@payez/next-mvp 3.2.2 → 3.2.3

package/dist/middleware/create-middleware.d.ts

@@ -96,5 +96,7 @@ export interface MvpMiddlewareOptions {
     onRefreshFailure?: (status: number, isNetworkError: boolean) => void;
     /** Additional paths to bypass middleware (beyond /api/auth/ and /api/session/) */
     bypassPaths?: string[];
+    /** Paths exempt from RBAC checks (auth still enforced, just no page-permission check) */
+    rbacExemptPaths?: string[];
 }
 export declare function createMvpMiddleware(options?: MvpMiddlewareOptions): (request: NextRequest) => Promise<NextResponse>;

package/dist/middleware/create-middleware.js

@@ -232,6 +232,7 @@ function createMvpMiddleware(options = {}) {
     const viabilityEndpoint = options.viabilityEndpoint || '/api/session/viability';
     const refreshEndpoint = options.refreshEndpoint || '/api/auth/refresh';
     const bypassPaths = options.bypassPaths || [];
+    const rbacExemptPaths = options.rbacExemptPaths || [];
     return async function middleware(request) {
         const { pathname, searchParams } = request.nextUrl;
         // =========================================================================
@@ -287,6 +288,7 @@ function createMvpMiddleware(options = {}) {
             circuitBreaker: cb,
             logger: log,
             refreshEndpoint,
+            rbacExemptPaths,
             onRefreshSuccess: options.onRefreshSuccess,
             onRefreshFailure: options.onRefreshFailure,
         });
@@ -351,7 +353,7 @@ async function executeDecision(request, decision, pathname, sessionPointer, sess
     const safeCallback = getSafeCallbackUrl(pathname);
     switch (decision.type) {
         case 'allow':
-            return handleAllow(request, pathname, sessionPointer, sessionStatus);
+            return handleAllow(request, pathname, sessionPointer, sessionStatus, opts.rbacExemptPaths);
         case 'redirect':
             return redirectTo(request, decision.location, decision.clearCookies);
         case 'service_error':
@@ -363,11 +365,12 @@ async function executeDecision(request, decision, pathname, sessionPointer, sess
 /** Paths that must never be RBAC-checked (they are RBAC redirect targets) */
 const RBAC_EXEMPT_PATHS = ['/error', '/unauthorized', '/service-unavailable'];
 /** Handle 'allow' decision - run RBAC if enabled */
-async function handleAllow(request, pathname, sessionPointer, sessionStatus) {
+async function handleAllow(request, pathname, sessionPointer, sessionStatus, rbacExemptPaths = []) {
     const isPublic = (0, route_config_1.isUnauthenticatedRoute)(pathname);
     if ((0, rbac_check_1.isRBACEnabled)() && !isPublic && sessionPointer.exists) {
-        // Skip RBAC for error/fallback pages to prevent redirect loops
-        if (RBAC_EXEMPT_PATHS.some(p => pathname.startsWith(p))) {
+        // Skip RBAC for error/fallback pages (prevent redirect loops) and app-configured exempt paths
+        if (RBAC_EXEMPT_PATHS.some(p => pathname.startsWith(p)) ||
+            rbacExemptPaths.some(p => pathname.startsWith(p))) {
             return server_1.NextResponse.next();
         }
         if (!sessionPointer.clientId) {

package/package.json

@@ -1,6 +1,6 @@
 {
   "name": "@payez/next-mvp",
-  "version": "3.2.2",
+  "version": "3.2.3",
   "sideEffects": false,
   "main": "dist/index.js",
   "types": "dist/index.d.ts",

package/src/middleware/create-middleware.ts

@@ -108,6 +108,8 @@ export interface MvpMiddlewareOptions {
   onRefreshFailure?: (status: number, isNetworkError: boolean) => void;
   /** Additional paths to bypass middleware (beyond /api/auth/ and /api/session/) */
   bypassPaths?: string[];
+  /** Paths exempt from RBAC checks (auth still enforced, just no page-permission check) */
+  rbacExemptPaths?: string[];
 }
 
 // =============================================================================
@@ -336,6 +338,7 @@ export function createMvpMiddleware(options: MvpMiddlewareOptions = {}) {
   const viabilityEndpoint = options.viabilityEndpoint || '/api/session/viability';
   const refreshEndpoint = options.refreshEndpoint || '/api/auth/refresh';
   const bypassPaths = options.bypassPaths || [];
+  const rbacExemptPaths = options.rbacExemptPaths || [];
 
   return async function middleware(request: NextRequest): Promise<NextResponse> {
     const { pathname, searchParams } = request.nextUrl;
@@ -400,6 +403,7 @@ export function createMvpMiddleware(options: MvpMiddlewareOptions = {}) {
       circuitBreaker: cb,
       logger: log,
       refreshEndpoint,
+      rbacExemptPaths,
       onRefreshSuccess: options.onRefreshSuccess,
       onRefreshFailure: options.onRefreshFailure,
     });
@@ -474,6 +478,7 @@ interface ExecuteOptions {
   circuitBreaker: CircuitBreakerProvider;
   logger: MiddlewareLogger;
   refreshEndpoint: string;
+  rbacExemptPaths: string[];
   onRefreshSuccess?: () => void;
   onRefreshFailure?: (status: number, isNetworkError: boolean) => void;
 }
@@ -491,7 +496,7 @@ async function executeDecision(
 
   switch (decision.type) {
     case 'allow':
-      return handleAllow(request, pathname, sessionPointer, sessionStatus);
+      return handleAllow(request, pathname, sessionPointer, sessionStatus, opts.rbacExemptPaths);
 
     case 'redirect':
       return redirectTo(request, decision.location, decision.clearCookies);
@@ -512,13 +517,15 @@ async function handleAllow(
   request: NextRequest,
   pathname: string,
   sessionPointer: SessionPointer,
-  sessionStatus: SessionStatus
+  sessionStatus: SessionStatus,
+  rbacExemptPaths: string[] = []
 ): Promise<NextResponse> {
   const isPublic = isUnauthenticatedRoute(pathname);
 
   if (isRBACEnabled() && !isPublic && sessionPointer.exists) {
-    // Skip RBAC for error/fallback pages to prevent redirect loops
-    if (RBAC_EXEMPT_PATHS.some(p => pathname.startsWith(p))) {
+    // Skip RBAC for error/fallback pages (prevent redirect loops) and app-configured exempt paths
+    if (RBAC_EXEMPT_PATHS.some(p => pathname.startsWith(p)) ||
+        rbacExemptPaths.some(p => pathname.startsWith(p))) {
       return NextResponse.next();
     }