@atlasauth/nextjs 0.1.0

package/dist/index.d.ts

@@ -0,0 +1,2 @@
+export * from './matcher';
+export * from './middleware';

package/dist/index.js

@@ -0,0 +1,19 @@
+"use strict";
+var __createBinding = (this && this.__createBinding) || (Object.create ? (function(o, m, k, k2) {
+    if (k2 === undefined) k2 = k;
+    var desc = Object.getOwnPropertyDescriptor(m, k);
+    if (!desc || ("get" in desc ? !m.__esModule : desc.writable || desc.configurable)) {
+      desc = { enumerable: true, get: function() { return m[k]; } };
+    }
+    Object.defineProperty(o, k2, desc);
+}) : (function(o, m, k, k2) {
+    if (k2 === undefined) k2 = k;
+    o[k2] = m[k];
+}));
+var __exportStar = (this && this.__exportStar) || function(m, exports) {
+    for (var p in m) if (p !== "default" && !Object.prototype.hasOwnProperty.call(exports, p)) __createBinding(exports, m, p);
+};
+Object.defineProperty(exports, "__esModule", { value: true });
+__exportStar(require("./matcher"), exports);
+__exportStar(require("./middleware"), exports);
+//# sourceMappingURL=index.js.map

package/dist/index.js.map

@@ -0,0 +1 @@
+{"version":3,"file":"index.js","sourceRoot":"","sources":["../src/index.ts"],"names":[],"mappings":";;;;;;;;;;;;;;;;AAAA,4CAA0B;AAC1B,+CAA6B"}

package/dist/matcher.d.ts

@@ -0,0 +1,67 @@
+/**
+ * §10.1 `@atlasauth/nextjs`: "route protection matcher config".
+ *
+ * The single most consequential decision in this package is the DEFAULT. A
+ * matcher that treats unlisted routes as public means every new page a
+ * developer adds ships unprotected, and nothing anywhere reports it — the page
+ * simply works, for everyone, including people who are not signed in. So the
+ * default is deny: a route is protected unless it matches a public pattern.
+ *
+ * That is the opposite of comfortable. It means a developer who forgets to list
+ * their marketing page gets redirected to sign-in and notices immediately,
+ * which is a loud failure rather than a silent breach.
+ */
+/**
+ * Patterns support one wildcard form: `(.*)` at the end, matching Next.js's own
+ * matcher syntax so a developer writes one dialect rather than two.
+ *
+ * Deliberately NOT a general regex. A customer-authored regex in an
+ * authorization path is a catastrophic-backtracking outage waiting to happen,
+ * and `/admin(.*)` covers what anyone actually needs.
+ */
+export declare function matchesPattern(pathname: string, pattern: string): boolean;
+export declare function matchesAny(pathname: string, patterns: readonly string[]): boolean;
+export declare function isStaticAsset(pathname: string): boolean;
+export interface MiddlewareConfig {
+    /** Routes reachable without a session. Everything else requires one. */
+    publicRoutes?: readonly string[];
+    /** Routes that require a session even if a public pattern would match them. */
+    protectedRoutes?: readonly string[];
+    signInUrl?: string;
+    /** Exact origins a `redirect_url` may point at (§13.1). */
+    allowedOrigins?: readonly string[];
+}
+export declare const DEFAULT_SIGN_IN_URL = "/sign-in";
+export type RouteDecision = {
+    action: 'skip';
+} | {
+    action: 'allow';
+} | {
+    action: 'redirect';
+    to: string;
+} | {
+    action: 'unauthorized';
+};
+/**
+ * Decide what to do with a request.
+ *
+ * `protectedRoutes` wins over `publicRoutes` deliberately. A developer who
+ * writes `publicRoutes: ['/(.*)']` while iterating and then protects `/admin`
+ * expects the narrower, more explicit rule to hold — and the failure of the
+ * other precedence is that `/admin` is public.
+ */
+export declare function decideRoute(input: {
+    pathname: string;
+    signedIn: boolean;
+    config?: MiddlewareConfig;
+    /** For API routes, a redirect is useless — the caller wants a 401. */
+    isApiRoute?: boolean;
+}): RouteDecision;
+/**
+ * §13.1 open redirect: validate a `redirect_url` before sending anyone to it.
+ *
+ * A relative path is allowed because it cannot leave the site. An absolute URL
+ * must match an allowed origin EXACTLY — prefix matching is how
+ * `https://app.example.com.evil.test` gets accepted.
+ */
+export declare function safeRedirect(redirectUrl: string | null | undefined, allowedOrigins?: readonly string[], fallback?: string): string;

package/dist/matcher.js

@@ -0,0 +1,111 @@
+"use strict";
+/**
+ * §10.1 `@atlasauth/nextjs`: "route protection matcher config".
+ *
+ * The single most consequential decision in this package is the DEFAULT. A
+ * matcher that treats unlisted routes as public means every new page a
+ * developer adds ships unprotected, and nothing anywhere reports it — the page
+ * simply works, for everyone, including people who are not signed in. So the
+ * default is deny: a route is protected unless it matches a public pattern.
+ *
+ * That is the opposite of comfortable. It means a developer who forgets to list
+ * their marketing page gets redirected to sign-in and notices immediately,
+ * which is a loud failure rather than a silent breach.
+ */
+Object.defineProperty(exports, "__esModule", { value: true });
+exports.DEFAULT_SIGN_IN_URL = void 0;
+exports.matchesPattern = matchesPattern;
+exports.matchesAny = matchesAny;
+exports.isStaticAsset = isStaticAsset;
+exports.decideRoute = decideRoute;
+exports.safeRedirect = safeRedirect;
+/**
+ * Patterns support one wildcard form: `(.*)` at the end, matching Next.js's own
+ * matcher syntax so a developer writes one dialect rather than two.
+ *
+ * Deliberately NOT a general regex. A customer-authored regex in an
+ * authorization path is a catastrophic-backtracking outage waiting to happen,
+ * and `/admin(.*)` covers what anyone actually needs.
+ */
+function matchesPattern(pathname, pattern) {
+    if (pattern === pathname)
+        return true;
+    const wildcard = pattern.indexOf('(.*)');
+    if (wildcard === -1)
+        return false;
+    // Anything after the wildcard is meaningless — `(.*)` already matched it.
+    const prefix = pattern.slice(0, wildcard);
+    return pathname.startsWith(prefix);
+}
+function matchesAny(pathname, patterns) {
+    return patterns.some((pattern) => matchesPattern(pathname, pattern));
+}
+/**
+ * Paths that are never auth decisions.
+ *
+ * Running auth on every image request is a measurable cost on a page with forty
+ * assets, and a redirect on a `.css` file breaks the page rather than
+ * protecting it.
+ */
+const ALWAYS_SKIPPED = ['/_next/', '/favicon.ico', '/robots.txt', '/sitemap.xml', '/.well-known/'];
+function isStaticAsset(pathname) {
+    if (ALWAYS_SKIPPED.some((prefix) => pathname.startsWith(prefix)))
+        return true;
+    // A dotted final segment is a file, not a page.
+    const last = pathname.split('/').pop() ?? '';
+    return last.includes('.');
+}
+exports.DEFAULT_SIGN_IN_URL = '/sign-in';
+/**
+ * Decide what to do with a request.
+ *
+ * `protectedRoutes` wins over `publicRoutes` deliberately. A developer who
+ * writes `publicRoutes: ['/(.*)']` while iterating and then protects `/admin`
+ * expects the narrower, more explicit rule to hold — and the failure of the
+ * other precedence is that `/admin` is public.
+ */
+function decideRoute(input) {
+    const config = input.config ?? {};
+    if (isStaticAsset(input.pathname))
+        return { action: 'skip' };
+    const explicitlyProtected = matchesAny(input.pathname, config.protectedRoutes ?? []);
+    const isPublic = !explicitlyProtected && matchesAny(input.pathname, config.publicRoutes ?? []);
+    if (isPublic || input.signedIn)
+        return { action: 'allow' };
+    /**
+     * An API route gets a 401, not a redirect. Redirecting a fetch to an HTML
+     * sign-in page produces a JSON parse error in the caller's code, three
+     * frames from the actual problem.
+     */
+    if (input.isApiRoute)
+        return { action: 'unauthorized' };
+    const signInUrl = config.signInUrl ?? exports.DEFAULT_SIGN_IN_URL;
+    return {
+        action: 'redirect',
+        to: `${signInUrl}?redirect_url=${encodeURIComponent(input.pathname)}`,
+    };
+}
+/**
+ * §13.1 open redirect: validate a `redirect_url` before sending anyone to it.
+ *
+ * A relative path is allowed because it cannot leave the site. An absolute URL
+ * must match an allowed origin EXACTLY — prefix matching is how
+ * `https://app.example.com.evil.test` gets accepted.
+ */
+function safeRedirect(redirectUrl, allowedOrigins = [], fallback = '/') {
+    if (!redirectUrl)
+        return fallback;
+    // Protocol-relative `//evil.test` is an absolute URL wearing a disguise.
+    if (redirectUrl.startsWith('//'))
+        return fallback;
+    if (redirectUrl.startsWith('/'))
+        return redirectUrl;
+    try {
+        const url = new URL(redirectUrl);
+        return allowedOrigins.includes(url.origin) ? redirectUrl : fallback;
+    }
+    catch {
+        return fallback;
+    }
+}
+//# sourceMappingURL=matcher.js.map

package/dist/matcher.js.map

@@ -0,0 +1 @@
+{"version":3,"file":"matcher.js","sourceRoot":"","sources":["../src/matcher.ts"],"names":[],"mappings":";AAAA;;;;;;;;;;;;GAYG;;;AAUH,wCASC;AAED,gCAEC;AAWD,sCAKC;AA4BD,kCA4BC;AASD,oCAiBC;AAvHD;;;;;;;GAOG;AACH,SAAgB,cAAc,CAAC,QAAgB,EAAE,OAAe;IAC9D,IAAI,OAAO,KAAK,QAAQ;QAAE,OAAO,IAAI,CAAC;IAEtC,MAAM,QAAQ,GAAG,OAAO,CAAC,OAAO,CAAC,MAAM,CAAC,CAAC;IACzC,IAAI,QAAQ,KAAK,CAAC,CAAC;QAAE,OAAO,KAAK,CAAC;IAElC,0EAA0E;IAC1E,MAAM,MAAM,GAAG,OAAO,CAAC,KAAK,CAAC,CAAC,EAAE,QAAQ,CAAC,CAAC;IAC1C,OAAO,QAAQ,CAAC,UAAU,CAAC,MAAM,CAAC,CAAC;AACrC,CAAC;AAED,SAAgB,UAAU,CAAC,QAAgB,EAAE,QAA2B;IACtE,OAAO,QAAQ,CAAC,IAAI,CAAC,CAAC,OAAO,EAAE,EAAE,CAAC,cAAc,CAAC,QAAQ,EAAE,OAAO,CAAC,CAAC,CAAC;AACvE,CAAC;AAED;;;;;;GAMG;AACH,MAAM,cAAc,GAAG,CAAC,SAAS,EAAE,cAAc,EAAE,aAAa,EAAE,cAAc,EAAE,eAAe,CAAC,CAAC;AAEnG,SAAgB,aAAa,CAAC,QAAgB;IAC5C,IAAI,cAAc,CAAC,IAAI,CAAC,CAAC,MAAM,EAAE,EAAE,CAAC,QAAQ,CAAC,UAAU,CAAC,MAAM,CAAC,CAAC;QAAE,OAAO,IAAI,CAAC;IAC9E,gDAAgD;IAChD,MAAM,IAAI,GAAG,QAAQ,CAAC,KAAK,CAAC,GAAG,CAAC,CAAC,GAAG,EAAE,IAAI,EAAE,CAAC;IAC7C,OAAO,IAAI,CAAC,QAAQ,CAAC,GAAG,CAAC,CAAC;AAC5B,CAAC;AAYY,QAAA,mBAAmB,GAAG,UAAU,CAAC;AAQ9C;;;;;;;GAOG;AACH,SAAgB,WAAW,CAAC,KAM3B;IACC,MAAM,MAAM,GAAG,KAAK,CAAC,MAAM,IAAI,EAAE,CAAC;IAElC,IAAI,aAAa,CAAC,KAAK,CAAC,QAAQ,CAAC;QAAE,OAAO,EAAE,MAAM,EAAE,MAAM,EAAE,CAAC;IAE7D,MAAM,mBAAmB,GAAG,UAAU,CAAC,KAAK,CAAC,QAAQ,EAAE,MAAM,CAAC,eAAe,IAAI,EAAE,CAAC,CAAC;IACrF,MAAM,QAAQ,GAAG,CAAC,mBAAmB,IAAI,UAAU,CAAC,KAAK,CAAC,QAAQ,EAAE,MAAM,CAAC,YAAY,IAAI,EAAE,CAAC,CAAC;IAE/F,IAAI,QAAQ,IAAI,KAAK,CAAC,QAAQ;QAAE,OAAO,EAAE,MAAM,EAAE,OAAO,EAAE,CAAC;IAE3D;;;;OAIG;IACH,IAAI,KAAK,CAAC,UAAU;QAAE,OAAO,EAAE,MAAM,EAAE,cAAc,EAAE,CAAC;IAExD,MAAM,SAAS,GAAG,MAAM,CAAC,SAAS,IAAI,2BAAmB,CAAC;IAC1D,OAAO;QACL,MAAM,EAAE,UAAU;QAClB,EAAE,EAAE,GAAG,SAAS,iBAAiB,kBAAkB,CAAC,KAAK,CAAC,QAAQ,CAAC,EAAE;KACtE,CAAC;AACJ,CAAC;AAED;;;;;;GAMG;AACH,SAAgB,YAAY,CAC1B,WAAsC,EACtC,iBAAoC,EAAE,EACtC,QAAQ,GAAG,GAAG;IAEd,IAAI,CAAC,WAAW;QAAE,OAAO,QAAQ,CAAC;IAElC,yEAAyE;IACzE,IAAI,WAAW,CAAC,UAAU,CAAC,IAAI,CAAC;QAAE,OAAO,QAAQ,CAAC;IAClD,IAAI,WAAW,CAAC,UAAU,CAAC,GAAG,CAAC;QAAE,OAAO,WAAW,CAAC;IAEpD,IAAI,CAAC;QACH,MAAM,GAAG,GAAG,IAAI,GAAG,CAAC,WAAW,CAAC,CAAC;QACjC,OAAO,cAAc,CAAC,QAAQ,CAAC,GAAG,CAAC,MAAM,CAAC,CAAC,CAAC,CAAC,WAAW,CAAC,CAAC,CAAC,QAAQ,CAAC;IACtE,CAAC;IAAC,MAAM,CAAC;QACP,OAAO,QAAQ,CAAC;IAClB,CAAC;AACH,CAAC"}

package/dist/middleware.d.ts

@@ -0,0 +1,103 @@
+import { AtlasBackend, type ProtectCondition, type SessionClaims } from '@atlasauth/backend';
+import { safeRedirect, type MiddlewareConfig } from './matcher';
+/**
+ * §10.1: "Middleware: reads cookies, verifies JWT at the edge, exposes auth()
+ * in server components/route handlers, route protection matcher config."
+ *
+ * Verifying at the EDGE is the point. A middleware that called Atlas on every
+ * request would add a round trip to every page load in the customer's app and
+ * make Atlas's latency theirs — which is precisely what §7.3's local
+ * verification exists to avoid. The JWKS is cached in-process by
+ * `@atlasauth/backend`, so a warm edge instance verifies with no network at all.
+ */
+export interface AtlasMiddlewareOptions extends MiddlewareConfig {
+    publishableKey?: string;
+    jwksUrl: string;
+    issuer: string;
+    authorizedParties?: readonly string[];
+    fetchImpl?: typeof fetch;
+    /**
+     * Cross-property SSO handshake. When a protected route has no valid local
+     * session, bounce the browser ONCE through the Atlas handshake endpoint
+     * (`GET {fapiOrigin}/v1/client/handshake`) before falling back to the sign-in
+     * redirect. The endpoint reads the authoritative session and returns a fresh
+     * first-party one, so a user already signed in on another of the customer's
+     * properties is admitted here with no login screen. Requires `publishableKey`.
+     * The loop is guarded by the `__atlas_hs` marker the endpoint appends: once it
+     * comes back (ok → session cookie now present; signed_out → nobody's signed
+     * in), we don't handshake again and let normal routing proceed.
+     */
+    handshake?: boolean;
+    /** Origin of the Atlas Frontend API (where `/v1/client/handshake` lives).
+     *  Defaults to the origin of `jwksUrl`. */
+    fapiOrigin?: string;
+}
+/** Minimal shapes, so this package does not depend on Next.js at build time. */
+export interface EdgeRequest {
+    nextUrl: {
+        pathname: string;
+        search?: string;
+    };
+    headers: {
+        get(name: string): string | null;
+    };
+    url?: string;
+}
+/** The subset of a NextResponse cookie jar the handshake redeem needs. */
+export interface EdgeCookies {
+    set(name: string, value: string, options?: Record<string, unknown>): void;
+}
+/** A redirect response we can also set first-party cookies on (NextResponse). */
+export interface EdgeRedirect {
+    cookies?: EdgeCookies;
+}
+export interface EdgeResponse {
+    next(): unknown;
+    redirect(url: string | URL): EdgeRedirect;
+    json(body: unknown, init?: {
+        status?: number;
+    }): unknown;
+}
+export interface AuthState {
+    userId: string | null;
+    sessionId: string | null;
+    orgId: string | null;
+    orgRole: string | null;
+    claims: SessionClaims | null;
+}
+export declare const SIGNED_OUT: AuthState;
+/**
+ * Resolve the auth state for a request.
+ *
+ * A token that fails verification produces SIGNED_OUT, never a thrown error. A
+ * middleware that throws takes the whole page down; treating an unverifiable
+ * token as "not signed in" degrades to the sign-in screen, which is what the
+ * user needs anyway.
+ */
+export declare function resolveAuth(backend: AtlasBackend, request: EdgeRequest): Promise<AuthState>;
+export declare function atlasMiddleware(options: AtlasMiddlewareOptions): (request: EdgeRequest, response: EdgeResponse) => Promise<unknown>;
+/**
+ * The `auth()` helper for server components and route handlers.
+ *
+ * Returns a plain state rather than throwing on a signed-out user, because a
+ * server component that renders differently for anonymous visitors is the
+ * normal case, not an error.
+ */
+export declare function createAuthHelper(options: AtlasMiddlewareOptions): (request: EdgeRequest) => Promise<AuthState & {
+    /**
+     * Mirrors `<Protect>`, for gating inside a server component. Full
+     * condition set (permission / role / anyPermission / allPermissions) via
+     * the shared `@atlasauth/authz` primitive — the same one React evaluates, so a
+     * check written for a component behaves identically here.
+     */
+    has(condition?: ProtectCondition): boolean;
+    /**
+     * Assert access, throwing `ForbiddenError` when unmet. With no argument it
+     * asserts signed-in (anonymous access is a bug); with a condition it also
+     * asserts the permission/role, like Clerk's `auth().protect({ permission })`.
+     */
+    protect(condition?: ProtectCondition): asserts this is AuthState & {
+        userId: string;
+    };
+}>;
+export { safeRedirect };

package/dist/middleware.js

@@ -0,0 +1,207 @@
+"use strict";
+Object.defineProperty(exports, "__esModule", { value: true });
+exports.safeRedirect = exports.SIGNED_OUT = void 0;
+exports.resolveAuth = resolveAuth;
+exports.atlasMiddleware = atlasMiddleware;
+exports.createAuthHelper = createAuthHelper;
+const backend_1 = require("@atlasauth/backend");
+const matcher_1 = require("./matcher");
+Object.defineProperty(exports, "safeRedirect", { enumerable: true, get: function () { return matcher_1.safeRedirect; } });
+exports.SIGNED_OUT = {
+    userId: null,
+    sessionId: null,
+    orgId: null,
+    orgRole: null,
+    claims: null,
+};
+function readCookie(header, name) {
+    if (!header)
+        return undefined;
+    for (const part of header.split(';')) {
+        const [key, ...rest] = part.trim().split('=');
+        if (key === name)
+            return rest.join('=');
+    }
+    return undefined;
+}
+/**
+ * Resolve the auth state for a request.
+ *
+ * A token that fails verification produces SIGNED_OUT, never a thrown error. A
+ * middleware that throws takes the whole page down; treating an unverifiable
+ * token as "not signed in" degrades to the sign-in screen, which is what the
+ * user needs anyway.
+ */
+async function resolveAuth(backend, request) {
+    const header = request.headers.get('authorization');
+    const bearer = header?.startsWith('Bearer ') ? header.slice(7) : undefined;
+    const cookie = readCookie(request.headers.get('cookie'), '__session');
+    const token = bearer ?? cookie;
+    if (!token)
+        return exports.SIGNED_OUT;
+    const result = await backend.verify(token);
+    if (!result.ok)
+        return exports.SIGNED_OUT;
+    return {
+        userId: result.claims.sub,
+        sessionId: result.claims.sid,
+        orgId: result.claims.org_id ?? null,
+        orgRole: result.claims.org_role ?? null,
+        claims: result.claims,
+    };
+}
+function atlasMiddleware(options) {
+    const backend = new backend_1.AtlasBackend({
+        jwksUrl: options.jwksUrl,
+        issuer: options.issuer,
+        authorizedParties: options.authorizedParties,
+        fetchImpl: options.fetchImpl,
+    });
+    return async function middleware(request, response) {
+        /**
+         * Cross-domain satellite RETURN: the handshake endpoint bounced the browser
+         * back with `?__atlas_hs=ok&__atlas_hu=<userId>&__atlas_hn=<nonce>`. Exchange
+         * the single-use nonce (server-to-server) for a fresh session and set it as
+         * this property's OWN first-party cookies, then re-enter on a clean URL so
+         * the normal verify path picks up the new `__session`. This is the piece
+         * that makes a truly separate-domain property seamless (a same-registrable-
+         * domain subdomain instead gets a parent-domain cookie straight from the
+         * endpoint and never carries a nonce). Runs before anything else — the
+         * session cookie isn't set yet, so route/auth decisions must wait for it.
+         */
+        if (options.handshake && options.publishableKey && request.url) {
+            const url = new URL(request.url);
+            const hs = url.searchParams.get('__atlas_hs');
+            const userId = url.searchParams.get('__atlas_hu');
+            const nonce = url.searchParams.get('__atlas_hn');
+            if (hs === 'ok' && userId && nonce) {
+                // PKCE proof: redeem only with the verifier we stashed HttpOnly on the
+                // way out (its challenge was bound to this nonce at mint time). Without
+                // it a leaked nonce is inert — so a missing verifier can never redeem.
+                const codeVerifier = readCookie(request.headers.get('cookie'), '__atlas_hv');
+                const fapiOrigin = options.fapiOrigin ?? new URL(options.jwksUrl).origin;
+                const session = codeVerifier
+                    ? await (0, backend_1.redeemHandshake)({
+                        fapiOrigin,
+                        publishableKey: options.publishableKey,
+                        userId,
+                        nonce,
+                        codeVerifier,
+                        fetchImpl: options.fetchImpl,
+                    })
+                    : null;
+                const clean = new URL(url.toString());
+                for (const k of ['__atlas_hs', '__atlas_hu', '__atlas_hn'])
+                    clean.searchParams.delete(k);
+                if (session) {
+                    const res = response.redirect(clean.toString());
+                    res.cookies?.set('__session', session.jwt, { path: '/', sameSite: 'lax', secure: true });
+                    res.cookies?.set('__atlas_rt', session.refreshToken, {
+                        path: '/',
+                        httpOnly: true,
+                        sameSite: 'lax',
+                        secure: true,
+                    });
+                    // The verifier is spent — clear it so it can't be reused or leak.
+                    res.cookies?.set('__atlas_hv', '', { path: '/', maxAge: 0 });
+                    return res;
+                }
+                // A bad/expired/replayed nonce, a rejected PKCE proof, or no verifier →
+                // no session. Carry a SPENT marker (__atlas_hs=failed) instead of a clean
+                // URL: the outbound guard keys off the presence of __atlas_hs, so a clean
+                // URL here would bounce straight back to the handshake forever. With the
+                // marker, normal routing takes over and sends the user to sign-in.
+                clean.searchParams.set('__atlas_hs', 'failed');
+                const res = response.redirect(clean.toString());
+                res.cookies?.set('__atlas_hv', '', { path: '/', maxAge: 0 });
+                return res;
+            }
+        }
+        const auth = await resolveAuth(backend, request);
+        const decision = (0, matcher_1.decideRoute)({
+            pathname: request.nextUrl.pathname,
+            signedIn: auth.userId !== null,
+            config: options,
+            isApiRoute: request.nextUrl.pathname.startsWith('/api/'),
+        });
+        switch (decision.action) {
+            case 'skip':
+            case 'allow':
+                return response.next();
+            case 'unauthorized':
+                return response.json({ errors: [{ code: 'UNAUTHENTICATED' }] }, { status: 401 });
+            case 'redirect': {
+                /**
+                 * Cross-property handshake: before sending a signed-out user to the
+                 * sign-in page, try the Atlas handshake ONCE — they may already have a
+                 * session on a sibling property. The `__atlas_hs` marker the endpoint
+                 * appends on its way back is our loop guard: if it's absent we bounce to
+                 * the handshake; if it's present the handshake already ran (and either
+                 * set a session cookie we'll now verify on re-entry, or reported
+                 * signed_out), so we fall through to the normal sign-in redirect.
+                 */
+                if (options.handshake && options.publishableKey && request.url) {
+                    const current = new URL(request.url);
+                    if (!current.searchParams.has('__atlas_hs')) {
+                        // Generate a PKCE pair: only the challenge rides the (loggable)
+                        // handshake URL; the verifier is stashed HttpOnly and proves
+                        // possession at redeem, so a captured return-URL nonce is inert.
+                        const { verifier, challenge } = await (0, backend_1.createPkcePair)();
+                        const fapiOrigin = options.fapiOrigin ?? new URL(options.jwksUrl).origin;
+                        const hs = new URL('/v1/client/handshake', fapiOrigin);
+                        hs.searchParams.set('publishable_key', options.publishableKey);
+                        hs.searchParams.set('redirect_url', current.toString());
+                        hs.searchParams.set('code_challenge', challenge);
+                        const res = response.redirect(hs.toString());
+                        res.cookies?.set('__atlas_hv', verifier, {
+                            path: '/',
+                            httpOnly: true,
+                            sameSite: 'lax',
+                            secure: true,
+                            maxAge: 300, // the handshake round trip is seconds; don't linger
+                        });
+                        return res;
+                    }
+                }
+                /**
+                 * The redirect target is built from the request's own pathname, not
+                 * from anything a caller supplied — but it still goes through
+                 * `safeRedirect`, because a `redirect_url` already present in the query
+                 * would otherwise be carried forward unchecked (§13.1).
+                 */
+                const base = request.url ? new URL(request.url).origin : '';
+                return response.redirect(`${base}${decision.to}`);
+            }
+        }
+    };
+}
+/**
+ * The `auth()` helper for server components and route handlers.
+ *
+ * Returns a plain state rather than throwing on a signed-out user, because a
+ * server component that renders differently for anonymous visitors is the
+ * normal case, not an error.
+ */
+function createAuthHelper(options) {
+    const backend = new backend_1.AtlasBackend({
+        jwksUrl: options.jwksUrl,
+        issuer: options.issuer,
+        authorizedParties: options.authorizedParties,
+        fetchImpl: options.fetchImpl,
+    });
+    return async function auth(request) {
+        const state = await resolveAuth(backend, request);
+        return {
+            ...state,
+            has(condition = {}) {
+                return (0, backend_1.hasFromClaims)(state.claims, condition);
+            },
+            protect(condition = {}) {
+                const outcome = (0, backend_1.evaluate)(state.claims, condition);
+                if (!outcome.allowed)
+                    throw new backend_1.ForbiddenError(outcome.reason, condition);
+            },
+        };
+    };
+}
+//# sourceMappingURL=middleware.js.map

package/dist/middleware.js.map

@@ -0,0 +1 @@
+{"version":3,"file":"middleware.js","sourceRoot":"","sources":["../src/middleware.ts"],"names":[],"mappings":";;;AAqGA,kCAkBC;AAED,0CAoIC;AASD,4CAsCC;AA5SD,gDAS4B;AAC5B,uCAA6E;AAoSpE,6FApSa,sBAAY,OAoSb;AAlOR,QAAA,UAAU,GAAc;IACnC,MAAM,EAAE,IAAI;IACZ,SAAS,EAAE,IAAI;IACf,KAAK,EAAE,IAAI;IACX,OAAO,EAAE,IAAI;IACb,MAAM,EAAE,IAAI;CACb,CAAC;AAEF,SAAS,UAAU,CAAC,MAAqB,EAAE,IAAY;IACrD,IAAI,CAAC,MAAM;QAAE,OAAO,SAAS,CAAC;IAC9B,KAAK,MAAM,IAAI,IAAI,MAAM,CAAC,KAAK,CAAC,GAAG,CAAC,EAAE,CAAC;QACrC,MAAM,CAAC,GAAG,EAAE,GAAG,IAAI,CAAC,GAAG,IAAI,CAAC,IAAI,EAAE,CAAC,KAAK,CAAC,GAAG,CAAC,CAAC;QAC9C,IAAI,GAAG,KAAK,IAAI;YAAE,OAAO,IAAI,CAAC,IAAI,CAAC,GAAG,CAAC,CAAC;IAC1C,CAAC;IACD,OAAO,SAAS,CAAC;AACnB,CAAC;AAED;;;;;;;GAOG;AACI,KAAK,UAAU,WAAW,CAAC,OAAqB,EAAE,OAAoB;IAC3E,MAAM,MAAM,GAAG,OAAO,CAAC,OAAO,CAAC,GAAG,CAAC,eAAe,CAAC,CAAC;IACpD,MAAM,MAAM,GAAG,MAAM,EAAE,UAAU,CAAC,SAAS,CAAC,CAAC,CAAC,CAAC,MAAM,CAAC,KAAK,CAAC,CAAC,CAAC,CAAC,CAAC,CAAC,SAAS,CAAC;IAC3E,MAAM,MAAM,GAAG,UAAU,CAAC,OAAO,CAAC,OAAO,CAAC,GAAG,CAAC,QAAQ,CAAC,EAAE,WAAW,CAAC,CAAC;IAEtE,MAAM,KAAK,GAAG,MAAM,IAAI,MAAM,CAAC;IAC/B,IAAI,CAAC,KAAK;QAAE,OAAO,kBAAU,CAAC;IAE9B,MAAM,MAAM,GAAG,MAAM,OAAO,CAAC,MAAM,CAAC,KAAK,CAAC,CAAC;IAC3C,IAAI,CAAC,MAAM,CAAC,EAAE;QAAE,OAAO,kBAAU,CAAC;IAElC,OAAO;QACL,MAAM,EAAE,MAAM,CAAC,MAAM,CAAC,GAAG;QACzB,SAAS,EAAE,MAAM,CAAC,MAAM,CAAC,GAAG;QAC5B,KAAK,EAAE,MAAM,CAAC,MAAM,CAAC,MAAM,IAAI,IAAI;QACnC,OAAO,EAAE,MAAM,CAAC,MAAM,CAAC,QAAQ,IAAI,IAAI;QACvC,MAAM,EAAE,MAAM,CAAC,MAAM;KACtB,CAAC;AACJ,CAAC;AAED,SAAgB,eAAe,CAAC,OAA+B;IAC7D,MAAM,OAAO,GAAG,IAAI,sBAAY,CAAC;QAC/B,OAAO,EAAE,OAAO,CAAC,OAAO;QACxB,MAAM,EAAE,OAAO,CAAC,MAAM;QACtB,iBAAiB,EAAE,OAAO,CAAC,iBAAiB;QAC5C,SAAS,EAAE,OAAO,CAAC,SAAS;KAC7B,CAAC,CAAC;IAEH,OAAO,KAAK,UAAU,UAAU,CAAC,OAAoB,EAAE,QAAsB;QAC3E;;;;;;;;;;WAUG;QACH,IAAI,OAAO,CAAC,SAAS,IAAI,OAAO,CAAC,cAAc,IAAI,OAAO,CAAC,GAAG,EAAE,CAAC;YAC/D,MAAM,GAAG,GAAG,IAAI,GAAG,CAAC,OAAO,CAAC,GAAG,CAAC,CAAC;YACjC,MAAM,EAAE,GAAG,GAAG,CAAC,YAAY,CAAC,GAAG,CAAC,YAAY,CAAC,CAAC;YAC9C,MAAM,MAAM,GAAG,GAAG,CAAC,YAAY,CAAC,GAAG,CAAC,YAAY,CAAC,CAAC;YAClD,MAAM,KAAK,GAAG,GAAG,CAAC,YAAY,CAAC,GAAG,CAAC,YAAY,CAAC,CAAC;YACjD,IAAI,EAAE,KAAK,IAAI,IAAI,MAAM,IAAI,KAAK,EAAE,CAAC;gBACnC,uEAAuE;gBACvE,wEAAwE;gBACxE,uEAAuE;gBACvE,MAAM,YAAY,GAAG,UAAU,CAAC,OAAO,CAAC,OAAO,CAAC,GAAG,CAAC,QAAQ,CAAC,EAAE,YAAY,CAAC,CAAC;gBAC7E,MAAM,UAAU,GAAG,OAAO,CAAC,UAAU,IAAI,IAAI,GAAG,CAAC,OAAO,CAAC,OAAO,CAAC,CAAC,MAAM,CAAC;gBACzE,MAAM,OAAO,GAAG,YAAY;oBAC1B,CAAC,CAAC,MAAM,IAAA,yBAAe,EAAC;wBACpB,UAAU;wBACV,cAAc,EAAE,OAAO,CAAC,cAAc;wBACtC,MAAM;wBACN,KAAK;wBACL,YAAY;wBACZ,SAAS,EAAE,OAAO,CAAC,SAAS;qBAC7B,CAAC;oBACJ,CAAC,CAAC,IAAI,CAAC;gBAET,MAAM,KAAK,GAAG,IAAI,GAAG,CAAC,GAAG,CAAC,QAAQ,EAAE,CAAC,CAAC;gBACtC,KAAK,MAAM,CAAC,IAAI,CAAC,YAAY,EAAE,YAAY,EAAE,YAAY,CAAC;oBAAE,KAAK,CAAC,YAAY,CAAC,MAAM,CAAC,CAAC,CAAC,CAAC;gBAEzF,IAAI,OAAO,EAAE,CAAC;oBACZ,MAAM,GAAG,GAAG,QAAQ,CAAC,QAAQ,CAAC,KAAK,CAAC,QAAQ,EAAE,CAAC,CAAC;oBAChD,GAAG,CAAC,OAAO,EAAE,GAAG,CAAC,WAAW,EAAE,OAAO,CAAC,GAAG,EAAE,EAAE,IAAI,EAAE,GAAG,EAAE,QAAQ,EAAE,KAAK,EAAE,MAAM,EAAE,IAAI,EAAE,CAAC,CAAC;oBACzF,GAAG,CAAC,OAAO,EAAE,GAAG,CAAC,YAAY,EAAE,OAAO,CAAC,YAAY,EAAE;wBACnD,IAAI,EAAE,GAAG;wBACT,QAAQ,EAAE,IAAI;wBACd,QAAQ,EAAE,KAAK;wBACf,MAAM,EAAE,IAAI;qBACb,CAAC,CAAC;oBACH,kEAAkE;oBAClE,GAAG,CAAC,OAAO,EAAE,GAAG,CAAC,YAAY,EAAE,EAAE,EAAE,EAAE,IAAI,EAAE,GAAG,EAAE,MAAM,EAAE,CAAC,EAAE,CAAC,CAAC;oBAC7D,OAAO,GAAG,CAAC;gBACb,CAAC;gBAED,wEAAwE;gBACxE,0EAA0E;gBAC1E,0EAA0E;gBAC1E,yEAAyE;gBACzE,mEAAmE;gBACnE,KAAK,CAAC,YAAY,CAAC,GAAG,CAAC,YAAY,EAAE,QAAQ,CAAC,CAAC;gBAC/C,MAAM,GAAG,GAAG,QAAQ,CAAC,QAAQ,CAAC,KAAK,CAAC,QAAQ,EAAE,CAAC,CAAC;gBAChD,GAAG,CAAC,OAAO,EAAE,GAAG,CAAC,YAAY,EAAE,EAAE,EAAE,EAAE,IAAI,EAAE,GAAG,EAAE,MAAM,EAAE,CAAC,EAAE,CAAC,CAAC;gBAC7D,OAAO,GAAG,CAAC;YACb,CAAC;QACH,CAAC;QAED,MAAM,IAAI,GAAG,MAAM,WAAW,CAAC,OAAO,EAAE,OAAO,CAAC,CAAC;QAEjD,MAAM,QAAQ,GAAG,IAAA,qBAAW,EAAC;YAC3B,QAAQ,EAAE,OAAO,CAAC,OAAO,CAAC,QAAQ;YAClC,QAAQ,EAAE,IAAI,CAAC,MAAM,KAAK,IAAI;YAC9B,MAAM,EAAE,OAAO;YACf,UAAU,EAAE,OAAO,CAAC,OAAO,CAAC,QAAQ,CAAC,UAAU,CAAC,OAAO,CAAC;SACzD,CAAC,CAAC;QAEH,QAAQ,QAAQ,CAAC,MAAM,EAAE,CAAC;YACxB,KAAK,MAAM,CAAC;YACZ,KAAK,OAAO;gBACV,OAAO,QAAQ,CAAC,IAAI,EAAE,CAAC;YAEzB,KAAK,cAAc;gBACjB,OAAO,QAAQ,CAAC,IAAI,CAAC,EAAE,MAAM,EAAE,CAAC,EAAE,IAAI,EAAE,iBAAiB,EAAE,CAAC,EAAE,EAAE,EAAE,MAAM,EAAE,GAAG,EAAE,CAAC,CAAC;YAEnF,KAAK,UAAU,CAAC,CAAC,CAAC;gBAChB;;;;;;;;mBAQG;gBACH,IAAI,OAAO,CAAC,SAAS,IAAI,OAAO,CAAC,cAAc,IAAI,OAAO,CAAC,GAAG,EAAE,CAAC;oBAC/D,MAAM,OAAO,GAAG,IAAI,GAAG,CAAC,OAAO,CAAC,GAAG,CAAC,CAAC;oBACrC,IAAI,CAAC,OAAO,CAAC,YAAY,CAAC,GAAG,CAAC,YAAY,CAAC,EAAE,CAAC;wBAC5C,gEAAgE;wBAChE,6DAA6D;wBAC7D,iEAAiE;wBACjE,MAAM,EAAE,QAAQ,EAAE,SAAS,EAAE,GAAG,MAAM,IAAA,wBAAc,GAAE,CAAC;wBACvD,MAAM,UAAU,GAAG,OAAO,CAAC,UAAU,IAAI,IAAI,GAAG,CAAC,OAAO,CAAC,OAAO,CAAC,CAAC,MAAM,CAAC;wBACzE,MAAM,EAAE,GAAG,IAAI,GAAG,CAAC,sBAAsB,EAAE,UAAU,CAAC,CAAC;wBACvD,EAAE,CAAC,YAAY,CAAC,GAAG,CAAC,iBAAiB,EAAE,OAAO,CAAC,cAAc,CAAC,CAAC;wBAC/D,EAAE,CAAC,YAAY,CAAC,GAAG,CAAC,cAAc,EAAE,OAAO,CAAC,QAAQ,EAAE,CAAC,CAAC;wBACxD,EAAE,CAAC,YAAY,CAAC,GAAG,CAAC,gBAAgB,EAAE,SAAS,CAAC,CAAC;wBACjD,MAAM,GAAG,GAAG,QAAQ,CAAC,QAAQ,CAAC,EAAE,CAAC,QAAQ,EAAE,CAAC,CAAC;wBAC7C,GAAG,CAAC,OAAO,EAAE,GAAG,CAAC,YAAY,EAAE,QAAQ,EAAE;4BACvC,IAAI,EAAE,GAAG;4BACT,QAAQ,EAAE,IAAI;4BACd,QAAQ,EAAE,KAAK;4BACf,MAAM,EAAE,IAAI;4BACZ,MAAM,EAAE,GAAG,EAAE,oDAAoD;yBAClE,CAAC,CAAC;wBACH,OAAO,GAAG,CAAC;oBACb,CAAC;gBACH,CAAC;gBACD;;;;;mBAKG;gBACH,MAAM,IAAI,GAAG,OAAO,CAAC,GAAG,CAAC,CAAC,CAAC,IAAI,GAAG,CAAC,OAAO,CAAC,GAAG,CAAC,CAAC,MAAM,CAAC,CAAC,CAAC,EAAE,CAAC;gBAC5D,OAAO,QAAQ,CAAC,QAAQ,CAAC,GAAG,IAAI,GAAG,QAAQ,CAAC,EAAE,EAAE,CAAC,CAAC;YACpD,CAAC;QACH,CAAC;IACH,CAAC,CAAC;AACJ,CAAC;AAED;;;;;;GAMG;AACH,SAAgB,gBAAgB,CAAC,OAA+B;IAC9D,MAAM,OAAO,GAAG,IAAI,sBAAY,CAAC;QAC/B,OAAO,EAAE,OAAO,CAAC,OAAO;QACxB,MAAM,EAAE,OAAO,CAAC,MAAM;QACtB,iBAAiB,EAAE,OAAO,CAAC,iBAAiB;QAC5C,SAAS,EAAE,OAAO,CAAC,SAAS;KAC7B,CAAC,CAAC;IAEH,OAAO,KAAK,UAAU,IAAI,CAAC,OAAoB;QAiB7C,MAAM,KAAK,GAAG,MAAM,WAAW,CAAC,OAAO,EAAE,OAAO,CAAC,CAAC;QAElD,OAAO;YACL,GAAG,KAAK;YACR,GAAG,CAAC,SAAS,GAAG,EAAE;gBAChB,OAAO,IAAA,uBAAa,EAAC,KAAK,CAAC,MAAM,EAAE,SAAS,CAAC,CAAC;YAChD,CAAC;YACD,OAAO,CAAC,YAA8B,EAAE;gBACtC,MAAM,OAAO,GAAG,IAAA,kBAAQ,EAAC,KAAK,CAAC,MAAM,EAAE,SAAS,CAAC,CAAC;gBAClD,IAAI,CAAC,OAAO,CAAC,OAAO;oBAAE,MAAM,IAAI,wBAAc,CAAC,OAAO,CAAC,MAAM,EAAE,SAAS,CAAC,CAAC;YAC5E,CAAC;SACF,CAAC;IACJ,CAAC,CAAC;AACJ,CAAC"}

package/package.json

@@ -0,0 +1,26 @@
+{
+  "name": "@atlasauth/nextjs",
+  "version": "0.1.0",
+  "main": "./dist/index.js",
+  "types": "./dist/index.d.ts",
+  "dependencies": {
+    "@atlasauth/backend": "0.1.0"
+  },
+  "devDependencies": {
+    "typescript": "^5.6.3",
+    "vitest": "^2.1.4",
+    "jose": "^5.9.6"
+  },
+  "publishConfig": {
+    "access": "public"
+  },
+  "files": [
+    "dist",
+    "README.md"
+  ],
+  "scripts": {
+    "build": "tsc -p tsconfig.build.json",
+    "typecheck": "tsc -p tsconfig.json --noEmit",
+    "test": "vitest run"
+  }
+}