@infuro/cms-core 1.0.31 → 1.0.33

package/dist/auth.d.cts

@@ -1,6 +1,7 @@
 import { S as SessionUser, E as EntityCrudAction, b as EntityPermissionFlags } from './vendor-scope-DTYhJk_I.cjs';
 export { A as ADMIN_GROUP_NAME, a as AuthHelpers, G as GetSession, O as OPEN_ENDPOINTS, P as PERMISSION_REQUIRED_ENDPOINTS, R as RBAC_ADMIN_ONLY_ENTITIES, V as VENDOR_OWNER_GROUP_NAME, c as VENDOR_SCOPED_STORE_ENTITIES, d as VENDOR_STORE_RBAC_ENTITIES, f as canManageRoles, g as canManageVendorRoles, h as canManageVendorTeam, i as canOnboardVendors, j as createAuthHelpers, k as createCmsAuthBundle, l as getPermissionableEntityKeys, m as getRequiredPermission, n as hasEntityPermission, o as isOpenEndpoint, p as isPlatformAdministrator, q as isPublicMethod, r as isSuperAdminGroupName, s as isVendorGroupName, t as isVendorOwner, u as isVendorPortalUser, v as isVendorStaff, w as permissionRowsToRecord, x as resolveVendorScopeFromSessionUser, y as sessionHasEntityAccess, z as vendorPortalFlagsFromUser } from './vendor-scope-DTYhJk_I.cjs';
 import { DataSource } from 'typeorm';
+import { getToken } from 'next-auth/jwt';
 import { NextAuthOptions } from 'next-auth';
 
 /**
@@ -79,40 +80,45 @@ declare function logEntityAccessDecision(dataSource: RbacDebugDataSource | undef
  */
 declare function seedAdministratorPermissions(dataSource: DataSource, entityMap: Record<string, unknown>): Promise<void>;
 
+interface CmsMiddlewareRequest {
+    nextUrl: {
+        pathname: string;
+    };
+    url: string;
+    method: string;
+    cookies: {
+        get: (name: string) => {
+            value?: string;
+        } | undefined;
+    };
+    /**
+     * Full Next.js request (e.g. `NextRequest`). When provided, session is resolved via
+     * `getToken()` so chunked `next-auth.session-token.N` cookies work.
+     */
+    req?: Parameters<typeof getToken>[0]['req'];
+}
 interface CmsMiddlewareConfig {
     publicAdminPaths?: string[];
     publicApiPaths?: string[];
     /** path -> allowed methods */
     publicApiMethods?: Record<string, string[]>;
     signInPath?: string;
-    getSessionToken?: (request: {
-        cookies: {
-            get: (name: string) => {
-                value?: string;
-            } | undefined;
-        };
-    }) => string | undefined;
+    /** @deprecated Prefer passing `req` on the request; used only when `req` is omitted. */
+    getSessionToken?: (request: CmsMiddlewareRequest) => string | undefined;
+    secret?: string;
 }
 /** Default public API paths (no auth). Sites should extend this with their own routes. */
 declare const defaultPublicApiMethods: Record<string, string[]>;
 /**
  * Returns middleware logic. Use from Next.js middleware:
  *   import { createCmsMiddleware } from '@infuro/cms-core';
- *   export const middleware = createCmsMiddleware({ ... });
+ *   export async function middleware(request: NextRequest) {
+ *     const result = await cmsMiddleware({ ...request fields, req: request });
+ *     ...
+ *   }
  *   export const config = { matcher: ['/admin/:path*', '/api/:path*'] };
  */
-declare function createCmsMiddleware(config?: CmsMiddlewareConfig): (request: {
-    nextUrl: {
-        pathname: string;
-    };
-    url: string;
-    method: string;
-    cookies: {
-        get: (name: string) => {
-            value?: string;
-        } | undefined;
-    };
-}) => {
+declare function createCmsMiddleware(config?: CmsMiddlewareConfig): (request: CmsMiddlewareRequest) => Promise<{
     type: "next";
 } | {
     type: "redirect";
@@ -121,6 +127,15 @@ declare function createCmsMiddleware(config?: CmsMiddlewareConfig): (request: {
     type: "json";
     status: number;
     body: unknown;
-};
+}>;
+
+/** Set `CMS_AUTH_DEBUG=false` to silence server auth logs in development. */
+declare function isAuthDebugEnabled(): boolean;
+/** Browser console logs; set `NEXT_PUBLIC_CMS_AUTH_DEBUG=false` to silence. */
+declare function isAuthDebugClientEnabled(): boolean;
+declare function logAuth(message: string, data?: Record<string, unknown>): void;
+declare function logAuthClient(message: string, data?: Record<string, unknown>): void;
+declare function summarizeSessionUserForLog(user: unknown): Record<string, unknown>;
+declare function nextAuthCookieDebugInfo(): Record<string, unknown>;
 
-export { type AuthorizeOtpInput, type CmsMiddlewareConfig, EntityCrudAction, EntityPermissionFlags, type NextAuthOptionsConfig, type NextAuthUser, SessionUser, createCmsMiddleware, defaultPublicApiMethods, explainSessionEntityAccess, getNextAuthOptions, isRbacDebugEnabled, logEntityAccessDecision, logRbac, seedAdministratorPermissions, summarizeEntityPerms };
+export { type AuthorizeOtpInput, type CmsMiddlewareConfig, type CmsMiddlewareRequest, EntityCrudAction, EntityPermissionFlags, type NextAuthOptionsConfig, type NextAuthUser, SessionUser, createCmsMiddleware, defaultPublicApiMethods, explainSessionEntityAccess, getNextAuthOptions, isAuthDebugClientEnabled, isAuthDebugEnabled, isRbacDebugEnabled, logAuth, logAuthClient, logEntityAccessDecision, logRbac, nextAuthCookieDebugInfo, seedAdministratorPermissions, summarizeEntityPerms, summarizeSessionUserForLog };

package/dist/auth.d.ts

@@ -1,6 +1,7 @@
 import { S as SessionUser, E as EntityCrudAction, b as EntityPermissionFlags } from './vendor-scope-DTYhJk_I.js';
 export { A as ADMIN_GROUP_NAME, a as AuthHelpers, G as GetSession, O as OPEN_ENDPOINTS, P as PERMISSION_REQUIRED_ENDPOINTS, R as RBAC_ADMIN_ONLY_ENTITIES, V as VENDOR_OWNER_GROUP_NAME, c as VENDOR_SCOPED_STORE_ENTITIES, d as VENDOR_STORE_RBAC_ENTITIES, f as canManageRoles, g as canManageVendorRoles, h as canManageVendorTeam, i as canOnboardVendors, j as createAuthHelpers, k as createCmsAuthBundle, l as getPermissionableEntityKeys, m as getRequiredPermission, n as hasEntityPermission, o as isOpenEndpoint, p as isPlatformAdministrator, q as isPublicMethod, r as isSuperAdminGroupName, s as isVendorGroupName, t as isVendorOwner, u as isVendorPortalUser, v as isVendorStaff, w as permissionRowsToRecord, x as resolveVendorScopeFromSessionUser, y as sessionHasEntityAccess, z as vendorPortalFlagsFromUser } from './vendor-scope-DTYhJk_I.js';
 import { DataSource } from 'typeorm';
+import { getToken } from 'next-auth/jwt';
 import { NextAuthOptions } from 'next-auth';
 
 /**
@@ -79,40 +80,45 @@ declare function logEntityAccessDecision(dataSource: RbacDebugDataSource | undef
  */
 declare function seedAdministratorPermissions(dataSource: DataSource, entityMap: Record<string, unknown>): Promise<void>;
 
+interface CmsMiddlewareRequest {
+    nextUrl: {
+        pathname: string;
+    };
+    url: string;
+    method: string;
+    cookies: {
+        get: (name: string) => {
+            value?: string;
+        } | undefined;
+    };
+    /**
+     * Full Next.js request (e.g. `NextRequest`). When provided, session is resolved via
+     * `getToken()` so chunked `next-auth.session-token.N` cookies work.
+     */
+    req?: Parameters<typeof getToken>[0]['req'];
+}
 interface CmsMiddlewareConfig {
     publicAdminPaths?: string[];
     publicApiPaths?: string[];
     /** path -> allowed methods */
     publicApiMethods?: Record<string, string[]>;
     signInPath?: string;
-    getSessionToken?: (request: {
-        cookies: {
-            get: (name: string) => {
-                value?: string;
-            } | undefined;
-        };
-    }) => string | undefined;
+    /** @deprecated Prefer passing `req` on the request; used only when `req` is omitted. */
+    getSessionToken?: (request: CmsMiddlewareRequest) => string | undefined;
+    secret?: string;
 }
 /** Default public API paths (no auth). Sites should extend this with their own routes. */
 declare const defaultPublicApiMethods: Record<string, string[]>;
 /**
  * Returns middleware logic. Use from Next.js middleware:
  *   import { createCmsMiddleware } from '@infuro/cms-core';
- *   export const middleware = createCmsMiddleware({ ... });
+ *   export async function middleware(request: NextRequest) {
+ *     const result = await cmsMiddleware({ ...request fields, req: request });
+ *     ...
+ *   }
  *   export const config = { matcher: ['/admin/:path*', '/api/:path*'] };
  */
-declare function createCmsMiddleware(config?: CmsMiddlewareConfig): (request: {
-    nextUrl: {
-        pathname: string;
-    };
-    url: string;
-    method: string;
-    cookies: {
-        get: (name: string) => {
-            value?: string;
-        } | undefined;
-    };
-}) => {
+declare function createCmsMiddleware(config?: CmsMiddlewareConfig): (request: CmsMiddlewareRequest) => Promise<{
     type: "next";
 } | {
     type: "redirect";
@@ -121,6 +127,15 @@ declare function createCmsMiddleware(config?: CmsMiddlewareConfig): (request: {
     type: "json";
     status: number;
     body: unknown;
-};
+}>;
+
+/** Set `CMS_AUTH_DEBUG=false` to silence server auth logs in development. */
+declare function isAuthDebugEnabled(): boolean;
+/** Browser console logs; set `NEXT_PUBLIC_CMS_AUTH_DEBUG=false` to silence. */
+declare function isAuthDebugClientEnabled(): boolean;
+declare function logAuth(message: string, data?: Record<string, unknown>): void;
+declare function logAuthClient(message: string, data?: Record<string, unknown>): void;
+declare function summarizeSessionUserForLog(user: unknown): Record<string, unknown>;
+declare function nextAuthCookieDebugInfo(): Record<string, unknown>;
 
-export { type AuthorizeOtpInput, type CmsMiddlewareConfig, EntityCrudAction, EntityPermissionFlags, type NextAuthOptionsConfig, type NextAuthUser, SessionUser, createCmsMiddleware, defaultPublicApiMethods, explainSessionEntityAccess, getNextAuthOptions, isRbacDebugEnabled, logEntityAccessDecision, logRbac, seedAdministratorPermissions, summarizeEntityPerms };
+export { type AuthorizeOtpInput, type CmsMiddlewareConfig, type CmsMiddlewareRequest, EntityCrudAction, EntityPermissionFlags, type NextAuthOptionsConfig, type NextAuthUser, SessionUser, createCmsMiddleware, defaultPublicApiMethods, explainSessionEntityAccess, getNextAuthOptions, isAuthDebugClientEnabled, isAuthDebugEnabled, isRbacDebugEnabled, logAuth, logAuthClient, logEntityAccessDecision, logRbac, nextAuthCookieDebugInfo, seedAdministratorPermissions, summarizeEntityPerms, summarizeSessionUserForLog };

package/dist/auth.js

@@ -491,6 +491,59 @@ async function seedAdministratorPermissions(dataSource, entityMap) {
   }
 }
 
+// src/auth/middleware.ts
+import { getToken } from "next-auth/jwt";
+
+// src/auth/auth-debug.ts
+var LOG_PREFIX2 = "[cms-auth]";
+function isAuthDebugEnabled() {
+  const v = process.env.CMS_AUTH_DEBUG?.trim().toLowerCase();
+  if (v === "1" || v === "true" || v === "yes") return true;
+  if (v === "0" || v === "false" || v === "no") return false;
+  return process.env.NODE_ENV === "development";
+}
+function isAuthDebugClientEnabled() {
+  if (typeof window === "undefined") return false;
+  const v = process.env.NEXT_PUBLIC_CMS_AUTH_DEBUG?.trim().toLowerCase();
+  if (v === "1" || v === "true" || v === "yes") return true;
+  if (v === "0" || v === "false" || v === "no") return false;
+  return process.env.NODE_ENV === "development";
+}
+function logAuth(message, data) {
+  if (!isAuthDebugEnabled()) return;
+  if (data) console.info(LOG_PREFIX2, message, data);
+  else console.info(LOG_PREFIX2, message);
+}
+function logAuthClient(message, data) {
+  if (!isAuthDebugClientEnabled()) return;
+  if (data) console.info(LOG_PREFIX2, message, data);
+  else console.info(LOG_PREFIX2, message);
+}
+function summarizeSessionUserForLog(user) {
+  if (!user || typeof user !== "object") return { present: false };
+  const u = user;
+  return {
+    present: true,
+    email: u.email ?? null,
+    id: u.id ?? null,
+    adminAccess: u.adminAccess ?? null,
+    isRBACAdmin: u.isRBACAdmin ?? null,
+    isVendorPortal: u.isVendorPortal ?? null,
+    groupName: u.groupName ?? null
+  };
+}
+function nextAuthCookieDebugInfo() {
+  const nextAuthUrl = process.env.NEXTAUTH_URL ?? "(unset)";
+  const isHttps = nextAuthUrl.startsWith("https");
+  return {
+    nextAuthUrl,
+    hasSecret: Boolean(process.env.NEXTAUTH_SECRET),
+    cookieName: isHttps ? "__Secure-next-auth.session-token" : "next-auth.session-token",
+    cookieSecure: isHttps,
+    nodeEnv: process.env.NODE_ENV ?? "(unset)"
+  };
+}
+
 // src/auth/middleware.ts
 var defaultPublicApiMethods = {
   "/api/contacts": ["POST"],
@@ -503,8 +556,21 @@ var defaultPublicApiMethods = {
   "/api/users/set-password": ["POST"],
   "/api/users/invite": ["POST"]
 };
-function defaultGetSessionToken(request) {
-  return request.cookies.get("__Secure-next-auth.session-token")?.value ?? request.cookies.get("next-auth.session-token")?.value;
+function legacyGetSessionToken(request) {
+  const secure = request.cookies.get("__Secure-next-auth.session-token")?.value;
+  const regular = request.cookies.get("next-auth.session-token")?.value;
+  return secure ?? regular;
+}
+function sessionCookiePresence(request) {
+  const secure = request.cookies.get("__Secure-next-auth.session-token")?.value;
+  const regular = request.cookies.get("next-auth.session-token")?.value;
+  const hasChunked = Boolean(request.cookies.get("next-auth.session-token.0")?.value) || Boolean(request.cookies.get("__Secure-next-auth.session-token.0")?.value);
+  return {
+    hasSecureToken: Boolean(secure),
+    hasRegularToken: Boolean(regular),
+    hasChunkedToken: hasChunked,
+    resolved: Boolean(secure ?? regular)
+  };
 }
 function isPublicMethod2(pathname, method, publicApiMethods) {
   for (const [endpoint, methods] of Object.entries(publicApiMethods)) {
@@ -512,31 +578,59 @@ function isPublicMethod2(pathname, method, publicApiMethods) {
   }
   return false;
 }
+async function hasValidSession(request, secret, legacyGetToken) {
+  if (request.req) {
+    const token = await getToken({ req: request.req, secret });
+    return token != null;
+  }
+  return Boolean(legacyGetToken(request));
+}
 function createCmsMiddleware(config = {}) {
   const {
     publicAdminPaths = ["/admin/signin", "/admin/forgot-password", "/admin/reset-password", "/admin/invite"],
     publicApiMethods = defaultPublicApiMethods,
     signInPath = "/admin/signin",
-    getSessionToken = defaultGetSessionToken
+    getSessionToken = legacyGetSessionToken,
+    secret = process.env.NEXTAUTH_SECRET
   } = config;
-  return function cmsMiddleware(request) {
+  return async function cmsMiddleware(request) {
     const pathname = request.nextUrl.pathname;
     const method = request.method;
     if (publicAdminPaths.some((p) => pathname === p || pathname.startsWith(p + "/"))) {
       return { type: "next" };
     }
     if (pathname.startsWith("/admin")) {
-      const token = getSessionToken(request);
-      if (!token) {
+      const authenticated = await hasValidSession(request, secret, getSessionToken);
+      const cookies = sessionCookiePresence(request);
+      if (!authenticated) {
+        logAuth("middleware: admin redirect to signin (no session)", {
+          pathname,
+          method,
+          usesGetToken: Boolean(request.req),
+          ...cookies,
+          expectedCookieName: process.env.NEXTAUTH_URL?.startsWith("https") ? "__Secure-next-auth.session-token" : "next-auth.session-token"
+        });
         return { type: "redirect", url: new URL(signInPath, request.url).toString() };
       }
+      logAuth("middleware: admin allowed", {
+        pathname,
+        method,
+        usesGetToken: Boolean(request.req),
+        ...cookies
+      });
     }
     if (pathname.startsWith("/api")) {
       if (isPublicMethod2(pathname, method, publicApiMethods)) {
         return { type: "next" };
       }
-      const token = getSessionToken(request);
-      if (!token) {
+      const authenticated = await hasValidSession(request, secret, getSessionToken);
+      if (!authenticated) {
+        logAuth("middleware: api 401 (no session)", {
+          pathname,
+          method,
+          usesGetToken: Boolean(request.req),
+          ...sessionCookiePresence(request)
+        });
         return { type: "json", status: 401, body: { error: "Unauthorized" } };
       }
     }
@@ -591,6 +685,7 @@ function getNextAuthOptions(config) {
     enableOtpLogin = false,
     authorizeOtp
   } = config;
+  logAuth("getNextAuthOptions init", nextAuthCookieDebugInfo());
   const providers = [];
   if (enablePasswordLogin) {
     providers.push(
@@ -601,15 +696,43 @@ function getNextAuthOptions(config) {
           password: { label: "Password", type: "password" }
         },
         async authorize(credentials) {
-          if (!credentials?.email || !credentials?.password) return null;
+          const email = credentials?.email?.trim() ?? "";
+          if (!email || !credentials?.password) {
+            logAuth("authorize(credentials) rejected", { reason: "missing_email_or_password" });
+            return null;
+          }
           try {
-            const user = await getUserByEmail(credentials.email);
-            if (!user || user.blocked || user.deleted || !user.password) return null;
+            const user = await getUserByEmail(email);
+            if (!user) {
+              logAuth("authorize(credentials) rejected", { reason: "user_not_found", email });
+              return null;
+            }
+            if (user.blocked) {
+              logAuth("authorize(credentials) rejected", { reason: "blocked", email, userId: user.id });
+              return null;
+            }
+            if (user.deleted) {
+              logAuth("authorize(credentials) rejected", { reason: "deleted", email, userId: user.id });
+              return null;
+            }
+            if (!user.password) {
+              logAuth("authorize(credentials) rejected", { reason: "no_password", email, userId: user.id });
+              return null;
+            }
             const valid = await comparePassword(credentials.password, user.password);
-            if (!valid) return null;
-            return sessionUserFromNextAuthUser(user);
+            if (!valid) {
+              logAuth("authorize(credentials) rejected", { reason: "invalid_password", email, userId: user.id });
+              return null;
+            }
+            const sessionUser = sessionUserFromNextAuthUser(user);
+            logAuth("authorize(credentials) ok", summarizeSessionUserForLog(sessionUser));
+            return sessionUser;
           } catch (err) {
             console.error("[cms-auth] authorize error (credentials):", err instanceof Error ? err.message : err);
+            logAuth("authorize(credentials) error", {
+              email,
+              message: err instanceof Error ? err.message : String(err)
+            });
             return null;
           }
         }
@@ -662,6 +785,10 @@ function getNextAuthOptions(config) {
     callbacks: {
       async jwt({ token, user, trigger, session }) {
         if (user) {
+          logAuth("jwt callback: new sign-in", {
+            trigger,
+            user: summarizeSessionUserForLog(user)
+          });
           const u = user;
           token.id = u.id;
           token.groupId = u.groupId;
@@ -676,6 +803,7 @@ function getNextAuthOptions(config) {
           token.isVendorOwner = u.isVendorOwner;
         }
         if (trigger === "update" && session && typeof session === "object") {
+          logAuth("jwt callback: session update", { trigger });
           const s = session;
           const t = token;
           if (typeof s.name === "string") t.name = s.name;
@@ -685,8 +813,13 @@ function getNextAuthOptions(config) {
         return token;
       },
       async session({ session, token }) {
+        const t = token;
+        logAuth("session callback", {
+          tokenHasId: t.id != null,
+          tokenEmail: typeof t.email === "string" ? t.email : null,
+          sessionUser: summarizeSessionUserForLog(session.user)
+        });
         if (session.user) {
-          const t = token;
           if (typeof t.name === "string") session.user.name = t.name;
           if (typeof t.email === "string") session.user.email = t.email;
           session.user.id = t.id;
@@ -728,6 +861,8 @@ export {
   getPermissionableEntityKeys,
   getRequiredPermission,
   hasEntityPermission,
+  isAuthDebugClientEnabled,
+  isAuthDebugEnabled,
   isOpenEndpoint,
   isPlatformAdministrator,
   isPublicMethod,
@@ -737,13 +872,17 @@ export {
   isVendorOwner,
   isVendorPortalUser,
   isVendorStaff,
+  logAuth,
+  logAuthClient,
   logEntityAccessDecision,
   logRbac,
+  nextAuthCookieDebugInfo,
   permissionRowsToRecord,
   resolveVendorScopeFromSessionUser,
   seedAdministratorPermissions,
   sessionHasEntityAccess,
   summarizeEntityPerms,
+  summarizeSessionUserForLog,
   vendorPortalFlagsFromUser
 };
 //# sourceMappingURL=auth.js.map