@auth-gate/nextjs 0.1.0

package/dist/index.mjs

@@ -0,0 +1,608 @@
+// src/index.ts
+import { createAuthGateClient } from "@auth-gate/core";
+
+// src/session.ts
+import { cookies } from "next/headers";
+function createSessionHelpers(client) {
+  async function getSession() {
+    const cookieStore = await cookies();
+    const cookie = cookieStore.get(client.cookieName);
+    if (!cookie) return null;
+    return client.decryptSession(cookie.value);
+  }
+  async function setSession(user) {
+    const cookieStore = await cookies();
+    const encrypted = await client.encryptSession(user);
+    const options = client.getSessionCookieOptions();
+    cookieStore.set(client.cookieName, encrypted, options);
+  }
+  async function clearSession() {
+    const cookieStore = await cookies();
+    cookieStore.set(client.cookieName, "", {
+      httpOnly: true,
+      secure: process.env.NODE_ENV === "production",
+      sameSite: "lax",
+      maxAge: 0,
+      path: "/"
+    });
+    cookieStore.set(client.refreshTokenCookieName, "", {
+      httpOnly: true,
+      secure: process.env.NODE_ENV === "production",
+      sameSite: "lax",
+      maxAge: 0,
+      path: "/"
+    });
+  }
+  return { getSession, setSession, clearSession };
+}
+
+// src/handlers.ts
+import { cookies as cookies2 } from "next/headers";
+import { NextResponse } from "next/server";
+import { SUPPORTED_PROVIDERS } from "@auth-gate/core";
+function createHandlers(client, appUrl) {
+  const { getSession, setSession, clearSession } = createSessionHelpers(client);
+  async function providerLogin(_request, { params }) {
+    const { provider } = await params;
+    if (!SUPPORTED_PROVIDERS.includes(provider)) {
+      return NextResponse.json(
+        { error: "Unsupported provider" },
+        { status: 400 }
+      );
+    }
+    const { state, nonce } = await client.createState();
+    const cookieStore = await cookies2();
+    cookieStore.set(client.nonceCookieName, nonce, client.getNonceCookieOptions());
+    const callbackUrl = `${appUrl}${client.callbackPath}`;
+    const authUrl = client.getOAuthUrl(provider, callbackUrl);
+    const url = new URL(authUrl);
+    url.searchParams.set("state", state);
+    return NextResponse.redirect(url);
+  }
+  async function callback(request) {
+    var _a;
+    const token = request.nextUrl.searchParams.get("token");
+    const state = request.nextUrl.searchParams.get("state");
+    const mfaChallenge = request.nextUrl.searchParams.get("mfa_challenge");
+    const mfaMethods = request.nextUrl.searchParams.get("mfa_methods");
+    const mfaSetupRequired = request.nextUrl.searchParams.get("mfa_setup_required");
+    const refreshToken = request.nextUrl.searchParams.get("refresh_token");
+    if (mfaChallenge) {
+      const mfaUrl = new URL("/mfa-verify", request.url);
+      mfaUrl.searchParams.set("mfa_challenge", mfaChallenge);
+      if (mfaMethods) mfaUrl.searchParams.set("mfa_methods", mfaMethods);
+      return NextResponse.redirect(mfaUrl);
+    }
+    if (!token) {
+      return NextResponse.redirect(
+        new URL("/login?error=missing_token", request.url)
+      );
+    }
+    if (state) {
+      const cookieStore = await cookies2();
+      const nonce = (_a = cookieStore.get(client.nonceCookieName)) == null ? void 0 : _a.value;
+      cookieStore.set(client.nonceCookieName, "", {
+        httpOnly: true,
+        secure: process.env.NODE_ENV === "production",
+        sameSite: "lax",
+        maxAge: 0,
+        path: "/"
+      });
+      if (!nonce || !await client.verifyState(state, nonce)) {
+        return NextResponse.redirect(
+          new URL("/login?error=invalid_state", request.url)
+        );
+      }
+    }
+    const result = await client.verifyToken(token);
+    if (!result.valid || !result.user) {
+      return NextResponse.redirect(
+        new URL("/login?error=invalid_token", request.url)
+      );
+    }
+    await setSession(result.user);
+    if (refreshToken) {
+      const cookieStore = await cookies2();
+      cookieStore.set(client.refreshTokenCookieName, refreshToken, {
+        httpOnly: true,
+        secure: process.env.NODE_ENV === "production",
+        sameSite: "lax",
+        maxAge: client.sessionMaxAge,
+        path: "/"
+      });
+    }
+    if (mfaSetupRequired) {
+      return NextResponse.redirect(new URL("/mfa-setup", request.url));
+    }
+    return NextResponse.redirect(new URL("/dashboard", request.url));
+  }
+  async function emailSignup(request) {
+    const body = await request.json();
+    const { email, password, name } = body;
+    if (!email || !password) {
+      return NextResponse.json(
+        { error: "Missing email or password" },
+        { status: 400 }
+      );
+    }
+    const response = await client.emailSignup({
+      email,
+      password,
+      name,
+      callbackUrl: `${appUrl}${client.callbackPath}`
+    });
+    if (!response.ok) {
+      const error = await response.json().catch(() => ({ error: "Request failed" }));
+      return NextResponse.json(error, { status: response.status });
+    }
+    const data = await response.json().catch(() => ({ error: "Request failed" }));
+    const verified = await client.verifyToken(data.token);
+    if (!verified.valid || !verified.user) {
+      return NextResponse.json(
+        { error: "Token verification failed" },
+        { status: 401 }
+      );
+    }
+    await setSession(verified.user);
+    if (data.refresh_token) {
+      const cookieStore = await cookies2();
+      cookieStore.set(client.refreshTokenCookieName, data.refresh_token, {
+        httpOnly: true,
+        secure: process.env.NODE_ENV === "production",
+        sameSite: "lax",
+        maxAge: client.sessionMaxAge,
+        path: "/"
+      });
+    }
+    return NextResponse.json({ success: true, redirect: "/dashboard" });
+  }
+  async function emailSignin(request) {
+    const body = await request.json();
+    const { email, password } = body;
+    if (!email || !password) {
+      return NextResponse.json(
+        { error: "Missing email or password" },
+        { status: 400 }
+      );
+    }
+    const response = await client.emailSignin({
+      email,
+      password,
+      callbackUrl: `${appUrl}${client.callbackPath}`
+    });
+    if (!response.ok) {
+      const error = await response.json().catch(() => ({ error: "Request failed" }));
+      return NextResponse.json(error, { status: response.status });
+    }
+    const data = await response.json().catch(() => ({ error: "Request failed" }));
+    if (data.mfa_required) {
+      return NextResponse.json({
+        mfa_required: true,
+        mfa_challenge: data.mfa_challenge,
+        mfa_methods: data.mfa_methods
+      });
+    }
+    const verified = await client.verifyToken(data.token);
+    if (!verified.valid || !verified.user) {
+      return NextResponse.json(
+        { error: "Token verification failed" },
+        { status: 401 }
+      );
+    }
+    await setSession(verified.user);
+    if (data.refresh_token) {
+      const cookieStore = await cookies2();
+      cookieStore.set(client.refreshTokenCookieName, data.refresh_token, {
+        httpOnly: true,
+        secure: process.env.NODE_ENV === "production",
+        sameSite: "lax",
+        maxAge: client.sessionMaxAge,
+        path: "/"
+      });
+    }
+    return NextResponse.json({
+      success: true,
+      redirect: data.mfa_setup_required ? "/mfa-setup" : "/dashboard"
+    });
+  }
+  async function emailForgotPassword(request) {
+    const body = await request.json();
+    const { email } = body;
+    if (!email) {
+      return NextResponse.json(
+        { error: "Missing email" },
+        { status: 400 }
+      );
+    }
+    const response = await client.emailForgotPassword({
+      email,
+      callbackUrl: `${appUrl}/reset-password`
+    });
+    if (!response.ok) {
+      const error = await response.json().catch(() => ({ error: "Request failed" }));
+      return NextResponse.json(error, { status: response.status });
+    }
+    return NextResponse.json({ success: true });
+  }
+  async function emailResetPassword(request) {
+    const body = await request.json();
+    const { token, password } = body;
+    if (!token || !password) {
+      return NextResponse.json(
+        { error: "Missing token or password" },
+        { status: 400 }
+      );
+    }
+    const response = await client.emailResetPassword({ token, password });
+    if (!response.ok) {
+      const error = await response.json().catch(() => ({ error: "Request failed" }));
+      return NextResponse.json(error, { status: response.status });
+    }
+    const data = await response.json().catch(() => ({ error: "Request failed" }));
+    if (data.token) {
+      const verified = await client.verifyToken(data.token);
+      if (verified.valid && verified.user) {
+        await setSession(verified.user);
+        return NextResponse.json({
+          success: true,
+          redirect: "/dashboard"
+        });
+      }
+    }
+    return NextResponse.json({ success: true, redirect: "/login" });
+  }
+  async function magicLinkSend(request) {
+    const body = await request.json();
+    const { email } = body;
+    if (!email) {
+      return NextResponse.json(
+        { error: "Missing email" },
+        { status: 400 }
+      );
+    }
+    const response = await client.magicLinkSend({
+      email,
+      callbackUrl: `${appUrl}${client.callbackPath}`
+    });
+    if (!response.ok) {
+      const error = await response.json().catch(() => ({ error: "Request failed" }));
+      return NextResponse.json(error, { status: response.status });
+    }
+    return NextResponse.json({ success: true });
+  }
+  async function emailVerifyCode(request) {
+    const body = await request.json();
+    const { email, code } = body;
+    if (!email || !code) {
+      return NextResponse.json(
+        { error: "Missing email or code" },
+        { status: 400 }
+      );
+    }
+    const response = await client.emailVerifyCode({ email, code });
+    if (!response.ok) {
+      const error = await response.json().catch(() => ({ error: "Request failed" }));
+      return NextResponse.json(error, { status: response.status });
+    }
+    return NextResponse.json({ success: true, email_verified: true });
+  }
+  async function smsSendCode(request) {
+    const body = await request.json();
+    const { phone } = body;
+    if (!phone) {
+      return NextResponse.json(
+        { error: "Missing phone number" },
+        { status: 400 }
+      );
+    }
+    const response = await client.smsSendCode({
+      phone,
+      callbackUrl: `${appUrl}${client.callbackPath}`
+    });
+    if (!response.ok) {
+      const error = await response.json().catch(() => ({ error: "Request failed" }));
+      return NextResponse.json(error, { status: response.status });
+    }
+    return NextResponse.json({ success: true });
+  }
+  async function smsVerifyCode(request) {
+    const body = await request.json();
+    const { phone, code } = body;
+    if (!phone || !code) {
+      return NextResponse.json(
+        { error: "Missing phone or code" },
+        { status: 400 }
+      );
+    }
+    const response = await client.smsVerifyCode({
+      phone,
+      code,
+      callbackUrl: `${appUrl}${client.callbackPath}`
+    });
+    if (!response.ok) {
+      const error = await response.json().catch(() => ({ error: "Request failed" }));
+      return NextResponse.json(error, { status: response.status });
+    }
+    const data = await response.json().catch(() => ({ error: "Request failed" }));
+    const verified = await client.verifyToken(data.token);
+    if (!verified.valid || !verified.user) {
+      return NextResponse.json(
+        { error: "Token verification failed" },
+        { status: 401 }
+      );
+    }
+    await setSession(verified.user);
+    return NextResponse.json({ success: true, redirect: "/dashboard" });
+  }
+  async function mfaVerify(request) {
+    const body = await request.json();
+    const { challenge, code, method } = body;
+    if (!challenge || !code || !method) {
+      return NextResponse.json(
+        { error: "Missing challenge, code, or method" },
+        { status: 400 }
+      );
+    }
+    const response = await client.mfaVerify({ challenge, code, method });
+    if (!response.ok) {
+      const error = await response.json().catch(() => ({ error: "Request failed" }));
+      return NextResponse.json(error, { status: response.status });
+    }
+    const data = await response.json();
+    const verified = await client.verifyToken(data.token);
+    if (!verified.valid || !verified.user) {
+      return NextResponse.json(
+        { error: "Token verification failed" },
+        { status: 401 }
+      );
+    }
+    await setSession(verified.user);
+    if (data.refresh_token) {
+      const cookieStore = await cookies2();
+      cookieStore.set(client.refreshTokenCookieName, data.refresh_token, {
+        httpOnly: true,
+        secure: process.env.NODE_ENV === "production",
+        sameSite: "lax",
+        maxAge: client.sessionMaxAge,
+        path: "/"
+      });
+    }
+    return NextResponse.json({ success: true, redirect: "/dashboard" });
+  }
+  async function mfaTotpSetup() {
+    const cookieStore = await cookies2();
+    const sessionCookie = cookieStore.get(client.cookieName);
+    if (!sessionCookie) {
+      return NextResponse.json({ error: "Unauthorized" }, { status: 401 });
+    }
+    return NextResponse.json(
+      { error: "Call /api/proxy/mfa/totp/setup directly with Bearer JWT" },
+      { status: 400 }
+    );
+  }
+  async function refresh() {
+    const cookieStore = await cookies2();
+    const refreshCookie = cookieStore.get(client.refreshTokenCookieName);
+    if (!(refreshCookie == null ? void 0 : refreshCookie.value)) {
+      return NextResponse.json(
+        { error: "No refresh token" },
+        { status: 401 }
+      );
+    }
+    const result = await client.refreshToken(refreshCookie.value);
+    if (!result) {
+      return NextResponse.json(
+        { error: "Invalid refresh token" },
+        { status: 401 }
+      );
+    }
+    const verified = await client.verifyToken(result.token);
+    if (verified.valid && verified.user) {
+      await setSession(verified.user);
+    }
+    return NextResponse.json({ success: true, token: result.token });
+  }
+  async function logout() {
+    const cookieStore = await cookies2();
+    const refreshCookie = cookieStore.get(client.refreshTokenCookieName);
+    if (refreshCookie == null ? void 0 : refreshCookie.value) {
+      await client.revokeSession(refreshCookie.value);
+      cookieStore.set(client.refreshTokenCookieName, "", {
+        httpOnly: true,
+        secure: process.env.NODE_ENV === "production",
+        sameSite: "lax",
+        maxAge: 0,
+        path: "/"
+      });
+    }
+    await clearSession();
+    return NextResponse.redirect(new URL("/", appUrl));
+  }
+  async function me() {
+    const user = await getSession();
+    if (!user) {
+      return NextResponse.json({ user: null });
+    }
+    const cookieStore = await cookies2();
+    const refreshCookie = cookieStore.get(client.refreshTokenCookieName);
+    if (refreshCookie == null ? void 0 : refreshCookie.value) {
+      const result = await client.refreshToken(refreshCookie.value);
+      if (!result) {
+        await clearSession();
+        return NextResponse.json({ user: null });
+      }
+      const verified = await client.verifyToken(result.token);
+      if (verified.valid && verified.user) {
+        await setSession(verified.user);
+        return NextResponse.json({ user: verified.user });
+      }
+    }
+    return NextResponse.json({ user });
+  }
+  return {
+    providerLogin,
+    callback,
+    emailSignup,
+    emailSignin,
+    emailForgotPassword,
+    emailResetPassword,
+    emailVerifyCode,
+    magicLinkSend,
+    smsSendCode,
+    smsVerifyCode,
+    mfaVerify,
+    mfaTotpSetup,
+    refresh,
+    logout,
+    me
+  };
+}
+function createCatchAllHandler(client, appUrl) {
+  const handlers = createHandlers(client, appUrl);
+  async function GET(request, context) {
+    const { authgate: segments } = await context.params;
+    const path = segments.join("/");
+    if (segments.length === 2 && segments[1] === "login") {
+      return handlers.providerLogin(request, {
+        params: Promise.resolve({ provider: segments[0] })
+      });
+    }
+    if (path === "callback") {
+      return handlers.callback(request);
+    }
+    if (path === "me") {
+      return handlers.me();
+    }
+    return NextResponse.json({ error: "Not found" }, { status: 404 });
+  }
+  async function POST(request, context) {
+    const { authgate: segments } = await context.params;
+    const path = segments.join("/");
+    switch (path) {
+      case "email/signup":
+        return handlers.emailSignup(request);
+      case "email/signin":
+        return handlers.emailSignin(request);
+      case "email/forgot-password":
+        return handlers.emailForgotPassword(request);
+      case "email/reset-password":
+        return handlers.emailResetPassword(request);
+      case "email/verify-code":
+        return handlers.emailVerifyCode(request);
+      case "magic-link/send":
+        return handlers.magicLinkSend(request);
+      case "sms/send-code":
+        return handlers.smsSendCode(request);
+      case "sms/verify-code":
+        return handlers.smsVerifyCode(request);
+      case "mfa/verify":
+        return handlers.mfaVerify(request);
+      case "refresh":
+        return handlers.refresh();
+      case "logout":
+        return handlers.logout();
+      default:
+        return NextResponse.json({ error: "Not found" }, { status: 404 });
+    }
+  }
+  return { GET, POST };
+}
+
+// src/index.ts
+import { createAuthGateClient as createAuthGateClient2, SUPPORTED_PROVIDERS as SUPPORTED_PROVIDERS2 } from "@auth-gate/core";
+
+// src/middleware.ts
+import { NextResponse as NextResponse2 } from "next/server";
+var REVALIDATION_INTERVAL = 300;
+function patternToRegex(pattern) {
+  const regexStr = pattern.replace(/\/:(\w+)\*/g, "(?:/.*)?").replace(/\/:(\w+)/g, "/[^/]+");
+  return new RegExp(`^${regexStr}$`);
+}
+function matchesPath(pathname, patterns) {
+  return patterns.some((p) => patternToRegex(p).test(pathname));
+}
+function redirectToLogin(request, loginPath, client) {
+  const loginUrl = new URL(loginPath, request.url);
+  loginUrl.searchParams.set("redirect", request.nextUrl.pathname);
+  const response = NextResponse2.redirect(loginUrl);
+  response.cookies.set(client.cookieName, "", {
+    httpOnly: true,
+    secure: process.env.NODE_ENV === "production",
+    sameSite: "lax",
+    maxAge: 0,
+    path: "/"
+  });
+  response.cookies.set(client.refreshTokenCookieName, "", {
+    httpOnly: true,
+    secure: process.env.NODE_ENV === "production",
+    sameSite: "lax",
+    maxAge: 0,
+    path: "/"
+  });
+  return response;
+}
+function createAuthGateMiddleware(clientOrGetter, options) {
+  var _a, _b;
+  const loginPath = (_a = options == null ? void 0 : options.loginPath) != null ? _a : "/login";
+  const matcher = (_b = options == null ? void 0 : options.matcher) != null ? _b : ["/dashboard/:path*"];
+  const getClient = () => typeof clientOrGetter === "function" ? clientOrGetter() : clientOrGetter;
+  return async function authMiddleware(request) {
+    if (!matchesPath(request.nextUrl.pathname, matcher)) {
+      return null;
+    }
+    const client = getClient();
+    const cookie = request.cookies.get(client.cookieName);
+    if (!cookie) {
+      return redirectToLogin(request, loginPath, client);
+    }
+    const payload = await client.decryptSessionPayload(cookie.value);
+    if (!payload) {
+      return redirectToLogin(request, loginPath, client);
+    }
+    const refreshCookie = request.cookies.get(client.refreshTokenCookieName);
+    if (refreshCookie == null ? void 0 : refreshCookie.value) {
+      const now = Math.floor(Date.now() / 1e3);
+      const sessionAge = now - payload.iat;
+      if (sessionAge >= REVALIDATION_INTERVAL) {
+        const result = await client.refreshToken(refreshCookie.value);
+        if (!result) {
+          return redirectToLogin(request, loginPath, client);
+        }
+        const verified = await client.verifyToken(result.token);
+        if (!verified.valid || !verified.user) {
+          return redirectToLogin(request, loginPath, client);
+        }
+        const newCookieValue = await client.encryptSession(verified.user);
+        const response = NextResponse2.next();
+        response.cookies.set(
+          client.cookieName,
+          newCookieValue,
+          client.getSessionCookieOptions()
+        );
+        return response;
+      }
+    }
+    return null;
+  };
+}
+
+// src/index.ts
+function createAuthGate(config) {
+  const client = createAuthGateClient(config);
+  const session = createSessionHelpers(client);
+  const handlers = createCatchAllHandler(client, config.appUrl);
+  return {
+    client,
+    handlers,
+    session
+  };
+}
+export {
+  SUPPORTED_PROVIDERS2 as SUPPORTED_PROVIDERS,
+  createAuthGate,
+  createAuthGateClient2 as createAuthGateClient,
+  createAuthGateMiddleware,
+  createCatchAllHandler,
+  createHandlers,
+  createSessionHelpers
+};

package/package.json

@@ -0,0 +1,36 @@
+{
+  "name": "@auth-gate/nextjs",
+  "version": "0.1.0",
+  "type": "module",
+  "exports": {
+    ".": {
+      "types": "./dist/index.d.ts",
+      "import": "./dist/index.mjs",
+      "require": "./dist/index.cjs"
+    }
+  },
+  "main": "./dist/index.cjs",
+  "module": "./dist/index.mjs",
+  "types": "./dist/index.d.ts",
+  "files": [
+    "dist"
+  ],
+  "dependencies": {
+    "@auth-gate/core": "0.1.0"
+  },
+  "peerDependencies": {
+    "next": ">=14"
+  },
+  "devDependencies": {
+    "next": "16.1.6",
+    "react": "19.2.3",
+    "react-dom": "19.2.3",
+    "@types/react": "^19",
+    "tsup": "^8.0.0",
+    "typescript": "^5"
+  },
+  "scripts": {
+    "build": "tsup",
+    "typecheck": "tsc --noEmit"
+  }
+}