@payez/next-mvp 4.1.7 → 4.1.9

package/src/routes/account/update-phone.ts

@@ -1,13 +1,13 @@
-/**
- * Update Phone Route
- *
- * Ready-to-use route handler for updating phone number.
- * Used for 2FA setup - users need to add a phone to enable SMS verification.
- *
- * @example
- * ```typescript
- * // app/api/account/update-phone/route.ts
- * export { POST } from '@payez/next-mvp/routes/account/update-phone';
- * ```
- */
-export { POST } from '../../api-handlers/account/update-phone';
+/**
+ * Update Phone Route
+ *
+ * Ready-to-use route handler for updating phone number.
+ * Used for 2FA setup - users need to add a phone to enable SMS verification.
+ *
+ * @example
+ * ```typescript
+ * // app/api/account/update-phone/route.ts
+ * export { POST } from '@payez/next-mvp/routes/account/update-phone';
+ * ```
+ */
+export { POST } from '../../api-handlers/account/update-phone';

package/src/routes/auth/logout.ts

@@ -1,109 +1,109 @@
-/**
- * Ready-to-Use Logout Route
- *
- * Provides a pre-configured logout handler that properly cleans up
- * sessions and revokes tokens.
- *
- * @example
- * ```typescript
- * // app/api/auth/logout/route.ts
- * export { POST } from '@payez/next-mvp/routes/auth/logout';
- * ```
- *
- * @version 2.0.0
- * @since auth-ready-v2
- */
-
-import { NextRequest, NextResponse } from 'next/server';
-import { getSession } from '../../server/auth';
-import { deleteSession } from '../../lib/session-store';
-import {
-  getSessionCookieName,
-  getSecureSessionCookieName,
-  getCsrfCookieName,
-  getSecureCsrfCookieName,
-  getCallbackUrlCookieName,
-} from '../../lib/app-slug';
-import { siteEvents, getClientIp } from '../../lib/site-logger';
-
-/**
- * POST /api/auth/logout - Sign out and clean up session
- *
- * Performs complete logout:
- * 1. Revokes tokens at IDP (if refresh token available)
- * 2. Deletes session from store
- * 3. Clears session cookies
- */
-export async function POST(req: NextRequest) {
-  try {
-    const session = await getSession(req);
-
-    if (!session) {
-      // Already logged out
-      return NextResponse.json({
-        success: true,
-        message: 'No active session'
-      });
-    }
-
-    const sessionId = session.session?.token;
-
-    // Delete session from store (this also removes the refresh token)
-    if (sessionId) {
-      try {
-        await deleteSession(sessionId);
-        console.info('[LOGOUT_ROUTE] Session deleted from store');
-      } catch (error) {
-        console.warn('[LOGOUT_ROUTE] Failed to delete session:', error);
-      }
-    }
-
-    // Log logout event (fire-and-forget)
-    const userId = session.user?.id;
-    if (userId) {
-      siteEvents.logout({
-        user_id: userId,
-        session_id: sessionId,
-        trigger: 'user',
-        url: '/api/auth/logout',
-        user_agent: req.headers.get('user-agent') || undefined,
-        ip_address: getClientIp(req.headers) || undefined,
-      });
-    }
-
-    // Build response that clears session cookies
-    const response = NextResponse.json({
-      success: true,
-      message: 'Logged out successfully'
-    });
-
-    // Clear NextAuth session cookies (using app-slug prefixed names)
-    const cookieNames = [
-      getSessionCookieName(),
-      getSecureSessionCookieName(),
-      getCsrfCookieName(),
-      getSecureCsrfCookieName(),
-      getCallbackUrlCookieName(),
-      `__Secure-${getCallbackUrlCookieName()}`,
-    ];
-
-    // Clear each cookie by setting it with maxAge 0
-    cookieNames.forEach(name => {
-      response.cookies.set(name, '', {
-        maxAge: 0,
-        path: '/',
-        httpOnly: true,
-        secure: process.env.NODE_ENV === 'production',
-        sameSite: 'lax'
-      });
-    });
-
-    return response;
-  } catch (error) {
-    console.error('[LOGOUT_ROUTE] Error during logout:', error);
-    return NextResponse.json({
-      error: 'Failed to logout',
-      details: error instanceof Error ? error.message : 'Unknown error'
-    }, { status: 500 });
-  }
+/**
+ * Ready-to-Use Logout Route
+ *
+ * Provides a pre-configured logout handler that properly cleans up
+ * sessions and revokes tokens.
+ *
+ * @example
+ * ```typescript
+ * // app/api/auth/logout/route.ts
+ * export { POST } from '@payez/next-mvp/routes/auth/logout';
+ * ```
+ *
+ * @version 2.0.0
+ * @since auth-ready-v2
+ */
+
+import { NextRequest, NextResponse } from 'next/server';
+import { getSession } from '../../server/auth';
+import { deleteSession } from '../../lib/session-store';
+import {
+  getSessionCookieName,
+  getSecureSessionCookieName,
+  getCsrfCookieName,
+  getSecureCsrfCookieName,
+  getCallbackUrlCookieName,
+} from '../../lib/app-slug';
+import { siteEvents, getClientIp } from '../../lib/site-logger';
+
+/**
+ * POST /api/auth/logout - Sign out and clean up session
+ *
+ * Performs complete logout:
+ * 1. Revokes tokens at IDP (if refresh token available)
+ * 2. Deletes session from store
+ * 3. Clears session cookies
+ */
+export async function POST(req: NextRequest) {
+  try {
+    const session = await getSession(req);
+
+    if (!session) {
+      // Already logged out
+      return NextResponse.json({
+        success: true,
+        message: 'No active session'
+      });
+    }
+
+    const sessionId = session.session?.token;
+
+    // Delete session from store (this also removes the refresh token)
+    if (sessionId) {
+      try {
+        await deleteSession(sessionId);
+        console.info('[LOGOUT_ROUTE] Session deleted from store');
+      } catch (error) {
+        console.warn('[LOGOUT_ROUTE] Failed to delete session:', error);
+      }
+    }
+
+    // Log logout event (fire-and-forget)
+    const userId = session.user?.id;
+    if (userId) {
+      siteEvents.logout({
+        user_id: userId,
+        session_id: sessionId,
+        trigger: 'user',
+        url: '/api/auth/logout',
+        user_agent: req.headers.get('user-agent') || undefined,
+        ip_address: getClientIp(req.headers) || undefined,
+      });
+    }
+
+    // Build response that clears session cookies
+    const response = NextResponse.json({
+      success: true,
+      message: 'Logged out successfully'
+    });
+
+    // Clear NextAuth session cookies (using app-slug prefixed names)
+    const cookieNames = [
+      getSessionCookieName(),
+      getSecureSessionCookieName(),
+      getCsrfCookieName(),
+      getSecureCsrfCookieName(),
+      getCallbackUrlCookieName(),
+      `__Secure-${getCallbackUrlCookieName()}`,
+    ];
+
+    // Clear each cookie by setting it with maxAge 0
+    cookieNames.forEach(name => {
+      response.cookies.set(name, '', {
+        maxAge: 0,
+        path: '/',
+        httpOnly: true,
+        secure: process.env.NODE_ENV === 'production',
+        sameSite: 'lax'
+      });
+    });
+
+    return response;
+  } catch (error) {
+    console.error('[LOGOUT_ROUTE] Error during logout:', error);
+    return NextResponse.json({
+      error: 'Failed to logout',
+      details: error instanceof Error ? error.message : 'Unknown error'
+    }, { status: 500 });
+  }
 }

package/src/routes/auth/nextauth.ts

@@ -1,45 +1,45 @@
-/**
- * Ready-to-Use Auth Route Handler (Better Auth)
- *
- * Provides a pre-configured Better Auth handler that uses dynamic OAuth providers
- * loaded from IDP at startup.
- *
- * Replaces the former NextAuth handler. The file name is kept as nextauth.ts
- * to avoid breaking re-exports in routes/auth/index.ts.
- *
- * @version 4.0.0 - Better Auth migration
- * @since better-auth-4.0
- */
-
-import { getBetterAuthHandler } from '../../auth/better-auth';
-import { NextResponse } from 'next/server';
-
-/**
- * GET handler for auth routes
- * Delegates to Better Auth instance.
- */
-export async function GET(request: Request) {
-  const handler = await getBetterAuthHandler();
-  if (!handler) {
-    return NextResponse.json(
-      { error: 'Auth handler not available' },
-      { status: 503 }
-    );
-  }
-  return handler.GET(request);
-}
-
-/**
- * POST handler for auth routes
- * Delegates to Better Auth instance.
- */
-export async function POST(request: Request) {
-  const handler = await getBetterAuthHandler();
-  if (!handler) {
-    return NextResponse.json(
-      { error: 'Auth handler not available' },
-      { status: 503 }
-    );
-  }
-  return handler.POST(request);
-}
+/**
+ * Ready-to-Use Auth Route Handler (Better Auth)
+ *
+ * Provides a pre-configured Better Auth handler that uses dynamic OAuth providers
+ * loaded from IDP at startup.
+ *
+ * Replaces the former NextAuth handler. The file name is kept as nextauth.ts
+ * to avoid breaking re-exports in routes/auth/index.ts.
+ *
+ * @version 4.0.0 - Better Auth migration
+ * @since better-auth-4.0
+ */
+
+import { getBetterAuthHandler } from '../../auth/better-auth';
+import { NextResponse } from 'next/server';
+
+/**
+ * GET handler for auth routes
+ * Delegates to Better Auth instance.
+ */
+export async function GET(request: Request) {
+  const handler = await getBetterAuthHandler();
+  if (!handler) {
+    return NextResponse.json(
+      { error: 'Auth handler not available' },
+      { status: 503 }
+    );
+  }
+  return handler.GET(request);
+}
+
+/**
+ * POST handler for auth routes
+ * Delegates to Better Auth instance.
+ */
+export async function POST(request: Request) {
+  const handler = await getBetterAuthHandler();
+  if (!handler) {
+    return NextResponse.json(
+      { error: 'Auth handler not available' },
+      { status: 503 }
+    );
+  }
+  return handler.POST(request);
+}

package/src/routes/auth/settings.ts

@@ -1,75 +1,75 @@
-/**
- * Public Auth Settings Route
- *
- * Returns client auth settings for pre-login pages (signup, login).
- * Does NOT require authentication - these are public client settings.
- */
-
-import { NextResponse } from 'next/server';
-import { getIDPClientConfig } from '../../lib/idp-client-config';
-
-export interface PublicAuthSettings {
-    // OAuth providers enabled for this client
-    enabledProviders: string[];
-
-    // Registration settings
-    allowPublicRegistration: boolean;
-    allowFederatedLogin: boolean;
-
-    // Password settings
-    enablePasswordReset: boolean;
-
-    // 2FA settings (public - no secrets)
-    require2FA: boolean;
-    allowed2FAMethods: string[];
-}
-
-/**
- * GET /api/auth/settings
- *
- * Returns public auth settings for the current client.
- * Used by login/signup pages to determine what options to show.
- */
-export async function GET() {
-    try {
-        const config = await getIDPClientConfig();
-
-        const settings: PublicAuthSettings = {
-            // Get enabled OAuth provider names
-            enabledProviders: config.oauthProviders
-                ?.filter(p => p.enabled)
-                .map(p => p.provider) ?? [],
-
-            // Registration - default to true if not specified
-            allowPublicRegistration: true, // Could come from config.authSettings in future
-            allowFederatedLogin: config.oauthProviders?.some(p => p.enabled) ?? false,
-
-            // Password reset
-            enablePasswordReset: true, // Could come from config.authSettings in future
-
-            // 2FA
-            require2FA: config.authSettings?.require2FA ?? true,
-            allowed2FAMethods: config.authSettings?.allowed2FAMethods ?? ['email', 'sms'],
-        };
-
-        return NextResponse.json({
-            success: true,
-            data: settings,
-        });
-    } catch (error) {
-        console.error('[AUTH_SETTINGS] Failed to get settings:', error);
-
-        // Return safe defaults on error
-        return NextResponse.json({
-            success: true,
-            data: {
-                enabledProviders: [],
-                allowPublicRegistration: true,
-                allowFederatedLogin: false,
-                enablePasswordReset: true,
-                require2FA: true,
-                allowed2FAMethods: ['email', 'sms'],
-            } as PublicAuthSettings,
-        });
-    }
-}
+/**
+ * Public Auth Settings Route
+ *
+ * Returns client auth settings for pre-login pages (signup, login).
+ * Does NOT require authentication - these are public client settings.
+ */
+
+import { NextResponse } from 'next/server';
+import { getIDPClientConfig } from '../../lib/idp-client-config';
+
+export interface PublicAuthSettings {
+    // OAuth providers enabled for this client
+    enabledProviders: string[];
+
+    // Registration settings
+    allowPublicRegistration: boolean;
+    allowFederatedLogin: boolean;
+
+    // Password settings
+    enablePasswordReset: boolean;
+
+    // 2FA settings (public - no secrets)
+    require2FA: boolean;
+    allowed2FAMethods: string[];
+}
+
+/**
+ * GET /api/auth/settings
+ *
+ * Returns public auth settings for the current client.
+ * Used by login/signup pages to determine what options to show.
+ */
+export async function GET() {
+    try {
+        const config = await getIDPClientConfig();
+
+        const settings: PublicAuthSettings = {
+            // Get enabled OAuth provider names
+            enabledProviders: config.oauthProviders
+                ?.filter(p => p.enabled)
+                .map(p => p.provider) ?? [],
+
+            // Registration - default to true if not specified
+            allowPublicRegistration: true, // Could come from config.authSettings in future
+            allowFederatedLogin: config.oauthProviders?.some(p => p.enabled) ?? false,
+
+            // Password reset
+            enablePasswordReset: true, // Could come from config.authSettings in future
+
+            // 2FA
+            require2FA: config.authSettings?.require2FA ?? true,
+            allowed2FAMethods: config.authSettings?.allowed2FAMethods ?? ['email', 'sms'],
+        };
+
+        return NextResponse.json({
+            success: true,
+            data: settings,
+        });
+    } catch (error) {
+        console.error('[AUTH_SETTINGS] Failed to get settings:', error);
+
+        // Return safe defaults on error
+        return NextResponse.json({
+            success: true,
+            data: {
+                enabledProviders: [],
+                allowPublicRegistration: true,
+                allowFederatedLogin: false,
+                enablePasswordReset: true,
+                require2FA: true,
+                allowed2FAMethods: ['email', 'sms'],
+            } as PublicAuthSettings,
+        });
+    }
+}