@propelauth/nextjs 0.1.7 → 0.1.8

package/dist/server/app-router/index.js

@@ -1,10 +1,27 @@
 "use strict";
 var __create = Object.create;
 var __defProp = Object.defineProperty;
+var __defProps = Object.defineProperties;
 var __getOwnPropDesc = Object.getOwnPropertyDescriptor;
+var __getOwnPropDescs = Object.getOwnPropertyDescriptors;
 var __getOwnPropNames = Object.getOwnPropertyNames;
+var __getOwnPropSymbols = Object.getOwnPropertySymbols;
 var __getProtoOf = Object.getPrototypeOf;
 var __hasOwnProp = Object.prototype.hasOwnProperty;
+var __propIsEnum = Object.prototype.propertyIsEnumerable;
+var __defNormalProp = (obj, key, value) => key in obj ? __defProp(obj, key, { enumerable: true, configurable: true, writable: true, value }) : obj[key] = value;
+var __spreadValues = (a, b) => {
+  for (var prop in b || (b = {}))
+    if (__hasOwnProp.call(b, prop))
+      __defNormalProp(a, prop, b[prop]);
+  if (__getOwnPropSymbols)
+    for (var prop of __getOwnPropSymbols(b)) {
+      if (__propIsEnum.call(b, prop))
+        __defNormalProp(a, prop, b[prop]);
+    }
+  return a;
+};
+var __spreadProps = (a, b) => __defProps(a, __getOwnPropDescs(b));
 var __export = (target, all) => {
   for (var name in all)
     __defProp(target, name, { get: all[name], enumerable: true });
@@ -317,7 +334,6 @@ var CUSTOM_HEADER_FOR_PATH = "x-propelauth-current-path";
 var RETURN_TO_PATH_COOKIE_NAME = "__pa_return_to_path";
 var COOKIE_OPTIONS = {
   httpOnly: true,
-  sameSite: "lax",
   secure: true,
   path: "/"
 };
@@ -352,6 +368,22 @@ function getVerifierKey() {
   }
   return verifierKey.replace(/\\n/g, "\n");
 }
+function getSameSiteCookieValue() {
+  const sameSiteOverride = process.env.PROPELAUTH_SAME_SITE_COOKIE_OVERRIDE;
+  if (sameSiteOverride === "none") {
+    return "none";
+  } else if (sameSiteOverride === "lax") {
+    return "lax";
+  } else if (sameSiteOverride === "strict") {
+    return "strict";
+  } else if (sameSiteOverride) {
+    throw new Error(
+      'Invalid value for PROPELAUTH_SAME_SITE_COOKIE_OVERRIDE, must be one of "none", "lax", or "strict"'
+    );
+  } else {
+    return "lax";
+  }
+}
 function refreshTokenWithAccessAndRefreshToken(refreshToken, activeOrgId) {
   return __async(this, null, function* () {
     const body = {
@@ -491,9 +523,10 @@ function authMiddleware(req) {
         response2.cookies.delete(REFRESH_TOKEN_COOKIE_NAME);
         return response2;
       } else {
+        const sameSite = getSameSiteCookieValue();
         const nextResponse = getNextResponse(req, response.accessToken);
-        nextResponse.cookies.set(ACCESS_TOKEN_COOKIE_NAME, response.accessToken, COOKIE_OPTIONS);
-        nextResponse.cookies.set(REFRESH_TOKEN_COOKIE_NAME, response.refreshToken, COOKIE_OPTIONS);
+        nextResponse.cookies.set(ACCESS_TOKEN_COOKIE_NAME, response.accessToken, __spreadProps(__spreadValues({}, COOKIE_OPTIONS), { sameSite }));
+        nextResponse.cookies.set(REFRESH_TOKEN_COOKIE_NAME, response.refreshToken, __spreadProps(__spreadValues({}, COOKIE_OPTIONS), { sameSite }));
         return nextResponse;
       }
     }
@@ -524,6 +557,7 @@ function getRouteHandlers(args) {
     const returnToPath = req.nextUrl.searchParams.get("return_to_path");
     const state = randomState();
     const redirectUri = getRedirectUri();
+    const sameSite = getSameSiteCookieValue();
     const authorizeUrlSearchParams = new URLSearchParams({
       redirect_uri: redirectUri,
       state,
@@ -532,12 +566,12 @@ function getRouteHandlers(args) {
     const authorize_url = getAuthUrlOrigin() + "/propelauth/ssr/authorize?" + authorizeUrlSearchParams.toString();
     const headers2 = new Headers();
     headers2.append("Location", authorize_url);
-    headers2.append("Set-Cookie", `${STATE_COOKIE_NAME}=${state}; Path=/; HttpOnly; Secure; SameSite=Lax`);
+    headers2.append("Set-Cookie", `${STATE_COOKIE_NAME}=${state}; Path=/; HttpOnly; Secure; SameSite=${sameSite}`);
     if (returnToPath) {
       if (returnToPath.startsWith("/")) {
         headers2.append(
           "Set-Cookie",
-          `${RETURN_TO_PATH_COOKIE_NAME}=${returnToPath}; Path=/; HttpOnly; Secure; SameSite=Lax; Max-Age=600`
+          `${RETURN_TO_PATH_COOKIE_NAME}=${returnToPath}; Path=/; HttpOnly; Secure; SameSite=${sameSite}; Max-Age=600`
         );
       } else {
         console.warn("return_to_path must start with /");
@@ -551,6 +585,7 @@ function getRouteHandlers(args) {
   function callbackGetHandler(req) {
     return __async(this, null, function* () {
       var _a, _b, _c;
+      const sameSite = getSameSiteCookieValue();
       const oauthState = (_a = req.cookies.get(STATE_COOKIE_NAME)) == null ? void 0 : _a.value;
       if (!oauthState || oauthState.length !== 64) {
         return new Response(null, { status: 302, headers: { Location: LOGIN_PATH } });
@@ -609,15 +644,15 @@ function getRouteHandlers(args) {
             headers3.append("Location", returnToPath);
             headers3.append(
               "Set-Cookie",
-              `${ACCESS_TOKEN_COOKIE_NAME}=${response2.accessToken}; Path=/; HttpOnly; Secure; SameSite=Lax`
+              `${ACCESS_TOKEN_COOKIE_NAME}=${response2.accessToken}; Path=/; HttpOnly; Secure; SameSite=${sameSite}`
             );
             headers3.append(
               "Set-Cookie",
-              `${REFRESH_TOKEN_COOKIE_NAME}=${response2.refreshToken}; Path=/; HttpOnly; Secure; SameSite=Lax`
+              `${REFRESH_TOKEN_COOKIE_NAME}=${response2.refreshToken}; Path=/; HttpOnly; Secure; SameSite=${sameSite}`
             );
             headers3.append(
               "Set-Cookie",
-              `${ACTIVE_ORG_ID_COOKIE_NAME}=${activeOrgId}; Path=/; HttpOnly; Secure; SameSite=Lax`
+              `${ACTIVE_ORG_ID_COOKIE_NAME}=${activeOrgId}; Path=/; HttpOnly; Secure; SameSite=${sameSite}`
             );
             headers3.append("Set-Cookie", getCookieForReturnToPathInCallback(returnToPathFromCookie));
             return new Response(null, {
@@ -630,15 +665,15 @@ function getRouteHandlers(args) {
         headers2.append("Location", returnToPath);
         headers2.append(
           "Set-Cookie",
-          `${ACCESS_TOKEN_COOKIE_NAME}=${accessToken}; Path=/; HttpOnly; Secure; SameSite=Lax`
+          `${ACCESS_TOKEN_COOKIE_NAME}=${accessToken}; Path=/; HttpOnly; Secure; SameSite=${sameSite}`
         );
         headers2.append(
           "Set-Cookie",
-          `${REFRESH_TOKEN_COOKIE_NAME}=${data.refresh_token}; Path=/; HttpOnly; Secure; SameSite=Lax`
+          `${REFRESH_TOKEN_COOKIE_NAME}=${data.refresh_token}; Path=/; HttpOnly; Secure; SameSite=${sameSite}`
         );
         headers2.append(
           "Set-Cookie",
-          `${ACTIVE_ORG_ID_COOKIE_NAME}=; Path=/; HttpOnly; Secure; SameSite=Lax; Max-Age=0`
+          `${ACTIVE_ORG_ID_COOKIE_NAME}=; Path=/; HttpOnly; Secure; SameSite=${sameSite}; Max-Age=0`
         );
         headers2.append("Set-Cookie", getCookieForReturnToPathInCallback(returnToPathFromCookie));
         return new Response(null, {
@@ -660,6 +695,7 @@ function getRouteHandlers(args) {
       var _a, _b;
       const oldRefreshToken = (_a = req.cookies.get(REFRESH_TOKEN_COOKIE_NAME)) == null ? void 0 : _a.value;
       const activeOrgId = (_b = req.cookies.get(ACTIVE_ORG_ID_COOKIE_NAME)) == null ? void 0 : _b.value;
+      const sameSite = getSameSiteCookieValue();
       if (oldRefreshToken) {
         const refreshResponse = yield refreshTokenWithAccessAndRefreshToken(oldRefreshToken, activeOrgId);
         if (refreshResponse.error === "unexpected") {
@@ -668,15 +704,15 @@ function getRouteHandlers(args) {
           const headers3 = new Headers();
           headers3.append(
             "Set-Cookie",
-            `${ACCESS_TOKEN_COOKIE_NAME}=; Path=/; HttpOnly; Secure; SameSite=Lax; Max-Age=0`
+            `${ACCESS_TOKEN_COOKIE_NAME}=; Path=/; HttpOnly; Secure; SameSite=${sameSite}; Max-Age=0`
           );
           headers3.append(
             "Set-Cookie",
-            `${REFRESH_TOKEN_COOKIE_NAME}=; Path=/; HttpOnly; Secure; SameSite=Lax; Max-Age=0`
+            `${REFRESH_TOKEN_COOKIE_NAME}=; Path=/; HttpOnly; Secure; SameSite=${sameSite}; Max-Age=0`
           );
           headers3.append(
             "Set-Cookie",
-            `${ACTIVE_ORG_ID_COOKIE_NAME}=; Path=/; HttpOnly; Secure; SameSite=Lax; Max-Age=0`
+            `${ACTIVE_ORG_ID_COOKIE_NAME}=; Path=/; HttpOnly; Secure; SameSite=${sameSite}; Max-Age=0`
           );
           return new Response("Unauthorized", { status: 401, headers: headers3 });
         }
@@ -702,11 +738,11 @@ function getRouteHandlers(args) {
           const headers3 = new Headers();
           headers3.append(
             "Set-Cookie",
-            `${ACCESS_TOKEN_COOKIE_NAME}=${accessToken}; Path=/; HttpOnly; Secure; SameSite=Lax`
+            `${ACCESS_TOKEN_COOKIE_NAME}=${accessToken}; Path=/; HttpOnly; Secure; SameSite=${sameSite}`
           );
           headers3.append(
             "Set-Cookie",
-            `${REFRESH_TOKEN_COOKIE_NAME}=${refreshToken}; Path=/; HttpOnly; Secure; SameSite=Lax`
+            `${REFRESH_TOKEN_COOKIE_NAME}=${refreshToken}; Path=/; HttpOnly; Secure; SameSite=${sameSite}`
           );
           headers3.append("Content-Type", "application/json");
           return new Response(JSON.stringify(jsonResponse), {
@@ -717,15 +753,15 @@ function getRouteHandlers(args) {
           const headers3 = new Headers();
           headers3.append(
             "Set-Cookie",
-            `${ACCESS_TOKEN_COOKIE_NAME}=; Path=/; HttpOnly; Secure; SameSite=Lax; Max-Age=0`
+            `${ACCESS_TOKEN_COOKIE_NAME}=; Path=/; HttpOnly; Secure; SameSite=${sameSite}; Max-Age=0`
           );
           headers3.append(
             "Set-Cookie",
-            `${REFRESH_TOKEN_COOKIE_NAME}=; Path=/; HttpOnly; Secure; SameSite=Lax; Max-Age=0`
+            `${REFRESH_TOKEN_COOKIE_NAME}=; Path=/; HttpOnly; Secure; SameSite=${sameSite}; Max-Age=0`
           );
           headers3.append(
             "Set-Cookie",
-            `${ACTIVE_ORG_ID_COOKIE_NAME}=; Path=/; HttpOnly; Secure; SameSite=Lax; Max-Age=0`
+            `${ACTIVE_ORG_ID_COOKIE_NAME}=; Path=/; HttpOnly; Secure; SameSite=${sameSite}; Max-Age=0`
           );
           return new Response(null, {
             status: 401,
@@ -736,9 +772,18 @@ function getRouteHandlers(args) {
         }
       }
       const headers2 = new Headers();
-      headers2.append("Set-Cookie", `${ACCESS_TOKEN_COOKIE_NAME}=; Path=/; HttpOnly; Secure; SameSite=Lax; Max-Age=0`);
-      headers2.append("Set-Cookie", `${REFRESH_TOKEN_COOKIE_NAME}=; Path=/; HttpOnly; Secure; SameSite=Lax; Max-Age=0`);
-      headers2.append("Set-Cookie", `${ACTIVE_ORG_ID_COOKIE_NAME}=; Path=/; HttpOnly; Secure; SameSite=Lax; Max-Age=0`);
+      headers2.append(
+        "Set-Cookie",
+        `${ACCESS_TOKEN_COOKIE_NAME}=; Path=/; HttpOnly; Secure; SameSite=${sameSite}; Max-Age=0`
+      );
+      headers2.append(
+        "Set-Cookie",
+        `${REFRESH_TOKEN_COOKIE_NAME}=; Path=/; HttpOnly; Secure; SameSite=${sameSite}; Max-Age=0`
+      );
+      headers2.append(
+        "Set-Cookie",
+        `${ACTIVE_ORG_ID_COOKIE_NAME}=; Path=/; HttpOnly; Secure; SameSite=${sameSite}; Max-Age=0`
+      );
       return new Response(null, { status: 401 });
     });
   }
@@ -750,21 +795,22 @@ function getRouteHandlers(args) {
         console.error("postLoginPathFn returned undefined");
         return new Response("Unexpected error", { status: 500 });
       }
+      const sameSite = getSameSiteCookieValue();
       const refreshToken = (_a = req.cookies.get(REFRESH_TOKEN_COOKIE_NAME)) == null ? void 0 : _a.value;
       if (!refreshToken) {
         const headers2 = new Headers();
         headers2.append("Location", path);
         headers2.append(
           "Set-Cookie",
-          `${ACCESS_TOKEN_COOKIE_NAME}=; Path=/; HttpOnly; Secure; SameSite=Lax; Max-Age=0`
+          `${ACCESS_TOKEN_COOKIE_NAME}=; Path=/; HttpOnly; Secure; SameSite=${sameSite}; Max-Age=0`
         );
         headers2.append(
           "Set-Cookie",
-          `${REFRESH_TOKEN_COOKIE_NAME}=; Path=/; HttpOnly; Secure; SameSite=Lax; Max-Age=0`
+          `${REFRESH_TOKEN_COOKIE_NAME}=; Path=/; HttpOnly; Secure; SameSite=${sameSite}; Max-Age=0`
         );
         headers2.append(
           "Set-Cookie",
-          `${ACTIVE_ORG_ID_COOKIE_NAME}=; Path=/; HttpOnly; Secure; SameSite=Lax; Max-Age=0`
+          `${ACTIVE_ORG_ID_COOKIE_NAME}=; Path=/; HttpOnly; Secure; SameSite=${sameSite}; Max-Age=0`
         );
         return new Response(null, {
           status: 302,
@@ -781,15 +827,15 @@ function getRouteHandlers(args) {
         headers2.append("Location", path);
         headers2.append(
           "Set-Cookie",
-          `${ACCESS_TOKEN_COOKIE_NAME}=; Path=/; HttpOnly; Secure; SameSite=Lax; Max-Age=0`
+          `${ACCESS_TOKEN_COOKIE_NAME}=; Path=/; HttpOnly; Secure; SameSite=${sameSite}; Max-Age=0`
         );
         headers2.append(
           "Set-Cookie",
-          `${REFRESH_TOKEN_COOKIE_NAME}=; Path=/; HttpOnly; Secure; SameSite=Lax; Max-Age=0`
+          `${REFRESH_TOKEN_COOKIE_NAME}=; Path=/; HttpOnly; Secure; SameSite=${sameSite}; Max-Age=0`
         );
         headers2.append(
           "Set-Cookie",
-          `${ACTIVE_ORG_ID_COOKIE_NAME}=; Path=/; HttpOnly; Secure; SameSite=Lax; Max-Age=0`
+          `${ACTIVE_ORG_ID_COOKIE_NAME}=; Path=/; HttpOnly; Secure; SameSite=${sameSite}; Max-Age=0`
         );
         return new Response(null, {
           status: 302,
@@ -808,20 +854,21 @@ function getRouteHandlers(args) {
   function logoutPostHandler(req) {
     return __async(this, null, function* () {
       var _a;
+      const sameSite = getSameSiteCookieValue();
       const refreshToken = (_a = req.cookies.get(REFRESH_TOKEN_COOKIE_NAME)) == null ? void 0 : _a.value;
       if (!refreshToken) {
         const headers3 = new Headers();
         headers3.append(
           "Set-Cookie",
-          `${ACCESS_TOKEN_COOKIE_NAME}=; Path=/; HttpOnly; Secure; SameSite=Lax; Max-Age=0`
+          `${ACCESS_TOKEN_COOKIE_NAME}=; Path=/; HttpOnly; Secure; SameSite=${sameSite}; Max-Age=0`
         );
         headers3.append(
           "Set-Cookie",
-          `${REFRESH_TOKEN_COOKIE_NAME}=; Path=/; HttpOnly; Secure; SameSite=Lax; Max-Age=0`
+          `${REFRESH_TOKEN_COOKIE_NAME}=; Path=/; HttpOnly; Secure; SameSite=${sameSite}; Max-Age=0`
         );
         headers3.append(
           "Set-Cookie",
-          `${ACTIVE_ORG_ID_COOKIE_NAME}=; Path=/; HttpOnly; Secure; SameSite=Lax; Max-Age=0`
+          `${ACTIVE_ORG_ID_COOKIE_NAME}=; Path=/; HttpOnly; Secure; SameSite=${sameSite}; Max-Age=0`
         );
         return new Response(null, { status: 200, headers: headers3 });
       }
@@ -845,9 +892,18 @@ function getRouteHandlers(args) {
         );
       }
       const headers2 = new Headers();
-      headers2.append("Set-Cookie", `${ACCESS_TOKEN_COOKIE_NAME}=; Path=/; HttpOnly; Secure; SameSite=Lax; Max-Age=0`);
-      headers2.append("Set-Cookie", `${REFRESH_TOKEN_COOKIE_NAME}=; Path=/; HttpOnly; Secure; SameSite=Lax; Max-Age=0`);
-      headers2.append("Set-Cookie", `${ACTIVE_ORG_ID_COOKIE_NAME}=; Path=/; HttpOnly; Secure; SameSite=Lax; Max-Age=0`);
+      headers2.append(
+        "Set-Cookie",
+        `${ACCESS_TOKEN_COOKIE_NAME}=; Path=/; HttpOnly; Secure; SameSite=${sameSite}; Max-Age=0`
+      );
+      headers2.append(
+        "Set-Cookie",
+        `${REFRESH_TOKEN_COOKIE_NAME}=; Path=/; HttpOnly; Secure; SameSite=${sameSite}; Max-Age=0`
+      );
+      headers2.append(
+        "Set-Cookie",
+        `${ACTIVE_ORG_ID_COOKIE_NAME}=; Path=/; HttpOnly; Secure; SameSite=${sameSite}; Max-Age=0`
+      );
       return new Response(null, { status: 200, headers: headers2 });
     });
   }
@@ -856,11 +912,12 @@ function getRouteHandlers(args) {
       var _a;
       const oldRefreshToken = (_a = req.cookies.get(REFRESH_TOKEN_COOKIE_NAME)) == null ? void 0 : _a.value;
       const activeOrgId = req.nextUrl.searchParams.get("active_org_id");
+      const sameSite = getSameSiteCookieValue();
       if (!oldRefreshToken) {
         const headers2 = new Headers();
         headers2.append(
           "Set-Cookie",
-          `${ACTIVE_ORG_ID_COOKIE_NAME}=; Path=/; HttpOnly; Secure; SameSite=Lax; Max-Age=0`
+          `${ACTIVE_ORG_ID_COOKIE_NAME}=; Path=/; HttpOnly; Secure; SameSite=${sameSite}; Max-Age=0`
         );
         return new Response(null, { status: 401, headers: headers2 });
       }
@@ -895,15 +952,15 @@ function getRouteHandlers(args) {
         const headers2 = new Headers();
         headers2.append(
           "Set-Cookie",
-          `${ACCESS_TOKEN_COOKIE_NAME}=${accessToken}; Path=/; HttpOnly; Secure; SameSite=Lax`
+          `${ACCESS_TOKEN_COOKIE_NAME}=${accessToken}; Path=/; HttpOnly; Secure; SameSite=${sameSite}`
         );
         headers2.append(
           "Set-Cookie",
-          `${REFRESH_TOKEN_COOKIE_NAME}=${refreshToken}; Path=/; HttpOnly; Secure; SameSite=Lax`
+          `${REFRESH_TOKEN_COOKIE_NAME}=${refreshToken}; Path=/; HttpOnly; Secure; SameSite=${sameSite}`
         );
         headers2.append(
           "Set-Cookie",
-          `${ACTIVE_ORG_ID_COOKIE_NAME}=${activeOrgId}; Path=/; HttpOnly; Secure; SameSite=Lax`
+          `${ACTIVE_ORG_ID_COOKIE_NAME}=${activeOrgId}; Path=/; HttpOnly; Secure; SameSite=${sameSite}`
         );
         headers2.append("Content-Type", "application/json");
         return new Response(JSON.stringify(jsonResponse), {
@@ -977,10 +1034,11 @@ function getUrlEncodedRedirectPathForCurrentPath() {
   return encodeURIComponent(path);
 }
 function getCookieForReturnToPathInCallback(returnToPathFromCookie) {
+  const sameSite = getSameSiteCookieValue();
   if (returnToPathFromCookie) {
-    return `${RETURN_TO_PATH_COOKIE_NAME}=${returnToPathFromCookie}; Path=/; HttpOnly; Secure; SameSite=Lax; Max-Age=15`;
+    return `${RETURN_TO_PATH_COOKIE_NAME}=${returnToPathFromCookie}; Path=/; HttpOnly; Secure; SameSite=${sameSite}; Max-Age=15`;
   } else {
-    return `${RETURN_TO_PATH_COOKIE_NAME}=; Path=/; HttpOnly; Secure; SameSite=Lax; Max-Age=0`;
+    return `${RETURN_TO_PATH_COOKIE_NAME}=; Path=/; HttpOnly; Secure; SameSite=${sameSite}; Max-Age=0`;
   }
 }
 function getCurrentPath() {