@sylphx/sdk 0.15.0 → 0.15.2

package/dist/nextjs/index.d.ts

@@ -649,6 +649,19 @@ interface AuthCookiesData {
     /** Expiry timestamp from USER cookie */
     expiresAt: number | null;
 }
+/**
+ * Decode a cookie value without throwing on malformed percent-encoding.
+ */
+declare function decodeCookieValue(value: string): string;
+/**
+ * Read the last value for a cookie name from a raw Cookie header.
+ *
+ * Browsers can legitimately send duplicate cookie names when an application
+ * has migrated between host-only and domain-scoped cookies. RFC 6265 orders
+ * same-path duplicates by creation time, so the most recently set cookie is the
+ * right value for auth session recovery.
+ */
+declare function readCookieValueFromHeader(cookieHeader: string | null | undefined, name: string): string | null;
 /**
  * Get auth cookies from the request
  *
@@ -703,4 +716,4 @@ declare function clearAuthCookiesMiddleware(response: NextResponse, namespace: s
  */
 declare function parseUserCookie(value: string): UserCookieData | null;
 
-export { ACTIVE_ORG_COOKIE_OPTIONS, ACTIVE_ORG_LIFETIME, type AuthCookiesData, type AuthResult, REFRESH_TOKEN_LIFETIME, SECURE_COOKIE_OPTIONS, SESSION_TOKEN_LIFETIME, SESSION_TOKEN_LIFETIME_MS, type SylphxMiddlewareConfig, type SylphxOrganizationContextConfig, TOKEN_EXPIRY_BUFFER_MS, USER_COOKIE_OPTIONS, type UserCookieData, auth, clearAuthCookies, clearAuthCookiesMiddleware, configureServer, createMatcher, createSylphxMiddleware, currentUser, currentUserId, decodeUserId, encodeUserId, getAuthCookies, getAuthorizationUrl, getCookieNames, getNamespace, getSessionToken, handleCallback, hasRefreshToken, isSessionExpired, parseUserCookie, setAuthCookies, setAuthCookiesMiddleware, signOut, sylphxMiddleware, syncAuthToCookies };
+export { ACTIVE_ORG_COOKIE_OPTIONS, ACTIVE_ORG_LIFETIME, type AuthCookiesData, type AuthResult, REFRESH_TOKEN_LIFETIME, SECURE_COOKIE_OPTIONS, SESSION_TOKEN_LIFETIME, SESSION_TOKEN_LIFETIME_MS, type SylphxMiddlewareConfig, type SylphxOrganizationContextConfig, TOKEN_EXPIRY_BUFFER_MS, USER_COOKIE_OPTIONS, type UserCookieData, auth, clearAuthCookies, clearAuthCookiesMiddleware, configureServer, createMatcher, createSylphxMiddleware, currentUser, currentUserId, decodeCookieValue, decodeUserId, encodeUserId, getAuthCookies, getAuthorizationUrl, getCookieNames, getNamespace, getSessionToken, handleCallback, hasRefreshToken, isSessionExpired, parseUserCookie, readCookieValueFromHeader, setAuthCookies, setAuthCookiesMiddleware, signOut, sylphxMiddleware, syncAuthToCookies };

package/dist/nextjs/index.mjs

@@ -230,6 +230,26 @@ var ACTIVE_ORG_COOKIE_OPTIONS = {
   ...SECURE_COOKIE_OPTIONS,
   httpOnly: true
 };
+function decodeCookieValue(value) {
+  try {
+    return decodeURIComponent(value);
+  } catch {
+    return value;
+  }
+}
+function readCookieValueFromHeader(cookieHeader, name) {
+  if (!cookieHeader) return null;
+  let value = null;
+  for (const cookie of cookieHeader.split(";")) {
+    const trimmed = cookie.trim();
+    const eq = trimmed.indexOf("=");
+    if (eq === -1) continue;
+    if (trimmed.slice(0, eq) === name) {
+      value = decodeCookieValue(trimmed.slice(eq + 1));
+    }
+  }
+  return value;
+}
 async function getAuthCookies(namespace) {
   const cookieStore = await cookies();
   const names = getCookieNames(namespace);
@@ -670,6 +690,19 @@ function clearOAuthPkceCookie(response, ctx) {
     path: ctx.config.authPrefix
   });
 }
+function readRequestCookieValue(request, name) {
+  const values = request.cookies.getAll(name);
+  if (values.length > 0) {
+    const value = values[values.length - 1]?.value;
+    return value === void 0 ? void 0 : decodeCookieValue(value);
+  }
+  const cookie = request.cookies.get(name);
+  if (cookie) return decodeCookieValue(cookie.value);
+  return readCookieValueFromHeader(request.headers.get("cookie"), name) ?? void 0;
+}
+function hasRequestCookie(request, name) {
+  return readRequestCookieValue(request, name) !== void 0;
+}
 function isTwoFactorLoginResponse(data) {
   return typeof data === "object" && data !== null && data.requiresTwoFactor === true && typeof data.userId === "string";
 }
@@ -702,7 +735,7 @@ function setRestoredSessionCookies(response, ctx, restored) {
   }
 }
 async function refreshSessionFromCookie(request, ctx, previousSessionToken) {
-  const refreshToken = request.cookies.get(ctx.cookieNames.REFRESH)?.value;
+  const refreshToken = readRequestCookieValue(request, ctx.cookieNames.REFRESH);
   if (!refreshToken) return null;
   const refreshedTokens = await refreshTokens(refreshToken, ctx);
   if (!refreshedTokens) return null;
@@ -799,8 +832,8 @@ async function handleSession(request, ctx) {
   if (request.method !== "GET") {
     return NextResponse.json({ error: "Method not allowed" }, { status: 405 });
   }
-  const sessionToken = request.cookies.get(ctx.cookieNames.SESSION)?.value;
-  const userCookie = parseUserCookie2(request.cookies.get(ctx.cookieNames.USER)?.value);
+  const sessionToken = readRequestCookieValue(request, ctx.cookieNames.SESSION);
+  const userCookie = parseUserCookie2(readRequestCookieValue(request, ctx.cookieNames.USER));
   if (sessionToken && !isTokenExpired(sessionToken) && userCookie?.user) {
     return NextResponse.json(sessionMetadataBody(sessionToken, userCookie.user));
   }
@@ -813,7 +846,7 @@ async function handleSession(request, ctx) {
     return response2;
   }
   const response = NextResponse.json({ success: true, session: null, user: null });
-  if (sessionToken || request.cookies.has(ctx.cookieNames.REFRESH) || userCookie) {
+  if (sessionToken || hasRequestCookie(request, ctx.cookieNames.REFRESH) || userCookie) {
     clearAuthCookiesMiddleware(response, ctx.namespace);
   }
   return response;
@@ -999,7 +1032,7 @@ async function handleCallback(request, ctx) {
 }
 async function handleSignOut(request, ctx) {
   ctx.log("Signout");
-  const refreshToken = request.cookies.get(ctx.cookieNames.REFRESH)?.value;
+  const refreshToken = readRequestCookieValue(request, ctx.cookieNames.REFRESH);
   if (refreshToken) {
     try {
       await fetch(`${ctx.platformUrl}/v1/auth/revoke`, {
@@ -1021,7 +1054,7 @@ async function handleSignOut(request, ctx) {
 }
 async function handleToken(request, ctx) {
   ctx.log("Token request");
-  const sessionToken = request.cookies.get(ctx.cookieNames.SESSION)?.value;
+  const sessionToken = readRequestCookieValue(request, ctx.cookieNames.SESSION);
   if (sessionToken && !isTokenExpired(sessionToken)) {
     ctx.log("Token returned");
     return NextResponse.json({ accessToken: sessionToken });
@@ -1038,7 +1071,7 @@ async function handleToken(request, ctx) {
     { error: sessionToken ? "Session expired" : "Not authenticated", accessToken: null },
     { status: 401 }
   );
-  if (sessionToken || request.cookies.has(ctx.cookieNames.REFRESH)) {
+  if (sessionToken || hasRequestCookie(request, ctx.cookieNames.REFRESH)) {
     clearAuthCookiesMiddleware(response, ctx.namespace);
   }
   return response;
@@ -1071,17 +1104,10 @@ function parseUserCookie2(value) {
     return null;
   }
 }
-function decodeCookieValue(value) {
-  try {
-    return decodeURIComponent(value);
-  } catch {
-    return value;
-  }
-}
 function readFirstCookieValue(request, names) {
   for (const name of names) {
-    const value = request.cookies.get(name)?.value;
-    if (value) return decodeCookieValue(value);
+    const value = readRequestCookieValue(request, name);
+    if (value) return value;
   }
   return null;
 }
@@ -1214,9 +1240,22 @@ async function handleSwitchOrg(request, ctx) {
   if (request.method !== "POST") {
     return NextResponse.json({ error: "Method not allowed" }, { status: 405 });
   }
-  const sessionToken = request.cookies.get(ctx.cookieNames.SESSION)?.value;
-  if (!sessionToken || isTokenExpired(sessionToken)) {
-    return NextResponse.json({ error: "Not authenticated", accessToken: null }, { status: 401 });
+  const currentSessionToken = readRequestCookieValue(request, ctx.cookieNames.SESSION);
+  let sessionToken = currentSessionToken && !isTokenExpired(currentSessionToken) ? currentSessionToken : null;
+  let restoredBaseSession = null;
+  if (!sessionToken) {
+    restoredBaseSession = await refreshSessionFromCookie(request, ctx, currentSessionToken);
+    sessionToken = restoredBaseSession?.tokens.accessToken ?? null;
+  }
+  if (!sessionToken) {
+    const response = NextResponse.json(
+      { error: "Not authenticated", accessToken: null },
+      { status: 401 }
+    );
+    if (currentSessionToken || hasRequestCookie(request, ctx.cookieNames.REFRESH)) {
+      clearAuthCookiesMiddleware(response, ctx.namespace);
+    }
+    return response;
   }
   let orgId = null;
   let requestedOrgSlug = null;
@@ -1258,11 +1297,17 @@ async function handleSwitchOrg(request, ctx) {
       user: data.user ?? null,
       organization: activeOrganization
     });
+    if (restoredBaseSession) {
+      setAuthCookiesMiddleware(response, ctx.namespace, restoredBaseSession.tokens);
+      if (restoredBaseSession.activeOrganization) {
+        setActiveOrganizationCookies(response, ctx, restoredBaseSession.activeOrganization);
+      }
+    }
     response.cookies.set(ctx.cookieNames.SESSION, accessToken, {
       ...SECURE_COOKIE_OPTIONS,
       maxAge: expiresIn
     });
-    const existingUser = parseUserCookie2(request.cookies.get(ctx.cookieNames.USER)?.value);
+    const existingUser = parseUserCookie2(readRequestCookieValue(request, ctx.cookieNames.USER));
     const user = data.user ?? existingUser?.user;
     if (user) {
       response.cookies.set(
@@ -1487,8 +1532,8 @@ function createSylphxMiddleware(userConfig = {}) {
     if (pathname === `${config.authPrefix}/switch-org`) {
       return handleSwitchOrg(request, ctx);
     }
-    const sessionToken = request.cookies.get(cookieNames.SESSION)?.value;
-    const refreshToken = request.cookies.get(cookieNames.REFRESH)?.value;
+    const sessionToken = readRequestCookieValue(request, cookieNames.SESSION);
+    const refreshToken = readRequestCookieValue(request, cookieNames.REFRESH);
     const hasValidSession = sessionToken && !isTokenExpired(sessionToken);
     const response = NextResponse.next({ request: { headers: request.headers } });
     let isAuthenticated = hasValidSession;
@@ -3009,6 +3054,7 @@ export {
   createSylphxMiddleware,
   currentUser,
   currentUserId,
+  decodeCookieValue,
   decodeUserId,
   encodeUserId,
   getAuthCookies,
@@ -3020,6 +3066,7 @@ export {
   hasRefreshToken,
   isSessionExpired,
   parseUserCookie,
+  readCookieValueFromHeader,
   setAuthCookies,
   setAuthCookiesMiddleware,
   signOut,