@payez/next-mvp 3.9.1 → 4.0.0

package/dist/routes/auth/logout.d.ts

@@ -1,31 +1,31 @@
-/**
- * Ready-to-Use Logout Route
- *
- * Provides a pre-configured logout handler that properly cleans up
- * sessions and revokes tokens.
- *
- * @example
- * ```typescript
- * // app/api/auth/logout/route.ts
- * export { POST } from '@payez/next-mvp/routes/auth/logout';
- * ```
- *
- * @version 2.0.0
- * @since auth-ready-v2
- */
-import { NextRequest, NextResponse } from 'next/server';
-/**
- * POST /api/auth/logout - Sign out and clean up session
- *
- * Performs complete logout:
- * 1. Revokes tokens at IDP (if refresh token available)
- * 2. Deletes session from store
- * 3. Clears NextAuth session cookie
- */
-export declare function POST(req: NextRequest): Promise<NextResponse<{
-    success: boolean;
-    message: string;
-}> | NextResponse<{
-    error: string;
-    details: string;
-}>>;
+/**
+ * Ready-to-Use Logout Route
+ *
+ * Provides a pre-configured logout handler that properly cleans up
+ * sessions and revokes tokens.
+ *
+ * @example
+ * ```typescript
+ * // app/api/auth/logout/route.ts
+ * export { POST } from '@payez/next-mvp/routes/auth/logout';
+ * ```
+ *
+ * @version 2.0.0
+ * @since auth-ready-v2
+ */
+import { NextRequest, NextResponse } from 'next/server';
+/**
+ * POST /api/auth/logout - Sign out and clean up session
+ *
+ * Performs complete logout:
+ * 1. Revokes tokens at IDP (if refresh token available)
+ * 2. Deletes session from store
+ * 3. Clears session cookies
+ */
+export declare function POST(req: NextRequest): Promise<NextResponse<{
+    success: boolean;
+    message: string;
+}> | NextResponse<{
+    error: string;
+    details: string;
+}>>;

package/dist/routes/auth/logout.js

@@ -1,113 +1,98 @@
-"use strict";
-/**
- * Ready-to-Use Logout Route
- *
- * Provides a pre-configured logout handler that properly cleans up
- * sessions and revokes tokens.
- *
- * @example
- * ```typescript
- * // app/api/auth/logout/route.ts
- * export { POST } from '@payez/next-mvp/routes/auth/logout';
- * ```
- *
- * @version 2.0.0
- * @since auth-ready-v2
- */
-Object.defineProperty(exports, "__esModule", { value: true });
-exports.POST = POST;
-const server_1 = require("next/server");
-const jwt_1 = require("next-auth/jwt");
-const session_store_1 = require("../../lib/session-store");
-const app_slug_1 = require("../../lib/app-slug");
-const idp_client_config_1 = require("../../lib/idp-client-config");
-const site_logger_1 = require("../../lib/site-logger");
-async function getConfig() {
-    const idpConfig = await (0, idp_client_config_1.getIDPClientConfig)();
-    const idpBaseUrl = process.env.IDP_URL;
-    if (!idpBaseUrl) {
-        throw new Error('[IDP_URL] FATAL: IDP_URL environment variable is REQUIRED.');
-    }
-    return {
-        nextAuthSecret: idpConfig.nextAuthSecret || '',
-        idpBaseUrl,
-        clientId: process.env.CLIENT_ID || process.env.NEXT_PUBLIC_IDP_CLIENT_ID || '',
-    };
-}
-/**
- * POST /api/auth/logout - Sign out and clean up session
- *
- * Performs complete logout:
- * 1. Revokes tokens at IDP (if refresh token available)
- * 2. Deletes session from store
- * 3. Clears NextAuth session cookie
- */
-async function POST(req) {
-    const { nextAuthSecret, idpBaseUrl, clientId } = await getConfig();
-    try {
-        const token = await (0, jwt_1.getToken)({ req, secret: nextAuthSecret, cookieName: (0, app_slug_1.getJwtCookieName)() });
-        if (!token) {
-            // Already logged out
-            return server_1.NextResponse.json({
-                success: true,
-                message: 'No active session'
-            });
-        }
-        // Support both field names: sessionToken (auth.ts JWT) and redisSessionId (legacy)
-        const sessionId = token.sessionToken || token.redisSessionId;
-        // Delete session from store (this also removes the refresh token)
-        if (sessionId) {
-            try {
-                await (0, session_store_1.deleteSession)(sessionId);
-                console.info('[LOGOUT_ROUTE] Session deleted from store');
-            }
-            catch (error) {
-                console.warn('[LOGOUT_ROUTE] Failed to delete session:', error);
-            }
-        }
-        // Log logout event (fire-and-forget)
-        const userId = token.sub || token.idpUserId;
-        if (userId) {
-            site_logger_1.siteEvents.logout({
-                user_id: userId,
-                session_id: sessionId,
-                trigger: 'user',
-                url: '/api/auth/logout',
-                user_agent: req.headers.get('user-agent') || undefined,
-                ip_address: (0, site_logger_1.getClientIp)(req.headers) || undefined,
-            });
-        }
-        // Build response that clears NextAuth cookies
-        const response = server_1.NextResponse.json({
-            success: true,
-            message: 'Logged out successfully'
-        });
-        // Clear NextAuth session cookies (using app-slug prefixed names)
-        const cookieNames = [
-            (0, app_slug_1.getSessionCookieName)(),
-            (0, app_slug_1.getSecureSessionCookieName)(),
-            (0, app_slug_1.getCsrfCookieName)(),
-            (0, app_slug_1.getSecureCsrfCookieName)(),
-            (0, app_slug_1.getCallbackUrlCookieName)(),
-            `__Secure-${(0, app_slug_1.getCallbackUrlCookieName)()}`,
-        ];
-        // Clear each cookie by setting it with maxAge 0
-        cookieNames.forEach(name => {
-            response.cookies.set(name, '', {
-                maxAge: 0,
-                path: '/',
-                httpOnly: true,
-                secure: process.env.NODE_ENV === 'production',
-                sameSite: 'lax'
-            });
-        });
-        return response;
-    }
-    catch (error) {
-        console.error('[LOGOUT_ROUTE] Error during logout:', error);
-        return server_1.NextResponse.json({
-            error: 'Failed to logout',
-            details: error instanceof Error ? error.message : 'Unknown error'
-        }, { status: 500 });
-    }
-}
+"use strict";
+/**
+ * Ready-to-Use Logout Route
+ *
+ * Provides a pre-configured logout handler that properly cleans up
+ * sessions and revokes tokens.
+ *
+ * @example
+ * ```typescript
+ * // app/api/auth/logout/route.ts
+ * export { POST } from '@payez/next-mvp/routes/auth/logout';
+ * ```
+ *
+ * @version 2.0.0
+ * @since auth-ready-v2
+ */
+Object.defineProperty(exports, "__esModule", { value: true });
+exports.POST = POST;
+const server_1 = require("next/server");
+const auth_1 = require("../../server/auth");
+const session_store_1 = require("../../lib/session-store");
+const app_slug_1 = require("../../lib/app-slug");
+const site_logger_1 = require("../../lib/site-logger");
+/**
+ * POST /api/auth/logout - Sign out and clean up session
+ *
+ * Performs complete logout:
+ * 1. Revokes tokens at IDP (if refresh token available)
+ * 2. Deletes session from store
+ * 3. Clears session cookies
+ */
+async function POST(req) {
+    try {
+        const session = await (0, auth_1.getSession)(req);
+        if (!session) {
+            // Already logged out
+            return server_1.NextResponse.json({
+                success: true,
+                message: 'No active session'
+            });
+        }
+        const sessionId = session.session?.token;
+        // Delete session from store (this also removes the refresh token)
+        if (sessionId) {
+            try {
+                await (0, session_store_1.deleteSession)(sessionId);
+                console.info('[LOGOUT_ROUTE] Session deleted from store');
+            }
+            catch (error) {
+                console.warn('[LOGOUT_ROUTE] Failed to delete session:', error);
+            }
+        }
+        // Log logout event (fire-and-forget)
+        const userId = session.user?.id;
+        if (userId) {
+            site_logger_1.siteEvents.logout({
+                user_id: userId,
+                session_id: sessionId,
+                trigger: 'user',
+                url: '/api/auth/logout',
+                user_agent: req.headers.get('user-agent') || undefined,
+                ip_address: (0, site_logger_1.getClientIp)(req.headers) || undefined,
+            });
+        }
+        // Build response that clears session cookies
+        const response = server_1.NextResponse.json({
+            success: true,
+            message: 'Logged out successfully'
+        });
+        // Clear NextAuth session cookies (using app-slug prefixed names)
+        const cookieNames = [
+            (0, app_slug_1.getSessionCookieName)(),
+            (0, app_slug_1.getSecureSessionCookieName)(),
+            (0, app_slug_1.getCsrfCookieName)(),
+            (0, app_slug_1.getSecureCsrfCookieName)(),
+            (0, app_slug_1.getCallbackUrlCookieName)(),
+            `__Secure-${(0, app_slug_1.getCallbackUrlCookieName)()}`,
+        ];
+        // Clear each cookie by setting it with maxAge 0
+        cookieNames.forEach(name => {
+            response.cookies.set(name, '', {
+                maxAge: 0,
+                path: '/',
+                httpOnly: true,
+                secure: process.env.NODE_ENV === 'production',
+                sameSite: 'lax'
+            });
+        });
+        return response;
+    }
+    catch (error) {
+        console.error('[LOGOUT_ROUTE] Error during logout:', error);
+        return server_1.NextResponse.json({
+            error: 'Failed to logout',
+            details: error instanceof Error ? error.message : 'Unknown error'
+        }, { status: 500 });
+    }
+}

package/dist/routes/auth/nextauth.d.ts

@@ -1,19 +1,22 @@
 /**
- * Ready-to-Use NextAuth Route Handler
+ * Ready-to-Use Auth Route Handler (Better Auth)
  *
- * Provides a pre-configured NextAuth handler that uses dynamic OAuth providers
- * loaded from IDP at startup via getAuthOptions().
+ * Provides a pre-configured Better Auth handler that uses dynamic OAuth providers
+ * loaded from IDP at startup.
  *
- * @version 2.2.0 - Dynamic provider loading from IDP
- * @since auth-ready-v2-hotfix
+ * Replaces the former NextAuth handler. The file name is kept as nextauth.ts
+ * to avoid breaking re-exports in routes/auth/index.ts.
+ *
+ * @version 4.0.0 - Better Auth migration
+ * @since better-auth-4.0
  */
 /**
- * GET handler for NextAuth
- * Uses async factory to get dynamic providers from IDP
+ * GET handler for auth routes
+ * Delegates to Better Auth instance.
  */
-export declare function GET(request: Request, context: any): Promise<any>;
+export declare function GET(request: Request): Promise<Response>;
 /**
- * POST handler for NextAuth
- * Uses async factory to get dynamic providers from IDP
+ * POST handler for auth routes
+ * Delegates to Better Auth instance.
  */
-export declare function POST(request: Request, context: any): Promise<any>;
+export declare function POST(request: Request): Promise<Response>;

package/dist/routes/auth/nextauth.js

@@ -1,72 +1,40 @@
 "use strict";
 /**
- * Ready-to-Use NextAuth Route Handler
+ * Ready-to-Use Auth Route Handler (Better Auth)
  *
- * Provides a pre-configured NextAuth handler that uses dynamic OAuth providers
- * loaded from IDP at startup via getAuthOptions().
+ * Provides a pre-configured Better Auth handler that uses dynamic OAuth providers
+ * loaded from IDP at startup.
  *
- * @version 2.2.0 - Dynamic provider loading from IDP
- * @since auth-ready-v2-hotfix
+ * Replaces the former NextAuth handler. The file name is kept as nextauth.ts
+ * to avoid breaking re-exports in routes/auth/index.ts.
+ *
+ * @version 4.0.0 - Better Auth migration
+ * @since better-auth-4.0
  */
-var __importDefault = (this && this.__importDefault) || function (mod) {
-    return (mod && mod.__esModule) ? mod : { "default": mod };
-};
 Object.defineProperty(exports, "__esModule", { value: true });
 exports.GET = GET;
 exports.POST = POST;
-const next_auth_1 = __importDefault(require("next-auth"));
-const auth_options_1 = require("../../auth/auth-options");
-// Cached handler - built once with dynamic providers
-let cachedHandler = null;
-let handlerPromise = null;
+const better_auth_1 = require("../../auth/better-auth");
+const server_1 = require("next/server");
 /**
- * Get or build the NextAuth handler with dynamic providers.
- * Uses caching to avoid rebuilding on every request.
+ * GET handler for auth routes
+ * Delegates to Better Auth instance.
  */
-async function getHandler() {
-    // Return cached if available
-    if (cachedHandler) {
-        return cachedHandler;
-    }
-    // Prevent concurrent builds
-    if (handlerPromise) {
-        return handlerPromise;
+async function GET(request) {
+    const handler = await (0, better_auth_1.getBetterAuthHandler)();
+    if (!handler) {
+        return server_1.NextResponse.json({ error: 'Auth handler not available' }, { status: 503 });
     }
-    handlerPromise = (async () => {
-        try {
-            // Try to get dynamic auth options from IDP
-            const options = await (0, auth_options_1.getAuthOptions)();
-            console.log('[NEXTAUTH_ROUTE] Built handler with dynamic providers');
-            cachedHandler = (0, next_auth_1.default)(options);
-            return cachedHandler;
-        }
-        catch (error) {
-            // Fallback to static options if IDP unavailable
-            console.warn('[NEXTAUTH_ROUTE] Failed to get dynamic options, using static fallback:', {
-                error: error instanceof Error ? error.message : String(error)
-            });
-            cachedHandler = (0, next_auth_1.default)(auth_options_1.authOptions);
-            return cachedHandler;
-        }
-        finally {
-            handlerPromise = null;
-        }
-    })();
-    return handlerPromise;
-}
-/**
- * GET handler for NextAuth
- * Uses async factory to get dynamic providers from IDP
- */
-async function GET(request, context) {
-    const handler = await getHandler();
-    return handler(request, context);
+    return handler.GET(request);
 }
 /**
- * POST handler for NextAuth
- * Uses async factory to get dynamic providers from IDP
+ * POST handler for auth routes
+ * Delegates to Better Auth instance.
  */
-async function POST(request, context) {
-    const handler = await getHandler();
-    return handler(request, context);
+async function POST(request) {
+    const handler = await (0, better_auth_1.getBetterAuthHandler)();
+    if (!handler) {
+        return server_1.NextResponse.json({ error: 'Auth handler not available' }, { status: 503 });
+    }
+    return handler.POST(request);
 }