@coreiam/auth 1.0.392-beta.1 → 1.0.392-beta.12

package/dist/nextjs/actions.js

@@ -99,11 +99,19 @@ exports.loginActionSdk = loginActionSdk;
 exports.registerActionSdk = registerActionSdk;
 exports.logoutActionSdk = logoutActionSdk;
 exports.updateProfileActionSdk = updateProfileActionSdk;
+exports.changePasswordActionSdk = changePasswordActionSdk;
 exports.setupMfaActionSdk = setupMfaActionSdk;
 exports.verifyMfaActionSdk = verifyMfaActionSdk;
 exports.disableMfaActionSdk = disableMfaActionSdk;
 exports.requestOtpActionSdk = requestOtpActionSdk;
 exports.verifyOtpActionSdk = verifyOtpActionSdk;
+exports.verifyEmailActionSdk = verifyEmailActionSdk;
+exports.resendVerificationActionSdk = resendVerificationActionSdk;
+exports.forgotPasswordActionSdk = forgotPasswordActionSdk;
+exports.resetPasswordActionSdk = resetPasswordActionSdk;
+exports.listSessionsActionSdk = listSessionsActionSdk;
+exports.revokeSessionActionSdk = revokeSessionActionSdk;
+exports.revokeAllSessionsActionSdk = revokeAllSessionsActionSdk;
 const headers_1 = require("next/headers");
 const core_1 = require("../core");
 // FIX: lazy singleton instead of `const iam = new CoreIAM();` at module
@@ -210,34 +218,13 @@ async function getSession() {
             return null;
         }
     }
-    // Fallback: If middleware didn't run (e.g. API route), we can still read the JWT
-    // But we DO NOT verify it here, because verification requires the JWKS fetch which 
-    // is too slow for Server Components. We just decode it to get the identity.
-    // The middleware is the true security gate.
-    const authHeader = reqHeaders.get('Authorization') || reqHeaders.get('authorization');
-    const cookieHeader = reqHeaders.get('cookie');
-    let token = undefined;
-    if (authHeader?.startsWith('Bearer ')) {
-        token = authHeader.substring(7);
-    }
-    else if (cookieHeader) {
-        const match = cookieHeader.match(/jwt=([^;]+)/);
-        if (match)
-            token = match[1];
-    }
-    if (!token)
-        return null;
+    // FIX (SDK-1): delegate to the SAME verification funnel coreIamMiddleware
+    // uses (CoreIAM.verifySession — jose, RS256-pinned, issuer-checked) instead
+    // of decoding the payload unverified. One implementation, zero drift,
+    // no new env vars. Forged tokens -> null.
     try {
-        // Just decode the payload without verifying (middleware already verified it)
-        const payloadB64 = token.split('.')[1];
-        const payloadStr = Buffer.from(payloadB64, 'base64').toString('utf8');
-        const payload = JSON.parse(payloadStr);
-        return {
-            sub: payload.sub,
-            email: payload.email,
-            tenantId: payload.tenantId,
-            roles: payload.roles || []
-        };
+        const result = await getIam().verifySession(reqHeaders);
+        return result.identity ?? null;
     }
     catch {
         return null;
@@ -291,6 +278,16 @@ async function updateProfileActionSdk(updateData) {
         return { ok: false, status: 500, data: { error: 'Profile update failed' } };
     }
 }
+async function changePasswordActionSdk(currentPassword, newPassword) {
+    const reqHeaders = await (0, headers_1.headers)();
+    try {
+        const response = await getIam().changePassword(currentPassword, newPassword, reqHeaders);
+        return { ok: response.ok, status: response.status, data: await response.json().catch(() => ({})) };
+    }
+    catch (error) {
+        return { ok: false, status: 500, data: { error: 'Password change failed' } };
+    }
+}
 async function setupMfaActionSdk() {
     const reqHeaders = await (0, headers_1.headers)();
     try {
@@ -325,7 +322,12 @@ async function requestOtpActionSdk(body) {
     const reqHeaders = await (0, headers_1.headers)();
     try {
         const response = await getIam().requestOtp(body, reqHeaders);
-        return { ok: response.ok, status: response.status, data: await response.json().catch(() => ({})) };
+        // FIX (SDK-3, uniformity): request-otp currently sets no cookies, but routing
+        // any Set-Cookie through the same sync as every other auth action keeps the
+        // invariant above true if the backend ever starts setting one.
+        await syncCookiesToNext(response);
+        const data = await response.json().catch(() => ({}));
+        return { ok: response.ok, status: response.status, data, retryAfter: (0, core_1.retryAfterSeconds)(data) };
     }
     catch (error) {
         return { ok: false, status: 500, data: { error: 'OTP request failed' } };
@@ -335,9 +337,108 @@ async function verifyOtpActionSdk(body) {
     const reqHeaders = await (0, headers_1.headers)();
     try {
         const response = await getIam().verifyOtp(body, reqHeaders);
-        return { ok: response.ok, status: response.status, data: await response.json().catch(() => ({})) };
+        // FIX (SDK-3): sync Set-Cookie to the Next.js cookie store before returning.
+        // W2's POST /auth/verify-otp mints an OTP session and Set-Cookies the jwt
+        // cookie (Max-Age 900 — verified live in acceptance). Without this line the
+        // action silently dropped the session cookie, so passwordless login via
+        // server action never established a browser session. Mirrors the
+        // loginActionSdk / registerActionSdk pattern exactly.
+        await syncCookiesToNext(response);
+        const data = await response.json().catch(() => ({}));
+        return { ok: response.ok, status: response.status, data, retryAfter: (0, core_1.retryAfterSeconds)(data) };
     }
     catch (error) {
         return { ok: false, status: 500, data: { error: 'OTP verification failed' } };
     }
 }
+// W5 (beta.9): signup email verification — register fires the verification
+// email (emailVerificationRequired: true); these close the loop so the SDK
+// surface matches the server's /auth/verify-email + resend-verification pair.
+async function verifyEmailActionSdk(body) {
+    const reqHeaders = await (0, headers_1.headers)();
+    try {
+        const response = await getIam().verifyEmail(body, reqHeaders);
+        await syncCookiesToNext(response);
+        const data = await response.json().catch(() => ({}));
+        return { ok: response.ok, status: response.status, data, retryAfter: (0, core_1.retryAfterSeconds)(data) };
+    }
+    catch (error) {
+        return { ok: false, status: 500, data: { error: 'Email verification failed' } };
+    }
+}
+async function resendVerificationActionSdk(email) {
+    const reqHeaders = await (0, headers_1.headers)();
+    try {
+        const response = await getIam().resendVerification(email, reqHeaders);
+        await syncCookiesToNext(response);
+        const data = await response.json().catch(() => ({}));
+        return { ok: response.ok, status: response.status, data, retryAfter: (0, core_1.retryAfterSeconds)(data) };
+    }
+    catch (error) {
+        return { ok: false, status: 500, data: { error: 'Verification resend failed' } };
+    }
+}
+async function forgotPasswordActionSdk(email) {
+    const reqHeaders = await (0, headers_1.headers)();
+    try {
+        const response = await getIam().forgotPassword(email, reqHeaders);
+        await syncCookiesToNext(response);
+        return { ok: response.ok, status: response.status, data: await response.json().catch(() => ({})) };
+    }
+    catch (error) {
+        return { ok: false, status: 500, data: { error: 'Password reset request failed' } };
+    }
+}
+async function resetPasswordActionSdk(email, otp, newPassword) {
+    const reqHeaders = await (0, headers_1.headers)();
+    try {
+        const response = await getIam().resetPassword(email, otp, newPassword, reqHeaders);
+        // W2's reset-password revokes ALL session families server-side
+        // (revokeAllUserSessions) and clears cookies via Set-Cookie deletions —
+        // this sync applies them to the browser. Without it the client would sit
+        // on dead cookies after a successful reset.
+        await syncCookiesToNext(response);
+        return { ok: response.ok, status: response.status, data: await response.json().catch(() => ({})) };
+    }
+    catch (error) {
+        return { ok: false, status: 500, data: { error: 'Password reset failed' } };
+    }
+}
+// --- W4 (beta.7): session management. listSessions in a Server Component,
+// revoke calls from client components via server actions — same funnel and
+// same AuthResult contract as every action above. The backend sets no
+// cookies on these routes, but Set-Cookie sync stays wired for uniformity
+// (SDK-3 pattern).
+async function listSessionsActionSdk() {
+    const reqHeaders = await (0, headers_1.headers)();
+    try {
+        const response = await getIam().listSessions(reqHeaders);
+        await syncCookiesToNext(response);
+        return { ok: response.ok, status: response.status, data: await response.json().catch(() => ({})) };
+    }
+    catch (error) {
+        return { ok: false, status: 500, data: { error: 'Failed to list sessions' } };
+    }
+}
+async function revokeSessionActionSdk(sessionId) {
+    const reqHeaders = await (0, headers_1.headers)();
+    try {
+        const response = await getIam().revokeSession(sessionId, reqHeaders);
+        await syncCookiesToNext(response);
+        return { ok: response.ok, status: response.status, data: await response.json().catch(() => ({})) };
+    }
+    catch (error) {
+        return { ok: false, status: 500, data: { error: error instanceof Error ? error.message : 'Session revoke failed' } };
+    }
+}
+async function revokeAllSessionsActionSdk() {
+    const reqHeaders = await (0, headers_1.headers)();
+    try {
+        const response = await getIam().revokeAllSessions(reqHeaders);
+        await syncCookiesToNext(response);
+        return { ok: response.ok, status: response.status, data: await response.json().catch(() => ({})) };
+    }
+    catch (error) {
+        return { ok: false, status: 500, data: { error: 'Revoke-all failed' } };
+    }
+}

package/dist/nextjs/index.d.ts

@@ -2,7 +2,7 @@ import { NextRequest, NextResponse } from 'next/server';
 import { CoreIAM, CoreIAMIdentity } from '../core';
 export { CoreIAMProvider, useAuth } from './provider';
 export { coreIamMiddleware, coreIamAuth } from './middleware';
-export { getSession, loginActionSdk, registerActionSdk, logoutActionSdk, updateProfileActionSdk, setupMfaActionSdk, verifyMfaActionSdk, disableMfaActionSdk, requestOtpActionSdk, verifyOtpActionSdk } from './actions';
+export { getSession, loginActionSdk, registerActionSdk, logoutActionSdk, updateProfileActionSdk, setupMfaActionSdk, verifyMfaActionSdk, disableMfaActionSdk, requestOtpActionSdk, verifyOtpActionSdk, forgotPasswordActionSdk, resetPasswordActionSdk, listSessionsActionSdk, revokeSessionActionSdk, revokeAllSessionsActionSdk } from './actions';
 export declare class NextHandlers {
     private iam;
     constructor(iam?: CoreIAM);

package/dist/nextjs/index.js

@@ -1,6 +1,6 @@
 "use strict";
 Object.defineProperty(exports, "__esModule", { value: true });
-exports.OAuthHandlers = exports.NextHandlers = exports.verifyOtpActionSdk = exports.requestOtpActionSdk = exports.disableMfaActionSdk = exports.verifyMfaActionSdk = exports.setupMfaActionSdk = exports.updateProfileActionSdk = exports.logoutActionSdk = exports.registerActionSdk = exports.loginActionSdk = exports.getSession = exports.coreIamAuth = exports.coreIamMiddleware = exports.useAuth = exports.CoreIAMProvider = void 0;
+exports.OAuthHandlers = exports.NextHandlers = exports.revokeAllSessionsActionSdk = exports.revokeSessionActionSdk = exports.listSessionsActionSdk = exports.resetPasswordActionSdk = exports.forgotPasswordActionSdk = exports.verifyOtpActionSdk = exports.requestOtpActionSdk = exports.disableMfaActionSdk = exports.verifyMfaActionSdk = exports.setupMfaActionSdk = exports.updateProfileActionSdk = exports.logoutActionSdk = exports.registerActionSdk = exports.loginActionSdk = exports.getSession = exports.coreIamAuth = exports.coreIamMiddleware = exports.useAuth = exports.CoreIAMProvider = void 0;
 exports.auth = auth;
 // src/nextjs/index.ts
 const server_1 = require("next/server");
@@ -23,6 +23,11 @@ Object.defineProperty(exports, "verifyMfaActionSdk", { enumerable: true, get: fu
 Object.defineProperty(exports, "disableMfaActionSdk", { enumerable: true, get: function () { return actions_1.disableMfaActionSdk; } });
 Object.defineProperty(exports, "requestOtpActionSdk", { enumerable: true, get: function () { return actions_1.requestOtpActionSdk; } });
 Object.defineProperty(exports, "verifyOtpActionSdk", { enumerable: true, get: function () { return actions_1.verifyOtpActionSdk; } });
+Object.defineProperty(exports, "forgotPasswordActionSdk", { enumerable: true, get: function () { return actions_1.forgotPasswordActionSdk; } });
+Object.defineProperty(exports, "resetPasswordActionSdk", { enumerable: true, get: function () { return actions_1.resetPasswordActionSdk; } });
+Object.defineProperty(exports, "listSessionsActionSdk", { enumerable: true, get: function () { return actions_1.listSessionsActionSdk; } });
+Object.defineProperty(exports, "revokeSessionActionSdk", { enumerable: true, get: function () { return actions_1.revokeSessionActionSdk; } });
+Object.defineProperty(exports, "revokeAllSessionsActionSdk", { enumerable: true, get: function () { return actions_1.revokeAllSessionsActionSdk; } });
 class NextHandlers {
     iam;
     constructor(iam) {
@@ -62,6 +67,10 @@ class OAuthHandlers {
     }
     // Handles the initial redirect to Google/GitHub
     async handleInitiate(req, provider) {
+        // FIX (SDK-5): validate the provider segment before interpolation.
+        if (!core_1.OAUTH_PROVIDERS.has(provider)) {
+            return server_1.NextResponse.redirect(new URL('/auth/login', req.url));
+        }
         const redirectUri = `${process.env.NEXT_PUBLIC_APP_URL}/api/auth/callback/${provider}`;
         const response = await this.iam.proxy(`/auth/oauth/initiate/${provider}?redirectUri=${encodeURIComponent(redirectUri)}&scopes=email,profile`, { method: 'GET' }, req.headers);
         const data = await response.json();
@@ -72,11 +81,19 @@ class OAuthHandlers {
     }
     // Handles the callback from Google/GitHub
     async handleCallback(req, provider) {
+        // FIX (SDK-5): validate the provider segment before interpolation.
+        if (!core_1.OAUTH_PROVIDERS.has(provider)) {
+            return server_1.NextResponse.redirect(new URL('/auth/login', req.url));
+        }
         const { searchParams } = new URL(req.url);
         const code = searchParams.get('code');
         const state = searchParams.get('state');
         const redirectUri = `${process.env.NEXT_PUBLIC_APP_URL}/api/auth/callback/${provider}`;
-        const targetUrl = `/auth/oauth/callback/${provider}?code=${code}&state=${state}&redirectUri=${redirectUri}`;
+        // FIX (SDK-5): raw code/state/redirectUri here was a query-injection surface.
+        const targetUrl = `/auth/oauth/callback/${provider}`
+            + `?code=${encodeURIComponent(code ?? '')}`
+            + `&state=${encodeURIComponent(state ?? '')}`
+            + `&redirectUri=${encodeURIComponent(redirectUri)}`;
         const response = await this.iam.proxy(targetUrl, { method: 'GET' }, req.headers);
         const res = server_1.NextResponse.redirect(new URL('/', req.url));
         const setCookies = response.headers.getSetCookie();
@@ -89,8 +106,39 @@ class OAuthHandlers {
     }
 }
 exports.OAuthHandlers = OAuthHandlers;
+// FIX (SDK-7): bounded LRU instead of wholesale .clear() at 10k. Flushing the
+// whole map on overflow let an attacker cycle 10,001 distinct fake Bearer
+// tokens and evict every LEGIT entry — all real users' next requests re-hit
+// the backend verify (cache-stampede amplifier). LRU keeps hot legit entries
+// alive under exactly that attack. Hand-rolled on purpose: zero new
+// dependencies for a published SDK; semantics fully covered by vitest.
 const MAX_CACHE_SIZE = 10000;
+const CACHE_TTL_MS = 5 * 60 * 1000;
 const apiKeyCache = new Map();
+// LRU read: drop stale entries, and delete+re-set moves the entry to the
+// Map's tail — JavaScript Maps preserve insertion order, so the tail is
+// "most recently used" and the head is "least recently used".
+function cacheGet(token) {
+    const entry = apiKeyCache.get(token);
+    if (!entry)
+        return undefined;
+    if (entry.expires <= Date.now()) {
+        apiKeyCache.delete(token);
+        return undefined;
+    }
+    apiKeyCache.delete(token);
+    apiKeyCache.set(token, entry);
+    return entry;
+}
+// LRU write: insert at tail; if over capacity, evict the head (oldest use).
+function cacheSet(token, entry) {
+    apiKeyCache.set(token, entry);
+    if (apiKeyCache.size > MAX_CACHE_SIZE) {
+        const lru = apiKeyCache.keys().next().value;
+        if (lru !== undefined)
+            apiKeyCache.delete(lru);
+    }
+}
 async function auth(request) {
     const authHeader = request.headers.get('authorization');
     if (!authHeader?.startsWith('Bearer '))
@@ -99,15 +147,11 @@ async function auth(request) {
     const gatewayUrl = process.env.COREIAM_API_URL;
     if (!gatewayUrl)
         return null;
-    // 1. Check Cache
-    const cached = apiKeyCache.get(token);
-    if (cached && cached.expires > Date.now()) {
+    // 1. Check Cache (was: raw .get() + expiry check + wholesale .clear() on size)
+    const cached = cacheGet(token);
+    if (cached) {
         return cached.valid ? cached.identity : null;
     }
-    // FIX: Prevent memory leak by clearing cache if it gets too large
-    if (apiKeyCache.size >= MAX_CACHE_SIZE) {
-        apiKeyCache.clear(); // Simple crude eviction. In production SDK, use lru-cache.
-    }
     // 2. Call CoreIAM to verify
     try {
         const res = await fetch(`${gatewayUrl}/auth/api-keys/verify`, {
@@ -124,11 +168,11 @@ async function auth(request) {
                 sub: data.sub,
                 tenantId: data.tenantId,
             };
-            apiKeyCache.set(token, { valid: true, identity, expires: Date.now() + (5 * 60 * 1000) });
+            cacheSet(token, { valid: true, identity, expires: Date.now() + CACHE_TTL_MS });
             return identity;
         }
         else {
-            apiKeyCache.set(token, { valid: false, expires: Date.now() + (5 * 60 * 1000) });
+            cacheSet(token, { valid: false, expires: Date.now() + CACHE_TTL_MS });
             return null;
         }
     }

package/dist/nextjs/middleware.js

@@ -122,11 +122,11 @@ exports.coreIamMiddleware = coreIamMiddleware;
 //   }
 //   return { response: NextResponse.next(), isAuthenticated };
 // }
-// src/nextjs/middleware.ts
+// sdk/javascript/src/nextjs/middleware.ts
 const server_1 = require("next/server");
 //import { jwtVerify, createRemoteJWKSet } from 'jose';
 const core_1 = require("../core");
-const gatewayUrl = process.env.COREIAM_API_URL;
+const gatewayUrl = (0, core_1.resolveGatewayUrl)({ apiKey: process.env.COREIAM_API_KEY || '' });
 /**
 const JWKS = gatewayUrl
   ? createRemoteJWKSet(new URL(`${gatewayUrl}/.well-known/jwks.json`))
@@ -153,20 +153,56 @@ async function performRefresh(refreshTokenCookie, jwtCookie) {
         });
         if (!refreshRes.ok)
             return null;
+        // FIX (SDK-11): derive Max-Age from the backend's own Set-Cookie instead of
+        // hardcoding 24h/7d — the hardcoded values silently overrode the backend's
+        // post-W1 policy (jwt Max-Age 900). The backend is the source of truth.
         const setCookies = refreshRes.headers.getSetCookie();
         let newJwt = '', newRefreshToken = '';
+        let jwtMaxAge = 900, refreshMaxAge = 7 * 24 * 60 * 60; // fallbacks if backend sends no Max-Age
         setCookies.forEach(cookie => {
-            if (cookie.startsWith('jwt='))
+            const maxAgeMatch = cookie.match(/max-age=(-?\d+)/i);
+            if (cookie.startsWith('jwt=')) {
                 newJwt = cookie.split(';')[0].split('=')[1];
-            if (cookie.startsWith('refreshToken='))
+                if (maxAgeMatch)
+                    jwtMaxAge = parseInt(maxAgeMatch[1], 10);
+            }
+            if (cookie.startsWith('refreshToken=')) {
                 newRefreshToken = cookie.split(';')[0].split('=')[1];
+                if (maxAgeMatch)
+                    refreshMaxAge = parseInt(maxAgeMatch[1], 10);
+            }
         });
-        return newJwt ? { jwt: newJwt, refreshToken: newRefreshToken } : null;
+        return newJwt ? { jwt: newJwt, refreshToken: newRefreshToken, jwtMaxAge, refreshMaxAge } : null;
     }
     catch (error) {
         return null;
     }
 }
+// async function performRefresh(
+//   refreshTokenCookie: { value: string } | undefined,
+//   jwtCookie: { value: string } | undefined,
+// ): Promise<{ jwt: string; refreshToken: string } | null> {
+//   if (!gatewayUrl) return null;
+//   try {
+//     const refreshRes = await fetch(`${gatewayUrl}/auth/refresh-token`, {
+//       method: 'POST',
+//       headers: {
+//         'X-API-Key': process.env.COREIAM_API_KEY!,
+//         'cookie': `refreshToken=${refreshTokenCookie?.value || ''}; jwt=${jwtCookie?.value || ''}`,
+//       },
+//     });
+//     if (!refreshRes.ok) return null;
+//     const setCookies = refreshRes.headers.getSetCookie();
+//     let newJwt = '', newRefreshToken = '';
+//     setCookies.forEach(cookie => {
+//       if (cookie.startsWith('jwt=')) newJwt = cookie.split(';')[0].split('=')[1];
+//       if (cookie.startsWith('refreshToken=')) newRefreshToken = cookie.split(';')[0].split('=')[1];
+//     });
+//     return newJwt ? { jwt: newJwt, refreshToken: newRefreshToken } : null;
+//   } catch (error) {
+//     return null;
+//   }
+// }
 /**
  * Helper function for custom middleware (proxy.ts).
  * Returns the response and authentication state.
@@ -182,7 +218,12 @@ async function coreIamAuth(request) {
         if (method === 'OPTIONS') {
             const res = new server_1.NextResponse(null, { status: 204 }); // 204 No Content
             const origin = request.headers.get('origin');
-            if (origin) {
+            // FIX (SDK-14): reflect only known origins — reflecting ANY origin together
+            // with Allow-Credentials is a footgun even though this only answers
+            // preflights (actual responses carry no CORS headers).
+            const allowedOrigins = (process.env.COREIAM_ALLOWED_ORIGINS || '')
+                .split(',').map(s => s.trim()).filter(Boolean);
+            if (origin && (origin === request.nextUrl.origin || allowedOrigins.includes(origin))) {
                 res.headers.set('Access-Control-Allow-Origin', origin);
                 res.headers.set('Access-Control-Allow-Methods', 'GET, POST, PUT, DELETE, OPTIONS');
                 res.headers.set('Access-Control-Allow-Headers', 'Content-Type, Authorization, X-CSRF-Token');
@@ -194,7 +235,7 @@ async function coreIamAuth(request) {
         const iam = getIam();
         if (!iam) {
             return {
-                response: new server_1.NextResponse('CoreIAM is not configured (COREIAM_API_URL / COREIAM_API_KEY)', { status: 500 }),
+                response: new server_1.NextResponse('CoreIAM is not configured (COREIAM_API_KEY required; gateway URL defaults by key prefix)', { status: 500 }),
                 isAuthenticated: false,
             };
         }
@@ -235,7 +276,7 @@ async function coreIamAuth(request) {
             </head>
             <body>
               <p>Account linked successfully! Redirecting...</p>
-              <script>window.location.href = "${finalUrl}";</script>
+              <script>window.location.href = ${JSON.stringify(finalUrl)};</script>
             </body>
             </html>
           `;
@@ -263,25 +304,46 @@ async function coreIamAuth(request) {
         let targetPath = pathname.replace('/api/auth', '/auth');
         const body = method !== 'GET' ? await request.json().catch(() => undefined) : undefined;
         // FIX: Special routing for OAuth Initiate
+        // if (pathname.startsWith('/api/auth/oauth/') && !pathname.includes('callback') && !pathname.includes('link')) {
+        //   const provider = pathname.split('/').pop();
+        //   const redirectUri = `${process.env.NEXT_PUBLIC_APP_URL}/api/auth/callback/${provider}`;
+        //   targetPath = `/auth/oauth/initiate/${provider}?redirectUri=${encodeURIComponent(redirectUri)}&scopes=email,profile`;
+        // }
+        // FIX: Special routing for OAuth Initiate
         if (pathname.startsWith('/api/auth/oauth/') && !pathname.includes('callback') && !pathname.includes('link')) {
-            const provider = pathname.split('/').pop();
+            const provider = pathname.split('/').pop() || '';
+            // FIX (SDK-5): reject unknown providers before URL interpolation.
+            if (!core_1.OAUTH_PROVIDERS.has(provider)) {
+                return { response: new server_1.NextResponse('Unsupported OAuth provider', { status: 400 }), isAuthenticated: false };
+            }
             const redirectUri = `${process.env.NEXT_PUBLIC_APP_URL}/api/auth/callback/${provider}`;
             targetPath = `/auth/oauth/initiate/${provider}?redirectUri=${encodeURIComponent(redirectUri)}&scopes=email,profile`;
         }
-        // FIX: Special routing for OAuth Callback
         if (pathname.startsWith('/api/auth/callback/')) {
-            const provider = pathname.split('/').pop();
+            const provider = pathname.split('/').pop() || '';
+            // FIX (SDK-5): reject unknown providers before URL interpolation.
+            if (!core_1.OAUTH_PROVIDERS.has(provider)) {
+                return { response: new server_1.NextResponse('Unsupported OAuth provider', { status: 400 }), isAuthenticated: false };
+            }
             const searchParams = new URL(request.url).searchParams;
             const code = searchParams.get('code');
             const state = searchParams.get('state');
             const redirectUri = `${process.env.NEXT_PUBLIC_APP_URL}/api/auth/callback/${provider}`;
-            targetPath = `/auth/oauth/callback/${provider}?code=${code}&state=${state}&redirectUri=${redirectUri}`;
+            // targetPath = `/auth/oauth/callback/${provider}?code=${code}&state=${state}&redirectUri=${redirectUri}`;
+            // OAuth callback targetPath — encode all three:
+            targetPath = `/auth/oauth/callback/${provider}`
+                + `?code=${encodeURIComponent(code ?? '')}`
+                + `&state=${encodeURIComponent(state ?? '')}`
+                + `&redirectUri=${encodeURIComponent(redirectUri)}`;
         }
-        const response = await iam.proxy(targetPath, {
+        const init = {
             method,
             body: body ? JSON.stringify(body) : undefined,
             headers: { 'Content-Type': 'application/json' },
-        }, request.headers);
+        };
+        const response = core_1.CSRF_PROTECTED_PATHS.has(targetPath)
+            ? await iam.proxyWithCsrfProtection(targetPath, init, request.headers)
+            : await iam.proxy(targetPath, init, request.headers);
         // Handle OAuth Initiate Redirects
         if (pathname.startsWith('/api/auth/oauth/') && !pathname.includes('callback') && !pathname.includes('link')) {
             const data = await response.json().catch(() => ({}));
@@ -349,6 +411,13 @@ async function coreIamAuth(request) {
     
     */
     // 2. LOCAL JWT VERIFICATION & REFRESH
+    // FIX (SDK-9): strip any client-supplied `x-coreiam-identity` header BEFORE
+    // any pass-through. getSession() (actions.ts) trusts this header verbatim,
+    // and on unauthenticated paths the original request headers flow straight
+    // into Server Components — a forged header manufactured an identity there.
+    // Only branches that complete verification re-attach it, to this copy.
+    const sanitizedHeaders = new Headers(request.headers);
+    sanitizedHeaders.delete('x-coreiam-identity');
     //    Now delegates to CoreIAM.verifySession — the same code path Express
     //    users get, so the two implementations can never drift.
     const jwtCookie = request.cookies.get("jwt");
@@ -358,7 +427,7 @@ async function coreIamAuth(request) {
     if (client) {
         const result = await client.verifySession(request.headers);
         if (result.identity) {
-            const requestHeaders = new Headers(request.headers);
+            const requestHeaders = new Headers(sanitizedHeaders);
             requestHeaders.set('x-coreiam-identity', JSON.stringify(result.identity));
             return {
                 response: server_1.NextResponse.next({ request: { headers: requestHeaders } }),
@@ -380,33 +449,56 @@ async function coreIamAuth(request) {
         }
         const result = await refreshInFlight;
         if (result) {
-            const requestHeaders = new Headers(request.headers);
+            const requestHeaders = new Headers(sanitizedHeaders);
             requestHeaders.set('cookie', `jwt=${result.jwt}; refreshToken=${result.refreshToken}`);
             requestHeaders.set('Authorization', `Bearer ${result.jwt}`);
-            try {
-                const payloadB64 = result.jwt.split('.')[1];
-                const payloadStr = Buffer.from(payloadB64, 'base64').toString('utf8');
-                const payload = JSON.parse(payloadStr);
-                requestHeaders.set('x-coreiam-identity', JSON.stringify({
-                    sub: payload.sub,
-                    email: payload.email,
-                    tenantId: payload.tenantId,
-                    roles: payload.roles || []
-                }));
+            // try {
+            //   const payloadB64 = result.jwt.split('.')[1];
+            //   const payloadStr = Buffer.from(payloadB64, 'base64').toString('utf8');
+            //   const payload = JSON.parse(payloadStr);
+            //   requestHeaders.set('x-coreiam-identity', JSON.stringify({
+            //     sub: payload.sub,
+            //     email: payload.email,
+            //     tenantId: payload.tenantId,
+            //     roles: payload.roles || []
+            //   }));
+            // } catch {}
+            // // FIX: forward requestHeaders (fresh cookie + identity) — NOT sanitizedHeaders,
+            // // which still carries the old expired cookie.
+            // const response = NextResponse.next({ request: { headers: requestHeaders } });
+            // const isProd = process.env.NODE_ENV === 'production';
+            // response.cookies.set('jwt', result.jwt, { httpOnly: true, secure: isProd, sameSite: 'strict', maxAge: 24 * 60 * 60 });
+            // response.cookies.set('refreshToken', result.refreshToken, { httpOnly: true, secure: isProd, sameSite: 'strict', maxAge: 7 * 24 * 60 * 60 });
+            // return { response, isAuthenticated: true };
+            // FIX (SDK-12): don't decode the JWT by hand. Buffer isn't available in
+            // the Edge runtime (Next middleware's default) — that throw was silently
+            // swallowed by the empty catch, leaving x-coreiam-identity missing on Edge.
+            // Verifying through the same funnel everything else uses fixes that and
+            // keeps ONE verification implementation. verifySession accepts a
+            // cookie-header string.
+            const verified = await client?.verifySession(`jwt=${result.jwt}`);
+            if (verified?.identity) {
+                requestHeaders.set('x-coreiam-identity', JSON.stringify(verified.identity));
             }
-            catch { }
+            // FIX: forward requestHeaders (fresh cookie + identity) — NOT sanitizedHeaders,
+            // which still carries the old expired cookie.
             const response = server_1.NextResponse.next({ request: { headers: requestHeaders } });
             const isProd = process.env.NODE_ENV === 'production';
-            response.cookies.set('jwt', result.jwt, { httpOnly: true, secure: isProd, sameSite: 'strict', maxAge: 24 * 60 * 60 });
-            response.cookies.set('refreshToken', result.refreshToken, { httpOnly: true, secure: isProd, sameSite: 'strict', maxAge: 7 * 24 * 60 * 60 });
+            // FIX (SDK-11): Max-Age derived from the backend's own Set-Cookie (see
+            // performRefresh) instead of hardcoded 24h/7d, and sameSite 'lax' to match
+            // the link-confirm handler — previously the only lax/strict mismatch.
+            response.cookies.set('jwt', result.jwt, { httpOnly: true, secure: isProd, sameSite: 'lax', maxAge: result.jwtMaxAge });
+            response.cookies.set('refreshToken', result.refreshToken, { httpOnly: true, secure: isProd, sameSite: 'lax', maxAge: result.refreshMaxAge });
             return { response, isAuthenticated: true };
         }
-        const response = server_1.NextResponse.next();
+        // FIX (SDK-9): failure branch must forward sanitizedHeaders too — bare next()
+        // passes the original headers through, re-opening the forged-header hole.
+        const response = server_1.NextResponse.next({ request: { headers: sanitizedHeaders } });
         response.cookies.delete('jwt');
         response.cookies.delete('refreshToken');
         return { response, isAuthenticated: false };
     }
-    return { response: server_1.NextResponse.next(), isAuthenticated: false };
+    return { response: server_1.NextResponse.next({ request: { headers: sanitizedHeaders } }), isAuthenticated: false };
 }
 /**
  * 1-line middleware factory for developers who don't need custom routing.
@@ -416,7 +508,10 @@ function coreIamMiddleware(options = {}) {
     return async (request) => {
         const { response, isAuthenticated } = await coreIamAuth(request);
         const pathname = request.nextUrl.pathname;
-        const isPublicRoute = publicRoutes.some(route => pathname.startsWith(route));
+        // const isPublicRoute = publicRoutes.some(route => pathname.startsWith(route));
+        // FIX (SDK-15): exact-segment prefix match — '/blog' must not also make
+        // '/blog-admin' public. Tolerates routes declared with a trailing slash.
+        const isPublicRoute = publicRoutes.some(route => pathname === route || pathname.startsWith(route.endsWith('/') ? route : route + '/'));
         // If not authenticated and trying to access a protected route
         if (!isAuthenticated && !isPublicRoute) {
             const redirect = server_1.NextResponse.redirect(new URL(signInUrl, request.url));

package/dist/nextjs/provider.d.ts

@@ -1,5 +1,5 @@
 import React from 'react';
-import type { CoreIAMIdentity } from '../core';
+import { type CoreIAMIdentity } from '../core';
 interface AuthContextType {
     identity: CoreIAMIdentity | null;
     isLoading: boolean;
@@ -21,6 +21,22 @@ interface AuthContextType {
         error?: string;
     }>;
     refetchIdentity: () => Promise<void>;
+    requestOtp: (email: string) => Promise<{
+        success?: boolean;
+        error?: string;
+    }>;
+    verifyOtp: (email: string, otp: string) => Promise<{
+        success?: boolean;
+        error?: string;
+    }>;
+    forgotPassword: (email: string) => Promise<{
+        success?: boolean;
+        error?: string;
+    }>;
+    resetPassword: (email: string, otp: string, newPassword: string) => Promise<{
+        success?: boolean;
+        error?: string;
+    }>;
 }
 export declare function CoreIAMProvider({ children, initialIdentity }: {
     children: React.ReactNode;