authscape 1.0.774 → 1.0.776

package/index.js

@@ -776,14 +776,25 @@ function AuthScapeApp(_ref0) {
   // back to /signin-oidc (a URL with no Next.js page in the consumer project),
   // useSearchParams() returns null and the PKCE code is never picked up.
   // The Pages Router router parses query from `asPath` and works on 404 too.
+  //
+  // SSR safety: accessing `router.isReady`, `router.query`, `router.asPath`
+  // throws "NextRouter was not mounted" on server-side renders where the
+  // router singleton hasn't been initialized (Static Generation, _error
+  // pages, some edge-runtime paths). We only do the work on the client.
   var router = (0, _router.useRouter)();
-  var rawQueryCode = router.isReady ? router.query.code : null;
-  // router.query values can be string | string[] — coerce to a single string.
-  var queryCode = typeof rawQueryCode === "string" ? rawQueryCode : Array.isArray(rawQueryCode) ? rawQueryCode[0] : null;
-  // Pages Router's `router.pathname` returns the route file path (e.g. "/_error"
-  // for the 404 page). The auth-redirect guard below compares against
-  // "/signin-oidc", so we derive the actual URL path from `asPath` instead.
-  var pathname = (router.asPath || "").split("?")[0].split("#")[0];
+  var queryCode = null;
+  var pathname = "";
+  if (typeof window !== "undefined") {
+    try {
+      if (router && router.isReady) {
+        var raw = router.query && router.query.code;
+        queryCode = typeof raw === "string" ? raw : Array.isArray(raw) ? raw[0] : null;
+      }
+      pathname = (router && router.asPath || "").split("?")[0].split("#")[0];
+    } catch (_) {
+      // router not mounted (SSR / static render) — leave defaults
+    }
+  }
   var signInValidator = /*#__PURE__*/function () {
     var _ref1 = _asyncToGenerator(/*#__PURE__*/_regeneratorRuntime().mark(function _callee8(codeFromQuery) {
       var codeVerifier, headers, body, response, domainHost, redirectUri, usr, enrichedUser;

package/package.json

@@ -1,6 +1,6 @@
 {
   "name": "authscape",
-  "version": "1.0.774",
+  "version": "1.0.776",
   "description": "",
   "main": "index.js",
   "files": [

package/src/components/AuthScapeApp.js

@@ -507,16 +507,27 @@ export function AuthScapeApp({
   // back to /signin-oidc (a URL with no Next.js page in the consumer project),
   // useSearchParams() returns null and the PKCE code is never picked up.
   // The Pages Router router parses query from `asPath` and works on 404 too.
+  //
+  // SSR safety: accessing `router.isReady`, `router.query`, `router.asPath`
+  // throws "NextRouter was not mounted" on server-side renders where the
+  // router singleton hasn't been initialized (Static Generation, _error
+  // pages, some edge-runtime paths). We only do the work on the client.
   const router = useRouter();
-  const rawQueryCode = router.isReady ? router.query.code : null;
-  // router.query values can be string | string[] — coerce to a single string.
-  const queryCode = typeof rawQueryCode === "string"
-    ? rawQueryCode
-    : (Array.isArray(rawQueryCode) ? rawQueryCode[0] : null);
-  // Pages Router's `router.pathname` returns the route file path (e.g. "/_error"
-  // for the 404 page). The auth-redirect guard below compares against
-  // "/signin-oidc", so we derive the actual URL path from `asPath` instead.
-  const pathname = (router.asPath || "").split("?")[0].split("#")[0];
+  let queryCode = null;
+  let pathname = "";
+  if (typeof window !== "undefined") {
+    try {
+      if (router && router.isReady) {
+        const raw = router.query && router.query.code;
+        queryCode = typeof raw === "string"
+          ? raw
+          : (Array.isArray(raw) ? raw[0] : null);
+      }
+      pathname = ((router && router.asPath) || "").split("?")[0].split("#")[0];
+    } catch (_) {
+      // router not mounted (SSR / static render) — leave defaults
+    }
+  }
 
   const signInValidator = async (codeFromQuery) => {
     if (queryCodeUsed.current === codeFromQuery) return;