
+    const message = error.message.toLowerCase();
+    return message.includes("code not found");
+  }
   setCookieTokens(params) {
-    const isSecure = this.config.redirectUrl.includes("https");
+    const isSecure = this.isSecureCookie();
     this.cookies.set(
       SETTINGS.storage_keys.access,
       params.access_token,
@@ -86,36 +113,61 @@ class AuditAuthNext {
   }
   async callback(request) {
     const code = new URL(request.url).searchParams.get("code");
-    try {
-      const { data } = await authorizeCode({ code, client_type: "server" });
-      const session = {
-        user: data.user
-      };
-      const isSecure = this.config.redirectUrl.includes("http");
-      this.cookies.set(
-        SETTINGS.storage_keys.session,
-        JSON.stringify(session),
-        {
-          httpOnly: true,
-          sameSite: "lax",
-          secure: isSecure,
-          path: "/",
-          maxAge: data.refresh_expires_seconds - 60
-        }
-      );
-      this.setCookieTokens({
-        access_token: data.access_token,
-        access_expires_seconds: data.access_expires_seconds,
-        refresh_token: data.refresh_token,
-        refresh_expires_seconds: data.refresh_expires_seconds
-      });
-      return { ok: true, url: this.config.redirectUrl };
-    } catch {
+    if (!code) {
       return {
         ok: false,
         url: `${SETTINGS.domains.client}/auth/invalid?reason=wrong_config`
       };
     }
+    const lastAuthorizedCode = this.getLastAuthorizedCode();
+    if (lastAuthorizedCode === code && (this.hasSession() || this.hasAuthCookies())) {
+      return { ok: true, url: this.config.redirectUrl };
+    }
+    const inFlight = callbackInFlight.get(code);
+    if (inFlight) return inFlight;
+    const authorizeRequest = (async () => {
+      try {
+        const { data } = await authorizeCode({ code, client_type: "server" });
+        const session = {
+          user: data.user
+        };
+        const isSecure = this.isSecureCookie();
+        this.cookies.set(
+          SETTINGS.storage_keys.session,
+          JSON.stringify(session),
+          {
+            httpOnly: true,
+            sameSite: "lax",
+            secure: isSecure,
+            path: "/",
+            maxAge: data.refresh_expires_seconds - 60
+          }
+        );
+        this.setCookieTokens({
+          access_token: data.access_token,
+          access_expires_seconds: data.access_expires_seconds,
+          refresh_token: data.refresh_token,
+          refresh_expires_seconds: data.refresh_expires_seconds
+        });
+        this.setLastAuthorizedCode(code);
+        return { ok: true, url: this.config.redirectUrl };
+      } catch (error) {
+        if (this.isDuplicateCodeError(error) && (this.hasSession() || this.hasAuthCookies() || this.getLastAuthorizedCode() === code)) {
+          this.setLastAuthorizedCode(code);
+          return { ok: true, url: this.config.redirectUrl };
+        }
+        return {
+          ok: false,
+          url: `${SETTINGS.domains.client}/auth/invalid?reason=wrong_config`
+        };
+      }
+    })();
+    callbackInFlight.set(code, authorizeRequest);
+    try {
+      return await authorizeRequest;
+    } finally {
+      callbackInFlight.delete(code);
+    }
   }
   async logout() {
     const { access } = this.getCookieTokens();
@@ -236,8 +288,8 @@ class AuditAuthNext {
             ;
           case "refresh":
             {
-              const { ok: ok2 } = await this.refresh();
-              if (ok2) return NextResponse.redirect(redirectUrl || this.config.redirectUrl);
+              const { ok } = await this.refresh();
+              if (ok) return NextResponse.redirect(redirectUrl || this.config.redirectUrl);
               const url = await buildAuthUrl({ apiKey: this.config.apiKey, redirectUrl: `${this.config.baseUrl}/api/auditauth/callback` });
               return NextResponse.redirect(url);
             }
@@ -297,8 +349,8 @@ class AuditAuthNext {
           case "refresh":
             {
               const redirectUrl = req.nextUrl.searchParams.get("redirectUrl");
-              const { ok: ok2 } = await this.refresh();
-              if (ok2) return NextResponse.redirect(redirectUrl || this.config.redirectUrl);
+              const { ok } = await this.refresh();
+              if (ok) return NextResponse.redirect(redirectUrl || this.config.redirectUrl);
               return new Response("Session expired", { status: 401 });
             }
             ;

package/dist/settings.d.cts

@@ -14,11 +14,11 @@ declare const SETTINGS: {
     readonly jwt_public_key: "-----BEGIN PUBLIC KEY-----\nMIIBIjANBgkqhkiG9w0BAQEFAAOCAQ8AMIIBCgKCAQEAs2EYs4Q9OyjNuAEPqb4j\nIzc52JdfVcNvEbG43Xp8B2kI9QxwRyX7rtFSwKowj3W1BlCLaTIMK3TafWOf9QwH\nfemuL9Ni37PFcGptzpyuoCYYA650EuD82PENcO49lsObvty2cuXxQszbPPvAecm4\nJ/XG70td/W1UwbjAJcdmp8ktZGYR0JXM37hYA9Xq/aKwu7d0FTL6WdKTvt3L5VxL\nF6WNyLs65ZSbu+j8UEkwmoJ9h9Y0mLQmFtmkoh/HWOFyFDnBNiJX0vRb++RhJw6w\ncrSbqpbTu7z4vIep5lgSOut39P273SVTQZ3cGQIS+605Ur5wjkkSzzaJV1QLBBR9\nAQIDAQAB\n-----END PUBLIC KEY-----\n";
     readonly jwt_issuer: "https://api.auditauth.com";
     readonly domains: {
-        readonly api: "http://localhost:4000/v1";
-        readonly client: "http://localhost:3000";
-    } | {
         readonly api: "https://api.auditauth.com/v1";
         readonly client: "https://auditauth.com";
+    } | {
+        readonly api: "http://localhost:4000/v1";
+        readonly client: "https://localhost:3000";
     };
     readonly storage_keys: {
         readonly access: "auditauth_access";

package/dist/settings.d.ts

@@ -14,11 +14,11 @@ declare const SETTINGS: {
     readonly jwt_public_key: "-----BEGIN PUBLIC KEY-----\nMIIBIjANBgkqhkiG9w0BAQEFAAOCAQ8AMIIBCgKCAQEAs2EYs4Q9OyjNuAEPqb4j\nIzc52JdfVcNvEbG43Xp8B2kI9QxwRyX7rtFSwKowj3W1BlCLaTIMK3TafWOf9QwH\nfemuL9Ni37PFcGptzpyuoCYYA650EuD82PENcO49lsObvty2cuXxQszbPPvAecm4\nJ/XG70td/W1UwbjAJcdmp8ktZGYR0JXM37hYA9Xq/aKwu7d0FTL6WdKTvt3L5VxL\nF6WNyLs65ZSbu+j8UEkwmoJ9h9Y0mLQmFtmkoh/HWOFyFDnBNiJX0vRb++RhJw6w\ncrSbqpbTu7z4vIep5lgSOut39P273SVTQZ3cGQIS+605Ur5wjkkSzzaJV1QLBBR9\nAQIDAQAB\n-----END PUBLIC KEY-----\n";
     readonly jwt_issuer: "https://api.auditauth.com";
     readonly domains: {
-        readonly api: "http://localhost:4000/v1";
-        readonly client: "http://localhost:3000";
-    } | {
         readonly api: "https://api.auditauth.com/v1";
         readonly client: "https://auditauth.com";
+    } | {
+        readonly api: "http://localhost:4000/v1";
+        readonly client: "https://localhost:3000";
     };
     readonly storage_keys: {
         readonly access: "auditauth_access";

package/package.json

@@ -1,6 +1,6 @@
 {
   "name": "@auditauth/next",
-  "version": "0.2.0-beta.4",
+  "version": "0.2.0-beta.5",
   "description": "AuditAuth NextJS SDK",
   "license": "MIT",
   "author": "Nimibyte",
@@ -53,8 +53,8 @@
     "react-dom": ">=18"
   },
   "dependencies": {
-    "@auditauth/core": "^0.2.0-beta.4",
-    "@auditauth/node": "^0.2.0-beta.4"
+    "@auditauth/core": "^0.2.0-beta.5",
+    "@auditauth/node": "^0.2.0-beta.5"
   },
   "devDependencies": {
     "typescript": "^5.9.0",