@ya-accelerators/nextjs-framework 0.0.83 → 0.0.85
This diff represents the content of publicly available package versions that have been released to one of the supported registries. The information contained in this diff is provided for informational purposes only and reflects changes between package versions as they appear in their respective public registries.
- package/@types/next-auth.d.ts +0 -1
- package/dist/hooks/dispatch/index.jsx +8 -4
- package/dist/hooks/dispatch/index.jsx.map +1 -1
- package/dist/hooks/toast/index.jsx +3 -0
- package/dist/hooks/toast/index.jsx.map +1 -1
- package/dist/lib/next-auth/index.js +117 -115
- package/dist/lib/next-auth/index.js.map +1 -1
- package/dist/lib/trpc/index.js +19 -5
- package/dist/lib/trpc/index.js.map +1 -1
- package/dist/tsconfig.tsbuildinfo +1 -1
- package/dist/ui/composite/input/dateRange/index.jsx +13 -17
- package/dist/ui/composite/input/dateRange/index.jsx.map +1 -1
- package/dist/ui/composite/input/dateTimePicker/index.jsx +5 -3
- package/dist/ui/composite/input/dateTimePicker/index.jsx.map +1 -1
- package/dist/ui/composite/input/dateTimeRange/index.jsx +14 -21
- package/dist/ui/composite/input/dateTimeRange/index.jsx.map +1 -1
- package/dist/ui/functional/signInForm/index.jsx +1 -1
- package/dist/ui/functional/signInForm/index.jsx.map +1 -1
- package/dist/ui/functional/signOutForm/index.jsx +1 -1
- package/dist/ui/functional/signOutForm/index.jsx.map +1 -1
- package/dist/ui/layout/form/index.jsx +27 -23
- package/dist/ui/layout/form/index.jsx.map +1 -1
- package/dist/ui/layout/modal/index.jsx +23 -17
- package/dist/ui/layout/modal/index.jsx.map +1 -1
- package/dist/ui/layout/root/index.jsx +2 -2
- package/dist/ui/layout/root/index.jsx.map +1 -1
- package/dist/util/date/impl.js +5 -1
- package/dist/util/date/impl.js.map +1 -1
- package/dist/util/index.js +2 -3
- package/dist/util/index.js.map +1 -1
- package/package.json +1 -1
package/@types/next-auth.d.ts
CHANGED
|
@@ -15,10 +15,14 @@ export const DispatchProvider = ({ children }) => {
|
|
|
15
15
|
if (requestShowLoading !== false) {
|
|
16
16
|
showLoading();
|
|
17
17
|
}
|
|
18
|
-
|
|
19
|
-
|
|
20
|
-
|
|
21
|
-
|
|
18
|
+
try {
|
|
19
|
+
const ret = await promise;
|
|
20
|
+
router.refresh();
|
|
21
|
+
return ret;
|
|
22
|
+
}
|
|
23
|
+
finally {
|
|
24
|
+
dismissLoading();
|
|
25
|
+
}
|
|
22
26
|
};
|
|
23
27
|
return <DispatchContext.Provider value={{ dispatch }}>{children}</DispatchContext.Provider>;
|
|
24
28
|
};
|
|
@@ -1 +1 @@
|
|
|
1
|
-
{"version":3,"file":"index.jsx","sourceRoot":"","sources":["../../../../src/hooks/dispatch/index.tsx"],"names":[],"mappings":"AAAA,YAAY,CAAA;AAEZ,OAAO,EAAE,SAAS,EAAE,MAAM,iBAAiB,CAAA;AAE3C,OAAO,EAAE,aAAa,EAAE,UAAU,EAAE,MAAM,OAAO,CAAA;AAEjD,OAAO,EAAE,iBAAiB,EAAE,MAAM,YAAY,CAAA;AAK9C,MAAM,eAAe,GAAG,aAAa,CAAmB;IACtD,QAAQ,CAAI,OAAmB;QAC7B,OAAO,OAAO,CAAA;IAChB,CAAC;CACF,CAAC,CAAA;AAEF,MAAM,CAAC,MAAM,kBAAkB,GAAG,GAAG,EAAE,CAAC,UAAU,CAAC,eAAe,CAAC,CAAA;AAEnE,MAAM,CAAC,MAAM,gBAAgB,GAAG,CAAC,EAAE,QAAQ,EAA2B,EAAE,EAAE;IACxE,MAAM,MAAM,GAAG,SAAS,EAAE,CAAA;IAC1B,MAAM,EAAE,WAAW,EAAE,cAAc,EAAE,GAAG,iBAAiB,EAAE,CAAA;IAC3D,MAAM,QAAQ,GAAG,KAAK,WAAc,OAAmB,EAAE,kBAA4B;QACnF,IAAI,kBAAkB,KAAK,KAAK,EAAE,CAAC;YACjC,WAAW,EAAE,CAAA;QACf,CAAC;QACD,MAAM,GAAG,GAAG,MAAM,OAAO,CAAA;
|
|
1
|
+
{"version":3,"file":"index.jsx","sourceRoot":"","sources":["../../../../src/hooks/dispatch/index.tsx"],"names":[],"mappings":"AAAA,YAAY,CAAA;AAEZ,OAAO,EAAE,SAAS,EAAE,MAAM,iBAAiB,CAAA;AAE3C,OAAO,EAAE,aAAa,EAAE,UAAU,EAAE,MAAM,OAAO,CAAA;AAEjD,OAAO,EAAE,iBAAiB,EAAE,MAAM,YAAY,CAAA;AAK9C,MAAM,eAAe,GAAG,aAAa,CAAmB;IACtD,QAAQ,CAAI,OAAmB;QAC7B,OAAO,OAAO,CAAA;IAChB,CAAC;CACF,CAAC,CAAA;AAEF,MAAM,CAAC,MAAM,kBAAkB,GAAG,GAAG,EAAE,CAAC,UAAU,CAAC,eAAe,CAAC,CAAA;AAEnE,MAAM,CAAC,MAAM,gBAAgB,GAAG,CAAC,EAAE,QAAQ,EAA2B,EAAE,EAAE;IACxE,MAAM,MAAM,GAAG,SAAS,EAAE,CAAA;IAC1B,MAAM,EAAE,WAAW,EAAE,cAAc,EAAE,GAAG,iBAAiB,EAAE,CAAA;IAC3D,MAAM,QAAQ,GAAG,KAAK,WAAc,OAAmB,EAAE,kBAA4B;QACnF,IAAI,kBAAkB,KAAK,KAAK,EAAE,CAAC;YACjC,WAAW,EAAE,CAAA;QACf,CAAC;QACD,IAAI,CAAC;YACH,MAAM,GAAG,GAAG,MAAM,OAAO,CAAA;YACzB,MAAM,CAAC,OAAO,EAAE,CAAA;YAChB,OAAO,GAAG,CAAA;QACZ,CAAC;gBAAS,CAAC;YACT,cAAc,EAAE,CAAA;QAClB,CAAC;IACH,CAAC,CAAA;IACD,OAAO,CAAC,eAAe,CAAC,QAAQ,CAAC,KAAK,CAAC,CAAC,EAAE,QAAQ,EAAE,CAAC,CAAC,CAAC,QAAQ,CAAC,EAAE,eAAe,CAAC,QAAQ,CAAC,CAAA;AAC7F,CAAC,CAAA"}
|
|
@@ -1 +1 @@
|
|
|
1
|
-
{"version":3,"file":"index.jsx","sourceRoot":"","sources":["../../../../src/hooks/toast/index.tsx"],"names":[],"mappings":"AAAA,YAAY,CAAA;AAGZ,OAAO,EAAE,aAAa,EAAE,UAAU,EAAE,QAAQ,EAAE,MAAM,OAAO,CAAA;AAE3D,OAAO,EAAE,KAAK,EAAE,MAAM,uBAAuB,CAAA;AAC7C,OAAO,EAAE,UAAU,EAAE,MAAM,sBAAsB,CAAA;AAMjD,MAAM,YAAY,GAAG,aAAa,CAAgB;IAChD,SAAS,EAAE,GAAG,EAAE,GAAE,CAAC;IACnB,YAAY,EAAE,GAAG,EAAE,GAAE,CAAC;CACvB,CAAC,CAAA;AAEF,MAAM,CAAC,MAAM,eAAe,GAAG,GAAG,EAAE,CAAC,UAAU,CAAC,YAAY,CAAC,CAAA;AAE7D,MAAM,CAAC,MAAM,aAAa,GAAG,CAAC,EAAE,QAAQ,EAA2B,EAAE,EAAE;IACrE,MAAM,CAAC,OAAO,EAAE,UAAU,CAAC,GAAG,QAAQ,EAAa,CAAA;IACnD,MAAM,CAAC,KAAK,EAAE,QAAQ,CAAC,GAAG,QAAQ,CAAa,UAAU,CAAC,OAAO,CAAC,CAAA;IAClE,MAAM,CAAC,CAAC,EAAE,IAAI,CAAC,GAAG,QAAQ,EAAkB,CAAA;IAC5C,MAAM,SAAS,GAAG,CAAC,EAAE,OAAO,EAAE,KAAK,EAAE,MAAM,EAA+D,EAAE,EAAE;QAC5G,UAAU,CAAC,OAAO,CAAC,CAAA;QACnB,QAAQ,CAAC,KAAK,IAAI,UAAU,CAAC,OAAO,CAAC,CAAA;QACrC,IAAI,CAAC,EAAE,CAAC;YACN,YAAY,CAAC,CAAC,CAAC,CAAA;YACf,IAAI,CAAC,SAAS,CAAC,CAAA;QACjB,CAAC;QACD,IAAI,MAAM,EAAE,CAAC;YACX,IAAI,CACF,UAAU,CAAC,GAAG,EAAE;gBACd,UAAU,CAAC,SAAS,CAAC,CAAA;gBACrB,IAAI,CAAC,SAAS,CAAC,CAAA;YACjB,CAAC,EAAE,MAAM,CAAC,CACX,CAAA;QACH,CAAC;IACH,CAAC,CAAA;IACD,MAAM,YAAY,GAAG,GAAG,EAAE;QACxB,UAAU,CAAC,SAAS,CAAC,CAAA;QACrB,IAAI,CAAC,SAAS,CAAC,CAAA;IACjB,CAAC,CAAA;IACD,OAAO,CACL,CAAC,YAAY,CAAC,QAAQ,CAAC,KAAK,CAAC,CAAC,EAAE,SAAS,EAAE,YAAY,EAAE,CAAC,CACxD;MAAA,CAAC,QAAQ,CACT;MAAA,CAAC,OAAO,IAAI,CACV,CAAC,KAAK,CAAC,KAAK,CAAC,CAAC,KAAK,CAAC,CAAC,YAAY,CAAC,CAAC,YAAY,CAAC,CAC9C;UAAA,CAAC,OAAO,CACV;QAAA,EAAE,KAAK,CAAC,CACT,CACH;IAAA,EAAE,YAAY,CAAC,QAAQ,CAAC,CACzB,CAAA;AACH,CAAC,CAAA"}
|
|
1
|
+
{"version":3,"file":"index.jsx","sourceRoot":"","sources":["../../../../src/hooks/toast/index.tsx"],"names":[],"mappings":"AAAA,YAAY,CAAA;AAGZ,OAAO,EAAE,aAAa,EAAE,UAAU,EAAE,QAAQ,EAAE,MAAM,OAAO,CAAA;AAE3D,OAAO,EAAE,KAAK,EAAE,MAAM,uBAAuB,CAAA;AAC7C,OAAO,EAAE,UAAU,EAAE,MAAM,sBAAsB,CAAA;AAMjD,MAAM,YAAY,GAAG,aAAa,CAAgB;IAChD,SAAS,EAAE,GAAG,EAAE,GAAE,CAAC;IACnB,YAAY,EAAE,GAAG,EAAE,GAAE,CAAC;CACvB,CAAC,CAAA;AAEF,MAAM,CAAC,MAAM,eAAe,GAAG,GAAG,EAAE,CAAC,UAAU,CAAC,YAAY,CAAC,CAAA;AAE7D,MAAM,CAAC,MAAM,aAAa,GAAG,CAAC,EAAE,QAAQ,EAA2B,EAAE,EAAE;IACrE,MAAM,CAAC,OAAO,EAAE,UAAU,CAAC,GAAG,QAAQ,EAAa,CAAA;IACnD,MAAM,CAAC,KAAK,EAAE,QAAQ,CAAC,GAAG,QAAQ,CAAa,UAAU,CAAC,OAAO,CAAC,CAAA;IAClE,MAAM,CAAC,CAAC,EAAE,IAAI,CAAC,GAAG,QAAQ,EAAkB,CAAA;IAC5C,MAAM,SAAS,GAAG,CAAC,EAAE,OAAO,EAAE,KAAK,EAAE,MAAM,EAA+D,EAAE,EAAE;QAC5G,UAAU,CAAC,OAAO,CAAC,CAAA;QACnB,QAAQ,CAAC,KAAK,IAAI,UAAU,CAAC,OAAO,CAAC,CAAA;QACrC,IAAI,CAAC,EAAE,CAAC;YACN,YAAY,CAAC,CAAC,CAAC,CAAA;YACf,IAAI,CAAC,SAAS,CAAC,CAAA;QACjB,CAAC;QACD,IAAI,MAAM,EAAE,CAAC;YACX,IAAI,CACF,UAAU,CAAC,GAAG,EAAE;gBACd,UAAU,CAAC,SAAS,CAAC,CAAA;gBACrB,IAAI,CAAC,SAAS,CAAC,CAAA;YACjB,CAAC,EAAE,MAAM,CAAC,CACX,CAAA;QACH,CAAC;IACH,CAAC,CAAA;IACD,MAAM,YAAY,GAAG,GAAG,EAAE;QACxB,IAAI,CAAC,EAAE,CAAC;YACN,YAAY,CAAC,CAAC,CAAC,CAAA;QACjB,CAAC;QACD,UAAU,CAAC,SAAS,CAAC,CAAA;QACrB,IAAI,CAAC,SAAS,CAAC,CAAA;IACjB,CAAC,CAAA;IACD,OAAO,CACL,CAAC,YAAY,CAAC,QAAQ,CAAC,KAAK,CAAC,CAAC,EAAE,SAAS,EAAE,YAAY,EAAE,CAAC,CACxD;MAAA,CAAC,QAAQ,CACT;MAAA,CAAC,OAAO,IAAI,CACV,CAAC,KAAK,CAAC,KAAK,CAAC,CAAC,KAAK,CAAC,CAAC,YAAY,CAAC,CAAC,YAAY,CAAC,CAC9C;UAAA,CAAC,OAAO,CACV;QAAA,EAAE,KAAK,CAAC,CACT,CACH;IAAA,EAAE,YAAY,CAAC,QAAQ,CAAC,CACzB,CAAA;AACH,CAAC,CAAA"}
|
|
@@ -19,131 +19,133 @@ const dedupedRefresh = (refreshToken, refresh) => {
|
|
|
19
19
|
inflightRefreshes.set(refreshToken, p);
|
|
20
20
|
return p;
|
|
21
21
|
};
|
|
22
|
-
export const options = (authorize, refresh, externalAuthorize) =>
|
|
23
|
-
|
|
24
|
-
|
|
25
|
-
|
|
26
|
-
|
|
27
|
-
|
|
28
|
-
|
|
29
|
-
|
|
30
|
-
|
|
31
|
-
|
|
32
|
-
|
|
33
|
-
defaultServerEnv.
|
|
34
|
-
|
|
35
|
-
|
|
36
|
-
|
|
37
|
-
|
|
38
|
-
|
|
39
|
-
|
|
40
|
-
|
|
41
|
-
|
|
42
|
-
|
|
43
|
-
|
|
44
|
-
|
|
45
|
-
|
|
46
|
-
|
|
47
|
-
|
|
48
|
-
|
|
49
|
-
|
|
50
|
-
|
|
51
|
-
|
|
52
|
-
|
|
53
|
-
|
|
54
|
-
|
|
55
|
-
|
|
56
|
-
try {
|
|
57
|
-
// Route an app-supplied opaque credential (e.g. a MicroHub OIDC broker
|
|
58
|
-
// one-time code) through externalAuthorize; otherwise fall back to the
|
|
59
|
-
// email/password path. Either callback maps to a TokenSet or undefined.
|
|
60
|
-
let tokenSet;
|
|
61
|
-
if (credentials.credential && externalAuthorize) {
|
|
62
|
-
tokenSet = await externalAuthorize(credentials.credential);
|
|
22
|
+
export const options = (authorize, refresh, externalAuthorize) => {
|
|
23
|
+
return {
|
|
24
|
+
secret: (() => {
|
|
25
|
+
// next build (page-data collection) evaluates this module but never signs anything —
|
|
26
|
+
// the secret is a runtime-only concern (Secrets Manager / dev .env). Build must not require it.
|
|
27
|
+
if (defaultServerEnv.NEXT_PHASE === 'phase-production-build') {
|
|
28
|
+
return defaultServerEnv.NEXTAUTH_SECRET ?? 'build-only-not-used-at-runtime';
|
|
29
|
+
}
|
|
30
|
+
if (!defaultServerEnv.NEXTAUTH_SECRET) {
|
|
31
|
+
throw new Error('NEXTAUTH_SECRET is not set');
|
|
32
|
+
}
|
|
33
|
+
if (defaultServerEnv.DEPLOY_ENV !== 'dev' &&
|
|
34
|
+
defaultServerEnv.NEXTAUTH_SECRET === 'build-only-not-used-at-runtime') {
|
|
35
|
+
throw new Error('NEXTAUTH_SECRET must be replaced with a real secret in non-dev environments');
|
|
36
|
+
}
|
|
37
|
+
return defaultServerEnv.NEXTAUTH_SECRET;
|
|
38
|
+
})(),
|
|
39
|
+
pages: {
|
|
40
|
+
signIn: '/signin',
|
|
41
|
+
},
|
|
42
|
+
session: {
|
|
43
|
+
maxAge: 60 * 60 * 24 * 30,
|
|
44
|
+
strategy: 'jwt',
|
|
45
|
+
},
|
|
46
|
+
providers: [
|
|
47
|
+
CredentialsProvider({
|
|
48
|
+
credentials: {
|
|
49
|
+
email: { type: 'email' },
|
|
50
|
+
password: { type: 'password' },
|
|
51
|
+
credential: { type: 'text' },
|
|
52
|
+
},
|
|
53
|
+
async authorize(credentials) {
|
|
54
|
+
if (!credentials) {
|
|
55
|
+
return null;
|
|
63
56
|
}
|
|
64
|
-
|
|
65
|
-
|
|
57
|
+
try {
|
|
58
|
+
// Route an app-supplied opaque credential (e.g. a MicroHub OIDC broker
|
|
59
|
+
// one-time code) through externalAuthorize; otherwise fall back to the
|
|
60
|
+
// email/password path. Either callback maps to a TokenSet or undefined.
|
|
61
|
+
let tokenSet;
|
|
62
|
+
if (credentials.credential && externalAuthorize) {
|
|
63
|
+
tokenSet = await externalAuthorize(credentials.credential);
|
|
64
|
+
}
|
|
65
|
+
else if (authorize) {
|
|
66
|
+
tokenSet = await authorize(credentials.email, credentials.password);
|
|
67
|
+
}
|
|
68
|
+
if (!tokenSet) {
|
|
69
|
+
return null;
|
|
70
|
+
}
|
|
71
|
+
return {
|
|
72
|
+
tokenSet,
|
|
73
|
+
};
|
|
66
74
|
}
|
|
67
|
-
|
|
75
|
+
catch (error) {
|
|
76
|
+
// NextAuth swallows authorize() exceptions silently and returns null —
|
|
77
|
+
// operationally indistinguishable from "wrong password". Log the throw so
|
|
78
|
+
// server-side bugs in the consumer's authorize callback are visible.
|
|
79
|
+
logger.error('auth', { op: 'authorize', error });
|
|
68
80
|
return null;
|
|
69
81
|
}
|
|
70
|
-
|
|
71
|
-
|
|
72
|
-
|
|
82
|
+
},
|
|
83
|
+
}),
|
|
84
|
+
],
|
|
85
|
+
callbacks: {
|
|
86
|
+
session: ({ session, token }) => {
|
|
87
|
+
// The access token is deliberately NOT copied onto the session: the session is serialized to the
|
|
88
|
+
// browser via /api/auth/session (SessionProvider), so exposing the bearer there hands any client
|
|
89
|
+
// script a usable credential. The server reads it from the JWT via getToken (see Lib.trpc).
|
|
90
|
+
if (token?.scope) {
|
|
91
|
+
session.scope = token.scope;
|
|
73
92
|
}
|
|
74
|
-
|
|
75
|
-
|
|
76
|
-
// operationally indistinguishable from "wrong password". Log the throw so
|
|
77
|
-
// server-side bugs in the consumer's authorize callback are visible.
|
|
78
|
-
logger.error('auth', { op: 'authorize', error });
|
|
79
|
-
return null;
|
|
93
|
+
if (token?.error) {
|
|
94
|
+
session.error = token.error;
|
|
80
95
|
}
|
|
96
|
+
return session;
|
|
81
97
|
},
|
|
82
|
-
|
|
83
|
-
|
|
84
|
-
|
|
85
|
-
|
|
86
|
-
|
|
87
|
-
|
|
88
|
-
|
|
89
|
-
|
|
90
|
-
|
|
91
|
-
|
|
92
|
-
|
|
93
|
-
session
|
|
94
|
-
|
|
95
|
-
|
|
96
|
-
|
|
97
|
-
|
|
98
|
-
|
|
99
|
-
|
|
100
|
-
|
|
101
|
-
|
|
102
|
-
|
|
103
|
-
|
|
104
|
-
|
|
105
|
-
|
|
106
|
-
|
|
107
|
-
|
|
108
|
-
|
|
109
|
-
|
|
110
|
-
|
|
111
|
-
|
|
112
|
-
|
|
113
|
-
|
|
114
|
-
|
|
115
|
-
|
|
116
|
-
|
|
117
|
-
|
|
118
|
-
|
|
119
|
-
const refreshed = await dedupedRefresh(token.refreshToken, refresh);
|
|
120
|
-
if (!refreshed) {
|
|
98
|
+
jwt: async ({ token, user }) => {
|
|
99
|
+
// New sign-in path: authorize() returned a TokenSet; CredentialsProvider
|
|
100
|
+
// hands it to us on `user.tokenSet`.
|
|
101
|
+
if (user?.tokenSet) {
|
|
102
|
+
token.accessToken = user.tokenSet.accessToken;
|
|
103
|
+
token.refreshToken = user.tokenSet.refreshToken;
|
|
104
|
+
token.expiresAtSec = user.tokenSet.expiresAtSec;
|
|
105
|
+
token.scope = user.tokenSet.scope;
|
|
106
|
+
token.error = undefined;
|
|
107
|
+
return token;
|
|
108
|
+
}
|
|
109
|
+
// Existing session path: refresh the access token if expiry is within
|
|
110
|
+
// the leeway. `refresh` is optional — without it, the access token
|
|
111
|
+
// simply expires and downstream calls start failing 401 until the user
|
|
112
|
+
// signs in again. The refreshToken is cleared on failure so subsequent
|
|
113
|
+
// jwt() invocations don't loop and hammer the refresh endpoint until
|
|
114
|
+
// session.maxAge.
|
|
115
|
+
if (refresh &&
|
|
116
|
+
token.refreshToken &&
|
|
117
|
+
token.expiresAtSec &&
|
|
118
|
+
Date.now() / 1000 >= token.expiresAtSec - REFRESH_LEEWAY_SEC) {
|
|
119
|
+
try {
|
|
120
|
+
const refreshed = await dedupedRefresh(token.refreshToken, refresh);
|
|
121
|
+
if (!refreshed) {
|
|
122
|
+
return { ...token, refreshToken: undefined, error: 'RefreshAccessTokenError' };
|
|
123
|
+
}
|
|
124
|
+
return {
|
|
125
|
+
...token,
|
|
126
|
+
accessToken: refreshed.accessToken,
|
|
127
|
+
refreshToken: refreshed.refreshToken,
|
|
128
|
+
expiresAtSec: refreshed.expiresAtSec,
|
|
129
|
+
scope: refreshed.scope,
|
|
130
|
+
error: undefined,
|
|
131
|
+
};
|
|
132
|
+
}
|
|
133
|
+
catch (error) {
|
|
134
|
+
logger.error('auth', { op: 'refresh', error });
|
|
121
135
|
return { ...token, refreshToken: undefined, error: 'RefreshAccessTokenError' };
|
|
122
136
|
}
|
|
123
|
-
return {
|
|
124
|
-
...token,
|
|
125
|
-
accessToken: refreshed.accessToken,
|
|
126
|
-
refreshToken: refreshed.refreshToken,
|
|
127
|
-
expiresAtSec: refreshed.expiresAtSec,
|
|
128
|
-
scope: refreshed.scope,
|
|
129
|
-
error: undefined,
|
|
130
|
-
};
|
|
131
137
|
}
|
|
132
|
-
|
|
133
|
-
|
|
134
|
-
|
|
138
|
+
return token;
|
|
139
|
+
},
|
|
140
|
+
redirect: ({ url, baseUrl }) => {
|
|
141
|
+
if (url.startsWith('/')) {
|
|
142
|
+
return `${baseUrl}${url}`;
|
|
135
143
|
}
|
|
136
|
-
|
|
137
|
-
|
|
138
|
-
|
|
139
|
-
|
|
140
|
-
if (url.startsWith('/')) {
|
|
141
|
-
return `${baseUrl}${url}`;
|
|
142
|
-
}
|
|
143
|
-
const searchParams = new URLSearchParams(new URL(url).search);
|
|
144
|
-
const resolved = new URL(searchParams.get('callbackUrl') ?? '', baseUrl);
|
|
145
|
-
return resolved.origin === new URL(baseUrl).origin ? resolved.toString() : baseUrl;
|
|
144
|
+
const searchParams = new URLSearchParams(new URL(url).search);
|
|
145
|
+
const resolved = new URL(searchParams.get('callbackUrl') ?? '', baseUrl);
|
|
146
|
+
return resolved.origin === new URL(baseUrl).origin ? resolved.toString() : baseUrl;
|
|
147
|
+
},
|
|
146
148
|
},
|
|
147
|
-
}
|
|
148
|
-
}
|
|
149
|
+
};
|
|
150
|
+
};
|
|
149
151
|
//# sourceMappingURL=index.js.map
|
|
@@ -1 +1 @@
|
|
|
1
|
-
{"version":3,"file":"index.js","sourceRoot":"","sources":["../../../../src/lib/next-auth/index.ts"],"names":[],"mappings":"AACA,OAAO,mBAAmB,MAAM,iCAAiC,CAAA;AAEjE,OAAO,EAAE,kBAAkB,EAAE,MAAM,iBAAiB,CAAA;AACpD,OAAO,EAAE,gBAAgB,EAAE,MAAM,WAAW,CAAA;AAC5C,OAAO,EAAE,MAAM,EAAE,MAAM,cAAc,CAAA;AASrC,+EAA+E;AAC/E,+EAA+E;AAC/E,iFAAiF;AACjF,8EAA8E;AAC9E,+DAA+D;AAC/D,MAAM,iBAAiB,GAAG,IAAI,GAAG,EAAyC,CAAA;AAE1E,MAAM,cAAc,GAAG,CACrB,YAAoB,EACpB,OAAgE,EACjC,EAAE;IACjC,MAAM,QAAQ,GAAG,iBAAiB,CAAC,GAAG,CAAC,YAAY,CAAC,CAAA;IACpD,IAAI,QAAQ,EAAE,CAAC;QACb,OAAO,QAAQ,CAAA;IACjB,CAAC;IACD,MAAM,CAAC,GAAG,OAAO,CAAC,YAAY,CAAC,CAAC,OAAO,CAAC,GAAG,EAAE;QAC3C,iBAAiB,CAAC,MAAM,CAAC,YAAY,CAAC,CAAA;IACxC,CAAC,CAAC,CAAA;IACF,iBAAiB,CAAC,GAAG,CAAC,YAAY,EAAE,CAAC,CAAC,CAAA;IACtC,OAAO,CAAC,CAAA;AACV,CAAC,CAAA;AAED,MAAM,CAAC,MAAM,OAAO,GAAG,CACrB,SAA8E,EAC9E,OAAiE,EACjE,iBAAyE,EACxD,EAAE,
|
|
1
|
+
{"version":3,"file":"index.js","sourceRoot":"","sources":["../../../../src/lib/next-auth/index.ts"],"names":[],"mappings":"AACA,OAAO,mBAAmB,MAAM,iCAAiC,CAAA;AAEjE,OAAO,EAAE,kBAAkB,EAAE,MAAM,iBAAiB,CAAA;AACpD,OAAO,EAAE,gBAAgB,EAAE,MAAM,WAAW,CAAA;AAC5C,OAAO,EAAE,MAAM,EAAE,MAAM,cAAc,CAAA;AASrC,+EAA+E;AAC/E,+EAA+E;AAC/E,iFAAiF;AACjF,8EAA8E;AAC9E,+DAA+D;AAC/D,MAAM,iBAAiB,GAAG,IAAI,GAAG,EAAyC,CAAA;AAE1E,MAAM,cAAc,GAAG,CACrB,YAAoB,EACpB,OAAgE,EACjC,EAAE;IACjC,MAAM,QAAQ,GAAG,iBAAiB,CAAC,GAAG,CAAC,YAAY,CAAC,CAAA;IACpD,IAAI,QAAQ,EAAE,CAAC;QACb,OAAO,QAAQ,CAAA;IACjB,CAAC;IACD,MAAM,CAAC,GAAG,OAAO,CAAC,YAAY,CAAC,CAAC,OAAO,CAAC,GAAG,EAAE;QAC3C,iBAAiB,CAAC,MAAM,CAAC,YAAY,CAAC,CAAA;IACxC,CAAC,CAAC,CAAA;IACF,iBAAiB,CAAC,GAAG,CAAC,YAAY,EAAE,CAAC,CAAC,CAAA;IACtC,OAAO,CAAC,CAAA;AACV,CAAC,CAAA;AAED,MAAM,CAAC,MAAM,OAAO,GAAG,CACrB,SAA8E,EAC9E,OAAiE,EACjE,iBAAyE,EACxD,EAAE;IACnB,OAAO;QACL,MAAM,EAAE,CAAC,GAAG,EAAE;YACZ,qFAAqF;YACrF,gGAAgG;YAChG,IAAI,gBAAgB,CAAC,UAAU,KAAK,wBAAwB,EAAE,CAAC;gBAC7D,OAAO,gBAAgB,CAAC,eAAe,IAAI,gCAAgC,CAAA;YAC7E,CAAC;YACD,IAAI,CAAC,gBAAgB,CAAC,eAAe,EAAE,CAAC;gBACtC,MAAM,IAAI,KAAK,CAAC,4BAA4B,CAAC,CAAA;YAC/C,CAAC;YACD,IACE,gBAAgB,CAAC,UAAU,KAAK,KAAK;gBACrC,gBAAgB,CAAC,eAAe,KAAK,gCAAgC,EACrE,CAAC;gBACD,MAAM,IAAI,KAAK,CAAC,6EAA6E,CAAC,CAAA;YAChG,CAAC;YACD,OAAO,gBAAgB,CAAC,eAAe,CAAA;QACzC,CAAC,CAAC,EAAE;QACJ,KAAK,EAAE;YACL,MAAM,EAAE,SAAS;SAClB;QACD,OAAO,EAAE;YACP,MAAM,EAAE,EAAE,GAAG,EAAE,GAAG,EAAE,GAAG,EAAE;YACzB,QAAQ,EAAE,KAAK;SAChB;QACD,SAAS,EAAE;YACT,mBAAmB,CAAC;gBAClB,WAAW,EAAE;oBACX,KAAK,EAAE,EAAE,IAAI,EAAE,OAAO,EAAE;oBACxB,QAAQ,EAAE,EAAE,IAAI,EAAE,UAAU,EAAE;oBAC9B,UAAU,EAAE,EAAE,IAAI,EAAE,MAAM,EAAE;iBAC7B;gBACD,KAAK,CAAC,SAAS,CAAC,WAAW;oBACzB,IAAI,CAAC,WAAW,EAAE,CAAC;wBACjB,OAAO,IAAI,CAAA;oBACb,CAAC;oBACD,IAAI,CAAC;wBACH,uEAAuE;wBACvE,uEAAuE;wBACvE,wEAAwE;wBACxE,IAAI,QAA8B,CAAA;wBAClC,IAAI,WAAW,CAAC,UAAU,IAAI,iBAAiB,EAAE,CAAC;4BAChD,QAAQ,GAAG,MAAM,iBAAiB,CAAC,WAAW,CAAC,UAAU,CAAC,CAAA;wBAC5D,CAAC;6BAAM,IAAI,SAAS,EAAE,CAAC;4BACrB,QAAQ,GAAG,MAAM,SAAS,CAAC,WAAW,CAAC,KAAK,EAAE,WAAW,CAAC,QAAQ,CAAC,CAAA;wBACrE,CAAC;wBACD,IAAI,CAAC,QAAQ,EAAE,CAAC;4BACd,OAAO,IAAI,CAAA;wBACb,CAAC;wBACD,OAAO;4BACL,QAAQ;yBACD,CAAA;oBACX,CAAC;oBAAC,OAAO,KAAK,EAAE,CAAC;wBACf,uEAAuE;wBACvE,0EAA0E;wBAC1E,qEAAqE;wBACrE,MAAM,CAAC,KAAK,CAAC,MAAM,EAAE,EAAE,EAAE,EAAE,WAAW,EAAE,KAAK,EAAE,CAAC,CAAA;wBAChD,OAAO,IAAI,CAAA;oBACb,CAAC;gBACH,CAAC;aACF,CAAC;SACH;QACD,SAAS,EAAE;YACT,OAAO,EAAE,CAAC,EAAE,OAAO,EAAE,KAAK,EAAE,EAAE,EAAE;gBAC9B,iGAAiG;gBACjG,iGAAiG;gBACjG,4FAA4F;gBAC5F,IAAI,KAAK,EAAE,KAAK,EAAE,CAAC;oBACjB,OAAO,CAAC,KAAK,GAAG,KAAK,CAAC,KAAK,CAAA;gBAC7B,CAAC;gBACD,IAAI,KAAK,EAAE,KAAK,EAAE,CAAC;oBACjB,OAAO,CAAC,KAAK,GAAG,KAAK,CAAC,KAAK,CAAA;gBAC7B,CAAC;gBACD,OAAO,OAAO,CAAA;YAChB,CAAC;YACD,GAAG,EAAE,KAAK,EAAE,EAAE,KAAK,EAAE,IAAI,EAAE,EAAE,EAAE;gBAC7B,yEAAyE;gBACzE,qCAAqC;gBACrC,IAAI,IAAI,EAAE,QAAQ,EAAE,CAAC;oBACnB,KAAK,CAAC,WAAW,GAAG,IAAI,CAAC,QAAQ,CAAC,WAAW,CAAA;oBAC7C,KAAK,CAAC,YAAY,GAAG,IAAI,CAAC,QAAQ,CAAC,YAAY,CAAA;oBAC/C,KAAK,CAAC,YAAY,GAAG,IAAI,CAAC,QAAQ,CAAC,YAAY,CAAA;oBAC/C,KAAK,CAAC,KAAK,GAAG,IAAI,CAAC,QAAQ,CAAC,KAAK,CAAA;oBACjC,KAAK,CAAC,KAAK,GAAG,SAAS,CAAA;oBACvB,OAAO,KAAK,CAAA;gBACd,CAAC;gBACD,sEAAsE;gBACtE,mEAAmE;gBACnE,uEAAuE;gBACvE,uEAAuE;gBACvE,qEAAqE;gBACrE,kBAAkB;gBAClB,IACE,OAAO;oBACP,KAAK,CAAC,YAAY;oBAClB,KAAK,CAAC,YAAY;oBAClB,IAAI,CAAC,GAAG,EAAE,GAAG,IAAI,IAAI,KAAK,CAAC,YAAY,GAAG,kBAAkB,EAC5D,CAAC;oBACD,IAAI,CAAC;wBACH,MAAM,SAAS,GAAG,MAAM,cAAc,CAAC,KAAK,CAAC,YAAY,EAAE,OAAO,CAAC,CAAA;wBACnE,IAAI,CAAC,SAAS,EAAE,CAAC;4BACf,OAAO,EAAE,GAAG,KAAK,EAAE,YAAY,EAAE,SAAS,EAAE,KAAK,EAAE,yBAAyB,EAAE,CAAA;wBAChF,CAAC;wBACD,OAAO;4BACL,GAAG,KAAK;4BACR,WAAW,EAAE,SAAS,CAAC,WAAW;4BAClC,YAAY,EAAE,SAAS,CAAC,YAAY;4BACpC,YAAY,EAAE,SAAS,CAAC,YAAY;4BACpC,KAAK,EAAE,SAAS,CAAC,KAAK;4BACtB,KAAK,EAAE,SAAS;yBACjB,CAAA;oBACH,CAAC;oBAAC,OAAO,KAAK,EAAE,CAAC;wBACf,MAAM,CAAC,KAAK,CAAC,MAAM,EAAE,EAAE,EAAE,EAAE,SAAS,EAAE,KAAK,EAAE,CAAC,CAAA;wBAC9C,OAAO,EAAE,GAAG,KAAK,EAAE,YAAY,EAAE,SAAS,EAAE,KAAK,EAAE,yBAAyB,EAAE,CAAA;oBAChF,CAAC;gBACH,CAAC;gBACD,OAAO,KAAK,CAAA;YACd,CAAC;YACD,QAAQ,EAAE,CAAC,EAAE,GAAG,EAAE,OAAO,EAAE,EAAE,EAAE;gBAC7B,IAAI,GAAG,CAAC,UAAU,CAAC,GAAG,CAAC,EAAE,CAAC;oBACxB,OAAO,GAAG,OAAO,GAAG,GAAG,EAAE,CAAA;gBAC3B,CAAC;gBACD,MAAM,YAAY,GAAG,IAAI,eAAe,CAAC,IAAI,GAAG,CAAC,GAAG,CAAC,CAAC,MAAM,CAAC,CAAA;gBAC7D,MAAM,QAAQ,GAAG,IAAI,GAAG,CAAC,YAAY,CAAC,GAAG,CAAC,aAAa,CAAC,IAAI,EAAE,EAAE,OAAO,CAAC,CAAA;gBACxE,OAAO,QAAQ,CAAC,MAAM,KAAK,IAAI,GAAG,CAAC,OAAO,CAAC,CAAC,MAAM,CAAC,CAAC,CAAC,QAAQ,CAAC,QAAQ,EAAE,CAAC,CAAC,CAAC,OAAO,CAAA;YACpF,CAAC;SACF;KACF,CAAA;AACH,CAAC,CAAA"}
|
package/dist/lib/trpc/index.js
CHANGED
|
@@ -1,10 +1,9 @@
|
|
|
1
|
-
import {
|
|
1
|
+
import { defaultServerEnv } from '../../env';
|
|
2
2
|
import { getCookieValue, setCookieValue } from '../cookie';
|
|
3
|
-
import { options as nextAuthOptions } from '../next-auth';
|
|
4
3
|
export const setHeaderValues = async (headers, options) => setCookieValue('headers', JSON.stringify(headers), options);
|
|
5
4
|
// The `headers` cookie is client-controllable (tamperable via subdomain cookie injection or an
|
|
6
5
|
// httpOnly:false setHeaderValues call), so auth / IP / routing headers must not be accepted from it.
|
|
7
|
-
// The real authorization is applied server-side from the
|
|
6
|
+
// The real authorization is applied server-side from the JWT (getToken) below.
|
|
8
7
|
const SENSITIVE_HEADER_NAMES = new Set([
|
|
9
8
|
'authorization',
|
|
10
9
|
'cookie',
|
|
@@ -15,10 +14,26 @@ const SENSITIVE_HEADER_NAMES = new Set([
|
|
|
15
14
|
]);
|
|
16
15
|
const createDefaultHeaders = async (defaultHeaders = {}) => {
|
|
17
16
|
let baseHeaders = {};
|
|
17
|
+
let authorization;
|
|
18
18
|
if (typeof window === 'undefined') {
|
|
19
19
|
const { headers: nextHeaders } = await import('next/headers');
|
|
20
20
|
const headersList = await nextHeaders();
|
|
21
21
|
baseHeaders = { 'user-agent': headersList.get('user-agent') || 'unknown' };
|
|
22
|
+
// Read the access token from the server-side JWT (getToken decodes the same session cookie
|
|
23
|
+
// getServerSession does) rather than the session — the session no longer carries the bearer, so it is
|
|
24
|
+
// never exposed to client JS. Do NOT refresh here: the RSC / server-action path cannot persist a
|
|
25
|
+
// rotated session cookie, so an inline refresh consumes a (possibly rotating) refresh token out of
|
|
26
|
+
// band and poisons the next-auth jwt-callback refresh (which is the only place that can persist the
|
|
27
|
+
// rotation). Refresh stays solely in the jwt callback, driven by the client session poll.
|
|
28
|
+
const { getToken } = await import('next-auth/jwt');
|
|
29
|
+
const { NextRequest } = await import('next/server');
|
|
30
|
+
const token = await getToken({
|
|
31
|
+
req: new NextRequest('http://localhost', { headers: { cookie: headersList.get('cookie') ?? '' } }),
|
|
32
|
+
secret: defaultServerEnv.NEXTAUTH_SECRET,
|
|
33
|
+
});
|
|
34
|
+
if (token?.accessToken) {
|
|
35
|
+
authorization = `Bearer ${token.accessToken}`;
|
|
36
|
+
}
|
|
22
37
|
}
|
|
23
38
|
const savedHeaders = {};
|
|
24
39
|
const headersCookie = await getCookieValue('headers');
|
|
@@ -35,11 +50,10 @@ const createDefaultHeaders = async (defaultHeaders = {}) => {
|
|
|
35
50
|
// Ignore if JSON parse fails
|
|
36
51
|
}
|
|
37
52
|
}
|
|
38
|
-
const session = await getServerSession(nextAuthOptions());
|
|
39
53
|
return {
|
|
40
54
|
...baseHeaders,
|
|
41
55
|
...savedHeaders,
|
|
42
|
-
...(
|
|
56
|
+
...(authorization ? { authorization } : {}),
|
|
43
57
|
...defaultHeaders,
|
|
44
58
|
};
|
|
45
59
|
};
|
|
@@ -1 +1 @@
|
|
|
1
|
-
{"version":3,"file":"index.js","sourceRoot":"","sources":["../../../../src/lib/trpc/index.ts"],"names":[],"mappings":"
|
|
1
|
+
{"version":3,"file":"index.js","sourceRoot":"","sources":["../../../../src/lib/trpc/index.ts"],"names":[],"mappings":"AAEA,OAAO,EAAE,gBAAgB,EAAE,MAAM,WAAW,CAAA;AAC5C,OAAO,EAAE,cAAc,EAAE,cAAc,EAAE,MAAM,WAAW,CAAA;AAE1D,MAAM,CAAC,MAAM,eAAe,GAAG,KAAK,EAClC,OAAoB,EACpB,OAKC,EACD,EAAE,CAAC,cAAc,CAAC,SAAS,EAAE,IAAI,CAAC,SAAS,CAAC,OAAO,CAAC,EAAE,OAAO,CAAC,CAAA;AAEhE,+FAA+F;AAC/F,qGAAqG;AACrG,+EAA+E;AAC/E,MAAM,sBAAsB,GAAG,IAAI,GAAG,CAAC;IACrC,eAAe;IACf,QAAQ;IACR,iBAAiB;IACjB,kBAAkB;IAClB,mBAAmB;IACnB,WAAW;CACZ,CAAC,CAAA;AAEF,MAAM,oBAAoB,GAAG,KAAK,EAAE,iBAA8B,EAAE,EAAwB,EAAE;IAC5F,IAAI,WAAW,GAAgB,EAAE,CAAA;IACjC,IAAI,aAAiC,CAAA;IAErC,IAAI,OAAO,MAAM,KAAK,WAAW,EAAE,CAAC;QAClC,MAAM,EAAE,OAAO,EAAE,WAAW,EAAE,GAAG,MAAM,MAAM,CAAC,cAAc,CAAC,CAAA;QAC7D,MAAM,WAAW,GAAG,MAAM,WAAW,EAAE,CAAA;QACvC,WAAW,GAAG,EAAE,YAAY,EAAE,WAAW,CAAC,GAAG,CAAC,YAAY,CAAC,IAAI,SAAS,EAAE,CAAA;QAC1E,2FAA2F;QAC3F,sGAAsG;QACtG,iGAAiG;QACjG,mGAAmG;QACnG,oGAAoG;QACpG,0FAA0F;QAC1F,MAAM,EAAE,QAAQ,EAAE,GAAG,MAAM,MAAM,CAAC,eAAe,CAAC,CAAA;QAClD,MAAM,EAAE,WAAW,EAAE,GAAG,MAAM,MAAM,CAAC,aAAa,CAAC,CAAA;QACnD,MAAM,KAAK,GAAG,MAAM,QAAQ,CAAC;YAC3B,GAAG,EAAE,IAAI,WAAW,CAAC,kBAAkB,EAAE,EAAE,OAAO,EAAE,EAAE,MAAM,EAAE,WAAW,CAAC,GAAG,CAAC,QAAQ,CAAC,IAAI,EAAE,EAAE,EAAE,CAAC;YAClG,MAAM,EAAE,gBAAgB,CAAC,eAAe;SACzC,CAAC,CAAA;QACF,IAAI,KAAK,EAAE,WAAW,EAAE,CAAC;YACvB,aAAa,GAAG,UAAU,KAAK,CAAC,WAAW,EAAE,CAAA;QAC/C,CAAC;IACH,CAAC;IAED,MAAM,YAAY,GAAgB,EAAE,CAAA;IACpC,MAAM,aAAa,GAAG,MAAM,cAAc,CAAC,SAAS,CAAC,CAAA;IACrD,IAAI,aAAa,EAAE,CAAC;QAClB,IAAI,CAAC;YACH,MAAM,aAAa,GAAG,IAAI,CAAC,KAAK,CAAC,aAAa,CAA2B,CAAA;YACzE,KAAK,MAAM,CAAC,GAAG,EAAE,KAAK,CAAC,IAAI,MAAM,CAAC,OAAO,CAAC,aAAa,CAAC,EAAE,CAAC;gBACzD,IAAI,CAAC,sBAAsB,CAAC,GAAG,CAAC,GAAG,CAAC,WAAW,EAAE,CAAC,EAAE,CAAC;oBACnD,YAAY,CAAC,GAAG,CAAC,GAAG,KAAK,CAAA;gBAC3B,CAAC;YACH,CAAC;QACH,CAAC;QAAC,MAAM,CAAC;YACP,6BAA6B;QAC/B,CAAC;IACH,CAAC;IAED,OAAO;QACL,GAAG,WAAW;QACd,GAAG,YAAY;QACf,GAAG,CAAC,aAAa,CAAC,CAAC,CAAC,EAAE,aAAa,EAAE,CAAC,CAAC,CAAC,EAAE,CAAC;QAC3C,GAAG,cAAc;KAClB,CAAA;AACH,CAAC,CAAA;AAED,MAAM,CAAC,MAAM,mBAAmB,GAAG,KAAK,EAAE,KAAmB,EAAwB,EAAE,CAAC,oBAAoB,CAAC,KAAK,CAAC,CAAA"}
|