@coreiam/auth 1.0.2 → 1.0.4

package/dist/nextjs/actions.js

@@ -9,8 +9,6 @@ exports.logoutActionSdk = logoutActionSdk;
 const headers_1 = require("next/headers");
 const core_1 = require("../core");
 const iam = new core_1.CoreIAM();
-// GLOBAL LOCK: Prevents concurrent refresh requests
-let refreshLock = null;
 async function syncCookiesToNext(response) {
     const cookieStore = await (0, headers_1.cookies)();
     const setCookies = response.headers.getSetCookie();
@@ -31,21 +29,17 @@ async function syncCookiesToNext(response) {
                 cookieOptions.path = attrValue || '/';
             if (lowerName === 'max-age') {
                 const maxAge = parseInt(attrValue, 10);
-                if (maxAge <= 0) {
+                if (maxAge <= 0)
                     isDeleting = true;
-                }
-                else {
+                else
                     cookieOptions.maxAge = maxAge;
-                }
             }
             if (lowerName === 'expires') {
                 const expiryDate = new Date(attrValue);
-                if (expiryDate.getTime() < Date.now()) {
+                if (expiryDate.getTime() < Date.now())
                     isDeleting = true;
-                }
-                else {
+                else
                     cookieOptions.expires = expiryDate;
-                }
             }
             if (lowerName === 'samesite')
                 cookieOptions.sameSite = attrValue?.toLowerCase() || 'lax';
@@ -62,38 +56,7 @@ async function syncCookiesToNext(response) {
 }
 async function getSession() {
     const reqHeaders = await (0, headers_1.headers)();
-    let response = await iam.proxy('/auth/profile', { method: 'GET' }, reqHeaders);
-    if (response.status === 401) {
-        // 1. Use the lock! If another component is already refreshing, wait for it.
-        if (!refreshLock) {
-            refreshLock = iam.proxy('/auth/refresh-token', { method: 'POST' }, reqHeaders)
-                .then(res => res.ok ? res.headers.getSetCookie() : null)
-                .finally(() => { refreshLock = null; }); // Clear lock when done
-        }
-        const setCookies = await refreshLock;
-        if (setCookies && setCookies.length > 0) {
-            // 2. Sync the new cookies to the browser
-            const fakeRes = new Response(null, { headers: { 'set-cookie': setCookies.join(', ') } });
-            await syncCookiesToNext(fakeRes);
-            // 3. Build new headers with the refreshed cookies and retry
-            const cookieStore = await (0, headers_1.cookies)();
-            const newJwt = cookieStore.get('jwt')?.value;
-            const newRefresh = cookieStore.get('refreshToken')?.value;
-            const retryHeaders = new Headers(reqHeaders);
-            if (newJwt && newRefresh) {
-                retryHeaders.set('cookie', `jwt=${newJwt}; refreshToken=${newRefresh}`);
-                retryHeaders.set('Authorization', `Bearer ${newJwt}`);
-            }
-            response = await iam.proxy('/auth/profile', { method: 'GET' }, retryHeaders);
-        }
-        else {
-            // 4. CRITICAL: If refresh failed, CLEAR THE COOKIES to break the infinite loop!
-            const cookieStore = await (0, headers_1.cookies)();
-            cookieStore.delete('jwt');
-            cookieStore.delete('refreshToken');
-            return null;
-        }
-    }
+    const response = await iam.proxy('/auth/profile', { method: 'GET' }, reqHeaders);
     if (!response.ok)
         return null;
     const coreIamIdentity = await response.json();

package/dist/nextjs/index.d.ts

@@ -1,5 +1,6 @@
 export { CoreIAMProvider, useAuth } from './provider';
 export { loginActionSdk, registerActionSdk, logoutActionSdk, getSession } from './actions';
+export { coreIamMiddleware } from './middleware';
 import { NextRequest, NextResponse } from 'next/server';
 import { CoreIAM } from '../core';
 export declare class NextHandlers {

package/dist/nextjs/index.js

@@ -1,6 +1,6 @@
 "use strict";
 Object.defineProperty(exports, "__esModule", { value: true });
-exports.NextHandlers = exports.getSession = exports.logoutActionSdk = exports.registerActionSdk = exports.loginActionSdk = exports.useAuth = exports.CoreIAMProvider = void 0;
+exports.NextHandlers = exports.coreIamMiddleware = exports.getSession = exports.logoutActionSdk = exports.registerActionSdk = exports.loginActionSdk = exports.useAuth = exports.CoreIAMProvider = void 0;
 // src/nextjs/index.ts
 var provider_1 = require("./provider");
 Object.defineProperty(exports, "CoreIAMProvider", { enumerable: true, get: function () { return provider_1.CoreIAMProvider; } });
@@ -10,6 +10,8 @@ Object.defineProperty(exports, "loginActionSdk", { enumerable: true, get: functi
 Object.defineProperty(exports, "registerActionSdk", { enumerable: true, get: function () { return actions_1.registerActionSdk; } });
 Object.defineProperty(exports, "logoutActionSdk", { enumerable: true, get: function () { return actions_1.logoutActionSdk; } });
 Object.defineProperty(exports, "getSession", { enumerable: true, get: function () { return actions_1.getSession; } });
+var middleware_1 = require("./middleware");
+Object.defineProperty(exports, "coreIamMiddleware", { enumerable: true, get: function () { return middleware_1.coreIamMiddleware; } });
 const server_1 = require("next/server");
 class NextHandlers {
     iam;

package/dist/nextjs/middleware.d.ts

@@ -0,0 +1,2 @@
+import { NextRequest, NextResponse } from 'next/server';
+export declare function coreIamMiddleware(): (request: NextRequest) => Promise<NextResponse<unknown>>;

package/dist/nextjs/middleware.js

@@ -0,0 +1,94 @@
+"use strict";
+Object.defineProperty(exports, "__esModule", { value: true });
+exports.coreIamMiddleware = coreIamMiddleware;
+// src/nextjs/middleware.ts
+const server_1 = require("next/server");
+const jwt_decode_1 = require("jwt-decode");
+const DEFAULT_GATEWAY_URL = "https://api.e-qalam.com";
+function coreIamMiddleware() {
+    return async function middleware(request) {
+        const { nextUrl } = request;
+        const pathname = nextUrl.pathname;
+        const jwtCookie = request.cookies.get("jwt");
+        const refreshTokenCookie = request.cookies.get("refreshToken");
+        let isLoggedIn = false;
+        let needsRefresh = false;
+        if (jwtCookie) {
+            try {
+                const decoded = (0, jwt_decode_1.jwtDecode)(jwtCookie.value);
+                if (decoded.exp && decoded.exp * 1000 > Date.now()) {
+                    isLoggedIn = true;
+                }
+                else {
+                    if (refreshTokenCookie)
+                        needsRefresh = true;
+                }
+            }
+            catch {
+                if (refreshTokenCookie)
+                    needsRefresh = true;
+            }
+        }
+        else if (refreshTokenCookie) {
+            needsRefresh = true;
+        }
+        // Allow API routes to pass through (we handle their 401s normally)
+        if (pathname.startsWith('/api')) {
+            return server_1.NextResponse.next();
+        }
+        // 1. ATTEMPT SILENT REFRESH
+        if (needsRefresh) {
+            try {
+                const refreshRes = await fetch(`${DEFAULT_GATEWAY_URL}/auth/refresh-token`, {
+                    method: 'POST',
+                    headers: {
+                        'X-API-Key': process.env.COREIAM_API_KEY,
+                        'cookie': `refreshToken=${refreshTokenCookie?.value || ''}; jwt=${jwtCookie?.value || ''}`,
+                    },
+                });
+                if (refreshRes.ok) {
+                    const setCookies = refreshRes.headers.getSetCookie();
+                    if (setCookies && setCookies.length > 0) {
+                        let newJwt = '';
+                        let newRefreshToken = '';
+                        setCookies.forEach(cookie => {
+                            if (cookie.startsWith('jwt='))
+                                newJwt = cookie.split(';')[0].split('=')[1];
+                            if (cookie.startsWith('refreshToken='))
+                                newRefreshToken = cookie.split(';')[0].split('=')[1];
+                        });
+                        // CRITICAL: Rewrite request headers so Server Components see the new JWT!
+                        const requestHeaders = new Headers(request.headers);
+                        requestHeaders.set('cookie', `jwt=${newJwt}; refreshToken=${newRefreshToken}`);
+                        requestHeaders.set('Authorization', `Bearer ${newJwt}`);
+                        const response = server_1.NextResponse.next({
+                            request: { headers: requestHeaders },
+                        });
+                        // Set the new cookies on the browser
+                        setCookies.forEach(cookie => {
+                            response.headers.append('set-cookie', cookie);
+                        });
+                        return response; // Exit early, token is fresh!
+                    }
+                }
+            }
+            catch (error) {
+                // Refresh failed, fall through to clear cookies
+            }
+            // 2. IF REFRESH FAILED, CLEAR COOKIES TO PREVENT INFINITE LOOP
+            const res = server_1.NextResponse.redirect(new URL('/auth/login', nextUrl));
+            res.cookies.delete('jwt');
+            res.cookies.delete('refreshToken');
+            return res;
+        }
+        // 3. STANDARD ROUTE PROTECTION
+        const isAuthRoute = pathname.startsWith('/auth/login') || pathname.startsWith('/auth/register');
+        if (isAuthRoute && isLoggedIn) {
+            return server_1.NextResponse.redirect(new URL('/', nextUrl));
+        }
+        if (!isLoggedIn && !isAuthRoute) {
+            return server_1.NextResponse.redirect(new URL('/auth/login', nextUrl));
+        }
+        return server_1.NextResponse.next();
+    };
+}

package/package.json

@@ -1,6 +1,6 @@
 {
   "name": "@coreiam/auth",
-  "version": "1.0.2",
+  "version": "1.0.4",
   "main": "./dist/core/index.js",
   "types": "./dist/core/index.d.ts",
   "exports": {
@@ -20,26 +20,43 @@
       "require": "./dist/react/index.js"
     }
   },
-  "files": ["dist"],
+  "files": [
+    "dist"
+  ],
   "scripts": {
     "build": "tsc"
   },
-  "keywords": ["coreiam", "auth", "saas", "multi-tenant", "nextjs"],
+  "keywords": [
+    "coreiam",
+    "auth",
+    "saas",
+    "multi-tenant",
+    "nextjs"
+  ],
   "author": "coreIAM",
   "license": "MIT",
-  "publishConfig": { "access": "public" },
+  "publishConfig": {
+    "access": "public"
+  },
   "peerDependencies": {
     "next": ">=14",
     "react": ">=18"
   },
   "peerDependenciesMeta": {
-    "next": { "optional": true },
-    "react": { "optional": true }
+    "next": {
+      "optional": true
+    },
+    "react": {
+      "optional": true
+    }
   },
   "devDependencies": {
     "@types/react": "^19.2.7",
     "next": "^16.2.11",
     "react": "^19.2.7",
     "typescript": "^5.0.0"
+  },
+  "dependencies": {
+    "jwt-decode": "^4.0.0"
   }
 }