@evenicanpm/storefront-core 2.1.0 → 2.2.0

package/package.json

@@ -1,6 +1,6 @@
 {
 	"name": "@evenicanpm/storefront-core",
-	"version": "2.1.0",
+	"version": "2.2.0",
 	"description": "Core module for D365/e4 Headless Storefront",
 	"type": "module",
 	"scripts": {
@@ -32,13 +32,14 @@
 	"peerDependencies": {
 		"@msdyn365-commerce/retail-proxy": "9.50",
 		"@tanstack/react-query": "^5.76.1",
+		"better-auth": "*",
 		"graphql": "^16.11.0",
 		"graphql-request": "^7.1.2",
 		"jsonwebtoken": "^9.0.2",
 		"lodash": "^4.17.21",
 		"next": "^15.2.1",
-		"next-auth": "^4.24.11",
 		"object-mapper": "^6.2.0",
+		"set-cookie-parser": "^2.7.1",
 		"typedoc": "^0.28.9",
 		"typedoc-plugin-merge-modules": "^7.0.0",
 		"typescript": "^5.8.3",
@@ -49,5 +50,5 @@
 			"esbuild": "0.19.11"
 		}
 	},
-	"gitHead": "8227589295d3d63586f9b26fff8d643b070989b3"
+	"gitHead": "21ad4044713e4d6625e30c745dd6cd5c7c52b0b3"
 }

package/src/api-manager/datasources/d365/utils/get-context-cookie.ts

@@ -1,8 +1,8 @@
 "use server";
 import type { ICallerContext } from "@msdyn365-commerce/retail-proxy";
-import { cookies } from "next/headers";
+import { cookies, headers as getHeaders } from "next/headers";
 import { getLocale } from "next-intl/server";
-import { manuallyRetrieveSessionCookie } from "@/auth/next-auth-cookie-manager";
+import { auth } from "@/auth/better-auth";
 
 /**
  * Retrieves the D365 context from the "D365Context" cookie, enriches it with the current session token,
@@ -21,14 +21,16 @@ import { manuallyRetrieveSessionCookie } from "@/auth/next-auth-cookie-manager";
 export async function getContextFromCookie(): Promise<ICallerContext> {
 	const cookieStore = await cookies();
 	const d365Context = cookieStore.get("D365Context");
-	const token = await manuallyRetrieveSessionCookie();
+	const session = await auth.api.getSession({ headers: await getHeaders() });
+	const accessToken =
+		(session?.session as { accessToken?: string })?.accessToken || "";
 	const locale = await getLocale();
 	if (d365Context) {
 		const context = JSON.parse(d365Context.value) as ICallerContext;
 		context.requestContext.operationId = crypto.randomUUID();
 		context.requestContext.user = {
-			isAuthenticated: !!token?.accessToken,
-			token: token?.accessToken ?? "",
+			isAuthenticated: !!accessToken,
+			token: accessToken,
 		};
 		context.requestContext.locale = locale;
 		return context;

package/src/api-manager/datasources/e4/middleware.ts

@@ -0,0 +1,35 @@
+import createGraphQLClient from "@evenicanpm/storefront-core/src/lib/create-graphql-client";
+import type { NextRequest, NextResponse } from "next/server";
+import { parse, splitCookiesString } from "set-cookie-parser";
+
+const setE4SessionCookies = async (
+	response: NextResponse,
+	request: NextRequest,
+) => {
+	const cookiesAlreadySet = request.cookies.get("storefront");
+	if (cookiesAlreadySet) return response;
+
+	const e4Api = await createGraphQLClient();
+
+	const session = await e4Api.e4ReadSessionCustomer();
+
+	const cookieString = session?.headers?.get("set-cookie");
+	if (!cookieString) return response;
+	const splitCookies = parse(
+		splitCookiesString(decodeURIComponent(cookieString)),
+	);
+
+	splitCookies.forEach((cookie) => {
+		response.cookies.set({
+			name: cookie.name,
+			value: cookie.value,
+			httpOnly: true,
+			expires: cookie.expires,
+			secure: true,
+		});
+	});
+
+	return response;
+};
+
+export default setE4SessionCookies;

package/src/api-manager/lib/get-graphql-client.ts

@@ -2,9 +2,8 @@
 
 import { getSdk } from "@evenicanpm/storefront-core/src/api-manager/datasources/e4/graphqlRequestSdk";
 import { GraphQLClient } from "graphql-request";
-import { cookies } from "next/headers";
-import { getServerSession } from "next-auth/next";
-import authOptions from "@/auth/auth-options";
+import { cookies, headers as getHeaders } from "next/headers";
+import { auth } from "@/auth/better-auth";
 
 /**
  * Initializes and returns a cached GraphQL client
@@ -28,9 +27,11 @@ const getGraphQLClient = async (withAuth = false) => {
 	}
 
 	if (withAuth) {
-		const session = await getServerSession(authOptions());
-		if (session?.accessToken) {
-			headers.Authorization = `Bearer ${session.accessToken}`;
+		const session = await auth.api.getSession({ headers: await getHeaders() });
+		const accessToken = (session?.session as { accessToken?: string })
+			?.accessToken;
+		if (accessToken) {
+			headers.Authorization = `Bearer ${accessToken}`;
 		}
 	}
 

package/src/api-manager/services/create-query.ts

@@ -7,14 +7,9 @@ import {
 	useQuery,
 	useSuspenseQuery,
 } from "@tanstack/react-query";
-import { Mutex } from "async-mutex";
-import jwt from "jsonwebtoken";
-import { getSession } from "next-auth/react";
-import { manuallyRetrieveSessionCookie } from "@/auth/next-auth-cookie-manager";
 import signOut from "@/auth/signout";
 
 const QUERY_ROUTE = "/api";
-const mutex = new Mutex();
 
 export type ApiPath<T extends keyof DatasourceApis = keyof DatasourceApis> = [
 	T,
@@ -27,22 +22,6 @@ export type Query<TInput, TOutput> = ReturnType<
 
 // --- Shared helpers (no closure dependencies) ---
 
-const checkTokenExpiry = async (): Promise<boolean> => {
-	let token: string | undefined;
-	if (isServer) {
-		const session = (await manuallyRetrieveSessionCookie()) ?? undefined;
-		token = session?.accessToken;
-	} else {
-		const session = await getSession();
-		token = session?.accessToken;
-	}
-	const decoded = token && (jwt.decode(token) as { exp?: number } | null);
-	const currentTime = Math.floor(Date.now() / 1000);
-	return (
-		!!decoded && typeof decoded.exp === "number" && decoded.exp < currentTime
-	);
-};
-
 const doFetch = async <TInput>(
 	input: TInput | undefined,
 	apiManagerPath: ApiPath,
@@ -60,27 +39,6 @@ const doFetch = async <TInput>(
 	return result.json();
 };
 
-// Acquires a mutex before fetching so concurrent requests don't each trigger
-// a token refresh simultaneously (double-check pattern after acquiring lock).
-const withTokenRefresh = async <TInput>(
-	input: TInput | undefined,
-	apiManagerPath: ApiPath,
-) => {
-	const release = await mutex.acquire();
-	try {
-		const headers = new Headers();
-		if (await checkTokenExpiry()) {
-			headers.append("should-refresh-token", "true");
-		}
-		return await doFetch(input, apiManagerPath, headers);
-	} catch (error) {
-		console.error("Error fetching data:", error);
-		throw new Error("Failed to fetch data");
-	} finally {
-		release();
-	}
-};
-
 // --- Factory ---
 
 export const createQuery = <TInput, TOutput>(
@@ -103,10 +61,7 @@ export const createQuery = <TInput, TOutput>(
 					return getApiFromPath(apiManager, apiManagerPath)(input);
 				}
 			: async () => {
-					const isExpired = await checkTokenExpiry();
-					return isExpired
-						? withTokenRefresh(input, apiManagerPath)
-						: doFetch(input, apiManagerPath);
+					return await doFetch(input, apiManagerPath);
 				},
 		enabled: config?.disableProperties
 			? config.disableProperties.every((prop) => !!input?.[prop])

package/src/auth/better-auth.ts

@@ -0,0 +1,89 @@
+import { betterAuth } from "better-auth";
+import { genericOAuth, customSession } from "better-auth/plugins";
+import { nextCookies } from "better-auth/next-js";
+
+const tenantName = process.env.NEXT_PUBLIC_ENTRA_EXTERNAL_ID_TENANT_NAME || "";
+const loginAuthority = `https://${tenantName}.ciamlogin.com/${tenantName}.onmicrosoft.com`;
+
+export const auth = betterAuth({
+	secret: process.env.BETTER_AUTH_SECRET,
+	baseURL: process.env.BETTER_AUTH_URL || process.env.NEXTAUTH_URL,
+	session: {
+		cookieCache: {
+			enabled: true,
+			maxAge: 60 * 60, // 1 hour
+			strategy: "jwe",
+			refreshCache: true,
+		},
+	},
+	account: {
+		storeStateStrategy: "cookie",
+		storeAccountCookie: true,
+	},
+	plugins: [
+		genericOAuth({
+			config: [
+				{
+					providerId: "entra-external-id",
+					clientId: process.env.NEXT_PUBLIC_ENTRA_EXTERNAL_ID_CLIENT_ID || "",
+					clientSecret:
+						process.env.NEXT_PUBLIC_ENTRA_EXTERNAL_ID_CLIENT_SECRET || "",
+					discoveryUrl: `${loginAuthority}/v2.0/.well-known/openid-configuration`,
+					scopes: (
+						process.env.NEXT_PUBLIC_ENTRA_EXTERNAL_ID_CUSTOM_SCOPES ||
+						"offline_access openid email profile"
+					).split(" "),
+					pkce: true,
+					prompt: "login",
+					getUserInfo: async (tokens) => {
+						// Decode the id_token to get user claims
+						const idToken = tokens.idToken;
+						if (idToken) {
+							const parts = idToken.split(".");
+							if (parts.length === 3) {
+								const payload = JSON.parse(
+									Buffer.from(parts[1], "base64url").toString(),
+								);
+								return {
+									id: payload.oid || payload.sub,
+									name: payload.name,
+									email:
+										payload.email ||
+										payload.preferred_username ||
+										payload.emails?.[0],
+									emailVerified: !!payload.email_verified,
+								};
+							}
+						}
+						return null;
+					},
+				},
+			],
+		}),
+		customSession(async ({ user, session }, ctx) => {
+			let accessToken = "";
+			try {
+				const accounts = await ctx.context.internalAdapter.findAccounts(
+					user.id,
+				);
+				const account = accounts?.find(
+					(a) => a.providerId === "entra-external-id",
+				);
+				// For Entra External ID, use id_token as the access token
+				accessToken = account?.idToken || account?.accessToken || "";
+			} catch {
+				// Account data may not be accessible in all modes
+			}
+			return {
+				user,
+				session: {
+					...session,
+					accessToken,
+				},
+			};
+		}),
+		nextCookies(), // must be last plugin
+	],
+});
+
+export type Session = typeof auth.$Infer.Session;

package/src/auth/signout.ts

@@ -1,42 +1,13 @@
-const fetchCsrfToken = async (): Promise<string> => {
-	try {
-		const response = await fetch("/api/auth/csrf");
-		if (!response.ok) {
-			throw new Error(`Failed to fetch CSRF token: ${response.statusText}`);
-		}
-		const data: { csrfToken: string } = await response.json();
-		return data.csrfToken;
-	} catch (error) {
-		console.error("Error fetching CSRF token:", error);
-		throw error;
-	}
-};
+import { createAuthClient } from "better-auth/react";
+
+const authClient = createAuthClient();
 
 /**
- *  Alternative to signOut from "next-auth/react" - https://github.com/nextauthjs/next-auth/blob/main/packages/next-auth/src/react.tsx
- *  Solution to known next-auth issue - https://github.com/nextauthjs/next-auth/issues/4612
+ * Signs the user out and redirects to the home page.
  */
 const signOut = async (): Promise<void> => {
 	try {
-		const csrfToken = await fetchCsrfToken();
-
-		const formData = new URLSearchParams({
-			csrfToken,
-			json: "true",
-		});
-
-		const response = await fetch("/api/auth/signout", {
-			method: "POST",
-			headers: {
-				"Content-Type": "application/x-www-form-urlencoded",
-			},
-			body: formData,
-		});
-
-		if (!response.ok) {
-			throw new Error(`Failed to sign out: ${response.statusText}`);
-		}
-
+		await authClient.signOut();
 		globalThis.location.href = "/";
 	} catch (error) {
 		console.error(error);

package/src/components/header/__tests__/header.test.tsx

@@ -7,8 +7,15 @@ vi.mock("@evenicanpm/storefront-core/src/hooks/use-nextauth-session", () => ({
 	useAppSession: vi.fn(() => ({ session: null })),
 }));
 
-vi.mock("next-auth/react", () => ({
-	useSession: () => ({ data: null, status: "unauthenticated" }),
+vi.mock("better-auth/react", () => ({
+	createAuthClient: () => ({
+		useSession: () => ({ data: null, isPending: false }),
+		signIn: { oauth2: vi.fn() },
+	}),
+}));
+
+vi.mock("better-auth/client/plugins", () => ({
+	genericOAuthClient: () => ({}),
 }));
 
 vi.mock(

package/src/components/header/__tests__/user.test.tsx

@@ -4,6 +4,14 @@ import { fireEvent, render, screen, waitFor } from "@testing-library/react";
 import { NextIntlClientProvider } from "next-intl";
 import { vi } from "vitest";
 
+const { mockMutate, mockHandleRedirectPromise, mockUseSession } = vi.hoisted(
+	() => ({
+		mockMutate: vi.fn().mockResolvedValue({}),
+		mockHandleRedirectPromise: vi.fn().mockResolvedValue(null),
+		mockUseSession: vi.fn(),
+	}),
+);
+
 vi.mock(
 	"@evenicanpm/storefront-core/src/api-manager/services/session/mutations/session-init",
 	() => ({
@@ -11,10 +19,6 @@ vi.mock(
 	}),
 );
 
-const mockMutate = vi.fn().mockResolvedValue({});
-const mockHandleRedirectPromise = vi.fn().mockResolvedValue(null);
-const mockUseSession = vi.fn();
-
 vi.mock(
 	"@evenicanpm/storefront-core/src/api-manager/services/user/mutations/update-user",
 	() => ({
@@ -36,9 +40,17 @@ vi.mock("next/navigation", () => ({
 	usePathname: () => "/mock-path",
 }));
 
-vi.doMock("next-auth/react", () => ({
-	useSession: mockUseSession,
-	signIn: vi.fn(),
+vi.mock("better-auth/react", () => {
+	return {
+		createAuthClient: () => ({
+			useSession: mockUseSession,
+			signIn: { oauth2: vi.fn() },
+		}),
+	};
+});
+
+vi.mock("better-auth/client/plugins", () => ({
+	genericOAuthClient: () => ({}),
 }));
 
 vi.mock("@evenicanpm/storefront-core/src/auth/msal", () => ({
@@ -58,7 +70,7 @@ describe.skip("User Component", async () => {
 	it("renders login button when user is not authenticated", () => {
 		mockUseSession.mockReturnValue({
 			data: null,
-			status: "unauthenticated",
+			isPending: false,
 		});
 		render(
 			<NextIntlClientProvider locale="en" messages={messages}>
@@ -75,9 +87,9 @@ describe.skip("User Component", async () => {
 		mockUseSession.mockReturnValue({
 			data: {
 				user: { email: "test@example.com" },
-				accessToken: "mockAccessToken",
+				session: { accessToken: "mockAccessToken" },
 			},
-			status: "authenticated",
+			isPending: false,
 		});
 
 		render(
@@ -94,10 +106,10 @@ describe.skip("User Component", async () => {
 		expect(userMenuButton).toBeInTheDocument();
 	});
 
-	it("calls signOut when session.error is present", () => {
+	it("calls signOut when session is null after pending", () => {
 		mockUseSession.mockReturnValue({
-			data: { error: "Some auth error" },
-			status: "authenticated",
+			data: null,
+			isPending: false,
 		});
 
 		render(
@@ -113,8 +125,11 @@ describe.skip("User Component", async () => {
 		const mockSignOut = vi.mocked(signOut);
 
 		mockUseSession.mockReturnValue({
-			data: { user: { email: "test@example.com" }, accessToken: "token" },
-			status: "authenticated",
+			data: {
+				user: { email: "test@example.com" },
+				session: { accessToken: "token" },
+			},
+			isPending: false,
 		});
 
 		render(
@@ -139,9 +154,9 @@ describe.skip("User Component", async () => {
 		mockUseSession.mockReturnValue({
 			data: {
 				user: { email: "test@example.com" },
-				accessToken: "mockAccessToken",
+				session: { accessToken: "mockAccessToken" },
 			},
-			status: "authenticated",
+			isPending: false,
 		});
 
 		vi.mocked(mockHandleRedirectPromise).mockResolvedValue({
@@ -193,9 +208,9 @@ describe.skip("User Component", async () => {
 		mockUseSession.mockReturnValue({
 			data: {
 				user: { email: "test@example.com" },
-				accessToken: "mockAccessToken",
+				session: { accessToken: "mockAccessToken" },
 			},
-			status: "authenticated",
+			isPending: false,
 		});
 
 		vi.mocked(mockHandleRedirectPromise).mockRejectedValue(

package/src/components/header/components/user.tsx

@@ -23,7 +23,13 @@ import {
 } from "@mui/material";
 import { useRouter } from "next/navigation";
 // Auth components
-import { signIn, useSession } from "next-auth/react";
+import { createAuthClient } from "better-auth/react";
+import { genericOAuthClient } from "better-auth/client/plugins";
+
+const authClient = createAuthClient({
+	plugins: [genericOAuthClient()],
+});
+const { useSession: useBetterAuthSession } = authClient;
 import type React from "react";
 import {
 	createContext,
@@ -52,7 +58,7 @@ interface UserContextValue {
 	status: string;
 	menuItems: typeof MENU_ITEMS;
 	handleLogout: () => Promise<void>;
-	signIn: typeof signIn;
+	handleSignIn: () => void;
 	signOut: () => Promise<void>;
 	anchorEl: HTMLButtonElement | null;
 	setAnchorEl: (el: HTMLButtonElement | null) => void;
@@ -66,12 +72,15 @@ interface Props {
 }
 
 const User = ({ children }: Props) => {
-	const { data: session, status } = useSession();
+	const { data: session, isPending } = useBetterAuthSession();
+	const status = isPending
+		? "loading"
+		: session
+			? "authenticated"
+			: "unauthenticated";
 
-	if (session?.error) {
-		// Custom error set in server - /api/auth/[...nextauth]
-		console.warn("Auth Error", session?.error);
-		signOutCustom();
+	if (session === null && !isPending) {
+		// No error handling needed - session is simply null when not authenticated
 	}
 
 	const isAuthenticated = !!session;
@@ -81,12 +90,12 @@ const User = ({ children }: Props) => {
 
 	// session init
 	useEffect(() => {
-		if (isAuthenticated) {
-			const { accessToken, user } = session;
-			const email = user?.email;
-			if (accessToken && email) {
-				sessionInit({ accessToken, email });
-			}
+		if (isAuthenticated && session?.user?.email) {
+			const accessToken =
+				(session.session as { accessToken?: string })?.accessToken || "";
+			sessionInit({ accessToken, email: session.user.email }).catch(
+				console.error,
+			);
 		}
 	}, [isAuthenticated, session, sessionInit]);
 
@@ -124,6 +133,13 @@ const User = ({ children }: Props) => {
 		}
 	};
 
+	const handleSignIn = () => {
+		authClient.signIn.oauth2({
+			providerId: "entra-external-id",
+			callbackURL: "/",
+		});
+	};
+
 	const [anchorEl, setAnchorEl] = useState<HTMLButtonElement | null>(null);
 	const open = Boolean(anchorEl);
 
@@ -132,7 +148,7 @@ const User = ({ children }: Props) => {
 		status,
 		menuItems: MENU_ITEMS,
 		handleLogout,
-		signIn,
+		handleSignIn,
 		signOut: signOutCustom,
 		anchorEl,
 		setAnchorEl,
@@ -149,13 +165,13 @@ User.MobileTrigger = function MobileTrigger() {
 	const ctx = useContext(UserContext);
 	const router = useRouter();
 	if (!ctx) return null;
-	const { isAuthenticated, signIn } = ctx;
+	const { isAuthenticated, handleSignIn } = ctx;
 	return (
 		<IconButton
 			aria-label="User Menu"
 			onClick={() => {
 				if (isAuthenticated) router.push("/account/profile");
-				else signIn();
+				else handleSignIn();
 			}}
 		>
 			<MobileUserIcon style={{ fontSize: "1.25rem" }} />
@@ -239,13 +255,13 @@ User.MenuItem = function MenuItem({
 User.LoginButton = function LoginButton() {
 	const ctx = useContext(UserContext);
 	if (!ctx) return null;
-	const { signIn } = ctx;
+	const { handleSignIn } = ctx;
 	return (
 		<Button
 			size="small"
 			variant="contained"
 			color="primary"
-			onClick={() => signIn()}
+			onClick={() => handleSignIn()}
 		>
 			<T path="Account.Menu.btnLogin" />
 		</Button>

package/src/components/wishlist-dialogs/add-to-wishlist/compound/add-to-wishlist-dialog.tsx

@@ -8,9 +8,11 @@ import { AddToWishListDialogContext } from "@evenicanpm/storefront-core/src/comp
 // LOCAL COMPONENTS
 import DialogHeader from "@evenicanpm/storefront-core/src/components/wishlist-dialogs/add-to-wishlist/compound/wishlist-dialog-header";
 import { Dialog, DialogContent } from "@mui/material";
-import { useSession } from "next-auth/react";
+import { createAuthClient } from "better-auth/react";
 import type React from "react";
 
+const { useSession } = createAuthClient();
+
 export interface AddToWishlistDialogProps {
 	open: boolean;
 	handleClose: () => void;

package/src/components/wishlist-dialogs/add-to-wishlist/compound/wishlist-dialog-header.tsx

@@ -9,8 +9,10 @@ import { H2 } from "@evenicanpm/storefront-core/src/components/Typography";
 import CreateWishlistButton from "@evenicanpm/storefront-core/src/components/wishlist-dialogs/create-wishlist/create-wishlist-button";
 import { IconButton, styled, type Theme } from "@mui/material";
 import useMediaQuery from "@mui/material/useMediaQuery";
-import { useSession } from "next-auth/react";
+import { createAuthClient } from "better-auth/react";
 import { useTranslations } from "next-intl";
+
+const { useSession } = createAuthClient();
 // ICONS
 import { MdFavorite } from "react-icons/md";
 

package/src/hooks/use-nextauth-session.ts

@@ -1,36 +1,31 @@
 // hooks/useAppSession.ts
 
 import useSessionInit from "@evenicanpm/storefront-core/src/api-manager/services/session/mutations/session-init";
-import useSessionLogout from "@evenicanpm/storefront-core/src/api-manager/services/session/mutations/session-logout";
 // API hooks
 import useUpdateUser from "@evenicanpm/storefront-core/src/api-manager/services/user/mutations/update-user";
 import {
 	getMsalInstance,
 	initializeMsal,
 } from "@evenicanpm/storefront-core/src/auth/msal";
-import { useSession } from "next-auth/react";
+import { createAuthClient } from "better-auth/react";
 import { useEffect } from "react";
 
+const authClient = createAuthClient();
+const { useSession: useBetterAuthSession } = authClient;
+
 export function useAppSession() {
-	const { data: session } = useSession();
+	const { data: session, isPending } = useBetterAuthSession();
 	const { mutateAsync: sessionInit } = useSessionInit();
 	const { mutateAsync: updateUser } = useUpdateUser();
-	const { mutateAsync: sessionLogout } = useSessionLogout();
-
-	// Handle custom auth errors
-	useEffect(() => {
-		if (session?.error) {
-			console.warn("Auth Error", session.error);
-			sessionLogout({}); // Or your custom signOut
-		}
-	}, [session, sessionLogout]);
 
 	// Initialize session in API
 	useEffect(() => {
 		if (!session) return;
 
-		const { accessToken, user } = session;
-		if (accessToken && user?.email) {
+		const { user } = session;
+		const accessToken =
+			(session.session as { accessToken?: string })?.accessToken || "";
+		if (user?.email) {
 			sessionInit({ accessToken, email: user.email }).catch(console.error);
 		}
 	}, [session, sessionInit]);
@@ -64,5 +59,6 @@ export function useAppSession() {
 	return {
 		session,
 		isAuthenticated: !!session,
+		isPending,
 	};
 }

package/src/pages/cart/__tests__/checkout-form.test.tsx

@@ -10,8 +10,10 @@ import { NextIntlClientProvider } from "next-intl";
 import type React from "react";
 import { vi } from "vitest";
 
-vi.mock("next-auth/react", () => ({
-	// Empty mock for next-auth to stop throwing errors
+vi.mock("better-auth/react", () => ({
+	createAuthClient: () => ({
+		useSession: () => ({ data: null, isPending: false }),
+	}),
 }));
 
 // global.fetch = vi.fn(() => Promise.resolve({ json: () => ({}) }));

package/src/api-manager/datasources/d365/utils/decode-jwt.ts

@@ -1,10 +0,0 @@
-"use server";
-import { decode } from "next-auth/jwt";
-
-export async function decodeToken(token: string) {
-	const secret = process.env.NEXTAUTH_SECRET; //this shouldn't be from key vault.
-	if (!secret) {
-		throw new Error("Environment variable NEXTAUTH_SECRET is not set.");
-	}
-	return decode({ token: token, secret });
-}

package/src/auth/auth-options.test.ts

@@ -1,70 +0,0 @@
-import type { Account, Session } from "next-auth";
-import type { JWT } from "next-auth/jwt";
-import { describe, expect, it } from "vitest";
-import authOptions, { type ExtendedJwtToken } from "@/auth/auth-options";
-
-describe("next-auth option callbacks", () => {
-	describe("jwt callback", () => {
-		it("should store accessToken and refreshToken when account and profile are available", async () => {
-			const token: ExtendedJwtToken = {
-				accessToken: "",
-				accessTokenExpiresAt: 0,
-				provider: "azure-ad-b2c",
-				refreshTokenExpiresAt: 0,
-				exp: 0,
-			};
-			const account: Account = {
-				access_token: "testAccessToken",
-				refresh_token: "testRefreshToken",
-				expires_on: Math.floor(Date.now() / 1000) + 3600,
-				refresh_token_expires_in: 86400,
-				providerAccountId: "test-provider-account-id",
-				provider: "azure-ad-b2c",
-				type: "oauth",
-			};
-
-			let newToken: ExtendedJwtToken | undefined;
-			if (authOptions()?.callbacks?.jwt) {
-				newToken = await authOptions().callbacks.jwt({
-					token,
-					user: { id: "123" },
-					account,
-					profile: {},
-				});
-			}
-
-			expect(newToken?.accessToken).toBe("testAccessToken");
-			expect(newToken?.refreshToken).toBe("testRefreshToken");
-			expect(newToken?.accessTokenExpiresAt).toBe(token.accessTokenExpiresAt); // We're not setting this or using it anymore
-			expect(newToken?.refreshTokenExpiresAt).toBe(token.refreshTokenExpiresAt); // We're not setting this or using it anymore);
-		});
-	});
-
-	describe("session callback", () => {
-		it("should pass accessToken and error to session", async () => {
-			const session = { expires: "", user: { name: "123" } };
-			const token: JWT = {
-				accessToken: "sessionToken",
-				accessTokenExpiresAt: 0,
-				refreshToken: "",
-				refreshTokenExpiresAt: 0,
-				error: "SomeError",
-			};
-			let newSession: Session | null;
-			if (authOptions()?.callbacks?.session) {
-				newSession = await authOptions().callbacks.session({
-					session,
-					token,
-					user: { id: "123", email: "", emailVerified: new Date(Date.now()) },
-					newSession: {},
-					trigger: "update",
-				});
-			} else {
-				newSession = null;
-			}
-
-			expect(newSession?.accessToken).toBe("sessionToken");
-			expect(newSession?.error).toBe("SomeError");
-		});
-	});
-});

package/src/auth/auth-options.ts

@@ -1,101 +0,0 @@
-import { deleteCartCookie } from "@evenicanpm/storefront-core/src/lib/cart-cookie-handler";
-import type {
-	GetServerSidePropsContext,
-	NextApiRequest,
-	NextApiResponse,
-} from "next";
-import type { NextAuthOptions, Session } from "next-auth";
-import type { JWT } from "next-auth/jwt";
-import { getServerSession } from "next-auth/next";
-import { getProviders } from "@/auth/providers";
-
-// Split providers into separate array so we can iterate them and match the provider ID
-export type ExtendedJwtToken = JWT & {
-	provider: string;
-	exp: number;
-};
-
-export type ExtendedSession = Session & { token?: JWT };
-
-const createAuthOptions = (): NextAuthOptions => {
-	const providers = getProviders();
-	const secret = process.env.NEXTAUTH_SECRET; // internally used by next-auth, shouldn't be from key vault.
-	return {
-		providers,
-		secret,
-		cookies: {
-			csrfToken: {
-				name: "next-auth.csrf-token",
-				options: {
-					httpOnly: true,
-					sameSite: "none",
-					path: "/",
-					secure: true,
-				},
-			},
-			pkceCodeVerifier: {
-				name: "next-auth.pkce.code_verifier",
-				options: {
-					httpOnly: true,
-					sameSite: "none",
-					path: "/",
-					secure: true,
-				},
-			},
-			nonce: {
-				name: "next-auth.nonce",
-				options: {
-					httpOnly: true,
-					sameSite: "none",
-					path: "/",
-					secure: true,
-				},
-			},
-		},
-		// Order in which callbacks are called = signin > redirect > jwt > session. Thats why session callback has token info.
-		callbacks: {
-			// By default, NextAuth uses "session" with strategy: "jwt"
-			async jwt({ token, account, profile }) {
-				const _token = token as ExtendedJwtToken;
-				// account and profile is available only in first callback after signin
-				if (account && profile) {
-					_token.provider = account.provider;
-					// use id_token for entra external id and access_token for aadb2c
-					_token.accessToken =
-						_token.provider === "entra-external-id"
-							? account.id_token
-							: account.access_token;
-					_token.refreshToken = account.refresh_token;
-				}
-				return _token;
-				// return await checkAccessTokenExpiry(_token)
-			},
-			async session({ session, token }) {
-				const _session = { ...session } as ExtendedSession;
-				// Way to pass data to the browser
-				// Use this error to force logout in UI. No proper way to signout user from server.
-				_session.error = token?.error;
-				_session.accessToken = token.accessToken;
-
-				return _session;
-			},
-		},
-		events: {
-			signOut: async () => {
-				await deleteCartCookie();
-			},
-		},
-	};
-};
-
-export function auth(
-	// <-- use this function to access the jwt from React components
-	...args:
-		| [GetServerSidePropsContext["req"], GetServerSidePropsContext["res"]]
-		| [NextApiRequest, NextApiResponse]
-		| []
-) {
-	return getServerSession(...args, createAuthOptions());
-}
-
-export default createAuthOptions;

package/src/auth/next-auth-cookie-manager.ts

@@ -1,87 +0,0 @@
-"use server";
-import type { RequestCookie } from "next/dist/compiled/@edge-runtime/cookies";
-import { cookies } from "next/headers";
-import { decode, encode, type JWT } from "next-auth/jwt";
-import type { ExtendedJwtToken } from "@/auth/auth-options";
-
-const NEXT_AUTH_COOKIE_NAME = "next-auth.session-token";
-const SECURE_COOKIE_PREFIX = "__Secure-";
-
-/**
- * Retrieves and decodes the NextAuth session cookie from the request.
- *
- * This function handles both single and chunked session cookies:
- * - If the session cookie is under 4KB, it is stored as a single cookie.
- * - If the session cookie exceeds 4KB, it is split into multiple chunked cookies with indexed names.
- *
- * The function attempts to retrieve the single cookie first. If not found,
- * it iteratively collects all chunked cookies, concatenates their values,
- * and decodes the resulting token.
- *
- * @returns A Promise resolving to the decoded session object, or `undefined` if no session cookie is found.
- */
-const manuallyRetrieveSessionCookie = async () => {
-	const cookieStore = await cookies();
-	let cookie: RequestCookie | undefined;
-	// Single token when the cookie size is < 4k
-	cookie = cookieStore.get(`${SECURE_COOKIE_PREFIX}${NEXT_AUTH_COOKIE_NAME}`);
-	//If the cookie is found, return it. the cookie is under 4kb
-	if (cookie) {
-		return decode({
-			token: cookie.value,
-			secret: process.env.NEXTAUTH_SECRET || "",
-		});
-	}
-	//If the cookie is not found, we need to see if there is a chunked cookie
-	//The chunked cookie is stored in multiple cookies with the same name and an index
-	//The cookie is chunked when the cookie size is > 4k
-	//The value is just split between the cookies, so we can just concat them.
-	let i = 0;
-	const cookieValues: string[] = [];
-	do {
-		cookie = cookieStore.get(
-			`${SECURE_COOKIE_PREFIX}${NEXT_AUTH_COOKIE_NAME}.${i}`,
-		);
-		if (cookie) {
-			cookieValues.push(cookie.value);
-		}
-		i++;
-	} while (cookie !== undefined);
-	if (cookieValues.length) {
-		return decode({
-			token: cookieValues.join(""),
-			secret: process.env.NEXTAUTH_SECRET || "",
-		});
-	}
-
-	//If no cookie is found, return undefined
-	return undefined;
-};
-
-/**
- * Manually sets the NextAuth session cookie with the provided JWT token.
- *
- * This function encodes the given JWT or ExtendedJwtToken and sets it as a secure,
- * HTTP-only cookie named `__Secure-next-auth.session-token`. The cookie is set using
- * the current cookie store, and the encoding uses the secret from the `NEXTAUTH_SECRET`
- * environment variable.
- *
- * @param token - The JWT or ExtendedJwtToken to be encoded and stored in the session cookie.
- * @returns A promise that resolves when the cookie has been set.
- */
-const manuallySetSessionCookie = async (token: JWT | ExtendedJwtToken) => {
-	const cookieStore = await cookies();
-	// Set the cookie with the name __Secure-next-auth.session-token
-	const value = await encode({
-		token,
-		secret: process.env.NEXTAUTH_SECRET || "",
-	});
-	cookieStore.set({
-		name: `${SECURE_COOKIE_PREFIX}${NEXT_AUTH_COOKIE_NAME}`,
-		value,
-		httpOnly: true,
-		secure: true,
-	});
-};
-
-export { manuallyRetrieveSessionCookie, manuallySetSessionCookie };

package/src/auth/providers/aadb2c-provider.ts

@@ -1,32 +0,0 @@
-import AzureADB2CProvider from "next-auth/providers/azure-ad-b2c";
-
-// By default, NextAuth tries to use either PKCE or Client Secret-based authentication, depending on how the provider is configured.
-// If clientSecret is provided, it assumes client secret authentication (which doesn't use code_challenge).
-// If clientSecret is missing, it assumes PKCE.
-// But Azure AD B2C sometimes requires PKCE explicitly, so NextAuth needs to be told to always use PKCE.
-const azureADB2CProvider = () => {
-	const CLIENT_ID = process.env.NEXT_PUBLIC_AZURE_AD_B2C_CLIENTID || "";
-	const SCOPE = `${process.env.NEXT_PUBLIC_AZURE_AD_B2C_API_PERMISSION} offline_access openid`;
-	const LOGIN_AUTHORITY = process.env.NEXT_PUBLIC_AZURE_AD_B2C_LOGIN_AUTHORITY;
-
-	return AzureADB2CProvider({
-		clientId: CLIENT_ID,
-		clientSecret: "",
-		issuer: `${LOGIN_AUTHORITY}/v2.0`, // either (tenantId and primaryUserFlow) or issuer must be provided
-		authorization: {
-			// We can also send params from UI - signIn("azure-ad-b2c", {}, { prompt: "login" })
-			params: {
-				scope: SCOPE,
-				// When a user logs in once, the session remains active, and next time Azure AD B2C automatically logs the user in without showing the sign-in page again
-				// This option forces login screen every time.
-				prompt: "login",
-			},
-		},
-		checks: ["pkce"],
-		client: {
-			token_endpoint_auth_method: "none", // Disables Client Secret, ensuring that only PKCE is used
-		},
-	});
-};
-
-export default azureADB2CProvider;

package/src/auth/providers/authentik-provider.ts

@@ -1,24 +0,0 @@
-import AuthentikProvider from "next-auth/providers/authentik";
-
-const clientId = "DRWJuuA4HEWyhSAsDjTgUHrsDo7CmeUa1p5UVN2e";
-const clientSecret =
-	"4PyTnKqbO6fzDngGrLkD9YiFTxXASsJH7WPoMBeFCpezfrooZE3j2FCnWYXfO5ioFm8Uwx95kHspXsNRjl9S3uq7CBZcJUpbFfXywDMEGqrxXKT4biEuiihOTHL65qOY";
-const issuer =
-	"https://authentik-server.orangeocean-cbcb289b.eastus.azurecontainerapps.io/application/o/sandboxauthapp";
-const wellKnown =
-	"https://authentik-server.orangeocean-cbcb289b.eastus.azurecontainerapps.io/application/o/sandboxauthapp/.well-known/openid-configuration";
-const authentikProvider = AuthentikProvider({
-	clientId,
-	clientSecret,
-	issuer,
-	id: "Authentik",
-	name: "Authentik",
-	wellKnown: wellKnown,
-	authorization: {
-		params: {
-			scope: "openid email profile offline_access",
-		},
-	},
-});
-
-export default authentikProvider;

package/src/auth/providers/entra-external-id-provider.ts

@@ -1,50 +0,0 @@
-import type { Provider } from "next-auth/providers";
-
-const createEntraExternalIdProvider = (): Provider => {
-	const clientId = process.env.NEXT_PUBLIC_ENTRA_EXTERNAL_ID_CLIENT_ID || "";
-	const customScopes =
-		process.env.NEXT_PUBLIC_ENTRA_EXTERNAL_ID_CUSTOM_SCOPES || "";
-	const tenantName =
-		process.env.NEXT_PUBLIC_ENTRA_EXTERNAL_ID_TENANT_NAME || "";
-	const clientSecret =
-		process.env.NEXT_PUBLIC_ENTRA_EXTERNAL_ID_CLIENT_SECRET || "";
-
-	// Build auth url and wellKnown from the loginAuthority
-	const loginAuthority = `https://${tenantName}.ciamlogin.com/${tenantName}.onmicrosoft.com`;
-	const authUrl = `${loginAuthority}/oauth2/v2.0/authorize`;
-	const wellKnownUrl = `${loginAuthority}/v2.0/.well-known/openid-configuration`;
-
-	return {
-		id: "entra-external-id",
-		clientId: clientId,
-		client: {
-			client_id: clientId,
-			response_types: ["code id_token"],
-			client_secret: clientSecret,
-			// token_endpoint_auth_method: 'none',
-		},
-		type: "oauth",
-		idToken: true,
-		name: "Microsoft Entra External ID",
-		authorization: {
-			url: authUrl,
-			params: {
-				scope: customScopes,
-				prompt: "login",
-				response_type: "code id_token",
-				response_mode: "form_post",
-			},
-		},
-		wellKnown: wellKnownUrl,
-		profile(profile) {
-			return {
-				id: profile.oid,
-				name: profile.name,
-				email: profile.email,
-			};
-		},
-		checks: ["pkce", "nonce"],
-	};
-};
-
-export default createEntraExternalIdProvider;

package/src/auth/providers/index.ts

@@ -1,16 +0,0 @@
-import azureADB2CProvider from "@/auth/providers/aadb2c-provider";
-import authentikProvider from "@/auth/providers/authentik-provider";
-import createEntraExternalIdProvider from "@/auth/providers/entra-external-id-provider";
-import keycloakProvider from "@/auth/providers/keycloak-provider";
-
-export const getProviders = () => {
-	const azureProvider = azureADB2CProvider();
-	const entraExternalIdProvider = createEntraExternalIdProvider();
-	// once we stop hard coding others use loader function here
-	return [
-		authentikProvider,
-		azureProvider,
-		keycloakProvider,
-		entraExternalIdProvider,
-	];
-};

package/src/auth/providers/keycloak-provider.ts

@@ -1,22 +0,0 @@
-import KeycloakProvider from "next-auth/providers/keycloak";
-
-const clientid = "b6229a60-b0de-4f86-9891-e0b58d756e39";
-const issuer =
-	"https://keycloak-app-g9dmfkf6atdqdrcn.eastus2-01.azurewebsites.net/realms/e4headless";
-const wellKnown =
-	"https://keycloak-app-g9dmfkf6atdqdrcn.eastus2-01.azurewebsites.net/realms/e4headless/.well-known/openid-configuration";
-const keycloakProvider = KeycloakProvider({
-	clientId: clientid,
-	clientSecret: "",
-	issuer: issuer,
-	id: "Keycloak",
-	name: "Keycloak",
-	wellKnown: wellKnown,
-	authorization: {
-		params: {
-			scope: "openid email profile offline_access",
-		},
-	},
-});
-
-export default keycloakProvider;

package/src/auth/refresh-token.ts

@@ -1,132 +0,0 @@
-"use server";
-import jwt from "jsonwebtoken";
-import type { JWT } from "next-auth/jwt";
-import type { AuthorizationEndpointHandler } from "next-auth/providers";
-import type { ExtendedJwtToken } from "@/auth/auth-options";
-import { getProviders } from "@/auth/providers";
-
-type TokenResponse = {
-	token: ExtendedJwtToken;
-	isRefreshed: boolean;
-};
-
-const checkAccessTokenExpiry = async (
-	token: ExtendedJwtToken,
-): Promise<TokenResponse> => {
-	const providers = getProviders();
-	const decryptedToken = jwt.decode(token?.accessToken ?? "") as jwt.JwtPayload;
-	if (!decryptedToken) {
-		token.error = "Token Invalid";
-		return { token, isRefreshed: false };
-	}
-
-	if (!decryptedToken.exp) {
-		token.error = "noExpiryOnToken";
-		return {
-			token,
-			isRefreshed: false,
-		};
-	}
-	const expiry = decryptedToken.exp * 1000;
-	const nowMinusBuffer = 5 * 60 * 1000; // 5 minutes
-	// Check if token is expired or will expire in 5 minutes
-	// return token if access Token is not expired yet
-	if (Date.now() < expiry - nowMinusBuffer) {
-		return {
-			token,
-			isRefreshed: false,
-		};
-	}
-
-	const refreshTokenExpiry = token.exp * 1000;
-
-	// Avoid making request for access token if refresh token is expired.
-	if (Date.now() >= refreshTokenExpiry) {
-		token.error = "RefreshTokenExpired";
-		return {
-			token,
-			isRefreshed: false,
-		};
-	}
-
-	//Find the provider that matches the provider cookie
-	const matchedProvider = providers.find(
-		(p) => p.id.toLowerCase() === token.provider.toLowerCase(),
-	);
-	if (!matchedProvider || !("wellKnown" in matchedProvider)) {
-		token.error = "NoProviderMatch";
-		return {
-			token,
-			isRefreshed: false,
-		};
-	}
-
-	const wellKnown = matchedProvider.wellKnown;
-	const clientId = matchedProvider.options?.clientId;
-	const scope = (
-		matchedProvider.options?.authorization as AuthorizationEndpointHandler
-	)?.params?.scope;
-
-	if (!wellKnown || !clientId || !scope) {
-		return {
-			token: { ...token, error: "MissingProviderInfo" },
-			isRefreshed: false,
-		};
-	}
-
-	const newToken = await refreshAccessToken(token, wellKnown, clientId, scope);
-
-	return {
-		token: newToken as ExtendedJwtToken,
-		isRefreshed: !newToken.error,
-	};
-};
-
-const refreshAccessToken = async (
-	token: JWT,
-	wellKnown: string,
-	clientId: string,
-	scope: string,
-) => {
-	if (!token.refreshToken) {
-		return { ...token, error: "NoRefreshToken" };
-	}
-
-	const refreshUrl = await getTokenEndpoint(wellKnown);
-	try {
-		const response = await fetch(refreshUrl, {
-			method: "POST",
-			headers: { "Content-Type": "application/x-www-form-urlencoded" },
-			body: new URLSearchParams({
-				client_id: clientId,
-				grant_type: "refresh_token",
-				refresh_token: token.refreshToken,
-				scope: scope,
-			}),
-		});
-		const refreshedTokens = await response.json();
-		if (!response.ok) {
-			throw new Error(refreshedTokens.error_description);
-		}
-		return {
-			...token,
-			accessToken: refreshedTokens.access_token,
-			refreshToken: refreshedTokens.refresh_token,
-		};
-	} catch (error) {
-		console.error("Error refreshing web token:", error);
-		return { ...token, error: "RefreshAccessTokenError" };
-	}
-};
-
-const getTokenEndpoint = async (wellKnown: string) => {
-	const json = await getWellKnownData(wellKnown);
-	return json.token_endpoint;
-};
-
-const getWellKnownData = async (wellKnown: string) => {
-	const data = await fetch(wellKnown);
-	return data.json();
-};
-
-export default checkAccessTokenExpiry;

package/src/auth/types/next-auth.d.ts

@@ -1,38 +0,0 @@
-// eslint-disable-next-line @typescript-eslint/no-unused-vars
-import type { NextAuthOptions } from "next-auth";
-
-declare module "next-auth" {
-	/**
-	 * Returned by `useSession`, `getSession` and received as a prop on the `SessionProvider` React Context
-	 */
-	interface Session {
-		error?: string;
-		accessToken?: string;
-	}
-}
-
-declare module "next-auth/jwt" {
-	interface JWT {
-		accessToken?: string;
-		accessTokenExpiresAt: number;
-		refreshToken?: string;
-		refreshTokenExpiresAt: number;
-		error?: string;
-	}
-}
-
-/**
- * Usually contains information about the provider being used
- * and also extends `TokenSet`, which is different tokens returned by OAuth Providers.
- */
-declare module "next-auth/providers/azure-ad-b2c" {
-	interface Account {
-		access_token: string;
-		expires_on: number;
-		refresh_token: string;
-		refresh_token_expires_in: number;
-	}
-
-	/** The OAuth profile returned from your provider */
-	// interface Profile {}
-}