@payez/next-mvp 4.8.1 → 4.8.3

package/src/lib/internal-api.ts

@@ -1,171 +1,171 @@
-/**
- * Centralized internal API helper for the app to call ITSELF.
- *
- * IMPORTANT: All calls from the Next.js server to its own API routes MUST use
- * these functions. Never use req.url, req.nextUrl.origin, or construct URLs
- * from the incoming request.
- *
- * WHY HTTP IS REQUIRED (not optional):
- * - This is the app calling its OWN backend within the same pod/container
- * - NextAuth cookies are encrypted based on request protocol
- * - TLS is terminated at ingress, so the pod receives HTTP internally
- * - Using HTTPS here causes cookie decryption failures and 403 errors
- * - This is NOT about "K8s traffic doesn't need TLS" - it's about
- *   protocol consistency for cookie/session encryption
- *
- * Environment:
- * - INTERNAL_API_URL: Required in production (e.g., http://service.namespace.svc.cluster.local:80)
- * - Falls back to http://localhost:3200 in development only
- */
-
-/**
- * Get the internal API base URL for the app to call itself.
- *
- * @throws Error in production if INTERNAL_API_URL is not set
- * @returns The base URL (no trailing slash)
- */
-export function getInternalApiUrl(): string {
-  const url = process.env.INTERNAL_API_URL;
-  if (url) return url.replace(/\/$/, ''); // strip trailing slash
-
-  if (process.env.NODE_ENV !== 'production') {
-    return 'http://localhost:3200';
-  }
-
-  throw new Error(
-    '[INTERNAL_API_URL] FATAL: INTERNAL_API_URL environment variable is REQUIRED in production. ' +
-    'This is for the app to call ITSELF. MUST be HTTP (not HTTPS) due to cookie encryption. ' +
-    'Set to http://service.namespace.svc.cluster.local:80'
-  );
-}
-
-/**
- * Options for internal fetch calls
- */
-export interface InternalFetchOptions extends Omit<RequestInit, 'headers'> {
-  /** Additional headers to include */
-  headers?: Record<string, string>;
-  /** Cookie header to forward (typically from req.headers.get('cookie')) */
-  cookie?: string;
-  /** Session token for x-session-token header */
-  sessionToken?: string;
-  /** Request ID for tracing */
-  requestId?: string;
-  /** Parse response as JSON (default: true) */
-  parseJson?: boolean;
-}
-
-/**
- * Result of an internal fetch call
- */
-export interface InternalFetchResult<T = unknown> {
-  ok: boolean;
-  status: number;
-  statusText: string;
-  data: T | null;
-  response: Response;
-}
-
-/**
- * Make a fetch call to an internal API route (app calling itself).
- *
- * @param path - The API path (e.g., '/api/auth/refresh')
- * @param options - Fetch options
- * @returns The fetch result with parsed data
- *
- * @example
- * ```ts
- * // Simple GET
- * const result = await internalFetch('/api/health');
- *
- * // POST with session
- * const result = await internalFetch('/api/auth/refresh', {
- *   method: 'POST',
- *   cookie: req.headers.get('cookie') || '',
- *   sessionToken: token.redisSessionId,
- *   body: JSON.stringify({ refresh_token: refreshToken }),
- * });
- * ```
- */
-export async function internalFetch<T = unknown>(
-  path: string,
-  options: InternalFetchOptions = {}
-): Promise<InternalFetchResult<T>> {
-  const {
-    headers: extraHeaders = {},
-    cookie,
-    sessionToken,
-    requestId,
-    parseJson = true,
-    ...fetchOptions
-  } = options;
-
-  const baseUrl = getInternalApiUrl();
-  const url = `${baseUrl}${path.startsWith('/') ? path : `/${path}`}`;
-
-  // Build headers
-  const headers: Record<string, string> = {
-    'Accept': 'application/json',
-    'Content-Type': 'application/json',
-    ...extraHeaders,
-  };
-
-  if (cookie) {
-    headers['Cookie'] = cookie;
-  }
-  if (sessionToken) {
-    headers['X-Session-Token'] = sessionToken;
-  }
-  if (requestId) {
-    headers['X-Request-Id'] = requestId;
-  }
-
-  const response = await fetch(url, {
-    ...fetchOptions,
-    headers,
-  });
-
-  let data: T | null = null;
-  if (parseJson) {
-    try {
-      data = await response.json() as T;
-    } catch {
-      data = null;
-    }
-  }
-
-  return {
-    ok: response.ok,
-    status: response.status,
-    statusText: response.statusText,
-    data,
-    response,
-  };
-}
-
-/**
- * Trigger a token refresh via the internal API.
- * This is a convenience wrapper for the common refresh pattern.
- *
- * @param cookie - The cookie header from the incoming request
- * @param sessionToken - The session token
- * @param refreshToken - Optional refresh token to include in body
- * @param requestId - Optional request ID for tracing
- * @returns Whether the refresh was successful
- */
-export async function internalRefresh(
-  cookie: string,
-  sessionToken: string,
-  refreshToken?: string,
-  requestId?: string
-): Promise<{ ok: boolean; status: number }> {
-  const result = await internalFetch('/api/auth/refresh', {
-    method: 'POST',
-    cookie,
-    sessionToken,
-    requestId,
-    body: refreshToken ? JSON.stringify({ refresh_token: refreshToken }) : undefined,
-  });
-
-  return { ok: result.ok, status: result.status };
-}
+/**
+ * Centralized internal API helper for the app to call ITSELF.
+ *
+ * IMPORTANT: All calls from the Next.js server to its own API routes MUST use
+ * these functions. Never use req.url, req.nextUrl.origin, or construct URLs
+ * from the incoming request.
+ *
+ * WHY HTTP IS REQUIRED (not optional):
+ * - This is the app calling its OWN backend within the same pod/container
+ * - NextAuth cookies are encrypted based on request protocol
+ * - TLS is terminated at ingress, so the pod receives HTTP internally
+ * - Using HTTPS here causes cookie decryption failures and 403 errors
+ * - This is NOT about "K8s traffic doesn't need TLS" - it's about
+ *   protocol consistency for cookie/session encryption
+ *
+ * Environment:
+ * - INTERNAL_API_URL: Required in production (e.g., http://service.namespace.svc.cluster.local:80)
+ * - Falls back to http://localhost:3200 in development only
+ */
+
+/**
+ * Get the internal API base URL for the app to call itself.
+ *
+ * @throws Error in production if INTERNAL_API_URL is not set
+ * @returns The base URL (no trailing slash)
+ */
+export function getInternalApiUrl(): string {
+  const url = process.env.INTERNAL_API_URL;
+  if (url) return url.replace(/\/$/, ''); // strip trailing slash
+
+  if (process.env.NODE_ENV !== 'production') {
+    return 'http://localhost:3200';
+  }
+
+  throw new Error(
+    '[INTERNAL_API_URL] FATAL: INTERNAL_API_URL environment variable is REQUIRED in production. ' +
+    'This is for the app to call ITSELF. MUST be HTTP (not HTTPS) due to cookie encryption. ' +
+    'Set to http://service.namespace.svc.cluster.local:80'
+  );
+}
+
+/**
+ * Options for internal fetch calls
+ */
+export interface InternalFetchOptions extends Omit<RequestInit, 'headers'> {
+  /** Additional headers to include */
+  headers?: Record<string, string>;
+  /** Cookie header to forward (typically from req.headers.get('cookie')) */
+  cookie?: string;
+  /** Session token for x-session-token header */
+  sessionToken?: string;
+  /** Request ID for tracing */
+  requestId?: string;
+  /** Parse response as JSON (default: true) */
+  parseJson?: boolean;
+}
+
+/**
+ * Result of an internal fetch call
+ */
+export interface InternalFetchResult<T = unknown> {
+  ok: boolean;
+  status: number;
+  statusText: string;
+  data: T | null;
+  response: Response;
+}
+
+/**
+ * Make a fetch call to an internal API route (app calling itself).
+ *
+ * @param path - The API path (e.g., '/api/auth/refresh')
+ * @param options - Fetch options
+ * @returns The fetch result with parsed data
+ *
+ * @example
+ * ```ts
+ * // Simple GET
+ * const result = await internalFetch('/api/health');
+ *
+ * // POST with session
+ * const result = await internalFetch('/api/auth/refresh', {
+ *   method: 'POST',
+ *   cookie: req.headers.get('cookie') || '',
+ *   sessionToken: token.redisSessionId,
+ *   body: JSON.stringify({ refresh_token: refreshToken }),
+ * });
+ * ```
+ */
+export async function internalFetch<T = unknown>(
+  path: string,
+  options: InternalFetchOptions = {}
+): Promise<InternalFetchResult<T>> {
+  const {
+    headers: extraHeaders = {},
+    cookie,
+    sessionToken,
+    requestId,
+    parseJson = true,
+    ...fetchOptions
+  } = options;
+
+  const baseUrl = getInternalApiUrl();
+  const url = `${baseUrl}${path.startsWith('/') ? path : `/${path}`}`;
+
+  // Build headers
+  const headers: Record<string, string> = {
+    'Accept': 'application/json',
+    'Content-Type': 'application/json',
+    ...extraHeaders,
+  };
+
+  if (cookie) {
+    headers['Cookie'] = cookie;
+  }
+  if (sessionToken) {
+    headers['X-Session-Token'] = sessionToken;
+  }
+  if (requestId) {
+    headers['X-Request-Id'] = requestId;
+  }
+
+  const response = await fetch(url, {
+    ...fetchOptions,
+    headers,
+  });
+
+  let data: T | null = null;
+  if (parseJson) {
+    try {
+      data = await response.json() as T;
+    } catch {
+      data = null;
+    }
+  }
+
+  return {
+    ok: response.ok,
+    status: response.status,
+    statusText: response.statusText,
+    data,
+    response,
+  };
+}
+
+/**
+ * Trigger a token refresh via the internal API.
+ * This is a convenience wrapper for the common refresh pattern.
+ *
+ * @param cookie - The cookie header from the incoming request
+ * @param sessionToken - The session token
+ * @param refreshToken - Optional refresh token to include in body
+ * @param requestId - Optional request ID for tracing
+ * @returns Whether the refresh was successful
+ */
+export async function internalRefresh(
+  cookie: string,
+  sessionToken: string,
+  refreshToken?: string,
+  requestId?: string
+): Promise<{ ok: boolean; status: number }> {
+  const result = await internalFetch('/api/auth/refresh', {
+    method: 'POST',
+    cookie,
+    sessionToken,
+    requestId,
+    body: refreshToken ? JSON.stringify({ refresh_token: refreshToken }) : undefined,
+  });
+
+  return { ok: result.ok, status: result.status };
+}

package/src/lib/jwt-decode-client.ts

@@ -1,45 +1,45 @@
-/**
- * Client-safe JWT decode (no Node.js dependencies)
- * This is a lightweight version for browser usage
- */
-
-// Decode base64url
-function base64urlDecode(base64url: string): string {
-  try {
-    // Convert base64url to base64
-    let base64 = base64url.replace(/-/g, '+').replace(/_/g, '/');
-    // Add padding if needed
-    while (base64.length % 4) {
-      base64 += '=';
-    }
-    return atob(base64);
-  } catch (e) {
-    throw new Error('Invalid base64url encoding');
-  }
-}
-
-/**
- * Simple JWT decode for client-side use (no signature verification)
- * @param token - JWT token string
- * @returns Decoded payload or null if invalid
- */
-export function jwtDecode<T = any>(token: string): T | null {
-  if (!token) return null;
-
-  try {
-    const parts = token.split('.');
-    if (parts.length < 2) {
-      console.error('[JWT] Invalid token format');
-      return null;
-    }
-
-    const payload = parts[1];
-    const decoded = base64urlDecode(payload);
-    const parsedPayload = JSON.parse(decoded);
-
-    return parsedPayload;
-  } catch (e) {
-    console.error('[JWT] Decode failed:', e instanceof Error ? e.message : 'Unknown error');
-    return null;
-  }
-}
+/**
+ * Client-safe JWT decode (no Node.js dependencies)
+ * This is a lightweight version for browser usage
+ */
+
+// Decode base64url
+function base64urlDecode(base64url: string): string {
+  try {
+    // Convert base64url to base64
+    let base64 = base64url.replace(/-/g, '+').replace(/_/g, '/');
+    // Add padding if needed
+    while (base64.length % 4) {
+      base64 += '=';
+    }
+    return atob(base64);
+  } catch (e) {
+    throw new Error('Invalid base64url encoding');
+  }
+}
+
+/**
+ * Simple JWT decode for client-side use (no signature verification)
+ * @param token - JWT token string
+ * @returns Decoded payload or null if invalid
+ */
+export function jwtDecode<T = any>(token: string): T | null {
+  if (!token) return null;
+
+  try {
+    const parts = token.split('.');
+    if (parts.length < 2) {
+      console.error('[JWT] Invalid token format');
+      return null;
+    }
+
+    const payload = parts[1];
+    const decoded = base64urlDecode(payload);
+    const parsedPayload = JSON.parse(decoded);
+
+    return parsedPayload;
+  } catch (e) {
+    console.error('[JWT] Decode failed:', e instanceof Error ? e.message : 'Unknown error');
+    return null;
+  }
+}

package/src/lib/jwt-decode.ts

@@ -1,83 +1,83 @@
-import { jwtDecode as originalJwtDecode } from 'jwt-decode';
-
-// Define JwtPayload interface since jwt-decode v4 doesn't export it
-export interface JwtPayload {
-    iss?: string;
-    sub?: string;
-    aud?: string[] | string;
-    exp?: number;
-    nbf?: number;
-    iat?: number;
-    jti?: string;
-}
-
-/**
- * JWT Header structure.
- * Contains metadata about the token including the signing key ID.
- */
-export interface JwtHeader {
-    /** Algorithm used to sign the token (e.g., 'RS256', 'HS256') */
-    alg: string;
-    /** Token type (typically 'JWT') */
-    typ?: string;
-    /** Key ID - identifies which key was used to sign this token */
-    kid?: string;
-    /** Content type */
-    cty?: string;
-}
-
-/**
- * Decode JWT payload (standard claims).
- * This is a thin wrapper around jwt-decode library.
- */
-export function jwtDecode<T = JwtPayload>(token: string): T {
-    return originalJwtDecode<T>(token);
-}
-
-/**
- * Decode JWT header to extract kid, alg, and other header claims.
- *
- * The JWT header contains critical information:
- * - kid: Key ID used to sign the token (needed for key governance)
- * - alg: Algorithm used for signing
- * - typ: Token type
- *
- * @param token - The JWT token string
- * @returns Decoded header or null if decoding fails
- */
-export function decodeJwtHeader(token: string): JwtHeader | null {
-    try {
-        if (!token || typeof token !== 'string') {
-            return null;
-        }
-
-        const parts = token.split('.');
-        if (parts.length !== 3) {
-            console.warn('[JWT_DECODE] Invalid JWT structure - expected 3 parts, got', parts.length);
-            return null;
-        }
-
-        // Decode base64url header (part 0)
-        const headerB64 = parts[0].replace(/-/g, '+').replace(/_/g, '/');
-        const headerJson = typeof atob !== 'undefined'
-            ? atob(headerB64)
-            : Buffer.from(headerB64, 'base64').toString('utf-8');
-
-        return JSON.parse(headerJson) as JwtHeader;
-    } catch (error) {
-        console.error('[JWT_DECODE] Failed to decode JWT header:', error);
-        return null;
-    }
-}
-
-/**
- * Extract just the kid (Key ID) from a JWT token.
- * Convenience function for when you only need the key ID.
- *
- * @param token - The JWT token string
- * @returns The kid value or undefined if not present/decodable
- */
-export function extractKidFromToken(token: string): string | undefined {
-    const header = decodeJwtHeader(token);
-    return header?.kid;
+import { jwtDecode as originalJwtDecode } from 'jwt-decode';
+
+// Define JwtPayload interface since jwt-decode v4 doesn't export it
+export interface JwtPayload {
+    iss?: string;
+    sub?: string;
+    aud?: string[] | string;
+    exp?: number;
+    nbf?: number;
+    iat?: number;
+    jti?: string;
+}
+
+/**
+ * JWT Header structure.
+ * Contains metadata about the token including the signing key ID.
+ */
+export interface JwtHeader {
+    /** Algorithm used to sign the token (e.g., 'RS256', 'HS256') */
+    alg: string;
+    /** Token type (typically 'JWT') */
+    typ?: string;
+    /** Key ID - identifies which key was used to sign this token */
+    kid?: string;
+    /** Content type */
+    cty?: string;
+}
+
+/**
+ * Decode JWT payload (standard claims).
+ * This is a thin wrapper around jwt-decode library.
+ */
+export function jwtDecode<T = JwtPayload>(token: string): T {
+    return originalJwtDecode<T>(token);
+}
+
+/**
+ * Decode JWT header to extract kid, alg, and other header claims.
+ *
+ * The JWT header contains critical information:
+ * - kid: Key ID used to sign the token (needed for key governance)
+ * - alg: Algorithm used for signing
+ * - typ: Token type
+ *
+ * @param token - The JWT token string
+ * @returns Decoded header or null if decoding fails
+ */
+export function decodeJwtHeader(token: string): JwtHeader | null {
+    try {
+        if (!token || typeof token !== 'string') {
+            return null;
+        }
+
+        const parts = token.split('.');
+        if (parts.length !== 3) {
+            console.warn('[JWT_DECODE] Invalid JWT structure - expected 3 parts, got', parts.length);
+            return null;
+        }
+
+        // Decode base64url header (part 0)
+        const headerB64 = parts[0].replace(/-/g, '+').replace(/_/g, '/');
+        const headerJson = typeof atob !== 'undefined'
+            ? atob(headerB64)
+            : Buffer.from(headerB64, 'base64').toString('utf-8');
+
+        return JSON.parse(headerJson) as JwtHeader;
+    } catch (error) {
+        console.error('[JWT_DECODE] Failed to decode JWT header:', error);
+        return null;
+    }
+}
+
+/**
+ * Extract just the kid (Key ID) from a JWT token.
+ * Convenience function for when you only need the key ID.
+ *
+ * @param token - The JWT token string
+ * @returns The kid value or undefined if not present/decodable
+ */
+export function extractKidFromToken(token: string): string | undefined {
+    const header = decodeJwtHeader(token);
+    return header?.kid;
 }