@danainnovations/sonance-gate 0.1.0

package/README.md

@@ -0,0 +1,63 @@
+# @danainnovations/sonance-gate
+
+Sonance Okta SSO for any web app on Vercel — one file, any framework (Next.js, Vite, Astro, SvelteKit, static HTML).
+
+## How it behaves
+
+| Environment | Behavior |
+|---|---|
+| Vercel production | Real Okta sign-in required for every route |
+| Vercel preview | Open (protect previews with Vercel Deployment Protection) |
+| Local dev | Open — `/auth/me` returns a fake "Dev User" |
+
+Sessions last 12 hours; re-auth is silent while your Okta session is alive.
+
+## Install
+
+```bash
+npm install @danainnovations/sonance-gate
+```
+
+Create `middleware.ts` at your project root (NOT inside `src/` or `app/`):
+
+```ts
+import { createGate } from '@danainnovations/sonance-gate'
+
+export default createGate({
+  // Paths reachable without sign-in. '/prefix/*' matches the whole subtree;
+  // a bare '/prefix' must be listed exactly (on its own) to be public.
+  publicPaths: ['/api/webhook/*'],
+})
+
+export const config = {
+  runtime: 'nodejs',
+  matcher: ['/((?!_next/static|_next/image|favicon.ico|assets/).*)'],
+}
+```
+
+Next.js note: on Next.js ≤15 the framework owns root `middleware.ts` — compose by calling the gate first inside your existing middleware and returning its Response when defined. On Next.js 16+ use `proxy.ts` for framework logic; `middleware.ts` belongs to the gate.
+
+## Environment variables (Vercel production only)
+
+`OKTA_CLIENT_ID`, `OKTA_CLIENT_SECRET`, `OKTA_ISSUER` — pushed by the Technology team from your app's Okta registration. `SESSION_SECRET` — any random string ≥32 chars. Nothing is needed locally.
+
+If any are missing in production the gate fails closed with a 500 naming the missing key names.
+
+## Showing who's signed in
+
+The gate serves `GET /auth/me` → `{ sub, name, email }` (a fake Dev User outside production). Framework-free widget:
+
+```html
+<div id="whoami"></div>
+<script>
+  fetch('/auth/me').then(r => r.ok ? r.json() : null).then(user => {
+    if (!user) return
+    document.getElementById('whoami').innerHTML =
+      `${user.name} · <a href="/auth/signout">Sign out</a>`
+  })
+</script>
+```
+
+Endpoints: `/auth/signin` (optionally `?returnTo=/path`), `/auth/signout`, `/auth/me`, `/auth/callback` (Okta's redirect URI — register `https://<your-domain>/auth/callback`).
+
+Sign-out clears the app session and forces a fresh Okta credential prompt on the next visit (your Okta org session for other apps stays alive).

package/dist/index.cjs

@@ -0,0 +1,360 @@
+"use strict";
+var __create = Object.create;
+var __defProp = Object.defineProperty;
+var __getOwnPropDesc = Object.getOwnPropertyDescriptor;
+var __getOwnPropNames = Object.getOwnPropertyNames;
+var __getProtoOf = Object.getPrototypeOf;
+var __hasOwnProp = Object.prototype.hasOwnProperty;
+var __export = (target, all) => {
+  for (var name in all)
+    __defProp(target, name, { get: all[name], enumerable: true });
+};
+var __copyProps = (to, from, except, desc) => {
+  if (from && typeof from === "object" || typeof from === "function") {
+    for (let key of __getOwnPropNames(from))
+      if (!__hasOwnProp.call(to, key) && key !== except)
+        __defProp(to, key, { get: () => from[key], enumerable: !(desc = __getOwnPropDesc(from, key)) || desc.enumerable });
+  }
+  return to;
+};
+var __toESM = (mod, isNodeMode, target) => (target = mod != null ? __create(__getProtoOf(mod)) : {}, __copyProps(
+  // If the importer is in node compatibility mode or this is not an ESM
+  // file that has been converted to a CommonJS file using a Babel-
+  // compatible transform (i.e. "__esModule" has not been set), then set
+  // "default" to the CommonJS "module.exports" for node compatibility.
+  isNodeMode || !mod || !mod.__esModule ? __defProp(target, "default", { value: mod, enumerable: true }) : target,
+  mod
+));
+var __toCommonJS = (mod) => __copyProps(__defProp({}, "__esModule", { value: true }), mod);
+
+// src/index.ts
+var index_exports = {};
+__export(index_exports, {
+  DEV_USER: () => DEV_USER,
+  createGate: () => createGate
+});
+module.exports = __toCommonJS(index_exports);
+var import_middleware = require("@vercel/functions/middleware");
+
+// src/config.ts
+function loadEnv(vars = process.env) {
+  const enforcing = vars.VERCEL_ENV === "production" && vars.AUTH_BYPASS !== "true";
+  if (!enforcing) return { mode: "open" };
+  const missing = [];
+  if (!vars.OKTA_CLIENT_ID) missing.push("OKTA_CLIENT_ID");
+  if (!vars.OKTA_CLIENT_SECRET) missing.push("OKTA_CLIENT_SECRET");
+  if (!vars.OKTA_ISSUER) missing.push("OKTA_ISSUER");
+  if (!vars.SESSION_SECRET) missing.push("SESSION_SECRET");
+  else if (vars.SESSION_SECRET.length < 32) missing.push("SESSION_SECRET (must be at least 32 chars)");
+  if (missing.length > 0) return { mode: "misconfigured", missing };
+  return {
+    mode: "enforce",
+    env: {
+      clientId: vars.OKTA_CLIENT_ID,
+      clientSecret: vars.OKTA_CLIENT_SECRET,
+      issuer: normalizeIssuer(vars.OKTA_ISSUER),
+      sessionSecret: vars.SESSION_SECRET
+    }
+  };
+}
+function normalizeIssuer(raw) {
+  const withScheme = /^https?:\/\//.test(raw) ? raw : `https://${raw}`;
+  return withScheme.replace(/\/+$/, "");
+}
+
+// src/cookies.ts
+var SESSION_COOKIE = "__Host-sg_session";
+var STATE_COOKIE = "__Host-sg_state";
+var SIGNEDOUT_COOKIE = "__Host-sg_signedout";
+var ATTRS = "Path=/; HttpOnly; Secure; SameSite=Lax";
+function getCookie(request, name) {
+  const header = request.headers.get("cookie");
+  if (!header) return void 0;
+  for (const part of header.split(";")) {
+    const eq = part.indexOf("=");
+    if (eq === -1) continue;
+    if (part.slice(0, eq).trim() === name) return part.slice(eq + 1).trim();
+  }
+  return void 0;
+}
+function setCookie(name, value, maxAgeSec) {
+  return `${name}=${value}; ${ATTRS}; Max-Age=${maxAgeSec}`;
+}
+function clearCookie(name) {
+  return `${name}=; ${ATTRS}; Max-Age=0`;
+}
+
+// src/session.ts
+var import_node_crypto = require("crypto");
+var import_jose = require("jose");
+var SESSION_MAX_AGE = 43200;
+var STATE_MAX_AGE = 600;
+function keyOf(secret) {
+  return new Uint8Array((0, import_node_crypto.createHash)("sha256").update(secret).digest());
+}
+async function seal(claims, secret, maxAgeSec) {
+  const now = Math.floor(Date.now() / 1e3);
+  return new import_jose.EncryptJWT(claims).setProtectedHeader({ alg: "dir", enc: "A256GCM" }).setIssuedAt(now).setExpirationTime(now + maxAgeSec).encrypt(keyOf(secret));
+}
+async function unseal(token, secret) {
+  try {
+    const { payload } = await (0, import_jose.jwtDecrypt)(token, keyOf(secret));
+    return payload;
+  } catch {
+    return null;
+  }
+}
+
+// src/oidc.ts
+var import_node_crypto2 = require("crypto");
+var import_jose2 = require("jose");
+var discoveryCache = /* @__PURE__ */ new Map();
+function discover(issuer, fetchFn = fetch) {
+  let cached = discoveryCache.get(issuer);
+  if (!cached) {
+    cached = (async () => {
+      const res = await fetchFn(`${issuer}/.well-known/openid-configuration`);
+      if (!res.ok) throw new Error(`OIDC discovery failed (${res.status}) for issuer`);
+      return await res.json();
+    })();
+    cached.catch(() => discoveryCache.delete(issuer));
+    discoveryCache.set(issuer, cached);
+  }
+  return cached;
+}
+function randomToken() {
+  return (0, import_node_crypto2.randomBytes)(32).toString("base64url");
+}
+async function pkcePair() {
+  const verifier = randomToken();
+  const challenge = (0, import_node_crypto2.createHash)("sha256").update(verifier).digest("base64url");
+  return { verifier, challenge };
+}
+function buildAuthorizeUrl(meta, p) {
+  const url = new URL(meta.authorization_endpoint);
+  url.search = new URLSearchParams({
+    client_id: p.clientId,
+    response_type: "code",
+    scope: "openid profile email",
+    redirect_uri: p.redirectUri,
+    state: p.state,
+    nonce: p.nonce,
+    code_challenge: p.challenge,
+    code_challenge_method: "S256",
+    ...p.prompt ? { prompt: p.prompt } : {}
+  }).toString();
+  return url.toString();
+}
+async function exchangeCode(meta, p, fetchFn = fetch) {
+  const res = await fetchFn(meta.token_endpoint, {
+    method: "POST",
+    headers: {
+      "content-type": "application/x-www-form-urlencoded",
+      authorization: `Basic ${Buffer.from(`${p.clientId}:${p.clientSecret}`).toString("base64")}`
+    },
+    body: new URLSearchParams({
+      grant_type: "authorization_code",
+      code: p.code,
+      redirect_uri: p.redirectUri,
+      code_verifier: p.verifier
+    }).toString()
+  });
+  if (!res.ok) throw new Error(`Token exchange failed (${res.status})`);
+  const json2 = await res.json();
+  if (!json2.id_token) throw new Error("Token exchange failed (no id_token in response)");
+  return { idToken: json2.id_token };
+}
+async function validateIdToken(idToken, p) {
+  const { payload } = await (0, import_jose2.jwtVerify)(idToken, p.jwks, {
+    issuer: p.issuer,
+    audience: p.clientId
+  });
+  if (payload.nonce !== p.nonce) throw new Error("ID token nonce mismatch");
+  return {
+    sub: String(payload.sub ?? ""),
+    name: String(payload.name ?? payload.email ?? "Unknown"),
+    email: String(payload.email ?? "")
+  };
+}
+
+// src/gate.ts
+var remoteJwks;
+var DEV_USER = { sub: "dev-user", name: "Dev User", email: "dev@sonance.com" };
+function json(body, status = 200, headers = {}) {
+  return new Response(JSON.stringify(body), {
+    status,
+    headers: { "content-type": "application/json", "cache-control": "no-store", ...headers }
+  });
+}
+function redirect(location, cookies = []) {
+  const headers = new Headers({ location });
+  for (const c of cookies) headers.append("set-cookie", c);
+  return new Response(null, { status: 302, headers });
+}
+async function handleRequest(request, opts = {}, vars = process.env, deps = {}) {
+  const env = loadEnv(vars);
+  const path = new URL(request.url).pathname;
+  if (env.mode === "open") {
+    if (path === "/auth/me") return json(DEV_USER);
+    if (path === "/auth/signin" || path === "/auth/signout") return redirect("/");
+    return void 0;
+  }
+  if (env.mode === "misconfigured") {
+    return new Response(
+      `Authentication misconfigured. Missing environment variables: ${env.missing.join(", ")}`,
+      { status: 500, headers: { "content-type": "text/plain" } }
+    );
+  }
+  try {
+    return await enforce(request, path, env.env, opts, deps);
+  } catch {
+    return new Response("Authentication error. Please try again shortly.", {
+      status: 502,
+      headers: { "content-type": "text/plain" }
+    });
+  }
+}
+function sanitizeReturnTo(raw) {
+  if (raw && /^\/(?![/\\])/.test(raw)) return raw;
+  return "/";
+}
+function wantsHtml(request) {
+  if (request.headers.get("sec-fetch-dest") === "document") return true;
+  return (request.headers.get("accept") ?? "").includes("text/html");
+}
+function isPublic(path, publicPaths = []) {
+  for (const pub of publicPaths) {
+    if (pub.endsWith("/*")) {
+      if (path.startsWith(pub.slice(0, -1))) return true;
+    } else if (path === pub) {
+      return true;
+    }
+  }
+  return false;
+}
+async function startSignin(url, returnTo, env, deps, forceLogin = false) {
+  const meta = await discover(env.issuer, deps.fetchFn);
+  const { verifier, challenge } = await pkcePair();
+  const payload = {
+    state: randomToken(),
+    verifier,
+    nonce: randomToken(),
+    returnTo: sanitizeReturnTo(returnTo)
+  };
+  const stateCookie = await seal({ ...payload }, env.sessionSecret, STATE_MAX_AGE);
+  const authorizeUrl = buildAuthorizeUrl(meta, {
+    clientId: env.clientId,
+    redirectUri: `${url.origin}/auth/callback`,
+    state: payload.state,
+    nonce: payload.nonce,
+    challenge,
+    // After an explicit sign-out, silent Okta re-auth would sign the user
+    // straight back in; prompt=login forces a fresh credential prompt.
+    prompt: forceLogin ? "login" : void 0
+  });
+  return redirect(authorizeUrl, [setCookie(STATE_COOKIE, stateCookie, STATE_MAX_AGE)]);
+}
+async function enforce(request, path, env, opts, deps) {
+  const url = new URL(request.url);
+  const session = await (async () => {
+    const raw = getCookie(request, SESSION_COOKIE);
+    return raw ? unseal(raw, env.sessionSecret) : null;
+  })();
+  const signedOut = getCookie(request, SIGNEDOUT_COOKIE) === "1";
+  if (path === "/auth/signin") {
+    return startSignin(url, sanitizeReturnTo(url.searchParams.get("returnTo")), env, deps, signedOut);
+  }
+  if (path === "/auth/callback") {
+    return handleCallback(request, url, env, deps);
+  }
+  if (path === "/auth/signout") {
+    return redirect("/", [
+      clearCookie(SESSION_COOKIE),
+      setCookie(SIGNEDOUT_COOKIE, "1", 60 * 60 * 24 * 30)
+    ]);
+  }
+  if (path === "/auth/me") {
+    if (!session) return json({ error: "unauthenticated" }, 401);
+    const { sub, name, email } = session;
+    return json({ sub, name, email });
+  }
+  if (isPublic(path, opts.publicPaths)) return void 0;
+  if (session) return void 0;
+  if (wantsHtml(request)) {
+    return startSignin(url, url.pathname + url.search, env, deps, signedOut);
+  }
+  return json({ error: "unauthenticated", signin: "/auth/signin" }, 401);
+}
+function errorPage(status, title, detail) {
+  const html = `<!doctype html><meta charset="utf-8"><title>${title}</title>
+<body style="font-family:system-ui;max-width:32rem;margin:4rem auto;padding:0 1rem">
+<h1 style="font-size:1.25rem">${title}</h1><p>${detail}</p>
+<p><a href="/auth/signin">Try signing in again</a></p></body>`;
+  return new Response(html, { status, headers: { "content-type": "text/html; charset=utf-8" } });
+}
+async function handleCallback(request, url, env, deps) {
+  const oktaError = url.searchParams.get("error");
+  if (oktaError === "access_denied") {
+    return errorPage(
+      403,
+      "Access denied",
+      "You are not assigned to this application in Okta. Ask the Technology team for access."
+    );
+  }
+  if (oktaError) {
+    const safeError = /^[a-z0-9_]{1,40}$/i.test(oktaError) ? oktaError : "unknown";
+    return errorPage(502, "Sign-in failed", `Okta returned an error (${safeError}).`);
+  }
+  const rawState = getCookie(request, STATE_COOKIE);
+  const st = rawState ? await unseal(rawState, env.sessionSecret) : null;
+  const code = url.searchParams.get("code");
+  if (!st || !code || url.searchParams.get("state") !== st.state) {
+    return errorPage(
+      400,
+      "Sign-in expired",
+      "The sign-in attempt is invalid or expired. Please try again."
+    );
+  }
+  try {
+    const meta = await discover(env.issuer, deps.fetchFn);
+    const { idToken } = await exchangeCode(meta, {
+      clientId: env.clientId,
+      clientSecret: env.clientSecret,
+      code,
+      redirectUri: `${url.origin}/auth/callback`,
+      verifier: st.verifier
+    }, deps.fetchFn);
+    const { createRemoteJWKSet } = await import("jose");
+    const jwks = deps.jwks ?? (remoteJwks ??= createRemoteJWKSet(new URL(meta.jwks_uri)));
+    const claims = await validateIdToken(idToken, {
+      issuer: env.issuer,
+      clientId: env.clientId,
+      nonce: st.nonce,
+      jwks
+    });
+    const sessionToken = await seal({ ...claims }, env.sessionSecret, SESSION_MAX_AGE);
+    return redirect(st.returnTo, [
+      setCookie(SESSION_COOKIE, sessionToken, SESSION_MAX_AGE),
+      clearCookie(STATE_COOKIE),
+      clearCookie(SIGNEDOUT_COOKIE)
+    ]);
+  } catch {
+    return errorPage(
+      502,
+      "Sign-in failed",
+      "Could not complete sign-in with Okta. Try again; if it persists, contact the Technology team."
+    );
+  }
+}
+
+// src/index.ts
+function createGate(opts = {}) {
+  return async (request) => {
+    return await handleRequest(request, opts) ?? (0, import_middleware.next)();
+  };
+}
+// Annotate the CommonJS export names for ESM import in node:
+0 && (module.exports = {
+  DEV_USER,
+  createGate
+});

package/dist/index.d.cts

@@ -0,0 +1,12 @@
+interface GateOptions {
+    publicPaths?: string[];
+}
+declare const DEV_USER: {
+    sub: string;
+    name: string;
+    email: string;
+};
+
+declare function createGate(opts?: GateOptions): (request: Request) => Promise<Response>;
+
+export { DEV_USER, type GateOptions, createGate };

package/dist/index.d.ts

@@ -0,0 +1,12 @@
+interface GateOptions {
+    publicPaths?: string[];
+}
+declare const DEV_USER: {
+    sub: string;
+    name: string;
+    email: string;
+};
+
+declare function createGate(opts?: GateOptions): (request: Request) => Promise<Response>;
+
+export { DEV_USER, type GateOptions, createGate };

package/dist/index.js

@@ -0,0 +1,324 @@
+// src/index.ts
+import { next } from "@vercel/functions/middleware";
+
+// src/config.ts
+function loadEnv(vars = process.env) {
+  const enforcing = vars.VERCEL_ENV === "production" && vars.AUTH_BYPASS !== "true";
+  if (!enforcing) return { mode: "open" };
+  const missing = [];
+  if (!vars.OKTA_CLIENT_ID) missing.push("OKTA_CLIENT_ID");
+  if (!vars.OKTA_CLIENT_SECRET) missing.push("OKTA_CLIENT_SECRET");
+  if (!vars.OKTA_ISSUER) missing.push("OKTA_ISSUER");
+  if (!vars.SESSION_SECRET) missing.push("SESSION_SECRET");
+  else if (vars.SESSION_SECRET.length < 32) missing.push("SESSION_SECRET (must be at least 32 chars)");
+  if (missing.length > 0) return { mode: "misconfigured", missing };
+  return {
+    mode: "enforce",
+    env: {
+      clientId: vars.OKTA_CLIENT_ID,
+      clientSecret: vars.OKTA_CLIENT_SECRET,
+      issuer: normalizeIssuer(vars.OKTA_ISSUER),
+      sessionSecret: vars.SESSION_SECRET
+    }
+  };
+}
+function normalizeIssuer(raw) {
+  const withScheme = /^https?:\/\//.test(raw) ? raw : `https://${raw}`;
+  return withScheme.replace(/\/+$/, "");
+}
+
+// src/cookies.ts
+var SESSION_COOKIE = "__Host-sg_session";
+var STATE_COOKIE = "__Host-sg_state";
+var SIGNEDOUT_COOKIE = "__Host-sg_signedout";
+var ATTRS = "Path=/; HttpOnly; Secure; SameSite=Lax";
+function getCookie(request, name) {
+  const header = request.headers.get("cookie");
+  if (!header) return void 0;
+  for (const part of header.split(";")) {
+    const eq = part.indexOf("=");
+    if (eq === -1) continue;
+    if (part.slice(0, eq).trim() === name) return part.slice(eq + 1).trim();
+  }
+  return void 0;
+}
+function setCookie(name, value, maxAgeSec) {
+  return `${name}=${value}; ${ATTRS}; Max-Age=${maxAgeSec}`;
+}
+function clearCookie(name) {
+  return `${name}=; ${ATTRS}; Max-Age=0`;
+}
+
+// src/session.ts
+import { createHash } from "crypto";
+import { EncryptJWT, jwtDecrypt } from "jose";
+var SESSION_MAX_AGE = 43200;
+var STATE_MAX_AGE = 600;
+function keyOf(secret) {
+  return new Uint8Array(createHash("sha256").update(secret).digest());
+}
+async function seal(claims, secret, maxAgeSec) {
+  const now = Math.floor(Date.now() / 1e3);
+  return new EncryptJWT(claims).setProtectedHeader({ alg: "dir", enc: "A256GCM" }).setIssuedAt(now).setExpirationTime(now + maxAgeSec).encrypt(keyOf(secret));
+}
+async function unseal(token, secret) {
+  try {
+    const { payload } = await jwtDecrypt(token, keyOf(secret));
+    return payload;
+  } catch {
+    return null;
+  }
+}
+
+// src/oidc.ts
+import { createHash as createHash2, randomBytes } from "crypto";
+import { jwtVerify } from "jose";
+var discoveryCache = /* @__PURE__ */ new Map();
+function discover(issuer, fetchFn = fetch) {
+  let cached = discoveryCache.get(issuer);
+  if (!cached) {
+    cached = (async () => {
+      const res = await fetchFn(`${issuer}/.well-known/openid-configuration`);
+      if (!res.ok) throw new Error(`OIDC discovery failed (${res.status}) for issuer`);
+      return await res.json();
+    })();
+    cached.catch(() => discoveryCache.delete(issuer));
+    discoveryCache.set(issuer, cached);
+  }
+  return cached;
+}
+function randomToken() {
+  return randomBytes(32).toString("base64url");
+}
+async function pkcePair() {
+  const verifier = randomToken();
+  const challenge = createHash2("sha256").update(verifier).digest("base64url");
+  return { verifier, challenge };
+}
+function buildAuthorizeUrl(meta, p) {
+  const url = new URL(meta.authorization_endpoint);
+  url.search = new URLSearchParams({
+    client_id: p.clientId,
+    response_type: "code",
+    scope: "openid profile email",
+    redirect_uri: p.redirectUri,
+    state: p.state,
+    nonce: p.nonce,
+    code_challenge: p.challenge,
+    code_challenge_method: "S256",
+    ...p.prompt ? { prompt: p.prompt } : {}
+  }).toString();
+  return url.toString();
+}
+async function exchangeCode(meta, p, fetchFn = fetch) {
+  const res = await fetchFn(meta.token_endpoint, {
+    method: "POST",
+    headers: {
+      "content-type": "application/x-www-form-urlencoded",
+      authorization: `Basic ${Buffer.from(`${p.clientId}:${p.clientSecret}`).toString("base64")}`
+    },
+    body: new URLSearchParams({
+      grant_type: "authorization_code",
+      code: p.code,
+      redirect_uri: p.redirectUri,
+      code_verifier: p.verifier
+    }).toString()
+  });
+  if (!res.ok) throw new Error(`Token exchange failed (${res.status})`);
+  const json2 = await res.json();
+  if (!json2.id_token) throw new Error("Token exchange failed (no id_token in response)");
+  return { idToken: json2.id_token };
+}
+async function validateIdToken(idToken, p) {
+  const { payload } = await jwtVerify(idToken, p.jwks, {
+    issuer: p.issuer,
+    audience: p.clientId
+  });
+  if (payload.nonce !== p.nonce) throw new Error("ID token nonce mismatch");
+  return {
+    sub: String(payload.sub ?? ""),
+    name: String(payload.name ?? payload.email ?? "Unknown"),
+    email: String(payload.email ?? "")
+  };
+}
+
+// src/gate.ts
+var remoteJwks;
+var DEV_USER = { sub: "dev-user", name: "Dev User", email: "dev@sonance.com" };
+function json(body, status = 200, headers = {}) {
+  return new Response(JSON.stringify(body), {
+    status,
+    headers: { "content-type": "application/json", "cache-control": "no-store", ...headers }
+  });
+}
+function redirect(location, cookies = []) {
+  const headers = new Headers({ location });
+  for (const c of cookies) headers.append("set-cookie", c);
+  return new Response(null, { status: 302, headers });
+}
+async function handleRequest(request, opts = {}, vars = process.env, deps = {}) {
+  const env = loadEnv(vars);
+  const path = new URL(request.url).pathname;
+  if (env.mode === "open") {
+    if (path === "/auth/me") return json(DEV_USER);
+    if (path === "/auth/signin" || path === "/auth/signout") return redirect("/");
+    return void 0;
+  }
+  if (env.mode === "misconfigured") {
+    return new Response(
+      `Authentication misconfigured. Missing environment variables: ${env.missing.join(", ")}`,
+      { status: 500, headers: { "content-type": "text/plain" } }
+    );
+  }
+  try {
+    return await enforce(request, path, env.env, opts, deps);
+  } catch {
+    return new Response("Authentication error. Please try again shortly.", {
+      status: 502,
+      headers: { "content-type": "text/plain" }
+    });
+  }
+}
+function sanitizeReturnTo(raw) {
+  if (raw && /^\/(?![/\\])/.test(raw)) return raw;
+  return "/";
+}
+function wantsHtml(request) {
+  if (request.headers.get("sec-fetch-dest") === "document") return true;
+  return (request.headers.get("accept") ?? "").includes("text/html");
+}
+function isPublic(path, publicPaths = []) {
+  for (const pub of publicPaths) {
+    if (pub.endsWith("/*")) {
+      if (path.startsWith(pub.slice(0, -1))) return true;
+    } else if (path === pub) {
+      return true;
+    }
+  }
+  return false;
+}
+async function startSignin(url, returnTo, env, deps, forceLogin = false) {
+  const meta = await discover(env.issuer, deps.fetchFn);
+  const { verifier, challenge } = await pkcePair();
+  const payload = {
+    state: randomToken(),
+    verifier,
+    nonce: randomToken(),
+    returnTo: sanitizeReturnTo(returnTo)
+  };
+  const stateCookie = await seal({ ...payload }, env.sessionSecret, STATE_MAX_AGE);
+  const authorizeUrl = buildAuthorizeUrl(meta, {
+    clientId: env.clientId,
+    redirectUri: `${url.origin}/auth/callback`,
+    state: payload.state,
+    nonce: payload.nonce,
+    challenge,
+    // After an explicit sign-out, silent Okta re-auth would sign the user
+    // straight back in; prompt=login forces a fresh credential prompt.
+    prompt: forceLogin ? "login" : void 0
+  });
+  return redirect(authorizeUrl, [setCookie(STATE_COOKIE, stateCookie, STATE_MAX_AGE)]);
+}
+async function enforce(request, path, env, opts, deps) {
+  const url = new URL(request.url);
+  const session = await (async () => {
+    const raw = getCookie(request, SESSION_COOKIE);
+    return raw ? unseal(raw, env.sessionSecret) : null;
+  })();
+  const signedOut = getCookie(request, SIGNEDOUT_COOKIE) === "1";
+  if (path === "/auth/signin") {
+    return startSignin(url, sanitizeReturnTo(url.searchParams.get("returnTo")), env, deps, signedOut);
+  }
+  if (path === "/auth/callback") {
+    return handleCallback(request, url, env, deps);
+  }
+  if (path === "/auth/signout") {
+    return redirect("/", [
+      clearCookie(SESSION_COOKIE),
+      setCookie(SIGNEDOUT_COOKIE, "1", 60 * 60 * 24 * 30)
+    ]);
+  }
+  if (path === "/auth/me") {
+    if (!session) return json({ error: "unauthenticated" }, 401);
+    const { sub, name, email } = session;
+    return json({ sub, name, email });
+  }
+  if (isPublic(path, opts.publicPaths)) return void 0;
+  if (session) return void 0;
+  if (wantsHtml(request)) {
+    return startSignin(url, url.pathname + url.search, env, deps, signedOut);
+  }
+  return json({ error: "unauthenticated", signin: "/auth/signin" }, 401);
+}
+function errorPage(status, title, detail) {
+  const html = `<!doctype html><meta charset="utf-8"><title>${title}</title>
+<body style="font-family:system-ui;max-width:32rem;margin:4rem auto;padding:0 1rem">
+<h1 style="font-size:1.25rem">${title}</h1><p>${detail}</p>
+<p><a href="/auth/signin">Try signing in again</a></p></body>`;
+  return new Response(html, { status, headers: { "content-type": "text/html; charset=utf-8" } });
+}
+async function handleCallback(request, url, env, deps) {
+  const oktaError = url.searchParams.get("error");
+  if (oktaError === "access_denied") {
+    return errorPage(
+      403,
+      "Access denied",
+      "You are not assigned to this application in Okta. Ask the Technology team for access."
+    );
+  }
+  if (oktaError) {
+    const safeError = /^[a-z0-9_]{1,40}$/i.test(oktaError) ? oktaError : "unknown";
+    return errorPage(502, "Sign-in failed", `Okta returned an error (${safeError}).`);
+  }
+  const rawState = getCookie(request, STATE_COOKIE);
+  const st = rawState ? await unseal(rawState, env.sessionSecret) : null;
+  const code = url.searchParams.get("code");
+  if (!st || !code || url.searchParams.get("state") !== st.state) {
+    return errorPage(
+      400,
+      "Sign-in expired",
+      "The sign-in attempt is invalid or expired. Please try again."
+    );
+  }
+  try {
+    const meta = await discover(env.issuer, deps.fetchFn);
+    const { idToken } = await exchangeCode(meta, {
+      clientId: env.clientId,
+      clientSecret: env.clientSecret,
+      code,
+      redirectUri: `${url.origin}/auth/callback`,
+      verifier: st.verifier
+    }, deps.fetchFn);
+    const { createRemoteJWKSet } = await import("jose");
+    const jwks = deps.jwks ?? (remoteJwks ??= createRemoteJWKSet(new URL(meta.jwks_uri)));
+    const claims = await validateIdToken(idToken, {
+      issuer: env.issuer,
+      clientId: env.clientId,
+      nonce: st.nonce,
+      jwks
+    });
+    const sessionToken = await seal({ ...claims }, env.sessionSecret, SESSION_MAX_AGE);
+    return redirect(st.returnTo, [
+      setCookie(SESSION_COOKIE, sessionToken, SESSION_MAX_AGE),
+      clearCookie(STATE_COOKIE),
+      clearCookie(SIGNEDOUT_COOKIE)
+    ]);
+  } catch {
+    return errorPage(
+      502,
+      "Sign-in failed",
+      "Could not complete sign-in with Okta. Try again; if it persists, contact the Technology team."
+    );
+  }
+}
+
+// src/index.ts
+function createGate(opts = {}) {
+  return async (request) => {
+    return await handleRequest(request, opts) ?? next();
+  };
+}
+export {
+  DEV_USER,
+  createGate
+};

package/package.json

@@ -0,0 +1,42 @@
+{
+  "name": "@danainnovations/sonance-gate",
+  "version": "0.1.0",
+  "description": "Framework-agnostic Sonance Okta SSO gate for Vercel apps (Routing Middleware)",
+  "type": "module",
+  "main": "./dist/index.cjs",
+  "types": "./dist/index.d.ts",
+  "exports": {
+    ".": {
+      "types": "./dist/index.d.ts",
+      "import": "./dist/index.js",
+      "require": "./dist/index.cjs"
+    }
+  },
+  "files": [
+    "dist"
+  ],
+  "publishConfig": {
+    "access": "public"
+  },
+  "engines": {
+    "node": ">=20"
+  },
+  "scripts": {
+    "build": "tsup",
+    "test": "vitest run",
+    "test:watch": "vitest",
+    "typecheck": "tsc --noEmit",
+    "prepublishOnly": "npm run build && npm test"
+  },
+  "dependencies": {
+    "@vercel/functions": "^3.7.5",
+    "jose": "^5.9.6"
+  },
+  "devDependencies": {
+    "@types/node": "^26.1.0",
+    "tsup": "^8.3.5",
+    "typescript": "^5.7.2",
+    "vitest": "^2.1.8"
+  },
+  "license": "MIT"
+}