@cas-system/nextjs-cas-client 1.0.0

package/dist/handlers/callback.js

@@ -0,0 +1,65 @@
+/**
+ * @module @cas-system/nextjs-cas-client/handlers/callback
+ * @description API route handler for the CAS SSO callback endpoint.
+ *
+ * After the CAS server authenticates the user it redirects to
+ * `{callbackUrl}?token=JWT_TOKEN`.  This handler:
+ *
+ * 1. Extracts the `token` query parameter.
+ * 2. Validates it server-side via the CAS `/api/validate-token` endpoint.
+ * 3. Sets an encrypted session cookie.
+ * 4. Redirects the user to the intended URL (or `/`).
+ *
+ * @example
+ * ```ts
+ * // app/api/cas/callback/route.ts
+ * import { createCallbackHandler } from '@cas-system/nextjs-cas-client/handlers';
+ *
+ * const handler = createCallbackHandler({
+ *   cas: {
+ *     serverUrl: process.env.CAS_SERVER_URL!,
+ *     clientId: process.env.CAS_CLIENT_ID!,
+ *     clientSecret: process.env.CAS_CLIENT_SECRET!,
+ *   },
+ *   afterLoginUrl: '/dashboard',
+ * });
+ *
+ * export { handler as GET };
+ * ```
+ */
+import { NextResponse } from 'next/server';
+import { cookies } from 'next/headers';
+import { CasClient } from '../server/cas-client';
+import { setCasSession } from '../server/auth';
+/**
+ * Create a GET handler for `/api/cas/callback`.
+ *
+ * @param config - Handler configuration including CAS server details.
+ * @returns A Next.js App Router GET handler.
+ */
+export function createCallbackHandler(config) {
+    const cas = new CasClient(config.cas);
+    const afterLoginUrl = config.afterLoginUrl ?? '/';
+    return async function GET(request) {
+        const { searchParams } = request.nextUrl;
+        const token = searchParams.get('token');
+        const returnUrl = searchParams.get('returnUrl') ?? afterLoginUrl;
+        if (!token) {
+            console.error('[CasCallback] No token query parameter received.');
+            return NextResponse.redirect(new URL('/login?error=no_token', request.url));
+        }
+        // Validate the token server-side
+        const user = await cas.validateToken(token);
+        if (!user) {
+            console.error('[CasCallback] Token validation failed.');
+            return NextResponse.redirect(new URL('/login?error=invalid_token', request.url));
+        }
+        // Set session cookie
+        const cookieStore = await cookies();
+        await setCasSession(cookieStore, user, token);
+        // Redirect to the intended URL
+        const redirectUrl = new URL(returnUrl, request.url);
+        return NextResponse.redirect(redirectUrl);
+    };
+}
+//# sourceMappingURL=callback.js.map

package/dist/handlers/callback.js.map

@@ -0,0 +1 @@
+{"version":3,"file":"callback.js","sourceRoot":"","sources":["../../src/handlers/callback.ts"],"names":[],"mappings":"AAAA;;;;;;;;;;;;;;;;;;;;;;;;;;;;GA4BG;AAEH,OAAO,EAAe,YAAY,EAAE,MAAM,aAAa,CAAC;AACxD,OAAO,EAAE,OAAO,EAAE,MAAM,cAAc,CAAC;AAEvC,OAAO,EAAE,SAAS,EAAE,MAAM,sBAAsB,CAAC;AACjD,OAAO,EAAE,aAAa,EAAE,MAAM,gBAAgB,CAAC;AAE/C;;;;;GAKG;AACH,MAAM,UAAU,qBAAqB,CAAC,MAAwB;IAC5D,MAAM,GAAG,GAAG,IAAI,SAAS,CAAC,MAAM,CAAC,GAAG,CAAC,CAAC;IACtC,MAAM,aAAa,GAAG,MAAM,CAAC,aAAa,IAAI,GAAG,CAAC;IAElD,OAAO,KAAK,UAAU,GAAG,CAAC,OAAoB;QAC5C,MAAM,EAAE,YAAY,EAAE,GAAG,OAAO,CAAC,OAAO,CAAC;QACzC,MAAM,KAAK,GAAG,YAAY,CAAC,GAAG,CAAC,OAAO,CAAC,CAAC;QACxC,MAAM,SAAS,GAAG,YAAY,CAAC,GAAG,CAAC,WAAW,CAAC,IAAI,aAAa,CAAC;QAEjE,IAAI,CAAC,KAAK,EAAE,CAAC;YACX,OAAO,CAAC,KAAK,CAAC,kDAAkD,CAAC,CAAC;YAClE,OAAO,YAAY,CAAC,QAAQ,CAAC,IAAI,GAAG,CAAC,uBAAuB,EAAE,OAAO,CAAC,GAAG,CAAC,CAAC,CAAC;QAC9E,CAAC;QAED,iCAAiC;QACjC,MAAM,IAAI,GAAG,MAAM,GAAG,CAAC,aAAa,CAAC,KAAK,CAAC,CAAC;QAE5C,IAAI,CAAC,IAAI,EAAE,CAAC;YACV,OAAO,CAAC,KAAK,CAAC,wCAAwC,CAAC,CAAC;YACxD,OAAO,YAAY,CAAC,QAAQ,CAC1B,IAAI,GAAG,CAAC,4BAA4B,EAAE,OAAO,CAAC,GAAG,CAAC,CACnD,CAAC;QACJ,CAAC;QAED,qBAAqB;QACrB,MAAM,WAAW,GAAG,MAAM,OAAO,EAAE,CAAC;QACpC,MAAM,aAAa,CAAC,WAAW,EAAE,IAAI,EAAE,KAAK,CAAC,CAAC;QAE9C,+BAA+B;QAC/B,MAAM,WAAW,GAAG,IAAI,GAAG,CAAC,SAAS,EAAE,OAAO,CAAC,GAAG,CAAC,CAAC;QACpD,OAAO,YAAY,CAAC,QAAQ,CAAC,WAAW,CAAC,CAAC;IAC5C,CAAC,CAAC;AACJ,CAAC"}

package/dist/handlers/index.d.ts

@@ -0,0 +1,8 @@
+/**
+ * @module @cas-system/nextjs-cas-client/handlers
+ * @description Re-exports all API route handler factories.
+ */
+export { createCallbackHandler } from './callback';
+export { createLogoutHandler } from './logout';
+export { createUserHandler } from './user';
+//# sourceMappingURL=index.d.ts.map

package/dist/handlers/index.d.ts.map

@@ -0,0 +1 @@
+{"version":3,"file":"index.d.ts","sourceRoot":"","sources":["../../src/handlers/index.ts"],"names":[],"mappings":"AAAA;;;GAGG;AAEH,OAAO,EAAE,qBAAqB,EAAE,MAAM,YAAY,CAAC;AACnD,OAAO,EAAE,mBAAmB,EAAE,MAAM,UAAU,CAAC;AAC/C,OAAO,EAAE,iBAAiB,EAAE,MAAM,QAAQ,CAAC"}

package/dist/handlers/index.js

@@ -0,0 +1,8 @@
+/**
+ * @module @cas-system/nextjs-cas-client/handlers
+ * @description Re-exports all API route handler factories.
+ */
+export { createCallbackHandler } from './callback';
+export { createLogoutHandler } from './logout';
+export { createUserHandler } from './user';
+//# sourceMappingURL=index.js.map

package/dist/handlers/index.js.map

@@ -0,0 +1 @@
+{"version":3,"file":"index.js","sourceRoot":"","sources":["../../src/handlers/index.ts"],"names":[],"mappings":"AAAA;;;GAGG;AAEH,OAAO,EAAE,qBAAqB,EAAE,MAAM,YAAY,CAAC;AACnD,OAAO,EAAE,mBAAmB,EAAE,MAAM,UAAU,CAAC;AAC/C,OAAO,EAAE,iBAAiB,EAAE,MAAM,QAAQ,CAAC"}

package/dist/handlers/logout.d.ts

@@ -0,0 +1,36 @@
+/**
+ * @module @cas-system/nextjs-cas-client/handlers/logout
+ * @description API route handler for the CAS logout endpoint.
+ *
+ * 1. Reads the session to obtain the JWT token.
+ * 2. Notifies the CAS server of the logout.
+ * 3. Clears the session cookies.
+ * 4. Redirects the user (or returns 200 for API calls).
+ *
+ * @example
+ * ```ts
+ * // app/api/cas/logout/route.ts
+ * import { createLogoutHandler } from '@cas-system/nextjs-cas-client/handlers';
+ *
+ * const handler = createLogoutHandler({
+ *   cas: {
+ *     serverUrl: process.env.CAS_SERVER_URL!,
+ *     clientId: process.env.CAS_CLIENT_ID!,
+ *     clientSecret: process.env.CAS_CLIENT_SECRET!,
+ *   },
+ *   afterLogoutUrl: '/',
+ * });
+ *
+ * export { handler as POST };
+ * ```
+ */
+import { NextRequest, NextResponse } from 'next/server';
+import type { CasHandlerConfig } from '../types';
+/**
+ * Create a POST handler for `/api/cas/logout`.
+ *
+ * @param config - Handler configuration.
+ * @returns A Next.js App Router POST handler.
+ */
+export declare function createLogoutHandler(config: CasHandlerConfig): (request: NextRequest) => Promise<NextResponse>;
+//# sourceMappingURL=logout.d.ts.map

package/dist/handlers/logout.d.ts.map

@@ -0,0 +1 @@
+{"version":3,"file":"logout.d.ts","sourceRoot":"","sources":["../../src/handlers/logout.ts"],"names":[],"mappings":"AAAA;;;;;;;;;;;;;;;;;;;;;;;;;GAyBG;AAEH,OAAO,EAAE,WAAW,EAAE,YAAY,EAAE,MAAM,aAAa,CAAC;AAExD,OAAO,KAAK,EAAE,gBAAgB,EAAE,MAAM,UAAU,CAAC;AAIjD;;;;;GAKG;AACH,wBAAgB,mBAAmB,CAAC,MAAM,EAAE,gBAAgB,IAI/B,SAAS,WAAW,KAAG,OAAO,CAAC,YAAY,CAAC,CAyBxE"}

package/dist/handlers/logout.js

@@ -0,0 +1,61 @@
+/**
+ * @module @cas-system/nextjs-cas-client/handlers/logout
+ * @description API route handler for the CAS logout endpoint.
+ *
+ * 1. Reads the session to obtain the JWT token.
+ * 2. Notifies the CAS server of the logout.
+ * 3. Clears the session cookies.
+ * 4. Redirects the user (or returns 200 for API calls).
+ *
+ * @example
+ * ```ts
+ * // app/api/cas/logout/route.ts
+ * import { createLogoutHandler } from '@cas-system/nextjs-cas-client/handlers';
+ *
+ * const handler = createLogoutHandler({
+ *   cas: {
+ *     serverUrl: process.env.CAS_SERVER_URL!,
+ *     clientId: process.env.CAS_CLIENT_ID!,
+ *     clientSecret: process.env.CAS_CLIENT_SECRET!,
+ *   },
+ *   afterLogoutUrl: '/',
+ * });
+ *
+ * export { handler as POST };
+ * ```
+ */
+import { NextResponse } from 'next/server';
+import { cookies } from 'next/headers';
+import { CasClient } from '../server/cas-client';
+import { getCasSession, clearCasSession } from '../server/auth';
+/**
+ * Create a POST handler for `/api/cas/logout`.
+ *
+ * @param config - Handler configuration.
+ * @returns A Next.js App Router POST handler.
+ */
+export function createLogoutHandler(config) {
+    const cas = new CasClient(config.cas);
+    const afterLogoutUrl = config.afterLogoutUrl ?? '/';
+    return async function POST(request) {
+        const cookieStore = await cookies();
+        // Attempt to read the current session for the token
+        const session = await getCasSession(cookieStore);
+        // Notify the CAS server (best-effort)
+        if (session?.token) {
+            await cas.logout(session.token).catch(() => {
+                // Swallow — the local session will be cleared regardless
+            });
+        }
+        // Clear local session cookies
+        clearCasSession(cookieStore);
+        // If the request expects JSON (e.g. fetch from client), return 200
+        const accept = request.headers.get('accept') ?? '';
+        if (accept.includes('application/json')) {
+            return NextResponse.json({ success: true });
+        }
+        // Otherwise redirect
+        return NextResponse.redirect(new URL(afterLogoutUrl, request.url));
+    };
+}
+//# sourceMappingURL=logout.js.map

package/dist/handlers/logout.js.map

@@ -0,0 +1 @@
+{"version":3,"file":"logout.js","sourceRoot":"","sources":["../../src/handlers/logout.ts"],"names":[],"mappings":"AAAA;;;;;;;;;;;;;;;;;;;;;;;;;GAyBG;AAEH,OAAO,EAAe,YAAY,EAAE,MAAM,aAAa,CAAC;AACxD,OAAO,EAAE,OAAO,EAAE,MAAM,cAAc,CAAC;AAEvC,OAAO,EAAE,SAAS,EAAE,MAAM,sBAAsB,CAAC;AACjD,OAAO,EAAE,aAAa,EAAE,eAAe,EAAE,MAAM,gBAAgB,CAAC;AAEhE;;;;;GAKG;AACH,MAAM,UAAU,mBAAmB,CAAC,MAAwB;IAC1D,MAAM,GAAG,GAAG,IAAI,SAAS,CAAC,MAAM,CAAC,GAAG,CAAC,CAAC;IACtC,MAAM,cAAc,GAAG,MAAM,CAAC,cAAc,IAAI,GAAG,CAAC;IAEpD,OAAO,KAAK,UAAU,IAAI,CAAC,OAAoB;QAC7C,MAAM,WAAW,GAAG,MAAM,OAAO,EAAE,CAAC;QAEpC,oDAAoD;QACpD,MAAM,OAAO,GAAG,MAAM,aAAa,CAAC,WAAW,CAAC,CAAC;QAEjD,sCAAsC;QACtC,IAAI,OAAO,EAAE,KAAK,EAAE,CAAC;YACnB,MAAM,GAAG,CAAC,MAAM,CAAC,OAAO,CAAC,KAAK,CAAC,CAAC,KAAK,CAAC,GAAG,EAAE;gBACzC,yDAAyD;YAC3D,CAAC,CAAC,CAAC;QACL,CAAC;QAED,8BAA8B;QAC9B,eAAe,CAAC,WAAW,CAAC,CAAC;QAE7B,mEAAmE;QACnE,MAAM,MAAM,GAAG,OAAO,CAAC,OAAO,CAAC,GAAG,CAAC,QAAQ,CAAC,IAAI,EAAE,CAAC;QACnD,IAAI,MAAM,CAAC,QAAQ,CAAC,kBAAkB,CAAC,EAAE,CAAC;YACxC,OAAO,YAAY,CAAC,IAAI,CAAC,EAAE,OAAO,EAAE,IAAI,EAAE,CAAC,CAAC;QAC9C,CAAC;QAED,qBAAqB;QACrB,OAAO,YAAY,CAAC,QAAQ,CAAC,IAAI,GAAG,CAAC,cAAc,EAAE,OAAO,CAAC,GAAG,CAAC,CAAC,CAAC;IACrE,CAAC,CAAC;AACJ,CAAC"}

package/dist/handlers/user.d.ts

@@ -0,0 +1,27 @@
+/**
+ * @module @cas-system/nextjs-cas-client/handlers/user
+ * @description API route handler that returns the current CAS user from
+ * the session cookie.  This endpoint is called by the client-side
+ * `CasProvider` to hydrate the auth state.
+ *
+ * @example
+ * ```ts
+ * // app/api/cas/user/route.ts
+ * import { createUserHandler } from '@cas-system/nextjs-cas-client/handlers';
+ *
+ * const handler = createUserHandler();
+ * export { handler as GET };
+ * ```
+ */
+import { NextResponse } from 'next/server';
+/**
+ * Create a GET handler for `/api/cas/user`.
+ *
+ * Returns `{ user: CasUser }` when authenticated, or `401` otherwise.
+ * The response includes `Cache-Control: no-store` to prevent caching of
+ * auth state.
+ *
+ * @returns A Next.js App Router GET handler.
+ */
+export declare function createUserHandler(): () => Promise<NextResponse>;
+//# sourceMappingURL=user.d.ts.map

package/dist/handlers/user.d.ts.map

@@ -0,0 +1 @@
+{"version":3,"file":"user.d.ts","sourceRoot":"","sources":["../../src/handlers/user.ts"],"names":[],"mappings":"AAAA;;;;;;;;;;;;;;GAcG;AAEH,OAAO,EAAE,YAAY,EAAE,MAAM,aAAa,CAAC;AAI3C;;;;;;;;GAQG;AACH,wBAAgB,iBAAiB,UACF,OAAO,CAAC,YAAY,CAAC,CAsBnD"}

package/dist/handlers/user.js

@@ -0,0 +1,44 @@
+/**
+ * @module @cas-system/nextjs-cas-client/handlers/user
+ * @description API route handler that returns the current CAS user from
+ * the session cookie.  This endpoint is called by the client-side
+ * `CasProvider` to hydrate the auth state.
+ *
+ * @example
+ * ```ts
+ * // app/api/cas/user/route.ts
+ * import { createUserHandler } from '@cas-system/nextjs-cas-client/handlers';
+ *
+ * const handler = createUserHandler();
+ * export { handler as GET };
+ * ```
+ */
+import { NextResponse } from 'next/server';
+import { cookies } from 'next/headers';
+import { getCasSession } from '../server/auth';
+/**
+ * Create a GET handler for `/api/cas/user`.
+ *
+ * Returns `{ user: CasUser }` when authenticated, or `401` otherwise.
+ * The response includes `Cache-Control: no-store` to prevent caching of
+ * auth state.
+ *
+ * @returns A Next.js App Router GET handler.
+ */
+export function createUserHandler() {
+    return async function GET() {
+        const cookieStore = await cookies();
+        const session = await getCasSession(cookieStore);
+        if (!session) {
+            return NextResponse.json({ user: null, error: 'Not authenticated' }, {
+                status: 401,
+                headers: { 'Cache-Control': 'no-store' },
+            });
+        }
+        return NextResponse.json({ user: session.user }, {
+            status: 200,
+            headers: { 'Cache-Control': 'no-store' },
+        });
+    };
+}
+//# sourceMappingURL=user.js.map

package/dist/handlers/user.js.map

@@ -0,0 +1 @@
+{"version":3,"file":"user.js","sourceRoot":"","sources":["../../src/handlers/user.ts"],"names":[],"mappings":"AAAA;;;;;;;;;;;;;;GAcG;AAEH,OAAO,EAAE,YAAY,EAAE,MAAM,aAAa,CAAC;AAC3C,OAAO,EAAE,OAAO,EAAE,MAAM,cAAc,CAAC;AACvC,OAAO,EAAE,aAAa,EAAE,MAAM,gBAAgB,CAAC;AAE/C;;;;;;;;GAQG;AACH,MAAM,UAAU,iBAAiB;IAC/B,OAAO,KAAK,UAAU,GAAG;QACvB,MAAM,WAAW,GAAG,MAAM,OAAO,EAAE,CAAC;QACpC,MAAM,OAAO,GAAG,MAAM,aAAa,CAAC,WAAW,CAAC,CAAC;QAEjD,IAAI,CAAC,OAAO,EAAE,CAAC;YACb,OAAO,YAAY,CAAC,IAAI,CACtB,EAAE,IAAI,EAAE,IAAI,EAAE,KAAK,EAAE,mBAAmB,EAAE,EAC1C;gBACE,MAAM,EAAE,GAAG;gBACX,OAAO,EAAE,EAAE,eAAe,EAAE,UAAU,EAAE;aACzC,CACF,CAAC;QACJ,CAAC;QAED,OAAO,YAAY,CAAC,IAAI,CACtB,EAAE,IAAI,EAAE,OAAO,CAAC,IAAI,EAAE,EACtB;YACE,MAAM,EAAE,GAAG;YACX,OAAO,EAAE,EAAE,eAAe,EAAE,UAAU,EAAE;SACzC,CACF,CAAC;IACJ,CAAC,CAAC;AACJ,CAAC"}

package/dist/hooks/useCasAuth.d.ts

@@ -0,0 +1,32 @@
+/**
+ * @module @cas-system/nextjs-cas-client/hooks/useCasAuth
+ * @description Client-side hook for accessing CAS authentication state and
+ * actions (login, logout, refresh).
+ *
+ * @example
+ * ```tsx
+ * 'use client';
+ * import { useCasAuth } from '@cas-system/nextjs-cas-client';
+ *
+ * export function Navbar() {
+ *   const { user, isAuthenticated, login, logout } = useCasAuth();
+ *
+ *   return isAuthenticated ? (
+ *     <button onClick={logout}>Sign out ({user?.username})</button>
+ *   ) : (
+ *     <button onClick={() => login()}>Sign in</button>
+ *   );
+ * }
+ * ```
+ */
+import type { CasAuthContext } from '../types';
+/**
+ * Access CAS authentication state and actions.
+ *
+ * This is a convenience re-export of the context hook.  Must be used inside
+ * a `<CasProvider>`.
+ *
+ * @returns The full {@link CasAuthContext}.
+ */
+export declare function useCasAuth(): CasAuthContext;
+//# sourceMappingURL=useCasAuth.d.ts.map

package/dist/hooks/useCasAuth.d.ts.map

@@ -0,0 +1 @@
+{"version":3,"file":"useCasAuth.d.ts","sourceRoot":"","sources":["../../src/hooks/useCasAuth.ts"],"names":[],"mappings":"AAEA;;;;;;;;;;;;;;;;;;;;GAoBG;AAEH,OAAO,KAAK,EAAE,cAAc,EAAE,MAAM,UAAU,CAAC;AAG/C;;;;;;;GAOG;AACH,wBAAgB,UAAU,IAAI,cAAc,CAE3C"}

package/dist/hooks/useCasAuth.js

@@ -0,0 +1,14 @@
+'use client';
+import { useCasAuthContext } from '../CasProvider';
+/**
+ * Access CAS authentication state and actions.
+ *
+ * This is a convenience re-export of the context hook.  Must be used inside
+ * a `<CasProvider>`.
+ *
+ * @returns The full {@link CasAuthContext}.
+ */
+export function useCasAuth() {
+    return useCasAuthContext();
+}
+//# sourceMappingURL=useCasAuth.js.map

package/dist/hooks/useCasAuth.js.map

@@ -0,0 +1 @@
+{"version":3,"file":"useCasAuth.js","sourceRoot":"","sources":["../../src/hooks/useCasAuth.ts"],"names":[],"mappings":"AAAA,YAAY,CAAC;AAyBb,OAAO,EAAE,iBAAiB,EAAE,MAAM,gBAAgB,CAAC;AAEnD;;;;;;;GAOG;AACH,MAAM,UAAU,UAAU;IACxB,OAAO,iBAAiB,EAAE,CAAC;AAC7B,CAAC"}

package/dist/hooks/useCasUser.d.ts

@@ -0,0 +1,33 @@
+import type { CasUser } from '../types';
+/** Return type of {@link useCasUser}. */
+export interface UseCasUserReturn {
+    /** The current user, or `null` when not authenticated. */
+    user: CasUser | null;
+    /** Whether the initial session fetch is still loading. */
+    isLoading: boolean;
+    /** Whether a valid session exists. */
+    isAuthenticated: boolean;
+    /**
+     * Check whether the current user has **all** of the specified roles.
+     *
+     * @param roles - Required roles.
+     * @returns `true` if the user possesses every role (or the list is empty).
+     */
+    hasRole: (...roles: string[]) => boolean;
+    /**
+     * Check whether the current user has **at least one** of the specified roles.
+     *
+     * @param roles - Roles to check.
+     * @returns `true` if the user possesses any one role.
+     */
+    hasAnyRole: (...roles: string[]) => boolean;
+    /** All roles assigned to the current user (empty array when unauthenticated). */
+    roles: string[];
+}
+/**
+ * Hook for accessing the current CAS user and performing role checks.
+ *
+ * Must be used inside a `<CasProvider>`.
+ */
+export declare function useCasUser(): UseCasUserReturn;
+//# sourceMappingURL=useCasUser.d.ts.map

package/dist/hooks/useCasUser.d.ts.map

@@ -0,0 +1 @@
+{"version":3,"file":"useCasUser.d.ts","sourceRoot":"","sources":["../../src/hooks/useCasUser.ts"],"names":[],"mappings":"AAyBA,OAAO,KAAK,EAAE,OAAO,EAAE,MAAM,UAAU,CAAC;AAGxC,yCAAyC;AACzC,MAAM,WAAW,gBAAgB;IAC/B,0DAA0D;IAC1D,IAAI,EAAE,OAAO,GAAG,IAAI,CAAC;IAErB,0DAA0D;IAC1D,SAAS,EAAE,OAAO,CAAC;IAEnB,sCAAsC;IACtC,eAAe,EAAE,OAAO,CAAC;IAEzB;;;;;OAKG;IACH,OAAO,EAAE,CAAC,GAAG,KAAK,EAAE,MAAM,EAAE,KAAK,OAAO,CAAC;IAEzC;;;;;OAKG;IACH,UAAU,EAAE,CAAC,GAAG,KAAK,EAAE,MAAM,EAAE,KAAK,OAAO,CAAC;IAE5C,iFAAiF;IACjF,KAAK,EAAE,MAAM,EAAE,CAAC;CACjB;AAED;;;;GAIG;AACH,wBAAgB,UAAU,IAAI,gBAAgB,CAsB7C"}

package/dist/hooks/useCasUser.js

@@ -0,0 +1,45 @@
+'use client';
+/**
+ * @module @cas-system/nextjs-cas-client/hooks/useCasUser
+ * @description Client-side hook focused on the current CAS user and
+ * role-based access control helpers.
+ *
+ * @example
+ * ```tsx
+ * 'use client';
+ * import { useCasUser } from '@cas-system/nextjs-cas-client';
+ *
+ * export function AdminPanel() {
+ *   const { user, hasRole, hasAnyRole } = useCasUser();
+ *
+ *   if (!hasRole('admin')) {
+ *     return <p>Access denied</p>;
+ *   }
+ *
+ *   return <h1>Welcome admin {user?.username}</h1>;
+ * }
+ * ```
+ */
+import { useCallback, useMemo } from 'react';
+import { useCasAuthContext } from '../CasProvider';
+/**
+ * Hook for accessing the current CAS user and performing role checks.
+ *
+ * Must be used inside a `<CasProvider>`.
+ */
+export function useCasUser() {
+    const { user, isLoading, isAuthenticated } = useCasAuthContext();
+    const roles = useMemo(() => user?.roles ?? [], [user]);
+    const hasRole = useCallback((...required) => {
+        if (!user?.roles)
+            return required.length === 0;
+        return required.every((r) => user.roles.includes(r));
+    }, [user]);
+    const hasAnyRole = useCallback((...candidates) => {
+        if (!user?.roles)
+            return false;
+        return candidates.some((r) => user.roles.includes(r));
+    }, [user]);
+    return { user, isLoading, isAuthenticated, hasRole, hasAnyRole, roles };
+}
+//# sourceMappingURL=useCasUser.js.map

package/dist/hooks/useCasUser.js.map

@@ -0,0 +1 @@
+{"version":3,"file":"useCasUser.js","sourceRoot":"","sources":["../../src/hooks/useCasUser.ts"],"names":[],"mappings":"AAAA,YAAY,CAAC;AAEb;;;;;;;;;;;;;;;;;;;;GAoBG;AAEH,OAAO,EAAE,WAAW,EAAE,OAAO,EAAE,MAAM,OAAO,CAAC;AAE7C,OAAO,EAAE,iBAAiB,EAAE,MAAM,gBAAgB,CAAC;AAiCnD;;;;GAIG;AACH,MAAM,UAAU,UAAU;IACxB,MAAM,EAAE,IAAI,EAAE,SAAS,EAAE,eAAe,EAAE,GAAG,iBAAiB,EAAE,CAAC;IAEjE,MAAM,KAAK,GAAG,OAAO,CAAC,GAAG,EAAE,CAAC,IAAI,EAAE,KAAK,IAAI,EAAE,EAAE,CAAC,IAAI,CAAC,CAAC,CAAC;IAEvD,MAAM,OAAO,GAAG,WAAW,CACzB,CAAC,GAAG,QAAkB,EAAE,EAAE;QACxB,IAAI,CAAC,IAAI,EAAE,KAAK;YAAE,OAAO,QAAQ,CAAC,MAAM,KAAK,CAAC,CAAC;QAC/C,OAAO,QAAQ,CAAC,KAAK,CAAC,CAAC,CAAC,EAAE,EAAE,CAAC,IAAI,CAAC,KAAM,CAAC,QAAQ,CAAC,CAAC,CAAC,CAAC,CAAC;IACxD,CAAC,EACD,CAAC,IAAI,CAAC,CACP,CAAC;IAEF,MAAM,UAAU,GAAG,WAAW,CAC5B,CAAC,GAAG,UAAoB,EAAE,EAAE;QAC1B,IAAI,CAAC,IAAI,EAAE,KAAK;YAAE,OAAO,KAAK,CAAC;QAC/B,OAAO,UAAU,CAAC,IAAI,CAAC,CAAC,CAAC,EAAE,EAAE,CAAC,IAAI,CAAC,KAAM,CAAC,QAAQ,CAAC,CAAC,CAAC,CAAC,CAAC;IACzD,CAAC,EACD,CAAC,IAAI,CAAC,CACP,CAAC;IAEF,OAAO,EAAE,IAAI,EAAE,SAAS,EAAE,eAAe,EAAE,OAAO,EAAE,UAAU,EAAE,KAAK,EAAE,CAAC;AAC1E,CAAC"}

package/dist/index.d.ts

@@ -0,0 +1,19 @@
+/**
+ * @module @cas-system/nextjs-cas-client
+ * @description Public entry point for the Next.js CAS Client SDK.
+ *
+ * Re-exports the client-side provider, hooks, components, and shared types.
+ * Server-only helpers live under `@cas-system/nextjs-cas-client/server`,
+ * route handlers under `/handlers`, and middleware under `/middleware`.
+ */
+export { CasProvider, useCasAuthContext } from './CasProvider';
+export type { CasProviderProps } from './CasProvider';
+export { useCasAuth } from './hooks/useCasAuth';
+export { useCasUser } from './hooks/useCasUser';
+export type { UseCasUserReturn } from './hooks/useCasUser';
+export { CasLoginButton } from './components/CasLoginButton';
+export type { CasLoginButtonProps } from './components/CasLoginButton';
+export { CasProtectedRoute } from './components/CasProtectedRoute';
+export type { CasProtectedRouteProps } from './components/CasProtectedRoute';
+export type { CasConfig, CasServerConfig, CasUser, CasSessionData, CasMiddlewareConfig, CasAuthContext, CasHandlerConfig, } from './types';
+//# sourceMappingURL=index.d.ts.map

package/dist/index.d.ts.map

@@ -0,0 +1 @@
+{"version":3,"file":"index.d.ts","sourceRoot":"","sources":["../src/index.ts"],"names":[],"mappings":"AAAA;;;;;;;GAOG;AAGH,OAAO,EAAE,WAAW,EAAE,iBAAiB,EAAE,MAAM,eAAe,CAAC;AAC/D,YAAY,EAAE,gBAAgB,EAAE,MAAM,eAAe,CAAC;AAGtD,OAAO,EAAE,UAAU,EAAE,MAAM,oBAAoB,CAAC;AAChD,OAAO,EAAE,UAAU,EAAE,MAAM,oBAAoB,CAAC;AAChD,YAAY,EAAE,gBAAgB,EAAE,MAAM,oBAAoB,CAAC;AAG3D,OAAO,EAAE,cAAc,EAAE,MAAM,6BAA6B,CAAC;AAC7D,YAAY,EAAE,mBAAmB,EAAE,MAAM,6BAA6B,CAAC;AACvE,OAAO,EAAE,iBAAiB,EAAE,MAAM,gCAAgC,CAAC;AACnE,YAAY,EAAE,sBAAsB,EAAE,MAAM,gCAAgC,CAAC;AAG7E,YAAY,EACV,SAAS,EACT,eAAe,EACf,OAAO,EACP,cAAc,EACd,mBAAmB,EACnB,cAAc,EACd,gBAAgB,GACjB,MAAM,SAAS,CAAC"}

package/dist/index.js

@@ -0,0 +1,17 @@
+/**
+ * @module @cas-system/nextjs-cas-client
+ * @description Public entry point for the Next.js CAS Client SDK.
+ *
+ * Re-exports the client-side provider, hooks, components, and shared types.
+ * Server-only helpers live under `@cas-system/nextjs-cas-client/server`,
+ * route handlers under `/handlers`, and middleware under `/middleware`.
+ */
+// Provider + context hook
+export { CasProvider, useCasAuthContext } from './CasProvider';
+// Hooks
+export { useCasAuth } from './hooks/useCasAuth';
+export { useCasUser } from './hooks/useCasUser';
+// Components
+export { CasLoginButton } from './components/CasLoginButton';
+export { CasProtectedRoute } from './components/CasProtectedRoute';
+//# sourceMappingURL=index.js.map

package/dist/index.js.map

@@ -0,0 +1 @@
+{"version":3,"file":"index.js","sourceRoot":"","sources":["../src/index.ts"],"names":[],"mappings":"AAAA;;;;;;;GAOG;AAEH,0BAA0B;AAC1B,OAAO,EAAE,WAAW,EAAE,iBAAiB,EAAE,MAAM,eAAe,CAAC;AAG/D,QAAQ;AACR,OAAO,EAAE,UAAU,EAAE,MAAM,oBAAoB,CAAC;AAChD,OAAO,EAAE,UAAU,EAAE,MAAM,oBAAoB,CAAC;AAGhD,aAAa;AACb,OAAO,EAAE,cAAc,EAAE,MAAM,6BAA6B,CAAC;AAE7D,OAAO,EAAE,iBAAiB,EAAE,MAAM,gCAAgC,CAAC"}

package/dist/middleware.d.ts

@@ -0,0 +1,40 @@
+/**
+ * @module @cas-system/nextjs-cas-client/middleware
+ * @description Factory for creating a Next.js middleware that guards routes
+ * behind CAS authentication.
+ *
+ * @example
+ * ```ts
+ * // middleware.ts (project root)
+ * import { createCasMiddleware } from '@cas-system/nextjs-cas-client/middleware';
+ *
+ * export default createCasMiddleware({
+ *   protectedPaths: ['/dashboard', '/admin', '/settings'],
+ *   publicPaths: ['/api/health'],
+ *   loginPath: '/login',
+ * });
+ *
+ * export const config = {
+ *   matcher: ['/((?!_next/static|_next/image|favicon.ico).*)'],
+ * };
+ * ```
+ */
+import { NextRequest, NextResponse } from 'next/server';
+import type { CasMiddlewareConfig } from './types';
+/**
+ * Create a Next.js middleware function that enforces CAS authentication on
+ * the configured protected paths.
+ *
+ * @param config - Middleware configuration.
+ * @returns A Next.js-compatible middleware function.
+ *
+ * @remarks
+ * - If the request targets a **public path** it is always allowed through.
+ * - If the request targets a **protected path** and there is no valid CAS
+ *   session cookie, the user is redirected to either the `loginPath` (if
+ *   set) or the CAS server SSO login page.
+ * - The original URL is forwarded as a `?returnUrl=…` query parameter so
+ *   the login page can redirect back after authentication.
+ */
+export declare function createCasMiddleware(config: CasMiddlewareConfig): (request: NextRequest) => Promise<NextResponse>;
+//# sourceMappingURL=middleware.d.ts.map

package/dist/middleware.d.ts.map

@@ -0,0 +1 @@
+{"version":3,"file":"middleware.d.ts","sourceRoot":"","sources":["../src/middleware.ts"],"names":[],"mappings":"AAAA;;;;;;;;;;;;;;;;;;;;GAoBG;AAEH,OAAO,EAAE,WAAW,EAAE,YAAY,EAAE,MAAM,aAAa,CAAC;AACxD,OAAO,KAAK,EAAE,mBAAmB,EAAE,MAAM,SAAS,CAAC;AAanD;;;;;;;;;;;;;;GAcG;AACH,wBAAgB,mBAAmB,CAAC,MAAM,EAAE,mBAAmB,IAQ3D,SAAS,WAAW,KACnB,OAAO,CAAC,YAAY,CAAC,CA+EzB"}

package/dist/middleware.js

@@ -0,0 +1,111 @@
+/**
+ * @module @cas-system/nextjs-cas-client/middleware
+ * @description Factory for creating a Next.js middleware that guards routes
+ * behind CAS authentication.
+ *
+ * @example
+ * ```ts
+ * // middleware.ts (project root)
+ * import { createCasMiddleware } from '@cas-system/nextjs-cas-client/middleware';
+ *
+ * export default createCasMiddleware({
+ *   protectedPaths: ['/dashboard', '/admin', '/settings'],
+ *   publicPaths: ['/api/health'],
+ *   loginPath: '/login',
+ * });
+ *
+ * export const config = {
+ *   matcher: ['/((?!_next/static|_next/image|favicon.ico).*)'],
+ * };
+ * ```
+ */
+import { NextResponse } from 'next/server';
+import { getCasSessionFromRequest } from './server/auth';
+/**
+ * Check whether `pathname` starts with any of the given prefixes.
+ * @internal
+ */
+function matchesAny(pathname, prefixes) {
+    return prefixes.some((p) => pathname === p || pathname.startsWith(p.endsWith('/') ? p : `${p}/`));
+}
+/**
+ * Create a Next.js middleware function that enforces CAS authentication on
+ * the configured protected paths.
+ *
+ * @param config - Middleware configuration.
+ * @returns A Next.js-compatible middleware function.
+ *
+ * @remarks
+ * - If the request targets a **public path** it is always allowed through.
+ * - If the request targets a **protected path** and there is no valid CAS
+ *   session cookie, the user is redirected to either the `loginPath` (if
+ *   set) or the CAS server SSO login page.
+ * - The original URL is forwarded as a `?returnUrl=…` query parameter so
+ *   the login page can redirect back after authentication.
+ */
+export function createCasMiddleware(config) {
+    const { protectedPaths, publicPaths = [], loginPath, } = config;
+    return async function casMiddleware(request) {
+        const { pathname } = request.nextUrl;
+        // 1. Skip static assets and internal Next.js routes
+        if (pathname.startsWith('/_next') ||
+            pathname.startsWith('/favicon') ||
+            pathname.includes('.')) {
+            return NextResponse.next();
+        }
+        // 2. Always allow explicitly public paths
+        if (matchesAny(pathname, publicPaths)) {
+            return NextResponse.next();
+        }
+        // 3. Check whether this path requires authentication
+        const isProtected = matchesAny(pathname, protectedPaths);
+        if (!isProtected) {
+            return NextResponse.next();
+        }
+        // 4. Attempt to read the session from cookies
+        const session = await getCasSessionFromRequest(request);
+        if (session) {
+            // Authenticated — attach user info as request headers so downstream
+            // Server Components / Route Handlers can read them without re-parsing
+            // the cookie.
+            const requestHeaders = new Headers(request.headers);
+            requestHeaders.set('x-cas-user', JSON.stringify(session.user));
+            requestHeaders.set('x-cas-authenticated', 'true');
+            return NextResponse.next({
+                request: { headers: requestHeaders },
+            });
+        }
+        // 5. Not authenticated — redirect to login
+        const returnUrl = request.nextUrl.pathname + request.nextUrl.search;
+        if (loginPath) {
+            // Redirect to the app's own login page
+            const loginUrl = new URL(loginPath, request.url);
+            loginUrl.searchParams.set('returnUrl', returnUrl);
+            return NextResponse.redirect(loginUrl);
+        }
+        // Redirect directly to the CAS SSO login page.
+        // The browser must reach CAS at its PUBLIC base url, which may differ from
+        // the internal back-channel url used for server-to-server validation.
+        // Prefer CAS_PUBLIC_URL; fall back to CAS_SERVER_URL for single-url setups.
+        const casServerUrl = process.env.CAS_PUBLIC_URL || process.env.CAS_SERVER_URL;
+        const casClientId = process.env.CAS_CLIENT_ID;
+        const casCallbackUrl = process.env.CAS_CALLBACK_URL ??
+            `${request.nextUrl.origin}/api/cas/callback`;
+        if (!casServerUrl || !casClientId) {
+            console.error('[CasMiddleware] CAS_SERVER_URL and CAS_CLIENT_ID env vars are required ' +
+                'when no loginPath is configured.');
+            return NextResponse.next();
+        }
+        // Encode the return URL into the callback so we can redirect after login
+        const callbackWithReturn = new URL(casCallbackUrl);
+        callbackWithReturn.searchParams.set('returnUrl', returnUrl);
+        const params = new URLSearchParams({
+            client_id: casClientId,
+            response_type: 'token',
+            redirect_uri: callbackWithReturn.toString(),
+        });
+        const casLoginUrl = `${casServerUrl.replace(/\/+$/, '')}/sso/login?${params.toString()}`;
+        return NextResponse.redirect(casLoginUrl);
+    };
+}
+//# sourceMappingURL=middleware.js.map

package/dist/middleware.js.map

@@ -0,0 +1 @@
+{"version":3,"file":"middleware.js","sourceRoot":"","sources":["../src/middleware.ts"],"names":[],"mappings":"AAAA;;;;;;;;;;;;;;;;;;;;GAoBG;AAEH,OAAO,EAAe,YAAY,EAAE,MAAM,aAAa,CAAC;AAExD,OAAO,EAAE,wBAAwB,EAAE,MAAM,eAAe,CAAC;AAEzD;;;GAGG;AACH,SAAS,UAAU,CAAC,QAAgB,EAAE,QAAkB;IACtD,OAAO,QAAQ,CAAC,IAAI,CAClB,CAAC,CAAC,EAAE,EAAE,CAAC,QAAQ,KAAK,CAAC,IAAI,QAAQ,CAAC,UAAU,CAAC,CAAC,CAAC,QAAQ,CAAC,GAAG,CAAC,CAAC,CAAC,CAAC,CAAC,CAAC,CAAC,CAAC,GAAG,CAAC,GAAG,CAAC,CAC5E,CAAC;AACJ,CAAC;AAED;;;;;;;;;;;;;;GAcG;AACH,MAAM,UAAU,mBAAmB,CAAC,MAA2B;IAC7D,MAAM,EACJ,cAAc,EACd,WAAW,GAAG,EAAE,EAChB,SAAS,GACV,GAAG,MAAM,CAAC;IAEX,OAAO,KAAK,UAAU,aAAa,CACjC,OAAoB;QAEpB,MAAM,EAAE,QAAQ,EAAE,GAAG,OAAO,CAAC,OAAO,CAAC;QAErC,oDAAoD;QACpD,IACE,QAAQ,CAAC,UAAU,CAAC,QAAQ,CAAC;YAC7B,QAAQ,CAAC,UAAU,CAAC,UAAU,CAAC;YAC/B,QAAQ,CAAC,QAAQ,CAAC,GAAG,CAAC,EACtB,CAAC;YACD,OAAO,YAAY,CAAC,IAAI,EAAE,CAAC;QAC7B,CAAC;QAED,0CAA0C;QAC1C,IAAI,UAAU,CAAC,QAAQ,EAAE,WAAW,CAAC,EAAE,CAAC;YACtC,OAAO,YAAY,CAAC,IAAI,EAAE,CAAC;QAC7B,CAAC;QAED,qDAAqD;QACrD,MAAM,WAAW,GAAG,UAAU,CAAC,QAAQ,EAAE,cAAc,CAAC,CAAC;QACzD,IAAI,CAAC,WAAW,EAAE,CAAC;YACjB,OAAO,YAAY,CAAC,IAAI,EAAE,CAAC;QAC7B,CAAC;QAED,8CAA8C;QAC9C,MAAM,OAAO,GAAG,MAAM,wBAAwB,CAAC,OAAO,CAAC,CAAC;QACxD,IAAI,OAAO,EAAE,CAAC;YACZ,oEAAoE;YACpE,sEAAsE;YACtE,cAAc;YACd,MAAM,cAAc,GAAG,IAAI,OAAO,CAAC,OAAO,CAAC,OAAO,CAAC,CAAC;YACpD,cAAc,CAAC,GAAG,CAAC,YAAY,EAAE,IAAI,CAAC,SAAS,CAAC,OAAO,CAAC,IAAI,CAAC,CAAC,CAAC;YAC/D,cAAc,CAAC,GAAG,CAAC,qBAAqB,EAAE,MAAM,CAAC,CAAC;YAElD,OAAO,YAAY,CAAC,IAAI,CAAC;gBACvB,OAAO,EAAE,EAAE,OAAO,EAAE,cAAc,EAAE;aACrC,CAAC,CAAC;QACL,CAAC;QAED,2CAA2C;QAC3C,MAAM,SAAS,GAAG,OAAO,CAAC,OAAO,CAAC,QAAQ,GAAG,OAAO,CAAC,OAAO,CAAC,MAAM,CAAC;QAEpE,IAAI,SAAS,EAAE,CAAC;YACd,uCAAuC;YACvC,MAAM,QAAQ,GAAG,IAAI,GAAG,CAAC,SAAS,EAAE,OAAO,CAAC,GAAG,CAAC,CAAC;YACjD,QAAQ,CAAC,YAAY,CAAC,GAAG,CAAC,WAAW,EAAE,SAAS,CAAC,CAAC;YAClD,OAAO,YAAY,CAAC,QAAQ,CAAC,QAAQ,CAAC,CAAC;QACzC,CAAC;QAED,+CAA+C;QAC/C,2EAA2E;QAC3E,sEAAsE;QACtE,4EAA4E;QAC5E,MAAM,YAAY,GAAG,OAAO,CAAC,GAAG,CAAC,cAAc,IAAI,OAAO,CAAC,GAAG,CAAC,cAAc,CAAC;QAC9E,MAAM,WAAW,GAAG,OAAO,CAAC,GAAG,CAAC,aAAa,CAAC;QAC9C,MAAM,cAAc,GAClB,OAAO,CAAC,GAAG,CAAC,gBAAgB;YAC5B,GAAG,OAAO,CAAC,OAAO,CAAC,MAAM,mBAAmB,CAAC;QAE/C,IAAI,CAAC,YAAY,IAAI,CAAC,WAAW,EAAE,CAAC;YAClC,OAAO,CAAC,KAAK,CACX,yEAAyE;gBACvE,kCAAkC,CACrC,CAAC;YACF,OAAO,YAAY,CAAC,IAAI,EAAE,CAAC;QAC7B,CAAC;QAED,yEAAyE;QACzE,MAAM,kBAAkB,GAAG,IAAI,GAAG,CAAC,cAAc,CAAC,CAAC;QACnD,kBAAkB,CAAC,YAAY,CAAC,GAAG,CAAC,WAAW,EAAE,SAAS,CAAC,CAAC;QAE5D,MAAM,MAAM,GAAG,IAAI,eAAe,CAAC;YACjC,SAAS,EAAE,WAAW;YACtB,aAAa,EAAE,OAAO;YACtB,YAAY,EAAE,kBAAkB,CAAC,QAAQ,EAAE;SAC5C,CAAC,CAAC;QAEH,MAAM,WAAW,GAAG,GAAG,YAAY,CAAC,OAAO,CAAC,MAAM,EAAE,EAAE,CAAC,cAAc,MAAM,CAAC,QAAQ,EAAE,EAAE,CAAC;QACzF,OAAO,YAAY,CAAC,QAAQ,CAAC,WAAW,CAAC,CAAC;IAC5C,CAAC,CAAC;AACJ,CAAC"}