@augmenting-integrations/auth 4.1.2 → 4.1.3

package/dist/index.d.ts

@@ -0,0 +1,73 @@
+import { type DefaultSession, type Session } from "next-auth";
+declare module "next-auth" {
+    interface Session {
+        user: {
+            groups: string[];
+            role: string;
+        } & DefaultSession["user"];
+    }
+    interface User {
+        role?: string;
+        groups?: string[];
+    }
+}
+export type CreateAuthOptions = {
+    /** Path prefixes that require an authenticated session. */
+    authedRoutePrefixes: string[];
+    /**
+     * Page to redirect to when an unauthed user hits a gated route.
+     * If omitted, derived automatically from appDomain + allowedParentDomain:
+     * apex app gets `/login`; subdomain apps get `https://<apex>/login`.
+     */
+    signInPage?: string;
+    /**
+     * Cookie Domain attribute. In subdomain ecosystems, set to the parent
+     * (e.g. `.agency.aillc.link`). Default: process.env.AUTH_COOKIE_DOMAIN.
+     * In dev (NODE_ENV !== "production") this is ignored — cookies stay
+     * host-only so per-port localhost apps don't collide.
+     */
+    cookieDomain?: string;
+    /**
+     * The parent domain that all subdomain apps share (e.g.
+     * `.agency.aillc.link`). The redirect callback uses this to allow
+     * post-login redirects back to any subdomain of the parent (apex or
+     * `<sub>.agency.aillc.link`). Default: process.env.AUTH_ALLOWED_PARENT_DOMAIN.
+     */
+    allowedParentDomain?: string;
+    /**
+     * This app's full FQDN (e.g. `agency.aillc.link` for the apex app, or
+     * `leads.agency.aillc.link` for a subdomain app). Used to derive the
+     * default signInPage. Default: process.env.APP_DOMAIN.
+     */
+    appDomain?: string;
+    /** Override prod/dev detection. Default reads NODE_ENV. */
+    isProd?: boolean;
+    /**
+     * The JWT signing secret. Default: process.env.AUTH_SECRET.
+     * In prod, pass this from a runtime fetch (Secrets Manager) to keep the
+     * secret out of Lambda env vars and to support rotation without redeploy.
+     */
+    secret?: string;
+    cognito?: {
+        clientId?: string;
+        clientSecret?: string;
+        issuer?: string;
+    };
+};
+export declare class AuthError extends Error {
+    code: "unauthenticated" | "forbidden";
+    constructor(code: "unauthenticated" | "forbidden");
+}
+/** Returns the user's Cognito groups (always an array, possibly empty). */
+export declare function getUserGroups(session: Session | null | undefined): string[];
+/** Case-insensitive group membership check. */
+export declare function hasGroup(session: Session | null | undefined, name: string): boolean;
+/**
+ * Throws AuthError if no session (`unauthenticated`) or if the user is in
+ * none of the provided groups (`forbidden`). Pass multiple names to allow
+ * any-of.
+ */
+export declare function requireGroup(session: Session | null | undefined, ...names: string[]): void;
+export declare function createAuth(opts: CreateAuthOptions): import("next-auth").NextAuthResult;
+export type { NextAuthConfig } from "next-auth";
+//# sourceMappingURL=index.d.ts.map

package/dist/index.d.ts.map

@@ -0,0 +1 @@
+{"version":3,"file":"index.d.ts","sourceRoot":"","sources":["../src/index.ts"],"names":[],"mappings":"AAkBA,OAAiB,EACf,KAAK,cAAc,EAEnB,KAAK,OAAO,EACb,MAAM,WAAW,CAAC;AAInB,OAAO,QAAQ,WAAW,CAAC;IACzB,UAAU,OAAO;QACf,IAAI,EAAE;YACJ,MAAM,EAAE,MAAM,EAAE,CAAC;YACjB,IAAI,EAAE,MAAM,CAAC;SACd,GAAG,cAAc,CAAC,MAAM,CAAC,CAAC;KAC5B;IACD,UAAU,IAAI;QACZ,IAAI,CAAC,EAAE,MAAM,CAAC;QACd,MAAM,CAAC,EAAE,MAAM,EAAE,CAAC;KACnB;CACF;AAED,MAAM,MAAM,iBAAiB,GAAG;IAC9B,2DAA2D;IAC3D,mBAAmB,EAAE,MAAM,EAAE,CAAC;IAC9B;;;;OAIG;IACH,UAAU,CAAC,EAAE,MAAM,CAAC;IACpB;;;;;OAKG;IACH,YAAY,CAAC,EAAE,MAAM,CAAC;IACtB;;;;;OAKG;IACH,mBAAmB,CAAC,EAAE,MAAM,CAAC;IAC7B;;;;OAIG;IACH,SAAS,CAAC,EAAE,MAAM,CAAC;IACnB,2DAA2D;IAC3D,MAAM,CAAC,EAAE,OAAO,CAAC;IACjB;;;;OAIG;IACH,MAAM,CAAC,EAAE,MAAM,CAAC;IAChB,OAAO,CAAC,EAAE;QACR,QAAQ,CAAC,EAAE,MAAM,CAAC;QAClB,YAAY,CAAC,EAAE,MAAM,CAAC;QACtB,MAAM,CAAC,EAAE,MAAM,CAAC;KACjB,CAAC;CACH,CAAC;AAIF,qBAAa,SAAU,SAAQ,KAAK;IACf,IAAI,EAAE,iBAAiB,GAAG,WAAW;gBAArC,IAAI,EAAE,iBAAiB,GAAG,WAAW;CAIzD;AAID,2EAA2E;AAC3E,wBAAgB,aAAa,CAAC,OAAO,EAAE,OAAO,GAAG,IAAI,GAAG,SAAS,GAAG,MAAM,EAAE,CAE3E;AAED,+CAA+C;AAC/C,wBAAgB,QAAQ,CAAC,OAAO,EAAE,OAAO,GAAG,IAAI,GAAG,SAAS,EAAE,IAAI,EAAE,MAAM,GAAG,OAAO,CAInF;AAED;;;;GAIG;AACH,wBAAgB,YAAY,CAC1B,OAAO,EAAE,OAAO,GAAG,IAAI,GAAG,SAAS,EACnC,GAAG,KAAK,EAAE,MAAM,EAAE,GACjB,IAAI,CAKN;AAyFD,wBAAgB,UAAU,CAAC,IAAI,EAAE,iBAAiB,sCAkIjD;AAED,YAAY,EAAE,cAAc,EAAE,MAAM,WAAW,CAAC"}

package/package.json

@@ -1,6 +1,6 @@
 {
   "name": "@augmenting-integrations/auth",
-  "version": "4.1.2",
+  "version": "4.1.3",
   "description": "Auth.js v5 factory: Cognito in prod, Credentials role-picker in dev. Same JWT shape (sub, email, cognito:groups) regardless of provider.",
   "license": "MIT",
   "publishConfig": {