najm-auth 1.1.44 → 2.0.2

package/dist/{NajmAuthClient-D08--i69.d.ts → NajmAuthClient-B9dGk9MH.d.ts}

@@ -77,6 +77,11 @@ interface AuthClientConfig {
     /** Request timeout in milliseconds (default: 30000) */
     timeout?: number;
 }
+type OAuthProvider = 'google';
+interface OAuthLoginOptions {
+    /** Same-origin frontend path after OAuth completes. */
+    returnTo?: string;
+}
 /**
  * Auth event types
  */
@@ -182,6 +187,11 @@ declare class NajmAuthClient {
         password: string;
     }): Promise<AuthUser>;
     register(data: Record<string, unknown>): Promise<AuthUser>;
+    getOAuthLoginUrl(provider: OAuthProvider, options?: OAuthLoginOptions): string;
+    loginWithOAuth(provider: OAuthProvider, options?: OAuthLoginOptions): void;
+    loginWithGoogle(options?: OAuthLoginOptions): void;
+    linkOAuthAccount(provider: OAuthProvider, options?: OAuthLoginOptions): Promise<void>;
+    completeOAuthLogin(): Promise<AuthUser>;
     logout(): Promise<void>;
     refresh(): Promise<void>;
     fetchUser(): Promise<AuthUser | null>;
@@ -230,10 +240,11 @@ declare class NajmAuthClient {
     private handleTabMessage;
     private notify;
     private emit;
+    private validateReturnTo;
 }
 /**
  * Factory function to create an auth client.
  */
 declare function createAuthClient(config: AuthClientConfig): NajmAuthClient;
 
-export { AuthError as A, type DecodedToken as D, FetchClient as F, type HydrateSession as H, NajmAuthClient as N, type RetryConfig as R, type SyncPayload as S, type TabSyncMessage as T, type AuthClientConfig as a, type AuthEventMap as b, createAuthClient as c, type AuthState as d, type AuthUser as e, type AuthEvent as f, type AuthEventHandler as g, type ServerResponse as h, type TokenPair as i, type RequestOptions as j };
+export { AuthError as A, type DecodedToken as D, FetchClient as F, type HydrateSession as H, NajmAuthClient as N, type OAuthProvider as O, type RetryConfig as R, type SyncPayload as S, type TabSyncMessage as T, type AuthClientConfig as a, type AuthEventMap as b, createAuthClient as c, type AuthState as d, type AuthUser as e, type AuthEvent as f, type AuthEventHandler as g, type ServerResponse as h, type TokenPair as i, type RequestOptions as j, type OAuthLoginOptions as k };

package/dist/client/index.d.ts

@@ -1,5 +1,5 @@
-import { D as DecodedToken, T as TabSyncMessage, S as SyncPayload } from '../NajmAuthClient-D08--i69.js';
-export { a as AuthClientConfig, A as AuthError, f as AuthEvent, g as AuthEventHandler, b as AuthEventMap, d as AuthState, e as AuthUser, F as FetchClient, H as HydrateSession, N as NajmAuthClient, j as RequestOptions, R as RetryConfig, h as ServerResponse, i as TokenPair, c as createAuthClient } from '../NajmAuthClient-D08--i69.js';
+import { D as DecodedToken, T as TabSyncMessage, S as SyncPayload } from '../NajmAuthClient-B9dGk9MH.js';
+export { a as AuthClientConfig, A as AuthError, f as AuthEvent, g as AuthEventHandler, b as AuthEventMap, d as AuthState, e as AuthUser, F as FetchClient, H as HydrateSession, N as NajmAuthClient, k as OAuthLoginOptions, O as OAuthProvider, j as RequestOptions, R as RetryConfig, h as ServerResponse, i as TokenPair, c as createAuthClient } from '../NajmAuthClient-B9dGk9MH.js';
 
 /**
  * Decode a JWT token payload without verification.

package/dist/client/index.js

@@ -138,7 +138,7 @@ function decodeToken(token) {
 }
 __name(decodeToken, "decodeToken");
 function isTokenExpired(decoded) {
-  if (!decoded.exp) return false;
+  if (!decoded.exp) return true;
   return Date.now() / 1e3 >= decoded.exp;
 }
 __name(isTokenExpired, "isTokenExpired");
@@ -264,6 +264,43 @@ var NajmAuthClient = class _NajmAuthClient {
     );
     return res.data;
   }
+  getOAuthLoginUrl(provider, options = {}) {
+    const baseURL = this.config.baseURL.replace(/\/$/, "");
+    const authPrefix = this.prefix.startsWith("/") ? this.prefix : `/${this.prefix}`;
+    const raw = `${baseURL}${authPrefix}/oauth/${provider}/start`;
+    const absolute = /^[a-z][a-z\d+.-]*:\/\//i.test(raw);
+    const url = new URL(raw, absolute ? void 0 : "https://najm.invalid");
+    if (options.returnTo) {
+      url.searchParams.set("returnTo", this.validateReturnTo(options.returnTo));
+    }
+    return absolute ? url.toString() : `${url.pathname}${url.search}`;
+  }
+  loginWithOAuth(provider, options) {
+    if (typeof window === "undefined") {
+      throw new Error("OAuth login requires a browser environment");
+    }
+    window.location.assign(this.getOAuthLoginUrl(provider, options));
+  }
+  loginWithGoogle(options) {
+    this.loginWithOAuth("google", options);
+  }
+  async linkOAuthAccount(provider, options = {}) {
+    const query = options.returnTo ? `?${new URLSearchParams({ returnTo: this.validateReturnTo(options.returnTo) })}` : "";
+    const res = await this.api.post(
+      `${this.prefix}/oauth/${provider}/link${query}`
+    );
+    if (!res.data?.authorizationUrl) throw new Error("OAuth provider did not return an authorization URL");
+    if (typeof window === "undefined") throw new Error("OAuth linking requires a browser environment");
+    window.location.assign(res.data.authorizationUrl);
+  }
+  async completeOAuthLogin() {
+    await this.refresh();
+    const user = await this.fetchUser();
+    if (!user) throw new Error("OAuth session could not be completed");
+    this.tabSync?.broadcastSync(this.getSyncPayload());
+    this.emit("login", user);
+    return user;
+  }
   async logout() {
     this.resetState();
     this.tabSync?.broadcastLogout();
@@ -555,6 +592,18 @@ var NajmAuthClient = class _NajmAuthClient {
       this.eventListeners.get("stateChange")?.forEach((h) => h(this.state));
     }
   }
+  validateReturnTo(value) {
+    const candidate = value.trim();
+    if (!candidate.startsWith("/") || candidate.startsWith("//") || candidate.includes("\\")) {
+      throw new Error("returnTo must be a same-origin path");
+    }
+    const base = new URL("https://najm.invalid");
+    const parsed = new URL(candidate, base);
+    if (parsed.origin !== base.origin || parsed.username || parsed.password) {
+      throw new Error("returnTo must be a same-origin path");
+    }
+    return `${parsed.pathname}${parsed.search}${parsed.hash}`;
+  }
 };
 function createAuthClient(config) {
   return new NajmAuthClient(config);

package/dist/client/react/index.d.ts

@@ -1,7 +1,7 @@
 import * as react_jsx_runtime from 'react/jsx-runtime';
 import * as react from 'react';
 import { ReactNode, CSSProperties, ReactElement } from 'react';
-import { N as NajmAuthClient, H as HydrateSession, d as AuthState, e as AuthUser, A as AuthError, f as AuthEvent, b as AuthEventMap } from '../../NajmAuthClient-D08--i69.js';
+import { N as NajmAuthClient, H as HydrateSession, d as AuthState, e as AuthUser, A as AuthError, k as OAuthLoginOptions, f as AuthEvent, b as AuthEventMap } from '../../NajmAuthClient-B9dGk9MH.js';
 
 interface AuthProviderProps {
     client: NajmAuthClient;
@@ -162,6 +162,27 @@ interface UseChangePasswordReturn {
 }
 declare function useChangePassword(opts?: UseChangePasswordOptions): UseChangePasswordReturn;
 
+interface UseGoogleLoginOptions {
+    onError?: (error: AuthError | Error) => void;
+}
+interface UseGoogleLoginReturn {
+    loginWithGoogle: (options?: OAuthLoginOptions) => void;
+    linkGoogle: (options?: OAuthLoginOptions) => Promise<void>;
+    isRedirecting: boolean;
+    error: AuthError | Error | null;
+}
+declare function useGoogleLogin(options?: UseGoogleLoginOptions): UseGoogleLoginReturn;
+
+interface UseOAuthCallbackOptions {
+    onSuccess?: (user: AuthUser) => void;
+    onError?: (error: AuthError | Error) => void;
+}
+declare function useOAuthCallback(options?: UseOAuthCallbackOptions): {
+    complete: () => Promise<AuthUser>;
+    isLoading: boolean;
+    error: AuthError | Error;
+};
+
 /**
  * Subscribe to a specific auth event. Cleans up on unmount.
  * Uses a stable ref for the handler to avoid re-subscribing on every render.
@@ -537,4 +558,22 @@ interface RedirectToLoginProps {
  */
 declare function RedirectToLogin({ to, preserveFrom }: RedirectToLoginProps): any;
 
-export { AuthBoundary, type AuthEventEntry, AuthGate, AuthLoading, AuthProvider, Can, IfAuth, LoginButton, PermissionList, Protected, RedirectToLogin, Role, type SessionStatus, SignOutButton, SignedIn, SignedOut, UserAvatar, UserEmail, UserName, UserRole, useAuth, useAuthClient, useAuthEvent, useAuthEvents, useChangePassword, useForgotPassword, useLogin, useLogout, usePermissions, useRegister, useResetPassword, useSession, useUser };
+interface GoogleLoginButtonProps extends OAuthLoginOptions {
+    children: ReactNode;
+    onError?: (error: Error) => void;
+}
+declare function GoogleLoginButton({ children, returnTo, onError }: GoogleLoginButtonProps): ReactElement<{
+    onClick?: (event: unknown) => void;
+    disabled?: boolean;
+}, string | react.JSXElementConstructor<any>>;
+
+interface OAuthCallbackProps {
+    fallback?: ReactNode;
+    errorFallback?: ReactNode | ((props: {
+        error: Error;
+    }) => ReactNode);
+    defaultRedirect?: string;
+}
+declare function OAuthCallback({ fallback, errorFallback, defaultRedirect, }: OAuthCallbackProps): react_jsx_runtime.JSX.Element;
+
+export { AuthBoundary, type AuthEventEntry, AuthGate, AuthLoading, AuthProvider, Can, GoogleLoginButton, IfAuth, LoginButton, OAuthCallback, PermissionList, Protected, RedirectToLogin, Role, type SessionStatus, SignOutButton, SignedIn, SignedOut, UserAvatar, UserEmail, UserName, UserRole, useAuth, useAuthClient, useAuthEvent, useAuthEvents, useChangePassword, useForgotPassword, useGoogleLogin, useLogin, useLogout, useOAuthCallback, usePermissions, useRegister, useResetPassword, useSession, useUser };

package/dist/client/react/index.js

@@ -310,11 +310,74 @@ function useChangePassword(opts) {
 }
 __name(useChangePassword, "useChangePassword");
 
+// src/client/react/useGoogleLogin.ts
+import { useCallback as useCallback7, useState as useState8 } from "react";
+function useGoogleLogin(options) {
+  const client = useAuthClient();
+  const [isRedirecting, setIsRedirecting] = useState8(false);
+  const [error, setError] = useState8(null);
+  const fail = useCallback7((value) => {
+    const next = value instanceof Error ? value : new Error(String(value));
+    setIsRedirecting(false);
+    setError(next);
+    options?.onError?.(next);
+  }, [options?.onError]);
+  const loginWithGoogle = useCallback7((loginOptions) => {
+    setError(null);
+    setIsRedirecting(true);
+    try {
+      client.loginWithGoogle(loginOptions);
+    } catch (value) {
+      fail(value);
+    }
+  }, [client, fail]);
+  const linkGoogle = useCallback7(async (loginOptions) => {
+    setError(null);
+    setIsRedirecting(true);
+    try {
+      await client.linkOAuthAccount("google", loginOptions);
+    } catch (value) {
+      fail(value);
+    }
+  }, [client, fail]);
+  return { loginWithGoogle, linkGoogle, isRedirecting, error };
+}
+__name(useGoogleLogin, "useGoogleLogin");
+
+// src/client/react/useOAuthCallback.ts
+import { useCallback as useCallback8, useRef as useRef3, useState as useState9 } from "react";
+function useOAuthCallback(options) {
+  const client = useAuthClient();
+  const promise = useRef3(null);
+  const [isLoading, setIsLoading] = useState9(false);
+  const [error, setError] = useState9(null);
+  const complete = useCallback8(async () => {
+    if (promise.current) return promise.current;
+    setIsLoading(true);
+    setError(null);
+    promise.current = client.completeOAuthLogin();
+    try {
+      const user = await promise.current;
+      options?.onSuccess?.(user);
+      return user;
+    } catch (value) {
+      const next = value instanceof Error ? value : new Error(String(value));
+      setError(next);
+      options?.onError?.(next);
+      throw next;
+    } finally {
+      setIsLoading(false);
+    }
+  }, [client, options?.onSuccess, options?.onError]);
+  return { complete, isLoading, error };
+}
+__name(useOAuthCallback, "useOAuthCallback");
+
 // src/client/react/useAuthEvent.ts
-import { useEffect as useEffect3, useRef as useRef3 } from "react";
+import { useEffect as useEffect3, useRef as useRef4 } from "react";
 function useAuthEvent(event, handler) {
   const client = useAuthClient();
-  const handlerRef = useRef3(handler);
+  const handlerRef = useRef4(handler);
   handlerRef.current = handler;
   useEffect3(() => {
     const listener = /* @__PURE__ */ __name((data) => handlerRef.current(data), "listener");
@@ -325,7 +388,7 @@ function useAuthEvent(event, handler) {
 __name(useAuthEvent, "useAuthEvent");
 
 // src/client/react/useAuthEvents.ts
-import { useEffect as useEffect4, useRef as useRef4, useState as useState8 } from "react";
+import { useEffect as useEffect4, useRef as useRef5, useState as useState10 } from "react";
 var ALL_EVENTS = [
   "login",
   "logout",
@@ -338,8 +401,8 @@ var ALL_EVENTS = [
 function useAuthEvents(opts) {
   const client = useAuthClient();
   const max = opts?.maxEntries ?? 100;
-  const [entries, setEntries] = useState8([]);
-  const maxRef = useRef4(max);
+  const [entries, setEntries] = useState10([]);
+  const maxRef = useRef5(max);
   maxRef.current = max;
   useEffect4(() => {
     const cleanups = [];
@@ -619,14 +682,73 @@ function RedirectToLogin({ to = "/login", preserveFrom = true }) {
   return null;
 }
 __name(RedirectToLogin, "RedirectToLogin");
+
+// src/client/react/GoogleLoginButton.tsx
+import { Children as Children3, cloneElement as cloneElement3, isValidElement as isValidElement3 } from "react";
+function GoogleLoginButton({ children, returnTo, onError }) {
+  const { loginWithGoogle, isRedirecting } = useGoogleLogin({ onError });
+  const child = Children3.only(children);
+  if (!isValidElement3(child)) {
+    throw new Error("<GoogleLoginButton> expects a single React element as its child");
+  }
+  const element = child;
+  return cloneElement3(element, {
+    onClick: /* @__PURE__ */ __name((event) => {
+      element.props.onClick?.(event);
+      if (!event?.defaultPrevented) {
+        loginWithGoogle({ returnTo });
+      }
+    }, "onClick"),
+    disabled: Boolean(element.props.disabled || isRedirecting)
+  });
+}
+__name(GoogleLoginButton, "GoogleLoginButton");
+
+// src/client/react/OAuthCallback.tsx
+import { useEffect as useEffect7 } from "react";
+import { Fragment as Fragment14, jsx as jsx16 } from "react/jsx-runtime";
+var safeReturnTo = /* @__PURE__ */ __name((value, fallback) => {
+  const safeFallback = fallback.startsWith("/") && !fallback.startsWith("//") && !fallback.includes("\\") ? fallback : "/";
+  if (!value || !value.startsWith("/") || value.startsWith("//") || value.includes("\\")) return safeFallback;
+  try {
+    const base = new URL("https://najm.invalid");
+    const parsed = new URL(value, base);
+    if (parsed.origin !== base.origin) return safeFallback;
+    return `${parsed.pathname}${parsed.search}${parsed.hash}`;
+  } catch {
+    return safeFallback;
+  }
+}, "safeReturnTo");
+function OAuthCallback({
+  fallback = null,
+  errorFallback = null,
+  defaultRedirect = "/"
+}) {
+  const { complete, error } = useOAuthCallback();
+  useEffect7(() => {
+    complete().then(() => {
+      if (typeof window === "undefined") return;
+      const params = new URLSearchParams(window.location.search);
+      window.location.replace(safeReturnTo(params.get("returnTo"), defaultRedirect));
+    }).catch(() => {
+    });
+  }, [complete, defaultRedirect]);
+  if (error) {
+    return /* @__PURE__ */ jsx16(Fragment14, { children: typeof errorFallback === "function" ? errorFallback({ error }) : errorFallback });
+  }
+  return /* @__PURE__ */ jsx16(Fragment14, { children: fallback });
+}
+__name(OAuthCallback, "OAuthCallback");
 export {
   AuthBoundary,
   AuthGate,
   AuthLoading,
   AuthProvider,
   Can,
+  GoogleLoginButton,
   IfAuth,
   LoginButton,
+  OAuthCallback,
   PermissionList,
   Protected,
   RedirectToLogin,
@@ -644,8 +766,10 @@ export {
   useAuthEvents,
   useChangePassword,
   useForgotPassword,
+  useGoogleLogin,
   useLogin,
   useLogout,
+  useOAuthCallback,
   usePermissions,
   useRegister,
   useResetPassword,

package/dist/client/server/index.d.ts

@@ -1,4 +1,4 @@
-import { e as AuthUser, F as FetchClient, R as RetryConfig, N as NajmAuthClient } from '../../NajmAuthClient-D08--i69.js';
+import { e as AuthUser, F as FetchClient, R as RetryConfig, N as NajmAuthClient } from '../../NajmAuthClient-B9dGk9MH.js';
 export { withAuthMiddleware } from '../edge.js';
 import 'next/server';
 

package/dist/client/server/index.js

@@ -588,6 +588,43 @@ var NajmAuthClient = class _NajmAuthClient {
     );
     return res.data;
   }
+  getOAuthLoginUrl(provider, options = {}) {
+    const baseURL = this.config.baseURL.replace(/\/$/, "");
+    const authPrefix = this.prefix.startsWith("/") ? this.prefix : `/${this.prefix}`;
+    const raw = `${baseURL}${authPrefix}/oauth/${provider}/start`;
+    const absolute = /^[a-z][a-z\d+.-]*:\/\//i.test(raw);
+    const url = new URL(raw, absolute ? void 0 : "https://najm.invalid");
+    if (options.returnTo) {
+      url.searchParams.set("returnTo", this.validateReturnTo(options.returnTo));
+    }
+    return absolute ? url.toString() : `${url.pathname}${url.search}`;
+  }
+  loginWithOAuth(provider, options) {
+    if (typeof window === "undefined") {
+      throw new Error("OAuth login requires a browser environment");
+    }
+    window.location.assign(this.getOAuthLoginUrl(provider, options));
+  }
+  loginWithGoogle(options) {
+    this.loginWithOAuth("google", options);
+  }
+  async linkOAuthAccount(provider, options = {}) {
+    const query = options.returnTo ? `?${new URLSearchParams({ returnTo: this.validateReturnTo(options.returnTo) })}` : "";
+    const res = await this.api.post(
+      `${this.prefix}/oauth/${provider}/link${query}`
+    );
+    if (!res.data?.authorizationUrl) throw new Error("OAuth provider did not return an authorization URL");
+    if (typeof window === "undefined") throw new Error("OAuth linking requires a browser environment");
+    window.location.assign(res.data.authorizationUrl);
+  }
+  async completeOAuthLogin() {
+    await this.refresh();
+    const user = await this.fetchUser();
+    if (!user) throw new Error("OAuth session could not be completed");
+    this.tabSync?.broadcastSync(this.getSyncPayload());
+    this.emit("login", user);
+    return user;
+  }
   async logout() {
     this.resetState();
     this.tabSync?.broadcastLogout();
@@ -879,6 +916,18 @@ var NajmAuthClient = class _NajmAuthClient {
       this.eventListeners.get("stateChange")?.forEach((h) => h(this.state));
     }
   }
+  validateReturnTo(value) {
+    const candidate = value.trim();
+    if (!candidate.startsWith("/") || candidate.startsWith("//") || candidate.includes("\\")) {
+      throw new Error("returnTo must be a same-origin path");
+    }
+    const base = new URL("https://najm.invalid");
+    const parsed = new URL(candidate, base);
+    if (parsed.origin !== base.origin || parsed.username || parsed.password) {
+      throw new Error("returnTo must be a same-origin path");
+    }
+    return `${parsed.pathname}${parsed.search}${parsed.hash}`;
+  }
 };
 function createAuthClient(config) {
   return new NajmAuthClient(config);