nexus-shared 1.1.18 → 1.1.20

package/src/sso-config/sign-up-route.tsx

@@ -0,0 +1,57 @@
+import { NextRequest, NextResponse } from "next/server";
+import { HttpPost } from "../services/http-services";
+import { AUTH_COOKIES, ResolvePostLoginRedirectUrl, SetSsoSessionCookie } from "./cookie-helpers";
+import { DecodeRedirectContext } from "./redirect-context-helpers";
+import { GetClientConfiguration } from "./sso-backend-flow";
+import { SSO_CONFIG } from "./sso-config";
+import { ISignUpRequest } from "./sso-interfaces";
+import { ParseWrappedResult } from "./sso-response-helpers";
+
+const mapGender = (gender?: string | null) => {
+  const normalized = gender?.trim().toLowerCase();
+  if (normalized === "male") return 0;
+  if (normalized === "female") return 1;
+  return 2;
+};
+
+/** POST — register a new account (identity provider app). */
+export async function SignUpPostRoute(req: NextRequest) {
+  const body = (await req.json()) as ISignUpRequest & { confirmPassword?: string };
+
+  if (!body.fullName?.trim() || !body.username?.trim() || !body.email?.trim() || !body.password || !body.confirmPassword) {
+    return NextResponse.json({ error: "All required fields must be provided." }, { status: 400 });
+  }
+
+  if (body.password !== body.confirmPassword) {
+    return NextResponse.json({ error: "Passwords do not match." }, { status: 400 });
+  }
+
+  const signUpRes = await HttpPost(SSO_CONFIG.BACKEND_ENDPOINTS.SIGN_UP, {
+    fullname: body.fullName.trim(),
+    username: body.username.trim(),
+    password: body.password,
+    confirmPassword: body.confirmPassword,
+    genderType: mapGender(body.gender),
+    emailAddress: body.email.trim(),
+    contactNumber: null,
+    clientSystemName: SSO_CONFIG.BACKEND_CONFIG.CLIENT_SYSTEM_NAME,
+  });
+
+  const signUpResult = ParseWrappedResult<{ ssoSession: string }>(signUpRes);
+  if (!signUpRes.isSuccess || !signUpResult?.ssoSession) {
+    return NextResponse.json(signUpRes, { status: signUpRes.code ?? 400 });
+  }
+
+  const ssoConfiguration = await GetClientConfiguration();
+  const redirectContext = DecodeRedirectContext(req.cookies.get(AUTH_COOKIES.redirectContext)?.value);
+
+  const response = NextResponse.json({
+    ...signUpRes,
+    result: {
+      ...signUpResult,
+      redirectUrl: ResolvePostLoginRedirectUrl(!!redirectContext?.redirectUri),
+    },
+  });
+  SetSsoSessionCookie(response, signUpResult.ssoSession, ssoConfiguration.ssoSessionLifetime);
+  return response;
+}

package/src/sso-config/sso-backend-flow.ts

@@ -0,0 +1,38 @@
+import { NEXUS_CONFIG } from "../nexus.environments";
+import { HttpGet, HttpPost } from "../services/http-services";
+import { SSO_CONFIG } from "./sso-config";
+import { IClientApplication, PKCE_METHOD_S256, SSOAuthResponse, SsoExchangeInput, TokenExchangeInput } from "./sso-interfaces";
+import { ParseSsoCodeResponse, ParseTokenResponse } from "./sso-response-helpers";
+
+/** Server-only: request an authorization code using client policy + PKCE. */
+export async function RequestAuthorizationCode(input: SsoExchangeInput): Promise<string | null> {
+  const ssoRes = await HttpPost(SSO_CONFIG.BACKEND_ENDPOINTS.SSO, {
+    ssoSession: input.ssoSession,
+    redirectUri: input.redirectUri,
+    state: input.state,
+    returnPath: input.returnPath,
+    codeChallenge: input.pkce.challenge,
+    codeChallengeMethod: input.pkce.method ?? PKCE_METHOD_S256,
+  });
+
+  return ParseSsoCodeResponse(ssoRes);
+}
+
+/** Server-only: exchange authorization code for tokens. */
+export async function ExchangeAuthorizationCode(input: TokenExchangeInput): Promise<SSOAuthResponse | null> {
+  const tokenRes = await HttpPost(SSO_CONFIG.BACKEND_ENDPOINTS.TOKEN, {
+    code: input.code,
+    redirectUri: input.redirectUri,
+    clientSystemName: SSO_CONFIG.BACKEND_CONFIG.CLIENT_SYSTEM_NAME,
+    codeVerifier: input.codeVerifier,
+  });
+
+  return ParseTokenResponse(tokenRes);
+}
+
+/** Server-only: get client configuration from the backend. */
+export async function GetClientConfiguration(): Promise<IClientApplication> {
+  const clientConfigRes = await HttpGet(SSO_CONFIG.BACKEND_ENDPOINTS.CLIENT_CONFIG, null, NEXUS_CONFIG.DEFAULT_REVALIDATE_TIME_ONE_DAY);
+  if (!clientConfigRes.isSuccess) throw new Error("Failed to get client configuration");
+  return clientConfigRes.result;
+}

package/src/sso-config/sso-complete-route.tsx

@@ -0,0 +1,50 @@
+import { NextRequest, NextResponse } from "next/server";
+import { AUTH_COOKIES, GetDecryptedRequestCookie } from "./cookie-helpers";
+import { EncodeOAuthCallbackState } from "./oauth-callback-state";
+import { ClearRedirectContextCookie, DecodeRedirectContext } from "./redirect-context-helpers";
+import { RequestAuthorizationCode } from "./sso-backend-flow";
+import { BuildAuthenticationSignInUrl, SSO_CONFIG } from "./sso-config";
+import { PKCE_METHOD_S256, PkcePair } from "./sso-interfaces";
+
+function buildSignInRedirect(redirectContext: ReturnType<typeof DecodeRedirectContext>) {
+  return new URL(BuildAuthenticationSignInUrl(redirectContext?.returnPath));
+}
+
+/** Completes SSO after credentials sign-in: exchange session for code and redirect to the client callback. */
+export async function SsoCompleteRoute(req: NextRequest) {
+  const ssoSession = GetDecryptedRequestCookie(req, AUTH_COOKIES.ssoSession);
+  const redirectContext = DecodeRedirectContext(req.cookies.get(AUTH_COOKIES.redirectContext)?.value);
+
+  if (!ssoSession) {
+    return NextResponse.redirect(buildSignInRedirect(redirectContext));
+  }
+
+  if (!redirectContext?.redirectUri) {
+    return NextResponse.redirect(new URL(SSO_CONFIG.FRONTEND_ENDPOINTS.SIGN_IN, req.url));
+  }
+
+  const pkce: PkcePair = {
+    verifier: redirectContext.pkceVerifier,
+    challenge: redirectContext.codeChallenge,
+    method: (redirectContext.codeChallengeMethod as PkcePair["method"]) ?? PKCE_METHOD_S256,
+  };
+
+  try {
+    const code = await RequestAuthorizationCode({
+      ssoSession,
+      redirectUri: redirectContext.redirectUri,
+      state: redirectContext.state,
+      returnPath: redirectContext.returnPath,
+      pkce,
+    });
+    if (!code) return NextResponse.redirect(buildSignInRedirect(redirectContext));
+
+    const callbackState = EncodeOAuthCallbackState(redirectContext.state, redirectContext.returnPath, pkce.verifier);
+    const location = `${redirectContext.redirectUri}?code=${encodeURIComponent(code)}&state=${encodeURIComponent(callbackState)}`;
+    const response = NextResponse.redirect(location);
+    ClearRedirectContextCookie(response);
+    return response;
+  } catch {
+    return NextResponse.redirect(buildSignInRedirect(redirectContext));
+  }
+}

package/src/sso-config/sso-config.ts

@@ -0,0 +1,59 @@
+import { APIS, URLS } from "nexus-shared";
+
+const _callbackPath = `${URLS.CURRENT}/api/auth/callback`;
+
+// @ts-ignore
+const processEnv = process.env;
+
+export const SSO_CONFIG = {
+  COOKIE_CONFIG: {
+    COOKIE_SECRET: processEnv.SSO_COOKIE_SECRET as string,
+  },
+  BACKEND_ENDPOINTS: {
+    SIGN_IN: `${APIS.AUTHENTICATION}/Authentication/SignIn`,
+    SIGN_UP: `${APIS.AUTHENTICATION}/Authentication/SignUp`,
+    SSO: `${APIS.AUTHENTICATION}/Authentication/SSO`,
+    TOKEN: `${APIS.AUTHENTICATION}/Authentication/Token`,
+    REFRESH: `${APIS.AUTHENTICATION}/Authentication/Refresh`,
+    SIGN_OUT: `${APIS.AUTHENTICATION}/Authentication/SignOut`,
+    PROVIDERS: `${APIS.AUTHENTICATION}/Authentication/Providers`,
+    CLIENT_CONFIG: `${APIS.AUTHENTICATION}/Authentication/ClientConfig/${processEnv.AUTH_CLIENT_SYSTEM_NAME}`,
+    FORGOT_PASSWORD: `${APIS.AUTHENTICATION}/Authentication/ForgotPassword`,
+    RESET_PASSWORD: `${APIS.AUTHENTICATION}/Authentication/ResetPassword`,
+    /** Used by VerifyAccessToken — returns 200 for a valid Bearer token, 401 otherwise. */
+    VERIFY: `${APIS.AUTHENTICATION}/Authentication/Verify`,
+    PROVIDER_CHALLENGE: (provider: string, returnUrl: string, clientSystemName: string) => `${APIS.AUTHENTICATION}/Provider/${provider}/Challenge?returnUrl=${encodeURIComponent(returnUrl)}&clientSystemName=${encodeURIComponent(clientSystemName)}`,
+  },
+  BACKEND_CONFIG: {
+    /** Matches AuthenticationOptions.DefaultClientSystemName (NEXUS_WEB_APPLICATION_API). */
+    CLIENT_SYSTEM_NAME: processEnv.AUTH_CLIENT_SYSTEM_NAME as string,
+    /** How long redirect_uri/state survive in a secure httpOnly cookie on the auth app (seconds). */
+    REDIRECT_CONTEXT_MAX_AGE: processEnv.REDIRECT_CONTEXT_MAX_AGE as string,
+  },
+  FRONTEND_ENDPOINTS: {
+    CALLBACK: _callbackPath,
+    SIGN_IN: `${URLS.CURRENT}/api/auth/sign-in`,
+    SIGN_UP: `${URLS.CURRENT}/api/auth/sign-up`,
+    SIGN_OUT: `${URLS.CURRENT}/api/auth/sign-out`,
+    REFRESH: `${URLS.CURRENT}/api/auth/refresh`,
+    SSO_COMPLETE: `${URLS.CURRENT}/api/auth/sso-complete`,
+    PROVIDER_COMPLETE: `${URLS.CURRENT}/api/auth/provider-complete`,
+    FORGOT_PASSWORD: `${URLS.CURRENT}/api/auth/forgot-password`,
+    RESET_PASSWORD: `${URLS.CURRENT}/api/auth/reset-password`,
+  },
+} as const;
+
+/** Client-app entry URL for centralized sign-in (includes redirect_uri + optional return path). */
+export function BuildAuthenticationSignInUrl(returnPath?: string) {
+  const entryUrl = new URL(`${URLS.AUTHENTICATION}/api/auth/redirect-context`);
+  entryUrl.searchParams.set("redirect_uri", SSO_CONFIG.FRONTEND_ENDPOINTS.CALLBACK);
+  if (returnPath) entryUrl.searchParams.set("state", returnPath);
+  return entryUrl.toString();
+}
+
+/** Sign-out URL that returns the user to a page on this app after cookies are cleared. */
+export function BuildSignOutUrl(returnPath?: string) {
+  const signOutUrl = new URL(SSO_CONFIG.FRONTEND_ENDPOINTS.SIGN_OUT);
+  if (returnPath) signOutUrl.searchParams.set("returnUrl", returnPath);
+  return signOutUrl.toString();
+}

package/src/sso-config/sso-interfaces.tsx

@@ -0,0 +1,99 @@
+import { UN } from "../interfaces/type-interfaces";
+
+export const PKCE_METHOD_S256 = "S256";
+
+export interface SSOAuthResponse {
+  accessToken: string;
+  refreshToken: string;
+  expiresTokenIn: number;
+  expiresRefreshTokenIn: number;
+  returnPath?: string;
+}
+
+export interface CookieInfo {
+  ssoSession?: string;
+  accessToken?: string | UN;
+  refreshToken?: string;
+}
+
+export interface IRedirectContext {
+  redirectUri: string;
+  /** OAuth CSRF nonce sent to the client callback. */
+  state: string;
+  /** Relative path to return to after sign-in completes. */
+  returnPath: string;
+  /** PKCE code challenge (stored server-side until SSO). */
+  codeChallenge: string;
+  codeChallengeMethod: string;
+  /** PKCE verifier (server-side only; also embedded in signed callback state). */
+  pkceVerifier: string;
+}
+
+export interface ISignInParams {
+  redirect_uri: string | UN;
+  state: string | UN;
+}
+
+export interface ISsoSessionResponse {
+  code: string;
+}
+
+export interface ILoginRequest {
+  username: string;
+  password: string;
+  rememberMe: boolean;
+  clientSystemName: string;
+}
+
+export interface ILoginResponse {
+  ssoSession: string;
+  displayName: string;
+  role: string;
+  userId: number;
+  redirectUrl?: string;
+}
+
+export interface ISignUpRequest {
+  fullName: string;
+  gender?: string | UN;
+  username: string;
+  email: string;
+  password: string;
+}
+
+export interface IDemoUserInfo {
+  id: number;
+  username: string;
+  email: string;
+  displayName: string;
+  role: string;
+  passwordHint: string;
+}
+
+export type SsoExchangeInput = {
+  ssoSession: string;
+  redirectUri: string;
+  state?: string;
+  returnPath?: string;
+  pkce: PkcePair;
+};
+
+export type TokenExchangeInput = {
+  code: string;
+  redirectUri: string;
+  codeVerifier: string;
+};
+export type PkcePair = {
+  verifier: string;
+  challenge: string;
+  method: typeof PKCE_METHOD_S256;
+};
+
+export interface IClientApplication {
+  requirePkce: boolean;
+  accessTokenLifetime: number;
+  refreshTokenLifetime: number;
+  authorizationCodeLifetime: number;
+  ssoSessionLifetime: number;
+  allowOfflineAccess: boolean;
+}

package/src/sso-config/sso-response-helpers.tsx

@@ -0,0 +1,20 @@
+import { IErrorRespose, ISuccessResponse } from "../interfaces/http-interfaces";
+import { ISsoSessionResponse, SSOAuthResponse } from "./sso-interfaces";
+
+type ApiResponse = ISuccessResponse | IErrorRespose;
+
+export function ParseWrappedResult<T>(response: ApiResponse): T | null {
+  if (!response.isSuccess) return null;
+  return (response.result ?? null) as T | null;
+}
+
+export function ParseSsoCodeResponse(response: ApiResponse): string | null {
+  const result = ParseWrappedResult<ISsoSessionResponse | { code?: string }>(response);
+  if (!result) return null;
+  if ("code" in result && result.code) return result.code;
+  return null;
+}
+
+export function ParseTokenResponse(response: ApiResponse): SSOAuthResponse | null {
+  return ParseWrappedResult<SSOAuthResponse>(response);
+}

package/src/sso-server.tsx

@@ -1 +1,21 @@
-export {};
+export * from "./sso-config/oauth-callback-state";
+export * from "./sso-config/pkce-helpers";
+export * from "./sso-config/sso-backend-flow";
+export * from "./sso-config/auth-token-validation";
+export * from "./sso-config/callback-route";
+export * from "./sso-config/cookie-helpers";
+export * from "./sso-config/redirect-context-actions";
+export * from "./sso-config/redirect-context-helpers";
+export * from "./sso-config/redirect-context-route";
+export * from "./sso-config/redirect-context-persist";
+export * from "./sso-config/refresh-route";
+export * from "./sso-config/sign-in-route";
+export * from "./sso-config/sign-out-route";
+export * from "./sso-config/sign-up-route";
+export * from "./sso-config/sso-response-helpers";
+export * from "./sso-config/forgot-password-route";
+export * from "./sso-config/provider-complete-route";
+export * from "./sso-config/sso-complete-route";
+export * from "./sso-config/sso-config";
+export * from "./sso-config/sso-interfaces";
+export * from "./sso-config/sso-response-helpers";

package/src/styles/nexus.dialog.css

@@ -8,6 +8,9 @@
   z-index: 100 !important;
   cursor: default;
 }
+.nexus-message {
+  z-index: 100000 !important;
+}
 
 .dialog.left::before,
 .dialog.right::before,

package/src/styles/nexus.icon.css

@@ -22,6 +22,7 @@
   transition: var(--ANIM);
   font-size: var(--IS);
   pointer-events: none !important;
+  --ionicon-stroke-width: 2rem;
 }
 
 .ib.h:hover > .icon {

package/src/styles/nexus.logic.css

@@ -1,18 +1,47 @@
+:root {
+  --ACTIVE_BACKGROUND_COLOR: var(--B1);
+  --ACTIVE_BORDER_COLOR: var(--B20);
+  --ACTIVE_TEXT_COLOR: var(--T1);
+}
+.item .ho1 {
+  opacity: 0;
+}
+
 .ho1:hover {
   opacity: 1;
 }
-.btn.active {
-  font-weight: 500;
-}
-.btn.active {
+.btn.active,
+.btn.left-active {
   background-color: var(--ACTIVE_BACKGROUND_COLOR) !important;
   pointer-events: none;
+  border-radius: 0 !important;
+  opacity: 1 !important;
 }
-.btn.active::after {
+.btn.active::after,
+.btn.left-active::after {
   content: " ";
   position: absolute;
   width: 100%;
   height: var(--BRD2);
   bottom: 0;
+  left: 0;
   background-color: var(--ACTIVE_BORDER_COLOR);
 }
+
+.btn.left-active::after {
+  width: calc(var(--BRD2) * 3) !important;
+  height: 100% !important;
+  bottom: unset;
+  top: 0;
+}
+
+.btn.active,
+.btn.left-active,
+.btn.active span,
+.btn.active .icon,
+.btn.left-active .icon,
+.btn.left-active span {
+  color: var(--ACTIVE_TEXT_COLOR) !important;
+  font-weight: 600 !important;
+  opacity: 1 !important;
+}

package/src/interfaces/sso-interfaces.tsx

@@ -1,52 +0,0 @@
-import { UN } from "nexus-shared";
-export interface SSOAuthResponse {
-  accessToken: string;
-  refreshToken: string;
-  expiresTokenIn: number;
-  expiresRefreshTokenIn: number;
-  returnPath?: string;
-}
-
-export interface CookieInfo {
-  ssoSession: string;
-  accessToken: string | UN;
-  refreshToken: string | UN;
-}
-
-export interface IRedirectContext {
-  redirectUri: string;
-  /** OAuth CSRF nonce sent to the client callback. */
-  state: string;
-  /** Relative path to return to after sign-in completes. */
-  returnPath: string;
-}
-
-export interface ISignInParams {
-  redirect_uri: string | UN;
-  state: string | UN;
-}
-
-export interface ISsoSessionResponse {
-  code: string;
-}
-
-export interface ILoginRequest {
-  username: string;
-  password: string;
-}
-
-export interface ILoginResponse {
-  ssoSession: string;
-  displayName: string;
-  role: string;
-  userId: number;
-}
-
-export interface IDemoUserInfo {
-  id: number;
-  username: string;
-  email: string;
-  displayName: string;
-  role: string;
-  passwordHint: string;
-}

package/src/load-env.ts

@@ -1,2 +0,0 @@
-/** Loads environment variables for nexus-shared consumers (no-op when Next.js already loaded .env). */
-export {};