@coreiam/auth 1.0.392-beta.4 → 1.0.392-beta.8

package/dist/core/index.d.ts

@@ -136,10 +136,47 @@ export declare class CoreIAM {
     loginWithCsrfProtection(identifier: string, password: string, incomingHeaders: Headers): Promise<Response>;
     registerWithCsrfProtection(userData: any, incomingHeaders: Headers): Promise<Response>;
     updateProfile(updateData: any, incomingHeaders: Headers): Promise<Response>;
+    changePassword(currentPassword: string, newPassword: string, incomingHeaders: Headers): Promise<Response>;
     setupMfa(incomingHeaders: Headers): Promise<Response>;
     verifyMfa(token: string, incomingHeaders: Headers): Promise<Response>;
     disableMfa(incomingHeaders: Headers): Promise<Response>;
-    requestOtp(body: any, incomingHeaders: Headers): Promise<Response>;
-    verifyOtp(body: any, incomingHeaders: Headers): Promise<Response>;
+    requestOtp(body: RequestOtpBody, incomingHeaders: Headers): Promise<Response>;
+    verifyOtp(body: VerifyOtpBody, incomingHeaders: Headers): Promise<Response>;
+    forgotPassword(email: string, incomingHeaders: Headers): Promise<Response>;
+    resetPassword(email: string, otp: string, newPassword: string, incomingHeaders: Headers): Promise<Response>;
+    listSessions(incomingHeaders: Headers): Promise<Response>;
+    revokeSession(sessionId: string, incomingHeaders: Headers): Promise<Response>;
+    revokeAllSessions(incomingHeaders: Headers): Promise<Response>;
 }
 export declare const CSRF_PROTECTED_PATHS: ReadonlySet<string>;
+export declare const OAUTH_PROVIDERS: ReadonlySet<string>;
+export interface RequestOtpBody {
+    email: string;
+}
+export interface VerifyOtpBody {
+    email: string;
+    otp: string;
+}
+export interface RequestResetBody {
+    email: string;
+}
+export interface ResetPasswordBody {
+    email: string;
+    otp: string;
+    newPassword: string;
+}
+export interface SessionSummary {
+    id: string;
+    userAgent: string;
+    ipAddress: string;
+    createdAt: string;
+    lastActiveAt: string;
+    isCurrent: boolean;
+}
+export interface ListSessionsResponse {
+    sessions: SessionSummary[];
+}
+export interface RevokeAllSessionsResponse {
+    success: boolean;
+    sessionsRevoked: number;
+}

package/dist/core/index.js

@@ -1,6 +1,6 @@
 "use strict";
 Object.defineProperty(exports, "__esModule", { value: true });
-exports.CSRF_PROTECTED_PATHS = exports.CoreIAM = void 0;
+exports.OAUTH_PROVIDERS = exports.CSRF_PROTECTED_PATHS = exports.CoreIAM = void 0;
 exports.toIdentity = toIdentity;
 // src/core/index.ts
 const jose_1 = require("jose");
@@ -339,8 +339,22 @@ class CoreIAM {
         const existingCookieStr = incomingHeaders.get('cookie') || '';
         const newCookiePairs = csrfCookies.map(c => c.split(';')[0]);
         if (newCookiePairs.length > 0) {
-            const combinedCookies = [existingCookieStr, ...newCookiePairs].filter(Boolean).join('; ');
-            authHeaders.set('cookie', combinedCookies);
+            // FIX (SDK-4): dedupe by cookie NAME, newest value wins. The old
+            // [existing, ...new].join() emitted 'csrfToken=old; csrfToken=new' once
+            // the browser jar already held a csrf cookie and the handshake rotated
+            // it — whether the backend parser reads the first or last duplicate
+            // decided 403-or-pass. Nondeterministic across parsers is a bug.
+            const jar = new Map();
+            for (const pair of [...existingCookieStr.split(';'), ...newCookiePairs]) {
+                const trimmed = pair.trim();
+                if (!trimmed)
+                    continue;
+                const eq = trimmed.indexOf('=');
+                if (eq === -1)
+                    continue;
+                jar.set(trimmed.slice(0, eq), trimmed.slice(eq + 1));
+            }
+            authHeaders.set('cookie', [...jar.entries()].map(([k, v]) => `${k}=${v}`).join('; '));
         }
         return this.proxy(path, init, authHeaders);
     }
@@ -365,6 +379,13 @@ class CoreIAM {
             body: JSON.stringify(updateData),
         }, incomingHeaders);
     }
+    async changePassword(currentPassword, newPassword, incomingHeaders) {
+        return this.proxyWithCsrfProtection('/auth/password', {
+            method: 'PUT',
+            headers: { 'Content-Type': 'application/json' },
+            body: JSON.stringify({ currentPassword, newPassword }),
+        }, incomingHeaders);
+    }
     async setupMfa(incomingHeaders) {
         return this.proxyWithCsrfProtection('/auth/mfa/setup', { method: 'POST' }, incomingHeaders);
     }
@@ -392,10 +413,63 @@ class CoreIAM {
             body: JSON.stringify(body),
         }, incomingHeaders);
     }
+    // W3 beta.6: forgot-password / reset-password. Both go through the same
+    // CSRF funnel as every other CsrfGuard-decorated endpoint — the paths are
+    // pre-registered in CSRF_PROTECTED_PATHS (SDK-6), so the middleware proxy
+    // and these methods stay in parity.
+    async forgotPassword(email, incomingHeaders) {
+        return this.proxyWithCsrfProtection('/auth/request-reset', {
+            method: 'POST',
+            headers: { 'Content-Type': 'application/json' },
+            body: JSON.stringify({ email }),
+        }, incomingHeaders);
+    }
+    async resetPassword(email, otp, newPassword, incomingHeaders) {
+        return this.proxyWithCsrfProtection('/auth/reset-password', {
+            method: 'POST',
+            headers: { 'Content-Type': 'application/json' },
+            body: JSON.stringify({ email, otp, newPassword }),
+        }, incomingHeaders);
+    }
+    // W4 (beta.7): session management surface. listSessions is a plain
+    // authenticated GET (same shape as the /auth/profile GET precedent —
+    // JWT comes from the forwarded cookie via proxy(), reads carry no CSRF
+    // requirement); the two state-changing calls go through the shared CSRF
+    // handshake exactly like changePassword.
+    async listSessions(incomingHeaders) {
+        return this.proxy('/auth/sessions', { method: 'GET' }, incomingHeaders);
+    }
+    async revokeSession(sessionId, incomingHeaders) {
+        // Same rationale as OAUTH_PROVIDERS (SDK-5): never interpolate an
+        // unvalidated path segment into a URL. The backend's ParseUUIDPipe
+        // would reject garbage with a 400 anyway — this fails fast
+        // client-side and can never become a traversal string.
+        if (!/^[0-9a-f]{8}-[0-9a-f]{4}-[0-9a-f]{4}-[0-9a-f]{4}-[0-9a-f]{12}$/i.test(sessionId)) {
+            throw new Error('revokeSession: sessionId must be a UUID');
+        }
+        return this.proxyWithCsrfProtection(`/auth/sessions/${sessionId}`, { method: 'DELETE' }, incomingHeaders);
+    }
+    async revokeAllSessions(incomingHeaders) {
+        return this.proxyWithCsrfProtection('/auth/sessions/revoke-all', { method: 'POST' }, incomingHeaders);
+    }
 }
 exports.CoreIAM = CoreIAM;
 exports.CSRF_PROTECTED_PATHS = new Set([
     '/auth/login', '/auth/register', '/auth/discover-tenants',
     '/auth/request-otp', '/auth/verify-otp', '/auth/mfa/login',
     '/auth/profile', '/auth/mfa/setup', '/auth/mfa/verify', '/auth/mfa/disable',
+    '/auth/password',
+    '/auth/request-reset', '/auth/reset-password',
+    // W4 (beta.7): revoke-all is exact-matched. The per-session revoke is a
+    // DYNAMIC path (/auth/sessions/<uuid>) a string Set cannot match — the SDK
+    // methods self-handshake via proxyWithCsrfProtection so server-action
+    // callers are fully covered; middleware-proxied browser-direct DELETEs to
+    // /api/auth/sessions/<uuid> are not auto-handshaked (known limitation; the
+    // fix is a prefix matcher inside middleware.ts, deliberately deferred to
+    // keep this patch off that file).
+    '/auth/sessions/revoke-all',
 ]);
+// FIX (SDK-5): single source of truth for supported OAuth providers. Every
+// place that interpolates a provider segment into a backend URL must check
+// this set first — an unvalidated path segment is a traversal surface.
+exports.OAUTH_PROVIDERS = new Set(['google', 'github']);

package/dist/nextjs/actions.d.ts

@@ -1,4 +1,4 @@
-import { CoreIAMIdentity } from '../core';
+import { CoreIAMIdentity, RequestOtpBody, VerifyOtpBody } from '../core';
 export interface AuthResult {
     ok: boolean;
     status: number;
@@ -9,8 +9,14 @@ export declare function loginActionSdk(identifier: string, password: string): Pr
 export declare function registerActionSdk(userData: any): Promise<AuthResult>;
 export declare function logoutActionSdk(): Promise<AuthResult>;
 export declare function updateProfileActionSdk(updateData: Record<string, any>): Promise<AuthResult>;
+export declare function changePasswordActionSdk(currentPassword: string, newPassword: string): Promise<AuthResult>;
 export declare function setupMfaActionSdk(): Promise<AuthResult>;
 export declare function verifyMfaActionSdk(token: string): Promise<AuthResult>;
 export declare function disableMfaActionSdk(): Promise<AuthResult>;
-export declare function requestOtpActionSdk(body: Record<string, any>): Promise<AuthResult>;
-export declare function verifyOtpActionSdk(body: Record<string, any>): Promise<AuthResult>;
+export declare function requestOtpActionSdk(body: RequestOtpBody): Promise<AuthResult>;
+export declare function verifyOtpActionSdk(body: VerifyOtpBody): Promise<AuthResult>;
+export declare function forgotPasswordActionSdk(email: string): Promise<AuthResult>;
+export declare function resetPasswordActionSdk(email: string, otp: string, newPassword: string): Promise<AuthResult>;
+export declare function listSessionsActionSdk(): Promise<AuthResult>;
+export declare function revokeSessionActionSdk(sessionId: string): Promise<AuthResult>;
+export declare function revokeAllSessionsActionSdk(): Promise<AuthResult>;

package/dist/nextjs/actions.js

@@ -99,11 +99,17 @@ exports.loginActionSdk = loginActionSdk;
 exports.registerActionSdk = registerActionSdk;
 exports.logoutActionSdk = logoutActionSdk;
 exports.updateProfileActionSdk = updateProfileActionSdk;
+exports.changePasswordActionSdk = changePasswordActionSdk;
 exports.setupMfaActionSdk = setupMfaActionSdk;
 exports.verifyMfaActionSdk = verifyMfaActionSdk;
 exports.disableMfaActionSdk = disableMfaActionSdk;
 exports.requestOtpActionSdk = requestOtpActionSdk;
 exports.verifyOtpActionSdk = verifyOtpActionSdk;
+exports.forgotPasswordActionSdk = forgotPasswordActionSdk;
+exports.resetPasswordActionSdk = resetPasswordActionSdk;
+exports.listSessionsActionSdk = listSessionsActionSdk;
+exports.revokeSessionActionSdk = revokeSessionActionSdk;
+exports.revokeAllSessionsActionSdk = revokeAllSessionsActionSdk;
 const headers_1 = require("next/headers");
 const core_1 = require("../core");
 // FIX: lazy singleton instead of `const iam = new CoreIAM();` at module
@@ -210,34 +216,13 @@ async function getSession() {
             return null;
         }
     }
-    // Fallback: If middleware didn't run (e.g. API route), we can still read the JWT
-    // But we DO NOT verify it here, because verification requires the JWKS fetch which 
-    // is too slow for Server Components. We just decode it to get the identity.
-    // The middleware is the true security gate.
-    const authHeader = reqHeaders.get('Authorization') || reqHeaders.get('authorization');
-    const cookieHeader = reqHeaders.get('cookie');
-    let token = undefined;
-    if (authHeader?.startsWith('Bearer ')) {
-        token = authHeader.substring(7);
-    }
-    else if (cookieHeader) {
-        const match = cookieHeader.match(/jwt=([^;]+)/);
-        if (match)
-            token = match[1];
-    }
-    if (!token)
-        return null;
+    // FIX (SDK-1): delegate to the SAME verification funnel coreIamMiddleware
+    // uses (CoreIAM.verifySession — jose, RS256-pinned, issuer-checked) instead
+    // of decoding the payload unverified. One implementation, zero drift,
+    // no new env vars. Forged tokens -> null.
     try {
-        // Just decode the payload without verifying (middleware already verified it)
-        const payloadB64 = token.split('.')[1];
-        const payloadStr = Buffer.from(payloadB64, 'base64').toString('utf8');
-        const payload = JSON.parse(payloadStr);
-        return {
-            sub: payload.sub,
-            email: payload.email,
-            tenantId: payload.tenantId,
-            roles: payload.roles || []
-        };
+        const result = await getIam().verifySession(reqHeaders);
+        return result.identity ?? null;
     }
     catch {
         return null;
@@ -291,6 +276,16 @@ async function updateProfileActionSdk(updateData) {
         return { ok: false, status: 500, data: { error: 'Profile update failed' } };
     }
 }
+async function changePasswordActionSdk(currentPassword, newPassword) {
+    const reqHeaders = await (0, headers_1.headers)();
+    try {
+        const response = await getIam().changePassword(currentPassword, newPassword, reqHeaders);
+        return { ok: response.ok, status: response.status, data: await response.json().catch(() => ({})) };
+    }
+    catch (error) {
+        return { ok: false, status: 500, data: { error: 'Password change failed' } };
+    }
+}
 async function setupMfaActionSdk() {
     const reqHeaders = await (0, headers_1.headers)();
     try {
@@ -325,6 +320,10 @@ async function requestOtpActionSdk(body) {
     const reqHeaders = await (0, headers_1.headers)();
     try {
         const response = await getIam().requestOtp(body, reqHeaders);
+        // FIX (SDK-3, uniformity): request-otp currently sets no cookies, but routing
+        // any Set-Cookie through the same sync as every other auth action keeps the
+        // invariant above true if the backend ever starts setting one.
+        await syncCookiesToNext(response);
         return { ok: response.ok, status: response.status, data: await response.json().catch(() => ({})) };
     }
     catch (error) {
@@ -335,9 +334,80 @@ async function verifyOtpActionSdk(body) {
     const reqHeaders = await (0, headers_1.headers)();
     try {
         const response = await getIam().verifyOtp(body, reqHeaders);
+        // FIX (SDK-3): sync Set-Cookie to the Next.js cookie store before returning.
+        // W2's POST /auth/verify-otp mints an OTP session and Set-Cookies the jwt
+        // cookie (Max-Age 900 — verified live in acceptance). Without this line the
+        // action silently dropped the session cookie, so passwordless login via
+        // server action never established a browser session. Mirrors the
+        // loginActionSdk / registerActionSdk pattern exactly.
+        await syncCookiesToNext(response);
         return { ok: response.ok, status: response.status, data: await response.json().catch(() => ({})) };
     }
     catch (error) {
         return { ok: false, status: 500, data: { error: 'OTP verification failed' } };
     }
 }
+async function forgotPasswordActionSdk(email) {
+    const reqHeaders = await (0, headers_1.headers)();
+    try {
+        const response = await getIam().forgotPassword(email, reqHeaders);
+        await syncCookiesToNext(response);
+        return { ok: response.ok, status: response.status, data: await response.json().catch(() => ({})) };
+    }
+    catch (error) {
+        return { ok: false, status: 500, data: { error: 'Password reset request failed' } };
+    }
+}
+async function resetPasswordActionSdk(email, otp, newPassword) {
+    const reqHeaders = await (0, headers_1.headers)();
+    try {
+        const response = await getIam().resetPassword(email, otp, newPassword, reqHeaders);
+        // W2's reset-password revokes ALL session families server-side
+        // (revokeAllUserSessions) and clears cookies via Set-Cookie deletions —
+        // this sync applies them to the browser. Without it the client would sit
+        // on dead cookies after a successful reset.
+        await syncCookiesToNext(response);
+        return { ok: response.ok, status: response.status, data: await response.json().catch(() => ({})) };
+    }
+    catch (error) {
+        return { ok: false, status: 500, data: { error: 'Password reset failed' } };
+    }
+}
+// --- W4 (beta.7): session management. listSessions in a Server Component,
+// revoke calls from client components via server actions — same funnel and
+// same AuthResult contract as every action above. The backend sets no
+// cookies on these routes, but Set-Cookie sync stays wired for uniformity
+// (SDK-3 pattern).
+async function listSessionsActionSdk() {
+    const reqHeaders = await (0, headers_1.headers)();
+    try {
+        const response = await getIam().listSessions(reqHeaders);
+        await syncCookiesToNext(response);
+        return { ok: response.ok, status: response.status, data: await response.json().catch(() => ({})) };
+    }
+    catch (error) {
+        return { ok: false, status: 500, data: { error: 'Failed to list sessions' } };
+    }
+}
+async function revokeSessionActionSdk(sessionId) {
+    const reqHeaders = await (0, headers_1.headers)();
+    try {
+        const response = await getIam().revokeSession(sessionId, reqHeaders);
+        await syncCookiesToNext(response);
+        return { ok: response.ok, status: response.status, data: await response.json().catch(() => ({})) };
+    }
+    catch (error) {
+        return { ok: false, status: 500, data: { error: error instanceof Error ? error.message : 'Session revoke failed' } };
+    }
+}
+async function revokeAllSessionsActionSdk() {
+    const reqHeaders = await (0, headers_1.headers)();
+    try {
+        const response = await getIam().revokeAllSessions(reqHeaders);
+        await syncCookiesToNext(response);
+        return { ok: response.ok, status: response.status, data: await response.json().catch(() => ({})) };
+    }
+    catch (error) {
+        return { ok: false, status: 500, data: { error: 'Revoke-all failed' } };
+    }
+}

package/dist/nextjs/index.d.ts

@@ -2,7 +2,7 @@ import { NextRequest, NextResponse } from 'next/server';
 import { CoreIAM, CoreIAMIdentity } from '../core';
 export { CoreIAMProvider, useAuth } from './provider';
 export { coreIamMiddleware, coreIamAuth } from './middleware';
-export { getSession, loginActionSdk, registerActionSdk, logoutActionSdk, updateProfileActionSdk, setupMfaActionSdk, verifyMfaActionSdk, disableMfaActionSdk, requestOtpActionSdk, verifyOtpActionSdk } from './actions';
+export { getSession, loginActionSdk, registerActionSdk, logoutActionSdk, updateProfileActionSdk, setupMfaActionSdk, verifyMfaActionSdk, disableMfaActionSdk, requestOtpActionSdk, verifyOtpActionSdk, forgotPasswordActionSdk, resetPasswordActionSdk, listSessionsActionSdk, revokeSessionActionSdk, revokeAllSessionsActionSdk } from './actions';
 export declare class NextHandlers {
     private iam;
     constructor(iam?: CoreIAM);

package/dist/nextjs/index.js

@@ -1,6 +1,6 @@
 "use strict";
 Object.defineProperty(exports, "__esModule", { value: true });
-exports.OAuthHandlers = exports.NextHandlers = exports.verifyOtpActionSdk = exports.requestOtpActionSdk = exports.disableMfaActionSdk = exports.verifyMfaActionSdk = exports.setupMfaActionSdk = exports.updateProfileActionSdk = exports.logoutActionSdk = exports.registerActionSdk = exports.loginActionSdk = exports.getSession = exports.coreIamAuth = exports.coreIamMiddleware = exports.useAuth = exports.CoreIAMProvider = void 0;
+exports.OAuthHandlers = exports.NextHandlers = exports.revokeAllSessionsActionSdk = exports.revokeSessionActionSdk = exports.listSessionsActionSdk = exports.resetPasswordActionSdk = exports.forgotPasswordActionSdk = exports.verifyOtpActionSdk = exports.requestOtpActionSdk = exports.disableMfaActionSdk = exports.verifyMfaActionSdk = exports.setupMfaActionSdk = exports.updateProfileActionSdk = exports.logoutActionSdk = exports.registerActionSdk = exports.loginActionSdk = exports.getSession = exports.coreIamAuth = exports.coreIamMiddleware = exports.useAuth = exports.CoreIAMProvider = void 0;
 exports.auth = auth;
 // src/nextjs/index.ts
 const server_1 = require("next/server");
@@ -23,6 +23,11 @@ Object.defineProperty(exports, "verifyMfaActionSdk", { enumerable: true, get: fu
 Object.defineProperty(exports, "disableMfaActionSdk", { enumerable: true, get: function () { return actions_1.disableMfaActionSdk; } });
 Object.defineProperty(exports, "requestOtpActionSdk", { enumerable: true, get: function () { return actions_1.requestOtpActionSdk; } });
 Object.defineProperty(exports, "verifyOtpActionSdk", { enumerable: true, get: function () { return actions_1.verifyOtpActionSdk; } });
+Object.defineProperty(exports, "forgotPasswordActionSdk", { enumerable: true, get: function () { return actions_1.forgotPasswordActionSdk; } });
+Object.defineProperty(exports, "resetPasswordActionSdk", { enumerable: true, get: function () { return actions_1.resetPasswordActionSdk; } });
+Object.defineProperty(exports, "listSessionsActionSdk", { enumerable: true, get: function () { return actions_1.listSessionsActionSdk; } });
+Object.defineProperty(exports, "revokeSessionActionSdk", { enumerable: true, get: function () { return actions_1.revokeSessionActionSdk; } });
+Object.defineProperty(exports, "revokeAllSessionsActionSdk", { enumerable: true, get: function () { return actions_1.revokeAllSessionsActionSdk; } });
 class NextHandlers {
     iam;
     constructor(iam) {
@@ -62,6 +67,10 @@ class OAuthHandlers {
     }
     // Handles the initial redirect to Google/GitHub
     async handleInitiate(req, provider) {
+        // FIX (SDK-5): validate the provider segment before interpolation.
+        if (!core_1.OAUTH_PROVIDERS.has(provider)) {
+            return server_1.NextResponse.redirect(new URL('/auth/login', req.url));
+        }
         const redirectUri = `${process.env.NEXT_PUBLIC_APP_URL}/api/auth/callback/${provider}`;
         const response = await this.iam.proxy(`/auth/oauth/initiate/${provider}?redirectUri=${encodeURIComponent(redirectUri)}&scopes=email,profile`, { method: 'GET' }, req.headers);
         const data = await response.json();
@@ -72,11 +81,19 @@ class OAuthHandlers {
     }
     // Handles the callback from Google/GitHub
     async handleCallback(req, provider) {
+        // FIX (SDK-5): validate the provider segment before interpolation.
+        if (!core_1.OAUTH_PROVIDERS.has(provider)) {
+            return server_1.NextResponse.redirect(new URL('/auth/login', req.url));
+        }
         const { searchParams } = new URL(req.url);
         const code = searchParams.get('code');
         const state = searchParams.get('state');
         const redirectUri = `${process.env.NEXT_PUBLIC_APP_URL}/api/auth/callback/${provider}`;
-        const targetUrl = `/auth/oauth/callback/${provider}?code=${code}&state=${state}&redirectUri=${redirectUri}`;
+        // FIX (SDK-5): raw code/state/redirectUri here was a query-injection surface.
+        const targetUrl = `/auth/oauth/callback/${provider}`
+            + `?code=${encodeURIComponent(code ?? '')}`
+            + `&state=${encodeURIComponent(state ?? '')}`
+            + `&redirectUri=${encodeURIComponent(redirectUri)}`;
         const response = await this.iam.proxy(targetUrl, { method: 'GET' }, req.headers);
         const res = server_1.NextResponse.redirect(new URL('/', req.url));
         const setCookies = response.headers.getSetCookie();
@@ -89,8 +106,39 @@ class OAuthHandlers {
     }
 }
 exports.OAuthHandlers = OAuthHandlers;
+// FIX (SDK-7): bounded LRU instead of wholesale .clear() at 10k. Flushing the
+// whole map on overflow let an attacker cycle 10,001 distinct fake Bearer
+// tokens and evict every LEGIT entry — all real users' next requests re-hit
+// the backend verify (cache-stampede amplifier). LRU keeps hot legit entries
+// alive under exactly that attack. Hand-rolled on purpose: zero new
+// dependencies for a published SDK; semantics fully covered by vitest.
 const MAX_CACHE_SIZE = 10000;
+const CACHE_TTL_MS = 5 * 60 * 1000;
 const apiKeyCache = new Map();
+// LRU read: drop stale entries, and delete+re-set moves the entry to the
+// Map's tail — JavaScript Maps preserve insertion order, so the tail is
+// "most recently used" and the head is "least recently used".
+function cacheGet(token) {
+    const entry = apiKeyCache.get(token);
+    if (!entry)
+        return undefined;
+    if (entry.expires <= Date.now()) {
+        apiKeyCache.delete(token);
+        return undefined;
+    }
+    apiKeyCache.delete(token);
+    apiKeyCache.set(token, entry);
+    return entry;
+}
+// LRU write: insert at tail; if over capacity, evict the head (oldest use).
+function cacheSet(token, entry) {
+    apiKeyCache.set(token, entry);
+    if (apiKeyCache.size > MAX_CACHE_SIZE) {
+        const lru = apiKeyCache.keys().next().value;
+        if (lru !== undefined)
+            apiKeyCache.delete(lru);
+    }
+}
 async function auth(request) {
     const authHeader = request.headers.get('authorization');
     if (!authHeader?.startsWith('Bearer '))
@@ -99,15 +147,11 @@ async function auth(request) {
     const gatewayUrl = process.env.COREIAM_API_URL;
     if (!gatewayUrl)
         return null;
-    // 1. Check Cache
-    const cached = apiKeyCache.get(token);
-    if (cached && cached.expires > Date.now()) {
+    // 1. Check Cache (was: raw .get() + expiry check + wholesale .clear() on size)
+    const cached = cacheGet(token);
+    if (cached) {
         return cached.valid ? cached.identity : null;
     }
-    // FIX: Prevent memory leak by clearing cache if it gets too large
-    if (apiKeyCache.size >= MAX_CACHE_SIZE) {
-        apiKeyCache.clear(); // Simple crude eviction. In production SDK, use lru-cache.
-    }
     // 2. Call CoreIAM to verify
     try {
         const res = await fetch(`${gatewayUrl}/auth/api-keys/verify`, {
@@ -124,11 +168,11 @@ async function auth(request) {
                 sub: data.sub,
                 tenantId: data.tenantId,
             };
-            apiKeyCache.set(token, { valid: true, identity, expires: Date.now() + (5 * 60 * 1000) });
+            cacheSet(token, { valid: true, identity, expires: Date.now() + CACHE_TTL_MS });
             return identity;
         }
         else {
-            apiKeyCache.set(token, { valid: false, expires: Date.now() + (5 * 60 * 1000) });
+            cacheSet(token, { valid: false, expires: Date.now() + CACHE_TTL_MS });
             return null;
         }
     }

package/dist/nextjs/middleware.js

@@ -122,7 +122,7 @@ exports.coreIamMiddleware = coreIamMiddleware;
 //   }
 //   return { response: NextResponse.next(), isAuthenticated };
 // }
-// src/nextjs/middleware.ts
+// sdk/javascript/src/nextjs/middleware.ts
 const server_1 = require("next/server");
 //import { jwtVerify, createRemoteJWKSet } from 'jose';
 const core_1 = require("../core");
@@ -153,20 +153,56 @@ async function performRefresh(refreshTokenCookie, jwtCookie) {
         });
         if (!refreshRes.ok)
             return null;
+        // FIX (SDK-11): derive Max-Age from the backend's own Set-Cookie instead of
+        // hardcoding 24h/7d — the hardcoded values silently overrode the backend's
+        // post-W1 policy (jwt Max-Age 900). The backend is the source of truth.
         const setCookies = refreshRes.headers.getSetCookie();
         let newJwt = '', newRefreshToken = '';
+        let jwtMaxAge = 900, refreshMaxAge = 7 * 24 * 60 * 60; // fallbacks if backend sends no Max-Age
         setCookies.forEach(cookie => {
-            if (cookie.startsWith('jwt='))
+            const maxAgeMatch = cookie.match(/max-age=(-?\d+)/i);
+            if (cookie.startsWith('jwt=')) {
                 newJwt = cookie.split(';')[0].split('=')[1];
-            if (cookie.startsWith('refreshToken='))
+                if (maxAgeMatch)
+                    jwtMaxAge = parseInt(maxAgeMatch[1], 10);
+            }
+            if (cookie.startsWith('refreshToken=')) {
                 newRefreshToken = cookie.split(';')[0].split('=')[1];
+                if (maxAgeMatch)
+                    refreshMaxAge = parseInt(maxAgeMatch[1], 10);
+            }
         });
-        return newJwt ? { jwt: newJwt, refreshToken: newRefreshToken } : null;
+        return newJwt ? { jwt: newJwt, refreshToken: newRefreshToken, jwtMaxAge, refreshMaxAge } : null;
     }
     catch (error) {
         return null;
     }
 }
+// async function performRefresh(
+//   refreshTokenCookie: { value: string } | undefined,
+//   jwtCookie: { value: string } | undefined,
+// ): Promise<{ jwt: string; refreshToken: string } | null> {
+//   if (!gatewayUrl) return null;
+//   try {
+//     const refreshRes = await fetch(`${gatewayUrl}/auth/refresh-token`, {
+//       method: 'POST',
+//       headers: {
+//         'X-API-Key': process.env.COREIAM_API_KEY!,
+//         'cookie': `refreshToken=${refreshTokenCookie?.value || ''}; jwt=${jwtCookie?.value || ''}`,
+//       },
+//     });
+//     if (!refreshRes.ok) return null;
+//     const setCookies = refreshRes.headers.getSetCookie();
+//     let newJwt = '', newRefreshToken = '';
+//     setCookies.forEach(cookie => {
+//       if (cookie.startsWith('jwt=')) newJwt = cookie.split(';')[0].split('=')[1];
+//       if (cookie.startsWith('refreshToken=')) newRefreshToken = cookie.split(';')[0].split('=')[1];
+//     });
+//     return newJwt ? { jwt: newJwt, refreshToken: newRefreshToken } : null;
+//   } catch (error) {
+//     return null;
+//   }
+// }
 /**
  * Helper function for custom middleware (proxy.ts).
  * Returns the response and authentication state.
@@ -182,7 +218,12 @@ async function coreIamAuth(request) {
         if (method === 'OPTIONS') {
             const res = new server_1.NextResponse(null, { status: 204 }); // 204 No Content
             const origin = request.headers.get('origin');
-            if (origin) {
+            // FIX (SDK-14): reflect only known origins — reflecting ANY origin together
+            // with Allow-Credentials is a footgun even though this only answers
+            // preflights (actual responses carry no CORS headers).
+            const allowedOrigins = (process.env.COREIAM_ALLOWED_ORIGINS || '')
+                .split(',').map(s => s.trim()).filter(Boolean);
+            if (origin && (origin === request.nextUrl.origin || allowedOrigins.includes(origin))) {
                 res.headers.set('Access-Control-Allow-Origin', origin);
                 res.headers.set('Access-Control-Allow-Methods', 'GET, POST, PUT, DELETE, OPTIONS');
                 res.headers.set('Access-Control-Allow-Headers', 'Content-Type, Authorization, X-CSRF-Token');
@@ -235,7 +276,7 @@ async function coreIamAuth(request) {
             </head>
             <body>
               <p>Account linked successfully! Redirecting...</p>
-              <script>window.location.href = "${finalUrl}";</script>
+              <script>window.location.href = ${JSON.stringify(finalUrl)};</script>
             </body>
             </html>
           `;
@@ -263,14 +304,27 @@ async function coreIamAuth(request) {
         let targetPath = pathname.replace('/api/auth', '/auth');
         const body = method !== 'GET' ? await request.json().catch(() => undefined) : undefined;
         // FIX: Special routing for OAuth Initiate
+        // if (pathname.startsWith('/api/auth/oauth/') && !pathname.includes('callback') && !pathname.includes('link')) {
+        //   const provider = pathname.split('/').pop();
+        //   const redirectUri = `${process.env.NEXT_PUBLIC_APP_URL}/api/auth/callback/${provider}`;
+        //   targetPath = `/auth/oauth/initiate/${provider}?redirectUri=${encodeURIComponent(redirectUri)}&scopes=email,profile`;
+        // }
+        // FIX: Special routing for OAuth Initiate
         if (pathname.startsWith('/api/auth/oauth/') && !pathname.includes('callback') && !pathname.includes('link')) {
-            const provider = pathname.split('/').pop();
+            const provider = pathname.split('/').pop() || '';
+            // FIX (SDK-5): reject unknown providers before URL interpolation.
+            if (!core_1.OAUTH_PROVIDERS.has(provider)) {
+                return { response: new server_1.NextResponse('Unsupported OAuth provider', { status: 400 }), isAuthenticated: false };
+            }
             const redirectUri = `${process.env.NEXT_PUBLIC_APP_URL}/api/auth/callback/${provider}`;
             targetPath = `/auth/oauth/initiate/${provider}?redirectUri=${encodeURIComponent(redirectUri)}&scopes=email,profile`;
         }
-        // FIX: Special routing for OAuth Callback
         if (pathname.startsWith('/api/auth/callback/')) {
-            const provider = pathname.split('/').pop();
+            const provider = pathname.split('/').pop() || '';
+            // FIX (SDK-5): reject unknown providers before URL interpolation.
+            if (!core_1.OAUTH_PROVIDERS.has(provider)) {
+                return { response: new server_1.NextResponse('Unsupported OAuth provider', { status: 400 }), isAuthenticated: false };
+            }
             const searchParams = new URL(request.url).searchParams;
             const code = searchParams.get('code');
             const state = searchParams.get('state');
@@ -357,6 +411,13 @@ async function coreIamAuth(request) {
     
     */
     // 2. LOCAL JWT VERIFICATION & REFRESH
+    // FIX (SDK-9): strip any client-supplied `x-coreiam-identity` header BEFORE
+    // any pass-through. getSession() (actions.ts) trusts this header verbatim,
+    // and on unauthenticated paths the original request headers flow straight
+    // into Server Components — a forged header manufactured an identity there.
+    // Only branches that complete verification re-attach it, to this copy.
+    const sanitizedHeaders = new Headers(request.headers);
+    sanitizedHeaders.delete('x-coreiam-identity');
     //    Now delegates to CoreIAM.verifySession — the same code path Express
     //    users get, so the two implementations can never drift.
     const jwtCookie = request.cookies.get("jwt");
@@ -366,7 +427,7 @@ async function coreIamAuth(request) {
     if (client) {
         const result = await client.verifySession(request.headers);
         if (result.identity) {
-            const requestHeaders = new Headers(request.headers);
+            const requestHeaders = new Headers(sanitizedHeaders);
             requestHeaders.set('x-coreiam-identity', JSON.stringify(result.identity));
             return {
                 response: server_1.NextResponse.next({ request: { headers: requestHeaders } }),
@@ -388,33 +449,56 @@ async function coreIamAuth(request) {
         }
         const result = await refreshInFlight;
         if (result) {
-            const requestHeaders = new Headers(request.headers);
+            const requestHeaders = new Headers(sanitizedHeaders);
             requestHeaders.set('cookie', `jwt=${result.jwt}; refreshToken=${result.refreshToken}`);
             requestHeaders.set('Authorization', `Bearer ${result.jwt}`);
-            try {
-                const payloadB64 = result.jwt.split('.')[1];
-                const payloadStr = Buffer.from(payloadB64, 'base64').toString('utf8');
-                const payload = JSON.parse(payloadStr);
-                requestHeaders.set('x-coreiam-identity', JSON.stringify({
-                    sub: payload.sub,
-                    email: payload.email,
-                    tenantId: payload.tenantId,
-                    roles: payload.roles || []
-                }));
+            // try {
+            //   const payloadB64 = result.jwt.split('.')[1];
+            //   const payloadStr = Buffer.from(payloadB64, 'base64').toString('utf8');
+            //   const payload = JSON.parse(payloadStr);
+            //   requestHeaders.set('x-coreiam-identity', JSON.stringify({
+            //     sub: payload.sub,
+            //     email: payload.email,
+            //     tenantId: payload.tenantId,
+            //     roles: payload.roles || []
+            //   }));
+            // } catch {}
+            // // FIX: forward requestHeaders (fresh cookie + identity) — NOT sanitizedHeaders,
+            // // which still carries the old expired cookie.
+            // const response = NextResponse.next({ request: { headers: requestHeaders } });
+            // const isProd = process.env.NODE_ENV === 'production';
+            // response.cookies.set('jwt', result.jwt, { httpOnly: true, secure: isProd, sameSite: 'strict', maxAge: 24 * 60 * 60 });
+            // response.cookies.set('refreshToken', result.refreshToken, { httpOnly: true, secure: isProd, sameSite: 'strict', maxAge: 7 * 24 * 60 * 60 });
+            // return { response, isAuthenticated: true };
+            // FIX (SDK-12): don't decode the JWT by hand. Buffer isn't available in
+            // the Edge runtime (Next middleware's default) — that throw was silently
+            // swallowed by the empty catch, leaving x-coreiam-identity missing on Edge.
+            // Verifying through the same funnel everything else uses fixes that and
+            // keeps ONE verification implementation. verifySession accepts a
+            // cookie-header string.
+            const verified = await client?.verifySession(`jwt=${result.jwt}`);
+            if (verified?.identity) {
+                requestHeaders.set('x-coreiam-identity', JSON.stringify(verified.identity));
             }
-            catch { }
+            // FIX: forward requestHeaders (fresh cookie + identity) — NOT sanitizedHeaders,
+            // which still carries the old expired cookie.
             const response = server_1.NextResponse.next({ request: { headers: requestHeaders } });
             const isProd = process.env.NODE_ENV === 'production';
-            response.cookies.set('jwt', result.jwt, { httpOnly: true, secure: isProd, sameSite: 'strict', maxAge: 24 * 60 * 60 });
-            response.cookies.set('refreshToken', result.refreshToken, { httpOnly: true, secure: isProd, sameSite: 'strict', maxAge: 7 * 24 * 60 * 60 });
+            // FIX (SDK-11): Max-Age derived from the backend's own Set-Cookie (see
+            // performRefresh) instead of hardcoded 24h/7d, and sameSite 'lax' to match
+            // the link-confirm handler — previously the only lax/strict mismatch.
+            response.cookies.set('jwt', result.jwt, { httpOnly: true, secure: isProd, sameSite: 'lax', maxAge: result.jwtMaxAge });
+            response.cookies.set('refreshToken', result.refreshToken, { httpOnly: true, secure: isProd, sameSite: 'lax', maxAge: result.refreshMaxAge });
             return { response, isAuthenticated: true };
         }
-        const response = server_1.NextResponse.next();
+        // FIX (SDK-9): failure branch must forward sanitizedHeaders too — bare next()
+        // passes the original headers through, re-opening the forged-header hole.
+        const response = server_1.NextResponse.next({ request: { headers: sanitizedHeaders } });
         response.cookies.delete('jwt');
         response.cookies.delete('refreshToken');
         return { response, isAuthenticated: false };
     }
-    return { response: server_1.NextResponse.next(), isAuthenticated: false };
+    return { response: server_1.NextResponse.next({ request: { headers: sanitizedHeaders } }), isAuthenticated: false };
 }
 /**
  * 1-line middleware factory for developers who don't need custom routing.
@@ -424,7 +508,10 @@ function coreIamMiddleware(options = {}) {
     return async (request) => {
         const { response, isAuthenticated } = await coreIamAuth(request);
         const pathname = request.nextUrl.pathname;
-        const isPublicRoute = publicRoutes.some(route => pathname.startsWith(route));
+        // const isPublicRoute = publicRoutes.some(route => pathname.startsWith(route));
+        // FIX (SDK-15): exact-segment prefix match — '/blog' must not also make
+        // '/blog-admin' public. Tolerates routes declared with a trailing slash.
+        const isPublicRoute = publicRoutes.some(route => pathname === route || pathname.startsWith(route.endsWith('/') ? route : route + '/'));
         // If not authenticated and trying to access a protected route
         if (!isAuthenticated && !isPublicRoute) {
             const redirect = server_1.NextResponse.redirect(new URL(signInUrl, request.url));

package/dist/nextjs/provider.d.ts

@@ -1,5 +1,5 @@
 import React from 'react';
-import type { CoreIAMIdentity } from '../core';
+import { type CoreIAMIdentity } from '../core';
 interface AuthContextType {
     identity: CoreIAMIdentity | null;
     isLoading: boolean;
@@ -21,6 +21,22 @@ interface AuthContextType {
         error?: string;
     }>;
     refetchIdentity: () => Promise<void>;
+    requestOtp: (email: string) => Promise<{
+        success?: boolean;
+        error?: string;
+    }>;
+    verifyOtp: (email: string, otp: string) => Promise<{
+        success?: boolean;
+        error?: string;
+    }>;
+    forgotPassword: (email: string) => Promise<{
+        success?: boolean;
+        error?: string;
+    }>;
+    resetPassword: (email: string, otp: string, newPassword: string) => Promise<{
+        success?: boolean;
+        error?: string;
+    }>;
 }
 export declare function CoreIAMProvider({ children, initialIdentity }: {
     children: React.ReactNode;

package/dist/nextjs/provider.js

@@ -60,6 +60,7 @@ const jsx_runtime_1 = require("react/jsx-runtime");
 const react_1 = require("react");
 const navigation_1 = require("next/navigation");
 const actions_1 = require("./actions");
+const core_1 = require("../core");
 const AuthContext = (0, react_1.createContext)({
     identity: null,
     isLoading: true,
@@ -69,6 +70,10 @@ const AuthContext = (0, react_1.createContext)({
     register: async () => ({ error: 'Not mounted' }),
     verifyMfa: async () => ({ error: 'Not mounted' }),
     refetchIdentity: async () => { },
+    requestOtp: async () => ({ error: 'Not mounted' }),
+    verifyOtp: async () => ({ error: 'Not mounted' }),
+    forgotPassword: async () => ({ error: 'Not mounted' }),
+    resetPassword: async () => ({ error: 'Not mounted' }),
 });
 function CoreIAMProvider({ children, initialIdentity }) {
     const [identity, setIdentity] = (0, react_1.useState)(initialIdentity ?? null);
@@ -107,9 +112,19 @@ function CoreIAMProvider({ children, initialIdentity }) {
     const verifyMfa = async (tempToken, code) => {
         setIsLoading(true);
         try {
+            // FIX (SDK-2): perform the CSRF handshake before calling /api/auth/mfa/login.
+            // That path is in CSRF_PROTECTED_PATHS and the backend CsrfGuard is
+            // double-submit (the x-csrf-token header must equal the csrfToken cookie).
+            // The login-phase handshake already placed the csrf cookie in the browser
+            // jar, so only the header echo was missing — which made every provider
+            // MFA login fail with 403. This now mirrors the login() flow exactly.
+            const csrfToken = await getCsrfToken();
             const res = await fetch('/api/auth/mfa/login', {
                 method: 'POST',
-                headers: { 'Content-Type': 'application/json' },
+                headers: {
+                    'Content-Type': 'application/json',
+                    'x-csrf-token': csrfToken,
+                },
                 credentials: 'include',
                 body: JSON.stringify({ tempToken, code }),
             });
@@ -128,6 +143,101 @@ function CoreIAMProvider({ children, initialIdentity }) {
             setIsLoading(false);
         }
     };
+    const requestOtp = async (email) => {
+        setIsLoading(true);
+        try {
+            const csrfToken = await getCsrfToken();
+            const res = await fetch('/api/auth/request-otp', {
+                method: 'POST',
+                headers: { 'Content-Type': 'application/json', 'x-csrf-token': csrfToken },
+                credentials: 'include',
+                body: JSON.stringify({ email }),
+            });
+            const data = await res.json();
+            if (!res.ok)
+                return { error: data.message || 'OTP request failed' };
+            return { success: true };
+        }
+        catch {
+            return { error: 'Something went wrong' };
+        }
+        finally {
+            setIsLoading(false);
+        }
+    };
+    const verifyOtp = async (email, otp) => {
+        setIsLoading(true);
+        try {
+            const csrfToken = await getCsrfToken();
+            const res = await fetch('/api/auth/verify-otp', {
+                method: 'POST',
+                headers: { 'Content-Type': 'application/json', 'x-csrf-token': csrfToken },
+                credentials: 'include',
+                body: JSON.stringify({ email, otp }),
+            });
+            const data = await res.json();
+            if (!res.ok)
+                return { error: data.message || 'Invalid or expired OTP' };
+            // Session established (jwt cookie set server-side) — hard refresh to
+            // let the server re-render authenticated, same as login()/verifyMfa().
+            window.location.href = '/';
+            return { success: true };
+        }
+        catch {
+            return { error: 'Something went wrong' };
+        }
+        finally {
+            setIsLoading(false);
+        }
+    };
+    const forgotPassword = async (email) => {
+        setIsLoading(true);
+        try {
+            const csrfToken = await getCsrfToken();
+            const res = await fetch('/api/auth/request-reset', {
+                method: 'POST',
+                headers: { 'Content-Type': 'application/json', 'x-csrf-token': csrfToken },
+                credentials: 'include',
+                body: JSON.stringify({ email }),
+            });
+            const data = await res.json();
+            if (!res.ok)
+                return { error: data.message || 'Reset request failed' };
+            // Backend response is uniform (no account-existence leak) — treat
+            // success generically; UI copy ("if the account exists…") is the app's.
+            return { success: true };
+        }
+        catch {
+            return { error: 'Something went wrong' };
+        }
+        finally {
+            setIsLoading(false);
+        }
+    };
+    const resetPassword = async (email, otp, newPassword) => {
+        setIsLoading(true);
+        try {
+            const csrfToken = await getCsrfToken();
+            const res = await fetch('/api/auth/reset-password', {
+                method: 'POST',
+                headers: { 'Content-Type': 'application/json', 'x-csrf-token': csrfToken },
+                credentials: 'include',
+                body: JSON.stringify({ email, otp, newPassword }),
+            });
+            const data = await res.json();
+            if (!res.ok)
+                return { error: data.message || 'Password reset failed' };
+            // All sessions revoked server-side — route to login with the new password.
+            window.location.href = '/auth/login';
+            return { success: true };
+        }
+        catch {
+            return { error: 'Something went wrong' };
+        }
+        finally {
+            setIsLoading(false);
+        }
+    };
     const login = async (values, callbackUrl) => {
         setIsLoading(true);
         try {
@@ -151,7 +261,20 @@ function CoreIAMProvider({ children, initialIdentity }) {
                 return { twoFactor: true, tempToken: data.tempToken };
             }
             // Hard refresh to let server re-render with new cookies
-            window.location.href = callbackUrl || '/';
+            // FIX (SDK-8): defense-in-depth — only same-origin relative callback URLs.
+            // Airtight defense-in-depth against open redirects
+            const cb = callbackUrl || '/';
+            let target;
+            try {
+                target = new URL(cb, window.location.origin);
+            }
+            catch {
+                return { error: 'Invalid callback URL' };
+            }
+            if (target.origin !== window.location.origin) {
+                return { error: 'Invalid callback URL' };
+            }
+            window.location.href = target.pathname + target.search + target.hash;
             return { success: true };
         }
         catch {
@@ -192,6 +315,15 @@ function CoreIAMProvider({ children, initialIdentity }) {
             if (!res.ok) {
                 if (data.code === 'OAUTH_ACCOUNT_EXISTS') {
                     // Automatically redirect to the OAuth provider!
+                    // FIX (SDK-8): route only to known providers (local literal — importing
+                    // OAUTH_PROVIDERS from ../core would pull server code into the client bundle).
+                    if (!['google', 'github'].includes(data.provider)) {
+                        return { error: 'Unsupported provider' };
+                    }
+                    // Use the exported Set from core instead of a hardcoded array to prevent drift
+                    if (!core_1.OAUTH_PROVIDERS.has(data.provider)) {
+                        return { error: 'Unsupported provider' };
+                    }
                     window.location.href = `/api/auth/oauth/${data.provider}`;
                     return { success: true };
                 }
@@ -207,7 +339,7 @@ function CoreIAMProvider({ children, initialIdentity }) {
             setIsLoading(false);
         }
     };
-    return ((0, jsx_runtime_1.jsx)(AuthContext.Provider, { value: { identity, isLoading, isAuthenticated: !!identity, login, logout, register, verifyMfa, refetchIdentity }, children: children }));
+    return ((0, jsx_runtime_1.jsx)(AuthContext.Provider, { value: { identity, isLoading, isAuthenticated: !!identity, login, logout, register, verifyMfa, refetchIdentity, requestOtp, verifyOtp, forgotPassword, resetPassword }, children: children }));
 }
 function useAuth() {
     return (0, react_1.useContext)(AuthContext);

package/package.json

@@ -1,6 +1,6 @@
 {
   "name": "@coreiam/auth",
-  "version": "1.0.392-beta.4",
+  "version": "1.0.392-beta.8",
   "main": "./dist/core/index.js",
   "types": "./dist/core/index.d.ts",
   "exports": {