@evenicanpm/storefront-core 2.0.1 → 2.2.0

package/src/hooks/use-nextauth-session.ts

@@ -1,36 +1,31 @@
 // hooks/useAppSession.ts
 
 import useSessionInit from "@evenicanpm/storefront-core/src/api-manager/services/session/mutations/session-init";
-import useSessionLogout from "@evenicanpm/storefront-core/src/api-manager/services/session/mutations/session-logout";
 // API hooks
 import useUpdateUser from "@evenicanpm/storefront-core/src/api-manager/services/user/mutations/update-user";
 import {
 	getMsalInstance,
 	initializeMsal,
 } from "@evenicanpm/storefront-core/src/auth/msal";
-import { useSession } from "next-auth/react";
+import { createAuthClient } from "better-auth/react";
 import { useEffect } from "react";
 
+const authClient = createAuthClient();
+const { useSession: useBetterAuthSession } = authClient;
+
 export function useAppSession() {
-	const { data: session } = useSession();
+	const { data: session, isPending } = useBetterAuthSession();
 	const { mutateAsync: sessionInit } = useSessionInit();
 	const { mutateAsync: updateUser } = useUpdateUser();
-	const { mutateAsync: sessionLogout } = useSessionLogout();
-
-	// Handle custom auth errors
-	useEffect(() => {
-		if (session?.error) {
-			console.warn("Auth Error", session.error);
-			sessionLogout({}); // Or your custom signOut
-		}
-	}, [session, sessionLogout]);
 
 	// Initialize session in API
 	useEffect(() => {
 		if (!session) return;
 
-		const { accessToken, user } = session;
-		if (accessToken && user?.email) {
+		const { user } = session;
+		const accessToken =
+			(session.session as { accessToken?: string })?.accessToken || "";
+		if (user?.email) {
 			sessionInit({ accessToken, email: user.email }).catch(console.error);
 		}
 	}, [session, sessionInit]);
@@ -64,5 +59,6 @@ export function useAppSession() {
 	return {
 		session,
 		isAuthenticated: !!session,
+		isPending,
 	};
 }

package/src/pages/cart/__tests__/checkout-form.test.tsx

@@ -10,8 +10,10 @@ import { NextIntlClientProvider } from "next-intl";
 import type React from "react";
 import { vi } from "vitest";
 
-vi.mock("next-auth/react", () => ({
-	// Empty mock for next-auth to stop throwing errors
+vi.mock("better-auth/react", () => ({
+	createAuthClient: () => ({
+		useSession: () => ({ data: null, isPending: false }),
+	}),
 }));
 
 // global.fetch = vi.fn(() => Promise.resolve({ json: () => ({}) }));

package/src/api-manager/datasources/d365/utils/decode-jwt.ts

@@ -1,10 +0,0 @@
-"use server";
-import { decode } from "next-auth/jwt";
-
-export async function decodeToken(token: string) {
-	const secret = process.env.NEXTAUTH_SECRET; //this shouldn't be from key vault.
-	if (!secret) {
-		throw new Error("Environment variable NEXTAUTH_SECRET is not set.");
-	}
-	return decode({ token: token, secret });
-}

package/src/auth/auth-options.test.ts

@@ -1,70 +0,0 @@
-import type { Account, Session } from "next-auth";
-import type { JWT } from "next-auth/jwt";
-import { describe, expect, it } from "vitest";
-import authOptions, { type ExtendedJwtToken } from "@/auth/auth-options";
-
-describe("next-auth option callbacks", () => {
-	describe("jwt callback", () => {
-		it("should store accessToken and refreshToken when account and profile are available", async () => {
-			const token: ExtendedJwtToken = {
-				accessToken: "",
-				accessTokenExpiresAt: 0,
-				provider: "azure-ad-b2c",
-				refreshTokenExpiresAt: 0,
-				exp: 0,
-			};
-			const account: Account = {
-				access_token: "testAccessToken",
-				refresh_token: "testRefreshToken",
-				expires_on: Math.floor(Date.now() / 1000) + 3600,
-				refresh_token_expires_in: 86400,
-				providerAccountId: "test-provider-account-id",
-				provider: "azure-ad-b2c",
-				type: "oauth",
-			};
-
-			let newToken: ExtendedJwtToken | undefined;
-			if (authOptions()?.callbacks?.jwt) {
-				newToken = await authOptions().callbacks.jwt({
-					token,
-					user: { id: "123" },
-					account,
-					profile: {},
-				});
-			}
-
-			expect(newToken?.accessToken).toBe("testAccessToken");
-			expect(newToken?.refreshToken).toBe("testRefreshToken");
-			expect(newToken?.accessTokenExpiresAt).toBe(token.accessTokenExpiresAt); // We're not setting this or using it anymore
-			expect(newToken?.refreshTokenExpiresAt).toBe(token.refreshTokenExpiresAt); // We're not setting this or using it anymore);
-		});
-	});
-
-	describe("session callback", () => {
-		it("should pass accessToken and error to session", async () => {
-			const session = { expires: "", user: { name: "123" } };
-			const token: JWT = {
-				accessToken: "sessionToken",
-				accessTokenExpiresAt: 0,
-				refreshToken: "",
-				refreshTokenExpiresAt: 0,
-				error: "SomeError",
-			};
-			let newSession: Session | null;
-			if (authOptions()?.callbacks?.session) {
-				newSession = await authOptions().callbacks.session({
-					session,
-					token,
-					user: { id: "123", email: "", emailVerified: new Date(Date.now()) },
-					newSession: {},
-					trigger: "update",
-				});
-			} else {
-				newSession = null;
-			}
-
-			expect(newSession?.accessToken).toBe("sessionToken");
-			expect(newSession?.error).toBe("SomeError");
-		});
-	});
-});

package/src/auth/auth-options.ts

@@ -1,101 +0,0 @@
-import { deleteCartCookie } from "@evenicanpm/storefront-core/src/lib/cart-cookie-handler";
-import type {
-	GetServerSidePropsContext,
-	NextApiRequest,
-	NextApiResponse,
-} from "next";
-import type { NextAuthOptions, Session } from "next-auth";
-import type { JWT } from "next-auth/jwt";
-import { getServerSession } from "next-auth/next";
-import { getProviders } from "@/auth/providers";
-
-// Split providers into separate array so we can iterate them and match the provider ID
-export type ExtendedJwtToken = JWT & {
-	provider: string;
-	exp: number;
-};
-
-export type ExtendedSession = Session & { token?: JWT };
-
-const createAuthOptions = (): NextAuthOptions => {
-	const providers = getProviders();
-	const secret = process.env.NEXTAUTH_SECRET; // internally used by next-auth, shouldn't be from key vault.
-	return {
-		providers,
-		secret,
-		cookies: {
-			csrfToken: {
-				name: "next-auth.csrf-token",
-				options: {
-					httpOnly: true,
-					sameSite: "none",
-					path: "/",
-					secure: true,
-				},
-			},
-			pkceCodeVerifier: {
-				name: "next-auth.pkce.code_verifier",
-				options: {
-					httpOnly: true,
-					sameSite: "none",
-					path: "/",
-					secure: true,
-				},
-			},
-			nonce: {
-				name: "next-auth.nonce",
-				options: {
-					httpOnly: true,
-					sameSite: "none",
-					path: "/",
-					secure: true,
-				},
-			},
-		},
-		// Order in which callbacks are called = signin > redirect > jwt > session. Thats why session callback has token info.
-		callbacks: {
-			// By default, NextAuth uses "session" with strategy: "jwt"
-			async jwt({ token, account, profile }) {
-				const _token = token as ExtendedJwtToken;
-				// account and profile is available only in first callback after signin
-				if (account && profile) {
-					_token.provider = account.provider;
-					// use id_token for entra external id and access_token for aadb2c
-					_token.accessToken =
-						_token.provider === "entra-external-id"
-							? account.id_token
-							: account.access_token;
-					_token.refreshToken = account.refresh_token;
-				}
-				return _token;
-				// return await checkAccessTokenExpiry(_token)
-			},
-			async session({ session, token }) {
-				const _session = { ...session } as ExtendedSession;
-				// Way to pass data to the browser
-				// Use this error to force logout in UI. No proper way to signout user from server.
-				_session.error = token?.error;
-				_session.accessToken = token.accessToken;
-
-				return _session;
-			},
-		},
-		events: {
-			signOut: async () => {
-				await deleteCartCookie();
-			},
-		},
-	};
-};
-
-export function auth(
-	// <-- use this function to access the jwt from React components
-	...args:
-		| [GetServerSidePropsContext["req"], GetServerSidePropsContext["res"]]
-		| [NextApiRequest, NextApiResponse]
-		| []
-) {
-	return getServerSession(...args, createAuthOptions());
-}
-
-export default createAuthOptions;

package/src/auth/next-auth-cookie-manager.ts

@@ -1,87 +0,0 @@
-"use server";
-import type { RequestCookie } from "next/dist/compiled/@edge-runtime/cookies";
-import { cookies } from "next/headers";
-import { decode, encode, type JWT } from "next-auth/jwt";
-import type { ExtendedJwtToken } from "@/auth/auth-options";
-
-const NEXT_AUTH_COOKIE_NAME = "next-auth.session-token";
-const SECURE_COOKIE_PREFIX = "__Secure-";
-
-/**
- * Retrieves and decodes the NextAuth session cookie from the request.
- *
- * This function handles both single and chunked session cookies:
- * - If the session cookie is under 4KB, it is stored as a single cookie.
- * - If the session cookie exceeds 4KB, it is split into multiple chunked cookies with indexed names.
- *
- * The function attempts to retrieve the single cookie first. If not found,
- * it iteratively collects all chunked cookies, concatenates their values,
- * and decodes the resulting token.
- *
- * @returns A Promise resolving to the decoded session object, or `undefined` if no session cookie is found.
- */
-const manuallyRetrieveSessionCookie = async () => {
-	const cookieStore = await cookies();
-	let cookie: RequestCookie | undefined;
-	// Single token when the cookie size is < 4k
-	cookie = cookieStore.get(`${SECURE_COOKIE_PREFIX}${NEXT_AUTH_COOKIE_NAME}`);
-	//If the cookie is found, return it. the cookie is under 4kb
-	if (cookie) {
-		return decode({
-			token: cookie.value,
-			secret: process.env.NEXTAUTH_SECRET || "",
-		});
-	}
-	//If the cookie is not found, we need to see if there is a chunked cookie
-	//The chunked cookie is stored in multiple cookies with the same name and an index
-	//The cookie is chunked when the cookie size is > 4k
-	//The value is just split between the cookies, so we can just concat them.
-	let i = 0;
-	const cookieValues: string[] = [];
-	do {
-		cookie = cookieStore.get(
-			`${SECURE_COOKIE_PREFIX}${NEXT_AUTH_COOKIE_NAME}.${i}`,
-		);
-		if (cookie) {
-			cookieValues.push(cookie.value);
-		}
-		i++;
-	} while (cookie !== undefined);
-	if (cookieValues.length) {
-		return decode({
-			token: cookieValues.join(""),
-			secret: process.env.NEXTAUTH_SECRET || "",
-		});
-	}
-
-	//If no cookie is found, return undefined
-	return undefined;
-};
-
-/**
- * Manually sets the NextAuth session cookie with the provided JWT token.
- *
- * This function encodes the given JWT or ExtendedJwtToken and sets it as a secure,
- * HTTP-only cookie named `__Secure-next-auth.session-token`. The cookie is set using
- * the current cookie store, and the encoding uses the secret from the `NEXTAUTH_SECRET`
- * environment variable.
- *
- * @param token - The JWT or ExtendedJwtToken to be encoded and stored in the session cookie.
- * @returns A promise that resolves when the cookie has been set.
- */
-const manuallySetSessionCookie = async (token: JWT | ExtendedJwtToken) => {
-	const cookieStore = await cookies();
-	// Set the cookie with the name __Secure-next-auth.session-token
-	const value = await encode({
-		token,
-		secret: process.env.NEXTAUTH_SECRET || "",
-	});
-	cookieStore.set({
-		name: `${SECURE_COOKIE_PREFIX}${NEXT_AUTH_COOKIE_NAME}`,
-		value,
-		httpOnly: true,
-		secure: true,
-	});
-};
-
-export { manuallyRetrieveSessionCookie, manuallySetSessionCookie };

package/src/auth/providers/aadb2c-provider.ts

@@ -1,32 +0,0 @@
-import AzureADB2CProvider from "next-auth/providers/azure-ad-b2c";
-
-// By default, NextAuth tries to use either PKCE or Client Secret-based authentication, depending on how the provider is configured.
-// If clientSecret is provided, it assumes client secret authentication (which doesn't use code_challenge).
-// If clientSecret is missing, it assumes PKCE.
-// But Azure AD B2C sometimes requires PKCE explicitly, so NextAuth needs to be told to always use PKCE.
-const azureADB2CProvider = () => {
-	const CLIENT_ID = process.env.NEXT_PUBLIC_AZURE_AD_B2C_CLIENTID || "";
-	const SCOPE = `${process.env.NEXT_PUBLIC_AZURE_AD_B2C_API_PERMISSION} offline_access openid`;
-	const LOGIN_AUTHORITY = process.env.NEXT_PUBLIC_AZURE_AD_B2C_LOGIN_AUTHORITY;
-
-	return AzureADB2CProvider({
-		clientId: CLIENT_ID,
-		clientSecret: "",
-		issuer: `${LOGIN_AUTHORITY}/v2.0`, // either (tenantId and primaryUserFlow) or issuer must be provided
-		authorization: {
-			// We can also send params from UI - signIn("azure-ad-b2c", {}, { prompt: "login" })
-			params: {
-				scope: SCOPE,
-				// When a user logs in once, the session remains active, and next time Azure AD B2C automatically logs the user in without showing the sign-in page again
-				// This option forces login screen every time.
-				prompt: "login",
-			},
-		},
-		checks: ["pkce"],
-		client: {
-			token_endpoint_auth_method: "none", // Disables Client Secret, ensuring that only PKCE is used
-		},
-	});
-};
-
-export default azureADB2CProvider;

package/src/auth/providers/authentik-provider.ts

@@ -1,24 +0,0 @@
-import AuthentikProvider from "next-auth/providers/authentik";
-
-const clientId = "DRWJuuA4HEWyhSAsDjTgUHrsDo7CmeUa1p5UVN2e";
-const clientSecret =
-	"4PyTnKqbO6fzDngGrLkD9YiFTxXASsJH7WPoMBeFCpezfrooZE3j2FCnWYXfO5ioFm8Uwx95kHspXsNRjl9S3uq7CBZcJUpbFfXywDMEGqrxXKT4biEuiihOTHL65qOY";
-const issuer =
-	"https://authentik-server.orangeocean-cbcb289b.eastus.azurecontainerapps.io/application/o/sandboxauthapp";
-const wellKnown =
-	"https://authentik-server.orangeocean-cbcb289b.eastus.azurecontainerapps.io/application/o/sandboxauthapp/.well-known/openid-configuration";
-const authentikProvider = AuthentikProvider({
-	clientId,
-	clientSecret,
-	issuer,
-	id: "Authentik",
-	name: "Authentik",
-	wellKnown: wellKnown,
-	authorization: {
-		params: {
-			scope: "openid email profile offline_access",
-		},
-	},
-});
-
-export default authentikProvider;

package/src/auth/providers/entra-external-id-provider.ts

@@ -1,50 +0,0 @@
-import type { Provider } from "next-auth/providers";
-
-const createEntraExternalIdProvider = (): Provider => {
-	const clientId = process.env.NEXT_PUBLIC_ENTRA_EXTERNAL_ID_CLIENT_ID || "";
-	const customScopes =
-		process.env.NEXT_PUBLIC_ENTRA_EXTERNAL_ID_CUSTOM_SCOPES || "";
-	const tenantName =
-		process.env.NEXT_PUBLIC_ENTRA_EXTERNAL_ID_TENANT_NAME || "";
-	const clientSecret =
-		process.env.NEXT_PUBLIC_ENTRA_EXTERNAL_ID_CLIENT_SECRET || "";
-
-	// Build auth url and wellKnown from the loginAuthority
-	const loginAuthority = `https://${tenantName}.ciamlogin.com/${tenantName}.onmicrosoft.com`;
-	const authUrl = `${loginAuthority}/oauth2/v2.0/authorize`;
-	const wellKnownUrl = `${loginAuthority}/v2.0/.well-known/openid-configuration`;
-
-	return {
-		id: "entra-external-id",
-		clientId: clientId,
-		client: {
-			client_id: clientId,
-			response_types: ["code id_token"],
-			client_secret: clientSecret,
-			// token_endpoint_auth_method: 'none',
-		},
-		type: "oauth",
-		idToken: true,
-		name: "Microsoft Entra External ID",
-		authorization: {
-			url: authUrl,
-			params: {
-				scope: customScopes,
-				prompt: "login",
-				response_type: "code id_token",
-				response_mode: "form_post",
-			},
-		},
-		wellKnown: wellKnownUrl,
-		profile(profile) {
-			return {
-				id: profile.oid,
-				name: profile.name,
-				email: profile.email,
-			};
-		},
-		checks: ["pkce", "nonce"],
-	};
-};
-
-export default createEntraExternalIdProvider;

package/src/auth/providers/index.ts

@@ -1,16 +0,0 @@
-import azureADB2CProvider from "@/auth/providers/aadb2c-provider";
-import authentikProvider from "@/auth/providers/authentik-provider";
-import createEntraExternalIdProvider from "@/auth/providers/entra-external-id-provider";
-import keycloakProvider from "@/auth/providers/keycloak-provider";
-
-export const getProviders = () => {
-	const azureProvider = azureADB2CProvider();
-	const entraExternalIdProvider = createEntraExternalIdProvider();
-	// once we stop hard coding others use loader function here
-	return [
-		authentikProvider,
-		azureProvider,
-		keycloakProvider,
-		entraExternalIdProvider,
-	];
-};

package/src/auth/providers/keycloak-provider.ts

@@ -1,22 +0,0 @@
-import KeycloakProvider from "next-auth/providers/keycloak";
-
-const clientid = "b6229a60-b0de-4f86-9891-e0b58d756e39";
-const issuer =
-	"https://keycloak-app-g9dmfkf6atdqdrcn.eastus2-01.azurewebsites.net/realms/e4headless";
-const wellKnown =
-	"https://keycloak-app-g9dmfkf6atdqdrcn.eastus2-01.azurewebsites.net/realms/e4headless/.well-known/openid-configuration";
-const keycloakProvider = KeycloakProvider({
-	clientId: clientid,
-	clientSecret: "",
-	issuer: issuer,
-	id: "Keycloak",
-	name: "Keycloak",
-	wellKnown: wellKnown,
-	authorization: {
-		params: {
-			scope: "openid email profile offline_access",
-		},
-	},
-});
-
-export default keycloakProvider;

package/src/auth/refresh-token.ts

@@ -1,132 +0,0 @@
-"use server";
-import jwt from "jsonwebtoken";
-import type { JWT } from "next-auth/jwt";
-import type { AuthorizationEndpointHandler } from "next-auth/providers";
-import type { ExtendedJwtToken } from "@/auth/auth-options";
-import { getProviders } from "@/auth/providers";
-
-type TokenResponse = {
-	token: ExtendedJwtToken;
-	isRefreshed: boolean;
-};
-
-const checkAccessTokenExpiry = async (
-	token: ExtendedJwtToken,
-): Promise<TokenResponse> => {
-	const providers = getProviders();
-	const decryptedToken = jwt.decode(token?.accessToken ?? "") as jwt.JwtPayload;
-	if (!decryptedToken) {
-		token.error = "Token Invalid";
-		return { token, isRefreshed: false };
-	}
-
-	if (!decryptedToken.exp) {
-		token.error = "noExpiryOnToken";
-		return {
-			token,
-			isRefreshed: false,
-		};
-	}
-	const expiry = decryptedToken.exp * 1000;
-	const nowMinusBuffer = 5 * 60 * 1000; // 5 minutes
-	// Check if token is expired or will expire in 5 minutes
-	// return token if access Token is not expired yet
-	if (Date.now() < expiry - nowMinusBuffer) {
-		return {
-			token,
-			isRefreshed: false,
-		};
-	}
-
-	const refreshTokenExpiry = token.exp * 1000;
-
-	// Avoid making request for access token if refresh token is expired.
-	if (Date.now() >= refreshTokenExpiry) {
-		token.error = "RefreshTokenExpired";
-		return {
-			token,
-			isRefreshed: false,
-		};
-	}
-
-	//Find the provider that matches the provider cookie
-	const matchedProvider = providers.find(
-		(p) => p.id.toLowerCase() === token.provider.toLowerCase(),
-	);
-	if (!matchedProvider || !("wellKnown" in matchedProvider)) {
-		token.error = "NoProviderMatch";
-		return {
-			token,
-			isRefreshed: false,
-		};
-	}
-
-	const wellKnown = matchedProvider.wellKnown;
-	const clientId = matchedProvider.options?.clientId;
-	const scope = (
-		matchedProvider.options?.authorization as AuthorizationEndpointHandler
-	)?.params?.scope;
-
-	if (!wellKnown || !clientId || !scope) {
-		return {
-			token: { ...token, error: "MissingProviderInfo" },
-			isRefreshed: false,
-		};
-	}
-
-	const newToken = await refreshAccessToken(token, wellKnown, clientId, scope);
-
-	return {
-		token: newToken as ExtendedJwtToken,
-		isRefreshed: !newToken.error,
-	};
-};
-
-const refreshAccessToken = async (
-	token: JWT,
-	wellKnown: string,
-	clientId: string,
-	scope: string,
-) => {
-	if (!token.refreshToken) {
-		return { ...token, error: "NoRefreshToken" };
-	}
-
-	const refreshUrl = await getTokenEndpoint(wellKnown);
-	try {
-		const response = await fetch(refreshUrl, {
-			method: "POST",
-			headers: { "Content-Type": "application/x-www-form-urlencoded" },
-			body: new URLSearchParams({
-				client_id: clientId,
-				grant_type: "refresh_token",
-				refresh_token: token.refreshToken,
-				scope: scope,
-			}),
-		});
-		const refreshedTokens = await response.json();
-		if (!response.ok) {
-			throw new Error(refreshedTokens.error_description);
-		}
-		return {
-			...token,
-			accessToken: refreshedTokens.access_token,
-			refreshToken: refreshedTokens.refresh_token,
-		};
-	} catch (error) {
-		console.error("Error refreshing web token:", error);
-		return { ...token, error: "RefreshAccessTokenError" };
-	}
-};
-
-const getTokenEndpoint = async (wellKnown: string) => {
-	const json = await getWellKnownData(wellKnown);
-	return json.token_endpoint;
-};
-
-const getWellKnownData = async (wellKnown: string) => {
-	const data = await fetch(wellKnown);
-	return data.json();
-};
-
-export default checkAccessTokenExpiry;

package/src/auth/types/next-auth.d.ts

@@ -1,38 +0,0 @@
-// eslint-disable-next-line @typescript-eslint/no-unused-vars
-import type { NextAuthOptions } from "next-auth";
-
-declare module "next-auth" {
-	/**
-	 * Returned by `useSession`, `getSession` and received as a prop on the `SessionProvider` React Context
-	 */
-	interface Session {
-		error?: string;
-		accessToken?: string;
-	}
-}
-
-declare module "next-auth/jwt" {
-	interface JWT {
-		accessToken?: string;
-		accessTokenExpiresAt: number;
-		refreshToken?: string;
-		refreshTokenExpiresAt: number;
-		error?: string;
-	}
-}
-
-/**
- * Usually contains information about the provider being used
- * and also extends `TokenSet`, which is different tokens returned by OAuth Providers.
- */
-declare module "next-auth/providers/azure-ad-b2c" {
-	interface Account {
-		access_token: string;
-		expires_on: number;
-		refresh_token: string;
-		refresh_token_expires_in: number;
-	}
-
-	/** The OAuth profile returned from your provider */
-	// interface Profile {}
-}