remove accessToken from being sent to client components

[nicknisi]

Breaking change

This removes accessToken from being accessible in client components. The following is no longer allowed.

const { accessToken } = useAuth(); // no longer accessible

This pull request focuses on removing the accessToken from the client-side code to enhance security and simplify the auth object. The most important changes include sanitizing the auth object, updating actions to use the sanitized auth object, and modifying components to remove references to accessToken.

Security Improvements:

• Added a sanitize function to remove the accessToken from the auth object before it is used on the client side. (src/actions.ts)
• Updated getAuthAction and refreshAuthAction to use the sanitize function. (src/actions.ts) [1] [2]

Component Updates:

• Removed accessToken from the AuthContextType type definition. (src/components/authkit-provider.tsx)
• Removed accessToken state and related code from the AuthKitProvider component. (src/components/authkit-provider.tsx) [1] [2] [3] [4] [5]

Test Adjustments:

• Removed accessToken from test mock data in useAuth test suite. (__tests__/authkit-provider.spec.tsx)

[cmatheson]

we should probably remove these oauthTokens too for good measure (maybe someone else on the team thinks differently?).

[nicknisi]

It looks like that's only referenced in that test and isn't actually passed to the client. We're only sending UserInfo | NoUserInfo from these actions

authkit-nextjs/src/interfaces.ts

Lines 26 to 45 in 700f29d

	export interface UserInfo {
	user: User;
	sessionId: string;
	organizationId?: string;
	role?: string;
	permissions?: string[];
	entitlements?: string[];
	impersonator?: Impersonator;
	accessToken: string;
	}
	export interface NoUserInfo {
	user: null;
	sessionId?: undefined;
	organizationId?: undefined;
	role?: undefined;
	permissions?: undefined;
	entitlements?: undefined;
	impersonator?: undefined;
	accessToken?: undefined;
	}

[nicknisi]

I went ahead and removed oauthTokens here from the mock return.

[cmatheson]

oh i see, we pass the oauthTokens to an onSuccess callback but otherwise don't store them at all 👍

[statico]

Hi there! How does this affect the <UsersManagement /> widget as described in the WorkOS Widgets docs? Those docs say to use getAccessToken from useAuth(). (cc @tburgin)

[cmatheson]

@statico getAccessToken() is for authkit-react. Nextjs falls into the backend integrations bucket (token docs)