@coreiam/auth 1.0.2 → 1.0.5

package/dist/core/index.js

@@ -2,15 +2,17 @@
 // src/core/index.ts
 Object.defineProperty(exports, "__esModule", { value: true });
 exports.CoreIAM = void 0;
-const DEFAULT_GATEWAY_URL = "https://api.e-qalam.com";
 class CoreIAM {
     apiKey = '';
     baseUrl = '';
     constructor(config) {
         this.apiKey = config?.apiKey || process.env.COREIAM_API_KEY || '';
-        this.baseUrl = config?.baseUrl || DEFAULT_GATEWAY_URL;
+        // FIX: Removed hardcoded URL. Throw if missing.
+        this.baseUrl = config?.baseUrl || process.env.COREIAM_API_URL || '';
         if (!this.apiKey)
-            throw new Error('CoreIAM: Missing API Key');
+            throw new Error('CoreIAM: Missing API Key (COREIAM_API_KEY)');
+        if (!this.baseUrl)
+            throw new Error('CoreIAM: Missing Gateway URL (COREIAM_API_URL)');
     }
     // Exposed publicly so the Next.js layer can use it for getSession()
     async refreshTokens(headers) {

package/dist/nextjs/actions.js

@@ -9,8 +9,6 @@ exports.logoutActionSdk = logoutActionSdk;
 const headers_1 = require("next/headers");
 const core_1 = require("../core");
 const iam = new core_1.CoreIAM();
-// GLOBAL LOCK: Prevents concurrent refresh requests
-let refreshLock = null;
 async function syncCookiesToNext(response) {
     const cookieStore = await (0, headers_1.cookies)();
     const setCookies = response.headers.getSetCookie();
@@ -31,21 +29,17 @@ async function syncCookiesToNext(response) {
                 cookieOptions.path = attrValue || '/';
             if (lowerName === 'max-age') {
                 const maxAge = parseInt(attrValue, 10);
-                if (maxAge <= 0) {
+                if (maxAge <= 0)
                     isDeleting = true;
-                }
-                else {
+                else
                     cookieOptions.maxAge = maxAge;
-                }
             }
             if (lowerName === 'expires') {
                 const expiryDate = new Date(attrValue);
-                if (expiryDate.getTime() < Date.now()) {
+                if (expiryDate.getTime() < Date.now())
                     isDeleting = true;
-                }
-                else {
+                else
                     cookieOptions.expires = expiryDate;
-                }
             }
             if (lowerName === 'samesite')
                 cookieOptions.sameSite = attrValue?.toLowerCase() || 'lax';
@@ -62,38 +56,7 @@ async function syncCookiesToNext(response) {
 }
 async function getSession() {
     const reqHeaders = await (0, headers_1.headers)();
-    let response = await iam.proxy('/auth/profile', { method: 'GET' }, reqHeaders);
-    if (response.status === 401) {
-        // 1. Use the lock! If another component is already refreshing, wait for it.
-        if (!refreshLock) {
-            refreshLock = iam.proxy('/auth/refresh-token', { method: 'POST' }, reqHeaders)
-                .then(res => res.ok ? res.headers.getSetCookie() : null)
-                .finally(() => { refreshLock = null; }); // Clear lock when done
-        }
-        const setCookies = await refreshLock;
-        if (setCookies && setCookies.length > 0) {
-            // 2. Sync the new cookies to the browser
-            const fakeRes = new Response(null, { headers: { 'set-cookie': setCookies.join(', ') } });
-            await syncCookiesToNext(fakeRes);
-            // 3. Build new headers with the refreshed cookies and retry
-            const cookieStore = await (0, headers_1.cookies)();
-            const newJwt = cookieStore.get('jwt')?.value;
-            const newRefresh = cookieStore.get('refreshToken')?.value;
-            const retryHeaders = new Headers(reqHeaders);
-            if (newJwt && newRefresh) {
-                retryHeaders.set('cookie', `jwt=${newJwt}; refreshToken=${newRefresh}`);
-                retryHeaders.set('Authorization', `Bearer ${newJwt}`);
-            }
-            response = await iam.proxy('/auth/profile', { method: 'GET' }, retryHeaders);
-        }
-        else {
-            // 4. CRITICAL: If refresh failed, CLEAR THE COOKIES to break the infinite loop!
-            const cookieStore = await (0, headers_1.cookies)();
-            cookieStore.delete('jwt');
-            cookieStore.delete('refreshToken');
-            return null;
-        }
-    }
+    const response = await iam.proxy('/auth/profile', { method: 'GET' }, reqHeaders);
     if (!response.ok)
         return null;
     const coreIamIdentity = await response.json();

package/dist/nextjs/index.d.ts

@@ -1,9 +1,10 @@
 export { CoreIAMProvider, useAuth } from './provider';
 export { loginActionSdk, registerActionSdk, logoutActionSdk, getSession } from './actions';
+export { coreIamMiddleware } from './middleware';
 import { NextRequest, NextResponse } from 'next/server';
 import { CoreIAM } from '../core';
 export declare class NextHandlers {
     private iam;
-    constructor(iam: CoreIAM);
+    constructor(iam?: CoreIAM);
     handleProxy(req: NextRequest, internalPath: string): Promise<NextResponse<any>>;
 }

package/dist/nextjs/index.js

@@ -1,6 +1,6 @@
 "use strict";
 Object.defineProperty(exports, "__esModule", { value: true });
-exports.NextHandlers = exports.getSession = exports.logoutActionSdk = exports.registerActionSdk = exports.loginActionSdk = exports.useAuth = exports.CoreIAMProvider = void 0;
+exports.NextHandlers = exports.coreIamMiddleware = exports.getSession = exports.logoutActionSdk = exports.registerActionSdk = exports.loginActionSdk = exports.useAuth = exports.CoreIAMProvider = void 0;
 // src/nextjs/index.ts
 var provider_1 = require("./provider");
 Object.defineProperty(exports, "CoreIAMProvider", { enumerable: true, get: function () { return provider_1.CoreIAMProvider; } });
@@ -10,11 +10,16 @@ Object.defineProperty(exports, "loginActionSdk", { enumerable: true, get: functi
 Object.defineProperty(exports, "registerActionSdk", { enumerable: true, get: function () { return actions_1.registerActionSdk; } });
 Object.defineProperty(exports, "logoutActionSdk", { enumerable: true, get: function () { return actions_1.logoutActionSdk; } });
 Object.defineProperty(exports, "getSession", { enumerable: true, get: function () { return actions_1.getSession; } });
+// FIX: Export the new handleCoreIamAuth function instead of the old middleware
+var middleware_1 = require("./middleware");
+Object.defineProperty(exports, "coreIamMiddleware", { enumerable: true, get: function () { return middleware_1.coreIamMiddleware; } });
 const server_1 = require("next/server");
+const core_1 = require("../core");
 class NextHandlers {
     iam;
     constructor(iam) {
-        this.iam = iam;
+        // If no iam client is provided, instantiate one using the env variables
+        this.iam = iam || new core_1.CoreIAM({ apiKey: process.env.COREIAM_API_KEY, baseUrl: process.env.COREIAM_API_URL });
     }
     async handleProxy(req, internalPath) {
         const method = internalPath === '/csrf' ? 'POST' : req.method;

package/dist/nextjs/middleware.d.ts

@@ -0,0 +1,9 @@
+import { NextRequest, NextResponse } from 'next/server';
+/**
+ * Handles CoreIAM token refresh and header rewriting.
+ * Returns the NextResponse to return, and whether the user is authenticated.
+ */
+export declare function coreIamMiddleware(request: NextRequest): Promise<{
+    response: NextResponse;
+    isAuthenticated: boolean;
+}>;

package/dist/nextjs/middleware.js

@@ -0,0 +1,82 @@
+"use strict";
+Object.defineProperty(exports, "__esModule", { value: true });
+exports.coreIamMiddleware = coreIamMiddleware;
+// src/nextjs/middleware.ts
+const server_1 = require("next/server");
+const jwt_decode_1 = require("jwt-decode");
+/**
+ * Handles CoreIAM token refresh and header rewriting.
+ * Returns the NextResponse to return, and whether the user is authenticated.
+ */
+async function coreIamMiddleware(request) {
+    const jwtCookie = request.cookies.get("jwt");
+    const refreshTokenCookie = request.cookies.get("refreshToken");
+    const gatewayUrl = process.env.COREIAM_API_URL;
+    let isAuthenticated = false;
+    let needsRefresh = false;
+    if (jwtCookie) {
+        try {
+            const decoded = (0, jwt_decode_1.jwtDecode)(jwtCookie.value);
+            if (decoded.exp && decoded.exp * 1000 > Date.now()) {
+                isAuthenticated = true;
+            }
+            else if (refreshTokenCookie) {
+                needsRefresh = true;
+            }
+        }
+        catch {
+            if (refreshTokenCookie)
+                needsRefresh = true;
+        }
+    }
+    else if (refreshTokenCookie) {
+        needsRefresh = true;
+    }
+    // 1. ATTEMPT SILENT REFRESH
+    if (needsRefresh && gatewayUrl) {
+        try {
+            const refreshRes = await fetch(`${gatewayUrl}/auth/refresh-token`, {
+                method: 'POST',
+                headers: {
+                    'X-API-Key': process.env.COREIAM_API_KEY,
+                    'cookie': `refreshToken=${refreshTokenCookie?.value || ''}; jwt=${jwtCookie?.value || ''}`,
+                },
+            });
+            if (refreshRes.ok) {
+                const setCookies = refreshRes.headers.getSetCookie();
+                if (setCookies && setCookies.length > 0) {
+                    let newJwt = '';
+                    let newRefreshToken = '';
+                    setCookies.forEach(cookie => {
+                        if (cookie.startsWith('jwt='))
+                            newJwt = cookie.split(';')[0].split('=')[1];
+                        if (cookie.startsWith('refreshToken='))
+                            newRefreshToken = cookie.split(';')[0].split('=')[1];
+                    });
+                    if (newJwt) {
+                        const requestHeaders = new Headers(request.headers);
+                        requestHeaders.set('cookie', `jwt=${newJwt}; refreshToken=${newRefreshToken}`);
+                        requestHeaders.set('Authorization', `Bearer ${newJwt}`);
+                        const response = server_1.NextResponse.next({
+                            request: { headers: requestHeaders },
+                        });
+                        setCookies.forEach(cookie => {
+                            response.headers.append('set-cookie', cookie);
+                        });
+                        return { response, isAuthenticated: true };
+                    }
+                }
+            }
+        }
+        catch (error) {
+            // Refresh failed, fall through to clear cookies
+        }
+        // 2. IF REFRESH FAILED, CLEAR COOKIES
+        const response = server_1.NextResponse.next();
+        response.cookies.delete('jwt');
+        response.cookies.delete('refreshToken');
+        return { response, isAuthenticated: false };
+    }
+    // 3. NO REFRESH NEEDED (Token is valid or completely missing)
+    return { response: server_1.NextResponse.next(), isAuthenticated };
+}

package/package.json

@@ -1,6 +1,6 @@
 {
   "name": "@coreiam/auth",
-  "version": "1.0.2",
+  "version": "1.0.5",
   "main": "./dist/core/index.js",
   "types": "./dist/core/index.d.ts",
   "exports": {
@@ -20,26 +20,43 @@
       "require": "./dist/react/index.js"
     }
   },
-  "files": ["dist"],
+  "files": [
+    "dist"
+  ],
   "scripts": {
     "build": "tsc"
   },
-  "keywords": ["coreiam", "auth", "saas", "multi-tenant", "nextjs"],
+  "keywords": [
+    "coreiam",
+    "auth",
+    "saas",
+    "multi-tenant",
+    "nextjs"
+  ],
   "author": "coreIAM",
   "license": "MIT",
-  "publishConfig": { "access": "public" },
+  "publishConfig": {
+    "access": "public"
+  },
   "peerDependencies": {
     "next": ">=14",
     "react": ">=18"
   },
   "peerDependenciesMeta": {
-    "next": { "optional": true },
-    "react": { "optional": true }
+    "next": {
+      "optional": true
+    },
+    "react": {
+      "optional": true
+    }
   },
   "devDependencies": {
     "@types/react": "^19.2.7",
     "next": "^16.2.11",
     "react": "^19.2.7",
     "typescript": "^5.0.0"
+  },
+  "dependencies": {
+    "jwt-decode": "^4.0.0"
   }
 }