@coreiam/auth 1.0.392-beta.2 → 1.0.392-beta.3

package/dist/core/index.d.ts

@@ -142,3 +142,4 @@ export declare class CoreIAM {
     requestOtp(body: any, incomingHeaders: Headers): Promise<Response>;
     verifyOtp(body: any, incomingHeaders: Headers): Promise<Response>;
 }
+export declare const CSRF_PROTECTED_PATHS: ReadonlySet<string>;

package/dist/core/index.js

@@ -1,6 +1,6 @@
 "use strict";
 Object.defineProperty(exports, "__esModule", { value: true });
-exports.CoreIAM = void 0;
+exports.CSRF_PROTECTED_PATHS = exports.CoreIAM = void 0;
 exports.toIdentity = toIdentity;
 // src/core/index.ts
 const jose_1 = require("jose");
@@ -104,15 +104,33 @@ class CoreIAM {
             return input.get('cookie') || '';
         return input.cookie || '';
     }
+    // private readSessionCookie(input: SessionInput): string | null {
+    //   const raw = this.readCookieHeader(input);
+    //   if (!raw) return null;
+    //   // Anchored to a real cookie-name boundary (same pattern proxy() uses),
+    //   // so a cookie named "notjwt" or "xjwt" can never match.
+    //   const escaped = this.sessionCookieName.replace(/[.*+?^${}()|[\]\\]/g, '\\$&');
+    //   const match = raw.match(new RegExp(`(?:^|;\\s*)${escaped}=([^;]+)`));
+    //   return match ? decodeURIComponent(match[1]) : null;
+    // }
+    // PATCH 1 — readSessionCookie: a corrupt cookie value (%E0%A4%A) currently
+    // throws URIError out of verifySession → 500 on /session. A corrupt value is
+    // an invalid token, not a server error: return it raw; jwtVerify classifies
+    // it as 'invalid_signature'.
     readSessionCookie(input) {
         const raw = this.readCookieHeader(input);
         if (!raw)
             return null;
-        // Anchored to a real cookie-name boundary (same pattern proxy() uses),
-        // so a cookie named "notjwt" or "xjwt" can never match.
         const escaped = this.sessionCookieName.replace(/[.*+?^${}()|[\]\\]/g, '\\$&');
         const match = raw.match(new RegExp(`(?:^|;\\s*)${escaped}=([^;]+)`));
-        return match ? decodeURIComponent(match[1]) : null;
+        if (!match)
+            return null;
+        try {
+            return decodeURIComponent(match[1]);
+        }
+        catch {
+            return match[1];
+        }
     }
     async verifySession(input) {
         const token = this.readSessionCookie(input);
@@ -376,3 +394,8 @@ class CoreIAM {
     }
 }
 exports.CoreIAM = CoreIAM;
+exports.CSRF_PROTECTED_PATHS = new Set([
+    '/auth/login', '/auth/register', '/auth/discover-tenants',
+    '/auth/request-otp', '/auth/verify-otp', '/auth/mfa/login',
+    '/auth/profile', '/auth/mfa/setup', '/auth/mfa/verify', '/auth/mfa/disable',
+]);

package/dist/express/index.js

@@ -6,11 +6,6 @@ exports.requireAuth = requireAuth;
 // src/express/index.ts
 const express_1 = require("express");
 const core_1 = require("../core");
-const CSRF_PROTECTED = new Set([
-    '/auth/login', '/auth/register', '/auth/profile',
-    '/auth/mfa/setup', '/auth/mfa/verify', '/auth/mfa/disable',
-    '/auth/request-otp', '/auth/verify-otp',
-]);
 /** Express 4 does not catch async rejections — route them to next(err). */
 const wrap = (fn) => (req, res, next) => { fn(req, res, next).catch(next); };
 function sessionCookie(name, value, maxAgeSec, isProd) {
@@ -70,7 +65,12 @@ function coreIamExpress(options) {
         const code = req.query.code;
         const state = req.query.state;
         const redirectUri = `${appUrl}${authPath}/callback/${provider}`;
-        const target = `/auth/oauth/callback/${provider}?code=${code}&state=${state}&redirectUri=${encodeURIComponent(redirectUri)}`;
+        // const target = `/auth/oauth/callback/${provider}?code=${code}&state=${state}&redirectUri=${encodeURIComponent(redirectUri)}`;
+        // OAuth callback — encode all three params:
+        const target = `/auth/oauth/callback/${provider}`
+            + `?code=${encodeURIComponent(String(code ?? ''))}`
+            + `&state=${encodeURIComponent(String(state ?? ''))}`
+            + `&redirectUri=${encodeURIComponent(redirectUri)}`;
         const response = await iam.proxy(target, { method: 'GET' }, toHeaders(req));
         const data = await response.json().catch(() => ({}));
         // Account linking: redirect to CoreIAM's hosted confirmation page
@@ -138,7 +138,7 @@ function coreIamExpress(options) {
             init.body = req.body ? JSON.stringify(req.body) : undefined;
             init.headers = { 'Content-Type': 'application/json' };
         }
-        const response = CSRF_PROTECTED.has(target)
+        const response = core_1.CSRF_PROTECTED_PATHS.has(target)
             ? await iam.proxyWithCsrfProtection(target, init, toHeaders(req))
             : await iam.proxy(target, init, toHeaders(req));
         const data = await response.json().catch(() => ({}));

package/dist/hono/index.d.ts

@@ -0,0 +1,33 @@
+import { Hono, type MiddlewareHandler } from 'hono';
+import { CoreIAMIdentity } from '../core';
+export interface CoreIamHonoOptions {
+    apiKey: string;
+    baseUrl: string;
+    /** Your app's public URL (OAuth callbacks redirect back here). */
+    appUrl: string;
+    /** Mount path of the adapter. MUST match how you mount it. Default '/api/auth'. */
+    authPath?: string;
+    signInUrl?: string;
+    successUrl?: string;
+}
+/** Pass to your app: `new Hono<CoreIAMEnv>()` so `c.get('identity')` is typed. */
+export type CoreIAMEnv = {
+    Variables: {
+        identity: CoreIAMIdentity;
+    };
+};
+/**
+ * Drop-in auth router for Hono (Node, Bun, Deno, Workers).
+ *   const app = new Hono();
+ *   app.route('/api/auth', coreIamHono({ apiKey, baseUrl, appUrl }));
+ * Same behavior as the Express adapter: CSRF handshake, OAuth + account
+ * linking, cookie forwarding, silent refresh on /session.
+ */
+export declare function coreIamHono(options: CoreIamHonoOptions): Hono;
+export interface RequireAuthConfig {
+    apiKey?: string;
+    baseUrl?: string;
+    signInUrl?: string;
+}
+/** Route guard: local verify → c.get('identity'); 401s API requests, redirects pages. */
+export declare function requireAuth(config?: RequireAuthConfig): MiddlewareHandler<CoreIAMEnv>;

package/dist/hono/index.js

@@ -0,0 +1,195 @@
+"use strict";
+Object.defineProperty(exports, "__esModule", { value: true });
+exports.coreIamHono = coreIamHono;
+exports.requireAuth = requireAuth;
+// src/hono/index.ts
+const hono_1 = require("hono");
+const core_1 = require("../core");
+/**
+ * Drop-in auth router for Hono (Node, Bun, Deno, Workers).
+ *   const app = new Hono();
+ *   app.route('/api/auth', coreIamHono({ apiKey, baseUrl, appUrl }));
+ * Same behavior as the Express adapter: CSRF handshake, OAuth + account
+ * linking, cookie forwarding, silent refresh on /session.
+ */
+function coreIamHono(options) {
+    const appUrl = options.appUrl.replace(/\/+$/, '');
+    const authPath = (options.authPath ?? '/api/auth').replace(/\/+$/, '');
+    const successUrl = options.successUrl ?? '/';
+    const signInUrl = options.signInUrl ?? '/login';
+    const gatewayUrl = options.baseUrl.replace(/\/+$/, '');
+    const isProd = process.env.NODE_ENV === 'production';
+    const iam = new core_1.CoreIAM(options);
+    const app = new hono_1.Hono();
+    // c.req.path is always the FULL path (Hono does not rewrite it per sub-app),
+    // so the mount prefix must be stripped by hand to get '/login' → '/auth/login'.
+    const relPath = (c) => {
+        const p = c.req.path;
+        if (p === authPath)
+            return '/';
+        if (p.startsWith(`${authPath}/`))
+            return p.slice(authPath.length);
+        if (process.env.NODE_ENV !== 'production') {
+            console.warn(`[coreIamHono] ${p} does not start with authPath '${authPath}' — ` +
+                `if you mounted the adapter elsewhere, pass the same value as authPath.`);
+        }
+        return p;
+    };
+    // Same attributes as the Express adapter's sessionCookie().
+    const sessionCookie = (name, value, maxAgeSec) => `${name}=${encodeURIComponent(value)}; Path=/; HttpOnly; SameSite=Lax; Max-Age=${maxAgeSec}${isProd ? '; Secure' : ''}`;
+    // Mirrors the Express adapter (json() + urlencoded()): both content types
+    // accepted on every auth route, re-serialized as JSON for the gateway.
+    const readBody = async (c) => {
+        if ((c.req.header('content-type') || '').includes('application/x-www-form-urlencoded')) {
+            return Object.fromEntries(new URLSearchParams(await c.req.text()).entries());
+        }
+        return c.req.json().catch(() => undefined);
+    };
+    // ── CORS preflight short-circuit — same as the Next.js middleware, so ──
+    // cross-origin frontends work with zero setup. Same-origin (the documented
+    // pattern) never sends OPTIONS.
+    app.options('*', (c) => {
+        const origin = c.req.header('origin');
+        if (origin) {
+            c.header('Access-Control-Allow-Origin', origin);
+            c.header('Access-Control-Allow-Credentials', 'true');
+            c.header('Access-Control-Allow-Methods', 'GET, POST, PUT, DELETE, OPTIONS');
+            c.header('Access-Control-Allow-Headers', 'Content-Type, Authorization, X-CSRF-Token');
+            c.header('Vary', 'Origin', { append: true });
+        }
+        return c.body(null, 204);
+    });
+    // ── GET {authPath}/session — local verify + silent refresh (React provider) ──
+    app.get('/session', async (c) => {
+        const result = await iam.verifySession(c.req.raw.headers);
+        if (result.identity)
+            return c.json(result.identity);
+        if (result.reason === 'expired') {
+            const { identity, setCookies } = await iam.refreshSession(c.req.raw.headers);
+            if (identity) {
+                setCookies?.forEach((sc) => c.header('Set-Cookie', sc, { append: true }));
+                return c.json(identity);
+            }
+        }
+        return c.json({ error: 'unauthenticated' }, 401);
+    });
+    // ── GET {authPath}/oauth/:provider — initiate ──
+    app.get('/oauth/:provider', async (c, next) => {
+        const provider = c.req.param('provider');
+        if (provider === 'link')
+            return next(); // link/confirm is POSTed below
+        const redirectUri = `${appUrl}${authPath}/callback/${provider}`;
+        const target = `/auth/oauth/initiate/${provider}?redirectUri=${encodeURIComponent(redirectUri)}&scopes=email,profile`;
+        const response = await iam.proxy(target, { method: 'GET' }, c.req.raw.headers);
+        const data = await response.json().catch(() => ({}));
+        if (data.url)
+            return c.redirect(data.url, 302);
+        return c.redirect(signInUrl, 302);
+    });
+    // ── GET {authPath}/callback/:provider ──
+    app.get('/callback/:provider', async (c) => {
+        const provider = c.req.param('provider');
+        const code = c.req.query('code');
+        const state = c.req.query('state');
+        const redirectUri = `${appUrl}${authPath}/callback/${provider}`;
+        const target = `/auth/oauth/callback/${provider}`
+            + `?code=${encodeURIComponent(code ?? '')}`
+            + `&state=${encodeURIComponent(state ?? '')}`
+            + `&redirectUri=${encodeURIComponent(redirectUri)}`;
+        const response = await iam.proxy(target, { method: 'GET' }, c.req.raw.headers);
+        const data = (await response.json().catch(() => ({})));
+        // Account linking → CoreIAM's hosted confirmation page
+        if (data.action === 'link_candidate') {
+            const redirect = new URL(`${gatewayUrl}/auth/hosted/confirm-link`);
+            redirect.searchParams.set('token', data.tempToken);
+            redirect.searchParams.set('provider', data.provider);
+            redirect.searchParams.set('email', data.email || '');
+            redirect.searchParams.set('appOrigin', appUrl);
+            return c.redirect(redirect.toString(), 303);
+        }
+        // Normal login: forward gateway cookies, then redirect.
+        response.headers.getSetCookie().forEach((sc) => c.header('Set-Cookie', sc, { append: true }));
+        return c.redirect(successUrl, 302);
+    });
+    // ── POST {authPath}/oauth/link/confirm (hosted page posts urlencoded) ──
+    app.post('/oauth/link/confirm', async (c) => {
+        const contentType = c.req.header('content-type') || '';
+        let formData;
+        if (contentType.includes('application/x-www-form-urlencoded')) {
+            const params = new URLSearchParams(await c.req.text());
+            formData = { tempToken: params.get('tempToken') ?? undefined, password: params.get('password') ?? undefined };
+        }
+        else {
+            formData = (await c.req.json().catch(() => ({})));
+        }
+        const response = await iam.proxy('/auth/oauth/link/confirm', {
+            method: 'POST',
+            body: JSON.stringify(formData),
+            headers: { 'Content-Type': 'application/json' },
+        }, c.req.raw.headers);
+        const data = (await response.json().catch(() => ({})));
+        if (response.ok && data.success) {
+            const finalUrl = new URL(data.redirectUri || '/', appUrl).toString();
+            if (data.accessToken)
+                c.header('Set-Cookie', sessionCookie('jwt', data.accessToken, 24 * 60 * 60), { append: true });
+            if (data.clientRefreshToken)
+                c.header('Set-Cookie', sessionCookie('refreshToken', data.clientRefreshToken, 7 * 24 * 60 * 60), { append: true });
+            // 200 + JS redirect — NOT a 303: breaks the cross-site redirect chain so
+            // the browser sends the freshly-set SameSite=Lax cookies on the next hop.
+            // (Identical to the Express adapter and Next middleware — do not "simplify".)
+            return c.html(`<!DOCTYPE html>
+<html>
+  <head><title>Linking Successful</title></head>
+  <body>
+    <p>Account linked successfully! Redirecting...</p>
+    <script>window.location.href = ${JSON.stringify(finalUrl)};</script>
+  </body>
+</html>`);
+        }
+        const errorRedirect = new URL(`${gatewayUrl}/auth/hosted/confirm-link`);
+        errorRedirect.searchParams.set('token', formData.tempToken || '');
+        errorRedirect.searchParams.set('provider', data.provider || 'google');
+        errorRedirect.searchParams.set('email', data.email || '');
+        errorRedirect.searchParams.set('appOrigin', appUrl);
+        errorRedirect.searchParams.set('error', data.message || 'Invalid password. Link failed.');
+        return c.redirect(errorRedirect.toString(), 303);
+    });
+    // ── Everything else: generic JSON passthrough (login, register, logout,
+    //    csrf-token, MFA, OTP, profile). CSRF-protected endpoints run the
+    //    handshake first — the same set, from core, as Express/Next. ──
+    app.all('*', async (c) => {
+        const target = `/auth${relPath(c)}`;
+        const init = { method: c.req.method };
+        if (c.req.method !== 'GET' && c.req.method !== 'HEAD') {
+            const body = await readBody(c);
+            if (body !== undefined) {
+                init.body = JSON.stringify(body);
+                init.headers = { 'Content-Type': 'application/json' };
+            }
+        }
+        const response = core_1.CSRF_PROTECTED_PATHS.has(target)
+            ? await iam.proxyWithCsrfProtection(target, init, c.req.raw.headers)
+            : await iam.proxy(target, init, c.req.raw.headers);
+        c.status(response.status);
+        response.headers.getSetCookie().forEach((sc) => c.header('Set-Cookie', sc, { append: true }));
+        return c.json(await response.json().catch(() => ({})));
+    });
+    return app;
+}
+/** Route guard: local verify → c.get('identity'); 401s API requests, redirects pages. */
+function requireAuth(config = {}) {
+    const iam = new core_1.CoreIAM(config);
+    const { signInUrl = '/login' } = config;
+    return async (c, next) => {
+        const identity = await iam.getSession(c.req.raw.headers);
+        if (!identity) {
+            const accept = c.req.header('accept') || '';
+            const wantsJson = c.req.path.startsWith('/api') || accept.includes('json') || accept.trim() === '*/*';
+            if (wantsJson)
+                return c.json({ error: 'unauthenticated' }, 401);
+            return c.redirect(signInUrl, 302);
+        }
+        c.set('identity', identity);
+        await next();
+    };
+}

package/dist/nextjs/middleware.js

@@ -275,13 +275,21 @@ async function coreIamAuth(request) {
             const code = searchParams.get('code');
             const state = searchParams.get('state');
             const redirectUri = `${process.env.NEXT_PUBLIC_APP_URL}/api/auth/callback/${provider}`;
-            targetPath = `/auth/oauth/callback/${provider}?code=${code}&state=${state}&redirectUri=${redirectUri}`;
+            // targetPath = `/auth/oauth/callback/${provider}?code=${code}&state=${state}&redirectUri=${redirectUri}`;
+            // OAuth callback targetPath — encode all three:
+            targetPath = `/auth/oauth/callback/${provider}`
+                + `?code=${encodeURIComponent(code ?? '')}`
+                + `&state=${encodeURIComponent(state ?? '')}`
+                + `&redirectUri=${encodeURIComponent(redirectUri)}`;
         }
-        const response = await iam.proxy(targetPath, {
+        const init = {
             method,
             body: body ? JSON.stringify(body) : undefined,
             headers: { 'Content-Type': 'application/json' },
-        }, request.headers);
+        };
+        const response = core_1.CSRF_PROTECTED_PATHS.has(targetPath)
+            ? await iam.proxyWithCsrfProtection(targetPath, init, request.headers)
+            : await iam.proxy(targetPath, init, request.headers);
         // Handle OAuth Initiate Redirects
         if (pathname.startsWith('/api/auth/oauth/') && !pathname.includes('callback') && !pathname.includes('link')) {
             const data = await response.json().catch(() => ({}));

package/package.json

@@ -1,6 +1,6 @@
 {
   "name": "@coreiam/auth",
-  "version": "1.0.392-beta.2",
+  "version": "1.0.392-beta.3",
   "main": "./dist/core/index.js",
   "types": "./dist/core/index.d.ts",
   "exports": {
@@ -37,17 +37,24 @@
     "auth",
     "saas",
     "multi-tenant",
-    "nextjs"
+    "nextjs",
+    "hono",
+    "react",
+    "vite",
+    "express"
   ],
   "author": "coreIAM",
   "license": "MIT",
   "publishConfig": {
     "access": "public"
   },
+   "./hono": { "types": "./dist/hono/index.d.ts", "import": "./dist/hono/index.js", "require": "./dist/hono/index.js" },
+  "./ui":   { "types": "./dist/ui/buttons.d.ts",  "import": "./dist/ui/buttons.js",  "require": "./dist/ui/buttons.js" },
   "peerDependencies": {
     "express": "^4.0.0 || ^5.0.0",
     "next": ">=14",
-    "react": ">=18"
+    "react": ">=18",
+    "hono": ">=4"
   },
   "peerDependenciesMeta": {
     "next": {
@@ -58,6 +65,9 @@
     },
     "express": {
       "optional": true
+    },
+    "hono": { 
+      "optional": true 
     }
   },
   "devDependencies": {
@@ -69,7 +79,8 @@
     "react": "^19.2.7",
     "supertest": "^7.3.0",
     "typescript": "^5.0.0",
-    "vitest": "^3.2.7"
+    "vitest": "^3.2.7",
+    "hono": "^4.6.0"
   },
   "dependencies": {
     "@radix-ui/react-slot": "^1.3.3",