@becklyn/deployment-protection 0.0.1

package/LICENSE

@@ -0,0 +1,21 @@
+MIT License
+
+Copyright (c) 2024 Becklyn Studios
+
+Permission is hereby granted, free of charge, to any person obtaining a copy
+of this software and associated documentation files (the "Software"), to deal
+in the Software without restriction, including without limitation the rights
+to use, copy, modify, merge, publish, distribute, sublicense, and/or sell
+copies of the Software, and to permit persons to whom the Software is
+furnished to do so, subject to the following conditions:
+
+The above copyright notice and this permission notice shall be included in all
+copies or substantial portions of the Software.
+
+THE SOFTWARE IS PROVIDED "AS IS", WITHOUT WARRANTY OF ANY KIND, EXPRESS OR
+IMPLIED, INCLUDING BUT NOT LIMITED TO THE WARRANTIES OF MERCHANTABILITY,
+FITNESS FOR A PARTICULAR PURPOSE AND NONINFRINGEMENT. IN NO EVENT SHALL THE
+AUTHORS OR COPYRIGHT HOLDERS BE LIABLE FOR ANY CLAIM, DAMAGES OR OTHER
+LIABILITY, WHETHER IN AN ACTION OF CONTRACT, TORT OR OTHERWISE, ARISING FROM,
+OUT OF OR IN CONNECTION WITH THE SOFTWARE OR THE USE OR OTHER DEALINGS IN THE
+SOFTWARE.

package/README.md

@@ -0,0 +1,158 @@
+# `@becklyn/deployment-protection`
+
+Simple, shared deployment gate for Next.js apps on Vercel.
+
+Use this instead of (or after disabling) Vercel platform Deployment Protection when you need:
+
+- a **shared username/password** from env vars
+- optional **Sign in with Vercel** for team members
+- always-on **automation bypass** via `x-vercel-protection-bypass` / `VERCEL_AUTOMATION_BYPASS_SECRET`
+- a kill switch (`DEPLOYMENT_PROTECTION_ENABLED`, on by default)
+
+Protection runs in Next.js **middleware** (Next ≤15) or **proxy** (Next 16+).
+
+> **Note:** Vercel Connect is unrelated (third-party API tokens). Platform Vercel Authentication cookies are not visible to your app once platform protection is off — team members use the **Sign in with Vercel** button instead.
+
+## Install
+
+```bash
+npm i @becklyn/deployment-protection
+```
+
+## Quick setup
+
+### 1. Middleware / proxy
+
+**Next.js 16+ (`proxy.ts`):**
+
+```ts
+import {
+    deploymentProtectionMatcher,
+    withDeploymentProtection,
+} from "@becklyn/deployment-protection";
+
+export const proxy = withDeploymentProtection();
+
+export const config = {
+    matcher: deploymentProtectionMatcher,
+};
+```
+
+**Next.js ≤15 (`middleware.ts`):**
+
+```ts
+import {
+    deploymentProtectionMatcher,
+    withDeploymentProtection,
+} from "@becklyn/deployment-protection";
+
+export default withDeploymentProtection();
+
+export const config = {
+    matcher: deploymentProtectionMatcher,
+};
+```
+
+Compose with existing middleware:
+
+```ts
+export default withDeploymentProtection(async request => {
+    // your logic…
+    return NextResponse.next();
+});
+```
+
+### 2. Environment variables
+
+| Variable                                     | Required          | Default                   | Description                                            |
+| -------------------------------------------- | ----------------- | ------------------------- | ------------------------------------------------------ |
+| `DEPLOYMENT_PROTECTION_ENABLED`              | no                | `true`                    | Set `false` / `0` / `off` to disable                   |
+| `DEPLOYMENT_PROTECTION_USERNAME`             | for password auth | —                         | Shared username                                        |
+| `DEPLOYMENT_PROTECTION_PASSWORD`             | for password auth | —                         | Shared password                                        |
+| `DEPLOYMENT_PROTECTION_SECRET`               | recommended       | derived from user+pass    | HMAC secret for session cookies                        |
+| `VERCEL_AUTOMATION_BYPASS_SECRET`            | no                | —                         | Same secret as Vercel Protection Bypass for Automation |
+| `DEPLOYMENT_PROTECTION_VERCEL_CLIENT_ID`     | for Vercel login  | —                         | Or `NEXT_PUBLIC_VERCEL_APP_CLIENT_ID`                  |
+| `DEPLOYMENT_PROTECTION_VERCEL_CLIENT_SECRET` | for Vercel login  | —                         | Or `VERCEL_APP_CLIENT_SECRET`                          |
+| `DEPLOYMENT_PROTECTION_FORM_TITLE`           | no                | `Authentication required` | Login heading                                          |
+| `DEPLOYMENT_PROTECTION_FORM_DESCRIPTION`     | no                | …                         | Login description                                      |
+
+At least one of password auth, Vercel OAuth, or a bypass secret must be configured while enabled. If nothing is configured, the gate stays inactive (fail-open) so local dev is not bricked.
+
+### 3. Sign in with Vercel (optional)
+
+1. Create a [Sign in with Vercel](https://vercel.com/docs/sign-in-with-vercel) app in the Vercel dashboard.
+2. Generate a client secret.
+3. Add authorization callback URLs for each project host, pointing at:
+
+    ```text
+    https://<your-host>/_becklyn/deployment-protection/vercel/callback
+    http://localhost:3000/_becklyn/deployment-protection/vercel/callback
+    ```
+
+    You can attach the path to preview + production domains of each project from the dashboard.
+
+4. Set client id/secret env vars on the project(s). Prefer team-level shared env values.
+
+Scopes used: `openid email profile`.
+
+### 4. Automation bypass
+
+Matches Vercel’s Protection Bypass for Automation:
+
+```http
+GET /api/health
+x-vercel-protection-bypass: <VERCEL_AUTOMATION_BYPASS_SECRET>
+```
+
+Or query:
+
+```text
+https://app.example/?x-vercel-protection-bypass=<secret>&x-vercel-set-bypass-cookie=true
+```
+
+When platform Deployment Protection is disabled, **this package** enforces the bypass secret so CI/Playwright keep working the same way.
+
+## Behaviour
+
+1. Disabled / misconfigured → pass through
+2. Internal Vercel OAuth routes → handled by the package
+3. Login form `POST` → validate username/password, set signed HttpOnly session cookie
+4. Valid bypass header/query/cookie → allow (optionally set cookies)
+5. Valid session cookie → allow
+6. Else → HTML login page (password and/or Sign in with Vercel)
+
+Session cookie: `__becklyn_dp_session` (HMAC-SHA256, 14 days by default).
+
+## Disable without code changes
+
+```bash
+DEPLOYMENT_PROTECTION_ENABLED=false
+```
+
+Redeploy. Middleware stays installed but is a no-op.
+
+## API
+
+```ts
+import {
+    deploymentProtectionMatcher,
+    handleDeploymentProtection,
+    resolveConfig,
+    withDeploymentProtection,
+} from "@becklyn/deployment-protection";
+```
+
+- `withDeploymentProtection(options?)` / `withDeploymentProtection(next, options?)` — middleware/proxy factory
+- `handleDeploymentProtection(request, options?)` — framework-agnostic core (`null` = continue)
+- `deploymentProtectionMatcher` — recommended matcher array
+
+## Security notes
+
+- This is a **shared-secret gate**, not per-user product auth.
+- Prefer a dedicated `DEPLOYMENT_PROTECTION_SECRET` in production.
+- Turn off paid Vercel Password Protection / seat-heavy sharing once this is live; keep `VERCEL_AUTOMATION_BYPASS_SECRET` configured for tooling.
+- Middleware is a convenience edge check — do not treat it as the only control for highly sensitive data.
+
+## License
+
+MIT

package/dist/cjs/bypass.d.ts

@@ -0,0 +1,5 @@
+export declare function readBypassToken(request: Request): string | null;
+export declare function readBypassCookie(request: Request): string | null;
+export declare function isValidBypass(provided: string | null | undefined, secret: string | null): Promise<boolean>;
+export declare function shouldSetBypassCookie(request: Request): boolean | "samesitenone";
+//# sourceMappingURL=bypass.d.ts.map

package/dist/cjs/bypass.d.ts.map

@@ -0,0 +1 @@
+{"version":3,"file":"bypass.d.ts","sourceRoot":"","sources":["../../src/bypass.ts"],"names":[],"mappings":"AAGA,wBAAgB,eAAe,CAAC,OAAO,EAAE,OAAO,GAAG,MAAM,GAAG,IAAI,CAe/D;AAED,wBAAgB,gBAAgB,CAAC,OAAO,EAAE,OAAO,GAAG,MAAM,GAAG,IAAI,CAehE;AAED,wBAAsB,aAAa,CAC/B,QAAQ,EAAE,MAAM,GAAG,IAAI,GAAG,SAAS,EACnC,MAAM,EAAE,MAAM,GAAG,IAAI,GACtB,OAAO,CAAC,OAAO,CAAC,CAMlB;AAED,wBAAgB,qBAAqB,CAAC,OAAO,EAAE,OAAO,GAAG,OAAO,GAAG,cAAc,CAehF"}

package/dist/cjs/bypass.js

@@ -0,0 +1,51 @@
+"use strict";
+Object.defineProperty(exports, "__esModule", { value: true });
+exports.readBypassToken = readBypassToken;
+exports.readBypassCookie = readBypassCookie;
+exports.isValidBypass = isValidBypass;
+exports.shouldSetBypassCookie = shouldSetBypassCookie;
+const constants_1 = require("./constants");
+const crypto_1 = require("./crypto");
+function readBypassToken(request) {
+    const header = request.headers.get(constants_1.BYPASS_HEADER)?.trim();
+    if (header) {
+        return header;
+    }
+    const url = new URL(request.url);
+    const query = url.searchParams.get(constants_1.BYPASS_HEADER)?.trim();
+    if (query) {
+        return query;
+    }
+    return null;
+}
+function readBypassCookie(request) {
+    const cookieHeader = request.headers.get("cookie");
+    if (!cookieHeader) {
+        return null;
+    }
+    for (const part of cookieHeader.split(";")) {
+        const [rawName, ...rest] = part.trim().split("=");
+        if (rawName === constants_1.BYPASS_COOKIE_NAME) {
+            return decodeURIComponent(rest.join("="));
+        }
+    }
+    return null;
+}
+async function isValidBypass(provided, secret) {
+    if (!provided || !secret) {
+        return false;
+    }
+    return (0, crypto_1.timingSafeEqualString)(provided, secret);
+}
+function shouldSetBypassCookie(request) {
+    const url = new URL(request.url);
+    const value = request.headers.get(constants_1.SET_BYPASS_COOKIE_HEADER) ??
+        url.searchParams.get(constants_1.SET_BYPASS_COOKIE_HEADER);
+    if (!value) {
+        return false;
+    }
+    if (value.toLowerCase() === "samesitenone") {
+        return "samesitenone";
+    }
+    return value === "true" || value === "1";
+}

package/dist/cjs/config.d.ts

@@ -0,0 +1,13 @@
+import type { DeploymentProtectionConfig, DeploymentProtectionOptions } from "./types";
+/**
+ * Resolve runtime configuration from env (+ optional overrides).
+ */
+export declare function resolveConfig(options?: DeploymentProtectionOptions): DeploymentProtectionConfig;
+export declare function hasPasswordAuth(config: DeploymentProtectionConfig): boolean;
+export declare function hasVercelAuth(config: DeploymentProtectionConfig): boolean;
+/**
+ * Protection only runs when enabled and at least one auth method is configured.
+ * Misconfigured+enabled is treated as inactive (fail-open) so local/dev isn't bricked.
+ */
+export declare function isProtectionActive(config: DeploymentProtectionConfig): boolean;
+//# sourceMappingURL=config.d.ts.map

package/dist/cjs/config.d.ts.map

@@ -0,0 +1 @@
+{"version":3,"file":"config.d.ts","sourceRoot":"","sources":["../../src/config.ts"],"names":[],"mappings":"AAAA,OAAO,KAAK,EAAE,0BAA0B,EAAE,2BAA2B,EAAU,MAAM,SAAS,CAAC;AA0B/F;;GAEG;AACH,wBAAgB,aAAa,CACzB,OAAO,GAAE,2BAAgC,GAC1C,0BAA0B,CA6C5B;AAED,wBAAgB,eAAe,CAAC,MAAM,EAAE,0BAA0B,GAAG,OAAO,CAE3E;AAED,wBAAgB,aAAa,CAAC,MAAM,EAAE,0BAA0B,GAAG,OAAO,CAEzE;AAED;;;GAGG;AACH,wBAAgB,kBAAkB,CAAC,MAAM,EAAE,0BAA0B,GAAG,OAAO,CAK9E"}

package/dist/cjs/config.js

@@ -0,0 +1,68 @@
+"use strict";
+Object.defineProperty(exports, "__esModule", { value: true });
+exports.resolveConfig = resolveConfig;
+exports.hasPasswordAuth = hasPasswordAuth;
+exports.hasVercelAuth = hasVercelAuth;
+exports.isProtectionActive = isProtectionActive;
+const FALSEY = new Set(["0", "false", "no", "off"]);
+function read(env, ...keys) {
+    for (const key of keys) {
+        const value = env[key]?.trim();
+        if (value) {
+            return value;
+        }
+    }
+    return null;
+}
+function isEnabled(env) {
+    const raw = read(env, "DEPLOYMENT_PROTECTION_ENABLED");
+    if (!raw) {
+        return true;
+    }
+    return !FALSEY.has(raw.toLowerCase());
+}
+/**
+ * Resolve runtime configuration from env (+ optional overrides).
+ */
+function resolveConfig(options = {}) {
+    const env = {
+        ...(typeof process !== "undefined" ? process.env : {}),
+        ...options.env,
+    };
+    const username = read(env, "DEPLOYMENT_PROTECTION_USERNAME");
+    const password = read(env, "DEPLOYMENT_PROTECTION_PASSWORD");
+    const explicitSecret = read(env, "DEPLOYMENT_PROTECTION_SECRET");
+    // Prefer an explicit secret; otherwise derive a stable key from credentials so
+    // projects can stay zero-config beyond username/password.
+    const secret = explicitSecret ?? (username && password ? `dp:${username}:${password}` : null);
+    return {
+        enabled: isEnabled(env),
+        username,
+        password,
+        secret,
+        bypassSecret: read(env, "VERCEL_AUTOMATION_BYPASS_SECRET", "DEPLOYMENT_PROTECTION_BYPASS_SECRET"),
+        vercelClientId: read(env, "DEPLOYMENT_PROTECTION_VERCEL_CLIENT_ID", "NEXT_PUBLIC_VERCEL_APP_CLIENT_ID", "VERCEL_APP_CLIENT_ID"),
+        vercelClientSecret: read(env, "DEPLOYMENT_PROTECTION_VERCEL_CLIENT_SECRET", "VERCEL_APP_CLIENT_SECRET"),
+        sessionTtlSeconds: options.sessionTtlSeconds ?? 60 * 60 * 24 * 14,
+        formTitle: options.form?.title ??
+            read(env, "DEPLOYMENT_PROTECTION_FORM_TITLE") ??
+            "Authentication required",
+        formDescription: options.form?.description ??
+            read(env, "DEPLOYMENT_PROTECTION_FORM_DESCRIPTION") ??
+            "Enter the shared credentials to continue.",
+    };
+}
+function hasPasswordAuth(config) {
+    return Boolean(config.username && config.password && config.secret);
+}
+function hasVercelAuth(config) {
+    return Boolean(config.vercelClientId && config.vercelClientSecret && config.secret);
+}
+/**
+ * Protection only runs when enabled and at least one auth method is configured.
+ * Misconfigured+enabled is treated as inactive (fail-open) so local/dev isn't bricked.
+ */
+function isProtectionActive(config) {
+    return (config.enabled &&
+        (hasPasswordAuth(config) || hasVercelAuth(config) || Boolean(config.bypassSecret)));
+}

package/dist/cjs/constants.d.ts

@@ -0,0 +1,15 @@
+export declare const SESSION_COOKIE_NAME = "__becklyn_dp_session";
+export declare const BYPASS_COOKIE_NAME = "__becklyn_dp_bypass";
+export declare const OAUTH_STATE_COOKIE = "__becklyn_dp_oauth_state";
+export declare const OAUTH_NONCE_COOKIE = "__becklyn_dp_oauth_nonce";
+export declare const OAUTH_VERIFIER_COOKIE = "__becklyn_dp_oauth_verifier";
+export declare const OAUTH_RETURN_COOKIE = "__becklyn_dp_oauth_return";
+export declare const INTERNAL_PATH_PREFIX = "/_becklyn/deployment-protection";
+export declare const VERCEL_AUTHORIZE_PATH = "/_becklyn/deployment-protection/vercel";
+export declare const VERCEL_CALLBACK_PATH = "/_becklyn/deployment-protection/vercel/callback";
+export declare const BYPASS_HEADER = "x-vercel-protection-bypass";
+export declare const SET_BYPASS_COOKIE_HEADER = "x-vercel-set-bypass-cookie";
+export declare const DEFAULT_SESSION_TTL_SECONDS: number;
+/** Recommended Next.js matcher for full-site protection. */
+export declare const deploymentProtectionMatcher: string[];
+//# sourceMappingURL=constants.d.ts.map

package/dist/cjs/constants.d.ts.map

@@ -0,0 +1 @@
+{"version":3,"file":"constants.d.ts","sourceRoot":"","sources":["../../src/constants.ts"],"names":[],"mappings":"AAAA,eAAO,MAAM,mBAAmB,yBAAyB,CAAC;AAC1D,eAAO,MAAM,kBAAkB,wBAAwB,CAAC;AACxD,eAAO,MAAM,kBAAkB,6BAA6B,CAAC;AAC7D,eAAO,MAAM,kBAAkB,6BAA6B,CAAC;AAC7D,eAAO,MAAM,qBAAqB,gCAAgC,CAAC;AACnE,eAAO,MAAM,mBAAmB,8BAA8B,CAAC;AAE/D,eAAO,MAAM,oBAAoB,oCAAoC,CAAC;AACtE,eAAO,MAAM,qBAAqB,2CAAmC,CAAC;AACtE,eAAO,MAAM,oBAAoB,oDAA4C,CAAC;AAE9E,eAAO,MAAM,aAAa,+BAA+B,CAAC;AAC1D,eAAO,MAAM,wBAAwB,+BAA+B,CAAC;AAErE,eAAO,MAAM,2BAA2B,QAAoB,CAAC;AAE7D,4DAA4D;AAC5D,eAAO,MAAM,2BAA2B,UAEvC,CAAC"}

package/dist/cjs/constants.js

@@ -0,0 +1,19 @@
+"use strict";
+Object.defineProperty(exports, "__esModule", { value: true });
+exports.deploymentProtectionMatcher = exports.DEFAULT_SESSION_TTL_SECONDS = exports.SET_BYPASS_COOKIE_HEADER = exports.BYPASS_HEADER = exports.VERCEL_CALLBACK_PATH = exports.VERCEL_AUTHORIZE_PATH = exports.INTERNAL_PATH_PREFIX = exports.OAUTH_RETURN_COOKIE = exports.OAUTH_VERIFIER_COOKIE = exports.OAUTH_NONCE_COOKIE = exports.OAUTH_STATE_COOKIE = exports.BYPASS_COOKIE_NAME = exports.SESSION_COOKIE_NAME = void 0;
+exports.SESSION_COOKIE_NAME = "__becklyn_dp_session";
+exports.BYPASS_COOKIE_NAME = "__becklyn_dp_bypass";
+exports.OAUTH_STATE_COOKIE = "__becklyn_dp_oauth_state";
+exports.OAUTH_NONCE_COOKIE = "__becklyn_dp_oauth_nonce";
+exports.OAUTH_VERIFIER_COOKIE = "__becklyn_dp_oauth_verifier";
+exports.OAUTH_RETURN_COOKIE = "__becklyn_dp_oauth_return";
+exports.INTERNAL_PATH_PREFIX = "/_becklyn/deployment-protection";
+exports.VERCEL_AUTHORIZE_PATH = `${exports.INTERNAL_PATH_PREFIX}/vercel`;
+exports.VERCEL_CALLBACK_PATH = `${exports.INTERNAL_PATH_PREFIX}/vercel/callback`;
+exports.BYPASS_HEADER = "x-vercel-protection-bypass";
+exports.SET_BYPASS_COOKIE_HEADER = "x-vercel-set-bypass-cookie";
+exports.DEFAULT_SESSION_TTL_SECONDS = 60 * 60 * 24 * 14; // 14 days
+/** Recommended Next.js matcher for full-site protection. */
+exports.deploymentProtectionMatcher = [
+    "/((?!_next/static|_next/image|favicon.ico|.*\\.(?:svg|png|jpg|jpeg|gif|webp|ico|css|js|map|txt|xml|woff2?)$).*)",
+];

package/dist/cjs/crypto.d.ts

@@ -0,0 +1,7 @@
+export declare function bytesToBase64Url(bytes: ArrayBuffer | Uint8Array): string;
+export declare function base64UrlToBytes(value: string): Uint8Array;
+export declare function sha256Base64Url(value: string): Promise<string>;
+export declare function hmacSign(secret: string, payload: string): Promise<string>;
+export declare function timingSafeEqualString(a: string, b: string): Promise<boolean>;
+export declare function randomToken(byteLength?: number): string;
+//# sourceMappingURL=crypto.d.ts.map

package/dist/cjs/crypto.d.ts.map

@@ -0,0 +1 @@
+{"version":3,"file":"crypto.d.ts","sourceRoot":"","sources":["../../src/crypto.ts"],"names":[],"mappings":"AAEA,wBAAgB,gBAAgB,CAAC,KAAK,EAAE,WAAW,GAAG,UAAU,GAAG,MAAM,CASxE;AAED,wBAAgB,gBAAgB,CAAC,KAAK,EAAE,MAAM,GAAG,UAAU,CAY1D;AAED,wBAAsB,eAAe,CAAC,KAAK,EAAE,MAAM,GAAG,OAAO,CAAC,MAAM,CAAC,CAGpE;AAED,wBAAsB,QAAQ,CAAC,MAAM,EAAE,MAAM,EAAE,OAAO,EAAE,MAAM,GAAG,OAAO,CAAC,MAAM,CAAC,CAU/E;AAED,wBAAsB,qBAAqB,CAAC,CAAC,EAAE,MAAM,EAAE,CAAC,EAAE,MAAM,GAAG,OAAO,CAAC,OAAO,CAAC,CAiBlF;AAED,wBAAgB,WAAW,CAAC,UAAU,SAAK,GAAG,MAAM,CAInD"}

package/dist/cjs/crypto.js

@@ -0,0 +1,56 @@
+"use strict";
+Object.defineProperty(exports, "__esModule", { value: true });
+exports.bytesToBase64Url = bytesToBase64Url;
+exports.base64UrlToBytes = base64UrlToBytes;
+exports.sha256Base64Url = sha256Base64Url;
+exports.hmacSign = hmacSign;
+exports.timingSafeEqualString = timingSafeEqualString;
+exports.randomToken = randomToken;
+const textEncoder = new TextEncoder();
+function bytesToBase64Url(bytes) {
+    const view = bytes instanceof Uint8Array ? bytes : new Uint8Array(bytes);
+    let binary = "";
+    for (const byte of view) {
+        binary += String.fromCharCode(byte);
+    }
+    return btoa(binary).replace(/\+/g, "-").replace(/\//g, "_").replace(/=+$/g, "");
+}
+function base64UrlToBytes(value) {
+    const padded = value.replace(/-/g, "+").replace(/_/g, "/");
+    const padLength = (4 - (padded.length % 4)) % 4;
+    const base64 = padded + "=".repeat(padLength);
+    const binary = atob(base64);
+    const bytes = new Uint8Array(binary.length);
+    for (let i = 0; i < binary.length; i++) {
+        bytes[i] = binary.charCodeAt(i);
+    }
+    return bytes;
+}
+async function sha256Base64Url(value) {
+    const digest = await crypto.subtle.digest("SHA-256", textEncoder.encode(value));
+    return bytesToBase64Url(digest);
+}
+async function hmacSign(secret, payload) {
+    const key = await crypto.subtle.importKey("raw", textEncoder.encode(secret), { name: "HMAC", hash: "SHA-256" }, false, ["sign"]);
+    const signature = await crypto.subtle.sign("HMAC", key, textEncoder.encode(payload));
+    return bytesToBase64Url(signature);
+}
+async function timingSafeEqualString(a, b) {
+    const aBytes = textEncoder.encode(a);
+    const bBytes = textEncoder.encode(b);
+    if (aBytes.length !== bBytes.length) {
+        // Compare against itself to keep runtime roughly constant on length mismatch.
+        await crypto.subtle.digest("SHA-256", aBytes);
+        return false;
+    }
+    let mismatch = 0;
+    for (let i = 0; i < aBytes.length; i++) {
+        mismatch |= (aBytes[i] ?? 0) ^ (bBytes[i] ?? 0);
+    }
+    return mismatch === 0;
+}
+function randomToken(byteLength = 32) {
+    const bytes = new Uint8Array(byteLength);
+    crypto.getRandomValues(bytes);
+    return bytesToBase64Url(bytes);
+}

package/dist/cjs/handler.d.ts

@@ -0,0 +1,6 @@
+import type { DeploymentProtectionOptions } from "./types";
+/**
+ * Core request handler. Returns `null` when the request may continue to the app.
+ */
+export declare function handleDeploymentProtection(request: Request, options?: DeploymentProtectionOptions): Promise<Response | null>;
+//# sourceMappingURL=handler.d.ts.map

package/dist/cjs/handler.d.ts.map

@@ -0,0 +1 @@
+{"version":3,"file":"handler.d.ts","sourceRoot":"","sources":["../../src/handler.ts"],"names":[],"mappings":"AAiBA,OAAO,KAAK,EAA8B,2BAA2B,EAAE,MAAM,SAAS,CAAC;AA2OvF;;GAEG;AACH,wBAAsB,0BAA0B,CAC5C,OAAO,EAAE,OAAO,EAChB,OAAO,GAAE,2BAAgC,GAC1C,OAAO,CAAC,QAAQ,GAAG,IAAI,CAAC,CAqD1B"}

package/dist/cjs/handler.js

@@ -0,0 +1,212 @@
+"use strict";
+Object.defineProperty(exports, "__esModule", { value: true });
+exports.handleDeploymentProtection = handleDeploymentProtection;
+const bypass_1 = require("./bypass");
+const config_1 = require("./config");
+const constants_1 = require("./constants");
+const crypto_1 = require("./crypto");
+const login_page_1 = require("./login-page");
+const password_1 = require("./password");
+const safe_return_to_1 = require("./safe-return-to");
+const session_1 = require("./session");
+const vercel_oauth_1 = require("./vercel-oauth");
+function isSecureRequest(request) {
+    return new URL(request.url).protocol === "https:";
+}
+function getPathname(request) {
+    return new URL(request.url).pathname;
+}
+function htmlResponse(html, status = 401) {
+    return new Response(html, {
+        status,
+        headers: {
+            "Content-Type": "text/html; charset=utf-8",
+            "Cache-Control": "no-store",
+        },
+    });
+}
+function redirect(location, status = 302) {
+    return new Response(null, {
+        status,
+        headers: {
+            Location: location,
+            "Cache-Control": "no-store",
+        },
+    });
+}
+async function attachSession(response, config, method, subject, secure) {
+    if (!config.secret) {
+        return response;
+    }
+    const token = await (0, session_1.createSessionToken)(config.secret, method, subject, config.sessionTtlSeconds);
+    const opts = (0, session_1.sessionCookieOptions)(config.sessionTtlSeconds, secure);
+    (0, vercel_oauth_1.appendSetCookie)(response, constants_1.SESSION_COOKIE_NAME, token, opts);
+    return response;
+}
+async function handleBypass(request, config) {
+    if (!config.bypassSecret) {
+        return { kind: "miss" };
+    }
+    const token = (0, bypass_1.readBypassToken)(request) ?? (0, bypass_1.readBypassCookie)(request);
+    if (!(await (0, bypass_1.isValidBypass)(token, config.bypassSecret))) {
+        return { kind: "miss" };
+    }
+    const setCookieMode = (0, bypass_1.shouldSetBypassCookie)(request);
+    const url = new URL(request.url);
+    const hadQueryBypass = url.searchParams.has(constants_1.BYPASS_HEADER);
+    const hadSetCookieQuery = url.searchParams.has("x-vercel-set-bypass-cookie");
+    if (hadQueryBypass || hadSetCookieQuery || setCookieMode) {
+        url.searchParams.delete(constants_1.BYPASS_HEADER);
+        url.searchParams.delete("x-vercel-set-bypass-cookie");
+        const response = redirect(url.pathname + url.search + url.hash);
+        const secure = isSecureRequest(request);
+        if (setCookieMode || hadSetCookieQuery) {
+            (0, vercel_oauth_1.appendSetCookie)(response, constants_1.BYPASS_COOKIE_NAME, config.bypassSecret, {
+                httpOnly: true,
+                secure,
+                path: "/",
+                maxAge: config.sessionTtlSeconds,
+                sameSite: setCookieMode === "samesitenone" ? "none" : "lax",
+            });
+        }
+        await attachSession(response, config, "bypass", "automation", secure);
+        return { kind: "respond", response };
+    }
+    return { kind: "allow" };
+}
+async function handlePasswordPost(request, config) {
+    if (request.method !== "POST" || !(0, config_1.hasPasswordAuth)(config)) {
+        return null;
+    }
+    const contentType = request.headers.get("content-type") ?? "";
+    if (!contentType.includes("application/x-www-form-urlencoded") &&
+        !contentType.includes("multipart/form-data")) {
+        return null;
+    }
+    let form;
+    try {
+        form = await request.formData();
+    }
+    catch {
+        return null;
+    }
+    if (form.get("__becklyn_dp") !== "1") {
+        return null;
+    }
+    const username = String(form.get("username") ?? "");
+    const password = String(form.get("password") ?? "");
+    const returnTo = (0, safe_return_to_1.safeReturnTo)(String(form.get("return_to") ?? getPathname(request)));
+    if (!(await (0, password_1.validatePasswordCredentials)(config, username, password))) {
+        return htmlResponse((0, login_page_1.renderLoginPage)(config, {
+            error: "Invalid username or password.",
+            returnTo,
+            showPassword: true,
+            showVercel: (0, config_1.hasVercelAuth)(config),
+        }));
+    }
+    const response = redirect(returnTo);
+    return attachSession(response, config, "password", username, isSecureRequest(request));
+}
+async function handleVercelAuthorize(request, config) {
+    if (getPathname(request) !== constants_1.VERCEL_AUTHORIZE_PATH) {
+        return null;
+    }
+    if (!(0, config_1.hasVercelAuth)(config)) {
+        return new Response("Sign in with Vercel is not configured", { status: 500 });
+    }
+    const returnTo = (0, safe_return_to_1.safeReturnTo)(new URL(request.url).searchParams.get("return_to"));
+    return (0, vercel_oauth_1.buildVercelAuthorizeRedirect)(request, config, returnTo);
+}
+async function handleVercelCallback(request, config) {
+    if (getPathname(request) !== constants_1.VERCEL_CALLBACK_PATH) {
+        return null;
+    }
+    if (!(0, config_1.hasVercelAuth)(config) || !config.secret) {
+        return new Response("Sign in with Vercel is not configured", { status: 500 });
+    }
+    const url = new URL(request.url);
+    const code = url.searchParams.get("code");
+    const state = url.searchParams.get("state");
+    const secure = isSecureRequest(request);
+    const returnTo = (0, safe_return_to_1.safeReturnTo)((0, vercel_oauth_1.readCookie)(request, constants_1.OAUTH_RETURN_COOKIE));
+    if (!code || !(await (0, vercel_oauth_1.assertOAuthState)(request, state))) {
+        const response = htmlResponse((0, login_page_1.renderLoginPage)(config, {
+            error: "Vercel sign-in failed (invalid state).",
+            returnTo,
+            showPassword: (0, config_1.hasPasswordAuth)(config),
+            showVercel: true,
+        }));
+        (0, vercel_oauth_1.clearOAuthCookies)(response, secure);
+        return response;
+    }
+    try {
+        const codeVerifier = (0, vercel_oauth_1.readCookie)(request, constants_1.OAUTH_VERIFIER_COOKIE);
+        if (!codeVerifier) {
+            throw new Error("Missing PKCE verifier");
+        }
+        const tokenData = await (0, vercel_oauth_1.exchangeVercelCode)(request, config, code, codeVerifier);
+        const storedNonce = (0, vercel_oauth_1.readCookie)(request, constants_1.OAUTH_NONCE_COOKIE);
+        const tokenNonce = (0, vercel_oauth_1.decodeIdTokenNonce)(tokenData.id_token);
+        if (storedNonce && tokenNonce && !(await (0, crypto_1.timingSafeEqualString)(storedNonce, tokenNonce))) {
+            throw new Error("Nonce mismatch");
+        }
+        const user = await (0, vercel_oauth_1.fetchVercelUserInfo)(tokenData.access_token);
+        const subject = user.preferred_username || user.email || user.sub || "vercel-user";
+        const response = redirect(returnTo);
+        (0, vercel_oauth_1.clearOAuthCookies)(response, secure);
+        return attachSession(response, config, "vercel", subject, secure);
+    }
+    catch {
+        const response = htmlResponse((0, login_page_1.renderLoginPage)(config, {
+            error: "Vercel sign-in failed.",
+            returnTo,
+            showPassword: (0, config_1.hasPasswordAuth)(config),
+            showVercel: true,
+        }));
+        (0, vercel_oauth_1.clearOAuthCookies)(response, secure);
+        return response;
+    }
+}
+/**
+ * Core request handler. Returns `null` when the request may continue to the app.
+ */
+async function handleDeploymentProtection(request, options = {}) {
+    const config = (0, config_1.resolveConfig)(options);
+    if (!(0, config_1.isProtectionActive)(config)) {
+        return null;
+    }
+    const vercelAuthorize = await handleVercelAuthorize(request, config);
+    if (vercelAuthorize) {
+        return vercelAuthorize;
+    }
+    const vercelCallback = await handleVercelCallback(request, config);
+    if (vercelCallback) {
+        return vercelCallback;
+    }
+    const passwordResponse = await handlePasswordPost(request, config);
+    if (passwordResponse) {
+        return passwordResponse;
+    }
+    const bypass = await handleBypass(request, config);
+    if (bypass.kind === "respond") {
+        return bypass.response;
+    }
+    if (bypass.kind === "allow") {
+        return null;
+    }
+    if (config.secret) {
+        const session = await (0, session_1.verifySessionToken)(config.secret, (0, vercel_oauth_1.readCookie)(request, constants_1.SESSION_COOKIE_NAME));
+        if (session) {
+            return null;
+        }
+    }
+    if (!(0, config_1.hasPasswordAuth)(config) && !(0, config_1.hasVercelAuth)(config)) {
+        return new Response("Unauthorized", { status: 401 });
+    }
+    const returnTo = (0, safe_return_to_1.safeReturnTo)(getPathname(request) + new URL(request.url).search);
+    return htmlResponse((0, login_page_1.renderLoginPage)(config, {
+        returnTo,
+        showPassword: (0, config_1.hasPasswordAuth)(config),
+        showVercel: (0, config_1.hasVercelAuth)(config),
+    }));
+}