nexus-shared 1.1.21 → 3.0.0

package/src/sso-config/sign-up-route.tsx

@@ -1,57 +0,0 @@
-import { NextRequest, NextResponse } from "next/server";
-import { HttpPost } from "../services/http-services";
-import { AUTH_COOKIES, ResolvePostLoginRedirectUrl, SetSsoSessionCookie } from "./cookie-helpers";
-import { DecodeRedirectContext } from "./redirect-context-helpers";
-import { GetClientConfiguration } from "./sso-backend-flow";
-import { SSO_CONFIG } from "./sso-config";
-import { ISignUpRequest } from "./sso-interfaces";
-import { ParseWrappedResult } from "./sso-response-helpers";
-
-const mapGender = (gender?: string | null) => {
-  const normalized = gender?.trim().toLowerCase();
-  if (normalized === "male") return 0;
-  if (normalized === "female") return 1;
-  return 2;
-};
-
-/** POST — register a new account (identity provider app). */
-export async function SignUpPostRoute(req: NextRequest) {
-  const body = (await req.json()) as ISignUpRequest & { confirmPassword?: string };
-
-  if (!body.fullName?.trim() || !body.username?.trim() || !body.email?.trim() || !body.password || !body.confirmPassword) {
-    return NextResponse.json({ error: "All required fields must be provided." }, { status: 400 });
-  }
-
-  if (body.password !== body.confirmPassword) {
-    return NextResponse.json({ error: "Passwords do not match." }, { status: 400 });
-  }
-
-  const signUpRes = await HttpPost(SSO_CONFIG.BACKEND_ENDPOINTS.SIGN_UP, {
-    fullname: body.fullName.trim(),
-    username: body.username.trim(),
-    password: body.password,
-    confirmPassword: body.confirmPassword,
-    genderType: mapGender(body.gender),
-    emailAddress: body.email.trim(),
-    contactNumber: null,
-    clientSystemName: SSO_CONFIG.BACKEND_CONFIG.CLIENT_SYSTEM_NAME,
-  });
-
-  const signUpResult = ParseWrappedResult<{ ssoSession: string }>(signUpRes);
-  if (!signUpRes.isSuccess || !signUpResult?.ssoSession) {
-    return NextResponse.json(signUpRes, { status: signUpRes.code ?? 400 });
-  }
-
-  const ssoConfiguration = await GetClientConfiguration();
-  const redirectContext = DecodeRedirectContext(req.cookies.get(AUTH_COOKIES.redirectContext)?.value);
-
-  const response = NextResponse.json({
-    ...signUpRes,
-    result: {
-      ...signUpResult,
-      redirectUrl: ResolvePostLoginRedirectUrl(!!redirectContext?.redirectUri),
-    },
-  });
-  SetSsoSessionCookie(response, signUpResult.ssoSession, ssoConfiguration.ssoSessionLifetime);
-  return response;
-}

package/src/sso-config/sso-backend-flow.ts

@@ -1,38 +0,0 @@
-import { NEXUS_CONFIG } from "../nexus.environments";
-import { HttpGet, HttpPost } from "../services/http-services";
-import { SSO_CONFIG } from "./sso-config";
-import { IClientApplication, PKCE_METHOD_S256, SSOAuthResponse, SsoExchangeInput, TokenExchangeInput } from "./sso-interfaces";
-import { ParseSsoCodeResponse, ParseTokenResponse } from "./sso-response-helpers";
-
-/** Server-only: request an authorization code using client policy + PKCE. */
-export async function RequestAuthorizationCode(input: SsoExchangeInput): Promise<string | null> {
-  const ssoRes = await HttpPost(SSO_CONFIG.BACKEND_ENDPOINTS.SSO, {
-    ssoSession: input.ssoSession,
-    redirectUri: input.redirectUri,
-    state: input.state,
-    returnPath: input.returnPath,
-    codeChallenge: input.pkce.challenge,
-    codeChallengeMethod: input.pkce.method ?? PKCE_METHOD_S256,
-  });
-
-  return ParseSsoCodeResponse(ssoRes);
-}
-
-/** Server-only: exchange authorization code for tokens. */
-export async function ExchangeAuthorizationCode(input: TokenExchangeInput): Promise<SSOAuthResponse | null> {
-  const tokenRes = await HttpPost(SSO_CONFIG.BACKEND_ENDPOINTS.TOKEN, {
-    code: input.code,
-    redirectUri: input.redirectUri,
-    clientSystemName: SSO_CONFIG.BACKEND_CONFIG.CLIENT_SYSTEM_NAME,
-    codeVerifier: input.codeVerifier,
-  });
-
-  return ParseTokenResponse(tokenRes);
-}
-
-/** Server-only: get client configuration from the backend. */
-export async function GetClientConfiguration(): Promise<IClientApplication> {
-  const clientConfigRes = await HttpGet(SSO_CONFIG.BACKEND_ENDPOINTS.CLIENT_CONFIG, null, NEXUS_CONFIG.DEFAULT_REVALIDATE_TIME_ONE_DAY);
-  if (!clientConfigRes.isSuccess) throw new Error("Failed to get client configuration");
-  return clientConfigRes.result;
-}

package/src/sso-config/sso-complete-route.tsx

@@ -1,50 +0,0 @@
-import { NextRequest, NextResponse } from "next/server";
-import { AUTH_COOKIES, GetDecryptedRequestCookie } from "./cookie-helpers";
-import { EncodeOAuthCallbackState } from "./oauth-callback-state";
-import { ClearRedirectContextCookie, DecodeRedirectContext } from "./redirect-context-helpers";
-import { RequestAuthorizationCode } from "./sso-backend-flow";
-import { BuildAuthenticationSignInUrl, SSO_CONFIG } from "./sso-config";
-import { PKCE_METHOD_S256, PkcePair } from "./sso-interfaces";
-
-function buildSignInRedirect(redirectContext: ReturnType<typeof DecodeRedirectContext>) {
-  return new URL(BuildAuthenticationSignInUrl(redirectContext?.returnPath));
-}
-
-/** Completes SSO after credentials sign-in: exchange session for code and redirect to the client callback. */
-export async function SsoCompleteRoute(req: NextRequest) {
-  const ssoSession = GetDecryptedRequestCookie(req, AUTH_COOKIES.ssoSession);
-  const redirectContext = DecodeRedirectContext(req.cookies.get(AUTH_COOKIES.redirectContext)?.value);
-
-  if (!ssoSession) {
-    return NextResponse.redirect(buildSignInRedirect(redirectContext));
-  }
-
-  if (!redirectContext?.redirectUri) {
-    return NextResponse.redirect(new URL(SSO_CONFIG.FRONTEND_ENDPOINTS.SIGN_IN, req.url));
-  }
-
-  const pkce: PkcePair = {
-    verifier: redirectContext.pkceVerifier,
-    challenge: redirectContext.codeChallenge,
-    method: (redirectContext.codeChallengeMethod as PkcePair["method"]) ?? PKCE_METHOD_S256,
-  };
-
-  try {
-    const code = await RequestAuthorizationCode({
-      ssoSession,
-      redirectUri: redirectContext.redirectUri,
-      state: redirectContext.state,
-      returnPath: redirectContext.returnPath,
-      pkce,
-    });
-    if (!code) return NextResponse.redirect(buildSignInRedirect(redirectContext));
-
-    const callbackState = EncodeOAuthCallbackState(redirectContext.state, redirectContext.returnPath, pkce.verifier);
-    const location = `${redirectContext.redirectUri}?code=${encodeURIComponent(code)}&state=${encodeURIComponent(callbackState)}`;
-    const response = NextResponse.redirect(location);
-    ClearRedirectContextCookie(response);
-    return response;
-  } catch {
-    return NextResponse.redirect(buildSignInRedirect(redirectContext));
-  }
-}

package/src/sso-config/sso-config.ts

@@ -1,59 +0,0 @@
-import { APIS, URLS } from "nexus-shared";
-
-const _callbackPath = `${URLS.CURRENT}/api/auth/callback`;
-
-// @ts-ignore
-const processEnv = process.env;
-
-export const SSO_CONFIG = {
-  COOKIE_CONFIG: {
-    COOKIE_SECRET: processEnv.SSO_COOKIE_SECRET as string,
-  },
-  BACKEND_ENDPOINTS: {
-    SIGN_IN: `${APIS.AUTHENTICATION}/Authentication/SignIn`,
-    SIGN_UP: `${APIS.AUTHENTICATION}/Authentication/SignUp`,
-    SSO: `${APIS.AUTHENTICATION}/Authentication/SSO`,
-    TOKEN: `${APIS.AUTHENTICATION}/Authentication/Token`,
-    REFRESH: `${APIS.AUTHENTICATION}/Authentication/Refresh`,
-    SIGN_OUT: `${APIS.AUTHENTICATION}/Authentication/SignOut`,
-    PROVIDERS: `${APIS.AUTHENTICATION}/Authentication/Providers`,
-    CLIENT_CONFIG: `${APIS.AUTHENTICATION}/Authentication/ClientConfig/${processEnv.AUTH_CLIENT_SYSTEM_NAME}`,
-    FORGOT_PASSWORD: `${APIS.AUTHENTICATION}/Authentication/ForgotPassword`,
-    RESET_PASSWORD: `${APIS.AUTHENTICATION}/Authentication/ResetPassword`,
-    /** Used by VerifyAccessToken — returns 200 for a valid Bearer token, 401 otherwise. */
-    VERIFY: `${APIS.AUTHENTICATION}/Authentication/Verify`,
-    PROVIDER_CHALLENGE: (provider: string, returnUrl: string, clientSystemName: string) => `${APIS.AUTHENTICATION}/Provider/${provider}/Challenge?returnUrl=${encodeURIComponent(returnUrl)}&clientSystemName=${encodeURIComponent(clientSystemName)}`,
-  },
-  BACKEND_CONFIG: {
-    /** Matches AuthenticationOptions.DefaultClientSystemName (NEXUS_WEB_APPLICATION_API). */
-    CLIENT_SYSTEM_NAME: processEnv.AUTH_CLIENT_SYSTEM_NAME as string,
-    /** How long redirect_uri/state survive in a secure httpOnly cookie on the auth app (seconds). */
-    REDIRECT_CONTEXT_MAX_AGE: processEnv.REDIRECT_CONTEXT_MAX_AGE as string,
-  },
-  FRONTEND_ENDPOINTS: {
-    CALLBACK: _callbackPath,
-    SIGN_IN: `${URLS.CURRENT}/api/auth/sign-in`,
-    SIGN_UP: `${URLS.CURRENT}/api/auth/sign-up`,
-    SIGN_OUT: `${URLS.CURRENT}/api/auth/sign-out`,
-    REFRESH: `${URLS.CURRENT}/api/auth/refresh`,
-    SSO_COMPLETE: `${URLS.CURRENT}/api/auth/sso-complete`,
-    PROVIDER_COMPLETE: `${URLS.CURRENT}/api/auth/provider-complete`,
-    FORGOT_PASSWORD: `${URLS.CURRENT}/api/auth/forgot-password`,
-    RESET_PASSWORD: `${URLS.CURRENT}/api/auth/reset-password`,
-  },
-} as const;
-
-/** Client-app entry URL for centralized sign-in (includes redirect_uri + optional return path). */
-export function BuildAuthenticationSignInUrl(returnPath?: string) {
-  const entryUrl = new URL(`${URLS.AUTHENTICATION}/api/auth/redirect-context`);
-  entryUrl.searchParams.set("redirect_uri", SSO_CONFIG.FRONTEND_ENDPOINTS.CALLBACK);
-  if (returnPath) entryUrl.searchParams.set("state", returnPath);
-  return entryUrl.toString();
-}
-
-/** Sign-out URL that returns the user to a page on this app after cookies are cleared. */
-export function BuildSignOutUrl(returnPath?: string) {
-  const signOutUrl = new URL(SSO_CONFIG.FRONTEND_ENDPOINTS.SIGN_OUT);
-  if (returnPath) signOutUrl.searchParams.set("returnUrl", returnPath);
-  return signOutUrl.toString();
-}

package/src/sso-config/sso-interfaces.tsx

@@ -1,99 +0,0 @@
-import { UN } from "../interfaces/type-interfaces";
-
-export const PKCE_METHOD_S256 = "S256";
-
-export interface SSOAuthResponse {
-  accessToken: string;
-  refreshToken: string;
-  expiresTokenIn: number;
-  expiresRefreshTokenIn: number;
-  returnPath?: string;
-}
-
-export interface CookieInfo {
-  ssoSession?: string;
-  accessToken?: string | UN;
-  refreshToken?: string;
-}
-
-export interface IRedirectContext {
-  redirectUri: string;
-  /** OAuth CSRF nonce sent to the client callback. */
-  state: string;
-  /** Relative path to return to after sign-in completes. */
-  returnPath: string;
-  /** PKCE code challenge (stored server-side until SSO). */
-  codeChallenge: string;
-  codeChallengeMethod: string;
-  /** PKCE verifier (server-side only; also embedded in signed callback state). */
-  pkceVerifier: string;
-}
-
-export interface ISignInParams {
-  redirect_uri: string | UN;
-  state: string | UN;
-}
-
-export interface ISsoSessionResponse {
-  code: string;
-}
-
-export interface ILoginRequest {
-  username: string;
-  password: string;
-  rememberMe: boolean;
-  clientSystemName: string;
-}
-
-export interface ILoginResponse {
-  ssoSession: string;
-  displayName: string;
-  role: string;
-  userId: number;
-  redirectUrl?: string;
-}
-
-export interface ISignUpRequest {
-  fullName: string;
-  gender?: string | UN;
-  username: string;
-  email: string;
-  password: string;
-}
-
-export interface IDemoUserInfo {
-  id: number;
-  username: string;
-  email: string;
-  displayName: string;
-  role: string;
-  passwordHint: string;
-}
-
-export type SsoExchangeInput = {
-  ssoSession: string;
-  redirectUri: string;
-  state?: string;
-  returnPath?: string;
-  pkce: PkcePair;
-};
-
-export type TokenExchangeInput = {
-  code: string;
-  redirectUri: string;
-  codeVerifier: string;
-};
-export type PkcePair = {
-  verifier: string;
-  challenge: string;
-  method: typeof PKCE_METHOD_S256;
-};
-
-export interface IClientApplication {
-  requirePkce: boolean;
-  accessTokenLifetime: number;
-  refreshTokenLifetime: number;
-  authorizationCodeLifetime: number;
-  ssoSessionLifetime: number;
-  allowOfflineAccess: boolean;
-}

package/src/sso-config/sso-response-helpers.tsx

@@ -1,20 +0,0 @@
-import { IErrorRespose, ISuccessResponse } from "../interfaces/http-interfaces";
-import { ISsoSessionResponse, SSOAuthResponse } from "./sso-interfaces";
-
-type ApiResponse = ISuccessResponse | IErrorRespose;
-
-export function ParseWrappedResult<T>(response: ApiResponse): T | null {
-  if (!response.isSuccess) return null;
-  return (response.result ?? null) as T | null;
-}
-
-export function ParseSsoCodeResponse(response: ApiResponse): string | null {
-  const result = ParseWrappedResult<ISsoSessionResponse | { code?: string }>(response);
-  if (!result) return null;
-  if ("code" in result && result.code) return result.code;
-  return null;
-}
-
-export function ParseTokenResponse(response: ApiResponse): SSOAuthResponse | null {
-  return ParseWrappedResult<SSOAuthResponse>(response);
-}

package/src/sso-server.tsx

@@ -1,21 +0,0 @@
-export * from "./sso-config/oauth-callback-state";
-export * from "./sso-config/pkce-helpers";
-export * from "./sso-config/sso-backend-flow";
-export * from "./sso-config/auth-token-validation";
-export * from "./sso-config/callback-route";
-export * from "./sso-config/cookie-helpers";
-export * from "./sso-config/redirect-context-actions";
-export * from "./sso-config/redirect-context-helpers";
-export * from "./sso-config/redirect-context-route";
-export * from "./sso-config/redirect-context-persist";
-export * from "./sso-config/refresh-route";
-export * from "./sso-config/sign-in-route";
-export * from "./sso-config/sign-out-route";
-export * from "./sso-config/sign-up-route";
-export * from "./sso-config/sso-response-helpers";
-export * from "./sso-config/forgot-password-route";
-export * from "./sso-config/provider-complete-route";
-export * from "./sso-config/sso-complete-route";
-export * from "./sso-config/sso-config";
-export * from "./sso-config/sso-interfaces";
-export * from "./sso-config/sso-response-helpers";

package/src/styles/nexus.animation.css

@@ -1,269 +0,0 @@
-/**
- * EAnimations / EAnimationClasses — nexus.shared/interfaces/layout-interfaces.tsx
- * Legacy transition tokens (nexus.utility `.h`, `.anim`): --ANIM_SPD, --ANIM
- */
-
-:root {
-  --ANIM_SPD: 300ms;
-  --anim-ease: cubic-bezier(0.33, 1, 0.68, 1);
-  --anim-ease-out: cubic-bezier(0.16, 1, 0.3, 1);
-  --anim-ease-in: cubic-bezier(0.32, 0, 0.67, 0);
-  --ANIM: all var(--ANIM_SPD);
-
-  --SPIN_BOX_SIZE: 3.5rem;
-  --SPIN_BOX_BORDER_SIZE: 0.45rem;
-}
-
-/* ----- One-shot: fade / pulse ----- */
-
-.an-fa,
-.an-fo,
-.an-fio,
-.an-pi,
-.an-po {
-  animation-duration: var(--ANIM_SPD);
-  animation-timing-function: var(--anim-ease-out);
-  animation-fill-mode: both;
-}
-
-.an-fa {
-  animation-name: fadeIn;
-}
-
-.an-fo {
-  animation-name: fadeOut;
-  animation-timing-function: var(--anim-ease-in);
-  animation-fill-mode: forwards;
-}
-
-.an-fio {
-  animation-name: fadeInOut;
-  animation-duration: calc(var(--ANIM_SPD) * 2);
-  animation-timing-function: var(--anim-ease);
-  animation-iteration-count: 1;
-  animation-fill-mode: both;
-  animation: fadeInOut calc(var(--ANIM_SPD) * 6) ease-in-out infinite;
-}
-
-.an-pi {
-  animation-name: pulseIn;
-}
-
-.an-po {
-  animation-name: pulseOut;
-  animation-timing-function: var(--anim-ease-in);
-  animation-fill-mode: forwards;
-}
-
-.an-pio {
-  animation-name: pulseInOut;
-  animation-duration: calc(var(--ANIM_SPD) * 2);
-  animation-iteration-count: infinite;
-  animation-direction: alternate;
-  animation-timing-function: var(--anim-ease);
-  animation-fill-mode: none;
-}
-
-/* ----- Infinite: bounce (vertical), spin (ring), slide bar (L → R) ----- */
-
-.an-bounce {
-  animation-name: bounce;
-  animation-duration: calc(var(--ANIM_SPD) * 4);
-  animation-timing-function: linear;
-  animation-iteration-count: infinite;
-}
-
-.an-spin {
-  display: inline-block;
-  box-sizing: border-box;
-  width: var(--SPIN_BOX_SIZE);
-  height: var(--SPIN_BOX_SIZE);
-  vertical-align: middle;
-  border-radius: 50%;
-  border-style: solid;
-  border-width: var(--SPIN_BOX_BORDER_SIZE);
-  border-color: var(--B30);
-  border-top-color: var(--B20);
-  animation-name: spin;
-  animation-duration: calc(var(--ANIM_SPD) * 5);
-  animation-timing-function: linear;
-  animation-iteration-count: infinite;
-}
-
-.an-sbar {
-  position: relative;
-  display: block;
-  width: 100%;
-  max-width: 14rem;
-  height: 0.28rem;
-  min-height: 0.28rem;
-  overflow: hidden;
-  border-radius: 999px;
-  background-color: var(--B30);
-}
-
-.an-sbar::after {
-  content: "";
-  position: absolute;
-  top: 0;
-  left: -45%;
-  width: 45%;
-  height: 100%;
-  border-radius: inherit;
-  background: linear-gradient(90deg, var(--B400), var(--B20), var(--B600), var(--B400));
-  background-size: 200% 100%;
-  animation: slideBarSweep calc(var(--ANIM_SPD) * 5) ease-in-out infinite;
-}
-
-/**
- * Pill runs between track walls (alternate = return trip, no jump to 0).
- * --bbar-ball-pct: segment width (unitless %). --bbar-dur: one leg duration.
- * --bbar-ease: slightly slower near each wall; middle stays quicker.
- */
-.an-bbar {
-  position: relative;
-  display: block;
-  width: 100%;
-  max-width: 14rem;
-  height: 0.28rem;
-  min-height: 0.28rem;
-  overflow: hidden;
-  border-radius: 999px;
-  background-color: var(--B30);
-  --bbar-ball-pct: 40;
-  --bbar-dur: 1s;
-  /** Slight slowdown at each wall (start, far end, and same on the return leg). */
-  --bbar-ease: cubic-bezier(0.45, 0.1, 0.55, 0.9);
-}
-
-.an-bbar::after {
-  content: "";
-  position: absolute;
-  top: 0;
-  left: 0;
-  width: calc(var(--bbar-ball-pct) * 1%);
-  height: 100%;
-  border-radius: inherit;
-  background: linear-gradient(90deg, var(--B400), var(--B20), var(--B600), var(--B400));
-  background-size: 200% 100%;
-  will-change: transform;
-  animation-name: bounceBarBall;
-  animation-duration: var(--bbar-dur);
-  animation-timing-function: var(--bbar-ease);
-  animation-iteration-count: infinite;
-  animation-direction: alternate;
-}
-
-/* ----- Keyframes ----- */
-
-@keyframes fadeIn {
-  from {
-    opacity: 0;
-  }
-
-  to {
-    opacity: 1;
-  }
-}
-
-@keyframes fadeOut {
-  from {
-    opacity: 1;
-  }
-
-  to {
-    opacity: 0;
-  }
-}
-
-@keyframes fadeInOut {
-  0% {
-    opacity: 1;
-  }
-
-  50% {
-    opacity: 0.6;
-  }
-
-  100% {
-    opacity: 1;
-  }
-}
-
-@keyframes pulseInOut {
-  from {
-    transform: scale3d(1, 1, 1);
-  }
-
-  to {
-    transform: scale3d(1.04, 1.04, 1);
-  }
-}
-
-@keyframes bounce {
-  0%,
-  20%,
-  50%,
-  80%,
-  100% {
-    transform: translate3d(0, 0, 0);
-  }
-
-  40% {
-    transform: translate3d(0, -0.5rem, 0);
-  }
-
-  60% {
-    transform: translate3d(0, -0.25rem, 0);
-  }
-}
-
-@keyframes spin {
-  0% {
-    transform: rotate3d(0, 0, 1, 0deg);
-    border-top-color: var(--B20);
-  }
-
-  50% {
-    border-top-color: var(--B400);
-  }
-
-  75% {
-    border-top-color: var(--B600);
-  }
-
-  100% {
-    transform: rotate3d(0, 0, 1, 360deg);
-    border-top-color: var(--B20);
-  }
-}
-
-@keyframes slideBarSweep {
-  0% {
-    transform: translate3d(0, 0, 0);
-    background-position: 0% 50%;
-    opacity: 0.85;
-  }
-
-  50% {
-    opacity: 1;
-  }
-
-  100% {
-    transform: translate3d(320%, 0, 0);
-    background-position: 100% 50%;
-    opacity: 0.9;
-  }
-}
-
-@keyframes bounceBarBall {
-  0% {
-    transform: translate3d(0, 0, 0);
-    background-position: 0% 50%;
-  }
-
-  100% {
-    transform: translate3d(calc((100 - var(--bbar-ball-pct)) / var(--bbar-ball-pct) * 100%), 0, 0);
-    background-position: 100% 50%;
-  }
-}