@civic/auth 0.11.9 → 0.13.0-beta.0

package/CHANGELOG.md

@@ -1,7 +1,12 @@
+# 0.13.0 - Support deep-linking
+- support deep-linking with RETURN_URL cookie mechanism
+
+# 0.12.0 - Remove unused redirect parameters from NextJS provider interface
+- Remove unused redirectOnLogin and redirectOnLogout parameters
+
 # 0.11.9 - Fix NextJS logout race condition
 - fix a race condition in NextJS logout to clear cookies immediately using a new 'clearsession' route handler
 
-
 # 0.11.8 - Comprehensive loading states and UX improvements
 - Added loading states to all auth buttons (SignInButton, SignOutButton, UserButton) with consistent visual feedback
 - Fixed logout flickering by showing "Logging out..." state and preventing premature transition to "Log in"

package/dist/nextjs/config.d.ts

@@ -2,6 +2,17 @@ import type { NextConfig } from "next";
 import { type CookieConfig, type TokensCookieConfig } from "../shared/lib/types.js";
 import { type CookiesConfigObject } from "../shared/lib/cookieConfig.js";
 export type { CookiesConfigObject };
+/**
+ * Controls how deep links (original URLs) are handled after authentication.
+ *
+ * - `"fullUrl"`: Redirect to the original URL the user tried to access.
+ *   `loginSuccessUrl` is used as fallback only when no deep link exists.
+ * - `"queryParamsOnly"`: Redirect to `loginSuccessUrl`, but merge query params from original URL.
+ * - `"disabled"`: No deep link preservation. Always use `loginSuccessUrl`.
+ *
+ * @default "fullUrl"
+ */
+export type DeepLinkHandling = "fullUrl" | "queryParamsOnly" | "disabled";
 export declare const systemUrlsConfig: {
     callbackUrl: {
         defaultPath: string;
@@ -57,6 +68,12 @@ export type AuthConfigWithDefaults = {
     autoRedirect: boolean;
     disableRefresh?: boolean;
     targetContainerElement?: HTMLElement | string;
+    /**
+     * Controls how deep links (original URLs) are handled after authentication.
+     * @see DeepLinkHandling
+     * @default "fullUrl"
+     */
+    deepLinkHandling: DeepLinkHandling;
 };
 /**
  * All possible config values for Civic Auth
@@ -85,6 +102,7 @@ export type OptionalAuthConfig = Partial<AuthConfigWithDefaults | {
     autoRedirect?: boolean;
     disableRefresh?: boolean;
     targetContainerElement?: HTMLElement | string;
+    deepLinkHandling?: DeepLinkHandling;
 };
 /**
  * Configuration values for Civic Auth.
@@ -178,6 +196,7 @@ export declare const createCivicAuthPlugin: (authConfig: AuthConfig) => (nextCon
         _civic_auth_base_url: string | undefined;
         _civic_auth_auto_redirect: string;
         _civic_auth_disable_refresh: string | undefined;
+        _civic_auth_deep_link_handling: DeepLinkHandling;
     };
     allowedDevOrigins?: string[];
     exportPathMap?: (defaultMap: import("next/dist/server/config-shared.js").ExportPathMap, ctx: {

package/dist/nextjs/config.d.ts.map

@@ -1 +1 @@
-{"version":3,"file":"config.d.ts","sourceRoot":"","sources":["../../src/nextjs/config.ts"],"names":[],"mappings":"AACA,OAAO,KAAK,EAAE,UAAU,EAAE,MAAM,MAAM,CAAC;AAGvC,OAAO,EACL,KAAK,YAAY,EACjB,KAAK,kBAAkB,EACxB,MAAM,uBAAuB,CAAC;AAI/B,OAAO,EAEL,KAAK,mBAAmB,EACzB,MAAM,8BAA8B,CAAC;AAGtC,YAAY,EAAE,mBAAmB,EAAE,CAAC;AAcpC,eAAO,MAAM,gBAAgB;;;;;;;;;;;;;;;;;;;;;;;;;;;;;CAW5B,CAAC;AAgBF;;;GAGG;AACH,MAAM,MAAM,sBAAsB,GAAG;IACnC,QAAQ,EAAE,MAAM,CAAC;IACjB,WAAW,EAAE,MAAM,CAAC;IAEpB,WAAW,EAAE,MAAM,CAAC;IACpB,YAAY,EAAE,MAAM,CAAC;IACrB,SAAS,EAAE,MAAM,CAAC;IAClB,YAAY,EAAE,MAAM,CAAC;IACrB,UAAU,EAAE,MAAM,CAAC;IACnB,OAAO,EAAE,MAAM,CAAC;IAChB,eAAe,EAAE,MAAM,CAAC;IAExB,eAAe,CAAC,EAAE,MAAM,CAAC;IAIzB,QAAQ,EAAE,MAAM,CAAC;IACjB,iBAAiB,EAAE,MAAM,CAAC;IAC1B,OAAO,EAAE,MAAM,EAAE,CAAC;IAClB,OAAO,EAAE,MAAM,EAAE,CAAC;IAClB,OAAO,EAAE,mBAAmB,CAAC;IAC7B,QAAQ,CAAC,EAAE,MAAM,CAAC;IAClB,OAAO,CAAC,EAAE,MAAM,CAAC;IACjB,YAAY,EAAE,OAAO,CAAC;IACtB,cAAc,CAAC,EAAE,OAAO,CAAC;IACzB,sBAAsB,CAAC,EAAE,WAAW,GAAG,MAAM,CAAC;CAC/C,CAAC;AAEF;;GAEG;AACH,MAAM,MAAM,kBAAkB,GAAG,OAAO,CACpC,sBAAsB,GACtB;IACE,OAAO,CAAC,EAAE;QACR,MAAM,CAAC,EAAE,OAAO,CAAC,kBAAkB,CAAC,CAAC;QACrC,IAAI,CAAC,EAAE,YAAY,CAAC;KACrB,CAAC;CACH,CACJ,GAAG;IAGF,WAAW,CAAC,EAAE,MAAM,CAAC;IACrB,eAAe,CAAC,EAAE,MAAM,CAAC;IACzB,QAAQ,CAAC,EAAE,MAAM,CAAC;IAClB,YAAY,CAAC,EAAE,MAAM,CAAC;IACtB,SAAS,CAAC,EAAE,MAAM,CAAC;IACnB,iBAAiB,CAAC,EAAE,MAAM,CAAC;IAC3B,YAAY,CAAC,EAAE,MAAM,CAAC;IACtB,UAAU,CAAC,EAAE,MAAM,CAAC;IACpB,OAAO,CAAC,EAAE,MAAM,CAAC;IACjB,eAAe,CAAC,EAAE,MAAM,CAAC;IACzB,OAAO,CAAC,EAAE,MAAM,EAAE,CAAC;IACnB,OAAO,CAAC,EAAE,MAAM,EAAE,CAAC;IACnB,QAAQ,CAAC,EAAE,MAAM,CAAC;IAClB,OAAO,CAAC,EAAE,MAAM,CAAC;IACjB,WAAW,CAAC,EAAE,MAAM,CAAC;IACrB,YAAY,CAAC,EAAE,OAAO,CAAC;IACvB,cAAc,CAAC,EAAE,OAAO,CAAC;IACzB,sBAAsB,CAAC,EAAE,WAAW,GAAG,MAAM,CAAC;CAC/C,CAAC;AAEF;;;GAGG;AACH,MAAM,MAAM,UAAU,GAAG,kBAAkB,GAAG;IAC5C,QAAQ,EAAE,MAAM,CAAC;IACjB,OAAO,CAAC,EAAE,MAAM,EAAE,CAAC;CACpB,CAAC;AAEF;;GAEG;AACH,eAAO,MAAM,iBAAiB,EAAE,IAAI,CAAC,sBAAsB,EAAE,UAAU,CAsBtE,CAAC;AAEF;;;;;;;;;;;;;;;;;;;GAmBG;AACH,eAAO,MAAM,iBAAiB,YACpB,OAAO,CAAC,UAAU,CAAC,KAC1B,sBA2EF,CAAC;AAkCF;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;GAqCG;AACH,eAAO,MAAM,qBAAqB,eAAgB,UAAU,mBACrC,UAAU;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;qBA+C+qP,CAAC;6BAAsG,CAAC;;;sBAAke,CAAC;yBAA4H,CAAC;;;qBAA+H,CAAC;;;;;;;;;;;;;;;;;;iBAA8pE,CAAC;;;;;;;6BAAg6C,CAAC;sBAAoC,CAAC;;aAAoC,CAAC;;6BAA0D,CAAC;oBAA8B,CAAC;0BAAkE,CAAC;;qBAA2C,CAAC;mBAAiC,CAAC;;wBAA+C,CAAC;eAAmD,CAAC;iBAA4C,CAAC;2BAAyC,CAAC;;;;;;;;;yBAA4zC,CAAC;6BAAwC,CAAC;;;eAAkD,CAAC;mBAAuB,CAAC;;;;CADx/b,CAAC"}
+{"version":3,"file":"config.d.ts","sourceRoot":"","sources":["../../src/nextjs/config.ts"],"names":[],"mappings":"AACA,OAAO,KAAK,EAAE,UAAU,EAAE,MAAM,MAAM,CAAC;AAGvC,OAAO,EACL,KAAK,YAAY,EACjB,KAAK,kBAAkB,EACxB,MAAM,uBAAuB,CAAC;AAI/B,OAAO,EAEL,KAAK,mBAAmB,EACzB,MAAM,8BAA8B,CAAC;AAGtC,YAAY,EAAE,mBAAmB,EAAE,CAAC;AAIpC;;;;;;;;;GASG;AACH,MAAM,MAAM,gBAAgB,GAAG,SAAS,GAAG,iBAAiB,GAAG,UAAU,CAAC;AAY1E,eAAO,MAAM,gBAAgB;;;;;;;;;;;;;;;;;;;;;;;;;;;;;CAW5B,CAAC;AAgBF;;;GAGG;AACH,MAAM,MAAM,sBAAsB,GAAG;IACnC,QAAQ,EAAE,MAAM,CAAC;IACjB,WAAW,EAAE,MAAM,CAAC;IAEpB,WAAW,EAAE,MAAM,CAAC;IACpB,YAAY,EAAE,MAAM,CAAC;IACrB,SAAS,EAAE,MAAM,CAAC;IAClB,YAAY,EAAE,MAAM,CAAC;IACrB,UAAU,EAAE,MAAM,CAAC;IACnB,OAAO,EAAE,MAAM,CAAC;IAChB,eAAe,EAAE,MAAM,CAAC;IAExB,eAAe,CAAC,EAAE,MAAM,CAAC;IAIzB,QAAQ,EAAE,MAAM,CAAC;IACjB,iBAAiB,EAAE,MAAM,CAAC;IAC1B,OAAO,EAAE,MAAM,EAAE,CAAC;IAClB,OAAO,EAAE,MAAM,EAAE,CAAC;IAClB,OAAO,EAAE,mBAAmB,CAAC;IAC7B,QAAQ,CAAC,EAAE,MAAM,CAAC;IAClB,OAAO,CAAC,EAAE,MAAM,CAAC;IACjB,YAAY,EAAE,OAAO,CAAC;IACtB,cAAc,CAAC,EAAE,OAAO,CAAC;IACzB,sBAAsB,CAAC,EAAE,WAAW,GAAG,MAAM,CAAC;IAC9C;;;;OAIG;IACH,gBAAgB,EAAE,gBAAgB,CAAC;CACpC,CAAC;AAEF;;GAEG;AACH,MAAM,MAAM,kBAAkB,GAAG,OAAO,CACpC,sBAAsB,GACtB;IACE,OAAO,CAAC,EAAE;QACR,MAAM,CAAC,EAAE,OAAO,CAAC,kBAAkB,CAAC,CAAC;QACrC,IAAI,CAAC,EAAE,YAAY,CAAC;KACrB,CAAC;CACH,CACJ,GAAG;IAGF,WAAW,CAAC,EAAE,MAAM,CAAC;IACrB,eAAe,CAAC,EAAE,MAAM,CAAC;IACzB,QAAQ,CAAC,EAAE,MAAM,CAAC;IAClB,YAAY,CAAC,EAAE,MAAM,CAAC;IACtB,SAAS,CAAC,EAAE,MAAM,CAAC;IACnB,iBAAiB,CAAC,EAAE,MAAM,CAAC;IAC3B,YAAY,CAAC,EAAE,MAAM,CAAC;IACtB,UAAU,CAAC,EAAE,MAAM,CAAC;IACpB,OAAO,CAAC,EAAE,MAAM,CAAC;IACjB,eAAe,CAAC,EAAE,MAAM,CAAC;IACzB,OAAO,CAAC,EAAE,MAAM,EAAE,CAAC;IACnB,OAAO,CAAC,EAAE,MAAM,EAAE,CAAC;IACnB,QAAQ,CAAC,EAAE,MAAM,CAAC;IAClB,OAAO,CAAC,EAAE,MAAM,CAAC;IACjB,WAAW,CAAC,EAAE,MAAM,CAAC;IACrB,YAAY,CAAC,EAAE,OAAO,CAAC;IACvB,cAAc,CAAC,EAAE,OAAO,CAAC;IACzB,sBAAsB,CAAC,EAAE,WAAW,GAAG,MAAM,CAAC;IAC9C,gBAAgB,CAAC,EAAE,gBAAgB,CAAC;CACrC,CAAC;AAEF;;;GAGG;AACH,MAAM,MAAM,UAAU,GAAG,kBAAkB,GAAG;IAC5C,QAAQ,EAAE,MAAM,CAAC;IACjB,OAAO,CAAC,EAAE,MAAM,EAAE,CAAC;CACpB,CAAC;AAEF;;GAEG;AACH,eAAO,MAAM,iBAAiB,EAAE,IAAI,CAAC,sBAAsB,EAAE,UAAU,CAuBtE,CAAC;AAEF;;;;;;;;;;;;;;;;;;;GAmBG;AACH,eAAO,MAAM,iBAAiB,YACpB,OAAO,CAAC,UAAU,CAAC,KAC1B,sBAgFF,CAAC;AAkCF;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;GAqCG;AACH,eAAO,MAAM,qBAAqB,eAAgB,UAAU,mBACrC,UAAU;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;qBAgDklN,CAAC;6BAAsG,CAAC;;;sBAAke,CAAC;yBAA4H,CAAC;;;qBAA+H,CAAC;;;;;;;;;;;;;;;;;;iBAA8pE,CAAC;;;;;;;6BAAg6C,CAAC;sBAAoC,CAAC;;aAAoC,CAAC;;6BAA0D,CAAC;oBAA8B,CAAC;0BAAkE,CAAC;;qBAA2C,CAAC;mBAAiC,CAAC;;wBAA+C,CAAC;eAAmD,CAAC;iBAA4C,CAAC;2BAAyC,CAAC;;;;;;;;;yBAA4zC,CAAC;6BAAwC,CAAC;;;eAAkD,CAAC;mBAAuB,CAAC;;;;CAD35Z,CAAC"}

package/dist/nextjs/config.js

@@ -53,6 +53,7 @@ export const defaultAuthConfig = {
     baseUrl: undefined, // No default - will use request.nextUrl.origin when undefined
     autoRedirect: true, // Default to current behavior
     cookies: createNextJSCookieConfig(),
+    deepLinkHandling: "fullUrl", // Default to full deep link preservation
 };
 /**
  * Resolves the authentication configuration by combining:
@@ -103,6 +104,9 @@ export const resolveAuthConfig = (config = {}) => {
         autoRedirect: process.env._civic_auth_auto_redirect === "false" ? false : undefined,
         disableRefresh: process.env._civic_auth_disable_refresh === "true" ? true : undefined,
         targetContainerElement: process.env._civic_auth_target_container_element,
+        deepLinkHandling: (["fullUrl", "queryParamsOnly", "disabled"].includes(process.env._civic_auth_deep_link_handling || "")
+            ? process.env._civic_auth_deep_link_handling
+            : undefined),
     });
     // Ensure "/api/auth/**" is always excluded
     const finalExclude = new Set([
@@ -227,6 +231,7 @@ export const createCivicAuthPlugin = (authConfig) => {
                 _civic_auth_base_url: resolvedConfig.baseUrl,
                 _civic_auth_auto_redirect: resolvedConfig.autoRedirect.toString(),
                 _civic_auth_disable_refresh: resolvedConfig.disableRefresh?.toString(),
+                _civic_auth_deep_link_handling: resolvedConfig.deepLinkHandling,
             },
         };
     };

package/dist/nextjs/config.js.map

@@ -1 +1 @@
-{"version":3,"file":"config.js","sourceRoot":"","sources":["../../src/nextjs/config.ts"],"names":[],"mappings":"AAEA,OAAO,EAAE,OAAO,EAAE,MAAM,iBAAiB,CAAC;AAC1C,OAAO,EAAE,gBAAgB,EAAE,MAAM,YAAY,CAAC;AAC9C,OAAO,EAGN,MAAM,uBAAuB,CAAC;AAC/B,OAAO,EAAE,mBAAmB,EAAE,MAAM,gBAAgB,CAAC;AACrD,OAAO,EAAE,KAAK,EAAE,MAAM,cAAc,CAAC;AACrC,OAAO,EAAE,gBAAgB,EAAE,MAAM,YAAY,CAAC;AAC9C,OAAO,EACL,wBAAwB,GAEzB,MAAM,8BAA8B,CAAC;AAKtC,MAAM,MAAM,GAAG,OAAO,CAAC,MAAM,CAAC,QAAQ,CAAC,IAAI,CAAC;AAY5C,MAAM,CAAC,MAAM,gBAAgB,GAAG;IAC9B,WAAW,EAAE,EAAE,WAAW,EAAE,oBAAoB,EAAE,aAAa,EAAE,IAAI,EAAE;IACvE,YAAY,EAAE,EAAE,WAAW,EAAE,qBAAqB,EAAE,aAAa,EAAE,IAAI,EAAE;IACzE,UAAU,EAAE,EAAE,WAAW,EAAE,mBAAmB,EAAE,aAAa,EAAE,IAAI,EAAE;IACrE,SAAS,EAAE,EAAE,WAAW,EAAE,kBAAkB,EAAE,aAAa,EAAE,IAAI,EAAE;IACnE,YAAY,EAAE,EAAE,WAAW,EAAE,iBAAiB,EAAE,aAAa,EAAE,IAAI,EAAE;IACrE,OAAO,EAAE,EAAE,WAAW,EAAE,gBAAgB,EAAE,aAAa,EAAE,IAAI,EAAE;IAC/D,eAAe,EAAE;QACf,WAAW,EAAE,wBAAwB;QACrC,aAAa,EAAE,IAAI;KACpB;CACF,CAAC;AACF,MAAM,UAAU,GAAmC;IACjD,GAAG,gBAAgB;IACnB,iBAAiB,EAAE;QACjB,WAAW,EAAE,EAAE;QACf,aAAa,EAAE,IAAI;QACnB,eAAe,EAAE,IAAI;KACtB;IACD,QAAQ,EAAE;QACR,WAAW,EAAE,EAAE;QACf,aAAa,EAAE,IAAI;QACnB,eAAe,EAAE,IAAI;QACrB,UAAU,EAAE,IAAI;KACjB;CACF,CAAC;AA6EF;;GAEG;AACH,MAAM,CAAC,MAAM,iBAAiB,GAA6C;IACzE,WAAW,EAAE,mBAAmB;IAChC,sBAAsB;IACtB,4DAA4D;IAC5D,GAAI,MAAM,CAAC,WAAW,CACpB,MAAM,CAAC,OAAO,CAAC,gBAAgB,CAAC,CAAC,GAAG,CAAC,CAAC,CAAC,GAAG,EAAE,KAAK,CAAC,EAAE,EAAE,CAAC;QACrD,GAAG;QACH,KAAK,CAAC,WAAW;KAClB,CAAC,CAGF;IACF,qBAAqB;IACrB,eAAe,EAAE,SAAS,EAAE,mDAAmD;IAC/E,QAAQ,EAAE,GAAG;IACb,iBAAiB,EAAE,GAAG;IACtB,OAAO,EAAE,CAAC,KAAK,CAAC;IAChB,OAAO,EAAE,CAAC,cAAc,CAAC;IACzB,QAAQ,EAAE,EAAE;IACZ,OAAO,EAAE,SAAS,EAAE,8DAA8D;IAClF,YAAY,EAAE,IAAI,EAAE,8BAA8B;IAClD,OAAO,EAAE,wBAAwB,EAAE;CACpC,CAAC;AAEF;;;;;;;;;;;;;;;;;;;GAmBG;AACH,MAAM,CAAC,MAAM,iBAAiB,GAAG,CAC/B,SAA8B,EAAE,EACR,EAAE;IAC1B,0EAA0E;IAC1E,kEAAkE;IAClE,MAAM,kBAAkB,GAAG,MAAM,CAAC,OAAO,CAAC;IAE1C,MAAM,aAAa,GAAG,gBAAgB,CAAC;QACrC,QAAQ,EAAE,OAAO,CAAC,GAAG,CAAC,qBAAqB;QAC3C,WAAW,EAAE,OAAO,CAAC,GAAG,CAAC,mBAAmB;QAC5C,WAAW,EAAE,OAAO,CAAC,GAAG,CAAC,wBAAwB;QACjD,eAAe,EAAE,OAAO,CAAC,GAAG,CAAC,6BAA6B;QAC1D,YAAY,EAAE,OAAO,CAAC,GAAG,CAAC,yBAAyB;QACnD,QAAQ,EAAE,OAAO,CAAC,GAAG,CAAC,qBAAqB;QAC3C,YAAY,EAAE,OAAO,CAAC,GAAG,CAAC,0BAA0B;QACpD,SAAS,EAAE,OAAO,CAAC,GAAG,CAAC,sBAAsB;QAC7C,iBAAiB,EAAE,OAAO,CAAC,GAAG,CAAC,+BAA+B;QAC9D,UAAU,EAAE,OAAO,CAAC,GAAG,CAAC,uBAAuB;QAC/C,OAAO,EAAE,OAAO,CAAC,GAAG,CAAC,oBAAoB;QACzC,eAAe,EAAE,OAAO,CAAC,GAAG,CAAC,6BAA6B;QAC1D,OAAO,EAAE,OAAO,CAAC,GAAG,CAAC,oBAAoB,EAAE,KAAK,CAAC,GAAG,CAAC;QACrD,OAAO,EAAE,OAAO,CAAC,GAAG,CAAC,oBAAoB,EAAE,KAAK,CAAC,GAAG,CAAC;QACrD,OAAO,EAAE,kBAAkB;YACzB,CAAC,CAAC,SAAS;YACX,CAAC,CAAC,OAAO,CAAC,GAAG,CAAC,yBAAyB;gBACrC,CAAC,CAAC,IAAI,CAAC,KAAK,CAAC,OAAO,CAAC,GAAG,CAAC,yBAAyB,CAAC;gBACnD,CAAC,CAAC,SAAS;QACf,QAAQ,EAAE,OAAO,CAAC,GAAG,CAAC,qBAAqB,IAAI,EAAE;QACjD,OAAO,EAAE,OAAO,CAAC,GAAG,CAAC,oBAAoB;QACzC,YAAY,EACV,OAAO,CAAC,GAAG,CAAC,yBAAyB,KAAK,OAAO,CAAC,CAAC,CAAC,KAAK,CAAC,CAAC,CAAC,SAAS;QACvE,cAAc,EACZ,OAAO,CAAC,GAAG,CAAC,2BAA2B,KAAK,MAAM,CAAC,CAAC,CAAC,IAAI,CAAC,CAAC,CAAC,SAAS;QACvE,sBAAsB,EAAE,OAAO,CAAC,GAAG,CAAC,oCAAoC;KACzE,CAAe,CAAC;IAEjB,2CAA2C;IAC3C,MAAM,YAAY,GAAG,IAAI,GAAG,CAAC;QAC3B,GAAG,iBAAiB,CAAC,OAAO;QAC5B,GAAG,CAAC,aAAa,CAAC,OAAO,IAAI,EAAE,CAAC;QAChC,GAAG,CAAC,MAAM,CAAC,OAAO,IAAI,EAAE,CAAC;KAC1B,CAAC,CAAC;IAEH,4DAA4D;IAC5D,MAAM,eAAe,GAAG,MAAM,CAAC,OAAO,CAAC;IAEvC,6CAA6C;IAC7C,MAAM,YAAY,GAAG,KAAK,CAAC,WAAW,CACpC,EAAE,WAAW,EAAE,KAAK,EAAE,EACtB,iBAAiB,EACjB,aAAa,EACb,MAAM,CACP,CAAC;IAEF,kDAAkD;IAClD,YAAY,CAAC,OAAO,GAAG,KAAK,CAAC,IAAI,CAAC,YAAY,CAAC,CAAC;IAEhD,6EAA6E;IAC7E,mEAAmE;IACnE,IAAI,CAAC,MAAM,CAAC,OAAO,IAAI,CAAC,aAAa,CAAC,OAAO,IAAI,YAAY,CAAC,QAAQ,EAAE,CAAC;QACvE,YAAY,CAAC,OAAO,GAAG,wBAAwB,CAAC,YAAY,CAAC,QAAQ,CAAC,CAAC;IACzE,CAAC;IAED,4FAA4F;IAC5F,IAAI,eAAe,IAAI,YAAY,CAAC,OAAO,EAAE,CAAC;QAC5C,YAAY,CAAC,OAAO,GAAG,KAAK,CAAC,WAAW,CACtC,EAAE,WAAW,EAAE,KAAK,EAAE,EACtB,YAAY,CAAC,OAAO,EACpB,eAAe,CAChB,CAAC;IACJ,CAAC;IAED,IAAI,YAAY,CAAC,QAAQ,KAAK,SAAS,EAAE,CAAC;QACxC,MAAM,IAAI,KAAK,CAAC,kCAAkC,CAAC,CAAC;IACtD,CAAC;IAED,OAAO,YAA6D,CAAC;AACvE,CAAC,CAAC;AAEF;;GAEG;AACH,SAAS,mBAAmB,CAC1B,UAAsB,EACtB,QAAgB;IAEhB,MAAM,uBAAuB,GAA2B,EAAE,CAAC;IAE3D,IAAI,CAAC,QAAQ;QAAE,OAAO,uBAAuB,CAAC;IAE9C,MAAM,CAAC,OAAO,CAAC,UAAU,CAAC,CAAC,OAAO,CAAC,CAAC,CAAC,GAAG,EAAE,MAAM,CAAC,EAAE,EAAE;QACnD,uCAAuC;QACvC,MAAM,YAAY,GAAG,UAAU,CAAC,GAAuB,CAAC,CAAC;QACzD,IACE,YAAY,KAAK,SAAS;YAC1B,CAAC,CAAC,MAAM,CAAC,UAAU,IAAI,YAAY,KAAK,EAAE,CAAC,EAC3C,CAAC;YACD,OAAO;QACT,CAAC;QAED,uCAAuC;QACvC,MAAM,QAAQ,GAAG,MAAM,CAAC,eAAe;YACrC,CAAC,CAAC,QAAQ;YACV,CAAC,CAAC,GAAG,QAAQ,GAAG,MAAM,CAAC,WAAW,EAAE,CAAC;QAEvC,uBAAuB,CAAC,GAAG,CAAC,GAAG,QAAQ,CAAC;IAC1C,CAAC,CAAC,CAAC;IAEH,OAAO,uBAA8C,CAAC;AACxD,CAAC;AAED;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;GAqCG;AACH,MAAM,CAAC,MAAM,qBAAqB,GAAG,CAAC,UAAsB,EAAE,EAAE;IAC9D,OAAO,CAAC,UAAuB,EAAE,EAAE;QACjC,MAAM,CAAC,KAAK,CACV,kCAAkC,EAClC,IAAI,CAAC,SAAS,CAAC,UAAU,EAAE,IAAI,EAAE,CAAC,CAAC,CACpC,CAAC;QAEF,uCAAuC;QACvC,MAAM,QAAQ,GAAG,gBAAgB,CAAC,UAAU,EAAE,QAAQ,IAAI,EAAE,CAAC,CAAC;QAE9D,yDAAyD;QACzD,MAAM,uBAAuB,GAAG,mBAAmB,CAAC,UAAU,EAAE,QAAQ,CAAC,CAAC;QAE1E,+DAA+D;QAC/D,MAAM,cAAc,GAAG,iBAAiB,CAAC;YACvC,GAAG,uBAAuB;YAC1B,GAAG,UAAU;YACb,QAAQ;SACT,CAAC,CAAC;QAEH,OAAO;YACL,GAAG,UAAU;YACb,GAAG,EAAE;gBACH,GAAG,UAAU,EAAE,GAAG;gBAClB,6DAA6D;gBAC7D,qBAAqB,EAAE,cAAc,CAAC,QAAQ;gBAC9C,mBAAmB,EAAE,cAAc,CAAC,WAAW;gBAC/C,wBAAwB,EAAE,cAAc,CAAC,WAAW;gBACpD,6BAA6B,EAAE,cAAc,CAAC,eAAe;gBAC7D,yBAAyB,EAAE,cAAc,CAAC,YAAY;gBACtD,qBAAqB,EAAE,cAAc,CAAC,QAAQ;gBAC9C,0BAA0B,EAAE,cAAc,CAAC,YAAY;gBACvD,sBAAsB,EAAE,cAAc,CAAC,SAAS;gBAChD,+BAA+B,EAAE,cAAc,CAAC,iBAAiB;gBACjE,uBAAuB,EAAE,cAAc,CAAC,UAAU;gBAClD,oBAAoB,EAAE,cAAc,CAAC,OAAO;gBAC5C,6BAA6B,EAAE,cAAc,CAAC,eAAe;gBAC7D,oBAAoB,EAAE,cAAc,CAAC,OAAO,CAAC,IAAI,CAAC,GAAG,CAAC;gBACtD,oBAAoB,EAAE,cAAc,CAAC,OAAO,CAAC,IAAI,CAAC,GAAG,CAAC;gBACtD,yBAAyB,EAAE,IAAI,CAAC,SAAS,CAAC,cAAc,CAAC,OAAO,CAAC;gBACjE,qBAAqB,EAAE,cAAc,CAAC,QAAQ;gBAC9C,oBAAoB,EAAE,cAAc,CAAC,OAAO;gBAC5C,yBAAyB,EAAE,cAAc,CAAC,YAAY,CAAC,QAAQ,EAAE;gBACjE,2BAA2B,EAAE,cAAc,CAAC,cAAc,EAAE,QAAQ,EAAE;aACvE;SACF,CAAC;IACJ,CAAC,CAAC;AACJ,CAAC,CAAC","sourcesContent":["/* eslint-disable turbo/no-undeclared-env-vars */\nimport type { NextConfig } from \"next\";\nimport { loggers } from \"@/lib/logger.js\";\nimport { withoutUndefined } from \"@/utils.js\";\nimport {\n  type CookieConfig,\n  type TokensCookieConfig,\n} from \"@/shared/lib/types.js\";\nimport { DEFAULT_AUTH_SERVER } from \"@/constants.js\";\nimport { merge } from \"ts-deepmerge\";\nimport { sanitizeBasePath } from \"./utils.js\";\nimport {\n  createNextJSCookieConfig,\n  type CookiesConfigObject,\n} from \"@/shared/lib/cookieConfig.js\";\n\n// Re-export the shared type for public API\nexport type { CookiesConfigObject };\n\nconst logger = loggers.nextjs.handlers.auth;\n\n/**\n * URL configuration mapping for applying basePath\n */\ntype UrlConfigEntry = {\n  defaultPath: string;\n  applyBasePath: boolean;\n  useBasePathOnly?: boolean;\n  checkEmpty?: boolean;\n};\n\nexport const systemUrlsConfig = {\n  callbackUrl: { defaultPath: \"/api/auth/callback\", applyBasePath: true },\n  challengeUrl: { defaultPath: \"/api/auth/challenge\", applyBasePath: true },\n  refreshUrl: { defaultPath: \"/api/auth/refresh\", applyBasePath: true },\n  logoutUrl: { defaultPath: \"/api/auth/logout\", applyBasePath: true },\n  loginInitUrl: { defaultPath: \"/api/auth/login\", applyBasePath: true },\n  userUrl: { defaultPath: \"/api/auth/user\", applyBasePath: true },\n  clearSessionUrl: {\n    defaultPath: \"/api/auth/clearsession\",\n    applyBasePath: true,\n  },\n};\nconst URL_CONFIG: Record<string, UrlConfigEntry> = {\n  ...systemUrlsConfig,\n  logoutCallbackUrl: {\n    defaultPath: \"\",\n    applyBasePath: true,\n    useBasePathOnly: true,\n  },\n  loginUrl: {\n    defaultPath: \"\",\n    applyBasePath: true,\n    useBasePathOnly: true,\n    checkEmpty: true,\n  },\n};\n\n/**\n * Configuration values for Civic Auth.\n * Only clientId is required, all others are optional.\n */\nexport type AuthConfigWithDefaults = {\n  clientId: string;\n  oauthServer: string;\n  // Internal API routes\n  callbackUrl: string; // where Civic's internal OAuth callback is hosted\n  loginInitUrl: string; // Internal auth route for initiating login flow (e.g., /api/auth/login)\n  logoutUrl: string;\n  challengeUrl: string;\n  refreshUrl: string;\n  userUrl: string;\n  clearSessionUrl: string;\n  // User-facing routes\n  loginSuccessUrl?: string; // where the user should be sent after the entire login completes, including the token exchange\n  // The path the user will be sent to if they access a resource that needs\n  // them to be logged in. If there is a dedicated login page, it can be set here.\n  // Note: This is NOT for internal auth routes - see loginInitUrl for that.\n  loginUrl: string;\n  logoutCallbackUrl: string;\n  include: string[];\n  exclude: string[];\n  cookies: CookiesConfigObject;\n  basePath?: string;\n  baseUrl?: string; // Public domain for apps behind reverse proxies (e.g., \"https://myapp.com\")\n  autoRedirect: boolean;\n  disableRefresh?: boolean; // Disable automatic token refresh\n  targetContainerElement?: HTMLElement | string;\n};\n\n/**\n * All possible config values for Civic Auth\n */\nexport type OptionalAuthConfig = Partial<\n  | AuthConfigWithDefaults\n  | {\n      cookies?: {\n        tokens?: Partial<TokensCookieConfig>;\n        user?: CookieConfig;\n      };\n    }\n> & {\n  // Ensure TypeScript understands these properties are available\n  // This doesn't change the public API, just helps TypeScript internally\n  callbackUrl?: string; // where Civic's internal OAuth callback is hosted\n  loginSuccessUrl?: string; // where the user should be sent after the entire login completes, including the token exchange\n  loginUrl?: string;\n  loginInitUrl?: string;\n  logoutUrl?: string;\n  logoutCallbackUrl?: string;\n  challengeUrl?: string;\n  refreshUrl?: string;\n  userUrl?: string;\n  clearSessionUrl?: string;\n  include?: string[];\n  exclude?: string[];\n  basePath?: string;\n  baseUrl?: string;\n  oauthServer?: string;\n  autoRedirect?: boolean;\n  disableRefresh?: boolean;\n  targetContainerElement?: HTMLElement | string;\n};\n\n/**\n * Configuration values for Civic Auth.\n * Only clientId is required, all others are optional.\n */\nexport type AuthConfig = OptionalAuthConfig & {\n  clientId: string;\n  exclude?: string[];\n};\n\n/**\n * Default configuration values that will be used if not overridden\n */\nexport const defaultAuthConfig: Omit<AuthConfigWithDefaults, \"clientId\"> = {\n  oauthServer: DEFAULT_AUTH_SERVER,\n  // Internal API routes\n  // deconstruct systemUrls to set the keys and default values\n  ...(Object.fromEntries(\n    Object.entries(systemUrlsConfig).map(([key, value]) => [\n      key,\n      value.defaultPath,\n    ]),\n  ) as {\n    [key in keyof typeof systemUrlsConfig]: string;\n  }),\n  // User-facing routes\n  loginSuccessUrl: undefined, // By default, the user is sent to the redirect_url\n  loginUrl: \"/\",\n  logoutCallbackUrl: \"/\",\n  include: [\"/**\"],\n  exclude: [\"/api/auth/**\"],\n  basePath: \"\",\n  baseUrl: undefined, // No default - will use request.nextUrl.origin when undefined\n  autoRedirect: true, // Default to current behavior\n  cookies: createNextJSCookieConfig(),\n};\n\n/**\n * Resolves the authentication configuration by combining:\n * 1. Default values\n * 2. Environment variables (set internally by the plugin)\n * 3. Explicitly passed configuration\n *\n * Config will be merged deeply, with arrays not merged, so that the\n * default include list (for example) [\"/*\"] will not be added\n *\n * Note: Developers should not set _civic_auth_* environment variables directly.\n * Instead, pass configuration to the createCivicAuthPlugin in next.config.js:\n *\n * @example\n * ```js\n * // next.config.js\n * export default createCivicAuthPlugin({\n *   callbackUrl: '/custom/callback',\n * })\n * ```\n */\nexport const resolveAuthConfig = (\n  config: Partial<AuthConfig> = {},\n): AuthConfigWithDefaults => {\n  // Read configuration that was set by the plugin via environment variables\n  // Don't load environment cookies if explicit cookies are provided\n  const hasExplicitCookies = config.cookies;\n\n  const configFromEnv = withoutUndefined({\n    clientId: process.env._civic_auth_client_id,\n    oauthServer: process.env._civic_oauth_server,\n    callbackUrl: process.env._civic_auth_callback_url,\n    loginSuccessUrl: process.env._civic_auth_login_success_url,\n    challengeUrl: process.env._civic_auth_challenge_url,\n    loginUrl: process.env._civic_auth_login_url,\n    loginInitUrl: process.env._civic_auth_login_init_url,\n    logoutUrl: process.env._civic_auth_logout_url,\n    logoutCallbackUrl: process.env._civic_auth_logout_callback_url,\n    refreshUrl: process.env._civic_auth_refresh_url,\n    userUrl: process.env._civic_auth_user_url,\n    clearSessionUrl: process.env._civic_auth_clear_session_url,\n    include: process.env._civic_auth_includes?.split(\",\"),\n    exclude: process.env._civic_auth_excludes?.split(\",\"),\n    cookies: hasExplicitCookies\n      ? undefined\n      : process.env._civic_auth_cookie_config\n        ? JSON.parse(process.env._civic_auth_cookie_config)\n        : undefined,\n    basePath: process.env._civic_auth_base_path || \"\",\n    baseUrl: process.env._civic_auth_base_url,\n    autoRedirect:\n      process.env._civic_auth_auto_redirect === \"false\" ? false : undefined,\n    disableRefresh:\n      process.env._civic_auth_disable_refresh === \"true\" ? true : undefined,\n    targetContainerElement: process.env._civic_auth_target_container_element,\n  }) as AuthConfig;\n\n  // Ensure \"/api/auth/**\" is always excluded\n  const finalExclude = new Set([\n    ...defaultAuthConfig.exclude,\n    ...(configFromEnv.exclude || []),\n    ...(config.exclude ?? []),\n  ]);\n\n  // Store explicit cookies config before merge to preserve it\n  const explicitCookies = config.cookies;\n\n  // Perform a deep merge of the configurations\n  const mergedConfig = merge.withOptions(\n    { mergeArrays: false },\n    defaultAuthConfig,\n    configFromEnv,\n    config,\n  );\n\n  // Override the exclude list with the ensured list\n  mergedConfig.exclude = Array.from(finalExclude);\n\n  // Update cookie configuration with basePath if it wasn't explicitly provided\n  // Only auto-configure if no explicit cookies are provided anywhere\n  if (!config.cookies && !configFromEnv.cookies && mergedConfig.basePath) {\n    mergedConfig.cookies = createNextJSCookieConfig(mergedConfig.basePath);\n  }\n\n  // Merge explicit cookies with merged config to preserve both explicit settings and defaults\n  if (explicitCookies && mergedConfig.cookies) {\n    mergedConfig.cookies = merge.withOptions(\n      { mergeArrays: false },\n      mergedConfig.cookies,\n      explicitCookies,\n    );\n  }\n\n  if (mergedConfig.clientId === undefined) {\n    throw new Error(\"Civic Auth client ID is required\");\n  }\n\n  return mergedConfig as AuthConfigWithDefaults & { clientId: string };\n};\n\n/**\n * Applies basePath to URLs based on URL_CONFIG rules\n */\nfunction applyBasePathToUrls(\n  authConfig: AuthConfig,\n  basePath: string,\n): Partial<AuthConfig> {\n  const defaultUrlsWithBasePath: Record<string, string> = {};\n\n  if (!basePath) return defaultUrlsWithBasePath;\n\n  Object.entries(URL_CONFIG).forEach(([key, config]) => {\n    // Skip if explicitly set in authConfig\n    const currentValue = authConfig[key as keyof AuthConfig];\n    if (\n      currentValue !== undefined &&\n      !(config.checkEmpty && currentValue === \"\")\n    ) {\n      return;\n    }\n\n    // Apply basePath based on config rules\n    const urlValue = config.useBasePathOnly\n      ? basePath\n      : `${basePath}${config.defaultPath}`;\n\n    defaultUrlsWithBasePath[key] = urlValue;\n  });\n\n  return defaultUrlsWithBasePath as Partial<AuthConfig>;\n}\n\n/**\n * Creates a Next.js plugin that handles auth configuration.\n *\n * This is the main configuration point for the auth system.\n * Do not set _civic_auth_* environment variables directly - instead,\n * pass your configuration here.\n *\n * The only required field is clientId.\n *\n * Notes:\n * - If you provide explicit URLs, they will be used exactly as provided.\n * - Default URLs will automatically include the basePath from your Next.js config.\n *\n * @example\n * ```js\n * // next.config.js\n * export default createCivicAuthPlugin({\n *  clientId: 'my-client-id',\n * });\n * ```\n *\n * @example\n * ```js\n * // next.config.js\n * export default createCivicAuthPlugin({\n *   clientId: 'my-client-id',\n *   callbackUrl: '/custom/callback',\n *   loginUrl: '/custom/login',\n *   logoutUrl: '/custom/logout',\n *   logoutCallbackUrl: '/custom/logoutcallback',\n *   include: ['/protected/*'],\n *   exclude: ['/public/*']\n * })\n * ```\n *\n * The plugin sets internal environment variables that are used by\n * the auth system. These variables should not be set manually.\n */\nexport const createCivicAuthPlugin = (authConfig: AuthConfig) => {\n  return (nextConfig?: NextConfig) => {\n    logger.debug(\n      \"createCivicAuthPlugin nextConfig\",\n      JSON.stringify(nextConfig, null, 2),\n    );\n\n    // Extract basePath from Next.js config\n    const basePath = sanitizeBasePath(nextConfig?.basePath || \"\");\n\n    // Apply basePath to URLs using the configuration mapping\n    const defaultUrlsWithBasePath = applyBasePathToUrls(authConfig, basePath);\n\n    // Create final config with basePath and possibly modified URLs\n    const resolvedConfig = resolveAuthConfig({\n      ...defaultUrlsWithBasePath,\n      ...authConfig,\n      basePath,\n    });\n\n    return {\n      ...nextConfig,\n      env: {\n        ...nextConfig?.env,\n        // Internal environment variables - do not set these manually\n        _civic_auth_client_id: resolvedConfig.clientId,\n        _civic_oauth_server: resolvedConfig.oauthServer,\n        _civic_auth_callback_url: resolvedConfig.callbackUrl,\n        _civic_auth_login_success_url: resolvedConfig.loginSuccessUrl,\n        _civic_auth_challenge_url: resolvedConfig.challengeUrl,\n        _civic_auth_login_url: resolvedConfig.loginUrl,\n        _civic_auth_login_init_url: resolvedConfig.loginInitUrl,\n        _civic_auth_logout_url: resolvedConfig.logoutUrl,\n        _civic_auth_logout_callback_url: resolvedConfig.logoutCallbackUrl,\n        _civic_auth_refresh_url: resolvedConfig.refreshUrl,\n        _civic_auth_user_url: resolvedConfig.userUrl,\n        _civic_auth_clear_session_url: resolvedConfig.clearSessionUrl,\n        _civic_auth_includes: resolvedConfig.include.join(\",\"),\n        _civic_auth_excludes: resolvedConfig.exclude.join(\",\"),\n        _civic_auth_cookie_config: JSON.stringify(resolvedConfig.cookies),\n        _civic_auth_base_path: resolvedConfig.basePath,\n        _civic_auth_base_url: resolvedConfig.baseUrl,\n        _civic_auth_auto_redirect: resolvedConfig.autoRedirect.toString(),\n        _civic_auth_disable_refresh: resolvedConfig.disableRefresh?.toString(),\n      },\n    };\n  };\n};\n"]}
+{"version":3,"file":"config.js","sourceRoot":"","sources":["../../src/nextjs/config.ts"],"names":[],"mappings":"AAEA,OAAO,EAAE,OAAO,EAAE,MAAM,iBAAiB,CAAC;AAC1C,OAAO,EAAE,gBAAgB,EAAE,MAAM,YAAY,CAAC;AAC9C,OAAO,EAGN,MAAM,uBAAuB,CAAC;AAC/B,OAAO,EAAE,mBAAmB,EAAE,MAAM,gBAAgB,CAAC;AACrD,OAAO,EAAE,KAAK,EAAE,MAAM,cAAc,CAAC;AACrC,OAAO,EAAE,gBAAgB,EAAE,MAAM,YAAY,CAAC;AAC9C,OAAO,EACL,wBAAwB,GAEzB,MAAM,8BAA8B,CAAC;AAKtC,MAAM,MAAM,GAAG,OAAO,CAAC,MAAM,CAAC,QAAQ,CAAC,IAAI,CAAC;AAwB5C,MAAM,CAAC,MAAM,gBAAgB,GAAG;IAC9B,WAAW,EAAE,EAAE,WAAW,EAAE,oBAAoB,EAAE,aAAa,EAAE,IAAI,EAAE;IACvE,YAAY,EAAE,EAAE,WAAW,EAAE,qBAAqB,EAAE,aAAa,EAAE,IAAI,EAAE;IACzE,UAAU,EAAE,EAAE,WAAW,EAAE,mBAAmB,EAAE,aAAa,EAAE,IAAI,EAAE;IACrE,SAAS,EAAE,EAAE,WAAW,EAAE,kBAAkB,EAAE,aAAa,EAAE,IAAI,EAAE;IACnE,YAAY,EAAE,EAAE,WAAW,EAAE,iBAAiB,EAAE,aAAa,EAAE,IAAI,EAAE;IACrE,OAAO,EAAE,EAAE,WAAW,EAAE,gBAAgB,EAAE,aAAa,EAAE,IAAI,EAAE;IAC/D,eAAe,EAAE;QACf,WAAW,EAAE,wBAAwB;QACrC,aAAa,EAAE,IAAI;KACpB;CACF,CAAC;AACF,MAAM,UAAU,GAAmC;IACjD,GAAG,gBAAgB;IACnB,iBAAiB,EAAE;QACjB,WAAW,EAAE,EAAE;QACf,aAAa,EAAE,IAAI;QACnB,eAAe,EAAE,IAAI;KACtB;IACD,QAAQ,EAAE;QACR,WAAW,EAAE,EAAE;QACf,aAAa,EAAE,IAAI;QACnB,eAAe,EAAE,IAAI;QACrB,UAAU,EAAE,IAAI;KACjB;CACF,CAAC;AAoFF;;GAEG;AACH,MAAM,CAAC,MAAM,iBAAiB,GAA6C;IACzE,WAAW,EAAE,mBAAmB;IAChC,sBAAsB;IACtB,4DAA4D;IAC5D,GAAI,MAAM,CAAC,WAAW,CACpB,MAAM,CAAC,OAAO,CAAC,gBAAgB,CAAC,CAAC,GAAG,CAAC,CAAC,CAAC,GAAG,EAAE,KAAK,CAAC,EAAE,EAAE,CAAC;QACrD,GAAG;QACH,KAAK,CAAC,WAAW;KAClB,CAAC,CAGF;IACF,qBAAqB;IACrB,eAAe,EAAE,SAAS,EAAE,mDAAmD;IAC/E,QAAQ,EAAE,GAAG;IACb,iBAAiB,EAAE,GAAG;IACtB,OAAO,EAAE,CAAC,KAAK,CAAC;IAChB,OAAO,EAAE,CAAC,cAAc,CAAC;IACzB,QAAQ,EAAE,EAAE;IACZ,OAAO,EAAE,SAAS,EAAE,8DAA8D;IAClF,YAAY,EAAE,IAAI,EAAE,8BAA8B;IAClD,OAAO,EAAE,wBAAwB,EAAE;IACnC,gBAAgB,EAAE,SAAS,EAAE,yCAAyC;CACvE,CAAC;AAEF;;;;;;;;;;;;;;;;;;;GAmBG;AACH,MAAM,CAAC,MAAM,iBAAiB,GAAG,CAC/B,SAA8B,EAAE,EACR,EAAE;IAC1B,0EAA0E;IAC1E,kEAAkE;IAClE,MAAM,kBAAkB,GAAG,MAAM,CAAC,OAAO,CAAC;IAE1C,MAAM,aAAa,GAAG,gBAAgB,CAAC;QACrC,QAAQ,EAAE,OAAO,CAAC,GAAG,CAAC,qBAAqB;QAC3C,WAAW,EAAE,OAAO,CAAC,GAAG,CAAC,mBAAmB;QAC5C,WAAW,EAAE,OAAO,CAAC,GAAG,CAAC,wBAAwB;QACjD,eAAe,EAAE,OAAO,CAAC,GAAG,CAAC,6BAA6B;QAC1D,YAAY,EAAE,OAAO,CAAC,GAAG,CAAC,yBAAyB;QACnD,QAAQ,EAAE,OAAO,CAAC,GAAG,CAAC,qBAAqB;QAC3C,YAAY,EAAE,OAAO,CAAC,GAAG,CAAC,0BAA0B;QACpD,SAAS,EAAE,OAAO,CAAC,GAAG,CAAC,sBAAsB;QAC7C,iBAAiB,EAAE,OAAO,CAAC,GAAG,CAAC,+BAA+B;QAC9D,UAAU,EAAE,OAAO,CAAC,GAAG,CAAC,uBAAuB;QAC/C,OAAO,EAAE,OAAO,CAAC,GAAG,CAAC,oBAAoB;QACzC,eAAe,EAAE,OAAO,CAAC,GAAG,CAAC,6BAA6B;QAC1D,OAAO,EAAE,OAAO,CAAC,GAAG,CAAC,oBAAoB,EAAE,KAAK,CAAC,GAAG,CAAC;QACrD,OAAO,EAAE,OAAO,CAAC,GAAG,CAAC,oBAAoB,EAAE,KAAK,CAAC,GAAG,CAAC;QACrD,OAAO,EAAE,kBAAkB;YACzB,CAAC,CAAC,SAAS;YACX,CAAC,CAAC,OAAO,CAAC,GAAG,CAAC,yBAAyB;gBACrC,CAAC,CAAC,IAAI,CAAC,KAAK,CAAC,OAAO,CAAC,GAAG,CAAC,yBAAyB,CAAC;gBACnD,CAAC,CAAC,SAAS;QACf,QAAQ,EAAE,OAAO,CAAC,GAAG,CAAC,qBAAqB,IAAI,EAAE;QACjD,OAAO,EAAE,OAAO,CAAC,GAAG,CAAC,oBAAoB;QACzC,YAAY,EACV,OAAO,CAAC,GAAG,CAAC,yBAAyB,KAAK,OAAO,CAAC,CAAC,CAAC,KAAK,CAAC,CAAC,CAAC,SAAS;QACvE,cAAc,EACZ,OAAO,CAAC,GAAG,CAAC,2BAA2B,KAAK,MAAM,CAAC,CAAC,CAAC,IAAI,CAAC,CAAC,CAAC,SAAS;QACvE,sBAAsB,EAAE,OAAO,CAAC,GAAG,CAAC,oCAAoC;QACxE,gBAAgB,EAAE,CAAC,CAAC,SAAS,EAAE,iBAAiB,EAAE,UAAU,CAAC,CAAC,QAAQ,CACpE,OAAO,CAAC,GAAG,CAAC,8BAA8B,IAAI,EAAE,CACjD;YACC,CAAC,CAAC,OAAO,CAAC,GAAG,CAAC,8BAA8B;YAC5C,CAAC,CAAC,SAAS,CAAiC;KAC/C,CAAe,CAAC;IAEjB,2CAA2C;IAC3C,MAAM,YAAY,GAAG,IAAI,GAAG,CAAC;QAC3B,GAAG,iBAAiB,CAAC,OAAO;QAC5B,GAAG,CAAC,aAAa,CAAC,OAAO,IAAI,EAAE,CAAC;QAChC,GAAG,CAAC,MAAM,CAAC,OAAO,IAAI,EAAE,CAAC;KAC1B,CAAC,CAAC;IAEH,4DAA4D;IAC5D,MAAM,eAAe,GAAG,MAAM,CAAC,OAAO,CAAC;IAEvC,6CAA6C;IAC7C,MAAM,YAAY,GAAG,KAAK,CAAC,WAAW,CACpC,EAAE,WAAW,EAAE,KAAK,EAAE,EACtB,iBAAiB,EACjB,aAAa,EACb,MAAM,CACP,CAAC;IAEF,kDAAkD;IAClD,YAAY,CAAC,OAAO,GAAG,KAAK,CAAC,IAAI,CAAC,YAAY,CAAC,CAAC;IAEhD,6EAA6E;IAC7E,mEAAmE;IACnE,IAAI,CAAC,MAAM,CAAC,OAAO,IAAI,CAAC,aAAa,CAAC,OAAO,IAAI,YAAY,CAAC,QAAQ,EAAE,CAAC;QACvE,YAAY,CAAC,OAAO,GAAG,wBAAwB,CAAC,YAAY,CAAC,QAAQ,CAAC,CAAC;IACzE,CAAC;IAED,4FAA4F;IAC5F,IAAI,eAAe,IAAI,YAAY,CAAC,OAAO,EAAE,CAAC;QAC5C,YAAY,CAAC,OAAO,GAAG,KAAK,CAAC,WAAW,CACtC,EAAE,WAAW,EAAE,KAAK,EAAE,EACtB,YAAY,CAAC,OAAO,EACpB,eAAe,CAChB,CAAC;IACJ,CAAC;IAED,IAAI,YAAY,CAAC,QAAQ,KAAK,SAAS,EAAE,CAAC;QACxC,MAAM,IAAI,KAAK,CAAC,kCAAkC,CAAC,CAAC;IACtD,CAAC;IAED,OAAO,YAA6D,CAAC;AACvE,CAAC,CAAC;AAEF;;GAEG;AACH,SAAS,mBAAmB,CAC1B,UAAsB,EACtB,QAAgB;IAEhB,MAAM,uBAAuB,GAA2B,EAAE,CAAC;IAE3D,IAAI,CAAC,QAAQ;QAAE,OAAO,uBAAuB,CAAC;IAE9C,MAAM,CAAC,OAAO,CAAC,UAAU,CAAC,CAAC,OAAO,CAAC,CAAC,CAAC,GAAG,EAAE,MAAM,CAAC,EAAE,EAAE;QACnD,uCAAuC;QACvC,MAAM,YAAY,GAAG,UAAU,CAAC,GAAuB,CAAC,CAAC;QACzD,IACE,YAAY,KAAK,SAAS;YAC1B,CAAC,CAAC,MAAM,CAAC,UAAU,IAAI,YAAY,KAAK,EAAE,CAAC,EAC3C,CAAC;YACD,OAAO;QACT,CAAC;QAED,uCAAuC;QACvC,MAAM,QAAQ,GAAG,MAAM,CAAC,eAAe;YACrC,CAAC,CAAC,QAAQ;YACV,CAAC,CAAC,GAAG,QAAQ,GAAG,MAAM,CAAC,WAAW,EAAE,CAAC;QAEvC,uBAAuB,CAAC,GAAG,CAAC,GAAG,QAAQ,CAAC;IAC1C,CAAC,CAAC,CAAC;IAEH,OAAO,uBAA8C,CAAC;AACxD,CAAC;AAED;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;GAqCG;AACH,MAAM,CAAC,MAAM,qBAAqB,GAAG,CAAC,UAAsB,EAAE,EAAE;IAC9D,OAAO,CAAC,UAAuB,EAAE,EAAE;QACjC,MAAM,CAAC,KAAK,CACV,kCAAkC,EAClC,IAAI,CAAC,SAAS,CAAC,UAAU,EAAE,IAAI,EAAE,CAAC,CAAC,CACpC,CAAC;QAEF,uCAAuC;QACvC,MAAM,QAAQ,GAAG,gBAAgB,CAAC,UAAU,EAAE,QAAQ,IAAI,EAAE,CAAC,CAAC;QAE9D,yDAAyD;QACzD,MAAM,uBAAuB,GAAG,mBAAmB,CAAC,UAAU,EAAE,QAAQ,CAAC,CAAC;QAE1E,+DAA+D;QAC/D,MAAM,cAAc,GAAG,iBAAiB,CAAC;YACvC,GAAG,uBAAuB;YAC1B,GAAG,UAAU;YACb,QAAQ;SACT,CAAC,CAAC;QAEH,OAAO;YACL,GAAG,UAAU;YACb,GAAG,EAAE;gBACH,GAAG,UAAU,EAAE,GAAG;gBAClB,6DAA6D;gBAC7D,qBAAqB,EAAE,cAAc,CAAC,QAAQ;gBAC9C,mBAAmB,EAAE,cAAc,CAAC,WAAW;gBAC/C,wBAAwB,EAAE,cAAc,CAAC,WAAW;gBACpD,6BAA6B,EAAE,cAAc,CAAC,eAAe;gBAC7D,yBAAyB,EAAE,cAAc,CAAC,YAAY;gBACtD,qBAAqB,EAAE,cAAc,CAAC,QAAQ;gBAC9C,0BAA0B,EAAE,cAAc,CAAC,YAAY;gBACvD,sBAAsB,EAAE,cAAc,CAAC,SAAS;gBAChD,+BAA+B,EAAE,cAAc,CAAC,iBAAiB;gBACjE,uBAAuB,EAAE,cAAc,CAAC,UAAU;gBAClD,oBAAoB,EAAE,cAAc,CAAC,OAAO;gBAC5C,6BAA6B,EAAE,cAAc,CAAC,eAAe;gBAC7D,oBAAoB,EAAE,cAAc,CAAC,OAAO,CAAC,IAAI,CAAC,GAAG,CAAC;gBACtD,oBAAoB,EAAE,cAAc,CAAC,OAAO,CAAC,IAAI,CAAC,GAAG,CAAC;gBACtD,yBAAyB,EAAE,IAAI,CAAC,SAAS,CAAC,cAAc,CAAC,OAAO,CAAC;gBACjE,qBAAqB,EAAE,cAAc,CAAC,QAAQ;gBAC9C,oBAAoB,EAAE,cAAc,CAAC,OAAO;gBAC5C,yBAAyB,EAAE,cAAc,CAAC,YAAY,CAAC,QAAQ,EAAE;gBACjE,2BAA2B,EAAE,cAAc,CAAC,cAAc,EAAE,QAAQ,EAAE;gBACtE,8BAA8B,EAAE,cAAc,CAAC,gBAAgB;aAChE;SACF,CAAC;IACJ,CAAC,CAAC;AACJ,CAAC,CAAC","sourcesContent":["/* eslint-disable turbo/no-undeclared-env-vars */\nimport type { NextConfig } from \"next\";\nimport { loggers } from \"@/lib/logger.js\";\nimport { withoutUndefined } from \"@/utils.js\";\nimport {\n  type CookieConfig,\n  type TokensCookieConfig,\n} from \"@/shared/lib/types.js\";\nimport { DEFAULT_AUTH_SERVER } from \"@/constants.js\";\nimport { merge } from \"ts-deepmerge\";\nimport { sanitizeBasePath } from \"./utils.js\";\nimport {\n  createNextJSCookieConfig,\n  type CookiesConfigObject,\n} from \"@/shared/lib/cookieConfig.js\";\n\n// Re-export the shared type for public API\nexport type { CookiesConfigObject };\n\nconst logger = loggers.nextjs.handlers.auth;\n\n/**\n * Controls how deep links (original URLs) are handled after authentication.\n *\n * - `\"fullUrl\"`: Redirect to the original URL the user tried to access.\n *   `loginSuccessUrl` is used as fallback only when no deep link exists.\n * - `\"queryParamsOnly\"`: Redirect to `loginSuccessUrl`, but merge query params from original URL.\n * - `\"disabled\"`: No deep link preservation. Always use `loginSuccessUrl`.\n *\n * @default \"fullUrl\"\n */\nexport type DeepLinkHandling = \"fullUrl\" | \"queryParamsOnly\" | \"disabled\";\n\n/**\n * URL configuration mapping for applying basePath\n */\ntype UrlConfigEntry = {\n  defaultPath: string;\n  applyBasePath: boolean;\n  useBasePathOnly?: boolean;\n  checkEmpty?: boolean;\n};\n\nexport const systemUrlsConfig = {\n  callbackUrl: { defaultPath: \"/api/auth/callback\", applyBasePath: true },\n  challengeUrl: { defaultPath: \"/api/auth/challenge\", applyBasePath: true },\n  refreshUrl: { defaultPath: \"/api/auth/refresh\", applyBasePath: true },\n  logoutUrl: { defaultPath: \"/api/auth/logout\", applyBasePath: true },\n  loginInitUrl: { defaultPath: \"/api/auth/login\", applyBasePath: true },\n  userUrl: { defaultPath: \"/api/auth/user\", applyBasePath: true },\n  clearSessionUrl: {\n    defaultPath: \"/api/auth/clearsession\",\n    applyBasePath: true,\n  },\n};\nconst URL_CONFIG: Record<string, UrlConfigEntry> = {\n  ...systemUrlsConfig,\n  logoutCallbackUrl: {\n    defaultPath: \"\",\n    applyBasePath: true,\n    useBasePathOnly: true,\n  },\n  loginUrl: {\n    defaultPath: \"\",\n    applyBasePath: true,\n    useBasePathOnly: true,\n    checkEmpty: true,\n  },\n};\n\n/**\n * Configuration values for Civic Auth.\n * Only clientId is required, all others are optional.\n */\nexport type AuthConfigWithDefaults = {\n  clientId: string;\n  oauthServer: string;\n  // Internal API routes\n  callbackUrl: string; // where Civic's internal OAuth callback is hosted\n  loginInitUrl: string; // Internal auth route for initiating login flow (e.g., /api/auth/login)\n  logoutUrl: string;\n  challengeUrl: string;\n  refreshUrl: string;\n  userUrl: string;\n  clearSessionUrl: string;\n  // User-facing routes\n  loginSuccessUrl?: string; // where the user should be sent after the entire login completes, including the token exchange\n  // The path the user will be sent to if they access a resource that needs\n  // them to be logged in. If there is a dedicated login page, it can be set here.\n  // Note: This is NOT for internal auth routes - see loginInitUrl for that.\n  loginUrl: string;\n  logoutCallbackUrl: string;\n  include: string[];\n  exclude: string[];\n  cookies: CookiesConfigObject;\n  basePath?: string;\n  baseUrl?: string; // Public domain for apps behind reverse proxies (e.g., \"https://myapp.com\")\n  autoRedirect: boolean;\n  disableRefresh?: boolean; // Disable automatic token refresh\n  targetContainerElement?: HTMLElement | string;\n  /**\n   * Controls how deep links (original URLs) are handled after authentication.\n   * @see DeepLinkHandling\n   * @default \"fullUrl\"\n   */\n  deepLinkHandling: DeepLinkHandling;\n};\n\n/**\n * All possible config values for Civic Auth\n */\nexport type OptionalAuthConfig = Partial<\n  | AuthConfigWithDefaults\n  | {\n      cookies?: {\n        tokens?: Partial<TokensCookieConfig>;\n        user?: CookieConfig;\n      };\n    }\n> & {\n  // Ensure TypeScript understands these properties are available\n  // This doesn't change the public API, just helps TypeScript internally\n  callbackUrl?: string; // where Civic's internal OAuth callback is hosted\n  loginSuccessUrl?: string; // where the user should be sent after the entire login completes, including the token exchange\n  loginUrl?: string;\n  loginInitUrl?: string;\n  logoutUrl?: string;\n  logoutCallbackUrl?: string;\n  challengeUrl?: string;\n  refreshUrl?: string;\n  userUrl?: string;\n  clearSessionUrl?: string;\n  include?: string[];\n  exclude?: string[];\n  basePath?: string;\n  baseUrl?: string;\n  oauthServer?: string;\n  autoRedirect?: boolean;\n  disableRefresh?: boolean;\n  targetContainerElement?: HTMLElement | string;\n  deepLinkHandling?: DeepLinkHandling;\n};\n\n/**\n * Configuration values for Civic Auth.\n * Only clientId is required, all others are optional.\n */\nexport type AuthConfig = OptionalAuthConfig & {\n  clientId: string;\n  exclude?: string[];\n};\n\n/**\n * Default configuration values that will be used if not overridden\n */\nexport const defaultAuthConfig: Omit<AuthConfigWithDefaults, \"clientId\"> = {\n  oauthServer: DEFAULT_AUTH_SERVER,\n  // Internal API routes\n  // deconstruct systemUrls to set the keys and default values\n  ...(Object.fromEntries(\n    Object.entries(systemUrlsConfig).map(([key, value]) => [\n      key,\n      value.defaultPath,\n    ]),\n  ) as {\n    [key in keyof typeof systemUrlsConfig]: string;\n  }),\n  // User-facing routes\n  loginSuccessUrl: undefined, // By default, the user is sent to the redirect_url\n  loginUrl: \"/\",\n  logoutCallbackUrl: \"/\",\n  include: [\"/**\"],\n  exclude: [\"/api/auth/**\"],\n  basePath: \"\",\n  baseUrl: undefined, // No default - will use request.nextUrl.origin when undefined\n  autoRedirect: true, // Default to current behavior\n  cookies: createNextJSCookieConfig(),\n  deepLinkHandling: \"fullUrl\", // Default to full deep link preservation\n};\n\n/**\n * Resolves the authentication configuration by combining:\n * 1. Default values\n * 2. Environment variables (set internally by the plugin)\n * 3. Explicitly passed configuration\n *\n * Config will be merged deeply, with arrays not merged, so that the\n * default include list (for example) [\"/*\"] will not be added\n *\n * Note: Developers should not set _civic_auth_* environment variables directly.\n * Instead, pass configuration to the createCivicAuthPlugin in next.config.js:\n *\n * @example\n * ```js\n * // next.config.js\n * export default createCivicAuthPlugin({\n *   callbackUrl: '/custom/callback',\n * })\n * ```\n */\nexport const resolveAuthConfig = (\n  config: Partial<AuthConfig> = {},\n): AuthConfigWithDefaults => {\n  // Read configuration that was set by the plugin via environment variables\n  // Don't load environment cookies if explicit cookies are provided\n  const hasExplicitCookies = config.cookies;\n\n  const configFromEnv = withoutUndefined({\n    clientId: process.env._civic_auth_client_id,\n    oauthServer: process.env._civic_oauth_server,\n    callbackUrl: process.env._civic_auth_callback_url,\n    loginSuccessUrl: process.env._civic_auth_login_success_url,\n    challengeUrl: process.env._civic_auth_challenge_url,\n    loginUrl: process.env._civic_auth_login_url,\n    loginInitUrl: process.env._civic_auth_login_init_url,\n    logoutUrl: process.env._civic_auth_logout_url,\n    logoutCallbackUrl: process.env._civic_auth_logout_callback_url,\n    refreshUrl: process.env._civic_auth_refresh_url,\n    userUrl: process.env._civic_auth_user_url,\n    clearSessionUrl: process.env._civic_auth_clear_session_url,\n    include: process.env._civic_auth_includes?.split(\",\"),\n    exclude: process.env._civic_auth_excludes?.split(\",\"),\n    cookies: hasExplicitCookies\n      ? undefined\n      : process.env._civic_auth_cookie_config\n        ? JSON.parse(process.env._civic_auth_cookie_config)\n        : undefined,\n    basePath: process.env._civic_auth_base_path || \"\",\n    baseUrl: process.env._civic_auth_base_url,\n    autoRedirect:\n      process.env._civic_auth_auto_redirect === \"false\" ? false : undefined,\n    disableRefresh:\n      process.env._civic_auth_disable_refresh === \"true\" ? true : undefined,\n    targetContainerElement: process.env._civic_auth_target_container_element,\n    deepLinkHandling: ([\"fullUrl\", \"queryParamsOnly\", \"disabled\"].includes(\n      process.env._civic_auth_deep_link_handling || \"\",\n    )\n      ? process.env._civic_auth_deep_link_handling\n      : undefined) as DeepLinkHandling | undefined,\n  }) as AuthConfig;\n\n  // Ensure \"/api/auth/**\" is always excluded\n  const finalExclude = new Set([\n    ...defaultAuthConfig.exclude,\n    ...(configFromEnv.exclude || []),\n    ...(config.exclude ?? []),\n  ]);\n\n  // Store explicit cookies config before merge to preserve it\n  const explicitCookies = config.cookies;\n\n  // Perform a deep merge of the configurations\n  const mergedConfig = merge.withOptions(\n    { mergeArrays: false },\n    defaultAuthConfig,\n    configFromEnv,\n    config,\n  );\n\n  // Override the exclude list with the ensured list\n  mergedConfig.exclude = Array.from(finalExclude);\n\n  // Update cookie configuration with basePath if it wasn't explicitly provided\n  // Only auto-configure if no explicit cookies are provided anywhere\n  if (!config.cookies && !configFromEnv.cookies && mergedConfig.basePath) {\n    mergedConfig.cookies = createNextJSCookieConfig(mergedConfig.basePath);\n  }\n\n  // Merge explicit cookies with merged config to preserve both explicit settings and defaults\n  if (explicitCookies && mergedConfig.cookies) {\n    mergedConfig.cookies = merge.withOptions(\n      { mergeArrays: false },\n      mergedConfig.cookies,\n      explicitCookies,\n    );\n  }\n\n  if (mergedConfig.clientId === undefined) {\n    throw new Error(\"Civic Auth client ID is required\");\n  }\n\n  return mergedConfig as AuthConfigWithDefaults & { clientId: string };\n};\n\n/**\n * Applies basePath to URLs based on URL_CONFIG rules\n */\nfunction applyBasePathToUrls(\n  authConfig: AuthConfig,\n  basePath: string,\n): Partial<AuthConfig> {\n  const defaultUrlsWithBasePath: Record<string, string> = {};\n\n  if (!basePath) return defaultUrlsWithBasePath;\n\n  Object.entries(URL_CONFIG).forEach(([key, config]) => {\n    // Skip if explicitly set in authConfig\n    const currentValue = authConfig[key as keyof AuthConfig];\n    if (\n      currentValue !== undefined &&\n      !(config.checkEmpty && currentValue === \"\")\n    ) {\n      return;\n    }\n\n    // Apply basePath based on config rules\n    const urlValue = config.useBasePathOnly\n      ? basePath\n      : `${basePath}${config.defaultPath}`;\n\n    defaultUrlsWithBasePath[key] = urlValue;\n  });\n\n  return defaultUrlsWithBasePath as Partial<AuthConfig>;\n}\n\n/**\n * Creates a Next.js plugin that handles auth configuration.\n *\n * This is the main configuration point for the auth system.\n * Do not set _civic_auth_* environment variables directly - instead,\n * pass your configuration here.\n *\n * The only required field is clientId.\n *\n * Notes:\n * - If you provide explicit URLs, they will be used exactly as provided.\n * - Default URLs will automatically include the basePath from your Next.js config.\n *\n * @example\n * ```js\n * // next.config.js\n * export default createCivicAuthPlugin({\n *  clientId: 'my-client-id',\n * });\n * ```\n *\n * @example\n * ```js\n * // next.config.js\n * export default createCivicAuthPlugin({\n *   clientId: 'my-client-id',\n *   callbackUrl: '/custom/callback',\n *   loginUrl: '/custom/login',\n *   logoutUrl: '/custom/logout',\n *   logoutCallbackUrl: '/custom/logoutcallback',\n *   include: ['/protected/*'],\n *   exclude: ['/public/*']\n * })\n * ```\n *\n * The plugin sets internal environment variables that are used by\n * the auth system. These variables should not be set manually.\n */\nexport const createCivicAuthPlugin = (authConfig: AuthConfig) => {\n  return (nextConfig?: NextConfig) => {\n    logger.debug(\n      \"createCivicAuthPlugin nextConfig\",\n      JSON.stringify(nextConfig, null, 2),\n    );\n\n    // Extract basePath from Next.js config\n    const basePath = sanitizeBasePath(nextConfig?.basePath || \"\");\n\n    // Apply basePath to URLs using the configuration mapping\n    const defaultUrlsWithBasePath = applyBasePathToUrls(authConfig, basePath);\n\n    // Create final config with basePath and possibly modified URLs\n    const resolvedConfig = resolveAuthConfig({\n      ...defaultUrlsWithBasePath,\n      ...authConfig,\n      basePath,\n    });\n\n    return {\n      ...nextConfig,\n      env: {\n        ...nextConfig?.env,\n        // Internal environment variables - do not set these manually\n        _civic_auth_client_id: resolvedConfig.clientId,\n        _civic_oauth_server: resolvedConfig.oauthServer,\n        _civic_auth_callback_url: resolvedConfig.callbackUrl,\n        _civic_auth_login_success_url: resolvedConfig.loginSuccessUrl,\n        _civic_auth_challenge_url: resolvedConfig.challengeUrl,\n        _civic_auth_login_url: resolvedConfig.loginUrl,\n        _civic_auth_login_init_url: resolvedConfig.loginInitUrl,\n        _civic_auth_logout_url: resolvedConfig.logoutUrl,\n        _civic_auth_logout_callback_url: resolvedConfig.logoutCallbackUrl,\n        _civic_auth_refresh_url: resolvedConfig.refreshUrl,\n        _civic_auth_user_url: resolvedConfig.userUrl,\n        _civic_auth_clear_session_url: resolvedConfig.clearSessionUrl,\n        _civic_auth_includes: resolvedConfig.include.join(\",\"),\n        _civic_auth_excludes: resolvedConfig.exclude.join(\",\"),\n        _civic_auth_cookie_config: JSON.stringify(resolvedConfig.cookies),\n        _civic_auth_base_path: resolvedConfig.basePath,\n        _civic_auth_base_url: resolvedConfig.baseUrl,\n        _civic_auth_auto_redirect: resolvedConfig.autoRedirect.toString(),\n        _civic_auth_disable_refresh: resolvedConfig.disableRefresh?.toString(),\n        _civic_auth_deep_link_handling: resolvedConfig.deepLinkHandling,\n      },\n    };\n  };\n};\n"]}

package/dist/nextjs/hooks/useInitialAuthConfig.d.ts.map

@@ -1 +1 @@
-{"version":3,"file":"useInitialAuthConfig.d.ts","sourceRoot":"","sources":["../../../src/nextjs/hooks/useInitialAuthConfig.ts"],"names":[],"mappings":"AASA,OAAO,KAAK,EAAE,gBAAgB,EAAE,MAAM,qCAAqC,CAAC;AAC5E,OAAO,KAAK,EACV,aAAa,EACb,oBAAoB,EACrB,MAAM,qCAAqC,CAAC;AAC7C,OAAO,KAAK,EAAE,IAAI,EAAE,UAAU,EAAE,MAAM,YAAY,CAAC;AAKnD,MAAM,WAAW,2BAA2B;IAC1C,WAAW,CAAC,EAAE,oBAAoB,CAAC;IACnC,UAAU,CAAC,EAAE,UAAU,CAAC;IACxB,UAAU,CAAC,EAAE,IAAI,GAAG,IAAI,CAAC;IACzB,KAAK,CAAC,EAAE,MAAM,CAAC;IACf,sBAAsB,CAAC,EAAE,WAAW,GAAG,MAAM,CAAC;IAC9C,WAAW,CAAC,EAAE,MAAM,CAAC;IACrB,eAAe,CAAC,EAAE,MAAM,CAAC;IACzB,WAAW,CAAC,EAAE,CAAC,GAAG,EAAE,MAAM,EAAE,MAAM,CAAC,EAAE,MAAM,KAAK,IAAI,CAAC;IACrD,OAAO,CAAC,EAAE,aAAa,CAAC;IACxB,cAAc,CAAC,EAAE,OAAO,CAAC;CAC1B;AAED,MAAM,WAAW,6BAA6B;IAC5C,WAAW,CAAC,EAAE,oBAAoB,CAAC;IACnC,UAAU,CAAC,EAAE,UAAU,CAAC;IACxB,QAAQ,CAAC,EAAE,MAAM,CAAC;IAClB,WAAW,CAAC,EAAE,MAAM,CAAC;IACrB,iBAAiB,CAAC,EAAE,MAAM,CAAC;IAC3B,sBAAsB,CAAC,EAAE,MAAM,CAAC;CACjC;AAED;;;GAGG;AACH,eAAO,MAAM,oBAAoB,aACtB,2BAA2B,KACnC;IACD,aAAa,EAAE,gBAAgB,CAAC;IAChC,yBAAyB,EAAE,CACzB,SAAS,CAAC,EAAE,6BAA6B,KACtC,gBAAgB,CAAC;IACtB,SAAS,EAAE,MAAM,CAAC;IAClB,YAAY,EAAE,OAAO,CAAC;CAiKvB,CAAC"}
+{"version":3,"file":"useInitialAuthConfig.d.ts","sourceRoot":"","sources":["../../../src/nextjs/hooks/useInitialAuthConfig.ts"],"names":[],"mappings":"AASA,OAAO,KAAK,EAAE,gBAAgB,EAAE,MAAM,qCAAqC,CAAC;AAC5E,OAAO,KAAK,EACV,aAAa,EACb,oBAAoB,EACrB,MAAM,qCAAqC,CAAC;AAC7C,OAAO,KAAK,EAAE,IAAI,EAAE,UAAU,EAAE,MAAM,YAAY,CAAC;AAKnD,MAAM,WAAW,2BAA2B;IAC1C,WAAW,CAAC,EAAE,oBAAoB,CAAC;IACnC,UAAU,CAAC,EAAE,UAAU,CAAC;IACxB,UAAU,CAAC,EAAE,IAAI,GAAG,IAAI,CAAC;IACzB,KAAK,CAAC,EAAE,MAAM,CAAC;IACf,sBAAsB,CAAC,EAAE,WAAW,GAAG,MAAM,CAAC;IAC9C,WAAW,CAAC,EAAE,MAAM,CAAC;IACrB,eAAe,CAAC,EAAE,MAAM,CAAC;IACzB,WAAW,CAAC,EAAE,CAAC,GAAG,EAAE,MAAM,EAAE,MAAM,CAAC,EAAE,MAAM,KAAK,IAAI,CAAC;IACrD,OAAO,CAAC,EAAE,aAAa,CAAC;IACxB,cAAc,CAAC,EAAE,OAAO,CAAC;CAC1B;AAED,MAAM,WAAW,6BAA6B;IAC5C,WAAW,CAAC,EAAE,oBAAoB,CAAC;IACnC,UAAU,CAAC,EAAE,UAAU,CAAC;IACxB,QAAQ,CAAC,EAAE,MAAM,CAAC;IAClB,WAAW,CAAC,EAAE,MAAM,CAAC;IACrB,iBAAiB,CAAC,EAAE,MAAM,CAAC;IAC3B,sBAAsB,CAAC,EAAE,MAAM,CAAC;CACjC;AAED;;;GAGG;AACH,eAAO,MAAM,oBAAoB,aACtB,2BAA2B,KACnC;IACD,aAAa,EAAE,gBAAgB,CAAC;IAChC,yBAAyB,EAAE,CACzB,SAAS,CAAC,EAAE,6BAA6B,KACtC,gBAAgB,CAAC;IACtB,SAAS,EAAE,MAAM,CAAC;IAClB,YAAY,EAAE,OAAO,CAAC;CAkKvB,CAAC"}

package/dist/nextjs/hooks/useInitialAuthConfig.js

@@ -81,7 +81,7 @@ export const useInitialAuthConfig = (options = {}) => {
                     }, 100);
                 });
             },
-            onSignIn: async ({ error }) => {
+            onSignIn: async ({ error, redirectUrl }) => {
                 if (error) {
                     loggers.nextjs.hooks.error("onSignIn: Error signing in", error);
                     return;
@@ -90,9 +90,10 @@ export const useInitialAuthConfig = (options = {}) => {
                 try {
                     // Trigger server-side revalidation to force NextAuthProvider to re-run
                     await revalidateUserData(pathname);
-                    // Navigate if needed
-                    if (loginSuccessUrl && loginSuccessUrl !== pathname) {
-                        router.push(loginSuccessUrl);
+                    // Navigate to the deep link (redirectUrl) if available, otherwise fall back to loginSuccessUrl
+                    const targetUrl = redirectUrl || loginSuccessUrl;
+                    if (targetUrl && targetUrl !== pathname) {
+                        router.push(targetUrl);
                     }
                 }
                 catch (revalidateError) {

package/dist/nextjs/hooks/useInitialAuthConfig.js.map

@@ -1 +1 @@
-{"version":3,"file":"useInitialAuthConfig.js","sourceRoot":"","sources":["../../../src/nextjs/hooks/useInitialAuthConfig.ts"],"names":[],"mappings":"AAAA;;;GAGG;AACH,YAAY,CAAC;AAEb,OAAO,EAAE,OAAO,EAAE,QAAQ,EAAE,MAAM,OAAO,CAAC;AAC1C,OAAO,EAAE,SAAS,EAAE,WAAW,EAAE,MAAM,oBAAoB,CAAC;AAC5D,OAAO,EAAE,iBAAiB,EAAE,MAAM,oBAAoB,CAAC;AAOvD,OAAO,EAAE,oBAAoB,EAAE,MAAM,mBAAmB,CAAC;AACzD,OAAO,EAAE,OAAO,EAAE,MAAM,iBAAiB,CAAC;AAC1C,OAAO,EAAE,kBAAkB,EAAE,MAAM,eAAe,CAAC;AAwBnD;;;GAGG;AACH,MAAM,CAAC,MAAM,oBAAoB,GAAG,CAClC,UAAuC,EAAE,EAQzC,EAAE;IACF,MAAM,MAAM,GAAG,SAAS,EAAE,CAAC;IAC3B,MAAM,QAAQ,GAAG,WAAW,EAAE,CAAC;IAC/B,MAAM,cAAc,GAAG,iBAAiB,CAAC,OAAO,CAAC,CAAC;IAClD,0EAA0E;IAC1E,yEAAyE;IACzE,MAAM,CAAC,YAAY,EAAE,eAAe,CAAC,GAAG,QAAQ,CAAU,KAAK,CAAC,CAAC;IACjE,MAAM,EACJ,QAAQ,EACR,WAAW,EACX,eAAe,EACf,YAAY,EACZ,SAAS,EACT,UAAU,EACV,OAAO,EACP,eAAe,EACf,iBAAiB,EACjB,WAAW,EACX,sBAAsB,EACtB,QAAQ,GACT,GAAG,cAAc,CAAC;IAEnB,MAAM,UAAU,GAAqB,OAAO,CAAC,GAAG,EAAE;QAChD,OAAO;YACL,cAAc,EAAE,OAAO,CAAC,cAAc;YACtC,0EAA0E;YAC1E,qEAAqE;YACrE,OAAO,EAAE,IAAI,oBAAoB,CAAC,EAAE,IAAI,EAAE,QAAQ,IAAI,GAAG,EAAE,CAAC;YAC5D,QAAQ,EAAE,QAAQ;YAClB,QAAQ,EACN,OAAO,MAAM,KAAK,WAAW;gBAC3B,CAAC,CAAC,MAAM,CAAC,QAAQ,CAAC,MAAM,GAAG,YAAY;gBACvC,CAAC,CAAC,SAAS;YACf,WAAW,EACT,OAAO,MAAM,KAAK,WAAW;gBAC3B,CAAC,CAAC,MAAM,CAAC,QAAQ,CAAC,MAAM,GAAG,WAAW;gBACtC,CAAC,CAAC,SAAS;YACf,MAAM,EAAE;gBACN,WAAW,EAAE,WAAW;gBACxB,kBAAkB,EAAE,WAAW;aAChC;YACD,iBAAiB,EAAE,iBAAiB;YACpC,eAAe,EAAE,eAAe;YAChC,sBAAsB,EAAE,sBAAsB;YAC9C,WAAW,EAAE,OAAO,CAAC,WAAW;YAChC,UAAU,EAAE,OAAO,CAAC,UAAU;YAC9B,iBAAiB,EAAE,iBAAiB;YACpC,SAAS,EAAE,QAAQ;YACnB,OAAO,EAAE,OAAO,CAAC,OAAO;YACxB,gBAAgB,EAAE;gBAChB,IAAI,EAAE,OAAO;gBACb,OAAO,EAAE,UAAU;gBACnB,MAAM,EAAE,SAAS;gBACjB,YAAY,EAAE,eAAe;aAC9B;YACD,SAAS,EAAE,KAAK,IAAI,EAAE;gBACpB,eAAe,CAAC,IAAI,CAAC,CAAC;gBACtB,MAAM,IAAI,OAAO,CAAC,CAAC,OAAO,EAAE,EAAE;oBAC5B,UAAU,CAAC,KAAK,IAAI,EAAE;wBACpB,IAAI,CAAC;4BACH,uEAAuE;4BACvE,MAAM,kBAAkB,CAAC,QAAQ,CAAC,CAAC;wBACrC,CAAC;wBAAC,OAAO,eAAe,EAAE,CAAC;4BACzB,OAAO,CAAC,KAAK,CAAC,gCAAgC,EAAE,eAAe,CAAC,CAAC;4BACjE,sDAAsD;4BACtD,MAAM,CAAC,OAAO,EAAE,CAAC;wBACnB,CAAC;wBACD,OAAO,CAAC,IAAI,CAAC,CAAC;oBAChB,CAAC,EAAE,GAAG,CAAC,CAAC;gBACV,CAAC,CAAC,CAAC;YACL,CAAC;YACD,SAAS,EAAE,KAAK,EAAE,KAAK,EAAE,EAAE;gBACzB,IAAI,KAAK,EAAE,CAAC;oBACV,OAAO,CAAC,MAAM,CAAC,KAAK,CAAC,KAAK,CAAC,6BAA6B,EAAE,KAAK,CAAC,CAAC;gBACnE,CAAC;gBACD,eAAe,CAAC,KAAK,CAAC,CAAC;gBAEvB,MAAM,IAAI,OAAO,CAAC,CAAC,OAAO,EAAE,EAAE;oBAC5B,UAAU,CAAC,KAAK,IAAI,EAAE;wBACpB,MAAM,CAAC,OAAO,EAAE,CAAC;wBACjB,OAAO,CAAC,IAAI,CAAC,CAAC;oBAChB,CAAC,EAAE,GAAG,CAAC,CAAC;gBACV,CAAC,CAAC,CAAC;YACL,CAAC;YACD,QAAQ,EAAE,KAAK,EAAE,EAAE,KAAK,EAAE,EAAE,EAAE;gBAC5B,IAAI,KAAK,EAAE,CAAC;oBACV,OAAO,CAAC,MAAM,CAAC,KAAK,CAAC,KAAK,CAAC,4BAA4B,EAAE,KAAK,CAAC,CAAC;oBAChE,OAAO;gBACT,CAAC;gBACD,eAAe,CAAC,KAAK,CAAC,CAAC;gBACvB,IAAI,CAAC;oBACH,uEAAuE;oBACvE,MAAM,kBAAkB,CAAC,QAAQ,CAAC,CAAC;oBACnC,qBAAqB;oBACrB,IAAI,eAAe,IAAI,eAAe,KAAK,QAAQ,EAAE,CAAC;wBACpD,MAAM,CAAC,IAAI,CAAC,eAAe,CAAC,CAAC;oBAC/B,CAAC;gBACH,CAAC;gBAAC,OAAO,eAAe,EAAE,CAAC;oBACzB,OAAO,CAAC,KAAK,CAAC,gCAAgC,EAAE,eAAe,CAAC,CAAC;oBACjE,sDAAsD;oBACtD,MAAM,CAAC,OAAO,EAAE,CAAC;gBACnB,CAAC;YACH,CAAC;YACD,WAAW,EAAE,OAAO,CAAC,WAAW;YAChC,WAAW,EAAE,CAAC,CAAC,YAAY,IAAI,OAAO,CAAC,UAAU,CAAC,IAAI,IAAI;YAC1D,cAAc,EAAE,IAAI,EAAE,0CAA0C;SACjE,CAAC;IACJ,CAAC,EAAE;QACD,OAAO,CAAC,cAAc;QACtB,OAAO,CAAC,WAAW;QACnB,OAAO,CAAC,UAAU;QAClB,OAAO,CAAC,OAAO;QACf,OAAO,CAAC,WAAW;QACnB,OAAO,CAAC,UAAU;QAClB,QAAQ;QACR,YAAY;QACZ,WAAW;QACX,WAAW;QACX,iBAAiB;QACjB,eAAe;QACf,sBAAsB;QACtB,OAAO;QACP,UAAU;QACV,SAAS;QACT,eAAe;QACf,QAAQ;QACR,YAAY;QACZ,QAAQ;QACR,MAAM;KACP,CAAC,CAAC;IAEH,MAAM,yBAAyB,GAAG,OAAO,CAAC,GAAG,EAAE;QAC7C,OAAO,CACL,YAA2C,EAAE,EAC3B,EAAE;YACpB,OAAO;gBACL,GAAG,UAAU;gBACb,6DAA6D;gBAC7D,GAAG,CAAC,SAAS,CAAC,WAAW,IAAI,EAAE,WAAW,EAAE,SAAS,CAAC,WAAW,EAAE,CAAC;gBACpE,GAAG,CAAC,SAAS,CAAC,UAAU,KAAK,SAAS,IAAI;oBACxC,UAAU,EAAE,SAAS,CAAC,UAAU;iBACjC,CAAC;gBACF,GAAG,CAAC,SAAS,CAAC,QAAQ,IAAI,EAAE,QAAQ,EAAE,SAAS,CAAC,QAAQ,EAAE,CAAC;gBAC3D,GAAG,CAAC,SAAS,CAAC,WAAW,IAAI,EAAE,WAAW,EAAE,SAAS,CAAC,WAAW,EAAE,CAAC;gBACpE,GAAG,CAAC,SAAS,CAAC,iBAAiB,IAAI;oBACjC,iBAAiB,EAAE,SAAS,CAAC,iBAAiB;iBAC/C,CAAC;gBACF,GAAG,CAAC,SAAS,CAAC,sBAAsB,IAAI;oBACtC,sBAAsB,EAAE,SAAS,CAAC,sBAAsB;iBACzD,CAAC;aACH,CAAC;QACJ,CAAC,CAAC;IACJ,CAAC,EAAE,CAAC,UAAU,CAAC,CAAC,CAAC;IAEjB,OAAO;QACL,aAAa,EAAE,UAAU;QACzB,yBAAyB;QACzB,SAAS;QACT,YAAY;KACb,CAAC;AACJ,CAAC,CAAC","sourcesContent":["/**\n * Hook for creating the initial auth configuration\n * Reusable across NextJS components that need to initialize GlobalAuthManager\n */\n\"use client\";\n\nimport { useMemo, useState } from \"react\";\nimport { useRouter, usePathname } from \"next/navigation.js\";\nimport { resolveAuthConfig } from \"@/nextjs/config.js\";\nimport type { GlobalAuthConfig } from \"@/reactjs/core/GlobalAuthManager.js\";\nimport type {\n  LoggingConfig,\n  VanillaJSDisplayMode,\n} from \"@/vanillajs/auth/types/AuthTypes.js\";\nimport type { User, IframeMode } from \"@/types.js\";\nimport { BrowserCookieStorage } from \"@/shared/index.js\";\nimport { loggers } from \"@/lib/logger.js\";\nimport { revalidateUserData } from \"../actions.js\";\n\nexport interface UseInitialAuthConfigOptions {\n  displayMode?: VanillaJSDisplayMode;\n  iframeMode?: IframeMode;\n  serverUser?: User | null;\n  nonce?: string;\n  targetContainerElement?: HTMLElement | string;\n  oauthServer?: string;\n  loginSuccessUrl?: string;\n  onUrlChange?: (url: string, source?: string) => void;\n  logging?: LoggingConfig;\n  disableRefresh?: boolean;\n}\n\nexport interface UseInitialAuthConfigOverrides {\n  displayMode?: VanillaJSDisplayMode;\n  iframeMode?: IframeMode;\n  clientId?: string;\n  redirectUrl?: string;\n  logoutRedirectUrl?: string;\n  targetContainerElement?: string;\n}\n\n/**\n * Hook that creates the initial auth configuration\n * Can be used standalone or merged with overrides\n */\nexport const useInitialAuthConfig = (\n  options: UseInitialAuthConfigOptions = {},\n): {\n  initialConfig: GlobalAuthConfig;\n  createConfigWithOverrides: (\n    overrides?: UseInitialAuthConfigOverrides,\n  ) => GlobalAuthConfig;\n  logoutUrl: string;\n  hasSignedOut: boolean;\n} => {\n  const router = useRouter();\n  const pathname = usePathname();\n  const resolvedConfig = resolveAuthConfig(options);\n  // Force a re-render when the page gets re-rendered after sign-in/sign-out\n  // so that client-side hooks and event listeners are properly initialized\n  const [hasSignedOut, setHasSignedOut] = useState<boolean>(false);\n  const {\n    clientId,\n    oauthServer,\n    loginSuccessUrl,\n    loginInitUrl,\n    logoutUrl,\n    refreshUrl,\n    userUrl,\n    clearSessionUrl,\n    logoutCallbackUrl,\n    callbackUrl,\n    targetContainerElement,\n    basePath,\n  } = resolvedConfig;\n\n  const baseConfig: GlobalAuthConfig = useMemo(() => {\n    return {\n      disableRefresh: options.disableRefresh,\n      // we need this to retrieve client-available cookies for auto-refresh etc.\n      // Pass basePath to ensure cookies are set/read with the correct path\n      storage: new BrowserCookieStorage({ path: basePath || \"/\" }),\n      clientId: clientId,\n      loginUrl:\n        typeof window !== \"undefined\"\n          ? window.location.origin + loginInitUrl\n          : undefined,\n      redirectUrl:\n        typeof window !== \"undefined\"\n          ? window.location.origin + callbackUrl\n          : undefined,\n      config: {\n        oauthServer: oauthServer,\n        oauthServerBaseUrl: oauthServer,\n      },\n      logoutRedirectUrl: logoutCallbackUrl,\n      loginSuccessUrl: loginSuccessUrl,\n      targetContainerElement: targetContainerElement,\n      displayMode: options.displayMode,\n      iframeMode: options.iframeMode,\n      logoutCallbackUrl: logoutCallbackUrl,\n      framework: \"nextjs\",\n      logging: options.logging,\n      backendEndpoints: {\n        user: userUrl,\n        refresh: refreshUrl,\n        logout: logoutUrl,\n        clearSession: clearSessionUrl,\n      },\n      onSignOut: async () => {\n        setHasSignedOut(true);\n        await new Promise((resolve) => {\n          setTimeout(async () => {\n            try {\n              // Trigger server-side revalidation to force NextAuthProvider to re-run\n              await revalidateUserData(pathname);\n            } catch (revalidateError) {\n              console.error(\"onSignIn: Revalidation failed:\", revalidateError);\n              // Fallback to router.refresh() if server action fails\n              router.refresh();\n            }\n            resolve(true);\n          }, 100);\n        });\n      },\n      onRefresh: async (error) => {\n        if (error) {\n          loggers.nextjs.hooks.error(\"onRefresh: Error refreshing\", error);\n        }\n        setHasSignedOut(false);\n\n        await new Promise((resolve) => {\n          setTimeout(async () => {\n            router.refresh();\n            resolve(true);\n          }, 100);\n        });\n      },\n      onSignIn: async ({ error }) => {\n        if (error) {\n          loggers.nextjs.hooks.error(\"onSignIn: Error signing in\", error);\n          return;\n        }\n        setHasSignedOut(false);\n        try {\n          // Trigger server-side revalidation to force NextAuthProvider to re-run\n          await revalidateUserData(pathname);\n          // Navigate if needed\n          if (loginSuccessUrl && loginSuccessUrl !== pathname) {\n            router.push(loginSuccessUrl);\n          }\n        } catch (revalidateError) {\n          console.error(\"onSignIn: Revalidation failed:\", revalidateError);\n          // Fallback to router.refresh() if server action fails\n          router.refresh();\n        }\n      },\n      onUrlChange: options.onUrlChange,\n      initialUser: (!hasSignedOut && options.serverUser) || null,\n      initialIdToken: null, // ID token is httpOnly and not accessible\n    };\n  }, [\n    options.disableRefresh,\n    options.displayMode,\n    options.iframeMode,\n    options.logging,\n    options.onUrlChange,\n    options.serverUser,\n    clientId,\n    loginInitUrl,\n    callbackUrl,\n    oauthServer,\n    logoutCallbackUrl,\n    loginSuccessUrl,\n    targetContainerElement,\n    userUrl,\n    refreshUrl,\n    logoutUrl,\n    clearSessionUrl,\n    basePath,\n    hasSignedOut,\n    pathname,\n    router,\n  ]);\n\n  const createConfigWithOverrides = useMemo(() => {\n    return (\n      overrides: UseInitialAuthConfigOverrides = {},\n    ): GlobalAuthConfig => {\n      return {\n        ...baseConfig,\n        // Override specific properties while keeping the base config\n        ...(overrides.displayMode && { displayMode: overrides.displayMode }),\n        ...(overrides.iframeMode !== undefined && {\n          iframeMode: overrides.iframeMode,\n        }),\n        ...(overrides.clientId && { clientId: overrides.clientId }),\n        ...(overrides.redirectUrl && { redirectUrl: overrides.redirectUrl }),\n        ...(overrides.logoutRedirectUrl && {\n          logoutRedirectUrl: overrides.logoutRedirectUrl,\n        }),\n        ...(overrides.targetContainerElement && {\n          targetContainerElement: overrides.targetContainerElement,\n        }),\n      };\n    };\n  }, [baseConfig]);\n\n  return {\n    initialConfig: baseConfig,\n    createConfigWithOverrides,\n    logoutUrl,\n    hasSignedOut,\n  };\n};\n"]}
+{"version":3,"file":"useInitialAuthConfig.js","sourceRoot":"","sources":["../../../src/nextjs/hooks/useInitialAuthConfig.ts"],"names":[],"mappings":"AAAA;;;GAGG;AACH,YAAY,CAAC;AAEb,OAAO,EAAE,OAAO,EAAE,QAAQ,EAAE,MAAM,OAAO,CAAC;AAC1C,OAAO,EAAE,SAAS,EAAE,WAAW,EAAE,MAAM,oBAAoB,CAAC;AAC5D,OAAO,EAAE,iBAAiB,EAAE,MAAM,oBAAoB,CAAC;AAOvD,OAAO,EAAE,oBAAoB,EAAE,MAAM,mBAAmB,CAAC;AACzD,OAAO,EAAE,OAAO,EAAE,MAAM,iBAAiB,CAAC;AAC1C,OAAO,EAAE,kBAAkB,EAAE,MAAM,eAAe,CAAC;AAwBnD;;;GAGG;AACH,MAAM,CAAC,MAAM,oBAAoB,GAAG,CAClC,UAAuC,EAAE,EAQzC,EAAE;IACF,MAAM,MAAM,GAAG,SAAS,EAAE,CAAC;IAC3B,MAAM,QAAQ,GAAG,WAAW,EAAE,CAAC;IAC/B,MAAM,cAAc,GAAG,iBAAiB,CAAC,OAAO,CAAC,CAAC;IAClD,0EAA0E;IAC1E,yEAAyE;IACzE,MAAM,CAAC,YAAY,EAAE,eAAe,CAAC,GAAG,QAAQ,CAAU,KAAK,CAAC,CAAC;IACjE,MAAM,EACJ,QAAQ,EACR,WAAW,EACX,eAAe,EACf,YAAY,EACZ,SAAS,EACT,UAAU,EACV,OAAO,EACP,eAAe,EACf,iBAAiB,EACjB,WAAW,EACX,sBAAsB,EACtB,QAAQ,GACT,GAAG,cAAc,CAAC;IAEnB,MAAM,UAAU,GAAqB,OAAO,CAAC,GAAG,EAAE;QAChD,OAAO;YACL,cAAc,EAAE,OAAO,CAAC,cAAc;YACtC,0EAA0E;YAC1E,qEAAqE;YACrE,OAAO,EAAE,IAAI,oBAAoB,CAAC,EAAE,IAAI,EAAE,QAAQ,IAAI,GAAG,EAAE,CAAC;YAC5D,QAAQ,EAAE,QAAQ;YAClB,QAAQ,EACN,OAAO,MAAM,KAAK,WAAW;gBAC3B,CAAC,CAAC,MAAM,CAAC,QAAQ,CAAC,MAAM,GAAG,YAAY;gBACvC,CAAC,CAAC,SAAS;YACf,WAAW,EACT,OAAO,MAAM,KAAK,WAAW;gBAC3B,CAAC,CAAC,MAAM,CAAC,QAAQ,CAAC,MAAM,GAAG,WAAW;gBACtC,CAAC,CAAC,SAAS;YACf,MAAM,EAAE;gBACN,WAAW,EAAE,WAAW;gBACxB,kBAAkB,EAAE,WAAW;aAChC;YACD,iBAAiB,EAAE,iBAAiB;YACpC,eAAe,EAAE,eAAe;YAChC,sBAAsB,EAAE,sBAAsB;YAC9C,WAAW,EAAE,OAAO,CAAC,WAAW;YAChC,UAAU,EAAE,OAAO,CAAC,UAAU;YAC9B,iBAAiB,EAAE,iBAAiB;YACpC,SAAS,EAAE,QAAQ;YACnB,OAAO,EAAE,OAAO,CAAC,OAAO;YACxB,gBAAgB,EAAE;gBAChB,IAAI,EAAE,OAAO;gBACb,OAAO,EAAE,UAAU;gBACnB,MAAM,EAAE,SAAS;gBACjB,YAAY,EAAE,eAAe;aAC9B;YACD,SAAS,EAAE,KAAK,IAAI,EAAE;gBACpB,eAAe,CAAC,IAAI,CAAC,CAAC;gBACtB,MAAM,IAAI,OAAO,CAAC,CAAC,OAAO,EAAE,EAAE;oBAC5B,UAAU,CAAC,KAAK,IAAI,EAAE;wBACpB,IAAI,CAAC;4BACH,uEAAuE;4BACvE,MAAM,kBAAkB,CAAC,QAAQ,CAAC,CAAC;wBACrC,CAAC;wBAAC,OAAO,eAAe,EAAE,CAAC;4BACzB,OAAO,CAAC,KAAK,CAAC,gCAAgC,EAAE,eAAe,CAAC,CAAC;4BACjE,sDAAsD;4BACtD,MAAM,CAAC,OAAO,EAAE,CAAC;wBACnB,CAAC;wBACD,OAAO,CAAC,IAAI,CAAC,CAAC;oBAChB,CAAC,EAAE,GAAG,CAAC,CAAC;gBACV,CAAC,CAAC,CAAC;YACL,CAAC;YACD,SAAS,EAAE,KAAK,EAAE,KAAK,EAAE,EAAE;gBACzB,IAAI,KAAK,EAAE,CAAC;oBACV,OAAO,CAAC,MAAM,CAAC,KAAK,CAAC,KAAK,CAAC,6BAA6B,EAAE,KAAK,CAAC,CAAC;gBACnE,CAAC;gBACD,eAAe,CAAC,KAAK,CAAC,CAAC;gBAEvB,MAAM,IAAI,OAAO,CAAC,CAAC,OAAO,EAAE,EAAE;oBAC5B,UAAU,CAAC,KAAK,IAAI,EAAE;wBACpB,MAAM,CAAC,OAAO,EAAE,CAAC;wBACjB,OAAO,CAAC,IAAI,CAAC,CAAC;oBAChB,CAAC,EAAE,GAAG,CAAC,CAAC;gBACV,CAAC,CAAC,CAAC;YACL,CAAC;YACD,QAAQ,EAAE,KAAK,EAAE,EAAE,KAAK,EAAE,WAAW,EAAE,EAAE,EAAE;gBACzC,IAAI,KAAK,EAAE,CAAC;oBACV,OAAO,CAAC,MAAM,CAAC,KAAK,CAAC,KAAK,CAAC,4BAA4B,EAAE,KAAK,CAAC,CAAC;oBAChE,OAAO;gBACT,CAAC;gBACD,eAAe,CAAC,KAAK,CAAC,CAAC;gBACvB,IAAI,CAAC;oBACH,uEAAuE;oBACvE,MAAM,kBAAkB,CAAC,QAAQ,CAAC,CAAC;oBACnC,+FAA+F;oBAC/F,MAAM,SAAS,GAAG,WAAW,IAAI,eAAe,CAAC;oBACjD,IAAI,SAAS,IAAI,SAAS,KAAK,QAAQ,EAAE,CAAC;wBACxC,MAAM,CAAC,IAAI,CAAC,SAAS,CAAC,CAAC;oBACzB,CAAC;gBACH,CAAC;gBAAC,OAAO,eAAe,EAAE,CAAC;oBACzB,OAAO,CAAC,KAAK,CAAC,gCAAgC,EAAE,eAAe,CAAC,CAAC;oBACjE,sDAAsD;oBACtD,MAAM,CAAC,OAAO,EAAE,CAAC;gBACnB,CAAC;YACH,CAAC;YACD,WAAW,EAAE,OAAO,CAAC,WAAW;YAChC,WAAW,EAAE,CAAC,CAAC,YAAY,IAAI,OAAO,CAAC,UAAU,CAAC,IAAI,IAAI;YAC1D,cAAc,EAAE,IAAI,EAAE,0CAA0C;SACjE,CAAC;IACJ,CAAC,EAAE;QACD,OAAO,CAAC,cAAc;QACtB,OAAO,CAAC,WAAW;QACnB,OAAO,CAAC,UAAU;QAClB,OAAO,CAAC,OAAO;QACf,OAAO,CAAC,WAAW;QACnB,OAAO,CAAC,UAAU;QAClB,QAAQ;QACR,YAAY;QACZ,WAAW;QACX,WAAW;QACX,iBAAiB;QACjB,eAAe;QACf,sBAAsB;QACtB,OAAO;QACP,UAAU;QACV,SAAS;QACT,eAAe;QACf,QAAQ;QACR,YAAY;QACZ,QAAQ;QACR,MAAM;KACP,CAAC,CAAC;IAEH,MAAM,yBAAyB,GAAG,OAAO,CAAC,GAAG,EAAE;QAC7C,OAAO,CACL,YAA2C,EAAE,EAC3B,EAAE;YACpB,OAAO;gBACL,GAAG,UAAU;gBACb,6DAA6D;gBAC7D,GAAG,CAAC,SAAS,CAAC,WAAW,IAAI,EAAE,WAAW,EAAE,SAAS,CAAC,WAAW,EAAE,CAAC;gBACpE,GAAG,CAAC,SAAS,CAAC,UAAU,KAAK,SAAS,IAAI;oBACxC,UAAU,EAAE,SAAS,CAAC,UAAU;iBACjC,CAAC;gBACF,GAAG,CAAC,SAAS,CAAC,QAAQ,IAAI,EAAE,QAAQ,EAAE,SAAS,CAAC,QAAQ,EAAE,CAAC;gBAC3D,GAAG,CAAC,SAAS,CAAC,WAAW,IAAI,EAAE,WAAW,EAAE,SAAS,CAAC,WAAW,EAAE,CAAC;gBACpE,GAAG,CAAC,SAAS,CAAC,iBAAiB,IAAI;oBACjC,iBAAiB,EAAE,SAAS,CAAC,iBAAiB;iBAC/C,CAAC;gBACF,GAAG,CAAC,SAAS,CAAC,sBAAsB,IAAI;oBACtC,sBAAsB,EAAE,SAAS,CAAC,sBAAsB;iBACzD,CAAC;aACH,CAAC;QACJ,CAAC,CAAC;IACJ,CAAC,EAAE,CAAC,UAAU,CAAC,CAAC,CAAC;IAEjB,OAAO;QACL,aAAa,EAAE,UAAU;QACzB,yBAAyB;QACzB,SAAS;QACT,YAAY;KACb,CAAC;AACJ,CAAC,CAAC","sourcesContent":["/**\n * Hook for creating the initial auth configuration\n * Reusable across NextJS components that need to initialize GlobalAuthManager\n */\n\"use client\";\n\nimport { useMemo, useState } from \"react\";\nimport { useRouter, usePathname } from \"next/navigation.js\";\nimport { resolveAuthConfig } from \"@/nextjs/config.js\";\nimport type { GlobalAuthConfig } from \"@/reactjs/core/GlobalAuthManager.js\";\nimport type {\n  LoggingConfig,\n  VanillaJSDisplayMode,\n} from \"@/vanillajs/auth/types/AuthTypes.js\";\nimport type { User, IframeMode } from \"@/types.js\";\nimport { BrowserCookieStorage } from \"@/shared/index.js\";\nimport { loggers } from \"@/lib/logger.js\";\nimport { revalidateUserData } from \"../actions.js\";\n\nexport interface UseInitialAuthConfigOptions {\n  displayMode?: VanillaJSDisplayMode;\n  iframeMode?: IframeMode;\n  serverUser?: User | null;\n  nonce?: string;\n  targetContainerElement?: HTMLElement | string;\n  oauthServer?: string;\n  loginSuccessUrl?: string;\n  onUrlChange?: (url: string, source?: string) => void;\n  logging?: LoggingConfig;\n  disableRefresh?: boolean;\n}\n\nexport interface UseInitialAuthConfigOverrides {\n  displayMode?: VanillaJSDisplayMode;\n  iframeMode?: IframeMode;\n  clientId?: string;\n  redirectUrl?: string;\n  logoutRedirectUrl?: string;\n  targetContainerElement?: string;\n}\n\n/**\n * Hook that creates the initial auth configuration\n * Can be used standalone or merged with overrides\n */\nexport const useInitialAuthConfig = (\n  options: UseInitialAuthConfigOptions = {},\n): {\n  initialConfig: GlobalAuthConfig;\n  createConfigWithOverrides: (\n    overrides?: UseInitialAuthConfigOverrides,\n  ) => GlobalAuthConfig;\n  logoutUrl: string;\n  hasSignedOut: boolean;\n} => {\n  const router = useRouter();\n  const pathname = usePathname();\n  const resolvedConfig = resolveAuthConfig(options);\n  // Force a re-render when the page gets re-rendered after sign-in/sign-out\n  // so that client-side hooks and event listeners are properly initialized\n  const [hasSignedOut, setHasSignedOut] = useState<boolean>(false);\n  const {\n    clientId,\n    oauthServer,\n    loginSuccessUrl,\n    loginInitUrl,\n    logoutUrl,\n    refreshUrl,\n    userUrl,\n    clearSessionUrl,\n    logoutCallbackUrl,\n    callbackUrl,\n    targetContainerElement,\n    basePath,\n  } = resolvedConfig;\n\n  const baseConfig: GlobalAuthConfig = useMemo(() => {\n    return {\n      disableRefresh: options.disableRefresh,\n      // we need this to retrieve client-available cookies for auto-refresh etc.\n      // Pass basePath to ensure cookies are set/read with the correct path\n      storage: new BrowserCookieStorage({ path: basePath || \"/\" }),\n      clientId: clientId,\n      loginUrl:\n        typeof window !== \"undefined\"\n          ? window.location.origin + loginInitUrl\n          : undefined,\n      redirectUrl:\n        typeof window !== \"undefined\"\n          ? window.location.origin + callbackUrl\n          : undefined,\n      config: {\n        oauthServer: oauthServer,\n        oauthServerBaseUrl: oauthServer,\n      },\n      logoutRedirectUrl: logoutCallbackUrl,\n      loginSuccessUrl: loginSuccessUrl,\n      targetContainerElement: targetContainerElement,\n      displayMode: options.displayMode,\n      iframeMode: options.iframeMode,\n      logoutCallbackUrl: logoutCallbackUrl,\n      framework: \"nextjs\",\n      logging: options.logging,\n      backendEndpoints: {\n        user: userUrl,\n        refresh: refreshUrl,\n        logout: logoutUrl,\n        clearSession: clearSessionUrl,\n      },\n      onSignOut: async () => {\n        setHasSignedOut(true);\n        await new Promise((resolve) => {\n          setTimeout(async () => {\n            try {\n              // Trigger server-side revalidation to force NextAuthProvider to re-run\n              await revalidateUserData(pathname);\n            } catch (revalidateError) {\n              console.error(\"onSignIn: Revalidation failed:\", revalidateError);\n              // Fallback to router.refresh() if server action fails\n              router.refresh();\n            }\n            resolve(true);\n          }, 100);\n        });\n      },\n      onRefresh: async (error) => {\n        if (error) {\n          loggers.nextjs.hooks.error(\"onRefresh: Error refreshing\", error);\n        }\n        setHasSignedOut(false);\n\n        await new Promise((resolve) => {\n          setTimeout(async () => {\n            router.refresh();\n            resolve(true);\n          }, 100);\n        });\n      },\n      onSignIn: async ({ error, redirectUrl }) => {\n        if (error) {\n          loggers.nextjs.hooks.error(\"onSignIn: Error signing in\", error);\n          return;\n        }\n        setHasSignedOut(false);\n        try {\n          // Trigger server-side revalidation to force NextAuthProvider to re-run\n          await revalidateUserData(pathname);\n          // Navigate to the deep link (redirectUrl) if available, otherwise fall back to loginSuccessUrl\n          const targetUrl = redirectUrl || loginSuccessUrl;\n          if (targetUrl && targetUrl !== pathname) {\n            router.push(targetUrl);\n          }\n        } catch (revalidateError) {\n          console.error(\"onSignIn: Revalidation failed:\", revalidateError);\n          // Fallback to router.refresh() if server action fails\n          router.refresh();\n        }\n      },\n      onUrlChange: options.onUrlChange,\n      initialUser: (!hasSignedOut && options.serverUser) || null,\n      initialIdToken: null, // ID token is httpOnly and not accessible\n    };\n  }, [\n    options.disableRefresh,\n    options.displayMode,\n    options.iframeMode,\n    options.logging,\n    options.onUrlChange,\n    options.serverUser,\n    clientId,\n    loginInitUrl,\n    callbackUrl,\n    oauthServer,\n    logoutCallbackUrl,\n    loginSuccessUrl,\n    targetContainerElement,\n    userUrl,\n    refreshUrl,\n    logoutUrl,\n    clearSessionUrl,\n    basePath,\n    hasSignedOut,\n    pathname,\n    router,\n  ]);\n\n  const createConfigWithOverrides = useMemo(() => {\n    return (\n      overrides: UseInitialAuthConfigOverrides = {},\n    ): GlobalAuthConfig => {\n      return {\n        ...baseConfig,\n        // Override specific properties while keeping the base config\n        ...(overrides.displayMode && { displayMode: overrides.displayMode }),\n        ...(overrides.iframeMode !== undefined && {\n          iframeMode: overrides.iframeMode,\n        }),\n        ...(overrides.clientId && { clientId: overrides.clientId }),\n        ...(overrides.redirectUrl && { redirectUrl: overrides.redirectUrl }),\n        ...(overrides.logoutRedirectUrl && {\n          logoutRedirectUrl: overrides.logoutRedirectUrl,\n        }),\n        ...(overrides.targetContainerElement && {\n          targetContainerElement: overrides.targetContainerElement,\n        }),\n      };\n    };\n  }, [baseConfig]);\n\n  return {\n    initialConfig: baseConfig,\n    createConfigWithOverrides,\n    logoutUrl,\n    hasSignedOut,\n  };\n};\n"]}

package/dist/nextjs/providers/NextAuthProvider.d.ts

@@ -1,8 +1,5 @@
 import type { AuthProviderProps } from "../../shared/providers/types.js";
 type NextCivicAuthProviderProps = Omit<AuthProviderProps, "clientId" | "onSignIn" | "onSignOut">;
-export declare function CivicNextAuthProvider({ children, ...props }: NextCivicAuthProviderProps & {
-    redirectOnLogin?: string;
-    redirectOnLogout?: string;
-}): Promise<import("react/jsx-runtime").JSX.Element>;
+export declare function CivicNextAuthProvider({ children, ...props }: NextCivicAuthProviderProps): Promise<import("react/jsx-runtime").JSX.Element>;
 export type { NextCivicAuthProviderProps };
 //# sourceMappingURL=NextAuthProvider.d.ts.map

package/dist/nextjs/providers/NextAuthProvider.d.ts.map

@@ -1 +1 @@
-{"version":3,"file":"NextAuthProvider.d.ts","sourceRoot":"","sources":["../../../src/nextjs/providers/NextAuthProvider.tsx"],"names":[],"mappings":"AAIA,OAAO,KAAK,EAAE,iBAAiB,EAAE,MAAM,6BAA6B,CAAC;AAIrE,KAAK,0BAA0B,GAAG,IAAI,CACpC,iBAAiB,EACjB,UAAU,GAAG,UAAU,GAAG,WAAW,CACtC,CAAC;AAGF,wBAAsB,qBAAqB,CAAC,EAC1C,QAAQ,EACR,GAAG,KAAK,EACT,EAAE,0BAA0B,GAAG;IAC9B,eAAe,CAAC,EAAE,MAAM,CAAC;IACzB,gBAAgB,CAAC,EAAE,MAAM,CAAC;CAC3B,oDA2BA;AAGD,YAAY,EAAE,0BAA0B,EAAE,CAAC"}
+{"version":3,"file":"NextAuthProvider.d.ts","sourceRoot":"","sources":["../../../src/nextjs/providers/NextAuthProvider.tsx"],"names":[],"mappings":"AAIA,OAAO,KAAK,EAAE,iBAAiB,EAAE,MAAM,6BAA6B,CAAC;AAIrE,KAAK,0BAA0B,GAAG,IAAI,CACpC,iBAAiB,EACjB,UAAU,GAAG,UAAU,GAAG,WAAW,CACtC,CAAC;AAGF,wBAAsB,qBAAqB,CAAC,EAC1C,QAAQ,EACR,GAAG,KAAK,EACT,EAAE,0BAA0B,oDA2B5B;AAGD,YAAY,EAAE,0BAA0B,EAAE,CAAC"}

package/dist/nextjs/providers/NextAuthProvider.js.map

@@ -1 +1 @@
-{"version":3,"file":"NextAuthProvider.js","sourceRoot":"","sources":["../../../src/nextjs/providers/NextAuthProvider.tsx"],"names":[],"mappings":";AAAA,6BAA6B;AAC7B,OAAO,KAAK,MAAM,OAAO,CAAC;AAC1B,OAAO,EAAE,OAAO,EAAE,SAAS,EAAE,MAAM,mBAAmB,CAAC;AAGvD,OAAO,EAAE,2BAA2B,EAAE,MAAM,6BAA6B,CAAC;AAC1E,OAAO,EAAE,OAAO,EAAE,MAAM,iBAAiB,CAAC;AAO1C,0EAA0E;AAC1E,MAAM,CAAC,KAAK,UAAU,qBAAqB,CAAC,EAC1C,QAAQ,EACR,GAAG,KAAK,EAIT;IACC,sEAAsE;IACtE,IAAI,UAAU,GAAgB,IAAI,CAAC;IACnC,IAAI,YAAY,GAAuB,IAAI,CAAC;IAE5C,IAAI,CAAC;QACH,UAAU,GAAG,MAAM,OAAO,EAAE,CAAC;QAC7B,YAAY,GAAG,MAAM,SAAS,EAAE,CAAC;IACnC,CAAC;IAAC,OAAO,KAAK,EAAE,CAAC;QACf,8CAA8C;QAC9C,OAAO,CAAC,MAAM,CAAC,SAAS,CAAC,KAAK,CAC5B,yCAAyC,EACzC,KAAK,CACN,CAAC;QACF,UAAU,GAAG,IAAI,CAAC;QAClB,YAAY,GAAG,IAAI,CAAC;IACtB,CAAC;IAED,OAAO,CACL,KAAC,2BAA2B,IAC1B,UAAU,EAAE,UAAU,EACtB,YAAY,EAAE,YAAY,KACtB,KAAK,YAER,QAAQ,GACmB,CAC/B,CAAC;AACJ,CAAC","sourcesContent":["/** @jsxImportSource react */\nimport React from \"react\";\nimport { getUser, getTokens } from \"@/nextjs/index.js\";\nimport type { User, OAuthTokens } from \"@/types.js\";\nimport type { AuthProviderProps } from \"@/shared/providers/types.js\";\nimport { CivicNextAuthProviderClient } from \"./NextAuthProviderClient.js\";\nimport { loggers } from \"@/lib/logger.js\";\n\ntype NextCivicAuthProviderProps = Omit<\n  AuthProviderProps,\n  \"clientId\" | \"onSignIn\" | \"onSignOut\"\n>;\n\n// Server component that reads user data and passes it to client component\nexport async function CivicNextAuthProvider({\n  children,\n  ...props\n}: NextCivicAuthProviderProps & {\n  redirectOnLogin?: string;\n  redirectOnLogout?: string;\n}) {\n  // Read user data and tokens server-side to prevent hydration mismatch\n  let serverUser: User | null = null;\n  let serverTokens: OAuthTokens | null = null;\n\n  try {\n    serverUser = await getUser();\n    serverTokens = await getTokens();\n  } catch (error) {\n    // If server-side reading fails, just use null\n    loggers.nextjs.providers.debug(\n      \"Failed to read user/tokens server-side:\",\n      error,\n    );\n    serverUser = null;\n    serverTokens = null;\n  }\n\n  return (\n    <CivicNextAuthProviderClient\n      serverUser={serverUser}\n      serverTokens={serverTokens}\n      {...props}\n    >\n      {children}\n    </CivicNextAuthProviderClient>\n  );\n}\n\n// Export the type for external use\nexport type { NextCivicAuthProviderProps };\n"]}
+{"version":3,"file":"NextAuthProvider.js","sourceRoot":"","sources":["../../../src/nextjs/providers/NextAuthProvider.tsx"],"names":[],"mappings":";AAAA,6BAA6B;AAC7B,OAAO,KAAK,MAAM,OAAO,CAAC;AAC1B,OAAO,EAAE,OAAO,EAAE,SAAS,EAAE,MAAM,mBAAmB,CAAC;AAGvD,OAAO,EAAE,2BAA2B,EAAE,MAAM,6BAA6B,CAAC;AAC1E,OAAO,EAAE,OAAO,EAAE,MAAM,iBAAiB,CAAC;AAO1C,0EAA0E;AAC1E,MAAM,CAAC,KAAK,UAAU,qBAAqB,CAAC,EAC1C,QAAQ,EACR,GAAG,KAAK,EACmB;IAC3B,sEAAsE;IACtE,IAAI,UAAU,GAAgB,IAAI,CAAC;IACnC,IAAI,YAAY,GAAuB,IAAI,CAAC;IAE5C,IAAI,CAAC;QACH,UAAU,GAAG,MAAM,OAAO,EAAE,CAAC;QAC7B,YAAY,GAAG,MAAM,SAAS,EAAE,CAAC;IACnC,CAAC;IAAC,OAAO,KAAK,EAAE,CAAC;QACf,8CAA8C;QAC9C,OAAO,CAAC,MAAM,CAAC,SAAS,CAAC,KAAK,CAC5B,yCAAyC,EACzC,KAAK,CACN,CAAC;QACF,UAAU,GAAG,IAAI,CAAC;QAClB,YAAY,GAAG,IAAI,CAAC;IACtB,CAAC;IAED,OAAO,CACL,KAAC,2BAA2B,IAC1B,UAAU,EAAE,UAAU,EACtB,YAAY,EAAE,YAAY,KACtB,KAAK,YAER,QAAQ,GACmB,CAC/B,CAAC;AACJ,CAAC","sourcesContent":["/** @jsxImportSource react */\nimport React from \"react\";\nimport { getUser, getTokens } from \"@/nextjs/index.js\";\nimport type { User, OAuthTokens } from \"@/types.js\";\nimport type { AuthProviderProps } from \"@/shared/providers/types.js\";\nimport { CivicNextAuthProviderClient } from \"./NextAuthProviderClient.js\";\nimport { loggers } from \"@/lib/logger.js\";\n\ntype NextCivicAuthProviderProps = Omit<\n  AuthProviderProps,\n  \"clientId\" | \"onSignIn\" | \"onSignOut\"\n>;\n\n// Server component that reads user data and passes it to client component\nexport async function CivicNextAuthProvider({\n  children,\n  ...props\n}: NextCivicAuthProviderProps) {\n  // Read user data and tokens server-side to prevent hydration mismatch\n  let serverUser: User | null = null;\n  let serverTokens: OAuthTokens | null = null;\n\n  try {\n    serverUser = await getUser();\n    serverTokens = await getTokens();\n  } catch (error) {\n    // If server-side reading fails, just use null\n    loggers.nextjs.providers.debug(\n      \"Failed to read user/tokens server-side:\",\n      error,\n    );\n    serverUser = null;\n    serverTokens = null;\n  }\n\n  return (\n    <CivicNextAuthProviderClient\n      serverUser={serverUser}\n      serverTokens={serverTokens}\n      {...props}\n    >\n      {children}\n    </CivicNextAuthProviderClient>\n  );\n}\n\n// Export the type for external use\nexport type { NextCivicAuthProviderProps };\n"]}

package/dist/nextjs/providers/NextAuthProviderClient.d.ts

@@ -1,11 +1,15 @@
 import type { AuthProviderProps } from "../../shared/providers/types.js";
 import type { User, OAuthTokens } from "../../types.js";
 type NextCivicAuthProviderProps = Omit<AuthProviderProps, "clientId">;
+/**
+ * Props for the CivicNextAuthProviderClient component.
+ * @internal This interface is for internal use - the public API is through CivicAuthProvider.
+ */
 export interface CivicNextAuthProviderClientProps extends NextCivicAuthProviderProps {
+    /** Server-provided user data for hydration to prevent hydration mismatch */
     serverUser: User | null;
+    /** Server-provided OAuth tokens for hydration */
     serverTokens: OAuthTokens | null;
-    redirectOnLogin?: string;
-    redirectOnLogout?: string;
 }
 export declare const CivicNextAuthProviderClient: ({ children, serverUser, serverTokens, ...props }: CivicNextAuthProviderClientProps) => import("react/jsx-runtime").JSX.Element;
 export {};

package/dist/nextjs/providers/NextAuthProviderClient.d.ts.map

@@ -1 +1 @@
-{"version":3,"file":"NextAuthProviderClient.d.ts","sourceRoot":"","sources":["../../../src/nextjs/providers/NextAuthProviderClient.tsx"],"names":[],"mappings":"AAWA,OAAO,KAAK,EAAE,iBAAiB,EAAE,MAAM,6BAA6B,CAAC;AAErE,OAAO,KAAK,EAAE,IAAI,EAAE,WAAW,EAAE,MAAM,YAAY,CAAC;AAIpD,KAAK,0BAA0B,GAAG,IAAI,CAAC,iBAAiB,EAAE,UAAU,CAAC,CAAC;AAEtE,MAAM,WAAW,gCACf,SAAQ,0BAA0B;IAClC,UAAU,EAAE,IAAI,GAAG,IAAI,CAAC;IACxB,YAAY,EAAE,WAAW,GAAG,IAAI,CAAC;IACjC,eAAe,CAAC,EAAE,MAAM,CAAC;IACzB,gBAAgB,CAAC,EAAE,MAAM,CAAC;CAC3B;AAID,eAAO,MAAM,2BAA2B,qDAKrC,gCAAgC,4CA8ElC,CAAC"}
+{"version":3,"file":"NextAuthProviderClient.d.ts","sourceRoot":"","sources":["../../../src/nextjs/providers/NextAuthProviderClient.tsx"],"names":[],"mappings":"AAWA,OAAO,KAAK,EAAE,iBAAiB,EAAE,MAAM,6BAA6B,CAAC;AAErE,OAAO,KAAK,EAAE,IAAI,EAAE,WAAW,EAAE,MAAM,YAAY,CAAC;AAIpD,KAAK,0BAA0B,GAAG,IAAI,CAAC,iBAAiB,EAAE,UAAU,CAAC,CAAC;AAEtE;;;GAGG;AACH,MAAM,WAAW,gCACf,SAAQ,0BAA0B;IAClC,4EAA4E;IAC5E,UAAU,EAAE,IAAI,GAAG,IAAI,CAAC;IACxB,iDAAiD;IACjD,YAAY,EAAE,WAAW,GAAG,IAAI,CAAC;CAClC;AAID,eAAO,MAAM,2BAA2B,qDAKrC,gCAAgC,4CA8ElC,CAAC"}

package/dist/nextjs/providers/NextAuthProviderClient.js.map

@@ -1 +1 @@
-{"version":3,"file":"NextAuthProviderClient.js","sourceRoot":"","sources":["../../../src/nextjs/providers/NextAuthProviderClient.tsx"],"names":[],"mappings":"AAAA,6BAA6B;AAC7B,YAAY,CAAC;;AAEb;;GAEG;AACH,OAAO,EAAE,iBAAiB,EAAE,MAAM,oBAAoB,CAAC;AACvD,OAAO,EAAE,iBAAiB,EAAE,MAAM,qCAAqC,CAAC;AACxE,OAAO,EAAE,kBAAkB,EAAE,MAAM,yCAAyC,CAAC;AAC7E,OAAO,EAAE,iBAAiB,EAAE,MAAM,wBAAwB,CAAC;AAC3D,OAAO,EAAE,oBAAoB,EAAE,MAAM,wCAAwC,CAAC;AAE9E,OAAO,EAAE,SAAS,EAAE,MAAM,EAAE,MAAM,OAAO,CAAC;AAE1C,OAAO,EAAE,WAAW,EAAE,SAAS,EAAE,MAAM,oBAAoB,CAAC;AAC5D,OAAO,EAAE,OAAO,EAAE,MAAM,iBAAiB,CAAC;AAY1C,kEAAkE;AAElE,MAAM,CAAC,MAAM,2BAA2B,GAAG,CAAC,EAC1C,QAAQ,EACR,UAAU,EACV,YAAY,EACZ,GAAG,KAAK,EACyB,EAAE,EAAE;IACrC,MAAM,MAAM,GAAG,SAAS,EAAE,CAAC;IAC3B,MAAM,cAAc,GAAG,iBAAiB,EAAE,CAAC;IAC3C,MAAM,EAAE,WAAW,EAAE,eAAe,EAAE,cAAc,EAAE,GAAG,cAAc,CAAC;IAExE,MAAM,QAAQ,GAAG,WAAW,EAAE,CAAC;IAC/B,MAAM,gBAAgB,GAAG,MAAM,CAAC,QAAQ,CAAC,CAAC;IAE1C,mEAAmE;IACnE,iFAAiF;IACjF,MAAM,EAAE,aAAa,EAAE,YAAY,EAAE,GAAG,oBAAoB,CAAC;QAC3D,cAAc;QACd,OAAO,EAAE,KAAK,CAAC,OAAO;QACtB,WAAW,EAAE,KAAK,CAAC,WAAW,IAAI,QAAQ;QAC1C,UAAU,EAAE,KAAK,CAAC,UAAU;QAC5B,UAAU,EAAE,UAAU;QACtB,KAAK,EAAE,KAAK,CAAC,KAAK;QAClB,sBAAsB,EAAE,KAAK,CAAC,sBAAsB;QACpD,WAAW,EAAE,WAAW;QACxB,eAAe,EAAE,eAAe;QAChC,WAAW,EAAE,CAAC,GAAW,EAAE,MAAe,EAAE,EAAE;YAC5C,sCAAsC;YACtC,QAAQ,MAAM,EAAE,CAAC;gBACf,KAAK,OAAO;oBACV,OAAO,CAAC,GAAG,CAAC,+CAA+C,GAAG,EAAE,CAAC,CAAC;oBAClE,MAAM,CAAC,QAAQ,CAAC,IAAI,GAAG,GAAG,CAAC;oBAC3B,MAAM;gBACR,KAAK,WAAW;oBACd,OAAO,CAAC,GAAG,CAAC,0CAA0C,GAAG,EAAE,CAAC,CAAC;oBAC7D,MAAM,CAAC,QAAQ,CAAC,IAAI,GAAG,GAAG,CAAC;oBAC3B,MAAM;gBACR;oBACE,OAAO,CAAC,GAAG,CACT,qCAAqC,GAAG,aAAa,MAAM,IAAI,SAAS,GAAG,CAC5E,CAAC;oBACF,MAAM,CAAC,IAAI,CAAC,GAAG,CAAC,CAAC;YACrB,CAAC;QACH,CAAC;KACF,CAAC,CAAC;IAEH,oDAAoD;IACpD,SAAS,CAAC,GAAG,EAAE;QACb,MAAM,UAAU,GAAG,KAAK,IAAI,EAAE;YAC5B,IAAI,CAAC;gBACH,MAAM,OAAO,GAAG,iBAAiB,CAAC,WAAW,EAAE,CAAC;gBAEhD,IAAI,gBAAgB,CAAC,OAAO,KAAK,QAAQ,EAAE,CAAC;oBAC1C,OAAO,CAAC,MAAM,CAAC,KAAK,CAAC,KAAK,CACxB,4CAA4C,gBAAgB,CAAC,OAAO,OAAO,QAAQ,yBAAyB,CAC7G,CAAC;oBACF,gBAAgB,CAAC,OAAO,GAAG,QAAQ,CAAC;oBACpC,MAAM,OAAO,CAAC,OAAO,EAAE,CAAC;gBAC1B,CAAC;gBAED,MAAM,OAAO,CAAC,UAAU,CAAC,aAAa,CAAC,CAAC;YAC1C,CAAC;YAAC,OAAO,KAAK,EAAE,CAAC;gBACf,OAAO,CAAC,KAAK,CACX,uDAAuD,EACvD,KAAK,CACN,CAAC;YACJ,CAAC;QACH,CAAC,CAAC;QAEF,iDAAiD;QACjD,yDAAyD;QACzD,gDAAgD;QAChD,IAAI,CAAC,YAAY,EAAE,CAAC;YAClB,UAAU,EAAE,CAAC;QACf,CAAC;IACH,CAAC,EAAE,CAAC,aAAa,EAAE,MAAM,EAAE,QAAQ,EAAE,YAAY,CAAC,CAAC,CAAC;IAEpD,OAAO,CACL,KAAC,iBAAiB,CAAC,QAAQ,IACzB,KAAK,EAAE,EAAE,IAAI,EAAE,UAAU,EAAE,MAAM,EAAE,YAAY,EAAE,YAEjD,KAAC,kBAAkB,cAAE,QAAQ,GAAsB,GACxB,CAC9B,CAAC;AACJ,CAAC,CAAC","sourcesContent":["/** @jsxImportSource react */\n\"use client\";\n\n/**\n * Client component for NextAuth provider that receives server-provided user data\n */\nimport { resolveAuthConfig } from \"@/nextjs/config.js\";\nimport { GlobalAuthManager } from \"@/reactjs/core/GlobalAuthManager.js\";\nimport { AuthStatusProvider } from \"@/shared/providers/AuthStatusContext.js\";\nimport { ServerUserContext } from \"./ServerUserContext.js\";\nimport { useInitialAuthConfig } from \"@/nextjs/hooks/useInitialAuthConfig.js\";\nimport type { AuthProviderProps } from \"@/shared/providers/types.js\";\nimport { useEffect, useRef } from \"react\";\nimport type { User, OAuthTokens } from \"@/types.js\";\nimport { usePathname, useRouter } from \"next/navigation.js\";\nimport { loggers } from \"@/lib/logger.js\";\n\ntype NextCivicAuthProviderProps = Omit<AuthProviderProps, \"clientId\">;\n\nexport interface CivicNextAuthProviderClientProps\n  extends NextCivicAuthProviderProps {\n  serverUser: User | null;\n  serverTokens: OAuthTokens | null;\n  redirectOnLogin?: string;\n  redirectOnLogout?: string;\n}\n\n// Context to provide server user data immediately to useUser hook\n\nexport const CivicNextAuthProviderClient = ({\n  children,\n  serverUser,\n  serverTokens,\n  ...props\n}: CivicNextAuthProviderClientProps) => {\n  const router = useRouter();\n  const resolvedConfig = resolveAuthConfig();\n  const { oauthServer, loginSuccessUrl, disableRefresh } = resolvedConfig;\n\n  const pathname = usePathname();\n  const previousPathname = useRef(pathname);\n\n  // Initialize GlobalAuthManager synchronously with server user data\n  // This ensures the server user is available immediately when useUser() is called\n  const { initialConfig, hasSignedOut } = useInitialAuthConfig({\n    disableRefresh,\n    logging: props.logging,\n    displayMode: props.displayMode || \"iframe\",\n    iframeMode: props.iframeMode,\n    serverUser: serverUser,\n    nonce: props.nonce,\n    targetContainerElement: props.targetContainerElement,\n    oauthServer: oauthServer,\n    loginSuccessUrl: loginSuccessUrl,\n    onUrlChange: (url: string, source?: string) => {\n      // Handle different URL change sources\n      switch (source) {\n        case \"login\":\n          console.log(`[NextAuthProvider] Authentication redirect: ${url}`);\n          window.location.href = url;\n          break;\n        case \"login_app\":\n          console.log(`[NextAuthProvider] Login app redirect: ${url}`);\n          window.location.href = url;\n          break;\n        default:\n          console.log(\n            `[NextAuthProvider] Navigating to: ${url} (source: ${source || \"unknown\"})`,\n          );\n          router.push(url);\n      }\n    },\n  });\n\n  // Initialize auth manager with server-provided data\n  useEffect(() => {\n    const initialize = async () => {\n      try {\n        const manager = GlobalAuthManager.getInstance();\n\n        if (previousPathname.current !== pathname) {\n          loggers.nextjs.hooks.debug(\n            `[NextAuthProvider] Pathname changed from ${previousPathname.current} to ${pathname}, cleaning auth manager`,\n          );\n          previousPathname.current = pathname;\n          await manager.cleanup();\n        }\n\n        await manager.initialize(initialConfig);\n      } catch (error) {\n        console.error(\n          \"[NextAuthProvider] Failed to initialize auth manager:\",\n          error,\n        );\n      }\n    };\n\n    // don't immediately initialize while signing out\n    // or we might overwrite the signed-out state the version\n    // from the /user endpoint before it has updated\n    if (!hasSignedOut) {\n      initialize();\n    }\n  }, [initialConfig, router, pathname, hasSignedOut]);\n\n  return (\n    <ServerUserContext.Provider\n      value={{ user: serverUser, tokens: serverTokens }}\n    >\n      <AuthStatusProvider>{children}</AuthStatusProvider>\n    </ServerUserContext.Provider>\n  );\n};\n"]}
+{"version":3,"file":"NextAuthProviderClient.js","sourceRoot":"","sources":["../../../src/nextjs/providers/NextAuthProviderClient.tsx"],"names":[],"mappings":"AAAA,6BAA6B;AAC7B,YAAY,CAAC;;AAEb;;GAEG;AACH,OAAO,EAAE,iBAAiB,EAAE,MAAM,oBAAoB,CAAC;AACvD,OAAO,EAAE,iBAAiB,EAAE,MAAM,qCAAqC,CAAC;AACxE,OAAO,EAAE,kBAAkB,EAAE,MAAM,yCAAyC,CAAC;AAC7E,OAAO,EAAE,iBAAiB,EAAE,MAAM,wBAAwB,CAAC;AAC3D,OAAO,EAAE,oBAAoB,EAAE,MAAM,wCAAwC,CAAC;AAE9E,OAAO,EAAE,SAAS,EAAE,MAAM,EAAE,MAAM,OAAO,CAAC;AAE1C,OAAO,EAAE,WAAW,EAAE,SAAS,EAAE,MAAM,oBAAoB,CAAC;AAC5D,OAAO,EAAE,OAAO,EAAE,MAAM,iBAAiB,CAAC;AAgB1C,kEAAkE;AAElE,MAAM,CAAC,MAAM,2BAA2B,GAAG,CAAC,EAC1C,QAAQ,EACR,UAAU,EACV,YAAY,EACZ,GAAG,KAAK,EACyB,EAAE,EAAE;IACrC,MAAM,MAAM,GAAG,SAAS,EAAE,CAAC;IAC3B,MAAM,cAAc,GAAG,iBAAiB,EAAE,CAAC;IAC3C,MAAM,EAAE,WAAW,EAAE,eAAe,EAAE,cAAc,EAAE,GAAG,cAAc,CAAC;IAExE,MAAM,QAAQ,GAAG,WAAW,EAAE,CAAC;IAC/B,MAAM,gBAAgB,GAAG,MAAM,CAAC,QAAQ,CAAC,CAAC;IAE1C,mEAAmE;IACnE,iFAAiF;IACjF,MAAM,EAAE,aAAa,EAAE,YAAY,EAAE,GAAG,oBAAoB,CAAC;QAC3D,cAAc;QACd,OAAO,EAAE,KAAK,CAAC,OAAO;QACtB,WAAW,EAAE,KAAK,CAAC,WAAW,IAAI,QAAQ;QAC1C,UAAU,EAAE,KAAK,CAAC,UAAU;QAC5B,UAAU,EAAE,UAAU;QACtB,KAAK,EAAE,KAAK,CAAC,KAAK;QAClB,sBAAsB,EAAE,KAAK,CAAC,sBAAsB;QACpD,WAAW,EAAE,WAAW;QACxB,eAAe,EAAE,eAAe;QAChC,WAAW,EAAE,CAAC,GAAW,EAAE,MAAe,EAAE,EAAE;YAC5C,sCAAsC;YACtC,QAAQ,MAAM,EAAE,CAAC;gBACf,KAAK,OAAO;oBACV,OAAO,CAAC,GAAG,CAAC,+CAA+C,GAAG,EAAE,CAAC,CAAC;oBAClE,MAAM,CAAC,QAAQ,CAAC,IAAI,GAAG,GAAG,CAAC;oBAC3B,MAAM;gBACR,KAAK,WAAW;oBACd,OAAO,CAAC,GAAG,CAAC,0CAA0C,GAAG,EAAE,CAAC,CAAC;oBAC7D,MAAM,CAAC,QAAQ,CAAC,IAAI,GAAG,GAAG,CAAC;oBAC3B,MAAM;gBACR;oBACE,OAAO,CAAC,GAAG,CACT,qCAAqC,GAAG,aAAa,MAAM,IAAI,SAAS,GAAG,CAC5E,CAAC;oBACF,MAAM,CAAC,IAAI,CAAC,GAAG,CAAC,CAAC;YACrB,CAAC;QACH,CAAC;KACF,CAAC,CAAC;IAEH,oDAAoD;IACpD,SAAS,CAAC,GAAG,EAAE;QACb,MAAM,UAAU,GAAG,KAAK,IAAI,EAAE;YAC5B,IAAI,CAAC;gBACH,MAAM,OAAO,GAAG,iBAAiB,CAAC,WAAW,EAAE,CAAC;gBAEhD,IAAI,gBAAgB,CAAC,OAAO,KAAK,QAAQ,EAAE,CAAC;oBAC1C,OAAO,CAAC,MAAM,CAAC,KAAK,CAAC,KAAK,CACxB,4CAA4C,gBAAgB,CAAC,OAAO,OAAO,QAAQ,yBAAyB,CAC7G,CAAC;oBACF,gBAAgB,CAAC,OAAO,GAAG,QAAQ,CAAC;oBACpC,MAAM,OAAO,CAAC,OAAO,EAAE,CAAC;gBAC1B,CAAC;gBAED,MAAM,OAAO,CAAC,UAAU,CAAC,aAAa,CAAC,CAAC;YAC1C,CAAC;YAAC,OAAO,KAAK,EAAE,CAAC;gBACf,OAAO,CAAC,KAAK,CACX,uDAAuD,EACvD,KAAK,CACN,CAAC;YACJ,CAAC;QACH,CAAC,CAAC;QAEF,iDAAiD;QACjD,yDAAyD;QACzD,gDAAgD;QAChD,IAAI,CAAC,YAAY,EAAE,CAAC;YAClB,UAAU,EAAE,CAAC;QACf,CAAC;IACH,CAAC,EAAE,CAAC,aAAa,EAAE,MAAM,EAAE,QAAQ,EAAE,YAAY,CAAC,CAAC,CAAC;IAEpD,OAAO,CACL,KAAC,iBAAiB,CAAC,QAAQ,IACzB,KAAK,EAAE,EAAE,IAAI,EAAE,UAAU,EAAE,MAAM,EAAE,YAAY,EAAE,YAEjD,KAAC,kBAAkB,cAAE,QAAQ,GAAsB,GACxB,CAC9B,CAAC;AACJ,CAAC,CAAC","sourcesContent":["/** @jsxImportSource react */\n\"use client\";\n\n/**\n * Client component for NextAuth provider that receives server-provided user data\n */\nimport { resolveAuthConfig } from \"@/nextjs/config.js\";\nimport { GlobalAuthManager } from \"@/reactjs/core/GlobalAuthManager.js\";\nimport { AuthStatusProvider } from \"@/shared/providers/AuthStatusContext.js\";\nimport { ServerUserContext } from \"./ServerUserContext.js\";\nimport { useInitialAuthConfig } from \"@/nextjs/hooks/useInitialAuthConfig.js\";\nimport type { AuthProviderProps } from \"@/shared/providers/types.js\";\nimport { useEffect, useRef } from \"react\";\nimport type { User, OAuthTokens } from \"@/types.js\";\nimport { usePathname, useRouter } from \"next/navigation.js\";\nimport { loggers } from \"@/lib/logger.js\";\n\ntype NextCivicAuthProviderProps = Omit<AuthProviderProps, \"clientId\">;\n\n/**\n * Props for the CivicNextAuthProviderClient component.\n * @internal This interface is for internal use - the public API is through CivicAuthProvider.\n */\nexport interface CivicNextAuthProviderClientProps\n  extends NextCivicAuthProviderProps {\n  /** Server-provided user data for hydration to prevent hydration mismatch */\n  serverUser: User | null;\n  /** Server-provided OAuth tokens for hydration */\n  serverTokens: OAuthTokens | null;\n}\n\n// Context to provide server user data immediately to useUser hook\n\nexport const CivicNextAuthProviderClient = ({\n  children,\n  serverUser,\n  serverTokens,\n  ...props\n}: CivicNextAuthProviderClientProps) => {\n  const router = useRouter();\n  const resolvedConfig = resolveAuthConfig();\n  const { oauthServer, loginSuccessUrl, disableRefresh } = resolvedConfig;\n\n  const pathname = usePathname();\n  const previousPathname = useRef(pathname);\n\n  // Initialize GlobalAuthManager synchronously with server user data\n  // This ensures the server user is available immediately when useUser() is called\n  const { initialConfig, hasSignedOut } = useInitialAuthConfig({\n    disableRefresh,\n    logging: props.logging,\n    displayMode: props.displayMode || \"iframe\",\n    iframeMode: props.iframeMode,\n    serverUser: serverUser,\n    nonce: props.nonce,\n    targetContainerElement: props.targetContainerElement,\n    oauthServer: oauthServer,\n    loginSuccessUrl: loginSuccessUrl,\n    onUrlChange: (url: string, source?: string) => {\n      // Handle different URL change sources\n      switch (source) {\n        case \"login\":\n          console.log(`[NextAuthProvider] Authentication redirect: ${url}`);\n          window.location.href = url;\n          break;\n        case \"login_app\":\n          console.log(`[NextAuthProvider] Login app redirect: ${url}`);\n          window.location.href = url;\n          break;\n        default:\n          console.log(\n            `[NextAuthProvider] Navigating to: ${url} (source: ${source || \"unknown\"})`,\n          );\n          router.push(url);\n      }\n    },\n  });\n\n  // Initialize auth manager with server-provided data\n  useEffect(() => {\n    const initialize = async () => {\n      try {\n        const manager = GlobalAuthManager.getInstance();\n\n        if (previousPathname.current !== pathname) {\n          loggers.nextjs.hooks.debug(\n            `[NextAuthProvider] Pathname changed from ${previousPathname.current} to ${pathname}, cleaning auth manager`,\n          );\n          previousPathname.current = pathname;\n          await manager.cleanup();\n        }\n\n        await manager.initialize(initialConfig);\n      } catch (error) {\n        console.error(\n          \"[NextAuthProvider] Failed to initialize auth manager:\",\n          error,\n        );\n      }\n    };\n\n    // don't immediately initialize while signing out\n    // or we might overwrite the signed-out state the version\n    // from the /user endpoint before it has updated\n    if (!hasSignedOut) {\n      initialize();\n    }\n  }, [initialConfig, router, pathname, hasSignedOut]);\n\n  return (\n    <ServerUserContext.Provider\n      value={{ user: serverUser, tokens: serverTokens }}\n    >\n      <AuthStatusProvider>{children}</AuthStatusProvider>\n    </ServerUserContext.Provider>\n  );\n};\n"]}

package/dist/nextjs/routeHandler.d.ts.map

@@ -1 +1 @@
-{"version":3,"file":"routeHandler.d.ts","sourceRoot":"","sources":["../../src/nextjs/routeHandler.ts"],"names":[],"mappings":"AAIA,OAAO,KAAK,EAAE,UAAU,EAAE,MAAM,oBAAoB,CAAC;AAKrD,OAAO,KAAK,EAAE,WAAW,EAAE,MAAM,gBAAgB,CAAC;AAClD,OAAO,EAAE,YAAY,EAAE,MAAM,gBAAgB,CAAC;AA0Q9C,wBAAsB,YAAY,CAChC,OAAO,EAAE,WAAW,EACpB,MAAM,EAAE,UAAU,GACjB,OAAO,CAAC,YAAY,CAAC,CAwEvB;AA0CD,wBAAsB,oBAAoB,CACxC,OAAO,EAAE,WAAW,EACpB,MAAM,EAAE,UAAU,GACjB,OAAO,CAAC,YAAY,CAAC,CA4DvB;AAED;;;;;;;;;;;;;;GAcG;AACH,eAAO,MAAM,OAAO,iCAEF,WAAW,KAAG,OAAO,CAAC,YAAY,CAuCjD,CAAC"}
+{"version":3,"file":"routeHandler.d.ts","sourceRoot":"","sources":["../../src/nextjs/routeHandler.ts"],"names":[],"mappings":"AAIA,OAAO,KAAK,EAAE,UAAU,EAAE,MAAM,oBAAoB,CAAC;AASrD,OAAO,KAAK,EAAE,WAAW,EAAE,MAAM,gBAAgB,CAAC;AAClD,OAAO,EAAE,YAAY,EAAE,MAAM,gBAAgB,CAAC;AA0U9C,wBAAsB,YAAY,CAChC,OAAO,EAAE,WAAW,EACpB,MAAM,EAAE,UAAU,GACjB,OAAO,CAAC,YAAY,CAAC,CAwEvB;AA0CD,wBAAsB,oBAAoB,CACxC,OAAO,EAAE,WAAW,EACpB,MAAM,EAAE,UAAU,GACjB,OAAO,CAAC,YAAY,CAAC,CA4DvB;AAED;;;;;;;;;;;;;;GAcG;AACH,eAAO,MAAM,OAAO,iCAEF,WAAW,KAAG,OAAO,CAAC,YAAY,CAuCjD,CAAC"}

package/dist/nextjs/routeHandler.js

@@ -4,7 +4,7 @@ import { loggers } from "../lib/logger.js";
 import { displayModeFromState } from "../lib/oauth.js";
 import { resolveAuthConfig } from "../nextjs/config.js";
 import { clearAuthCookies, NextjsCookieStorage } from "../nextjs/cookies.js";
-import { CodeVerifier, UserStorage } from "../shared/lib/types.js";
+import { AuthFlowCookie, CodeVerifier, UserStorage, } from "../shared/lib/types.js";
 import { revalidatePath } from "next/cache.js";
 import { NextResponse } from "next/server.js";
 import { prependBasePath, redirectWithBasePath } from "./utils.js";
@@ -131,7 +131,7 @@ async function handleCallback(request, config) {
     if (!code || !state)
         throw new AuthError("Bad parameters", 400);
     try {
-        const { civicAuth, appUrl, urlDetectionRequest } = createCivicAuth(request, resolvedConfigs);
+        const { civicAuth, appUrl, urlDetectionRequest, cookieStorage } = createCivicAuth(request, resolvedConfigs);
         // Convert NextRequest to the format expected by handleCallback
         const handleCallbackRequest = {
             headers: Object.fromEntries(request.headers.entries()),
@@ -139,7 +139,45 @@ async function handleCallback(request, config) {
         };
         // Get loginSuccessUrl with proper baseUrl handling
         const loginSuccessUrl = CivicAuth.getLoginSuccessUrl(urlDetectionRequest, appUrl);
-        const frontendUrl = loginSuccessUrl || resolvedConfigs.loginSuccessUrl || "/";
+        const defaultFrontendUrl = loginSuccessUrl || resolvedConfigs.loginSuccessUrl || "/";
+        // Check for preserved deep link (returnUrl cookie)
+        const returnUrl = await cookieStorage.get(AuthFlowCookie.RETURN_URL);
+        // Delete the cookie immediately after reading (single-use)
+        if (returnUrl) {
+            await cookieStorage.delete(AuthFlowCookie.RETURN_URL);
+            logger.debug("[CALLBACK_HANDLER] Found returnUrl cookie", { returnUrl });
+        }
+        // Determine final redirect URL based on deepLinkHandling config
+        let frontendUrl;
+        if (returnUrl && resolvedConfigs.deepLinkHandling === "queryParamsOnly") {
+            // queryParamsOnly: Use loginSuccessUrl but merge query params from returnUrl
+            try {
+                const returnUrlObj = new URL(returnUrl, appUrl);
+                const baseUrlObj = new URL(defaultFrontendUrl, appUrl);
+                // Append query params from returnUrl to the base loginSuccessUrl
+                returnUrlObj.searchParams.forEach((value, key) => {
+                    baseUrlObj.searchParams.set(key, value);
+                });
+                frontendUrl = baseUrlObj.pathname + baseUrlObj.search + baseUrlObj.hash;
+                logger.debug("[CALLBACK_HANDLER] deepLinkHandling=queryParamsOnly: merged returnUrl params", { frontendUrl });
+            }
+            catch (error) {
+                // If URL parsing fails, fall back to default
+                logger.warn("[CALLBACK_HANDLER] Failed to merge query params from returnUrl", { error, returnUrl, defaultFrontendUrl });
+                frontendUrl = defaultFrontendUrl;
+            }
+        }
+        else if (returnUrl && resolvedConfigs.deepLinkHandling === "fullUrl") {
+            // fullUrl: Use the preserved deep link directly
+            frontendUrl = returnUrl;
+            logger.debug("[CALLBACK_HANDLER] deepLinkHandling=fullUrl: using preserved deep link", {
+                frontendUrl,
+            });
+        }
+        else {
+            // No returnUrl cookie or deepLinkHandling is "disabled" - use default loginSuccessUrl
+            frontendUrl = defaultFrontendUrl;
+        }
         // Use CivicAuth's smart callback handler
         const result = await civicAuth.handleCallback({
             code,
@@ -155,12 +193,24 @@ async function handleCallback(request, config) {
         if (result.content) {
             // Handle both string content and object content
             if (typeof result.content === "string") {
-                return new NextResponse(result.content, {
+                const response = new NextResponse(result.content, {
                     status: 200,
-                    headers: {
-                        "Content-Type": "text/html",
-                    },
+                    headers: { "Content-Type": "text/html" },
                 });
+                // If we had a returnUrl cookie, delete it using NextResponse's cookie API.
+                // This ensures consistent cookie attributes from the resolved config.
+                if (returnUrl) {
+                    const cookieConfig = resolvedConfigs.cookies?.tokens?.[AuthFlowCookie.RETURN_URL];
+                    response.cookies.set(AuthFlowCookie.RETURN_URL, "", {
+                        path: cookieConfig?.path ?? resolvedConfigs.basePath ?? "/",
+                        httpOnly: cookieConfig?.httpOnly ?? true,
+                        secure: cookieConfig?.secure ?? true,
+                        sameSite: cookieConfig?.sameSite ?? "strict",
+                        maxAge: 0, // Immediately expire the cookie
+                    });
+                    logger.debug("[CALLBACK_HANDLER] Clearing returnUrl cookie via NextResponse");
+                }
+                return response;
             }
             else {
                 // Object content (JSON response)