80100e7631
Migrate to a monorepo setup - step 1 * Move web to subfolder /apps/scandic-web * Yarn + transitive deps - Move to yarn - design-system package removed for now since yarn doesn't support the parameter for token (ie project currently broken) - Add missing transitive dependencies as Yarn otherwise prevents these imports - VS Code doesn't pick up TS path aliases unless you open /apps/scandic-web instead of root (will be fixed with monorepo) * Pin framer-motion to temporarily fix typing issue https://github.com/adobe/react-spectrum/issues/7494 * Pin zod to avoid typ error There seems to have been a breaking change in the types returned by zod where error is now returned as undefined instead of missing in the type. We should just handle this but to avoid merge conflicts just pin the dependency for now. * Pin react-intl version Pin version of react-intl to avoid tiny type issue where formatMessage does not accept a generic any more. This will be fixed in a future commit, but to avoid merge conflicts just pin for now. * Pin typescript version Temporarily pin version as newer versions as stricter and results in a type error. Will be fixed in future commit after merge. * Setup workspaces * Add design-system as a monorepo package * Remove unused env var DESIGN_SYSTEM_ACCESS_TOKEN * Fix husky for monorepo setup * Update netlify.toml * Add lint script to root package.json * Add stub readme * Fix react-intl formatMessage types * Test netlify.toml in root * Remove root toml * Update netlify.toml publish path * Remove package-lock.json * Update build for branch/preview builds Approved-by: Linus Flood
100 lines
3.3 KiB
TypeScript
100 lines
3.3 KiB
TypeScript
import { NextResponse } from "next/server"
|
|
|
|
import { authRequired, mfaRequired } from "@/constants/routes/authRequired"
|
|
import { login } from "@/constants/routes/handleAuth"
|
|
import { getInternalNextURL, getPublicNextURL } from "@/server/utils"
|
|
|
|
import { auth } from "@/auth"
|
|
import { findLang } from "@/utils/languages"
|
|
|
|
import type { NextMiddleware } from "next/server"
|
|
|
|
import type { MiddlewareMatcher } from "@/types/middleware"
|
|
|
|
/**
|
|
* AppRouteHandlerFnContext is the context that is passed to the handler as
|
|
* the second argument. This is only done for Route handlers (route.js) and
|
|
* not for middleware. Middleware`s second argument is `event` of type
|
|
* `NextFetchEvent`.
|
|
*
|
|
* Auth.js uses the same pattern for both Route handlers and Middleware,
|
|
* the auth()-wrapper:
|
|
*
|
|
* auth((req) => { ... })
|
|
*
|
|
* But there is a difference between middleware and route handlers, route
|
|
* handlers get passed a context which middleware do not get (they get a
|
|
* NextFetchEvent instead). Using the same function for both works runtime
|
|
* because Auth.js handles this properly. But fails in typings as the second
|
|
* argument doesn't match for middleware.
|
|
*
|
|
* We want to avoid using ts-expect-error because that hides other errors
|
|
* not related to this typing error and ts-expect-error cannot be scoped either.
|
|
*
|
|
* So we type assert this export to NextMiddleware. The lesser of all evils.
|
|
*
|
|
* https://github.com/nextauthjs/next-auth/blob/3c035ec62f2f21d7cab65504ba83fb1a9a13be01/packages/next-auth/src/lib/index.ts#L265
|
|
* https://authjs.dev/reference/nextjs
|
|
*/
|
|
export const middleware = auth(async (request) => {
|
|
const lang = findLang(request.nextUrl.pathname)!
|
|
|
|
const isLoggedIn = !!request.auth
|
|
const hasError = request.auth?.error
|
|
|
|
// Inside auth() we need an internal request for rewrites.
|
|
// @see getInternalNextURL()
|
|
const nextUrlInternal = getInternalNextURL(request)
|
|
|
|
const nextUrlPublic = getPublicNextURL(request)
|
|
|
|
/**
|
|
* Function to validate MFA from token data
|
|
* @returns boolean
|
|
*/
|
|
function isMFAInvalid() {
|
|
const isMFATokenValid = request.auth
|
|
? request.auth.token.mfa_expires_at > Date.now()
|
|
: false
|
|
return !(request.auth?.token.mfa_scope && isMFATokenValid)
|
|
}
|
|
const isMFAPath = mfaRequired.includes(request.nextUrl.pathname)
|
|
|
|
if (isLoggedIn && isMFAPath && isMFAInvalid()) {
|
|
const headers = new Headers(request.headers)
|
|
headers.set("x-returnurl", nextUrlPublic.href)
|
|
headers.set("x-login-source", "mfa")
|
|
return NextResponse.rewrite(new URL(`/${lang}/login`, nextUrlInternal), {
|
|
request: {
|
|
headers,
|
|
},
|
|
})
|
|
}
|
|
|
|
if (isLoggedIn && !hasError) {
|
|
const headers = new Headers(request.headers)
|
|
headers.set("x-continue", "1")
|
|
return NextResponse.next({
|
|
headers,
|
|
})
|
|
}
|
|
|
|
const headers = new Headers()
|
|
headers.append(
|
|
"set-cookie",
|
|
`redirectTo=${encodeURIComponent(nextUrlPublic.href)}; Path=/; HttpOnly; SameSite=Lax`
|
|
)
|
|
|
|
const loginUrl = login[lang]
|
|
const redirectUrl = new URL(loginUrl, nextUrlPublic)
|
|
const redirectOpts = {
|
|
headers,
|
|
}
|
|
console.log(`[authRequired] redirecting to: ${redirectUrl}`, redirectOpts)
|
|
return NextResponse.redirect(redirectUrl, redirectOpts)
|
|
}) as NextMiddleware // See comment above
|
|
|
|
export const matcher: MiddlewareMatcher = (request) => {
|
|
return authRequired.includes(request.nextUrl.pathname)
|
|
}
|