@cas-system/nextjs-cas-client 1.0.0

package/dist/server/auth.d.ts

@@ -0,0 +1,111 @@
+/**
+ * @module @cas-system/nextjs-cas-client/server/auth
+ * @description Server-side session helpers for reading / writing CAS session
+ * data to Next.js cookies.
+ *
+ * The session is stored as a base-64 encoded JSON blob (signed with HMAC)
+ * inside an `HttpOnly`, `Secure`, `SameSite=Lax` cookie.  This gives us
+ * tamper-proof cookies without requiring any external crypto library.
+ *
+ * **Security model:**
+ * - The cookie is `HttpOnly` — JavaScript in the browser cannot read it.
+ * - A separate HMAC signature cookie prevents tampering.
+ * - Token validation always happens server-side via {@link CasClient}.
+ */
+import type { ReadonlyRequestCookies } from 'next/dist/server/web/spec-extension/adapters/request-cookies';
+import type { CasUser, CasSessionData } from '../types';
+import { NextRequest, NextResponse } from 'next/server';
+/**
+ * Read the CAS session from Next.js **request** cookies.
+ *
+ * Works in Server Components, Route Handlers, and middleware — anywhere
+ * you have access to the Next.js `cookies()` helper.
+ *
+ * @param cookies - The Next.js `cookies()` read-only store.
+ * @returns The session data, or `null` if no valid session exists.
+ *
+ * @example
+ * ```ts
+ * import { cookies } from 'next/headers';
+ * import { getCasSession } from '@cas-system/nextjs-cas-client/server';
+ *
+ * export default async function DashboardPage() {
+ *   const session = await getCasSession(cookies());
+ *   if (!session) redirect('/login');
+ *   return <h1>Hello {session.user.username}</h1>;
+ * }
+ * ```
+ */
+export declare function getCasSession(cookies: ReadonlyRequestCookies): Promise<CasSessionData | null>;
+/**
+ * Write the CAS session into Next.js **response** cookies.
+ *
+ * @param cookies - The Next.js `cookies()` store (must be writable — only
+ *                  available inside Route Handlers and Server Actions).
+ * @param user    - The authenticated user.
+ * @param token   - The raw JWT token.
+ *
+ * @example
+ * ```ts
+ * import { cookies } from 'next/headers';
+ * import { setCasSession } from '@cas-system/nextjs-cas-client/server';
+ *
+ * await setCasSession(cookies(), user, token);
+ * ```
+ */
+export declare function setCasSession(cookies: ReadonlyRequestCookies, user: CasUser, token: string): Promise<void>;
+/**
+ * Delete the CAS session cookies.
+ *
+ * @param cookies - The Next.js `cookies()` store.
+ *
+ * @example
+ * ```ts
+ * import { cookies } from 'next/headers';
+ * import { clearCasSession } from '@cas-system/nextjs-cas-client/server';
+ *
+ * clearCasSession(cookies());
+ * ```
+ */
+export declare function clearCasSession(cookies: ReadonlyRequestCookies): void;
+/** Typed Next.js App Router route handler signature. */
+type RouteHandler = (req: NextRequest, ctx?: {
+    params?: Record<string, string>;
+}) => Promise<NextResponse | Response> | NextResponse | Response;
+/** A route handler that receives the authenticated user as a 3rd argument. */
+type AuthenticatedHandler = (req: NextRequest, ctx: {
+    params?: Record<string, string>;
+}, user: CasUser) => Promise<NextResponse | Response> | NextResponse | Response;
+/**
+ * Higher-order function that wraps a Next.js App Router route handler,
+ * automatically extracting and verifying the CAS session and injecting the
+ * `CasUser` into the handler.
+ *
+ * If no valid session exists, responds with `401 Unauthorized`.
+ *
+ * @param handler - The protected route handler.
+ * @returns A standard Next.js route handler.
+ *
+ * @example
+ * ```ts
+ * // app/api/admin/route.ts
+ * import { withCasAuth } from '@cas-system/nextjs-cas-client/server';
+ *
+ * export const GET = withCasAuth(async (req, ctx, user) => {
+ *   return NextResponse.json({ message: `Hello ${user.username}` });
+ * });
+ * ```
+ */
+export declare function withCasAuth(handler: AuthenticatedHandler): RouteHandler;
+/**
+ * Read the CAS session from a plain `NextRequest` (useful in middleware
+ * and edge functions where the `cookies()` helper is not available).
+ *
+ * @param request - The incoming Next.js request.
+ * @returns Session data or `null`.
+ *
+ * @internal
+ */
+export declare function getCasSessionFromRequest(request: NextRequest): Promise<CasSessionData | null>;
+export {};
+//# sourceMappingURL=auth.d.ts.map

package/dist/server/auth.d.ts.map

@@ -0,0 +1 @@
+{"version":3,"file":"auth.d.ts","sourceRoot":"","sources":["../../src/server/auth.ts"],"names":[],"mappings":"AAAA;;;;;;;;;;;;;GAaG;AAEH,OAAO,KAAK,EAAE,sBAAsB,EAAE,MAAM,8DAA8D,CAAC;AAC3G,OAAO,KAAK,EAAE,OAAO,EAAE,cAAc,EAAE,MAAM,UAAU,CAAC;AACxD,OAAO,EAAE,WAAW,EAAE,YAAY,EAAE,MAAM,aAAa,CAAC;AA8DxD;;;;;;;;;;;;;;;;;;;;GAoBG;AACH,wBAAsB,aAAa,CACjC,OAAO,EAAE,sBAAsB,GAC9B,OAAO,CAAC,cAAc,GAAG,IAAI,CAAC,CAuBhC;AAED;;;;;;;;;;;;;;;GAeG;AACH,wBAAsB,aAAa,CACjC,OAAO,EAAE,sBAAsB,EAC/B,IAAI,EAAE,OAAO,EACb,KAAK,EAAE,MAAM,GACZ,OAAO,CAAC,IAAI,CAAC,CAgBf;AAED;;;;;;;;;;;;GAYG;AACH,wBAAgB,eAAe,CAAC,OAAO,EAAE,sBAAsB,GAAG,IAAI,CAGrE;AAMD,wDAAwD;AACxD,KAAK,YAAY,GAAG,CAClB,GAAG,EAAE,WAAW,EAChB,GAAG,CAAC,EAAE;IAAE,MAAM,CAAC,EAAE,MAAM,CAAC,MAAM,EAAE,MAAM,CAAC,CAAA;CAAE,KACtC,OAAO,CAAC,YAAY,GAAG,QAAQ,CAAC,GAAG,YAAY,GAAG,QAAQ,CAAC;AAEhE,8EAA8E;AAC9E,KAAK,oBAAoB,GAAG,CAC1B,GAAG,EAAE,WAAW,EAChB,GAAG,EAAE;IAAE,MAAM,CAAC,EAAE,MAAM,CAAC,MAAM,EAAE,MAAM,CAAC,CAAA;CAAE,EACxC,IAAI,EAAE,OAAO,KACV,OAAO,CAAC,YAAY,GAAG,QAAQ,CAAC,GAAG,YAAY,GAAG,QAAQ,CAAC;AAEhE;;;;;;;;;;;;;;;;;;;GAmBG;AACH,wBAAgB,WAAW,CAAC,OAAO,EAAE,oBAAoB,GAAG,YAAY,CAsCvE;AAED;;;;;;;;GAQG;AACH,wBAAsB,wBAAwB,CAC5C,OAAO,EAAE,WAAW,GACnB,OAAO,CAAC,cAAc,GAAG,IAAI,CAAC,CAehC"}

package/dist/server/auth.js

@@ -0,0 +1,215 @@
+/**
+ * @module @cas-system/nextjs-cas-client/server/auth
+ * @description Server-side session helpers for reading / writing CAS session
+ * data to Next.js cookies.
+ *
+ * The session is stored as a base-64 encoded JSON blob (signed with HMAC)
+ * inside an `HttpOnly`, `Secure`, `SameSite=Lax` cookie.  This gives us
+ * tamper-proof cookies without requiring any external crypto library.
+ *
+ * **Security model:**
+ * - The cookie is `HttpOnly` — JavaScript in the browser cannot read it.
+ * - A separate HMAC signature cookie prevents tampering.
+ * - Token validation always happens server-side via {@link CasClient}.
+ */
+import { NextResponse } from 'next/server';
+// ---------------------------------------------------------------------------
+// Constants
+// ---------------------------------------------------------------------------
+/** Name of the cookie that stores the session payload. */
+const SESSION_COOKIE = 'cas_session';
+/** Name of the cookie that stores the HMAC signature of the payload. */
+const SIGNATURE_COOKIE = 'cas_session_sig';
+/** Secret used for HMAC signing — falls back to a build-time constant. */
+function getSigningSecret() {
+    const secret = process.env.CAS_COOKIE_SECRET ?? process.env.CAS_CLIENT_SECRET;
+    if (!secret) {
+        throw new Error('[CasAuth] Neither CAS_COOKIE_SECRET nor CAS_CLIENT_SECRET environment variable is set. ' +
+            'One of these is required for cookie signing.');
+    }
+    return secret;
+}
+// ---------------------------------------------------------------------------
+// Internal crypto helpers
+// ---------------------------------------------------------------------------
+/** @internal */
+async function signPayload(payload, secret) {
+    const encoder = new TextEncoder();
+    const key = await crypto.subtle.importKey('raw', encoder.encode(secret), { name: 'HMAC', hash: 'SHA-256' }, false, ['sign']);
+    const sig = await crypto.subtle.sign('HMAC', key, encoder.encode(payload));
+    return btoa(String.fromCharCode(...new Uint8Array(sig)));
+}
+/** @internal */
+async function verifyPayload(payload, signature, secret) {
+    const expected = await signPayload(payload, secret);
+    // Constant-time-ish comparison (good enough for HMAC output).
+    if (expected.length !== signature.length)
+        return false;
+    let mismatch = 0;
+    for (let i = 0; i < expected.length; i++) {
+        mismatch |= expected.charCodeAt(i) ^ signature.charCodeAt(i);
+    }
+    return mismatch === 0;
+}
+// ---------------------------------------------------------------------------
+// Public API
+// ---------------------------------------------------------------------------
+/**
+ * Read the CAS session from Next.js **request** cookies.
+ *
+ * Works in Server Components, Route Handlers, and middleware — anywhere
+ * you have access to the Next.js `cookies()` helper.
+ *
+ * @param cookies - The Next.js `cookies()` read-only store.
+ * @returns The session data, or `null` if no valid session exists.
+ *
+ * @example
+ * ```ts
+ * import { cookies } from 'next/headers';
+ * import { getCasSession } from '@cas-system/nextjs-cas-client/server';
+ *
+ * export default async function DashboardPage() {
+ *   const session = await getCasSession(cookies());
+ *   if (!session) redirect('/login');
+ *   return <h1>Hello {session.user.username}</h1>;
+ * }
+ * ```
+ */
+export async function getCasSession(cookies) {
+    try {
+        const sessionCookie = cookies.get(SESSION_COOKIE);
+        const sigCookie = cookies.get(SIGNATURE_COOKIE);
+        if (!sessionCookie?.value || !sigCookie?.value)
+            return null;
+        const secret = getSigningSecret();
+        const valid = await verifyPayload(sessionCookie.value, sigCookie.value, secret);
+        if (!valid) {
+            console.warn('[CasAuth] Cookie signature mismatch — session rejected.');
+            return null;
+        }
+        const decoded = atob(sessionCookie.value);
+        const data = JSON.parse(decoded);
+        return data;
+    }
+    catch {
+        return null;
+    }
+}
+/**
+ * Write the CAS session into Next.js **response** cookies.
+ *
+ * @param cookies - The Next.js `cookies()` store (must be writable — only
+ *                  available inside Route Handlers and Server Actions).
+ * @param user    - The authenticated user.
+ * @param token   - The raw JWT token.
+ *
+ * @example
+ * ```ts
+ * import { cookies } from 'next/headers';
+ * import { setCasSession } from '@cas-system/nextjs-cas-client/server';
+ *
+ * await setCasSession(cookies(), user, token);
+ * ```
+ */
+export async function setCasSession(cookies, user, token) {
+    const data = { user, token, createdAt: Date.now() };
+    const payload = btoa(JSON.stringify(data));
+    const secret = getSigningSecret();
+    const sig = await signPayload(payload, secret);
+    const cookieOptions = {
+        httpOnly: true,
+        secure: process.env.NODE_ENV === 'production',
+        sameSite: 'lax',
+        path: '/',
+        maxAge: 60 * 60 * 24 * 7, // 7 days
+    };
+    cookies.set(SESSION_COOKIE, payload, cookieOptions);
+    cookies.set(SIGNATURE_COOKIE, sig, cookieOptions);
+}
+/**
+ * Delete the CAS session cookies.
+ *
+ * @param cookies - The Next.js `cookies()` store.
+ *
+ * @example
+ * ```ts
+ * import { cookies } from 'next/headers';
+ * import { clearCasSession } from '@cas-system/nextjs-cas-client/server';
+ *
+ * clearCasSession(cookies());
+ * ```
+ */
+export function clearCasSession(cookies) {
+    cookies.delete(SESSION_COOKIE);
+    cookies.delete(SIGNATURE_COOKIE);
+}
+/**
+ * Higher-order function that wraps a Next.js App Router route handler,
+ * automatically extracting and verifying the CAS session and injecting the
+ * `CasUser` into the handler.
+ *
+ * If no valid session exists, responds with `401 Unauthorized`.
+ *
+ * @param handler - The protected route handler.
+ * @returns A standard Next.js route handler.
+ *
+ * @example
+ * ```ts
+ * // app/api/admin/route.ts
+ * import { withCasAuth } from '@cas-system/nextjs-cas-client/server';
+ *
+ * export const GET = withCasAuth(async (req, ctx, user) => {
+ *   return NextResponse.json({ message: `Hello ${user.username}` });
+ * });
+ * ```
+ */
+export function withCasAuth(handler) {
+    return async (req, ctx) => {
+        // In App Router route handlers, we can read cookies directly from the request.
+        const sessionCookie = req.cookies.get(SESSION_COOKIE);
+        const sigCookie = req.cookies.get(SIGNATURE_COOKIE);
+        if (!sessionCookie?.value || !sigCookie?.value) {
+            return NextResponse.json({ error: 'Unauthorized' }, { status: 401 });
+        }
+        try {
+            const secret = getSigningSecret();
+            const valid = await verifyPayload(sessionCookie.value, sigCookie.value, secret);
+            if (!valid) {
+                return NextResponse.json({ error: 'Unauthorized — invalid session' }, { status: 401 });
+            }
+            const decoded = atob(sessionCookie.value);
+            const data = JSON.parse(decoded);
+            return handler(req, ctx ?? {}, data.user);
+        }
+        catch {
+            return NextResponse.json({ error: 'Unauthorized — session parse error' }, { status: 401 });
+        }
+    };
+}
+/**
+ * Read the CAS session from a plain `NextRequest` (useful in middleware
+ * and edge functions where the `cookies()` helper is not available).
+ *
+ * @param request - The incoming Next.js request.
+ * @returns Session data or `null`.
+ *
+ * @internal
+ */
+export async function getCasSessionFromRequest(request) {
+    try {
+        const sessionValue = request.cookies.get(SESSION_COOKIE)?.value;
+        const sigValue = request.cookies.get(SIGNATURE_COOKIE)?.value;
+        if (!sessionValue || !sigValue)
+            return null;
+        const secret = getSigningSecret();
+        const valid = await verifyPayload(sessionValue, sigValue, secret);
+        if (!valid)
+            return null;
+        const decoded = atob(sessionValue);
+        return JSON.parse(decoded);
+    }
+    catch {
+        return null;
+    }
+}
+//# sourceMappingURL=auth.js.map

package/dist/server/auth.js.map

@@ -0,0 +1 @@
+{"version":3,"file":"auth.js","sourceRoot":"","sources":["../../src/server/auth.ts"],"names":[],"mappings":"AAAA;;;;;;;;;;;;;GAaG;AAIH,OAAO,EAAe,YAAY,EAAE,MAAM,aAAa,CAAC;AAExD,8EAA8E;AAC9E,YAAY;AACZ,8EAA8E;AAE9E,0DAA0D;AAC1D,MAAM,cAAc,GAAG,aAAa,CAAC;AAErC,wEAAwE;AACxE,MAAM,gBAAgB,GAAG,iBAAiB,CAAC;AAE3C,0EAA0E;AAC1E,SAAS,gBAAgB;IACvB,MAAM,MAAM,GAAG,OAAO,CAAC,GAAG,CAAC,iBAAiB,IAAI,OAAO,CAAC,GAAG,CAAC,iBAAiB,CAAC;IAC9E,IAAI,CAAC,MAAM,EAAE,CAAC;QACZ,MAAM,IAAI,KAAK,CACb,yFAAyF;YACvF,8CAA8C,CACjD,CAAC;IACJ,CAAC;IACD,OAAO,MAAM,CAAC;AAChB,CAAC;AAED,8EAA8E;AAC9E,0BAA0B;AAC1B,8EAA8E;AAE9E,gBAAgB;AAChB,KAAK,UAAU,WAAW,CAAC,OAAe,EAAE,MAAc;IACxD,MAAM,OAAO,GAAG,IAAI,WAAW,EAAE,CAAC;IAClC,MAAM,GAAG,GAAG,MAAM,MAAM,CAAC,MAAM,CAAC,SAAS,CACvC,KAAK,EACL,OAAO,CAAC,MAAM,CAAC,MAAM,CAAC,EACtB,EAAE,IAAI,EAAE,MAAM,EAAE,IAAI,EAAE,SAAS,EAAE,EACjC,KAAK,EACL,CAAC,MAAM,CAAC,CACT,CAAC;IACF,MAAM,GAAG,GAAG,MAAM,MAAM,CAAC,MAAM,CAAC,IAAI,CAAC,MAAM,EAAE,GAAG,EAAE,OAAO,CAAC,MAAM,CAAC,OAAO,CAAC,CAAC,CAAC;IAC3E,OAAO,IAAI,CAAC,MAAM,CAAC,YAAY,CAAC,GAAG,IAAI,UAAU,CAAC,GAAG,CAAC,CAAC,CAAC,CAAC;AAC3D,CAAC;AAED,gBAAgB;AAChB,KAAK,UAAU,aAAa,CAC1B,OAAe,EACf,SAAiB,EACjB,MAAc;IAEd,MAAM,QAAQ,GAAG,MAAM,WAAW,CAAC,OAAO,EAAE,MAAM,CAAC,CAAC;IACpD,8DAA8D;IAC9D,IAAI,QAAQ,CAAC,MAAM,KAAK,SAAS,CAAC,MAAM;QAAE,OAAO,KAAK,CAAC;IACvD,IAAI,QAAQ,GAAG,CAAC,CAAC;IACjB,KAAK,IAAI,CAAC,GAAG,CAAC,EAAE,CAAC,GAAG,QAAQ,CAAC,MAAM,EAAE,CAAC,EAAE,EAAE,CAAC;QACzC,QAAQ,IAAI,QAAQ,CAAC,UAAU,CAAC,CAAC,CAAC,GAAG,SAAS,CAAC,UAAU,CAAC,CAAC,CAAC,CAAC;IAC/D,CAAC;IACD,OAAO,QAAQ,KAAK,CAAC,CAAC;AACxB,CAAC;AAED,8EAA8E;AAC9E,aAAa;AACb,8EAA8E;AAE9E;;;;;;;;;;;;;;;;;;;;GAoBG;AACH,MAAM,CAAC,KAAK,UAAU,aAAa,CACjC,OAA+B;IAE/B,IAAI,CAAC;QACH,MAAM,aAAa,GAAG,OAAO,CAAC,GAAG,CAAC,cAAc,CAAC,CAAC;QAClD,MAAM,SAAS,GAAG,OAAO,CAAC,GAAG,CAAC,gBAAgB,CAAC,CAAC;QAChD,IAAI,CAAC,aAAa,EAAE,KAAK,IAAI,CAAC,SAAS,EAAE,KAAK;YAAE,OAAO,IAAI,CAAC;QAE5D,MAAM,MAAM,GAAG,gBAAgB,EAAE,CAAC;QAClC,MAAM,KAAK,GAAG,MAAM,aAAa,CAC/B,aAAa,CAAC,KAAK,EACnB,SAAS,CAAC,KAAK,EACf,MAAM,CACP,CAAC;QACF,IAAI,CAAC,KAAK,EAAE,CAAC;YACX,OAAO,CAAC,IAAI,CAAC,yDAAyD,CAAC,CAAC;YACxE,OAAO,IAAI,CAAC;QACd,CAAC;QAED,MAAM,OAAO,GAAG,IAAI,CAAC,aAAa,CAAC,KAAK,CAAC,CAAC;QAC1C,MAAM,IAAI,GAAG,IAAI,CAAC,KAAK,CAAC,OAAO,CAAmB,CAAC;QACnD,OAAO,IAAI,CAAC;IACd,CAAC;IAAC,MAAM,CAAC;QACP,OAAO,IAAI,CAAC;IACd,CAAC;AACH,CAAC;AAED;;;;;;;;;;;;;;;GAeG;AACH,MAAM,CAAC,KAAK,UAAU,aAAa,CACjC,OAA+B,EAC/B,IAAa,EACb,KAAa;IAEb,MAAM,IAAI,GAAmB,EAAE,IAAI,EAAE,KAAK,EAAE,SAAS,EAAE,IAAI,CAAC,GAAG,EAAE,EAAE,CAAC;IACpE,MAAM,OAAO,GAAG,IAAI,CAAC,IAAI,CAAC,SAAS,CAAC,IAAI,CAAC,CAAC,CAAC;IAC3C,MAAM,MAAM,GAAG,gBAAgB,EAAE,CAAC;IAClC,MAAM,GAAG,GAAG,MAAM,WAAW,CAAC,OAAO,EAAE,MAAM,CAAC,CAAC;IAE/C,MAAM,aAAa,GAAG;QACpB,QAAQ,EAAE,IAAI;QACd,MAAM,EAAE,OAAO,CAAC,GAAG,CAAC,QAAQ,KAAK,YAAY;QAC7C,QAAQ,EAAE,KAAc;QACxB,IAAI,EAAE,GAAG;QACT,MAAM,EAAE,EAAE,GAAG,EAAE,GAAG,EAAE,GAAG,CAAC,EAAE,SAAS;KACpC,CAAC;IAED,OAAe,CAAC,GAAG,CAAC,cAAc,EAAE,OAAO,EAAE,aAAa,CAAC,CAAC;IAC5D,OAAe,CAAC,GAAG,CAAC,gBAAgB,EAAE,GAAG,EAAE,aAAa,CAAC,CAAC;AAC7D,CAAC;AAED;;;;;;;;;;;;GAYG;AACH,MAAM,UAAU,eAAe,CAAC,OAA+B;IAC5D,OAAe,CAAC,MAAM,CAAC,cAAc,CAAC,CAAC;IACvC,OAAe,CAAC,MAAM,CAAC,gBAAgB,CAAC,CAAC;AAC5C,CAAC;AAmBD;;;;;;;;;;;;;;;;;;;GAmBG;AACH,MAAM,UAAU,WAAW,CAAC,OAA6B;IACvD,OAAO,KAAK,EAAE,GAAgB,EAAE,GAAyC,EAAE,EAAE;QAC3E,+EAA+E;QAC/E,MAAM,aAAa,GAAG,GAAG,CAAC,OAAO,CAAC,GAAG,CAAC,cAAc,CAAC,CAAC;QACtD,MAAM,SAAS,GAAG,GAAG,CAAC,OAAO,CAAC,GAAG,CAAC,gBAAgB,CAAC,CAAC;QAEpD,IAAI,CAAC,aAAa,EAAE,KAAK,IAAI,CAAC,SAAS,EAAE,KAAK,EAAE,CAAC;YAC/C,OAAO,YAAY,CAAC,IAAI,CACtB,EAAE,KAAK,EAAE,cAAc,EAAE,EACzB,EAAE,MAAM,EAAE,GAAG,EAAE,CAChB,CAAC;QACJ,CAAC;QAED,IAAI,CAAC;YACH,MAAM,MAAM,GAAG,gBAAgB,EAAE,CAAC;YAClC,MAAM,KAAK,GAAG,MAAM,aAAa,CAC/B,aAAa,CAAC,KAAK,EACnB,SAAS,CAAC,KAAK,EACf,MAAM,CACP,CAAC;YACF,IAAI,CAAC,KAAK,EAAE,CAAC;gBACX,OAAO,YAAY,CAAC,IAAI,CACtB,EAAE,KAAK,EAAE,gCAAgC,EAAE,EAC3C,EAAE,MAAM,EAAE,GAAG,EAAE,CAChB,CAAC;YACJ,CAAC;YAED,MAAM,OAAO,GAAG,IAAI,CAAC,aAAa,CAAC,KAAK,CAAC,CAAC;YAC1C,MAAM,IAAI,GAAG,IAAI,CAAC,KAAK,CAAC,OAAO,CAAmB,CAAC;YAEnD,OAAO,OAAO,CAAC,GAAG,EAAE,GAAG,IAAI,EAAE,EAAE,IAAI,CAAC,IAAI,CAAC,CAAC;QAC5C,CAAC;QAAC,MAAM,CAAC;YACP,OAAO,YAAY,CAAC,IAAI,CACtB,EAAE,KAAK,EAAE,oCAAoC,EAAE,EAC/C,EAAE,MAAM,EAAE,GAAG,EAAE,CAChB,CAAC;QACJ,CAAC;IACH,CAAC,CAAC;AACJ,CAAC;AAED;;;;;;;;GAQG;AACH,MAAM,CAAC,KAAK,UAAU,wBAAwB,CAC5C,OAAoB;IAEpB,IAAI,CAAC;QACH,MAAM,YAAY,GAAG,OAAO,CAAC,OAAO,CAAC,GAAG,CAAC,cAAc,CAAC,EAAE,KAAK,CAAC;QAChE,MAAM,QAAQ,GAAG,OAAO,CAAC,OAAO,CAAC,GAAG,CAAC,gBAAgB,CAAC,EAAE,KAAK,CAAC;QAC9D,IAAI,CAAC,YAAY,IAAI,CAAC,QAAQ;YAAE,OAAO,IAAI,CAAC;QAE5C,MAAM,MAAM,GAAG,gBAAgB,EAAE,CAAC;QAClC,MAAM,KAAK,GAAG,MAAM,aAAa,CAAC,YAAY,EAAE,QAAQ,EAAE,MAAM,CAAC,CAAC;QAClE,IAAI,CAAC,KAAK;YAAE,OAAO,IAAI,CAAC;QAExB,MAAM,OAAO,GAAG,IAAI,CAAC,YAAY,CAAC,CAAC;QACnC,OAAO,IAAI,CAAC,KAAK,CAAC,OAAO,CAAmB,CAAC;IAC/C,CAAC;IAAC,MAAM,CAAC;QACP,OAAO,IAAI,CAAC;IACd,CAAC;AACH,CAAC"}

package/dist/server/cas-client.d.ts

@@ -0,0 +1,93 @@
+/**
+ * @module @cas-system/nextjs-cas-client/server/cas-client
+ * @description Server-side CAS client for token validation, generation, and
+ * SSO login URL construction.  Uses only the built-in `fetch` API — zero
+ * external dependencies.
+ *
+ * **IMPORTANT:** This module must only run on the server. It requires the
+ * `clientSecret` which must never be sent to the browser.
+ */
+import type { CasServerConfig, CasUser } from '../types';
+/**
+ * Server-side CAS client.
+ *
+ * @example
+ * ```ts
+ * import { CasClient } from '@cas-system/nextjs-cas-client/server';
+ *
+ * const cas = new CasClient({
+ *   serverUrl: process.env.CAS_SERVER_URL!,
+ *   clientId: process.env.CAS_CLIENT_ID!,
+ *   clientSecret: process.env.CAS_CLIENT_SECRET!,
+ *   callbackUrl: process.env.CAS_CALLBACK_URL,
+ * });
+ *
+ * // Validate a token received from the callback
+ * const user = await cas.validateToken(token);
+ * ```
+ */
+export declare class CasClient {
+    private readonly config;
+    constructor(config: CasServerConfig);
+    /**
+     * Build the CAS SSO login URL.
+     *
+     * @param returnUrl - Optional URL to redirect back to after login.
+     *                    Falls back to `config.callbackUrl`.
+     * @returns Fully-qualified CAS login URL.
+     *
+     * @example
+     * ```ts
+     * const loginUrl = cas.getLoginUrl('/dashboard');
+     * redirect(loginUrl);
+     * ```
+     */
+    getLoginUrl(returnUrl?: string): string;
+    /**
+     * Validate a JWT token with the CAS server (server-to-server call).
+     *
+     * @param token - The JWT token received from the CAS callback.
+     * @returns The authenticated {@link CasUser} or `null` if invalid.
+     *
+     * @example
+     * ```ts
+     * const user = await cas.validateToken(token);
+     * if (!user) throw new Error('Invalid token');
+     * ```
+     */
+    validateToken(token: string): Promise<CasUser | null>;
+    /**
+     * Generate a JWT token for the given username (server-to-server).
+     *
+     * This is useful for machine-to-machine auth flows or impersonation
+     * when the calling service already knows the target user.
+     *
+     * @param username - The username to issue a token for.
+     * @returns The JWT string or `null` on failure.
+     */
+    generateToken(username: string): Promise<string | null>;
+    /**
+     * Notify the CAS server of a logout event.
+     *
+     * @param token - Optional token to invalidate on the server.
+     * @returns `true` if the server acknowledged the logout.
+     */
+    logout(token?: string): Promise<boolean>;
+    /**
+     * Check whether a user has **all** of the specified roles.
+     *
+     * @param user  - The CAS user.
+     * @param roles - Required roles.
+     * @returns `true` if the user possesses every role.
+     */
+    static hasRoles(user: CasUser, roles: string[]): boolean;
+    /**
+     * Check whether a user has **at least one** of the specified roles.
+     *
+     * @param user  - The CAS user.
+     * @param roles - Roles to check.
+     * @returns `true` if the user possesses any of the roles.
+     */
+    static hasAnyRole(user: CasUser, roles: string[]): boolean;
+}
+//# sourceMappingURL=cas-client.d.ts.map

package/dist/server/cas-client.d.ts.map

@@ -0,0 +1 @@
+{"version":3,"file":"cas-client.d.ts","sourceRoot":"","sources":["../../src/server/cas-client.ts"],"names":[],"mappings":"AAAA;;;;;;;;GAQG;AAEH,OAAO,KAAK,EACV,eAAe,EACf,OAAO,EAGR,MAAM,UAAU,CAAC;AAkBlB;;;;;;;;;;;;;;;;;GAiBG;AACH,qBAAa,SAAS;IACpB,OAAO,CAAC,QAAQ,CAAC,MAAM,CAA0C;gBAErD,MAAM,EAAE,eAAe;IAgBnC;;;;;;;;;;;;OAYG;IACH,WAAW,CAAC,SAAS,CAAC,EAAE,MAAM,GAAG,MAAM;IAevC;;;;;;;;;;;OAWG;IACG,aAAa,CAAC,KAAK,EAAE,MAAM,GAAG,OAAO,CAAC,OAAO,GAAG,IAAI,CAAC;IAuC3D;;;;;;;;OAQG;IACG,aAAa,CAAC,QAAQ,EAAE,MAAM,GAAG,OAAO,CAAC,MAAM,GAAG,IAAI,CAAC;IAuC7D;;;;;OAKG;IACG,MAAM,CAAC,KAAK,CAAC,EAAE,MAAM,GAAG,OAAO,CAAC,OAAO,CAAC;IAgC9C;;;;;;OAMG;IACH,MAAM,CAAC,QAAQ,CAAC,IAAI,EAAE,OAAO,EAAE,KAAK,EAAE,MAAM,EAAE,GAAG,OAAO;IAKxD;;;;;;OAMG;IACH,MAAM,CAAC,UAAU,CAAC,IAAI,EAAE,OAAO,EAAE,KAAK,EAAE,MAAM,EAAE,GAAG,OAAO;CAI3D"}

package/dist/server/cas-client.js

@@ -0,0 +1,222 @@
+/**
+ * @module @cas-system/nextjs-cas-client/server/cas-client
+ * @description Server-side CAS client for token validation, generation, and
+ * SSO login URL construction.  Uses only the built-in `fetch` API — zero
+ * external dependencies.
+ *
+ * **IMPORTANT:** This module must only run on the server. It requires the
+ * `clientSecret` which must never be sent to the browser.
+ */
+// ---------------------------------------------------------------------------
+// Helpers
+// ---------------------------------------------------------------------------
+/**
+ * Normalise a base URL by stripping a trailing slash.
+ * @internal
+ */
+function normaliseUrl(url) {
+    return url.replace(/\/+$/, '');
+}
+// ---------------------------------------------------------------------------
+// CasClient
+// ---------------------------------------------------------------------------
+/**
+ * Server-side CAS client.
+ *
+ * @example
+ * ```ts
+ * import { CasClient } from '@cas-system/nextjs-cas-client/server';
+ *
+ * const cas = new CasClient({
+ *   serverUrl: process.env.CAS_SERVER_URL!,
+ *   clientId: process.env.CAS_CLIENT_ID!,
+ *   clientSecret: process.env.CAS_CLIENT_SECRET!,
+ *   callbackUrl: process.env.CAS_CALLBACK_URL,
+ * });
+ *
+ * // Validate a token received from the callback
+ * const user = await cas.validateToken(token);
+ * ```
+ */
+export class CasClient {
+    constructor(config) {
+        if (!config.serverUrl)
+            throw new Error('[CasClient] serverUrl is required');
+        if (!config.clientId)
+            throw new Error('[CasClient] clientId is required');
+        if (!config.clientSecret)
+            throw new Error('[CasClient] clientSecret is required');
+        this.config = {
+            ...config,
+            serverUrl: normaliseUrl(config.serverUrl),
+        };
+    }
+    // -----------------------------------------------------------------------
+    // Login URL
+    // -----------------------------------------------------------------------
+    /**
+     * Build the CAS SSO login URL.
+     *
+     * @param returnUrl - Optional URL to redirect back to after login.
+     *                    Falls back to `config.callbackUrl`.
+     * @returns Fully-qualified CAS login URL.
+     *
+     * @example
+     * ```ts
+     * const loginUrl = cas.getLoginUrl('/dashboard');
+     * redirect(loginUrl);
+     * ```
+     */
+    getLoginUrl(returnUrl) {
+        const callbackUrl = returnUrl ?? this.config.callbackUrl ?? '/api/cas/callback';
+        const params = new URLSearchParams({
+            client_id: this.config.clientId,
+            response_type: 'token',
+            redirect_uri: callbackUrl,
+        });
+        return `${this.config.serverUrl}/sso/login?${params.toString()}`;
+    }
+    // -----------------------------------------------------------------------
+    // Token Validation
+    // -----------------------------------------------------------------------
+    /**
+     * Validate a JWT token with the CAS server (server-to-server call).
+     *
+     * @param token - The JWT token received from the CAS callback.
+     * @returns The authenticated {@link CasUser} or `null` if invalid.
+     *
+     * @example
+     * ```ts
+     * const user = await cas.validateToken(token);
+     * if (!user) throw new Error('Invalid token');
+     * ```
+     */
+    async validateToken(token) {
+        try {
+            const res = await fetch(`${this.config.serverUrl}/api/validate-token`, {
+                method: 'POST',
+                headers: {
+                    'Content-Type': 'application/json',
+                },
+                body: JSON.stringify({
+                    token,
+                    client_id: this.config.clientId,
+                    client_secret: this.config.clientSecret,
+                }),
+                cache: 'no-store',
+            });
+            if (!res.ok) {
+                console.error(`[CasClient] validateToken failed: ${res.status} ${res.statusText}`);
+                return null;
+            }
+            const data = (await res.json());
+            if (!data.valid || !data.user)
+                return null;
+            return data.user;
+        }
+        catch (err) {
+            console.error('[CasClient] validateToken error:', err);
+            return null;
+        }
+    }
+    // -----------------------------------------------------------------------
+    // Token Generation
+    // -----------------------------------------------------------------------
+    /**
+     * Generate a JWT token for the given username (server-to-server).
+     *
+     * This is useful for machine-to-machine auth flows or impersonation
+     * when the calling service already knows the target user.
+     *
+     * @param username - The username to issue a token for.
+     * @returns The JWT string or `null` on failure.
+     */
+    async generateToken(username) {
+        try {
+            const res = await fetch(`${this.config.serverUrl}/api/sso/token`, {
+                method: 'POST',
+                headers: {
+                    'Content-Type': 'application/json',
+                },
+                body: JSON.stringify({
+                    client_id: this.config.clientId,
+                    client_secret: this.config.clientSecret,
+                    username,
+                }),
+                cache: 'no-store',
+            });
+            if (!res.ok) {
+                console.error(`[CasClient] generateToken failed: ${res.status} ${res.statusText}`);
+                return null;
+            }
+            const data = (await res.json());
+            if (!data.token)
+                return null;
+            return data.token;
+        }
+        catch (err) {
+            console.error('[CasClient] generateToken error:', err);
+            return null;
+        }
+    }
+    // -----------------------------------------------------------------------
+    // Logout
+    // -----------------------------------------------------------------------
+    /**
+     * Notify the CAS server of a logout event.
+     *
+     * @param token - Optional token to invalidate on the server.
+     * @returns `true` if the server acknowledged the logout.
+     */
+    async logout(token) {
+        try {
+            const headers = {
+                'Content-Type': 'application/json',
+            };
+            if (token) {
+                headers['Authorization'] = `Bearer ${token}`;
+            }
+            const res = await fetch(`${this.config.serverUrl}/api/logout`, {
+                method: 'POST',
+                headers,
+                body: JSON.stringify({
+                    client_id: this.config.clientId,
+                }),
+                cache: 'no-store',
+            });
+            return res.ok;
+        }
+        catch (err) {
+            console.error('[CasClient] logout error:', err);
+            return false;
+        }
+    }
+    // -----------------------------------------------------------------------
+    // Role helpers
+    // -----------------------------------------------------------------------
+    /**
+     * Check whether a user has **all** of the specified roles.
+     *
+     * @param user  - The CAS user.
+     * @param roles - Required roles.
+     * @returns `true` if the user possesses every role.
+     */
+    static hasRoles(user, roles) {
+        if (!user.roles)
+            return roles.length === 0;
+        return roles.every((r) => user.roles.includes(r));
+    }
+    /**
+     * Check whether a user has **at least one** of the specified roles.
+     *
+     * @param user  - The CAS user.
+     * @param roles - Roles to check.
+     * @returns `true` if the user possesses any of the roles.
+     */
+    static hasAnyRole(user, roles) {
+        if (!user.roles)
+            return false;
+        return roles.some((r) => user.roles.includes(r));
+    }
+}
+//# sourceMappingURL=cas-client.js.map

package/dist/server/cas-client.js.map

@@ -0,0 +1 @@
+{"version":3,"file":"cas-client.js","sourceRoot":"","sources":["../../src/server/cas-client.ts"],"names":[],"mappings":"AAAA;;;;;;;;GAQG;AASH,8EAA8E;AAC9E,UAAU;AACV,8EAA8E;AAE9E;;;GAGG;AACH,SAAS,YAAY,CAAC,GAAW;IAC/B,OAAO,GAAG,CAAC,OAAO,CAAC,MAAM,EAAE,EAAE,CAAC,CAAC;AACjC,CAAC;AAED,8EAA8E;AAC9E,YAAY;AACZ,8EAA8E;AAE9E;;;;;;;;;;;;;;;;;GAiBG;AACH,MAAM,OAAO,SAAS;IAGpB,YAAY,MAAuB;QACjC,IAAI,CAAC,MAAM,CAAC,SAAS;YAAE,MAAM,IAAI,KAAK,CAAC,mCAAmC,CAAC,CAAC;QAC5E,IAAI,CAAC,MAAM,CAAC,QAAQ;YAAE,MAAM,IAAI,KAAK,CAAC,kCAAkC,CAAC,CAAC;QAC1E,IAAI,CAAC,MAAM,CAAC,YAAY;YACtB,MAAM,IAAI,KAAK,CAAC,sCAAsC,CAAC,CAAC;QAE1D,IAAI,CAAC,MAAM,GAAG;YACZ,GAAG,MAAM;YACT,SAAS,EAAE,YAAY,CAAC,MAAM,CAAC,SAAS,CAAC;SAC1C,CAAC;IACJ,CAAC;IAED,0EAA0E;IAC1E,YAAY;IACZ,0EAA0E;IAE1E;;;;;;;;;;;;OAYG;IACH,WAAW,CAAC,SAAkB;QAC5B,MAAM,WAAW,GACf,SAAS,IAAI,IAAI,CAAC,MAAM,CAAC,WAAW,IAAI,mBAAmB,CAAC;QAC9D,MAAM,MAAM,GAAG,IAAI,eAAe,CAAC;YACjC,SAAS,EAAE,IAAI,CAAC,MAAM,CAAC,QAAQ;YAC/B,aAAa,EAAE,OAAO;YACtB,YAAY,EAAE,WAAW;SAC1B,CAAC,CAAC;QACH,OAAO,GAAG,IAAI,CAAC,MAAM,CAAC,SAAS,cAAc,MAAM,CAAC,QAAQ,EAAE,EAAE,CAAC;IACnE,CAAC;IAED,0EAA0E;IAC1E,mBAAmB;IACnB,0EAA0E;IAE1E;;;;;;;;;;;OAWG;IACH,KAAK,CAAC,aAAa,CAAC,KAAa;QAC/B,IAAI,CAAC;YACH,MAAM,GAAG,GAAG,MAAM,KAAK,CACrB,GAAG,IAAI,CAAC,MAAM,CAAC,SAAS,qBAAqB,EAC7C;gBACE,MAAM,EAAE,MAAM;gBACd,OAAO,EAAE;oBACP,cAAc,EAAE,kBAAkB;iBACnC;gBACD,IAAI,EAAE,IAAI,CAAC,SAAS,CAAC;oBACnB,KAAK;oBACL,SAAS,EAAE,IAAI,CAAC,MAAM,CAAC,QAAQ;oBAC/B,aAAa,EAAE,IAAI,CAAC,MAAM,CAAC,YAAY;iBACxC,CAAC;gBACF,KAAK,EAAE,UAAU;aAClB,CACF,CAAC;YAEF,IAAI,CAAC,GAAG,CAAC,EAAE,EAAE,CAAC;gBACZ,OAAO,CAAC,KAAK,CACX,qCAAqC,GAAG,CAAC,MAAM,IAAI,GAAG,CAAC,UAAU,EAAE,CACpE,CAAC;gBACF,OAAO,IAAI,CAAC;YACd,CAAC;YAED,MAAM,IAAI,GAAG,CAAC,MAAM,GAAG,CAAC,IAAI,EAAE,CAAwB,CAAC;YACvD,IAAI,CAAC,IAAI,CAAC,KAAK,IAAI,CAAC,IAAI,CAAC,IAAI;gBAAE,OAAO,IAAI,CAAC;YAE3C,OAAO,IAAI,CAAC,IAAI,CAAC;QACnB,CAAC;QAAC,OAAO,GAAG,EAAE,CAAC;YACb,OAAO,CAAC,KAAK,CAAC,kCAAkC,EAAE,GAAG,CAAC,CAAC;YACvD,OAAO,IAAI,CAAC;QACd,CAAC;IACH,CAAC;IAED,0EAA0E;IAC1E,mBAAmB;IACnB,0EAA0E;IAE1E;;;;;;;;OAQG;IACH,KAAK,CAAC,aAAa,CAAC,QAAgB;QAClC,IAAI,CAAC;YACH,MAAM,GAAG,GAAG,MAAM,KAAK,CACrB,GAAG,IAAI,CAAC,MAAM,CAAC,SAAS,gBAAgB,EACxC;gBACE,MAAM,EAAE,MAAM;gBACd,OAAO,EAAE;oBACP,cAAc,EAAE,kBAAkB;iBACnC;gBACD,IAAI,EAAE,IAAI,CAAC,SAAS,CAAC;oBACnB,SAAS,EAAE,IAAI,CAAC,MAAM,CAAC,QAAQ;oBAC/B,aAAa,EAAE,IAAI,CAAC,MAAM,CAAC,YAAY;oBACvC,QAAQ;iBACT,CAAC;gBACF,KAAK,EAAE,UAAU;aAClB,CACF,CAAC;YAEF,IAAI,CAAC,GAAG,CAAC,EAAE,EAAE,CAAC;gBACZ,OAAO,CAAC,KAAK,CACX,qCAAqC,GAAG,CAAC,MAAM,IAAI,GAAG,CAAC,UAAU,EAAE,CACpE,CAAC;gBACF,OAAO,IAAI,CAAC;YACd,CAAC;YAED,MAAM,IAAI,GAAG,CAAC,MAAM,GAAG,CAAC,IAAI,EAAE,CAAqB,CAAC;YACpD,IAAI,CAAC,IAAI,CAAC,KAAK;gBAAE,OAAO,IAAI,CAAC;YAE7B,OAAO,IAAI,CAAC,KAAK,CAAC;QACpB,CAAC;QAAC,OAAO,GAAG,EAAE,CAAC;YACb,OAAO,CAAC,KAAK,CAAC,kCAAkC,EAAE,GAAG,CAAC,CAAC;YACvD,OAAO,IAAI,CAAC;QACd,CAAC;IACH,CAAC;IAED,0EAA0E;IAC1E,SAAS;IACT,0EAA0E;IAE1E;;;;;OAKG;IACH,KAAK,CAAC,MAAM,CAAC,KAAc;QACzB,IAAI,CAAC;YACH,MAAM,OAAO,GAA2B;gBACtC,cAAc,EAAE,kBAAkB;aACnC,CAAC;YACF,IAAI,KAAK,EAAE,CAAC;gBACV,OAAO,CAAC,eAAe,CAAC,GAAG,UAAU,KAAK,EAAE,CAAC;YAC/C,CAAC;YAED,MAAM,GAAG,GAAG,MAAM,KAAK,CACrB,GAAG,IAAI,CAAC,MAAM,CAAC,SAAS,aAAa,EACrC;gBACE,MAAM,EAAE,MAAM;gBACd,OAAO;gBACP,IAAI,EAAE,IAAI,CAAC,SAAS,CAAC;oBACnB,SAAS,EAAE,IAAI,CAAC,MAAM,CAAC,QAAQ;iBAChC,CAAC;gBACF,KAAK,EAAE,UAAU;aAClB,CACF,CAAC;YAEF,OAAO,GAAG,CAAC,EAAE,CAAC;QAChB,CAAC;QAAC,OAAO,GAAG,EAAE,CAAC;YACb,OAAO,CAAC,KAAK,CAAC,2BAA2B,EAAE,GAAG,CAAC,CAAC;YAChD,OAAO,KAAK,CAAC;QACf,CAAC;IACH,CAAC;IAED,0EAA0E;IAC1E,eAAe;IACf,0EAA0E;IAE1E;;;;;;OAMG;IACH,MAAM,CAAC,QAAQ,CAAC,IAAa,EAAE,KAAe;QAC5C,IAAI,CAAC,IAAI,CAAC,KAAK;YAAE,OAAO,KAAK,CAAC,MAAM,KAAK,CAAC,CAAC;QAC3C,OAAO,KAAK,CAAC,KAAK,CAAC,CAAC,CAAC,EAAE,EAAE,CAAC,IAAI,CAAC,KAAM,CAAC,QAAQ,CAAC,CAAC,CAAC,CAAC,CAAC;IACrD,CAAC;IAED;;;;;;OAMG;IACH,MAAM,CAAC,UAAU,CAAC,IAAa,EAAE,KAAe;QAC9C,IAAI,CAAC,IAAI,CAAC,KAAK;YAAE,OAAO,KAAK,CAAC;QAC9B,OAAO,KAAK,CAAC,IAAI,CAAC,CAAC,CAAC,EAAE,EAAE,CAAC,IAAI,CAAC,KAAM,CAAC,QAAQ,CAAC,CAAC,CAAC,CAAC,CAAC;IACpD,CAAC;CACF"}

package/dist/server/index.d.ts

@@ -0,0 +1,12 @@
+/**
+ * @module @cas-system/nextjs-cas-client/server
+ * @description Server-only entry point for the Next.js CAS Client SDK.
+ *
+ * Exposes the {@link CasClient} (token validation / generation / logout) and
+ * the cookie-based session helpers.  These modules require the
+ * `clientSecret` / cookie signing secret and must never run in the browser.
+ */
+export { CasClient } from './cas-client';
+export { getCasSession, setCasSession, clearCasSession, withCasAuth, getCasSessionFromRequest, } from './auth';
+export type { CasConfig, CasServerConfig, CasUser, CasSessionData, CasHandlerConfig, } from '../types';
+//# sourceMappingURL=index.d.ts.map