Skip to content

@last1id/sdk-nextjs

0.1.1

Docs only. Production issuer is https://auth.last1.id. LAST1_CLIENT_ID accepts the Client ID UUID or the App ID slug.

0.1.0

Initial release. Companion to @last1id/sdk@^0.3.0 for Next.js App Router partners.

Routing

  • createLast1Handler(config) returns { GET, POST } for a catch-all route at app/api/auth/last1/[...last1]/route.ts.
  • Auto-mounts four sub-routes:
  • GET /login — builds PKCE, sets an encrypted PKCE cookie (${cookieName}_pkce, 10-min max-age), redirects to ${issuerUrl}/oauth/authorize. Accepts a ?next=<same-origin path> parameter, validated against open-redirect attempts.
  • GET /callback — verifies state, exchanges the authorization code, derives identityId from the id_token (sub claim) or falls back to /oauth/userinfo, fires onLoginSuccess, writes an encrypted session cookie, and 302s to either the captured next path or loginSuccessRedirect.
  • POST /logout — decrypts the cookie, fires onLogout, clears the cookie, redirects.
  • GET /me — returns { session: { identityId, scope, accessTokenExpiresAt, issuedAt } } or 401. Tokens are never included in the JSON body.

Session helpers

  • getLast1Session({ sessionSecret, cookieName?, cookieStore? }) — reads cookies via next/headers by default, accepts an injected cookieStore for tests / non-Next.js environments.
  • withLast1Session({ ... }, handler) — wraps a Route Handler so it receives a primed Last1Client. Token rotations (driven by the base SDK's 401 → refresh → retry loop) are persisted back to the response cookie automatically. On a dead refresh chain (Last1AuthError), the wrapper clears the cookie and returns the configured unauthorizedResponse (default 401 JSON).
  • clearLast1SessionCookie(options?) — returns a clearing Set-Cookie header value for routes that do their own logout.

Crypto

  • AES-256-GCM session and PKCE cookies, encrypted with keys derived from the partner's sessionSecret via HKDF-SHA256 using a per-purpose info label (so the session cookie can never be parsed as a PKCE cookie or vice versa).
  • All crypto runs through Web Crypto (globalThis.crypto.subtle), so the handler works on Edge runtime, Node 20+, and Vercel Functions without any additional dependencies.

Re-exports

  • Last1Client, Last1AuthError, Last1HttpError, plus types UserinfoClaims and TokenSet from @last1id/sdk.