@goplusvn/core 0.1.56 → 0.1.57

package/package.json

@@ -1,7 +1,7 @@
 {
   "name": "@goplusvn/core",
   "description": "GoPlusVN Platform Kit - ERP kernel: layout, RBAC, CRUD, multi-tenant, system pages",
-  "version": "0.1.56",
+  "version": "0.1.57",
   "private": false,
   "publishConfig": {
     "registry": "https://registry.npmjs.org",
@@ -119,7 +119,6 @@
     "eslint-plugin-react-hooks": "^7.0.1",
     "globals": "16.5.0",
     "jsdom": "^27.2.0",
-    "next-auth": "4.24.11",
     "tsup": "^8.5.1",
     "typescript": "^5.7.3",
     "typescript-eslint": "^8.50.1",

package/src/auth/__tests__/proxy-gate.test.ts

@@ -0,0 +1,27 @@
+import { readFileSync } from "node:fs";
+import { resolve } from "node:path";
+
+import { describe, expect, it } from "vitest";
+
+// Đọc theo cwd chứ không theo import.meta.url: môi trường test là jsdom nên
+// import.meta.url là URL http, fileURLToPath ném "URL must be of scheme file".
+const source = readFileSync(resolve(process.cwd(), "src/auth/proxy-gate.ts"), "utf8")
+  // Bỏ chú thích: phần header có ví dụ dùng, trong đó cũng có chữ `import`.
+  .replace(/\/\*[\s\S]*?\*\//g, "")
+  .replace(/^\s*\/\/.*$/gm, "");
+
+describe("proxy-gate không kéo theo thư viện auth nào", () => {
+  // Bẫy đã trả giá: proxy-gate từng `await import("next-auth/jwt")` trong nhánh
+  // mặc định. Bundler phân giải TĨNH cả dynamic import, nên mọi app Better Auth
+  // (không cài next-auth) đều gãy middleware bằng "Module not found" — mà trong
+  // workspace này thì không lộ, vì next-auth nằm ở devDependencies của core.
+  // Middleware chạy ở Edge: đừng thêm import nào không phải next/server.
+  it("chỉ import next/server", () => {
+    const specifiers = [
+      ...source.matchAll(/(?:^|\s)import\s+(?:type\s+)?[^"']*from\s*["']([^"']+)["']/gm),
+      ...source.matchAll(/\bimport\(\s*["']([^"']+)["']\s*\)/g),
+    ].map((m) => m[1]);
+
+    expect([...new Set(specifiers)].sort()).toEqual(["next/server"]);
+  });
+});

package/src/auth/proxy-gate.ts

@@ -1,7 +1,7 @@
 // @goerp/core/auth/proxy-gate — server-only request-gate for the Next.js
 // proxy/middleware. Default-DENY authentication (authN); route-level authZ still
 // happens via getCrudPermissions/checkPermission. Isolated in its own subpath so
-// `next/server` + `next-auth/jwt` never leak into client bundles via the auth barrel.
+// `next/server` never leaks into client bundles via the auth barrel.
 //
 // Usage (app side):
 //   // src/proxy.ts
@@ -14,7 +14,7 @@ import { NextResponse } from "next/server";
 import type { NextRequest } from "next/server";
 
 export interface AuthProxyOptions {
-  /** API prefixes served without a session (NextAuth + public). Default: /api/auth, /api/public. */
+  /** API prefixes served without a session (auth handler + public). Default: /api/auth, /api/public. */
   publicApiPrefixes?: string[];
   /** Pages reachable while logged out. Default: /sign-in. */
   publicPages?: string[];
@@ -22,33 +22,49 @@ export interface AuthProxyOptions {
   signInPath?: string;
   /** Where to send a logged-in user who hits a guest page. Default: "/". */
   homePath?: string;
-  /** Override token reader (tests / custom JWT). Default: next-auth getToken. */
+  /**
+   * Session reader. STRONGLY recommended — pass the one your auth library ships
+   * (Better Auth: `getSessionCookie` from "better-auth/cookies"; NextAuth:
+   * `getToken` from "next-auth/jwt"). Default: presence of a known session
+   * cookie, see SESSION_COOKIE_NAMES.
+   */
   getToken?: (req: NextRequest) => Promise<unknown | null>;
 }
 
 const startsWithAny = (pathname: string, list: string[]) =>
   list.some((p) => pathname === p || pathname.startsWith(`${p}/`));
 
+/**
+ * Cookie tên gì thì coi như "có phiên" — dùng cho trường hợp app không truyền
+ * getToken. Middleware chạy ở Edge nên đây CHỈ là rào authN thô; chữ ký/hạn
+ * dùng vẫn do từng route kiểm qua getSession(). Không import next-auth ở đây:
+ * bundler phân giải tĩnh cả `await import()`, nên một dòng import next-auth
+ * trong nhánh chết cũng đủ làm mọi app Better Auth gãy middleware bằng
+ * "Module not found: Can't resolve 'next-auth/jwt'".
+ */
+const SESSION_COOKIE_NAMES = [
+  "better-auth.session_token",
+  "__Secure-better-auth.session_token",
+  "next-auth.session-token",
+  "__Secure-next-auth.session-token",
+  "authjs.session-token",
+  "__Secure-authjs.session-token",
+];
+
 export function createAuthProxy(options: AuthProxyOptions = {}) {
   const publicApiPrefixes = options.publicApiPrefixes ?? ["/api/auth", "/api/public"];
   const publicPages = options.publicPages ?? ["/sign-in"];
   const signInPath = options.signInPath ?? "/sign-in";
   const homePath = options.homePath ?? "/";
-  // next-auth chỉ được LAZY-load khi app không truyền getToken riêng — app đã
-  // sang Better Auth (không cài next-auth) sẽ không dính module-not-found lúc
-  // import proxy-gate (trước đây import top-level, next-auth lại chỉ nằm ở
-  // devDependencies của core).
   const readToken =
     options.getToken ??
-    (async (req: NextRequest) => {
-      const { getToken } = await import("next-auth/jwt");
-      return getToken({ req });
-    });
+    (async (req: NextRequest) =>
+      SESSION_COOKIE_NAMES.some((name) => req.cookies.has(name)) ? { cookie: true } : null);
 
   return async function proxy(request: NextRequest) {
     const { pathname, search } = request.nextUrl;
 
-    // API routes that authenticate themselves (NextAuth) or are public → pass.
+    // API routes that authenticate themselves (the auth handler) or are public → pass.
     if (startsWithAny(pathname, publicApiPrefixes)) return NextResponse.next();
 
     const token = await readToken(request);

package/src/ui/layout/command-menu.tsx

@@ -245,13 +245,13 @@ export function CommandMenu({
           buttonClassName,
         )}
         onClick={() => setOpen(true)}
-        aria-label={dictionary.search.search}
+        aria-label={dictionary?.search?.search ?? "Tìm kiếm"}
         {...props}
       >
         <Search className={cn("h-4 w-4", variant !== "icon" && "me-2")} />
         {variant !== "icon" && (
           <>
-            <span>{dictionary.search.search}</span>
+            <span>{dictionary?.search?.search ?? "Tìm kiếm"}</span>
             {variant !== "fiori" && <Keyboard className="ms-auto">K</Keyboard>}
           </>
         )}
@@ -270,7 +270,7 @@ export function CommandMenu({
           <Search className="absolute left-4 top-1/2 -translate-y-1/2 h-4 w-4 shrink-0 opacity-50" />
           <input
             className="flex h-11 w-full rounded-md bg-transparent py-3 pl-10 pr-10 text-sm outline-none placeholder:text-muted-foreground disabled:cursor-not-allowed disabled:opacity-50"
-            placeholder={dictionary.search.typeCommand}
+            placeholder={dictionary?.search?.typeCommand ?? "Nhập lệnh hoặc từ khoá…"}
             value={query}
             onChange={(e) => setQuery(e.target.value)}
             autoFocus
@@ -288,7 +288,7 @@ export function CommandMenu({
             </div>
           ) : (
             !searchResults?.length &&
-            query && <CommandEmpty>{dictionary.search.noResults}</CommandEmpty>
+            query && <CommandEmpty>{dictionary?.search?.noResults ?? "Không có kết quả"}</CommandEmpty>
           )}
 
           <ScrollArea className="h-[300px] max-h-[300px]">

package/src/ui/layout/notification-dropdown.tsx

@@ -73,10 +73,10 @@ export function NotificationDropdown({
         <Card className="border-0 shadow-none">
           <div className="flex items-center justify-between border-b border-border p-3">
             <h3 className="text-sm font-semibold">
-              {dictionary.navigation.notifications.notifications}
+              {dictionary?.navigation?.notifications?.notifications ?? "Thông báo"}
             </h3>
             <Button variant="link" className="text-primary h-auto p-0">
-              {dictionary.navigation.notifications.dismissAll}
+              {dictionary?.navigation?.notifications?.dismissAll ?? "Bỏ qua tất cả"}
             </Button>
           </div>
           <ScrollArea className="max-h-[300px]">
@@ -117,7 +117,7 @@ export function NotificationDropdown({
                 "text-primary text-center",
               )}
             >
-              {dictionary.navigation.notifications.seeAllNotifications}
+              {dictionary?.navigation?.notifications?.seeAllNotifications ?? "Xem tất cả thông báo"}
             </Link>
           </CardFooter>
         </Card>

package/src/ui/layout/user-dropdown.tsx

@@ -149,7 +149,7 @@ export function UserDropdown({
               className="flex items-center w-full"
             >
               <User className="me-2 size-4 text-muted-foreground group-hover:text-primary group-focus:text-primary transition-colors" />
-              <span>{dictionary.navigation.userNav.profile}</span>
+              <span>{dictionary?.navigation?.userNav?.profile ?? "Hồ sơ"}</span>
             </Link>
           </DropdownMenuItem>
           {/* <DropdownMenuItem
@@ -161,7 +161,7 @@ export function UserDropdown({
               className="flex items-center w-full"
             >
               <UserCog className="me-2 size-4 text-muted-foreground group-hover:text-primary group-focus:text-primary transition-colors" />
-              <span>{dictionary.navigation.userNav.settings}</span>
+              <span>{dictionary?.navigation?.userNav?.settings ?? "Cài đặt"}</span>
             </Link>
           </DropdownMenuItem> */}
         </DropdownMenuGroup>
@@ -173,7 +173,7 @@ export function UserDropdown({
           className="h-8 px-2 rounded-md cursor-pointer text-red-600 focus:bg-red-50 focus:text-red-700 dark:text-red-400 dark:focus:bg-red-950/30 dark:focus:text-red-300 transition-colors duration-200 group text-sm"
         >
           <LogOut className="me-2 size-4 group-hover:text-red-700 dark:group-hover:text-red-300 transition-colors" />
-          <span>{dictionary.navigation.userNav.signOut}</span>
+          <span>{dictionary?.navigation?.userNav?.signOut ?? "Đăng xuất"}</span>
         </DropdownMenuItem>
       </DropdownMenuContent>
     </DropdownMenu>

package/src/utils/index.ts

@@ -432,14 +432,19 @@ export function generateId(prefix?: string): string {
 }
 
 /**
- * Get dictionary value safely
+ * Get dictionary value safely.
+ *
+ * `section` được phép undefined: app mới bắt đầu với `dictionary = {}` (chưa
+ * localize gì) thì `dictionary.navigation` là undefined, và trước đây cả shell
+ * đổ "Cannot read properties of undefined" — hỏng TOÀN BỘ trang chứ không phải
+ * hiện sai một nhãn. Thiếu từ điển thì rơi về chính key.
  */
 export function getDictionaryValue(
   key: string,
-  section: Record<string, unknown>,
+  section: Record<string, unknown> | undefined | null,
   fallback?: string,
 ): string {
-  const value = section[key];
+  const value = section?.[key];
 
   if (typeof value !== "string") {
     if (fallback !== undefined) {
@@ -447,7 +452,7 @@ export function getDictionaryValue(
     }
 
     const normalizedKey = key.replace(/[-_]/g, "");
-    const normalizedValue = section[normalizedKey];
+    const normalizedValue = section?.[normalizedKey];
 
     if (typeof normalizedValue === "string") {
       return normalizedValue;