@pylonsync/next 0.3.6 → 0.3.8

package/package.json

@@ -3,7 +3,7 @@
   "publishConfig": {
     "access": "public"
   },
-  "version": "0.3.6",
+  "version": "0.3.8",
   "type": "module",
   "description": "Next.js helpers for Pylon — cookie-based auth gate, server-side session helpers, and reusable client hooks.",
   "exports": {

package/src/auth.ts

@@ -67,12 +67,33 @@ export async function listOAuthProviders(): Promise<OAuthProvider[]> {
 /**
  * Kick off an OAuth login. Browser navigates to Pylon's GET login
  * route, which 302s to the provider, which 302s back to Pylon's GET
- * callback (Set-Cookie + 302 to PYLON_DASHBOARD_URL). The OAuth code
+ * callback (Set-Cookie + 302 to the success URL). The OAuth code
  * never enters JS, so XSS in the dashboard can't intercept the
  * handshake.
+ *
+ * `successUrl` and `errorUrl` MUST have origins listed in the
+ * server's PYLON_TRUSTED_ORIGINS — otherwise pylon's start endpoint
+ * 403s with UNTRUSTED_REDIRECT. Defaults are sensible for typical
+ * Next.js layouts (current origin's `/dashboard` and `/login`); pass
+ * explicit values for apps that route auth elsewhere.
  */
-export function startOAuthLogin(provider: OAuthProvider["provider"]): void {
-	window.location.href = `/api/auth/login/${provider}?redirect=1`;
+export type StartOAuthLoginOptions = {
+	successUrl?: string;
+	errorUrl?: string;
+};
+export function startOAuthLogin(
+	provider: OAuthProvider["provider"],
+	opts: StartOAuthLoginOptions = {},
+): void {
+	const origin = window.location.origin;
+	const successUrl = opts.successUrl ?? `${origin}/dashboard`;
+	const errorUrl = opts.errorUrl ?? `${origin}/login`;
+	const params = new URLSearchParams({
+		redirect: "1",
+		callback: successUrl,
+		error_callback: errorUrl,
+	});
+	window.location.href = `/api/auth/login/${provider}?${params.toString()}`;
 }
 
 export async function sendVerificationEmail(): Promise<{

package/src/server.ts

@@ -206,21 +206,39 @@ export function createPylonServer(config: PylonServerConfig): PylonServer {
 		auth: PylonAuth;
 		user: U;
 	} | null> {
-		const auth = await getAuth();
-		if (!auth) return null;
-		try {
-			const user = await pylonJsonBound<U>(`/api/fn/${getMeFn}`, {
-				method: "POST",
-				headers: { "Content-Type": "application/json" },
-				body: "{}",
-			});
-			if (user == null) return null;
-			return { auth, user };
-		} catch {
-			// Function may not be registered yet, or the row was
-			// deleted while logged in — treat as anonymous.
-			return null;
-		}
+		// Single round-trip to /api/auth/session — pylon returns
+		// `{ session, user }` where `user` is the User row projected
+		// to safe fields (passwordHash + framework-internal columns
+		// stripped). This replaces the older two-step
+		// /api/auth/me + /api/fn/getMe dance.
+		const session = await readSession();
+		if (!session) return null;
+		const resp = await fetch(`${target()}/api/auth/session`, {
+			headers: { cookie: session.header },
+			cache: "no-store",
+		})
+			.then(
+				(r) =>
+					r.json() as Promise<{
+						session?: {
+							user_id?: string;
+							tenant_id?: string | null;
+							is_admin?: boolean;
+						};
+						user?: U | null;
+					}>,
+			)
+			.catch(() => ({}) as { session?: undefined; user?: undefined });
+		if (!resp.session?.user_id || !resp.user) return null;
+		return {
+			auth: {
+				userId: resp.session.user_id,
+				tenantId: resp.session.tenant_id ?? null,
+				isAdmin: resp.session.is_admin ?? false,
+				cookieHeader: session.header,
+			},
+			user: resp.user,
+		};
 	}
 
 	async function requireMe<U = Record<string, unknown>>(): Promise<{