hazo_auth 5.1.33 → 5.1.35

package/README.md

@@ -251,7 +251,7 @@ export default function Page() {
 | Page | Import | Description |
 |------|--------|-------------|
 | **LoginPage** | `hazo_auth/pages/login` | Login form with forgot password link |
-| **RegisterPage** | `hazo_auth/pages/register` | Registration with password validation |
+| **RegisterPage** | `hazo_auth/pages/register` | Registration with password validation and OAuth support |
 | **ForgotPasswordPage** | `hazo_auth/pages/forgot_password` | Request password reset email |
 | **ResetPasswordPage** | `hazo_auth/pages/reset_password` | Set new password with token |
 | **VerifyEmailPage** | `hazo_auth/pages/verify_email` | Email verification handler |
@@ -926,7 +926,7 @@ hazo_auth supports Google Sign-In via NextAuth.js v4, allowing users to authenti
 
 - **Dual authentication**: Users can have BOTH Google OAuth and email/password login
 - **Auto-linking**: Automatically links Google login to existing unverified email/password accounts
-- **Graceful degradation**: Login page adapts based on enabled authentication methods
+- **Graceful degradation**: Login and register pages adapt based on enabled authentication methods
 - **Set password feature**: Google-only users can add a password later via My Settings
 - **Profile data**: Full name and profile picture automatically populated from Google
 
@@ -1018,6 +1018,7 @@ auto_link_unverified_accounts = true
 
 # Customize button text (optional)
 google_button_text = Continue with Google
+google_button_text_register = Sign up with Google
 oauth_divider_text = or
 
 # Post-Login Redirect Configuration (v5.1.16+)
@@ -1266,7 +1267,7 @@ export default async function LoginPage() {
 
 **Available Layout Components:**
 - `LoginLayout` - Login form with email/password
-- `RegisterLayout` - Registration form with password requirements
+- `RegisterLayout` - Registration form with password requirements and OAuth (Google Sign-In)
 - `ForgotPasswordLayout` - Request password reset
 - `ResetPasswordLayout` - Set new password with token
 - `EmailVerificationLayout` - Verify email address

package/cli-src/lib/register_config.server.ts

@@ -7,6 +7,7 @@ import { get_config_boolean, get_config_value, read_config_section } from "./con
 import { get_password_requirements_config } from "./password_requirements_config.server.js";
 import { get_already_logged_in_config } from "./already_logged_in_config.server.js";
 import { get_user_fields_config } from "./user_fields_config.server.js";
+import { get_oauth_config } from "./oauth_config.server.js";
 
 // Default image path - consuming apps should either:
 // 1. Configure their own image_src in hazo_auth_config.ini
@@ -33,6 +34,13 @@ export type RegisterConfig = {
   imageSrc: string;
   imageAlt: string;
   imageBackgroundColor: string;
+  /** OAuth configuration */
+  oauth: {
+    enable_google: boolean;
+    enable_email_password: boolean;
+    google_button_text: string;
+    oauth_divider_text: string;
+  };
 };
 
 // section: helpers
@@ -89,6 +97,16 @@ export function get_register_config(): RegisterConfig {
     "#e2e8f0"
   );
 
+  // Get OAuth configuration (shared with login)
+  const oauthConfig = get_oauth_config();
+
+  // For the register page, default button text to "Sign up with Google" unless overridden
+  const registerGoogleButtonText = get_config_value(
+    "hazo_auth__oauth",
+    "google_button_text_register",
+    "Sign up with Google"
+  );
+
   return {
     showNameField,
     passwordRequirements,
@@ -102,6 +120,12 @@ export function get_register_config(): RegisterConfig {
     imageSrc,
     imageAlt,
     imageBackgroundColor,
+    oauth: {
+      enable_google: oauthConfig.enable_google,
+      enable_email_password: oauthConfig.enable_email_password,
+      google_button_text: registerGoogleButtonText,
+      oauth_divider_text: oauthConfig.oauth_divider_text,
+    },
   };
 }
 

package/cli-src/lib/utils/proxy_request.ts

@@ -0,0 +1,81 @@
+// file_description: Shared utility for rewriting request.url behind reverse proxies (Cloudflare Tunnel, nginx, AWS ALB)
+import { NextRequest } from "next/server";
+
+/**
+ * Detects the public-facing origin from proxy headers.
+ * Returns null if not behind a proxy (origins match).
+ */
+function detect_public_origin(request_url: URL, headers: Headers): string | null {
+  // Priority 1: NEXTAUTH_URL env var (explicitly configured)
+  const nextauth_url = process.env.NEXTAUTH_URL;
+  if (nextauth_url) {
+    try {
+      const public_origin = new URL(nextauth_url).origin;
+      if (public_origin !== request_url.origin) {
+        return public_origin;
+      }
+    } catch {
+      // Invalid NEXTAUTH_URL, fall through
+    }
+  }
+
+  // Priority 2: x-forwarded-host header (set by Cloudflare Tunnel, nginx, etc.)
+  const forwarded_host = headers.get("x-forwarded-host");
+  if (forwarded_host && forwarded_host !== request_url.hostname) {
+    const proto = headers.get("x-forwarded-proto") || "https";
+    return `${proto}://${forwarded_host}`;
+  }
+
+  // Priority 3: host header (Cloudflare Tunnel also sets this)
+  const host_header = headers.get("host");
+  if (host_header && host_header !== request_url.host) {
+    const proto = headers.get("x-forwarded-proto") || "https";
+    return `${proto}://${host_header}`;
+  }
+
+  return null;
+}
+
+/**
+ * Rewrites request.url to use the public-facing origin when behind a reverse proxy.
+ *
+ * Behind proxies like Cloudflare Tunnel, Next.js sets request.url to the internal
+ * address (e.g., https://localhost:3000). This causes NextResponse.redirect() to
+ * resolve Location headers against the internal origin instead of the public domain.
+ *
+ * Apply this at the TOP of any route handler that uses NextResponse.redirect().
+ *
+ * @param request - The incoming NextRequest
+ * @returns A new NextRequest with corrected URL, or the original if no proxy detected
+ */
+export function rewrite_request_for_proxy(request: NextRequest): NextRequest {
+  try {
+    const request_url = new URL(request.url);
+    const public_origin = detect_public_origin(request_url, request.headers);
+
+    if (!public_origin) {
+      return request; // Not behind a proxy, no rewriting needed
+    }
+
+    // Construct corrected URL: public origin + original path + query
+    const corrected_url = `${public_origin}${request_url.pathname}${request_url.search}`;
+
+    // Create new NextRequest with corrected URL, preserving everything else
+    return new NextRequest(corrected_url, {
+      method: request.method,
+      headers: request.headers,
+      body: request.body,
+    });
+  } catch {
+    return request;
+  }
+}
+
+/**
+ * Gets the public-facing origin for constructing redirect URLs.
+ * Use this when you need the origin string but don't need to rewrite the request.
+ */
+export function get_public_origin(request: NextRequest): string {
+  const request_url = new URL(request.url);
+  return detect_public_origin(request_url, request.headers) || request_url.origin;
+}

package/dist/components/layouts/register/index.d.ts

@@ -1,6 +1,16 @@
 import { type ButtonPaletteOverrides, type LayoutFieldMapOverrides, type LayoutLabelOverrides, type PasswordRequirementOverrides } from "../shared/config/layout_customization.js";
 import { type LayoutDataClient } from "../shared/data/layout_data_client.js";
 import type { StaticImageData } from "next/image";
+export type OAuthLayoutConfig = {
+    /** Enable Google OAuth login */
+    enable_google: boolean;
+    /** Enable traditional email/password login */
+    enable_email_password: boolean;
+    /** Text displayed on the Google sign-in button */
+    google_button_text: string;
+    /** Text displayed on the divider between OAuth and email/password form */
+    oauth_divider_text: string;
+};
 export type RegisterLayoutProps<TClient = unknown> = {
     image_src: string | StaticImageData;
     image_alt: string;
@@ -19,6 +29,8 @@ export type RegisterLayoutProps<TClient = unknown> = {
     signInPath?: string;
     signInLabel?: string;
     urlOnLogon?: string;
+    /** OAuth configuration */
+    oauth?: OAuthLayoutConfig;
 };
-export default function register_layout<TClient>({ image_src, image_alt, image_background_color, field_overrides, labels, button_colors, password_requirements, show_name_field, data_client, alreadyLoggedInMessage, showLogoutButton, showReturnHomeButton, returnHomeButtonLabel, returnHomePath, signInPath, signInLabel, urlOnLogon, }: RegisterLayoutProps<TClient>): import("react/jsx-runtime").JSX.Element;
+export default function register_layout<TClient>({ image_src, image_alt, image_background_color, field_overrides, labels, button_colors, password_requirements, show_name_field, data_client, alreadyLoggedInMessage, showLogoutButton, showReturnHomeButton, returnHomeButtonLabel, returnHomePath, signInPath, signInLabel, urlOnLogon, oauth, }: RegisterLayoutProps<TClient>): import("react/jsx-runtime").JSX.Element;
 //# sourceMappingURL=index.d.ts.map

package/dist/components/layouts/register/index.d.ts.map

@@ -1 +1 @@
-{"version":3,"file":"index.d.ts","sourceRoot":"","sources":["../../../../src/components/layouts/register/index.tsx"],"names":[],"mappings":"AAaA,OAAO,EACL,KAAK,sBAAsB,EAC3B,KAAK,uBAAuB,EAC5B,KAAK,oBAAoB,EACzB,KAAK,4BAA4B,EAClC,MAAM,uCAAuC,CAAC;AAY/C,OAAO,EAAE,KAAK,gBAAgB,EAAE,MAAM,mCAAmC,CAAC;AAC1E,OAAO,KAAK,EAAE,eAAe,EAAE,MAAM,YAAY,CAAC;AAGlD,MAAM,MAAM,mBAAmB,CAAC,OAAO,GAAG,OAAO,IAAI;IACnD,SAAS,EAAE,MAAM,GAAG,eAAe,CAAC;IACpC,SAAS,EAAE,MAAM,CAAC;IAClB,sBAAsB,CAAC,EAAE,MAAM,CAAC;IAChC,eAAe,CAAC,EAAE,uBAAuB,CAAC;IAC1C,MAAM,CAAC,EAAE,oBAAoB,CAAC;IAC9B,aAAa,CAAC,EAAE,sBAAsB,CAAC;IACvC,qBAAqB,CAAC,EAAE,4BAA4B,CAAC;IACrD,eAAe,CAAC,EAAE,OAAO,CAAC;IAC1B,WAAW,EAAE,gBAAgB,CAAC,OAAO,CAAC,CAAC;IACvC,sBAAsB,CAAC,EAAE,MAAM,CAAC;IAChC,gBAAgB,CAAC,EAAE,OAAO,CAAC;IAC3B,oBAAoB,CAAC,EAAE,OAAO,CAAC;IAC/B,qBAAqB,CAAC,EAAE,MAAM,CAAC;IAC/B,cAAc,CAAC,EAAE,MAAM,CAAC;IACxB,UAAU,CAAC,EAAE,MAAM,CAAC;IACpB,WAAW,CAAC,EAAE,MAAM,CAAC;IACrB,UAAU,CAAC,EAAE,MAAM,CAAC;CACrB,CAAC;AAYF,MAAM,CAAC,OAAO,UAAU,eAAe,CAAC,OAAO,EAAE,EAC/C,SAAS,EACT,SAAS,EACT,sBAAkC,EAClC,eAAe,EACf,MAAM,EACN,aAAa,EACb,qBAAqB,EACrB,eAAsB,EACtB,WAAW,EACX,sBAAoD,EACpD,gBAAuB,EACvB,oBAA4B,EAC5B,qBAAqC,EACrC,cAAoB,EACpB,UAA+B,EAC/B,WAAuB,EACvB,UAAU,GACX,EAAE,mBAAmB,CAAC,OAAO,CAAC,2CA+I9B"}
+{"version":3,"file":"index.d.ts","sourceRoot":"","sources":["../../../../src/components/layouts/register/index.tsx"],"names":[],"mappings":"AAiBA,OAAO,EACL,KAAK,sBAAsB,EAC3B,KAAK,uBAAuB,EAC5B,KAAK,oBAAoB,EACzB,KAAK,4BAA4B,EAClC,MAAM,uCAAuC,CAAC;AAY/C,OAAO,EAAE,KAAK,gBAAgB,EAAE,MAAM,mCAAmC,CAAC;AAC1E,OAAO,KAAK,EAAE,eAAe,EAAE,MAAM,YAAY,CAAC;AAGlD,MAAM,MAAM,iBAAiB,GAAG;IAC9B,gCAAgC;IAChC,aAAa,EAAE,OAAO,CAAC;IACvB,8CAA8C;IAC9C,qBAAqB,EAAE,OAAO,CAAC;IAC/B,kDAAkD;IAClD,kBAAkB,EAAE,MAAM,CAAC;IAC3B,0EAA0E;IAC1E,kBAAkB,EAAE,MAAM,CAAC;CAC5B,CAAC;AAEF,MAAM,MAAM,mBAAmB,CAAC,OAAO,GAAG,OAAO,IAAI;IACnD,SAAS,EAAE,MAAM,GAAG,eAAe,CAAC;IACpC,SAAS,EAAE,MAAM,CAAC;IAClB,sBAAsB,CAAC,EAAE,MAAM,CAAC;IAChC,eAAe,CAAC,EAAE,uBAAuB,CAAC;IAC1C,MAAM,CAAC,EAAE,oBAAoB,CAAC;IAC9B,aAAa,CAAC,EAAE,sBAAsB,CAAC;IACvC,qBAAqB,CAAC,EAAE,4BAA4B,CAAC;IACrD,eAAe,CAAC,EAAE,OAAO,CAAC;IAC1B,WAAW,EAAE,gBAAgB,CAAC,OAAO,CAAC,CAAC;IACvC,sBAAsB,CAAC,EAAE,MAAM,CAAC;IAChC,gBAAgB,CAAC,EAAE,OAAO,CAAC;IAC3B,oBAAoB,CAAC,EAAE,OAAO,CAAC;IAC/B,qBAAqB,CAAC,EAAE,MAAM,CAAC;IAC/B,cAAc,CAAC,EAAE,MAAM,CAAC;IACxB,UAAU,CAAC,EAAE,MAAM,CAAC;IACpB,WAAW,CAAC,EAAE,MAAM,CAAC;IACrB,UAAU,CAAC,EAAE,MAAM,CAAC;IACpB,0BAA0B;IAC1B,KAAK,CAAC,EAAE,iBAAiB,CAAC;CAC3B,CAAC;AAYF,MAAM,CAAC,OAAO,UAAU,eAAe,CAAC,OAAO,EAAE,EAC/C,SAAS,EACT,SAAS,EACT,sBAAkC,EAClC,eAAe,EACf,MAAM,EACN,aAAa,EACb,qBAAqB,EACrB,eAAsB,EACtB,WAAW,EACX,sBAAoD,EACpD,gBAAuB,EACvB,oBAA4B,EAC5B,qBAAqC,EACrC,cAAoB,EACpB,UAA+B,EAC/B,WAAuB,EACvB,UAAU,EACV,KAAK,GACN,EAAE,mBAAmB,CAAC,OAAO,CAAC,2CAgN9B"}

package/dist/components/layouts/register/index.js

@@ -4,6 +4,7 @@
 import { jsx as _jsx, jsxs as _jsxs, Fragment as _Fragment } from "react/jsx-runtime";
 // section: imports
 import Link from "next/link";
+import { useSearchParams } from "next/navigation";
 import { Input } from "../../ui/input.js";
 import { PasswordField } from "../shared/components/password_field.js";
 import { FormFieldWrapper } from "../shared/components/form_field_wrapper.js";
@@ -11,6 +12,9 @@ import { FormHeader } from "../shared/components/form_header.js";
 import { FormActionButtons } from "../shared/components/form_action_buttons.js";
 import { TwoColumnAuthLayout } from "../shared/components/two_column_auth_layout.js";
 import { AlreadyLoggedInGuard } from "../shared/components/already_logged_in_guard.js";
+import { GoogleSignInButton } from "../shared/components/google_sign_in_button.js";
+import { OAuthDivider } from "../shared/components/oauth_divider.js";
+import { AlertCircle } from "lucide-react";
 import { REGISTER_FIELD_IDS, createRegisterFieldDefinitions, resolveRegisterButtonPalette, resolveRegisterLabels, resolveRegisterPasswordRequirements, } from "./config/register_field_config.js";
 import { use_register_form, } from "./hooks/use_register_form.js";
 const ORDERED_FIELDS = [
@@ -20,7 +24,29 @@ const ORDERED_FIELDS = [
     REGISTER_FIELD_IDS.CONFIRM_PASSWORD,
 ];
 // section: component
-export default function register_layout({ image_src, image_alt, image_background_color = "#f1f5f9", field_overrides, labels, button_colors, password_requirements, show_name_field = true, data_client, alreadyLoggedInMessage = "You are already logged in", showLogoutButton = true, showReturnHomeButton = false, returnHomeButtonLabel = "Return home", returnHomePath = "/", signInPath = "/hazo_auth/login", signInLabel = "Sign in", urlOnLogon, }) {
+export default function register_layout({ image_src, image_alt, image_background_color = "#f1f5f9", field_overrides, labels, button_colors, password_requirements, show_name_field = true, data_client, alreadyLoggedInMessage = "You are already logged in", showLogoutButton = true, showReturnHomeButton = false, returnHomeButtonLabel = "Return home", returnHomePath = "/", signInPath = "/hazo_auth/login", signInLabel = "Sign in", urlOnLogon, oauth, }) {
+    // Default OAuth config: both enabled
+    const oauthConfig = oauth || {
+        enable_google: true,
+        enable_email_password: true,
+        google_button_text: "Sign up with Google",
+        oauth_divider_text: "or continue with email",
+    };
+    // Read OAuth error from URL query params (e.g., ?error=AccessDenied)
+    const searchParams = useSearchParams();
+    const oauthError = searchParams.get("error");
+    const getOAuthErrorMessage = (error) => {
+        switch (error) {
+            case "AccessDenied":
+                return "Access was denied. You may have cancelled the sign-in or your account is not authorized.";
+            case "OAuthSignin":
+            case "OAuthCallback":
+            case "OAuthCreateAccount":
+                return "Something went wrong with Google sign-in. Please try again.";
+            default:
+                return "An error occurred during sign-in. Please try again.";
+        }
+    };
     const fieldDefinitions = createRegisterFieldDefinitions(field_overrides);
     const resolvedLabels = resolveRegisterLabels(labels);
     const resolvedButtonPalette = resolveRegisterButtonPalette(button_colors);
@@ -54,5 +80,5 @@ export default function register_layout({ image_src, image_alt, image_background
             return (_jsx(FormFieldWrapper, { fieldId: fieldDefinition.id, label: fieldDefinition.label, input: inputElement, errorMessage: shouldShowError }, fieldId));
         });
     };
-    return (_jsx(AlreadyLoggedInGuard, { image_src: image_src, image_alt: image_alt, image_background_color: image_background_color, message: alreadyLoggedInMessage, showLogoutButton: showLogoutButton, showReturnHomeButton: showReturnHomeButton, returnHomeButtonLabel: returnHomeButtonLabel, returnHomePath: returnHomePath, children: _jsx(TwoColumnAuthLayout, { imageSrc: image_src, imageAlt: image_alt, imageBackgroundColor: image_background_color, formContent: _jsxs(_Fragment, { children: [_jsx(FormHeader, { heading: resolvedLabels.heading, subHeading: resolvedLabels.subHeading }), _jsxs("form", { className: "cls_register_layout_form_fields flex flex-col gap-5", onSubmit: form.handleSubmit, "aria-label": "Registration form", children: [renderFields(form), _jsx(FormActionButtons, { submitLabel: resolvedLabels.submitButton, cancelLabel: resolvedLabels.cancelButton, buttonPalette: resolvedButtonPalette, isSubmitDisabled: form.isSubmitDisabled, onCancel: form.handleCancel, submitAriaLabel: "Submit registration form", cancelAriaLabel: "Cancel registration form" }), _jsxs("div", { className: "cls_register_layout_sign_in_link flex items-center justify-center gap-1 text-sm text-muted-foreground", children: [_jsx("span", { children: "Already have an account?" }), _jsx(Link, { href: signInPath, className: "cls_register_layout_sign_in_link_text text-primary underline-offset-4 hover:underline", "aria-label": "Go to sign in page", children: signInLabel })] }), form.isSubmitting && (_jsx("div", { className: "cls_register_submitting_indicator text-sm text-slate-600 text-center", children: "Registering..." }))] })] }) }) }));
+    return (_jsx(AlreadyLoggedInGuard, { image_src: image_src, image_alt: image_alt, image_background_color: image_background_color, message: alreadyLoggedInMessage, showLogoutButton: showLogoutButton, showReturnHomeButton: showReturnHomeButton, returnHomeButtonLabel: returnHomeButtonLabel, returnHomePath: returnHomePath, children: _jsx(TwoColumnAuthLayout, { imageSrc: image_src, imageAlt: image_alt, imageBackgroundColor: image_background_color, formContent: _jsxs(_Fragment, { children: [_jsx(FormHeader, { heading: resolvedLabels.heading, subHeading: resolvedLabels.subHeading }), oauthError && (_jsxs("div", { className: "cls_register_layout_oauth_error flex items-center gap-2 rounded-md border border-red-200 bg-red-50 p-3 text-sm text-red-700", children: [_jsx(AlertCircle, { className: "h-4 w-4 shrink-0", "aria-hidden": "true" }), _jsx("span", { children: getOAuthErrorMessage(oauthError) })] })), oauthConfig.enable_google && (_jsx("div", { className: "cls_register_layout_oauth_section", children: _jsx(GoogleSignInButton, { label: oauthConfig.google_button_text }) })), oauthConfig.enable_google && oauthConfig.enable_email_password && (_jsx(OAuthDivider, { text: oauthConfig.oauth_divider_text })), oauthConfig.enable_email_password && (_jsxs("form", { className: "cls_register_layout_form_fields flex flex-col gap-5", onSubmit: form.handleSubmit, "aria-label": "Registration form", children: [renderFields(form), _jsx(FormActionButtons, { submitLabel: resolvedLabels.submitButton, cancelLabel: resolvedLabels.cancelButton, buttonPalette: resolvedButtonPalette, isSubmitDisabled: form.isSubmitDisabled, onCancel: form.handleCancel, submitAriaLabel: "Submit registration form", cancelAriaLabel: "Cancel registration form" }), _jsxs("div", { className: "cls_register_layout_sign_in_link flex items-center justify-center gap-1 text-sm text-muted-foreground", children: [_jsx("span", { children: "Already have an account?" }), _jsx(Link, { href: signInPath, className: "cls_register_layout_sign_in_link_text text-primary underline-offset-4 hover:underline", "aria-label": "Go to sign in page", children: signInLabel })] }), form.isSubmitting && (_jsx("div", { className: "cls_register_submitting_indicator text-sm text-slate-600 text-center", children: "Registering..." }))] })), !oauthConfig.enable_email_password && oauthConfig.enable_google && (_jsxs("div", { className: "cls_register_layout_sign_in_link mt-4 flex items-center justify-center gap-1 text-sm text-muted-foreground", children: [_jsx("span", { children: "Already have an account?" }), _jsx(Link, { href: signInPath, className: "cls_register_layout_sign_in_link_text text-primary underline-offset-4 hover:underline", "aria-label": "Go to sign in page", children: signInLabel })] }))] }) }) }));
 }

package/dist/components/ui/button.d.ts

@@ -1,7 +1,7 @@
 import * as React from "react";
 import { type VariantProps } from "class-variance-authority";
 declare const buttonVariants: (props?: ({
-    variant?: "link" | "default" | "destructive" | "outline" | "secondary" | "ghost" | null | undefined;
+    variant?: "default" | "destructive" | "outline" | "secondary" | "ghost" | "link" | null | undefined;
     size?: "default" | "sm" | "lg" | "icon" | null | undefined;
 } & import("class-variance-authority/types").ClassProp) | undefined) => string;
 export interface ButtonProps extends React.ButtonHTMLAttributes<HTMLButtonElement>, VariantProps<typeof buttonVariants> {

package/dist/lib/register_config.server.d.ts

@@ -18,6 +18,13 @@ export type RegisterConfig = {
     imageSrc: string;
     imageAlt: string;
     imageBackgroundColor: string;
+    /** OAuth configuration */
+    oauth: {
+        enable_google: boolean;
+        enable_email_password: boolean;
+        google_button_text: string;
+        oauth_divider_text: string;
+    };
 };
 /**
  * Reads register layout configuration from hazo_auth_config.ini file

package/dist/lib/register_config.server.d.ts.map

@@ -1 +1 @@
-{"version":3,"file":"register_config.server.d.ts","sourceRoot":"","sources":["../../src/lib/register_config.server.ts"],"names":[],"mappings":"AAEA,OAAO,aAAa,CAAC;AAcrB,MAAM,MAAM,cAAc,GAAG;IAC3B,aAAa,EAAE,OAAO,CAAC;IACvB,oBAAoB,EAAE;QACpB,cAAc,EAAE,MAAM,CAAC;QACvB,iBAAiB,EAAE,OAAO,CAAC;QAC3B,iBAAiB,EAAE,OAAO,CAAC;QAC3B,cAAc,EAAE,OAAO,CAAC;QACxB,eAAe,EAAE,OAAO,CAAC;KAC1B,CAAC;IACF,sBAAsB,EAAE,MAAM,CAAC;IAC/B,gBAAgB,EAAE,OAAO,CAAC;IAC1B,oBAAoB,EAAE,OAAO,CAAC;IAC9B,qBAAqB,EAAE,MAAM,CAAC;IAC9B,cAAc,EAAE,MAAM,CAAC;IACvB,UAAU,EAAE,MAAM,CAAC;IACnB,WAAW,EAAE,MAAM,CAAC;IACpB,QAAQ,EAAE,MAAM,CAAC;IACjB,QAAQ,EAAE,MAAM,CAAC;IACjB,oBAAoB,EAAE,MAAM,CAAC;CAC9B,CAAC;AAGF;;;;GAIG;AACH,wBAAgB,mBAAmB,IAAI,cAAc,CA8DpD"}
+{"version":3,"file":"register_config.server.d.ts","sourceRoot":"","sources":["../../src/lib/register_config.server.ts"],"names":[],"mappings":"AAEA,OAAO,aAAa,CAAC;AAerB,MAAM,MAAM,cAAc,GAAG;IAC3B,aAAa,EAAE,OAAO,CAAC;IACvB,oBAAoB,EAAE;QACpB,cAAc,EAAE,MAAM,CAAC;QACvB,iBAAiB,EAAE,OAAO,CAAC;QAC3B,iBAAiB,EAAE,OAAO,CAAC;QAC3B,cAAc,EAAE,OAAO,CAAC;QACxB,eAAe,EAAE,OAAO,CAAC;KAC1B,CAAC;IACF,sBAAsB,EAAE,MAAM,CAAC;IAC/B,gBAAgB,EAAE,OAAO,CAAC;IAC1B,oBAAoB,EAAE,OAAO,CAAC;IAC9B,qBAAqB,EAAE,MAAM,CAAC;IAC9B,cAAc,EAAE,MAAM,CAAC;IACvB,UAAU,EAAE,MAAM,CAAC;IACnB,WAAW,EAAE,MAAM,CAAC;IACpB,QAAQ,EAAE,MAAM,CAAC;IACjB,QAAQ,EAAE,MAAM,CAAC;IACjB,oBAAoB,EAAE,MAAM,CAAC;IAC7B,0BAA0B;IAC1B,KAAK,EAAE;QACL,aAAa,EAAE,OAAO,CAAC;QACvB,qBAAqB,EAAE,OAAO,CAAC;QAC/B,kBAAkB,EAAE,MAAM,CAAC;QAC3B,kBAAkB,EAAE,MAAM,CAAC;KAC5B,CAAC;CACH,CAAC;AAGF;;;;GAIG;AACH,wBAAgB,mBAAmB,IAAI,cAAc,CA8EpD"}

package/dist/lib/register_config.server.js

@@ -6,6 +6,7 @@ import { get_config_boolean, get_config_value, read_config_section } from "./con
 import { get_password_requirements_config } from "./password_requirements_config.server.js";
 import { get_already_logged_in_config } from "./already_logged_in_config.server.js";
 import { get_user_fields_config } from "./user_fields_config.server.js";
+import { get_oauth_config } from "./oauth_config.server.js";
 // Default image path - consuming apps should either:
 // 1. Configure their own image_src in hazo_auth_config.ini
 // 2. Copy the default images from node_modules/hazo_auth/public/hazo_auth/images/ to their public folder
@@ -37,6 +38,10 @@ export function get_register_config() {
     const imageSrc = get_config_value("hazo_auth__register_layout", "image_src", DEFAULT_REGISTER_IMAGE_PATH);
     const imageAlt = get_config_value("hazo_auth__register_layout", "image_alt", "Modern building representing user registration");
     const imageBackgroundColor = get_config_value("hazo_auth__register_layout", "image_background_color", "#e2e8f0");
+    // Get OAuth configuration (shared with login)
+    const oauthConfig = get_oauth_config();
+    // For the register page, default button text to "Sign up with Google" unless overridden
+    const registerGoogleButtonText = get_config_value("hazo_auth__oauth", "google_button_text_register", "Sign up with Google");
     return {
         showNameField,
         passwordRequirements,
@@ -50,5 +55,11 @@ export function get_register_config() {
         imageSrc,
         imageAlt,
         imageBackgroundColor,
+        oauth: {
+            enable_google: oauthConfig.enable_google,
+            enable_email_password: oauthConfig.enable_email_password,
+            google_button_text: registerGoogleButtonText,
+            oauth_divider_text: oauthConfig.oauth_divider_text,
+        },
     };
 }

package/dist/lib/utils/proxy_request.d.ts

@@ -0,0 +1,20 @@
+import { NextRequest } from "next/server";
+/**
+ * Rewrites request.url to use the public-facing origin when behind a reverse proxy.
+ *
+ * Behind proxies like Cloudflare Tunnel, Next.js sets request.url to the internal
+ * address (e.g., https://localhost:3000). This causes NextResponse.redirect() to
+ * resolve Location headers against the internal origin instead of the public domain.
+ *
+ * Apply this at the TOP of any route handler that uses NextResponse.redirect().
+ *
+ * @param request - The incoming NextRequest
+ * @returns A new NextRequest with corrected URL, or the original if no proxy detected
+ */
+export declare function rewrite_request_for_proxy(request: NextRequest): NextRequest;
+/**
+ * Gets the public-facing origin for constructing redirect URLs.
+ * Use this when you need the origin string but don't need to rewrite the request.
+ */
+export declare function get_public_origin(request: NextRequest): string;
+//# sourceMappingURL=proxy_request.d.ts.map

package/dist/lib/utils/proxy_request.d.ts.map

@@ -0,0 +1 @@
+{"version":3,"file":"proxy_request.d.ts","sourceRoot":"","sources":["../../../src/lib/utils/proxy_request.ts"],"names":[],"mappings":"AACA,OAAO,EAAE,WAAW,EAAE,MAAM,aAAa,CAAC;AAqC1C;;;;;;;;;;;GAWG;AACH,wBAAgB,yBAAyB,CAAC,OAAO,EAAE,WAAW,GAAG,WAAW,CAqB3E;AAED;;;GAGG;AACH,wBAAgB,iBAAiB,CAAC,OAAO,EAAE,WAAW,GAAG,MAAM,CAG9D"}

package/dist/lib/utils/proxy_request.js

@@ -0,0 +1,74 @@
+// file_description: Shared utility for rewriting request.url behind reverse proxies (Cloudflare Tunnel, nginx, AWS ALB)
+import { NextRequest } from "next/server";
+/**
+ * Detects the public-facing origin from proxy headers.
+ * Returns null if not behind a proxy (origins match).
+ */
+function detect_public_origin(request_url, headers) {
+    // Priority 1: NEXTAUTH_URL env var (explicitly configured)
+    const nextauth_url = process.env.NEXTAUTH_URL;
+    if (nextauth_url) {
+        try {
+            const public_origin = new URL(nextauth_url).origin;
+            if (public_origin !== request_url.origin) {
+                return public_origin;
+            }
+        }
+        catch (_a) {
+            // Invalid NEXTAUTH_URL, fall through
+        }
+    }
+    // Priority 2: x-forwarded-host header (set by Cloudflare Tunnel, nginx, etc.)
+    const forwarded_host = headers.get("x-forwarded-host");
+    if (forwarded_host && forwarded_host !== request_url.hostname) {
+        const proto = headers.get("x-forwarded-proto") || "https";
+        return `${proto}://${forwarded_host}`;
+    }
+    // Priority 3: host header (Cloudflare Tunnel also sets this)
+    const host_header = headers.get("host");
+    if (host_header && host_header !== request_url.host) {
+        const proto = headers.get("x-forwarded-proto") || "https";
+        return `${proto}://${host_header}`;
+    }
+    return null;
+}
+/**
+ * Rewrites request.url to use the public-facing origin when behind a reverse proxy.
+ *
+ * Behind proxies like Cloudflare Tunnel, Next.js sets request.url to the internal
+ * address (e.g., https://localhost:3000). This causes NextResponse.redirect() to
+ * resolve Location headers against the internal origin instead of the public domain.
+ *
+ * Apply this at the TOP of any route handler that uses NextResponse.redirect().
+ *
+ * @param request - The incoming NextRequest
+ * @returns A new NextRequest with corrected URL, or the original if no proxy detected
+ */
+export function rewrite_request_for_proxy(request) {
+    try {
+        const request_url = new URL(request.url);
+        const public_origin = detect_public_origin(request_url, request.headers);
+        if (!public_origin) {
+            return request; // Not behind a proxy, no rewriting needed
+        }
+        // Construct corrected URL: public origin + original path + query
+        const corrected_url = `${public_origin}${request_url.pathname}${request_url.search}`;
+        // Create new NextRequest with corrected URL, preserving everything else
+        return new NextRequest(corrected_url, {
+            method: request.method,
+            headers: request.headers,
+            body: request.body,
+        });
+    }
+    catch (_a) {
+        return request;
+    }
+}
+/**
+ * Gets the public-facing origin for constructing redirect URLs.
+ * Use this when you need the origin string but don't need to rewrite the request.
+ */
+export function get_public_origin(request) {
+    const request_url = new URL(request.url);
+    return detect_public_origin(request_url, request.headers) || request_url.origin;
+}

package/dist/server/routes/nextauth.d.ts.map

@@ -1 +1 @@
-{"version":3,"file":"nextauth.d.ts","sourceRoot":"","sources":["../../../src/server/routes/nextauth.ts"],"names":[],"mappings":"AAQA,KAAK,eAAe,GAAG;IACrB,MAAM,EAAE,OAAO,CAAC;QAAE,QAAQ,EAAE,MAAM,EAAE,CAAA;KAAE,CAAC,CAAC;CACzC,CAAC;AA0DF,wBAAsB,GAAG,CAAC,OAAO,EAAE,OAAO,EAAE,OAAO,EAAE,eAAe,gBAGnE;AAED,wBAAsB,IAAI,CAAC,OAAO,EAAE,OAAO,EAAE,OAAO,EAAE,eAAe,gBAGpE"}
+{"version":3,"file":"nextauth.d.ts","sourceRoot":"","sources":["../../../src/server/routes/nextauth.ts"],"names":[],"mappings":"AAQA,KAAK,eAAe,GAAG;IACrB,MAAM,EAAE,OAAO,CAAC;QAAE,QAAQ,EAAE,MAAM,EAAE,CAAA;KAAE,CAAC,CAAC;CACzC,CAAC;AAyGF,wBAAsB,GAAG,CAAC,OAAO,EAAE,OAAO,EAAE,OAAO,EAAE,eAAe,gBAEnE;AAED,wBAAsB,IAAI,CAAC,OAAO,EAAE,OAAO,EAAE,OAAO,EAAE,eAAe,gBAEpE"}

package/dist/server/routes/nextauth.js

@@ -4,60 +4,106 @@
 import NextAuthImport from "next-auth";
 const NextAuth = NextAuthImport.default || NextAuthImport;
 import { get_nextauth_config } from "../../lib/auth/nextauth_config.js";
-// section: handler
-// Get config lazily to ensure environment variables are available
-function getHandler() {
-    const config = get_nextauth_config();
-    return NextAuth(config);
-}
-// Create handler lazily
-let cachedHandler = null;
-function getOrCreateHandler() {
-    if (!cachedHandler) {
-        cachedHandler = getHandler();
+// section: proxy_detection
+/**
+ * Detects the public-facing origin from request headers.
+ * Cloudflare tunnel sends: x-forwarded-host, x-forwarded-proto, cf-visitor, host
+ */
+function detect_proxy_origin(request) {
+    try {
+        const request_url = new URL(request.url);
+        const forwarded_host = request.headers.get("x-forwarded-host");
+        const host_header = request.headers.get("host");
+        const forwarded_proto = request.headers.get("x-forwarded-proto") || "https";
+        // Debug logging in development
+        if (process.env.NODE_ENV === "development") {
+            console.log("[NextAuth Proxy] request.url:", request.url);
+            console.log("[NextAuth Proxy] request_url.hostname:", request_url.hostname, "request_url.host:", request_url.host);
+            console.log("[NextAuth Proxy] x-forwarded-host:", forwarded_host);
+            console.log("[NextAuth Proxy] host header:", host_header);
+            console.log("[NextAuth Proxy] x-forwarded-proto:", forwarded_proto);
+        }
+        // Check x-forwarded-host first (set by Cloudflare tunnel, nginx, etc.)
+        if (forwarded_host && forwarded_host !== request_url.hostname) {
+            const origin = `${forwarded_proto}://${forwarded_host}`;
+            if (process.env.NODE_ENV === "development") {
+                console.log("[NextAuth Proxy] Detected proxy via x-forwarded-host:", origin);
+            }
+            return origin;
+        }
+        // Check host header (Cloudflare tunnel also sets this to the tunnel domain)
+        if (host_header && host_header !== request_url.host) {
+            const origin = `${forwarded_proto}://${host_header}`;
+            if (process.env.NODE_ENV === "development") {
+                console.log("[NextAuth Proxy] Detected proxy via host header:", origin);
+            }
+            return origin;
+        }
+        if (process.env.NODE_ENV === "development") {
+            console.log("[NextAuth Proxy] No proxy detected");
+        }
     }
-    return cachedHandler;
+    catch (e) {
+        console.error("[NextAuth Proxy] Error:", e);
+    }
+    return null;
 }
-// section: url_rewriting
+// section: handler
 /**
- * Rewrites request.url to use the public-facing origin when behind a reverse proxy.
- * NextAuth uses request.url to construct the OAuth redirect_uri parameter.
- * Without this, redirect_uri points to the internal address (e.g. https://localhost:3000),
- * which is unreachable from the user's browser.
+ * Handles NextAuth requests with proxy/tunnel support.
+ *
+ * When behind a proxy (Cloudflare tunnel, nginx, etc.), temporarily sets
+ * NEXTAUTH_URL to the proxy origin so next-auth uses the correct baseUrl
+ * for cookies, CSRF, and OAuth callback URLs.
+ *
+ * IMPORTANT: NEXTAUTH_URL must remain overridden for the entire duration of
+ * the handler execution, because next-auth reads it lazily during request
+ * processing (not just at handler creation time). We restore it after the
+ * handler completes.
  */
-function rewrite_request_for_proxy(request) {
-    const nextauth_url = process.env.NEXTAUTH_URL;
-    if (!nextauth_url) {
-        return request;
+async function handle_request(request, context) {
+    const proxy_origin = detect_proxy_origin(request);
+    const original_nextauth_url = process.env.NEXTAUTH_URL;
+    // If behind a proxy, override NEXTAUTH_URL for the entire request lifecycle
+    if (proxy_origin) {
+        let auth_path = "/api/auth";
+        if (original_nextauth_url) {
+            try {
+                const parsed = new URL(original_nextauth_url);
+                auth_path = parsed.pathname;
+            }
+            catch (_a) {
+                // ignore
+            }
+        }
+        process.env.NEXTAUTH_URL = `${proxy_origin}${auth_path}`;
     }
     try {
-        const public_origin = nextauth_url.replace(/\/$/, "");
-        const request_url = new URL(request.url);
-        // If origins already match, no rewriting needed (direct dev mode)
-        if (request_url.origin === public_origin) {
-            return request;
-        }
-        // Construct the corrected URL: public origin + original path + query
-        const corrected_url = `${public_origin}${request_url.pathname}${request_url.search}`;
-        // Create a new Request with the corrected URL, preserving everything else
-        return new Request(corrected_url, {
-            method: request.method,
-            headers: request.headers,
-            body: request.body,
-            // @ts-expect-error - duplex is required for streaming bodies in Node.js
-            duplex: "half",
-        });
+        const config = get_nextauth_config();
+        const handler = NextAuth(config);
+        // Next.js 16 passes params as a Promise, but next-auth v4 expects it resolved
+        const resolved_params = await context.params;
+        const resolved_context = { params: resolved_params };
+        // Await the handler response before restoring NEXTAUTH_URL
+        const response = await handler(request, resolved_context);
+        return response;
     }
-    catch (_a) {
-        return request;
+    finally {
+        // Restore original NEXTAUTH_URL after handler completes
+        if (proxy_origin) {
+            if (original_nextauth_url) {
+                process.env.NEXTAUTH_URL = original_nextauth_url;
+            }
+            else {
+                delete process.env.NEXTAUTH_URL;
+            }
+        }
     }
 }
 // section: exports
 export async function GET(request, context) {
-    const handler = getOrCreateHandler();
-    return handler(rewrite_request_for_proxy(request), context);
+    return handle_request(request, context);
 }
 export async function POST(request, context) {
-    const handler = getOrCreateHandler();
-    return handler(rewrite_request_for_proxy(request), context);
+    return handle_request(request, context);
 }

package/dist/server/routes/oauth_google_callback.d.ts

@@ -4,5 +4,5 @@ import { NextRequest, NextResponse } from "next/server";
  * The user creation/linking is done in NextAuth signIn callback
  * This route just sets the hazo_auth session cookies
  */
-export declare function GET(request: NextRequest): Promise<NextResponse<unknown>>;
+export declare function GET(original_request: NextRequest): Promise<NextResponse<unknown>>;
 //# sourceMappingURL=oauth_google_callback.d.ts.map

package/dist/server/routes/oauth_google_callback.d.ts.map

@@ -1 +1 @@
-{"version":3,"file":"oauth_google_callback.d.ts","sourceRoot":"","sources":["../../../src/server/routes/oauth_google_callback.ts"],"names":[],"mappings":"AAEA,OAAO,EAAE,WAAW,EAAE,YAAY,EAAE,MAAM,aAAa,CAAC;AAwBxD;;;;GAIG;AACH,wBAAsB,GAAG,CAAC,OAAO,EAAE,WAAW,kCAgJ7C"}
+{"version":3,"file":"oauth_google_callback.d.ts","sourceRoot":"","sources":["../../../src/server/routes/oauth_google_callback.ts"],"names":[],"mappings":"AAEA,OAAO,EAAE,WAAW,EAAE,YAAY,EAAE,MAAM,aAAa,CAAC;AAwBxD;;;;GAIG;AACH,wBAAsB,GAAG,CAAC,gBAAgB,EAAE,WAAW,kCA6JtD"}

package/dist/server/routes/oauth_google_callback.js

@@ -10,18 +10,28 @@ import { get_cookie_name, get_cookie_options, BASE_COOKIE_NAMES } from "../../li
 import { get_hazo_connect_instance } from "../../lib/hazo_connect_instance.server.js";
 import { get_post_login_redirect } from "../../lib/services/post_verification_service.js";
 import { get_oauth_config } from "../../lib/oauth_config.server.js";
-import { create_redirect_url } from "../../lib/utils/get_origin_url.js";
+import { rewrite_request_for_proxy } from "../../lib/utils/proxy_request.js";
 // section: api_handler
 /**
  * Handles the OAuth callback after Google sign-in
  * The user creation/linking is done in NextAuth signIn callback
  * This route just sets the hazo_auth session cookies
  */
-export async function GET(request) {
+export async function GET(original_request) {
+    // Rewrite request.url to public origin when behind a reverse proxy.
+    // This ensures all NextResponse.redirect() calls produce correct Location headers.
+    const request = rewrite_request_for_proxy(original_request);
     const logger = create_app_logger();
+    // Detect if request came through HTTPS proxy (Cloudflare tunnel, etc.)
+    const is_secure = original_request.headers.get("x-forwarded-proto") === "https" ||
+        request.url.startsWith("https://");
     try {
         // Get the NextAuth token from the session
-        const token = (await getToken({ req: request }));
+        // When behind HTTPS proxy, next-auth uses __Secure- cookie prefix
+        const token = (await getToken({
+            req: request,
+            secureCookie: is_secure,
+        }));
         logger.debug("google_callback_token_received", {
             filename: get_filename(),
             line_number: get_line_number(),
@@ -37,7 +47,7 @@ export async function GET(request) {
                 note: "No NextAuth token found - user may not have completed Google sign-in",
             });
             // Redirect to login with error — use .toString() to ensure absolute URL
-            const login_url = create_redirect_url("/hazo_auth/login", request.url);
+            const login_url = new URL("/hazo_auth/login", request.url);
             login_url.searchParams.set("error", "oauth_failed");
             return NextResponse.redirect(login_url.toString());
         }
@@ -50,7 +60,7 @@ export async function GET(request) {
                 has_hazo_user_id: !!token.hazo_user_id,
                 has_google_id: !!token.google_id,
             });
-            const login_url = create_redirect_url("/hazo_auth/login", request.url);
+            const login_url = new URL("/hazo_auth/login", request.url);
             login_url.searchParams.set("error", "oauth_incomplete");
             return NextResponse.redirect(login_url.toString());
         }
@@ -94,12 +104,13 @@ export async function GET(request) {
             invitation_table_error,
         });
         // Create redirect response — use .toString() to ensure absolute public-facing URL
-        const redirect_url = create_redirect_url(determined_redirect, request.url);
+        const redirect_url = new URL(determined_redirect, request.url);
         const response = NextResponse.redirect(redirect_url.toString());
         // Set authentication cookies (same as login route, with configurable prefix and domain)
+        // secure=true when in production OR when accessed via HTTPS proxy (Cloudflare tunnel, etc.)
         const base_cookie_options = {
             httpOnly: true,
-            secure: process.env.NODE_ENV === "production",
+            secure: process.env.NODE_ENV === "production" || is_secure,
             sameSite: "lax",
             path: "/",
             maxAge: 60 * 60 * 24 * 30, // 30 days
@@ -134,7 +145,7 @@ export async function GET(request) {
             error_message,
             error_stack,
         });
-        const login_url = create_redirect_url("/hazo_auth/login", request.url);
+        const login_url = new URL("/hazo_auth/login", request.url);
         login_url.searchParams.set("error", "oauth_error");
         return NextResponse.redirect(login_url.toString());
     }

package/dist/server_pages/register.d.ts.map

@@ -1 +1 @@
-{"version":3,"file":"register.d.ts","sourceRoot":"","sources":["../../src/server_pages/register.tsx"],"names":[],"mappings":"AAEA,OAAO,aAAa,CAAC;AAOrB,OAAO,KAAK,EAAE,eAAe,EAAE,MAAM,YAAY,CAAC;AAElD,MAAM,MAAM,iBAAiB,GAAG;IAC9B;;;OAGG;IACH,SAAS,CAAC,EAAE,MAAM,GAAG,eAAe,CAAC;IAErC;;;OAGG;IACH,SAAS,CAAC,EAAE,MAAM,CAAC;IAEnB;;;OAGG;IACH,sBAAsB,CAAC,EAAE,MAAM,CAAC;CACjC,CAAC;AAIF;;;;;;;;;;;;;;;;;;;;;;;;GAwBG;AACH,MAAM,CAAC,OAAO,UAAU,YAAY,CAAC,EACnC,SAAS,EACT,SAAS,EACT,sBAAsB,GACvB,GAAE,iBAAsB,2CA4BxB;AAGD,OAAO,EAAE,YAAY,EAAE,CAAC"}
+{"version":3,"file":"register.d.ts","sourceRoot":"","sources":["../../src/server_pages/register.tsx"],"names":[],"mappings":"AAEA,OAAO,aAAa,CAAC;AAOrB,OAAO,KAAK,EAAE,eAAe,EAAE,MAAM,YAAY,CAAC;AAElD,MAAM,MAAM,iBAAiB,GAAG;IAC9B;;;OAGG;IACH,SAAS,CAAC,EAAE,MAAM,GAAG,eAAe,CAAC;IAErC;;;OAGG;IACH,SAAS,CAAC,EAAE,MAAM,CAAC;IAEnB;;;OAGG;IACH,sBAAsB,CAAC,EAAE,MAAM,CAAC;CACjC,CAAC;AAIF;;;;;;;;;;;;;;;;;;;;;;;;GAwBG;AACH,MAAM,CAAC,OAAO,UAAU,YAAY,CAAC,EACnC,SAAS,EACT,SAAS,EACT,sBAAsB,GACvB,GAAE,iBAAsB,2CAkCxB;AAGD,OAAO,EAAE,YAAY,EAAE,CAAC"}

package/dist/server_pages/register.js

@@ -40,7 +40,12 @@ export default function RegisterPage({ image_src, image_alt, image_background_co
     const finalImageAlt = image_alt || config.imageAlt;
     const finalImageBackgroundColor = image_background_color || config.imageBackgroundColor;
     // Pass serializable config to client wrapper, wrapped in AuthPageShell for navbar support
-    return (_jsx(AuthPageShell, { children: _jsx(RegisterClientWrapper, { image_src: finalImageSrc, image_alt: finalImageAlt, image_background_color: finalImageBackgroundColor, showNameField: config.showNameField, passwordRequirements: config.passwordRequirements, alreadyLoggedInMessage: config.alreadyLoggedInMessage, showLogoutButton: config.showLogoutButton, showReturnHomeButton: config.showReturnHomeButton, returnHomeButtonLabel: config.returnHomeButtonLabel, returnHomePath: config.returnHomePath, signInPath: config.signInPath, signInLabel: config.signInLabel }) }));
+    return (_jsx(AuthPageShell, { children: _jsx(RegisterClientWrapper, { image_src: finalImageSrc, image_alt: finalImageAlt, image_background_color: finalImageBackgroundColor, showNameField: config.showNameField, passwordRequirements: config.passwordRequirements, alreadyLoggedInMessage: config.alreadyLoggedInMessage, showLogoutButton: config.showLogoutButton, showReturnHomeButton: config.showReturnHomeButton, returnHomeButtonLabel: config.returnHomeButtonLabel, returnHomePath: config.returnHomePath, signInPath: config.signInPath, signInLabel: config.signInLabel, oauth: {
+                enable_google: config.oauth.enable_google,
+                enable_email_password: config.oauth.enable_email_password,
+                google_button_text: config.oauth.google_button_text,
+                oauth_divider_text: config.oauth.oauth_divider_text,
+            } }) }));
 }
 // Named export for direct imports
 export { RegisterPage };

package/dist/server_pages/register_client_wrapper.d.ts

@@ -1,13 +1,16 @@
 import type { RegisterConfig } from "../lib/register_config.server";
+import type { OAuthLayoutConfig } from "../components/layouts/register/index";
 import type { StaticImageData } from "next/image";
-export type RegisterClientWrapperProps = Omit<RegisterConfig, 'imageSrc' | 'imageAlt' | 'imageBackgroundColor'> & {
+export type RegisterClientWrapperProps = Omit<RegisterConfig, 'imageSrc' | 'imageAlt' | 'imageBackgroundColor' | 'oauth'> & {
     image_src: string | StaticImageData;
     image_alt: string;
     image_background_color: string;
+    /** OAuth configuration */
+    oauth?: OAuthLayoutConfig;
 };
 /**
  * Client wrapper for RegisterLayout
  * Initializes hazo_connect data client on client side and passes config from server
  */
-export declare function RegisterClientWrapper({ image_src, image_alt, image_background_color, showNameField, passwordRequirements, alreadyLoggedInMessage, showLogoutButton, showReturnHomeButton, returnHomeButtonLabel, returnHomePath, signInPath, signInLabel, }: RegisterClientWrapperProps): import("react/jsx-runtime").JSX.Element;
+export declare function RegisterClientWrapper({ image_src, image_alt, image_background_color, showNameField, passwordRequirements, alreadyLoggedInMessage, showLogoutButton, showReturnHomeButton, returnHomeButtonLabel, returnHomePath, signInPath, signInLabel, oauth, }: RegisterClientWrapperProps): import("react/jsx-runtime").JSX.Element;
 //# sourceMappingURL=register_client_wrapper.d.ts.map

package/dist/server_pages/register_client_wrapper.d.ts.map

@@ -1 +1 @@
-{"version":3,"file":"register_client_wrapper.d.ts","sourceRoot":"","sources":["../../src/server_pages/register_client_wrapper.tsx"],"names":[],"mappings":"AASA,OAAO,KAAK,EAAE,cAAc,EAAE,MAAM,+BAA+B,CAAC;AAGpE,OAAO,KAAK,EAAE,eAAe,EAAE,MAAM,YAAY,CAAC;AAElD,MAAM,MAAM,0BAA0B,GAAG,IAAI,CAAC,cAAc,EAAE,UAAU,GAAG,UAAU,GAAG,sBAAsB,CAAC,GAAG;IAChH,SAAS,EAAE,MAAM,GAAG,eAAe,CAAC;IACpC,SAAS,EAAE,MAAM,CAAC;IAClB,sBAAsB,EAAE,MAAM,CAAC;CAChC,CAAC;AAGF;;;GAGG;AACH,wBAAgB,qBAAqB,CAAC,EACpC,SAAS,EACT,SAAS,EACT,sBAAsB,EACtB,aAAa,EACb,oBAAoB,EACpB,sBAAsB,EACtB,gBAAgB,EAChB,oBAAoB,EACpB,qBAAqB,EACrB,cAAc,EACd,UAAU,EACV,WAAW,GACZ,EAAE,0BAA0B,2CAqC5B"}
+{"version":3,"file":"register_client_wrapper.d.ts","sourceRoot":"","sources":["../../src/server_pages/register_client_wrapper.tsx"],"names":[],"mappings":"AASA,OAAO,KAAK,EAAE,cAAc,EAAE,MAAM,+BAA+B,CAAC;AACpE,OAAO,KAAK,EAAE,iBAAiB,EAAE,MAAM,sCAAsC,CAAC;AAG9E,OAAO,KAAK,EAAE,eAAe,EAAE,MAAM,YAAY,CAAC;AAElD,MAAM,MAAM,0BAA0B,GAAG,IAAI,CAAC,cAAc,EAAE,UAAU,GAAG,UAAU,GAAG,sBAAsB,GAAG,OAAO,CAAC,GAAG;IAC1H,SAAS,EAAE,MAAM,GAAG,eAAe,CAAC;IACpC,SAAS,EAAE,MAAM,CAAC;IAClB,sBAAsB,EAAE,MAAM,CAAC;IAC/B,0BAA0B;IAC1B,KAAK,CAAC,EAAE,iBAAiB,CAAC;CAC3B,CAAC;AAGF;;;GAGG;AACH,wBAAgB,qBAAqB,CAAC,EACpC,SAAS,EACT,SAAS,EACT,sBAAsB,EACtB,aAAa,EACb,oBAAoB,EACpB,sBAAsB,EACtB,gBAAgB,EAChB,oBAAoB,EACpB,qBAAqB,EACrB,cAAc,EACd,UAAU,EACV,WAAW,EACX,KAAK,GACN,EAAE,0BAA0B,2CAsC5B"}

package/dist/server_pages/register_client_wrapper.js

@@ -11,7 +11,7 @@ import { create_sqlite_hazo_connect } from "../lib/hazo_connect_setup.js";
  * Client wrapper for RegisterLayout
  * Initializes hazo_connect data client on client side and passes config from server
  */
-export function RegisterClientWrapper({ image_src, image_alt, image_background_color, showNameField, passwordRequirements, alreadyLoggedInMessage, showLogoutButton, showReturnHomeButton, returnHomeButtonLabel, returnHomePath, signInPath, signInLabel, }) {
+export function RegisterClientWrapper({ image_src, image_alt, image_background_color, showNameField, passwordRequirements, alreadyLoggedInMessage, showLogoutButton, showReturnHomeButton, returnHomeButtonLabel, returnHomePath, signInPath, signInLabel, oauth, }) {
     const [dataClient, setDataClient] = useState(null);
     useEffect(() => {
         // Initialize hazo_connect on client side
@@ -23,5 +23,5 @@ export function RegisterClientWrapper({ image_src, image_alt, image_background_c
     if (!dataClient) {
         return (_jsx("div", { className: "cls_register_page_loading flex items-center justify-center min-h-screen", children: _jsx("div", { className: "text-slate-600 animate-pulse", children: "Loading..." }) }));
     }
-    return (_jsx(RegisterLayout, { image_src: image_src, image_alt: image_alt, image_background_color: image_background_color, data_client: dataClient, show_name_field: showNameField, password_requirements: passwordRequirements, alreadyLoggedInMessage: alreadyLoggedInMessage, showLogoutButton: showLogoutButton, showReturnHomeButton: showReturnHomeButton, returnHomeButtonLabel: returnHomeButtonLabel, returnHomePath: returnHomePath, signInPath: signInPath, signInLabel: signInLabel }));
+    return (_jsx(RegisterLayout, { image_src: image_src, image_alt: image_alt, image_background_color: image_background_color, data_client: dataClient, show_name_field: showNameField, password_requirements: passwordRequirements, alreadyLoggedInMessage: alreadyLoggedInMessage, showLogoutButton: showLogoutButton, showReturnHomeButton: showReturnHomeButton, returnHomeButtonLabel: returnHomeButtonLabel, returnHomePath: returnHomePath, signInPath: signInPath, signInLabel: signInLabel, oauth: oauth }));
 }

package/package.json

@@ -1,6 +1,6 @@
 {
   "name": "hazo_auth",
-  "version": "5.1.33",
+  "version": "5.1.35",
   "description": "Zero-config authentication UI components for Next.js with RBAC, OAuth, scope-based multi-tenancy, and invitations",
   "keywords": [
     "authentication",
@@ -188,7 +188,7 @@
   "scripts": {
     "dev": "next dev",
     "build": "next build",
-    "build:pkg": "tsc -p tsconfig.build.json && tsx scripts/copy_assets.ts",
+    "build:pkg": "tsc --jsx react-jsx --skipLibCheck -p tsconfig.build.json && tsx scripts/copy_assets.ts",
     "prepublishOnly": "npm run build:pkg",
     "validate": "tsx scripts/validate_setup.ts",
     "generate-routes": "tsx scripts/generate_routes.ts",

package/dist/lib/index.d.ts

@@ -1,32 +0,0 @@
-export * from "./auth/index.js";
-export * from "./services/index.js";
-export { cn, merge_class_names } from "./utils.js";
-export { get_config_value, get_config_number, get_config_boolean, get_config_array, read_config_section } from "./config/config_loader.server.js";
-export { create_sqlite_hazo_connect } from "./hazo_connect_setup.js";
-export { get_hazo_connect_instance } from "./hazo_connect_instance.server.js";
-export { create_app_logger } from "./app_logger.js";
-export { get_login_config } from "./login_config.server.js";
-export { get_register_config } from "./register_config.server.js";
-export { get_forgot_password_config } from "./forgot_password_config.server.js";
-export { get_reset_password_config } from "./reset_password_config.server.js";
-export { get_email_verification_config } from "./email_verification_config.server.js";
-export { get_my_settings_config } from "./my_settings_config.server.js";
-export { get_user_management_config } from "./user_management_config.server.js";
-export { get_profile_picture_config } from "./profile_picture_config.server.js";
-export { get_profile_pic_menu_config } from "./profile_pic_menu_config.server.js";
-export { get_already_logged_in_config } from "./already_logged_in_config.server.js";
-export { get_ui_shell_config } from "./ui_shell_config.server.js";
-export { get_ui_sizes_config } from "./ui_sizes_config.server.js";
-export { get_auth_utility_config } from "./auth_utility_config.server.js";
-export { get_password_requirements_config } from "./password_requirements_config.server.js";
-export { get_messages_config } from "./messages_config.server.js";
-export { get_user_fields_config } from "./user_fields_config.server.js";
-export { get_file_types_config } from "./file_types_config.server.js";
-export { get_oauth_config, is_google_oauth_enabled, is_email_password_enabled } from "./oauth_config.server.js";
-export type { OAuthConfig } from "./oauth_config.server";
-export { get_branding_config, is_branding_enabled, is_allowed_logo_format, get_max_logo_size_bytes } from "./branding_config.server.js";
-export type { FirmBrandingConfig } from "./branding_config.server";
-export { sanitize_error_for_user } from "./utils/error_sanitizer.js";
-export type { ErrorSanitizationOptions } from "./utils/error_sanitizer";
-export * from "./utils/api_route_helpers.js";
-//# sourceMappingURL=index.d.ts.map

package/dist/lib/index.d.ts.map

@@ -1 +0,0 @@
-{"version":3,"file":"index.d.ts","sourceRoot":"","sources":["../../src/lib/index.ts"],"names":[],"mappings":"AAEA,cAAc,cAAc,CAAC;AAG7B,cAAc,kBAAkB,CAAC;AAGjC,OAAO,EAAE,EAAE,EAAE,iBAAiB,EAAE,MAAM,SAAS,CAAC;AAGhD,OAAO,EAAE,gBAAgB,EAAE,iBAAiB,EAAE,kBAAkB,EAAE,gBAAgB,EAAE,mBAAmB,EAAE,MAAM,+BAA+B,CAAC;AAG/I,OAAO,EAAE,0BAA0B,EAAE,MAAM,sBAAsB,CAAC;AAClE,OAAO,EAAE,yBAAyB,EAAE,MAAM,gCAAgC,CAAC;AAG3E,OAAO,EAAE,iBAAiB,EAAE,MAAM,cAAc,CAAC;AAGjD,OAAO,EAAE,gBAAgB,EAAE,MAAM,uBAAuB,CAAC;AACzD,OAAO,EAAE,mBAAmB,EAAE,MAAM,0BAA0B,CAAC;AAC/D,OAAO,EAAE,0BAA0B,EAAE,MAAM,iCAAiC,CAAC;AAC7E,OAAO,EAAE,yBAAyB,EAAE,MAAM,gCAAgC,CAAC;AAC3E,OAAO,EAAE,6BAA6B,EAAE,MAAM,oCAAoC,CAAC;AACnF,OAAO,EAAE,sBAAsB,EAAE,MAAM,6BAA6B,CAAC;AACrE,OAAO,EAAE,0BAA0B,EAAE,MAAM,iCAAiC,CAAC;AAC7E,OAAO,EAAE,0BAA0B,EAAE,MAAM,iCAAiC,CAAC;AAC7E,OAAO,EAAE,2BAA2B,EAAE,MAAM,kCAAkC,CAAC;AAC/E,OAAO,EAAE,4BAA4B,EAAE,MAAM,mCAAmC,CAAC;AACjF,OAAO,EAAE,mBAAmB,EAAE,MAAM,0BAA0B,CAAC;AAC/D,OAAO,EAAE,mBAAmB,EAAE,MAAM,0BAA0B,CAAC;AAC/D,OAAO,EAAE,uBAAuB,EAAE,MAAM,8BAA8B,CAAC;AACvE,OAAO,EAAE,gCAAgC,EAAE,MAAM,uCAAuC,CAAC;AACzF,OAAO,EAAE,mBAAmB,EAAE,MAAM,0BAA0B,CAAC;AAC/D,OAAO,EAAE,sBAAsB,EAAE,MAAM,6BAA6B,CAAC;AACrE,OAAO,EAAE,qBAAqB,EAAE,MAAM,4BAA4B,CAAC;AACnE,OAAO,EAAE,gBAAgB,EAAE,uBAAuB,EAAE,yBAAyB,EAAE,MAAM,uBAAuB,CAAC;AAC7G,YAAY,EAAE,WAAW,EAAE,MAAM,uBAAuB,CAAC;AACzD,OAAO,EAAE,mBAAmB,EAAE,mBAAmB,EAAE,sBAAsB,EAAE,uBAAuB,EAAE,MAAM,0BAA0B,CAAC;AACrI,YAAY,EAAE,kBAAkB,EAAE,MAAM,0BAA0B,CAAC;AAGnE,OAAO,EAAE,uBAAuB,EAAE,MAAM,yBAAyB,CAAC;AAClE,YAAY,EAAE,wBAAwB,EAAE,MAAM,yBAAyB,CAAC;AACxE,cAAc,2BAA2B,CAAC"}

package/dist/lib/index.js

@@ -1,37 +0,0 @@
-// file_description: barrel export for lib utilities
-// section: auth_exports
-export * from "./auth/index.js";
-// section: service_exports
-export * from "./services/index.js";
-// section: utility_exports
-export { cn, merge_class_names } from "./utils.js";
-// section: config_exports
-export { get_config_value, get_config_number, get_config_boolean, get_config_array, read_config_section } from "./config/config_loader.server.js";
-// section: hazo_connect_exports
-export { create_sqlite_hazo_connect } from "./hazo_connect_setup.js";
-export { get_hazo_connect_instance } from "./hazo_connect_instance.server.js";
-// section: logger_exports
-export { create_app_logger } from "./app_logger.js";
-// section: config_server_exports
-export { get_login_config } from "./login_config.server.js";
-export { get_register_config } from "./register_config.server.js";
-export { get_forgot_password_config } from "./forgot_password_config.server.js";
-export { get_reset_password_config } from "./reset_password_config.server.js";
-export { get_email_verification_config } from "./email_verification_config.server.js";
-export { get_my_settings_config } from "./my_settings_config.server.js";
-export { get_user_management_config } from "./user_management_config.server.js";
-export { get_profile_picture_config } from "./profile_picture_config.server.js";
-export { get_profile_pic_menu_config } from "./profile_pic_menu_config.server.js";
-export { get_already_logged_in_config } from "./already_logged_in_config.server.js";
-export { get_ui_shell_config } from "./ui_shell_config.server.js";
-export { get_ui_sizes_config } from "./ui_sizes_config.server.js";
-export { get_auth_utility_config } from "./auth_utility_config.server.js";
-export { get_password_requirements_config } from "./password_requirements_config.server.js";
-export { get_messages_config } from "./messages_config.server.js";
-export { get_user_fields_config } from "./user_fields_config.server.js";
-export { get_file_types_config } from "./file_types_config.server.js";
-export { get_oauth_config, is_google_oauth_enabled, is_email_password_enabled } from "./oauth_config.server.js";
-export { get_branding_config, is_branding_enabled, is_allowed_logo_format, get_max_logo_size_bytes } from "./branding_config.server.js";
-// section: util_exports
-export { sanitize_error_for_user } from "./utils/error_sanitizer.js";
-export * from "./utils/api_route_helpers.js";