@stackwright-pro/auth-nextjs 0.1.0 → 0.1.1-alpha.1

package/dist/index.d.mts

@@ -1,6 +1,6 @@
 import { NextRequest, NextResponse } from 'next/server';
 import { AuthConfig, SessionManager, RBACEngine, AuthSession, CookieOptions } from '@stackwright-pro/auth';
-export { AuthConfig, AuthSession, AuthUser } from '@stackwright-pro/auth';
+export { AuthConfig, AuthContext, AuthContextValue, AuthProvider, AuthProviderProps, AuthSession, AuthUser, RBACEngine, useAuth, useRequireAuth } from '@stackwright-pro/auth';
 import { NextApiRequest, NextApiResponse } from 'next';
 
 interface MiddlewareConfig {
@@ -67,6 +67,12 @@ interface ProtectedRouteConfig {
      * Cookie name (default: 'stackwright_session')
      */
     cookieName?: string;
+    /**
+     * Optional RBAC engine for wildcard-aware role/permission checking.
+     * When provided, authorization decisions use RBACEngine (consistent
+     * with middleware). Without it, falls back to direct array checks.
+     */
+    rbacEngine?: RBACEngine;
 }
 /**
  * Handler function with authenticated session

package/dist/index.d.ts

@@ -1,6 +1,6 @@
 import { NextRequest, NextResponse } from 'next/server';
 import { AuthConfig, SessionManager, RBACEngine, AuthSession, CookieOptions } from '@stackwright-pro/auth';
-export { AuthConfig, AuthSession, AuthUser } from '@stackwright-pro/auth';
+export { AuthConfig, AuthContext, AuthContextValue, AuthProvider, AuthProviderProps, AuthSession, AuthUser, RBACEngine, useAuth, useRequireAuth } from '@stackwright-pro/auth';
 import { NextApiRequest, NextApiResponse } from 'next';
 
 interface MiddlewareConfig {
@@ -67,6 +67,12 @@ interface ProtectedRouteConfig {
      * Cookie name (default: 'stackwright_session')
      */
     cookieName?: string;
+    /**
+     * Optional RBAC engine for wildcard-aware role/permission checking.
+     * When provided, authorization decisions use RBACEngine (consistent
+     * with middleware). Without it, falls back to direct array checks.
+     */
+    rbacEngine?: RBACEngine;
 }
 /**
  * Handler function with authenticated session

package/dist/index.js

@@ -20,10 +20,15 @@ var __toCommonJS = (mod) => __copyProps(__defProp({}, "__esModule", { value: tru
 // src/index.ts
 var index_exports = {};
 __export(index_exports, {
+  AuthContext: () => import_auth3.AuthContext,
+  AuthProvider: () => import_auth3.AuthProvider,
+  RBACEngine: () => import_auth2.RBACEngine,
   clearSessionCookie: () => clearSessionCookie,
   createAuthMiddleware: () => createAuthMiddleware,
   protectedRoute: () => protectedRoute,
-  setSessionCookie: () => setSessionCookie
+  setSessionCookie: () => setSessionCookie,
+  useAuth: () => import_auth3.useAuth,
+  useRequireAuth: () => import_auth3.useRequireAuth
 });
 module.exports = __toCommonJS(index_exports);
 
@@ -64,7 +69,7 @@ function createAuthMiddleware(config) {
       const response = import_server.NextResponse.next();
       response.cookies.set(cookieName, newJwt, {
         httpOnly: true,
-        secure: process.env.NODE_ENV === "production",
+        secure: true,
         sameSite: "lax",
         maxAge: 900
         // 15 minutes
@@ -77,12 +82,7 @@ function createAuthMiddleware(config) {
 
 // src/api-helpers.ts
 function protectedRoute(handler, config) {
-  const {
-    sessionManager,
-    roles,
-    permissions,
-    cookieName = "stackwright_session"
-  } = config;
+  const { sessionManager, roles, permissions, cookieName = "stackwright_session" } = config;
   return async (req, res) => {
     const sessionCookie = req.cookies[cookieName];
     if (!sessionCookie) {
@@ -95,19 +95,33 @@ function protectedRoute(handler, config) {
       return;
     }
     if (roles && roles.length > 0) {
-      const hasRole = roles.some((role) => session.user.roles.includes(role));
-      if (!hasRole) {
-        res.status(403).json({ error: "Insufficient permissions" });
-        return;
+      if (config.rbacEngine) {
+        if (!config.rbacEngine.hasAnyRole(session.user, roles)) {
+          res.status(403).json({ error: "Insufficient permissions" });
+          return;
+        }
+      } else {
+        const hasRole = roles.some((role) => session.user.roles.includes(role));
+        if (!hasRole) {
+          res.status(403).json({ error: "Insufficient permissions" });
+          return;
+        }
       }
     }
     if (permissions && permissions.length > 0) {
-      const hasAllPermissions = permissions.every(
-        (permission) => session.user.permissions?.includes(permission)
-      );
-      if (!hasAllPermissions) {
-        res.status(403).json({ error: "Insufficient permissions" });
-        return;
+      if (config.rbacEngine) {
+        if (!config.rbacEngine.hasAllPermissions(session.user, permissions)) {
+          res.status(403).json({ error: "Insufficient permissions" });
+          return;
+        }
+      } else {
+        const hasAllPermissions = permissions.every(
+          (permission) => session.user.permissions?.includes(permission)
+        );
+        if (!hasAllPermissions) {
+          res.status(403).json({ error: "Insufficient permissions" });
+          return;
+        }
       }
     }
     await handler(req, res, session);
@@ -123,7 +137,7 @@ function setSessionCookie(res, sessionJwt, options = {}) {
     ...options,
     maxAge,
     httpOnly: true,
-    secure: process.env.NODE_ENV === "production",
+    secure: true,
     sameSite: "lax"
   });
   res.setHeader("Set-Cookie", cookie);
@@ -133,11 +147,20 @@ function clearSessionCookie(res, options = {}) {
   const cookie = (0, import_auth.clearCookie)(cookieName, options);
   res.setHeader("Set-Cookie", cookie);
 }
+
+// src/index.ts
+var import_auth2 = require("@stackwright-pro/auth");
+var import_auth3 = require("@stackwright-pro/auth");
 // Annotate the CommonJS export names for ESM import in node:
 0 && (module.exports = {
+  AuthContext,
+  AuthProvider,
+  RBACEngine,
   clearSessionCookie,
   createAuthMiddleware,
   protectedRoute,
-  setSessionCookie
+  setSessionCookie,
+  useAuth,
+  useRequireAuth
 });
 //# sourceMappingURL=index.js.map

package/dist/index.js.map

@@ -1 +1 @@
-{"version":3,"sources":["../src/index.ts","../src/middleware.ts","../src/api-helpers.ts","../src/cookie-utils.ts"],"sourcesContent":["export { createAuthMiddleware, type MiddlewareConfig } from './middleware.js';\nexport { \n  protectedRoute, \n  type ProtectedRouteConfig, \n  type AuthenticatedHandler \n} from './api-helpers.js';\nexport { setSessionCookie, clearSessionCookie } from './cookie-utils.js';\n\n// Re-export commonly used types from core\nexport type { \n  AuthUser, \n  AuthSession, \n  AuthConfig \n} from '@stackwright-pro/auth';\n","import { type NextRequest, NextResponse } from 'next/server';\nimport { SessionManager, RBACEngine, type AuthConfig, type AuthSession } from '@stackwright-pro/auth';\n\nexport interface MiddlewareConfig {\n  /**\n   * Auth configuration\n   */\n  authConfig: AuthConfig;\n  \n  /**\n   * Session manager instance\n   */\n  sessionManager: SessionManager;\n  \n  /**\n   * RBAC engine instance\n   */\n  rbacEngine: RBACEngine;\n  \n  /**\n   * Cookie name for session (default: 'stackwright_session')\n   */\n  cookieName?: string;\n  \n  /**\n   * URL to redirect to when authentication fails (default: '/login')\n   */\n  loginUrl?: string;\n  \n  /**\n   * URL to redirect to when authorization fails (default: '/unauthorized')\n   */\n  unauthorizedUrl?: string;\n}\n\n/**\n * Create Next.js middleware for authentication and authorization\n * \n * @example\n * ```typescript\n * // middleware.ts\n * import { createAuthMiddleware } from '@stackwright-pro/auth-nextjs';\n * \n * export default createAuthMiddleware({\n *   authConfig,\n *   sessionManager,\n *   rbacEngine,\n * });\n * \n * export const config = {\n *   matcher: ['/((?!_next|api/auth).*)'],\n * };\n * ```\n */\nexport function createAuthMiddleware(config: MiddlewareConfig) {\n  const {\n    sessionManager,\n    rbacEngine,\n    cookieName = 'stackwright_session',\n    loginUrl = '/login',\n    unauthorizedUrl = '/unauthorized',\n  } = config;\n  \n  return async function authMiddleware(\n    request: NextRequest\n  ): Promise<NextResponse | undefined> {\n    const { pathname } = request.nextUrl;\n    \n    // Check if route is public\n    if (rbacEngine.isPublicRoute(pathname)) {\n      return undefined; // Continue to next middleware\n    }\n    \n    // Extract session from cookie\n    const sessionCookie = request.cookies.get(cookieName);\n    let session: AuthSession | null = null;\n    \n    if (sessionCookie) {\n      session = await sessionManager.deserialize(sessionCookie.value);\n    }\n    \n    // Check if session is valid\n    if (!session || sessionManager.isExpired(session)) {\n      // Redirect to login\n      const url = request.nextUrl.clone();\n      url.pathname = loginUrl;\n      url.searchParams.set('redirect', pathname);\n      return NextResponse.redirect(url);\n    }\n    \n    // Check if user can access route\n    if (!rbacEngine.canAccessRoute(session.user, pathname)) {\n      // Redirect to unauthorized\n      const url = request.nextUrl.clone();\n      url.pathname = unauthorizedUrl;\n      return NextResponse.redirect(url);\n    }\n    \n    // Refresh session if needed\n    if (sessionManager.shouldRefresh(session)) {\n      const refreshed = await sessionManager.refreshSession(session);\n      const newJwt = await sessionManager.serialize(refreshed);\n      \n      const response = NextResponse.next();\n      response.cookies.set(cookieName, newJwt, {\n        httpOnly: true,\n        secure: process.env.NODE_ENV === 'production',\n        sameSite: 'lax',\n        maxAge: 900, // 15 minutes\n      });\n      \n      return response;\n    }\n    \n    // Allow request to continue\n    return undefined;\n  };\n}\n","import type { NextApiRequest, NextApiResponse } from 'next';\nimport { SessionManager, type AuthSession, type AuthUser } from '@stackwright-pro/auth';\n\nexport interface ProtectedRouteConfig {\n  /**\n   * Session manager for validating sessions\n   */\n  sessionManager: SessionManager;\n  \n  /**\n   * Required roles (user must have ANY of these)\n   */\n  roles?: string[];\n  \n  /**\n   * Required permissions (user must have ALL of these)\n   */\n  permissions?: string[];\n  \n  /**\n   * Cookie name (default: 'stackwright_session')\n   */\n  cookieName?: string;\n}\n\n/**\n * Handler function with authenticated session\n */\nexport type AuthenticatedHandler<T = any> = (\n  req: NextApiRequest,\n  res: NextApiResponse<T>,\n  session: AuthSession\n) => void | Promise<void>;\n\n/**\n * Wrap API route with authentication/authorization\n * \n * @example\n * ```typescript\n * // pages/api/equipment/[id].ts\n * export default protectedRoute(\n *   async (req, res, session) => {\n *     const equipment = await getEquipment(req.query.id);\n *     res.json(equipment);\n *   },\n *   {\n *     sessionManager,\n *     roles: ['ANALYST', 'ADMIN'],\n *   }\n * );\n * ```\n */\nexport function protectedRoute<T = any>(\n  handler: AuthenticatedHandler<T>,\n  config: ProtectedRouteConfig\n): (req: NextApiRequest, res: NextApiResponse) => Promise<void> {\n  const {\n    sessionManager,\n    roles,\n    permissions,\n    cookieName = 'stackwright_session',\n  } = config;\n  \n  return async (req: NextApiRequest, res: NextApiResponse) => {\n    // Extract session from cookie\n    const sessionCookie = req.cookies[cookieName];\n    \n    if (!sessionCookie) {\n      res.status(401).json({ error: 'Not authenticated' } as any);\n      return;\n    }\n    \n    // Verify session\n    const session = await sessionManager.deserialize(sessionCookie);\n    \n    if (!session || sessionManager.isExpired(session)) {\n      res.status(401).json({ error: 'Session expired' } as any);\n      return;\n    }\n    \n    // Check roles\n    if (roles && roles.length > 0) {\n      const hasRole = roles.some(role => session.user.roles.includes(role));\n      if (!hasRole) {\n        res.status(403).json({ error: 'Insufficient permissions' } as any);\n        return;\n      }\n    }\n    \n    // Check permissions\n    if (permissions && permissions.length > 0) {\n      const hasAllPermissions = permissions.every(permission =>\n        session.user.permissions?.includes(permission)\n      );\n      if (!hasAllPermissions) {\n        res.status(403).json({ error: 'Insufficient permissions' } as any);\n        return;\n      }\n    }\n    \n    // Call handler with session\n    await handler(req, res, session);\n  };\n}\n","import type { NextApiResponse } from 'next';\nimport { serializeCookie, clearCookie, type CookieOptions } from '@stackwright-pro/auth';\n\n/**\n * Set session cookie in Next.js API response\n */\nexport function setSessionCookie(\n  res: NextApiResponse,\n  sessionJwt: string,\n  options: CookieOptions = {}\n): void {\n  const cookieName = options.name || 'stackwright_session';\n  const maxAge = options.maxAge || 900; // 15 minutes default\n  \n  const cookie = serializeCookie(cookieName, sessionJwt, {\n    ...options,\n    maxAge,\n    httpOnly: true,\n    secure: process.env.NODE_ENV === 'production',\n    sameSite: 'lax',\n  });\n  \n  res.setHeader('Set-Cookie', cookie);\n}\n\n/**\n * Clear session cookie in Next.js API response\n */\nexport function clearSessionCookie(\n  res: NextApiResponse,\n  options: Pick<CookieOptions, 'name' | 'domain' | 'path'> = {}\n): void {\n  const cookieName = options.name || 'stackwright_session';\n  \n  const cookie = clearCookie(cookieName, options);\n  \n  res.setHeader('Set-Cookie', cookie);\n}\n"],"mappings":";;;;;;;;;;;;;;;;;;;;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;;;ACAA,oBAA+C;AAsDxC,SAAS,qBAAqB,QAA0B;AAC7D,QAAM;AAAA,IACJ;AAAA,IACA;AAAA,IACA,aAAa;AAAA,IACb,WAAW;AAAA,IACX,kBAAkB;AAAA,EACpB,IAAI;AAEJ,SAAO,eAAe,eACpB,SACmC;AACnC,UAAM,EAAE,SAAS,IAAI,QAAQ;AAG7B,QAAI,WAAW,cAAc,QAAQ,GAAG;AACtC,aAAO;AAAA,IACT;AAGA,UAAM,gBAAgB,QAAQ,QAAQ,IAAI,UAAU;AACpD,QAAI,UAA8B;AAElC,QAAI,eAAe;AACjB,gBAAU,MAAM,eAAe,YAAY,cAAc,KAAK;AAAA,IAChE;AAGA,QAAI,CAAC,WAAW,eAAe,UAAU,OAAO,GAAG;AAEjD,YAAM,MAAM,QAAQ,QAAQ,MAAM;AAClC,UAAI,WAAW;AACf,UAAI,aAAa,IAAI,YAAY,QAAQ;AACzC,aAAO,2BAAa,SAAS,GAAG;AAAA,IAClC;AAGA,QAAI,CAAC,WAAW,eAAe,QAAQ,MAAM,QAAQ,GAAG;AAEtD,YAAM,MAAM,QAAQ,QAAQ,MAAM;AAClC,UAAI,WAAW;AACf,aAAO,2BAAa,SAAS,GAAG;AAAA,IAClC;AAGA,QAAI,eAAe,cAAc,OAAO,GAAG;AACzC,YAAM,YAAY,MAAM,eAAe,eAAe,OAAO;AAC7D,YAAM,SAAS,MAAM,eAAe,UAAU,SAAS;AAEvD,YAAM,WAAW,2BAAa,KAAK;AACnC,eAAS,QAAQ,IAAI,YAAY,QAAQ;AAAA,QACvC,UAAU;AAAA,QACV,QAAQ,QAAQ,IAAI,aAAa;AAAA,QACjC,UAAU;AAAA,QACV,QAAQ;AAAA;AAAA,MACV,CAAC;AAED,aAAO;AAAA,IACT;AAGA,WAAO;AAAA,EACT;AACF;;;ACjEO,SAAS,eACd,SACA,QAC8D;AAC9D,QAAM;AAAA,IACJ;AAAA,IACA;AAAA,IACA;AAAA,IACA,aAAa;AAAA,EACf,IAAI;AAEJ,SAAO,OAAO,KAAqB,QAAyB;AAE1D,UAAM,gBAAgB,IAAI,QAAQ,UAAU;AAE5C,QAAI,CAAC,eAAe;AAClB,UAAI,OAAO,GAAG,EAAE,KAAK,EAAE,OAAO,oBAAoB,CAAQ;AAC1D;AAAA,IACF;AAGA,UAAM,UAAU,MAAM,eAAe,YAAY,aAAa;AAE9D,QAAI,CAAC,WAAW,eAAe,UAAU,OAAO,GAAG;AACjD,UAAI,OAAO,GAAG,EAAE,KAAK,EAAE,OAAO,kBAAkB,CAAQ;AACxD;AAAA,IACF;AAGA,QAAI,SAAS,MAAM,SAAS,GAAG;AAC7B,YAAM,UAAU,MAAM,KAAK,UAAQ,QAAQ,KAAK,MAAM,SAAS,IAAI,CAAC;AACpE,UAAI,CAAC,SAAS;AACZ,YAAI,OAAO,GAAG,EAAE,KAAK,EAAE,OAAO,2BAA2B,CAAQ;AACjE;AAAA,MACF;AAAA,IACF;AAGA,QAAI,eAAe,YAAY,SAAS,GAAG;AACzC,YAAM,oBAAoB,YAAY;AAAA,QAAM,gBAC1C,QAAQ,KAAK,aAAa,SAAS,UAAU;AAAA,MAC/C;AACA,UAAI,CAAC,mBAAmB;AACtB,YAAI,OAAO,GAAG,EAAE,KAAK,EAAE,OAAO,2BAA2B,CAAQ;AACjE;AAAA,MACF;AAAA,IACF;AAGA,UAAM,QAAQ,KAAK,KAAK,OAAO;AAAA,EACjC;AACF;;;ACtGA,kBAAiE;AAK1D,SAAS,iBACd,KACA,YACA,UAAyB,CAAC,GACpB;AACN,QAAM,aAAa,QAAQ,QAAQ;AACnC,QAAM,SAAS,QAAQ,UAAU;AAEjC,QAAM,aAAS,6BAAgB,YAAY,YAAY;AAAA,IACrD,GAAG;AAAA,IACH;AAAA,IACA,UAAU;AAAA,IACV,QAAQ,QAAQ,IAAI,aAAa;AAAA,IACjC,UAAU;AAAA,EACZ,CAAC;AAED,MAAI,UAAU,cAAc,MAAM;AACpC;AAKO,SAAS,mBACd,KACA,UAA2D,CAAC,GACtD;AACN,QAAM,aAAa,QAAQ,QAAQ;AAEnC,QAAM,aAAS,yBAAY,YAAY,OAAO;AAE9C,MAAI,UAAU,cAAc,MAAM;AACpC;","names":[]}
+{"version":3,"sources":["../src/index.ts","../src/middleware.ts","../src/api-helpers.ts","../src/cookie-utils.ts"],"sourcesContent":["export { createAuthMiddleware, type MiddlewareConfig } from './middleware.js';\nexport {\n  protectedRoute,\n  type ProtectedRouteConfig,\n  type AuthenticatedHandler,\n} from './api-helpers.js';\nexport { setSessionCookie, clearSessionCookie } from './cookie-utils.js';\n\n// Re-export commonly used types/classes from core\nexport type { AuthUser, AuthSession, AuthConfig } from '@stackwright-pro/auth';\n\n// Re-export RBAC engine\nexport { RBACEngine } from '@stackwright-pro/auth';\n\n// Re-export React context components for Next.js apps\nexport { AuthProvider, AuthContext, useAuth, useRequireAuth } from '@stackwright-pro/auth';\nexport type { AuthProviderProps, AuthContextValue } from '@stackwright-pro/auth';\n","import { type NextRequest, NextResponse } from 'next/server';\nimport {\n  SessionManager,\n  RBACEngine,\n  type AuthConfig,\n  type AuthSession,\n} from '@stackwright-pro/auth';\n\nexport interface MiddlewareConfig {\n  /**\n   * Auth configuration\n   */\n  authConfig: AuthConfig;\n\n  /**\n   * Session manager instance\n   */\n  sessionManager: SessionManager;\n\n  /**\n   * RBAC engine instance\n   */\n  rbacEngine: RBACEngine;\n\n  /**\n   * Cookie name for session (default: 'stackwright_session')\n   */\n  cookieName?: string;\n\n  /**\n   * URL to redirect to when authentication fails (default: '/login')\n   */\n  loginUrl?: string;\n\n  /**\n   * URL to redirect to when authorization fails (default: '/unauthorized')\n   */\n  unauthorizedUrl?: string;\n}\n\n/**\n * Create Next.js middleware for authentication and authorization\n *\n * @example\n * ```typescript\n * // middleware.ts\n * import { createAuthMiddleware } from '@stackwright-pro/auth-nextjs';\n *\n * export default createAuthMiddleware({\n *   authConfig,\n *   sessionManager,\n *   rbacEngine,\n * });\n *\n * export const config = {\n *   matcher: ['/((?!_next|api/auth).*)'],\n * };\n * ```\n */\nexport function createAuthMiddleware(config: MiddlewareConfig) {\n  const {\n    sessionManager,\n    rbacEngine,\n    cookieName = 'stackwright_session',\n    loginUrl = '/login',\n    unauthorizedUrl = '/unauthorized',\n  } = config;\n\n  return async function authMiddleware(request: NextRequest): Promise<NextResponse | undefined> {\n    const { pathname } = request.nextUrl;\n\n    // Check if route is public\n    if (rbacEngine.isPublicRoute(pathname)) {\n      return undefined; // Continue to next middleware\n    }\n\n    // Extract session from cookie\n    const sessionCookie = request.cookies.get(cookieName);\n    let session: AuthSession | null = null;\n\n    if (sessionCookie) {\n      session = await sessionManager.deserialize(sessionCookie.value);\n    }\n\n    // Check if session is valid\n    if (!session || sessionManager.isExpired(session)) {\n      // Redirect to login\n      const url = request.nextUrl.clone();\n      url.pathname = loginUrl;\n      url.searchParams.set('redirect', pathname);\n      return NextResponse.redirect(url);\n    }\n\n    // Check if user can access route\n    if (!rbacEngine.canAccessRoute(session.user, pathname)) {\n      // Redirect to unauthorized\n      const url = request.nextUrl.clone();\n      url.pathname = unauthorizedUrl;\n      return NextResponse.redirect(url);\n    }\n\n    // Refresh session if needed\n    if (sessionManager.shouldRefresh(session)) {\n      const refreshed = await sessionManager.refreshSession(session);\n      const newJwt = await sessionManager.serialize(refreshed);\n\n      const response = NextResponse.next();\n      response.cookies.set(cookieName, newJwt, {\n        httpOnly: true,\n        secure: true,\n        sameSite: 'lax',\n        maxAge: 900, // 15 minutes\n      });\n\n      return response;\n    }\n\n    // Allow request to continue\n    return undefined;\n  };\n}\n","import type { NextApiRequest, NextApiResponse } from 'next';\nimport { SessionManager, RBACEngine, type AuthSession, type AuthUser } from '@stackwright-pro/auth';\n\nexport interface ProtectedRouteConfig {\n  /**\n   * Session manager for validating sessions\n   */\n  sessionManager: SessionManager;\n\n  /**\n   * Required roles (user must have ANY of these)\n   */\n  roles?: string[];\n\n  /**\n   * Required permissions (user must have ALL of these)\n   */\n  permissions?: string[];\n\n  /**\n   * Cookie name (default: 'stackwright_session')\n   */\n  cookieName?: string;\n\n  /**\n   * Optional RBAC engine for wildcard-aware role/permission checking.\n   * When provided, authorization decisions use RBACEngine (consistent\n   * with middleware). Without it, falls back to direct array checks.\n   */\n  rbacEngine?: RBACEngine;\n}\n\n/**\n * Handler function with authenticated session\n */\nexport type AuthenticatedHandler<T = any> = (\n  req: NextApiRequest,\n  res: NextApiResponse<T>,\n  session: AuthSession\n) => void | Promise<void>;\n\n/**\n * Wrap API route with authentication/authorization\n *\n * @example\n * ```typescript\n * // pages/api/equipment/[id].ts\n * export default protectedRoute(\n *   async (req, res, session) => {\n *     const equipment = await getEquipment(req.query.id);\n *     res.json(equipment);\n *   },\n *   {\n *     sessionManager,\n *     roles: ['ANALYST', 'ADMIN'],\n *   }\n * );\n * ```\n */\nexport function protectedRoute<T = any>(\n  handler: AuthenticatedHandler<T>,\n  config: ProtectedRouteConfig\n): (req: NextApiRequest, res: NextApiResponse) => Promise<void> {\n  const { sessionManager, roles, permissions, cookieName = 'stackwright_session' } = config;\n\n  return async (req: NextApiRequest, res: NextApiResponse) => {\n    // Extract session from cookie\n    const sessionCookie = req.cookies[cookieName];\n\n    if (!sessionCookie) {\n      res.status(401).json({ error: 'Not authenticated' } as any);\n      return;\n    }\n\n    // Verify session\n    const session = await sessionManager.deserialize(sessionCookie);\n\n    if (!session || sessionManager.isExpired(session)) {\n      res.status(401).json({ error: 'Session expired' } as any);\n      return;\n    }\n\n    // Check roles\n    if (roles && roles.length > 0) {\n      if (config.rbacEngine) {\n        // Use RBAC engine for consistent wildcard-aware checking\n        if (!config.rbacEngine.hasAnyRole(session.user, roles)) {\n          res.status(403).json({ error: 'Insufficient permissions' } as any);\n          return;\n        }\n      } else {\n        // Fallback: direct check (no wildcard support)\n        const hasRole = roles.some((role) => session.user.roles.includes(role));\n        if (!hasRole) {\n          res.status(403).json({ error: 'Insufficient permissions' } as any);\n          return;\n        }\n      }\n    }\n\n    // Check permissions\n    if (permissions && permissions.length > 0) {\n      if (config.rbacEngine) {\n        // Use RBAC engine for wildcard-aware permission checking\n        if (!config.rbacEngine.hasAllPermissions(session.user, permissions)) {\n          res.status(403).json({ error: 'Insufficient permissions' } as any);\n          return;\n        }\n      } else {\n        // Fallback: direct check (no wildcard support)\n        const hasAllPermissions = permissions.every((permission) =>\n          session.user.permissions?.includes(permission)\n        );\n        if (!hasAllPermissions) {\n          res.status(403).json({ error: 'Insufficient permissions' } as any);\n          return;\n        }\n      }\n    }\n\n    // Call handler with session\n    await handler(req, res, session);\n  };\n}\n","import type { NextApiResponse } from 'next';\nimport { serializeCookie, clearCookie, type CookieOptions } from '@stackwright-pro/auth';\n\n/**\n * Set session cookie in Next.js API response\n */\nexport function setSessionCookie(\n  res: NextApiResponse,\n  sessionJwt: string,\n  options: CookieOptions = {}\n): void {\n  const cookieName = options.name || 'stackwright_session';\n  const maxAge = options.maxAge || 900; // 15 minutes default\n\n  const cookie = serializeCookie(cookieName, sessionJwt, {\n    ...options,\n    maxAge,\n    httpOnly: true,\n    secure: true,\n    sameSite: 'lax',\n  });\n\n  res.setHeader('Set-Cookie', cookie);\n}\n\n/**\n * Clear session cookie in Next.js API response\n */\nexport function clearSessionCookie(\n  res: NextApiResponse,\n  options: Pick<CookieOptions, 'name' | 'domain' | 'path'> = {}\n): void {\n  const cookieName = options.name || 'stackwright_session';\n\n  const cookie = clearCookie(cookieName, options);\n\n  res.setHeader('Set-Cookie', cookie);\n}\n"],"mappings":";;;;;;;;;;;;;;;;;;;;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;;;ACAA,oBAA+C;AA2DxC,SAAS,qBAAqB,QAA0B;AAC7D,QAAM;AAAA,IACJ;AAAA,IACA;AAAA,IACA,aAAa;AAAA,IACb,WAAW;AAAA,IACX,kBAAkB;AAAA,EACpB,IAAI;AAEJ,SAAO,eAAe,eAAe,SAAyD;AAC5F,UAAM,EAAE,SAAS,IAAI,QAAQ;AAG7B,QAAI,WAAW,cAAc,QAAQ,GAAG;AACtC,aAAO;AAAA,IACT;AAGA,UAAM,gBAAgB,QAAQ,QAAQ,IAAI,UAAU;AACpD,QAAI,UAA8B;AAElC,QAAI,eAAe;AACjB,gBAAU,MAAM,eAAe,YAAY,cAAc,KAAK;AAAA,IAChE;AAGA,QAAI,CAAC,WAAW,eAAe,UAAU,OAAO,GAAG;AAEjD,YAAM,MAAM,QAAQ,QAAQ,MAAM;AAClC,UAAI,WAAW;AACf,UAAI,aAAa,IAAI,YAAY,QAAQ;AACzC,aAAO,2BAAa,SAAS,GAAG;AAAA,IAClC;AAGA,QAAI,CAAC,WAAW,eAAe,QAAQ,MAAM,QAAQ,GAAG;AAEtD,YAAM,MAAM,QAAQ,QAAQ,MAAM;AAClC,UAAI,WAAW;AACf,aAAO,2BAAa,SAAS,GAAG;AAAA,IAClC;AAGA,QAAI,eAAe,cAAc,OAAO,GAAG;AACzC,YAAM,YAAY,MAAM,eAAe,eAAe,OAAO;AAC7D,YAAM,SAAS,MAAM,eAAe,UAAU,SAAS;AAEvD,YAAM,WAAW,2BAAa,KAAK;AACnC,eAAS,QAAQ,IAAI,YAAY,QAAQ;AAAA,QACvC,UAAU;AAAA,QACV,QAAQ;AAAA,QACR,UAAU;AAAA,QACV,QAAQ;AAAA;AAAA,MACV,CAAC;AAED,aAAO;AAAA,IACT;AAGA,WAAO;AAAA,EACT;AACF;;;AC7DO,SAAS,eACd,SACA,QAC8D;AAC9D,QAAM,EAAE,gBAAgB,OAAO,aAAa,aAAa,sBAAsB,IAAI;AAEnF,SAAO,OAAO,KAAqB,QAAyB;AAE1D,UAAM,gBAAgB,IAAI,QAAQ,UAAU;AAE5C,QAAI,CAAC,eAAe;AAClB,UAAI,OAAO,GAAG,EAAE,KAAK,EAAE,OAAO,oBAAoB,CAAQ;AAC1D;AAAA,IACF;AAGA,UAAM,UAAU,MAAM,eAAe,YAAY,aAAa;AAE9D,QAAI,CAAC,WAAW,eAAe,UAAU,OAAO,GAAG;AACjD,UAAI,OAAO,GAAG,EAAE,KAAK,EAAE,OAAO,kBAAkB,CAAQ;AACxD;AAAA,IACF;AAGA,QAAI,SAAS,MAAM,SAAS,GAAG;AAC7B,UAAI,OAAO,YAAY;AAErB,YAAI,CAAC,OAAO,WAAW,WAAW,QAAQ,MAAM,KAAK,GAAG;AACtD,cAAI,OAAO,GAAG,EAAE,KAAK,EAAE,OAAO,2BAA2B,CAAQ;AACjE;AAAA,QACF;AAAA,MACF,OAAO;AAEL,cAAM,UAAU,MAAM,KAAK,CAAC,SAAS,QAAQ,KAAK,MAAM,SAAS,IAAI,CAAC;AACtE,YAAI,CAAC,SAAS;AACZ,cAAI,OAAO,GAAG,EAAE,KAAK,EAAE,OAAO,2BAA2B,CAAQ;AACjE;AAAA,QACF;AAAA,MACF;AAAA,IACF;AAGA,QAAI,eAAe,YAAY,SAAS,GAAG;AACzC,UAAI,OAAO,YAAY;AAErB,YAAI,CAAC,OAAO,WAAW,kBAAkB,QAAQ,MAAM,WAAW,GAAG;AACnE,cAAI,OAAO,GAAG,EAAE,KAAK,EAAE,OAAO,2BAA2B,CAAQ;AACjE;AAAA,QACF;AAAA,MACF,OAAO;AAEL,cAAM,oBAAoB,YAAY;AAAA,UAAM,CAAC,eAC3C,QAAQ,KAAK,aAAa,SAAS,UAAU;AAAA,QAC/C;AACA,YAAI,CAAC,mBAAmB;AACtB,cAAI,OAAO,GAAG,EAAE,KAAK,EAAE,OAAO,2BAA2B,CAAQ;AACjE;AAAA,QACF;AAAA,MACF;AAAA,IACF;AAGA,UAAM,QAAQ,KAAK,KAAK,OAAO;AAAA,EACjC;AACF;;;AC1HA,kBAAiE;AAK1D,SAAS,iBACd,KACA,YACA,UAAyB,CAAC,GACpB;AACN,QAAM,aAAa,QAAQ,QAAQ;AACnC,QAAM,SAAS,QAAQ,UAAU;AAEjC,QAAM,aAAS,6BAAgB,YAAY,YAAY;AAAA,IACrD,GAAG;AAAA,IACH;AAAA,IACA,UAAU;AAAA,IACV,QAAQ;AAAA,IACR,UAAU;AAAA,EACZ,CAAC;AAED,MAAI,UAAU,cAAc,MAAM;AACpC;AAKO,SAAS,mBACd,KACA,UAA2D,CAAC,GACtD;AACN,QAAM,aAAa,QAAQ,QAAQ;AAEnC,QAAM,aAAS,yBAAY,YAAY,OAAO;AAE9C,MAAI,UAAU,cAAc,MAAM;AACpC;;;AHzBA,IAAAA,eAA2B;AAG3B,IAAAA,eAAmE;","names":["import_auth"]}

package/dist/index.mjs

@@ -35,7 +35,7 @@ function createAuthMiddleware(config) {
       const response = NextResponse.next();
       response.cookies.set(cookieName, newJwt, {
         httpOnly: true,
-        secure: process.env.NODE_ENV === "production",
+        secure: true,
         sameSite: "lax",
         maxAge: 900
         // 15 minutes
@@ -48,12 +48,7 @@ function createAuthMiddleware(config) {
 
 // src/api-helpers.ts
 function protectedRoute(handler, config) {
-  const {
-    sessionManager,
-    roles,
-    permissions,
-    cookieName = "stackwright_session"
-  } = config;
+  const { sessionManager, roles, permissions, cookieName = "stackwright_session" } = config;
   return async (req, res) => {
     const sessionCookie = req.cookies[cookieName];
     if (!sessionCookie) {
@@ -66,19 +61,33 @@ function protectedRoute(handler, config) {
       return;
     }
     if (roles && roles.length > 0) {
-      const hasRole = roles.some((role) => session.user.roles.includes(role));
-      if (!hasRole) {
-        res.status(403).json({ error: "Insufficient permissions" });
-        return;
+      if (config.rbacEngine) {
+        if (!config.rbacEngine.hasAnyRole(session.user, roles)) {
+          res.status(403).json({ error: "Insufficient permissions" });
+          return;
+        }
+      } else {
+        const hasRole = roles.some((role) => session.user.roles.includes(role));
+        if (!hasRole) {
+          res.status(403).json({ error: "Insufficient permissions" });
+          return;
+        }
       }
     }
     if (permissions && permissions.length > 0) {
-      const hasAllPermissions = permissions.every(
-        (permission) => session.user.permissions?.includes(permission)
-      );
-      if (!hasAllPermissions) {
-        res.status(403).json({ error: "Insufficient permissions" });
-        return;
+      if (config.rbacEngine) {
+        if (!config.rbacEngine.hasAllPermissions(session.user, permissions)) {
+          res.status(403).json({ error: "Insufficient permissions" });
+          return;
+        }
+      } else {
+        const hasAllPermissions = permissions.every(
+          (permission) => session.user.permissions?.includes(permission)
+        );
+        if (!hasAllPermissions) {
+          res.status(403).json({ error: "Insufficient permissions" });
+          return;
+        }
       }
     }
     await handler(req, res, session);
@@ -94,7 +103,7 @@ function setSessionCookie(res, sessionJwt, options = {}) {
     ...options,
     maxAge,
     httpOnly: true,
-    secure: process.env.NODE_ENV === "production",
+    secure: true,
     sameSite: "lax"
   });
   res.setHeader("Set-Cookie", cookie);
@@ -104,10 +113,19 @@ function clearSessionCookie(res, options = {}) {
   const cookie = clearCookie(cookieName, options);
   res.setHeader("Set-Cookie", cookie);
 }
+
+// src/index.ts
+import { RBACEngine } from "@stackwright-pro/auth";
+import { AuthProvider, AuthContext, useAuth, useRequireAuth } from "@stackwright-pro/auth";
 export {
+  AuthContext,
+  AuthProvider,
+  RBACEngine,
   clearSessionCookie,
   createAuthMiddleware,
   protectedRoute,
-  setSessionCookie
+  setSessionCookie,
+  useAuth,
+  useRequireAuth
 };
 //# sourceMappingURL=index.mjs.map

package/dist/index.mjs.map

@@ -1 +1 @@
-{"version":3,"sources":["../src/middleware.ts","../src/api-helpers.ts","../src/cookie-utils.ts"],"sourcesContent":["import { type NextRequest, NextResponse } from 'next/server';\nimport { SessionManager, RBACEngine, type AuthConfig, type AuthSession } from '@stackwright-pro/auth';\n\nexport interface MiddlewareConfig {\n  /**\n   * Auth configuration\n   */\n  authConfig: AuthConfig;\n  \n  /**\n   * Session manager instance\n   */\n  sessionManager: SessionManager;\n  \n  /**\n   * RBAC engine instance\n   */\n  rbacEngine: RBACEngine;\n  \n  /**\n   * Cookie name for session (default: 'stackwright_session')\n   */\n  cookieName?: string;\n  \n  /**\n   * URL to redirect to when authentication fails (default: '/login')\n   */\n  loginUrl?: string;\n  \n  /**\n   * URL to redirect to when authorization fails (default: '/unauthorized')\n   */\n  unauthorizedUrl?: string;\n}\n\n/**\n * Create Next.js middleware for authentication and authorization\n * \n * @example\n * ```typescript\n * // middleware.ts\n * import { createAuthMiddleware } from '@stackwright-pro/auth-nextjs';\n * \n * export default createAuthMiddleware({\n *   authConfig,\n *   sessionManager,\n *   rbacEngine,\n * });\n * \n * export const config = {\n *   matcher: ['/((?!_next|api/auth).*)'],\n * };\n * ```\n */\nexport function createAuthMiddleware(config: MiddlewareConfig) {\n  const {\n    sessionManager,\n    rbacEngine,\n    cookieName = 'stackwright_session',\n    loginUrl = '/login',\n    unauthorizedUrl = '/unauthorized',\n  } = config;\n  \n  return async function authMiddleware(\n    request: NextRequest\n  ): Promise<NextResponse | undefined> {\n    const { pathname } = request.nextUrl;\n    \n    // Check if route is public\n    if (rbacEngine.isPublicRoute(pathname)) {\n      return undefined; // Continue to next middleware\n    }\n    \n    // Extract session from cookie\n    const sessionCookie = request.cookies.get(cookieName);\n    let session: AuthSession | null = null;\n    \n    if (sessionCookie) {\n      session = await sessionManager.deserialize(sessionCookie.value);\n    }\n    \n    // Check if session is valid\n    if (!session || sessionManager.isExpired(session)) {\n      // Redirect to login\n      const url = request.nextUrl.clone();\n      url.pathname = loginUrl;\n      url.searchParams.set('redirect', pathname);\n      return NextResponse.redirect(url);\n    }\n    \n    // Check if user can access route\n    if (!rbacEngine.canAccessRoute(session.user, pathname)) {\n      // Redirect to unauthorized\n      const url = request.nextUrl.clone();\n      url.pathname = unauthorizedUrl;\n      return NextResponse.redirect(url);\n    }\n    \n    // Refresh session if needed\n    if (sessionManager.shouldRefresh(session)) {\n      const refreshed = await sessionManager.refreshSession(session);\n      const newJwt = await sessionManager.serialize(refreshed);\n      \n      const response = NextResponse.next();\n      response.cookies.set(cookieName, newJwt, {\n        httpOnly: true,\n        secure: process.env.NODE_ENV === 'production',\n        sameSite: 'lax',\n        maxAge: 900, // 15 minutes\n      });\n      \n      return response;\n    }\n    \n    // Allow request to continue\n    return undefined;\n  };\n}\n","import type { NextApiRequest, NextApiResponse } from 'next';\nimport { SessionManager, type AuthSession, type AuthUser } from '@stackwright-pro/auth';\n\nexport interface ProtectedRouteConfig {\n  /**\n   * Session manager for validating sessions\n   */\n  sessionManager: SessionManager;\n  \n  /**\n   * Required roles (user must have ANY of these)\n   */\n  roles?: string[];\n  \n  /**\n   * Required permissions (user must have ALL of these)\n   */\n  permissions?: string[];\n  \n  /**\n   * Cookie name (default: 'stackwright_session')\n   */\n  cookieName?: string;\n}\n\n/**\n * Handler function with authenticated session\n */\nexport type AuthenticatedHandler<T = any> = (\n  req: NextApiRequest,\n  res: NextApiResponse<T>,\n  session: AuthSession\n) => void | Promise<void>;\n\n/**\n * Wrap API route with authentication/authorization\n * \n * @example\n * ```typescript\n * // pages/api/equipment/[id].ts\n * export default protectedRoute(\n *   async (req, res, session) => {\n *     const equipment = await getEquipment(req.query.id);\n *     res.json(equipment);\n *   },\n *   {\n *     sessionManager,\n *     roles: ['ANALYST', 'ADMIN'],\n *   }\n * );\n * ```\n */\nexport function protectedRoute<T = any>(\n  handler: AuthenticatedHandler<T>,\n  config: ProtectedRouteConfig\n): (req: NextApiRequest, res: NextApiResponse) => Promise<void> {\n  const {\n    sessionManager,\n    roles,\n    permissions,\n    cookieName = 'stackwright_session',\n  } = config;\n  \n  return async (req: NextApiRequest, res: NextApiResponse) => {\n    // Extract session from cookie\n    const sessionCookie = req.cookies[cookieName];\n    \n    if (!sessionCookie) {\n      res.status(401).json({ error: 'Not authenticated' } as any);\n      return;\n    }\n    \n    // Verify session\n    const session = await sessionManager.deserialize(sessionCookie);\n    \n    if (!session || sessionManager.isExpired(session)) {\n      res.status(401).json({ error: 'Session expired' } as any);\n      return;\n    }\n    \n    // Check roles\n    if (roles && roles.length > 0) {\n      const hasRole = roles.some(role => session.user.roles.includes(role));\n      if (!hasRole) {\n        res.status(403).json({ error: 'Insufficient permissions' } as any);\n        return;\n      }\n    }\n    \n    // Check permissions\n    if (permissions && permissions.length > 0) {\n      const hasAllPermissions = permissions.every(permission =>\n        session.user.permissions?.includes(permission)\n      );\n      if (!hasAllPermissions) {\n        res.status(403).json({ error: 'Insufficient permissions' } as any);\n        return;\n      }\n    }\n    \n    // Call handler with session\n    await handler(req, res, session);\n  };\n}\n","import type { NextApiResponse } from 'next';\nimport { serializeCookie, clearCookie, type CookieOptions } from '@stackwright-pro/auth';\n\n/**\n * Set session cookie in Next.js API response\n */\nexport function setSessionCookie(\n  res: NextApiResponse,\n  sessionJwt: string,\n  options: CookieOptions = {}\n): void {\n  const cookieName = options.name || 'stackwright_session';\n  const maxAge = options.maxAge || 900; // 15 minutes default\n  \n  const cookie = serializeCookie(cookieName, sessionJwt, {\n    ...options,\n    maxAge,\n    httpOnly: true,\n    secure: process.env.NODE_ENV === 'production',\n    sameSite: 'lax',\n  });\n  \n  res.setHeader('Set-Cookie', cookie);\n}\n\n/**\n * Clear session cookie in Next.js API response\n */\nexport function clearSessionCookie(\n  res: NextApiResponse,\n  options: Pick<CookieOptions, 'name' | 'domain' | 'path'> = {}\n): void {\n  const cookieName = options.name || 'stackwright_session';\n  \n  const cookie = clearCookie(cookieName, options);\n  \n  res.setHeader('Set-Cookie', cookie);\n}\n"],"mappings":";AAAA,SAA2B,oBAAoB;AAsDxC,SAAS,qBAAqB,QAA0B;AAC7D,QAAM;AAAA,IACJ;AAAA,IACA;AAAA,IACA,aAAa;AAAA,IACb,WAAW;AAAA,IACX,kBAAkB;AAAA,EACpB,IAAI;AAEJ,SAAO,eAAe,eACpB,SACmC;AACnC,UAAM,EAAE,SAAS,IAAI,QAAQ;AAG7B,QAAI,WAAW,cAAc,QAAQ,GAAG;AACtC,aAAO;AAAA,IACT;AAGA,UAAM,gBAAgB,QAAQ,QAAQ,IAAI,UAAU;AACpD,QAAI,UAA8B;AAElC,QAAI,eAAe;AACjB,gBAAU,MAAM,eAAe,YAAY,cAAc,KAAK;AAAA,IAChE;AAGA,QAAI,CAAC,WAAW,eAAe,UAAU,OAAO,GAAG;AAEjD,YAAM,MAAM,QAAQ,QAAQ,MAAM;AAClC,UAAI,WAAW;AACf,UAAI,aAAa,IAAI,YAAY,QAAQ;AACzC,aAAO,aAAa,SAAS,GAAG;AAAA,IAClC;AAGA,QAAI,CAAC,WAAW,eAAe,QAAQ,MAAM,QAAQ,GAAG;AAEtD,YAAM,MAAM,QAAQ,QAAQ,MAAM;AAClC,UAAI,WAAW;AACf,aAAO,aAAa,SAAS,GAAG;AAAA,IAClC;AAGA,QAAI,eAAe,cAAc,OAAO,GAAG;AACzC,YAAM,YAAY,MAAM,eAAe,eAAe,OAAO;AAC7D,YAAM,SAAS,MAAM,eAAe,UAAU,SAAS;AAEvD,YAAM,WAAW,aAAa,KAAK;AACnC,eAAS,QAAQ,IAAI,YAAY,QAAQ;AAAA,QACvC,UAAU;AAAA,QACV,QAAQ,QAAQ,IAAI,aAAa;AAAA,QACjC,UAAU;AAAA,QACV,QAAQ;AAAA;AAAA,MACV,CAAC;AAED,aAAO;AAAA,IACT;AAGA,WAAO;AAAA,EACT;AACF;;;ACjEO,SAAS,eACd,SACA,QAC8D;AAC9D,QAAM;AAAA,IACJ;AAAA,IACA;AAAA,IACA;AAAA,IACA,aAAa;AAAA,EACf,IAAI;AAEJ,SAAO,OAAO,KAAqB,QAAyB;AAE1D,UAAM,gBAAgB,IAAI,QAAQ,UAAU;AAE5C,QAAI,CAAC,eAAe;AAClB,UAAI,OAAO,GAAG,EAAE,KAAK,EAAE,OAAO,oBAAoB,CAAQ;AAC1D;AAAA,IACF;AAGA,UAAM,UAAU,MAAM,eAAe,YAAY,aAAa;AAE9D,QAAI,CAAC,WAAW,eAAe,UAAU,OAAO,GAAG;AACjD,UAAI,OAAO,GAAG,EAAE,KAAK,EAAE,OAAO,kBAAkB,CAAQ;AACxD;AAAA,IACF;AAGA,QAAI,SAAS,MAAM,SAAS,GAAG;AAC7B,YAAM,UAAU,MAAM,KAAK,UAAQ,QAAQ,KAAK,MAAM,SAAS,IAAI,CAAC;AACpE,UAAI,CAAC,SAAS;AACZ,YAAI,OAAO,GAAG,EAAE,KAAK,EAAE,OAAO,2BAA2B,CAAQ;AACjE;AAAA,MACF;AAAA,IACF;AAGA,QAAI,eAAe,YAAY,SAAS,GAAG;AACzC,YAAM,oBAAoB,YAAY;AAAA,QAAM,gBAC1C,QAAQ,KAAK,aAAa,SAAS,UAAU;AAAA,MAC/C;AACA,UAAI,CAAC,mBAAmB;AACtB,YAAI,OAAO,GAAG,EAAE,KAAK,EAAE,OAAO,2BAA2B,CAAQ;AACjE;AAAA,MACF;AAAA,IACF;AAGA,UAAM,QAAQ,KAAK,KAAK,OAAO;AAAA,EACjC;AACF;;;ACtGA,SAAS,iBAAiB,mBAAuC;AAK1D,SAAS,iBACd,KACA,YACA,UAAyB,CAAC,GACpB;AACN,QAAM,aAAa,QAAQ,QAAQ;AACnC,QAAM,SAAS,QAAQ,UAAU;AAEjC,QAAM,SAAS,gBAAgB,YAAY,YAAY;AAAA,IACrD,GAAG;AAAA,IACH;AAAA,IACA,UAAU;AAAA,IACV,QAAQ,QAAQ,IAAI,aAAa;AAAA,IACjC,UAAU;AAAA,EACZ,CAAC;AAED,MAAI,UAAU,cAAc,MAAM;AACpC;AAKO,SAAS,mBACd,KACA,UAA2D,CAAC,GACtD;AACN,QAAM,aAAa,QAAQ,QAAQ;AAEnC,QAAM,SAAS,YAAY,YAAY,OAAO;AAE9C,MAAI,UAAU,cAAc,MAAM;AACpC;","names":[]}
+{"version":3,"sources":["../src/middleware.ts","../src/api-helpers.ts","../src/cookie-utils.ts","../src/index.ts"],"sourcesContent":["import { type NextRequest, NextResponse } from 'next/server';\nimport {\n  SessionManager,\n  RBACEngine,\n  type AuthConfig,\n  type AuthSession,\n} from '@stackwright-pro/auth';\n\nexport interface MiddlewareConfig {\n  /**\n   * Auth configuration\n   */\n  authConfig: AuthConfig;\n\n  /**\n   * Session manager instance\n   */\n  sessionManager: SessionManager;\n\n  /**\n   * RBAC engine instance\n   */\n  rbacEngine: RBACEngine;\n\n  /**\n   * Cookie name for session (default: 'stackwright_session')\n   */\n  cookieName?: string;\n\n  /**\n   * URL to redirect to when authentication fails (default: '/login')\n   */\n  loginUrl?: string;\n\n  /**\n   * URL to redirect to when authorization fails (default: '/unauthorized')\n   */\n  unauthorizedUrl?: string;\n}\n\n/**\n * Create Next.js middleware for authentication and authorization\n *\n * @example\n * ```typescript\n * // middleware.ts\n * import { createAuthMiddleware } from '@stackwright-pro/auth-nextjs';\n *\n * export default createAuthMiddleware({\n *   authConfig,\n *   sessionManager,\n *   rbacEngine,\n * });\n *\n * export const config = {\n *   matcher: ['/((?!_next|api/auth).*)'],\n * };\n * ```\n */\nexport function createAuthMiddleware(config: MiddlewareConfig) {\n  const {\n    sessionManager,\n    rbacEngine,\n    cookieName = 'stackwright_session',\n    loginUrl = '/login',\n    unauthorizedUrl = '/unauthorized',\n  } = config;\n\n  return async function authMiddleware(request: NextRequest): Promise<NextResponse | undefined> {\n    const { pathname } = request.nextUrl;\n\n    // Check if route is public\n    if (rbacEngine.isPublicRoute(pathname)) {\n      return undefined; // Continue to next middleware\n    }\n\n    // Extract session from cookie\n    const sessionCookie = request.cookies.get(cookieName);\n    let session: AuthSession | null = null;\n\n    if (sessionCookie) {\n      session = await sessionManager.deserialize(sessionCookie.value);\n    }\n\n    // Check if session is valid\n    if (!session || sessionManager.isExpired(session)) {\n      // Redirect to login\n      const url = request.nextUrl.clone();\n      url.pathname = loginUrl;\n      url.searchParams.set('redirect', pathname);\n      return NextResponse.redirect(url);\n    }\n\n    // Check if user can access route\n    if (!rbacEngine.canAccessRoute(session.user, pathname)) {\n      // Redirect to unauthorized\n      const url = request.nextUrl.clone();\n      url.pathname = unauthorizedUrl;\n      return NextResponse.redirect(url);\n    }\n\n    // Refresh session if needed\n    if (sessionManager.shouldRefresh(session)) {\n      const refreshed = await sessionManager.refreshSession(session);\n      const newJwt = await sessionManager.serialize(refreshed);\n\n      const response = NextResponse.next();\n      response.cookies.set(cookieName, newJwt, {\n        httpOnly: true,\n        secure: true,\n        sameSite: 'lax',\n        maxAge: 900, // 15 minutes\n      });\n\n      return response;\n    }\n\n    // Allow request to continue\n    return undefined;\n  };\n}\n","import type { NextApiRequest, NextApiResponse } from 'next';\nimport { SessionManager, RBACEngine, type AuthSession, type AuthUser } from '@stackwright-pro/auth';\n\nexport interface ProtectedRouteConfig {\n  /**\n   * Session manager for validating sessions\n   */\n  sessionManager: SessionManager;\n\n  /**\n   * Required roles (user must have ANY of these)\n   */\n  roles?: string[];\n\n  /**\n   * Required permissions (user must have ALL of these)\n   */\n  permissions?: string[];\n\n  /**\n   * Cookie name (default: 'stackwright_session')\n   */\n  cookieName?: string;\n\n  /**\n   * Optional RBAC engine for wildcard-aware role/permission checking.\n   * When provided, authorization decisions use RBACEngine (consistent\n   * with middleware). Without it, falls back to direct array checks.\n   */\n  rbacEngine?: RBACEngine;\n}\n\n/**\n * Handler function with authenticated session\n */\nexport type AuthenticatedHandler<T = any> = (\n  req: NextApiRequest,\n  res: NextApiResponse<T>,\n  session: AuthSession\n) => void | Promise<void>;\n\n/**\n * Wrap API route with authentication/authorization\n *\n * @example\n * ```typescript\n * // pages/api/equipment/[id].ts\n * export default protectedRoute(\n *   async (req, res, session) => {\n *     const equipment = await getEquipment(req.query.id);\n *     res.json(equipment);\n *   },\n *   {\n *     sessionManager,\n *     roles: ['ANALYST', 'ADMIN'],\n *   }\n * );\n * ```\n */\nexport function protectedRoute<T = any>(\n  handler: AuthenticatedHandler<T>,\n  config: ProtectedRouteConfig\n): (req: NextApiRequest, res: NextApiResponse) => Promise<void> {\n  const { sessionManager, roles, permissions, cookieName = 'stackwright_session' } = config;\n\n  return async (req: NextApiRequest, res: NextApiResponse) => {\n    // Extract session from cookie\n    const sessionCookie = req.cookies[cookieName];\n\n    if (!sessionCookie) {\n      res.status(401).json({ error: 'Not authenticated' } as any);\n      return;\n    }\n\n    // Verify session\n    const session = await sessionManager.deserialize(sessionCookie);\n\n    if (!session || sessionManager.isExpired(session)) {\n      res.status(401).json({ error: 'Session expired' } as any);\n      return;\n    }\n\n    // Check roles\n    if (roles && roles.length > 0) {\n      if (config.rbacEngine) {\n        // Use RBAC engine for consistent wildcard-aware checking\n        if (!config.rbacEngine.hasAnyRole(session.user, roles)) {\n          res.status(403).json({ error: 'Insufficient permissions' } as any);\n          return;\n        }\n      } else {\n        // Fallback: direct check (no wildcard support)\n        const hasRole = roles.some((role) => session.user.roles.includes(role));\n        if (!hasRole) {\n          res.status(403).json({ error: 'Insufficient permissions' } as any);\n          return;\n        }\n      }\n    }\n\n    // Check permissions\n    if (permissions && permissions.length > 0) {\n      if (config.rbacEngine) {\n        // Use RBAC engine for wildcard-aware permission checking\n        if (!config.rbacEngine.hasAllPermissions(session.user, permissions)) {\n          res.status(403).json({ error: 'Insufficient permissions' } as any);\n          return;\n        }\n      } else {\n        // Fallback: direct check (no wildcard support)\n        const hasAllPermissions = permissions.every((permission) =>\n          session.user.permissions?.includes(permission)\n        );\n        if (!hasAllPermissions) {\n          res.status(403).json({ error: 'Insufficient permissions' } as any);\n          return;\n        }\n      }\n    }\n\n    // Call handler with session\n    await handler(req, res, session);\n  };\n}\n","import type { NextApiResponse } from 'next';\nimport { serializeCookie, clearCookie, type CookieOptions } from '@stackwright-pro/auth';\n\n/**\n * Set session cookie in Next.js API response\n */\nexport function setSessionCookie(\n  res: NextApiResponse,\n  sessionJwt: string,\n  options: CookieOptions = {}\n): void {\n  const cookieName = options.name || 'stackwright_session';\n  const maxAge = options.maxAge || 900; // 15 minutes default\n\n  const cookie = serializeCookie(cookieName, sessionJwt, {\n    ...options,\n    maxAge,\n    httpOnly: true,\n    secure: true,\n    sameSite: 'lax',\n  });\n\n  res.setHeader('Set-Cookie', cookie);\n}\n\n/**\n * Clear session cookie in Next.js API response\n */\nexport function clearSessionCookie(\n  res: NextApiResponse,\n  options: Pick<CookieOptions, 'name' | 'domain' | 'path'> = {}\n): void {\n  const cookieName = options.name || 'stackwright_session';\n\n  const cookie = clearCookie(cookieName, options);\n\n  res.setHeader('Set-Cookie', cookie);\n}\n","export { createAuthMiddleware, type MiddlewareConfig } from './middleware.js';\nexport {\n  protectedRoute,\n  type ProtectedRouteConfig,\n  type AuthenticatedHandler,\n} from './api-helpers.js';\nexport { setSessionCookie, clearSessionCookie } from './cookie-utils.js';\n\n// Re-export commonly used types/classes from core\nexport type { AuthUser, AuthSession, AuthConfig } from '@stackwright-pro/auth';\n\n// Re-export RBAC engine\nexport { RBACEngine } from '@stackwright-pro/auth';\n\n// Re-export React context components for Next.js apps\nexport { AuthProvider, AuthContext, useAuth, useRequireAuth } from '@stackwright-pro/auth';\nexport type { AuthProviderProps, AuthContextValue } from '@stackwright-pro/auth';\n"],"mappings":";AAAA,SAA2B,oBAAoB;AA2DxC,SAAS,qBAAqB,QAA0B;AAC7D,QAAM;AAAA,IACJ;AAAA,IACA;AAAA,IACA,aAAa;AAAA,IACb,WAAW;AAAA,IACX,kBAAkB;AAAA,EACpB,IAAI;AAEJ,SAAO,eAAe,eAAe,SAAyD;AAC5F,UAAM,EAAE,SAAS,IAAI,QAAQ;AAG7B,QAAI,WAAW,cAAc,QAAQ,GAAG;AACtC,aAAO;AAAA,IACT;AAGA,UAAM,gBAAgB,QAAQ,QAAQ,IAAI,UAAU;AACpD,QAAI,UAA8B;AAElC,QAAI,eAAe;AACjB,gBAAU,MAAM,eAAe,YAAY,cAAc,KAAK;AAAA,IAChE;AAGA,QAAI,CAAC,WAAW,eAAe,UAAU,OAAO,GAAG;AAEjD,YAAM,MAAM,QAAQ,QAAQ,MAAM;AAClC,UAAI,WAAW;AACf,UAAI,aAAa,IAAI,YAAY,QAAQ;AACzC,aAAO,aAAa,SAAS,GAAG;AAAA,IAClC;AAGA,QAAI,CAAC,WAAW,eAAe,QAAQ,MAAM,QAAQ,GAAG;AAEtD,YAAM,MAAM,QAAQ,QAAQ,MAAM;AAClC,UAAI,WAAW;AACf,aAAO,aAAa,SAAS,GAAG;AAAA,IAClC;AAGA,QAAI,eAAe,cAAc,OAAO,GAAG;AACzC,YAAM,YAAY,MAAM,eAAe,eAAe,OAAO;AAC7D,YAAM,SAAS,MAAM,eAAe,UAAU,SAAS;AAEvD,YAAM,WAAW,aAAa,KAAK;AACnC,eAAS,QAAQ,IAAI,YAAY,QAAQ;AAAA,QACvC,UAAU;AAAA,QACV,QAAQ;AAAA,QACR,UAAU;AAAA,QACV,QAAQ;AAAA;AAAA,MACV,CAAC;AAED,aAAO;AAAA,IACT;AAGA,WAAO;AAAA,EACT;AACF;;;AC7DO,SAAS,eACd,SACA,QAC8D;AAC9D,QAAM,EAAE,gBAAgB,OAAO,aAAa,aAAa,sBAAsB,IAAI;AAEnF,SAAO,OAAO,KAAqB,QAAyB;AAE1D,UAAM,gBAAgB,IAAI,QAAQ,UAAU;AAE5C,QAAI,CAAC,eAAe;AAClB,UAAI,OAAO,GAAG,EAAE,KAAK,EAAE,OAAO,oBAAoB,CAAQ;AAC1D;AAAA,IACF;AAGA,UAAM,UAAU,MAAM,eAAe,YAAY,aAAa;AAE9D,QAAI,CAAC,WAAW,eAAe,UAAU,OAAO,GAAG;AACjD,UAAI,OAAO,GAAG,EAAE,KAAK,EAAE,OAAO,kBAAkB,CAAQ;AACxD;AAAA,IACF;AAGA,QAAI,SAAS,MAAM,SAAS,GAAG;AAC7B,UAAI,OAAO,YAAY;AAErB,YAAI,CAAC,OAAO,WAAW,WAAW,QAAQ,MAAM,KAAK,GAAG;AACtD,cAAI,OAAO,GAAG,EAAE,KAAK,EAAE,OAAO,2BAA2B,CAAQ;AACjE;AAAA,QACF;AAAA,MACF,OAAO;AAEL,cAAM,UAAU,MAAM,KAAK,CAAC,SAAS,QAAQ,KAAK,MAAM,SAAS,IAAI,CAAC;AACtE,YAAI,CAAC,SAAS;AACZ,cAAI,OAAO,GAAG,EAAE,KAAK,EAAE,OAAO,2BAA2B,CAAQ;AACjE;AAAA,QACF;AAAA,MACF;AAAA,IACF;AAGA,QAAI,eAAe,YAAY,SAAS,GAAG;AACzC,UAAI,OAAO,YAAY;AAErB,YAAI,CAAC,OAAO,WAAW,kBAAkB,QAAQ,MAAM,WAAW,GAAG;AACnE,cAAI,OAAO,GAAG,EAAE,KAAK,EAAE,OAAO,2BAA2B,CAAQ;AACjE;AAAA,QACF;AAAA,MACF,OAAO;AAEL,cAAM,oBAAoB,YAAY;AAAA,UAAM,CAAC,eAC3C,QAAQ,KAAK,aAAa,SAAS,UAAU;AAAA,QAC/C;AACA,YAAI,CAAC,mBAAmB;AACtB,cAAI,OAAO,GAAG,EAAE,KAAK,EAAE,OAAO,2BAA2B,CAAQ;AACjE;AAAA,QACF;AAAA,MACF;AAAA,IACF;AAGA,UAAM,QAAQ,KAAK,KAAK,OAAO;AAAA,EACjC;AACF;;;AC1HA,SAAS,iBAAiB,mBAAuC;AAK1D,SAAS,iBACd,KACA,YACA,UAAyB,CAAC,GACpB;AACN,QAAM,aAAa,QAAQ,QAAQ;AACnC,QAAM,SAAS,QAAQ,UAAU;AAEjC,QAAM,SAAS,gBAAgB,YAAY,YAAY;AAAA,IACrD,GAAG;AAAA,IACH;AAAA,IACA,UAAU;AAAA,IACV,QAAQ;AAAA,IACR,UAAU;AAAA,EACZ,CAAC;AAED,MAAI,UAAU,cAAc,MAAM;AACpC;AAKO,SAAS,mBACd,KACA,UAA2D,CAAC,GACtD;AACN,QAAM,aAAa,QAAQ,QAAQ;AAEnC,QAAM,SAAS,YAAY,YAAY,OAAO;AAE9C,MAAI,UAAU,cAAc,MAAM;AACpC;;;ACzBA,SAAS,kBAAkB;AAG3B,SAAS,cAAc,aAAa,SAAS,sBAAsB;","names":[]}

package/package.json

@@ -1,6 +1,6 @@
 {
   "name": "@stackwright-pro/auth-nextjs",
-  "version": "0.1.0",
+  "version": "0.1.1-alpha.1",
   "description": "Next.js adapter for Stackwright Pro authentication",
   "license": "PROPRIETARY",
   "main": "./dist/index.js",
@@ -17,7 +17,7 @@
     "dist"
   ],
   "dependencies": {
-    "@stackwright-pro/auth": "0.1.0"
+    "@stackwright-pro/auth": "0.1.1-alpha.1"
   },
   "devDependencies": {
     "@types/node": "^25.4.0",
@@ -30,10 +30,14 @@
     "react": "^19",
     "react-dom": "^19"
   },
+  "publishConfig": {
+    "access": "public"
+  },
   "scripts": {
     "build": "tsup",
     "dev": "tsup --watch",
     "test": "vitest run",
+    "test:coverage": "vitest run --coverage",
     "test:watch": "vitest"
   }
 }