@drvalue-oss/iam-next

Next.js Route Handler factories for the drvalue IAM BFF token-exchange pattern:

• Refresh token lives in an httpOnly cookie on YOUR Next.js app (never touches the browser JS).
• Access token is delivered to the browser via URL hash, then stored in localStorage by the SPA.
• The Next.js app proxies refresh / revoke calls to IAM server-to-server, so the browser never CORS-talks to IAM directly.

Install

pnpm add @drvalue-oss/iam-next

Peer dep: next ^14 || ^15 || ^16.

Setup

Create one shared config and three Route Handlers:

// lib/iam.ts
import type { IamNextConfig } from '@drvalue-oss/iam-next';

export const iamConfig: IamNextConfig = {
  iamServerUrl: process.env.IAM_SERVER_URL!,        // https://iam.drvalue.co.kr
  appUrl: process.env.NEXT_PUBLIC_APP_URL!,         // https://app.drvalue.co.kr
  cookieDomain: process.env.COOKIE_DOMAIN,          // .drvalue.co.kr (optional)
  internalApiKey: process.env.INTERNAL_API_KEY,     // for token revoke (optional)
};

// app/auth/callback/route.ts
import { createCallbackHandler } from '@drvalue-oss/iam-next';
import { iamConfig } from '@/lib/iam';

export const GET = createCallbackHandler({
  ...iamConfig,
  resolveLoginPath: (origin) => (origin === 'admin' ? '/admin/login' : '/login'),
});

// app/api/auth/refresh/route.ts
import { createRefreshHandler } from '@drvalue-oss/iam-next';
import { iamConfig } from '@/lib/iam';

export const POST = createRefreshHandler(iamConfig);

// app/api/auth/logout/route.ts
import { createLogoutHandler } from '@drvalue-oss/iam-next';
import { iamConfig } from '@/lib/iam';

export const POST = createLogoutHandler(iamConfig);

The /auth/complete bridge page

The callback handler redirects to /auth/complete#access_token=...&expires_in=... so the access token never lands in a server log. Implement the bridge yourself — it needs to:

1. Parse the hash, call setAccessToken(token, expiresIn) from @drvalue-oss/iam-react.
2. (optional) Fetch /me to populate your auth store.
3. Redirect to the user's destination (admin dashboard / user dashboard / etc).

See examples/nextjs-app/src/app/auth/complete/page.tsx for a reference implementation.

Why the URL hash

The hash is not sent to the server on navigation. The Next.js server never sees the access token. Combined with window.history.replaceState on the complete page, the token also disappears from the browser URL bar after handoff.

License

MIT