@coreiam/auth 1.0.392-beta.1 → 1.0.392-beta.12

package/dist/nextjs/provider.js

@@ -51,7 +51,7 @@
 // export function useAuth() {
 //   return useContext(AuthContext);
 // }
-// src/nextjs/provider.tsx
+// sdk/javascript/src/nextjs/provider.tsx
 'use client';
 Object.defineProperty(exports, "__esModule", { value: true });
 exports.CoreIAMProvider = CoreIAMProvider;
@@ -60,6 +60,7 @@ const jsx_runtime_1 = require("react/jsx-runtime");
 const react_1 = require("react");
 const navigation_1 = require("next/navigation");
 const actions_1 = require("./actions");
+const core_1 = require("../core");
 const AuthContext = (0, react_1.createContext)({
     identity: null,
     isLoading: true,
@@ -69,6 +70,10 @@ const AuthContext = (0, react_1.createContext)({
     register: async () => ({ error: 'Not mounted' }),
     verifyMfa: async () => ({ error: 'Not mounted' }),
     refetchIdentity: async () => { },
+    requestOtp: async () => ({ error: 'Not mounted' }),
+    verifyOtp: async () => ({ error: 'Not mounted' }),
+    forgotPassword: async () => ({ error: 'Not mounted' }),
+    resetPassword: async () => ({ error: 'Not mounted' }),
 });
 function CoreIAMProvider({ children, initialIdentity }) {
     const [identity, setIdentity] = (0, react_1.useState)(initialIdentity ?? null);
@@ -107,9 +112,19 @@ function CoreIAMProvider({ children, initialIdentity }) {
     const verifyMfa = async (tempToken, code) => {
         setIsLoading(true);
         try {
+            // FIX (SDK-2): perform the CSRF handshake before calling /api/auth/mfa/login.
+            // That path is in CSRF_PROTECTED_PATHS and the backend CsrfGuard is
+            // double-submit (the x-csrf-token header must equal the csrfToken cookie).
+            // The login-phase handshake already placed the csrf cookie in the browser
+            // jar, so only the header echo was missing — which made every provider
+            // MFA login fail with 403. This now mirrors the login() flow exactly.
+            const csrfToken = await getCsrfToken();
             const res = await fetch('/api/auth/mfa/login', {
                 method: 'POST',
-                headers: { 'Content-Type': 'application/json' },
+                headers: {
+                    'Content-Type': 'application/json',
+                    'x-csrf-token': csrfToken,
+                },
                 credentials: 'include',
                 body: JSON.stringify({ tempToken, code }),
             });
@@ -128,6 +143,101 @@ function CoreIAMProvider({ children, initialIdentity }) {
             setIsLoading(false);
         }
     };
+    const requestOtp = async (email) => {
+        setIsLoading(true);
+        try {
+            const csrfToken = await getCsrfToken();
+            const res = await fetch('/api/auth/request-otp', {
+                method: 'POST',
+                headers: { 'Content-Type': 'application/json', 'x-csrf-token': csrfToken },
+                credentials: 'include',
+                body: JSON.stringify({ email }),
+            });
+            const data = await res.json();
+            if (!res.ok)
+                return { error: data.message || 'OTP request failed' };
+            return { success: true };
+        }
+        catch {
+            return { error: 'Something went wrong' };
+        }
+        finally {
+            setIsLoading(false);
+        }
+    };
+    const verifyOtp = async (email, otp) => {
+        setIsLoading(true);
+        try {
+            const csrfToken = await getCsrfToken();
+            const res = await fetch('/api/auth/verify-otp', {
+                method: 'POST',
+                headers: { 'Content-Type': 'application/json', 'x-csrf-token': csrfToken },
+                credentials: 'include',
+                body: JSON.stringify({ email, otp }),
+            });
+            const data = await res.json();
+            if (!res.ok)
+                return { error: data.message || 'Invalid or expired OTP' };
+            // Session established (jwt cookie set server-side) — hard refresh to
+            // let the server re-render authenticated, same as login()/verifyMfa().
+            window.location.href = '/';
+            return { success: true };
+        }
+        catch {
+            return { error: 'Something went wrong' };
+        }
+        finally {
+            setIsLoading(false);
+        }
+    };
+    const forgotPassword = async (email) => {
+        setIsLoading(true);
+        try {
+            const csrfToken = await getCsrfToken();
+            const res = await fetch('/api/auth/request-reset', {
+                method: 'POST',
+                headers: { 'Content-Type': 'application/json', 'x-csrf-token': csrfToken },
+                credentials: 'include',
+                body: JSON.stringify({ email }),
+            });
+            const data = await res.json();
+            if (!res.ok)
+                return { error: data.message || 'Reset request failed' };
+            // Backend response is uniform (no account-existence leak) — treat
+            // success generically; UI copy ("if the account exists…") is the app's.
+            return { success: true };
+        }
+        catch {
+            return { error: 'Something went wrong' };
+        }
+        finally {
+            setIsLoading(false);
+        }
+    };
+    const resetPassword = async (email, otp, newPassword) => {
+        setIsLoading(true);
+        try {
+            const csrfToken = await getCsrfToken();
+            const res = await fetch('/api/auth/reset-password', {
+                method: 'POST',
+                headers: { 'Content-Type': 'application/json', 'x-csrf-token': csrfToken },
+                credentials: 'include',
+                body: JSON.stringify({ email, otp, newPassword }),
+            });
+            const data = await res.json();
+            if (!res.ok)
+                return { error: data.message || 'Password reset failed' };
+            // All sessions revoked server-side — route to login with the new password.
+            window.location.href = '/auth/login';
+            return { success: true };
+        }
+        catch {
+            return { error: 'Something went wrong' };
+        }
+        finally {
+            setIsLoading(false);
+        }
+    };
     const login = async (values, callbackUrl) => {
         setIsLoading(true);
         try {
@@ -151,7 +261,20 @@ function CoreIAMProvider({ children, initialIdentity }) {
                 return { twoFactor: true, tempToken: data.tempToken };
             }
             // Hard refresh to let server re-render with new cookies
-            window.location.href = callbackUrl || '/';
+            // FIX (SDK-8): defense-in-depth — only same-origin relative callback URLs.
+            // Airtight defense-in-depth against open redirects
+            const cb = callbackUrl || '/';
+            let target;
+            try {
+                target = new URL(cb, window.location.origin);
+            }
+            catch {
+                return { error: 'Invalid callback URL' };
+            }
+            if (target.origin !== window.location.origin) {
+                return { error: 'Invalid callback URL' };
+            }
+            window.location.href = target.pathname + target.search + target.hash;
             return { success: true };
         }
         catch {
@@ -192,6 +315,15 @@ function CoreIAMProvider({ children, initialIdentity }) {
             if (!res.ok) {
                 if (data.code === 'OAUTH_ACCOUNT_EXISTS') {
                     // Automatically redirect to the OAuth provider!
+                    // FIX (SDK-8): route only to known providers (local literal — importing
+                    // OAUTH_PROVIDERS from ../core would pull server code into the client bundle).
+                    if (!['google', 'github'].includes(data.provider)) {
+                        return { error: 'Unsupported provider' };
+                    }
+                    // Use the exported Set from core instead of a hardcoded array to prevent drift
+                    if (!core_1.OAUTH_PROVIDERS.has(data.provider)) {
+                        return { error: 'Unsupported provider' };
+                    }
                     window.location.href = `/api/auth/oauth/${data.provider}`;
                     return { success: true };
                 }
@@ -207,7 +339,7 @@ function CoreIAMProvider({ children, initialIdentity }) {
             setIsLoading(false);
         }
     };
-    return ((0, jsx_runtime_1.jsx)(AuthContext.Provider, { value: { identity, isLoading, isAuthenticated: !!identity, login, logout, register, verifyMfa, refetchIdentity }, children: children }));
+    return ((0, jsx_runtime_1.jsx)(AuthContext.Provider, { value: { identity, isLoading, isAuthenticated: !!identity, login, logout, register, verifyMfa, refetchIdentity, requestOtp, verifyOtp, forgotPassword, resetPassword }, children: children }));
 }
 function useAuth() {
     return (0, react_1.useContext)(AuthContext);

package/dist/react/provider.js

@@ -44,6 +44,7 @@ export function useAuth() {
 }
 
 */
+//sdk/javascript/src/react/provider.tsx
 'use client';
 Object.defineProperty(exports, "__esModule", { value: true });
 exports.CoreIAMProvider = CoreIAMProvider;

package/package.json

@@ -1,6 +1,6 @@
 {
   "name": "@coreiam/auth",
-  "version": "1.0.392-beta.1",
+  "version": "1.0.392-beta.12",
   "main": "./dist/core/index.js",
   "types": "./dist/core/index.d.ts",
   "exports": {
@@ -23,6 +23,16 @@
       "types": "./dist/express/index.d.ts",
       "import": "./dist/express/index.js",
       "require": "./dist/express/index.js"
+    },
+    "./hono": {
+      "types": "./dist/hono/index.d.ts",
+      "import": "./dist/hono/index.js",
+      "require": "./dist/hono/index.js"
+    },
+    "./ui": {
+      "types": "./dist/ui/buttons.d.ts",
+      "import": "./dist/ui/buttons.js",
+      "require": "./dist/ui/buttons.js"
     }
   },
   "files": [
@@ -30,24 +40,31 @@
   ],
   "scripts": {
     "build": "tsc",
-    "test": "vitest run"
+    "test": "vitest run",
+    "prepublishOnly": "grep -q dev.e-qalam.com dist/core/index.js && grep -q api.e-qalam.com dist/core/index.js || { echo \"STALE DIST: rebuild before publish (beta.11 lesson)\"; exit 1; }"
   },
   "keywords": [
     "coreiam",
     "auth",
     "saas",
     "multi-tenant",
-    "nextjs"
+    "nextjs",
+    "hono",
+    "react",
+    "vite",
+    "express"
   ],
-  "author": "coreIAM",
+  "author": "coreiam",
   "license": "MIT",
   "publishConfig": {
-    "access": "public"
+    "access": "public",
+    "tag": "beta"
   },
   "peerDependencies": {
     "express": "^4.0.0 || ^5.0.0",
     "next": ">=14",
-    "react": ">=18"
+    "react": ">=18",
+    "hono": ">=4"
   },
   "peerDependenciesMeta": {
     "next": {
@@ -58,6 +75,9 @@
     },
     "express": {
       "optional": true
+    },
+    "hono": {
+      "optional": true
     }
   },
   "devDependencies": {
@@ -69,7 +89,8 @@
     "react": "^19.2.7",
     "supertest": "^7.3.0",
     "typescript": "^5.0.0",
-    "vitest": "^3.2.7"
+    "vitest": "^3.2.7",
+    "hono": "^4.6.0"
   },
   "dependencies": {
     "@radix-ui/react-slot": "^1.3.3",