Skip to content

Commit aeb7e8e

Browse files
BccorbBccorb
committed
Readme
1 parent 14e73cb commit aeb7e8e

4 files changed

Lines changed: 205 additions & 12 deletions

File tree

‎README.md‎

Lines changed: 172 additions & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -0,0 +1,172 @@
1+
# @seamless-auth/server
2+
3+
> A drop-in authentication API and route protection toolkit for Next.js powered by SeamlessAuth.
4+
5+
SeamlessAuth provides passwordless authentication, WebAuthn support, and Stripe-ready billing with minimal configuration. This server package handles **all authentication API routes and token validation** so you can focus on building your product.
6+
7+
---
8+
9+
## 🚀 Quick Start
10+
11+
### 1. Install the Package
12+
13+
```bash
14+
npm install @seamless-auth/server
15+
```
16+
17+
---
18+
19+
### 2. Create the Drop-In API Route
20+
21+
In your Next.js project:
22+
23+
```ts
24+
// app/api/auth/route.ts
25+
26+
export {
27+
authApiHandler as GET,
28+
authApiHandler as POST,
29+
authApiHandler as DELETE,
30+
authApiHandler as PATCH,
31+
} from "@seamless-auth/server";
32+
```
33+
34+
👉 This exposes all SeamlessAuth API routes automatically:
35+
36+
- `/api/auth/login`
37+
- `/api/auth/logout`
38+
- `/api/auth/user`
39+
- `/api/auth/registration/register`
40+
- `/api/auth/otp/*`
41+
- `/api/auth/webauthn/*`
42+
- `/api/auth/user/update`
43+
- `/api/auth/user/delete`
44+
45+
---
46+
47+
### 3. Wrap Your App with the Auth Provider
48+
49+
```tsx
50+
// app/layout.tsx
51+
import { AuthProvider } from "@seamless-auth/nextjs";
52+
53+
export default function RootLayout({ children }) {
54+
return (
55+
<html lang="en">
56+
<body>
57+
<AuthProvider>{children}</AuthProvider>
58+
</body>
59+
</html>
60+
);
61+
}
62+
```
63+
64+
---
65+
66+
### 4. Protect API Routes
67+
68+
```ts
69+
// app/api/protected/route.ts
70+
import { withAuth } from "@seamless-auth/server";
71+
72+
export const GET = withAuth(async (req, user) => {
73+
return Response.json({ message: "Hello, protected world!", user });
74+
});
75+
```
76+
77+
👉 Automatically verifies the token via JWKS and injects the user object.
78+
79+
---
80+
81+
### 5. Optional: Protect Pages with Middleware
82+
83+
```ts
84+
// middleware.ts
85+
import { getUserFromRequest } from "@seamless-auth/server";
86+
import { NextResponse } from "next/server";
87+
88+
const protectedPaths = ["/dashboard", "/settings"];
89+
90+
export async function middleware(req) {
91+
if (protectedPaths.some((path) => req.nextUrl.pathname.startsWith(path))) {
92+
const user = await getUserFromRequest(req);
93+
if (!user) {
94+
return NextResponse.redirect(new URL("/login", req.url));
95+
}
96+
}
97+
return NextResponse.next();
98+
}
99+
```
100+
101+
---
102+
103+
### 6. Environment Variables
104+
105+
Add this to your `.env.local`:
106+
107+
```env
108+
SEAMLESS_AUTH_JWKS_URL=https://your-auth-server.com/.well-known/jwks.json
109+
AUTH_SERVER_URL=https://your-auth-server.com
110+
```
111+
112+
---
113+
114+
## ✅ Features
115+
116+
- 🔒 Fully server-side token validation using JWKS.
117+
- 🔑 Built-in drop-in auth API routes.
118+
- 📦 No consumer-side API route boilerplate.
119+
- 🛡️ Secure cookie handling, ready for production.
120+
- ⚡️ Fast, minimal setup — just install and go.
121+
- 💻 Seamless Next.js integration.
122+
123+
---
124+
125+
## ✅ Provided API Routes
126+
127+
The following routes are automatically available:
128+
129+
### Authentication
130+
131+
- `POST /api/auth/login`
132+
- `POST /api/auth/logout`
133+
- `GET /api/auth/user`
134+
- `PATCH /api/auth/user/update`
135+
- `DELETE /api/auth/user/delete`
136+
137+
### Registration
138+
139+
- `POST /api/auth/registration/register`
140+
141+
### OTP
142+
143+
- `POST /api/auth/otp/generate-phone-otp`
144+
- `POST /api/auth/otp/generate-email-otp`
145+
- `POST /api/auth/otp/verify-phone-otp`
146+
- `POST /api/auth/otp/verify-email-otp`
147+
148+
### WebAuthn
149+
150+
- `POST /api/auth/webauthn/generate-authentication-options`
151+
- `POST /api/auth/webauthn/verify-authentication`
152+
- `POST /api/auth/webauthn/generate-registration-options`
153+
- `POST /api/auth/webauthn/verify-registration`
154+
155+
---
156+
157+
## ✅ Provided Utilities
158+
159+
- `withAuth` — Protects API routes with token validation.
160+
- `getUserFromRequest` — Reads cookies and verifies tokens in Next.js middleware or API routes.
161+
162+
---
163+
164+
## ✅ Coming Soon
165+
166+
- Built-in rate limiting for JWKS and auth endpoints.
167+
- Extended multi-tenant support.
168+
- Additional OAuth providers.
169+
170+
---
171+
172+
For the full frontend setup, see the `@seamless-auth/nextjs` package.

‎src/nextjs/routes/registration.ts‎

Lines changed: 20 additions & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -0,0 +1,20 @@
1+
import { NextRequest, NextResponse } from "next/server";
2+
3+
export async function registrationHandler(req: NextRequest) {
4+
if (req.method === "POST") {
5+
const authServerUrl =
6+
process.env.AUTH_SERVER_URL + "/registration/register";
7+
8+
const proxyRes = await fetch(authServerUrl, {
9+
method: "POST",
10+
body: await req.text(),
11+
headers: { "Content-Type": "application/json" },
12+
credentials: "include",
13+
});
14+
15+
const data = await proxyRes.json();
16+
return NextResponse.json(data, { status: proxyRes.status });
17+
}
18+
19+
return NextResponse.json({ error: "Not Found" }, { status: 404 });
20+
}

‎src/nextjs/routes/routes.ts‎

Lines changed: 0 additions & 10 deletions
This file was deleted.

‎src/nextjs/routes/webauthn.ts‎

Lines changed: 13 additions & 2 deletions
Original file line numberDiff line numberDiff line change
@@ -15,8 +15,19 @@ export async function webAuthnHandlers(req: NextRequest) {
1515
req.method === "POST" &&
1616
pathname.endsWith("/api/auth/webauthn/verify-authentication")
1717
) {
18-
// TODO: Proxy to auth server
19-
return NextResponse.json({ message: "Authentication verified" });
18+
const authServerUrl =
19+
process.env.AUTH_SERVER_URL + "/webAuthn/verify-authentication";
20+
21+
const proxyRes = await fetch(authServerUrl, {
22+
method: "POST",
23+
body: await req.text(),
24+
headers: { "Content-Type": "application/json" },
25+
credentials: "include",
26+
});
27+
28+
const data = await proxyRes.json();
29+
30+
return NextResponse.json(data, { status: proxyRes.status });
2031
}
2132

2233
if (

0 commit comments

Comments
 (0)