@civic/auth 0.0.1-beta.30 → 0.0.1-beta.4

package/dist/nextjs.d.mts

@@ -2,52 +2,34 @@ import * as next_dist_shared_lib_image_config from 'next/dist/shared/lib/image-c
 import * as next_dist_lib_load_custom_routes from 'next/dist/lib/load-custom-routes';
 import * as next_dist_server_config_shared from 'next/dist/server/config-shared';
 import { NextConfig } from 'next';
-import { T as TokensCookieConfig, a as CookieConfig, O as OAuthTokens, C as CodeVerifier } from './types-DOfl9w7j.mjs';
-import { U as User, S as SessionData, a as UnknownObject } from './types-BxAubCqO.mjs';
+import { U as User } from './index-DoDoIY_K.mjs';
 import { NextRequest, NextResponse } from 'next/server.js';
-import { NextResponse as NextResponse$1 } from 'next/server';
-import { C as CookieStorage, a as CookieStorageSettings } from './storage-BJyqsZwC.mjs';
 import 'oslo/oauth2';
+import 'oslo/jwt';
 
-type CookiesConfigObject = {
-    tokens: TokensCookieConfig;
-    user: CookieConfig;
-};
+interface CookieConfig {
+    secure?: boolean;
+    sameSite?: "strict" | "lax" | "none";
+    domain?: string;
+    path?: string;
+    maxAge?: number;
+}
 type AuthConfigWithDefaults = {
     clientId: string;
     oauthServer: string;
     callbackUrl: string;
     loginUrl: string;
     logoutUrl: string;
+    appUrl?: string;
     challengeUrl: string;
     include: string[];
     exclude: string[];
-    cookies: CookiesConfigObject;
+    cookies: {
+        tokens: CookieConfig;
+        user: CookieConfig;
+    };
 };
 type AuthConfig = Partial<AuthConfigWithDefaults>;
-type DefinedAuthConfig = AuthConfigWithDefaults;
-/**
- * Default configuration values that will be used if not overridden
- */
-declare const defaultAuthConfig: Omit<AuthConfigWithDefaults, "clientId">;
-/**
- * Resolves the authentication configuration by combining:
- * 1. Default values
- * 2. Environment variables (set internally by the plugin)
- * 3. Explicitly passed configuration
- *
- * Note: Developers should not set _civic_auth_* environment variables directly.
- * Instead, pass configuration to the createCivicAuthPlugin in next.config.js:
- *
- * @example
- * ```js
- * // next.config.js
- * export default createCivicAuthPlugin({
- *   callbackUrl: '/custom/callback',
- * })
- * ```
- */
-declare const resolveAuthConfig: (config?: AuthConfig) => AuthConfigWithDefaults;
 /**
  * Creates a Next.js plugin that handles auth configuration.
  *
@@ -58,7 +40,7 @@ declare const resolveAuthConfig: (config?: AuthConfig) => AuthConfigWithDefaults
  * @example
  * ```js
  * // next.config.js
- * export default createCivicAuthPlugin({
+ * export tefault createCivicAuthPlugin({
  *   clientId: 'my-client-id',
  *   callbackUrl: '/custom/callback',
  *   loginUrl: '/custom/login',
@@ -71,7 +53,7 @@ declare const resolveAuthConfig: (config?: AuthConfig) => AuthConfigWithDefaults
  * The plugin sets internal environment variables that are used by
  * the auth system. These variables should not be set manually.
  */
-declare const createCivicAuthPlugin: (authConfig: AuthConfig & Pick<Required<AuthConfig>, "clientId">) => (nextConfig?: NextConfig) => {
+declare const createCivicAuthPlugin: (clientId: string, authConfig?: AuthConfig) => (nextConfig?: NextConfig) => {
     env: {
         _civic_auth_client_id: string;
         _civic_oauth_server: string;
@@ -79,6 +61,7 @@ declare const createCivicAuthPlugin: (authConfig: AuthConfig & Pick<Required<Aut
         _civic_auth_challenge_url: string;
         _civic_auth_login_url: string;
         _civic_auth_logout_url: string;
+        _civic_auth_app_url: string | undefined;
         _civic_auth_includes: string;
         _civic_auth_excludes: string;
         _civic_auth_cookie_config: string;
@@ -239,29 +222,4 @@ declare function auth(authConfig?: AuthConfig): (middleware: Middleware) => ((re
  */
 declare const handler: (authConfig?: {}) => (request: NextRequest) => Promise<NextResponse>;
 
-/**
- * Creates HTTP-only cookies for authentication tokens
- */
-declare const createTokenCookies: (response: NextResponse$1, sessionData: SessionData, config: AuthConfig) => void;
-/**
- * Creates a client-readable cookie with user info
- */
-declare const createUserInfoCookie: (response: NextResponse$1, user: User<UnknownObject> | null, sessionData: SessionData, config: AuthConfig) => void;
-/**
- * Clears all authentication cookies
- */
-declare const clearAuthCookies: (config: AuthConfig) => Promise<void>;
-type KeySetter = OAuthTokens | CodeVerifier;
-declare class NextjsCookieStorage extends CookieStorage {
-    readonly config: Partial<TokensCookieConfig>;
-    constructor(config?: Partial<TokensCookieConfig>);
-    get(key: string): string | null;
-    set(key: KeySetter, value: string): void;
-}
-declare class NextjsClientStorage extends CookieStorage {
-    constructor(config?: Partial<CookieStorageSettings>);
-    get(key: string): string | null;
-    set(key: string, value: string): void;
-}
-
-export { type AuthConfig, type AuthConfigWithDefaults, type CookiesConfigObject, type DefinedAuthConfig, NextjsClientStorage, NextjsCookieStorage, auth, authMiddleware, clearAuthCookies, createCivicAuthPlugin, createTokenCookies, createUserInfoCookie, defaultAuthConfig, getUser, handler, resolveAuthConfig, withAuth };
+export { auth, authMiddleware, createCivicAuthPlugin, getUser, handler, withAuth };

package/dist/nextjs.d.ts

@@ -2,52 +2,34 @@ import * as next_dist_shared_lib_image_config from 'next/dist/shared/lib/image-c
 import * as next_dist_lib_load_custom_routes from 'next/dist/lib/load-custom-routes';
 import * as next_dist_server_config_shared from 'next/dist/server/config-shared';
 import { NextConfig } from 'next';
-import { T as TokensCookieConfig, a as CookieConfig, O as OAuthTokens, C as CodeVerifier } from './types-DOfl9w7j.js';
-import { U as User, S as SessionData, a as UnknownObject } from './types-BxAubCqO.js';
+import { U as User } from './index-DoDoIY_K.js';
 import { NextRequest, NextResponse } from 'next/server.js';
-import { NextResponse as NextResponse$1 } from 'next/server';
-import { C as CookieStorage, a as CookieStorageSettings } from './storage-ANmRwpZ3.js';
 import 'oslo/oauth2';
+import 'oslo/jwt';
 
-type CookiesConfigObject = {
-    tokens: TokensCookieConfig;
-    user: CookieConfig;
-};
+interface CookieConfig {
+    secure?: boolean;
+    sameSite?: "strict" | "lax" | "none";
+    domain?: string;
+    path?: string;
+    maxAge?: number;
+}
 type AuthConfigWithDefaults = {
     clientId: string;
     oauthServer: string;
     callbackUrl: string;
     loginUrl: string;
     logoutUrl: string;
+    appUrl?: string;
     challengeUrl: string;
     include: string[];
     exclude: string[];
-    cookies: CookiesConfigObject;
+    cookies: {
+        tokens: CookieConfig;
+        user: CookieConfig;
+    };
 };
 type AuthConfig = Partial<AuthConfigWithDefaults>;
-type DefinedAuthConfig = AuthConfigWithDefaults;
-/**
- * Default configuration values that will be used if not overridden
- */
-declare const defaultAuthConfig: Omit<AuthConfigWithDefaults, "clientId">;
-/**
- * Resolves the authentication configuration by combining:
- * 1. Default values
- * 2. Environment variables (set internally by the plugin)
- * 3. Explicitly passed configuration
- *
- * Note: Developers should not set _civic_auth_* environment variables directly.
- * Instead, pass configuration to the createCivicAuthPlugin in next.config.js:
- *
- * @example
- * ```js
- * // next.config.js
- * export default createCivicAuthPlugin({
- *   callbackUrl: '/custom/callback',
- * })
- * ```
- */
-declare const resolveAuthConfig: (config?: AuthConfig) => AuthConfigWithDefaults;
 /**
  * Creates a Next.js plugin that handles auth configuration.
  *
@@ -58,7 +40,7 @@ declare const resolveAuthConfig: (config?: AuthConfig) => AuthConfigWithDefaults
  * @example
  * ```js
  * // next.config.js
- * export default createCivicAuthPlugin({
+ * export tefault createCivicAuthPlugin({
  *   clientId: 'my-client-id',
  *   callbackUrl: '/custom/callback',
  *   loginUrl: '/custom/login',
@@ -71,7 +53,7 @@ declare const resolveAuthConfig: (config?: AuthConfig) => AuthConfigWithDefaults
  * The plugin sets internal environment variables that are used by
  * the auth system. These variables should not be set manually.
  */
-declare const createCivicAuthPlugin: (authConfig: AuthConfig & Pick<Required<AuthConfig>, "clientId">) => (nextConfig?: NextConfig) => {
+declare const createCivicAuthPlugin: (clientId: string, authConfig?: AuthConfig) => (nextConfig?: NextConfig) => {
     env: {
         _civic_auth_client_id: string;
         _civic_oauth_server: string;
@@ -79,6 +61,7 @@ declare const createCivicAuthPlugin: (authConfig: AuthConfig & Pick<Required<Aut
         _civic_auth_challenge_url: string;
         _civic_auth_login_url: string;
         _civic_auth_logout_url: string;
+        _civic_auth_app_url: string | undefined;
         _civic_auth_includes: string;
         _civic_auth_excludes: string;
         _civic_auth_cookie_config: string;
@@ -239,29 +222,4 @@ declare function auth(authConfig?: AuthConfig): (middleware: Middleware) => ((re
  */
 declare const handler: (authConfig?: {}) => (request: NextRequest) => Promise<NextResponse>;
 
-/**
- * Creates HTTP-only cookies for authentication tokens
- */
-declare const createTokenCookies: (response: NextResponse$1, sessionData: SessionData, config: AuthConfig) => void;
-/**
- * Creates a client-readable cookie with user info
- */
-declare const createUserInfoCookie: (response: NextResponse$1, user: User<UnknownObject> | null, sessionData: SessionData, config: AuthConfig) => void;
-/**
- * Clears all authentication cookies
- */
-declare const clearAuthCookies: (config: AuthConfig) => Promise<void>;
-type KeySetter = OAuthTokens | CodeVerifier;
-declare class NextjsCookieStorage extends CookieStorage {
-    readonly config: Partial<TokensCookieConfig>;
-    constructor(config?: Partial<TokensCookieConfig>);
-    get(key: string): string | null;
-    set(key: KeySetter, value: string): void;
-}
-declare class NextjsClientStorage extends CookieStorage {
-    constructor(config?: Partial<CookieStorageSettings>);
-    get(key: string): string | null;
-    set(key: string, value: string): void;
-}
-
-export { type AuthConfig, type AuthConfigWithDefaults, type CookiesConfigObject, type DefinedAuthConfig, NextjsClientStorage, NextjsCookieStorage, auth, authMiddleware, clearAuthCookies, createCivicAuthPlugin, createTokenCookies, createUserInfoCookie, defaultAuthConfig, getUser, handler, resolveAuthConfig, withAuth };
+export { auth, authMiddleware, createCivicAuthPlugin, getUser, handler, withAuth };

package/dist/nextjs.js

@@ -4,43 +4,82 @@
 
 
 
+var _chunkWPISYQG3js = require('./chunk-WPISYQG3.js');
 
 
 
 
 
-var _chunkTH6FI2XIjs = require('./chunk-TH6FI2XI.js');
+var _chunkT47HULF6js = require('./chunk-T47HULF6.js');
 
 
-var _chunkJEOPLLWOjs = require('./chunk-JEOPLLWO.js');
+var _chunkOLT5HB3Gjs = require('./chunk-OLT5HB3G.js');
 
 
 
 
+var _chunkCRTRMMJ7js = require('./chunk-CRTRMMJ7.js');
 
+// src/shared/UserSession.ts
+var GenericUserSession = class {
+  constructor(storage) {
+    this.storage = storage;
+  }
+  get() {
+    const user = this.storage.get("user" /* USER */);
+    return user ? JSON.parse(user) : null;
+  }
+  set(user) {
+    const value = user ? JSON.stringify(user) : "";
+    this.storage.set("user" /* USER */, value);
+  }
+};
 
-
-
-var _chunkAM2Y662Ijs = require('./chunk-AM2Y662I.js');
-
-
-
-
-var _chunkCRTRMMJ7js = require('./chunk-CRTRMMJ7.js');
+// src/nextjs/cookies.ts
+var _headersjs = require('next/headers.js');
+var clearAuthCookies = () => _chunkCRTRMMJ7js.__async.call(void 0, void 0, null, function* () {
+  const cookieStorage = new NextjsCookieStorage();
+  _chunkOLT5HB3Gjs.clearTokens.call(void 0, cookieStorage);
+  const clientStorage = new NextjsClientStorage();
+  const userSession = new GenericUserSession(clientStorage);
+  userSession.set(null);
+});
+var NextjsCookieStorage = class extends _chunkT47HULF6js.CookieStorage {
+  constructor(config = {}) {
+    super(_chunkCRTRMMJ7js.__spreadProps.call(void 0, _chunkCRTRMMJ7js.__spreadValues.call(void 0, {}, config), {
+      secure: true,
+      httpOnly: true
+    }));
+  }
+  get(key) {
+    var _a;
+    return ((_a = _headersjs.cookies.call(void 0, ).get(key)) == null ? void 0 : _a.value) || null;
+  }
+  set(key, value) {
+    _headersjs.cookies.call(void 0, ).set(key, value, this.settings);
+  }
+};
+var NextjsClientStorage = class extends _chunkT47HULF6js.CookieStorage {
+  constructor(config = {}) {
+    super(_chunkCRTRMMJ7js.__spreadProps.call(void 0, _chunkCRTRMMJ7js.__spreadValues.call(void 0, {}, config), {
+      secure: false,
+      httpOnly: false
+    }));
+  }
+  get(key) {
+    var _a;
+    return ((_a = _headersjs.cookies.call(void 0, ).get(key)) == null ? void 0 : _a.value) || null;
+  }
+  set(key, value) {
+    _headersjs.cookies.call(void 0, ).set(key, value, this.settings);
+  }
+};
 
 // src/nextjs/GetUser.ts
 var getUser2 = () => {
-  var _a;
-  const clientStorage = new (0, _chunkTH6FI2XIjs.NextjsClientStorage)();
-  const userSession = new (0, _chunkAM2Y662Ijs.GenericUserSession)(clientStorage);
-  const tokens = _chunkAM2Y662Ijs.retrieveTokens.call(void 0, clientStorage);
-  const user = userSession.get();
-  if (!user || !tokens) return null;
-  return _chunkCRTRMMJ7js.__spreadProps.call(void 0, _chunkCRTRMMJ7js.__spreadValues.call(void 0, {}, user), {
-    idToken: tokens.id_token,
-    accessToken: tokens.access_token,
-    refreshToken: (_a = tokens.refresh_token) != null ? _a : ""
-  });
+  const clientStorage = new NextjsClientStorage();
+  const userSession = new GenericUserSession(clientStorage);
+  return userSession.get();
 };
 
 // src/nextjs/middleware.ts
@@ -60,9 +99,9 @@ var matchesGlobs = (pathname, patterns) => patterns.some((pattern) => {
   return matchGlob(pathname, pattern);
 });
 var applyAuth = (authConfig, request) => _chunkCRTRMMJ7js.__async.call(void 0, void 0, null, function* () {
-  const authConfigWithDefaults = _chunkTH6FI2XIjs.resolveAuthConfig.call(void 0, authConfig);
+  const authConfigWithDefaults = _chunkWPISYQG3js.resolveAuthConfig.call(void 0, authConfig);
   const isAuthenticated = !!request.cookies.get("id_token");
-  if (request.nextUrl.pathname === authConfigWithDefaults.loginUrl && request.method === "GET") {
+  if (request.nextUrl.pathname === authConfigWithDefaults.loginUrl) {
     console.log("\u2192 Skipping auth check - this is the login URL");
     return void 0;
   }
@@ -75,14 +114,14 @@ var applyAuth = (authConfig, request) => _chunkCRTRMMJ7js.__async.call(void 0, v
     return void 0;
   }
   if (!isAuthenticated) {
+    console.log("\u2192 No valid token found - redirecting to login");
     const loginUrl = new URL(authConfigWithDefaults.loginUrl, request.url);
-    console.log("\u2192 No valid token found - redirecting to login", loginUrl);
     return _serverjs.NextResponse.redirect(loginUrl);
   }
   console.log("\u2192 Auth check passed");
   return void 0;
 });
-var authMiddleware = (authConfig = _chunkTH6FI2XIjs.defaultAuthConfig) => (request) => _chunkCRTRMMJ7js.__async.call(void 0, void 0, null, function* () {
+var authMiddleware = (authConfig = _chunkWPISYQG3js.defaultAuthConfig) => (request) => _chunkCRTRMMJ7js.__async.call(void 0, void 0, null, function* () {
   const response = yield applyAuth(authConfig, request);
   if (response) return response;
   return _serverjs.NextResponse.next();
@@ -107,8 +146,7 @@ function auth(authConfig = {}) {
 // src/nextjs/routeHandler.ts
 
 var _cachejs = require('next/cache.js');
-var _headersjs = require('next/headers.js');
-var logger = _chunkTH6FI2XIjs.loggers.nextjs.handlers.auth;
+var logger = _chunkWPISYQG3js.loggers.nextjs.handlers.auth;
 var AuthError = class extends Error {
   constructor(message, status = 401) {
     super(message);
@@ -116,154 +154,61 @@ var AuthError = class extends Error {
     this.name = "AuthError";
   }
 };
-function handleChallenge(request, config) {
+function handleChallenge() {
   return _chunkCRTRMMJ7js.__async.call(void 0, this, null, function* () {
-    var _a, _b;
-    const cookieStorage = new (0, _chunkTH6FI2XIjs.NextjsCookieStorage)((_b = (_a = config.cookies) == null ? void 0 : _a.tokens) != null ? _b : {});
-    const pkceProducer = new (0, _chunkAM2Y662Ijs.GenericPublicClientPKCEProducer)(cookieStorage);
+    const cookieStorage = new NextjsCookieStorage();
+    const pkceProducer = new (0, _chunkT47HULF6js.GenericPublicClientPKCEProducer)(cookieStorage);
     const challenge = yield pkceProducer.getCodeChallenge();
-    const appUrl = request.nextUrl.searchParams.get("appUrl");
-    if (appUrl) {
-      cookieStorage.set("app_url" /* APP_URL */, appUrl);
-    }
     return _serverjs.NextResponse.json({ status: "success", challenge });
   });
 }
-function performTokenExchangeAndSetCookies(request, config, code, state, appUrl) {
+function handleCallback(request, config) {
   return _chunkCRTRMMJ7js.__async.call(void 0, this, null, function* () {
-    const resolvedConfigs = _chunkTH6FI2XIjs.resolveAuthConfig.call(void 0, config);
-    const cookieStorage = new (0, _chunkTH6FI2XIjs.NextjsCookieStorage)(resolvedConfigs.cookies.tokens);
-    const callbackUrl = _chunkTH6FI2XIjs.resolveCallbackUrl.call(void 0, resolvedConfigs, appUrl);
+    const code = request.nextUrl.searchParams.get("code");
+    const state = request.nextUrl.searchParams.get("state");
+    if (!code || !state) throw new AuthError("Bad parameters", 400);
+    const cookieStorage = new NextjsCookieStorage();
+    const resolvedConfigs = _chunkWPISYQG3js.resolveAuthConfig.call(void 0, config);
+    const callbackUrl = _chunkWPISYQG3js.resolveCallbackUrl.call(void 0, resolvedConfigs, request.url);
     try {
-      yield _chunkJEOPLLWOjs.resolveOAuthAccessCode.call(void 0, code, state, cookieStorage, _chunkCRTRMMJ7js.__spreadProps.call(void 0, _chunkCRTRMMJ7js.__spreadValues.call(void 0, {}, resolvedConfigs), {
+      yield _chunkT47HULF6js.resolveOAuthAccessCode.call(void 0, code, state, cookieStorage, _chunkCRTRMMJ7js.__spreadProps.call(void 0, _chunkCRTRMMJ7js.__spreadValues.call(void 0, {}, resolvedConfigs), {
         redirectUrl: callbackUrl
       }));
     } catch (error) {
       logger.error("Token exchange failed:", error);
       throw new AuthError("Failed to authenticate user", 401);
     }
-    const user = yield _chunkAM2Y662Ijs.getUser.call(void 0, cookieStorage);
+    const user = yield _chunkT47HULF6js.getUser.call(void 0, cookieStorage);
     if (!user) {
       throw new AuthError("Failed to get user info", 401);
     }
-    const clientStorage = new (0, _chunkTH6FI2XIjs.NextjsClientStorage)();
-    const userSession = new (0, _chunkAM2Y662Ijs.GenericUserSession)(clientStorage);
+    const clientStorage = new NextjsClientStorage();
+    const userSession = new GenericUserSession(clientStorage);
     userSession.set(user);
-  });
-}
-function handleCallback(request, config) {
-  return _chunkCRTRMMJ7js.__async.call(void 0, this, null, function* () {
-    var _a;
-    const resolvedConfigs = _chunkTH6FI2XIjs.resolveAuthConfig.call(void 0, config);
-    console.log("handleCallback", { request, resolvedConfigs });
-    const code = request.nextUrl.searchParams.get("code");
-    const state = request.nextUrl.searchParams.get("state") || "";
-    if (!code || !state) throw new AuthError("Bad parameters", 400);
-    const appUrl = ((_a = request.cookies.get("app_url" /* APP_URL */)) == null ? void 0 : _a.value) || request.nextUrl.searchParams.get("appUrl");
-    console.log("handleCallback", {
-      code,
-      state,
-      cookies: _headersjs.cookies.call(void 0, ),
-      appUrl
-    });
-    const codeVerifier = request.cookies.get("code_verifier" /* COOKIE_NAME */);
-    if (!codeVerifier || !appUrl) {
-      console.log("handleCallback no code_verifier found", {
-        state,
-        serverTokenExchange: _chunkAM2Y662Ijs.serverTokenExchangeFromState.call(void 0, `${state}`)
-      });
-      let response2 = new (0, _serverjs.NextResponse)(
-        `<html><body><span style="display:none">${_chunkAM2Y662Ijs.TOKEN_EXCHANGE_TRIGGER_TEXT}</span></body></html>`
-      );
-      if (state && _chunkAM2Y662Ijs.serverTokenExchangeFromState.call(void 0, state)) {
-        console.log(
-          "handleCallback serverTokenExchangeFromState, launching redirect page...",
-          {
-            requestUrl: request.url,
-            configCallbackUrl: resolvedConfigs.callbackUrl
-          }
-        );
-        const requestUrl = new URL(request.url);
-        const fetchUrl = `${resolvedConfigs.callbackUrl}?${requestUrl.searchParams.toString()}&sameDomainServerTokenExchange=true`;
-        response2 = new (0, _serverjs.NextResponse)(
-          `<html>
-            <body>
-                <span style="display:none">
-                    <script>
-                        window.onload = function () {
-                            const appUrl = globalThis.window?.location?.origin;
-                            fetch('${fetchUrl}&appUrl=' + appUrl).then((response) => {
-                                response.json().then((jsonResponse) => {
-                                    console.log('fetch jsonResponse', jsonResponse);
-                                    if (jsonResponse.redirectUrl) {
-                                        console.log('handleCallback serverTokenExchangeFromState, redirecting');
-                                        window.location.href = jsonResponse.redirectUrl;
-                                    }
-                                });
-                            });
-                        };
-                    </script>
-                </span>
-            </body>
-        </html>
-        `
-        );
-      }
-      response2.headers.set("Content-Type", "text/html; charset=utf-8");
-      console.log(
-        `handleCallback no code_verifier found, returning ${_chunkAM2Y662Ijs.TOKEN_EXCHANGE_TRIGGER_TEXT}`
-      );
-      return response2;
-    }
-    yield performTokenExchangeAndSetCookies(
-      request,
-      resolvedConfigs,
-      code,
-      state,
-      appUrl
-    );
-    if (request.url.includes("sameDomainServerTokenExchange=true")) {
-      console.log(
-        "handleCallback sameDomainServerTokenExchange = true, returnining redirectUrl",
-        appUrl
-      );
-      return _serverjs.NextResponse.json({
-        status: "success",
-        redirectUrl: appUrl
-      });
-    }
-    if (_chunkAM2Y662Ijs.serverTokenExchangeFromState.call(void 0, state)) {
-      console.log(
-        "handleCallback serverTokenExchangeFromState, redirect to appUrl",
-        appUrl
-      );
-      if (!appUrl) {
-        throw new Error("appUrl undefined. Cannot redirect.");
-      }
-      return _serverjs.NextResponse.redirect(`${appUrl}`);
-    }
-    const response = new (0, _serverjs.NextResponse)(
-      `<html><span style="display:none">${_chunkAM2Y662Ijs.TOKEN_EXCHANGE_SUCCESS_TEXT}</span></html>`
-    );
+    const response = new (0, _serverjs.NextResponse)(`<html></html>`);
     response.headers.set("Content-Type", "text/html; charset=utf-8");
     return response;
   });
 }
-var getAbsoluteRedirectPath = (redirectPath, currentBasePath) => new URL(redirectPath, currentBasePath).href;
+var getAbsoluteRedirectPath = (redirectPath, currentBasePath) => {
+  if (/^(https?:\/\/|www\.).+/i.test(redirectPath)) {
+    return redirectPath;
+  }
+  return new URL(redirectPath, currentBasePath).href;
+};
 function handleLogout(request, config) {
   return _chunkCRTRMMJ7js.__async.call(void 0, this, null, function* () {
     var _a;
-    const resolvedConfigs = _chunkTH6FI2XIjs.resolveAuthConfig.call(void 0, config);
+    const resolvedConfigs = _chunkWPISYQG3js.resolveAuthConfig.call(void 0, config);
     const defaultRedirectPath = (_a = resolvedConfigs.loginUrl) != null ? _a : "/";
     const redirectTarget = new URL(request.url).searchParams.get("redirect") || defaultRedirectPath;
     const isAbsoluteRedirect = /^(https?:\/\/|www\.).+/i.test(redirectTarget);
-    const appUrl = request.nextUrl.searchParams.get("appUrl");
-    const finalRedirectUrl = isAbsoluteRedirect ? redirectTarget : getAbsoluteRedirectPath(
+    const finalRedirectUrl = getAbsoluteRedirectPath(
       redirectTarget,
-      new URL(appUrl != null ? appUrl : request.url).origin
+      new URL(request.url).origin
     );
     const response = _serverjs.NextResponse.redirect(finalRedirectUrl);
-    _chunkTH6FI2XIjs.clearAuthCookies.call(void 0, config);
+    clearAuthCookies();
     try {
       _cachejs.revalidatePath.call(void 0, isAbsoluteRedirect ? finalRedirectUrl : redirectTarget);
     } catch (error) {
@@ -273,14 +218,14 @@ function handleLogout(request, config) {
   });
 }
 var handler = (authConfig = {}) => (request) => _chunkCRTRMMJ7js.__async.call(void 0, void 0, null, function* () {
-  const config = _chunkTH6FI2XIjs.resolveAuthConfig.call(void 0, authConfig);
+  const config = _chunkWPISYQG3js.resolveAuthConfig.call(void 0, authConfig);
   try {
     const pathname = request.nextUrl.pathname;
     const pathSegments = pathname.split("/");
     const lastSegment = pathSegments[pathSegments.length - 1];
     switch (lastSegment) {
       case "challenge":
-        return yield handleChallenge(request, config);
+        return yield handleChallenge();
       case "callback":
         return yield handleCallback(request, config);
       case "logout":
@@ -293,7 +238,7 @@ var handler = (authConfig = {}) => (request) => _chunkCRTRMMJ7js.__async.call(vo
     const status = error instanceof AuthError ? error.status : 500;
     const message = error instanceof Error ? error.message : "Authentication failed";
     const response = _serverjs.NextResponse.json({ error: message }, { status });
-    _chunkTH6FI2XIjs.clearAuthCookies.call(void 0, config);
+    clearAuthCookies();
     return response;
   }
 });
@@ -304,12 +249,5 @@ var handler = (authConfig = {}) => (request) => _chunkCRTRMMJ7js.__async.call(vo
 
 
 
-
-
-
-
-
-
-
-exports.NextjsClientStorage = _chunkTH6FI2XIjs.NextjsClientStorage; exports.NextjsCookieStorage = _chunkTH6FI2XIjs.NextjsCookieStorage; exports.auth = auth; exports.authMiddleware = authMiddleware; exports.clearAuthCookies = _chunkTH6FI2XIjs.clearAuthCookies; exports.createCivicAuthPlugin = _chunkTH6FI2XIjs.createCivicAuthPlugin; exports.createTokenCookies = _chunkTH6FI2XIjs.createTokenCookies; exports.createUserInfoCookie = _chunkTH6FI2XIjs.createUserInfoCookie; exports.defaultAuthConfig = _chunkTH6FI2XIjs.defaultAuthConfig; exports.getUser = getUser2; exports.handler = handler; exports.resolveAuthConfig = _chunkTH6FI2XIjs.resolveAuthConfig; exports.withAuth = withAuth;
+exports.auth = auth; exports.authMiddleware = authMiddleware; exports.createCivicAuthPlugin = _chunkWPISYQG3js.createCivicAuthPlugin; exports.getUser = getUser2; exports.handler = handler; exports.withAuth = withAuth;
 //# sourceMappingURL=nextjs.js.map