@poly-x/next 0.1.0-alpha.14 → 0.1.0-alpha.15

package/dist/server.cjs

@@ -113,6 +113,24 @@ function collectForwardedDeviceHeaders(request) {
 	if (clientIp) forwarded["x-forwarded-for"] = clientIp;
 	return forwarded;
 }
+/**
+* Build the forwarded precise-location headers (`x-polyx-geo-*`) from the browser's login
+* body (v6, FR-LOC-7). The browser captures a consented position client-side and posts it;
+* the platform reads these on the token exchange. Only well-formed values are forwarded, and
+* the consent state rides even when coordinates are absent (denied/timeout → coarse fallback).
+*/
+function geoHeadersFromBody(geo) {
+	const headers = {};
+	if (!geo || typeof geo !== "object") return headers;
+	const g = geo;
+	const lat = Number(g.latitude);
+	const lon = Number(g.longitude);
+	if (typeof g.latitude === "string" && Number.isFinite(lat) && lat >= -90 && lat <= 90) headers["x-polyx-geo-lat"] = g.latitude;
+	if (typeof g.longitude === "string" && Number.isFinite(lon) && lon >= -180 && lon <= 180) headers["x-polyx-geo-lon"] = g.longitude;
+	if (typeof g.accuracyMeters === "number" && Number.isFinite(g.accuracyMeters) && g.accuracyMeters >= 0) headers["x-polyx-geo-accuracy"] = String(g.accuracyMeters);
+	if (g.consent === "granted" || g.consent === "denied" || g.consent === "revoked") headers["x-polyx-geo-consent"] = g.consent;
+	return headers;
+}
 /** Read the current session — safe in Server Components (no cookie write). */
 async function auth(overrides) {
 	const config = resolveNextConfig(overrides);
@@ -169,6 +187,7 @@ function createAuthHandlers(handlersConfig = {}) {
 			} catch {
 				return Response.json({ status: "invalid_request" }, { status: 400 });
 			}
+			const geoHeaders = geoHeadersFromBody(payload.geo);
 			const email = typeof payload.email === "string" ? payload.email : "";
 			const password = typeof payload.password === "string" ? payload.password : "";
 			if (!email || !password) return Response.json({ status: "invalid_request" }, { status: 400 });
@@ -190,7 +209,10 @@ function createAuthHandlers(handlersConfig = {}) {
 				});
 				switch (outcome.type) {
 					case "authorized":
-						await newSession(adapt(await (0, next_headers.cookies)()), config, secure).establishFromCode(outcome.code, verifier, redirectUri, collectForwardedDeviceHeaders(request));
+						await newSession(adapt(await (0, next_headers.cookies)()), config, secure).establishFromCode(outcome.code, verifier, redirectUri, {
+							...collectForwardedDeviceHeaders(request),
+							...geoHeaders
+						});
 						return Response.json({
 							status: "success",
 							redirectTo: afterSignInPath

package/dist/server.mjs

@@ -112,6 +112,24 @@ function collectForwardedDeviceHeaders(request) {
 	if (clientIp) forwarded["x-forwarded-for"] = clientIp;
 	return forwarded;
 }
+/**
+* Build the forwarded precise-location headers (`x-polyx-geo-*`) from the browser's login
+* body (v6, FR-LOC-7). The browser captures a consented position client-side and posts it;
+* the platform reads these on the token exchange. Only well-formed values are forwarded, and
+* the consent state rides even when coordinates are absent (denied/timeout → coarse fallback).
+*/
+function geoHeadersFromBody(geo) {
+	const headers = {};
+	if (!geo || typeof geo !== "object") return headers;
+	const g = geo;
+	const lat = Number(g.latitude);
+	const lon = Number(g.longitude);
+	if (typeof g.latitude === "string" && Number.isFinite(lat) && lat >= -90 && lat <= 90) headers["x-polyx-geo-lat"] = g.latitude;
+	if (typeof g.longitude === "string" && Number.isFinite(lon) && lon >= -180 && lon <= 180) headers["x-polyx-geo-lon"] = g.longitude;
+	if (typeof g.accuracyMeters === "number" && Number.isFinite(g.accuracyMeters) && g.accuracyMeters >= 0) headers["x-polyx-geo-accuracy"] = String(g.accuracyMeters);
+	if (g.consent === "granted" || g.consent === "denied" || g.consent === "revoked") headers["x-polyx-geo-consent"] = g.consent;
+	return headers;
+}
 /** Read the current session — safe in Server Components (no cookie write). */
 async function auth(overrides) {
 	const config = resolveNextConfig(overrides);
@@ -168,6 +186,7 @@ function createAuthHandlers(handlersConfig = {}) {
 			} catch {
 				return Response.json({ status: "invalid_request" }, { status: 400 });
 			}
+			const geoHeaders = geoHeadersFromBody(payload.geo);
 			const email = typeof payload.email === "string" ? payload.email : "";
 			const password = typeof payload.password === "string" ? payload.password : "";
 			if (!email || !password) return Response.json({ status: "invalid_request" }, { status: 400 });
@@ -189,7 +208,10 @@ function createAuthHandlers(handlersConfig = {}) {
 				});
 				switch (outcome.type) {
 					case "authorized":
-						await newSession(adapt(await cookies()), config, secure).establishFromCode(outcome.code, verifier, redirectUri, collectForwardedDeviceHeaders(request));
+						await newSession(adapt(await cookies()), config, secure).establishFromCode(outcome.code, verifier, redirectUri, {
+							...collectForwardedDeviceHeaders(request),
+							...geoHeaders
+						});
 						return Response.json({
 							status: "success",
 							redirectTo: afterSignInPath

package/package.json

@@ -1,6 +1,6 @@
 {
   "name": "@poly-x/next",
-  "version": "0.1.0-alpha.14",
+  "version": "0.1.0-alpha.15",
   "description": "PolyX SDK for Next.js App Router - components plus server helpers",
   "license": "MIT",
   "type": "module",
@@ -47,8 +47,8 @@
   "module": "./dist/index.mjs",
   "types": "./dist/index.d.cts",
   "dependencies": {
-    "@poly-x/core": "0.1.0-alpha.14",
-    "@poly-x/react": "0.1.0-alpha.14"
+    "@poly-x/react": "0.1.0-alpha.15",
+    "@poly-x/core": "0.1.0-alpha.15"
   },
   "peerDependencies": {
     "next": ">=14",