@insforge/sdk 1.3.0-ssr.1 → 1.3.0-ssr.2

package/README.md

@@ -295,7 +295,19 @@ import { createRefreshAuthRouter } from "@insforge/sdk/ssr";
 export const { POST } = createRefreshAuthRouter();
 ```
 
-For server-owned refresh cookies, run sign-in in a Route Handler or Server Action and use `setAuthCookies()` from `@insforge/sdk/ssr` with the auth response.
+For server-owned refresh cookies, run sign-in in a Route Handler or Server Action and use `setAuthCookies()` from `@insforge/sdk/ssr` with the framework cookie writer. In Next.js Route Handlers, pass `response.cookies`:
+
+```typescript
+import { NextResponse } from "next/server";
+import { setAuthCookies } from "@insforge/sdk/ssr";
+
+const response = NextResponse.json({ user: data.user });
+setAuthCookies(response.cookies, {
+  accessToken: data.accessToken,
+  refreshToken: data.refreshToken,
+});
+return response;
+```
 
 If your refresh route needs custom side effects:
 

package/dist/ssr.d.mts

@@ -24,10 +24,21 @@ interface AuthCookieOptions {
 type CookieStoreValue = string | {
     value?: string | null;
 } | undefined | null;
-interface CookieStore {
+interface CookieReader {
     get(name: string): CookieStoreValue;
+}
+interface CookieWriter {
     set?(name: string, value: string, options?: CookieOptions): unknown;
-    delete?(name: string, options?: CookieOptions): unknown;
+    set?(options: {
+        name: string;
+        value: string;
+    } & CookieOptions): unknown;
+    delete?(name: string): unknown;
+    delete?(options: {
+        name: string;
+    } & CookieOptions): unknown;
+}
+interface CookieStore extends CookieReader, CookieWriter {
 }
 interface AuthCookieSettings {
     names?: AuthCookieNames;
@@ -37,11 +48,11 @@ declare function getAccessTokenCookieName(names?: AuthCookieNames): string;
 declare function getRefreshTokenCookieName(names?: AuthCookieNames): string;
 declare function accessTokenCookieOptions(token: string, overrides?: CookieOptions): CookieOptions;
 declare function refreshTokenCookieOptions(token: string, overrides?: CookieOptions): CookieOptions;
-declare function setAuthCookies(target: Headers | CookieStore | undefined, tokens: {
+declare function setAuthCookies(cookies: CookieWriter | undefined, tokens: {
     accessToken: string;
     refreshToken?: string | null;
 }, settings?: AuthCookieSettings): void;
-declare function clearAuthCookies(target: Headers | CookieStore | undefined, settings?: AuthCookieSettings): void;
+declare function clearAuthCookies(cookies: CookieWriter | undefined, settings?: AuthCookieSettings): void;
 
 interface CreateBrowserClientOptions extends Omit<InsForgeConfig, 'edgeFunctionToken' | 'isServerMode' | 'auth'>, AuthCookieSettings {
     refreshUrl?: string;
@@ -85,4 +96,4 @@ interface UpdateSessionResult {
 }
 declare function updateSession(options: UpdateSessionOptions): Promise<UpdateSessionResult>;
 
-export { type AuthCookieNames, type AuthCookieOptions, type AuthCookieSettings, type CookieOptions, type CookieStore, type CreateBrowserClientOptions, type CreateServerClientOptions, DEFAULT_ACCESS_TOKEN_COOKIE, DEFAULT_REFRESH_TOKEN_COOKIE, type RefreshAuthOptions, type RefreshAuthResult, type RefreshAuthRouteHandler, type UpdateSessionOptions, type UpdateSessionResult, accessTokenCookieOptions, clearAuthCookies, createBrowserClient, createRefreshAuthRouter, createServerClient, getAccessTokenCookieName, getRefreshTokenCookieName, refreshAuth, refreshTokenCookieOptions, setAuthCookies, updateSession };
+export { type AuthCookieNames, type AuthCookieOptions, type AuthCookieSettings, type CookieOptions, type CookieReader, type CookieStore, type CookieWriter, type CreateBrowserClientOptions, type CreateServerClientOptions, DEFAULT_ACCESS_TOKEN_COOKIE, DEFAULT_REFRESH_TOKEN_COOKIE, type RefreshAuthOptions, type RefreshAuthResult, type RefreshAuthRouteHandler, type UpdateSessionOptions, type UpdateSessionResult, accessTokenCookieOptions, clearAuthCookies, createBrowserClient, createRefreshAuthRouter, createServerClient, getAccessTokenCookieName, getRefreshTokenCookieName, refreshAuth, refreshTokenCookieOptions, setAuthCookies, updateSession };

package/dist/ssr.d.ts

@@ -24,10 +24,21 @@ interface AuthCookieOptions {
 type CookieStoreValue = string | {
     value?: string | null;
 } | undefined | null;
-interface CookieStore {
+interface CookieReader {
     get(name: string): CookieStoreValue;
+}
+interface CookieWriter {
     set?(name: string, value: string, options?: CookieOptions): unknown;
-    delete?(name: string, options?: CookieOptions): unknown;
+    set?(options: {
+        name: string;
+        value: string;
+    } & CookieOptions): unknown;
+    delete?(name: string): unknown;
+    delete?(options: {
+        name: string;
+    } & CookieOptions): unknown;
+}
+interface CookieStore extends CookieReader, CookieWriter {
 }
 interface AuthCookieSettings {
     names?: AuthCookieNames;
@@ -37,11 +48,11 @@ declare function getAccessTokenCookieName(names?: AuthCookieNames): string;
 declare function getRefreshTokenCookieName(names?: AuthCookieNames): string;
 declare function accessTokenCookieOptions(token: string, overrides?: CookieOptions): CookieOptions;
 declare function refreshTokenCookieOptions(token: string, overrides?: CookieOptions): CookieOptions;
-declare function setAuthCookies(target: Headers | CookieStore | undefined, tokens: {
+declare function setAuthCookies(cookies: CookieWriter | undefined, tokens: {
     accessToken: string;
     refreshToken?: string | null;
 }, settings?: AuthCookieSettings): void;
-declare function clearAuthCookies(target: Headers | CookieStore | undefined, settings?: AuthCookieSettings): void;
+declare function clearAuthCookies(cookies: CookieWriter | undefined, settings?: AuthCookieSettings): void;
 
 interface CreateBrowserClientOptions extends Omit<InsForgeConfig, 'edgeFunctionToken' | 'isServerMode' | 'auth'>, AuthCookieSettings {
     refreshUrl?: string;
@@ -85,4 +96,4 @@ interface UpdateSessionResult {
 }
 declare function updateSession(options: UpdateSessionOptions): Promise<UpdateSessionResult>;
 
-export { type AuthCookieNames, type AuthCookieOptions, type AuthCookieSettings, type CookieOptions, type CookieStore, type CreateBrowserClientOptions, type CreateServerClientOptions, DEFAULT_ACCESS_TOKEN_COOKIE, DEFAULT_REFRESH_TOKEN_COOKIE, type RefreshAuthOptions, type RefreshAuthResult, type RefreshAuthRouteHandler, type UpdateSessionOptions, type UpdateSessionResult, accessTokenCookieOptions, clearAuthCookies, createBrowserClient, createRefreshAuthRouter, createServerClient, getAccessTokenCookieName, getRefreshTokenCookieName, refreshAuth, refreshTokenCookieOptions, setAuthCookies, updateSession };
+export { type AuthCookieNames, type AuthCookieOptions, type AuthCookieSettings, type CookieOptions, type CookieReader, type CookieStore, type CookieWriter, type CreateBrowserClientOptions, type CreateServerClientOptions, DEFAULT_ACCESS_TOKEN_COOKIE, DEFAULT_REFRESH_TOKEN_COOKIE, type RefreshAuthOptions, type RefreshAuthResult, type RefreshAuthRouteHandler, type UpdateSessionOptions, type UpdateSessionResult, accessTokenCookieOptions, clearAuthCookies, createBrowserClient, createRefreshAuthRouter, createServerClient, getAccessTokenCookieName, getRefreshTokenCookieName, refreshAuth, refreshTokenCookieOptions, setAuthCookies, updateSession };

package/dist/ssr.js

@@ -2735,11 +2735,11 @@ function setCookie(cookies, name, value, options) {
 }
 function deleteCookie(cookies, name, options) {
   if (!cookies) return;
-  if (cookies.delete) {
-    cookies.delete(name, options);
+  if (cookies.set) {
+    cookies.set(name, "", expiredCookieOptions(options));
     return;
   }
-  cookies.set?.(name, "", expiredCookieOptions(options));
+  cookies.delete?.(name);
 }
 function serializeCookie(name, value, options = {}) {
   const parts = [`${encodeURIComponent(name)}=${encodeURIComponent(value)}`];
@@ -2758,32 +2758,17 @@ function serializeCookie(name, value, options = {}) {
 function appendSetCookie(headers, name, value, options) {
   headers.append("Set-Cookie", serializeCookie(name, value, options));
 }
-function setAuthCookies(target, tokens, settings = {}) {
+function setAuthCookies(cookies, tokens, settings = {}) {
   const accessName = getAccessTokenCookieName(settings.names);
   const refreshName = getRefreshTokenCookieName(settings.names);
   const accessOptions = accessTokenCookieOptions(
     tokens.accessToken,
     settings.options?.accessToken
   );
-  if (target instanceof Headers) {
-    appendSetCookie(target, accessName, tokens.accessToken, accessOptions);
-    if (tokens.refreshToken) {
-      appendSetCookie(
-        target,
-        refreshName,
-        tokens.refreshToken,
-        refreshTokenCookieOptions(
-          tokens.refreshToken,
-          settings.options?.refreshToken
-        )
-      );
-    }
-    return;
-  }
-  setCookie(target, accessName, tokens.accessToken, accessOptions);
+  setCookie(cookies, accessName, tokens.accessToken, accessOptions);
   if (tokens.refreshToken) {
     setCookie(
-      target,
+      cookies,
       refreshName,
       tokens.refreshToken,
       refreshTokenCookieOptions(
@@ -2793,18 +2778,48 @@ function setAuthCookies(target, tokens, settings = {}) {
     );
   }
 }
-function clearAuthCookies(target, settings = {}) {
+function clearAuthCookies(cookies, settings = {}) {
   const accessName = getAccessTokenCookieName(settings.names);
   const refreshName = getRefreshTokenCookieName(settings.names);
   const accessOptions = expiredCookieOptions(settings.options?.accessToken);
   const refreshOptions = expiredCookieOptions(settings.options?.refreshToken);
-  if (target instanceof Headers) {
-    appendSetCookie(target, accessName, "", accessOptions);
-    appendSetCookie(target, refreshName, "", refreshOptions);
-    return;
+  deleteCookie(cookies, accessName, accessOptions);
+  deleteCookie(cookies, refreshName, refreshOptions);
+}
+function setAuthCookieHeaders(headers, tokens, settings = {}) {
+  const accessName = getAccessTokenCookieName(settings.names);
+  const refreshName = getRefreshTokenCookieName(settings.names);
+  appendSetCookie(
+    headers,
+    accessName,
+    tokens.accessToken,
+    accessTokenCookieOptions(tokens.accessToken, settings.options?.accessToken)
+  );
+  if (tokens.refreshToken) {
+    appendSetCookie(
+      headers,
+      refreshName,
+      tokens.refreshToken,
+      refreshTokenCookieOptions(
+        tokens.refreshToken,
+        settings.options?.refreshToken
+      )
+    );
   }
-  deleteCookie(target, accessName, accessOptions);
-  deleteCookie(target, refreshName, refreshOptions);
+}
+function clearAuthCookieHeaders(headers, settings = {}) {
+  appendSetCookie(
+    headers,
+    getAccessTokenCookieName(settings.names),
+    "",
+    expiredCookieOptions(settings.options?.accessToken)
+  );
+  appendSetCookie(
+    headers,
+    getRefreshTokenCookieName(settings.names),
+    "",
+    expiredCookieOptions(settings.options?.refreshToken)
+  );
 }
 
 // src/ssr/browser-client.ts
@@ -3029,7 +3044,7 @@ async function refreshAuth(options = {}) {
   const headers = new Headers();
   const refreshToken = readRefreshToken(options);
   if (!refreshToken) {
-    clearAuthCookies(headers, options);
+    clearAuthCookieHeaders(headers, options);
     const error2 = new InsForgeError(
       "Refresh token cookie is missing",
       401,
@@ -3099,7 +3114,7 @@ async function refreshAuth(options = {}) {
     error = normalizeError(caught);
   }
   if (error || !data?.accessToken) {
-    clearAuthCookies(headers, options);
+    clearAuthCookieHeaders(headers, options);
     const normalized = normalizeError(error);
     return {
       response: jsonResponse(
@@ -3118,7 +3133,7 @@ async function refreshAuth(options = {}) {
     };
   }
   const nextRefreshToken = data.refreshToken ?? refreshToken;
-  setAuthCookies(
+  setAuthCookieHeaders(
     headers,
     {
       accessToken: data.accessToken,