@coreiam/auth 1.0.8 → 1.0.10

package/dist/nextjs/actions.d.ts

@@ -4,7 +4,7 @@ export interface AuthResult {
     status: number;
     data: any;
 }
-export declare const getSession: () => Promise<CoreIAMIdentity | null>;
+export declare function getSession(): Promise<CoreIAMIdentity | null>;
 export declare function loginActionSdk(identifier: string, password: string): Promise<AuthResult>;
 export declare function registerActionSdk(userData: any): Promise<AuthResult>;
 export declare function logoutActionSdk(): Promise<AuthResult>;

package/dist/nextjs/actions.js

@@ -1,25 +1,13 @@
 "use strict";
-'use server';
+// src/nextjs/actions.ts
+// REMOVE 'use server' from here.
 Object.defineProperty(exports, "__esModule", { value: true });
-exports.getSession = void 0;
+exports.getSession = getSession;
 exports.loginActionSdk = loginActionSdk;
 exports.registerActionSdk = registerActionSdk;
 exports.logoutActionSdk = logoutActionSdk;
-const react_1 = require("react");
 const headers_1 = require("next/headers");
 const core_1 = require("../core");
-// FIX: lazy singleton instead of `const iam = new CoreIAM();` at module
-// scope. The constructor throws if COREIAM_API_KEY/COREIAM_API_URL are
-// missing — fine on the server, where those env vars exist — but a
-// module-level throw happens the instant the module is evaluated, before
-// any function in it is even called. If this module's 'use server'
-// boundary is ever not recognized correctly by the bundler (see the note
-// on the browser error below), the real module gets included in the client
-// bundle instead of being swapped for action-reference stubs, and that
-// throw fires in the browser instead, where those env vars are never
-// defined. Making this lazy doesn't fix a lost 'use server' boundary by
-// itself, but it does mean import alone can never crash — only an actual
-// invocation can, which is strictly better either way.
 let _iam = null;
 function getIam() {
     if (!_iam)
@@ -71,27 +59,8 @@ async function syncCookiesToNext(response) {
         }
     }
 }
-// FIX: wrapped in React's cache(). This is the generic fix for "why are we
-// calling /profile so much" — any number of calls to getSession() within the
-// same request/render (direct calls, or nested inside a consumer's own
-// currentUser()-style wrapper) now collapse into a single network round trip
-// to CoreIAM automatically, for every current and future call site.
-//
-// Deliberately NOT adding a refresh-retry fallback here (an earlier draft in
-// this thread did). Next.js only allows cookies().set()/cookies().delete()
-// inside a Server Action or Route Handler — never during a Server Component
-// render — and getSession() is called from both (e.g. from a plain
-// RootLayout render, and from consumers' currentUser()-style wrappers used
-// throughout Server Components). A refresh path that can only sometimes
-// persist its new cookies isn't safe: on the render-context call it would
-// still redeem the refresh token server-side (rotating/burning it) but never
-// deliver the new one to the browser, stranding the client on a now-dead
-// refresh token. Refresh belongs solely in middleware.ts, which is the one
-// place in the request lifecycle actually allowed to mutate response
-// cookies. If middleware already refreshed upstream, this succeeds; if
-// middleware's refresh also failed, returning null here is correct, not a
-// bug to work around.
-exports.getSession = (0, react_1.cache)(async () => {
+// This is called by Server Components (e.g., layout.tsx)
+async function getSession() {
     const reqHeaders = await (0, headers_1.headers)();
     const response = await getIam().proxy('/auth/profile', { method: 'GET' }, reqHeaders);
     if (!response.ok)
@@ -100,7 +69,9 @@ exports.getSession = (0, react_1.cache)(async () => {
     if (!coreIamIdentity?.sub)
         return null;
     return coreIamIdentity;
-});
+}
+// These are no longer called by the SDK's provider.tsx, 
+// but can still be used by Qalam's Server Actions if needed.
 async function loginActionSdk(identifier, password) {
     const reqHeaders = await (0, headers_1.headers)();
     try {

package/dist/nextjs/index.js

@@ -10,7 +10,6 @@ Object.defineProperty(exports, "loginActionSdk", { enumerable: true, get: functi
 Object.defineProperty(exports, "registerActionSdk", { enumerable: true, get: function () { return actions_1.registerActionSdk; } });
 Object.defineProperty(exports, "logoutActionSdk", { enumerable: true, get: function () { return actions_1.logoutActionSdk; } });
 Object.defineProperty(exports, "getSession", { enumerable: true, get: function () { return actions_1.getSession; } });
-// FIX: Export the new handleCoreIamAuth function instead of the old middleware
 var middleware_1 = require("./middleware");
 Object.defineProperty(exports, "coreIamMiddleware", { enumerable: true, get: function () { return middleware_1.coreIamMiddleware; } });
 const server_1 = require("next/server");
@@ -18,7 +17,6 @@ const core_1 = require("../core");
 class NextHandlers {
     iam;
     constructor(iam) {
-        // If no iam client is provided, instantiate one using the env variables
         this.iam = iam || new core_1.CoreIAM({ apiKey: process.env.COREIAM_API_KEY, baseUrl: process.env.COREIAM_API_URL });
     }
     async handleProxy(req, internalPath) {

package/dist/nextjs/middleware.js

@@ -4,24 +4,6 @@ exports.coreIamMiddleware = coreIamMiddleware;
 // src/nextjs/middleware.ts
 const server_1 = require("next/server");
 const jwt_decode_1 = require("jwt-decode");
-// Module-level: persists across requests as long as this runs in a single,
-// long-running Node process (true for a VPS deploy). This lets concurrent
-// middleware invocations on THIS process share one in-flight refresh
-// instead of each independently redeeming the same (single-use) refresh
-// token and knocking each other out with 401 Invalid refresh token.
-//
-// This lock is per-process by nature — no amount of cleverness here makes
-// it coordinate across multiple Node processes/instances, since it's just
-// in-memory state. That's fine: it's an optimization (avoids the latency
-// and CoreIAM load of firing off N calls that are mostly doomed to fail
-// anyway), not the thing that makes rotation actually correct under
-// concurrency. That guarantee now lives where all callers ultimately
-// converge regardless of how many Qalam or CoreIAM processes exist: a
-// conditional (WHERE isRevoked: false) update inside a transaction in
-// auth.service.ts's refreshToken(), enforced by Postgres itself. If this
-// lock is ever bypassed or scaled beyond one process, refreshes just get a
-// little less efficient (a few requests eagerly hit CoreIAM instead of
-// waiting on a local promise) — they don't get less correct.
 let refreshInFlight = null;
 async function performRefresh(refreshTokenCookie, jwtCookie, gatewayUrl) {
     try {
@@ -92,21 +74,18 @@ async function coreIamMiddleware(request) {
             const response = server_1.NextResponse.next({
                 request: { headers: requestHeaders },
             });
-            // FIX: flags now match cookie.util.ts exactly (httpOnly, sameSite:
-            // 'strict', secure in production only, correct maxAge per cookie),
-            // instead of the placeholder flags used before that file was reviewed.
             const isProd = process.env.NODE_ENV === 'production';
             response.cookies.set('jwt', result.jwt, {
                 httpOnly: true,
                 secure: isProd,
                 sameSite: 'strict',
-                maxAge: 24 * 60 * 60, // seconds — matches the 24h maxAge in cookie.util.ts
+                maxAge: 24 * 60 * 60,
             });
             response.cookies.set('refreshToken', result.refreshToken, {
                 httpOnly: true,
                 secure: isProd,
                 sameSite: 'strict',
-                maxAge: 7 * 24 * 60 * 60, // seconds — matches the 7d maxAge in cookie.util.ts
+                maxAge: 7 * 24 * 60 * 60,
             });
             return { response, isAuthenticated: true };
         }

package/dist/nextjs/provider.d.ts

@@ -1,22 +1,15 @@
 import React from 'react';
 import type { CoreIAMIdentity } from '../core';
 export interface CoreIAMRedirects {
-    /** Where to send the user after a successful login, if no callbackUrl is passed to login(). */
     afterLogin?: string;
-    /** Where to send the user after logout. */
     afterLogout?: string;
 }
 interface LoginResult {
     success?: boolean;
     error?: string;
+    twoFactor?: boolean;
 }
 interface AuthContextType {
-    /**
-     * Generic CoreIAM identity (sub/email/roles/tenantId) — NOT an app-shaped
-     * user. This SDK has no knowledge of any consumer's local user model
-     * (roles, profile fields, etc). Consumers that need an enriched user
-     * object should build their own layer on top of this, keyed off `sub`.
-     */
     identity: CoreIAMIdentity | null;
     isLoading: boolean;
     isAuthenticated: boolean;
@@ -30,9 +23,7 @@ interface AuthContextType {
 }
 export declare function CoreIAMProvider({ children, initialIdentity, redirects, }: {
     children: React.ReactNode;
-    /** Pass the result of a server-side getSession() call to skip the client fetch on first paint. */
     initialIdentity?: CoreIAMIdentity | null;
-    /** Where to redirect after login/logout. Omit for no redirect (caller handles navigation itself). */
     redirects?: CoreIAMRedirects;
 }): import("react/jsx-runtime").JSX.Element;
 export declare function useAuth(): AuthContextType;

package/dist/nextjs/provider.js

@@ -1,4 +1,5 @@
 "use strict";
+// src/nextjs/provider.tsx
 'use client';
 Object.defineProperty(exports, "__esModule", { value: true });
 exports.CoreIAMProvider = CoreIAMProvider;
@@ -6,7 +7,6 @@ exports.useAuth = useAuth;
 const jsx_runtime_1 = require("react/jsx-runtime");
 const react_1 = require("react");
 const navigation_1 = require("next/navigation");
-const actions_1 = require("./actions");
 const AuthContext = (0, react_1.createContext)({
     identity: null,
     isLoading: true,
@@ -20,10 +20,11 @@ function CoreIAMProvider({ children, initialIdentity, redirects = {}, }) {
     const [identity, setIdentity] = (0, react_1.useState)(initialIdentity ?? null);
     const [isLoading, setIsLoading] = (0, react_1.useState)(initialIdentity === undefined);
     const router = (0, navigation_1.useRouter)();
-    const refetchIdentity = async () => {
+    const refetchIdentity = (0, react_1.useCallback)(async () => {
         try {
-            const result = await (0, actions_1.getSession)();
-            setIdentity(result);
+            // Call the Next.js API route, which securely calls CoreIAM
+            const res = await fetch('/api/auth/session', { credentials: 'include' });
+            setIdentity(res.ok ? await res.json() : null);
         }
         catch {
             setIdentity(null);
@@ -31,33 +32,40 @@ function CoreIAMProvider({ children, initialIdentity, redirects = {}, }) {
         finally {
             setIsLoading(false);
         }
-    };
+    }, []);
     (0, react_1.useEffect)(() => {
-        // FIX: was `initialIdentity === null`, which can't tell "SSR ran and
-        // confirmed you're logged out" (a correct, final null) apart from "no
-        // SSR value was ever provided" (a real undefined). Since layout.tsx
-        // always calls getSession() and passes its result — even when that
-        // result legitimately is null — every logged-out page view was
-        // treated as "no SSR value, fetch again," firing a second, wholly
-        // redundant /auth/profile call for something SSR had already
-        // determined. undefined (the prop genuinely omitted) is the only case
-        // that should trigger this fallback fetch.
         if (initialIdentity === undefined) {
             refetchIdentity();
         }
         else {
             setIsLoading(false);
         }
-        // Intentionally only on mount — initialIdentity is a one-time SSR seed,
-        // not something we want to re-run this effect for if it changes identity.
         // eslint-disable-next-line react-hooks/exhaustive-deps
     }, []);
     const login = async (values, callbackUrl) => {
         setIsLoading(true);
         try {
-            const result = await (0, actions_1.loginActionSdk)(values.email, values.password);
-            if (!result.ok) {
-                return { error: result.data?.message || result.data?.error || 'Invalid credentials' };
+            // Fetch CSRF token first
+            const csrfRes = await fetch('/api/auth/csrf', { credentials: 'include' });
+            if (!csrfRes.ok)
+                return { error: 'Failed to get CSRF token' };
+            const { csrfToken } = await csrfRes.json();
+            // Call login API route
+            const loginRes = await fetch('/api/auth/login', {
+                method: 'POST',
+                headers: {
+                    'Content-Type': 'application/json',
+                    'x-csrf-token': csrfToken,
+                },
+                credentials: 'include',
+                body: JSON.stringify(values),
+            });
+            const data = await loginRes.json();
+            if (!loginRes.ok) {
+                return { error: data.message || data.error || 'Invalid credentials' };
+            }
+            if (data.twoFactor) {
+                return { twoFactor: true };
             }
             await refetchIdentity();
             const target = callbackUrl || redirects.afterLogin;
@@ -74,7 +82,10 @@ function CoreIAMProvider({ children, initialIdentity, redirects = {}, }) {
     };
     const logout = async () => {
         try {
-            await (0, actions_1.logoutActionSdk)();
+            await fetch('/api/auth/logout', {
+                method: 'POST',
+                credentials: 'include',
+            });
         }
         finally {
             setIdentity(null);
@@ -85,14 +96,29 @@ function CoreIAMProvider({ children, initialIdentity, redirects = {}, }) {
     const register = async (userData) => {
         setIsLoading(true);
         try {
-            const result = await (0, actions_1.registerActionSdk)(userData);
-            if (!result.ok) {
-                return { error: result.data?.message || result.data?.error || 'Registration failed' };
+            const csrfRes = await fetch('/api/auth/csrf', { credentials: 'include' });
+            if (!csrfRes.ok)
+                return { error: 'Failed to get CSRF token' };
+            const { csrfToken } = await csrfRes.json();
+            const registerRes = await fetch('/api/auth/register', {
+                method: 'POST',
+                headers: {
+                    'Content-Type': 'application/json',
+                    'x-csrf-token': csrfToken,
+                },
+                credentials: 'include',
+                body: JSON.stringify(userData),
+            });
+            if (!registerRes.ok) {
+                const error = await registerRes.json();
+                return { error: error.message || error.error || 'Registration failed' };
             }
-            // Registration on the backend doesn't auto-issue a session — log in
-            // immediately after, same as the flow this replaces did.
+            // Auto-login after registration
             return await login({ email: userData.email, password: userData.password });
         }
+        catch {
+            return { error: 'Something went wrong' };
+        }
         finally {
             setIsLoading(false);
         }

package/package.json

@@ -1,6 +1,6 @@
 {
   "name": "@coreiam/auth",
-  "version": "1.0.8",
+  "version": "1.0.10",
   "main": "./dist/core/index.js",
   "types": "./dist/core/index.d.ts",
   "exports": {