@zitadel/sdk-next 0.0.0 → 0.1.0-alpha.10

package/dist/auth.d.ts

@@ -3,10 +3,12 @@ import { AuthResult } from '@zitadel/sdk-core/types';
 /**
  * Reads the auth state in a React Server Component or Next.js Route Handler.
  *
- * The middleware verifies the JWT and tunnels it to the RSC runtime via
- * `x-nextgen-auth-token`. This function decodes the tunnelled token without
- * re-verifying the signature — verification has already been done by the
- * middleware on every request.
+ * - **JWT tokens** are decoded locally (no backend round-trip).
+ * - **Opaque encrypted tokens** have already been validated by the
+ *   middleware via `GET /sessions/me`. If the `x-nextgen-auth-token`
+ *   header is set, the session is authentic. Session details (email,
+ *   name) are not available server-side for opaque tokens — use the
+ *   `/__nextgen/sessions/me` proxy from a client component to fetch them.
  *
  * ```ts
  * import { auth } from "@zitadel/sdk-next";
@@ -14,7 +16,7 @@ import { AuthResult } from '@zitadel/sdk-core/types';
  * export default async function Page() {
  *   const session = await auth();
  *   if (!session.isAuthenticated) return <p>Not signed in</p>;
- *   return <p>Hello {session.session.email}</p>;
+ *   return <p>Hello {session.session.userId}</p>;
  * }
  * ```
  *

package/dist/auth.js

@@ -1,7 +1,7 @@
 import {
   auth
-} from "./chunk-EAUJMJ45.js";
-import "./chunk-5P5THDJF.js";
+} from "./chunk-B7S6XMT3.js";
+import "./chunk-OCZMYSFX.js";
 export {
   auth
 };

package/dist/{chunk-UTJFJPDR.js → chunk-4KENHIG4.js}

@@ -1,6 +1,7 @@
 import {
+  base64UrlDecode,
   verifyJwt
-} from "./chunk-5P5THDJF.js";
+} from "./chunk-OCZMYSFX.js";
 
 // src/middleware.ts
 import {
@@ -68,6 +69,31 @@ async function nextgenMiddleware(req, options = {}) {
     pathname
   });
 }
+var DECODER = new TextDecoder();
+function isJwtShaped(token) {
+  const parts = token.split(".");
+  if (parts.length < 3 || !parts[0]) return false;
+  try {
+    const header = JSON.parse(
+      DECODER.decode(base64UrlDecode(parts[0]))
+    );
+    return typeof header?.alg === "string" && !("enc" in header);
+  } catch {
+    return false;
+  }
+}
+async function validateOpaqueSessionToken(token, issuerUrl, timeoutMs) {
+  try {
+    const res = await fetch(`${issuerUrl}/sessions/me`, {
+      method: "GET",
+      headers: { cookie: `__nextgen_session=${token}` },
+      signal: AbortSignal.timeout(timeoutMs)
+    });
+    return res.ok;
+  } catch {
+    return false;
+  }
+}
 async function proxyRequest(req, authUrl, proxyPath, proxyTimeoutMs, onExchangeResponse) {
   const url = new URL(req.url);
   const suffix = url.pathname.slice(proxyPath.length);
@@ -94,13 +120,20 @@ async function proxyRequest(req, authUrl, proxyPath, proxyTimeoutMs, onExchangeR
     upstreamHeaders.set("x-forwarded-proto", url.protocol.replace(":", ""));
   }
   const hasBody = !["GET", "HEAD"].includes(req.method);
+  const isExchangeRequest = req.method === "POST" && suffix.startsWith("/sessions/exchange");
+  if (isExchangeRequest && !upstreamHeaders.has("authorization")) {
+    const projectId = url.searchParams.get("project_id");
+    if (projectId) {
+      upstreamHeaders.set("authorization", `Bearer sk_${projectId}`);
+    }
+  }
+  const bodyBuffer = hasBody ? await req.arrayBuffer() : void 0;
   const upstream = await fetch(target, {
     method: req.method,
     headers: upstreamHeaders,
-    body: hasBody ? req.body : void 0,
+    body: bodyBuffer,
     redirect: "manual",
-    signal: AbortSignal.timeout(proxyTimeoutMs),
-    ...hasBody ? { duplex: "half" } : {}
+    signal: AbortSignal.timeout(proxyTimeoutMs)
   });
   const responseHeaders = filterResponseHeaders(upstream.headers);
   const setCookies = upstream.headers.getSetCookie?.() ?? [];
@@ -111,8 +144,7 @@ async function proxyRequest(req, authUrl, proxyPath, proxyTimeoutMs, onExchangeR
     status: upstream.status,
     headers: responseHeaders
   });
-  const isExchange = req.method === "POST" && suffix.startsWith("/sessions/exchange");
-  if (isExchange && onExchangeResponse) {
+  if (isExchangeRequest && onExchangeResponse) {
     response = await onExchangeResponse(response);
   }
   return response;
@@ -145,6 +177,19 @@ async function handleAuth(req, opts) {
     const tunnelled2 = tunnelHeaders(req, { "x-nextgen-auth-token": token });
     return NextResponse.next({ request: { headers: tunnelled2 } });
   }
+  if (!payload && cookieToken && !isJwtShaped(cookieToken)) {
+    const isValid = await validateOpaqueSessionToken(
+      cookieToken,
+      url,
+      jwksTimeoutMs ?? 5e3
+    );
+    if (isValid) {
+      const tunnelled2 = tunnelHeaders(req, {
+        "x-nextgen-auth-token": cookieToken
+      });
+      return NextResponse.next({ request: { headers: tunnelled2 } });
+    }
+  }
   const tunnelled = tunnelHeaders(req, { "x-nextgen-auth-token": "" });
   const staleNextgenCookies = req.cookies.getAll().filter((c) => c.name.startsWith("__nextgen"));
   if (matchesRoutes(pathname, protectedRoutes)) {

package/dist/chunk-B7S6XMT3.js

@@ -0,0 +1,41 @@
+import {
+  decodeJwt
+} from "./chunk-OCZMYSFX.js";
+
+// src/auth.ts
+import { headers } from "next/headers";
+async function auth() {
+  const headerStore = await headers();
+  const token = headerStore.get("x-nextgen-auth-token");
+  if (!token) {
+    return { isAuthenticated: false, session: null };
+  }
+  try {
+    const { payload } = decodeJwt(token);
+    if (payload.sub) {
+      return {
+        isAuthenticated: true,
+        session: {
+          userId: payload.sub,
+          email: payload.email ?? null,
+          name: payload.name ?? null,
+          token
+        }
+      };
+    }
+  } catch {
+  }
+  return {
+    isAuthenticated: true,
+    session: {
+      userId: "unknown",
+      email: null,
+      name: null,
+      token
+    }
+  };
+}
+
+export {
+  auth
+};

package/dist/{chunk-5P5THDJF.js → chunk-OCZMYSFX.js}

@@ -7,6 +7,7 @@ import {
 } from "@zitadel/sdk-core/jwt";
 
 export {
+  base64UrlDecode,
   decodeJwt,
   verifyJwt
 };

package/dist/index.js

@@ -1,11 +1,11 @@
 import {
   createProxy,
   nextgenMiddleware
-} from "./chunk-UTJFJPDR.js";
+} from "./chunk-4KENHIG4.js";
 import {
   auth
-} from "./chunk-EAUJMJ45.js";
-import "./chunk-5P5THDJF.js";
+} from "./chunk-B7S6XMT3.js";
+import "./chunk-OCZMYSFX.js";
 import "./chunk-6F4PWJZI.js";
 import {
   useAuth

package/dist/middleware.js

@@ -1,8 +1,8 @@
 import {
   createProxy,
   nextgenMiddleware
-} from "./chunk-UTJFJPDR.js";
-import "./chunk-5P5THDJF.js";
+} from "./chunk-4KENHIG4.js";
+import "./chunk-OCZMYSFX.js";
 export {
   createProxy,
   nextgenMiddleware

package/dist/server.js

@@ -1,7 +1,7 @@
 import {
   auth
-} from "./chunk-EAUJMJ45.js";
-import "./chunk-5P5THDJF.js";
+} from "./chunk-B7S6XMT3.js";
+import "./chunk-OCZMYSFX.js";
 export {
   auth
 };

package/package.json

@@ -1,6 +1,6 @@
 {
   "name": "@zitadel/sdk-next",
-  "version": "0.0.0",
+  "version": "0.1.0-alpha.10",
   "description": "Next.js helpers and mock auth UI for Zitadel",
   "homepage": "https://github.com/zitadel/nextgen/tree/main/packages/sdk-next#readme",
   "bugs": {
@@ -39,9 +39,9 @@
   },
   "dependencies": {
     "server-only": "^0.0.1",
-    "@zitadel/api": "0.0.0",
-    "@zitadel/sdk-core": "0.0.0",
-    "@zitadel/components": "0.0.0"
+    "@zitadel/api": "0.1.0-alpha.10",
+    "@zitadel/components": "0.1.0-alpha.10",
+    "@zitadel/sdk-core": "0.1.0-alpha.10"
   },
   "peerDependencies": {
     "next": ">=14",

package/dist/chunk-EAUJMJ45.js

@@ -1,34 +0,0 @@
-import {
-  decodeJwt
-} from "./chunk-5P5THDJF.js";
-
-// src/auth.ts
-import { headers } from "next/headers";
-async function auth() {
-  try {
-    const headerStore = await headers();
-    const token = headerStore.get("x-nextgen-auth-token");
-    if (!token) {
-      return { isAuthenticated: false, session: null };
-    }
-    const { payload } = decodeJwt(token);
-    if (!payload.sub) {
-      return { isAuthenticated: false, session: null };
-    }
-    return {
-      isAuthenticated: true,
-      session: {
-        userId: payload.sub,
-        email: payload.email ?? null,
-        name: payload.name ?? null,
-        token
-      }
-    };
-  } catch {
-    return { isAuthenticated: false, session: null };
-  }
-}
-
-export {
-  auth
-};

package/dist/tsconfig.tsbuildinfo

@@ -1 +0,0 @@
-{"fileNames":[],"fileInfos":[],"root":[],"options":{"composite":true,"declarationMap":true,"emitDeclarationOnly":true,"importHelpers":true,"module":99,"noEmitOnError":true,"noFallthroughCasesInSwitch":true,"noImplicitOverride":true,"noImplicitReturns":true,"noUncheckedIndexedAccess":true,"noUnusedLocals":true,"skipLibCheck":true,"strict":true,"target":9,"tsBuildInfoFile":"./tsconfig.tsbuildinfo"},"version":"5.9.3"}