@propelauth/nextjs 0.0.111 → 0.0.112-beta.0

package/dist/server/app-router/index.mjs

@@ -42,8 +42,9 @@ import { NextResponse } from "next/server.js";
 
 // src/user.ts
 var UserFromToken = class {
-  constructor(userId, email, orgIdToOrgMemberInfo, firstName, lastName, username, legacyUserId, impersonatorUserId, properties) {
+  constructor(userId, email, orgIdToOrgMemberInfo, firstName, lastName, username, legacyUserId, impersonatorUserId, properties, activeOrgId) {
     this.userId = userId;
+    this.activeOrgId = activeOrgId;
     this.orgIdToOrgMemberInfo = orgIdToOrgMemberInfo;
     this.email = email;
     this.firstName = firstName;
@@ -53,6 +54,15 @@ var UserFromToken = class {
     this.impersonatorUserId = impersonatorUserId;
     this.properties = properties;
   }
+  getActiveOrg() {
+    if (!this.activeOrgId || !this.orgIdToOrgMemberInfo) {
+      return void 0;
+    }
+    return this.orgIdToOrgMemberInfo[this.activeOrgId];
+  }
+  getActiveOrgId() {
+    return this.activeOrgId;
+  }
   getOrg(orgId) {
     if (!this.orgIdToOrgMemberInfo) {
       return void 0;
@@ -85,9 +95,7 @@ var UserFromToken = class {
     const obj = JSON.parse(json);
     const orgIdToOrgMemberInfo = {};
     for (const orgId in obj.orgIdToOrgMemberInfo) {
-      orgIdToOrgMemberInfo[orgId] = OrgMemberInfo.fromJSON(
-        JSON.stringify(obj.orgIdToOrgMemberInfo[orgId])
-      );
+      orgIdToOrgMemberInfo[orgId] = OrgMemberInfo.fromJSON(JSON.stringify(obj.orgIdToOrgMemberInfo[orgId]));
     }
     return new UserFromToken(
       obj.userId,
@@ -101,6 +109,29 @@ var UserFromToken = class {
       obj.properties
     );
   }
+  static fromJwtPayload(payload) {
+    let activeOrgId;
+    let orgIdToOrgMemberInfo;
+    if (payload.org_member_info) {
+      activeOrgId = payload.org_member_info.org_id;
+      orgIdToOrgMemberInfo = toOrgIdToOrgMemberInfo({ [activeOrgId]: payload.org_member_info });
+    } else {
+      activeOrgId = void 0;
+      orgIdToOrgMemberInfo = toOrgIdToOrgMemberInfo(payload.org_id_to_org_member_info);
+    }
+    return new UserFromToken(
+      payload.user_id,
+      payload.email,
+      orgIdToOrgMemberInfo,
+      payload.first_name,
+      payload.last_name,
+      payload.username,
+      payload.legacy_user_id,
+      payload.impersonatorUserId,
+      payload.properties,
+      activeOrgId
+    );
+  }
 };
 var OrgMemberInfo = class {
   constructor(orgId, orgName, orgMetadata, urlSafeOrgName, userAssignedRole, userInheritedRolesPlusCurrentRole, userPermissions) {
@@ -149,17 +180,7 @@ var OrgMemberInfo = class {
   }
 };
 function toUser(snake_case) {
-  return new UserFromToken(
-    snake_case.user_id,
-    snake_case.email,
-    toOrgIdToOrgMemberInfo(snake_case.org_id_to_org_member_info),
-    snake_case.first_name,
-    snake_case.last_name,
-    snake_case.username,
-    snake_case.legacy_user_id,
-    snake_case.impersonatorUserId,
-    snake_case.properties
-  );
+  return UserFromToken.fromJwtPayload(snake_case);
 }
 function toOrgIdToOrgMemberInfo(snake_case) {
   if (snake_case === void 0) {
@@ -231,12 +252,17 @@ function getVerifierKey() {
   }
   return verifierKey.replace(/\\n/g, "\n");
 }
-function refreshTokenWithAccessAndRefreshToken(refreshToken) {
+function refreshTokenWithAccessAndRefreshToken(refreshToken, activeOrgId) {
   return __async(this, null, function* () {
     const body = {
       refresh_token: refreshToken
     };
-    const url = `${getAuthUrlOrigin()}/api/backend/v1/refresh_token`;
+    const queryParams = new URLSearchParams();
+    if (activeOrgId) {
+      queryParams.set("with_active_org_support", "true");
+      queryParams.set("active_org_id", activeOrgId);
+    }
+    const url = `${getAuthUrlOrigin()}/api/backend/v1/refresh_token?${queryParams.toString()}`;
     const response = yield fetch(url, {
       method: "POST",
       body: JSON.stringify(body),
@@ -248,10 +274,7 @@ function refreshTokenWithAccessAndRefreshToken(refreshToken) {
     if (response.ok) {
       const data = yield response.json();
       const newRefreshToken = data.refresh_token;
-      const {
-        access_token: accessToken,
-        expires_at_seconds: expiresAtSeconds
-      } = data.access_token;
+      const { access_token: accessToken, expires_at_seconds: expiresAtSeconds } = data.access_token;
       return {
         refreshToken: newRefreshToken,
         accessToken,
@@ -312,6 +335,9 @@ function validateAccessToken(accessToken) {
   });
 }
 
+// src/shared.ts
+var ACTIVE_ORG_ID_COOKIE_NAME = "__pa_org_id";
+
 // src/server/app-router.ts
 function getUserOrRedirect() {
   return __async(this, null, function* () {
@@ -326,8 +352,7 @@ function getUserOrRedirect() {
 }
 function getUser() {
   return __async(this, null, function* () {
-    var _a;
-    const accessToken = headers().get(CUSTOM_HEADER_FOR_ACCESS_TOKEN) || ((_a = cookies().get(ACCESS_TOKEN_COOKIE_NAME)) == null ? void 0 : _a.value);
+    const accessToken = getAccessToken();
     if (accessToken) {
       const user = yield validateAccessTokenOrUndefined(accessToken);
       if (user) {
@@ -338,14 +363,12 @@ function getUser() {
   });
 }
 function getAccessToken() {
-  return __async(this, null, function* () {
-    var _a;
-    return headers().get(CUSTOM_HEADER_FOR_ACCESS_TOKEN) || ((_a = cookies().get(ACCESS_TOKEN_COOKIE_NAME)) == null ? void 0 : _a.value);
-  });
+  var _a;
+  return headers().get(CUSTOM_HEADER_FOR_ACCESS_TOKEN) || ((_a = cookies().get(ACCESS_TOKEN_COOKIE_NAME)) == null ? void 0 : _a.value);
 }
 function authMiddleware(req) {
   return __async(this, null, function* () {
-    var _a, _b;
+    var _a, _b, _c;
     if (req.headers.has(CUSTOM_HEADER_FOR_ACCESS_TOKEN)) {
       throw new Error(`${CUSTOM_HEADER_FOR_ACCESS_TOKEN} is set which is for internal use only`);
     } else if (req.nextUrl.pathname === CALLBACK_PATH || req.nextUrl.pathname === LOGOUT_PATH || req.nextUrl.pathname === USERINFO_PATH) {
@@ -353,6 +376,7 @@ function authMiddleware(req) {
     }
     const accessToken = (_a = req.cookies.get(ACCESS_TOKEN_COOKIE_NAME)) == null ? void 0 : _a.value;
     const refreshToken = (_b = req.cookies.get(REFRESH_TOKEN_COOKIE_NAME)) == null ? void 0 : _b.value;
+    const activeOrgId = (_c = req.cookies.get(ACTIVE_ORG_ID_COOKIE_NAME)) == null ? void 0 : _c.value;
     if (accessToken) {
       const user = yield validateAccessTokenOrUndefined(accessToken);
       if (user) {
@@ -360,7 +384,7 @@ function authMiddleware(req) {
       }
     }
     if (refreshToken) {
-      const response = yield refreshTokenWithAccessAndRefreshToken(refreshToken);
+      const response = yield refreshTokenWithAccessAndRefreshToken(refreshToken, activeOrgId);
       if (response.error === "unexpected") {
         throw new Error("Unexpected error while refreshing access token");
       } else if (response.error === "unauthorized") {
@@ -421,7 +445,7 @@ function getRouteHandlers(args) {
   }
   function callbackGetHandler(req) {
     return __async(this, null, function* () {
-      var _a, _b;
+      var _a, _b, _c;
       const oauthState = (_a = req.cookies.get(STATE_COOKIE_NAME)) == null ? void 0 : _a.value;
       if (!oauthState || oauthState.length !== 64) {
         return new Response(null, { status: 302, headers: { Location: LOGIN_PATH } });
@@ -457,6 +481,49 @@ function getRouteHandlers(args) {
           console.error("postLoginRedirectPathFn returned undefined");
           return new Response("Unexpected error", { status: 500 });
         }
+        const currentActiveOrgId = (_c = req.cookies.get(ACTIVE_ORG_ID_COOKIE_NAME)) == null ? void 0 : _c.value;
+        const user = yield validateAccessToken(accessToken);
+        const isUserInCurrentActiveOrg = !!currentActiveOrgId && !!user.getOrg(currentActiveOrgId);
+        let activeOrgId = void 0;
+        if (isUserInCurrentActiveOrg) {
+          activeOrgId = currentActiveOrgId;
+        } else if (args == null ? void 0 : args.getDefaultActiveOrgId) {
+          activeOrgId = args.getDefaultActiveOrgId(user);
+        }
+        if (activeOrgId) {
+          const response2 = yield refreshTokenWithAccessAndRefreshToken(data.refresh_token, activeOrgId);
+          if (response2.error === "unexpected") {
+            throw new Error("Unexpected error while setting active org");
+          } else if (response2.error === "unauthorized") {
+            console.error(
+              "Unauthorized error while setting active org. Your user may not have access to this org"
+            );
+            return new Response("Unauthorized", { status: 401 });
+          } else {
+            const headers3 = new Headers();
+            headers3.append("Location", returnToPath);
+            headers3.append(
+              "Set-Cookie",
+              `${ACCESS_TOKEN_COOKIE_NAME}=${response2.accessToken}; Path=/; HttpOnly; Secure; SameSite=Lax`
+            );
+            headers3.append(
+              "Set-Cookie",
+              `${REFRESH_TOKEN_COOKIE_NAME}=${response2.refreshToken}; Path=/; HttpOnly; Secure; SameSite=Lax`
+            );
+            headers3.append(
+              "Set-Cookie",
+              `${ACTIVE_ORG_ID_COOKIE_NAME}=${activeOrgId}; Path=/; HttpOnly; Secure; SameSite=Lax`
+            );
+            headers3.append(
+              "Set-Cookie",
+              `${RETURN_TO_PATH_COOKIE_NAME}=; Path=/; HttpOnly; Secure; SameSite=Lax; Max-Age=0`
+            );
+            return new Response(null, {
+              status: 302,
+              headers: headers3
+            });
+          }
+        }
         const headers2 = new Headers();
         headers2.append("Location", returnToPath);
         headers2.append(
@@ -467,6 +534,10 @@ function getRouteHandlers(args) {
           "Set-Cookie",
           `${REFRESH_TOKEN_COOKIE_NAME}=${data.refresh_token}; Path=/; HttpOnly; Secure; SameSite=Lax`
         );
+        headers2.append(
+          "Set-Cookie",
+          `${ACTIVE_ORG_ID_COOKIE_NAME}=; Path=/; HttpOnly; Secure; SameSite=Lax; Max-Age=0`
+        );
         headers2.append(
           "Set-Cookie",
           `${RETURN_TO_PATH_COOKIE_NAME}=; Path=/; HttpOnly; Secure; SameSite=Lax; Max-Age=0`
@@ -487,10 +558,11 @@ function getRouteHandlers(args) {
   }
   function userinfoGetHandler(req) {
     return __async(this, null, function* () {
-      var _a;
+      var _a, _b;
       const oldRefreshToken = (_a = req.cookies.get(REFRESH_TOKEN_COOKIE_NAME)) == null ? void 0 : _a.value;
+      const activeOrgId = (_b = req.cookies.get(ACTIVE_ORG_ID_COOKIE_NAME)) == null ? void 0 : _b.value;
       if (oldRefreshToken) {
-        const refreshResponse = yield refreshTokenWithAccessAndRefreshToken(oldRefreshToken);
+        const refreshResponse = yield refreshTokenWithAccessAndRefreshToken(oldRefreshToken, activeOrgId);
         if (refreshResponse.error === "unexpected") {
           throw new Error("Unexpected error while refreshing access token");
         } else if (refreshResponse.error === "unauthorized") {
@@ -503,6 +575,10 @@ function getRouteHandlers(args) {
             "Set-Cookie",
             `${REFRESH_TOKEN_COOKIE_NAME}=; Path=/; HttpOnly; Secure; SameSite=Lax; Max-Age=0`
           );
+          headers3.append(
+            "Set-Cookie",
+            `${ACTIVE_ORG_ID_COOKIE_NAME}=; Path=/; HttpOnly; Secure; SameSite=Lax; Max-Age=0`
+          );
           return new Response("Unauthorized", { status: 401, headers: headers3 });
         }
         const refreshToken = refreshResponse.refreshToken;
@@ -521,7 +597,8 @@ function getRouteHandlers(args) {
           const jsonResponse = {
             userinfo: data,
             accessToken,
-            impersonatorUserId: userFromToken.impersonatorUserId
+            impersonatorUserId: userFromToken.impersonatorUserId,
+            activeOrgId
           };
           const headers3 = new Headers();
           headers3.append(
@@ -547,6 +624,10 @@ function getRouteHandlers(args) {
             "Set-Cookie",
             `${REFRESH_TOKEN_COOKIE_NAME}=; Path=/; HttpOnly; Secure; SameSite=Lax; Max-Age=0`
           );
+          headers3.append(
+            "Set-Cookie",
+            `${ACTIVE_ORG_ID_COOKIE_NAME}=; Path=/; HttpOnly; Secure; SameSite=Lax; Max-Age=0`
+          );
           return new Response(null, {
             status: 401,
             headers: headers3
@@ -558,12 +639,13 @@ function getRouteHandlers(args) {
       const headers2 = new Headers();
       headers2.append("Set-Cookie", `${ACCESS_TOKEN_COOKIE_NAME}=; Path=/; HttpOnly; Secure; SameSite=Lax; Max-Age=0`);
       headers2.append("Set-Cookie", `${REFRESH_TOKEN_COOKIE_NAME}=; Path=/; HttpOnly; Secure; SameSite=Lax; Max-Age=0`);
+      headers2.append("Set-Cookie", `${ACTIVE_ORG_ID_COOKIE_NAME}=; Path=/; HttpOnly; Secure; SameSite=Lax; Max-Age=0`);
       return new Response(null, { status: 401 });
     });
   }
   function logoutGetHandler(req) {
     return __async(this, null, function* () {
-      var _a;
+      var _a, _b;
       const path = (args == null ? void 0 : args.postLoginRedirectPathFn) ? args.postLoginRedirectPathFn(req) : "/";
       if (!path) {
         console.error("postLoginPathFn returned undefined");
@@ -581,12 +663,17 @@ function getRouteHandlers(args) {
           "Set-Cookie",
           `${REFRESH_TOKEN_COOKIE_NAME}=; Path=/; HttpOnly; Secure; SameSite=Lax; Max-Age=0`
         );
+        headers2.append(
+          "Set-Cookie",
+          `${ACTIVE_ORG_ID_COOKIE_NAME}=; Path=/; HttpOnly; Secure; SameSite=Lax; Max-Age=0`
+        );
         return new Response(null, {
           status: 302,
           headers: headers2
         });
       }
-      const refreshResponse = yield refreshTokenWithAccessAndRefreshToken(refreshToken);
+      const activeOrgId = (_b = req.cookies.get(ACTIVE_ORG_ID_COOKIE_NAME)) == null ? void 0 : _b.value;
+      const refreshResponse = yield refreshTokenWithAccessAndRefreshToken(refreshToken, activeOrgId);
       if (refreshResponse.error === "unexpected") {
         console.error("Unexpected error while refreshing access token");
         return new Response("Unexpected error", { status: 500 });
@@ -601,6 +688,10 @@ function getRouteHandlers(args) {
           "Set-Cookie",
           `${REFRESH_TOKEN_COOKIE_NAME}=; Path=/; HttpOnly; Secure; SameSite=Lax; Max-Age=0`
         );
+        headers2.append(
+          "Set-Cookie",
+          `${ACTIVE_ORG_ID_COOKIE_NAME}=; Path=/; HttpOnly; Secure; SameSite=Lax; Max-Age=0`
+        );
         return new Response(null, {
           status: 302,
           headers: headers2
@@ -629,6 +720,10 @@ function getRouteHandlers(args) {
           "Set-Cookie",
           `${REFRESH_TOKEN_COOKIE_NAME}=; Path=/; HttpOnly; Secure; SameSite=Lax; Max-Age=0`
         );
+        headers3.append(
+          "Set-Cookie",
+          `${ACTIVE_ORG_ID_COOKIE_NAME}=; Path=/; HttpOnly; Secure; SameSite=Lax; Max-Age=0`
+        );
         return new Response(null, { status: 200, headers: headers3 });
       }
       const authUrlOrigin = getAuthUrlOrigin();
@@ -653,9 +748,78 @@ function getRouteHandlers(args) {
       const headers2 = new Headers();
       headers2.append("Set-Cookie", `${ACCESS_TOKEN_COOKIE_NAME}=; Path=/; HttpOnly; Secure; SameSite=Lax; Max-Age=0`);
       headers2.append("Set-Cookie", `${REFRESH_TOKEN_COOKIE_NAME}=; Path=/; HttpOnly; Secure; SameSite=Lax; Max-Age=0`);
+      headers2.append("Set-Cookie", `${ACTIVE_ORG_ID_COOKIE_NAME}=; Path=/; HttpOnly; Secure; SameSite=Lax; Max-Age=0`);
       return new Response(null, { status: 200, headers: headers2 });
     });
   }
+  function setActiveOrgHandler(req) {
+    return __async(this, null, function* () {
+      var _a;
+      const oldRefreshToken = (_a = req.cookies.get(REFRESH_TOKEN_COOKIE_NAME)) == null ? void 0 : _a.value;
+      const activeOrgId = req.nextUrl.searchParams.get("active_org_id");
+      if (!oldRefreshToken) {
+        const headers2 = new Headers();
+        headers2.append(
+          "Set-Cookie",
+          `${ACTIVE_ORG_ID_COOKIE_NAME}=; Path=/; HttpOnly; Secure; SameSite=Lax; Max-Age=0`
+        );
+        return new Response(null, { status: 401, headers: headers2 });
+      }
+      if (!activeOrgId) {
+        return new Response(null, { status: 400 });
+      }
+      const refreshResponse = yield refreshTokenWithAccessAndRefreshToken(oldRefreshToken, activeOrgId);
+      if (refreshResponse.error === "unexpected") {
+        throw new Error("Unexpected error while setting active org id");
+      } else if (refreshResponse.error === "unauthorized") {
+        return new Response("Unauthorized", { status: 401 });
+      }
+      const refreshToken = refreshResponse.refreshToken;
+      const accessToken = refreshResponse.accessToken;
+      const authUrlOrigin = getAuthUrlOrigin();
+      const path = `${authUrlOrigin}/propelauth/oauth/userinfo`;
+      const response = yield fetch(path, {
+        headers: {
+          "Content-Type": "application/json",
+          Authorization: "Bearer " + accessToken
+        }
+      });
+      if (response.ok) {
+        const userFromToken = yield validateAccessToken(accessToken);
+        const data = yield response.json();
+        const jsonResponse = {
+          userinfo: data,
+          accessToken,
+          impersonatorUserId: userFromToken.impersonatorUserId,
+          activeOrgId
+        };
+        const headers2 = new Headers();
+        headers2.append(
+          "Set-Cookie",
+          `${ACCESS_TOKEN_COOKIE_NAME}=${accessToken}; Path=/; HttpOnly; Secure; SameSite=Lax`
+        );
+        headers2.append(
+          "Set-Cookie",
+          `${REFRESH_TOKEN_COOKIE_NAME}=${refreshToken}; Path=/; HttpOnly; Secure; SameSite=Lax`
+        );
+        headers2.append(
+          "Set-Cookie",
+          `${ACTIVE_ORG_ID_COOKIE_NAME}=${activeOrgId}; Path=/; HttpOnly; Secure; SameSite=Lax`
+        );
+        headers2.append("Content-Type", "application/json");
+        return new Response(JSON.stringify(jsonResponse), {
+          status: 200,
+          headers: headers2
+        });
+      } else if (response.status === 401) {
+        return new Response(null, {
+          status: 401
+        });
+      } else {
+        return new Response(null, { status: 500 });
+      }
+    });
+  }
   function getRouteHandler(req, { params }) {
     if (params.slug === "login") {
       return loginGetHandler(req);
@@ -674,6 +838,8 @@ function getRouteHandlers(args) {
   function postRouteHandler(req, { params }) {
     if (params.slug === "logout") {
       return logoutPostHandler(req);
+    } else if (params.slug === "set-active-org") {
+      return setActiveOrgHandler(req);
     } else {
       return new Response("", { status: 404 });
     }