@civic/auth 0.9.6-beta.2 → 0.10.0-beta.0

package/dist/nextjs/hooks/useInitialAuthConfig.d.ts.map

@@ -1 +1 @@
-{"version":3,"file":"useInitialAuthConfig.d.ts","sourceRoot":"","sources":["../../../src/nextjs/hooks/useInitialAuthConfig.ts"],"names":[],"mappings":"AASA,OAAO,KAAK,EAAE,gBAAgB,EAAE,MAAM,qCAAqC,CAAC;AAC5E,OAAO,KAAK,EAAE,oBAAoB,EAAE,MAAM,qCAAqC,CAAC;AAChF,OAAO,KAAK,EAAE,IAAI,EAAE,UAAU,EAAE,MAAM,YAAY,CAAC;AAGnD,MAAM,WAAW,2BAA2B;IAC1C,WAAW,CAAC,EAAE,oBAAoB,CAAC;IACnC,UAAU,CAAC,EAAE,UAAU,CAAC;IACxB,UAAU,CAAC,EAAE,IAAI,GAAG,IAAI,CAAC;IACzB,KAAK,CAAC,EAAE,MAAM,CAAC;IACf,sBAAsB,CAAC,EAAE,WAAW,GAAG,MAAM,CAAC;IAC9C,WAAW,CAAC,EAAE,MAAM,CAAC;IACrB,eAAe,CAAC,EAAE,MAAM,CAAC;IACzB,WAAW,CAAC,EAAE,CAAC,GAAG,EAAE,MAAM,EAAE,MAAM,CAAC,EAAE,MAAM,KAAK,IAAI,CAAC;CACtD;AAED,MAAM,WAAW,6BAA6B;IAC5C,WAAW,CAAC,EAAE,oBAAoB,CAAC;IACnC,UAAU,CAAC,EAAE,UAAU,CAAC;IACxB,QAAQ,CAAC,EAAE,MAAM,CAAC;IAClB,WAAW,CAAC,EAAE,MAAM,CAAC;IACrB,iBAAiB,CAAC,EAAE,MAAM,CAAC;IAC3B,sBAAsB,CAAC,EAAE,MAAM,CAAC;CACjC;AAED;;;GAGG;AACH,eAAO,MAAM,oBAAoB,aACtB,2BAA2B,KACnC;IACD,aAAa,EAAE,gBAAgB,CAAC;IAChC,yBAAyB,EAAE,CACzB,SAAS,CAAC,EAAE,6BAA6B,KACtC,gBAAgB,CAAC;IACtB,SAAS,EAAE,MAAM,CAAC;CA8GnB,CAAC"}
+{"version":3,"file":"useInitialAuthConfig.d.ts","sourceRoot":"","sources":["../../../src/nextjs/hooks/useInitialAuthConfig.ts"],"names":[],"mappings":"AASA,OAAO,KAAK,EAAE,gBAAgB,EAAE,MAAM,qCAAqC,CAAC;AAC5E,OAAO,KAAK,EAAE,oBAAoB,EAAE,MAAM,qCAAqC,CAAC;AAChF,OAAO,KAAK,EAAE,IAAI,EAAE,UAAU,EAAE,MAAM,YAAY,CAAC;AAGnD,MAAM,WAAW,2BAA2B;IAC1C,WAAW,CAAC,EAAE,oBAAoB,CAAC;IACnC,UAAU,CAAC,EAAE,UAAU,CAAC;IACxB,UAAU,CAAC,EAAE,IAAI,GAAG,IAAI,CAAC;IACzB,KAAK,CAAC,EAAE,MAAM,CAAC;IACf,sBAAsB,CAAC,EAAE,WAAW,GAAG,MAAM,CAAC;IAC9C,WAAW,CAAC,EAAE,MAAM,CAAC;IACrB,eAAe,CAAC,EAAE,MAAM,CAAC;IACzB,WAAW,CAAC,EAAE,CAAC,GAAG,EAAE,MAAM,EAAE,MAAM,CAAC,EAAE,MAAM,KAAK,IAAI,CAAC;CACtD;AAED,MAAM,WAAW,6BAA6B;IAC5C,WAAW,CAAC,EAAE,oBAAoB,CAAC;IACnC,UAAU,CAAC,EAAE,UAAU,CAAC;IACxB,QAAQ,CAAC,EAAE,MAAM,CAAC;IAClB,WAAW,CAAC,EAAE,MAAM,CAAC;IACrB,iBAAiB,CAAC,EAAE,MAAM,CAAC;IAC3B,sBAAsB,CAAC,EAAE,MAAM,CAAC;CACjC;AAED;;;GAGG;AACH,eAAO,MAAM,oBAAoB,aACtB,2BAA2B,KACnC;IACD,aAAa,EAAE,gBAAgB,CAAC;IAChC,yBAAyB,EAAE,CACzB,SAAS,CAAC,EAAE,6BAA6B,KACtC,gBAAgB,CAAC;IACtB,SAAS,EAAE,MAAM,CAAC;CAoHnB,CAAC"}

package/dist/nextjs/hooks/useInitialAuthConfig.js

@@ -15,18 +15,21 @@ export const useInitialAuthConfig = (options = {}) => {
     const router = useRouter();
     const pathname = usePathname();
     const resolvedConfig = resolveAuthConfig(options);
-    const { clientId, oauthServer, loginSuccessUrl, logoutUrl, refreshUrl, logoutCallbackUrl, targetContainerElement, } = resolvedConfig;
+    const { clientId, oauthServer, loginSuccessUrl, logoutUrl, refreshUrl, logoutCallbackUrl, callbackUrl, targetContainerElement, } = resolvedConfig;
     const baseConfig = useMemo(() => {
         return {
             clientId: clientId,
             loginUrl: typeof window !== "undefined"
                 ? window.location.origin + `/api/auth/login`
                 : undefined,
+            redirectUrl: typeof window !== "undefined"
+                ? window.location.origin + callbackUrl
+                : undefined,
             config: {
                 oauthServer: oauthServer,
                 oauthServerBaseUrl: oauthServer,
             },
-            logoutRedirectUrl: logoutUrl,
+            logoutRedirectUrl: logoutCallbackUrl,
             loginSuccessUrl: loginSuccessUrl,
             targetContainerElement: targetContainerElement,
             displayMode: options.displayMode,
@@ -75,6 +78,7 @@ export const useInitialAuthConfig = (options = {}) => {
         router,
         pathname,
         targetContainerElement,
+        callbackUrl,
         options.displayMode,
         options.iframeMode,
         options.serverUser,

package/dist/nextjs/hooks/useInitialAuthConfig.js.map

@@ -1 +1 @@
-{"version":3,"file":"useInitialAuthConfig.js","sourceRoot":"","sources":["../../../src/nextjs/hooks/useInitialAuthConfig.ts"],"names":[],"mappings":"AAAA;;;GAGG;AACH,YAAY,CAAC;AAEb,OAAO,EAAE,OAAO,EAAE,MAAM,OAAO,CAAC;AAChC,OAAO,EAAE,SAAS,EAAE,WAAW,EAAE,MAAM,oBAAoB,CAAC;AAC5D,OAAO,EAAE,iBAAiB,EAAE,MAAM,oBAAoB,CAAC;AAIvD,OAAO,EAAE,kBAAkB,EAAE,MAAM,qBAAqB,CAAC;AAsBzD;;;GAGG;AACH,MAAM,CAAC,MAAM,oBAAoB,GAAG,CAClC,UAAuC,EAAE,EAOzC,EAAE;IACF,MAAM,MAAM,GAAG,SAAS,EAAE,CAAC;IAC3B,MAAM,QAAQ,GAAG,WAAW,EAAE,CAAC;IAC/B,MAAM,cAAc,GAAG,iBAAiB,CAAC,OAAO,CAAC,CAAC;IAElD,MAAM,EACJ,QAAQ,EACR,WAAW,EACX,eAAe,EACf,SAAS,EACT,UAAU,EACV,iBAAiB,EACjB,sBAAsB,GACvB,GAAG,cAAc,CAAC;IAEnB,MAAM,UAAU,GAAqB,OAAO,CAAC,GAAG,EAAE;QAChD,OAAO;YACL,QAAQ,EAAE,QAAQ;YAClB,QAAQ,EACN,OAAO,MAAM,KAAK,WAAW;gBAC3B,CAAC,CAAC,MAAM,CAAC,QAAQ,CAAC,MAAM,GAAG,iBAAiB;gBAC5C,CAAC,CAAC,SAAS;YACf,MAAM,EAAE;gBACN,WAAW,EAAE,WAAW;gBACxB,kBAAkB,EAAE,WAAW;aAChC;YACD,iBAAiB,EAAE,SAAS;YAC5B,eAAe,EAAE,eAAe;YAChC,sBAAsB,EAAE,sBAAsB;YAC9C,WAAW,EAAE,OAAO,CAAC,WAAW;YAChC,UAAU,EAAE,OAAO,CAAC,UAAU;YAC9B,iBAAiB,EAAE,iBAAiB;YACpC,SAAS,EAAE,QAAQ;YACnB,OAAO,EAAE;gBACP,KAAK,EAAE,OAAO;gBACd,OAAO,EAAE,KAAK;aACf;YACD,gBAAgB,EAAE;gBAChB,IAAI,EAAE,gBAAgB;gBACtB,OAAO,EAAE,UAAU;gBACnB,MAAM,EAAE,SAAS;aAClB;YACD,QAAQ,EAAE,KAAK,EAAE,KAAK,EAAE,EAAE;gBACxB,IAAI,KAAK,EAAE,CAAC;oBACV,OAAO,CAAC,KAAK,CAAC,4BAA4B,EAAE,KAAK,CAAC,CAAC;oBACnD,OAAO;gBACT,CAAC;gBAED,IAAI,CAAC;oBACH,uEAAuE;oBACvE,MAAM,kBAAkB,CAAC,QAAQ,CAAC,CAAC;oBACnC,qBAAqB;oBACrB,IAAI,eAAe,IAAI,eAAe,KAAK,QAAQ,EAAE,CAAC;wBACpD,MAAM,CAAC,IAAI,CAAC,eAAe,CAAC,CAAC;oBAC/B,CAAC;gBACH,CAAC;gBAAC,OAAO,eAAe,EAAE,CAAC;oBACzB,OAAO,CAAC,KAAK,CAAC,gCAAgC,EAAE,eAAe,CAAC,CAAC;oBACjE,sDAAsD;oBACtD,MAAM,CAAC,OAAO,EAAE,CAAC;gBACnB,CAAC;YACH,CAAC;YACD,WAAW,EAAE,OAAO,CAAC,WAAW;YAChC,WAAW,EAAE,OAAO,CAAC,UAAU,IAAI,IAAI;YACvC,cAAc,EAAE,IAAI,EAAE,0CAA0C;SACjE,CAAC;IACJ,CAAC,EAAE;QACD,QAAQ;QACR,WAAW;QACX,eAAe;QACf,iBAAiB;QACjB,UAAU;QACV,SAAS;QACT,MAAM;QACN,QAAQ;QACR,sBAAsB;QACtB,OAAO,CAAC,WAAW;QACnB,OAAO,CAAC,UAAU;QAClB,OAAO,CAAC,UAAU;QAClB,OAAO,CAAC,WAAW;KACpB,CAAC,CAAC;IAEH,MAAM,yBAAyB,GAAG,OAAO,CAAC,GAAG,EAAE;QAC7C,OAAO,CACL,YAA2C,EAAE,EAC3B,EAAE;YACpB,OAAO;gBACL,GAAG,UAAU;gBACb,6DAA6D;gBAC7D,GAAG,CAAC,SAAS,CAAC,WAAW,IAAI,EAAE,WAAW,EAAE,SAAS,CAAC,WAAW,EAAE,CAAC;gBACpE,GAAG,CAAC,SAAS,CAAC,UAAU,KAAK,SAAS,IAAI;oBACxC,UAAU,EAAE,SAAS,CAAC,UAAU;iBACjC,CAAC;gBACF,GAAG,CAAC,SAAS,CAAC,QAAQ,IAAI,EAAE,QAAQ,EAAE,SAAS,CAAC,QAAQ,EAAE,CAAC;gBAC3D,GAAG,CAAC,SAAS,CAAC,WAAW,IAAI,EAAE,WAAW,EAAE,SAAS,CAAC,WAAW,EAAE,CAAC;gBACpE,GAAG,CAAC,SAAS,CAAC,iBAAiB,IAAI;oBACjC,iBAAiB,EAAE,SAAS,CAAC,iBAAiB;iBAC/C,CAAC;gBACF,GAAG,CAAC,SAAS,CAAC,sBAAsB,IAAI;oBACtC,sBAAsB,EAAE,SAAS,CAAC,sBAAsB;iBACzD,CAAC;aACH,CAAC;QACJ,CAAC,CAAC;IACJ,CAAC,EAAE,CAAC,UAAU,CAAC,CAAC,CAAC;IAEjB,OAAO;QACL,aAAa,EAAE,UAAU;QACzB,yBAAyB;QACzB,SAAS;KACV,CAAC;AACJ,CAAC,CAAC","sourcesContent":["/**\n * Hook for creating the initial auth configuration\n * Reusable across NextJS components that need to initialize GlobalAuthManager\n */\n\"use client\";\n\nimport { useMemo } from \"react\";\nimport { useRouter, usePathname } from \"next/navigation.js\";\nimport { resolveAuthConfig } from \"@/nextjs/config.js\";\nimport type { GlobalAuthConfig } from \"@/reactjs/core/GlobalAuthManager.js\";\nimport type { VanillaJSDisplayMode } from \"@/vanillajs/auth/types/AuthTypes.js\";\nimport type { User, IframeMode } from \"@/types.js\";\nimport { revalidateUserData } from \"@/nextjs/actions.js\";\n\nexport interface UseInitialAuthConfigOptions {\n  displayMode?: VanillaJSDisplayMode;\n  iframeMode?: IframeMode;\n  serverUser?: User | null;\n  nonce?: string;\n  targetContainerElement?: HTMLElement | string;\n  oauthServer?: string;\n  loginSuccessUrl?: string;\n  onUrlChange?: (url: string, source?: string) => void;\n}\n\nexport interface UseInitialAuthConfigOverrides {\n  displayMode?: VanillaJSDisplayMode;\n  iframeMode?: IframeMode;\n  clientId?: string;\n  redirectUrl?: string;\n  logoutRedirectUrl?: string;\n  targetContainerElement?: string;\n}\n\n/**\n * Hook that creates the initial auth configuration\n * Can be used standalone or merged with overrides\n */\nexport const useInitialAuthConfig = (\n  options: UseInitialAuthConfigOptions = {},\n): {\n  initialConfig: GlobalAuthConfig;\n  createConfigWithOverrides: (\n    overrides?: UseInitialAuthConfigOverrides,\n  ) => GlobalAuthConfig;\n  logoutUrl: string;\n} => {\n  const router = useRouter();\n  const pathname = usePathname();\n  const resolvedConfig = resolveAuthConfig(options);\n\n  const {\n    clientId,\n    oauthServer,\n    loginSuccessUrl,\n    logoutUrl,\n    refreshUrl,\n    logoutCallbackUrl,\n    targetContainerElement,\n  } = resolvedConfig;\n\n  const baseConfig: GlobalAuthConfig = useMemo(() => {\n    return {\n      clientId: clientId,\n      loginUrl:\n        typeof window !== \"undefined\"\n          ? window.location.origin + `/api/auth/login`\n          : undefined,\n      config: {\n        oauthServer: oauthServer,\n        oauthServerBaseUrl: oauthServer,\n      },\n      logoutRedirectUrl: logoutUrl,\n      loginSuccessUrl: loginSuccessUrl,\n      targetContainerElement: targetContainerElement,\n      displayMode: options.displayMode,\n      iframeMode: options.iframeMode,\n      logoutCallbackUrl: logoutCallbackUrl,\n      framework: \"nextjs\",\n      logging: {\n        level: \"debug\",\n        enabled: false,\n      },\n      backendEndpoints: {\n        user: \"/api/auth/user\",\n        refresh: refreshUrl,\n        logout: logoutUrl,\n      },\n      onSignIn: async (error) => {\n        if (error) {\n          console.error(\"onSignIn: Error signing in\", error);\n          return;\n        }\n\n        try {\n          // Trigger server-side revalidation to force NextAuthProvider to re-run\n          await revalidateUserData(pathname);\n          // Navigate if needed\n          if (loginSuccessUrl && loginSuccessUrl !== pathname) {\n            router.push(loginSuccessUrl);\n          }\n        } catch (revalidateError) {\n          console.error(\"onSignIn: Revalidation failed:\", revalidateError);\n          // Fallback to router.refresh() if server action fails\n          router.refresh();\n        }\n      },\n      onUrlChange: options.onUrlChange,\n      initialUser: options.serverUser || null,\n      initialIdToken: null, // ID token is httpOnly and not accessible\n    };\n  }, [\n    clientId,\n    oauthServer,\n    loginSuccessUrl,\n    logoutCallbackUrl,\n    refreshUrl,\n    logoutUrl,\n    router,\n    pathname,\n    targetContainerElement,\n    options.displayMode,\n    options.iframeMode,\n    options.serverUser,\n    options.onUrlChange,\n  ]);\n\n  const createConfigWithOverrides = useMemo(() => {\n    return (\n      overrides: UseInitialAuthConfigOverrides = {},\n    ): GlobalAuthConfig => {\n      return {\n        ...baseConfig,\n        // Override specific properties while keeping the base config\n        ...(overrides.displayMode && { displayMode: overrides.displayMode }),\n        ...(overrides.iframeMode !== undefined && {\n          iframeMode: overrides.iframeMode,\n        }),\n        ...(overrides.clientId && { clientId: overrides.clientId }),\n        ...(overrides.redirectUrl && { redirectUrl: overrides.redirectUrl }),\n        ...(overrides.logoutRedirectUrl && {\n          logoutRedirectUrl: overrides.logoutRedirectUrl,\n        }),\n        ...(overrides.targetContainerElement && {\n          targetContainerElement: overrides.targetContainerElement,\n        }),\n      };\n    };\n  }, [baseConfig]);\n\n  return {\n    initialConfig: baseConfig,\n    createConfigWithOverrides,\n    logoutUrl,\n  };\n};\n"]}
+{"version":3,"file":"useInitialAuthConfig.js","sourceRoot":"","sources":["../../../src/nextjs/hooks/useInitialAuthConfig.ts"],"names":[],"mappings":"AAAA;;;GAGG;AACH,YAAY,CAAC;AAEb,OAAO,EAAE,OAAO,EAAE,MAAM,OAAO,CAAC;AAChC,OAAO,EAAE,SAAS,EAAE,WAAW,EAAE,MAAM,oBAAoB,CAAC;AAC5D,OAAO,EAAE,iBAAiB,EAAE,MAAM,oBAAoB,CAAC;AAIvD,OAAO,EAAE,kBAAkB,EAAE,MAAM,qBAAqB,CAAC;AAsBzD;;;GAGG;AACH,MAAM,CAAC,MAAM,oBAAoB,GAAG,CAClC,UAAuC,EAAE,EAOzC,EAAE;IACF,MAAM,MAAM,GAAG,SAAS,EAAE,CAAC;IAC3B,MAAM,QAAQ,GAAG,WAAW,EAAE,CAAC;IAC/B,MAAM,cAAc,GAAG,iBAAiB,CAAC,OAAO,CAAC,CAAC;IAElD,MAAM,EACJ,QAAQ,EACR,WAAW,EACX,eAAe,EACf,SAAS,EACT,UAAU,EACV,iBAAiB,EACjB,WAAW,EACX,sBAAsB,GACvB,GAAG,cAAc,CAAC;IAEnB,MAAM,UAAU,GAAqB,OAAO,CAAC,GAAG,EAAE;QAChD,OAAO;YACL,QAAQ,EAAE,QAAQ;YAClB,QAAQ,EACN,OAAO,MAAM,KAAK,WAAW;gBAC3B,CAAC,CAAC,MAAM,CAAC,QAAQ,CAAC,MAAM,GAAG,iBAAiB;gBAC5C,CAAC,CAAC,SAAS;YACf,WAAW,EACT,OAAO,MAAM,KAAK,WAAW;gBAC3B,CAAC,CAAC,MAAM,CAAC,QAAQ,CAAC,MAAM,GAAG,WAAW;gBACtC,CAAC,CAAC,SAAS;YACf,MAAM,EAAE;gBACN,WAAW,EAAE,WAAW;gBACxB,kBAAkB,EAAE,WAAW;aAChC;YACD,iBAAiB,EAAE,iBAAiB;YACpC,eAAe,EAAE,eAAe;YAChC,sBAAsB,EAAE,sBAAsB;YAC9C,WAAW,EAAE,OAAO,CAAC,WAAW;YAChC,UAAU,EAAE,OAAO,CAAC,UAAU;YAC9B,iBAAiB,EAAE,iBAAiB;YACpC,SAAS,EAAE,QAAQ;YACnB,OAAO,EAAE;gBACP,KAAK,EAAE,OAAO;gBACd,OAAO,EAAE,KAAK;aACf;YACD,gBAAgB,EAAE;gBAChB,IAAI,EAAE,gBAAgB;gBACtB,OAAO,EAAE,UAAU;gBACnB,MAAM,EAAE,SAAS;aAClB;YACD,QAAQ,EAAE,KAAK,EAAE,KAAK,EAAE,EAAE;gBACxB,IAAI,KAAK,EAAE,CAAC;oBACV,OAAO,CAAC,KAAK,CAAC,4BAA4B,EAAE,KAAK,CAAC,CAAC;oBACnD,OAAO;gBACT,CAAC;gBAED,IAAI,CAAC;oBACH,uEAAuE;oBACvE,MAAM,kBAAkB,CAAC,QAAQ,CAAC,CAAC;oBACnC,qBAAqB;oBACrB,IAAI,eAAe,IAAI,eAAe,KAAK,QAAQ,EAAE,CAAC;wBACpD,MAAM,CAAC,IAAI,CAAC,eAAe,CAAC,CAAC;oBAC/B,CAAC;gBACH,CAAC;gBAAC,OAAO,eAAe,EAAE,CAAC;oBACzB,OAAO,CAAC,KAAK,CAAC,gCAAgC,EAAE,eAAe,CAAC,CAAC;oBACjE,sDAAsD;oBACtD,MAAM,CAAC,OAAO,EAAE,CAAC;gBACnB,CAAC;YACH,CAAC;YACD,WAAW,EAAE,OAAO,CAAC,WAAW;YAChC,WAAW,EAAE,OAAO,CAAC,UAAU,IAAI,IAAI;YACvC,cAAc,EAAE,IAAI,EAAE,0CAA0C;SACjE,CAAC;IACJ,CAAC,EAAE;QACD,QAAQ;QACR,WAAW;QACX,eAAe;QACf,iBAAiB;QACjB,UAAU;QACV,SAAS;QACT,MAAM;QACN,QAAQ;QACR,sBAAsB;QACtB,WAAW;QACX,OAAO,CAAC,WAAW;QACnB,OAAO,CAAC,UAAU;QAClB,OAAO,CAAC,UAAU;QAClB,OAAO,CAAC,WAAW;KACpB,CAAC,CAAC;IAEH,MAAM,yBAAyB,GAAG,OAAO,CAAC,GAAG,EAAE;QAC7C,OAAO,CACL,YAA2C,EAAE,EAC3B,EAAE;YACpB,OAAO;gBACL,GAAG,UAAU;gBACb,6DAA6D;gBAC7D,GAAG,CAAC,SAAS,CAAC,WAAW,IAAI,EAAE,WAAW,EAAE,SAAS,CAAC,WAAW,EAAE,CAAC;gBACpE,GAAG,CAAC,SAAS,CAAC,UAAU,KAAK,SAAS,IAAI;oBACxC,UAAU,EAAE,SAAS,CAAC,UAAU;iBACjC,CAAC;gBACF,GAAG,CAAC,SAAS,CAAC,QAAQ,IAAI,EAAE,QAAQ,EAAE,SAAS,CAAC,QAAQ,EAAE,CAAC;gBAC3D,GAAG,CAAC,SAAS,CAAC,WAAW,IAAI,EAAE,WAAW,EAAE,SAAS,CAAC,WAAW,EAAE,CAAC;gBACpE,GAAG,CAAC,SAAS,CAAC,iBAAiB,IAAI;oBACjC,iBAAiB,EAAE,SAAS,CAAC,iBAAiB;iBAC/C,CAAC;gBACF,GAAG,CAAC,SAAS,CAAC,sBAAsB,IAAI;oBACtC,sBAAsB,EAAE,SAAS,CAAC,sBAAsB;iBACzD,CAAC;aACH,CAAC;QACJ,CAAC,CAAC;IACJ,CAAC,EAAE,CAAC,UAAU,CAAC,CAAC,CAAC;IAEjB,OAAO;QACL,aAAa,EAAE,UAAU;QACzB,yBAAyB;QACzB,SAAS;KACV,CAAC;AACJ,CAAC,CAAC","sourcesContent":["/**\n * Hook for creating the initial auth configuration\n * Reusable across NextJS components that need to initialize GlobalAuthManager\n */\n\"use client\";\n\nimport { useMemo } from \"react\";\nimport { useRouter, usePathname } from \"next/navigation.js\";\nimport { resolveAuthConfig } from \"@/nextjs/config.js\";\nimport type { GlobalAuthConfig } from \"@/reactjs/core/GlobalAuthManager.js\";\nimport type { VanillaJSDisplayMode } from \"@/vanillajs/auth/types/AuthTypes.js\";\nimport type { User, IframeMode } from \"@/types.js\";\nimport { revalidateUserData } from \"@/nextjs/actions.js\";\n\nexport interface UseInitialAuthConfigOptions {\n  displayMode?: VanillaJSDisplayMode;\n  iframeMode?: IframeMode;\n  serverUser?: User | null;\n  nonce?: string;\n  targetContainerElement?: HTMLElement | string;\n  oauthServer?: string;\n  loginSuccessUrl?: string;\n  onUrlChange?: (url: string, source?: string) => void;\n}\n\nexport interface UseInitialAuthConfigOverrides {\n  displayMode?: VanillaJSDisplayMode;\n  iframeMode?: IframeMode;\n  clientId?: string;\n  redirectUrl?: string;\n  logoutRedirectUrl?: string;\n  targetContainerElement?: string;\n}\n\n/**\n * Hook that creates the initial auth configuration\n * Can be used standalone or merged with overrides\n */\nexport const useInitialAuthConfig = (\n  options: UseInitialAuthConfigOptions = {},\n): {\n  initialConfig: GlobalAuthConfig;\n  createConfigWithOverrides: (\n    overrides?: UseInitialAuthConfigOverrides,\n  ) => GlobalAuthConfig;\n  logoutUrl: string;\n} => {\n  const router = useRouter();\n  const pathname = usePathname();\n  const resolvedConfig = resolveAuthConfig(options);\n\n  const {\n    clientId,\n    oauthServer,\n    loginSuccessUrl,\n    logoutUrl,\n    refreshUrl,\n    logoutCallbackUrl,\n    callbackUrl,\n    targetContainerElement,\n  } = resolvedConfig;\n\n  const baseConfig: GlobalAuthConfig = useMemo(() => {\n    return {\n      clientId: clientId,\n      loginUrl:\n        typeof window !== \"undefined\"\n          ? window.location.origin + `/api/auth/login`\n          : undefined,\n      redirectUrl:\n        typeof window !== \"undefined\"\n          ? window.location.origin + callbackUrl\n          : undefined,\n      config: {\n        oauthServer: oauthServer,\n        oauthServerBaseUrl: oauthServer,\n      },\n      logoutRedirectUrl: logoutCallbackUrl,\n      loginSuccessUrl: loginSuccessUrl,\n      targetContainerElement: targetContainerElement,\n      displayMode: options.displayMode,\n      iframeMode: options.iframeMode,\n      logoutCallbackUrl: logoutCallbackUrl,\n      framework: \"nextjs\",\n      logging: {\n        level: \"debug\",\n        enabled: false,\n      },\n      backendEndpoints: {\n        user: \"/api/auth/user\",\n        refresh: refreshUrl,\n        logout: logoutUrl,\n      },\n      onSignIn: async (error) => {\n        if (error) {\n          console.error(\"onSignIn: Error signing in\", error);\n          return;\n        }\n\n        try {\n          // Trigger server-side revalidation to force NextAuthProvider to re-run\n          await revalidateUserData(pathname);\n          // Navigate if needed\n          if (loginSuccessUrl && loginSuccessUrl !== pathname) {\n            router.push(loginSuccessUrl);\n          }\n        } catch (revalidateError) {\n          console.error(\"onSignIn: Revalidation failed:\", revalidateError);\n          // Fallback to router.refresh() if server action fails\n          router.refresh();\n        }\n      },\n      onUrlChange: options.onUrlChange,\n      initialUser: options.serverUser || null,\n      initialIdToken: null, // ID token is httpOnly and not accessible\n    };\n  }, [\n    clientId,\n    oauthServer,\n    loginSuccessUrl,\n    logoutCallbackUrl,\n    refreshUrl,\n    logoutUrl,\n    router,\n    pathname,\n    targetContainerElement,\n    callbackUrl,\n    options.displayMode,\n    options.iframeMode,\n    options.serverUser,\n    options.onUrlChange,\n  ]);\n\n  const createConfigWithOverrides = useMemo(() => {\n    return (\n      overrides: UseInitialAuthConfigOverrides = {},\n    ): GlobalAuthConfig => {\n      return {\n        ...baseConfig,\n        // Override specific properties while keeping the base config\n        ...(overrides.displayMode && { displayMode: overrides.displayMode }),\n        ...(overrides.iframeMode !== undefined && {\n          iframeMode: overrides.iframeMode,\n        }),\n        ...(overrides.clientId && { clientId: overrides.clientId }),\n        ...(overrides.redirectUrl && { redirectUrl: overrides.redirectUrl }),\n        ...(overrides.logoutRedirectUrl && {\n          logoutRedirectUrl: overrides.logoutRedirectUrl,\n        }),\n        ...(overrides.targetContainerElement && {\n          targetContainerElement: overrides.targetContainerElement,\n        }),\n      };\n    };\n  }, [baseConfig]);\n\n  return {\n    initialConfig: baseConfig,\n    createConfigWithOverrides,\n    logoutUrl,\n  };\n};\n"]}

package/dist/nextjs/routeHandler.d.ts.map

@@ -1 +1 @@
-{"version":3,"file":"routeHandler.d.ts","sourceRoot":"","sources":["../../src/nextjs/routeHandler.ts"],"names":[],"mappings":"AAIA,OAAO,KAAK,EAAE,UAAU,EAAE,MAAM,oBAAoB,CAAC;AAIrD,OAAO,KAAK,EAAE,WAAW,EAAE,MAAM,gBAAgB,CAAC;AAClD,OAAO,EAAE,YAAY,EAAE,MAAM,gBAAgB,CAAC;AA2Q9C,wBAAsB,YAAY,CAChC,OAAO,EAAE,WAAW,EACpB,MAAM,EAAE,UAAU,GACjB,OAAO,CAAC,YAAY,CAAC,CAiFvB;AAED,wBAAsB,oBAAoB,CACxC,OAAO,EAAE,WAAW,EACpB,MAAM,EAAE,UAAU,GACjB,OAAO,CAAC,YAAY,CAAC,CAyDvB;AAED;;;;;;;;;;;GAWG;AACH,eAAO,MAAM,OAAO,iCAEF,WAAW,KAAG,OAAO,CAAC,YAAY,CAqCjD,CAAC"}
+{"version":3,"file":"routeHandler.d.ts","sourceRoot":"","sources":["../../src/nextjs/routeHandler.ts"],"names":[],"mappings":"AAIA,OAAO,KAAK,EAAE,UAAU,EAAE,MAAM,oBAAoB,CAAC;AAKrD,OAAO,KAAK,EAAE,WAAW,EAAE,MAAM,gBAAgB,CAAC;AAClD,OAAO,EAAE,YAAY,EAAE,MAAM,gBAAgB,CAAC;AAoR9C,wBAAsB,YAAY,CAChC,OAAO,EAAE,WAAW,EACpB,MAAM,EAAE,UAAU,GACjB,OAAO,CAAC,YAAY,CAAC,CA2EvB;AAED,wBAAsB,oBAAoB,CACxC,OAAO,EAAE,WAAW,EACpB,MAAM,EAAE,UAAU,GACjB,OAAO,CAAC,YAAY,CAAC,CA2DvB;AAED;;;;;;;;;;;GAWG;AACH,eAAO,MAAM,OAAO,iCAEF,WAAW,KAAG,OAAO,CAAC,YAAY,CAqCjD,CAAC"}

package/dist/nextjs/routeHandler.js

@@ -5,6 +5,7 @@ import { displayModeFromState } from "../lib/oauth.js";
 import { resolveAuthConfig } from "../nextjs/config.js";
 import { clearAuthCookies, NextjsCookieStorage } from "../nextjs/cookies.js";
 import { CodeVerifier, UserStorage } from "../shared/lib/types.js";
+import { revalidatePath } from "next/cache.js";
 import { NextResponse } from "next/server.js";
 const logger = loggers.nextjs.handlers.auth;
 class AuthError extends Error {
@@ -185,14 +186,25 @@ async function handleCallback(request, config) {
         return NextResponse.redirect(CivicAuth.toAbsoluteUrl(urlDetectionRequest, "/?error=callback_failed", appUrl));
     }
 }
+const revalidateUrlPath = async (url) => {
+    try {
+        const path = new URL(url).pathname;
+        revalidatePath(path);
+    }
+    catch (error) {
+        logger.warn("Failed to revalidate path after logout:", error);
+    }
+};
 export async function handleLogout(request, config) {
     const resolvedConfigs = resolveAuthConfig(config);
+    // Get framework-agnostic request for URL utilities
+    const urlDetectionRequest = toUrlDetectionRequest(request);
+    const appUrl = CivicAuth.getAppUrl(urlDetectionRequest);
+    // Read the state from the query parameters
+    const state = request.nextUrl.searchParams.get("state");
+    const clientLogoutRedirectUrl = request.nextUrl.searchParams.get("logoutRedirectUrl");
     try {
         logger.info("[LOGOUT_HANDLER] Backend logout endpoint called");
-        // Check for client-provided logoutRedirectUrl query parameter
-        const requestUrl = new URL(request.url);
-        const clientLogoutRedirectUrl = requestUrl.searchParams.get("logoutRedirectUrl");
-        const frontendState = new URL(request.url).searchParams.get("state");
         // If client provided a logoutRedirectUrl, override the config
         let configToUse = resolvedConfigs;
         if (clientLogoutRedirectUrl) {
@@ -206,43 +218,39 @@ export async function handleLogout(request, config) {
             });
         }
         const { civicAuth } = createCivicAuth(request, configToUse);
+        // Always redirect to OAuth logout (like main branch)
+        // Don't validate session - even invalid local sessions should hit OAuth logout
+        logger.info("[LOGOUT_HANDLER] Processing logout request", {
+            state: !!state,
+        });
+        // Always redirect to OAuth logout endpoint (like main branch)
+        // Client-side iframe logic will handle completion and redirect appropriately
         const logoutUrl = await civicAuth.buildLogoutRedirectUrl({
-            state: frontendState || undefined,
+            state: state || undefined,
         });
-        await civicAuth.clearTokens();
-        // Convert to URL object to modify parameters
-        const url = new URL(logoutUrl.toString());
-        // Remove the state parameter to avoid it showing up in the frontend URL
-        url.searchParams.delete("state");
-        logger.info("[LOGOUT_HANDLER] Returning logout URL for client-side iframe handling", {
-            logoutUrl: url.toString(),
+        try {
+            await civicAuth.clearTokens();
+            // Revalidate current path to update authentication state in server components
+            await revalidateUrlPath(request.url);
+        }
+        catch (error) {
+            logger.error("[LOGOUT_HANDLER] Error clearing tokens:", error);
+        }
+        // Remove state parameter from logout URL to prevent it from appearing in frontend URL
+        const cleanLogoutUrl = new URL(logoutUrl);
+        cleanLogoutUrl.searchParams.delete("state");
+        logger.info("[LOGOUT_HANDLER] Redirecting to OAuth logout endpoint", {
+            logoutUrl: cleanLogoutUrl.toString(),
         });
-        return NextResponse.redirect(url.toString());
+        return NextResponse.redirect(cleanLogoutUrl.toString());
     }
     catch (error) {
         logger.error("[LOGOUT_HANDLER] Logout error:", error);
         // If logout URL generation fails, clear tokens and redirect to home
-        try {
-            const { civicAuth } = createCivicAuth(request, resolvedConfigs);
-            await civicAuth.clearTokens();
-            // Use client-provided logoutRedirectUrl for fallback too
-            const requestUrl = new URL(request.url);
-            const clientLogoutRedirectUrl = requestUrl.searchParams.get("logoutRedirectUrl");
-            const urlDetectionRequest = toUrlDetectionRequest(request);
-            const appUrl = CivicAuth.getAppUrl(urlDetectionRequest);
-            const fallbackUrl = clientLogoutRedirectUrl || resolvedConfigs.logoutCallbackUrl;
-            return NextResponse.redirect(CivicAuth.toAbsoluteUrl(urlDetectionRequest, fallbackUrl, appUrl));
-        }
-        catch (clearError) {
-            logger.error("[LOGOUT_HANDLER] Failed to clear tokens:", clearError);
-            // Final fallback
-            const requestUrl = new URL(request.url);
-            const clientLogoutRedirectUrl = requestUrl.searchParams.get("logoutRedirectUrl");
-            const urlDetectionRequest = toUrlDetectionRequest(request);
-            const appUrl = CivicAuth.getAppUrl(urlDetectionRequest);
-            const fallbackUrl = clientLogoutRedirectUrl || resolvedConfigs.logoutCallbackUrl;
-            return NextResponse.redirect(CivicAuth.toAbsoluteUrl(urlDetectionRequest, fallbackUrl, appUrl));
-        }
+        await clearAuthCookies();
+        const fallbackUrl = clientLogoutRedirectUrl || resolvedConfigs.logoutCallbackUrl;
+        const finalFallbackUrl = CivicAuth.toAbsoluteUrl(urlDetectionRequest, fallbackUrl, appUrl);
+        return NextResponse.redirect(finalFallbackUrl);
     }
 }
 export async function handleLogoutCallback(request, config) {
@@ -271,6 +279,8 @@ export async function handleLogoutCallback(request, config) {
             logoutCallbackUrl: resolvedConfigs.logoutCallbackUrl,
             redirectUrl,
         });
+        // Revalidate the redirect path to update authentication state in server components
+        await revalidateUrlPath(redirectUrl);
         return NextResponse.redirect(redirectUrl);
     }
     catch (error) {

package/dist/nextjs/routeHandler.js.map

@@ -1 +1 @@
-{"version":3,"file":"routeHandler.js","sourceRoot":"","sources":["../../src/nextjs/routeHandler.ts"],"names":[],"mappings":"AAAA,OAAO,EAAE,SAAS,EAA4B,MAAM,oBAAoB,CAAC;AACzE,OAAO,EAAE,mBAAmB,EAAE,MAAM,gBAAgB,CAAC;AACrD,OAAO,EAAE,OAAO,EAAE,MAAM,iBAAiB,CAAC;AAC1C,OAAO,EAAE,oBAAoB,EAAE,MAAM,gBAAgB,CAAC;AAEtD,OAAO,EAAE,iBAAiB,EAAE,MAAM,oBAAoB,CAAC;AACvD,OAAO,EAAE,gBAAgB,EAAE,mBAAmB,EAAE,MAAM,qBAAqB,CAAC;AAC5E,OAAO,EAAE,YAAY,EAAE,WAAW,EAAE,MAAM,uBAAuB,CAAC;AAElE,OAAO,EAAE,YAAY,EAAE,MAAM,gBAAgB,CAAC;AAE9C,MAAM,MAAM,GAAG,OAAO,CAAC,MAAM,CAAC,QAAQ,CAAC,IAAI,CAAC;AAE5C,MAAM,SAAU,SAAQ,KAAK;IAGT;IAFlB,YACE,OAAe,EACC,SAAiB,GAAG;QAEpC,KAAK,CAAC,OAAO,CAAC,CAAC;QAFC,WAAM,GAAN,MAAM,CAAc;QAGpC,IAAI,CAAC,IAAI,GAAG,WAAW,CAAC;IAC1B,CAAC;CACF;AAED;;GAEG;AACH,MAAM,qBAAqB,GAAG,CAAC,OAAoB,EAAuB,EAAE,CAAC,CAAC;IAC5E,GAAG,EAAE,OAAO,CAAC,GAAG;IAChB,OAAO,EAAE,MAAM,CAAC,WAAW,CAAC,OAAO,CAAC,OAAO,CAAC,OAAO,EAAE,CAAC;IACtD,YAAY,EAAE;QACZ,GAAG,EAAE,CAAC,IAAY,EAAE,EAAE,CAAC,OAAO,CAAC,OAAO,CAAC,YAAY,CAAC,GAAG,CAAC,IAAI,CAAC;KAC9D;IACD,OAAO,EAAE;QACP,GAAG,EAAE,CAAC,IAAY,EAAE,EAAE,CAAC,OAAO,CAAC,OAAO,CAAC,GAAG,CAAC,IAAI,CAAC;KACjD;CACF,CAAC,CAAC;AAEH;;;GAGG;AACH,MAAM,eAAe,GAAG,CAAC,OAAoB,EAAE,MAAkB,EAAE,EAAE;IACnE,MAAM,cAAc,GAAG,iBAAiB,CAAC,MAAM,CAAC,CAAC;IACjD,MAAM,aAAa,GAAG,IAAI,mBAAmB,CAAC;QAC5C,GAAG,cAAc,CAAC,OAAO,EAAE,MAAM;QACjC,CAAC,WAAW,CAAC,IAAI,CAAC,EAAE,cAAc,CAAC,OAAO,EAAE,IAAI;KACjD,CAAC,CAAC;IAEH,+CAA+C;IAC/C,MAAM,mBAAmB,GAAG,qBAAqB,CAAC,OAAO,CAAC,CAAC;IAE3D,kDAAkD;IAClD,MAAM,YAAY,GAAG,SAAS,CAAC,SAAS,CAAC,mBAAmB,CAAC,CAAC;IAE9D,mEAAmE;IACnE,mEAAmE;IACnE,MAAM,MAAM,GACV,cAAc,CAAC,OAAO;QACtB,YAAY;QACZ,IAAI,GAAG,CAAC,mBAAmB,CAAC,GAAG,CAAC,CAAC,MAAM,CAAC;IAE1C,8DAA8D;IAC9D,MAAM,mBAAmB,GAAG,cAAc,CAAC,WAAW,CAAC,UAAU,CAAC,MAAM,CAAC;QACvE,CAAC,CAAC,cAAc,CAAC,WAAW;QAC5B,CAAC,CAAC,SAAS,CAAC,aAAa,CACrB,mBAAmB,EACnB,cAAc,CAAC,WAAW,EAC1B,MAAM,CACP,CAAC;IACN,MAAM,yBAAyB,GAAG,cAAc,CAAC,iBAAiB,CAAC,UAAU,CAC3E,MAAM,CACP;QACC,CAAC,CAAC,cAAc,CAAC,iBAAiB;QAClC,CAAC,CAAC,SAAS,CAAC,aAAa,CACrB,mBAAmB,EACnB,cAAc,CAAC,iBAAiB,EAChC,MAAM,CACP,CAAC;IAEN,MAAM,SAAS,GAAG,IAAI,SAAS,CAAC,aAAa,EAAE;QAC7C,QAAQ,EAAE,cAAc,CAAC,QAAQ;QACjC,WAAW,EAAE,mBAAmB;QAChC,WAAW,EAAE,cAAc,CAAC,WAAW;QACvC,qBAAqB,EAAE,yBAAyB;QAChD,eAAe,EAAE,OAAO,CAAC,GAAG;KAC7B,CAAC,CAAC;IAEH,OAAO;QACL,SAAS;QACT,aAAa;QACb,MAAM,EAAE,2CAA2C;QACnD,mBAAmB,EAAE,6BAA6B;KACnD,CAAC;AACJ,CAAC,CAAC;AAEF;;;GAGG;AACH,KAAK,UAAU,WAAW,CACxB,OAAoB,EACpB,MAAkB;IAElB,MAAM,eAAe,GAAG,iBAAiB,CAAC,MAAM,CAAC,CAAC;IAElD,IAAI,CAAC;QACH,MAAM,aAAa,GAAG,OAAO,CAAC,OAAO,CAAC,YAAY,CAAC,GAAG,CAAC,OAAO,CAAC,CAAC;QAEhE,wDAAwD;QACxD,MAAM,eAAe,GAAG,OAAO,CAAC,OAAO,CAAC,YAAY,CAAC,GAAG,CAAC,QAAQ,CAAC,CAAC;QACnE,IAAI,eAAe,EAAE,CAAC;YACpB,MAAM,aAAa,GAAG,IAAI,mBAAmB,CAC3C,eAAe,CAAC,OAAO,EAAE,MAAM,IAAI,EAAE,CACtC,CAAC;YACF,MAAM,aAAa,CAAC,GAAG,CAAC,YAAY,CAAC,OAAO,EAAE,eAAe,CAAC,CAAC;QACjE,CAAC;QAED,MAAM,EAAE,SAAS,EAAE,GAAG,eAAe,CAAC,OAAO,EAAE,eAAe,CAAC,CAAC;QAEhE,MAAM,GAAG,GAAG,MAAM,SAAS,CAAC,aAAa,CAAC;YACxC,KAAK,EAAE,aAAa,IAAI,SAAS;SAClC,CAAC,CAAC;QAEH,MAAM,CAAC,IAAI,CAAC,gDAAgD,EAAE;YAC5D,QAAQ,EAAE,GAAG,CAAC,QAAQ,EAAE;SACzB,CAAC,CAAC;QAEH,OAAO,YAAY,CAAC,QAAQ,CAAC,GAAG,CAAC,QAAQ,EAAE,CAAC,CAAC;IAC/C,CAAC;IAAC,OAAO,KAAK,EAAE,CAAC;QACf,MAAM,CAAC,KAAK,CAAC,sCAAsC,EAAE,KAAK,CAAC,CAAC;QAC5D,MAAM,mBAAmB,GAAG,qBAAqB,CAAC,OAAO,CAAC,CAAC;QAC3D,MAAM,MAAM,GAAG,SAAS,CAAC,SAAS,CAAC,mBAAmB,CAAC,CAAC;QACxD,OAAO,YAAY,CAAC,QAAQ,CAC1B,SAAS,CAAC,aAAa,CACrB,mBAAmB,EACnB,sBAAsB,EACtB,MAAM,CACP,CACF,CAAC;IACJ,CAAC;AACH,CAAC;AAED,KAAK,UAAU,aAAa,CAC1B,OAAoB,EACpB,MAAkB;IAElB,MAAM,eAAe,GAAG,iBAAiB,CAAC,MAAM,CAAC,CAAC;IAElD,IAAI,CAAC;QACH,MAAM,EAAE,SAAS,EAAE,GAAG,eAAe,CAAC,OAAO,EAAE,eAAe,CAAC,CAAC;QAEhE,MAAM,SAAS,CAAC,aAAa,EAAE,CAAC;QAEhC,MAAM,CAAC,IAAI,CAAC,iDAAiD,CAAC,CAAC;QAE/D,MAAM,SAAS,GAAG,OAAO,CAAC,OAAO,CAAC,YAAY,CAAC,GAAG,CAAC,WAAW,CAAC,CAAC;QAChE,IAAI,SAAS,EAAE,CAAC;YACd,4EAA4E;YAC5E,MAAM,QAAQ,GAAG,YAAY,CAAC,QAAQ,CAAC,SAAS,CAAC,CAAC;YAClD,QAAQ,CAAC,OAAO,CAAC,MAAM,CAAC,qBAAqB,CAAC,CAAC;YAC/C,OAAO,QAAQ,CAAC;QAClB,CAAC;QAED,OAAO,YAAY,CAAC,IAAI,CAAC;YACvB,MAAM,EAAE,SAAS;YACjB,OAAO,EAAE,kBAAkB;SAC5B,CAAC,CAAC;IACL,CAAC;IAAC,OAAO,KAAK,EAAE,CAAC;QACf,MAAM,CAAC,KAAK,CAAC,wCAAwC,EAAE,KAAK,CAAC,CAAC;QAC9D,MAAM,SAAS,GAAG,OAAO,CAAC,OAAO,CAAC,YAAY,CAAC,GAAG,CAAC,WAAW,CAAC,CAAC;QAChE,IAAI,SAAS,EAAE,CAAC;YACd,OAAO,YAAY,CAAC,QAAQ,CAAC,SAAS,CAAC,CAAC;QAC1C,CAAC;QACD,OAAO,YAAY,CAAC,IAAI,CACtB,EAAE,KAAK,EAAE,sBAAsB,EAAE,EACjC,EAAE,MAAM,EAAE,GAAG,EAAE,CAChB,CAAC;IACJ,CAAC;AACH,CAAC;AAED,KAAK,UAAU,cAAc,CAC3B,OAAoB,EACpB,MAAkB;IAElB,MAAM,eAAe,GAAG,iBAAiB,CAAC,MAAM,CAAC,CAAC;IAClD,MAAM,IAAI,GAAG,OAAO,CAAC,OAAO,CAAC,YAAY,CAAC,GAAG,CAAC,MAAM,CAAC,CAAC;IACtD,MAAM,KAAK,GAAG,OAAO,CAAC,OAAO,CAAC,YAAY,CAAC,GAAG,CAAC,OAAO,CAAC,CAAC;IACxD,MAAM,KAAK,GAAG,OAAO,CAAC,OAAO,CAAC,YAAY,CAAC,GAAG,CAAC,OAAO,CAAC,CAAC;IAExD,IAAI,KAAK,EAAE,CAAC;QACV,MAAM,CAAC,KAAK,CAAC,0BAA0B,EAAE,KAAK,CAAC,CAAC;QAChD,MAAM,mBAAmB,GAAG,qBAAqB,CAAC,OAAO,CAAC,CAAC;QAC3D,MAAM,MAAM,GAAG,SAAS,CAAC,SAAS,CAAC,mBAAmB,CAAC,CAAC;QACxD,OAAO,YAAY,CAAC,QAAQ,CAC1B,SAAS,CAAC,aAAa,CACrB,mBAAmB,EACnB,qBAAqB,EACrB,MAAM,CACP,CACF,CAAC;IACJ,CAAC;IAED,IAAI,CAAC,IAAI,IAAI,CAAC,KAAK;QAAE,MAAM,IAAI,SAAS,CAAC,gBAAgB,EAAE,GAAG,CAAC,CAAC;IAEhE,IAAI,CAAC;QACH,MAAM,EAAE,SAAS,EAAE,MAAM,EAAE,mBAAmB,EAAE,GAAG,eAAe,CAChE,OAAO,EACP,eAAe,CAChB,CAAC;QAEF,+DAA+D;QAC/D,MAAM,qBAAqB,GAAG;YAC5B,OAAO,EAAE,MAAM,CAAC,WAAW,CAAC,OAAO,CAAC,OAAO,CAAC,OAAO,EAAE,CAAC;YACtD,GAAG,EAAE,OAAO,CAAC,GAAG,CAAC,QAAQ,EAAE;SAC5B,CAAC;QAEF,mDAAmD;QACnD,MAAM,eAAe,GAAG,SAAS,CAAC,kBAAkB,CAClD,mBAAmB,EACnB,MAAM,CACP,CAAC;QACF,MAAM,WAAW,GACf,eAAe,IAAI,eAAe,CAAC,eAAe,IAAI,GAAG,CAAC;QAE5D,yCAAyC;QACzC,MAAM,MAAM,GAAG,MAAM,SAAS,CAAC,cAAc,CAC3C;YACE,IAAI;YACJ,KAAK;YACL,GAAG,EAAE,qBAAqB;SAC3B,EACD;YACE,yCAAyC;YACzC,WAAW,EAAE,WAAW;SACzB,CACF,CAAC;QAEF,IAAI,MAAM,CAAC,UAAU,EAAE,CAAC;YACtB,OAAO,YAAY,CAAC,QAAQ,CAC1B,SAAS,CAAC,aAAa,CAAC,mBAAmB,EAAE,MAAM,CAAC,UAAU,EAAE,MAAM,CAAC,CACxE,CAAC;QACJ,CAAC;QAED,IAAI,MAAM,CAAC,OAAO,EAAE,CAAC;YACnB,gDAAgD;YAChD,IAAI,OAAO,MAAM,CAAC,OAAO,KAAK,QAAQ,EAAE,CAAC;gBACvC,OAAO,IAAI,YAAY,CAAC,MAAM,CAAC,OAAO,EAAE;oBACtC,MAAM,EAAE,GAAG;oBACX,OAAO,EAAE;wBACP,cAAc,EAAE,WAAW;qBAC5B;iBACF,CAAC,CAAC;YACL,CAAC;iBAAM,CAAC;gBACN,iCAAiC;gBACjC,OAAO,YAAY,CAAC,IAAI,CAAC,MAAM,CAAC,OAAO,CAAC,CAAC;YAC3C,CAAC;QACH,CAAC;QAED,oBAAoB;QACpB,OAAO,YAAY,CAAC,QAAQ,CAC1B,SAAS,CAAC,aAAa,CAAC,mBAAmB,EAAE,GAAG,EAAE,MAAM,CAAC,CAC1D,CAAC;IACJ,CAAC;IAAC,OAAO,KAAK,EAAE,CAAC;QACf,MAAM,CAAC,KAAK,CAAC,0CAA0C,EAAE,KAAK,CAAC,CAAC;QAChE,MAAM,mBAAmB,GAAG,qBAAqB,CAAC,OAAO,CAAC,CAAC;QAC3D,MAAM,MAAM,GAAG,SAAS,CAAC,SAAS,CAAC,mBAAmB,CAAC,CAAC;QACxD,OAAO,YAAY,CAAC,QAAQ,CAC1B,SAAS,CAAC,aAAa,CACrB,mBAAmB,EACnB,yBAAyB,EACzB,MAAM,CACP,CACF,CAAC;IACJ,CAAC;AACH,CAAC;AAED,MAAM,CAAC,KAAK,UAAU,YAAY,CAChC,OAAoB,EACpB,MAAkB;IAElB,MAAM,eAAe,GAAG,iBAAiB,CAAC,MAAM,CAAC,CAAC;IAElD,IAAI,CAAC;QACH,MAAM,CAAC,IAAI,CAAC,iDAAiD,CAAC,CAAC;QAE/D,8DAA8D;QAC9D,MAAM,UAAU,GAAG,IAAI,GAAG,CAAC,OAAO,CAAC,GAAG,CAAC,CAAC;QACxC,MAAM,uBAAuB,GAC3B,UAAU,CAAC,YAAY,CAAC,GAAG,CAAC,mBAAmB,CAAC,CAAC;QACnD,MAAM,aAAa,GAAG,IAAI,GAAG,CAAC,OAAO,CAAC,GAAG,CAAC,CAAC,YAAY,CAAC,GAAG,CAAC,OAAO,CAAC,CAAC;QAErE,8DAA8D;QAC9D,IAAI,WAAW,GAAG,eAAe,CAAC;QAClC,IAAI,uBAAuB,EAAE,CAAC;YAC5B,WAAW,GAAG;gBACZ,GAAG,eAAe;gBAClB,iBAAiB,EAAE,uBAAuB;aAC3C,CAAC;YACF,MAAM,CAAC,IAAI,CAAC,iDAAiD,EAAE;gBAC7D,QAAQ,EAAE,eAAe,CAAC,iBAAiB;gBAC3C,QAAQ,EAAE,uBAAuB;aAClC,CAAC,CAAC;QACL,CAAC;QAED,MAAM,EAAE,SAAS,EAAE,GAAG,eAAe,CAAC,OAAO,EAAE,WAAW,CAAC,CAAC;QAE5D,MAAM,SAAS,GAAG,MAAM,SAAS,CAAC,sBAAsB,CAAC;YACvD,KAAK,EAAE,aAAa,IAAI,SAAS;SAClC,CAAC,CAAC;QACH,MAAM,SAAS,CAAC,WAAW,EAAE,CAAC;QAE9B,6CAA6C;QAC7C,MAAM,GAAG,GAAG,IAAI,GAAG,CAAC,SAAS,CAAC,QAAQ,EAAE,CAAC,CAAC;QAC1C,wEAAwE;QACxE,GAAG,CAAC,YAAY,CAAC,MAAM,CAAC,OAAO,CAAC,CAAC;QAEjC,MAAM,CAAC,IAAI,CACT,uEAAuE,EACvE;YACE,SAAS,EAAE,GAAG,CAAC,QAAQ,EAAE;SAC1B,CACF,CAAC;QAEF,OAAO,YAAY,CAAC,QAAQ,CAAC,GAAG,CAAC,QAAQ,EAAE,CAAC,CAAC;IAC/C,CAAC;IAAC,OAAO,KAAK,EAAE,CAAC;QACf,MAAM,CAAC,KAAK,CAAC,gCAAgC,EAAE,KAAK,CAAC,CAAC;QACtD,oEAAoE;QACpE,IAAI,CAAC;YACH,MAAM,EAAE,SAAS,EAAE,GAAG,eAAe,CAAC,OAAO,EAAE,eAAe,CAAC,CAAC;YAChE,MAAM,SAAS,CAAC,WAAW,EAAE,CAAC;YAE9B,yDAAyD;YACzD,MAAM,UAAU,GAAG,IAAI,GAAG,CAAC,OAAO,CAAC,GAAG,CAAC,CAAC;YACxC,MAAM,uBAAuB,GAC3B,UAAU,CAAC,YAAY,CAAC,GAAG,CAAC,mBAAmB,CAAC,CAAC;YACnD,MAAM,mBAAmB,GAAG,qBAAqB,CAAC,OAAO,CAAC,CAAC;YAC3D,MAAM,MAAM,GAAG,SAAS,CAAC,SAAS,CAAC,mBAAmB,CAAC,CAAC;YACxD,MAAM,WAAW,GACf,uBAAuB,IAAI,eAAe,CAAC,iBAAiB,CAAC;YAE/D,OAAO,YAAY,CAAC,QAAQ,CAC1B,SAAS,CAAC,aAAa,CAAC,mBAAmB,EAAE,WAAW,EAAE,MAAM,CAAC,CAClE,CAAC;QACJ,CAAC;QAAC,OAAO,UAAU,EAAE,CAAC;YACpB,MAAM,CAAC,KAAK,CAAC,0CAA0C,EAAE,UAAU,CAAC,CAAC;YAErE,iBAAiB;YACjB,MAAM,UAAU,GAAG,IAAI,GAAG,CAAC,OAAO,CAAC,GAAG,CAAC,CAAC;YACxC,MAAM,uBAAuB,GAC3B,UAAU,CAAC,YAAY,CAAC,GAAG,CAAC,mBAAmB,CAAC,CAAC;YACnD,MAAM,mBAAmB,GAAG,qBAAqB,CAAC,OAAO,CAAC,CAAC;YAC3D,MAAM,MAAM,GAAG,SAAS,CAAC,SAAS,CAAC,mBAAmB,CAAC,CAAC;YACxD,MAAM,WAAW,GACf,uBAAuB,IAAI,eAAe,CAAC,iBAAiB,CAAC;YAE/D,OAAO,YAAY,CAAC,QAAQ,CAC1B,SAAS,CAAC,aAAa,CAAC,mBAAmB,EAAE,WAAW,EAAE,MAAM,CAAC,CAClE,CAAC;QACJ,CAAC;IACH,CAAC;AACH,CAAC;AAED,MAAM,CAAC,KAAK,UAAU,oBAAoB,CACxC,OAAoB,EACpB,MAAkB;IAElB,MAAM,eAAe,GAAG,iBAAiB,CAAC,MAAM,CAAC,CAAC;IAElD,IAAI,CAAC;QACH,MAAM,CAAC,IAAI,CACT,mEAAmE,CACpE,CAAC;QAEF,+BAA+B;QAC/B,MAAM,gBAAgB,EAAE,CAAC;QAEzB,+DAA+D;QAC/D,MAAM,mBAAmB,GAAG,qBAAqB,CAAC,OAAO,CAAC,CAAC;QAC3D,MAAM,EAAE,SAAS,EAAE,GAAG,eAAe,CAAC,OAAO,EAAE,eAAe,CAAC,CAAC;QAEhE,+CAA+C;QAC/C,MAAM,KAAK,GAAG,OAAO,CAAC,OAAO,CAAC,YAAY,CAAC,GAAG,CAAC,OAAO,CAAC,CAAC;QAExD,uEAAuE;QACvE,IAAI,KAAK,IAAI,oBAAoB,CAAC,KAAK,EAAE,QAAQ,CAAC,KAAK,QAAQ,EAAE,CAAC;YAChE,oEAAoE;YACpE,MAAM,qBAAqB,GACzB,SAAS,CAAC,wBAAwB,CAAC,mBAAmB,CAAC,CAAC;YAC1D,MAAM,QAAQ,GAAG,IAAI,YAAY,CAC/B,8CAA8C,mBAAmB,YAAY,qBAAqB,gEAAgE,CACnK,CAAC;YACF,QAAQ,CAAC,OAAO,CAAC,GAAG,CAAC,cAAc,EAAE,0BAA0B,CAAC,CAAC;YACjE,MAAM,CAAC,IAAI,CACT,gEAAgE,EAChE,EAAE,qBAAqB,EAAE,CAC1B,CAAC;YACF,OAAO,QAAQ,CAAC;QAClB,CAAC;QAED,kFAAkF;QAClF,MAAM,WAAW,GAAG,SAAS,CAAC,wBAAwB,CAAC,mBAAmB,CAAC,CAAC;QAC5E,MAAM,CAAC,IAAI,CACT,8DAA8D,EAC9D;YACE,iBAAiB,EAAE,eAAe,CAAC,iBAAiB;YACpD,WAAW;SACZ,CACF,CAAC;QAEF,OAAO,YAAY,CAAC,QAAQ,CAAC,WAAW,CAAC,CAAC;IAC5C,CAAC;IAAC,OAAO,KAAK,EAAE,CAAC;QACf,MAAM,CAAC,KAAK,CAAC,kDAAkD,EAAE,KAAK,CAAC,CAAC;QACxE,MAAM,mBAAmB,GAAG,qBAAqB,CAAC,OAAO,CAAC,CAAC;QAC3D,MAAM,MAAM,GAAG,SAAS,CAAC,SAAS,CAAC,mBAAmB,CAAC,CAAC;QACxD,OAAO,YAAY,CAAC,QAAQ,CAC1B,SAAS,CAAC,aAAa,CACrB,mBAAmB,EACnB,eAAe,CAAC,iBAAiB,EACjC,MAAM,CACP,CACF,CAAC;IACJ,CAAC;AACH,CAAC;AAED;;;;;;;;;;;GAWG;AACH,MAAM,CAAC,MAAM,OAAO,GAClB,CAAC,UAAU,GAAG,EAAE,EAAE,EAAE,CACpB,KAAK,EAAE,OAAoB,EAAyB,EAAE;IACpD,MAAM,MAAM,GAAG,iBAAiB,CAAC,UAAU,CAAC,CAAC;IAE7C,IAAI,CAAC;QACH,MAAM,QAAQ,GAAG,OAAO,CAAC,OAAO,CAAC,QAAQ,CAAC;QAC1C,MAAM,YAAY,GAAG,QAAQ,CAAC,KAAK,CAAC,GAAG,CAAC,CAAC;QACzC,MAAM,WAAW,GAAG,YAAY,CAAC,YAAY,CAAC,MAAM,GAAG,CAAC,CAAC,CAAC;QAE1D,QAAQ,WAAW,EAAE,CAAC;YACpB,KAAK,WAAW,CAAC;YACjB,KAAK,OAAO;gBACV,OAAO,MAAM,WAAW,CAAC,OAAO,EAAE,MAAM,CAAC,CAAC;YAC5C,KAAK,UAAU;gBACb,OAAO,MAAM,cAAc,CAAC,OAAO,EAAE,MAAM,CAAC,CAAC;YAC/C,KAAK,SAAS;gBACZ,OAAO,MAAM,aAAa,CAAC,OAAO,EAAE,MAAM,CAAC,CAAC;YAC9C,KAAK,QAAQ;gBACX,OAAO,MAAM,YAAY,CAAC,OAAO,EAAE,MAAM,CAAC,CAAC;YAC7C,KAAK,gBAAgB;gBACnB,OAAO,MAAM,oBAAoB,CAAC,OAAO,EAAE,MAAM,CAAC,CAAC;YACrD,KAAK,MAAM;gBACT,OAAO,MAAM,UAAU,CAAC,OAAO,EAAE,MAAM,CAAC,CAAC;YAC3C;gBACE,MAAM,IAAI,SAAS,CAAC,uBAAuB,QAAQ,EAAE,EAAE,GAAG,CAAC,CAAC;QAChE,CAAC;IACH,CAAC;IAAC,OAAO,KAAK,EAAE,CAAC;QACf,MAAM,CAAC,KAAK,CAAC,qBAAqB,EAAE,KAAK,CAAC,CAAC;QAE3C,MAAM,MAAM,GAAG,KAAK,YAAY,SAAS,CAAC,CAAC,CAAC,KAAK,CAAC,MAAM,CAAC,CAAC,CAAC,GAAG,CAAC;QAC/D,MAAM,OAAO,GACX,KAAK,YAAY,KAAK,CAAC,CAAC,CAAC,KAAK,CAAC,OAAO,CAAC,CAAC,CAAC,uBAAuB,CAAC;QAEnE,MAAM,QAAQ,GAAG,YAAY,CAAC,IAAI,CAAC,EAAE,KAAK,EAAE,OAAO,EAAE,EAAE,EAAE,MAAM,EAAE,CAAC,CAAC;QAEnE,MAAM,gBAAgB,EAAE,CAAC;QACzB,OAAO,QAAQ,CAAC;IAClB,CAAC;AACH,CAAC,CAAC;AAEJ;;;GAGG;AACH,KAAK,UAAU,UAAU,CACvB,OAAoB,EACpB,MAAkB;IAElB,MAAM,eAAe,GAAG,iBAAiB,CAAC,MAAM,CAAC,CAAC;IAElD,IAAI,CAAC;QACH,MAAM,EAAE,SAAS,EAAE,GAAG,eAAe,CAAC,OAAO,EAAE,eAAe,CAAC,CAAC;QAEhE,MAAM,UAAU,GAAG,MAAM,SAAS,CAAC,UAAU,EAAE,CAAC;QAEhD,IAAI,CAAC,UAAU,EAAE,CAAC;YAChB,OAAO,YAAY,CAAC,IAAI,CAAC,EAAE,KAAK,EAAE,mBAAmB,EAAE,EAAE,EAAE,MAAM,EAAE,GAAG,EAAE,CAAC,CAAC;QAC5E,CAAC;QAED,MAAM,IAAI,GAAG,MAAM,SAAS,CAAC,OAAO,EAAE,CAAC;QAEvC,OAAO,YAAY,CAAC,IAAI,CAAC,EAAE,IAAI,EAAE,CAAC,CAAC;IACrC,CAAC;IAAC,OAAO,KAAK,EAAE,CAAC;QACf,MAAM,CAAC,KAAK,CAAC,qCAAqC,EAAE,KAAK,CAAC,CAAC;QAC3D,OAAO,YAAY,CAAC,IAAI,CACtB,EAAE,KAAK,EAAE,uBAAuB,EAAE,EAClC,EAAE,MAAM,EAAE,GAAG,EAAE,CAChB,CAAC;IACJ,CAAC;AACH,CAAC","sourcesContent":["import { CivicAuth, type UrlDetectionRequest } from \"@civic/auth/server\";\nimport { LOGOUT_SUCCESS_TEXT } from \"@/constants.js\";\nimport { loggers } from \"@/lib/logger.js\";\nimport { displayModeFromState } from \"@/lib/oauth.js\";\nimport type { AuthConfig } from \"@/nextjs/config.js\";\nimport { resolveAuthConfig } from \"@/nextjs/config.js\";\nimport { clearAuthCookies, NextjsCookieStorage } from \"@/nextjs/cookies.js\";\nimport { CodeVerifier, UserStorage } from \"@/shared/lib/types.js\";\nimport type { NextRequest } from \"next/server.js\";\nimport { NextResponse } from \"next/server.js\";\n\nconst logger = loggers.nextjs.handlers.auth;\n\nclass AuthError extends Error {\n  constructor(\n    message: string,\n    public readonly status: number = 401,\n  ) {\n    super(message);\n    this.name = \"AuthError\";\n  }\n}\n\n/**\n * Helper to convert NextRequest to UrlDetectionRequest for framework-agnostic URL handling\n */\nconst toUrlDetectionRequest = (request: NextRequest): UrlDetectionRequest => ({\n  url: request.url,\n  headers: Object.fromEntries(request.headers.entries()),\n  searchParams: {\n    get: (name: string) => request.nextUrl.searchParams.get(name),\n  },\n  cookies: {\n    get: (name: string) => request.cookies.get(name),\n  },\n});\n\n/**\n * Helper to create CivicAuth instance for a request\n * Now handles appUrl detection for proxy environments\n */\nconst createCivicAuth = (request: NextRequest, config: AuthConfig) => {\n  const resolvedConfig = resolveAuthConfig(config);\n  const cookieStorage = new NextjsCookieStorage({\n    ...resolvedConfig.cookies?.tokens,\n    [UserStorage.USER]: resolvedConfig.cookies?.user,\n  });\n\n  // Convert to framework-agnostic request format\n  const urlDetectionRequest = toUrlDetectionRequest(request);\n\n  // Get appUrl from client (for proxy environments)\n  const clientAppUrl = CivicAuth.getAppUrl(urlDetectionRequest);\n\n  // Use baseUrl from config, then client appUrl, then request origin\n  // This matches the main branch priority: config > client > request\n  const appUrl =\n    resolvedConfig.baseUrl ||\n    clientAppUrl ||\n    new URL(urlDetectionRequest.url).origin;\n\n  // Build absolute URLs using detected appUrl or request origin\n  const absoluteCallbackUrl = resolvedConfig.callbackUrl.startsWith(\"http\")\n    ? resolvedConfig.callbackUrl\n    : CivicAuth.toAbsoluteUrl(\n        urlDetectionRequest,\n        resolvedConfig.callbackUrl,\n        appUrl,\n      );\n  const absoluteLogoutCallbackUrl = resolvedConfig.logoutCallbackUrl.startsWith(\n    \"http\",\n  )\n    ? resolvedConfig.logoutCallbackUrl\n    : CivicAuth.toAbsoluteUrl(\n        urlDetectionRequest,\n        resolvedConfig.logoutCallbackUrl,\n        appUrl,\n      );\n\n  const civicAuth = new CivicAuth(cookieStorage, {\n    clientId: resolvedConfig.clientId,\n    redirectUrl: absoluteCallbackUrl,\n    oauthServer: resolvedConfig.oauthServer,\n    postLogoutRedirectUrl: absoluteLogoutCallbackUrl,\n    loginSuccessUrl: request.url,\n  });\n\n  return {\n    civicAuth,\n    cookieStorage,\n    appUrl, // Return appUrl for use in other functions\n    urlDetectionRequest, // Return for use in handlers\n  };\n};\n\n/**\n * Login handler - backend OAuth login initiation endpoint\n * Uses CivicAuth.buildLoginUrl()\n */\nasync function handleLogin(\n  request: NextRequest,\n  config: AuthConfig,\n): Promise<NextResponse> {\n  const resolvedConfigs = resolveAuthConfig(config);\n\n  try {\n    const frontendState = request.nextUrl.searchParams.get(\"state\");\n\n    // Store appUrl in cookie if provided as query parameter\n    const appUrlFromQuery = request.nextUrl.searchParams.get(\"appUrl\");\n    if (appUrlFromQuery) {\n      const cookieStorage = new NextjsCookieStorage(\n        resolvedConfigs.cookies?.tokens ?? {},\n      );\n      await cookieStorage.set(CodeVerifier.APP_URL, appUrlFromQuery);\n    }\n\n    const { civicAuth } = createCivicAuth(request, resolvedConfigs);\n\n    const url = await civicAuth.buildLoginUrl({\n      state: frontendState || undefined,\n    });\n\n    logger.info(\"[LOGIN_HANDLER] Redirecting to OAuth login URL\", {\n      loginUrl: url.toString(),\n    });\n\n    return NextResponse.redirect(url.toString());\n  } catch (error) {\n    logger.error(\"[LOGIN_HANDLER] Backend login error:\", error);\n    const urlDetectionRequest = toUrlDetectionRequest(request);\n    const appUrl = CivicAuth.getAppUrl(urlDetectionRequest);\n    return NextResponse.redirect(\n      CivicAuth.toAbsoluteUrl(\n        urlDetectionRequest,\n        \"/?error=login_failed\",\n        appUrl,\n      ),\n    );\n  }\n}\n\nasync function handleRefresh(\n  request: NextRequest,\n  config: AuthConfig,\n): Promise<NextResponse> {\n  const resolvedConfigs = resolveAuthConfig(config);\n\n  try {\n    const { civicAuth } = createCivicAuth(request, resolvedConfigs);\n\n    await civicAuth.refreshTokens();\n\n    logger.info(\"[REFRESH_HANDLER] Tokens refreshed successfully\");\n\n    const targetUrl = request.nextUrl.searchParams.get(\"targetUrl\");\n    if (targetUrl) {\n      // Success: clear the refresh attempt tracking cookie and redirect to target\n      const response = NextResponse.redirect(targetUrl);\n      response.cookies.delete(\"_civic_last_refresh\");\n      return response;\n    }\n\n    return NextResponse.json({\n      status: \"success\",\n      message: \"Tokens refreshed\",\n    });\n  } catch (error) {\n    logger.error(\"[REFRESH_HANDLER] Token refresh error:\", error);\n    const targetUrl = request.nextUrl.searchParams.get(\"targetUrl\");\n    if (targetUrl) {\n      return NextResponse.redirect(targetUrl);\n    }\n    return NextResponse.json(\n      { error: \"Token refresh failed\" },\n      { status: 500 },\n    );\n  }\n}\n\nasync function handleCallback(\n  request: NextRequest,\n  config: AuthConfig,\n): Promise<NextResponse> {\n  const resolvedConfigs = resolveAuthConfig(config);\n  const code = request.nextUrl.searchParams.get(\"code\");\n  const state = request.nextUrl.searchParams.get(\"state\");\n  const error = request.nextUrl.searchParams.get(\"error\");\n\n  if (error) {\n    logger.error(\"OAuth error in callback:\", error);\n    const urlDetectionRequest = toUrlDetectionRequest(request);\n    const appUrl = CivicAuth.getAppUrl(urlDetectionRequest);\n    return NextResponse.redirect(\n      CivicAuth.toAbsoluteUrl(\n        urlDetectionRequest,\n        \"/?error=oauth_error\",\n        appUrl,\n      ),\n    );\n  }\n\n  if (!code || !state) throw new AuthError(\"Bad parameters\", 400);\n\n  try {\n    const { civicAuth, appUrl, urlDetectionRequest } = createCivicAuth(\n      request,\n      resolvedConfigs,\n    );\n\n    // Convert NextRequest to the format expected by handleCallback\n    const handleCallbackRequest = {\n      headers: Object.fromEntries(request.headers.entries()),\n      url: request.url.toString(),\n    };\n\n    // Get loginSuccessUrl with proper baseUrl handling\n    const loginSuccessUrl = CivicAuth.getLoginSuccessUrl(\n      urlDetectionRequest,\n      appUrl,\n    );\n    const frontendUrl =\n      loginSuccessUrl || resolvedConfigs.loginSuccessUrl || \"/\";\n\n    // Use CivicAuth's smart callback handler\n    const result = await civicAuth.handleCallback(\n      {\n        code,\n        state,\n        req: handleCallbackRequest,\n      },\n      {\n        // Pass the properly resolved frontendUrl\n        frontendUrl: frontendUrl,\n      },\n    );\n\n    if (result.redirectTo) {\n      return NextResponse.redirect(\n        CivicAuth.toAbsoluteUrl(urlDetectionRequest, result.redirectTo, appUrl),\n      );\n    }\n\n    if (result.content) {\n      // Handle both string content and object content\n      if (typeof result.content === \"string\") {\n        return new NextResponse(result.content, {\n          status: 200,\n          headers: {\n            \"Content-Type\": \"text/html\",\n          },\n        });\n      } else {\n        // Object content (JSON response)\n        return NextResponse.json(result.content);\n      }\n    }\n\n    // Fallback redirect\n    return NextResponse.redirect(\n      CivicAuth.toAbsoluteUrl(urlDetectionRequest, \"/\", appUrl),\n    );\n  } catch (error) {\n    logger.error(\"[CALLBACK_HANDLER] OAuth callback error:\", error);\n    const urlDetectionRequest = toUrlDetectionRequest(request);\n    const appUrl = CivicAuth.getAppUrl(urlDetectionRequest);\n    return NextResponse.redirect(\n      CivicAuth.toAbsoluteUrl(\n        urlDetectionRequest,\n        \"/?error=callback_failed\",\n        appUrl,\n      ),\n    );\n  }\n}\n\nexport async function handleLogout(\n  request: NextRequest,\n  config: AuthConfig,\n): Promise<NextResponse> {\n  const resolvedConfigs = resolveAuthConfig(config);\n\n  try {\n    logger.info(\"[LOGOUT_HANDLER] Backend logout endpoint called\");\n\n    // Check for client-provided logoutRedirectUrl query parameter\n    const requestUrl = new URL(request.url);\n    const clientLogoutRedirectUrl =\n      requestUrl.searchParams.get(\"logoutRedirectUrl\");\n    const frontendState = new URL(request.url).searchParams.get(\"state\");\n\n    // If client provided a logoutRedirectUrl, override the config\n    let configToUse = resolvedConfigs;\n    if (clientLogoutRedirectUrl) {\n      configToUse = {\n        ...resolvedConfigs,\n        logoutCallbackUrl: clientLogoutRedirectUrl,\n      };\n      logger.info(\"[LOGOUT_HANDLER] Overriding logout callback URL\", {\n        original: resolvedConfigs.logoutCallbackUrl,\n        override: clientLogoutRedirectUrl,\n      });\n    }\n\n    const { civicAuth } = createCivicAuth(request, configToUse);\n\n    const logoutUrl = await civicAuth.buildLogoutRedirectUrl({\n      state: frontendState || undefined,\n    });\n    await civicAuth.clearTokens();\n\n    // Convert to URL object to modify parameters\n    const url = new URL(logoutUrl.toString());\n    // Remove the state parameter to avoid it showing up in the frontend URL\n    url.searchParams.delete(\"state\");\n\n    logger.info(\n      \"[LOGOUT_HANDLER] Returning logout URL for client-side iframe handling\",\n      {\n        logoutUrl: url.toString(),\n      },\n    );\n\n    return NextResponse.redirect(url.toString());\n  } catch (error) {\n    logger.error(\"[LOGOUT_HANDLER] Logout error:\", error);\n    // If logout URL generation fails, clear tokens and redirect to home\n    try {\n      const { civicAuth } = createCivicAuth(request, resolvedConfigs);\n      await civicAuth.clearTokens();\n\n      // Use client-provided logoutRedirectUrl for fallback too\n      const requestUrl = new URL(request.url);\n      const clientLogoutRedirectUrl =\n        requestUrl.searchParams.get(\"logoutRedirectUrl\");\n      const urlDetectionRequest = toUrlDetectionRequest(request);\n      const appUrl = CivicAuth.getAppUrl(urlDetectionRequest);\n      const fallbackUrl =\n        clientLogoutRedirectUrl || resolvedConfigs.logoutCallbackUrl;\n\n      return NextResponse.redirect(\n        CivicAuth.toAbsoluteUrl(urlDetectionRequest, fallbackUrl, appUrl),\n      );\n    } catch (clearError) {\n      logger.error(\"[LOGOUT_HANDLER] Failed to clear tokens:\", clearError);\n\n      // Final fallback\n      const requestUrl = new URL(request.url);\n      const clientLogoutRedirectUrl =\n        requestUrl.searchParams.get(\"logoutRedirectUrl\");\n      const urlDetectionRequest = toUrlDetectionRequest(request);\n      const appUrl = CivicAuth.getAppUrl(urlDetectionRequest);\n      const fallbackUrl =\n        clientLogoutRedirectUrl || resolvedConfigs.logoutCallbackUrl;\n\n      return NextResponse.redirect(\n        CivicAuth.toAbsoluteUrl(urlDetectionRequest, fallbackUrl, appUrl),\n      );\n    }\n  }\n}\n\nexport async function handleLogoutCallback(\n  request: NextRequest,\n  config: AuthConfig,\n): Promise<NextResponse> {\n  const resolvedConfigs = resolveAuthConfig(config);\n\n  try {\n    logger.info(\n      \"[LOGOUT_CALLBACK_HANDLER] Backend logout callback endpoint called\",\n    );\n\n    // Clear authentication cookies\n    await clearAuthCookies();\n\n    // Get framework-agnostic request and create CivicAuth instance\n    const urlDetectionRequest = toUrlDetectionRequest(request);\n    const { civicAuth } = createCivicAuth(request, resolvedConfigs);\n\n    // Get the state parameter for iframe detection\n    const state = request.nextUrl.searchParams.get(\"state\");\n\n    // If this is an iframe request, return HTML with logout success signal\n    if (state && displayModeFromState(state, \"iframe\") === \"iframe\") {\n      // For iframe mode, include the post-logout redirect URL in the HTML\n      const postLogoutRedirectUrl =\n        civicAuth.getPostLogoutRedirectUrl(urlDetectionRequest);\n      const response = new NextResponse(\n        `<html lang=\"en\"><span style=\"display:none\">${LOGOUT_SUCCESS_TEXT}<a href=\"${postLogoutRedirectUrl}\" rel=\"civic-auth-post-logout-redirect-url\"></a></span></html>`,\n      );\n      response.headers.set(\"Content-Type\", \"text/html; charset=utf-8\");\n      logger.info(\n        \"[LOGOUT_CALLBACK_HANDLER] Returning iframe logout success HTML\",\n        { postLogoutRedirectUrl },\n      );\n      return response;\n    }\n\n    // For non-iframe requests, redirect to the logout callback URL or post-logout URL\n    const redirectUrl = civicAuth.getPostLogoutRedirectUrl(urlDetectionRequest);\n    logger.info(\n      \"[LOGOUT_CALLBACK_HANDLER] Redirecting to logout callback URL\",\n      {\n        logoutCallbackUrl: resolvedConfigs.logoutCallbackUrl,\n        redirectUrl,\n      },\n    );\n\n    return NextResponse.redirect(redirectUrl);\n  } catch (error) {\n    logger.error(\"[LOGOUT_CALLBACK_HANDLER] Logout callback error:\", error);\n    const urlDetectionRequest = toUrlDetectionRequest(request);\n    const appUrl = CivicAuth.getAppUrl(urlDetectionRequest);\n    return NextResponse.redirect(\n      CivicAuth.toAbsoluteUrl(\n        urlDetectionRequest,\n        resolvedConfigs.logoutCallbackUrl,\n        appUrl,\n      ),\n    );\n  }\n}\n\n/**\n * Creates an authentication handler for Next.js API routes\n *\n * Usage:\n * ```ts\n * // app/api/auth/[...civicauth]/route.ts\n * import { handler } from '@civic/auth/nextjs'\n * export const GET = handler({\n *   // optional config overrides\n * })\n * ```\n */\nexport const handler =\n  (authConfig = {}) =>\n  async (request: NextRequest): Promise<NextResponse> => {\n    const config = resolveAuthConfig(authConfig);\n\n    try {\n      const pathname = request.nextUrl.pathname;\n      const pathSegments = pathname.split(\"/\");\n      const lastSegment = pathSegments[pathSegments.length - 1];\n\n      switch (lastSegment) {\n        case \"challenge\":\n        case \"login\":\n          return await handleLogin(request, config);\n        case \"callback\":\n          return await handleCallback(request, config);\n        case \"refresh\":\n          return await handleRefresh(request, config);\n        case \"logout\":\n          return await handleLogout(request, config);\n        case \"logoutcallback\":\n          return await handleLogoutCallback(request, config);\n        case \"user\":\n          return await handleUser(request, config);\n        default:\n          throw new AuthError(`Invalid auth route: ${pathname}`, 404);\n      }\n    } catch (error) {\n      logger.error(\"Auth handler error:\", error);\n\n      const status = error instanceof AuthError ? error.status : 500;\n      const message =\n        error instanceof Error ? error.message : \"Authentication failed\";\n\n      const response = NextResponse.json({ error: message }, { status });\n\n      await clearAuthCookies();\n      return response;\n    }\n  };\n\n/**\n * User endpoint - returns current user data as JSON\n * Uses CivicAuth.isLoggedIn() and getUser()\n */\nasync function handleUser(\n  request: NextRequest,\n  config: AuthConfig,\n): Promise<NextResponse> {\n  const resolvedConfigs = resolveAuthConfig(config);\n\n  try {\n    const { civicAuth } = createCivicAuth(request, resolvedConfigs);\n\n    const isLoggedIn = await civicAuth.isLoggedIn();\n\n    if (!isLoggedIn) {\n      return NextResponse.json({ error: \"Not authenticated\" }, { status: 401 });\n    }\n\n    const user = await civicAuth.getUser();\n\n    return NextResponse.json({ user });\n  } catch (error) {\n    logger.error(\"[USER_HANDLER] User endpoint error:\", error);\n    return NextResponse.json(\n      { error: \"Internal server error\" },\n      { status: 500 },\n    );\n  }\n}\n"]}
+{"version":3,"file":"routeHandler.js","sourceRoot":"","sources":["../../src/nextjs/routeHandler.ts"],"names":[],"mappings":"AAAA,OAAO,EAAE,SAAS,EAA4B,MAAM,oBAAoB,CAAC;AACzE,OAAO,EAAE,mBAAmB,EAAE,MAAM,gBAAgB,CAAC;AACrD,OAAO,EAAE,OAAO,EAAE,MAAM,iBAAiB,CAAC;AAC1C,OAAO,EAAE,oBAAoB,EAAE,MAAM,gBAAgB,CAAC;AAEtD,OAAO,EAAE,iBAAiB,EAAE,MAAM,oBAAoB,CAAC;AACvD,OAAO,EAAE,gBAAgB,EAAE,mBAAmB,EAAE,MAAM,qBAAqB,CAAC;AAC5E,OAAO,EAAE,YAAY,EAAE,WAAW,EAAE,MAAM,uBAAuB,CAAC;AAClE,OAAO,EAAE,cAAc,EAAE,MAAM,eAAe,CAAC;AAE/C,OAAO,EAAE,YAAY,EAAE,MAAM,gBAAgB,CAAC;AAE9C,MAAM,MAAM,GAAG,OAAO,CAAC,MAAM,CAAC,QAAQ,CAAC,IAAI,CAAC;AAE5C,MAAM,SAAU,SAAQ,KAAK;IAGT;IAFlB,YACE,OAAe,EACC,SAAiB,GAAG;QAEpC,KAAK,CAAC,OAAO,CAAC,CAAC;QAFC,WAAM,GAAN,MAAM,CAAc;QAGpC,IAAI,CAAC,IAAI,GAAG,WAAW,CAAC;IAC1B,CAAC;CACF;AAED;;GAEG;AACH,MAAM,qBAAqB,GAAG,CAAC,OAAoB,EAAuB,EAAE,CAAC,CAAC;IAC5E,GAAG,EAAE,OAAO,CAAC,GAAG;IAChB,OAAO,EAAE,MAAM,CAAC,WAAW,CAAC,OAAO,CAAC,OAAO,CAAC,OAAO,EAAE,CAAC;IACtD,YAAY,EAAE;QACZ,GAAG,EAAE,CAAC,IAAY,EAAE,EAAE,CAAC,OAAO,CAAC,OAAO,CAAC,YAAY,CAAC,GAAG,CAAC,IAAI,CAAC;KAC9D;IACD,OAAO,EAAE;QACP,GAAG,EAAE,CAAC,IAAY,EAAE,EAAE,CAAC,OAAO,CAAC,OAAO,CAAC,GAAG,CAAC,IAAI,CAAC;KACjD;CACF,CAAC,CAAC;AAEH;;;GAGG;AACH,MAAM,eAAe,GAAG,CAAC,OAAoB,EAAE,MAAkB,EAAE,EAAE;IACnE,MAAM,cAAc,GAAG,iBAAiB,CAAC,MAAM,CAAC,CAAC;IACjD,MAAM,aAAa,GAAG,IAAI,mBAAmB,CAAC;QAC5C,GAAG,cAAc,CAAC,OAAO,EAAE,MAAM;QACjC,CAAC,WAAW,CAAC,IAAI,CAAC,EAAE,cAAc,CAAC,OAAO,EAAE,IAAI;KACjD,CAAC,CAAC;IAEH,+CAA+C;IAC/C,MAAM,mBAAmB,GAAG,qBAAqB,CAAC,OAAO,CAAC,CAAC;IAE3D,kDAAkD;IAClD,MAAM,YAAY,GAAG,SAAS,CAAC,SAAS,CAAC,mBAAmB,CAAC,CAAC;IAE9D,mEAAmE;IACnE,mEAAmE;IACnE,MAAM,MAAM,GACV,cAAc,CAAC,OAAO;QACtB,YAAY;QACZ,IAAI,GAAG,CAAC,mBAAmB,CAAC,GAAG,CAAC,CAAC,MAAM,CAAC;IAE1C,8DAA8D;IAC9D,MAAM,mBAAmB,GAAG,cAAc,CAAC,WAAW,CAAC,UAAU,CAAC,MAAM,CAAC;QACvE,CAAC,CAAC,cAAc,CAAC,WAAW;QAC5B,CAAC,CAAC,SAAS,CAAC,aAAa,CACrB,mBAAmB,EACnB,cAAc,CAAC,WAAW,EAC1B,MAAM,CACP,CAAC;IACN,MAAM,yBAAyB,GAAG,cAAc,CAAC,iBAAiB,CAAC,UAAU,CAC3E,MAAM,CACP;QACC,CAAC,CAAC,cAAc,CAAC,iBAAiB;QAClC,CAAC,CAAC,SAAS,CAAC,aAAa,CACrB,mBAAmB,EACnB,cAAc,CAAC,iBAAiB,EAChC,MAAM,CACP,CAAC;IAEN,MAAM,SAAS,GAAG,IAAI,SAAS,CAAC,aAAa,EAAE;QAC7C,QAAQ,EAAE,cAAc,CAAC,QAAQ;QACjC,WAAW,EAAE,mBAAmB;QAChC,WAAW,EAAE,cAAc,CAAC,WAAW;QACvC,qBAAqB,EAAE,yBAAyB;QAChD,eAAe,EAAE,OAAO,CAAC,GAAG;KAC7B,CAAC,CAAC;IAEH,OAAO;QACL,SAAS;QACT,aAAa;QACb,MAAM,EAAE,2CAA2C;QACnD,mBAAmB,EAAE,6BAA6B;KACnD,CAAC;AACJ,CAAC,CAAC;AAEF;;;GAGG;AACH,KAAK,UAAU,WAAW,CACxB,OAAoB,EACpB,MAAkB;IAElB,MAAM,eAAe,GAAG,iBAAiB,CAAC,MAAM,CAAC,CAAC;IAElD,IAAI,CAAC;QACH,MAAM,aAAa,GAAG,OAAO,CAAC,OAAO,CAAC,YAAY,CAAC,GAAG,CAAC,OAAO,CAAC,CAAC;QAEhE,wDAAwD;QACxD,MAAM,eAAe,GAAG,OAAO,CAAC,OAAO,CAAC,YAAY,CAAC,GAAG,CAAC,QAAQ,CAAC,CAAC;QACnE,IAAI,eAAe,EAAE,CAAC;YACpB,MAAM,aAAa,GAAG,IAAI,mBAAmB,CAC3C,eAAe,CAAC,OAAO,EAAE,MAAM,IAAI,EAAE,CACtC,CAAC;YACF,MAAM,aAAa,CAAC,GAAG,CAAC,YAAY,CAAC,OAAO,EAAE,eAAe,CAAC,CAAC;QACjE,CAAC;QAED,MAAM,EAAE,SAAS,EAAE,GAAG,eAAe,CAAC,OAAO,EAAE,eAAe,CAAC,CAAC;QAEhE,MAAM,GAAG,GAAG,MAAM,SAAS,CAAC,aAAa,CAAC;YACxC,KAAK,EAAE,aAAa,IAAI,SAAS;SAClC,CAAC,CAAC;QAEH,MAAM,CAAC,IAAI,CAAC,gDAAgD,EAAE;YAC5D,QAAQ,EAAE,GAAG,CAAC,QAAQ,EAAE;SACzB,CAAC,CAAC;QAEH,OAAO,YAAY,CAAC,QAAQ,CAAC,GAAG,CAAC,QAAQ,EAAE,CAAC,CAAC;IAC/C,CAAC;IAAC,OAAO,KAAK,EAAE,CAAC;QACf,MAAM,CAAC,KAAK,CAAC,sCAAsC,EAAE,KAAK,CAAC,CAAC;QAC5D,MAAM,mBAAmB,GAAG,qBAAqB,CAAC,OAAO,CAAC,CAAC;QAC3D,MAAM,MAAM,GAAG,SAAS,CAAC,SAAS,CAAC,mBAAmB,CAAC,CAAC;QACxD,OAAO,YAAY,CAAC,QAAQ,CAC1B,SAAS,CAAC,aAAa,CACrB,mBAAmB,EACnB,sBAAsB,EACtB,MAAM,CACP,CACF,CAAC;IACJ,CAAC;AACH,CAAC;AAED,KAAK,UAAU,aAAa,CAC1B,OAAoB,EACpB,MAAkB;IAElB,MAAM,eAAe,GAAG,iBAAiB,CAAC,MAAM,CAAC,CAAC;IAElD,IAAI,CAAC;QACH,MAAM,EAAE,SAAS,EAAE,GAAG,eAAe,CAAC,OAAO,EAAE,eAAe,CAAC,CAAC;QAEhE,MAAM,SAAS,CAAC,aAAa,EAAE,CAAC;QAEhC,MAAM,CAAC,IAAI,CAAC,iDAAiD,CAAC,CAAC;QAE/D,MAAM,SAAS,GAAG,OAAO,CAAC,OAAO,CAAC,YAAY,CAAC,GAAG,CAAC,WAAW,CAAC,CAAC;QAChE,IAAI,SAAS,EAAE,CAAC;YACd,4EAA4E;YAC5E,MAAM,QAAQ,GAAG,YAAY,CAAC,QAAQ,CAAC,SAAS,CAAC,CAAC;YAClD,QAAQ,CAAC,OAAO,CAAC,MAAM,CAAC,qBAAqB,CAAC,CAAC;YAC/C,OAAO,QAAQ,CAAC;QAClB,CAAC;QAED,OAAO,YAAY,CAAC,IAAI,CAAC;YACvB,MAAM,EAAE,SAAS;YACjB,OAAO,EAAE,kBAAkB;SAC5B,CAAC,CAAC;IACL,CAAC;IAAC,OAAO,KAAK,EAAE,CAAC;QACf,MAAM,CAAC,KAAK,CAAC,wCAAwC,EAAE,KAAK,CAAC,CAAC;QAC9D,MAAM,SAAS,GAAG,OAAO,CAAC,OAAO,CAAC,YAAY,CAAC,GAAG,CAAC,WAAW,CAAC,CAAC;QAChE,IAAI,SAAS,EAAE,CAAC;YACd,OAAO,YAAY,CAAC,QAAQ,CAAC,SAAS,CAAC,CAAC;QAC1C,CAAC;QACD,OAAO,YAAY,CAAC,IAAI,CACtB,EAAE,KAAK,EAAE,sBAAsB,EAAE,EACjC,EAAE,MAAM,EAAE,GAAG,EAAE,CAChB,CAAC;IACJ,CAAC;AACH,CAAC;AAED,KAAK,UAAU,cAAc,CAC3B,OAAoB,EACpB,MAAkB;IAElB,MAAM,eAAe,GAAG,iBAAiB,CAAC,MAAM,CAAC,CAAC;IAClD,MAAM,IAAI,GAAG,OAAO,CAAC,OAAO,CAAC,YAAY,CAAC,GAAG,CAAC,MAAM,CAAC,CAAC;IACtD,MAAM,KAAK,GAAG,OAAO,CAAC,OAAO,CAAC,YAAY,CAAC,GAAG,CAAC,OAAO,CAAC,CAAC;IACxD,MAAM,KAAK,GAAG,OAAO,CAAC,OAAO,CAAC,YAAY,CAAC,GAAG,CAAC,OAAO,CAAC,CAAC;IAExD,IAAI,KAAK,EAAE,CAAC;QACV,MAAM,CAAC,KAAK,CAAC,0BAA0B,EAAE,KAAK,CAAC,CAAC;QAChD,MAAM,mBAAmB,GAAG,qBAAqB,CAAC,OAAO,CAAC,CAAC;QAC3D,MAAM,MAAM,GAAG,SAAS,CAAC,SAAS,CAAC,mBAAmB,CAAC,CAAC;QACxD,OAAO,YAAY,CAAC,QAAQ,CAC1B,SAAS,CAAC,aAAa,CACrB,mBAAmB,EACnB,qBAAqB,EACrB,MAAM,CACP,CACF,CAAC;IACJ,CAAC;IAED,IAAI,CAAC,IAAI,IAAI,CAAC,KAAK;QAAE,MAAM,IAAI,SAAS,CAAC,gBAAgB,EAAE,GAAG,CAAC,CAAC;IAEhE,IAAI,CAAC;QACH,MAAM,EAAE,SAAS,EAAE,MAAM,EAAE,mBAAmB,EAAE,GAAG,eAAe,CAChE,OAAO,EACP,eAAe,CAChB,CAAC;QAEF,+DAA+D;QAC/D,MAAM,qBAAqB,GAAG;YAC5B,OAAO,EAAE,MAAM,CAAC,WAAW,CAAC,OAAO,CAAC,OAAO,CAAC,OAAO,EAAE,CAAC;YACtD,GAAG,EAAE,OAAO,CAAC,GAAG,CAAC,QAAQ,EAAE;SAC5B,CAAC;QAEF,mDAAmD;QACnD,MAAM,eAAe,GAAG,SAAS,CAAC,kBAAkB,CAClD,mBAAmB,EACnB,MAAM,CACP,CAAC;QACF,MAAM,WAAW,GACf,eAAe,IAAI,eAAe,CAAC,eAAe,IAAI,GAAG,CAAC;QAE5D,yCAAyC;QACzC,MAAM,MAAM,GAAG,MAAM,SAAS,CAAC,cAAc,CAC3C;YACE,IAAI;YACJ,KAAK;YACL,GAAG,EAAE,qBAAqB;SAC3B,EACD;YACE,yCAAyC;YACzC,WAAW,EAAE,WAAW;SACzB,CACF,CAAC;QAEF,IAAI,MAAM,CAAC,UAAU,EAAE,CAAC;YACtB,OAAO,YAAY,CAAC,QAAQ,CAC1B,SAAS,CAAC,aAAa,CAAC,mBAAmB,EAAE,MAAM,CAAC,UAAU,EAAE,MAAM,CAAC,CACxE,CAAC;QACJ,CAAC;QAED,IAAI,MAAM,CAAC,OAAO,EAAE,CAAC;YACnB,gDAAgD;YAChD,IAAI,OAAO,MAAM,CAAC,OAAO,KAAK,QAAQ,EAAE,CAAC;gBACvC,OAAO,IAAI,YAAY,CAAC,MAAM,CAAC,OAAO,EAAE;oBACtC,MAAM,EAAE,GAAG;oBACX,OAAO,EAAE;wBACP,cAAc,EAAE,WAAW;qBAC5B;iBACF,CAAC,CAAC;YACL,CAAC;iBAAM,CAAC;gBACN,iCAAiC;gBACjC,OAAO,YAAY,CAAC,IAAI,CAAC,MAAM,CAAC,OAAO,CAAC,CAAC;YAC3C,CAAC;QACH,CAAC;QAED,oBAAoB;QACpB,OAAO,YAAY,CAAC,QAAQ,CAC1B,SAAS,CAAC,aAAa,CAAC,mBAAmB,EAAE,GAAG,EAAE,MAAM,CAAC,CAC1D,CAAC;IACJ,CAAC;IAAC,OAAO,KAAK,EAAE,CAAC;QACf,MAAM,CAAC,KAAK,CAAC,0CAA0C,EAAE,KAAK,CAAC,CAAC;QAChE,MAAM,mBAAmB,GAAG,qBAAqB,CAAC,OAAO,CAAC,CAAC;QAC3D,MAAM,MAAM,GAAG,SAAS,CAAC,SAAS,CAAC,mBAAmB,CAAC,CAAC;QACxD,OAAO,YAAY,CAAC,QAAQ,CAC1B,SAAS,CAAC,aAAa,CACrB,mBAAmB,EACnB,yBAAyB,EACzB,MAAM,CACP,CACF,CAAC;IACJ,CAAC;AACH,CAAC;AAED,MAAM,iBAAiB,GAAG,KAAK,EAAE,GAAW,EAAE,EAAE;IAC9C,IAAI,CAAC;QACH,MAAM,IAAI,GAAG,IAAI,GAAG,CAAC,GAAG,CAAC,CAAC,QAAQ,CAAC;QACnC,cAAc,CAAC,IAAI,CAAC,CAAC;IACvB,CAAC;IAAC,OAAO,KAAK,EAAE,CAAC;QACf,MAAM,CAAC,IAAI,CAAC,yCAAyC,EAAE,KAAK,CAAC,CAAC;IAChE,CAAC;AACH,CAAC,CAAC;AAEF,MAAM,CAAC,KAAK,UAAU,YAAY,CAChC,OAAoB,EACpB,MAAkB;IAElB,MAAM,eAAe,GAAG,iBAAiB,CAAC,MAAM,CAAC,CAAC;IAElD,mDAAmD;IACnD,MAAM,mBAAmB,GAAG,qBAAqB,CAAC,OAAO,CAAC,CAAC;IAC3D,MAAM,MAAM,GAAG,SAAS,CAAC,SAAS,CAAC,mBAAmB,CAAC,CAAC;IAExD,2CAA2C;IAC3C,MAAM,KAAK,GAAG,OAAO,CAAC,OAAO,CAAC,YAAY,CAAC,GAAG,CAAC,OAAO,CAAC,CAAC;IACxD,MAAM,uBAAuB,GAC3B,OAAO,CAAC,OAAO,CAAC,YAAY,CAAC,GAAG,CAAC,mBAAmB,CAAC,CAAC;IAExD,IAAI,CAAC;QACH,MAAM,CAAC,IAAI,CAAC,iDAAiD,CAAC,CAAC;QAE/D,8DAA8D;QAC9D,IAAI,WAAW,GAAG,eAAe,CAAC;QAClC,IAAI,uBAAuB,EAAE,CAAC;YAC5B,WAAW,GAAG;gBACZ,GAAG,eAAe;gBAClB,iBAAiB,EAAE,uBAAuB;aAC3C,CAAC;YACF,MAAM,CAAC,IAAI,CAAC,iDAAiD,EAAE;gBAC7D,QAAQ,EAAE,eAAe,CAAC,iBAAiB;gBAC3C,QAAQ,EAAE,uBAAuB;aAClC,CAAC,CAAC;QACL,CAAC;QAED,MAAM,EAAE,SAAS,EAAE,GAAG,eAAe,CAAC,OAAO,EAAE,WAAW,CAAC,CAAC;QAE5D,qDAAqD;QACrD,+EAA+E;QAC/E,MAAM,CAAC,IAAI,CAAC,4CAA4C,EAAE;YACxD,KAAK,EAAE,CAAC,CAAC,KAAK;SACf,CAAC,CAAC;QAEH,8DAA8D;QAC9D,6EAA6E;QAC7E,MAAM,SAAS,GAAG,MAAM,SAAS,CAAC,sBAAsB,CAAC;YACvD,KAAK,EAAE,KAAK,IAAI,SAAS;SAC1B,CAAC,CAAC;QAEH,IAAI,CAAC;YACH,MAAM,SAAS,CAAC,WAAW,EAAE,CAAC;YAE9B,8EAA8E;YAC9E,MAAM,iBAAiB,CAAC,OAAO,CAAC,GAAG,CAAC,CAAC;QACvC,CAAC;QAAC,OAAO,KAAK,EAAE,CAAC;YACf,MAAM,CAAC,KAAK,CAAC,yCAAyC,EAAE,KAAK,CAAC,CAAC;QACjE,CAAC;QAED,sFAAsF;QACtF,MAAM,cAAc,GAAG,IAAI,GAAG,CAAC,SAAS,CAAC,CAAC;QAC1C,cAAc,CAAC,YAAY,CAAC,MAAM,CAAC,OAAO,CAAC,CAAC;QAE5C,MAAM,CAAC,IAAI,CAAC,uDAAuD,EAAE;YACnE,SAAS,EAAE,cAAc,CAAC,QAAQ,EAAE;SACrC,CAAC,CAAC;QAEH,OAAO,YAAY,CAAC,QAAQ,CAAC,cAAc,CAAC,QAAQ,EAAE,CAAC,CAAC;IAC1D,CAAC;IAAC,OAAO,KAAK,EAAE,CAAC;QACf,MAAM,CAAC,KAAK,CAAC,gCAAgC,EAAE,KAAK,CAAC,CAAC;QACtD,oEAAoE;QACpE,MAAM,gBAAgB,EAAE,CAAC;QAEzB,MAAM,WAAW,GACf,uBAAuB,IAAI,eAAe,CAAC,iBAAiB,CAAC;QAC/D,MAAM,gBAAgB,GAAG,SAAS,CAAC,aAAa,CAC9C,mBAAmB,EACnB,WAAW,EACX,MAAM,CACP,CAAC;QAEF,OAAO,YAAY,CAAC,QAAQ,CAAC,gBAAgB,CAAC,CAAC;IACjD,CAAC;AACH,CAAC;AAED,MAAM,CAAC,KAAK,UAAU,oBAAoB,CACxC,OAAoB,EACpB,MAAkB;IAElB,MAAM,eAAe,GAAG,iBAAiB,CAAC,MAAM,CAAC,CAAC;IAElD,IAAI,CAAC;QACH,MAAM,CAAC,IAAI,CACT,mEAAmE,CACpE,CAAC;QAEF,+BAA+B;QAC/B,MAAM,gBAAgB,EAAE,CAAC;QAEzB,+DAA+D;QAC/D,MAAM,mBAAmB,GAAG,qBAAqB,CAAC,OAAO,CAAC,CAAC;QAC3D,MAAM,EAAE,SAAS,EAAE,GAAG,eAAe,CAAC,OAAO,EAAE,eAAe,CAAC,CAAC;QAEhE,+CAA+C;QAC/C,MAAM,KAAK,GAAG,OAAO,CAAC,OAAO,CAAC,YAAY,CAAC,GAAG,CAAC,OAAO,CAAC,CAAC;QAExD,uEAAuE;QACvE,IAAI,KAAK,IAAI,oBAAoB,CAAC,KAAK,EAAE,QAAQ,CAAC,KAAK,QAAQ,EAAE,CAAC;YAChE,oEAAoE;YACpE,MAAM,qBAAqB,GACzB,SAAS,CAAC,wBAAwB,CAAC,mBAAmB,CAAC,CAAC;YAC1D,MAAM,QAAQ,GAAG,IAAI,YAAY,CAC/B,8CAA8C,mBAAmB,YAAY,qBAAqB,gEAAgE,CACnK,CAAC;YACF,QAAQ,CAAC,OAAO,CAAC,GAAG,CAAC,cAAc,EAAE,0BAA0B,CAAC,CAAC;YACjE,MAAM,CAAC,IAAI,CACT,gEAAgE,EAChE,EAAE,qBAAqB,EAAE,CAC1B,CAAC;YACF,OAAO,QAAQ,CAAC;QAClB,CAAC;QAED,kFAAkF;QAClF,MAAM,WAAW,GAAG,SAAS,CAAC,wBAAwB,CAAC,mBAAmB,CAAC,CAAC;QAC5E,MAAM,CAAC,IAAI,CACT,8DAA8D,EAC9D;YACE,iBAAiB,EAAE,eAAe,CAAC,iBAAiB;YACpD,WAAW;SACZ,CACF,CAAC;QAEF,mFAAmF;QACnF,MAAM,iBAAiB,CAAC,WAAW,CAAC,CAAC;QACrC,OAAO,YAAY,CAAC,QAAQ,CAAC,WAAW,CAAC,CAAC;IAC5C,CAAC;IAAC,OAAO,KAAK,EAAE,CAAC;QACf,MAAM,CAAC,KAAK,CAAC,kDAAkD,EAAE,KAAK,CAAC,CAAC;QACxE,MAAM,mBAAmB,GAAG,qBAAqB,CAAC,OAAO,CAAC,CAAC;QAC3D,MAAM,MAAM,GAAG,SAAS,CAAC,SAAS,CAAC,mBAAmB,CAAC,CAAC;QACxD,OAAO,YAAY,CAAC,QAAQ,CAC1B,SAAS,CAAC,aAAa,CACrB,mBAAmB,EACnB,eAAe,CAAC,iBAAiB,EACjC,MAAM,CACP,CACF,CAAC;IACJ,CAAC;AACH,CAAC;AAED;;;;;;;;;;;GAWG;AACH,MAAM,CAAC,MAAM,OAAO,GAClB,CAAC,UAAU,GAAG,EAAE,EAAE,EAAE,CACpB,KAAK,EAAE,OAAoB,EAAyB,EAAE;IACpD,MAAM,MAAM,GAAG,iBAAiB,CAAC,UAAU,CAAC,CAAC;IAE7C,IAAI,CAAC;QACH,MAAM,QAAQ,GAAG,OAAO,CAAC,OAAO,CAAC,QAAQ,CAAC;QAC1C,MAAM,YAAY,GAAG,QAAQ,CAAC,KAAK,CAAC,GAAG,CAAC,CAAC;QACzC,MAAM,WAAW,GAAG,YAAY,CAAC,YAAY,CAAC,MAAM,GAAG,CAAC,CAAC,CAAC;QAE1D,QAAQ,WAAW,EAAE,CAAC;YACpB,KAAK,WAAW,CAAC;YACjB,KAAK,OAAO;gBACV,OAAO,MAAM,WAAW,CAAC,OAAO,EAAE,MAAM,CAAC,CAAC;YAC5C,KAAK,UAAU;gBACb,OAAO,MAAM,cAAc,CAAC,OAAO,EAAE,MAAM,CAAC,CAAC;YAC/C,KAAK,SAAS;gBACZ,OAAO,MAAM,aAAa,CAAC,OAAO,EAAE,MAAM,CAAC,CAAC;YAC9C,KAAK,QAAQ;gBACX,OAAO,MAAM,YAAY,CAAC,OAAO,EAAE,MAAM,CAAC,CAAC;YAC7C,KAAK,gBAAgB;gBACnB,OAAO,MAAM,oBAAoB,CAAC,OAAO,EAAE,MAAM,CAAC,CAAC;YACrD,KAAK,MAAM;gBACT,OAAO,MAAM,UAAU,CAAC,OAAO,EAAE,MAAM,CAAC,CAAC;YAC3C;gBACE,MAAM,IAAI,SAAS,CAAC,uBAAuB,QAAQ,EAAE,EAAE,GAAG,CAAC,CAAC;QAChE,CAAC;IACH,CAAC;IAAC,OAAO,KAAK,EAAE,CAAC;QACf,MAAM,CAAC,KAAK,CAAC,qBAAqB,EAAE,KAAK,CAAC,CAAC;QAE3C,MAAM,MAAM,GAAG,KAAK,YAAY,SAAS,CAAC,CAAC,CAAC,KAAK,CAAC,MAAM,CAAC,CAAC,CAAC,GAAG,CAAC;QAC/D,MAAM,OAAO,GACX,KAAK,YAAY,KAAK,CAAC,CAAC,CAAC,KAAK,CAAC,OAAO,CAAC,CAAC,CAAC,uBAAuB,CAAC;QAEnE,MAAM,QAAQ,GAAG,YAAY,CAAC,IAAI,CAAC,EAAE,KAAK,EAAE,OAAO,EAAE,EAAE,EAAE,MAAM,EAAE,CAAC,CAAC;QAEnE,MAAM,gBAAgB,EAAE,CAAC;QACzB,OAAO,QAAQ,CAAC;IAClB,CAAC;AACH,CAAC,CAAC;AAEJ;;;GAGG;AACH,KAAK,UAAU,UAAU,CACvB,OAAoB,EACpB,MAAkB;IAElB,MAAM,eAAe,GAAG,iBAAiB,CAAC,MAAM,CAAC,CAAC;IAElD,IAAI,CAAC;QACH,MAAM,EAAE,SAAS,EAAE,GAAG,eAAe,CAAC,OAAO,EAAE,eAAe,CAAC,CAAC;QAEhE,MAAM,UAAU,GAAG,MAAM,SAAS,CAAC,UAAU,EAAE,CAAC;QAEhD,IAAI,CAAC,UAAU,EAAE,CAAC;YAChB,OAAO,YAAY,CAAC,IAAI,CAAC,EAAE,KAAK,EAAE,mBAAmB,EAAE,EAAE,EAAE,MAAM,EAAE,GAAG,EAAE,CAAC,CAAC;QAC5E,CAAC;QAED,MAAM,IAAI,GAAG,MAAM,SAAS,CAAC,OAAO,EAAE,CAAC;QAEvC,OAAO,YAAY,CAAC,IAAI,CAAC,EAAE,IAAI,EAAE,CAAC,CAAC;IACrC,CAAC;IAAC,OAAO,KAAK,EAAE,CAAC;QACf,MAAM,CAAC,KAAK,CAAC,qCAAqC,EAAE,KAAK,CAAC,CAAC;QAC3D,OAAO,YAAY,CAAC,IAAI,CACtB,EAAE,KAAK,EAAE,uBAAuB,EAAE,EAClC,EAAE,MAAM,EAAE,GAAG,EAAE,CAChB,CAAC;IACJ,CAAC;AACH,CAAC","sourcesContent":["import { CivicAuth, type UrlDetectionRequest } from \"@civic/auth/server\";\nimport { LOGOUT_SUCCESS_TEXT } from \"@/constants.js\";\nimport { loggers } from \"@/lib/logger.js\";\nimport { displayModeFromState } from \"@/lib/oauth.js\";\nimport type { AuthConfig } from \"@/nextjs/config.js\";\nimport { resolveAuthConfig } from \"@/nextjs/config.js\";\nimport { clearAuthCookies, NextjsCookieStorage } from \"@/nextjs/cookies.js\";\nimport { CodeVerifier, UserStorage } from \"@/shared/lib/types.js\";\nimport { revalidatePath } from \"next/cache.js\";\nimport type { NextRequest } from \"next/server.js\";\nimport { NextResponse } from \"next/server.js\";\n\nconst logger = loggers.nextjs.handlers.auth;\n\nclass AuthError extends Error {\n  constructor(\n    message: string,\n    public readonly status: number = 401,\n  ) {\n    super(message);\n    this.name = \"AuthError\";\n  }\n}\n\n/**\n * Helper to convert NextRequest to UrlDetectionRequest for framework-agnostic URL handling\n */\nconst toUrlDetectionRequest = (request: NextRequest): UrlDetectionRequest => ({\n  url: request.url,\n  headers: Object.fromEntries(request.headers.entries()),\n  searchParams: {\n    get: (name: string) => request.nextUrl.searchParams.get(name),\n  },\n  cookies: {\n    get: (name: string) => request.cookies.get(name),\n  },\n});\n\n/**\n * Helper to create CivicAuth instance for a request\n * Now handles appUrl detection for proxy environments\n */\nconst createCivicAuth = (request: NextRequest, config: AuthConfig) => {\n  const resolvedConfig = resolveAuthConfig(config);\n  const cookieStorage = new NextjsCookieStorage({\n    ...resolvedConfig.cookies?.tokens,\n    [UserStorage.USER]: resolvedConfig.cookies?.user,\n  });\n\n  // Convert to framework-agnostic request format\n  const urlDetectionRequest = toUrlDetectionRequest(request);\n\n  // Get appUrl from client (for proxy environments)\n  const clientAppUrl = CivicAuth.getAppUrl(urlDetectionRequest);\n\n  // Use baseUrl from config, then client appUrl, then request origin\n  // This matches the main branch priority: config > client > request\n  const appUrl =\n    resolvedConfig.baseUrl ||\n    clientAppUrl ||\n    new URL(urlDetectionRequest.url).origin;\n\n  // Build absolute URLs using detected appUrl or request origin\n  const absoluteCallbackUrl = resolvedConfig.callbackUrl.startsWith(\"http\")\n    ? resolvedConfig.callbackUrl\n    : CivicAuth.toAbsoluteUrl(\n        urlDetectionRequest,\n        resolvedConfig.callbackUrl,\n        appUrl,\n      );\n  const absoluteLogoutCallbackUrl = resolvedConfig.logoutCallbackUrl.startsWith(\n    \"http\",\n  )\n    ? resolvedConfig.logoutCallbackUrl\n    : CivicAuth.toAbsoluteUrl(\n        urlDetectionRequest,\n        resolvedConfig.logoutCallbackUrl,\n        appUrl,\n      );\n\n  const civicAuth = new CivicAuth(cookieStorage, {\n    clientId: resolvedConfig.clientId,\n    redirectUrl: absoluteCallbackUrl,\n    oauthServer: resolvedConfig.oauthServer,\n    postLogoutRedirectUrl: absoluteLogoutCallbackUrl,\n    loginSuccessUrl: request.url,\n  });\n\n  return {\n    civicAuth,\n    cookieStorage,\n    appUrl, // Return appUrl for use in other functions\n    urlDetectionRequest, // Return for use in handlers\n  };\n};\n\n/**\n * Login handler - backend OAuth login initiation endpoint\n * Uses CivicAuth.buildLoginUrl()\n */\nasync function handleLogin(\n  request: NextRequest,\n  config: AuthConfig,\n): Promise<NextResponse> {\n  const resolvedConfigs = resolveAuthConfig(config);\n\n  try {\n    const frontendState = request.nextUrl.searchParams.get(\"state\");\n\n    // Store appUrl in cookie if provided as query parameter\n    const appUrlFromQuery = request.nextUrl.searchParams.get(\"appUrl\");\n    if (appUrlFromQuery) {\n      const cookieStorage = new NextjsCookieStorage(\n        resolvedConfigs.cookies?.tokens ?? {},\n      );\n      await cookieStorage.set(CodeVerifier.APP_URL, appUrlFromQuery);\n    }\n\n    const { civicAuth } = createCivicAuth(request, resolvedConfigs);\n\n    const url = await civicAuth.buildLoginUrl({\n      state: frontendState || undefined,\n    });\n\n    logger.info(\"[LOGIN_HANDLER] Redirecting to OAuth login URL\", {\n      loginUrl: url.toString(),\n    });\n\n    return NextResponse.redirect(url.toString());\n  } catch (error) {\n    logger.error(\"[LOGIN_HANDLER] Backend login error:\", error);\n    const urlDetectionRequest = toUrlDetectionRequest(request);\n    const appUrl = CivicAuth.getAppUrl(urlDetectionRequest);\n    return NextResponse.redirect(\n      CivicAuth.toAbsoluteUrl(\n        urlDetectionRequest,\n        \"/?error=login_failed\",\n        appUrl,\n      ),\n    );\n  }\n}\n\nasync function handleRefresh(\n  request: NextRequest,\n  config: AuthConfig,\n): Promise<NextResponse> {\n  const resolvedConfigs = resolveAuthConfig(config);\n\n  try {\n    const { civicAuth } = createCivicAuth(request, resolvedConfigs);\n\n    await civicAuth.refreshTokens();\n\n    logger.info(\"[REFRESH_HANDLER] Tokens refreshed successfully\");\n\n    const targetUrl = request.nextUrl.searchParams.get(\"targetUrl\");\n    if (targetUrl) {\n      // Success: clear the refresh attempt tracking cookie and redirect to target\n      const response = NextResponse.redirect(targetUrl);\n      response.cookies.delete(\"_civic_last_refresh\");\n      return response;\n    }\n\n    return NextResponse.json({\n      status: \"success\",\n      message: \"Tokens refreshed\",\n    });\n  } catch (error) {\n    logger.error(\"[REFRESH_HANDLER] Token refresh error:\", error);\n    const targetUrl = request.nextUrl.searchParams.get(\"targetUrl\");\n    if (targetUrl) {\n      return NextResponse.redirect(targetUrl);\n    }\n    return NextResponse.json(\n      { error: \"Token refresh failed\" },\n      { status: 500 },\n    );\n  }\n}\n\nasync function handleCallback(\n  request: NextRequest,\n  config: AuthConfig,\n): Promise<NextResponse> {\n  const resolvedConfigs = resolveAuthConfig(config);\n  const code = request.nextUrl.searchParams.get(\"code\");\n  const state = request.nextUrl.searchParams.get(\"state\");\n  const error = request.nextUrl.searchParams.get(\"error\");\n\n  if (error) {\n    logger.error(\"OAuth error in callback:\", error);\n    const urlDetectionRequest = toUrlDetectionRequest(request);\n    const appUrl = CivicAuth.getAppUrl(urlDetectionRequest);\n    return NextResponse.redirect(\n      CivicAuth.toAbsoluteUrl(\n        urlDetectionRequest,\n        \"/?error=oauth_error\",\n        appUrl,\n      ),\n    );\n  }\n\n  if (!code || !state) throw new AuthError(\"Bad parameters\", 400);\n\n  try {\n    const { civicAuth, appUrl, urlDetectionRequest } = createCivicAuth(\n      request,\n      resolvedConfigs,\n    );\n\n    // Convert NextRequest to the format expected by handleCallback\n    const handleCallbackRequest = {\n      headers: Object.fromEntries(request.headers.entries()),\n      url: request.url.toString(),\n    };\n\n    // Get loginSuccessUrl with proper baseUrl handling\n    const loginSuccessUrl = CivicAuth.getLoginSuccessUrl(\n      urlDetectionRequest,\n      appUrl,\n    );\n    const frontendUrl =\n      loginSuccessUrl || resolvedConfigs.loginSuccessUrl || \"/\";\n\n    // Use CivicAuth's smart callback handler\n    const result = await civicAuth.handleCallback(\n      {\n        code,\n        state,\n        req: handleCallbackRequest,\n      },\n      {\n        // Pass the properly resolved frontendUrl\n        frontendUrl: frontendUrl,\n      },\n    );\n\n    if (result.redirectTo) {\n      return NextResponse.redirect(\n        CivicAuth.toAbsoluteUrl(urlDetectionRequest, result.redirectTo, appUrl),\n      );\n    }\n\n    if (result.content) {\n      // Handle both string content and object content\n      if (typeof result.content === \"string\") {\n        return new NextResponse(result.content, {\n          status: 200,\n          headers: {\n            \"Content-Type\": \"text/html\",\n          },\n        });\n      } else {\n        // Object content (JSON response)\n        return NextResponse.json(result.content);\n      }\n    }\n\n    // Fallback redirect\n    return NextResponse.redirect(\n      CivicAuth.toAbsoluteUrl(urlDetectionRequest, \"/\", appUrl),\n    );\n  } catch (error) {\n    logger.error(\"[CALLBACK_HANDLER] OAuth callback error:\", error);\n    const urlDetectionRequest = toUrlDetectionRequest(request);\n    const appUrl = CivicAuth.getAppUrl(urlDetectionRequest);\n    return NextResponse.redirect(\n      CivicAuth.toAbsoluteUrl(\n        urlDetectionRequest,\n        \"/?error=callback_failed\",\n        appUrl,\n      ),\n    );\n  }\n}\n\nconst revalidateUrlPath = async (url: string) => {\n  try {\n    const path = new URL(url).pathname;\n    revalidatePath(path);\n  } catch (error) {\n    logger.warn(\"Failed to revalidate path after logout:\", error);\n  }\n};\n\nexport async function handleLogout(\n  request: NextRequest,\n  config: AuthConfig,\n): Promise<NextResponse> {\n  const resolvedConfigs = resolveAuthConfig(config);\n\n  // Get framework-agnostic request for URL utilities\n  const urlDetectionRequest = toUrlDetectionRequest(request);\n  const appUrl = CivicAuth.getAppUrl(urlDetectionRequest);\n\n  // Read the state from the query parameters\n  const state = request.nextUrl.searchParams.get(\"state\");\n  const clientLogoutRedirectUrl =\n    request.nextUrl.searchParams.get(\"logoutRedirectUrl\");\n\n  try {\n    logger.info(\"[LOGOUT_HANDLER] Backend logout endpoint called\");\n\n    // If client provided a logoutRedirectUrl, override the config\n    let configToUse = resolvedConfigs;\n    if (clientLogoutRedirectUrl) {\n      configToUse = {\n        ...resolvedConfigs,\n        logoutCallbackUrl: clientLogoutRedirectUrl,\n      };\n      logger.info(\"[LOGOUT_HANDLER] Overriding logout callback URL\", {\n        original: resolvedConfigs.logoutCallbackUrl,\n        override: clientLogoutRedirectUrl,\n      });\n    }\n\n    const { civicAuth } = createCivicAuth(request, configToUse);\n\n    // Always redirect to OAuth logout (like main branch)\n    // Don't validate session - even invalid local sessions should hit OAuth logout\n    logger.info(\"[LOGOUT_HANDLER] Processing logout request\", {\n      state: !!state,\n    });\n\n    // Always redirect to OAuth logout endpoint (like main branch)\n    // Client-side iframe logic will handle completion and redirect appropriately\n    const logoutUrl = await civicAuth.buildLogoutRedirectUrl({\n      state: state || undefined,\n    });\n\n    try {\n      await civicAuth.clearTokens();\n\n      // Revalidate current path to update authentication state in server components\n      await revalidateUrlPath(request.url);\n    } catch (error) {\n      logger.error(\"[LOGOUT_HANDLER] Error clearing tokens:\", error);\n    }\n\n    // Remove state parameter from logout URL to prevent it from appearing in frontend URL\n    const cleanLogoutUrl = new URL(logoutUrl);\n    cleanLogoutUrl.searchParams.delete(\"state\");\n\n    logger.info(\"[LOGOUT_HANDLER] Redirecting to OAuth logout endpoint\", {\n      logoutUrl: cleanLogoutUrl.toString(),\n    });\n\n    return NextResponse.redirect(cleanLogoutUrl.toString());\n  } catch (error) {\n    logger.error(\"[LOGOUT_HANDLER] Logout error:\", error);\n    // If logout URL generation fails, clear tokens and redirect to home\n    await clearAuthCookies();\n\n    const fallbackUrl =\n      clientLogoutRedirectUrl || resolvedConfigs.logoutCallbackUrl;\n    const finalFallbackUrl = CivicAuth.toAbsoluteUrl(\n      urlDetectionRequest,\n      fallbackUrl,\n      appUrl,\n    );\n\n    return NextResponse.redirect(finalFallbackUrl);\n  }\n}\n\nexport async function handleLogoutCallback(\n  request: NextRequest,\n  config: AuthConfig,\n): Promise<NextResponse> {\n  const resolvedConfigs = resolveAuthConfig(config);\n\n  try {\n    logger.info(\n      \"[LOGOUT_CALLBACK_HANDLER] Backend logout callback endpoint called\",\n    );\n\n    // Clear authentication cookies\n    await clearAuthCookies();\n\n    // Get framework-agnostic request and create CivicAuth instance\n    const urlDetectionRequest = toUrlDetectionRequest(request);\n    const { civicAuth } = createCivicAuth(request, resolvedConfigs);\n\n    // Get the state parameter for iframe detection\n    const state = request.nextUrl.searchParams.get(\"state\");\n\n    // If this is an iframe request, return HTML with logout success signal\n    if (state && displayModeFromState(state, \"iframe\") === \"iframe\") {\n      // For iframe mode, include the post-logout redirect URL in the HTML\n      const postLogoutRedirectUrl =\n        civicAuth.getPostLogoutRedirectUrl(urlDetectionRequest);\n      const response = new NextResponse(\n        `<html lang=\"en\"><span style=\"display:none\">${LOGOUT_SUCCESS_TEXT}<a href=\"${postLogoutRedirectUrl}\" rel=\"civic-auth-post-logout-redirect-url\"></a></span></html>`,\n      );\n      response.headers.set(\"Content-Type\", \"text/html; charset=utf-8\");\n      logger.info(\n        \"[LOGOUT_CALLBACK_HANDLER] Returning iframe logout success HTML\",\n        { postLogoutRedirectUrl },\n      );\n      return response;\n    }\n\n    // For non-iframe requests, redirect to the logout callback URL or post-logout URL\n    const redirectUrl = civicAuth.getPostLogoutRedirectUrl(urlDetectionRequest);\n    logger.info(\n      \"[LOGOUT_CALLBACK_HANDLER] Redirecting to logout callback URL\",\n      {\n        logoutCallbackUrl: resolvedConfigs.logoutCallbackUrl,\n        redirectUrl,\n      },\n    );\n\n    // Revalidate the redirect path to update authentication state in server components\n    await revalidateUrlPath(redirectUrl);\n    return NextResponse.redirect(redirectUrl);\n  } catch (error) {\n    logger.error(\"[LOGOUT_CALLBACK_HANDLER] Logout callback error:\", error);\n    const urlDetectionRequest = toUrlDetectionRequest(request);\n    const appUrl = CivicAuth.getAppUrl(urlDetectionRequest);\n    return NextResponse.redirect(\n      CivicAuth.toAbsoluteUrl(\n        urlDetectionRequest,\n        resolvedConfigs.logoutCallbackUrl,\n        appUrl,\n      ),\n    );\n  }\n}\n\n/**\n * Creates an authentication handler for Next.js API routes\n *\n * Usage:\n * ```ts\n * // app/api/auth/[...civicauth]/route.ts\n * import { handler } from '@civic/auth/nextjs'\n * export const GET = handler({\n *   // optional config overrides\n * })\n * ```\n */\nexport const handler =\n  (authConfig = {}) =>\n  async (request: NextRequest): Promise<NextResponse> => {\n    const config = resolveAuthConfig(authConfig);\n\n    try {\n      const pathname = request.nextUrl.pathname;\n      const pathSegments = pathname.split(\"/\");\n      const lastSegment = pathSegments[pathSegments.length - 1];\n\n      switch (lastSegment) {\n        case \"challenge\":\n        case \"login\":\n          return await handleLogin(request, config);\n        case \"callback\":\n          return await handleCallback(request, config);\n        case \"refresh\":\n          return await handleRefresh(request, config);\n        case \"logout\":\n          return await handleLogout(request, config);\n        case \"logoutcallback\":\n          return await handleLogoutCallback(request, config);\n        case \"user\":\n          return await handleUser(request, config);\n        default:\n          throw new AuthError(`Invalid auth route: ${pathname}`, 404);\n      }\n    } catch (error) {\n      logger.error(\"Auth handler error:\", error);\n\n      const status = error instanceof AuthError ? error.status : 500;\n      const message =\n        error instanceof Error ? error.message : \"Authentication failed\";\n\n      const response = NextResponse.json({ error: message }, { status });\n\n      await clearAuthCookies();\n      return response;\n    }\n  };\n\n/**\n * User endpoint - returns current user data as JSON\n * Uses CivicAuth.isLoggedIn() and getUser()\n */\nasync function handleUser(\n  request: NextRequest,\n  config: AuthConfig,\n): Promise<NextResponse> {\n  const resolvedConfigs = resolveAuthConfig(config);\n\n  try {\n    const { civicAuth } = createCivicAuth(request, resolvedConfigs);\n\n    const isLoggedIn = await civicAuth.isLoggedIn();\n\n    if (!isLoggedIn) {\n      return NextResponse.json({ error: \"Not authenticated\" }, { status: 401 });\n    }\n\n    const user = await civicAuth.getUser();\n\n    return NextResponse.json({ user });\n  } catch (error) {\n    logger.error(\"[USER_HANDLER] User endpoint error:\", error);\n    return NextResponse.json(\n      { error: \"Internal server error\" },\n      { status: 500 },\n    );\n  }\n}\n"]}

package/dist/reactjs/components/ButtonContentOrLoader.js

@@ -30,6 +30,6 @@ export const ButtonContentOrLoader = ({ authStatus, displayMode, userActionStart
                     left: 0,
                     right: 0,
                     bottom: 0,
-                }, children: _jsx(LoadingIcon, {}) })) : null] }));
+                }, children: _jsx(LoadingIcon, { width: "1.5em", height: "1.5em" }) })) : null] }));
 };
 //# sourceMappingURL=ButtonContentOrLoader.js.map

package/dist/reactjs/components/ButtonContentOrLoader.js.map

@@ -1 +1 @@
-{"version":3,"file":"ButtonContentOrLoader.js","sourceRoot":"","sources":["../../../src/reactjs/components/ButtonContentOrLoader.tsx"],"names":[],"mappings":"AAAA,YAAY,CAAC;;AACb,OAAO,KAAK,MAAM,OAAO,CAAC;AAC1B,OAAO,EAAE,WAAW,EAAE,MAAM,oCAAoC,CAAC;AAEjE,OAAO,EAAE,gBAAgB,EAAE,MAAM,YAAY,CAAC;AAE9C;;;;;;;GAOG;AACH,MAAM,CAAC,MAAM,qBAAqB,GAAG,CAAC,EACpC,UAAU,EACV,WAAW,EACX,iBAAiB,EACjB,QAAQ,GAMT,EAAE,EAAE;IACH,MAAM,UAAU,GAAG,gBAAgB,CACjC,UAAU,EACV,WAAW,EACX,iBAAiB,CAElB,CAAC;IACF,OAAO,CACL,eACE,GAAG,EAAE;YACH,QAAQ,EAAE,UAAU;YACpB,OAAO,EAAE,MAAM;YACf,UAAU,EAAE,QAAQ;YACpB,cAAc,EAAE,QAAQ;SACzB,aAED,eACE,GAAG,EAAE;oBACH,UAAU,EAAE,UAAU,CAAC,CAAC,CAAC,QAAQ,CAAC,CAAC,CAAC,SAAS;oBAC7C,UAAU,EAAE,QAAQ;iBACrB,YAEA,QAAQ,GACJ,EACN,UAAU,CAAC,CAAC,CAAC,CACZ,eACE,GAAG,EAAE;oBACH,QAAQ,EAAE,UAAU;oBACpB,OAAO,EAAE,MAAM;oBACf,cAAc,EAAE,QAAQ;oBACxB,UAAU,EAAE,QAAQ;oBACpB,GAAG,EAAE,CAAC;oBACN,IAAI,EAAE,CAAC;oBACP,KAAK,EAAE,CAAC;oBACR,MAAM,EAAE,CAAC;iBACV,YAED,KAAC,WAAW,KAAG,GACV,CACR,CAAC,CAAC,CAAC,IAAI,IACJ,CACP,CAAC;AACJ,CAAC,CAAC","sourcesContent":["\"use client\";\nimport React from \"react\";\nimport { LoadingIcon } from \"@/shared/components/LoadingIcon.js\";\nimport type { AuthStatus, DisplayMode } from \"@/types.js\";\nimport { shouldShowLoader } from \"./utils.js\";\n\n/**\n * show the loader if the user action has started and the iframe has not been aborted\n * @param {AuthStatus} options.authStatus\n * @param {DisplayMode} options.displayMode\n * @param {boolean} options.userActionStarted\n * @param options.children\n * @returns\n */\nexport const ButtonContentOrLoader = ({\n  authStatus,\n  displayMode,\n  userActionStarted,\n  children,\n}: {\n  authStatus: AuthStatus;\n  displayMode: DisplayMode;\n  userActionStarted?: boolean;\n  children: React.ReactNode;\n}) => {\n  const showLoader = shouldShowLoader(\n    authStatus,\n    displayMode,\n    userActionStarted,\n    // TODO check if the iframe was aborted\n  );\n  return (\n    <div\n      css={{\n        position: \"relative\",\n        display: \"flex\",\n        alignItems: \"center\",\n        justifyContent: \"center\",\n      }}\n    >\n      <span\n        css={{\n          visibility: showLoader ? \"hidden\" : \"visible\",\n          whiteSpace: \"nowrap\",\n        }}\n      >\n        {children}\n      </span>\n      {showLoader ? (\n        <span\n          css={{\n            position: \"absolute\",\n            display: \"flex\",\n            justifyContent: \"center\",\n            alignItems: \"center\",\n            top: 0,\n            left: 0,\n            right: 0,\n            bottom: 0,\n          }}\n        >\n          <LoadingIcon />\n        </span>\n      ) : null}\n    </div>\n  );\n};\n"]}
+{"version":3,"file":"ButtonContentOrLoader.js","sourceRoot":"","sources":["../../../src/reactjs/components/ButtonContentOrLoader.tsx"],"names":[],"mappings":"AAAA,YAAY,CAAC;;AACb,OAAO,KAAK,MAAM,OAAO,CAAC;AAC1B,OAAO,EAAE,WAAW,EAAE,MAAM,oCAAoC,CAAC;AAEjE,OAAO,EAAE,gBAAgB,EAAE,MAAM,YAAY,CAAC;AAE9C;;;;;;;GAOG;AACH,MAAM,CAAC,MAAM,qBAAqB,GAAG,CAAC,EACpC,UAAU,EACV,WAAW,EACX,iBAAiB,EACjB,QAAQ,GAMT,EAAE,EAAE;IACH,MAAM,UAAU,GAAG,gBAAgB,CACjC,UAAU,EACV,WAAW,EACX,iBAAiB,CAElB,CAAC;IACF,OAAO,CACL,eACE,GAAG,EAAE;YACH,QAAQ,EAAE,UAAU;YACpB,OAAO,EAAE,MAAM;YACf,UAAU,EAAE,QAAQ;YACpB,cAAc,EAAE,QAAQ;SACzB,aAED,eACE,GAAG,EAAE;oBACH,UAAU,EAAE,UAAU,CAAC,CAAC,CAAC,QAAQ,CAAC,CAAC,CAAC,SAAS;oBAC7C,UAAU,EAAE,QAAQ;iBACrB,YAEA,QAAQ,GACJ,EACN,UAAU,CAAC,CAAC,CAAC,CACZ,eACE,GAAG,EAAE;oBACH,QAAQ,EAAE,UAAU;oBACpB,OAAO,EAAE,MAAM;oBACf,cAAc,EAAE,QAAQ;oBACxB,UAAU,EAAE,QAAQ;oBACpB,GAAG,EAAE,CAAC;oBACN,IAAI,EAAE,CAAC;oBACP,KAAK,EAAE,CAAC;oBACR,MAAM,EAAE,CAAC;iBACV,YAED,KAAC,WAAW,IAAC,KAAK,EAAC,OAAO,EAAC,MAAM,EAAC,OAAO,GAAG,GACvC,CACR,CAAC,CAAC,CAAC,IAAI,IACJ,CACP,CAAC;AACJ,CAAC,CAAC","sourcesContent":["\"use client\";\nimport React from \"react\";\nimport { LoadingIcon } from \"@/shared/components/LoadingIcon.js\";\nimport type { AuthStatus, DisplayMode } from \"@/types.js\";\nimport { shouldShowLoader } from \"./utils.js\";\n\n/**\n * show the loader if the user action has started and the iframe has not been aborted\n * @param {AuthStatus} options.authStatus\n * @param {DisplayMode} options.displayMode\n * @param {boolean} options.userActionStarted\n * @param options.children\n * @returns\n */\nexport const ButtonContentOrLoader = ({\n  authStatus,\n  displayMode,\n  userActionStarted,\n  children,\n}: {\n  authStatus: AuthStatus;\n  displayMode: DisplayMode;\n  userActionStarted?: boolean;\n  children: React.ReactNode;\n}) => {\n  const showLoader = shouldShowLoader(\n    authStatus,\n    displayMode,\n    userActionStarted,\n    // TODO check if the iframe was aborted\n  );\n  return (\n    <div\n      css={{\n        position: \"relative\",\n        display: \"flex\",\n        alignItems: \"center\",\n        justifyContent: \"center\",\n      }}\n    >\n      <span\n        css={{\n          visibility: showLoader ? \"hidden\" : \"visible\",\n          whiteSpace: \"nowrap\",\n        }}\n      >\n        {children}\n      </span>\n      {showLoader ? (\n        <span\n          css={{\n            position: \"absolute\",\n            display: \"flex\",\n            justifyContent: \"center\",\n            alignItems: \"center\",\n            top: 0,\n            left: 0,\n            right: 0,\n            bottom: 0,\n          }}\n        >\n          <LoadingIcon width=\"1.5em\" height=\"1.5em\" />\n        </span>\n      ) : null}\n    </div>\n  );\n};\n"]}

package/dist/reactjs/components/CivicAuthIframeContainer.d.ts.map

@@ -1 +1 @@
-{"version":3,"file":"CivicAuthIframeContainer.d.ts","sourceRoot":"","sources":["../../../src/reactjs/components/CivicAuthIframeContainer.tsx"],"names":[],"mappings":"AAKA,eAAO,MAAM,wBAAwB,EAAE,KAAK,CAAC,EAsB5C,CAAC"}
+{"version":3,"file":"CivicAuthIframeContainer.d.ts","sourceRoot":"","sources":["../../../src/reactjs/components/CivicAuthIframeContainer.tsx"],"names":[],"mappings":"AAKA,eAAO,MAAM,wBAAwB,EAAE,KAAK,CAAC,EA0B5C,CAAC"}

package/dist/reactjs/components/CivicAuthIframeContainer.js

@@ -21,6 +21,6 @@ export const CivicAuthIframeContainer = () => {
         const timer = setTimeout(reloadEmbeddedIframe, 100);
         return () => clearTimeout(timer);
     }, []);
-    return _jsx("div", { id: "civic-login-container" });
+    return (_jsx("div", { className: "w-[360px] max-w-[360px]", children: _jsx("div", { id: "civic-login-container" }) }));
 };
 //# sourceMappingURL=CivicAuthIframeContainer.js.map

package/dist/reactjs/components/CivicAuthIframeContainer.js.map

@@ -1 +1 @@
-{"version":3,"file":"CivicAuthIframeContainer.js","sourceRoot":"","sources":["../../../src/reactjs/components/CivicAuthIframeContainer.tsx"],"names":[],"mappings":"AAAA,YAAY,CAAC;;AAEb,OAAO,EAAE,SAAS,EAAE,MAAM,OAAO,CAAC;AAClC,OAAO,EAAE,iBAAiB,EAAE,MAAM,8BAA8B,CAAC;AAEjE,MAAM,CAAC,MAAM,wBAAwB,GAAa,GAAG,EAAE;IACrD,yEAAyE;IACzE,SAAS,CAAC,GAAG,EAAE;QACb,MAAM,oBAAoB,GAAG,KAAK,IAAI,EAAE;YACtC,IAAI,CAAC;gBACH,MAAM,OAAO,GAAG,iBAAiB,CAAC,WAAW,EAAE,CAAC;gBAEhD,8EAA8E;gBAC9E,MAAM,OAAO,CAAC,cAAc,EAAE,CAAC;YACjC,CAAC;YAAC,MAAM,CAAC;gBACP,gCAAgC;gBAChC,sDAAsD;gBACtD,oBAAoB;YACtB,CAAC;QACH,CAAC,CAAC;QAEF,+CAA+C;QAC/C,MAAM,KAAK,GAAG,UAAU,CAAC,oBAAoB,EAAE,GAAG,CAAC,CAAC;QACpD,OAAO,GAAG,EAAE,CAAC,YAAY,CAAC,KAAK,CAAC,CAAC;IACnC,CAAC,EAAE,EAAE,CAAC,CAAC;IAEP,OAAO,cAAK,EAAE,EAAC,uBAAuB,GAAG,CAAC;AAC5C,CAAC,CAAC","sourcesContent":["\"use client\";\n\nimport { useEffect } from \"react\";\nimport { GlobalAuthManager } from \"../core/GlobalAuthManager.js\";\n\nexport const CivicAuthIframeContainer: React.FC = () => {\n  // Reload the embedded iframe when this component mounts after navigation\n  useEffect(() => {\n    const reloadEmbeddedIframe = async () => {\n      try {\n        const manager = GlobalAuthManager.getInstance();\n\n        // Use the new reloadEmbedded method - designed specifically for this scenario\n        await manager.reloadEmbedded();\n      } catch {\n        // It's ok to fail silently here\n        // This can fail on first load since it's being loaded\n        // from the provider\n      }\n    };\n\n    // Add a small delay to ensure the DOM is ready\n    const timer = setTimeout(reloadEmbeddedIframe, 100);\n    return () => clearTimeout(timer);\n  }, []);\n\n  return <div id=\"civic-login-container\" />;\n};\n"]}
+{"version":3,"file":"CivicAuthIframeContainer.js","sourceRoot":"","sources":["../../../src/reactjs/components/CivicAuthIframeContainer.tsx"],"names":[],"mappings":"AAAA,YAAY,CAAC;;AAEb,OAAO,EAAE,SAAS,EAAE,MAAM,OAAO,CAAC;AAClC,OAAO,EAAE,iBAAiB,EAAE,MAAM,8BAA8B,CAAC;AAEjE,MAAM,CAAC,MAAM,wBAAwB,GAAa,GAAG,EAAE;IACrD,yEAAyE;IACzE,SAAS,CAAC,GAAG,EAAE;QACb,MAAM,oBAAoB,GAAG,KAAK,IAAI,EAAE;YACtC,IAAI,CAAC;gBACH,MAAM,OAAO,GAAG,iBAAiB,CAAC,WAAW,EAAE,CAAC;gBAEhD,8EAA8E;gBAC9E,MAAM,OAAO,CAAC,cAAc,EAAE,CAAC;YACjC,CAAC;YAAC,MAAM,CAAC;gBACP,gCAAgC;gBAChC,sDAAsD;gBACtD,oBAAoB;YACtB,CAAC;QACH,CAAC,CAAC;QAEF,+CAA+C;QAC/C,MAAM,KAAK,GAAG,UAAU,CAAC,oBAAoB,EAAE,GAAG,CAAC,CAAC;QACpD,OAAO,GAAG,EAAE,CAAC,YAAY,CAAC,KAAK,CAAC,CAAC;IACnC,CAAC,EAAE,EAAE,CAAC,CAAC;IAEP,OAAO,CACL,cAAK,SAAS,EAAC,yBAAyB,YACtC,cAAK,EAAE,EAAC,uBAAuB,GAAG,GAC9B,CACP,CAAC;AACJ,CAAC,CAAC","sourcesContent":["\"use client\";\n\nimport { useEffect } from \"react\";\nimport { GlobalAuthManager } from \"../core/GlobalAuthManager.js\";\n\nexport const CivicAuthIframeContainer: React.FC = () => {\n  // Reload the embedded iframe when this component mounts after navigation\n  useEffect(() => {\n    const reloadEmbeddedIframe = async () => {\n      try {\n        const manager = GlobalAuthManager.getInstance();\n\n        // Use the new reloadEmbedded method - designed specifically for this scenario\n        await manager.reloadEmbedded();\n      } catch {\n        // It's ok to fail silently here\n        // This can fail on first load since it's being loaded\n        // from the provider\n      }\n    };\n\n    // Add a small delay to ensure the DOM is ready\n    const timer = setTimeout(reloadEmbeddedIframe, 100);\n    return () => clearTimeout(timer);\n  }, []);\n\n  return (\n    <div className=\"w-[360px] max-w-[360px]\">\n      <div id=\"civic-login-container\" />\n    </div>\n  );\n};\n"]}

package/dist/server/logout.d.ts.map

@@ -1 +1 @@
-{"version":3,"file":"logout.d.ts","sourceRoot":"","sources":["../../src/server/logout.ts"],"names":[],"mappings":"AAAA,OAAO,KAAK,EAAE,UAAU,EAAE,MAAM,oBAAoB,CAAC;AACrD,OAAO,KAAK,EAAE,WAAW,EAAE,MAAM,YAAY,CAAC;AAM9C,wBAAsB,sBAAsB,CAC1C,MAAM,EAAE,IAAI,CAAC,UAAU,EAAE,UAAU,GAAG,uBAAuB,CAAC,GAC5D,OAAO,CAAC,IAAI,CAAC,UAAU,EAAE,aAAa,CAAC,CAAC,GAAG;IACzC,MAAM,CAAC,EAAE,MAAM,EAAE,CAAC;IAClB,KAAK,CAAC,EAAE,MAAM,CAAC;CAChB,EACH,OAAO,EAAE,WAAW,GACnB,OAAO,CAAC,GAAG,CAAC,CAwBd"}
+{"version":3,"file":"logout.d.ts","sourceRoot":"","sources":["../../src/server/logout.ts"],"names":[],"mappings":"AAAA,OAAO,KAAK,EAAE,UAAU,EAAE,MAAM,oBAAoB,CAAC;AACrD,OAAO,KAAK,EAAE,WAAW,EAAE,MAAM,YAAY,CAAC;AAO9C,wBAAsB,sBAAsB,CAC1C,MAAM,EAAE,IAAI,CAAC,UAAU,EAAE,UAAU,GAAG,uBAAuB,CAAC,GAC5D,OAAO,CAAC,IAAI,CAAC,UAAU,EAAE,aAAa,CAAC,CAAC,GAAG;IACzC,MAAM,CAAC,EAAE,MAAM,EAAE,CAAC;IAClB,KAAK,CAAC,EAAE,MAAM,CAAC;CAChB,EACH,OAAO,EAAE,WAAW,GACnB,OAAO,CAAC,GAAG,CAAC,CAuCd"}

package/dist/server/logout.js

@@ -2,6 +2,7 @@ import { DEFAULT_AUTH_SERVER, DEFAULT_SCOPES } from "../constants.js";
 import { GenericPublicClientPKCEProducer } from "../services/PKCE.js";
 import { GenericAuthenticationInitiator } from "../services/AuthenticationService.js";
 import { OAuthTokenTypes } from "../shared/lib/types.js";
+import { getEndpointsWithOverrides } from "../shared/lib/util.js";
 export async function buildLogoutRedirectUrl(config, storage) {
     // Ensure clientId is present for OAuth operations
     if (!config.clientId) {
@@ -21,8 +22,16 @@ export async function buildLogoutRedirectUrl(config, storage) {
         redirectUrl: config.postLogoutRedirectUrl || "/",
     });
     const idToken = await storage.get(OAuthTokenTypes.ID_TOKEN);
-    if (!idToken)
-        throw new Error("No id_token found in storage");
+    // OAuth logout should work without id_token_hint (it's optional per OAuth spec)
+    if (!idToken) {
+        // Build logout URL using proper endpoint discovery, without id_token_hint
+        const endpoints = await getEndpointsWithOverrides(config.oauthServer ?? DEFAULT_AUTH_SERVER);
+        const logoutUrl = new URL(endpoints.endsession);
+        logoutUrl.searchParams.append("client_id", config.clientId);
+        logoutUrl.searchParams.append("state", state);
+        logoutUrl.searchParams.append("post_logout_redirect_uri", config.postLogoutRedirectUrl || "/");
+        return logoutUrl;
+    }
     return authInitiator.signOut(idToken);
 }
 //# sourceMappingURL=logout.js.map

package/dist/server/logout.js.map

@@ -1 +1 @@
-{"version":3,"file":"logout.js","sourceRoot":"","sources":["../../src/server/logout.ts"],"names":[],"mappings":"AAEA,OAAO,EAAE,mBAAmB,EAAE,cAAc,EAAE,MAAM,gBAAgB,CAAC;AACrE,OAAO,EAAE,+BAA+B,EAAE,MAAM,oBAAoB,CAAC;AACrE,OAAO,EAAE,8BAA8B,EAAE,MAAM,qCAAqC,CAAC;AACrF,OAAO,EAAE,eAAe,EAAE,MAAM,uBAAuB,CAAC;AAExD,MAAM,CAAC,KAAK,UAAU,sBAAsB,CAC1C,MAIG,EACH,OAAoB;IAEpB,kDAAkD;IAClD,IAAI,CAAC,MAAM,CAAC,QAAQ,EAAE,CAAC;QACrB,MAAM,IAAI,KAAK,CAAC,kDAAkD,CAAC,CAAC;IACtE,CAAC;IAED,0CAA0C;IAC1C,MAAM,KAAK,GAAG,MAAM,CAAC,KAAK,IAAI,IAAI,CAAC,MAAM,EAAE,CAAC,QAAQ,CAAC,EAAE,CAAC,CAAC,SAAS,CAAC,CAAC,CAAC,CAAC;IACtE,MAAM,MAAM,GAAG,MAAM,CAAC,MAAM,IAAI,cAAc,CAAC;IAC/C,MAAM,YAAY,GAAG,IAAI,+BAA+B,CAAC,OAAO,CAAC,CAAC;IAClE,MAAM,aAAa,GAAG,IAAI,8BAA8B,CAAC;QACvD,GAAG,MAAM;QACT,QAAQ,EAAE,MAAM,CAAC,QAAQ;QACzB,KAAK;QACL,MAAM;QACN,WAAW,EAAE,MAAM,CAAC,WAAW,IAAI,mBAAmB;QACtD,YAAY,EAAE,YAAY;QAC1B,WAAW,EAAE,MAAM,CAAC,qBAAqB,IAAI,GAAG;KACjD,CAAC,CAAC;IAEH,MAAM,OAAO,GAAG,MAAM,OAAO,CAAC,GAAG,CAAC,eAAe,CAAC,QAAQ,CAAC,CAAC;IAC5D,IAAI,CAAC,OAAO;QAAE,MAAM,IAAI,KAAK,CAAC,8BAA8B,CAAC,CAAC;IAE9D,OAAO,aAAa,CAAC,OAAO,CAAC,OAAO,CAAC,CAAC;AACxC,CAAC","sourcesContent":["import type { AuthConfig } from \"@/server/config.js\";\nimport type { AuthStorage } from \"@/types.js\";\nimport { DEFAULT_AUTH_SERVER, DEFAULT_SCOPES } from \"@/constants.js\";\nimport { GenericPublicClientPKCEProducer } from \"@/services/PKCE.js\";\nimport { GenericAuthenticationInitiator } from \"@/services/AuthenticationService.js\";\nimport { OAuthTokenTypes } from \"@/shared/lib/types.js\";\n\nexport async function buildLogoutRedirectUrl(\n  config: Pick<AuthConfig, \"clientId\" | \"postLogoutRedirectUrl\"> &\n    Partial<Pick<AuthConfig, \"oauthServer\">> & {\n      scopes?: string[];\n      state?: string;\n    },\n  storage: AuthStorage,\n): Promise<URL> {\n  // Ensure clientId is present for OAuth operations\n  if (!config.clientId) {\n    throw new Error(\"clientId is required for OAuth logout operations\");\n  }\n\n  // generate a random state if not provided\n  const state = config.state ?? Math.random().toString(36).substring(2);\n  const scopes = config.scopes ?? DEFAULT_SCOPES;\n  const pkceProducer = new GenericPublicClientPKCEProducer(storage);\n  const authInitiator = new GenericAuthenticationInitiator({\n    ...config,\n    clientId: config.clientId,\n    state,\n    scopes,\n    oauthServer: config.oauthServer ?? DEFAULT_AUTH_SERVER,\n    pkceConsumer: pkceProducer,\n    redirectUrl: config.postLogoutRedirectUrl || \"/\",\n  });\n\n  const idToken = await storage.get(OAuthTokenTypes.ID_TOKEN);\n  if (!idToken) throw new Error(\"No id_token found in storage\");\n\n  return authInitiator.signOut(idToken);\n}\n"]}
+{"version":3,"file":"logout.js","sourceRoot":"","sources":["../../src/server/logout.ts"],"names":[],"mappings":"AAEA,OAAO,EAAE,mBAAmB,EAAE,cAAc,EAAE,MAAM,gBAAgB,CAAC;AACrE,OAAO,EAAE,+BAA+B,EAAE,MAAM,oBAAoB,CAAC;AACrE,OAAO,EAAE,8BAA8B,EAAE,MAAM,qCAAqC,CAAC;AACrF,OAAO,EAAE,eAAe,EAAE,MAAM,uBAAuB,CAAC;AACxD,OAAO,EAAE,yBAAyB,EAAE,MAAM,sBAAsB,CAAC;AAEjE,MAAM,CAAC,KAAK,UAAU,sBAAsB,CAC1C,MAIG,EACH,OAAoB;IAEpB,kDAAkD;IAClD,IAAI,CAAC,MAAM,CAAC,QAAQ,EAAE,CAAC;QACrB,MAAM,IAAI,KAAK,CAAC,kDAAkD,CAAC,CAAC;IACtE,CAAC;IAED,0CAA0C;IAC1C,MAAM,KAAK,GAAG,MAAM,CAAC,KAAK,IAAI,IAAI,CAAC,MAAM,EAAE,CAAC,QAAQ,CAAC,EAAE,CAAC,CAAC,SAAS,CAAC,CAAC,CAAC,CAAC;IACtE,MAAM,MAAM,GAAG,MAAM,CAAC,MAAM,IAAI,cAAc,CAAC;IAC/C,MAAM,YAAY,GAAG,IAAI,+BAA+B,CAAC,OAAO,CAAC,CAAC;IAClE,MAAM,aAAa,GAAG,IAAI,8BAA8B,CAAC;QACvD,GAAG,MAAM;QACT,QAAQ,EAAE,MAAM,CAAC,QAAQ;QACzB,KAAK;QACL,MAAM;QACN,WAAW,EAAE,MAAM,CAAC,WAAW,IAAI,mBAAmB;QACtD,YAAY,EAAE,YAAY;QAC1B,WAAW,EAAE,MAAM,CAAC,qBAAqB,IAAI,GAAG;KACjD,CAAC,CAAC;IAEH,MAAM,OAAO,GAAG,MAAM,OAAO,CAAC,GAAG,CAAC,eAAe,CAAC,QAAQ,CAAC,CAAC;IAE5D,gFAAgF;IAChF,IAAI,CAAC,OAAO,EAAE,CAAC;QACb,0EAA0E;QAC1E,MAAM,SAAS,GAAG,MAAM,yBAAyB,CAC/C,MAAM,CAAC,WAAW,IAAI,mBAAmB,CAC1C,CAAC;QACF,MAAM,SAAS,GAAG,IAAI,GAAG,CAAC,SAAS,CAAC,UAAU,CAAC,CAAC;QAChD,SAAS,CAAC,YAAY,CAAC,MAAM,CAAC,WAAW,EAAE,MAAM,CAAC,QAAQ,CAAC,CAAC;QAC5D,SAAS,CAAC,YAAY,CAAC,MAAM,CAAC,OAAO,EAAE,KAAK,CAAC,CAAC;QAC9C,SAAS,CAAC,YAAY,CAAC,MAAM,CAC3B,0BAA0B,EAC1B,MAAM,CAAC,qBAAqB,IAAI,GAAG,CACpC,CAAC;QACF,OAAO,SAAS,CAAC;IACnB,CAAC;IAED,OAAO,aAAa,CAAC,OAAO,CAAC,OAAO,CAAC,CAAC;AACxC,CAAC","sourcesContent":["import type { AuthConfig } from \"@/server/config.js\";\nimport type { AuthStorage } from \"@/types.js\";\nimport { DEFAULT_AUTH_SERVER, DEFAULT_SCOPES } from \"@/constants.js\";\nimport { GenericPublicClientPKCEProducer } from \"@/services/PKCE.js\";\nimport { GenericAuthenticationInitiator } from \"@/services/AuthenticationService.js\";\nimport { OAuthTokenTypes } from \"@/shared/lib/types.js\";\nimport { getEndpointsWithOverrides } from \"@/shared/lib/util.js\";\n\nexport async function buildLogoutRedirectUrl(\n  config: Pick<AuthConfig, \"clientId\" | \"postLogoutRedirectUrl\"> &\n    Partial<Pick<AuthConfig, \"oauthServer\">> & {\n      scopes?: string[];\n      state?: string;\n    },\n  storage: AuthStorage,\n): Promise<URL> {\n  // Ensure clientId is present for OAuth operations\n  if (!config.clientId) {\n    throw new Error(\"clientId is required for OAuth logout operations\");\n  }\n\n  // generate a random state if not provided\n  const state = config.state ?? Math.random().toString(36).substring(2);\n  const scopes = config.scopes ?? DEFAULT_SCOPES;\n  const pkceProducer = new GenericPublicClientPKCEProducer(storage);\n  const authInitiator = new GenericAuthenticationInitiator({\n    ...config,\n    clientId: config.clientId,\n    state,\n    scopes,\n    oauthServer: config.oauthServer ?? DEFAULT_AUTH_SERVER,\n    pkceConsumer: pkceProducer,\n    redirectUrl: config.postLogoutRedirectUrl || \"/\",\n  });\n\n  const idToken = await storage.get(OAuthTokenTypes.ID_TOKEN);\n\n  // OAuth logout should work without id_token_hint (it's optional per OAuth spec)\n  if (!idToken) {\n    // Build logout URL using proper endpoint discovery, without id_token_hint\n    const endpoints = await getEndpointsWithOverrides(\n      config.oauthServer ?? DEFAULT_AUTH_SERVER,\n    );\n    const logoutUrl = new URL(endpoints.endsession);\n    logoutUrl.searchParams.append(\"client_id\", config.clientId);\n    logoutUrl.searchParams.append(\"state\", state);\n    logoutUrl.searchParams.append(\n      \"post_logout_redirect_uri\",\n      config.postLogoutRedirectUrl || \"/\",\n    );\n    return logoutUrl;\n  }\n\n  return authInitiator.signOut(idToken);\n}\n"]}

package/dist/server/session.d.ts.map

@@ -1 +1 @@
-{"version":3,"file":"session.d.ts","sourceRoot":"","sources":["../../src/server/session.ts"],"names":[],"mappings":"AAAA,OAAO,EACL,KAAK,WAAW,EAChB,KAAK,WAAW,EAChB,KAAK,IAAI,EACT,KAAK,WAAW,EAChB,KAAK,aAAa,EAClB,KAAK,qBAAqB,EAE3B,MAAM,YAAY,CAAC;AACpB,OAAO,KAAK,EAAE,UAAU,EAAE,MAAM,oBAAoB,CAAC;AAoBrD,OAAO,KAAK,EAAE,sBAAsB,EAAE,MAAM,qBAAqB,CAAC;AAOlE,MAAM,MAAM,mBAAmB,GAAG;IAChC,GAAG,EAAE,MAAM,CAAC;IACZ,OAAO,EAAE,MAAM,CAAC,MAAM,EAAE,MAAM,GAAG,MAAM,EAAE,GAAG,SAAS,CAAC,CAAC;IACvD,YAAY,EAAE;QACZ,GAAG,CAAC,IAAI,EAAE,MAAM,GAAG,MAAM,GAAG,IAAI,CAAC;KAClC,CAAC;IACF,OAAO,EAAE;QACP,GAAG,CAAC,IAAI,EAAE,MAAM,GAAG;YAAE,KAAK,EAAE,MAAM,CAAA;SAAE,GAAG,SAAS,CAAC;KAClD,CAAC;CACH,CAAC;AAEF,MAAM,MAAM,qBAAqB,GAAG;IAClC,OAAO,EAAE;QACP,CAAC,GAAG,EAAE,MAAM,GAAG,MAAM,GAAG,MAAM,EAAE,GAAG,SAAS,CAAC;QAC7C,OAAO,CAAC,EAAE,MAAM,CAAC;QACjB,MAAM,CAAC,EAAE,MAAM,CAAC;QAChB,YAAY,CAAC,EAAE,MAAM,CAAC;QACtB,MAAM,CAAC,EAAE,MAAM,CAAC;QAChB,gBAAgB,CAAC,EAAE,MAAM,CAAC;KAC3B,CAAC;IACF,GAAG,CAAC,EAAE,MAAM,CAAC;CACd,CAAC;AAEF,MAAM,MAAM,oBAAoB,GAAG;IACjC,IAAI,EAAE,MAAM,CAAC;IACb,KAAK,EAAE,MAAM,CAAC;IACd,GAAG,EAAE,qBAAqB,CAAC;CAC5B,CAAC;AAgDF;;;GAGG;AACH,qBAAa,SAAS;IAGlB,QAAQ,CAAC,OAAO,EAAE,WAAW;IAC7B,QAAQ,CAAC,UAAU,EAAE,UAAU;IAHjC,aAAa,EAAE,sBAAsB,GAAG,IAAI,CAAQ;gBAEzC,OAAO,EAAE,WAAW,EACpB,UAAU,EAAE,UAAU;IAGjC,IAAI,WAAW,IAAI,MAAM,CAExB;IAEK,eAAe,IAAI,OAAO,CAAC,sBAAsB,CAAC;IAaxD;;;OAGG;IACG,OAAO,CACX,CAAC,SAAS,aAAa,GAAG,WAAW,KAClC,OAAO,CAAC,IAAI,CAAC,CAAC,CAAC,GAAG,IAAI,CAAC;IAkB5B;;;OAGG;IACG,SAAS,IAAI,OAAO,CAAC,WAAW,GAAG,IAAI,CAAC;IAoB9C;;;;;OAKG;IACG,sBAAsB,CAC1B,IAAI,EAAE,MAAM,EACZ,KAAK,EAAE,MAAM,GACZ,OAAO,CAAC,qBAAqB,CAAC;IAIjC;;;OAGG;IACG,UAAU,IAAI,OAAO,CAAC,OAAO,CAAC;IAMpC;;;;OAIG;IACG,aAAa,CAAC,OAAO,CAAC,EAAE;QAC5B,MAAM,CAAC,EAAE,MAAM,EAAE,CAAC;QAClB,KAAK,CAAC,EAAE,MAAM,CAAC;QACf,KAAK,CAAC,EAAE,MAAM,CAAC;KAChB,GAAG,OAAO,CAAC,GAAG,CAAC;IAchB;;;;OAIG;IACG,sBAAsB,CAAC,OAAO,CAAC,EAAE;QACrC,MAAM,CAAC,EAAE,MAAM,EAAE,CAAC;QAClB,KAAK,CAAC,EAAE,MAAM,CAAC;KAChB,GAAG,OAAO,CAAC,GAAG,CAAC;IA8ChB;;;OAGG;IACG,aAAa,IAAI,OAAO,CAAC,qBAAqB,GAAG,IAAI,CAAC;IAI5D;;OAEG;IACG,WAAW,IAAI,OAAO,CAAC,IAAI,CAAC;IAIlC;;;OAGG;IAEH;;OAEG;IACH,MAAM,CAAC,YAAY,CAAC,KAAK,EAAE,MAAM,GAAG,MAAM;IAS1C;;OAEG;IACH,MAAM,CAAC,oBAAoB,CACzB,OAAO,EAAE,mBAAmB,EAC5B,SAAS,EAAE,MAAM,GAChB,MAAM,GAAG,IAAI;IAQhB;;OAEG;IACH,MAAM,CAAC,qBAAqB,CAC1B,OAAO,EAAE,mBAAmB,EAC5B,UAAU,EAAE,MAAM,EAClB,SAAS,EAAE,MAAM,GAChB,MAAM,GAAG,IAAI;IAWhB;;;OAGG;IACH,MAAM,CAAC,SAAS,CAAC,OAAO,EAAE,mBAAmB,GAAG,MAAM,GAAG,IAAI;IAQ7D;;;OAGG;IACH,MAAM,CAAC,kBAAkB,CACvB,OAAO,EAAE,mBAAmB,EAC5B,OAAO,CAAC,EAAE,MAAM,GAAG,IAAI,GACtB,MAAM,GAAG,IAAI;IAahB;;OAEG;IACH,MAAM,CAAC,aAAa,CAClB,OAAO,EAAE,mBAAmB,EAC5B,GAAG,EAAE,MAAM,EACX,MAAM,CAAC,EAAE,MAAM,GAAG,IAAI,GACrB,MAAM;IAUT;;OAEG;IACH,wBAAwB,CAAC,OAAO,EAAE,mBAAmB,GAAG,MAAM;IAyB9D;;;;;;;;;;;;;;;;;;;;;;;;;;;;OA4BG;IACG,cAAc,CAClB,EAAE,IAAI,EAAE,KAAK,EAAE,GAAG,EAAE,EAAE,oBAAoB,EAC1C,OAAO,CAAC,EAAE;QACR,WAAW,CAAC,EAAE,MAAM,CAAC;QACrB,WAAW,CAAC,EAAE,OAAO,CAAC;KACvB,GACA,OAAO,CAAC;QACT,UAAU,CAAC,EAAE,MAAM,CAAC;QACpB,OAAO,CAAC,EAAE,MAAM,GAAG;YAAE,OAAO,EAAE,OAAO,CAAC;YAAC,IAAI,CAAC,EAAE,IAAI,GAAG,IAAI,CAAA;SAAE,CAAC;KAC7D,CAAC;IAwPF;;OAEG;IACH,OAAO,CAAC,4BAA4B;IAyEpC;;OAEG;IACH,OAAO,CAAC,8BAA8B,CAkCpC;CACH"}
+{"version":3,"file":"session.d.ts","sourceRoot":"","sources":["../../src/server/session.ts"],"names":[],"mappings":"AAAA,OAAO,EACL,KAAK,WAAW,EAChB,KAAK,WAAW,EAChB,KAAK,IAAI,EACT,KAAK,WAAW,EAChB,KAAK,aAAa,EAClB,KAAK,qBAAqB,EAE3B,MAAM,YAAY,CAAC;AACpB,OAAO,KAAK,EAAE,UAAU,EAAE,MAAM,oBAAoB,CAAC;AAoBrD,OAAO,KAAK,EAAE,sBAAsB,EAAE,MAAM,qBAAqB,CAAC;AAQlE,MAAM,MAAM,mBAAmB,GAAG;IAChC,GAAG,EAAE,MAAM,CAAC;IACZ,OAAO,EAAE,MAAM,CAAC,MAAM,EAAE,MAAM,GAAG,MAAM,EAAE,GAAG,SAAS,CAAC,CAAC;IACvD,YAAY,EAAE;QACZ,GAAG,CAAC,IAAI,EAAE,MAAM,GAAG,MAAM,GAAG,IAAI,CAAC;KAClC,CAAC;IACF,OAAO,EAAE;QACP,GAAG,CAAC,IAAI,EAAE,MAAM,GAAG;YAAE,KAAK,EAAE,MAAM,CAAA;SAAE,GAAG,SAAS,CAAC;KAClD,CAAC;CACH,CAAC;AAEF,MAAM,MAAM,qBAAqB,GAAG;IAClC,OAAO,EAAE;QACP,CAAC,GAAG,EAAE,MAAM,GAAG,MAAM,GAAG,MAAM,EAAE,GAAG,SAAS,CAAC;QAC7C,OAAO,CAAC,EAAE,MAAM,CAAC;QACjB,MAAM,CAAC,EAAE,MAAM,CAAC;QAChB,YAAY,CAAC,EAAE,MAAM,CAAC;QACtB,MAAM,CAAC,EAAE,MAAM,CAAC;QAChB,gBAAgB,CAAC,EAAE,MAAM,CAAC;KAC3B,CAAC;IACF,GAAG,CAAC,EAAE,MAAM,CAAC;CACd,CAAC;AAEF,MAAM,MAAM,oBAAoB,GAAG;IACjC,IAAI,EAAE,MAAM,CAAC;IACb,KAAK,EAAE,MAAM,CAAC;IACd,GAAG,EAAE,qBAAqB,CAAC;CAC5B,CAAC;AAgDF;;;GAGG;AACH,qBAAa,SAAS;IAGlB,QAAQ,CAAC,OAAO,EAAE,WAAW;IAC7B,QAAQ,CAAC,UAAU,EAAE,UAAU;IAHjC,aAAa,EAAE,sBAAsB,GAAG,IAAI,CAAQ;gBAEzC,OAAO,EAAE,WAAW,EACpB,UAAU,EAAE,UAAU;IAGjC,IAAI,WAAW,IAAI,MAAM,CAExB;IAEK,eAAe,IAAI,OAAO,CAAC,sBAAsB,CAAC;IAaxD;;;OAGG;IACG,OAAO,CACX,CAAC,SAAS,aAAa,GAAG,WAAW,KAClC,OAAO,CAAC,IAAI,CAAC,CAAC,CAAC,GAAG,IAAI,CAAC;IAkB5B;;;OAGG;IACG,SAAS,IAAI,OAAO,CAAC,WAAW,GAAG,IAAI,CAAC;IAoB9C;;;;;OAKG;IACG,sBAAsB,CAC1B,IAAI,EAAE,MAAM,EACZ,KAAK,EAAE,MAAM,GACZ,OAAO,CAAC,qBAAqB,CAAC;IAIjC;;;OAGG;IACG,UAAU,IAAI,OAAO,CAAC,OAAO,CAAC;IAMpC;;;;OAIG;IACG,aAAa,CAAC,OAAO,CAAC,EAAE;QAC5B,MAAM,CAAC,EAAE,MAAM,EAAE,CAAC;QAClB,KAAK,CAAC,EAAE,MAAM,CAAC;QACf,KAAK,CAAC,EAAE,MAAM,CAAC;KAChB,GAAG,OAAO,CAAC,GAAG,CAAC;IAchB;;;;OAIG;IACG,sBAAsB,CAAC,OAAO,CAAC,EAAE;QACrC,MAAM,CAAC,EAAE,MAAM,EAAE,CAAC;QAClB,KAAK,CAAC,EAAE,MAAM,CAAC;KAChB,GAAG,OAAO,CAAC,GAAG,CAAC;IAuEhB;;;OAGG;IACG,aAAa,IAAI,OAAO,CAAC,qBAAqB,GAAG,IAAI,CAAC;IAI5D;;OAEG;IACG,WAAW,IAAI,OAAO,CAAC,IAAI,CAAC;IAIlC;;;OAGG;IAEH;;OAEG;IACH,MAAM,CAAC,YAAY,CAAC,KAAK,EAAE,MAAM,GAAG,MAAM;IAS1C;;OAEG;IACH,MAAM,CAAC,oBAAoB,CACzB,OAAO,EAAE,mBAAmB,EAC5B,SAAS,EAAE,MAAM,GAChB,MAAM,GAAG,IAAI;IAQhB;;OAEG;IACH,MAAM,CAAC,qBAAqB,CAC1B,OAAO,EAAE,mBAAmB,EAC5B,UAAU,EAAE,MAAM,EAClB,SAAS,EAAE,MAAM,GAChB,MAAM,GAAG,IAAI;IAWhB;;;OAGG;IACH,MAAM,CAAC,SAAS,CAAC,OAAO,EAAE,mBAAmB,GAAG,MAAM,GAAG,IAAI;IAQ7D;;;OAGG;IACH,MAAM,CAAC,kBAAkB,CACvB,OAAO,EAAE,mBAAmB,EAC5B,OAAO,CAAC,EAAE,MAAM,GAAG,IAAI,GACtB,MAAM,GAAG,IAAI;IAahB;;OAEG;IACH,MAAM,CAAC,aAAa,CAClB,OAAO,EAAE,mBAAmB,EAC5B,GAAG,EAAE,MAAM,EACX,MAAM,CAAC,EAAE,MAAM,GAAG,IAAI,GACrB,MAAM;IAUT;;OAEG;IACH,wBAAwB,CAAC,OAAO,EAAE,mBAAmB,GAAG,MAAM;IAyB9D;;;;;;;;;;;;;;;;;;;;;;;;;;;;OA4BG;IACG,cAAc,CAClB,EAAE,IAAI,EAAE,KAAK,EAAE,GAAG,EAAE,EAAE,oBAAoB,EAC1C,OAAO,CAAC,EAAE;QACR,WAAW,CAAC,EAAE,MAAM,CAAC;QACrB,WAAW,CAAC,EAAE,OAAO,CAAC;KACvB,GACA,OAAO,CAAC;QACT,UAAU,CAAC,EAAE,MAAM,CAAC;QACpB,OAAO,CAAC,EAAE,MAAM,GAAG;YAAE,OAAO,EAAE,OAAO,CAAC;YAAC,IAAI,CAAC,EAAE,IAAI,GAAG,IAAI,CAAA;SAAE,CAAC;KAC7D,CAAC;IAwPF;;OAEG;IACH,OAAO,CAAC,4BAA4B;IAyEpC;;OAEG;IACH,OAAO,CAAC,8BAA8B,CAkCpC;CACH"}

package/dist/server/session.js

@@ -13,6 +13,7 @@ import { displayModeFromState, loginSuccessUrlFromState } from "../lib/oauth.js"
 import { decodeJwt } from "jose";
 import { generateOauthLogoutUrl } from "../shared/lib/util.js";
 import { CodeVerifier } from "../shared/lib/types.js";
+import { getBackendEndpoints, resolveEndpointUrl } from "../shared/lib/util.js";
 // Function to omit keys from an object
 const omitKeys = (keys, obj) => {
     const result = { ...obj };
@@ -153,8 +154,25 @@ export class CivicAuth {
      * @returns The logout URL
      */
     async buildLogoutRedirectUrl(options) {
-        // For backend flows with HTTP-only cookies, try to get tokens directly
-        // For logout, we don't need valid/authenticated tokens - just the ID token to build logout URL
+        // Check if this is backend integration mode (loginUrl provided)
+        if (this.authConfig.loginUrl) {
+            // Backend integration mode: redirect to backend logout endpoint
+            // This matches the vanilla client's logout logic for backend integration
+            const backendUrl = new URL(this.authConfig.loginUrl).origin;
+            const endpoints = getBackendEndpoints(this.authConfig.backendEndpoints);
+            const backendLogoutUrl = resolveEndpointUrl(backendUrl, endpoints.logout);
+            const logoutUrl = new URL(backendLogoutUrl);
+            // Include logoutRedirectUrl as query parameter if configured
+            if (this.authConfig.postLogoutRedirectUrl) {
+                logoutUrl.searchParams.set("logoutRedirectUrl", this.authConfig.postLogoutRedirectUrl);
+            }
+            // Include state if provided
+            if (options?.state) {
+                logoutUrl.searchParams.set("state", options.state);
+            }
+            return logoutUrl;
+        }
+        // Standard OAuth flow - redirect to OAuth provider's logout endpoint
         try {
             // Use the shared getTokens function directly - this bypasses session validation
             // since for logout we just need the raw ID token, not validated tokens