hazo_auth 10.4.7 → 10.4.8

package/SETUP_CHECKLIST.md

@@ -947,10 +947,10 @@ Google OAuth Sign-In allows users to authenticate with their Google accounts. Th
 5. Configure OAuth consent screen if prompted
 6. Set **Application type** to "Web application"
 7. Add **Authorized JavaScript origins**:
-   - Development: `http://localhost:3000`
+   - Development: `http://localhost:<YOUR_PORT>`
    - Production: `https://yourdomain.com`
-8. Add **Authorized redirect URIs**:
-   - Development: `http://localhost:3000/api/auth/callback/google`
+8. Add **Authorized redirect URIs** — the path is fixed and exported as `GOOGLE_NEXTAUTH_CALLBACK_PATH` from `hazo_auth`:
+   - Development: `http://localhost:<YOUR_PORT>/api/auth/callback/google`
    - Production: `https://yourdomain.com/api/auth/callback/google`
 9. Copy the **Client ID** and **Client Secret**
 

package/cli-src/lib/auth/nextauth_config.ts

@@ -12,6 +12,7 @@ import { handle_google_oauth_login } from "../services/oauth_service.js";
 import { get_hazo_connect_instance } from "../hazo_connect_instance.server.js";
 import { create_app_logger } from "../app_logger.js";
 import { store_google_oauth_token, GoogleTokenStorageUnconfigured } from "../services/google_token_service.js";
+import { GOOGLE_OAUTH_CALLBACK_PATH, FACEBOOK_OAUTH_CALLBACK_PATH } from "../oauth_routes.js";
 
 // section: types
 export type NextAuthCallbackUser = {
@@ -102,8 +103,8 @@ export function get_nextauth_config(): AuthOptions {
         // Always redirect to our custom callback after sign-in to set hazo_auth cookies
         // The callbackUrl from signIn() comes through as `url`
         if (
-          url.includes("/api/hazo_auth/oauth/google/callback") ||
-          url.includes("/api/hazo_auth/oauth/facebook/callback")
+          url.includes(GOOGLE_OAUTH_CALLBACK_PATH) ||
+          url.includes(FACEBOOK_OAUTH_CALLBACK_PATH)
         ) {
           return url;
         }
@@ -118,9 +119,9 @@ export function get_nextauth_config(): AuthOptions {
 
         // Default: redirect to our custom OAuth callback to set cookies
         if (url.includes("facebook")) {
-          return `${baseUrl}/api/hazo_auth/oauth/facebook/callback`;
+          return `${baseUrl}${FACEBOOK_OAUTH_CALLBACK_PATH}`;
         }
-        return `${baseUrl}/api/hazo_auth/oauth/google/callback`;
+        return `${baseUrl}${GOOGLE_OAUTH_CALLBACK_PATH}`;
       },
       /**
        * Sign-in callback - handle user creation/linking for Google OAuth

package/cli-src/lib/oauth_routes.ts

@@ -0,0 +1,13 @@
+// file_description: Fixed OAuth route paths exported for consumer apps and internal use
+
+/** NextAuth's built-in OAuth redirect URI — register this in Google Cloud Console. */
+export const GOOGLE_NEXTAUTH_CALLBACK_PATH = "/api/auth/callback/google" as const;
+
+/** hazo_auth's custom post-auth handler — creates the hazo_auth session after Google sign-in. */
+export const GOOGLE_OAUTH_CALLBACK_PATH = "/api/hazo_auth/oauth/google/callback" as const;
+
+/** NextAuth's built-in OAuth redirect URI — register this in Facebook Developer Console. */
+export const FACEBOOK_NEXTAUTH_CALLBACK_PATH = "/api/auth/callback/facebook" as const;
+
+/** hazo_auth's custom post-auth handler — creates the hazo_auth session after Facebook sign-in. */
+export const FACEBOOK_OAUTH_CALLBACK_PATH = "/api/hazo_auth/oauth/facebook/callback" as const;

package/dist/index.d.ts

@@ -6,5 +6,6 @@ export { AuthenticationRequiredError, TenantRequiredError, TenantAccessDeniedErr
 export type { LegalDoc, LegalAcceptanceRecord, LegalAcceptanceMap } from './lib/legal/legal_docs_types';
 export { cn, merge_class_names } from "./lib/utils.js";
 export { HAZO_AUTH_PERMISSIONS, ALL_ADMIN_PERMISSIONS, GLOBAL_ADMIN_PERMISSION } from "./lib/constants.js";
+export { GOOGLE_NEXTAUTH_CALLBACK_PATH, GOOGLE_OAUTH_CALLBACK_PATH, FACEBOOK_NEXTAUTH_CALLBACK_PATH, FACEBOOK_OAUTH_CALLBACK_PATH, } from "./lib/oauth_routes.js";
 export { requestGoogleScopes } from "./lib/auth/request_google_scopes.js";
 //# sourceMappingURL=index.d.ts.map

package/dist/index.d.ts.map

@@ -1 +1 @@
-{"version":3,"file":"index.d.ts","sourceRoot":"","sources":["../src/index.ts"],"names":[],"mappings":"AAQA,cAAc,+BAA+B,CAAC;AAC9C,cAAc,6BAA6B,CAAC;AAG5C,cAAc,oBAAoB,CAAC;AAGnC,YAAY,EACV,YAAY,EACZ,cAAc,EACd,aAAa,EACb,eAAe,EACf,YAAY,EACZ,kBAAkB,EAClB,iBAAiB,EACjB,gBAAgB,EAChB,wBAAwB,GACzB,MAAM,uBAAuB,CAAC;AAC/B,OAAO,EACL,2BAA2B,EAC3B,mBAAmB,EACnB,uBAAuB,GACxB,MAAM,uBAAuB,CAAC;AAG/B,YAAY,EAAE,QAAQ,EAAE,qBAAqB,EAAE,kBAAkB,EAAE,MAAM,8BAA8B,CAAC;AAGxG,OAAO,EAAE,EAAE,EAAE,iBAAiB,EAAE,MAAM,aAAa,CAAC;AAGpD,OAAO,EAAE,qBAAqB,EAAE,qBAAqB,EAAE,uBAAuB,EAAE,MAAM,iBAAiB,CAAC;AAGxG,OAAO,EAAE,mBAAmB,EAAE,MAAM,kCAAkC,CAAC"}
+{"version":3,"file":"index.d.ts","sourceRoot":"","sources":["../src/index.ts"],"names":[],"mappings":"AAQA,cAAc,+BAA+B,CAAC;AAC9C,cAAc,6BAA6B,CAAC;AAG5C,cAAc,oBAAoB,CAAC;AAGnC,YAAY,EACV,YAAY,EACZ,cAAc,EACd,aAAa,EACb,eAAe,EACf,YAAY,EACZ,kBAAkB,EAClB,iBAAiB,EACjB,gBAAgB,EAChB,wBAAwB,GACzB,MAAM,uBAAuB,CAAC;AAC/B,OAAO,EACL,2BAA2B,EAC3B,mBAAmB,EACnB,uBAAuB,GACxB,MAAM,uBAAuB,CAAC;AAG/B,YAAY,EAAE,QAAQ,EAAE,qBAAqB,EAAE,kBAAkB,EAAE,MAAM,8BAA8B,CAAC;AAGxG,OAAO,EAAE,EAAE,EAAE,iBAAiB,EAAE,MAAM,aAAa,CAAC;AAGpD,OAAO,EAAE,qBAAqB,EAAE,qBAAqB,EAAE,uBAAuB,EAAE,MAAM,iBAAiB,CAAC;AACxG,OAAO,EACL,6BAA6B,EAC7B,0BAA0B,EAC1B,+BAA+B,EAC/B,4BAA4B,GAC7B,MAAM,oBAAoB,CAAC;AAG5B,OAAO,EAAE,mBAAmB,EAAE,MAAM,kCAAkC,CAAC"}

package/dist/index.js

@@ -14,5 +14,6 @@ export { AuthenticationRequiredError, TenantRequiredError, TenantAccessDeniedErr
 export { cn, merge_class_names } from "./lib/utils.js";
 // section: constant_exports
 export { HAZO_AUTH_PERMISSIONS, ALL_ADMIN_PERMISSIONS, GLOBAL_ADMIN_PERMISSION } from "./lib/constants.js";
+export { GOOGLE_NEXTAUTH_CALLBACK_PATH, GOOGLE_OAUTH_CALLBACK_PATH, FACEBOOK_NEXTAUTH_CALLBACK_PATH, FACEBOOK_OAUTH_CALLBACK_PATH, } from "./lib/oauth_routes.js";
 // section: google_oauth_exports
 export { requestGoogleScopes } from "./lib/auth/request_google_scopes.js";

package/dist/lib/auth/nextauth_config.d.ts.map

@@ -1 +1 @@
-{"version":3,"file":"nextauth_config.d.ts","sourceRoot":"","sources":["../../../src/lib/auth/nextauth_config.ts"],"names":[],"mappings":"AAEA,OAAO,KAAK,EAAE,WAAW,EAAW,MAAM,WAAW,CAAC;AActD,MAAM,MAAM,oBAAoB,GAAG;IACjC,EAAE,CAAC,EAAE,MAAM,CAAC;IACZ,KAAK,CAAC,EAAE,MAAM,GAAG,IAAI,CAAC;IACtB,IAAI,CAAC,EAAE,MAAM,GAAG,IAAI,CAAC;IACrB,KAAK,CAAC,EAAE,MAAM,GAAG,IAAI,CAAC;CACvB,CAAC;AAEF,MAAM,MAAM,uBAAuB,GAAG;IACpC,QAAQ,EAAE,MAAM,CAAC;IACjB,iBAAiB,EAAE,MAAM,CAAC;IAC1B,IAAI,EAAE,MAAM,CAAC;IACb,YAAY,CAAC,EAAE,MAAM,CAAC;IACtB,QAAQ,CAAC,EAAE,MAAM,CAAC;IAClB,UAAU,CAAC,EAAE,MAAM,CAAC;IACpB,aAAa,CAAC,EAAE,MAAM,CAAC;IACvB,KAAK,CAAC,EAAE,MAAM,CAAC;CAChB,CAAC;AAEF,MAAM,MAAM,uBAAuB,GAAG;IACpC,GAAG,CAAC,EAAE,MAAM,CAAC;IACb,IAAI,CAAC,EAAE,MAAM,CAAC;IACd,KAAK,CAAC,EAAE,MAAM,CAAC;IACf,OAAO,CAAC,EAAE,MAAM,CAAC;IACjB,cAAc,CAAC,EAAE,OAAO,CAAC;CAC1B,CAAC;AAGF;;;;GAIG;AACH,wBAAgB,mBAAmB,IAAI,WAAW,CAwQjD;AAED;;;GAGG;AACH,wBAAgB,mBAAmB,IAAI,OAAO,CAW7C"}
+{"version":3,"file":"nextauth_config.d.ts","sourceRoot":"","sources":["../../../src/lib/auth/nextauth_config.ts"],"names":[],"mappings":"AAEA,OAAO,KAAK,EAAE,WAAW,EAAW,MAAM,WAAW,CAAC;AAetD,MAAM,MAAM,oBAAoB,GAAG;IACjC,EAAE,CAAC,EAAE,MAAM,CAAC;IACZ,KAAK,CAAC,EAAE,MAAM,GAAG,IAAI,CAAC;IACtB,IAAI,CAAC,EAAE,MAAM,GAAG,IAAI,CAAC;IACrB,KAAK,CAAC,EAAE,MAAM,GAAG,IAAI,CAAC;CACvB,CAAC;AAEF,MAAM,MAAM,uBAAuB,GAAG;IACpC,QAAQ,EAAE,MAAM,CAAC;IACjB,iBAAiB,EAAE,MAAM,CAAC;IAC1B,IAAI,EAAE,MAAM,CAAC;IACb,YAAY,CAAC,EAAE,MAAM,CAAC;IACtB,QAAQ,CAAC,EAAE,MAAM,CAAC;IAClB,UAAU,CAAC,EAAE,MAAM,CAAC;IACpB,aAAa,CAAC,EAAE,MAAM,CAAC;IACvB,KAAK,CAAC,EAAE,MAAM,CAAC;CAChB,CAAC;AAEF,MAAM,MAAM,uBAAuB,GAAG;IACpC,GAAG,CAAC,EAAE,MAAM,CAAC;IACb,IAAI,CAAC,EAAE,MAAM,CAAC;IACd,KAAK,CAAC,EAAE,MAAM,CAAC;IACf,OAAO,CAAC,EAAE,MAAM,CAAC;IACjB,cAAc,CAAC,EAAE,OAAO,CAAC;CAC1B,CAAC;AAGF;;;;GAIG;AACH,wBAAgB,mBAAmB,IAAI,WAAW,CAwQjD;AAED;;;GAGG;AACH,wBAAgB,mBAAmB,IAAI,OAAO,CAW7C"}

package/dist/lib/auth/nextauth_config.js

@@ -8,6 +8,7 @@ import { handle_google_oauth_login } from "../services/oauth_service.js";
 import { get_hazo_connect_instance } from "../hazo_connect_instance.server.js";
 import { create_app_logger } from "../app_logger.js";
 import { store_google_oauth_token, GoogleTokenStorageUnconfigured } from "../services/google_token_service.js";
+import { GOOGLE_OAUTH_CALLBACK_PATH, FACEBOOK_OAUTH_CALLBACK_PATH } from "../oauth_routes.js";
 // section: config
 /**
  * Gets NextAuth.js configuration with enabled OAuth providers
@@ -60,8 +61,8 @@ export function get_nextauth_config() {
                 console.log("[NextAuth redirect callback]", { url, baseUrl });
                 // Always redirect to our custom callback after sign-in to set hazo_auth cookies
                 // The callbackUrl from signIn() comes through as `url`
-                if (url.includes("/api/hazo_auth/oauth/google/callback") ||
-                    url.includes("/api/hazo_auth/oauth/facebook/callback")) {
+                if (url.includes(GOOGLE_OAUTH_CALLBACK_PATH) ||
+                    url.includes(FACEBOOK_OAUTH_CALLBACK_PATH)) {
                     return url;
                 }
                 // If URL is relative or same origin, allow it
@@ -73,9 +74,9 @@ export function get_nextauth_config() {
                 }
                 // Default: redirect to our custom OAuth callback to set cookies
                 if (url.includes("facebook")) {
-                    return `${baseUrl}/api/hazo_auth/oauth/facebook/callback`;
+                    return `${baseUrl}${FACEBOOK_OAUTH_CALLBACK_PATH}`;
                 }
-                return `${baseUrl}/api/hazo_auth/oauth/google/callback`;
+                return `${baseUrl}${GOOGLE_OAUTH_CALLBACK_PATH}`;
             },
             /**
              * Sign-in callback - handle user creation/linking for Google OAuth

package/dist/lib/oauth_routes.d.ts

@@ -0,0 +1,9 @@
+/** NextAuth's built-in OAuth redirect URI — register this in Google Cloud Console. */
+export declare const GOOGLE_NEXTAUTH_CALLBACK_PATH: "/api/auth/callback/google";
+/** hazo_auth's custom post-auth handler — creates the hazo_auth session after Google sign-in. */
+export declare const GOOGLE_OAUTH_CALLBACK_PATH: "/api/hazo_auth/oauth/google/callback";
+/** NextAuth's built-in OAuth redirect URI — register this in Facebook Developer Console. */
+export declare const FACEBOOK_NEXTAUTH_CALLBACK_PATH: "/api/auth/callback/facebook";
+/** hazo_auth's custom post-auth handler — creates the hazo_auth session after Facebook sign-in. */
+export declare const FACEBOOK_OAUTH_CALLBACK_PATH: "/api/hazo_auth/oauth/facebook/callback";
+//# sourceMappingURL=oauth_routes.d.ts.map

package/dist/lib/oauth_routes.d.ts.map

@@ -0,0 +1 @@
+{"version":3,"file":"oauth_routes.d.ts","sourceRoot":"","sources":["../../src/lib/oauth_routes.ts"],"names":[],"mappings":"AAEA,sFAAsF;AACtF,eAAO,MAAM,6BAA6B,EAAG,2BAAoC,CAAC;AAElF,iGAAiG;AACjG,eAAO,MAAM,0BAA0B,EAAG,sCAA+C,CAAC;AAE1F,4FAA4F;AAC5F,eAAO,MAAM,+BAA+B,EAAG,6BAAsC,CAAC;AAEtF,mGAAmG;AACnG,eAAO,MAAM,4BAA4B,EAAG,wCAAiD,CAAC"}

package/dist/lib/oauth_routes.js

@@ -0,0 +1,9 @@
+// file_description: Fixed OAuth route paths exported for consumer apps and internal use
+/** NextAuth's built-in OAuth redirect URI — register this in Google Cloud Console. */
+export const GOOGLE_NEXTAUTH_CALLBACK_PATH = "/api/auth/callback/google";
+/** hazo_auth's custom post-auth handler — creates the hazo_auth session after Google sign-in. */
+export const GOOGLE_OAUTH_CALLBACK_PATH = "/api/hazo_auth/oauth/google/callback";
+/** NextAuth's built-in OAuth redirect URI — register this in Facebook Developer Console. */
+export const FACEBOOK_NEXTAUTH_CALLBACK_PATH = "/api/auth/callback/facebook";
+/** hazo_auth's custom post-auth handler — creates the hazo_auth session after Facebook sign-in. */
+export const FACEBOOK_OAUTH_CALLBACK_PATH = "/api/hazo_auth/oauth/facebook/callback";

package/package.json

@@ -1,6 +1,6 @@
 {
   "name": "hazo_auth",
-  "version": "10.4.7",
+  "version": "10.4.8",
   "description": "Zero-config authentication UI components for Next.js with RBAC, OAuth, scope-based multi-tenancy, and invitations",
   "keywords": [
     "authentication",