@coreiam/auth 1.0.5 → 1.0.7

package/dist/core/index.js

@@ -51,7 +51,11 @@ class CoreIAM {
         const cookie = incomingHeaders.get('cookie');
         if (cookie) {
             headers.set('cookie', cookie);
-            const jwtMatch = cookie.match(/jwt=([^;]+)/);
+            // FIX: anchored to a real cookie-name boundary (start of string, or right
+            // after "; "), so this can't match "jwt=" as a substring of some other
+            // cookie's name or value. Not currently exploitable (no other cookie in
+            // this system contains "jwt="), but cheap to close off.
+            const jwtMatch = cookie.match(/(?:^|;\s*)jwt=([^;]+)/);
             if (jwtMatch) {
                 headers.set('Authorization', `Bearer ${jwtMatch[1]}`);
             }

package/dist/nextjs/actions.d.ts

@@ -4,7 +4,7 @@ export interface AuthResult {
     status: number;
     data: any;
 }
-export declare function getSession(): Promise<CoreIAMIdentity | null>;
+export declare const getSession: () => Promise<CoreIAMIdentity | null>;
 export declare function loginActionSdk(identifier: string, password: string): Promise<AuthResult>;
 export declare function registerActionSdk(userData: any): Promise<AuthResult>;
 export declare function logoutActionSdk(): Promise<AuthResult>;

package/dist/nextjs/actions.js

@@ -1,14 +1,31 @@
 "use strict";
-// src/nextjs/actions.ts
 'use server';
 Object.defineProperty(exports, "__esModule", { value: true });
-exports.getSession = getSession;
+exports.getSession = void 0;
 exports.loginActionSdk = loginActionSdk;
 exports.registerActionSdk = registerActionSdk;
 exports.logoutActionSdk = logoutActionSdk;
+const react_1 = require("react");
 const headers_1 = require("next/headers");
 const core_1 = require("../core");
-const iam = new core_1.CoreIAM();
+// FIX: lazy singleton instead of `const iam = new CoreIAM();` at module
+// scope. The constructor throws if COREIAM_API_KEY/COREIAM_API_URL are
+// missing — fine on the server, where those env vars exist — but a
+// module-level throw happens the instant the module is evaluated, before
+// any function in it is even called. If this module's 'use server'
+// boundary is ever not recognized correctly by the bundler (see the note
+// on the browser error below), the real module gets included in the client
+// bundle instead of being swapped for action-reference stubs, and that
+// throw fires in the browser instead, where those env vars are never
+// defined. Making this lazy doesn't fix a lost 'use server' boundary by
+// itself, but it does mean import alone can never crash — only an actual
+// invocation can, which is strictly better either way.
+let _iam = null;
+function getIam() {
+    if (!_iam)
+        _iam = new core_1.CoreIAM();
+    return _iam;
+}
 async function syncCookiesToNext(response) {
     const cookieStore = await (0, headers_1.cookies)();
     const setCookies = response.headers.getSetCookie();
@@ -54,20 +71,40 @@ async function syncCookiesToNext(response) {
         }
     }
 }
-async function getSession() {
+// FIX: wrapped in React's cache(). This is the generic fix for "why are we
+// calling /profile so much" — any number of calls to getSession() within the
+// same request/render (direct calls, or nested inside a consumer's own
+// currentUser()-style wrapper) now collapse into a single network round trip
+// to CoreIAM automatically, for every current and future call site.
+//
+// Deliberately NOT adding a refresh-retry fallback here (an earlier draft in
+// this thread did). Next.js only allows cookies().set()/cookies().delete()
+// inside a Server Action or Route Handler — never during a Server Component
+// render — and getSession() is called from both (e.g. from a plain
+// RootLayout render, and from consumers' currentUser()-style wrappers used
+// throughout Server Components). A refresh path that can only sometimes
+// persist its new cookies isn't safe: on the render-context call it would
+// still redeem the refresh token server-side (rotating/burning it) but never
+// deliver the new one to the browser, stranding the client on a now-dead
+// refresh token. Refresh belongs solely in middleware.ts, which is the one
+// place in the request lifecycle actually allowed to mutate response
+// cookies. If middleware already refreshed upstream, this succeeds; if
+// middleware's refresh also failed, returning null here is correct, not a
+// bug to work around.
+exports.getSession = (0, react_1.cache)(async () => {
     const reqHeaders = await (0, headers_1.headers)();
-    const response = await iam.proxy('/auth/profile', { method: 'GET' }, reqHeaders);
+    const response = await getIam().proxy('/auth/profile', { method: 'GET' }, reqHeaders);
     if (!response.ok)
         return null;
     const coreIamIdentity = await response.json();
     if (!coreIamIdentity?.sub)
         return null;
     return coreIamIdentity;
-}
+});
 async function loginActionSdk(identifier, password) {
     const reqHeaders = await (0, headers_1.headers)();
     try {
-        const response = await iam.loginWithCsrfProtection(identifier, password, reqHeaders);
+        const response = await getIam().loginWithCsrfProtection(identifier, password, reqHeaders);
         await syncCookiesToNext(response);
         return { ok: response.ok, status: response.status, data: await response.json().catch(() => ({})) };
     }
@@ -78,7 +115,7 @@ async function loginActionSdk(identifier, password) {
 async function registerActionSdk(userData) {
     const reqHeaders = await (0, headers_1.headers)();
     try {
-        const response = await iam.registerWithCsrfProtection(userData, reqHeaders);
+        const response = await getIam().registerWithCsrfProtection(userData, reqHeaders);
         await syncCookiesToNext(response);
         return { ok: response.ok, status: response.status, data: await response.json().catch(() => ({})) };
     }
@@ -89,7 +126,7 @@ async function registerActionSdk(userData) {
 async function logoutActionSdk() {
     const reqHeaders = await (0, headers_1.headers)();
     try {
-        const response = await iam.logout(reqHeaders);
+        const response = await getIam().logout(reqHeaders);
         await syncCookiesToNext(response);
         return { ok: response.ok, status: response.status, data: await response.json().catch(() => ({})) };
     }

package/dist/nextjs/middleware.js

@@ -4,6 +4,51 @@ exports.coreIamMiddleware = coreIamMiddleware;
 // src/nextjs/middleware.ts
 const server_1 = require("next/server");
 const jwt_decode_1 = require("jwt-decode");
+// Module-level: persists across requests as long as this runs in a single,
+// long-running Node process (true for a VPS deploy). This lets concurrent
+// middleware invocations on THIS process share one in-flight refresh
+// instead of each independently redeeming the same (single-use) refresh
+// token and knocking each other out with 401 Invalid refresh token.
+//
+// This lock is per-process by nature — no amount of cleverness here makes
+// it coordinate across multiple Node processes/instances, since it's just
+// in-memory state. That's fine: it's an optimization (avoids the latency
+// and CoreIAM load of firing off N calls that are mostly doomed to fail
+// anyway), not the thing that makes rotation actually correct under
+// concurrency. That guarantee now lives where all callers ultimately
+// converge regardless of how many Qalam or CoreIAM processes exist: a
+// conditional (WHERE isRevoked: false) update inside a transaction in
+// auth.service.ts's refreshToken(), enforced by Postgres itself. If this
+// lock is ever bypassed or scaled beyond one process, refreshes just get a
+// little less efficient (a few requests eagerly hit CoreIAM instead of
+// waiting on a local promise) — they don't get less correct.
+let refreshInFlight = null;
+async function performRefresh(refreshTokenCookie, jwtCookie, gatewayUrl) {
+    try {
+        const refreshRes = await fetch(`${gatewayUrl}/auth/refresh-token`, {
+            method: 'POST',
+            headers: {
+                'X-API-Key': process.env.COREIAM_API_KEY,
+                'cookie': `refreshToken=${refreshTokenCookie?.value || ''}; jwt=${jwtCookie?.value || ''}`,
+            },
+        });
+        if (!refreshRes.ok)
+            return null;
+        const setCookies = refreshRes.headers.getSetCookie();
+        let newJwt = '';
+        let newRefreshToken = '';
+        setCookies.forEach(cookie => {
+            if (cookie.startsWith('jwt='))
+                newJwt = cookie.split(';')[0].split('=')[1];
+            if (cookie.startsWith('refreshToken='))
+                newRefreshToken = cookie.split(';')[0].split('=')[1];
+        });
+        return newJwt ? { jwt: newJwt, refreshToken: newRefreshToken } : null;
+    }
+    catch (error) {
+        return null;
+    }
+}
 /**
  * Handles CoreIAM token refresh and header rewriting.
  * Returns the NextResponse to return, and whether the user is authenticated.
@@ -32,44 +77,38 @@ async function coreIamMiddleware(request) {
     else if (refreshTokenCookie) {
         needsRefresh = true;
     }
-    // 1. ATTEMPT SILENT REFRESH
+    // 1. ATTEMPT SILENT REFRESH (single-flight)
     if (needsRefresh && gatewayUrl) {
-        try {
-            const refreshRes = await fetch(`${gatewayUrl}/auth/refresh-token`, {
-                method: 'POST',
-                headers: {
-                    'X-API-Key': process.env.COREIAM_API_KEY,
-                    'cookie': `refreshToken=${refreshTokenCookie?.value || ''}; jwt=${jwtCookie?.value || ''}`,
-                },
+        if (!refreshInFlight) {
+            refreshInFlight = performRefresh(refreshTokenCookie, jwtCookie, gatewayUrl).finally(() => {
+                refreshInFlight = null;
             });
-            if (refreshRes.ok) {
-                const setCookies = refreshRes.headers.getSetCookie();
-                if (setCookies && setCookies.length > 0) {
-                    let newJwt = '';
-                    let newRefreshToken = '';
-                    setCookies.forEach(cookie => {
-                        if (cookie.startsWith('jwt='))
-                            newJwt = cookie.split(';')[0].split('=')[1];
-                        if (cookie.startsWith('refreshToken='))
-                            newRefreshToken = cookie.split(';')[0].split('=')[1];
-                    });
-                    if (newJwt) {
-                        const requestHeaders = new Headers(request.headers);
-                        requestHeaders.set('cookie', `jwt=${newJwt}; refreshToken=${newRefreshToken}`);
-                        requestHeaders.set('Authorization', `Bearer ${newJwt}`);
-                        const response = server_1.NextResponse.next({
-                            request: { headers: requestHeaders },
-                        });
-                        setCookies.forEach(cookie => {
-                            response.headers.append('set-cookie', cookie);
-                        });
-                        return { response, isAuthenticated: true };
-                    }
-                }
-            }
         }
-        catch (error) {
-            // Refresh failed, fall through to clear cookies
+        const result = await refreshInFlight;
+        if (result) {
+            const requestHeaders = new Headers(request.headers);
+            requestHeaders.set('cookie', `jwt=${result.jwt}; refreshToken=${result.refreshToken}`);
+            requestHeaders.set('Authorization', `Bearer ${result.jwt}`);
+            const response = server_1.NextResponse.next({
+                request: { headers: requestHeaders },
+            });
+            // FIX: flags now match cookie.util.ts exactly (httpOnly, sameSite:
+            // 'strict', secure in production only, correct maxAge per cookie),
+            // instead of the placeholder flags used before that file was reviewed.
+            const isProd = process.env.NODE_ENV === 'production';
+            response.cookies.set('jwt', result.jwt, {
+                httpOnly: true,
+                secure: isProd,
+                sameSite: 'strict',
+                maxAge: 24 * 60 * 60, // seconds — matches the 24h maxAge in cookie.util.ts
+            });
+            response.cookies.set('refreshToken', result.refreshToken, {
+                httpOnly: true,
+                secure: isProd,
+                sameSite: 'strict',
+                maxAge: 7 * 24 * 60 * 60, // seconds — matches the 7d maxAge in cookie.util.ts
+            });
+            return { response, isAuthenticated: true };
         }
         // 2. IF REFRESH FAILED, CLEAR COOKIES
         const response = server_1.NextResponse.next();

package/dist/nextjs/provider.d.ts

@@ -1,10 +1,39 @@
 import React from 'react';
+import type { CoreIAMIdentity } from '../core';
+export interface CoreIAMRedirects {
+    /** Where to send the user after a successful login, if no callbackUrl is passed to login(). */
+    afterLogin?: string;
+    /** Where to send the user after logout. */
+    afterLogout?: string;
+}
+interface LoginResult {
+    success?: boolean;
+    error?: string;
+}
 interface AuthContextType {
-    user: any | null;
+    /**
+     * Generic CoreIAM identity (sub/email/roles/tenantId) — NOT an app-shaped
+     * user. This SDK has no knowledge of any consumer's local user model
+     * (roles, profile fields, etc). Consumers that need an enriched user
+     * object should build their own layer on top of this, keyed off `sub`.
+     */
+    identity: CoreIAMIdentity | null;
     isLoading: boolean;
+    isAuthenticated: boolean;
+    login: (values: {
+        email: string;
+        password: string;
+    }, callbackUrl?: string) => Promise<LoginResult>;
+    logout: () => Promise<void>;
+    register: (userData: Record<string, any>) => Promise<LoginResult>;
+    refetchIdentity: () => Promise<void>;
 }
-export declare function CoreIAMProvider({ children }: {
+export declare function CoreIAMProvider({ children, initialIdentity, redirects, }: {
     children: React.ReactNode;
+    /** Pass the result of a server-side getSession() call to skip the client fetch on first paint. */
+    initialIdentity?: CoreIAMIdentity | null;
+    /** Where to redirect after login/logout. Omit for no redirect (caller handles navigation itself). */
+    redirects?: CoreIAMRedirects;
 }): import("react/jsx-runtime").JSX.Element;
 export declare function useAuth(): AuthContextType;
 export {};

package/dist/nextjs/provider.js

@@ -1,25 +1,94 @@
 "use strict";
-// src/nextjs/provider.tsx
 'use client';
 Object.defineProperty(exports, "__esModule", { value: true });
 exports.CoreIAMProvider = CoreIAMProvider;
 exports.useAuth = useAuth;
 const jsx_runtime_1 = require("react/jsx-runtime");
 const react_1 = require("react");
+const navigation_1 = require("next/navigation");
+const actions_1 = require("./actions");
 const AuthContext = (0, react_1.createContext)({
-    user: null,
+    identity: null,
     isLoading: true,
+    isAuthenticated: false,
+    login: async () => ({ error: 'CoreIAMProvider is not mounted' }),
+    logout: async () => { },
+    register: async () => ({ error: 'CoreIAMProvider is not mounted' }),
+    refetchIdentity: async () => { },
 });
-function CoreIAMProvider({ children }) {
-    const [user, setUser] = (0, react_1.useState)(null);
-    const [isLoading, setIsLoading] = (0, react_1.useState)(true);
+function CoreIAMProvider({ children, initialIdentity = null, redirects = {}, }) {
+    const [identity, setIdentity] = (0, react_1.useState)(initialIdentity);
+    const [isLoading, setIsLoading] = (0, react_1.useState)(initialIdentity === null);
+    const router = (0, navigation_1.useRouter)();
+    const refetchIdentity = async () => {
+        try {
+            const result = await (0, actions_1.getSession)();
+            setIdentity(result);
+        }
+        catch {
+            setIdentity(null);
+        }
+        finally {
+            setIsLoading(false);
+        }
+    };
     (0, react_1.useEffect)(() => {
-        fetch('/api/auth/session')
-            .then(res => res.ok ? res.json() : null)
-            .then(data => setUser(data))
-            .finally(() => setIsLoading(false));
+        if (initialIdentity === null) {
+            refetchIdentity();
+        }
+        else {
+            setIsLoading(false);
+        }
+        // Intentionally only on mount — initialIdentity is a one-time SSR seed,
+        // not something we want to re-run this effect for if it changes identity.
+        // eslint-disable-next-line react-hooks/exhaustive-deps
     }, []);
-    return ((0, jsx_runtime_1.jsx)(AuthContext.Provider, { value: { user, isLoading }, children: children }));
+    const login = async (values, callbackUrl) => {
+        setIsLoading(true);
+        try {
+            const result = await (0, actions_1.loginActionSdk)(values.email, values.password);
+            if (!result.ok) {
+                return { error: result.data?.message || result.data?.error || 'Invalid credentials' };
+            }
+            await refetchIdentity();
+            const target = callbackUrl || redirects.afterLogin;
+            if (target)
+                router.push(target);
+            return { success: true };
+        }
+        catch {
+            return { error: 'Something went wrong' };
+        }
+        finally {
+            setIsLoading(false);
+        }
+    };
+    const logout = async () => {
+        try {
+            await (0, actions_1.logoutActionSdk)();
+        }
+        finally {
+            setIdentity(null);
+            if (redirects.afterLogout)
+                router.push(redirects.afterLogout);
+        }
+    };
+    const register = async (userData) => {
+        setIsLoading(true);
+        try {
+            const result = await (0, actions_1.registerActionSdk)(userData);
+            if (!result.ok) {
+                return { error: result.data?.message || result.data?.error || 'Registration failed' };
+            }
+            // Registration on the backend doesn't auto-issue a session — log in
+            // immediately after, same as the flow this replaces did.
+            return await login({ email: userData.email, password: userData.password });
+        }
+        finally {
+            setIsLoading(false);
+        }
+    };
+    return ((0, jsx_runtime_1.jsx)(AuthContext.Provider, { value: { identity, isLoading, isAuthenticated: !!identity, login, logout, register, refetchIdentity }, children: children }));
 }
 function useAuth() {
     return (0, react_1.useContext)(AuthContext);

package/package.json

@@ -1,6 +1,6 @@
 {
   "name": "@coreiam/auth",
-  "version": "1.0.5",
+  "version": "1.0.7",
   "main": "./dist/core/index.js",
   "types": "./dist/core/index.d.ts",
   "exports": {