@reblu/site-next 1.0.0 → 1.2.0

package/README.md

@@ -1,22 +1,33 @@
 # @reblu/site-next
 
-Next.js glue for Reblu SITEs (REB-418). Two responsibilities, both intentionally
-Next-coupled so the lower SDK layers — [`@reblu/site-client`](../site-client),
-[`@reblu/site-contracts`](../site-contracts),
+Next.js glue for Reblu SITEs (REB-418, REB-510). Three responsibilities, all
+intentionally Next-coupled so the lower SDK layers —
+[`@reblu/site-client`](../site-client), [`@reblu/site-contracts`](../site-contracts),
 [`@reblu/site-ui`](../site-ui) — stay framework-agnostic:
 
 1. **`NextCacheAdapter`** — implements `@reblu/site-client`'s `RebluCacheAdapter`,
    translating a cache policy into Next ISR `fetch` options.
 2. **Editable-CTA glue** — the `EditableCta` async Server Component, its
    `CtaButtons` `'use client'` boundary, and `StickyMobileCta`.
+3. **Auth** (`./auth`) + **`createProxyRoute`** (`./route-handlers`) — the
+   client auth components (`LoginForm`, password reset, set-password,
+   email confirm, MFA step-up, `AuthLogo`) and the server-only Route Handler
+   factory that proxies them to base-api's `/api/site/auth/*`.
 
 ## Install
 
 ```bash
-pnpm add @reblu/site-next @reblu/site-client @reblu/site-contracts @reblu/site-ui
+pnpm add @reblu/site-next @reblu/site-client @reblu/site-contracts @reblu/site-ui next-themes
 ```
 
-Peer deps: `react >=19`, `next >=16`, `@reblu/site-ui`.
+Peer deps: `react >=19`, `next >=16`, `@reblu/site-ui`, `next-themes`.
+
+`next-themes` is required by the `./auth` entry as a whole, not only by
+`AuthLogo`: `tsup.config.ts` builds `auth.js`/`auth.cjs` as ONE
+self-contained bundle (`splitting: false`, `treeshake: false`, both required
+to preserve the `'use client'` directive — R4), so importing anything from
+`@reblu/site-next/auth` pulls in `AuthLogo`'s `next-themes` import at module
+resolution time, even if your code never renders `<AuthLogo/>`.
 
 ## ISR caching
 
@@ -57,6 +68,61 @@ import { client } from '@/lib/reblu'
 `CtaButtons` is additionally available at the `@reblu/site-next/cta-buttons`
 subpath, which resolves directly to the emitted `'use client'` boundary.
 
+## Auth
+
+`@reblu/site-next/auth` exports the copy-injectable client components a SITE
+mounts at its auth pages, each with Spanish-default copy overridable via a
+`copy` prop:
+
+```tsx
+import { LoginForm, AuthLogo, mapLoginError } from '@reblu/site-next/auth'
+
+<AuthLogo
+  logoLightExpandedUrl={config.logoLightExpandedUrl}
+  logoDarkExpandedUrl={config.logoDarkExpandedUrl}
+  logoLightSmallUrl={config.logoLightSmallUrl}
+  logoDarkSmallUrl={config.logoDarkSmallUrl}
+  siteName={config.siteName}
+/>
+<LoginForm
+  passwordLoginUrl="/api/auth/login"
+  mfaVerifyUrl="/api/auth/mfa-verify"
+  magicLinkRequestUrl="/api/auth/magic-link-request"
+  resetPasswordUrl="/reset-password"
+/>
+```
+
+| Export                   | Mount path (fixed by base-api)     | Notes                                    |
+| ------------------------- | ----------------------------------- | ----------------------------------------- |
+| `LoginForm`                | `/login`                            | Password + magic-link + MFA               |
+| `AuthCallback`              | Supabase email-template target      | No `AuthLogo` (transient, R1 exception)  |
+| `ResetPasswordRequest`      | SITE-owned (e.g. `/reset-password`) | Anti-enumeration generic success; posts to its own `requestUrl` prop |
+| `ResetPasswordConfirm`      | `/reset-password/confirm`           | Includes REB-378 MFA step-up branch       |
+| `SetPassword`               | `/auth/set-password`                | Invite flow, `session_exchange_token`     |
+| `AuthConfirm`               | `/auth/confirm`                     | Dual-mode: `success=true` / `token_hash`  |
+| `AuthLogo`                  | —                                    | Dynamic tenant logo, `next-themes`-driven |
+| `mapLoginError`             | —                                    | Maps Supabase `?error=` to Spanish copy   |
+
+`ResetPasswordConfirm`, `SetPassword`, and `AuthConfirm` read their own URL
+params internally via `useSearchParams()`. Next.js requires that hook's
+subtree to render inside a `<Suspense>` boundary — wrap the page/route that
+mounts one of these three in `<Suspense>` yourself (`LoginForm` and
+`AuthCallback` don't need it: they don't call `useSearchParams()`).
+
+`createProxyRoute` (`@reblu/site-next/route-handlers`, server-only,
+dependency-free) wires a Route Handler file to base-api in one line:
+
+```ts
+// app/api/auth/login/route.ts
+import { createProxyRoute } from '@reblu/site-next/route-handlers'
+
+export const POST = createProxyRoute('/api/site/auth/login')
+```
+
+`baseUrl`/`apiKey` resolve from `opts` first, falling back to the
+`REBLU_API_BASE_URL`/`REBLU_API_KEY` env vars — read lazily per request, not at
+module load.
+
 ## Build
 
 `tsup` → dual ESM/CJS + `.d.ts`. Code-splitting is **off** so each entry keeps its