@segmentstream-cloud/app 0.3.0 → 0.3.1

package/README.md

@@ -53,6 +53,12 @@ import { segmentstream } from "@/segmentstream";
 export const { GET, POST, PUT, DELETE, PATCH } = segmentstream.authHandlers();
 ```
 
+The route completes emailed sign-in links (`/api/auth/magic-link/verify`) itself: it
+verifies the token through Neon Auth without a callback, sets the session cookies on
+the app's domain and redirects to the link's `callbackURL` path. An expired, used or
+unknown link redirects to `/sign-in?error=sign_in_link_invalid`, where `<SignIn />`
+offers a new code.
+
 **`src/app/sign-in/page.tsx`** renders the sign-in form, and the root layout imports
 its stylesheet once:
 

package/dist/errors.d.ts

@@ -31,6 +31,8 @@ export declare class SegmentStreamApiError extends Error {
 }
 /** The person signed in, but the ontology has no member row for them. */
 export declare const NOT_INVITED = "not_invited";
+/** An emailed sign-in link that Neon Auth rejected: expired, already used or unknown. */
+export declare const SIGN_IN_LINK_INVALID = "sign_in_link_invalid";
 /** The error body of a failed response: `{ error, detail, requestId, issues? }`. */
 export declare function apiErrorFrom(status: number, payload: unknown, fallbackDetail: string): SegmentStreamApiError;
 export declare function readJson(response: Response): Promise<unknown>;

package/dist/errors.js

@@ -26,6 +26,8 @@ export class SegmentStreamApiError extends Error {
 }
 /** The person signed in, but the ontology has no member row for them. */
 export const NOT_INVITED = "not_invited";
+/** An emailed sign-in link that Neon Auth rejected: expired, already used or unknown. */
+export const SIGN_IN_LINK_INVALID = "sign_in_link_invalid";
 /** The error body of a failed response: `{ error, detail, requestId, issues? }`. */
 export function apiErrorFrom(status, payload, fallbackDetail) {
     const body = typeof payload === "object" && payload !== null ? payload : {};

package/dist/index.d.ts

@@ -15,7 +15,7 @@ import type { SegmentStreamAppConfig } from "./config.js";
  * from the ontology. Without it, members sign in with their SegmentStream account, as in 0.2.
  */
 export declare function createSegmentStreamApp<O = unknown>(config: SegmentStreamAppConfig): SegmentStreamApp<O>;
-export { NOT_INVITED, SegmentStreamApiError } from "./errors.js";
+export { NOT_INVITED, SIGN_IN_LINK_INVALID, SegmentStreamApiError } from "./errors.js";
 export { grants, isAllowed } from "./permissions.js";
 export { sql } from "./parameters.js";
 export type { AuthenticationMethod, SegmentStreamApp } from "./app.js";

package/dist/index.js

@@ -16,6 +16,6 @@ import { createApp } from "./app.js";
 export function createSegmentStreamApp(config) {
     return createApp(config);
 }
-export { NOT_INVITED, SegmentStreamApiError } from "./errors.js";
+export { NOT_INVITED, SIGN_IN_LINK_INVALID, SegmentStreamApiError } from "./errors.js";
 export { grants, isAllowed } from "./permissions.js";
 export { sql } from "./parameters.js";

package/dist/neon.js

@@ -4,7 +4,7 @@ import { cookies } from "next/headers";
 import { redirect } from "next/navigation";
 import { NextResponse } from "next/server";
 import { replaceRequestCookies, safeReturnTo } from "./cookies.js";
-import { NOT_INVITED, SegmentStreamApiError, apiErrorFrom, readJson } from "./errors.js";
+import { NOT_INVITED, SIGN_IN_LINK_INVALID, SegmentStreamApiError, apiErrorFrom, readJson, } from "./errors.js";
 import { parseMe } from "./me.js";
 import { createOntologyTransport } from "./ontology-transport.js";
 import { isAllowed } from "./permissions.js";
@@ -28,6 +28,12 @@ export const OPEN_PATHS = [
     "/sitemap.xml",
     "/manifest.webmanifest",
 ];
+/**
+ * Better Auth answers a magic link that names a callback with a redirect to that path on Neon
+ * Auth's own origin; Neon's proxy follows it and loses the session cookie. Without them it answers
+ * JSON with the cookies, and the app's auth route redirects itself.
+ */
+const MAGIC_LINK_CALLBACK_PARAMETERS = ["callbackURL", "errorCallbackURL", "newUserCallbackURL"];
 /** How long a user's roles and permissions are reused before `/api/ontology/me` is asked again. */
 const USER_TTL_MS = 60_000;
 /** Neon Auth JWTs live 15 minutes; a cached one is replaced a minute before it expires. */
@@ -281,7 +287,12 @@ export function createNeonSession(dependencies) {
     function authHandlers() {
         const handlers = () => (routeHandlers ??= neonAuth().handler());
         return {
-            GET: (request, context) => handlers().GET(request, context),
+            GET: async (request, context) => {
+                const { path } = await context.params;
+                return path.length === 2 && path[0] === "magic-link" && path[1] === "verify"
+                    ? completeMagicLink(request, context, () => handlers().GET)
+                    : handlers().GET(request, context);
+            },
             POST: (request, context) => handlers().POST(request, context),
             PUT: (request, context) => handlers().PUT(request, context),
             DELETE: (request, context) => handlers().DELETE(request, context),
@@ -375,6 +386,52 @@ function forwardSessionCookies(request, response) {
     }
     return forwarded;
 }
+/**
+ * Signs in with an emailed magic link on the app's own domain: Neon Auth verifies the token
+ * without a callback and sets the session cookies, which go to the browser with a redirect to the
+ * link's `callbackURL` path. A link Neon Auth rejects leads to the sign-in page instead.
+ */
+async function completeMagicLink(request, context, verify) {
+    const url = new URL(request.url);
+    const destination = safeReturnTo(url.searchParams.get("callbackURL"));
+    const token = url.searchParams.get("token");
+    if (token === null || token === "") {
+        return invalidSignInLink(url.origin, destination);
+    }
+    for (const name of MAGIC_LINK_CALLBACK_PARAMETERS) {
+        url.searchParams.delete(name);
+    }
+    const handler = verify();
+    let response;
+    try {
+        response = await handler(new Request(url, request), context);
+    }
+    catch {
+        return invalidSignInLink(url.origin, destination);
+    }
+    // The body holds the session token; only the cookies go on to the browser.
+    void response.body?.cancel().catch(() => undefined);
+    if (!response.ok) {
+        return invalidSignInLink(url.origin, destination);
+    }
+    const redirect = NextResponse.redirect(new URL(destination, url.origin), 303);
+    for (const cookie of response.headers.getSetCookie()) {
+        redirect.headers.append("set-cookie", cookie);
+    }
+    redirect.headers.set("cache-control", "no-store");
+    return redirect;
+}
+/** An expired, used or unknown sign-in link: the sign-in page explains it and sends a code. */
+function invalidSignInLink(origin, destination) {
+    const url = new URL(SIGN_IN_PAGE, origin);
+    url.searchParams.set("error", SIGN_IN_LINK_INVALID);
+    if (destination !== "/") {
+        url.searchParams.set("returnTo", destination);
+    }
+    const response = NextResponse.redirect(url, 303);
+    response.headers.set("cache-control", "no-store");
+    return response;
+}
 /** Page navigations go to the sign-in page and come back to where they started. */
 function signInPageRedirect(request) {
     const url = new URL(SIGN_IN_PAGE, request.nextUrl.origin);

package/dist/ui/index.d.ts

@@ -7,4 +7,4 @@ export type { SignInProps } from "./sign-in.js";
 export type { SessionState, SessionUser, UserState } from "./store.js";
 export { isAllowed } from "../permissions.js";
 export type { CurrentUser } from "../me.js";
-export { SegmentStreamApiError, NOT_INVITED } from "../errors.js";
+export { SegmentStreamApiError, NOT_INVITED, SIGN_IN_LINK_INVALID } from "../errors.js";

package/dist/ui/index.js

@@ -5,4 +5,4 @@ export { Can, SignedIn, SignedOut, UserMenu, signOut } from "./components.js";
 export { usePermissions, useSession, useUser } from "./hooks.js";
 export { SignIn, signInErrorMessage } from "./sign-in.js";
 export { isAllowed } from "../permissions.js";
-export { SegmentStreamApiError, NOT_INVITED } from "../errors.js";
+export { SegmentStreamApiError, NOT_INVITED, SIGN_IN_LINK_INVALID } from "../errors.js";

package/dist/ui/sign-in.d.ts

@@ -2,7 +2,8 @@ export interface SignInProps {
     /** Where to go once signed in. Defaults to the page's `returnTo` parameter, then `/`. */
     readonly returnTo?: string;
     /**
-     * Why the page was opened: `not_invited` when `requireUser()` found no invitation. Defaults to
+     * Why the page was opened: `not_invited` when `requireUser()` found no invitation,
+     * `sign_in_link_invalid` when an emailed sign-in link was expired, used or unknown. Defaults to
      * the page's `error` parameter.
      */
     readonly error?: string;

package/dist/ui/sign-in.js

@@ -1,6 +1,7 @@
 "use client";
 import { jsx as _jsx, jsxs as _jsxs } from "react/jsx-runtime";
 import { useEffect, useId, useRef, useState, useSyncExternalStore } from "react";
+import { SIGN_IN_LINK_INVALID } from "../errors.js";
 import { safeReturnTo } from "../return-to.js";
 import { useSession } from "./hooks.js";
 import { navigate } from "./navigation.js";
@@ -38,6 +39,7 @@ export function SignIn({ returnTo, error: reason, title = "Sign in" }) {
     const resendTimer = useRef(undefined);
     const destination = safeReturnTo(returnTo ?? pageReturnTo);
     const notInvited = (reason ?? pageError) === NOT_INVITED && !switchingAccount;
+    const linkInvalid = (reason ?? pageError) === SIGN_IN_LINK_INVALID;
     useEffect(() => () => clearInterval(resendTimer.current), []);
     useEffect(() => {
         if (step === "code") {
@@ -141,7 +143,7 @@ export function SignIn({ returnTo, error: reason, title = "Sign in" }) {
         return (_jsxs("section", { className: "ss-card ss-sign-in", "aria-labelledby": `${ids}-title`, children: [_jsx("h1", { id: `${ids}-title`, className: "ss-title", children: "You are signed in" }), _jsx("p", { className: "ss-text", children: sessionEmail === null ? "You already have a session." : `Signed in as ${sessionEmail}.` }), _jsxs("div", { className: "ss-actions", children: [_jsx("a", { className: "ss-button", href: destination, children: "Continue" }), _jsx("button", { type: "button", className: "ss-button ss-button--secondary", onClick: () => void switchAccount(), children: "Use another email" })] })] }));
     }
     if (step === "email") {
-        return (_jsxs("section", { className: "ss-card ss-sign-in", "aria-labelledby": `${ids}-title`, children: [_jsx("h1", { id: `${ids}-title`, className: "ss-title", children: title }), _jsxs("p", { className: "ss-text", children: ["We will email you a ", CODE_LENGTH, "-digit code to sign in."] }), _jsxs("form", { className: "ss-form", onSubmit: (event) => void submitEmail(event), noValidate: true, children: [_jsxs("div", { className: "ss-field", children: [_jsx("label", { className: "ss-label", htmlFor: `${ids}-email`, children: "Email" }), _jsx("input", { id: `${ids}-email`, className: "ss-input", type: "email", name: "email", autoComplete: "email", inputMode: "email", required: true, value: email, onChange: (event) => setEmail(event.target.value), disabled: pending !== null, "aria-invalid": error !== null, "aria-describedby": error === null ? undefined : errorId })] }), error !== null && (_jsx("p", { id: errorId, className: "ss-error", role: "alert", children: error })), _jsx("button", { type: "submit", className: "ss-button", disabled: pending !== null, "aria-busy": pending === "send", children: pending === "send" ? "Sending code…" : "Send code" })] })] }));
+        return (_jsxs("section", { className: "ss-card ss-sign-in", "aria-labelledby": `${ids}-title`, children: [_jsx("h1", { id: `${ids}-title`, className: "ss-title", children: title }), _jsxs("p", { className: "ss-text", children: ["We will email you a ", CODE_LENGTH, "-digit code to sign in."] }), _jsxs("form", { className: "ss-form", onSubmit: (event) => void submitEmail(event), noValidate: true, children: [linkInvalid && (_jsx("p", { className: "ss-notice", role: "status", children: "This sign-in link is not valid anymore. Enter your email to get a new code." })), _jsxs("div", { className: "ss-field", children: [_jsx("label", { className: "ss-label", htmlFor: `${ids}-email`, children: "Email" }), _jsx("input", { id: `${ids}-email`, className: "ss-input", type: "email", name: "email", autoComplete: "email", inputMode: "email", required: true, value: email, onChange: (event) => setEmail(event.target.value), disabled: pending !== null, "aria-invalid": error !== null, "aria-describedby": error === null ? undefined : errorId })] }), error !== null && (_jsx("p", { id: errorId, className: "ss-error", role: "alert", children: error })), _jsx("button", { type: "submit", className: "ss-button", disabled: pending !== null, "aria-busy": pending === "send", children: pending === "send" ? "Sending code…" : "Send code" })] })] }));
     }
     return (_jsxs("section", { className: "ss-card ss-sign-in", "aria-labelledby": `${ids}-title`, children: [_jsx("h1", { id: `${ids}-title`, className: "ss-title", children: "Check your email" }), _jsxs("p", { className: "ss-text", children: ["Enter the ", CODE_LENGTH, "-digit code we sent to ", _jsx("strong", { children: email }), "."] }), _jsxs("form", { className: "ss-form", onSubmit: (event) => {
                     event.preventDefault();

package/package.json

@@ -1,6 +1,6 @@
 {
   "name": "@segmentstream-cloud/app",
-  "version": "0.3.0",
+  "version": "0.3.1",
   "description": "Sign-in, users, permissions, the ontology client and warehouse data access for SegmentStream workspace apps built with Next.js.",
   "license": "Apache-2.0",
   "author": "SegmentStream",