@zitadel/sdk-next 0.1.0-alpha.10 → 0.1.0-alpha.12

package/dist/auth.d.ts

@@ -1,4 +1,4 @@
-import { AuthResult } from '@zitadel/sdk-core/types';
+import { AuthResult } from '@zitadel/sdk-core/middleware';
 
 /**
  * Reads the auth state in a React Server Component or Next.js Route Handler.

package/dist/auth.js

@@ -1,7 +1,7 @@
 import {
   auth
-} from "./chunk-B7S6XMT3.js";
-import "./chunk-OCZMYSFX.js";
+} from "./chunk-WZU5OYIF.js";
+import "./chunk-KHTLEMQO.js";
 export {
   auth
 };

package/dist/{chunk-4KENHIG4.js → chunk-7D5LORRL.js}

@@ -1,7 +1,7 @@
 import {
   base64UrlDecode,
   verifyJwt
-} from "./chunk-OCZMYSFX.js";
+} from "./chunk-KHTLEMQO.js";
 
 // src/middleware.ts
 import {
@@ -35,8 +35,7 @@ async function nextgenMiddleware(req, options = {}) {
     audience,
     allowedTokenTypes = ["JWT", "at+JWT"],
     jwksTimeoutMs,
-    proxyTimeoutMs = 5e3,
-    onExchangeResponse
+    proxyTimeoutMs = 5e3
   } = options;
   if (!loginPath.startsWith("/") || loginPath.startsWith("//")) {
     throw new Error(
@@ -49,13 +48,7 @@ async function nextgenMiddleware(req, options = {}) {
     return NextResponse.next({ request: { headers } });
   }
   if (pathname === proxyPath || pathname.startsWith(`${proxyPath}/`)) {
-    return proxyRequest(
-      req,
-      url,
-      proxyPath,
-      proxyTimeoutMs,
-      onExchangeResponse
-    );
+    return proxyRequest(req, url, proxyPath, proxyTimeoutMs);
   }
   return handleAuth(req, {
     url,
@@ -74,9 +67,7 @@ function isJwtShaped(token) {
   const parts = token.split(".");
   if (parts.length < 3 || !parts[0]) return false;
   try {
-    const header = JSON.parse(
-      DECODER.decode(base64UrlDecode(parts[0]))
-    );
+    const header = JSON.parse(DECODER.decode(base64UrlDecode(parts[0])));
     return typeof header?.alg === "string" && !("enc" in header);
   } catch {
     return false;
@@ -94,7 +85,7 @@ async function validateOpaqueSessionToken(token, issuerUrl, timeoutMs) {
     return false;
   }
 }
-async function proxyRequest(req, authUrl, proxyPath, proxyTimeoutMs, onExchangeResponse) {
+async function proxyRequest(req, authUrl, proxyPath, proxyTimeoutMs) {
   const url = new URL(req.url);
   const suffix = url.pathname.slice(proxyPath.length);
   const target = `${authUrl}${suffix}${url.search}`;
@@ -108,10 +99,7 @@ async function proxyRequest(req, authUrl, proxyPath, proxyTimeoutMs, onExchangeR
   const directIp = req.ip ?? req.headers.get("x-real-ip");
   if (directIp) {
     const existingXff = upstreamHeaders.get("x-forwarded-for");
-    upstreamHeaders.set(
-      "x-forwarded-for",
-      existingXff ? `${existingXff}, ${directIp}` : directIp
-    );
+    upstreamHeaders.set("x-forwarded-for", existingXff ? `${existingXff}, ${directIp}` : directIp);
   }
   if (!upstreamHeaders.has("x-forwarded-host")) {
     upstreamHeaders.set("x-forwarded-host", url.host);
@@ -120,11 +108,10 @@ async function proxyRequest(req, authUrl, proxyPath, proxyTimeoutMs, onExchangeR
     upstreamHeaders.set("x-forwarded-proto", url.protocol.replace(":", ""));
   }
   const hasBody = !["GET", "HEAD"].includes(req.method);
-  const isExchangeRequest = req.method === "POST" && suffix.startsWith("/sessions/exchange");
-  if (isExchangeRequest && !upstreamHeaders.has("authorization")) {
-    const projectId = url.searchParams.get("project_id");
-    if (projectId) {
-      upstreamHeaders.set("authorization", `Bearer sk_${projectId}`);
+  if (!upstreamHeaders.has("authorization")) {
+    const secret = process.env.ZITADEL_PROJECT_SECRET;
+    if (secret) {
+      upstreamHeaders.set("authorization", `Bearer ${secret}`);
     }
   }
   const bodyBuffer = hasBody ? await req.arrayBuffer() : void 0;
@@ -140,14 +127,10 @@ async function proxyRequest(req, authUrl, proxyPath, proxyTimeoutMs, onExchangeR
   for (const cookie of setCookies) {
     responseHeaders.append("set-cookie", cookie);
   }
-  let response = new Response(upstream.body, {
+  return new Response(upstream.body, {
     status: upstream.status,
     headers: responseHeaders
   });
-  if (isExchangeRequest && onExchangeResponse) {
-    response = await onExchangeResponse(response);
-  }
-  return response;
 }
 async function handleAuth(req, opts) {
   const {
@@ -178,11 +161,7 @@ async function handleAuth(req, opts) {
     return NextResponse.next({ request: { headers: tunnelled2 } });
   }
   if (!payload && cookieToken && !isJwtShaped(cookieToken)) {
-    const isValid = await validateOpaqueSessionToken(
-      cookieToken,
-      url,
-      jwksTimeoutMs ?? 5e3
-    );
+    const isValid = await validateOpaqueSessionToken(cookieToken, url, jwksTimeoutMs ?? 5e3);
     if (isValid) {
       const tunnelled2 = tunnelHeaders(req, {
         "x-nextgen-auth-token": cookieToken

package/dist/chunk-KHTLEMQO.js

@@ -0,0 +1,8 @@
+// src/lib/jwt.ts
+import { JWKS_TTL_MS, base64UrlDecode, decodeJwt, verifyJwt } from "@zitadel/sdk-core/jwt";
+
+export {
+  base64UrlDecode,
+  decodeJwt,
+  verifyJwt
+};

package/dist/{chunk-B7S6XMT3.js → chunk-WZU5OYIF.js}

@@ -1,6 +1,6 @@
 import {
   decodeJwt
-} from "./chunk-OCZMYSFX.js";
+} from "./chunk-KHTLEMQO.js";
 
 // src/auth.ts
 import { headers } from "next/headers";

package/dist/context.d.ts

@@ -1,6 +1,6 @@
 import * as react_jsx_runtime from 'react/jsx-runtime';
 import { ReactNode } from 'react';
-import { AuthResult, NextgenSession } from '@zitadel/sdk-core/types';
+import { AuthResult, NextgenSession } from '@zitadel/sdk-core/middleware';
 
 declare function NextgenProvider({ session, children, }: {
     session: AuthResult | NextgenSession | null;

package/dist/index.d.ts

@@ -1,4 +1,4 @@
-export { AuthResult, AuthState, NextgenMiddlewareOptions, NextgenSession, UnauthState } from '@zitadel/sdk-core/types';
+export { AuthResult, AuthState, NextgenMiddlewareOptions, NextgenSession, UnauthState } from '@zitadel/sdk-core/middleware';
 export { ProxyHandler, ProxyOptions, createProxy, nextgenMiddleware } from './middleware.js';
 export { auth } from './auth.js';
 export { NextgenProvider, useAuthContext } from './context.js';

package/dist/index.js

@@ -1,11 +1,11 @@
 import {
   createProxy,
   nextgenMiddleware
-} from "./chunk-4KENHIG4.js";
+} from "./chunk-7D5LORRL.js";
 import {
   auth
-} from "./chunk-B7S6XMT3.js";
-import "./chunk-OCZMYSFX.js";
+} from "./chunk-WZU5OYIF.js";
+import "./chunk-KHTLEMQO.js";
 import "./chunk-6F4PWJZI.js";
 import {
   useAuth

package/dist/middleware.d.ts

@@ -1,5 +1,5 @@
 import { ZitadelProject } from '@zitadel/api/config';
-import { NextgenMiddlewareOptions } from '@zitadel/sdk-core/types';
+import { NextgenMiddlewareOptions } from '@zitadel/sdk-core/middleware';
 import { NextRequest, NextResponse } from 'next/server';
 
 /**
@@ -38,7 +38,7 @@ declare function nextgenMiddleware(req: NextRequest, options?: NextgenMiddleware
  * `proxyPath` and `url` are omitted because they come from the
  * {@link ZitadelConfig} passed as the first argument.
  */
-type ProxyOptions = Omit<NextgenMiddlewareOptions, 'proxyPath' | 'url'>;
+type ProxyOptions = Omit<NextgenMiddlewareOptions, "proxyPath" | "url">;
 /**
  * A pre-configured middleware handler returned by {@link createProxy}.
  */

package/dist/middleware.js

@@ -1,8 +1,8 @@
 import {
   createProxy,
   nextgenMiddleware
-} from "./chunk-4KENHIG4.js";
-import "./chunk-OCZMYSFX.js";
+} from "./chunk-7D5LORRL.js";
+import "./chunk-KHTLEMQO.js";
 export {
   createProxy,
   nextgenMiddleware

package/dist/server.d.ts

@@ -1,2 +1,2 @@
 export { auth } from './auth.js';
-import '@zitadel/sdk-core/types';
+import '@zitadel/sdk-core/middleware';

package/dist/server.js

@@ -1,7 +1,7 @@
 import {
   auth
-} from "./chunk-B7S6XMT3.js";
-import "./chunk-OCZMYSFX.js";
+} from "./chunk-WZU5OYIF.js";
+import "./chunk-KHTLEMQO.js";
 export {
   auth
 };

package/dist/types.d.ts

@@ -1,3 +1,3 @@
-export { AuthResult, AuthState, NextgenMiddlewareOptions, NextgenSession, UnauthState } from '@zitadel/sdk-core/types';
+export { AuthResult, AuthState, NextgenMiddlewareOptions, NextgenSession, UnauthState } from '@zitadel/sdk-core/middleware';
 import '@zitadel/components';
 import '@zitadel/api/config';

package/dist/useAuth.d.ts

@@ -1,4 +1,4 @@
-import { AuthResult } from '@zitadel/sdk-core/types';
+import { AuthResult } from '@zitadel/sdk-core/middleware';
 
 declare function useAuth(): AuthResult;
 

package/package.json

@@ -1,6 +1,6 @@
 {
   "name": "@zitadel/sdk-next",
-  "version": "0.1.0-alpha.10",
+  "version": "0.1.0-alpha.12",
   "description": "Next.js helpers and mock auth UI for Zitadel",
   "homepage": "https://github.com/zitadel/nextgen/tree/main/packages/sdk-next#readme",
   "bugs": {
@@ -39,9 +39,9 @@
   },
   "dependencies": {
     "server-only": "^0.0.1",
-    "@zitadel/api": "0.1.0-alpha.10",
-    "@zitadel/components": "0.1.0-alpha.10",
-    "@zitadel/sdk-core": "0.1.0-alpha.10"
+    "@zitadel/api": "0.1.0-alpha.12",
+    "@zitadel/components": "0.1.0-alpha.12",
+    "@zitadel/sdk-core": "0.1.0-alpha.12"
   },
   "peerDependencies": {
     "next": ">=14",
@@ -50,12 +50,10 @@
   },
   "devDependencies": {
     "@eslint/js": "^9.0.0",
-    "tsup": "^8.3.5",
-    "typescript": "^5.7.3",
     "@eslint/json": "^0.11.0",
     "@eslint/markdown": "^6.0.0",
-    "@testing-library/react": "^16.0.0",
-    "@testing-library/user-event": "^14.0.0",
+    "@testing-library/react": "^16.3.2",
+    "@testing-library/user-event": "^14.6.1",
     "@types/react": "^19.2.14",
     "eslint": "^9.0.0",
     "eslint-config-prettier": "^10.0.0",
@@ -67,9 +65,11 @@
     "eslint-plugin-react": "^7.37.0",
     "eslint-plugin-react-hooks": "^5.0.0",
     "eslint-plugin-testing-library": "^7.0.0",
-    "jsdom": "^26.0.0",
+    "jsdom": "^29.0.2",
     "next": "^16.2.4",
     "prettier": "^3.0.0",
+    "tsup": "^8.3.5",
+    "typescript": "^5.7.3",
     "typescript-eslint": "^8.0.0",
     "vitest": "^3.0.0"
   },

package/dist/chunk-OCZMYSFX.js

@@ -1,13 +0,0 @@
-// src/lib/jwt.ts
-import {
-  JWKS_TTL_MS,
-  base64UrlDecode,
-  decodeJwt,
-  verifyJwt
-} from "@zitadel/sdk-core/jwt";
-
-export {
-  base64UrlDecode,
-  decodeJwt,
-  verifyJwt
-};