@cmssy/next 0.1.7 → 0.1.9

package/dist/index.cjs

@@ -4,7 +4,9 @@ var headers = require('next/headers');
 var navigation = require('next/navigation');
 var react = require('@cmssy/react');
 var jsxRuntime = require('react/jsx-runtime');
-var crypto = require('crypto');
+var crypto$1 = require('crypto');
+var jose = require('jose');
+var server = require('next/server');
 
 // src/create-cmssy-page.tsx
 
@@ -156,9 +158,9 @@ function resolveBridgeOrigin(editorOrigin) {
 }
 var MIN_SECRET_LENGTH = 16;
 function secretsMatch(a, b) {
-  const ha = crypto.createHash("sha256").update(a).digest();
-  const hb = crypto.createHash("sha256").update(b).digest();
-  return crypto.timingSafeEqual(ha, hb);
+  const ha = crypto$1.createHash("sha256").update(a).digest();
+  const hb = crypto$1.createHash("sha256").update(b).digest();
+  return crypto$1.timingSafeEqual(ha, hb);
 }
 function safeRedirect(redirect2, fallback) {
   if (!redirect2 || !redirect2.startsWith("/")) return fallback;
@@ -226,15 +228,551 @@ async function getCmssyLocale(config) {
   const { defaultLocale } = await react.resolveSiteLocales(config);
   return defaultLocale;
 }
+var CMSSY_SESSION_COOKIE = "cmssy_session";
+var SESSION_MAX_AGE_SECONDS = 30 * 24 * 60 * 60;
+var MIN_SESSION_SECRET_LENGTH = 32;
+var ACCESS_EXPIRY_SKEW_MS = 3e4;
+async function deriveSessionKey(secret) {
+  if (typeof secret !== "string" || secret.length < MIN_SESSION_SECRET_LENGTH) {
+    throw new Error(
+      `cmssy auth sessionSecret must be at least ${MIN_SESSION_SECRET_LENGTH} characters`
+    );
+  }
+  const digest = await crypto.subtle.digest(
+    "SHA-256",
+    new TextEncoder().encode(secret)
+  );
+  return new Uint8Array(digest);
+}
+async function sealSession(payload, secret, audience) {
+  const key = await deriveSessionKey(secret);
+  const jwt = new jose.EncryptJWT({ ...payload }).setProtectedHeader({ alg: "dir", enc: "A256GCM" }).setIssuedAt().setExpirationTime(`${SESSION_MAX_AGE_SECONDS}s`);
+  if (audience) jwt.setAudience(audience);
+  return jwt.encrypt(key);
+}
+async function openSession(token, secret, audience) {
+  const key = await deriveSessionKey(secret);
+  try {
+    const { payload } = await jose.jwtDecrypt(token, key, {
+      keyManagementAlgorithms: ["dir"],
+      contentEncryptionAlgorithms: ["A256GCM"],
+      ...audience ? { audience } : {}
+    });
+    const { accessToken, refreshToken, accessExpiresAt, user } = payload;
+    if (typeof accessToken !== "string" || typeof refreshToken !== "string" || !Number.isFinite(accessExpiresAt) || !user || typeof user !== "object" || typeof user.recordId !== "string" || typeof user.email !== "string") {
+      return null;
+    }
+    return {
+      accessToken,
+      refreshToken,
+      accessExpiresAt,
+      user: {
+        recordId: user.recordId,
+        email: user.email
+      }
+    };
+  } catch {
+    return null;
+  }
+}
+function isAccessExpired(payload, now = Date.now()) {
+  return payload.accessExpiresAt <= now + ACCESS_EXPIRY_SKEW_MS;
+}
+function sessionCookieOptions() {
+  return {
+    httpOnly: true,
+    secure: process.env.NODE_ENV !== "development",
+    sameSite: "lax",
+    path: "/",
+    maxAge: SESSION_MAX_AGE_SECONDS
+  };
+}
+
+// src/config.ts
+function assertAuthConfig(config) {
+  const auth = config.auth;
+  if (!auth || typeof auth.modelSlug !== "string" || !auth.modelSlug) {
+    throw new Error("cmssy: config.auth.modelSlug is required for auth routes");
+  }
+  if (typeof auth.sessionSecret !== "string" || auth.sessionSecret.length < MIN_SESSION_SECRET_LENGTH) {
+    throw new Error(
+      `cmssy: config.auth.sessionSecret must be at least ${MIN_SESSION_SECRET_LENGTH} characters`
+    );
+  }
+  return auth;
+}
+var LOGIN_MUTATION = `mutation SiteMemberLogin($input: SiteMemberLoginInput!) {
+  siteMemberLogin(input: $input) {
+    success message accessToken refreshToken accessTokenExpiresIn
+  }
+}`;
+var REGISTER_MUTATION = `mutation SiteMemberRegister($input: SiteMemberRegisterInput!) {
+  siteMemberRegister(input: $input) { success message }
+}`;
+var REFRESH_MUTATION = `mutation SiteMemberRefresh($refreshToken: String!) {
+  siteMemberRefresh(refreshToken: $refreshToken) {
+    success message accessToken refreshToken accessTokenExpiresIn
+  }
+}`;
+var LOGOUT_MUTATION = `mutation SiteMemberLogout($refreshToken: String!) {
+  siteMemberLogout(refreshToken: $refreshToken) { success message }
+}`;
+var LOGOUT_EVERYWHERE_MUTATION = `mutation SiteMemberLogoutEverywhere {
+  siteMemberLogoutEverywhere { success message }
+}`;
+var FORGOT_MUTATION = `mutation SiteMemberForgotPassword($modelSlug: String!, $identity: String!) {
+  siteMemberForgotPassword(modelSlug: $modelSlug, identity: $identity) { success message }
+}`;
+var RESET_MUTATION = `mutation SiteMemberResetPassword($token: String!, $newPassword: String!) {
+  siteMemberResetPassword(token: $token, newPassword: $newPassword) { success message }
+}`;
+var VERIFY_MUTATION = `mutation SiteMemberVerifyEmail($token: String!) {
+  siteMemberVerifyEmail(token: $token) { success message }
+}`;
+var workspaceIdCache = /* @__PURE__ */ new Map();
+function workspaceIdFor(config) {
+  const key = `${config.apiUrl}::${config.workspaceSlug}`;
+  const existing = workspaceIdCache.get(key);
+  if (existing) return existing;
+  const fresh = react.resolveWorkspaceId(config).catch((err) => {
+    workspaceIdCache.delete(key);
+    throw err;
+  });
+  workspaceIdCache.set(key, fresh);
+  return fresh;
+}
+async function authRequest(config, query, variables, label, accessToken) {
+  const workspaceId = await workspaceIdFor(config);
+  return react.graphqlRequest(
+    config,
+    query,
+    variables,
+    {
+      headers: {
+        "x-workspace-id": workspaceId,
+        ...accessToken ? { authorization: `Bearer ${accessToken}` } : {}
+      }
+    },
+    label
+  );
+}
+function decodeAccessClaims(accessToken) {
+  const parts = accessToken.split(".");
+  if (parts.length !== 3) return null;
+  try {
+    const base64 = parts[1].replace(/-/g, "+").replace(/_/g, "/");
+    const bytes = Uint8Array.from(atob(base64), (c) => c.charCodeAt(0));
+    const json2 = JSON.parse(new TextDecoder().decode(bytes));
+    if (typeof json2.recordId !== "string" || typeof json2.email !== "string" || json2.type !== "site_member") {
+      return null;
+    }
+    return { recordId: json2.recordId, email: json2.email };
+  } catch {
+    return null;
+  }
+}
+function toSessionPayload(result) {
+  if (!result.success || !result.accessToken || !result.refreshToken || !result.accessTokenExpiresIn) {
+    return null;
+  }
+  const user = decodeAccessClaims(result.accessToken);
+  if (!user) return null;
+  return {
+    accessToken: result.accessToken,
+    refreshToken: result.refreshToken,
+    accessExpiresAt: Date.now() + result.accessTokenExpiresIn * 1e3,
+    user
+  };
+}
+async function backendSignIn(config, modelSlug, identity, password) {
+  const data = await authRequest(
+    config,
+    LOGIN_MUTATION,
+    {
+      input: { modelSlug, identity, password }
+    },
+    "site member login"
+  );
+  return data.siteMemberLogin;
+}
+async function backendRegister(config, modelSlug, identity, password, fields) {
+  const data = await authRequest(
+    config,
+    REGISTER_MUTATION,
+    {
+      input: { modelSlug, identity, password, fields }
+    },
+    "site member register"
+  );
+  return data.siteMemberRegister;
+}
+async function backendRefresh(config, refreshToken) {
+  const data = await authRequest(
+    config,
+    REFRESH_MUTATION,
+    { refreshToken },
+    "site member refresh"
+  );
+  return data.siteMemberRefresh;
+}
+async function backendSignOut(config, refreshToken) {
+  try {
+    await authRequest(
+      config,
+      LOGOUT_MUTATION,
+      { refreshToken },
+      "site member logout"
+    );
+  } catch {
+    return;
+  }
+}
+async function backendSignOutEverywhere(config, accessToken) {
+  try {
+    await authRequest(
+      config,
+      LOGOUT_EVERYWHERE_MUTATION,
+      {},
+      "site member logout everywhere",
+      accessToken
+    );
+  } catch {
+    return;
+  }
+}
+async function backendForgotPassword(config, modelSlug, identity) {
+  const data = await authRequest(
+    config,
+    FORGOT_MUTATION,
+    { modelSlug, identity },
+    "site member forgot password"
+  );
+  return data.siteMemberForgotPassword;
+}
+async function backendResetPassword(config, token, newPassword) {
+  const data = await authRequest(
+    config,
+    RESET_MUTATION,
+    { token, newPassword },
+    "site member reset password"
+  );
+  return data.siteMemberResetPassword;
+}
+async function backendVerifyEmail(config, token) {
+  const data = await authRequest(
+    config,
+    VERIFY_MUTATION,
+    { token },
+    "site member verify email"
+  );
+  return data.siteMemberVerifyEmail;
+}
+
+// src/create-auth-route.ts
+var MAX_BODY_CHARS = 16 * 1024;
+function json(body, status = 200) {
+  return new Response(JSON.stringify(body), {
+    status,
+    headers: {
+      "content-type": "application/json",
+      "cache-control": "no-store"
+    }
+  });
+}
+async function readBody(request) {
+  const contentType = request.headers.get("content-type") ?? "";
+  if (!contentType.toLowerCase().includes("application/json")) {
+    throw new Error("content-type must be application/json");
+  }
+  const text = await request.text();
+  if (text.length > MAX_BODY_CHARS) {
+    throw new Error("body too large");
+  }
+  if (!text) return {};
+  const parsed = JSON.parse(text);
+  if (!parsed || typeof parsed !== "object" || Array.isArray(parsed)) {
+    throw new Error("body must be a JSON object");
+  }
+  return parsed;
+}
+function str(value) {
+  return typeof value === "string" ? value : "";
+}
+function plainObject(value) {
+  if (!value || typeof value !== "object" || Array.isArray(value)) return {};
+  return value;
+}
+async function readSession(config, auth) {
+  const jar = await headers.cookies();
+  const raw = jar.get(CMSSY_SESSION_COOKIE)?.value;
+  if (!raw) return null;
+  return openSession(raw, auth.sessionSecret, config.workspaceSlug);
+}
+async function writeSession(config, auth, payload) {
+  const sealed = await sealSession(
+    payload,
+    auth.sessionSecret,
+    config.workspaceSlug
+  );
+  const jar = await headers.cookies();
+  jar.set(CMSSY_SESSION_COOKIE, sealed, sessionCookieOptions());
+}
+async function clearSession() {
+  const jar = await headers.cookies();
+  jar.set(CMSSY_SESSION_COOKIE, "", {
+    ...sessionCookieOptions(),
+    maxAge: 0
+  });
+}
+async function refreshSession(config, auth, session) {
+  const result = await backendRefresh(config, session.refreshToken);
+  const payload = toSessionPayload(result);
+  if (!payload) {
+    await clearSession();
+    return null;
+  }
+  await writeSession(config, auth, payload);
+  return payload;
+}
+function createCmssyAuthRoute(config) {
+  const auth = assertAuthConfig(config);
+  async function handleSignIn(body) {
+    const identity = str(body.identity);
+    const password = str(body.password);
+    if (!identity || !password) {
+      return json({ ok: false, message: "Invalid credentials." }, 400);
+    }
+    const result = await backendSignIn(
+      config,
+      auth.modelSlug,
+      identity,
+      password
+    );
+    const payload = toSessionPayload(result);
+    if (!payload) {
+      return json({ ok: false, message: result.message }, 401);
+    }
+    await writeSession(config, auth, payload);
+    return json({ ok: true, user: payload.user });
+  }
+  async function handleRegister(body) {
+    const identity = str(body.identity);
+    const password = str(body.password);
+    if (!identity || !password) {
+      return json({ ok: false, message: "Invalid input." }, 400);
+    }
+    const result = await backendRegister(
+      config,
+      auth.modelSlug,
+      identity,
+      password,
+      plainObject(body.fields)
+    );
+    return json({ ok: result.success, message: result.message });
+  }
+  async function handleSignOut() {
+    const session = await readSession(config, auth);
+    if (session) {
+      await backendSignOut(config, session.refreshToken);
+    }
+    await clearSession();
+    return json({ ok: true });
+  }
+  async function handleSignOutEverywhere() {
+    let session = await readSession(config, auth);
+    if (session && isAccessExpired(session)) {
+      session = await refreshSession(config, auth, session);
+    }
+    if (session) {
+      await backendSignOutEverywhere(config, session.accessToken);
+    }
+    await clearSession();
+    return json({ ok: true });
+  }
+  async function handleRefresh() {
+    const session = await readSession(config, auth);
+    if (!session) {
+      return json({ ok: false, user: null }, 401);
+    }
+    const refreshed = await refreshSession(config, auth, session);
+    if (!refreshed) {
+      return json({ ok: false, user: null }, 401);
+    }
+    return json({ ok: true, user: refreshed.user });
+  }
+  async function handleMe() {
+    let session = await readSession(config, auth);
+    if (session && isAccessExpired(session)) {
+      session = await refreshSession(config, auth, session);
+    }
+    return json({ user: session?.user ?? null });
+  }
+  async function handleForgotPassword(body) {
+    const identity = str(body.identity);
+    if (!identity) {
+      return json({ ok: false, message: "Invalid input." }, 400);
+    }
+    const result = await backendForgotPassword(
+      config,
+      auth.modelSlug,
+      identity
+    );
+    return json({ ok: result.success, message: result.message });
+  }
+  async function handleResetPassword(body) {
+    const token = str(body.token);
+    const newPassword = str(body.newPassword);
+    if (!token || !newPassword) {
+      return json({ ok: false, message: "Invalid input." }, 400);
+    }
+    const result = await backendResetPassword(config, token, newPassword);
+    return json({ ok: result.success, message: result.message });
+  }
+  async function handleVerifyEmail(body) {
+    const token = str(body.token);
+    if (!token) {
+      return json({ ok: false, message: "Invalid input." }, 400);
+    }
+    const result = await backendVerifyEmail(config, token);
+    return json({ ok: result.success, message: result.message });
+  }
+  return {
+    async POST(request, context) {
+      const { action } = await context.params;
+      let body;
+      try {
+        body = await readBody(request);
+      } catch {
+        return json({ ok: false, message: "Invalid request body." }, 400);
+      }
+      try {
+        switch (action) {
+          case "sign-in":
+            return await handleSignIn(body);
+          case "register":
+            return await handleRegister(body);
+          case "sign-out":
+            return await handleSignOut();
+          case "sign-out-everywhere":
+            return await handleSignOutEverywhere();
+          case "refresh":
+            return await handleRefresh();
+          case "forgot-password":
+            return await handleForgotPassword(body);
+          case "reset-password":
+            return await handleResetPassword(body);
+          case "verify-email":
+            return await handleVerifyEmail(body);
+          default:
+            return json({ ok: false, message: "Not found." }, 404);
+        }
+      } catch {
+        return json({ ok: false, message: "Something went wrong." }, 500);
+      }
+    },
+    async GET(_request, context) {
+      const { action } = await context.params;
+      if (action !== "me") {
+        return json({ ok: false, message: "Not found." }, 404);
+      }
+      try {
+        return await handleMe();
+      } catch {
+        return json({ user: null });
+      }
+    }
+  };
+}
+async function readValidSession(config) {
+  const auth = assertAuthConfig(config);
+  const jar = await headers.cookies();
+  const raw = jar.get(CMSSY_SESSION_COOKIE)?.value;
+  if (!raw) return null;
+  const session = await openSession(
+    raw,
+    auth.sessionSecret,
+    config.workspaceSlug
+  );
+  if (!session || isAccessExpired(session)) return null;
+  return session;
+}
+async function getCmssyUser(config) {
+  const session = await readValidSession(config);
+  return session?.user ?? null;
+}
+async function getCmssyAccessToken(config) {
+  const session = await readValidSession(config);
+  return session?.accessToken ?? null;
+}
+function isPrefetch(request) {
+  return request.headers.get("next-router-prefetch") !== null || request.headers.get("purpose") === "prefetch" || (request.headers.get("sec-purpose") ?? "").includes("prefetch");
+}
+function createCmssyAuthMiddleware(config) {
+  const auth = assertAuthConfig(config);
+  return async function cmssyAuthMiddleware(request) {
+    const raw = request.cookies.get(CMSSY_SESSION_COOKIE)?.value;
+    if (!raw) return server.NextResponse.next();
+    const session = await openSession(
+      raw,
+      auth.sessionSecret,
+      config.workspaceSlug
+    );
+    if (!session) {
+      const response = server.NextResponse.next();
+      response.cookies.set(CMSSY_SESSION_COOKIE, "", {
+        ...sessionCookieOptions(),
+        maxAge: 0
+      });
+      return response;
+    }
+    if (!isAccessExpired(session)) return server.NextResponse.next();
+    if (isPrefetch(request)) return server.NextResponse.next();
+    let payload = null;
+    try {
+      const result = await backendRefresh(config, session.refreshToken);
+      payload = toSessionPayload(result);
+    } catch {
+      return server.NextResponse.next();
+    }
+    if (!payload) {
+      const cleared = server.NextResponse.next();
+      cleared.cookies.set(CMSSY_SESSION_COOKIE, "", {
+        ...sessionCookieOptions(),
+        maxAge: 0
+      });
+      return cleared;
+    }
+    const sealed = await sealSession(
+      payload,
+      auth.sessionSecret,
+      config.workspaceSlug
+    );
+    request.cookies.set(CMSSY_SESSION_COOKIE, sealed);
+    const refreshed = server.NextResponse.next({ request });
+    refreshed.cookies.set(CMSSY_SESSION_COOKIE, sealed, sessionCookieOptions());
+    return refreshed;
+  };
+}
 
 exports.CMSSY_EDIT_HEADER = CMSSY_EDIT_HEADER;
 exports.CMSSY_LOCALE_HEADER = CMSSY_LOCALE_HEADER;
+exports.CMSSY_SESSION_COOKIE = CMSSY_SESSION_COOKIE;
+exports.SESSION_MAX_AGE_SECONDS = SESSION_MAX_AGE_SECONDS;
 exports.applyCmssyCsp = applyCmssyCsp;
+exports.assertAuthConfig = assertAuthConfig;
 exports.cmssyCspHeaders = cmssyCspHeaders;
+exports.createCmssyAuthMiddleware = createCmssyAuthMiddleware;
+exports.createCmssyAuthRoute = createCmssyAuthRoute;
 exports.createCmssyPage = createCmssyPage;
 exports.createDraftRoute = createDraftRoute;
+exports.getCmssyAccessToken = getCmssyAccessToken;
 exports.getCmssyLocale = getCmssyLocale;
+exports.getCmssyUser = getCmssyUser;
+exports.isAccessExpired = isAccessExpired;
 exports.isCmssyEditMode = isCmssyEditMode;
 exports.isCmssyEditRequest = isCmssyEditRequest;
 exports.localeForPathname = localeForPathname;
+exports.openSession = openSession;
+exports.sealSession = sealSession;
+exports.sessionCookieOptions = sessionCookieOptions;
 exports.splitCmssyLocale = splitCmssyLocale;

package/dist/index.d.cts

@@ -2,17 +2,24 @@ import * as react_jsx_runtime from 'react/jsx-runtime';
 import { ComponentType } from 'react';
 import { CmssyPageData, CmssyFormDefinition, BlockDefinition, CmssyClientConfig } from '@cmssy/react';
 import { EditBridgeConfig } from '@cmssy/react/client';
+import { NextRequest, NextResponse } from 'next/server';
 
+interface CmssyAuthConfig {
+    modelSlug: string;
+    sessionSecret: string;
+}
 interface CmssyNextConfig {
     apiUrl: string;
     workspaceSlug: string;
     draftSecret: string;
     editorOrigin: string | string[];
+    auth?: CmssyAuthConfig;
     defaultLocale?: string;
     /** All languages enabled on the workspace; exposed to blocks via context.locale.enabled. */
     enabledLocales?: string[];
     resolveLocale?: () => string | Promise<string>;
 }
+declare function assertAuthConfig(config: CmssyNextConfig): CmssyAuthConfig;
 
 interface CmssyEditorProps {
     page: CmssyPageData;
@@ -75,4 +82,48 @@ declare function splitCmssyLocale(config: CmssyClientConfig, path: string[] | un
 }>;
 declare function getCmssyLocale(config: CmssyClientConfig): Promise<string>;
 
-export { CMSSY_EDIT_HEADER, CMSSY_LOCALE_HEADER, type CmssyCspOptions, type CmssyDraftRouteConfig, type CmssyEditorProps, type CmssyNextConfig, type CreateCmssyPageOptions, applyCmssyCsp, cmssyCspHeaders, createCmssyPage, createDraftRoute, getCmssyLocale, isCmssyEditMode, isCmssyEditRequest, localeForPathname, splitCmssyLocale };
+declare const CMSSY_SESSION_COOKIE = "cmssy_session";
+declare const SESSION_MAX_AGE_SECONDS: number;
+interface CmssySessionUser {
+    recordId: string;
+    email: string;
+}
+interface CmssySessionPayload {
+    accessToken: string;
+    refreshToken: string;
+    accessExpiresAt: number;
+    user: CmssySessionUser;
+}
+declare function sealSession(payload: CmssySessionPayload, secret: string, audience?: string): Promise<string>;
+declare function openSession(token: string, secret: string, audience?: string): Promise<CmssySessionPayload | null>;
+declare function isAccessExpired(payload: CmssySessionPayload, now?: number): boolean;
+interface SessionCookieOptions {
+    httpOnly: true;
+    secure: boolean;
+    sameSite: "lax";
+    path: "/";
+    maxAge: number;
+}
+declare function sessionCookieOptions(): SessionCookieOptions;
+
+interface CmssyAuthRouteHandlers {
+    POST(request: Request, context: {
+        params: Promise<{
+            action: string;
+        }>;
+    }): Promise<Response>;
+    GET(request: Request, context: {
+        params: Promise<{
+            action: string;
+        }>;
+    }): Promise<Response>;
+}
+declare function createCmssyAuthRoute(config: CmssyNextConfig): CmssyAuthRouteHandlers;
+
+declare function getCmssyUser(config: CmssyNextConfig): Promise<CmssySessionUser | null>;
+declare function getCmssyAccessToken(config: CmssyNextConfig): Promise<string | null>;
+
+type CmssyAuthMiddleware = (request: NextRequest) => Promise<NextResponse>;
+declare function createCmssyAuthMiddleware(config: CmssyNextConfig): CmssyAuthMiddleware;
+
+export { CMSSY_EDIT_HEADER, CMSSY_LOCALE_HEADER, CMSSY_SESSION_COOKIE, type CmssyAuthConfig, type CmssyAuthMiddleware, type CmssyAuthRouteHandlers, type CmssyCspOptions, type CmssyDraftRouteConfig, type CmssyEditorProps, type CmssyNextConfig, type CmssySessionPayload, type CmssySessionUser, type CreateCmssyPageOptions, SESSION_MAX_AGE_SECONDS, type SessionCookieOptions, applyCmssyCsp, assertAuthConfig, cmssyCspHeaders, createCmssyAuthMiddleware, createCmssyAuthRoute, createCmssyPage, createDraftRoute, getCmssyAccessToken, getCmssyLocale, getCmssyUser, isAccessExpired, isCmssyEditMode, isCmssyEditRequest, localeForPathname, openSession, sealSession, sessionCookieOptions, splitCmssyLocale };

package/dist/index.d.ts

@@ -2,17 +2,24 @@ import * as react_jsx_runtime from 'react/jsx-runtime';
 import { ComponentType } from 'react';
 import { CmssyPageData, CmssyFormDefinition, BlockDefinition, CmssyClientConfig } from '@cmssy/react';
 import { EditBridgeConfig } from '@cmssy/react/client';
+import { NextRequest, NextResponse } from 'next/server';
 
+interface CmssyAuthConfig {
+    modelSlug: string;
+    sessionSecret: string;
+}
 interface CmssyNextConfig {
     apiUrl: string;
     workspaceSlug: string;
     draftSecret: string;
     editorOrigin: string | string[];
+    auth?: CmssyAuthConfig;
     defaultLocale?: string;
     /** All languages enabled on the workspace; exposed to blocks via context.locale.enabled. */
     enabledLocales?: string[];
     resolveLocale?: () => string | Promise<string>;
 }
+declare function assertAuthConfig(config: CmssyNextConfig): CmssyAuthConfig;
 
 interface CmssyEditorProps {
     page: CmssyPageData;
@@ -75,4 +82,48 @@ declare function splitCmssyLocale(config: CmssyClientConfig, path: string[] | un
 }>;
 declare function getCmssyLocale(config: CmssyClientConfig): Promise<string>;
 
-export { CMSSY_EDIT_HEADER, CMSSY_LOCALE_HEADER, type CmssyCspOptions, type CmssyDraftRouteConfig, type CmssyEditorProps, type CmssyNextConfig, type CreateCmssyPageOptions, applyCmssyCsp, cmssyCspHeaders, createCmssyPage, createDraftRoute, getCmssyLocale, isCmssyEditMode, isCmssyEditRequest, localeForPathname, splitCmssyLocale };
+declare const CMSSY_SESSION_COOKIE = "cmssy_session";
+declare const SESSION_MAX_AGE_SECONDS: number;
+interface CmssySessionUser {
+    recordId: string;
+    email: string;
+}
+interface CmssySessionPayload {
+    accessToken: string;
+    refreshToken: string;
+    accessExpiresAt: number;
+    user: CmssySessionUser;
+}
+declare function sealSession(payload: CmssySessionPayload, secret: string, audience?: string): Promise<string>;
+declare function openSession(token: string, secret: string, audience?: string): Promise<CmssySessionPayload | null>;
+declare function isAccessExpired(payload: CmssySessionPayload, now?: number): boolean;
+interface SessionCookieOptions {
+    httpOnly: true;
+    secure: boolean;
+    sameSite: "lax";
+    path: "/";
+    maxAge: number;
+}
+declare function sessionCookieOptions(): SessionCookieOptions;
+
+interface CmssyAuthRouteHandlers {
+    POST(request: Request, context: {
+        params: Promise<{
+            action: string;
+        }>;
+    }): Promise<Response>;
+    GET(request: Request, context: {
+        params: Promise<{
+            action: string;
+        }>;
+    }): Promise<Response>;
+}
+declare function createCmssyAuthRoute(config: CmssyNextConfig): CmssyAuthRouteHandlers;
+
+declare function getCmssyUser(config: CmssyNextConfig): Promise<CmssySessionUser | null>;
+declare function getCmssyAccessToken(config: CmssyNextConfig): Promise<string | null>;
+
+type CmssyAuthMiddleware = (request: NextRequest) => Promise<NextResponse>;
+declare function createCmssyAuthMiddleware(config: CmssyNextConfig): CmssyAuthMiddleware;
+
+export { CMSSY_EDIT_HEADER, CMSSY_LOCALE_HEADER, CMSSY_SESSION_COOKIE, type CmssyAuthConfig, type CmssyAuthMiddleware, type CmssyAuthRouteHandlers, type CmssyCspOptions, type CmssyDraftRouteConfig, type CmssyEditorProps, type CmssyNextConfig, type CmssySessionPayload, type CmssySessionUser, type CreateCmssyPageOptions, SESSION_MAX_AGE_SECONDS, type SessionCookieOptions, applyCmssyCsp, assertAuthConfig, cmssyCspHeaders, createCmssyAuthMiddleware, createCmssyAuthRoute, createCmssyPage, createDraftRoute, getCmssyAccessToken, getCmssyLocale, getCmssyUser, isAccessExpired, isCmssyEditMode, isCmssyEditRequest, localeForPathname, openSession, sealSession, sessionCookieOptions, splitCmssyLocale };

package/dist/index.js

@@ -1,8 +1,10 @@
-import { draftMode, headers } from 'next/headers';
+import { draftMode, headers, cookies } from 'next/headers';
 import { notFound, redirect } from 'next/navigation';
-import { resolveSiteLocales, splitLocaleFromPath, fetchPage, resolveForms, CmssyServerPage } from '@cmssy/react';
+import { resolveSiteLocales, splitLocaleFromPath, fetchPage, resolveForms, CmssyServerPage, graphqlRequest, resolveWorkspaceId } from '@cmssy/react';
 import { jsx } from 'react/jsx-runtime';
 import { createHash, timingSafeEqual } from 'crypto';
+import { EncryptJWT, jwtDecrypt } from 'jose';
+import { NextResponse } from 'next/server';
 
 // src/create-cmssy-page.tsx
 
@@ -224,5 +226,530 @@ async function getCmssyLocale(config) {
   const { defaultLocale } = await resolveSiteLocales(config);
   return defaultLocale;
 }
+var CMSSY_SESSION_COOKIE = "cmssy_session";
+var SESSION_MAX_AGE_SECONDS = 30 * 24 * 60 * 60;
+var MIN_SESSION_SECRET_LENGTH = 32;
+var ACCESS_EXPIRY_SKEW_MS = 3e4;
+async function deriveSessionKey(secret) {
+  if (typeof secret !== "string" || secret.length < MIN_SESSION_SECRET_LENGTH) {
+    throw new Error(
+      `cmssy auth sessionSecret must be at least ${MIN_SESSION_SECRET_LENGTH} characters`
+    );
+  }
+  const digest = await crypto.subtle.digest(
+    "SHA-256",
+    new TextEncoder().encode(secret)
+  );
+  return new Uint8Array(digest);
+}
+async function sealSession(payload, secret, audience) {
+  const key = await deriveSessionKey(secret);
+  const jwt = new EncryptJWT({ ...payload }).setProtectedHeader({ alg: "dir", enc: "A256GCM" }).setIssuedAt().setExpirationTime(`${SESSION_MAX_AGE_SECONDS}s`);
+  if (audience) jwt.setAudience(audience);
+  return jwt.encrypt(key);
+}
+async function openSession(token, secret, audience) {
+  const key = await deriveSessionKey(secret);
+  try {
+    const { payload } = await jwtDecrypt(token, key, {
+      keyManagementAlgorithms: ["dir"],
+      contentEncryptionAlgorithms: ["A256GCM"],
+      ...audience ? { audience } : {}
+    });
+    const { accessToken, refreshToken, accessExpiresAt, user } = payload;
+    if (typeof accessToken !== "string" || typeof refreshToken !== "string" || !Number.isFinite(accessExpiresAt) || !user || typeof user !== "object" || typeof user.recordId !== "string" || typeof user.email !== "string") {
+      return null;
+    }
+    return {
+      accessToken,
+      refreshToken,
+      accessExpiresAt,
+      user: {
+        recordId: user.recordId,
+        email: user.email
+      }
+    };
+  } catch {
+    return null;
+  }
+}
+function isAccessExpired(payload, now = Date.now()) {
+  return payload.accessExpiresAt <= now + ACCESS_EXPIRY_SKEW_MS;
+}
+function sessionCookieOptions() {
+  return {
+    httpOnly: true,
+    secure: process.env.NODE_ENV !== "development",
+    sameSite: "lax",
+    path: "/",
+    maxAge: SESSION_MAX_AGE_SECONDS
+  };
+}
+
+// src/config.ts
+function assertAuthConfig(config) {
+  const auth = config.auth;
+  if (!auth || typeof auth.modelSlug !== "string" || !auth.modelSlug) {
+    throw new Error("cmssy: config.auth.modelSlug is required for auth routes");
+  }
+  if (typeof auth.sessionSecret !== "string" || auth.sessionSecret.length < MIN_SESSION_SECRET_LENGTH) {
+    throw new Error(
+      `cmssy: config.auth.sessionSecret must be at least ${MIN_SESSION_SECRET_LENGTH} characters`
+    );
+  }
+  return auth;
+}
+var LOGIN_MUTATION = `mutation SiteMemberLogin($input: SiteMemberLoginInput!) {
+  siteMemberLogin(input: $input) {
+    success message accessToken refreshToken accessTokenExpiresIn
+  }
+}`;
+var REGISTER_MUTATION = `mutation SiteMemberRegister($input: SiteMemberRegisterInput!) {
+  siteMemberRegister(input: $input) { success message }
+}`;
+var REFRESH_MUTATION = `mutation SiteMemberRefresh($refreshToken: String!) {
+  siteMemberRefresh(refreshToken: $refreshToken) {
+    success message accessToken refreshToken accessTokenExpiresIn
+  }
+}`;
+var LOGOUT_MUTATION = `mutation SiteMemberLogout($refreshToken: String!) {
+  siteMemberLogout(refreshToken: $refreshToken) { success message }
+}`;
+var LOGOUT_EVERYWHERE_MUTATION = `mutation SiteMemberLogoutEverywhere {
+  siteMemberLogoutEverywhere { success message }
+}`;
+var FORGOT_MUTATION = `mutation SiteMemberForgotPassword($modelSlug: String!, $identity: String!) {
+  siteMemberForgotPassword(modelSlug: $modelSlug, identity: $identity) { success message }
+}`;
+var RESET_MUTATION = `mutation SiteMemberResetPassword($token: String!, $newPassword: String!) {
+  siteMemberResetPassword(token: $token, newPassword: $newPassword) { success message }
+}`;
+var VERIFY_MUTATION = `mutation SiteMemberVerifyEmail($token: String!) {
+  siteMemberVerifyEmail(token: $token) { success message }
+}`;
+var workspaceIdCache = /* @__PURE__ */ new Map();
+function workspaceIdFor(config) {
+  const key = `${config.apiUrl}::${config.workspaceSlug}`;
+  const existing = workspaceIdCache.get(key);
+  if (existing) return existing;
+  const fresh = resolveWorkspaceId(config).catch((err) => {
+    workspaceIdCache.delete(key);
+    throw err;
+  });
+  workspaceIdCache.set(key, fresh);
+  return fresh;
+}
+async function authRequest(config, query, variables, label, accessToken) {
+  const workspaceId = await workspaceIdFor(config);
+  return graphqlRequest(
+    config,
+    query,
+    variables,
+    {
+      headers: {
+        "x-workspace-id": workspaceId,
+        ...accessToken ? { authorization: `Bearer ${accessToken}` } : {}
+      }
+    },
+    label
+  );
+}
+function decodeAccessClaims(accessToken) {
+  const parts = accessToken.split(".");
+  if (parts.length !== 3) return null;
+  try {
+    const base64 = parts[1].replace(/-/g, "+").replace(/_/g, "/");
+    const bytes = Uint8Array.from(atob(base64), (c) => c.charCodeAt(0));
+    const json2 = JSON.parse(new TextDecoder().decode(bytes));
+    if (typeof json2.recordId !== "string" || typeof json2.email !== "string" || json2.type !== "site_member") {
+      return null;
+    }
+    return { recordId: json2.recordId, email: json2.email };
+  } catch {
+    return null;
+  }
+}
+function toSessionPayload(result) {
+  if (!result.success || !result.accessToken || !result.refreshToken || !result.accessTokenExpiresIn) {
+    return null;
+  }
+  const user = decodeAccessClaims(result.accessToken);
+  if (!user) return null;
+  return {
+    accessToken: result.accessToken,
+    refreshToken: result.refreshToken,
+    accessExpiresAt: Date.now() + result.accessTokenExpiresIn * 1e3,
+    user
+  };
+}
+async function backendSignIn(config, modelSlug, identity, password) {
+  const data = await authRequest(
+    config,
+    LOGIN_MUTATION,
+    {
+      input: { modelSlug, identity, password }
+    },
+    "site member login"
+  );
+  return data.siteMemberLogin;
+}
+async function backendRegister(config, modelSlug, identity, password, fields) {
+  const data = await authRequest(
+    config,
+    REGISTER_MUTATION,
+    {
+      input: { modelSlug, identity, password, fields }
+    },
+    "site member register"
+  );
+  return data.siteMemberRegister;
+}
+async function backendRefresh(config, refreshToken) {
+  const data = await authRequest(
+    config,
+    REFRESH_MUTATION,
+    { refreshToken },
+    "site member refresh"
+  );
+  return data.siteMemberRefresh;
+}
+async function backendSignOut(config, refreshToken) {
+  try {
+    await authRequest(
+      config,
+      LOGOUT_MUTATION,
+      { refreshToken },
+      "site member logout"
+    );
+  } catch {
+    return;
+  }
+}
+async function backendSignOutEverywhere(config, accessToken) {
+  try {
+    await authRequest(
+      config,
+      LOGOUT_EVERYWHERE_MUTATION,
+      {},
+      "site member logout everywhere",
+      accessToken
+    );
+  } catch {
+    return;
+  }
+}
+async function backendForgotPassword(config, modelSlug, identity) {
+  const data = await authRequest(
+    config,
+    FORGOT_MUTATION,
+    { modelSlug, identity },
+    "site member forgot password"
+  );
+  return data.siteMemberForgotPassword;
+}
+async function backendResetPassword(config, token, newPassword) {
+  const data = await authRequest(
+    config,
+    RESET_MUTATION,
+    { token, newPassword },
+    "site member reset password"
+  );
+  return data.siteMemberResetPassword;
+}
+async function backendVerifyEmail(config, token) {
+  const data = await authRequest(
+    config,
+    VERIFY_MUTATION,
+    { token },
+    "site member verify email"
+  );
+  return data.siteMemberVerifyEmail;
+}
+
+// src/create-auth-route.ts
+var MAX_BODY_CHARS = 16 * 1024;
+function json(body, status = 200) {
+  return new Response(JSON.stringify(body), {
+    status,
+    headers: {
+      "content-type": "application/json",
+      "cache-control": "no-store"
+    }
+  });
+}
+async function readBody(request) {
+  const contentType = request.headers.get("content-type") ?? "";
+  if (!contentType.toLowerCase().includes("application/json")) {
+    throw new Error("content-type must be application/json");
+  }
+  const text = await request.text();
+  if (text.length > MAX_BODY_CHARS) {
+    throw new Error("body too large");
+  }
+  if (!text) return {};
+  const parsed = JSON.parse(text);
+  if (!parsed || typeof parsed !== "object" || Array.isArray(parsed)) {
+    throw new Error("body must be a JSON object");
+  }
+  return parsed;
+}
+function str(value) {
+  return typeof value === "string" ? value : "";
+}
+function plainObject(value) {
+  if (!value || typeof value !== "object" || Array.isArray(value)) return {};
+  return value;
+}
+async function readSession(config, auth) {
+  const jar = await cookies();
+  const raw = jar.get(CMSSY_SESSION_COOKIE)?.value;
+  if (!raw) return null;
+  return openSession(raw, auth.sessionSecret, config.workspaceSlug);
+}
+async function writeSession(config, auth, payload) {
+  const sealed = await sealSession(
+    payload,
+    auth.sessionSecret,
+    config.workspaceSlug
+  );
+  const jar = await cookies();
+  jar.set(CMSSY_SESSION_COOKIE, sealed, sessionCookieOptions());
+}
+async function clearSession() {
+  const jar = await cookies();
+  jar.set(CMSSY_SESSION_COOKIE, "", {
+    ...sessionCookieOptions(),
+    maxAge: 0
+  });
+}
+async function refreshSession(config, auth, session) {
+  const result = await backendRefresh(config, session.refreshToken);
+  const payload = toSessionPayload(result);
+  if (!payload) {
+    await clearSession();
+    return null;
+  }
+  await writeSession(config, auth, payload);
+  return payload;
+}
+function createCmssyAuthRoute(config) {
+  const auth = assertAuthConfig(config);
+  async function handleSignIn(body) {
+    const identity = str(body.identity);
+    const password = str(body.password);
+    if (!identity || !password) {
+      return json({ ok: false, message: "Invalid credentials." }, 400);
+    }
+    const result = await backendSignIn(
+      config,
+      auth.modelSlug,
+      identity,
+      password
+    );
+    const payload = toSessionPayload(result);
+    if (!payload) {
+      return json({ ok: false, message: result.message }, 401);
+    }
+    await writeSession(config, auth, payload);
+    return json({ ok: true, user: payload.user });
+  }
+  async function handleRegister(body) {
+    const identity = str(body.identity);
+    const password = str(body.password);
+    if (!identity || !password) {
+      return json({ ok: false, message: "Invalid input." }, 400);
+    }
+    const result = await backendRegister(
+      config,
+      auth.modelSlug,
+      identity,
+      password,
+      plainObject(body.fields)
+    );
+    return json({ ok: result.success, message: result.message });
+  }
+  async function handleSignOut() {
+    const session = await readSession(config, auth);
+    if (session) {
+      await backendSignOut(config, session.refreshToken);
+    }
+    await clearSession();
+    return json({ ok: true });
+  }
+  async function handleSignOutEverywhere() {
+    let session = await readSession(config, auth);
+    if (session && isAccessExpired(session)) {
+      session = await refreshSession(config, auth, session);
+    }
+    if (session) {
+      await backendSignOutEverywhere(config, session.accessToken);
+    }
+    await clearSession();
+    return json({ ok: true });
+  }
+  async function handleRefresh() {
+    const session = await readSession(config, auth);
+    if (!session) {
+      return json({ ok: false, user: null }, 401);
+    }
+    const refreshed = await refreshSession(config, auth, session);
+    if (!refreshed) {
+      return json({ ok: false, user: null }, 401);
+    }
+    return json({ ok: true, user: refreshed.user });
+  }
+  async function handleMe() {
+    let session = await readSession(config, auth);
+    if (session && isAccessExpired(session)) {
+      session = await refreshSession(config, auth, session);
+    }
+    return json({ user: session?.user ?? null });
+  }
+  async function handleForgotPassword(body) {
+    const identity = str(body.identity);
+    if (!identity) {
+      return json({ ok: false, message: "Invalid input." }, 400);
+    }
+    const result = await backendForgotPassword(
+      config,
+      auth.modelSlug,
+      identity
+    );
+    return json({ ok: result.success, message: result.message });
+  }
+  async function handleResetPassword(body) {
+    const token = str(body.token);
+    const newPassword = str(body.newPassword);
+    if (!token || !newPassword) {
+      return json({ ok: false, message: "Invalid input." }, 400);
+    }
+    const result = await backendResetPassword(config, token, newPassword);
+    return json({ ok: result.success, message: result.message });
+  }
+  async function handleVerifyEmail(body) {
+    const token = str(body.token);
+    if (!token) {
+      return json({ ok: false, message: "Invalid input." }, 400);
+    }
+    const result = await backendVerifyEmail(config, token);
+    return json({ ok: result.success, message: result.message });
+  }
+  return {
+    async POST(request, context) {
+      const { action } = await context.params;
+      let body;
+      try {
+        body = await readBody(request);
+      } catch {
+        return json({ ok: false, message: "Invalid request body." }, 400);
+      }
+      try {
+        switch (action) {
+          case "sign-in":
+            return await handleSignIn(body);
+          case "register":
+            return await handleRegister(body);
+          case "sign-out":
+            return await handleSignOut();
+          case "sign-out-everywhere":
+            return await handleSignOutEverywhere();
+          case "refresh":
+            return await handleRefresh();
+          case "forgot-password":
+            return await handleForgotPassword(body);
+          case "reset-password":
+            return await handleResetPassword(body);
+          case "verify-email":
+            return await handleVerifyEmail(body);
+          default:
+            return json({ ok: false, message: "Not found." }, 404);
+        }
+      } catch {
+        return json({ ok: false, message: "Something went wrong." }, 500);
+      }
+    },
+    async GET(_request, context) {
+      const { action } = await context.params;
+      if (action !== "me") {
+        return json({ ok: false, message: "Not found." }, 404);
+      }
+      try {
+        return await handleMe();
+      } catch {
+        return json({ user: null });
+      }
+    }
+  };
+}
+async function readValidSession(config) {
+  const auth = assertAuthConfig(config);
+  const jar = await cookies();
+  const raw = jar.get(CMSSY_SESSION_COOKIE)?.value;
+  if (!raw) return null;
+  const session = await openSession(
+    raw,
+    auth.sessionSecret,
+    config.workspaceSlug
+  );
+  if (!session || isAccessExpired(session)) return null;
+  return session;
+}
+async function getCmssyUser(config) {
+  const session = await readValidSession(config);
+  return session?.user ?? null;
+}
+async function getCmssyAccessToken(config) {
+  const session = await readValidSession(config);
+  return session?.accessToken ?? null;
+}
+function isPrefetch(request) {
+  return request.headers.get("next-router-prefetch") !== null || request.headers.get("purpose") === "prefetch" || (request.headers.get("sec-purpose") ?? "").includes("prefetch");
+}
+function createCmssyAuthMiddleware(config) {
+  const auth = assertAuthConfig(config);
+  return async function cmssyAuthMiddleware(request) {
+    const raw = request.cookies.get(CMSSY_SESSION_COOKIE)?.value;
+    if (!raw) return NextResponse.next();
+    const session = await openSession(
+      raw,
+      auth.sessionSecret,
+      config.workspaceSlug
+    );
+    if (!session) {
+      const response = NextResponse.next();
+      response.cookies.set(CMSSY_SESSION_COOKIE, "", {
+        ...sessionCookieOptions(),
+        maxAge: 0
+      });
+      return response;
+    }
+    if (!isAccessExpired(session)) return NextResponse.next();
+    if (isPrefetch(request)) return NextResponse.next();
+    let payload = null;
+    try {
+      const result = await backendRefresh(config, session.refreshToken);
+      payload = toSessionPayload(result);
+    } catch {
+      return NextResponse.next();
+    }
+    if (!payload) {
+      const cleared = NextResponse.next();
+      cleared.cookies.set(CMSSY_SESSION_COOKIE, "", {
+        ...sessionCookieOptions(),
+        maxAge: 0
+      });
+      return cleared;
+    }
+    const sealed = await sealSession(
+      payload,
+      auth.sessionSecret,
+      config.workspaceSlug
+    );
+    request.cookies.set(CMSSY_SESSION_COOKIE, sealed);
+    const refreshed = NextResponse.next({ request });
+    refreshed.cookies.set(CMSSY_SESSION_COOKIE, sealed, sessionCookieOptions());
+    return refreshed;
+  };
+}
 
-export { CMSSY_EDIT_HEADER, CMSSY_LOCALE_HEADER, applyCmssyCsp, cmssyCspHeaders, createCmssyPage, createDraftRoute, getCmssyLocale, isCmssyEditMode, isCmssyEditRequest, localeForPathname, splitCmssyLocale };
+export { CMSSY_EDIT_HEADER, CMSSY_LOCALE_HEADER, CMSSY_SESSION_COOKIE, SESSION_MAX_AGE_SECONDS, applyCmssyCsp, assertAuthConfig, cmssyCspHeaders, createCmssyAuthMiddleware, createCmssyAuthRoute, createCmssyPage, createDraftRoute, getCmssyAccessToken, getCmssyLocale, getCmssyUser, isAccessExpired, isCmssyEditMode, isCmssyEditRequest, localeForPathname, openSession, sealSession, sessionCookieOptions, splitCmssyLocale };

package/package.json

@@ -1,6 +1,6 @@
 {
   "name": "@cmssy/next",
-  "version": "0.1.7",
+  "version": "0.1.9",
   "description": "Next.js App Router bindings for cmssy headless sites (createCmssyPage + draft preview)",
   "keywords": [
     "cmssy",
@@ -49,7 +49,10 @@
     "tsup": "^8.3.0",
     "typescript": "^5.6.0",
     "vitest": "^2.1.0",
-    "@cmssy/react": "0.1.7"
+    "@cmssy/react": "0.1.9"
+  },
+  "dependencies": {
+    "jose": "^6.2.3"
   },
   "scripts": {
     "build": "tsup",