@zitadel/sdk-next 0.1.0-alpha.9 → 0.1.0

package/dist/chunk-2BFQLJQE.js

@@ -1,27 +0,0 @@
-// src/context.tsx
-import { createContext, useContext } from "react";
-import { jsx } from "react/jsx-runtime";
-var defaultValue = { isAuthenticated: false, session: null };
-var NextgenAuthContext = createContext(defaultValue);
-function NextgenProvider({
-  session,
-  children
-}) {
-  let value;
-  if (!session) {
-    value = { isAuthenticated: false, session: null };
-  } else if ("isAuthenticated" in session) {
-    value = session;
-  } else {
-    value = { isAuthenticated: true, session };
-  }
-  return /* @__PURE__ */ jsx(NextgenAuthContext.Provider, { value, children });
-}
-function useAuthContext() {
-  return useContext(NextgenAuthContext);
-}
-
-export {
-  NextgenProvider,
-  useAuthContext
-};

package/dist/chunk-4KENHIG4.js

@@ -1,222 +0,0 @@
-import {
-  base64UrlDecode,
-  verifyJwt
-} from "./chunk-OCZMYSFX.js";
-
-// src/middleware.ts
-import {
-  HOP_BY_HOP,
-  INTERNAL_HEADERS,
-  filterResponseHeaders,
-  matchesRoutes
-} from "@zitadel/sdk-core/middleware";
-import { NextResponse } from "next/server";
-function tunnelHeaders(req, extra) {
-  const headers = new Headers(req.headers);
-  headers.delete("x-middleware-override-headers");
-  const injectedNames = [];
-  for (const [name, value] of Object.entries(extra)) {
-    headers.set(name, value);
-    headers.set(`x-middleware-request-${name}`, value);
-    injectedNames.push(name);
-  }
-  headers.set("x-middleware-override-headers", injectedNames.join(","));
-  return headers;
-}
-async function nextgenMiddleware(req, options = {}) {
-  const {
-    url = process.env.ZITADEL_URL ?? "http://localhost:8080",
-    proxyPath = "/__nextgen",
-    protectedRoutes = [],
-    ignoredRoutes = [],
-    loginPath = "/login",
-    allowedAlgorithms = ["RS256", "ES256"],
-    clockSkewMs = 5e3,
-    audience,
-    allowedTokenTypes = ["JWT", "at+JWT"],
-    jwksTimeoutMs,
-    proxyTimeoutMs = 5e3,
-    onExchangeResponse
-  } = options;
-  if (!loginPath.startsWith("/") || loginPath.startsWith("//")) {
-    throw new Error(
-      `[nextgen] loginPath must be a relative path starting with a single "/". Received: "${loginPath}". Using an absolute or protocol-relative URL would allow open-redirect attacks.`
-    );
-  }
-  const { pathname } = new URL(req.url);
-  if (matchesRoutes(pathname, ignoredRoutes)) {
-    const headers = tunnelHeaders(req, { "x-nextgen-auth-token": "" });
-    return NextResponse.next({ request: { headers } });
-  }
-  if (pathname === proxyPath || pathname.startsWith(`${proxyPath}/`)) {
-    return proxyRequest(
-      req,
-      url,
-      proxyPath,
-      proxyTimeoutMs,
-      onExchangeResponse
-    );
-  }
-  return handleAuth(req, {
-    url,
-    protectedRoutes,
-    loginPath,
-    allowedAlgorithms,
-    clockSkewMs,
-    audience,
-    allowedTokenTypes,
-    jwksTimeoutMs,
-    pathname
-  });
-}
-var DECODER = new TextDecoder();
-function isJwtShaped(token) {
-  const parts = token.split(".");
-  if (parts.length < 3 || !parts[0]) return false;
-  try {
-    const header = JSON.parse(
-      DECODER.decode(base64UrlDecode(parts[0]))
-    );
-    return typeof header?.alg === "string" && !("enc" in header);
-  } catch {
-    return false;
-  }
-}
-async function validateOpaqueSessionToken(token, issuerUrl, timeoutMs) {
-  try {
-    const res = await fetch(`${issuerUrl}/sessions/me`, {
-      method: "GET",
-      headers: { cookie: `__nextgen_session=${token}` },
-      signal: AbortSignal.timeout(timeoutMs)
-    });
-    return res.ok;
-  } catch {
-    return false;
-  }
-}
-async function proxyRequest(req, authUrl, proxyPath, proxyTimeoutMs, onExchangeResponse) {
-  const url = new URL(req.url);
-  const suffix = url.pathname.slice(proxyPath.length);
-  const target = `${authUrl}${suffix}${url.search}`;
-  const upstreamHeaders = new Headers();
-  for (const [key, value] of req.headers.entries()) {
-    const lower = key.toLowerCase();
-    if (!HOP_BY_HOP.has(lower) && !INTERNAL_HEADERS.has(lower)) {
-      upstreamHeaders.set(key, value);
-    }
-  }
-  const directIp = req.ip ?? req.headers.get("x-real-ip");
-  if (directIp) {
-    const existingXff = upstreamHeaders.get("x-forwarded-for");
-    upstreamHeaders.set(
-      "x-forwarded-for",
-      existingXff ? `${existingXff}, ${directIp}` : directIp
-    );
-  }
-  if (!upstreamHeaders.has("x-forwarded-host")) {
-    upstreamHeaders.set("x-forwarded-host", url.host);
-  }
-  if (!upstreamHeaders.has("x-forwarded-proto")) {
-    upstreamHeaders.set("x-forwarded-proto", url.protocol.replace(":", ""));
-  }
-  const hasBody = !["GET", "HEAD"].includes(req.method);
-  const isExchangeRequest = req.method === "POST" && suffix.startsWith("/sessions/exchange");
-  if (isExchangeRequest && !upstreamHeaders.has("authorization")) {
-    const projectId = url.searchParams.get("project_id");
-    if (projectId) {
-      upstreamHeaders.set("authorization", `Bearer sk_${projectId}`);
-    }
-  }
-  const bodyBuffer = hasBody ? await req.arrayBuffer() : void 0;
-  const upstream = await fetch(target, {
-    method: req.method,
-    headers: upstreamHeaders,
-    body: bodyBuffer,
-    redirect: "manual",
-    signal: AbortSignal.timeout(proxyTimeoutMs)
-  });
-  const responseHeaders = filterResponseHeaders(upstream.headers);
-  const setCookies = upstream.headers.getSetCookie?.() ?? [];
-  for (const cookie of setCookies) {
-    responseHeaders.append("set-cookie", cookie);
-  }
-  let response = new Response(upstream.body, {
-    status: upstream.status,
-    headers: responseHeaders
-  });
-  if (isExchangeRequest && onExchangeResponse) {
-    response = await onExchangeResponse(response);
-  }
-  return response;
-}
-async function handleAuth(req, opts) {
-  const {
-    url,
-    protectedRoutes,
-    loginPath,
-    allowedAlgorithms,
-    clockSkewMs,
-    audience,
-    allowedTokenTypes,
-    jwksTimeoutMs,
-    pathname
-  } = opts;
-  const authHeader = req.headers.get("authorization");
-  const bearerToken = authHeader?.startsWith("Bearer ") ? authHeader.slice(7) : null;
-  const cookieToken = req.cookies.get("__nextgen_session")?.value ?? null;
-  const token = bearerToken ?? cookieToken;
-  const payload = token ? await verifyJwt(token, {
-    issuerUrl: url,
-    allowedAlgorithms,
-    clockSkewMs,
-    audience,
-    allowedTokenTypes,
-    jwksTimeoutMs
-  }) : null;
-  if (payload && token && payload.sub) {
-    const tunnelled2 = tunnelHeaders(req, { "x-nextgen-auth-token": token });
-    return NextResponse.next({ request: { headers: tunnelled2 } });
-  }
-  if (!payload && cookieToken && !isJwtShaped(cookieToken)) {
-    const isValid = await validateOpaqueSessionToken(
-      cookieToken,
-      url,
-      jwksTimeoutMs ?? 5e3
-    );
-    if (isValid) {
-      const tunnelled2 = tunnelHeaders(req, {
-        "x-nextgen-auth-token": cookieToken
-      });
-      return NextResponse.next({ request: { headers: tunnelled2 } });
-    }
-  }
-  const tunnelled = tunnelHeaders(req, { "x-nextgen-auth-token": "" });
-  const staleNextgenCookies = req.cookies.getAll().filter((c) => c.name.startsWith("__nextgen"));
-  if (matchesRoutes(pathname, protectedRoutes)) {
-    const loginUrl = new URL(loginPath, req.url);
-    loginUrl.searchParams.set("next", pathname);
-    const redirect = NextResponse.redirect(loginUrl, { status: 302 });
-    for (const cookie of staleNextgenCookies) {
-      redirect.cookies.delete(cookie.name);
-    }
-    return redirect;
-  }
-  const response = NextResponse.next({ request: { headers: tunnelled } });
-  for (const cookie of staleNextgenCookies) {
-    response.cookies.delete(cookie.name);
-  }
-  return response;
-}
-function createProxy(config, options = {}) {
-  const mergedOptions = {
-    ...options,
-    proxyPath: config.proxyPath,
-    url: config.url
-  };
-  return (req) => nextgenMiddleware(req, mergedOptions);
-}
-
-export {
-  nextgenMiddleware,
-  createProxy
-};

package/dist/chunk-B7S6XMT3.js

@@ -1,41 +0,0 @@
-import {
-  decodeJwt
-} from "./chunk-OCZMYSFX.js";
-
-// src/auth.ts
-import { headers } from "next/headers";
-async function auth() {
-  const headerStore = await headers();
-  const token = headerStore.get("x-nextgen-auth-token");
-  if (!token) {
-    return { isAuthenticated: false, session: null };
-  }
-  try {
-    const { payload } = decodeJwt(token);
-    if (payload.sub) {
-      return {
-        isAuthenticated: true,
-        session: {
-          userId: payload.sub,
-          email: payload.email ?? null,
-          name: payload.name ?? null,
-          token
-        }
-      };
-    }
-  } catch {
-  }
-  return {
-    isAuthenticated: true,
-    session: {
-      userId: "unknown",
-      email: null,
-      name: null,
-      token
-    }
-  };
-}
-
-export {
-  auth
-};

package/dist/chunk-OCZMYSFX.js

@@ -1,13 +0,0 @@
-// src/lib/jwt.ts
-import {
-  JWKS_TTL_MS,
-  base64UrlDecode,
-  decodeJwt,
-  verifyJwt
-} from "@zitadel/sdk-core/jwt";
-
-export {
-  base64UrlDecode,
-  decodeJwt,
-  verifyJwt
-};

package/dist/chunk-XTCHTAIQ.js

@@ -1,12 +0,0 @@
-import {
-  useAuthContext
-} from "./chunk-2BFQLJQE.js";
-
-// src/useAuth.ts
-function useAuth() {
-  return useAuthContext();
-}
-
-export {
-  useAuth
-};