@c1m-public/platform-auth 0.9.1 → 0.9.3

package/dist/access/index.d.ts

@@ -1 +1 @@
-export { a as AccessEntry, b as AccessErrorCode, c as AccessScopeType, A as AccessSnapshot, d as AccessSnapshotError, D as DASH_PERMISSIONS, e as DASH_ROLES, f as DEFAULT_ACCESS_ENDPOINT_PATH, g as DashPermissionKey, h as DashRole, F as FetchAccessSnapshotOptions, L as LEADBROKER_PERMISSIONS, i as LeadBrokerPermissionKey, j as PIPELINE_STAGES, k as PLATFORM_PERMISSIONS, P as PermissionCheckOptions, l as PermissionKey, m as PipelineStage, n as PlatformPermissionKey, W as WORKSPACE_PERMISSIONS, o as WORKSPACE_ROLES, p as WorkspacePermissionKey, q as WorkspaceRole, r as appScopes, s as dashRole, t as emptySnapshot, u as entryCoversApp, v as fetchAccessSnapshot, w as hasAllPermissions, x as hasAnyPermission, y as hasPermission, z as hasWorkspacePermission, B as isAccessSnapshotError, C as isPipelineStage, E as isPlatformOwner, G as managedDashes, H as parseAccessSnapshot, I as permissionsFor } from '../index-CbsCWtku.js';
+export { a as AccessEntry, b as AccessErrorCode, c as AccessScopeType, A as AccessSnapshot, d as AccessSnapshotError, D as DASH_PERMISSIONS, e as DASH_ROLES, f as DEFAULT_ACCESS_ENDPOINT_PATH, g as DashPermissionKey, h as DashRole, F as FetchAccessSnapshotOptions, L as LEADBROKER_PERMISSIONS, i as LeadBrokerPermissionKey, j as PIPELINE_STAGES, k as PLATFORM_PERMISSIONS, P as PermissionCheckOptions, l as PermissionKey, m as PipelineStage, n as PlatformPermissionKey, W as WORKSPACE_PERMISSIONS, o as WORKSPACE_ROLES, p as WorkspacePermissionKey, q as WorkspaceRole, r as appScopes, s as dashRole, t as emptySnapshot, u as entryCoversApp, v as fetchAccessSnapshot, w as hasAllPermissions, x as hasAnyPermission, y as hasPermission, z as hasWorkspacePermission, B as isAccessSnapshotError, C as isPipelineStage, E as isPlatformOwner, G as managedDashes, H as parseAccessSnapshot, I as permissionsFor } from '../index-BcDlVbUd.js';

package/dist/access/index.js

@@ -1,5 +1,6 @@
 // src/access/generated/keys.ts
 var PLATFORM_PERMISSIONS = [
+  "affiliates.enrollments.manage",
   "affiliates.finance.manage",
   "affiliates.partners.manage",
   "affiliates.programmes.manage",

package/dist/access/next.d.ts

@@ -1,5 +1,5 @@
-import { A as AccessSnapshot, P as PermissionCheckOptions, R as Resolvable } from '../index-CbsCWtku.js';
-export { a as AccessEntry, b as AccessErrorCode, c as AccessScopeType, d as AccessSnapshotError, D as DASH_PERMISSIONS, e as DASH_ROLES, f as DEFAULT_ACCESS_ENDPOINT_PATH, g as DashPermissionKey, h as DashRole, F as FetchAccessSnapshotOptions, L as LEADBROKER_PERMISSIONS, i as LeadBrokerPermissionKey, j as PIPELINE_STAGES, k as PLATFORM_PERMISSIONS, l as PermissionKey, m as PipelineStage, n as PlatformPermissionKey, W as WORKSPACE_PERMISSIONS, o as WORKSPACE_ROLES, p as WorkspacePermissionKey, q as WorkspaceRole, r as appScopes, s as dashRole, t as emptySnapshot, u as entryCoversApp, v as fetchAccessSnapshot, w as hasAllPermissions, x as hasAnyPermission, y as hasPermission, z as hasWorkspacePermission, B as isAccessSnapshotError, C as isPipelineStage, E as isPlatformOwner, G as managedDashes, H as parseAccessSnapshot, I as permissionsFor } from '../index-CbsCWtku.js';
+import { A as AccessSnapshot, P as PermissionCheckOptions, R as Resolvable } from '../index-BcDlVbUd.js';
+export { a as AccessEntry, b as AccessErrorCode, c as AccessScopeType, d as AccessSnapshotError, D as DASH_PERMISSIONS, e as DASH_ROLES, f as DEFAULT_ACCESS_ENDPOINT_PATH, g as DashPermissionKey, h as DashRole, F as FetchAccessSnapshotOptions, L as LEADBROKER_PERMISSIONS, i as LeadBrokerPermissionKey, j as PIPELINE_STAGES, k as PLATFORM_PERMISSIONS, l as PermissionKey, m as PipelineStage, n as PlatformPermissionKey, W as WORKSPACE_PERMISSIONS, o as WORKSPACE_ROLES, p as WorkspacePermissionKey, q as WorkspaceRole, r as appScopes, s as dashRole, t as emptySnapshot, u as entryCoversApp, v as fetchAccessSnapshot, w as hasAllPermissions, x as hasAnyPermission, y as hasPermission, z as hasWorkspacePermission, B as isAccessSnapshotError, C as isPipelineStage, E as isPlatformOwner, G as managedDashes, H as parseAccessSnapshot, I as permissionsFor } from '../index-BcDlVbUd.js';
 
 /** Default cache tag for one subject's snapshot: `access:<subjectId>`. */
 declare function accessCacheTag(subjectId: string): string;

package/dist/access/next.js

@@ -1,7 +1,7 @@
 import 'server-only';
 import { cache } from 'react';
-import { forbidden, unauthorized } from 'next/navigation.js';
-import { updateTag } from 'next/cache.js';
+import { forbidden, unauthorized } from 'next/navigation';
+import { updateTag } from 'next/cache';
 
 // src/access/next.ts
 
@@ -251,6 +251,7 @@ function permissionsFor(snapshot, opts = {}) {
 
 // src/access/generated/keys.ts
 var PLATFORM_PERMISSIONS = [
+  "affiliates.enrollments.manage",
   "affiliates.finance.manage",
   "affiliates.partners.manage",
   "affiliates.programmes.manage",

package/dist/{index-CbsCWtku.d.ts → index-BcDlVbUd.d.ts}

@@ -1,5 +1,5 @@
 /** Platform-operator permission keys. */
-declare const PLATFORM_PERMISSIONS: readonly ["affiliates.finance.manage", "affiliates.partners.manage", "affiliates.programmes.manage", "affiliates.view", "linkservice.domains.manage", "linkservice.links.manage", "linkservice.qr.manage", "linkservice.view", "platform.admin.view", "platform.audit.view", "platform.auth.manage", "platform.billing.manage", "platform.channels.manage", "platform.channels.view", "platform.config.manage", "platform.docs.manage", "platform.docs.view", "platform.observability.manage", "platform.observability.view", "platform.offboarding.view", "platform.ops.manage", "platform.support.impersonate", "platform.support.sessions", "platform.tenants.archive", "platform.tenants.manage", "platform.tenants.restore", "platform.users.deactivate", "platform.users.delete", "platform.users.invite", "platform.users.manage_access", "platform.users.reactivate", "platform.users.view"];
+declare const PLATFORM_PERMISSIONS: readonly ["affiliates.enrollments.manage", "affiliates.finance.manage", "affiliates.partners.manage", "affiliates.programmes.manage", "affiliates.view", "linkservice.domains.manage", "linkservice.links.manage", "linkservice.qr.manage", "linkservice.view", "platform.admin.view", "platform.audit.view", "platform.auth.manage", "platform.billing.manage", "platform.channels.manage", "platform.channels.view", "platform.config.manage", "platform.docs.manage", "platform.docs.view", "platform.observability.manage", "platform.observability.view", "platform.offboarding.view", "platform.ops.manage", "platform.support.impersonate", "platform.support.sessions", "platform.tenants.archive", "platform.tenants.manage", "platform.tenants.restore", "platform.users.deactivate", "platform.users.delete", "platform.users.invite", "platform.users.manage_access", "platform.users.reactivate", "platform.users.view"];
 type PlatformPermissionKey = (typeof PLATFORM_PERMISSIONS)[number];
 /** Dash-owner permission keys (granted at dash scope, mirrored from the membership role). */
 declare const DASH_PERMISSIONS: readonly ["dash.apps.manage", "dash.billing.manage", "dash.channels.manage", "dash.customers.manage", "dash.domains.manage", "dash.members.manage", "dash.ownership.transfer", "dash.plans.manage", "dash.publish", "dash.settings.manage", "dash.workspaces.admin", "dash.workspaces.manage"];

package/dist/index.js

@@ -151,12 +151,27 @@ function serializeCookie(name, value, options = {}) {
   return parts.join("; ");
 }
 function setCookie(response, name, value, options) {
-  response.headers.append("Set-Cookie", serializeCookie(name, value, options));
-  return response;
+  return appendSetCookie(response, serializeCookie(name, value, options));
 }
 function deleteCookie(response, name, options) {
-  response.headers.append("Set-Cookie", serializeCookie(name, "", { ...options, maxAge: 0 }));
-  return response;
+  return appendSetCookie(response, serializeCookie(name, "", { ...options, maxAge: 0 }));
+}
+function appendSetCookie(response, cookie) {
+  try {
+    response.headers.append("Set-Cookie", cookie);
+    return response;
+  } catch (error) {
+    if (!(error instanceof TypeError) || !/immutable/i.test(error.message)) {
+      throw error;
+    }
+    const mutable = new Response(response.body, {
+      status: response.status,
+      statusText: response.statusText,
+      headers: response.headers
+    });
+    mutable.headers.append("Set-Cookie", cookie);
+    return mutable;
+  }
 }
 
 // src/device-cookie.ts
@@ -316,8 +331,11 @@ function createHandoffTarget(config) {
   const cookieOptions = { httpOnly: true, secure, sameSite: "lax", path: "/", maxAge: HANDOFF_COOKIE_TTL_SECONDS };
   const timeout = config.timeoutMs ?? config.fetchTimeoutMs ?? DEFAULT_FETCH_TIMEOUT_MS;
   const clearHandoffCookies = (response) => {
-    for (const name of Object.values(cookies)) deleteCookie(response, name, { path: "/", secure });
-    return response;
+    let result = response;
+    for (const name of Object.values(cookies)) {
+      result = deleteCookie(result, name, { path: "/", secure });
+    }
+    return result;
   };
   const fail = (origin, code) => clearHandoffCookies(loginErrorRedirect(origin, config.loginPath, code));
   return {
@@ -335,11 +353,11 @@ function createHandoffTarget(config) {
       const start = new URL(sourceStartPath(config.app), sourceOrigin);
       start.searchParams.set("code_challenge", await s256(verifier));
       start.searchParams.set("state", state);
-      const response = redirect(start);
-      setCookie(response, cookies.verifier, verifier, cookieOptions);
-      setCookie(response, cookies.state, state, cookieOptions);
+      let response = redirect(start);
+      response = setCookie(response, cookies.verifier, verifier, cookieOptions);
+      response = setCookie(response, cookies.state, state, cookieOptions);
       const from = safeInternalPath(url.searchParams.get("from"));
-      if (from) setCookie(response, cookies.from, from, cookieOptions);
+      if (from) response = setCookie(response, cookies.from, from, cookieOptions);
       return response;
     },
     /** GET `?code=&state=` */

package/dist/next.js

@@ -1,5 +1,5 @@
 import 'server-only';
-import { headers, cookies } from 'next/headers.js';
+import { headers, cookies } from 'next/headers';
 
 // src/next.ts
 
@@ -156,12 +156,27 @@ function serializeCookie(name, value, options = {}) {
   return parts.join("; ");
 }
 function setCookie(response, name, value, options) {
-  response.headers.append("Set-Cookie", serializeCookie(name, value, options));
-  return response;
+  return appendSetCookie(response, serializeCookie(name, value, options));
 }
 function deleteCookie(response, name, options) {
-  response.headers.append("Set-Cookie", serializeCookie(name, "", { ...options, maxAge: 0 }));
-  return response;
+  return appendSetCookie(response, serializeCookie(name, "", { ...options, maxAge: 0 }));
+}
+function appendSetCookie(response, cookie) {
+  try {
+    response.headers.append("Set-Cookie", cookie);
+    return response;
+  } catch (error) {
+    if (!(error instanceof TypeError) || !/immutable/i.test(error.message)) {
+      throw error;
+    }
+    const mutable = new Response(response.body, {
+      status: response.status,
+      statusText: response.statusText,
+      headers: response.headers
+    });
+    mutable.headers.append("Set-Cookie", cookie);
+    return mutable;
+  }
 }
 
 // src/device-cookie.ts
@@ -321,8 +336,11 @@ function createHandoffTarget(config) {
   const cookieOptions = { httpOnly: true, secure, sameSite: "lax", path: "/", maxAge: HANDOFF_COOKIE_TTL_SECONDS };
   const timeout = config.timeoutMs ?? config.fetchTimeoutMs ?? DEFAULT_FETCH_TIMEOUT_MS;
   const clearHandoffCookies = (response) => {
-    for (const name of Object.values(cookies)) deleteCookie(response, name, { path: "/", secure });
-    return response;
+    let result = response;
+    for (const name of Object.values(cookies)) {
+      result = deleteCookie(result, name, { path: "/", secure });
+    }
+    return result;
   };
   const fail = (origin, code) => clearHandoffCookies(loginErrorRedirect(origin, config.loginPath, code));
   return {
@@ -340,11 +358,11 @@ function createHandoffTarget(config) {
       const start = new URL(sourceStartPath(config.app), sourceOrigin);
       start.searchParams.set("code_challenge", await s256(verifier));
       start.searchParams.set("state", state);
-      const response = redirect(start);
-      setCookie(response, cookies.verifier, verifier, cookieOptions);
-      setCookie(response, cookies.state, state, cookieOptions);
+      let response = redirect(start);
+      response = setCookie(response, cookies.verifier, verifier, cookieOptions);
+      response = setCookie(response, cookies.state, state, cookieOptions);
       const from = safeInternalPath(url.searchParams.get("from"));
-      if (from) setCookie(response, cookies.from, from, cookieOptions);
+      if (from) response = setCookie(response, cookies.from, from, cookieOptions);
       return response;
     },
     /** GET `?code=&state=` */
@@ -747,10 +765,11 @@ function createSessionStore(config) {
   }
   function writeSessionCookies(response, accessToken, refreshToken, rememberMe = config.defaultRememberMe ?? true) {
     assertAudience(accessToken);
-    setCookie(response, names.session, accessToken, cookieOptions(rememberMe, accessToken));
-    if (refreshToken) setCookie(response, names.refreshToken, refreshToken, cookieOptions(rememberMe, refreshToken));
-    setCookie(response, names.rememberMe, rememberMe ? "true" : "false", cookieOptions(rememberMe));
-    return response;
+    let result = setCookie(response, names.session, accessToken, cookieOptions(rememberMe, accessToken));
+    if (refreshToken) {
+      result = setCookie(result, names.refreshToken, refreshToken, cookieOptions(rememberMe, refreshToken));
+    }
+    return setCookie(result, names.rememberMe, rememberMe ? "true" : "false", cookieOptions(rememberMe));
   }
   async function getAccessToken() {
     const store = await jar("getAccessToken");
@@ -805,8 +824,11 @@ function createSessionStore(config) {
     }
   }
   function clearSessionCookies(response) {
-    for (const name of [names.session, names.refreshToken, names.rememberMe]) deleteCookie(response, name, clearOptions());
-    return response;
+    let result = response;
+    for (const name of [names.session, names.refreshToken, names.rememberMe]) {
+      result = deleteCookie(result, name, clearOptions());
+    }
+    return result;
   }
   async function requireSession() {
     const session = await getSession();

package/package.json

@@ -1,6 +1,6 @@
 {
   "name": "@c1m-public/platform-auth",
-  "version": "0.9.1",
+  "version": "0.9.3",
   "type": "module",
   "license": "MIT",
   "description": "Session and authorization helpers for C1M platform surfaces. The root is runtime-neutral (Web Request/Response): token/session reads, the first-party handoff (PKCE target + source), proxy session gate and coalesced refresh; ./next adds the server-only guard; ./access carries the resolved access snapshot, typed permission keys, predicates, a Next loader and React bindings",