@poly-x/next 0.1.0-alpha.13 → 0.1.0-alpha.15

package/dist/proxy.cjs

@@ -1,5 +1,5 @@
 Object.defineProperty(exports, Symbol.toStringTag, { value: "Module" });
-require("./server-session-BpRaJCz9.cjs");
+require("./server-session-QJLA_Tz-.cjs");
 let next_server = require("next/server");
 //#region src/proxy.ts
 /**

package/dist/proxy.mjs

@@ -1,4 +1,4 @@
-import "./server-session-DedPwl4b.mjs";
+import "./server-session-CjP44zFC.mjs";
 import { NextResponse } from "next/server";
 //#region src/proxy.ts
 /**

package/dist/{server-session-DedPwl4b.mjs → server-session-CjP44zFC.mjs}

@@ -85,11 +85,12 @@ var ServerSession = class {
 		this.cookieName = options.cookieName ?? "polyx_session";
 		this.secure = options.secure ?? true;
 	}
-	async establishFromCode(code, codeVerifier, redirectUri) {
+	async establishFromCode(code, codeVerifier, redirectUri, forwardedHeaders) {
 		const stored = await this.authClient.exchangeCode({
 			code,
 			codeVerifier,
-			redirectUri
+			redirectUri,
+			forwardedHeaders
 		});
 		await this.write(stored);
 		return stored;

package/dist/{server-session-BpRaJCz9.cjs → server-session-QJLA_Tz-.cjs}

@@ -85,11 +85,12 @@ var ServerSession = class {
 		this.cookieName = options.cookieName ?? "polyx_session";
 		this.secure = options.secure ?? true;
 	}
-	async establishFromCode(code, codeVerifier, redirectUri) {
+	async establishFromCode(code, codeVerifier, redirectUri, forwardedHeaders) {
 		const stored = await this.authClient.exchangeCode({
 			code,
 			codeVerifier,
-			redirectUri
+			redirectUri,
+			forwardedHeaders
 		});
 		await this.write(stored);
 		return stored;

package/dist/server.cjs

@@ -1,5 +1,5 @@
 Object.defineProperty(exports, Symbol.toStringTag, { value: "Module" });
-const require_server_session = require("./server-session-BpRaJCz9.cjs");
+const require_server_session = require("./server-session-QJLA_Tz-.cjs");
 let _poly_x_core = require("@poly-x/core");
 let next_headers = require("next/headers");
 //#region src/config.ts
@@ -72,6 +72,65 @@ function resolveCookieSecure(request, config) {
 		return true;
 	}
 }
+/** Browser request headers the platform reads for session device attribution. */
+const FORWARDED_DEVICE_HEADERS = [
+	"user-agent",
+	"accept-language",
+	"sec-ch-ua",
+	"sec-ch-ua-platform",
+	"sec-ch-ua-mobile",
+	"sec-ch-ua-model"
+];
+/**
+* The end user's IP as observed by THIS BFF's own infrastructure — the left-most
+* entry of the inbound `x-forwarded-for` (what the platform/proxy in front of the
+* app set), falling back to `x-real-ip`. Returns undefined on localhost/dev where
+* neither is present, letting the platform fall back to its own resolution rather
+* than recording a blank. (This trusts the infra-set forwarded chain, not a value
+* the browser could set on the same-origin BFF request.)
+*/
+function resolveClientIp(request) {
+	const first = request.headers.get("x-forwarded-for")?.split(",")[0]?.trim();
+	if (first) return first;
+	return request.headers.get("x-real-ip")?.trim() || void 0;
+}
+/**
+* Curate the browser context to forward on the session-creating token exchange.
+* In a BFF deployment the outbound call to poly-auth is made by Node, so without
+* this the platform attributes the session to the server ("node"/Unknown UA, the
+* server's IP). We forward a fixed allowlist of the browser's own request headers
+* plus the observed client IP (as `x-forwarded-for`). Only headers actually
+* present are forwarded — never blank values that would clobber the platform's
+* own fallback resolution.
+*/
+function collectForwardedDeviceHeaders(request) {
+	const forwarded = {};
+	for (const name of FORWARDED_DEVICE_HEADERS) {
+		const value = request.headers.get(name);
+		if (value) forwarded[name] = value;
+	}
+	const clientIp = resolveClientIp(request);
+	if (clientIp) forwarded["x-forwarded-for"] = clientIp;
+	return forwarded;
+}
+/**
+* Build the forwarded precise-location headers (`x-polyx-geo-*`) from the browser's login
+* body (v6, FR-LOC-7). The browser captures a consented position client-side and posts it;
+* the platform reads these on the token exchange. Only well-formed values are forwarded, and
+* the consent state rides even when coordinates are absent (denied/timeout → coarse fallback).
+*/
+function geoHeadersFromBody(geo) {
+	const headers = {};
+	if (!geo || typeof geo !== "object") return headers;
+	const g = geo;
+	const lat = Number(g.latitude);
+	const lon = Number(g.longitude);
+	if (typeof g.latitude === "string" && Number.isFinite(lat) && lat >= -90 && lat <= 90) headers["x-polyx-geo-lat"] = g.latitude;
+	if (typeof g.longitude === "string" && Number.isFinite(lon) && lon >= -180 && lon <= 180) headers["x-polyx-geo-lon"] = g.longitude;
+	if (typeof g.accuracyMeters === "number" && Number.isFinite(g.accuracyMeters) && g.accuracyMeters >= 0) headers["x-polyx-geo-accuracy"] = String(g.accuracyMeters);
+	if (g.consent === "granted" || g.consent === "denied" || g.consent === "revoked") headers["x-polyx-geo-consent"] = g.consent;
+	return headers;
+}
 /** Read the current session — safe in Server Components (no cookie write). */
 async function auth(overrides) {
 	const config = resolveNextConfig(overrides);
@@ -128,6 +187,7 @@ function createAuthHandlers(handlersConfig = {}) {
 			} catch {
 				return Response.json({ status: "invalid_request" }, { status: 400 });
 			}
+			const geoHeaders = geoHeadersFromBody(payload.geo);
 			const email = typeof payload.email === "string" ? payload.email : "";
 			const password = typeof payload.password === "string" ? payload.password : "";
 			if (!email || !password) return Response.json({ status: "invalid_request" }, { status: 400 });
@@ -149,7 +209,10 @@ function createAuthHandlers(handlersConfig = {}) {
 				});
 				switch (outcome.type) {
 					case "authorized":
-						await newSession(adapt(await (0, next_headers.cookies)()), config, secure).establishFromCode(outcome.code, verifier, redirectUri);
+						await newSession(adapt(await (0, next_headers.cookies)()), config, secure).establishFromCode(outcome.code, verifier, redirectUri, {
+							...collectForwardedDeviceHeaders(request),
+							...geoHeaders
+						});
 						return Response.json({
 							status: "success",
 							redirectTo: afterSignInPath
@@ -249,7 +312,7 @@ function createAuthHandlers(handlersConfig = {}) {
 			if (!code || !state || !raw) return Response.redirect(home, 302);
 			const tx = JSON.parse(raw);
 			if (tx.state !== state) return Response.redirect(home, 302);
-			await newSession(adapt(store), config, secure).establishFromCode(code, tx.verifier, tx.redirectUri);
+			await newSession(adapt(store), config, secure).establishFromCode(code, tx.verifier, tx.redirectUri, collectForwardedDeviceHeaders(request));
 			return Response.redirect(home, 302);
 		},
 		async refresh(request) {

package/dist/server.d.cts

@@ -58,7 +58,7 @@ declare class ServerSession {
   private readonly cookieName;
   private readonly secure;
   constructor(options: ServerSessionOptions);
-  establishFromCode(code: string, codeVerifier: string, redirectUri: string): Promise<StoredSession>;
+  establishFromCode(code: string, codeVerifier: string, redirectUri: string, forwardedHeaders?: Record<string, string>): Promise<StoredSession>;
   read(): Promise<StoredSession | null>;
   /** Rotate the tokens; clears the cookie (returns null) on a terminal refresh failure. */
   refresh(): Promise<StoredSession | null>;

package/dist/server.d.mts

@@ -58,7 +58,7 @@ declare class ServerSession {
   private readonly cookieName;
   private readonly secure;
   constructor(options: ServerSessionOptions);
-  establishFromCode(code: string, codeVerifier: string, redirectUri: string): Promise<StoredSession>;
+  establishFromCode(code: string, codeVerifier: string, redirectUri: string, forwardedHeaders?: Record<string, string>): Promise<StoredSession>;
   read(): Promise<StoredSession | null>;
   /** Rotate the tokens; clears the cookie (returns null) on a terminal refresh failure. */
   refresh(): Promise<StoredSession | null>;

package/dist/server.mjs

@@ -1,4 +1,4 @@
-import { a as sealSession, i as openSession, n as ServerSession, r as toAuthContext, t as DEFAULT_SESSION_COOKIE } from "./server-session-DedPwl4b.mjs";
+import { a as sealSession, i as openSession, n as ServerSession, r as toAuthContext, t as DEFAULT_SESSION_COOKIE } from "./server-session-CjP44zFC.mjs";
 import { AuthClient, FetchTransport, generatePkce, randomState, resolveConfig } from "@poly-x/core";
 import { cookies } from "next/headers";
 //#region src/config.ts
@@ -71,6 +71,65 @@ function resolveCookieSecure(request, config) {
 		return true;
 	}
 }
+/** Browser request headers the platform reads for session device attribution. */
+const FORWARDED_DEVICE_HEADERS = [
+	"user-agent",
+	"accept-language",
+	"sec-ch-ua",
+	"sec-ch-ua-platform",
+	"sec-ch-ua-mobile",
+	"sec-ch-ua-model"
+];
+/**
+* The end user's IP as observed by THIS BFF's own infrastructure — the left-most
+* entry of the inbound `x-forwarded-for` (what the platform/proxy in front of the
+* app set), falling back to `x-real-ip`. Returns undefined on localhost/dev where
+* neither is present, letting the platform fall back to its own resolution rather
+* than recording a blank. (This trusts the infra-set forwarded chain, not a value
+* the browser could set on the same-origin BFF request.)
+*/
+function resolveClientIp(request) {
+	const first = request.headers.get("x-forwarded-for")?.split(",")[0]?.trim();
+	if (first) return first;
+	return request.headers.get("x-real-ip")?.trim() || void 0;
+}
+/**
+* Curate the browser context to forward on the session-creating token exchange.
+* In a BFF deployment the outbound call to poly-auth is made by Node, so without
+* this the platform attributes the session to the server ("node"/Unknown UA, the
+* server's IP). We forward a fixed allowlist of the browser's own request headers
+* plus the observed client IP (as `x-forwarded-for`). Only headers actually
+* present are forwarded — never blank values that would clobber the platform's
+* own fallback resolution.
+*/
+function collectForwardedDeviceHeaders(request) {
+	const forwarded = {};
+	for (const name of FORWARDED_DEVICE_HEADERS) {
+		const value = request.headers.get(name);
+		if (value) forwarded[name] = value;
+	}
+	const clientIp = resolveClientIp(request);
+	if (clientIp) forwarded["x-forwarded-for"] = clientIp;
+	return forwarded;
+}
+/**
+* Build the forwarded precise-location headers (`x-polyx-geo-*`) from the browser's login
+* body (v6, FR-LOC-7). The browser captures a consented position client-side and posts it;
+* the platform reads these on the token exchange. Only well-formed values are forwarded, and
+* the consent state rides even when coordinates are absent (denied/timeout → coarse fallback).
+*/
+function geoHeadersFromBody(geo) {
+	const headers = {};
+	if (!geo || typeof geo !== "object") return headers;
+	const g = geo;
+	const lat = Number(g.latitude);
+	const lon = Number(g.longitude);
+	if (typeof g.latitude === "string" && Number.isFinite(lat) && lat >= -90 && lat <= 90) headers["x-polyx-geo-lat"] = g.latitude;
+	if (typeof g.longitude === "string" && Number.isFinite(lon) && lon >= -180 && lon <= 180) headers["x-polyx-geo-lon"] = g.longitude;
+	if (typeof g.accuracyMeters === "number" && Number.isFinite(g.accuracyMeters) && g.accuracyMeters >= 0) headers["x-polyx-geo-accuracy"] = String(g.accuracyMeters);
+	if (g.consent === "granted" || g.consent === "denied" || g.consent === "revoked") headers["x-polyx-geo-consent"] = g.consent;
+	return headers;
+}
 /** Read the current session — safe in Server Components (no cookie write). */
 async function auth(overrides) {
 	const config = resolveNextConfig(overrides);
@@ -127,6 +186,7 @@ function createAuthHandlers(handlersConfig = {}) {
 			} catch {
 				return Response.json({ status: "invalid_request" }, { status: 400 });
 			}
+			const geoHeaders = geoHeadersFromBody(payload.geo);
 			const email = typeof payload.email === "string" ? payload.email : "";
 			const password = typeof payload.password === "string" ? payload.password : "";
 			if (!email || !password) return Response.json({ status: "invalid_request" }, { status: 400 });
@@ -148,7 +208,10 @@ function createAuthHandlers(handlersConfig = {}) {
 				});
 				switch (outcome.type) {
 					case "authorized":
-						await newSession(adapt(await cookies()), config, secure).establishFromCode(outcome.code, verifier, redirectUri);
+						await newSession(adapt(await cookies()), config, secure).establishFromCode(outcome.code, verifier, redirectUri, {
+							...collectForwardedDeviceHeaders(request),
+							...geoHeaders
+						});
 						return Response.json({
 							status: "success",
 							redirectTo: afterSignInPath
@@ -248,7 +311,7 @@ function createAuthHandlers(handlersConfig = {}) {
 			if (!code || !state || !raw) return Response.redirect(home, 302);
 			const tx = JSON.parse(raw);
 			if (tx.state !== state) return Response.redirect(home, 302);
-			await newSession(adapt(store), config, secure).establishFromCode(code, tx.verifier, tx.redirectUri);
+			await newSession(adapt(store), config, secure).establishFromCode(code, tx.verifier, tx.redirectUri, collectForwardedDeviceHeaders(request));
 			return Response.redirect(home, 302);
 		},
 		async refresh(request) {

package/package.json

@@ -1,6 +1,6 @@
 {
   "name": "@poly-x/next",
-  "version": "0.1.0-alpha.13",
+  "version": "0.1.0-alpha.15",
   "description": "PolyX SDK for Next.js App Router - components plus server helpers",
   "license": "MIT",
   "type": "module",
@@ -47,8 +47,8 @@
   "module": "./dist/index.mjs",
   "types": "./dist/index.d.cts",
   "dependencies": {
-    "@poly-x/core": "0.1.0-alpha.13",
-    "@poly-x/react": "0.1.0-alpha.13"
+    "@poly-x/react": "0.1.0-alpha.15",
+    "@poly-x/core": "0.1.0-alpha.15"
   },
   "peerDependencies": {
     "next": ">=14",