hazo_auth 10.4.10 → 10.4.11

package/cli-src/cli/validate.ts

@@ -310,6 +310,43 @@ function check_env_vars(): CheckResult[] {
 const GOOGLE_NEXTAUTH_CALLBACK_PATH = "/api/auth/callback/google";
 const FACEBOOK_NEXTAUTH_CALLBACK_PATH = "/api/auth/callback/facebook";
 
+/**
+ * The edge proxy (Edge Runtime, no filesystem) reads the cookie prefix from the
+ * HAZO_AUTH_COOKIE_PREFIX env var, while the server reads cookie_prefix from the
+ * ini. If they differ — or the env var is unset — the edge gate can't find the
+ * session cookie and silently bounces authenticated users back to /login. This
+ * check catches that split before it wastes an afternoon.
+ */
+function check_cookie_prefix(project_root: string): CheckResult[] {
+  const hazo_config = read_ini_file(path.join(project_root, "config", "hazo_auth_config.ini"));
+  const ini_prefix = (hazo_config?.["hazo_auth__cookies"]?.["cookie_prefix"] ?? "").trim();
+  const env_prefix = (process.env.HAZO_AUTH_COOKIE_PREFIX ?? "").trim();
+
+  if (!ini_prefix) {
+    // Already reported as a fail by check_config_values; nothing to compare.
+    return [];
+  }
+  if (!env_prefix) {
+    return [
+      {
+        name: "Cookie prefix (env ↔ ini)",
+        status: "fail",
+        message: `HAZO_AUTH_COOKIE_PREFIX env var not set. The edge proxy throws without it and bounces authenticated users to /login. Set HAZO_AUTH_COOKIE_PREFIX=${ini_prefix} to match cookie_prefix in hazo_auth_config.ini.`,
+      },
+    ];
+  }
+  if (env_prefix !== ini_prefix) {
+    return [
+      {
+        name: "Cookie prefix (env ↔ ini)",
+        status: "fail",
+        message: `Mismatch: HAZO_AUTH_COOKIE_PREFIX="${env_prefix}" but ini cookie_prefix="${ini_prefix}". They must be identical or the edge gate can't find the session cookie. Make them equal.`,
+      },
+    ];
+  }
+  return [{ name: "Cookie prefix (env ↔ ini)", status: "pass", message: `"${env_prefix}" (matches)` }];
+}
+
 function read_oauth_origin(): { origin: string; resolved: boolean } {
   const nextauth_url = process.env.NEXTAUTH_URL;
   if (nextauth_url && nextauth_url.trim().length > 0) {
@@ -850,6 +887,14 @@ export function run_validation(): ValidationSummary {
   all_results.push(...env_results);
   console.log();
 
+  const cookie_prefix_results = check_cookie_prefix(project_root);
+  if (cookie_prefix_results.length > 0) {
+    console.log("\x1b[1m🍪 Cookie Prefix\x1b[0m");
+    cookie_prefix_results.forEach(print_result);
+    all_results.push(...cookie_prefix_results);
+    console.log();
+  }
+
   console.log("\x1b[1m🔑 OAuth Providers\x1b[0m");
   const oauth_results = check_oauth(project_root);
   oauth_results.forEach(print_result);

package/cli-src/lib/oauth_preflight.server.ts

@@ -3,6 +3,7 @@
 import "server-only";
 
 import { get_oauth_config } from "./oauth_config.server.js";
+import { get_cookies_config } from "./cookies_config.server.js";
 import { googleRedirectUri, facebookRedirectUri } from "./oauth_routes.js";
 import { create_app_logger } from "./app_logger.js";
 
@@ -49,6 +50,30 @@ export function getOAuthPreflightReport(): OAuthPreflightReport {
   const oauth = get_oauth_config();
   const redirectUris: OAuthPreflightReport["redirectUris"] = [];
 
+  // Cookie prefix: env (read by the edge proxy) must match the ini (read by the
+  // server). A mismatch — or an unset env var — makes the edge gate throw and
+  // silently bounce authenticated users to /login.
+  try {
+    const ini_prefix = (get_cookies_config().cookie_prefix ?? "").trim();
+    const env_prefix = (process.env.HAZO_AUTH_COOKIE_PREFIX ?? "").trim();
+    if (ini_prefix && !env_prefix) {
+      checks.push({
+        name: "Cookie prefix",
+        status: "fail",
+        message: `HAZO_AUTH_COOKIE_PREFIX env var not set. The edge proxy throws without it and bounces authenticated users to /login. Set HAZO_AUTH_COOKIE_PREFIX=${ini_prefix} (matching cookie_prefix in hazo_auth_config.ini).`,
+      });
+    } else if (ini_prefix && env_prefix && env_prefix !== ini_prefix) {
+      checks.push({
+        name: "Cookie prefix",
+        status: "fail",
+        message: `Mismatch: HAZO_AUTH_COOKIE_PREFIX="${env_prefix}" vs ini cookie_prefix="${ini_prefix}". They must be identical or the edge gate can't find the session cookie.`,
+      });
+    }
+  } catch {
+    // get_cookies_config throws when cookie_prefix is absent from the ini; that
+    // missing-config case is reported elsewhere (validate CLI / server boot).
+  }
+
   // NEXTAUTH_URL — the source of the redirect URI.
   if (resolved) {
     checks.push({ name: "NEXTAUTH_URL", status: "pass", message: origin });
@@ -152,10 +177,10 @@ export function logOAuthPreflight(): OAuthPreflightReport | null {
   _logged_once = true;
 
   const report = getOAuthPreflightReport();
-  if (report.redirectUris.length === 0) return report; // No OAuth providers enabled.
-
   const logger = create_app_logger();
 
+  // Always surface failing/warning checks (e.g. cookie-prefix mismatch), even
+  // when no OAuth provider is enabled and there are no redirect URIs to print.
   for (const check of report.checks) {
     if (check.status === "fail") {
       logger.error("oauth_preflight_check_failed", { check: check.name, detail: check.message });
@@ -164,6 +189,8 @@ export function logOAuthPreflight(): OAuthPreflightReport | null {
     }
   }
 
+  if (report.redirectUris.length === 0) return report; // No OAuth providers — nothing to register.
+
   // Highlighted, copy-pasteable block — the single thing that prevents
   // redirect_uri_mismatch. console (not logger) so it renders verbatim.
   const lines: string[] = [

package/dist/cli/validate.d.ts.map

@@ -1 +1 @@
-{"version":3,"file":"validate.d.ts","sourceRoot":"","sources":["../../src/cli/validate.ts"],"names":[],"mappings":"AAOA,KAAK,WAAW,GAAG,MAAM,GAAG,MAAM,GAAG,MAAM,CAAC;AAE5C,KAAK,WAAW,GAAG;IACjB,IAAI,EAAE,MAAM,CAAC;IACb,MAAM,EAAE,WAAW,CAAC;IACpB,OAAO,EAAE,MAAM,CAAC;CACjB,CAAC;AAEF,MAAM,MAAM,iBAAiB,GAAG;IAC9B,MAAM,EAAE,MAAM,CAAC;IACf,MAAM,EAAE,MAAM,CAAC;IACf,QAAQ,EAAE,MAAM,CAAC;IACjB,OAAO,EAAE,WAAW,EAAE,CAAC;CACxB,CAAC;AAsyBF,wBAAgB,cAAc,IAAI,iBAAiB,CAsFlD"}
+{"version":3,"file":"validate.d.ts","sourceRoot":"","sources":["../../src/cli/validate.ts"],"names":[],"mappings":"AAOA,KAAK,WAAW,GAAG,MAAM,GAAG,MAAM,GAAG,MAAM,CAAC;AAE5C,KAAK,WAAW,GAAG;IACjB,IAAI,EAAE,MAAM,CAAC;IACb,MAAM,EAAE,WAAW,CAAC;IACpB,OAAO,EAAE,MAAM,CAAC;CACjB,CAAC;AAEF,MAAM,MAAM,iBAAiB,GAAG;IAC9B,MAAM,EAAE,MAAM,CAAC;IACf,MAAM,EAAE,MAAM,CAAC;IACf,QAAQ,EAAE,MAAM,CAAC;IACjB,OAAO,EAAE,WAAW,EAAE,CAAC;CACxB,CAAC;AA20BF,wBAAgB,cAAc,IAAI,iBAAiB,CA8FlD"}

package/dist/cli/validate.js

@@ -272,6 +272,42 @@ function check_env_vars() {
 // compiles as an isolated tree and must not import the server-only lib.
 const GOOGLE_NEXTAUTH_CALLBACK_PATH = "/api/auth/callback/google";
 const FACEBOOK_NEXTAUTH_CALLBACK_PATH = "/api/auth/callback/facebook";
+/**
+ * The edge proxy (Edge Runtime, no filesystem) reads the cookie prefix from the
+ * HAZO_AUTH_COOKIE_PREFIX env var, while the server reads cookie_prefix from the
+ * ini. If they differ — or the env var is unset — the edge gate can't find the
+ * session cookie and silently bounces authenticated users back to /login. This
+ * check catches that split before it wastes an afternoon.
+ */
+function check_cookie_prefix(project_root) {
+    var _a, _b, _c;
+    const hazo_config = read_ini_file(path.join(project_root, "config", "hazo_auth_config.ini"));
+    const ini_prefix = ((_b = (_a = hazo_config === null || hazo_config === void 0 ? void 0 : hazo_config["hazo_auth__cookies"]) === null || _a === void 0 ? void 0 : _a["cookie_prefix"]) !== null && _b !== void 0 ? _b : "").trim();
+    const env_prefix = ((_c = process.env.HAZO_AUTH_COOKIE_PREFIX) !== null && _c !== void 0 ? _c : "").trim();
+    if (!ini_prefix) {
+        // Already reported as a fail by check_config_values; nothing to compare.
+        return [];
+    }
+    if (!env_prefix) {
+        return [
+            {
+                name: "Cookie prefix (env ↔ ini)",
+                status: "fail",
+                message: `HAZO_AUTH_COOKIE_PREFIX env var not set. The edge proxy throws without it and bounces authenticated users to /login. Set HAZO_AUTH_COOKIE_PREFIX=${ini_prefix} to match cookie_prefix in hazo_auth_config.ini.`,
+            },
+        ];
+    }
+    if (env_prefix !== ini_prefix) {
+        return [
+            {
+                name: "Cookie prefix (env ↔ ini)",
+                status: "fail",
+                message: `Mismatch: HAZO_AUTH_COOKIE_PREFIX="${env_prefix}" but ini cookie_prefix="${ini_prefix}". They must be identical or the edge gate can't find the session cookie. Make them equal.`,
+            },
+        ];
+    }
+    return [{ name: "Cookie prefix (env ↔ ini)", status: "pass", message: `"${env_prefix}" (matches)` }];
+}
 function read_oauth_origin() {
     var _a;
     const nextauth_url = process.env.NEXTAUTH_URL;
@@ -781,6 +817,13 @@ export function run_validation() {
     env_results.forEach(print_result);
     all_results.push(...env_results);
     console.log();
+    const cookie_prefix_results = check_cookie_prefix(project_root);
+    if (cookie_prefix_results.length > 0) {
+        console.log("\x1b[1m🍪 Cookie Prefix\x1b[0m");
+        cookie_prefix_results.forEach(print_result);
+        all_results.push(...cookie_prefix_results);
+        console.log();
+    }
     console.log("\x1b[1m🔑 OAuth Providers\x1b[0m");
     const oauth_results = check_oauth(project_root);
     oauth_results.forEach(print_result);

package/dist/lib/oauth_preflight.server.d.ts.map

@@ -1 +1 @@
-{"version":3,"file":"oauth_preflight.server.d.ts","sourceRoot":"","sources":["../../src/lib/oauth_preflight.server.ts"],"names":[],"mappings":"AAEA,OAAO,aAAa,CAAC;AAOrB,MAAM,MAAM,eAAe,GAAG,MAAM,GAAG,MAAM,GAAG,MAAM,CAAC;AAEvD,MAAM,MAAM,cAAc,GAAG;IAC3B,IAAI,EAAE,MAAM,CAAC;IACb,MAAM,EAAE,eAAe,CAAC;IACxB,OAAO,EAAE,MAAM,CAAC;CACjB,CAAC;AAEF,MAAM,MAAM,oBAAoB,GAAG;IACjC,yEAAyE;IACzE,MAAM,EAAE,MAAM,CAAC;IACf,wEAAwE;IACxE,cAAc,EAAE,OAAO,CAAC;IACxB,uFAAuF;IACvF,YAAY,EAAE;QAAE,QAAQ,EAAE,QAAQ,GAAG,UAAU,CAAC;QAAC,GAAG,EAAE,MAAM,CAAA;KAAE,EAAE,CAAC;IACjE,MAAM,EAAE,cAAc,EAAE,CAAC;CAC1B,CAAC;AAeF;;;;GAIG;AACH,wBAAgB,uBAAuB,IAAI,oBAAoB,CA2F9D;AAKD;;;;;;;GAOG;AACH,wBAAgB,iBAAiB,IAAI,oBAAoB,GAAG,IAAI,CAsC/D"}
+{"version":3,"file":"oauth_preflight.server.d.ts","sourceRoot":"","sources":["../../src/lib/oauth_preflight.server.ts"],"names":[],"mappings":"AAEA,OAAO,aAAa,CAAC;AAQrB,MAAM,MAAM,eAAe,GAAG,MAAM,GAAG,MAAM,GAAG,MAAM,CAAC;AAEvD,MAAM,MAAM,cAAc,GAAG;IAC3B,IAAI,EAAE,MAAM,CAAC;IACb,MAAM,EAAE,eAAe,CAAC;IACxB,OAAO,EAAE,MAAM,CAAC;CACjB,CAAC;AAEF,MAAM,MAAM,oBAAoB,GAAG;IACjC,yEAAyE;IACzE,MAAM,EAAE,MAAM,CAAC;IACf,wEAAwE;IACxE,cAAc,EAAE,OAAO,CAAC;IACxB,uFAAuF;IACvF,YAAY,EAAE;QAAE,QAAQ,EAAE,QAAQ,GAAG,UAAU,CAAC;QAAC,GAAG,EAAE,MAAM,CAAA;KAAE,EAAE,CAAC;IACjE,MAAM,EAAE,cAAc,EAAE,CAAC;CAC1B,CAAC;AAeF;;;;GAIG;AACH,wBAAgB,uBAAuB,IAAI,oBAAoB,CAmH9D;AAKD;;;;;;;GAOG;AACH,wBAAgB,iBAAiB,IAAI,oBAAoB,GAAG,IAAI,CAwC/D"}

package/dist/lib/oauth_preflight.server.js

@@ -2,6 +2,7 @@
 // redirect URIs to register, killing the recurring `redirect_uri_mismatch` for new apps.
 import "server-only";
 import { get_oauth_config } from "./oauth_config.server.js";
+import { get_cookies_config } from "./cookies_config.server.js";
 import { googleRedirectUri, facebookRedirectUri } from "./oauth_routes.js";
 import { create_app_logger } from "./app_logger.js";
 // section: helpers
@@ -22,10 +23,36 @@ function resolve_origin() {
  * no DB or network access.
  */
 export function getOAuthPreflightReport() {
+    var _a, _b;
     const checks = [];
     const { origin, resolved } = resolve_origin();
     const oauth = get_oauth_config();
     const redirectUris = [];
+    // Cookie prefix: env (read by the edge proxy) must match the ini (read by the
+    // server). A mismatch — or an unset env var — makes the edge gate throw and
+    // silently bounce authenticated users to /login.
+    try {
+        const ini_prefix = ((_a = get_cookies_config().cookie_prefix) !== null && _a !== void 0 ? _a : "").trim();
+        const env_prefix = ((_b = process.env.HAZO_AUTH_COOKIE_PREFIX) !== null && _b !== void 0 ? _b : "").trim();
+        if (ini_prefix && !env_prefix) {
+            checks.push({
+                name: "Cookie prefix",
+                status: "fail",
+                message: `HAZO_AUTH_COOKIE_PREFIX env var not set. The edge proxy throws without it and bounces authenticated users to /login. Set HAZO_AUTH_COOKIE_PREFIX=${ini_prefix} (matching cookie_prefix in hazo_auth_config.ini).`,
+            });
+        }
+        else if (ini_prefix && env_prefix && env_prefix !== ini_prefix) {
+            checks.push({
+                name: "Cookie prefix",
+                status: "fail",
+                message: `Mismatch: HAZO_AUTH_COOKIE_PREFIX="${env_prefix}" vs ini cookie_prefix="${ini_prefix}". They must be identical or the edge gate can't find the session cookie.`,
+            });
+        }
+    }
+    catch (_c) {
+        // get_cookies_config throws when cookie_prefix is absent from the ini; that
+        // missing-config case is reported elsewhere (validate CLI / server boot).
+    }
     // NEXTAUTH_URL — the source of the redirect URI.
     if (resolved) {
         checks.push({ name: "NEXTAUTH_URL", status: "pass", message: origin });
@@ -45,7 +72,7 @@ export function getOAuthPreflightReport() {
             const u = new URL(origin);
             url_port = u.port || (u.protocol === "https:" ? "443" : "80");
         }
-        catch (_a) {
+        catch (_d) {
             url_port = null;
         }
         if (url_port && url_port !== declared_port) {
@@ -128,9 +155,9 @@ export function logOAuthPreflight() {
         return null;
     _logged_once = true;
     const report = getOAuthPreflightReport();
-    if (report.redirectUris.length === 0)
-        return report; // No OAuth providers enabled.
     const logger = create_app_logger();
+    // Always surface failing/warning checks (e.g. cookie-prefix mismatch), even
+    // when no OAuth provider is enabled and there are no redirect URIs to print.
     for (const check of report.checks) {
         if (check.status === "fail") {
             logger.error("oauth_preflight_check_failed", { check: check.name, detail: check.message });
@@ -139,6 +166,8 @@ export function logOAuthPreflight() {
             logger.warn("oauth_preflight_check_warning", { check: check.name, detail: check.message });
         }
     }
+    if (report.redirectUris.length === 0)
+        return report; // No OAuth providers — nothing to register.
     // Highlighted, copy-pasteable block — the single thing that prevents
     // redirect_uri_mismatch. console (not logger) so it renders verbatim.
     const lines = [

package/package.json

@@ -1,6 +1,6 @@
 {
   "name": "hazo_auth",
-  "version": "10.4.10",
+  "version": "10.4.11",
   "description": "Zero-config authentication UI components for Next.js with RBAC, OAuth, scope-based multi-tenancy, and invitations",
   "keywords": [
     "authentication",