@binary1702/auth 0.2.5 → 0.4.0

package/dist/next/proxy.d.ts

@@ -1,5 +1,6 @@
 import { NextResponse, type NextRequest } from "next/server.js";
+import { MATCHER } from "../core/guard.ts";
 /** Paste this into proxy.ts as `export const config = { matcher: MATCHER }` */
-export declare const MATCHER: string[];
+export { MATCHER };
 export declare function proxy(request: NextRequest): Promise<NextResponse>;
 export default proxy;

package/dist/next/proxy.js

@@ -2,10 +2,13 @@
 // Proxy (Next 16) / middleware (Next 15). Runs before every route.
 //
 // Verifies the cookie signature only. No database, no network.
-//   no/invalid cookie + page request  → 302 to /auth/sign-in?next=<path>
+//   no/invalid cookie + page request  → 302 to the sign-in page?next=<path>
 //   no/invalid cookie + /api request  → 401 JSON
 //   valid cookie                      → continue
 //
+// The sign-in page is /auth/sign-in, or the app's own page when
+// b17_auth.yaml names one under `pages:` (core/pages.ts).
+//
 // A cheap first gate, not the last one: a revoked session (deleted
 // user, changed password) still has a valid signature and passes here.
 // getUser()/requireUser() check the database and refuse it, so no data
@@ -13,26 +16,35 @@
 //
 // The CLI writes proxy.ts with an inline `config.matcher`, because
 // Next reads the matcher statically and ignores a re-exported one.
-// This function also guards those paths itself, so a missing matcher
-// degrades to "slightly slower", never to "static assets blocked".
+// The matcher only skips Next's build output; isPublic() (core/guard.ts)
+// makes every other decision, so the rule lives in one tested place.
 // ─────────────────────────────────────────────────────────────
 import { NextResponse } from "next/server.js";
-import { COOKIE_NAME, SIGN_IN_PATH, getSecret } from "../core/config.js";
+import { COOKIE_NAME, cookieName, getSecret } from "../core/config.js";
 import { verifySession } from "../core/session.js";
+import { MATCHER, isPublic } from "../core/guard.js";
+import { options } from "../core/options.js";
+import { appPages, pagePath, sendsHome } from "../core/pages.js";
 /** Paste this into proxy.ts as `export const config = { matcher: MATCHER }` */
-export const MATCHER = ["/((?!auth|_next/static|_next/image|favicon.ico|.*\\..*).*)"];
-const PUBLIC = /^\/(auth(\/|$)|_next\/|favicon\.ico$)|\.[a-z0-9]+$/i;
+export { MATCHER };
 export async function proxy(request) {
     const { pathname, search } = request.nextUrl;
-    if (PUBLIC.test(pathname))
+    // `protected:` or `public:` from b17_auth.yaml, on top of the built-in rules (auth pages, Next internals)
+    const o = options();
+    // The current cookie name, then the pre-0.3.0 one: upgrading signs nobody out
+    const token = request.cookies.get(cookieName(o.production))?.value ?? request.cookies.get(COOKIE_NAME)?.value;
+    const signedIn = async () => !!token && !!(await verifySession(token, getSecret()));
+    // With `home:` set, the root is the public site and the app lives elsewhere: a signed-in visitor goes there
+    if (sendsHome(pathname, o.home) && (await signedIn()))
+        return NextResponse.redirect(new URL(o.home, request.url));
+    if (isPublic(pathname, { public: o.public, protected: o.protected, pages: appPages(o.pages) }))
         return NextResponse.next();
-    const token = request.cookies.get(COOKIE_NAME)?.value;
-    if (token && (await verifySession(token, getSecret())))
+    if (await signedIn())
         return NextResponse.next();
     if (pathname.startsWith("/api/")) {
         return NextResponse.json({ error: "Unauthorized" }, { status: 401 });
     }
-    const url = new URL(SIGN_IN_PATH, request.url);
+    const url = new URL(pagePath(o.pages, "signIn"), request.url);
     if (pathname !== "/")
         url.searchParams.set("next", pathname + search);
     return NextResponse.redirect(url);

package/dist/react/index.d.ts

@@ -0,0 +1,72 @@
+import { type ReactNode } from "react";
+import { type Authorization, type Organization, type Session } from "../core/org.ts";
+import type { SignupPolicy } from "../core/signup.ts";
+export type { Session, Organization, Authorization, SignupPolicy };
+export type AuthState = {
+    user: Session["user"] | null;
+    organization: Organization | null;
+    authorization: Authorization;
+    /** True only while the provider is fetching the session itself */
+    loading: boolean;
+    /** Re-fetch GET /auth/session (after switching organization, for instance) */
+    refresh: () => Promise<void>;
+    /** May this user do that? For showing and hiding UI; the server still checks with requirePermission(). */
+    can: (permission: string) => boolean;
+};
+export declare function fetchSession(): Promise<Session | null>;
+export declare function AuthProvider(props: {
+    session?: Session | null;
+    children: ReactNode;
+}): import("react").FunctionComponentElement<import("react").ProviderProps<AuthState | null>>;
+export declare function useAuth(): AuthState;
+/**
+ * What a sign-in or sign-up attempt comes back with.
+ *   ok, verify false    signed in; go to `next` (checked by the server: same origin only)
+ *   ok, verify true     account created, no session yet: "check your email"
+ *   not ok              `error` is the message to show; `status` 401 wrong password,
+ *                       403 cross-site / wrong invite / email not verified, 404 sign-up closed,
+ *                       409 email taken, 429 too many tries (`retryAfter` seconds)
+ */
+export type AuthResult = {
+    ok: true;
+    user: Session["user"];
+    next: string;
+    verify: boolean;
+} | {
+    ok: false;
+    status: number;
+    error: string;
+    verify: boolean;
+    retryAfter?: number;
+};
+/** POST /auth/sign-in. On success the cookie is set; navigate to `next`. */
+export declare function signIn(input: {
+    email: string;
+    password: string;
+    next?: string;
+}): Promise<AuthResult>;
+/** POST /auth/sign-up. `invite` when the policy requires it. */
+export declare function signUp(input: {
+    email: string;
+    password: string;
+    invite?: string;
+    next?: string;
+}): Promise<AuthResult>;
+/** POST /auth/sign-out: clears the cookie. Then navigate somewhere public (or link to /auth/sign-out?next=/). */
+export declare function signOut(): Promise<void>;
+/** What a sign-in or sign-up page needs to know before it renders. */
+export type Policy = {
+    /** May anyone sign up right now, is an invite code required, and is this the first account? */
+    signup: SignupPolicy;
+    /** Where the pages are: the app's own (b17_auth.yaml `pages:`) or the package's */
+    pages: {
+        signIn: string;
+        signUp: string;
+    };
+    /** The signed-in home (b17_auth.yaml `home:`), else "/" */
+    home: string;
+    /** The app name from b17_auth.yaml, if set */
+    name?: string;
+};
+/** GET /auth/policy */
+export declare function fetchPolicy(): Promise<Policy>;

package/dist/react/index.js

@@ -0,0 +1,107 @@
+"use client";
+// ─────────────────────────────────────────────────────────────
+// React side of the session contract. For rendering only: every
+// protected operation is still checked on the server.
+//
+//   <AuthProvider session={await getSession()}>   in a server layout,
+//                                                 no request from the client
+//   <AuthProvider>                                 anywhere else: fetches
+//                                                 GET /auth/session once
+//   const { user, organization, authorization } = useAuth()
+//
+// Signed out: user and organization are null, permissions are empty.
+//
+// For an app that draws its own sign-in / sign-up pages (b17_auth.yaml
+// `pages:`), the protocol as functions. The package decides what is
+// valid, where to go next and when to refuse; the page only renders:
+//
+//   const r = await signIn({ email, password, next })
+//   r.ok ? location.assign(r.next) : setError(r.error)
+//
+//   const { signup } = await fetchPolicy()   // may anyone sign up right now? first account?
+// ─────────────────────────────────────────────────────────────
+import { createContext, createElement, useCallback, useContext, useEffect, useState } from "react";
+import { NO_SESSION, hasPermission } from "../core/org.js";
+const SESSION_URL = "/auth/session";
+const SIGN_IN_URL = "/auth/sign-in";
+const SIGN_UP_URL = "/auth/sign-up";
+const SIGN_OUT_URL = "/auth/sign-out";
+const POLICY_URL = "/auth/policy";
+const Ctx = createContext(null);
+export async function fetchSession() {
+    const res = await fetch(SESSION_URL, { credentials: "same-origin", cache: "no-store" });
+    return res.ok ? (await res.json()) : null;
+}
+export function AuthProvider(props) {
+    const provided = props.session !== undefined;
+    const [session, setSession] = useState(props.session ?? null);
+    const [loading, setLoading] = useState(!provided);
+    const refresh = useCallback(async () => {
+        setLoading(true);
+        try {
+            setSession(await fetchSession());
+        }
+        finally {
+            setLoading(false);
+        }
+    }, []);
+    useEffect(() => {
+        if (provided)
+            setSession(props.session ?? null);
+        else
+            void refresh();
+    }, [provided, props.session, refresh]);
+    const authorization = session?.authorization ?? NO_SESSION.authorization;
+    const value = {
+        user: session?.user ?? NO_SESSION.user,
+        organization: session?.organization ?? NO_SESSION.organization,
+        authorization,
+        loading,
+        refresh,
+        can: (permission) => hasPermission({ authorization }, permission),
+    };
+    return createElement(Ctx.Provider, { value }, props.children);
+}
+export function useAuth() {
+    const ctx = useContext(Ctx);
+    if (!ctx)
+        throw new Error("useAuth() needs an <AuthProvider> above it");
+    return ctx;
+}
+async function attempt(url, body) {
+    const res = await fetch(url, {
+        method: "POST",
+        credentials: "same-origin",
+        headers: { "content-type": "application/json" },
+        body: JSON.stringify(body),
+    });
+    const data = (await res.json().catch(() => ({})));
+    if (res.ok && data.user)
+        return { ok: true, user: data.user, next: data.next ?? "/", verify: data.verify === true };
+    return {
+        ok: false,
+        status: res.status,
+        error: data.error ?? (data.verify ? "Check your email for a verification link, then sign in." : "Something went wrong. Try again."),
+        verify: data.verify === true,
+        retryAfter: data.retryAfter,
+    };
+}
+/** POST /auth/sign-in. On success the cookie is set; navigate to `next`. */
+export function signIn(input) {
+    return attempt(SIGN_IN_URL, input);
+}
+/** POST /auth/sign-up. `invite` when the policy requires it. */
+export function signUp(input) {
+    return attempt(SIGN_UP_URL, input);
+}
+/** POST /auth/sign-out: clears the cookie. Then navigate somewhere public (or link to /auth/sign-out?next=/). */
+export async function signOut() {
+    await fetch(SIGN_OUT_URL, { method: "POST", credentials: "same-origin", headers: { "content-type": "application/json" }, body: "{}" });
+}
+/** GET /auth/policy */
+export async function fetchPolicy() {
+    const res = await fetch(POLICY_URL, { credentials: "same-origin", cache: "no-store" });
+    if (!res.ok)
+        throw new Error(`GET ${POLICY_URL} answered ${res.status}`);
+    return (await res.json());
+}

package/package.json

@@ -1,6 +1,6 @@
 {
   "name": "@binary1702/auth",
-  "version": "0.2.5",
+  "version": "0.4.0",
   "description": "Email + password auth for Next.js. One command: npx @binary1702/auth",
   "type": "module",
   "repository": {
@@ -26,27 +26,41 @@
     "./next/proxy": {
       "types": "./dist/next/proxy.d.ts",
       "import": "./dist/next/proxy.js"
+    },
+    "./react": {
+      "types": "./dist/react/index.d.ts",
+      "import": "./dist/react/index.js"
     }
   },
   "files": [
     "dist",
     "INSTALL.md",
-    "PROMPT.md"
+    "PROMPT.md",
+    "AGENTS.md",
+    "CHANGELOG.md"
   ],
   "scripts": {
     "build": "tsc",
     "prepublishOnly": "npm run build",
-    "test": "node --test tests/*.test.ts"
+    "test": "node --test tests/*.test.ts",
+    "dev": "npx next dev demo -p 3002"
   },
   "dependencies": {
     "@neondatabase/serverless": "^1.1.0",
     "jose": "^6.2.5"
   },
   "peerDependencies": {
-    "next": ">=15.0.0"
+    "next": ">=15.0.0",
+    "react": ">=18"
+  },
+  "peerDependenciesMeta": {
+    "react": {
+      "optional": true
+    }
   },
   "devDependencies": {
     "@types/node": "^20",
+    "@types/react": "19.3.0",
     "next": "^16.3.2",
     "typescript": "^5.9.3"
   },