@cas-system/nextjs-cas-client 1.0.0 → 1.0.1

package/dist/cjs/hooks/useCasUser.js

@@ -0,0 +1,48 @@
+"use strict";
+'use client';
+Object.defineProperty(exports, "__esModule", { value: true });
+exports.useCasUser = useCasUser;
+/**
+ * @module @cas-system/nextjs-cas-client/hooks/useCasUser
+ * @description Client-side hook focused on the current CAS user and
+ * role-based access control helpers.
+ *
+ * @example
+ * ```tsx
+ * 'use client';
+ * import { useCasUser } from '@cas-system/nextjs-cas-client';
+ *
+ * export function AdminPanel() {
+ *   const { user, hasRole, hasAnyRole } = useCasUser();
+ *
+ *   if (!hasRole('admin')) {
+ *     return <p>Access denied</p>;
+ *   }
+ *
+ *   return <h1>Welcome admin {user?.username}</h1>;
+ * }
+ * ```
+ */
+const react_1 = require("react");
+const CasProvider_js_1 = require("../CasProvider.js");
+/**
+ * Hook for accessing the current CAS user and performing role checks.
+ *
+ * Must be used inside a `<CasProvider>`.
+ */
+function useCasUser() {
+    const { user, isLoading, isAuthenticated } = (0, CasProvider_js_1.useCasAuthContext)();
+    const roles = (0, react_1.useMemo)(() => user?.roles ?? [], [user]);
+    const hasRole = (0, react_1.useCallback)((...required) => {
+        if (!user?.roles)
+            return required.length === 0;
+        return required.every((r) => user.roles.includes(r));
+    }, [user]);
+    const hasAnyRole = (0, react_1.useCallback)((...candidates) => {
+        if (!user?.roles)
+            return false;
+        return candidates.some((r) => user.roles.includes(r));
+    }, [user]);
+    return { user, isLoading, isAuthenticated, hasRole, hasAnyRole, roles };
+}
+//# sourceMappingURL=useCasUser.js.map

package/dist/cjs/hooks/useCasUser.js.map

@@ -0,0 +1 @@
+{"version":3,"file":"useCasUser.js","sourceRoot":"","sources":["../../../src/hooks/useCasUser.ts"],"names":[],"mappings":";AAAA,YAAY,CAAC;;AAgEb,gCAsBC;AApFD;;;;;;;;;;;;;;;;;;;;GAoBG;AAEH,iCAA6C;AAE7C,sDAAsD;AAiCtD;;;;GAIG;AACH,SAAgB,UAAU;IACxB,MAAM,EAAE,IAAI,EAAE,SAAS,EAAE,eAAe,EAAE,GAAG,IAAA,kCAAiB,GAAE,CAAC;IAEjE,MAAM,KAAK,GAAG,IAAA,eAAO,EAAC,GAAG,EAAE,CAAC,IAAI,EAAE,KAAK,IAAI,EAAE,EAAE,CAAC,IAAI,CAAC,CAAC,CAAC;IAEvD,MAAM,OAAO,GAAG,IAAA,mBAAW,EACzB,CAAC,GAAG,QAAkB,EAAE,EAAE;QACxB,IAAI,CAAC,IAAI,EAAE,KAAK;YAAE,OAAO,QAAQ,CAAC,MAAM,KAAK,CAAC,CAAC;QAC/C,OAAO,QAAQ,CAAC,KAAK,CAAC,CAAC,CAAC,EAAE,EAAE,CAAC,IAAI,CAAC,KAAM,CAAC,QAAQ,CAAC,CAAC,CAAC,CAAC,CAAC;IACxD,CAAC,EACD,CAAC,IAAI,CAAC,CACP,CAAC;IAEF,MAAM,UAAU,GAAG,IAAA,mBAAW,EAC5B,CAAC,GAAG,UAAoB,EAAE,EAAE;QAC1B,IAAI,CAAC,IAAI,EAAE,KAAK;YAAE,OAAO,KAAK,CAAC;QAC/B,OAAO,UAAU,CAAC,IAAI,CAAC,CAAC,CAAC,EAAE,EAAE,CAAC,IAAI,CAAC,KAAM,CAAC,QAAQ,CAAC,CAAC,CAAC,CAAC,CAAC;IACzD,CAAC,EACD,CAAC,IAAI,CAAC,CACP,CAAC;IAEF,OAAO,EAAE,IAAI,EAAE,SAAS,EAAE,eAAe,EAAE,OAAO,EAAE,UAAU,EAAE,KAAK,EAAE,CAAC;AAC1E,CAAC"}

package/dist/{index.d.ts → cjs/index.d.ts}

@@ -6,14 +6,14 @@
  * Server-only helpers live under `@cas-system/nextjs-cas-client/server`,
  * route handlers under `/handlers`, and middleware under `/middleware`.
  */
-export { CasProvider, useCasAuthContext } from './CasProvider';
-export type { CasProviderProps } from './CasProvider';
-export { useCasAuth } from './hooks/useCasAuth';
-export { useCasUser } from './hooks/useCasUser';
-export type { UseCasUserReturn } from './hooks/useCasUser';
-export { CasLoginButton } from './components/CasLoginButton';
-export type { CasLoginButtonProps } from './components/CasLoginButton';
-export { CasProtectedRoute } from './components/CasProtectedRoute';
-export type { CasProtectedRouteProps } from './components/CasProtectedRoute';
-export type { CasConfig, CasServerConfig, CasUser, CasSessionData, CasMiddlewareConfig, CasAuthContext, CasHandlerConfig, } from './types';
+export { CasProvider, useCasAuthContext } from './CasProvider.js';
+export type { CasProviderProps } from './CasProvider.js';
+export { useCasAuth } from './hooks/useCasAuth.js';
+export { useCasUser } from './hooks/useCasUser.js';
+export type { UseCasUserReturn } from './hooks/useCasUser.js';
+export { CasLoginButton } from './components/CasLoginButton.js';
+export type { CasLoginButtonProps } from './components/CasLoginButton.js';
+export { CasProtectedRoute } from './components/CasProtectedRoute.js';
+export type { CasProtectedRouteProps } from './components/CasProtectedRoute.js';
+export type { CasConfig, CasServerConfig, CasUser, CasSessionData, CasMiddlewareConfig, CasAuthContext, CasHandlerConfig, } from './types.js';
 //# sourceMappingURL=index.d.ts.map

package/dist/cjs/index.d.ts.map

@@ -0,0 +1 @@
+{"version":3,"file":"index.d.ts","sourceRoot":"","sources":["../../src/index.ts"],"names":[],"mappings":"AAAA;;;;;;;GAOG;AAGH,OAAO,EAAE,WAAW,EAAE,iBAAiB,EAAE,MAAM,kBAAkB,CAAC;AAClE,YAAY,EAAE,gBAAgB,EAAE,MAAM,kBAAkB,CAAC;AAGzD,OAAO,EAAE,UAAU,EAAE,MAAM,uBAAuB,CAAC;AACnD,OAAO,EAAE,UAAU,EAAE,MAAM,uBAAuB,CAAC;AACnD,YAAY,EAAE,gBAAgB,EAAE,MAAM,uBAAuB,CAAC;AAG9D,OAAO,EAAE,cAAc,EAAE,MAAM,gCAAgC,CAAC;AAChE,YAAY,EAAE,mBAAmB,EAAE,MAAM,gCAAgC,CAAC;AAC1E,OAAO,EAAE,iBAAiB,EAAE,MAAM,mCAAmC,CAAC;AACtE,YAAY,EAAE,sBAAsB,EAAE,MAAM,mCAAmC,CAAC;AAGhF,YAAY,EACV,SAAS,EACT,eAAe,EACf,OAAO,EACP,cAAc,EACd,mBAAmB,EACnB,cAAc,EACd,gBAAgB,GACjB,MAAM,YAAY,CAAC"}

package/dist/cjs/index.js

@@ -0,0 +1,26 @@
+"use strict";
+/**
+ * @module @cas-system/nextjs-cas-client
+ * @description Public entry point for the Next.js CAS Client SDK.
+ *
+ * Re-exports the client-side provider, hooks, components, and shared types.
+ * Server-only helpers live under `@cas-system/nextjs-cas-client/server`,
+ * route handlers under `/handlers`, and middleware under `/middleware`.
+ */
+Object.defineProperty(exports, "__esModule", { value: true });
+exports.CasProtectedRoute = exports.CasLoginButton = exports.useCasUser = exports.useCasAuth = exports.useCasAuthContext = exports.CasProvider = void 0;
+// Provider + context hook
+var CasProvider_js_1 = require("./CasProvider.js");
+Object.defineProperty(exports, "CasProvider", { enumerable: true, get: function () { return CasProvider_js_1.CasProvider; } });
+Object.defineProperty(exports, "useCasAuthContext", { enumerable: true, get: function () { return CasProvider_js_1.useCasAuthContext; } });
+// Hooks
+var useCasAuth_js_1 = require("./hooks/useCasAuth.js");
+Object.defineProperty(exports, "useCasAuth", { enumerable: true, get: function () { return useCasAuth_js_1.useCasAuth; } });
+var useCasUser_js_1 = require("./hooks/useCasUser.js");
+Object.defineProperty(exports, "useCasUser", { enumerable: true, get: function () { return useCasUser_js_1.useCasUser; } });
+// Components
+var CasLoginButton_js_1 = require("./components/CasLoginButton.js");
+Object.defineProperty(exports, "CasLoginButton", { enumerable: true, get: function () { return CasLoginButton_js_1.CasLoginButton; } });
+var CasProtectedRoute_js_1 = require("./components/CasProtectedRoute.js");
+Object.defineProperty(exports, "CasProtectedRoute", { enumerable: true, get: function () { return CasProtectedRoute_js_1.CasProtectedRoute; } });
+//# sourceMappingURL=index.js.map

package/dist/cjs/index.js.map

@@ -0,0 +1 @@
+{"version":3,"file":"index.js","sourceRoot":"","sources":["../../src/index.ts"],"names":[],"mappings":";AAAA;;;;;;;GAOG;;;AAEH,0BAA0B;AAC1B,mDAAkE;AAAzD,6GAAA,WAAW,OAAA;AAAE,mHAAA,iBAAiB,OAAA;AAGvC,QAAQ;AACR,uDAAmD;AAA1C,2GAAA,UAAU,OAAA;AACnB,uDAAmD;AAA1C,2GAAA,UAAU,OAAA;AAGnB,aAAa;AACb,oEAAgE;AAAvD,mHAAA,cAAc,OAAA;AAEvB,0EAAsE;AAA7D,yHAAA,iBAAiB,OAAA"}

package/dist/{middleware.d.ts → cjs/middleware.d.ts}

@@ -19,8 +19,8 @@
  * };
  * ```
  */
-import { NextRequest, NextResponse } from 'next/server';
-import type { CasMiddlewareConfig } from './types';
+import { NextRequest, NextResponse } from 'next/server.js';
+import type { CasMiddlewareConfig } from './types.js';
 /**
  * Create a Next.js middleware function that enforces CAS authentication on
  * the configured protected paths.

package/dist/cjs/middleware.d.ts.map

@@ -0,0 +1 @@
+{"version":3,"file":"middleware.d.ts","sourceRoot":"","sources":["../../src/middleware.ts"],"names":[],"mappings":"AAAA;;;;;;;;;;;;;;;;;;;;GAoBG;AAEH,OAAO,EAAE,WAAW,EAAE,YAAY,EAAE,MAAM,gBAAgB,CAAC;AAC3D,OAAO,KAAK,EAAE,mBAAmB,EAAE,MAAM,YAAY,CAAC;AAatD;;;;;;;;;;;;;;GAcG;AACH,wBAAgB,mBAAmB,CAAC,MAAM,EAAE,mBAAmB,IAQ3D,SAAS,WAAW,KACnB,OAAO,CAAC,YAAY,CAAC,CA+EzB"}

package/dist/cjs/middleware.js

@@ -0,0 +1,114 @@
+"use strict";
+/**
+ * @module @cas-system/nextjs-cas-client/middleware
+ * @description Factory for creating a Next.js middleware that guards routes
+ * behind CAS authentication.
+ *
+ * @example
+ * ```ts
+ * // middleware.ts (project root)
+ * import { createCasMiddleware } from '@cas-system/nextjs-cas-client/middleware';
+ *
+ * export default createCasMiddleware({
+ *   protectedPaths: ['/dashboard', '/admin', '/settings'],
+ *   publicPaths: ['/api/health'],
+ *   loginPath: '/login',
+ * });
+ *
+ * export const config = {
+ *   matcher: ['/((?!_next/static|_next/image|favicon.ico).*)'],
+ * };
+ * ```
+ */
+Object.defineProperty(exports, "__esModule", { value: true });
+exports.createCasMiddleware = createCasMiddleware;
+const server_js_1 = require("next/server.js");
+const auth_js_1 = require("./server/auth.js");
+/**
+ * Check whether `pathname` starts with any of the given prefixes.
+ * @internal
+ */
+function matchesAny(pathname, prefixes) {
+    return prefixes.some((p) => pathname === p || pathname.startsWith(p.endsWith('/') ? p : `${p}/`));
+}
+/**
+ * Create a Next.js middleware function that enforces CAS authentication on
+ * the configured protected paths.
+ *
+ * @param config - Middleware configuration.
+ * @returns A Next.js-compatible middleware function.
+ *
+ * @remarks
+ * - If the request targets a **public path** it is always allowed through.
+ * - If the request targets a **protected path** and there is no valid CAS
+ *   session cookie, the user is redirected to either the `loginPath` (if
+ *   set) or the CAS server SSO login page.
+ * - The original URL is forwarded as a `?returnUrl=…` query parameter so
+ *   the login page can redirect back after authentication.
+ */
+function createCasMiddleware(config) {
+    const { protectedPaths, publicPaths = [], loginPath, } = config;
+    return async function casMiddleware(request) {
+        const { pathname } = request.nextUrl;
+        // 1. Skip static assets and internal Next.js routes
+        if (pathname.startsWith('/_next') ||
+            pathname.startsWith('/favicon') ||
+            pathname.includes('.')) {
+            return server_js_1.NextResponse.next();
+        }
+        // 2. Always allow explicitly public paths
+        if (matchesAny(pathname, publicPaths)) {
+            return server_js_1.NextResponse.next();
+        }
+        // 3. Check whether this path requires authentication
+        const isProtected = matchesAny(pathname, protectedPaths);
+        if (!isProtected) {
+            return server_js_1.NextResponse.next();
+        }
+        // 4. Attempt to read the session from cookies
+        const session = await (0, auth_js_1.getCasSessionFromRequest)(request);
+        if (session) {
+            // Authenticated — attach user info as request headers so downstream
+            // Server Components / Route Handlers can read them without re-parsing
+            // the cookie.
+            const requestHeaders = new Headers(request.headers);
+            requestHeaders.set('x-cas-user', JSON.stringify(session.user));
+            requestHeaders.set('x-cas-authenticated', 'true');
+            return server_js_1.NextResponse.next({
+                request: { headers: requestHeaders },
+            });
+        }
+        // 5. Not authenticated — redirect to login
+        const returnUrl = request.nextUrl.pathname + request.nextUrl.search;
+        if (loginPath) {
+            // Redirect to the app's own login page
+            const loginUrl = new URL(loginPath, request.url);
+            loginUrl.searchParams.set('returnUrl', returnUrl);
+            return server_js_1.NextResponse.redirect(loginUrl);
+        }
+        // Redirect directly to the CAS SSO login page.
+        // The browser must reach CAS at its PUBLIC base url, which may differ from
+        // the internal back-channel url used for server-to-server validation.
+        // Prefer CAS_PUBLIC_URL; fall back to CAS_SERVER_URL for single-url setups.
+        const casServerUrl = process.env.CAS_PUBLIC_URL || process.env.CAS_SERVER_URL;
+        const casClientId = process.env.CAS_CLIENT_ID;
+        const casCallbackUrl = process.env.CAS_CALLBACK_URL ??
+            `${request.nextUrl.origin}/api/cas/callback`;
+        if (!casServerUrl || !casClientId) {
+            console.error('[CasMiddleware] CAS_SERVER_URL and CAS_CLIENT_ID env vars are required ' +
+                'when no loginPath is configured.');
+            return server_js_1.NextResponse.next();
+        }
+        // Encode the return URL into the callback so we can redirect after login
+        const callbackWithReturn = new URL(casCallbackUrl);
+        callbackWithReturn.searchParams.set('returnUrl', returnUrl);
+        const params = new URLSearchParams({
+            client_id: casClientId,
+            response_type: 'token',
+            redirect_uri: callbackWithReturn.toString(),
+        });
+        const casLoginUrl = `${casServerUrl.replace(/\/+$/, '')}/sso/login?${params.toString()}`;
+        return server_js_1.NextResponse.redirect(casLoginUrl);
+    };
+}
+//# sourceMappingURL=middleware.js.map

package/dist/cjs/middleware.js.map

@@ -0,0 +1 @@
+{"version":3,"file":"middleware.js","sourceRoot":"","sources":["../../src/middleware.ts"],"names":[],"mappings":";AAAA;;;;;;;;;;;;;;;;;;;;GAoBG;;AA+BH,kDAwFC;AArHD,8CAA2D;AAE3D,8CAA4D;AAE5D;;;GAGG;AACH,SAAS,UAAU,CAAC,QAAgB,EAAE,QAAkB;IACtD,OAAO,QAAQ,CAAC,IAAI,CAClB,CAAC,CAAC,EAAE,EAAE,CAAC,QAAQ,KAAK,CAAC,IAAI,QAAQ,CAAC,UAAU,CAAC,CAAC,CAAC,QAAQ,CAAC,GAAG,CAAC,CAAC,CAAC,CAAC,CAAC,CAAC,CAAC,CAAC,GAAG,CAAC,GAAG,CAAC,CAC5E,CAAC;AACJ,CAAC;AAED;;;;;;;;;;;;;;GAcG;AACH,SAAgB,mBAAmB,CAAC,MAA2B;IAC7D,MAAM,EACJ,cAAc,EACd,WAAW,GAAG,EAAE,EAChB,SAAS,GACV,GAAG,MAAM,CAAC;IAEX,OAAO,KAAK,UAAU,aAAa,CACjC,OAAoB;QAEpB,MAAM,EAAE,QAAQ,EAAE,GAAG,OAAO,CAAC,OAAO,CAAC;QAErC,oDAAoD;QACpD,IACE,QAAQ,CAAC,UAAU,CAAC,QAAQ,CAAC;YAC7B,QAAQ,CAAC,UAAU,CAAC,UAAU,CAAC;YAC/B,QAAQ,CAAC,QAAQ,CAAC,GAAG,CAAC,EACtB,CAAC;YACD,OAAO,wBAAY,CAAC,IAAI,EAAE,CAAC;QAC7B,CAAC;QAED,0CAA0C;QAC1C,IAAI,UAAU,CAAC,QAAQ,EAAE,WAAW,CAAC,EAAE,CAAC;YACtC,OAAO,wBAAY,CAAC,IAAI,EAAE,CAAC;QAC7B,CAAC;QAED,qDAAqD;QACrD,MAAM,WAAW,GAAG,UAAU,CAAC,QAAQ,EAAE,cAAc,CAAC,CAAC;QACzD,IAAI,CAAC,WAAW,EAAE,CAAC;YACjB,OAAO,wBAAY,CAAC,IAAI,EAAE,CAAC;QAC7B,CAAC;QAED,8CAA8C;QAC9C,MAAM,OAAO,GAAG,MAAM,IAAA,kCAAwB,EAAC,OAAO,CAAC,CAAC;QACxD,IAAI,OAAO,EAAE,CAAC;YACZ,oEAAoE;YACpE,sEAAsE;YACtE,cAAc;YACd,MAAM,cAAc,GAAG,IAAI,OAAO,CAAC,OAAO,CAAC,OAAO,CAAC,CAAC;YACpD,cAAc,CAAC,GAAG,CAAC,YAAY,EAAE,IAAI,CAAC,SAAS,CAAC,OAAO,CAAC,IAAI,CAAC,CAAC,CAAC;YAC/D,cAAc,CAAC,GAAG,CAAC,qBAAqB,EAAE,MAAM,CAAC,CAAC;YAElD,OAAO,wBAAY,CAAC,IAAI,CAAC;gBACvB,OAAO,EAAE,EAAE,OAAO,EAAE,cAAc,EAAE;aACrC,CAAC,CAAC;QACL,CAAC;QAED,2CAA2C;QAC3C,MAAM,SAAS,GAAG,OAAO,CAAC,OAAO,CAAC,QAAQ,GAAG,OAAO,CAAC,OAAO,CAAC,MAAM,CAAC;QAEpE,IAAI,SAAS,EAAE,CAAC;YACd,uCAAuC;YACvC,MAAM,QAAQ,GAAG,IAAI,GAAG,CAAC,SAAS,EAAE,OAAO,CAAC,GAAG,CAAC,CAAC;YACjD,QAAQ,CAAC,YAAY,CAAC,GAAG,CAAC,WAAW,EAAE,SAAS,CAAC,CAAC;YAClD,OAAO,wBAAY,CAAC,QAAQ,CAAC,QAAQ,CAAC,CAAC;QACzC,CAAC;QAED,+CAA+C;QAC/C,2EAA2E;QAC3E,sEAAsE;QACtE,4EAA4E;QAC5E,MAAM,YAAY,GAAG,OAAO,CAAC,GAAG,CAAC,cAAc,IAAI,OAAO,CAAC,GAAG,CAAC,cAAc,CAAC;QAC9E,MAAM,WAAW,GAAG,OAAO,CAAC,GAAG,CAAC,aAAa,CAAC;QAC9C,MAAM,cAAc,GAClB,OAAO,CAAC,GAAG,CAAC,gBAAgB;YAC5B,GAAG,OAAO,CAAC,OAAO,CAAC,MAAM,mBAAmB,CAAC;QAE/C,IAAI,CAAC,YAAY,IAAI,CAAC,WAAW,EAAE,CAAC;YAClC,OAAO,CAAC,KAAK,CACX,yEAAyE;gBACvE,kCAAkC,CACrC,CAAC;YACF,OAAO,wBAAY,CAAC,IAAI,EAAE,CAAC;QAC7B,CAAC;QAED,yEAAyE;QACzE,MAAM,kBAAkB,GAAG,IAAI,GAAG,CAAC,cAAc,CAAC,CAAC;QACnD,kBAAkB,CAAC,YAAY,CAAC,GAAG,CAAC,WAAW,EAAE,SAAS,CAAC,CAAC;QAE5D,MAAM,MAAM,GAAG,IAAI,eAAe,CAAC;YACjC,SAAS,EAAE,WAAW;YACtB,aAAa,EAAE,OAAO;YACtB,YAAY,EAAE,kBAAkB,CAAC,QAAQ,EAAE;SAC5C,CAAC,CAAC;QAEH,MAAM,WAAW,GAAG,GAAG,YAAY,CAAC,OAAO,CAAC,MAAM,EAAE,EAAE,CAAC,cAAc,MAAM,CAAC,QAAQ,EAAE,EAAE,CAAC;QACzF,OAAO,wBAAY,CAAC,QAAQ,CAAC,WAAW,CAAC,CAAC;IAC5C,CAAC,CAAC;AACJ,CAAC"}

package/dist/cjs/package.json

@@ -0,0 +1,3 @@
+{
+  "type": "commonjs"
+}

package/dist/{server → cjs/server}/auth.d.ts

@@ -13,8 +13,8 @@
  * - Token validation always happens server-side via {@link CasClient}.
  */
 import type { ReadonlyRequestCookies } from 'next/dist/server/web/spec-extension/adapters/request-cookies';
-import type { CasUser, CasSessionData } from '../types';
-import { NextRequest, NextResponse } from 'next/server';
+import type { CasUser, CasSessionData } from '../types.js';
+import { NextRequest, NextResponse } from 'next/server.js';
 /**
  * Read the CAS session from Next.js **request** cookies.
  *

package/dist/cjs/server/auth.d.ts.map

@@ -0,0 +1 @@
+{"version":3,"file":"auth.d.ts","sourceRoot":"","sources":["../../../src/server/auth.ts"],"names":[],"mappings":"AAAA;;;;;;;;;;;;;GAaG;AAEH,OAAO,KAAK,EAAE,sBAAsB,EAAE,MAAM,8DAA8D,CAAC;AAC3G,OAAO,KAAK,EAAE,OAAO,EAAE,cAAc,EAAE,MAAM,aAAa,CAAC;AAC3D,OAAO,EAAE,WAAW,EAAE,YAAY,EAAE,MAAM,gBAAgB,CAAC;AA8D3D;;;;;;;;;;;;;;;;;;;;GAoBG;AACH,wBAAsB,aAAa,CACjC,OAAO,EAAE,sBAAsB,GAC9B,OAAO,CAAC,cAAc,GAAG,IAAI,CAAC,CAuBhC;AAED;;;;;;;;;;;;;;;GAeG;AACH,wBAAsB,aAAa,CACjC,OAAO,EAAE,sBAAsB,EAC/B,IAAI,EAAE,OAAO,EACb,KAAK,EAAE,MAAM,GACZ,OAAO,CAAC,IAAI,CAAC,CAgBf;AAED;;;;;;;;;;;;GAYG;AACH,wBAAgB,eAAe,CAAC,OAAO,EAAE,sBAAsB,GAAG,IAAI,CAGrE;AAMD,wDAAwD;AACxD,KAAK,YAAY,GAAG,CAClB,GAAG,EAAE,WAAW,EAChB,GAAG,CAAC,EAAE;IAAE,MAAM,CAAC,EAAE,MAAM,CAAC,MAAM,EAAE,MAAM,CAAC,CAAA;CAAE,KACtC,OAAO,CAAC,YAAY,GAAG,QAAQ,CAAC,GAAG,YAAY,GAAG,QAAQ,CAAC;AAEhE,8EAA8E;AAC9E,KAAK,oBAAoB,GAAG,CAC1B,GAAG,EAAE,WAAW,EAChB,GAAG,EAAE;IAAE,MAAM,CAAC,EAAE,MAAM,CAAC,MAAM,EAAE,MAAM,CAAC,CAAA;CAAE,EACxC,IAAI,EAAE,OAAO,KACV,OAAO,CAAC,YAAY,GAAG,QAAQ,CAAC,GAAG,YAAY,GAAG,QAAQ,CAAC;AAEhE;;;;;;;;;;;;;;;;;;;GAmBG;AACH,wBAAgB,WAAW,CAAC,OAAO,EAAE,oBAAoB,GAAG,YAAY,CAsCvE;AAED;;;;;;;;GAQG;AACH,wBAAsB,wBAAwB,CAC5C,OAAO,EAAE,WAAW,GACnB,OAAO,CAAC,cAAc,GAAG,IAAI,CAAC,CAehC"}

package/dist/cjs/server/auth.js

@@ -0,0 +1,222 @@
+"use strict";
+/**
+ * @module @cas-system/nextjs-cas-client/server/auth
+ * @description Server-side session helpers for reading / writing CAS session
+ * data to Next.js cookies.
+ *
+ * The session is stored as a base-64 encoded JSON blob (signed with HMAC)
+ * inside an `HttpOnly`, `Secure`, `SameSite=Lax` cookie.  This gives us
+ * tamper-proof cookies without requiring any external crypto library.
+ *
+ * **Security model:**
+ * - The cookie is `HttpOnly` — JavaScript in the browser cannot read it.
+ * - A separate HMAC signature cookie prevents tampering.
+ * - Token validation always happens server-side via {@link CasClient}.
+ */
+Object.defineProperty(exports, "__esModule", { value: true });
+exports.getCasSession = getCasSession;
+exports.setCasSession = setCasSession;
+exports.clearCasSession = clearCasSession;
+exports.withCasAuth = withCasAuth;
+exports.getCasSessionFromRequest = getCasSessionFromRequest;
+const server_js_1 = require("next/server.js");
+// ---------------------------------------------------------------------------
+// Constants
+// ---------------------------------------------------------------------------
+/** Name of the cookie that stores the session payload. */
+const SESSION_COOKIE = 'cas_session';
+/** Name of the cookie that stores the HMAC signature of the payload. */
+const SIGNATURE_COOKIE = 'cas_session_sig';
+/** Secret used for HMAC signing — falls back to a build-time constant. */
+function getSigningSecret() {
+    const secret = process.env.CAS_COOKIE_SECRET ?? process.env.CAS_CLIENT_SECRET;
+    if (!secret) {
+        throw new Error('[CasAuth] Neither CAS_COOKIE_SECRET nor CAS_CLIENT_SECRET environment variable is set. ' +
+            'One of these is required for cookie signing.');
+    }
+    return secret;
+}
+// ---------------------------------------------------------------------------
+// Internal crypto helpers
+// ---------------------------------------------------------------------------
+/** @internal */
+async function signPayload(payload, secret) {
+    const encoder = new TextEncoder();
+    const key = await crypto.subtle.importKey('raw', encoder.encode(secret), { name: 'HMAC', hash: 'SHA-256' }, false, ['sign']);
+    const sig = await crypto.subtle.sign('HMAC', key, encoder.encode(payload));
+    return btoa(String.fromCharCode(...new Uint8Array(sig)));
+}
+/** @internal */
+async function verifyPayload(payload, signature, secret) {
+    const expected = await signPayload(payload, secret);
+    // Constant-time-ish comparison (good enough for HMAC output).
+    if (expected.length !== signature.length)
+        return false;
+    let mismatch = 0;
+    for (let i = 0; i < expected.length; i++) {
+        mismatch |= expected.charCodeAt(i) ^ signature.charCodeAt(i);
+    }
+    return mismatch === 0;
+}
+// ---------------------------------------------------------------------------
+// Public API
+// ---------------------------------------------------------------------------
+/**
+ * Read the CAS session from Next.js **request** cookies.
+ *
+ * Works in Server Components, Route Handlers, and middleware — anywhere
+ * you have access to the Next.js `cookies()` helper.
+ *
+ * @param cookies - The Next.js `cookies()` read-only store.
+ * @returns The session data, or `null` if no valid session exists.
+ *
+ * @example
+ * ```ts
+ * import { cookies } from 'next/headers';
+ * import { getCasSession } from '@cas-system/nextjs-cas-client/server';
+ *
+ * export default async function DashboardPage() {
+ *   const session = await getCasSession(cookies());
+ *   if (!session) redirect('/login');
+ *   return <h1>Hello {session.user.username}</h1>;
+ * }
+ * ```
+ */
+async function getCasSession(cookies) {
+    try {
+        const sessionCookie = cookies.get(SESSION_COOKIE);
+        const sigCookie = cookies.get(SIGNATURE_COOKIE);
+        if (!sessionCookie?.value || !sigCookie?.value)
+            return null;
+        const secret = getSigningSecret();
+        const valid = await verifyPayload(sessionCookie.value, sigCookie.value, secret);
+        if (!valid) {
+            console.warn('[CasAuth] Cookie signature mismatch — session rejected.');
+            return null;
+        }
+        const decoded = atob(sessionCookie.value);
+        const data = JSON.parse(decoded);
+        return data;
+    }
+    catch {
+        return null;
+    }
+}
+/**
+ * Write the CAS session into Next.js **response** cookies.
+ *
+ * @param cookies - The Next.js `cookies()` store (must be writable — only
+ *                  available inside Route Handlers and Server Actions).
+ * @param user    - The authenticated user.
+ * @param token   - The raw JWT token.
+ *
+ * @example
+ * ```ts
+ * import { cookies } from 'next/headers';
+ * import { setCasSession } from '@cas-system/nextjs-cas-client/server';
+ *
+ * await setCasSession(cookies(), user, token);
+ * ```
+ */
+async function setCasSession(cookies, user, token) {
+    const data = { user, token, createdAt: Date.now() };
+    const payload = btoa(JSON.stringify(data));
+    const secret = getSigningSecret();
+    const sig = await signPayload(payload, secret);
+    const cookieOptions = {
+        httpOnly: true,
+        secure: process.env.NODE_ENV === 'production',
+        sameSite: 'lax',
+        path: '/',
+        maxAge: 60 * 60 * 24 * 7, // 7 days
+    };
+    cookies.set(SESSION_COOKIE, payload, cookieOptions);
+    cookies.set(SIGNATURE_COOKIE, sig, cookieOptions);
+}
+/**
+ * Delete the CAS session cookies.
+ *
+ * @param cookies - The Next.js `cookies()` store.
+ *
+ * @example
+ * ```ts
+ * import { cookies } from 'next/headers';
+ * import { clearCasSession } from '@cas-system/nextjs-cas-client/server';
+ *
+ * clearCasSession(cookies());
+ * ```
+ */
+function clearCasSession(cookies) {
+    cookies.delete(SESSION_COOKIE);
+    cookies.delete(SIGNATURE_COOKIE);
+}
+/**
+ * Higher-order function that wraps a Next.js App Router route handler,
+ * automatically extracting and verifying the CAS session and injecting the
+ * `CasUser` into the handler.
+ *
+ * If no valid session exists, responds with `401 Unauthorized`.
+ *
+ * @param handler - The protected route handler.
+ * @returns A standard Next.js route handler.
+ *
+ * @example
+ * ```ts
+ * // app/api/admin/route.ts
+ * import { withCasAuth } from '@cas-system/nextjs-cas-client/server';
+ *
+ * export const GET = withCasAuth(async (req, ctx, user) => {
+ *   return NextResponse.json({ message: `Hello ${user.username}` });
+ * });
+ * ```
+ */
+function withCasAuth(handler) {
+    return async (req, ctx) => {
+        // In App Router route handlers, we can read cookies directly from the request.
+        const sessionCookie = req.cookies.get(SESSION_COOKIE);
+        const sigCookie = req.cookies.get(SIGNATURE_COOKIE);
+        if (!sessionCookie?.value || !sigCookie?.value) {
+            return server_js_1.NextResponse.json({ error: 'Unauthorized' }, { status: 401 });
+        }
+        try {
+            const secret = getSigningSecret();
+            const valid = await verifyPayload(sessionCookie.value, sigCookie.value, secret);
+            if (!valid) {
+                return server_js_1.NextResponse.json({ error: 'Unauthorized — invalid session' }, { status: 401 });
+            }
+            const decoded = atob(sessionCookie.value);
+            const data = JSON.parse(decoded);
+            return handler(req, ctx ?? {}, data.user);
+        }
+        catch {
+            return server_js_1.NextResponse.json({ error: 'Unauthorized — session parse error' }, { status: 401 });
+        }
+    };
+}
+/**
+ * Read the CAS session from a plain `NextRequest` (useful in middleware
+ * and edge functions where the `cookies()` helper is not available).
+ *
+ * @param request - The incoming Next.js request.
+ * @returns Session data or `null`.
+ *
+ * @internal
+ */
+async function getCasSessionFromRequest(request) {
+    try {
+        const sessionValue = request.cookies.get(SESSION_COOKIE)?.value;
+        const sigValue = request.cookies.get(SIGNATURE_COOKIE)?.value;
+        if (!sessionValue || !sigValue)
+            return null;
+        const secret = getSigningSecret();
+        const valid = await verifyPayload(sessionValue, sigValue, secret);
+        if (!valid)
+            return null;
+        const decoded = atob(sessionValue);
+        return JSON.parse(decoded);
+    }
+    catch {
+        return null;
+    }
+}
+//# sourceMappingURL=auth.js.map

package/dist/cjs/server/auth.js.map

@@ -0,0 +1 @@
+{"version":3,"file":"auth.js","sourceRoot":"","sources":["../../../src/server/auth.ts"],"names":[],"mappings":";AAAA;;;;;;;;;;;;;GAaG;;AAuFH,sCAyBC;AAkBD,sCAoBC;AAeD,0CAGC;AAuCD,kCAsCC;AAWD,4DAiBC;AA7QD,8CAA2D;AAE3D,8EAA8E;AAC9E,YAAY;AACZ,8EAA8E;AAE9E,0DAA0D;AAC1D,MAAM,cAAc,GAAG,aAAa,CAAC;AAErC,wEAAwE;AACxE,MAAM,gBAAgB,GAAG,iBAAiB,CAAC;AAE3C,0EAA0E;AAC1E,SAAS,gBAAgB;IACvB,MAAM,MAAM,GAAG,OAAO,CAAC,GAAG,CAAC,iBAAiB,IAAI,OAAO,CAAC,GAAG,CAAC,iBAAiB,CAAC;IAC9E,IAAI,CAAC,MAAM,EAAE,CAAC;QACZ,MAAM,IAAI,KAAK,CACb,yFAAyF;YACvF,8CAA8C,CACjD,CAAC;IACJ,CAAC;IACD,OAAO,MAAM,CAAC;AAChB,CAAC;AAED,8EAA8E;AAC9E,0BAA0B;AAC1B,8EAA8E;AAE9E,gBAAgB;AAChB,KAAK,UAAU,WAAW,CAAC,OAAe,EAAE,MAAc;IACxD,MAAM,OAAO,GAAG,IAAI,WAAW,EAAE,CAAC;IAClC,MAAM,GAAG,GAAG,MAAM,MAAM,CAAC,MAAM,CAAC,SAAS,CACvC,KAAK,EACL,OAAO,CAAC,MAAM,CAAC,MAAM,CAAC,EACtB,EAAE,IAAI,EAAE,MAAM,EAAE,IAAI,EAAE,SAAS,EAAE,EACjC,KAAK,EACL,CAAC,MAAM,CAAC,CACT,CAAC;IACF,MAAM,GAAG,GAAG,MAAM,MAAM,CAAC,MAAM,CAAC,IAAI,CAAC,MAAM,EAAE,GAAG,EAAE,OAAO,CAAC,MAAM,CAAC,OAAO,CAAC,CAAC,CAAC;IAC3E,OAAO,IAAI,CAAC,MAAM,CAAC,YAAY,CAAC,GAAG,IAAI,UAAU,CAAC,GAAG,CAAC,CAAC,CAAC,CAAC;AAC3D,CAAC;AAED,gBAAgB;AAChB,KAAK,UAAU,aAAa,CAC1B,OAAe,EACf,SAAiB,EACjB,MAAc;IAEd,MAAM,QAAQ,GAAG,MAAM,WAAW,CAAC,OAAO,EAAE,MAAM,CAAC,CAAC;IACpD,8DAA8D;IAC9D,IAAI,QAAQ,CAAC,MAAM,KAAK,SAAS,CAAC,MAAM;QAAE,OAAO,KAAK,CAAC;IACvD,IAAI,QAAQ,GAAG,CAAC,CAAC;IACjB,KAAK,IAAI,CAAC,GAAG,CAAC,EAAE,CAAC,GAAG,QAAQ,CAAC,MAAM,EAAE,CAAC,EAAE,EAAE,CAAC;QACzC,QAAQ,IAAI,QAAQ,CAAC,UAAU,CAAC,CAAC,CAAC,GAAG,SAAS,CAAC,UAAU,CAAC,CAAC,CAAC,CAAC;IAC/D,CAAC;IACD,OAAO,QAAQ,KAAK,CAAC,CAAC;AACxB,CAAC;AAED,8EAA8E;AAC9E,aAAa;AACb,8EAA8E;AAE9E;;;;;;;;;;;;;;;;;;;;GAoBG;AACI,KAAK,UAAU,aAAa,CACjC,OAA+B;IAE/B,IAAI,CAAC;QACH,MAAM,aAAa,GAAG,OAAO,CAAC,GAAG,CAAC,cAAc,CAAC,CAAC;QAClD,MAAM,SAAS,GAAG,OAAO,CAAC,GAAG,CAAC,gBAAgB,CAAC,CAAC;QAChD,IAAI,CAAC,aAAa,EAAE,KAAK,IAAI,CAAC,SAAS,EAAE,KAAK;YAAE,OAAO,IAAI,CAAC;QAE5D,MAAM,MAAM,GAAG,gBAAgB,EAAE,CAAC;QAClC,MAAM,KAAK,GAAG,MAAM,aAAa,CAC/B,aAAa,CAAC,KAAK,EACnB,SAAS,CAAC,KAAK,EACf,MAAM,CACP,CAAC;QACF,IAAI,CAAC,KAAK,EAAE,CAAC;YACX,OAAO,CAAC,IAAI,CAAC,yDAAyD,CAAC,CAAC;YACxE,OAAO,IAAI,CAAC;QACd,CAAC;QAED,MAAM,OAAO,GAAG,IAAI,CAAC,aAAa,CAAC,KAAK,CAAC,CAAC;QAC1C,MAAM,IAAI,GAAG,IAAI,CAAC,KAAK,CAAC,OAAO,CAAmB,CAAC;QACnD,OAAO,IAAI,CAAC;IACd,CAAC;IAAC,MAAM,CAAC;QACP,OAAO,IAAI,CAAC;IACd,CAAC;AACH,CAAC;AAED;;;;;;;;;;;;;;;GAeG;AACI,KAAK,UAAU,aAAa,CACjC,OAA+B,EAC/B,IAAa,EACb,KAAa;IAEb,MAAM,IAAI,GAAmB,EAAE,IAAI,EAAE,KAAK,EAAE,SAAS,EAAE,IAAI,CAAC,GAAG,EAAE,EAAE,CAAC;IACpE,MAAM,OAAO,GAAG,IAAI,CAAC,IAAI,CAAC,SAAS,CAAC,IAAI,CAAC,CAAC,CAAC;IAC3C,MAAM,MAAM,GAAG,gBAAgB,EAAE,CAAC;IAClC,MAAM,GAAG,GAAG,MAAM,WAAW,CAAC,OAAO,EAAE,MAAM,CAAC,CAAC;IAE/C,MAAM,aAAa,GAAG;QACpB,QAAQ,EAAE,IAAI;QACd,MAAM,EAAE,OAAO,CAAC,GAAG,CAAC,QAAQ,KAAK,YAAY;QAC7C,QAAQ,EAAE,KAAc;QACxB,IAAI,EAAE,GAAG;QACT,MAAM,EAAE,EAAE,GAAG,EAAE,GAAG,EAAE,GAAG,CAAC,EAAE,SAAS;KACpC,CAAC;IAED,OAAe,CAAC,GAAG,CAAC,cAAc,EAAE,OAAO,EAAE,aAAa,CAAC,CAAC;IAC5D,OAAe,CAAC,GAAG,CAAC,gBAAgB,EAAE,GAAG,EAAE,aAAa,CAAC,CAAC;AAC7D,CAAC;AAED;;;;;;;;;;;;GAYG;AACH,SAAgB,eAAe,CAAC,OAA+B;IAC5D,OAAe,CAAC,MAAM,CAAC,cAAc,CAAC,CAAC;IACvC,OAAe,CAAC,MAAM,CAAC,gBAAgB,CAAC,CAAC;AAC5C,CAAC;AAmBD;;;;;;;;;;;;;;;;;;;GAmBG;AACH,SAAgB,WAAW,CAAC,OAA6B;IACvD,OAAO,KAAK,EAAE,GAAgB,EAAE,GAAyC,EAAE,EAAE;QAC3E,+EAA+E;QAC/E,MAAM,aAAa,GAAG,GAAG,CAAC,OAAO,CAAC,GAAG,CAAC,cAAc,CAAC,CAAC;QACtD,MAAM,SAAS,GAAG,GAAG,CAAC,OAAO,CAAC,GAAG,CAAC,gBAAgB,CAAC,CAAC;QAEpD,IAAI,CAAC,aAAa,EAAE,KAAK,IAAI,CAAC,SAAS,EAAE,KAAK,EAAE,CAAC;YAC/C,OAAO,wBAAY,CAAC,IAAI,CACtB,EAAE,KAAK,EAAE,cAAc,EAAE,EACzB,EAAE,MAAM,EAAE,GAAG,EAAE,CAChB,CAAC;QACJ,CAAC;QAED,IAAI,CAAC;YACH,MAAM,MAAM,GAAG,gBAAgB,EAAE,CAAC;YAClC,MAAM,KAAK,GAAG,MAAM,aAAa,CAC/B,aAAa,CAAC,KAAK,EACnB,SAAS,CAAC,KAAK,EACf,MAAM,CACP,CAAC;YACF,IAAI,CAAC,KAAK,EAAE,CAAC;gBACX,OAAO,wBAAY,CAAC,IAAI,CACtB,EAAE,KAAK,EAAE,gCAAgC,EAAE,EAC3C,EAAE,MAAM,EAAE,GAAG,EAAE,CAChB,CAAC;YACJ,CAAC;YAED,MAAM,OAAO,GAAG,IAAI,CAAC,aAAa,CAAC,KAAK,CAAC,CAAC;YAC1C,MAAM,IAAI,GAAG,IAAI,CAAC,KAAK,CAAC,OAAO,CAAmB,CAAC;YAEnD,OAAO,OAAO,CAAC,GAAG,EAAE,GAAG,IAAI,EAAE,EAAE,IAAI,CAAC,IAAI,CAAC,CAAC;QAC5C,CAAC;QAAC,MAAM,CAAC;YACP,OAAO,wBAAY,CAAC,IAAI,CACtB,EAAE,KAAK,EAAE,oCAAoC,EAAE,EAC/C,EAAE,MAAM,EAAE,GAAG,EAAE,CAChB,CAAC;QACJ,CAAC;IACH,CAAC,CAAC;AACJ,CAAC;AAED;;;;;;;;GAQG;AACI,KAAK,UAAU,wBAAwB,CAC5C,OAAoB;IAEpB,IAAI,CAAC;QACH,MAAM,YAAY,GAAG,OAAO,CAAC,OAAO,CAAC,GAAG,CAAC,cAAc,CAAC,EAAE,KAAK,CAAC;QAChE,MAAM,QAAQ,GAAG,OAAO,CAAC,OAAO,CAAC,GAAG,CAAC,gBAAgB,CAAC,EAAE,KAAK,CAAC;QAC9D,IAAI,CAAC,YAAY,IAAI,CAAC,QAAQ;YAAE,OAAO,IAAI,CAAC;QAE5C,MAAM,MAAM,GAAG,gBAAgB,EAAE,CAAC;QAClC,MAAM,KAAK,GAAG,MAAM,aAAa,CAAC,YAAY,EAAE,QAAQ,EAAE,MAAM,CAAC,CAAC;QAClE,IAAI,CAAC,KAAK;YAAE,OAAO,IAAI,CAAC;QAExB,MAAM,OAAO,GAAG,IAAI,CAAC,YAAY,CAAC,CAAC;QACnC,OAAO,IAAI,CAAC,KAAK,CAAC,OAAO,CAAmB,CAAC;IAC/C,CAAC;IAAC,MAAM,CAAC;QACP,OAAO,IAAI,CAAC;IACd,CAAC;AACH,CAAC"}

package/dist/{server → cjs/server}/cas-client.d.ts

@@ -7,7 +7,7 @@
  * **IMPORTANT:** This module must only run on the server. It requires the
  * `clientSecret` which must never be sent to the browser.
  */
-import type { CasServerConfig, CasUser } from '../types';
+import type { CasServerConfig, CasUser } from '../types.js';
 /**
  * Server-side CAS client.
  *

package/dist/cjs/server/cas-client.d.ts.map

@@ -0,0 +1 @@
+{"version":3,"file":"cas-client.d.ts","sourceRoot":"","sources":["../../../src/server/cas-client.ts"],"names":[],"mappings":"AAAA;;;;;;;;GAQG;AAEH,OAAO,KAAK,EACV,eAAe,EACf,OAAO,EAGR,MAAM,aAAa,CAAC;AAkBrB;;;;;;;;;;;;;;;;;GAiBG;AACH,qBAAa,SAAS;IACpB,OAAO,CAAC,QAAQ,CAAC,MAAM,CAA0C;gBAErD,MAAM,EAAE,eAAe;IAgBnC;;;;;;;;;;;;OAYG;IACH,WAAW,CAAC,SAAS,CAAC,EAAE,MAAM,GAAG,MAAM;IAevC;;;;;;;;;;;OAWG;IACG,aAAa,CAAC,KAAK,EAAE,MAAM,GAAG,OAAO,CAAC,OAAO,GAAG,IAAI,CAAC;IAuC3D;;;;;;;;OAQG;IACG,aAAa,CAAC,QAAQ,EAAE,MAAM,GAAG,OAAO,CAAC,MAAM,GAAG,IAAI,CAAC;IAuC7D;;;;;OAKG;IACG,MAAM,CAAC,KAAK,CAAC,EAAE,MAAM,GAAG,OAAO,CAAC,OAAO,CAAC;IAgC9C;;;;;;OAMG;IACH,MAAM,CAAC,QAAQ,CAAC,IAAI,EAAE,OAAO,EAAE,KAAK,EAAE,MAAM,EAAE,GAAG,OAAO;IAKxD;;;;;;OAMG;IACH,MAAM,CAAC,UAAU,CAAC,IAAI,EAAE,OAAO,EAAE,KAAK,EAAE,MAAM,EAAE,GAAG,OAAO;CAI3D"}