@cas-system/nextjs-cas-client 1.0.0

package/LICENSE

@@ -0,0 +1,21 @@
+MIT License
+
+Copyright (c) 2026 InSol-2021
+
+Permission is hereby granted, free of charge, to any person obtaining a copy
+of this software and associated documentation files (the "Software"), to deal
+in the Software without restriction, including without limitation the rights
+to use, copy, modify, merge, publish, distribute, sublicense, and/or sell
+copies of the Software, and to permit persons to whom the Software is
+furnished to do so, subject to the following conditions:
+
+The above copyright notice and this permission notice shall be included in all
+copies or substantial portions of the Software.
+
+THE SOFTWARE IS PROVIDED "AS IS", WITHOUT WARRANTY OF ANY KIND, EXPRESS OR
+IMPLIED, INCLUDING BUT NOT LIMITED TO THE WARRANTIES OF MERCHANTABILITY,
+FITNESS FOR A PARTICULAR PURPOSE AND NONINFRINGEMENT. IN NO EVENT SHALL THE
+AUTHORS OR COPYRIGHT HOLDERS BE LIABLE FOR ANY CLAIM, DAMAGES OR OTHER
+LIABILITY, WHETHER IN AN ACTION OF CONTRACT, TORT OR OTHERWISE, ARISING FROM,
+OUT OF OR IN CONNECTION WITH THE SOFTWARE OR THE USE OR OTHER DEALINGS IN THE
+SOFTWARE.

package/README.md

@@ -0,0 +1,148 @@
+# @cas-system/nextjs-cas-client
+
+Next.js CAS (Central Authentication System) Client SDK for the **One System** CAS server.
+Supports the App Router, Server Components, Route Handlers, Middleware, and client-side hooks.
+
+## Install
+
+```bash
+npm install @cas-system/nextjs-cas-client
+# peer deps: next >= 14, react >= 18, react-dom >= 18
+# runtime: Node.js >= 18.17 (App Router). Verified on Node 22.
+```
+
+## How the SSO flow works
+
+1. The browser is redirected to `GET {CAS_SERVER_URL}/sso/login?client_id={CLIENT_ID}`.
+2. After authenticating, the CAS server 302-redirects to your registered callback URL
+   with the token appended: `{callbackUrl}?token={JWT}`.
+3. Your callback route handler reads the `token` query parameter and validates it
+   **server-to-server** via `POST {CAS_SERVER_URL}/api/validate-token`
+   (body: `{ token, client_id, client_secret }`). The token is **single-use**.
+4. On success the handler establishes an `HttpOnly`, signed session cookie.
+
+## Configuration
+
+Server-side configuration (`CasServerConfig`):
+
+| Field          | Env var (suggested)   | Description                                  |
+| -------------- | --------------------- | -------------------------------------------- |
+| `serverUrl`    | `CAS_SERVER_URL`      | Base URL of the CAS server (no trailing `/`) |
+| `clientId`     | `CAS_CLIENT_ID`       | Registered client identifier                 |
+| `clientSecret` | `CAS_CLIENT_SECRET`   | Secret for server-to-server token validation |
+| `callbackUrl`  | `CAS_CALLBACK_URL`    | Optional; defaults to `/api/cas/callback`    |
+
+The session cookie is signed with `CAS_COOKIE_SECRET` (falls back to `CAS_CLIENT_SECRET`).
+
+## Route handlers (App Router)
+
+```ts
+// app/api/cas/callback/route.ts
+import { createCallbackHandler } from '@cas-system/nextjs-cas-client/handlers';
+
+export const GET = createCallbackHandler({
+  cas: {
+    serverUrl: process.env.CAS_SERVER_URL!,
+    clientId: process.env.CAS_CLIENT_ID!,
+    clientSecret: process.env.CAS_CLIENT_SECRET!,
+  },
+  afterLoginUrl: '/dashboard',
+});
+```
+
+```ts
+// app/api/cas/logout/route.ts
+import { createLogoutHandler } from '@cas-system/nextjs-cas-client/handlers';
+
+export const POST = createLogoutHandler({
+  cas: {
+    serverUrl: process.env.CAS_SERVER_URL!,
+    clientId: process.env.CAS_CLIENT_ID!,
+    clientSecret: process.env.CAS_CLIENT_SECRET!,
+  },
+  afterLogoutUrl: '/',
+});
+```
+
+```ts
+// app/api/cas/user/route.ts
+import { createUserHandler } from '@cas-system/nextjs-cas-client/handlers';
+
+export const GET = createUserHandler();
+```
+
+## Middleware
+
+```ts
+// middleware.ts
+import { createCasMiddleware } from '@cas-system/nextjs-cas-client/middleware';
+
+export default createCasMiddleware({
+  protectedPaths: ['/dashboard', '/admin'],
+  publicPaths: ['/api/health'],
+  loginPath: '/login', // optional
+});
+
+export const config = {
+  matcher: ['/((?!_next/static|_next/image|favicon.ico).*)'],
+};
+```
+
+The middleware reads `CAS_SERVER_URL`, `CAS_CLIENT_ID`, and `CAS_CALLBACK_URL`
+from the environment when `loginPath` is not configured.
+
+## Client provider + hooks
+
+```tsx
+// app/layout.tsx
+import { CasProvider } from '@cas-system/nextjs-cas-client';
+
+export default function RootLayout({ children }: { children: React.ReactNode }) {
+  return (
+    <html>
+      <body>
+        {/* casServerUrl / casClientId / casCallbackUrl let login() build the
+            CAS SSO redirect. They are NEXT_PUBLIC_* (no secret). */}
+        <CasProvider
+          casServerUrl={process.env.NEXT_PUBLIC_CAS_SERVER_URL}
+          casClientId={process.env.NEXT_PUBLIC_CAS_CLIENT_ID}
+          casCallbackUrl={process.env.NEXT_PUBLIC_CAS_CALLBACK_URL}
+        >
+          {children}
+        </CasProvider>
+      </body>
+    </html>
+  );
+}
+```
+
+```tsx
+'use client';
+import { useCasAuth, useCasUser, CasLoginButton, CasProtectedRoute } from '@cas-system/nextjs-cas-client';
+
+export function Navbar() {
+  const { user, isAuthenticated, login, logout } = useCasAuth();
+  return isAuthenticated
+    ? <button onClick={logout}>Sign out ({user?.username})</button>
+    : <CasLoginButton>Sign in with SSO</CasLoginButton>;
+}
+```
+
+## Server-side session helpers
+
+```ts
+import { cookies } from 'next/headers';
+import { getCasSession, withCasAuth, CasClient } from '@cas-system/nextjs-cas-client/server';
+
+// In a Server Component / Route Handler
+const session = await getCasSession(await cookies());
+
+// Protect a route handler
+export const GET = withCasAuth(async (req, ctx, user) => {
+  return Response.json({ message: `Hello ${user.username}` });
+});
+```
+
+## License
+
+MIT

package/dist/CasProvider.d.ts

@@ -0,0 +1,63 @@
+/**
+ * @module @cas-system/nextjs-cas-client/CasProvider
+ * @description Client-side React context provider that manages CAS
+ * authentication state.  Fetches the current session from
+ * `/api/cas/user` on mount and exposes login / logout / refresh actions.
+ *
+ * @example
+ * ```tsx
+ * // app/layout.tsx
+ * import { CasProvider } from '@cas-system/nextjs-cas-client';
+ *
+ * export default function RootLayout({ children }: { children: React.ReactNode }) {
+ *   return (
+ *     <html>
+ *       <body>
+ *         <CasProvider>{children}</CasProvider>
+ *       </body>
+ *     </html>
+ *   );
+ * }
+ * ```
+ */
+import React from 'react';
+import type { CasAuthContext } from './types';
+/** Props accepted by {@link CasProvider}. */
+export interface CasProviderProps {
+    children: React.ReactNode;
+    /**
+     * Custom endpoint that returns the current user JSON.
+     * @default '/api/cas/user'
+     */
+    userEndpoint?: string;
+    /**
+     * Custom endpoint for logout.
+     * @default '/api/cas/logout'
+     */
+    logoutEndpoint?: string;
+    /**
+     * CAS login URL (client-side redirect).
+     * When omitted the provider builds it from `casServerUrl` and `casClientId`.
+     */
+    loginUrl?: string;
+    /** CAS server URL — used to build the login redirect when `loginUrl` is not provided. */
+    casServerUrl?: string;
+    /** CAS client ID — used to build the login redirect when `loginUrl` is not provided. */
+    casClientId?: string;
+    /** Callback URL — used to build the login redirect when `loginUrl` is not provided. */
+    casCallbackUrl?: string;
+}
+/**
+ * Client-side authentication provider.
+ *
+ * Wrap your application (typically in `app/layout.tsx`) with this provider to
+ * make CAS auth state available to all client components via the
+ * {@link useCasAuth} and {@link useCasUser} hooks.
+ */
+export declare function CasProvider({ children, userEndpoint, logoutEndpoint, loginUrl: loginUrlProp, casServerUrl, casClientId, casCallbackUrl, }: CasProviderProps): React.JSX.Element;
+/**
+ * Access the CAS auth context.  Must be called inside a `<CasProvider>`.
+ * @throws If used outside of a `CasProvider`.
+ */
+export declare function useCasAuthContext(): CasAuthContext;
+//# sourceMappingURL=CasProvider.d.ts.map

package/dist/CasProvider.d.ts.map

@@ -0,0 +1 @@
+{"version":3,"file":"CasProvider.d.ts","sourceRoot":"","sources":["../src/CasProvider.tsx"],"names":[],"mappings":"AAEA;;;;;;;;;;;;;;;;;;;;;GAqBG;AAEH,OAAO,KAON,MAAM,OAAO,CAAC;AACf,OAAO,KAAK,EAAE,cAAc,EAAW,MAAM,SAAS,CAAC;AAYvD,6CAA6C;AAC7C,MAAM,WAAW,gBAAgB;IAC/B,QAAQ,EAAE,KAAK,CAAC,SAAS,CAAC;IAE1B;;;OAGG;IACH,YAAY,CAAC,EAAE,MAAM,CAAC;IAEtB;;;OAGG;IACH,cAAc,CAAC,EAAE,MAAM,CAAC;IAExB;;;OAGG;IACH,QAAQ,CAAC,EAAE,MAAM,CAAC;IAElB,yFAAyF;IACzF,YAAY,CAAC,EAAE,MAAM,CAAC;IAEtB,wFAAwF;IACxF,WAAW,CAAC,EAAE,MAAM,CAAC;IAErB,uFAAuF;IACvF,cAAc,CAAC,EAAE,MAAM,CAAC;CACzB;AAMD;;;;;;GAMG;AACH,wBAAgB,WAAW,CAAC,EAC1B,QAAQ,EACR,YAA8B,EAC9B,cAAkC,EAClC,QAAQ,EAAE,YAAY,EACtB,YAAY,EACZ,WAAW,EACX,cAAc,GACf,EAAE,gBAAgB,qBA8GlB;AAMD;;;GAGG;AACH,wBAAgB,iBAAiB,IAAI,cAAc,CASlD"}

package/dist/CasProvider.js

@@ -0,0 +1,150 @@
+'use client';
+import { jsx as _jsx } from "react/jsx-runtime";
+/**
+ * @module @cas-system/nextjs-cas-client/CasProvider
+ * @description Client-side React context provider that manages CAS
+ * authentication state.  Fetches the current session from
+ * `/api/cas/user` on mount and exposes login / logout / refresh actions.
+ *
+ * @example
+ * ```tsx
+ * // app/layout.tsx
+ * import { CasProvider } from '@cas-system/nextjs-cas-client';
+ *
+ * export default function RootLayout({ children }: { children: React.ReactNode }) {
+ *   return (
+ *     <html>
+ *       <body>
+ *         <CasProvider>{children}</CasProvider>
+ *       </body>
+ *     </html>
+ *   );
+ * }
+ * ```
+ */
+import { createContext, useCallback, useContext, useEffect, useMemo, useState, } from 'react';
+// ---------------------------------------------------------------------------
+// Context
+// ---------------------------------------------------------------------------
+const CasContext = createContext(undefined);
+// ---------------------------------------------------------------------------
+// Provider component
+// ---------------------------------------------------------------------------
+/**
+ * Client-side authentication provider.
+ *
+ * Wrap your application (typically in `app/layout.tsx`) with this provider to
+ * make CAS auth state available to all client components via the
+ * {@link useCasAuth} and {@link useCasUser} hooks.
+ */
+export function CasProvider({ children, userEndpoint = '/api/cas/user', logoutEndpoint = '/api/cas/logout', loginUrl: loginUrlProp, casServerUrl, casClientId, casCallbackUrl, }) {
+    const [user, setUser] = useState(null);
+    const [isLoading, setIsLoading] = useState(true);
+    const [error, setError] = useState(null);
+    // -----------------------------------------------------------------------
+    // Fetch current session
+    // -----------------------------------------------------------------------
+    const fetchUser = useCallback(async () => {
+        setIsLoading(true);
+        setError(null);
+        try {
+            const res = await fetch(userEndpoint, {
+                credentials: 'same-origin',
+                cache: 'no-store',
+            });
+            if (res.ok) {
+                const data = (await res.json());
+                setUser(data.user ?? null);
+            }
+            else {
+                setUser(null);
+            }
+        }
+        catch (err) {
+            setUser(null);
+            setError(err instanceof Error ? err : new Error('Failed to fetch CAS session'));
+        }
+        finally {
+            setIsLoading(false);
+        }
+    }, [userEndpoint]);
+    useEffect(() => {
+        void fetchUser();
+    }, [fetchUser]);
+    // -----------------------------------------------------------------------
+    // Actions
+    // -----------------------------------------------------------------------
+    const login = useCallback((returnUrl) => {
+        if (loginUrlProp) {
+            const url = new URL(loginUrlProp);
+            if (returnUrl)
+                url.searchParams.set('returnUrl', returnUrl);
+            window.location.href = url.toString();
+            return;
+        }
+        if (casServerUrl && casClientId) {
+            const callback = casCallbackUrl ??
+                `${window.location.origin}/api/cas/callback`;
+            const callbackWithReturn = new URL(callback);
+            if (returnUrl)
+                callbackWithReturn.searchParams.set('returnUrl', returnUrl);
+            const params = new URLSearchParams({
+                client_id: casClientId,
+                response_type: 'token',
+                redirect_uri: callbackWithReturn.toString(),
+            });
+            window.location.href = `${casServerUrl.replace(/\/+$/, '')}/sso/login?${params.toString()}`;
+            return;
+        }
+        // Fallback — redirect to a local login page
+        const url = new URL('/login', window.location.origin);
+        if (returnUrl)
+            url.searchParams.set('returnUrl', returnUrl);
+        window.location.href = url.toString();
+    }, [loginUrlProp, casServerUrl, casClientId, casCallbackUrl]);
+    const logout = useCallback(async () => {
+        try {
+            await fetch(logoutEndpoint, {
+                method: 'POST',
+                credentials: 'same-origin',
+            });
+        }
+        catch {
+            // Ignore — cookie might already be gone
+        }
+        setUser(null);
+        window.location.href = '/';
+    }, [logoutEndpoint]);
+    const refresh = useCallback(async () => {
+        await fetchUser();
+    }, [fetchUser]);
+    // -----------------------------------------------------------------------
+    // Memoised context value
+    // -----------------------------------------------------------------------
+    const value = useMemo(() => ({
+        user,
+        isLoading,
+        isAuthenticated: !!user,
+        error,
+        login,
+        logout,
+        refresh,
+    }), [user, isLoading, error, login, logout, refresh]);
+    return _jsx(CasContext.Provider, { value: value, children: children });
+}
+// ---------------------------------------------------------------------------
+// Hook (also re-exported from hooks/)
+// ---------------------------------------------------------------------------
+/**
+ * Access the CAS auth context.  Must be called inside a `<CasProvider>`.
+ * @throws If used outside of a `CasProvider`.
+ */
+export function useCasAuthContext() {
+    const ctx = useContext(CasContext);
+    if (!ctx) {
+        throw new Error('useCasAuthContext must be used within a <CasProvider>. ' +
+            'Wrap your app in <CasProvider> in your root layout.');
+    }
+    return ctx;
+}
+//# sourceMappingURL=CasProvider.js.map

package/dist/CasProvider.js.map

@@ -0,0 +1 @@
+{"version":3,"file":"CasProvider.js","sourceRoot":"","sources":["../src/CasProvider.tsx"],"names":[],"mappings":"AAAA,YAAY,CAAC;;AAEb;;;;;;;;;;;;;;;;;;;;;GAqBG;AAEH,OAAc,EACZ,aAAa,EACb,WAAW,EACX,UAAU,EACV,SAAS,EACT,OAAO,EACP,QAAQ,GACT,MAAM,OAAO,CAAC;AAGf,8EAA8E;AAC9E,UAAU;AACV,8EAA8E;AAE9E,MAAM,UAAU,GAAG,aAAa,CAA6B,SAAS,CAAC,CAAC;AAsCxE,8EAA8E;AAC9E,qBAAqB;AACrB,8EAA8E;AAE9E;;;;;;GAMG;AACH,MAAM,UAAU,WAAW,CAAC,EAC1B,QAAQ,EACR,YAAY,GAAG,eAAe,EAC9B,cAAc,GAAG,iBAAiB,EAClC,QAAQ,EAAE,YAAY,EACtB,YAAY,EACZ,WAAW,EACX,cAAc,GACG;IACjB,MAAM,CAAC,IAAI,EAAE,OAAO,CAAC,GAAG,QAAQ,CAAiB,IAAI,CAAC,CAAC;IACvD,MAAM,CAAC,SAAS,EAAE,YAAY,CAAC,GAAG,QAAQ,CAAC,IAAI,CAAC,CAAC;IACjD,MAAM,CAAC,KAAK,EAAE,QAAQ,CAAC,GAAG,QAAQ,CAAe,IAAI,CAAC,CAAC;IAEvD,0EAA0E;IAC1E,wBAAwB;IACxB,0EAA0E;IAE1E,MAAM,SAAS,GAAG,WAAW,CAAC,KAAK,IAAI,EAAE;QACvC,YAAY,CAAC,IAAI,CAAC,CAAC;QACnB,QAAQ,CAAC,IAAI,CAAC,CAAC;QACf,IAAI,CAAC;YACH,MAAM,GAAG,GAAG,MAAM,KAAK,CAAC,YAAY,EAAE;gBACpC,WAAW,EAAE,aAAa;gBAC1B,KAAK,EAAE,UAAU;aAClB,CAAC,CAAC;YACH,IAAI,GAAG,CAAC,EAAE,EAAE,CAAC;gBACX,MAAM,IAAI,GAAG,CAAC,MAAM,GAAG,CAAC,IAAI,EAAE,CAAsB,CAAC;gBACrD,OAAO,CAAC,IAAI,CAAC,IAAI,IAAI,IAAI,CAAC,CAAC;YAC7B,CAAC;iBAAM,CAAC;gBACN,OAAO,CAAC,IAAI,CAAC,CAAC;YAChB,CAAC;QACH,CAAC;QAAC,OAAO,GAAG,EAAE,CAAC;YACb,OAAO,CAAC,IAAI,CAAC,CAAC;YACd,QAAQ,CACN,GAAG,YAAY,KAAK,CAAC,CAAC,CAAC,GAAG,CAAC,CAAC,CAAC,IAAI,KAAK,CAAC,6BAA6B,CAAC,CACtE,CAAC;QACJ,CAAC;gBAAS,CAAC;YACT,YAAY,CAAC,KAAK,CAAC,CAAC;QACtB,CAAC;IACH,CAAC,EAAE,CAAC,YAAY,CAAC,CAAC,CAAC;IAEnB,SAAS,CAAC,GAAG,EAAE;QACb,KAAK,SAAS,EAAE,CAAC;IACnB,CAAC,EAAE,CAAC,SAAS,CAAC,CAAC,CAAC;IAEhB,0EAA0E;IAC1E,UAAU;IACV,0EAA0E;IAE1E,MAAM,KAAK,GAAG,WAAW,CACvB,CAAC,SAAkB,EAAE,EAAE;QACrB,IAAI,YAAY,EAAE,CAAC;YACjB,MAAM,GAAG,GAAG,IAAI,GAAG,CAAC,YAAY,CAAC,CAAC;YAClC,IAAI,SAAS;gBAAE,GAAG,CAAC,YAAY,CAAC,GAAG,CAAC,WAAW,EAAE,SAAS,CAAC,CAAC;YAC5D,MAAM,CAAC,QAAQ,CAAC,IAAI,GAAG,GAAG,CAAC,QAAQ,EAAE,CAAC;YACtC,OAAO;QACT,CAAC;QAED,IAAI,YAAY,IAAI,WAAW,EAAE,CAAC;YAChC,MAAM,QAAQ,GACZ,cAAc;gBACd,GAAG,MAAM,CAAC,QAAQ,CAAC,MAAM,mBAAmB,CAAC;YAE/C,MAAM,kBAAkB,GAAG,IAAI,GAAG,CAAC,QAAQ,CAAC,CAAC;YAC7C,IAAI,SAAS;gBAAE,kBAAkB,CAAC,YAAY,CAAC,GAAG,CAAC,WAAW,EAAE,SAAS,CAAC,CAAC;YAE3E,MAAM,MAAM,GAAG,IAAI,eAAe,CAAC;gBACjC,SAAS,EAAE,WAAW;gBACtB,aAAa,EAAE,OAAO;gBACtB,YAAY,EAAE,kBAAkB,CAAC,QAAQ,EAAE;aAC5C,CAAC,CAAC;YACH,MAAM,CAAC,QAAQ,CAAC,IAAI,GAAG,GAAG,YAAY,CAAC,OAAO,CAAC,MAAM,EAAE,EAAE,CAAC,cAAc,MAAM,CAAC,QAAQ,EAAE,EAAE,CAAC;YAC5F,OAAO;QACT,CAAC;QAED,4CAA4C;QAC5C,MAAM,GAAG,GAAG,IAAI,GAAG,CAAC,QAAQ,EAAE,MAAM,CAAC,QAAQ,CAAC,MAAM,CAAC,CAAC;QACtD,IAAI,SAAS;YAAE,GAAG,CAAC,YAAY,CAAC,GAAG,CAAC,WAAW,EAAE,SAAS,CAAC,CAAC;QAC5D,MAAM,CAAC,QAAQ,CAAC,IAAI,GAAG,GAAG,CAAC,QAAQ,EAAE,CAAC;IACxC,CAAC,EACD,CAAC,YAAY,EAAE,YAAY,EAAE,WAAW,EAAE,cAAc,CAAC,CAC1D,CAAC;IAEF,MAAM,MAAM,GAAG,WAAW,CAAC,KAAK,IAAI,EAAE;QACpC,IAAI,CAAC;YACH,MAAM,KAAK,CAAC,cAAc,EAAE;gBAC1B,MAAM,EAAE,MAAM;gBACd,WAAW,EAAE,aAAa;aAC3B,CAAC,CAAC;QACL,CAAC;QAAC,MAAM,CAAC;YACP,wCAAwC;QAC1C,CAAC;QACD,OAAO,CAAC,IAAI,CAAC,CAAC;QACd,MAAM,CAAC,QAAQ,CAAC,IAAI,GAAG,GAAG,CAAC;IAC7B,CAAC,EAAE,CAAC,cAAc,CAAC,CAAC,CAAC;IAErB,MAAM,OAAO,GAAG,WAAW,CAAC,KAAK,IAAI,EAAE;QACrC,MAAM,SAAS,EAAE,CAAC;IACpB,CAAC,EAAE,CAAC,SAAS,CAAC,CAAC,CAAC;IAEhB,0EAA0E;IAC1E,yBAAyB;IACzB,0EAA0E;IAE1E,MAAM,KAAK,GAAG,OAAO,CACnB,GAAG,EAAE,CAAC,CAAC;QACL,IAAI;QACJ,SAAS;QACT,eAAe,EAAE,CAAC,CAAC,IAAI;QACvB,KAAK;QACL,KAAK;QACL,MAAM;QACN,OAAO;KACR,CAAC,EACF,CAAC,IAAI,EAAE,SAAS,EAAE,KAAK,EAAE,KAAK,EAAE,MAAM,EAAE,OAAO,CAAC,CACjD,CAAC;IAEF,OAAO,KAAC,UAAU,CAAC,QAAQ,IAAC,KAAK,EAAE,KAAK,YAAG,QAAQ,GAAuB,CAAC;AAC7E,CAAC;AAED,8EAA8E;AAC9E,sCAAsC;AACtC,8EAA8E;AAE9E;;;GAGG;AACH,MAAM,UAAU,iBAAiB;IAC/B,MAAM,GAAG,GAAG,UAAU,CAAC,UAAU,CAAC,CAAC;IACnC,IAAI,CAAC,GAAG,EAAE,CAAC;QACT,MAAM,IAAI,KAAK,CACb,yDAAyD;YACvD,qDAAqD,CACxD,CAAC;IACJ,CAAC;IACD,OAAO,GAAG,CAAC;AACb,CAAC"}

package/dist/components/CasLoginButton.d.ts

@@ -0,0 +1,36 @@
+/**
+ * @module @cas-system/nextjs-cas-client/components/CasLoginButton
+ * @description A ready-to-use login button that redirects to the CAS SSO
+ * login page when clicked.
+ *
+ * @example
+ * ```tsx
+ * import { CasLoginButton } from '@cas-system/nextjs-cas-client';
+ *
+ * export default function Header() {
+ *   return (
+ *     <nav>
+ *       <CasLoginButton>Sign in with SSO</CasLoginButton>
+ *     </nav>
+ *   );
+ * }
+ * ```
+ */
+import React from 'react';
+/** Props for {@link CasLoginButton}. */
+export interface CasLoginButtonProps extends Omit<React.ButtonHTMLAttributes<HTMLButtonElement>, 'onClick'> {
+    children?: React.ReactNode;
+    /**
+     * URL to return to after login.
+     * Defaults to the current page.
+     */
+    returnUrl?: string;
+}
+/**
+ * A simple button that triggers the CAS login flow.
+ *
+ * When the user is already authenticated the button renders nothing by
+ * default.  Customise this via the {@link CasLoginButtonProps}.
+ */
+export declare function CasLoginButton({ children, returnUrl, ...buttonProps }: CasLoginButtonProps): React.JSX.Element | null;
+//# sourceMappingURL=CasLoginButton.d.ts.map

package/dist/components/CasLoginButton.d.ts.map

@@ -0,0 +1 @@
+{"version":3,"file":"CasLoginButton.d.ts","sourceRoot":"","sources":["../../src/components/CasLoginButton.tsx"],"names":[],"mappings":"AAEA;;;;;;;;;;;;;;;;;GAiBG;AAEH,OAAO,KAAK,MAAM,OAAO,CAAC;AAG1B,wCAAwC;AACxC,MAAM,WAAW,mBACf,SAAQ,IAAI,CAAC,KAAK,CAAC,oBAAoB,CAAC,iBAAiB,CAAC,EAAE,SAAS,CAAC;IACtE,QAAQ,CAAC,EAAE,KAAK,CAAC,SAAS,CAAC;IAE3B;;;OAGG;IACH,SAAS,CAAC,EAAE,MAAM,CAAC;CACpB;AAED;;;;;GAKG;AACH,wBAAgB,cAAc,CAAC,EAC7B,QAAoB,EACpB,SAAS,EACT,GAAG,WAAW,EACf,EAAE,mBAAmB,4BA8BrB"}

package/dist/components/CasLoginButton.js

@@ -0,0 +1,23 @@
+'use client';
+import { jsx as _jsx } from "react/jsx-runtime";
+import { useCasAuthContext } from '../CasProvider';
+/**
+ * A simple button that triggers the CAS login flow.
+ *
+ * When the user is already authenticated the button renders nothing by
+ * default.  Customise this via the {@link CasLoginButtonProps}.
+ */
+export function CasLoginButton({ children = 'Sign in', returnUrl, ...buttonProps }) {
+    const { isAuthenticated, isLoading, login } = useCasAuthContext();
+    if (isLoading) {
+        return (_jsx("button", { ...buttonProps, disabled: true, children: "Loading\u2026" }));
+    }
+    if (isAuthenticated) {
+        return null;
+    }
+    return (_jsx("button", { ...buttonProps, onClick: () => login(returnUrl ??
+            (typeof window !== 'undefined'
+                ? window.location.pathname + window.location.search
+                : undefined)), children: children }));
+}
+//# sourceMappingURL=CasLoginButton.js.map

package/dist/components/CasLoginButton.js.map

@@ -0,0 +1 @@
+{"version":3,"file":"CasLoginButton.js","sourceRoot":"","sources":["../../src/components/CasLoginButton.tsx"],"names":[],"mappings":"AAAA,YAAY,CAAC;;AAsBb,OAAO,EAAE,iBAAiB,EAAE,MAAM,gBAAgB,CAAC;AAcnD;;;;;GAKG;AACH,MAAM,UAAU,cAAc,CAAC,EAC7B,QAAQ,GAAG,SAAS,EACpB,SAAS,EACT,GAAG,WAAW,EACM;IACpB,MAAM,EAAE,eAAe,EAAE,SAAS,EAAE,KAAK,EAAE,GAAG,iBAAiB,EAAE,CAAC;IAElE,IAAI,SAAS,EAAE,CAAC;QACd,OAAO,CACL,oBAAY,WAAW,EAAE,QAAQ,oCAExB,CACV,CAAC;IACJ,CAAC;IAED,IAAI,eAAe,EAAE,CAAC;QACpB,OAAO,IAAI,CAAC;IACd,CAAC;IAED,OAAO,CACL,oBACM,WAAW,EACf,OAAO,EAAE,GAAG,EAAE,CACZ,KAAK,CACH,SAAS;YACP,CAAC,OAAO,MAAM,KAAK,WAAW;gBAC5B,CAAC,CAAC,MAAM,CAAC,QAAQ,CAAC,QAAQ,GAAG,MAAM,CAAC,QAAQ,CAAC,MAAM;gBACnD,CAAC,CAAC,SAAS,CAAC,CACjB,YAGF,QAAQ,GACF,CACV,CAAC;AACJ,CAAC"}

package/dist/components/CasProtectedRoute.d.ts

@@ -0,0 +1,51 @@
+/**
+ * @module @cas-system/nextjs-cas-client/components/CasProtectedRoute
+ * @description Client component that guards its children behind CAS
+ * authentication.  Shows a loading state while the session is being
+ * fetched and redirects to login when no valid session exists.
+ *
+ * @example
+ * ```tsx
+ * import { CasProtectedRoute } from '@cas-system/nextjs-cas-client';
+ *
+ * export default function SecretPage() {
+ *   return (
+ *     <CasProtectedRoute>
+ *       <h1>Secret Content</h1>
+ *     </CasProtectedRoute>
+ *   );
+ * }
+ * ```
+ */
+import React from 'react';
+/** Props for {@link CasProtectedRoute}. */
+export interface CasProtectedRouteProps {
+    children: React.ReactNode;
+    /**
+     * Optional list of required roles.  The user must possess **all** of
+     * these roles to see the content.
+     */
+    roles?: string[];
+    /**
+     * Custom loading element shown while the session is being fetched.
+     * @default A simple "Loading…" paragraph.
+     */
+    loadingFallback?: React.ReactNode;
+    /**
+     * Custom element shown when the user is authenticated but lacks the
+     * required roles.
+     * @default A simple "Access denied" paragraph.
+     */
+    unauthorizedFallback?: React.ReactNode;
+    /**
+     * URL to redirect to when not authenticated.
+     * If omitted the provider's `login()` action is invoked instead.
+     */
+    redirectTo?: string;
+}
+/**
+ * Client component that only renders its children when the user is
+ * authenticated (and optionally has the required roles).
+ */
+export declare function CasProtectedRoute({ children, roles, loadingFallback, unauthorizedFallback, redirectTo, }: CasProtectedRouteProps): React.JSX.Element;
+//# sourceMappingURL=CasProtectedRoute.d.ts.map

package/dist/components/CasProtectedRoute.d.ts.map

@@ -0,0 +1 @@
+{"version":3,"file":"CasProtectedRoute.d.ts","sourceRoot":"","sources":["../../src/components/CasProtectedRoute.tsx"],"names":[],"mappings":"AAEA;;;;;;;;;;;;;;;;;;GAkBG;AAEH,OAAO,KAAoB,MAAM,OAAO,CAAC;AAGzC,2CAA2C;AAC3C,MAAM,WAAW,sBAAsB;IACrC,QAAQ,EAAE,KAAK,CAAC,SAAS,CAAC;IAE1B;;;OAGG;IACH,KAAK,CAAC,EAAE,MAAM,EAAE,CAAC;IAEjB;;;OAGG;IACH,eAAe,CAAC,EAAE,KAAK,CAAC,SAAS,CAAC;IAElC;;;;OAIG;IACH,oBAAoB,CAAC,EAAE,KAAK,CAAC,SAAS,CAAC;IAEvC;;;OAGG;IACH,UAAU,CAAC,EAAE,MAAM,CAAC;CACrB;AAED;;;GAGG;AACH,wBAAgB,iBAAiB,CAAC,EAChC,QAAQ,EACR,KAAK,EACL,eAAe,EACf,oBAAoB,EACpB,UAAU,GACX,EAAE,sBAAsB,qBAmCxB"}

package/dist/components/CasProtectedRoute.js

@@ -0,0 +1,58 @@
+'use client';
+import { jsx as _jsx, Fragment as _Fragment } from "react/jsx-runtime";
+/**
+ * @module @cas-system/nextjs-cas-client/components/CasProtectedRoute
+ * @description Client component that guards its children behind CAS
+ * authentication.  Shows a loading state while the session is being
+ * fetched and redirects to login when no valid session exists.
+ *
+ * @example
+ * ```tsx
+ * import { CasProtectedRoute } from '@cas-system/nextjs-cas-client';
+ *
+ * export default function SecretPage() {
+ *   return (
+ *     <CasProtectedRoute>
+ *       <h1>Secret Content</h1>
+ *     </CasProtectedRoute>
+ *   );
+ * }
+ * ```
+ */
+import { useEffect } from 'react';
+import { useCasAuthContext } from '../CasProvider';
+/**
+ * Client component that only renders its children when the user is
+ * authenticated (and optionally has the required roles).
+ */
+export function CasProtectedRoute({ children, roles, loadingFallback, unauthorizedFallback, redirectTo, }) {
+    const { user, isLoading, isAuthenticated, login } = useCasAuthContext();
+    useEffect(() => {
+        if (!isLoading && !isAuthenticated) {
+            if (redirectTo) {
+                window.location.href = redirectTo;
+            }
+            else {
+                login(window.location.pathname + window.location.search);
+            }
+        }
+    }, [isLoading, isAuthenticated, login, redirectTo]);
+    // Still loading
+    if (isLoading) {
+        return _jsx(_Fragment, { children: loadingFallback ?? _jsx("p", { children: "Loading\u2026" }) });
+    }
+    // Not authenticated — will redirect in useEffect
+    if (!isAuthenticated) {
+        return _jsx(_Fragment, { children: loadingFallback ?? _jsx("p", { children: "Redirecting to login\u2026" }) });
+    }
+    // Role check
+    if (roles && roles.length > 0) {
+        const userRoles = user?.roles ?? [];
+        const hasRequiredRoles = roles.every((r) => userRoles.includes(r));
+        if (!hasRequiredRoles) {
+            return (_jsx(_Fragment, { children: unauthorizedFallback ?? _jsx("p", { children: "Access denied \u2014 insufficient permissions." }) }));
+        }
+    }
+    return _jsx(_Fragment, { children: children });
+}
+//# sourceMappingURL=CasProtectedRoute.js.map

package/dist/components/CasProtectedRoute.js.map

@@ -0,0 +1 @@
+{"version":3,"file":"CasProtectedRoute.js","sourceRoot":"","sources":["../../src/components/CasProtectedRoute.tsx"],"names":[],"mappings":"AAAA,YAAY,CAAC;;AAEb;;;;;;;;;;;;;;;;;;GAkBG;AAEH,OAAc,EAAE,SAAS,EAAE,MAAM,OAAO,CAAC;AACzC,OAAO,EAAE,iBAAiB,EAAE,MAAM,gBAAgB,CAAC;AAgCnD;;;GAGG;AACH,MAAM,UAAU,iBAAiB,CAAC,EAChC,QAAQ,EACR,KAAK,EACL,eAAe,EACf,oBAAoB,EACpB,UAAU,GACa;IACvB,MAAM,EAAE,IAAI,EAAE,SAAS,EAAE,eAAe,EAAE,KAAK,EAAE,GAAG,iBAAiB,EAAE,CAAC;IAExE,SAAS,CAAC,GAAG,EAAE;QACb,IAAI,CAAC,SAAS,IAAI,CAAC,eAAe,EAAE,CAAC;YACnC,IAAI,UAAU,EAAE,CAAC;gBACf,MAAM,CAAC,QAAQ,CAAC,IAAI,GAAG,UAAU,CAAC;YACpC,CAAC;iBAAM,CAAC;gBACN,KAAK,CAAC,MAAM,CAAC,QAAQ,CAAC,QAAQ,GAAG,MAAM,CAAC,QAAQ,CAAC,MAAM,CAAC,CAAC;YAC3D,CAAC;QACH,CAAC;IACH,CAAC,EAAE,CAAC,SAAS,EAAE,eAAe,EAAE,KAAK,EAAE,UAAU,CAAC,CAAC,CAAC;IAEpD,gBAAgB;IAChB,IAAI,SAAS,EAAE,CAAC;QACd,OAAO,4BAAG,eAAe,IAAI,wCAAe,GAAI,CAAC;IACnD,CAAC;IAED,iDAAiD;IACjD,IAAI,CAAC,eAAe,EAAE,CAAC;QACrB,OAAO,4BAAG,eAAe,IAAI,qDAA4B,GAAI,CAAC;IAChE,CAAC;IAED,aAAa;IACb,IAAI,KAAK,IAAI,KAAK,CAAC,MAAM,GAAG,CAAC,EAAE,CAAC;QAC9B,MAAM,SAAS,GAAG,IAAI,EAAE,KAAK,IAAI,EAAE,CAAC;QACpC,MAAM,gBAAgB,GAAG,KAAK,CAAC,KAAK,CAAC,CAAC,CAAC,EAAE,EAAE,CAAC,SAAS,CAAC,QAAQ,CAAC,CAAC,CAAC,CAAC,CAAC;QACnE,IAAI,CAAC,gBAAgB,EAAE,CAAC;YACtB,OAAO,CACL,4BAAG,oBAAoB,IAAI,yEAAgD,GAAI,CAChF,CAAC;QACJ,CAAC;IACH,CAAC;IAED,OAAO,4BAAG,QAAQ,GAAI,CAAC;AACzB,CAAC"}

package/dist/handlers/callback.d.ts

@@ -0,0 +1,39 @@
+/**
+ * @module @cas-system/nextjs-cas-client/handlers/callback
+ * @description API route handler for the CAS SSO callback endpoint.
+ *
+ * After the CAS server authenticates the user it redirects to
+ * `{callbackUrl}?token=JWT_TOKEN`.  This handler:
+ *
+ * 1. Extracts the `token` query parameter.
+ * 2. Validates it server-side via the CAS `/api/validate-token` endpoint.
+ * 3. Sets an encrypted session cookie.
+ * 4. Redirects the user to the intended URL (or `/`).
+ *
+ * @example
+ * ```ts
+ * // app/api/cas/callback/route.ts
+ * import { createCallbackHandler } from '@cas-system/nextjs-cas-client/handlers';
+ *
+ * const handler = createCallbackHandler({
+ *   cas: {
+ *     serverUrl: process.env.CAS_SERVER_URL!,
+ *     clientId: process.env.CAS_CLIENT_ID!,
+ *     clientSecret: process.env.CAS_CLIENT_SECRET!,
+ *   },
+ *   afterLoginUrl: '/dashboard',
+ * });
+ *
+ * export { handler as GET };
+ * ```
+ */
+import { NextRequest, NextResponse } from 'next/server';
+import type { CasHandlerConfig } from '../types';
+/**
+ * Create a GET handler for `/api/cas/callback`.
+ *
+ * @param config - Handler configuration including CAS server details.
+ * @returns A Next.js App Router GET handler.
+ */
+export declare function createCallbackHandler(config: CasHandlerConfig): (request: NextRequest) => Promise<NextResponse>;
+//# sourceMappingURL=callback.d.ts.map

package/dist/handlers/callback.d.ts.map

@@ -0,0 +1 @@
+{"version":3,"file":"callback.d.ts","sourceRoot":"","sources":["../../src/handlers/callback.ts"],"names":[],"mappings":"AAAA;;;;;;;;;;;;;;;;;;;;;;;;;;;;GA4BG;AAEH,OAAO,EAAE,WAAW,EAAE,YAAY,EAAE,MAAM,aAAa,CAAC;AAExD,OAAO,KAAK,EAAE,gBAAgB,EAAE,MAAM,UAAU,CAAC;AAIjD;;;;;GAKG;AACH,wBAAgB,qBAAqB,CAAC,MAAM,EAAE,gBAAgB,IAIlC,SAAS,WAAW,KAAG,OAAO,CAAC,YAAY,CAAC,CA4BvE"}