@payez/next-mvp 3.9.1 → 4.0.1

package/src/auth/providers/oauth.ts

@@ -1,114 +0,0 @@
-/**
- * OAuth Provider Builder
- *
- * Dynamically builds NextAuth OAuth providers from IDP configuration.
- * Supports Google, Apple, Facebook, GitHub, and Microsoft/Azure AD.
- *
- * @version 1.0.0
- * @since auth-refactor-2026-01
- */
-
-import type { Provider } from 'next-auth/providers/index';
-import GoogleProvider from 'next-auth/providers/google';
-import AppleProvider from 'next-auth/providers/apple';
-import FacebookProvider from 'next-auth/providers/facebook';
-import GitHubProvider from 'next-auth/providers/github';
-import AzureADProvider from 'next-auth/providers/azure-ad';
-import type { IDPClientConfig, OAuthProviderConfig } from '../../lib/idp-client-config';
-
-// ============================================================================
-// PROVIDER BUILDER
-// ============================================================================
-
-/**
- * Build NextAuth OAuth providers from IDP configuration.
- *
- * The IDP returns a list of enabled OAuth providers with their credentials.
- * This function maps them to NextAuth provider instances.
- *
- * @param config - IDP client configuration containing OAuth provider list
- * @returns Array of NextAuth Provider instances
- */
-export function buildOAuthProviders(config: IDPClientConfig): Provider[] {
-  const providers: Provider[] = [];
-
-  for (const oauth of config.oauthProviders || []) {
-    if (!oauth.enabled) {
-      continue;
-    }
-
-    const provider = createOAuthProvider(oauth);
-    if (provider) {
-      providers.push(provider);
-    }
-  }
-
-  return providers;
-}
-
-/**
- * Create a single OAuth provider instance from config.
- */
-function createOAuthProvider(oauth: OAuthProviderConfig): Provider | null {
-  const providerName = oauth.provider.toLowerCase();
-
-  switch (providerName) {
-    case 'google':
-      return GoogleProvider({
-        clientId: oauth.clientId,
-        clientSecret: oauth.clientSecret,
-        authorization: {
-          params: {
-            scope: oauth.scopes || 'openid email profile',
-          },
-        },
-      });
-
-    case 'apple':
-      return AppleProvider({
-        clientId: oauth.clientId,
-        clientSecret: oauth.clientSecret,
-        authorization: {
-          params: {
-            scope: oauth.scopes || 'name email',
-          },
-        },
-      });
-
-    case 'facebook':
-      return FacebookProvider({
-        clientId: oauth.clientId,
-        clientSecret: oauth.clientSecret,
-      });
-
-    case 'github':
-      return GitHubProvider({
-        clientId: oauth.clientId,
-        clientSecret: oauth.clientSecret,
-      });
-
-    case 'microsoft':
-    case 'azure_ad':
-    case 'azure-ad':
-    case 'azuread':
-      return AzureADProvider({
-        clientId: oauth.clientId,
-        clientSecret: oauth.clientSecret,
-        tenantId: oauth.additionalParams?.tenantId || 'common',
-      });
-
-    default:
-      console.warn(`[OAUTH_PROVIDERS] Unknown OAuth provider: ${oauth.provider}`);
-      return null;
-  }
-}
-
-/**
- * Get list of enabled provider names from config.
- * Useful for logging and debugging.
- */
-export function getEnabledProviderNames(config: IDPClientConfig): string[] {
-  return (config.oauthProviders || [])
-    .filter((p) => p.enabled)
-    .map((p) => p.provider);
-}

package/src/lib/nextauth-secret.ts

@@ -1,121 +0,0 @@
-import 'server-only';
-import { validateNextAuthSecret } from './secret-validation';
-import { randomUUID } from 'crypto';
-
-let cachedSecret: string | null = null;
-let lastFetchedAt = 0;
-
-/**
- * Resolve the NextAuth secret (server-only).
- *
- * Priority:
- * 1) Use process.env.NEXTAUTH_SECRET if present (allows overrides/production)
- * 2) Fetch from IDP broker endpoint - IDP handles all Key Vault/signing
- * 3) Cache result in-memory and set process.env.NEXTAUTH_SECRET for subsequent calls
- */
-export async function resolveNextAuthSecret(): Promise<string> {
-  // Check if already in environment
-  if (process.env.NEXTAUTH_SECRET && process.env.NEXTAUTH_SECRET.trim() !== '') {
-    // Silent - already configured
-    return process.env.NEXTAUTH_SECRET;
-  }
-
-  // Check if cached and fresh (within 5 minutes)
-  if (cachedSecret && Date.now() - lastFetchedAt < 5 * 60 * 1000) {
-    return cachedSecret;
-  }
-
-  // Broker mode: fetch from IDP (IDP handles all Key Vault/signing)
-  const base = process.env.IDP_URL;
-  if (!base) throw new Error('IDP_URL environment variable is required');
-
-  const clientIdStr = process.env.CLIENT_ID;
-  if (!clientIdStr || clientIdStr.trim() === '') throw new Error('CLIENT_ID is required (e.g., "ideal_resume_website")');
-
-  // Step 1: Request IDP to sign a client assertion (IDP has the keys, not us)
-
-  const signingUrl = new URL(`${base.replace(/\/$/, '')}/api/ExternalAuth/sign-client-assertion`);
-
-  const signingPayload = {
-    issuer: clientIdStr,
-    subject: clientIdStr,
-    audience: 'urn:payez:externalauth:nextauthsecret',
-    expires_in: 60,
-  };
-
-  const signingResp = await fetch(signingUrl.toString(), {
-    method: 'POST',
-    headers: {
-      'Accept': 'application/json',
-      'Content-Type': 'application/json',
-      'X-Client-Id': clientIdStr,
-      'X-Correlation-Id': randomUUID().replace(/-/g, ''),
-    },
-    body: JSON.stringify(signingPayload),
-    cache: 'no-store'
-  } as RequestInit);
-
-  if (!signingResp.ok) {
-    const txt = await signingResp.text().catch(() => 'Unknown error');
-    throw new Error(`Failed to sign client assertion: ${signingResp.status} ${signingResp.statusText} - ${txt}`);
-  }
-
-  const signingBody: any = await signingResp.json().catch(() => ({}));
-  const client_assertion = (
-    signingBody?.data?.client_assertion ??
-    signingBody?.data?.clientAssertion ??
-    signingBody?.client_assertion ??
-    signingBody?.clientAssertion ??
-    signingBody?.data?.ClientAssertion ??
-    signingBody?.ClientAssertion
-  ) as string | undefined;
-
-  if (!client_assertion || typeof client_assertion !== 'string') {
-    throw new Error('IDP did not return a valid signed client assertion');
-  }
-
-  // Step 2: Use the signed assertion to fetch the NextAuth secret
-
-  const proxyUrl = new URL(`${base.replace(/\/$/, '')}/api/ExternalAuth/next-auth/secret`);
-
-  const proxyResp = await fetch(proxyUrl.toString(), {
-    method: 'POST',
-    headers: {
-      'Accept': 'application/json',
-      'Content-Type': 'application/json',
-      'X-Client-Id': clientIdStr,
-      'X-Correlation-Id': randomUUID().replace(/-/g, ''),
-    },
-    body: JSON.stringify({ client_assertion }),
-    cache: 'no-store'
-  } as RequestInit);
-
-  if (!proxyResp.ok) {
-    const txt = await proxyResp.text().catch(() => 'Unknown error');
-    throw new Error(`Proxy error: ${proxyResp.status} ${proxyResp.statusText} - ${txt}`);
-  }
-
-  const proxyBody: any = await proxyResp.json().catch(() => ({}));
-
-  const secret = (proxyBody?.data?.secret ?? proxyBody?.secret) as string | undefined;
-  const configuration = (proxyBody?.data?.configuration ?? proxyBody?.configuration) as any | undefined;
-
-  // Configuration is available but we don't log it verbosely
-
-  if (!secret || typeof secret !== 'string') {
-    throw new Error('Proxy did not return a valid NextAuth secret');
-  }
-
-  const validation = validateNextAuthSecret(secret);
-  if (!validation.valid) {
-    throw new Error(`Fetched NextAuth secret failed validation: ${validation.reason}`);
-  }
-
-  cachedSecret = secret;
-  lastFetchedAt = Date.now();
-  process.env.NEXTAUTH_SECRET = secret;
-
-  console.log('[NEXTAUTH-SECRET] Resolved from IDP (length:', secret.length + ')');
-
-  return secret;
-}

package/src/types/next-auth.d.ts

@@ -1,15 +0,0 @@
-import { DefaultSession } from 'next-auth';
-
-declare module 'next-auth' {
-  interface Session extends DefaultSession {
-    accessToken?: string;
-    refreshToken?: string;
-    accessTokenExpires?: number;
-    error?: string;
-    user: {
-      id: string;
-      requiresTwoFactor?: boolean;
-      twoFactorSessionVerified?: boolean;
-    } & DefaultSession['user'];
-  }
-}