@infuro/cms-core 1.0.47 → 1.0.50

package/dist/{chunk-Q3HQEM4R.cjs → chunk-YV5PK4JW.cjs}

@@ -1,13 +1,17 @@
 'use strict';
 
+var chunk3EOM4V2M_cjs = require('./chunk-3EOM4V2M.cjs');
+var chunkOY2YTBMP_cjs = require('./chunk-OY2YTBMP.cjs');
 var chunk77NUXO6A_cjs = require('./chunk-77NUXO6A.cjs');
 var chunkUSNT2KNT_cjs = require('./chunk-USNT2KNT.cjs');
 var jwt = require('next-auth/jwt');
 var _CredentialsProvider = require('next-auth/providers/credentials');
+var _GoogleProvider = require('next-auth/providers/google');
 
 function _interopDefault (e) { return e && e.__esModule ? e : { default: e }; }
 
 var _CredentialsProvider__default = /*#__PURE__*/_interopDefault(_CredentialsProvider);
+var _GoogleProvider__default = /*#__PURE__*/_interopDefault(_GoogleProvider);
 
 // src/auth/seed-permissions.ts
 async function seedAdministratorPermissions(dataSource, entityMap) {
@@ -135,6 +139,10 @@ var defaultPublicApiMethods = {
   "/api/users/invite": [
     "GET",
     "POST"
+  ],
+  /** Public keys only (e.g. googleEnabled); secrets stay private in the settings handler. */
+  "/api/settings/auth_providers": [
+    "GET"
   ]
 };
 function legacyGetSessionToken(request) {
@@ -240,7 +248,281 @@ function createCmsMiddleware(config = {}) {
   }, "cmsMiddleware");
 }
 chunkUSNT2KNT_cjs.__name(createCmsMiddleware, "createCmsMiddleware");
+
+// src/auth/auth-providers-settings.ts
+var AUTH_PROVIDERS_SETTINGS_GROUP = "auth_providers";
+function parseEnabled(raw) {
+  if (typeof raw === "boolean") return raw;
+  if (typeof raw === "number") return raw !== 0;
+  if (typeof raw === "string") {
+    const n = raw.trim().toLowerCase();
+    return n === "true" || n === "1" || n === "yes" || n === "on";
+  }
+  return false;
+}
+chunkUSNT2KNT_cjs.__name(parseEnabled, "parseEnabled");
+function resolveSettingsEncryptionKey() {
+  if (typeof process === "undefined") return void 0;
+  return process.env.SETTINGS_ENCRYPTION_KEY?.trim() || process.env.NEXTAUTH_SECRET?.trim() || void 0;
+}
+chunkUSNT2KNT_cjs.__name(resolveSettingsEncryptionKey, "resolveSettingsEncryptionKey");
+function decryptSettingValue(encoded, key) {
+  const buf = Buffer.from(encoded, "base64");
+  const keyBuf = Buffer.from(key.padEnd(32, "0").slice(0, 32), "utf8");
+  const out = Buffer.alloc(buf.length);
+  for (let i = 0; i < buf.length; i++) out[i] = buf[i] ^ keyBuf[i % keyBuf.length];
+  return out.toString("utf8");
+}
+chunkUSNT2KNT_cjs.__name(decryptSettingValue, "decryptSettingValue");
+async function loadAuthProvidersSettingsFromDb(dataSource, entityMap, encryptionKey) {
+  if (!entityMap.configs) return {};
+  const key = encryptionKey ?? resolveSettingsEncryptionKey();
+  const rows = await dataSource.getRepository(entityMap.configs).find({
+    where: {
+      settings: AUTH_PROVIDERS_SETTINGS_GROUP,
+      deleted: false
+    }
+  });
+  const out = {};
+  for (const row of rows) {
+    let val = row.value;
+    if (row.encrypted && key) {
+      try {
+        val = decryptSettingValue(val, key);
+      } catch {
+      }
+    }
+    out[row.key] = val;
+  }
+  return out;
+}
+chunkUSNT2KNT_cjs.__name(loadAuthProvidersSettingsFromDb, "loadAuthProvidersSettingsFromDb");
+function fromSettingsMap(map) {
+  const clientId = String(map.googleClientId ?? map.GOOGLE_CLIENT_ID ?? "").trim();
+  const clientSecret = String(map.googleClientSecret ?? map.GOOGLE_CLIENT_SECRET ?? "").trim();
+  const enabledFlag = map.googleEnabled !== void 0 && map.googleEnabled !== "" ? parseEnabled(map.googleEnabled) : parseEnabled(map.enabled);
+  if (!enabledFlag || !clientId || !clientSecret) return null;
+  return {
+    enabled: true,
+    clientId,
+    clientSecret
+  };
+}
+chunkUSNT2KNT_cjs.__name(fromSettingsMap, "fromSettingsMap");
+function fromEnv() {
+  const env = typeof process !== "undefined" ? process.env : void 0;
+  if (!env) return null;
+  const clientId = String(env.GOOGLE_CLIENT_ID ?? "").trim();
+  const clientSecret = String(env.GOOGLE_CLIENT_SECRET ?? "").trim();
+  const enabledRaw = env.GOOGLE_AUTH_ENABLED;
+  const enabled = enabledRaw === void 0 || enabledRaw === "" ? Boolean(clientId && clientSecret) : parseEnabled(enabledRaw);
+  if (!enabled || !clientId || !clientSecret) return null;
+  return {
+    enabled: true,
+    clientId,
+    clientSecret
+  };
+}
+chunkUSNT2KNT_cjs.__name(fromEnv, "fromEnv");
+async function resolveGoogleAuthConfig(input = {}) {
+  if (input.settings) {
+    const fromExplicit = fromSettingsMap(input.settings);
+    if (fromExplicit?.enabled) {
+      logAuth("resolveGoogleAuthConfig: from explicit settings", {
+        enabled: true
+      });
+      return fromExplicit;
+    }
+  }
+  if (input.dataSource && input.entityMap?.configs) {
+    try {
+      const map = await loadAuthProvidersSettingsFromDb(input.dataSource, input.entityMap, input.encryptionKey);
+      const fromDb = fromSettingsMap(map);
+      if (fromDb?.enabled) {
+        logAuth("resolveGoogleAuthConfig: from DB settings", {
+          enabled: true
+        });
+        return fromDb;
+      }
+      if (map.googleEnabled !== void 0 || map.googleClientId !== void 0) {
+        logAuth("resolveGoogleAuthConfig: DB present but incomplete/disabled", {
+          googleEnabled: map.googleEnabled ?? null,
+          hasClientId: Boolean(String(map.googleClientId ?? "").trim()),
+          hasClientSecret: Boolean(String(map.googleClientSecret ?? "").trim())
+        });
+      }
+    } catch (err) {
+      logAuth("resolveGoogleAuthConfig: DB load failed", {
+        message: err instanceof Error ? err.message : String(err)
+      });
+    }
+  }
+  if (!input.skipEnvFallback) {
+    const envCfg = fromEnv();
+    if (envCfg) {
+      logAuth("resolveGoogleAuthConfig: from env", {
+        enabled: true
+      });
+      return envCfg;
+    }
+  }
+  return null;
+}
+chunkUSNT2KNT_cjs.__name(resolveGoogleAuthConfig, "resolveGoogleAuthConfig");
+function googleOAuthRedirectUri(baseUrl) {
+  const base = (baseUrl ?? process.env.NEXTAUTH_URL ?? "").replace(/\/$/, "");
+  return base ? `${base}/api/auth/callback/google` : "/api/auth/callback/google";
+}
+chunkUSNT2KNT_cjs.__name(googleOAuthRedirectUri, "googleOAuthRedirectUri");
+function isGoogleAuthPubliclyEnabled(settings) {
+  if (!settings) return false;
+  if (settings.googleEnabled !== void 0 && settings.googleEnabled !== "") {
+    return parseEnabled(settings.googleEnabled);
+  }
+  return parseEnabled(settings.enabled);
+}
+chunkUSNT2KNT_cjs.__name(isGoogleAuthPubliclyEnabled, "isGoogleAuthPubliclyEnabled");
+
+// src/auth/create-google-customer.ts
+function normalizeEmail(email) {
+  return email.trim().toLowerCase();
+}
+chunkUSNT2KNT_cjs.__name(normalizeEmail, "normalizeEmail");
+async function createCustomerUserFromGoogleOAuth(input) {
+  const email = normalizeEmail(input.email);
+  if (!email || !input.entityMap.users || !input.entityMap.user_groups) {
+    logAuth("createCustomerUserFromGoogleOAuth skipped", {
+      reason: "missing_email_or_entities",
+      hasUsers: Boolean(input.entityMap.users),
+      hasGroups: Boolean(input.entityMap.user_groups)
+    });
+    return null;
+  }
+  const userRepo = input.dataSource.getRepository(input.entityMap.users);
+  const groupRepo = input.dataSource.getRepository(input.entityMap.user_groups);
+  try {
+    await chunkOY2YTBMP_cjs.retireSoftDeletedUniqueValue(userRepo, "email", email);
+  } catch {
+  }
+  const existing = await userRepo.findOne({
+    where: {
+      email,
+      deleted: false
+    },
+    relations: [
+      "group",
+      "group.permissions"
+    ]
+  });
+  if (existing) {
+    return existing;
+  }
+  const customerG = await groupRepo.findOne({
+    where: {
+      name: "Customer",
+      deleted: false
+    }
+  });
+  const groupId = customerG ? Number(customerG.id) : null;
+  if (!Number.isFinite(groupId) || groupId == null) {
+    logAuth("createCustomerUserFromGoogleOAuth failed", {
+      reason: "customer_group_missing",
+      email
+    });
+    return null;
+  }
+  const displayName = typeof input.name === "string" && input.name.trim() || email.split("@")[0] || "Customer";
+  try {
+    const created = await userRepo.save(userRepo.create({
+      name: displayName,
+      email,
+      password: null,
+      blocked: false,
+      adminAccess: false,
+      groupId,
+      inviteStatus: "active",
+      inviteToken: null,
+      emailVerifiedAt: /* @__PURE__ */ new Date()
+    }));
+    const userId = Number(created.id);
+    if (!Number.isFinite(userId)) {
+      logAuth("createCustomerUserFromGoogleOAuth failed", {
+        reason: "invalid_id",
+        email
+      });
+      return null;
+    }
+    if (input.entityMap.contacts) {
+      try {
+        await chunk3EOM4V2M_cjs.linkUnclaimedContactToUser(input.dataSource, input.entityMap.contacts, userId, email);
+      } catch {
+      }
+    }
+    if (input.entityMap.customer) {
+      try {
+        await chunk3EOM4V2M_cjs.ensureCustomerForUser(input.dataSource, input.entityMap.customer, {
+          id: userId,
+          name: displayName,
+          email,
+          phone: null
+        }, {
+          phone: null
+        });
+      } catch {
+      }
+    }
+    const loaded = await userRepo.findOne({
+      where: {
+        id: userId
+      },
+      relations: [
+        "group",
+        "group.permissions"
+      ]
+    });
+    if (!loaded) {
+      logAuth("createCustomerUserFromGoogleOAuth failed", {
+        reason: "reload_failed",
+        email,
+        userId
+      });
+      return null;
+    }
+    logAuth("createCustomerUserFromGoogleOAuth ok", {
+      email,
+      userId
+    });
+    return loaded;
+  } catch (err) {
+    const raced = await userRepo.findOne({
+      where: {
+        email,
+        deleted: false
+      },
+      relations: [
+        "group",
+        "group.permissions"
+      ]
+    });
+    if (raced) {
+      logAuth("createCustomerUserFromGoogleOAuth raced_to_existing", {
+        email,
+        userId: raced.id
+      });
+      return raced;
+    }
+    logAuth("createCustomerUserFromGoogleOAuth error", {
+      email,
+      message: err instanceof Error ? err.message : String(err)
+    });
+    return null;
+  }
+}
+chunkUSNT2KNT_cjs.__name(createCustomerUserFromGoogleOAuth, "createCustomerUserFromGoogleOAuth");
+
+// src/auth/nextauth-options.ts
 var CredentialsProvider = _CredentialsProvider__default.default.default ?? _CredentialsProvider__default.default;
+var GoogleProvider = _GoogleProvider__default.default.default ?? _GoogleProvider__default.default;
 function parseBooleanSetting(value) {
   if (typeof value === "boolean") return value;
   if (typeof value === "number") return value !== 0;
@@ -362,8 +644,12 @@ function permitsCustomerLogin(allowCustomerLogin, credentials) {
   return !callbackUrlTargetsAdmin(callbackUrl);
 }
 chunkUSNT2KNT_cjs.__name(permitsCustomerLogin, "permitsCustomerLogin");
+function applySessionUserToAuthUser(target, sessionUser) {
+  Object.assign(target, sessionUser);
+}
+chunkUSNT2KNT_cjs.__name(applySessionUserToAuthUser, "applySessionUserToAuthUser");
 function getNextAuthOptions(config) {
-  const { getUserByEmail, comparePassword, signInPage = "/admin/signin", secret, extend, enablePasswordLogin = true, enableOtpLogin = false, authorizeOtp, allowCustomerLogin } = config;
+  const { getUserByEmail, comparePassword, signInPage = "/admin/signin", secret, extend, enablePasswordLogin = true, enableOtpLogin = false, authorizeOtp, allowCustomerLogin, google, createCustomerUserFromGoogle } = config;
   logAuth("getNextAuthOptions init", nextAuthCookieDebugInfo());
   const providers = [];
   if (enablePasswordLogin) {
@@ -519,6 +805,14 @@ function getNextAuthOptions(config) {
       }
     }));
   }
+  if (google?.enabled && google.clientId && google.clientSecret) {
+    providers.push(GoogleProvider({
+      clientId: google.clientId,
+      clientSecret: google.clientSecret,
+      allowDangerousEmailAccountLinking: true
+    }));
+    logAuth("getNextAuthOptions: GoogleProvider registered");
+  }
   const options = {
     secret: secret ?? process.env.NEXTAUTH_SECRET,
     providers,
@@ -540,6 +834,94 @@ function getNextAuthOptions(config) {
       }
     },
     callbacks: {
+      async signIn({ user, account, profile }) {
+        if (account?.provider !== "google") return true;
+        const emailRaw = typeof user?.email === "string" && user.email || (profile && typeof profile.email === "string" ? profile.email : "");
+        const email = emailRaw.trim().toLowerCase();
+        if (!email) {
+          logAuth("signIn(google) rejected", {
+            reason: "missing_email"
+          });
+          return false;
+        }
+        try {
+          let dbUser = await getUserByEmail(email);
+          if (!dbUser && allowCustomerLogin === true && createCustomerUserFromGoogle) {
+            const profileName = typeof user?.name === "string" && user.name || (profile && typeof profile.name === "string" ? profile.name : null);
+            dbUser = await createCustomerUserFromGoogle({
+              email,
+              name: profileName
+            });
+            if (dbUser) {
+              logAuth("signIn(google) created customer", {
+                email,
+                userId: dbUser.id
+              });
+            }
+          }
+          if (!dbUser) {
+            logAuth("signIn(google) rejected", {
+              reason: "user_not_found",
+              email
+            });
+            return false;
+          }
+          if (dbUser.blocked) {
+            logAuth("signIn(google) rejected", {
+              reason: "blocked",
+              email,
+              userId: dbUser.id
+            });
+            return false;
+          }
+          if (dbUser.inviteStatus === "pending") {
+            logAuth("signIn(google) rejected", {
+              reason: "invite_pending",
+              email,
+              userId: dbUser.id
+            });
+            return false;
+          }
+          if (dbUser.deleted) {
+            logAuth("signIn(google) rejected", {
+              reason: "deleted",
+              email,
+              userId: dbUser.id
+            });
+            return false;
+          }
+          if (isCustomerGroupUser(dbUser) && allowCustomerLogin !== true) {
+            logAuth("signIn(google) rejected", {
+              reason: "customer_group",
+              email,
+              userId: dbUser.id
+            });
+            return false;
+          }
+          const sessionUser = sessionUserFromNextAuthUser(dbUser);
+          if (sessionUser.isVendorPortal && !sessionUser.isRBACAdmin) {
+            const multiVendorEnabled = await checkMultiVendorEnabledViaSettingsApi();
+            if (!multiVendorEnabled) {
+              logAuth("signIn(google) rejected", {
+                reason: "multi_vendor_disabled",
+                email,
+                userId: dbUser.id
+              });
+              return false;
+            }
+          }
+          applySessionUserToAuthUser(user, sessionUser);
+          logAuth("signIn(google) ok", summarizeSessionUserForLog(sessionUser));
+          return true;
+        } catch (err) {
+          console.error("[cms-auth] signIn error (google):", err instanceof Error ? err.message : err);
+          logAuth("signIn(google) error", {
+            email,
+            message: err instanceof Error ? err.message : String(err)
+          });
+          return false;
+        }
+      },
       async jwt({ token, user, trigger, session }) {
         if (user) {
           logAuth("jwt callback: new sign-in", {
@@ -608,6 +990,30 @@ function getNextAuthOptions(config) {
   return extend ? extend(options) : options;
 }
 chunkUSNT2KNT_cjs.__name(getNextAuthOptions, "getNextAuthOptions");
+async function buildNextAuthOptions(config) {
+  const { dataSource, entityMap, settingsEncryptionKey, googleResolve, google, createCustomerUserFromGoogle, ...rest } = config;
+  const resolved = google ?? await resolveGoogleAuthConfig({
+    dataSource,
+    entityMap,
+    encryptionKey: settingsEncryptionKey,
+    ...googleResolve
+  });
+  let createCustomer = createCustomerUserFromGoogle;
+  if (!createCustomer && rest.allowCustomerLogin === true && dataSource && entityMap && entityMap.users && entityMap.user_groups) {
+    createCustomer = /* @__PURE__ */ chunkUSNT2KNT_cjs.__name((input) => createCustomerUserFromGoogleOAuth({
+      dataSource,
+      entityMap,
+      email: input.email,
+      name: input.name
+    }), "createCustomer");
+  }
+  return getNextAuthOptions({
+    ...rest,
+    google: resolved,
+    createCustomerUserFromGoogle: createCustomer
+  });
+}
+chunkUSNT2KNT_cjs.__name(buildNextAuthOptions, "buildNextAuthOptions");
 function getStorefrontNextAuthOptions(config) {
   return getNextAuthOptions({
     ...config,
@@ -615,15 +1021,29 @@ function getStorefrontNextAuthOptions(config) {
   });
 }
 chunkUSNT2KNT_cjs.__name(getStorefrontNextAuthOptions, "getStorefrontNextAuthOptions");
+async function buildStorefrontNextAuthOptions(config) {
+  return buildNextAuthOptions({
+    ...config,
+    allowCustomerLogin: true
+  });
+}
+chunkUSNT2KNT_cjs.__name(buildStorefrontNextAuthOptions, "buildStorefrontNextAuthOptions");
 
+exports.AUTH_PROVIDERS_SETTINGS_GROUP = AUTH_PROVIDERS_SETTINGS_GROUP;
+exports.buildNextAuthOptions = buildNextAuthOptions;
+exports.buildStorefrontNextAuthOptions = buildStorefrontNextAuthOptions;
 exports.createCmsMiddleware = createCmsMiddleware;
+exports.createCustomerUserFromGoogleOAuth = createCustomerUserFromGoogleOAuth;
 exports.defaultPublicApiMethods = defaultPublicApiMethods;
 exports.getNextAuthOptions = getNextAuthOptions;
 exports.getStorefrontNextAuthOptions = getStorefrontNextAuthOptions;
+exports.googleOAuthRedirectUri = googleOAuthRedirectUri;
 exports.isAuthDebugClientEnabled = isAuthDebugClientEnabled;
 exports.isAuthDebugEnabled = isAuthDebugEnabled;
+exports.isGoogleAuthPubliclyEnabled = isGoogleAuthPubliclyEnabled;
 exports.logAuth = logAuth;
 exports.logAuthClient = logAuthClient;
 exports.nextAuthCookieDebugInfo = nextAuthCookieDebugInfo;
+exports.resolveGoogleAuthConfig = resolveGoogleAuthConfig;
 exports.seedAdministratorPermissions = seedAdministratorPermissions;
 exports.summarizeSessionUserForLog = summarizeSessionUserForLog;

package/dist/cli.cjs

@@ -207,7 +207,7 @@ export async function PATCH(req: Request, ctx: { params: Promise<{ path?: string
 export async function DELETE(req: Request, ctx: { params: Promise<{ path?: string[] }> }) { return handle('DELETE', req, ctx); }
 `,
   "src/app/api/auth/[...nextauth]/route.ts": `import NextAuth from 'next-auth';
-import { getNextAuthOptions } from '@infuro/cms-core/auth';
+import { buildNextAuthOptions } from '@infuro/cms-core/auth';
 import { getDataSourceInitialized } from '@/lib/data-source';
 import { CMS_ENTITY_MAP, enrichUserWithVendorContext } from '@infuro/cms-core';
 import bcrypt from 'bcryptjs';
@@ -215,7 +215,9 @@ import bcrypt from 'bcryptjs';
 async function getOptions() {
   const dataSource = await getDataSourceInitialized();
   const userRepo = dataSource.getRepository(CMS_ENTITY_MAP.users);
-  return getNextAuthOptions({
+  return buildNextAuthOptions({
+    dataSource,
+    entityMap: CMS_ENTITY_MAP,
     getUserByEmail: async (email: string) => {
       const user = await userRepo.findOne({
         where: { email },
@@ -229,24 +231,17 @@ async function getOptions() {
   });
 }
 
-let handler: ReturnType<typeof NextAuth> | null = null;
-
-async function getHandler() {
-  if (!handler) handler = NextAuth(await getOptions());
-  return handler;
-}
-
 type NextAuthContext = { params: Promise<{ nextauth?: string[] }> };
 
 export async function GET(req: Request, context: NextAuthContext) {
-  return (await getHandler())(req, context);
+  return NextAuth(await getOptions())(req, context);
 }
 export async function POST(req: Request, context: NextAuthContext) {
-  return (await getHandler())(req, context);
+  return NextAuth(await getOptions())(req, context);
 }
 `,
   "src/app/api/storefront-auth/[...nextauth]/route.ts": `import NextAuth from 'next-auth';
-import { getStorefrontNextAuthOptions } from '@infuro/cms-core/auth';
+import { buildStorefrontNextAuthOptions } from '@infuro/cms-core/auth';
 import { getDataSourceInitialized } from '@/lib/data-source';
 import { CMS_ENTITY_MAP, enrichUserWithVendorContext } from '@infuro/cms-core';
 import bcrypt from 'bcryptjs';
@@ -254,7 +249,9 @@ import bcrypt from 'bcryptjs';
 async function getOptions() {
   const dataSource = await getDataSourceInitialized();
   const userRepo = dataSource.getRepository(CMS_ENTITY_MAP.users);
-  return getStorefrontNextAuthOptions({
+  return buildStorefrontNextAuthOptions({
+    dataSource,
+    entityMap: CMS_ENTITY_MAP,
     getUserByEmail: async (email: string) => {
       const user = await userRepo.findOne({
         where: { email },
@@ -268,20 +265,13 @@ async function getOptions() {
   });
 }
 
-let handler: ReturnType<typeof NextAuth> | null = null;
-
-async function getHandler() {
-  if (!handler) handler = NextAuth(await getOptions());
-  return handler;
-}
-
 type NextAuthContext = { params: Promise<{ nextauth?: string[] }> };
 
 export async function GET(req: Request, context: NextAuthContext) {
-  return (await getHandler())(req, context);
+  return NextAuth(await getOptions())(req, context);
 }
 export async function POST(req: Request, context: NextAuthContext) {
-  return (await getHandler())(req, context);
+  return NextAuth(await getOptions())(req, context);
 }
 `,
   "src/app/admin/layout.tsx": `'use client';
@@ -322,6 +312,7 @@ const cmsMiddleware = createCmsMiddleware({
     '/api/users/forgot-password': ['POST'],
     '/api/users/set-password': ['POST'],
     '/api/users/invite': ['GET', 'POST'],
+    '/api/settings/auth_providers': ['GET'],
   },
 });
 

package/dist/cli.js

@@ -200,7 +200,7 @@ export async function PATCH(req: Request, ctx: { params: Promise<{ path?: string
 export async function DELETE(req: Request, ctx: { params: Promise<{ path?: string[] }> }) { return handle('DELETE', req, ctx); }
 `,
   "src/app/api/auth/[...nextauth]/route.ts": `import NextAuth from 'next-auth';
-import { getNextAuthOptions } from '@infuro/cms-core/auth';
+import { buildNextAuthOptions } from '@infuro/cms-core/auth';
 import { getDataSourceInitialized } from '@/lib/data-source';
 import { CMS_ENTITY_MAP, enrichUserWithVendorContext } from '@infuro/cms-core';
 import bcrypt from 'bcryptjs';
@@ -208,7 +208,9 @@ import bcrypt from 'bcryptjs';
 async function getOptions() {
   const dataSource = await getDataSourceInitialized();
   const userRepo = dataSource.getRepository(CMS_ENTITY_MAP.users);
-  return getNextAuthOptions({
+  return buildNextAuthOptions({
+    dataSource,
+    entityMap: CMS_ENTITY_MAP,
     getUserByEmail: async (email: string) => {
       const user = await userRepo.findOne({
         where: { email },
@@ -222,24 +224,17 @@ async function getOptions() {
   });
 }
 
-let handler: ReturnType<typeof NextAuth> | null = null;
-
-async function getHandler() {
-  if (!handler) handler = NextAuth(await getOptions());
-  return handler;
-}
-
 type NextAuthContext = { params: Promise<{ nextauth?: string[] }> };
 
 export async function GET(req: Request, context: NextAuthContext) {
-  return (await getHandler())(req, context);
+  return NextAuth(await getOptions())(req, context);
 }
 export async function POST(req: Request, context: NextAuthContext) {
-  return (await getHandler())(req, context);
+  return NextAuth(await getOptions())(req, context);
 }
 `,
   "src/app/api/storefront-auth/[...nextauth]/route.ts": `import NextAuth from 'next-auth';
-import { getStorefrontNextAuthOptions } from '@infuro/cms-core/auth';
+import { buildStorefrontNextAuthOptions } from '@infuro/cms-core/auth';
 import { getDataSourceInitialized } from '@/lib/data-source';
 import { CMS_ENTITY_MAP, enrichUserWithVendorContext } from '@infuro/cms-core';
 import bcrypt from 'bcryptjs';
@@ -247,7 +242,9 @@ import bcrypt from 'bcryptjs';
 async function getOptions() {
   const dataSource = await getDataSourceInitialized();
   const userRepo = dataSource.getRepository(CMS_ENTITY_MAP.users);
-  return getStorefrontNextAuthOptions({
+  return buildStorefrontNextAuthOptions({
+    dataSource,
+    entityMap: CMS_ENTITY_MAP,
     getUserByEmail: async (email: string) => {
       const user = await userRepo.findOne({
         where: { email },
@@ -261,20 +258,13 @@ async function getOptions() {
   });
 }
 
-let handler: ReturnType<typeof NextAuth> | null = null;
-
-async function getHandler() {
-  if (!handler) handler = NextAuth(await getOptions());
-  return handler;
-}
-
 type NextAuthContext = { params: Promise<{ nextauth?: string[] }> };
 
 export async function GET(req: Request, context: NextAuthContext) {
-  return (await getHandler())(req, context);
+  return NextAuth(await getOptions())(req, context);
 }
 export async function POST(req: Request, context: NextAuthContext) {
-  return (await getHandler())(req, context);
+  return NextAuth(await getOptions())(req, context);
 }
 `,
   "src/app/admin/layout.tsx": `'use client';
@@ -315,6 +305,7 @@ const cmsMiddleware = createCmsMiddleware({
     '/api/users/forgot-password': ['POST'],
     '/api/users/set-password': ['POST'],
     '/api/users/invite': ['GET', 'POST'],
+    '/api/settings/auth_providers': ['GET'],
   },
 });