@sylphx/sdk 0.10.6 → 0.10.7

package/dist/nextjs/index.d.ts

@@ -64,14 +64,18 @@ interface SylphxMiddlewareConfig {
     afterSignInUrl?: string;
     /**
      * Auth routes prefix. Routes are mounted at:
+     * - {prefix}/register — email/password registration handler
      * - {prefix}/login — credentials login handler
+     * - {prefix}/verify-email — email verification handler
      * - {prefix}/oauth-providers — enabled social login providers
      * - {prefix}/oauth/authorize — social login start handler
      * - {prefix}/callback — OAuth callback handler
      * - {prefix}/passkey/options — passkey login challenge handler
      * - {prefix}/passkey/authenticate — passkey login verification handler
+     * - {prefix}/verify-2fa — TOTP/backup-code verification handler
      * - {prefix}/forgot-password — password reset email handler
      * - {prefix}/reset-password — password reset verification handler
+     * - {prefix}/session — safe session metadata handler
      * - {prefix}/signout — Sign out handler
      *
      * @default '/auth'

package/dist/nextjs/index.mjs

@@ -634,12 +634,30 @@ function isTwoFactorLoginResponse(data) {
 function isOAuthAuthorizeResponse(data) {
   return typeof data === "object" && data !== null && typeof data.authorization_url === "string";
 }
+function authCookieJsonResponse(ctx, data) {
+  const response = NextResponse.json({ success: true, user: data.user });
+  setAuthCookiesMiddleware(response, ctx.namespace, data);
+  return response;
+}
 function headersForPlatformAuth(ctx) {
   return {
     "Content-Type": "application/json",
     "x-app-secret": ctx.secretKey
   };
 }
+async function handleRegister(request, ctx) {
+  if (request.method !== "POST") {
+    return NextResponse.json({ error: "Method not allowed" }, { status: 405 });
+  }
+  const body = await parseJsonObject(request);
+  const res = await fetch(`${ctx.platformUrl}/v1/auth/register`, {
+    method: "POST",
+    headers: headersForPlatformAuth(ctx),
+    body: JSON.stringify(body ?? {})
+  });
+  const data = await res.json().catch(() => ({}));
+  return NextResponse.json(data, { status: res.status });
+}
 async function handleLogin(request, ctx) {
   if (request.method !== "POST") {
     return NextResponse.json({ error: "Method not allowed" }, { status: 405 });
@@ -665,9 +683,78 @@ async function handleLogin(request, ctx) {
   if (!isTokenResponse(data)) {
     return NextResponse.json({ error: "invalid_response" }, { status: 502 });
   }
-  const response = NextResponse.json({ success: true, user: data.user });
-  setAuthCookiesMiddleware(response, ctx.namespace, data);
-  return response;
+  return authCookieJsonResponse(ctx, data);
+}
+async function handleVerifyEmail(request, ctx) {
+  if (request.method !== "POST") {
+    return NextResponse.json({ error: "Method not allowed" }, { status: 405 });
+  }
+  const body = await parseJsonObject(request);
+  const token = typeof body?.token === "string" ? body.token : null;
+  if (!token) {
+    return NextResponse.json({ error: "token is required" }, { status: 400 });
+  }
+  const res = await fetch(`${ctx.platformUrl}/v1/auth/verify-email`, {
+    method: "POST",
+    headers: headersForPlatformAuth(ctx),
+    body: JSON.stringify({ token })
+  });
+  const data = await res.json().catch(() => ({}));
+  return NextResponse.json(data, { status: res.status });
+}
+async function handleVerifyTwoFactor(request, ctx) {
+  if (request.method !== "POST") {
+    return NextResponse.json({ error: "Method not allowed" }, { status: 405 });
+  }
+  const body = await parseJsonObject(request);
+  const userId = typeof body?.userId === "string" ? body.userId : null;
+  const code = typeof body?.code === "string" ? body.code : null;
+  if (!userId || !code) {
+    return NextResponse.json({ error: "userId and code are required" }, { status: 400 });
+  }
+  const res = await fetch(`${ctx.platformUrl}/v1/auth/verify-2fa`, {
+    method: "POST",
+    headers: headersForPlatformAuth(ctx),
+    body: JSON.stringify({ userId, code })
+  });
+  const data = await res.json().catch(() => ({}));
+  if (!res.ok) {
+    return NextResponse.json(data, { status: res.status });
+  }
+  if (!isTokenResponse(data)) {
+    return NextResponse.json({ error: "invalid_response" }, { status: 502 });
+  }
+  return authCookieJsonResponse(ctx, data);
+}
+function handleSession(request, ctx) {
+  if (request.method !== "GET") {
+    return NextResponse.json({ error: "Method not allowed" }, { status: 405 });
+  }
+  const sessionToken = request.cookies.get(ctx.cookieNames.SESSION)?.value;
+  const userCookieValue = request.cookies.get(ctx.cookieNames.USER)?.value;
+  let userCookie = userCookieValue ? parseUserCookie2(userCookieValue) : null;
+  if (!userCookie && userCookieValue) {
+    try {
+      userCookie = parseUserCookie2(decodeURIComponent(userCookieValue));
+    } catch {
+      userCookie = null;
+    }
+  }
+  if (!sessionToken || isTokenExpired(sessionToken) || !userCookie?.user) {
+    return NextResponse.json({ success: true, session: null, user: null });
+  }
+  const payload = decodeJwtPayload(sessionToken);
+  const userId = payload?.sub ?? userCookie.user.id;
+  const expiresAt = typeof payload?.exp === "number" ? new Date(payload.exp * 1e3).toISOString() : new Date(userCookie.expiresAt).toISOString();
+  return NextResponse.json({
+    success: true,
+    session: {
+      id: `platform:${userId}`,
+      userId,
+      expiresAt
+    },
+    user: userCookie.user
+  });
 }
 async function handleOAuthProviders(ctx) {
   const res = await fetch(`${ctx.platformUrl}/v1/auth/oauth-providers`, {
@@ -747,9 +834,7 @@ async function handlePasskeyAuthenticate(request, ctx) {
   if (!isTokenResponse(data)) {
     return NextResponse.json({ error: "invalid_response" }, { status: 502 });
   }
-  const response = NextResponse.json({ success: true, user: data.user });
-  setAuthCookiesMiddleware(response, ctx.namespace, data);
-  return response;
+  return authCookieJsonResponse(ctx, data);
 }
 async function handleForgotPassword(request, ctx) {
   if (request.method !== "POST") {
@@ -1091,12 +1176,15 @@ async function handleSwitchOrg(request, ctx) {
     }
     const expiresIn = resolveOrgScopedTokenExpiresIn(data);
     const expiresAt = Date.now() + expiresIn * 1e3;
+    const payload = decodeJwtPayload(accessToken);
+    const activeOrganization = {
+      id: payload?.org_id ?? orgId,
+      slug: payload?.org_slug ?? requestedOrgSlug
+    };
     const response = NextResponse.json({
-      accessToken,
-      token: accessToken,
-      expiresIn,
-      tokenType: resolveOrgScopedTokenType(data),
-      user: data.user ?? null
+      success: true,
+      user: data.user ?? null,
+      organization: activeOrganization
     });
     response.cookies.set(ctx.cookieNames.SESSION, accessToken, {
       ...SECURE_COOKIE_OPTIONS,
@@ -1117,11 +1205,7 @@ async function handleSwitchOrg(request, ctx) {
         }
       );
     }
-    const payload = decodeJwtPayload(accessToken);
-    setActiveOrganizationCookies(response, ctx, {
-      id: payload?.org_id ?? orgId,
-      slug: payload?.org_slug ?? requestedOrgSlug
-    });
+    setActiveOrganizationCookies(response, ctx, activeOrganization);
     ctx.log("Switch org success", { orgId });
     return response;
   } catch (err) {
@@ -1267,12 +1351,18 @@ function createSylphxMiddleware(userConfig = {}) {
     if (pathname.includes(".") || pathname.startsWith("/_next")) {
       return NextResponse.next();
     }
+    if (pathname === `${config.authPrefix}/register`) {
+      return handleRegister(request, ctx);
+    }
     if (pathname === `${config.authPrefix}/callback`) {
       return handleCallback(request, ctx);
     }
     if (pathname === `${config.authPrefix}/login`) {
       return handleLogin(request, ctx);
     }
+    if (pathname === `${config.authPrefix}/verify-email`) {
+      return handleVerifyEmail(request, ctx);
+    }
     if (pathname === `${config.authPrefix}/oauth-providers`) {
       return handleOAuthProviders(ctx);
     }
@@ -1285,12 +1375,18 @@ function createSylphxMiddleware(userConfig = {}) {
     if (pathname === `${config.authPrefix}/passkey/authenticate`) {
       return handlePasskeyAuthenticate(request, ctx);
     }
+    if (pathname === `${config.authPrefix}/verify-2fa`) {
+      return handleVerifyTwoFactor(request, ctx);
+    }
     if (pathname === `${config.authPrefix}/forgot-password`) {
       return handleForgotPassword(request, ctx);
     }
     if (pathname === `${config.authPrefix}/reset-password`) {
       return handleResetPassword(request, ctx);
     }
+    if (pathname === `${config.authPrefix}/session`) {
+      return handleSession(request, ctx);
+    }
     if (pathname === `${config.authPrefix}/signout`) {
       return handleSignOut(request, ctx);
     }