@thinkingcat/auth-utils 1.0.21 → 1.0.23

package/dist/index.js

@@ -419,14 +419,21 @@ async function createAuthResponse(accessToken, secret, options) {
     const { payload } = tokenResult;
     // 2. NextAuth JWT 생성
     const jwt = createNextAuthJWT(payload, serviceId);
+    // refreshToken 추가
+    if (refreshToken) {
+        jwt.refreshToken = refreshToken;
+    }
+    // accessTokenExpires 추가 (15분)
+    jwt.accessTokenExpires = Date.now() + (15 * 60 * 1000);
     debugLog('createAuthResponse', 'JWT created:', {
         hasId: !!jwt.id,
         hasEmail: !!jwt.email,
         hasRole: !!jwt.role,
+        hasRefreshToken: !!jwt.refreshToken,
     });
-    // 3. NextAuth 세션 토큰 생성 전략
-    // NextAuth의 JWT 콜백이 custom tokens를 읽어서 자동으로 NextAuth 세션을 생성
-    debugLog('createAuthResponse', 'Custom tokens will be set, NextAuth JWT callback will handle session creation');
+    // 3. NextAuth session cookie 생성
+    const nextAuthToken = await encodeNextAuthToken(jwt, secret);
+    debugLog('createAuthResponse', 'NextAuth session token encoded');
     // 5. HTML 생성
     const displayText = text || serviceId;
     const html = redirectPath
@@ -440,7 +447,23 @@ async function createAuthResponse(accessToken, secret, options) {
             'Content-Type': 'text/html',
         },
     });
-    // 4. 쿠키 설정
+    // 4. NextAuth session cookie 설정
+    const nextAuthCookieName = isProduction
+        ? '__Secure-next-auth.session-token'
+        : 'next-auth.session-token';
+    const cookieOptions = {
+        httpOnly: true,
+        secure: isProduction,
+        sameSite: isProduction ? 'none' : 'lax',
+        path: '/',
+        maxAge: 30 * 24 * 60 * 60, // 30일
+    };
+    if (cookieDomain) {
+        cookieOptions.domain = cookieDomain;
+    }
+    response.cookies.set(nextAuthCookieName, nextAuthToken, cookieOptions);
+    debugLog('createAuthResponse', 'NextAuth session cookie set:', nextAuthCookieName);
+    // 5. 커스텀 토큰 쿠키 설정
     if (refreshToken) {
         setCustomTokens(response, accessToken, refreshToken, {
             cookiePrefix,
@@ -886,22 +909,44 @@ async function handleJWTCallback(token, user, account, options) {
         debugLog('handleJWTCallback', 'Initial login, creating token from user data');
         return createInitialJWTToken(token, user, account);
     }
-    // 2. 토큰 유효성 체크
+    // 2. 커스텀 토큰 쿠키 우선 체크 (middleware에서 refresh한 토큰이 있을 수 있음)
+    if (secret && licenseKey && serviceId) {
+        const cookieNameToUse = cookieName || `${serviceId}_access_token`;
+        debugLog('handleJWTCallback', 'Checking custom token cookie first:', cookieNameToUse);
+        const customJwt = await getJWTFromCustomTokenCookie(cookieNameToUse, secret, serviceId, licenseKey);
+        if (customJwt) {
+            debugLog('handleJWTCallback', 'Found valid custom token cookie, using it');
+            // refreshToken이 있으면 유지
+            if (token.refreshToken) {
+                customJwt.refreshToken = token.refreshToken;
+            }
+            return customJwt;
+        }
+        debugLog('handleJWTCallback', 'No valid custom token cookie found');
+    }
+    // 3. 토큰 유효성 체크
     const now = Date.now();
     const expires = token.accessTokenExpires;
     const hasValidToken = token.id && expires && expires > now;
     const refreshToken = token.refreshToken;
-    // 2-1. nextauth token이 있고 만료되지 않았으면 그대로 사용
+    debugLog('handleJWTCallback', 'Token status:', {
+        hasId: !!token.id,
+        hasExpires: !!expires,
+        expiresIn: expires ? Math.round((expires - now) / 1000) + 's' : 'N/A',
+        hasValidToken,
+        hasRefreshToken: !!refreshToken,
+    });
+    // 3-1. nextauth token이 있고 만료되지 않았으면 그대로 사용
     if (hasValidToken) {
         debugLog('handleJWTCallback', 'Token is still valid, using existing token');
         return token;
     }
-    // 2-2. nextauth token이 없거나 만료됨 → refresh token으로 갱신 시도
+    // 3-2. nextauth token이 없거나 만료됨 → refresh token으로 갱신 시도
     // (refreshToken이 있고 SSO 설정이 있을 때만)
     if (refreshToken && ssoBaseURL && authServiceKey && secret) {
-        debugLog('handleJWTCallback', 'Token invalid or expired, attempting refresh');
+        debugLog('handleJWTCallback', 'Token invalid or expired, attempting SSO refresh');
         try {
-            debugLog('handleJWTCallback', 'Calling SSO refresh endpoint');
+            debugLog('handleJWTCallback', 'Calling SSO refresh endpoint:', `${ssoBaseURL}/api/sso/refresh`);
             const response = await fetch(`${ssoBaseURL}/api/sso/refresh`, {
                 method: 'POST',
                 headers: {
@@ -910,10 +955,11 @@ async function handleJWTCallback(token, user, account, options) {
                 },
                 body: JSON.stringify({ refreshToken }),
             });
+            debugLog('handleJWTCallback', 'SSO refresh response status:', response.status);
             if (response.ok) {
                 const result = await response.json();
                 if (result.success && result.accessToken) {
-                    debugLog('handleJWTCallback', 'Successfully refreshed token');
+                    debugLog('handleJWTCallback', 'Successfully refreshed token from SSO');
                     // 새 액세스 토큰 검증 및 페이로드 추출
                     const tokenResult = await verifyToken(result.accessToken, secret);
                     if (tokenResult) {
@@ -926,35 +972,27 @@ async function handleJWTCallback(token, user, account, options) {
                     }
                 }
             }
-            debugLog('handleJWTCallback', 'Failed to refresh token, SSO response not ok');
+            debugLog('handleJWTCallback', 'Failed to refresh token from SSO');
         }
         catch (error) {
             console.error('[handleJWTCallback] Error refreshing token:', error);
         }
     }
     else {
-        debugLog('handleJWTCallback', 'Cannot refresh - missing refresh token or SSO config');
+        debugLog('handleJWTCallback', 'Cannot refresh - missing requirements:', {
+            hasRefreshToken: !!refreshToken,
+            hasSSO: !!ssoBaseURL,
+            hasAuthKey: !!authServiceKey,
+            hasSecret: !!secret,
+        });
     }
-    // 3. refresh 실패 시 - 기존 토큰이 있으면 반환
+    // 4. refresh 실패 시 - 기존 토큰이 있으면 반환
     if (token.id) {
         debugLog('handleJWTCallback', 'Refresh failed, returning existing token (possibly expired)');
         return token;
     }
-    // 4. 토큰에 id가 없는 경우 - 커스텀 토큰 쿠키에서 정보 읽기
-    debugLog('handleJWTCallback', 'Token has no id, checking custom token cookie');
-    if (secret && licenseKey && serviceId) {
-        const cookieNameToUse = cookieName || `${serviceId}_access_token`;
-        const jwt = await getJWTFromCustomTokenCookie(cookieNameToUse, secret, serviceId, licenseKey);
-        if (jwt) {
-            debugLog('handleJWTCallback', 'Successfully created JWT from custom token cookie');
-            return jwt;
-        }
-        debugLog('handleJWTCallback', 'Failed to create JWT from custom token cookie');
-    }
-    else {
-        debugLog('handleJWTCallback', 'Missing required parameters for custom token reading');
-    }
-    debugLog('handleJWTCallback', 'Returning original token');
+    // 5. 모든 시도 실패 - 빈 토큰 반환
+    debugLog('handleJWTCallback', 'All attempts failed, returning empty token');
     return token;
 }
 /**

package/package.json

@@ -1,6 +1,6 @@
 {
   "name": "@thinkingcat/auth-utils",
-  "version": "1.0.21",
+  "version": "1.0.23",
   "description": "Authentication utilities for ThinkingCat SSO services with conditional logging",
   "main": "dist/index.js",
   "types": "dist/index.d.ts",