@mostajs/auth-lite 0.1.0 → 0.1.1

package/dist/index.js

@@ -1,14 +1,14 @@
 import { createHash, randomBytes, timingSafeEqual } from 'crypto';
-import { baseFromHeaders } from '@mostajs/url';
 /**
- * Base PUBLIQUE (`proto://host`) pour les redirects. En WebContainer
- * (StackBlitz/Bolt) ou derrière un reverse proxy, `req.url` côté Node pointe
- * sur le bind interne (`http://localhost:3000`) → l'utilisateur serait redirigé
- * vers localhost. `baseFromHeaders` lit l'hôte public réel depuis
- * `X-Forwarded-Host`/`Host` ; fallback sur l'origine de `req.url`.
+ * Réponse 303 avec un `Location` **relatif** (ex. `/dashboard`). Le navigateur
+ * le résout contre l'URL PUBLIQUE de la requête courante → fonctionne en
+ * WebContainer (StackBlitz/Bolt — qui ne transmettent pas l'hôte public au
+ * serveur), derrière un reverse proxy, et en localhost, **sans que le serveur
+ * ait besoin de connaître son hôte**. Plus robuste qu'une URL absolue.
  */
-function reqBase(req) {
-    return baseFromHeaders(req.headers) ?? new URL(req.url).origin;
+async function see(location) {
+    const { NextResponse } = await import('next/server');
+    return new NextResponse(null, { status: 303, headers: { Location: location } });
 }
 // ---------------------------------------------------------------------------
 // Password hashing — salted, iterated SHA-256 (no native addon, boots anywhere)
@@ -59,48 +59,44 @@ export function createAuthHandlers(config) {
     const afterLogout = config.afterLogout ?? '/';
     const loginError = config.loginErrorPath ?? '/login?error=invalid';
     const signupError = config.signupErrorPath ?? ((k) => `/signup?error=${k}`);
-    async function startSession(req, sessions, userId) {
-        const { NextResponse } = await import('next/server');
+    async function startSession(sessions, userId) {
         const token = randomBytes(32).toString('hex');
         const expiresAt = new Date(Date.now() + ttlMs);
         await sessions.create({ token, user: userId, expiresAt });
-        const res = NextResponse.redirect(new URL(afterAuth, reqBase(req)), 303);
+        const res = await see(afterAuth);
         res.cookies.set(cookie, token, { httpOnly: true, sameSite: 'lax', path: '/', expires: expiresAt });
         return res;
     }
     /** POST handler — verify credentials, start a session. */
     async function login(req) {
-        const { NextResponse } = await import('next/server');
         const form = await req.formData();
         const email = String(form.get('email') ?? '').toLowerCase().trim();
         const password = String(form.get('password') ?? '');
         const { users, sessions } = await config.getRepos();
         const user = await users.findOne({ email });
         if (!user || !verifyPassword(password, user.passwordHash)) {
-            return NextResponse.redirect(new URL(loginError, reqBase(req)), 303);
+            return see(loginError);
         }
-        return startSession(req, sessions, user.id);
+        return startSession(sessions, user.id);
     }
     /** POST handler — create the account, start a session. */
     async function signup(req) {
-        const { NextResponse } = await import('next/server');
         const form = await req.formData();
         const email = String(form.get('email') ?? '').toLowerCase().trim();
         const name = String(form.get('name') ?? '').trim();
         const password = String(form.get('password') ?? '');
         if (!email || !name || password.length < 6) {
-            return NextResponse.redirect(new URL(signupError('invalid'), reqBase(req)), 303);
+            return see(signupError('invalid'));
         }
         const { users, sessions } = await config.getRepos();
         if (await users.findOne({ email })) {
-            return NextResponse.redirect(new URL(signupError('exists'), reqBase(req)), 303);
+            return see(signupError('exists'));
         }
         const user = await users.create({ email, name, passwordHash: hashPassword(password) });
-        return startSession(req, sessions, user.id);
+        return startSession(sessions, user.id);
     }
     /** POST handler — destroy the session (DB + cookie). */
     async function logout(req) {
-        const { NextResponse } = await import('next/server');
         const token = req.cookies.get(cookie)?.value;
         if (token) {
             const { sessions } = await config.getRepos();
@@ -108,7 +104,7 @@ export function createAuthHandlers(config) {
             if (session)
                 await sessions.delete(session.id);
         }
-        const res = NextResponse.redirect(new URL(afterLogout, reqBase(req)), 303);
+        const res = await see(afterLogout);
         res.cookies.delete(cookie);
         return res;
     }

package/package.json

@@ -1,6 +1,6 @@
 {
   "name": "@mostajs/auth-lite",
-  "version": "0.1.0",
+  "version": "0.1.1",
   "description": "Minimal email/password + session auth for Next.js on @mostajs/orm. No native addon — boots in Bolt.new / StackBlitz / edge.",
   "license": "AGPL-3.0-or-later",
   "author": "Dr Hamid MADANI <drmdh@msn.com>",
@@ -57,8 +57,5 @@
   "funding": {
     "type": "github",
     "url": "https://github.com/sponsors/apolocine"
-  },
-  "dependencies": {
-    "@mostajs/url": "^0.5.0"
   }
 }