@coreiam/auth 1.0.9 → 1.0.10

package/dist/nextjs/actions.js

@@ -1,127 +1,6 @@
 "use strict";
-// 'use server';
-// import { cache } from 'react';
-// import { cookies, headers } from 'next/headers';
-// import { CoreIAM, CoreIAMIdentity } from '../core';
-// export interface AuthResult {
-//   ok: boolean;
-//   status: number;
-//   data: any;
-// }
-// // FIX: lazy singleton instead of `const iam = new CoreIAM();` at module
-// // scope. The constructor throws if COREIAM_API_KEY/COREIAM_API_URL are
-// // missing — fine on the server, where those env vars exist — but a
-// // module-level throw happens the instant the module is evaluated, before
-// // any function in it is even called. If this module's 'use server'
-// // boundary is ever not recognized correctly by the bundler (see the note
-// // on the browser error below), the real module gets included in the client
-// // bundle instead of being swapped for action-reference stubs, and that
-// // throw fires in the browser instead, where those env vars are never
-// // defined. Making this lazy doesn't fix a lost 'use server' boundary by
-// // itself, but it does mean import alone can never crash — only an actual
-// // invocation can, which is strictly better either way.
-// let _iam: CoreIAM | null = null;
-// function getIam(): CoreIAM {
-//   if (!_iam) _iam = new CoreIAM();
-//   return _iam;
-// }
-// async function syncCookiesToNext(response: Response) {
-//   const cookieStore = await cookies();
-//   const setCookies = response.headers.getSetCookie();
-//   for (const cookieStr of setCookies) {
-//     const parts = cookieStr.split(';');
-//     const [nameValue, ...attributes] = parts;
-//     const [name, ...valueParts] = nameValue.split('=');
-//     const cookieOptions: any = {};
-//     let isDeleting = false;
-//     attributes.forEach(attr => {
-//       const [attrName, attrValue] = attr.trim().split('=');
-//       const lowerName = attrName?.toLowerCase();
-//       if (lowerName === 'httponly') cookieOptions.httpOnly = true;
-//       if (lowerName === 'secure') cookieOptions.secure = true;
-//       if (lowerName === 'path') cookieOptions.path = attrValue || '/';
-//       if (lowerName === 'max-age') {
-//         const maxAge = parseInt(attrValue, 10);
-//         if (maxAge <= 0) isDeleting = true;
-//         else cookieOptions.maxAge = maxAge;
-//       }
-//       if (lowerName === 'expires') {
-//         const expiryDate = new Date(attrValue);
-//         if (expiryDate.getTime() < Date.now()) isDeleting = true;
-//         else cookieOptions.expires = expiryDate;
-//       }
-//       if (lowerName === 'samesite') cookieOptions.sameSite = attrValue?.toLowerCase() || 'lax';
-//     });
-//     const cookieName = name.trim();
-//     const cookieValue = valueParts.join('=').trim();
-//     if (isDeleting || cookieValue === '') {
-//       cookieStore.delete(cookieName);
-//     } else {
-//       cookieStore.set(cookieName, cookieValue, cookieOptions);
-//     }
-//   }
-// }
-// // FIX: wrapped in React's cache(). This is the generic fix for "why are we
-// // calling /profile so much" — any number of calls to getSession() within the
-// // same request/render (direct calls, or nested inside a consumer's own
-// // currentUser()-style wrapper) now collapse into a single network round trip
-// // to CoreIAM automatically, for every current and future call site.
-// //
-// // Deliberately NOT adding a refresh-retry fallback here (an earlier draft in
-// // this thread did). Next.js only allows cookies().set()/cookies().delete()
-// // inside a Server Action or Route Handler — never during a Server Component
-// // render — and getSession() is called from both (e.g. from a plain
-// // RootLayout render, and from consumers' currentUser()-style wrappers used
-// // throughout Server Components). A refresh path that can only sometimes
-// // persist its new cookies isn't safe: on the render-context call it would
-// // still redeem the refresh token server-side (rotating/burning it) but never
-// // deliver the new one to the browser, stranding the client on a now-dead
-// // refresh token. Refresh belongs solely in middleware.ts, which is the one
-// // place in the request lifecycle actually allowed to mutate response
-// // cookies. If middleware already refreshed upstream, this succeeds; if
-// // middleware's refresh also failed, returning null here is correct, not a
-// // bug to work around.
-// export const getSession = cache(async (): Promise<CoreIAMIdentity | null> => {
-//   const reqHeaders = await headers();
-//   const response = await getIam().proxy('/auth/profile', { method: 'GET' }, reqHeaders);
-//   if (!response.ok) return null;
-//   const coreIamIdentity = await response.json();
-//   if (!coreIamIdentity?.sub) return null;
-//   return coreIamIdentity as CoreIAMIdentity; 
-// });
-// export async function loginActionSdk(identifier: string, password: string): Promise<AuthResult> {
-//   const reqHeaders = await headers();
-//   try {
-//     const response = await getIam().loginWithCsrfProtection(identifier, password, reqHeaders);
-//     await syncCookiesToNext(response);
-//     return { ok: response.ok, status: response.status, data: await response.json().catch(() => ({})) };
-//   } catch (error) {
-//     return { ok: false, status: 500, data: { error: error instanceof Error ? error.message : 'Login failed' } };
-//   }
-// }
-// export async function registerActionSdk(userData: any): Promise<AuthResult> {
-//   const reqHeaders = await headers();
-//   try {
-//     const response = await getIam().registerWithCsrfProtection(userData, reqHeaders);
-//     await syncCookiesToNext(response);
-//     return { ok: response.ok, status: response.status, data: await response.json().catch(() => ({})) };
-//   } catch (error) {
-//     return { ok: false, status: 500, data: { error: error instanceof Error ? error.message : 'Registration failed' } };
-//   }
-// }
-// export async function logoutActionSdk(): Promise<AuthResult> {
-//   const reqHeaders = await headers();
-//   try {
-//     const response = await getIam().logout(reqHeaders);
-//     await syncCookiesToNext(response);
-//     return { ok: response.ok, status: response.status, data: await response.json().catch(() => ({})) };
-//   } catch (error) {
-//     return { ok: false, status: 500, data: { error: 'Logout failed' } };
-//   }
-// }
 // src/nextjs/actions.ts
-'use server';
-// 'use server';
+// REMOVE 'use server' from here.
 Object.defineProperty(exports, "__esModule", { value: true });
 exports.getSession = getSession;
 exports.loginActionSdk = loginActionSdk;
@@ -180,8 +59,7 @@ async function syncCookiesToNext(response) {
         }
     }
 }
-// FIX: MUST be `export async function`, NOT `export const`. 
-// If it's a const, Next.js ignores 'use server' and bundles this file in the client!
+// This is called by Server Components (e.g., layout.tsx)
 async function getSession() {
     const reqHeaders = await (0, headers_1.headers)();
     const response = await getIam().proxy('/auth/profile', { method: 'GET' }, reqHeaders);
@@ -192,6 +70,8 @@ async function getSession() {
         return null;
     return coreIamIdentity;
 }
+// These are no longer called by the SDK's provider.tsx, 
+// but can still be used by Qalam's Server Actions if needed.
 async function loginActionSdk(identifier, password) {
     const reqHeaders = await (0, headers_1.headers)();
     try {

package/dist/nextjs/provider.d.ts

@@ -1,22 +1,15 @@
 import React from 'react';
 import type { CoreIAMIdentity } from '../core';
 export interface CoreIAMRedirects {
-    /** Where to send the user after a successful login, if no callbackUrl is passed to login(). */
     afterLogin?: string;
-    /** Where to send the user after logout. */
     afterLogout?: string;
 }
 interface LoginResult {
     success?: boolean;
     error?: string;
+    twoFactor?: boolean;
 }
 interface AuthContextType {
-    /**
-     * Generic CoreIAM identity (sub/email/roles/tenantId) — NOT an app-shaped
-     * user. This SDK has no knowledge of any consumer's local user model
-     * (roles, profile fields, etc). Consumers that need an enriched user
-     * object should build their own layer on top of this, keyed off `sub`.
-     */
     identity: CoreIAMIdentity | null;
     isLoading: boolean;
     isAuthenticated: boolean;
@@ -30,9 +23,7 @@ interface AuthContextType {
 }
 export declare function CoreIAMProvider({ children, initialIdentity, redirects, }: {
     children: React.ReactNode;
-    /** Pass the result of a server-side getSession() call to skip the client fetch on first paint. */
     initialIdentity?: CoreIAMIdentity | null;
-    /** Where to redirect after login/logout. Omit for no redirect (caller handles navigation itself). */
     redirects?: CoreIAMRedirects;
 }): import("react/jsx-runtime").JSX.Element;
 export declare function useAuth(): AuthContextType;

package/dist/nextjs/provider.js

@@ -1,4 +1,5 @@
 "use strict";
+// src/nextjs/provider.tsx
 'use client';
 Object.defineProperty(exports, "__esModule", { value: true });
 exports.CoreIAMProvider = CoreIAMProvider;
@@ -6,7 +7,6 @@ exports.useAuth = useAuth;
 const jsx_runtime_1 = require("react/jsx-runtime");
 const react_1 = require("react");
 const navigation_1 = require("next/navigation");
-const actions_1 = require("./actions");
 const AuthContext = (0, react_1.createContext)({
     identity: null,
     isLoading: true,
@@ -20,10 +20,11 @@ function CoreIAMProvider({ children, initialIdentity, redirects = {}, }) {
     const [identity, setIdentity] = (0, react_1.useState)(initialIdentity ?? null);
     const [isLoading, setIsLoading] = (0, react_1.useState)(initialIdentity === undefined);
     const router = (0, navigation_1.useRouter)();
-    const refetchIdentity = async () => {
+    const refetchIdentity = (0, react_1.useCallback)(async () => {
         try {
-            const result = await (0, actions_1.getSession)();
-            setIdentity(result);
+            // Call the Next.js API route, which securely calls CoreIAM
+            const res = await fetch('/api/auth/session', { credentials: 'include' });
+            setIdentity(res.ok ? await res.json() : null);
         }
         catch {
             setIdentity(null);
@@ -31,33 +32,40 @@ function CoreIAMProvider({ children, initialIdentity, redirects = {}, }) {
         finally {
             setIsLoading(false);
         }
-    };
+    }, []);
     (0, react_1.useEffect)(() => {
-        // FIX: was `initialIdentity === null`, which can't tell "SSR ran and
-        // confirmed you're logged out" (a correct, final null) apart from "no
-        // SSR value was ever provided" (a real undefined). Since layout.tsx
-        // always calls getSession() and passes its result — even when that
-        // result legitimately is null — every logged-out page view was
-        // treated as "no SSR value, fetch again," firing a second, wholly
-        // redundant /auth/profile call for something SSR had already
-        // determined. undefined (the prop genuinely omitted) is the only case
-        // that should trigger this fallback fetch.
         if (initialIdentity === undefined) {
             refetchIdentity();
         }
         else {
             setIsLoading(false);
         }
-        // Intentionally only on mount — initialIdentity is a one-time SSR seed,
-        // not something we want to re-run this effect for if it changes identity.
         // eslint-disable-next-line react-hooks/exhaustive-deps
     }, []);
     const login = async (values, callbackUrl) => {
         setIsLoading(true);
         try {
-            const result = await (0, actions_1.loginActionSdk)(values.email, values.password);
-            if (!result.ok) {
-                return { error: result.data?.message || result.data?.error || 'Invalid credentials' };
+            // Fetch CSRF token first
+            const csrfRes = await fetch('/api/auth/csrf', { credentials: 'include' });
+            if (!csrfRes.ok)
+                return { error: 'Failed to get CSRF token' };
+            const { csrfToken } = await csrfRes.json();
+            // Call login API route
+            const loginRes = await fetch('/api/auth/login', {
+                method: 'POST',
+                headers: {
+                    'Content-Type': 'application/json',
+                    'x-csrf-token': csrfToken,
+                },
+                credentials: 'include',
+                body: JSON.stringify(values),
+            });
+            const data = await loginRes.json();
+            if (!loginRes.ok) {
+                return { error: data.message || data.error || 'Invalid credentials' };
+            }
+            if (data.twoFactor) {
+                return { twoFactor: true };
             }
             await refetchIdentity();
             const target = callbackUrl || redirects.afterLogin;
@@ -74,7 +82,10 @@ function CoreIAMProvider({ children, initialIdentity, redirects = {}, }) {
     };
     const logout = async () => {
         try {
-            await (0, actions_1.logoutActionSdk)();
+            await fetch('/api/auth/logout', {
+                method: 'POST',
+                credentials: 'include',
+            });
         }
         finally {
             setIdentity(null);
@@ -85,14 +96,29 @@ function CoreIAMProvider({ children, initialIdentity, redirects = {}, }) {
     const register = async (userData) => {
         setIsLoading(true);
         try {
-            const result = await (0, actions_1.registerActionSdk)(userData);
-            if (!result.ok) {
-                return { error: result.data?.message || result.data?.error || 'Registration failed' };
+            const csrfRes = await fetch('/api/auth/csrf', { credentials: 'include' });
+            if (!csrfRes.ok)
+                return { error: 'Failed to get CSRF token' };
+            const { csrfToken } = await csrfRes.json();
+            const registerRes = await fetch('/api/auth/register', {
+                method: 'POST',
+                headers: {
+                    'Content-Type': 'application/json',
+                    'x-csrf-token': csrfToken,
+                },
+                credentials: 'include',
+                body: JSON.stringify(userData),
+            });
+            if (!registerRes.ok) {
+                const error = await registerRes.json();
+                return { error: error.message || error.error || 'Registration failed' };
             }
-            // Registration on the backend doesn't auto-issue a session — log in
-            // immediately after, same as the flow this replaces did.
+            // Auto-login after registration
             return await login({ email: userData.email, password: userData.password });
         }
+        catch {
+            return { error: 'Something went wrong' };
+        }
         finally {
             setIsLoading(false);
         }

package/package.json

@@ -1,6 +1,6 @@
 {
   "name": "@coreiam/auth",
-  "version": "1.0.9",
+  "version": "1.0.10",
   "main": "./dist/core/index.js",
   "types": "./dist/core/index.d.ts",
   "exports": {