@coreiam/auth 1.0.15 → 1.0.391

package/dist/nextjs/provider.js

@@ -1,182 +1,49 @@
 "use strict";
 // // src/nextjs/provider.tsx
 // 'use client';
-// import React, { createContext, useContext, useEffect, useState, useCallback } from 'react';
-// import { useRouter } from 'next/navigation';
+// import React, { createContext, useContext, useEffect, useState } from 'react';
+// import { getSession } from './actions';
 // import type { CoreIAMIdentity } from '../core';
-// export interface CoreIAMRedirects {
-//   afterLogin?: string;
-//   afterLogout?: string;
-// }
-// interface LoginResult {
-//   success?: boolean;
-//   error?: string;
-//   twoFactor?: boolean;
-// }
 // interface AuthContextType {
 //   identity: CoreIAMIdentity | null;
 //   isLoading: boolean;
 //   isAuthenticated: boolean;
-//   login: (values: { email: string; password: string }, callbackUrl?: string) => Promise<LoginResult>;
-//   logout: () => Promise<void>;
-//   register: (userData: Record<string, any>) => Promise<LoginResult>;
 //   refetchIdentity: () => Promise<void>;
 // }
 // const AuthContext = createContext<AuthContextType>({
 //   identity: null,
 //   isLoading: true,
 //   isAuthenticated: false,
-//   login: async () => ({ error: 'CoreIAMProvider is not mounted' }),
-//   logout: async () => {},
-//   register: async () => ({ error: 'CoreIAMProvider is not mounted' }),
 //   refetchIdentity: async () => {},
 // });
-// export function CoreIAMProvider({
-//   children,
-//   initialIdentity,
-//   redirects = {},
-// }: {
-//   children: React.ReactNode;
+// export function CoreIAMProvider({ 
+//   children, 
+//   initialIdentity 
+// }: { 
+//   children: React.ReactNode; 
 //   initialIdentity?: CoreIAMIdentity | null;
-//   redirects?: CoreIAMRedirects;
 // }) {
 //   const [identity, setIdentity] = useState<CoreIAMIdentity | null>(initialIdentity ?? null);
 //   const [isLoading, setIsLoading] = useState(initialIdentity === undefined);
-//   const router = useRouter();
-//   const refetchIdentity = useCallback(async () => {
+//   const refetchIdentity = async () => {
 //     try {
-//       // Call the Next.js API route, which securely calls CoreIAM
-//       const res = await fetch('/api/auth/session', { credentials: 'include' });
-//       setIdentity(res.ok ? await res.json() : null);
+//       const result = await getSession();
+//       setIdentity(result);
 //     } catch {
 //       setIdentity(null);
 //     } finally {
 //       setIsLoading(false);
 //     }
-//   }, []);
+//   };
 //   useEffect(() => {
 //     if (initialIdentity === undefined) {
 //       refetchIdentity();
 //     } else {
 //       setIsLoading(false);
 //     }
-//     // eslint-disable-next-line react-hooks/exhaustive-deps
 //   }, []);
-//   // const login = async (values: { email: string; password: string }, callbackUrl?: string): Promise<LoginResult> => {
-//   //   setIsLoading(true);
-//   //   try {
-//   //     // Fetch CSRF token first
-//   //     const csrfRes = await fetch('/api/auth/csrf', { credentials: 'include' });
-//   //     if (!csrfRes.ok) return { error: 'Failed to get CSRF token' };
-//   //     const { csrfToken } = await csrfRes.json();
-//   //     // Call login API route
-//   //     const loginRes = await fetch('/api/auth/login', {
-//   //       method: 'POST',
-//   //       headers: {
-//   //         'Content-Type': 'application/json',
-//   //         'x-csrf-token': csrfToken,
-//   //       },
-//   //       credentials: 'include',
-//   //       body: JSON.stringify(values),
-//   //     });
-//   //     const data = await loginRes.json();
-//   //     if (!loginRes.ok) {
-//   //       return { error: data.message || data.error || 'Invalid credentials' };
-//   //     }
-//   //     if (data.twoFactor) {
-//   //       return { twoFactor: true };
-//   //     }
-//   //     await refetchIdentity();
-//   //     const target = callbackUrl || redirects.afterLogin;
-//   //     if (target) router.push(target);
-//   //     return { success: true };
-//   //   } catch {
-//   //     return { error: 'Something went wrong' };
-//   //   } finally {
-//   //     setIsLoading(false);
-//   //   }
-//   // };
-//   const login = async (values: { email: string; password: string }, callbackUrl?: string): Promise<LoginResult> => {
-//     setIsLoading(true);
-//     try {
-//       // Fetch CSRF token first
-//       const csrfRes = await fetch('/api/auth/csrf', { credentials: 'include' });
-//       if (!csrfRes.ok) return { error: 'Failed to get CSRF token' };
-//       const { csrfToken } = await csrfRes.json();
-//       // FIX: Map 'email' to 'identifier' for the CoreIAM backend
-//       const loginPayload = {
-//         identifier: values.email,
-//         password: values.password,
-//       };
-//       // Call login API route
-//       const loginRes = await fetch('/api/auth/login', {
-//         method: 'POST',
-//         headers: {
-//           'Content-Type': 'application/json',
-//           'x-csrf-token': csrfToken,
-//         },
-//         credentials: 'include',
-//         body: JSON.stringify(loginPayload), // Send the mapped payload
-//       });
-//       const data = await loginRes.json();
-//       if (!loginRes.ok) {
-//         return { error: data.message || data.error || 'Invalid credentials' };
-//       }
-//       if (data.twoFactor) {
-//         return { twoFactor: true };
-//       }
-//       await refetchIdentity();
-//       const target = callbackUrl || redirects.afterLogin;
-//       if (target) router.push(target);
-//       return { success: true };
-//     } catch {
-//       return { error: 'Something went wrong' };
-//     } finally {
-//       setIsLoading(false);
-//     }
-//   };
-//   const logout = async () => {
-//     try {
-//       await fetch('/api/auth/logout', {
-//         method: 'POST',
-//         credentials: 'include',
-//       });
-//     } finally {
-//       setIdentity(null);
-//       if (redirects.afterLogout) router.push(redirects.afterLogout);
-//     }
-//   };
-//   const register = async (userData: Record<string, any>): Promise<LoginResult> => {
-//     setIsLoading(true);
-//     try {
-//       const csrfRes = await fetch('/api/auth/csrf', { credentials: 'include' });
-//       if (!csrfRes.ok) return { error: 'Failed to get CSRF token' };
-//       const { csrfToken } = await csrfRes.json();
-//       const registerRes = await fetch('/api/auth/register', {
-//         method: 'POST',
-//         headers: {
-//           'Content-Type': 'application/json',
-//           'x-csrf-token': csrfToken,
-//         },
-//         credentials: 'include',
-//         body: JSON.stringify(userData),
-//       });
-//       if (!registerRes.ok) {
-//         const error = await registerRes.json();
-//         return { error: error.message || error.error || 'Registration failed' };
-//       }
-//       // Auto-login after registration
-//       return await login({ email: userData.email, password: userData.password });
-//     } catch {
-//       return { error: 'Something went wrong' };
-//     } finally {
-//       setIsLoading(false);
-//     }
-//   };
 //   return (
-//     <AuthContext.Provider
-//       value={{ identity, isLoading, isAuthenticated: !!identity, login, logout, register, refetchIdentity }}
-//     >
+//     <AuthContext.Provider value={{ identity, isLoading, isAuthenticated: !!identity, refetchIdentity }}>
 //       {children}
 //     </AuthContext.Provider>
 //   );
@@ -184,6 +51,7 @@
 // export function useAuth() {
 //   return useContext(AuthContext);
 // }
+// src/nextjs/provider.tsx
 'use client';
 Object.defineProperty(exports, "__esModule", { value: true });
 exports.CoreIAMProvider = CoreIAMProvider;
@@ -196,20 +64,17 @@ const AuthContext = (0, react_1.createContext)({
     identity: null,
     isLoading: true,
     isAuthenticated: false,
-    login: async () => ({ error: 'CoreIAMProvider is not mounted' }),
+    login: async () => ({ error: 'Not mounted' }),
     logout: async () => { },
-    register: async () => ({ error: 'CoreIAMProvider is not mounted' }),
+    register: async () => ({ error: 'Not mounted' }),
+    verifyMfa: async () => ({ error: 'Not mounted' }),
     refetchIdentity: async () => { },
 });
-function CoreIAMProvider({ children, initialIdentity, redirects = {}, }) {
+function CoreIAMProvider({ children, initialIdentity }) {
     const [identity, setIdentity] = (0, react_1.useState)(initialIdentity ?? null);
     const [isLoading, setIsLoading] = (0, react_1.useState)(initialIdentity === undefined);
     const router = (0, navigation_1.useRouter)();
     const refetchIdentity = async () => {
-        // DEBUG_TRACE: browser console — tags who called this (mount effect vs.
-        // an explicit login/logout/register call). Temporary, remove once
-        // settled.
-        console.log(`[DEBUG_TRACE][CoreIAMProvider] refetchIdentity() called @ ${new Date().toISOString()}`);
         try {
             const result = await (0, actions_1.getSession)();
             setIdentity(result);
@@ -222,37 +87,71 @@ function CoreIAMProvider({ children, initialIdentity, redirects = {}, }) {
         }
     };
     (0, react_1.useEffect)(() => {
-        // FIX: was `initialIdentity === null`, which can't tell "SSR ran and
-        // confirmed you're logged out" (a correct, final null) apart from "no
-        // SSR value was ever provided" (a real undefined). Since layout.tsx
-        // always calls getSession() and passes its result — even when that
-        // result legitimately is null — every logged-out page view was
-        // treated as "no SSR value, fetch again," firing a second, wholly
-        // redundant /auth/profile call for something SSR had already
-        // determined. undefined (the prop genuinely omitted) is the only case
-        // that should trigger this fallback fetch.
-        console.log(`[DEBUG_TRACE][CoreIAMProvider] mount effect ran, initialIdentity=${initialIdentity === undefined ? 'undefined' : JSON.stringify(initialIdentity)} @ ${new Date().toISOString()}`);
         if (initialIdentity === undefined) {
             refetchIdentity();
         }
         else {
             setIsLoading(false);
         }
-        // Intentionally only on mount — initialIdentity is a one-time SSR seed,
-        // not something we want to re-run this effect for if it changes identity.
-        // eslint-disable-next-line react-hooks/exhaustive-deps
     }, []);
+    const getCsrfToken = async () => {
+        const res = await fetch('/api/auth/csrf-token', {
+            method: 'POST',
+            credentials: 'include'
+        });
+        if (!res.ok)
+            throw new Error('Failed to get CSRF token');
+        const { csrfToken } = await res.json();
+        return csrfToken;
+    };
+    const verifyMfa = async (tempToken, code) => {
+        setIsLoading(true);
+        try {
+            const res = await fetch('/api/auth/mfa/login', {
+                method: 'POST',
+                headers: { 'Content-Type': 'application/json' },
+                credentials: 'include',
+                body: JSON.stringify({ tempToken, code }),
+            });
+            const data = await res.json();
+            if (!res.ok) {
+                return { error: data.message || 'Invalid 2FA code.' };
+            }
+            // Success! Hard refresh to let the server re-render with new cookies
+            window.location.href = '/';
+            return { success: true };
+        }
+        catch {
+            return { error: 'Something went wrong' };
+        }
+        finally {
+            setIsLoading(false);
+        }
+    };
     const login = async (values, callbackUrl) => {
         setIsLoading(true);
         try {
-            const result = await (0, actions_1.loginActionSdk)(values.email, values.password);
-            if (!result.ok) {
-                return { error: result.data?.message || result.data?.error || 'Invalid credentials' };
+            // 1. Fetch CSRF token
+            const csrfToken = await getCsrfToken();
+            // 2. Call login API route
+            const res = await fetch('/api/auth/login', {
+                method: 'POST',
+                headers: {
+                    'Content-Type': 'application/json',
+                    'x-csrf-token': csrfToken,
+                },
+                credentials: 'include',
+                body: JSON.stringify({ identifier: values.email, password: values.password }),
+            });
+            const data = await res.json();
+            if (!res.ok)
+                return { error: data.message || 'Invalid credentials' };
+            if (data.twoFactorRequired) {
+                // Return the twoFactor flag and the tempToken to the form
+                return { twoFactor: true, tempToken: data.tempToken };
             }
-            await refetchIdentity();
-            const target = callbackUrl || redirects.afterLogin;
-            if (target)
-                router.push(target);
+            // Hard refresh to let server re-render with new cookies
+            window.location.href = callbackUrl || '/';
             return { success: true };
         }
         catch {
@@ -263,31 +162,52 @@ function CoreIAMProvider({ children, initialIdentity, redirects = {}, }) {
         }
     };
     const logout = async () => {
+        setIsLoading(true);
         try {
-            await (0, actions_1.logoutActionSdk)();
+            await fetch('/api/auth/logout', { method: 'POST', credentials: 'include' });
+            setIdentity(null);
+            window.location.href = '/auth/login';
         }
         finally {
-            setIdentity(null);
-            if (redirects.afterLogout)
-                router.push(redirects.afterLogout);
+            setIsLoading(false);
         }
     };
     const register = async (userData) => {
         setIsLoading(true);
         try {
-            const result = await (0, actions_1.registerActionSdk)(userData);
-            if (!result.ok) {
-                return { error: result.data?.message || result.data?.error || 'Registration failed' };
+            // 1. Fetch CSRF token
+            const csrfToken = await getCsrfToken();
+            // 2. Call register API route
+            const res = await fetch('/api/auth/register', {
+                method: 'POST',
+                headers: {
+                    'Content-Type': 'application/json',
+                    'x-csrf-token': csrfToken,
+                },
+                credentials: 'include',
+                body: JSON.stringify(userData),
+            });
+            const data = await res.json();
+            // 3. FIX: Check for the "OAuth Required" signal
+            if (!res.ok) {
+                if (data.code === 'OAUTH_ACCOUNT_EXISTS') {
+                    // Automatically redirect to the OAuth provider!
+                    window.location.href = `/api/auth/oauth/${data.provider}`;
+                    return { success: true };
+                }
+                return { error: data.message || 'Registration failed' };
             }
-            // Registration on the backend doesn't auto-issue a session — log in
-            // immediately after, same as the flow this replaces did.
-            return await login({ email: userData.email, password: userData.password });
+            // Auto-login after standard registration
+            return login({ email: userData.email, password: userData.password });
+        }
+        catch {
+            return { error: 'Something went wrong' };
         }
         finally {
             setIsLoading(false);
         }
     };
-    return ((0, jsx_runtime_1.jsx)(AuthContext.Provider, { value: { identity, isLoading, isAuthenticated: !!identity, login, logout, register, refetchIdentity }, children: children }));
+    return ((0, jsx_runtime_1.jsx)(AuthContext.Provider, { value: { identity, isLoading, isAuthenticated: !!identity, login, logout, register, verifyMfa, refetchIdentity }, children: children }));
 }
 function useAuth() {
     return (0, react_1.useContext)(AuthContext);

package/dist/react/provider.d.ts

@@ -1,6 +1,7 @@
 import React from 'react';
+import type { CoreIAMIdentity } from '../core';
 interface AuthContextType {
-    user: any | null;
+    user: CoreIAMIdentity | null;
     isLoading: boolean;
 }
 export declare function CoreIAMProvider({ children, sessionUrl }: {

package/dist/react/provider.js

@@ -1,25 +1,72 @@
 "use strict";
 // src/react/provider.tsx
+/**
+'use client';
+
+import React, { createContext, useContext, useEffect, useState } from 'react';
+
+interface AuthContextType {
+  user: any | null;
+  isLoading: boolean;
+}
+
+const AuthContext = createContext<AuthContextType>({
+  user: null,
+  isLoading: true,
+});
+
+export function CoreIAMProvider({
+  children,
+  sessionUrl = '/api/auth/session'
+}: {
+  children: React.ReactNode;
+  sessionUrl?: string;
+}) {
+  const [user, setUser] = useState<any | null>(null);
+  const [isLoading, setIsLoading] = useState(true);
+
+  useEffect(() => {
+    fetch(sessionUrl, { credentials: 'include' })
+      .then(res => res.ok ? res.json() : null)
+      .then(data => setUser(data))
+      .finally(() => setIsLoading(false));
+  }, [sessionUrl]);
+
+  return (
+    <AuthContext.Provider value={{ user, isLoading }}>
+      {children}
+    </AuthContext.Provider>
+  );
+}
+
+export function useAuth() {
+  return useContext(AuthContext);
+}
+
+*/
 'use client';
 Object.defineProperty(exports, "__esModule", { value: true });
 exports.CoreIAMProvider = CoreIAMProvider;
 exports.useAuth = useAuth;
 const jsx_runtime_1 = require("react/jsx-runtime");
 const react_1 = require("react");
-const AuthContext = (0, react_1.createContext)({
-    user: null,
-    isLoading: true,
-});
+const AuthContext = (0, react_1.createContext)({ user: null, isLoading: true });
 function CoreIAMProvider({ children, sessionUrl = '/api/auth/session' }) {
     const [user, setUser] = (0, react_1.useState)(null);
     const [isLoading, setIsLoading] = (0, react_1.useState)(true);
     (0, react_1.useEffect)(() => {
+        let cancelled = false;
         fetch(sessionUrl, { credentials: 'include' })
-            .then(res => res.ok ? res.json() : null)
-            .then(data => setUser(data))
-            .finally(() => setIsLoading(false));
+            .then(res => (res.ok ? res.json() : null))
+            .then(data => { if (!cancelled)
+            setUser(data); })
+            .catch(() => { if (!cancelled)
+            setUser(null); }) // NEW: network failure no longer leaves an unhandled rejection
+            .finally(() => { if (!cancelled)
+            setIsLoading(false); });
+        return () => { cancelled = true; }; // NEW: no state updates after unmount
     }, [sessionUrl]);
-    return ((0, jsx_runtime_1.jsx)(AuthContext.Provider, { value: { user, isLoading }, children: children }));
+    return (0, jsx_runtime_1.jsx)(AuthContext.Provider, { value: { user, isLoading }, children: children });
 }
 function useAuth() {
     return (0, react_1.useContext)(AuthContext);

package/dist/ui/buttons.d.ts

@@ -0,0 +1,45 @@
+import React from 'react';
+export interface SignInButtonProps extends React.ButtonHTMLAttributes<HTMLButtonElement> {
+    /** If true, renders child directly via Radix Slot instead of a <button> */
+    asChild?: boolean;
+    /** Destination route on click */
+    redirectTo?: string;
+}
+/**
+ * Renders a sign-in button or merges click behavior onto a child element (asChild).
+ */
+export declare function SignInButton({ asChild, redirectTo, onClick, children, ...props }: SignInButtonProps): import("react/jsx-runtime").JSX.Element;
+export interface SignUpButtonProps extends React.ButtonHTMLAttributes<HTMLButtonElement> {
+    asChild?: boolean;
+    redirectTo?: string;
+}
+/**
+ * Renders a sign-up button or merges click behavior onto a child element (asChild).
+ */
+export declare function SignUpButton({ asChild, redirectTo, onClick, children, ...props }: SignUpButtonProps): import("react/jsx-runtime").JSX.Element;
+export interface OAuthButtonProps extends React.ButtonHTMLAttributes<HTMLButtonElement> {
+    asChild?: boolean;
+    provider: 'google' | 'github' | 'microsoft' | 'apple' | string;
+}
+/**
+ * Renders an OAuth provider button or merges click behavior onto a child element (asChild).
+ */
+export declare function OAuthButton({ asChild, provider, onClick, children, ...props }: OAuthButtonProps): import("react/jsx-runtime").JSX.Element;
+export interface SignOutButtonProps extends React.ButtonHTMLAttributes<HTMLButtonElement> {
+    asChild?: boolean;
+    /** Destination route after signing out */
+    redirectTo?: string;
+}
+/**
+ * Renders a sign-out button or merges click behavior onto a child element (asChild).
+ */
+export declare function SignOutButton({ asChild, redirectTo, onClick, children, ...props }: SignOutButtonProps): import("react/jsx-runtime").JSX.Element;
+export interface UserButtonProps extends React.ButtonHTMLAttributes<HTMLButtonElement> {
+    asChild?: boolean;
+    /** Destination route for the user's account/profile page */
+    redirectTo?: string;
+}
+/**
+ * Renders a user profile button or merges click behavior onto a child element (asChild).
+ */
+export declare function UserButton({ asChild, redirectTo, onClick, children, ...props }: UserButtonProps): import("react/jsx-runtime").JSX.Element;

package/dist/ui/buttons.js

@@ -0,0 +1,76 @@
+"use strict";
+'use client';
+Object.defineProperty(exports, "__esModule", { value: true });
+exports.SignInButton = SignInButton;
+exports.SignUpButton = SignUpButton;
+exports.OAuthButton = OAuthButton;
+exports.SignOutButton = SignOutButton;
+exports.UserButton = UserButton;
+const jsx_runtime_1 = require("react/jsx-runtime");
+const react_slot_1 = require("@radix-ui/react-slot");
+/**
+ * Renders a sign-in button or merges click behavior onto a child element (asChild).
+ */
+function SignInButton({ asChild = false, redirectTo = '/auth/login', onClick, children, ...props }) {
+    const Component = asChild ? react_slot_1.Slot : 'button';
+    const handleClick = (e) => {
+        onClick?.(e); // Run original onClick prop if passed
+        if (!e.defaultPrevented) {
+            window.location.href = redirectTo;
+        }
+    };
+    return ((0, jsx_runtime_1.jsx)(Component, { ...props, onClick: handleClick, children: children ?? 'Sign In' }));
+}
+/**
+ * Renders a sign-up button or merges click behavior onto a child element (asChild).
+ */
+function SignUpButton({ asChild = false, redirectTo = '/auth/register', onClick, children, ...props }) {
+    const Component = asChild ? react_slot_1.Slot : 'button';
+    const handleClick = (e) => {
+        onClick?.(e);
+        if (!e.defaultPrevented) {
+            window.location.href = redirectTo;
+        }
+    };
+    return ((0, jsx_runtime_1.jsx)(Component, { ...props, onClick: handleClick, children: children ?? 'Sign Up' }));
+}
+/**
+ * Renders an OAuth provider button or merges click behavior onto a child element (asChild).
+ */
+function OAuthButton({ asChild = false, provider, onClick, children, ...props }) {
+    const Component = asChild ? react_slot_1.Slot : 'button';
+    const handleClick = (e) => {
+        onClick?.(e);
+        if (!e.defaultPrevented) {
+            window.location.href = `/api/auth/oauth/${provider}`;
+        }
+    };
+    return ((0, jsx_runtime_1.jsx)(Component, { ...props, onClick: handleClick, children: children ?? `Continue with ${provider}` }));
+}
+/**
+ * Renders a sign-out button or merges click behavior onto a child element (asChild).
+ */
+function SignOutButton({ asChild = false, redirectTo = '/', onClick, children, ...props }) {
+    const Component = asChild ? react_slot_1.Slot : 'button';
+    const handleClick = (e) => {
+        onClick?.(e);
+        if (!e.defaultPrevented) {
+            // Direct to your framework's sign-out endpoint, passing the redirect URL
+            window.location.href = `/api/auth/signout?callbackUrl=${encodeURIComponent(redirectTo)}`;
+        }
+    };
+    return ((0, jsx_runtime_1.jsx)(Component, { ...props, onClick: handleClick, children: children ?? 'Sign Out' }));
+}
+/**
+ * Renders a user profile button or merges click behavior onto a child element (asChild).
+ */
+function UserButton({ asChild = false, redirectTo = '/account', onClick, children, ...props }) {
+    const Component = asChild ? react_slot_1.Slot : 'button';
+    const handleClick = (e) => {
+        onClick?.(e);
+        if (!e.defaultPrevented) {
+            window.location.href = redirectTo;
+        }
+    };
+    return ((0, jsx_runtime_1.jsx)(Component, { ...props, onClick: handleClick, children: children ?? 'My Account' }));
+}

package/package.json

@@ -1,6 +1,6 @@
 {
   "name": "@coreiam/auth",
-  "version": "1.0.15",
+  "version": "1.0.391",
   "main": "./dist/core/index.js",
   "types": "./dist/core/index.d.ts",
   "exports": {
@@ -18,13 +18,19 @@
       "types": "./dist/react/index.d.ts",
       "import": "./dist/react/index.js",
       "require": "./dist/react/index.js"
+    },
+    "./express": {
+      "types": "./dist/express/index.d.ts",
+      "import": "./dist/express/index.js",
+      "require": "./dist/express/index.js"
     }
   },
   "files": [
     "dist"
   ],
   "scripts": {
-    "build": "tsc"
+    "build": "tsc",
+    "test": "vitest run"
   },
   "keywords": [
     "coreiam",
@@ -39,6 +45,7 @@
     "access": "public"
   },
   "peerDependencies": {
+    "express": "^4.0.0 || ^5.0.0",
     "next": ">=14",
     "react": ">=18"
   },
@@ -48,15 +55,25 @@
     },
     "react": {
       "optional": true
+    },
+    "express": {
+      "optional": true
     }
   },
   "devDependencies": {
+    "@types/express": "^5.0.6",
     "@types/react": "^19.2.7",
+    "@types/supertest": "^7.2.1",
+    "express": "^5.2.1",
     "next": "^16.2.11",
     "react": "^19.2.7",
-    "typescript": "^5.0.0"
+    "supertest": "^7.3.0",
+    "typescript": "^5.0.0",
+    "vitest": "^3.2.7"
   },
   "dependencies": {
+    "@radix-ui/react-slot": "^1.3.3",
+    "jose": "^6.2.7",
     "jwt-decode": "^4.0.0"
   }
-}
+}