najm-auth 2.0.14 → 3.0.0

package/dist/client/server/index.js

@@ -382,7 +382,7 @@ function requestOriginFromHeaders(headers) {
   }
 }
 async function getSession(config = {}) {
-  const cookieName = config.cookieName ?? "refreshToken";
+  const cookieName2 = config.cookieName ?? "refreshToken";
   const sessionCookieName = config.sessionCookieName ?? "najm.session";
   const baseURL = config.baseURL ?? defaultBaseURL();
   const prefix = config.authPrefix ?? "/auth";
@@ -395,7 +395,7 @@ async function getSession(config = {}) {
     const mod = await import("next/headers");
     const cookieStore = await mod.cookies();
     sessionCookieValue = cookieStore.get(sessionCookieName)?.value;
-    refreshCookieValue = cookieStore.get(cookieName)?.value;
+    refreshCookieValue = cookieStore.get(cookieName2)?.value;
     if (typeof mod.headers === "function") {
       requestOrigin = requestOriginFromHeaders(await mod.headers());
     }
@@ -434,7 +434,7 @@ async function getSession(config = {}) {
     endpoint,
     requestOrigin,
     allowLoopbackEndpoint: internalRecoveryURL !== void 0,
-    refreshCookieName: cookieName,
+    refreshCookieName: cookieName2,
     refreshCookieValue,
     sessionCookieName,
     sessionSecret: secret,
@@ -700,7 +700,7 @@ function withAuthMiddleware(config) {
     publicRoutes = [],
     loginRoute = "/login",
     roleRoutes = {},
-    cookieName = "refreshToken",
+    cookieName: cookieName2 = "refreshToken",
     apiBaseURL = "/api",
     authPrefix = "/auth",
     sessionCookieName = "najm.session",
@@ -719,7 +719,7 @@ function withAuthMiddleware(config) {
       loginUrl.searchParams.set("from", returnPath2);
       const res = NextResponse.redirect(loginUrl);
       if (clearCookies.includes("refresh")) {
-        res.cookies.delete(cookieName);
+        res.cookies.delete(cookieName2);
       }
       if (clearCookies.includes("session")) {
         res.cookies.delete(sessionCookieName);
@@ -746,7 +746,7 @@ function withAuthMiddleware(config) {
     }) : null;
     let recovery = null;
     if (!session || verifyAlways) {
-      const refreshCookie = readCookieValue(cookie, cookieName);
+      const refreshCookie = readCookieValue(cookie, cookieName2);
       if (!refreshCookie || recoveryURL === false && !resolvedInternalRecoveryURL) {
         return redirectToLogin(returnPath, ["refresh", "session"]);
       }
@@ -755,7 +755,7 @@ function withAuthMiddleware(config) {
         endpoint,
         requestOrigin: url.origin,
         allowLoopbackEndpoint: resolvedInternalRecoveryURL !== void 0,
-        refreshCookieName: cookieName,
+        refreshCookieName: cookieName2,
         refreshCookieValue: refreshCookie,
         sessionCookieName,
         sessionSecret: secret,
@@ -888,6 +888,10 @@ var TabSync = class {
 };
 
 // src/client/NajmAuthClient.ts
+function isCredentialSetupPending(payload) {
+  return typeof payload === "object" && payload !== null && payload.nextStep === "credential_setup";
+}
+__name(isCredentialSetupPending, "isCredentialSetupPending");
 var INITIAL_STATE = {
   user: null,
   accessToken: null,
@@ -939,20 +943,23 @@ var NajmAuthClient = class _NajmAuthClient {
   // Auth Operations
   // =========================================================================
   async login(credentials) {
-    const res = await this.api.post(
-      `${this.prefix}/login`,
-      { body: credentials, skipAuth: true }
-    );
-    this.applyTokens(res.data);
-    if (res.data.user) {
-      this.state = { ...this.state, user: res.data.user };
+    const res = await this.api.post(`${this.prefix}/login`, { body: credentials, skipAuth: true });
+    this.resetRefreshFailures();
+    const setup = isCredentialSetupPending(res) ? res : isCredentialSetupPending(res.data) ? res.data : null;
+    if (setup) {
+      return { ...setup };
+    }
+    const authenticated = res.data;
+    this.applyTokens(authenticated);
+    if (authenticated.user) {
+      this.state = { ...this.state, user: authenticated.user };
       this.notify();
     } else {
       await this.fetchUser();
     }
     this.tabSync?.broadcastSync(this.getSyncPayload());
     this.emit("login", this.state.user);
-    return this.state.user;
+    return { nextStep: "authenticated", user: this.state.user };
   }
   async register(data) {
     const res = await this.api.post(
@@ -1324,10 +1331,11 @@ function defineAuth(authConfig = {}) {
     apiBaseURL = "/api",
     authPrefix = "/auth",
     loginRoute = "/login",
+    forbiddenRoute = "/forbidden",
     publicRoutes = [],
     protectedRoutes = [],
     roleRoutes = {},
-    cookieName = "refreshToken",
+    cookieName: cookieName2 = "refreshToken",
     sessionCookieName = "najm.session",
     sessionSecret,
     sessionMaxAge,
@@ -1345,7 +1353,7 @@ function defineAuth(authConfig = {}) {
   const sessionConfig = {
     baseURL: apiBaseURL,
     authPrefix,
-    cookieName,
+    cookieName: cookieName2,
     sessionCookieName,
     sessionSecret,
     sessionMaxAge,
@@ -1393,12 +1401,21 @@ function defineAuth(authConfig = {}) {
       throw err;
     }
   }, "requireSession");
+  const requireRole = /* @__PURE__ */ __name(async (roles) => {
+    const session = await requireSession();
+    const held = session.roles ?? (session.user.role ? [session.user.role] : []);
+    if (!held.some((role) => roles.includes(role))) {
+      const { redirect } = await import("next/navigation");
+      redirect(forbiddenRoute);
+    }
+    return session;
+  }, "requireRole");
   const middleware = withAuthMiddleware({
     protectedRoutes,
     publicRoutes,
     loginRoute,
     roleRoutes,
-    cookieName,
+    cookieName: cookieName2,
     apiBaseURL,
     authPrefix,
     sessionCookieName,
@@ -1420,7 +1437,7 @@ function defineAuth(authConfig = {}) {
         const userRoles = session.roles ?? (session.user.role ? [session.user.role] : []);
         if (!userRoles.includes(options.role)) {
           const { redirect } = await import("next/navigation");
-          redirect(loginRoute);
+          redirect(forbiddenRoute);
         }
       }
       if (options?.permission) {
@@ -1428,7 +1445,7 @@ function defineAuth(authConfig = {}) {
         const perms = session.permissions ?? session.user.permissions ?? [];
         if (!matchPermission2(perms, options.permission)) {
           const { redirect } = await import("next/navigation");
-          redirect(loginRoute);
+          redirect(forbiddenRoute);
         }
       }
       return Page({ session, ...props });
@@ -1443,20 +1460,186 @@ function defineAuth(authConfig = {}) {
     },
     getSession: getSession2,
     requireSession,
+    requireRole,
     middleware,
     config: { matcher },
     protect
   };
 }
 __name(defineAuth, "defineAuth");
+
+// src/client/server/safeRedirect.ts
+var DEFAULT_BLOCKED_PREFIXES = ["/api", "/login", "/_next"];
+var ASSET_EXTENSIONS = /\.(?:css|gif|ico|jpe?g|js|json|map|png|svg|webmanifest|webp)$/i;
+function getSafeRedirectPath(value, options = {}) {
+  const {
+    fallback = "/dashboard",
+    blockedPrefixes = DEFAULT_BLOCKED_PREFIXES
+  } = typeof options === "string" ? { fallback: options } : options;
+  const path = Array.isArray(value) ? value[0] : value;
+  if (!path || !path.startsWith("/") || // Protocol-relative: the browser treats `//host/x` as off-site.
+  path.startsWith("//") || // A backslash is normalized to a forward slash by some browsers, so
+  // `/\evil.test` is another way to spell the case above.
+  path.startsWith("/\\") || blockedPrefixes.some((prefix) => path.startsWith(prefix)) || ASSET_EXTENSIONS.test(path.split("?")[0] ?? path)) {
+    return fallback;
+  }
+  return path;
+}
+__name(getSafeRedirectPath, "getSafeRedirectPath");
+
+// src/client/server/authCookiePersistence.ts
+var DEFAULTS = {
+  authCookieNames: ["refreshToken", "najm.session"],
+  rememberCookieName: "najm.remember",
+  maxAgeSeconds: 7 * 24 * 60 * 60,
+  loginPaths: ["/api/auth/login"],
+  logoutPaths: ["/api/auth/logout"],
+  refreshPaths: ["/api/auth/refresh", "/api/auth/session/recover"],
+  setupCompletionPaths: ["/api/auth/credential-setup/change"]
+};
+function isNajmSetupResponse(payload) {
+  if (typeof payload !== "object" || payload === null) return false;
+  const body = payload;
+  if (body.nextStep === "credential_setup") return true;
+  const data = body.data;
+  return typeof data === "object" && data !== null && data.nextStep === "credential_setup";
+}
+__name(isNajmSetupResponse, "isNajmSetupResponse");
+function cookieValue(header, name) {
+  for (const part of header.split(";")) {
+    const separator = part.indexOf("=");
+    if (separator < 0) continue;
+    if (part.slice(0, separator).trim() !== name) continue;
+    return part.slice(separator + 1).trim();
+  }
+  return void 0;
+}
+__name(cookieValue, "cookieValue");
+function cookieName(setCookie) {
+  const separator = setCookie.indexOf("=");
+  return separator < 0 ? "" : setCookie.slice(0, separator).trim();
+}
+__name(cookieName, "cookieName");
+function makeSessionCookie(setCookie, authCookieNames = DEFAULTS.authCookieNames) {
+  if (!authCookieNames.includes(cookieName(setCookie))) return setCookie;
+  return setCookie.split(";").filter((part) => !/^\s*(?:expires|max-age)=/i.test(part)).join(";");
+}
+__name(makeSessionCookie, "makeSessionCookie");
+function isDeletionCookie(setCookie) {
+  if (/^[^=]+=\s*(?:;|$)/.test(setCookie)) return true;
+  if (/(?:^|;)\s*max-age=0(?:;|$)/i.test(setCookie)) return true;
+  const expires = /(?:^|;)\s*expires=([^;]+)/i.exec(setCookie)?.[1];
+  return expires ? new Date(expires).getTime() <= Date.now() : false;
+}
+__name(isDeletionCookie, "isDeletionCookie");
+function rememberCookie(name, mode, secure, maxAgeSeconds) {
+  const attributes = [
+    `${name}=${mode === "persistent" ? "1" : "0"}`,
+    "Path=/",
+    "HttpOnly",
+    "SameSite=Lax"
+  ];
+  if (secure) attributes.push("Secure");
+  if (mode === "persistent") attributes.push(`Max-Age=${maxAgeSeconds}`);
+  return attributes.join("; ");
+}
+__name(rememberCookie, "rememberCookie");
+function clearedRememberCookie(name, secure) {
+  return [
+    `${name}=`,
+    "Path=/",
+    "HttpOnly",
+    "SameSite=Lax",
+    ...secure ? ["Secure"] : [],
+    "Max-Age=0"
+  ].join("; ");
+}
+__name(clearedRememberCookie, "clearedRememberCookie");
+function withAuthCookiePersistence(handler, options = {}) {
+  const {
+    authCookieNames = DEFAULTS.authCookieNames,
+    rememberCookieName = DEFAULTS.rememberCookieName,
+    maxAgeSeconds = DEFAULTS.maxAgeSeconds,
+    loginPaths = DEFAULTS.loginPaths,
+    logoutPaths = DEFAULTS.logoutPaths,
+    refreshPaths = DEFAULTS.refreshPaths,
+    setupCompletionPaths = DEFAULTS.setupCompletionPaths,
+    isSetupResponse
+  } = options;
+  const resolveAction = /* @__PURE__ */ __name(async (request) => {
+    const { pathname } = new URL(request.url);
+    if (loginPaths.includes(pathname)) {
+      const body = await request.clone().json().catch(() => null);
+      return {
+        type: "apply",
+        mode: body?.rememberMe === true ? "persistent" : "session"
+      };
+    }
+    if (logoutPaths.includes(pathname)) return { type: "clear" };
+    if (setupCompletionPaths.includes(pathname)) return { type: "clear" };
+    if (refreshPaths.includes(pathname)) {
+      const remembered = cookieValue(
+        request.headers.get("cookie") ?? "",
+        rememberCookieName
+      );
+      if (remembered === "0") return { type: "apply", mode: "session" };
+      if (remembered === "1") return { type: "apply", mode: "persistent" };
+    }
+    return null;
+  }, "resolveAction");
+  const applyAction = /* @__PURE__ */ __name((response, action, secure) => {
+    const headers = new Headers(response.headers);
+    const setCookies = headers.getSetCookie();
+    headers.delete("set-cookie");
+    for (const setCookie of setCookies) {
+      if (action.type === "setup" && authCookieNames.includes(cookieName(setCookie)) && !isDeletionCookie(setCookie)) {
+        continue;
+      }
+      headers.append(
+        "set-cookie",
+        action.type === "apply" && action.mode === "session" ? makeSessionCookie(setCookie, authCookieNames) : setCookie
+      );
+    }
+    headers.append(
+      "set-cookie",
+      action.type === "clear" || action.type === "setup" ? clearedRememberCookie(rememberCookieName, secure) : rememberCookie(rememberCookieName, action.mode, secure, maxAgeSeconds)
+    );
+    return new Response(response.body, {
+      headers,
+      status: response.status,
+      statusText: response.statusText
+    });
+  }, "applyAction");
+  return async (request) => {
+    let action = await resolveAction(request);
+    const response = await handler(request);
+    if (!response.ok) return response;
+    if (action?.type === "apply" && loginPaths.includes(new URL(request.url).pathname)) {
+      const payload = await response.clone().json().catch(() => null);
+      if (isNajmSetupResponse(payload) || isSetupResponse?.(payload)) {
+        action = { type: "setup" };
+      }
+    }
+    if (!action) return response;
+    return applyAction(
+      response,
+      action,
+      new URL(request.url).protocol === "https:"
+    );
+  };
+}
+__name(withAuthCookiePersistence, "withAuthCookiePersistence");
 export {
   AuthConfigError,
   AuthTransportError,
   NoSessionError,
   createServerClient,
   defineAuth,
+  getSafeRedirectPath,
   getServerSession,
   getSession,
+  makeSessionCookie,
   withAuth,
+  withAuthCookiePersistence,
   withAuthMiddleware
 };

package/dist/identity/ma.d.ts

@@ -0,0 +1 @@
+export { M as MOROCCAN_CIN_TEMPORARY_CREDENTIAL_KIND, e as TemporaryCredential, T as TemporaryCredentialInput, i as isMoroccanCin, m as moroccanCinTemporaryCredential, j as moroccoIdentityPreset, n as normalizeMoroccanCin, k as normalizeMoroccanPhone } from '../ma-sNHnUGLO.js';

package/dist/identity/ma.js

@@ -0,0 +1,64 @@
+var __defProp = Object.defineProperty;
+var __name = (target, value) => __defProp(target, "name", { value, configurable: true });
+
+// src/identity/presets.ts
+var compactPhone = /* @__PURE__ */ __name((value) => value.trim().replace(/[\s().-]+/g, ""), "compactPhone");
+var MOROCCO_LOCAL = /^0\d{9}$/;
+var MOROCCO_NATIONAL = /^212\d{9}$/;
+var MOROCCO_E164 = /^\+212\d{9}$/;
+var normalizeMoroccanPhone = /* @__PURE__ */ __name((value) => {
+  const compact = compactPhone(value);
+  if (MOROCCO_LOCAL.test(compact))
+    return `+212${compact.slice(1)}`;
+  if (MOROCCO_NATIONAL.test(compact))
+    return `+${compact}`;
+  if (MOROCCO_E164.test(compact))
+    return compact;
+  return null;
+}, "normalizeMoroccanPhone");
+var moroccoIdentityPreset = {
+  name: "ma",
+  normalize: normalizeMoroccanPhone
+};
+
+// src/identity/temporaryCredential.ts
+var EXACT_TEMPORARY_CREDENTIAL_KIND = "exact";
+var exactKind = {
+  name: EXACT_TEMPORARY_CREDENTIAL_KIND,
+  normalize: /* @__PURE__ */ __name((value) => value, "normalize")
+};
+var MOROCCAN_CIN_TEMPORARY_CREDENTIAL_KIND = "ma-cin";
+var MOROCCAN_CIN = /^[a-z]{1,3}\d{5,17}$/i;
+function isMoroccanCin(value) {
+  const trimmed = value.trim();
+  return trimmed.length >= 8 && trimmed.length <= 20 && MOROCCAN_CIN.test(trimmed);
+}
+__name(isMoroccanCin, "isMoroccanCin");
+function normalizeMoroccanCin(value) {
+  return isMoroccanCin(value) ? value.trim().toLowerCase() : value;
+}
+__name(normalizeMoroccanCin, "normalizeMoroccanCin");
+var moroccanCinKind = {
+  name: MOROCCAN_CIN_TEMPORARY_CREDENTIAL_KIND,
+  normalize: normalizeMoroccanCin,
+  isTemporaryShape: isMoroccanCin
+};
+var KINDS = /* @__PURE__ */ new Map([
+  [exactKind.name, exactKind],
+  [moroccanCinKind.name, moroccanCinKind]
+]);
+function moroccanCinTemporaryCredential(value) {
+  if (!isMoroccanCin(value)) {
+    throw new Error("moroccanCinTemporaryCredential requires a valid Moroccan CIN");
+  }
+  return { kind: MOROCCAN_CIN_TEMPORARY_CREDENTIAL_KIND, value };
+}
+__name(moroccanCinTemporaryCredential, "moroccanCinTemporaryCredential");
+export {
+  MOROCCAN_CIN_TEMPORARY_CREDENTIAL_KIND,
+  isMoroccanCin,
+  moroccanCinTemporaryCredential,
+  moroccoIdentityPreset,
+  normalizeMoroccanCin,
+  normalizeMoroccanPhone
+};