hazo_auth 10.4.7 → 10.4.9

package/SETUP_CHECKLIST.md

@@ -947,10 +947,10 @@ Google OAuth Sign-In allows users to authenticate with their Google accounts. Th
 5. Configure OAuth consent screen if prompted
 6. Set **Application type** to "Web application"
 7. Add **Authorized JavaScript origins**:
-   - Development: `http://localhost:3000`
+   - Development: `http://localhost:<YOUR_PORT>`
    - Production: `https://yourdomain.com`
-8. Add **Authorized redirect URIs**:
-   - Development: `http://localhost:3000/api/auth/callback/google`
+8. Add **Authorized redirect URIs** — the path is fixed and exported as `GOOGLE_NEXTAUTH_CALLBACK_PATH` from `hazo_auth`:
+   - Development: `http://localhost:<YOUR_PORT>/api/auth/callback/google`
    - Production: `https://yourdomain.com/api/auth/callback/google`
 9. Copy the **Client ID** and **Client Secret**
 

package/cli-src/lib/auth/nextauth_config.ts

@@ -12,6 +12,7 @@ import { handle_google_oauth_login } from "../services/oauth_service.js";
 import { get_hazo_connect_instance } from "../hazo_connect_instance.server.js";
 import { create_app_logger } from "../app_logger.js";
 import { store_google_oauth_token, GoogleTokenStorageUnconfigured } from "../services/google_token_service.js";
+import { GOOGLE_OAUTH_CALLBACK_PATH, FACEBOOK_OAUTH_CALLBACK_PATH } from "../oauth_routes.js";
 
 // section: types
 export type NextAuthCallbackUser = {
@@ -102,8 +103,8 @@ export function get_nextauth_config(): AuthOptions {
         // Always redirect to our custom callback after sign-in to set hazo_auth cookies
         // The callbackUrl from signIn() comes through as `url`
         if (
-          url.includes("/api/hazo_auth/oauth/google/callback") ||
-          url.includes("/api/hazo_auth/oauth/facebook/callback")
+          url.includes(GOOGLE_OAUTH_CALLBACK_PATH) ||
+          url.includes(FACEBOOK_OAUTH_CALLBACK_PATH)
         ) {
           return url;
         }
@@ -118,9 +119,9 @@ export function get_nextauth_config(): AuthOptions {
 
         // Default: redirect to our custom OAuth callback to set cookies
         if (url.includes("facebook")) {
-          return `${baseUrl}/api/hazo_auth/oauth/facebook/callback`;
+          return `${baseUrl}${FACEBOOK_OAUTH_CALLBACK_PATH}`;
         }
-        return `${baseUrl}/api/hazo_auth/oauth/google/callback`;
+        return `${baseUrl}${GOOGLE_OAUTH_CALLBACK_PATH}`;
       },
       /**
        * Sign-in callback - handle user creation/linking for Google OAuth
@@ -174,9 +175,22 @@ export function get_nextauth_config(): AuthOptions {
             // Store user_id in account for the JWT callback to pick up
             (account as Record<string, unknown>).hazo_user_id = result.user_id;
 
-            // Capture refresh token when extra scopes were granted
+            // Capture refresh token when extra scopes were granted.
+            // Google echoes the base scopes back in full-URL form
+            // (https://www.googleapis.com/auth/userinfo.email|profile), so we
+            // normalise to short names before comparing — otherwise every plain
+            // login looks like it requested extra scopes and triggers offline
+            // token storage that should never run.
             const BASE_SCOPES = ["openid", "email", "profile"];
-            const granted_scopes = (account.scope ?? "").split(" ").filter(Boolean);
+            const normalise_scope = (s: string): string => {
+              if (s === "https://www.googleapis.com/auth/userinfo.email") return "email";
+              if (s === "https://www.googleapis.com/auth/userinfo.profile") return "profile";
+              return s;
+            };
+            const granted_scopes = (account.scope ?? "")
+              .split(" ")
+              .filter(Boolean)
+              .map(normalise_scope);
             const has_extra_scopes = granted_scopes.some(s => !BASE_SCOPES.includes(s));
 
             if (account.refresh_token && has_extra_scopes) {
@@ -196,17 +210,23 @@ export function get_nextauth_config(): AuthOptions {
                 });
               } catch (tokenError) {
                 if (tokenError instanceof GoogleTokenStorageUnconfigured) {
-                  logger.error("nextauth_google_token_storage_unconfigured", {
+                  // Non-fatal: offline Google API access (refresh-token storage)
+                  // requires HAZO_AUTH_OAUTH_KEY_* encryption keys. Login itself
+                  // does not — the user already authenticated. Warn so the admin
+                  // can configure keys if they want offline access, but let the
+                  // sign-in complete instead of dead-ending on an error page.
+                  logger.warn("nextauth_google_token_storage_unconfigured", {
                     user_id: result.user_id,
                     error: tokenError.message,
+                    impact: "Login succeeded; offline Google API access disabled until HAZO_AUTH_OAUTH_KEY_CURRENT and HAZO_AUTH_OAUTH_KEY_<ID> are set.",
+                  });
+                } else {
+                  const errorMsg = tokenError instanceof Error ? tokenError.message : String(tokenError);
+                  logger.error("nextauth_google_token_store_failed", {
+                    user_id: result.user_id,
+                    error: errorMsg,
                   });
-                  return "/api/auth/error?error=GoogleTokenStorageUnconfigured";
                 }
-                const errorMsg = tokenError instanceof Error ? tokenError.message : String(tokenError);
-                logger.error("nextauth_google_token_store_failed", {
-                  user_id: result.user_id,
-                  error: errorMsg,
-                });
                 // Non-fatal: continue sign-in even if token storage fails
               }
             }

package/cli-src/lib/oauth_routes.ts

@@ -0,0 +1,13 @@
+// file_description: Fixed OAuth route paths exported for consumer apps and internal use
+
+/** NextAuth's built-in OAuth redirect URI — register this in Google Cloud Console. */
+export const GOOGLE_NEXTAUTH_CALLBACK_PATH = "/api/auth/callback/google" as const;
+
+/** hazo_auth's custom post-auth handler — creates the hazo_auth session after Google sign-in. */
+export const GOOGLE_OAUTH_CALLBACK_PATH = "/api/hazo_auth/oauth/google/callback" as const;
+
+/** NextAuth's built-in OAuth redirect URI — register this in Facebook Developer Console. */
+export const FACEBOOK_NEXTAUTH_CALLBACK_PATH = "/api/auth/callback/facebook" as const;
+
+/** hazo_auth's custom post-auth handler — creates the hazo_auth session after Facebook sign-in. */
+export const FACEBOOK_OAUTH_CALLBACK_PATH = "/api/hazo_auth/oauth/facebook/callback" as const;

package/dist/index.d.ts

@@ -6,5 +6,6 @@ export { AuthenticationRequiredError, TenantRequiredError, TenantAccessDeniedErr
 export type { LegalDoc, LegalAcceptanceRecord, LegalAcceptanceMap } from './lib/legal/legal_docs_types';
 export { cn, merge_class_names } from "./lib/utils.js";
 export { HAZO_AUTH_PERMISSIONS, ALL_ADMIN_PERMISSIONS, GLOBAL_ADMIN_PERMISSION } from "./lib/constants.js";
+export { GOOGLE_NEXTAUTH_CALLBACK_PATH, GOOGLE_OAUTH_CALLBACK_PATH, FACEBOOK_NEXTAUTH_CALLBACK_PATH, FACEBOOK_OAUTH_CALLBACK_PATH, } from "./lib/oauth_routes.js";
 export { requestGoogleScopes } from "./lib/auth/request_google_scopes.js";
 //# sourceMappingURL=index.d.ts.map

package/dist/index.d.ts.map

@@ -1 +1 @@
-{"version":3,"file":"index.d.ts","sourceRoot":"","sources":["../src/index.ts"],"names":[],"mappings":"AAQA,cAAc,+BAA+B,CAAC;AAC9C,cAAc,6BAA6B,CAAC;AAG5C,cAAc,oBAAoB,CAAC;AAGnC,YAAY,EACV,YAAY,EACZ,cAAc,EACd,aAAa,EACb,eAAe,EACf,YAAY,EACZ,kBAAkB,EAClB,iBAAiB,EACjB,gBAAgB,EAChB,wBAAwB,GACzB,MAAM,uBAAuB,CAAC;AAC/B,OAAO,EACL,2BAA2B,EAC3B,mBAAmB,EACnB,uBAAuB,GACxB,MAAM,uBAAuB,CAAC;AAG/B,YAAY,EAAE,QAAQ,EAAE,qBAAqB,EAAE,kBAAkB,EAAE,MAAM,8BAA8B,CAAC;AAGxG,OAAO,EAAE,EAAE,EAAE,iBAAiB,EAAE,MAAM,aAAa,CAAC;AAGpD,OAAO,EAAE,qBAAqB,EAAE,qBAAqB,EAAE,uBAAuB,EAAE,MAAM,iBAAiB,CAAC;AAGxG,OAAO,EAAE,mBAAmB,EAAE,MAAM,kCAAkC,CAAC"}
+{"version":3,"file":"index.d.ts","sourceRoot":"","sources":["../src/index.ts"],"names":[],"mappings":"AAQA,cAAc,+BAA+B,CAAC;AAC9C,cAAc,6BAA6B,CAAC;AAG5C,cAAc,oBAAoB,CAAC;AAGnC,YAAY,EACV,YAAY,EACZ,cAAc,EACd,aAAa,EACb,eAAe,EACf,YAAY,EACZ,kBAAkB,EAClB,iBAAiB,EACjB,gBAAgB,EAChB,wBAAwB,GACzB,MAAM,uBAAuB,CAAC;AAC/B,OAAO,EACL,2BAA2B,EAC3B,mBAAmB,EACnB,uBAAuB,GACxB,MAAM,uBAAuB,CAAC;AAG/B,YAAY,EAAE,QAAQ,EAAE,qBAAqB,EAAE,kBAAkB,EAAE,MAAM,8BAA8B,CAAC;AAGxG,OAAO,EAAE,EAAE,EAAE,iBAAiB,EAAE,MAAM,aAAa,CAAC;AAGpD,OAAO,EAAE,qBAAqB,EAAE,qBAAqB,EAAE,uBAAuB,EAAE,MAAM,iBAAiB,CAAC;AACxG,OAAO,EACL,6BAA6B,EAC7B,0BAA0B,EAC1B,+BAA+B,EAC/B,4BAA4B,GAC7B,MAAM,oBAAoB,CAAC;AAG5B,OAAO,EAAE,mBAAmB,EAAE,MAAM,kCAAkC,CAAC"}

package/dist/index.js

@@ -14,5 +14,6 @@ export { AuthenticationRequiredError, TenantRequiredError, TenantAccessDeniedErr
 export { cn, merge_class_names } from "./lib/utils.js";
 // section: constant_exports
 export { HAZO_AUTH_PERMISSIONS, ALL_ADMIN_PERMISSIONS, GLOBAL_ADMIN_PERMISSION } from "./lib/constants.js";
+export { GOOGLE_NEXTAUTH_CALLBACK_PATH, GOOGLE_OAUTH_CALLBACK_PATH, FACEBOOK_NEXTAUTH_CALLBACK_PATH, FACEBOOK_OAUTH_CALLBACK_PATH, } from "./lib/oauth_routes.js";
 // section: google_oauth_exports
 export { requestGoogleScopes } from "./lib/auth/request_google_scopes.js";

package/dist/lib/auth/nextauth_config.d.ts.map

@@ -1 +1 @@
-{"version":3,"file":"nextauth_config.d.ts","sourceRoot":"","sources":["../../../src/lib/auth/nextauth_config.ts"],"names":[],"mappings":"AAEA,OAAO,KAAK,EAAE,WAAW,EAAW,MAAM,WAAW,CAAC;AActD,MAAM,MAAM,oBAAoB,GAAG;IACjC,EAAE,CAAC,EAAE,MAAM,CAAC;IACZ,KAAK,CAAC,EAAE,MAAM,GAAG,IAAI,CAAC;IACtB,IAAI,CAAC,EAAE,MAAM,GAAG,IAAI,CAAC;IACrB,KAAK,CAAC,EAAE,MAAM,GAAG,IAAI,CAAC;CACvB,CAAC;AAEF,MAAM,MAAM,uBAAuB,GAAG;IACpC,QAAQ,EAAE,MAAM,CAAC;IACjB,iBAAiB,EAAE,MAAM,CAAC;IAC1B,IAAI,EAAE,MAAM,CAAC;IACb,YAAY,CAAC,EAAE,MAAM,CAAC;IACtB,QAAQ,CAAC,EAAE,MAAM,CAAC;IAClB,UAAU,CAAC,EAAE,MAAM,CAAC;IACpB,aAAa,CAAC,EAAE,MAAM,CAAC;IACvB,KAAK,CAAC,EAAE,MAAM,CAAC;CAChB,CAAC;AAEF,MAAM,MAAM,uBAAuB,GAAG;IACpC,GAAG,CAAC,EAAE,MAAM,CAAC;IACb,IAAI,CAAC,EAAE,MAAM,CAAC;IACd,KAAK,CAAC,EAAE,MAAM,CAAC;IACf,OAAO,CAAC,EAAE,MAAM,CAAC;IACjB,cAAc,CAAC,EAAE,OAAO,CAAC;CAC1B,CAAC;AAGF;;;;GAIG;AACH,wBAAgB,mBAAmB,IAAI,WAAW,CAwQjD;AAED;;;GAGG;AACH,wBAAgB,mBAAmB,IAAI,OAAO,CAW7C"}
+{"version":3,"file":"nextauth_config.d.ts","sourceRoot":"","sources":["../../../src/lib/auth/nextauth_config.ts"],"names":[],"mappings":"AAEA,OAAO,KAAK,EAAE,WAAW,EAAW,MAAM,WAAW,CAAC;AAetD,MAAM,MAAM,oBAAoB,GAAG;IACjC,EAAE,CAAC,EAAE,MAAM,CAAC;IACZ,KAAK,CAAC,EAAE,MAAM,GAAG,IAAI,CAAC;IACtB,IAAI,CAAC,EAAE,MAAM,GAAG,IAAI,CAAC;IACrB,KAAK,CAAC,EAAE,MAAM,GAAG,IAAI,CAAC;CACvB,CAAC;AAEF,MAAM,MAAM,uBAAuB,GAAG;IACpC,QAAQ,EAAE,MAAM,CAAC;IACjB,iBAAiB,EAAE,MAAM,CAAC;IAC1B,IAAI,EAAE,MAAM,CAAC;IACb,YAAY,CAAC,EAAE,MAAM,CAAC;IACtB,QAAQ,CAAC,EAAE,MAAM,CAAC;IAClB,UAAU,CAAC,EAAE,MAAM,CAAC;IACpB,aAAa,CAAC,EAAE,MAAM,CAAC;IACvB,KAAK,CAAC,EAAE,MAAM,CAAC;CAChB,CAAC;AAEF,MAAM,MAAM,uBAAuB,GAAG;IACpC,GAAG,CAAC,EAAE,MAAM,CAAC;IACb,IAAI,CAAC,EAAE,MAAM,CAAC;IACd,KAAK,CAAC,EAAE,MAAM,CAAC;IACf,OAAO,CAAC,EAAE,MAAM,CAAC;IACjB,cAAc,CAAC,EAAE,OAAO,CAAC;CAC1B,CAAC;AAGF;;;;GAIG;AACH,wBAAgB,mBAAmB,IAAI,WAAW,CA2RjD;AAED;;;GAGG;AACH,wBAAgB,mBAAmB,IAAI,OAAO,CAW7C"}

package/dist/lib/auth/nextauth_config.js

@@ -8,6 +8,7 @@ import { handle_google_oauth_login } from "../services/oauth_service.js";
 import { get_hazo_connect_instance } from "../hazo_connect_instance.server.js";
 import { create_app_logger } from "../app_logger.js";
 import { store_google_oauth_token, GoogleTokenStorageUnconfigured } from "../services/google_token_service.js";
+import { GOOGLE_OAUTH_CALLBACK_PATH, FACEBOOK_OAUTH_CALLBACK_PATH } from "../oauth_routes.js";
 // section: config
 /**
  * Gets NextAuth.js configuration with enabled OAuth providers
@@ -60,8 +61,8 @@ export function get_nextauth_config() {
                 console.log("[NextAuth redirect callback]", { url, baseUrl });
                 // Always redirect to our custom callback after sign-in to set hazo_auth cookies
                 // The callbackUrl from signIn() comes through as `url`
-                if (url.includes("/api/hazo_auth/oauth/google/callback") ||
-                    url.includes("/api/hazo_auth/oauth/facebook/callback")) {
+                if (url.includes(GOOGLE_OAUTH_CALLBACK_PATH) ||
+                    url.includes(FACEBOOK_OAUTH_CALLBACK_PATH)) {
                     return url;
                 }
                 // If URL is relative or same origin, allow it
@@ -73,9 +74,9 @@ export function get_nextauth_config() {
                 }
                 // Default: redirect to our custom OAuth callback to set cookies
                 if (url.includes("facebook")) {
-                    return `${baseUrl}/api/hazo_auth/oauth/facebook/callback`;
+                    return `${baseUrl}${FACEBOOK_OAUTH_CALLBACK_PATH}`;
                 }
-                return `${baseUrl}/api/hazo_auth/oauth/google/callback`;
+                return `${baseUrl}${GOOGLE_OAUTH_CALLBACK_PATH}`;
             },
             /**
              * Sign-in callback - handle user creation/linking for Google OAuth
@@ -115,9 +116,24 @@ export function get_nextauth_config() {
                         });
                         // Store user_id in account for the JWT callback to pick up
                         account.hazo_user_id = result.user_id;
-                        // Capture refresh token when extra scopes were granted
+                        // Capture refresh token when extra scopes were granted.
+                        // Google echoes the base scopes back in full-URL form
+                        // (https://www.googleapis.com/auth/userinfo.email|profile), so we
+                        // normalise to short names before comparing — otherwise every plain
+                        // login looks like it requested extra scopes and triggers offline
+                        // token storage that should never run.
                         const BASE_SCOPES = ["openid", "email", "profile"];
-                        const granted_scopes = ((_b = account.scope) !== null && _b !== void 0 ? _b : "").split(" ").filter(Boolean);
+                        const normalise_scope = (s) => {
+                            if (s === "https://www.googleapis.com/auth/userinfo.email")
+                                return "email";
+                            if (s === "https://www.googleapis.com/auth/userinfo.profile")
+                                return "profile";
+                            return s;
+                        };
+                        const granted_scopes = ((_b = account.scope) !== null && _b !== void 0 ? _b : "")
+                            .split(" ")
+                            .filter(Boolean)
+                            .map(normalise_scope);
                         const has_extra_scopes = granted_scopes.some(s => !BASE_SCOPES.includes(s));
                         if (account.refresh_token && has_extra_scopes) {
                             try {
@@ -137,17 +153,24 @@ export function get_nextauth_config() {
                             }
                             catch (tokenError) {
                                 if (tokenError instanceof GoogleTokenStorageUnconfigured) {
-                                    logger.error("nextauth_google_token_storage_unconfigured", {
+                                    // Non-fatal: offline Google API access (refresh-token storage)
+                                    // requires HAZO_AUTH_OAUTH_KEY_* encryption keys. Login itself
+                                    // does not — the user already authenticated. Warn so the admin
+                                    // can configure keys if they want offline access, but let the
+                                    // sign-in complete instead of dead-ending on an error page.
+                                    logger.warn("nextauth_google_token_storage_unconfigured", {
                                         user_id: result.user_id,
                                         error: tokenError.message,
+                                        impact: "Login succeeded; offline Google API access disabled until HAZO_AUTH_OAUTH_KEY_CURRENT and HAZO_AUTH_OAUTH_KEY_<ID> are set.",
+                                    });
+                                }
+                                else {
+                                    const errorMsg = tokenError instanceof Error ? tokenError.message : String(tokenError);
+                                    logger.error("nextauth_google_token_store_failed", {
+                                        user_id: result.user_id,
+                                        error: errorMsg,
                                     });
-                                    return "/api/auth/error?error=GoogleTokenStorageUnconfigured";
                                 }
-                                const errorMsg = tokenError instanceof Error ? tokenError.message : String(tokenError);
-                                logger.error("nextauth_google_token_store_failed", {
-                                    user_id: result.user_id,
-                                    error: errorMsg,
-                                });
                                 // Non-fatal: continue sign-in even if token storage fails
                             }
                         }

package/dist/lib/oauth_routes.d.ts

@@ -0,0 +1,9 @@
+/** NextAuth's built-in OAuth redirect URI — register this in Google Cloud Console. */
+export declare const GOOGLE_NEXTAUTH_CALLBACK_PATH: "/api/auth/callback/google";
+/** hazo_auth's custom post-auth handler — creates the hazo_auth session after Google sign-in. */
+export declare const GOOGLE_OAUTH_CALLBACK_PATH: "/api/hazo_auth/oauth/google/callback";
+/** NextAuth's built-in OAuth redirect URI — register this in Facebook Developer Console. */
+export declare const FACEBOOK_NEXTAUTH_CALLBACK_PATH: "/api/auth/callback/facebook";
+/** hazo_auth's custom post-auth handler — creates the hazo_auth session after Facebook sign-in. */
+export declare const FACEBOOK_OAUTH_CALLBACK_PATH: "/api/hazo_auth/oauth/facebook/callback";
+//# sourceMappingURL=oauth_routes.d.ts.map

package/dist/lib/oauth_routes.d.ts.map

@@ -0,0 +1 @@
+{"version":3,"file":"oauth_routes.d.ts","sourceRoot":"","sources":["../../src/lib/oauth_routes.ts"],"names":[],"mappings":"AAEA,sFAAsF;AACtF,eAAO,MAAM,6BAA6B,EAAG,2BAAoC,CAAC;AAElF,iGAAiG;AACjG,eAAO,MAAM,0BAA0B,EAAG,sCAA+C,CAAC;AAE1F,4FAA4F;AAC5F,eAAO,MAAM,+BAA+B,EAAG,6BAAsC,CAAC;AAEtF,mGAAmG;AACnG,eAAO,MAAM,4BAA4B,EAAG,wCAAiD,CAAC"}

package/dist/lib/oauth_routes.js

@@ -0,0 +1,9 @@
+// file_description: Fixed OAuth route paths exported for consumer apps and internal use
+/** NextAuth's built-in OAuth redirect URI — register this in Google Cloud Console. */
+export const GOOGLE_NEXTAUTH_CALLBACK_PATH = "/api/auth/callback/google";
+/** hazo_auth's custom post-auth handler — creates the hazo_auth session after Google sign-in. */
+export const GOOGLE_OAUTH_CALLBACK_PATH = "/api/hazo_auth/oauth/google/callback";
+/** NextAuth's built-in OAuth redirect URI — register this in Facebook Developer Console. */
+export const FACEBOOK_NEXTAUTH_CALLBACK_PATH = "/api/auth/callback/facebook";
+/** hazo_auth's custom post-auth handler — creates the hazo_auth session after Facebook sign-in. */
+export const FACEBOOK_OAUTH_CALLBACK_PATH = "/api/hazo_auth/oauth/facebook/callback";

package/package.json

@@ -1,6 +1,6 @@
 {
   "name": "hazo_auth",
-  "version": "10.4.7",
+  "version": "10.4.9",
   "description": "Zero-config authentication UI components for Next.js with RBAC, OAuth, scope-based multi-tenancy, and invitations",
   "keywords": [
     "authentication",