@civic/auth 0.13.0-beta.0 → 0.13.0-beta.2

package/dist/nextjs/utils.js.map

@@ -1 +1 @@
-{"version":3,"file":"utils.js","sourceRoot":"","sources":["../../src/nextjs/utils.ts"],"names":[],"mappings":"AAAA,OAAO,EACL,gBAAgB,GAGjB,MAAM,oBAAoB,CAAC;AAE5B,OAAO,EAAE,YAAY,EAAE,MAAM,gBAAgB,CAAC;AAE9C,OAAO,EAAE,OAAO,EAAE,MAAM,iBAAiB,CAAC;AAC1C,OAAO,SAAS,MAAM,WAAW,CAAC;AAClC,OAAO,EACL,cAAc,EACd,YAAY,EACZ,eAAe,EACf,WAAW,GAGZ,MAAM,uBAAuB,CAAC;AAC/B,OAAO,EACL,WAAW,EACX,sBAAsB,EACtB,iBAAiB,GAClB,MAAM,sBAAsB,CAAC;AAC9B,OAAO,EAAE,aAAa,EAAE,MAAM,mBAAmB,CAAC;AAClD,OAAO,EAAE,0BAA0B,EAAE,MAAM,6BAA6B,CAAC;AAEzE,MAAM,MAAM,GAAG,OAAO,CAAC,MAAM,CAAC,UAAU,CAAC;AAEzC,MAAM,CAAC,MAAM,kBAAkB,GAAG,CAChC,MAA8B,EAC9B,OAAgB,EACR,EAAE;IACV,MAAM,WAAW,GAAG,IAAI,GAAG,CAAC,MAAM,EAAE,WAAW,EAAE,OAAO,CAAC,CAAC,QAAQ,EAAE,CAAC;IACrE,OAAO,WAAW,CAAC,QAAQ,EAAE,CAAC;AAChC,CAAC,CAAC;AAEF,MAAM,UAAU,gBAAgB,CAAC,IAAY;IAC3C,IAAI,CAAC,IAAI,IAAI,IAAI,KAAK,GAAG;QAAE,OAAO,EAAE,CAAC;IAErC,gCAAgC;IAChC,MAAM,gBAAgB,GAAG,IAAI,CAAC,UAAU,CAAC,GAAG,CAAC,CAAC,CAAC,CAAC,IAAI,CAAC,CAAC,CAAC,IAAI,IAAI,EAAE,CAAC;IAElE,6CAA6C;IAC7C,OAAO,gBAAgB,CAAC,OAAO,CAAC,MAAM,EAAE,EAAE,CAAC,CAAC;AAC9C,CAAC;AAED;;;GAGG;AACH,MAAM,UAAU,sBAAsB,CACpC,QAAgB,EAChB,QAAiB;IAEjB,IAAI,CAAC,QAAQ,IAAI,QAAQ,KAAK,EAAE,IAAI,QAAQ,KAAK,GAAG,EAAE,CAAC;QACrD,OAAO,QAAQ,CAAC;IAClB,CAAC;IAED,oDAAoD;IACpD,MAAM,iBAAiB,GAAG,gBAAgB,CAAC,QAAQ,CAAC,CAAC;IAErD,kFAAkF;IAClF,oEAAoE;IACpE,IAAI,QAAQ,KAAK,iBAAiB,EAAE,CAAC;QACnC,4BAA4B;QAC5B,OAAO,GAAG,CAAC;IACb,CAAC;SAAM,IAAI,QAAQ,CAAC,UAAU,CAAC,iBAAiB,GAAG,GAAG,CAAC,EAAE,CAAC;QACxD,kEAAkE;QAClE,OAAO,QAAQ,CAAC,KAAK,CAAC,iBAAiB,CAAC,MAAM,CAAC,CAAC;IAClD,CAAC;IAED,8EAA8E;IAC9E,OAAO,QAAQ,CAAC;AAClB,CAAC;AAED,MAAM,YAAY,GAAG,CACnB,OAAoB,EACpB,UAAkC,EAC1B,EAAE;IACV,mEAAmE;IACnE,IAAI,UAAU,CAAC,OAAO,EAAE,CAAC;QACvB,OAAO,UAAU,CAAC,OAAO,CAAC;IAC5B,CAAC;IAED,2DAA2D;IAC3D,OAAO,OAAO,CAAC,OAAO,CAAC,MAAM,CAAC;AAChC,CAAC,CAAC;AAEF,iBAAiB;AACjB,YAAY;AACZ,QAAQ;AACR,UAAU;AACV,gBAAgB;AAChB,MAAM,SAAS,GAAG,CAAC,QAAgB,EAAE,WAAmB,EAAE,EAAE;IAC1D,MAAM,OAAO,GAAG,SAAS,CAAC,WAAW,CAAC,CAAC;IACvC,OAAO,OAAO,CAAC,QAAQ,CAAC,CAAC;AAC3B,CAAC,CAAC;AAEF,MAAM,YAAY,GAAG,CAAC,QAAgB,EAAE,QAAkB,EAAE,EAAE,CAC5D,QAAQ,CAAC,IAAI,CAAC,CAAC,OAAO,EAAE,EAAE;IACxB,IAAI,CAAC,OAAO;QAAE,OAAO,KAAK,CAAC;IAC3B,OAAO,SAAS,CAAC,QAAQ,EAAE,OAAO,CAAC,CAAC;AACtC,CAAC,CAAC,CAAC;AAEL;;GAEG;AACH,MAAM,CAAC,MAAM,oBAAoB,GAAG,CAAC,OAAoB,EAAW,EAAE;IACpE,OAAO,CAAC,OAAO,CAAC,aAAa,IAAI,CAAC,CAAC,OAAO,CAAC,YAAY,CAAC;AAC1D,CAAC,CAAC;AAEF,MAAM,mBAAmB,GAAG,CAAC,IAAY,EAAE,WAAmB,EAAE,EAAE,EAAE;IAClE,OAAO,IAAI,CAAC,OAAO,CAAC,IAAI,MAAM,CAAC,IAAI,QAAQ,EAAE,CAAC,EAAE,EAAE,CAAC,CAAC;AACtD,CAAC,CAAC;AACF;;GAEG;AACH,MAAM,CAAC,MAAM,2BAA2B,GAAG,CACzC,QAAgB,EAChB,UAAkC,EACzB,EAAE;IACX,mFAAmF;IACnF,MAAM,UAAU,GAAG,MAAM,CAAC,IAAI,CAAC,gBAAgB,CAAC,CAAC,GAAG,CAClD,CAAC,GAAG,EAAE,EAAE,CAAC,UAAU,CAAC,GAAmC,CAAW,CACnE,CAAC;IAEF,6EAA6E;IAC7E,0FAA0F;IAC1F,8FAA8F;IAC9F,MAAM,gBAAgB,GAAG,mBAAmB,CAAC,QAAQ,EAAE,UAAU,CAAC,QAAQ,CAAC,CAAC;IAC5E,MAAM,kBAAkB,GAAG,UAAU,CAAC,GAAG,CAAC,CAAC,GAAG,EAAE,EAAE,CAChD,mBAAmB,CAAC,GAAG,EAAE,UAAU,CAAC,QAAQ,CAAC,CAC9C,CAAC;IACF,MAAM,WAAW,GAAG,kBAAkB,CAAC,IAAI,CACzC,CAAC,GAAG,EAAE,EAAE,CAAC,GAAG,IAAI,QAAQ,IAAI,QAAQ,KAAK,GAAG,IAAI,GAAG,KAAK,gBAAgB,CACzE,CAAC;IACF,MAAM,CAAC,KAAK,CAAC,qBAAqB,EAAE,EAAE,QAAQ,EAAE,WAAW,EAAE,UAAU,EAAE,CAAC,CAAC;IAC3E,IAAI,WAAW,EAAE,CAAC;QAChB,MAAM,CAAC,KAAK,CACV,0DAA0D,EAC1D,QAAQ,CACT,CAAC;IACJ,CAAC;IAED,OAAO,WAAW,CAAC;AACrB,CAAC,CAAC;AAEF;;GAEG;AACH,MAAM,OAAO,6BAA8B,SAAQ,aAAa;IAErD;IACC;IACA;IAHV,YACS,SAAmD,EAAE,EACpD,OAAoB,EACpB,QAAsB;QAE9B,KAAK,CAAC;YACJ,MAAM,EAAE,IAAI;YACZ,QAAQ,EAAE,IAAI;SACf,CAAC,CAAC;QAPI,WAAM,GAAN,MAAM,CAA+C;QACpD,YAAO,GAAP,OAAO,CAAa;QACpB,aAAQ,GAAR,QAAQ,CAAc;IAMhC,CAAC;IAED,KAAK,CAAC,GAAG,CAAC,GAAW;QACnB,wEAAwE;QACxE,MAAM,WAAW,GAAG,IAAI,CAAC,QAAQ,CAAC,OAAO,CAAC,GAAG,CAAC,GAAG,CAAC,EAAE,KAAK,CAAC;QAC1D,IAAI,WAAW,EAAE,CAAC;YAChB,OAAO,WAAW,CAAC;QACrB,CAAC;QAED,MAAM,cAAc,GAAG,IAAI,CAAC,MAAM,EAAE,CAAC,GAAgB,CAAC,IAAI,EAAE,CAAC;QAC7D,MAAM,cAAc,GAAG,cAAc,CAAC,IAAI,CAAC;QAE3C,iFAAiF;QACjF,mFAAmF;QACnF,IAAI,cAAc,IAAI,cAAc,KAAK,GAAG,EAAE,CAAC;YAC7C,MAAM,YAAY,GAAG,IAAI,CAAC,OAAO,CAAC,OAAO,CAAC,GAAG,CAAC,QAAQ,CAAC,CAAC;YACxD,MAAM,QAAQ,GAAG,0BAA0B,CAAC,YAAY,EAAE,GAAG,CAAC,CAAC;YAC/D,IAAI,QAAQ,EAAE,CAAC;gBACb,OAAO,QAAQ,CAAC;YAClB,CAAC;QACH,CAAC;QAED,+CAA+C;QAC/C,OAAO,IAAI,CAAC,OAAO,CAAC,OAAO,CAAC,GAAG,CAAC,GAAG,CAAC,EAAE,KAAK,IAAI,IAAI,CAAC;IACtD,CAAC;IAED,KAAK,CAAC,GAAG,CACP,GAAW,EACX,KAAa,EACb,oBAAkC;QAElC,MAAM,cAAc,GAAG,IAAI,CAAC,MAAM,EAAE,CAAC,GAAgB,CAAC,IAAI;YACxD,GAAG,IAAI,CAAC,QAAQ;SACjB,CAAC;QACF,MAAM,aAAa,GAAG,sBAAsB,CAAC,IAAI,CAAC,OAAO,CAAC,CAAC;QAE3D,MAAM,iBAAiB,GAAG;YACxB,GAAG,cAAc;YACjB,GAAG,oBAAoB;YACvB,sDAAsD;YACtD,MAAM,EAAE,aAAa,CAAC,MAAM;YAC5B,QAAQ,EAAE,aAAa,CAAC,QAAQ;SACjC,CAAC;QAEF,2EAA2E;QAC3E,IAAI,CAAC,QAAQ,CAAC,OAAO,CAAC,GAAG,CAAC,GAAG,EAAE,KAAK,EAAE,iBAAiB,CAAC,CAAC;IAC3D,CAAC;IAED,KAAK,CAAC,MAAM,CAAC,GAAW;QACtB,oEAAoE;QACpE,MAAM,cAAc,GAAG,IAAI,CAAC,MAAM,EAAE,CAAC,GAAgB,CAAC,IAAI,EAAE,CAAC;QAE7D,gEAAgE;QAChE,IAAI,cAAc,CAAC,IAAI,EAAE,CAAC;YACxB,IAAI,CAAC,QAAQ,CAAC,OAAO,CAAC,GAAG,CAAC,GAAG,EAAE,EAAE,EAAE;gBACjC,OAAO,EAAE,IAAI,IAAI,CAAC,CAAC,CAAC,EAAE,qBAAqB;gBAC3C,IAAI,EAAE,cAAc,CAAC,IAAI;aAC1B,CAAC,CAAC;QACL,CAAC;aAAM,CAAC;YACN,IAAI,CAAC,QAAQ,CAAC,OAAO,CAAC,MAAM,CAAC,GAAG,CAAC,CAAC;QACpC,CAAC;IACH,CAAC;CACF;AAED;;;GAGG;AACH,MAAM,CAAC,MAAM,cAAc,GAAG,CAC5B,QAAgB,EAChB,OAAoB,EACpB,UAAkC,EAC5B,EAAE;IACR,IAAI,QAAQ,KAAK,UAAU,CAAC,QAAQ,EAAE,CAAC;QACrC,OAAO;IACT,CAAC;IAED,mDAAmD;IACnD,IAAI,OAAO,CAAC,aAAa,EAAE,CAAC;QAC1B,MAAM,CAAC,KAAK,CAAC,2CAA2C,CAAC,CAAC;IAC5D,CAAC;SAAM,CAAC;QACN,MAAM,CAAC,KAAK,CAAC,6CAA6C,CAAC,CAAC;IAC9D,CAAC;AACH,CAAC,CAAC;AAEF;;GAEG;AACH,MAAM,CAAC,MAAM,8BAA8B,GAAG,CAC5C,QAAgB,EAChB,UAAkC,EACzB,EAAE;IACX,yBAAyB;IACzB,IAAI,CAAC,YAAY,CAAC,QAAQ,EAAE,UAAU,CAAC,OAAO,CAAC,EAAE,CAAC;QAChD,MAAM,CAAC,KAAK,CACV,sDAAsD,EACtD,QAAQ,CACT,CAAC;QACF,OAAO,IAAI,CAAC;IACd,CAAC;IAED,yBAAyB;IACzB,IAAI,YAAY,CAAC,QAAQ,EAAE,UAAU,CAAC,OAAO,CAAC,EAAE,CAAC;QAC/C,MAAM,CAAC,KAAK,CAAC,kDAAkD,EAAE,QAAQ,CAAC,CAAC;QAC3E,OAAO,IAAI,CAAC;IACd,CAAC;IAED,OAAO,KAAK,CAAC;AACf,CAAC,CAAC;AAEF,MAAM,CAAC,MAAM,gBAAgB,GAAG,CAC9B,cAA4B,EAC5B,UAAsC,EACtC,EAAE;IACF,MAAM,gBAAgB,GAAG;QACvB,GAAG,MAAM,CAAC,MAAM,CAAC,eAAe,CAAC;QACjC,GAAG,MAAM,CAAC,MAAM,CAAC,WAAW,CAAC;QAC7B,GAAG,MAAM,CAAC,MAAM,CAAC,YAAY,CAAC;KAC/B,CAAC;IACF,MAAM,CAAC,KAAK,CAAC,wBAAwB,EAAE;QACrC,GAAG,EAAE,cAAc,CAAC,GAAG;QACvB,MAAM,EAAE,UAAU,CAAC,GAAG;KACvB,CAAC,CAAC;IACH,cAAc,EAAE,OAAO;SACpB,MAAM,EAAE;SACR,MAAM,CAAC,CAAC,MAAM,EAAE,EAAE,CACjB,gBAAgB,CAAC,QAAQ,CAAC,MAAM,CAAC,IAAuB,CAAC,CAC1D;SACA,OAAO,CAAC,CAAC,MAAM,EAAE,EAAE;QAClB,MAAM,CAAC,KAAK,CAAC,oCAAoC,EAAE,MAAM,CAAC,CAAC;QAC3D,UAAU,CAAC,OAAO,CAAC,GAAG,CAAC,MAAM,CAAC,CAAC;IACjC,CAAC,CAAC,CAAC;AACP,CAAC,CAAC;AACF;;GAEG;AACH,MAAM,CAAC,MAAM,yBAAyB,GAAG,KAAK,EAC5C,OAAoB,EACpB,OAAoB,EACpB,QAAsB,EACtB,OAAsC,EACtC,UAAkC,EACC,EAAE;IACrC,6CAA6C;IAC7C,IAAI,OAAO,CAAC,WAAW,IAAI,OAAO,CAAC,OAAO,IAAI,OAAO,CAAC,YAAY,EAAE,CAAC;QACnE,MAAM,CAAC,KAAK,CAAC,mCAAmC,CAAC,CAAC;QAClD,MAAM,WAAW,CAAC,OAAO,CAAC,CAAC;IAC7B,CAAC;IAED,gEAAgE;IAChE,MAAM,QAAQ,GAAG,IAAI,GAAG,CACtB,UAAU,CAAC,QAAQ,EACnB,YAAY,CAAC,OAAO,EAAE,UAAU,CAAC,CAClC,CAAC;IACF,MAAM,WAAW,GAAG,GAAG,QAAQ,CAAC,QAAQ,EAAE,EAAE,CAAC;IAC7C,MAAM,wBAAwB,GAAG,sBAAsB,CACrD,QAAQ,CAAC,QAAQ,EACjB,UAAU,CAAC,QAAQ,CACpB,CAAC;IAEF,gFAAgF;IAChF,mGAAmG;IACnG,gJAAgJ;IAChJ,IAAI,OAAO,CAAC,OAAO,CAAC,QAAQ,KAAK,wBAAwB,EAAE,CAAC;QAC1D,MAAM,CAAC,KAAK,CACV,mDAAmD,WAAW,GAAG,CAClE,CAAC;QAEF,4EAA4E;QAC5E,IAAI,UAAU,CAAC,gBAAgB,KAAK,UAAU,EAAE,CAAC;YAC/C,MAAM,SAAS,GAAG,YAAY,CAAC,OAAO,EAAE,UAAU,CAAC,CAAC;YACpD,2CAA2C;YAC3C,MAAM,QAAQ,GACZ,OAAO,CAAC,OAAO,CAAC,QAAQ;gBACxB,OAAO,CAAC,OAAO,CAAC,MAAM;gBACtB,OAAO,CAAC,OAAO,CAAC,IAAI,CAAC;YAEvB,mEAAmE;YACnE,MAAM,kBAAkB,GAAG,iBAAiB,CAAC,QAAQ,EAAE,SAAS,CAAC,CAAC;YAElE,IAAI,kBAAkB,EAAE,CAAC;gBACvB,MAAM,CAAC,KAAK,CACV,4BAA4B,kBAAkB,0BAA0B,CACzE,CAAC;gBACF,MAAM,OAAO,CAAC,GAAG,CAAC,cAAc,CAAC,UAAU,EAAE,kBAAkB,EAAE,EAAE,CAAC,CAAC;YACvE,CAAC;QACH,CAAC;QAED,MAAM,kBAAkB,GAAG,oBAAoB,CAAC,UAAU,EAAE,WAAW,CAAC,CAAC;QACzE,0DAA0D;QAC1D,QAAQ,CAAC,OAAO,CAAC,MAAM,EAAE,CAAC,OAAO,CAAC,CAAC,MAAM,EAAE,EAAE;YAC3C,kBAAkB,CAAC,OAAO,CAAC,GAAG,CAAC,MAAM,CAAC,CAAC;QACzC,CAAC,CAAC,CAAC;QACH,OAAO,kBAAkB,CAAC;IAC5B,CAAC;IAED,OAAO,QAAQ,CAAC;AAClB,CAAC,CAAC;AAEF;;;;;GAKG;AACH,MAAM,CAAC,MAAM,eAAe,GAAG,CAAC,GAAW,EAAE,QAAgB,EAAE,EAAE;IAC/D,QAAQ,GAAG,GAAG,GAAG,QAAQ,CAAC,OAAO,CAAC,UAAU,EAAE,EAAE,CAAC,CAAC,CAAC,qBAAqB;IAExE,MAAM,UAAU,GAAG,cAAc,CAAC,IAAI,CAAC,GAAG,CAAC,CAAC;IAE5C,IAAI,UAAU,EAAE,CAAC;QACf,MAAM,CAAC,GAAG,IAAI,GAAG,CAAC,GAAG,CAAC,CAAC;QACvB,IAAI,CAAC,CAAC,CAAC,QAAQ,CAAC,UAAU,CAAC,QAAQ,CAAC,EAAE,CAAC;YACrC,CAAC,CAAC,QAAQ;gBACR,QAAQ,GAAG,CAAC,CAAC,CAAC,QAAQ,CAAC,UAAU,CAAC,GAAG,CAAC,CAAC,CAAC,CAAC,EAAE,CAAC,CAAC,CAAC,GAAG,CAAC,GAAG,CAAC,CAAC,QAAQ,CAAC;QACpE,CAAC;QACD,OAAO,CAAC,CAAC,QAAQ,EAAE,CAAC;IACtB,CAAC;IAED,OAAO,GAAG,CAAC,UAAU,CAAC,QAAQ,CAAC;QAC7B,CAAC,CAAC,GAAG;QACL,CAAC,CAAC,QAAQ,GAAG,CAAC,GAAG,CAAC,UAAU,CAAC,GAAG,CAAC,CAAC,CAAC,CAAC,EAAE,CAAC,CAAC,CAAC,GAAG,CAAC,GAAG,GAAG,CAAC;AACxD,CAAC,CAAC;AAEF,MAAM,CAAC,MAAM,oBAAoB,GAAG,CAClC,MAAkB,EAClB,SAAiB,EACH,EAAE,CAChB,YAAY,CAAC,QAAQ,CAAC,eAAe,CAAC,SAAS,EAAE,MAAM,CAAC,QAAQ,IAAI,EAAE,CAAC,CAAC,CAAC","sourcesContent":["import {\n  systemUrlsConfig,\n  type AuthConfig,\n  type AuthConfigWithDefaults,\n} from \"@/nextjs/config.js\";\nimport type { NextRequest } from \"next/server.js\";\nimport { NextResponse } from \"next/server.js\";\nimport type { SessionData } from \"@/types.js\";\nimport { loggers } from \"@/lib/logger.js\";\nimport picomatch from \"picomatch\";\nimport {\n  AuthFlowCookie,\n  CodeVerifier,\n  OAuthTokenTypes,\n  UserStorage,\n  type CookieConfig,\n  type KeySetter,\n} from \"@/shared/lib/types.js\";\nimport {\n  clearTokens,\n  getCookieConfiguration,\n  sanitizeReturnUrl,\n} from \"@/shared/lib/util.js\";\nimport { CookieStorage } from \"@/server/index.js\";\nimport { extractCookieFromRawHeader } from \"@/shared/lib/cookieUtils.js\";\n\nconst logger = loggers.nextjs.middleware;\n\nexport const resolveCallbackUrl = (\n  config: AuthConfigWithDefaults,\n  baseUrl?: string,\n): string => {\n  const callbackUrl = new URL(config?.callbackUrl, baseUrl).toString();\n  return callbackUrl.toString();\n};\n\nexport function sanitizeBasePath(path: string): string {\n  if (!path || path === \"/\") return \"\";\n\n  // Ensure it starts with a slash\n  const withLeadingSlash = path.startsWith(\"/\") ? path : `/${path}`;\n\n  // Remove all trailing slashes (not just one)\n  return withLeadingSlash.replace(/\\/+$/, \"\");\n}\n\n/**\n * Removes the basePath prefix from a pathname, properly handling edge cases\n * This is the inverse operation of adding basePath to a URL\n */\nexport function removeBasePathFromPath(\n  pathname: string,\n  basePath?: string,\n): string {\n  if (!basePath || basePath === \"\" || basePath === \"/\") {\n    return pathname;\n  }\n\n  // Sanitize the basePath to ensure consistent format\n  const sanitizedBasePath = sanitizeBasePath(basePath);\n\n  // Check if pathname starts with the basePath followed by a slash or end of string\n  // This prevents partial matches like \"/app\" matching \"/application\"\n  if (pathname === sanitizedBasePath) {\n    // Exact match - return root\n    return \"/\";\n  } else if (pathname.startsWith(sanitizedBasePath + \"/\")) {\n    // basePath followed by slash - remove basePath but keep the slash\n    return pathname.slice(sanitizedBasePath.length);\n  }\n\n  // If basePath doesn't match as a complete path segment, return pathname as-is\n  return pathname;\n}\n\nconst getOriginUrl = (\n  request: NextRequest,\n  authConfig: AuthConfigWithDefaults,\n): string => {\n  // Use configured baseUrl if provided (for reverse proxy scenarios)\n  if (authConfig.baseUrl) {\n    return authConfig.baseUrl;\n  }\n\n  // Fallback to nextUrl.origin (includes port automatically)\n  return request.nextUrl.origin;\n};\n\n// Matches globs:\n// Examples:\n// /user\n// /user/*\n// /user/**/info\nconst matchGlob = (pathname: string, globPattern: string) => {\n  const matches = picomatch(globPattern);\n  return matches(pathname);\n};\n\nconst matchesGlobs = (pathname: string, patterns: string[]) =>\n  patterns.some((pattern) => {\n    if (!pattern) return false;\n    return matchGlob(pathname, pattern);\n  });\n\n/**\n * Determines if we should attempt token refresh based on session state\n */\nexport const shouldAttemptRefresh = (session: SessionData): boolean => {\n  return !session.authenticated && !!session.refreshToken;\n};\n\nconst stripBasePathPrefix = (path: string, basePath: string = \"\") => {\n  return path.replace(new RegExp(`^${basePath}`), \"\");\n};\n/**\n * Checks if the current path is a system URL that should skip auth\n */\nexport const shouldSkipAuthForSystemUrls = (\n  pathname: string,\n  authConfig: AuthConfigWithDefaults,\n): boolean => {\n  // make an array of all system URLs from authConfig using the systemUrlsConfig keys\n  const systemUrls = Object.keys(systemUrlsConfig).map(\n    (key) => authConfig[key as keyof AuthConfigWithDefaults] as string,\n  );\n\n  // check if any of the urls in systemUrls has a substring match with pathname\n  // the systemUrl or incoming path could have a basePath, i.e. /dashboard/api/auth/callback\n  // therefore we check if the systemUrl equals the pathname after stripping the basePath prefix\n  const strippedPathname = stripBasePathPrefix(pathname, authConfig.basePath);\n  const strippedSystemUrls = systemUrls.map((url) =>\n    stripBasePathPrefix(url, authConfig.basePath),\n  );\n  const isSystemUrl = strippedSystemUrls.some(\n    (url) => url && pathname && pathname !== \"/\" && url === strippedPathname,\n  );\n  logger.debug(\"→ isSystemUrl check\", { pathname, isSystemUrl, systemUrls });\n  if (isSystemUrl) {\n    logger.debug(\n      \"→ Skipping auth check - this a URL defined in authConfig\",\n      pathname,\n    );\n  }\n\n  return isSystemUrl;\n};\n\n/**\n * CookieStorage implementation for NextJS middleware context that works with NextRequest\n */\nexport class NextjsMiddlewareCookieStorage extends CookieStorage {\n  constructor(\n    public config: Partial<Record<KeySetter, CookieConfig>> = {},\n    private request: NextRequest,\n    private response: NextResponse,\n  ) {\n    super({\n      secure: true,\n      httpOnly: true,\n    });\n  }\n\n  async get(key: string): Promise<string | null> {\n    // First try to get cookies from the response if it has already been set\n    const cookieValue = this.response.cookies.get(key)?.value;\n    if (cookieValue) {\n      return cookieValue;\n    }\n\n    const cookieSettings = this.config?.[key as KeySetter] || {};\n    const configuredPath = cookieSettings.path;\n\n    // If we have a non-root basePath, use raw header parsing to get the first cookie\n    // which should be from the most specific path, avoiding duplicate cookie conflicts\n    if (configuredPath && configuredPath !== \"/\") {\n      const cookieHeader = this.request.headers.get(\"cookie\");\n      const rawValue = extractCookieFromRawHeader(cookieHeader, key);\n      if (rawValue) {\n        return rawValue;\n      }\n    }\n\n    // Fallback to standard Next.js request cookies\n    return this.request.cookies.get(key)?.value || null;\n  }\n\n  async set(\n    key: string,\n    value: string,\n    cookieConfigOverride: CookieConfig,\n  ): Promise<void> {\n    const cookieSettings = this.config?.[key as KeySetter] || {\n      ...this.settings,\n    };\n    const dynamicConfig = getCookieConfiguration(this.request);\n\n    const useCookieSettings = {\n      ...cookieSettings,\n      ...cookieConfigOverride,\n      // Apply dynamic configuration for secure and sameSite\n      secure: dynamicConfig.secure,\n      sameSite: dynamicConfig.sameSite,\n    };\n\n    // Respect the httpOnly setting from configuration instead of hardcoding it\n    this.response.cookies.set(key, value, useCookieSettings);\n  }\n\n  async delete(key: string): Promise<void> {\n    // Get cookie configuration for this key to respect the path setting\n    const cookieSettings = this.config?.[key as KeySetter] || {};\n\n    // If we have a path configured, use it when deleting the cookie\n    if (cookieSettings.path) {\n      this.response.cookies.set(key, \"\", {\n        expires: new Date(0), // Expire in the past\n        path: cookieSettings.path,\n      });\n    } else {\n      this.response.cookies.delete(key);\n    }\n  }\n}\n\n/**\n * Handles authentication logic specifically for the login URL\n * Provides logging for login URL access patterns\n */\nexport const handleLoginUrl = (\n  pathname: string,\n  session: SessionData,\n  authConfig: AuthConfigWithDefaults,\n): void => {\n  if (pathname !== authConfig.loginUrl) {\n    return;\n  }\n\n  // We are on the login URL - log the access pattern\n  if (session.authenticated) {\n    logger.debug(`→ Authenticated user accessing login page`);\n  } else {\n    logger.debug(`→ Unauthenticated user accessing login page`);\n  }\n};\n\n/**\n * Checks if the current path should skip auth based on include/exclude patterns\n */\nexport const shouldSkipAuthForRoutePatterns = (\n  pathname: string,\n  authConfig: AuthConfigWithDefaults,\n): boolean => {\n  // Check include patterns\n  if (!matchesGlobs(pathname, authConfig.include)) {\n    logger.debug(\n      \"→ Skipping auth check - path not in include patterns\",\n      pathname,\n    );\n    return true;\n  }\n\n  // Check exclude patterns\n  if (matchesGlobs(pathname, authConfig.exclude)) {\n    logger.debug(\"→ Skipping auth check - path in exclude patterns\", pathname);\n    return true;\n  }\n\n  return false;\n};\n\nexport const copyCivicCookies = (\n  sourceResponse: NextResponse,\n  targetCall: NextResponse | NextRequest,\n) => {\n  const civicCookieNames = [\n    ...Object.values(OAuthTokenTypes),\n    ...Object.values(UserStorage),\n    ...Object.values(CodeVerifier),\n  ];\n  logger.debug(\"Copying Civic cookies:\", {\n    src: sourceResponse.url,\n    target: targetCall.url,\n  });\n  sourceResponse?.cookies\n    .getAll()\n    .filter((cookie) =>\n      civicCookieNames.includes(cookie.name as OAuthTokenTypes),\n    )\n    .forEach((cookie) => {\n      logger.debug(\"Setting middlewareResponse cookie:\", cookie);\n      targetCall.cookies.set(cookie);\n    });\n};\n/**\n * Handles final authentication logic for unauthenticated users on protected routes\n */\nexport const handleUnauthenticatedUser = async (\n  session: SessionData,\n  request: NextRequest,\n  response: NextResponse,\n  storage: NextjsMiddlewareCookieStorage,\n  authConfig: AuthConfigWithDefaults,\n): Promise<NextResponse | undefined> => {\n  // Clear expired/invalid tokens if they exist\n  if (session.accessToken || session.idToken || session.refreshToken) {\n    logger.debug(`→ Clearing expired/invalid tokens`);\n    await clearTokens(storage);\n  }\n\n  // Final fallback: redirect to login unless we're already there.\n  const loginUrl = new URL(\n    authConfig.loginUrl,\n    getOriginUrl(request, authConfig),\n  );\n  const redirectUrl = `${loginUrl.toString()}`;\n  const loginPathWithoutBasePath = removeBasePathFromPath(\n    loginUrl.pathname,\n    authConfig.basePath,\n  );\n\n  // If we're already at the login URL, the middleware will just return undefined.\n  // This is to prevent an infinite redirect loop if middleware is applied to the login route itself.\n  // The loginUrl from getOriginUrl already includes the basePath, but request.nextUrl.pathname does not. So we strip it off to enable comparison.\n  if (request.nextUrl.pathname !== loginPathWithoutBasePath) {\n    logger.debug(\n      `→ No valid tokens found - redirecting to login \"${redirectUrl}\"`,\n    );\n\n    // Preserve the original URL as a deep link for post-authentication redirect\n    if (authConfig.deepLinkHandling !== \"disabled\") {\n      const originUrl = getOriginUrl(request, authConfig);\n      // Get the full path including query string\n      const fullPath =\n        request.nextUrl.pathname +\n        request.nextUrl.search +\n        request.nextUrl.hash;\n\n      // Sanitize the return URL to prevent open redirect vulnerabilities\n      const sanitizedReturnUrl = sanitizeReturnUrl(fullPath, originUrl);\n\n      if (sanitizedReturnUrl) {\n        logger.debug(\n          `→ Preserving deep link: \"${sanitizedReturnUrl}\" for post-auth redirect`,\n        );\n        await storage.set(AuthFlowCookie.RETURN_URL, sanitizedReturnUrl, {});\n      }\n    }\n\n    const redirectedResponse = redirectWithBasePath(authConfig, redirectUrl);\n    // Copy any cookies that were set to the redirect response\n    response.cookies.getAll().forEach((cookie) => {\n      redirectedResponse.cookies.set(cookie);\n    });\n    return redirectedResponse;\n  }\n\n  return response;\n};\n\n/**\n * Prepends the basePath onto a given URL if it's not already there. Works for both relative and absolute URLs.\n * @param url\n * @param basePath\n * @returns\n */\nexport const prependBasePath = (url: string, basePath: string) => {\n  basePath = \"/\" + basePath.replace(/^\\/|\\/$/g, \"\"); // normalize basePath\n\n  const isAbsolute = /^https?:\\/\\//.test(url);\n\n  if (isAbsolute) {\n    const u = new URL(url);\n    if (!u.pathname.startsWith(basePath)) {\n      u.pathname =\n        basePath + (u.pathname.startsWith(\"/\") ? \"\" : \"/\") + u.pathname;\n    }\n    return u.toString();\n  }\n\n  return url.startsWith(basePath)\n    ? url\n    : basePath + (url.startsWith(\"/\") ? \"\" : \"/\") + url;\n};\n\nexport const redirectWithBasePath = (\n  config: AuthConfig,\n  targetUrl: string,\n): NextResponse =>\n  NextResponse.redirect(prependBasePath(targetUrl, config.basePath || \"\"));\n"]}
+{"version":3,"file":"utils.js","sourceRoot":"","sources":["../../src/nextjs/utils.ts"],"names":[],"mappings":"AAAA,OAAO,EACL,gBAAgB,GAGjB,MAAM,oBAAoB,CAAC;AAE5B,OAAO,EAAE,YAAY,EAAE,MAAM,gBAAgB,CAAC;AAE9C,OAAO,EAAE,OAAO,EAAE,MAAM,iBAAiB,CAAC;AAC1C,OAAO,SAAS,MAAM,WAAW,CAAC;AAClC,OAAO,EACL,cAAc,EACd,YAAY,EACZ,eAAe,EACf,WAAW,GAGZ,MAAM,uBAAuB,CAAC;AAC/B,OAAO,EACL,WAAW,EACX,sBAAsB,EACtB,iBAAiB,GAClB,MAAM,sBAAsB,CAAC;AAE9B,oCAAoC;AACpC,OAAO,EAAE,iBAAiB,EAAE,CAAC;AAC7B,OAAO,EAAE,aAAa,EAAE,MAAM,mBAAmB,CAAC;AAClD,OAAO,EAAE,0BAA0B,EAAE,MAAM,6BAA6B,CAAC;AAEzE,MAAM,MAAM,GAAG,OAAO,CAAC,MAAM,CAAC,UAAU,CAAC;AAEzC,MAAM,CAAC,MAAM,kBAAkB,GAAG,CAChC,MAA8B,EAC9B,OAAgB,EACR,EAAE;IACV,MAAM,WAAW,GAAG,IAAI,GAAG,CAAC,MAAM,EAAE,WAAW,EAAE,OAAO,CAAC,CAAC,QAAQ,EAAE,CAAC;IACrE,OAAO,WAAW,CAAC,QAAQ,EAAE,CAAC;AAChC,CAAC,CAAC;AAEF,MAAM,UAAU,gBAAgB,CAAC,IAAY;IAC3C,IAAI,CAAC,IAAI,IAAI,IAAI,KAAK,GAAG;QAAE,OAAO,EAAE,CAAC;IAErC,gCAAgC;IAChC,MAAM,gBAAgB,GAAG,IAAI,CAAC,UAAU,CAAC,GAAG,CAAC,CAAC,CAAC,CAAC,IAAI,CAAC,CAAC,CAAC,IAAI,IAAI,EAAE,CAAC;IAElE,6CAA6C;IAC7C,OAAO,gBAAgB,CAAC,OAAO,CAAC,MAAM,EAAE,EAAE,CAAC,CAAC;AAC9C,CAAC;AAED;;;GAGG;AACH,MAAM,UAAU,sBAAsB,CACpC,QAAgB,EAChB,QAAiB;IAEjB,IAAI,CAAC,QAAQ,IAAI,QAAQ,KAAK,EAAE,IAAI,QAAQ,KAAK,GAAG,EAAE,CAAC;QACrD,OAAO,QAAQ,CAAC;IAClB,CAAC;IAED,oDAAoD;IACpD,MAAM,iBAAiB,GAAG,gBAAgB,CAAC,QAAQ,CAAC,CAAC;IAErD,kFAAkF;IAClF,oEAAoE;IACpE,IAAI,QAAQ,KAAK,iBAAiB,EAAE,CAAC;QACnC,4BAA4B;QAC5B,OAAO,GAAG,CAAC;IACb,CAAC;SAAM,IAAI,QAAQ,CAAC,UAAU,CAAC,iBAAiB,GAAG,GAAG,CAAC,EAAE,CAAC;QACxD,kEAAkE;QAClE,OAAO,QAAQ,CAAC,KAAK,CAAC,iBAAiB,CAAC,MAAM,CAAC,CAAC;IAClD,CAAC;IAED,8EAA8E;IAC9E,OAAO,QAAQ,CAAC;AAClB,CAAC;AAED,MAAM,CAAC,MAAM,YAAY,GAAG,CAC1B,OAAoB,EACpB,UAAkC,EAC1B,EAAE;IACV,mEAAmE;IACnE,IAAI,UAAU,CAAC,OAAO,EAAE,CAAC;QACvB,OAAO,UAAU,CAAC,OAAO,CAAC;IAC5B,CAAC;IAED,2DAA2D;IAC3D,OAAO,OAAO,CAAC,OAAO,CAAC,MAAM,CAAC;AAChC,CAAC,CAAC;AAEF,iBAAiB;AACjB,YAAY;AACZ,QAAQ;AACR,UAAU;AACV,gBAAgB;AAChB,MAAM,SAAS,GAAG,CAAC,QAAgB,EAAE,WAAmB,EAAE,EAAE;IAC1D,MAAM,OAAO,GAAG,SAAS,CAAC,WAAW,CAAC,CAAC;IACvC,OAAO,OAAO,CAAC,QAAQ,CAAC,CAAC;AAC3B,CAAC,CAAC;AAEF,MAAM,YAAY,GAAG,CAAC,QAAgB,EAAE,QAAkB,EAAE,EAAE,CAC5D,QAAQ,CAAC,IAAI,CAAC,CAAC,OAAO,EAAE,EAAE;IACxB,IAAI,CAAC,OAAO;QAAE,OAAO,KAAK,CAAC;IAC3B,OAAO,SAAS,CAAC,QAAQ,EAAE,OAAO,CAAC,CAAC;AACtC,CAAC,CAAC,CAAC;AAEL;;GAEG;AACH,MAAM,CAAC,MAAM,oBAAoB,GAAG,CAAC,OAAoB,EAAW,EAAE;IACpE,OAAO,CAAC,OAAO,CAAC,aAAa,IAAI,CAAC,CAAC,OAAO,CAAC,YAAY,CAAC;AAC1D,CAAC,CAAC;AAEF,MAAM,mBAAmB,GAAG,CAAC,IAAY,EAAE,WAAmB,EAAE,EAAE,EAAE;IAClE,OAAO,IAAI,CAAC,OAAO,CAAC,IAAI,MAAM,CAAC,IAAI,QAAQ,EAAE,CAAC,EAAE,EAAE,CAAC,CAAC;AACtD,CAAC,CAAC;AACF;;GAEG;AACH,MAAM,CAAC,MAAM,2BAA2B,GAAG,CACzC,QAAgB,EAChB,UAAkC,EACzB,EAAE;IACX,mFAAmF;IACnF,MAAM,UAAU,GAAG,MAAM,CAAC,IAAI,CAAC,gBAAgB,CAAC,CAAC,GAAG,CAClD,CAAC,GAAG,EAAE,EAAE,CAAC,UAAU,CAAC,GAAmC,CAAW,CACnE,CAAC;IAEF,6EAA6E;IAC7E,0FAA0F;IAC1F,8FAA8F;IAC9F,MAAM,gBAAgB,GAAG,mBAAmB,CAAC,QAAQ,EAAE,UAAU,CAAC,QAAQ,CAAC,CAAC;IAC5E,MAAM,kBAAkB,GAAG,UAAU,CAAC,GAAG,CAAC,CAAC,GAAG,EAAE,EAAE,CAChD,mBAAmB,CAAC,GAAG,EAAE,UAAU,CAAC,QAAQ,CAAC,CAC9C,CAAC;IACF,MAAM,WAAW,GAAG,kBAAkB,CAAC,IAAI,CACzC,CAAC,GAAG,EAAE,EAAE,CAAC,GAAG,IAAI,QAAQ,IAAI,QAAQ,KAAK,GAAG,IAAI,GAAG,KAAK,gBAAgB,CACzE,CAAC;IACF,MAAM,CAAC,KAAK,CAAC,qBAAqB,EAAE,EAAE,QAAQ,EAAE,WAAW,EAAE,UAAU,EAAE,CAAC,CAAC;IAC3E,IAAI,WAAW,EAAE,CAAC;QAChB,MAAM,CAAC,KAAK,CACV,0DAA0D,EAC1D,QAAQ,CACT,CAAC;IACJ,CAAC;IAED,OAAO,WAAW,CAAC;AACrB,CAAC,CAAC;AAEF;;GAEG;AACH,MAAM,OAAO,6BAA8B,SAAQ,aAAa;IAErD;IACC;IACA;IAHV,YACS,SAAmD,EAAE,EACpD,OAAoB,EACpB,QAAsB;QAE9B,KAAK,CAAC;YACJ,MAAM,EAAE,IAAI;YACZ,QAAQ,EAAE,IAAI;SACf,CAAC,CAAC;QAPI,WAAM,GAAN,MAAM,CAA+C;QACpD,YAAO,GAAP,OAAO,CAAa;QACpB,aAAQ,GAAR,QAAQ,CAAc;IAMhC,CAAC;IAED,KAAK,CAAC,GAAG,CAAC,GAAW;QACnB,wEAAwE;QACxE,MAAM,WAAW,GAAG,IAAI,CAAC,QAAQ,CAAC,OAAO,CAAC,GAAG,CAAC,GAAG,CAAC,EAAE,KAAK,CAAC;QAC1D,IAAI,WAAW,EAAE,CAAC;YAChB,OAAO,WAAW,CAAC;QACrB,CAAC;QAED,MAAM,cAAc,GAAG,IAAI,CAAC,MAAM,EAAE,CAAC,GAAgB,CAAC,IAAI,EAAE,CAAC;QAC7D,MAAM,cAAc,GAAG,cAAc,CAAC,IAAI,CAAC;QAE3C,iFAAiF;QACjF,mFAAmF;QACnF,IAAI,cAAc,IAAI,cAAc,KAAK,GAAG,EAAE,CAAC;YAC7C,MAAM,YAAY,GAAG,IAAI,CAAC,OAAO,CAAC,OAAO,CAAC,GAAG,CAAC,QAAQ,CAAC,CAAC;YACxD,MAAM,QAAQ,GAAG,0BAA0B,CAAC,YAAY,EAAE,GAAG,CAAC,CAAC;YAC/D,IAAI,QAAQ,EAAE,CAAC;gBACb,OAAO,QAAQ,CAAC;YAClB,CAAC;QACH,CAAC;QAED,+CAA+C;QAC/C,OAAO,IAAI,CAAC,OAAO,CAAC,OAAO,CAAC,GAAG,CAAC,GAAG,CAAC,EAAE,KAAK,IAAI,IAAI,CAAC;IACtD,CAAC;IAED,KAAK,CAAC,GAAG,CACP,GAAW,EACX,KAAa,EACb,oBAAkC;QAElC,MAAM,cAAc,GAAG,IAAI,CAAC,MAAM,EAAE,CAAC,GAAgB,CAAC,IAAI;YACxD,GAAG,IAAI,CAAC,QAAQ;SACjB,CAAC;QACF,MAAM,aAAa,GAAG,sBAAsB,CAAC,IAAI,CAAC,OAAO,CAAC,CAAC;QAE3D,MAAM,iBAAiB,GAAG;YACxB,GAAG,cAAc;YACjB,GAAG,oBAAoB;YACvB,sDAAsD;YACtD,MAAM,EAAE,aAAa,CAAC,MAAM;YAC5B,QAAQ,EAAE,aAAa,CAAC,QAAQ;SACjC,CAAC;QAEF,2EAA2E;QAC3E,IAAI,CAAC,QAAQ,CAAC,OAAO,CAAC,GAAG,CAAC,GAAG,EAAE,KAAK,EAAE,iBAAiB,CAAC,CAAC;IAC3D,CAAC;IAED,KAAK,CAAC,MAAM,CAAC,GAAW;QACtB,oEAAoE;QACpE,MAAM,cAAc,GAAG,IAAI,CAAC,MAAM,EAAE,CAAC,GAAgB,CAAC,IAAI,EAAE,CAAC;QAE7D,gEAAgE;QAChE,IAAI,cAAc,CAAC,IAAI,EAAE,CAAC;YACxB,IAAI,CAAC,QAAQ,CAAC,OAAO,CAAC,GAAG,CAAC,GAAG,EAAE,EAAE,EAAE;gBACjC,MAAM,EAAE,CAAC,EAAE,gCAAgC;gBAC3C,IAAI,EAAE,cAAc,CAAC,IAAI;aAC1B,CAAC,CAAC;QACL,CAAC;aAAM,CAAC;YACN,IAAI,CAAC,QAAQ,CAAC,OAAO,CAAC,MAAM,CAAC,GAAG,CAAC,CAAC;QACpC,CAAC;IACH,CAAC;CACF;AAED;;;GAGG;AACH,MAAM,CAAC,MAAM,cAAc,GAAG,CAC5B,QAAgB,EAChB,OAAoB,EACpB,UAAkC,EAC5B,EAAE;IACR,IAAI,QAAQ,KAAK,UAAU,CAAC,QAAQ,EAAE,CAAC;QACrC,OAAO;IACT,CAAC;IAED,mDAAmD;IACnD,IAAI,OAAO,CAAC,aAAa,EAAE,CAAC;QAC1B,MAAM,CAAC,KAAK,CAAC,2CAA2C,CAAC,CAAC;IAC5D,CAAC;SAAM,CAAC;QACN,MAAM,CAAC,KAAK,CAAC,6CAA6C,CAAC,CAAC;IAC9D,CAAC;AACH,CAAC,CAAC;AAEF;;GAEG;AACH,MAAM,CAAC,MAAM,8BAA8B,GAAG,CAC5C,QAAgB,EAChB,UAAkC,EACzB,EAAE;IACX,yBAAyB;IACzB,IAAI,CAAC,YAAY,CAAC,QAAQ,EAAE,UAAU,CAAC,OAAO,CAAC,EAAE,CAAC;QAChD,MAAM,CAAC,KAAK,CACV,sDAAsD,EACtD,QAAQ,CACT,CAAC;QACF,OAAO,IAAI,CAAC;IACd,CAAC;IAED,yBAAyB;IACzB,IAAI,YAAY,CAAC,QAAQ,EAAE,UAAU,CAAC,OAAO,CAAC,EAAE,CAAC;QAC/C,MAAM,CAAC,KAAK,CAAC,kDAAkD,EAAE,QAAQ,CAAC,CAAC;QAC3E,OAAO,IAAI,CAAC;IACd,CAAC;IAED,OAAO,KAAK,CAAC;AACf,CAAC,CAAC;AAEF,MAAM,CAAC,MAAM,gBAAgB,GAAG,CAC9B,cAA4B,EAC5B,UAAsC,EACtC,EAAE;IACF,MAAM,gBAAgB,GAAG;QACvB,GAAG,MAAM,CAAC,MAAM,CAAC,eAAe,CAAC;QACjC,GAAG,MAAM,CAAC,MAAM,CAAC,WAAW,CAAC;QAC7B,GAAG,MAAM,CAAC,MAAM,CAAC,YAAY,CAAC;KAC/B,CAAC;IACF,MAAM,CAAC,KAAK,CAAC,wBAAwB,EAAE;QACrC,GAAG,EAAE,cAAc,CAAC,GAAG;QACvB,MAAM,EAAE,UAAU,CAAC,GAAG;KACvB,CAAC,CAAC;IACH,cAAc,EAAE,OAAO;SACpB,MAAM,EAAE;SACR,MAAM,CAAC,CAAC,MAAM,EAAE,EAAE,CACjB,gBAAgB,CAAC,QAAQ,CAAC,MAAM,CAAC,IAAuB,CAAC,CAC1D;SACA,OAAO,CAAC,CAAC,MAAM,EAAE,EAAE;QAClB,MAAM,CAAC,KAAK,CAAC,oCAAoC,EAAE,MAAM,CAAC,CAAC;QAC3D,UAAU,CAAC,OAAO,CAAC,GAAG,CAAC,MAAM,CAAC,CAAC;IACjC,CAAC,CAAC,CAAC;AACP,CAAC,CAAC;AACF;;GAEG;AACH,MAAM,CAAC,MAAM,yBAAyB,GAAG,KAAK,EAC5C,OAAoB,EACpB,OAAoB,EACpB,QAAsB,EACtB,OAAsC,EACtC,UAAkC,EACC,EAAE;IACrC,6CAA6C;IAC7C,IAAI,OAAO,CAAC,WAAW,IAAI,OAAO,CAAC,OAAO,IAAI,OAAO,CAAC,YAAY,EAAE,CAAC;QACnE,MAAM,CAAC,KAAK,CAAC,mCAAmC,CAAC,CAAC;QAClD,MAAM,WAAW,CAAC,OAAO,CAAC,CAAC;IAC7B,CAAC;IAED,gEAAgE;IAChE,MAAM,QAAQ,GAAG,IAAI,GAAG,CACtB,UAAU,CAAC,QAAQ,EACnB,YAAY,CAAC,OAAO,EAAE,UAAU,CAAC,CAClC,CAAC;IACF,MAAM,WAAW,GAAG,GAAG,QAAQ,CAAC,QAAQ,EAAE,EAAE,CAAC;IAC7C,MAAM,wBAAwB,GAAG,sBAAsB,CACrD,QAAQ,CAAC,QAAQ,EACjB,UAAU,CAAC,QAAQ,CACpB,CAAC;IAEF,gFAAgF;IAChF,mGAAmG;IACnG,gJAAgJ;IAChJ,IAAI,OAAO,CAAC,OAAO,CAAC,QAAQ,KAAK,wBAAwB,EAAE,CAAC;QAC1D,MAAM,CAAC,KAAK,CACV,mDAAmD,WAAW,GAAG,CAClE,CAAC;QAEF,4EAA4E;QAC5E,sEAAsE;QACtE,IAAI,UAAU,CAAC,gBAAgB,KAAK,UAAU,EAAE,CAAC;YAC/C,MAAM,SAAS,GAAG,YAAY,CAAC,OAAO,EAAE,UAAU,CAAC,CAAC;YACpD,2CAA2C;YAC3C,MAAM,QAAQ,GACZ,OAAO,CAAC,OAAO,CAAC,QAAQ;gBACxB,OAAO,CAAC,OAAO,CAAC,MAAM;gBACtB,OAAO,CAAC,OAAO,CAAC,IAAI,CAAC;YAEvB,mEAAmE;YACnE,MAAM,kBAAkB,GAAG,iBAAiB,CAAC,QAAQ,EAAE,SAAS,CAAC,CAAC;YAElE,IAAI,kBAAkB,EAAE,CAAC;gBACvB,IAAI,QAAgB,CAAC;gBAErB,IAAI,UAAU,CAAC,gBAAgB,KAAK,iBAAiB,EAAE,CAAC;oBACtD,6EAA6E;oBAC7E,MAAM,eAAe,GAAG,UAAU,CAAC,eAAe,IAAI,GAAG,CAAC;oBAC1D,IAAI,CAAC;wBACH,MAAM,YAAY,GAAG,IAAI,GAAG,CAAC,kBAAkB,EAAE,SAAS,CAAC,CAAC;wBAE5D,mDAAmD;wBACnD,IAAI,YAAY,CAAC,YAAY,CAAC,IAAI,KAAK,CAAC,EAAE,CAAC;4BACzC,MAAM,CAAC,KAAK,CACV,2FAA2F,eAAe,GAAG,CAC9G,CAAC;4BACF,QAAQ,GAAG,eAAe,CAAC;wBAC7B,CAAC;6BAAM,CAAC;4BACN,MAAM,UAAU,GAAG,IAAI,GAAG,CAAC,eAAe,EAAE,SAAS,CAAC,CAAC;4BAEvD,2DAA2D;4BAC3D,YAAY,CAAC,YAAY,CAAC,OAAO,CAAC,CAAC,KAAK,EAAE,GAAG,EAAE,EAAE;gCAC/C,UAAU,CAAC,YAAY,CAAC,GAAG,CAAC,GAAG,EAAE,KAAK,CAAC,CAAC;4BAC1C,CAAC,CAAC,CAAC;4BAEH,QAAQ;gCACN,UAAU,CAAC,QAAQ,GAAG,UAAU,CAAC,MAAM,GAAG,UAAU,CAAC,IAAI,CAAC;4BAC5D,MAAM,CAAC,KAAK,CACV,2DAA2D,QAAQ,GAAG,CACvE,CAAC;wBACJ,CAAC;oBACH,CAAC;oBAAC,MAAM,CAAC;wBACP,qDAAqD;wBACrD,MAAM,CAAC,IAAI,CACT,iEAAiE,CAClE,CAAC;wBACF,QAAQ,GAAG,eAAe,CAAC;oBAC7B,CAAC;gBACH,CAAC;qBAAM,CAAC;oBACN,sCAAsC;oBACtC,QAAQ,GAAG,kBAAkB,CAAC;oBAC9B,MAAM,CAAC,KAAK,CACV,qDAAqD,QAAQ,GAAG,CACjE,CAAC;gBACJ,CAAC;gBAED,8CAA8C;gBAC9C,MAAM,OAAO,CAAC,GAAG,CAAC,cAAc,CAAC,UAAU,EAAE,QAAQ,EAAE,EAAE,CAAC,CAAC;YAC7D,CAAC;QACH,CAAC;QAED,MAAM,kBAAkB,GAAG,oBAAoB,CAAC,UAAU,EAAE,WAAW,CAAC,CAAC;QACzE,0DAA0D;QAC1D,QAAQ,CAAC,OAAO,CAAC,MAAM,EAAE,CAAC,OAAO,CAAC,CAAC,MAAM,EAAE,EAAE;YAC3C,kBAAkB,CAAC,OAAO,CAAC,GAAG,CAAC,MAAM,CAAC,CAAC;QACzC,CAAC,CAAC,CAAC;QACH,OAAO,kBAAkB,CAAC;IAC5B,CAAC;IAED,OAAO,QAAQ,CAAC;AAClB,CAAC,CAAC;AAEF;;;;;GAKG;AACH,MAAM,CAAC,MAAM,eAAe,GAAG,CAAC,GAAW,EAAE,QAAgB,EAAE,EAAE;IAC/D,QAAQ,GAAG,GAAG,GAAG,QAAQ,CAAC,OAAO,CAAC,UAAU,EAAE,EAAE,CAAC,CAAC,CAAC,qBAAqB;IAExE,MAAM,UAAU,GAAG,cAAc,CAAC,IAAI,CAAC,GAAG,CAAC,CAAC;IAE5C,IAAI,UAAU,EAAE,CAAC;QACf,MAAM,CAAC,GAAG,IAAI,GAAG,CAAC,GAAG,CAAC,CAAC;QACvB,IAAI,CAAC,CAAC,CAAC,QAAQ,CAAC,UAAU,CAAC,QAAQ,CAAC,EAAE,CAAC;YACrC,CAAC,CAAC,QAAQ;gBACR,QAAQ,GAAG,CAAC,CAAC,CAAC,QAAQ,CAAC,UAAU,CAAC,GAAG,CAAC,CAAC,CAAC,CAAC,EAAE,CAAC,CAAC,CAAC,GAAG,CAAC,GAAG,CAAC,CAAC,QAAQ,CAAC;QACpE,CAAC;QACD,OAAO,CAAC,CAAC,QAAQ,EAAE,CAAC;IACtB,CAAC;IAED,OAAO,GAAG,CAAC,UAAU,CAAC,QAAQ,CAAC;QAC7B,CAAC,CAAC,GAAG;QACL,CAAC,CAAC,QAAQ,GAAG,CAAC,GAAG,CAAC,UAAU,CAAC,GAAG,CAAC,CAAC,CAAC,CAAC,EAAE,CAAC,CAAC,CAAC,GAAG,CAAC,GAAG,GAAG,CAAC;AACxD,CAAC,CAAC;AAEF,MAAM,CAAC,MAAM,oBAAoB,GAAG,CAClC,MAAkB,EAClB,SAAiB,EACH,EAAE,CAChB,YAAY,CAAC,QAAQ,CAAC,eAAe,CAAC,SAAS,EAAE,MAAM,CAAC,QAAQ,IAAI,EAAE,CAAC,CAAC,CAAC","sourcesContent":["import {\n  systemUrlsConfig,\n  type AuthConfig,\n  type AuthConfigWithDefaults,\n} from \"@/nextjs/config.js\";\nimport type { NextRequest } from \"next/server.js\";\nimport { NextResponse } from \"next/server.js\";\nimport type { SessionData } from \"@/types.js\";\nimport { loggers } from \"@/lib/logger.js\";\nimport picomatch from \"picomatch\";\nimport {\n  AuthFlowCookie,\n  CodeVerifier,\n  OAuthTokenTypes,\n  UserStorage,\n  type CookieConfig,\n  type KeySetter,\n} from \"@/shared/lib/types.js\";\nimport {\n  clearTokens,\n  getCookieConfiguration,\n  sanitizeReturnUrl,\n} from \"@/shared/lib/util.js\";\n\n// Re-export for use by routeHandler\nexport { sanitizeReturnUrl };\nimport { CookieStorage } from \"@/server/index.js\";\nimport { extractCookieFromRawHeader } from \"@/shared/lib/cookieUtils.js\";\n\nconst logger = loggers.nextjs.middleware;\n\nexport const resolveCallbackUrl = (\n  config: AuthConfigWithDefaults,\n  baseUrl?: string,\n): string => {\n  const callbackUrl = new URL(config?.callbackUrl, baseUrl).toString();\n  return callbackUrl.toString();\n};\n\nexport function sanitizeBasePath(path: string): string {\n  if (!path || path === \"/\") return \"\";\n\n  // Ensure it starts with a slash\n  const withLeadingSlash = path.startsWith(\"/\") ? path : `/${path}`;\n\n  // Remove all trailing slashes (not just one)\n  return withLeadingSlash.replace(/\\/+$/, \"\");\n}\n\n/**\n * Removes the basePath prefix from a pathname, properly handling edge cases\n * This is the inverse operation of adding basePath to a URL\n */\nexport function removeBasePathFromPath(\n  pathname: string,\n  basePath?: string,\n): string {\n  if (!basePath || basePath === \"\" || basePath === \"/\") {\n    return pathname;\n  }\n\n  // Sanitize the basePath to ensure consistent format\n  const sanitizedBasePath = sanitizeBasePath(basePath);\n\n  // Check if pathname starts with the basePath followed by a slash or end of string\n  // This prevents partial matches like \"/app\" matching \"/application\"\n  if (pathname === sanitizedBasePath) {\n    // Exact match - return root\n    return \"/\";\n  } else if (pathname.startsWith(sanitizedBasePath + \"/\")) {\n    // basePath followed by slash - remove basePath but keep the slash\n    return pathname.slice(sanitizedBasePath.length);\n  }\n\n  // If basePath doesn't match as a complete path segment, return pathname as-is\n  return pathname;\n}\n\nexport const getOriginUrl = (\n  request: NextRequest,\n  authConfig: AuthConfigWithDefaults,\n): string => {\n  // Use configured baseUrl if provided (for reverse proxy scenarios)\n  if (authConfig.baseUrl) {\n    return authConfig.baseUrl;\n  }\n\n  // Fallback to nextUrl.origin (includes port automatically)\n  return request.nextUrl.origin;\n};\n\n// Matches globs:\n// Examples:\n// /user\n// /user/*\n// /user/**/info\nconst matchGlob = (pathname: string, globPattern: string) => {\n  const matches = picomatch(globPattern);\n  return matches(pathname);\n};\n\nconst matchesGlobs = (pathname: string, patterns: string[]) =>\n  patterns.some((pattern) => {\n    if (!pattern) return false;\n    return matchGlob(pathname, pattern);\n  });\n\n/**\n * Determines if we should attempt token refresh based on session state\n */\nexport const shouldAttemptRefresh = (session: SessionData): boolean => {\n  return !session.authenticated && !!session.refreshToken;\n};\n\nconst stripBasePathPrefix = (path: string, basePath: string = \"\") => {\n  return path.replace(new RegExp(`^${basePath}`), \"\");\n};\n/**\n * Checks if the current path is a system URL that should skip auth\n */\nexport const shouldSkipAuthForSystemUrls = (\n  pathname: string,\n  authConfig: AuthConfigWithDefaults,\n): boolean => {\n  // make an array of all system URLs from authConfig using the systemUrlsConfig keys\n  const systemUrls = Object.keys(systemUrlsConfig).map(\n    (key) => authConfig[key as keyof AuthConfigWithDefaults] as string,\n  );\n\n  // check if any of the urls in systemUrls has a substring match with pathname\n  // the systemUrl or incoming path could have a basePath, i.e. /dashboard/api/auth/callback\n  // therefore we check if the systemUrl equals the pathname after stripping the basePath prefix\n  const strippedPathname = stripBasePathPrefix(pathname, authConfig.basePath);\n  const strippedSystemUrls = systemUrls.map((url) =>\n    stripBasePathPrefix(url, authConfig.basePath),\n  );\n  const isSystemUrl = strippedSystemUrls.some(\n    (url) => url && pathname && pathname !== \"/\" && url === strippedPathname,\n  );\n  logger.debug(\"→ isSystemUrl check\", { pathname, isSystemUrl, systemUrls });\n  if (isSystemUrl) {\n    logger.debug(\n      \"→ Skipping auth check - this a URL defined in authConfig\",\n      pathname,\n    );\n  }\n\n  return isSystemUrl;\n};\n\n/**\n * CookieStorage implementation for NextJS middleware context that works with NextRequest\n */\nexport class NextjsMiddlewareCookieStorage extends CookieStorage {\n  constructor(\n    public config: Partial<Record<KeySetter, CookieConfig>> = {},\n    private request: NextRequest,\n    private response: NextResponse,\n  ) {\n    super({\n      secure: true,\n      httpOnly: true,\n    });\n  }\n\n  async get(key: string): Promise<string | null> {\n    // First try to get cookies from the response if it has already been set\n    const cookieValue = this.response.cookies.get(key)?.value;\n    if (cookieValue) {\n      return cookieValue;\n    }\n\n    const cookieSettings = this.config?.[key as KeySetter] || {};\n    const configuredPath = cookieSettings.path;\n\n    // If we have a non-root basePath, use raw header parsing to get the first cookie\n    // which should be from the most specific path, avoiding duplicate cookie conflicts\n    if (configuredPath && configuredPath !== \"/\") {\n      const cookieHeader = this.request.headers.get(\"cookie\");\n      const rawValue = extractCookieFromRawHeader(cookieHeader, key);\n      if (rawValue) {\n        return rawValue;\n      }\n    }\n\n    // Fallback to standard Next.js request cookies\n    return this.request.cookies.get(key)?.value || null;\n  }\n\n  async set(\n    key: string,\n    value: string,\n    cookieConfigOverride: CookieConfig,\n  ): Promise<void> {\n    const cookieSettings = this.config?.[key as KeySetter] || {\n      ...this.settings,\n    };\n    const dynamicConfig = getCookieConfiguration(this.request);\n\n    const useCookieSettings = {\n      ...cookieSettings,\n      ...cookieConfigOverride,\n      // Apply dynamic configuration for secure and sameSite\n      secure: dynamicConfig.secure,\n      sameSite: dynamicConfig.sameSite,\n    };\n\n    // Respect the httpOnly setting from configuration instead of hardcoding it\n    this.response.cookies.set(key, value, useCookieSettings);\n  }\n\n  async delete(key: string): Promise<void> {\n    // Get cookie configuration for this key to respect the path setting\n    const cookieSettings = this.config?.[key as KeySetter] || {};\n\n    // If we have a path configured, use it when deleting the cookie\n    if (cookieSettings.path) {\n      this.response.cookies.set(key, \"\", {\n        maxAge: 0, // Immediately expire the cookie\n        path: cookieSettings.path,\n      });\n    } else {\n      this.response.cookies.delete(key);\n    }\n  }\n}\n\n/**\n * Handles authentication logic specifically for the login URL\n * Provides logging for login URL access patterns\n */\nexport const handleLoginUrl = (\n  pathname: string,\n  session: SessionData,\n  authConfig: AuthConfigWithDefaults,\n): void => {\n  if (pathname !== authConfig.loginUrl) {\n    return;\n  }\n\n  // We are on the login URL - log the access pattern\n  if (session.authenticated) {\n    logger.debug(`→ Authenticated user accessing login page`);\n  } else {\n    logger.debug(`→ Unauthenticated user accessing login page`);\n  }\n};\n\n/**\n * Checks if the current path should skip auth based on include/exclude patterns\n */\nexport const shouldSkipAuthForRoutePatterns = (\n  pathname: string,\n  authConfig: AuthConfigWithDefaults,\n): boolean => {\n  // Check include patterns\n  if (!matchesGlobs(pathname, authConfig.include)) {\n    logger.debug(\n      \"→ Skipping auth check - path not in include patterns\",\n      pathname,\n    );\n    return true;\n  }\n\n  // Check exclude patterns\n  if (matchesGlobs(pathname, authConfig.exclude)) {\n    logger.debug(\"→ Skipping auth check - path in exclude patterns\", pathname);\n    return true;\n  }\n\n  return false;\n};\n\nexport const copyCivicCookies = (\n  sourceResponse: NextResponse,\n  targetCall: NextResponse | NextRequest,\n) => {\n  const civicCookieNames = [\n    ...Object.values(OAuthTokenTypes),\n    ...Object.values(UserStorage),\n    ...Object.values(CodeVerifier),\n  ];\n  logger.debug(\"Copying Civic cookies:\", {\n    src: sourceResponse.url,\n    target: targetCall.url,\n  });\n  sourceResponse?.cookies\n    .getAll()\n    .filter((cookie) =>\n      civicCookieNames.includes(cookie.name as OAuthTokenTypes),\n    )\n    .forEach((cookie) => {\n      logger.debug(\"Setting middlewareResponse cookie:\", cookie);\n      targetCall.cookies.set(cookie);\n    });\n};\n/**\n * Handles final authentication logic for unauthenticated users on protected routes\n */\nexport const handleUnauthenticatedUser = async (\n  session: SessionData,\n  request: NextRequest,\n  response: NextResponse,\n  storage: NextjsMiddlewareCookieStorage,\n  authConfig: AuthConfigWithDefaults,\n): Promise<NextResponse | undefined> => {\n  // Clear expired/invalid tokens if they exist\n  if (session.accessToken || session.idToken || session.refreshToken) {\n    logger.debug(`→ Clearing expired/invalid tokens`);\n    await clearTokens(storage);\n  }\n\n  // Final fallback: redirect to login unless we're already there.\n  const loginUrl = new URL(\n    authConfig.loginUrl,\n    getOriginUrl(request, authConfig),\n  );\n  const redirectUrl = `${loginUrl.toString()}`;\n  const loginPathWithoutBasePath = removeBasePathFromPath(\n    loginUrl.pathname,\n    authConfig.basePath,\n  );\n\n  // If we're already at the login URL, the middleware will just return undefined.\n  // This is to prevent an infinite redirect loop if middleware is applied to the login route itself.\n  // The loginUrl from getOriginUrl already includes the basePath, but request.nextUrl.pathname does not. So we strip it off to enable comparison.\n  if (request.nextUrl.pathname !== loginPathWithoutBasePath) {\n    logger.debug(\n      `→ No valid tokens found - redirecting to login \"${redirectUrl}\"`,\n    );\n\n    // Preserve the original URL as a deep link for post-authentication redirect\n    // Apply deepLinkHandling logic here to compute the final redirect URL\n    if (authConfig.deepLinkHandling !== \"disabled\") {\n      const originUrl = getOriginUrl(request, authConfig);\n      // Get the full path including query string\n      const fullPath =\n        request.nextUrl.pathname +\n        request.nextUrl.search +\n        request.nextUrl.hash;\n\n      // Sanitize the return URL to prevent open redirect vulnerabilities\n      const sanitizedReturnUrl = sanitizeReturnUrl(fullPath, originUrl);\n\n      if (sanitizedReturnUrl) {\n        let returnTo: string;\n\n        if (authConfig.deepLinkHandling === \"queryParamsOnly\") {\n          // queryParamsOnly: Merge query params from original URL into loginSuccessUrl\n          const loginSuccessUrl = authConfig.loginSuccessUrl || \"/\";\n          try {\n            const returnUrlObj = new URL(sanitizedReturnUrl, originUrl);\n\n            // If no query params, use loginSuccessUrl directly\n            if (returnUrlObj.searchParams.size === 0) {\n              logger.debug(\n                `→ deepLinkHandling=queryParamsOnly: no query params to preserve, using loginSuccessUrl \"${loginSuccessUrl}\"`,\n              );\n              returnTo = loginSuccessUrl;\n            } else {\n              const baseUrlObj = new URL(loginSuccessUrl, originUrl);\n\n              // Append query params from original URL to loginSuccessUrl\n              returnUrlObj.searchParams.forEach((value, key) => {\n                baseUrlObj.searchParams.set(key, value);\n              });\n\n              returnTo =\n                baseUrlObj.pathname + baseUrlObj.search + baseUrlObj.hash;\n              logger.debug(\n                `→ deepLinkHandling=queryParamsOnly: merged params into \"${returnTo}\"`,\n              );\n            }\n          } catch {\n            // If URL parsing fails, fall back to loginSuccessUrl\n            logger.warn(\n              `→ Failed to merge query params, falling back to loginSuccessUrl`,\n            );\n            returnTo = loginSuccessUrl;\n          }\n        } else {\n          // fullUrl: Use the full path directly\n          returnTo = sanitizedReturnUrl;\n          logger.debug(\n            `→ deepLinkHandling=fullUrl: preserving deep link \"${returnTo}\"`,\n          );\n        }\n\n        // Set the cookie with the computed return URL\n        await storage.set(AuthFlowCookie.RETURN_URL, returnTo, {});\n      }\n    }\n\n    const redirectedResponse = redirectWithBasePath(authConfig, redirectUrl);\n    // Copy any cookies that were set to the redirect response\n    response.cookies.getAll().forEach((cookie) => {\n      redirectedResponse.cookies.set(cookie);\n    });\n    return redirectedResponse;\n  }\n\n  return response;\n};\n\n/**\n * Prepends the basePath onto a given URL if it's not already there. Works for both relative and absolute URLs.\n * @param url\n * @param basePath\n * @returns\n */\nexport const prependBasePath = (url: string, basePath: string) => {\n  basePath = \"/\" + basePath.replace(/^\\/|\\/$/g, \"\"); // normalize basePath\n\n  const isAbsolute = /^https?:\\/\\//.test(url);\n\n  if (isAbsolute) {\n    const u = new URL(url);\n    if (!u.pathname.startsWith(basePath)) {\n      u.pathname =\n        basePath + (u.pathname.startsWith(\"/\") ? \"\" : \"/\") + u.pathname;\n    }\n    return u.toString();\n  }\n\n  return url.startsWith(basePath)\n    ? url\n    : basePath + (url.startsWith(\"/\") ? \"\" : \"/\") + url;\n};\n\nexport const redirectWithBasePath = (\n  config: AuthConfig,\n  targetUrl: string,\n): NextResponse =>\n  NextResponse.redirect(prependBasePath(targetUrl, config.basePath || \"\"));\n"]}

package/dist/server/session.d.ts.map

@@ -1 +1 @@
-{"version":3,"file":"session.d.ts","sourceRoot":"","sources":["../../src/server/session.ts"],"names":[],"mappings":"AAAA,OAAO,EACL,KAAK,WAAW,EAChB,KAAK,IAAI,EACT,KAAK,WAAW,EAChB,KAAK,aAAa,EAClB,KAAK,qBAAqB,EAE3B,MAAM,YAAY,CAAC;AACpB,OAAO,KAAK,EAAE,UAAU,EAAE,MAAM,oBAAoB,CAAC;AAoBrD,OAAO,KAAK,EAAE,sBAAsB,EAAE,MAAM,qBAAqB,CAAC;AAUlE,OAAO,KAAK,EAAE,aAAa,EAAE,MAAM,YAAY,CAAC;AAIhD,MAAM,MAAM,mBAAmB,GAAG;IAChC,GAAG,EAAE,MAAM,CAAC;IACZ,OAAO,EAAE,MAAM,CAAC,MAAM,EAAE,MAAM,GAAG,MAAM,EAAE,GAAG,SAAS,CAAC,CAAC;IACvD,YAAY,EAAE;QACZ,GAAG,CAAC,IAAI,EAAE,MAAM,GAAG,MAAM,GAAG,IAAI,CAAC;KAClC,CAAC;IACF,OAAO,EAAE;QACP,GAAG,CAAC,IAAI,EAAE,MAAM,GAAG;YAAE,KAAK,EAAE,MAAM,CAAA;SAAE,GAAG,SAAS,CAAC;KAClD,CAAC;CACH,CAAC;AAEF,MAAM,MAAM,qBAAqB,GAAG;IAClC,OAAO,EAAE;QACP,CAAC,GAAG,EAAE,MAAM,GAAG,MAAM,GAAG,MAAM,EAAE,GAAG,SAAS,CAAC;QAC7C,OAAO,CAAC,EAAE,MAAM,CAAC;QACjB,MAAM,CAAC,EAAE,MAAM,CAAC;QAChB,YAAY,CAAC,EAAE,MAAM,CAAC;QACtB,MAAM,CAAC,EAAE,MAAM,CAAC;QAChB,gBAAgB,CAAC,EAAE,MAAM,CAAC;KAC3B,CAAC;IACF,GAAG,CAAC,EAAE,MAAM,CAAC;CACd,CAAC;AAEF,MAAM,MAAM,oBAAoB,GAAG;IACjC,IAAI,EAAE,MAAM,CAAC;IACb,KAAK,EAAE,MAAM,CAAC;IACd,GAAG,EAAE,qBAAqB,CAAC;CAC5B,CAAC;AAgDF;;;GAGG;AACH,qBAAa,SAAS;IAGlB,QAAQ,CAAC,OAAO,EAAE,aAAa;IAC/B,QAAQ,CAAC,UAAU,EAAE,UAAU;IAHjC,aAAa,EAAE,sBAAsB,GAAG,IAAI,CAAQ;gBAEzC,OAAO,EAAE,aAAa,EACtB,UAAU,EAAE,UAAU;IAGjC,IAAI,WAAW,IAAI,MAAM,CAExB;IAEK,eAAe,IAAI,OAAO,CAAC,sBAAsB,CAAC;IAexD;;;OAGG;IACG,OAAO,CACX,CAAC,SAAS,aAAa,GAAG,WAAW,KAClC,OAAO,CAAC,IAAI,CAAC,CAAC,CAAC,GAAG,IAAI,CAAC;IAkB5B;;;OAGG;IACG,SAAS,IAAI,OAAO,CAAC,WAAW,GAAG,IAAI,CAAC;IAoB9C;;;;;OAKG;IACG,sBAAsB,CAC1B,IAAI,EAAE,MAAM,EACZ,KAAK,EAAE,MAAM,GACZ,OAAO,CAAC,qBAAqB,CAAC;IAIjC;;;OAGG;IACG,UAAU,IAAI,OAAO,CAAC,OAAO,CAAC;IAMpC;;;;OAIG;IACG,aAAa,CAAC,OAAO,CAAC,EAAE;QAC5B,MAAM,CAAC,EAAE,MAAM,EAAE,CAAC;QAClB,KAAK,CAAC,EAAE,MAAM,CAAC;QACf,KAAK,CAAC,EAAE,MAAM,CAAC;KAChB,GAAG,OAAO,CAAC,GAAG,CAAC;IAchB;;;;OAIG;IACG,sBAAsB,CAAC,OAAO,CAAC,EAAE;QACrC,MAAM,CAAC,EAAE,MAAM,EAAE,CAAC;QAClB,KAAK,CAAC,EAAE,MAAM,CAAC;KAChB,GAAG,OAAO,CAAC,GAAG,CAAC;IAuEhB;;;OAGG;IACG,aAAa,IAAI,OAAO,CAAC,qBAAqB,GAAG,IAAI,CAAC;IAI5D;;OAEG;IACG,WAAW,IAAI,OAAO,CAAC,IAAI,CAAC;IAIlC;;;OAGG;IAEH;;OAEG;IACH,MAAM,CAAC,YAAY,CAAC,KAAK,EAAE,MAAM,GAAG,MAAM;IAS1C;;OAEG;IACH,MAAM,CAAC,oBAAoB,CACzB,OAAO,EAAE,mBAAmB,EAC5B,SAAS,EAAE,MAAM,GAChB,MAAM,GAAG,IAAI;IAQhB;;OAEG;IACH,MAAM,CAAC,qBAAqB,CAC1B,OAAO,EAAE,mBAAmB,EAC5B,UAAU,EAAE,MAAM,EAClB,SAAS,EAAE,MAAM,GAChB,MAAM,GAAG,IAAI;IAWhB;;;OAGG;IACH,MAAM,CAAC,SAAS,CAAC,OAAO,EAAE,mBAAmB,GAAG,MAAM,GAAG,IAAI;IAQ7D;;;OAGG;IACH,MAAM,CAAC,kBAAkB,CACvB,OAAO,EAAE,mBAAmB,EAC5B,OAAO,CAAC,EAAE,MAAM,GAAG,IAAI,GACtB,MAAM,GAAG,IAAI;IAahB;;OAEG;IACH,MAAM,CAAC,aAAa,CAClB,OAAO,EAAE,mBAAmB,EAC5B,GAAG,EAAE,MAAM,EACX,MAAM,CAAC,EAAE,MAAM,GAAG,IAAI,GACrB,MAAM;IAUT;;OAEG;IACH,wBAAwB,CAAC,OAAO,EAAE,mBAAmB,GAAG,MAAM;IAyB9D;;;;;;;;;;;;;;;;;;;;;;;;;;;;OA4BG;IACG,cAAc,CAClB,EAAE,IAAI,EAAE,KAAK,EAAE,GAAG,EAAE,EAAE,oBAAoB,EAC1C,OAAO,CAAC,EAAE;QACR,WAAW,CAAC,EAAE,MAAM,CAAC;QACrB,WAAW,CAAC,EAAE,OAAO,CAAC;KACvB,GACA,OAAO,CAAC;QACT,UAAU,CAAC,EAAE,MAAM,CAAC;QACpB,OAAO,CAAC,EAAE,MAAM,GAAG;YAAE,OAAO,EAAE,OAAO,CAAC;YAAC,IAAI,CAAC,EAAE,IAAI,GAAG,IAAI,CAAA;SAAE,CAAC;KAC7D,CAAC;IAoQF;;OAEG;IACH,OAAO,CAAC,4BAA4B;IA4EpC;;OAEG;IACH,OAAO,CAAC,8BAA8B,CAkCpC;CACH"}
+{"version":3,"file":"session.d.ts","sourceRoot":"","sources":["../../src/server/session.ts"],"names":[],"mappings":"AAAA,OAAO,EACL,KAAK,WAAW,EAChB,KAAK,IAAI,EACT,KAAK,WAAW,EAChB,KAAK,aAAa,EAClB,KAAK,qBAAqB,EAE3B,MAAM,YAAY,CAAC;AACpB,OAAO,KAAK,EAAE,UAAU,EAAE,MAAM,oBAAoB,CAAC;AAoBrD,OAAO,KAAK,EAAE,sBAAsB,EAAE,MAAM,qBAAqB,CAAC;AAUlE,OAAO,KAAK,EAAE,aAAa,EAAE,MAAM,YAAY,CAAC;AAIhD,MAAM,MAAM,mBAAmB,GAAG;IAChC,GAAG,EAAE,MAAM,CAAC;IACZ,OAAO,EAAE,MAAM,CAAC,MAAM,EAAE,MAAM,GAAG,MAAM,EAAE,GAAG,SAAS,CAAC,CAAC;IACvD,YAAY,EAAE;QACZ,GAAG,CAAC,IAAI,EAAE,MAAM,GAAG,MAAM,GAAG,IAAI,CAAC;KAClC,CAAC;IACF,OAAO,EAAE;QACP,GAAG,CAAC,IAAI,EAAE,MAAM,GAAG;YAAE,KAAK,EAAE,MAAM,CAAA;SAAE,GAAG,SAAS,CAAC;KAClD,CAAC;CACH,CAAC;AAEF,MAAM,MAAM,qBAAqB,GAAG;IAClC,OAAO,EAAE;QACP,CAAC,GAAG,EAAE,MAAM,GAAG,MAAM,GAAG,MAAM,EAAE,GAAG,SAAS,CAAC;QAC7C,OAAO,CAAC,EAAE,MAAM,CAAC;QACjB,MAAM,CAAC,EAAE,MAAM,CAAC;QAChB,YAAY,CAAC,EAAE,MAAM,CAAC;QACtB,MAAM,CAAC,EAAE,MAAM,CAAC;QAChB,gBAAgB,CAAC,EAAE,MAAM,CAAC;KAC3B,CAAC;IACF,GAAG,CAAC,EAAE,MAAM,CAAC;CACd,CAAC;AAEF,MAAM,MAAM,oBAAoB,GAAG;IACjC,IAAI,EAAE,MAAM,CAAC;IACb,KAAK,EAAE,MAAM,CAAC;IACd,GAAG,EAAE,qBAAqB,CAAC;CAC5B,CAAC;AAgDF;;;GAGG;AACH,qBAAa,SAAS;IAGlB,QAAQ,CAAC,OAAO,EAAE,aAAa;IAC/B,QAAQ,CAAC,UAAU,EAAE,UAAU;IAHjC,aAAa,EAAE,sBAAsB,GAAG,IAAI,CAAQ;gBAEzC,OAAO,EAAE,aAAa,EACtB,UAAU,EAAE,UAAU;IAGjC,IAAI,WAAW,IAAI,MAAM,CAExB;IAEK,eAAe,IAAI,OAAO,CAAC,sBAAsB,CAAC;IAexD;;;OAGG;IACG,OAAO,CACX,CAAC,SAAS,aAAa,GAAG,WAAW,KAClC,OAAO,CAAC,IAAI,CAAC,CAAC,CAAC,GAAG,IAAI,CAAC;IAkB5B;;;OAGG;IACG,SAAS,IAAI,OAAO,CAAC,WAAW,GAAG,IAAI,CAAC;IAoB9C;;;;;OAKG;IACG,sBAAsB,CAC1B,IAAI,EAAE,MAAM,EACZ,KAAK,EAAE,MAAM,GACZ,OAAO,CAAC,qBAAqB,CAAC;IAIjC;;;OAGG;IACG,UAAU,IAAI,OAAO,CAAC,OAAO,CAAC;IAMpC;;;;OAIG;IACG,aAAa,CAAC,OAAO,CAAC,EAAE;QAC5B,MAAM,CAAC,EAAE,MAAM,EAAE,CAAC;QAClB,KAAK,CAAC,EAAE,MAAM,CAAC;QACf,KAAK,CAAC,EAAE,MAAM,CAAC;KAChB,GAAG,OAAO,CAAC,GAAG,CAAC;IAchB;;;;OAIG;IACG,sBAAsB,CAAC,OAAO,CAAC,EAAE;QACrC,MAAM,CAAC,EAAE,MAAM,EAAE,CAAC;QAClB,KAAK,CAAC,EAAE,MAAM,CAAC;KAChB,GAAG,OAAO,CAAC,GAAG,CAAC;IAuEhB;;;OAGG;IACG,aAAa,IAAI,OAAO,CAAC,qBAAqB,GAAG,IAAI,CAAC;IAI5D;;OAEG;IACG,WAAW,IAAI,OAAO,CAAC,IAAI,CAAC;IAIlC;;;OAGG;IAEH;;OAEG;IACH,MAAM,CAAC,YAAY,CAAC,KAAK,EAAE,MAAM,GAAG,MAAM;IAS1C;;OAEG;IACH,MAAM,CAAC,oBAAoB,CACzB,OAAO,EAAE,mBAAmB,EAC5B,SAAS,EAAE,MAAM,GAChB,MAAM,GAAG,IAAI;IAQhB;;OAEG;IACH,MAAM,CAAC,qBAAqB,CAC1B,OAAO,EAAE,mBAAmB,EAC5B,UAAU,EAAE,MAAM,EAClB,SAAS,EAAE,MAAM,GAChB,MAAM,GAAG,IAAI;IAWhB;;;OAGG;IACH,MAAM,CAAC,SAAS,CAAC,OAAO,EAAE,mBAAmB,GAAG,MAAM,GAAG,IAAI;IAQ7D;;;OAGG;IACH,MAAM,CAAC,kBAAkB,CACvB,OAAO,EAAE,mBAAmB,EAC5B,OAAO,CAAC,EAAE,MAAM,GAAG,IAAI,GACtB,MAAM,GAAG,IAAI;IAahB;;OAEG;IACH,MAAM,CAAC,aAAa,CAClB,OAAO,EAAE,mBAAmB,EAC5B,GAAG,EAAE,MAAM,EACX,MAAM,CAAC,EAAE,MAAM,GAAG,IAAI,GACrB,MAAM;IAUT;;OAEG;IACH,wBAAwB,CAAC,OAAO,EAAE,mBAAmB,GAAG,MAAM;IAyB9D;;;;;;;;;;;;;;;;;;;;;;;;;;;;OA4BG;IACG,cAAc,CAClB,EAAE,IAAI,EAAE,KAAK,EAAE,GAAG,EAAE,EAAE,oBAAoB,EAC1C,OAAO,CAAC,EAAE;QACR,WAAW,CAAC,EAAE,MAAM,CAAC;QACrB,WAAW,CAAC,EAAE,OAAO,CAAC;KACvB,GACA,OAAO,CAAC;QACT,UAAU,CAAC,EAAE,MAAM,CAAC;QACpB,OAAO,CAAC,EAAE,MAAM,GAAG;YAAE,OAAO,EAAE,OAAO,CAAC;YAAC,IAAI,CAAC,EAAE,IAAI,GAAG,IAAI,CAAA;SAAE,CAAC;KAC7D,CAAC;IA6PF;;OAEG;IACH,OAAO,CAAC,4BAA4B;IA2EpC;;OAEG;IACH,OAAO,CAAC,8BAA8B,CAkCpC;CACH"}

package/dist/server/session.js

@@ -371,10 +371,9 @@ export class CivicAuth {
                 newSearchParams.delete("sameDomainCallback");
                 newSearchParams.delete("appUrl");
                 newSearchParams.delete("loginSuccessUrl");
-                // Use preserved deep link if available and valid, otherwise fall back to cleaned callback URL
-                const cleanedSearch = newSearchParams.toString();
-                const fallbackUrl = `${currentUrl.pathname}${cleanedSearch ? "?" + cleanedSearch : ""}${currentUrl.hash}`;
-                const redirectUrl = loginSuccessUrl || fallbackUrl;
+                // Use preserved deep link if available and valid, otherwise fall back to loginSuccessUrl or "/"
+                // Note: Do NOT fall back to currentUrl.pathname as that's the callback URL, which would cause a loop
+                const redirectUrl = loginSuccessUrl || this.authConfig.loginSuccessUrl || "/";
                 return {
                     content: {
                         success: true,
@@ -424,6 +423,10 @@ export class CivicAuth {
                             return { redirectTo: frontendUrl };
                         }
                         else {
+                            // Return JSON when no redirect destination is available.
+                            // This is intentional for API-style callbacks and cross-origin scenarios
+                            // where cookies aren't accessible to read config. The JSON response allows
+                            // clients (e.g., vanilla JS SDK) to handle the success case programmatically.
                             return { content: { success: true, user } };
                         }
                     }
@@ -520,19 +523,9 @@ export class CivicAuth {
         if (frontendUrl) {
             return { redirectTo: frontendUrl };
         }
-        // Server-side fallback: if no frontend URL is configured but we have a postLogoutRedirectUrl,
-        // redirect there instead of returning JSON content
-        if (this.authConfig.postLogoutRedirectUrl) {
-            return { redirectTo: this.authConfig.postLogoutRedirectUrl };
-        }
-        // Absolute fallback: return success as JSON content if no other conditions are met.
-        // This could happen if no loginSuccessUrl or postLogoutRedirectUrl is configured.
-        return {
-            content: {
-                success: true,
-                user,
-            },
-        };
+        // Absolute fallback: redirect to loginSuccessUrl or "/"
+        // Never return JSON for browser navigation - that would display raw JSON to the user
+        return { redirectTo: this.authConfig.loginSuccessUrl || "/" };
     }
     /**
      * Generate HTML content for iframe completion that sends postMessage to parent
@@ -541,10 +534,10 @@ export class CivicAuth {
         const escapedUser = JSON.stringify(user).replace(/'/g, "\\'");
         const clientId = this.authConfig.clientId;
         // Determine fallback redirect URL
-        const fallbackUrl = frontendUrl ||
-            this.authConfig.redirectUrl ||
-            this.authConfig.postLogoutRedirectUrl ||
-            "/";
+        // Note: redirectUrl is the OAuth callback URL - it should NEVER be used as a post-login
+        // destination as it would cause an infinite redirect loop in iframe mode.
+        // postLogoutRedirectUrl is semantically incorrect for login success scenarios.
+        const fallbackUrl = frontendUrl || this.authConfig.loginSuccessUrl || "/";
         return `
       <!DOCTYPE html>
       <html>

package/dist/server/session.js.map

@@ -1 +1 @@
-{"version":3,"file":"session.js","sourceRoot":"","sources":["../../src/server/session.ts"],"names":[],"mappings":"AAAA,OAAO,EAML,SAAS,GACV,MAAM,YAAY,CAAC;AAEpB,OAAO,EACL,OAAO,IAAI,iBAAiB,EAC5B,SAAS,IAAI,mBAAmB,GACjC,MAAM,yBAAyB,CAAC;AACjC,OAAO,EAAE,WAAW,IAAI,eAAe,EAAE,MAAM,sBAAsB,CAAC;AACtE,OAAO,EAAE,sBAAsB,EAAE,MAAM,mBAAmB,CAAC;AAC3D,OAAO,EAAE,aAAa,EAAE,MAAM,mBAAmB,CAAC;AAClD,OAAO,EAAE,sBAAsB,EAAE,MAAM,oBAAoB,CAAC;AAC5D,OAAO,EACL,2BAA2B,EAC3B,2BAA2B,GAC5B,MAAM,gBAAgB,CAAC;AACxB,OAAO,EAAE,aAAa,EAAE,MAAM,qBAAqB,CAAC;AACpD,OAAO,EAAE,UAAU,EAAE,MAAM,mBAAmB,CAAC;AAC/C,OAAO,EAAE,4BAA4B,EAAE,MAAM,0CAA0C,CAAC;AACxF,OAAO,EACL,mBAAmB,EACnB,4BAA4B,GAC7B,MAAM,gBAAgB,CAAC;AAExB,OAAO,EAAE,oBAAoB,EAAE,wBAAwB,EAAE,MAAM,gBAAgB,CAAC;AAChF,OAAO,EAAE,SAAS,EAAmB,MAAM,MAAM,CAAC;AAClD,OAAO,EACL,sBAAsB,EACtB,mBAAmB,EACnB,kBAAkB,EAClB,iBAAiB,GAClB,MAAM,sBAAsB,CAAC;AAC9B,OAAO,EAAE,YAAY,EAAE,MAAM,uBAAuB,CAAC;AAErD,OAAO,EAAE,OAAO,EAAE,MAAM,iBAAiB,CAAC;AAgC1C,uCAAuC;AACvC,MAAM,QAAQ,GAAG,CACf,IAAS,EACT,GAAM,EACM,EAAE;IACd,MAAM,MAAM,GAAG,EAAE,GAAG,GAAG,EAAE,CAAC;IAC1B,IAAI,CAAC,OAAO,CAAC,CAAC,GAAG,EAAE,EAAE;QACnB,OAAO,MAAM,CAAC,GAAG,CAAC,CAAC;IACrB,CAAC,CAAC,CAAC;IACH,OAAO,MAAM,CAAC;AAChB,CAAC,CAAC;AAEF;;GAEG;AACH,MAAM,oBAAoB,GAAG,CAAC,GAA0B,EAAW,EAAE;IACnE,IAAI,CAAC,GAAG,CAAC,GAAG;QAAE,OAAO,KAAK,CAAC;IAC3B,OAAO,GAAG,CAAC,GAAG,CAAC,QAAQ,CAAC,yBAAyB,CAAC,CAAC;AACrD,CAAC,CAAC;AAEF;;;;GAIG;AACH,SAAS,iBAAiB,CACxB,MAA6B;IAE7B,IAAI,CAAC,MAAM,CAAC,QAAQ;QAAE,OAAO,IAAI,CAAC;IAElC,MAAM,WAAW,GAAG,SAAS,CAAC,MAAM,CAAC,QAAQ,CAAmB,CAAC;IACjE,IAAI,CAAC,WAAW,CAAC,GAAG;QAAE,OAAO,IAAI,CAAC;IAElC,qCAAqC;IACrC,MAAM,6BAA6B,GAAG;QACpC,GAAI,WAAiB;QACrB,EAAE,EAAE,WAAW,CAAC,GAAG;KACpB,CAAC;IAEF,0EAA0E;IAC1E,OAAO,QAAQ,CACb,CAAC,GAAG,4BAA4B,EAAE,GAAG,SAAS,CAAC,EAC/C,6BAA6B,CACnB,CAAC;AACf,CAAC;AAED;;;GAGG;AACH,MAAM,OAAO,SAAS;IAGT;IACA;IAHX,aAAa,GAAkC,IAAI,CAAC;IACpD,YACW,OAAsB,EACtB,UAAsB;QADtB,YAAO,GAAP,OAAO,CAAe;QACtB,eAAU,GAAV,UAAU,CAAY;IAC9B,CAAC;IAEJ,IAAI,WAAW;QACb,OAAO,IAAI,CAAC,UAAU,CAAC,WAAW,IAAI,mBAAmB,CAAC;IAC5D,CAAC;IAED,KAAK,CAAC,eAAe;QACnB,IAAI,IAAI,CAAC,aAAa,EAAE,CAAC;YACvB,OAAO,CAAC,MAAM,CAAC,KAAK,CAAC,gCAAgC,EAAE,IAAI,CAAC,UAAU,CAAC,CAAC;YACxE,OAAO,OAAO,CAAC,OAAO,CAAC,IAAI,CAAC,aAAa,CAAC,CAAC;QAC7C,CAAC;QACD,OAAO,CAAC,MAAM,CAAC,KAAK,CAAC,4BAA4B,EAAE,IAAI,CAAC,UAAU,CAAC,CAAC;QACpE,IAAI,CAAC,aAAa,GAAG,MAAM,4BAA4B,CAAC,KAAK,CAC3D;YACE,GAAG,IAAI,CAAC,UAAU;YAClB,WAAW,EAAE,IAAI,CAAC,WAAW;SAC9B,EACD,IAAI,CAAC,OAAO,CACb,CAAC;QACF,OAAO,IAAI,CAAC,aAAa,CAAC;IAC5B,CAAC;IACD;;;OAGG;IACH,KAAK,CAAC,OAAO;QAGX,MAAM,QAAQ,GAAG,MAAM,IAAI,CAAC,eAAe,EAAE,CAAC;QAE9C,IAAI,CAAC;YACH,iDAAiD;YACjD,MAAM,OAAO,GAAG,MAAM,QAAQ,CAAC,uBAAuB,EAAE,CAAC;YACzD,IAAI,CAAC,OAAO,EAAE,aAAa,EAAE,CAAC;gBAC5B,OAAO,IAAI,CAAC;YACd,CAAC;YAED,qEAAqE;YACrE,OAAO,iBAAiB,CAAI,IAAI,CAAC,OAAO,CAAC,CAAC;QAC5C,CAAC;QAAC,OAAO,KAAK,EAAE,CAAC;YACf,OAAO,CAAC,KAAK,CAAC,wCAAwC,EAAE,KAAK,CAAC,CAAC;YAC/D,OAAO,IAAI,CAAC;QACd,CAAC;IACH,CAAC;IAED;;;OAGG;IACH,KAAK,CAAC,SAAS;QACb,MAAM,QAAQ,GAAG,MAAM,IAAI,CAAC,eAAe,EAAE,CAAC;QAE9C,IAAI,CAAC;YACH,mDAAmD;YACnD,MAAM,OAAO,GAAG,MAAM,QAAQ,CAAC,uBAAuB,EAAE,CAAC;YAEzD,IAAI,CAAC,OAAO,EAAE,aAAa,EAAE,CAAC;gBAC5B,OAAO,IAAI,CAAC;YACd,CAAC;YAED,uEAAuE;YACvE,MAAM,MAAM,GAAG,MAAM,mBAAmB,CAAC,IAAI,CAAC,OAAO,CAAC,CAAC;YACvD,OAAO,MAAM,CAAC;QAChB,CAAC;QAAC,OAAO,KAAK,EAAE,CAAC;YACf,OAAO,CAAC,KAAK,CAAC,4CAA4C,EAAE,KAAK,CAAC,CAAC;YACnE,OAAO,IAAI,CAAC;QACd,CAAC;IACH,CAAC;IAED;;;;;OAKG;IACH,KAAK,CAAC,sBAAsB,CAC1B,IAAY,EACZ,KAAa;QAEb,OAAO,sBAAsB,CAAC,IAAI,EAAE,KAAK,EAAE,IAAI,CAAC,OAAO,EAAE,IAAI,CAAC,UAAU,CAAC,CAAC;IAC5E,CAAC;IAED;;;OAGG;IACH,KAAK,CAAC,UAAU;QACd,MAAM,QAAQ,GAAG,MAAM,IAAI,CAAC,eAAe,EAAE,CAAC;QAC9C,MAAM,OAAO,GAAG,MAAM,QAAQ,CAAC,uBAAuB,EAAE,CAAC;QACzD,OAAO,OAAO,EAAE,aAAa,IAAI,KAAK,CAAC;IACzC,CAAC;IAED;;;;OAIG;IACH,KAAK,CAAC,aAAa,CAAC,OAInB;QACC,OAAO,aAAa,CAClB;YACE,GAAG,IAAI,CAAC,UAAU;YAClB,MAAM,EAAE,OAAO,EAAE,MAAM;YACvB,KAAK,EAAE,OAAO,EAAE,KAAK;YACrB,KAAK,EAAE,OAAO,EAAE,KAAK;YACrB,SAAS,EAAE,QAAQ;YACnB,UAAU,EAAE,UAAU,EAAE;SACzB,EACD,IAAI,CAAC,OAAO,CACb,CAAC;IACJ,CAAC;IAED;;;;OAIG;IACH,KAAK,CAAC,sBAAsB,CAAC,OAG5B;QACC,gEAAgE;QAChE,IAAI,IAAI,CAAC,UAAU,CAAC,QAAQ,EAAE,CAAC;YAC7B,gEAAgE;YAChE,yEAAyE;YACzE,MAAM,UAAU,GAAG,IAAI,GAAG,CAAC,IAAI,CAAC,UAAU,CAAC,QAAQ,CAAC,CAAC,MAAM,CAAC;YAC5D,MAAM,SAAS,GAAG,mBAAmB,CAAC,IAAI,CAAC,UAAU,CAAC,gBAAgB,CAAC,CAAC;YACxE,MAAM,gBAAgB,GAAG,kBAAkB,CAAC,UAAU,EAAE,SAAS,CAAC,MAAM,CAAC,CAAC;YAE1E,MAAM,SAAS,GAAG,IAAI,GAAG,CAAC,gBAAgB,CAAC,CAAC;YAE5C,6DAA6D;YAC7D,IAAI,IAAI,CAAC,UAAU,CAAC,qBAAqB,EAAE,CAAC;gBAC1C,SAAS,CAAC,YAAY,CAAC,GAAG,CACxB,mBAAmB,EACnB,IAAI,CAAC,UAAU,CAAC,qBAAqB,CACtC,CAAC;YACJ,CAAC;YAED,4BAA4B;YAC5B,IAAI,OAAO,EAAE,KAAK,EAAE,CAAC;gBACnB,SAAS,CAAC,YAAY,CAAC,GAAG,CAAC,OAAO,EAAE,OAAO,CAAC,KAAK,CAAC,CAAC;YACrD,CAAC;YAED,OAAO,SAAS,CAAC;QACnB,CAAC;QAED,qEAAqE;QACrE,IAAI,CAAC;YACH,gFAAgF;YAChF,uEAAuE;YACvE,MAAM,MAAM,GAAG,MAAM,mBAAmB,CAAC,IAAI,CAAC,OAAO,CAAC,CAAC;YAEvD,IAAI,MAAM,EAAE,OAAO,EAAE,CAAC;gBACpB,kDAAkD;gBAClD,IAAI,CAAC,IAAI,CAAC,UAAU,CAAC,QAAQ,EAAE,CAAC;oBAC9B,MAAM,IAAI,KAAK,CAAC,kDAAkD,CAAC,CAAC;gBACtE,CAAC;gBAED,wDAAwD;gBACxD,yDAAyD;gBAEzD,MAAM,SAAS,GAAG,MAAM,sBAAsB,CAAC;oBAC7C,QAAQ,EAAE,IAAI,CAAC,UAAU,CAAC,QAAQ;oBAClC,WAAW,EAAE,IAAI,CAAC,UAAU,CAAC,qBAAqB,IAAI,GAAG;oBACzD,OAAO,EAAE,MAAM,CAAC,OAAO;oBACvB,KAAK,EAAE,OAAO,EAAE,KAAK,IAAI,IAAI,CAAC,MAAM,EAAE,CAAC,QAAQ,CAAC,EAAE,CAAC,CAAC,SAAS,CAAC,CAAC,CAAC;oBAChE,WAAW,EAAE,IAAI,CAAC,WAAW;iBAC9B,CAAC,CAAC;gBAEH,OAAO,SAAS,CAAC;YACnB,CAAC;QACH,CAAC;QAAC,OAAO,KAAK,EAAE,CAAC;YACf,kEAAkE;YAClE,OAAO,CAAC,IAAI,CACV,sFAAsF,EACtF,KAAK,CACN,CAAC;QACJ,CAAC;QAED,4FAA4F;QAC5F,OAAO,sBAAsB,CAC3B;YACE,GAAG,IAAI,CAAC,UAAU;YAClB,MAAM,EAAE,OAAO,EAAE,MAAM;YACvB,KAAK,EAAE,OAAO,EAAE,KAAK;SACtB,EACD,IAAI,CAAC,OAAO,CACb,CAAC;IACJ,CAAC;IAED;;;OAGG;IACH,KAAK,CAAC,aAAa;QACjB,OAAO,aAAa,CAAC,IAAI,CAAC,OAAO,EAAE,IAAI,CAAC,UAAU,CAAC,CAAC;IACtD,CAAC;IAED;;OAEG;IACH,KAAK,CAAC,WAAW;QACf,OAAO,eAAe,CAAC,IAAI,CAAC,OAAO,CAAC,CAAC;IACvC,CAAC;IAED;;;OAGG;IAEH;;OAEG;IACH,MAAM,CAAC,YAAY,CAAC,KAAa;QAC/B,IAAI,CAAC;YACH,OAAO,kBAAkB,CAAC,KAAK,CAAC,CAAC;QACnC,CAAC;QAAC,OAAO,CAAC,EAAE,CAAC;YACX,OAAO,CAAC,KAAK,CAAC,+BAA+B,EAAE,CAAC,CAAC,CAAC;YAClD,OAAO,KAAK,CAAC;QACf,CAAC;IACH,CAAC;IAED;;OAEG;IACH,MAAM,CAAC,oBAAoB,CACzB,OAA4B,EAC5B,SAAiB;QAEjB,MAAM,UAAU,GAAG,OAAO,CAAC,YAAY,CAAC,GAAG,CAAC,SAAS,CAAC,CAAC;QACvD,IAAI,UAAU,EAAE,CAAC;YACf,OAAO,SAAS,CAAC,YAAY,CAAC,UAAU,CAAC,CAAC;QAC5C,CAAC;QACD,OAAO,IAAI,CAAC;IACd,CAAC;IAED;;OAEG;IACH,MAAM,CAAC,qBAAqB,CAC1B,OAA4B,EAC5B,UAAkB,EAClB,SAAiB;QAEjB,4EAA4E;QAC5E,MAAM,WAAW,GAAG,OAAO,CAAC,OAAO,CAAC,GAAG,CAAC,UAAU,CAAC,EAAE,KAAK,CAAC;QAC3D,IAAI,WAAW,EAAE,CAAC;YAChB,OAAO,SAAS,CAAC,YAAY,CAAC,WAAW,CAAC,CAAC;QAC7C,CAAC;QAED,8BAA8B;QAC9B,OAAO,SAAS,CAAC,oBAAoB,CAAC,OAAO,EAAE,SAAS,CAAC,CAAC;IAC5D,CAAC;IAED;;;OAGG;IACH,MAAM,CAAC,SAAS,CAAC,OAA4B;QAC3C,OAAO,SAAS,CAAC,qBAAqB,CACpC,OAAO,EACP,YAAY,CAAC,OAAO,EACpB,QAAQ,CACT,CAAC;IACJ,CAAC;IAED;;;OAGG;IACH,MAAM,CAAC,kBAAkB,CACvB,OAA4B,EAC5B,OAAuB;QAEvB,MAAM,KAAK,GAAG,OAAO,CAAC,YAAY,CAAC,GAAG,CAAC,OAAO,CAAC,CAAC;QAChD,MAAM,eAAe,GACnB,wBAAwB,CAAC,KAAK,CAAC;YAC/B,SAAS,CAAC,oBAAoB,CAAC,OAAO,EAAE,iBAAiB,CAAC,CAAC;QAE7D,IAAI,CAAC,eAAe,EAAE,CAAC;YACrB,OAAO,IAAI,CAAC;QACd,CAAC;QAED,OAAO,OAAO,CAAC,CAAC,CAAC,IAAI,GAAG,CAAC,eAAe,EAAE,OAAO,CAAC,CAAC,IAAI,CAAC,CAAC,CAAC,eAAe,CAAC;IAC5E,CAAC;IAED;;OAEG;IACH,MAAM,CAAC,aAAa,CAClB,OAA4B,EAC5B,GAAW,EACX,MAAsB;QAEtB,IAAI,GAAG,CAAC,UAAU,CAAC,MAAM,CAAC,EAAE,CAAC;YAC3B,OAAO,GAAG,CAAC;QACb,CAAC;QAED,0FAA0F;QAC1F,MAAM,OAAO,GAAG,MAAM,IAAI,IAAI,GAAG,CAAC,OAAO,CAAC,GAAG,CAAC,CAAC,MAAM,CAAC;QACtD,OAAO,IAAI,GAAG,CAAC,GAAG,EAAE,OAAO,CAAC,CAAC,IAAI,CAAC;IACpC,CAAC;IAED;;OAEG;IACH,wBAAwB,CAAC,OAA4B;QACnD,iEAAiE;QACjE,MAAM,SAAS,GAAG,OAAO,CAAC,YAAY,CAAC,GAAG,CAAC,WAAW,CAAC,CAAC;QACxD,IAAI,SAAS,EAAE,CAAC;YACd,OAAO,SAAS,CAAC;QACnB,CAAC;QAED,MAAM,cAAc,GAAG,IAAI,CAAC,UAAU,CAAC,eAAe,IAAI,GAAG,CAAC;QAE9D,+CAA+C;QAC/C,MAAM,kBAAkB,GAAG,yBAAyB,CAAC,IAAI,CAAC,cAAc,CAAC,CAAC;QAC1E,IAAI,kBAAkB,EAAE,CAAC;YACvB,OAAO,cAAc,CAAC;QACxB,CAAC;QAED,gDAAgD;QAChD,MAAM,MAAM,GAAG,SAAS,CAAC,SAAS,CAAC,OAAO,CAAC,CAAC;QAC5C,IAAI,MAAM,EAAE,CAAC;YACX,OAAO,IAAI,GAAG,CAAC,cAAc,EAAE,MAAM,CAAC,CAAC,IAAI,CAAC;QAC9C,CAAC;QAED,6BAA6B;QAC7B,OAAO,IAAI,GAAG,CAAC,OAAO,CAAC,GAAG,CAAC,CAAC,MAAM,CAAC;IACrC,CAAC;IAED;;;;;;;;;;;;;;;;;;;;;;;;;;;;OA4BG;IACH,KAAK,CAAC,cAAc,CAClB,EAAE,IAAI,EAAE,KAAK,EAAE,GAAG,EAAwB,EAC1C,OAGC;QAKD,oDAAoD;QACpD,IAAI,oBAAoB,CAAC,GAAG,CAAC,EAAE,CAAC;YAC9B,IAAI,CAAC;gBACH,0EAA0E;gBAC1E,MAAM,iBAAiB,GAAG,MAAM,IAAI,CAAC,UAAU,EAAE,CAAC;gBAClD,IAAI,IAAI,GAAgB,IAAI,CAAC;gBAE7B,IAAI,iBAAiB,EAAE,CAAC;oBACtB,wDAAwD;oBACxD,IAAI,GAAG,MAAM,IAAI,CAAC,OAAO,EAAE,CAAC;oBAC5B,OAAO,CAAC,GAAG,CACT,qDAAqD,EACrD,CAAC,CAAC,IAAI,CACP,CAAC;gBACJ,CAAC;qBAAM,CAAC;oBACN,8DAA8D;oBAC9D,MAAM,MAAM,GAAG,MAAM,IAAI,CAAC,sBAAsB,CAAC,IAAI,EAAE,KAAK,CAAC,CAAC;oBAC9D,IAAI,GAAG,iBAAiB,CAAC,MAAM,CAAC,CAAC;oBACjC,OAAO,CAAC,GAAG,CACT,mDAAmD,EACnD,CAAC,CAAC,IAAI,CACP,CAAC;gBACJ,CAAC;gBAED,gDAAgD;gBAChD,MAAM,UAAU,GAAG,IAAI,GAAG,CAAC,GAAG,CAAC,GAAG,IAAI,EAAE,CAAC,CAAC;gBAE1C,oFAAoF;gBACpF,oFAAoF;gBACpF,MAAM,kBAAkB,GACtB,UAAU,CAAC,YAAY,CAAC,GAAG,CAAC,iBAAiB,CAAC,CAAC;gBACjD,MAAM,eAAe,GAAG,kBAAkB;oBACxC,CAAC,CAAC,iBAAiB,CAAC,kBAAkB,EAAE,UAAU,CAAC,MAAM,CAAC;oBAC1D,CAAC,CAAC,IAAI,CAAC;gBAET,MAAM,eAAe,GAAG,IAAI,eAAe,CAAC,UAAU,CAAC,MAAM,CAAC,CAAC;gBAC/D,eAAe,CAAC,MAAM,CAAC,oBAAoB,CAAC,CAAC;gBAC7C,eAAe,CAAC,MAAM,CAAC,QAAQ,CAAC,CAAC;gBACjC,eAAe,CAAC,MAAM,CAAC,iBAAiB,CAAC,CAAC;gBAE1C,8FAA8F;gBAC9F,MAAM,aAAa,GAAG,eAAe,CAAC,QAAQ,EAAE,CAAC;gBACjD,MAAM,WAAW,GAAG,GAAG,UAAU,CAAC,QAAQ,GAAG,aAAa,CAAC,CAAC,CAAC,GAAG,GAAG,aAAa,CAAC,CAAC,CAAC,EAAE,GAAG,UAAU,CAAC,IAAI,EAAE,CAAC;gBAC1G,MAAM,WAAW,GAAG,eAAe,IAAI,WAAW,CAAC;gBACnD,OAAO;oBACL,OAAO,EAAE;wBACP,OAAO,EAAE,IAAI;wBACb,WAAW;qBACiC;iBAC/C,CAAC;YACJ,CAAC;YAAC,OAAO,KAAK,EAAE,CAAC;gBACf,OAAO,CAAC,KAAK,CAAC,8BAA8B,EAAE,KAAK,CAAC,CAAC;gBACrD,MAAM,KAAK,CAAC;YACd,CAAC;QACH,CAAC;QAED,mDAAmD;QACnD,IAAI,MAA6B,CAAC;QAClC,IAAI,IAAiB,CAAC;QAEtB,IAAI,CAAC;YACH,MAAM,GAAG,MAAM,IAAI,CAAC,sBAAsB,CAAC,IAAI,EAAE,KAAK,CAAC,CAAC;YACxD,IAAI,GAAG,iBAAiB,CAAC,MAAM,CAAC,CAAC;QACnC,CAAC;QAAC,OAAO,KAAK,EAAE,CAAC;YACf,kEAAkE;YAClE,MAAM,mBAAmB,GACvB,KAAK,YAAY,KAAK;gBACtB,KAAK,CAAC,OAAO,CAAC,QAAQ,CAAC,oCAAoC,CAAC,CAAC;YAE/D,IAAI,mBAAmB,EAAE,CAAC;gBACxB,+EAA+E;gBAC/E,IAAI,CAAC;oBACH,MAAM,iBAAiB,GAAG,MAAM,IAAI,CAAC,UAAU,EAAE,CAAC;oBAElD,IAAI,iBAAiB,EAAE,CAAC;wBACtB,4DAA4D;wBAC5D,MAAM,IAAI,GAAG,MAAM,IAAI,CAAC,OAAO,EAAE,CAAC;wBAClC,MAAM,6BAA6B,GACjC,wBAAwB,CAAC,KAAK,CAAC,CAAC;wBAClC,MAAM,WAAW,GACf,OAAO,EAAE,WAAW;4BACpB,6BAA6B;4BAC7B,IAAI,CAAC,UAAU,CAAC,eAAe,CAAC;wBAElC,8EAA8E;wBAC9E,MAAM,gBAAgB,GAAG,oBAAoB,CAAC,KAAK,EAAE,SAAS,CAAC,CAAC;wBAChE,MAAM,qBAAqB,GAAG,gBAAgB,KAAK,QAAQ,CAAC;wBAE5D,IACE,qBAAqB;4BACrB,CAAC,IAAI,CAAC,UAAU,CAAC,sBAAsB;4BACvC,IAAI;4BACJ,WAAW,EACX,CAAC;4BACD,qEAAqE;4BACrE,MAAM,cAAc,GAAG,IAAI,CAAC,4BAA4B,CACtD,IAAI,EACJ,WAAW,CACZ,CAAC;4BACF,OAAO,EAAE,OAAO,EAAE,cAAc,EAAE,CAAC;wBACrC,CAAC;wBAED,IAAI,WAAW,EAAE,CAAC;4BAChB,OAAO,EAAE,UAAU,EAAE,WAAW,EAAE,CAAC;wBACrC,CAAC;6BAAM,CAAC;4BACN,OAAO,EAAE,OAAO,EAAE,EAAE,OAAO,EAAE,IAAI,EAAE,IAAI,EAAE,EAAE,CAAC;wBAC9C,CAAC;oBACH,CAAC;gBACH,CAAC;gBAAC,OAAO,cAAc,EAAE,CAAC;oBACxB,OAAO,CAAC,IAAI,CACV,wCAAwC,EACxC,cAAc,CACf,CAAC;oBACF,sDAAsD;gBACxD,CAAC;gBAED,MAAM,gBAAgB,GAAG,oBAAoB,CAAC,KAAK,EAAE,SAAS,CAAC,CAAC;gBAChE,MAAM,qBAAqB,GAAG,gBAAgB,KAAK,QAAQ,CAAC;gBAE5D,IAAI,qBAAqB,IAAI,CAAC,IAAI,CAAC,UAAU,CAAC,sBAAsB,EAAE,CAAC;oBACrE,uDAAuD;oBACvD,MAAM,6BAA6B,GAAG,wBAAwB,CAAC,KAAK,CAAC,CAAC;oBACtE,MAAM,WAAW,GACf,OAAO,EAAE,WAAW;wBACpB,6BAA6B;wBAC7B,IAAI,CAAC,UAAU,CAAC,eAAe,CAAC;oBAElC,MAAM,WAAW,GAAG,GAAG,CAAC,GAAG,IAAI,EAAE,CAAC;oBAClC,MAAM,cAAc,GAAG,IAAI,CAAC,8BAA8B,CACxD,WAAW,EACX,WAAW,CACZ,CAAC;oBACF,OAAO,EAAE,OAAO,EAAE,cAAc,EAAE,CAAC;gBACrC,CAAC;gBAED,gFAAgF;gBAChF,OAAO;oBACL,OAAO,EAAE,oDAAoD,2BAA2B,uBAAuB;iBAChH,CAAC;YACJ,CAAC;YAED,wBAAwB;YACxB,MAAM,KAAK,CAAC;QACd,CAAC;QAED,gDAAgD;QAChD,MAAM,6BAA6B,GAAG,wBAAwB,CAAC,KAAK,CAAC,CAAC;QAEtE,sFAAsF;QACtF,MAAM,WAAW,GACf,OAAO,EAAE,WAAW;YACpB,6BAA6B;YAC7B,IAAI,CAAC,UAAU,CAAC,eAAe,CAAC;QAElC,yDAAyD;QACzD,MAAM,gBAAgB,GAAG,oBAAoB,CAAC,KAAK,EAAE,SAAS,CAAC,CAAC;QAChE,MAAM,qBAAqB,GAAG,gBAAgB,KAAK,QAAQ,CAAC;QAE5D,2DAA2D;QAC3D,kEAAkE;QAClE,MAAM,mBAAmB,GACvB,qBAAqB,IAAI,CAAC,IAAI,CAAC,UAAU,CAAC,sBAAsB,CAAC;QAEnE,MAAM,kBAAkB,GAAG,GAAG,CAAC,OAAO,CAAC,gBAAgB,CAAC,KAAK,UAAU,CAAC;QACxE,MAAM,eAAe,GAAG,GAAG,CAAC,OAAO,CAAC,gBAAgB,CAAC,KAAK,QAAQ,CAAC;QACnE,MAAM,YAAY,GAChB,OAAO,EAAE,WAAW,IAAI,GAAG,CAAC,OAAO,CAAC,MAAM,EAAE,QAAQ,CAAC,kBAAkB,CAAC,CAAC;QAE3E,qGAAqG;QACrG,wCAAwC;QACxC,MAAM,SAAS,GAAG,GAAG,CAAC,OAAO,CAAC,YAAY,CAAC,IAAI,EAAE,CAAC;QAClD,MAAM,QAAQ,GACZ,SAAS,CAAC,QAAQ,CAAC,QAAQ,CAAC,IAAI,CAAC,SAAS,CAAC,QAAQ,CAAC,QAAQ,CAAC,CAAC;QAChE,MAAM,yBAAyB,GAC7B,QAAQ;YACR,CAAC,SAAS,CAAC,QAAQ,CAAC,QAAQ,CAAC,IAAI,CAAC,SAAS,CAAC,QAAQ,CAAC,QAAQ,CAAC,CAAC,CAAC;QAElE,wEAAwE;QACxE,yFAAyF;QACzF,IACE,mBAAmB;YACnB,IAAI;YACJ,WAAW;YACX,CAAC,yBAAyB,EAC1B,CAAC;YACD,MAAM,cAAc,GAAG,IAAI,CAAC,4BAA4B,CACtD,IAAI,EACJ,WAAW,CACZ,CAAC;YACF,OAAO,EAAE,OAAO,EAAE,cAAc,EAAE,CAAC;QACrC,CAAC;QAED,sEAAsE;QACtE,IACE,mBAAmB;YACnB,IAAI;YACJ,WAAW;YACX,yBAAyB,EACzB,CAAC;YACD,OAAO,EAAE,UAAU,EAAE,WAAW,EAAE,CAAC;QACrC,CAAC;QAED,sEAAsE;QACtE,IAAI,kBAAkB,IAAI,WAAW,EAAE,CAAC;YACtC,OAAO,EAAE,UAAU,EAAE,WAAW,EAAE,CAAC;QACrC,CAAC;QAED,sEAAsE;QACtE,8FAA8F;QAC9F,IAAI,eAAe,IAAI,IAAI,IAAI,WAAW,EAAE,CAAC;YAC3C,IAAI,yBAAyB,EAAE,CAAC;gBAC9B,OAAO,CAAC,GAAG,CACT,sEAAsE,CACvE,CAAC;gBACF,OAAO,EAAE,UAAU,EAAE,WAAW,EAAE,CAAC;YACrC,CAAC;iBAAM,CAAC;gBACN,OAAO,CAAC,GAAG,CACT,mFAAmF,CACpF,CAAC;gBACF,MAAM,cAAc,GAAG,IAAI,CAAC,4BAA4B,CACtD,IAAI,EACJ,WAAW,CACZ,CAAC;gBACF,OAAO,EAAE,OAAO,EAAE,cAAc,EAAE,CAAC;YACrC,CAAC;QACH,CAAC;QAED,2DAA2D;QAC3D,IAAI,YAAY,EAAE,CAAC;YACjB,OAAO;gBACL,OAAO,EAAE;oBACP,OAAO,EAAE,IAAI;oBACb,IAAI;iBACL;aACF,CAAC;QACJ,CAAC;QAED,kFAAkF;QAClF,2BAA2B;QAC3B,IAAI,WAAW,EAAE,CAAC;YAChB,OAAO,EAAE,UAAU,EAAE,WAAW,EAAE,CAAC;QACrC,CAAC;QAED,8FAA8F;QAC9F,mDAAmD;QACnD,IAAI,IAAI,CAAC,UAAU,CAAC,qBAAqB,EAAE,CAAC;YAC1C,OAAO,EAAE,UAAU,EAAE,IAAI,CAAC,UAAU,CAAC,qBAAqB,EAAE,CAAC;QAC/D,CAAC;QAED,oFAAoF;QACpF,kFAAkF;QAClF,OAAO;YACL,OAAO,EAAE;gBACP,OAAO,EAAE,IAAI;gBACb,IAAI;aACL;SACF,CAAC;IACJ,CAAC;IAED;;OAEG;IACK,4BAA4B,CAClC,IAAU,EACV,WAAoB;QAEpB,MAAM,WAAW,GAAG,IAAI,CAAC,SAAS,CAAC,IAAI,CAAC,CAAC,OAAO,CAAC,IAAI,EAAE,KAAK,CAAC,CAAC;QAC9D,MAAM,QAAQ,GAAG,IAAI,CAAC,UAAU,CAAC,QAAQ,CAAC;QAE1C,kCAAkC;QAClC,MAAM,WAAW,GACf,WAAW;YACX,IAAI,CAAC,UAAU,CAAC,WAAW;YAC3B,IAAI,CAAC,UAAU,CAAC,qBAAqB;YACrC,GAAG,CAAC;QAEN,OAAO;;;;;;;;;qFAS0E,WAAW;YACpF,2BAA2B;;;;;;;;;;;0BAWb,WAAW;iCACJ,IAAI,CAAC,SAAS,CAAC,WAAW,CAAC;;;;;;;;;;;;4BAYhC,IAAI,CAAC,SAAS,CAAC,QAAQ,CAAC;;0BAE1B,WAAW;iCACJ,IAAI,CAAC,SAAS,CAAC,WAAW,CAAC;;;;;;;;;;;;;;;mCAezB,IAAI,CAAC,SAAS,CAAC,WAAW,CAAC;;;;;;;KAOzD,CAAC;IACJ,CAAC;IAED;;OAEG;IACK,8BAA8B,GAAG,CACvC,WAAmB,EACnB,WAAoB,EACZ,EAAE;QACV,MAAM,mBAAmB,GAAG,WAAW;YACrC,CAAC,CAAC,oBAAoB,kBAAkB,CAAC,WAAW,CAAC,EAAE;YACvD,CAAC,CAAC,EAAE,CAAC;QAEP,OAAO;;;;;;;;;;;2BAWgB,WAAW,qEAAqE,mBAAmB;;;;;;;;;;;;;;CAc7H,CAAC;IACA,CAAC,CAAC;CACH","sourcesContent":["import {\n  type OAuthTokens,\n  type User,\n  type EmptyObject,\n  type UnknownObject,\n  type OIDCTokenResponseBody,\n  tokenKeys,\n} from \"@/types.js\";\nimport type { AuthConfig } from \"@/server/config.js\";\nimport {\n  getUser as getUserFromShared,\n  getTokens as getTokensFromShared,\n} from \"@/shared/lib/session.js\";\nimport { clearTokens as clearTokensUtil } from \"@/shared/lib/util.js\";\nimport { resolveOAuthAccessCode } from \"@/server/login.js\";\nimport { buildLoginUrl } from \"@/server/login.js\";\nimport { buildLogoutRedirectUrl } from \"@/server/logout.js\";\nimport {\n  TOKEN_EXCHANGE_SUCCESS_TEXT,\n  TOKEN_EXCHANGE_TRIGGER_TEXT,\n} from \"@/constants.js\";\nimport { refreshTokens } from \"@/server/refresh.js\";\nimport { getVersion } from \"@/shared/index.js\";\nimport { ServerAuthenticationResolver } from \"@/server/ServerAuthenticationResolver.js\";\nimport {\n  DEFAULT_AUTH_SERVER,\n  JWT_PAYLOAD_KNOWN_CLAIM_KEYS,\n} from \"@/constants.js\";\nimport type { AuthenticationResolver } from \"@/services/types.js\";\nimport { displayModeFromState, loginSuccessUrlFromState } from \"@/lib/oauth.js\";\nimport { decodeJwt, type JWTPayload } from \"jose\";\nimport {\n  generateOauthLogoutUrl,\n  getBackendEndpoints,\n  resolveEndpointUrl,\n  sanitizeReturnUrl,\n} from \"@/shared/lib/util.js\";\nimport { CodeVerifier } from \"@/shared/lib/types.js\";\nimport type { CookieStorage } from \"./index.js\";\nimport { loggers } from \"@/lib/logger.js\";\n\n// Generic request interface for framework-agnostic URL detection\nexport type UrlDetectionRequest = {\n  url: string;\n  headers: Record<string, string | string[] | undefined>;\n  searchParams: {\n    get(name: string): string | null;\n  };\n  cookies: {\n    get(name: string): { value: string } | undefined;\n  };\n};\n\nexport type HandleCallbackRequest = {\n  headers: {\n    [key: string]: string | string[] | undefined;\n    referer?: string;\n    origin?: string;\n    \"user-agent\"?: string;\n    accept?: string;\n    \"sec-fetch-dest\"?: string;\n  };\n  url?: string;\n};\n\nexport type HandleCallbackParams = {\n  code: string;\n  state: string;\n  req: HandleCallbackRequest;\n};\n\n// Function to omit keys from an object\nconst omitKeys = <K extends keyof T, T extends Record<string, unknown>>(\n  keys: K[],\n  obj: T,\n): Omit<T, K> => {\n  const result = { ...obj };\n  keys.forEach((key) => {\n    delete result[key];\n  });\n  return result;\n};\n\n/**\n * Helper to detect if this is a same-domain callback request (for iframe workaround)\n */\nconst isSameDomainCallback = (req: HandleCallbackRequest): boolean => {\n  if (!req.url) return false;\n  return req.url.includes(\"sameDomainCallback=true\");\n};\n\n/**\n * Extract user information directly from OIDC tokens\n * @param tokens The OIDC tokens response\n * @returns The user object or null if no valid ID token\n */\nfunction getUserFromTokens<T extends UnknownObject = EmptyObject>(\n  tokens: OIDCTokenResponseBody,\n): User<T> | null {\n  if (!tokens.id_token) return null;\n\n  const parsedToken = decodeJwt(tokens.id_token) as JWTPayload & T;\n  if (!parsedToken.sub) return null;\n\n  // set the user ID from the token sub\n  const userWithAdditionalTokenFields = {\n    ...(parsedToken as T),\n    id: parsedToken.sub,\n  };\n\n  // Remove the token keys from the user object to stop it getting too large\n  return omitKeys(\n    [...JWT_PAYLOAD_KNOWN_CLAIM_KEYS, ...tokenKeys],\n    userWithAdditionalTokenFields,\n  ) as User<T>;\n}\n\n/**\n * CivicAuth is the main entry point for server-side authentication operations.\n * It provides a unified interface to all the authentication functions.\n */\nexport class CivicAuth {\n  _authResolver: AuthenticationResolver | null = null;\n  constructor(\n    readonly storage: CookieStorage,\n    readonly authConfig: AuthConfig,\n  ) {}\n\n  get oauthServer(): string {\n    return this.authConfig.oauthServer || DEFAULT_AUTH_SERVER;\n  }\n\n  async getAuthResolver(): Promise<AuthenticationResolver> {\n    if (this._authResolver) {\n      loggers.server.debug(\"Reusing existing auth resolver\", this.authConfig);\n      return Promise.resolve(this._authResolver);\n    }\n    loggers.server.debug(\"Creating new auth resolver\", this.authConfig);\n    this._authResolver = await ServerAuthenticationResolver.build(\n      {\n        ...this.authConfig,\n        oauthServer: this.oauthServer,\n      },\n      this.storage,\n    );\n    return this._authResolver;\n  }\n  /**\n   * Gets the authenticated user with token validation\n   * @returns The user object if authenticated, null otherwise\n   */\n  async getUser<\n    T extends UnknownObject = EmptyObject,\n  >(): Promise<User<T> | null> {\n    const resolver = await this.getAuthResolver();\n\n    try {\n      // Validate the session before returning the user\n      const session = await resolver.validateExistingSession();\n      if (!session?.authenticated) {\n        return null;\n      }\n\n      // If session is valid, use the shared implementation to get the user\n      return getUserFromShared<T>(this.storage);\n    } catch (error) {\n      console.error(\"Token validation failed during getUser\", error);\n      return null;\n    }\n  }\n\n  /**\n   * Gets the authentication tokens with token validation\n   * @returns The tokens if authenticated, null otherwise\n   */\n  async getTokens(): Promise<OAuthTokens | null> {\n    const resolver = await this.getAuthResolver();\n\n    try {\n      // Validate the session before returning the tokens\n      const session = await resolver.validateExistingSession();\n\n      if (!session?.authenticated) {\n        return null;\n      }\n\n      // If session is valid, use the shared implementation to get the tokens\n      const tokens = await getTokensFromShared(this.storage);\n      return tokens;\n    } catch (error) {\n      console.error(\"❌ Token validation failed during getTokens\", error);\n      return null;\n    }\n  }\n\n  /**\n   * Resolve an OAuth access code to a set of OIDC tokens\n   * @param code The access code from the query parameter\n   * @param state The OAuth state parameter\n   * @returns OIDC tokens\n   */\n  async resolveOAuthAccessCode(\n    code: string,\n    state: string,\n  ): Promise<OIDCTokenResponseBody> {\n    return resolveOAuthAccessCode(code, state, this.storage, this.authConfig);\n  }\n\n  /**\n   * Check if the user is currently logged in\n   * @returns true if logged in, false otherwise\n   */\n  async isLoggedIn(): Promise<boolean> {\n    const resolver = await this.getAuthResolver();\n    const session = await resolver.validateExistingSession();\n    return session?.authenticated ?? false;\n  }\n\n  /**\n   * Build a login URL to redirect the user to\n   * @param options Additional options for building the login URL\n   * @returns The login URL\n   */\n  async buildLoginUrl(options?: {\n    scopes?: string[];\n    state?: string;\n    nonce?: string;\n  }): Promise<URL> {\n    return buildLoginUrl(\n      {\n        ...this.authConfig,\n        scopes: options?.scopes,\n        state: options?.state,\n        nonce: options?.nonce,\n        framework: \"server\",\n        sdkVersion: getVersion(),\n      },\n      this.storage,\n    );\n  }\n\n  /**\n   * Build a logout URL to redirect the user to\n   * @param options Additional options for building the logout URL\n   * @returns The logout URL\n   */\n  async buildLogoutRedirectUrl(options?: {\n    scopes?: string[];\n    state?: string;\n  }): Promise<URL> {\n    // Check if this is backend integration mode (loginUrl provided)\n    if (this.authConfig.loginUrl) {\n      // Backend integration mode: redirect to backend logout endpoint\n      // This matches the vanilla client's logout logic for backend integration\n      const backendUrl = new URL(this.authConfig.loginUrl).origin;\n      const endpoints = getBackendEndpoints(this.authConfig.backendEndpoints);\n      const backendLogoutUrl = resolveEndpointUrl(backendUrl, endpoints.logout);\n\n      const logoutUrl = new URL(backendLogoutUrl);\n\n      // Include logoutRedirectUrl as query parameter if configured\n      if (this.authConfig.postLogoutRedirectUrl) {\n        logoutUrl.searchParams.set(\n          \"logoutRedirectUrl\",\n          this.authConfig.postLogoutRedirectUrl,\n        );\n      }\n\n      // Include state if provided\n      if (options?.state) {\n        logoutUrl.searchParams.set(\"state\", options.state);\n      }\n\n      return logoutUrl;\n    }\n\n    // Standard OAuth flow - redirect to OAuth provider's logout endpoint\n    try {\n      // Use the shared getTokens function directly - this bypasses session validation\n      // since for logout we just need the raw ID token, not validated tokens\n      const tokens = await getTokensFromShared(this.storage);\n\n      if (tokens?.idToken) {\n        // Ensure clientId is present for OAuth operations\n        if (!this.authConfig.clientId) {\n          throw new Error(\"clientId is required for OAuth logout operations\");\n        }\n\n        // We have access to the ID token from HTTP-only cookies\n        // Build the logout URL manually using the shared utility\n\n        const logoutUrl = await generateOauthLogoutUrl({\n          clientId: this.authConfig.clientId,\n          redirectUrl: this.authConfig.postLogoutRedirectUrl || \"/\",\n          idToken: tokens.idToken,\n          state: options?.state ?? Math.random().toString(36).substring(2),\n          oauthServer: this.oauthServer,\n        });\n\n        return logoutUrl;\n      }\n    } catch (error) {\n      // If direct token access fails, fall back to the generic function\n      console.warn(\n        \"❌ Could not get tokens directly from storage, falling back to generic logout method:\",\n        error,\n      );\n    }\n\n    // Fallback to the generic function for other storage types or when tokens aren't accessible\n    return buildLogoutRedirectUrl(\n      {\n        ...this.authConfig,\n        scopes: options?.scopes,\n        state: options?.state,\n      },\n      this.storage,\n    );\n  }\n\n  /**\n   * Refresh the current set of OIDC tokens\n   * @returns The refreshed tokens or null for backend flows where tokens are managed in HTTP-only cookies\n   */\n  async refreshTokens(): Promise<OIDCTokenResponseBody | null> {\n    return refreshTokens(this.storage, this.authConfig);\n  }\n\n  /**\n   * Clear all authentication tokens from storage\n   */\n  async clearTokens(): Promise<void> {\n    return clearTokensUtil(this.storage);\n  }\n\n  /**\n   * Framework-agnostic URL detection and resolution helpers\n   * These methods handle proxy environments and can be used by any framework\n   */\n\n  /**\n   * Try to URI decode a value, returning the original value on error\n   */\n  static tryUriDecode(value: string): string {\n    try {\n      return decodeURIComponent(value);\n    } catch (e) {\n      console.error(\"Error decoding URI component:\", e);\n      return value;\n    }\n  }\n\n  /**\n   * Get decoded query parameter from request\n   */\n  static getDecodedQueryParam(\n    request: UrlDetectionRequest,\n    paramName: string,\n  ): string | null {\n    const queryParam = request.searchParams.get(paramName);\n    if (queryParam) {\n      return CivicAuth.tryUriDecode(queryParam);\n    }\n    return null;\n  }\n\n  /**\n   * Get value from cookie or query parameter (cookie takes precedence)\n   */\n  static getCookieOrQueryParam(\n    request: UrlDetectionRequest,\n    cookieName: string,\n    queryName: string,\n  ): string | null {\n    // First check the cookie as it might have the full path with base directory\n    const cookieValue = request.cookies.get(cookieName)?.value;\n    if (cookieValue) {\n      return CivicAuth.tryUriDecode(cookieValue);\n    }\n\n    // Fallback to query parameter\n    return CivicAuth.getDecodedQueryParam(request, queryName);\n  }\n\n  /**\n   * Get app URL from request (for proxy environment support)\n   * Checks cookies first, then query parameters\n   */\n  static getAppUrl(request: UrlDetectionRequest): string | null {\n    return CivicAuth.getCookieOrQueryParam(\n      request,\n      CodeVerifier.APP_URL,\n      \"appUrl\",\n    );\n  }\n\n  /**\n   * Get login success URL with proper base URL handling\n   * Extracts from state parameter or query parameters, resolves with baseUrl if provided\n   */\n  static getLoginSuccessUrl(\n    request: UrlDetectionRequest,\n    baseUrl?: string | null,\n  ): string | null {\n    const state = request.searchParams.get(\"state\");\n    const loginSuccessUrl =\n      loginSuccessUrlFromState(state) ||\n      CivicAuth.getDecodedQueryParam(request, \"loginSuccessUrl\");\n\n    if (!loginSuccessUrl) {\n      return null;\n    }\n\n    return baseUrl ? new URL(loginSuccessUrl, baseUrl).href : loginSuccessUrl;\n  }\n\n  /**\n   * Convert relative URL to absolute URL using appUrl for proxy environments\n   */\n  static toAbsoluteUrl(\n    request: UrlDetectionRequest,\n    url: string,\n    appUrl?: string | null,\n  ): string {\n    if (url.startsWith(\"http\")) {\n      return url;\n    }\n\n    // Use appUrl if available (for proxy environments), otherwise fall back to request origin\n    const baseUrl = appUrl || new URL(request.url).origin;\n    return new URL(url, baseUrl).href;\n  }\n\n  /**\n   * Get post-logout redirect URL with proxy environment support\n   */\n  getPostLogoutRedirectUrl(request: UrlDetectionRequest): string {\n    // Check if we have a target URL in the request (from middleware)\n    const targetUrl = request.searchParams.get(\"targetUrl\");\n    if (targetUrl) {\n      return targetUrl;\n    }\n\n    const redirectTarget = this.authConfig.loginSuccessUrl ?? \"/\";\n\n    // If loginSuccessUrl is absolute, use it as-is\n    const isAbsoluteRedirect = /^(https?:\\/\\/|www\\.).+/i.test(redirectTarget);\n    if (isAbsoluteRedirect) {\n      return redirectTarget;\n    }\n\n    // Use appUrl from client for proxy environments\n    const appUrl = CivicAuth.getAppUrl(request);\n    if (appUrl) {\n      return new URL(redirectTarget, appUrl).href;\n    }\n\n    // Fallback to request origin\n    return new URL(request.url).origin;\n  }\n\n  /**\n   * Smart callback handler that automatically detects frontend vs backend requests\n   * and redirects appropriately. Use this instead of resolveOAuthAccessCode + manual redirect.\n   *\n   * @param params An object containing the authorization code, state, and the incoming request.\n   * @param params.code The authorization code from query parameters.\n   * @param params.state The OAuth state parameter.\n   * @param params.req The incoming request object (e.g., from Express).\n   * @param options Configuration options (frontendUrl override, apiResponse flag).\n   * @returns Object with redirect information or HTML content for iframe completion.\n   *\n   * @example\n   * ```javascript\n   * app.get('/auth/callback', async (req, res) => {\n   *   const { code, state } = req.query;\n   *   // The request object 'req' is passed directly\n   *   const result = await req.civicAuth.handleCallback({ code, state, req });\n   *\n   *   if (result.htmlContent) {\n   *     res.setHeader('Content-Type', 'text/html');\n   *     res.send(result.htmlContent);\n   *   } else if (result.redirectTo) {\n   *     res.redirect(result.redirectTo);\n   *   } else {\n   *     res.json({ success: true, user: result.user });\n   *   }\n   * });\n   * ```\n   */\n  async handleCallback(\n    { code, state, req }: HandleCallbackParams,\n    options?: {\n      frontendUrl?: string;\n      apiResponse?: boolean;\n    },\n  ): Promise<{\n    redirectTo?: string;\n    content?: string | { success: boolean; user?: User | null };\n  }> {\n    // Handle same-domain callback for iframe workaround\n    if (isSameDomainCallback(req)) {\n      try {\n        // Check if user is already authenticated before attempting token exchange\n        const isAlreadyLoggedIn = await this.isLoggedIn();\n        let user: User | null = null;\n\n        if (isAlreadyLoggedIn) {\n          // User is already authenticated, get existing user data\n          user = await this.getUser();\n          console.log(\n            \"User already authenticated in same-domain callback:\",\n            !!user,\n          );\n        } else {\n          // For same-domain callbacks, we should have access to cookies\n          const tokens = await this.resolveOAuthAccessCode(code, state);\n          user = getUserFromTokens(tokens);\n          console.log(\n            \"Completed token exchange in same-domain callback:\",\n            !!user,\n          );\n        }\n\n        // Return JSON response for same-domain callback\n        const currentUrl = new URL(req.url || \"\");\n\n        // Extract and sanitize loginSuccessUrl (deep link) BEFORE cleaning up search params\n        // Sanitization prevents open redirect attacks via malicious URLs in the query param\n        const rawLoginSuccessUrl =\n          currentUrl.searchParams.get(\"loginSuccessUrl\");\n        const loginSuccessUrl = rawLoginSuccessUrl\n          ? sanitizeReturnUrl(rawLoginSuccessUrl, currentUrl.origin)\n          : null;\n\n        const newSearchParams = new URLSearchParams(currentUrl.search);\n        newSearchParams.delete(\"sameDomainCallback\");\n        newSearchParams.delete(\"appUrl\");\n        newSearchParams.delete(\"loginSuccessUrl\");\n\n        // Use preserved deep link if available and valid, otherwise fall back to cleaned callback URL\n        const cleanedSearch = newSearchParams.toString();\n        const fallbackUrl = `${currentUrl.pathname}${cleanedSearch ? \"?\" + cleanedSearch : \"\"}${currentUrl.hash}`;\n        const redirectUrl = loginSuccessUrl || fallbackUrl;\n        return {\n          content: {\n            success: true,\n            redirectUrl,\n          } as { success: boolean; redirectUrl: string },\n        };\n      } catch (error) {\n        console.error(\"Same-domain callback failed:\", error);\n        throw error;\n      }\n    }\n\n    // Try to resolve the OAuth code and create session\n    let tokens: OIDCTokenResponseBody;\n    let user: User | null;\n\n    try {\n      tokens = await this.resolveOAuthAccessCode(code, state);\n      user = getUserFromTokens(tokens);\n    } catch (error) {\n      // Check if this is a code verifier error and we're in iframe mode\n      const isCodeVerifierError =\n        error instanceof Error &&\n        error.message.includes(\"Code verifier not found in storage\");\n\n      if (isCodeVerifierError) {\n        // First check if user is already authenticated before trying iframe workaround\n        try {\n          const isAlreadyLoggedIn = await this.isLoggedIn();\n\n          if (isAlreadyLoggedIn) {\n            // \"User already authenticated, skipping iframe workaround\",\n            const user = await this.getUser();\n            const loginSuccessUrlFromStateValue =\n              loginSuccessUrlFromState(state);\n            const frontendUrl =\n              options?.frontendUrl ||\n              loginSuccessUrlFromStateValue ||\n              this.authConfig.loginSuccessUrl;\n\n            // Check if this is an iframe context - if so, generate iframe completion HTML\n            const stateDisplayMode = displayModeFromState(state, undefined);\n            const isConfiguredForIframe = stateDisplayMode === \"iframe\";\n\n            if (\n              isConfiguredForIframe &&\n              !this.authConfig.disableIframeDetection &&\n              user &&\n              frontendUrl\n            ) {\n              // Generating iframe completion HTML for already authenticated user\",\n              const completionHtml = this.generateIframeCompletionHtml(\n                user,\n                frontendUrl,\n              );\n              return { content: completionHtml };\n            }\n\n            if (frontendUrl) {\n              return { redirectTo: frontendUrl };\n            } else {\n              return { content: { success: true, user } };\n            }\n          }\n        } catch (authCheckError) {\n          console.warn(\n            \"Failed to check authentication status:\",\n            authCheckError,\n          );\n          // Continue with iframe workaround if auth check fails\n        }\n\n        const stateDisplayMode = displayModeFromState(state, undefined);\n        const isConfiguredForIframe = stateDisplayMode === \"iframe\";\n\n        if (isConfiguredForIframe && !this.authConfig.disableIframeDetection) {\n          // Generate HTML that will trigger same-domain callback\n          const loginSuccessUrlFromStateValue = loginSuccessUrlFromState(state);\n          const frontendUrl =\n            options?.frontendUrl ||\n            loginSuccessUrlFromStateValue ||\n            this.authConfig.loginSuccessUrl;\n\n          const callbackUrl = req.url || \"\";\n          const sameDomainHtml = this.generateSameDomainCallbackHtml(\n            callbackUrl,\n            frontendUrl,\n          );\n          return { content: sameDomainHtml };\n        }\n\n        // For non-iframe mode or when iframe detection is disabled, return trigger text\n        return {\n          content: `<html lang=\"en\"><body><span style=\"display:none\">${TOKEN_EXCHANGE_TRIGGER_TEXT}</span></body></html>`,\n        };\n      }\n\n      // Re-throw other errors\n      throw error;\n    }\n\n    // Extract loginSuccessUrl from state if present\n    const loginSuccessUrlFromStateValue = loginSuccessUrlFromState(state);\n\n    // Priority: options.frontendUrl > loginSuccessUrl from state > config loginSuccessUrl\n    const frontendUrl =\n      options?.frontendUrl ||\n      loginSuccessUrlFromStateValue ||\n      this.authConfig.loginSuccessUrl;\n\n    // Priority 1: Check state for display mode configuration\n    const stateDisplayMode = displayModeFromState(state, undefined);\n    const isConfiguredForIframe = stateDisplayMode === \"iframe\";\n\n    // Determine if this should be treated as an iframe request\n    // Configuration (from state) takes precedence over auto-detection\n    const shouldTreatAsIframe =\n      isConfiguredForIframe && !this.authConfig.disableIframeDetection;\n\n    const isTopLevelRedirect = req.headers[\"sec-fetch-dest\"] === \"document\";\n    const isIframeRequest = req.headers[\"sec-fetch-dest\"] === \"iframe\";\n    const isApiRequest =\n      options?.apiResponse || req.headers.accept?.includes(\"application/json\");\n\n    // Detect Safari or other browsers where iframe postMessage may fail due to cross-origin restrictions\n    //TODO: Find a better way to detect this\n    const userAgent = req.headers[\"user-agent\"] || \"\";\n    const isSafari =\n      userAgent.includes(\"Safari\") && !userAgent.includes(\"Chrome\");\n    const isLikelyCrossOriginIframe =\n      isSafari ||\n      (userAgent.includes(\"WebKit\") && !userAgent.includes(\"Chrome\"));\n\n    // Case 1: The request should be treated as iframe. Return HTML content.\n    // Unless iframe detection is disabled via configuration OR we detect cross-origin issues\n    if (\n      shouldTreatAsIframe &&\n      user &&\n      frontendUrl &&\n      !isLikelyCrossOriginIframe\n    ) {\n      const completionHtml = this.generateIframeCompletionHtml(\n        user,\n        frontendUrl,\n      );\n      return { content: completionHtml };\n    }\n\n    // Case 1b: Safari/cross-origin iframe case - redirect instead of HTML\n    if (\n      shouldTreatAsIframe &&\n      user &&\n      frontendUrl &&\n      isLikelyCrossOriginIframe\n    ) {\n      return { redirectTo: frontendUrl };\n    }\n\n    // Case 2: The request is a top-level navigation. Return redirect URL.\n    if (isTopLevelRedirect && frontendUrl) {\n      return { redirectTo: frontendUrl };\n    }\n\n    // Case 2a: The request is from an iframe (detected by sec-fetch-dest)\n    // Even if not configured for iframe in state, we should still generate iframe completion HTML\n    if (isIframeRequest && user && frontendUrl) {\n      if (isLikelyCrossOriginIframe) {\n        console.log(\n          \"Iframe request detected but cross-origin issues likely - redirecting\",\n        );\n        return { redirectTo: frontendUrl };\n      } else {\n        console.log(\n          \"Generating iframe completion HTML for iframe request (detected by sec-fetch-dest)\",\n        );\n        const completionHtml = this.generateIframeCompletionHtml(\n          user,\n          frontendUrl,\n        );\n        return { content: completionHtml };\n      }\n    }\n\n    // Case 3: The request is an API call. Return JSON content.\n    if (isApiRequest) {\n      return {\n        content: {\n          success: true,\n          user,\n        },\n      };\n    }\n\n    // Fallback for older browsers or other contexts: if a frontend URL is configured,\n    // assume a redirect to it.\n    if (frontendUrl) {\n      return { redirectTo: frontendUrl };\n    }\n\n    // Server-side fallback: if no frontend URL is configured but we have a postLogoutRedirectUrl,\n    // redirect there instead of returning JSON content\n    if (this.authConfig.postLogoutRedirectUrl) {\n      return { redirectTo: this.authConfig.postLogoutRedirectUrl };\n    }\n\n    // Absolute fallback: return success as JSON content if no other conditions are met.\n    // This could happen if no loginSuccessUrl or postLogoutRedirectUrl is configured.\n    return {\n      content: {\n        success: true,\n        user,\n      },\n    };\n  }\n\n  /**\n   * Generate HTML content for iframe completion that sends postMessage to parent\n   */\n  private generateIframeCompletionHtml(\n    user: User,\n    frontendUrl?: string,\n  ): string {\n    const escapedUser = JSON.stringify(user).replace(/'/g, \"\\\\'\");\n    const clientId = this.authConfig.clientId;\n\n    // Determine fallback redirect URL\n    const fallbackUrl =\n      frontendUrl ||\n      this.authConfig.redirectUrl ||\n      this.authConfig.postLogoutRedirectUrl ||\n      \"/\";\n\n    return `\n      <!DOCTYPE html>\n      <html>\n      <head>\n        <title>Authentication Complete</title>\n        <meta charset=\"utf-8\">\n      </head>\n      <body>        \n        <!-- Success signal for SignalObserver -->\n        <div id=\"civic-auth-success-signal\" style=\"display: none;\" data-user-info='${escapedUser}'>\n          ${TOKEN_EXCHANGE_SUCCESS_TEXT}\n        </div>\n        \n        <script>\n          // Send postMessage to parent to resolve authentication promise\n          if (window.parent && window.parent !== window) {\n            try {\n              window.parent.postMessage({\n                type: 'auth_success',\n                detail: 'Authentication successful',\n                data: {\n                  user: ${escapedUser},\n                  redirectUrl: ${JSON.stringify(fallbackUrl)}\n                }\n              }, '*');\n            } catch (error) {\n              console.error('❌ Failed to send postMessage:', error);\n            }\n\n            // Also send civicloginApp format message for compatibility\n            try {\n              window.parent.postMessage({\n                source: 'civicloginApp',\n                type: 'auth_success',\n                clientId: ${JSON.stringify(clientId)},\n                data: {\n                  user: ${escapedUser},\n                  redirectUrl: ${JSON.stringify(fallbackUrl)}\n                }\n              }, '*');\n            } catch (error) {\n              console.error('❌ Failed to send civicloginApp message:', error);\n            }\n          } else {\n            console.log('❌ Not in iframe context or no parent window');\n          }\n          \n          // Fallback redirect after 500ms delay to handle cases where:\n          // 1. postMessage fails or parent doesn't respond\n          // 2. Not in iframe context\n          // 3. Any other edge cases where the user gets stuck\n          setTimeout(function() {\n            var redirectTarget = ${JSON.stringify(fallbackUrl)};\n            console.log('🔄 Executing fallback redirect to:', redirectTarget);\n            window.location.href = redirectTarget;\n          }, 500);\n        </script>\n      </body>\n      </html>\n    `;\n  }\n\n  /**\n   * Generate HTML response that triggers same-domain callback for iframe workaround\n   */\n  private generateSameDomainCallbackHtml = (\n    callbackUrl: string,\n    frontendUrl?: string,\n  ): string => {\n    const loginSuccessSegment = frontendUrl\n      ? `&loginSuccessUrl=${encodeURIComponent(frontendUrl)}`\n      : \"\";\n\n    return `<html lang=\"en\">\n  <body>\n      <span style=\"display:none\">\n          <script>\n              window.onload = function () {\n                  // Get the complete URL including origin and path\n                  // This ensures we capture any base path like /directory\n                  const appUrl = window.location.href.substring(\n                    0,\n                    window.location.href.indexOf(\"/api/auth\")\n                  );\n                  fetch('${callbackUrl}&sameDomainCallback=true&appUrl=' + encodeURIComponent(appUrl) + '${loginSuccessSegment}').then((response) => {\n                      response.json().then((jsonResponse) => {\n                        // For login: Redirect back to the callback route, so Case 2 in handleTokenExchangeComplete will be triggered\n                        // For logout: Redirect to the postLogoutRedirectUrl\n                        if(jsonResponse.redirectUrl) {\n                          window.location.href = jsonResponse.redirectUrl;\n                        }\n                      });\n                  });\n              };\n          </script>\n      </span>\n  </body>\n</html>\n`;\n  };\n}\n"]}
+{"version":3,"file":"session.js","sourceRoot":"","sources":["../../src/server/session.ts"],"names":[],"mappings":"AAAA,OAAO,EAML,SAAS,GACV,MAAM,YAAY,CAAC;AAEpB,OAAO,EACL,OAAO,IAAI,iBAAiB,EAC5B,SAAS,IAAI,mBAAmB,GACjC,MAAM,yBAAyB,CAAC;AACjC,OAAO,EAAE,WAAW,IAAI,eAAe,EAAE,MAAM,sBAAsB,CAAC;AACtE,OAAO,EAAE,sBAAsB,EAAE,MAAM,mBAAmB,CAAC;AAC3D,OAAO,EAAE,aAAa,EAAE,MAAM,mBAAmB,CAAC;AAClD,OAAO,EAAE,sBAAsB,EAAE,MAAM,oBAAoB,CAAC;AAC5D,OAAO,EACL,2BAA2B,EAC3B,2BAA2B,GAC5B,MAAM,gBAAgB,CAAC;AACxB,OAAO,EAAE,aAAa,EAAE,MAAM,qBAAqB,CAAC;AACpD,OAAO,EAAE,UAAU,EAAE,MAAM,mBAAmB,CAAC;AAC/C,OAAO,EAAE,4BAA4B,EAAE,MAAM,0CAA0C,CAAC;AACxF,OAAO,EACL,mBAAmB,EACnB,4BAA4B,GAC7B,MAAM,gBAAgB,CAAC;AAExB,OAAO,EAAE,oBAAoB,EAAE,wBAAwB,EAAE,MAAM,gBAAgB,CAAC;AAChF,OAAO,EAAE,SAAS,EAAmB,MAAM,MAAM,CAAC;AAClD,OAAO,EACL,sBAAsB,EACtB,mBAAmB,EACnB,kBAAkB,EAClB,iBAAiB,GAClB,MAAM,sBAAsB,CAAC;AAC9B,OAAO,EAAE,YAAY,EAAE,MAAM,uBAAuB,CAAC;AAErD,OAAO,EAAE,OAAO,EAAE,MAAM,iBAAiB,CAAC;AAgC1C,uCAAuC;AACvC,MAAM,QAAQ,GAAG,CACf,IAAS,EACT,GAAM,EACM,EAAE;IACd,MAAM,MAAM,GAAG,EAAE,GAAG,GAAG,EAAE,CAAC;IAC1B,IAAI,CAAC,OAAO,CAAC,CAAC,GAAG,EAAE,EAAE;QACnB,OAAO,MAAM,CAAC,GAAG,CAAC,CAAC;IACrB,CAAC,CAAC,CAAC;IACH,OAAO,MAAM,CAAC;AAChB,CAAC,CAAC;AAEF;;GAEG;AACH,MAAM,oBAAoB,GAAG,CAAC,GAA0B,EAAW,EAAE;IACnE,IAAI,CAAC,GAAG,CAAC,GAAG;QAAE,OAAO,KAAK,CAAC;IAC3B,OAAO,GAAG,CAAC,GAAG,CAAC,QAAQ,CAAC,yBAAyB,CAAC,CAAC;AACrD,CAAC,CAAC;AAEF;;;;GAIG;AACH,SAAS,iBAAiB,CACxB,MAA6B;IAE7B,IAAI,CAAC,MAAM,CAAC,QAAQ;QAAE,OAAO,IAAI,CAAC;IAElC,MAAM,WAAW,GAAG,SAAS,CAAC,MAAM,CAAC,QAAQ,CAAmB,CAAC;IACjE,IAAI,CAAC,WAAW,CAAC,GAAG;QAAE,OAAO,IAAI,CAAC;IAElC,qCAAqC;IACrC,MAAM,6BAA6B,GAAG;QACpC,GAAI,WAAiB;QACrB,EAAE,EAAE,WAAW,CAAC,GAAG;KACpB,CAAC;IAEF,0EAA0E;IAC1E,OAAO,QAAQ,CACb,CAAC,GAAG,4BAA4B,EAAE,GAAG,SAAS,CAAC,EAC/C,6BAA6B,CACnB,CAAC;AACf,CAAC;AAED;;;GAGG;AACH,MAAM,OAAO,SAAS;IAGT;IACA;IAHX,aAAa,GAAkC,IAAI,CAAC;IACpD,YACW,OAAsB,EACtB,UAAsB;QADtB,YAAO,GAAP,OAAO,CAAe;QACtB,eAAU,GAAV,UAAU,CAAY;IAC9B,CAAC;IAEJ,IAAI,WAAW;QACb,OAAO,IAAI,CAAC,UAAU,CAAC,WAAW,IAAI,mBAAmB,CAAC;IAC5D,CAAC;IAED,KAAK,CAAC,eAAe;QACnB,IAAI,IAAI,CAAC,aAAa,EAAE,CAAC;YACvB,OAAO,CAAC,MAAM,CAAC,KAAK,CAAC,gCAAgC,EAAE,IAAI,CAAC,UAAU,CAAC,CAAC;YACxE,OAAO,OAAO,CAAC,OAAO,CAAC,IAAI,CAAC,aAAa,CAAC,CAAC;QAC7C,CAAC;QACD,OAAO,CAAC,MAAM,CAAC,KAAK,CAAC,4BAA4B,EAAE,IAAI,CAAC,UAAU,CAAC,CAAC;QACpE,IAAI,CAAC,aAAa,GAAG,MAAM,4BAA4B,CAAC,KAAK,CAC3D;YACE,GAAG,IAAI,CAAC,UAAU;YAClB,WAAW,EAAE,IAAI,CAAC,WAAW;SAC9B,EACD,IAAI,CAAC,OAAO,CACb,CAAC;QACF,OAAO,IAAI,CAAC,aAAa,CAAC;IAC5B,CAAC;IACD;;;OAGG;IACH,KAAK,CAAC,OAAO;QAGX,MAAM,QAAQ,GAAG,MAAM,IAAI,CAAC,eAAe,EAAE,CAAC;QAE9C,IAAI,CAAC;YACH,iDAAiD;YACjD,MAAM,OAAO,GAAG,MAAM,QAAQ,CAAC,uBAAuB,EAAE,CAAC;YACzD,IAAI,CAAC,OAAO,EAAE,aAAa,EAAE,CAAC;gBAC5B,OAAO,IAAI,CAAC;YACd,CAAC;YAED,qEAAqE;YACrE,OAAO,iBAAiB,CAAI,IAAI,CAAC,OAAO,CAAC,CAAC;QAC5C,CAAC;QAAC,OAAO,KAAK,EAAE,CAAC;YACf,OAAO,CAAC,KAAK,CAAC,wCAAwC,EAAE,KAAK,CAAC,CAAC;YAC/D,OAAO,IAAI,CAAC;QACd,CAAC;IACH,CAAC;IAED;;;OAGG;IACH,KAAK,CAAC,SAAS;QACb,MAAM,QAAQ,GAAG,MAAM,IAAI,CAAC,eAAe,EAAE,CAAC;QAE9C,IAAI,CAAC;YACH,mDAAmD;YACnD,MAAM,OAAO,GAAG,MAAM,QAAQ,CAAC,uBAAuB,EAAE,CAAC;YAEzD,IAAI,CAAC,OAAO,EAAE,aAAa,EAAE,CAAC;gBAC5B,OAAO,IAAI,CAAC;YACd,CAAC;YAED,uEAAuE;YACvE,MAAM,MAAM,GAAG,MAAM,mBAAmB,CAAC,IAAI,CAAC,OAAO,CAAC,CAAC;YACvD,OAAO,MAAM,CAAC;QAChB,CAAC;QAAC,OAAO,KAAK,EAAE,CAAC;YACf,OAAO,CAAC,KAAK,CAAC,4CAA4C,EAAE,KAAK,CAAC,CAAC;YACnE,OAAO,IAAI,CAAC;QACd,CAAC;IACH,CAAC;IAED;;;;;OAKG;IACH,KAAK,CAAC,sBAAsB,CAC1B,IAAY,EACZ,KAAa;QAEb,OAAO,sBAAsB,CAAC,IAAI,EAAE,KAAK,EAAE,IAAI,CAAC,OAAO,EAAE,IAAI,CAAC,UAAU,CAAC,CAAC;IAC5E,CAAC;IAED;;;OAGG;IACH,KAAK,CAAC,UAAU;QACd,MAAM,QAAQ,GAAG,MAAM,IAAI,CAAC,eAAe,EAAE,CAAC;QAC9C,MAAM,OAAO,GAAG,MAAM,QAAQ,CAAC,uBAAuB,EAAE,CAAC;QACzD,OAAO,OAAO,EAAE,aAAa,IAAI,KAAK,CAAC;IACzC,CAAC;IAED;;;;OAIG;IACH,KAAK,CAAC,aAAa,CAAC,OAInB;QACC,OAAO,aAAa,CAClB;YACE,GAAG,IAAI,CAAC,UAAU;YAClB,MAAM,EAAE,OAAO,EAAE,MAAM;YACvB,KAAK,EAAE,OAAO,EAAE,KAAK;YACrB,KAAK,EAAE,OAAO,EAAE,KAAK;YACrB,SAAS,EAAE,QAAQ;YACnB,UAAU,EAAE,UAAU,EAAE;SACzB,EACD,IAAI,CAAC,OAAO,CACb,CAAC;IACJ,CAAC;IAED;;;;OAIG;IACH,KAAK,CAAC,sBAAsB,CAAC,OAG5B;QACC,gEAAgE;QAChE,IAAI,IAAI,CAAC,UAAU,CAAC,QAAQ,EAAE,CAAC;YAC7B,gEAAgE;YAChE,yEAAyE;YACzE,MAAM,UAAU,GAAG,IAAI,GAAG,CAAC,IAAI,CAAC,UAAU,CAAC,QAAQ,CAAC,CAAC,MAAM,CAAC;YAC5D,MAAM,SAAS,GAAG,mBAAmB,CAAC,IAAI,CAAC,UAAU,CAAC,gBAAgB,CAAC,CAAC;YACxE,MAAM,gBAAgB,GAAG,kBAAkB,CAAC,UAAU,EAAE,SAAS,CAAC,MAAM,CAAC,CAAC;YAE1E,MAAM,SAAS,GAAG,IAAI,GAAG,CAAC,gBAAgB,CAAC,CAAC;YAE5C,6DAA6D;YAC7D,IAAI,IAAI,CAAC,UAAU,CAAC,qBAAqB,EAAE,CAAC;gBAC1C,SAAS,CAAC,YAAY,CAAC,GAAG,CACxB,mBAAmB,EACnB,IAAI,CAAC,UAAU,CAAC,qBAAqB,CACtC,CAAC;YACJ,CAAC;YAED,4BAA4B;YAC5B,IAAI,OAAO,EAAE,KAAK,EAAE,CAAC;gBACnB,SAAS,CAAC,YAAY,CAAC,GAAG,CAAC,OAAO,EAAE,OAAO,CAAC,KAAK,CAAC,CAAC;YACrD,CAAC;YAED,OAAO,SAAS,CAAC;QACnB,CAAC;QAED,qEAAqE;QACrE,IAAI,CAAC;YACH,gFAAgF;YAChF,uEAAuE;YACvE,MAAM,MAAM,GAAG,MAAM,mBAAmB,CAAC,IAAI,CAAC,OAAO,CAAC,CAAC;YAEvD,IAAI,MAAM,EAAE,OAAO,EAAE,CAAC;gBACpB,kDAAkD;gBAClD,IAAI,CAAC,IAAI,CAAC,UAAU,CAAC,QAAQ,EAAE,CAAC;oBAC9B,MAAM,IAAI,KAAK,CAAC,kDAAkD,CAAC,CAAC;gBACtE,CAAC;gBAED,wDAAwD;gBACxD,yDAAyD;gBAEzD,MAAM,SAAS,GAAG,MAAM,sBAAsB,CAAC;oBAC7C,QAAQ,EAAE,IAAI,CAAC,UAAU,CAAC,QAAQ;oBAClC,WAAW,EAAE,IAAI,CAAC,UAAU,CAAC,qBAAqB,IAAI,GAAG;oBACzD,OAAO,EAAE,MAAM,CAAC,OAAO;oBACvB,KAAK,EAAE,OAAO,EAAE,KAAK,IAAI,IAAI,CAAC,MAAM,EAAE,CAAC,QAAQ,CAAC,EAAE,CAAC,CAAC,SAAS,CAAC,CAAC,CAAC;oBAChE,WAAW,EAAE,IAAI,CAAC,WAAW;iBAC9B,CAAC,CAAC;gBAEH,OAAO,SAAS,CAAC;YACnB,CAAC;QACH,CAAC;QAAC,OAAO,KAAK,EAAE,CAAC;YACf,kEAAkE;YAClE,OAAO,CAAC,IAAI,CACV,sFAAsF,EACtF,KAAK,CACN,CAAC;QACJ,CAAC;QAED,4FAA4F;QAC5F,OAAO,sBAAsB,CAC3B;YACE,GAAG,IAAI,CAAC,UAAU;YAClB,MAAM,EAAE,OAAO,EAAE,MAAM;YACvB,KAAK,EAAE,OAAO,EAAE,KAAK;SACtB,EACD,IAAI,CAAC,OAAO,CACb,CAAC;IACJ,CAAC;IAED;;;OAGG;IACH,KAAK,CAAC,aAAa;QACjB,OAAO,aAAa,CAAC,IAAI,CAAC,OAAO,EAAE,IAAI,CAAC,UAAU,CAAC,CAAC;IACtD,CAAC;IAED;;OAEG;IACH,KAAK,CAAC,WAAW;QACf,OAAO,eAAe,CAAC,IAAI,CAAC,OAAO,CAAC,CAAC;IACvC,CAAC;IAED;;;OAGG;IAEH;;OAEG;IACH,MAAM,CAAC,YAAY,CAAC,KAAa;QAC/B,IAAI,CAAC;YACH,OAAO,kBAAkB,CAAC,KAAK,CAAC,CAAC;QACnC,CAAC;QAAC,OAAO,CAAC,EAAE,CAAC;YACX,OAAO,CAAC,KAAK,CAAC,+BAA+B,EAAE,CAAC,CAAC,CAAC;YAClD,OAAO,KAAK,CAAC;QACf,CAAC;IACH,CAAC;IAED;;OAEG;IACH,MAAM,CAAC,oBAAoB,CACzB,OAA4B,EAC5B,SAAiB;QAEjB,MAAM,UAAU,GAAG,OAAO,CAAC,YAAY,CAAC,GAAG,CAAC,SAAS,CAAC,CAAC;QACvD,IAAI,UAAU,EAAE,CAAC;YACf,OAAO,SAAS,CAAC,YAAY,CAAC,UAAU,CAAC,CAAC;QAC5C,CAAC;QACD,OAAO,IAAI,CAAC;IACd,CAAC;IAED;;OAEG;IACH,MAAM,CAAC,qBAAqB,CAC1B,OAA4B,EAC5B,UAAkB,EAClB,SAAiB;QAEjB,4EAA4E;QAC5E,MAAM,WAAW,GAAG,OAAO,CAAC,OAAO,CAAC,GAAG,CAAC,UAAU,CAAC,EAAE,KAAK,CAAC;QAC3D,IAAI,WAAW,EAAE,CAAC;YAChB,OAAO,SAAS,CAAC,YAAY,CAAC,WAAW,CAAC,CAAC;QAC7C,CAAC;QAED,8BAA8B;QAC9B,OAAO,SAAS,CAAC,oBAAoB,CAAC,OAAO,EAAE,SAAS,CAAC,CAAC;IAC5D,CAAC;IAED;;;OAGG;IACH,MAAM,CAAC,SAAS,CAAC,OAA4B;QAC3C,OAAO,SAAS,CAAC,qBAAqB,CACpC,OAAO,EACP,YAAY,CAAC,OAAO,EACpB,QAAQ,CACT,CAAC;IACJ,CAAC;IAED;;;OAGG;IACH,MAAM,CAAC,kBAAkB,CACvB,OAA4B,EAC5B,OAAuB;QAEvB,MAAM,KAAK,GAAG,OAAO,CAAC,YAAY,CAAC,GAAG,CAAC,OAAO,CAAC,CAAC;QAChD,MAAM,eAAe,GACnB,wBAAwB,CAAC,KAAK,CAAC;YAC/B,SAAS,CAAC,oBAAoB,CAAC,OAAO,EAAE,iBAAiB,CAAC,CAAC;QAE7D,IAAI,CAAC,eAAe,EAAE,CAAC;YACrB,OAAO,IAAI,CAAC;QACd,CAAC;QAED,OAAO,OAAO,CAAC,CAAC,CAAC,IAAI,GAAG,CAAC,eAAe,EAAE,OAAO,CAAC,CAAC,IAAI,CAAC,CAAC,CAAC,eAAe,CAAC;IAC5E,CAAC;IAED;;OAEG;IACH,MAAM,CAAC,aAAa,CAClB,OAA4B,EAC5B,GAAW,EACX,MAAsB;QAEtB,IAAI,GAAG,CAAC,UAAU,CAAC,MAAM,CAAC,EAAE,CAAC;YAC3B,OAAO,GAAG,CAAC;QACb,CAAC;QAED,0FAA0F;QAC1F,MAAM,OAAO,GAAG,MAAM,IAAI,IAAI,GAAG,CAAC,OAAO,CAAC,GAAG,CAAC,CAAC,MAAM,CAAC;QACtD,OAAO,IAAI,GAAG,CAAC,GAAG,EAAE,OAAO,CAAC,CAAC,IAAI,CAAC;IACpC,CAAC;IAED;;OAEG;IACH,wBAAwB,CAAC,OAA4B;QACnD,iEAAiE;QACjE,MAAM,SAAS,GAAG,OAAO,CAAC,YAAY,CAAC,GAAG,CAAC,WAAW,CAAC,CAAC;QACxD,IAAI,SAAS,EAAE,CAAC;YACd,OAAO,SAAS,CAAC;QACnB,CAAC;QAED,MAAM,cAAc,GAAG,IAAI,CAAC,UAAU,CAAC,eAAe,IAAI,GAAG,CAAC;QAE9D,+CAA+C;QAC/C,MAAM,kBAAkB,GAAG,yBAAyB,CAAC,IAAI,CAAC,cAAc,CAAC,CAAC;QAC1E,IAAI,kBAAkB,EAAE,CAAC;YACvB,OAAO,cAAc,CAAC;QACxB,CAAC;QAED,gDAAgD;QAChD,MAAM,MAAM,GAAG,SAAS,CAAC,SAAS,CAAC,OAAO,CAAC,CAAC;QAC5C,IAAI,MAAM,EAAE,CAAC;YACX,OAAO,IAAI,GAAG,CAAC,cAAc,EAAE,MAAM,CAAC,CAAC,IAAI,CAAC;QAC9C,CAAC;QAED,6BAA6B;QAC7B,OAAO,IAAI,GAAG,CAAC,OAAO,CAAC,GAAG,CAAC,CAAC,MAAM,CAAC;IACrC,CAAC;IAED;;;;;;;;;;;;;;;;;;;;;;;;;;;;OA4BG;IACH,KAAK,CAAC,cAAc,CAClB,EAAE,IAAI,EAAE,KAAK,EAAE,GAAG,EAAwB,EAC1C,OAGC;QAKD,oDAAoD;QACpD,IAAI,oBAAoB,CAAC,GAAG,CAAC,EAAE,CAAC;YAC9B,IAAI,CAAC;gBACH,0EAA0E;gBAC1E,MAAM,iBAAiB,GAAG,MAAM,IAAI,CAAC,UAAU,EAAE,CAAC;gBAClD,IAAI,IAAI,GAAgB,IAAI,CAAC;gBAE7B,IAAI,iBAAiB,EAAE,CAAC;oBACtB,wDAAwD;oBACxD,IAAI,GAAG,MAAM,IAAI,CAAC,OAAO,EAAE,CAAC;oBAC5B,OAAO,CAAC,GAAG,CACT,qDAAqD,EACrD,CAAC,CAAC,IAAI,CACP,CAAC;gBACJ,CAAC;qBAAM,CAAC;oBACN,8DAA8D;oBAC9D,MAAM,MAAM,GAAG,MAAM,IAAI,CAAC,sBAAsB,CAAC,IAAI,EAAE,KAAK,CAAC,CAAC;oBAC9D,IAAI,GAAG,iBAAiB,CAAC,MAAM,CAAC,CAAC;oBACjC,OAAO,CAAC,GAAG,CACT,mDAAmD,EACnD,CAAC,CAAC,IAAI,CACP,CAAC;gBACJ,CAAC;gBAED,gDAAgD;gBAChD,MAAM,UAAU,GAAG,IAAI,GAAG,CAAC,GAAG,CAAC,GAAG,IAAI,EAAE,CAAC,CAAC;gBAE1C,oFAAoF;gBACpF,oFAAoF;gBACpF,MAAM,kBAAkB,GACtB,UAAU,CAAC,YAAY,CAAC,GAAG,CAAC,iBAAiB,CAAC,CAAC;gBACjD,MAAM,eAAe,GAAG,kBAAkB;oBACxC,CAAC,CAAC,iBAAiB,CAAC,kBAAkB,EAAE,UAAU,CAAC,MAAM,CAAC;oBAC1D,CAAC,CAAC,IAAI,CAAC;gBAET,MAAM,eAAe,GAAG,IAAI,eAAe,CAAC,UAAU,CAAC,MAAM,CAAC,CAAC;gBAC/D,eAAe,CAAC,MAAM,CAAC,oBAAoB,CAAC,CAAC;gBAC7C,eAAe,CAAC,MAAM,CAAC,QAAQ,CAAC,CAAC;gBACjC,eAAe,CAAC,MAAM,CAAC,iBAAiB,CAAC,CAAC;gBAE1C,gGAAgG;gBAChG,qGAAqG;gBACrG,MAAM,WAAW,GACf,eAAe,IAAI,IAAI,CAAC,UAAU,CAAC,eAAe,IAAI,GAAG,CAAC;gBAC5D,OAAO;oBACL,OAAO,EAAE;wBACP,OAAO,EAAE,IAAI;wBACb,WAAW;qBACiC;iBAC/C,CAAC;YACJ,CAAC;YAAC,OAAO,KAAK,EAAE,CAAC;gBACf,OAAO,CAAC,KAAK,CAAC,8BAA8B,EAAE,KAAK,CAAC,CAAC;gBACrD,MAAM,KAAK,CAAC;YACd,CAAC;QACH,CAAC;QAED,mDAAmD;QACnD,IAAI,MAA6B,CAAC;QAClC,IAAI,IAAiB,CAAC;QAEtB,IAAI,CAAC;YACH,MAAM,GAAG,MAAM,IAAI,CAAC,sBAAsB,CAAC,IAAI,EAAE,KAAK,CAAC,CAAC;YACxD,IAAI,GAAG,iBAAiB,CAAC,MAAM,CAAC,CAAC;QACnC,CAAC;QAAC,OAAO,KAAK,EAAE,CAAC;YACf,kEAAkE;YAClE,MAAM,mBAAmB,GACvB,KAAK,YAAY,KAAK;gBACtB,KAAK,CAAC,OAAO,CAAC,QAAQ,CAAC,oCAAoC,CAAC,CAAC;YAE/D,IAAI,mBAAmB,EAAE,CAAC;gBACxB,+EAA+E;gBAC/E,IAAI,CAAC;oBACH,MAAM,iBAAiB,GAAG,MAAM,IAAI,CAAC,UAAU,EAAE,CAAC;oBAElD,IAAI,iBAAiB,EAAE,CAAC;wBACtB,4DAA4D;wBAC5D,MAAM,IAAI,GAAG,MAAM,IAAI,CAAC,OAAO,EAAE,CAAC;wBAClC,MAAM,6BAA6B,GACjC,wBAAwB,CAAC,KAAK,CAAC,CAAC;wBAClC,MAAM,WAAW,GACf,OAAO,EAAE,WAAW;4BACpB,6BAA6B;4BAC7B,IAAI,CAAC,UAAU,CAAC,eAAe,CAAC;wBAElC,8EAA8E;wBAC9E,MAAM,gBAAgB,GAAG,oBAAoB,CAAC,KAAK,EAAE,SAAS,CAAC,CAAC;wBAChE,MAAM,qBAAqB,GAAG,gBAAgB,KAAK,QAAQ,CAAC;wBAE5D,IACE,qBAAqB;4BACrB,CAAC,IAAI,CAAC,UAAU,CAAC,sBAAsB;4BACvC,IAAI;4BACJ,WAAW,EACX,CAAC;4BACD,qEAAqE;4BACrE,MAAM,cAAc,GAAG,IAAI,CAAC,4BAA4B,CACtD,IAAI,EACJ,WAAW,CACZ,CAAC;4BACF,OAAO,EAAE,OAAO,EAAE,cAAc,EAAE,CAAC;wBACrC,CAAC;wBAED,IAAI,WAAW,EAAE,CAAC;4BAChB,OAAO,EAAE,UAAU,EAAE,WAAW,EAAE,CAAC;wBACrC,CAAC;6BAAM,CAAC;4BACN,yDAAyD;4BACzD,yEAAyE;4BACzE,2EAA2E;4BAC3E,8EAA8E;4BAC9E,OAAO,EAAE,OAAO,EAAE,EAAE,OAAO,EAAE,IAAI,EAAE,IAAI,EAAE,EAAE,CAAC;wBAC9C,CAAC;oBACH,CAAC;gBACH,CAAC;gBAAC,OAAO,cAAc,EAAE,CAAC;oBACxB,OAAO,CAAC,IAAI,CACV,wCAAwC,EACxC,cAAc,CACf,CAAC;oBACF,sDAAsD;gBACxD,CAAC;gBAED,MAAM,gBAAgB,GAAG,oBAAoB,CAAC,KAAK,EAAE,SAAS,CAAC,CAAC;gBAChE,MAAM,qBAAqB,GAAG,gBAAgB,KAAK,QAAQ,CAAC;gBAE5D,IAAI,qBAAqB,IAAI,CAAC,IAAI,CAAC,UAAU,CAAC,sBAAsB,EAAE,CAAC;oBACrE,uDAAuD;oBACvD,MAAM,6BAA6B,GAAG,wBAAwB,CAAC,KAAK,CAAC,CAAC;oBACtE,MAAM,WAAW,GACf,OAAO,EAAE,WAAW;wBACpB,6BAA6B;wBAC7B,IAAI,CAAC,UAAU,CAAC,eAAe,CAAC;oBAElC,MAAM,WAAW,GAAG,GAAG,CAAC,GAAG,IAAI,EAAE,CAAC;oBAClC,MAAM,cAAc,GAAG,IAAI,CAAC,8BAA8B,CACxD,WAAW,EACX,WAAW,CACZ,CAAC;oBACF,OAAO,EAAE,OAAO,EAAE,cAAc,EAAE,CAAC;gBACrC,CAAC;gBAED,gFAAgF;gBAChF,OAAO;oBACL,OAAO,EAAE,oDAAoD,2BAA2B,uBAAuB;iBAChH,CAAC;YACJ,CAAC;YAED,wBAAwB;YACxB,MAAM,KAAK,CAAC;QACd,CAAC;QAED,gDAAgD;QAChD,MAAM,6BAA6B,GAAG,wBAAwB,CAAC,KAAK,CAAC,CAAC;QAEtE,sFAAsF;QACtF,MAAM,WAAW,GACf,OAAO,EAAE,WAAW;YACpB,6BAA6B;YAC7B,IAAI,CAAC,UAAU,CAAC,eAAe,CAAC;QAElC,yDAAyD;QACzD,MAAM,gBAAgB,GAAG,oBAAoB,CAAC,KAAK,EAAE,SAAS,CAAC,CAAC;QAChE,MAAM,qBAAqB,GAAG,gBAAgB,KAAK,QAAQ,CAAC;QAE5D,2DAA2D;QAC3D,kEAAkE;QAClE,MAAM,mBAAmB,GACvB,qBAAqB,IAAI,CAAC,IAAI,CAAC,UAAU,CAAC,sBAAsB,CAAC;QAEnE,MAAM,kBAAkB,GAAG,GAAG,CAAC,OAAO,CAAC,gBAAgB,CAAC,KAAK,UAAU,CAAC;QACxE,MAAM,eAAe,GAAG,GAAG,CAAC,OAAO,CAAC,gBAAgB,CAAC,KAAK,QAAQ,CAAC;QACnE,MAAM,YAAY,GAChB,OAAO,EAAE,WAAW,IAAI,GAAG,CAAC,OAAO,CAAC,MAAM,EAAE,QAAQ,CAAC,kBAAkB,CAAC,CAAC;QAE3E,qGAAqG;QACrG,wCAAwC;QACxC,MAAM,SAAS,GAAG,GAAG,CAAC,OAAO,CAAC,YAAY,CAAC,IAAI,EAAE,CAAC;QAClD,MAAM,QAAQ,GACZ,SAAS,CAAC,QAAQ,CAAC,QAAQ,CAAC,IAAI,CAAC,SAAS,CAAC,QAAQ,CAAC,QAAQ,CAAC,CAAC;QAChE,MAAM,yBAAyB,GAC7B,QAAQ;YACR,CAAC,SAAS,CAAC,QAAQ,CAAC,QAAQ,CAAC,IAAI,CAAC,SAAS,CAAC,QAAQ,CAAC,QAAQ,CAAC,CAAC,CAAC;QAElE,wEAAwE;QACxE,yFAAyF;QACzF,IACE,mBAAmB;YACnB,IAAI;YACJ,WAAW;YACX,CAAC,yBAAyB,EAC1B,CAAC;YACD,MAAM,cAAc,GAAG,IAAI,CAAC,4BAA4B,CACtD,IAAI,EACJ,WAAW,CACZ,CAAC;YACF,OAAO,EAAE,OAAO,EAAE,cAAc,EAAE,CAAC;QACrC,CAAC;QAED,sEAAsE;QACtE,IACE,mBAAmB;YACnB,IAAI;YACJ,WAAW;YACX,yBAAyB,EACzB,CAAC;YACD,OAAO,EAAE,UAAU,EAAE,WAAW,EAAE,CAAC;QACrC,CAAC;QAED,sEAAsE;QACtE,IAAI,kBAAkB,IAAI,WAAW,EAAE,CAAC;YACtC,OAAO,EAAE,UAAU,EAAE,WAAW,EAAE,CAAC;QACrC,CAAC;QAED,sEAAsE;QACtE,8FAA8F;QAC9F,IAAI,eAAe,IAAI,IAAI,IAAI,WAAW,EAAE,CAAC;YAC3C,IAAI,yBAAyB,EAAE,CAAC;gBAC9B,OAAO,CAAC,GAAG,CACT,sEAAsE,CACvE,CAAC;gBACF,OAAO,EAAE,UAAU,EAAE,WAAW,EAAE,CAAC;YACrC,CAAC;iBAAM,CAAC;gBACN,OAAO,CAAC,GAAG,CACT,mFAAmF,CACpF,CAAC;gBACF,MAAM,cAAc,GAAG,IAAI,CAAC,4BAA4B,CACtD,IAAI,EACJ,WAAW,CACZ,CAAC;gBACF,OAAO,EAAE,OAAO,EAAE,cAAc,EAAE,CAAC;YACrC,CAAC;QACH,CAAC;QAED,2DAA2D;QAC3D,IAAI,YAAY,EAAE,CAAC;YACjB,OAAO;gBACL,OAAO,EAAE;oBACP,OAAO,EAAE,IAAI;oBACb,IAAI;iBACL;aACF,CAAC;QACJ,CAAC;QAED,kFAAkF;QAClF,2BAA2B;QAC3B,IAAI,WAAW,EAAE,CAAC;YAChB,OAAO,EAAE,UAAU,EAAE,WAAW,EAAE,CAAC;QACrC,CAAC;QAED,wDAAwD;QACxD,qFAAqF;QACrF,OAAO,EAAE,UAAU,EAAE,IAAI,CAAC,UAAU,CAAC,eAAe,IAAI,GAAG,EAAE,CAAC;IAChE,CAAC;IAED;;OAEG;IACK,4BAA4B,CAClC,IAAU,EACV,WAAoB;QAEpB,MAAM,WAAW,GAAG,IAAI,CAAC,SAAS,CAAC,IAAI,CAAC,CAAC,OAAO,CAAC,IAAI,EAAE,KAAK,CAAC,CAAC;QAC9D,MAAM,QAAQ,GAAG,IAAI,CAAC,UAAU,CAAC,QAAQ,CAAC;QAE1C,kCAAkC;QAClC,wFAAwF;QACxF,0EAA0E;QAC1E,+EAA+E;QAC/E,MAAM,WAAW,GAAG,WAAW,IAAI,IAAI,CAAC,UAAU,CAAC,eAAe,IAAI,GAAG,CAAC;QAE1E,OAAO;;;;;;;;;qFAS0E,WAAW;YACpF,2BAA2B;;;;;;;;;;;0BAWb,WAAW;iCACJ,IAAI,CAAC,SAAS,CAAC,WAAW,CAAC;;;;;;;;;;;;4BAYhC,IAAI,CAAC,SAAS,CAAC,QAAQ,CAAC;;0BAE1B,WAAW;iCACJ,IAAI,CAAC,SAAS,CAAC,WAAW,CAAC;;;;;;;;;;;;;;;mCAezB,IAAI,CAAC,SAAS,CAAC,WAAW,CAAC;;;;;;;KAOzD,CAAC;IACJ,CAAC;IAED;;OAEG;IACK,8BAA8B,GAAG,CACvC,WAAmB,EACnB,WAAoB,EACZ,EAAE;QACV,MAAM,mBAAmB,GAAG,WAAW;YACrC,CAAC,CAAC,oBAAoB,kBAAkB,CAAC,WAAW,CAAC,EAAE;YACvD,CAAC,CAAC,EAAE,CAAC;QAEP,OAAO;;;;;;;;;;;2BAWgB,WAAW,qEAAqE,mBAAmB;;;;;;;;;;;;;;CAc7H,CAAC;IACA,CAAC,CAAC;CACH","sourcesContent":["import {\n  type OAuthTokens,\n  type User,\n  type EmptyObject,\n  type UnknownObject,\n  type OIDCTokenResponseBody,\n  tokenKeys,\n} from \"@/types.js\";\nimport type { AuthConfig } from \"@/server/config.js\";\nimport {\n  getUser as getUserFromShared,\n  getTokens as getTokensFromShared,\n} from \"@/shared/lib/session.js\";\nimport { clearTokens as clearTokensUtil } from \"@/shared/lib/util.js\";\nimport { resolveOAuthAccessCode } from \"@/server/login.js\";\nimport { buildLoginUrl } from \"@/server/login.js\";\nimport { buildLogoutRedirectUrl } from \"@/server/logout.js\";\nimport {\n  TOKEN_EXCHANGE_SUCCESS_TEXT,\n  TOKEN_EXCHANGE_TRIGGER_TEXT,\n} from \"@/constants.js\";\nimport { refreshTokens } from \"@/server/refresh.js\";\nimport { getVersion } from \"@/shared/index.js\";\nimport { ServerAuthenticationResolver } from \"@/server/ServerAuthenticationResolver.js\";\nimport {\n  DEFAULT_AUTH_SERVER,\n  JWT_PAYLOAD_KNOWN_CLAIM_KEYS,\n} from \"@/constants.js\";\nimport type { AuthenticationResolver } from \"@/services/types.js\";\nimport { displayModeFromState, loginSuccessUrlFromState } from \"@/lib/oauth.js\";\nimport { decodeJwt, type JWTPayload } from \"jose\";\nimport {\n  generateOauthLogoutUrl,\n  getBackendEndpoints,\n  resolveEndpointUrl,\n  sanitizeReturnUrl,\n} from \"@/shared/lib/util.js\";\nimport { CodeVerifier } from \"@/shared/lib/types.js\";\nimport type { CookieStorage } from \"./index.js\";\nimport { loggers } from \"@/lib/logger.js\";\n\n// Generic request interface for framework-agnostic URL detection\nexport type UrlDetectionRequest = {\n  url: string;\n  headers: Record<string, string | string[] | undefined>;\n  searchParams: {\n    get(name: string): string | null;\n  };\n  cookies: {\n    get(name: string): { value: string } | undefined;\n  };\n};\n\nexport type HandleCallbackRequest = {\n  headers: {\n    [key: string]: string | string[] | undefined;\n    referer?: string;\n    origin?: string;\n    \"user-agent\"?: string;\n    accept?: string;\n    \"sec-fetch-dest\"?: string;\n  };\n  url?: string;\n};\n\nexport type HandleCallbackParams = {\n  code: string;\n  state: string;\n  req: HandleCallbackRequest;\n};\n\n// Function to omit keys from an object\nconst omitKeys = <K extends keyof T, T extends Record<string, unknown>>(\n  keys: K[],\n  obj: T,\n): Omit<T, K> => {\n  const result = { ...obj };\n  keys.forEach((key) => {\n    delete result[key];\n  });\n  return result;\n};\n\n/**\n * Helper to detect if this is a same-domain callback request (for iframe workaround)\n */\nconst isSameDomainCallback = (req: HandleCallbackRequest): boolean => {\n  if (!req.url) return false;\n  return req.url.includes(\"sameDomainCallback=true\");\n};\n\n/**\n * Extract user information directly from OIDC tokens\n * @param tokens The OIDC tokens response\n * @returns The user object or null if no valid ID token\n */\nfunction getUserFromTokens<T extends UnknownObject = EmptyObject>(\n  tokens: OIDCTokenResponseBody,\n): User<T> | null {\n  if (!tokens.id_token) return null;\n\n  const parsedToken = decodeJwt(tokens.id_token) as JWTPayload & T;\n  if (!parsedToken.sub) return null;\n\n  // set the user ID from the token sub\n  const userWithAdditionalTokenFields = {\n    ...(parsedToken as T),\n    id: parsedToken.sub,\n  };\n\n  // Remove the token keys from the user object to stop it getting too large\n  return omitKeys(\n    [...JWT_PAYLOAD_KNOWN_CLAIM_KEYS, ...tokenKeys],\n    userWithAdditionalTokenFields,\n  ) as User<T>;\n}\n\n/**\n * CivicAuth is the main entry point for server-side authentication operations.\n * It provides a unified interface to all the authentication functions.\n */\nexport class CivicAuth {\n  _authResolver: AuthenticationResolver | null = null;\n  constructor(\n    readonly storage: CookieStorage,\n    readonly authConfig: AuthConfig,\n  ) {}\n\n  get oauthServer(): string {\n    return this.authConfig.oauthServer || DEFAULT_AUTH_SERVER;\n  }\n\n  async getAuthResolver(): Promise<AuthenticationResolver> {\n    if (this._authResolver) {\n      loggers.server.debug(\"Reusing existing auth resolver\", this.authConfig);\n      return Promise.resolve(this._authResolver);\n    }\n    loggers.server.debug(\"Creating new auth resolver\", this.authConfig);\n    this._authResolver = await ServerAuthenticationResolver.build(\n      {\n        ...this.authConfig,\n        oauthServer: this.oauthServer,\n      },\n      this.storage,\n    );\n    return this._authResolver;\n  }\n  /**\n   * Gets the authenticated user with token validation\n   * @returns The user object if authenticated, null otherwise\n   */\n  async getUser<\n    T extends UnknownObject = EmptyObject,\n  >(): Promise<User<T> | null> {\n    const resolver = await this.getAuthResolver();\n\n    try {\n      // Validate the session before returning the user\n      const session = await resolver.validateExistingSession();\n      if (!session?.authenticated) {\n        return null;\n      }\n\n      // If session is valid, use the shared implementation to get the user\n      return getUserFromShared<T>(this.storage);\n    } catch (error) {\n      console.error(\"Token validation failed during getUser\", error);\n      return null;\n    }\n  }\n\n  /**\n   * Gets the authentication tokens with token validation\n   * @returns The tokens if authenticated, null otherwise\n   */\n  async getTokens(): Promise<OAuthTokens | null> {\n    const resolver = await this.getAuthResolver();\n\n    try {\n      // Validate the session before returning the tokens\n      const session = await resolver.validateExistingSession();\n\n      if (!session?.authenticated) {\n        return null;\n      }\n\n      // If session is valid, use the shared implementation to get the tokens\n      const tokens = await getTokensFromShared(this.storage);\n      return tokens;\n    } catch (error) {\n      console.error(\"❌ Token validation failed during getTokens\", error);\n      return null;\n    }\n  }\n\n  /**\n   * Resolve an OAuth access code to a set of OIDC tokens\n   * @param code The access code from the query parameter\n   * @param state The OAuth state parameter\n   * @returns OIDC tokens\n   */\n  async resolveOAuthAccessCode(\n    code: string,\n    state: string,\n  ): Promise<OIDCTokenResponseBody> {\n    return resolveOAuthAccessCode(code, state, this.storage, this.authConfig);\n  }\n\n  /**\n   * Check if the user is currently logged in\n   * @returns true if logged in, false otherwise\n   */\n  async isLoggedIn(): Promise<boolean> {\n    const resolver = await this.getAuthResolver();\n    const session = await resolver.validateExistingSession();\n    return session?.authenticated ?? false;\n  }\n\n  /**\n   * Build a login URL to redirect the user to\n   * @param options Additional options for building the login URL\n   * @returns The login URL\n   */\n  async buildLoginUrl(options?: {\n    scopes?: string[];\n    state?: string;\n    nonce?: string;\n  }): Promise<URL> {\n    return buildLoginUrl(\n      {\n        ...this.authConfig,\n        scopes: options?.scopes,\n        state: options?.state,\n        nonce: options?.nonce,\n        framework: \"server\",\n        sdkVersion: getVersion(),\n      },\n      this.storage,\n    );\n  }\n\n  /**\n   * Build a logout URL to redirect the user to\n   * @param options Additional options for building the logout URL\n   * @returns The logout URL\n   */\n  async buildLogoutRedirectUrl(options?: {\n    scopes?: string[];\n    state?: string;\n  }): Promise<URL> {\n    // Check if this is backend integration mode (loginUrl provided)\n    if (this.authConfig.loginUrl) {\n      // Backend integration mode: redirect to backend logout endpoint\n      // This matches the vanilla client's logout logic for backend integration\n      const backendUrl = new URL(this.authConfig.loginUrl).origin;\n      const endpoints = getBackendEndpoints(this.authConfig.backendEndpoints);\n      const backendLogoutUrl = resolveEndpointUrl(backendUrl, endpoints.logout);\n\n      const logoutUrl = new URL(backendLogoutUrl);\n\n      // Include logoutRedirectUrl as query parameter if configured\n      if (this.authConfig.postLogoutRedirectUrl) {\n        logoutUrl.searchParams.set(\n          \"logoutRedirectUrl\",\n          this.authConfig.postLogoutRedirectUrl,\n        );\n      }\n\n      // Include state if provided\n      if (options?.state) {\n        logoutUrl.searchParams.set(\"state\", options.state);\n      }\n\n      return logoutUrl;\n    }\n\n    // Standard OAuth flow - redirect to OAuth provider's logout endpoint\n    try {\n      // Use the shared getTokens function directly - this bypasses session validation\n      // since for logout we just need the raw ID token, not validated tokens\n      const tokens = await getTokensFromShared(this.storage);\n\n      if (tokens?.idToken) {\n        // Ensure clientId is present for OAuth operations\n        if (!this.authConfig.clientId) {\n          throw new Error(\"clientId is required for OAuth logout operations\");\n        }\n\n        // We have access to the ID token from HTTP-only cookies\n        // Build the logout URL manually using the shared utility\n\n        const logoutUrl = await generateOauthLogoutUrl({\n          clientId: this.authConfig.clientId,\n          redirectUrl: this.authConfig.postLogoutRedirectUrl || \"/\",\n          idToken: tokens.idToken,\n          state: options?.state ?? Math.random().toString(36).substring(2),\n          oauthServer: this.oauthServer,\n        });\n\n        return logoutUrl;\n      }\n    } catch (error) {\n      // If direct token access fails, fall back to the generic function\n      console.warn(\n        \"❌ Could not get tokens directly from storage, falling back to generic logout method:\",\n        error,\n      );\n    }\n\n    // Fallback to the generic function for other storage types or when tokens aren't accessible\n    return buildLogoutRedirectUrl(\n      {\n        ...this.authConfig,\n        scopes: options?.scopes,\n        state: options?.state,\n      },\n      this.storage,\n    );\n  }\n\n  /**\n   * Refresh the current set of OIDC tokens\n   * @returns The refreshed tokens or null for backend flows where tokens are managed in HTTP-only cookies\n   */\n  async refreshTokens(): Promise<OIDCTokenResponseBody | null> {\n    return refreshTokens(this.storage, this.authConfig);\n  }\n\n  /**\n   * Clear all authentication tokens from storage\n   */\n  async clearTokens(): Promise<void> {\n    return clearTokensUtil(this.storage);\n  }\n\n  /**\n   * Framework-agnostic URL detection and resolution helpers\n   * These methods handle proxy environments and can be used by any framework\n   */\n\n  /**\n   * Try to URI decode a value, returning the original value on error\n   */\n  static tryUriDecode(value: string): string {\n    try {\n      return decodeURIComponent(value);\n    } catch (e) {\n      console.error(\"Error decoding URI component:\", e);\n      return value;\n    }\n  }\n\n  /**\n   * Get decoded query parameter from request\n   */\n  static getDecodedQueryParam(\n    request: UrlDetectionRequest,\n    paramName: string,\n  ): string | null {\n    const queryParam = request.searchParams.get(paramName);\n    if (queryParam) {\n      return CivicAuth.tryUriDecode(queryParam);\n    }\n    return null;\n  }\n\n  /**\n   * Get value from cookie or query parameter (cookie takes precedence)\n   */\n  static getCookieOrQueryParam(\n    request: UrlDetectionRequest,\n    cookieName: string,\n    queryName: string,\n  ): string | null {\n    // First check the cookie as it might have the full path with base directory\n    const cookieValue = request.cookies.get(cookieName)?.value;\n    if (cookieValue) {\n      return CivicAuth.tryUriDecode(cookieValue);\n    }\n\n    // Fallback to query parameter\n    return CivicAuth.getDecodedQueryParam(request, queryName);\n  }\n\n  /**\n   * Get app URL from request (for proxy environment support)\n   * Checks cookies first, then query parameters\n   */\n  static getAppUrl(request: UrlDetectionRequest): string | null {\n    return CivicAuth.getCookieOrQueryParam(\n      request,\n      CodeVerifier.APP_URL,\n      \"appUrl\",\n    );\n  }\n\n  /**\n   * Get login success URL with proper base URL handling\n   * Extracts from state parameter or query parameters, resolves with baseUrl if provided\n   */\n  static getLoginSuccessUrl(\n    request: UrlDetectionRequest,\n    baseUrl?: string | null,\n  ): string | null {\n    const state = request.searchParams.get(\"state\");\n    const loginSuccessUrl =\n      loginSuccessUrlFromState(state) ||\n      CivicAuth.getDecodedQueryParam(request, \"loginSuccessUrl\");\n\n    if (!loginSuccessUrl) {\n      return null;\n    }\n\n    return baseUrl ? new URL(loginSuccessUrl, baseUrl).href : loginSuccessUrl;\n  }\n\n  /**\n   * Convert relative URL to absolute URL using appUrl for proxy environments\n   */\n  static toAbsoluteUrl(\n    request: UrlDetectionRequest,\n    url: string,\n    appUrl?: string | null,\n  ): string {\n    if (url.startsWith(\"http\")) {\n      return url;\n    }\n\n    // Use appUrl if available (for proxy environments), otherwise fall back to request origin\n    const baseUrl = appUrl || new URL(request.url).origin;\n    return new URL(url, baseUrl).href;\n  }\n\n  /**\n   * Get post-logout redirect URL with proxy environment support\n   */\n  getPostLogoutRedirectUrl(request: UrlDetectionRequest): string {\n    // Check if we have a target URL in the request (from middleware)\n    const targetUrl = request.searchParams.get(\"targetUrl\");\n    if (targetUrl) {\n      return targetUrl;\n    }\n\n    const redirectTarget = this.authConfig.loginSuccessUrl ?? \"/\";\n\n    // If loginSuccessUrl is absolute, use it as-is\n    const isAbsoluteRedirect = /^(https?:\\/\\/|www\\.).+/i.test(redirectTarget);\n    if (isAbsoluteRedirect) {\n      return redirectTarget;\n    }\n\n    // Use appUrl from client for proxy environments\n    const appUrl = CivicAuth.getAppUrl(request);\n    if (appUrl) {\n      return new URL(redirectTarget, appUrl).href;\n    }\n\n    // Fallback to request origin\n    return new URL(request.url).origin;\n  }\n\n  /**\n   * Smart callback handler that automatically detects frontend vs backend requests\n   * and redirects appropriately. Use this instead of resolveOAuthAccessCode + manual redirect.\n   *\n   * @param params An object containing the authorization code, state, and the incoming request.\n   * @param params.code The authorization code from query parameters.\n   * @param params.state The OAuth state parameter.\n   * @param params.req The incoming request object (e.g., from Express).\n   * @param options Configuration options (frontendUrl override, apiResponse flag).\n   * @returns Object with redirect information or HTML content for iframe completion.\n   *\n   * @example\n   * ```javascript\n   * app.get('/auth/callback', async (req, res) => {\n   *   const { code, state } = req.query;\n   *   // The request object 'req' is passed directly\n   *   const result = await req.civicAuth.handleCallback({ code, state, req });\n   *\n   *   if (result.htmlContent) {\n   *     res.setHeader('Content-Type', 'text/html');\n   *     res.send(result.htmlContent);\n   *   } else if (result.redirectTo) {\n   *     res.redirect(result.redirectTo);\n   *   } else {\n   *     res.json({ success: true, user: result.user });\n   *   }\n   * });\n   * ```\n   */\n  async handleCallback(\n    { code, state, req }: HandleCallbackParams,\n    options?: {\n      frontendUrl?: string;\n      apiResponse?: boolean;\n    },\n  ): Promise<{\n    redirectTo?: string;\n    content?: string | { success: boolean; user?: User | null };\n  }> {\n    // Handle same-domain callback for iframe workaround\n    if (isSameDomainCallback(req)) {\n      try {\n        // Check if user is already authenticated before attempting token exchange\n        const isAlreadyLoggedIn = await this.isLoggedIn();\n        let user: User | null = null;\n\n        if (isAlreadyLoggedIn) {\n          // User is already authenticated, get existing user data\n          user = await this.getUser();\n          console.log(\n            \"User already authenticated in same-domain callback:\",\n            !!user,\n          );\n        } else {\n          // For same-domain callbacks, we should have access to cookies\n          const tokens = await this.resolveOAuthAccessCode(code, state);\n          user = getUserFromTokens(tokens);\n          console.log(\n            \"Completed token exchange in same-domain callback:\",\n            !!user,\n          );\n        }\n\n        // Return JSON response for same-domain callback\n        const currentUrl = new URL(req.url || \"\");\n\n        // Extract and sanitize loginSuccessUrl (deep link) BEFORE cleaning up search params\n        // Sanitization prevents open redirect attacks via malicious URLs in the query param\n        const rawLoginSuccessUrl =\n          currentUrl.searchParams.get(\"loginSuccessUrl\");\n        const loginSuccessUrl = rawLoginSuccessUrl\n          ? sanitizeReturnUrl(rawLoginSuccessUrl, currentUrl.origin)\n          : null;\n\n        const newSearchParams = new URLSearchParams(currentUrl.search);\n        newSearchParams.delete(\"sameDomainCallback\");\n        newSearchParams.delete(\"appUrl\");\n        newSearchParams.delete(\"loginSuccessUrl\");\n\n        // Use preserved deep link if available and valid, otherwise fall back to loginSuccessUrl or \"/\"\n        // Note: Do NOT fall back to currentUrl.pathname as that's the callback URL, which would cause a loop\n        const redirectUrl =\n          loginSuccessUrl || this.authConfig.loginSuccessUrl || \"/\";\n        return {\n          content: {\n            success: true,\n            redirectUrl,\n          } as { success: boolean; redirectUrl: string },\n        };\n      } catch (error) {\n        console.error(\"Same-domain callback failed:\", error);\n        throw error;\n      }\n    }\n\n    // Try to resolve the OAuth code and create session\n    let tokens: OIDCTokenResponseBody;\n    let user: User | null;\n\n    try {\n      tokens = await this.resolveOAuthAccessCode(code, state);\n      user = getUserFromTokens(tokens);\n    } catch (error) {\n      // Check if this is a code verifier error and we're in iframe mode\n      const isCodeVerifierError =\n        error instanceof Error &&\n        error.message.includes(\"Code verifier not found in storage\");\n\n      if (isCodeVerifierError) {\n        // First check if user is already authenticated before trying iframe workaround\n        try {\n          const isAlreadyLoggedIn = await this.isLoggedIn();\n\n          if (isAlreadyLoggedIn) {\n            // \"User already authenticated, skipping iframe workaround\",\n            const user = await this.getUser();\n            const loginSuccessUrlFromStateValue =\n              loginSuccessUrlFromState(state);\n            const frontendUrl =\n              options?.frontendUrl ||\n              loginSuccessUrlFromStateValue ||\n              this.authConfig.loginSuccessUrl;\n\n            // Check if this is an iframe context - if so, generate iframe completion HTML\n            const stateDisplayMode = displayModeFromState(state, undefined);\n            const isConfiguredForIframe = stateDisplayMode === \"iframe\";\n\n            if (\n              isConfiguredForIframe &&\n              !this.authConfig.disableIframeDetection &&\n              user &&\n              frontendUrl\n            ) {\n              // Generating iframe completion HTML for already authenticated user\",\n              const completionHtml = this.generateIframeCompletionHtml(\n                user,\n                frontendUrl,\n              );\n              return { content: completionHtml };\n            }\n\n            if (frontendUrl) {\n              return { redirectTo: frontendUrl };\n            } else {\n              // Return JSON when no redirect destination is available.\n              // This is intentional for API-style callbacks and cross-origin scenarios\n              // where cookies aren't accessible to read config. The JSON response allows\n              // clients (e.g., vanilla JS SDK) to handle the success case programmatically.\n              return { content: { success: true, user } };\n            }\n          }\n        } catch (authCheckError) {\n          console.warn(\n            \"Failed to check authentication status:\",\n            authCheckError,\n          );\n          // Continue with iframe workaround if auth check fails\n        }\n\n        const stateDisplayMode = displayModeFromState(state, undefined);\n        const isConfiguredForIframe = stateDisplayMode === \"iframe\";\n\n        if (isConfiguredForIframe && !this.authConfig.disableIframeDetection) {\n          // Generate HTML that will trigger same-domain callback\n          const loginSuccessUrlFromStateValue = loginSuccessUrlFromState(state);\n          const frontendUrl =\n            options?.frontendUrl ||\n            loginSuccessUrlFromStateValue ||\n            this.authConfig.loginSuccessUrl;\n\n          const callbackUrl = req.url || \"\";\n          const sameDomainHtml = this.generateSameDomainCallbackHtml(\n            callbackUrl,\n            frontendUrl,\n          );\n          return { content: sameDomainHtml };\n        }\n\n        // For non-iframe mode or when iframe detection is disabled, return trigger text\n        return {\n          content: `<html lang=\"en\"><body><span style=\"display:none\">${TOKEN_EXCHANGE_TRIGGER_TEXT}</span></body></html>`,\n        };\n      }\n\n      // Re-throw other errors\n      throw error;\n    }\n\n    // Extract loginSuccessUrl from state if present\n    const loginSuccessUrlFromStateValue = loginSuccessUrlFromState(state);\n\n    // Priority: options.frontendUrl > loginSuccessUrl from state > config loginSuccessUrl\n    const frontendUrl =\n      options?.frontendUrl ||\n      loginSuccessUrlFromStateValue ||\n      this.authConfig.loginSuccessUrl;\n\n    // Priority 1: Check state for display mode configuration\n    const stateDisplayMode = displayModeFromState(state, undefined);\n    const isConfiguredForIframe = stateDisplayMode === \"iframe\";\n\n    // Determine if this should be treated as an iframe request\n    // Configuration (from state) takes precedence over auto-detection\n    const shouldTreatAsIframe =\n      isConfiguredForIframe && !this.authConfig.disableIframeDetection;\n\n    const isTopLevelRedirect = req.headers[\"sec-fetch-dest\"] === \"document\";\n    const isIframeRequest = req.headers[\"sec-fetch-dest\"] === \"iframe\";\n    const isApiRequest =\n      options?.apiResponse || req.headers.accept?.includes(\"application/json\");\n\n    // Detect Safari or other browsers where iframe postMessage may fail due to cross-origin restrictions\n    //TODO: Find a better way to detect this\n    const userAgent = req.headers[\"user-agent\"] || \"\";\n    const isSafari =\n      userAgent.includes(\"Safari\") && !userAgent.includes(\"Chrome\");\n    const isLikelyCrossOriginIframe =\n      isSafari ||\n      (userAgent.includes(\"WebKit\") && !userAgent.includes(\"Chrome\"));\n\n    // Case 1: The request should be treated as iframe. Return HTML content.\n    // Unless iframe detection is disabled via configuration OR we detect cross-origin issues\n    if (\n      shouldTreatAsIframe &&\n      user &&\n      frontendUrl &&\n      !isLikelyCrossOriginIframe\n    ) {\n      const completionHtml = this.generateIframeCompletionHtml(\n        user,\n        frontendUrl,\n      );\n      return { content: completionHtml };\n    }\n\n    // Case 1b: Safari/cross-origin iframe case - redirect instead of HTML\n    if (\n      shouldTreatAsIframe &&\n      user &&\n      frontendUrl &&\n      isLikelyCrossOriginIframe\n    ) {\n      return { redirectTo: frontendUrl };\n    }\n\n    // Case 2: The request is a top-level navigation. Return redirect URL.\n    if (isTopLevelRedirect && frontendUrl) {\n      return { redirectTo: frontendUrl };\n    }\n\n    // Case 2a: The request is from an iframe (detected by sec-fetch-dest)\n    // Even if not configured for iframe in state, we should still generate iframe completion HTML\n    if (isIframeRequest && user && frontendUrl) {\n      if (isLikelyCrossOriginIframe) {\n        console.log(\n          \"Iframe request detected but cross-origin issues likely - redirecting\",\n        );\n        return { redirectTo: frontendUrl };\n      } else {\n        console.log(\n          \"Generating iframe completion HTML for iframe request (detected by sec-fetch-dest)\",\n        );\n        const completionHtml = this.generateIframeCompletionHtml(\n          user,\n          frontendUrl,\n        );\n        return { content: completionHtml };\n      }\n    }\n\n    // Case 3: The request is an API call. Return JSON content.\n    if (isApiRequest) {\n      return {\n        content: {\n          success: true,\n          user,\n        },\n      };\n    }\n\n    // Fallback for older browsers or other contexts: if a frontend URL is configured,\n    // assume a redirect to it.\n    if (frontendUrl) {\n      return { redirectTo: frontendUrl };\n    }\n\n    // Absolute fallback: redirect to loginSuccessUrl or \"/\"\n    // Never return JSON for browser navigation - that would display raw JSON to the user\n    return { redirectTo: this.authConfig.loginSuccessUrl || \"/\" };\n  }\n\n  /**\n   * Generate HTML content for iframe completion that sends postMessage to parent\n   */\n  private generateIframeCompletionHtml(\n    user: User,\n    frontendUrl?: string,\n  ): string {\n    const escapedUser = JSON.stringify(user).replace(/'/g, \"\\\\'\");\n    const clientId = this.authConfig.clientId;\n\n    // Determine fallback redirect URL\n    // Note: redirectUrl is the OAuth callback URL - it should NEVER be used as a post-login\n    // destination as it would cause an infinite redirect loop in iframe mode.\n    // postLogoutRedirectUrl is semantically incorrect for login success scenarios.\n    const fallbackUrl = frontendUrl || this.authConfig.loginSuccessUrl || \"/\";\n\n    return `\n      <!DOCTYPE html>\n      <html>\n      <head>\n        <title>Authentication Complete</title>\n        <meta charset=\"utf-8\">\n      </head>\n      <body>        \n        <!-- Success signal for SignalObserver -->\n        <div id=\"civic-auth-success-signal\" style=\"display: none;\" data-user-info='${escapedUser}'>\n          ${TOKEN_EXCHANGE_SUCCESS_TEXT}\n        </div>\n        \n        <script>\n          // Send postMessage to parent to resolve authentication promise\n          if (window.parent && window.parent !== window) {\n            try {\n              window.parent.postMessage({\n                type: 'auth_success',\n                detail: 'Authentication successful',\n                data: {\n                  user: ${escapedUser},\n                  redirectUrl: ${JSON.stringify(fallbackUrl)}\n                }\n              }, '*');\n            } catch (error) {\n              console.error('❌ Failed to send postMessage:', error);\n            }\n\n            // Also send civicloginApp format message for compatibility\n            try {\n              window.parent.postMessage({\n                source: 'civicloginApp',\n                type: 'auth_success',\n                clientId: ${JSON.stringify(clientId)},\n                data: {\n                  user: ${escapedUser},\n                  redirectUrl: ${JSON.stringify(fallbackUrl)}\n                }\n              }, '*');\n            } catch (error) {\n              console.error('❌ Failed to send civicloginApp message:', error);\n            }\n          } else {\n            console.log('❌ Not in iframe context or no parent window');\n          }\n          \n          // Fallback redirect after 500ms delay to handle cases where:\n          // 1. postMessage fails or parent doesn't respond\n          // 2. Not in iframe context\n          // 3. Any other edge cases where the user gets stuck\n          setTimeout(function() {\n            var redirectTarget = ${JSON.stringify(fallbackUrl)};\n            console.log('🔄 Executing fallback redirect to:', redirectTarget);\n            window.location.href = redirectTarget;\n          }, 500);\n        </script>\n      </body>\n      </html>\n    `;\n  }\n\n  /**\n   * Generate HTML response that triggers same-domain callback for iframe workaround\n   */\n  private generateSameDomainCallbackHtml = (\n    callbackUrl: string,\n    frontendUrl?: string,\n  ): string => {\n    const loginSuccessSegment = frontendUrl\n      ? `&loginSuccessUrl=${encodeURIComponent(frontendUrl)}`\n      : \"\";\n\n    return `<html lang=\"en\">\n  <body>\n      <span style=\"display:none\">\n          <script>\n              window.onload = function () {\n                  // Get the complete URL including origin and path\n                  // This ensures we capture any base path like /directory\n                  const appUrl = window.location.href.substring(\n                    0,\n                    window.location.href.indexOf(\"/api/auth\")\n                  );\n                  fetch('${callbackUrl}&sameDomainCallback=true&appUrl=' + encodeURIComponent(appUrl) + '${loginSuccessSegment}').then((response) => {\n                      response.json().then((jsonResponse) => {\n                        // For login: Redirect back to the callback route, so Case 2 in handleTokenExchangeComplete will be triggered\n                        // For logout: Redirect to the postLogoutRedirectUrl\n                        if(jsonResponse.redirectUrl) {\n                          window.location.href = jsonResponse.redirectUrl;\n                        }\n                      });\n                  });\n              };\n          </script>\n      </span>\n  </body>\n</html>\n`;\n  };\n}\n"]}

package/dist/shared/version.d.ts

@@ -1,2 +1,2 @@
-export declare const VERSION = "@civic/auth:0.13.0-beta.0";
+export declare const VERSION = "@civic/auth:0.13.0-beta.2";
 //# sourceMappingURL=version.d.ts.map

package/dist/shared/version.js

@@ -1,3 +1,3 @@
 // This is an auto-generated file. Do not edit.
-export const VERSION = "@civic/auth:0.13.0-beta.0";
+export const VERSION = "@civic/auth:0.13.0-beta.2";
 //# sourceMappingURL=version.js.map

package/dist/shared/version.js.map

@@ -1 +1 @@
-{"version":3,"file":"version.js","sourceRoot":"","sources":["../../src/shared/version.ts"],"names":[],"mappings":"AAAA,+CAA+C;AAE/C,MAAM,CAAC,MAAM,OAAO,GAAG,2BAA2B,CAAC","sourcesContent":["// This is an auto-generated file. Do not edit.\n\nexport const VERSION = \"@civic/auth:0.13.0-beta.0\";\n"]}
+{"version":3,"file":"version.js","sourceRoot":"","sources":["../../src/shared/version.ts"],"names":[],"mappings":"AAAA,+CAA+C;AAE/C,MAAM,CAAC,MAAM,OAAO,GAAG,2BAA2B,CAAC","sourcesContent":["// This is an auto-generated file. Do not edit.\n\nexport const VERSION = \"@civic/auth:0.13.0-beta.2\";\n"]}

package/package.json

@@ -1,6 +1,6 @@
 {
   "name": "@civic/auth",
-  "version": "0.13.0-beta.0",
+  "version": "0.13.0-beta.2",
   "type": "module",
   "main": "./dist/index.js",
   "module": "./dist/index.js",