@poly-x/next 0.1.0-alpha.1 → 0.1.0-alpha.11

package/dist/server.mjs

@@ -1,7 +1,14 @@
-import { a as sealSession, i as openSession, n as ServerSession, r as toAuthContext, t as DEFAULT_SESSION_COOKIE } from "./server-session-B3zJ7CS8.mjs";
+import { a as sealSession, i as openSession, n as ServerSession, r as toAuthContext, t as DEFAULT_SESSION_COOKIE } from "./server-session-DedPwl4b.mjs";
 import { AuthClient, FetchTransport, generatePkce, randomState, resolveConfig } from "@poly-x/core";
 import { cookies } from "next/headers";
 //#region src/config.ts
+/** Parse a boolean-ish env var; undefined when unset/unrecognized (→ auto-derive). */
+function parseBoolEnv(value) {
+	if (value === void 0) return void 0;
+	const v = value.trim().toLowerCase();
+	if (v === "true" || v === "1") return true;
+	if (v === "false" || v === "0") return false;
+}
 function resolveNextConfig(overrides = {}) {
 	const publishableKey = overrides.publishableKey ?? process.env.NEXT_PUBLIC_POLYX_PUBLISHABLE_KEY;
 	const secret = overrides.secret ?? process.env.POLYX_SESSION_SECRET;
@@ -11,7 +18,8 @@ function resolveNextConfig(overrides = {}) {
 		publishableKey,
 		secret,
 		baseUrl: overrides.baseUrl ?? process.env.POLYX_BASE_URL,
-		signInUrl: overrides.signInUrl ?? process.env.NEXT_PUBLIC_POLYX_SIGN_IN_URL
+		signInUrl: overrides.signInUrl ?? process.env.NEXT_PUBLIC_POLYX_SIGN_IN_URL,
+		cookieSecure: overrides.cookieSecure ?? parseBoolEnv(process.env.POLYX_COOKIE_SECURE)
 	};
 }
 function buildServerAuthClient(config) {
@@ -35,6 +43,8 @@ function buildServerAuthClient(config) {
 */
 const VERIFIER_COOKIE = "polyx_pkce";
 const VERIFIER_MAX_AGE = 600;
+/** poly-auth's own floor (Joi: min 6, max 128) — reject early rather than round-trip. */
+const MIN_PASSWORD_LENGTH = 6;
 function adapt(store) {
 	return {
 		get: (name) => store.get(name)?.value,
@@ -45,6 +55,22 @@ function adapt(store) {
 async function requestCookies() {
 	return adapt(await cookies());
 }
+/**
+* Decide the cookie `Secure` attribute for this request. An explicit `cookieSecure`
+* (from `POLYX_COOKIE_SECURE` or code) wins; otherwise derive from the transport —
+* `x-forwarded-proto` (proxied TLS) then the request URL — and fail secure if unknown.
+* A Secure cookie is dropped by the browser over http, so http/localhost must be false.
+*/
+function resolveCookieSecure(request, config) {
+	if (config.cookieSecure !== void 0) return config.cookieSecure;
+	const forwarded = request.headers.get("x-forwarded-proto");
+	if (forwarded) return forwarded.split(",")[0].trim() === "https";
+	try {
+		return new URL(request.url).protocol === "https:";
+	} catch {
+		return true;
+	}
+}
 /** Read the current session — safe in Server Components (no cookie write). */
 async function auth(overrides) {
 	const config = resolveNextConfig(overrides);
@@ -57,16 +83,18 @@ async function auth(overrides) {
 function createAuthHandlers(handlersConfig = {}) {
 	const callbackPath = handlersConfig.callbackPath ?? "/api/polyx/callback";
 	const afterSignInPath = handlersConfig.afterSignInPath ?? "/";
-	function newSession(store, config) {
+	function newSession(store, config, secure) {
 		return new ServerSession({
 			authClient: buildServerAuthClient(config),
 			secret: config.secret,
-			cookies: store
+			cookies: store,
+			secure
 		});
 	}
 	return {
 		async signin(request) {
 			const config = resolveNextConfig(handlersConfig);
+			const secure = resolveCookieSecure(request, config);
 			const redirectUri = `${new URL(request.url).origin}${callbackPath}`;
 			const { verifier, challenge } = await generatePkce();
 			const state = randomState();
@@ -76,7 +104,7 @@ function createAuthHandlers(handlersConfig = {}) {
 				redirectUri
 			}), {
 				httpOnly: true,
-				secure: true,
+				secure,
 				sameSite: "lax",
 				path: "/",
 				maxAge: VERIFIER_MAX_AGE
@@ -88,8 +116,128 @@ function createAuthHandlers(handlersConfig = {}) {
 			});
 			return Response.redirect(url, 302);
 		},
+		async authenticate(request) {
+			const config = resolveNextConfig(handlersConfig);
+			const secure = resolveCookieSecure(request, config);
+			const redirectUri = `${new URL(request.url).origin}${callbackPath}`;
+			const client = buildServerAuthClient(config);
+			let payload;
+			try {
+				payload = await request.json();
+			} catch {
+				return Response.json({ status: "invalid_request" }, { status: 400 });
+			}
+			const email = typeof payload.email === "string" ? payload.email : "";
+			const password = typeof payload.password === "string" ? payload.password : "";
+			if (!email || !password) return Response.json({ status: "invalid_request" }, { status: 400 });
+			const organizationCode = typeof payload.organizationCode === "string" ? payload.organizationCode : void 0;
+			const tenantId = typeof payload.tenantId === "string" ? payload.tenantId : void 0;
+			const newPassword = typeof payload.newPassword === "string" ? payload.newPassword : void 0;
+			const confirmPassword = typeof payload.confirmPassword === "string" ? payload.confirmPassword : void 0;
+			/** One authorize attempt, mapped to the wire response (sealing the session on success). */
+			async function attempt(withPassword) {
+				const { verifier, challenge } = await generatePkce();
+				const outcome = await client.authorizeWithPassword({
+					email,
+					password: withPassword,
+					redirectUri,
+					state: randomState(),
+					challenge,
+					organizationCode,
+					tenantId
+				});
+				switch (outcome.type) {
+					case "authorized":
+						await newSession(adapt(await cookies()), config, secure).establishFromCode(outcome.code, verifier, redirectUri);
+						return Response.json({
+							status: "success",
+							redirectTo: afterSignInPath
+						});
+					case "select_tenant": return Response.json({
+						status: "select_tenant",
+						tenants: outcome.tenants,
+						state: outcome.state
+					});
+					case "password_change_required": return Response.json({
+						status: "password_change_required",
+						userId: outcome.userId
+					}, { status: 403 });
+					case "no_access": return Response.json({ status: "no_access" }, { status: 403 });
+					default: return Response.json({ status: "invalid_credentials" }, { status: 401 });
+				}
+			}
+			if (newPassword === void 0) return attempt(password);
+			if (newPassword.length < MIN_PASSWORD_LENGTH) return Response.json({
+				status: "weak_password",
+				minLength: MIN_PASSWORD_LENGTH
+			}, { status: 400 });
+			if (newPassword !== confirmPassword) return Response.json({ status: "password_mismatch" }, { status: 400 });
+			const { challenge } = await generatePkce();
+			const proof = await client.authorizeWithPassword({
+				email,
+				password,
+				redirectUri,
+				state: randomState(),
+				challenge,
+				organizationCode,
+				tenantId
+			});
+			if (proof.type !== "password_change_required") return Response.json({ status: "invalid_credentials" }, { status: 401 });
+			await client.setPassword({
+				userId: proof.userId,
+				newPassword,
+				confirmPassword,
+				ticket: proof.ticket
+			});
+			return attempt(newPassword);
+		},
+		async forgotPassword(request) {
+			const config = resolveNextConfig(handlersConfig);
+			let payload;
+			try {
+				payload = await request.json();
+			} catch {
+				return Response.json({ status: "invalid_request" }, { status: 400 });
+			}
+			const email = typeof payload.email === "string" ? payload.email.trim() : "";
+			if (!email) return Response.json({ status: "invalid_request" }, { status: 400 });
+			try {
+				await buildServerAuthClient(config).requestPasswordReset({ email });
+			} catch {}
+			return Response.json({ status: "accepted" });
+		},
+		async resetPassword(request) {
+			const config = resolveNextConfig(handlersConfig);
+			let payload;
+			try {
+				payload = await request.json();
+			} catch {
+				return Response.json({ status: "invalid_request" }, { status: 400 });
+			}
+			const token = typeof payload.token === "string" ? payload.token : "";
+			const newPassword = typeof payload.newPassword === "string" ? payload.newPassword : "";
+			const confirmPassword = typeof payload.confirmPassword === "string" ? payload.confirmPassword : void 0;
+			if (!token) return Response.json({ status: "invalid_request" }, { status: 400 });
+			if (newPassword.length < MIN_PASSWORD_LENGTH) return Response.json({
+				status: "weak_password",
+				minLength: MIN_PASSWORD_LENGTH
+			}, { status: 400 });
+			if (confirmPassword !== void 0 && newPassword !== confirmPassword) return Response.json({ status: "password_mismatch" }, { status: 400 });
+			switch (await buildServerAuthClient(config).resetPassword({
+				token,
+				newPassword
+			})) {
+				case "ok": return Response.json({ status: "success" });
+				case "weak_password": return Response.json({
+					status: "weak_password",
+					minLength: MIN_PASSWORD_LENGTH
+				}, { status: 400 });
+				default: return Response.json({ status: "invalid_or_expired" }, { status: 400 });
+			}
+		},
 		async callback(request) {
 			const config = resolveNextConfig(handlersConfig);
+			const secure = resolveCookieSecure(request, config);
 			const url = new URL(request.url);
 			const code = url.searchParams.get("code");
 			const state = url.searchParams.get("state");
@@ -100,21 +248,35 @@ function createAuthHandlers(handlersConfig = {}) {
 			if (!code || !state || !raw) return Response.redirect(home, 302);
 			const tx = JSON.parse(raw);
 			if (tx.state !== state) return Response.redirect(home, 302);
-			await newSession(adapt(store), config).establishFromCode(code, tx.verifier, tx.redirectUri);
+			await newSession(adapt(store), config, secure).establishFromCode(code, tx.verifier, tx.redirectUri);
 			return Response.redirect(home, 302);
 		},
-		async refresh() {
+		async refresh(request) {
 			const config = resolveNextConfig(handlersConfig);
-			const session = await newSession(await requestCookies(), config).refresh();
+			const secure = resolveCookieSecure(request, config);
+			const session = await newSession(await requestCookies(), config, secure).refresh();
 			return Response.json({ isSignedIn: session !== null }, { status: session ? 200 : 401 });
 		},
+		/**
+		* End the session: revoke it upstream (bearer-authenticated, using the sealed token)
+		* and unseal the cookie. `?scope=everywhere` signs the user out of every device.
+		*
+		* Content-negotiated so both callers work: a plain link/form navigation gets the 302 it
+		* expects, while `Accept: application/json` (what `<UserButton/>` sends) gets JSON and
+		* decides its own destination client-side. Deliberately no server-side redirect target
+		* — a caller-supplied one would be an open redirect on the auth path, and the client
+		* already knows where it wants to land.
+		*/
 		async signout(request) {
 			const config = resolveNextConfig(handlersConfig);
-			newSession(adapt(await cookies()), config).clear();
-			try {
-				await buildServerAuthClient(config).logout("device");
-			} catch {}
+			const secure = resolveCookieSecure(request, config);
+			const scope = new URL(request.url).searchParams.get("scope") === "everywhere" ? "everywhere" : "device";
+			await newSession(adapt(await cookies()), config, secure).revoke(scope);
+			if (request.headers.get("accept")?.includes("application/json")) return Response.json({ signedOut: true });
 			return Response.redirect(new URL(request.url).origin + "/", 302);
+		},
+		async session() {
+			return Response.json(await auth(handlersConfig));
 		}
 	};
 }