@coreiam/auth 1.0.12 → 1.0.14

package/dist/core/index.d.ts

@@ -23,6 +23,22 @@ export declare class CoreIAM {
     login(body: any, headers: Headers): Promise<Response>;
     register(body: any, headers: Headers): Promise<Response>;
     logout(headers: Headers): Promise<Response>;
+    /**
+       * FIX: shared CSRF handshake, factored out of what used to be two
+       * near-identical copies in loginWithCsrfProtection/registerWithCsrfProtection.
+       * Fetches a CSRF token, attaches it as a header, merges the csrfToken
+       * cookie the backend just set into the outgoing cookie header, then
+       * proxies the real request through with both in place. Every
+       * CsrfGuard-decorated CoreIAM endpoint should go through this, not just
+       * login/register — see the new methods below.
+       */
+    proxyWithCsrfProtection(path: string, init: RequestInit, incomingHeaders: Headers): Promise<Response>;
     loginWithCsrfProtection(identifier: string, password: string, incomingHeaders: Headers): Promise<Response>;
     registerWithCsrfProtection(userData: any, incomingHeaders: Headers): Promise<Response>;
+    updateProfile(updateData: any, incomingHeaders: Headers): Promise<Response>;
+    setupMfa(incomingHeaders: Headers): Promise<Response>;
+    verifyMfa(token: string, incomingHeaders: Headers): Promise<Response>;
+    disableMfa(incomingHeaders: Headers): Promise<Response>;
+    requestOtp(body: any, incomingHeaders: Headers): Promise<Response>;
+    verifyOtp(body: any, incomingHeaders: Headers): Promise<Response>;
 }

package/dist/core/index.js

@@ -79,7 +79,59 @@ class CoreIAM {
     async logout(headers) {
         return this.proxy('/auth/logout', { method: 'POST' }, headers);
     }
-    async loginWithCsrfProtection(identifier, password, incomingHeaders) {
+    //   async loginWithCsrfProtection(identifier: string, password: string, incomingHeaders: Headers) {
+    //     const csrfResponse = await this.getCsrfToken(incomingHeaders);
+    //     const csrfData = await csrfResponse.json();
+    //     const csrfToken = csrfData.csrfToken || csrfData._csrf;
+    //     if (!csrfToken) throw new Error('Failed to obtain CSRF token');
+    //     const authHeaders = new Headers(incomingHeaders);
+    //     authHeaders.set('x-csrf-token', csrfToken);
+    //     const csrfCookies = csrfResponse.headers.getSetCookie();
+    //     const existingCookieStr = incomingHeaders.get('cookie') || '';
+    //     const newCookiePairs = csrfCookies.map(c => c.split(';')[0]);
+    //     if (newCookiePairs.length > 0) {
+    //       const combinedCookies = [existingCookieStr, ...newCookiePairs].filter(Boolean).join('; ');
+    //       authHeaders.set('cookie', combinedCookies);
+    //     }
+    //     return this.proxy('/auth/login', {
+    //       method: 'POST',
+    //       headers: { 'Content-Type': 'application/json' },
+    //       body: JSON.stringify({ identifier, password }),
+    //     }, authHeaders);
+    //   }
+    //   async registerWithCsrfProtection(userData: any, incomingHeaders: Headers) {
+    //     const csrfResponse = await this.getCsrfToken(incomingHeaders);
+    //     const csrfData = await csrfResponse.json();
+    //     const csrfToken = csrfData.csrfToken || csrfData._csrf;
+    //     if (!csrfToken) throw new Error('Failed to obtain CSRF token');
+    //     const authHeaders = new Headers(incomingHeaders);
+    //     authHeaders.set('x-csrf-token', csrfToken);
+    //     const setCookieHeader = csrfResponse.headers.get('set-cookie');
+    //     if (setCookieHeader) {
+    //       const existingCookie = incomingHeaders.get('cookie') || '';
+    //       const updatedCookie = setCookieHeader.split(',').map(cookie => cookie.trim())
+    //         .map(cookie => cookie.split(';')[0])
+    //         .join('; ');
+    //       const combinedCookies = [existingCookie, updatedCookie].filter(Boolean).join('; ');
+    //       authHeaders.set('cookie', combinedCookies);
+    //     }
+    //     return this.proxy('/auth/register', {
+    //       method: 'POST',
+    //       headers: { 'Content-Type': 'application/json' },
+    //       body: JSON.stringify(userData),
+    //     }, authHeaders);
+    //   }
+    // }
+    /**
+       * FIX: shared CSRF handshake, factored out of what used to be two
+       * near-identical copies in loginWithCsrfProtection/registerWithCsrfProtection.
+       * Fetches a CSRF token, attaches it as a header, merges the csrfToken
+       * cookie the backend just set into the outgoing cookie header, then
+       * proxies the real request through with both in place. Every
+       * CsrfGuard-decorated CoreIAM endpoint should go through this, not just
+       * login/register — see the new methods below.
+       */
+    async proxyWithCsrfProtection(path, init, incomingHeaders) {
         const csrfResponse = await this.getCsrfToken(incomingHeaders);
         const csrfData = await csrfResponse.json();
         const csrfToken = csrfData.csrfToken || csrfData._csrf;
@@ -94,34 +146,55 @@ class CoreIAM {
             const combinedCookies = [existingCookieStr, ...newCookiePairs].filter(Boolean).join('; ');
             authHeaders.set('cookie', combinedCookies);
         }
-        return this.proxy('/auth/login', {
+        return this.proxy(path, init, authHeaders);
+    }
+    async loginWithCsrfProtection(identifier, password, incomingHeaders) {
+        return this.proxyWithCsrfProtection('/auth/login', {
             method: 'POST',
             headers: { 'Content-Type': 'application/json' },
             body: JSON.stringify({ identifier, password }),
-        }, authHeaders);
+        }, incomingHeaders);
     }
     async registerWithCsrfProtection(userData, incomingHeaders) {
-        const csrfResponse = await this.getCsrfToken(incomingHeaders);
-        const csrfData = await csrfResponse.json();
-        const csrfToken = csrfData.csrfToken || csrfData._csrf;
-        if (!csrfToken)
-            throw new Error('Failed to obtain CSRF token');
-        const authHeaders = new Headers(incomingHeaders);
-        authHeaders.set('x-csrf-token', csrfToken);
-        const setCookieHeader = csrfResponse.headers.get('set-cookie');
-        if (setCookieHeader) {
-            const existingCookie = incomingHeaders.get('cookie') || '';
-            const updatedCookie = setCookieHeader.split(',').map(cookie => cookie.trim())
-                .map(cookie => cookie.split(';')[0])
-                .join('; ');
-            const combinedCookies = [existingCookie, updatedCookie].filter(Boolean).join('; ');
-            authHeaders.set('cookie', combinedCookies);
-        }
-        return this.proxy('/auth/register', {
+        return this.proxyWithCsrfProtection('/auth/register', {
             method: 'POST',
             headers: { 'Content-Type': 'application/json' },
             body: JSON.stringify(userData),
-        }, authHeaders);
+        }, incomingHeaders);
+    }
+    async updateProfile(updateData, incomingHeaders) {
+        return this.proxyWithCsrfProtection('/auth/profile', {
+            method: 'PUT',
+            headers: { 'Content-Type': 'application/json' },
+            body: JSON.stringify(updateData),
+        }, incomingHeaders);
+    }
+    async setupMfa(incomingHeaders) {
+        return this.proxyWithCsrfProtection('/auth/mfa/setup', { method: 'POST' }, incomingHeaders);
+    }
+    async verifyMfa(token, incomingHeaders) {
+        return this.proxyWithCsrfProtection('/auth/mfa/verify', {
+            method: 'POST',
+            headers: { 'Content-Type': 'application/json' },
+            body: JSON.stringify({ token }),
+        }, incomingHeaders);
+    }
+    async disableMfa(incomingHeaders) {
+        return this.proxyWithCsrfProtection('/auth/mfa/disable', { method: 'DELETE' }, incomingHeaders);
+    }
+    async requestOtp(body, incomingHeaders) {
+        return this.proxyWithCsrfProtection('/auth/request-otp', {
+            method: 'POST',
+            headers: { 'Content-Type': 'application/json' },
+            body: JSON.stringify(body),
+        }, incomingHeaders);
+    }
+    async verifyOtp(body, incomingHeaders) {
+        return this.proxyWithCsrfProtection('/auth/verify-otp', {
+            method: 'POST',
+            headers: { 'Content-Type': 'application/json' },
+            body: JSON.stringify(body),
+        }, incomingHeaders);
     }
 }
 exports.CoreIAM = CoreIAM;

package/dist/nextjs/actions.d.ts

@@ -8,3 +8,9 @@ export declare const getSession: () => Promise<CoreIAMIdentity | null>;
 export declare function loginActionSdk(identifier: string, password: string): Promise<AuthResult>;
 export declare function registerActionSdk(userData: any): Promise<AuthResult>;
 export declare function logoutActionSdk(): Promise<AuthResult>;
+export declare function updateProfileActionSdk(updateData: Record<string, any>): Promise<AuthResult>;
+export declare function setupMfaActionSdk(): Promise<AuthResult>;
+export declare function verifyMfaActionSdk(token: string): Promise<AuthResult>;
+export declare function disableMfaActionSdk(): Promise<AuthResult>;
+export declare function requestOtpActionSdk(body: Record<string, any>): Promise<AuthResult>;
+export declare function verifyOtpActionSdk(body: Record<string, any>): Promise<AuthResult>;

package/dist/nextjs/actions.js

@@ -1,14 +1,124 @@
 "use strict";
+// // src/nextjs/actions.ts
+// // REMOVE 'use server' from here.
+// import { cookies, headers } from 'next/headers';
+// import { CoreIAM, CoreIAMIdentity } from '../core';
+// export interface AuthResult {
+//   ok: boolean;
+//   status: number;
+//   data: any;
+// }
+// let _iam: CoreIAM | null = null;
+// function getIam(): CoreIAM {
+//   if (!_iam) _iam = new CoreIAM();
+//   return _iam;
+// }
+// async function syncCookiesToNext(response: Response) {
+//   const cookieStore = await cookies();
+//   const setCookies = response.headers.getSetCookie();
+//   for (const cookieStr of setCookies) {
+//     const parts = cookieStr.split(';');
+//     const [nameValue, ...attributes] = parts;
+//     const [name, ...valueParts] = nameValue.split('=');
+//     const cookieOptions: any = {};
+//     let isDeleting = false;
+//     attributes.forEach(attr => {
+//       const [attrName, attrValue] = attr.trim().split('=');
+//       const lowerName = attrName?.toLowerCase();
+//       if (lowerName === 'httponly') cookieOptions.httpOnly = true;
+//       if (lowerName === 'secure') cookieOptions.secure = true;
+//       if (lowerName === 'path') cookieOptions.path = attrValue || '/';
+//       if (lowerName === 'max-age') {
+//         const maxAge = parseInt(attrValue, 10);
+//         if (maxAge <= 0) isDeleting = true;
+//         else cookieOptions.maxAge = maxAge;
+//       }
+//       if (lowerName === 'expires') {
+//         const expiryDate = new Date(attrValue);
+//         if (expiryDate.getTime() < Date.now()) isDeleting = true;
+//         else cookieOptions.expires = expiryDate;
+//       }
+//       if (lowerName === 'samesite') cookieOptions.sameSite = attrValue?.toLowerCase() || 'lax';
+//     });
+//     const cookieName = name.trim();
+//     const cookieValue = valueParts.join('=').trim();
+//     if (isDeleting || cookieValue === '') {
+//       cookieStore.delete(cookieName);
+//     } else {
+//       cookieStore.set(cookieName, cookieValue, cookieOptions);
+//     }
+//   }
+// }
+// // This is called by Server Components (e.g., layout.tsx)
+// export async function getSession(): Promise<CoreIAMIdentity | null> {
+//   const reqHeaders = await headers();
+//   const response = await getIam().proxy('/auth/profile', { method: 'GET' }, reqHeaders);
+//   if (!response.ok) return null;
+//   const coreIamIdentity = await response.json();
+//   if (!coreIamIdentity?.sub) return null;
+//   return coreIamIdentity as CoreIAMIdentity; 
+// }
+// // These are no longer called by the SDK's provider.tsx, 
+// // but can still be used by Qalam's Server Actions if needed.
+// export async function loginActionSdk(identifier: string, password: string): Promise<AuthResult> {
+//   const reqHeaders = await headers();
+//   try {
+//     const response = await getIam().loginWithCsrfProtection(identifier, password, reqHeaders);
+//     await syncCookiesToNext(response);
+//     return { ok: response.ok, status: response.status, data: await response.json().catch(() => ({})) };
+//   } catch (error) {
+//     return { ok: false, status: 500, data: { error: error instanceof Error ? error.message : 'Login failed' } };
+//   }
+// }
+// export async function registerActionSdk(userData: any): Promise<AuthResult> {
+//   const reqHeaders = await headers();
+//   try {
+//     const response = await getIam().registerWithCsrfProtection(userData, reqHeaders);
+//     await syncCookiesToNext(response);
+//     return { ok: response.ok, status: response.status, data: await response.json().catch(() => ({})) };
+//   } catch (error) {
+//     return { ok: false, status: 500, data: { error: error instanceof Error ? error.message : 'Registration failed' } };
+//   }
+// }
+// export async function logoutActionSdk(): Promise<AuthResult> {
+//   const reqHeaders = await headers();
+//   try {
+//     const response = await getIam().logout(reqHeaders);
+//     await syncCookiesToNext(response);
+//     return { ok: response.ok, status: response.status, data: await response.json().catch(() => ({})) };
+//   } catch (error) {
+//     return { ok: false, status: 500, data: { error: 'Logout failed' } };
+//   }
+// }
+'use server';
+// // src/nextjs/actions.ts
+// // REMOVE 'use server' from here.
 Object.defineProperty(exports, "__esModule", { value: true });
 exports.getSession = void 0;
 exports.loginActionSdk = loginActionSdk;
 exports.registerActionSdk = registerActionSdk;
 exports.logoutActionSdk = logoutActionSdk;
-// src/nextjs/actions.ts
-// REMOVE 'use server' from here.
+exports.updateProfileActionSdk = updateProfileActionSdk;
+exports.setupMfaActionSdk = setupMfaActionSdk;
+exports.verifyMfaActionSdk = verifyMfaActionSdk;
+exports.disableMfaActionSdk = disableMfaActionSdk;
+exports.requestOtpActionSdk = requestOtpActionSdk;
+exports.verifyOtpActionSdk = verifyOtpActionSdk;
 const react_1 = require("react");
 const headers_1 = require("next/headers");
 const core_1 = require("../core");
+// FIX: lazy singleton instead of `const iam = new CoreIAM();` at module
+// scope. The constructor throws if COREIAM_API_KEY/COREIAM_API_URL are
+// missing — fine on the server, where those env vars exist — but a
+// module-level throw happens the instant the module is evaluated, before
+// any function in it is even called. If this module's 'use server'
+// boundary is ever not recognized correctly by the bundler (see the note
+// on the browser error below), the real module gets included in the client
+// bundle instead of being swapped for action-reference stubs, and that
+// throw fires in the browser instead, where those env vars are never
+// defined. Making this lazy doesn't fix a lost 'use server' boundary by
+// itself, but it does mean import alone can never crash — only an actual
+// invocation can, which is strictly better either way.
 let _iam = null;
 function getIam() {
     if (!_iam)
@@ -60,16 +170,32 @@ async function syncCookiesToNext(response) {
         }
     }
 }
-// // This is called by Server Components (e.g., layout.tsx)
-// export async function getSession(): Promise<CoreIAMIdentity | null> {
-//   const reqHeaders = await headers();
-//   const response = await getIam().proxy('/auth/profile', { method: 'GET' }, reqHeaders);
-//   if (!response.ok) return null;
-//   const coreIamIdentity = await response.json();
-//   if (!coreIamIdentity?.sub) return null;
-//   return coreIamIdentity as CoreIAMIdentity; 
-// }
+// FIX: wrapped in React's cache(). This is the generic fix for "why are we
+// calling /profile so much" — any number of calls to getSession() within the
+// same request/render (direct calls, or nested inside a consumer's own
+// currentUser()-style wrapper) now collapse into a single network round trip
+// to CoreIAM automatically, for every current and future call site.
+//
+// Deliberately NOT adding a refresh-retry fallback here (an earlier draft in
+// this thread did). Next.js only allows cookies().set()/cookies().delete()
+// inside a Server Action or Route Handler — never during a Server Component
+// render — and getSession() is called from both (e.g. from a plain
+// RootLayout render, and from consumers' currentUser()-style wrappers used
+// throughout Server Components). A refresh path that can only sometimes
+// persist its new cookies isn't safe: on the render-context call it would
+// still redeem the refresh token server-side (rotating/burning it) but never
+// deliver the new one to the browser, stranding the client on a now-dead
+// refresh token. Refresh belongs solely in middleware.ts, which is the one
+// place in the request lifecycle actually allowed to mutate response
+// cookies. If middleware already refreshed upstream, this succeeds; if
+// middleware's refresh also failed, returning null here is correct, not a
+// bug to work around.
 exports.getSession = (0, react_1.cache)(async () => {
+    // DEBUG_TRACE: temporary — remove once the duplicate-call question is
+    // settled. This fires once per real (uncached) call, server-side, so it
+    // shows up in the Next.js terminal, not the browser console. Grep
+    // "DEBUG_TRACE" to find every line this touch added.
+    console.log(`[DEBUG_TRACE] getSession() real fetch @ ${new Date().toISOString()}`);
     const reqHeaders = await (0, headers_1.headers)();
     const response = await getIam().proxy('/auth/profile', { method: 'GET' }, reqHeaders);
     if (!response.ok)
@@ -79,8 +205,6 @@ exports.getSession = (0, react_1.cache)(async () => {
         return null;
     return coreIamIdentity;
 });
-// These are no longer called by the SDK's provider.tsx, 
-// but can still be used by Qalam's Server Actions if needed.
 async function loginActionSdk(identifier, password) {
     const reqHeaders = await (0, headers_1.headers)();
     try {
@@ -114,3 +238,68 @@ async function logoutActionSdk() {
         return { ok: false, status: 500, data: { error: 'Logout failed' } };
     }
 }
+// --- Newly added, prompted by an audit of CSRF coverage across every
+// CsrfGuard-decorated CoreIAM endpoint (not just login/register). Each of
+// these now handles its own CSRF handshake via core/index.ts's
+// proxyWithCsrfProtection, the same way loginActionSdk/registerActionSdk
+// already did — nothing calling these needs to fetch a CSRF token itself.
+async function updateProfileActionSdk(updateData) {
+    const reqHeaders = await (0, headers_1.headers)();
+    try {
+        const response = await getIam().updateProfile(updateData, reqHeaders);
+        return { ok: response.ok, status: response.status, data: await response.json().catch(() => ({})) };
+    }
+    catch (error) {
+        return { ok: false, status: 500, data: { error: 'Profile update failed' } };
+    }
+}
+async function setupMfaActionSdk() {
+    const reqHeaders = await (0, headers_1.headers)();
+    try {
+        const response = await getIam().setupMfa(reqHeaders);
+        return { ok: response.ok, status: response.status, data: await response.json().catch(() => ({})) };
+    }
+    catch (error) {
+        return { ok: false, status: 500, data: { error: 'MFA setup failed' } };
+    }
+}
+async function verifyMfaActionSdk(token) {
+    const reqHeaders = await (0, headers_1.headers)();
+    try {
+        const response = await getIam().verifyMfa(token, reqHeaders);
+        return { ok: response.ok, status: response.status, data: await response.json().catch(() => ({})) };
+    }
+    catch (error) {
+        return { ok: false, status: 500, data: { error: 'MFA verification failed' } };
+    }
+}
+async function disableMfaActionSdk() {
+    const reqHeaders = await (0, headers_1.headers)();
+    try {
+        const response = await getIam().disableMfa(reqHeaders);
+        return { ok: response.ok, status: response.status, data: await response.json().catch(() => ({})) };
+    }
+    catch (error) {
+        return { ok: false, status: 500, data: { error: 'Disabling MFA failed' } };
+    }
+}
+async function requestOtpActionSdk(body) {
+    const reqHeaders = await (0, headers_1.headers)();
+    try {
+        const response = await getIam().requestOtp(body, reqHeaders);
+        return { ok: response.ok, status: response.status, data: await response.json().catch(() => ({})) };
+    }
+    catch (error) {
+        return { ok: false, status: 500, data: { error: 'OTP request failed' } };
+    }
+}
+async function verifyOtpActionSdk(body) {
+    const reqHeaders = await (0, headers_1.headers)();
+    try {
+        const response = await getIam().verifyOtp(body, reqHeaders);
+        return { ok: response.ok, status: response.status, data: await response.json().catch(() => ({})) };
+    }
+    catch (error) {
+        return { ok: false, status: 500, data: { error: 'OTP verification failed' } };
+    }
+}

package/dist/nextjs/provider.d.ts

@@ -1,15 +1,22 @@
 import React from 'react';
 import type { CoreIAMIdentity } from '../core';
 export interface CoreIAMRedirects {
+    /** Where to send the user after a successful login, if no callbackUrl is passed to login(). */
     afterLogin?: string;
+    /** Where to send the user after logout. */
     afterLogout?: string;
 }
 interface LoginResult {
     success?: boolean;
     error?: string;
-    twoFactor?: boolean;
 }
 interface AuthContextType {
+    /**
+     * Generic CoreIAM identity (sub/email/roles/tenantId) — NOT an app-shaped
+     * user. This SDK has no knowledge of any consumer's local user model
+     * (roles, profile fields, etc). Consumers that need an enriched user
+     * object should build their own layer on top of this, keyed off `sub`.
+     */
     identity: CoreIAMIdentity | null;
     isLoading: boolean;
     isAuthenticated: boolean;
@@ -23,7 +30,9 @@ interface AuthContextType {
 }
 export declare function CoreIAMProvider({ children, initialIdentity, redirects, }: {
     children: React.ReactNode;
+    /** Pass the result of a server-side getSession() call to skip the client fetch on first paint. */
     initialIdentity?: CoreIAMIdentity | null;
+    /** Where to redirect after login/logout. Omit for no redirect (caller handles navigation itself). */
     redirects?: CoreIAMRedirects;
 }): import("react/jsx-runtime").JSX.Element;
 export declare function useAuth(): AuthContextType;

package/dist/nextjs/provider.js

@@ -1,5 +1,189 @@
 "use strict";
-// src/nextjs/provider.tsx
+// // src/nextjs/provider.tsx
+// 'use client';
+// import React, { createContext, useContext, useEffect, useState, useCallback } from 'react';
+// import { useRouter } from 'next/navigation';
+// import type { CoreIAMIdentity } from '../core';
+// export interface CoreIAMRedirects {
+//   afterLogin?: string;
+//   afterLogout?: string;
+// }
+// interface LoginResult {
+//   success?: boolean;
+//   error?: string;
+//   twoFactor?: boolean;
+// }
+// interface AuthContextType {
+//   identity: CoreIAMIdentity | null;
+//   isLoading: boolean;
+//   isAuthenticated: boolean;
+//   login: (values: { email: string; password: string }, callbackUrl?: string) => Promise<LoginResult>;
+//   logout: () => Promise<void>;
+//   register: (userData: Record<string, any>) => Promise<LoginResult>;
+//   refetchIdentity: () => Promise<void>;
+// }
+// const AuthContext = createContext<AuthContextType>({
+//   identity: null,
+//   isLoading: true,
+//   isAuthenticated: false,
+//   login: async () => ({ error: 'CoreIAMProvider is not mounted' }),
+//   logout: async () => {},
+//   register: async () => ({ error: 'CoreIAMProvider is not mounted' }),
+//   refetchIdentity: async () => {},
+// });
+// export function CoreIAMProvider({
+//   children,
+//   initialIdentity,
+//   redirects = {},
+// }: {
+//   children: React.ReactNode;
+//   initialIdentity?: CoreIAMIdentity | null;
+//   redirects?: CoreIAMRedirects;
+// }) {
+//   const [identity, setIdentity] = useState<CoreIAMIdentity | null>(initialIdentity ?? null);
+//   const [isLoading, setIsLoading] = useState(initialIdentity === undefined);
+//   const router = useRouter();
+//   const refetchIdentity = useCallback(async () => {
+//     try {
+//       // Call the Next.js API route, which securely calls CoreIAM
+//       const res = await fetch('/api/auth/session', { credentials: 'include' });
+//       setIdentity(res.ok ? await res.json() : null);
+//     } catch {
+//       setIdentity(null);
+//     } finally {
+//       setIsLoading(false);
+//     }
+//   }, []);
+//   useEffect(() => {
+//     if (initialIdentity === undefined) {
+//       refetchIdentity();
+//     } else {
+//       setIsLoading(false);
+//     }
+//     // eslint-disable-next-line react-hooks/exhaustive-deps
+//   }, []);
+//   // const login = async (values: { email: string; password: string }, callbackUrl?: string): Promise<LoginResult> => {
+//   //   setIsLoading(true);
+//   //   try {
+//   //     // Fetch CSRF token first
+//   //     const csrfRes = await fetch('/api/auth/csrf', { credentials: 'include' });
+//   //     if (!csrfRes.ok) return { error: 'Failed to get CSRF token' };
+//   //     const { csrfToken } = await csrfRes.json();
+//   //     // Call login API route
+//   //     const loginRes = await fetch('/api/auth/login', {
+//   //       method: 'POST',
+//   //       headers: {
+//   //         'Content-Type': 'application/json',
+//   //         'x-csrf-token': csrfToken,
+//   //       },
+//   //       credentials: 'include',
+//   //       body: JSON.stringify(values),
+//   //     });
+//   //     const data = await loginRes.json();
+//   //     if (!loginRes.ok) {
+//   //       return { error: data.message || data.error || 'Invalid credentials' };
+//   //     }
+//   //     if (data.twoFactor) {
+//   //       return { twoFactor: true };
+//   //     }
+//   //     await refetchIdentity();
+//   //     const target = callbackUrl || redirects.afterLogin;
+//   //     if (target) router.push(target);
+//   //     return { success: true };
+//   //   } catch {
+//   //     return { error: 'Something went wrong' };
+//   //   } finally {
+//   //     setIsLoading(false);
+//   //   }
+//   // };
+//   const login = async (values: { email: string; password: string }, callbackUrl?: string): Promise<LoginResult> => {
+//     setIsLoading(true);
+//     try {
+//       // Fetch CSRF token first
+//       const csrfRes = await fetch('/api/auth/csrf', { credentials: 'include' });
+//       if (!csrfRes.ok) return { error: 'Failed to get CSRF token' };
+//       const { csrfToken } = await csrfRes.json();
+//       // FIX: Map 'email' to 'identifier' for the CoreIAM backend
+//       const loginPayload = {
+//         identifier: values.email,
+//         password: values.password,
+//       };
+//       // Call login API route
+//       const loginRes = await fetch('/api/auth/login', {
+//         method: 'POST',
+//         headers: {
+//           'Content-Type': 'application/json',
+//           'x-csrf-token': csrfToken,
+//         },
+//         credentials: 'include',
+//         body: JSON.stringify(loginPayload), // Send the mapped payload
+//       });
+//       const data = await loginRes.json();
+//       if (!loginRes.ok) {
+//         return { error: data.message || data.error || 'Invalid credentials' };
+//       }
+//       if (data.twoFactor) {
+//         return { twoFactor: true };
+//       }
+//       await refetchIdentity();
+//       const target = callbackUrl || redirects.afterLogin;
+//       if (target) router.push(target);
+//       return { success: true };
+//     } catch {
+//       return { error: 'Something went wrong' };
+//     } finally {
+//       setIsLoading(false);
+//     }
+//   };
+//   const logout = async () => {
+//     try {
+//       await fetch('/api/auth/logout', {
+//         method: 'POST',
+//         credentials: 'include',
+//       });
+//     } finally {
+//       setIdentity(null);
+//       if (redirects.afterLogout) router.push(redirects.afterLogout);
+//     }
+//   };
+//   const register = async (userData: Record<string, any>): Promise<LoginResult> => {
+//     setIsLoading(true);
+//     try {
+//       const csrfRes = await fetch('/api/auth/csrf', { credentials: 'include' });
+//       if (!csrfRes.ok) return { error: 'Failed to get CSRF token' };
+//       const { csrfToken } = await csrfRes.json();
+//       const registerRes = await fetch('/api/auth/register', {
+//         method: 'POST',
+//         headers: {
+//           'Content-Type': 'application/json',
+//           'x-csrf-token': csrfToken,
+//         },
+//         credentials: 'include',
+//         body: JSON.stringify(userData),
+//       });
+//       if (!registerRes.ok) {
+//         const error = await registerRes.json();
+//         return { error: error.message || error.error || 'Registration failed' };
+//       }
+//       // Auto-login after registration
+//       return await login({ email: userData.email, password: userData.password });
+//     } catch {
+//       return { error: 'Something went wrong' };
+//     } finally {
+//       setIsLoading(false);
+//     }
+//   };
+//   return (
+//     <AuthContext.Provider
+//       value={{ identity, isLoading, isAuthenticated: !!identity, login, logout, register, refetchIdentity }}
+//     >
+//       {children}
+//     </AuthContext.Provider>
+//   );
+// }
+// export function useAuth() {
+//   return useContext(AuthContext);
+// }
 'use client';
 Object.defineProperty(exports, "__esModule", { value: true });
 exports.CoreIAMProvider = CoreIAMProvider;
@@ -7,6 +191,7 @@ exports.useAuth = useAuth;
 const jsx_runtime_1 = require("react/jsx-runtime");
 const react_1 = require("react");
 const navigation_1 = require("next/navigation");
+const actions_1 = require("./actions");
 const AuthContext = (0, react_1.createContext)({
     identity: null,
     isLoading: true,
@@ -20,11 +205,14 @@ function CoreIAMProvider({ children, initialIdentity, redirects = {}, }) {
     const [identity, setIdentity] = (0, react_1.useState)(initialIdentity ?? null);
     const [isLoading, setIsLoading] = (0, react_1.useState)(initialIdentity === undefined);
     const router = (0, navigation_1.useRouter)();
-    const refetchIdentity = (0, react_1.useCallback)(async () => {
+    const refetchIdentity = async () => {
+        // DEBUG_TRACE: browser console — tags who called this (mount effect vs.
+        // an explicit login/logout/register call). Temporary, remove once
+        // settled.
+        console.log(`[DEBUG_TRACE][CoreIAMProvider] refetchIdentity() called @ ${new Date().toISOString()}`);
         try {
-            // Call the Next.js API route, which securely calls CoreIAM
-            const res = await fetch('/api/auth/session', { credentials: 'include' });
-            setIdentity(res.ok ? await res.json() : null);
+            const result = await (0, actions_1.getSession)();
+            setIdentity(result);
         }
         catch {
             setIdentity(null);
@@ -32,79 +220,34 @@ function CoreIAMProvider({ children, initialIdentity, redirects = {}, }) {
         finally {
             setIsLoading(false);
         }
-    }, []);
+    };
     (0, react_1.useEffect)(() => {
+        // FIX: was `initialIdentity === null`, which can't tell "SSR ran and
+        // confirmed you're logged out" (a correct, final null) apart from "no
+        // SSR value was ever provided" (a real undefined). Since layout.tsx
+        // always calls getSession() and passes its result — even when that
+        // result legitimately is null — every logged-out page view was
+        // treated as "no SSR value, fetch again," firing a second, wholly
+        // redundant /auth/profile call for something SSR had already
+        // determined. undefined (the prop genuinely omitted) is the only case
+        // that should trigger this fallback fetch.
+        console.log(`[DEBUG_TRACE][CoreIAMProvider] mount effect ran, initialIdentity=${initialIdentity === undefined ? 'undefined' : JSON.stringify(initialIdentity)} @ ${new Date().toISOString()}`);
         if (initialIdentity === undefined) {
             refetchIdentity();
         }
         else {
             setIsLoading(false);
         }
+        // Intentionally only on mount — initialIdentity is a one-time SSR seed,
+        // not something we want to re-run this effect for if it changes identity.
         // eslint-disable-next-line react-hooks/exhaustive-deps
     }, []);
-    // const login = async (values: { email: string; password: string }, callbackUrl?: string): Promise<LoginResult> => {
-    //   setIsLoading(true);
-    //   try {
-    //     // Fetch CSRF token first
-    //     const csrfRes = await fetch('/api/auth/csrf', { credentials: 'include' });
-    //     if (!csrfRes.ok) return { error: 'Failed to get CSRF token' };
-    //     const { csrfToken } = await csrfRes.json();
-    //     // Call login API route
-    //     const loginRes = await fetch('/api/auth/login', {
-    //       method: 'POST',
-    //       headers: {
-    //         'Content-Type': 'application/json',
-    //         'x-csrf-token': csrfToken,
-    //       },
-    //       credentials: 'include',
-    //       body: JSON.stringify(values),
-    //     });
-    //     const data = await loginRes.json();
-    //     if (!loginRes.ok) {
-    //       return { error: data.message || data.error || 'Invalid credentials' };
-    //     }
-    //     if (data.twoFactor) {
-    //       return { twoFactor: true };
-    //     }
-    //     await refetchIdentity();
-    //     const target = callbackUrl || redirects.afterLogin;
-    //     if (target) router.push(target);
-    //     return { success: true };
-    //   } catch {
-    //     return { error: 'Something went wrong' };
-    //   } finally {
-    //     setIsLoading(false);
-    //   }
-    // };
     const login = async (values, callbackUrl) => {
         setIsLoading(true);
         try {
-            // Fetch CSRF token first
-            const csrfRes = await fetch('/api/auth/csrf', { credentials: 'include' });
-            if (!csrfRes.ok)
-                return { error: 'Failed to get CSRF token' };
-            const { csrfToken } = await csrfRes.json();
-            // FIX: Map 'email' to 'identifier' for the CoreIAM backend
-            const loginPayload = {
-                identifier: values.email,
-                password: values.password,
-            };
-            // Call login API route
-            const loginRes = await fetch('/api/auth/login', {
-                method: 'POST',
-                headers: {
-                    'Content-Type': 'application/json',
-                    'x-csrf-token': csrfToken,
-                },
-                credentials: 'include',
-                body: JSON.stringify(loginPayload), // Send the mapped payload
-            });
-            const data = await loginRes.json();
-            if (!loginRes.ok) {
-                return { error: data.message || data.error || 'Invalid credentials' };
-            }
-            if (data.twoFactor) {
-                return { twoFactor: true };
+            const result = await (0, actions_1.loginActionSdk)(values.email, values.password);
+            if (!result.ok) {
+                return { error: result.data?.message || result.data?.error || 'Invalid credentials' };
             }
             await refetchIdentity();
             const target = callbackUrl || redirects.afterLogin;
@@ -121,10 +264,7 @@ function CoreIAMProvider({ children, initialIdentity, redirects = {}, }) {
     };
     const logout = async () => {
         try {
-            await fetch('/api/auth/logout', {
-                method: 'POST',
-                credentials: 'include',
-            });
+            await (0, actions_1.logoutActionSdk)();
         }
         finally {
             setIdentity(null);
@@ -135,29 +275,14 @@ function CoreIAMProvider({ children, initialIdentity, redirects = {}, }) {
     const register = async (userData) => {
         setIsLoading(true);
         try {
-            const csrfRes = await fetch('/api/auth/csrf', { credentials: 'include' });
-            if (!csrfRes.ok)
-                return { error: 'Failed to get CSRF token' };
-            const { csrfToken } = await csrfRes.json();
-            const registerRes = await fetch('/api/auth/register', {
-                method: 'POST',
-                headers: {
-                    'Content-Type': 'application/json',
-                    'x-csrf-token': csrfToken,
-                },
-                credentials: 'include',
-                body: JSON.stringify(userData),
-            });
-            if (!registerRes.ok) {
-                const error = await registerRes.json();
-                return { error: error.message || error.error || 'Registration failed' };
+            const result = await (0, actions_1.registerActionSdk)(userData);
+            if (!result.ok) {
+                return { error: result.data?.message || result.data?.error || 'Registration failed' };
             }
-            // Auto-login after registration
+            // Registration on the backend doesn't auto-issue a session — log in
+            // immediately after, same as the flow this replaces did.
             return await login({ email: userData.email, password: userData.password });
         }
-        catch {
-            return { error: 'Something went wrong' };
-        }
         finally {
             setIsLoading(false);
         }

package/package.json

@@ -1,6 +1,6 @@
 {
   "name": "@coreiam/auth",
-  "version": "1.0.12",
+  "version": "1.0.14",
   "main": "./dist/core/index.js",
   "types": "./dist/core/index.d.ts",
   "exports": {