@payez/next-mvp 4.0.27 → 4.0.28

package/dist/auth/better-auth.d.ts

@@ -108,3 +108,21 @@ export declare function getBetterAuthHandler(): Promise<{
  * This replaces the old databaseHooks approach which doesn't fire in stateless mode.
  */
 export declare function exchangeOAuthForIdpTokens(sessionToken: string, provider?: string): Promise<boolean>;
+/**
+ * Create a production-ready GET handler for the auth catch-all route.
+ *
+ * Wraps better-auth's GET handler with:
+ * - OAuth state error recovery (redirects to login instead of error page)
+ * - IDP token exchange after successful OAuth callback
+ *
+ * Usage in host app:
+ * ```ts
+ * import { createAuthGetHandler, getBetterAuthHandler } from '@payez/next-mvp/auth/better-auth';
+ * export const GET = createAuthGetHandler('/account-auth/login');
+ * export async function POST(req: Request) {
+ *   const ba = await getBetterAuthHandler();
+ *   return ba!.POST(req);
+ * }
+ * ```
+ */
+export declare function createAuthGetHandler(loginPath?: string): (request: Request) => Promise<Response>;

package/dist/auth/better-auth.js

@@ -17,6 +17,7 @@ exports.isBetterAuthEnabled = isBetterAuthEnabled;
 exports.getBetterAuthInstance = getBetterAuthInstance;
 exports.getBetterAuthHandler = getBetterAuthHandler;
 exports.exchangeOAuthForIdpTokens = exchangeOAuthForIdpTokens;
+exports.createAuthGetHandler = createAuthGetHandler;
 require("server-only");
 const better_auth_1 = require("better-auth");
 const next_js_1 = require("better-auth/next-js");
@@ -257,3 +258,64 @@ async function exchangeOAuthForIdpTokens(sessionToken, provider = 'google') {
         return false;
     }
 }
+/**
+ * Create a production-ready GET handler for the auth catch-all route.
+ *
+ * Wraps better-auth's GET handler with:
+ * - OAuth state error recovery (redirects to login instead of error page)
+ * - IDP token exchange after successful OAuth callback
+ *
+ * Usage in host app:
+ * ```ts
+ * import { createAuthGetHandler, getBetterAuthHandler } from '@payez/next-mvp/auth/better-auth';
+ * export const GET = createAuthGetHandler('/account-auth/login');
+ * export async function POST(req: Request) {
+ *   const ba = await getBetterAuthHandler();
+ *   return ba!.POST(req);
+ * }
+ * ```
+ */
+function createAuthGetHandler(loginPath = '/account-auth/login') {
+    return async function GET(request) {
+        const ba = await getBetterAuthHandler();
+        if (!ba) {
+            return new Response('Auth handler not configured', { status: 500 });
+        }
+        const response = await ba.GET(request);
+        // Intercept auth errors (state mismatch, expired cookies) — redirect to login cleanly
+        if (response.status === 302) {
+            const location = response.headers.get('location') || '';
+            if (location.includes('/api/auth/error') || location.includes('please_restart')) {
+                console.warn('[BETTER_AUTH] OAuth state error, redirecting to login');
+                return Response.redirect(new URL(loginPath, request.url), 302);
+            }
+        }
+        // After successful OAuth callback: exchange Google identity for IDP tokens
+        const url = new URL(request.url);
+        if (url.pathname.includes('/callback/') && response.status === 302) {
+            try {
+                const auth = await getBetterAuthInstance();
+                if (auth?.api?.getSession) {
+                    const setCookies = response.headers.getSetCookie?.() || [];
+                    const cookieHeader = setCookies
+                        .map((c) => c.split(';')[0])
+                        .join('; ');
+                    const headers = new Headers();
+                    headers.set('cookie', cookieHeader);
+                    const session = await auth.api.getSession({ headers });
+                    if (session?.session?.token) {
+                        console.log('[BETTER_AUTH] Got session token from callback:', session.session.token.substring(0, 10), '| email:', session.user?.email);
+                        await exchangeOAuthForIdpTokens(session.session.token);
+                    }
+                    else {
+                        console.warn('[BETTER_AUTH] Could not get session after OAuth callback');
+                    }
+                }
+            }
+            catch (err) {
+                console.error('[BETTER_AUTH] IDP token exchange failed:', err.message);
+            }
+        }
+        return response;
+    };
+}

package/package.json

@@ -1,6 +1,6 @@
 {
   "name": "@payez/next-mvp",
-  "version": "4.0.27",
+  "version": "4.0.28",
   "sideEffects": false,
   "main": "dist/index.js",
   "types": "dist/index.d.ts",

package/src/auth/better-auth.ts

@@ -283,3 +283,69 @@ export async function exchangeOAuthForIdpTokens(
     return false;
   }
 }
+
+/**
+ * Create a production-ready GET handler for the auth catch-all route.
+ *
+ * Wraps better-auth's GET handler with:
+ * - OAuth state error recovery (redirects to login instead of error page)
+ * - IDP token exchange after successful OAuth callback
+ *
+ * Usage in host app:
+ * ```ts
+ * import { createAuthGetHandler, getBetterAuthHandler } from '@payez/next-mvp/auth/better-auth';
+ * export const GET = createAuthGetHandler('/account-auth/login');
+ * export async function POST(req: Request) {
+ *   const ba = await getBetterAuthHandler();
+ *   return ba!.POST(req);
+ * }
+ * ```
+ */
+export function createAuthGetHandler(loginPath: string = '/account-auth/login') {
+  return async function GET(request: Request): Promise<Response> {
+    const ba = await getBetterAuthHandler();
+    if (!ba) {
+      return new Response('Auth handler not configured', { status: 500 });
+    }
+
+    const response = await ba.GET(request);
+
+    // Intercept auth errors (state mismatch, expired cookies) — redirect to login cleanly
+    if (response.status === 302) {
+      const location = response.headers.get('location') || '';
+      if (location.includes('/api/auth/error') || location.includes('please_restart')) {
+        console.warn('[BETTER_AUTH] OAuth state error, redirecting to login');
+        return Response.redirect(new URL(loginPath, request.url), 302);
+      }
+    }
+
+    // After successful OAuth callback: exchange Google identity for IDP tokens
+    const url = new URL(request.url);
+    if (url.pathname.includes('/callback/') && response.status === 302) {
+      try {
+        const auth = await getBetterAuthInstance();
+        if (auth?.api?.getSession) {
+          const setCookies = response.headers.getSetCookie?.() || [];
+          const cookieHeader = setCookies
+            .map((c: string) => c.split(';')[0])
+            .join('; ');
+
+          const headers = new Headers();
+          headers.set('cookie', cookieHeader);
+
+          const session = await auth.api.getSession({ headers });
+          if (session?.session?.token) {
+            console.log('[BETTER_AUTH] Got session token from callback:', session.session.token.substring(0, 10), '| email:', session.user?.email);
+            await exchangeOAuthForIdpTokens(session.session.token);
+          } else {
+            console.warn('[BETTER_AUTH] Could not get session after OAuth callback');
+          }
+        }
+      } catch (err: any) {
+        console.error('[BETTER_AUTH] IDP token exchange failed:', err.message);
+      }
+    }
+
+    return response;
+  };
+}