Pkg/auth/0.4 by YoungMayor · Pull Request #45 · MayR-Labs/mayrlabs-js

YoungMayor · 2026-04-08T12:07:05Z

This pull request introduces a major 0.4.0 release for @mayrlabs/auth-nextjs, focusing on strict environment validation and improved configuration consistency. The most significant changes include enforcing runtime environment variable validation using @t3-oss/env-nextjs and zod, refactoring configuration to rely solely on environment variables (removing most options from createNextIssuerAuth), supporting remote JWK fetching, and standardizing session cookie naming. Documentation and tests have also been updated to reflect these changes.

Environment Validation and Configuration:

Integrated @t3-oss/env-nextjs and zod to strictly validate all required authentication environment variables at runtime. The SDK now fails fast if configuration is missing or malformed, improving reliability and security. All configuration for both client and issuer auth is now handled via environment variables, with sensible defaults and clear error messages. (packages/auth-nextjs/src/client/index.tsx, packages/auth-nextjs/src/issuer/index.ts, packages/auth-nextjs/README.md, packages/auth-nextjs/CHANGELOG.md, [1] [2] [3] [4]
createNextIssuerAuth() no longer accepts options for session keys or redirects; these are now determined solely by environment variables, representing a breaking change for issuer configuration. (packages/auth-nextjs/src/issuer/index.ts, packages/auth-nextjs/README.md, [1] [2]

Feature Enhancements:

Added support for the remotePublicKey option in createNextClientAuth, allowing public keys to be fetched automatically from the identity provider's JWKS endpoint, reducing manual configuration. (packages/auth-nextjs/src/client/index.tsx, packages/auth-nextjs/src/types.ts, [1] [2]
Standardized the session cookie key to mayrlabs-auth-session across the ecosystem for better consistency. (packages/auth-nextjs/src/client/index.tsx, packages/auth-nextjs/src/issuer/index.ts, [1] [2]

Documentation and Testing:

Updated and expanded TSDoc and README documentation to clearly describe all environment variables, defaults, and usage patterns, including migration notes for the breaking changes. (packages/auth-nextjs/README.md, packages/auth-nextjs/CHANGELOG.md, [1] [2]
Refactored tests and test setup to align with the new environment variable validation approach, removing tests for missing variables (since validation is now centralized) and setting up environment variables in a single place for consistency. (packages/auth-nextjs/src/index.test.ts, packages/auth-nextjs/vitest.setup.ts, [1] [2] [3]

Dependency Updates:

Added @t3-oss/env-nextjs and zod as dependencies to enable strict environment validation. (packages/auth-nextjs/package.json, packages/auth-nextjs/package.jsonL119-R121)

Versioning:

Bumped the package version to 0.4.0 to reflect these major and breaking changes. (packages/auth-nextjs/package.json, packages/auth-nextjs/package.jsonL3-R3)

…ration

…ntation, and integrate @t3-oss/env-nextjs for secure configuration management

…nd standardized session keys across auth packages

Copilot

Pull request overview

This PR delivers a 0.4.0 release across @mayrlabs/auth and @mayrlabs/auth-nextjs, introducing remote JWKS support and stricter env-based configuration/validation, plus some unrelated prunejs test/tsconfig adjustments.

Changes:

Add core constants and remote JWKS verification support in @mayrlabs/auth (and update defaults like session key).
Refactor @mayrlabs/auth-nextjs to validate configuration via @t3-oss/env-nextjs/zod, rely more on env vars, and add remotePublicKey support.
Add new unit tests in packages/prunejs and adjust its tsconfig.json include list.

Reviewed changes

Copilot reviewed 20 out of 25 changed files in this pull request and generated 10 comments.

Show a summary per file

File	Description
packages/prunejs/tsconfig.json	Restricts TS include pattern to `src/*/`.
packages/prunejs/src/test/utils/parser.test.ts	Adds parser utility unit tests.
packages/prunejs/src/test/utils/file-system.test.ts	Adds file-system utility unit tests.
packages/prunejs/src/test/utils/config.test.ts	Adds config loading/validation unit tests.
packages/prunejs/src/test/utils/analyzer.test.ts	Adds analyzer unit tests for unused code detection.
packages/auth/src/types.ts	Updates config types for optional `publicKey` + `remotePublicKey` and adds TSDoc.
packages/auth/src/index.ts	Exports new `core/constants`.
packages/auth/src/core/issuer.ts	Refines issuer signing methods and error-token signing payload.
packages/auth/src/core/constants.ts	Introduces shared constants (ACCOUNT_URL, ISSUER, SESSION_KEY, MACHINE_AUDIENCE).
packages/auth/src/core/client.ts	Switches default session key to shared constant and adds docs.
packages/auth/src/core/base.ts	Adds remote JWKS key support via `createRemoteJWKSet` and renames key getter to `getVerifyKey`.
packages/auth/src/core/base.test.ts	Updates tests for renamed `getVerifyKey`.
packages/auth/package.json	Bumps `@mayrlabs/auth` version to 0.4.0.
packages/auth/CHANGELOG.md	Documents 0.4.0 changes (remote JWK + constants + docs).
packages/auth/ABOUT.md	Updates documented default session key name.
packages/auth-nextjs/vitest.setup.ts	Adds shared env setup for tests.
packages/auth-nextjs/vitest.config.ts	Registers `setupFiles` for Vitest env initialization.
packages/auth-nextjs/src/types.ts	Updates Next.js integration options/types (adds `remotePublicKey`, removes issuer options).
packages/auth-nextjs/src/issuer/index.ts	Refactors issuer auth to `createEnv`/`zod`-validated env config and removes options.
packages/auth-nextjs/src/index.test.ts	Updates tests for env refactor and standardized session key.
packages/auth-nextjs/src/client/index.tsx	Adds env validation, supports `remotePublicKey`, standardizes session key, and uses audience env var in callback verification.
packages/auth-nextjs/README.md	Updates docs for new env vars and migration (incl. remote JWKS).
packages/auth-nextjs/package.json	Bumps version to 0.4.0 and adds env validation dependencies.
packages/auth-nextjs/CHANGELOG.md	Documents 0.4.0 changes and breaking issuer config change.

💡 Add Copilot custom instructions for smarter, more guided reviews. Learn how to get started.

Copilot · 2026-04-08T12:13:12Z

+export const clientEnv = createEnv({
+  server: {
+    MAYRLABS_AUTH_PUBLIC_JWK: z.string().optional(),
+    MAYRLABS_CLIENT_ID: z.string().min(1),
+    MAYRLABS_CLIENT_SECRET: z.string().min(1),
+    MAYRLABS_ACCOUNT_URL: z.string().url().default(ACCOUNT_URL),
+    MAYRLABS_CLIENT_AUDIENCE: z.string().min(1),
+    MAYRLABS_AUTH_ISSUER: z.string().optional(),
+    MAYRLABS_AUTH_SESSION_KEY: z.string().default(SESSION_KEY),
+    MAYRLABS_AUTH_ERROR_REDIRECT: z.string().default("/login"),
+    MAYRLABS_AUTH_SUCCESS_REDIRECT: z.string().default("/dashboard"),
+  },
+  client: {},
+  experimental__runtimeEnv: process.env,
+  skipValidation: process.env.NODE_ENV === "test",
+});


MAYRLABS_AUTH_PUBLIC_JWK is optional in the env schema, but if options.remotePublicKey is not enabled a missing public key will only fail later during token verification (throwing MISSING_PUBLIC_KEY). To preserve the PR’s “fail fast” config behavior, add an explicit initialization-time check that either remotePublicKey is true or publicKey is present, and throw a clear error message from createNextClientAuth().

Copilot · 2026-04-08T12:13:12Z

+export const issuerEnv = createEnv({
+  server: {
+    MAYRLABS_AUTH_PUBLIC_JWK: z.string().min(1),
+    MAYRLABS_AUTH_PRIVATE_JWK: z.string().min(1),
+    MAYRLABS_AUTH_ISSUER: z.string().min(1).default("auth.mayrlabs.com"),
+    MAYRLABS_AUTH_SESSION_KEY: z.string().default(SESSION_KEY),
+    MAYRLABS_AUTH_ERROR_REDIRECT: z.string().default("/login"),
+  },


The env validation currently only checks that JWK env vars are non-empty strings, but the PR description claims validation fails fast when config is malformed. Consider refining MAYRLABS_AUTH_PUBLIC_JWK to validate it is valid JSON (and ideally shaped like a JWK) so malformed values error at startup rather than at first token verification.

Copilot · 2026-04-08T12:13:12Z

- `MAYRLABS_CLIENT_ID`: Your application's unique ID.
- `MAYRLABS_CLIENT_SECRET`: Your application's secret key (keep this server-side only).
- `MAYRLABS_ACCOUNT_URL`: (Optional) The URL of the central account system center.
+The SDK now strictly validates environment variables using Zilch. Ensure the following are set in your `.env`:


The README says environment variables are validated using “Zilch”, but the implementation uses zod (and @t3-oss/env-nextjs). This is misleading to users and should be corrected.

Suggested change

The SDK now strictly validates environment variables using Zilch. Ensure the following are set in your `.env`:

The SDK now strictly validates environment variables using `zod` via `@t3-oss/env-nextjs`. Ensure the following are set in your `.env`:

Copilot · 2026-04-08T12:13:13Z

 export interface ClientConfigInput
  extends Omit<ClientConfig, "redirects" | "session" | "issuer"> {
+  /**
+   * The issuer string representing the IDP token issuer length.


This TSDoc line reads “issuer length”, which looks like an accidental word and makes the description confusing. Update it to describe the issuer string (e.g., “issuer string representing the expected token issuer”).

Suggested change

* The issuer string representing the IDP token issuer length.

* The issuer string representing the expected IDP token issuer.

Copilot · 2026-04-08T12:13:13Z

+process.env.MAYRLABS_AUTH_PUBLIC_JWK = JSON.stringify({
+  kty: "RSA",
+  n: "...",
+  e: "...",
+});
+process.env.MAYRLABS_AUTH_PRIVATE_JWK = JSON.stringify({
+  kty: "RSA",
+  n: "...",
+  e: "...",
+});
+process.env.MAYRLABS_CLIENT_ID = "test-id";
+process.env.MAYRLABS_CLIENT_SECRET = "test-secret";
+process.env.MAYRLABS_ACCOUNT_URL = "https://testing.com";
+process.env.MAYRLABS_CLIENT_AUDIENCE = "test-audience";
+process.env.MAYRLABS_AUTH_ISSUER = "test-issuer";
+process.env.MAYRLABS_AUTH_SESSION_KEY = "mayrlabs-auth-session";
+process.env.MAYRLABS_AUTH_ERROR_REDIRECT = "/login";
+process.env.MAYRLABS_AUTH_SUCCESS_REDIRECT = "/dashboard";
+


Now that vitest.config.ts sets setupFiles: ["./vitest.setup.ts"], these duplicated process.env.* assignments in the test file are redundant and can drift from the shared setup. Prefer keeping env initialization only in vitest.setup.ts and removing it from this test file.

Suggested change

process.env.MAYRLABS_AUTH_PUBLIC_JWK = JSON.stringify({

kty: "RSA",

n: "...",

e: "...",

});

process.env.MAYRLABS_AUTH_PRIVATE_JWK = JSON.stringify({

kty: "RSA",

n: "...",

e: "...",

});

process.env.MAYRLABS_CLIENT_ID = "test-id";

process.env.MAYRLABS_CLIENT_SECRET = "test-secret";

process.env.MAYRLABS_ACCOUNT_URL = "https://testing.com";

process.env.MAYRLABS_CLIENT_AUDIENCE = "test-audience";

process.env.MAYRLABS_AUTH_ISSUER = "test-issuer";

process.env.MAYRLABS_AUTH_SESSION_KEY = "mayrlabs-auth-session";

process.env.MAYRLABS_AUTH_ERROR_REDIRECT = "/login";

process.env.MAYRLABS_AUTH_SUCCESS_REDIRECT = "/dashboard";

Copilot · 2026-04-08T12:13:13Z

+export const clientEnv = createEnv({
+  server: {
+    MAYRLABS_AUTH_PUBLIC_JWK: z.string().optional(),
+    MAYRLABS_CLIENT_ID: z.string().min(1),
+    MAYRLABS_CLIENT_SECRET: z.string().min(1),
+    MAYRLABS_ACCOUNT_URL: z.string().url().default(ACCOUNT_URL),
+    MAYRLABS_CLIENT_AUDIENCE: z.string().min(1),
+    MAYRLABS_AUTH_ISSUER: z.string().optional(),
+    MAYRLABS_AUTH_SESSION_KEY: z.string().default(SESSION_KEY),
+    MAYRLABS_AUTH_ERROR_REDIRECT: z.string().default("/login"),
+    MAYRLABS_AUTH_SUCCESS_REDIRECT: z.string().default("/dashboard"),
+  },


Similar to issuer env validation: MAYRLABS_AUTH_PUBLIC_JWK is accepted as an arbitrary string (when provided). If the goal is strict env validation, consider refining it to ensure it’s valid JSON (and a plausible JWK) so misconfiguration is caught at startup rather than during the first verification call.

Copilot · 2026-04-08T12:13:13Z


-    const user = await setup.verifyAuthToken(token);
+    const user = await setup.verifyAuthToken(token, audience);

    if (!user) {
      return redirectToError(


handleCallback() now verifies tokens using the configured MAYRLABS_CLIENT_AUDIENCE (good), but other flows in this module still call setup.verifyAuthToken(token) without passing audience (e.g. getUser() / authProxy() / AuthProvider() via getUser()). Since ClientAuthSetup defaults audience to clientId, this can make session-cookie verification fail after a successful callback, or validate against an unintended audience. Please thread audience through all verifyAuthToken calls in this module for consistency.

Copilot · 2026-04-08T12:13:14Z

+  protected async getVerifyKey(): Promise<CryptoKey | JWTVerifyGetKey> {
+    if (this.config.remotePublicKey && this.config.accountUrl) {
+      this._jwks ??= createRemoteJWKSet(
+        new URL(`${this.config.accountUrl}/.well-known/jwks.json`),
+      );
+
+      return this._jwks;
+    }


Remote JWKS verification is new behavior (remotePublicKey + accountUrl → createRemoteJWKSet(...)), but the existing BaseAuthSetup tests only cover local key import/caching. Add a focused unit test that enables remotePublicKey and asserts getVerifyKey() returns/caches a JWKS getter (and that jwtVerify is invoked with it) to prevent regressions.

Introduce a jwkSchema (Zod) to validate JWKs and use it in both issuer and client env parsing. Enforce that either a remote public key is used or an env-provided public JWK is present, and improve error messages for unauthenticated cases. Fix session cookie key usage and ensure verifyAuthToken is called with audience where appropriate; adjust logout/redirect handling to use configured redirects. Update tests to mock remote JWKS and cover caching behavior, and remove hardcoded env setup from client tests. Also bump @mayrlabs/auth dependency version in auth-nextjs and correct a README typo (Zilch -> Zod).

YoungMayor added 3 commits April 7, 2026 09:29

refactor: move test files to src directory and update project configu…

68fc293

…ration

refactor: improve auth type definitions, enhance client/issuer docume…

fc8c666

…ntation, and integrate @t3-oss/env-nextjs for secure configuration management

feat: implement remote JWK fetching, strict environment validation, a…

3ab0bec

…nd standardized session keys across auth packages

YoungMayor requested a review from Copilot April 8, 2026 12:07

Copilot started reviewing on behalf of YoungMayor April 8, 2026 12:07 View session

Copilot AI reviewed Apr 8, 2026

View reviewed changes

YoungMayor merged commit 14a0293 into main Apr 8, 2026
1 check passed

YoungMayor deleted the pkg/auth/0.4 branch April 8, 2026 14:05

Navigation Menu

Uh oh!

Pkg/auth/0.4 - #45

Pkg/auth/0.4#45
YoungMayor merged 4 commits into
mainfrom
pkg/auth/0.4

YoungMayor commented Apr 8, 2026

Uh oh!

Copilot AI left a comment

Uh oh!

Uh oh!

Copilot AI Apr 8, 2026

Uh oh!

Copilot AI Apr 8, 2026

Uh oh!

Copilot AI Apr 8, 2026

Uh oh!

Copilot AI Apr 8, 2026

Uh oh!

Copilot AI Apr 8, 2026

Uh oh!

Copilot AI Apr 8, 2026

Uh oh!

Copilot AI Apr 8, 2026

Uh oh!

Copilot AI Apr 8, 2026

Uh oh!

Uh oh!

Uh oh!

Reviewers

Assignees

Labels

Projects

Milestone

Development

Uh oh!

2 participants

	The SDK now strictly validates environment variables using Zilch. Ensure the following are set in your `.env`:
	The SDK now strictly validates environment variables using `zod` via `@t3-oss/env-nextjs`. Ensure the following are set in your `.env`:

	* The issuer string representing the IDP token issuer length.
	* The issuer string representing the expected IDP token issuer.

Uh oh!

Conversation

YoungMayor commented Apr 8, 2026

Uh oh!

Copilot AI left a comment

Choose a reason for hiding this comment

Pull request overview

Reviewed changes

Uh oh!

Uh oh!

Copilot AI Apr 8, 2026

Choose a reason for hiding this comment

Uh oh!

Copilot AI Apr 8, 2026

Choose a reason for hiding this comment

Uh oh!

Copilot AI Apr 8, 2026

Choose a reason for hiding this comment

Uh oh!

Copilot AI Apr 8, 2026

Choose a reason for hiding this comment

Uh oh!

Copilot AI Apr 8, 2026

Choose a reason for hiding this comment

Uh oh!

Copilot AI Apr 8, 2026

Choose a reason for hiding this comment

Uh oh!

Copilot AI Apr 8, 2026

Choose a reason for hiding this comment

Uh oh!

Copilot AI Apr 8, 2026

Choose a reason for hiding this comment

Uh oh!

Uh oh!

Uh oh!

Reviewers

Assignees

Labels

Projects

Milestone

Development

Uh oh!

2 participants