@coreiam/auth 1.0.15 → 1.0.391

package/dist/core/index.d.ts

@@ -1,7 +1,16 @@
+import { type JWTPayload } from 'jose';
 export interface CoreIAMConfig {
     baseUrl?: string;
     apiKey?: string;
     tenantId?: string;
+    /** Expected token issuer. Default: 'coreiam'. */
+    issuer?: string;
+    /** Optional strict audience check — off by default, matches current gateway tokens. */
+    audience?: string;
+    /** Session cookie name. Default: 'jwt'. */
+    sessionCookieName?: string;
+    /** JWKS path on the gateway. Default: '/.well-known/jwks.json'. */
+    jwksPath?: string;
 }
 export interface CoreIAMIdentity {
     sub: string;
@@ -10,14 +19,83 @@ export interface CoreIAMIdentity {
     roles?: string[];
     [key: string]: any;
 }
+/** Accepts a Headers instance, an Express req.headers object, or a raw Cookie string. */
+export type SessionInput = Headers | Record<string, string | string[] | undefined> | string;
+export type SessionFailureReason = 'no_cookie' | 'expired' | 'invalid_claims' | 'invalid_signature' | 'jwks_unavailable';
+export interface SessionResult {
+    identity: CoreIAMIdentity | null;
+    reason?: SessionFailureReason;
+}
+export interface RefreshSessionResult {
+    identity: CoreIAMIdentity | null;
+    /** Raw Set-Cookie strings to apply on your response (rotated jwt/refreshToken). */
+    setCookies: string[] | null;
+}
+/** Maps gateway token claims → CoreIAMIdentity (same shape the Next.js middleware injects). */
+export declare function toIdentity(payload: JWTPayload): CoreIAMIdentity;
+/**
+export class CoreIAM {
+  private apiKey: string = '';
+  private baseUrl: string = '';
+
+  constructor(config?: { apiKey?: string; baseUrl?: string }) {
+    this.apiKey = config?.apiKey || process.env.COREIAM_API_KEY || '';
+    // FIX: Removed hardcoded URL. Throw if missing.
+    this.baseUrl = config?.baseUrl || process.env.COREIAM_API_URL || '';
+    
+    if (!this.apiKey) throw new Error('CoreIAM: Missing API Key (COREIAM_API_KEY)');
+    if (!this.baseUrl) throw new Error('CoreIAM: Missing Gateway URL (COREIAM_API_URL)');
+  }
+*/
 export declare class CoreIAM {
     private apiKey;
     private baseUrl;
-    constructor(config?: {
-        apiKey?: string;
-        baseUrl?: string;
-    });
-    refreshTokens(headers: Headers): Promise<string[] | null>;
+    private issuer;
+    private audience?;
+    private sessionCookieName;
+    private jwksPath;
+    private jwks;
+    private refreshInFlight;
+    constructor(config?: CoreIAMConfig);
+    private getJwks;
+    /** Optional warm-up: call at boot so the first verification pays no JWKS latency. */
+    preloadJwks(): Promise<void>;
+    private readCookieHeader;
+    private readSessionCookie;
+    verifySession(input: SessionInput): Promise<SessionResult>;
+    getSession(input: SessionInput): Promise<CoreIAMIdentity | null>;
+    /**
+     * One-call silent refresh for non-Next servers: posts the refresh cookie
+     * to the gateway, verifies the rotated access token, and returns the new
+     * Set-Cookie strings so the caller can forward them on its response.
+     */
+    refreshSession(input: SessionInput): Promise<RefreshSessionResult>;
+    refreshTokens(input: SessionInput): Promise<string[] | null>;
+    private doRefresh;
+    /**
+      async refreshTokens(headers: Headers): Promise<string[] | null> {
+        try {
+          const response = await fetch(`${this.baseUrl}/auth/refresh-token`, {
+            method: 'POST',
+            headers: {
+              'X-API-Key': this.apiKey,
+              'cookie': headers.get('cookie') || '',
+            },
+          });
+    
+          if (response.ok) {
+            const setCookies = response.headers.getSetCookie();
+            if (setCookies && setCookies.length > 0) {
+              return setCookies;
+            }
+          }
+          return null;
+        } catch (error) {
+          return null;
+        }
+      }
+    
+    */
     proxy(path: string, init: RequestInit, incomingHeaders: Headers): Promise<Response>;
     getCsrfToken(headers: Headers): Promise<Response>;
     login(body: any, headers: Headers): Promise<Response>;

package/dist/core/index.js

@@ -1,41 +1,189 @@
 "use strict";
-// src/core/index.ts
 Object.defineProperty(exports, "__esModule", { value: true });
 exports.CoreIAM = void 0;
+exports.toIdentity = toIdentity;
+// src/core/index.ts
+const jose_1 = require("jose");
+/** Maps gateway token claims → CoreIAMIdentity (same shape the Next.js middleware injects). */
+function toIdentity(payload) {
+    return {
+        sub: payload.sub,
+        email: payload.email,
+        tenantId: payload.tenantId,
+        roles: Array.isArray(payload.roles) ? payload.roles : [],
+    };
+}
+/**
+export class CoreIAM {
+  private apiKey: string = '';
+  private baseUrl: string = '';
+
+  constructor(config?: { apiKey?: string; baseUrl?: string }) {
+    this.apiKey = config?.apiKey || process.env.COREIAM_API_KEY || '';
+    // FIX: Removed hardcoded URL. Throw if missing.
+    this.baseUrl = config?.baseUrl || process.env.COREIAM_API_URL || '';
+    
+    if (!this.apiKey) throw new Error('CoreIAM: Missing API Key (COREIAM_API_KEY)');
+    if (!this.baseUrl) throw new Error('CoreIAM: Missing Gateway URL (COREIAM_API_URL)');
+  }
+*/
 class CoreIAM {
     apiKey = '';
     baseUrl = '';
+    issuer = 'coreiam';
+    audience;
+    sessionCookieName = 'jwt';
+    jwksPath = '/.well-known/jwks.json';
+    jwks = null;
+    refreshInFlight = null;
     constructor(config) {
         this.apiKey = config?.apiKey || process.env.COREIAM_API_KEY || '';
-        // FIX: Removed hardcoded URL. Throw if missing.
-        this.baseUrl = config?.baseUrl || process.env.COREIAM_API_URL || '';
+        this.baseUrl = (config?.baseUrl || process.env.COREIAM_API_URL || '').replace(/\/+$/, '');
+        this.issuer = config?.issuer ?? 'coreiam';
+        this.audience = config?.audience;
+        this.sessionCookieName = config?.sessionCookieName ?? 'jwt';
+        this.jwksPath = config?.jwksPath ?? '/.well-known/jwks.json';
         if (!this.apiKey)
             throw new Error('CoreIAM: Missing API Key (COREIAM_API_KEY)');
         if (!this.baseUrl)
             throw new Error('CoreIAM: Missing Gateway URL (COREIAM_API_URL)');
     }
-    // Exposed publicly so the Next.js layer can use it for getSession()
-    async refreshTokens(headers) {
+    getJwks() {
+        // Lazy singleton: jose fetches once, caches, and handles key rotation.
+        this.jwks ??= (0, jose_1.createRemoteJWKSet)(new URL(`${this.baseUrl}${this.jwksPath}`), {
+            cooldownDuration: 30_000,
+            cacheMaxAge: 10 * 60_000,
+        });
+        return this.jwks;
+    }
+    /** Optional warm-up: call at boot so the first verification pays no JWKS latency. */
+    async preloadJwks() {
+        try {
+            // Deliberately look up a key that won't exist — jose fetches and
+            // caches the whole key set on the first lookup, which is the warm-up.
+            await this.getJwks()({ alg: 'RS256', kid: '__preload__' }, {});
+        }
+        catch {
+            /* expected: no matching key — the fetch is the point */
+        }
+    }
+    readCookieHeader(input) {
+        if (typeof input === 'string')
+            return input;
+        if (typeof input.get === 'function')
+            return input.get('cookie') || '';
+        return input.cookie || '';
+    }
+    readSessionCookie(input) {
+        const raw = this.readCookieHeader(input);
+        if (!raw)
+            return null;
+        // Anchored to a real cookie-name boundary (same pattern proxy() uses),
+        // so a cookie named "notjwt" or "xjwt" can never match.
+        const escaped = this.sessionCookieName.replace(/[.*+?^${}()|[\]\\]/g, '\\$&');
+        const match = raw.match(new RegExp(`(?:^|;\\s*)${escaped}=([^;]+)`));
+        return match ? decodeURIComponent(match[1]) : null;
+    }
+    async verifySession(input) {
+        const token = this.readSessionCookie(input);
+        if (!token)
+            return { identity: null, reason: 'no_cookie' };
+        try {
+            const { payload } = await (0, jose_1.jwtVerify)(token, this.getJwks(), {
+                algorithms: ['RS256'], // pinned — blocks alg confusion
+                issuer: this.issuer,
+                ...(this.audience ? { audience: this.audience } : {}),
+            });
+            return { identity: toIdentity(payload) };
+        }
+        catch (error) {
+            if (error instanceof jose_1.errors.JWTExpired)
+                return { identity: null, reason: 'expired' };
+            if (error instanceof jose_1.errors.JWTClaimValidationFailed)
+                return { identity: null, reason: 'invalid_claims' };
+            // JOSE errors = the token itself is bad. Anything else (fetch failure
+            // while getting the JWKS) = we couldn't check — that is not a sign-out.
+            if (error instanceof jose_1.errors.JOSEError)
+                return { identity: null, reason: 'invalid_signature' };
+            return { identity: null, reason: 'jwks_unavailable' };
+        }
+    }
+    async getSession(input) {
+        return (await this.verifySession(input)).identity;
+    }
+    /**
+     * One-call silent refresh for non-Next servers: posts the refresh cookie
+     * to the gateway, verifies the rotated access token, and returns the new
+     * Set-Cookie strings so the caller can forward them on its response.
+     */
+    async refreshSession(input) {
+        const setCookies = await this.refreshTokens(input);
+        if (!setCookies)
+            return { identity: null, setCookies: null };
+        const rotated = setCookies
+            .find(c => c.startsWith(`${this.sessionCookieName}=`))
+            ?.split(';')[0]; // "jwt=<new value>" — a valid single-cookie header string
+        if (rotated) {
+            const { identity } = await this.verifySession(rotated);
+            if (identity)
+                return { identity, setCookies };
+        }
+        return { identity: null, setCookies };
+    }
+    async refreshTokens(input) {
+        // Single-flight: concurrent requests share one gateway refresh call
+        // (matters with rotating refresh tokens). Input widened from Headers
+        // to SessionInput — backwards compatible.
+        this.refreshInFlight ??= this.doRefresh(input).finally(() => {
+            this.refreshInFlight = null;
+        });
+        return this.refreshInFlight;
+    }
+    async doRefresh(input) {
         try {
             const response = await fetch(`${this.baseUrl}/auth/refresh-token`, {
                 method: 'POST',
                 headers: {
                     'X-API-Key': this.apiKey,
-                    'cookie': headers.get('cookie') || '',
+                    'cookie': this.readCookieHeader(input),
                 },
             });
             if (response.ok) {
                 const setCookies = response.headers.getSetCookie();
-                if (setCookies && setCookies.length > 0) {
+                if (setCookies && setCookies.length > 0)
                     return setCookies;
-                }
             }
             return null;
         }
-        catch (error) {
+        catch {
             return null;
         }
     }
+    // Exposed publicly so the Next.js layer can use it for getSession()
+    /**
+      async refreshTokens(headers: Headers): Promise<string[] | null> {
+        try {
+          const response = await fetch(`${this.baseUrl}/auth/refresh-token`, {
+            method: 'POST',
+            headers: {
+              'X-API-Key': this.apiKey,
+              'cookie': headers.get('cookie') || '',
+            },
+          });
+    
+          if (response.ok) {
+            const setCookies = response.headers.getSetCookie();
+            if (setCookies && setCookies.length > 0) {
+              return setCookies;
+            }
+          }
+          return null;
+        } catch (error) {
+          return null;
+        }
+      }
+    
+    */
     async proxy(path, init, incomingHeaders) {
         const url = `${this.baseUrl}${path}`;
         const headers = new Headers(init.headers);

package/dist/express/index.d.ts

@@ -0,0 +1,26 @@
+import { Router, type RequestHandler } from 'express';
+import { type CoreIAMConfig } from '../core';
+export interface CoreIamExpressOptions extends CoreIAMConfig {
+    /**
+     * Public URL of the app as the user's browser reaches it (e.g. http://localhost:5173
+     * in Vite dev, or your production domain). /api/auth must route from this origin
+     * to this Express server (reverse proxy in prod, Vite dev proxy in dev).
+     */
+    appUrl: string;
+    /** Mount path of the auth router. Default: '/api/auth'. */
+    authPath?: string;
+    /** Redirect target after successful OAuth login. Default: '/'. */
+    successUrl?: string;
+    /** Redirect target when OAuth initiation fails. Default: '/login'. */
+    signInUrl?: string;
+}
+export declare function coreIamExpress(options: CoreIamExpressOptions): Router;
+/**
+ * Route guard: verifies the session cookie locally and puts the identity on
+ * res.locals.identity. 401s API requests; redirects page requests.
+ */
+export declare function requireAuth(config?: CoreIAMConfig & {
+    signInUrl?: string;
+}): RequestHandler;
+export { CoreIAM } from '../core';
+export type { CoreIAMIdentity } from '../core';

package/dist/express/index.js

@@ -0,0 +1,171 @@
+"use strict";
+Object.defineProperty(exports, "__esModule", { value: true });
+exports.CoreIAM = void 0;
+exports.coreIamExpress = coreIamExpress;
+exports.requireAuth = requireAuth;
+// src/express/index.ts
+const express_1 = require("express");
+const core_1 = require("../core");
+const CSRF_PROTECTED = new Set([
+    '/auth/login', '/auth/register', '/auth/profile',
+    '/auth/mfa/setup', '/auth/mfa/verify', '/auth/mfa/disable',
+    '/auth/request-otp', '/auth/verify-otp',
+]);
+/** Express 4 does not catch async rejections — route them to next(err). */
+const wrap = (fn) => (req, res, next) => { fn(req, res, next).catch(next); };
+function sessionCookie(name, value, maxAgeSec, isProd) {
+    return `${name}=${encodeURIComponent(value)}; Path=/; HttpOnly; SameSite=Lax; Max-Age=${maxAgeSec}${isProd ? '; Secure' : ''}`;
+}
+function coreIamExpress(options) {
+    const appUrl = options.appUrl.replace(/\/+$/, '');
+    const authPath = (options.authPath ?? '/api/auth').replace(/\/+$/, '');
+    const successUrl = options.successUrl ?? '/';
+    const signInUrl = options.signInUrl ?? '/login';
+    const gatewayUrl = (options.baseUrl || process.env.COREIAM_API_URL || '').replace(/\/+$/, '');
+    const isProd = process.env.NODE_ENV === 'production';
+    const iam = new core_1.CoreIAM(options);
+    const router = (0, express_1.Router)();
+    // Body parsing for JSON + the urlencoded link-confirm post.
+    // Skips automatically if the host app already parsed the body.
+    router.use((0, express_1.json)());
+    router.use((0, express_1.urlencoded)({ extended: false }));
+    const toHeaders = (req) => new Headers(req.headers);
+    // ---------------------------------------------------------------
+    // GET {authPath}/session — matches the React provider's default
+    // sessionUrl ('/api/auth/session'). Local JWKS verify + silent refresh.
+    // ---------------------------------------------------------------
+    router.get('/session', wrap(async (req, res) => {
+        const result = await iam.verifySession(req.headers);
+        if (result.identity)
+            return void res.json(result.identity);
+        if (result.reason === 'expired') {
+            const { identity, setCookies } = await iam.refreshSession(req.headers);
+            if (identity) {
+                setCookies?.forEach(c => res.append('Set-Cookie', c));
+                return void res.json(identity);
+            }
+        }
+        res.status(401).json({ error: 'unauthenticated' });
+    }));
+    // ---------------------------------------------------------------
+    // OAuth initiate: GET {authPath}/oauth/:provider
+    // ---------------------------------------------------------------
+    router.get('/oauth/:provider', wrap(async (req, res, next) => {
+        const provider = req.params.provider;
+        if (provider === 'link')
+            return next(); // not an initiate route
+        const redirectUri = `${appUrl}${authPath}/callback/${provider}`;
+        const target = `/auth/oauth/initiate/${provider}?redirectUri=${encodeURIComponent(redirectUri)}&scopes=email,profile`;
+        const response = await iam.proxy(target, { method: 'GET' }, toHeaders(req));
+        const data = await response.json().catch(() => ({}));
+        if (data.url)
+            return void res.redirect(302, data.url);
+        res.redirect(302, signInUrl);
+    }));
+    // ---------------------------------------------------------------
+    // OAuth callback: GET {authPath}/callback/:provider
+    // ---------------------------------------------------------------
+    router.get('/callback/:provider', wrap(async (req, res) => {
+        const provider = req.params.provider;
+        const code = req.query.code;
+        const state = req.query.state;
+        const redirectUri = `${appUrl}${authPath}/callback/${provider}`;
+        const target = `/auth/oauth/callback/${provider}?code=${code}&state=${state}&redirectUri=${encodeURIComponent(redirectUri)}`;
+        const response = await iam.proxy(target, { method: 'GET' }, toHeaders(req));
+        const data = await response.json().catch(() => ({}));
+        // Account linking: redirect to CoreIAM's hosted confirmation page
+        if (data.action === 'link_candidate') {
+            const redirect = new URL(`${gatewayUrl}/auth/hosted/confirm-link`);
+            redirect.searchParams.set('token', data.tempToken);
+            redirect.searchParams.set('provider', data.provider);
+            redirect.searchParams.set('email', data.email || '');
+            redirect.searchParams.set('appOrigin', appUrl);
+            return void res.redirect(303, redirect.toString());
+        }
+        // Normal OAuth login: forward the gateway's session cookies, then redirect.
+        // (Set-Cookie must be appended BEFORE res.redirect — Express sends immediately.)
+        response.headers.getSetCookie().forEach(c => res.append('Set-Cookie', c));
+        res.redirect(302, successUrl);
+    }));
+    // ---------------------------------------------------------------
+    // Account-link confirmation: POST {authPath}/oauth/link/confirm
+    // (the hosted page posts tempToken + password back here)
+    // ---------------------------------------------------------------
+    router.post('/oauth/link/confirm', wrap(async (req, res) => {
+        const formData = (req.body ?? {});
+        const response = await iam.proxy('/auth/oauth/link/confirm', {
+            method: 'POST',
+            body: JSON.stringify({ tempToken: formData.tempToken, password: formData.password }),
+            headers: { 'Content-Type': 'application/json' },
+        }, toHeaders(req));
+        const data = await response.json().catch(() => ({}));
+        if (response.ok && data.success) {
+            const finalUrl = new URL(data.redirectUri || '/', appUrl).toString();
+            // Same cookie attributes the Next.js handler uses.
+            if (data.accessToken)
+                res.append('Set-Cookie', sessionCookie('jwt', data.accessToken, 24 * 60 * 60, isProd));
+            if (data.clientRefreshToken)
+                res.append('Set-Cookie', sessionCookie('refreshToken', data.clientRefreshToken, 7 * 24 * 60 * 60, isProd));
+            // 200 + JS redirect breaks the cross-site redirect chain so the browser
+            // sends the freshly-set (SameSite=Lax) cookies on the next hop.
+            return void res.status(200).type('html').send(`<!DOCTYPE html>
+<html>
+  <head><title>Linking Successful</title></head>
+  <body>
+    <p>Account linked successfully! Redirecting...</p>
+    <script>window.location.href = ${JSON.stringify(finalUrl)};</script>
+  </body>
+</html>`);
+        }
+        // Failed (wrong password) -> back to the hosted page with the error
+        const errorRedirect = new URL(`${gatewayUrl}/auth/hosted/confirm-link`);
+        errorRedirect.searchParams.set('token', formData.tempToken);
+        errorRedirect.searchParams.set('provider', data.provider || 'google');
+        errorRedirect.searchParams.set('email', data.email || '');
+        errorRedirect.searchParams.set('appOrigin', appUrl);
+        errorRedirect.searchParams.set('error', data.message || 'Invalid password. Link failed.');
+        res.redirect(303, errorRedirect.toString());
+    }));
+    // ---------------------------------------------------------------
+    // Everything else: generic JSON passthrough (login, register, logout,
+    // csrf-token, MFA, OTP, profile...). CSRF-protected endpoints run the
+    // handshake first, same as the Next.js server actions.
+    // ---------------------------------------------------------------
+    router.use(wrap(async (req, res) => {
+        const target = `/auth${req.path}`; // /login -> /auth/login
+        const init = { method: req.method };
+        if (req.method !== 'GET' && req.method !== 'HEAD') {
+            init.body = req.body ? JSON.stringify(req.body) : undefined;
+            init.headers = { 'Content-Type': 'application/json' };
+        }
+        const response = CSRF_PROTECTED.has(target)
+            ? await iam.proxyWithCsrfProtection(target, init, toHeaders(req))
+            : await iam.proxy(target, init, toHeaders(req));
+        const data = await response.json().catch(() => ({}));
+        res.status(response.status);
+        response.headers.getSetCookie().forEach(c => res.append('Set-Cookie', c));
+        res.json(data);
+    }));
+    return router;
+}
+/**
+ * Route guard: verifies the session cookie locally and puts the identity on
+ * res.locals.identity. 401s API requests; redirects page requests.
+ */
+function requireAuth(config) {
+    const iam = new core_1.CoreIAM(config);
+    const { signInUrl = '/login' } = config ?? {};
+    return wrap(async (req, res, next) => {
+        const identity = await iam.getSession(req.headers);
+        if (!identity) {
+            if (req.path.startsWith('/api') || req.accepts(['html', 'json']) === 'json') {
+                return void res.status(401).json({ error: 'unauthenticated' });
+            }
+            return void res.redirect(302, signInUrl);
+        }
+        res.locals.identity = identity;
+        next();
+    });
+}
+var core_2 = require("../core");
+Object.defineProperty(exports, "CoreIAM", { enumerable: true, get: function () { return core_2.CoreIAM; } });

package/dist/nextjs/actions.js

@@ -189,16 +189,59 @@ async function syncCookiesToNext(response) {
 // cookies. If middleware already refreshed upstream, this succeeds; if
 // middleware's refresh also failed, returning null here is correct, not a
 // bug to work around.
+// export async function getSession(): Promise<CoreIAMIdentity | null> {
+//   console.log(`[DEBUG_TRACE] getSession() real fetch @ ${new Date().toISOString()}`);
+//   const reqHeaders = await headers();
+//   const response = await getIam().proxy('/auth/profile', { method: 'GET' }, reqHeaders);
+//   if (!response.ok) return null;
+//   const coreIamIdentity = await response.json();
+//   if (!coreIamIdentity?.sub) return null;
+//   return coreIamIdentity as CoreIAMIdentity; 
+// }
 async function getSession() {
-    console.log(`[DEBUG_TRACE] getSession() real fetch @ ${new Date().toISOString()}`);
     const reqHeaders = await (0, headers_1.headers)();
-    const response = await getIam().proxy('/auth/profile', { method: 'GET' }, reqHeaders);
-    if (!response.ok)
+    // The middleware verified the JWT and attached the payload to the request headers
+    const identityHeader = reqHeaders.get('x-coreiam-identity');
+    if (identityHeader) {
+        try {
+            return JSON.parse(identityHeader);
+        }
+        catch {
+            return null;
+        }
+    }
+    // Fallback: If middleware didn't run (e.g. API route), we can still read the JWT
+    // But we DO NOT verify it here, because verification requires the JWKS fetch which 
+    // is too slow for Server Components. We just decode it to get the identity.
+    // The middleware is the true security gate.
+    const authHeader = reqHeaders.get('Authorization') || reqHeaders.get('authorization');
+    const cookieHeader = reqHeaders.get('cookie');
+    let token = undefined;
+    if (authHeader?.startsWith('Bearer ')) {
+        token = authHeader.substring(7);
+    }
+    else if (cookieHeader) {
+        const match = cookieHeader.match(/jwt=([^;]+)/);
+        if (match)
+            token = match[1];
+    }
+    if (!token)
         return null;
-    const coreIamIdentity = await response.json();
-    if (!coreIamIdentity?.sub)
+    try {
+        // Just decode the payload without verifying (middleware already verified it)
+        const payloadB64 = token.split('.')[1];
+        const payloadStr = Buffer.from(payloadB64, 'base64').toString('utf8');
+        const payload = JSON.parse(payloadStr);
+        return {
+            sub: payload.sub,
+            email: payload.email,
+            tenantId: payload.tenantId,
+            roles: payload.roles || []
+        };
+    }
+    catch {
         return null;
-    return coreIamIdentity;
+    }
 }
 async function loginActionSdk(identifier, password) {
     const reqHeaders = await (0, headers_1.headers)();

package/dist/nextjs/index.d.ts

@@ -1,10 +1,17 @@
-export { CoreIAMProvider, useAuth } from './provider';
-export { loginActionSdk, registerActionSdk, logoutActionSdk, getSession } from './actions';
-export { coreIamMiddleware } from './middleware';
 import { NextRequest, NextResponse } from 'next/server';
-import { CoreIAM } from '../core';
+import { CoreIAM, CoreIAMIdentity } from '../core';
+export { CoreIAMProvider, useAuth } from './provider';
+export { coreIamMiddleware, coreIamAuth } from './middleware';
+export { getSession, loginActionSdk, registerActionSdk, logoutActionSdk, updateProfileActionSdk, setupMfaActionSdk, verifyMfaActionSdk, disableMfaActionSdk, requestOtpActionSdk, verifyOtpActionSdk } from './actions';
 export declare class NextHandlers {
     private iam;
     constructor(iam?: CoreIAM);
     handleProxy(req: NextRequest, internalPath: string): Promise<NextResponse<any>>;
 }
+export declare class OAuthHandlers {
+    private iam;
+    constructor(iam?: CoreIAM);
+    handleInitiate(req: NextRequest, provider: string): Promise<NextResponse<unknown>>;
+    handleCallback(req: NextRequest, provider: string): Promise<NextResponse<unknown>>;
+}
+export declare function auth(request: NextRequest): Promise<CoreIAMIdentity | null>;