@mohasinac/appkit 2.1.3 → 2.3.0

package/src/next/request-helpers.ts

@@ -1,76 +0,0 @@
-/**
- * API Request Helpers
- *
- * Generic utilities for API route request parsing and session extraction.
- * Uses structural request types (not NextRequest) to avoid cross-package
- * type identity issues when multiple Next.js installs exist in a monorepo.
- */
-
-import { AuthenticationError } from "../errors";
-
-interface CookieStoreLike {
-  get(name: string): { value?: string } | string | undefined;
-}
-
-type CookieCapableRequest = Request & { cookies?: CookieStoreLike };
-
-function readCookieFromHeader(request: Request, name: string): string | undefined {
-  const cookieHeader = request.headers.get("cookie") ?? "";
-  const match = cookieHeader.match(
-    new RegExp(`(?:^|;\\s*)${name}=([^;]+)`),
-  );
-  return match ? decodeURIComponent(match[1]) : undefined;
-}
-
-export function getSearchParams(request: Request): URLSearchParams {
-  return new URL(request.url).searchParams;
-}
-
-export function getOptionalSessionCookie(
-  request: CookieCapableRequest,
-): string | undefined {
-  const cookieValue = request.cookies?.get("__session");
-  if (typeof cookieValue === "string") return cookieValue;
-  if (cookieValue && typeof cookieValue === "object") return cookieValue.value;
-  return readCookieFromHeader(request, "__session");
-}
-
-export function getRequiredSessionCookie(request: CookieCapableRequest): string {
-  const cookie = getOptionalSessionCookie(request);
-  if (!cookie) throw new AuthenticationError("Unauthorized");
-  return cookie;
-}
-
-export function getBooleanParam(
-  searchParams: URLSearchParams,
-  key: string,
-): boolean | undefined {
-  const value = searchParams.get(key);
-  if (value === null) return undefined;
-  return value === "true";
-}
-
-export function getStringParam(
-  searchParams: URLSearchParams,
-  key: string,
-): string | undefined {
-  const value = searchParams.get(key);
-  if (!value) return undefined;
-  return value;
-}
-
-export function getNumberParam(
-  searchParams: URLSearchParams,
-  key: string,
-  fallback: number,
-  options?: { min?: number; max?: number },
-): number {
-  const rawValue = searchParams.get(key);
-  const parsed = rawValue ? Number.parseInt(rawValue, 10) : fallback;
-  const safeValue = Number.isNaN(parsed) ? fallback : parsed;
-  if (typeof options?.min === "number" && safeValue < options.min)
-    return options.min;
-  if (typeof options?.max === "number" && safeValue > options.max)
-    return options.max;
-  return safeValue;
-}

package/src/next/routing/route-map.ts

@@ -1,221 +0,0 @@
-export type RoutePath = string | ((...args: string[]) => string);
-
-export interface RouteMap {
-  HOME: string;
-  PUBLIC: Record<string, RoutePath>;
-  ERRORS: Record<string, string>;
-  AUTH: Record<string, string>;
-  USER: Record<string, RoutePath>;
-  SELLER: Record<string, RoutePath>;
-  ADMIN: Record<string, RoutePath>;
-  DEMO: Record<string, RoutePath>;
-  BLOG: Record<string, RoutePath>;
-}
-
-export const DEFAULT_ROUTE_MAP = {
-  HOME: "/",
-  PUBLIC: {
-    FAQS: "/faqs",
-    FAQ_CATEGORY: (category: string) => `/faqs/${category}`,
-    PROFILE: (userId: string) => `/profile/${userId}`,
-    PRODUCTS: "/products",
-    PRODUCT_DETAIL: (slugOrId: string) => `/products/${slugOrId}`,
-    AUCTIONS: "/auctions",
-    AUCTION_DETAIL: (id: string) => `/auctions/${id}`,
-    PRE_ORDERS: "/pre-orders",
-    PRE_ORDER_DETAIL: (id: string) => `/pre-orders/${id}`,
-    SELLERS: "/sellers",
-    SELLER_DETAIL: (id: string) => `/sellers/${id}`,
-    STORES: "/stores",
-    STORE_DETAIL: (storeSlug: string) => `/stores/${storeSlug}`,
-    STORE_PRODUCTS: (storeSlug: string) => `/stores/${storeSlug}/products`,
-    STORE_AUCTIONS: (storeSlug: string) => `/stores/${storeSlug}/auctions`,
-    STORE_REVIEWS: (storeSlug: string) => `/stores/${storeSlug}/reviews`,
-    STORE_ABOUT: (storeSlug: string) => `/stores/${storeSlug}/about`,
-    CATEGORIES: "/categories",
-    SEARCH: "/search",
-    PROMOTIONS: "/promotions",
-    ABOUT: "/about",
-    CONTACT: "/contact",
-    BLOG: "/blog",
-    HELP: "/help",
-    TERMS: "/terms",
-    PRIVACY: "/privacy",
-    SECURITY: "/security",
-    TRACK_ORDER: "/track",
-    SELLER_GUIDE: "/seller-guide",
-    COOKIE_POLICY: "/cookies",
-    REFUND_POLICY: "/refund-policy",
-    SHIPPING_POLICY: "/shipping-policy",
-    HOW_AUCTIONS_WORK: "/how-auctions-work",
-    HOW_PRE_ORDERS_WORK: "/how-pre-orders-work",
-    HOW_OFFERS_WORK: "/how-offers-work",
-    HOW_CHECKOUT_WORKS: "/how-checkout-works",
-    HOW_ORDERS_WORK: "/how-orders-work",
-    HOW_REVIEWS_WORK: "/how-reviews-work",
-    HOW_PAYOUTS_WORK: "/how-payouts-work",
-    FEES: "/fees",
-    EVENTS: "/events",
-    EVENT_DETAIL: (id: string) => `/events/${id}`,
-    EVENT_PARTICIPATE: (id: string) => `/events/${id}/participate`,
-    REVIEWS: "/reviews",
-  },
-  ERRORS: {
-    UNAUTHORIZED: "/unauthorized",
-  },
-  AUTH: {
-    LOGIN: "/auth/login",
-    REGISTER: "/auth/register",
-    FORGOT_PASSWORD: "/auth/forgot-password",
-    RESET_PASSWORD: "/auth/reset-password",
-    VERIFY_EMAIL: "/auth/verify-email",
-    OAUTH_LOADING: "/auth/oauth-loading",
-    CLOSE: "/auth/close",
-  },
-  USER: {
-    PROFILE: "/user/profile",
-    SETTINGS: "/user/settings",
-    ORDERS: "/user/orders",
-    WISHLIST: "/user/wishlist",
-    ADDRESSES: "/user/addresses",
-    ADDRESSES_ADD: "/user/addresses/add",
-    ADDRESSES_EDIT: (id: string) => `/user/addresses/edit/${id}`,
-    ORDER_DETAIL: (id: string) => `/user/orders/view/${id}`,
-    ORDER_TRACK: (id: string) => `/user/orders/${id}/track`,
-    NOTIFICATIONS: "/user/notifications",
-    MESSAGES: "/user/messages",
-    BECOME_SELLER: "/user/become-seller",
-    CART: "/cart",
-    CHECKOUT: "/checkout",
-    CHECKOUT_SUCCESS: "/checkout/success",
-    OFFERS: "/user/offers",
-  },
-  SELLER: {
-    DASHBOARD: "/seller",
-    PRODUCTS: "/seller/products",
-    PRODUCTS_NEW: "/seller/products/new",
-    PRODUCTS_EDIT: (id: string) => `/seller/products/${id}/edit`,
-    ORDERS: "/seller/orders",
-    AUCTIONS: "/seller/auctions",
-    PRE_ORDERS: "/seller/pre-orders",
-    ANALYTICS: "/seller/analytics",
-    PAYOUTS: "/seller/payouts",
-    STORE: "/seller/store",
-    SHIPPING: "/seller/shipping",
-    PAYOUT_SETTINGS: "/seller/payout-settings",
-    ADDRESSES: "/seller/addresses",
-    COUPONS: "/seller/coupons",
-    COUPONS_NEW: "/seller/coupons/new",
-    OFFERS: "/seller/offers",
-  },
-  ADMIN: {
-    DASHBOARD: "/admin/dashboard",
-    USERS: "/admin/users",
-    SITE: "/admin/site",
-    CAROUSEL: "/admin/carousel",
-    SECTIONS: "/admin/sections",
-    NAVIGATION: "/admin/navigation",
-    CATEGORIES: "/admin/categories",
-    FAQS: "/admin/faqs",
-    REVIEWS: "/admin/reviews",
-    COUPONS: "/admin/coupons",
-    MEDIA: "/admin/media",
-    PRODUCTS: "/admin/products",
-    ORDERS: "/admin/orders",
-    BIDS: "/admin/bids",
-    BLOG: "/admin/blog",
-    ANALYTICS: "/admin/analytics",
-    PAYOUTS: "/admin/payouts",
-    EVENTS: "/admin/events",
-    EVENT_ENTRIES: (id: string) => `/admin/events/${id}/entries`,
-    STORES: "/admin/stores",
-    FEATURE_FLAGS: "/admin/feature-flags",
-    COPILOT: "/admin/copilot",
-  },
-  DEMO: {
-    SEED: "/demo/seed",
-  },
-  BLOG: {
-    LIST: "/blog",
-    ARTICLE: (slug: string) => `/blog/${slug}`,
-  },
-} as const satisfies RouteMap;
-
-export function createRouteMap(overrides: Partial<RouteMap> = {}): RouteMap {
-  return {
-    ...DEFAULT_ROUTE_MAP,
-    ...overrides,
-    PUBLIC: {
-      ...DEFAULT_ROUTE_MAP.PUBLIC,
-      ...(overrides.PUBLIC ?? {}),
-    },
-    ERRORS: {
-      ...DEFAULT_ROUTE_MAP.ERRORS,
-      ...(overrides.ERRORS ?? {}),
-    },
-    AUTH: {
-      ...DEFAULT_ROUTE_MAP.AUTH,
-      ...(overrides.AUTH ?? {}),
-    },
-    USER: {
-      ...DEFAULT_ROUTE_MAP.USER,
-      ...(overrides.USER ?? {}),
-    },
-    SELLER: {
-      ...DEFAULT_ROUTE_MAP.SELLER,
-      ...(overrides.SELLER ?? {}),
-    },
-    ADMIN: {
-      ...DEFAULT_ROUTE_MAP.ADMIN,
-      ...(overrides.ADMIN ?? {}),
-    },
-    DEMO: {
-      ...DEFAULT_ROUTE_MAP.DEMO,
-      ...(overrides.DEMO ?? {}),
-    },
-    BLOG: {
-      ...DEFAULT_ROUTE_MAP.BLOG,
-      ...(overrides.BLOG ?? {}),
-    },
-  };
-}
-
-export const ROUTES = DEFAULT_ROUTE_MAP;
-
-export const PUBLIC_ROUTES = [
-  ROUTES.HOME,
-  ROUTES.PUBLIC.FAQS as string,
-  ROUTES.PUBLIC.PRODUCTS as string,
-  ROUTES.PUBLIC.AUCTIONS as string,
-  ROUTES.PUBLIC.PRE_ORDERS as string,
-  ROUTES.PUBLIC.SELLERS as string,
-  ROUTES.PUBLIC.STORES as string,
-  ROUTES.PUBLIC.CATEGORIES as string,
-  ROUTES.PUBLIC.SEARCH as string,
-  ROUTES.PUBLIC.PROMOTIONS as string,
-  ROUTES.PUBLIC.ABOUT as string,
-  ROUTES.PUBLIC.CONTACT as string,
-  ROUTES.PUBLIC.BLOG as string,
-  ROUTES.PUBLIC.HELP as string,
-  ROUTES.PUBLIC.TERMS as string,
-  ROUTES.PUBLIC.PRIVACY as string,
-  ROUTES.ERRORS.UNAUTHORIZED,
-  ROUTES.AUTH.LOGIN,
-  ROUTES.AUTH.REGISTER,
-  ROUTES.AUTH.FORGOT_PASSWORD,
-  ROUTES.AUTH.RESET_PASSWORD,
-  ROUTES.AUTH.VERIFY_EMAIL,
-] as const;
-
-export const PROTECTED_ROUTES = [
-  ROUTES.USER.PROFILE as string,
-  ROUTES.USER.SETTINGS as string,
-  ROUTES.USER.ORDERS as string,
-  ROUTES.USER.WISHLIST as string,
-  ROUTES.USER.ADDRESSES as string,
-  ROUTES.USER.ADDRESSES_ADD as string,
-  ROUTES.USER.NOTIFICATIONS as string,
-  ROUTES.USER.CART as string,
-] as const;
-
-export const AUTH_ROUTES = [ROUTES.AUTH.LOGIN, ROUTES.AUTH.REGISTER] as const;

package/src/providers/auth-firebase/browser-stub.ts

@@ -1,32 +0,0 @@
-/**
- * Browser stub for @mohasinac/appkit/providers/auth-firebase
- *
- * This file is served to the browser webpack build via the "browser"
- * condition in package.json exports.  All firebase-admin Auth code must
- * only run on the server; this stub exists solely to satisfy the
- * static-analysis graph without pulling any Node.js-only dependencies
- * into the client bundle.
- */
-
-/* eslint-disable @typescript-eslint/no-explicit-any */
-
-export const firebaseAuthProvider: any = null;
-export const firebaseSessionProvider: any = null;
-export function createSessionCookieFromToken(): never {
-  throw new Error("createSessionCookieFromToken is server-only");
-}
-export function verifyIdToken(): never {
-  throw new Error("verifyIdToken is server-only");
-}
-export function verifySessionCookie(): never {
-  throw new Error("verifySessionCookie is server-only");
-}
-export function createMiddlewareAuthChain(): never {
-  throw new Error("createMiddlewareAuthChain is server-only");
-}
-export function requireAuth(): never {
-  throw new Error("requireAuth is server-only");
-}
-export function requireRole(): never {
-  throw new Error("requireRole is server-only");
-}

package/src/providers/auth-firebase/helpers.ts

@@ -1,150 +0,0 @@
-/**
- * Server-side Firebase Auth helper functions.
- *
- * Drop-in replacements for the functions in `src/lib/firebase/auth-server.ts`.
- * All functions use the shared `getAdminAuth()` singleton from `@mohasinac/db-firebase`.
- */
-
-import type { AuthPayload } from "../../contracts";
-import { getAdminAuthLite } from "../db-firebase/admin-auth-lite";
-import { createSessionCookieFromToken } from "./session";
-
-export { createSessionCookieFromToken };
-
-const EXPECTED_AUTH_CODES = new Set([
-  "auth/argument-error",
-  "auth/id-token-expired",
-  "auth/id-token-revoked",
-  "auth/session-cookie-expired",
-  "auth/session-cookie-revoked",
-  "auth/user-disabled",
-  "auth/user-not-found",
-]);
-
-// ─── Token helpers ────────────────────────────────────────────────────────────
-
-/** Verify a Firebase ID token. Returns null for expected auth failures. */
-export async function verifyIdToken(
-  token: string,
-): Promise<AuthPayload | null> {
-  try {
-    const decoded = await getAdminAuthLite().verifyIdToken(token);
-    return {
-      uid: decoded.uid,
-      email: decoded.email ?? null,
-      role: (decoded.role as string | undefined) ?? "user",
-      emailVerified: decoded.email_verified ?? false,
-    };
-  } catch (err) {
-    if (!EXPECTED_AUTH_CODES.has((err as { code?: string }).code ?? "")) {
-      console.error(
-        "[@mohasinac/auth-firebase] Token verification failed:",
-        err,
-      );
-    }
-    return null;
-  }
-}
-
-/** Verify a Firebase session cookie. Returns null for expected auth failures. */
-export async function verifySessionCookie(
-  cookie: string,
-): Promise<AuthPayload | null> {
-  try {
-    const decoded = await getAdminAuthLite().verifySessionCookie(cookie, true);
-    return {
-      uid: decoded.uid,
-      email: decoded.email ?? null,
-      role: (decoded.role as string | undefined) ?? "user",
-      emailVerified: decoded.email_verified ?? false,
-    };
-  } catch (err) {
-    if (!EXPECTED_AUTH_CODES.has((err as { code?: string }).code ?? "")) {
-      console.error(
-        "[@mohasinac/auth-firebase] Session cookie verification failed:",
-        err,
-      );
-    }
-    return null;
-  }
-}
-
-/**
- * Create a middleware auth chain function.
- *
- * Returns an async function that reads the `__session` (or `idToken`) cookie
- * from a `RequestCookies`-like object and returns the decoded `AuthPayload`.
- *
- * @example
- * ```ts
- * import { createMiddlewareAuthChain } from "@mohasinac/auth-firebase";
- *
- * const getUser = createMiddlewareAuthChain();
- * const user = await getUser(request.cookies);
- * ```
- */
-export function createMiddlewareAuthChain() {
-  return async function getUser(cookies: {
-    get(name: string): { value: string } | undefined;
-  }): Promise<AuthPayload | null> {
-    const session = cookies.get("__session")?.value;
-    if (session) {
-      const user = await verifySessionCookie(session);
-      if (user) return user;
-    }
-
-    const idToken = cookies.get("idToken")?.value;
-    if (idToken) {
-      return verifyIdToken(idToken);
-    }
-
-    return null;
-  };
-}
-
-/**
- * Require a valid session — throws if not authenticated.
- *
- * @param cookies  `RequestCookies` from `request.cookies` (middleware) or
- *                 `await cookies()` from `next/headers` (RSC / API route).
- */
-export async function requireAuth(cookies: {
-  get(name: string): { value: string } | undefined;
-}): Promise<AuthPayload> {
-  const chain = createMiddlewareAuthChain();
-  const user = await chain(cookies);
-  if (!user) {
-    throw Object.assign(new Error("Unauthorized"), { statusCode: 401 });
-  }
-  return user;
-}
-
-/**
- * Require a specific role — throws 401/403 if not authenticated or wrong role.
- *
- * @param cookies  Cookie store (same as `requireAuth`).
- * @param role     A single role string or an array of allowed roles.
- * @param resolveRole  Optional async function to resolve the role from the DB.
- */
-export async function requireRole(
-  cookies: { get(name: string): { value: string } | undefined },
-  role: string | string[],
-  resolveRole?: (uid: string) => Promise<string>,
-): Promise<AuthPayload> {
-  const user = await requireAuth(cookies);
-  const allowed = Array.isArray(role) ? role : [role];
-
-  let userRole = user.role;
-  if (resolveRole) {
-    userRole = await resolveRole(user.uid);
-  }
-
-  if (!allowed.includes(userRole)) {
-    throw Object.assign(
-      new Error(`Forbidden — requires role: ${allowed.join(" | ")}`),
-      { statusCode: 403 },
-    );
-  }
-
-  return { ...user, role: userRole };
-}

package/src/providers/auth-firebase/index.ts

@@ -1,26 +0,0 @@
-/**
- * @mohasinac/auth-firebase
- *
- * Firebase Auth implementation of IAuthProvider + ISessionProvider
- * from @mohasinac/contracts.
- *
- * Server-side only — never import in browser/client-component code.
- */
-
-// IAuthProvider implementation
-export { firebaseAuthProvider } from "./provider";
-
-// ISessionProvider implementation
-export {
-  firebaseSessionProvider,
-  createSessionCookieFromToken,
-} from "./session";
-
-// Standalone helpers (drop-in replacements for auth-server.ts)
-export {
-  verifyIdToken,
-  verifySessionCookie,
-  createMiddlewareAuthChain,
-  requireAuth,
-  requireRole,
-} from "./helpers";

package/src/providers/auth-firebase/provider.ts

@@ -1,163 +0,0 @@
-/**
- * firebaseAuthProvider — IAuthProvider
- *
- * Implements `@mohasinac/contracts` `IAuthProvider` using the Firebase Admin SDK.
- * Server-side only.  Never import this in browser/client-component code.
- */
-
-import type {
-  IAuthProvider,
-  AuthPayload,
-  AuthUser,
-  CreateUserInput,
-} from "../../contracts";
-import { getAdminAuthLite } from "../db-firebase/admin-auth-lite";
-
-/** Firebase error codes that represent a normal "not authenticated" state. */
-const EXPECTED_AUTH_CODES = new Set([
-  "auth/argument-error",
-  "auth/id-token-expired",
-  "auth/id-token-revoked",
-  "auth/session-cookie-expired",
-  "auth/session-cookie-revoked",
-  "auth/user-disabled",
-  "auth/user-not-found",
-]);
-
-function isExpectedAuthError(err: unknown): boolean {
-  return EXPECTED_AUTH_CODES.has((err as { code?: string }).code ?? "");
-}
-
-function toAuthPayload(decoded: {
-  uid: string;
-  email?: string | null;
-  role?: string;
-  email_verified?: boolean;
-  [k: string]: unknown;
-}): AuthPayload {
-  return {
-    uid: decoded.uid,
-    email: decoded.email ?? null,
-    role: (decoded.role as string | undefined) ?? "user",
-    emailVerified: decoded.email_verified ?? false,
-    claims: Object.fromEntries(
-      Object.entries(decoded).filter(
-        ([k]) =>
-          ![
-            "uid",
-            "email",
-            "email_verified",
-            "iat",
-            "exp",
-            "aud",
-            "iss",
-            "sub",
-            "auth_time",
-            "firebase",
-          ].includes(k),
-      ),
-    ),
-  };
-}
-
-function toAuthUser(record: {
-  uid: string;
-  email?: string;
-  displayName?: string;
-  photoURL?: string;
-  emailVerified: boolean;
-  disabled: boolean;
-  metadata: { creationTime?: string };
-  customClaims?: Record<string, unknown>;
-}): AuthUser {
-  return {
-    uid: record.uid,
-    email: record.email ?? null,
-    displayName: record.displayName ?? null,
-    photoURL: record.photoURL ?? null,
-    role: (record.customClaims?.["role"] as string | undefined) ?? "user",
-    emailVerified: record.emailVerified,
-    disabled: record.disabled,
-    createdAt: record.metadata.creationTime ?? new Date(0).toISOString(),
-  };
-}
-
-export const firebaseAuthProvider: IAuthProvider = {
-  async verifyToken(token: string): Promise<AuthPayload> {
-    try {
-      const decoded = await getAdminAuthLite().verifyIdToken(token);
-      return toAuthPayload(decoded);
-    } catch (err) {
-      if (!isExpectedAuthError(err)) {
-        console.error(
-          "[@mohasinac/auth-firebase] Token verification failed:",
-          err,
-        );
-      }
-      throw err;
-    }
-  },
-
-  async createCustomToken(
-    uid: string,
-    claims?: Record<string, unknown>,
-  ): Promise<string> {
-    return getAdminAuthLite().createCustomToken(uid, claims);
-  },
-
-  async getUser(uid: string): Promise<AuthUser | null> {
-    try {
-      const record = await getAdminAuthLite().getUser(uid);
-      return toAuthUser(record);
-    } catch (err) {
-      if ((err as { code?: string }).code === "auth/user-not-found")
-        return null;
-      throw err;
-    }
-  },
-
-  async createUser(data: CreateUserInput): Promise<AuthUser> {
-    const record = await getAdminAuthLite().createUser({
-      email: data.email,
-      password: data.password,
-      displayName: data.displayName,
-      photoURL: data.photoURL,
-      emailVerified: data.emailVerified ?? false,
-    });
-    if (data.role) {
-      await getAdminAuthLite().setCustomUserClaims(record.uid, {
-        role: data.role,
-      });
-      // Re-fetch to get updated claims
-      const updated = await getAdminAuthLite().getUser(record.uid);
-      return toAuthUser(updated);
-    }
-    return toAuthUser(record);
-  },
-
-  async updateUser(
-    uid: string,
-    data: Partial<CreateUserInput>,
-  ): Promise<AuthUser> {
-    const record = await getAdminAuthLite().updateUser(uid, {
-      email: data.email,
-      password: data.password,
-      displayName: data.displayName,
-      photoURL: data.photoURL,
-      emailVerified: data.emailVerified,
-    });
-    if (data.role !== undefined) {
-      await getAdminAuthLite().setCustomUserClaims(uid, { role: data.role });
-    }
-    const updated = await getAdminAuthLite().getUser(record.uid);
-    return toAuthUser(updated);
-  },
-
-  async deleteUser(uid: string): Promise<void> {
-    await getAdminAuthLite().deleteUser(uid);
-  },
-
-  async revokeTokens(uid: string): Promise<void> {
-    await getAdminAuthLite().revokeRefreshTokens(uid);
-  },
-};