@solvapay/next 1.1.0 → 1.2.0-preview-e89fa52f99b6d0c7bf9834fcf2d1403141051fa0

package/README.md

@@ -69,6 +69,19 @@ export const middleware = createSupabaseAuthMiddleware({
 export const config = { matcher: ['/api/:path*'] }
 ```
 
+Auth0 has the same high-level API:
+
+```typescript
+import { createAuth0AuthMiddleware } from '@solvapay/next/middleware'
+import { auth0 } from './lib/auth0'
+
+export const proxy = createAuth0AuthMiddleware({ auth0 })
+
+export const config = {
+  matcher: ['/((?!_next/static|_next/image|favicon.ico|sitemap.xml|robots.txt).*)'],
+}
+```
+
 Next.js 16 renamed middleware to proxy — use `@solvapay/next/middleware` and export `proxy` instead of `middleware` when required.
 
 ## Requirements

package/dist/chunk-WSXIXEUB.js

@@ -0,0 +1,134 @@
+// src/helpers/middleware.ts
+import { NextResponse } from "next/server";
+import { SOLVAPAY_AUTHORIZATION_HEADER, SOLVAPAY_USER_ID_HEADER } from "@solvapay/auth";
+import { createAuth0AuthAdapter } from "@solvapay/auth/auth0";
+function mergeSetCookies(target, source) {
+  for (const cookie of source.headers.getSetCookie()) {
+    target.headers.append("set-cookie", cookie);
+  }
+}
+async function resolveIdentity(adapter, req) {
+  if (adapter.getIdentityFromRequest) {
+    return adapter.getIdentityFromRequest(req);
+  }
+  const userId = await adapter.getUserIdFromRequest(req);
+  if (!userId) {
+    return null;
+  }
+  return { userId };
+}
+function buildForwardResponse(req, userIdHeader, identity) {
+  const requestHeaders = new Headers(req.headers);
+  requestHeaders.delete(userIdHeader);
+  requestHeaders.delete(SOLVAPAY_AUTHORIZATION_HEADER);
+  if (identity) {
+    requestHeaders.set(userIdHeader, identity.userId);
+    if (identity.claimsToken) {
+      requestHeaders.set(SOLVAPAY_AUTHORIZATION_HEADER, `Bearer ${identity.claimsToken}`);
+    }
+  }
+  return NextResponse.next({
+    request: {
+      headers: requestHeaders
+    }
+  });
+}
+function getPathname(req) {
+  if (req.nextUrl) {
+    return req.nextUrl.pathname;
+  }
+  return new URL(req.url).pathname;
+}
+function createAuthMiddleware(options) {
+  const {
+    adapter,
+    publicRoutes = [],
+    userIdHeader = SOLVAPAY_USER_ID_HEADER,
+    processAllRoutes = false,
+    protectedRoutePrefix = "/api"
+  } = options;
+  return async function middleware(request) {
+    const req = request;
+    const pathname = getPathname(req);
+    if (!processAllRoutes && !pathname.startsWith("/api")) {
+      return NextResponse.next();
+    }
+    const handleResult = adapter.handleRequest ? await adapter.handleRequest(req) : null;
+    if (handleResult?.ownsRequest && handleResult.response) {
+      return handleResult.response;
+    }
+    const isPublicRoute = publicRoutes.some((route) => pathname.startsWith(route));
+    const identity = await resolveIdentity(adapter, req);
+    const userId = identity?.userId ?? null;
+    const isProtectedApiRoute = pathname.startsWith(protectedRoutePrefix) && !isPublicRoute;
+    if (isProtectedApiRoute && !userId) {
+      const unauthorized = NextResponse.json(
+        { error: "Unauthorized", details: "Valid authentication required" },
+        { status: 401 }
+      );
+      if (handleResult?.sessionResponse) {
+        mergeSetCookies(unauthorized, handleResult.sessionResponse);
+      }
+      return unauthorized;
+    }
+    const forward = buildForwardResponse(req, userIdHeader, identity);
+    if (handleResult?.sessionResponse) {
+      mergeSetCookies(forward, handleResult.sessionResponse);
+    }
+    return forward;
+  };
+}
+function createAuth0AuthMiddleware(options) {
+  const {
+    auth0,
+    authRoutePrefix,
+    publicRoutes = [],
+    userIdHeader = SOLVAPAY_USER_ID_HEADER,
+    protectedRoutePrefix = "/api"
+  } = options;
+  return createAuthMiddleware({
+    adapter: createAuth0AuthAdapter({ auth0, authRoutePrefix }),
+    publicRoutes,
+    userIdHeader,
+    protectedRoutePrefix,
+    processAllRoutes: true
+  });
+}
+function createSupabaseAuthMiddleware(options = {}) {
+  const { jwtSecret, publicRoutes = [], userIdHeader = SOLVAPAY_USER_ID_HEADER } = options;
+  let authAdapter = null;
+  let adapterPromise = null;
+  const lazyAdapter = {
+    async getUserIdFromRequest(req) {
+      if (!authAdapter) {
+        if (!adapterPromise) {
+          adapterPromise = (async () => {
+            const secret = jwtSecret || process.env.SUPABASE_JWT_SECRET;
+            if (!secret) {
+              throw new Error(
+                "SUPABASE_JWT_SECRET environment variable is required. Please set it in your .env.local file. Get it from: Supabase Dashboard \u2192 Settings \u2192 API \u2192 JWT Secret"
+              );
+            }
+            const { SupabaseAuthAdapter } = await import("@solvapay/auth/supabase");
+            authAdapter = new SupabaseAuthAdapter({ jwtSecret: secret });
+            return authAdapter;
+          })();
+        }
+        authAdapter = await adapterPromise;
+      }
+      return authAdapter.getUserIdFromRequest(req);
+    }
+  };
+  return createAuthMiddleware({
+    adapter: lazyAdapter,
+    publicRoutes,
+    userIdHeader,
+    processAllRoutes: false
+  });
+}
+
+export {
+  createAuthMiddleware,
+  createAuth0AuthMiddleware,
+  createSupabaseAuthMiddleware
+};

package/dist/index.cjs

@@ -35,6 +35,7 @@ __export(index_exports, {
   checkPurchase: () => checkPurchase,
   clearAllPurchaseCache: () => clearAllPurchaseCache,
   clearPurchaseCache: () => clearPurchaseCache,
+  createAuth0AuthMiddleware: () => createAuth0AuthMiddleware,
   createAuthMiddleware: () => createAuthMiddleware,
   createCheckoutSession: () => createCheckoutSession,
   createCustomerSession: () => createCustomerSession,
@@ -353,44 +354,102 @@ async function trackUsage(request, body, options = {}) {
 
 // src/helpers/middleware.ts
 var import_server17 = require("next/server");
+var import_auth = require("@solvapay/auth");
+var import_auth0 = require("@solvapay/auth/auth0");
+function mergeSetCookies(target, source) {
+  for (const cookie of source.headers.getSetCookie()) {
+    target.headers.append("set-cookie", cookie);
+  }
+}
+async function resolveIdentity(adapter, req) {
+  if (adapter.getIdentityFromRequest) {
+    return adapter.getIdentityFromRequest(req);
+  }
+  const userId = await adapter.getUserIdFromRequest(req);
+  if (!userId) {
+    return null;
+  }
+  return { userId };
+}
+function buildForwardResponse(req, userIdHeader, identity) {
+  const requestHeaders = new Headers(req.headers);
+  requestHeaders.delete(userIdHeader);
+  requestHeaders.delete(import_auth.SOLVAPAY_AUTHORIZATION_HEADER);
+  if (identity) {
+    requestHeaders.set(userIdHeader, identity.userId);
+    if (identity.claimsToken) {
+      requestHeaders.set(import_auth.SOLVAPAY_AUTHORIZATION_HEADER, `Bearer ${identity.claimsToken}`);
+    }
+  }
+  return import_server17.NextResponse.next({
+    request: {
+      headers: requestHeaders
+    }
+  });
+}
+function getPathname(req) {
+  if (req.nextUrl) {
+    return req.nextUrl.pathname;
+  }
+  return new URL(req.url).pathname;
+}
 function createAuthMiddleware(options) {
-  const { adapter, publicRoutes = [], userIdHeader = "x-user-id" } = options;
+  const {
+    adapter,
+    publicRoutes = [],
+    userIdHeader = import_auth.SOLVAPAY_USER_ID_HEADER,
+    processAllRoutes = false,
+    protectedRoutePrefix = "/api"
+  } = options;
   return async function middleware(request) {
     const req = request;
-    const { pathname } = req.nextUrl;
-    if (!pathname.startsWith("/api")) {
+    const pathname = getPathname(req);
+    if (!processAllRoutes && !pathname.startsWith("/api")) {
       return import_server17.NextResponse.next();
     }
-    const isPublicRoute = publicRoutes.some((route) => pathname.startsWith(route));
-    const userId = await adapter.getUserIdFromRequest(req);
-    if (isPublicRoute) {
-      const requestHeaders2 = new Headers(req.headers);
-      if (userId) {
-        requestHeaders2.set(userIdHeader, userId);
-      }
-      return import_server17.NextResponse.next({
-        request: {
-          headers: requestHeaders2
-        }
-      });
+    const handleResult = adapter.handleRequest ? await adapter.handleRequest(req) : null;
+    if (handleResult?.ownsRequest && handleResult.response) {
+      return handleResult.response;
     }
-    if (!userId) {
-      return import_server17.NextResponse.json(
+    const isPublicRoute = publicRoutes.some((route) => pathname.startsWith(route));
+    const identity = await resolveIdentity(adapter, req);
+    const userId = identity?.userId ?? null;
+    const isProtectedApiRoute = pathname.startsWith(protectedRoutePrefix) && !isPublicRoute;
+    if (isProtectedApiRoute && !userId) {
+      const unauthorized = import_server17.NextResponse.json(
         { error: "Unauthorized", details: "Valid authentication required" },
         { status: 401 }
       );
-    }
-    const requestHeaders = new Headers(req.headers);
-    requestHeaders.set(userIdHeader, userId);
-    return import_server17.NextResponse.next({
-      request: {
-        headers: requestHeaders
+      if (handleResult?.sessionResponse) {
+        mergeSetCookies(unauthorized, handleResult.sessionResponse);
       }
-    });
+      return unauthorized;
+    }
+    const forward = buildForwardResponse(req, userIdHeader, identity);
+    if (handleResult?.sessionResponse) {
+      mergeSetCookies(forward, handleResult.sessionResponse);
+    }
+    return forward;
   };
 }
+function createAuth0AuthMiddleware(options) {
+  const {
+    auth0,
+    authRoutePrefix,
+    publicRoutes = [],
+    userIdHeader = import_auth.SOLVAPAY_USER_ID_HEADER,
+    protectedRoutePrefix = "/api"
+  } = options;
+  return createAuthMiddleware({
+    adapter: (0, import_auth0.createAuth0AuthAdapter)({ auth0, authRoutePrefix }),
+    publicRoutes,
+    userIdHeader,
+    protectedRoutePrefix,
+    processAllRoutes: true
+  });
+}
 function createSupabaseAuthMiddleware(options = {}) {
-  const { jwtSecret, publicRoutes = [], userIdHeader = "x-user-id" } = options;
+  const { jwtSecret, publicRoutes = [], userIdHeader = import_auth.SOLVAPAY_USER_ID_HEADER } = options;
   let authAdapter = null;
   let adapterPromise = null;
   const lazyAdapter = {
@@ -417,7 +476,8 @@ function createSupabaseAuthMiddleware(options = {}) {
   return createAuthMiddleware({
     adapter: lazyAdapter,
     publicRoutes,
-    userIdHeader
+    userIdHeader,
+    processAllRoutes: false
   });
 }
 
@@ -460,6 +520,7 @@ async function checkPurchase(request, options = {}) {
   checkPurchase,
   clearAllPurchaseCache,
   clearPurchaseCache,
+  createAuth0AuthMiddleware,
   createAuthMiddleware,
   createCheckoutSession,
   createCustomerSession,

package/dist/index.d.cts

@@ -1,7 +1,8 @@
 import { NextResponse } from 'next/server';
 import { AuthenticatedUser, SolvaPay } from '@solvapay/server';
-export { AuthMiddlewareOptions, SupabaseAuthMiddlewareOptions, createAuthMiddleware, createSupabaseAuthMiddleware } from './middleware.cjs';
+export { Auth0AuthMiddlewareOptions, AuthMiddlewareOptions, SupabaseAuthMiddlewareOptions, createAuth0AuthMiddleware, createAuthMiddleware, createSupabaseAuthMiddleware } from './middleware.cjs';
 import '@solvapay/auth';
+import '@solvapay/auth/auth0';
 
 /**
  * Purchase Cache Utilities
@@ -508,6 +509,7 @@ declare function trackUsage(request: globalThis.Request, body: {
     productRef?: string;
     description?: string;
     metadata?: Record<string, unknown>;
+    idempotencyKey?: string;
 }, options?: {
     solvaPay?: SolvaPay;
 }): Promise<NextResponse>;

package/dist/index.d.ts

@@ -1,7 +1,8 @@
 import { NextResponse } from 'next/server';
 import { AuthenticatedUser, SolvaPay } from '@solvapay/server';
-export { AuthMiddlewareOptions, SupabaseAuthMiddlewareOptions, createAuthMiddleware, createSupabaseAuthMiddleware } from './middleware.js';
+export { Auth0AuthMiddlewareOptions, AuthMiddlewareOptions, SupabaseAuthMiddlewareOptions, createAuth0AuthMiddleware, createAuthMiddleware, createSupabaseAuthMiddleware } from './middleware.js';
 import '@solvapay/auth';
+import '@solvapay/auth/auth0';
 
 /**
  * Purchase Cache Utilities
@@ -508,6 +509,7 @@ declare function trackUsage(request: globalThis.Request, body: {
     productRef?: string;
     description?: string;
     metadata?: Record<string, unknown>;
+    idempotencyKey?: string;
 }, options?: {
     solvaPay?: SolvaPay;
 }): Promise<NextResponse>;

package/dist/index.js

@@ -1,7 +1,8 @@
 import {
+  createAuth0AuthMiddleware,
   createAuthMiddleware,
   createSupabaseAuthMiddleware
-} from "./chunk-F7TBIH6W.js";
+} from "./chunk-WSXIXEUB.js";
 
 // src/index.ts
 import { NextResponse as NextResponse4 } from "next/server";
@@ -354,6 +355,7 @@ export {
   checkPurchase,
   clearAllPurchaseCache,
   clearPurchaseCache,
+  createAuth0AuthMiddleware,
   createAuthMiddleware,
   createCheckoutSession,
   createCustomerSession,

package/dist/middleware.cjs

@@ -30,6 +30,7 @@ var __toCommonJS = (mod) => __copyProps(__defProp({}, "__esModule", { value: tru
 // src/middleware.ts
 var middleware_exports = {};
 __export(middleware_exports, {
+  createAuth0AuthMiddleware: () => createAuth0AuthMiddleware,
   createAuthMiddleware: () => createAuthMiddleware,
   createSupabaseAuthMiddleware: () => createSupabaseAuthMiddleware
 });
@@ -37,44 +38,102 @@ module.exports = __toCommonJS(middleware_exports);
 
 // src/helpers/middleware.ts
 var import_server = require("next/server");
+var import_auth = require("@solvapay/auth");
+var import_auth0 = require("@solvapay/auth/auth0");
+function mergeSetCookies(target, source) {
+  for (const cookie of source.headers.getSetCookie()) {
+    target.headers.append("set-cookie", cookie);
+  }
+}
+async function resolveIdentity(adapter, req) {
+  if (adapter.getIdentityFromRequest) {
+    return adapter.getIdentityFromRequest(req);
+  }
+  const userId = await adapter.getUserIdFromRequest(req);
+  if (!userId) {
+    return null;
+  }
+  return { userId };
+}
+function buildForwardResponse(req, userIdHeader, identity) {
+  const requestHeaders = new Headers(req.headers);
+  requestHeaders.delete(userIdHeader);
+  requestHeaders.delete(import_auth.SOLVAPAY_AUTHORIZATION_HEADER);
+  if (identity) {
+    requestHeaders.set(userIdHeader, identity.userId);
+    if (identity.claimsToken) {
+      requestHeaders.set(import_auth.SOLVAPAY_AUTHORIZATION_HEADER, `Bearer ${identity.claimsToken}`);
+    }
+  }
+  return import_server.NextResponse.next({
+    request: {
+      headers: requestHeaders
+    }
+  });
+}
+function getPathname(req) {
+  if (req.nextUrl) {
+    return req.nextUrl.pathname;
+  }
+  return new URL(req.url).pathname;
+}
 function createAuthMiddleware(options) {
-  const { adapter, publicRoutes = [], userIdHeader = "x-user-id" } = options;
+  const {
+    adapter,
+    publicRoutes = [],
+    userIdHeader = import_auth.SOLVAPAY_USER_ID_HEADER,
+    processAllRoutes = false,
+    protectedRoutePrefix = "/api"
+  } = options;
   return async function middleware(request) {
     const req = request;
-    const { pathname } = req.nextUrl;
-    if (!pathname.startsWith("/api")) {
+    const pathname = getPathname(req);
+    if (!processAllRoutes && !pathname.startsWith("/api")) {
       return import_server.NextResponse.next();
     }
-    const isPublicRoute = publicRoutes.some((route) => pathname.startsWith(route));
-    const userId = await adapter.getUserIdFromRequest(req);
-    if (isPublicRoute) {
-      const requestHeaders2 = new Headers(req.headers);
-      if (userId) {
-        requestHeaders2.set(userIdHeader, userId);
-      }
-      return import_server.NextResponse.next({
-        request: {
-          headers: requestHeaders2
-        }
-      });
+    const handleResult = adapter.handleRequest ? await adapter.handleRequest(req) : null;
+    if (handleResult?.ownsRequest && handleResult.response) {
+      return handleResult.response;
     }
-    if (!userId) {
-      return import_server.NextResponse.json(
+    const isPublicRoute = publicRoutes.some((route) => pathname.startsWith(route));
+    const identity = await resolveIdentity(adapter, req);
+    const userId = identity?.userId ?? null;
+    const isProtectedApiRoute = pathname.startsWith(protectedRoutePrefix) && !isPublicRoute;
+    if (isProtectedApiRoute && !userId) {
+      const unauthorized = import_server.NextResponse.json(
         { error: "Unauthorized", details: "Valid authentication required" },
         { status: 401 }
       );
-    }
-    const requestHeaders = new Headers(req.headers);
-    requestHeaders.set(userIdHeader, userId);
-    return import_server.NextResponse.next({
-      request: {
-        headers: requestHeaders
+      if (handleResult?.sessionResponse) {
+        mergeSetCookies(unauthorized, handleResult.sessionResponse);
       }
-    });
+      return unauthorized;
+    }
+    const forward = buildForwardResponse(req, userIdHeader, identity);
+    if (handleResult?.sessionResponse) {
+      mergeSetCookies(forward, handleResult.sessionResponse);
+    }
+    return forward;
   };
 }
+function createAuth0AuthMiddleware(options) {
+  const {
+    auth0,
+    authRoutePrefix,
+    publicRoutes = [],
+    userIdHeader = import_auth.SOLVAPAY_USER_ID_HEADER,
+    protectedRoutePrefix = "/api"
+  } = options;
+  return createAuthMiddleware({
+    adapter: (0, import_auth0.createAuth0AuthAdapter)({ auth0, authRoutePrefix }),
+    publicRoutes,
+    userIdHeader,
+    protectedRoutePrefix,
+    processAllRoutes: true
+  });
+}
 function createSupabaseAuthMiddleware(options = {}) {
-  const { jwtSecret, publicRoutes = [], userIdHeader = "x-user-id" } = options;
+  const { jwtSecret, publicRoutes = [], userIdHeader = import_auth.SOLVAPAY_USER_ID_HEADER } = options;
   let authAdapter = null;
   let adapterPromise = null;
   const lazyAdapter = {
@@ -101,11 +160,13 @@ function createSupabaseAuthMiddleware(options = {}) {
   return createAuthMiddleware({
     adapter: lazyAdapter,
     publicRoutes,
-    userIdHeader
+    userIdHeader,
+    processAllRoutes: false
   });
 }
 // Annotate the CommonJS export names for ESM import in node:
 0 && (module.exports = {
+  createAuth0AuthMiddleware,
   createAuthMiddleware,
   createSupabaseAuthMiddleware
 });

package/dist/middleware.d.cts

@@ -1,11 +1,12 @@
-import { NextRequest, NextResponse } from 'next/server';
+import { NextRequest } from 'next/server';
 import { AuthAdapter } from '@solvapay/auth';
+import { Auth0ClientLike } from '@solvapay/auth/auth0';
 
 /**
  * Next.js Middleware Helpers
  *
  * Helpers for creating authentication middleware in Next.js.
- * Works with any AuthAdapter implementation (Supabase, custom, etc.)
+ * Works with any AuthAdapter implementation (Supabase, Auth0, custom, etc.)
  */
 
 /**
@@ -23,156 +24,65 @@ interface AuthMiddlewareOptions {
      */
     publicRoutes?: string[];
     /**
-     * Header name to store the user ID (default: 'x-user-id')
+     * Header name to store the user ID (default: `x-user-id`)
      */
     userIdHeader?: string;
+    /**
+     * When true, process all matched routes (not only `/api/*`).
+     * Use with session-based adapters (Auth0) that refresh cookies on every request.
+     * Default: false (legacy Supabase API-only behaviour).
+     */
+    processAllRoutes?: boolean;
+    /**
+     * When `processAllRoutes` is true, only enforce 401 on paths starting with this prefix.
+     * Default: `/api`
+     */
+    protectedRoutePrefix?: string;
 }
 /**
  * Creates a Next.js middleware function for authentication
- *
- * This helper:
- * 1. Uses the provided AuthAdapter to extract userId from requests
- * 2. Handles public vs protected routes
- * 3. Adds userId to request headers for downstream routes
- * 4. Returns appropriate error responses for auth failures
- *
- * @param options - Configuration options
- * @returns Next.js middleware function (can be exported as `middleware` or `proxy`)
- *
- * @example Next.js 15
- * ```typescript
- * // middleware.ts (at project root)
- * import { createAuthMiddleware } from '@solvapay/next';
- * import { SupabaseAuthAdapter } from '@solvapay/auth/supabase';
- *
- * const adapter = new SupabaseAuthAdapter({
- *   jwtSecret: process.env.SUPABASE_JWT_SECRET!,
- * });
- *
- * export const middleware = createAuthMiddleware({
- *   adapter,
- *   publicRoutes: ['/api/list-plans'],
- * });
- *
- * export const config = {
- *   matcher: ['/api/:path*'],
- * };
- * ```
- *
- * @example Next.js 16 with src/ folder
- * ```typescript
- * // src/proxy.ts (in src/ folder, not project root)
- * import { createAuthMiddleware } from '@solvapay/next';
- * import { SupabaseAuthAdapter } from '@solvapay/auth/supabase';
- *
- * const adapter = new SupabaseAuthAdapter({
- *   jwtSecret: process.env.SUPABASE_JWT_SECRET!,
- * });
- *
- * // Use 'proxy' export for Next.js 16 (no deprecation warning)
- * export const proxy = createAuthMiddleware({
- *   adapter,
- *   publicRoutes: ['/api/list-plans'],
- * });
- *
- * export const config = {
- *   matcher: ['/api/:path*'],
- * };
- * ```
- *
- * @example Custom adapter
- * ```typescript
- * import { createAuthMiddleware } from '@solvapay/next';
- * import type { AuthAdapter } from '@solvapay/auth';
- *
- * const myAdapter: AuthAdapter = {
- *   async getUserIdFromRequest(req) {
- *     // Your custom auth logic
- *     return userId;
- *   },
- * };
- *
- * export const middleware = createAuthMiddleware({
- *   adapter: myAdapter,
- * });
- * ```
- *
- * **File Location Notes:**
- * - **Next.js 15**: Place `middleware.ts` at project root
- * - **Next.js 16 without `src/` folder**: Place `middleware.ts` or `proxy.ts` at project root
- * - **Next.js 16 with `src/` folder**: Place `src/proxy.ts` or `src/middleware.ts` (in `src/` folder, not root)
- *
- * **Note:** Next.js 16 renamed "middleware" to "proxy". You can export the return value as either
- * `middleware` or `proxy` - both work, but `proxy` is recommended to avoid deprecation warnings.
  */
-declare function createAuthMiddleware(options: AuthMiddlewareOptions): (request: NextRequest) => Promise<NextResponse<unknown>>;
+declare function createAuthMiddleware(options: AuthMiddlewareOptions): (request: NextRequest) => Promise<Response>;
 /**
- * Configuration options for Supabase authentication middleware
+ * Configuration options for Auth0 authentication middleware
  */
-interface SupabaseAuthMiddlewareOptions {
+interface Auth0AuthMiddlewareOptions {
     /**
-     * Supabase JWT secret (from Supabase dashboard: Settings → API → JWT Secret)
-     * If not provided, will use SUPABASE_JWT_SECRET environment variable
+     * Auth0 client instance used by the adapter.
      */
-    jwtSecret?: string;
+    auth0: Auth0ClientLike;
     /**
-     * Public routes that don't require authentication
-     * Routes are matched using pathname.startsWith()
+     * Public routes that don't require authentication.
      */
     publicRoutes?: string[];
     /**
-     * Header name to store the user ID (default: 'x-user-id')
+     * Route prefix owned by Auth0 (default: `/auth`).
      */
+    authRoutePrefix?: string;
+    /**
+     * Header name to store the user ID (default: `x-user-id`)
+     */
+    userIdHeader?: string;
+    /**
+     * Route prefix that enforces 401 when unauthenticated (default: `/api`)
+     */
+    protectedRoutePrefix?: string;
+}
+/**
+ * Creates a Next.js middleware function for Auth0 authentication.
+ */
+declare function createAuth0AuthMiddleware(options: Auth0AuthMiddlewareOptions): (request: NextRequest) => Promise<Response>;
+/**
+ * Configuration options for Supabase authentication middleware
+ */
+interface SupabaseAuthMiddlewareOptions {
+    jwtSecret?: string;
+    publicRoutes?: string[];
     userIdHeader?: string;
 }
 /**
  * Creates a Next.js middleware function for Supabase authentication
- *
- * Convenience function that creates a SupabaseAuthAdapter and wraps it with createAuthMiddleware.
- * Only use this if you're using Supabase - otherwise use createAuthMiddleware with your own adapter.
- *
- * Uses dynamic import to avoid requiring Supabase as a dependency in @solvapay/next.
- *
- * @param options - Configuration options
- * @returns Next.js middleware function (can be exported as `middleware` or `proxy`)
- *
- * @example Next.js 15
- * ```typescript
- * // middleware.ts (at project root)
- * import { createSupabaseAuthMiddleware } from '@solvapay/next';
- *
- * export const middleware = createSupabaseAuthMiddleware({
- *   publicRoutes: ['/api/list-plans'],
- * });
- *
- * export const config = {
- *   matcher: ['/api/:path*'],
- * };
- * ```
- *
- * @example Next.js 16 with src/ folder
- * ```typescript
- * // src/proxy.ts (in src/ folder, not project root)
- * import { createSupabaseAuthMiddleware } from '@solvapay/next';
- *
- * // Use 'proxy' export for Next.js 16 (no deprecation warning)
- * export const proxy = createSupabaseAuthMiddleware({
- *   publicRoutes: ['/api/list-plans'],
- * });
- *
- * export const config = {
- *   matcher: ['/api/:path*'],
- * };
- * ```
- *
- * **File Location Notes:**
- * - **Next.js 15**: Place `middleware.ts` at project root
- * - **Next.js 16 without `src/` folder**: Place `middleware.ts` or `proxy.ts` at project root
- * - **Next.js 16 with `src/` folder**: Place `src/proxy.ts` or `src/middleware.ts` (in `src/` folder, not root)
- *
- * **Note:** Next.js 16 renamed "middleware" to "proxy". You can export the return value as either
- * `middleware` or `proxy` - both work, but `proxy` is recommended to avoid deprecation warnings.
  */
-declare function createSupabaseAuthMiddleware(options?: SupabaseAuthMiddlewareOptions): (request: NextRequest) => Promise<NextResponse<unknown>>;
+declare function createSupabaseAuthMiddleware(options?: SupabaseAuthMiddlewareOptions): (request: NextRequest) => Promise<Response>;
 
-export { type AuthMiddlewareOptions, type SupabaseAuthMiddlewareOptions, createAuthMiddleware, createSupabaseAuthMiddleware };
+export { type Auth0AuthMiddlewareOptions, type AuthMiddlewareOptions, type SupabaseAuthMiddlewareOptions, createAuth0AuthMiddleware, createAuthMiddleware, createSupabaseAuthMiddleware };

package/dist/middleware.d.ts

@@ -1,11 +1,12 @@
-import { NextRequest, NextResponse } from 'next/server';
+import { NextRequest } from 'next/server';
 import { AuthAdapter } from '@solvapay/auth';
+import { Auth0ClientLike } from '@solvapay/auth/auth0';
 
 /**
  * Next.js Middleware Helpers
  *
  * Helpers for creating authentication middleware in Next.js.
- * Works with any AuthAdapter implementation (Supabase, custom, etc.)
+ * Works with any AuthAdapter implementation (Supabase, Auth0, custom, etc.)
  */
 
 /**
@@ -23,156 +24,65 @@ interface AuthMiddlewareOptions {
      */
     publicRoutes?: string[];
     /**
-     * Header name to store the user ID (default: 'x-user-id')
+     * Header name to store the user ID (default: `x-user-id`)
      */
     userIdHeader?: string;
+    /**
+     * When true, process all matched routes (not only `/api/*`).
+     * Use with session-based adapters (Auth0) that refresh cookies on every request.
+     * Default: false (legacy Supabase API-only behaviour).
+     */
+    processAllRoutes?: boolean;
+    /**
+     * When `processAllRoutes` is true, only enforce 401 on paths starting with this prefix.
+     * Default: `/api`
+     */
+    protectedRoutePrefix?: string;
 }
 /**
  * Creates a Next.js middleware function for authentication
- *
- * This helper:
- * 1. Uses the provided AuthAdapter to extract userId from requests
- * 2. Handles public vs protected routes
- * 3. Adds userId to request headers for downstream routes
- * 4. Returns appropriate error responses for auth failures
- *
- * @param options - Configuration options
- * @returns Next.js middleware function (can be exported as `middleware` or `proxy`)
- *
- * @example Next.js 15
- * ```typescript
- * // middleware.ts (at project root)
- * import { createAuthMiddleware } from '@solvapay/next';
- * import { SupabaseAuthAdapter } from '@solvapay/auth/supabase';
- *
- * const adapter = new SupabaseAuthAdapter({
- *   jwtSecret: process.env.SUPABASE_JWT_SECRET!,
- * });
- *
- * export const middleware = createAuthMiddleware({
- *   adapter,
- *   publicRoutes: ['/api/list-plans'],
- * });
- *
- * export const config = {
- *   matcher: ['/api/:path*'],
- * };
- * ```
- *
- * @example Next.js 16 with src/ folder
- * ```typescript
- * // src/proxy.ts (in src/ folder, not project root)
- * import { createAuthMiddleware } from '@solvapay/next';
- * import { SupabaseAuthAdapter } from '@solvapay/auth/supabase';
- *
- * const adapter = new SupabaseAuthAdapter({
- *   jwtSecret: process.env.SUPABASE_JWT_SECRET!,
- * });
- *
- * // Use 'proxy' export for Next.js 16 (no deprecation warning)
- * export const proxy = createAuthMiddleware({
- *   adapter,
- *   publicRoutes: ['/api/list-plans'],
- * });
- *
- * export const config = {
- *   matcher: ['/api/:path*'],
- * };
- * ```
- *
- * @example Custom adapter
- * ```typescript
- * import { createAuthMiddleware } from '@solvapay/next';
- * import type { AuthAdapter } from '@solvapay/auth';
- *
- * const myAdapter: AuthAdapter = {
- *   async getUserIdFromRequest(req) {
- *     // Your custom auth logic
- *     return userId;
- *   },
- * };
- *
- * export const middleware = createAuthMiddleware({
- *   adapter: myAdapter,
- * });
- * ```
- *
- * **File Location Notes:**
- * - **Next.js 15**: Place `middleware.ts` at project root
- * - **Next.js 16 without `src/` folder**: Place `middleware.ts` or `proxy.ts` at project root
- * - **Next.js 16 with `src/` folder**: Place `src/proxy.ts` or `src/middleware.ts` (in `src/` folder, not root)
- *
- * **Note:** Next.js 16 renamed "middleware" to "proxy". You can export the return value as either
- * `middleware` or `proxy` - both work, but `proxy` is recommended to avoid deprecation warnings.
  */
-declare function createAuthMiddleware(options: AuthMiddlewareOptions): (request: NextRequest) => Promise<NextResponse<unknown>>;
+declare function createAuthMiddleware(options: AuthMiddlewareOptions): (request: NextRequest) => Promise<Response>;
 /**
- * Configuration options for Supabase authentication middleware
+ * Configuration options for Auth0 authentication middleware
  */
-interface SupabaseAuthMiddlewareOptions {
+interface Auth0AuthMiddlewareOptions {
     /**
-     * Supabase JWT secret (from Supabase dashboard: Settings → API → JWT Secret)
-     * If not provided, will use SUPABASE_JWT_SECRET environment variable
+     * Auth0 client instance used by the adapter.
      */
-    jwtSecret?: string;
+    auth0: Auth0ClientLike;
     /**
-     * Public routes that don't require authentication
-     * Routes are matched using pathname.startsWith()
+     * Public routes that don't require authentication.
      */
     publicRoutes?: string[];
     /**
-     * Header name to store the user ID (default: 'x-user-id')
+     * Route prefix owned by Auth0 (default: `/auth`).
      */
+    authRoutePrefix?: string;
+    /**
+     * Header name to store the user ID (default: `x-user-id`)
+     */
+    userIdHeader?: string;
+    /**
+     * Route prefix that enforces 401 when unauthenticated (default: `/api`)
+     */
+    protectedRoutePrefix?: string;
+}
+/**
+ * Creates a Next.js middleware function for Auth0 authentication.
+ */
+declare function createAuth0AuthMiddleware(options: Auth0AuthMiddlewareOptions): (request: NextRequest) => Promise<Response>;
+/**
+ * Configuration options for Supabase authentication middleware
+ */
+interface SupabaseAuthMiddlewareOptions {
+    jwtSecret?: string;
+    publicRoutes?: string[];
     userIdHeader?: string;
 }
 /**
  * Creates a Next.js middleware function for Supabase authentication
- *
- * Convenience function that creates a SupabaseAuthAdapter and wraps it with createAuthMiddleware.
- * Only use this if you're using Supabase - otherwise use createAuthMiddleware with your own adapter.
- *
- * Uses dynamic import to avoid requiring Supabase as a dependency in @solvapay/next.
- *
- * @param options - Configuration options
- * @returns Next.js middleware function (can be exported as `middleware` or `proxy`)
- *
- * @example Next.js 15
- * ```typescript
- * // middleware.ts (at project root)
- * import { createSupabaseAuthMiddleware } from '@solvapay/next';
- *
- * export const middleware = createSupabaseAuthMiddleware({
- *   publicRoutes: ['/api/list-plans'],
- * });
- *
- * export const config = {
- *   matcher: ['/api/:path*'],
- * };
- * ```
- *
- * @example Next.js 16 with src/ folder
- * ```typescript
- * // src/proxy.ts (in src/ folder, not project root)
- * import { createSupabaseAuthMiddleware } from '@solvapay/next';
- *
- * // Use 'proxy' export for Next.js 16 (no deprecation warning)
- * export const proxy = createSupabaseAuthMiddleware({
- *   publicRoutes: ['/api/list-plans'],
- * });
- *
- * export const config = {
- *   matcher: ['/api/:path*'],
- * };
- * ```
- *
- * **File Location Notes:**
- * - **Next.js 15**: Place `middleware.ts` at project root
- * - **Next.js 16 without `src/` folder**: Place `middleware.ts` or `proxy.ts` at project root
- * - **Next.js 16 with `src/` folder**: Place `src/proxy.ts` or `src/middleware.ts` (in `src/` folder, not root)
- *
- * **Note:** Next.js 16 renamed "middleware" to "proxy". You can export the return value as either
- * `middleware` or `proxy` - both work, but `proxy` is recommended to avoid deprecation warnings.
  */
-declare function createSupabaseAuthMiddleware(options?: SupabaseAuthMiddlewareOptions): (request: NextRequest) => Promise<NextResponse<unknown>>;
+declare function createSupabaseAuthMiddleware(options?: SupabaseAuthMiddlewareOptions): (request: NextRequest) => Promise<Response>;
 
-export { type AuthMiddlewareOptions, type SupabaseAuthMiddlewareOptions, createAuthMiddleware, createSupabaseAuthMiddleware };
+export { type Auth0AuthMiddlewareOptions, type AuthMiddlewareOptions, type SupabaseAuthMiddlewareOptions, createAuth0AuthMiddleware, createAuthMiddleware, createSupabaseAuthMiddleware };

package/dist/middleware.js

@@ -1,8 +1,10 @@
 import {
+  createAuth0AuthMiddleware,
   createAuthMiddleware,
   createSupabaseAuthMiddleware
-} from "./chunk-F7TBIH6W.js";
+} from "./chunk-WSXIXEUB.js";
 export {
+  createAuth0AuthMiddleware,
   createAuthMiddleware,
   createSupabaseAuthMiddleware
 };

package/package.json

@@ -1,6 +1,6 @@
 {
   "name": "@solvapay/next",
-  "version": "1.1.0",
+  "version": "1.2.0-preview-e89fa52f99b6d0c7bf9834fcf2d1403141051fa0",
   "type": "module",
   "main": "./dist/index.cjs",
   "module": "./dist/index.js",
@@ -34,9 +34,9 @@
   },
   "sideEffects": false,
   "dependencies": {
-    "@solvapay/auth": "1.0.8",
+    "@solvapay/auth": "1.1.0-preview-e89fa52f99b6d0c7bf9834fcf2d1403141051fa0",
     "@solvapay/core": "1.0.9",
-    "@solvapay/server": "1.2.0"
+    "@solvapay/server": "1.2.1-preview-e89fa52f99b6d0c7bf9834fcf2d1403141051fa0"
   },
   "peerDependencies": {
     "next": ">=13.0.0"
@@ -50,7 +50,7 @@
   },
   "scripts": {
     "build": "tsup src/index.ts src/middleware.ts --format esm,cjs --dts --tsconfig tsconfig.build.json --external next",
-    "test": "vitest run || exit 0",
+    "test": "vitest run",
     "test:watch": "vitest",
     "lint": "eslint src",
     "lint:fix": "eslint src --fix"

package/dist/chunk-F7TBIH6W.js

@@ -1,74 +0,0 @@
-// src/helpers/middleware.ts
-import { NextResponse } from "next/server";
-function createAuthMiddleware(options) {
-  const { adapter, publicRoutes = [], userIdHeader = "x-user-id" } = options;
-  return async function middleware(request) {
-    const req = request;
-    const { pathname } = req.nextUrl;
-    if (!pathname.startsWith("/api")) {
-      return NextResponse.next();
-    }
-    const isPublicRoute = publicRoutes.some((route) => pathname.startsWith(route));
-    const userId = await adapter.getUserIdFromRequest(req);
-    if (isPublicRoute) {
-      const requestHeaders2 = new Headers(req.headers);
-      if (userId) {
-        requestHeaders2.set(userIdHeader, userId);
-      }
-      return NextResponse.next({
-        request: {
-          headers: requestHeaders2
-        }
-      });
-    }
-    if (!userId) {
-      return NextResponse.json(
-        { error: "Unauthorized", details: "Valid authentication required" },
-        { status: 401 }
-      );
-    }
-    const requestHeaders = new Headers(req.headers);
-    requestHeaders.set(userIdHeader, userId);
-    return NextResponse.next({
-      request: {
-        headers: requestHeaders
-      }
-    });
-  };
-}
-function createSupabaseAuthMiddleware(options = {}) {
-  const { jwtSecret, publicRoutes = [], userIdHeader = "x-user-id" } = options;
-  let authAdapter = null;
-  let adapterPromise = null;
-  const lazyAdapter = {
-    async getUserIdFromRequest(req) {
-      if (!authAdapter) {
-        if (!adapterPromise) {
-          adapterPromise = (async () => {
-            const secret = jwtSecret || process.env.SUPABASE_JWT_SECRET;
-            if (!secret) {
-              throw new Error(
-                "SUPABASE_JWT_SECRET environment variable is required. Please set it in your .env.local file. Get it from: Supabase Dashboard \u2192 Settings \u2192 API \u2192 JWT Secret"
-              );
-            }
-            const { SupabaseAuthAdapter } = await import("@solvapay/auth/supabase");
-            authAdapter = new SupabaseAuthAdapter({ jwtSecret: secret });
-            return authAdapter;
-          })();
-        }
-        authAdapter = await adapterPromise;
-      }
-      return authAdapter.getUserIdFromRequest(req);
-    }
-  };
-  return createAuthMiddleware({
-    adapter: lazyAdapter,
-    publicRoutes,
-    userIdHeader
-  });
-}
-
-export {
-  createAuthMiddleware,
-  createSupabaseAuthMiddleware
-};