@djangocfg/nextjs 2.1.603 → 2.1.604

package/README.md

@@ -457,6 +457,7 @@ import { RedirectPage } from '@djangocfg/layouts/components/RedirectPage';
 | `@djangocfg/nextjs/i18n/components` | `LocaleSwitcher` (`'use client'`) |
 | `@djangocfg/nextjs/i18n/proxy` | `createProxy` for middleware |
 | `@djangocfg/nextjs/i18n/navigation` | `Link`, `redirect`, `usePathname`, `useRouter` |
+| `@djangocfg/nextjs/auth` | Server-side shared session cookie: `serverAuthHeaders`, `getServerAccessToken`, `hasServerSession` |
 | `@djangocfg/nextjs/ai` | AI documentation search and MCP config |
 | `@djangocfg/nextjs/config` | Base Next.js configuration factory |
 | `@djangocfg/nextjs/pwa` | PWA client utilities (service worker registration) |

package/dist/auth/index.d.mts

@@ -0,0 +1,10 @@
+/** The access token of the signed-in user, or `null`. May be expired: the API decides. */
+declare function getServerAccessToken(): Promise<string | null>;
+/** The refresh token, or `null`. Rarely needed on the server. */
+declare function getServerRefreshToken(): Promise<string | null>;
+/** `{ Authorization: 'Bearer …' }` for a server-side fetch; `{}` when signed out. */
+declare function serverAuthHeaders(): Promise<Record<string, string>>;
+/** Whether a session cookie is present (not whether it is still valid). */
+declare function hasServerSession(): Promise<boolean>;
+
+export { getServerAccessToken, getServerRefreshToken, hasServerSession, serverAuthHeaders };

package/dist/auth/index.mjs

@@ -0,0 +1,31 @@
+// src/auth/index.ts
+import { cookies } from "next/headers";
+import { CFG_KEYS } from "@djangocfg/api/storage";
+async function readSessionCookie(name) {
+  try {
+    const raw = (await cookies()).get(name)?.value;
+    return raw ? decodeURIComponent(raw) : null;
+  } catch {
+    return null;
+  }
+}
+function getServerAccessToken() {
+  return readSessionCookie(CFG_KEYS.accessToken.key);
+}
+function getServerRefreshToken() {
+  return readSessionCookie(CFG_KEYS.refreshToken.key);
+}
+async function serverAuthHeaders() {
+  const token = await getServerAccessToken();
+  return token ? { Authorization: `Bearer ${token}` } : {};
+}
+async function hasServerSession() {
+  return await getServerAccessToken() !== null || await getServerRefreshToken() !== null;
+}
+export {
+  getServerAccessToken,
+  getServerRefreshToken,
+  hasServerSession,
+  serverAuthHeaders
+};
+//# sourceMappingURL=index.mjs.map

package/dist/auth/index.mjs.map

@@ -0,0 +1 @@
+{"version":3,"sources":["../../src/auth/index.ts"],"sourcesContent":["/**\n * Server-side view of the shared session cookie.\n *\n * `@djangocfg/api` keeps the JWT pair in cookies on the registrable domain, so a Server\n * Component, route handler or `generateMetadata` on any subdomain sees the same session\n * with no setup:\n *\n * ```ts\n * import { serverAuthHeaders } from '@djangocfg/nextjs/auth';\n * const res = await fetch(`${API}/cfg/accounts/profile/`, { headers: await serverAuthHeaders() });\n * ```\n *\n * The API authenticates the `Authorization` header only; this cookie is never an\n * authenticator by itself, so reading it here creates no CSRF surface.\n */\nimport { cookies } from 'next/headers';\nimport { CFG_KEYS } from '@djangocfg/api/storage';\n\nasync function readSessionCookie(name: string): Promise<string | null> {\n  try {\n    const raw = (await cookies()).get(name)?.value;\n    return raw ? decodeURIComponent(raw) : null;\n  } catch {\n    // Outside a request scope (build time, static generation): no session.\n    return null;\n  }\n}\n\n/** The access token of the signed-in user, or `null`. May be expired: the API decides. */\nexport function getServerAccessToken(): Promise<string | null> {\n  return readSessionCookie(CFG_KEYS.accessToken.key);\n}\n\n/** The refresh token, or `null`. Rarely needed on the server. */\nexport function getServerRefreshToken(): Promise<string | null> {\n  return readSessionCookie(CFG_KEYS.refreshToken.key);\n}\n\n/** `{ Authorization: 'Bearer …' }` for a server-side fetch; `{}` when signed out. */\nexport async function serverAuthHeaders(): Promise<Record<string, string>> {\n  const token = await getServerAccessToken();\n  return token ? { Authorization: `Bearer ${token}` } : {};\n}\n\n/** Whether a session cookie is present (not whether it is still valid). */\nexport async function hasServerSession(): Promise<boolean> {\n  return (await getServerAccessToken()) !== null || (await getServerRefreshToken()) !== null;\n}\n"],"mappings":";AAeA,SAAS,eAAe;AACxB,SAAS,gBAAgB;AAEzB,eAAe,kBAAkB,MAAsC;AACrE,MAAI;AACF,UAAM,OAAO,MAAM,QAAQ,GAAG,IAAI,IAAI,GAAG;AACzC,WAAO,MAAM,mBAAmB,GAAG,IAAI;AAAA,EACzC,QAAQ;AAEN,WAAO;AAAA,EACT;AACF;AAGO,SAAS,uBAA+C;AAC7D,SAAO,kBAAkB,SAAS,YAAY,GAAG;AACnD;AAGO,SAAS,wBAAgD;AAC9D,SAAO,kBAAkB,SAAS,aAAa,GAAG;AACpD;AAGA,eAAsB,oBAAqD;AACzE,QAAM,QAAQ,MAAM,qBAAqB;AACzC,SAAO,QAAQ,EAAE,eAAe,UAAU,KAAK,GAAG,IAAI,CAAC;AACzD;AAGA,eAAsB,mBAAqC;AACzD,SAAQ,MAAM,qBAAqB,MAAO,QAAS,MAAM,sBAAsB,MAAO;AACxF;","names":[]}

package/dist/i18n/routing.d.mts

@@ -24,6 +24,7 @@ declare function createRouting(config?: Partial<I18nConfig>): {
     localePrefix?: next_intl_routing.LocalePrefix<string[], "always" | "as-needed" | "never"> | undefined;
     domains?: undefined;
     localeCookie?: boolean | {
+        name?: string | undefined;
         maxAge?: number | undefined | undefined;
         priority?: "low" | "medium" | "high" | undefined | undefined;
         domain?: string | undefined | undefined;
@@ -31,7 +32,6 @@ declare function createRouting(config?: Partial<I18nConfig>): {
         secure?: boolean | undefined | undefined;
         sameSite?: true | false | "lax" | "strict" | "none" | undefined | undefined;
         partitioned?: boolean | undefined | undefined;
-        name?: string | undefined;
     };
     alternateLinks?: boolean;
     localeDetection?: boolean;
@@ -46,6 +46,7 @@ declare const routing: {
     localePrefix?: next_intl_routing.LocalePrefix<string[], "always" | "as-needed" | "never"> | undefined;
     domains?: undefined;
     localeCookie?: boolean | {
+        name?: string | undefined;
         maxAge?: number | undefined | undefined;
         priority?: "low" | "medium" | "high" | undefined | undefined;
         domain?: string | undefined | undefined;
@@ -53,7 +54,6 @@ declare const routing: {
         secure?: boolean | undefined | undefined;
         sameSite?: true | false | "lax" | "strict" | "none" | undefined | undefined;
         partitioned?: boolean | undefined | undefined;
-        name?: string | undefined;
     };
     alternateLinks?: boolean;
     localeDetection?: boolean;

package/package.json

@@ -1,6 +1,6 @@
 {
   "name": "@djangocfg/nextjs",
-  "version": "2.1.603",
+  "version": "2.1.604",
   "description": "Next.js server utilities: sitemap, health, OG images, contact forms, navigation, config",
   "keywords": [
     "nextjs",
@@ -59,6 +59,11 @@
       "import": "./dist/config/index.mjs",
       "default": "./dist/config/index.mjs"
     },
+    "./auth": {
+      "types": "./dist/auth/index.d.mts",
+      "import": "./dist/auth/index.mjs",
+      "default": "./dist/auth/index.mjs"
+    },
     "./ai": {
       "types": "./dist/ai/index.d.mts",
       "import": "./dist/ai/index.mjs",
@@ -154,10 +159,10 @@
     "ai-docs": "tsx src/ai/cli.ts"
   },
   "peerDependencies": {
-    "@djangocfg/api": "^2.1.603",
-    "@djangocfg/devtools": "^2.1.603",
-    "@djangocfg/i18n": "^2.1.603",
-    "@djangocfg/ui-core": "^2.1.603",
+    "@djangocfg/api": "^2.1.604",
+    "@djangocfg/devtools": "^2.1.604",
+    "@djangocfg/i18n": "^2.1.604",
+    "@djangocfg/ui-core": "^2.1.604",
     "next": "^16.2.2"
   },
   "peerDependenciesMeta": {
@@ -179,12 +184,12 @@
     "semver": "^7.8.5"
   },
   "devDependencies": {
-    "@djangocfg/api": "^2.1.603",
-    "@djangocfg/devtools": "^2.1.603",
-    "@djangocfg/i18n": "^2.1.603",
-    "@djangocfg/layouts": "^2.1.603",
-    "@djangocfg/typescript-config": "^2.1.603",
-    "@djangocfg/ui-core": "^2.1.603",
+    "@djangocfg/api": "^2.1.604",
+    "@djangocfg/devtools": "^2.1.604",
+    "@djangocfg/i18n": "^2.1.604",
+    "@djangocfg/layouts": "^2.1.604",
+    "@djangocfg/typescript-config": "^2.1.604",
+    "@djangocfg/ui-core": "^2.1.604",
     "@types/node": "^25.9.5",
     "@types/react": "19.2.15",
     "@types/react-dom": "19.2.3",

package/src/auth/index.ts

@@ -0,0 +1,48 @@
+/**
+ * Server-side view of the shared session cookie.
+ *
+ * `@djangocfg/api` keeps the JWT pair in cookies on the registrable domain, so a Server
+ * Component, route handler or `generateMetadata` on any subdomain sees the same session
+ * with no setup:
+ *
+ * ```ts
+ * import { serverAuthHeaders } from '@djangocfg/nextjs/auth';
+ * const res = await fetch(`${API}/cfg/accounts/profile/`, { headers: await serverAuthHeaders() });
+ * ```
+ *
+ * The API authenticates the `Authorization` header only; this cookie is never an
+ * authenticator by itself, so reading it here creates no CSRF surface.
+ */
+import { cookies } from 'next/headers';
+import { CFG_KEYS } from '@djangocfg/api/storage';
+
+async function readSessionCookie(name: string): Promise<string | null> {
+  try {
+    const raw = (await cookies()).get(name)?.value;
+    return raw ? decodeURIComponent(raw) : null;
+  } catch {
+    // Outside a request scope (build time, static generation): no session.
+    return null;
+  }
+}
+
+/** The access token of the signed-in user, or `null`. May be expired: the API decides. */
+export function getServerAccessToken(): Promise<string | null> {
+  return readSessionCookie(CFG_KEYS.accessToken.key);
+}
+
+/** The refresh token, or `null`. Rarely needed on the server. */
+export function getServerRefreshToken(): Promise<string | null> {
+  return readSessionCookie(CFG_KEYS.refreshToken.key);
+}
+
+/** `{ Authorization: 'Bearer …' }` for a server-side fetch; `{}` when signed out. */
+export async function serverAuthHeaders(): Promise<Record<string, string>> {
+  const token = await getServerAccessToken();
+  return token ? { Authorization: `Bearer ${token}` } : {};
+}
+
+/** Whether a session cookie is present (not whether it is still valid). */
+export async function hasServerSession(): Promise<boolean> {
+  return (await getServerAccessToken()) !== null || (await getServerRefreshToken()) !== null;
+}