nexus-shared 1.1.20 → 2.0.0

package/src/sso-config/cookie-helpers.tsx

@@ -1,102 +0,0 @@
-import { cookies } from "next/headers";
-import { NextRequest, NextResponse } from "next/server";
-import { VerifyAccessToken } from "./auth-token-validation";
-import { DecryptCookieValue, EncryptCookieValue } from "./cookie-encryption";
-import { GetAuthCookieOptions } from "./redirect-context-helpers";
-import { CookieInfo, SSOAuthResponse } from "./sso-interfaces";
-import { SSO_CONFIG } from "./sso-config";
-
-export const AUTH_COOKIES = {
-  ssoSession: "sso_session",
-  accessToken: "access_token",
-  refreshToken: "refresh_token",
-  redirectContext: "sso_redirect_ctx",
-} as const;
-
-export function SetAuthCookies(response: NextResponse, tokens: SSOAuthResponse) {
-  response.cookies.set(AUTH_COOKIES.accessToken, EncryptCookieValue(tokens.accessToken), GetAuthCookieOptions(tokens.expiresTokenIn));
-  response.cookies.set(AUTH_COOKIES.refreshToken, EncryptCookieValue(tokens.refreshToken), GetAuthCookieOptions(tokens.expiresRefreshTokenIn));
-}
-
-export function SetSsoSessionCookie(response: NextResponse, ssoSession: string, maxAge: number | string) {
-  response.cookies.set(AUTH_COOKIES.ssoSession, EncryptCookieValue(ssoSession), GetAuthCookieOptions(maxAge ?? 28800));
-}
-
-export function ClearAuthCookies(response: NextResponse) {
-  response.cookies.set(AUTH_COOKIES.accessToken, "", GetAuthCookieOptions(0));
-  response.cookies.set(AUTH_COOKIES.refreshToken, "", GetAuthCookieOptions(0));
-  response.cookies.set(AUTH_COOKIES.ssoSession, "", GetAuthCookieOptions(0));
-}
-
-/**
- * Reads and decrypts a single auth cookie from an incoming NextRequest.
- * Returns null when the cookie is absent or the encrypted value is tampered / unreadable.
- */
-export function GetDecryptedRequestCookie(req: NextRequest, name: string): string | null {
-  const raw = req.cookies.get(name)?.value;
-  if (!raw) return null;
-  return DecryptCookieValue(raw);
-}
-
-export async function GetCookieInfo(): Promise<CookieInfo | null> {
-  const cookieStore = await cookies();
-
-  const rawRefreshToken = cookieStore.get(AUTH_COOKIES.refreshToken)?.value;
-  const refreshToken = rawRefreshToken ? (DecryptCookieValue(rawRefreshToken) ?? undefined) : undefined;
-
-  const rawSsoSession = cookieStore.get(AUTH_COOKIES.ssoSession)?.value;
-  const ssoSession = rawSsoSession ? (DecryptCookieValue(rawSsoSession) ?? undefined) : undefined;
-
-  const rawAccessToken = cookieStore.get(AUTH_COOKIES.accessToken)?.value;
-  const accessToken = rawAccessToken ? (DecryptCookieValue(rawAccessToken) ?? undefined) : undefined;
-
-  if (!refreshToken && !ssoSession) return null;
-
-  return {
-    ssoSession,
-    accessToken,
-    refreshToken,
-  };
-}
-
-/** Where to send the browser after credentials or provider sign-in succeeds. */
-export function ResolvePostLoginRedirectUrl(hasRedirectContext: boolean): string {
-  return hasRedirectContext ? SSO_CONFIG.FRONTEND_ENDPOINTS.SSO_COMPLETE : SSO_CONFIG.FRONTEND_ENDPOINTS.SIGN_IN;
-}
-
-/**
- * When the user already has auth cookies, returns the next URL (or null to show sign-in).
- * - refresh token → home or SSO complete for an external client
- * - sso session only → token exchange (GET sign-in) or SSO complete
- */
-export async function ResolveAuthenticatedRedirect(redirectContextUri?: string | null): Promise<string | null> {
-  const cookieInfo = await GetCookieInfo();
-  if (!cookieInfo) return null;
-
-  if (cookieInfo.refreshToken) {
-    return redirectContextUri ? SSO_CONFIG.FRONTEND_ENDPOINTS.SSO_COMPLETE : "/home";
-  }
-
-  if (cookieInfo.ssoSession) {
-    return redirectContextUri ? SSO_CONFIG.FRONTEND_ENDPOINTS.SSO_COMPLETE : SSO_CONFIG.FRONTEND_ENDPOINTS.SIGN_IN;
-  }
-
-  return null;
-}
-
-/** True when this client app has a valid access token (use on all non-auth client sites). */
-export async function HasAccessToken(backendValidation: boolean = false): Promise<boolean> {
-  const cookieStore = await cookies();
-  const rawRefreshToken = cookieStore.get(AUTH_COOKIES.refreshToken)?.value;
-  const refreshToken = rawRefreshToken ? DecryptCookieValue(rawRefreshToken) : null;
-  if (!refreshToken) return false;
-
-  const rawAccessToken = cookieStore.get(AUTH_COOKIES.accessToken)?.value;
-  const accessToken = rawAccessToken ? DecryptCookieValue(rawAccessToken) : null;
-
-  if (!accessToken && !backendValidation) return true;
-
-  if (!accessToken) return false;
-
-  return VerifyAccessToken(accessToken);
-}

package/src/sso-config/forgot-password-route.tsx

@@ -1,36 +0,0 @@
-import { NextRequest, NextResponse } from "next/server";
-import { HttpPost } from "../services/http-services";
-import { SSO_CONFIG } from "./sso-config";
-
-export async function ForgotPasswordPostRoute(req: NextRequest) {
-  const body = (await req.json()) as { usernameOrEmail?: string };
-  if (!body.usernameOrEmail?.trim()) {
-    return NextResponse.json({ error: "Username or email is required." }, { status: 400 });
-  }
-
-  const response = await HttpPost(SSO_CONFIG.BACKEND_ENDPOINTS.FORGOT_PASSWORD, {
-    usernameOrEmail: body.usernameOrEmail.trim(),
-  });
-
-  if (!response.isSuccess) {
-    return NextResponse.json(response, { status: response.code ?? 400 });
-  }
-
-  return NextResponse.json(response);
-}
-
-export async function ResetPasswordPostRoute(req: NextRequest) {
-  const body = (await req.json()) as {
-    resetSessionToken?: string;
-    verificationCode?: string;
-    newPassword?: string;
-    confirmPassword?: string;
-  };
-
-  const response = await HttpPost(SSO_CONFIG.BACKEND_ENDPOINTS.RESET_PASSWORD, body);
-  if (!response.isSuccess) {
-    return NextResponse.json(response, { status: response.code ?? 400 });
-  }
-
-  return NextResponse.json(response);
-}

package/src/sso-config/oauth-callback-state.ts

@@ -1,61 +0,0 @@
-import { createHmac, timingSafeEqual } from "crypto";
-import { SanitizeReturnPath } from "./redirect-context-helpers";
-
-type EncodedCallbackState = {
-  n: string;
-  p: string;
-  v: string;
-  t: number;
-};
-
-// @ts-ignore
-const processEnv = process.env;
-
-function getCookieSecret(): string {
-  const ssoSecret = processEnv.SSO_COOKIE_SECRET?.trim();
-  const secret = ssoSecret && !ssoSecret.startsWith("$") ? ssoSecret : undefined;
-  if (secret) return secret;
-  if (processEnv.NODE_ENV === "development") return "NexusDevAuthSecretKey2026MustBe32CharsLong!";
-  throw new Error("SSO_COOKIE_SECRET must be configured.");
-}
-
-function signPayload(data: string): string {
-  return createHmac("sha256", getCookieSecret()).update(data).digest("base64url");
-}
-
-/** Signed OAuth callback state (nonce + return path + PKCE verifier). */
-export function EncodeOAuthCallbackState(nonce: string, returnPath: string, codeVerifier: string): string {
-  const payload: EncodedCallbackState = {
-    n: nonce,
-    p: SanitizeReturnPath(returnPath),
-    v: codeVerifier,
-    t: Date.now(),
-  };
-  const data = Buffer.from(JSON.stringify(payload), "utf8").toString("base64url");
-  return `${data}.${signPayload(data)}`;
-}
-
-export function DecodeOAuthCallbackState(value?: string | null): { nonce: string; returnPath: string; codeVerifier: string } | null {
-  if (!value) return null;
-
-  try {
-    const [data, signature] = value.split(".");
-    if (!data || !signature) return null;
-
-    const expected = signPayload(data);
-    if (signature.length !== expected.length || !timingSafeEqual(Buffer.from(signature), Buffer.from(expected))) {
-      return null;
-    }
-
-    const payload = JSON.parse(Buffer.from(data, "base64url").toString("utf8")) as EncodedCallbackState;
-    if (!payload?.n || !payload?.v) return null;
-
-    return {
-      nonce: payload.n,
-      returnPath: SanitizeReturnPath(payload.p),
-      codeVerifier: payload.v,
-    };
-  } catch {
-    return null;
-  }
-}

package/src/sso-config/pkce-helpers.ts

@@ -1,9 +0,0 @@
-import { createHash, randomBytes } from "crypto";
-import { PKCE_METHOD_S256, PkcePair } from "./sso-interfaces";
-
-/** Creates an OAuth PKCE pair (RFC 7636) using S256. */
-export function CreatePkcePair(): PkcePair {
-  const verifier = randomBytes(32).toString("base64url");
-  const challenge = createHash("sha256").update(verifier).digest("base64url");
-  return { verifier, challenge, method: PKCE_METHOD_S256 };
-}

package/src/sso-config/provider-complete-route.tsx

@@ -1,18 +0,0 @@
-import { NextRequest, NextResponse } from "next/server";
-import { AUTH_COOKIES, ResolvePostLoginRedirectUrl, SetSsoSessionCookie } from "./cookie-helpers";
-import { DecodeRedirectContext } from "./redirect-context-helpers";
-import { GetClientConfiguration } from "./sso-backend-flow";
-
-/** GET — complete provider OAuth by persisting the backend SSO session cookie. */
-export async function ProviderCompleteRoute(req: NextRequest) {
-  const signInUrl = new URL("/auth/sign-in", req.url);
-  const ssoSession = req.nextUrl.searchParams.get("ssoSession");
-
-  if (!ssoSession) return NextResponse.redirect(signInUrl);
-  const ssoConfiguration = await GetClientConfiguration();
-
-  const redirectContext = DecodeRedirectContext(req.cookies.get(AUTH_COOKIES.redirectContext)?.value);
-  const response = NextResponse.redirect(new URL(ResolvePostLoginRedirectUrl(!!redirectContext?.redirectUri), req.url));
-  SetSsoSessionCookie(response, ssoSession, ssoConfiguration.ssoSessionLifetime);
-  return response;
-}

package/src/sso-config/redirect-context-actions.tsx

@@ -1,45 +0,0 @@
-"use server";
-
-import { cookies } from "next/headers";
-import { AUTH_COOKIES } from "./cookie-helpers";
-import { CreatePkcePair } from "./pkce-helpers";
-import { ClearRedirectContextStore, CreateOAuthNonce, DecodeRedirectContext, EncodeRedirectContext, GetRedirectContextCookieOptions, IsAllowedRedirectUri, SanitizeReturnPath } from "./redirect-context-helpers";
-import { IRedirectContext } from "./sso-interfaces";
-
-function ReadRedirectContextFromStore(cookieStore: Awaited<ReturnType<typeof cookies>>): IRedirectContext | null {
-  return DecodeRedirectContext(cookieStore.get(AUTH_COOKIES.redirectContext)?.value);
-}
-
-function WriteRedirectContextToStore(cookieStore: Awaited<ReturnType<typeof cookies>>, context: IRedirectContext) {
-  cookieStore.set(AUTH_COOKIES.redirectContext, EncodeRedirectContext(context), GetRedirectContextCookieOptions());
-}
-
-/** Server Action — persists redirect_uri/state into a signed httpOnly cookie. */
-export async function PersistRedirectContext(redirectUri?: string | null, state?: string | null) {
-  const cookieStore = await cookies();
-  const trimmedUri = redirectUri?.trim();
-
-  if (trimmedUri && IsAllowedRedirectUri(trimmedUri)) {
-    const existing = ReadRedirectContextFromStore(cookieStore);
-    if (existing?.redirectUri === trimmedUri) return;
-
-    const pkce = CreatePkcePair();
-    WriteRedirectContextToStore(cookieStore, {
-      redirectUri: trimmedUri,
-      state: CreateOAuthNonce(),
-      returnPath: SanitizeReturnPath(state),
-      codeChallenge: pkce.challenge,
-      codeChallengeMethod: pkce.method,
-      pkceVerifier: pkce.verifier,
-    });
-    return;
-  }
-
-  const existing = ReadRedirectContextFromStore(cookieStore);
-  if (existing) WriteRedirectContextToStore(cookieStore, existing);
-}
-
-/** Server Action — clears the redirect context cookie after SSO completes. */
-export async function ClearRedirectContext() {
-  await ClearRedirectContextStore();
-}

package/src/sso-config/redirect-context-helpers.tsx

@@ -1,159 +0,0 @@
-import { createHmac, randomBytes, timingSafeEqual } from "crypto";
-import { cookies } from "next/headers";
-import { NextResponse } from "next/server";
-import { NEXUS_INFO, URLS } from "../nexus.environments";
-import { AUTH_COOKIES } from "./cookie-helpers";
-import { CreatePkcePair } from "./pkce-helpers";
-import { SSO_CONFIG } from "./sso-config";
-import { IRedirectContext, PKCE_METHOD_S256 } from "./sso-interfaces";
-
-// @ts-ignore
-const processEnv = process.env;
-const CALLBACK_SUFFIX = "/api/auth/callback";
-
-type EncodedRedirectContext = {
-  r: string;
-  s: string;
-  p: string;
-  c: string;
-  m: string;
-  v: string;
-  t: number;
-};
-
-const signPayload = (data: string): string => createHmac("sha256", SSO_CONFIG.COOKIE_CONFIG.COOKIE_SECRET).update(data).digest("base64url");
-
-export function SanitizeReturnPath(value?: string | null): string {
-  if (!value?.trim()) return "/";
-  const path = value.trim();
-  if (!path.startsWith("/") || path.startsWith("//")) return "/";
-  return path;
-}
-
-export function CreateOAuthNonce(): string {
-  return randomBytes(24).toString("base64url");
-}
-
-/** Validates client callback URLs to prevent open redirects. */
-export function IsAllowedRedirectUri(redirectUri: string): boolean {
-  try {
-    const url = new URL(redirectUri);
-    if (!url.pathname.endsWith(CALLBACK_SUFFIX)) return false;
-    if (url.username || url.password) return false;
-    if (url.protocol !== "http:" && url.protocol !== "https:") return false;
-    return URLS.ALLOWED_ORIGINS.includes(url.origin);
-  } catch {
-    return false;
-  }
-}
-
-export function EncodeRedirectContext(context: IRedirectContext): string {
-  const payload: EncodedRedirectContext = {
-    r: context.redirectUri,
-    s: context.state,
-    p: context.returnPath,
-    c: context.codeChallenge,
-    m: context.codeChallengeMethod,
-    v: context.pkceVerifier,
-    t: Date.now(),
-  };
-  const data = Buffer.from(JSON.stringify(payload), "utf8").toString("base64url");
-  return `${data}.${signPayload(data)}`;
-}
-
-export function DecodeRedirectContext(value?: string | null): IRedirectContext | null {
-  if (!value) return null;
-
-  try {
-    const [data, signature] = value.split(".");
-    if (!data || !signature) return null;
-
-    const expected = signPayload(data);
-    if (signature.length !== expected.length || !timingSafeEqual(Buffer.from(signature), Buffer.from(expected))) {
-      return null;
-    }
-
-    const payload = JSON.parse(Buffer.from(data, "base64url").toString("utf8")) as EncodedRedirectContext;
-    if (!payload?.r || !IsAllowedRedirectUri(payload.r)) return null;
-
-    const ageMs = Date.now() - (payload.t ?? 0);
-    if (ageMs > Number(SSO_CONFIG.BACKEND_CONFIG.REDIRECT_CONTEXT_MAX_AGE) * 1000) return null;
-
-    if (!payload.c || !payload.v) return null;
-
-    return {
-      redirectUri: payload.r,
-      state: payload.s ?? "",
-      returnPath: SanitizeReturnPath(payload.p),
-      codeChallenge: payload.c,
-      codeChallengeMethod: payload.m ?? PKCE_METHOD_S256,
-      pkceVerifier: payload.v,
-    };
-  } catch {
-    return null;
-  }
-}
-
-function createRedirectContext(redirectUri: string, returnPath?: string | null): IRedirectContext {
-  const pkce = CreatePkcePair();
-  return {
-    redirectUri,
-    state: CreateOAuthNonce(),
-    returnPath: SanitizeReturnPath(returnPath),
-    codeChallenge: pkce.challenge,
-    codeChallengeMethod: pkce.method,
-    pkceVerifier: pkce.verifier,
-  };
-}
-
-/** Read-only: resolve redirect context from cookie, or build an in-memory context from URL params (no cookie writes). */
-export async function ReadRedirectContext(redirectUri?: string | null, state?: string | null): Promise<IRedirectContext | null> {
-  const cookieStore = await cookies();
-  const fromCookie = DecodeRedirectContext(cookieStore.get(AUTH_COOKIES.redirectContext)?.value);
-
-  const trimmedUri = redirectUri?.trim();
-  if (trimmedUri && IsAllowedRedirectUri(trimmedUri)) {
-    if (fromCookie?.redirectUri === trimmedUri) {
-      return fromCookie;
-    }
-    return createRedirectContext(trimmedUri, state);
-  }
-
-  return fromCookie;
-}
-
-export function GetAuthCookieOptions(maxAge: number | string) {
-  return {
-    httpOnly: true,
-    path: "/",
-    sameSite: "lax" as const,
-    maxAge: Number(maxAge),
-    secure: NEXUS_INFO.IS_PRODUCTION,
-  };
-}
-
-export function GetRedirectContextCookieOptions() {
-  return GetAuthCookieOptions(SSO_CONFIG.BACKEND_CONFIG.REDIRECT_CONTEXT_MAX_AGE);
-}
-
-export function SetRedirectContextCookie(response: NextResponse, context: IRedirectContext) {
-  if (!IsAllowedRedirectUri(context.redirectUri)) return;
-  response.cookies.set(AUTH_COOKIES.redirectContext, EncodeRedirectContext(context), GetRedirectContextCookieOptions());
-}
-
-const redirectContextClearOptions = () => ({
-  ...GetRedirectContextCookieOptions(),
-  maxAge: 0,
-  expires: new Date(0),
-});
-
-/** Route Handler / middleware — clears redirect context on the outgoing response. */
-export function ClearRedirectContextCookie(response: NextResponse) {
-  response.cookies.set(AUTH_COOKIES.redirectContext, "", redirectContextClearOptions());
-}
-
-/** Server Components / Server Actions — clears redirect context in the current request store. */
-export async function ClearRedirectContextStore() {
-  const cookieStore = await cookies();
-  cookieStore.set(AUTH_COOKIES.redirectContext, "", redirectContextClearOptions());
-}

package/src/sso-config/redirect-context-persist.tsx

@@ -1,18 +0,0 @@
-"use client";
-
-import { useSearchParams } from "next/navigation";
-import { useEffect } from "react";
-import { PersistRedirectContext } from "./redirect-context-actions";
-
-/** Keeps redirect_uri/state in a secure httpOnly cookie across auth page navigations. */
-export function RedirectContextPersist() {
-  const searchParams = useSearchParams();
-  const redirectUri = searchParams.get("redirect_uri");
-  const state = searchParams.get("state");
-
-  useEffect(() => {
-    void PersistRedirectContext(redirectUri, state);
-  }, [redirectUri, state]);
-
-  return null;
-}

package/src/sso-config/redirect-context-route.tsx

@@ -1,45 +0,0 @@
-import { NextRequest, NextResponse } from "next/server";
-import { AUTH_COOKIES } from "./cookie-helpers";
-import { CreatePkcePair } from "./pkce-helpers";
-import {
-  CreateOAuthNonce,
-  DecodeRedirectContext,
-  IsAllowedRedirectUri,
-  SanitizeReturnPath,
-  SetRedirectContextCookie,
-} from "./redirect-context-helpers";
-
-/** Route Handler — persists redirect_uri/state in a signed cookie, then forwards to the auth sign-in page. */
-export async function RedirectContextRoute(req: NextRequest) {
-  const redirectUri = req.nextUrl.searchParams.get("redirect_uri");
-  const state = req.nextUrl.searchParams.get("state");
-
-  const signInUrl = new URL("/auth/sign-in", req.url);
-  if (redirectUri) signInUrl.searchParams.set("redirect_uri", redirectUri);
-  if (state) signInUrl.searchParams.set("state", state);
-
-  const response = NextResponse.redirect(signInUrl);
-  const trimmedUri = redirectUri?.trim();
-
-  if (!trimmedUri || !IsAllowedRedirectUri(trimmedUri)) {
-    return response;
-  }
-
-  const existing = DecodeRedirectContext(req.cookies.get(AUTH_COOKIES.redirectContext)?.value);
-  if (existing?.redirectUri === trimmedUri) {
-    SetRedirectContextCookie(response, existing);
-    return response;
-  }
-
-  const pkce = CreatePkcePair();
-  SetRedirectContextCookie(response, {
-    redirectUri: trimmedUri,
-    state: CreateOAuthNonce(),
-    returnPath: SanitizeReturnPath(state),
-    codeChallenge: pkce.challenge,
-    codeChallengeMethod: pkce.method,
-    pkceVerifier: pkce.verifier,
-  });
-
-  return response;
-}

package/src/sso-config/refresh-route.tsx

@@ -1,23 +0,0 @@
-import { NextRequest, NextResponse } from "next/server";
-import { GetResponse } from "nexus-shared/interface";
-import { HttpPost } from "../services/http-services";
-import { AUTH_COOKIES, GetDecryptedRequestCookie, SetAuthCookies } from "./cookie-helpers";
-import { SSO_CONFIG } from "./sso-config";
-import { SSOAuthResponse } from "./sso-interfaces";
-
-export async function RefreshRoute(req: NextRequest) {
-  const refreshToken = GetDecryptedRequestCookie(req, AUTH_COOKIES.refreshToken);
-  if (!refreshToken) return NextResponse.json(GetResponse.ERROR("No refresh token", "NJS_X1003"), { status: 401 });
-
-  try {
-    const refreshRes = await HttpPost(SSO_CONFIG.BACKEND_ENDPOINTS.REFRESH, { refreshToken, clientSystemName: SSO_CONFIG.BACKEND_CONFIG.CLIENT_SYSTEM_NAME });
-    if (!refreshRes.isSuccess) return NextResponse.json(GetResponse.ERROR("Refresh failed", "NJS_X1001"), { status: 401 });
-
-    const newTokens = refreshRes.result as SSOAuthResponse;
-    const response = NextResponse.json(GetResponse.SUCCESS(null, "Refresh successful"));
-    SetAuthCookies(response, newTokens);
-    return response;
-  } catch {
-    return NextResponse.json(GetResponse.ERROR("Auth service unavailable", "NJS_X1002"), { status: 500 });
-  }
-}

package/src/sso-config/sign-in-route.tsx

@@ -1,74 +0,0 @@
-import { NextRequest, NextResponse } from "next/server";
-import { EErrorCodes, EExceptionCategories } from "../interfaces/exception-interfaces";
-import { GetResponse } from "../interfaces/http-interfaces";
-import { URLS } from "../nexus.environments";
-import { HttpPost } from "../services/http-services";
-import { AUTH_COOKIES, GetDecryptedRequestCookie, ResolvePostLoginRedirectUrl, SetAuthCookies, SetSsoSessionCookie } from "./cookie-helpers";
-import { DecodeRedirectContext } from "./redirect-context-helpers";
-import { CreatePkcePair } from "./pkce-helpers";
-import { ClearRedirectContextCookie } from "./redirect-context-helpers";
-import { ExchangeAuthorizationCode, GetClientConfiguration, RequestAuthorizationCode } from "./sso-backend-flow";
-import { BuildAuthenticationSignInUrl, SSO_CONFIG } from "./sso-config";
-import { ILoginRequest, ILoginResponse } from "./sso-interfaces";
-
-function failRedirect(req: NextRequest) {
-  const returnPath = req.nextUrl.searchParams.get("state") ?? "/";
-  return NextResponse.redirect(new URL(BuildAuthenticationSignInUrl(returnPath)));
-}
-
-/** GET — exchange local sso_session for access tokens (identity provider app). */
-export async function SignInGetRoute(req: NextRequest) {
-  const ssoSession = GetDecryptedRequestCookie(req, AUTH_COOKIES.ssoSession);
-
-  if (!ssoSession) return failRedirect(req);
-
-  const pkce = CreatePkcePair();
-
-  try {
-    const code = await RequestAuthorizationCode({
-      ssoSession,
-      redirectUri: SSO_CONFIG.FRONTEND_ENDPOINTS.CALLBACK,
-      pkce,
-    });
-    if (!code) return failRedirect(req);
-
-    const tokenData = await ExchangeAuthorizationCode({
-      code,
-      redirectUri: SSO_CONFIG.FRONTEND_ENDPOINTS.CALLBACK,
-      codeVerifier: pkce.verifier,
-    });
-    if (!tokenData) return failRedirect(req);
-
-    const response = NextResponse.redirect(new URL(URLS.CURRENT!));
-    SetAuthCookies(response, tokenData);
-    ClearRedirectContextCookie(response);
-    return response;
-  } catch {
-    return failRedirect(req);
-  }
-}
-
-/** POST — username/password sign-in (identity provider app). */
-export async function SignInPostRoute(req: NextRequest) {
-  const body = (await req.json()) as ILoginRequest;
-  body.clientSystemName = SSO_CONFIG.BACKEND_CONFIG.CLIENT_SYSTEM_NAME;
-
-  if (!body.username?.trim() || !body.password) return NextResponse.json(GetResponse.ERROR("Username and password are required.", "USERNAME_AND_PASSWORD_REQUIRED", EExceptionCategories.Validation, EErrorCodes.FormatInvalid, "Username|Password"), { status: 400 });
-
-  const signInRes = await HttpPost(SSO_CONFIG.BACKEND_ENDPOINTS.SIGN_IN, body);
-
-  const signInResult = signInRes?.result as ILoginResponse;
-
-  if (signInResult?.ssoSession) {
-    const redirectContext = DecodeRedirectContext(req.cookies.get(AUTH_COOKIES.redirectContext)?.value);
-    signInResult.redirectUrl = ResolvePostLoginRedirectUrl(!!redirectContext?.redirectUri);
-  }
-
-  if (!signInRes.isSuccess || !signInResult?.ssoSession) return NextResponse.json(signInRes, { status: signInRes.code ?? 401 });
-
-  const ssoConfiguration = await GetClientConfiguration();
-  const response = NextResponse.json(signInRes);
-
-  SetSsoSessionCookie(response, signInResult.ssoSession, ssoConfiguration.ssoSessionLifetime);
-  return response;
-}

package/src/sso-config/sign-out-route.tsx

@@ -1,57 +0,0 @@
-import { NextRequest, NextResponse } from "next/server";
-import { NEXUS_INFO, URLS } from "../nexus.environments";
-import { HttpPost } from "../services/http-services";
-import { AUTH_COOKIES, ClearAuthCookies, GetDecryptedRequestCookie } from "./cookie-helpers";
-import { SanitizeReturnPath } from "./redirect-context-helpers";
-import { SSO_CONFIG } from "./sso-config";
-
-function hasAuthSession(req: NextRequest): boolean {
-  return !!(req.cookies.get(AUTH_COOKIES.ssoSession)?.value || req.cookies.get(AUTH_COOKIES.accessToken)?.value || req.cookies.get(AUTH_COOKIES.refreshToken)?.value);
-}
-
-function resolveReturnUrl(req: NextRequest): URL {
-  if (NEXUS_INFO.IS_ADMIN_MODULE && !hasAuthSession(req)) {
-    return new URL(URLS.SIGN_IN);
-  }
-
-  const appBase = req.nextUrl.origin ?? URLS.CURRENT!;
-  const returnPath = req.nextUrl.searchParams.get("returnUrl");
-  if (returnPath) {
-    return new URL(SanitizeReturnPath(returnPath), appBase);
-  }
-
-  if (NEXUS_INFO.IS_ADMIN_MODULE) {
-    return new URL(URLS.SIGN_IN);
-  }
-
-  return new URL(appBase);
-}
-
-async function revokeServerSession(req: NextRequest) {
-  const ssoSession = GetDecryptedRequestCookie(req, AUTH_COOKIES.ssoSession);
-  if (!ssoSession) return;
-
-  const response = await HttpPost(SSO_CONFIG.BACKEND_ENDPOINTS.SIGN_OUT, { ssoSession });
-
-  return response.isSuccess;
-}
-
-/** GET — clear cookies and redirect back to the originating app page. */
-export async function SignOutGetRoute(req: NextRequest) {
-  await revokeServerSession(req);
-  const response = NextResponse.redirect(resolveReturnUrl(req));
-  ClearAuthCookies(response);
-  return response;
-}
-
-/** POST — clear cookies and return JSON (API clients). */
-export async function SignOutPostRoute(req: NextRequest) {
-  if (NEXUS_INFO.IS_ADMIN_MODULE && !hasAuthSession(req)) {
-    return NextResponse.json({ ok: false, redirect: URLS.SIGN_IN }, { status: 401 });
-  }
-
-  await revokeServerSession(req);
-  const response = NextResponse.json({ ok: true });
-  ClearAuthCookies(response);
-  return response;
-}