@civic/auth 0.0.1-beta.18 → 0.0.1-beta.2

package/dist/nextjs.mjs

@@ -1,21 +1,13 @@
 import {
-  NextjsClientStorage,
-  NextjsCookieStorage,
-  clearAuthCookies,
+  AuthSessionServiceImpl,
   createCivicAuthPlugin,
   defaultAuthConfig,
   loggers,
-  resolveAuthConfig,
-  resolveCallbackUrl
-} from "./chunk-5XL2ST72.mjs";
+  resolveAuthConfig
+} from "./chunk-NXBKSUKI.mjs";
 import {
-  GenericPublicClientPKCEProducer,
-  GenericUserSession,
-  TOKEN_EXCHANGE_TRIGGER_TEXT,
-  getUser,
-  resolveOAuthAccessCode,
-  retrieveTokens
-} from "./chunk-G3P5TIO2.mjs";
+  deriveCodeChallenge
+} from "./chunk-T7HUHQ3J.mjs";
 import {
   __async,
   __spreadProps,
@@ -23,18 +15,12 @@ import {
 } from "./chunk-RGHW4PYM.mjs";
 
 // src/nextjs/GetUser.ts
-var getUser2 = () => {
+import { cookies } from "next/headers.js";
+var getUser = () => {
   var _a;
-  const clientStorage = new NextjsClientStorage();
-  const userSession = new GenericUserSession(clientStorage);
-  const tokens = retrieveTokens(clientStorage);
-  const user = userSession.get();
-  if (!user || !tokens) return null;
-  return __spreadProps(__spreadValues({}, user), {
-    idToken: tokens.id_token,
-    accessToken: tokens.access_token,
-    refreshToken: (_a = tokens.refresh_token) != null ? _a : ""
-  });
+  const user = (_a = cookies().get("user")) == null ? void 0 : _a.value;
+  if (!user) return null;
+  return JSON.parse(user);
 };
 
 // src/nextjs/middleware.ts
@@ -56,7 +42,7 @@ var matchesGlobs = (pathname, patterns) => patterns.some((pattern) => {
 var applyAuth = (authConfig, request) => __async(void 0, null, function* () {
   const authConfigWithDefaults = resolveAuthConfig(authConfig);
   const isAuthenticated = !!request.cookies.get("id_token");
-  if (request.nextUrl.pathname === authConfigWithDefaults.loginUrl && request.method === "GET") {
+  if (request.nextUrl.pathname === authConfigWithDefaults.loginUrl) {
     console.log("\u2192 Skipping auth check - this is the login URL");
     return void 0;
   }
@@ -101,6 +87,129 @@ function auth(authConfig = {}) {
 // src/nextjs/routeHandler.ts
 import { NextResponse as NextResponse2 } from "next/server.js";
 import { revalidatePath } from "next/cache.js";
+
+// src/nextjs/NextJSSessionService.ts
+import { cookies as cookies2 } from "next/headers.js";
+
+// src/nextjs/cookies.ts
+var createTokenCookies = (response, sessionData, config) => {
+  var _a, _b;
+  const maxAge = (_a = sessionData.expiresIn) != null ? _a : 3600;
+  const cookieOptions = __spreadProps(__spreadValues({}, (_b = config.cookies) == null ? void 0 : _b.tokens), {
+    maxAge
+  });
+  if (sessionData.accessToken) {
+    response.cookies.set("access_token", sessionData.accessToken, __spreadProps(__spreadValues({}, cookieOptions), {
+      httpOnly: true
+    }));
+  }
+  if (sessionData.idToken) {
+    response.cookies.set("id_token", sessionData.idToken, __spreadProps(__spreadValues({}, cookieOptions), {
+      httpOnly: true
+    }));
+  }
+  if (sessionData.refreshToken) {
+    response.cookies.set("refresh_token", sessionData.refreshToken, __spreadProps(__spreadValues({}, cookieOptions), {
+      httpOnly: true
+    }));
+  }
+};
+var createUserInfoCookie = (response, user, sessionData, config) => {
+  var _a, _b, _c;
+  if (!user) {
+    response.cookies.set("user", "", __spreadProps(__spreadValues({}, (_a = config.cookies) == null ? void 0 : _a.user), {
+      maxAge: 0
+    }));
+    return;
+  }
+  const maxAge = (_b = sessionData.expiresIn) != null ? _b : 3600;
+  const frontendUser = __spreadValues({}, user);
+  response.cookies.set("user", JSON.stringify(frontendUser), __spreadProps(__spreadValues({}, (_c = config.cookies) == null ? void 0 : _c.user), {
+    maxAge
+  }));
+};
+var clearAuthCookies = (response, config) => {
+  var _a, _b;
+  const clearOptions = __spreadProps(__spreadValues({}, (_a = config.cookies) == null ? void 0 : _a.tokens), {
+    maxAge: 0
+  });
+  response.cookies.set("access_token", "", clearOptions);
+  response.cookies.set("id_token", "", clearOptions);
+  response.cookies.set("refresh_token", "", clearOptions);
+  response.cookies.set("codeVerifier", "", clearOptions);
+  response.cookies.set("user", "", __spreadProps(__spreadValues({}, (_b = config.cookies) == null ? void 0 : _b.user), {
+    maxAge: 0
+  }));
+};
+
+// src/nextjs/NextJSSessionService.ts
+var NextJSAuthSessionServiceImpl = class extends AuthSessionServiceImpl {
+  constructor(authConfig, request, response, inputEndpoints) {
+    super(
+      authConfig.clientId,
+      authConfig.callbackUrl,
+      authConfig.oauthServer,
+      inputEndpoints
+    );
+    this.authConfig = authConfig;
+    this.request = request;
+    this.response = response;
+    this.inputEndpoints = inputEndpoints;
+  }
+  getCodeVerifier() {
+    const codeVerifier = cookies2().get("codeVerifier");
+    if (!codeVerifier) {
+      throw new Error("Code verifier not found in cookies");
+    }
+    return codeVerifier.value;
+  }
+  getSessionData() {
+    var _a, _b, _c, _d;
+    const authenticated = cookies2().get("access_token") !== void 0;
+    return {
+      authenticated,
+      codeVerifier: (_a = cookies2().get("codeVerifier")) == null ? void 0 : _a.value,
+      accessToken: (_b = cookies2().get("access_token")) == null ? void 0 : _b.value,
+      idToken: (_c = cookies2().get("id_token")) == null ? void 0 : _c.value,
+      refreshToken: (_d = cookies2().get("refresh_token")) == null ? void 0 : _d.value
+    };
+  }
+  updateSessionData(data) {
+    createTokenCookies(
+      this.response,
+      data,
+      this.authConfig
+    );
+  }
+  getUser() {
+    const userCookie = cookies2().get("user");
+    if (!userCookie) return null;
+    return JSON.parse(userCookie.value);
+  }
+  setUser(user) {
+    createUserInfoCookie(
+      this.response,
+      user,
+      { authenticated: true },
+      this.authConfig
+    );
+  }
+  clearSessionData() {
+    clearAuthCookies(this.response, this.authConfig);
+  }
+  // TODO fix the Window reference
+  loadAuthorizationUrl() {
+    throw new Error("Not implemented");
+  }
+  logout() {
+    return __async(this, null, function* () {
+      this.updateSessionData({ authenticated: false });
+    });
+  }
+};
+
+// src/nextjs/routeHandler.ts
+import { generateCodeVerifier } from "oslo/oauth2";
 var logger = loggers.nextjs.handlers.auth;
 var AuthError = class extends Error {
   constructor(message, status = 401) {
@@ -111,48 +220,47 @@ var AuthError = class extends Error {
 };
 function handleChallenge() {
   return __async(this, null, function* () {
-    const cookieStorage = new NextjsCookieStorage();
-    const pkceProducer = new GenericPublicClientPKCEProducer(cookieStorage);
-    const challenge = yield pkceProducer.getCodeChallenge();
-    return NextResponse2.json({ status: "success", challenge });
+    const codeVerifier = generateCodeVerifier();
+    console.log("handleChallenge codeVerifier", codeVerifier);
+    const challenge = yield deriveCodeChallenge(codeVerifier);
+    const response = NextResponse2.json({ status: "success", challenge });
+    response.cookies.set("codeVerifier", codeVerifier, {
+      httpOnly: true,
+      secure: true,
+      sameSite: "strict"
+    });
+    return response;
   });
 }
 function handleCallback(request, config) {
   return __async(this, null, function* () {
-    if (!request.cookies.get("code_verifier")) {
-      const response2 = new NextResponse2(
-        `<html><body><span style="display:none">${TOKEN_EXCHANGE_TRIGGER_TEXT}</span></body></html>`
-      );
-      response2.headers.set("Content-Type", "text/html; charset=utf-8");
-      console.log(
-        `handleCallback no code_verifier found, returning ${TOKEN_EXCHANGE_TRIGGER_TEXT}`
-      );
-      return response2;
-    }
     const code = request.nextUrl.searchParams.get("code");
-    const state = request.nextUrl.searchParams.get("state");
-    if (!code || !state) throw new AuthError("Bad parameters", 400);
-    const resolvedConfigs = resolveAuthConfig(config);
-    const cookieStorage = new NextjsCookieStorage(resolvedConfigs.cookies.tokens);
-    const callbackUrl = resolveCallbackUrl(resolvedConfigs, request.url);
+    if (!code) throw new AuthError("Missing authorization code");
     try {
-      yield resolveOAuthAccessCode(code, state, cookieStorage, __spreadProps(__spreadValues({}, resolvedConfigs), {
-        redirectUrl: callbackUrl
-      }));
+      const response = new NextResponse2(`<html></html>`);
+      response.headers.set("Content-Type", "text/html; charset=utf-8");
+      const resolvedConfigs = resolveAuthConfig(config);
+      const callbackUrl = new URL(
+        resolvedConfigs == null ? void 0 : resolvedConfigs.callbackUrl,
+        request.url
+      ).toString();
+      const authService = getDefaultAuthSessionService(
+        __spreadProps(__spreadValues({}, resolvedConfigs), {
+          callbackUrl
+        }),
+        request,
+        response
+      );
+      console.log("handleCallback authService", authService);
+      const tokens = yield authService.tokenExchange(request.nextUrl.toString());
+      if (!tokens.accessToken) {
+        throw new AuthError("Missing access token");
+      }
+      return response;
     } catch (error) {
       logger.error("Token exchange failed:", error);
       throw new AuthError("Failed to authenticate user", 401);
     }
-    const user = yield getUser(cookieStorage);
-    if (!user) {
-      throw new AuthError("Failed to get user info", 401);
-    }
-    const clientStorage = new NextjsClientStorage();
-    const userSession = new GenericUserSession(clientStorage);
-    userSession.set(user);
-    const response = new NextResponse2(`<html></html>`);
-    response.headers.set("Content-Type", "text/html; charset=utf-8");
-    return response;
   });
 }
 var getAbsoluteRedirectPath = (redirectPath, currentBasePath) => {
@@ -173,7 +281,7 @@ function handleLogout(request, config) {
       new URL(request.url).origin
     );
     const response = NextResponse2.redirect(finalRedirectUrl);
-    clearAuthCookies();
+    clearAuthCookies(response, resolvedConfigs);
     try {
       revalidatePath(isAbsoluteRedirect ? finalRedirectUrl : redirectTarget);
     } catch (error) {
@@ -182,6 +290,9 @@ function handleLogout(request, config) {
     return response;
   });
 }
+var getDefaultAuthSessionService = (authConfig, request, response) => {
+  return new NextJSAuthSessionServiceImpl(authConfig, request, response);
+};
 var handler = (authConfig = {}) => (request) => __async(void 0, null, function* () {
   const config = resolveAuthConfig(authConfig);
   try {
@@ -203,7 +314,7 @@ var handler = (authConfig = {}) => (request) => __async(void 0, null, function*
     const status = error instanceof AuthError ? error.status : 500;
     const message = error instanceof Error ? error.message : "Authentication failed";
     const response = NextResponse2.json({ error: message }, { status });
-    clearAuthCookies();
+    clearAuthCookies(response, config);
     return response;
   }
 });
@@ -211,7 +322,7 @@ export {
   auth,
   authMiddleware,
   createCivicAuthPlugin,
-  getUser2 as getUser,
+  getUser,
   handler,
   withAuth
 };

package/dist/nextjs.mjs.map

@@ -1 +1 @@
-{"version":3,"sources":["../src/nextjs/GetUser.ts","../src/nextjs/middleware.ts","../src/nextjs/routeHandler.ts"],"sourcesContent":["/**\n * Used on the server-side to get the user object from the cookie\n */\nimport { User } from \"@/types\";\nimport { GenericUserSession } from \"@/shared/UserSession\";\nimport { NextjsClientStorage } from \"@/nextjs/cookies\";\nimport { retrieveTokens } from \"@/shared/util\";\n\nexport const getUser = (): User | null => {\n  const clientStorage = new NextjsClientStorage();\n  const userSession = new GenericUserSession(clientStorage);\n  const tokens = retrieveTokens(clientStorage);\n  const user = userSession.get();\n  if (!user || !tokens) return null;\n\n  return {\n    ...user!,\n    idToken: tokens.id_token,\n    accessToken: tokens.access_token,\n    refreshToken: tokens.refresh_token ?? \"\",\n  } as User;\n};\n","/**\n * Authenticates the user on all requests by checking the token cookie\n *\n * Usage:\n * Option 1: use if no other middleware (e.g. no next-intl etc)\n * export default authMiddleware();\n *\n * Option 2: use if other middleware is needed - default auth config\n * export default withAuth((request) => {\n *    console.log('in custom middleware', request.nextUrl.pathname);\n *    return NextResponse.next();\n * })\n *\n * Option 3: use if other middleware is needed - specifying auth config\n * const withCivicAuth = auth({ loginUrl: '/login', include: ['/[.*]/user'] })\n * export default withCivicAuth((request) => {\n *   console.log('in custom middleware', request.url);\n *   return NextResponse.next();\n * })\n *\n */\nimport { NextRequest, NextResponse } from \"next/server.js\";\nimport picomatch from \"picomatch\";\nimport {\n  AuthConfig,\n  defaultAuthConfig,\n  resolveAuthConfig,\n} from \"@/nextjs/config.js\";\n\ntype Middleware = (\n  request: NextRequest,\n) => Promise<NextResponse> | NextResponse;\n\n// Matches globs:\n// Examples:\n// /user\n// /user/*\n// /user/**/info\nconst matchGlob = (pathname: string, globPattern: string) => {\n  const matches = picomatch(globPattern);\n  return matches(pathname);\n};\n\n// Matches globs:\n// Examples:\n// /user\n// /user/*\n// /user/**/info\nconst matchesGlobs = (pathname: string, patterns: string[]) =>\n  patterns.some((pattern) => {\n    if (!pattern) return false;\n    console.log(\"matching\", {\n      pattern,\n      pathname,\n      match: matchGlob(pathname, pattern),\n    });\n    return matchGlob(pathname, pattern);\n  });\n\n// internal - used by all exported functions\nconst applyAuth = async (\n  authConfig: AuthConfig,\n  request: NextRequest,\n): Promise<NextResponse | undefined> => {\n  const authConfigWithDefaults = resolveAuthConfig(authConfig);\n\n  // Check for any valid auth token\n  const isAuthenticated = !!request.cookies.get(\"id_token\");\n\n  // skip auth check for redirect to login url\n  if (\n    request.nextUrl.pathname === authConfigWithDefaults.loginUrl &&\n    request.method === \"GET\"\n  ) {\n    console.log(\"→ Skipping auth check - this is the login URL\");\n    return undefined;\n  }\n\n  if (!matchesGlobs(request.nextUrl.pathname, authConfigWithDefaults.include)) {\n    console.log(\"→ Skipping auth check - path not in include patterns\");\n    return undefined;\n  }\n\n  if (matchesGlobs(request.nextUrl.pathname, authConfigWithDefaults.exclude)) {\n    console.log(\"→ Skipping auth check - path in exclude patterns\");\n    return undefined;\n  }\n\n  // Check for either token type\n  if (!isAuthenticated) {\n    console.log(\"→ No valid token found - redirecting to login\");\n    const loginUrl = new URL(authConfigWithDefaults.loginUrl, request.url);\n    return NextResponse.redirect(loginUrl);\n  }\n\n  console.log(\"→ Auth check passed\");\n  return undefined;\n};\n\n/**\n *\n * Use this when auth is the only middleware you need.\n * Usage:\n *\n * export default authMiddleware({ loginUrl = '/login' }); // or just authMiddleware();\n *\n */\nexport const authMiddleware =\n  (authConfig = defaultAuthConfig) =>\n  async (request: NextRequest): Promise<NextResponse> => {\n    const response = await applyAuth(authConfig, request);\n    if (response) return response;\n\n    // NextJS doesn't do middleware chaining yet, so this does not mean\n    // \"call the next middleware\" - it means \"continue to the route handler\"\n    return NextResponse.next();\n  };\n\n/**\n * Usage:\n *\n * export default withAuth(async (request) => {\n *    console.log('my middleware');\n *    return NextResponse.next();\n *  })\n */\n// use this when you have your own middleware to chain\nexport function withAuth(\n  middleware: Middleware,\n): (request: NextRequest) => Promise<NextResponse> {\n  return async (request: NextRequest): Promise<NextResponse> => {\n    const response = await applyAuth({}, request);\n    if (response) return response;\n    return middleware(request);\n  };\n}\n\n/**\n * Use this when you want to configure the middleware here (an alternative is to do it in the next.config file)\n *\n * Usage:\n *\n * const withAuth = auth({ loginUrl = '/login' }); // or just auth();\n *\n * export default withAuth(async (request) => {\n *    console.log('my middleware');\n *    return NextResponse.next();\n *  })\n *\n */\nexport function auth(authConfig: AuthConfig = {}) {\n  return (\n    middleware: Middleware,\n  ): ((request: NextRequest) => Promise<NextResponse>) => {\n    return async (request: NextRequest): Promise<NextResponse> => {\n      const response = await applyAuth(authConfig, request);\n      if (response) return response;\n      return middleware(request);\n    };\n  };\n}\n","import { NextRequest, NextResponse } from \"next/server.js\";\nimport { revalidatePath } from \"next/cache.js\";\nimport { AuthConfig, resolveAuthConfig } from \"@/nextjs/config.js\";\nimport { loggers } from \"@/lib/logger.js\";\nimport {\n  clearAuthCookies,\n  NextjsClientStorage,\n  NextjsCookieStorage,\n} from \"@/nextjs/cookies.js\";\nimport { GenericPublicClientPKCEProducer } from \"@/services/PKCE.js\";\nimport { resolveOAuthAccessCode } from \"@/server/login.js\";\nimport { getUser } from \"@/shared/session.js\";\nimport { resolveCallbackUrl } from \"@/nextjs/utils.js\";\nimport { GenericUserSession } from \"@/shared/UserSession.js\";\nimport { TOKEN_EXCHANGE_TRIGGER_TEXT } from \"@/constants\";\n\nconst logger = loggers.nextjs.handlers.auth;\n\nclass AuthError extends Error {\n  constructor(\n    message: string,\n    public readonly status: number = 401,\n  ) {\n    super(message);\n    this.name = \"AuthError\";\n  }\n}\n\n/**\n * create a code verifier and challenge for PKCE\n * saving the verifier in a cookie for later use\n * @returns {Promise<NextResponse>}\n */\nasync function handleChallenge(): Promise<NextResponse> {\n  const cookieStorage = new NextjsCookieStorage();\n  const pkceProducer = new GenericPublicClientPKCEProducer(cookieStorage);\n\n  const challenge = await pkceProducer.getCodeChallenge();\n\n  return NextResponse.json({ status: \"success\", challenge });\n}\n\nasync function handleCallback(\n  request: NextRequest,\n  config: AuthConfig,\n): Promise<NextResponse> {\n  // If we have a code_verifier cookie, we can do a token exchange.\n  // Otherwise, just render an empty page.\n  // The initial redirect back from the auth server does not send cookies, because the redirect is from a 3rd-party domain.\n  // The client will make an additional call to this route with cookies included, at which point we do the token exchange.\n  if (!request.cookies.get(\"code_verifier\")) {\n    const response = new NextResponse(\n      `<html><body><span style=\"display:none\">${TOKEN_EXCHANGE_TRIGGER_TEXT}</span></body></html>`,\n    );\n    response.headers.set(\"Content-Type\", \"text/html; charset=utf-8\");\n    console.log(\n      `handleCallback no code_verifier found, returning ${TOKEN_EXCHANGE_TRIGGER_TEXT}`,\n    );\n    return response;\n  }\n  const code = request.nextUrl.searchParams.get(\"code\");\n  const state = request.nextUrl.searchParams.get(\"state\");\n  if (!code || !state) throw new AuthError(\"Bad parameters\", 400);\n\n  const resolvedConfigs = resolveAuthConfig(config);\n  const cookieStorage = new NextjsCookieStorage(resolvedConfigs.cookies.tokens);\n\n  const callbackUrl = resolveCallbackUrl(resolvedConfigs, request.url);\n  try {\n    await resolveOAuthAccessCode(code, state, cookieStorage, {\n      ...resolvedConfigs,\n      redirectUrl: callbackUrl,\n    });\n  } catch (error) {\n    logger.error(\"Token exchange failed:\", error);\n    throw new AuthError(\"Failed to authenticate user\", 401);\n  }\n\n  const user = await getUser(cookieStorage);\n  if (!user) {\n    throw new AuthError(\"Failed to get user info\", 401);\n  }\n\n  const clientStorage = new NextjsClientStorage();\n  const userSession = new GenericUserSession(clientStorage);\n  userSession.set(user);\n\n  // return an empty HTML response so the iframe doesn't show any response\n  // in the short moment between the redirect and the parent window\n  // acknowledging the redirect and closing the iframe\n  const response = new NextResponse(`<html></html>`);\n  response.headers.set(\"Content-Type\", \"text/html; charset=utf-8\");\n  return response;\n}\n\n/**\n * If redirectPath is an absolute path, return it as-is.\n * Otherwise for relative paths, append it to the current domain.\n * @param redirectPath\n * @returns\n */\nconst getAbsoluteRedirectPath = (\n  redirectPath: string,\n  currentBasePath: string,\n) => {\n  // Check if the redirectPath is an absolute URL\n  if (/^(https?:\\/\\/|www\\.).+/i.test(redirectPath)) {\n    return redirectPath; // Return as-is if it's an absolute URL\n  }\n  return new URL(redirectPath, currentBasePath).href;\n};\n\nasync function handleLogout(\n  request: NextRequest,\n  config: AuthConfig,\n): Promise<NextResponse> {\n  const resolvedConfigs = resolveAuthConfig(config);\n  const defaultRedirectPath = resolvedConfigs.loginUrl ?? \"/\";\n  const redirectTarget =\n    new URL(request.url).searchParams.get(\"redirect\") || defaultRedirectPath;\n  const isAbsoluteRedirect = /^(https?:\\/\\/|www\\.).+/i.test(redirectTarget);\n  const finalRedirectUrl = getAbsoluteRedirectPath(\n    redirectTarget,\n    new URL(request.url).origin,\n  );\n\n  const response = NextResponse.redirect(finalRedirectUrl);\n\n  clearAuthCookies();\n\n  try {\n    revalidatePath(isAbsoluteRedirect ? finalRedirectUrl : redirectTarget);\n  } catch (error) {\n    logger.warn(\"Failed to revalidate path after logout:\", error);\n  }\n\n  return response;\n}\n\n/**\n * Creates an authentication handler for Next.js API routes\n *\n * Usage:\n * ```ts\n * // app/api/auth/[...civicauth]/route.ts\n * import { handler } from '@civic/auth/nextjs'\n * export const GET = handler({\n *   // optional config overrides\n * })\n * ```\n */\nexport const handler =\n  (authConfig = {}) =>\n  async (request: NextRequest): Promise<NextResponse> => {\n    const config = resolveAuthConfig(authConfig);\n\n    try {\n      const pathname = request.nextUrl.pathname;\n      const pathSegments = pathname.split(\"/\");\n      const lastSegment = pathSegments[pathSegments.length - 1];\n\n      switch (lastSegment) {\n        case \"challenge\":\n          return await handleChallenge();\n        case \"callback\":\n          return await handleCallback(request, config);\n        case \"logout\":\n          return await handleLogout(request, config);\n        default:\n          throw new AuthError(`Invalid auth route: ${pathname}`, 404);\n      }\n    } catch (error) {\n      logger.error(\"Auth handler error:\", error);\n\n      const status = error instanceof AuthError ? error.status : 500;\n      const message =\n        error instanceof Error ? error.message : \"Authentication failed\";\n\n      const response = NextResponse.json({ error: message }, { status });\n\n      clearAuthCookies();\n      return response;\n    }\n  };\n"],"mappings":";;;;;;;;;;;;;;;;;;;;;;;;;AAQO,IAAMA,WAAU,MAAmB;AAR1C;AASE,QAAM,gBAAgB,IAAI,oBAAoB;AAC9C,QAAM,cAAc,IAAI,mBAAmB,aAAa;AACxD,QAAM,SAAS,eAAe,aAAa;AAC3C,QAAM,OAAO,YAAY,IAAI;AAC7B,MAAI,CAAC,QAAQ,CAAC,OAAQ,QAAO;AAE7B,SAAO,iCACF,OADE;AAAA,IAEL,SAAS,OAAO;AAAA,IAChB,aAAa,OAAO;AAAA,IACpB,eAAc,YAAO,kBAAP,YAAwB;AAAA,EACxC;AACF;;;ACAA,SAAsB,oBAAoB;AAC1C,OAAO,eAAe;AAgBtB,IAAM,YAAY,CAAC,UAAkB,gBAAwB;AAC3D,QAAM,UAAU,UAAU,WAAW;AACrC,SAAO,QAAQ,QAAQ;AACzB;AAOA,IAAM,eAAe,CAAC,UAAkB,aACtC,SAAS,KAAK,CAAC,YAAY;AACzB,MAAI,CAAC,QAAS,QAAO;AACrB,UAAQ,IAAI,YAAY;AAAA,IACtB;AAAA,IACA;AAAA,IACA,OAAO,UAAU,UAAU,OAAO;AAAA,EACpC,CAAC;AACD,SAAO,UAAU,UAAU,OAAO;AACpC,CAAC;AAGH,IAAM,YAAY,CAChB,YACA,YACsC;AACtC,QAAM,yBAAyB,kBAAkB,UAAU;AAG3D,QAAM,kBAAkB,CAAC,CAAC,QAAQ,QAAQ,IAAI,UAAU;AAGxD,MACE,QAAQ,QAAQ,aAAa,uBAAuB,YACpD,QAAQ,WAAW,OACnB;AACA,YAAQ,IAAI,oDAA+C;AAC3D,WAAO;AAAA,EACT;AAEA,MAAI,CAAC,aAAa,QAAQ,QAAQ,UAAU,uBAAuB,OAAO,GAAG;AAC3E,YAAQ,IAAI,2DAAsD;AAClE,WAAO;AAAA,EACT;AAEA,MAAI,aAAa,QAAQ,QAAQ,UAAU,uBAAuB,OAAO,GAAG;AAC1E,YAAQ,IAAI,uDAAkD;AAC9D,WAAO;AAAA,EACT;AAGA,MAAI,CAAC,iBAAiB;AACpB,YAAQ,IAAI,oDAA+C;AAC3D,UAAM,WAAW,IAAI,IAAI,uBAAuB,UAAU,QAAQ,GAAG;AACrE,WAAO,aAAa,SAAS,QAAQ;AAAA,EACvC;AAEA,UAAQ,IAAI,0BAAqB;AACjC,SAAO;AACT;AAUO,IAAM,iBACX,CAAC,aAAa,sBACd,CAAO,YAAgD;AACrD,QAAM,WAAW,MAAM,UAAU,YAAY,OAAO;AACpD,MAAI,SAAU,QAAO;AAIrB,SAAO,aAAa,KAAK;AAC3B;AAWK,SAAS,SACd,YACiD;AACjD,SAAO,CAAO,YAAgD;AAC5D,UAAM,WAAW,MAAM,UAAU,CAAC,GAAG,OAAO;AAC5C,QAAI,SAAU,QAAO;AACrB,WAAO,WAAW,OAAO;AAAA,EAC3B;AACF;AAeO,SAAS,KAAK,aAAyB,CAAC,GAAG;AAChD,SAAO,CACL,eACsD;AACtD,WAAO,CAAO,YAAgD;AAC5D,YAAM,WAAW,MAAM,UAAU,YAAY,OAAO;AACpD,UAAI,SAAU,QAAO;AACrB,aAAO,WAAW,OAAO;AAAA,IAC3B;AAAA,EACF;AACF;;;AChKA,SAAsB,gBAAAC,qBAAoB;AAC1C,SAAS,sBAAsB;AAe/B,IAAM,SAAS,QAAQ,OAAO,SAAS;AAEvC,IAAM,YAAN,cAAwB,MAAM;AAAA,EAC5B,YACE,SACgB,SAAiB,KACjC;AACA,UAAM,OAAO;AAFG;AAGhB,SAAK,OAAO;AAAA,EACd;AACF;AAOA,SAAe,kBAAyC;AAAA;AACtD,UAAM,gBAAgB,IAAI,oBAAoB;AAC9C,UAAM,eAAe,IAAI,gCAAgC,aAAa;AAEtE,UAAM,YAAY,MAAM,aAAa,iBAAiB;AAEtD,WAAOC,cAAa,KAAK,EAAE,QAAQ,WAAW,UAAU,CAAC;AAAA,EAC3D;AAAA;AAEA,SAAe,eACb,SACA,QACuB;AAAA;AAKvB,QAAI,CAAC,QAAQ,QAAQ,IAAI,eAAe,GAAG;AACzC,YAAMC,YAAW,IAAID;AAAA,QACnB,0CAA0C,2BAA2B;AAAA,MACvE;AACA,MAAAC,UAAS,QAAQ,IAAI,gBAAgB,0BAA0B;AAC/D,cAAQ;AAAA,QACN,oDAAoD,2BAA2B;AAAA,MACjF;AACA,aAAOA;AAAA,IACT;AACA,UAAM,OAAO,QAAQ,QAAQ,aAAa,IAAI,MAAM;AACpD,UAAM,QAAQ,QAAQ,QAAQ,aAAa,IAAI,OAAO;AACtD,QAAI,CAAC,QAAQ,CAAC,MAAO,OAAM,IAAI,UAAU,kBAAkB,GAAG;AAE9D,UAAM,kBAAkB,kBAAkB,MAAM;AAChD,UAAM,gBAAgB,IAAI,oBAAoB,gBAAgB,QAAQ,MAAM;AAE5E,UAAM,cAAc,mBAAmB,iBAAiB,QAAQ,GAAG;AACnE,QAAI;AACF,YAAM,uBAAuB,MAAM,OAAO,eAAe,iCACpD,kBADoD;AAAA,QAEvD,aAAa;AAAA,MACf,EAAC;AAAA,IACH,SAAS,OAAO;AACd,aAAO,MAAM,0BAA0B,KAAK;AAC5C,YAAM,IAAI,UAAU,+BAA+B,GAAG;AAAA,IACxD;AAEA,UAAM,OAAO,MAAM,QAAQ,aAAa;AACxC,QAAI,CAAC,MAAM;AACT,YAAM,IAAI,UAAU,2BAA2B,GAAG;AAAA,IACpD;AAEA,UAAM,gBAAgB,IAAI,oBAAoB;AAC9C,UAAM,cAAc,IAAI,mBAAmB,aAAa;AACxD,gBAAY,IAAI,IAAI;AAKpB,UAAM,WAAW,IAAID,cAAa,eAAe;AACjD,aAAS,QAAQ,IAAI,gBAAgB,0BAA0B;AAC/D,WAAO;AAAA,EACT;AAAA;AAQA,IAAM,0BAA0B,CAC9B,cACA,oBACG;AAEH,MAAI,0BAA0B,KAAK,YAAY,GAAG;AAChD,WAAO;AAAA,EACT;AACA,SAAO,IAAI,IAAI,cAAc,eAAe,EAAE;AAChD;AAEA,SAAe,aACb,SACA,QACuB;AAAA;AAnHzB;AAoHE,UAAM,kBAAkB,kBAAkB,MAAM;AAChD,UAAM,uBAAsB,qBAAgB,aAAhB,YAA4B;AACxD,UAAM,iBACJ,IAAI,IAAI,QAAQ,GAAG,EAAE,aAAa,IAAI,UAAU,KAAK;AACvD,UAAM,qBAAqB,0BAA0B,KAAK,cAAc;AACxE,UAAM,mBAAmB;AAAA,MACvB;AAAA,MACA,IAAI,IAAI,QAAQ,GAAG,EAAE;AAAA,IACvB;AAEA,UAAM,WAAWA,cAAa,SAAS,gBAAgB;AAEvD,qBAAiB;AAEjB,QAAI;AACF,qBAAe,qBAAqB,mBAAmB,cAAc;AAAA,IACvE,SAAS,OAAO;AACd,aAAO,KAAK,2CAA2C,KAAK;AAAA,IAC9D;AAEA,WAAO;AAAA,EACT;AAAA;AAcO,IAAM,UACX,CAAC,aAAa,CAAC,MACf,CAAO,YAAgD;AACrD,QAAM,SAAS,kBAAkB,UAAU;AAE3C,MAAI;AACF,UAAM,WAAW,QAAQ,QAAQ;AACjC,UAAM,eAAe,SAAS,MAAM,GAAG;AACvC,UAAM,cAAc,aAAa,aAAa,SAAS,CAAC;AAExD,YAAQ,aAAa;AAAA,MACnB,KAAK;AACH,eAAO,MAAM,gBAAgB;AAAA,MAC/B,KAAK;AACH,eAAO,MAAM,eAAe,SAAS,MAAM;AAAA,MAC7C,KAAK;AACH,eAAO,MAAM,aAAa,SAAS,MAAM;AAAA,MAC3C;AACE,cAAM,IAAI,UAAU,uBAAuB,QAAQ,IAAI,GAAG;AAAA,IAC9D;AAAA,EACF,SAAS,OAAO;AACd,WAAO,MAAM,uBAAuB,KAAK;AAEzC,UAAM,SAAS,iBAAiB,YAAY,MAAM,SAAS;AAC3D,UAAM,UACJ,iBAAiB,QAAQ,MAAM,UAAU;AAE3C,UAAM,WAAWA,cAAa,KAAK,EAAE,OAAO,QAAQ,GAAG,EAAE,OAAO,CAAC;AAEjE,qBAAiB;AACjB,WAAO;AAAA,EACT;AACF;","names":["getUser","NextResponse","NextResponse","response"]}
+{"version":3,"sources":["../src/nextjs/GetUser.ts","../src/nextjs/middleware.ts","../src/nextjs/routeHandler.ts","../src/nextjs/NextJSSessionService.ts","../src/nextjs/cookies.ts"],"sourcesContent":["/**\n * Used on the server-side to get the user object from the cookie\n */\nimport { cookies } from \"next/headers.js\";\nimport { UnknownObject, User } from \"../types\";\n\nexport const getUser = (): User<UnknownObject> | null => {\n  // TODO validate the token?\n  const user = cookies().get(\"user\")?.value;\n  if (!user) return null;\n  return JSON.parse(user);\n};\n","/**\n * Authenticates the user on all requests by checking the token cookie\n *\n * Usage:\n * Option 1: use if no other middleware (e.g. no next-intl etc)\n * export default authMiddleware();\n *\n * Option 2: use if other middleware is needed - default auth config\n * export default withAuth((request) => {\n *    console.log('in custom middleware', request.nextUrl.pathname);\n *    return NextResponse.next();\n * })\n *\n * Option 3: use if other middleware is needed - specifying auth config\n * const withCivicAuth = auth({ loginUrl: '/login', include: ['/[.*]/user'] })\n * export default withCivicAuth((request) => {\n *   console.log('in custom middleware', request.url);\n *   return NextResponse.next();\n * })\n *\n */\nimport { NextRequest, NextResponse } from \"next/server.js\";\nimport picomatch from \"picomatch\";\nimport {\n  AuthConfig,\n  defaultAuthConfig,\n  resolveAuthConfig,\n} from \"@/nextjs/config.js\";\n\ntype Middleware = (\n  request: NextRequest,\n) => Promise<NextResponse> | NextResponse;\n\n// Matches globs:\n// Examples:\n// /user\n// /user/*\n// /user/**/info\nconst matchGlob = (pathname: string, globPattern: string) => {\n  const matches = picomatch(globPattern);\n  return matches(pathname);\n};\n\n// Matches globs:\n// Examples:\n// /user\n// /user/*\n// /user/**/info\nconst matchesGlobs = (pathname: string, patterns: string[]) =>\n  patterns.some((pattern) => {\n    if (!pattern) return false;\n    console.log(\"matching\", {\n      pattern,\n      pathname,\n      match: matchGlob(pathname, pattern),\n    });\n    return matchGlob(pathname, pattern);\n  });\n\n// internal - used by all exported functions\nconst applyAuth = async (\n  authConfig: AuthConfig,\n  request: NextRequest,\n): Promise<NextResponse | undefined> => {\n  const authConfigWithDefaults = resolveAuthConfig(authConfig);\n\n  // Check for any valid auth token\n  const isAuthenticated = !!request.cookies.get(\"id_token\");\n\n  // skip auth check for login url\n  if (request.nextUrl.pathname === authConfigWithDefaults.loginUrl) {\n    console.log(\"→ Skipping auth check - this is the login URL\");\n    return undefined;\n  }\n\n  if (!matchesGlobs(request.nextUrl.pathname, authConfigWithDefaults.include)) {\n    console.log(\"→ Skipping auth check - path not in include patterns\");\n    return undefined;\n  }\n\n  if (matchesGlobs(request.nextUrl.pathname, authConfigWithDefaults.exclude)) {\n    console.log(\"→ Skipping auth check - path in exclude patterns\");\n    return undefined;\n  }\n\n  // Check for either token type\n  if (!isAuthenticated) {\n    console.log(\"→ No valid token found - redirecting to login\");\n    const loginUrl = new URL(authConfigWithDefaults.loginUrl, request.url);\n    return NextResponse.redirect(loginUrl);\n  }\n\n  console.log(\"→ Auth check passed\");\n  return undefined;\n};\n\n/**\n *\n * Use this when auth is the only middleware you need.\n * Usage:\n *\n * export default authMiddleware({ loginUrl = '/login' }); // or just authMiddleware();\n *\n */\nexport const authMiddleware =\n  (authConfig = defaultAuthConfig) =>\n  async (request: NextRequest): Promise<NextResponse> => {\n    const response = await applyAuth(authConfig, request);\n    if (response) return response;\n\n    // NextJS doesn't do middleware chaining yet, so this does not mean\n    // \"call the next middleware\" - it means \"continue to the route handler\"\n    return NextResponse.next();\n  };\n\n/**\n * Usage:\n *\n * export default withAuth(async (request) => {\n *    console.log('my middleware');\n *    return NextResponse.next();\n *  })\n */\n// use this when you have your own middleware to chain\nexport function withAuth(\n  middleware: Middleware,\n): (request: NextRequest) => Promise<NextResponse> {\n  return async (request: NextRequest): Promise<NextResponse> => {\n    const response = await applyAuth({}, request);\n    if (response) return response;\n    return middleware(request);\n  };\n}\n\n/**\n * Use this when you want to configure the middleware here (an alternative is to do it in the next.config file)\n *\n * Usage:\n *\n * const withAuth = auth({ loginUrl = '/login' }); // or just auth();\n *\n * export default withAuth(async (request) => {\n *    console.log('my middleware');\n *    return NextResponse.next();\n *  })\n *\n */\nexport function auth(authConfig: AuthConfig = {}) {\n  return (\n    middleware: Middleware,\n  ): ((request: NextRequest) => Promise<NextResponse>) => {\n    return async (request: NextRequest): Promise<NextResponse> => {\n      const response = await applyAuth(authConfig, request);\n      if (response) return response;\n      return middleware(request);\n    };\n  };\n}\n","import { NextRequest, NextResponse } from \"next/server.js\";\nimport { revalidatePath } from \"next/cache.js\";\nimport {\n  AuthConfig,\n  DefinedAuthConfig,\n  resolveAuthConfig,\n} from \"@/nextjs/config.js\";\nimport { loggers } from \"@/lib/logger.js\";\nimport { AuthSessionService } from \"@/types\";\nimport { NextJSAuthSessionServiceImpl } from \"./NextJSSessionService.js\";\nimport { clearAuthCookies } from \"./cookies.js\";\nimport { generateCodeVerifier } from \"oslo/oauth2\";\nimport { deriveCodeChallenge } from \"@/shared/util.js\";\n\nconst logger = loggers.nextjs.handlers.auth;\n\nclass AuthError extends Error {\n  constructor(\n    message: string,\n    public readonly status: number = 401,\n  ) {\n    super(message);\n    this.name = \"AuthError\";\n  }\n}\n\n/**\n * create a code verifier and challenge for PKCE\n * saving the verifier in a cookie for later use\n * @returns {Promise<NextResponse>}\n */\nasync function handleChallenge(): Promise<NextResponse> {\n  const codeVerifier = generateCodeVerifier();\n  console.log(\"handleChallenge codeVerifier\", codeVerifier);\n  const challenge = await deriveCodeChallenge(codeVerifier);\n  const response = NextResponse.json({ status: \"success\", challenge });\n  response.cookies.set(\"codeVerifier\", codeVerifier, {\n    httpOnly: true,\n    secure: true,\n    sameSite: \"strict\",\n  });\n  return response;\n}\nasync function handleCallback(\n  request: NextRequest,\n  config: AuthConfig,\n): Promise<NextResponse> {\n  const code = request.nextUrl.searchParams.get(\"code\");\n  if (!code) throw new AuthError(\"Missing authorization code\");\n\n  try {\n    // return an empty HTML response so the iframe doesn't show any response\n    // in the short moment between the redirect and the parent window\n    // acknowledging the redirect and closing the iframe\n    const response = new NextResponse(`<html></html>`);\n    response.headers.set(\"Content-Type\", \"text/html; charset=utf-8\");\n\n    const resolvedConfigs = resolveAuthConfig(config);\n    const callbackUrl = new URL(\n      resolvedConfigs?.callbackUrl,\n      request.url,\n    ).toString();\n\n    const authService = getDefaultAuthSessionService(\n      {\n        ...resolvedConfigs,\n        callbackUrl,\n      },\n      request,\n      response,\n    );\n    console.log(\"handleCallback authService\", authService);\n    const tokens = await authService.tokenExchange(request.nextUrl.toString());\n\n    if (!tokens.accessToken) {\n      throw new AuthError(\"Missing access token\");\n    }\n\n    return response;\n  } catch (error) {\n    logger.error(\"Token exchange failed:\", error);\n    throw new AuthError(\"Failed to authenticate user\", 401);\n  }\n}\n\n/**\n * If redirectPath is an absolute path, return it as-is.\n * Otherwise for relative paths, append it to the current domain.\n * @param redirectPath\n * @returns\n */\nconst getAbsoluteRedirectPath = (\n  redirectPath: string,\n  currentBasePath: string,\n) => {\n  // Check if the redirectPath is an absolute URL\n  if (/^(https?:\\/\\/|www\\.).+/i.test(redirectPath)) {\n    return redirectPath; // Return as-is if it's an absolute URL\n  }\n  return new URL(redirectPath, currentBasePath).href;\n};\n\nasync function handleLogout(\n  request: NextRequest,\n  config: AuthConfig,\n): Promise<NextResponse> {\n  const resolvedConfigs = resolveAuthConfig(config);\n  const defaultRedirectPath = resolvedConfigs.loginUrl ?? \"/\";\n  const redirectTarget =\n    new URL(request.url).searchParams.get(\"redirect\") || defaultRedirectPath;\n  const isAbsoluteRedirect = /^(https?:\\/\\/|www\\.).+/i.test(redirectTarget);\n  const finalRedirectUrl = getAbsoluteRedirectPath(\n    redirectTarget,\n    new URL(request.url).origin,\n  );\n\n  const response = NextResponse.redirect(finalRedirectUrl);\n  clearAuthCookies(response, resolvedConfigs);\n\n  try {\n    revalidatePath(isAbsoluteRedirect ? finalRedirectUrl : redirectTarget);\n  } catch (error) {\n    logger.warn(\"Failed to revalidate path after logout:\", error);\n  }\n\n  return response;\n}\n\nconst getDefaultAuthSessionService = (\n  authConfig: DefinedAuthConfig,\n  request?: NextRequest,\n  response?: NextResponse,\n): AuthSessionService => {\n  return new NextJSAuthSessionServiceImpl(authConfig, request, response);\n};\n\n/**\n * Creates an authentication handler for Next.js API routes\n *\n * Usage:\n * ```ts\n * // app/api/auth/[...civicauth]/route.ts\n * import { handler } from '@civic/auth/nextjs'\n * export const GET = handler({\n *   // optional config overrides\n * })\n * ```\n */\nexport const handler =\n  (authConfig: {} = {}) =>\n  async (request: NextRequest): Promise<NextResponse> => {\n    const config = resolveAuthConfig(authConfig);\n\n    try {\n      const pathname = request.nextUrl.pathname;\n      const pathSegments = pathname.split(\"/\");\n      const lastSegment = pathSegments[pathSegments.length - 1];\n\n      switch (lastSegment) {\n        case \"challenge\":\n          return await handleChallenge();\n        case \"callback\":\n          return await handleCallback(request, config);\n        case \"logout\":\n          return await handleLogout(request, config);\n        default:\n          throw new AuthError(`Invalid auth route: ${pathname}`, 404);\n      }\n    } catch (error) {\n      logger.error(\"Auth handler error:\", error);\n\n      const status = error instanceof AuthError ? error.status : 500;\n      const message =\n        error instanceof Error ? error.message : \"Authentication failed\";\n\n      const response = NextResponse.json({ error: message }, { status });\n\n      clearAuthCookies(response, config);\n      return response;\n    }\n  };\n","import { cookies } from \"next/headers.js\";\nimport { SessionData, UnknownObject, Endpoints, User } from \"../types.js\";\nimport { NextRequest, NextResponse } from \"next/server.js\";\nimport { AuthConfigWithDefaults } from \"./config.js\";\nimport { AuthSessionServiceImpl } from \"@/services\";\nimport {\n  clearAuthCookies,\n  createTokenCookies,\n  createUserInfoCookie,\n} from \"./cookies.js\";\n\nexport type StorageInterface = {\n  get(): SessionData;\n  getUser(): User<UnknownObject> | null;\n  set(data: Partial<SessionData>): void;\n  setUser(data: User<UnknownObject> | null): void;\n  clear(): void;\n};\n\nexport class NextJSAuthSessionServiceImpl extends AuthSessionServiceImpl {\n  constructor(\n    readonly authConfig: AuthConfigWithDefaults,\n    readonly request: NextRequest | undefined,\n    readonly response: NextResponse | undefined,\n    readonly inputEndpoints?: Endpoints | undefined,\n  ) {\n    super(\n      authConfig.clientId,\n      authConfig.callbackUrl,\n      authConfig.oauthServer,\n      inputEndpoints,\n    );\n  }\n\n  protected getCodeVerifier(): string {\n    const codeVerifier = cookies().get(\"codeVerifier\");\n    if (!codeVerifier) {\n      throw new Error(\"Code verifier not found in cookies\");\n    }\n    return codeVerifier.value;\n  }\n\n  getSessionData(): SessionData {\n    const authenticated = cookies().get(\"access_token\") !== undefined;\n    return {\n      authenticated,\n      codeVerifier: cookies().get(\"codeVerifier\")?.value,\n      accessToken: cookies().get(\"access_token\")?.value,\n      idToken: cookies().get(\"id_token\")?.value,\n      refreshToken: cookies().get(\"refresh_token\")?.value,\n    };\n  }\n\n  updateSessionData(data: Partial<SessionData>): void {\n    createTokenCookies(\n      this.response as NextResponse,\n      data as SessionData,\n      this.authConfig,\n    );\n  }\n\n  getUser(): User<UnknownObject> | null {\n    const userCookie = cookies().get(\"user\");\n    if (!userCookie) return null;\n    return JSON.parse(userCookie.value);\n  }\n\n  setUser(user: User<UnknownObject> | null): void {\n    createUserInfoCookie(\n      this.response as NextResponse,\n      user,\n      { authenticated: true },\n      this.authConfig,\n    );\n  }\n\n  clearSessionData(): void {\n    clearAuthCookies(this.response as NextResponse, this.authConfig);\n  }\n\n  // TODO fix the Window reference\n  loadAuthorizationUrl() {\n    throw new Error(\"Not implemented\");\n  }\n\n  async logout(): Promise<void> {\n    this.updateSessionData({ authenticated: false });\n  }\n}\n","import { SessionData, UnknownObject, User } from \"@/types\";\nimport { NextResponse } from \"next/server\";\nimport { AuthConfig } from \"./config\";\n\n/**\n * Creates HTTP-only cookies for authentication tokens\n */\nconst createTokenCookies = (\n  response: NextResponse,\n  sessionData: SessionData,\n  config: AuthConfig,\n) => {\n  const maxAge = sessionData.expiresIn ?? 3600;\n  const cookieOptions = {\n    ...config.cookies?.tokens,\n    maxAge,\n  };\n\n  if (sessionData.accessToken) {\n    response.cookies.set(\"access_token\", sessionData.accessToken, {\n      ...cookieOptions,\n      httpOnly: true,\n    });\n  }\n\n  if (sessionData.idToken) {\n    response.cookies.set(\"id_token\", sessionData.idToken, {\n      ...cookieOptions,\n      httpOnly: true,\n    });\n  }\n\n  if (sessionData.refreshToken) {\n    response.cookies.set(\"refresh_token\", sessionData.refreshToken, {\n      ...cookieOptions,\n      httpOnly: true,\n    });\n  }\n};\n\n/**\n * Creates a client-readable cookie with user info\n */\nconst createUserInfoCookie = (\n  response: NextResponse,\n  user: User<UnknownObject> | null,\n  sessionData: SessionData,\n  config: AuthConfig,\n) => {\n  if (!user) {\n    response.cookies.set(\"user\", \"\", {\n      ...config.cookies?.user,\n      maxAge: 0,\n    });\n    return;\n  }\n  const maxAge = sessionData.expiresIn ?? 3600;\n\n  // TODO select fields to include in the user cookie\n  const frontendUser = {\n    ...user,\n  };\n\n  // TODO make call to get user info from the\n  // auth server /userinfo endpoint when it's available\n  // then add to the default claims above\n\n  response.cookies.set(\"user\", JSON.stringify(frontendUser), {\n    ...config.cookies?.user,\n    maxAge,\n  });\n};\n\n/**\n * Clears all authentication cookies\n */\nconst clearAuthCookies = (response: NextResponse, config: AuthConfig) => {\n  const clearOptions = {\n    ...config.cookies?.tokens,\n    maxAge: 0,\n  };\n\n  response.cookies.set(\"access_token\", \"\", clearOptions);\n  response.cookies.set(\"id_token\", \"\", clearOptions);\n  response.cookies.set(\"refresh_token\", \"\", clearOptions);\n  response.cookies.set(\"codeVerifier\", \"\", clearOptions);\n  response.cookies.set(\"user\", \"\", {\n    ...config.cookies?.user,\n    maxAge: 0,\n  });\n};\n\nexport { createTokenCookies, createUserInfoCookie, clearAuthCookies };\n"],"mappings":";;;;;;;;;;;;;;;;;AAGA,SAAS,eAAe;AAGjB,IAAM,UAAU,MAAkC;AANzD;AAQE,QAAM,QAAO,aAAQ,EAAE,IAAI,MAAM,MAApB,mBAAuB;AACpC,MAAI,CAAC,KAAM,QAAO;AAClB,SAAO,KAAK,MAAM,IAAI;AACxB;;;ACUA,SAAsB,oBAAoB;AAC1C,OAAO,eAAe;AAgBtB,IAAM,YAAY,CAAC,UAAkB,gBAAwB;AAC3D,QAAM,UAAU,UAAU,WAAW;AACrC,SAAO,QAAQ,QAAQ;AACzB;AAOA,IAAM,eAAe,CAAC,UAAkB,aACtC,SAAS,KAAK,CAAC,YAAY;AACzB,MAAI,CAAC,QAAS,QAAO;AACrB,UAAQ,IAAI,YAAY;AAAA,IACtB;AAAA,IACA;AAAA,IACA,OAAO,UAAU,UAAU,OAAO;AAAA,EACpC,CAAC;AACD,SAAO,UAAU,UAAU,OAAO;AACpC,CAAC;AAGH,IAAM,YAAY,CAChB,YACA,YACsC;AACtC,QAAM,yBAAyB,kBAAkB,UAAU;AAG3D,QAAM,kBAAkB,CAAC,CAAC,QAAQ,QAAQ,IAAI,UAAU;AAGxD,MAAI,QAAQ,QAAQ,aAAa,uBAAuB,UAAU;AAChE,YAAQ,IAAI,oDAA+C;AAC3D,WAAO;AAAA,EACT;AAEA,MAAI,CAAC,aAAa,QAAQ,QAAQ,UAAU,uBAAuB,OAAO,GAAG;AAC3E,YAAQ,IAAI,2DAAsD;AAClE,WAAO;AAAA,EACT;AAEA,MAAI,aAAa,QAAQ,QAAQ,UAAU,uBAAuB,OAAO,GAAG;AAC1E,YAAQ,IAAI,uDAAkD;AAC9D,WAAO;AAAA,EACT;AAGA,MAAI,CAAC,iBAAiB;AACpB,YAAQ,IAAI,oDAA+C;AAC3D,UAAM,WAAW,IAAI,IAAI,uBAAuB,UAAU,QAAQ,GAAG;AACrE,WAAO,aAAa,SAAS,QAAQ;AAAA,EACvC;AAEA,UAAQ,IAAI,0BAAqB;AACjC,SAAO;AACT;AAUO,IAAM,iBACX,CAAC,aAAa,sBACd,CAAO,YAAgD;AACrD,QAAM,WAAW,MAAM,UAAU,YAAY,OAAO;AACpD,MAAI,SAAU,QAAO;AAIrB,SAAO,aAAa,KAAK;AAC3B;AAWK,SAAS,SACd,YACiD;AACjD,SAAO,CAAO,YAAgD;AAC5D,UAAM,WAAW,MAAM,UAAU,CAAC,GAAG,OAAO;AAC5C,QAAI,SAAU,QAAO;AACrB,WAAO,WAAW,OAAO;AAAA,EAC3B;AACF;AAeO,SAAS,KAAK,aAAyB,CAAC,GAAG;AAChD,SAAO,CACL,eACsD;AACtD,WAAO,CAAO,YAAgD;AAC5D,YAAM,WAAW,MAAM,UAAU,YAAY,OAAO;AACpD,UAAI,SAAU,QAAO;AACrB,aAAO,WAAW,OAAO;AAAA,IAC3B;AAAA,EACF;AACF;;;AC7JA,SAAsB,gBAAAA,qBAAoB;AAC1C,SAAS,sBAAsB;;;ACD/B,SAAS,WAAAC,gBAAe;;;ACOxB,IAAM,qBAAqB,CACzB,UACA,aACA,WACG;AAXL;AAYE,QAAM,UAAS,iBAAY,cAAZ,YAAyB;AACxC,QAAM,gBAAgB,kCACjB,YAAO,YAAP,mBAAgB,SADC;AAAA,IAEpB;AAAA,EACF;AAEA,MAAI,YAAY,aAAa;AAC3B,aAAS,QAAQ,IAAI,gBAAgB,YAAY,aAAa,iCACzD,gBADyD;AAAA,MAE5D,UAAU;AAAA,IACZ,EAAC;AAAA,EACH;AAEA,MAAI,YAAY,SAAS;AACvB,aAAS,QAAQ,IAAI,YAAY,YAAY,SAAS,iCACjD,gBADiD;AAAA,MAEpD,UAAU;AAAA,IACZ,EAAC;AAAA,EACH;AAEA,MAAI,YAAY,cAAc;AAC5B,aAAS,QAAQ,IAAI,iBAAiB,YAAY,cAAc,iCAC3D,gBAD2D;AAAA,MAE9D,UAAU;AAAA,IACZ,EAAC;AAAA,EACH;AACF;AAKA,IAAM,uBAAuB,CAC3B,UACA,MACA,aACA,WACG;AAhDL;AAiDE,MAAI,CAAC,MAAM;AACT,aAAS,QAAQ,IAAI,QAAQ,IAAI,kCAC5B,YAAO,YAAP,mBAAgB,OADY;AAAA,MAE/B,QAAQ;AAAA,IACV,EAAC;AACD;AAAA,EACF;AACA,QAAM,UAAS,iBAAY,cAAZ,YAAyB;AAGxC,QAAM,eAAe,mBAChB;AAOL,WAAS,QAAQ,IAAI,QAAQ,KAAK,UAAU,YAAY,GAAG,kCACtD,YAAO,YAAP,mBAAgB,OADsC;AAAA,IAEzD;AAAA,EACF,EAAC;AACH;AAKA,IAAM,mBAAmB,CAAC,UAAwB,WAAuB;AA5EzE;AA6EE,QAAM,eAAe,kCAChB,YAAO,YAAP,mBAAgB,SADA;AAAA,IAEnB,QAAQ;AAAA,EACV;AAEA,WAAS,QAAQ,IAAI,gBAAgB,IAAI,YAAY;AACrD,WAAS,QAAQ,IAAI,YAAY,IAAI,YAAY;AACjD,WAAS,QAAQ,IAAI,iBAAiB,IAAI,YAAY;AACtD,WAAS,QAAQ,IAAI,gBAAgB,IAAI,YAAY;AACrD,WAAS,QAAQ,IAAI,QAAQ,IAAI,kCAC5B,YAAO,YAAP,mBAAgB,OADY;AAAA,IAE/B,QAAQ;AAAA,EACV,EAAC;AACH;;;ADvEO,IAAM,+BAAN,cAA2C,uBAAuB;AAAA,EACvE,YACW,YACA,SACA,UACA,gBACT;AACA;AAAA,MACE,WAAW;AAAA,MACX,WAAW;AAAA,MACX,WAAW;AAAA,MACX;AAAA,IACF;AAVS;AACA;AACA;AACA;AAAA,EAQX;AAAA,EAEU,kBAA0B;AAClC,UAAM,eAAeC,SAAQ,EAAE,IAAI,cAAc;AACjD,QAAI,CAAC,cAAc;AACjB,YAAM,IAAI,MAAM,oCAAoC;AAAA,IACtD;AACA,WAAO,aAAa;AAAA,EACtB;AAAA,EAEA,iBAA8B;AA1ChC;AA2CI,UAAM,gBAAgBA,SAAQ,EAAE,IAAI,cAAc,MAAM;AACxD,WAAO;AAAA,MACL;AAAA,MACA,eAAc,KAAAA,SAAQ,EAAE,IAAI,cAAc,MAA5B,mBAA+B;AAAA,MAC7C,cAAa,KAAAA,SAAQ,EAAE,IAAI,cAAc,MAA5B,mBAA+B;AAAA,MAC5C,UAAS,KAAAA,SAAQ,EAAE,IAAI,UAAU,MAAxB,mBAA2B;AAAA,MACpC,eAAc,KAAAA,SAAQ,EAAE,IAAI,eAAe,MAA7B,mBAAgC;AAAA,IAChD;AAAA,EACF;AAAA,EAEA,kBAAkB,MAAkC;AAClD;AAAA,MACE,KAAK;AAAA,MACL;AAAA,MACA,KAAK;AAAA,IACP;AAAA,EACF;AAAA,EAEA,UAAsC;AACpC,UAAM,aAAaA,SAAQ,EAAE,IAAI,MAAM;AACvC,QAAI,CAAC,WAAY,QAAO;AACxB,WAAO,KAAK,MAAM,WAAW,KAAK;AAAA,EACpC;AAAA,EAEA,QAAQ,MAAwC;AAC9C;AAAA,MACE,KAAK;AAAA,MACL;AAAA,MACA,EAAE,eAAe,KAAK;AAAA,MACtB,KAAK;AAAA,IACP;AAAA,EACF;AAAA,EAEA,mBAAyB;AACvB,qBAAiB,KAAK,UAA0B,KAAK,UAAU;AAAA,EACjE;AAAA;AAAA,EAGA,uBAAuB;AACrB,UAAM,IAAI,MAAM,iBAAiB;AAAA,EACnC;AAAA,EAEM,SAAwB;AAAA;AAC5B,WAAK,kBAAkB,EAAE,eAAe,MAAM,CAAC;AAAA,IACjD;AAAA;AACF;;;AD7EA,SAAS,4BAA4B;AAGrC,IAAM,SAAS,QAAQ,OAAO,SAAS;AAEvC,IAAM,YAAN,cAAwB,MAAM;AAAA,EAC5B,YACE,SACgB,SAAiB,KACjC;AACA,UAAM,OAAO;AAFG;AAGhB,SAAK,OAAO;AAAA,EACd;AACF;AAOA,SAAe,kBAAyC;AAAA;AACtD,UAAM,eAAe,qBAAqB;AAC1C,YAAQ,IAAI,gCAAgC,YAAY;AACxD,UAAM,YAAY,MAAM,oBAAoB,YAAY;AACxD,UAAM,WAAWC,cAAa,KAAK,EAAE,QAAQ,WAAW,UAAU,CAAC;AACnE,aAAS,QAAQ,IAAI,gBAAgB,cAAc;AAAA,MACjD,UAAU;AAAA,MACV,QAAQ;AAAA,MACR,UAAU;AAAA,IACZ,CAAC;AACD,WAAO;AAAA,EACT;AAAA;AACA,SAAe,eACb,SACA,QACuB;AAAA;AACvB,UAAM,OAAO,QAAQ,QAAQ,aAAa,IAAI,MAAM;AACpD,QAAI,CAAC,KAAM,OAAM,IAAI,UAAU,4BAA4B;AAE3D,QAAI;AAIF,YAAM,WAAW,IAAIA,cAAa,eAAe;AACjD,eAAS,QAAQ,IAAI,gBAAgB,0BAA0B;AAE/D,YAAM,kBAAkB,kBAAkB,MAAM;AAChD,YAAM,cAAc,IAAI;AAAA,QACtB,mDAAiB;AAAA,QACjB,QAAQ;AAAA,MACV,EAAE,SAAS;AAEX,YAAM,cAAc;AAAA,QAClB,iCACK,kBADL;AAAA,UAEE;AAAA,QACF;AAAA,QACA;AAAA,QACA;AAAA,MACF;AACA,cAAQ,IAAI,8BAA8B,WAAW;AACrD,YAAM,SAAS,MAAM,YAAY,cAAc,QAAQ,QAAQ,SAAS,CAAC;AAEzE,UAAI,CAAC,OAAO,aAAa;AACvB,cAAM,IAAI,UAAU,sBAAsB;AAAA,MAC5C;AAEA,aAAO;AAAA,IACT,SAAS,OAAO;AACd,aAAO,MAAM,0BAA0B,KAAK;AAC5C,YAAM,IAAI,UAAU,+BAA+B,GAAG;AAAA,IACxD;AAAA,EACF;AAAA;AAQA,IAAM,0BAA0B,CAC9B,cACA,oBACG;AAEH,MAAI,0BAA0B,KAAK,YAAY,GAAG;AAChD,WAAO;AAAA,EACT;AACA,SAAO,IAAI,IAAI,cAAc,eAAe,EAAE;AAChD;AAEA,SAAe,aACb,SACA,QACuB;AAAA;AAzGzB;AA0GE,UAAM,kBAAkB,kBAAkB,MAAM;AAChD,UAAM,uBAAsB,qBAAgB,aAAhB,YAA4B;AACxD,UAAM,iBACJ,IAAI,IAAI,QAAQ,GAAG,EAAE,aAAa,IAAI,UAAU,KAAK;AACvD,UAAM,qBAAqB,0BAA0B,KAAK,cAAc;AACxE,UAAM,mBAAmB;AAAA,MACvB;AAAA,MACA,IAAI,IAAI,QAAQ,GAAG,EAAE;AAAA,IACvB;AAEA,UAAM,WAAWA,cAAa,SAAS,gBAAgB;AACvD,qBAAiB,UAAU,eAAe;AAE1C,QAAI;AACF,qBAAe,qBAAqB,mBAAmB,cAAc;AAAA,IACvE,SAAS,OAAO;AACd,aAAO,KAAK,2CAA2C,KAAK;AAAA,IAC9D;AAEA,WAAO;AAAA,EACT;AAAA;AAEA,IAAM,+BAA+B,CACnC,YACA,SACA,aACuB;AACvB,SAAO,IAAI,6BAA6B,YAAY,SAAS,QAAQ;AACvE;AAcO,IAAM,UACX,CAAC,aAAiB,CAAC,MACnB,CAAO,YAAgD;AACrD,QAAM,SAAS,kBAAkB,UAAU;AAE3C,MAAI;AACF,UAAM,WAAW,QAAQ,QAAQ;AACjC,UAAM,eAAe,SAAS,MAAM,GAAG;AACvC,UAAM,cAAc,aAAa,aAAa,SAAS,CAAC;AAExD,YAAQ,aAAa;AAAA,MACnB,KAAK;AACH,eAAO,MAAM,gBAAgB;AAAA,MAC/B,KAAK;AACH,eAAO,MAAM,eAAe,SAAS,MAAM;AAAA,MAC7C,KAAK;AACH,eAAO,MAAM,aAAa,SAAS,MAAM;AAAA,MAC3C;AACE,cAAM,IAAI,UAAU,uBAAuB,QAAQ,IAAI,GAAG;AAAA,IAC9D;AAAA,EACF,SAAS,OAAO;AACd,WAAO,MAAM,uBAAuB,KAAK;AAEzC,UAAM,SAAS,iBAAiB,YAAY,MAAM,SAAS;AAC3D,UAAM,UACJ,iBAAiB,QAAQ,MAAM,UAAU;AAE3C,UAAM,WAAWA,cAAa,KAAK,EAAE,OAAO,QAAQ,GAAG,EAAE,OAAO,CAAC;AAEjE,qBAAiB,UAAU,MAAM;AACjC,WAAO;AAAA,EACT;AACF;","names":["NextResponse","cookies","cookies","NextResponse"]}

package/dist/react.d.mts

@@ -1,10 +1,20 @@
-import { U as UserContextType, A as AuthContextType } from './index-DvjkKpkk.mjs';
-import { F as ForwardedTokens, C as Config, S as SessionData, b as EmptyObject, U as User, D as DisplayMode } from './types-HdCjGldB.mjs';
-import { O as OAuthTokens } from './types-b4c1koXj.mjs';
-import { ReactNode, RefObject, Dispatch, SetStateAction } from 'react';
+import { JWT } from 'oslo/jwt';
+import { D as DisplayMode, U as User, F as ForwardedTokens, A as AuthSessionService, E as Endpoints, b as UserInfoService, S as SessionData, a as UnknownObject, O as OIDCTokenResponseBody, P as ParsedTokens, C as Config } from './index-DoDoIY_K.mjs';
 import * as react_jsx_runtime from 'react/jsx-runtime';
-import 'oslo/jwt';
-import 'oslo/oauth2';
+import { ReactNode } from 'react';
+import { OAuth2Client } from 'oslo/oauth2';
+
+type AuthContextType = {
+    signIn: (displayMode?: DisplayMode) => Promise<void>;
+    isAuthenticated: boolean;
+    isLoading: boolean;
+    error: Error | null;
+    signOut: () => Promise<void>;
+};
+
+type UserContextType$1<T extends Record<string, unknown> & JWT["payload"] = Record<string, unknown> & JWT["payload"]> = {
+    user: User<T> | null;
+} & Omit<AuthContextType, "isAuthenticated">;
 
 type TokenContextType = {
     accessToken: string | null;
@@ -15,8 +25,45 @@ type TokenContextType = {
     error: Error | null;
 };
 
-interface PKCEConsumer {
-    getCodeChallenge(): Promise<string>;
+declare class AuthSessionServiceImpl implements AuthSessionService {
+    readonly clientId: string;
+    readonly redirectUrl: string;
+    readonly oauthServer: string;
+    readonly inputEndpoints?: Partial<Endpoints> | undefined;
+    private endpoints;
+    private oauth2Client;
+    private userInfoService;
+    private codeVerifier;
+    private refreshTokenTimeout;
+    constructor(clientId: string, redirectUrl: string, oauthServer: string, inputEndpoints?: Partial<Endpoints> | undefined);
+    protected getCodeVerifier(): string;
+    getUserInfoService(): Promise<UserInfoService>;
+    protected getEndpoints(): Promise<Endpoints>;
+    protected getOauth2Client(): Promise<OAuth2Client>;
+    getSessionData(): SessionData;
+    updateSessionData(data: Partial<SessionData>): void;
+    getUser(): User<UnknownObject> | null;
+    setUser(data: User<UnknownObject> | null): void;
+    clearSessionData(): void;
+    getAuthorizationUrlWithChallenge(state: string, scopes: string[]): Promise<URL>;
+    getAuthorizationUrl(scopes: string[], displayMode: DisplayMode, nonce?: string): Promise<string>;
+    loadAuthorizationUrl(authorizationURL: string, displayMode: DisplayMode): void;
+    init(): Promise<this>;
+    logout(): Promise<void>;
+    determineDisplayMode(displayMode: DisplayMode): DisplayMode;
+    signIn(displayMode: DisplayMode, scopes: string[], nonce: string): Promise<void>;
+    tokenExchange(responseUrl: string): Promise<SessionData>;
+    private setupTokenRefresh;
+    refreshToken(): Promise<SessionData>;
+    getUserInfo<T extends UnknownObject>(): Promise<User<T> | null>;
+    /**
+     * Uses the jose library to validate a JWT token using the OAuth JWKS endpoint
+     * @returns {Promise<jose.JWTPayload>}
+     * @throws {Error} if the token is invalid
+     * @param tokens
+     */
+    validateTokens(tokens: OIDCTokenResponseBody): Promise<ParsedTokens>;
+    validateExistingSession(): Promise<SessionData>;
 }
 
 type AuthProviderProps = {
@@ -27,20 +74,23 @@ type AuthProviderProps = {
     config?: Config;
     onSignIn?: (error?: Error) => void;
     onSignOut?: () => void;
-    pkceConsumer?: PKCEConsumer;
-    modalIframe?: boolean;
-    sessionData?: SessionData;
+    authServiceImpl?: AuthSessionServiceImpl;
+    serverSideTokenExchange?: boolean;
 };
 
-type CivicAuthProviderProps = Omit<AuthProviderProps, "pkceConsumer">;
+type CivicAuthProviderProps = Omit<AuthProviderProps, "authServiceImpl" | "serverSideTokenExchange">;
 declare const CivicAuthProvider: ({ children, ...props }: CivicAuthProviderProps) => react_jsx_runtime.JSX.Element;
 
+type UserContextType = {
+    user: User<UnknownObject> | null;
+};
 type NextCivicAuthProviderProps = Omit<AuthProviderProps, "clientId">;
 declare const CivicNextAuthProvider: ({ children, ...props }: NextCivicAuthProviderProps) => react_jsx_runtime.JSX.Element;
+declare const useNextUser: () => UserContextType;
 
-declare const useUser: <T extends Record<string, unknown> = Record<string, never>>() => UserContextType<T>;
+declare const useUser: <T extends Record<string, unknown> = Record<string, never>>() => UserContextType$1<T>;
 
-declare const useUserCookie: <T extends EmptyObject>() => User<T> | null;
+declare const useUserCookie: () => any;
 
 declare const useToken: () => TokenContextType;
 
@@ -48,30 +98,6 @@ declare const useAuth: () => AuthContextType;
 
 declare const useSession: () => SessionData;
 
-type ConfigProviderOutput = {
-    config: Config;
-    redirectUrl: string;
-    modalIframe: boolean;
-    serverTokenExchange: boolean;
-};
-
-declare const useConfig: () => ConfigProviderOutput;
-
-declare const useTokenCookie: (tokenName: OAuthTokens) => string | null;
-
-type IframeProviderOutput = {
-    iframeRef: RefObject<HTMLIFrameElement> | null;
-    setAuthResponseUrl: Dispatch<SetStateAction<string | null>>;
-};
-
-declare const useIframe: () => IframeProviderOutput;
-
-type CivicAuthIframeContainerProps = {
-    onClose?: () => void;
-    closeOnRedirect?: boolean;
-};
-declare const CivicAuthIframeContainer: ({ onClose, closeOnRedirect, }: CivicAuthIframeContainerProps) => react_jsx_runtime.JSX.Element;
-
 declare const UserButton: ({ displayMode, className, }: {
     displayMode?: DisplayMode;
     className?: string;
@@ -90,4 +116,4 @@ declare const NextLogOut: ({ children }: {
     children: ReactNode;
 }) => react_jsx_runtime.JSX.Element;
 
-export { AuthContextType, CivicAuthIframeContainer, CivicAuthProvider, type CivicAuthProviderProps, CivicNextAuthProvider, type NextCivicAuthProviderProps, NextLogOut, SignInButton, SignOutButton, type TokenContextType, UserButton, UserContextType, useAuth, useConfig, useIframe, useSession, useToken, useTokenCookie, useUser, useUserCookie };
+export { type AuthContextType, CivicAuthProvider, CivicNextAuthProvider, NextLogOut, SignInButton, SignOutButton, type TokenContextType, UserButton, type UserContextType$1 as UserContextType, useAuth, useNextUser, useSession, useToken, useUser, useUserCookie };