feat: auth0 server import restructure by Piyush-85 · Pull Request #2828 · auth0/nextjs-auth0

Piyush-85 · 2026-08-31T06:03:27Z

Pure file restructure of src/server/ with no logic changes, in preparation for the @auth0/auth0-server-js migration. Code is relocated verbatim into per-domain folders; the only edits are import-path updates and extracting inline types into dedicated types.ts files that are re-exported so all existing import paths remain valid. Public API is unchanged.

Changes

Moved auth-client.ts into its own folder; extracted module-level constants, helpers, error utilities, and inline types into separate files with the class kept whole.
Split cookies.ts into chunks.ts (cookie plumbing) and encryption.ts (crypto, the future swap target).
Grouped fetcher, proxy, and their types into a fetcher/ folder.
Grouped DPoP utilities, retry logic, and types into the existing dpop/ folder.
Moved session utility helpers and their tests into the session/ folder; extracted inline types from the session store files.
Extracted inline types from the helpers/ handler files into a shared types.ts.
Moved MFA utilities and their tests into the mfa/ folder.
Moved next-compat.ts and its test into a new http/ folder.
Moved feature-domain test files into their respective domain folders (passkey/, passwordless/, my-account/, connected-accounts/).
Consolidated core server test files into src/server/tests/.
Renamed src/test/ to src/test-fixtures/.

Testing

npm run build passes
npm run lint passes
Full unit suite green (~1902 tests)
Diff audit: all relocations are renames with identical content; only import paths changed

Checklist

No breaking changes to public API
No logic changes
All tests pass

…st into src/server

…itical RCE vulnerabilities

…-g3m4-5g8c)

#2824)

Co-authored-by: nandan-bhat <167290944+nandan-bhat@users.noreply.github.com>

Signed-off-by: dependabot[bot] <support@github.com> Co-authored-by: dependabot[bot] <49699333+dependabot[bot]@users.noreply.github.com> Co-authored-by: Piyush Kumar <piykumar85@gmail.com>

… migration

…ndary

…auth-client

coderabbitai · 2026-08-31T06:03:35Z

Important

Review skipped

Auto reviews are disabled on base/target branches other than the default branch.

Please check the settings in the CodeRabbit UI or the .coderabbit.yaml file in this repository. To trigger a single review, invoke the @coderabbitai review command.

⚙️ Run configuration

Configuration used: defaults

Review profile: CHILL

Plan: Team

Run ID: 3c2d5c11-735b-4f3d-a521-d1f811d309d9

You can disable this status message by setting the reviews.review_status to false in the CodeRabbit configuration file.

Use the checkbox below for a quick retry:

🔍 Trigger review

Thanks for using CodeRabbit! It's free for OSS, and your support helps us grow. If you like it, consider giving us a shout-out.

❤️ Share

_{Comment @coderabbitai help to get the list of available commands.}

…2822) Co-authored-by: Piyush Kumar <piyush.kumar@okta.com> Co-authored-by: Piyush Kumar <piykumar85@gmail.com>

# Conflicts: # src/server/auth-client/auth-client.ts # src/server/mfa/mfa-popup.test.ts # src/server/passwordless/passwordless-server.flow.test.ts # src/server/session/stateless-session-store.ts # src/server/tests/auth-client.test.ts # src/server/tests/transaction-store.test.ts

semgrepcode-auth0 · 2026-09-01T12:05:56Z

Semgrep found 1 ssc-7b3c1e5a-9d24-4f80-b6a1-2c8e0f35d719 finding:

examples/with-shadcn/pnpm-lock.yaml
- L1722 - Triage

Risk: Affected versions of js-yaml are vulnerable to Inefficient Algorithmic Complexity. An attacker can supply a YAML document containing a large !!omap sequence, which js-yaml resolves with a linear duplicate-key scan inside its per-element loop. Resolution is therefore quadratic in the number of entries, so a modestly sized document consumes disproportionate CPU inside the load call and blocks the event loop, resulting in a denial of service.

Manual Review Advice: A vulnerability from this advisory is reachable if you are using js-yaml on the CLI

Fix: Upgrade this library to at least version 4.3.1 at nextjs-auth0/examples/with-shadcn/pnpm-lock.yaml:1722.

Reference(s): GHSA-5p4m-2wfm-xmqj

Semgrep found 1 ssc-b5be3fd7-c1fb-4156-b16f-2fc35cb62b00 finding:

examples/with-shadcn/pnpm-lock.yaml
- L1722 - Triage

Risk: Affected versions of js-yaml are vulnerable to Inefficient Algorithmic Complexity / Uncontrolled Resource Consumption. An attacker can supply a YAML document containing a chain of mappings that each merge the previous one via the merge key (<<), causing js-yaml to spend quadratic CPU time while parsing input whose size grows only linearly, resulting in a denial of service.

Manual Review Advice: A vulnerability from this advisory is reachable if you are using js-yaml on the CLI

Fix: Upgrade this library to at least version 4.3.0 at nextjs-auth0/examples/with-shadcn/pnpm-lock.yaml:1722.

Reference(s): https://euvd.enisa.europa.eu/vulnerability/EUVD-2026-42301, GHSA-52cp-r559-cp3m, CVE-2026-59869

Piyush-85 and others added 23 commits August 25, 2026 16:43

chore: rename src/test to src/test-fixtures and move organizations.te…

85460ef

…st into src/server

chore: move core test files to src/server/tests/

659f84a

chore: move domain test files to their respective domain folders

eb3cde5

chore: move dpop utils to src/server/dpop/

3e43728

chore: move proxy utils to src/server/fetcher/

96e8484

chore: move src/server/fetcher.ts into src/server/fetcher/ folder

c4f7eef

chore: added migration example to gitignore for internal testing

325087a

fix: bump next.js to patched versions (15.5.24, 16.3.3) addressing cr…

1e19f24

…itical RCE vulnerabilities

fix: bump sharp to 0.35.4 across lockfiles for libheif RCE (GHSA-rgj7…

a3bcfee

…-g3m4-5g8c)

fix: bump next.js to patched versions (15.5.24, 16.3.3) addressing cr… (

f838be2

#2824)

Release v4.28.0

f4aa5c8

Release v4.28.0 (#2825)

42a81f4

Initial plan

60ea54b

fix: use pnpm pack instead of tar to create rl-scanner artifact

039cdf2

Co-authored-by: nandan-bhat <167290944+nandan-bhat@users.noreply.github.com>

fix: use pnpm pack instead of tar for RL scanner artifact (#2826)

0f998bc

Release v4.28.0 (#2825) (#2827)

4a90af5

fix: txn cookie accumulation (#2748)

9846912

chore(deps): bump jose from 6.2.9 to 6.2.10 (#2820)

09c430e

Signed-off-by: dependabot[bot] <support@github.com> Co-authored-by: dependabot[bot] <49699333+dependabot[bot]@users.noreply.github.com> Co-authored-by: Piyush Kumar <piykumar85@gmail.com>

chore(deps): bump the codeql-action group with 3 updates (#2821)

8070bdc

Signed-off-by: dependabot[bot] <support@github.com> Co-authored-by: dependabot[bot] <49699333+dependabot[bot]@users.noreply.github.com> Co-authored-by: Piyush Kumar <piykumar85@gmail.com>

chore(deps-dev): bump @types/react-dom from 19.2.4 to 19.2.5 (#2823)

88a8289

Signed-off-by: dependabot[bot] <support@github.com> Co-authored-by: dependabot[bot] <49699333+dependabot[bot]@users.noreply.github.com> Co-authored-by: Piyush Kumar <piykumar85@gmail.com>

chore: restructure src/server into domain folders for auth0-server-js…

7e84d25

… migration

chore: extract auth-client into auth-client/ folder for migration bou…

d01f116

…ndary

chore: extract per-domain types.ts and lift this-free helpers out of …

59a8204

…auth-client

Piyush-85 requested a review from a team as a code owner August 31, 2026 06:03

chore: Extract MFA related examples to a dedicated examples/mfa.md (#…

963aa38

…2822) Co-authored-by: Piyush Kumar <piyush.kumar@okta.com> Co-authored-by: Piyush Kumar <piykumar85@gmail.com>

Piyush-85 changed the title ~~Feat/auth0 server import restructure~~ feat: auth0 server import restructure Sep 1, 2026

Navigation Menu

Uh oh!

feat: auth0 server import restructure - #2828

feat: auth0 server import restructure#2828
Piyush-85 wants to merge 25 commits into
feat/auth0-server-importfrom
feat/auth0-server-import-restructure

Piyush-85 commented Aug 31, 2026

Uh oh!

coderabbitai Bot commented Aug 31, 2026 •

edited

Loading

Review skipped

Uh oh!

semgrepcode-auth0 Bot commented Sep 1, 2026

Uh oh!

Reviewers

Assignees

Labels

Projects

Milestone

Development

Uh oh!

3 participants

Uh oh!

Conversation

Piyush-85 commented Aug 31, 2026

Changes

Testing

Checklist

Uh oh!

coderabbitai Bot commented Aug 31, 2026 • edited Loading Uh oh! There was an error while loading. Please reload this page.

Uh oh!

Review skipped

Uh oh!

semgrepcode-auth0 Bot commented Sep 1, 2026

Uh oh!

Reviewers

Assignees

Labels

Projects

Milestone

Development

Uh oh!

3 participants

coderabbitai Bot commented Aug 31, 2026 •

edited

Loading