@wisemen/payload-core-auth 0.0.0 → 0.0.1

package/LICENSE.md

@@ -0,0 +1,59 @@
+# PolyForm Strict License 1.0.0
+
+<https://polyformproject.org/licenses/strict/1.0.0>
+
+## Acceptance
+
+In order to get any license under these terms, you must agree to them as both strict obligations and conditions to all your licenses.
+
+## Copyright License
+
+The licensor grants you a copyright license for the software to do everything you might do with the software that would otherwise infringe the licensor's copyright in it for any permitted purpose, other than distributing the software or making changes or new works based on the software.
+
+## Patent License
+
+The licensor grants you a patent license for the software that covers patent claims the licensor can license, or becomes able to license, that you would infringe by using the software.
+
+## Noncommercial Purposes
+
+Any noncommercial purpose is a permitted purpose.
+
+## Personal Uses
+
+Personal use for research, experiment, and testing for the benefit of public knowledge, personal study, private entertainment, hobby projects, amateur pursuits, or religious observance, without any anticipated commercial application, is use for a permitted purpose.
+
+## Noncommercial Organizations
+
+Use by any charitable organization, educational institution, public research organization, public safety or health organization, environmental protection organization, or government institution is use for a permitted purpose regardless of the source of funding or obligations resulting from the funding.
+
+## Fair Use
+
+You may have "fair use" rights for the software under the law. These terms do not limit them.
+
+## No Other Rights
+
+These terms do not allow you to sublicense or transfer any of your licenses to anyone else, or prevent the licensor from granting licenses to anyone else.  These terms do not imply any other licenses.
+
+## Patent Defense
+
+If you make any written claim that the software infringes or contributes to infringement of any patent, your patent license for the software granted under these terms ends immediately. If your company makes such a claim, your patent license ends immediately for work on behalf of your company.
+
+## Violations
+
+The first time you are notified in writing that you have violated any of these terms, or done anything with the software not covered by your licenses, your licenses can nonetheless continue if you come into full compliance with these terms, and take practical steps to correct past violations, within 32 days of receiving notice.  Otherwise, all your licenses end immediately.
+
+## No Liability
+
+***As far as the law allows, the software comes as is, without any warranty or condition, and the licensor will not be liable to you for any damages arising out of these terms or the use or nature of the software, under any kind of legal claim.***
+
+## Definitions
+
+The **licensor** is the individual or entity offering these terms, and the **software** is the software the licensor makes available under these terms.
+
+**You** refers to the individual or entity agreeing to these terms.
+
+**Your company** is any legal entity, sole proprietorship, or other kind of organization that you work for, plus all organizations that have control over, are under the control of, or are under common control with that organization.  **Control** means ownership of substantially all the assets of an entity, or the power to direct its management and policies by vote, contract, or otherwise.  Control can be direct or indirect.
+
+**Your licenses** are all the licenses granted to you for the software under these terms.
+
+**Use** means anything you do with the software requiring one of your licenses.

package/dist/authData-BieBPsYC.mjs

@@ -0,0 +1,121 @@
+import { deleteCookie, getCookie, setCookie } from "cookies-next";
+import { z } from "zod";
+
+//#region src/providers/providerStrategy.ts
+function getZitadelScopes(organizationId) {
+	return [
+		"openid",
+		"profile",
+		"email",
+		"offline_access",
+		`urn:zitadel:iam:org:id:${organizationId}`
+	];
+}
+async function parseAuthResponse(response, errorMessage) {
+	if (!response.ok) throw new Error(`${errorMessage}: ${await response.text()}`);
+	return response.json();
+}
+const zitadelClientStrategy = {
+	exchangeAuthorizationCode: async ({ clientId, organizationId, authBaseUrl, cmsBaseUrl, code, codeVerifier }) => parseAuthResponse(await fetch(`${authBaseUrl}/oauth/v2/token`, {
+		body: new URLSearchParams({
+			client_id: clientId,
+			code,
+			code_verifier: codeVerifier,
+			grant_type: "authorization_code",
+			redirect_uri: `${cmsBaseUrl}/auth/callback`,
+			scope: getZitadelScopes(organizationId).join(" ")
+		}),
+		headers: { "Content-Type": "application/x-www-form-urlencoded" },
+		method: "POST"
+	}), "Failed to exchange authorization code"),
+	getLoginUrl: ({ clientId, organizationId, authBaseUrl, cmsBaseUrl, codeChallenge, searchParams }) => {
+		searchParams.append("client_id", clientId);
+		searchParams.append("redirect_uri", `${cmsBaseUrl}/auth/callback`);
+		searchParams.append("response_type", "code");
+		searchParams.append("prompt", "login");
+		searchParams.append("scope", getZitadelScopes(organizationId).join(" "));
+		searchParams.append("code_challenge", codeChallenge);
+		searchParams.append("code_challenge_method", "S256");
+		return `${authBaseUrl}/oauth/v2/authorize?${searchParams.toString()}`;
+	},
+	refreshToken: async ({ clientId, authBaseUrl, refreshToken }) => parseAuthResponse(await fetch(`${authBaseUrl}/oauth/v2/token`, {
+		body: new URLSearchParams({
+			client_id: clientId,
+			grant_type: "refresh_token",
+			refresh_token: refreshToken
+		}),
+		headers: { "Content-Type": "application/x-www-form-urlencoded" },
+		method: "POST"
+	}), "Failed to refresh token")
+};
+function getAuthClientStrategy(provider) {
+	switch (provider) {
+		case "zitadel": return zitadelClientStrategy;
+		default: throw new Error(`Unsupported auth provider: ${provider}`);
+	}
+}
+
+//#endregion
+//#region src/shared/authData.ts
+const AUTH_COOKIE_NAME = "tokens";
+const CODE_CHALLENGE_COOKIE_NAME = "code_challenge";
+const CODE_VERIFIER_COOKIE_NAME = "code_verifier";
+const EXPIRED_AUTH_COOKIE = `${AUTH_COOKIE_NAME}=; Max-Age=0; Path=/; Expires=Thu, 01 Jan 1970 00:00:00 GMT`;
+const tokensSchema = z.object({
+	expires_at: z.number(),
+	access_token: z.string(),
+	refresh_token: z.string(),
+	token_type: z.string()
+});
+function setAuthCookie(authResponse, context) {
+	const expiresAt = Date.now() + authResponse.expires_in * 1e3;
+	const tokens = {
+		expires_at: expiresAt,
+		access_token: authResponse.access_token,
+		refresh_token: authResponse.refresh_token,
+		token_type: authResponse.token_type
+	};
+	setCookie(AUTH_COOKIE_NAME, JSON.stringify(tokens), {
+		...context,
+		maxAge: authResponse.expires_in,
+		sameSite: "lax",
+		path: "/"
+	});
+	return {
+		expiresAt,
+		accessToken: authResponse.access_token,
+		refreshToken: authResponse.refresh_token
+	};
+}
+async function getAuthData({ req, res }) {
+	const tokensCookie = await getCookie(AUTH_COOKIE_NAME, {
+		req,
+		res
+	});
+	if (typeof tokensCookie !== "string") return null;
+	const parsedTokens = tokensSchema.safeParse(JSON.parse(tokensCookie));
+	if (!parsedTokens.success) return null;
+	return {
+		expiresAt: Number(parsedTokens.data.expires_at),
+		accessToken: parsedTokens.data.access_token,
+		refreshToken: parsedTokens.data.refresh_token
+	};
+}
+function removeAuthCookie(context) {
+	deleteCookie(AUTH_COOKIE_NAME, {
+		...context,
+		path: "/"
+	});
+}
+function removePkceCookies() {
+	deleteCookie(CODE_CHALLENGE_COOKIE_NAME, { path: "/" });
+	deleteCookie(CODE_VERIFIER_COOKIE_NAME, { path: "/" });
+}
+function getRemoveAuthCookieHeaders() {
+	const headers = new Headers();
+	headers.append("Set-Cookie", EXPIRED_AUTH_COOKIE);
+	return headers;
+}
+
+//#endregion
+export { getRemoveAuthCookieHeaders as a, setAuthCookie as c, getAuthData as i, tokensSchema as l, CODE_CHALLENGE_COOKIE_NAME as n, removeAuthCookie as o, CODE_VERIFIER_COOKIE_NAME as r, removePkceCookies as s, AUTH_COOKIE_NAME as t, getAuthClientStrategy as u };

package/dist/authData-Cs0WZKng.d.mts

@@ -0,0 +1,54 @@
+import { n as AuthProviderType } from "./payloadAuth.types-pFZl0rQd.mjs";
+import { z } from "zod";
+import { NextRequest, NextResponse } from "next/server";
+
+//#region src/shared/authData.d.ts
+declare const AUTH_COOKIE_NAME = "tokens";
+declare const CODE_CHALLENGE_COOKIE_NAME = "code_challenge";
+declare const CODE_VERIFIER_COOKIE_NAME = "code_verifier";
+declare const tokensSchema: z.ZodObject<{
+  expires_at: z.ZodNumber;
+  access_token: z.ZodString;
+  refresh_token: z.ZodString;
+  token_type: z.ZodString;
+}, z.core.$strip>;
+interface AuthResponse {
+  access_token: string;
+  expires_in: number;
+  id_token?: string;
+  refresh_token: string;
+  token_type: string;
+}
+interface AuthData {
+  expiresAt: number;
+  accessToken: string;
+  refreshToken: string;
+}
+interface AuthClientConfig {
+  clientId: string;
+  organizationId: string;
+  authBaseUrl: string;
+  cmsBaseUrl: string;
+  provider: AuthProviderType;
+}
+interface CookieContext {
+  req?: NextRequest;
+  res?: NextResponse;
+}
+declare function setAuthCookie(authResponse: AuthResponse, context?: CookieContext): {
+  expiresAt: number;
+  accessToken: string;
+  refreshToken: string;
+};
+declare function getAuthData({
+  req,
+  res
+}: {
+  req: NextRequest;
+  res: NextResponse;
+}): Promise<AuthData | null>;
+declare function removeAuthCookie(context?: CookieContext): void;
+declare function removePkceCookies(): void;
+declare function getRemoveAuthCookieHeaders(): Headers;
+//#endregion
+export { CODE_CHALLENGE_COOKIE_NAME as a, getAuthData as c, removePkceCookies as d, setAuthCookie as f, AuthResponse as i, getRemoveAuthCookieHeaders as l, AuthClientConfig as n, CODE_VERIFIER_COOKIE_NAME as o, tokensSchema as p, AuthData as r, CookieContext as s, AUTH_COOKIE_NAME as t, removeAuthCookie as u };

package/dist/client.d.mts

@@ -0,0 +1,55 @@
+import { n as AuthProviderType } from "./payloadAuth.types-pFZl0rQd.mjs";
+import { n as AuthClientConfig } from "./authData-Cs0WZKng.mjs";
+import * as react0 from "react";
+import React from "react";
+
+//#region src/client/components/CallbackView.d.ts
+interface CallbackViewProps {
+  clientId: string;
+  organizationId: string;
+  authBaseUrl: string;
+  cmsBaseUrl: string;
+  provider: AuthProviderType;
+}
+declare function CallbackView({
+  clientId,
+  organizationId,
+  authBaseUrl,
+  cmsBaseUrl,
+  provider
+}: CallbackViewProps): react0.JSX.Element;
+//#endregion
+//#region src/client/components/LoginButton.d.ts
+interface LoginButtonProps extends AuthClientConfig {
+  label?: string;
+}
+declare function LoginButton({
+  clientId,
+  organizationId,
+  authBaseUrl,
+  cmsBaseUrl,
+  label,
+  provider
+}: LoginButtonProps): React.JSX.Element;
+//#endregion
+//#region src/client/loginWithCode.d.ts
+interface LoginWithCodeParams extends AuthClientConfig {
+  code: string;
+  codeVerifier: string;
+}
+declare function loginWithCode({
+  clientId,
+  organizationId,
+  authBaseUrl,
+  cmsBaseUrl,
+  code,
+  codeVerifier,
+  provider
+}: LoginWithCodeParams): Promise<{
+  success: boolean;
+}>;
+//#endregion
+//#region src/client/logout.d.ts
+declare function logout(): void;
+//#endregion
+export { CallbackView, LoginButton, loginWithCode, logout };

package/dist/client.mjs

@@ -0,0 +1,141 @@
+'use client';
+
+import { c as setAuthCookie, n as CODE_CHALLENGE_COOKIE_NAME, o as removeAuthCookie, r as CODE_VERIFIER_COOKIE_NAME, s as removePkceCookies, u as getAuthClientStrategy } from "./authData-BieBPsYC.mjs";
+import { getCookie } from "cookies-next";
+import { LoadingOverlay } from "@payloadcms/ui";
+import { redirect, useRouter, useSearchParams } from "next/navigation";
+import React, { useEffect, useState } from "react";
+import { jsx } from "react/jsx-runtime";
+import { setCookie as setCookie$1 } from "cookies-next/client";
+import pkceChallenge from "pkce-challenge";
+
+//#region src/client/loginWithCode.ts
+async function loginWithCode({ clientId, organizationId, authBaseUrl, cmsBaseUrl, code, codeVerifier, provider }) {
+	if (!codeVerifier) throw new Error("Code verifier not found");
+	setAuthCookie(await getAuthClientStrategy(provider).exchangeAuthorizationCode({
+		clientId,
+		organizationId,
+		authBaseUrl,
+		cmsBaseUrl,
+		code,
+		codeVerifier
+	}));
+	removePkceCookies();
+	return { success: true };
+}
+
+//#endregion
+//#region src/client/components/CallbackView.tsx
+function CallbackView({ clientId, organizationId, authBaseUrl, cmsBaseUrl, provider }) {
+	const code = useSearchParams()?.get("code");
+	const router = useRouter();
+	if (code == null) redirect("/login");
+	const codeVerifier = getCookie(CODE_VERIFIER_COOKIE_NAME);
+	useEffect(() => {
+		loginWithCode({
+			clientId,
+			organizationId,
+			authBaseUrl,
+			cmsBaseUrl,
+			code,
+			codeVerifier,
+			provider
+		}).then(({ success }) => {
+			if (success) {
+				router.push("/");
+				window.location.replace("/");
+			}
+		});
+	}, [
+		authBaseUrl,
+		clientId,
+		cmsBaseUrl,
+		code,
+		codeVerifier,
+		organizationId,
+		provider,
+		router
+	]);
+	return /* @__PURE__ */ jsx("div", {
+		style: {
+			alignItems: "center",
+			display: "flex",
+			flexDirection: "column",
+			gap: "2rem",
+			height: "100vh",
+			justifyContent: "center"
+		},
+		children: /* @__PURE__ */ jsx(LoadingOverlay, {})
+	});
+}
+
+//#endregion
+//#region src/client/components/LoginButton.tsx
+async function getLoginUrl({ clientId, organizationId, authBaseUrl, cmsBaseUrl, provider }) {
+	const searchParams = new URLSearchParams();
+	let codeChallenge = await getCookie(CODE_CHALLENGE_COOKIE_NAME);
+	const codeVerifier = await getCookie(CODE_VERIFIER_COOKIE_NAME);
+	if (codeChallenge == null || codeVerifier == null) {
+		const codes = await pkceChallenge();
+		setCookie$1(CODE_CHALLENGE_COOKIE_NAME, codes.code_challenge, {
+			sameSite: "lax",
+			path: "/"
+		});
+		setCookie$1(CODE_VERIFIER_COOKIE_NAME, codes.code_verifier, {
+			sameSite: "lax",
+			path: "/"
+		});
+		codeChallenge = codes.code_challenge;
+	}
+	return getAuthClientStrategy(provider).getLoginUrl({
+		clientId,
+		organizationId,
+		authBaseUrl,
+		cmsBaseUrl,
+		codeChallenge: String(codeChallenge),
+		searchParams
+	});
+}
+function LoginButton({ clientId, organizationId, authBaseUrl, cmsBaseUrl, label = "Sign in", provider }) {
+	const [url, setUrl] = useState(null);
+	useEffect(() => {
+		getLoginUrl({
+			clientId,
+			organizationId,
+			authBaseUrl,
+			cmsBaseUrl,
+			label,
+			provider
+		}).then((value) => {
+			setUrl(value);
+		});
+	}, [
+		authBaseUrl,
+		clientId,
+		cmsBaseUrl,
+		label,
+		organizationId,
+		provider
+	]);
+	return /* @__PURE__ */ jsx("div", { children: /* @__PURE__ */ jsx("a", {
+		className: `
+          btn btn--style-primary btn--icon-style-without-border btn--size-medium
+        `,
+		style: {
+			display: "block",
+			textAlign: "center",
+			width: "100%"
+		},
+		href: url ?? "",
+		children: label
+	}) });
+}
+
+//#endregion
+//#region src/client/logout.ts
+function logout() {
+	removeAuthCookie();
+}
+
+//#endregion
+export { CallbackView, LoginButton, loginWithCode, logout };

package/dist/index.d.mts

@@ -0,0 +1,73 @@
+import { a as CreateAuthStrategyParams, c as CreatePayloadAuthPluginParams, d as CreateZitadelUserHookParams, f as PayloadAuthPluginResult, g as createPayloadCollectionAuth, i as BaseUserRecordWithId, l as CreatePayloadCollectionAuthParams, m as PublicAuthConfig, n as AuthProviderType, o as CreateAuthUserHookParams, p as PayloadAuthProvider, r as BaseUserRecord, s as CreateFirstUserConfig, t as AuthEnv, u as CreateZitadelAuthStrategyParams } from "./payloadAuth.types-pFZl0rQd.mjs";
+import { a as CODE_CHALLENGE_COOKIE_NAME, c as getAuthData, d as removePkceCookies, f as setAuthCookie, i as AuthResponse, l as getRemoveAuthCookieHeaders, n as AuthClientConfig, o as CODE_VERIFIER_COOKIE_NAME, p as tokensSchema, r as AuthData, s as CookieContext, t as AUTH_COOKIE_NAME, u as removeAuthCookie } from "./authData-Cs0WZKng.mjs";
+import { AuthStrategy, AuthStrategyResult, CollectionAfterChangeHook, TypeWithID } from "payload";
+
+//#region src/plugin/payloadAuthPlugin.d.ts
+declare function createPayloadAuthPlugin<TUser extends BaseUserRecordWithId>({
+  isUserAllowed,
+  authConfig,
+  createFirstUser,
+  provider,
+  shouldSkipUserSync,
+  tenantCollectionSlug,
+  tokenRefreshBufferMs,
+  userCollectionSlug
+}: CreatePayloadAuthPluginParams<TUser>): PayloadAuthPluginResult;
+//#endregion
+//#region src/providers/providerStrategy.d.ts
+interface GetLoginUrlParams {
+  clientId: string;
+  organizationId: string;
+  authBaseUrl: string;
+  cmsBaseUrl: string;
+  codeChallenge: string;
+  searchParams: URLSearchParams;
+}
+interface ExchangeAuthorizationCodeParams {
+  clientId: string;
+  organizationId: string;
+  authBaseUrl: string;
+  cmsBaseUrl: string;
+  code: string;
+  codeVerifier: string;
+}
+interface RefreshProviderTokenParams {
+  clientId: string;
+  organizationId: string;
+  authBaseUrl: string;
+  refreshToken: string;
+}
+interface AuthClientStrategy {
+  exchangeAuthorizationCode: (params: ExchangeAuthorizationCodeParams) => Promise<AuthResponse>;
+  getLoginUrl: (params: GetLoginUrlParams) => string;
+  refreshToken: (params: RefreshProviderTokenParams) => Promise<AuthResponse>;
+}
+declare function getAuthClientStrategy(provider: AuthProviderType): AuthClientStrategy;
+//#endregion
+//#region src/providers/zitadel/zitadelProvider.d.ts
+declare function createZitadelAuthProvider<TUser extends BaseUserRecord & TypeWithID>(env: AuthEnv): PayloadAuthProvider<TUser>;
+//#endregion
+//#region src/providers/zitadel/zitadelStrategy.d.ts
+declare function createZitadelAuthStrategy<TUser extends BaseUserRecordWithId>({
+  isUserAllowed,
+  createFirstUser: createFirstUserConfig,
+  env,
+  userCollectionSlug
+}: CreateZitadelAuthStrategyParams<TUser>): AuthStrategy;
+//#endregion
+//#region src/providers/zitadel/zitadelUserHook.d.ts
+declare function createZitadelUserHook<TUser extends BaseUserRecordWithId>({
+  env,
+  shouldSkip
+}: CreateZitadelUserHookParams<TUser>): CollectionAfterChangeHook<TUser>;
+//#endregion
+//#region src/shared/constants.d.ts
+declare const DEFAULT_ACCESS_TOKEN_EXPIRATION: number;
+declare const DEFAULT_MAX_LOGIN_ATTEMPTS = 5;
+declare const DEFAULT_LOCK_TIME: number;
+//#endregion
+//#region src/shared/payloadAuth.shared.d.ts
+declare const USER_NOT_AUTHENTICATED: AuthStrategyResult;
+declare function getUnauthenticatedResult(clearAuth: boolean): AuthStrategyResult;
+//#endregion
+export { AUTH_COOKIE_NAME, AuthClientConfig, AuthData, AuthEnv, AuthProviderType, AuthResponse, BaseUserRecord, BaseUserRecordWithId, CODE_CHALLENGE_COOKIE_NAME, CODE_VERIFIER_COOKIE_NAME, CookieContext, CreateAuthStrategyParams, CreateAuthUserHookParams, CreateFirstUserConfig, CreatePayloadAuthPluginParams, CreatePayloadCollectionAuthParams, CreateZitadelAuthStrategyParams, CreateZitadelUserHookParams, DEFAULT_ACCESS_TOKEN_EXPIRATION, DEFAULT_LOCK_TIME, DEFAULT_MAX_LOGIN_ATTEMPTS, PayloadAuthPluginResult, PayloadAuthProvider, PublicAuthConfig, USER_NOT_AUTHENTICATED, createPayloadAuthPlugin, createPayloadCollectionAuth, createZitadelAuthProvider, createZitadelAuthStrategy, createZitadelUserHook, getAuthClientStrategy, getAuthData, getRemoveAuthCookieHeaders, getUnauthenticatedResult, removeAuthCookie, removePkceCookies, setAuthCookie, tokensSchema };

package/dist/index.mjs

@@ -0,0 +1,263 @@
+import { a as getRemoveAuthCookieHeaders, c as setAuthCookie, i as getAuthData, l as tokensSchema, n as CODE_CHALLENGE_COOKIE_NAME, o as removeAuthCookie, r as CODE_VERIFIER_COOKIE_NAME, s as removePkceCookies, t as AUTH_COOKIE_NAME, u as getAuthClientStrategy } from "./authData-BieBPsYC.mjs";
+import { getPayload } from "@wisemen/payload-core-utils";
+import { createRemoteJWKSet, errors, jwtVerify } from "jose";
+
+//#region src/shared/constants.ts
+const DEFAULT_ACCESS_TOKEN_EXPIRATION = 3600 * 24 * 30;
+const DEFAULT_MAX_LOGIN_ATTEMPTS = 5;
+const DEFAULT_LOCK_TIME = 600 * 1e3;
+
+//#endregion
+//#region src/plugin/payloadCollectionAuth.ts
+function createPayloadCollectionAuth({ lockTime = DEFAULT_LOCK_TIME, maxLoginAttempts = DEFAULT_MAX_LOGIN_ATTEMPTS, strategy, tokenExpiration = DEFAULT_ACCESS_TOKEN_EXPIRATION, verify = false }) {
+	return {
+		lockTime,
+		disableLocalStrategy: true,
+		maxLoginAttempts,
+		strategies: [strategy],
+		tokenExpiration,
+		verify
+	};
+}
+
+//#endregion
+//#region src/plugin/payloadAuthPlugin.ts
+function mergePublicAuthConfig(publicAuth, overrides) {
+	return {
+		clientId: overrides?.authClientId ?? publicAuth.authClientId,
+		organizationId: overrides?.authOrganizationId ?? publicAuth.authOrganizationId,
+		authBaseUrl: overrides?.authBaseUrl ?? publicAuth.authBaseUrl,
+		cmsBaseUrl: overrides?.cmsBaseUrl ?? publicAuth.cmsBaseUrl,
+		provider: overrides?.provider ?? publicAuth.provider
+	};
+}
+function createPayloadAuthPlugin({ isUserAllowed, authConfig, createFirstUser: createFirstUser$1, provider, shouldSkipUserSync, tenantCollectionSlug, tokenRefreshBufferMs, userCollectionSlug }) {
+	const strategy = provider.createStrategy({
+		isUserAllowed,
+		createFirstUser: createFirstUser$1 ?? {
+			tenantCollectionSlug,
+			userData: ({ email }) => ({ email })
+		},
+		userCollectionSlug
+	});
+	const userHook = provider.createUserHook({ shouldSkip: shouldSkipUserSync });
+	const publicAuth = provider.getPublicConfig();
+	return {
+		auth: publicAuth,
+		createCollectionAuth: (overrides) => createPayloadCollectionAuth({
+			...authConfig,
+			...overrides,
+			strategy
+		}),
+		getCallbackViewProps: (overrides) => mergePublicAuthConfig(publicAuth, overrides),
+		getLoginButtonProps: (overrides) => mergePublicAuthConfig(publicAuth, overrides),
+		middleware: async (middlewareState) => {
+			const { withPayloadTokenAuth } = await import("./withPayloadTokenAuth-CthBSj8k.mjs");
+			return withPayloadTokenAuth(middlewareState, {
+				auth: provider.getMiddlewareAuthConfig(),
+				tokenRefreshBufferMs
+			});
+		},
+		plugin: () => (incomingConfig) => incomingConfig,
+		strategy,
+		userHook
+	};
+}
+
+//#endregion
+//#region src/shared/payloadAuth.shared.ts
+const USER_NOT_AUTHENTICATED = { user: null };
+function getUnauthenticatedResult(clearAuth) {
+	if (!clearAuth) return USER_NOT_AUTHENTICATED;
+	return {
+		responseHeaders: getRemoveAuthCookieHeaders(),
+		user: null
+	};
+}
+
+//#endregion
+//#region src/providers/zitadel/zitadelStrategy.ts
+async function findUserByEmail({ userCollectionSlug, userEmail }) {
+	return (await (await getPayload()).find({
+		collection: userCollectionSlug,
+		limit: 1,
+		overrideAccess: true,
+		where: { email: { equals: userEmail } }
+	})).docs[0];
+}
+async function createFirstUser({ createFirstUserConfig, userCollectionSlug, userEmail }) {
+	const payload = await getPayload();
+	if (createFirstUserConfig == null) return USER_NOT_AUTHENTICATED;
+	const existingUserWithEmail = await findUserByEmail({
+		userCollectionSlug,
+		userEmail
+	});
+	if (existingUserWithEmail != null) return { user: {
+		...existingUserWithEmail,
+		collection: userCollectionSlug
+	} };
+	if ((await payload.find({
+		collection: userCollectionSlug,
+		limit: 1,
+		overrideAccess: true
+	})).docs.length > 0) return USER_NOT_AUTHENTICATED;
+	let existingTenant = (await payload.find({
+		collection: createFirstUserConfig.tenantCollectionSlug,
+		limit: 1,
+		overrideAccess: true
+	})).docs[0];
+	existingTenant ??= await payload.create({
+		collection: createFirstUserConfig.tenantCollectionSlug,
+		data: createFirstUserConfig.createTenantData?.() ?? { title: "Default" },
+		overrideAccess: true
+	});
+	if (existingTenant == null) throw new Error("Failed to resolve tenant for first user creation");
+	try {
+		return { user: {
+			...await payload.create({
+				collection: userCollectionSlug,
+				data: createFirstUserConfig.userData({
+					tenantId: existingTenant.id,
+					isFirstUser: true,
+					email: userEmail
+				}),
+				draft: false,
+				overrideAccess: true
+			}),
+			collection: userCollectionSlug
+		} };
+	} catch (error) {
+		const userCreatedConcurrently = await findUserByEmail({
+			userCollectionSlug,
+			userEmail
+		});
+		if (userCreatedConcurrently != null) return { user: {
+			...userCreatedConcurrently,
+			collection: userCollectionSlug
+		} };
+		throw error;
+	}
+}
+function createZitadelAuthStrategy({ isUserAllowed, createFirstUser: createFirstUserConfig, env, userCollectionSlug }) {
+	return {
+		name: "zitadel",
+		authenticate: async (ctx) => {
+			const bearerToken = ctx.headers.get("Authorization")?.split(" ")[1];
+			if (bearerToken == null) return USER_NOT_AUTHENTICATED;
+			const jwk = createRemoteJWKSet(new URL(env.authJwksEndpoint));
+			try {
+				const userEmail = (await jwtVerify(bearerToken, jwk, {
+					issuer: env.authIssuer,
+					audience: env.authClientId
+				})).payload.email;
+				if (typeof userEmail !== "string" || userEmail.length === 0) return USER_NOT_AUTHENTICATED;
+				const singleUser = await findUserByEmail({
+					userCollectionSlug,
+					userEmail
+				});
+				if (singleUser == null) return createFirstUser({
+					createFirstUserConfig,
+					userCollectionSlug,
+					userEmail
+				});
+				if (!isUserAllowed(singleUser)) return USER_NOT_AUTHENTICATED;
+				return { user: {
+					...singleUser,
+					collection: userCollectionSlug
+				} };
+			} catch (error) {
+				if (error instanceof errors.JWTExpired) return getUnauthenticatedResult(Boolean(ctx.canSetHeaders));
+				return getUnauthenticatedResult(Boolean(ctx.canSetHeaders));
+			}
+		}
+	};
+}
+
+//#endregion
+//#region src/providers/zitadel/zitadelUserHook.ts
+function getZitadelAccessToken(authServiceUser) {
+	if (!authServiceUser) throw new Error("Missing authServiceUser");
+	return authServiceUser;
+}
+async function doesZitadelUserExist({ accessToken, authBaseUrl, email }) {
+	const searchResponse = await fetch(`${authBaseUrl}/v2/users`, {
+		body: JSON.stringify({ queries: [{ emailQuery: {
+			emailAddress: email,
+			method: "TEXT_QUERY_METHOD_EQUALS"
+		} }] }),
+		headers: {
+			"Authorization": `Bearer ${accessToken}`,
+			"Content-Type": "application/json"
+		},
+		method: "POST"
+	});
+	if (!searchResponse.ok) throw new Error(`Failed to search Zitadel users: ${await searchResponse.text()}`);
+	const searchBody = await searchResponse.json();
+	return Array.isArray(searchBody.result) && searchBody.result.length > 0;
+}
+function createZitadelUserHook({ env, shouldSkip }) {
+	return async ({ data, operation }) => {
+		if (operation !== "create") return;
+		if (shouldSkip?.(data)) return;
+		const email = data.email;
+		if (!email) throw new Error("Cannot create Zitadel user without email");
+		const accessToken = getZitadelAccessToken(env.authServiceUser);
+		if (await doesZitadelUserExist({
+			accessToken,
+			authBaseUrl: env.authBaseUrl,
+			email
+		})) return;
+		const displayName = [data.firstName, data.lastName].filter(Boolean).join(" ") || email;
+		const createResponse = await fetch(`${env.authBaseUrl}/v2/users/human`, {
+			body: JSON.stringify({
+				email: {
+					email,
+					sendCode: {}
+				},
+				organization: { orgId: env.authOrganizationId },
+				profile: {
+					displayName,
+					familyName: data.lastName || email,
+					givenName: data.firstName || email
+				}
+			}),
+			headers: {
+				"Authorization": `Bearer ${accessToken}`,
+				"Content-Type": "application/json"
+			},
+			method: "POST"
+		});
+		if (!createResponse.ok) throw new Error(`Failed to create Zitadel user: ${await createResponse.text()}`);
+	};
+}
+
+//#endregion
+//#region src/providers/zitadel/zitadelProvider.ts
+function createZitadelAuthProvider(env) {
+	return {
+		createStrategy: (params) => createZitadelAuthStrategy({
+			...params,
+			env
+		}),
+		createUserHook: (params) => createZitadelUserHook({
+			...params,
+			env
+		}),
+		getMiddlewareAuthConfig: () => ({
+			authClientId: env.authClientId,
+			authOrganizationId: env.authOrganizationId,
+			authBaseUrl: env.authBaseUrl,
+			provider: "zitadel"
+		}),
+		getPublicConfig: () => ({
+			authClientId: env.authClientId,
+			authOrganizationId: env.authOrganizationId,
+			authBaseUrl: env.authBaseUrl,
+			cmsBaseUrl: env.cmsBaseUrl,
+			provider: "zitadel"
+		})
+	};
+}
+
+//#endregion
+export { AUTH_COOKIE_NAME, CODE_CHALLENGE_COOKIE_NAME, CODE_VERIFIER_COOKIE_NAME, DEFAULT_ACCESS_TOKEN_EXPIRATION, DEFAULT_LOCK_TIME, DEFAULT_MAX_LOGIN_ATTEMPTS, USER_NOT_AUTHENTICATED, createPayloadAuthPlugin, createPayloadCollectionAuth, createZitadelAuthProvider, createZitadelAuthStrategy, createZitadelUserHook, getAuthClientStrategy, getAuthData, getRemoveAuthCookieHeaders, getUnauthenticatedResult, removeAuthCookie, removePkceCookies, setAuthCookie, tokensSchema };

package/dist/payloadAuth.types-pFZl0rQd.d.mts

@@ -0,0 +1,138 @@
+import { NextRequest, NextResponse } from "next/server";
+import { AuthStrategy, CollectionAfterChangeHook, CollectionConfig, Plugin, TypeWithID } from "payload";
+
+//#region src/plugin/payloadCollectionAuth.d.ts
+declare function createPayloadCollectionAuth({
+  lockTime,
+  maxLoginAttempts,
+  strategy,
+  tokenExpiration,
+  verify
+}: CreatePayloadCollectionAuthParams & {
+  strategy: AuthStrategy;
+}): NonNullable<CollectionConfig['auth']>;
+//#endregion
+//#region src/server/withPayloadTokenAuth.d.ts
+interface AuthEnv$1 {
+  authClientId: string;
+  authOrganizationId: string;
+  authBaseUrl: string;
+  provider: AuthProviderType;
+}
+interface MiddlewareState {
+  request: NextRequest;
+  response: NextResponse;
+}
+interface WithPayloadTokenAuthParams {
+  auth: AuthEnv$1;
+  loginPath?: string;
+  tokenRefreshBufferMs?: number;
+}
+declare function withPayloadTokenAuth(middlewareState: MiddlewareState, {
+  auth,
+  loginPath,
+  tokenRefreshBufferMs
+}: WithPayloadTokenAuthParams): Promise<MiddlewareState>;
+//#endregion
+//#region src/shared/payloadAuth.types.d.ts
+interface BaseUserRecord {
+  email?: string | null;
+  firstName?: string | null;
+  lastName?: string | null;
+  role?: string | null;
+  username?: string;
+}
+interface BaseUserRecordWithId extends BaseUserRecord {
+  id: number | string;
+}
+interface AuthEnv {
+  authClientId: string;
+  authOrganizationId: string;
+  authBaseUrl: string;
+  authIssuer: string;
+  authJwksEndpoint: string;
+  authServiceUser: string;
+  cmsBaseUrl: string;
+}
+type AuthProviderType = 'zitadel';
+interface CreateFirstUserConfig {
+  createTenantData?: () => Record<string, unknown>;
+  tenantCollectionSlug: string;
+  userData: (params: {
+    tenantId: number | string;
+    isFirstUser: boolean;
+    email: string;
+  }) => Record<string, unknown>;
+}
+interface CreateZitadelAuthStrategyParams<TUser extends BaseUserRecord> {
+  isUserAllowed: (user: TUser) => boolean;
+  createFirstUser?: CreateFirstUserConfig;
+  env: AuthEnv;
+  userCollectionSlug: string;
+}
+interface CreateZitadelUserHookParams<TUser extends BaseUserRecord & TypeWithID> {
+  env: AuthEnv;
+  shouldSkip?: (user: Partial<TUser>) => boolean;
+}
+interface CreatePayloadCollectionAuthParams {
+  lockTime?: number;
+  maxLoginAttempts?: number;
+  strategy: AuthStrategy;
+  tokenExpiration?: number;
+  verify?: boolean;
+}
+interface PublicAuthConfig {
+  authClientId: string;
+  authOrganizationId: string;
+  authBaseUrl: string;
+  cmsBaseUrl: string;
+  provider: AuthProviderType;
+}
+interface CreateAuthStrategyParams<TUser extends BaseUserRecord> {
+  isUserAllowed: (user: TUser) => boolean;
+  createFirstUser?: CreateFirstUserConfig;
+  userCollectionSlug: string;
+}
+interface CreateAuthUserHookParams<TUser extends BaseUserRecord & TypeWithID> {
+  shouldSkip?: (user: Partial<TUser>) => boolean;
+}
+interface PayloadAuthProvider<TUser extends BaseUserRecord & TypeWithID> {
+  createStrategy: (params: CreateAuthStrategyParams<TUser>) => AuthStrategy;
+  createUserHook: (params: CreateAuthUserHookParams<TUser>) => CollectionAfterChangeHook<TUser>;
+  getMiddlewareAuthConfig: () => Pick<PublicAuthConfig, 'authBaseUrl' | 'authClientId' | 'authOrganizationId' | 'provider'>;
+  getPublicConfig: () => PublicAuthConfig;
+}
+interface CreatePayloadAuthPluginParams<TUser extends BaseUserRecord & TypeWithID> {
+  isUserAllowed: (user: TUser) => boolean;
+  authConfig?: Omit<CreatePayloadCollectionAuthParams, 'strategy'>;
+  createFirstUser?: CreateFirstUserConfig;
+  provider: PayloadAuthProvider<TUser>;
+  shouldSkipUserSync?: (user: Partial<TUser>) => boolean;
+  tenantCollectionSlug: string;
+  tokenRefreshBufferMs?: number;
+  userCollectionSlug: string;
+}
+interface PayloadAuthPluginResult {
+  auth: PublicAuthConfig;
+  createCollectionAuth: (overrides?: Omit<CreatePayloadCollectionAuthParams, 'strategy'>) => ReturnType<typeof createPayloadCollectionAuth>;
+  getCallbackViewProps: (overrides?: Partial<PublicAuthConfig>) => {
+    clientId: string;
+    organizationId: string;
+    authBaseUrl: string;
+    cmsBaseUrl: string;
+    provider: AuthProviderType;
+  };
+  getLoginButtonProps: (overrides?: Partial<PublicAuthConfig>) => {
+    clientId: string;
+    organizationId: string;
+    authBaseUrl: string;
+    cmsBaseUrl: string;
+    provider: AuthProviderType;
+  };
+  middleware: (middlewareState: Parameters<typeof withPayloadTokenAuth>[0]) => Promise<Awaited<ReturnType<typeof withPayloadTokenAuth>>>;
+  plugin: () => Plugin;
+  strategy: AuthStrategy;
+  userHook: CollectionAfterChangeHook<any>;
+}
+//#endregion
+export { CreateAuthStrategyParams as a, CreatePayloadAuthPluginParams as c, CreateZitadelUserHookParams as d, PayloadAuthPluginResult as f, createPayloadCollectionAuth as g, withPayloadTokenAuth as h, BaseUserRecordWithId as i, CreatePayloadCollectionAuthParams as l, PublicAuthConfig as m, AuthProviderType as n, CreateAuthUserHookParams as o, PayloadAuthProvider as p, BaseUserRecord as r, CreateFirstUserConfig as s, AuthEnv as t, CreateZitadelAuthStrategyParams as u };

package/dist/server.d.mts

@@ -0,0 +1,26 @@
+import { h as withPayloadTokenAuth, n as AuthProviderType } from "./payloadAuth.types-pFZl0rQd.mjs";
+import { NextRequest, NextResponse } from "next/server";
+
+//#region src/server/refreshToken.d.ts
+interface RefreshTokenParams {
+  clientId: string;
+  organizationId: string;
+  authBaseUrl: string;
+  provider: AuthProviderType;
+  req: NextRequest;
+  res: NextResponse;
+}
+declare function refreshToken({
+  clientId,
+  organizationId,
+  authBaseUrl,
+  provider,
+  req,
+  res
+}: RefreshTokenParams): Promise<{
+  expiresAt: number;
+  accessToken: string;
+  refreshToken: string;
+}>;
+//#endregion
+export { refreshToken, withPayloadTokenAuth };

package/dist/server.mjs

@@ -0,0 +1,3 @@
+import { n as refreshToken, t as withPayloadTokenAuth } from "./withPayloadTokenAuth-DzS8Ryke.mjs";
+
+export { refreshToken, withPayloadTokenAuth };

package/dist/withPayloadTokenAuth-CthBSj8k.mjs

@@ -0,0 +1,3 @@
+import { t as withPayloadTokenAuth } from "./withPayloadTokenAuth-DzS8Ryke.mjs";
+
+export { withPayloadTokenAuth };

package/dist/withPayloadTokenAuth-DzS8Ryke.mjs

@@ -0,0 +1,62 @@
+import { a as getRemoveAuthCookieHeaders, c as setAuthCookie, i as getAuthData, u as getAuthClientStrategy } from "./authData-BieBPsYC.mjs";
+import { NextResponse } from "next/server";
+
+//#region src/server/refreshToken.ts
+async function refreshToken({ clientId, organizationId, authBaseUrl, provider, req, res }) {
+	const authData = await getAuthData({
+		req,
+		res
+	});
+	if (authData == null) throw new Error("Auth data not found");
+	return setAuthCookie(await getAuthClientStrategy(provider).refreshToken({
+		clientId,
+		organizationId,
+		authBaseUrl,
+		refreshToken: authData.refreshToken
+	}), {
+		req,
+		res
+	});
+}
+
+//#endregion
+//#region src/server/withPayloadTokenAuth.ts
+async function withPayloadTokenAuth(middlewareState, { auth, loginPath = "/login", tokenRefreshBufferMs = 3e4 }) {
+	const { request, response } = middlewareState;
+	if (request.nextUrl.pathname === loginPath) return middlewareState;
+	const authData = await getAuthData({
+		req: request,
+		res: response
+	});
+	if (authData == null) return middlewareState;
+	let accessToken = authData.accessToken;
+	if (authData.expiresAt <= Date.now() + tokenRefreshBufferMs) try {
+		accessToken = (await refreshToken({
+			clientId: auth.authClientId,
+			organizationId: auth.authOrganizationId,
+			authBaseUrl: auth.authBaseUrl,
+			provider: auth.provider,
+			req: request,
+			res: response
+		})).accessToken;
+	} catch {
+		const unauthenticatedResponse = NextResponse.next({ headers: response.headers });
+		for (const [key, value] of getRemoveAuthCookieHeaders().entries()) unauthenticatedResponse.headers.append(key, value);
+		return {
+			request,
+			response: unauthenticatedResponse
+		};
+	}
+	const requestHeaders = new Headers(request.headers);
+	requestHeaders.set("Authorization", `Bearer ${accessToken}`);
+	return {
+		request,
+		response: NextResponse.next({
+			headers: response.headers,
+			request: { headers: requestHeaders }
+		})
+	};
+}
+
+//#endregion
+export { refreshToken as n, withPayloadTokenAuth as t };

package/package.json

@@ -1,9 +1,71 @@
 {
   "name": "@wisemen/payload-core-auth",
-  "version": "0.0.0",
+  "type": "module",
+  "version": "0.0.1",
+  "private": false,
+  "imports": {
+    "#*": "./src/*"
+  },
   "repository": {
     "type": "git",
     "url": "https://github.com/wisemen-digital/wisemen-core",
     "directory": "packages/payload/auth"
+  },
+  "exports": {
+    ".": {
+      "types": "./dist/index.d.mts",
+      "import": "./dist/index.mjs"
+    },
+    "./client": {
+      "types": "./dist/client.d.mts",
+      "import": "./dist/client.mjs"
+    },
+    "./server": {
+      "types": "./dist/server.d.mts",
+      "import": "./dist/server.mjs"
+    }
+  },
+  "main": "./dist/index.mjs",
+  "module": "./dist/index.mjs",
+  "types": "./dist/index.d.mts",
+  "typings": "./dist/index.d.mts",
+  "sideEffects": false,
+  "files": [
+    "dist"
+  ],
+  "peerDependencies": {
+    "@payloadcms/ui": ">=3.85.0",
+    "next": ">=16.2.6",
+    "payload": ">=3.85.0",
+    "react": ">=19.2.7",
+    "@wisemen/payload-core-utils": "^0.0.1"
+  },
+  "dependencies": {
+    "cookies-next": "6.1.1",
+    "jose": "6.2.3",
+    "pkce-challenge": "6.0.0",
+    "zod": "4.3.5"
+  },
+  "devDependencies": {
+    "@payloadcms/ui": "3.85.2",
+    "@types/node": "24.8.1",
+    "@types/react": "19.2.17",
+    "@wisemen/eslint-config-vue": "2.1.3",
+    "eslint": "9.39.4",
+    "next": "16.2.6",
+    "payload": "3.85.2",
+    "react": "19.2.7",
+    "rimraf": "6.1.3",
+    "tsdown": "0.18.4",
+    "typescript": "5.9.3",
+    "@wisemen/payload-core-utils": "^0.0.1"
+  },
+  "scripts": {
+    "build": "tsdown",
+    "dev": "tsdown --watch",
+    "cleanup": "rimraf dist/ node_modules/ .turbo/",
+    "lint": "eslint",
+    "type-check": "tsc --noEmit",
+    "lint:fix": "eslint --fix"
   }
-}
+}