@scalemule/nextjs 0.1.38 → 0.1.39

package/dist/server/index.js

@@ -34,40 +34,40 @@ function validateIP(ip) {
   return void 0;
 }
 function extractClientContext(request) {
-  const headers2 = request.headers;
+  const headers3 = request.headers;
   let ip;
-  const cfConnectingIp = headers2.get("cf-connecting-ip");
+  const cfConnectingIp = headers3.get("cf-connecting-ip");
   if (cfConnectingIp) {
     ip = validateIP(cfConnectingIp);
   }
   if (!ip) {
-    const doConnectingIp = headers2.get("do-connecting-ip");
+    const doConnectingIp = headers3.get("do-connecting-ip");
     if (doConnectingIp) {
       ip = validateIP(doConnectingIp);
     }
   }
   if (!ip) {
-    const realIp = headers2.get("x-real-ip");
+    const realIp = headers3.get("x-real-ip");
     if (realIp) {
       ip = validateIP(realIp);
     }
   }
   if (!ip) {
-    const forwardedFor = headers2.get("x-forwarded-for");
+    const forwardedFor = headers3.get("x-forwarded-for");
     if (forwardedFor) {
       const firstIp = forwardedFor.split(",")[0]?.trim();
       ip = validateIP(firstIp);
     }
   }
   if (!ip) {
-    const vercelForwarded = headers2.get("x-vercel-forwarded-for");
+    const vercelForwarded = headers3.get("x-vercel-forwarded-for");
     if (vercelForwarded) {
       const firstIp = vercelForwarded.split(",")[0]?.trim();
       ip = validateIP(firstIp);
     }
   }
   if (!ip) {
-    const trueClientIp = headers2.get("true-client-ip");
+    const trueClientIp = headers3.get("true-client-ip");
     if (trueClientIp) {
       ip = validateIP(trueClientIp);
     }
@@ -75,10 +75,10 @@ function extractClientContext(request) {
   if (!ip && request.ip) {
     ip = validateIP(request.ip);
   }
-  const userAgent = headers2.get("user-agent") || void 0;
-  const deviceFingerprint = headers2.get("x-device-fingerprint") || void 0;
-  const referrer = headers2.get("referer") || void 0;
-  const anonymousId = headers2.get("x-anonymous-id") || void 0;
+  const userAgent = headers3.get("user-agent") || void 0;
+  const deviceFingerprint = headers3.get("x-device-fingerprint") || void 0;
+  const referrer = headers3.get("referer") || void 0;
+  const anonymousId = headers3.get("x-anonymous-id") || void 0;
   return {
     ip,
     userAgent,
@@ -88,9 +88,9 @@ function extractClientContext(request) {
   };
 }
 function extractClientContextFromReq(req) {
-  const headers2 = req.headers;
+  const headers3 = req.headers;
   const getHeader = (name) => {
-    const value = headers2[name.toLowerCase()];
+    const value = headers3[name.toLowerCase()];
     if (Array.isArray(value)) {
       return value[0];
     }
@@ -149,27 +149,27 @@ function extractClientContextFromReq(req) {
   };
 }
 function buildClientContextHeaders(context) {
-  const headers2 = {};
+  const headers3 = {};
   if (!context) {
-    return headers2;
+    return headers3;
   }
   if (context.ip) {
-    headers2["x-sm-forwarded-client-ip"] = context.ip;
-    headers2["X-Client-IP"] = context.ip;
+    headers3["x-sm-forwarded-client-ip"] = context.ip;
+    headers3["X-Client-IP"] = context.ip;
   }
   if (context.userAgent) {
-    headers2["X-Client-User-Agent"] = context.userAgent;
+    headers3["X-Client-User-Agent"] = context.userAgent;
   }
   if (context.deviceFingerprint) {
-    headers2["X-Client-Device-Fingerprint"] = context.deviceFingerprint;
+    headers3["X-Client-Device-Fingerprint"] = context.deviceFingerprint;
   }
   if (context.referrer) {
-    headers2["X-Client-Referrer"] = context.referrer;
+    headers3["X-Client-Referrer"] = context.referrer;
   }
   if (context.anonymousId) {
-    headers2["x-anonymous-id"] = context.anonymousId;
+    headers3["x-anonymous-id"] = context.anonymousId;
   }
-  return headers2;
+  return headers3;
 }
 function buildFlagContext(clientContext, extraContext = {}) {
   const context = { ...extraContext };
@@ -187,6 +187,7 @@ var GATEWAY_URLS = {
 function resolveGatewayUrl(config) {
   if (config.gatewayUrl) return config.gatewayUrl;
   if (process.env.SCALEMULE_API_URL) return process.env.SCALEMULE_API_URL;
+  if (process.env.SCALEMULE_GATEWAY_URL) return process.env.SCALEMULE_GATEWAY_URL;
   return GATEWAY_URLS[config.environment || "prod"];
 }
 var ScaleMuleServer = class {
@@ -575,7 +576,7 @@ var ScaleMuleServer = class {
         formData.append("file", blob, file.filename);
         formData.append("sm_user_id", userId);
         const url = `${this.gatewayUrl}/v1/storage/upload`;
-        const headers2 = {
+        const headers3 = {
           "x-api-key": this.apiKey,
           "x-user-id": userId,
           ...buildClientContextHeaders(options?.clientContext)
@@ -586,7 +587,7 @@ var ScaleMuleServer = class {
         try {
           const response = await fetch(url, {
             method: "POST",
-            headers: headers2,
+            headers: headers3,
             body: formData
           });
           const text = await response.text();
@@ -808,14 +809,14 @@ var ScaleMuleServer = class {
    */
   async request(method, path, options = {}) {
     const url = `${this.gatewayUrl}${path}`;
-    const headers2 = {
+    const headers3 = {
       "x-api-key": this.apiKey,
       "Content-Type": "application/json",
       // Forward client context headers if provided
       ...buildClientContextHeaders(options.clientContext)
     };
     if (options.sessionToken) {
-      headers2["Authorization"] = `Bearer ${options.sessionToken}`;
+      headers3["Authorization"] = `Bearer ${options.sessionToken}`;
     }
     if (this.debug) {
       console.log(`[ScaleMule Server] ${method} ${path}`);
@@ -826,7 +827,7 @@ var ScaleMuleServer = class {
     try {
       const response = await fetch(url, {
         method,
-        headers: headers2,
+        headers: headers3,
         body: options.body ? JSON.stringify(options.body) : void 0
       });
       const rotated = response.headers.get("x-rotated-session-token");
@@ -922,87 +923,111 @@ function createCookieHeader(name, value, options = {}) {
 }
 function createClearCookieHeader(name, options = {}) {
   const path = options.path ?? "/";
-  let cookie = `${name}=; Path=${path}; Max-Age=0; HttpOnly`;
+  const secure = options.secure ?? process.env.NODE_ENV === "production";
+  const sameSite = options.sameSite ?? "lax";
+  let cookie = `${name}=; Path=${path}; Max-Age=0; HttpOnly; SameSite=${sameSite}`;
+  if (secure) {
+    cookie += "; Secure";
+  }
   if (options.domain) {
     cookie += `; Domain=${options.domain}`;
   }
   return cookie;
 }
 function withSession(loginResponse, responseBody, options = {}) {
-  const headers2 = new Headers();
-  headers2.set("Content-Type", "application/json");
-  headers2.append(
+  const headers3 = new Headers();
+  headers3.set("Content-Type", "application/json");
+  headers3.append(
     "Set-Cookie",
     createCookieHeader(SESSION_COOKIE_NAME, loginResponse.session_token, options)
   );
-  headers2.append(
+  headers3.append(
     "Set-Cookie",
     createCookieHeader(USER_ID_COOKIE_NAME, loginResponse.user.id, options)
   );
   return new Response(JSON.stringify({ success: true, data: responseBody }), {
     status: 200,
-    headers: headers2
+    headers: headers3
   });
 }
 function withRefreshedSession(sessionToken, userId, responseBody, options = {}) {
-  const headers2 = new Headers();
-  headers2.set("Content-Type", "application/json");
-  headers2.append(
+  const headers3 = new Headers();
+  headers3.set("Content-Type", "application/json");
+  headers3.append(
     "Set-Cookie",
     createCookieHeader(SESSION_COOKIE_NAME, sessionToken, options)
   );
-  headers2.append(
+  headers3.append(
     "Set-Cookie",
     createCookieHeader(USER_ID_COOKIE_NAME, userId, options)
   );
   return new Response(JSON.stringify({ success: true, data: responseBody }), {
     status: 200,
-    headers: headers2
+    headers: headers3
   });
 }
 function clearSession(responseBody, options = {}, status = 200) {
-  const headers2 = new Headers();
-  headers2.set("Content-Type", "application/json");
-  headers2.append("Set-Cookie", createClearCookieHeader(SESSION_COOKIE_NAME, options));
-  headers2.append("Set-Cookie", createClearCookieHeader(USER_ID_COOKIE_NAME, options));
+  const headers3 = new Headers();
+  headers3.set("Content-Type", "application/json");
+  headers3.append("Set-Cookie", createClearCookieHeader(SESSION_COOKIE_NAME, options));
+  headers3.append("Set-Cookie", createClearCookieHeader(USER_ID_COOKIE_NAME, options));
   return new Response(JSON.stringify({ success: status < 300, data: responseBody }), {
     status,
-    headers: headers2
+    headers: headers3
   });
 }
 async function getSession() {
   const cookieStore = await headers.cookies();
   const sessionCookie = cookieStore.get(SESSION_COOKIE_NAME);
   const userIdCookie = cookieStore.get(USER_ID_COOKIE_NAME);
-  if (!sessionCookie?.value || !userIdCookie?.value) {
-    return null;
+  if (sessionCookie?.value && userIdCookie?.value) {
+    return {
+      sessionToken: sessionCookie.value,
+      userId: userIdCookie.value,
+      expiresAt: /* @__PURE__ */ new Date()
+      // Note: actual expiry is managed by ScaleMule backend
+    };
   }
+  const headerStore = await headers.headers();
+  return sessionFromAuthHeaders(
+    headerStore.get("authorization"),
+    headerStore.get("x-sm-user-id")
+  );
+}
+function sessionFromAuthHeaders(authorization, userId) {
+  if (!authorization || !userId) return null;
+  const match = /^Bearer\s+(.+)$/i.exec(authorization.trim());
+  const token = match?.[1]?.trim();
+  if (!token) return null;
   return {
-    sessionToken: sessionCookie.value,
-    userId: userIdCookie.value,
+    sessionToken: token,
+    userId,
     expiresAt: /* @__PURE__ */ new Date()
-    // Note: actual expiry is managed by ScaleMule backend
   };
 }
 function getSessionFromRequest(request) {
   const cookieHeader = request.headers.get("cookie");
-  if (!cookieHeader) return null;
-  const cookies4 = Object.fromEntries(
-    cookieHeader.split(";").map((c) => {
-      const [key, ...rest] = c.trim().split("=");
-      return [key, decodeURIComponent(rest.join("="))];
-    })
-  );
-  const sessionToken = cookies4[SESSION_COOKIE_NAME];
-  const userId = cookies4[USER_ID_COOKIE_NAME];
-  if (!sessionToken || !userId) {
-    return null;
+  if (cookieHeader) {
+    const cookies4 = Object.fromEntries(
+      cookieHeader.split(";").map((c) => {
+        const [key, ...rest] = c.trim().split("=");
+        return [key, decodeURIComponent(rest.join("="))];
+      })
+    );
+    const sessionToken = cookies4[SESSION_COOKIE_NAME];
+    const userId = cookies4[USER_ID_COOKIE_NAME];
+    if (sessionToken && userId) {
+      return {
+        sessionToken,
+        userId,
+        expiresAt: /* @__PURE__ */ new Date()
+      };
+    }
   }
-  return {
-    sessionToken,
-    userId,
-    expiresAt: /* @__PURE__ */ new Date()
-  };
+  return sessionFromAuthHeaders(
+    request.headers.get("authorization"),
+    request.headers.get("x-sm-user-id")
+  );
 }
 var MAX_KNOWN_ACCOUNTS = 10;
 function maskEmail(email) {
@@ -1043,7 +1068,7 @@ function applyPrivacyToEntry(entry, privacy) {
       };
   }
 }
-function appendKnownAccountCookie(headers2, account, existingCookie, options = {}, privacy) {
+function appendKnownAccountCookie(headers3, account, existingCookie, options = {}, privacy) {
   let accounts = {};
   if (existingCookie) {
     try {
@@ -1072,9 +1097,9 @@ function appendKnownAccountCookie(headers2, account, existingCookie, options = {
   if (options.domain) {
     cookie += `; Domain=${options.domain}`;
   }
-  headers2.append("Set-Cookie", cookie);
+  headers3.append("Set-Cookie", cookie);
 }
-function removeKnownAccountFromCookie(headers2, userId, existingCookie, options = {}) {
+function removeKnownAccountFromCookie(headers3, userId, existingCookie, options = {}) {
   let accounts = {};
   if (existingCookie) {
     try {
@@ -1094,15 +1119,15 @@ function removeKnownAccountFromCookie(headers2, userId, existingCookie, options
   if (options.domain) {
     cookie += `; Domain=${options.domain}`;
   }
-  headers2.append("Set-Cookie", cookie);
+  headers3.append("Set-Cookie", cookie);
 }
-function clearKnownAccountsCookie(headers2, options = {}) {
+function clearKnownAccountsCookie(headers3, options = {}) {
   const path = options.path ?? "/";
   let cookie = `${KNOWN_ACCOUNTS_COOKIE_NAME}=; Path=${path}; Max-Age=0`;
   if (options.domain) {
     cookie += `; Domain=${options.domain}`;
   }
-  headers2.append("Set-Cookie", cookie);
+  headers3.append("Set-Cookie", cookie);
 }
 function getKnownAccountsFromRequest(request) {
   const cookieHeader = request.headers.get("cookie");
@@ -1600,13 +1625,13 @@ function createAuthRoutes(config = {}) {
           if (!user_id) {
             return errorResponse("VALIDATION_ERROR", "user_id required", 400);
           }
-          const headers2 = new Headers();
-          headers2.set("Content-Type", "application/json");
+          const headers3 = new Headers();
+          headers3.set("Content-Type", "application/json");
           const existingKnown = getKnownAccountsCookieRaw(request);
-          removeKnownAccountFromCookie(headers2, user_id, existingKnown, cookieOptions);
+          removeKnownAccountFromCookie(headers3, user_id, existingKnown, cookieOptions);
           return new Response(
             JSON.stringify({ success: true, data: { message: "Account forgotten" } }),
-            { status: 200, headers: headers2 }
+            { status: 200, headers: headers3 }
           );
         }
         // ==================== Forget All Accounts ====================
@@ -1614,12 +1639,12 @@ function createAuthRoutes(config = {}) {
           if (!config.enableAccountSwitcher) {
             return errorResponse("NOT_FOUND", "Account switcher not enabled", 404);
           }
-          const headers2 = new Headers();
-          headers2.set("Content-Type", "application/json");
-          clearKnownAccountsCookie(headers2, cookieOptions);
+          const headers3 = new Headers();
+          headers3.set("Content-Type", "application/json");
+          clearKnownAccountsCookie(headers3, cookieOptions);
           return new Response(
             JSON.stringify({ success: true, data: { message: "All accounts forgotten" } }),
-            { status: 200, headers: headers2 }
+            { status: 200, headers: headers3 }
           );
         }
         default:
@@ -2329,31 +2354,31 @@ function createPushRoutes(config) {
   const { apiKey, gatewayUrl, csrf = true } = config;
   async function proxyToGateway(request, method, subPath) {
     const targetUrl = `${gatewayUrl}/v1/communication/push/${subPath}`;
-    const headers2 = {
+    const headers3 = {
       "x-api-key": apiKey
     };
     const session = getSessionFromRequest(request);
     if (session?.sessionToken) {
-      headers2["Authorization"] = `Bearer ${session.sessionToken}`;
+      headers3["Authorization"] = `Bearer ${session.sessionToken}`;
     }
     const clientContext = extractClientContext(
       request
     );
     const contextHeaders = buildClientContextHeaders(clientContext);
-    Object.assign(headers2, contextHeaders);
+    Object.assign(headers3, contextHeaders);
     const workspaceId = request.headers.get("x-sm-workspace-id");
     if (workspaceId) {
-      headers2["x-sm-workspace-id"] = workspaceId;
+      headers3["x-sm-workspace-id"] = workspaceId;
     }
     const fetchOptions = {
       method,
-      headers: headers2
+      headers: headers3
     };
     if (method !== "GET" && method !== "DELETE") {
       try {
         const body = await request.text();
         if (body) {
-          headers2["Content-Type"] = "application/json";
+          headers3["Content-Type"] = "application/json";
           fetchOptions.body = body;
         }
       } catch {
@@ -2448,26 +2473,26 @@ function createNotificationRoutes(config) {
   const { apiKey, gatewayUrl } = config;
   async function proxyToGateway(request, method, subPath) {
     const targetUrl = `${gatewayUrl}/v1/notifications/${subPath}`;
-    const headers2 = {
+    const headers3 = {
       "x-api-key": apiKey,
       "Content-Type": "application/json"
     };
     const session = getSessionFromRequest(request);
     if (session?.sessionToken) {
-      headers2["Authorization"] = `Bearer ${session.sessionToken}`;
+      headers3["Authorization"] = `Bearer ${session.sessionToken}`;
     }
     const clientContext = extractClientContext(
       request
     );
     const contextHeaders = buildClientContextHeaders(clientContext);
-    Object.assign(headers2, contextHeaders);
+    Object.assign(headers3, contextHeaders);
     const workspaceId = request.headers.get("x-sm-workspace-id");
     if (workspaceId) {
-      headers2["x-sm-workspace-id"] = workspaceId;
+      headers3["x-sm-workspace-id"] = workspaceId;
     }
     const fetchOptions = {
       method,
-      headers: headers2
+      headers: headers3
     };
     if (method === "PATCH") {
       try {
@@ -3141,47 +3166,47 @@ function formatPermissionsDirective(feature, value) {
   return `${feature}=(${parts.join(" ")})`;
 }
 function buildSecurityHeaders(opts = {}) {
-  const headers2 = [];
+  const headers3 = [];
   const includeHsts = opts.includeHsts ?? true;
   const hstsMaxAge = opts.hstsMaxAgeSeconds ?? 31536e3;
   if (includeHsts && hstsMaxAge > 0) {
     const parts = [`max-age=${hstsMaxAge}`];
     if (opts.hstsIncludeSubDomains ?? true) parts.push("includeSubDomains");
     if (opts.hstsPreload ?? false) parts.push("preload");
-    headers2.push({
+    headers3.push({
       key: "Strict-Transport-Security",
       value: parts.join("; ")
     });
   }
   const frameOptions = opts.frameOptions === void 0 ? "DENY" : opts.frameOptions;
   if (frameOptions !== null) {
-    headers2.push({ key: "X-Frame-Options", value: frameOptions });
+    headers3.push({ key: "X-Frame-Options", value: frameOptions });
   }
   const contentTypeOptions = opts.contentTypeOptions === void 0 ? "nosniff" : opts.contentTypeOptions;
   if (contentTypeOptions !== null) {
-    headers2.push({ key: "X-Content-Type-Options", value: contentTypeOptions });
+    headers3.push({ key: "X-Content-Type-Options", value: contentTypeOptions });
   }
-  headers2.push({
+  headers3.push({
     key: "Referrer-Policy",
     value: opts.referrerPolicy ?? "strict-origin-when-cross-origin"
   });
   const xss = opts.xssProtection === void 0 ? "0" : opts.xssProtection;
   if (xss !== null) {
-    headers2.push({ key: "X-XSS-Protection", value: xss });
+    headers3.push({ key: "X-XSS-Protection", value: xss });
   }
   const permissions = opts.permissionsPolicy === void 0 ? DEFAULT_PERMISSIONS_POLICY : opts.permissionsPolicy;
   if (permissions !== null) {
     const directives = Object.entries(permissions).map(([feature, value]) => formatPermissionsDirective(feature, value)).join(", ");
-    headers2.push({ key: "Permissions-Policy", value: directives });
+    headers3.push({ key: "Permissions-Policy", value: directives });
   }
   if (opts.extraHeaders?.length) {
-    const byKey = new Map(headers2.map((h) => [h.key.toLowerCase(), h]));
+    const byKey = new Map(headers3.map((h) => [h.key.toLowerCase(), h]));
     for (const extra of opts.extraHeaders) {
       byKey.set(extra.key.toLowerCase(), extra);
     }
     return Array.from(byKey.values());
   }
-  return headers2;
+  return headers3;
 }
 
 exports.CSRF_COOKIE_NAME = CSRF_COOKIE_NAME;