@main12/auth-login 0.3.0 → 0.3.2

package/dist/index.js

@@ -1,5 +1,5 @@
+import { OAuth2Plugin } from 'payload-oauth2';
 import { authEndpoints } from './endpoints/authEndpoints.js';
-import { googleOAuthEndpoints } from './endpoints/googleOAuth.js';
 import { pluginConfig } from './config.js';
 function resolveGoogleConfig(providers) {
     const google = providers?.google;
@@ -11,22 +11,32 @@ function resolveGoogleConfig(providers) {
             clientSecret: ''
         };
     }
-    // Explicit config provided
-    if (typeof google === 'object' && google.clientId && google.clientSecret) {
+    // Explicit config object — user intends to enable Google OAuth
+    // Resolve credentials from explicit values or fall back to env vars
+    if (typeof google === 'object') {
+        const clientId = google.clientId || process.env.GOOGLE_CLIENT_ID || '';
+        const clientSecret = google.clientSecret || process.env.GOOGLE_CLIENT_SECRET || '';
         return {
             enabled: true,
-            clientId: google.clientId,
-            clientSecret: google.clientSecret
+            clientId,
+            clientSecret
         };
     }
-    // Auto-detect from env
-    const envId = process.env.GOOGLE_CLIENT_ID || '';
-    const envSecret = process.env.GOOGLE_CLIENT_SECRET || '';
-    const hasEnvCreds = !!(envId && envSecret);
+    // google: true — auto-detect from env
+    if (google === true) {
+        const envId = process.env.GOOGLE_CLIENT_ID || '';
+        const envSecret = process.env.GOOGLE_CLIENT_SECRET || '';
+        return {
+            enabled: !!(envId && envSecret),
+            clientId: envId,
+            clientSecret: envSecret
+        };
+    }
+    // Not configured at all — disabled
     return {
-        enabled: hasEnvCreds,
-        clientId: envId,
-        clientSecret: envSecret
+        enabled: false,
+        clientId: '',
+        clientSecret: ''
     };
 }
 /**
@@ -38,7 +48,7 @@ function resolveGoogleConfig(providers) {
         process.env.GOOGLE_CLIENT_SECRET = googleConfig.clientSecret;
     }
 }
-export const authLoginPlugin = (options = {})=>(config)=>{
+export const authLoginPlugin = (options = {})=>async (config)=>{
         if (options.enabled === false) return config;
         // Resolve provider config
         const googleConfig = resolveGoogleConfig(options.providers);
@@ -51,6 +61,15 @@ export const authLoginPlugin = (options = {})=>(config)=>{
             pluginConfig.Logo = options.logo;
         }
         pluginConfig.googleOAuthEnabled = googleConfig.enabled;
+        // Set env vars so RSC components can read config across module boundaries
+        process.env.AUTH_PLUGIN_STYLE = pluginConfig.style;
+        process.env.AUTH_PLUGIN_GOOGLE_OAUTH = String(pluginConfig.googleOAuthEnabled);
+        process.env.AUTH_PLUGIN_ALLOW_SIGNUP = String(options.allowSignup !== false);
+        process.env.AUTH_PLUGIN_PASSWORD_LOGIN = String(options.passwordLogin !== false);
+        process.env.AUTH_PLUGIN_OTP_LOGIN = String(options.otpLogin !== false);
+        pluginConfig.passwordLogin = options.passwordLogin !== false;
+        pluginConfig.otpLogin = options.otpLogin !== false;
+        process.env.AUTH_PLUGIN_ROUTE_REDIRECTS = String(pluginConfig.routeRedirects);
         // Route redirects config
         if (options.routeRedirects) {
             pluginConfig.routeRedirects = true;
@@ -58,17 +77,84 @@ export const authLoginPlugin = (options = {})=>(config)=>{
                 pluginConfig.authBasePath = options.routeRedirects.basePath;
             }
         }
+        // Register hidden auth-otps collection for OTP storage
+        config.collections = [
+            ...config.collections || [],
+            {
+                slug: 'auth-otps',
+                admin: {
+                    hidden: true
+                },
+                fields: [
+                    {
+                        name: 'email',
+                        type: 'email',
+                        required: true,
+                        index: true
+                    },
+                    {
+                        name: 'hash',
+                        type: 'text',
+                        required: true
+                    },
+                    {
+                        name: 'purpose',
+                        type: 'text'
+                    },
+                    {
+                        name: 'attempts',
+                        type: 'number',
+                        defaultValue: 0
+                    },
+                    {
+                        name: 'expiresAt',
+                        type: 'text'
+                    }
+                ]
+            }
+        ];
         // Register auth API endpoints
         config.endpoints = [
             ...config.endpoints || [],
             ...authEndpoints
         ];
-        // Register Google OAuth endpoints only if enabled
-        if (pluginConfig.googleOAuthEnabled) {
-            config.endpoints = [
-                ...config.endpoints,
-                ...googleOAuthEndpoints
-            ];
+        // Register Google OAuth via payload-oauth2 if enabled
+        if (googleConfig.enabled) {
+            const googleOpts = typeof options.providers?.google === 'object' ? options.providers.google : {};
+            const serverURL = options.domain || process.env.NEXT_PUBLIC_SERVER_URL || 'http://localhost:3000';
+            config = await OAuth2Plugin({
+                enabled: true,
+                strategyName: 'google',
+                useEmailAsIdentity: true,
+                serverURL,
+                clientId: googleConfig.clientId,
+                clientSecret: googleConfig.clientSecret,
+                tokenEndpoint: 'https://oauth2.googleapis.com/token',
+                providerAuthorizationUrl: 'https://accounts.google.com/o/oauth2/v2/auth',
+                scopes: [
+                    'openid',
+                    'https://www.googleapis.com/auth/userinfo.email',
+                    'https://www.googleapis.com/auth/userinfo.profile'
+                ],
+                authorizePath: '/oauth/google',
+                callbackPath: '/oauth/google/callback',
+                prompt: googleOpts.prompt || 'select_account',
+                getUserInfo: async (accessToken)=>{
+                    const response = await fetch('https://www.googleapis.com/oauth2/v3/userinfo', {
+                        headers: {
+                            Authorization: `Bearer ${accessToken}`
+                        }
+                    });
+                    const user = await response.json();
+                    return {
+                        email: user.email,
+                        sub: user.sub,
+                        name: user.name
+                    };
+                },
+                successRedirect: ()=>googleOpts.successRedirect || '/admin',
+                failureRedirect: ()=>googleOpts.failureRedirect || '/login?error=Google login failed'
+            })(config);
         }
         // Chain onInit
         const incomingOnInit = config.onInit;

package/dist/proxy.js

@@ -29,11 +29,25 @@ const AUTH_ROUTES = [
     const base = (basePath ?? pluginConfig.authBasePath).replace(/\/$/, '');
     const routeSet = new Set(routes);
     return function proxy(request) {
-        // If routeRedirects is disabled in plugin config, pass through
-        if (!pluginConfig.routeRedirects && !basePath) {
+        // Check route redirects — use env var (set by plugin) as it survives module boundaries
+        const redirectsEnabled = pluginConfig.routeRedirects || process.env.AUTH_PLUGIN_ROUTE_REDIRECTS === 'true';
+        if (!redirectsEnabled && !basePath) {
             return NextResponse.next();
         }
         const { pathname } = request.nextUrl;
+        // If user is already logged in, redirect away from auth pages (login, signup, etc.)
+        const token = request.cookies.get('payload-token')?.value;
+        if (token) {
+            const segment = pathname.replace(/^\//, '').replace(/\/$/, '');
+            const isAuthPage = routeSet.has(segment) || routeSet.has(pathname.replace(`${base}/`, ''));
+            if (isAuthPage || pathname.startsWith(`${base}/login`) || pathname.startsWith(`${base}/signup`)) {
+                const redirect = request.nextUrl.searchParams.get('redirect') || '/';
+                const url = request.nextUrl.clone();
+                url.pathname = redirect;
+                url.search = '';
+                return NextResponse.redirect(url);
+            }
+        }
         // Always redirect /admin/login to the plugin login page
         if (pathname === '/admin/login' || pathname === '/admin/login/') {
             const url = request.nextUrl.clone();
@@ -57,6 +71,7 @@ export const config = {
         '/signup',
         '/forgot-password',
         '/verify-otp',
-        '/set-password'
+        '/set-password',
+        '/auth/:path*'
     ]
 };

package/package.json

@@ -1,6 +1,6 @@
 {
   "name": "@main12/auth-login",
-  "version": "0.3.0",
+  "version": "0.3.2",
   "description": "Reusable Payload CMS auth plugin — login, signup, OTP, forgot password, branded emails, Powered by Main12",
   "license": "MIT",
   "type": "module",
@@ -19,11 +19,6 @@
       "import": "./dist/exports/rsc.js",
       "types": "./dist/exports/rsc.d.ts",
       "default": "./dist/exports/rsc.js"
-    },
-    "./proxy": {
-      "import": "./dist/proxy.js",
-      "types": "./dist/proxy.d.ts",
-      "default": "./dist/proxy.js"
     }
   },
   "main": "./dist/index.js",
@@ -31,21 +26,6 @@
   "files": [
     "dist"
   ],
-  "scripts": {
-    "build": "pnpm copyfiles && pnpm build:types && pnpm build:swc && pnpm build:fix-esm-imports",
-    "build:fix-esm-imports": "node ./scripts/fix-esm-imports.mjs",
-    "build:swc": "swc ./src -d ./dist --config-file .swcrc --strip-leading-paths",
-    "build:types": "tsc --outDir dist",
-    "clean": "rimraf {dist,*.tsbuildinfo}",
-    "copyfiles": "copyfiles -u 1 \"src/**/*.{html,css,scss,ttf,woff,woff2,eot,svg,jpg,png,json}\" dist/",
-    "dev": "next dev dev --turbo",
-    "dev:generate-importmap": "pnpm dev:payload generate:importmap",
-    "dev:generate-types": "pnpm dev:payload generate:types",
-    "dev:payload": "cross-env PAYLOAD_CONFIG_PATH=./dev/payload.config.ts payload",
-    "lint": "eslint",
-    "lint:fix": "eslint ./src --fix",
-    "test": "vitest"
-  },
   "devDependencies": {
     "@eslint/eslintrc": "^3.2.0",
     "@heroui/react": "^3.2.2",
@@ -95,33 +75,26 @@
   "engines": {
     "node": ">=18.20.2"
   },
-  "publishConfig": {
-    "exports": {
-      ".": {
-        "import": "./dist/index.js",
-        "types": "./dist/index.d.ts",
-        "default": "./dist/index.js"
-      },
-      "./client": {
-        "import": "./dist/exports/client.js",
-        "types": "./dist/exports/client.d.ts",
-        "default": "./dist/exports/client.js"
-      },
-      "./rsc": {
-        "import": "./dist/exports/rsc.js",
-        "types": "./dist/exports/rsc.d.ts",
-        "default": "./dist/exports/rsc.js"
-      }
-    },
-    "main": "./dist/index.js",
-    "types": "./dist/index.d.ts"
-  },
-  "pnpm": {
-    "onlyBuiltDependencies": [
-      "@swc/core",
-      "sharp",
-      "esbuild"
-    ]
+  "registry": "https://registry.npmjs.org/",
+  "dependencies": {
+    "@main12/brevo-adapter": "^0.1.1",
+    "axios": "^1.20.0",
+    "jose": "^6.2.12",
+    "payload-oauth2": "^1.0.21"
   },
-  "registry": "https://registry.npmjs.org/"
-}
+  "scripts": {
+    "build": "pnpm copyfiles && pnpm build:types && pnpm build:swc && pnpm build:fix-esm-imports",
+    "build:fix-esm-imports": "node ./scripts/fix-esm-imports.mjs",
+    "build:swc": "swc ./src -d ./dist --config-file .swcrc --strip-leading-paths",
+    "build:types": "tsc --outDir dist",
+    "clean": "rimraf {dist,*.tsbuildinfo}",
+    "copyfiles": "copyfiles -u 1 \"src/**/*.{html,css,scss,ttf,woff,woff2,eot,svg,jpg,png,json}\" dist/",
+    "dev": "next dev dev --turbo",
+    "dev:generate-importmap": "pnpm dev:payload generate:importmap",
+    "dev:generate-types": "pnpm dev:payload generate:types",
+    "dev:payload": "cross-env PAYLOAD_CONFIG_PATH=./dev/payload.config.ts payload",
+    "lint": "eslint",
+    "lint:fix": "eslint ./src --fix",
+    "test": "vitest"
+  }
+}

package/dist/endpoints/googleOAuth.d.ts

@@ -1,10 +0,0 @@
-import type { Endpoint } from 'payload';
-/**
- * GET /api/auth/oauth/google — start Google OAuth flow
- */
-export declare const googleOAuthStart: Endpoint;
-/**
- * GET /api/auth/oauth/google/callback — handle Google's redirect back
- */
-export declare const googleOAuthCallback: Endpoint;
-export declare const googleOAuthEndpoints: Endpoint[];

package/dist/endpoints/googleOAuth.js

@@ -1,144 +0,0 @@
-/**
- * Google OAuth 2.0 — zero dependencies, pure REST.
- *
- * Flow:
- * 1. GET /api/auth/oauth/google → Google consent screen
- * 2. GET /api/auth/oauth/google/callback → exchange code, get profile, login, redirect
- *
- * Requires env vars: GOOGLE_CLIENT_ID, GOOGLE_CLIENT_SECRET
- */ const GOOGLE_AUTH_URL = 'https://accounts.google.com/o/oauth2/v2/auth';
-const GOOGLE_TOKEN_URL = 'https://oauth2.googleapis.com/token';
-const GOOGLE_USERINFO_URL = 'https://www.googleapis.com/oauth2/v3/userinfo';
-function env(key, fb = '') {
-    return process.env[key] || fb;
-}
-/**
- * GET /api/auth/oauth/google — start Google OAuth flow
- */ export const googleOAuthStart = {
-    path: '/api/auth/oauth/google',
-    method: 'get',
-    handler: async (req)=>{
-        const clientId = env('GOOGLE_CLIENT_ID');
-        if (!clientId) return Response.json({
-            error: 'Google OAuth not configured'
-        }, {
-            status: 501
-        });
-        const url = new URL(req.url || 'http://localhost');
-        const redirect = url.searchParams.get('redirect') || '/';
-        const base = env('NEXT_PUBLIC_SERVER_URL', 'http://localhost:3000');
-        const params = new URLSearchParams({
-            client_id: clientId,
-            redirect_uri: `${base}/api/auth/oauth/google/callback`,
-            response_type: 'code',
-            scope: 'openid email profile',
-            access_type: 'online',
-            state: encodeURIComponent(redirect)
-        });
-        return Response.redirect(`${GOOGLE_AUTH_URL}?${params.toString()}`, 302);
-    }
-};
-/**
- * GET /api/auth/oauth/google/callback — handle Google's redirect back
- */ export const googleOAuthCallback = {
-    path: '/api/auth/oauth/google/callback',
-    method: 'get',
-    handler: async (req)=>{
-        const url = new URL(req.url || 'http://localhost');
-        const code = url.searchParams.get('code');
-        const state = url.searchParams.get('state') || '/';
-        const redirectTo = decodeURIComponent(state);
-        if (!code) return Response.redirect(`/login?error=${url.searchParams.get('error') || 'oauth_failed'}`, 302);
-        const clientId = env('GOOGLE_CLIENT_ID');
-        const clientSecret = env('GOOGLE_CLIENT_SECRET');
-        const base = env('NEXT_PUBLIC_SERVER_URL', 'http://localhost:3000');
-        try {
-            // 1. Exchange code for access token
-            const tokenRes = await fetch(GOOGLE_TOKEN_URL, {
-                method: 'POST',
-                headers: {
-                    'Content-Type': 'application/x-www-form-urlencoded'
-                },
-                body: new URLSearchParams({
-                    code,
-                    client_id: clientId,
-                    client_secret: clientSecret,
-                    redirect_uri: `${base}/api/auth/oauth/google/callback`,
-                    grant_type: 'authorization_code'
-                })
-            });
-            if (!tokenRes.ok) return Response.redirect(`/login?error=oauth_failed`, 302);
-            const tokens = await tokenRes.json();
-            const accessToken = tokens.access_token;
-            // 2. Get Google profile
-            const profileRes = await fetch(GOOGLE_USERINFO_URL, {
-                headers: {
-                    Authorization: `Bearer ${accessToken}`
-                }
-            });
-            if (!profileRes.ok) return Response.redirect(`/login?error=oauth_failed`, 302);
-            const profile = await profileRes.json();
-            const email = profile.email?.toLowerCase();
-            const name = profile.name || email?.split('@')[0];
-            if (!email) return Response.redirect(`/login?error=oauth_failed`, 302);
-            // 3. Find or create user
-            const users = await req.payload.find({
-                collection: 'users',
-                where: {
-                    email: {
-                        equals: email
-                    }
-                },
-                limit: 1
-            });
-            let userId;
-            let userPw;
-            if (users.docs?.length) {
-                userId = users.docs[0].id;
-                // Set a known temp password so we can login
-                userPw = `g_tmp_${Date.now()}`;
-                await req.payload.update({
-                    collection: 'users',
-                    id: userId,
-                    data: {
-                        password: userPw
-                    }
-                });
-            } else {
-                userPw = `g_new_${Date.now()}`;
-                const newUser = await req.payload.create({
-                    collection: 'users',
-                    data: {
-                        email,
-                        name,
-                        password: userPw,
-                        authProvider: 'google'
-                    }
-                });
-                userId = newUser.id;
-            }
-            // 4. Login
-            const loginResult = await req.payload.login({
-                collection: 'users',
-                data: {
-                    email,
-                    password: userPw
-                },
-                req: req
-            });
-            // 5. Set cookie + redirect
-            const response = Response.redirect(redirectTo, 302);
-            if (loginResult.token) {
-                response.headers.set('Set-Cookie', `payload-token=${loginResult.token}; Path=/; HttpOnly; SameSite=Lax` + `${process.env.NODE_ENV === 'production' ? '; Secure' : ''}` + `; Max-Age=${loginResult.exp || 7200}`);
-            }
-            return response;
-        } catch (err) {
-            console.error('[auth-login] Google OAuth error:', err);
-            return Response.redirect(`/login?error=oauth_failed`, 302);
-        }
-    }
-};
-export const googleOAuthEndpoints = [
-    googleOAuthStart,
-    googleOAuthCallback
-];