@imtbl/sdk 2.12.5-alpha.1 → 2.12.5-alpha.11

package/dist/auth_nextjs_server.js

@@ -1 +1,373 @@
-export * from '@imtbl/auth-nextjs/server';
+import { NextResponse } from 'next/server';
+import NextAuthImport from 'next-auth';
+import CredentialsImport from 'next-auth/providers/credentials';
+
+// ../packages/auth-nextjs/dist/node/server/index.js
+function matchPathPrefix(pathname, pattern) {
+  if (pathname === pattern) return true;
+  const prefix = pattern.endsWith("/") ? pattern : `${pattern}/`;
+  return pathname.startsWith(prefix);
+}
+var DEFAULT_AUTH_DOMAIN = "https://auth.immutable.com";
+var IMMUTABLE_PROVIDER_ID = "immutable";
+var TOKEN_EXPIRY_BUFFER_SECONDS = 60;
+var DEFAULT_SESSION_MAX_AGE_SECONDS = 365 * 24 * 60 * 60;
+function isTokenExpired(accessTokenExpires, bufferSeconds = TOKEN_EXPIRY_BUFFER_SECONDS) {
+  if (typeof accessTokenExpires !== "number" || Number.isNaN(accessTokenExpires)) {
+    return true;
+  }
+  return Date.now() >= accessTokenExpires - bufferSeconds * 1e3;
+}
+var Credentials = CredentialsImport.default || CredentialsImport;
+async function validateTokens(accessToken, authDomain) {
+  try {
+    const response = await fetch(`${authDomain}/userinfo`, {
+      method: "GET",
+      headers: {
+        Authorization: `Bearer ${accessToken}`
+      }
+    });
+    if (!response.ok) {
+      console.error("[auth-nextjs] Token validation failed:", response.status, response.statusText);
+      return null;
+    }
+    return await response.json();
+  } catch (error) {
+    console.error("[auth-nextjs] Token validation error:", error);
+    return null;
+  }
+}
+function createAuthConfig(config) {
+  const authDomain = config.authenticationDomain || DEFAULT_AUTH_DOMAIN;
+  return {
+    providers: [
+      Credentials({
+        id: IMMUTABLE_PROVIDER_ID,
+        name: "Immutable",
+        credentials: {
+          tokens: { label: "Tokens", type: "text" }
+        },
+        async authorize(credentials) {
+          if (!credentials?.tokens || typeof credentials.tokens !== "string") {
+            return null;
+          }
+          let tokenData;
+          try {
+            tokenData = JSON.parse(credentials.tokens);
+          } catch (error) {
+            console.error("[auth-nextjs] Failed to parse token data:", error);
+            return null;
+          }
+          if (!tokenData.accessToken || typeof tokenData.accessToken !== "string" || !tokenData.profile || typeof tokenData.profile !== "object" || !tokenData.profile.sub || typeof tokenData.profile.sub !== "string" || typeof tokenData.accessTokenExpires !== "number" || Number.isNaN(tokenData.accessTokenExpires)) {
+            console.error("[auth-nextjs] Invalid token data structure - missing required fields");
+            return null;
+          }
+          const userInfo = await validateTokens(tokenData.accessToken, authDomain);
+          if (!userInfo) {
+            console.error("[auth-nextjs] Token validation failed - rejecting authentication");
+            return null;
+          }
+          if (userInfo.sub !== tokenData.profile.sub) {
+            console.error(
+              "[auth-nextjs] User ID mismatch - userinfo sub:",
+              userInfo.sub,
+              "provided sub:",
+              tokenData.profile.sub
+            );
+            return null;
+          }
+          return {
+            id: userInfo.sub,
+            sub: userInfo.sub,
+            email: userInfo.email ?? tokenData.profile.email,
+            nickname: userInfo.nickname ?? tokenData.profile.nickname,
+            accessToken: tokenData.accessToken,
+            refreshToken: tokenData.refreshToken,
+            idToken: tokenData.idToken,
+            accessTokenExpires: tokenData.accessTokenExpires,
+            zkEvm: tokenData.zkEvm
+          };
+        }
+      })
+    ],
+    callbacks: {
+      // eslint-disable-next-line @typescript-eslint/no-explicit-any
+      async jwt({
+        token,
+        user,
+        trigger,
+        session: sessionUpdate
+      }) {
+        if (user) {
+          return {
+            ...token,
+            sub: user.sub,
+            email: user.email,
+            nickname: user.nickname,
+            accessToken: user.accessToken,
+            refreshToken: user.refreshToken,
+            idToken: user.idToken,
+            accessTokenExpires: user.accessTokenExpires,
+            zkEvm: user.zkEvm
+          };
+        }
+        if (trigger === "update" && sessionUpdate) {
+          const update = sessionUpdate;
+          return {
+            ...token,
+            ...update.accessToken ? { accessToken: update.accessToken } : {},
+            ...update.refreshToken ? { refreshToken: update.refreshToken } : {},
+            ...update.idToken ? { idToken: update.idToken } : {},
+            ...update.accessTokenExpires ? { accessTokenExpires: update.accessTokenExpires } : {},
+            ...update.zkEvm ? { zkEvm: update.zkEvm } : {},
+            // Clear any stale error when valid tokens are synced from client-side
+            error: void 0
+          };
+        }
+        if (!isTokenExpired(token.accessTokenExpires)) {
+          return token;
+        }
+        return {
+          ...token,
+          error: "TokenExpired"
+        };
+      },
+      // eslint-disable-next-line @typescript-eslint/no-explicit-any
+      async session({ session, token }) {
+        return {
+          ...session,
+          user: {
+            ...session.user,
+            sub: token.sub,
+            email: token.email,
+            nickname: token.nickname
+          },
+          accessToken: token.accessToken,
+          refreshToken: token.refreshToken,
+          idToken: token.idToken,
+          accessTokenExpires: token.accessTokenExpires,
+          zkEvm: token.zkEvm,
+          ...token.error && { error: token.error }
+        };
+      }
+    },
+    session: {
+      strategy: "jwt",
+      // Session max age in seconds (365 days default)
+      maxAge: DEFAULT_SESSION_MAX_AGE_SECONDS
+    }
+  };
+}
+var createAuthOptions = createAuthConfig;
+var NextAuth = NextAuthImport.default || NextAuthImport;
+function createImmutableAuth(config, overrides) {
+  const authConfig = createAuthConfig(config);
+  if (!overrides) {
+    return NextAuth(authConfig);
+  }
+  const composedCallbacks = {
+    ...authConfig.callbacks
+  };
+  if (overrides.callbacks) {
+    if (overrides.callbacks.jwt) {
+      const internalJwt = authConfig.callbacks?.jwt;
+      const userJwt = overrides.callbacks.jwt;
+      composedCallbacks.jwt = async (params) => {
+        const token = internalJwt ? await internalJwt(params) : params.token;
+        return userJwt({ ...params, token });
+      };
+    }
+    if (overrides.callbacks.session) {
+      const internalSession = authConfig.callbacks?.session;
+      const userSession = overrides.callbacks.session;
+      composedCallbacks.session = async (params) => {
+        const session = internalSession ? await internalSession(params) : params.session;
+        return userSession({ ...params, session });
+      };
+    }
+    if (overrides.callbacks.signIn) {
+      composedCallbacks.signIn = overrides.callbacks.signIn;
+    }
+    if (overrides.callbacks.redirect) {
+      composedCallbacks.redirect = overrides.callbacks.redirect;
+    }
+    if (overrides.callbacks.authorized) {
+      composedCallbacks.authorized = overrides.callbacks.authorized;
+    }
+  }
+  const mergedSession = overrides.session ? {
+    ...authConfig.session,
+    ...overrides.session,
+    // Always enforce JWT strategy - this is required for token storage/refresh
+    strategy: "jwt"
+  } : authConfig.session;
+  const mergedConfig = {
+    ...authConfig,
+    ...overrides,
+    callbacks: composedCallbacks,
+    session: mergedSession
+  };
+  return NextAuth(mergedConfig);
+}
+async function getAuthProps(auth) {
+  const session = await auth();
+  if (!session) {
+    return { session: null, ssr: false };
+  }
+  if (session.error === "TokenExpired") {
+    return { session: null, ssr: false };
+  }
+  if (session.error) {
+    return { session: null, ssr: false, authError: session.error };
+  }
+  return { session, ssr: true };
+}
+async function getAuthenticatedData(auth, fetcher) {
+  const session = await auth();
+  if (!session) {
+    return { session: null, ssr: false, data: null };
+  }
+  if (session.error === "TokenExpired") {
+    return { session: null, ssr: false, data: null };
+  }
+  if (session.error) {
+    return {
+      session: null,
+      ssr: false,
+      data: null,
+      authError: session.error
+    };
+  }
+  try {
+    const data = await fetcher(session.accessToken);
+    return { session, ssr: true, data };
+  } catch (err) {
+    const errorMessage = err instanceof Error ? err.message : String(err);
+    return {
+      session,
+      ssr: true,
+      data: null,
+      fetchError: errorMessage
+    };
+  }
+}
+async function getValidSession(auth) {
+  const session = await auth();
+  if (!session) {
+    return { status: "unauthenticated", session: null };
+  }
+  if (!session.error) {
+    return { status: "authenticated", session };
+  }
+  if (session.error === "TokenExpired") {
+    return { status: "token_expired", session };
+  }
+  return { status: "error", session, error: session.error };
+}
+function createProtectedDataFetcher(auth, onAuthError) {
+  return async function getProtectedData(fetcher) {
+    const result = await getAuthenticatedData(auth, fetcher);
+    if (result.authError) {
+      onAuthError(result.authError);
+    }
+    const { authError: handledAuthError, ...props } = result;
+    return props;
+  };
+}
+function createProtectedAuthProps(auth, onAuthError) {
+  return async function getProtectedAuth() {
+    const result = await getAuthProps(auth);
+    if (result.authError) {
+      onAuthError(result.authError);
+    }
+    const { authError: handledAuthError, ...props } = result;
+    return props;
+  };
+}
+function createProtectedFetchers(auth, onAuthError) {
+  return {
+    getAuthProps: createProtectedAuthProps(auth, onAuthError),
+    getData: createProtectedDataFetcher(auth, onAuthError)
+  };
+}
+async function withServerAuth(auth, serverRender, options = {}) {
+  const result = await getValidSession(auth);
+  switch (result.status) {
+    case "authenticated":
+      return serverRender(result.session);
+    case "token_expired":
+      if (options.onTokenExpired !== void 0) {
+        return typeof options.onTokenExpired === "function" ? options.onTokenExpired() : options.onTokenExpired;
+      }
+      return serverRender(result.session);
+    case "unauthenticated":
+      if (options.onUnauthenticated !== void 0) {
+        return typeof options.onUnauthenticated === "function" ? options.onUnauthenticated() : options.onUnauthenticated;
+      }
+      throw new Error("Unauthorized: No active session");
+    case "error":
+      if (options.onError !== void 0) {
+        return typeof options.onError === "function" ? options.onError(result.error) : options.onError;
+      }
+      throw new Error(`Unauthorized: ${result.error}`);
+    default:
+      throw new Error("Unknown auth state");
+  }
+}
+function createAuthMiddleware(auth, options = {}) {
+  const { loginUrl = "/login", protectedPaths, publicPaths } = options;
+  return async function middleware(request) {
+    const { pathname } = request.nextUrl;
+    if (publicPaths) {
+      const isPublic = publicPaths.some((pattern) => {
+        if (typeof pattern === "string") {
+          return matchPathPrefix(pathname, pattern);
+        }
+        return pattern.test(pathname);
+      });
+      if (isPublic) {
+        return NextResponse.next();
+      }
+    }
+    if (protectedPaths) {
+      const isProtected = protectedPaths.some((pattern) => {
+        if (typeof pattern === "string") {
+          return matchPathPrefix(pathname, pattern);
+        }
+        return pattern.test(pathname);
+      });
+      if (!isProtected) {
+        return NextResponse.next();
+      }
+    }
+    const session = await auth();
+    if (!session) {
+      const url = new URL(loginUrl, request.url);
+      const returnTo = request.nextUrl.search ? `${pathname}${request.nextUrl.search}` : pathname;
+      url.searchParams.set("returnTo", returnTo);
+      return NextResponse.redirect(url);
+    }
+    if (session.error && session.error !== "TokenExpired") {
+      const url = new URL(loginUrl, request.url);
+      const returnTo = request.nextUrl.search ? `${pathname}${request.nextUrl.search}` : pathname;
+      url.searchParams.set("returnTo", returnTo);
+      url.searchParams.set("error", session.error);
+      return NextResponse.redirect(url);
+    }
+    return NextResponse.next();
+  };
+}
+function withAuth(auth, handler) {
+  return async (...args) => {
+    const session = await auth();
+    if (!session) {
+      throw new Error("Unauthorized: No active session");
+    }
+    if (session.error && session.error !== "TokenExpired") {
+      throw new Error(`Unauthorized: ${session.error}`);
+    }
+    return handler(session, ...args);
+  };
+}
+
+export { createAuthConfig, createAuthMiddleware, createAuthOptions, createImmutableAuth, createProtectedAuthProps, createProtectedDataFetcher, createProtectedFetchers, getAuthProps, getAuthenticatedData, getValidSession, withAuth, withServerAuth };