@becklyn/deployment-protection 0.4.0 → 0.4.2

package/dist/es/handler.d.ts.map

@@ -1 +1 @@
-{"version":3,"file":"handler.d.ts","sourceRoot":"","sources":["../../src/handler.ts"],"names":[],"mappings":"AAyBA,OAAO,KAAK,EAA8B,2BAA2B,EAAE,MAAM,SAAS,CAAC;AA4RvF;;GAEG;AACH,wBAAsB,0BAA0B,CAC5C,OAAO,EAAE,OAAO,EAChB,OAAO,GAAE,2BAAgC,GAC1C,OAAO,CAAC,QAAQ,GAAG,IAAI,CAAC,CAqD1B"}
+{"version":3,"file":"handler.d.ts","sourceRoot":"","sources":["../../src/handler.ts"],"names":[],"mappings":"AA0BA,OAAO,KAAK,EAA8B,2BAA2B,EAAE,MAAM,SAAS,CAAC;AAqSvF;;GAEG;AACH,wBAAsB,0BAA0B,CAC5C,OAAO,EAAE,OAAO,EAChB,OAAO,GAAE,2BAAgC,GAC1C,OAAO,CAAC,QAAQ,GAAG,IAAI,CAAC,CAoD1B"}

package/dist/es/handler.js

@@ -1,6 +1,6 @@
 import { isValidBypass, readBypassCookie, readBypassToken, shouldSetBypassCookie } from "./bypass";
 import { hasPasswordAuth, hasVercelAuth, hasVercelDirectAuth, hasVercelProxyAuth, isProtectionActive, resolveConfig, } from "./config";
-import { BYPASS_COOKIE_NAME, BYPASS_HEADER, OAUTH_NONCE_COOKIE, OAUTH_RETURN_COOKIE, OAUTH_VERIFIER_COOKIE, SESSION_COOKIE_NAME, VERCEL_AUTHORIZE_PATH, VERCEL_CALLBACK_PATH, } from "./constants";
+import { BYPASS_COOKIE_NAME, BYPASS_HEADER, OAUTH_NONCE_COOKIE, OAUTH_RETURN_COOKIE, OAUTH_VERIFIER_COOKIE, SESSION_COOKIE_NAME, SET_BYPASS_COOKIE_HEADER, VERCEL_AUTHORIZE_PATH, VERCEL_CALLBACK_PATH, } from "./constants";
 import { timingSafeEqualString } from "./crypto";
 import { buildProxyStartUrl, verifyHandoffToken } from "./handoff";
 import { renderLoginPage } from "./login-page";
@@ -34,11 +34,20 @@ function redirect(request, location, status = 302) {
         },
     });
 }
+/**
+ * Prefer the dedicated session secret; fall back to the automation bypass secret
+ * so a query-param bypass can still persist `__becklyn_dp_session` when no
+ * username/password or explicit HMAC secret is configured.
+ */
+function signingSecret(config) {
+    return config.secret ?? config.bypassSecret;
+}
 async function attachSession(response, config, method, subject, secure) {
-    if (!config.secret) {
+    const secret = signingSecret(config);
+    if (!secret) {
         return response;
     }
-    const token = await createSessionToken(config.secret, method, subject, config.sessionTtlSeconds);
+    const token = await createSessionToken(secret, method, subject, config.sessionTtlSeconds);
     const opts = sessionCookieOptions(config.sessionTtlSeconds, secure);
     appendSetCookie(response, SESSION_COOKIE_NAME, token, opts);
     return response;
@@ -54,10 +63,12 @@ async function handleBypass(request, config) {
     const setCookieMode = shouldSetBypassCookie(request);
     const url = new URL(request.url);
     const hadQueryBypass = url.searchParams.has(BYPASS_HEADER);
-    const hadSetCookieQuery = url.searchParams.has("x-vercel-set-bypass-cookie");
+    const hadSetCookieQuery = url.searchParams.has(SET_BYPASS_COOKIE_HEADER);
+    // Query-param bypass (and the Vercel set-cookie helper) persist auth, then
+    // strip secrets from the URL. Header-only automation stays one-shot.
     if (hadQueryBypass || hadSetCookieQuery || setCookieMode) {
         url.searchParams.delete(BYPASS_HEADER);
-        url.searchParams.delete("x-vercel-set-bypass-cookie");
+        url.searchParams.delete(SET_BYPASS_COOKIE_HEADER);
         const response = redirect(request, url.pathname + url.search + url.hash);
         const secure = isSecureRequest(request);
         if (setCookieMode || hadSetCookieQuery) {
@@ -69,6 +80,7 @@ async function handleBypass(request, config) {
                 sameSite: setCookieMode === "samesitenone" ? "none" : "lax",
             });
         }
+        // Always persist a signed session when the bypass secret arrived via query.
         await attachSession(response, config, "bypass", "automation", secure);
         return { kind: "respond", response };
     }
@@ -230,8 +242,9 @@ export async function handleDeploymentProtection(request, options = {}) {
     if (bypass.kind === "allow") {
         return null;
     }
-    if (config.secret) {
-        const session = await verifySessionToken(config.secret, readCookie(request, SESSION_COOKIE_NAME));
+    const secret = signingSecret(config);
+    if (secret) {
+        const session = await verifySessionToken(secret, readCookie(request, SESSION_COOKIE_NAME));
         if (session) {
             return null;
         }

package/dist/es/middleware.d.ts.map

@@ -1 +1 @@
-{"version":3,"file":"middleware.d.ts","sourceRoot":"","sources":["../../src/middleware.ts"],"names":[],"mappings":"AAAA,OAAO,EAAE,KAAK,WAAW,EAAE,YAAY,EAAE,MAAM,aAAa,CAAC;AAE7D,OAAO,KAAK,EAAE,2BAA2B,EAAE,MAAM,SAAS,CAAC;AAE3D,KAAK,cAAc,GAAG,CAClB,OAAO,EAAE,WAAW,EACpB,KAAK,CAAC,EAAE,OAAO,KAEb,QAAQ,GACR,YAAY,GACZ,OAAO,CAAC,QAAQ,GAAG,YAAY,GAAG,SAAS,GAAG,IAAI,CAAC,GACnD,SAAS,GACT,IAAI,CAAC;AAEX,MAAM,MAAM,4BAA4B,GAClC,EAAE,GACF,CAAC,2BAA2B,CAAC,GAC7B,CAAC,cAAc,CAAC,GAChB,CAAC,cAAc,EAAE,2BAA2B,CAAC,CAAC;AA8DpD;;;;;;;;;;;;;;;;;;;;;;;;;;;;GA4BG;AACH,wBAAgB,wBAAwB,CAAC,GAAG,IAAI,EAAE,4BAA4B,IAgBtE,SAAS,WAAW,EACpB,QAAQ,OAAO,KAChB,OAAO,CAAC,QAAQ,GAAG,YAAY,CAAC,CActC"}
+{"version":3,"file":"middleware.d.ts","sourceRoot":"","sources":["../../src/middleware.ts"],"names":[],"mappings":"AAAA,OAAO,EAAE,KAAK,WAAW,EAAE,YAAY,EAAE,MAAM,aAAa,CAAC;AAE7D,OAAO,KAAK,EAAE,2BAA2B,EAAE,MAAM,SAAS,CAAC;AAE3D,KAAK,cAAc,GAAG,CAClB,OAAO,EAAE,WAAW,EACpB,KAAK,CAAC,EAAE,OAAO,KAEb,QAAQ,GACR,YAAY,GACZ,OAAO,CAAC,QAAQ,GAAG,YAAY,GAAG,SAAS,GAAG,IAAI,CAAC,GACnD,SAAS,GACT,IAAI,CAAC;AAEX,MAAM,MAAM,4BAA4B,GAClC,EAAE,GACF,CAAC,2BAA2B,CAAC,GAC7B,CAAC,cAAc,CAAC,GAChB,CAAC,cAAc,EAAE,2BAA2B,CAAC,CAAC;AA8JpD;;;;;;;;;;;;;;;;;;;;;;;;;;;;GA4BG;AACH,wBAAgB,wBAAwB,CAAC,GAAG,IAAI,EAAE,4BAA4B,IAgBtE,SAAS,WAAW,EACpB,QAAQ,OAAO,KAChB,OAAO,CAAC,QAAQ,GAAG,YAAY,CAAC,CActC"}

package/dist/es/middleware.js

@@ -6,12 +6,95 @@ function isOptions(value) {
         !Array.isArray(value) &&
         typeof value !== "function");
 }
+function decodeCookieValue(value) {
+    try {
+        return decodeURIComponent(value);
+    }
+    catch {
+        return value;
+    }
+}
+function parseSetCookie(header) {
+    const parts = header
+        .split(";")
+        .map(part => part.trim())
+        .filter(Boolean);
+    const first = parts.shift();
+    if (!first) {
+        return null;
+    }
+    const separator = first.indexOf("=");
+    if (separator <= 0) {
+        return null;
+    }
+    const parsed = {
+        name: first.slice(0, separator),
+        value: decodeCookieValue(first.slice(separator + 1)),
+    };
+    for (const part of parts) {
+        const [rawKey, ...rest] = part.split("=");
+        const key = rawKey?.toLowerCase();
+        const attrValue = rest.join("=");
+        if (key === "httponly") {
+            parsed.httpOnly = true;
+        }
+        else if (key === "secure") {
+            parsed.secure = true;
+        }
+        else if (key === "path") {
+            parsed.path = attrValue;
+        }
+        else if (key === "max-age") {
+            const maxAge = Number(attrValue);
+            if (!Number.isNaN(maxAge)) {
+                parsed.maxAge = maxAge;
+            }
+        }
+        else if (key === "samesite") {
+            const sameSite = attrValue.toLowerCase();
+            if (sameSite === "lax" || sameSite === "strict" || sameSite === "none") {
+                parsed.sameSite = sameSite;
+            }
+        }
+    }
+    return parsed;
+}
+function readSetCookieHeaders(headers) {
+    if (typeof headers.getSetCookie === "function") {
+        const cookies = headers.getSetCookie();
+        if (cookies.length > 0) {
+            return cookies;
+        }
+    }
+    const single = headers.get("set-cookie");
+    return single ? [single] : [];
+}
+/**
+ * Next.js middleware only reliably applies cookies set via `NextResponse.cookies`.
+ * Copying raw `Set-Cookie` headers onto a redirect is ignored by the runtime.
+ */
+function applyCookies(from, to) {
+    for (const header of readSetCookieHeaders(from.headers)) {
+        const cookie = parseSetCookie(header);
+        if (!cookie) {
+            continue;
+        }
+        to.cookies.set(cookie.name, cookie.value, {
+            httpOnly: cookie.httpOnly,
+            secure: cookie.secure,
+            path: cookie.path,
+            maxAge: cookie.maxAge,
+            sameSite: cookie.sameSite,
+        });
+    }
+}
 function toNextResponse(request, response) {
     const location = response.headers.get("Location");
     if (location && response.status >= 300 && response.status < 400) {
         // Always resolve against the incoming request so relative Locations never reach Next.
         const redirectResponse = NextResponse.redirect(new URL(location, request.url), response.status);
         copyHeaders(response, redirectResponse, /* skipLocation */ true);
+        applyCookies(response, redirectResponse);
         return redirectResponse;
     }
     const nextResponse = new NextResponse(response.body, {
@@ -19,22 +102,14 @@ function toNextResponse(request, response) {
         statusText: response.statusText,
     });
     copyHeaders(response, nextResponse, false);
+    applyCookies(response, nextResponse);
     return nextResponse;
 }
 function copyHeaders(from, to, skipLocation) {
-    const setCookies = typeof from.headers.getSetCookie === "function" ? from.headers.getSetCookie() : [];
-    if (setCookies.length > 0) {
-        for (const cookie of setCookies) {
-            to.headers.append("Set-Cookie", cookie);
-        }
-    }
     from.headers.forEach((value, key) => {
         const lower = key.toLowerCase();
         if (lower === "set-cookie") {
-            // Already copied via getSetCookie when available; fall back otherwise.
-            if (setCookies.length === 0) {
-                to.headers.append("Set-Cookie", value);
-            }
+            // Applied via NextResponse.cookies so the middleware runtime honors them.
             return;
         }
         if (skipLocation && lower === "location") {

package/dist/es/storybook.d.ts

@@ -1,10 +1,14 @@
 /**
  * Storybook deployment protection for Vercel.
  *
- * Built Storybooks are static sites, so protection runs as **Vercel Edge Middleware**
+ * Built Storybooks are static sites, so protection runs as **Vercel Routing Middleware**
  * (not Storybook config). Drop a `middleware.ts` next to the Vercel project root that
  * serves `storybook-static` and set the same env vars as the Next.js integration.
  *
+ * The published `./storybook` and `./edge` entry points resolve to self-contained ESM
+ * bundles so Vercel edge/nodejs middleware can load them without tracing multi-file
+ * package internals.
+ *
  * @example middleware.ts
  * ```ts
  * import { withStorybookDeploymentProtection } from "@becklyn/deployment-protection/storybook";
@@ -19,7 +23,7 @@
  * };
  * ```
  *
- * Optional `vercel.json` for a Storybook-only project:
+ * Optional `vercel.json` for a Storybook-only project (`framework` must be `null`):
  * ```json
  * {
  *   "buildCommand": "npm run build-storybook",

package/dist/es/storybook.d.ts.map

@@ -1 +1 @@
-{"version":3,"file":"storybook.d.ts","sourceRoot":"","sources":["../../src/storybook.ts"],"names":[],"mappings":"AAAA;;;;;;;;;;;;;;;;;;;;;;;;;;;;;GA6BG;AACH,OAAO,EACH,qBAAqB,EACrB,4BAA4B,IAAI,iCAAiC,GACpE,MAAM,QAAQ,CAAC;AAChB,YAAY,EAAE,2BAA2B,EAAE,MAAM,SAAS,CAAC"}
+{"version":3,"file":"storybook.d.ts","sourceRoot":"","sources":["../../src/storybook.ts"],"names":[],"mappings":"AAAA;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;GAiCG;AACH,OAAO,EACH,qBAAqB,EACrB,4BAA4B,IAAI,iCAAiC,GACpE,MAAM,QAAQ,CAAC;AAChB,YAAY,EAAE,2BAA2B,EAAE,MAAM,SAAS,CAAC"}

package/dist/es/storybook.js

@@ -1,10 +1,14 @@
 /**
  * Storybook deployment protection for Vercel.
  *
- * Built Storybooks are static sites, so protection runs as **Vercel Edge Middleware**
+ * Built Storybooks are static sites, so protection runs as **Vercel Routing Middleware**
  * (not Storybook config). Drop a `middleware.ts` next to the Vercel project root that
  * serves `storybook-static` and set the same env vars as the Next.js integration.
  *
+ * The published `./storybook` and `./edge` entry points resolve to self-contained ESM
+ * bundles so Vercel edge/nodejs middleware can load them without tracing multi-file
+ * package internals.
+ *
  * @example middleware.ts
  * ```ts
  * import { withStorybookDeploymentProtection } from "@becklyn/deployment-protection/storybook";
@@ -19,7 +23,7 @@
  * };
  * ```
  *
- * Optional `vercel.json` for a Storybook-only project:
+ * Optional `vercel.json` for a Storybook-only project (`framework` must be `null`):
  * ```json
  * {
  *   "buildCommand": "npm run build-storybook",