@propelauth/nextjs 0.1.7 → 0.1.8

package/dist/server/app-router/index.mjs

@@ -1,3 +1,22 @@
+var __defProp = Object.defineProperty;
+var __defProps = Object.defineProperties;
+var __getOwnPropDescs = Object.getOwnPropertyDescriptors;
+var __getOwnPropSymbols = Object.getOwnPropertySymbols;
+var __hasOwnProp = Object.prototype.hasOwnProperty;
+var __propIsEnum = Object.prototype.propertyIsEnumerable;
+var __defNormalProp = (obj, key, value) => key in obj ? __defProp(obj, key, { enumerable: true, configurable: true, writable: true, value }) : obj[key] = value;
+var __spreadValues = (a, b) => {
+  for (var prop in b || (b = {}))
+    if (__hasOwnProp.call(b, prop))
+      __defNormalProp(a, prop, b[prop]);
+  if (__getOwnPropSymbols)
+    for (var prop of __getOwnPropSymbols(b)) {
+      if (__propIsEnum.call(b, prop))
+        __defNormalProp(a, prop, b[prop]);
+    }
+  return a;
+};
+var __spreadProps = (a, b) => __defProps(a, __getOwnPropDescs(b));
 var __async = (__this, __arguments, generator) => {
   return new Promise((resolve, reject) => {
     var fulfilled = (value) => {
@@ -274,7 +293,6 @@ var CUSTOM_HEADER_FOR_PATH = "x-propelauth-current-path";
 var RETURN_TO_PATH_COOKIE_NAME = "__pa_return_to_path";
 var COOKIE_OPTIONS = {
   httpOnly: true,
-  sameSite: "lax",
   secure: true,
   path: "/"
 };
@@ -309,6 +327,22 @@ function getVerifierKey() {
   }
   return verifierKey.replace(/\\n/g, "\n");
 }
+function getSameSiteCookieValue() {
+  const sameSiteOverride = process.env.PROPELAUTH_SAME_SITE_COOKIE_OVERRIDE;
+  if (sameSiteOverride === "none") {
+    return "none";
+  } else if (sameSiteOverride === "lax") {
+    return "lax";
+  } else if (sameSiteOverride === "strict") {
+    return "strict";
+  } else if (sameSiteOverride) {
+    throw new Error(
+      'Invalid value for PROPELAUTH_SAME_SITE_COOKIE_OVERRIDE, must be one of "none", "lax", or "strict"'
+    );
+  } else {
+    return "lax";
+  }
+}
 function refreshTokenWithAccessAndRefreshToken(refreshToken, activeOrgId) {
   return __async(this, null, function* () {
     const body = {
@@ -448,9 +482,10 @@ function authMiddleware(req) {
         response2.cookies.delete(REFRESH_TOKEN_COOKIE_NAME);
         return response2;
       } else {
+        const sameSite = getSameSiteCookieValue();
         const nextResponse = getNextResponse(req, response.accessToken);
-        nextResponse.cookies.set(ACCESS_TOKEN_COOKIE_NAME, response.accessToken, COOKIE_OPTIONS);
-        nextResponse.cookies.set(REFRESH_TOKEN_COOKIE_NAME, response.refreshToken, COOKIE_OPTIONS);
+        nextResponse.cookies.set(ACCESS_TOKEN_COOKIE_NAME, response.accessToken, __spreadProps(__spreadValues({}, COOKIE_OPTIONS), { sameSite }));
+        nextResponse.cookies.set(REFRESH_TOKEN_COOKIE_NAME, response.refreshToken, __spreadProps(__spreadValues({}, COOKIE_OPTIONS), { sameSite }));
         return nextResponse;
       }
     }
@@ -481,6 +516,7 @@ function getRouteHandlers(args) {
     const returnToPath = req.nextUrl.searchParams.get("return_to_path");
     const state = randomState();
     const redirectUri = getRedirectUri();
+    const sameSite = getSameSiteCookieValue();
     const authorizeUrlSearchParams = new URLSearchParams({
       redirect_uri: redirectUri,
       state,
@@ -489,12 +525,12 @@ function getRouteHandlers(args) {
     const authorize_url = getAuthUrlOrigin() + "/propelauth/ssr/authorize?" + authorizeUrlSearchParams.toString();
     const headers2 = new Headers();
     headers2.append("Location", authorize_url);
-    headers2.append("Set-Cookie", `${STATE_COOKIE_NAME}=${state}; Path=/; HttpOnly; Secure; SameSite=Lax`);
+    headers2.append("Set-Cookie", `${STATE_COOKIE_NAME}=${state}; Path=/; HttpOnly; Secure; SameSite=${sameSite}`);
     if (returnToPath) {
       if (returnToPath.startsWith("/")) {
         headers2.append(
           "Set-Cookie",
-          `${RETURN_TO_PATH_COOKIE_NAME}=${returnToPath}; Path=/; HttpOnly; Secure; SameSite=Lax; Max-Age=600`
+          `${RETURN_TO_PATH_COOKIE_NAME}=${returnToPath}; Path=/; HttpOnly; Secure; SameSite=${sameSite}; Max-Age=600`
         );
       } else {
         console.warn("return_to_path must start with /");
@@ -508,6 +544,7 @@ function getRouteHandlers(args) {
   function callbackGetHandler(req) {
     return __async(this, null, function* () {
       var _a, _b, _c;
+      const sameSite = getSameSiteCookieValue();
       const oauthState = (_a = req.cookies.get(STATE_COOKIE_NAME)) == null ? void 0 : _a.value;
       if (!oauthState || oauthState.length !== 64) {
         return new Response(null, { status: 302, headers: { Location: LOGIN_PATH } });
@@ -566,15 +603,15 @@ function getRouteHandlers(args) {
             headers3.append("Location", returnToPath);
             headers3.append(
               "Set-Cookie",
-              `${ACCESS_TOKEN_COOKIE_NAME}=${response2.accessToken}; Path=/; HttpOnly; Secure; SameSite=Lax`
+              `${ACCESS_TOKEN_COOKIE_NAME}=${response2.accessToken}; Path=/; HttpOnly; Secure; SameSite=${sameSite}`
             );
             headers3.append(
               "Set-Cookie",
-              `${REFRESH_TOKEN_COOKIE_NAME}=${response2.refreshToken}; Path=/; HttpOnly; Secure; SameSite=Lax`
+              `${REFRESH_TOKEN_COOKIE_NAME}=${response2.refreshToken}; Path=/; HttpOnly; Secure; SameSite=${sameSite}`
             );
             headers3.append(
               "Set-Cookie",
-              `${ACTIVE_ORG_ID_COOKIE_NAME}=${activeOrgId}; Path=/; HttpOnly; Secure; SameSite=Lax`
+              `${ACTIVE_ORG_ID_COOKIE_NAME}=${activeOrgId}; Path=/; HttpOnly; Secure; SameSite=${sameSite}`
             );
             headers3.append("Set-Cookie", getCookieForReturnToPathInCallback(returnToPathFromCookie));
             return new Response(null, {
@@ -587,15 +624,15 @@ function getRouteHandlers(args) {
         headers2.append("Location", returnToPath);
         headers2.append(
           "Set-Cookie",
-          `${ACCESS_TOKEN_COOKIE_NAME}=${accessToken}; Path=/; HttpOnly; Secure; SameSite=Lax`
+          `${ACCESS_TOKEN_COOKIE_NAME}=${accessToken}; Path=/; HttpOnly; Secure; SameSite=${sameSite}`
         );
         headers2.append(
           "Set-Cookie",
-          `${REFRESH_TOKEN_COOKIE_NAME}=${data.refresh_token}; Path=/; HttpOnly; Secure; SameSite=Lax`
+          `${REFRESH_TOKEN_COOKIE_NAME}=${data.refresh_token}; Path=/; HttpOnly; Secure; SameSite=${sameSite}`
         );
         headers2.append(
           "Set-Cookie",
-          `${ACTIVE_ORG_ID_COOKIE_NAME}=; Path=/; HttpOnly; Secure; SameSite=Lax; Max-Age=0`
+          `${ACTIVE_ORG_ID_COOKIE_NAME}=; Path=/; HttpOnly; Secure; SameSite=${sameSite}; Max-Age=0`
         );
         headers2.append("Set-Cookie", getCookieForReturnToPathInCallback(returnToPathFromCookie));
         return new Response(null, {
@@ -617,6 +654,7 @@ function getRouteHandlers(args) {
       var _a, _b;
       const oldRefreshToken = (_a = req.cookies.get(REFRESH_TOKEN_COOKIE_NAME)) == null ? void 0 : _a.value;
       const activeOrgId = (_b = req.cookies.get(ACTIVE_ORG_ID_COOKIE_NAME)) == null ? void 0 : _b.value;
+      const sameSite = getSameSiteCookieValue();
       if (oldRefreshToken) {
         const refreshResponse = yield refreshTokenWithAccessAndRefreshToken(oldRefreshToken, activeOrgId);
         if (refreshResponse.error === "unexpected") {
@@ -625,15 +663,15 @@ function getRouteHandlers(args) {
           const headers3 = new Headers();
           headers3.append(
             "Set-Cookie",
-            `${ACCESS_TOKEN_COOKIE_NAME}=; Path=/; HttpOnly; Secure; SameSite=Lax; Max-Age=0`
+            `${ACCESS_TOKEN_COOKIE_NAME}=; Path=/; HttpOnly; Secure; SameSite=${sameSite}; Max-Age=0`
           );
           headers3.append(
             "Set-Cookie",
-            `${REFRESH_TOKEN_COOKIE_NAME}=; Path=/; HttpOnly; Secure; SameSite=Lax; Max-Age=0`
+            `${REFRESH_TOKEN_COOKIE_NAME}=; Path=/; HttpOnly; Secure; SameSite=${sameSite}; Max-Age=0`
           );
           headers3.append(
             "Set-Cookie",
-            `${ACTIVE_ORG_ID_COOKIE_NAME}=; Path=/; HttpOnly; Secure; SameSite=Lax; Max-Age=0`
+            `${ACTIVE_ORG_ID_COOKIE_NAME}=; Path=/; HttpOnly; Secure; SameSite=${sameSite}; Max-Age=0`
           );
           return new Response("Unauthorized", { status: 401, headers: headers3 });
         }
@@ -659,11 +697,11 @@ function getRouteHandlers(args) {
           const headers3 = new Headers();
           headers3.append(
             "Set-Cookie",
-            `${ACCESS_TOKEN_COOKIE_NAME}=${accessToken}; Path=/; HttpOnly; Secure; SameSite=Lax`
+            `${ACCESS_TOKEN_COOKIE_NAME}=${accessToken}; Path=/; HttpOnly; Secure; SameSite=${sameSite}`
           );
           headers3.append(
             "Set-Cookie",
-            `${REFRESH_TOKEN_COOKIE_NAME}=${refreshToken}; Path=/; HttpOnly; Secure; SameSite=Lax`
+            `${REFRESH_TOKEN_COOKIE_NAME}=${refreshToken}; Path=/; HttpOnly; Secure; SameSite=${sameSite}`
           );
           headers3.append("Content-Type", "application/json");
           return new Response(JSON.stringify(jsonResponse), {
@@ -674,15 +712,15 @@ function getRouteHandlers(args) {
           const headers3 = new Headers();
           headers3.append(
             "Set-Cookie",
-            `${ACCESS_TOKEN_COOKIE_NAME}=; Path=/; HttpOnly; Secure; SameSite=Lax; Max-Age=0`
+            `${ACCESS_TOKEN_COOKIE_NAME}=; Path=/; HttpOnly; Secure; SameSite=${sameSite}; Max-Age=0`
           );
           headers3.append(
             "Set-Cookie",
-            `${REFRESH_TOKEN_COOKIE_NAME}=; Path=/; HttpOnly; Secure; SameSite=Lax; Max-Age=0`
+            `${REFRESH_TOKEN_COOKIE_NAME}=; Path=/; HttpOnly; Secure; SameSite=${sameSite}; Max-Age=0`
           );
           headers3.append(
             "Set-Cookie",
-            `${ACTIVE_ORG_ID_COOKIE_NAME}=; Path=/; HttpOnly; Secure; SameSite=Lax; Max-Age=0`
+            `${ACTIVE_ORG_ID_COOKIE_NAME}=; Path=/; HttpOnly; Secure; SameSite=${sameSite}; Max-Age=0`
           );
           return new Response(null, {
             status: 401,
@@ -693,9 +731,18 @@ function getRouteHandlers(args) {
         }
       }
       const headers2 = new Headers();
-      headers2.append("Set-Cookie", `${ACCESS_TOKEN_COOKIE_NAME}=; Path=/; HttpOnly; Secure; SameSite=Lax; Max-Age=0`);
-      headers2.append("Set-Cookie", `${REFRESH_TOKEN_COOKIE_NAME}=; Path=/; HttpOnly; Secure; SameSite=Lax; Max-Age=0`);
-      headers2.append("Set-Cookie", `${ACTIVE_ORG_ID_COOKIE_NAME}=; Path=/; HttpOnly; Secure; SameSite=Lax; Max-Age=0`);
+      headers2.append(
+        "Set-Cookie",
+        `${ACCESS_TOKEN_COOKIE_NAME}=; Path=/; HttpOnly; Secure; SameSite=${sameSite}; Max-Age=0`
+      );
+      headers2.append(
+        "Set-Cookie",
+        `${REFRESH_TOKEN_COOKIE_NAME}=; Path=/; HttpOnly; Secure; SameSite=${sameSite}; Max-Age=0`
+      );
+      headers2.append(
+        "Set-Cookie",
+        `${ACTIVE_ORG_ID_COOKIE_NAME}=; Path=/; HttpOnly; Secure; SameSite=${sameSite}; Max-Age=0`
+      );
       return new Response(null, { status: 401 });
     });
   }
@@ -707,21 +754,22 @@ function getRouteHandlers(args) {
         console.error("postLoginPathFn returned undefined");
         return new Response("Unexpected error", { status: 500 });
       }
+      const sameSite = getSameSiteCookieValue();
       const refreshToken = (_a = req.cookies.get(REFRESH_TOKEN_COOKIE_NAME)) == null ? void 0 : _a.value;
       if (!refreshToken) {
         const headers2 = new Headers();
         headers2.append("Location", path);
         headers2.append(
           "Set-Cookie",
-          `${ACCESS_TOKEN_COOKIE_NAME}=; Path=/; HttpOnly; Secure; SameSite=Lax; Max-Age=0`
+          `${ACCESS_TOKEN_COOKIE_NAME}=; Path=/; HttpOnly; Secure; SameSite=${sameSite}; Max-Age=0`
         );
         headers2.append(
           "Set-Cookie",
-          `${REFRESH_TOKEN_COOKIE_NAME}=; Path=/; HttpOnly; Secure; SameSite=Lax; Max-Age=0`
+          `${REFRESH_TOKEN_COOKIE_NAME}=; Path=/; HttpOnly; Secure; SameSite=${sameSite}; Max-Age=0`
         );
         headers2.append(
           "Set-Cookie",
-          `${ACTIVE_ORG_ID_COOKIE_NAME}=; Path=/; HttpOnly; Secure; SameSite=Lax; Max-Age=0`
+          `${ACTIVE_ORG_ID_COOKIE_NAME}=; Path=/; HttpOnly; Secure; SameSite=${sameSite}; Max-Age=0`
         );
         return new Response(null, {
           status: 302,
@@ -738,15 +786,15 @@ function getRouteHandlers(args) {
         headers2.append("Location", path);
         headers2.append(
           "Set-Cookie",
-          `${ACCESS_TOKEN_COOKIE_NAME}=; Path=/; HttpOnly; Secure; SameSite=Lax; Max-Age=0`
+          `${ACCESS_TOKEN_COOKIE_NAME}=; Path=/; HttpOnly; Secure; SameSite=${sameSite}; Max-Age=0`
         );
         headers2.append(
           "Set-Cookie",
-          `${REFRESH_TOKEN_COOKIE_NAME}=; Path=/; HttpOnly; Secure; SameSite=Lax; Max-Age=0`
+          `${REFRESH_TOKEN_COOKIE_NAME}=; Path=/; HttpOnly; Secure; SameSite=${sameSite}; Max-Age=0`
         );
         headers2.append(
           "Set-Cookie",
-          `${ACTIVE_ORG_ID_COOKIE_NAME}=; Path=/; HttpOnly; Secure; SameSite=Lax; Max-Age=0`
+          `${ACTIVE_ORG_ID_COOKIE_NAME}=; Path=/; HttpOnly; Secure; SameSite=${sameSite}; Max-Age=0`
         );
         return new Response(null, {
           status: 302,
@@ -765,20 +813,21 @@ function getRouteHandlers(args) {
   function logoutPostHandler(req) {
     return __async(this, null, function* () {
       var _a;
+      const sameSite = getSameSiteCookieValue();
       const refreshToken = (_a = req.cookies.get(REFRESH_TOKEN_COOKIE_NAME)) == null ? void 0 : _a.value;
       if (!refreshToken) {
         const headers3 = new Headers();
         headers3.append(
           "Set-Cookie",
-          `${ACCESS_TOKEN_COOKIE_NAME}=; Path=/; HttpOnly; Secure; SameSite=Lax; Max-Age=0`
+          `${ACCESS_TOKEN_COOKIE_NAME}=; Path=/; HttpOnly; Secure; SameSite=${sameSite}; Max-Age=0`
         );
         headers3.append(
           "Set-Cookie",
-          `${REFRESH_TOKEN_COOKIE_NAME}=; Path=/; HttpOnly; Secure; SameSite=Lax; Max-Age=0`
+          `${REFRESH_TOKEN_COOKIE_NAME}=; Path=/; HttpOnly; Secure; SameSite=${sameSite}; Max-Age=0`
         );
         headers3.append(
           "Set-Cookie",
-          `${ACTIVE_ORG_ID_COOKIE_NAME}=; Path=/; HttpOnly; Secure; SameSite=Lax; Max-Age=0`
+          `${ACTIVE_ORG_ID_COOKIE_NAME}=; Path=/; HttpOnly; Secure; SameSite=${sameSite}; Max-Age=0`
         );
         return new Response(null, { status: 200, headers: headers3 });
       }
@@ -802,9 +851,18 @@ function getRouteHandlers(args) {
         );
       }
       const headers2 = new Headers();
-      headers2.append("Set-Cookie", `${ACCESS_TOKEN_COOKIE_NAME}=; Path=/; HttpOnly; Secure; SameSite=Lax; Max-Age=0`);
-      headers2.append("Set-Cookie", `${REFRESH_TOKEN_COOKIE_NAME}=; Path=/; HttpOnly; Secure; SameSite=Lax; Max-Age=0`);
-      headers2.append("Set-Cookie", `${ACTIVE_ORG_ID_COOKIE_NAME}=; Path=/; HttpOnly; Secure; SameSite=Lax; Max-Age=0`);
+      headers2.append(
+        "Set-Cookie",
+        `${ACCESS_TOKEN_COOKIE_NAME}=; Path=/; HttpOnly; Secure; SameSite=${sameSite}; Max-Age=0`
+      );
+      headers2.append(
+        "Set-Cookie",
+        `${REFRESH_TOKEN_COOKIE_NAME}=; Path=/; HttpOnly; Secure; SameSite=${sameSite}; Max-Age=0`
+      );
+      headers2.append(
+        "Set-Cookie",
+        `${ACTIVE_ORG_ID_COOKIE_NAME}=; Path=/; HttpOnly; Secure; SameSite=${sameSite}; Max-Age=0`
+      );
       return new Response(null, { status: 200, headers: headers2 });
     });
   }
@@ -813,11 +871,12 @@ function getRouteHandlers(args) {
       var _a;
       const oldRefreshToken = (_a = req.cookies.get(REFRESH_TOKEN_COOKIE_NAME)) == null ? void 0 : _a.value;
       const activeOrgId = req.nextUrl.searchParams.get("active_org_id");
+      const sameSite = getSameSiteCookieValue();
       if (!oldRefreshToken) {
         const headers2 = new Headers();
         headers2.append(
           "Set-Cookie",
-          `${ACTIVE_ORG_ID_COOKIE_NAME}=; Path=/; HttpOnly; Secure; SameSite=Lax; Max-Age=0`
+          `${ACTIVE_ORG_ID_COOKIE_NAME}=; Path=/; HttpOnly; Secure; SameSite=${sameSite}; Max-Age=0`
         );
         return new Response(null, { status: 401, headers: headers2 });
       }
@@ -852,15 +911,15 @@ function getRouteHandlers(args) {
         const headers2 = new Headers();
         headers2.append(
           "Set-Cookie",
-          `${ACCESS_TOKEN_COOKIE_NAME}=${accessToken}; Path=/; HttpOnly; Secure; SameSite=Lax`
+          `${ACCESS_TOKEN_COOKIE_NAME}=${accessToken}; Path=/; HttpOnly; Secure; SameSite=${sameSite}`
         );
         headers2.append(
           "Set-Cookie",
-          `${REFRESH_TOKEN_COOKIE_NAME}=${refreshToken}; Path=/; HttpOnly; Secure; SameSite=Lax`
+          `${REFRESH_TOKEN_COOKIE_NAME}=${refreshToken}; Path=/; HttpOnly; Secure; SameSite=${sameSite}`
         );
         headers2.append(
           "Set-Cookie",
-          `${ACTIVE_ORG_ID_COOKIE_NAME}=${activeOrgId}; Path=/; HttpOnly; Secure; SameSite=Lax`
+          `${ACTIVE_ORG_ID_COOKIE_NAME}=${activeOrgId}; Path=/; HttpOnly; Secure; SameSite=${sameSite}`
         );
         headers2.append("Content-Type", "application/json");
         return new Response(JSON.stringify(jsonResponse), {
@@ -934,10 +993,11 @@ function getUrlEncodedRedirectPathForCurrentPath() {
   return encodeURIComponent(path);
 }
 function getCookieForReturnToPathInCallback(returnToPathFromCookie) {
+  const sameSite = getSameSiteCookieValue();
   if (returnToPathFromCookie) {
-    return `${RETURN_TO_PATH_COOKIE_NAME}=${returnToPathFromCookie}; Path=/; HttpOnly; Secure; SameSite=Lax; Max-Age=15`;
+    return `${RETURN_TO_PATH_COOKIE_NAME}=${returnToPathFromCookie}; Path=/; HttpOnly; Secure; SameSite=${sameSite}; Max-Age=15`;
   } else {
-    return `${RETURN_TO_PATH_COOKIE_NAME}=; Path=/; HttpOnly; Secure; SameSite=Lax; Max-Age=0`;
+    return `${RETURN_TO_PATH_COOKIE_NAME}=; Path=/; HttpOnly; Secure; SameSite=${sameSite}; Max-Age=0`;
   }
 }
 function getCurrentPath() {