@coreiam/auth 1.0.4 → 1.0.6

package/dist/core/index.js

@@ -2,15 +2,17 @@
 // src/core/index.ts
 Object.defineProperty(exports, "__esModule", { value: true });
 exports.CoreIAM = void 0;
-const DEFAULT_GATEWAY_URL = "https://api.e-qalam.com";
 class CoreIAM {
     apiKey = '';
     baseUrl = '';
     constructor(config) {
         this.apiKey = config?.apiKey || process.env.COREIAM_API_KEY || '';
-        this.baseUrl = config?.baseUrl || DEFAULT_GATEWAY_URL;
+        // FIX: Removed hardcoded URL. Throw if missing.
+        this.baseUrl = config?.baseUrl || process.env.COREIAM_API_URL || '';
         if (!this.apiKey)
-            throw new Error('CoreIAM: Missing API Key');
+            throw new Error('CoreIAM: Missing API Key (COREIAM_API_KEY)');
+        if (!this.baseUrl)
+            throw new Error('CoreIAM: Missing Gateway URL (COREIAM_API_URL)');
     }
     // Exposed publicly so the Next.js layer can use it for getSession()
     async refreshTokens(headers) {
@@ -49,7 +51,11 @@ class CoreIAM {
         const cookie = incomingHeaders.get('cookie');
         if (cookie) {
             headers.set('cookie', cookie);
-            const jwtMatch = cookie.match(/jwt=([^;]+)/);
+            // FIX: anchored to a real cookie-name boundary (start of string, or right
+            // after "; "), so this can't match "jwt=" as a substring of some other
+            // cookie's name or value. Not currently exploitable (no other cookie in
+            // this system contains "jwt="), but cheap to close off.
+            const jwtMatch = cookie.match(/(?:^|;\s*)jwt=([^;]+)/);
             if (jwtMatch) {
                 headers.set('Authorization', `Bearer ${jwtMatch[1]}`);
             }

package/dist/nextjs/actions.d.ts

@@ -4,7 +4,7 @@ export interface AuthResult {
     status: number;
     data: any;
 }
-export declare function getSession(): Promise<CoreIAMIdentity | null>;
+export declare const getSession: () => Promise<CoreIAMIdentity | null>;
 export declare function loginActionSdk(identifier: string, password: string): Promise<AuthResult>;
 export declare function registerActionSdk(userData: any): Promise<AuthResult>;
 export declare function logoutActionSdk(): Promise<AuthResult>;

package/dist/nextjs/actions.js

@@ -1,11 +1,11 @@
 "use strict";
-// src/nextjs/actions.ts
 'use server';
 Object.defineProperty(exports, "__esModule", { value: true });
-exports.getSession = getSession;
+exports.getSession = void 0;
 exports.loginActionSdk = loginActionSdk;
 exports.registerActionSdk = registerActionSdk;
 exports.logoutActionSdk = logoutActionSdk;
+const react_1 = require("react");
 const headers_1 = require("next/headers");
 const core_1 = require("../core");
 const iam = new core_1.CoreIAM();
@@ -54,7 +54,27 @@ async function syncCookiesToNext(response) {
         }
     }
 }
-async function getSession() {
+// FIX: wrapped in React's cache(). This is the generic fix for "why are we
+// calling /profile so much" — any number of calls to getSession() within the
+// same request/render (direct calls, or nested inside a consumer's own
+// currentUser()-style wrapper) now collapse into a single network round trip
+// to CoreIAM automatically, for every current and future call site.
+//
+// Deliberately NOT adding a refresh-retry fallback here (an earlier draft in
+// this thread did). Next.js only allows cookies().set()/cookies().delete()
+// inside a Server Action or Route Handler — never during a Server Component
+// render — and getSession() is called from both (e.g. from a plain
+// RootLayout render, and from consumers' currentUser()-style wrappers used
+// throughout Server Components). A refresh path that can only sometimes
+// persist its new cookies isn't safe: on the render-context call it would
+// still redeem the refresh token server-side (rotating/burning it) but never
+// deliver the new one to the browser, stranding the client on a now-dead
+// refresh token. Refresh belongs solely in middleware.ts, which is the one
+// place in the request lifecycle actually allowed to mutate response
+// cookies. If middleware already refreshed upstream, this succeeds; if
+// middleware's refresh also failed, returning null here is correct, not a
+// bug to work around.
+exports.getSession = (0, react_1.cache)(async () => {
     const reqHeaders = await (0, headers_1.headers)();
     const response = await iam.proxy('/auth/profile', { method: 'GET' }, reqHeaders);
     if (!response.ok)
@@ -63,7 +83,7 @@ async function getSession() {
     if (!coreIamIdentity?.sub)
         return null;
     return coreIamIdentity;
-}
+});
 async function loginActionSdk(identifier, password) {
     const reqHeaders = await (0, headers_1.headers)();
     try {

package/dist/nextjs/index.d.ts

@@ -5,6 +5,6 @@ import { NextRequest, NextResponse } from 'next/server';
 import { CoreIAM } from '../core';
 export declare class NextHandlers {
     private iam;
-    constructor(iam: CoreIAM);
+    constructor(iam?: CoreIAM);
     handleProxy(req: NextRequest, internalPath: string): Promise<NextResponse<any>>;
 }

package/dist/nextjs/index.js

@@ -10,13 +10,16 @@ Object.defineProperty(exports, "loginActionSdk", { enumerable: true, get: functi
 Object.defineProperty(exports, "registerActionSdk", { enumerable: true, get: function () { return actions_1.registerActionSdk; } });
 Object.defineProperty(exports, "logoutActionSdk", { enumerable: true, get: function () { return actions_1.logoutActionSdk; } });
 Object.defineProperty(exports, "getSession", { enumerable: true, get: function () { return actions_1.getSession; } });
+// FIX: Export the new handleCoreIamAuth function instead of the old middleware
 var middleware_1 = require("./middleware");
 Object.defineProperty(exports, "coreIamMiddleware", { enumerable: true, get: function () { return middleware_1.coreIamMiddleware; } });
 const server_1 = require("next/server");
+const core_1 = require("../core");
 class NextHandlers {
     iam;
     constructor(iam) {
-        this.iam = iam;
+        // If no iam client is provided, instantiate one using the env variables
+        this.iam = iam || new core_1.CoreIAM({ apiKey: process.env.COREIAM_API_KEY, baseUrl: process.env.COREIAM_API_URL });
     }
     async handleProxy(req, internalPath) {
         const method = internalPath === '/csrf' ? 'POST' : req.method;

package/dist/nextjs/middleware.d.ts

@@ -1,2 +1,9 @@
 import { NextRequest, NextResponse } from 'next/server';
-export declare function coreIamMiddleware(): (request: NextRequest) => Promise<NextResponse<unknown>>;
+/**
+ * Handles CoreIAM token refresh and header rewriting.
+ * Returns the NextResponse to return, and whether the user is authenticated.
+ */
+export declare function coreIamMiddleware(request: NextRequest): Promise<{
+    response: NextResponse;
+    isAuthenticated: boolean;
+}>;

package/dist/nextjs/middleware.js

@@ -4,91 +4,118 @@ exports.coreIamMiddleware = coreIamMiddleware;
 // src/nextjs/middleware.ts
 const server_1 = require("next/server");
 const jwt_decode_1 = require("jwt-decode");
-const DEFAULT_GATEWAY_URL = "https://api.e-qalam.com";
-function coreIamMiddleware() {
-    return async function middleware(request) {
-        const { nextUrl } = request;
-        const pathname = nextUrl.pathname;
-        const jwtCookie = request.cookies.get("jwt");
-        const refreshTokenCookie = request.cookies.get("refreshToken");
-        let isLoggedIn = false;
-        let needsRefresh = false;
-        if (jwtCookie) {
-            try {
-                const decoded = (0, jwt_decode_1.jwtDecode)(jwtCookie.value);
-                if (decoded.exp && decoded.exp * 1000 > Date.now()) {
-                    isLoggedIn = true;
-                }
-                else {
-                    if (refreshTokenCookie)
-                        needsRefresh = true;
-                }
+// Module-level: persists across requests as long as this runs in a single,
+// long-running Node process (true for a VPS deploy). This lets concurrent
+// middleware invocations on THIS process share one in-flight refresh
+// instead of each independently redeeming the same (single-use) refresh
+// token and knocking each other out with 401 Invalid refresh token.
+//
+// This lock is per-process by nature — no amount of cleverness here makes
+// it coordinate across multiple Node processes/instances, since it's just
+// in-memory state. That's fine: it's an optimization (avoids the latency
+// and CoreIAM load of firing off N calls that are mostly doomed to fail
+// anyway), not the thing that makes rotation actually correct under
+// concurrency. That guarantee now lives where all callers ultimately
+// converge regardless of how many Qalam or CoreIAM processes exist: a
+// conditional (WHERE isRevoked: false) update inside a transaction in
+// auth.service.ts's refreshToken(), enforced by Postgres itself. If this
+// lock is ever bypassed or scaled beyond one process, refreshes just get a
+// little less efficient (a few requests eagerly hit CoreIAM instead of
+// waiting on a local promise) — they don't get less correct.
+let refreshInFlight = null;
+async function performRefresh(refreshTokenCookie, jwtCookie, gatewayUrl) {
+    try {
+        const refreshRes = await fetch(`${gatewayUrl}/auth/refresh-token`, {
+            method: 'POST',
+            headers: {
+                'X-API-Key': process.env.COREIAM_API_KEY,
+                'cookie': `refreshToken=${refreshTokenCookie?.value || ''}; jwt=${jwtCookie?.value || ''}`,
+            },
+        });
+        if (!refreshRes.ok)
+            return null;
+        const setCookies = refreshRes.headers.getSetCookie();
+        let newJwt = '';
+        let newRefreshToken = '';
+        setCookies.forEach(cookie => {
+            if (cookie.startsWith('jwt='))
+                newJwt = cookie.split(';')[0].split('=')[1];
+            if (cookie.startsWith('refreshToken='))
+                newRefreshToken = cookie.split(';')[0].split('=')[1];
+        });
+        return newJwt ? { jwt: newJwt, refreshToken: newRefreshToken } : null;
+    }
+    catch (error) {
+        return null;
+    }
+}
+/**
+ * Handles CoreIAM token refresh and header rewriting.
+ * Returns the NextResponse to return, and whether the user is authenticated.
+ */
+async function coreIamMiddleware(request) {
+    const jwtCookie = request.cookies.get("jwt");
+    const refreshTokenCookie = request.cookies.get("refreshToken");
+    const gatewayUrl = process.env.COREIAM_API_URL;
+    let isAuthenticated = false;
+    let needsRefresh = false;
+    if (jwtCookie) {
+        try {
+            const decoded = (0, jwt_decode_1.jwtDecode)(jwtCookie.value);
+            if (decoded.exp && decoded.exp * 1000 > Date.now()) {
+                isAuthenticated = true;
             }
-            catch {
-                if (refreshTokenCookie)
-                    needsRefresh = true;
+            else if (refreshTokenCookie) {
+                needsRefresh = true;
             }
         }
-        else if (refreshTokenCookie) {
-            needsRefresh = true;
-        }
-        // Allow API routes to pass through (we handle their 401s normally)
-        if (pathname.startsWith('/api')) {
-            return server_1.NextResponse.next();
-        }
-        // 1. ATTEMPT SILENT REFRESH
-        if (needsRefresh) {
-            try {
-                const refreshRes = await fetch(`${DEFAULT_GATEWAY_URL}/auth/refresh-token`, {
-                    method: 'POST',
-                    headers: {
-                        'X-API-Key': process.env.COREIAM_API_KEY,
-                        'cookie': `refreshToken=${refreshTokenCookie?.value || ''}; jwt=${jwtCookie?.value || ''}`,
-                    },
-                });
-                if (refreshRes.ok) {
-                    const setCookies = refreshRes.headers.getSetCookie();
-                    if (setCookies && setCookies.length > 0) {
-                        let newJwt = '';
-                        let newRefreshToken = '';
-                        setCookies.forEach(cookie => {
-                            if (cookie.startsWith('jwt='))
-                                newJwt = cookie.split(';')[0].split('=')[1];
-                            if (cookie.startsWith('refreshToken='))
-                                newRefreshToken = cookie.split(';')[0].split('=')[1];
-                        });
-                        // CRITICAL: Rewrite request headers so Server Components see the new JWT!
-                        const requestHeaders = new Headers(request.headers);
-                        requestHeaders.set('cookie', `jwt=${newJwt}; refreshToken=${newRefreshToken}`);
-                        requestHeaders.set('Authorization', `Bearer ${newJwt}`);
-                        const response = server_1.NextResponse.next({
-                            request: { headers: requestHeaders },
-                        });
-                        // Set the new cookies on the browser
-                        setCookies.forEach(cookie => {
-                            response.headers.append('set-cookie', cookie);
-                        });
-                        return response; // Exit early, token is fresh!
-                    }
-                }
-            }
-            catch (error) {
-                // Refresh failed, fall through to clear cookies
-            }
-            // 2. IF REFRESH FAILED, CLEAR COOKIES TO PREVENT INFINITE LOOP
-            const res = server_1.NextResponse.redirect(new URL('/auth/login', nextUrl));
-            res.cookies.delete('jwt');
-            res.cookies.delete('refreshToken');
-            return res;
+        catch {
+            if (refreshTokenCookie)
+                needsRefresh = true;
         }
-        // 3. STANDARD ROUTE PROTECTION
-        const isAuthRoute = pathname.startsWith('/auth/login') || pathname.startsWith('/auth/register');
-        if (isAuthRoute && isLoggedIn) {
-            return server_1.NextResponse.redirect(new URL('/', nextUrl));
+    }
+    else if (refreshTokenCookie) {
+        needsRefresh = true;
+    }
+    // 1. ATTEMPT SILENT REFRESH (single-flight)
+    if (needsRefresh && gatewayUrl) {
+        if (!refreshInFlight) {
+            refreshInFlight = performRefresh(refreshTokenCookie, jwtCookie, gatewayUrl).finally(() => {
+                refreshInFlight = null;
+            });
         }
-        if (!isLoggedIn && !isAuthRoute) {
-            return server_1.NextResponse.redirect(new URL('/auth/login', nextUrl));
+        const result = await refreshInFlight;
+        if (result) {
+            const requestHeaders = new Headers(request.headers);
+            requestHeaders.set('cookie', `jwt=${result.jwt}; refreshToken=${result.refreshToken}`);
+            requestHeaders.set('Authorization', `Bearer ${result.jwt}`);
+            const response = server_1.NextResponse.next({
+                request: { headers: requestHeaders },
+            });
+            // FIX: flags now match cookie.util.ts exactly (httpOnly, sameSite:
+            // 'strict', secure in production only, correct maxAge per cookie),
+            // instead of the placeholder flags used before that file was reviewed.
+            const isProd = process.env.NODE_ENV === 'production';
+            response.cookies.set('jwt', result.jwt, {
+                httpOnly: true,
+                secure: isProd,
+                sameSite: 'strict',
+                maxAge: 24 * 60 * 60, // seconds — matches the 24h maxAge in cookie.util.ts
+            });
+            response.cookies.set('refreshToken', result.refreshToken, {
+                httpOnly: true,
+                secure: isProd,
+                sameSite: 'strict',
+                maxAge: 7 * 24 * 60 * 60, // seconds — matches the 7d maxAge in cookie.util.ts
+            });
+            return { response, isAuthenticated: true };
         }
-        return server_1.NextResponse.next();
-    };
+        // 2. IF REFRESH FAILED, CLEAR COOKIES
+        const response = server_1.NextResponse.next();
+        response.cookies.delete('jwt');
+        response.cookies.delete('refreshToken');
+        return { response, isAuthenticated: false };
+    }
+    // 3. NO REFRESH NEEDED (Token is valid or completely missing)
+    return { response: server_1.NextResponse.next(), isAuthenticated };
 }

package/dist/nextjs/provider.d.ts

@@ -1,10 +1,39 @@
 import React from 'react';
+import type { CoreIAMIdentity } from '../core';
+export interface CoreIAMRedirects {
+    /** Where to send the user after a successful login, if no callbackUrl is passed to login(). */
+    afterLogin?: string;
+    /** Where to send the user after logout. */
+    afterLogout?: string;
+}
+interface LoginResult {
+    success?: boolean;
+    error?: string;
+}
 interface AuthContextType {
-    user: any | null;
+    /**
+     * Generic CoreIAM identity (sub/email/roles/tenantId) — NOT an app-shaped
+     * user. This SDK has no knowledge of any consumer's local user model
+     * (roles, profile fields, etc). Consumers that need an enriched user
+     * object should build their own layer on top of this, keyed off `sub`.
+     */
+    identity: CoreIAMIdentity | null;
     isLoading: boolean;
+    isAuthenticated: boolean;
+    login: (values: {
+        email: string;
+        password: string;
+    }, callbackUrl?: string) => Promise<LoginResult>;
+    logout: () => Promise<void>;
+    register: (userData: Record<string, any>) => Promise<LoginResult>;
+    refetchIdentity: () => Promise<void>;
 }
-export declare function CoreIAMProvider({ children }: {
+export declare function CoreIAMProvider({ children, initialIdentity, redirects, }: {
     children: React.ReactNode;
+    /** Pass the result of a server-side getSession() call to skip the client fetch on first paint. */
+    initialIdentity?: CoreIAMIdentity | null;
+    /** Where to redirect after login/logout. Omit for no redirect (caller handles navigation itself). */
+    redirects?: CoreIAMRedirects;
 }): import("react/jsx-runtime").JSX.Element;
 export declare function useAuth(): AuthContextType;
 export {};

package/dist/nextjs/provider.js

@@ -1,25 +1,94 @@
 "use strict";
-// src/nextjs/provider.tsx
 'use client';
 Object.defineProperty(exports, "__esModule", { value: true });
 exports.CoreIAMProvider = CoreIAMProvider;
 exports.useAuth = useAuth;
 const jsx_runtime_1 = require("react/jsx-runtime");
 const react_1 = require("react");
+const navigation_1 = require("next/navigation");
+const actions_1 = require("./actions");
 const AuthContext = (0, react_1.createContext)({
-    user: null,
+    identity: null,
     isLoading: true,
+    isAuthenticated: false,
+    login: async () => ({ error: 'CoreIAMProvider is not mounted' }),
+    logout: async () => { },
+    register: async () => ({ error: 'CoreIAMProvider is not mounted' }),
+    refetchIdentity: async () => { },
 });
-function CoreIAMProvider({ children }) {
-    const [user, setUser] = (0, react_1.useState)(null);
-    const [isLoading, setIsLoading] = (0, react_1.useState)(true);
+function CoreIAMProvider({ children, initialIdentity = null, redirects = {}, }) {
+    const [identity, setIdentity] = (0, react_1.useState)(initialIdentity);
+    const [isLoading, setIsLoading] = (0, react_1.useState)(initialIdentity === null);
+    const router = (0, navigation_1.useRouter)();
+    const refetchIdentity = async () => {
+        try {
+            const result = await (0, actions_1.getSession)();
+            setIdentity(result);
+        }
+        catch {
+            setIdentity(null);
+        }
+        finally {
+            setIsLoading(false);
+        }
+    };
     (0, react_1.useEffect)(() => {
-        fetch('/api/auth/session')
-            .then(res => res.ok ? res.json() : null)
-            .then(data => setUser(data))
-            .finally(() => setIsLoading(false));
+        if (initialIdentity === null) {
+            refetchIdentity();
+        }
+        else {
+            setIsLoading(false);
+        }
+        // Intentionally only on mount — initialIdentity is a one-time SSR seed,
+        // not something we want to re-run this effect for if it changes identity.
+        // eslint-disable-next-line react-hooks/exhaustive-deps
     }, []);
-    return ((0, jsx_runtime_1.jsx)(AuthContext.Provider, { value: { user, isLoading }, children: children }));
+    const login = async (values, callbackUrl) => {
+        setIsLoading(true);
+        try {
+            const result = await (0, actions_1.loginActionSdk)(values.email, values.password);
+            if (!result.ok) {
+                return { error: result.data?.message || result.data?.error || 'Invalid credentials' };
+            }
+            await refetchIdentity();
+            const target = callbackUrl || redirects.afterLogin;
+            if (target)
+                router.push(target);
+            return { success: true };
+        }
+        catch {
+            return { error: 'Something went wrong' };
+        }
+        finally {
+            setIsLoading(false);
+        }
+    };
+    const logout = async () => {
+        try {
+            await (0, actions_1.logoutActionSdk)();
+        }
+        finally {
+            setIdentity(null);
+            if (redirects.afterLogout)
+                router.push(redirects.afterLogout);
+        }
+    };
+    const register = async (userData) => {
+        setIsLoading(true);
+        try {
+            const result = await (0, actions_1.registerActionSdk)(userData);
+            if (!result.ok) {
+                return { error: result.data?.message || result.data?.error || 'Registration failed' };
+            }
+            // Registration on the backend doesn't auto-issue a session — log in
+            // immediately after, same as the flow this replaces did.
+            return await login({ email: userData.email, password: userData.password });
+        }
+        finally {
+            setIsLoading(false);
+        }
+    };
+    return ((0, jsx_runtime_1.jsx)(AuthContext.Provider, { value: { identity, isLoading, isAuthenticated: !!identity, login, logout, register, refetchIdentity }, children: children }));
 }
 function useAuth() {
     return (0, react_1.useContext)(AuthContext);

package/package.json

@@ -1,6 +1,6 @@
 {
   "name": "@coreiam/auth",
-  "version": "1.0.4",
+  "version": "1.0.6",
   "main": "./dist/core/index.js",
   "types": "./dist/core/index.d.ts",
   "exports": {