@civic/auth 0.3.6 → 0.3.8-beta.0

package/dist/cjs/nextjs/GetUser.js

@@ -0,0 +1,11 @@
+"use strict";
+Object.defineProperty(exports, "__esModule", { value: true });
+exports.getUser = void 0;
+const cookies_js_1 = require("../nextjs/cookies.js");
+const session_js_1 = require("../shared/lib/session.js");
+const getUser = async () => {
+    const clientStorage = new cookies_js_1.NextjsClientStorage();
+    return (0, session_js_1.getUser)(clientStorage);
+};
+exports.getUser = getUser;
+//# sourceMappingURL=GetUser.js.map

package/dist/cjs/nextjs/GetUser.js.map

@@ -0,0 +1 @@
+{"version":3,"file":"GetUser.js","sourceRoot":"","sources":["../../../src/nextjs/GetUser.ts"],"names":[],"mappings":";;;AAIA,oDAA0D;AAC1D,wDAAoE;AAE7D,MAAM,OAAO,GAAG,KAAK,IAA0B,EAAE;IACtD,MAAM,aAAa,GAAG,IAAI,gCAAmB,EAAE,CAAC;IAChD,OAAO,IAAA,oBAAc,EAAC,aAAa,CAAC,CAAC;AACvC,CAAC,CAAC;AAHW,QAAA,OAAO,WAGlB","sourcesContent":["/**\n * Used on the server-side to get the user object from the cookie\n */\nimport type { User } from \"@/types.js\";\nimport { NextjsClientStorage } from \"@/nextjs/cookies.js\";\nimport { getUser as getSessionUser } from \"@/shared/lib/session.js\";\n\nexport const getUser = async (): Promise<User | null> => {\n  const clientStorage = new NextjsClientStorage();\n  return getSessionUser(clientStorage);\n};\n"]}

package/dist/cjs/nextjs/NextAuthenticationRefresherImpl.d.ts

@@ -0,0 +1,11 @@
+import { AuthenticationRefresherImpl } from "../shared/lib/AuthenticationRefresherImpl.js";
+import type { Endpoints, OIDCTokenResponseBody } from "../types.js";
+import type { AuthConfig } from "../server/config.js";
+import type { CookieStorage } from "../server/index.js";
+export declare class NextAuthenticationRefresherImpl extends AuthenticationRefresherImpl {
+    endpointOverrides?: Partial<Endpoints> | undefined;
+    storage: CookieStorage | undefined;
+    constructor(authConfig: AuthConfig, storage: CookieStorage, endpointOverrides?: Partial<Endpoints> | undefined);
+    storeTokens(tokenResponseBody: OIDCTokenResponseBody): Promise<void>;
+}
+//# sourceMappingURL=NextAuthenticationRefresherImpl.d.ts.map

package/dist/cjs/nextjs/NextAuthenticationRefresherImpl.d.ts.map

@@ -0,0 +1 @@
+{"version":3,"file":"NextAuthenticationRefresherImpl.d.ts","sourceRoot":"","sources":["../../../src/nextjs/NextAuthenticationRefresherImpl.ts"],"names":[],"mappings":"AAAA,OAAO,EAAE,2BAA2B,EAAE,MAAM,6CAA6C,CAAC;AAC1F,OAAO,KAAK,EAAe,SAAS,EAAE,qBAAqB,EAAE,MAAM,YAAY,CAAC;AAChF,OAAO,KAAK,EAAE,UAAU,EAAE,MAAM,oBAAoB,CAAC;AAErD,OAAO,KAAK,EAAE,aAAa,EAAE,MAAM,mBAAmB,CAAC;AAEvD,qBAAa,+BAAgC,SAAQ,2BAA2B;IAKnE,iBAAiB,CAAC,EAAE,OAAO,CAAC,SAAS,CAAC;IAJxC,OAAO,EAAE,aAAa,GAAG,SAAS,CAAC;gBAE1C,UAAU,EAAE,UAAU,EACtB,OAAO,EAAE,aAAa,EACb,iBAAiB,CAAC,EAAE,OAAO,CAAC,SAAS,CAAC,YAAA;IAMlC,WAAW,CACxB,iBAAiB,EAAE,qBAAqB,GACvC,OAAO,CAAC,IAAI,CAAC;CAIjB"}

package/dist/cjs/nextjs/NextAuthenticationRefresherImpl.js

@@ -0,0 +1,21 @@
+"use strict";
+Object.defineProperty(exports, "__esModule", { value: true });
+exports.NextAuthenticationRefresherImpl = void 0;
+const AuthenticationRefresherImpl_js_1 = require("../shared/lib/AuthenticationRefresherImpl.js");
+const util_js_1 = require("../shared/lib/util.js");
+class NextAuthenticationRefresherImpl extends AuthenticationRefresherImpl_js_1.AuthenticationRefresherImpl {
+    endpointOverrides;
+    storage;
+    constructor(authConfig, storage, endpointOverrides) {
+        super(authConfig, storage, endpointOverrides);
+        this.endpointOverrides = endpointOverrides;
+        this.storage = storage;
+    }
+    async storeTokens(tokenResponseBody) {
+        if (!this.storage)
+            throw new Error("No storage available");
+        await (0, util_js_1.storeServerTokens)(this.storage, tokenResponseBody);
+    }
+}
+exports.NextAuthenticationRefresherImpl = NextAuthenticationRefresherImpl;
+//# sourceMappingURL=NextAuthenticationRefresherImpl.js.map

package/dist/cjs/nextjs/NextAuthenticationRefresherImpl.js.map

@@ -0,0 +1 @@
+{"version":3,"file":"NextAuthenticationRefresherImpl.js","sourceRoot":"","sources":["../../../src/nextjs/NextAuthenticationRefresherImpl.ts"],"names":[],"mappings":";;;AAAA,gGAA0F;AAG1F,kDAAsE;AAGtE,MAAa,+BAAgC,SAAQ,4DAA2B;IAKnE;IAJF,OAAO,CAA4B;IAC5C,YACE,UAAsB,EACtB,OAAsB,EACb,iBAAsC;QAE/C,KAAK,CAAC,UAAU,EAAE,OAAO,EAAE,iBAAiB,CAAC,CAAC;QAFrC,sBAAiB,GAAjB,iBAAiB,CAAqB;QAG/C,IAAI,CAAC,OAAO,GAAG,OAAO,CAAC;IACzB,CAAC;IAEQ,KAAK,CAAC,WAAW,CACxB,iBAAwC;QAExC,IAAI,CAAC,IAAI,CAAC,OAAO;YAAE,MAAM,IAAI,KAAK,CAAC,sBAAsB,CAAC,CAAC;QAC3D,MAAM,IAAA,2BAAiB,EAAC,IAAI,CAAC,OAAO,EAAE,iBAAiB,CAAC,CAAC;IAC3D,CAAC;CACF;AAjBD,0EAiBC","sourcesContent":["import { AuthenticationRefresherImpl } from \"@/shared/lib/AuthenticationRefresherImpl.js\";\nimport type { AuthStorage, Endpoints, OIDCTokenResponseBody } from \"@/types.js\";\nimport type { AuthConfig } from \"@/server/config.js\";\nimport { storeServerTokens, storeTokens } from \"@/shared/lib/util.js\";\nimport type { CookieStorage } from \"@/server/index.js\";\n\nexport class NextAuthenticationRefresherImpl extends AuthenticationRefresherImpl {\n  override storage: CookieStorage | undefined;\n  constructor(\n    authConfig: AuthConfig,\n    storage: CookieStorage,\n    override endpointOverrides?: Partial<Endpoints>,\n  ) {\n    super(authConfig, storage, endpointOverrides);\n    this.storage = storage;\n  }\n\n  override async storeTokens(\n    tokenResponseBody: OIDCTokenResponseBody,\n  ): Promise<void> {\n    if (!this.storage) throw new Error(\"No storage available\");\n    await storeServerTokens(this.storage, tokenResponseBody);\n  }\n}\n\n"]}

package/dist/cjs/nextjs/NextClientAuthenticationRefresher.d.ts

@@ -0,0 +1,8 @@
+import type { AuthConfig } from "../server/config.js";
+import type { AuthStorage, OIDCTokenResponseBody } from "../types.js";
+import { BrowserAuthenticationRefresher } from "../shared/lib/BrowserAuthenticationRefresher.js";
+export declare class NextClientAuthenticationRefresher extends BrowserAuthenticationRefresher {
+    static build(authConfig: AuthConfig, storage: AuthStorage, onError: (error: Error) => Promise<void>): Promise<NextClientAuthenticationRefresher>;
+    refreshAccessToken(): Promise<OIDCTokenResponseBody>;
+}
+//# sourceMappingURL=NextClientAuthenticationRefresher.d.ts.map

package/dist/cjs/nextjs/NextClientAuthenticationRefresher.d.ts.map

@@ -0,0 +1 @@
+{"version":3,"file":"NextClientAuthenticationRefresher.d.ts","sourceRoot":"","sources":["../../../src/nextjs/NextClientAuthenticationRefresher.ts"],"names":[],"mappings":"AAAA,OAAO,KAAK,EAAE,UAAU,EAAE,MAAM,oBAAoB,CAAC;AACrD,OAAO,KAAK,EAAE,WAAW,EAAE,qBAAqB,EAAE,MAAM,YAAY,CAAC;AACrE,OAAO,EAAE,8BAA8B,EAAE,MAAM,gDAAgD,CAAC;AAEhG,qBAAa,iCAAkC,SAAQ,8BAA8B;WAC7D,KAAK,CACzB,UAAU,EAAE,UAAU,EACtB,OAAO,EAAE,WAAW,EACpB,OAAO,EAAE,CAAC,KAAK,EAAE,KAAK,KAAK,OAAO,CAAC,IAAI,CAAC,GACvC,OAAO,CAAC,iCAAiC,CAAC;IAS9B,kBAAkB,IAAI,OAAO,CAAC,qBAAqB,CAAC;CAkBpE"}

package/dist/cjs/nextjs/NextClientAuthenticationRefresher.js

@@ -0,0 +1,28 @@
+"use strict";
+Object.defineProperty(exports, "__esModule", { value: true });
+exports.NextClientAuthenticationRefresher = void 0;
+const BrowserAuthenticationRefresher_js_1 = require("../shared/lib/BrowserAuthenticationRefresher.js");
+class NextClientAuthenticationRefresher extends BrowserAuthenticationRefresher_js_1.BrowserAuthenticationRefresher {
+    static async build(authConfig, storage, onError) {
+        const refresher = new NextClientAuthenticationRefresher(authConfig, storage, onError);
+        return refresher;
+    }
+    async refreshAccessToken() {
+        if (!this.authConfig)
+            throw new Error("No auth config available");
+        if (!this.authConfig.refreshUrl)
+            throw new Error("No refresh URL available");
+        try {
+            const res = await fetch(`${this.authConfig?.refreshUrl}`);
+            const json = await res.json();
+            return json.tokens;
+        }
+        catch (error) {
+            console.error("NextClientAuthenticationRefresher refreshAccessToken: Failed to refresh tokens:", error);
+            this.onError(error);
+            throw error;
+        }
+    }
+}
+exports.NextClientAuthenticationRefresher = NextClientAuthenticationRefresher;
+//# sourceMappingURL=NextClientAuthenticationRefresher.js.map

package/dist/cjs/nextjs/NextClientAuthenticationRefresher.js.map

@@ -0,0 +1 @@
+{"version":3,"file":"NextClientAuthenticationRefresher.js","sourceRoot":"","sources":["../../../src/nextjs/NextClientAuthenticationRefresher.ts"],"names":[],"mappings":";;;AAEA,sGAAgG;AAEhG,MAAa,iCAAkC,SAAQ,kEAA8B;IACnF,MAAM,CAAU,KAAK,CAAC,KAAK,CACzB,UAAsB,EACtB,OAAoB,EACpB,OAAwC;QAExC,MAAM,SAAS,GAAG,IAAI,iCAAiC,CACrD,UAAU,EACV,OAAO,EACP,OAAO,CACR,CAAC;QACF,OAAO,SAAS,CAAC;IACnB,CAAC;IAEQ,KAAK,CAAC,kBAAkB;QAC/B,IAAI,CAAC,IAAI,CAAC,UAAU;YAAE,MAAM,IAAI,KAAK,CAAC,0BAA0B,CAAC,CAAC;QAClE,IAAI,CAAC,IAAI,CAAC,UAAU,CAAC,UAAU;YAC7B,MAAM,IAAI,KAAK,CAAC,0BAA0B,CAAC,CAAC;QAE9C,IAAI,CAAC;YACH,MAAM,GAAG,GAAG,MAAM,KAAK,CAAC,GAAG,IAAI,CAAC,UAAU,EAAE,UAAU,EAAE,CAAC,CAAC;YAC1D,MAAM,IAAI,GAAG,MAAM,GAAG,CAAC,IAAI,EAAE,CAAC;YAC9B,OAAO,IAAI,CAAC,MAA+B,CAAC;QAC9C,CAAC;QAAC,OAAO,KAAK,EAAE,CAAC;YACf,OAAO,CAAC,KAAK,CACX,iFAAiF,EACjF,KAAK,CACN,CAAC;YACF,IAAI,CAAC,OAAO,CAAC,KAAc,CAAC,CAAC;YAC7B,MAAM,KAAK,CAAC;QACd,CAAC;IACH,CAAC;CACF;AAhCD,8EAgCC","sourcesContent":["import type { AuthConfig } from \"@/server/config.js\";\nimport type { AuthStorage, OIDCTokenResponseBody } from \"@/types.js\";\nimport { BrowserAuthenticationRefresher } from \"@/shared/lib/BrowserAuthenticationRefresher.js\";\n\nexport class NextClientAuthenticationRefresher extends BrowserAuthenticationRefresher {\n  static override async build(\n    authConfig: AuthConfig,\n    storage: AuthStorage,\n    onError: (error: Error) => Promise<void>,\n  ): Promise<NextClientAuthenticationRefresher> {\n    const refresher = new NextClientAuthenticationRefresher(\n      authConfig,\n      storage,\n      onError,\n    );\n    return refresher;\n  }\n\n  override async refreshAccessToken(): Promise<OIDCTokenResponseBody> {\n    if (!this.authConfig) throw new Error(\"No auth config available\");\n    if (!this.authConfig.refreshUrl)\n      throw new Error(\"No refresh URL available\");\n\n    try {\n      const res = await fetch(`${this.authConfig?.refreshUrl}`);\n      const json = await res.json();\n      return json.tokens as OIDCTokenResponseBody;\n    } catch (error) {\n      console.error(\n        \"NextClientAuthenticationRefresher refreshAccessToken: Failed to refresh tokens:\",\n        error,\n      );\n      this.onError(error as Error);\n      throw error;\n    }\n  }\n}\n"]}

package/dist/cjs/nextjs/NextServerAuthenticationRefresherImpl.d.ts

@@ -0,0 +1,12 @@
+import { AuthenticationRefresherImpl } from "../shared/lib/AuthenticationRefresherImpl.js";
+import type { Endpoints, OIDCTokenResponseBody } from "../types.js";
+import type { AuthConfig } from "../server/config.js";
+import type { CookieStorage } from "../server/index.js";
+export declare class NextServerAuthenticationRefresherImpl extends AuthenticationRefresherImpl {
+    endpointOverrides?: Partial<Endpoints> | undefined;
+    storage: CookieStorage | undefined;
+    constructor(authConfig: AuthConfig, storage: CookieStorage, onError: (error: Error) => Promise<void>, endpointOverrides?: Partial<Endpoints> | undefined);
+    storeTokens(tokenResponseBody: OIDCTokenResponseBody): Promise<void>;
+    static build(authConfig: AuthConfig, storage: CookieStorage, onError: (error: Error) => Promise<void>, endpointOverrides?: Partial<Endpoints>): Promise<NextServerAuthenticationRefresherImpl>;
+}
+//# sourceMappingURL=NextServerAuthenticationRefresherImpl.d.ts.map

package/dist/cjs/nextjs/NextServerAuthenticationRefresherImpl.d.ts.map

@@ -0,0 +1 @@
+{"version":3,"file":"NextServerAuthenticationRefresherImpl.d.ts","sourceRoot":"","sources":["../../../src/nextjs/NextServerAuthenticationRefresherImpl.ts"],"names":[],"mappings":"AAAA,OAAO,EAAE,2BAA2B,EAAE,MAAM,6CAA6C,CAAC;AAC1F,OAAO,KAAK,EAAE,SAAS,EAAE,qBAAqB,EAAE,MAAM,YAAY,CAAC;AACnE,OAAO,KAAK,EAAE,UAAU,EAAE,MAAM,oBAAoB,CAAC;AAErD,OAAO,KAAK,EAAE,aAAa,EAAE,MAAM,mBAAmB,CAAC;AAEvD,qBAAa,qCAAsC,SAAQ,2BAA2B;IAMzE,iBAAiB,CAAC,EAAE,OAAO,CAAC,SAAS,CAAC;IALxC,OAAO,EAAE,aAAa,GAAG,SAAS,CAAC;gBAE1C,UAAU,EAAE,UAAU,EACtB,OAAO,EAAE,aAAa,EACtB,OAAO,EAAE,CAAC,KAAK,EAAE,KAAK,KAAK,OAAO,CAAC,IAAI,CAAC,EAC/B,iBAAiB,CAAC,EAAE,OAAO,CAAC,SAAS,CAAC,YAAA;IAMlC,WAAW,CACxB,iBAAiB,EAAE,qBAAqB,GACvC,OAAO,CAAC,IAAI,CAAC;WAYM,KAAK,CACzB,UAAU,EAAE,UAAU,EACtB,OAAO,EAAE,aAAa,EACtB,OAAO,EAAE,CAAC,KAAK,EAAE,KAAK,KAAK,OAAO,CAAC,IAAI,CAAC,EACxC,iBAAiB,CAAC,EAAE,OAAO,CAAC,SAAS,CAAC,GACrC,OAAO,CAAC,qCAAqC,CAAC;CAWlD"}

package/dist/cjs/nextjs/NextServerAuthenticationRefresherImpl.js

@@ -0,0 +1,29 @@
+"use strict";
+Object.defineProperty(exports, "__esModule", { value: true });
+exports.NextServerAuthenticationRefresherImpl = void 0;
+const AuthenticationRefresherImpl_js_1 = require("../shared/lib/AuthenticationRefresherImpl.js");
+const util_js_1 = require("../shared/lib/util.js");
+class NextServerAuthenticationRefresherImpl extends AuthenticationRefresherImpl_js_1.AuthenticationRefresherImpl {
+    endpointOverrides;
+    storage;
+    constructor(authConfig, storage, onError, endpointOverrides) {
+        super(authConfig, storage, onError, endpointOverrides);
+        this.endpointOverrides = endpointOverrides;
+        this.storage = storage;
+    }
+    async storeTokens(tokenResponseBody) {
+        if (!this.storage)
+            throw new Error("No storage available");
+        console.log("NextServerAuthenticationRefresherImpl storeTokens calling storeServerTokens", {
+            tokenResponseBody,
+        });
+        await (0, util_js_1.storeServerTokens)(this.storage, tokenResponseBody);
+    }
+    static async build(authConfig, storage, onError, endpointOverrides) {
+        const refresher = new NextServerAuthenticationRefresherImpl(authConfig, storage, onError, endpointOverrides);
+        await refresher.init();
+        return refresher;
+    }
+}
+exports.NextServerAuthenticationRefresherImpl = NextServerAuthenticationRefresherImpl;
+//# sourceMappingURL=NextServerAuthenticationRefresherImpl.js.map

package/dist/cjs/nextjs/NextServerAuthenticationRefresherImpl.js.map

@@ -0,0 +1 @@
+{"version":3,"file":"NextServerAuthenticationRefresherImpl.js","sourceRoot":"","sources":["../../../src/nextjs/NextServerAuthenticationRefresherImpl.ts"],"names":[],"mappings":";;;AAAA,gGAA0F;AAG1F,kDAAyD;AAGzD,MAAa,qCAAsC,SAAQ,4DAA2B;IAMzE;IALF,OAAO,CAA4B;IAC5C,YACE,UAAsB,EACtB,OAAsB,EACtB,OAAwC,EAC/B,iBAAsC;QAE/C,KAAK,CAAC,UAAU,EAAE,OAAO,EAAE,OAAO,EAAE,iBAAiB,CAAC,CAAC;QAF9C,sBAAiB,GAAjB,iBAAiB,CAAqB;QAG/C,IAAI,CAAC,OAAO,GAAG,OAAO,CAAC;IACzB,CAAC;IAEQ,KAAK,CAAC,WAAW,CACxB,iBAAwC;QAExC,IAAI,CAAC,IAAI,CAAC,OAAO;YAAE,MAAM,IAAI,KAAK,CAAC,sBAAsB,CAAC,CAAC;QAE3D,OAAO,CAAC,GAAG,CACT,6EAA6E,EAC7E;YACE,iBAAiB;SAClB,CACF,CAAC;QACF,MAAM,IAAA,2BAAiB,EAAC,IAAI,CAAC,OAAO,EAAE,iBAAiB,CAAC,CAAC;IAC3D,CAAC;IAED,MAAM,CAAU,KAAK,CAAC,KAAK,CACzB,UAAsB,EACtB,OAAsB,EACtB,OAAwC,EACxC,iBAAsC;QAEtC,MAAM,SAAS,GAAG,IAAI,qCAAqC,CACzD,UAAU,EACV,OAAO,EACP,OAAO,EACP,iBAAiB,CAClB,CAAC;QACF,MAAM,SAAS,CAAC,IAAI,EAAE,CAAC;QAEvB,OAAO,SAAS,CAAC;IACnB,CAAC;CACF;AA1CD,sFA0CC","sourcesContent":["import { AuthenticationRefresherImpl } from \"@/shared/lib/AuthenticationRefresherImpl.js\";\nimport type { Endpoints, OIDCTokenResponseBody } from \"@/types.js\";\nimport type { AuthConfig } from \"@/server/config.js\";\nimport { storeServerTokens } from \"@/shared/lib/util.js\";\nimport type { CookieStorage } from \"@/server/index.js\";\n\nexport class NextServerAuthenticationRefresherImpl extends AuthenticationRefresherImpl {\n  override storage: CookieStorage | undefined;\n  constructor(\n    authConfig: AuthConfig,\n    storage: CookieStorage,\n    onError: (error: Error) => Promise<void>,\n    override endpointOverrides?: Partial<Endpoints>,\n  ) {\n    super(authConfig, storage, onError, endpointOverrides);\n    this.storage = storage;\n  }\n\n  override async storeTokens(\n    tokenResponseBody: OIDCTokenResponseBody,\n  ): Promise<void> {\n    if (!this.storage) throw new Error(\"No storage available\");\n\n    console.log(\n      \"NextServerAuthenticationRefresherImpl storeTokens calling storeServerTokens\",\n      {\n        tokenResponseBody,\n      },\n    );\n    await storeServerTokens(this.storage, tokenResponseBody);\n  }\n\n  static override async build(\n    authConfig: AuthConfig,\n    storage: CookieStorage,\n    onError: (error: Error) => Promise<void>,\n    endpointOverrides?: Partial<Endpoints>,\n  ): Promise<NextServerAuthenticationRefresherImpl> {\n    const refresher = new NextServerAuthenticationRefresherImpl(\n      authConfig,\n      storage,\n      onError,\n      endpointOverrides,\n    );\n    await refresher.init();\n\n    return refresher;\n  }\n}\n"]}

package/dist/cjs/nextjs/config.d.ts

@@ -0,0 +1,209 @@
+import type { NextConfig } from "next";
+import { type CookieConfig, type TokensCookieConfig } from "../shared/lib/types.js";
+export type CookiesConfigObject = {
+    tokens: TokensCookieConfig;
+    user: CookieConfig;
+};
+export type AuthConfigWithDefaults = {
+    clientId: string;
+    oauthServer: string;
+    callbackUrl: string;
+    loginUrl: string;
+    logoutUrl: string;
+    logoutCallbackUrl: string;
+    challengeUrl: string;
+    refreshUrl: string;
+    include: string[];
+    exclude: string[];
+    cookies: CookiesConfigObject;
+};
+/**
+ * All possible config values for Civic Auth
+ */
+export type OptionalAuthConfig = Partial<AuthConfigWithDefaults | {
+    cookies?: {
+        tokens?: Partial<TokensCookieConfig>;
+        user?: CookieConfig;
+    };
+}>;
+/**
+ * Configuration values that are required for Civic Auth to work.
+ */
+export type AuthConfig = OptionalAuthConfig & {
+    clientId: string;
+    exclude?: string[];
+};
+/**
+ * Default configuration values that will be used if not overridden
+ */
+export declare const defaultAuthConfig: Omit<AuthConfigWithDefaults, "clientId">;
+/**
+ * Resolves the authentication configuration by combining:
+ * 1. Default values
+ * 2. Environment variables (set internally by the plugin)
+ * 3. Explicitly passed configuration
+ *
+ * Config will be merged deeply, with arrays not merged, so that the
+ * default include list (for example) ["/*"] will not be added
+ *
+ * Note: Developers should not set _civic_auth_* environment variables directly.
+ * Instead, pass configuration to the createCivicAuthPlugin in next.config.js:
+ *
+ * @example
+ * ```js
+ * // next.config.js
+ * export default createCivicAuthPlugin({
+ *   callbackUrl: '/custom/callback',
+ * })
+ * ```
+ */
+export declare const resolveAuthConfig: (config?: Partial<AuthConfig>) => AuthConfigWithDefaults;
+/**
+ * Creates a Next.js plugin that handles auth configuration.
+ *
+ * This is the main configuration point for the auth system.
+ * Do not set _civic_auth_* environment variables directly - instead,
+ * pass your configuration here.
+ *
+ * The only required field is clientId.
+ *
+ * @example
+ * ```js
+ * // next.config.js
+ * export default createCivicAuthPlugin({
+ *  clientId: 'my-client-id',
+ * });
+ * ```
+ *
+ * @example
+ * ```js
+ * // next.config.js
+ * export default createCivicAuthPlugin({
+ *   clientId: 'my-client-id',
+ *   callbackUrl: '/custom/callback',
+ *   loginUrl: '/custom/login',
+ *   logoutUrl: '/custom/logout',
+ *   logoutCallbackUrl: '/custom/logoutcallback',
+ *   include: ['/protected/*'],
+ *   exclude: ['/public/*']
+ * })
+ * ```
+ *
+ * The plugin sets internal environment variables that are used by
+ * the auth system. These variables should not be set manually.
+ */
+export declare const createCivicAuthPlugin: (authConfig: AuthConfig) => (nextConfig?: NextConfig) => {
+    env: {
+        _civic_auth_client_id: string;
+        _civic_oauth_server: string;
+        _civic_auth_callback_url: string;
+        _civic_auth_challenge_url: string;
+        _civic_auth_login_url: string;
+        _civic_auth_logout_url: string;
+        _civic_auth_logout_callback_url: string;
+        _civic_auth_includes: string;
+        _civic_auth_excludes: string;
+        _civic_auth_cookie_config: string;
+    };
+    exportPathMap?: (defaultMap: import("next/dist/server/config-shared").ExportPathMap, ctx: {
+        dev: boolean;
+        dir: string;
+        outDir: string | null;
+        distDir: string;
+        buildId: string;
+    }) => Promise<import("next/dist/server/config-shared").ExportPathMap> | import("next/dist/server/config-shared").ExportPathMap;
+    i18n?: import("next/dist/server/config-shared").I18NConfig | null;
+    eslint?: import("next/dist/server/config-shared").ESLintConfig;
+    typescript?: import("next/dist/server/config-shared").TypeScriptConfig;
+    headers?: () => Promise<import("next/dist/lib/load-custom-routes").Header[]>;
+    rewrites?: () => Promise<import("next/dist/lib/load-custom-routes").Rewrite[] | {
+        beforeFiles: import("next/dist/lib/load-custom-routes").Rewrite[];
+        afterFiles: import("next/dist/lib/load-custom-routes").Rewrite[];
+        fallback: import("next/dist/lib/load-custom-routes").Rewrite[];
+    }>;
+    redirects?: () => Promise<import("next/dist/lib/load-custom-routes").Redirect[]>;
+    excludeDefaultMomentLocales?: boolean;
+    webpack?: import("next/dist/server/config-shared").NextJsWebpackConfig | null;
+    trailingSlash?: boolean;
+    distDir?: string;
+    cleanDistDir?: boolean;
+    assetPrefix?: string;
+    cacheHandler?: string | undefined;
+    cacheMaxMemorySize?: number;
+    useFileSystemPublicRoutes?: boolean;
+    generateBuildId?: () => string | null | Promise<string | null>;
+    generateEtags?: boolean;
+    pageExtensions?: string[];
+    compress?: boolean;
+    analyticsId?: string;
+    poweredByHeader?: boolean;
+    images?: import("next/dist/shared/lib/image-config").ImageConfig;
+    devIndicators?: {
+        buildActivity?: boolean;
+        buildActivityPosition?: "bottom-right" | "bottom-left" | "top-right" | "top-left";
+    };
+    onDemandEntries?: {
+        maxInactiveAge?: number;
+        pagesBufferLength?: number;
+    };
+    amp?: {
+        canonicalBase?: string;
+    };
+    deploymentId?: string;
+    basePath?: string;
+    sassOptions?: {
+        [key: string]: any;
+    };
+    productionBrowserSourceMaps?: boolean;
+    optimizeFonts?: boolean;
+    reactProductionProfiling?: boolean;
+    reactStrictMode?: boolean | null;
+    publicRuntimeConfig?: {
+        [key: string]: any;
+    };
+    serverRuntimeConfig?: {
+        [key: string]: any;
+    };
+    httpAgentOptions?: {
+        keepAlive?: boolean;
+    };
+    outputFileTracing?: boolean;
+    staticPageGenerationTimeout?: number;
+    crossOrigin?: "anonymous" | "use-credentials";
+    swcMinify?: boolean;
+    compiler?: {
+        reactRemoveProperties?: boolean | {
+            properties?: string[];
+        };
+        relay?: {
+            src: string;
+            artifactDirectory?: string;
+            language?: "typescript" | "javascript" | "flow";
+            eagerEsModules?: boolean;
+        };
+        removeConsole?: boolean | {
+            exclude?: string[];
+        };
+        styledComponents?: boolean | import("next/dist/server/config-shared").StyledComponentsConfig;
+        emotion?: boolean | import("next/dist/server/config-shared").EmotionConfig;
+        styledJsx?: boolean | {
+            useLightningcss?: boolean;
+        };
+    };
+    output?: "standalone" | "export";
+    transpilePackages?: string[];
+    skipMiddlewareUrlNormalize?: boolean;
+    skipTrailingSlashRedirect?: boolean;
+    modularizeImports?: Record<string, {
+        transform: string | Record<string, string>;
+        preventFullImport?: boolean;
+        skipDefaultConversion?: boolean;
+    }>;
+    logging?: {
+        fetches?: {
+            fullUrl?: boolean;
+        };
+    };
+    experimental?: import("next/dist/server/config-shared").ExperimentalConfig;
+};
+//# sourceMappingURL=config.d.ts.map

package/dist/cjs/nextjs/config.d.ts.map

@@ -0,0 +1 @@
+{"version":3,"file":"config.d.ts","sourceRoot":"","sources":["../../../src/nextjs/config.ts"],"names":[],"mappings":"AACA,OAAO,KAAK,EAAE,UAAU,EAAE,MAAM,MAAM,CAAC;AAGvC,OAAO,EAEL,KAAK,YAAY,EAEjB,KAAK,kBAAkB,EACxB,MAAM,uBAAuB,CAAC;AAM/B,MAAM,MAAM,mBAAmB,GAAG;IAChC,MAAM,EAAE,kBAAkB,CAAC;IAC3B,IAAI,EAAE,YAAY,CAAC;CACpB,CAAC;AAEF,MAAM,MAAM,sBAAsB,GAAG;IACnC,QAAQ,EAAE,MAAM,CAAC;IACjB,WAAW,EAAE,MAAM,CAAC;IACpB,WAAW,EAAE,MAAM,CAAC;IACpB,QAAQ,EAAE,MAAM,CAAC;IACjB,SAAS,EAAE,MAAM,CAAC;IAClB,iBAAiB,EAAE,MAAM,CAAC;IAC1B,YAAY,EAAE,MAAM,CAAC;IACrB,UAAU,EAAE,MAAM,CAAC;IACnB,OAAO,EAAE,MAAM,EAAE,CAAC;IAClB,OAAO,EAAE,MAAM,EAAE,CAAC;IAClB,OAAO,EAAE,mBAAmB,CAAC;CAC9B,CAAC;AAEF;;GAEG;AACH,MAAM,MAAM,kBAAkB,GAAG,OAAO,CACpC,sBAAsB,GACtB;IACE,OAAO,CAAC,EAAE;QACR,MAAM,CAAC,EAAE,OAAO,CAAC,kBAAkB,CAAC,CAAC;QACrC,IAAI,CAAC,EAAE,YAAY,CAAC;KACrB,CAAC;CACH,CACJ,CAAC;AAEF;;GAEG;AACH,MAAM,MAAM,UAAU,GAAG,kBAAkB,GAAG;IAC5C,QAAQ,EAAE,MAAM,CAAC;IACjB,OAAO,CAAC,EAAE,MAAM,EAAE,CAAC;CACpB,CAAC;AAKF;;GAEG;AACH,eAAO,MAAM,iBAAiB,EAAE,IAAI,CAAC,sBAAsB,EAAE,UAAU,CA+DtE,CAAC;AAEF;;;;;;;;;;;;;;;;;;;GAmBG;AACH,eAAO,MAAM,iBAAiB,YACpB,OAAO,CAAC,UAAU,CAAC,KAC1B,sBA8CF,CAAC;AAEF;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;GAiCG;AACH,eAAO,MAAM,qBAAqB,eAAgB,UAAU,mBACrC,UAAU;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;qBAyB2mZ,CAAC;6BAAsG,CAAC;;;sBAAke,CAAC;yBAA4H,CAAC;;;qBAA+H,CAAC;;;;;;;;;;;;;;;;;;iBAA8pE,CAAC;;;;;;;6BAAg6C,CAAC;sBAAoC,CAAC;;aAAoC,CAAC;;6BAA0D,CAAC;oBAA8B,CAAC;0BAAkE,CAAC;;qBAA2C,CAAC;mBAAiC,CAAC;;wBAA+C,CAAC;eAAmD,CAAC;iBAA4C,CAAC;2BAAyC,CAAC;;;;;;;;;yBAA4zC,CAAC;6BAAwC,CAAC;;;eAAkD,CAAC;mBAAuB,CAAC;;;;CADp7lB,CAAC"}

package/dist/cjs/nextjs/config.js

@@ -0,0 +1,191 @@
+"use strict";
+Object.defineProperty(exports, "__esModule", { value: true });
+exports.createCivicAuthPlugin = exports.resolveAuthConfig = exports.defaultAuthConfig = void 0;
+const logger_js_1 = require("../lib/logger.js");
+const utils_js_1 = require("../utils.js");
+const types_js_1 = require("../shared/lib/types.js");
+const constants_js_1 = require("../constants.js");
+const ts_deepmerge_1 = require("ts-deepmerge");
+const logger = logger_js_1.loggers.nextjs.handlers.auth;
+const defaultServerSecure = !(process.env.NODE_ENV === "development");
+const defaultCookiesMaxAge = 60 * 60; // 1 hour
+/**
+ * Default configuration values that will be used if not overridden
+ */
+exports.defaultAuthConfig = {
+    oauthServer: constants_js_1.DEFAULT_AUTH_SERVER,
+    callbackUrl: "/api/auth/callback",
+    challengeUrl: "/api/auth/challenge",
+    refreshUrl: "/api/auth/refresh",
+    logoutUrl: "/api/auth/logout",
+    logoutCallbackUrl: "/api/auth/logoutcallback",
+    loginUrl: "/",
+    include: ["/**"],
+    exclude: ["/api/auth/**"],
+    cookies: {
+        tokens: {
+            [types_js_1.OAuthTokens.ID_TOKEN]: {
+                secure: defaultServerSecure,
+                httpOnly: true,
+                sameSite: "strict",
+                path: "/",
+                maxAge: defaultCookiesMaxAge,
+            },
+            [types_js_1.OAuthTokens.ACCESS_TOKEN]: {
+                secure: defaultServerSecure,
+                httpOnly: true,
+                sameSite: "strict",
+                path: "/",
+                maxAge: defaultCookiesMaxAge,
+            },
+            [types_js_1.OAuthTokens.REFRESH_TOKEN]: {
+                secure: defaultServerSecure,
+                httpOnly: true,
+                sameSite: "strict",
+                path: "/",
+                maxAge: defaultCookiesMaxAge,
+            },
+            [types_js_1.OAuthTokens.ACCESS_TOKEN_EXPIRES_AT]: {
+                secure: defaultServerSecure,
+                httpOnly: false, // we need this to be available client-side
+                sameSite: "strict",
+                path: "/",
+                maxAge: defaultCookiesMaxAge,
+            },
+            [types_js_1.CodeVerifier.COOKIE_NAME]: {
+                secure: defaultServerSecure,
+                httpOnly: true,
+                sameSite: "strict",
+                path: "/",
+                maxAge: defaultCookiesMaxAge,
+            },
+            [types_js_1.CodeVerifier.APP_URL]: {
+                secure: defaultServerSecure,
+                httpOnly: true,
+                sameSite: "strict",
+                path: "/",
+                maxAge: defaultCookiesMaxAge,
+            },
+        },
+        user: {
+            secure: defaultServerSecure,
+            httpOnly: false, // we need this to be available client-side
+            sameSite: "strict",
+            path: "/",
+            maxAge: defaultCookiesMaxAge,
+        },
+    },
+};
+/**
+ * Resolves the authentication configuration by combining:
+ * 1. Default values
+ * 2. Environment variables (set internally by the plugin)
+ * 3. Explicitly passed configuration
+ *
+ * Config will be merged deeply, with arrays not merged, so that the
+ * default include list (for example) ["/*"] will not be added
+ *
+ * Note: Developers should not set _civic_auth_* environment variables directly.
+ * Instead, pass configuration to the createCivicAuthPlugin in next.config.js:
+ *
+ * @example
+ * ```js
+ * // next.config.js
+ * export default createCivicAuthPlugin({
+ *   callbackUrl: '/custom/callback',
+ * })
+ * ```
+ */
+const resolveAuthConfig = (config = {}) => {
+    // Read configuration that was set by the plugin via environment variables
+    const configFromEnv = (0, utils_js_1.withoutUndefined)({
+        clientId: process.env._civic_auth_client_id,
+        oauthServer: process.env._civic_oauth_server,
+        callbackUrl: process.env._civic_auth_callback_url,
+        challengeUrl: process.env._civic_auth_challenge_url,
+        loginUrl: process.env._civic_auth_login_url,
+        logoutUrl: process.env._civic_auth_logout_url,
+        logoutCallbackUrl: process.env._civic_auth_logout_callback_url,
+        include: process.env._civic_auth_includes?.split(","),
+        exclude: process.env._civic_auth_excludes?.split(","),
+        cookies: process.env._civic_auth_cookie_config
+            ? JSON.parse(process.env._civic_auth_cookie_config)
+            : undefined,
+    });
+    // Ensure "/api/auth/**" is always excluded
+    const finalExclude = new Set([
+        ...exports.defaultAuthConfig.exclude,
+        ...(configFromEnv.exclude || []),
+        ...(config.exclude ?? []),
+    ]);
+    // Perform a deep merge of the configurations
+    const mergedConfig = ts_deepmerge_1.merge.withOptions({ mergeArrays: false }, exports.defaultAuthConfig, configFromEnv, config);
+    // Override the exclude list with the ensured list
+    mergedConfig.exclude = Array.from(finalExclude);
+    logger.debug("Config from environment:", JSON.stringify(configFromEnv, null, 2));
+    logger.debug("Resolved config:", JSON.stringify(mergedConfig, null, 2));
+    if (mergedConfig.clientId === undefined) {
+        throw new Error("Civic Auth client ID is required");
+    }
+    return mergedConfig;
+};
+exports.resolveAuthConfig = resolveAuthConfig;
+/**
+ * Creates a Next.js plugin that handles auth configuration.
+ *
+ * This is the main configuration point for the auth system.
+ * Do not set _civic_auth_* environment variables directly - instead,
+ * pass your configuration here.
+ *
+ * The only required field is clientId.
+ *
+ * @example
+ * ```js
+ * // next.config.js
+ * export default createCivicAuthPlugin({
+ *  clientId: 'my-client-id',
+ * });
+ * ```
+ *
+ * @example
+ * ```js
+ * // next.config.js
+ * export default createCivicAuthPlugin({
+ *   clientId: 'my-client-id',
+ *   callbackUrl: '/custom/callback',
+ *   loginUrl: '/custom/login',
+ *   logoutUrl: '/custom/logout',
+ *   logoutCallbackUrl: '/custom/logoutcallback',
+ *   include: ['/protected/*'],
+ *   exclude: ['/public/*']
+ * })
+ * ```
+ *
+ * The plugin sets internal environment variables that are used by
+ * the auth system. These variables should not be set manually.
+ */
+const createCivicAuthPlugin = (authConfig) => {
+    return (nextConfig) => {
+        logger.debug("createCivicAuthPlugin nextConfig", JSON.stringify(nextConfig, null, 2));
+        const resolvedConfig = (0, exports.resolveAuthConfig)(authConfig);
+        return {
+            ...nextConfig,
+            env: {
+                ...nextConfig?.env,
+                // Internal environment variables - do not set these manually
+                _civic_auth_client_id: resolvedConfig.clientId,
+                _civic_oauth_server: resolvedConfig.oauthServer,
+                _civic_auth_callback_url: resolvedConfig.callbackUrl,
+                _civic_auth_challenge_url: resolvedConfig.challengeUrl,
+                _civic_auth_login_url: resolvedConfig.loginUrl,
+                _civic_auth_logout_url: resolvedConfig.logoutUrl,
+                _civic_auth_logout_callback_url: resolvedConfig.logoutCallbackUrl,
+                _civic_auth_includes: resolvedConfig.include.join(","),
+                _civic_auth_excludes: resolvedConfig.exclude.join(","),
+                _civic_auth_cookie_config: JSON.stringify(resolvedConfig.cookies),
+            },
+        };
+    };
+};
+exports.createCivicAuthPlugin = createCivicAuthPlugin;
+//# sourceMappingURL=config.js.map

package/dist/cjs/nextjs/config.js.map

@@ -0,0 +1 @@
+{"version":3,"file":"config.js","sourceRoot":"","sources":["../../../src/nextjs/config.ts"],"names":[],"mappings":";;;AAEA,+CAA0C;AAC1C,yCAA8C;AAC9C,oDAK+B;AAC/B,iDAAqD;AACrD,+CAAqC;AAErC,MAAM,MAAM,GAAG,mBAAO,CAAC,MAAM,CAAC,QAAQ,CAAC,IAAI,CAAC;AA0C5C,MAAM,mBAAmB,GAAG,CAAC,CAAC,OAAO,CAAC,GAAG,CAAC,QAAQ,KAAK,aAAa,CAAC,CAAC;AACtE,MAAM,oBAAoB,GAAG,EAAE,GAAG,EAAE,CAAC,CAAC,SAAS;AAE/C;;GAEG;AACU,QAAA,iBAAiB,GAA6C;IACzE,WAAW,EAAE,kCAAmB;IAChC,WAAW,EAAE,oBAAoB;IACjC,YAAY,EAAE,qBAAqB;IACnC,UAAU,EAAE,mBAAmB;IAC/B,SAAS,EAAE,kBAAkB;IAC7B,iBAAiB,EAAE,0BAA0B;IAC7C,QAAQ,EAAE,GAAG;IACb,OAAO,EAAE,CAAC,KAAK,CAAC;IAChB,OAAO,EAAE,CAAC,cAAc,CAAC;IACzB,OAAO,EAAE;QACP,MAAM,EAAE;YACN,CAAC,sBAAW,CAAC,QAAQ,CAAC,EAAE;gBACtB,MAAM,EAAE,mBAAmB;gBAC3B,QAAQ,EAAE,IAAI;gBACd,QAAQ,EAAE,QAAQ;gBAClB,IAAI,EAAE,GAAG;gBACT,MAAM,EAAE,oBAAoB;aAC7B;YACD,CAAC,sBAAW,CAAC,YAAY,CAAC,EAAE;gBAC1B,MAAM,EAAE,mBAAmB;gBAC3B,QAAQ,EAAE,IAAI;gBACd,QAAQ,EAAE,QAAQ;gBAClB,IAAI,EAAE,GAAG;gBACT,MAAM,EAAE,oBAAoB;aAC7B;YACD,CAAC,sBAAW,CAAC,aAAa,CAAC,EAAE;gBAC3B,MAAM,EAAE,mBAAmB;gBAC3B,QAAQ,EAAE,IAAI;gBACd,QAAQ,EAAE,QAAQ;gBAClB,IAAI,EAAE,GAAG;gBACT,MAAM,EAAE,oBAAoB;aAC7B;YACD,CAAC,sBAAW,CAAC,uBAAuB,CAAC,EAAE;gBACrC,MAAM,EAAE,mBAAmB;gBAC3B,QAAQ,EAAE,KAAK,EAAE,2CAA2C;gBAC5D,QAAQ,EAAE,QAAQ;gBAClB,IAAI,EAAE,GAAG;gBACT,MAAM,EAAE,oBAAoB;aAC7B;YACD,CAAC,uBAAY,CAAC,WAAW,CAAC,EAAE;gBAC1B,MAAM,EAAE,mBAAmB;gBAC3B,QAAQ,EAAE,IAAI;gBACd,QAAQ,EAAE,QAAQ;gBAClB,IAAI,EAAE,GAAG;gBACT,MAAM,EAAE,oBAAoB;aAC7B;YACD,CAAC,uBAAY,CAAC,OAAO,CAAC,EAAE;gBACtB,MAAM,EAAE,mBAAmB;gBAC3B,QAAQ,EAAE,IAAI;gBACd,QAAQ,EAAE,QAAQ;gBAClB,IAAI,EAAE,GAAG;gBACT,MAAM,EAAE,oBAAoB;aAC7B;SACF;QACD,IAAI,EAAE;YACJ,MAAM,EAAE,mBAAmB;YAC3B,QAAQ,EAAE,KAAK,EAAE,2CAA2C;YAC5D,QAAQ,EAAE,QAAQ;YAClB,IAAI,EAAE,GAAG;YACT,MAAM,EAAE,oBAAoB;SAC7B;KACF;CACF,CAAC;AAEF;;;;;;;;;;;;;;;;;;;GAmBG;AACI,MAAM,iBAAiB,GAAG,CAC/B,SAA8B,EAAE,EACR,EAAE;IAC1B,0EAA0E;IAC1E,MAAM,aAAa,GAAG,IAAA,2BAAgB,EAAC;QACrC,QAAQ,EAAE,OAAO,CAAC,GAAG,CAAC,qBAAqB;QAC3C,WAAW,EAAE,OAAO,CAAC,GAAG,CAAC,mBAAmB;QAC5C,WAAW,EAAE,OAAO,CAAC,GAAG,CAAC,wBAAwB;QACjD,YAAY,EAAE,OAAO,CAAC,GAAG,CAAC,yBAAyB;QACnD,QAAQ,EAAE,OAAO,CAAC,GAAG,CAAC,qBAAqB;QAC3C,SAAS,EAAE,OAAO,CAAC,GAAG,CAAC,sBAAsB;QAC7C,iBAAiB,EAAE,OAAO,CAAC,GAAG,CAAC,+BAA+B;QAC9D,OAAO,EAAE,OAAO,CAAC,GAAG,CAAC,oBAAoB,EAAE,KAAK,CAAC,GAAG,CAAC;QACrD,OAAO,EAAE,OAAO,CAAC,GAAG,CAAC,oBAAoB,EAAE,KAAK,CAAC,GAAG,CAAC;QACrD,OAAO,EAAE,OAAO,CAAC,GAAG,CAAC,yBAAyB;YAC5C,CAAC,CAAC,IAAI,CAAC,KAAK,CAAC,OAAO,CAAC,GAAG,CAAC,yBAAyB,CAAC;YACnD,CAAC,CAAC,SAAS;KACd,CAAe,CAAC;IAEjB,2CAA2C;IAC3C,MAAM,YAAY,GAAG,IAAI,GAAG,CAAC;QAC3B,GAAG,yBAAiB,CAAC,OAAO;QAC5B,GAAG,CAAC,aAAa,CAAC,OAAO,IAAI,EAAE,CAAC;QAChC,GAAG,CAAC,MAAM,CAAC,OAAO,IAAI,EAAE,CAAC;KAC1B,CAAC,CAAC;IAEH,6CAA6C;IAC7C,MAAM,YAAY,GAAG,oBAAK,CAAC,WAAW,CACpC,EAAE,WAAW,EAAE,KAAK,EAAE,EACtB,yBAAiB,EACjB,aAAa,EACb,MAAM,CACP,CAAC;IAEF,kDAAkD;IAClD,YAAY,CAAC,OAAO,GAAG,KAAK,CAAC,IAAI,CAAC,YAAY,CAAC,CAAC;IAEhD,MAAM,CAAC,KAAK,CACV,0BAA0B,EAC1B,IAAI,CAAC,SAAS,CAAC,aAAa,EAAE,IAAI,EAAE,CAAC,CAAC,CACvC,CAAC;IACF,MAAM,CAAC,KAAK,CAAC,kBAAkB,EAAE,IAAI,CAAC,SAAS,CAAC,YAAY,EAAE,IAAI,EAAE,CAAC,CAAC,CAAC,CAAC;IAExE,IAAI,YAAY,CAAC,QAAQ,KAAK,SAAS,EAAE,CAAC;QACxC,MAAM,IAAI,KAAK,CAAC,kCAAkC,CAAC,CAAC;IACtD,CAAC;IAED,OAAO,YAA6D,CAAC;AACvE,CAAC,CAAC;AAhDW,QAAA,iBAAiB,qBAgD5B;AAEF;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;GAiCG;AACI,MAAM,qBAAqB,GAAG,CAAC,UAAsB,EAAE,EAAE;IAC9D,OAAO,CAAC,UAAuB,EAAE,EAAE;QACjC,MAAM,CAAC,KAAK,CACV,kCAAkC,EAClC,IAAI,CAAC,SAAS,CAAC,UAAU,EAAE,IAAI,EAAE,CAAC,CAAC,CACpC,CAAC;QACF,MAAM,cAAc,GAAG,IAAA,yBAAiB,EAAC,UAAU,CAAC,CAAC;QACrD,OAAO;YACL,GAAG,UAAU;YACb,GAAG,EAAE;gBACH,GAAG,UAAU,EAAE,GAAG;gBAClB,6DAA6D;gBAC7D,qBAAqB,EAAE,cAAc,CAAC,QAAQ;gBAC9C,mBAAmB,EAAE,cAAc,CAAC,WAAW;gBAC/C,wBAAwB,EAAE,cAAc,CAAC,WAAW;gBACpD,yBAAyB,EAAE,cAAc,CAAC,YAAY;gBACtD,qBAAqB,EAAE,cAAc,CAAC,QAAQ;gBAC9C,sBAAsB,EAAE,cAAc,CAAC,SAAS;gBAChD,+BAA+B,EAAE,cAAc,CAAC,iBAAiB;gBACjE,oBAAoB,EAAE,cAAc,CAAC,OAAO,CAAC,IAAI,CAAC,GAAG,CAAC;gBACtD,oBAAoB,EAAE,cAAc,CAAC,OAAO,CAAC,IAAI,CAAC,GAAG,CAAC;gBACtD,yBAAyB,EAAE,IAAI,CAAC,SAAS,CAAC,cAAc,CAAC,OAAO,CAAC;aAClE;SACF,CAAC;IACJ,CAAC,CAAC;AACJ,CAAC,CAAC;AAzBW,QAAA,qBAAqB,yBAyBhC","sourcesContent":["/* eslint-disable turbo/no-undeclared-env-vars */\nimport type { NextConfig } from \"next\";\nimport { loggers } from \"@/lib/logger.js\";\nimport { withoutUndefined } from \"@/utils.js\";\nimport {\n  CodeVerifier,\n  type CookieConfig,\n  OAuthTokens,\n  type TokensCookieConfig,\n} from \"@/shared/lib/types.js\";\nimport { DEFAULT_AUTH_SERVER } from \"@/constants.js\";\nimport { merge } from \"ts-deepmerge\";\n\nconst logger = loggers.nextjs.handlers.auth;\n\nexport type CookiesConfigObject = {\n  tokens: TokensCookieConfig;\n  user: CookieConfig;\n};\n\nexport type AuthConfigWithDefaults = {\n  clientId: string;\n  oauthServer: string;\n  callbackUrl: string;\n  loginUrl: string;\n  logoutUrl: string;\n  logoutCallbackUrl: string;\n  challengeUrl: string;\n  refreshUrl: string;\n  include: string[];\n  exclude: string[];\n  cookies: CookiesConfigObject;\n};\n\n/**\n * All possible config values for Civic Auth\n */\nexport type OptionalAuthConfig = Partial<\n  | AuthConfigWithDefaults\n  | {\n      cookies?: {\n        tokens?: Partial<TokensCookieConfig>;\n        user?: CookieConfig;\n      };\n    }\n>;\n\n/**\n * Configuration values that are required for Civic Auth to work.\n */\nexport type AuthConfig = OptionalAuthConfig & {\n  clientId: string;\n  exclude?: string[];\n};\n\nconst defaultServerSecure = !(process.env.NODE_ENV === \"development\");\nconst defaultCookiesMaxAge = 60 * 60; // 1 hour\n\n/**\n * Default configuration values that will be used if not overridden\n */\nexport const defaultAuthConfig: Omit<AuthConfigWithDefaults, \"clientId\"> = {\n  oauthServer: DEFAULT_AUTH_SERVER,\n  callbackUrl: \"/api/auth/callback\",\n  challengeUrl: \"/api/auth/challenge\",\n  refreshUrl: \"/api/auth/refresh\",\n  logoutUrl: \"/api/auth/logout\",\n  logoutCallbackUrl: \"/api/auth/logoutcallback\",\n  loginUrl: \"/\",\n  include: [\"/**\"],\n  exclude: [\"/api/auth/**\"],\n  cookies: {\n    tokens: {\n      [OAuthTokens.ID_TOKEN]: {\n        secure: defaultServerSecure,\n        httpOnly: true,\n        sameSite: \"strict\",\n        path: \"/\",\n        maxAge: defaultCookiesMaxAge,\n      },\n      [OAuthTokens.ACCESS_TOKEN]: {\n        secure: defaultServerSecure,\n        httpOnly: true,\n        sameSite: \"strict\",\n        path: \"/\",\n        maxAge: defaultCookiesMaxAge,\n      },\n      [OAuthTokens.REFRESH_TOKEN]: {\n        secure: defaultServerSecure,\n        httpOnly: true,\n        sameSite: \"strict\",\n        path: \"/\",\n        maxAge: defaultCookiesMaxAge,\n      },\n      [OAuthTokens.ACCESS_TOKEN_EXPIRES_AT]: {\n        secure: defaultServerSecure,\n        httpOnly: false, // we need this to be available client-side\n        sameSite: \"strict\",\n        path: \"/\",\n        maxAge: defaultCookiesMaxAge,\n      },\n      [CodeVerifier.COOKIE_NAME]: {\n        secure: defaultServerSecure,\n        httpOnly: true,\n        sameSite: \"strict\",\n        path: \"/\",\n        maxAge: defaultCookiesMaxAge,\n      },\n      [CodeVerifier.APP_URL]: {\n        secure: defaultServerSecure,\n        httpOnly: true,\n        sameSite: \"strict\",\n        path: \"/\",\n        maxAge: defaultCookiesMaxAge,\n      },\n    },\n    user: {\n      secure: defaultServerSecure,\n      httpOnly: false, // we need this to be available client-side\n      sameSite: \"strict\",\n      path: \"/\",\n      maxAge: defaultCookiesMaxAge,\n    },\n  },\n};\n\n/**\n * Resolves the authentication configuration by combining:\n * 1. Default values\n * 2. Environment variables (set internally by the plugin)\n * 3. Explicitly passed configuration\n *\n * Config will be merged deeply, with arrays not merged, so that the\n * default include list (for example) [\"/*\"] will not be added\n *\n * Note: Developers should not set _civic_auth_* environment variables directly.\n * Instead, pass configuration to the createCivicAuthPlugin in next.config.js:\n *\n * @example\n * ```js\n * // next.config.js\n * export default createCivicAuthPlugin({\n *   callbackUrl: '/custom/callback',\n * })\n * ```\n */\nexport const resolveAuthConfig = (\n  config: Partial<AuthConfig> = {},\n): AuthConfigWithDefaults => {\n  // Read configuration that was set by the plugin via environment variables\n  const configFromEnv = withoutUndefined({\n    clientId: process.env._civic_auth_client_id,\n    oauthServer: process.env._civic_oauth_server,\n    callbackUrl: process.env._civic_auth_callback_url,\n    challengeUrl: process.env._civic_auth_challenge_url,\n    loginUrl: process.env._civic_auth_login_url,\n    logoutUrl: process.env._civic_auth_logout_url,\n    logoutCallbackUrl: process.env._civic_auth_logout_callback_url,\n    include: process.env._civic_auth_includes?.split(\",\"),\n    exclude: process.env._civic_auth_excludes?.split(\",\"),\n    cookies: process.env._civic_auth_cookie_config\n      ? JSON.parse(process.env._civic_auth_cookie_config)\n      : undefined,\n  }) as AuthConfig;\n\n  // Ensure \"/api/auth/**\" is always excluded\n  const finalExclude = new Set([\n    ...defaultAuthConfig.exclude,\n    ...(configFromEnv.exclude || []),\n    ...(config.exclude ?? []),\n  ]);\n\n  // Perform a deep merge of the configurations\n  const mergedConfig = merge.withOptions(\n    { mergeArrays: false },\n    defaultAuthConfig,\n    configFromEnv,\n    config,\n  );\n\n  // Override the exclude list with the ensured list\n  mergedConfig.exclude = Array.from(finalExclude);\n\n  logger.debug(\n    \"Config from environment:\",\n    JSON.stringify(configFromEnv, null, 2),\n  );\n  logger.debug(\"Resolved config:\", JSON.stringify(mergedConfig, null, 2));\n\n  if (mergedConfig.clientId === undefined) {\n    throw new Error(\"Civic Auth client ID is required\");\n  }\n\n  return mergedConfig as AuthConfigWithDefaults & { clientId: string };\n};\n\n/**\n * Creates a Next.js plugin that handles auth configuration.\n *\n * This is the main configuration point for the auth system.\n * Do not set _civic_auth_* environment variables directly - instead,\n * pass your configuration here.\n *\n * The only required field is clientId.\n *\n * @example\n * ```js\n * // next.config.js\n * export default createCivicAuthPlugin({\n *  clientId: 'my-client-id',\n * });\n * ```\n *\n * @example\n * ```js\n * // next.config.js\n * export default createCivicAuthPlugin({\n *   clientId: 'my-client-id',\n *   callbackUrl: '/custom/callback',\n *   loginUrl: '/custom/login',\n *   logoutUrl: '/custom/logout',\n *   logoutCallbackUrl: '/custom/logoutcallback',\n *   include: ['/protected/*'],\n *   exclude: ['/public/*']\n * })\n * ```\n *\n * The plugin sets internal environment variables that are used by\n * the auth system. These variables should not be set manually.\n */\nexport const createCivicAuthPlugin = (authConfig: AuthConfig) => {\n  return (nextConfig?: NextConfig) => {\n    logger.debug(\n      \"createCivicAuthPlugin nextConfig\",\n      JSON.stringify(nextConfig, null, 2),\n    );\n    const resolvedConfig = resolveAuthConfig(authConfig);\n    return {\n      ...nextConfig,\n      env: {\n        ...nextConfig?.env,\n        // Internal environment variables - do not set these manually\n        _civic_auth_client_id: resolvedConfig.clientId,\n        _civic_oauth_server: resolvedConfig.oauthServer,\n        _civic_auth_callback_url: resolvedConfig.callbackUrl,\n        _civic_auth_challenge_url: resolvedConfig.challengeUrl,\n        _civic_auth_login_url: resolvedConfig.loginUrl,\n        _civic_auth_logout_url: resolvedConfig.logoutUrl,\n        _civic_auth_logout_callback_url: resolvedConfig.logoutCallbackUrl,\n        _civic_auth_includes: resolvedConfig.include.join(\",\"),\n        _civic_auth_excludes: resolvedConfig.exclude.join(\",\"),\n        _civic_auth_cookie_config: JSON.stringify(resolvedConfig.cookies),\n      },\n    };\n  };\n};\n"]}

package/dist/cjs/nextjs/cookies.d.ts

@@ -0,0 +1,16 @@
+import type { KeySetter } from "../shared/lib/types.js";
+import { type CookieConfig } from "../shared/lib/types.js";
+import { CookieStorage } from "../shared/lib/storage.js";
+/**
+ * Clears all authentication cookies on server. Note, this can only be called by the server
+ */
+declare const clearAuthCookies: () => Promise<void>;
+declare class NextjsCookieStorage extends CookieStorage {
+    config: Partial<Record<KeySetter, CookieConfig>>;
+    constructor(config?: Partial<Record<KeySetter, CookieConfig>>);
+    get(key: string): Promise<string | null>;
+    set(key: KeySetter, value: string, cookieConfigOverride?: Partial<CookieConfig>): Promise<void>;
+    delete(key: KeySetter): Promise<void>;
+}
+export { clearAuthCookies, NextjsCookieStorage };
+//# sourceMappingURL=cookies.d.ts.map

package/dist/cjs/nextjs/cookies.d.ts.map

@@ -0,0 +1 @@
+{"version":3,"file":"cookies.d.ts","sourceRoot":"","sources":["../../../src/nextjs/cookies.ts"],"names":[],"mappings":"AAMA,OAAO,KAAK,EAAE,SAAS,EAAE,MAAM,uBAAuB,CAAC;AACvD,OAAO,EAAE,KAAK,YAAY,EAAE,MAAM,uBAAuB,CAAC;AAC1D,OAAO,EAAE,aAAa,EAAE,MAAM,yBAAyB,CAAC;AAExD;;GAEG;AACH,QAAA,MAAM,gBAAgB,qBAKrB,CAAC;AAEF,cAAM,mBAAoB,SAAQ,aAAa;IAC1B,MAAM,EAAE,OAAO,CAAC,MAAM,CAAC,SAAS,EAAE,YAAY,CAAC,CAAC;gBAAhD,MAAM,GAAE,OAAO,CAAC,MAAM,CAAC,SAAS,EAAE,YAAY,CAAC,CAAM;IAOlE,GAAG,CAAC,GAAG,EAAE,MAAM,GAAG,OAAO,CAAC,MAAM,GAAG,IAAI,CAAC;IAKxC,GAAG,CACP,GAAG,EAAE,SAAS,EACd,KAAK,EAAE,MAAM,EACb,oBAAoB,GAAE,OAAO,CAAC,YAAY,CAAM,GAC/C,OAAO,CAAC,IAAI,CAAC;IASV,MAAM,CAAC,GAAG,EAAE,SAAS,GAAG,OAAO,CAAC,IAAI,CAAC;CAI5C;AAED,OAAO,EAAE,gBAAgB,EAAE,mBAAmB,EAAE,CAAC"}