@synqauth/nextjs 0.3.0 → 0.4.0

package/dist/index.d.ts

@@ -109,7 +109,7 @@ interface SynqSignInError {
   /** Signs in as someone else (`prompt=select_account`), back to the same page. */
   readonly anotherAccountPath: string;
 }
-/** What a sign-in error code means, in plain words. */
+/** What a sign-in error code means, in plain words: whose side it is on, and what to do. */
 export declare function signInErrorMessage(code: string): string;
 //#endregion
 //#region src/index.d.ts

package/dist/index.js

@@ -1,4 +1,4 @@
-import { a as signInErrorMessage, d as memorySessionStore, f as defineSynqPlugin, h as resolveConfig, i as SIGN_IN_ERROR_PARAM, l as createSynqCore, m as normalizePath, n as unknownHostError, o as signInErrorOf, r as unknownHostResponse, t as siteCores, u as keyValueSessionStore } from "./sites-JUnMBDbp.js";
+import { a as signInErrorMessage, d as memorySessionStore, f as defineSynqPlugin, h as resolveConfig, i as SIGN_IN_ERROR_PARAM, l as createSynqCore, m as normalizePath, n as unknownHostError, o as signInErrorOf, r as unknownHostResponse, t as siteCores, u as keyValueSessionStore } from "./sites-BQ8NPcXw.js";
 import { defineSynqConfig } from "./define.js";
 import { cookies, headers } from "next/headers.js";
 import { cache } from "react";

package/dist/proxy.js

@@ -1,4 +1,4 @@
-import { c as withoutSignInError, h as resolveConfig, i as SIGN_IN_ERROR_PARAM, l as createSynqCore, m as normalizePath, o as signInErrorOf, p as requestJar, r as unknownHostResponse, s as signInErrorPage, t as siteCores } from "./sites-JUnMBDbp.js";
+import { c as withoutSignInError, h as resolveConfig, i as SIGN_IN_ERROR_PARAM, l as createSynqCore, m as normalizePath, o as signInErrorOf, p as requestJar, r as unknownHostResponse, s as signInErrorPage, t as siteCores } from "./sites-BQ8NPcXw.js";
 import { NextResponse } from "next/server.js";
 //#region src/proxy.ts
 /**

package/dist/{sites-JUnMBDbp.js → sites-BQ8NPcXw.js}

@@ -1,4 +1,4 @@
-import { SynqError, createSynqClient, isSynqError, memoryStorage, readMethodList, signInMethods } from "@synqauth/js";
+import { SynqError, createSynqClient, isSynqError, memoryStorage, readMethodList, signInEndingOf, signInMethods } from "@synqauth/js";
 //#region src/crypto.ts
 const encoder = new TextEncoder();
 const decoder = new TextDecoder();
@@ -380,7 +380,7 @@ function popupPage(result) {
 		...result
 	};
 	const data = JSON.stringify(message).replaceAll("<", "\\u003c");
-	const words = result.ok ? "You’re signed in. You can close this window." : "That didn’t finish. You can close this window and try again.";
+	const words = result.ok ? "You’re signed in. You can close this window." : "Sign-in didn’t finish. Close this window and try again from the app.";
 	const html = `<!doctype html>
 <html lang="en">
 <head>
@@ -1224,7 +1224,13 @@ function createSynqCore(config) {
 		try {
 			await client(handle.storage(config.primary, config.primary), config.primary, tx.storage).handleCallback(request.url);
 		} catch (error) {
-			return failed(isSynqError(error) ? error.code : "server_error");
+			const code = isSynqError(error) ? signInEndingOf(error.description) ?? error.code : "server_error";
+			if (!QUIET_SIGN_IN_ERRORS.has(code)) console.error("@synqauth/nextjs: sign-in callback failed", {
+				code,
+				status: isSynqError(error) ? error.status : void 0,
+				requestId: isSynqError(error) ? error.requestId : void 0
+			});
+			return failed(code);
 		}
 		if (tx.found.reauthenticate !== void 0) {
 			const refused = await reauthenticationRefused(jar, handle, tx.found.reauthenticate);
@@ -1737,7 +1743,10 @@ function createSynqCore(config) {
 		const rest = url.pathname.slice(prefix.length);
 		const [first = "", ...tail] = rest.split("/");
 		const jar = requestJar(request);
-		if (!["GET", "HEAD"].includes(request.method) && !sameOrigin(request, config.appUrl)) return problem(403, "forbidden", "A change must come from the app's own pages");
+		if (!["GET", "HEAD"].includes(request.method) && !sameOrigin(request, config.appUrl)) {
+			reportOriginMismatch(request, config.appUrl);
+			return problem(403, "origin_mismatch", "This change came from another address than the app's own pages (appUrl)");
+		}
 		let response;
 		try {
 			if (rest === "sign-in" && request.method === "GET") response = await signIn(request, jar);
@@ -1760,6 +1769,12 @@ function createSynqCore(config) {
 			else if (!RESERVED.has(first)) response = await plugin(request, jar, first, tail.join("/"));
 		} catch (error) {
 			if (!isSynqError(error)) throw error;
+			if (error.status === void 0 || error.status >= 500) console.error("@synqauth/nextjs: a route under the mount failed", {
+				route: rest,
+				code: error.code,
+				status: error.status,
+				requestId: error.requestId
+			});
 			response = problem(error.status && error.status >= 400 ? 502 : 500, error.code, error.message);
 		}
 		response ??= problem(404, "not_found", "No such route under the mount");
@@ -1843,6 +1858,30 @@ function sameOrigin(request, appUrl) {
 	if (origin) return origin === appUrl.origin;
 	return request.headers.get("sec-fetch-site") === "same-origin";
 }
+/**
+* Sign-in errors that are the person's own doing or an expected step, which
+* no server log needs to hear of (AERO-2757).
+*/
+const QUIET_SIGN_IN_ERRORS = /* @__PURE__ */ new Set([
+	"access_denied",
+	"login_required",
+	"interaction_required",
+	"consent_required",
+	"account_selection_required",
+	"cancelled",
+	"consent_denied",
+	"token_gate_refused",
+	"passkey_required",
+	"unknown_state"
+]);
+let originMismatchReported = false;
+/** Says once per process which origin the mount refused, and what appUrl says (AERO-2757). */
+function reportOriginMismatch(request, appUrl) {
+	if (originMismatchReported) return;
+	originMismatchReported = true;
+	const origin = request.headers.get("origin") ?? request.headers.get("sec-fetch-site") ?? "unknown";
+	console.error(`@synqauth/nextjs: refused a change from ${origin}: appUrl is ${appUrl.origin}. Set appUrl (or SYNQ_APP_URL) to the origin people use.`);
+}
 function withError(target, code) {
 	const url = new URL(target);
 	url.searchParams.set("synq_error", code);
@@ -1884,19 +1923,47 @@ const SIGN_IN_ERROR_PARAM = "synq_error";
 /** An OAuth or SDK error code, as the route mount puts it there. */
 const CODE = /^[a-z0-9_]{1,64}$/;
 const MESSAGES = {
-	access_denied: "The sign-in was cancelled, or this account can’t use this app.",
+	access_denied: "This account can’t use this app, or the sign-in was canceled. Sign in again, or use another account.",
+	cancelled: "You canceled signing in. Sign in when you’re ready.",
+	consent_denied: "You didn’t allow this app to use your account. Sign in again to allow it.",
+	token_gate_refused: "This account’s wallets don’t hold what this app asks for. Use another account, or add the wallet that holds it.",
+	token_gate_unavailable: "We couldn’t check your wallets. That’s a problem on Synq’s side, not yours. Try again in a minute.",
+	passkey_required: "This app needs you to sign in with a passkey.",
+	unmet_authentication_requirements: "This app needs you to sign in with a passkey.",
+	level_not_met: "This app needs you to sign in with a passkey.",
 	login_required: "You need to sign in to continue.",
 	interaction_required: "You need to sign in to continue.",
 	consent_required: "You need to allow this app to use your account to continue.",
 	account_selection_required: "Choose an account to continue.",
-	temporarily_unavailable: "Signing in isn’t available just now. Try again in a moment.",
-	unknown_state: "This sign-in expired, or it finished in another tab. Try again.",
+	temporarily_unavailable: "Signing in is down for a moment on Synq’s side. Try again in a minute.",
+	server_error: "Synq had a problem finishing your sign-in. Try again in a minute.",
+	invalid_grant: "This sign-in expired or was already used. Sign in again.",
+	unknown_state: "This sign-in expired, or it finished in another tab. Sign in again.",
 	other_account: "That signed in to another account. Confirm with a way in of the account signed in here.",
 	not_signed_in: "You were signed out. Sign in again."
 };
-/** What a sign-in error code means, in plain words. */
+/**
+* The app's own setup, which only its team can fix: retrying gets the same
+* answer, and nothing the person does changes it.
+*/
+const APP_SETUP = /* @__PURE__ */ new Set([
+	"invalid_client",
+	"unauthorized_client",
+	"invalid_scope",
+	"invalid_request",
+	"invalid_response",
+	"invalid_redirect_uri",
+	"unsupported_response_type",
+	"discovery_failed",
+	"method_not_offered",
+	"origin_mismatch"
+]);
+/** What a sign-in error code means, in plain words: whose side it is on, and what to do. */
 function signInErrorMessage(code) {
-	return MESSAGES[code] ?? "Something went wrong signing in. Try again.";
+	const said = MESSAGES[code];
+	if (said) return said;
+	if (APP_SETUP.has(code)) return `This app’s sign-in isn’t set up right, so it can’t finish. It’s not something you did: tell the app’s team (code ${code}).`;
+	return `Your sign-in didn’t finish (code ${code}). Try again, and if it keeps happening, tell the app’s team.`;
 }
 /** A path and query on the app, without `synq_error`: where the ways on come back to. */
 function withoutSignInError(pathAndSearch) {

package/package.json

@@ -1,6 +1,6 @@
 {
   "name": "@synqauth/nextjs",
-  "version": "0.3.0",
+  "version": "0.4.0",
   "description": "Synq for Next.js: a backend-for-frontend session, so the browser never holds a Synq token.",
   "license": "MIT",
   "repository": {
@@ -39,7 +39,7 @@
     "access": "public"
   },
   "dependencies": {
-    "@synqauth/js": "0.3.0"
+    "@synqauth/js": "0.4.0"
   },
   "peerDependencies": {
     "next": ">=16.0.0",