@eminuckan/spine 0.2.0

package/dist/server-CLbksnvg.d.ts

@@ -0,0 +1,144 @@
+import { APIConfig, APILogger, CreateAPIConfigOptions, GetAccessTokenFn, GetCurrentTenantFn, RetryConfig, TokenRefreshFn } from "./index-D6RK_5vm.js";
+import { AxiosInstance } from "axios";
+
+//#region src/api-client/api-config.server.d.ts
+/**
+* API Config Factory Options
+*/
+
+/**
+ * API Config Factory Options
+ */
+interface APIConfigFactoryOptions {
+  /**
+   * Base URL for API requests
+   */
+  baseURL?: string;
+  /**
+   * Default headers applied to all requests
+   */
+  defaultHeaders?: Record<string, string>;
+  /**
+   * User agent string
+   */
+  userAgent?: string;
+  /**
+   * Default timeout in milliseconds
+   */
+  timeout?: number;
+}
+/**
+ * Create API Config Factory
+ *
+ * Creates a factory function that generates API configurations
+ * with the provided auth and tenant resolvers.
+ */
+declare function createAPIConfigFactory(getAccessToken: GetAccessTokenFn, getCurrentTenant: GetCurrentTenantFn, logger?: APILogger, factoryOptions?: APIConfigFactoryOptions): {
+  createAPIConfig: (request: Request, options?: CreateAPIConfigOptions) => Promise<APIConfig>;
+  getAPIBaseURL: () => string;
+};
+type APIConfigFactory = ReturnType<typeof createAPIConfigFactory>; //#endregion
+//#region src/api-client/axios-setup.server.d.ts
+
+//# sourceMappingURL=api-config.server.d.ts.map
+/**
+ * Axios Setup Options
+ */
+interface AxiosSetupOptions {
+  /**
+   * Logger instance for logging
+   */
+  logger?: APILogger;
+  /**
+   * Token refresh function
+   */
+  attemptTokenRefresh?: TokenRefreshFn;
+  /**
+   * Retry configuration
+   */
+  retryConfig?: RetryConfig;
+  /**
+   * Whether to add request ID header
+   */
+  addRequestId?: boolean;
+}
+/**
+ * Setup Axios interceptors for auto-generated clients
+ *
+ * Features:
+ * - Automatic token refresh on 401
+ * - Retry logic with exponential backoff
+ * - ProblemDetails error parsing
+ * - Timeout management
+ * - Comprehensive logging
+ *
+ * @param axiosInstance - The Axios instance from auto-generated client
+ * @param request - The incoming request object (for token refresh)
+ * @param options - Configuration options
+ *
+ * @example
+ * `	ypescript
+ * const config = await createAPIConfig(request);
+ * const api = new IdentityApi(config);
+ * setupAxiosInterceptors(api.axios, request, { logger, attemptTokenRefresh });
+ *
+ * // Now all API calls have automatic retry, token refresh, error handling
+ * const users = await api.getUsers(tenantId);
+ * `
+ */
+declare function setupAxiosInterceptors(axiosInstance: AxiosInstance, request: Request, options?: AxiosSetupOptions): void;
+/**
+ * Create Enhanced Client Options
+ */
+interface CreateEnhancedClientOptions extends AxiosSetupOptions {
+  /**
+   * Whether tenant is required
+   */
+  requireTenant?: boolean;
+  /**
+   * Whether to include auth
+   */
+  includeAuth?: boolean;
+  /**
+   * Explicit tenant ID override
+   */
+  tenantId?: string;
+  /**
+   * Custom headers
+   */
+  customHeaders?: Record<string, string>;
+}
+/**
+ * Helper to create and setup an API client in one call
+ *
+ * @param request - The incoming request object
+ * @param ClientClass - The auto-generated API client class
+ * @param createAPIConfig - Function to create API configuration
+ * @param ConfigurationClass - The Configuration class from generated API
+ * @param options - Configuration options
+ * @returns Configured API client instance with interceptors
+ *
+ * @example
+ * `	ypescript
+ * import { IdentityApi, Configuration } from './generated-api';
+ *
+ * const { client: api, tenantId } = await createEnhancedClient(
+ *   request,
+ *   IdentityApi,
+ *   createAPIConfig,
+ *   Configuration,
+ *   { logger, attemptTokenRefresh }
+ * );
+ * const users = await api.getUsers(tenantId);
+ * `
+ */
+declare function createEnhancedClient<T>(request: Request, ClientClass: new (configuration?: any, basePath?: string, axios?: AxiosInstance) => T, createAPIConfig: (request: Request, options?: any) => Promise<any>, ConfigurationClass: new (params?: any) => any, options?: CreateEnhancedClientOptions): Promise<{
+  client: T;
+  tenantId: string;
+}>;
+
+//#endregion
+//# sourceMappingURL=axios-setup.server.d.ts.map
+
+export { APIConfigFactory, APIConfigFactoryOptions, AxiosSetupOptions, CreateEnhancedClientOptions, createAPIConfigFactory as createAPIConfigFactory$1, createEnhancedClient as createEnhancedClient$1, setupAxiosInterceptors as setupAxiosInterceptors$1 };
+//# sourceMappingURL=server-CLbksnvg.d.ts.map

package/dist/server-CLbksnvg.d.ts.map

@@ -0,0 +1 @@
+{"version":3,"file":"server-CLbksnvg.d.ts","names":[],"sources":["../src/api-client/api-config.server.ts","../src/api-client/axios-setup.server.ts"],"sourcesContent":null,"mappings":";;;;;;;;AA2BA;;;UAAiB,uBAAA;;;;EAyBD,OAAA,CAAA,EAAA,MAAA;EAAsB;;;EAEA,cAC3B,CAAA,EApBQ,MAoBR,CAAA,MAAA,EAAA,MAAA,CAAA;EAAS;;;EAiEe,SACtB,CAAA,EAAA,MAAA;EAAS;AAAV;AA0EZ;EAA4B,OAAA,CAAA,EAAA,MAAA;;;AAAa;;;;;iBA/IzB,sBAAA,iBACE,oCACE,6BACT,4BACO;6BA+DL,mBACA,2BACR,QAAQ;EClDI,aAAA,EAAA,GAAA,GAAiB,MAAA;CAAA;AAIvB,KDwHC,gBAAA,GAAmB,UCxHpB,CAAA,ODwHsC,sBCxHtC,CAAA,CAAA;;;;;;;AD4CE,UChDI,iBAAA,CDgDJ;EAAO;;;EAER,MAAA,CAAA,EC9CD,SD8CC;EA0EA;;;EAA2D,mBAAxC,CAAA,ECpHP,cDoHO;EAAU;;;gBChHzB;;;;EAZC,YAAA,CAAA,EAAA,OAAiB;;;;;AAYP;;;;;;;;;;;;;;;;;;;;;iBA+BX,sBAAA,gBACC,wBACN,mBACA;;;;AAHK,UA8KC,2BAAA,SAAoC,iBA9Kf,CAAA;EAAA;;;EAEpB,aACP,CAAA,EAAA,OAAA;EAAsB;;;;EA2KhB;;;EAgBO,QAhB6B,CAAA,EAAA,MAAA;EAAiB;;;kBAgBpD;;;;;;;;;;;;;;;;;;;;;;AA2BlB;;;;AAEsF,iBAFhE,oBAEgE,CAAA,CAAA,CAAA,CAAA,OAAA,EAD3E,OAC2E,EAAA,WAAA,EAAA,KAAA,aAAA,CAAA,EAAA,GAAA,EAAA,QAAA,CAAA,EAAA,MAAA,EAAA,KAAA,CAAA,EAAlB,aAAkB,EAAA,GAAA,CAAA,EAAA,eAAA,EAAA,CAAA,OAAA,EACzD,OADyD,EAAA,OAAA,CAAA,EAAA,GAAA,EAAA,GAC9B,OAD8B,CAAA,GAAA,CAAA,EAAA,kBAAA,EAAA,KAAA,MAAA,CAAA,EAAA,GAAA,EAAA,GAAA,GAAA,EAAA,OAAA,CAAA,EAG3E,2BAH2E,CAAA,EAInF,OAJmF,CAAA;EAAC,MAC1D,EAGR,CAHQ;EAAO,QAAoB,EAAA,MAAA;CAAO,CAAA"}

package/dist/server-CNp6gjFE.js

@@ -0,0 +1,78 @@
+import { PermissionChecker } from "./permissions-D5ScGGnd.js";
+
+//#region src/permissions/route-protection.server.ts
+const DEFAULT_UNAUTHORIZED_RESPONSE = () => new Response("Unauthorized", {
+	status: 401,
+	statusText: "You must be logged in to access this resource"
+});
+const DEFAULT_FORBIDDEN_RESPONSE = (details) => {
+	const message = process.env.NODE_ENV === "development" ? `Missing permissions: ${details.missingPermissions?.join(", ")}` : "You don't have permission to access this resource";
+	return new Response(message, {
+		status: 403,
+		statusText: "Forbidden"
+	});
+};
+let permissionRouteProtectionConfig = {};
+function getPermissionRouteProtectionConfig() {
+	if (!permissionRouteProtectionConfig.getSession) throw new Error("Permission route protection session getter not configured. Call configurePermissionRouteProtection first.");
+	if (!permissionRouteProtectionConfig.resolveContext) throw new Error("Permission route protection context resolver not configured. Call configurePermissionRouteProtection first.");
+	return {
+		getSession: permissionRouteProtectionConfig.getSession,
+		resolveContext: permissionRouteProtectionConfig.resolveContext,
+		createUnauthorizedResponse: permissionRouteProtectionConfig.createUnauthorizedResponse || DEFAULT_UNAUTHORIZED_RESPONSE,
+		createForbiddenResponse: permissionRouteProtectionConfig.createForbiddenResponse || DEFAULT_FORBIDDEN_RESPONSE
+	};
+}
+function configurePermissionRouteProtection(config) {
+	permissionRouteProtectionConfig = {
+		...permissionRouteProtectionConfig,
+		...config
+	};
+}
+function resetPermissionRouteProtection() {
+	permissionRouteProtectionConfig = {};
+}
+async function getPermissionRouteState(request) {
+	const config = getPermissionRouteProtectionConfig();
+	const session = await config.getSession(request);
+	const context = await config.resolveContext(request, session);
+	return {
+		config,
+		session,
+		context
+	};
+}
+async function requirePermission(request, permission, options = {}) {
+	const { config, session, context } = await getPermissionRouteState(request);
+	if (!session.user || !session.accessToken) throw config.createUnauthorizedResponse(request, session);
+	const checker = new PermissionChecker(context.permissions || []);
+	const permissionsToCheck = Array.isArray(permission) ? permission : [permission];
+	const result = checker.hasPermissions(permissionsToCheck, options);
+	if (!result.hasPermission) throw config.createForbiddenResponse({
+		request,
+		permission,
+		permissionsToCheck,
+		missingPermissions: result.missingPermissions,
+		options,
+		session,
+		context
+	});
+}
+async function checkPermission(request, permission, options = {}) {
+	try {
+		await requirePermission(request, permission, options);
+		return true;
+	} catch {
+		return false;
+	}
+}
+function withPermission(permission, loader, options) {
+	return async (args) => {
+		await requirePermission(args.request, permission, options);
+		return loader(args);
+	};
+}
+
+//#endregion
+export { checkPermission, configurePermissionRouteProtection, requirePermission, resetPermissionRouteProtection, withPermission };
+//# sourceMappingURL=server-CNp6gjFE.js.map

package/dist/server-CNp6gjFE.js.map

@@ -0,0 +1 @@
+{"version":3,"file":"server-CNp6gjFE.js","names":["details: ForbiddenPermissionDetails","permissionRouteProtectionConfig: PermissionRouteProtectionConfig","config: PermissionRouteProtectionConfig","request: Request","permission: PermissionCode | PermissionCode[]","options: PermissionCheckOptions","loader: (args: any) => Promise<TLoaderData>","options?: PermissionCheckOptions","args: any"],"sources":["../src/permissions/route-protection.server.ts"],"sourcesContent":["import { PermissionChecker } from './permission-service';\nimport type { PermissionCheckOptions, PermissionCode } from './types';\n\nexport interface PermissionRouteSession {\n  user?: {\n    sub?: string;\n    email?: string | null;\n  } | null;\n  accessToken?: string | null;\n}\n\nexport interface PermissionRouteContext {\n  permissions: PermissionCode[];\n  currentTenant?: string | null;\n}\n\nexport interface ForbiddenPermissionDetails {\n  request: Request;\n  permission: PermissionCode | PermissionCode[];\n  permissionsToCheck: PermissionCode[];\n  missingPermissions?: PermissionCode[];\n  options: PermissionCheckOptions;\n  session: PermissionRouteSession;\n  context: PermissionRouteContext;\n}\n\nexport interface PermissionRouteProtectionConfig {\n  getSession?: (request: Request) => Promise<PermissionRouteSession>;\n  resolveContext?: (\n    request: Request,\n    session: PermissionRouteSession\n  ) => Promise<PermissionRouteContext>;\n  createUnauthorizedResponse?: (\n    request: Request,\n    session: PermissionRouteSession\n  ) => Response;\n  createForbiddenResponse?: (details: ForbiddenPermissionDetails) => Response;\n}\n\nconst DEFAULT_UNAUTHORIZED_RESPONSE = () =>\n  new Response('Unauthorized', {\n    status: 401,\n    statusText: 'You must be logged in to access this resource',\n  });\n\nconst DEFAULT_FORBIDDEN_RESPONSE = (details: ForbiddenPermissionDetails) => {\n  const message =\n    process.env.NODE_ENV === 'development'\n      ? `Missing permissions: ${details.missingPermissions?.join(', ')}`\n      : \"You don't have permission to access this resource\";\n\n  return new Response(message, {\n    status: 403,\n    statusText: 'Forbidden',\n  });\n};\n\nlet permissionRouteProtectionConfig: PermissionRouteProtectionConfig = {};\n\nfunction getPermissionRouteProtectionConfig(): Required<PermissionRouteProtectionConfig> {\n  if (!permissionRouteProtectionConfig.getSession) {\n    throw new Error(\n      'Permission route protection session getter not configured. Call configurePermissionRouteProtection first.'\n    );\n  }\n\n  if (!permissionRouteProtectionConfig.resolveContext) {\n    throw new Error(\n      'Permission route protection context resolver not configured. Call configurePermissionRouteProtection first.'\n    );\n  }\n\n  return {\n    getSession: permissionRouteProtectionConfig.getSession,\n    resolveContext: permissionRouteProtectionConfig.resolveContext,\n    createUnauthorizedResponse:\n      permissionRouteProtectionConfig.createUnauthorizedResponse || DEFAULT_UNAUTHORIZED_RESPONSE,\n    createForbiddenResponse:\n      permissionRouteProtectionConfig.createForbiddenResponse || DEFAULT_FORBIDDEN_RESPONSE,\n  };\n}\n\nexport function configurePermissionRouteProtection(\n  config: PermissionRouteProtectionConfig\n): void {\n  permissionRouteProtectionConfig = {\n    ...permissionRouteProtectionConfig,\n    ...config,\n  };\n}\n\nexport function resetPermissionRouteProtection(): void {\n  permissionRouteProtectionConfig = {};\n}\n\nasync function getPermissionRouteState(request: Request): Promise<{\n  config: Required<PermissionRouteProtectionConfig>;\n  session: PermissionRouteSession;\n  context: PermissionRouteContext;\n}> {\n  const config = getPermissionRouteProtectionConfig();\n  const session = await config.getSession(request);\n  const context = await config.resolveContext(request, session);\n\n  return {\n    config,\n    session,\n    context,\n  };\n}\n\nexport async function requirePermission(\n  request: Request,\n  permission: PermissionCode | PermissionCode[],\n  options: PermissionCheckOptions = {}\n): Promise<void> {\n  const { config, session, context } = await getPermissionRouteState(request);\n\n  if (!session.user || !session.accessToken) {\n    throw config.createUnauthorizedResponse(request, session);\n  }\n\n  const checker = new PermissionChecker(context.permissions || []);\n  const permissionsToCheck = Array.isArray(permission) ? permission : [permission];\n  const result = checker.hasPermissions(permissionsToCheck, options);\n\n  if (!result.hasPermission) {\n    throw config.createForbiddenResponse({\n      request,\n      permission,\n      permissionsToCheck,\n      missingPermissions: result.missingPermissions,\n      options,\n      session,\n      context,\n    });\n  }\n}\n\nexport async function checkPermission(\n  request: Request,\n  permission: PermissionCode | PermissionCode[],\n  options: PermissionCheckOptions = {}\n): Promise<boolean> {\n  try {\n    await requirePermission(request, permission, options);\n    return true;\n  } catch {\n    return false;\n  }\n}\n\nexport function withPermission<TLoaderData>(\n  permission: PermissionCode | PermissionCode[],\n  loader: (args: any) => Promise<TLoaderData>,\n  options?: PermissionCheckOptions\n) {\n  return async (args: any): Promise<TLoaderData> => {\n    await requirePermission(args.request, permission, options);\n    return loader(args);\n  };\n}\n"],"mappings":";;;AAuCA,MAAM,gCAAgC,MACpC,IAAI,SAAS,gBAAgB;CAC3B,QAAQ;CACR,YAAY;AACb;AAEH,MAAM,6BAA6B,CAACA,YAAwC;CAC1E,MAAM,UACJ,QAAQ,IAAI,aAAa,iBACpB,uBAAuB,QAAQ,oBAAoB,KAAK,KAAK,CAAC,IAC/D;AAEN,QAAO,IAAI,SAAS,SAAS;EAC3B,QAAQ;EACR,YAAY;CACb;AACF;AAED,IAAIC,kCAAmE,CAAE;AAEzE,SAAS,qCAAgF;AACvF,MAAK,gCAAgC,WACnC,OAAM,IAAI,MACR;AAIJ,MAAK,gCAAgC,eACnC,OAAM,IAAI,MACR;AAIJ,QAAO;EACL,YAAY,gCAAgC;EAC5C,gBAAgB,gCAAgC;EAChD,4BACE,gCAAgC,8BAA8B;EAChE,yBACE,gCAAgC,2BAA2B;CAC9D;AACF;AAED,SAAgB,mCACdC,QACM;AACN,mCAAkC;EAChC,GAAG;EACH,GAAG;CACJ;AACF;AAED,SAAgB,iCAAuC;AACrD,mCAAkC,CAAE;AACrC;AAED,eAAe,wBAAwBC,SAIpC;CACD,MAAM,SAAS,oCAAoC;CACnD,MAAM,UAAU,MAAM,OAAO,WAAW,QAAQ;CAChD,MAAM,UAAU,MAAM,OAAO,eAAe,SAAS,QAAQ;AAE7D,QAAO;EACL;EACA;EACA;CACD;AACF;AAED,eAAsB,kBACpBA,SACAC,YACAC,UAAkC,CAAE,GACrB;CACf,MAAM,EAAE,QAAQ,SAAS,SAAS,GAAG,MAAM,wBAAwB,QAAQ;AAE3E,MAAK,QAAQ,SAAS,QAAQ,YAC5B,OAAM,OAAO,2BAA2B,SAAS,QAAQ;CAG3D,MAAM,UAAU,IAAI,kBAAkB,QAAQ,eAAe,CAAE;CAC/D,MAAM,qBAAqB,MAAM,QAAQ,WAAW,GAAG,aAAa,CAAC,UAAW;CAChF,MAAM,SAAS,QAAQ,eAAe,oBAAoB,QAAQ;AAElE,MAAK,OAAO,cACV,OAAM,OAAO,wBAAwB;EACnC;EACA;EACA;EACA,oBAAoB,OAAO;EAC3B;EACA;EACA;CACD,EAAC;AAEL;AAED,eAAsB,gBACpBF,SACAC,YACAC,UAAkC,CAAE,GAClB;AAClB,KAAI;AACF,QAAM,kBAAkB,SAAS,YAAY,QAAQ;AACrD,SAAO;CACR,QAAO;AACN,SAAO;CACR;AACF;AAED,SAAgB,eACdD,YACAE,QACAC,SACA;AACA,QAAO,OAAOC,SAAoC;AAChD,QAAM,kBAAkB,KAAK,SAAS,YAAY,QAAQ;AAC1D,SAAO,OAAO,KAAK;CACpB;AACF"}

package/dist/server-CXGaRaiS.d.ts

@@ -0,0 +1,256 @@
+import { AuthClaimMapping, AuthError, LoginOptions, OAuthState, ProtectionLevel, SessionData, TokenRefreshResult$1 as TokenRefreshResult, UserInfo } from "./types-DufLRY7A.js";
+
+//#region src/auth/redis-session-storage.server.d.ts
+
+declare const AUTH_ERROR_COOKIE_PREFIX: string;
+declare function createAuthSession(request: Request, sessionData: Partial<SessionData>): Promise<Headers>;
+declare function getAuthSession(request: Request): Promise<SessionData>;
+declare function updateAuthSession(request: Request, updates: Partial<SessionData>): Promise<Headers>;
+declare function destroyAuthSession(request: Request): Promise<Headers>;
+declare function requireAuthSession(request: Request): Promise<SessionData>;
+declare function isSessionValid(request: Request): Promise<boolean>;
+declare function createOAuthState(state: OAuthState): Promise<string>;
+declare function getOAuthState(stateId: string): Promise<OAuthState | null>;
+declare function deleteOAuthState(stateId: string): Promise<void>;
+declare function cleanupExpiredOAuthStates(): Promise<number>;
+declare function closeRedisConnection(): Promise<void>;
+
+//#endregion
+//#region src/auth/auth.server.d.ts
+//# sourceMappingURL=redis-session-storage.server.d.ts.map
+/**
+ * Configure claim mapping so different providers/backends can project their
+ * own claim names onto the shared auth/session primitives.
+ */
+declare function configureAuthClaimMapping(mapping: AuthClaimMapping): void;
+/**
+ * Reset claim mapping to the built-in defaults.
+ */
+declare function resetAuthClaimMapping(): void;
+/**
+ * Extract user info from ID token claims
+ */
+declare function extractUserInfo(claims: Record<string, unknown>): {
+  tenants: string[];
+  currentTenant?: string;
+  isOnboarded: boolean;
+  tenantRoles: Record<string, string[]>;
+  permissions: string[];
+};
+/**
+ * Check if there's an auth error in cookies
+ *
+ * This should be called by apps (especially those without landing pages like Dashboard)
+ * BEFORE starting OAuth flow to prevent redirect loops.
+ *
+ * @example
+ * ```ts
+ * // In dashboard's index route loader
+ * const authError = getAuthError(request);
+ * if (authError) {
+ *   return { authError }; // Show error to user
+ * }
+ * // No error, proceed with session check
+ * const user = await getUser(request);
+ * if (!user) {
+ *   return login(request);
+ * }
+ * ```
+ */
+declare function getAuthError(request: Request): AuthError | null;
+/**
+ * Clear auth error cookies
+ *
+ * Call this after displaying the error to the user
+ */
+declare function clearAuthErrorHeaders(): Headers;
+/**
+ * Check if request has auth error (quick check without parsing)
+ */
+declare function hasAuthError(request: Request): boolean;
+/**
+ * Initiate OAuth login flow
+ *
+ * @param request - The incoming request
+ * @param returnUrlOrOptions - Either a return URL string or LoginOptions object
+ */
+declare function login(request: Request, returnUrlOrOptions?: string | LoginOptions): Promise<Response>;
+/**
+ * Handle OAuth callback
+ *
+ * Handles OAuth authorization response including success and error cases.
+ *
+ * Error Handling:
+ * - `access_denied`: User doesn't have access to this application
+ *   - For apps with landing page: Redirect home with error cookie
+ *   - For apps without landing page: Redirect home with error cookie (must handle specially)
+ * - `login_required`: No active identity session
+ *   - Redirect to home to start fresh login
+ */
+declare function handleCallback(request: Request): Promise<Response>;
+/**
+ * Logout user
+ *
+ * Backend uses id_token_hint to identify which tokens to revoke.
+ *
+ * **Scenario 1: Full SSO Logout (Manual Sign Out)**
+ * - Query param: sso_logout=true
+ * - Result: Full logout + identity cookie cleared
+ * - User must re-authenticate everywhere
+ *
+ * **Scenario 2: Standard Logout (Automatic/Token Expired)**
+ * - No sso_logout param
+ * - Result: Tokens revoked based on id_token_hint
+ * - Backend determines which tokens to revoke
+ *
+ * Configuration:
+ * - `OIDC_SSO_LOGOUT` env var ('true' | 'false') - default behavior
+ * - Query param `sso_logout=true` - override for full logout
+ */
+declare function logout(request: Request): Promise<Response>;
+/**
+ * Get current user from session
+ */
+declare function getUser(request: Request): Promise<UserInfo | null>;
+/**
+ * Require authenticated user (throws redirect to login if not authenticated)
+ */
+declare function requireAuth(request: Request): Promise<UserInfo>;
+/**
+ * Get access token from session
+ */
+declare function getAccessToken(request: Request): Promise<string | null>;
+/**
+ * Refresh tokens
+ */
+declare function refreshTokens(request: Request, refreshToken?: string): Promise<TokenRefreshResult>;
+/**
+ * Clear auth server cache (useful for testing)
+ */
+declare function clearAuthServerCache(): void;
+
+//#endregion
+//#region src/auth/route-protection.server.d.ts
+//# sourceMappingURL=auth.server.d.ts.map
+/**
+ * Check if token needs refresh
+ */
+declare function shouldRefreshToken(request: Request): Promise<boolean>;
+/**
+ * Identity context check configuration
+ */
+interface DefaultRouteIdentityContext {
+  hasAnyMembership: boolean;
+  hasSubscription: boolean;
+  isOnboarded: boolean;
+}
+interface IdentityContextChecker<TIdentityContext = DefaultRouteIdentityContext> {
+  getIdentityContext: (request: Request, userId: string, forceRefresh?: boolean) => Promise<DefaultRouteIdentityContext & TIdentityContext>;
+}
+/**
+ * Tenant checker configuration
+ */
+interface TenantChecker {
+  getCurrentTenant: (request: Request) => Promise<string | null>;
+  initializeTenant: (request: Request) => Promise<{
+    headers: Headers;
+    tenantId: string;
+  } | null>;
+}
+/**
+ * Subscription checker configuration
+ */
+interface SubscriptionChecker {
+  checkTenantSubscriptionStatus: (request: Request, tenantId: string) => Promise<boolean>;
+}
+interface RouteProtectionRedirect {
+  location: string;
+  headers?: HeadersInit;
+  status?: number;
+}
+interface AutomaticLogoutRequestContext {
+  request: Request;
+  reason: 'expired-no-refresh-token' | 'refresh-failed';
+}
+interface LoginReturnUrlContext {
+  request: Request;
+  currentPath: string;
+  protection: ProtectionLevel;
+}
+interface RouteProtectionResolverContext<TIdentityContext = DefaultRouteIdentityContext> {
+  request: Request;
+  user: UserInfo;
+  currentPath: string;
+  protection: ProtectionLevel;
+  getIdentityContext: (forceRefresh?: boolean) => Promise<TIdentityContext | null>;
+  getCurrentTenant: () => Promise<string | null>;
+  initializeTenant: () => Promise<{
+    headers: Headers;
+    tenantId: string;
+  } | null>;
+}
+interface RouteProtectionErrorHandlerContext<TIdentityContext = DefaultRouteIdentityContext> extends RouteProtectionResolverContext<TIdentityContext> {
+  error: unknown;
+}
+/**
+ * Route protection configuration
+ */
+interface RouteProtectionConfig<TIdentityContext = DefaultRouteIdentityContext> {
+  identityChecker?: IdentityContextChecker<TIdentityContext>;
+  tenantChecker?: TenantChecker;
+  subscriptionChecker?: SubscriptionChecker;
+  resolveRoute?: (context: RouteProtectionResolverContext<TIdentityContext>) => Promise<RouteProtectionRedirect | null | void> | RouteProtectionRedirect | null | void;
+  handleRouteError?: (context: RouteProtectionErrorHandlerContext<TIdentityContext>) => Promise<RouteProtectionRedirect | null | void> | RouteProtectionRedirect | null | void;
+  getLoginReturnUrl?: (context: LoginReturnUrlContext) => string;
+  createAutomaticLogoutRequest?: (context: AutomaticLogoutRequestContext) => Promise<Request> | Request;
+}
+/**
+ * Configure route protection with identity/tenant/subscription checkers
+ */
+declare function configureRouteProtection<TIdentityContext = DefaultRouteIdentityContext>(config: RouteProtectionConfig<TIdentityContext>): void;
+/**
+ * Reset route protection to its built-in defaults.
+ */
+declare function resetRouteProtectionConfig(): void;
+/**
+ * Main route protection function
+ */
+declare function protectRoute<T>(request: Request, protection: ProtectionLevel, loaderFn: (user?: UserInfo) => Promise<T> | T): Promise<T>;
+/**
+ * Public route (optional auth)
+ */
+declare const publicRoute: <T>(request: Request, loaderFn: (user?: UserInfo) => Promise<T> | T) => Promise<T>;
+/**
+ * Auth-protected route
+ */
+declare const authRoute: <T>(request: Request, loaderFn: (user: UserInfo) => Promise<T> | T) => Promise<T>;
+/**
+ * Onboarding route
+ */
+declare const onboardingRoute: <T>(request: Request, loaderFn: (user: UserInfo) => Promise<T> | T) => Promise<T>;
+/**
+ * Subscription route
+ */
+declare const subscriptionRoute: <T>(request: Request, loaderFn: (user: UserInfo) => Promise<T> | T) => Promise<T>;
+
+//#endregion
+//#region src/auth/token-refresh.server.d.ts
+//# sourceMappingURL=route-protection.server.d.ts.map
+/**
+ * Attempt to refresh the access token
+ */
+declare function attemptTokenRefresh(request: Request): Promise<TokenRefreshResult>;
+/**
+ * Check if a response indicates token expiration
+ */
+declare function isTokenExpiredResponse(response: Response): boolean;
+/**
+ * Check if token refresh should be attempted
+ */
+declare function shouldAttemptTokenRefresh(response: Response, hasAuth: boolean): boolean;
+
+//#endregion
+//# sourceMappingURL=token-refresh.server.d.ts.map
+
+export { AUTH_ERROR_COOKIE_PREFIX, AutomaticLogoutRequestContext, DefaultRouteIdentityContext, IdentityContextChecker, LoginReturnUrlContext, RouteProtectionConfig, RouteProtectionErrorHandlerContext, RouteProtectionRedirect, RouteProtectionResolverContext, SubscriptionChecker, TenantChecker, attemptTokenRefresh as attemptTokenRefresh$1, authRoute as authRoute$1, cleanupExpiredOAuthStates, clearAuthErrorHeaders, clearAuthServerCache, closeRedisConnection, configureAuthClaimMapping, configureRouteProtection as configureRouteProtection$1, createAuthSession, createOAuthState, deleteOAuthState, destroyAuthSession, extractUserInfo, getAccessToken, getAuthError, getAuthSession, getOAuthState, getUser, handleCallback, hasAuthError, isSessionValid, isTokenExpiredResponse as isTokenExpiredResponse$1, login, logout, onboardingRoute as onboardingRoute$1, protectRoute as protectRoute$1, publicRoute as publicRoute$1, refreshTokens, requireAuth, requireAuthSession, resetAuthClaimMapping, resetRouteProtectionConfig as resetRouteProtectionConfig$1, shouldAttemptTokenRefresh as shouldAttemptTokenRefresh$1, shouldRefreshToken as shouldRefreshToken$1, subscriptionRoute as subscriptionRoute$1, updateAuthSession };
+//# sourceMappingURL=server-CXGaRaiS.d.ts.map

package/dist/server-CXGaRaiS.d.ts.map

@@ -0,0 +1 @@
+{"version":3,"file":"server-CXGaRaiS.d.ts","names":[],"sources":["../src/auth/redis-session-storage.server.ts","../src/auth/auth.server.ts","../src/auth/route-protection.server.ts","../src/auth/token-refresh.server.ts"],"sourcesContent":null,"mappings":";;;;AAiOe,cA3KF,wBA2KE,EAAA,MAAA;AACJ,iBAHW,iBAAA,CAGX,OAAA,EAFA,OAEA,EAAA,WAAA,EADI,OACJ,CADY,WACZ,CAAA,CAAA,EAAR,OAAQ,CAAA,OAAA,CAAA;AAAR,iBAiBmB,cAAA,CAjBnB,OAAA,EAiB2C,OAjB3C,CAAA,EAiBqD,OAjBrD,CAiB6D,WAjB7D,CAAA;AAAO,iBAuCY,iBAAA,CAvCZ,OAAA,EAwCC,OAxCD,EAAA,OAAA,EAyCC,OAzCD,CAyCS,WAzCT,CAAA,CAAA,EA0CP,OA1CO,CA0CC,OA1CD,CAAA;AAiBY,iBAwCA,kBAAA,CAxCc,OAAA,EAwCc,OAxCd,CAAA,EAwCwB,OAxCxB,CAwCgC,OAxChC,CAAA;AAAA,iBAmDd,kBAAA,CAnDc,OAAA,EAmDc,OAnDd,CAAA,EAmDwB,OAnDxB,CAmDgC,WAnDhC,CAAA;AAAU,iBA6DxB,cAAA,CA7DwB,OAAA,EA6DA,OA7DA,CAAA,EA6DU,OA7DV,CAAA,OAAA,CAAA;AAAkB,iBAmF1C,gBAAA,CAnF0C,KAAA,EAmFlB,UAnFkB,CAAA,EAmFL,OAnFK,CAAA,MAAA,CAAA;AAAR,iBA8FlC,aAAA,CA9FkC,OAAA,EAAA,MAAA,CAAA,EA8FF,OA9FE,CA8FM,UA9FN,GAAA,IAAA,CAAA;AAAO,iBA+GzC,gBAAA,CA/GyC,OAAA,EAAA,MAAA,CAAA,EA+GN,OA/GM,CAAA,IAAA,CAAA;AAsBzC,iBA+FA,yBAAA,CAAA,CA/FiB,EA+FY,OA/FZ,CAAA,MAAA,CAAA;AAAA,iBAoHjB,oBAAA,CAAA,CApHiB,EAoHO,OApHP,CAAA,IAAA,CAAA;;;;;AAtBvC;;;;AAAwD,iBCaxC,yBAAA,CDbwC,OAAA,ECaL,gBDbK,CAAA,EAAA,IAAA;AAAO;AAsB/D;;AACW,iBCWK,qBAAA,CAAA,CDXL,EAAA,IAAA;;;;AAER,iBCkJa,eAAA,CDlJb,MAAA,ECkJqC,MDlJrC,CAAA,MAAA,EAAA,OAAA,CAAA,CAAA,EAAA;EAAO,OAAA,EAAA,MAAA,EAAA;EAeY,aAAA,CAAA,EAAA,MAAkB;EAAA,WAAA,EAAA,OAAA;EAAA,WAAU,ECuInC,MDvImC,CAAA,MAAA,EAAA,MAAA,EAAA,CAAA;EAAO,WAAW,EAAA,MAAA,EAAA;CAAO;AAAR;AAWnE;;;;;AAAmE;AAUnE;;;;AAA+D;AAsB/D;;;;AAAkE;AAWlE;;;AAAsD,iBC2MtC,YAAA,CD3MsC,OAAA,EC2MhB,OD3MgB,CAAA,EC2MN,SD3MM,GAAA,IAAA;AAAO;AAiB7D;AAMA;AAqBA;;iBCwLgB,qBAAA,CAAA,GAAyB;;;;iBAUzB,YAAA,UAAsB;;AA/TtC;;;;AAqBA;iBAyTsB,KAAA,UACX,uCACqB,eAC7B,QAAQ;;;AAnLX;;;;AAIqB;;;;;;iBAiRC,cAAA,UAAwB,UAAU,QAAQ;;;;;;;;;;;;;;;AAvJhE;;;;AAAyD;iBAuYnC,MAAA,UAAgB,UAAU,QAAQ;;;;iBA8ElC,OAAA,UAAiB,UAAU,QAAQ;AA5bzD;;;iBAycsB,WAAA,UAAqB,UAAU,QAAQ;AA/b7D;;;iBA+csB,cAAA,UAAwB,UAAU;;;;AAhclC,iBA6cA,aAAA,CA7cK,OAAA,EA8chB,OA9cgB,EAAA,YAAA,CAAA,EAAA,MAAA,CAAA,EAgdxB,OAhdwB,CAgdhB,kBAhdgB,CAAA;;;;AAGxB,iBAijBa,oBAAA,CAAA,CAjjBb,EAAA,IAAA;;;;AAAO;;;;AD/WC,iBEhNW,kBAAA,CFgNX,OAAA,EEhNuC,OFgNvC,CAAA,EEhNiD,OFgNjD,CAAA,OAAA,CAAA;;AAAD;AAiBV;AAAoC,UEhJnB,2BAAA,CFgJmB;EAAA,gBAAU,EAAA,OAAA;EAAO,eAAW,EAAA,OAAA;EAAW,WAAnB,EAAA,OAAA;AAAO;AAsBzC,UEhKL,sBFgKsB,CAAA,mBEhKoB,2BFgKpB,CAAA,CAAA;EAAA,kBAAA,EAAA,CAAA,OAAA,EE9J1B,OF8J0B,EAAA,MAAA,EAAA,MAAA,EAAA,YAAA,CAAA,EAAA,OAAA,EAAA,GE3JhC,OF2JgC,CE3JxB,2BF2JwB,GE3JM,gBF2JN,CAAA;;;;;AAGpC,UExJc,aAAA,CFwJd;EAAO,gBAAA,EAAA,CAAA,OAAA,EEvJoB,OFuJpB,EAAA,GEvJgC,OFuJhC,CAAA,MAAA,GAAA,IAAA,CAAA;EAeY,gBAAA,EAAA,CAAA,OAAkB,EErKV,OFqKU,EAAA,GErKE,OFqKF,CAAA;IAAA,OAAA,EErKqB,OFqKrB;IAAU,QAAA,EAAA,MAAA;EAAO,CAAA,GAAW,IAAA,CAAA;;AAAD;AAWnE;;AAAkD,UE1KjC,mBAAA,CF0KiC;EAAO,6BAAW,EAAA,CAAA,OAAA,EEzKzB,OFyKyB,EAAA,QAAA,EAAA,MAAA,EAAA,GEzKK,OFyKL,CAAA,OAAA,CAAA;;AAAD,UEtKlD,uBAAA,CFsKkD;EAU7C,QAAA,EAAA,MAAA;EAAc,OAAA,CAAA,EE9KxB,WF8KwB;EAAA,MAAU,CAAA,EAAA,MAAA;;AAAiB,UE1K9C,6BAAA,CF0K8C;EAsBzC,OAAA,EE/LX,OF+LW;EAAgB,MAAA,EAAA,0BAAA,GAAA,gBAAA;;AAAqB,UE3L1C,qBAAA,CF2L0C;EAAO,OAAA,EE1LvD,OF0LuD;EAW5C,WAAA,EAAA,MAAa;EAAA,UAAA,EEnMrB,eFmMqB;;AAAmB,UEhMrC,8BFgMqC,CAAA,mBEhMa,2BFgMb,CAAA,CAAA;EAAO,OAAA,EE/LlD,OF+LkD;EAiBvC,IAAA,EE/Md,QF+Mc;EAMA,WAAA,EAAA,MAAA;EAqBA,UAAA,EExOR,eFwO4B;kDEvOQ,QAAQ;0BAChC;0BACA;aAAmB;;;;ADwG7B,UCrGC,kCDqGkC,CAAA,mBCrGoB,2BDqGJ,CAAA,SCpGzD,8BDoGyD,CCpG1B,gBDoG0B,CAAA,CAAA;;;;AAqBnE;;UClHiB,yCAAyC;oBACtC,uBAAuB;ED0P3B,aAAA,CAAA,ECzPE,aDyPa;EAAA,mBAAA,CAAA,ECxPP,mBDwPO;EAAA,YAAS,CAAA,EAAA,CAAA,OAAA,ECtP3B,8BDsP2B,CCtPI,gBDsPJ,CAAA,EAAA,GCrPjC,ODqPiC,CCrPzB,uBDqPyB,GAAA,IAAA,GAAA,IAAA,CAAA,GCrPgB,uBDqPhB,GAAA,IAAA,GAAA,IAAA;EAAM,gBAI/B,CAAA,EAAA,CAAA,OAAA,ECvPF,kCDuPE,CCvPiC,gBDuPjC,CAAA,EAAA,GCtPR,ODsPQ,CCtPA,uBDsPA,GAAA,IAAA,GAAA,IAAA,CAAA,GCtPyC,uBDsPzC,GAAA,IAAA,GAAA,IAAA;EAAM,iBAAA,CAAA,EAAA,CAAA,OAAA,ECrPW,qBDqPX,EAAA,GAAA,MAAA;2CCnPR,kCACN,QAAQ,WAAW;;;;;iBAQV,4CAA4C,qCAClD,sBAAsB;;;;iBAQhB,0BAAA,CAAA;;;;iBAmPM,yBACX,qBACG,mCACM,aAAa,QAAQ,KAAK,IAC3C,QAAQ;;;;cAqGE,0BACF,2BACS,aAAa,QAAQ,KAAK,MAAC,QAAA;;;ADH/C;AAA4B,cCSf,SDTe,EAAA,CAAA,CAAA,CAAA,CAAA,OAAA,ECUjB,ODViB,EAAA,QAAA,EAAA,CAAA,IAAA,ECWT,QDXS,EAAA,GCWI,ODXJ,CCWY,CDXZ,CAAA,GCWiB,CDXjB,EAAA,GCWkB,ODXlB,CCWkB,CDXlB,CAAA;;;AAA6B;cCiB5C,8BACF,0BACQ,aAAa,QAAQ,KAAK,MAAC,QAAA;;;;cAMjC,gCACF,0BACQ,aAAa,QAAQ,KAAK,MAAC,QAAA;;;;ADF9C;ADtVA;;;AAEuB,iBGrND,mBAAA,CHqNC,OAAA,EGrN4B,OHqN5B,CAAA,EGrNsC,OHqNtC,CGrN8C,kBHqN9C,CAAA;;;;AACb,iBG3JM,sBAAA,CH2JN,QAAA,EG3JuC,QH2JvC,CAAA,EAAA,OAAA;AAiBV;;;AAAgE,iBGrKhD,yBAAA,CHqKgD,QAAA,EGrKZ,QHqKY,EAAA,OAAA,EAAA,OAAA,CAAA,EAAA,OAAA"}