Pkg/auth/0.5 by YoungMayor · Pull Request #46 · MayR-Labs/mayrlabs-js

YoungMayor · 2026-04-10T08:15:54Z

No description provided.

… and update references

…hooks, and implement role-based access control in AuthProvider

…ient SDK

…el for consistency

… and update references feat: introduce MayRLabsUser utility class, add auth lifecycle event hooks, and implement role-based access control in AuthProvider

Copilot

Pull request overview

This PR bumps @mayrlabs/auth and @mayrlabs/auth-nextjs to 0.5.0, standardizes exported payload types, and adds new security/auth utilities (PKCE + CSRF state) alongside a higher-level AuthUser model used by the Next.js wrapper.

Changes:

Rename MayRLabsAuth*Payload types to Auth*Payload and align user claims shape with Account Center (id/username + nullable names).
Add core utilities: AuthUser, PKCE helpers (generateCodeVerifier, generateCodeChallenge) and random string generation; export them from the package root.
Update Next.js integration to add CSRF state verification, auth lifecycle hooks, role-gated AuthProvider, and optional session rotation.

Reviewed changes

Copilot reviewed 21 out of 21 changed files in this pull request and generated 7 comments.

Show a summary per file

File	Description
packages/auth/src/types.ts	Renames/reshapes JWT payload types; adds optional `events` hooks to `ClientConfig`.
packages/auth/src/index.ts	Exports new `core/utils` module from package entrypoint.
packages/auth/src/core/utils.ts	Introduces `AuthUser` wrapper + PKCE/random helpers.
packages/auth/src/core/_utils.ts	Adds internal crypto-random string generator + charsets.
packages/auth/src/core/client.ts	Extends `getLoginUrl` to accept additional query params.
packages/auth/src/core/constants.ts	Splits session cookie constants into client vs issuer keys.
packages/auth/src/core/base.ts	Updates payload type names across verification APIs.
packages/auth/src/core/issuer.ts	Updates payload type names across signing APIs.
packages/auth/README.md	Documents new model/hooks/CSRF/PKCE and updated types.
packages/auth/docs/pkce.md	Adds detailed PKCE documentation.
packages/auth/package.json	Version bump to `0.5.0`.
packages/auth/CHANGELOG.md	Changelog entry for `0.5.0` features/breaking changes.
packages/auth-nextjs/src/types.ts	Updates Next.js wrapper types to return `AuthUser` and adds new options.
packages/auth-nextjs/src/client/index.tsx	Implements CSRF state verification, redirect params, session rotation, role gating.
packages/auth-nextjs/src/client/provider.tsx	Updates client hook to expose `AuthUser` instance.
packages/auth-nextjs/src/issuer/index.ts	Switches issuer session key default and returns `AuthUser`.
packages/auth-nextjs/src/index.test.ts	Adjusts one cookie-key assertion (but broader changes add new untested paths).
packages/auth-nextjs/vitest.setup.ts	Updates test session key default.
packages/auth-nextjs/README.md	Documents new role gating, CSRF, redirects, session sliding.
packages/auth-nextjs/package.json	Version bump to `0.5.0` and uses workspace dependency on `@mayrlabs/auth`.
packages/auth-nextjs/CHANGELOG.md	Changelog entry for `0.5.0` and session key changes.

Comments suppressed due to low confidence (1)

packages/auth-nextjs/src/client/index.tsx:259

CSRF state verification in handleCallback requires both a state query param and a mayrlabs-auth-state cookie, but getUserOrRedirect() redirects with setup.getLoginUrl() (no state, no cookie). That will cause legitimate SSO callbacks to fail with CLIENT_CSRF_MISMATCH when login is initiated via Server Components using getUserOrRedirect. Consider generating/storing state (via cookies().set) before calling redirect(...), or routing unauthenticated flows through a helper that can set the state cookie.

  const getUserOrRedirect = async (): Promise<AuthUser> => {
    const user = await getUser();

    if (!user) return redirect(setup.getLoginUrl());

💡 Add Copilot custom instructions for smarter, more guided reviews. Learn how to get started.

Copilot · 2026-04-10T08:22:47Z

+function b64url(buffer: Uint8Array): string {
+  const binary = String.fromCharCode(...buffer);
+  const base64 = btoa(binary);
+
+  return base64.replace(/\+/g, "-").replace(/\//g, "_").replace(/=+$/, "");
+}


btoa is not available in Node.js, so generateCodeChallenge() will throw at runtime in server contexts (e.g. Next.js route handlers). Use a base64url encoder that works in both browser and Node (e.g. Buffer.from(bytes).toString("base64") when Buffer exists, otherwise btoa), or centralize base64url encoding in a shared utility.

Copilot · 2026-04-10T08:22:48Z

    const user = await getUser();

    if (!user) return redirect(setup.getLoginUrl());



AuthProvider redirects unauthenticated users with redirect(setup.getLoginUrl()), which does not set the CSRF state cookie or add the state param. With state verification enabled in handleCallback, any login initiated by AuthProvider will fail on callback. Generate/store the state cookie and include state in the login URL before redirecting, or refactor so AuthProvider uses a state-aware redirect helper.

Copilot · 2026-04-10T08:22:49Z

+export class AuthUser {
+  constructor(private readonly payload: AuthUserPayload) {}
+
+  /**
+   * The unique identifier for the user.
+   */
+  get id(): string {
+    return this.payload.id;
+  }
+
+  /**
+   * The user's email address.
+   */
+  get email(): string {


New public utilities (AuthUser, generateCodeVerifier, generateCodeChallenge, generateRandomString) are introduced here, but there are no accompanying unit tests in packages/auth/src/core/*.test.ts. Add tests to validate PKCE challenge generation (known verifier -> expected challenge), verifier charset/length constraints, and AuthUser role helpers to prevent regressions.

…om hello package, and initialize telegram-service tests

Allow customizing the CSRF state cookie key and improve state handling/security. The Next.js client now reads MAYRLABS_AUTH_STATE_KEY from env and accepts cookie.stateKey in options, deletes the state cookie immediately after consumption, and no longer requires a request argument for redirectToLogin (uses absolute redirect). Types, tests and README updated to reflect behavior and verify deletion and custom key usage. Also: make b64url base64 encoding work in Node and browsers, add core utils tests, and adjust a minor URL param ordering in core client.

… instead of login

…directs instead of absolute SSO URLs

…okie mocks

…package

…ronment variable usage for configuration keys

…fined configuration

YoungMayor added 5 commits April 8, 2026 16:56

refactor: split session key into distinct client and issuer constants…

314705b

… and update references

feat: introduce MayRLabsUser utility class, add auth lifecycle event …

5bee898

…hooks, and implement role-based access control in AuthProvider

feat: add autoRotateCookie support and auth event hooks to Next.js cl…

d440597

…ient SDK

refactor: rename MayRLabsAuth* types to Auth* and update AuthUser mod…

eaa90af

…el for consistency

refactor: split session key into distinct client and issuer constants…

232fc15

… and update references feat: introduce MayRLabsUser utility class, add auth lifecycle event hooks, and implement role-based access control in AuthProvider

YoungMayor requested a review from Copilot April 10, 2026 08:16

Copilot started reviewing on behalf of YoungMayor April 10, 2026 08:16 View session

Copilot AI reviewed Apr 10, 2026

View reviewed changes

YoungMayor added 9 commits April 10, 2026 09:33

test: add CSRF state validation to auth tests, remove test scripts fr…

537ab5f

…om hello package, and initialize telegram-service tests

test: initialize auth client in handleCallback error test case

05ee58b

fix: update getUserOrRedirect and AuthGuard to redirect to error page…

ec173f8

… instead of login

feat: update changelogs and refactor auth-nextjs to use local path re…

8355f4f

…directs instead of absolute SSO URLs

feat: add default values for environment variables and update test co…

9e89c37

…okie mocks

chore: pin @mayrlabs/auth dependency to version 0.5.0 in auth-nextjs …

245a2ae

…package

refactor: remove redundant client schema definitions and enforce envi…

69fff1e

…ronment variable usage for configuration keys

fix: remove default value for MAYRLABS_AUTH_SESSION_KEY to allow unde…

c96fc73

…fined configuration

YoungMayor merged commit 386e1aa into main Apr 10, 2026
1 check passed

YoungMayor deleted the pkg/auth/0.5 branch April 10, 2026 10:24

Navigation Menu

Uh oh!

Pkg/auth/0.5 - #46

Pkg/auth/0.5#46
YoungMayor merged 14 commits into
mainfrom
pkg/auth/0.5

YoungMayor commented Apr 10, 2026

Uh oh!

Copilot AI left a comment

Uh oh!

Copilot AI Apr 10, 2026

Uh oh!

Uh oh!

Copilot AI Apr 10, 2026

Uh oh!

Uh oh!

Uh oh!

Copilot AI Apr 10, 2026

Uh oh!

Uh oh!

Uh oh!

Reviewers

Assignees

Labels

Projects

Milestone

Development

Uh oh!

2 participants

		const user = await getUser();

		if (!user) return redirect(setup.getLoginUrl());

Uh oh!

Conversation

YoungMayor commented Apr 10, 2026

Uh oh!

Copilot AI left a comment

Choose a reason for hiding this comment

Pull request overview

Reviewed changes

Uh oh!

Copilot AI Apr 10, 2026

Choose a reason for hiding this comment

Uh oh!

Uh oh!

Copilot AI Apr 10, 2026

Choose a reason for hiding this comment

Uh oh!

Uh oh!

Uh oh!

Copilot AI Apr 10, 2026

Choose a reason for hiding this comment

Uh oh!

Uh oh!

Uh oh!

Reviewers

Assignees

Labels

Projects

Milestone

Development

Uh oh!

2 participants