@ceebee/auth-contract 0.1.0

package/README.md

@@ -0,0 +1,9 @@
+# `@ceebee/auth-contract`
+
+Home-owned Deep Module for the shared Auth.js session cookie and consumer-to-gateway destination.
+It deliberately does not own Google OAuth, the email allowlist, callbacks, token issuance, or UI;
+those remain Home Implementations behind this Interface.
+
+Consumers must pin `next-auth` to `5.0.0-beta.32`. Migrate one product at a time after publishing
+this package, retaining its existing `lib/auth-cookie.ts` and `lib/auth-gateway.ts` as compatibility
+facades until browser login and logout pass on sibling subdomains.

package/dist/index.d.ts

@@ -0,0 +1,24 @@
+export declare const PRODUCTION_SESSION_COOKIE = "__Secure-authjs.session-token";
+export declare const DEVELOPMENT_SESSION_COOKIE = "authjs.session-token";
+export declare const CEEBEE_COOKIE_DOMAIN = ".ceebee.biz.id";
+export interface SharedSessionCookie {
+    name: string;
+    options: {
+        domain?: string;
+        httpOnly: true;
+        sameSite: 'lax';
+        path: '/';
+        secure: boolean;
+    };
+}
+export declare function sharedSessionCookie(domain?: string): SharedSessionCookie;
+export declare function safeLocalPath(value: unknown): string;
+export interface GatewayUrlOptions {
+    action: 'login' | 'logout';
+    path?: unknown;
+    appOrigin: string;
+    gatewayOrigin?: string;
+}
+export declare function authGatewayUrl({ action, path, appOrigin, gatewayOrigin, }: GatewayUrlOptions): string;
+export declare function isSessionCookieName(name: string, sessionName: string): boolean;
+//# sourceMappingURL=index.d.ts.map

package/dist/index.d.ts.map

@@ -0,0 +1 @@
+{"version":3,"file":"index.d.ts","sourceRoot":"","sources":["../src/index.ts"],"names":[],"mappings":"AAAA,eAAO,MAAM,yBAAyB,kCAAkC,CAAC;AACzE,eAAO,MAAM,0BAA0B,yBAAyB,CAAC;AACjE,eAAO,MAAM,oBAAoB,mBAAmB,CAAC;AAErD,MAAM,WAAW,mBAAmB;IAClC,IAAI,EAAE,MAAM,CAAC;IACb,OAAO,EAAE;QACP,MAAM,CAAC,EAAE,MAAM,CAAC;QAChB,QAAQ,EAAE,IAAI,CAAC;QACf,QAAQ,EAAE,KAAK,CAAC;QAChB,IAAI,EAAE,GAAG,CAAC;QACV,MAAM,EAAE,OAAO,CAAC;KACjB,CAAC;CACH;AAED,wBAAgB,mBAAmB,CAAC,MAAM,CAAC,EAAE,MAAM,GAAG,mBAAmB,CAqBxE;AAED,wBAAgB,aAAa,CAAC,KAAK,EAAE,OAAO,GAAG,MAAM,CAKpD;AAED,MAAM,WAAW,iBAAiB;IAChC,MAAM,EAAE,OAAO,GAAG,QAAQ,CAAC;IAC3B,IAAI,CAAC,EAAE,OAAO,CAAC;IACf,SAAS,EAAE,MAAM,CAAC;IAClB,aAAa,CAAC,EAAE,MAAM,CAAC;CACxB;AAED,wBAAgB,cAAc,CAAC,EAC7B,MAAM,EACN,IAAU,EACV,SAAS,EACT,aAAuC,GACxC,EAAE,iBAAiB,GAAG,MAAM,CAI5B;AAED,wBAAgB,mBAAmB,CAAC,IAAI,EAAE,MAAM,EAAE,WAAW,EAAE,MAAM,GAAG,OAAO,CAE9E"}

package/dist/index.js

@@ -0,0 +1,41 @@
+export const PRODUCTION_SESSION_COOKIE = '__Secure-authjs.session-token';
+export const DEVELOPMENT_SESSION_COOKIE = 'authjs.session-token';
+export const CEEBEE_COOKIE_DOMAIN = '.ceebee.biz.id';
+export function sharedSessionCookie(domain) {
+    const normalized = domain?.trim();
+    if (!normalized) {
+        return {
+            name: DEVELOPMENT_SESSION_COOKIE,
+            options: { httpOnly: true, sameSite: 'lax', path: '/', secure: false },
+        };
+    }
+    if (normalized !== CEEBEE_COOKIE_DOMAIN) {
+        throw new Error(`AUTH_COOKIE_DOMAIN must be ${CEEBEE_COOKIE_DOMAIN}`);
+    }
+    return {
+        name: PRODUCTION_SESSION_COOKIE,
+        options: {
+            domain: normalized,
+            httpOnly: true,
+            sameSite: 'lax',
+            path: '/',
+            secure: true,
+        },
+    };
+}
+export function safeLocalPath(value) {
+    const path = typeof value === 'string' ? value.trim() : '';
+    if (!path.startsWith('/') || path.startsWith('//') || path.startsWith('/\\'))
+        return '/';
+    if (/[\u0000-\u001f\u007f]/.test(path))
+        return '/';
+    return path;
+}
+export function authGatewayUrl({ action, path = '/', appOrigin, gatewayOrigin = 'https://ceebee.biz.id', }) {
+    const url = new URL(`/${action}`, gatewayOrigin);
+    url.searchParams.set('returnTo', new URL(safeLocalPath(path), appOrigin).toString());
+    return url.toString();
+}
+export function isSessionCookieName(name, sessionName) {
+    return name === sessionName || name.startsWith(`${sessionName}.`);
+}

package/package.json

@@ -0,0 +1,21 @@
+{
+  "name": "@ceebee/auth-contract",
+  "version": "0.1.0",
+  "description": "Shared CeeBee session cookie and Auth Gateway destination contract.",
+  "type": "module",
+  "exports": {
+    ".": {
+      "types": "./dist/index.d.ts",
+      "default": "./dist/index.js"
+    }
+  },
+  "files": ["dist", "README.md"],
+  "engines": { "node": ">=20" },
+  "peerDependencies": { "next-auth": "5.0.0-beta.32" },
+  "devDependencies": { "typescript": "^5.7.2" },
+  "scripts": {
+    "build": "tsc -p tsconfig.json",
+    "test": "pnpm build && node --test test/*.test.mjs",
+    "prepublishOnly": "pnpm test"
+  }
+}