@becklyn/deployment-protection 0.2.0 → 0.4.0

package/dist/cjs/handoff.js

@@ -0,0 +1,199 @@
+"use strict";
+Object.defineProperty(exports, "__esModule", { value: true });
+exports.PROXY_START_TTL_SECONDS = exports.HANDOFF_TTL_SECONDS = void 0;
+exports.canonicalProxyStartPayload = canonicalProxyStartPayload;
+exports.signProxyStart = signProxyStart;
+exports.verifyProxyStartSignature = verifyProxyStartSignature;
+exports.buildProxyStartUrl = buildProxyStartUrl;
+exports.createHandoffToken = createHandoffToken;
+exports.verifyHandoffToken = verifyHandoffToken;
+exports.normalizeReturnOrigin = normalizeReturnOrigin;
+exports.isReturnOriginAllowed = isReturnOriginAllowed;
+exports.parseAllowlist = parseAllowlist;
+const crypto_1 = require("./crypto");
+const safe_return_to_1 = require("./safe-return-to");
+exports.HANDOFF_TTL_SECONDS = 60;
+exports.PROXY_START_TTL_SECONDS = 5 * 60;
+function encodeJson(value) {
+    return (0, crypto_1.bytesToBase64Url)(new TextEncoder().encode(JSON.stringify(value)));
+}
+function decodeJson(encoded) {
+    try {
+        const json = new TextDecoder().decode((0, crypto_1.base64UrlToBytes)(encoded));
+        return JSON.parse(json);
+    }
+    catch {
+        return null;
+    }
+}
+/**
+ * Canonical payload for HMAC over the proxy start request.
+ * Field order is fixed so app and proxy produce the same signature.
+ */
+function canonicalProxyStartPayload(params) {
+    return `v1\n${params.returnOrigin}\n${params.returnPath}\n${params.exp}\n${params.nonce}`;
+}
+async function signProxyStart(secret, params) {
+    return (0, crypto_1.hmacSign)(secret, canonicalProxyStartPayload(params));
+}
+async function verifyProxyStartSignature(secret, params, signature) {
+    if (!signature) {
+        return false;
+    }
+    if (params.exp < Math.floor(Date.now() / 1000)) {
+        return false;
+    }
+    const expected = await signProxyStart(secret, params);
+    return (0, crypto_1.timingSafeEqualString)(signature, expected);
+}
+async function buildProxyStartUrl(options) {
+    const returnPath = (0, safe_return_to_1.safeReturnTo)(options.returnPath);
+    const params = {
+        returnOrigin: options.returnOrigin.replace(/\/$/, ""),
+        returnPath,
+        exp: Math.floor(Date.now() / 1000) + (options.ttlSeconds ?? exports.PROXY_START_TTL_SECONDS),
+        nonce: (0, crypto_1.randomToken)(16),
+    };
+    const sig = await signProxyStart(options.secret, params);
+    const url = new URL("/start", ensureTrailingSlashBase(options.authProxyUrl));
+    url.searchParams.set("return_origin", params.returnOrigin);
+    url.searchParams.set("return_path", params.returnPath);
+    url.searchParams.set("exp", String(params.exp));
+    url.searchParams.set("nonce", params.nonce);
+    url.searchParams.set("sig", sig);
+    return url.toString();
+}
+function ensureTrailingSlashBase(value) {
+    try {
+        const url = new URL(value);
+        return url.toString().endsWith("/") ? url.toString() : `${url.toString()}/`;
+    }
+    catch {
+        return value.endsWith("/") ? value : `${value}/`;
+    }
+}
+async function createHandoffToken(secret, audienceOrigin, subject, ttlSeconds = exports.HANDOFF_TTL_SECONDS) {
+    const payload = {
+        exp: Math.floor(Date.now() / 1000) + ttlSeconds,
+        aud: audienceOrigin.replace(/\/$/, ""),
+        subject,
+        method: "vercel",
+    };
+    const body = encodeJson(payload);
+    const signature = await (0, crypto_1.hmacSign)(secret, body);
+    return `${body}.${signature}`;
+}
+async function verifyHandoffToken(secret, token, expectedAudienceOrigin) {
+    if (!token) {
+        return null;
+    }
+    const [body, signature] = token.split(".");
+    if (!body || !signature) {
+        return null;
+    }
+    const expected = await (0, crypto_1.hmacSign)(secret, body);
+    if (!(await (0, crypto_1.timingSafeEqualString)(signature, expected))) {
+        return null;
+    }
+    const payload = decodeJson(body);
+    if (!payload ||
+        typeof payload.exp !== "number" ||
+        typeof payload.aud !== "string" ||
+        typeof payload.subject !== "string" ||
+        payload.method !== "vercel") {
+        return null;
+    }
+    if (payload.exp < Math.floor(Date.now() / 1000)) {
+        return null;
+    }
+    const expectedAud = expectedAudienceOrigin.replace(/\/$/, "");
+    if (!(await (0, crypto_1.timingSafeEqualString)(payload.aud, expectedAud))) {
+        return null;
+    }
+    return payload;
+}
+/**
+ * Validate a post-login return origin for the auth proxy.
+ * Only https (and http://localhost / 127.0.0.1) are accepted.
+ */
+function normalizeReturnOrigin(value) {
+    if (typeof value !== "string" || value.length === 0 || value.length > 512) {
+        return null;
+    }
+    let url;
+    try {
+        url = new URL(value);
+    }
+    catch {
+        return null;
+    }
+    if (url.username || url.password) {
+        return null;
+    }
+    const host = url.hostname.toLowerCase();
+    const isLocalHttp = url.protocol === "http:" &&
+        (host === "localhost" || host === "127.0.0.1" || host === "[::1]");
+    if (url.protocol !== "https:" && !isLocalHttp) {
+        return null;
+    }
+    // Origin only — reject unexpected path/query/hash noise by normalizing.
+    return url.origin;
+}
+/**
+ * Optional allowlist. Entries may be:
+ * - full origins (`https://app.example.com`)
+ * - hostname suffixes (`.vercel.app`, `example.com`)
+ * - `localhost` (any localhost / 127.0.0.1 http(s) origin)
+ *
+ * Empty allowlist → any origin that passes {@link normalizeReturnOrigin}.
+ */
+function isReturnOriginAllowed(origin, allowlist) {
+    if (allowlist.length === 0) {
+        return true;
+    }
+    let url;
+    try {
+        url = new URL(origin);
+    }
+    catch {
+        return false;
+    }
+    const host = url.hostname.toLowerCase();
+    for (const raw of allowlist) {
+        const entry = raw.trim().toLowerCase();
+        if (!entry) {
+            continue;
+        }
+        if (entry === "localhost") {
+            if (host === "localhost" || host === "127.0.0.1" || host === "[::1]") {
+                return true;
+            }
+            continue;
+        }
+        if (entry.startsWith("http://") || entry.startsWith("https://")) {
+            try {
+                if (new URL(entry).origin.toLowerCase() === origin.toLowerCase()) {
+                    return true;
+                }
+            }
+            catch {
+                // ignore invalid allowlist entries
+            }
+            continue;
+        }
+        const suffix = entry.startsWith(".") ? entry : `.${entry}`;
+        if (host === entry || host === entry.replace(/^\./, "") || host.endsWith(suffix)) {
+            return true;
+        }
+    }
+    return false;
+}
+function parseAllowlist(value) {
+    if (!value) {
+        return [];
+    }
+    return value
+        .split(",")
+        .map(part => part.trim())
+        .filter(Boolean);
+}

package/dist/cjs/index.d.ts

@@ -1,6 +1,8 @@
 export { INTERNAL_PATH_PREFIX, VERCEL_AUTHORIZE_PATH, VERCEL_CALLBACK_PATH } from "./constants";
+export { AUTH_PROXY_CALLBACK_PATH, AUTH_PROXY_START_PATH, handleAuthProxyCallback, handleAuthProxyStart, } from "./auth-proxy";
 export { handleDeploymentProtection } from "./handler";
 export { withDeploymentProtection } from "./middleware";
-export { resolveConfig, hasPasswordAuth, hasVercelAuth, isProtectionActive } from "./config";
+export { middlewarePassThrough, withEdgeDeploymentProtection } from "./edge";
+export { resolveConfig, hasPasswordAuth, hasVercelAuth, hasVercelDirectAuth, hasVercelProxyAuth, isProtectionActive, } from "./config";
 export type { AuthMethod, DeploymentProtectionConfig, DeploymentProtectionOptions, FormOptions, SessionPayload, } from "./types";
 //# sourceMappingURL=index.d.ts.map

package/dist/cjs/index.d.ts.map

@@ -1 +1 @@
-{"version":3,"file":"index.d.ts","sourceRoot":"","sources":["../../src/index.ts"],"names":[],"mappings":"AAAA,OAAO,EAAE,oBAAoB,EAAE,qBAAqB,EAAE,oBAAoB,EAAE,MAAM,aAAa,CAAC;AAChG,OAAO,EAAE,0BAA0B,EAAE,MAAM,WAAW,CAAC;AACvD,OAAO,EAAE,wBAAwB,EAAE,MAAM,cAAc,CAAC;AACxD,OAAO,EAAE,aAAa,EAAE,eAAe,EAAE,aAAa,EAAE,kBAAkB,EAAE,MAAM,UAAU,CAAC;AAC7F,YAAY,EACR,UAAU,EACV,0BAA0B,EAC1B,2BAA2B,EAC3B,WAAW,EACX,cAAc,GACjB,MAAM,SAAS,CAAC"}
+{"version":3,"file":"index.d.ts","sourceRoot":"","sources":["../../src/index.ts"],"names":[],"mappings":"AAAA,OAAO,EAAE,oBAAoB,EAAE,qBAAqB,EAAE,oBAAoB,EAAE,MAAM,aAAa,CAAC;AAChG,OAAO,EACH,wBAAwB,EACxB,qBAAqB,EACrB,uBAAuB,EACvB,oBAAoB,GACvB,MAAM,cAAc,CAAC;AACtB,OAAO,EAAE,0BAA0B,EAAE,MAAM,WAAW,CAAC;AACvD,OAAO,EAAE,wBAAwB,EAAE,MAAM,cAAc,CAAC;AACxD,OAAO,EAAE,qBAAqB,EAAE,4BAA4B,EAAE,MAAM,QAAQ,CAAC;AAC7E,OAAO,EACH,aAAa,EACb,eAAe,EACf,aAAa,EACb,mBAAmB,EACnB,kBAAkB,EAClB,kBAAkB,GACrB,MAAM,UAAU,CAAC;AAClB,YAAY,EACR,UAAU,EACV,0BAA0B,EAC1B,2BAA2B,EAC3B,WAAW,EACX,cAAc,GACjB,MAAM,SAAS,CAAC"}

package/dist/cjs/index.js

@@ -1,16 +1,26 @@
 "use strict";
 Object.defineProperty(exports, "__esModule", { value: true });
-exports.isProtectionActive = exports.hasVercelAuth = exports.hasPasswordAuth = exports.resolveConfig = exports.withDeploymentProtection = exports.handleDeploymentProtection = exports.VERCEL_CALLBACK_PATH = exports.VERCEL_AUTHORIZE_PATH = exports.INTERNAL_PATH_PREFIX = void 0;
+exports.isProtectionActive = exports.hasVercelProxyAuth = exports.hasVercelDirectAuth = exports.hasVercelAuth = exports.hasPasswordAuth = exports.resolveConfig = exports.withEdgeDeploymentProtection = exports.middlewarePassThrough = exports.withDeploymentProtection = exports.handleDeploymentProtection = exports.handleAuthProxyStart = exports.handleAuthProxyCallback = exports.AUTH_PROXY_START_PATH = exports.AUTH_PROXY_CALLBACK_PATH = exports.VERCEL_CALLBACK_PATH = exports.VERCEL_AUTHORIZE_PATH = exports.INTERNAL_PATH_PREFIX = void 0;
 var constants_1 = require("./constants");
 Object.defineProperty(exports, "INTERNAL_PATH_PREFIX", { enumerable: true, get: function () { return constants_1.INTERNAL_PATH_PREFIX; } });
 Object.defineProperty(exports, "VERCEL_AUTHORIZE_PATH", { enumerable: true, get: function () { return constants_1.VERCEL_AUTHORIZE_PATH; } });
 Object.defineProperty(exports, "VERCEL_CALLBACK_PATH", { enumerable: true, get: function () { return constants_1.VERCEL_CALLBACK_PATH; } });
+var auth_proxy_1 = require("./auth-proxy");
+Object.defineProperty(exports, "AUTH_PROXY_CALLBACK_PATH", { enumerable: true, get: function () { return auth_proxy_1.AUTH_PROXY_CALLBACK_PATH; } });
+Object.defineProperty(exports, "AUTH_PROXY_START_PATH", { enumerable: true, get: function () { return auth_proxy_1.AUTH_PROXY_START_PATH; } });
+Object.defineProperty(exports, "handleAuthProxyCallback", { enumerable: true, get: function () { return auth_proxy_1.handleAuthProxyCallback; } });
+Object.defineProperty(exports, "handleAuthProxyStart", { enumerable: true, get: function () { return auth_proxy_1.handleAuthProxyStart; } });
 var handler_1 = require("./handler");
 Object.defineProperty(exports, "handleDeploymentProtection", { enumerable: true, get: function () { return handler_1.handleDeploymentProtection; } });
 var middleware_1 = require("./middleware");
 Object.defineProperty(exports, "withDeploymentProtection", { enumerable: true, get: function () { return middleware_1.withDeploymentProtection; } });
+var edge_1 = require("./edge");
+Object.defineProperty(exports, "middlewarePassThrough", { enumerable: true, get: function () { return edge_1.middlewarePassThrough; } });
+Object.defineProperty(exports, "withEdgeDeploymentProtection", { enumerable: true, get: function () { return edge_1.withEdgeDeploymentProtection; } });
 var config_1 = require("./config");
 Object.defineProperty(exports, "resolveConfig", { enumerable: true, get: function () { return config_1.resolveConfig; } });
 Object.defineProperty(exports, "hasPasswordAuth", { enumerable: true, get: function () { return config_1.hasPasswordAuth; } });
 Object.defineProperty(exports, "hasVercelAuth", { enumerable: true, get: function () { return config_1.hasVercelAuth; } });
+Object.defineProperty(exports, "hasVercelDirectAuth", { enumerable: true, get: function () { return config_1.hasVercelDirectAuth; } });
+Object.defineProperty(exports, "hasVercelProxyAuth", { enumerable: true, get: function () { return config_1.hasVercelProxyAuth; } });
 Object.defineProperty(exports, "isProtectionActive", { enumerable: true, get: function () { return config_1.isProtectionActive; } });

package/dist/cjs/storybook.d.ts

@@ -0,0 +1,33 @@
+/**
+ * Storybook deployment protection for Vercel.
+ *
+ * Built Storybooks are static sites, so protection runs as **Vercel Edge Middleware**
+ * (not Storybook config). Drop a `middleware.ts` next to the Vercel project root that
+ * serves `storybook-static` and set the same env vars as the Next.js integration.
+ *
+ * @example middleware.ts
+ * ```ts
+ * import { withStorybookDeploymentProtection } from "@becklyn/deployment-protection/storybook";
+ *
+ * export default withStorybookDeploymentProtection();
+ *
+ * // Matcher must be a string literal in this file (Vercel/Next static analysis).
+ * export const config = {
+ *   matcher: [
+ *     "/((?!.*\\.(?:svg|png|jpg|jpeg|gif|webp|ico|css|js|map|txt|xml|woff2?|mjs)$).*)",
+ *   ],
+ * };
+ * ```
+ *
+ * Optional `vercel.json` for a Storybook-only project:
+ * ```json
+ * {
+ *   "buildCommand": "npm run build-storybook",
+ *   "outputDirectory": "storybook-static",
+ *   "framework": null
+ * }
+ * ```
+ */
+export { middlewarePassThrough, withEdgeDeploymentProtection as withStorybookDeploymentProtection, } from "./edge";
+export type { DeploymentProtectionOptions } from "./types";
+//# sourceMappingURL=storybook.d.ts.map

package/dist/cjs/storybook.d.ts.map

@@ -0,0 +1 @@
+{"version":3,"file":"storybook.d.ts","sourceRoot":"","sources":["../../src/storybook.ts"],"names":[],"mappings":"AAAA;;;;;;;;;;;;;;;;;;;;;;;;;;;;;GA6BG;AACH,OAAO,EACH,qBAAqB,EACrB,4BAA4B,IAAI,iCAAiC,GACpE,MAAM,QAAQ,CAAC;AAChB,YAAY,EAAE,2BAA2B,EAAE,MAAM,SAAS,CAAC"}

package/dist/cjs/storybook.js

@@ -0,0 +1,36 @@
+"use strict";
+Object.defineProperty(exports, "__esModule", { value: true });
+exports.withStorybookDeploymentProtection = exports.middlewarePassThrough = void 0;
+/**
+ * Storybook deployment protection for Vercel.
+ *
+ * Built Storybooks are static sites, so protection runs as **Vercel Edge Middleware**
+ * (not Storybook config). Drop a `middleware.ts` next to the Vercel project root that
+ * serves `storybook-static` and set the same env vars as the Next.js integration.
+ *
+ * @example middleware.ts
+ * ```ts
+ * import { withStorybookDeploymentProtection } from "@becklyn/deployment-protection/storybook";
+ *
+ * export default withStorybookDeploymentProtection();
+ *
+ * // Matcher must be a string literal in this file (Vercel/Next static analysis).
+ * export const config = {
+ *   matcher: [
+ *     "/((?!.*\\.(?:svg|png|jpg|jpeg|gif|webp|ico|css|js|map|txt|xml|woff2?|mjs)$).*)",
+ *   ],
+ * };
+ * ```
+ *
+ * Optional `vercel.json` for a Storybook-only project:
+ * ```json
+ * {
+ *   "buildCommand": "npm run build-storybook",
+ *   "outputDirectory": "storybook-static",
+ *   "framework": null
+ * }
+ * ```
+ */
+var edge_1 = require("./edge");
+Object.defineProperty(exports, "middlewarePassThrough", { enumerable: true, get: function () { return edge_1.middlewarePassThrough; } });
+Object.defineProperty(exports, "withStorybookDeploymentProtection", { enumerable: true, get: function () { return edge_1.withEdgeDeploymentProtection; } });

package/dist/cjs/types.d.ts

@@ -4,7 +4,22 @@ export interface DeploymentProtectionConfig {
     username: string | null;
     password: string | null;
     secret: string | null;
+    /**
+     * Shared secret used to sign proxy start requests and verify handoff tokens.
+     * Falls back to {@link secret} when unset.
+     */
+    handoffSecret: string | null;
     bypassSecret: string | null;
+    /**
+     * Base URL of the central auth-proxy app (e.g. https://dp-auth.example.com).
+     * When set, protected apps no longer need per-host Vercel OAuth callback URLs.
+     */
+    authProxyUrl: string | null;
+    /**
+     * Optional allowlist for auth-proxy return origins (proxy side).
+     * See README for entry formats.
+     */
+    allowedReturnOrigins: string[];
     vercelClientId: string | null;
     vercelClientSecret: string | null;
     sessionTtlSeconds: number;

package/dist/cjs/types.d.ts.map

@@ -1 +1 @@
-{"version":3,"file":"types.d.ts","sourceRoot":"","sources":["../../src/types.ts"],"names":[],"mappings":"AAAA,MAAM,MAAM,UAAU,GAAG,UAAU,GAAG,QAAQ,GAAG,QAAQ,CAAC;AAE1D,MAAM,WAAW,0BAA0B;IACvC,OAAO,EAAE,OAAO,CAAC;IACjB,QAAQ,EAAE,MAAM,GAAG,IAAI,CAAC;IACxB,QAAQ,EAAE,MAAM,GAAG,IAAI,CAAC;IACxB,MAAM,EAAE,MAAM,GAAG,IAAI,CAAC;IACtB,YAAY,EAAE,MAAM,GAAG,IAAI,CAAC;IAC5B,cAAc,EAAE,MAAM,GAAG,IAAI,CAAC;IAC9B,kBAAkB,EAAE,MAAM,GAAG,IAAI,CAAC;IAClC,iBAAiB,EAAE,MAAM,CAAC;IAC1B,SAAS,EAAE,MAAM,CAAC;IAClB,eAAe,EAAE,MAAM,CAAC;CAC3B;AAED,MAAM,WAAW,WAAW;IACxB,KAAK,CAAC,EAAE,MAAM,CAAC;IACf,WAAW,CAAC,EAAE,MAAM,CAAC;CACxB;AAED,MAAM,WAAW,2BAA2B;IACxC;;;OAGG;IACH,GAAG,CAAC,EAAE,MAAM,CAAC,MAAM,EAAE,MAAM,GAAG,SAAS,CAAC,CAAC;IACzC,8CAA8C;IAC9C,IAAI,CAAC,EAAE,WAAW,CAAC;IACnB,qDAAqD;IACrD,iBAAiB,CAAC,EAAE,MAAM,CAAC;CAC9B;AAED,MAAM,WAAW,cAAc;IAC3B,GAAG,EAAE,MAAM,CAAC;IACZ,MAAM,EAAE,UAAU,CAAC;IACnB,OAAO,EAAE,MAAM,CAAC;CACnB;AAED,MAAM,MAAM,MAAM,GAAG,MAAM,CAAC,MAAM,EAAE,MAAM,GAAG,SAAS,CAAC,CAAC"}
+{"version":3,"file":"types.d.ts","sourceRoot":"","sources":["../../src/types.ts"],"names":[],"mappings":"AAAA,MAAM,MAAM,UAAU,GAAG,UAAU,GAAG,QAAQ,GAAG,QAAQ,CAAC;AAE1D,MAAM,WAAW,0BAA0B;IACvC,OAAO,EAAE,OAAO,CAAC;IACjB,QAAQ,EAAE,MAAM,GAAG,IAAI,CAAC;IACxB,QAAQ,EAAE,MAAM,GAAG,IAAI,CAAC;IACxB,MAAM,EAAE,MAAM,GAAG,IAAI,CAAC;IACtB;;;OAGG;IACH,aAAa,EAAE,MAAM,GAAG,IAAI,CAAC;IAC7B,YAAY,EAAE,MAAM,GAAG,IAAI,CAAC;IAC5B;;;OAGG;IACH,YAAY,EAAE,MAAM,GAAG,IAAI,CAAC;IAC5B;;;OAGG;IACH,oBAAoB,EAAE,MAAM,EAAE,CAAC;IAC/B,cAAc,EAAE,MAAM,GAAG,IAAI,CAAC;IAC9B,kBAAkB,EAAE,MAAM,GAAG,IAAI,CAAC;IAClC,iBAAiB,EAAE,MAAM,CAAC;IAC1B,SAAS,EAAE,MAAM,CAAC;IAClB,eAAe,EAAE,MAAM,CAAC;CAC3B;AAED,MAAM,WAAW,WAAW;IACxB,KAAK,CAAC,EAAE,MAAM,CAAC;IACf,WAAW,CAAC,EAAE,MAAM,CAAC;CACxB;AAED,MAAM,WAAW,2BAA2B;IACxC;;;OAGG;IACH,GAAG,CAAC,EAAE,MAAM,CAAC,MAAM,EAAE,MAAM,GAAG,SAAS,CAAC,CAAC;IACzC,8CAA8C;IAC9C,IAAI,CAAC,EAAE,WAAW,CAAC;IACnB,qDAAqD;IACrD,iBAAiB,CAAC,EAAE,MAAM,CAAC;CAC9B;AAED,MAAM,WAAW,cAAc;IAC3B,GAAG,EAAE,MAAM,CAAC;IACZ,MAAM,EAAE,UAAU,CAAC;IACnB,OAAO,EAAE,MAAM,CAAC;CACnB;AAED,MAAM,MAAM,MAAM,GAAG,MAAM,CAAC,MAAM,EAAE,MAAM,GAAG,SAAS,CAAC,CAAC"}

package/dist/cjs/vercel-oauth.d.ts

@@ -13,8 +13,15 @@ export interface VercelUserInfo {
     email?: string;
     preferred_username?: string;
 }
-export declare function buildVercelAuthorizeRedirect(request: Request, config: DeploymentProtectionConfig, returnTo: string): Promise<Response>;
-export declare function exchangeVercelCode(request: Request, config: DeploymentProtectionConfig, code: string, codeVerifier: string): Promise<VercelTokenResponse>;
+export interface VercelOAuthPathOptions {
+    /**
+     * Absolute path used as the OAuth redirect_uri path on the current origin.
+     * Defaults to the protected-app callback path. Auth-proxy uses `/callback`.
+     */
+    callbackPath?: string;
+}
+export declare function buildVercelAuthorizeRedirect(request: Request, config: DeploymentProtectionConfig, returnTo: string, options?: VercelOAuthPathOptions): Promise<Response>;
+export declare function exchangeVercelCode(request: Request, config: DeploymentProtectionConfig, code: string, codeVerifier: string, options?: VercelOAuthPathOptions): Promise<VercelTokenResponse>;
 export declare function fetchVercelUserInfo(accessToken: string): Promise<VercelUserInfo>;
 export declare function readCookie(request: Request, name: string): string | null;
 export declare function assertOAuthState(request: Request, state: string | null): Promise<boolean>;

package/dist/cjs/vercel-oauth.d.ts.map

@@ -1 +1 @@
-{"version":3,"file":"vercel-oauth.d.ts","sourceRoot":"","sources":["../../src/vercel-oauth.ts"],"names":[],"mappings":"AAQA,OAAO,KAAK,EAAE,0BAA0B,EAAE,MAAM,SAAS,CAAC;AAE1D,MAAM,WAAW,mBAAmB;IAChC,YAAY,EAAE,MAAM,CAAC;IACrB,UAAU,EAAE,MAAM,CAAC;IACnB,QAAQ,CAAC,EAAE,MAAM,CAAC;IAClB,UAAU,EAAE,MAAM,CAAC;IACnB,KAAK,CAAC,EAAE,MAAM,CAAC;IACf,aAAa,CAAC,EAAE,MAAM,CAAC;CAC1B;AAED,MAAM,WAAW,cAAc;IAC3B,GAAG,CAAC,EAAE,MAAM,CAAC;IACb,IAAI,CAAC,EAAE,MAAM,CAAC;IACd,KAAK,CAAC,EAAE,MAAM,CAAC;IACf,kBAAkB,CAAC,EAAE,MAAM,CAAC;CAC/B;AAYD,wBAAsB,4BAA4B,CAC9C,OAAO,EAAE,OAAO,EAChB,MAAM,EAAE,0BAA0B,EAClC,QAAQ,EAAE,MAAM,GACjB,OAAO,CAAC,QAAQ,CAAC,CAsCnB;AAED,wBAAsB,kBAAkB,CACpC,OAAO,EAAE,OAAO,EAChB,MAAM,EAAE,0BAA0B,EAClC,IAAI,EAAE,MAAM,EACZ,YAAY,EAAE,MAAM,GACrB,OAAO,CAAC,mBAAmB,CAAC,CA6B9B;AAED,wBAAsB,mBAAmB,CAAC,WAAW,EAAE,MAAM,GAAG,OAAO,CAAC,cAAc,CAAC,CAYtF;AAED,wBAAgB,UAAU,CAAC,OAAO,EAAE,OAAO,EAAE,IAAI,EAAE,MAAM,GAAG,MAAM,GAAG,IAAI,CAgBxE;AAED,wBAAsB,gBAAgB,CAAC,OAAO,EAAE,OAAO,EAAE,KAAK,EAAE,MAAM,GAAG,IAAI,GAAG,OAAO,CAAC,OAAO,CAAC,CAO/F;AAED,wBAAgB,kBAAkB,CAAC,OAAO,EAAE,MAAM,GAAG,SAAS,GAAG,MAAM,GAAG,IAAI,CAqB7E;AAED,wBAAgB,iBAAiB,CAAC,QAAQ,EAAE,QAAQ,EAAE,MAAM,EAAE,OAAO,GAAG,IAAI,CAiB3E;AAED,wBAAgB,eAAe,CAC3B,QAAQ,EAAE,QAAQ,EAClB,IAAI,EAAE,MAAM,EACZ,KAAK,EAAE,MAAM,EACb,OAAO,EAAE;IACL,QAAQ,CAAC,EAAE,OAAO,CAAC;IACnB,MAAM,CAAC,EAAE,OAAO,CAAC;IACjB,QAAQ,CAAC,EAAE,KAAK,GAAG,QAAQ,GAAG,MAAM,CAAC;IACrC,IAAI,CAAC,EAAE,MAAM,CAAC;IACd,MAAM,CAAC,EAAE,MAAM,CAAC;CACnB,GACF,IAAI,CAwBN"}
+{"version":3,"file":"vercel-oauth.d.ts","sourceRoot":"","sources":["../../src/vercel-oauth.ts"],"names":[],"mappings":"AASA,OAAO,KAAK,EAAE,0BAA0B,EAAE,MAAM,SAAS,CAAC;AAE1D,MAAM,WAAW,mBAAmB;IAChC,YAAY,EAAE,MAAM,CAAC;IACrB,UAAU,EAAE,MAAM,CAAC;IACnB,QAAQ,CAAC,EAAE,MAAM,CAAC;IAClB,UAAU,EAAE,MAAM,CAAC;IACnB,KAAK,CAAC,EAAE,MAAM,CAAC;IACf,aAAa,CAAC,EAAE,MAAM,CAAC;CAC1B;AAED,MAAM,WAAW,cAAc;IAC3B,GAAG,CAAC,EAAE,MAAM,CAAC;IACb,IAAI,CAAC,EAAE,MAAM,CAAC;IACd,KAAK,CAAC,EAAE,MAAM,CAAC;IACf,kBAAkB,CAAC,EAAE,MAAM,CAAC;CAC/B;AAED,MAAM,WAAW,sBAAsB;IACnC;;;OAGG;IACH,YAAY,CAAC,EAAE,MAAM,CAAC;CACzB;AAgBD,wBAAsB,4BAA4B,CAC9C,OAAO,EAAE,OAAO,EAChB,MAAM,EAAE,0BAA0B,EAClC,QAAQ,EAAE,MAAM,EAChB,OAAO,CAAC,EAAE,sBAAsB,GACjC,OAAO,CAAC,QAAQ,CAAC,CAsCnB;AAED,wBAAsB,kBAAkB,CACpC,OAAO,EAAE,OAAO,EAChB,MAAM,EAAE,0BAA0B,EAClC,IAAI,EAAE,MAAM,EACZ,YAAY,EAAE,MAAM,EACpB,OAAO,CAAC,EAAE,sBAAsB,GACjC,OAAO,CAAC,mBAAmB,CAAC,CA6B9B;AAED,wBAAsB,mBAAmB,CAAC,WAAW,EAAE,MAAM,GAAG,OAAO,CAAC,cAAc,CAAC,CAYtF;AAED,wBAAgB,UAAU,CAAC,OAAO,EAAE,OAAO,EAAE,IAAI,EAAE,MAAM,GAAG,MAAM,GAAG,IAAI,CAgBxE;AAED,wBAAsB,gBAAgB,CAAC,OAAO,EAAE,OAAO,EAAE,KAAK,EAAE,MAAM,GAAG,IAAI,GAAG,OAAO,CAAC,OAAO,CAAC,CAO/F;AAED,wBAAgB,kBAAkB,CAAC,OAAO,EAAE,MAAM,GAAG,SAAS,GAAG,MAAM,GAAG,IAAI,CAqB7E;AAED,wBAAgB,iBAAiB,CAAC,QAAQ,EAAE,QAAQ,EAAE,MAAM,EAAE,OAAO,GAAG,IAAI,CAkB3E;AAED,wBAAgB,eAAe,CAC3B,QAAQ,EAAE,QAAQ,EAClB,IAAI,EAAE,MAAM,EACZ,KAAK,EAAE,MAAM,EACb,OAAO,EAAE;IACL,QAAQ,CAAC,EAAE,OAAO,CAAC;IACnB,MAAM,CAAC,EAAE,OAAO,CAAC;IACjB,QAAQ,CAAC,EAAE,KAAK,GAAG,QAAQ,GAAG,MAAM,CAAC;IACrC,IAAI,CAAC,EAAE,MAAM,CAAC;IACd,MAAM,CAAC,EAAE,MAAM,CAAC;CACnB,GACF,IAAI,CAwBN"}

package/dist/cjs/vercel-oauth.js

@@ -19,7 +19,10 @@ function cookieOptions(secure) {
         maxAge: 10 * 60,
     };
 }
-async function buildVercelAuthorizeRedirect(request, config, returnTo) {
+function resolveCallbackPath(options) {
+    return options?.callbackPath ?? constants_1.VERCEL_CALLBACK_PATH;
+}
+async function buildVercelAuthorizeRedirect(request, config, returnTo, options) {
     if (!config.vercelClientId) {
         return new Response("Vercel OAuth is not configured", { status: 500 });
     }
@@ -28,7 +31,7 @@ async function buildVercelAuthorizeRedirect(request, config, returnTo) {
     const codeVerifier = (0, crypto_1.randomToken)(48);
     const codeChallenge = await (0, crypto_1.sha256Base64Url)(codeVerifier);
     const origin = new URL(request.url).origin;
-    const redirectUri = `${origin}${constants_1.VERCEL_CALLBACK_PATH}`;
+    const redirectUri = `${origin}${resolveCallbackPath(options)}`;
     const secure = origin.startsWith("https://");
     const params = new URLSearchParams({
         client_id: config.vercelClientId,
@@ -53,7 +56,7 @@ async function buildVercelAuthorizeRedirect(request, config, returnTo) {
     appendSetCookie(response, constants_1.OAUTH_RETURN_COOKIE, returnTo || "/", opts);
     return response;
 }
-async function exchangeVercelCode(request, config, code, codeVerifier) {
+async function exchangeVercelCode(request, config, code, codeVerifier, options) {
     if (!config.vercelClientId || !config.vercelClientSecret) {
         throw new Error("Vercel OAuth is not configured");
     }
@@ -64,7 +67,7 @@ async function exchangeVercelCode(request, config, code, codeVerifier) {
         client_secret: config.vercelClientSecret,
         code,
         code_verifier: codeVerifier,
-        redirect_uri: `${origin}${constants_1.VERCEL_CALLBACK_PATH}`,
+        redirect_uri: `${origin}${resolveCallbackPath(options)}`,
     });
     const response = await fetch("https://api.vercel.com/login/oauth/token", {
         method: "POST",
@@ -143,6 +146,7 @@ function clearOAuthCookies(response, secure) {
         constants_1.OAUTH_NONCE_COOKIE,
         constants_1.OAUTH_VERIFIER_COOKIE,
         constants_1.OAUTH_RETURN_COOKIE,
+        constants_1.OAUTH_RETURN_ORIGIN_COOKIE,
     ]) {
         appendSetCookie(response, name, "", expired);
     }

package/dist/es/auth-proxy.d.ts

@@ -0,0 +1,15 @@
+import type { DeploymentProtectionOptions } from "./types";
+/** Fixed OAuth callback path registered once on the Vercel OAuth app. */
+export declare const AUTH_PROXY_CALLBACK_PATH = "/callback";
+export declare const AUTH_PROXY_START_PATH = "/start";
+/**
+ * Auth-proxy entry: verify the signed start request from a protected app, then
+ * begin Sign in with Vercel against this proxy's fixed callback URL.
+ */
+export declare function handleAuthProxyStart(request: Request, options?: DeploymentProtectionOptions): Promise<Response>;
+/**
+ * Auth-proxy Vercel OAuth callback: exchange the code, mint a short-lived handoff
+ * token, and redirect back to the protected app callback.
+ */
+export declare function handleAuthProxyCallback(request: Request, options?: DeploymentProtectionOptions): Promise<Response>;
+//# sourceMappingURL=auth-proxy.d.ts.map

package/dist/es/auth-proxy.d.ts.map

@@ -0,0 +1 @@
+{"version":3,"file":"auth-proxy.d.ts","sourceRoot":"","sources":["../../src/auth-proxy.ts"],"names":[],"mappings":"AAiBA,OAAO,KAAK,EAAE,2BAA2B,EAAE,MAAM,SAAS,CAAC;AAY3D,yEAAyE;AACzE,eAAO,MAAM,wBAAwB,cAAc,CAAC;AACpD,eAAO,MAAM,qBAAqB,WAAW,CAAC;AA0B9C;;;GAGG;AACH,wBAAsB,oBAAoB,CACtC,OAAO,EAAE,OAAO,EAChB,OAAO,GAAE,2BAAgC,GAC1C,OAAO,CAAC,QAAQ,CAAC,CAwCnB;AAED;;;GAGG;AACH,wBAAsB,uBAAuB,CACzC,OAAO,EAAE,OAAO,EAChB,OAAO,GAAE,2BAAgC,GAC1C,OAAO,CAAC,QAAQ,CAAC,CAqEnB"}

package/dist/es/auth-proxy.js

@@ -0,0 +1,130 @@
+import { hasVercelDirectAuth, resolveConfig } from "./config";
+import { OAUTH_NONCE_COOKIE, OAUTH_RETURN_COOKIE, OAUTH_RETURN_ORIGIN_COOKIE, OAUTH_VERIFIER_COOKIE, VERCEL_CALLBACK_PATH, } from "./constants";
+import { timingSafeEqualString } from "./crypto";
+import { createHandoffToken, isReturnOriginAllowed, normalizeReturnOrigin, verifyProxyStartSignature, } from "./handoff";
+import { safeReturnTo } from "./safe-return-to";
+import { appendSetCookie, assertOAuthState, buildVercelAuthorizeRedirect, clearOAuthCookies, decodeIdTokenNonce, exchangeVercelCode, fetchVercelUserInfo, readCookie, } from "./vercel-oauth";
+/** Fixed OAuth callback path registered once on the Vercel OAuth app. */
+export const AUTH_PROXY_CALLBACK_PATH = "/callback";
+export const AUTH_PROXY_START_PATH = "/start";
+function isSecureRequest(request) {
+    return new URL(request.url).protocol === "https:";
+}
+function textResponse(message, status) {
+    return new Response(message, {
+        status,
+        headers: {
+            "Content-Type": "text/plain; charset=utf-8",
+            "Cache-Control": "no-store",
+        },
+    });
+}
+function cookieOptions(secure) {
+    return {
+        httpOnly: true,
+        sameSite: "lax",
+        secure,
+        path: "/",
+        maxAge: 10 * 60,
+    };
+}
+/**
+ * Auth-proxy entry: verify the signed start request from a protected app, then
+ * begin Sign in with Vercel against this proxy's fixed callback URL.
+ */
+export async function handleAuthProxyStart(request, options = {}) {
+    const config = resolveConfig(options);
+    if (!hasVercelDirectAuth(config) || !config.handoffSecret) {
+        return textResponse("Auth proxy is not configured", 500);
+    }
+    const url = new URL(request.url);
+    const returnOrigin = normalizeReturnOrigin(url.searchParams.get("return_origin"));
+    const returnPath = safeReturnTo(url.searchParams.get("return_path"));
+    const expRaw = url.searchParams.get("exp");
+    const nonce = url.searchParams.get("nonce");
+    const sig = url.searchParams.get("sig");
+    const exp = expRaw ? Number(expRaw) : NaN;
+    if (!returnOrigin || !nonce || !Number.isFinite(exp)) {
+        return textResponse("Invalid start request", 400);
+    }
+    if (!isReturnOriginAllowed(returnOrigin, config.allowedReturnOrigins)) {
+        return textResponse("Return origin is not allowed", 403);
+    }
+    const params = {
+        returnOrigin,
+        returnPath,
+        exp,
+        nonce,
+    };
+    if (!(await verifyProxyStartSignature(config.handoffSecret, params, sig))) {
+        return textResponse("Invalid or expired start signature", 403);
+    }
+    const response = await buildVercelAuthorizeRedirect(request, config, returnPath, {
+        callbackPath: AUTH_PROXY_CALLBACK_PATH,
+    });
+    const secure = isSecureRequest(request);
+    appendSetCookie(response, OAUTH_RETURN_ORIGIN_COOKIE, returnOrigin, cookieOptions(secure));
+    return response;
+}
+/**
+ * Auth-proxy Vercel OAuth callback: exchange the code, mint a short-lived handoff
+ * token, and redirect back to the protected app callback.
+ */
+export async function handleAuthProxyCallback(request, options = {}) {
+    const config = resolveConfig(options);
+    if (!hasVercelDirectAuth(config) || !config.handoffSecret) {
+        return textResponse("Auth proxy is not configured", 500);
+    }
+    const url = new URL(request.url);
+    const code = url.searchParams.get("code");
+    const state = url.searchParams.get("state");
+    const secure = isSecureRequest(request);
+    const returnOrigin = normalizeReturnOrigin(readCookie(request, OAUTH_RETURN_ORIGIN_COOKIE));
+    const returnPath = safeReturnTo(readCookie(request, OAUTH_RETURN_COOKIE));
+    const fail = (message, status = 401) => {
+        const response = textResponse(message, status);
+        clearOAuthCookies(response, secure);
+        return response;
+    };
+    if (!returnOrigin) {
+        return fail("Missing return origin", 400);
+    }
+    if (!isReturnOriginAllowed(returnOrigin, config.allowedReturnOrigins)) {
+        return fail("Return origin is not allowed", 403);
+    }
+    if (!code || !(await assertOAuthState(request, state))) {
+        return fail("Vercel sign-in failed (invalid state)");
+    }
+    try {
+        const codeVerifier = readCookie(request, OAUTH_VERIFIER_COOKIE);
+        if (!codeVerifier) {
+            throw new Error("Missing PKCE verifier");
+        }
+        const tokenData = await exchangeVercelCode(request, config, code, codeVerifier, {
+            callbackPath: AUTH_PROXY_CALLBACK_PATH,
+        });
+        const storedNonce = readCookie(request, OAUTH_NONCE_COOKIE);
+        const tokenNonce = decodeIdTokenNonce(tokenData.id_token);
+        if (storedNonce && tokenNonce && !(await timingSafeEqualString(storedNonce, tokenNonce))) {
+            throw new Error("Nonce mismatch");
+        }
+        const user = await fetchVercelUserInfo(tokenData.access_token);
+        const subject = user.preferred_username || user.email || user.sub || "vercel-user";
+        const handoff = await createHandoffToken(config.handoffSecret, returnOrigin, subject);
+        const target = new URL(VERCEL_CALLBACK_PATH, `${returnOrigin}/`);
+        target.searchParams.set("handoff", handoff);
+        target.searchParams.set("return_to", returnPath);
+        const response = new Response(null, {
+            status: 302,
+            headers: {
+                Location: target.toString(),
+                "Cache-Control": "no-store",
+            },
+        });
+        clearOAuthCookies(response, secure);
+        return response;
+    }
+    catch {
+        return fail("Vercel sign-in failed");
+    }
+}

package/dist/es/config.d.ts

@@ -4,6 +4,13 @@ import type { DeploymentProtectionConfig, DeploymentProtectionOptions } from "./
  */
 export declare function resolveConfig(options?: DeploymentProtectionOptions): DeploymentProtectionConfig;
 export declare function hasPasswordAuth(config: DeploymentProtectionConfig): boolean;
+/** Direct Vercel OAuth on the protected app (legacy / single-project setup). */
+export declare function hasVercelDirectAuth(config: DeploymentProtectionConfig): boolean;
+/**
+ * Central auth-proxy mode: apps only need the proxy URL + shared handoff secret.
+ * Vercel client credentials live solely on the proxy.
+ */
+export declare function hasVercelProxyAuth(config: DeploymentProtectionConfig): boolean;
 export declare function hasVercelAuth(config: DeploymentProtectionConfig): boolean;
 /**
  * Protection only runs when enabled and at least one auth method is configured.

package/dist/es/config.d.ts.map

@@ -1 +1 @@
-{"version":3,"file":"config.d.ts","sourceRoot":"","sources":["../../src/config.ts"],"names":[],"mappings":"AAAA,OAAO,KAAK,EAAE,0BAA0B,EAAE,2BAA2B,EAAU,MAAM,SAAS,CAAC;AA0B/F;;GAEG;AACH,wBAAgB,aAAa,CACzB,OAAO,GAAE,2BAAgC,GAC1C,0BAA0B,CA6C5B;AAED,wBAAgB,eAAe,CAAC,MAAM,EAAE,0BAA0B,GAAG,OAAO,CAE3E;AAED,wBAAgB,aAAa,CAAC,MAAM,EAAE,0BAA0B,GAAG,OAAO,CAEzE;AAED;;;GAGG;AACH,wBAAgB,kBAAkB,CAAC,MAAM,EAAE,0BAA0B,GAAG,OAAO,CAK9E"}
+{"version":3,"file":"config.d.ts","sourceRoot":"","sources":["../../src/config.ts"],"names":[],"mappings":"AACA,OAAO,KAAK,EAAE,0BAA0B,EAAE,2BAA2B,EAAU,MAAM,SAAS,CAAC;AA0B/F;;GAEG;AACH,wBAAgB,aAAa,CACzB,OAAO,GAAE,2BAAgC,GAC1C,0BAA0B,CA0D5B;AAED,wBAAgB,eAAe,CAAC,MAAM,EAAE,0BAA0B,GAAG,OAAO,CAE3E;AAED,gFAAgF;AAChF,wBAAgB,mBAAmB,CAAC,MAAM,EAAE,0BAA0B,GAAG,OAAO,CAE/E;AAED;;;GAGG;AACH,wBAAgB,kBAAkB,CAAC,MAAM,EAAE,0BAA0B,GAAG,OAAO,CAE9E;AAED,wBAAgB,aAAa,CAAC,MAAM,EAAE,0BAA0B,GAAG,OAAO,CAEzE;AAED;;;GAGG;AACH,wBAAgB,kBAAkB,CAAC,MAAM,EAAE,0BAA0B,GAAG,OAAO,CAK9E"}

package/dist/es/config.js

@@ -1,3 +1,4 @@
+import { parseAllowlist } from "./handoff";
 const FALSEY = new Set(["0", "false", "no", "off"]);
 function read(env, ...keys) {
     for (const key of keys) {
@@ -29,12 +30,17 @@ export function resolveConfig(options = {}) {
     // Prefer an explicit secret; otherwise derive a stable key from credentials so
     // projects can stay zero-config beyond username/password.
     const secret = explicitSecret ?? (username && password ? `dp:${username}:${password}` : null);
+    const handoffSecret = read(env, "DEPLOYMENT_PROTECTION_HANDOFF_SECRET") ?? explicitSecret ?? secret;
+    const authProxyUrl = read(env, "DEPLOYMENT_PROTECTION_AUTH_PROXY_URL")?.replace(/\/$/, "") ?? null;
     return {
         enabled: isEnabled(env),
         username,
         password,
         secret,
+        handoffSecret,
         bypassSecret: read(env, "VERCEL_AUTOMATION_BYPASS_SECRET", "DEPLOYMENT_PROTECTION_BYPASS_SECRET"),
+        authProxyUrl,
+        allowedReturnOrigins: parseAllowlist(read(env, "DEPLOYMENT_PROTECTION_ALLOWED_ORIGINS", "DEPLOYMENT_PROTECTION_AUTH_PROXY_ALLOWED_ORIGINS")),
         vercelClientId: read(env, "DEPLOYMENT_PROTECTION_VERCEL_CLIENT_ID", "NEXT_PUBLIC_VERCEL_APP_CLIENT_ID", "VERCEL_APP_CLIENT_ID"),
         vercelClientSecret: read(env, "DEPLOYMENT_PROTECTION_VERCEL_CLIENT_SECRET", "VERCEL_APP_CLIENT_SECRET"),
         sessionTtlSeconds: options.sessionTtlSeconds ?? 60 * 60 * 24 * 14,
@@ -49,9 +55,20 @@ export function resolveConfig(options = {}) {
 export function hasPasswordAuth(config) {
     return Boolean(config.username && config.password && config.secret);
 }
-export function hasVercelAuth(config) {
+/** Direct Vercel OAuth on the protected app (legacy / single-project setup). */
+export function hasVercelDirectAuth(config) {
     return Boolean(config.vercelClientId && config.vercelClientSecret && config.secret);
 }
+/**
+ * Central auth-proxy mode: apps only need the proxy URL + shared handoff secret.
+ * Vercel client credentials live solely on the proxy.
+ */
+export function hasVercelProxyAuth(config) {
+    return Boolean(config.authProxyUrl && config.handoffSecret && config.secret);
+}
+export function hasVercelAuth(config) {
+    return hasVercelDirectAuth(config) || hasVercelProxyAuth(config);
+}
 /**
  * Protection only runs when enabled and at least one auth method is configured.
  * Misconfigured+enabled is treated as inactive (fail-open) so local/dev isn't bricked.

package/dist/es/constants.d.ts

@@ -4,6 +4,7 @@ export declare const OAUTH_STATE_COOKIE = "__becklyn_dp_oauth_state";
 export declare const OAUTH_NONCE_COOKIE = "__becklyn_dp_oauth_nonce";
 export declare const OAUTH_VERIFIER_COOKIE = "__becklyn_dp_oauth_verifier";
 export declare const OAUTH_RETURN_COOKIE = "__becklyn_dp_oauth_return";
+export declare const OAUTH_RETURN_ORIGIN_COOKIE = "__becklyn_dp_oauth_return_origin";
 export declare const INTERNAL_PATH_PREFIX = "/_becklyn/deployment-protection";
 export declare const VERCEL_AUTHORIZE_PATH = "/_becklyn/deployment-protection/vercel";
 export declare const VERCEL_CALLBACK_PATH = "/_becklyn/deployment-protection/vercel/callback";