@asgardeo/nextjs 0.3.9 → 0.3.11

package/dist/esm/server/actions/signInAction.js

@@ -19,6 +19,7 @@
 import { generateSessionId, EmbeddedSignInFlowStatus, isEmpty, } from '@asgardeo/node';
 import { cookies } from 'next/headers';
 import AsgardeoNextClient from '../../AsgardeoNextClient';
+import logger from '../../utils/logger';
 import SessionManager from '../../utils/SessionManager';
 /**
  * Server action for signing in a user.
@@ -74,13 +75,21 @@ const signInAction = async (payload, request) => {
                 state: response?.authData?.state,
             }, {}, sessionId);
             if (signInResult) {
-                const idToken = await client.getDecodedIdToken(sessionId);
+                const idToken = await client.getDecodedIdToken(sessionId, (signInResult['idToken'] || signInResult['id_token']));
                 const userIdFromToken = (idToken['sub'] || signInResult['sub'] || sessionId);
                 const { accessToken } = signInResult;
+                const refreshToken = signInResult['refreshToken'] ?? '';
                 const scopes = signInResult['scope'];
                 const organizationId = (idToken['user_org'] || idToken['organization_id']);
-                const sessionToken = await SessionManager.createSessionToken(accessToken, userIdFromToken, sessionId, scopes, organizationId);
-                cookieStore.set(SessionManager.getSessionCookieName(), sessionToken, SessionManager.getSessionCookieOptions());
+                const rawExpiresIn = signInResult['expiresIn'] ?? signInResult['expires_in'];
+                const expiresIn = Number(rawExpiresIn);
+                if (Number.isNaN(expiresIn)) {
+                    throw new Error(`[signInAction] Invalid expiresIn value received: ${rawExpiresIn}`);
+                }
+                const config = await client.getConfiguration();
+                const sessionCookieExpiryTime = SessionManager.resolveSessionCookieExpiry(config.sessionCookieExpiryTime);
+                const sessionToken = await SessionManager.createSessionToken(accessToken, userIdFromToken, sessionId, scopes, expiresIn, refreshToken, organizationId);
+                cookieStore.set(SessionManager.getSessionCookieName(), sessionToken, SessionManager.getSessionCookieOptions(sessionCookieExpiryTime));
                 cookieStore.delete(SessionManager.getTempSessionCookieName());
             }
             const afterSignInUrl = await (await client.getStorageManager()).getConfigDataParameter('afterSignInUrl');
@@ -89,8 +98,7 @@ const signInAction = async (payload, request) => {
         return { data: response, success: true };
     }
     catch (error) {
-        // eslint-disable-next-line no-console
-        console.error('[signInAction] Error during sign-in:', error);
+        logger.error(`[signInAction] Error during sign-in: ${error instanceof Error ? error.message : String(error)}`);
         return { error: String(error), success: false };
     }
 };

package/dist/esm/server/actions/signInAction.js.map

@@ -1 +1 @@
-{"version":3,"file":"signInAction.js","sourceRoot":"","sources":["../../../../src/server/actions/signInAction.ts"],"names":[],"mappings":"AAAA;;;;;;;;;;;;;;;;GAgBG;AAEH,YAAY,CAAC;AAEb,OAAO,EACL,iBAAiB,EACjB,wBAAwB,EAKxB,OAAO,GACR,MAAM,gBAAgB,CAAC;AAExB,OAAO,EAAC,OAAO,EAAC,MAAM,cAAc,CAAC;AACrC,OAAO,kBAAkB,MAAM,0BAA0B,CAAC;AAC1D,OAAO,cAAqC,MAAM,4BAA4B,CAAC;AAE/E;;;;;;;GAOG;AACH,MAAM,YAAY,GAAG,KAAK,EACxB,OAAgD,EAChD,OAA0C,EAUzC,EAAE;IACH,IAAI,CAAC;QACH,MAAM,MAAM,GAAuB,kBAAkB,CAAC,WAAW,EAAE,CAAC;QACpE,MAAM,WAAW,GAA2B,MAAM,OAAO,EAAE,CAAC;QAE5D,IAAI,SAA6B,CAAC;QAElC,MAAM,oBAAoB,GAAuB,WAAW,CAAC,GAAG,CAAC,cAAc,CAAC,oBAAoB,EAAE,CAAC,EAAE,KAAK,CAAC;QAE/G,IAAI,oBAAoB,EAAE,CAAC;YACzB,IAAI,CAAC;gBACH,MAAM,cAAc,GAAwB,MAAM,cAAc,CAAC,kBAAkB,CAAC,oBAAoB,CAAC,CAAC;gBAC1G,SAAS,GAAG,cAAc,CAAC,SAAS,CAAC;YACvC,CAAC;YAAC,MAAM,CAAC;gBACP,sDAAsD;YACxD,CAAC;QACH,CAAC;QAED,IAAI,CAAC,SAAS,EAAE,CAAC;YACf,MAAM,gBAAgB,GAAuB,WAAW,CAAC,GAAG,CAAC,cAAc,CAAC,wBAAwB,EAAE,CAAC,EAAE,KAAK,CAAC;YAE/G,IAAI,gBAAgB,EAAE,CAAC;gBACrB,IAAI,CAAC;oBACH,MAAM,WAAW,GAAwB,MAAM,cAAc,CAAC,iBAAiB,CAAC,gBAAgB,CAAC,CAAC;oBAClG,SAAS,GAAG,WAAW,CAAC,SAAS,CAAC;gBACpC,CAAC;gBAAC,MAAM,CAAC;oBACP,4CAA4C;gBAC9C,CAAC;YACH,CAAC;QACH,CAAC;QAED,IAAI,CAAC,SAAS,EAAE,CAAC;YACf,SAAS,GAAG,iBAAiB,EAAE,CAAC;YAEhC,MAAM,gBAAgB,GAAW,MAAM,cAAc,CAAC,iBAAiB,CAAC,SAAS,CAAC,CAAC;YAEnF,WAAW,CAAC,GAAG,CACb,cAAc,CAAC,wBAAwB,EAAE,EACzC,gBAAgB,EAChB,cAAc,CAAC,2BAA2B,EAAE,CAC7C,CAAC;QACJ,CAAC;QAED,8EAA8E;QAC9E,IAAI,CAAC,OAAO,IAAI,OAAO,CAAC,OAAO,CAAC,EAAE,CAAC;YACjC,MAAM,gBAAgB,GAAW,MAAM,MAAM,CAAC,sBAAsB,CAAC,EAAE,EAAE,SAAS,CAAC,CAAC;YACpF,OAAO,EAAC,IAAI,EAAE,EAAC,SAAS,EAAE,MAAM,CAAC,gBAAgB,CAAC,EAAC,EAAE,OAAO,EAAE,IAAI,EAAC,CAAC;QACtE,CAAC;QAED,+BAA+B;QAC/B,MAAM,QAAQ,GAAQ,MAAM,MAAM,CAAC,MAAM,CAAC,OAAO,EAAE,OAAQ,EAAE,SAAS,CAAC,CAAC;QAExE,IAAI,QAAQ,CAAC,UAAU,KAAK,wBAAwB,CAAC,gBAAgB,EAAE,CAAC;YACtE,MAAM,YAAY,GAA4B,MAAM,MAAM,CAAC,MAAM,CAC/D;gBACE,IAAI,EAAE,QAAQ,EAAE,QAAQ,EAAE,IAAI;gBAC9B,aAAa,EAAE,QAAQ,EAAE,QAAQ,EAAE,aAAa;gBAChD,KAAK,EAAE,QAAQ,EAAE,QAAQ,EAAE,KAAK;aAC1B,EACR,EAAE,EACF,SAAS,CACV,CAAC;YAEF,IAAI,YAAY,EAAE,CAAC;gBACjB,MAAM,OAAO,GAAY,MAAM,MAAM,CAAC,iBAAiB,CAAC,SAAS,CAAC,CAAC;gBACnE,MAAM,eAAe,GAAW,CAAC,OAAO,CAAC,KAAK,CAAC,IAAI,YAAY,CAAC,KAAK,CAAC,IAAI,SAAS,CAAW,CAAC;gBAC/F,MAAM,EAAC,WAAW,EAAC,GAA0B,YAAqC,CAAC;gBACnF,MAAM,MAAM,GAAW,YAAY,CAAC,OAAO,CAAW,CAAC;gBACvD,MAAM,cAAc,GAAuB,CAAC,OAAO,CAAC,UAAU,CAAC,IAAI,OAAO,CAAC,iBAAiB,CAAC,CAEhF,CAAC;gBAEd,MAAM,YAAY,GAAW,MAAM,cAAc,CAAC,kBAAkB,CAClE,WAAW,EACX,eAAe,EACf,SAAmB,EACnB,MAAM,EACN,cAAc,CACf,CAAC;gBAEF,WAAW,CAAC,GAAG,CAAC,cAAc,CAAC,oBAAoB,EAAE,EAAE,YAAY,EAAE,cAAc,CAAC,uBAAuB,EAAE,CAAC,CAAC;gBAE/G,WAAW,CAAC,MAAM,CAAC,cAAc,CAAC,wBAAwB,EAAE,CAAC,CAAC;YAChE,CAAC;YAED,MAAM,cAAc,GAAW,MAAM,CAAC,MAAM,MAAM,CAAC,iBAAiB,EAAE,CAAC,CAAC,sBAAsB,CAAC,gBAAgB,CAAC,CAAC;YACjH,OAAO,EAAC,IAAI,EAAE,EAAC,cAAc,EAAE,MAAM,CAAC,cAAc,CAAC,EAAC,EAAE,OAAO,EAAE,IAAI,EAAC,CAAC;QACzE,CAAC;QAED,OAAO,EAAC,IAAI,EAAE,QAA8C,EAAE,OAAO,EAAE,IAAI,EAAC,CAAC;IAC/E,CAAC;IAAC,OAAO,KAAK,EAAE,CAAC;QACf,sCAAsC;QACtC,OAAO,CAAC,KAAK,CAAC,sCAAsC,EAAE,KAAK,CAAC,CAAC;QAC7D,OAAO,EAAC,KAAK,EAAE,MAAM,CAAC,KAAK,CAAC,EAAE,OAAO,EAAE,KAAK,EAAC,CAAC;IAChD,CAAC;AACH,CAAC,CAAC;AAEF,eAAe,YAAY,CAAC"}
+{"version":3,"file":"signInAction.js","sourceRoot":"","sources":["../../../../src/server/actions/signInAction.ts"],"names":[],"mappings":"AAAA;;;;;;;;;;;;;;;;GAgBG;AAEH,YAAY,CAAC;AAEb,OAAO,EACL,iBAAiB,EACjB,wBAAwB,EAKxB,OAAO,GACR,MAAM,gBAAgB,CAAC;AACxB,OAAO,EAAC,OAAO,EAAC,MAAM,cAAc,CAAC;AACrC,OAAO,kBAAkB,MAAM,0BAA0B,CAAC;AAE1D,OAAO,MAAM,MAAM,oBAAoB,CAAC;AACxC,OAAO,cAAqC,MAAM,4BAA4B,CAAC;AAI/E;;;;;;;GAOG;AACH,MAAM,YAAY,GAAG,KAAK,EACxB,OAAgD,EAChD,OAA0C,EAUzC,EAAE;IACH,IAAI,CAAC;QACH,MAAM,MAAM,GAAuB,kBAAkB,CAAC,WAAW,EAAE,CAAC;QACpE,MAAM,WAAW,GAAmB,MAAM,OAAO,EAAE,CAAC;QAEpD,IAAI,SAA6B,CAAC;QAElC,MAAM,oBAAoB,GAAuB,WAAW,CAAC,GAAG,CAAC,cAAc,CAAC,oBAAoB,EAAE,CAAC,EAAE,KAAK,CAAC;QAE/G,IAAI,oBAAoB,EAAE,CAAC;YACzB,IAAI,CAAC;gBACH,MAAM,cAAc,GAAwB,MAAM,cAAc,CAAC,kBAAkB,CAAC,oBAAoB,CAAC,CAAC;gBAC1G,SAAS,GAAG,cAAc,CAAC,SAAS,CAAC;YACvC,CAAC;YAAC,MAAM,CAAC;gBACP,sDAAsD;YACxD,CAAC;QACH,CAAC;QAED,IAAI,CAAC,SAAS,EAAE,CAAC;YACf,MAAM,gBAAgB,GAAuB,WAAW,CAAC,GAAG,CAAC,cAAc,CAAC,wBAAwB,EAAE,CAAC,EAAE,KAAK,CAAC;YAE/G,IAAI,gBAAgB,EAAE,CAAC;gBACrB,IAAI,CAAC;oBACH,MAAM,WAAW,GAAwB,MAAM,cAAc,CAAC,iBAAiB,CAAC,gBAAgB,CAAC,CAAC;oBAClG,SAAS,GAAG,WAAW,CAAC,SAAS,CAAC;gBACpC,CAAC;gBAAC,MAAM,CAAC;oBACP,4CAA4C;gBAC9C,CAAC;YACH,CAAC;QACH,CAAC;QAED,IAAI,CAAC,SAAS,EAAE,CAAC;YACf,SAAS,GAAG,iBAAiB,EAAE,CAAC;YAEhC,MAAM,gBAAgB,GAAW,MAAM,cAAc,CAAC,iBAAiB,CAAC,SAAS,CAAC,CAAC;YAEnF,WAAW,CAAC,GAAG,CACb,cAAc,CAAC,wBAAwB,EAAE,EACzC,gBAAgB,EAChB,cAAc,CAAC,2BAA2B,EAAE,CAC7C,CAAC;QACJ,CAAC;QAED,8EAA8E;QAC9E,IAAI,CAAC,OAAO,IAAI,OAAO,CAAC,OAAO,CAAC,EAAE,CAAC;YACjC,MAAM,gBAAgB,GAAW,MAAM,MAAM,CAAC,sBAAsB,CAAC,EAAE,EAAE,SAAS,CAAC,CAAC;YACpF,OAAO,EAAC,IAAI,EAAE,EAAC,SAAS,EAAE,MAAM,CAAC,gBAAgB,CAAC,EAAC,EAAE,OAAO,EAAE,IAAI,EAAC,CAAC;QACtE,CAAC;QAED,+BAA+B;QAC/B,MAAM,QAAQ,GAAQ,MAAM,MAAM,CAAC,MAAM,CAAC,OAAO,EAAE,OAAQ,EAAE,SAAS,CAAC,CAAC;QAExE,IAAI,QAAQ,CAAC,UAAU,KAAK,wBAAwB,CAAC,gBAAgB,EAAE,CAAC;YACtE,MAAM,YAAY,GAA4B,MAAM,MAAM,CAAC,MAAM,CAC/D;gBACE,IAAI,EAAE,QAAQ,EAAE,QAAQ,EAAE,IAAI;gBAC9B,aAAa,EAAE,QAAQ,EAAE,QAAQ,EAAE,aAAa;gBAChD,KAAK,EAAE,QAAQ,EAAE,QAAQ,EAAE,KAAK;aAC1B,EACR,EAAE,EACF,SAAS,CACV,CAAC;YAEF,IAAI,YAAY,EAAE,CAAC;gBACjB,MAAM,OAAO,GAAY,MAAM,MAAM,CAAC,iBAAiB,CACrD,SAAS,EACT,CAAC,YAAY,CAAC,SAAS,CAAC,IAAI,YAAY,CAAC,UAAU,CAAC,CAAW,CAChE,CAAC;gBACF,MAAM,eAAe,GAAW,CAAC,OAAO,CAAC,KAAK,CAAC,IAAI,YAAY,CAAC,KAAK,CAAC,IAAI,SAAS,CAAW,CAAC;gBAC/F,MAAM,EAAC,WAAW,EAAC,GAA0B,YAAqC,CAAC;gBACnF,MAAM,YAAY,GAAY,YAAY,CAAC,cAAc,CAAwB,IAAI,EAAE,CAAC;gBACxF,MAAM,MAAM,GAAW,YAAY,CAAC,OAAO,CAAW,CAAC;gBACvD,MAAM,cAAc,GAAuB,CAAC,OAAO,CAAC,UAAU,CAAC,IAAI,OAAO,CAAC,iBAAiB,CAAC,CAEhF,CAAC;gBACd,MAAM,YAAY,GAAY,YAAY,CAAC,WAAW,CAAC,IAAI,YAAY,CAAC,YAAY,CAAC,CAAC;gBACtF,MAAM,SAAS,GAAW,MAAM,CAAC,YAAY,CAAC,CAAC;gBAC/C,IAAI,MAAM,CAAC,KAAK,CAAC,SAAS,CAAC,EAAE,CAAC;oBAC5B,MAAM,IAAI,KAAK,CAAC,oDAAoD,YAAY,EAAE,CAAC,CAAC;gBACtF,CAAC;gBACD,MAAM,MAAM,GAAuB,MAAM,MAAM,CAAC,gBAAgB,EAAE,CAAC;gBACnE,MAAM,uBAAuB,GAAW,cAAc,CAAC,0BAA0B,CAC/E,MAAM,CAAC,uBAAuB,CAC/B,CAAC;gBAEF,MAAM,YAAY,GAAW,MAAM,cAAc,CAAC,kBAAkB,CAClE,WAAW,EACX,eAAe,EACf,SAAS,EACT,MAAM,EACN,SAAS,EACT,YAAY,EACZ,cAAc,CACf,CAAC;gBAEF,WAAW,CAAC,GAAG,CACb,cAAc,CAAC,oBAAoB,EAAE,EACrC,YAAY,EACZ,cAAc,CAAC,uBAAuB,CAAC,uBAAuB,CAAC,CAChE,CAAC;gBAEF,WAAW,CAAC,MAAM,CAAC,cAAc,CAAC,wBAAwB,EAAE,CAAC,CAAC;YAChE,CAAC;YAED,MAAM,cAAc,GAAW,MAAM,CAAC,MAAM,MAAM,CAAC,iBAAiB,EAAE,CAAC,CAAC,sBAAsB,CAAC,gBAAgB,CAAC,CAAC;YACjH,OAAO,EAAC,IAAI,EAAE,EAAC,cAAc,EAAE,MAAM,CAAC,cAAc,CAAC,EAAC,EAAE,OAAO,EAAE,IAAI,EAAC,CAAC;QACzE,CAAC;QAED,OAAO,EAAC,IAAI,EAAE,QAA8C,EAAE,OAAO,EAAE,IAAI,EAAC,CAAC;IAC/E,CAAC;IAAC,OAAO,KAAK,EAAE,CAAC;QACf,MAAM,CAAC,KAAK,CAAC,wCAAwC,KAAK,YAAY,KAAK,CAAC,CAAC,CAAC,KAAK,CAAC,OAAO,CAAC,CAAC,CAAC,MAAM,CAAC,KAAK,CAAC,EAAE,CAAC,CAAC;QAC/G,OAAO,EAAC,KAAK,EAAE,MAAM,CAAC,KAAK,CAAC,EAAE,OAAO,EAAE,KAAK,EAAC,CAAC;IAChD,CAAC;AACH,CAAC,CAAC;AAEF,eAAe,YAAY,CAAC"}

package/dist/esm/server/actions/signOutAction.js.map

@@ -1 +1 @@
-{"version":3,"file":"signOutAction.js","sourceRoot":"","sources":["../../../../src/server/actions/signOutAction.ts"],"names":[],"mappings":"AAAA;;;;;;;;;;;;;;;;GAgBG;AAEH,YAAY,CAAC;AAGb,OAAO,EAAC,OAAO,EAAC,MAAM,cAAc,CAAC;AACrC,OAAO,YAAY,MAAM,gBAAgB,CAAC;AAC1C,OAAO,kBAAkB,MAAM,0BAA0B,CAAC;AAC1D,OAAO,MAAM,MAAM,oBAAoB,CAAC;AACxC,OAAO,cAAc,MAAM,4BAA4B,CAAC;AAExD;;;;;GAKG;AACH,MAAM,aAAa,GAAG,KAAK,IAAqF,EAAE;IAChH,MAAM,CAAC,KAAK,CAAC,qEAAqE,CAAC,CAAC;IAEpF,MAAM,mBAAmB,GAAG,KAAK,IAAmB,EAAE;QACpD,MAAM,WAAW,GAA2B,MAAM,OAAO,EAAE,CAAC;QAE5D,WAAW,CAAC,MAAM,CAAC,cAAc,CAAC,oBAAoB,EAAE,CAAC,CAAC;QAC1D,WAAW,CAAC,MAAM,CAAC,cAAc,CAAC,wBAAwB,EAAE,CAAC,CAAC;IAChE,CAAC,CAAC;IAEF,IAAI,CAAC;QACH,MAAM,MAAM,GAAuB,kBAAkB,CAAC,WAAW,EAAE,CAAC;QACpE,MAAM,SAAS,GAAuB,MAAM,YAAY,EAAE,CAAC;QAE3D,IAAI,eAAe,GAAW,GAAG,CAAC;QAElC,IAAI,SAAS,EAAE,CAAC;YACd,MAAM,CAAC,KAAK,CAAC,2FAA2F,CAAC,CAAC;YAE1G,eAAe,GAAG,MAAM,MAAM,CAAC,OAAO,CAAC,EAAE,EAAE,SAAS,CAAC,CAAC;QACxD,CAAC;QAED,MAAM,mBAAmB,EAAE,CAAC;QAE5B,OAAO,EAAC,IAAI,EAAE,EAAC,eAAe,EAAC,EAAE,OAAO,EAAE,IAAI,EAAC,CAAC;IAClD,CAAC;IAAC,OAAO,KAAK,EAAE,CAAC;QACf,MAAM,CAAC,KAAK,CAAC,+DAA+D,EAAE,KAAK,CAAC,CAAC;QAErF,MAAM,CAAC,KAAK,CAAC,sEAAsE,CAAC,CAAC;QAErF,MAAM,mBAAmB,EAAE,CAAC;QAE5B,IAAI,YAAqB,CAAC;QAC1B,IAAI,OAAO,KAAK,KAAK,QAAQ,EAAE,CAAC;YAC9B,YAAY,GAAG,KAAK,CAAC;QACvB,CAAC;aAAM,IAAI,KAAK,YAAY,KAAK,EAAE,CAAC;YAClC,YAAY,GAAG,KAAK,CAAC,OAAO,CAAC;QAC/B,CAAC;aAAM,CAAC;YACN,YAAY,GAAG,IAAI,CAAC,SAAS,CAAC,KAAK,CAAC,CAAC;QACvC,CAAC;QAED,OAAO;YACL,KAAK,EAAE,YAAY;YACnB,OAAO,EAAE,KAAK;SACf,CAAC;IACJ,CAAC;AACH,CAAC,CAAC;AAEF,eAAe,aAAa,CAAC"}
+{"version":3,"file":"signOutAction.js","sourceRoot":"","sources":["../../../../src/server/actions/signOutAction.ts"],"names":[],"mappings":"AAAA;;;;;;;;;;;;;;;;GAgBG;AAEH,YAAY,CAAC;AAEb,OAAO,EAAC,OAAO,EAAC,MAAM,cAAc,CAAC;AACrC,OAAO,YAAY,MAAM,gBAAgB,CAAC;AAC1C,OAAO,kBAAkB,MAAM,0BAA0B,CAAC;AAC1D,OAAO,MAAM,MAAM,oBAAoB,CAAC;AACxC,OAAO,cAAc,MAAM,4BAA4B,CAAC;AAIxD;;;;;GAKG;AACH,MAAM,aAAa,GAAG,KAAK,IAAqF,EAAE;IAChH,MAAM,CAAC,KAAK,CAAC,qEAAqE,CAAC,CAAC;IAEpF,MAAM,mBAAmB,GAAG,KAAK,IAAmB,EAAE;QACpD,MAAM,WAAW,GAAmB,MAAM,OAAO,EAAE,CAAC;QAEpD,WAAW,CAAC,MAAM,CAAC,cAAc,CAAC,oBAAoB,EAAE,CAAC,CAAC;QAC1D,WAAW,CAAC,MAAM,CAAC,cAAc,CAAC,wBAAwB,EAAE,CAAC,CAAC;IAChE,CAAC,CAAC;IAEF,IAAI,CAAC;QACH,MAAM,MAAM,GAAuB,kBAAkB,CAAC,WAAW,EAAE,CAAC;QACpE,MAAM,SAAS,GAAuB,MAAM,YAAY,EAAE,CAAC;QAE3D,IAAI,eAAe,GAAW,GAAG,CAAC;QAElC,IAAI,SAAS,EAAE,CAAC;YACd,MAAM,CAAC,KAAK,CAAC,2FAA2F,CAAC,CAAC;YAE1G,eAAe,GAAG,MAAM,MAAM,CAAC,OAAO,CAAC,EAAE,EAAE,SAAS,CAAC,CAAC;QACxD,CAAC;QAED,MAAM,mBAAmB,EAAE,CAAC;QAE5B,OAAO,EAAC,IAAI,EAAE,EAAC,eAAe,EAAC,EAAE,OAAO,EAAE,IAAI,EAAC,CAAC;IAClD,CAAC;IAAC,OAAO,KAAK,EAAE,CAAC;QACf,MAAM,CAAC,KAAK,CAAC,+DAA+D,EAAE,KAAK,CAAC,CAAC;QAErF,MAAM,CAAC,KAAK,CAAC,sEAAsE,CAAC,CAAC;QAErF,MAAM,mBAAmB,EAAE,CAAC;QAE5B,IAAI,YAAqB,CAAC;QAC1B,IAAI,OAAO,KAAK,KAAK,QAAQ,EAAE,CAAC;YAC9B,YAAY,GAAG,KAAK,CAAC;QACvB,CAAC;aAAM,IAAI,KAAK,YAAY,KAAK,EAAE,CAAC;YAClC,YAAY,GAAG,KAAK,CAAC,OAAO,CAAC;QAC/B,CAAC;aAAM,CAAC;YACN,YAAY,GAAG,IAAI,CAAC,SAAS,CAAC,KAAK,CAAC,CAAC;QACvC,CAAC;QAED,OAAO;YACL,KAAK,EAAE,YAAY;YACnB,OAAO,EAAE,KAAK;SACf,CAAC;IACJ,CAAC;AACH,CAAC,CAAC;AAEF,eAAe,aAAa,CAAC"}

package/dist/esm/server/actions/switchOrganization.js

@@ -31,20 +31,19 @@ const switchOrganization = async (organization, sessionId) => {
         const client = AsgardeoNextClient.getInstance();
         const resolvedSessionId = sessionId ?? (await getSessionId());
         const response = await client.switchOrganization(organization, resolvedSessionId);
-        // After switching organization, we need to refresh the page to get updated session data
-        // This is because server components don't maintain state between function calls
         const { revalidatePath } = await import('next/cache');
-        // Revalidate the current path to refresh the component with new data
         revalidatePath('/');
-        if (response) {
-            const idToken = await client.getDecodedIdToken(resolvedSessionId, response.idToken);
+        if (response && response.accessToken) {
+            const tokenResponse = response;
+            const idToken = await client.getDecodedIdToken(resolvedSessionId, tokenResponse.idToken);
             const userIdFromToken = idToken['sub'];
-            const { accessToken } = response;
-            const scopes = response.scope;
             const organizationId = (idToken['user_org'] || idToken['organization_id']);
-            const sessionToken = await SessionManager.createSessionToken(accessToken, userIdFromToken, resolvedSessionId, scopes, organizationId);
+            const config = await client.getConfiguration();
+            const sessionCookieExpiryTime = SessionManager.resolveSessionCookieExpiry(config.sessionCookieExpiryTime);
+            const expiresIn = parseInt(tokenResponse.expiresIn, 10);
+            const sessionToken = await SessionManager.createSessionToken(tokenResponse.accessToken, userIdFromToken, resolvedSessionId, tokenResponse.scope, expiresIn, tokenResponse.refreshToken ?? '', organizationId);
             logger.debug('[switchOrganization] Session token created successfully.');
-            cookieStore.set(SessionManager.getSessionCookieName(), sessionToken, SessionManager.getSessionCookieOptions());
+            cookieStore.set(SessionManager.getSessionCookieName(), sessionToken, SessionManager.getSessionCookieOptions(sessionCookieExpiryTime));
         }
         return response;
     }

package/dist/esm/server/actions/switchOrganization.js.map

@@ -1 +1 @@
-{"version":3,"file":"switchOrganization.js","sourceRoot":"","sources":["../../../../src/server/actions/switchOrganization.ts"],"names":[],"mappings":"AAAA;;;;;;;;;;;;;;;;GAgBG;AAEH,YAAY,CAAC;AAEb,OAAO,EAAe,gBAAgB,EAAyB,MAAM,gBAAgB,CAAC;AAEtF,OAAO,EAAC,OAAO,EAAC,MAAM,cAAc,CAAC;AACrC,OAAO,YAAY,MAAM,gBAAgB,CAAC;AAC1C,OAAO,kBAAkB,MAAM,0BAA0B,CAAC;AAC1D,OAAO,MAAM,MAAM,oBAAoB,CAAC;AACxC,OAAO,cAAc,MAAM,4BAA4B,CAAC;AAExD;;GAEG;AACH,MAAM,kBAAkB,GAAG,KAAK,EAC9B,YAA0B,EAC1B,SAA6B,EACM,EAAE;IACrC,IAAI,CAAC;QACH,MAAM,WAAW,GAA2B,MAAM,OAAO,EAAE,CAAC;QAC5D,MAAM,MAAM,GAAuB,kBAAkB,CAAC,WAAW,EAAE,CAAC;QACpE,MAAM,iBAAiB,GAAW,SAAS,IAAK,CAAC,MAAM,YAAY,EAAE,CAAY,CAAC;QAClF,MAAM,QAAQ,GAA6B,MAAM,MAAM,CAAC,kBAAkB,CAAC,YAAY,EAAE,iBAAiB,CAAC,CAAC;QAE5G,wFAAwF;QACxF,gFAAgF;QAChF,MAAM,EAAC,cAAc,EAAC,GAAG,MAAM,MAAM,CAAC,YAAY,CAAC,CAAC;QAEpD,qEAAqE;QACrE,cAAc,CAAC,GAAG,CAAC,CAAC;QAEpB,IAAI,QAAQ,EAAE,CAAC;YACb,MAAM,OAAO,GAAY,MAAM,MAAM,CAAC,iBAAiB,CAAC,iBAAiB,EAAG,QAA0B,CAAC,OAAO,CAAC,CAAC;YAChH,MAAM,eAAe,GAAW,OAAO,CAAC,KAAK,CAAW,CAAC;YACzD,MAAM,EAAC,WAAW,EAAC,GAA0B,QAAyB,CAAC;YACvE,MAAM,MAAM,GAAY,QAA0B,CAAC,KAAK,CAAC;YACzD,MAAM,cAAc,GAAuB,CAAC,OAAO,CAAC,UAAU,CAAC,IAAI,OAAO,CAAC,iBAAiB,CAAC,CAEhF,CAAC;YAEd,MAAM,YAAY,GAAW,MAAM,cAAc,CAAC,kBAAkB,CAClE,WAAW,EACX,eAAyB,EACzB,iBAA2B,EAC3B,MAAM,EACN,cAAc,CACf,CAAC;YAEF,MAAM,CAAC,KAAK,CAAC,0DAA0D,CAAC,CAAC;YAEzE,WAAW,CAAC,GAAG,CAAC,cAAc,CAAC,oBAAoB,EAAE,EAAE,YAAY,EAAE,cAAc,CAAC,uBAAuB,EAAE,CAAC,CAAC;QACjH,CAAC;QAED,OAAO,QAAQ,CAAC;IAClB,CAAC;IAAC,OAAO,KAAK,EAAE,CAAC;QACf,MAAM,IAAI,gBAAgB,CACxB,uCAAuC,KAAK,YAAY,KAAK,CAAC,CAAC,CAAC,KAAK,CAAC,OAAO,CAAC,CAAC,CAAC,MAAM,CAAC,IAAI,CAAC,SAAS,CAAC,KAAK,CAAC,CAAC,EAAE,EAC/G,0CAA0C,EAC1C,QAAQ,EACR,KAAK,YAAY,gBAAgB,CAAC,CAAC,CAAC,KAAK,CAAC,UAAU,CAAC,CAAC,CAAC,SAAS,CACjE,CAAC;IACJ,CAAC;AACH,CAAC,CAAC;AAEF,eAAe,kBAAkB,CAAC"}
+{"version":3,"file":"switchOrganization.js","sourceRoot":"","sources":["../../../../src/server/actions/switchOrganization.ts"],"names":[],"mappings":"AAAA;;;;;;;;;;;;;;;;GAgBG;AAEH,YAAY,CAAC;AAEb,OAAO,EAAe,gBAAgB,EAAyB,MAAM,gBAAgB,CAAC;AACtF,OAAO,EAAC,OAAO,EAAC,MAAM,cAAc,CAAC;AACrC,OAAO,YAAY,MAAM,gBAAgB,CAAC;AAC1C,OAAO,kBAAkB,MAAM,0BAA0B,CAAC;AAE1D,OAAO,MAAM,MAAM,oBAAoB,CAAC;AACxC,OAAO,cAAc,MAAM,4BAA4B,CAAC;AAIxD;;GAEG;AACH,MAAM,kBAAkB,GAAG,KAAK,EAC9B,YAA0B,EAC1B,SAA6B,EACM,EAAE;IACrC,IAAI,CAAC;QACH,MAAM,WAAW,GAAmB,MAAM,OAAO,EAAE,CAAC;QACpD,MAAM,MAAM,GAAuB,kBAAkB,CAAC,WAAW,EAAE,CAAC;QACpE,MAAM,iBAAiB,GAAW,SAAS,IAAK,CAAC,MAAM,YAAY,EAAE,CAAY,CAAC;QAClF,MAAM,QAAQ,GAA6B,MAAM,MAAM,CAAC,kBAAkB,CAAC,YAAY,EAAE,iBAAiB,CAAC,CAAC;QAE5G,MAAM,EAAC,cAAc,EAAC,GAAG,MAAM,MAAM,CAAC,YAAY,CAAC,CAAC;QACpD,cAAc,CAAC,GAAG,CAAC,CAAC;QAEpB,IAAI,QAAQ,IAAK,QAA0B,CAAC,WAAW,EAAE,CAAC;YACxD,MAAM,aAAa,GAAkB,QAAyB,CAAC;YAC/D,MAAM,OAAO,GAAY,MAAM,MAAM,CAAC,iBAAiB,CAAC,iBAAiB,EAAE,aAAa,CAAC,OAAO,CAAC,CAAC;YAClG,MAAM,eAAe,GAAW,OAAO,CAAC,KAAK,CAAW,CAAC;YACzD,MAAM,cAAc,GAAuB,CAAC,OAAO,CAAC,UAAU,CAAC,IAAI,OAAO,CAAC,iBAAiB,CAAC,CAEhF,CAAC;YACd,MAAM,MAAM,GAAuB,MAAM,MAAM,CAAC,gBAAgB,EAAE,CAAC;YACnE,MAAM,uBAAuB,GAAW,cAAc,CAAC,0BAA0B,CAAC,MAAM,CAAC,uBAAuB,CAAC,CAAC;YAClH,MAAM,SAAS,GAAW,QAAQ,CAAC,aAAa,CAAC,SAAS,EAAE,EAAE,CAAC,CAAC;YAEhE,MAAM,YAAY,GAAW,MAAM,cAAc,CAAC,kBAAkB,CAClE,aAAa,CAAC,WAAW,EACzB,eAAe,EACf,iBAAiB,EACjB,aAAa,CAAC,KAAK,EACnB,SAAS,EACT,aAAa,CAAC,YAAY,IAAI,EAAE,EAChC,cAAc,CACf,CAAC;YAEF,MAAM,CAAC,KAAK,CAAC,0DAA0D,CAAC,CAAC;YAEzE,WAAW,CAAC,GAAG,CACb,cAAc,CAAC,oBAAoB,EAAE,EACrC,YAAY,EACZ,cAAc,CAAC,uBAAuB,CAAC,uBAAuB,CAAC,CAChE,CAAC;QACJ,CAAC;QAED,OAAO,QAAQ,CAAC;IAClB,CAAC;IAAC,OAAO,KAAK,EAAE,CAAC;QACf,MAAM,IAAI,gBAAgB,CACxB,uCAAuC,KAAK,YAAY,KAAK,CAAC,CAAC,CAAC,KAAK,CAAC,OAAO,CAAC,CAAC,CAAC,MAAM,CAAC,IAAI,CAAC,SAAS,CAAC,KAAK,CAAC,CAAC,EAAE,EAC/G,0CAA0C,EAC1C,QAAQ,EACR,KAAK,YAAY,gBAAgB,CAAC,CAAC,CAAC,KAAK,CAAC,UAAU,CAAC,CAAC,CAAC,SAAS,CACjE,CAAC;IACJ,CAAC;AACH,CAAC,CAAC;AAEF,eAAe,kBAAkB,CAAC"}

package/dist/esm/server/index.js

@@ -19,7 +19,4 @@
 export { default as asgardeo } from './asgardeo';
 export { default as AsgardeoProvider } from './AsgardeoProvider.js';
 export * from './AsgardeoProvider.js';
-export { default as asgardeoMiddleware } from './middleware/asgardeoMiddleware';
-export * from './middleware/asgardeoMiddleware';
-export { default as createRouteMatcher } from './middleware/createRouteMatcher';
 //# sourceMappingURL=index.js.map

package/dist/esm/server/index.js.map

@@ -1 +1 @@
-{"version":3,"file":"index.js","sourceRoot":"","sources":["../../../src/server/index.ts"],"names":[],"mappings":"AAAA;;;;;;;;;;;;;;;;GAgBG;AAEH,mCAAmC;AAEnC,OAAO,EAAC,OAAO,IAAI,QAAQ,EAAC,MAAM,YAAY,CAAC;AAE/C,OAAO,EAAC,OAAO,IAAI,gBAAgB,EAAC,MAAM,uBAAuB,CAAC;AAClE,cAAc,uBAAuB,CAAC;AAEtC,OAAO,EAAC,OAAO,IAAI,kBAAkB,EAAC,MAAM,iCAAiC,CAAC;AAC9E,cAAc,iCAAiC,CAAC;AAEhD,OAAO,EAAC,OAAO,IAAI,kBAAkB,EAAC,MAAM,iCAAiC,CAAC"}
+{"version":3,"file":"index.js","sourceRoot":"","sources":["../../../src/server/index.ts"],"names":[],"mappings":"AAAA;;;;;;;;;;;;;;;;GAgBG;AAEH,mCAAmC;AAEnC,OAAO,EAAC,OAAO,IAAI,QAAQ,EAAC,MAAM,YAAY,CAAC;AAE/C,OAAO,EAAC,OAAO,IAAI,gBAAgB,EAAC,MAAM,uBAAuB,CAAC;AAClE,cAAc,uBAAuB,CAAC"}

package/dist/esm/server/middleware/asgardeoMiddleware.js

@@ -16,44 +16,79 @@
  * under the License.
  */
 import { NextResponse } from 'next/server';
+import { REFRESH_BUFFER_SECONDS } from '../../constants/sessionConstants';
+import decorateConfigWithNextEnv from '../../utils/decorateConfigWithNextEnv';
+import handleRefreshToken from '../../utils/handleRefreshToken';
 import SessionManager from '../../utils/SessionManager';
-import { hasValidSession as hasValidJWTSession, getSessionFromRequest, getSessionIdFromRequest, } from '../../utils/sessionUtils';
+import { getSessionFromRequest, getSessionIdFromRequest } from '../../utils/sessionUtils';
 /**
- * Enhanced session validation that checks both JWT and legacy sessions
- *
- * @param request - The Next.js request object
- * @returns True if a valid session exists, false otherwise
+ * Removes a named cookie from a raw Cookie header string.
  */
-const hasValidSession = async (request) => {
-    try {
-        return await hasValidJWTSession(request);
-    }
-    catch {
-        return Promise.resolve(false);
-    }
-};
+const removeCookieFromHeader = (cookieHeader, name) => cookieHeader
+    .split(';')
+    .map((p) => p.trim())
+    .filter((p) => {
+    const eqIdx = p.indexOf('=');
+    const partName = eqIdx === -1 ? p : p.slice(0, eqIdx).trim();
+    return partName !== name;
+})
+    .join('; ');
 /**
- * Gets the session ID from the request cookies.
- * Supports both JWT and legacy session formats.
- *
- * @param request - The Next.js request object
- * @returns The session ID if it exists, undefined otherwise
+ * Replaces the value of a named cookie inside a raw Cookie header string.
+ * If the cookie does not already appear in the header it is appended.
  */
-const getSessionIdFromRequestMiddleware = async (request) => getSessionIdFromRequest(request);
+const replaceCookieInHeader = (cookieHeader, name, value) => {
+    const parts = cookieHeader
+        .split(';')
+        .map((p) => p.trim())
+        .filter(Boolean);
+    let found = false;
+    const updated = parts.map((part) => {
+        const eqIdx = part.indexOf('=');
+        const partName = eqIdx === -1 ? part : part.slice(0, eqIdx).trim();
+        if (partName === name) {
+            found = true;
+            return `${name}=${value}`;
+        }
+        return part;
+    });
+    if (!found) {
+        updated.push(`${name}=${value}`);
+    }
+    return updated.join('; ');
+};
 /**
  * Asgardeo middleware that integrates authentication into your Next.js application.
  * Similar to Clerk's clerkMiddleware pattern.
  *
+ * Proactively refreshes the access token when it is within REFRESH_BUFFER_SECONDS of
+ * expiry so that Server Components always receive a fresh session. The refresh also
+ * recovers expired tokens as long as a refresh token is present.
+ *
+ * The updated session cookie is written to:
+ *   - The response  → browser stores the new cookie for subsequent requests.
+ *   - The forwarded request headers → the same-request Server Component render sees
+ *     the fresh token immediately without waiting for the next navigation.
+ *
+ * Token refresh requires baseUrl, clientId, and clientSecret. These are resolved from
+ * the options argument first, then from the standard Asgardeo environment variables
+ * (NEXT_PUBLIC_ASGARDEO_BASE_URL, NEXT_PUBLIC_ASGARDEO_CLIENT_ID,
+ * ASGARDEO_CLIENT_SECRET). If none are available the refresh step is skipped silently.
+ *
  * @param handler - Optional handler function to customize middleware behavior
  * @param options - Configuration options for the middleware
  * @returns Next.js middleware function
  *
  * @example
  * ```typescript
- * // middleware.ts - Basic usage
+ * // middleware.ts - Basic usage (config read from env vars automatically)
  * import { asgardeoMiddleware } from '@asgardeo/nextjs';
  *
  * export default asgardeoMiddleware();
+ *
+ * export const config = {
+ *   matcher: ['/((?!_next/static|_next/image|favicon.ico).*)'],
+ * };
  * ```
  *
  * @example
@@ -69,82 +104,111 @@ const getSessionIdFromRequestMiddleware = async (request) => getSessionIdFromReq
  *   }
  * });
  * ```
- *
- * @example
- * ```typescript
- * // Advanced usage with custom logic
- * import { asgardeoMiddleware, createRouteMatcher } from '@asgardeo/nextjs';
- *
- * const isProtectedRoute = createRouteMatcher(['/dashboard(.*)']);
- * const isAuthRoute = createRouteMatcher(['/sign-in', '/sign-up']);
- *
- * export default asgardeoMiddleware(async (asgardeo, req) => {
- *   // Skip protection for auth routes
- *   if (isAuthRoute(req)) return;
- *
- *   // Protect specified routes
- *   if (isProtectedRoute(req)) {
- *     await asgardeo.protectRoute({ redirect: '/sign-in' });
- *   }
- *
- *   // Check authentication status
- *   if (asgardeo.isSignedIn()) {
- *     console.log('User is authenticated with session:', asgardeo.getSessionId());
- *   }
- * }, {
- *   defaultRedirect: '/sign-in'
- * });
- * ```
  */
 const asgardeoMiddleware = (handler, options) => async (request) => {
     const resolvedOptions = typeof options === 'function' ? options(request) : options || {};
+    // Resolve full config from passed options + environment variable fallbacks.
+    const resolvedConfig = decorateConfigWithNextEnv(resolvedOptions);
+    // ── OAuth callback detection ──────────────────────────────────────────────
     const url = new URL(request.url);
     const hasCallbackParams = url.searchParams.has('code') && url.searchParams.has('state');
     let isValidOAuthCallback = false;
-    if (hasCallbackParams) {
-        // OAuth callbacks should not contain error parameters that indicate failed auth
-        const hasError = url.searchParams.has('error');
-        if (!hasError) {
-            // Validate that there's a temporary session that initiated this OAuth flow
-            const tempSessionToken = request.cookies.get(SessionManager.getTempSessionCookieName())?.value;
-            if (tempSessionToken) {
-                try {
-                    // Verify the temporary session exists and is valid
-                    await SessionManager.verifyTempSession(tempSessionToken);
-                    isValidOAuthCallback = true;
-                }
-                catch {
-                    // Invalid temp session - this is not a legitimate OAuth callback
-                    isValidOAuthCallback = false;
-                }
+    if (hasCallbackParams && !url.searchParams.has('error')) {
+        const tempSessionToken = request.cookies.get(SessionManager.getTempSessionCookieName())?.value;
+        if (tempSessionToken) {
+            try {
+                await SessionManager.verifyTempSession(tempSessionToken);
+                isValidOAuthCallback = true;
+            }
+            catch {
+                isValidOAuthCallback = false;
             }
         }
     }
-    const sessionId = await getSessionIdFromRequestMiddleware(request);
-    const isAuthenticated = await hasValidSession(request);
-    const asgardeo = {
-        getSession: async () => {
+    // ── Session resolution ────────────────────────────────────────────────────
+    // Step 1: Attempt to get a fully verified (signature + expiry) session.
+    const verifiedSession = await getSessionFromRequest(request);
+    // Step 2: If no verified session exists, verify the raw cookie's signature
+    // without enforcing expiry. This allows the middleware to recover from an
+    // expired access token as long as the JWT is authentic and a refresh token
+    // is present. Skipping the signature check here would let a tampered cookie
+    // drive identity-confusion attacks since handleRefreshToken reuses `sub`,
+    // `sessionId`, and `organizationId` from the input payload when minting the
+    // new session JWT.
+    let expiredSession;
+    if (!verifiedSession) {
+        const rawToken = request.cookies.get(SessionManager.getSessionCookieName())?.value;
+        if (rawToken) {
             try {
-                return await getSessionFromRequest(request);
+                const decoded = await SessionManager.verifySessionTokenForRefresh(rawToken);
+                if (decoded.refreshToken) {
+                    expiredSession = decoded;
+                }
             }
             catch {
-                return undefined;
+                // Forged, tampered, wrong type, or malformed — ignore.
             }
-        },
+        }
+    }
+    // ── Token refresh ─────────────────────────────────────────────────────────
+    const now = Math.floor(Date.now() / 1000);
+    const candidateSession = verifiedSession ?? expiredSession;
+    // Config is required to call the token endpoint.
+    const hasRefreshConfig = !!(resolvedConfig.baseUrl &&
+        resolvedConfig.clientId &&
+        resolvedConfig.clientSecret);
+    // Refresh when:
+    //   a) Token is verified but within the proactive buffer window, OR
+    //   b) Token has already expired but a refresh token is available.
+    const needsRefresh = !isValidOAuthCallback &&
+        hasRefreshConfig &&
+        !!candidateSession?.refreshToken &&
+        ((!!verifiedSession && verifiedSession.exp <= now + REFRESH_BUFFER_SECONDS) || !!expiredSession);
+    let activeSession = verifiedSession;
+    let refreshCookieUpdate;
+    if (needsRefresh && candidateSession) {
+        try {
+            const { newSessionToken, sessionCookieExpiryTime } = await handleRefreshToken(candidateSession, {
+                baseUrl: resolvedConfig.baseUrl,
+                clientId: resolvedConfig.clientId,
+                clientSecret: resolvedConfig.clientSecret,
+                sessionCookieExpiryTime: resolvedConfig.sessionCookieExpiryTime,
+            });
+            // Verify the newly minted token so activeSession reflects fresh claims.
+            activeSession = await SessionManager.verifySessionToken(newSessionToken);
+            refreshCookieUpdate = { expiry: sessionCookieExpiryTime, token: newSessionToken };
+        }
+        catch {
+            // Refresh failed — clear the irrecoverable session.
+            activeSession = undefined;
+        }
+    }
+    // ── Session cleanup detection ─────────────────────────────────────────────
+    // Mark stale cookies for deletion when the session is irrecoverable. Skipped
+    // during OAuth callbacks where a session cookie may not exist yet.
+    const rawSessionCookie = request.cookies.get(SessionManager.getSessionCookieName())?.value;
+    let shouldClearCookie = false;
+    if (!isValidOAuthCallback && rawSessionCookie && !activeSession && !refreshCookieUpdate) {
+        // A cookie was present but all resolution paths (verify, decode, refresh)
+        // failed — the session is dead and cannot be recovered.
+        shouldClearCookie = true;
+    }
+    const sessionId = activeSession?.sessionId ?? (await getSessionIdFromRequest(request));
+    const isAuthenticated = !!activeSession;
+    // ── Middleware context ────────────────────────────────────────────────────
+    const asgardeo = {
+        getSession: async () => activeSession,
         getSessionId: () => sessionId,
         isSignedIn: () => isAuthenticated,
-        // eslint-disable-next-line @typescript-eslint/no-unused-vars
         protectRoute: async (routeOptions) => {
-            // Skip protection if this is a validated OAuth callback - let the callback handler process it first
-            // This prevents race conditions where middleware redirects before OAuth callback completes
+            // Skip during a valid OAuth callback to avoid redirecting before the
+            // callback action has had a chance to complete.
             if (isValidOAuthCallback) {
                 return undefined;
             }
             if (!isAuthenticated) {
                 const referer = request.headers.get('referer');
-                // TODO: Make this configurable or call the signIn() from here.
                 let fallbackRedirect = '/';
-                // If referer exists and is from the same origin, use it as fallback
                 if (referer) {
                     try {
                         const refererUrl = new URL(referer);
@@ -153,25 +217,58 @@ const asgardeoMiddleware = (handler, options) => async (request) => {
                             fallbackRedirect = refererUrl.pathname + refererUrl.search;
                         }
                     }
-                    catch (error) {
-                        // Invalid referer URL, ignore it
+                    catch {
+                        // Invalid referer — ignore.
                     }
                 }
-                // Fallback chain: options.redirect -> resolvedOptions.signInUrl -> resolvedOptions.defaultRedirect -> referer (same origin only)
-                const redirectUrl = resolvedOptions?.signInUrl || fallbackRedirect;
-                const signInUrl = new URL(redirectUrl, request.url);
-                return NextResponse.redirect(signInUrl);
+                const redirectUrl = routeOptions?.redirect ?? resolvedConfig.signInUrl ?? fallbackRedirect;
+                return NextResponse.redirect(new URL(redirectUrl, request.url));
             }
             return undefined;
         },
     };
-    if (handler) {
-        const result = await handler(asgardeo, request);
-        if (result) {
-            return result;
+    // ── Handler ───────────────────────────────────────────────────────────────
+    const handlerResponse = handler ? await handler(asgardeo, request) : undefined;
+    // ── Build final response ──────────────────────────────────────────────────
+    if (shouldClearCookie) {
+        const cookieName = SessionManager.getSessionCookieName();
+        if (handlerResponse) {
+            // Handler returned a response (e.g. a redirect from protectRoute).
+            // Attach the deletion so the browser discards the stale cookie.
+            handlerResponse.cookies.delete(cookieName);
+            return handlerResponse;
         }
+        // Pass-through: strip the dead cookie from the forwarded request headers
+        // so the same-request Server Component render sees no session at all.
+        const requestHeaders = new Headers(request.headers);
+        requestHeaders.set('cookie', removeCookieFromHeader(request.headers.get('cookie') ?? '', cookieName));
+        const cleanResponse = NextResponse.next({ request: { headers: requestHeaders } });
+        cleanResponse.cookies.delete(cookieName);
+        return cleanResponse;
+    }
+    if (!refreshCookieUpdate) {
+        return handlerResponse ?? NextResponse.next();
+    }
+    // A token refresh occurred — the new session cookie must be applied to:
+    //   1. The HTTP response so the browser stores the updated cookie.
+    //   2. The forwarded request headers so the same-request Server Component
+    //      render reads the fresh session token instead of the expired one.
+    const cookieName = SessionManager.getSessionCookieName();
+    const cookieOptions = SessionManager.getSessionCookieOptions(refreshCookieUpdate.expiry);
+    if (handlerResponse) {
+        // Handler returned a response (e.g. a redirect from protectRoute).
+        // Attach the refresh cookie so the browser receives it even on redirects.
+        handlerResponse.cookies.set(cookieName, refreshCookieUpdate.token, cookieOptions);
+        return handlerResponse;
     }
-    return NextResponse.next();
+    // Default pass-through: update both the response cookie and the request
+    // Cookie header so the downstream Server Component render is not stale.
+    const requestHeaders = new Headers(request.headers);
+    const updatedCookieHeader = replaceCookieInHeader(request.headers.get('cookie') ?? '', cookieName, refreshCookieUpdate.token);
+    requestHeaders.set('cookie', updatedCookieHeader);
+    const response = NextResponse.next({ request: { headers: requestHeaders } });
+    response.cookies.set(cookieName, refreshCookieUpdate.token, cookieOptions);
+    return response;
 };
 export default asgardeoMiddleware;
 //# sourceMappingURL=asgardeoMiddleware.js.map

package/dist/esm/server/middleware/asgardeoMiddleware.js.map

@@ -1 +1 @@
-{"version":3,"file":"asgardeoMiddleware.js","sourceRoot":"","sources":["../../../../src/server/middleware/asgardeoMiddleware.ts"],"names":[],"mappings":"AAAA;;;;;;;;;;;;;;;;GAgBG;AAEH,OAAO,EAAc,YAAY,EAAC,MAAM,aAAa,CAAC;AAEtD,OAAO,cAAqC,MAAM,4BAA4B,CAAC;AAC/E,OAAO,EACL,eAAe,IAAI,kBAAkB,EACrC,qBAAqB,EACrB,uBAAuB,GACxB,MAAM,0BAA0B,CAAC;AA4BlC;;;;;GAKG;AACH,MAAM,eAAe,GAAG,KAAK,EAAE,OAAoB,EAAoB,EAAE;IACvE,IAAI,CAAC;QACH,OAAO,MAAM,kBAAkB,CAAC,OAAO,CAAC,CAAC;IAC3C,CAAC;IAAC,MAAM,CAAC;QACP,OAAO,OAAO,CAAC,OAAO,CAAC,KAAK,CAAC,CAAC;IAChC,CAAC;AACH,CAAC,CAAC;AAEF;;;;;;GAMG;AACH,MAAM,iCAAiC,GAAG,KAAK,EAAE,OAAoB,EAA+B,EAAE,CACpG,uBAAuB,CAAC,OAAO,CAAC,CAAC;AAEnC;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;GAuDG;AACH,MAAM,kBAAkB,GACtB,CACE,OAAmC,EACnC,OAAuF,EACpC,EAAE,CACvD,KAAK,EAAE,OAAoB,EAAyB,EAAE;IACpD,MAAM,eAAe,GAA8B,OAAO,OAAO,KAAK,UAAU,CAAC,CAAC,CAAC,OAAO,CAAC,OAAO,CAAC,CAAC,CAAC,CAAC,OAAO,IAAI,EAAE,CAAC;IAEpH,MAAM,GAAG,GAAQ,IAAI,GAAG,CAAC,OAAO,CAAC,GAAG,CAAC,CAAC;IACtC,MAAM,iBAAiB,GAAY,GAAG,CAAC,YAAY,CAAC,GAAG,CAAC,MAAM,CAAC,IAAI,GAAG,CAAC,YAAY,CAAC,GAAG,CAAC,OAAO,CAAC,CAAC;IAEjG,IAAI,oBAAoB,GAAY,KAAK,CAAC;IAC1C,IAAI,iBAAiB,EAAE,CAAC;QACtB,gFAAgF;QAChF,MAAM,QAAQ,GAAY,GAAG,CAAC,YAAY,CAAC,GAAG,CAAC,OAAO,CAAC,CAAC;QAExD,IAAI,CAAC,QAAQ,EAAE,CAAC;YACd,2EAA2E;YAC3E,MAAM,gBAAgB,GAAuB,OAAO,CAAC,OAAO,CAAC,GAAG,CAC9D,cAAc,CAAC,wBAAwB,EAAE,CAC1C,EAAE,KAAK,CAAC;YACT,IAAI,gBAAgB,EAAE,CAAC;gBACrB,IAAI,CAAC;oBACH,mDAAmD;oBACnD,MAAM,cAAc,CAAC,iBAAiB,CAAC,gBAAgB,CAAC,CAAC;oBACzD,oBAAoB,GAAG,IAAI,CAAC;gBAC9B,CAAC;gBAAC,MAAM,CAAC;oBACP,iEAAiE;oBACjE,oBAAoB,GAAG,KAAK,CAAC;gBAC/B,CAAC;YACH,CAAC;QACH,CAAC;IACH,CAAC;IAED,MAAM,SAAS,GAAuB,MAAM,iCAAiC,CAAC,OAAO,CAAC,CAAC;IACvF,MAAM,eAAe,GAAY,MAAM,eAAe,CAAC,OAAO,CAAC,CAAC;IAEhE,MAAM,QAAQ,GAA8B;QAC1C,UAAU,EAAE,KAAK,IAA8C,EAAE;YAC/D,IAAI,CAAC;gBACH,OAAO,MAAM,qBAAqB,CAAC,OAAO,CAAC,CAAC;YAC9C,CAAC;YAAC,MAAM,CAAC;gBACP,OAAO,SAAS,CAAC;YACnB,CAAC;QACH,CAAC;QACD,YAAY,EAAE,GAAuB,EAAE,CAAC,SAAS;QACjD,UAAU,EAAE,GAAY,EAAE,CAAC,eAAe;QAC1C,6DAA6D;QAC7D,YAAY,EAAE,KAAK,EAAE,YAAkC,EAAgC,EAAE;YACvF,oGAAoG;YACpG,2FAA2F;YAC3F,IAAI,oBAAoB,EAAE,CAAC;gBACzB,OAAO,SAAS,CAAC;YACnB,CAAC;YAED,IAAI,CAAC,eAAe,EAAE,CAAC;gBACrB,MAAM,OAAO,GAAkB,OAAO,CAAC,OAAO,CAAC,GAAG,CAAC,SAAS,CAAC,CAAC;gBAC9D,+DAA+D;gBAC/D,IAAI,gBAAgB,GAAW,GAAG,CAAC;gBAEnC,oEAAoE;gBACpE,IAAI,OAAO,EAAE,CAAC;oBACZ,IAAI,CAAC;wBACH,MAAM,UAAU,GAAQ,IAAI,GAAG,CAAC,OAAO,CAAC,CAAC;wBACzC,MAAM,UAAU,GAAQ,IAAI,GAAG,CAAC,OAAO,CAAC,GAAG,CAAC,CAAC;wBAE7C,IAAI,UAAU,CAAC,MAAM,KAAK,UAAU,CAAC,MAAM,EAAE,CAAC;4BAC5C,gBAAgB,GAAG,UAAU,CAAC,QAAQ,GAAG,UAAU,CAAC,MAAM,CAAC;wBAC7D,CAAC;oBACH,CAAC;oBAAC,OAAO,KAAK,EAAE,CAAC;wBACf,iCAAiC;oBACnC,CAAC;gBACH,CAAC;gBAED,iIAAiI;gBACjI,MAAM,WAAW,GAAY,eAAe,EAAE,SAAoB,IAAI,gBAAgB,CAAC;gBAEvF,MAAM,SAAS,GAAQ,IAAI,GAAG,CAAC,WAAW,EAAE,OAAO,CAAC,GAAG,CAAC,CAAC;gBAEzD,OAAO,YAAY,CAAC,QAAQ,CAAC,SAAS,CAAC,CAAC;YAC1C,CAAC;YAED,OAAO,SAAS,CAAC;QACnB,CAAC;KACF,CAAC;IAEF,IAAI,OAAO,EAAE,CAAC;QACZ,MAAM,MAAM,GAAwB,MAAM,OAAO,CAAC,QAAQ,EAAE,OAAO,CAAC,CAAC;QACrE,IAAI,MAAM,EAAE,CAAC;YACX,OAAO,MAAM,CAAC;QAChB,CAAC;IACH,CAAC;IAED,OAAO,YAAY,CAAC,IAAI,EAAE,CAAC;AAC7B,CAAC,CAAC;AAEJ,eAAe,kBAAkB,CAAC"}
+{"version":3,"file":"asgardeoMiddleware.js","sourceRoot":"","sources":["../../../../src/server/middleware/asgardeoMiddleware.ts"],"names":[],"mappings":"AAAA;;;;;;;;;;;;;;;;GAgBG;AAEH,OAAO,EAAc,YAAY,EAAC,MAAM,aAAa,CAAC;AACtD,OAAO,EAAC,sBAAsB,EAAC,MAAM,kCAAkC,CAAC;AAExE,OAAO,yBAAyB,MAAM,uCAAuC,CAAC;AAC9E,OAAO,kBAAkB,MAAM,gCAAgC,CAAC;AAChE,OAAO,cAAqC,MAAM,4BAA4B,CAAC;AAC/E,OAAO,EAAC,qBAAqB,EAAE,uBAAuB,EAAC,MAAM,0BAA0B,CAAC;AA4BxF;;GAEG;AACH,MAAM,sBAAsB,GAAG,CAAC,YAAoB,EAAE,IAAY,EAAU,EAAE,CAC5E,YAAY;KACT,KAAK,CAAC,GAAG,CAAC;KACV,GAAG,CAAC,CAAC,CAAS,EAAE,EAAE,CAAC,CAAC,CAAC,IAAI,EAAE,CAAC;KAC5B,MAAM,CAAC,CAAC,CAAS,EAAE,EAAE;IACpB,MAAM,KAAK,GAAW,CAAC,CAAC,OAAO,CAAC,GAAG,CAAC,CAAC;IACrC,MAAM,QAAQ,GAAW,KAAK,KAAK,CAAC,CAAC,CAAC,CAAC,CAAC,CAAC,CAAC,CAAC,CAAC,CAAC,CAAC,KAAK,CAAC,CAAC,EAAE,KAAK,CAAC,CAAC,IAAI,EAAE,CAAC;IACrE,OAAO,QAAQ,KAAK,IAAI,CAAC;AAC3B,CAAC,CAAC;KACD,IAAI,CAAC,IAAI,CAAC,CAAC;AAEhB;;;GAGG;AACH,MAAM,qBAAqB,GAAG,CAAC,YAAoB,EAAE,IAAY,EAAE,KAAa,EAAU,EAAE;IAC1F,MAAM,KAAK,GAAa,YAAY;SACjC,KAAK,CAAC,GAAG,CAAC;SACV,GAAG,CAAC,CAAC,CAAS,EAAE,EAAE,CAAC,CAAC,CAAC,IAAI,EAAE,CAAC;SAC5B,MAAM,CAAC,OAAO,CAAC,CAAC;IAEnB,IAAI,KAAK,GAAY,KAAK,CAAC;IAC3B,MAAM,OAAO,GAAa,KAAK,CAAC,GAAG,CAAC,CAAC,IAAY,EAAE,EAAE;QACnD,MAAM,KAAK,GAAW,IAAI,CAAC,OAAO,CAAC,GAAG,CAAC,CAAC;QACxC,MAAM,QAAQ,GAAW,KAAK,KAAK,CAAC,CAAC,CAAC,CAAC,CAAC,IAAI,CAAC,CAAC,CAAC,IAAI,CAAC,KAAK,CAAC,CAAC,EAAE,KAAK,CAAC,CAAC,IAAI,EAAE,CAAC;QAC3E,IAAI,QAAQ,KAAK,IAAI,EAAE,CAAC;YACtB,KAAK,GAAG,IAAI,CAAC;YACb,OAAO,GAAG,IAAI,IAAI,KAAK,EAAE,CAAC;QAC5B,CAAC;QACD,OAAO,IAAI,CAAC;IACd,CAAC,CAAC,CAAC;IAEH,IAAI,CAAC,KAAK,EAAE,CAAC;QACX,OAAO,CAAC,IAAI,CAAC,GAAG,IAAI,IAAI,KAAK,EAAE,CAAC,CAAC;IACnC,CAAC;IAED,OAAO,OAAO,CAAC,IAAI,CAAC,IAAI,CAAC,CAAC;AAC5B,CAAC,CAAC;AAEF;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;GA+CG;AACH,MAAM,kBAAkB,GACtB,CACE,OAAmC,EACnC,OAAuF,EACpC,EAAE,CACvD,KAAK,EAAE,OAAoB,EAAyB,EAAE;IACpD,MAAM,eAAe,GAA8B,OAAO,OAAO,KAAK,UAAU,CAAC,CAAC,CAAC,OAAO,CAAC,OAAO,CAAC,CAAC,CAAC,CAAC,OAAO,IAAI,EAAE,CAAC;IAEpH,4EAA4E;IAC5E,MAAM,cAAc,GAAuB,yBAAyB,CAAC,eAAqC,CAAC,CAAC;IAE5G,6EAA6E;IAC7E,MAAM,GAAG,GAAQ,IAAI,GAAG,CAAC,OAAO,CAAC,GAAG,CAAC,CAAC;IACtC,MAAM,iBAAiB,GAAY,GAAG,CAAC,YAAY,CAAC,GAAG,CAAC,MAAM,CAAC,IAAI,GAAG,CAAC,YAAY,CAAC,GAAG,CAAC,OAAO,CAAC,CAAC;IAEjG,IAAI,oBAAoB,GAAY,KAAK,CAAC;IAC1C,IAAI,iBAAiB,IAAI,CAAC,GAAG,CAAC,YAAY,CAAC,GAAG,CAAC,OAAO,CAAC,EAAE,CAAC;QACxD,MAAM,gBAAgB,GAAuB,OAAO,CAAC,OAAO,CAAC,GAAG,CAC9D,cAAc,CAAC,wBAAwB,EAAE,CAC1C,EAAE,KAAK,CAAC;QACT,IAAI,gBAAgB,EAAE,CAAC;YACrB,IAAI,CAAC;gBACH,MAAM,cAAc,CAAC,iBAAiB,CAAC,gBAAgB,CAAC,CAAC;gBACzD,oBAAoB,GAAG,IAAI,CAAC;YAC9B,CAAC;YAAC,MAAM,CAAC;gBACP,oBAAoB,GAAG,KAAK,CAAC;YAC/B,CAAC;QACH,CAAC;IACH,CAAC;IAED,6EAA6E;IAC7E,wEAAwE;IACxE,MAAM,eAAe,GAAoC,MAAM,qBAAqB,CAAC,OAAO,CAAC,CAAC;IAE9F,2EAA2E;IAC3E,0EAA0E;IAC1E,2EAA2E;IAC3E,4EAA4E;IAC5E,0EAA0E;IAC1E,4EAA4E;IAC5E,mBAAmB;IACnB,IAAI,cAA+C,CAAC;IACpD,IAAI,CAAC,eAAe,EAAE,CAAC;QACrB,MAAM,QAAQ,GAAuB,OAAO,CAAC,OAAO,CAAC,GAAG,CAAC,cAAc,CAAC,oBAAoB,EAAE,CAAC,EAAE,KAAK,CAAC;QACvG,IAAI,QAAQ,EAAE,CAAC;YACb,IAAI,CAAC;gBACH,MAAM,OAAO,GAAwB,MAAM,cAAc,CAAC,4BAA4B,CAAC,QAAQ,CAAC,CAAC;gBACjG,IAAI,OAAO,CAAC,YAAY,EAAE,CAAC;oBACzB,cAAc,GAAG,OAAO,CAAC;gBAC3B,CAAC;YACH,CAAC;YAAC,MAAM,CAAC;gBACP,uDAAuD;YACzD,CAAC;QACH,CAAC;IACH,CAAC;IAED,6EAA6E;IAC7E,MAAM,GAAG,GAAW,IAAI,CAAC,KAAK,CAAC,IAAI,CAAC,GAAG,EAAE,GAAG,IAAI,CAAC,CAAC;IAClD,MAAM,gBAAgB,GAAoC,eAAe,IAAI,cAAc,CAAC;IAE5F,iDAAiD;IACjD,MAAM,gBAAgB,GAAY,CAAC,CAAC,CAClC,cAAc,CAAC,OAAO;QACtB,cAAc,CAAC,QAAQ;QACvB,cAAc,CAAC,YAAY,CAC5B,CAAC;IAEF,gBAAgB;IAChB,oEAAoE;IACpE,mEAAmE;IACnE,MAAM,YAAY,GAChB,CAAC,oBAAoB;QACrB,gBAAgB;QAChB,CAAC,CAAC,gBAAgB,EAAE,YAAY;QAChC,CAAC,CAAC,CAAC,CAAC,eAAe,IAAI,eAAe,CAAC,GAAG,IAAI,GAAG,GAAG,sBAAsB,CAAC,IAAI,CAAC,CAAC,cAAc,CAAC,CAAC;IAEnG,IAAI,aAAa,GAAoC,eAAe,CAAC;IACrE,IAAI,mBAAgE,CAAC;IAErE,IAAI,YAAY,IAAI,gBAAgB,EAAE,CAAC;QACrC,IAAI,CAAC;YACH,MAAM,EAAC,eAAe,EAAE,uBAAuB,EAAC,GAAG,MAAM,kBAAkB,CAAC,gBAAgB,EAAE;gBAC5F,OAAO,EAAE,cAAc,CAAC,OAAQ;gBAChC,QAAQ,EAAE,cAAc,CAAC,QAAS;gBAClC,YAAY,EAAE,cAAc,CAAC,YAAa;gBAC1C,uBAAuB,EAAE,cAAc,CAAC,uBAAuB;aAChE,CAAC,CAAC;YACH,wEAAwE;YACxE,aAAa,GAAG,MAAM,cAAc,CAAC,kBAAkB,CAAC,eAAe,CAAC,CAAC;YACzE,mBAAmB,GAAG,EAAC,MAAM,EAAE,uBAAuB,EAAE,KAAK,EAAE,eAAe,EAAC,CAAC;QAClF,CAAC;QAAC,MAAM,CAAC;YACP,oDAAoD;YACpD,aAAa,GAAG,SAAS,CAAC;QAC5B,CAAC;IACH,CAAC;IAED,6EAA6E;IAC7E,6EAA6E;IAC7E,mEAAmE;IACnE,MAAM,gBAAgB,GAAuB,OAAO,CAAC,OAAO,CAAC,GAAG,CAAC,cAAc,CAAC,oBAAoB,EAAE,CAAC,EAAE,KAAK,CAAC;IAE/G,IAAI,iBAAiB,GAAY,KAAK,CAAC;IAEvC,IAAI,CAAC,oBAAoB,IAAI,gBAAgB,IAAI,CAAC,aAAa,IAAI,CAAC,mBAAmB,EAAE,CAAC;QACxF,0EAA0E;QAC1E,wDAAwD;QACxD,iBAAiB,GAAG,IAAI,CAAC;IAC3B,CAAC;IAED,MAAM,SAAS,GAAuB,aAAa,EAAE,SAAS,IAAI,CAAC,MAAM,uBAAuB,CAAC,OAAO,CAAC,CAAC,CAAC;IAC3G,MAAM,eAAe,GAAY,CAAC,CAAC,aAAa,CAAC;IAEjD,6EAA6E;IAC7E,MAAM,QAAQ,GAA8B;QAC1C,UAAU,EAAE,KAAK,IAA8C,EAAE,CAAC,aAAa;QAC/E,YAAY,EAAE,GAAuB,EAAE,CAAC,SAAS;QACjD,UAAU,EAAE,GAAY,EAAE,CAAC,eAAe;QAC1C,YAAY,EAAE,KAAK,EAAE,YAAkC,EAAgC,EAAE;YACvF,qEAAqE;YACrE,gDAAgD;YAChD,IAAI,oBAAoB,EAAE,CAAC;gBACzB,OAAO,SAAS,CAAC;YACnB,CAAC;YAED,IAAI,CAAC,eAAe,EAAE,CAAC;gBACrB,MAAM,OAAO,GAAkB,OAAO,CAAC,OAAO,CAAC,GAAG,CAAC,SAAS,CAAC,CAAC;gBAC9D,IAAI,gBAAgB,GAAW,GAAG,CAAC;gBAEnC,IAAI,OAAO,EAAE,CAAC;oBACZ,IAAI,CAAC;wBACH,MAAM,UAAU,GAAQ,IAAI,GAAG,CAAC,OAAO,CAAC,CAAC;wBACzC,MAAM,UAAU,GAAQ,IAAI,GAAG,CAAC,OAAO,CAAC,GAAG,CAAC,CAAC;wBAC7C,IAAI,UAAU,CAAC,MAAM,KAAK,UAAU,CAAC,MAAM,EAAE,CAAC;4BAC5C,gBAAgB,GAAG,UAAU,CAAC,QAAQ,GAAG,UAAU,CAAC,MAAM,CAAC;wBAC7D,CAAC;oBACH,CAAC;oBAAC,MAAM,CAAC;wBACP,4BAA4B;oBAC9B,CAAC;gBACH,CAAC;gBAED,MAAM,WAAW,GACf,YAAY,EAAE,QAAQ,IAAK,cAAc,CAAC,SAAoB,IAAI,gBAAgB,CAAC;gBAErF,OAAO,YAAY,CAAC,QAAQ,CAAC,IAAI,GAAG,CAAC,WAAW,EAAE,OAAO,CAAC,GAAG,CAAC,CAAC,CAAC;YAClE,CAAC;YAED,OAAO,SAAS,CAAC;QACnB,CAAC;KACF,CAAC;IAEF,6EAA6E;IAC7E,MAAM,eAAe,GAAwB,OAAO,CAAC,CAAC,CAAC,MAAM,OAAO,CAAC,QAAQ,EAAE,OAAO,CAAC,CAAC,CAAC,CAAC,SAAS,CAAC;IAEpG,6EAA6E;IAC7E,IAAI,iBAAiB,EAAE,CAAC;QACtB,MAAM,UAAU,GAAW,cAAc,CAAC,oBAAoB,EAAE,CAAC;QAEjE,IAAI,eAAe,EAAE,CAAC;YACpB,mEAAmE;YACnE,gEAAgE;YAChE,eAAe,CAAC,OAAO,CAAC,MAAM,CAAC,UAAU,CAAC,CAAC;YAC3C,OAAO,eAAe,CAAC;QACzB,CAAC;QAED,yEAAyE;QACzE,sEAAsE;QACtE,MAAM,cAAc,GAAY,IAAI,OAAO,CAAC,OAAO,CAAC,OAAO,CAAC,CAAC;QAC7D,cAAc,CAAC,GAAG,CAAC,QAAQ,EAAE,sBAAsB,CAAC,OAAO,CAAC,OAAO,CAAC,GAAG,CAAC,QAAQ,CAAC,IAAI,EAAE,EAAE,UAAU,CAAC,CAAC,CAAC;QACtG,MAAM,aAAa,GAAiB,YAAY,CAAC,IAAI,CAAC,EAAC,OAAO,EAAE,EAAC,OAAO,EAAE,cAAc,EAAC,EAAC,CAAC,CAAC;QAC5F,aAAa,CAAC,OAAO,CAAC,MAAM,CAAC,UAAU,CAAC,CAAC;QACzC,OAAO,aAAa,CAAC;IACvB,CAAC;IAED,IAAI,CAAC,mBAAmB,EAAE,CAAC;QACzB,OAAO,eAAe,IAAI,YAAY,CAAC,IAAI,EAAE,CAAC;IAChD,CAAC;IAED,wEAAwE;IACxE,mEAAmE;IACnE,0EAA0E;IAC1E,wEAAwE;IACxE,MAAM,UAAU,GAAW,cAAc,CAAC,oBAAoB,EAAE,CAAC;IACjE,MAAM,aAAa,GACjB,cAAc,CAAC,uBAAuB,CAAC,mBAAmB,CAAC,MAAM,CAAC,CAAC;IAErE,IAAI,eAAe,EAAE,CAAC;QACpB,mEAAmE;QACnE,0EAA0E;QAC1E,eAAe,CAAC,OAAO,CAAC,GAAG,CAAC,UAAU,EAAE,mBAAmB,CAAC,KAAK,EAAE,aAAa,CAAC,CAAC;QAClF,OAAO,eAAe,CAAC;IACzB,CAAC;IAED,wEAAwE;IACxE,wEAAwE;IACxE,MAAM,cAAc,GAAY,IAAI,OAAO,CAAC,OAAO,CAAC,OAAO,CAAC,CAAC;IAC7D,MAAM,mBAAmB,GAAW,qBAAqB,CACvD,OAAO,CAAC,OAAO,CAAC,GAAG,CAAC,QAAQ,CAAC,IAAI,EAAE,EACnC,UAAU,EACV,mBAAmB,CAAC,KAAK,CAC1B,CAAC;IACF,cAAc,CAAC,GAAG,CAAC,QAAQ,EAAE,mBAAmB,CAAC,CAAC;IAElD,MAAM,QAAQ,GAAiB,YAAY,CAAC,IAAI,CAAC,EAAC,OAAO,EAAE,EAAC,OAAO,EAAE,cAAc,EAAC,EAAC,CAAC,CAAC;IACvF,QAAQ,CAAC,OAAO,CAAC,GAAG,CAAC,UAAU,EAAE,mBAAmB,CAAC,KAAK,EAAE,aAAa,CAAC,CAAC;IAC3E,OAAO,QAAQ,CAAC;AAClB,CAAC,CAAC;AAEJ,eAAe,kBAAkB,CAAC"}

package/dist/esm/utils/SessionManager.js

@@ -16,12 +16,12 @@
  * under the License.
  */
 import { AsgardeoRuntimeError, CookieConfig } from '@asgardeo/node';
-import { SignJWT, jwtVerify } from 'jose';
+import { SignJWT, jwtVerify, compactVerify } from 'jose';
+import { DEFAULT_SESSION_COOKIE_EXPIRY_TIME } from '../constants/sessionConstants';
 /**
  * Session management utility class for JWT-based session cookies
  */
 class SessionManager {
-    static DEFAULT_EXPIRY_SECONDS = 3600;
     /**
      * Get the signing secret from environment variable
      * Throws error in production if not set
@@ -55,13 +55,32 @@ class SessionManager {
         return jwt;
     }
     /**
-     * Create a session cookie with user information
+     * Resolve the session cookie expiry time in seconds.
+     *
+     * Resolution order (first defined value wins):
+     *   1. `configuredExpiry` — value from `AsgardeoNodeConfig.sessionCookieExpiryTime`
+     *   2. `ASGARDEO_SESSION_COOKIE_EXPIRY_TIME` environment variable
+     *   3. `DEFAULT_SESSION_COOKIE_EXPIRY_TIME` (24 hours)
      */
-    static async createSessionToken(accessToken, userId, sessionId, scopes, organizationId, expirySeconds = this.DEFAULT_EXPIRY_SECONDS) {
+    static resolveSessionCookieExpiry(configuredExpiry) {
+        if (configuredExpiry != null && configuredExpiry > 0) {
+            return configuredExpiry;
+        }
+        const envValue = process.env['ASGARDEO_SESSION_COOKIE_EXPIRY_TIME'];
+        if (envValue) {
+            const parsed = parseInt(envValue, 10);
+            if (!Number.isNaN(parsed) && parsed > 0) {
+                return parsed;
+            }
+        }
+        return DEFAULT_SESSION_COOKIE_EXPIRY_TIME;
+    }
+    static async createSessionToken(accessToken, userId, sessionId, scopes, accessTokenTtlSeconds, refreshToken, organizationId) {
         const secret = this.getSecret();
         const jwt = await new SignJWT({
             accessToken,
             organizationId,
+            refreshToken,
             scopes,
             sessionId,
             type: 'session',
@@ -69,7 +88,7 @@ class SessionManager {
             .setProtectedHeader({ alg: 'HS256' })
             .setSubject(userId)
             .setIssuedAt()
-            .setExpirationTime(Date.now() / 1000 + expirySeconds)
+            .setExpirationTime(Math.floor(Date.now() / 1000) + accessTokenTtlSeconds)
             .sign(secret);
         return jwt;
     }
@@ -80,12 +99,40 @@ class SessionManager {
         try {
             const secret = this.getSecret();
             const { payload } = await jwtVerify(token, secret);
+            if (payload['type'] !== 'session') {
+                throw new Error('Invalid token type');
+            }
             return payload;
         }
         catch (error) {
             throw new AsgardeoRuntimeError(`Invalid session token: ${error instanceof Error ? error.message : 'Unknown error'}`, 'invalid-session-token', 'nextjs', 'Session token verification failed');
         }
     }
+    /**
+     * Verify a session token for refresh. Validates the HMAC signature and the
+     * `type === 'session'` discriminant but intentionally skips the `exp` check
+     * so an expired access token can still be exchanged for a new one.
+     *
+     * Session lifetime is still bounded — the cookie's `maxAge` is set from
+     * `sessionCookieExpiryTime`, so the browser drops an over-age session regardless
+     * of the access-token exp embedded in the JWT.
+     *
+     * Never use the returned payload for authorization.
+     */
+    static async verifySessionTokenForRefresh(token) {
+        try {
+            const secret = this.getSecret();
+            const { payload: rawPayload } = await compactVerify(token, secret);
+            const payload = JSON.parse(new TextDecoder().decode(rawPayload));
+            if (payload.type !== 'session') {
+                throw new Error('Invalid token type');
+            }
+            return payload;
+        }
+        catch (error) {
+            throw new AsgardeoRuntimeError(`Invalid session token: ${error instanceof Error ? error.message : 'Unknown error'}`, 'invalid-session-token-for-refresh', 'nextjs', 'Session token signature or type check failed during refresh');
+        }
+    }
     /**
      * Verify and decode a temporary session token
      */
@@ -105,10 +152,10 @@ class SessionManager {
     /**
      * Get session cookie options
      */
-    static getSessionCookieOptions() {
+    static getSessionCookieOptions(maxAge) {
         return {
             httpOnly: true,
-            maxAge: this.DEFAULT_EXPIRY_SECONDS,
+            maxAge,
             path: '/',
             sameSite: 'lax',
             secure: process.env['NODE_ENV'] === 'production',