@caffeinebounce/identity 0.12.1

package/dist/server.mjs

@@ -0,0 +1,277 @@
+import { NextResponse } from 'next/server';
+export { generateSecureToken, getClientIP, getGeolocationFromIP, hashString } from '@caffeinebounce/shared-utils';
+
+// src/handlers/callback.ts
+var POST_AUTH_HOOK_ERROR_MESSAGE = "Authentication completed, but setup failed. Please try again.";
+var DEFAULT_LINKING_ACCOUNT_ERROR_MESSAGE = "This account is already connected to another account. Each external account can only be linked to one account.";
+var EMAIL_OTP_TYPES = [
+  "signup",
+  "invite",
+  "magiclink",
+  "recovery",
+  "email_change",
+  "email"
+];
+function getSafeRedirectPath(candidate, fallback) {
+  if (candidate?.startsWith("/") && !candidate.startsWith("//")) {
+    return candidate;
+  }
+  return fallback;
+}
+function getEmailOtpType(value) {
+  if (!value) {
+    return null;
+  }
+  return EMAIL_OTP_TYPES.includes(value) ? value : null;
+}
+function isDefaultLinkingFlow({
+  redirectPath
+}) {
+  return redirectPath.includes("/profile") || redirectPath.includes("/settings");
+}
+function isAlreadyLinkedAccountError(message) {
+  return message.includes("already linked") || message.includes("identity already exists") || message.includes("already registered");
+}
+function getDefaultLinkingErrorMessage(message) {
+  return isAlreadyLinkedAccountError(message) ? DEFAULT_LINKING_ACCOUNT_ERROR_MESSAGE : message;
+}
+async function createLinkingErrorRedirect({
+  request,
+  origin,
+  redirectPath,
+  error,
+  errorDescription,
+  message,
+  source,
+  isLinkingFlow,
+  resolveLinkingErrorMessage
+}) {
+  const linkingFlowContext = { request, origin, redirectPath };
+  if (!isLinkingFlow(linkingFlowContext)) {
+    return null;
+  }
+  const defaultMessage = getDefaultLinkingErrorMessage(message);
+  const userMessage = await resolveLinkingErrorMessage?.({
+    ...linkingFlowContext,
+    error,
+    errorDescription,
+    message,
+    defaultMessage,
+    source
+  }) ?? defaultMessage;
+  const nextUrl = new URL(redirectPath, origin);
+  nextUrl.searchParams.set("link_error", userMessage);
+  return NextResponse.redirect(nextUrl.toString());
+}
+async function runPostAuthHook({
+  postAuthHook,
+  postAuthHookErrorMode,
+  supabase,
+  user,
+  request,
+  origin,
+  redirectPath,
+  flow,
+  otpType,
+  signInPath
+}) {
+  if (!postAuthHook) {
+    return null;
+  }
+  try {
+    await postAuthHook({
+      supabase,
+      user,
+      request,
+      origin,
+      redirectPath,
+      flow,
+      otpType
+    });
+    return null;
+  } catch {
+    if (postAuthHookErrorMode === "ignore") {
+      return null;
+    }
+    return NextResponse.redirect(
+      `${origin}${signInPath}?error=${encodeURIComponent(POST_AUTH_HOOK_ERROR_MESSAGE)}`
+    );
+  }
+}
+function createRedirectResponse(target, origin) {
+  if (!target) {
+    return null;
+  }
+  if (target instanceof Response) {
+    return target;
+  }
+  if (target instanceof URL) {
+    return NextResponse.redirect(target.toString());
+  }
+  if (target.startsWith("/") && !target.startsWith("//")) {
+    return NextResponse.redirect(`${origin}${target}`);
+  }
+  return null;
+}
+async function redirectAfterSuccessfulAuth({
+  supabase,
+  request,
+  origin,
+  redirectPath,
+  flow,
+  otpType,
+  postAuthHook,
+  postAuthHookErrorMode,
+  signInPath,
+  resolveSuccessRedirect
+}) {
+  const {
+    data: { user }
+  } = await supabase.auth.getUser();
+  if (!user) {
+    return NextResponse.redirect(`${origin}${redirectPath}`);
+  }
+  const postAuthHookRedirect = await runPostAuthHook({
+    postAuthHook,
+    postAuthHookErrorMode,
+    supabase,
+    user,
+    request,
+    origin,
+    redirectPath,
+    flow,
+    otpType,
+    signInPath
+  });
+  if (postAuthHookRedirect) {
+    return postAuthHookRedirect;
+  }
+  const customRedirect = await resolveSuccessRedirect?.({
+    supabase,
+    user,
+    request,
+    origin,
+    redirectPath,
+    flow,
+    otpType
+  });
+  const customRedirectResponse = createRedirectResponse(customRedirect, origin);
+  if (customRedirectResponse) {
+    return customRedirectResponse;
+  }
+  return NextResponse.redirect(`${origin}${redirectPath}`);
+}
+function createAuthCallbackHandler({
+  createClient,
+  defaultRedirect = "/dashboard",
+  signInPath = "/signin",
+  postAuthHook,
+  postAuthHookErrorMode = "block",
+  resolveSuccessRedirect,
+  isLinkingFlow = isDefaultLinkingFlow,
+  resolveLinkingErrorMessage
+}) {
+  return async function GET(request) {
+    const requestUrl = new URL(request.url);
+    const code = requestUrl.searchParams.get("code");
+    const tokenHash = requestUrl.searchParams.get("token_hash");
+    const rawOtpType = requestUrl.searchParams.get("type");
+    const otpType = getEmailOtpType(rawOtpType);
+    const next = getSafeRedirectPath(
+      requestUrl.searchParams.get("next") ?? requestUrl.searchParams.get("redirect_to"),
+      defaultRedirect
+    );
+    const origin = requestUrl.origin;
+    const error = requestUrl.searchParams.get("error");
+    const errorDescription = requestUrl.searchParams.get("error_description");
+    if (error) {
+      const message = errorDescription || error;
+      const linkingErrorRedirect = await createLinkingErrorRedirect({
+        request,
+        origin,
+        redirectPath: next,
+        error,
+        errorDescription,
+        message,
+        source: "oauth_error",
+        isLinkingFlow,
+        resolveLinkingErrorMessage
+      });
+      if (linkingErrorRedirect) {
+        return linkingErrorRedirect;
+      }
+      return NextResponse.redirect(
+        `${origin}${signInPath}?error=${encodeURIComponent(message)}`
+      );
+    }
+    if (code) {
+      const supabase = await createClient();
+      const { error: exchangeError } = await supabase.auth.exchangeCodeForSession(code);
+      if (!exchangeError) {
+        return redirectAfterSuccessfulAuth({
+          supabase,
+          request,
+          origin,
+          redirectPath: next,
+          flow: "oauth",
+          postAuthHook,
+          postAuthHookErrorMode,
+          signInPath,
+          resolveSuccessRedirect
+        });
+      }
+      const errorMessage = exchangeError.message;
+      const linkingErrorRedirect = await createLinkingErrorRedirect({
+        request,
+        origin,
+        redirectPath: next,
+        error: exchangeError.name || "code_exchange",
+        errorDescription: null,
+        message: errorMessage,
+        source: "code_exchange",
+        isLinkingFlow,
+        resolveLinkingErrorMessage
+      });
+      if (linkingErrorRedirect) {
+        return linkingErrorRedirect;
+      }
+      return NextResponse.redirect(
+        `${origin}${signInPath}?error=${encodeURIComponent(errorMessage)}`
+      );
+    }
+    if (tokenHash || rawOtpType) {
+      if (!tokenHash || !otpType) {
+        return NextResponse.redirect(
+          `${origin}${signInPath}?error=${encodeURIComponent("Invalid verification link")}`
+        );
+      }
+      const supabase = await createClient();
+      const { error: verifyError } = await supabase.auth.verifyOtp({
+        token_hash: tokenHash,
+        type: otpType
+      });
+      if (!verifyError) {
+        return redirectAfterSuccessfulAuth({
+          supabase,
+          request,
+          origin,
+          redirectPath: next,
+          flow: "otp",
+          otpType,
+          postAuthHook,
+          postAuthHookErrorMode,
+          signInPath,
+          resolveSuccessRedirect
+        });
+      }
+      return NextResponse.redirect(
+        `${origin}${signInPath}?error=${encodeURIComponent(verifyError.message)}`
+      );
+    }
+    return NextResponse.redirect(
+      `${origin}${signInPath}?error=No authorization code received`
+    );
+  };
+}
+
+export { createAuthCallbackHandler };

package/package.json

@@ -0,0 +1,84 @@
+{
+  "name": "@caffeinebounce/identity",
+  "version": "0.12.1",
+  "description": "Authentication components and handlers for Caffeine Bounce projects",
+  "main": "./dist/index.js",
+  "module": "./dist/index.mjs",
+  "types": "./dist/index.d.ts",
+  "exports": {
+    ".": {
+      "import": {
+        "types": "./dist/index.d.mts",
+        "default": "./dist/index.mjs"
+      },
+      "require": {
+        "types": "./dist/index.d.ts",
+        "default": "./dist/index.js"
+      }
+    },
+    "./server": {
+      "import": {
+        "types": "./dist/server.d.mts",
+        "default": "./dist/server.mjs"
+      },
+      "require": {
+        "types": "./dist/server.d.ts",
+        "default": "./dist/server.js"
+      }
+    }
+  },
+  "files": [
+    "dist"
+  ],
+  "scripts": {
+    "build": "tsup",
+    "dev": "tsup --watch",
+    "test": "yarn run -T vitest run",
+    "test:watch": "yarn run -T vitest",
+    "typecheck": "tsc -p tsconfig.json --noEmit && tsc -p tsconfig.test.json --noEmit",
+    "clean": "rm -rf dist",
+    "lint": "biome check src/"
+  },
+  "publishConfig": {
+    "access": "public",
+    "registry": "https://registry.npmjs.org"
+  },
+  "repository": {
+    "type": "git",
+    "url": "git+https://github.com/caffeinebounce/shared-packages.git",
+    "directory": "packages/identity"
+  },
+  "peerDependencies": {
+    "next": ">=14.0.0",
+    "react": "^18 || ^19",
+    "react-dom": "^18 || ^19"
+  },
+  "peerDependenciesMeta": {
+    "next": {
+      "optional": false
+    }
+  },
+  "dependencies": {
+    "@caffeinebounce/logger": "^0.10.0",
+    "@caffeinebounce/shared-utils": "^0.7.136",
+    "@caffeinebounce/ui": "^0.62.2",
+    "@supabase/ssr": "^0.8.0",
+    "@supabase/supabase-js": "^2.49.4",
+    "input-otp": "^1.4.2",
+    "lucide-react": "^0.577.0",
+    "sonner": "^2.0.7",
+    "validator": "^13.15.26"
+  },
+  "devDependencies": {
+    "@types/node": "^25.5.0",
+    "@types/react": "^19.2.14",
+    "@types/react-dom": "^19.2.3",
+    "@types/validator": "^13.15.10",
+    "next": "^16.2.6",
+    "react": "^19.2.4",
+    "react-dom": "^19.2.4",
+    "tsup": "^8.5.1",
+    "typescript": "^5.9.3"
+  },
+  "license": "MIT"
+}