@coreiam/auth 1.0.14 → 1.0.39

package/dist/nextjs/actions.d.ts

@@ -4,7 +4,7 @@ export interface AuthResult {
     status: number;
     data: any;
 }
-export declare const getSession: () => Promise<CoreIAMIdentity | null>;
+export declare function getSession(): Promise<CoreIAMIdentity | null>;
 export declare function loginActionSdk(identifier: string, password: string): Promise<AuthResult>;
 export declare function registerActionSdk(userData: any): Promise<AuthResult>;
 export declare function logoutActionSdk(): Promise<AuthResult>;

package/dist/nextjs/actions.js

@@ -94,7 +94,7 @@
 // // src/nextjs/actions.ts
 // // REMOVE 'use server' from here.
 Object.defineProperty(exports, "__esModule", { value: true });
-exports.getSession = void 0;
+exports.getSession = getSession;
 exports.loginActionSdk = loginActionSdk;
 exports.registerActionSdk = registerActionSdk;
 exports.logoutActionSdk = logoutActionSdk;
@@ -104,7 +104,6 @@ exports.verifyMfaActionSdk = verifyMfaActionSdk;
 exports.disableMfaActionSdk = disableMfaActionSdk;
 exports.requestOtpActionSdk = requestOtpActionSdk;
 exports.verifyOtpActionSdk = verifyOtpActionSdk;
-const react_1 = require("react");
 const headers_1 = require("next/headers");
 const core_1 = require("../core");
 // FIX: lazy singleton instead of `const iam = new CoreIAM();` at module
@@ -190,21 +189,60 @@ async function syncCookiesToNext(response) {
 // cookies. If middleware already refreshed upstream, this succeeds; if
 // middleware's refresh also failed, returning null here is correct, not a
 // bug to work around.
-exports.getSession = (0, react_1.cache)(async () => {
-    // DEBUG_TRACE: temporary — remove once the duplicate-call question is
-    // settled. This fires once per real (uncached) call, server-side, so it
-    // shows up in the Next.js terminal, not the browser console. Grep
-    // "DEBUG_TRACE" to find every line this touch added.
-    console.log(`[DEBUG_TRACE] getSession() real fetch @ ${new Date().toISOString()}`);
+// export async function getSession(): Promise<CoreIAMIdentity | null> {
+//   console.log(`[DEBUG_TRACE] getSession() real fetch @ ${new Date().toISOString()}`);
+//   const reqHeaders = await headers();
+//   const response = await getIam().proxy('/auth/profile', { method: 'GET' }, reqHeaders);
+//   if (!response.ok) return null;
+//   const coreIamIdentity = await response.json();
+//   if (!coreIamIdentity?.sub) return null;
+//   return coreIamIdentity as CoreIAMIdentity; 
+// }
+async function getSession() {
     const reqHeaders = await (0, headers_1.headers)();
-    const response = await getIam().proxy('/auth/profile', { method: 'GET' }, reqHeaders);
-    if (!response.ok)
+    // The middleware verified the JWT and attached the payload to the request headers
+    const identityHeader = reqHeaders.get('x-coreiam-identity');
+    if (identityHeader) {
+        try {
+            return JSON.parse(identityHeader);
+        }
+        catch {
+            return null;
+        }
+    }
+    // Fallback: If middleware didn't run (e.g. API route), we can still read the JWT
+    // But we DO NOT verify it here, because verification requires the JWKS fetch which 
+    // is too slow for Server Components. We just decode it to get the identity.
+    // The middleware is the true security gate.
+    const authHeader = reqHeaders.get('Authorization') || reqHeaders.get('authorization');
+    const cookieHeader = reqHeaders.get('cookie');
+    let token = undefined;
+    if (authHeader?.startsWith('Bearer ')) {
+        token = authHeader.substring(7);
+    }
+    else if (cookieHeader) {
+        const match = cookieHeader.match(/jwt=([^;]+)/);
+        if (match)
+            token = match[1];
+    }
+    if (!token)
         return null;
-    const coreIamIdentity = await response.json();
-    if (!coreIamIdentity?.sub)
+    try {
+        // Just decode the payload without verifying (middleware already verified it)
+        const payloadB64 = token.split('.')[1];
+        const payloadStr = Buffer.from(payloadB64, 'base64').toString('utf8');
+        const payload = JSON.parse(payloadStr);
+        return {
+            sub: payload.sub,
+            email: payload.email,
+            tenantId: payload.tenantId,
+            roles: payload.roles || []
+        };
+    }
+    catch {
         return null;
-    return coreIamIdentity;
-});
+    }
+}
 async function loginActionSdk(identifier, password) {
     const reqHeaders = await (0, headers_1.headers)();
     try {

package/dist/nextjs/index.d.ts

@@ -1,10 +1,17 @@
-export { CoreIAMProvider, useAuth } from './provider';
-export { loginActionSdk, registerActionSdk, logoutActionSdk, getSession } from './actions';
-export { coreIamMiddleware } from './middleware';
 import { NextRequest, NextResponse } from 'next/server';
-import { CoreIAM } from '../core';
+import { CoreIAM, CoreIAMIdentity } from '../core';
+export { CoreIAMProvider, useAuth } from './provider';
+export { coreIamMiddleware, coreIamAuth } from './middleware';
+export { getSession, loginActionSdk, registerActionSdk, logoutActionSdk, updateProfileActionSdk, setupMfaActionSdk, verifyMfaActionSdk, disableMfaActionSdk, requestOtpActionSdk, verifyOtpActionSdk } from './actions';
 export declare class NextHandlers {
     private iam;
     constructor(iam?: CoreIAM);
     handleProxy(req: NextRequest, internalPath: string): Promise<NextResponse<any>>;
 }
+export declare class OAuthHandlers {
+    private iam;
+    constructor(iam?: CoreIAM);
+    handleInitiate(req: NextRequest, provider: string): Promise<NextResponse<unknown>>;
+    handleCallback(req: NextRequest, provider: string): Promise<NextResponse<unknown>>;
+}
+export declare function auth(request: NextRequest): Promise<CoreIAMIdentity | null>;

package/dist/nextjs/index.js

@@ -1,19 +1,28 @@
 "use strict";
 Object.defineProperty(exports, "__esModule", { value: true });
-exports.NextHandlers = exports.coreIamMiddleware = exports.getSession = exports.logoutActionSdk = exports.registerActionSdk = exports.loginActionSdk = exports.useAuth = exports.CoreIAMProvider = void 0;
+exports.OAuthHandlers = exports.NextHandlers = exports.verifyOtpActionSdk = exports.requestOtpActionSdk = exports.disableMfaActionSdk = exports.verifyMfaActionSdk = exports.setupMfaActionSdk = exports.updateProfileActionSdk = exports.logoutActionSdk = exports.registerActionSdk = exports.loginActionSdk = exports.getSession = exports.coreIamAuth = exports.coreIamMiddleware = exports.useAuth = exports.CoreIAMProvider = void 0;
+exports.auth = auth;
 // src/nextjs/index.ts
+const server_1 = require("next/server");
+const core_1 = require("../core");
 var provider_1 = require("./provider");
 Object.defineProperty(exports, "CoreIAMProvider", { enumerable: true, get: function () { return provider_1.CoreIAMProvider; } });
 Object.defineProperty(exports, "useAuth", { enumerable: true, get: function () { return provider_1.useAuth; } });
+var middleware_1 = require("./middleware");
+Object.defineProperty(exports, "coreIamMiddleware", { enumerable: true, get: function () { return middleware_1.coreIamMiddleware; } });
+Object.defineProperty(exports, "coreIamAuth", { enumerable: true, get: function () { return middleware_1.coreIamAuth; } });
+// FIX: Export ALL Server Action functions here
 var actions_1 = require("./actions");
+Object.defineProperty(exports, "getSession", { enumerable: true, get: function () { return actions_1.getSession; } });
 Object.defineProperty(exports, "loginActionSdk", { enumerable: true, get: function () { return actions_1.loginActionSdk; } });
 Object.defineProperty(exports, "registerActionSdk", { enumerable: true, get: function () { return actions_1.registerActionSdk; } });
 Object.defineProperty(exports, "logoutActionSdk", { enumerable: true, get: function () { return actions_1.logoutActionSdk; } });
-Object.defineProperty(exports, "getSession", { enumerable: true, get: function () { return actions_1.getSession; } });
-var middleware_1 = require("./middleware");
-Object.defineProperty(exports, "coreIamMiddleware", { enumerable: true, get: function () { return middleware_1.coreIamMiddleware; } });
-const server_1 = require("next/server");
-const core_1 = require("../core");
+Object.defineProperty(exports, "updateProfileActionSdk", { enumerable: true, get: function () { return actions_1.updateProfileActionSdk; } });
+Object.defineProperty(exports, "setupMfaActionSdk", { enumerable: true, get: function () { return actions_1.setupMfaActionSdk; } });
+Object.defineProperty(exports, "verifyMfaActionSdk", { enumerable: true, get: function () { return actions_1.verifyMfaActionSdk; } });
+Object.defineProperty(exports, "disableMfaActionSdk", { enumerable: true, get: function () { return actions_1.disableMfaActionSdk; } });
+Object.defineProperty(exports, "requestOtpActionSdk", { enumerable: true, get: function () { return actions_1.requestOtpActionSdk; } });
+Object.defineProperty(exports, "verifyOtpActionSdk", { enumerable: true, get: function () { return actions_1.verifyOtpActionSdk; } });
 class NextHandlers {
     iam;
     constructor(iam) {
@@ -46,3 +55,84 @@ class NextHandlers {
     }
 }
 exports.NextHandlers = NextHandlers;
+class OAuthHandlers {
+    iam;
+    constructor(iam) {
+        this.iam = iam || new core_1.CoreIAM({ apiKey: process.env.COREIAM_API_KEY, baseUrl: process.env.COREIAM_API_URL });
+    }
+    // Handles the initial redirect to Google/GitHub
+    async handleInitiate(req, provider) {
+        const redirectUri = `${process.env.NEXT_PUBLIC_APP_URL}/api/auth/callback/${provider}`;
+        const response = await this.iam.proxy(`/auth/oauth/initiate/${provider}?redirectUri=${encodeURIComponent(redirectUri)}&scopes=email,profile`, { method: 'GET' }, req.headers);
+        const data = await response.json();
+        if (data.url) {
+            return server_1.NextResponse.redirect(data.url);
+        }
+        return server_1.NextResponse.redirect(new URL('/auth/login', req.url));
+    }
+    // Handles the callback from Google/GitHub
+    async handleCallback(req, provider) {
+        const { searchParams } = new URL(req.url);
+        const code = searchParams.get('code');
+        const state = searchParams.get('state');
+        const redirectUri = `${process.env.NEXT_PUBLIC_APP_URL}/api/auth/callback/${provider}`;
+        const targetUrl = `/auth/oauth/callback/${provider}?code=${code}&state=${state}&redirectUri=${redirectUri}`;
+        const response = await this.iam.proxy(targetUrl, { method: 'GET' }, req.headers);
+        const res = server_1.NextResponse.redirect(new URL('/', req.url));
+        const setCookies = response.headers.getSetCookie();
+        if (setCookies && setCookies.length > 0) {
+            setCookies.forEach(cookie => {
+                res.headers.append('set-cookie', cookie);
+            });
+        }
+        return res;
+    }
+}
+exports.OAuthHandlers = OAuthHandlers;
+const MAX_CACHE_SIZE = 10000;
+const apiKeyCache = new Map();
+async function auth(request) {
+    const authHeader = request.headers.get('authorization');
+    if (!authHeader?.startsWith('Bearer '))
+        return null;
+    const token = authHeader.substring(7);
+    const gatewayUrl = process.env.COREIAM_API_URL;
+    if (!gatewayUrl)
+        return null;
+    // 1. Check Cache
+    const cached = apiKeyCache.get(token);
+    if (cached && cached.expires > Date.now()) {
+        return cached.valid ? cached.identity : null;
+    }
+    // FIX: Prevent memory leak by clearing cache if it gets too large
+    if (apiKeyCache.size >= MAX_CACHE_SIZE) {
+        apiKeyCache.clear(); // Simple crude eviction. In production SDK, use lru-cache.
+    }
+    // 2. Call CoreIAM to verify
+    try {
+        const res = await fetch(`${gatewayUrl}/auth/api-keys/verify`, {
+            method: 'POST',
+            headers: {
+                'Content-Type': 'application/json',
+                'X-API-Key': process.env.COREIAM_API_KEY
+            },
+            body: JSON.stringify({ token }),
+        });
+        const data = await res.json();
+        if (data.valid) {
+            const identity = {
+                sub: data.sub,
+                tenantId: data.tenantId,
+            };
+            apiKeyCache.set(token, { valid: true, identity, expires: Date.now() + (5 * 60 * 1000) });
+            return identity;
+        }
+        else {
+            apiKeyCache.set(token, { valid: false, expires: Date.now() + (5 * 60 * 1000) });
+            return null;
+        }
+    }
+    catch {
+        return null;
+    }
+}

package/dist/nextjs/middleware.d.ts

@@ -1,9 +1,16 @@
 import { NextRequest, NextResponse } from 'next/server';
 /**
- * Handles CoreIAM token refresh and header rewriting.
- * Returns the NextResponse to return, and whether the user is authenticated.
+ * Helper function for custom middleware (proxy.ts).
+ * Returns the response and authentication state.
  */
-export declare function coreIamMiddleware(request: NextRequest): Promise<{
+export declare function coreIamAuth(request: NextRequest): Promise<{
     response: NextResponse;
     isAuthenticated: boolean;
 }>;
+/**
+ * 1-line middleware factory for developers who don't need custom routing.
+ */
+export declare function coreIamMiddleware(options?: {
+    publicRoutes?: string[];
+    signInUrl?: string;
+}): (request: NextRequest) => Promise<NextResponse<unknown>>;

package/dist/nextjs/middleware.js

@@ -1,11 +1,139 @@
 "use strict";
+// // src/nextjs/middleware.ts
+// import { NextRequest, NextResponse } from 'next/server';
+// import { jwtVerify, createRemoteJWKSet } from 'jose';
 Object.defineProperty(exports, "__esModule", { value: true });
+exports.coreIamAuth = coreIamAuth;
 exports.coreIamMiddleware = coreIamMiddleware;
+// // FIX: Instantiate the JWKS client ONCE at the module level.
+// // This allows jose's internal cache to persist across requests.
+// const gatewayUrl = process.env.COREIAM_API_URL;
+// const JWKS = gatewayUrl 
+//   ? createRemoteJWKSet(new URL(`${gatewayUrl}/.well-known/jwks.json`))
+//   : null;
+// let refreshInFlight: Promise<{ jwt: string; refreshToken: string } | null> | null = null;
+// async function performRefresh(
+//   refreshTokenCookie: { value: string } | undefined,
+//   jwtCookie: { value: string } | undefined,
+//   gatewayUrl: string,
+// ): Promise<{ jwt: string; refreshToken: string } | null> {
+//   try {
+//     const refreshRes = await fetch(`${gatewayUrl}/auth/refresh-token`, {
+//       method: 'POST',
+//       headers: {
+//         'X-API-Key': process.env.COREIAM_API_KEY!,
+//         'cookie': `refreshToken=${refreshTokenCookie?.value || ''}; jwt=${jwtCookie?.value || ''}`,
+//       },
+//     });
+//     if (!refreshRes.ok) return null;
+//     const setCookies = refreshRes.headers.getSetCookie();
+//     let newJwt = '';
+//     let newRefreshToken = '';
+//     setCookies.forEach(cookie => {
+//       if (cookie.startsWith('jwt=')) newJwt = cookie.split(';')[0].split('=')[1];
+//       if (cookie.startsWith('refreshToken=')) newRefreshToken = cookie.split(';')[0].split('=')[1];
+//     });
+//     return newJwt ? { jwt: newJwt, refreshToken: newRefreshToken } : null;
+//   } catch (error) {
+//     return null;
+//   }
+// }
+// export async function coreIamMiddleware(request: NextRequest): Promise<{
+//   response: NextResponse;
+//   isAuthenticated: boolean;
+// }> {
+//   const jwtCookie = request.cookies.get("jwt");
+//   const refreshTokenCookie = request.cookies.get("refreshToken");
+//   let isAuthenticated = false;
+//   let needsRefresh = false;
+//   if (jwtCookie && JWKS) {
+//     try {
+//       // 1. SECURELY VERIFY JWT LOCALLY USING THE MODULE-LEVEL JWKS CLIENT
+//       const { payload } = await jwtVerify(jwtCookie.value, JWKS, {
+//         issuer: 'coreiam',
+//         algorithms: ['RS256']
+//       });
+//       // ATTACH IDENTITY TO REQUEST HEADERS FOR SERVER COMPONENTS
+//       const requestHeaders = new Headers(request.headers);
+//       requestHeaders.set('x-coreiam-identity', JSON.stringify({
+//         sub: payload.sub,
+//         email: payload.email,
+//         tenantId: payload.tenantId,
+//         roles: payload.roles || []
+//       }));
+//       const response = NextResponse.next({
+//         request: { headers: requestHeaders },
+//       });
+//       return { response, isAuthenticated: true };
+//     } catch (error: any) {
+//       // If token is expired, jose throws ERR_JWT_EXPIRED
+//       if (error.code === 'ERR_JWT_EXPIRED' && refreshTokenCookie) {
+//         needsRefresh = true;
+//       }
+//     }
+//   } else if (refreshTokenCookie) {
+//     needsRefresh = true;
+//   }
+//   if (needsRefresh && gatewayUrl) {
+//     if (!refreshInFlight) {
+//       refreshInFlight = performRefresh(refreshTokenCookie, jwtCookie, gatewayUrl).finally(() => {
+//         refreshInFlight = null;
+//       });
+//     }
+//     const result = await refreshInFlight;
+//     if (result) {
+//       const requestHeaders = new Headers(request.headers);
+//       requestHeaders.set('cookie', `jwt=${result.jwt}; refreshToken=${result.refreshToken}`);
+//       requestHeaders.set('Authorization', `Bearer ${result.jwt}`);
+//       // ATTACH IDENTITY TO REQUEST HEADERS FOR SERVER COMPONENTS (using the new JWT)
+//       try {
+//         const payloadB64 = result.jwt.split('.')[1];
+//         const payloadStr = Buffer.from(payloadB64, 'base64').toString('utf8');
+//         const payload = JSON.parse(payloadStr);
+//         requestHeaders.set('x-coreiam-identity', JSON.stringify({
+//           sub: payload.sub,
+//           email: payload.email,
+//           tenantId: payload.tenantId,
+//           roles: payload.roles || []
+//         }));
+//       } catch {}
+//       const response = NextResponse.next({
+//         request: { headers: requestHeaders },
+//       });
+//       const isProd = process.env.NODE_ENV === 'production';
+//       response.cookies.set('jwt', result.jwt, {
+//         httpOnly: true,
+//         secure: isProd,
+//         sameSite: 'strict',
+//         maxAge: 24 * 60 * 60,
+//       });
+//       response.cookies.set('refreshToken', result.refreshToken, {
+//         httpOnly: true,
+//         secure: isProd,
+//         sameSite: 'strict',
+//         maxAge: 7 * 24 * 60 * 60,
+//       });
+//       return { response, isAuthenticated: true };
+//     }
+//     const response = NextResponse.next();
+//     response.cookies.delete('jwt');
+//     response.cookies.delete('refreshToken');
+//     return { response, isAuthenticated: false };
+//   }
+//   return { response: NextResponse.next(), isAuthenticated };
+// }
 // src/nextjs/middleware.ts
 const server_1 = require("next/server");
-const jwt_decode_1 = require("jwt-decode");
+const jose_1 = require("jose");
+const core_1 = require("../core");
+const gatewayUrl = process.env.COREIAM_API_URL;
+const JWKS = gatewayUrl
+    ? (0, jose_1.createRemoteJWKSet)(new URL(`${gatewayUrl}/.well-known/jwks.json`))
+    : null;
 let refreshInFlight = null;
-async function performRefresh(refreshTokenCookie, jwtCookie, gatewayUrl) {
+async function performRefresh(refreshTokenCookie, jwtCookie) {
+    if (!gatewayUrl)
+        return null;
     try {
         const refreshRes = await fetch(`${gatewayUrl}/auth/refresh-token`, {
             method: 'POST',
@@ -17,8 +145,7 @@ async function performRefresh(refreshTokenCookie, jwtCookie, gatewayUrl) {
         if (!refreshRes.ok)
             return null;
         const setCookies = refreshRes.headers.getSetCookie();
-        let newJwt = '';
-        let newRefreshToken = '';
+        let newJwt = '', newRefreshToken = '';
         setCookies.forEach(cookie => {
             if (cookie.startsWith('jwt='))
                 newJwt = cookie.split(';')[0].split('=')[1];
@@ -32,37 +159,177 @@ async function performRefresh(refreshTokenCookie, jwtCookie, gatewayUrl) {
     }
 }
 /**
- * Handles CoreIAM token refresh and header rewriting.
- * Returns the NextResponse to return, and whether the user is authenticated.
+ * Helper function for custom middleware (proxy.ts).
+ * Returns the response and authentication state.
  */
-async function coreIamMiddleware(request) {
+async function coreIamAuth(request) {
+    const { nextUrl, method } = request;
+    const pathname = nextUrl.pathname;
+    // ========================================
+    // 1. ZERO-CONFIG API PROXY
+    // ========================================
+    if (pathname.startsWith('/api/auth/')) {
+        // FIX: Short-circuit CORS Preflight requests!
+        if (method === 'OPTIONS') {
+            const res = new server_1.NextResponse(null, { status: 204 }); // 204 No Content
+            const origin = request.headers.get('origin');
+            if (origin) {
+                res.headers.set('Access-Control-Allow-Origin', origin);
+                res.headers.set('Access-Control-Allow-Methods', 'GET, POST, PUT, DELETE, OPTIONS');
+                res.headers.set('Access-Control-Allow-Headers', 'Content-Type, Authorization, X-CSRF-Token');
+                res.headers.set('Access-Control-Allow-Credentials', 'true');
+            }
+            return { response: res, isAuthenticated: false };
+        }
+        const iam = new core_1.CoreIAM({ apiKey: process.env.COREIAM_API_KEY, baseUrl: gatewayUrl });
+        // FIX: Special handler for the Link Confirm POST! (Must be at the TOP, before generic body read)
+        if (pathname === '/api/auth/oauth/link/confirm') {
+            let formData = {};
+            const contentType = request.headers.get('content-type') || '';
+            if (contentType.includes('application/x-www-form-urlencoded')) {
+                const text = await request.text();
+                const params = new URLSearchParams(text);
+                formData = {
+                    tempToken: params.get('tempToken'),
+                    password: params.get('password')
+                };
+            }
+            else {
+                // Fallback to JSON (if called via fetch elsewhere)
+                formData = await request.json().catch(() => ({}));
+            }
+            const response = await iam.proxy('/auth/oauth/link/confirm', {
+                method: 'POST',
+                body: JSON.stringify(formData),
+                headers: { 'Content-Type': 'application/json' },
+            }, request.headers);
+            const data = await response.json().catch(() => ({}));
+            // If CoreIAM successfully verified the password and linked the account
+            if (response.ok && data.success) {
+                const appOrigin = request.nextUrl.origin; // e.g., http://localhost:3000
+                const redirectPath = data.redirectUri || '/';
+                const finalUrl = new URL(redirectPath, appOrigin).toString();
+                // FIX: Return a 200 OK with an HTML page that uses JavaScript to redirect.
+                // This breaks the cross-site redirect chain, forcing the browser to send the Lax cookies.
+                const html = `
+            <!DOCTYPE html>
+            <html>
+            <head>
+              <title>Linking Successful</title>
+            </head>
+            <body>
+              <p>Account linked successfully! Redirecting...</p>
+              <script>window.location.href = "${finalUrl}";</script>
+            </body>
+            </html>
+          `;
+                const res = new server_1.NextResponse(html, { status: 200, headers: { 'Content-Type': 'text/html' } });
+                // Set the cookies on the Next.js domain (localhost:3000)!
+                const isProd = process.env.NODE_ENV === 'production';
+                if (data.accessToken) {
+                    res.cookies.set('jwt', data.accessToken, { httpOnly: true, secure: isProd, sameSite: 'lax', maxAge: 24 * 60 * 60, path: '/' });
+                }
+                if (data.clientRefreshToken) {
+                    res.cookies.set('refreshToken', data.clientRefreshToken, { httpOnly: true, secure: isProd, sameSite: 'lax', maxAge: 7 * 24 * 60 * 60, path: '/' });
+                }
+                return { response: res, isAuthenticated: true };
+            }
+            // FIX: If it failed (wrong password), redirect back to the hosted page with an error param
+            const errorRedirect = new URL(`${gatewayUrl}/auth/hosted/confirm-link`);
+            errorRedirect.searchParams.set('token', formData.tempToken);
+            errorRedirect.searchParams.set('provider', data.provider || 'google');
+            errorRedirect.searchParams.set('email', data.email || '');
+            errorRedirect.searchParams.set('appOrigin', request.nextUrl.origin);
+            errorRedirect.searchParams.set('error', data.message || 'Invalid password. Link failed.');
+            return { response: server_1.NextResponse.redirect(errorRedirect, 303), isAuthenticated: false };
+        }
+        // Now it is safe to read the body for all other standard routes (Login, Register, etc.)
+        let targetPath = pathname.replace('/api/auth', '/auth');
+        const body = method !== 'GET' ? await request.json().catch(() => undefined) : undefined;
+        // FIX: Special routing for OAuth Initiate
+        if (pathname.startsWith('/api/auth/oauth/') && !pathname.includes('callback') && !pathname.includes('link')) {
+            const provider = pathname.split('/').pop();
+            const redirectUri = `${process.env.NEXT_PUBLIC_APP_URL}/api/auth/callback/${provider}`;
+            targetPath = `/auth/oauth/initiate/${provider}?redirectUri=${encodeURIComponent(redirectUri)}&scopes=email,profile`;
+        }
+        // FIX: Special routing for OAuth Callback
+        if (pathname.startsWith('/api/auth/callback/')) {
+            const provider = pathname.split('/').pop();
+            const searchParams = new URL(request.url).searchParams;
+            const code = searchParams.get('code');
+            const state = searchParams.get('state');
+            const redirectUri = `${process.env.NEXT_PUBLIC_APP_URL}/api/auth/callback/${provider}`;
+            targetPath = `/auth/oauth/callback/${provider}?code=${code}&state=${state}&redirectUri=${redirectUri}`;
+        }
+        const response = await iam.proxy(targetPath, {
+            method,
+            body: body ? JSON.stringify(body) : undefined,
+            headers: { 'Content-Type': 'application/json' },
+        }, request.headers);
+        // Handle OAuth Initiate Redirects
+        if (pathname.startsWith('/api/auth/oauth/') && !pathname.includes('callback') && !pathname.includes('link')) {
+            const data = await response.json().catch(() => ({}));
+            if (data.url)
+                return { response: server_1.NextResponse.redirect(data.url), isAuthenticated: false };
+            return { response: server_1.NextResponse.redirect(new URL('/auth/login', request.url)), isAuthenticated: false };
+        }
+        // Handle OAuth Callback Redirects
+        if (pathname.startsWith('/api/auth/callback/')) {
+            const data = await response.json().catch(() => ({}));
+            // FIX: Redirect to CoreIAM's Hosted Confirmation Page and pass appOrigin!
+            if (data.action === 'link_candidate') {
+                const appOrigin = request.nextUrl.origin; // e.g., http://localhost:3000
+                const redirectUrl = `${gatewayUrl}/auth/hosted/confirm-link?token=${encodeURIComponent(data.tempToken)}&provider=${encodeURIComponent(data.provider)}&email=${encodeURIComponent(data.email)}&appOrigin=${encodeURIComponent(appOrigin)}`;
+                return { response: server_1.NextResponse.redirect(redirectUrl), isAuthenticated: false };
+            }
+            // Normal OAuth login: redirect to dashboard
+            const res = server_1.NextResponse.redirect(new URL('/', request.url));
+            const setCookies = response.headers.getSetCookie();
+            setCookies.forEach(c => res.headers.append('set-cookie', c));
+            return { response: res, isAuthenticated: false };
+        }
+        // Standard JSON API Responses (Login, Logout, Register, etc.)
+        const data = await response.json().catch(() => ({}));
+        const res = server_1.NextResponse.json(data, { status: response.status });
+        const setCookies = response.headers.getSetCookie();
+        setCookies.forEach(c => res.headers.append('set-cookie', c));
+        return { response: res, isAuthenticated: false };
+    }
+    // 2. LOCAL JWT VERIFICATION & REFRESH
     const jwtCookie = request.cookies.get("jwt");
     const refreshTokenCookie = request.cookies.get("refreshToken");
-    const gatewayUrl = process.env.COREIAM_API_URL;
     let isAuthenticated = false;
     let needsRefresh = false;
-    if (jwtCookie) {
+    if (jwtCookie && JWKS) {
         try {
-            const decoded = (0, jwt_decode_1.jwtDecode)(jwtCookie.value);
-            if (decoded.exp && decoded.exp * 1000 > Date.now()) {
-                isAuthenticated = true;
-            }
-            else if (refreshTokenCookie) {
-                needsRefresh = true;
-            }
+            const { payload } = await (0, jose_1.jwtVerify)(jwtCookie.value, JWKS, {
+                issuer: 'coreiam',
+                algorithms: ['RS256']
+            });
+            const requestHeaders = new Headers(request.headers);
+            requestHeaders.set('x-coreiam-identity', JSON.stringify({
+                sub: payload.sub,
+                email: payload.email,
+                tenantId: payload.tenantId,
+                roles: payload.roles || []
+            }));
+            return {
+                response: server_1.NextResponse.next({ request: { headers: requestHeaders } }),
+                isAuthenticated: true
+            };
         }
-        catch {
-            if (refreshTokenCookie)
+        catch (error) {
+            if (error.code === 'ERR_JWT_EXPIRED' && refreshTokenCookie) {
                 needsRefresh = true;
+            }
         }
     }
     else if (refreshTokenCookie) {
         needsRefresh = true;
     }
-    // 1. ATTEMPT SILENT REFRESH (single-flight)
-    if (needsRefresh && gatewayUrl) {
+    if (needsRefresh) {
         if (!refreshInFlight) {
-            refreshInFlight = performRefresh(refreshTokenCookie, jwtCookie, gatewayUrl).finally(() => {
+            refreshInFlight = performRefresh(refreshTokenCookie, jwtCookie).finally(() => {
                 refreshInFlight = null;
             });
         }
@@ -71,30 +338,48 @@ async function coreIamMiddleware(request) {
             const requestHeaders = new Headers(request.headers);
             requestHeaders.set('cookie', `jwt=${result.jwt}; refreshToken=${result.refreshToken}`);
             requestHeaders.set('Authorization', `Bearer ${result.jwt}`);
-            const response = server_1.NextResponse.next({
-                request: { headers: requestHeaders },
-            });
+            try {
+                const payloadB64 = result.jwt.split('.')[1];
+                const payloadStr = Buffer.from(payloadB64, 'base64').toString('utf8');
+                const payload = JSON.parse(payloadStr);
+                requestHeaders.set('x-coreiam-identity', JSON.stringify({
+                    sub: payload.sub,
+                    email: payload.email,
+                    tenantId: payload.tenantId,
+                    roles: payload.roles || []
+                }));
+            }
+            catch { }
+            const response = server_1.NextResponse.next({ request: { headers: requestHeaders } });
             const isProd = process.env.NODE_ENV === 'production';
-            response.cookies.set('jwt', result.jwt, {
-                httpOnly: true,
-                secure: isProd,
-                sameSite: 'strict',
-                maxAge: 24 * 60 * 60,
-            });
-            response.cookies.set('refreshToken', result.refreshToken, {
-                httpOnly: true,
-                secure: isProd,
-                sameSite: 'strict',
-                maxAge: 7 * 24 * 60 * 60,
-            });
+            response.cookies.set('jwt', result.jwt, { httpOnly: true, secure: isProd, sameSite: 'strict', maxAge: 24 * 60 * 60 });
+            response.cookies.set('refreshToken', result.refreshToken, { httpOnly: true, secure: isProd, sameSite: 'strict', maxAge: 7 * 24 * 60 * 60 });
             return { response, isAuthenticated: true };
         }
-        // 2. IF REFRESH FAILED, CLEAR COOKIES
         const response = server_1.NextResponse.next();
         response.cookies.delete('jwt');
         response.cookies.delete('refreshToken');
         return { response, isAuthenticated: false };
     }
-    // 3. NO REFRESH NEEDED (Token is valid or completely missing)
-    return { response: server_1.NextResponse.next(), isAuthenticated };
+    return { response: server_1.NextResponse.next(), isAuthenticated: false };
+}
+/**
+ * 1-line middleware factory for developers who don't need custom routing.
+ */
+function coreIamMiddleware(options = {}) {
+    const { publicRoutes = [], signInUrl = '/login' } = options;
+    return async (request) => {
+        const { response, isAuthenticated } = await coreIamAuth(request);
+        const pathname = request.nextUrl.pathname;
+        const isPublicRoute = publicRoutes.some(route => pathname.startsWith(route));
+        // If not authenticated and trying to access a protected route
+        if (!isAuthenticated && !isPublicRoute) {
+            const redirect = server_1.NextResponse.redirect(new URL(signInUrl, request.url));
+            // CRITICAL: Copy any refreshed cookies/headers from the SDK response onto the redirect
+            const setCookies = response.headers.getSetCookie();
+            setCookies.forEach(c => redirect.headers.append('set-cookie', c));
+            return redirect;
+        }
+        return response;
+    };
 }

package/dist/nextjs/provider.d.ts

@@ -1,39 +1,30 @@
 import React from 'react';
 import type { CoreIAMIdentity } from '../core';
-export interface CoreIAMRedirects {
-    /** Where to send the user after a successful login, if no callbackUrl is passed to login(). */
-    afterLogin?: string;
-    /** Where to send the user after logout. */
-    afterLogout?: string;
-}
-interface LoginResult {
-    success?: boolean;
-    error?: string;
-}
 interface AuthContextType {
-    /**
-     * Generic CoreIAM identity (sub/email/roles/tenantId) — NOT an app-shaped
-     * user. This SDK has no knowledge of any consumer's local user model
-     * (roles, profile fields, etc). Consumers that need an enriched user
-     * object should build their own layer on top of this, keyed off `sub`.
-     */
     identity: CoreIAMIdentity | null;
     isLoading: boolean;
     isAuthenticated: boolean;
     login: (values: {
         email: string;
         password: string;
-    }, callbackUrl?: string) => Promise<LoginResult>;
+    }, callbackUrl?: string) => Promise<{
+        success?: boolean;
+        error?: string;
+    }>;
     logout: () => Promise<void>;
-    register: (userData: Record<string, any>) => Promise<LoginResult>;
+    register: (userData: any) => Promise<{
+        success?: boolean;
+        error?: string;
+    }>;
+    verifyMfa: (tempToken: string, code: string) => Promise<{
+        success?: boolean;
+        error?: string;
+    }>;
     refetchIdentity: () => Promise<void>;
 }
-export declare function CoreIAMProvider({ children, initialIdentity, redirects, }: {
+export declare function CoreIAMProvider({ children, initialIdentity }: {
     children: React.ReactNode;
-    /** Pass the result of a server-side getSession() call to skip the client fetch on first paint. */
     initialIdentity?: CoreIAMIdentity | null;
-    /** Where to redirect after login/logout. Omit for no redirect (caller handles navigation itself). */
-    redirects?: CoreIAMRedirects;
 }): import("react/jsx-runtime").JSX.Element;
 export declare function useAuth(): AuthContextType;
 export {};

package/dist/nextjs/provider.js

@@ -1,182 +1,49 @@
 "use strict";
 // // src/nextjs/provider.tsx
 // 'use client';
-// import React, { createContext, useContext, useEffect, useState, useCallback } from 'react';
-// import { useRouter } from 'next/navigation';
+// import React, { createContext, useContext, useEffect, useState } from 'react';
+// import { getSession } from './actions';
 // import type { CoreIAMIdentity } from '../core';
-// export interface CoreIAMRedirects {
-//   afterLogin?: string;
-//   afterLogout?: string;
-// }
-// interface LoginResult {
-//   success?: boolean;
-//   error?: string;
-//   twoFactor?: boolean;
-// }
 // interface AuthContextType {
 //   identity: CoreIAMIdentity | null;
 //   isLoading: boolean;
 //   isAuthenticated: boolean;
-//   login: (values: { email: string; password: string }, callbackUrl?: string) => Promise<LoginResult>;
-//   logout: () => Promise<void>;
-//   register: (userData: Record<string, any>) => Promise<LoginResult>;
 //   refetchIdentity: () => Promise<void>;
 // }
 // const AuthContext = createContext<AuthContextType>({
 //   identity: null,
 //   isLoading: true,
 //   isAuthenticated: false,
-//   login: async () => ({ error: 'CoreIAMProvider is not mounted' }),
-//   logout: async () => {},
-//   register: async () => ({ error: 'CoreIAMProvider is not mounted' }),
 //   refetchIdentity: async () => {},
 // });
-// export function CoreIAMProvider({
-//   children,
-//   initialIdentity,
-//   redirects = {},
-// }: {
-//   children: React.ReactNode;
+// export function CoreIAMProvider({ 
+//   children, 
+//   initialIdentity 
+// }: { 
+//   children: React.ReactNode; 
 //   initialIdentity?: CoreIAMIdentity | null;
-//   redirects?: CoreIAMRedirects;
 // }) {
 //   const [identity, setIdentity] = useState<CoreIAMIdentity | null>(initialIdentity ?? null);
 //   const [isLoading, setIsLoading] = useState(initialIdentity === undefined);
-//   const router = useRouter();
-//   const refetchIdentity = useCallback(async () => {
+//   const refetchIdentity = async () => {
 //     try {
-//       // Call the Next.js API route, which securely calls CoreIAM
-//       const res = await fetch('/api/auth/session', { credentials: 'include' });
-//       setIdentity(res.ok ? await res.json() : null);
+//       const result = await getSession();
+//       setIdentity(result);
 //     } catch {
 //       setIdentity(null);
 //     } finally {
 //       setIsLoading(false);
 //     }
-//   }, []);
+//   };
 //   useEffect(() => {
 //     if (initialIdentity === undefined) {
 //       refetchIdentity();
 //     } else {
 //       setIsLoading(false);
 //     }
-//     // eslint-disable-next-line react-hooks/exhaustive-deps
 //   }, []);
-//   // const login = async (values: { email: string; password: string }, callbackUrl?: string): Promise<LoginResult> => {
-//   //   setIsLoading(true);
-//   //   try {
-//   //     // Fetch CSRF token first
-//   //     const csrfRes = await fetch('/api/auth/csrf', { credentials: 'include' });
-//   //     if (!csrfRes.ok) return { error: 'Failed to get CSRF token' };
-//   //     const { csrfToken } = await csrfRes.json();
-//   //     // Call login API route
-//   //     const loginRes = await fetch('/api/auth/login', {
-//   //       method: 'POST',
-//   //       headers: {
-//   //         'Content-Type': 'application/json',
-//   //         'x-csrf-token': csrfToken,
-//   //       },
-//   //       credentials: 'include',
-//   //       body: JSON.stringify(values),
-//   //     });
-//   //     const data = await loginRes.json();
-//   //     if (!loginRes.ok) {
-//   //       return { error: data.message || data.error || 'Invalid credentials' };
-//   //     }
-//   //     if (data.twoFactor) {
-//   //       return { twoFactor: true };
-//   //     }
-//   //     await refetchIdentity();
-//   //     const target = callbackUrl || redirects.afterLogin;
-//   //     if (target) router.push(target);
-//   //     return { success: true };
-//   //   } catch {
-//   //     return { error: 'Something went wrong' };
-//   //   } finally {
-//   //     setIsLoading(false);
-//   //   }
-//   // };
-//   const login = async (values: { email: string; password: string }, callbackUrl?: string): Promise<LoginResult> => {
-//     setIsLoading(true);
-//     try {
-//       // Fetch CSRF token first
-//       const csrfRes = await fetch('/api/auth/csrf', { credentials: 'include' });
-//       if (!csrfRes.ok) return { error: 'Failed to get CSRF token' };
-//       const { csrfToken } = await csrfRes.json();
-//       // FIX: Map 'email' to 'identifier' for the CoreIAM backend
-//       const loginPayload = {
-//         identifier: values.email,
-//         password: values.password,
-//       };
-//       // Call login API route
-//       const loginRes = await fetch('/api/auth/login', {
-//         method: 'POST',
-//         headers: {
-//           'Content-Type': 'application/json',
-//           'x-csrf-token': csrfToken,
-//         },
-//         credentials: 'include',
-//         body: JSON.stringify(loginPayload), // Send the mapped payload
-//       });
-//       const data = await loginRes.json();
-//       if (!loginRes.ok) {
-//         return { error: data.message || data.error || 'Invalid credentials' };
-//       }
-//       if (data.twoFactor) {
-//         return { twoFactor: true };
-//       }
-//       await refetchIdentity();
-//       const target = callbackUrl || redirects.afterLogin;
-//       if (target) router.push(target);
-//       return { success: true };
-//     } catch {
-//       return { error: 'Something went wrong' };
-//     } finally {
-//       setIsLoading(false);
-//     }
-//   };
-//   const logout = async () => {
-//     try {
-//       await fetch('/api/auth/logout', {
-//         method: 'POST',
-//         credentials: 'include',
-//       });
-//     } finally {
-//       setIdentity(null);
-//       if (redirects.afterLogout) router.push(redirects.afterLogout);
-//     }
-//   };
-//   const register = async (userData: Record<string, any>): Promise<LoginResult> => {
-//     setIsLoading(true);
-//     try {
-//       const csrfRes = await fetch('/api/auth/csrf', { credentials: 'include' });
-//       if (!csrfRes.ok) return { error: 'Failed to get CSRF token' };
-//       const { csrfToken } = await csrfRes.json();
-//       const registerRes = await fetch('/api/auth/register', {
-//         method: 'POST',
-//         headers: {
-//           'Content-Type': 'application/json',
-//           'x-csrf-token': csrfToken,
-//         },
-//         credentials: 'include',
-//         body: JSON.stringify(userData),
-//       });
-//       if (!registerRes.ok) {
-//         const error = await registerRes.json();
-//         return { error: error.message || error.error || 'Registration failed' };
-//       }
-//       // Auto-login after registration
-//       return await login({ email: userData.email, password: userData.password });
-//     } catch {
-//       return { error: 'Something went wrong' };
-//     } finally {
-//       setIsLoading(false);
-//     }
-//   };
 //   return (
-//     <AuthContext.Provider
-//       value={{ identity, isLoading, isAuthenticated: !!identity, login, logout, register, refetchIdentity }}
-//     >
+//     <AuthContext.Provider value={{ identity, isLoading, isAuthenticated: !!identity, refetchIdentity }}>
 //       {children}
 //     </AuthContext.Provider>
 //   );
@@ -184,6 +51,7 @@
 // export function useAuth() {
 //   return useContext(AuthContext);
 // }
+// src/nextjs/provider.tsx
 'use client';
 Object.defineProperty(exports, "__esModule", { value: true });
 exports.CoreIAMProvider = CoreIAMProvider;
@@ -196,20 +64,17 @@ const AuthContext = (0, react_1.createContext)({
     identity: null,
     isLoading: true,
     isAuthenticated: false,
-    login: async () => ({ error: 'CoreIAMProvider is not mounted' }),
+    login: async () => ({ error: 'Not mounted' }),
     logout: async () => { },
-    register: async () => ({ error: 'CoreIAMProvider is not mounted' }),
+    register: async () => ({ error: 'Not mounted' }),
+    verifyMfa: async () => ({ error: 'Not mounted' }),
     refetchIdentity: async () => { },
 });
-function CoreIAMProvider({ children, initialIdentity, redirects = {}, }) {
+function CoreIAMProvider({ children, initialIdentity }) {
     const [identity, setIdentity] = (0, react_1.useState)(initialIdentity ?? null);
     const [isLoading, setIsLoading] = (0, react_1.useState)(initialIdentity === undefined);
     const router = (0, navigation_1.useRouter)();
     const refetchIdentity = async () => {
-        // DEBUG_TRACE: browser console — tags who called this (mount effect vs.
-        // an explicit login/logout/register call). Temporary, remove once
-        // settled.
-        console.log(`[DEBUG_TRACE][CoreIAMProvider] refetchIdentity() called @ ${new Date().toISOString()}`);
         try {
             const result = await (0, actions_1.getSession)();
             setIdentity(result);
@@ -222,37 +87,71 @@ function CoreIAMProvider({ children, initialIdentity, redirects = {}, }) {
         }
     };
     (0, react_1.useEffect)(() => {
-        // FIX: was `initialIdentity === null`, which can't tell "SSR ran and
-        // confirmed you're logged out" (a correct, final null) apart from "no
-        // SSR value was ever provided" (a real undefined). Since layout.tsx
-        // always calls getSession() and passes its result — even when that
-        // result legitimately is null — every logged-out page view was
-        // treated as "no SSR value, fetch again," firing a second, wholly
-        // redundant /auth/profile call for something SSR had already
-        // determined. undefined (the prop genuinely omitted) is the only case
-        // that should trigger this fallback fetch.
-        console.log(`[DEBUG_TRACE][CoreIAMProvider] mount effect ran, initialIdentity=${initialIdentity === undefined ? 'undefined' : JSON.stringify(initialIdentity)} @ ${new Date().toISOString()}`);
         if (initialIdentity === undefined) {
             refetchIdentity();
         }
         else {
             setIsLoading(false);
         }
-        // Intentionally only on mount — initialIdentity is a one-time SSR seed,
-        // not something we want to re-run this effect for if it changes identity.
-        // eslint-disable-next-line react-hooks/exhaustive-deps
     }, []);
+    const getCsrfToken = async () => {
+        const res = await fetch('/api/auth/csrf-token', {
+            method: 'POST',
+            credentials: 'include'
+        });
+        if (!res.ok)
+            throw new Error('Failed to get CSRF token');
+        const { csrfToken } = await res.json();
+        return csrfToken;
+    };
+    const verifyMfa = async (tempToken, code) => {
+        setIsLoading(true);
+        try {
+            const res = await fetch('/api/auth/mfa/login', {
+                method: 'POST',
+                headers: { 'Content-Type': 'application/json' },
+                credentials: 'include',
+                body: JSON.stringify({ tempToken, code }),
+            });
+            const data = await res.json();
+            if (!res.ok) {
+                return { error: data.message || 'Invalid 2FA code.' };
+            }
+            // Success! Hard refresh to let the server re-render with new cookies
+            window.location.href = '/';
+            return { success: true };
+        }
+        catch {
+            return { error: 'Something went wrong' };
+        }
+        finally {
+            setIsLoading(false);
+        }
+    };
     const login = async (values, callbackUrl) => {
         setIsLoading(true);
         try {
-            const result = await (0, actions_1.loginActionSdk)(values.email, values.password);
-            if (!result.ok) {
-                return { error: result.data?.message || result.data?.error || 'Invalid credentials' };
+            // 1. Fetch CSRF token
+            const csrfToken = await getCsrfToken();
+            // 2. Call login API route
+            const res = await fetch('/api/auth/login', {
+                method: 'POST',
+                headers: {
+                    'Content-Type': 'application/json',
+                    'x-csrf-token': csrfToken,
+                },
+                credentials: 'include',
+                body: JSON.stringify({ identifier: values.email, password: values.password }),
+            });
+            const data = await res.json();
+            if (!res.ok)
+                return { error: data.message || 'Invalid credentials' };
+            if (data.twoFactorRequired) {
+                // Return the twoFactor flag and the tempToken to the form
+                return { twoFactor: true, tempToken: data.tempToken };
             }
-            await refetchIdentity();
-            const target = callbackUrl || redirects.afterLogin;
-            if (target)
-                router.push(target);
+            // Hard refresh to let server re-render with new cookies
+            window.location.href = callbackUrl || '/';
             return { success: true };
         }
         catch {
@@ -263,31 +162,52 @@ function CoreIAMProvider({ children, initialIdentity, redirects = {}, }) {
         }
     };
     const logout = async () => {
+        setIsLoading(true);
         try {
-            await (0, actions_1.logoutActionSdk)();
+            await fetch('/api/auth/logout', { method: 'POST', credentials: 'include' });
+            setIdentity(null);
+            window.location.href = '/auth/login';
         }
         finally {
-            setIdentity(null);
-            if (redirects.afterLogout)
-                router.push(redirects.afterLogout);
+            setIsLoading(false);
         }
     };
     const register = async (userData) => {
         setIsLoading(true);
         try {
-            const result = await (0, actions_1.registerActionSdk)(userData);
-            if (!result.ok) {
-                return { error: result.data?.message || result.data?.error || 'Registration failed' };
+            // 1. Fetch CSRF token
+            const csrfToken = await getCsrfToken();
+            // 2. Call register API route
+            const res = await fetch('/api/auth/register', {
+                method: 'POST',
+                headers: {
+                    'Content-Type': 'application/json',
+                    'x-csrf-token': csrfToken,
+                },
+                credentials: 'include',
+                body: JSON.stringify(userData),
+            });
+            const data = await res.json();
+            // 3. FIX: Check for the "OAuth Required" signal
+            if (!res.ok) {
+                if (data.code === 'OAUTH_ACCOUNT_EXISTS') {
+                    // Automatically redirect to the OAuth provider!
+                    window.location.href = `/api/auth/oauth/${data.provider}`;
+                    return { success: true };
+                }
+                return { error: data.message || 'Registration failed' };
             }
-            // Registration on the backend doesn't auto-issue a session — log in
-            // immediately after, same as the flow this replaces did.
-            return await login({ email: userData.email, password: userData.password });
+            // Auto-login after standard registration
+            return login({ email: userData.email, password: userData.password });
+        }
+        catch {
+            return { error: 'Something went wrong' };
         }
         finally {
             setIsLoading(false);
         }
     };
-    return ((0, jsx_runtime_1.jsx)(AuthContext.Provider, { value: { identity, isLoading, isAuthenticated: !!identity, login, logout, register, refetchIdentity }, children: children }));
+    return ((0, jsx_runtime_1.jsx)(AuthContext.Provider, { value: { identity, isLoading, isAuthenticated: !!identity, login, logout, register, verifyMfa, refetchIdentity }, children: children }));
 }
 function useAuth() {
     return (0, react_1.useContext)(AuthContext);

package/dist/ui/buttons.d.ts

@@ -0,0 +1,45 @@
+import React from 'react';
+export interface SignInButtonProps extends React.ButtonHTMLAttributes<HTMLButtonElement> {
+    /** If true, renders child directly via Radix Slot instead of a <button> */
+    asChild?: boolean;
+    /** Destination route on click */
+    redirectTo?: string;
+}
+/**
+ * Renders a sign-in button or merges click behavior onto a child element (asChild).
+ */
+export declare function SignInButton({ asChild, redirectTo, onClick, children, ...props }: SignInButtonProps): import("react/jsx-runtime").JSX.Element;
+export interface SignUpButtonProps extends React.ButtonHTMLAttributes<HTMLButtonElement> {
+    asChild?: boolean;
+    redirectTo?: string;
+}
+/**
+ * Renders a sign-up button or merges click behavior onto a child element (asChild).
+ */
+export declare function SignUpButton({ asChild, redirectTo, onClick, children, ...props }: SignUpButtonProps): import("react/jsx-runtime").JSX.Element;
+export interface OAuthButtonProps extends React.ButtonHTMLAttributes<HTMLButtonElement> {
+    asChild?: boolean;
+    provider: 'google' | 'github' | 'microsoft' | 'apple' | string;
+}
+/**
+ * Renders an OAuth provider button or merges click behavior onto a child element (asChild).
+ */
+export declare function OAuthButton({ asChild, provider, onClick, children, ...props }: OAuthButtonProps): import("react/jsx-runtime").JSX.Element;
+export interface SignOutButtonProps extends React.ButtonHTMLAttributes<HTMLButtonElement> {
+    asChild?: boolean;
+    /** Destination route after signing out */
+    redirectTo?: string;
+}
+/**
+ * Renders a sign-out button or merges click behavior onto a child element (asChild).
+ */
+export declare function SignOutButton({ asChild, redirectTo, onClick, children, ...props }: SignOutButtonProps): import("react/jsx-runtime").JSX.Element;
+export interface UserButtonProps extends React.ButtonHTMLAttributes<HTMLButtonElement> {
+    asChild?: boolean;
+    /** Destination route for the user's account/profile page */
+    redirectTo?: string;
+}
+/**
+ * Renders a user profile button or merges click behavior onto a child element (asChild).
+ */
+export declare function UserButton({ asChild, redirectTo, onClick, children, ...props }: UserButtonProps): import("react/jsx-runtime").JSX.Element;

package/dist/ui/buttons.js

@@ -0,0 +1,76 @@
+"use strict";
+'use client';
+Object.defineProperty(exports, "__esModule", { value: true });
+exports.SignInButton = SignInButton;
+exports.SignUpButton = SignUpButton;
+exports.OAuthButton = OAuthButton;
+exports.SignOutButton = SignOutButton;
+exports.UserButton = UserButton;
+const jsx_runtime_1 = require("react/jsx-runtime");
+const react_slot_1 = require("@radix-ui/react-slot");
+/**
+ * Renders a sign-in button or merges click behavior onto a child element (asChild).
+ */
+function SignInButton({ asChild = false, redirectTo = '/auth/login', onClick, children, ...props }) {
+    const Component = asChild ? react_slot_1.Slot : 'button';
+    const handleClick = (e) => {
+        onClick?.(e); // Run original onClick prop if passed
+        if (!e.defaultPrevented) {
+            window.location.href = redirectTo;
+        }
+    };
+    return ((0, jsx_runtime_1.jsx)(Component, { ...props, onClick: handleClick, children: children ?? 'Sign In' }));
+}
+/**
+ * Renders a sign-up button or merges click behavior onto a child element (asChild).
+ */
+function SignUpButton({ asChild = false, redirectTo = '/auth/register', onClick, children, ...props }) {
+    const Component = asChild ? react_slot_1.Slot : 'button';
+    const handleClick = (e) => {
+        onClick?.(e);
+        if (!e.defaultPrevented) {
+            window.location.href = redirectTo;
+        }
+    };
+    return ((0, jsx_runtime_1.jsx)(Component, { ...props, onClick: handleClick, children: children ?? 'Sign Up' }));
+}
+/**
+ * Renders an OAuth provider button or merges click behavior onto a child element (asChild).
+ */
+function OAuthButton({ asChild = false, provider, onClick, children, ...props }) {
+    const Component = asChild ? react_slot_1.Slot : 'button';
+    const handleClick = (e) => {
+        onClick?.(e);
+        if (!e.defaultPrevented) {
+            window.location.href = `/api/auth/oauth/${provider}`;
+        }
+    };
+    return ((0, jsx_runtime_1.jsx)(Component, { ...props, onClick: handleClick, children: children ?? `Continue with ${provider}` }));
+}
+/**
+ * Renders a sign-out button or merges click behavior onto a child element (asChild).
+ */
+function SignOutButton({ asChild = false, redirectTo = '/', onClick, children, ...props }) {
+    const Component = asChild ? react_slot_1.Slot : 'button';
+    const handleClick = (e) => {
+        onClick?.(e);
+        if (!e.defaultPrevented) {
+            // Direct to your framework's sign-out endpoint, passing the redirect URL
+            window.location.href = `/api/auth/signout?callbackUrl=${encodeURIComponent(redirectTo)}`;
+        }
+    };
+    return ((0, jsx_runtime_1.jsx)(Component, { ...props, onClick: handleClick, children: children ?? 'Sign Out' }));
+}
+/**
+ * Renders a user profile button or merges click behavior onto a child element (asChild).
+ */
+function UserButton({ asChild = false, redirectTo = '/account', onClick, children, ...props }) {
+    const Component = asChild ? react_slot_1.Slot : 'button';
+    const handleClick = (e) => {
+        onClick?.(e);
+        if (!e.defaultPrevented) {
+            window.location.href = redirectTo;
+        }
+    };
+    return ((0, jsx_runtime_1.jsx)(Component, { ...props, onClick: handleClick, children: children ?? 'My Account' }));
+}

package/package.json

@@ -1,6 +1,6 @@
 {
   "name": "@coreiam/auth",
-  "version": "1.0.14",
+  "version": "1.0.39",
   "main": "./dist/core/index.js",
   "types": "./dist/core/index.d.ts",
   "exports": {
@@ -57,6 +57,8 @@
     "typescript": "^5.0.0"
   },
   "dependencies": {
+    "@radix-ui/react-slot": "^1.3.3",
+    "jose": "^6.2.7",
     "jwt-decode": "^4.0.0"
   }
-}
+}