@becklyn/deployment-protection 0.0.1 → 0.1.0

package/dist/cjs/handler.d.ts.map

@@ -1 +1 @@
-{"version":3,"file":"handler.d.ts","sourceRoot":"","sources":["../../src/handler.ts"],"names":[],"mappings":"AAiBA,OAAO,KAAK,EAA8B,2BAA2B,EAAE,MAAM,SAAS,CAAC;AA2OvF;;GAEG;AACH,wBAAsB,0BAA0B,CAC5C,OAAO,EAAE,OAAO,EAChB,OAAO,GAAE,2BAAgC,GAC1C,OAAO,CAAC,QAAQ,GAAG,IAAI,CAAC,CAqD1B"}
+{"version":3,"file":"handler.d.ts","sourceRoot":"","sources":["../../src/handler.ts"],"names":[],"mappings":"AAiBA,OAAO,KAAK,EAA8B,2BAA2B,EAAE,MAAM,SAAS,CAAC;AA6OvF;;GAEG;AACH,wBAAsB,0BAA0B,CAC5C,OAAO,EAAE,OAAO,EAChB,OAAO,GAAE,2BAAgC,GAC1C,OAAO,CAAC,QAAQ,GAAG,IAAI,CAAC,CAqD1B"}

package/dist/cjs/handler.js

@@ -25,11 +25,13 @@ function htmlResponse(html, status = 401) {
         },
     });
 }
-function redirect(location, status = 302) {
+function redirect(request, location, status = 302) {
+    // Next.js middleware/proxy requires an absolute Location; relative values throw ERR_INVALID_URL.
+    const absoluteLocation = new URL(location, request.url).toString();
     return new Response(null, {
         status,
         headers: {
-            Location: location,
+            Location: absoluteLocation,
             "Cache-Control": "no-store",
         },
     });
@@ -58,7 +60,7 @@ async function handleBypass(request, config) {
     if (hadQueryBypass || hadSetCookieQuery || setCookieMode) {
         url.searchParams.delete(constants_1.BYPASS_HEADER);
         url.searchParams.delete("x-vercel-set-bypass-cookie");
-        const response = redirect(url.pathname + url.search + url.hash);
+        const response = redirect(request, url.pathname + url.search + url.hash);
         const secure = isSecureRequest(request);
         if (setCookieMode || hadSetCookieQuery) {
             (0, vercel_oauth_1.appendSetCookie)(response, constants_1.BYPASS_COOKIE_NAME, config.bypassSecret, {
@@ -104,7 +106,7 @@ async function handlePasswordPost(request, config) {
             showVercel: (0, config_1.hasVercelAuth)(config),
         }));
     }
-    const response = redirect(returnTo);
+    const response = redirect(request, returnTo);
     return attachSession(response, config, "password", username, isSecureRequest(request));
 }
 async function handleVercelAuthorize(request, config) {
@@ -152,7 +154,7 @@ async function handleVercelCallback(request, config) {
         }
         const user = await (0, vercel_oauth_1.fetchVercelUserInfo)(tokenData.access_token);
         const subject = user.preferred_username || user.email || user.sub || "vercel-user";
-        const response = redirect(returnTo);
+        const response = redirect(request, returnTo);
         (0, vercel_oauth_1.clearOAuthCookies)(response, secure);
         return attachSession(response, config, "vercel", subject, secure);
     }

package/dist/cjs/middleware.d.ts.map

@@ -1 +1 @@
-{"version":3,"file":"middleware.d.ts","sourceRoot":"","sources":["../../src/middleware.ts"],"names":[],"mappings":"AAAA,OAAO,EAAE,KAAK,WAAW,EAAE,YAAY,EAAE,MAAM,aAAa,CAAC;AAC7D,OAAO,EAAE,2BAA2B,EAAE,MAAM,aAAa,CAAC;AAE1D,OAAO,KAAK,EAAE,2BAA2B,EAAE,MAAM,SAAS,CAAC;AAE3D,KAAK,cAAc,GAAG,CAClB,OAAO,EAAE,WAAW,EACpB,KAAK,CAAC,EAAE,OAAO,KAEb,QAAQ,GACR,YAAY,GACZ,OAAO,CAAC,QAAQ,GAAG,YAAY,GAAG,SAAS,GAAG,IAAI,CAAC,GACnD,SAAS,GACT,IAAI,CAAC;AAEX,MAAM,MAAM,4BAA4B,GAClC,EAAE,GACF,CAAC,2BAA2B,CAAC,GAC7B,CAAC,cAAc,CAAC,GAChB,CAAC,cAAc,EAAE,2BAA2B,CAAC,CAAC;AAWpD;;;;;;;;;;;;;;;;GAgBG;AACH,wBAAgB,wBAAwB,CAAC,GAAG,IAAI,EAAE,4BAA4B,IAgBtE,SAAS,WAAW,EACpB,QAAQ,OAAO,KAChB,OAAO,CAAC,QAAQ,GAAG,YAAY,CAAC,CAmBtC;AAED,OAAO,EAAE,2BAA2B,EAAE,CAAC"}
+{"version":3,"file":"middleware.d.ts","sourceRoot":"","sources":["../../src/middleware.ts"],"names":[],"mappings":"AAAA,OAAO,EAAE,KAAK,WAAW,EAAE,YAAY,EAAE,MAAM,aAAa,CAAC;AAC7D,OAAO,EAAE,2BAA2B,EAAE,MAAM,aAAa,CAAC;AAE1D,OAAO,KAAK,EAAE,2BAA2B,EAAE,MAAM,SAAS,CAAC;AAE3D,KAAK,cAAc,GAAG,CAClB,OAAO,EAAE,WAAW,EACpB,KAAK,CAAC,EAAE,OAAO,KAEb,QAAQ,GACR,YAAY,GACZ,OAAO,CAAC,QAAQ,GAAG,YAAY,GAAG,SAAS,GAAG,IAAI,CAAC,GACnD,SAAS,GACT,IAAI,CAAC;AAEX,MAAM,MAAM,4BAA4B,GAClC,EAAE,GACF,CAAC,2BAA2B,CAAC,GAC7B,CAAC,cAAc,CAAC,GAChB,CAAC,cAAc,EAAE,2BAA2B,CAAC,CAAC;AA8DpD;;;;;;;;;;;;;;;;GAgBG;AACH,wBAAgB,wBAAwB,CAAC,GAAG,IAAI,EAAE,4BAA4B,IAgBtE,SAAS,WAAW,EACpB,QAAQ,OAAO,KAChB,OAAO,CAAC,QAAQ,GAAG,YAAY,CAAC,CActC;AAED,OAAO,EAAE,2BAA2B,EAAE,CAAC"}

package/dist/cjs/middleware.js

@@ -12,6 +12,43 @@ function isOptions(value) {
         !Array.isArray(value) &&
         typeof value !== "function");
 }
+function toNextResponse(request, response) {
+    const location = response.headers.get("Location");
+    if (location && response.status >= 300 && response.status < 400) {
+        // Always resolve against the incoming request so relative Locations never reach Next.
+        const redirectResponse = server_1.NextResponse.redirect(new URL(location, request.url), response.status);
+        copyHeaders(response, redirectResponse, /* skipLocation */ true);
+        return redirectResponse;
+    }
+    const nextResponse = new server_1.NextResponse(response.body, {
+        status: response.status,
+        statusText: response.statusText,
+    });
+    copyHeaders(response, nextResponse, false);
+    return nextResponse;
+}
+function copyHeaders(from, to, skipLocation) {
+    const setCookies = typeof from.headers.getSetCookie === "function" ? from.headers.getSetCookie() : [];
+    if (setCookies.length > 0) {
+        for (const cookie of setCookies) {
+            to.headers.append("Set-Cookie", cookie);
+        }
+    }
+    from.headers.forEach((value, key) => {
+        const lower = key.toLowerCase();
+        if (lower === "set-cookie") {
+            // Already copied via getSetCookie when available; fall back otherwise.
+            if (setCookies.length === 0) {
+                to.headers.append("Set-Cookie", value);
+            }
+            return;
+        }
+        if (skipLocation && lower === "location") {
+            return;
+        }
+        to.headers.set(key, value);
+    });
+}
 /**
  * Next.js middleware / proxy wrapper.
  *
@@ -47,12 +84,7 @@ function withDeploymentProtection(...args) {
     return async function deploymentProtectionMiddleware(request, event) {
         const protectionResponse = await (0, handler_1.handleDeploymentProtection)(request, options);
         if (protectionResponse) {
-            // Preserve NextResponse subclass when possible
-            return new server_1.NextResponse(protectionResponse.body, {
-                status: protectionResponse.status,
-                statusText: protectionResponse.statusText,
-                headers: protectionResponse.headers,
-            });
+            return toNextResponse(request, protectionResponse);
         }
         if (next) {
             const result = await next(request, event);

package/dist/es/handler.d.ts.map

@@ -1 +1 @@
-{"version":3,"file":"handler.d.ts","sourceRoot":"","sources":["../../src/handler.ts"],"names":[],"mappings":"AAiBA,OAAO,KAAK,EAA8B,2BAA2B,EAAE,MAAM,SAAS,CAAC;AA2OvF;;GAEG;AACH,wBAAsB,0BAA0B,CAC5C,OAAO,EAAE,OAAO,EAChB,OAAO,GAAE,2BAAgC,GAC1C,OAAO,CAAC,QAAQ,GAAG,IAAI,CAAC,CAqD1B"}
+{"version":3,"file":"handler.d.ts","sourceRoot":"","sources":["../../src/handler.ts"],"names":[],"mappings":"AAiBA,OAAO,KAAK,EAA8B,2BAA2B,EAAE,MAAM,SAAS,CAAC;AA6OvF;;GAEG;AACH,wBAAsB,0BAA0B,CAC5C,OAAO,EAAE,OAAO,EAChB,OAAO,GAAE,2BAAgC,GAC1C,OAAO,CAAC,QAAQ,GAAG,IAAI,CAAC,CAqD1B"}

package/dist/es/handler.js

@@ -22,11 +22,13 @@ function htmlResponse(html, status = 401) {
         },
     });
 }
-function redirect(location, status = 302) {
+function redirect(request, location, status = 302) {
+    // Next.js middleware/proxy requires an absolute Location; relative values throw ERR_INVALID_URL.
+    const absoluteLocation = new URL(location, request.url).toString();
     return new Response(null, {
         status,
         headers: {
-            Location: location,
+            Location: absoluteLocation,
             "Cache-Control": "no-store",
         },
     });
@@ -55,7 +57,7 @@ async function handleBypass(request, config) {
     if (hadQueryBypass || hadSetCookieQuery || setCookieMode) {
         url.searchParams.delete(BYPASS_HEADER);
         url.searchParams.delete("x-vercel-set-bypass-cookie");
-        const response = redirect(url.pathname + url.search + url.hash);
+        const response = redirect(request, url.pathname + url.search + url.hash);
         const secure = isSecureRequest(request);
         if (setCookieMode || hadSetCookieQuery) {
             appendSetCookie(response, BYPASS_COOKIE_NAME, config.bypassSecret, {
@@ -101,7 +103,7 @@ async function handlePasswordPost(request, config) {
             showVercel: hasVercelAuth(config),
         }));
     }
-    const response = redirect(returnTo);
+    const response = redirect(request, returnTo);
     return attachSession(response, config, "password", username, isSecureRequest(request));
 }
 async function handleVercelAuthorize(request, config) {
@@ -149,7 +151,7 @@ async function handleVercelCallback(request, config) {
         }
         const user = await fetchVercelUserInfo(tokenData.access_token);
         const subject = user.preferred_username || user.email || user.sub || "vercel-user";
-        const response = redirect(returnTo);
+        const response = redirect(request, returnTo);
         clearOAuthCookies(response, secure);
         return attachSession(response, config, "vercel", subject, secure);
     }

package/dist/es/middleware.d.ts.map

@@ -1 +1 @@
-{"version":3,"file":"middleware.d.ts","sourceRoot":"","sources":["../../src/middleware.ts"],"names":[],"mappings":"AAAA,OAAO,EAAE,KAAK,WAAW,EAAE,YAAY,EAAE,MAAM,aAAa,CAAC;AAC7D,OAAO,EAAE,2BAA2B,EAAE,MAAM,aAAa,CAAC;AAE1D,OAAO,KAAK,EAAE,2BAA2B,EAAE,MAAM,SAAS,CAAC;AAE3D,KAAK,cAAc,GAAG,CAClB,OAAO,EAAE,WAAW,EACpB,KAAK,CAAC,EAAE,OAAO,KAEb,QAAQ,GACR,YAAY,GACZ,OAAO,CAAC,QAAQ,GAAG,YAAY,GAAG,SAAS,GAAG,IAAI,CAAC,GACnD,SAAS,GACT,IAAI,CAAC;AAEX,MAAM,MAAM,4BAA4B,GAClC,EAAE,GACF,CAAC,2BAA2B,CAAC,GAC7B,CAAC,cAAc,CAAC,GAChB,CAAC,cAAc,EAAE,2BAA2B,CAAC,CAAC;AAWpD;;;;;;;;;;;;;;;;GAgBG;AACH,wBAAgB,wBAAwB,CAAC,GAAG,IAAI,EAAE,4BAA4B,IAgBtE,SAAS,WAAW,EACpB,QAAQ,OAAO,KAChB,OAAO,CAAC,QAAQ,GAAG,YAAY,CAAC,CAmBtC;AAED,OAAO,EAAE,2BAA2B,EAAE,CAAC"}
+{"version":3,"file":"middleware.d.ts","sourceRoot":"","sources":["../../src/middleware.ts"],"names":[],"mappings":"AAAA,OAAO,EAAE,KAAK,WAAW,EAAE,YAAY,EAAE,MAAM,aAAa,CAAC;AAC7D,OAAO,EAAE,2BAA2B,EAAE,MAAM,aAAa,CAAC;AAE1D,OAAO,KAAK,EAAE,2BAA2B,EAAE,MAAM,SAAS,CAAC;AAE3D,KAAK,cAAc,GAAG,CAClB,OAAO,EAAE,WAAW,EACpB,KAAK,CAAC,EAAE,OAAO,KAEb,QAAQ,GACR,YAAY,GACZ,OAAO,CAAC,QAAQ,GAAG,YAAY,GAAG,SAAS,GAAG,IAAI,CAAC,GACnD,SAAS,GACT,IAAI,CAAC;AAEX,MAAM,MAAM,4BAA4B,GAClC,EAAE,GACF,CAAC,2BAA2B,CAAC,GAC7B,CAAC,cAAc,CAAC,GAChB,CAAC,cAAc,EAAE,2BAA2B,CAAC,CAAC;AA8DpD;;;;;;;;;;;;;;;;GAgBG;AACH,wBAAgB,wBAAwB,CAAC,GAAG,IAAI,EAAE,4BAA4B,IAgBtE,SAAS,WAAW,EACpB,QAAQ,OAAO,KAChB,OAAO,CAAC,QAAQ,GAAG,YAAY,CAAC,CActC;AAED,OAAO,EAAE,2BAA2B,EAAE,CAAC"}

package/dist/es/middleware.js

@@ -7,6 +7,43 @@ function isOptions(value) {
         !Array.isArray(value) &&
         typeof value !== "function");
 }
+function toNextResponse(request, response) {
+    const location = response.headers.get("Location");
+    if (location && response.status >= 300 && response.status < 400) {
+        // Always resolve against the incoming request so relative Locations never reach Next.
+        const redirectResponse = NextResponse.redirect(new URL(location, request.url), response.status);
+        copyHeaders(response, redirectResponse, /* skipLocation */ true);
+        return redirectResponse;
+    }
+    const nextResponse = new NextResponse(response.body, {
+        status: response.status,
+        statusText: response.statusText,
+    });
+    copyHeaders(response, nextResponse, false);
+    return nextResponse;
+}
+function copyHeaders(from, to, skipLocation) {
+    const setCookies = typeof from.headers.getSetCookie === "function" ? from.headers.getSetCookie() : [];
+    if (setCookies.length > 0) {
+        for (const cookie of setCookies) {
+            to.headers.append("Set-Cookie", cookie);
+        }
+    }
+    from.headers.forEach((value, key) => {
+        const lower = key.toLowerCase();
+        if (lower === "set-cookie") {
+            // Already copied via getSetCookie when available; fall back otherwise.
+            if (setCookies.length === 0) {
+                to.headers.append("Set-Cookie", value);
+            }
+            return;
+        }
+        if (skipLocation && lower === "location") {
+            return;
+        }
+        to.headers.set(key, value);
+    });
+}
 /**
  * Next.js middleware / proxy wrapper.
  *
@@ -42,12 +79,7 @@ export function withDeploymentProtection(...args) {
     return async function deploymentProtectionMiddleware(request, event) {
         const protectionResponse = await handleDeploymentProtection(request, options);
         if (protectionResponse) {
-            // Preserve NextResponse subclass when possible
-            return new NextResponse(protectionResponse.body, {
-                status: protectionResponse.status,
-                statusText: protectionResponse.statusText,
-                headers: protectionResponse.headers,
-            });
+            return toNextResponse(request, protectionResponse);
         }
         if (next) {
             const result = await next(request, event);

package/package.json

@@ -1,6 +1,6 @@
 {
     "name": "@becklyn/deployment-protection",
-    "version": "0.0.1",
+    "version": "0.1.0",
     "license": "MIT",
     "description": "Simple shared username/password + Sign in with Vercel gate for Next.js deployments",
     "homepage": "https://github.com/Becklyn-Studios/ts-libs/tree/main/packages/deployment-protection",
@@ -18,10 +18,10 @@
     "devDependencies": {
         "@becklyn/eslint": "*",
         "@becklyn/tsconfig": "*",
-        "@types/node": "^26.2.0",
-        "next": "^16.3.1",
+        "@types/node": "^25.9.5",
+        "next": "^16.3.0",
         "typescript": "^5.9.3",
-        "vitest": "^4.1.11"
+        "vitest": "^3.2.4"
     },
     "peerDependencies": {
         "next": "^14.0.0 || ^15.0.0 || ^16.0.0"