azirid-react 0.14.3 → 0.14.5

package/README.md

@@ -1432,6 +1432,11 @@ export const proxy = createAziridProxy({
   // The original URL is preserved as ?redirect= so you can send them back after login.
   loginUrl: '/login',
 
+  // Where to redirect authenticated users when they visit a public route.
+  // E.g. user is logged in and visits /login → redirected to /dashboard.
+  // Your app handles role-based routing from there.
+  dashboardUrl: '/dashboard',
+
   // Routes that are ALWAYS public, even if they match a protectedRoute.
   // Default: ['/login', '/signup', '/auth/handoff']
   publicRoutes: [
@@ -1452,12 +1457,20 @@ export const config = {
 
 #### How it works
 
+**Unauthenticated user visits protected route:**
 1. User visits `/dashboard/settings` without a valid token
 2. Middleware checks: is `/dashboard/settings` protected? Yes (`startsWith('/dashboard')`)
 3. Middleware checks: is it public? No
 4. Middleware redirects to `/login?redirect=/dashboard/settings`
 5. After login, you can read `?redirect=` and send them back
 
+**Authenticated user visits public route (with `dashboardUrl`):**
+1. User is logged in and visits `/login`
+2. Middleware validates the JWT — valid
+3. Middleware checks: is `/login` a public route? Yes
+4. `dashboardUrl` is set → redirects to `/dashboard`
+5. Your app handles role-based routing from there (e.g. redirect admins to `/admin`)
+
 Routes not listed in `protectedRoutes` are accessible to everyone (e.g. `/`, `/pricing`, `/about`).
 
 #### Options
@@ -1466,9 +1479,9 @@ Routes not listed in `protectedRoutes` are accessible to everyone (e.g. `/`, `/p
 | ------------------ | ---------- | -------------------------------- | ------------------------------------------------------------- |
 | `protectedRoutes`  | `string[]` | —                                | Routes that require auth (matched with `startsWith`)          |
 | `loginUrl`         | `string`   | `"/login"`                       | Redirect target for unauthenticated users                     |
+| `dashboardUrl`     | `string`   | —                                | Redirect authenticated users away from public routes here     |
 | `publicRoutes`     | `string[]` | `["/login", "/signup", "/auth/handoff"]` | Always-accessible routes, even if inside a protected path |
 | `cookieName`       | `string`   | `"__session"`                    | Cookie carrying the access token JWT                          |
-| `jwksUrl`          | `string`   | auto                             | Override JWKS endpoint URL                                    |
 
 ---
 

package/dist/index.cjs

@@ -4853,7 +4853,7 @@ function usePasswordToggle() {
 }
 
 // src/index.ts
-var SDK_VERSION = "0.14.3";
+var SDK_VERSION = "0.14.5";
 
 exports.AUTH_BASE_PATH = AUTH_BASE_PATH;
 exports.AuthForm = AuthForm;

package/dist/index.js

@@ -4851,7 +4851,7 @@ function usePasswordToggle() {
 }
 
 // src/index.ts
-var SDK_VERSION = "0.14.3";
+var SDK_VERSION = "0.14.5";
 
 export { AUTH_BASE_PATH, AuthForm, AziridProvider, CheckoutButton, ForgotPasswordForm, HandoffCallback, InvoiceList, LoginForm, PATHS, PayButton, PayphoneCallback, PayphoneWidgetRenderer, PricingTable, ReferralCard, ReferralStats, ResetPasswordForm, SDK_VERSION, SignupForm, SubscriptionBadge, buildPaths, changePasswordSchema, cn, createAccessClient, createForgotPasswordSchema, createLoginSchema, createMutationHook, createResetPasswordConfirmSchema, createSignupSchema, en, es, forgotPasswordSchema, isAuthError, loginSchema, magicLinkRequestSchema, magicLinkVerifySchema, passkeyRegisterStartSchema, removeStyles, resetPasswordConfirmSchema, resolveMessages, signupSchema, socialLoginSchema, useAccessClient, useAzirid, useBootstrap, useBranches, useBranding, useChangePassword, useCheckout, useFormState, useInvoices, useLogin, useLogout, useMagicLink, useMessages, usePasskeys, usePasswordReset, usePasswordToggle, usePayButton, usePaymentMethods, usePaymentProviders, usePayphoneCheckout, usePayphoneConfirm, usePlans, useReferral, useReferralStats, useRefresh, useSession, useSignup, useSocialLogin, useSubmitTransferProof, useSubscription, useSwitchTenant, useTenantMembers, useTenants, useTransferPayment, useTransferProofs, useUploadTransferProof };
 //# sourceMappingURL=index.js.map

package/dist/next-proxy.cjs

@@ -4,39 +4,68 @@ var server = require('next/server');
 var jose = require('jose');
 
 // src/next-proxy.ts
-var jwks = null;
-function getJwks(jwksUrl) {
-  if (jwks) return jwks;
-  const url = jwksUrl ?? `${process.env.AZIRID_API_URL ?? "https://api.azirid.com"}/v1/.well-known/jwks.json`;
-  jwks = jose.createRemoteJWKSet(new URL(url));
-  return jwks;
+var keyCache = /* @__PURE__ */ new Map();
+var CACHE_TTL = 5 * 60 * 1e3;
+function extractKid(token) {
+  try {
+    const headerB64 = token.split(".")[0];
+    const header = JSON.parse(
+      typeof Buffer !== "undefined" ? Buffer.from(headerB64, "base64url").toString() : atob(headerB64.replace(/-/g, "+").replace(/_/g, "/"))
+    );
+    return header.kid ?? null;
+  } catch {
+    return null;
+  }
+}
+async function resolveKey(kid, apiUrl) {
+  const cached = keyCache.get(kid);
+  if (cached && Date.now() - cached.cachedAt < CACHE_TTL) return cached.key;
+  const res = await fetch(`${apiUrl}/v1/.well-known/jwks/${kid}.json`);
+  if (!res.ok) throw new Error(`JWKS fetch failed: ${res.status}`);
+  const { keys } = await res.json();
+  if (!keys?.length) throw new Error(`No key found for kid: ${kid}`);
+  const key = await jose.importJWK(keys[0], "RS256");
+  keyCache.set(kid, { key, cachedAt: Date.now() });
+  return key;
 }
 function createRequestInterceptor(options) {
   const cookieName = options?.cookieName ?? "__session";
   const loginUrl = options?.loginUrl ?? "/login";
+  const apiUrl = (options?.apiUrl ?? process.env.AZIRID_API_URL ?? "https://api.azirid.com").replace(/\/$/, "");
   const defaultPublic = ["/login", "/signup", "/auth/handoff"];
   const publicRoutes = options?.publicRoutes ? [.../* @__PURE__ */ new Set([...options.publicRoutes, "/auth/handoff"])] : defaultPublic;
   const protectedRoutes = options?.protectedRoutes;
+  const dashboardUrl = options?.dashboardUrl;
   return async function handler(request) {
     const { pathname } = request.nextUrl;
     const token = request.cookies.get(cookieName)?.value;
     const response = server.NextResponse.next();
     if (token) {
       try {
-        const keySet = getJwks(options?.jwksUrl);
-        const { payload } = await jose.jwtVerify(token, keySet);
+        const kid = extractKid(token);
+        if (!kid) throw new Error("JWT missing kid");
+        const key = await resolveKey(kid, apiUrl);
+        const { payload } = await jose.jwtVerify(token, key);
         response.headers.set("x-azirid-token", token);
         if (payload.sub) response.headers.set("x-azirid-user-id", payload.sub);
       } catch (err) {
         if (typeof console !== "undefined") {
-          console.warn("[azirid-proxy] JWT validation failed:", err instanceof Error ? err.message : err);
+          console.warn(
+            "[azirid-proxy] JWT validation failed:",
+            err instanceof Error ? err.message : err
+          );
         }
         response.headers.set("Set-Cookie", `${cookieName}=; Path=/; Max-Age=0; SameSite=Lax`);
       }
     }
+    const hasValidToken = response.headers.has("x-azirid-token");
+    const isPublic = publicRoutes.some((r) => pathname.startsWith(r));
+    if (dashboardUrl && hasValidToken && isPublic && pathname !== dashboardUrl) {
+      const url = request.nextUrl.clone();
+      url.pathname = dashboardUrl;
+      return server.NextResponse.redirect(url);
+    }
     if (protectedRoutes) {
-      const hasValidToken = response.headers.has("x-azirid-token");
-      const isPublic = publicRoutes.some((r) => pathname.startsWith(r));
       const isProtected = protectedRoutes.some((r) => pathname.startsWith(r));
       if (isProtected && !isPublic && !hasValidToken) {
         const url = request.nextUrl.clone();

package/dist/next-proxy.cjs.map

@@ -1 +1 @@
-{"version":3,"sources":["../src/next-proxy.ts"],"names":["createRemoteJWKSet","NextResponse","jwtVerify"],"mappings":";;;;;;AA+CA,IAAI,IAAA,GAAqD,IAAA;AAEzD,SAAS,QAAQ,OAAA,EAAyD;AACxE,EAAA,IAAI,MAAM,OAAO,IAAA;AACjB,EAAA,MAAM,MACJ,OAAA,IACA,CAAA,EAAG,OAAA,CAAQ,GAAA,CAAI,kBAAkB,wBAAwB,CAAA,yBAAA,CAAA;AAC3D,EAAA,IAAA,GAAOA,uBAAA,CAAmB,IAAI,GAAA,CAAI,GAAG,CAAC,CAAA;AACtC,EAAA,OAAO,IAAA;AACT;AAIA,SAAS,yBAAyB,OAAA,EAA8B;AAC9D,EAAA,MAAM,UAAA,GAAa,SAAS,UAAA,IAAc,WAAA;AAC1C,EAAA,MAAM,QAAA,GAAW,SAAS,QAAA,IAAY,QAAA;AACtC,EAAA,MAAM,aAAA,GAAgB,CAAC,QAAA,EAAU,SAAA,EAAW,eAAe,CAAA;AAC3D,EAAA,MAAM,YAAA,GAAe,OAAA,EAAS,YAAA,GAC1B,CAAC,mBAAG,IAAI,GAAA,CAAI,CAAC,GAAG,OAAA,CAAQ,YAAA,EAAc,eAAe,CAAC,CAAC,CAAA,GACvD,aAAA;AACJ,EAAA,MAAM,kBAAkB,OAAA,EAAS,eAAA;AAEjC,EAAA,OAAO,eAAe,QAAQ,OAAA,EAAsB;AAClD,IAAA,MAAM,EAAE,QAAA,EAAS,GAAI,OAAA,CAAQ,OAAA;AAC7B,IAAA,MAAM,KAAA,GAAQ,OAAA,CAAQ,OAAA,CAAQ,GAAA,CAAI,UAAU,CAAA,EAAG,KAAA;AAE/C,IAAA,MAAM,QAAA,GAAWC,oBAAa,IAAA,EAAK;AAEnC,IAAA,IAAI,KAAA,EAAO;AACT,MAAA,IAAI;AACF,QAAA,MAAM,MAAA,GAAS,OAAA,CAAQ,OAAA,EAAS,OAAO,CAAA;AACvC,QAAA,MAAM,EAAE,OAAA,EAAQ,GAAI,MAAMC,cAAA,CAAU,OAAO,MAAM,CAAA;AAEjD,QAAA,QAAA,CAAS,OAAA,CAAQ,GAAA,CAAI,gBAAA,EAAkB,KAAK,CAAA;AAC5C,QAAA,IAAI,QAAQ,GAAA,EAAK,QAAA,CAAS,QAAQ,GAAA,CAAI,kBAAA,EAAoB,QAAQ,GAAG,CAAA;AAAA,MACvE,SAAS,GAAA,EAAK;AAEZ,QAAA,IAAI,OAAO,YAAY,WAAA,EAAa;AAClC,UAAA,OAAA,CAAQ,KAAK,uCAAA,EAAyC,GAAA,YAAe,KAAA,GAAQ,GAAA,CAAI,UAAU,GAAG,CAAA;AAAA,QAChG;AACA,QAAA,QAAA,CAAS,OAAA,CAAQ,GAAA,CAAI,YAAA,EAAc,CAAA,EAAG,UAAU,CAAA,kCAAA,CAAoC,CAAA;AAAA,MACtF;AAAA,IACF;AAGA,IAAA,IAAI,eAAA,EAAiB;AACnB,MAAA,MAAM,aAAA,GAAgB,QAAA,CAAS,OAAA,CAAQ,GAAA,CAAI,gBAAgB,CAAA;AAC3D,MAAA,MAAM,QAAA,GAAW,aAAa,IAAA,CAAK,CAAC,MAAM,QAAA,CAAS,UAAA,CAAW,CAAC,CAAC,CAAA;AAChE,MAAA,MAAM,WAAA,GAAc,gBAAgB,IAAA,CAAK,CAAC,MAAM,QAAA,CAAS,UAAA,CAAW,CAAC,CAAC,CAAA;AAEtE,MAAA,IAAI,WAAA,IAAe,CAAC,QAAA,IAAY,CAAC,aAAA,EAAe;AAC9C,QAAA,MAAM,GAAA,GAAM,OAAA,CAAQ,OAAA,CAAQ,KAAA,EAAM;AAClC,QAAA,GAAA,CAAI,QAAA,GAAW,QAAA;AACf,QAAA,GAAA,CAAI,YAAA,CAAa,GAAA,CAAI,UAAA,EAAY,QAAQ,CAAA;AACzC,QAAA,OAAOD,mBAAA,CAAa,SAAS,GAAG,CAAA;AAAA,MAClC;AAAA,IACF;AAEA,IAAA,OAAO,QAAA;AAAA,EACT,CAAA;AACF;AAyBO,SAAS,kBAAkB,OAAA,EAA8B;AAC9D,EAAA,OAAO,yBAAyB,OAAO,CAAA;AACzC;AAGO,IAAM,cAAc,iBAAA","file":"next-proxy.cjs","sourcesContent":["/**\n * Next.js middleware for Azirid Access.\n *\n * Validates the `__session` JWT cookie using JWKS and provides\n * route protection and token forwarding for server components.\n *\n * @example Next.js 16+ (proxy.ts)\n * ```ts\n * // proxy.ts\n * export { aziridProxy as proxy } from \"azirid-react/next/proxy\";\n * export const config = { matcher: [\"/((?!_next|favicon.ico|api/).*)\"] };\n * ```\n *\n * @example Next.js 16+ with custom options\n * ```ts\n * // proxy.ts\n * import { createAziridProxy } from \"azirid-react/next/proxy\";\n * export const proxy = createAziridProxy({\n *   protectedRoutes: [\"/dashboard\"],\n *   loginUrl: \"/login\",\n * });\n * export const config = { matcher: [\"/((?!_next|favicon.ico|api/).*)\"] };\n * ```\n *\n * @packageDocumentation\n */\n\nimport { NextResponse, type NextRequest } from 'next/server'\nimport { createRemoteJWKSet, jwtVerify } from 'jose'\n\n// ─── Options ────────────────────────────────────────────────\n\nexport interface AziridProxyOptions {\n  /** Cookie name that carries the access token JWT (default: \"__session\") */\n  cookieName?: string\n  /** Routes that require authentication (matched via startsWith) */\n  protectedRoutes?: string[]\n  /** Route to redirect to when not authenticated (default: \"/login\") */\n  loginUrl?: string\n  /** Routes that are always public (default: [\"/login\", \"/signup\"]) */\n  publicRoutes?: string[]\n  /** JWKS endpoint URL. Default: `${AZIRID_API_URL}/v1/.well-known/jwks.json` */\n  jwksUrl?: string\n}\n\n// ─── JWKS (lazy-initialized, cached by jose internally) ─────\n\nlet jwks: ReturnType<typeof createRemoteJWKSet> | null = null\n\nfunction getJwks(jwksUrl?: string): ReturnType<typeof createRemoteJWKSet> {\n  if (jwks) return jwks\n  const url =\n    jwksUrl ??\n    `${process.env.AZIRID_API_URL ?? 'https://api.azirid.com'}/v1/.well-known/jwks.json`\n  jwks = createRemoteJWKSet(new URL(url))\n  return jwks\n}\n\n// ─── Middleware logic ───────────────────────────────────────\n\nfunction createRequestInterceptor(options?: AziridProxyOptions) {\n  const cookieName = options?.cookieName ?? '__session'\n  const loginUrl = options?.loginUrl ?? '/login'\n  const defaultPublic = ['/login', '/signup', '/auth/handoff']\n  const publicRoutes = options?.publicRoutes\n    ? [...new Set([...options.publicRoutes, '/auth/handoff'])]\n    : defaultPublic\n  const protectedRoutes = options?.protectedRoutes\n\n  return async function handler(request: NextRequest) {\n    const { pathname } = request.nextUrl\n    const token = request.cookies.get(cookieName)?.value\n\n    const response = NextResponse.next()\n\n    if (token) {\n      try {\n        const keySet = getJwks(options?.jwksUrl)\n        const { payload } = await jwtVerify(token, keySet)\n        // Valid token — expose for server components via headers\n        response.headers.set('x-azirid-token', token)\n        if (payload.sub) response.headers.set('x-azirid-user-id', payload.sub)\n      } catch (err) {\n        // Invalid or expired JWT — clear corrupted cookie\n        if (typeof console !== 'undefined') {\n          console.warn('[azirid-proxy] JWT validation failed:', err instanceof Error ? err.message : err)\n        }\n        response.headers.set('Set-Cookie', `${cookieName}=; Path=/; Max-Age=0; SameSite=Lax`)\n      }\n    }\n\n    // Route protection (only when protectedRoutes is configured)\n    if (protectedRoutes) {\n      const hasValidToken = response.headers.has('x-azirid-token')\n      const isPublic = publicRoutes.some((r) => pathname.startsWith(r))\n      const isProtected = protectedRoutes.some((r) => pathname.startsWith(r))\n\n      if (isProtected && !isPublic && !hasValidToken) {\n        const url = request.nextUrl.clone()\n        url.pathname = loginUrl\n        url.searchParams.set('redirect', pathname)\n        return NextResponse.redirect(url)\n      }\n    }\n\n    return response\n  }\n}\n\n// ─── Proxy (Next.js 16+) ────────────────────────────────────\n\n/**\n * Create a customized Azirid middleware for Next.js 16+.\n *\n * @example Default (one line)\n * ```ts\n * // proxy.ts\n * export { aziridProxy as proxy } from \"azirid-react/next/proxy\";\n * export const config = { matcher: [\"/((?!_next|favicon.ico|api/).*)\"] };\n * ```\n *\n * @example Custom options\n * ```ts\n * // proxy.ts\n * import { createAziridProxy } from \"azirid-react/next/proxy\";\n * export const proxy = createAziridProxy({\n *   protectedRoutes: [\"/dashboard\"],\n *   loginUrl: \"/login\",\n * });\n * export const config = { matcher: [\"/((?!_next|favicon.ico|api/).*)\"] };\n * ```\n */\nexport function createAziridProxy(options?: AziridProxyOptions) {\n  return createRequestInterceptor(options)\n}\n\n/** Default proxy export for Next.js 16+ (no route protection, only validates + forwards token) */\nexport const aziridProxy = createAziridProxy()\n"]}
+{"version":3,"sources":["../src/next-proxy.ts"],"names":["importJWK","NextResponse","jwtVerify"],"mappings":";;;;;;AAkDA,IAAM,QAAA,uBAAe,GAAA,EAAkD;AACvE,IAAM,SAAA,GAAY,IAAI,EAAA,GAAK,GAAA;AAE3B,SAAS,WAAW,KAAA,EAA8B;AAChD,EAAA,IAAI;AACF,IAAA,MAAM,SAAA,GAAY,KAAA,CAAM,KAAA,CAAM,GAAG,EAAE,CAAC,CAAA;AACpC,IAAA,MAAM,SAAS,IAAA,CAAK,KAAA;AAAA,MAClB,OAAO,MAAA,KAAW,WAAA,GACd,OAAO,IAAA,CAAK,SAAA,EAAW,WAAW,CAAA,CAAE,QAAA,KACpC,IAAA,CAAK,SAAA,CAAU,QAAQ,IAAA,EAAM,GAAG,EAAE,OAAA,CAAQ,IAAA,EAAM,GAAG,CAAC;AAAA,KAC1D;AACA,IAAA,OAAO,OAAO,GAAA,IAAO,IAAA;AAAA,EACvB,CAAA,CAAA,MAAQ;AACN,IAAA,OAAO,IAAA;AAAA,EACT;AACF;AAEA,eAAe,UAAA,CAAW,KAAa,MAAA,EAAoC;AACzE,EAAA,MAAM,MAAA,GAAS,QAAA,CAAS,GAAA,CAAI,GAAG,CAAA;AAC/B,EAAA,IAAI,MAAA,IAAU,KAAK,GAAA,EAAI,GAAI,OAAO,QAAA,GAAW,SAAA,SAAkB,MAAA,CAAO,GAAA;AAEtE,EAAA,MAAM,MAAM,MAAM,KAAA,CAAM,GAAG,MAAM,CAAA,qBAAA,EAAwB,GAAG,CAAA,KAAA,CAAO,CAAA;AACnE,EAAA,IAAI,CAAC,IAAI,EAAA,EAAI,MAAM,IAAI,KAAA,CAAM,CAAA,mBAAA,EAAsB,GAAA,CAAI,MAAM,CAAA,CAAE,CAAA;AAE/D,EAAA,MAAM,EAAE,IAAA,EAAK,GAAK,MAAM,IAAI,IAAA,EAAK;AACjC,EAAA,IAAI,CAAC,MAAM,MAAA,EAAQ,MAAM,IAAI,KAAA,CAAM,CAAA,sBAAA,EAAyB,GAAG,CAAA,CAAE,CAAA;AAEjE,EAAA,MAAM,MAAO,MAAMA,cAAA,CAAU,IAAA,CAAK,CAAC,GAAG,OAAO,CAAA;AAC7C,EAAA,QAAA,CAAS,GAAA,CAAI,KAAK,EAAE,GAAA,EAAK,UAAU,IAAA,CAAK,GAAA,IAAO,CAAA;AAC/C,EAAA,OAAO,GAAA;AACT;AAIA,SAAS,yBAAyB,OAAA,EAA8B;AAC9D,EAAA,MAAM,UAAA,GAAa,SAAS,UAAA,IAAc,WAAA;AAC1C,EAAA,MAAM,QAAA,GAAW,SAAS,QAAA,IAAY,QAAA;AACtC,EAAA,MAAM,MAAA,GAAA,CACJ,SAAS,MAAA,IACT,OAAA,CAAQ,IAAI,cAAA,IACZ,wBAAA,EACA,OAAA,CAAQ,KAAA,EAAO,EAAE,CAAA;AACnB,EAAA,MAAM,aAAA,GAAgB,CAAC,QAAA,EAAU,SAAA,EAAW,eAAe,CAAA;AAC3D,EAAA,MAAM,YAAA,GAAe,OAAA,EAAS,YAAA,GAC1B,CAAC,mBAAG,IAAI,GAAA,CAAI,CAAC,GAAG,OAAA,CAAQ,YAAA,EAAc,eAAe,CAAC,CAAC,CAAA,GACvD,aAAA;AACJ,EAAA,MAAM,kBAAkB,OAAA,EAAS,eAAA;AACjC,EAAA,MAAM,eAAe,OAAA,EAAS,YAAA;AAE9B,EAAA,OAAO,eAAe,QAAQ,OAAA,EAAsB;AAClD,IAAA,MAAM,EAAE,QAAA,EAAS,GAAI,OAAA,CAAQ,OAAA;AAC7B,IAAA,MAAM,KAAA,GAAQ,OAAA,CAAQ,OAAA,CAAQ,GAAA,CAAI,UAAU,CAAA,EAAG,KAAA;AAE/C,IAAA,MAAM,QAAA,GAAWC,oBAAa,IAAA,EAAK;AAEnC,IAAA,IAAI,KAAA,EAAO;AACT,MAAA,IAAI;AACF,QAAA,MAAM,GAAA,GAAM,WAAW,KAAK,CAAA;AAC5B,QAAA,IAAI,CAAC,GAAA,EAAK,MAAM,IAAI,MAAM,iBAAiB,CAAA;AAE3C,QAAA,MAAM,GAAA,GAAM,MAAM,UAAA,CAAW,GAAA,EAAK,MAAM,CAAA;AACxC,QAAA,MAAM,EAAE,OAAA,EAAQ,GAAI,MAAMC,cAAA,CAAU,OAAO,GAAG,CAAA;AAG9C,QAAA,QAAA,CAAS,OAAA,CAAQ,GAAA,CAAI,gBAAA,EAAkB,KAAK,CAAA;AAC5C,QAAA,IAAI,QAAQ,GAAA,EAAK,QAAA,CAAS,QAAQ,GAAA,CAAI,kBAAA,EAAoB,QAAQ,GAAG,CAAA;AAAA,MACvE,SAAS,GAAA,EAAK;AAEZ,QAAA,IAAI,OAAO,YAAY,WAAA,EAAa;AAClC,UAAA,OAAA,CAAQ,IAAA;AAAA,YACN,uCAAA;AAAA,YACA,GAAA,YAAe,KAAA,GAAQ,GAAA,CAAI,OAAA,GAAU;AAAA,WACvC;AAAA,QACF;AACA,QAAA,QAAA,CAAS,OAAA,CAAQ,GAAA,CAAI,YAAA,EAAc,CAAA,EAAG,UAAU,CAAA,kCAAA,CAAoC,CAAA;AAAA,MACtF;AAAA,IACF;AAEA,IAAA,MAAM,aAAA,GAAgB,QAAA,CAAS,OAAA,CAAQ,GAAA,CAAI,gBAAgB,CAAA;AAC3D,IAAA,MAAM,QAAA,GAAW,aAAa,IAAA,CAAK,CAAC,MAAM,QAAA,CAAS,UAAA,CAAW,CAAC,CAAC,CAAA;AAGhE,IAAA,IAAI,YAAA,IAAgB,aAAA,IAAiB,QAAA,IAAY,QAAA,KAAa,YAAA,EAAc;AAC1E,MAAA,MAAM,GAAA,GAAM,OAAA,CAAQ,OAAA,CAAQ,KAAA,EAAM;AAClC,MAAA,GAAA,CAAI,QAAA,GAAW,YAAA;AACf,MAAA,OAAOD,mBAAA,CAAa,SAAS,GAAG,CAAA;AAAA,IAClC;AAGA,IAAA,IAAI,eAAA,EAAiB;AACnB,MAAA,MAAM,WAAA,GAAc,gBAAgB,IAAA,CAAK,CAAC,MAAM,QAAA,CAAS,UAAA,CAAW,CAAC,CAAC,CAAA;AAEtE,MAAA,IAAI,WAAA,IAAe,CAAC,QAAA,IAAY,CAAC,aAAA,EAAe;AAC9C,QAAA,MAAM,GAAA,GAAM,OAAA,CAAQ,OAAA,CAAQ,KAAA,EAAM;AAClC,QAAA,GAAA,CAAI,QAAA,GAAW,QAAA;AACf,QAAA,GAAA,CAAI,YAAA,CAAa,GAAA,CAAI,UAAA,EAAY,QAAQ,CAAA;AACzC,QAAA,OAAOA,mBAAA,CAAa,SAAS,GAAG,CAAA;AAAA,MAClC;AAAA,IACF;AAEA,IAAA,OAAO,QAAA;AAAA,EACT,CAAA;AACF;AAyBO,SAAS,kBAAkB,OAAA,EAA8B;AAC9D,EAAA,OAAO,yBAAyB,OAAO,CAAA;AACzC;AAGO,IAAM,cAAc,iBAAA","file":"next-proxy.cjs","sourcesContent":["/**\n * Next.js middleware for Azirid Access.\n *\n * Validates the `__session` JWT cookie by resolving the signing key\n * via the kid in the JWT header. Provides route protection and token\n * forwarding for server components.\n *\n * @example Next.js 16+ (proxy.ts)\n * ```ts\n * // proxy.ts\n * export { aziridProxy as proxy } from \"azirid-react/next/proxy\";\n * export const config = { matcher: [\"/((?!_next|favicon.ico|api/).*)\"] };\n * ```\n *\n * @example Next.js 16+ with custom options\n * ```ts\n * // proxy.ts\n * import { createAziridProxy } from \"azirid-react/next/proxy\";\n * export const proxy = createAziridProxy({\n *   protectedRoutes: [\"/dashboard\"],\n *   loginUrl: \"/login\",\n * });\n * export const config = { matcher: [\"/((?!_next|favicon.ico|api/).*)\"] };\n * ```\n *\n * @packageDocumentation\n */\n\nimport { NextResponse, type NextRequest } from 'next/server'\nimport { importJWK, jwtVerify, type JWK } from 'jose'\n\n// ─── Options ────────────────────────────────────────────────\n\nexport interface AziridProxyOptions {\n  /** Cookie name that carries the access token JWT (default: \"__session\") */\n  cookieName?: string\n  /** Routes that require authentication (matched via startsWith) */\n  protectedRoutes?: string[]\n  /** Route to redirect to when not authenticated (default: \"/login\") */\n  loginUrl?: string\n  /** Routes that are always public (default: [\"/login\", \"/signup\"]) */\n  publicRoutes?: string[]\n  /** Redirect authenticated users away from public routes (e.g. \"/dashboard\"). If set, users with a valid token visiting a publicRoute will be redirected here. */\n  dashboardUrl?: string\n  /** Override the Azirid API URL for key resolution (default: https://api.azirid.com) */\n  apiUrl?: string\n}\n\n// ─── Key resolver (cached, resolves by kid) ─────────────────\n\nconst keyCache = new Map<string, { key: CryptoKey; cachedAt: number }>()\nconst CACHE_TTL = 5 * 60 * 1000 // 5 minutes\n\nfunction extractKid(token: string): string | null {\n  try {\n    const headerB64 = token.split('.')[0]\n    const header = JSON.parse(\n      typeof Buffer !== 'undefined'\n        ? Buffer.from(headerB64, 'base64url').toString()\n        : atob(headerB64.replace(/-/g, '+').replace(/_/g, '/')),\n    )\n    return header.kid ?? null\n  } catch {\n    return null\n  }\n}\n\nasync function resolveKey(kid: string, apiUrl: string): Promise<CryptoKey> {\n  const cached = keyCache.get(kid)\n  if (cached && Date.now() - cached.cachedAt < CACHE_TTL) return cached.key\n\n  const res = await fetch(`${apiUrl}/v1/.well-known/jwks/${kid}.json`)\n  if (!res.ok) throw new Error(`JWKS fetch failed: ${res.status}`)\n\n  const { keys } = (await res.json()) as { keys: JWK[] }\n  if (!keys?.length) throw new Error(`No key found for kid: ${kid}`)\n\n  const key = (await importJWK(keys[0], 'RS256')) as CryptoKey\n  keyCache.set(kid, { key, cachedAt: Date.now() })\n  return key\n}\n\n// ─── Middleware logic ───────────────────────────────────────\n\nfunction createRequestInterceptor(options?: AziridProxyOptions) {\n  const cookieName = options?.cookieName ?? '__session'\n  const loginUrl = options?.loginUrl ?? '/login'\n  const apiUrl = (\n    options?.apiUrl ??\n    process.env.AZIRID_API_URL ??\n    'https://api.azirid.com'\n  ).replace(/\\/$/, '')\n  const defaultPublic = ['/login', '/signup', '/auth/handoff']\n  const publicRoutes = options?.publicRoutes\n    ? [...new Set([...options.publicRoutes, '/auth/handoff'])]\n    : defaultPublic\n  const protectedRoutes = options?.protectedRoutes\n  const dashboardUrl = options?.dashboardUrl\n\n  return async function handler(request: NextRequest) {\n    const { pathname } = request.nextUrl\n    const token = request.cookies.get(cookieName)?.value\n\n    const response = NextResponse.next()\n\n    if (token) {\n      try {\n        const kid = extractKid(token)\n        if (!kid) throw new Error('JWT missing kid')\n\n        const key = await resolveKey(kid, apiUrl)\n        const { payload } = await jwtVerify(token, key)\n\n        // Valid token — expose for server components via headers\n        response.headers.set('x-azirid-token', token)\n        if (payload.sub) response.headers.set('x-azirid-user-id', payload.sub)\n      } catch (err) {\n        // Invalid or expired JWT — clear corrupted cookie\n        if (typeof console !== 'undefined') {\n          console.warn(\n            '[azirid-proxy] JWT validation failed:',\n            err instanceof Error ? err.message : err,\n          )\n        }\n        response.headers.set('Set-Cookie', `${cookieName}=; Path=/; Max-Age=0; SameSite=Lax`)\n      }\n    }\n\n    const hasValidToken = response.headers.has('x-azirid-token')\n    const isPublic = publicRoutes.some((r) => pathname.startsWith(r))\n\n    // Redirect authenticated users away from public routes (e.g. login → dashboard)\n    if (dashboardUrl && hasValidToken && isPublic && pathname !== dashboardUrl) {\n      const url = request.nextUrl.clone()\n      url.pathname = dashboardUrl\n      return NextResponse.redirect(url)\n    }\n\n    // Route protection (only when protectedRoutes is configured)\n    if (protectedRoutes) {\n      const isProtected = protectedRoutes.some((r) => pathname.startsWith(r))\n\n      if (isProtected && !isPublic && !hasValidToken) {\n        const url = request.nextUrl.clone()\n        url.pathname = loginUrl\n        url.searchParams.set('redirect', pathname)\n        return NextResponse.redirect(url)\n      }\n    }\n\n    return response\n  }\n}\n\n// ─── Proxy (Next.js 16+) ────────────────────────────────────\n\n/**\n * Create a customized Azirid middleware for Next.js 16+.\n *\n * @example Default (one line)\n * ```ts\n * // proxy.ts\n * export { aziridProxy as proxy } from \"azirid-react/next/proxy\";\n * export const config = { matcher: [\"/((?!_next|favicon.ico|api/).*)\"] };\n * ```\n *\n * @example Custom options\n * ```ts\n * // proxy.ts\n * import { createAziridProxy } from \"azirid-react/next/proxy\";\n * export const proxy = createAziridProxy({\n *   protectedRoutes: [\"/dashboard\"],\n *   loginUrl: \"/login\",\n * });\n * export const config = { matcher: [\"/((?!_next|favicon.ico|api/).*)\"] };\n * ```\n */\nexport function createAziridProxy(options?: AziridProxyOptions) {\n  return createRequestInterceptor(options)\n}\n\n/** Default proxy export for Next.js 16+ (no route protection, only validates + forwards token) */\nexport const aziridProxy = createAziridProxy()\n"]}

package/dist/next-proxy.d.cts

@@ -3,8 +3,9 @@ import { NextRequest, NextResponse } from 'next/server';
 /**
  * Next.js middleware for Azirid Access.
  *
- * Validates the `__session` JWT cookie using JWKS and provides
- * route protection and token forwarding for server components.
+ * Validates the `__session` JWT cookie by resolving the signing key
+ * via the kid in the JWT header. Provides route protection and token
+ * forwarding for server components.
  *
  * @example Next.js 16+ (proxy.ts)
  * ```ts
@@ -36,8 +37,10 @@ interface AziridProxyOptions {
     loginUrl?: string;
     /** Routes that are always public (default: ["/login", "/signup"]) */
     publicRoutes?: string[];
-    /** JWKS endpoint URL. Default: `${AZIRID_API_URL}/v1/.well-known/jwks.json` */
-    jwksUrl?: string;
+    /** Redirect authenticated users away from public routes (e.g. "/dashboard"). If set, users with a valid token visiting a publicRoute will be redirected here. */
+    dashboardUrl?: string;
+    /** Override the Azirid API URL for key resolution (default: https://api.azirid.com) */
+    apiUrl?: string;
 }
 /**
  * Create a customized Azirid middleware for Next.js 16+.

package/dist/next-proxy.d.ts

@@ -3,8 +3,9 @@ import { NextRequest, NextResponse } from 'next/server';
 /**
  * Next.js middleware for Azirid Access.
  *
- * Validates the `__session` JWT cookie using JWKS and provides
- * route protection and token forwarding for server components.
+ * Validates the `__session` JWT cookie by resolving the signing key
+ * via the kid in the JWT header. Provides route protection and token
+ * forwarding for server components.
  *
  * @example Next.js 16+ (proxy.ts)
  * ```ts
@@ -36,8 +37,10 @@ interface AziridProxyOptions {
     loginUrl?: string;
     /** Routes that are always public (default: ["/login", "/signup"]) */
     publicRoutes?: string[];
-    /** JWKS endpoint URL. Default: `${AZIRID_API_URL}/v1/.well-known/jwks.json` */
-    jwksUrl?: string;
+    /** Redirect authenticated users away from public routes (e.g. "/dashboard"). If set, users with a valid token visiting a publicRoute will be redirected here. */
+    dashboardUrl?: string;
+    /** Override the Azirid API URL for key resolution (default: https://api.azirid.com) */
+    apiUrl?: string;
 }
 /**
  * Create a customized Azirid middleware for Next.js 16+.

package/dist/next-proxy.js

@@ -1,40 +1,69 @@
 import { NextResponse } from 'next/server';
-import { jwtVerify, createRemoteJWKSet } from 'jose';
+import { jwtVerify, importJWK } from 'jose';
 
 // src/next-proxy.ts
-var jwks = null;
-function getJwks(jwksUrl) {
-  if (jwks) return jwks;
-  const url = jwksUrl ?? `${process.env.AZIRID_API_URL ?? "https://api.azirid.com"}/v1/.well-known/jwks.json`;
-  jwks = createRemoteJWKSet(new URL(url));
-  return jwks;
+var keyCache = /* @__PURE__ */ new Map();
+var CACHE_TTL = 5 * 60 * 1e3;
+function extractKid(token) {
+  try {
+    const headerB64 = token.split(".")[0];
+    const header = JSON.parse(
+      typeof Buffer !== "undefined" ? Buffer.from(headerB64, "base64url").toString() : atob(headerB64.replace(/-/g, "+").replace(/_/g, "/"))
+    );
+    return header.kid ?? null;
+  } catch {
+    return null;
+  }
+}
+async function resolveKey(kid, apiUrl) {
+  const cached = keyCache.get(kid);
+  if (cached && Date.now() - cached.cachedAt < CACHE_TTL) return cached.key;
+  const res = await fetch(`${apiUrl}/v1/.well-known/jwks/${kid}.json`);
+  if (!res.ok) throw new Error(`JWKS fetch failed: ${res.status}`);
+  const { keys } = await res.json();
+  if (!keys?.length) throw new Error(`No key found for kid: ${kid}`);
+  const key = await importJWK(keys[0], "RS256");
+  keyCache.set(kid, { key, cachedAt: Date.now() });
+  return key;
 }
 function createRequestInterceptor(options) {
   const cookieName = options?.cookieName ?? "__session";
   const loginUrl = options?.loginUrl ?? "/login";
+  const apiUrl = (options?.apiUrl ?? process.env.AZIRID_API_URL ?? "https://api.azirid.com").replace(/\/$/, "");
   const defaultPublic = ["/login", "/signup", "/auth/handoff"];
   const publicRoutes = options?.publicRoutes ? [.../* @__PURE__ */ new Set([...options.publicRoutes, "/auth/handoff"])] : defaultPublic;
   const protectedRoutes = options?.protectedRoutes;
+  const dashboardUrl = options?.dashboardUrl;
   return async function handler(request) {
     const { pathname } = request.nextUrl;
     const token = request.cookies.get(cookieName)?.value;
     const response = NextResponse.next();
     if (token) {
       try {
-        const keySet = getJwks(options?.jwksUrl);
-        const { payload } = await jwtVerify(token, keySet);
+        const kid = extractKid(token);
+        if (!kid) throw new Error("JWT missing kid");
+        const key = await resolveKey(kid, apiUrl);
+        const { payload } = await jwtVerify(token, key);
         response.headers.set("x-azirid-token", token);
         if (payload.sub) response.headers.set("x-azirid-user-id", payload.sub);
       } catch (err) {
         if (typeof console !== "undefined") {
-          console.warn("[azirid-proxy] JWT validation failed:", err instanceof Error ? err.message : err);
+          console.warn(
+            "[azirid-proxy] JWT validation failed:",
+            err instanceof Error ? err.message : err
+          );
         }
         response.headers.set("Set-Cookie", `${cookieName}=; Path=/; Max-Age=0; SameSite=Lax`);
       }
     }
+    const hasValidToken = response.headers.has("x-azirid-token");
+    const isPublic = publicRoutes.some((r) => pathname.startsWith(r));
+    if (dashboardUrl && hasValidToken && isPublic && pathname !== dashboardUrl) {
+      const url = request.nextUrl.clone();
+      url.pathname = dashboardUrl;
+      return NextResponse.redirect(url);
+    }
     if (protectedRoutes) {
-      const hasValidToken = response.headers.has("x-azirid-token");
-      const isPublic = publicRoutes.some((r) => pathname.startsWith(r));
       const isProtected = protectedRoutes.some((r) => pathname.startsWith(r));
       if (isProtected && !isPublic && !hasValidToken) {
         const url = request.nextUrl.clone();

package/dist/next-proxy.js.map

@@ -1 +1 @@
-{"version":3,"sources":["../src/next-proxy.ts"],"names":[],"mappings":";;;;AA+CA,IAAI,IAAA,GAAqD,IAAA;AAEzD,SAAS,QAAQ,OAAA,EAAyD;AACxE,EAAA,IAAI,MAAM,OAAO,IAAA;AACjB,EAAA,MAAM,MACJ,OAAA,IACA,CAAA,EAAG,OAAA,CAAQ,GAAA,CAAI,kBAAkB,wBAAwB,CAAA,yBAAA,CAAA;AAC3D,EAAA,IAAA,GAAO,kBAAA,CAAmB,IAAI,GAAA,CAAI,GAAG,CAAC,CAAA;AACtC,EAAA,OAAO,IAAA;AACT;AAIA,SAAS,yBAAyB,OAAA,EAA8B;AAC9D,EAAA,MAAM,UAAA,GAAa,SAAS,UAAA,IAAc,WAAA;AAC1C,EAAA,MAAM,QAAA,GAAW,SAAS,QAAA,IAAY,QAAA;AACtC,EAAA,MAAM,aAAA,GAAgB,CAAC,QAAA,EAAU,SAAA,EAAW,eAAe,CAAA;AAC3D,EAAA,MAAM,YAAA,GAAe,OAAA,EAAS,YAAA,GAC1B,CAAC,mBAAG,IAAI,GAAA,CAAI,CAAC,GAAG,OAAA,CAAQ,YAAA,EAAc,eAAe,CAAC,CAAC,CAAA,GACvD,aAAA;AACJ,EAAA,MAAM,kBAAkB,OAAA,EAAS,eAAA;AAEjC,EAAA,OAAO,eAAe,QAAQ,OAAA,EAAsB;AAClD,IAAA,MAAM,EAAE,QAAA,EAAS,GAAI,OAAA,CAAQ,OAAA;AAC7B,IAAA,MAAM,KAAA,GAAQ,OAAA,CAAQ,OAAA,CAAQ,GAAA,CAAI,UAAU,CAAA,EAAG,KAAA;AAE/C,IAAA,MAAM,QAAA,GAAW,aAAa,IAAA,EAAK;AAEnC,IAAA,IAAI,KAAA,EAAO;AACT,MAAA,IAAI;AACF,QAAA,MAAM,MAAA,GAAS,OAAA,CAAQ,OAAA,EAAS,OAAO,CAAA;AACvC,QAAA,MAAM,EAAE,OAAA,EAAQ,GAAI,MAAM,SAAA,CAAU,OAAO,MAAM,CAAA;AAEjD,QAAA,QAAA,CAAS,OAAA,CAAQ,GAAA,CAAI,gBAAA,EAAkB,KAAK,CAAA;AAC5C,QAAA,IAAI,QAAQ,GAAA,EAAK,QAAA,CAAS,QAAQ,GAAA,CAAI,kBAAA,EAAoB,QAAQ,GAAG,CAAA;AAAA,MACvE,SAAS,GAAA,EAAK;AAEZ,QAAA,IAAI,OAAO,YAAY,WAAA,EAAa;AAClC,UAAA,OAAA,CAAQ,KAAK,uCAAA,EAAyC,GAAA,YAAe,KAAA,GAAQ,GAAA,CAAI,UAAU,GAAG,CAAA;AAAA,QAChG;AACA,QAAA,QAAA,CAAS,OAAA,CAAQ,GAAA,CAAI,YAAA,EAAc,CAAA,EAAG,UAAU,CAAA,kCAAA,CAAoC,CAAA;AAAA,MACtF;AAAA,IACF;AAGA,IAAA,IAAI,eAAA,EAAiB;AACnB,MAAA,MAAM,aAAA,GAAgB,QAAA,CAAS,OAAA,CAAQ,GAAA,CAAI,gBAAgB,CAAA;AAC3D,MAAA,MAAM,QAAA,GAAW,aAAa,IAAA,CAAK,CAAC,MAAM,QAAA,CAAS,UAAA,CAAW,CAAC,CAAC,CAAA;AAChE,MAAA,MAAM,WAAA,GAAc,gBAAgB,IAAA,CAAK,CAAC,MAAM,QAAA,CAAS,UAAA,CAAW,CAAC,CAAC,CAAA;AAEtE,MAAA,IAAI,WAAA,IAAe,CAAC,QAAA,IAAY,CAAC,aAAA,EAAe;AAC9C,QAAA,MAAM,GAAA,GAAM,OAAA,CAAQ,OAAA,CAAQ,KAAA,EAAM;AAClC,QAAA,GAAA,CAAI,QAAA,GAAW,QAAA;AACf,QAAA,GAAA,CAAI,YAAA,CAAa,GAAA,CAAI,UAAA,EAAY,QAAQ,CAAA;AACzC,QAAA,OAAO,YAAA,CAAa,SAAS,GAAG,CAAA;AAAA,MAClC;AAAA,IACF;AAEA,IAAA,OAAO,QAAA;AAAA,EACT,CAAA;AACF;AAyBO,SAAS,kBAAkB,OAAA,EAA8B;AAC9D,EAAA,OAAO,yBAAyB,OAAO,CAAA;AACzC;AAGO,IAAM,cAAc,iBAAA","file":"next-proxy.js","sourcesContent":["/**\n * Next.js middleware for Azirid Access.\n *\n * Validates the `__session` JWT cookie using JWKS and provides\n * route protection and token forwarding for server components.\n *\n * @example Next.js 16+ (proxy.ts)\n * ```ts\n * // proxy.ts\n * export { aziridProxy as proxy } from \"azirid-react/next/proxy\";\n * export const config = { matcher: [\"/((?!_next|favicon.ico|api/).*)\"] };\n * ```\n *\n * @example Next.js 16+ with custom options\n * ```ts\n * // proxy.ts\n * import { createAziridProxy } from \"azirid-react/next/proxy\";\n * export const proxy = createAziridProxy({\n *   protectedRoutes: [\"/dashboard\"],\n *   loginUrl: \"/login\",\n * });\n * export const config = { matcher: [\"/((?!_next|favicon.ico|api/).*)\"] };\n * ```\n *\n * @packageDocumentation\n */\n\nimport { NextResponse, type NextRequest } from 'next/server'\nimport { createRemoteJWKSet, jwtVerify } from 'jose'\n\n// ─── Options ────────────────────────────────────────────────\n\nexport interface AziridProxyOptions {\n  /** Cookie name that carries the access token JWT (default: \"__session\") */\n  cookieName?: string\n  /** Routes that require authentication (matched via startsWith) */\n  protectedRoutes?: string[]\n  /** Route to redirect to when not authenticated (default: \"/login\") */\n  loginUrl?: string\n  /** Routes that are always public (default: [\"/login\", \"/signup\"]) */\n  publicRoutes?: string[]\n  /** JWKS endpoint URL. Default: `${AZIRID_API_URL}/v1/.well-known/jwks.json` */\n  jwksUrl?: string\n}\n\n// ─── JWKS (lazy-initialized, cached by jose internally) ─────\n\nlet jwks: ReturnType<typeof createRemoteJWKSet> | null = null\n\nfunction getJwks(jwksUrl?: string): ReturnType<typeof createRemoteJWKSet> {\n  if (jwks) return jwks\n  const url =\n    jwksUrl ??\n    `${process.env.AZIRID_API_URL ?? 'https://api.azirid.com'}/v1/.well-known/jwks.json`\n  jwks = createRemoteJWKSet(new URL(url))\n  return jwks\n}\n\n// ─── Middleware logic ───────────────────────────────────────\n\nfunction createRequestInterceptor(options?: AziridProxyOptions) {\n  const cookieName = options?.cookieName ?? '__session'\n  const loginUrl = options?.loginUrl ?? '/login'\n  const defaultPublic = ['/login', '/signup', '/auth/handoff']\n  const publicRoutes = options?.publicRoutes\n    ? [...new Set([...options.publicRoutes, '/auth/handoff'])]\n    : defaultPublic\n  const protectedRoutes = options?.protectedRoutes\n\n  return async function handler(request: NextRequest) {\n    const { pathname } = request.nextUrl\n    const token = request.cookies.get(cookieName)?.value\n\n    const response = NextResponse.next()\n\n    if (token) {\n      try {\n        const keySet = getJwks(options?.jwksUrl)\n        const { payload } = await jwtVerify(token, keySet)\n        // Valid token — expose for server components via headers\n        response.headers.set('x-azirid-token', token)\n        if (payload.sub) response.headers.set('x-azirid-user-id', payload.sub)\n      } catch (err) {\n        // Invalid or expired JWT — clear corrupted cookie\n        if (typeof console !== 'undefined') {\n          console.warn('[azirid-proxy] JWT validation failed:', err instanceof Error ? err.message : err)\n        }\n        response.headers.set('Set-Cookie', `${cookieName}=; Path=/; Max-Age=0; SameSite=Lax`)\n      }\n    }\n\n    // Route protection (only when protectedRoutes is configured)\n    if (protectedRoutes) {\n      const hasValidToken = response.headers.has('x-azirid-token')\n      const isPublic = publicRoutes.some((r) => pathname.startsWith(r))\n      const isProtected = protectedRoutes.some((r) => pathname.startsWith(r))\n\n      if (isProtected && !isPublic && !hasValidToken) {\n        const url = request.nextUrl.clone()\n        url.pathname = loginUrl\n        url.searchParams.set('redirect', pathname)\n        return NextResponse.redirect(url)\n      }\n    }\n\n    return response\n  }\n}\n\n// ─── Proxy (Next.js 16+) ────────────────────────────────────\n\n/**\n * Create a customized Azirid middleware for Next.js 16+.\n *\n * @example Default (one line)\n * ```ts\n * // proxy.ts\n * export { aziridProxy as proxy } from \"azirid-react/next/proxy\";\n * export const config = { matcher: [\"/((?!_next|favicon.ico|api/).*)\"] };\n * ```\n *\n * @example Custom options\n * ```ts\n * // proxy.ts\n * import { createAziridProxy } from \"azirid-react/next/proxy\";\n * export const proxy = createAziridProxy({\n *   protectedRoutes: [\"/dashboard\"],\n *   loginUrl: \"/login\",\n * });\n * export const config = { matcher: [\"/((?!_next|favicon.ico|api/).*)\"] };\n * ```\n */\nexport function createAziridProxy(options?: AziridProxyOptions) {\n  return createRequestInterceptor(options)\n}\n\n/** Default proxy export for Next.js 16+ (no route protection, only validates + forwards token) */\nexport const aziridProxy = createAziridProxy()\n"]}
+{"version":3,"sources":["../src/next-proxy.ts"],"names":[],"mappings":";;;;AAkDA,IAAM,QAAA,uBAAe,GAAA,EAAkD;AACvE,IAAM,SAAA,GAAY,IAAI,EAAA,GAAK,GAAA;AAE3B,SAAS,WAAW,KAAA,EAA8B;AAChD,EAAA,IAAI;AACF,IAAA,MAAM,SAAA,GAAY,KAAA,CAAM,KAAA,CAAM,GAAG,EAAE,CAAC,CAAA;AACpC,IAAA,MAAM,SAAS,IAAA,CAAK,KAAA;AAAA,MAClB,OAAO,MAAA,KAAW,WAAA,GACd,OAAO,IAAA,CAAK,SAAA,EAAW,WAAW,CAAA,CAAE,QAAA,KACpC,IAAA,CAAK,SAAA,CAAU,QAAQ,IAAA,EAAM,GAAG,EAAE,OAAA,CAAQ,IAAA,EAAM,GAAG,CAAC;AAAA,KAC1D;AACA,IAAA,OAAO,OAAO,GAAA,IAAO,IAAA;AAAA,EACvB,CAAA,CAAA,MAAQ;AACN,IAAA,OAAO,IAAA;AAAA,EACT;AACF;AAEA,eAAe,UAAA,CAAW,KAAa,MAAA,EAAoC;AACzE,EAAA,MAAM,MAAA,GAAS,QAAA,CAAS,GAAA,CAAI,GAAG,CAAA;AAC/B,EAAA,IAAI,MAAA,IAAU,KAAK,GAAA,EAAI,GAAI,OAAO,QAAA,GAAW,SAAA,SAAkB,MAAA,CAAO,GAAA;AAEtE,EAAA,MAAM,MAAM,MAAM,KAAA,CAAM,GAAG,MAAM,CAAA,qBAAA,EAAwB,GAAG,CAAA,KAAA,CAAO,CAAA;AACnE,EAAA,IAAI,CAAC,IAAI,EAAA,EAAI,MAAM,IAAI,KAAA,CAAM,CAAA,mBAAA,EAAsB,GAAA,CAAI,MAAM,CAAA,CAAE,CAAA;AAE/D,EAAA,MAAM,EAAE,IAAA,EAAK,GAAK,MAAM,IAAI,IAAA,EAAK;AACjC,EAAA,IAAI,CAAC,MAAM,MAAA,EAAQ,MAAM,IAAI,KAAA,CAAM,CAAA,sBAAA,EAAyB,GAAG,CAAA,CAAE,CAAA;AAEjE,EAAA,MAAM,MAAO,MAAM,SAAA,CAAU,IAAA,CAAK,CAAC,GAAG,OAAO,CAAA;AAC7C,EAAA,QAAA,CAAS,GAAA,CAAI,KAAK,EAAE,GAAA,EAAK,UAAU,IAAA,CAAK,GAAA,IAAO,CAAA;AAC/C,EAAA,OAAO,GAAA;AACT;AAIA,SAAS,yBAAyB,OAAA,EAA8B;AAC9D,EAAA,MAAM,UAAA,GAAa,SAAS,UAAA,IAAc,WAAA;AAC1C,EAAA,MAAM,QAAA,GAAW,SAAS,QAAA,IAAY,QAAA;AACtC,EAAA,MAAM,MAAA,GAAA,CACJ,SAAS,MAAA,IACT,OAAA,CAAQ,IAAI,cAAA,IACZ,wBAAA,EACA,OAAA,CAAQ,KAAA,EAAO,EAAE,CAAA;AACnB,EAAA,MAAM,aAAA,GAAgB,CAAC,QAAA,EAAU,SAAA,EAAW,eAAe,CAAA;AAC3D,EAAA,MAAM,YAAA,GAAe,OAAA,EAAS,YAAA,GAC1B,CAAC,mBAAG,IAAI,GAAA,CAAI,CAAC,GAAG,OAAA,CAAQ,YAAA,EAAc,eAAe,CAAC,CAAC,CAAA,GACvD,aAAA;AACJ,EAAA,MAAM,kBAAkB,OAAA,EAAS,eAAA;AACjC,EAAA,MAAM,eAAe,OAAA,EAAS,YAAA;AAE9B,EAAA,OAAO,eAAe,QAAQ,OAAA,EAAsB;AAClD,IAAA,MAAM,EAAE,QAAA,EAAS,GAAI,OAAA,CAAQ,OAAA;AAC7B,IAAA,MAAM,KAAA,GAAQ,OAAA,CAAQ,OAAA,CAAQ,GAAA,CAAI,UAAU,CAAA,EAAG,KAAA;AAE/C,IAAA,MAAM,QAAA,GAAW,aAAa,IAAA,EAAK;AAEnC,IAAA,IAAI,KAAA,EAAO;AACT,MAAA,IAAI;AACF,QAAA,MAAM,GAAA,GAAM,WAAW,KAAK,CAAA;AAC5B,QAAA,IAAI,CAAC,GAAA,EAAK,MAAM,IAAI,MAAM,iBAAiB,CAAA;AAE3C,QAAA,MAAM,GAAA,GAAM,MAAM,UAAA,CAAW,GAAA,EAAK,MAAM,CAAA;AACxC,QAAA,MAAM,EAAE,OAAA,EAAQ,GAAI,MAAM,SAAA,CAAU,OAAO,GAAG,CAAA;AAG9C,QAAA,QAAA,CAAS,OAAA,CAAQ,GAAA,CAAI,gBAAA,EAAkB,KAAK,CAAA;AAC5C,QAAA,IAAI,QAAQ,GAAA,EAAK,QAAA,CAAS,QAAQ,GAAA,CAAI,kBAAA,EAAoB,QAAQ,GAAG,CAAA;AAAA,MACvE,SAAS,GAAA,EAAK;AAEZ,QAAA,IAAI,OAAO,YAAY,WAAA,EAAa;AAClC,UAAA,OAAA,CAAQ,IAAA;AAAA,YACN,uCAAA;AAAA,YACA,GAAA,YAAe,KAAA,GAAQ,GAAA,CAAI,OAAA,GAAU;AAAA,WACvC;AAAA,QACF;AACA,QAAA,QAAA,CAAS,OAAA,CAAQ,GAAA,CAAI,YAAA,EAAc,CAAA,EAAG,UAAU,CAAA,kCAAA,CAAoC,CAAA;AAAA,MACtF;AAAA,IACF;AAEA,IAAA,MAAM,aAAA,GAAgB,QAAA,CAAS,OAAA,CAAQ,GAAA,CAAI,gBAAgB,CAAA;AAC3D,IAAA,MAAM,QAAA,GAAW,aAAa,IAAA,CAAK,CAAC,MAAM,QAAA,CAAS,UAAA,CAAW,CAAC,CAAC,CAAA;AAGhE,IAAA,IAAI,YAAA,IAAgB,aAAA,IAAiB,QAAA,IAAY,QAAA,KAAa,YAAA,EAAc;AAC1E,MAAA,MAAM,GAAA,GAAM,OAAA,CAAQ,OAAA,CAAQ,KAAA,EAAM;AAClC,MAAA,GAAA,CAAI,QAAA,GAAW,YAAA;AACf,MAAA,OAAO,YAAA,CAAa,SAAS,GAAG,CAAA;AAAA,IAClC;AAGA,IAAA,IAAI,eAAA,EAAiB;AACnB,MAAA,MAAM,WAAA,GAAc,gBAAgB,IAAA,CAAK,CAAC,MAAM,QAAA,CAAS,UAAA,CAAW,CAAC,CAAC,CAAA;AAEtE,MAAA,IAAI,WAAA,IAAe,CAAC,QAAA,IAAY,CAAC,aAAA,EAAe;AAC9C,QAAA,MAAM,GAAA,GAAM,OAAA,CAAQ,OAAA,CAAQ,KAAA,EAAM;AAClC,QAAA,GAAA,CAAI,QAAA,GAAW,QAAA;AACf,QAAA,GAAA,CAAI,YAAA,CAAa,GAAA,CAAI,UAAA,EAAY,QAAQ,CAAA;AACzC,QAAA,OAAO,YAAA,CAAa,SAAS,GAAG,CAAA;AAAA,MAClC;AAAA,IACF;AAEA,IAAA,OAAO,QAAA;AAAA,EACT,CAAA;AACF;AAyBO,SAAS,kBAAkB,OAAA,EAA8B;AAC9D,EAAA,OAAO,yBAAyB,OAAO,CAAA;AACzC;AAGO,IAAM,cAAc,iBAAA","file":"next-proxy.js","sourcesContent":["/**\n * Next.js middleware for Azirid Access.\n *\n * Validates the `__session` JWT cookie by resolving the signing key\n * via the kid in the JWT header. Provides route protection and token\n * forwarding for server components.\n *\n * @example Next.js 16+ (proxy.ts)\n * ```ts\n * // proxy.ts\n * export { aziridProxy as proxy } from \"azirid-react/next/proxy\";\n * export const config = { matcher: [\"/((?!_next|favicon.ico|api/).*)\"] };\n * ```\n *\n * @example Next.js 16+ with custom options\n * ```ts\n * // proxy.ts\n * import { createAziridProxy } from \"azirid-react/next/proxy\";\n * export const proxy = createAziridProxy({\n *   protectedRoutes: [\"/dashboard\"],\n *   loginUrl: \"/login\",\n * });\n * export const config = { matcher: [\"/((?!_next|favicon.ico|api/).*)\"] };\n * ```\n *\n * @packageDocumentation\n */\n\nimport { NextResponse, type NextRequest } from 'next/server'\nimport { importJWK, jwtVerify, type JWK } from 'jose'\n\n// ─── Options ────────────────────────────────────────────────\n\nexport interface AziridProxyOptions {\n  /** Cookie name that carries the access token JWT (default: \"__session\") */\n  cookieName?: string\n  /** Routes that require authentication (matched via startsWith) */\n  protectedRoutes?: string[]\n  /** Route to redirect to when not authenticated (default: \"/login\") */\n  loginUrl?: string\n  /** Routes that are always public (default: [\"/login\", \"/signup\"]) */\n  publicRoutes?: string[]\n  /** Redirect authenticated users away from public routes (e.g. \"/dashboard\"). If set, users with a valid token visiting a publicRoute will be redirected here. */\n  dashboardUrl?: string\n  /** Override the Azirid API URL for key resolution (default: https://api.azirid.com) */\n  apiUrl?: string\n}\n\n// ─── Key resolver (cached, resolves by kid) ─────────────────\n\nconst keyCache = new Map<string, { key: CryptoKey; cachedAt: number }>()\nconst CACHE_TTL = 5 * 60 * 1000 // 5 minutes\n\nfunction extractKid(token: string): string | null {\n  try {\n    const headerB64 = token.split('.')[0]\n    const header = JSON.parse(\n      typeof Buffer !== 'undefined'\n        ? Buffer.from(headerB64, 'base64url').toString()\n        : atob(headerB64.replace(/-/g, '+').replace(/_/g, '/')),\n    )\n    return header.kid ?? null\n  } catch {\n    return null\n  }\n}\n\nasync function resolveKey(kid: string, apiUrl: string): Promise<CryptoKey> {\n  const cached = keyCache.get(kid)\n  if (cached && Date.now() - cached.cachedAt < CACHE_TTL) return cached.key\n\n  const res = await fetch(`${apiUrl}/v1/.well-known/jwks/${kid}.json`)\n  if (!res.ok) throw new Error(`JWKS fetch failed: ${res.status}`)\n\n  const { keys } = (await res.json()) as { keys: JWK[] }\n  if (!keys?.length) throw new Error(`No key found for kid: ${kid}`)\n\n  const key = (await importJWK(keys[0], 'RS256')) as CryptoKey\n  keyCache.set(kid, { key, cachedAt: Date.now() })\n  return key\n}\n\n// ─── Middleware logic ───────────────────────────────────────\n\nfunction createRequestInterceptor(options?: AziridProxyOptions) {\n  const cookieName = options?.cookieName ?? '__session'\n  const loginUrl = options?.loginUrl ?? '/login'\n  const apiUrl = (\n    options?.apiUrl ??\n    process.env.AZIRID_API_URL ??\n    'https://api.azirid.com'\n  ).replace(/\\/$/, '')\n  const defaultPublic = ['/login', '/signup', '/auth/handoff']\n  const publicRoutes = options?.publicRoutes\n    ? [...new Set([...options.publicRoutes, '/auth/handoff'])]\n    : defaultPublic\n  const protectedRoutes = options?.protectedRoutes\n  const dashboardUrl = options?.dashboardUrl\n\n  return async function handler(request: NextRequest) {\n    const { pathname } = request.nextUrl\n    const token = request.cookies.get(cookieName)?.value\n\n    const response = NextResponse.next()\n\n    if (token) {\n      try {\n        const kid = extractKid(token)\n        if (!kid) throw new Error('JWT missing kid')\n\n        const key = await resolveKey(kid, apiUrl)\n        const { payload } = await jwtVerify(token, key)\n\n        // Valid token — expose for server components via headers\n        response.headers.set('x-azirid-token', token)\n        if (payload.sub) response.headers.set('x-azirid-user-id', payload.sub)\n      } catch (err) {\n        // Invalid or expired JWT — clear corrupted cookie\n        if (typeof console !== 'undefined') {\n          console.warn(\n            '[azirid-proxy] JWT validation failed:',\n            err instanceof Error ? err.message : err,\n          )\n        }\n        response.headers.set('Set-Cookie', `${cookieName}=; Path=/; Max-Age=0; SameSite=Lax`)\n      }\n    }\n\n    const hasValidToken = response.headers.has('x-azirid-token')\n    const isPublic = publicRoutes.some((r) => pathname.startsWith(r))\n\n    // Redirect authenticated users away from public routes (e.g. login → dashboard)\n    if (dashboardUrl && hasValidToken && isPublic && pathname !== dashboardUrl) {\n      const url = request.nextUrl.clone()\n      url.pathname = dashboardUrl\n      return NextResponse.redirect(url)\n    }\n\n    // Route protection (only when protectedRoutes is configured)\n    if (protectedRoutes) {\n      const isProtected = protectedRoutes.some((r) => pathname.startsWith(r))\n\n      if (isProtected && !isPublic && !hasValidToken) {\n        const url = request.nextUrl.clone()\n        url.pathname = loginUrl\n        url.searchParams.set('redirect', pathname)\n        return NextResponse.redirect(url)\n      }\n    }\n\n    return response\n  }\n}\n\n// ─── Proxy (Next.js 16+) ────────────────────────────────────\n\n/**\n * Create a customized Azirid middleware for Next.js 16+.\n *\n * @example Default (one line)\n * ```ts\n * // proxy.ts\n * export { aziridProxy as proxy } from \"azirid-react/next/proxy\";\n * export const config = { matcher: [\"/((?!_next|favicon.ico|api/).*)\"] };\n * ```\n *\n * @example Custom options\n * ```ts\n * // proxy.ts\n * import { createAziridProxy } from \"azirid-react/next/proxy\";\n * export const proxy = createAziridProxy({\n *   protectedRoutes: [\"/dashboard\"],\n *   loginUrl: \"/login\",\n * });\n * export const config = { matcher: [\"/((?!_next|favicon.ico|api/).*)\"] };\n * ```\n */\nexport function createAziridProxy(options?: AziridProxyOptions) {\n  return createRequestInterceptor(options)\n}\n\n/** Default proxy export for Next.js 16+ (no route protection, only validates + forwards token) */\nexport const aziridProxy = createAziridProxy()\n"]}

package/package.json

@@ -1,6 +1,6 @@
 {
   "name": "azirid-react",
-  "version": "0.14.3",
+  "version": "0.14.5",
   "description": "Authentication components for React and Next.js — Login, Register, powered by TanStack Query and Zod.",
   "author": "Azirid",
   "license": "MIT",