@oauth42/next 0.4.7 → 0.5.0

package/dist/server/index.mjs

@@ -116,12 +116,72 @@ function withOAuth42ServerSideProps(getServerSideProps, authOptions) {
   };
 }
 
+// src/server/backend-session.ts
+function isBackendSessionMode(mode) {
+  return mode === "backend";
+}
+function sessionEndpoint(issuer) {
+  return `${issuer.replace(/\/$/, "")}/api/sdk/sessions`;
+}
+async function createBackendSession(params) {
+  const response = await fetch(sessionEndpoint(params.issuer), {
+    method: "POST",
+    headers: { "Content-Type": "application/json" },
+    body: JSON.stringify({
+      access_token: params.accessToken,
+      refresh_token: params.refreshToken,
+      expires_at: params.expiresAt ?? Math.floor(Date.now() / 1e3) + 3600,
+      id_token: params.idToken,
+      client_id: params.clientId,
+      client_secret: params.clientSecret,
+      issuer: params.issuer,
+      user: params.user
+    })
+  });
+  if (!response.ok) {
+    throw new Error(`OAuth42 backend session create failed: ${response.status}`);
+  }
+  return response.json();
+}
+async function resolveBackendSession(params) {
+  const response = await fetch(`${sessionEndpoint(params.issuer)}/resolve`, {
+    method: "POST",
+    headers: { "Content-Type": "application/json" },
+    body: JSON.stringify({
+      session_id: params.sessionId,
+      client_id: params.clientId,
+      client_secret: params.clientSecret,
+      issuer: params.issuer
+    })
+  });
+  if (response.status === 401 || response.status === 403 || response.status === 404) {
+    return null;
+  }
+  if (!response.ok) {
+    throw new Error(`OAuth42 backend session resolve failed: ${response.status}`);
+  }
+  return response.json();
+}
+async function revokeBackendSession(params) {
+  await fetch(sessionEndpoint(params.issuer), {
+    method: "DELETE",
+    headers: { "Content-Type": "application/json" },
+    body: JSON.stringify({
+      session_id: params.sessionId,
+      client_id: params.clientId,
+      client_secret: params.clientSecret
+    })
+  });
+}
+
 // src/server/auth.ts
 var NextAuth = NextAuthDefault.default || NextAuthDefault;
 var activeRefresh = null;
 function createAuth(options = {}) {
   const clientId = options.clientId || process.env.OAUTH42_CLIENT_ID;
   const clientSecret = options.clientSecret || process.env.OAUTH42_CLIENT_SECRET;
+  const issuer = options.issuer || process.env.NEXT_PUBLIC_OAUTH_ISSUER || process.env.OAUTH42_ISSUER || "https://localhost:8443";
+  const useBackendSessions = isBackendSessionMode(options.sessionStore);
   if (!clientId || !clientSecret) {
     throw new Error(
       "OAuth42 client credentials are required. Set OAUTH42_CLIENT_ID and OAUTH42_CLIENT_SECRET environment variables or pass them in the options."
@@ -132,7 +192,7 @@ function createAuth(options = {}) {
       OAuth42Provider({
         clientId,
         clientSecret,
-        issuer: options.issuer,
+        issuer,
         scopes: options.scopes,
         pkceEnabled: options.pkceEnabled
       })
@@ -141,14 +201,41 @@ function createAuth(options = {}) {
       async jwt({ token, account, profile }) {
         console.log("[OAuth42 SDK] JWT callback called", { hasAccount: !!account, hasProfile: !!profile });
         if (account) {
-          console.log("[OAuth42 SDK] Initial sign in - storing tokens in JWT");
-          token.accessToken = account.access_token;
-          token.refreshToken = account.refresh_token;
-          token.expiresAt = account.expires_at;
-          token.idToken = account.id_token;
-          token.clientId = clientId;
-          token.clientSecret = clientSecret;
-          token.issuer = options.issuer || process.env.NEXT_PUBLIC_OAUTH_ISSUER || process.env.OAUTH42_ISSUER;
+          if (useBackendSessions) {
+            if (!account.access_token || !account.refresh_token) {
+              throw new Error("OAuth42 backend sessions require access and refresh tokens");
+            }
+            const oauth42Profile = profile;
+            const backendSession = await createBackendSession({
+              issuer,
+              clientId,
+              clientSecret,
+              accessToken: account.access_token,
+              refreshToken: account.refresh_token,
+              expiresAt: account.expires_at,
+              idToken: account.id_token,
+              user: {
+                sub: oauth42Profile?.sub,
+                email: oauth42Profile?.email,
+                username: oauth42Profile?.username,
+                name: token.name,
+                emailVerified: oauth42Profile?.email_verified,
+                groups: oauth42Profile?.groups
+              }
+            });
+            token.oauth42SessionId = backendSession.session_id;
+            token.expiresAt = backendSession.expires_at;
+            token.issuer = issuer;
+          } else {
+            console.log("[OAuth42 SDK] Initial sign in - storing tokens in JWT");
+            token.accessToken = account.access_token;
+            token.refreshToken = account.refresh_token;
+            token.expiresAt = account.expires_at;
+            token.idToken = account.id_token;
+            token.clientId = clientId;
+            token.clientSecret = clientSecret;
+            token.issuer = issuer;
+          }
         }
         if (profile) {
           const oauth42Profile = profile;
@@ -165,12 +252,40 @@ function createAuth(options = {}) {
       },
       async session({ session, token }) {
         console.log("[OAuth42 SDK] Session callback called", { hasToken: !!token, hasSession: !!session });
-        session.accessToken = token.accessToken;
-        session.idToken = token.idToken;
+        if (useBackendSessions) {
+          const sessionId = token.oauth42SessionId;
+          if (!sessionId) {
+            session.error = "SessionRevoked";
+            return session;
+          }
+          const backendSession = await resolveBackendSession({
+            issuer,
+            clientId,
+            clientSecret,
+            sessionId
+          });
+          if (!backendSession) {
+            session.error = "SessionRevoked";
+            return session;
+          }
+          session.accessToken = backendSession.access_token;
+          session.idToken = backendSession.id_token;
+          token.expiresAt = backendSession.expires_at;
+          if (backendSession.user && session.user) {
+            session.user.email = backendSession.user.email;
+            session.user.name = backendSession.user.name;
+            session.user.username = backendSession.user.username;
+            session.user.emailVerified = backendSession.user.emailVerified;
+            session.user.groups = backendSession.user.groups;
+          }
+        } else {
+          session.accessToken = token.accessToken;
+          session.idToken = token.idToken;
+        }
         if (token.error) {
           session.error = token.error;
         }
-        if (session.user) {
+        if (!useBackendSessions && session.user) {
           session.user.email = token.email;
           session.user.name = token.name;
           session.user.username = token.username;
@@ -194,6 +309,26 @@ function createAuth(options = {}) {
       strategy: "jwt",
       ...options.session
     },
+    events: {
+      async signOut(message) {
+        if (useBackendSessions) {
+          const sessionId = message.token?.oauth42SessionId;
+          if (sessionId) {
+            await revokeBackendSession({
+              issuer,
+              clientId,
+              clientSecret,
+              sessionId
+            }).catch((error) => {
+              console.warn("[OAuth42 SDK] Failed to revoke backend session on signOut:", error);
+            });
+          }
+        }
+        if (options.events?.signOut) {
+          await options.events.signOut(message);
+        }
+      }
+    },
     debug: options.debug || process.env.NODE_ENV === "development",
     secret: process.env.NEXTAUTH_SECRET,
     // Configure unique cookie names per app to prevent session conflicts on localhost
@@ -226,7 +361,11 @@ function createAuth(options = {}) {
             secure: process.env.NODE_ENV === "production"
           }
         },
-        // PKCE code_verifier cookie - essential for PKCE flow
+        // PKCE code_verifier cookie - essential for PKCE flow.
+        // TTL covers the full OAuth round-trip including user-in-the-loop steps
+        // like passkey ceremonies, MFA enrollment, and any debugging pauses.
+        // The previous 15-minute value was too tight for realistic ceremony-
+        // heavy flows — see #524 for the incident where state expired mid-debug.
         pkceCodeVerifier: {
           name: `${options.cookiePrefix}.pkce.code_verifier`,
           options: {
@@ -234,11 +373,13 @@ function createAuth(options = {}) {
             sameSite: "lax",
             path: "/",
             secure: process.env.NODE_ENV === "production",
-            maxAge: 900
-            // 15 minutes
+            maxAge: 3600
+            // 1 hour (was 900 — 15 min was too short for passkey/MFA flows)
           }
         },
-        // State cookie for OAuth CSRF protection
+        // State cookie for OAuth CSRF protection. Same TTL rationale as
+        // pkceCodeVerifier above. State is single-use CSRF and cannot be
+        // replayed, so a longer TTL does not weaken the security story.
         state: {
           name: `${options.cookiePrefix}.state`,
           options: {
@@ -246,8 +387,8 @@ function createAuth(options = {}) {
             sameSite: "lax",
             path: "/",
             secure: process.env.NODE_ENV === "production",
-            maxAge: 900
-            // 15 minutes
+            maxAge: 3600
+            // 1 hour (was 900 — 15 min was too short for passkey/MFA flows)
           }
         },
         // Nonce cookie for OpenID Connect
@@ -341,7 +482,22 @@ import { getToken, encode } from "next-auth/jwt";
 var ALLOWED_COOKIE_SIZE = 4096;
 var ESTIMATED_EMPTY_COOKIE_SIZE = 163;
 var CHUNK_SIZE = ALLOWED_COOKIE_SIZE - ESTIMATED_EMPTY_COOKIE_SIZE;
+var REFRESH_RACE_GRACE_SECONDS = 60;
+var DEFAULT_SESSION_MAX_AGE_SECONDS = 365 * 24 * 60 * 60;
 var pendingRefreshes = /* @__PURE__ */ new Map();
+function shouldPreserveSessionOnRefreshFailure(params) {
+  if (params.error !== "invalid_grant" || !params.expiresAt) {
+    return false;
+  }
+  return params.now - params.expiresAt <= REFRESH_RACE_GRACE_SECONDS;
+}
+function resolveRefreshConfig(options, token) {
+  return {
+    clientId: options.clientId || token.clientId || process.env.OAUTH42_CLIENT_ID,
+    clientSecret: options.clientSecret || token.clientSecret || process.env.OAUTH42_CLIENT_SECRET,
+    issuer: options.issuer || token.issuer || process.env.OAUTH42_ISSUER || "https://localhost:8443"
+  };
+}
 async function refreshTokens(refreshToken, clientId, clientSecret, issuer) {
   try {
     const tokenUrl = `${issuer}/oauth2/token`;
@@ -376,9 +532,6 @@ async function refreshTokens(refreshToken, clientId, clientSecret, issuer) {
 }
 function withOAuth42Auth(options = {}) {
   const secret = process.env.NEXTAUTH_SECRET;
-  const clientId = process.env.OAUTH42_CLIENT_ID;
-  const clientSecret = process.env.OAUTH42_CLIENT_SECRET;
-  const issuer = process.env.OAUTH42_ISSUER || "https://localhost:8443";
   if (!secret) {
     console.warn("[OAuth42 Middleware] NEXTAUTH_SECRET not set");
   }
@@ -403,6 +556,42 @@ function withOAuth42Auth(options = {}) {
       url.searchParams.set("callbackUrl", pathname);
       return NextResponse.redirect(url);
     }
+    const refreshConfig = resolveRefreshConfig(options, token);
+    if (isBackendSessionMode(options.sessionStore)) {
+      const sessionId = token.oauth42SessionId;
+      if (!sessionId || !refreshConfig.clientId || !refreshConfig.clientSecret) {
+        const signInUrl = options.pages?.signIn || "/auth/signin";
+        const url = new URL(signInUrl, req.url);
+        url.searchParams.set("callbackUrl", pathname);
+        const response = NextResponse.redirect(url);
+        response.cookies.delete(cookieName);
+        return response;
+      }
+      const backendSession = await resolveBackendSession({
+        issuer: refreshConfig.issuer,
+        clientId: refreshConfig.clientId,
+        clientSecret: refreshConfig.clientSecret,
+        sessionId
+      }).catch((error) => {
+        console.error("[OAuth42 Middleware] Backend session resolve failed:", error);
+        return null;
+      });
+      if (!backendSession) {
+        const signInUrl = options.pages?.signIn || "/auth/signin";
+        const url = new URL(signInUrl, req.url);
+        url.searchParams.set("callbackUrl", pathname);
+        const response = NextResponse.redirect(url);
+        response.cookies.delete(cookieName);
+        return response;
+      }
+      const requestHeaders = new Headers(req.headers);
+      requestHeaders.set("x-oauth42-refreshed-token", backendSession.access_token);
+      return NextResponse.next({
+        request: {
+          headers: requestHeaders
+        }
+      });
+    }
     const expiresAt = token.expiresAt;
     const now = Math.floor(Date.now() / 1e3);
     const bufferSeconds = 15;
@@ -416,7 +605,7 @@ function withOAuth42Auth(options = {}) {
         path: pathname
       });
     }
-    if (needsRefresh && token.refreshToken && clientId && clientSecret) {
+    if (needsRefresh && token.refreshToken && refreshConfig.clientId && refreshConfig.clientSecret) {
       const userId = token.sub;
       let refreshPromise = pendingRefreshes.get(userId);
       if (refreshPromise) {
@@ -425,11 +614,14 @@ function withOAuth42Auth(options = {}) {
         console.log("[OAuth42 Middleware] Access token expired, refreshing...");
         refreshPromise = refreshTokens(
           token.refreshToken,
-          clientId,
-          clientSecret,
-          issuer
+          refreshConfig.clientId,
+          refreshConfig.clientSecret,
+          refreshConfig.issuer
         ).finally(() => {
-          setTimeout(() => pendingRefreshes.delete(userId), 3e4);
+          const cleanupTimer = setTimeout(() => pendingRefreshes.delete(userId), 3e4);
+          if (typeof cleanupTimer === "object" && "unref" in cleanupTimer) {
+            cleanupTimer.unref();
+          }
         });
         pendingRefreshes.set(userId, refreshPromise);
       }
@@ -456,7 +648,8 @@ function withOAuth42Auth(options = {}) {
           httpOnly: true,
           sameSite: "lax",
           path: "/",
-          secure: process.env.NODE_ENV === "production"
+          secure: process.env.NODE_ENV === "production",
+          maxAge: options.session?.maxAge ?? DEFAULT_SESSION_MAX_AGE_SECONDS
         };
         if (newJwt.length <= CHUNK_SIZE) {
           response.cookies.set(cookieName, newJwt, cookieOptions);
@@ -504,7 +697,23 @@ function withOAuth42Auth(options = {}) {
         });
         return response;
       } else {
-        console.log("[OAuth42 Middleware] Refresh failed (likely token blacklisted after deploy), clearing session");
+        if (shouldPreserveSessionOnRefreshFailure({
+          error: refreshed.error,
+          expiresAt,
+          now
+        })) {
+          console.warn(
+            "[OAuth42 Middleware] Refresh failed with invalid_grant for a recently expired token; preserving session cookie for likely parallel refresh race",
+            {
+              expiresAt,
+              now,
+              expiredAgo: now - expiresAt,
+              path: pathname
+            }
+          );
+          return NextResponse.next();
+        }
+        console.log("[OAuth42 Middleware] Refresh failed, clearing session");
         const signInUrl = options.pages?.signIn || "/auth/signin";
         const url = new URL(signInUrl, req.url);
         url.searchParams.set("callbackUrl", pathname);
@@ -650,12 +859,15 @@ export {
   default2 as NextAuth,
   OAuth42Provider,
   createAuth,
+  createBackendSession,
   createHandlers,
   createHostedAuthCallback,
   createMiddlewareConfig,
   getOAuth42Session,
   getServerSession,
   refreshAccessToken,
+  resolveBackendSession,
+  revokeBackendSession,
   withOAuth42Auth,
   withOAuth42ServerSideProps,
   withOAuth42Session