Implement SaaSKit Next.js

Add login, callback, a scalekit_session cookie, logout, and refresh in the App Router. Then stop.

Guardrails

• MUST re-check the session in Server Components. Middleware cookie-presence is not enough.
• MUST keep redirectUri identical to the dashboard Allowed callback URL.
• MUST set sameSite: 'lax' on every auth cookie. MUST NOT use 'strict' — it drops the cookie on the OAuth callback.
• MUST treat next as a relative path only (/..., not //…). MUST NOT redirect to an arbitrary URL.

Gotchas

• setup-saaskit already wrote env and registered the redirect. Start there.
• Read SCALEKIT_ENVIRONMENT_URL, SCALEKIT_CLIENT_ID, SCALEKIT_CLIENT_SECRET, and SCALEKIT_REDIRECT_URI. Never SCALEKIT_ENV_URL. Do not prepend https://.
• One scalekit_session JSON HttpOnly cookie. Do not copy Express path-scoped cookies from implement-saaskit.
• ScalekitClient is Node-only. Do not import it in middleware.ts (Edge).
• FSA scopes include offline_access. refreshAccessToken returns { accessToken, refreshToken } only.
• getLogoutUrl({ idTokenHint, postLogoutRedirectUri }). Register that post-logout URL.

Step 1 — Pick the path