@coreiam/auth 1.0.0

package/dist/core/index.d.ts

@@ -0,0 +1,21 @@
+export interface CoreIAMConfig {
+    baseUrl?: string;
+    apiKey?: string;
+    tenantId?: string;
+}
+export declare class CoreIAM {
+    private apiKey;
+    private baseUrl;
+    constructor(config?: {
+        apiKey?: string;
+        baseUrl?: string;
+    });
+    refreshTokens(headers: Headers): Promise<string[] | null>;
+    proxy(path: string, init: RequestInit, incomingHeaders: Headers): Promise<Response>;
+    getCsrfToken(headers: Headers): Promise<Response>;
+    login(body: any, headers: Headers): Promise<Response>;
+    register(body: any, headers: Headers): Promise<Response>;
+    logout(headers: Headers): Promise<Response>;
+    loginWithCsrfProtection(identifier: string, password: string, incomingHeaders: Headers): Promise<Response>;
+    registerWithCsrfProtection(userData: any, incomingHeaders: Headers): Promise<Response>;
+}

package/dist/core/index.js

@@ -0,0 +1,121 @@
+"use strict";
+// src/core/index.ts
+Object.defineProperty(exports, "__esModule", { value: true });
+exports.CoreIAM = void 0;
+const DEFAULT_GATEWAY_URL = "https://api.e-qalam.com";
+class CoreIAM {
+    apiKey = '';
+    baseUrl = '';
+    constructor(config) {
+        this.apiKey = config?.apiKey || process.env.COREIAM_API_KEY || '';
+        this.baseUrl = config?.baseUrl || DEFAULT_GATEWAY_URL;
+        if (!this.apiKey)
+            throw new Error('CoreIAM: Missing API Key');
+    }
+    // Exposed publicly so the Next.js layer can use it for getSession()
+    async refreshTokens(headers) {
+        try {
+            const response = await fetch(`${this.baseUrl}/auth/refresh-token`, {
+                method: 'POST',
+                headers: {
+                    'X-API-Key': this.apiKey,
+                    'cookie': headers.get('cookie') || '',
+                },
+            });
+            if (response.ok) {
+                const setCookies = response.headers.getSetCookie();
+                if (setCookies && setCookies.length > 0) {
+                    return setCookies;
+                }
+            }
+            return null;
+        }
+        catch (error) {
+            return null;
+        }
+    }
+    async proxy(path, init, incomingHeaders) {
+        const url = `${this.baseUrl}${path}`;
+        const headers = new Headers(init.headers);
+        if (this.apiKey) {
+            headers.set('X-API-Key', this.apiKey);
+        }
+        const userAgent = incomingHeaders.get('user-agent');
+        if (userAgent)
+            headers.set('user-agent', userAgent);
+        const forwardedFor = incomingHeaders.get('x-forwarded-for');
+        if (forwardedFor)
+            headers.set('x-forwarded-for', forwardedFor);
+        const cookie = incomingHeaders.get('cookie');
+        if (cookie) {
+            headers.set('cookie', cookie);
+            const jwtMatch = cookie.match(/jwt=([^;]+)/);
+            if (jwtMatch) {
+                headers.set('Authorization', `Bearer ${jwtMatch[1]}`);
+            }
+        }
+        const csrf = incomingHeaders.get('x-csrf-token');
+        if (csrf)
+            headers.set('x-csrf-token', csrf);
+        // Removed the 401 interceptor here to prevent infinite loops.
+        // The getSession() action will handle refreshes safely.
+        return fetch(url, { ...init, headers });
+    }
+    async getCsrfToken(headers) {
+        return this.proxy('/auth/csrf-token', { method: 'POST' }, headers);
+    }
+    async login(body, headers) {
+        return this.proxy('/auth/login', { method: 'POST', body: JSON.stringify(body) }, headers);
+    }
+    async register(body, headers) {
+        return this.proxy('/auth/register', { method: 'POST', body: JSON.stringify(body) }, headers);
+    }
+    async logout(headers) {
+        return this.proxy('/auth/logout', { method: 'POST' }, headers);
+    }
+    async loginWithCsrfProtection(identifier, password, incomingHeaders) {
+        const csrfResponse = await this.getCsrfToken(incomingHeaders);
+        const csrfData = await csrfResponse.json();
+        const csrfToken = csrfData.csrfToken || csrfData._csrf;
+        if (!csrfToken)
+            throw new Error('Failed to obtain CSRF token');
+        const authHeaders = new Headers(incomingHeaders);
+        authHeaders.set('x-csrf-token', csrfToken);
+        const csrfCookies = csrfResponse.headers.getSetCookie();
+        const existingCookieStr = incomingHeaders.get('cookie') || '';
+        const newCookiePairs = csrfCookies.map(c => c.split(';')[0]);
+        if (newCookiePairs.length > 0) {
+            const combinedCookies = [existingCookieStr, ...newCookiePairs].filter(Boolean).join('; ');
+            authHeaders.set('cookie', combinedCookies);
+        }
+        return this.proxy('/auth/login', {
+            method: 'POST',
+            headers: { 'Content-Type': 'application/json' },
+            body: JSON.stringify({ identifier, password }),
+        }, authHeaders);
+    }
+    async registerWithCsrfProtection(userData, incomingHeaders) {
+        const csrfResponse = await this.getCsrfToken(incomingHeaders);
+        const csrfData = await csrfResponse.json();
+        const csrfToken = csrfData.csrfToken || csrfData._csrf;
+        if (!csrfToken)
+            throw new Error('Failed to obtain CSRF token');
+        const authHeaders = new Headers(incomingHeaders);
+        authHeaders.set('x-csrf-token', csrfToken);
+        const setCookieHeader = csrfResponse.headers.get('set-cookie');
+        if (setCookieHeader) {
+            const existingCookie = incomingHeaders.get('cookie') || '';
+            const updatedCookie = setCookieHeader.split(',').map(cookie => cookie.trim())
+                .map(cookie => cookie.split(';')[0])
+                .join('; ');
+            const combinedCookies = [existingCookie, updatedCookie].filter(Boolean).join('; ');
+            authHeaders.set('cookie', combinedCookies);
+        }
+        return this.proxy('/auth/register', {
+            method: 'POST',
+            headers: { 'Content-Type': 'application/json' },
+            body: JSON.stringify(userData),
+        }, authHeaders);
+    }
+}
+exports.CoreIAM = CoreIAM;

package/dist/nextjs/actions.d.ts

@@ -0,0 +1,13 @@
+export interface AuthResult {
+    ok: boolean;
+    status: number;
+    data: any;
+}
+/**
+ * NEW: Securely gets the user session.
+ * Handles 401 by attempting a silent refresh internally.
+ */
+export declare function getSession(): Promise<any | null>;
+export declare function loginActionSdk(identifier: string, password: string): Promise<AuthResult>;
+export declare function registerActionSdk(userData: any): Promise<AuthResult>;
+export declare function logoutActionSdk(): Promise<AuthResult>;

package/dist/nextjs/actions.js

@@ -0,0 +1,122 @@
+"use strict";
+// src/nextjs/actions.ts
+'use server';
+Object.defineProperty(exports, "__esModule", { value: true });
+exports.getSession = getSession;
+exports.loginActionSdk = loginActionSdk;
+exports.registerActionSdk = registerActionSdk;
+exports.logoutActionSdk = logoutActionSdk;
+const headers_1 = require("next/headers");
+const core_1 = require("../core");
+const iam = new core_1.CoreIAM();
+async function syncCookiesToNext(response) {
+    const cookieStore = await (0, headers_1.cookies)();
+    const setCookies = response.headers.getSetCookie();
+    for (const cookieStr of setCookies) {
+        const parts = cookieStr.split(';');
+        const [nameValue, ...attributes] = parts;
+        const [name, ...valueParts] = nameValue.split('=');
+        const cookieOptions = {};
+        let isDeleting = false;
+        attributes.forEach(attr => {
+            const [attrName, attrValue] = attr.trim().split('=');
+            const lowerName = attrName?.toLowerCase();
+            if (lowerName === 'httponly')
+                cookieOptions.httpOnly = true;
+            if (lowerName === 'secure')
+                cookieOptions.secure = true;
+            if (lowerName === 'path')
+                cookieOptions.path = attrValue || '/';
+            if (lowerName === 'max-age') {
+                const maxAge = parseInt(attrValue, 10);
+                if (maxAge <= 0) {
+                    isDeleting = true;
+                }
+                else {
+                    cookieOptions.maxAge = maxAge;
+                }
+            }
+            if (lowerName === 'expires') {
+                const expiryDate = new Date(attrValue);
+                if (expiryDate.getTime() < Date.now()) {
+                    isDeleting = true;
+                }
+                else {
+                    cookieOptions.expires = expiryDate;
+                }
+            }
+            if (lowerName === 'samesite')
+                cookieOptions.sameSite = attrValue?.toLowerCase() || 'lax';
+        });
+        const cookieName = name.trim();
+        const cookieValue = valueParts.join('=').trim();
+        if (isDeleting || cookieValue === '') {
+            cookieStore.delete(cookieName);
+        }
+        else {
+            cookieStore.set(cookieName, cookieValue, cookieOptions);
+        }
+    }
+}
+/**
+ * NEW: Securely gets the user session.
+ * Handles 401 by attempting a silent refresh internally.
+ */
+async function getSession() {
+    const reqHeaders = await (0, headers_1.headers)();
+    let response = await iam.proxy('/auth/profile', { method: 'GET' }, reqHeaders);
+    if (response.status === 401) {
+        const refreshResponse = await iam.refreshTokens(reqHeaders);
+        if (refreshResponse && refreshResponse.length > 0) {
+            // Sync the new cookies to the browser
+            const fakeRes = new Response(null, { headers: { 'set-cookie': refreshResponse.join(', ') } });
+            await syncCookiesToNext(fakeRes);
+            // Build new headers with the refreshed cookies and retry
+            const cookieStore = await (0, headers_1.cookies)();
+            const newJwt = cookieStore.get('jwt')?.value;
+            const newRefresh = cookieStore.get('refreshToken')?.value;
+            const retryHeaders = new Headers(reqHeaders);
+            if (newJwt && newRefresh) {
+                retryHeaders.set('cookie', `jwt=${newJwt}; refreshToken=${newRefresh}`);
+                retryHeaders.set('Authorization', `Bearer ${newJwt}`);
+            }
+            response = await iam.proxy('/auth/profile', { method: 'GET' }, retryHeaders);
+        }
+    }
+    if (!response.ok)
+        return null;
+    return response.json();
+}
+async function loginActionSdk(identifier, password) {
+    const reqHeaders = await (0, headers_1.headers)();
+    try {
+        const response = await iam.loginWithCsrfProtection(identifier, password, reqHeaders);
+        await syncCookiesToNext(response);
+        return { ok: response.ok, status: response.status, data: await response.json().catch(() => ({})) };
+    }
+    catch (error) {
+        return { ok: false, status: 500, data: { error: error instanceof Error ? error.message : 'Login failed' } };
+    }
+}
+async function registerActionSdk(userData) {
+    const reqHeaders = await (0, headers_1.headers)();
+    try {
+        const response = await iam.registerWithCsrfProtection(userData, reqHeaders);
+        await syncCookiesToNext(response);
+        return { ok: response.ok, status: response.status, data: await response.json().catch(() => ({})) };
+    }
+    catch (error) {
+        return { ok: false, status: 500, data: { error: error instanceof Error ? error.message : 'Registration failed' } };
+    }
+}
+async function logoutActionSdk() {
+    const reqHeaders = await (0, headers_1.headers)();
+    try {
+        const response = await iam.logout(reqHeaders);
+        await syncCookiesToNext(response);
+        return { ok: response.ok, status: response.status, data: await response.json().catch(() => ({})) };
+    }
+    catch (error) {
+        return { ok: false, status: 500, data: { error: 'Logout failed' } };
+    }
+}

package/dist/nextjs/index.d.ts

@@ -0,0 +1,9 @@
+export { CoreIAMProvider, useAuth } from './provider';
+export { loginActionSdk, registerActionSdk, logoutActionSdk, getSession } from './actions';
+import { NextRequest, NextResponse } from 'next/server';
+import { CoreIAM } from '../core';
+export declare class NextHandlers {
+    private iam;
+    constructor(iam: CoreIAM);
+    handleProxy(req: NextRequest, internalPath: string): Promise<NextResponse<any>>;
+}

package/dist/nextjs/index.js

@@ -0,0 +1,45 @@
+"use strict";
+Object.defineProperty(exports, "__esModule", { value: true });
+exports.NextHandlers = exports.getSession = exports.logoutActionSdk = exports.registerActionSdk = exports.loginActionSdk = exports.useAuth = exports.CoreIAMProvider = void 0;
+// src/nextjs/index.ts
+var provider_1 = require("./provider");
+Object.defineProperty(exports, "CoreIAMProvider", { enumerable: true, get: function () { return provider_1.CoreIAMProvider; } });
+Object.defineProperty(exports, "useAuth", { enumerable: true, get: function () { return provider_1.useAuth; } });
+var actions_1 = require("./actions");
+Object.defineProperty(exports, "loginActionSdk", { enumerable: true, get: function () { return actions_1.loginActionSdk; } });
+Object.defineProperty(exports, "registerActionSdk", { enumerable: true, get: function () { return actions_1.registerActionSdk; } });
+Object.defineProperty(exports, "logoutActionSdk", { enumerable: true, get: function () { return actions_1.logoutActionSdk; } });
+Object.defineProperty(exports, "getSession", { enumerable: true, get: function () { return actions_1.getSession; } });
+const server_1 = require("next/server");
+class NextHandlers {
+    iam;
+    constructor(iam) {
+        this.iam = iam;
+    }
+    async handleProxy(req, internalPath) {
+        const method = internalPath === '/csrf' ? 'POST' : req.method;
+        const body = method !== 'GET' ? await req.json().catch(() => undefined) : undefined;
+        let targetPath = internalPath;
+        if (internalPath === '/csrf') {
+            targetPath = '/auth/csrf-token';
+        }
+        else if (!internalPath.startsWith('/auth')) {
+            targetPath = `/auth${internalPath}`;
+        }
+        const response = await this.iam.proxy(targetPath, {
+            method: method,
+            body: body ? JSON.stringify(body) : undefined,
+            headers: { 'Content-Type': 'application/json' },
+        }, req.headers);
+        const data = await response.json().catch(() => ({}));
+        const res = server_1.NextResponse.json(data, { status: response.status });
+        const setCookies = response.headers.getSetCookie();
+        if (setCookies && setCookies.length > 0) {
+            setCookies.forEach(cookie => {
+                res.headers.append('set-cookie', cookie);
+            });
+        }
+        return res;
+    }
+}
+exports.NextHandlers = NextHandlers;

package/dist/nextjs/provider.d.ts

@@ -0,0 +1,10 @@
+import React from 'react';
+interface AuthContextType {
+    user: any | null;
+    isLoading: boolean;
+}
+export declare function CoreIAMProvider({ children }: {
+    children: React.ReactNode;
+}): import("react/jsx-runtime").JSX.Element;
+export declare function useAuth(): AuthContextType;
+export {};

package/dist/nextjs/provider.js

@@ -0,0 +1,26 @@
+"use strict";
+// src/nextjs/provider.tsx
+'use client';
+Object.defineProperty(exports, "__esModule", { value: true });
+exports.CoreIAMProvider = CoreIAMProvider;
+exports.useAuth = useAuth;
+const jsx_runtime_1 = require("react/jsx-runtime");
+const react_1 = require("react");
+const AuthContext = (0, react_1.createContext)({
+    user: null,
+    isLoading: true,
+});
+function CoreIAMProvider({ children }) {
+    const [user, setUser] = (0, react_1.useState)(null);
+    const [isLoading, setIsLoading] = (0, react_1.useState)(true);
+    (0, react_1.useEffect)(() => {
+        fetch('/api/auth/session')
+            .then(res => res.ok ? res.json() : null)
+            .then(data => setUser(data))
+            .finally(() => setIsLoading(false));
+    }, []);
+    return ((0, jsx_runtime_1.jsx)(AuthContext.Provider, { value: { user, isLoading }, children: children }));
+}
+function useAuth() {
+    return (0, react_1.useContext)(AuthContext);
+}

package/dist/react/index.d.ts

@@ -0,0 +1,2 @@
+export { CoreIAMProvider, useAuth } from './provider';
+export { CoreIAM } from '../core';

package/dist/react/index.js

@@ -0,0 +1,9 @@
+"use strict";
+Object.defineProperty(exports, "__esModule", { value: true });
+exports.CoreIAM = exports.useAuth = exports.CoreIAMProvider = void 0;
+// src/react/index.ts
+var provider_1 = require("./provider");
+Object.defineProperty(exports, "CoreIAMProvider", { enumerable: true, get: function () { return provider_1.CoreIAMProvider; } });
+Object.defineProperty(exports, "useAuth", { enumerable: true, get: function () { return provider_1.useAuth; } });
+var core_1 = require("../core");
+Object.defineProperty(exports, "CoreIAM", { enumerable: true, get: function () { return core_1.CoreIAM; } });

package/dist/react/provider.d.ts

@@ -0,0 +1,11 @@
+import React from 'react';
+interface AuthContextType {
+    user: any | null;
+    isLoading: boolean;
+}
+export declare function CoreIAMProvider({ children, sessionUrl }: {
+    children: React.ReactNode;
+    sessionUrl?: string;
+}): import("react/jsx-runtime").JSX.Element;
+export declare function useAuth(): AuthContextType;
+export {};

package/dist/react/provider.js

@@ -0,0 +1,26 @@
+"use strict";
+// src/react/provider.tsx
+'use client';
+Object.defineProperty(exports, "__esModule", { value: true });
+exports.CoreIAMProvider = CoreIAMProvider;
+exports.useAuth = useAuth;
+const jsx_runtime_1 = require("react/jsx-runtime");
+const react_1 = require("react");
+const AuthContext = (0, react_1.createContext)({
+    user: null,
+    isLoading: true,
+});
+function CoreIAMProvider({ children, sessionUrl = '/api/auth/session' }) {
+    const [user, setUser] = (0, react_1.useState)(null);
+    const [isLoading, setIsLoading] = (0, react_1.useState)(true);
+    (0, react_1.useEffect)(() => {
+        fetch(sessionUrl, { credentials: 'include' })
+            .then(res => res.ok ? res.json() : null)
+            .then(data => setUser(data))
+            .finally(() => setIsLoading(false));
+    }, [sessionUrl]);
+    return ((0, jsx_runtime_1.jsx)(AuthContext.Provider, { value: { user, isLoading }, children: children }));
+}
+function useAuth() {
+    return (0, react_1.useContext)(AuthContext);
+}

package/package.json

@@ -0,0 +1,45 @@
+{
+  "name": "@coreiam/auth",
+  "version": "1.0.0",
+  "main": "./dist/core/index.js",
+  "types": "./dist/core/index.d.ts",
+  "exports": {
+    ".": {
+      "types": "./dist/core/index.d.ts",
+      "import": "./dist/core/index.js",
+      "require": "./dist/core/index.js"
+    },
+    "./nextjs": {
+      "types": "./dist/nextjs/index.d.ts",
+      "import": "./dist/nextjs/index.js",
+      "require": "./dist/nextjs/index.js"
+    },
+    "./react": {
+      "types": "./dist/react/index.d.ts",
+      "import": "./dist/react/index.js",
+      "require": "./dist/react/index.js"
+    }
+  },
+  "files": ["dist"],
+  "scripts": {
+    "build": "tsc"
+  },
+  "keywords": ["coreiam", "auth", "saas", "multi-tenant", "nextjs"],
+  "author": "coreIAM",
+  "license": "MIT",
+  "publishConfig": { "access": "public" },
+  "peerDependencies": {
+    "next": ">=14",
+    "react": ">=18"
+  },
+  "peerDependenciesMeta": {
+    "next": { "optional": true },
+    "react": { "optional": true }
+  },
+  "devDependencies": {
+    "@types/react": "^19.2.7",
+    "next": "^16.2.11",
+    "react": "^19.2.7",
+    "typescript": "^5.0.0"
+  }
+}