check server actions

Author: bcbogdan

lib/build/constants.js

@@ -11,3 +11,4 @@ export const REDIRECT_ATTEMPT_COUNT_COOKIE_NAME = "sSsrSessionRefreshAttempt";
 export const CURRENT_PATH_COOKIE_NAME = "sCurrentPath";
 export const FORCE_LOGOUT_PATH_PARAM_NAME = "forceLogout";
 export const REDIRECT_PATH_PARAM_NAME = "stRedirectTo";
+export const SESSION_REFRESH_API_PATH = "/api/auth/session/refresh";

lib/build/nextjs/constants.d.ts

@@ -14,57 +14,38 @@ import {
     FRONT_TOKEN_COOKIE_NAME,
     ANTI_CSRF_TOKEN_COOKIE_NAME,
     CURRENT_PATH_COOKIE_NAME,
+    SESSION_REFRESH_API_PATH,
 } from "./constants";
 
-import type { SuperTokensNextjsConfig, WithSession } from "./types";
+import type { ApiRequestMiddleware, SuperTokensNextjsConfig } from "./types";
 
 let AppInfo: SuperTokensNextjsConfig["appInfo"];
 const DEFAULT_API_BASE_PATH = "/api/auth";
 
-// Open questions:
-// - Do we need the x-user-id header?
-// - Do we want to enforce API route validation from the middleware
-// or do we explain how to do this at the API function level
-// - How do we pass withSession and ValidateSessionOptions together
-// - If we use withSession in the middleware, do we add some ability to choose which routes will be protected?
+// TODO: Test this inside a server action / form action
 export function superTokensMiddleware(
     config: SuperTokensNextjsConfig,
-    withSession: WithSession
+    apiRequestMiddleware?: ApiRequestMiddleware
 ): (request: Request) => Promise<Response | void> {
+    // TODO: Fix edge cases
     const usesTheNextjsApiAsTheAuthenticationServer = config.appInfo.apiDomain === config.appInfo.websiteDomain;
 
     return async (request: Request) => {
         const requestUrl = new URL(request.url);
-        if (requestUrl.pathname.startsWith("/api/auth/session/refresh") && request.method === "GET") {
+        // TODO: Use a constant here
+        if (requestUrl.pathname.startsWith(SESSION_REFRESH_API_PATH) && request.method === "GET") {
             return refreshSession(config, request);
         }
 
         if (requestUrl.pathname.startsWith("/api") && usesTheNextjsApiAsTheAuthenticationServer) {
-            if (request.headers.has("x-user-id")) {
-                console.warn(
-                    "The FE tried to pass x-user-id, which is only supposed to be a backend internal header. Ignoring."
-                );
-                request.headers.delete("x-user-id");
-            }
-
             if (requestUrl.pathname.startsWith(config.appInfo.apiBasePath || DEFAULT_API_BASE_PATH)) {
                 // this hits our pages/api/auth/* endpoints
                 return next();
             }
 
-            return withSession(request, async (err, session) => {
-                if (err) {
-                    return new Response(JSON.stringify(err), {
-                        status: 500,
-                        headers: { "Content-Type": "application/json" },
-                    });
-                }
-                const response = next();
-                if (session !== undefined) {
-                    response.headers.append("x-user-id", session.getUserId());
-                }
-                return response;
-            });
+            if (apiRequestMiddleware) {
+                return apiRequestMiddleware(request);
+            }
         }
 
         if (
@@ -105,6 +86,7 @@ export async function refreshSession(config: SuperTokensNextjsConfig, request: R
     }
 
     const requestUrl = new URL(request.url);
+    // TODO: Validate the redirect path
     const redirectTo = requestUrl.searchParams.get(REDIRECT_PATH_PARAM_NAME) || "/";
     try {
         const tokens = await fetchNewTokens(request);

lib/build/nextjs/middleware.d.ts

@@ -64,12 +64,14 @@ export type AccessTokenPayload = {
     };
 };
 
-export type WithSession = (
-    req: Request,
-    handler: (
-        error: Error | undefined,
-        session: (Record<string, unknown> & { getUserId: () => string }) | undefined
-    ) => Promise<Response>,
-    options?: unknown,
-    userContext?: Record<string, any>
-) => Promise<Response>;
+export interface ParsableRequest {
+    url: string;
+    method: string;
+    headers: Headers;
+    formData: () => Promise<FormData>;
+    json: () => Promise<any>;
+}
+
+export type ApiRequestMiddleware<Req extends ParsableRequest = Request, Res extends Response = Response> = (
+    req: Req
+) => Promise<Res>;