nexus-shared 1.1.17 → 1.1.19

package/src/sso-config/auth-token-validation.ts

@@ -0,0 +1,20 @@
+import { IUserValidationResponse } from "../interfaces/user-interfaces";
+import { HttpGet } from "../services/http-services";
+import { SSO_CONFIG } from "./sso-config";
+
+/**
+ * Verifies the access token by calling the backend Authentication/Verify endpoint.
+ * Returns true when the backend responds with HTTP 200 (token accepted), false for any
+ * other status or network failure. No JWT secrets or JWKS keys are needed in Next.js.
+ */
+export async function VerifyAccessToken(token: string): Promise<boolean> {
+  if (!token?.trim()) return false;
+  try {
+    const response = await HttpGet(SSO_CONFIG.BACKEND_ENDPOINTS.VERIFY, token);
+    if (!response.isSuccess) return false;
+    const validationResponse = response.result as IUserValidationResponse;
+    return validationResponse.isValidUser;
+  } catch {
+    return false;
+  }
+}

package/src/sso-config/callback-route.tsx

@@ -0,0 +1,34 @@
+import { NextRequest, NextResponse } from "next/server";
+import { URLS } from "../nexus.environments";
+import { SetAuthCookies } from "./cookie-helpers";
+import { DecodeOAuthCallbackState } from "./oauth-callback-state";
+import { SanitizeReturnPath } from "./redirect-context-helpers";
+import { BuildAuthenticationSignInUrl, SSO_CONFIG } from "./sso-config";
+import { ExchangeAuthorizationCode } from "./sso-backend-flow";
+
+export async function CallbackRoute(req: NextRequest) {
+  const code = req.nextUrl.searchParams.get("code");
+  const state = req.nextUrl.searchParams.get("state");
+  const callbackState = DecodeOAuthCallbackState(state);
+  const failUrl = new URL(BuildAuthenticationSignInUrl(callbackState?.returnPath));
+
+  if (!code) return NextResponse.redirect(failUrl);
+
+  if (!callbackState?.codeVerifier) return NextResponse.redirect(failUrl);
+
+  try {
+    const tokenData = await ExchangeAuthorizationCode({
+      code,
+      redirectUri: SSO_CONFIG.FRONTEND_ENDPOINTS.CALLBACK,
+      codeVerifier: callbackState.codeVerifier,
+    });
+    if (!tokenData) return NextResponse.redirect(failUrl);
+
+    const redirectTarget = new URL(SanitizeReturnPath(tokenData.returnPath ?? callbackState.returnPath), URLS.CURRENT!);
+    const response = NextResponse.redirect(redirectTarget);
+    SetAuthCookies(response, tokenData);
+    return response;
+  } catch {
+    return NextResponse.redirect(new URL(BuildAuthenticationSignInUrl(callbackState?.returnPath)));
+  }
+}

package/src/sso-config/cookie-encryption.ts

@@ -0,0 +1,51 @@
+import { createCipheriv, createDecipheriv, createHash, randomBytes } from "crypto";
+
+const ALGORITHM = "aes-256-gcm";
+const IV_BYTES = 12; // 96-bit IV recommended for GCM
+
+/**
+ * Derives a 32-byte AES key from SSO_COOKIE_SECRET using SHA-256.
+ * The secret itself is never sent to the browser.
+ */
+function deriveKey(): Buffer {
+  const raw = process.env.SSO_COOKIE_SECRET?.trim();
+  const secret = raw && !raw.startsWith("$") ? raw : process.env.NODE_ENV === "development" ? "NexusDevAuthSecretKey2026MustBe32CharsLong!" : null;
+  if (!secret) throw new Error("SSO_COOKIE_SECRET must be configured for cookie encryption.");
+  return createHash("sha256").update(secret).digest();
+}
+
+/**
+ * Encrypts a cookie value with AES-256-GCM.
+ * Output format: `<iv>.<authTag>.<ciphertext>` (all base64url).
+ * The browser stores only this opaque string — the raw token is never exposed.
+ */
+export function EncryptCookieValue(value: string): string {
+  const key = deriveKey();
+  const iv = randomBytes(IV_BYTES);
+  const cipher = createCipheriv(ALGORITHM, key, iv);
+  const encrypted = Buffer.concat([cipher.update(value, "utf8"), cipher.final()]);
+  const authTag = cipher.getAuthTag();
+  return `${iv.toString("base64url")}.${authTag.toString("base64url")}.${encrypted.toString("base64url")}`;
+}
+
+/**
+ * Decrypts a cookie value produced by EncryptCookieValue.
+ * Returns null if the value is missing, malformed, or the auth tag fails (tampered).
+ */
+export function DecryptCookieValue(value: string): string | null {
+  if (!value) return null;
+  try {
+    const parts = value.split(".");
+    if (parts.length !== 3) return null;
+    const key = deriveKey();
+    const iv = Buffer.from(parts[0], "base64url");
+    const authTag = Buffer.from(parts[1], "base64url");
+    const encrypted = Buffer.from(parts[2], "base64url");
+    const decipher = createDecipheriv(ALGORITHM, key, iv);
+    decipher.setAuthTag(authTag);
+    const decrypted = Buffer.concat([decipher.update(encrypted), decipher.final()]);
+    return decrypted.toString("utf8");
+  } catch {
+    return null;
+  }
+}

package/src/sso-config/cookie-helpers.tsx

@@ -0,0 +1,77 @@
+import { cookies } from "next/headers";
+import { NextRequest, NextResponse } from "next/server";
+import { VerifyAccessToken } from "./auth-token-validation";
+import { DecryptCookieValue, EncryptCookieValue } from "./cookie-encryption";
+import { GetAuthCookieOptions } from "./redirect-context-helpers";
+import { CookieInfo, SSOAuthResponse } from "./sso-interfaces";
+
+export const AUTH_COOKIES = {
+  ssoSession: "sso_session",
+  accessToken: "access_token",
+  refreshToken: "refresh_token",
+  redirectContext: "sso_redirect_ctx",
+} as const;
+
+export function SetAuthCookies(response: NextResponse, tokens: SSOAuthResponse) {
+  response.cookies.set(AUTH_COOKIES.accessToken, EncryptCookieValue(tokens.accessToken), GetAuthCookieOptions(tokens.expiresTokenIn));
+  response.cookies.set(AUTH_COOKIES.refreshToken, EncryptCookieValue(tokens.refreshToken), GetAuthCookieOptions(tokens.expiresRefreshTokenIn));
+}
+
+export function SetSsoSessionCookie(response: NextResponse, ssoSession: string, maxAge: number | string) {
+  response.cookies.set(AUTH_COOKIES.ssoSession, EncryptCookieValue(ssoSession), GetAuthCookieOptions(maxAge ?? 28800));
+}
+
+export function ClearAuthCookies(response: NextResponse) {
+  response.cookies.set(AUTH_COOKIES.accessToken, "", GetAuthCookieOptions(0));
+  response.cookies.set(AUTH_COOKIES.refreshToken, "", GetAuthCookieOptions(0));
+}
+
+export function ClearAllAuthCookies(response: NextResponse) {
+  response.cookies.set(AUTH_COOKIES.ssoSession, "", GetAuthCookieOptions(0));
+  ClearAuthCookies(response);
+}
+
+/**
+ * Reads and decrypts a single auth cookie from an incoming NextRequest.
+ * Returns null when the cookie is absent or the encrypted value is tampered / unreadable.
+ */
+export function GetDecryptedRequestCookie(req: NextRequest, name: string): string | null {
+  const raw = req.cookies.get(name)?.value;
+  if (!raw) return null;
+  return DecryptCookieValue(raw);
+}
+
+export async function GetCookieInfo(): Promise<CookieInfo | null> {
+  const cookieStore = await cookies();
+
+  const rawSsoSession = cookieStore.get(AUTH_COOKIES.ssoSession)?.value;
+  if (!rawSsoSession) return null;
+  const ssoSession = DecryptCookieValue(rawSsoSession);
+  if (!ssoSession) return null;
+
+  const rawAccessToken = cookieStore.get(AUTH_COOKIES.accessToken)?.value;
+  const rawRefreshToken = cookieStore.get(AUTH_COOKIES.refreshToken)?.value;
+
+  return {
+    ssoSession,
+    accessToken: rawAccessToken ? (DecryptCookieValue(rawAccessToken) ?? undefined) : undefined,
+    refreshToken: rawRefreshToken ? (DecryptCookieValue(rawRefreshToken) ?? undefined) : undefined,
+  };
+}
+
+/** True when this client app has a valid access token (use on all non-auth client sites). */
+export async function HasAccessToken(): Promise<boolean> {
+  const cookieStore = await cookies();
+  const raw = cookieStore.get(AUTH_COOKIES.accessToken)?.value;
+  if (!raw) return false;
+  const token = DecryptCookieValue(raw);
+  if (!token) return false;
+  return VerifyAccessToken(token);
+}
+
+/** True on the central auth app when user has SSO session or a valid local access token. */
+export async function HasAuthSession(): Promise<boolean> {
+  const cookieStore = await cookies();
+  const rawSsoSession = cookieStore.get(AUTH_COOKIES.ssoSession)?.value;
+  return !!(rawSsoSession && DecryptCookieValue(rawSsoSession));
+}

package/src/sso-config/forgot-password-route.tsx

@@ -0,0 +1,36 @@
+import { NextRequest, NextResponse } from "next/server";
+import { HttpPost } from "../services/http-services";
+import { SSO_CONFIG } from "./sso-config";
+
+export async function ForgotPasswordPostRoute(req: NextRequest) {
+  const body = (await req.json()) as { usernameOrEmail?: string };
+  if (!body.usernameOrEmail?.trim()) {
+    return NextResponse.json({ error: "Username or email is required." }, { status: 400 });
+  }
+
+  const response = await HttpPost(SSO_CONFIG.BACKEND_ENDPOINTS.FORGOT_PASSWORD, {
+    usernameOrEmail: body.usernameOrEmail.trim(),
+  });
+
+  if (!response.isSuccess) {
+    return NextResponse.json(response, { status: response.code ?? 400 });
+  }
+
+  return NextResponse.json(response);
+}
+
+export async function ResetPasswordPostRoute(req: NextRequest) {
+  const body = (await req.json()) as {
+    resetSessionToken?: string;
+    verificationCode?: string;
+    newPassword?: string;
+    confirmPassword?: string;
+  };
+
+  const response = await HttpPost(SSO_CONFIG.BACKEND_ENDPOINTS.RESET_PASSWORD, body);
+  if (!response.isSuccess) {
+    return NextResponse.json(response, { status: response.code ?? 400 });
+  }
+
+  return NextResponse.json(response);
+}

package/src/sso-config/oauth-callback-state.ts

@@ -0,0 +1,58 @@
+import { createHmac, timingSafeEqual } from "crypto";
+import { SanitizeReturnPath } from "./redirect-context-helpers";
+
+type EncodedCallbackState = {
+  n: string;
+  p: string;
+  v: string;
+  t: number;
+};
+
+function getCookieSecret(): string {
+  const ssoSecret = process.env.SSO_COOKIE_SECRET?.trim();
+  const secret = ssoSecret && !ssoSecret.startsWith("$") ? ssoSecret : undefined;
+  if (secret) return secret;
+  if (process.env.NODE_ENV === "development") return "NexusDevAuthSecretKey2026MustBe32CharsLong!";
+  throw new Error("SSO_COOKIE_SECRET must be configured.");
+}
+
+function signPayload(data: string): string {
+  return createHmac("sha256", getCookieSecret()).update(data).digest("base64url");
+}
+
+/** Signed OAuth callback state (nonce + return path + PKCE verifier). */
+export function EncodeOAuthCallbackState(nonce: string, returnPath: string, codeVerifier: string): string {
+  const payload: EncodedCallbackState = {
+    n: nonce,
+    p: SanitizeReturnPath(returnPath),
+    v: codeVerifier,
+    t: Date.now(),
+  };
+  const data = Buffer.from(JSON.stringify(payload), "utf8").toString("base64url");
+  return `${data}.${signPayload(data)}`;
+}
+
+export function DecodeOAuthCallbackState(value?: string | null): { nonce: string; returnPath: string; codeVerifier: string } | null {
+  if (!value) return null;
+
+  try {
+    const [data, signature] = value.split(".");
+    if (!data || !signature) return null;
+
+    const expected = signPayload(data);
+    if (signature.length !== expected.length || !timingSafeEqual(Buffer.from(signature), Buffer.from(expected))) {
+      return null;
+    }
+
+    const payload = JSON.parse(Buffer.from(data, "base64url").toString("utf8")) as EncodedCallbackState;
+    if (!payload?.n || !payload?.v) return null;
+
+    return {
+      nonce: payload.n,
+      returnPath: SanitizeReturnPath(payload.p),
+      codeVerifier: payload.v,
+    };
+  } catch {
+    return null;
+  }
+}

package/src/sso-config/pkce-helpers.ts

@@ -0,0 +1,16 @@
+import { randomBytes, createHash } from "crypto";
+
+export const PKCE_METHOD_S256 = "S256";
+
+export type PkcePair = {
+  verifier: string;
+  challenge: string;
+  method: typeof PKCE_METHOD_S256;
+};
+
+/** Creates an OAuth PKCE pair (RFC 7636) using S256. */
+export function CreatePkcePair(): PkcePair {
+  const verifier = randomBytes(32).toString("base64url");
+  const challenge = createHash("sha256").update(verifier).digest("base64url");
+  return { verifier, challenge, method: PKCE_METHOD_S256 };
+}

package/src/sso-config/provider-complete-route.tsx

@@ -0,0 +1,15 @@
+import { NextRequest, NextResponse } from "next/server";
+import { SetSsoSessionCookie } from "./cookie-helpers";
+import { SSO_CONFIG } from "./sso-config";
+
+/** GET — complete provider OAuth by persisting the backend SSO session cookie. */
+export async function ProviderCompleteRoute(req: NextRequest) {
+  const signInUrl = new URL("/auth/sign-in", req.url);
+  const ssoSession = req.nextUrl.searchParams.get("ssoSession");
+
+  if (!ssoSession) return NextResponse.redirect(signInUrl);
+
+  const response = NextResponse.redirect(new URL(SSO_CONFIG.FRONTEND_ENDPOINTS.SSO_COMPLETE, req.url));
+  SetSsoSessionCookie(response, ssoSession, SSO_CONFIG.BACKEND_CONFIG.SSO_SESSION_MAX_AGE);
+  return response;
+}

package/src/sso-config/redirect-context-actions.tsx

@@ -0,0 +1,46 @@
+"use server";
+
+import { cookies } from "next/headers";
+import { AUTH_COOKIES } from "./cookie-helpers";
+import { CreatePkcePair } from "./pkce-helpers";
+import { CreateOAuthNonce, DecodeRedirectContext, EncodeRedirectContext, GetRedirectContextCookieOptions, IsAllowedRedirectUri, SanitizeReturnPath } from "./redirect-context-helpers";
+import { IRedirectContext } from "./sso-interfaces";
+
+function ReadRedirectContextFromStore(cookieStore: Awaited<ReturnType<typeof cookies>>): IRedirectContext | null {
+  return DecodeRedirectContext(cookieStore.get(AUTH_COOKIES.redirectContext)?.value);
+}
+
+function WriteRedirectContextToStore(cookieStore: Awaited<ReturnType<typeof cookies>>, context: IRedirectContext) {
+  cookieStore.set(AUTH_COOKIES.redirectContext, EncodeRedirectContext(context), GetRedirectContextCookieOptions());
+}
+
+/** Server Action — persists redirect_uri/state into a signed httpOnly cookie. */
+export async function PersistRedirectContext(redirectUri?: string | null, state?: string | null) {
+  const cookieStore = await cookies();
+  const trimmedUri = redirectUri?.trim();
+
+  if (trimmedUri && IsAllowedRedirectUri(trimmedUri)) {
+    const existing = ReadRedirectContextFromStore(cookieStore);
+    if (existing?.redirectUri === trimmedUri) return;
+
+    const pkce = CreatePkcePair();
+    WriteRedirectContextToStore(cookieStore, {
+      redirectUri: trimmedUri,
+      state: CreateOAuthNonce(),
+      returnPath: SanitizeReturnPath(state),
+      codeChallenge: pkce.challenge,
+      codeChallengeMethod: pkce.method,
+      pkceVerifier: pkce.verifier,
+    });
+    return;
+  }
+
+  const existing = ReadRedirectContextFromStore(cookieStore);
+  if (existing) WriteRedirectContextToStore(cookieStore, existing);
+}
+
+/** Server Action — clears the redirect context cookie after SSO completes. */
+export async function ClearRedirectContext() {
+  const cookieStore = await cookies();
+  cookieStore.delete(AUTH_COOKIES.redirectContext);
+}

package/src/sso-config/redirect-context-helpers.tsx

@@ -0,0 +1,144 @@
+import { createHmac, randomBytes, timingSafeEqual } from "crypto";
+import { cookies } from "next/headers";
+import { NextResponse } from "next/server";
+import { URLS } from "../nexus.environments";
+import { AUTH_COOKIES } from "./cookie-helpers";
+import { CreatePkcePair, PKCE_METHOD_S256 } from "./pkce-helpers";
+import { SSO_CONFIG } from "./sso-config";
+import { IRedirectContext } from "./sso-interfaces";
+
+const CALLBACK_SUFFIX = "/api/auth/callback";
+
+type EncodedRedirectContext = {
+  r: string;
+  s: string;
+  p: string;
+  c: string;
+  m: string;
+  v: string;
+  t: number;
+};
+
+const signPayload = (data: string): string => createHmac("sha256", SSO_CONFIG.COOKIE_CONFIG.COOKIE_SECRET).update(data).digest("base64url");
+
+export function SanitizeReturnPath(value?: string | null): string {
+  if (!value?.trim()) return "/";
+  const path = value.trim();
+  if (!path.startsWith("/") || path.startsWith("//")) return "/";
+  return path;
+}
+
+export function CreateOAuthNonce(): string {
+  return randomBytes(24).toString("base64url");
+}
+
+/** Validates client callback URLs to prevent open redirects. */
+export function IsAllowedRedirectUri(redirectUri: string): boolean {
+  try {
+    const url = new URL(redirectUri);
+    if (!url.pathname.endsWith(CALLBACK_SUFFIX)) return false;
+    if (url.username || url.password) return false;
+    if (url.protocol !== "http:" && url.protocol !== "https:") return false;
+    return URLS.ALLOWED_ORIGINS.includes(url.origin);
+  } catch {
+    return false;
+  }
+}
+
+export function EncodeRedirectContext(context: IRedirectContext): string {
+  const payload: EncodedRedirectContext = {
+    r: context.redirectUri,
+    s: context.state,
+    p: context.returnPath,
+    c: context.codeChallenge,
+    m: context.codeChallengeMethod,
+    v: context.pkceVerifier,
+    t: Date.now(),
+  };
+  const data = Buffer.from(JSON.stringify(payload), "utf8").toString("base64url");
+  return `${data}.${signPayload(data)}`;
+}
+
+export function DecodeRedirectContext(value?: string | null): IRedirectContext | null {
+  if (!value) return null;
+
+  try {
+    const [data, signature] = value.split(".");
+    if (!data || !signature) return null;
+
+    const expected = signPayload(data);
+    if (signature.length !== expected.length || !timingSafeEqual(Buffer.from(signature), Buffer.from(expected))) {
+      return null;
+    }
+
+    const payload = JSON.parse(Buffer.from(data, "base64url").toString("utf8")) as EncodedRedirectContext;
+    if (!payload?.r || !IsAllowedRedirectUri(payload.r)) return null;
+
+    const ageMs = Date.now() - (payload.t ?? 0);
+    if (ageMs > Number(SSO_CONFIG.BACKEND_CONFIG.REDIRECT_CONTEXT_MAX_AGE) * 1000) return null;
+
+    if (!payload.c || !payload.v) return null;
+
+    return {
+      redirectUri: payload.r,
+      state: payload.s ?? "",
+      returnPath: SanitizeReturnPath(payload.p),
+      codeChallenge: payload.c,
+      codeChallengeMethod: payload.m ?? PKCE_METHOD_S256,
+      pkceVerifier: payload.v,
+    };
+  } catch {
+    return null;
+  }
+}
+
+function createRedirectContext(redirectUri: string, returnPath?: string | null): IRedirectContext {
+  const pkce = CreatePkcePair();
+  return {
+    redirectUri,
+    state: CreateOAuthNonce(),
+    returnPath: SanitizeReturnPath(returnPath),
+    codeChallenge: pkce.challenge,
+    codeChallengeMethod: pkce.method,
+    pkceVerifier: pkce.verifier,
+  };
+}
+
+/** Read-only: resolve redirect context from cookie, or build an in-memory context from URL params (no cookie writes). */
+export async function ReadRedirectContext(redirectUri?: string | null, state?: string | null): Promise<IRedirectContext | null> {
+  const cookieStore = await cookies();
+  const fromCookie = DecodeRedirectContext(cookieStore.get(AUTH_COOKIES.redirectContext)?.value);
+
+  const trimmedUri = redirectUri?.trim();
+  if (trimmedUri && IsAllowedRedirectUri(trimmedUri)) {
+    if (fromCookie?.redirectUri === trimmedUri) {
+      return fromCookie;
+    }
+    return createRedirectContext(trimmedUri, state);
+  }
+
+  return fromCookie;
+}
+
+export function GetAuthCookieOptions(maxAge: number | string) {
+  return {
+    httpOnly: true,
+    path: "/",
+    sameSite: "lax" as const,
+    maxAge: Number(maxAge),
+    secure: process.env.NODE_ENV === "production",
+  };
+}
+
+export function GetRedirectContextCookieOptions() {
+  return GetAuthCookieOptions(SSO_CONFIG.BACKEND_CONFIG.REDIRECT_CONTEXT_MAX_AGE);
+}
+
+export function SetRedirectContextCookie(response: NextResponse, context: IRedirectContext) {
+  if (!IsAllowedRedirectUri(context.redirectUri)) return;
+  response.cookies.set(AUTH_COOKIES.redirectContext, EncodeRedirectContext(context), GetRedirectContextCookieOptions());
+}
+
+export function ClearRedirectContextCookie(response: NextResponse) {
+  response.cookies.set(AUTH_COOKIES.redirectContext, "", { ...GetRedirectContextCookieOptions(), maxAge: 0 });
+}

package/src/sso-config/redirect-context-persist.tsx

@@ -0,0 +1,18 @@
+"use client";
+
+import { useSearchParams } from "next/navigation";
+import { useEffect } from "react";
+import { PersistRedirectContext } from "./redirect-context-actions";
+
+/** Keeps redirect_uri/state in a secure httpOnly cookie across auth page navigations. */
+export function RedirectContextPersist() {
+  const searchParams = useSearchParams();
+  const redirectUri = searchParams.get("redirect_uri");
+  const state = searchParams.get("state");
+
+  useEffect(() => {
+    void PersistRedirectContext(redirectUri, state);
+  }, [redirectUri, state]);
+
+  return null;
+}

package/src/sso-config/redirect-context-route.tsx

@@ -0,0 +1,45 @@
+import { NextRequest, NextResponse } from "next/server";
+import { AUTH_COOKIES } from "./cookie-helpers";
+import { CreatePkcePair } from "./pkce-helpers";
+import {
+  CreateOAuthNonce,
+  DecodeRedirectContext,
+  IsAllowedRedirectUri,
+  SanitizeReturnPath,
+  SetRedirectContextCookie,
+} from "./redirect-context-helpers";
+
+/** Route Handler — persists redirect_uri/state in a signed cookie, then forwards to the auth sign-in page. */
+export async function RedirectContextRoute(req: NextRequest) {
+  const redirectUri = req.nextUrl.searchParams.get("redirect_uri");
+  const state = req.nextUrl.searchParams.get("state");
+
+  const signInUrl = new URL("/auth/sign-in", req.url);
+  if (redirectUri) signInUrl.searchParams.set("redirect_uri", redirectUri);
+  if (state) signInUrl.searchParams.set("state", state);
+
+  const response = NextResponse.redirect(signInUrl);
+  const trimmedUri = redirectUri?.trim();
+
+  if (!trimmedUri || !IsAllowedRedirectUri(trimmedUri)) {
+    return response;
+  }
+
+  const existing = DecodeRedirectContext(req.cookies.get(AUTH_COOKIES.redirectContext)?.value);
+  if (existing?.redirectUri === trimmedUri) {
+    SetRedirectContextCookie(response, existing);
+    return response;
+  }
+
+  const pkce = CreatePkcePair();
+  SetRedirectContextCookie(response, {
+    redirectUri: trimmedUri,
+    state: CreateOAuthNonce(),
+    returnPath: SanitizeReturnPath(state),
+    codeChallenge: pkce.challenge,
+    codeChallengeMethod: pkce.method,
+    pkceVerifier: pkce.verifier,
+  });
+
+  return response;
+}

package/src/sso-config/refresh-route.tsx

@@ -0,0 +1,22 @@
+import { NextRequest, NextResponse } from "next/server";
+import { HttpPost } from "../services/http-services";
+import { AUTH_COOKIES, GetDecryptedRequestCookie, SetAuthCookies } from "./cookie-helpers";
+import { SSO_CONFIG } from "./sso-config";
+import { SSOAuthResponse } from "./sso-interfaces";
+
+export async function RefreshRoute(req: NextRequest) {
+  const refreshToken = GetDecryptedRequestCookie(req, AUTH_COOKIES.refreshToken);
+  if (!refreshToken) return NextResponse.json({ error: "No refresh token" }, { status: 401 });
+
+  try {
+    const refreshRes = await HttpPost(SSO_CONFIG.BACKEND_ENDPOINTS.REFRESH, { refreshToken, clientSystemName: SSO_CONFIG.BACKEND_CONFIG.CLIENT_SYSTEM_NAME });
+    if (!refreshRes.isSuccess) return NextResponse.json({ error: "Refresh failed" }, { status: 401 });
+
+    const newTokens = refreshRes.result as SSOAuthResponse;
+    const response = NextResponse.json({ ok: true });
+    SetAuthCookies(response, newTokens);
+    return response;
+  } catch {
+    return NextResponse.json({ error: "Auth service unavailable" }, { status: 500 });
+  }
+}

package/src/sso-config/sign-in-route.tsx

@@ -0,0 +1,69 @@
+import { NextRequest, NextResponse } from "next/server";
+import { EErrorCodes, EExceptionCategories } from "../interfaces/exception-interfaces";
+import { GetResponse } from "../interfaces/http-interfaces";
+import { URLS } from "../nexus.environments";
+import { HttpPost } from "../services/http-services";
+import { AUTH_COOKIES, GetDecryptedRequestCookie, SetAuthCookies, SetSsoSessionCookie } from "./cookie-helpers";
+import { CreatePkcePair } from "./pkce-helpers";
+import { ClearRedirectContextCookie } from "./redirect-context-helpers";
+import { ExchangeAuthorizationCode, RequestAuthorizationCode } from "./sso-backend-flow";
+import { BuildAuthenticationSignInUrl, SSO_CONFIG } from "./sso-config";
+import { ILoginRequest, ILoginResponse } from "./sso-interfaces";
+
+function failRedirect(req: NextRequest) {
+  const returnPath = req.nextUrl.searchParams.get("state") ?? "/";
+  return NextResponse.redirect(new URL(BuildAuthenticationSignInUrl(returnPath)));
+}
+
+/** GET — exchange local sso_session for access tokens (identity provider app). */
+export async function SignInGetRoute(req: NextRequest) {
+  const ssoSession = GetDecryptedRequestCookie(req, AUTH_COOKIES.ssoSession);
+
+  if (!ssoSession) return failRedirect(req);
+
+  const pkce = CreatePkcePair();
+
+  try {
+    const code = await RequestAuthorizationCode({
+      ssoSession,
+      redirectUri: SSO_CONFIG.FRONTEND_ENDPOINTS.CALLBACK,
+      pkce,
+    });
+    if (!code) return failRedirect(req);
+
+    const tokenData = await ExchangeAuthorizationCode({
+      code,
+      redirectUri: SSO_CONFIG.FRONTEND_ENDPOINTS.CALLBACK,
+      codeVerifier: pkce.verifier,
+    });
+    if (!tokenData) return failRedirect(req);
+
+    const response = NextResponse.redirect(new URL(URLS.CURRENT!));
+    SetAuthCookies(response, tokenData);
+    ClearRedirectContextCookie(response);
+    return response;
+  } catch {
+    return failRedirect(req);
+  }
+}
+
+/** POST — username/password sign-in (identity provider app). */
+export async function SignInPostRoute(req: NextRequest) {
+  const body = (await req.json()) as ILoginRequest;
+  body.clientSystemName = SSO_CONFIG.BACKEND_CONFIG.CLIENT_SYSTEM_NAME;
+
+  if (!body.username?.trim() || !body.password) return NextResponse.json(GetResponse.ERROR("Username and password are required.", "USERNAME_AND_PASSWORD_REQUIRED", EExceptionCategories.Validation, EErrorCodes.FormatInvalid, "Username|Password"), { status: 400 });
+
+  const signInRes = await HttpPost(SSO_CONFIG.BACKEND_ENDPOINTS.SIGN_IN, body);
+
+  const signInResult = signInRes?.result as ILoginResponse;
+
+  if (signInResult?.ssoSession) signInResult.redirectUrl = SSO_CONFIG.FRONTEND_ENDPOINTS.SSO_COMPLETE;
+
+  if (!signInRes.isSuccess || !signInResult?.ssoSession) return NextResponse.json(signInRes, { status: signInRes.code ?? 401 });
+
+  const response = NextResponse.json(signInRes);
+
+  SetSsoSessionCookie(response, signInResult.ssoSession, SSO_CONFIG.BACKEND_CONFIG.SSO_SESSION_MAX_AGE);
+  return response;
+}