@payez/next-mvp 3.9.1 → 4.0.1

package/dist/auth/auth-options.js

@@ -1,213 +0,0 @@
-"use strict";
-/**
- * NextAuth Configuration (Refactored)
- *
- * This is the composition layer that wires together all auth modules.
- * Individual logic lives in dedicated modules:
- * - providers/ - Credentials and OAuth provider builders
- * - callbacks/ - JWT, session, signIn callbacks
- * - events/ - SignOut event handler
- * - utils/ - Token utilities, IDP client
- * - types/ - Type definitions
- *
- * CARGO CULT PATTERNS REMOVED:
- * ============================
- * The original auth-options.ts (1186 lines) had several anti-patterns that
- * added complexity without benefit:
- *
- * 1. CALLBACK CONCURRENCY PROTECTION (removed)
- *    - shouldExecuteCallback() / markCallbackComplete()
- *    - A debouncing mechanism that tried to prevent callbacks from running
- *      too frequently. NextAuth already handles this properly.
- *    - Added complexity, caused race condition bugs, and leaked memory
- *      (Map entries never cleaned up).
- *
- * 2. SESSION RESTORATION (removed)
- *    - attemptSessionRestoration()
- *    - Tried to restore sessions by calling refresh endpoint from JWT callback.
- *    - Created circular dependencies and made debugging impossible.
- *    - Clean approach: Session missing = user re-authenticates. Simple.
- *
- * 3. VARIABLE NAME SOUP (normalized in Phase 3)
- *    - accessToken vs idpAccessToken vs oauthAccessToken
- *    - twoFactorComplete vs mfaVerified vs requiresTwoFactor
- *    - sessionToken vs redisSessionId
- *    - Now: Clear prefixes (idp*, oauth*, mfa*) with documented meanings.
- *
- * 4. INLINE EVERYTHING (modularized in Phase 2)
- *    - All logic was in one giant file with no separation of concerns.
- *    - Now: Each module has one job and can be tested independently.
- *
- * @version 2.0.0
- * @since auth-refactor-2026-01
- */
-Object.defineProperty(exports, "__esModule", { value: true });
-exports.authOptions = void 0;
-exports.getAuthOptions = getAuthOptions;
-exports.clearAuthOptionsCache = clearAuthOptionsCache;
-const jwt_1 = require("next-auth/jwt");
-const idp_client_config_1 = require("../lib/idp-client-config");
-const app_slug_1 = require("../lib/app-slug");
-// Module imports
-const providers_1 = require("./providers");
-const callbacks_1 = require("./callbacks");
-const events_1 = require("./events");
-// ============================================================================
-// ENVIRONMENT HELPERS
-// ============================================================================
-/**
- * Get AUTH_ISSUER_URL for JWT issuer claim.
- * Required for SSO across apps.
- */
-function getAuthIssuerUrl() {
-    const url = process.env.AUTH_ISSUER_URL;
-    if (!url) {
-        throw new Error('AUTH_ISSUER_URL environment variable is REQUIRED');
-    }
-    return url;
-}
-// ============================================================================
-// BASE AUTH OPTIONS
-// ============================================================================
-/**
- * Base NextAuth configuration.
- * Use getAuthOptions() for dynamic provider loading from IDP.
- */
-exports.authOptions = {
-    // Session uses JWT strategy - JWT contains only redisSessionId
-    session: {
-        strategy: 'jwt',
-        maxAge: 30 * 24 * 60 * 60, // 30 days default, overridden by IDP config
-    },
-    // Custom JWT handling for SSO issuer
-    jwt: {
-        encode: async (params) => {
-            try {
-                const issuer = getAuthIssuerUrl();
-                console.log('[JWT_ENCODE] Encoding token:', {
-                    hasToken: !!params.token,
-                    hasSecret: !!params.secret,
-                    secretLength: params.secret?.length || 0,
-                    issuer,
-                    tokenKeys: params.token ? Object.keys(params.token) : [],
-                });
-                const encoded = await (0, jwt_1.encode)({
-                    ...params,
-                    secret: params.secret,
-                    token: {
-                        ...params.token,
-                        iss: issuer,
-                    },
-                });
-                console.log('[JWT_ENCODE] Success, encoded length:', encoded?.length || 0);
-                return encoded;
-            }
-            catch (error) {
-                console.error('[JWT_ENCODE] FAILED:', error);
-                throw error;
-            }
-        },
-        decode: async (params) => {
-            const decoded = await (0, jwt_1.decode)(params);
-            if (decoded?.iss && decoded.iss !== getAuthIssuerUrl()) {
-                console.error('[JWT] Invalid issuer. Expected:', getAuthIssuerUrl(), 'Got:', decoded.iss);
-                return null; // Hard enforcement - reject mismatched issuers
-            }
-            return decoded;
-        },
-    },
-    // Cookie configuration for multi-app support
-    // In production, use __Secure- prefixed cookie names for enhanced security
-    cookies: {
-        sessionToken: {
-            name: process.env.NODE_ENV === 'production' ? (0, app_slug_1.getSecureSessionCookieName)() : (0, app_slug_1.getSessionCookieName)(),
-            options: {
-                httpOnly: true,
-                sameSite: 'lax',
-                path: '/',
-                secure: process.env.NODE_ENV === 'production',
-            },
-        },
-        csrfToken: {
-            name: process.env.NODE_ENV === 'production' ? (0, app_slug_1.getSecureCsrfCookieName)() : (0, app_slug_1.getCsrfCookieName)(),
-            options: {
-                httpOnly: true,
-                sameSite: 'lax',
-                path: '/',
-                secure: process.env.NODE_ENV === 'production',
-            },
-        },
-        callbackUrl: {
-            name: (0, app_slug_1.getCallbackUrlCookieName)(),
-            options: {
-                sameSite: 'lax',
-                path: '/',
-                secure: process.env.NODE_ENV === 'production',
-            },
-        },
-    },
-    // Providers - credentials only in base, OAuth added dynamically
-    providers: [(0, providers_1.createCredentialsProvider)()],
-    // Callbacks wired to modular implementations
-    callbacks: {
-        jwt: callbacks_1.jwtCallback,
-        session: callbacks_1.sessionCallback, // Type cast needed for NextAuth compatibility
-        signIn: callbacks_1.signInCallback,
-    },
-    // Events
-    events: {
-        signOut: events_1.handleSignOut,
-    },
-    // Custom pages
-    pages: {
-        signIn: '/account-auth/login',
-        error: '/account-auth/login',
-    },
-    debug: false,
-};
-// ============================================================================
-// DYNAMIC AUTH OPTIONS (WITH IDP OAUTH PROVIDERS)
-// ============================================================================
-let cachedAuthOptions = null;
-let authOptionsPromise = null;
-/**
- * Get auth options with dynamically loaded OAuth providers from IDP.
- * Uses caching to avoid rebuilding on every request.
- */
-async function getAuthOptions() {
-    if (cachedAuthOptions) {
-        return cachedAuthOptions;
-    }
-    if (authOptionsPromise) {
-        return authOptionsPromise;
-    }
-    authOptionsPromise = buildDynamicAuthOptions();
-    cachedAuthOptions = await authOptionsPromise;
-    authOptionsPromise = null;
-    return cachedAuthOptions;
-}
-/**
- * Build auth options with dynamic OAuth providers from IDP.
- */
-async function buildDynamicAuthOptions() {
-    const idpConfig = await (0, idp_client_config_1.getIDPClientConfig)();
-    const oauthProviders = (0, providers_1.buildOAuthProviders)(idpConfig);
-    return {
-        ...exports.authOptions,
-        secret: idpConfig.nextAuthSecret || process.env.NEXTAUTH_SECRET,
-        session: {
-            ...exports.authOptions.session,
-            maxAge: idpConfig.authSettings?.rememberMeDays
-                ? idpConfig.authSettings.rememberMeDays * 24 * 60 * 60
-                : 30 * 24 * 60 * 60,
-        },
-        providers: [(0, providers_1.createCredentialsProvider)(), ...oauthProviders],
-    };
-}
-/**
- * Clear cached auth options (when IDP config changes).
- */
-function clearAuthOptionsCache() {
-    cachedAuthOptions = null;
-    authOptionsPromise = null;
-}

package/dist/auth/better-auth.d.ts

@@ -1,82 +0,0 @@
-/**
- * Better Auth Configuration (Phase 1 — parallel install)
- *
- * NOT wired to routes yet. Exists alongside auth-options.ts for testing.
- * Wired in Phase 2 behind USE_BETTER_AUTH flag.
- *
- * Architecture: No database adapter — Better Auth runs in stateless mode
- * with JWE cookie cache. User management stays on IDP, sessions on Redis.
- *
- * @see BETTER-AUTH-MIGRATION-SPEC.md
- */
-import 'server-only';
-import type { IDPClientConfig } from '../lib/idp-client-config';
-/**
- * Better Auth social provider config shape.
- */
-export interface BetterAuthSocialProvider {
-    clientId: string;
-    clientSecret: string;
-    scope?: string[];
-}
-/**
- * Build Better Auth social providers from IDP config.
- * Replaces buildOAuthProviders() from providers/oauth.ts.
- */
-export declare function buildBetterAuthProviders(config: IDPClientConfig): Record<string, BetterAuthSocialProvider>;
-/**
- * Create Better Auth instance from IDP config.
- *
- * No database — runs in stateless mode with JWE cookie cache.
- * Call after getIDPClientConfig() resolves.
- */
-export declare function createBetterAuthInstance(idpConfig: IDPClientConfig): import("better-auth").Auth<{
-    secret: string;
-    socialProviders: Record<string, BetterAuthSocialProvider>;
-    trustedOrigins: string[];
-    session: {
-        cookieCache: {
-            enabled: true;
-            maxAge: number;
-            refreshCache: true;
-        };
-    };
-    plugins: [{
-        id: "next-cookies";
-        hooks: {
-            before: {
-                matcher(ctx: import("better-auth").HookEndpointContext): boolean;
-                handler: (inputContext: import("better-auth").MiddlewareInputContext<import("better-auth").MiddlewareOptions>) => Promise<void>;
-            }[];
-            after: {
-                matcher(ctx: import("better-auth").HookEndpointContext): true;
-                handler: (inputContext: import("better-auth").MiddlewareInputContext<import("better-auth").MiddlewareOptions>) => Promise<void>;
-            }[];
-        };
-    }];
-}>;
-/**
- * Check if Better Auth is enabled via flag.
- */
-export declare function isBetterAuthEnabled(): boolean;
-/**
- * Get flag-gated auth handler for Next.js route.
- *
- * When USE_BETTER_AUTH=true, returns Better Auth handlers.
- * Otherwise returns null (caller uses NextAuth).
- *
- * Usage in host app route:
- * ```ts
- * import { getBetterAuthHandler } from '@payez/next-mvp/auth/better-auth';
- *
- * export async function GET(req: Request) {
- *   const ba = await getBetterAuthHandler();
- *   if (ba) return ba.GET(req);
- *   // ... existing NextAuth handler
- * }
- * ```
- */
-export declare function getBetterAuthHandler(): Promise<{
-    GET: (req: Request) => Promise<Response>;
-    POST: (req: Request) => Promise<Response>;
-} | null>;

package/dist/auth/better-auth.js

@@ -1,122 +0,0 @@
-"use strict";
-/**
- * Better Auth Configuration (Phase 1 — parallel install)
- *
- * NOT wired to routes yet. Exists alongside auth-options.ts for testing.
- * Wired in Phase 2 behind USE_BETTER_AUTH flag.
- *
- * Architecture: No database adapter — Better Auth runs in stateless mode
- * with JWE cookie cache. User management stays on IDP, sessions on Redis.
- *
- * @see BETTER-AUTH-MIGRATION-SPEC.md
- */
-Object.defineProperty(exports, "__esModule", { value: true });
-exports.buildBetterAuthProviders = buildBetterAuthProviders;
-exports.createBetterAuthInstance = createBetterAuthInstance;
-exports.isBetterAuthEnabled = isBetterAuthEnabled;
-exports.getBetterAuthHandler = getBetterAuthHandler;
-require("server-only");
-const better_auth_1 = require("better-auth");
-const next_js_1 = require("better-auth/next-js");
-const next_js_2 = require("better-auth/next-js");
-const idp_client_config_1 = require("../lib/idp-client-config");
-/**
- * Build Better Auth social providers from IDP config.
- * Replaces buildOAuthProviders() from providers/oauth.ts.
- */
-function buildBetterAuthProviders(config) {
-    const providers = {};
-    for (const oauth of config.oauthProviders || []) {
-        if (!oauth.enabled)
-            continue;
-        const name = oauth.provider.toLowerCase();
-        providers[name] = {
-            clientId: oauth.clientId,
-            clientSecret: oauth.clientSecret,
-            scope: oauth.scopes?.split(' '),
-        };
-    }
-    return providers;
-}
-/**
- * Create Better Auth instance from IDP config.
- *
- * No database — runs in stateless mode with JWE cookie cache.
- * Call after getIDPClientConfig() resolves.
- */
-function createBetterAuthInstance(idpConfig) {
-    return (0, better_auth_1.betterAuth)({
-        secret: idpConfig.nextAuthSecret,
-        socialProviders: buildBetterAuthProviders(idpConfig),
-        // Trust the app's own origin + any configured base URL
-        trustedOrigins: [
-            ...(idpConfig.baseClientUrl ? [idpConfig.baseClientUrl] : []),
-            ...(process.env.BETTER_AUTH_URL ? [process.env.BETTER_AUTH_URL] : []),
-            'http://localhost:3000',
-            'http://localhost:3400',
-            'http://localhost:3600',
-        ],
-        // No database — stateless mode. Better Auth defaults to JWE cookie cache.
-        // Session cookie cache with refreshCache for DB-less setup.
-        session: {
-            cookieCache: {
-                enabled: true,
-                maxAge: 300,
-                refreshCache: true,
-            },
-        },
-        plugins: [
-            (0, next_js_1.nextCookies)(),
-        ],
-    });
-}
-/**
- * Check if Better Auth is enabled via flag.
- */
-function isBetterAuthEnabled() {
-    return process.env.USE_BETTER_AUTH === 'true';
-}
-/**
- * Get Better Auth Next.js route handlers (GET, POST).
- * Initializes Better Auth from IDP config on first call, caches the instance.
- */
-// eslint-disable-next-line @typescript-eslint/no-explicit-any
-let cachedInstance = null;
-// eslint-disable-next-line @typescript-eslint/no-explicit-any
-let initPromise = null;
-async function getBetterAuthInstance() {
-    if (cachedInstance)
-        return cachedInstance;
-    if (!initPromise) {
-        initPromise = (0, idp_client_config_1.getIDPClientConfig)().then(config => {
-            const instance = createBetterAuthInstance(config);
-            cachedInstance = instance;
-            console.log('[BETTER_AUTH] Instance created for', config.clientSlug || config.clientId);
-            return instance;
-        });
-    }
-    return initPromise;
-}
-/**
- * Get flag-gated auth handler for Next.js route.
- *
- * When USE_BETTER_AUTH=true, returns Better Auth handlers.
- * Otherwise returns null (caller uses NextAuth).
- *
- * Usage in host app route:
- * ```ts
- * import { getBetterAuthHandler } from '@payez/next-mvp/auth/better-auth';
- *
- * export async function GET(req: Request) {
- *   const ba = await getBetterAuthHandler();
- *   if (ba) return ba.GET(req);
- *   // ... existing NextAuth handler
- * }
- * ```
- */
-async function getBetterAuthHandler() {
-    if (!isBetterAuthEnabled())
-        return null;
-    const auth = await getBetterAuthInstance();
-    return (0, next_js_2.toNextJsHandler)(auth);
-}

package/dist/auth/callbacks/index.d.ts

@@ -1,6 +0,0 @@
-/**
- * Auth Callbacks - Public Exports
- */
-export { jwtCallback } from './jwt';
-export { sessionCallback } from './session';
-export { signInCallback } from './signin';

package/dist/auth/callbacks/index.js

@@ -1,12 +0,0 @@
-"use strict";
-/**
- * Auth Callbacks - Public Exports
- */
-Object.defineProperty(exports, "__esModule", { value: true });
-exports.signInCallback = exports.sessionCallback = exports.jwtCallback = void 0;
-var jwt_1 = require("./jwt");
-Object.defineProperty(exports, "jwtCallback", { enumerable: true, get: function () { return jwt_1.jwtCallback; } });
-var session_1 = require("./session");
-Object.defineProperty(exports, "sessionCallback", { enumerable: true, get: function () { return session_1.sessionCallback; } });
-var signin_1 = require("./signin");
-Object.defineProperty(exports, "signInCallback", { enumerable: true, get: function () { return signin_1.signInCallback; } });

package/dist/auth/callbacks/jwt.d.ts

@@ -1,45 +0,0 @@
-/**
- * JWT Callback
- *
- * Minimal token strategy - only store redisSessionId in JWT.
- * All session data lives in Redis, not in the browser cookie.
- *
- * HANDLES:
- * - Initial sign-in (credentials): Store redisSessionId from authorize()
- * - Initial sign-in (OAuth): Register with IDP, create session, store redisSessionId
- * - Subsequent requests: Validate session exists, return token
- *
- * @version 1.0.0
- * @since auth-refactor-2026-01
- */
-import type { JWT } from 'next-auth/jwt';
-import type { User, Account } from 'next-auth';
-interface JwtCallbackParams {
-    token: JWT;
-    user?: User | any;
-    account?: Account | null;
-    trigger?: 'signIn' | 'signUp' | 'update';
-}
-interface JwtCallbackResult extends JWT {
-    /** Redis session ID - the key to look up session data */
-    redisSessionId?: string;
-    /** User ID from IDP */
-    sub: string;
-    /** Error code if session validation failed */
-    error?: string;
-    /** Flag for OAuth users who need immediate 2FA redirect */
-    requiresTwoFactorRedirect?: boolean;
-}
-/**
- * JWT callback - builds the NextAuth JWT token.
- *
- * MINIMAL TOKEN STRATEGY:
- * - Only store redisSessionId (key to Redis session)
- * - All tokens and user data live in Redis
- * - Browser cookie stays small and secure
- *
- * @param params - JWT callback parameters from NextAuth
- * @returns JWT payload to store in browser cookie
- */
-export declare function jwtCallback({ token, user, account, trigger, }: JwtCallbackParams): Promise<JwtCallbackResult>;
-export {};