@coreiam/auth 1.0.39 → 1.0.392-beta.0

package/dist/core/index.d.ts

@@ -1,7 +1,16 @@
+import { type JWTPayload } from 'jose';
 export interface CoreIAMConfig {
     baseUrl?: string;
     apiKey?: string;
     tenantId?: string;
+    /** Expected token issuer. Default: 'coreiam'. */
+    issuer?: string;
+    /** Optional strict audience check — off by default, matches current gateway tokens. */
+    audience?: string;
+    /** Session cookie name. Default: 'jwt'. */
+    sessionCookieName?: string;
+    /** JWKS path on the gateway. Default: '/.well-known/jwks.json'. */
+    jwksPath?: string;
 }
 export interface CoreIAMIdentity {
     sub: string;
@@ -10,14 +19,100 @@ export interface CoreIAMIdentity {
     roles?: string[];
     [key: string]: any;
 }
+export interface DirectoryIdentity {
+    sub: string;
+    email?: string;
+    first_name?: string;
+    last_name?: string;
+    is_active?: boolean;
+    roles: string[];
+}
+/** Accepts a Headers instance, an Express req.headers object, or a raw Cookie string. */
+export type SessionInput = Headers | Record<string, string | string[] | undefined> | string;
+export type SessionFailureReason = 'no_cookie' | 'expired' | 'invalid_claims' | 'invalid_signature' | 'jwks_unavailable';
+export interface SessionResult {
+    identity: CoreIAMIdentity | null;
+    reason?: SessionFailureReason;
+}
+export interface RefreshSessionResult {
+    identity: CoreIAMIdentity | null;
+    /** Raw Set-Cookie strings to apply on your response (rotated jwt/refreshToken). */
+    setCookies: string[] | null;
+}
+/** Maps gateway token claims → CoreIAMIdentity (same shape the Next.js middleware injects). */
+export declare function toIdentity(payload: JWTPayload): CoreIAMIdentity;
+/**
+export class CoreIAM {
+  private apiKey: string = '';
+  private baseUrl: string = '';
+
+  constructor(config?: { apiKey?: string; baseUrl?: string }) {
+    this.apiKey = config?.apiKey || process.env.COREIAM_API_KEY || '';
+    // FIX: Removed hardcoded URL. Throw if missing.
+    this.baseUrl = config?.baseUrl || process.env.COREIAM_API_URL || '';
+    
+    if (!this.apiKey) throw new Error('CoreIAM: Missing API Key (COREIAM_API_KEY)');
+    if (!this.baseUrl) throw new Error('CoreIAM: Missing Gateway URL (COREIAM_API_URL)');
+  }
+*/
 export declare class CoreIAM {
     private apiKey;
     private baseUrl;
-    constructor(config?: {
-        apiKey?: string;
-        baseUrl?: string;
-    });
-    refreshTokens(headers: Headers): Promise<string[] | null>;
+    private issuer;
+    private audience?;
+    private sessionCookieName;
+    private jwksPath;
+    private jwks;
+    private refreshInFlight;
+    constructor(config?: CoreIAMConfig);
+    private getJwks;
+    /** Optional warm-up: call at boot so the first verification pays no JWKS latency. */
+    preloadJwks(): Promise<void>;
+    /**
+      * Tenant directory: all identities (with roles) for the tenant scoped to
+      * this instance's API key. Server-to-server, read-only.
+      * THROWS on failure — an audit must never silently see an empty roster.
+      */
+    listIdentities(): Promise<{
+        users: DirectoryIdentity[];
+        total: number;
+    }>;
+    private readCookieHeader;
+    private readSessionCookie;
+    verifySession(input: SessionInput): Promise<SessionResult>;
+    getSession(input: SessionInput): Promise<CoreIAMIdentity | null>;
+    /**
+     * One-call silent refresh for non-Next servers: posts the refresh cookie
+     * to the gateway, verifies the rotated access token, and returns the new
+     * Set-Cookie strings so the caller can forward them on its response.
+     */
+    refreshSession(input: SessionInput): Promise<RefreshSessionResult>;
+    refreshTokens(input: SessionInput): Promise<string[] | null>;
+    private doRefresh;
+    /**
+      async refreshTokens(headers: Headers): Promise<string[] | null> {
+        try {
+          const response = await fetch(`${this.baseUrl}/auth/refresh-token`, {
+            method: 'POST',
+            headers: {
+              'X-API-Key': this.apiKey,
+              'cookie': headers.get('cookie') || '',
+            },
+          });
+    
+          if (response.ok) {
+            const setCookies = response.headers.getSetCookie();
+            if (setCookies && setCookies.length > 0) {
+              return setCookies;
+            }
+          }
+          return null;
+        } catch (error) {
+          return null;
+        }
+      }
+    
+    */
     proxy(path: string, init: RequestInit, incomingHeaders: Headers): Promise<Response>;
     getCsrfToken(headers: Headers): Promise<Response>;
     login(body: any, headers: Headers): Promise<Response>;

package/dist/core/index.js

@@ -1,41 +1,203 @@
 "use strict";
-// src/core/index.ts
 Object.defineProperty(exports, "__esModule", { value: true });
 exports.CoreIAM = void 0;
+exports.toIdentity = toIdentity;
+// src/core/index.ts
+const jose_1 = require("jose");
+/** Maps gateway token claims → CoreIAMIdentity (same shape the Next.js middleware injects). */
+function toIdentity(payload) {
+    return {
+        sub: payload.sub,
+        email: payload.email,
+        tenantId: payload.tenantId,
+        roles: Array.isArray(payload.roles) ? payload.roles : [],
+    };
+}
+/**
+export class CoreIAM {
+  private apiKey: string = '';
+  private baseUrl: string = '';
+
+  constructor(config?: { apiKey?: string; baseUrl?: string }) {
+    this.apiKey = config?.apiKey || process.env.COREIAM_API_KEY || '';
+    // FIX: Removed hardcoded URL. Throw if missing.
+    this.baseUrl = config?.baseUrl || process.env.COREIAM_API_URL || '';
+    
+    if (!this.apiKey) throw new Error('CoreIAM: Missing API Key (COREIAM_API_KEY)');
+    if (!this.baseUrl) throw new Error('CoreIAM: Missing Gateway URL (COREIAM_API_URL)');
+  }
+*/
 class CoreIAM {
     apiKey = '';
     baseUrl = '';
+    issuer = 'coreiam';
+    audience;
+    sessionCookieName = 'jwt';
+    jwksPath = '/.well-known/jwks.json';
+    jwks = null;
+    refreshInFlight = null;
     constructor(config) {
         this.apiKey = config?.apiKey || process.env.COREIAM_API_KEY || '';
-        // FIX: Removed hardcoded URL. Throw if missing.
-        this.baseUrl = config?.baseUrl || process.env.COREIAM_API_URL || '';
+        this.baseUrl = (config?.baseUrl || process.env.COREIAM_API_URL || '').replace(/\/+$/, '');
+        this.issuer = config?.issuer ?? 'coreiam';
+        this.audience = config?.audience;
+        this.sessionCookieName = config?.sessionCookieName ?? 'jwt';
+        this.jwksPath = config?.jwksPath ?? '/.well-known/jwks.json';
         if (!this.apiKey)
             throw new Error('CoreIAM: Missing API Key (COREIAM_API_KEY)');
         if (!this.baseUrl)
             throw new Error('CoreIAM: Missing Gateway URL (COREIAM_API_URL)');
     }
-    // Exposed publicly so the Next.js layer can use it for getSession()
-    async refreshTokens(headers) {
+    getJwks() {
+        // Lazy singleton: jose fetches once, caches, and handles key rotation.
+        this.jwks ??= (0, jose_1.createRemoteJWKSet)(new URL(`${this.baseUrl}${this.jwksPath}`), {
+            cooldownDuration: 30_000,
+            cacheMaxAge: 10 * 60_000,
+        });
+        return this.jwks;
+    }
+    /** Optional warm-up: call at boot so the first verification pays no JWKS latency. */
+    async preloadJwks() {
+        try {
+            // Deliberately look up a key that won't exist — jose fetches and
+            // caches the whole key set on the first lookup, which is the warm-up.
+            await this.getJwks()({ alg: 'RS256', kid: '__preload__' }, {});
+        }
+        catch {
+            /* expected: no matching key — the fetch is the point */
+        }
+    }
+    /**
+      * Tenant directory: all identities (with roles) for the tenant scoped to
+      * this instance's API key. Server-to-server, read-only.
+      * THROWS on failure — an audit must never silently see an empty roster.
+      */
+    async listIdentities() {
+        const response = await this.proxy('/api/v1/directory', { method: 'GET' }, new Headers());
+        if (!response.ok) {
+            const body = await response.text().catch(() => '');
+            throw new Error(`listIdentities failed: ${response.status} ${body}`);
+        }
+        const data = await response.json();
+        return { users: data.users ?? [], total: data.total ?? 0 };
+    }
+    readCookieHeader(input) {
+        if (typeof input === 'string')
+            return input;
+        if (typeof input.get === 'function')
+            return input.get('cookie') || '';
+        return input.cookie || '';
+    }
+    readSessionCookie(input) {
+        const raw = this.readCookieHeader(input);
+        if (!raw)
+            return null;
+        // Anchored to a real cookie-name boundary (same pattern proxy() uses),
+        // so a cookie named "notjwt" or "xjwt" can never match.
+        const escaped = this.sessionCookieName.replace(/[.*+?^${}()|[\]\\]/g, '\\$&');
+        const match = raw.match(new RegExp(`(?:^|;\\s*)${escaped}=([^;]+)`));
+        return match ? decodeURIComponent(match[1]) : null;
+    }
+    async verifySession(input) {
+        const token = this.readSessionCookie(input);
+        if (!token)
+            return { identity: null, reason: 'no_cookie' };
+        try {
+            const { payload } = await (0, jose_1.jwtVerify)(token, this.getJwks(), {
+                algorithms: ['RS256'], // pinned — blocks alg confusion
+                issuer: this.issuer,
+                ...(this.audience ? { audience: this.audience } : {}),
+            });
+            return { identity: toIdentity(payload) };
+        }
+        catch (error) {
+            if (error instanceof jose_1.errors.JWTExpired)
+                return { identity: null, reason: 'expired' };
+            if (error instanceof jose_1.errors.JWTClaimValidationFailed)
+                return { identity: null, reason: 'invalid_claims' };
+            // JOSE errors = the token itself is bad. Anything else (fetch failure
+            // while getting the JWKS) = we couldn't check — that is not a sign-out.
+            if (error instanceof jose_1.errors.JOSEError)
+                return { identity: null, reason: 'invalid_signature' };
+            return { identity: null, reason: 'jwks_unavailable' };
+        }
+    }
+    async getSession(input) {
+        return (await this.verifySession(input)).identity;
+    }
+    /**
+     * One-call silent refresh for non-Next servers: posts the refresh cookie
+     * to the gateway, verifies the rotated access token, and returns the new
+     * Set-Cookie strings so the caller can forward them on its response.
+     */
+    async refreshSession(input) {
+        const setCookies = await this.refreshTokens(input);
+        if (!setCookies)
+            return { identity: null, setCookies: null };
+        const rotated = setCookies
+            .find(c => c.startsWith(`${this.sessionCookieName}=`))
+            ?.split(';')[0]; // "jwt=<new value>" — a valid single-cookie header string
+        if (rotated) {
+            const { identity } = await this.verifySession(rotated);
+            if (identity)
+                return { identity, setCookies };
+        }
+        return { identity: null, setCookies };
+    }
+    async refreshTokens(input) {
+        // Single-flight: concurrent requests share one gateway refresh call
+        // (matters with rotating refresh tokens). Input widened from Headers
+        // to SessionInput — backwards compatible.
+        this.refreshInFlight ??= this.doRefresh(input).finally(() => {
+            this.refreshInFlight = null;
+        });
+        return this.refreshInFlight;
+    }
+    async doRefresh(input) {
         try {
             const response = await fetch(`${this.baseUrl}/auth/refresh-token`, {
                 method: 'POST',
                 headers: {
                     'X-API-Key': this.apiKey,
-                    'cookie': headers.get('cookie') || '',
+                    'cookie': this.readCookieHeader(input),
                 },
             });
             if (response.ok) {
                 const setCookies = response.headers.getSetCookie();
-                if (setCookies && setCookies.length > 0) {
+                if (setCookies && setCookies.length > 0)
                     return setCookies;
-                }
             }
             return null;
         }
-        catch (error) {
+        catch {
             return null;
         }
     }
+    // Exposed publicly so the Next.js layer can use it for getSession()
+    /**
+      async refreshTokens(headers: Headers): Promise<string[] | null> {
+        try {
+          const response = await fetch(`${this.baseUrl}/auth/refresh-token`, {
+            method: 'POST',
+            headers: {
+              'X-API-Key': this.apiKey,
+              'cookie': headers.get('cookie') || '',
+            },
+          });
+    
+          if (response.ok) {
+            const setCookies = response.headers.getSetCookie();
+            if (setCookies && setCookies.length > 0) {
+              return setCookies;
+            }
+          }
+          return null;
+        } catch (error) {
+          return null;
+        }
+      }
+    
+    */
     async proxy(path, init, incomingHeaders) {
         const url = `${this.baseUrl}${path}`;
         const headers = new Headers(init.headers);

package/dist/express/index.d.ts

@@ -0,0 +1,26 @@
+import { Router, type RequestHandler } from 'express';
+import { type CoreIAMConfig } from '../core';
+export interface CoreIamExpressOptions extends CoreIAMConfig {
+    /**
+     * Public URL of the app as the user's browser reaches it (e.g. http://localhost:5173
+     * in Vite dev, or your production domain). /api/auth must route from this origin
+     * to this Express server (reverse proxy in prod, Vite dev proxy in dev).
+     */
+    appUrl: string;
+    /** Mount path of the auth router. Default: '/api/auth'. */
+    authPath?: string;
+    /** Redirect target after successful OAuth login. Default: '/'. */
+    successUrl?: string;
+    /** Redirect target when OAuth initiation fails. Default: '/login'. */
+    signInUrl?: string;
+}
+export declare function coreIamExpress(options: CoreIamExpressOptions): Router;
+/**
+ * Route guard: verifies the session cookie locally and puts the identity on
+ * res.locals.identity. 401s API requests; redirects page requests.
+ */
+export declare function requireAuth(config?: CoreIAMConfig & {
+    signInUrl?: string;
+}): RequestHandler;
+export { CoreIAM } from '../core';
+export type { CoreIAMIdentity } from '../core';

package/dist/express/index.js

@@ -0,0 +1,171 @@
+"use strict";
+Object.defineProperty(exports, "__esModule", { value: true });
+exports.CoreIAM = void 0;
+exports.coreIamExpress = coreIamExpress;
+exports.requireAuth = requireAuth;
+// src/express/index.ts
+const express_1 = require("express");
+const core_1 = require("../core");
+const CSRF_PROTECTED = new Set([
+    '/auth/login', '/auth/register', '/auth/profile',
+    '/auth/mfa/setup', '/auth/mfa/verify', '/auth/mfa/disable',
+    '/auth/request-otp', '/auth/verify-otp',
+]);
+/** Express 4 does not catch async rejections — route them to next(err). */
+const wrap = (fn) => (req, res, next) => { fn(req, res, next).catch(next); };
+function sessionCookie(name, value, maxAgeSec, isProd) {
+    return `${name}=${encodeURIComponent(value)}; Path=/; HttpOnly; SameSite=Lax; Max-Age=${maxAgeSec}${isProd ? '; Secure' : ''}`;
+}
+function coreIamExpress(options) {
+    const appUrl = options.appUrl.replace(/\/+$/, '');
+    const authPath = (options.authPath ?? '/api/auth').replace(/\/+$/, '');
+    const successUrl = options.successUrl ?? '/';
+    const signInUrl = options.signInUrl ?? '/login';
+    const gatewayUrl = (options.baseUrl || process.env.COREIAM_API_URL || '').replace(/\/+$/, '');
+    const isProd = process.env.NODE_ENV === 'production';
+    const iam = new core_1.CoreIAM(options);
+    const router = (0, express_1.Router)();
+    // Body parsing for JSON + the urlencoded link-confirm post.
+    // Skips automatically if the host app already parsed the body.
+    router.use((0, express_1.json)());
+    router.use((0, express_1.urlencoded)({ extended: false }));
+    const toHeaders = (req) => new Headers(req.headers);
+    // ---------------------------------------------------------------
+    // GET {authPath}/session — matches the React provider's default
+    // sessionUrl ('/api/auth/session'). Local JWKS verify + silent refresh.
+    // ---------------------------------------------------------------
+    router.get('/session', wrap(async (req, res) => {
+        const result = await iam.verifySession(req.headers);
+        if (result.identity)
+            return void res.json(result.identity);
+        if (result.reason === 'expired') {
+            const { identity, setCookies } = await iam.refreshSession(req.headers);
+            if (identity) {
+                setCookies?.forEach(c => res.append('Set-Cookie', c));
+                return void res.json(identity);
+            }
+        }
+        res.status(401).json({ error: 'unauthenticated' });
+    }));
+    // ---------------------------------------------------------------
+    // OAuth initiate: GET {authPath}/oauth/:provider
+    // ---------------------------------------------------------------
+    router.get('/oauth/:provider', wrap(async (req, res, next) => {
+        const provider = req.params.provider;
+        if (provider === 'link')
+            return next(); // not an initiate route
+        const redirectUri = `${appUrl}${authPath}/callback/${provider}`;
+        const target = `/auth/oauth/initiate/${provider}?redirectUri=${encodeURIComponent(redirectUri)}&scopes=email,profile`;
+        const response = await iam.proxy(target, { method: 'GET' }, toHeaders(req));
+        const data = await response.json().catch(() => ({}));
+        if (data.url)
+            return void res.redirect(302, data.url);
+        res.redirect(302, signInUrl);
+    }));
+    // ---------------------------------------------------------------
+    // OAuth callback: GET {authPath}/callback/:provider
+    // ---------------------------------------------------------------
+    router.get('/callback/:provider', wrap(async (req, res) => {
+        const provider = req.params.provider;
+        const code = req.query.code;
+        const state = req.query.state;
+        const redirectUri = `${appUrl}${authPath}/callback/${provider}`;
+        const target = `/auth/oauth/callback/${provider}?code=${code}&state=${state}&redirectUri=${encodeURIComponent(redirectUri)}`;
+        const response = await iam.proxy(target, { method: 'GET' }, toHeaders(req));
+        const data = await response.json().catch(() => ({}));
+        // Account linking: redirect to CoreIAM's hosted confirmation page
+        if (data.action === 'link_candidate') {
+            const redirect = new URL(`${gatewayUrl}/auth/hosted/confirm-link`);
+            redirect.searchParams.set('token', data.tempToken);
+            redirect.searchParams.set('provider', data.provider);
+            redirect.searchParams.set('email', data.email || '');
+            redirect.searchParams.set('appOrigin', appUrl);
+            return void res.redirect(303, redirect.toString());
+        }
+        // Normal OAuth login: forward the gateway's session cookies, then redirect.
+        // (Set-Cookie must be appended BEFORE res.redirect — Express sends immediately.)
+        response.headers.getSetCookie().forEach(c => res.append('Set-Cookie', c));
+        res.redirect(302, successUrl);
+    }));
+    // ---------------------------------------------------------------
+    // Account-link confirmation: POST {authPath}/oauth/link/confirm
+    // (the hosted page posts tempToken + password back here)
+    // ---------------------------------------------------------------
+    router.post('/oauth/link/confirm', wrap(async (req, res) => {
+        const formData = (req.body ?? {});
+        const response = await iam.proxy('/auth/oauth/link/confirm', {
+            method: 'POST',
+            body: JSON.stringify({ tempToken: formData.tempToken, password: formData.password }),
+            headers: { 'Content-Type': 'application/json' },
+        }, toHeaders(req));
+        const data = await response.json().catch(() => ({}));
+        if (response.ok && data.success) {
+            const finalUrl = new URL(data.redirectUri || '/', appUrl).toString();
+            // Same cookie attributes the Next.js handler uses.
+            if (data.accessToken)
+                res.append('Set-Cookie', sessionCookie('jwt', data.accessToken, 24 * 60 * 60, isProd));
+            if (data.clientRefreshToken)
+                res.append('Set-Cookie', sessionCookie('refreshToken', data.clientRefreshToken, 7 * 24 * 60 * 60, isProd));
+            // 200 + JS redirect breaks the cross-site redirect chain so the browser
+            // sends the freshly-set (SameSite=Lax) cookies on the next hop.
+            return void res.status(200).type('html').send(`<!DOCTYPE html>
+<html>
+  <head><title>Linking Successful</title></head>
+  <body>
+    <p>Account linked successfully! Redirecting...</p>
+    <script>window.location.href = ${JSON.stringify(finalUrl)};</script>
+  </body>
+</html>`);
+        }
+        // Failed (wrong password) -> back to the hosted page with the error
+        const errorRedirect = new URL(`${gatewayUrl}/auth/hosted/confirm-link`);
+        errorRedirect.searchParams.set('token', formData.tempToken);
+        errorRedirect.searchParams.set('provider', data.provider || 'google');
+        errorRedirect.searchParams.set('email', data.email || '');
+        errorRedirect.searchParams.set('appOrigin', appUrl);
+        errorRedirect.searchParams.set('error', data.message || 'Invalid password. Link failed.');
+        res.redirect(303, errorRedirect.toString());
+    }));
+    // ---------------------------------------------------------------
+    // Everything else: generic JSON passthrough (login, register, logout,
+    // csrf-token, MFA, OTP, profile...). CSRF-protected endpoints run the
+    // handshake first, same as the Next.js server actions.
+    // ---------------------------------------------------------------
+    router.use(wrap(async (req, res) => {
+        const target = `/auth${req.path}`; // /login -> /auth/login
+        const init = { method: req.method };
+        if (req.method !== 'GET' && req.method !== 'HEAD') {
+            init.body = req.body ? JSON.stringify(req.body) : undefined;
+            init.headers = { 'Content-Type': 'application/json' };
+        }
+        const response = CSRF_PROTECTED.has(target)
+            ? await iam.proxyWithCsrfProtection(target, init, toHeaders(req))
+            : await iam.proxy(target, init, toHeaders(req));
+        const data = await response.json().catch(() => ({}));
+        res.status(response.status);
+        response.headers.getSetCookie().forEach(c => res.append('Set-Cookie', c));
+        res.json(data);
+    }));
+    return router;
+}
+/**
+ * Route guard: verifies the session cookie locally and puts the identity on
+ * res.locals.identity. 401s API requests; redirects page requests.
+ */
+function requireAuth(config) {
+    const iam = new core_1.CoreIAM(config);
+    const { signInUrl = '/login' } = config ?? {};
+    return wrap(async (req, res, next) => {
+        const identity = await iam.getSession(req.headers);
+        if (!identity) {
+            if (req.path.startsWith('/api') || req.accepts(['html', 'json']) === 'json') {
+                return void res.status(401).json({ error: 'unauthenticated' });
+            }
+            return void res.redirect(302, signInUrl);
+        }
+        res.locals.identity = identity;
+        next();
+    });
+}
+var core_2 = require("../core");
+Object.defineProperty(exports, "CoreIAM", { enumerable: true, get: function () { return core_2.CoreIAM; } });

package/dist/nextjs/middleware.js

@@ -124,12 +124,21 @@ exports.coreIamMiddleware = coreIamMiddleware;
 // }
 // src/nextjs/middleware.ts
 const server_1 = require("next/server");
-const jose_1 = require("jose");
+//import { jwtVerify, createRemoteJWKSet } from 'jose';
 const core_1 = require("../core");
 const gatewayUrl = process.env.COREIAM_API_URL;
+/**
 const JWKS = gatewayUrl
-    ? (0, jose_1.createRemoteJWKSet)(new URL(`${gatewayUrl}/.well-known/jwks.json`))
-    : null;
+  ? createRemoteJWKSet(new URL(`${gatewayUrl}/.well-known/jwks.json`))
+  : null;
+*/
+let iam = null;
+function getIam() {
+    if (!gatewayUrl || !process.env.COREIAM_API_KEY)
+        return null;
+    iam ??= new core_1.CoreIAM({ apiKey: process.env.COREIAM_API_KEY, baseUrl: gatewayUrl });
+    return iam;
+}
 let refreshInFlight = null;
 async function performRefresh(refreshTokenCookie, jwtCookie) {
     if (!gatewayUrl)
@@ -181,7 +190,14 @@ async function coreIamAuth(request) {
             }
             return { response: res, isAuthenticated: false };
         }
-        const iam = new core_1.CoreIAM({ apiKey: process.env.COREIAM_API_KEY, baseUrl: gatewayUrl });
+        //    const iam = new CoreIAM({ apiKey: process.env.COREIAM_API_KEY!, baseUrl: gatewayUrl! });
+        const iam = getIam();
+        if (!iam) {
+            return {
+                response: new server_1.NextResponse('CoreIAM is not configured (COREIAM_API_URL / COREIAM_API_KEY)', { status: 500 }),
+                isAuthenticated: false,
+            };
+        }
         // FIX: Special handler for the Link Confirm POST! (Must be at the TOP, before generic body read)
         if (pathname === '/api/auth/oauth/link/confirm') {
             let formData = {};
@@ -295,33 +311,62 @@ async function coreIamAuth(request) {
         setCookies.forEach(c => res.headers.append('set-cookie', c));
         return { response: res, isAuthenticated: false };
     }
+    /**
+      // 2. LOCAL JWT VERIFICATION & REFRESH
+      const jwtCookie = request.cookies.get("jwt");
+      const refreshTokenCookie = request.cookies.get("refreshToken");
+    
+      let isAuthenticated = false;
+      let needsRefresh = false;
+    
+      if (jwtCookie && JWKS) {
+        try {
+          const { payload } = await jwtVerify(jwtCookie.value, JWKS, {
+            issuer: 'coreiam',
+            algorithms: ['RS256']
+          });
+          
+          const requestHeaders = new Headers(request.headers);
+          requestHeaders.set('x-coreiam-identity', JSON.stringify({
+            sub: payload.sub,
+            email: payload.email,
+            tenantId: payload.tenantId,
+            roles: payload.roles || []
+          }));
+          
+          return {
+            response: NextResponse.next({ request: { headers: requestHeaders } }),
+            isAuthenticated: true
+          };
+        } catch (error: any) {
+          if (error.code === 'ERR_JWT_EXPIRED' && refreshTokenCookie) {
+            needsRefresh = true;
+          }
+        }
+      } else if (refreshTokenCookie) {
+        needsRefresh = true;
+      }
+    
+    */
     // 2. LOCAL JWT VERIFICATION & REFRESH
+    //    Now delegates to CoreIAM.verifySession — the same code path Express
+    //    users get, so the two implementations can never drift.
     const jwtCookie = request.cookies.get("jwt");
     const refreshTokenCookie = request.cookies.get("refreshToken");
-    let isAuthenticated = false;
+    const client = getIam();
     let needsRefresh = false;
-    if (jwtCookie && JWKS) {
-        try {
-            const { payload } = await (0, jose_1.jwtVerify)(jwtCookie.value, JWKS, {
-                issuer: 'coreiam',
-                algorithms: ['RS256']
-            });
+    if (client) {
+        const result = await client.verifySession(request.headers);
+        if (result.identity) {
             const requestHeaders = new Headers(request.headers);
-            requestHeaders.set('x-coreiam-identity', JSON.stringify({
-                sub: payload.sub,
-                email: payload.email,
-                tenantId: payload.tenantId,
-                roles: payload.roles || []
-            }));
+            requestHeaders.set('x-coreiam-identity', JSON.stringify(result.identity));
             return {
                 response: server_1.NextResponse.next({ request: { headers: requestHeaders } }),
                 isAuthenticated: true
             };
         }
-        catch (error) {
-            if (error.code === 'ERR_JWT_EXPIRED' && refreshTokenCookie) {
-                needsRefresh = true;
-            }
+        if (refreshTokenCookie && (result.reason === 'expired' || result.reason === 'no_cookie')) {
+            needsRefresh = true;
         }
     }
     else if (refreshTokenCookie) {

package/dist/react/provider.d.ts

@@ -1,6 +1,7 @@
 import React from 'react';
+import type { CoreIAMIdentity } from '../core';
 interface AuthContextType {
-    user: any | null;
+    user: CoreIAMIdentity | null;
     isLoading: boolean;
 }
 export declare function CoreIAMProvider({ children, sessionUrl }: {

package/dist/react/provider.js

@@ -1,25 +1,72 @@
 "use strict";
 // src/react/provider.tsx
+/**
+'use client';
+
+import React, { createContext, useContext, useEffect, useState } from 'react';
+
+interface AuthContextType {
+  user: any | null;
+  isLoading: boolean;
+}
+
+const AuthContext = createContext<AuthContextType>({
+  user: null,
+  isLoading: true,
+});
+
+export function CoreIAMProvider({
+  children,
+  sessionUrl = '/api/auth/session'
+}: {
+  children: React.ReactNode;
+  sessionUrl?: string;
+}) {
+  const [user, setUser] = useState<any | null>(null);
+  const [isLoading, setIsLoading] = useState(true);
+
+  useEffect(() => {
+    fetch(sessionUrl, { credentials: 'include' })
+      .then(res => res.ok ? res.json() : null)
+      .then(data => setUser(data))
+      .finally(() => setIsLoading(false));
+  }, [sessionUrl]);
+
+  return (
+    <AuthContext.Provider value={{ user, isLoading }}>
+      {children}
+    </AuthContext.Provider>
+  );
+}
+
+export function useAuth() {
+  return useContext(AuthContext);
+}
+
+*/
 'use client';
 Object.defineProperty(exports, "__esModule", { value: true });
 exports.CoreIAMProvider = CoreIAMProvider;
 exports.useAuth = useAuth;
 const jsx_runtime_1 = require("react/jsx-runtime");
 const react_1 = require("react");
-const AuthContext = (0, react_1.createContext)({
-    user: null,
-    isLoading: true,
-});
+const AuthContext = (0, react_1.createContext)({ user: null, isLoading: true });
 function CoreIAMProvider({ children, sessionUrl = '/api/auth/session' }) {
     const [user, setUser] = (0, react_1.useState)(null);
     const [isLoading, setIsLoading] = (0, react_1.useState)(true);
     (0, react_1.useEffect)(() => {
+        let cancelled = false;
         fetch(sessionUrl, { credentials: 'include' })
-            .then(res => res.ok ? res.json() : null)
-            .then(data => setUser(data))
-            .finally(() => setIsLoading(false));
+            .then(res => (res.ok ? res.json() : null))
+            .then(data => { if (!cancelled)
+            setUser(data); })
+            .catch(() => { if (!cancelled)
+            setUser(null); }) // NEW: network failure no longer leaves an unhandled rejection
+            .finally(() => { if (!cancelled)
+            setIsLoading(false); });
+        return () => { cancelled = true; }; // NEW: no state updates after unmount
     }, [sessionUrl]);
-    return ((0, jsx_runtime_1.jsx)(AuthContext.Provider, { value: { user, isLoading }, children: children }));
+    return (0, jsx_runtime_1.jsx)(AuthContext.Provider, { value: { user, isLoading }, children: children });
 }
 function useAuth() {
     return (0, react_1.useContext)(AuthContext);

package/package.json

@@ -1,6 +1,6 @@
 {
   "name": "@coreiam/auth",
-  "version": "1.0.39",
+  "version": "1.0.392-beta.0",
   "main": "./dist/core/index.js",
   "types": "./dist/core/index.d.ts",
   "exports": {
@@ -18,13 +18,19 @@
       "types": "./dist/react/index.d.ts",
       "import": "./dist/react/index.js",
       "require": "./dist/react/index.js"
+    },
+    "./express": {
+      "types": "./dist/express/index.d.ts",
+      "import": "./dist/express/index.js",
+      "require": "./dist/express/index.js"
     }
   },
   "files": [
     "dist"
   ],
   "scripts": {
-    "build": "tsc"
+    "build": "tsc",
+    "test": "vitest run"
   },
   "keywords": [
     "coreiam",
@@ -39,6 +45,7 @@
     "access": "public"
   },
   "peerDependencies": {
+    "express": "^4.0.0 || ^5.0.0",
     "next": ">=14",
     "react": ">=18"
   },
@@ -48,13 +55,21 @@
     },
     "react": {
       "optional": true
+    },
+    "express": {
+      "optional": true
     }
   },
   "devDependencies": {
+    "@types/express": "^5.0.6",
     "@types/react": "^19.2.7",
+    "@types/supertest": "^7.2.1",
+    "express": "^5.2.1",
     "next": "^16.2.11",
     "react": "^19.2.7",
-    "typescript": "^5.0.0"
+    "supertest": "^7.3.0",
+    "typescript": "^5.0.0",
+    "vitest": "^3.2.7"
   },
   "dependencies": {
     "@radix-ui/react-slot": "^1.3.3",