# Aurabase Next.js App Router & SSR Reference

> Packages: `@aurabase/aurabase-js/ssr` and `@aurabase/aurabase-js/nextjs`
> Documentation: https://aurabase.cloud/en/docs/guides/nextjs-ssr
> Full support for Next.js 15 & 16: Server Components, Server Actions, Route Handlers, Middleware (or proxy.ts), and cookie chunking (RFC 6265).

## 1. Middleware / Proxy (`proxy.ts` or `middleware.ts`)
Refreshes and verifies JWT session cookies automatically on every request:

```typescript
import { createServerClient } from '@aurabase/aurabase-js/ssr'
import { NextResponse, type NextRequest } from 'next/server'

export async function proxy(request: NextRequest) {
  const response = NextResponse.next({ request })

  const aura = createServerClient(
    process.env.NEXT_PUBLIC_AURABASE_URL!,
    process.env.NEXT_PUBLIC_AURABASE_ANON_KEY!,
    {
      cookies: {
        getAll() { return request.cookies.getAll() },
        setAll(cookies) {
          cookies.forEach(({ name, value, options }) => {
            request.cookies.set(name, value)
            response.cookies.set(name, value, options)
          })
        },
      },
    }
  )

  const { data: user } = await aura.auth.getUser()

  if (!user && request.nextUrl.pathname.startsWith('/dashboard')) {
    return NextResponse.redirect(new URL('/login', request.url))
  }

  return response
}

export const config = {
  matcher: ['/((?!_next/static|_next/image|favicon.ico|.*\.(?:svg|png|jpg|jpeg|gif|webp)$).*)'],
}
```

## 2. Server Components (Read-Only)
```typescript
import { cookies } from 'next/headers'
import { createServerClient } from '@aurabase/aurabase-js/ssr'
import type { Database } from '@/lib/aurabase.types'

export default async function DashboardPage() {
  const cookieStore = await cookies()
  const aura = createServerClient<Database>(
    process.env.NEXT_PUBLIC_AURABASE_URL!,
    process.env.NEXT_PUBLIC_AURABASE_ANON_KEY!,
    {
      cookies: {
        getAll() { return cookieStore.getAll() },
        setAll() { /* No-op in Server Component */ },
      },
    }
  )

  const { data: posts } = await aura.from('posts').select('*')
  return (
    <main>
      <h1>Dashboard</h1>
      <ul>{posts?.map((p) => <li key={p.id}>{p.title}</li>)}</ul>
    </main>
  )
}
```

## 3. Server Actions (Secure Mutations)
```typescript
'use server'

import { cookies } from 'next/headers'
import { revalidatePath } from 'next/cache'
import { createServerClient } from '@aurabase/aurabase-js/ssr'

export async function createPostAction(formData: FormData) {
  const cookieStore = await cookies()
  const aura = createServerClient(
    process.env.NEXT_PUBLIC_AURABASE_URL!,
    process.env.NEXT_PUBLIC_AURABASE_ANON_KEY!,
    {
      cookies: {
        getAll() { return cookieStore.getAll() },
        setAll(cookies) {
          try {
            cookies.forEach(({ name, value, options }) => cookieStore.set(name, value, options))
          } catch { /* Ignored when called in Server Component */ }
        },
      },
    }
  )

  const title = formData.get('title') as string
  await aura.from('posts').insert({ title })
  revalidatePath('/dashboard')
}
```