@eminuckan/spine 0.2.1 → 0.2.4

package/dist/auth.server-Cx2h2qu3.js

@@ -1,724 +0,0 @@
-import { logger } from "./logging-_h2mi3L9.js";
-import { AUTH_ERROR_COOKIE_PREFIX, createAuthSession, createOAuthState, deleteOAuthState, destroyAuthSession, getAuthSession, getOAuthState, updateAuthSession } from "./redis-session-storage.server-BR_0y-QO.js";
-import * as oauth from "oauth4webapi";
-
-//#region src/http/response.ts
-/**
-* Create a redirect response without relying on a router/framework helper.
-*/
-function createRedirectResponse(location, init = {}) {
-	const headers = new Headers(init.headers);
-	headers.set("Location", location);
-	return new Response(null, {
-		status: init.status ?? 302,
-		headers
-	});
-}
-
-//#endregion
-//#region src/auth/auth.server.ts
-/**
-* Get effective SSO logout setting based on config
-*/
-function getEffectiveSsoLogout(config) {
-	if (config.ssoLogout !== void 0) return config.ssoLogout;
-	switch (config.applicationType) {
-		case "no-landing-page":
-		case "dashboard": return true;
-		case "landing-page":
-		case "tenant-app": return false;
-		default: return false;
-	}
-}
-/**
-* Get effective hasLandingPage setting based on config
-*/
-function getEffectiveHasLandingPage(config) {
-	if (config.hasLandingPage !== void 0) return config.hasLandingPage;
-	switch (config.applicationType) {
-		case "no-landing-page":
-		case "dashboard": return false;
-		case "landing-page":
-		case "tenant-app": return true;
-		default: return true;
-	}
-}
-/**
-* Create OAuth configuration from environment variables
-*/
-function createAuthConfig() {
-	const requiredEnvVars = {
-		authority: process.env.OIDC_AUTHORITY,
-		clientId: process.env.OIDC_CLIENT_ID,
-		redirectUri: process.env.OIDC_REDIRECT_URI
-	};
-	for (const [key, value] of Object.entries(requiredEnvVars)) if (!value) throw new Error(`Missing required environment variable: OIDC_${key.toUpperCase()}`);
-	const appTypeEnv = process.env.OIDC_APPLICATION_TYPE?.toLowerCase();
-	let applicationType = "custom";
-	if (appTypeEnv === "no-landing-page" || appTypeEnv === "no_landing_page") applicationType = "no-landing-page";
-	else if (appTypeEnv === "landing-page" || appTypeEnv === "landing_page") applicationType = "landing-page";
-	else if (appTypeEnv === "dashboard") applicationType = "dashboard";
-	else if (appTypeEnv === "tenant-app" || appTypeEnv === "tenant_app") applicationType = "tenant-app";
-	const ssoLogout = process.env.OIDC_SSO_LOGOUT !== void 0 ? process.env.OIDC_SSO_LOGOUT === "true" : void 0;
-	const hasLandingPage = process.env.OIDC_HAS_LANDING_PAGE !== void 0 ? process.env.OIDC_HAS_LANDING_PAGE === "true" : void 0;
-	return {
-		authority: requiredEnvVars.authority,
-		clientId: requiredEnvVars.clientId,
-		clientSecret: process.env.OIDC_CLIENT_SECRET,
-		redirectUri: requiredEnvVars.redirectUri,
-		scope: process.env.OIDC_SCOPE || "openid offline_access api",
-		postLogoutRedirectUri: process.env.OIDC_POST_LOGOUT_REDIRECT_URI,
-		applicationType,
-		ssoLogout,
-		hasLandingPage
-	};
-}
-let OIDC_CONFIG = null;
-function getAuthConfig() {
-	if (!OIDC_CONFIG) OIDC_CONFIG = createAuthConfig();
-	return OIDC_CONFIG;
-}
-let authServerCache = null;
-const CACHE_TTL = 60 * 60 * 1e3;
-/**
-* Get OAuth configuration with caching
-*/
-async function getOAuthConfig() {
-	const config = getAuthConfig();
-	const now = Date.now();
-	if (authServerCache && now - authServerCache.cachedAt < CACHE_TTL) return {
-		authorizationServer: authServerCache.authorizationServer,
-		client: authServerCache.client
-	};
-	try {
-		const issuer = new URL(config.authority);
-		const discoveryResponse = await oauth.discoveryRequest(issuer, { algorithm: "oidc" });
-		if (!discoveryResponse.ok) {
-			const errorText = await discoveryResponse.text().catch(() => "Unable to read response");
-			logger.error("OAuth discovery error", void 0, { errorText });
-			throw new Error(`OAuth discovery failed with status ${discoveryResponse.status}`);
-		}
-		const authorizationServer = await oauth.processDiscoveryResponse(issuer, discoveryResponse);
-		const client = { client_id: config.clientId };
-		authServerCache = {
-			authorizationServer,
-			client,
-			cachedAt: now
-		};
-		logger.info("OAuth discovery completed successfully");
-		return {
-			authorizationServer,
-			client
-		};
-	} catch (error) {
-		logger.error("OAuth discovery failed", error instanceof Error ? error : void 0);
-		throw new Error(`OAuth discovery failed: ${error instanceof Error ? error.message : "Unknown error"}`);
-	}
-}
-/**
-* Get client authentication method (None for public client with PKCE)
-*/
-function getClientAuth() {
-	return oauth.None();
-}
-const DEFAULT_AUTH_CLAIM_MAPPING = {
-	subject: ["sub"],
-	name: [
-		"name",
-		"preferred_username",
-		"email"
-	],
-	email: ["email"],
-	givenName: ["given_name", "givenName"],
-	familyName: ["family_name", "familyName"],
-	picture: ["picture", "avatar_url"],
-	locale: ["locale"],
-	zoneinfo: ["zoneinfo"],
-	updatedAt: ["updated_at"],
-	tenantIds: ["tenant_ids"],
-	tenantRoles: ["tenant_roles"],
-	permissions: [
-		"app_perms",
-		"permissions",
-		"scope"
-	],
-	isOnboarded: ["is_onboarded"]
-};
-let authClaimMapping = { ...DEFAULT_AUTH_CLAIM_MAPPING };
-function normalizeClaimKeys(keys) {
-	if (!Array.isArray(keys)) return [];
-	return Array.from(new Set(keys.map((key) => key.trim()).filter((key) => key.length > 0)));
-}
-/**
-* Configure claim mapping so different providers/backends can project their
-* own claim names onto the shared auth/session primitives.
-*/
-function configureAuthClaimMapping(mapping) {
-	authClaimMapping = {
-		subject: mapping.subject !== void 0 ? normalizeClaimKeys(mapping.subject) : DEFAULT_AUTH_CLAIM_MAPPING.subject,
-		name: mapping.name !== void 0 ? normalizeClaimKeys(mapping.name) : DEFAULT_AUTH_CLAIM_MAPPING.name,
-		email: mapping.email !== void 0 ? normalizeClaimKeys(mapping.email) : DEFAULT_AUTH_CLAIM_MAPPING.email,
-		givenName: mapping.givenName !== void 0 ? normalizeClaimKeys(mapping.givenName) : DEFAULT_AUTH_CLAIM_MAPPING.givenName,
-		familyName: mapping.familyName !== void 0 ? normalizeClaimKeys(mapping.familyName) : DEFAULT_AUTH_CLAIM_MAPPING.familyName,
-		picture: mapping.picture !== void 0 ? normalizeClaimKeys(mapping.picture) : DEFAULT_AUTH_CLAIM_MAPPING.picture,
-		locale: mapping.locale !== void 0 ? normalizeClaimKeys(mapping.locale) : DEFAULT_AUTH_CLAIM_MAPPING.locale,
-		zoneinfo: mapping.zoneinfo !== void 0 ? normalizeClaimKeys(mapping.zoneinfo) : DEFAULT_AUTH_CLAIM_MAPPING.zoneinfo,
-		updatedAt: mapping.updatedAt !== void 0 ? normalizeClaimKeys(mapping.updatedAt) : DEFAULT_AUTH_CLAIM_MAPPING.updatedAt,
-		tenantIds: mapping.tenantIds !== void 0 ? normalizeClaimKeys(mapping.tenantIds) : DEFAULT_AUTH_CLAIM_MAPPING.tenantIds,
-		tenantRoles: mapping.tenantRoles !== void 0 ? normalizeClaimKeys(mapping.tenantRoles) : DEFAULT_AUTH_CLAIM_MAPPING.tenantRoles,
-		permissions: mapping.permissions !== void 0 ? normalizeClaimKeys(mapping.permissions) : DEFAULT_AUTH_CLAIM_MAPPING.permissions,
-		isOnboarded: mapping.isOnboarded !== void 0 ? normalizeClaimKeys(mapping.isOnboarded) : DEFAULT_AUTH_CLAIM_MAPPING.isOnboarded
-	};
-}
-/**
-* Reset claim mapping to the built-in defaults.
-*/
-function resetAuthClaimMapping() {
-	authClaimMapping = { ...DEFAULT_AUTH_CLAIM_MAPPING };
-}
-function getConfiguredAuthClaimMapping() {
-	return authClaimMapping;
-}
-function getFirstClaimValue(claims, claimKeys) {
-	for (const claimKey of claimKeys) if (claimKey in claims) return {
-		key: claimKey,
-		value: claims[claimKey]
-	};
-	return {};
-}
-function getStringClaim(claims, claimKeys) {
-	const { value } = getFirstClaimValue(claims, claimKeys);
-	if (typeof value === "string") {
-		const trimmed = value.trim();
-		return trimmed.length > 0 ? trimmed : void 0;
-	}
-	if (typeof value === "number" || typeof value === "boolean") return `${value}`;
-	return void 0;
-}
-function getNumberClaim(claims, claimKeys) {
-	const { value } = getFirstClaimValue(claims, claimKeys);
-	if (typeof value === "number" && Number.isFinite(value)) return value;
-	if (typeof value === "string") {
-		const parsed = Number(value);
-		return Number.isFinite(parsed) ? parsed : void 0;
-	}
-	return void 0;
-}
-function getBooleanClaim(claims, claimKeys, defaultValue = false) {
-	const { value } = getFirstClaimValue(claims, claimKeys);
-	if (typeof value === "boolean") return value;
-	if (typeof value === "string") return value.toLowerCase() === "true";
-	return defaultValue;
-}
-/**
-* Parse JSON safely
-*/
-function parseJson(value) {
-	try {
-		return JSON.parse(value);
-	} catch {
-		return null;
-	}
-}
-/**
-* Convert value to string array
-*/
-function toStringArray(value) {
-	if (!value) return [];
-	if (Array.isArray(value)) return value.map((item) => typeof item === "string" ? item.trim() : `${item}`.trim()).filter((item) => item.length > 0);
-	if (typeof value === "string") {
-		const trimmed = value.trim();
-		if (!trimmed) return [];
-		if (trimmed.startsWith("[")) {
-			const parsed = parseJson(trimmed);
-			if (Array.isArray(parsed)) return parsed.map((item) => typeof item === "string" ? item.trim() : `${item}`.trim()).filter((item) => item.length > 0);
-		}
-		if (trimmed.includes(",")) return trimmed.split(",").map((item) => item.trim()).filter((item) => item.length > 0);
-		return [trimmed];
-	}
-	return [];
-}
-function toScopeArray(value) {
-	if (typeof value === "string") return value.trim().split(/\s+/).filter((item) => item.length > 0);
-	return toStringArray(value);
-}
-/**
-* Extract user info from ID token claims
-*/
-function extractUserInfo(claims) {
-	const claimMapping = getConfiguredAuthClaimMapping();
-	let tenants = [];
-	const { value: rawTenantIds } = getFirstClaimValue(claims, claimMapping.tenantIds);
-	if (rawTenantIds !== void 0) if (typeof rawTenantIds === "string" && rawTenantIds.trim().startsWith("[")) {
-		const parsed = parseJson(rawTenantIds.trim());
-		if (Array.isArray(parsed)) tenants = parsed.map((id) => typeof id === "string" ? id.trim() : `${id}`.trim()).filter((id) => id.length > 0);
-	} else tenants = toStringArray(rawTenantIds);
-	const tenantRoles = {};
-	const { value: rawRoles } = getFirstClaimValue(claims, claimMapping.tenantRoles);
-	if (rawRoles !== void 0) {
-		let parsedRoles = rawRoles;
-		if (typeof rawRoles === "string" && rawRoles.trim().startsWith("{")) parsedRoles = parseJson(rawRoles.trim()) ?? rawRoles;
-		if (parsedRoles && typeof parsedRoles === "object" && !Array.isArray(parsedRoles)) for (const [tenantId, roleValue] of Object.entries(parsedRoles)) {
-			const roleIds = toStringArray(roleValue);
-			if (roleIds.length > 0) tenantRoles[tenantId] = roleIds;
-		}
-	}
-	const permissionClaim = getFirstClaimValue(claims, claimMapping.permissions);
-	const permissions = permissionClaim.key === "scope" ? toScopeArray(permissionClaim.value) : toStringArray(permissionClaim.value);
-	const isOnboarded = getBooleanClaim(claims, claimMapping.isOnboarded);
-	return {
-		tenants,
-		isOnboarded,
-		tenantRoles,
-		permissions
-	};
-}
-/**
-* Create session data from token result
-*/
-async function createSessionData(tokenResult, claims) {
-	const claimMapping = getConfiguredAuthClaimMapping();
-	const baseUser = {
-		sub: getStringClaim(claims, claimMapping.subject) || "unknown",
-		name: getStringClaim(claims, claimMapping.name) || getStringClaim(claims, claimMapping.email) || "User",
-		email: getStringClaim(claims, claimMapping.email),
-		givenName: getStringClaim(claims, claimMapping.givenName),
-		familyName: getStringClaim(claims, claimMapping.familyName),
-		picture: getStringClaim(claims, claimMapping.picture),
-		locale: getStringClaim(claims, claimMapping.locale),
-		zoneinfo: getStringClaim(claims, claimMapping.zoneinfo),
-		updated_at: getNumberClaim(claims, claimMapping.updatedAt)
-	};
-	const expiresAt = tokenResult.expires_in ? Date.now() + tokenResult.expires_in * 1e3 : void 0;
-	return {
-		userId: baseUser.sub,
-		accessToken: tokenResult.access_token,
-		refreshToken: tokenResult.refresh_token,
-		idToken: tokenResult.id_token,
-		expiresAt,
-		user: baseUser,
-		lastActivity: Date.now()
-	};
-}
-const AUTH_ERROR_COOKIE = `${AUTH_ERROR_COOKIE_PREFIX}_auth_error`;
-const AUTH_ERROR_DESC_COOKIE = `${AUTH_ERROR_COOKIE_PREFIX}_auth_error_desc`;
-const OAUTH_STATE_COOKIE = `${AUTH_ERROR_COOKIE_PREFIX}_oauth_state_id`;
-/**
-* Check if there's an auth error in cookies
-* 
-* This should be called by apps (especially those without landing pages like Dashboard)
-* BEFORE starting OAuth flow to prevent redirect loops.
-* 
-* @example
-* ```ts
-* // In dashboard's index route loader
-* const authError = getAuthError(request);
-* if (authError) {
-*   return { authError }; // Show error to user
-* }
-* // No error, proceed with session check
-* const user = await getUser(request);
-* if (!user) {
-*   return login(request);
-* }
-* ```
-*/
-function getAuthError(request) {
-	const cookies = request.headers.get("Cookie");
-	if (!cookies) return null;
-	const errorRegex = new RegExp(`${AUTH_ERROR_COOKIE}=([^;]+)`);
-	const errorMatch = cookies.match(errorRegex);
-	if (!errorMatch) return null;
-	const error = decodeURIComponent(errorMatch[1]);
-	if (!error) return null;
-	const descRegex = new RegExp(`${AUTH_ERROR_DESC_COOKIE}=([^;]+)`);
-	const descMatch = cookies.match(descRegex);
-	const description = descMatch ? decodeURIComponent(descMatch[1]) : void 0;
-	return {
-		error,
-		description
-	};
-}
-/**
-* Clear auth error cookies
-* 
-* Call this after displaying the error to the user
-*/
-function clearAuthErrorHeaders() {
-	const headers = new Headers();
-	headers.append("Set-Cookie", `${AUTH_ERROR_COOKIE}=; Path=/; Max-Age=0`);
-	headers.append("Set-Cookie", `${AUTH_ERROR_DESC_COOKIE}=; Path=/; Max-Age=0`);
-	return headers;
-}
-/**
-* Check if request has auth error (quick check without parsing)
-*/
-function hasAuthError(request) {
-	const cookies = request.headers.get("Cookie");
-	return cookies?.includes(`${AUTH_ERROR_COOKIE}=`) ?? false;
-}
-/**
-* Initiate OAuth login flow
-* 
-* @param request - The incoming request
-* @param returnUrlOrOptions - Either a return URL string or LoginOptions object
-*/
-async function login(request, returnUrlOrOptions) {
-	try {
-		const config = getAuthConfig();
-		const options = typeof returnUrlOrOptions === "string" ? { returnUrl: returnUrlOrOptions } : returnUrlOrOptions || {};
-		const cookies = request.headers.get("Cookie");
-		const hasError = cookies?.includes(`${AUTH_ERROR_COOKIE}=`);
-		if (hasError) {
-			logger.warn("Auth error cookie detected, preventing redirect loop");
-			const headers$1 = new Headers();
-			headers$1.append("Set-Cookie", `${AUTH_ERROR_COOKIE}=; Path=/; Max-Age=0`);
-			const redirectUri = new URL(config.redirectUri);
-			const baseUrl = redirectUri.origin;
-			return createRedirectResponse(baseUrl, { headers: headers$1 });
-		}
-		const { authorizationServer, client } = await getOAuthConfig();
-		const codeVerifier = oauth.generateRandomCodeVerifier();
-		const codeChallenge = await oauth.calculatePKCECodeChallenge(codeVerifier);
-		const state = oauth.generateRandomState();
-		const nonce = oauth.generateRandomNonce();
-		const oauthState = {
-			state,
-			codeVerifier,
-			nonce,
-			returnUrl: options.returnUrl,
-			createdAt: Date.now()
-		};
-		logger.info("Creating OAuth state", {
-			returnUrl: options.returnUrl,
-			prompt: options.prompt
-		});
-		const stateId = await createOAuthState(oauthState);
-		const authorizationUrl = new URL(authorizationServer.authorization_endpoint);
-		authorizationUrl.searchParams.set("client_id", client.client_id);
-		authorizationUrl.searchParams.set("redirect_uri", config.redirectUri);
-		authorizationUrl.searchParams.set("response_type", "code");
-		authorizationUrl.searchParams.set("scope", config.scope);
-		authorizationUrl.searchParams.set("state", state);
-		authorizationUrl.searchParams.set("code_challenge", codeChallenge);
-		authorizationUrl.searchParams.set("code_challenge_method", "S256");
-		authorizationUrl.searchParams.set("nonce", nonce);
-		if (options.prompt) authorizationUrl.searchParams.set("prompt", options.prompt);
-		const headers = new Headers();
-		headers.append("Set-Cookie", `${OAUTH_STATE_COOKIE}=${stateId}; Path=/; HttpOnly; SameSite=Lax; Max-Age=600`);
-		logger.info("🔍 DEBUG: OAuth login config", {
-			clientId: config.clientId,
-			redirectUri: config.redirectUri,
-			postLogoutRedirectUri: config.postLogoutRedirectUri,
-			scope: config.scope,
-			authority: config.authority,
-			authorizationEndpoint: authorizationServer.authorization_endpoint,
-			fullAuthUrl: authorizationUrl.toString()
-		});
-		logger.info("OAuth authorization flow initiated", {
-			state,
-			stateId,
-			prompt: options.prompt
-		});
-		return createRedirectResponse(authorizationUrl.toString(), { headers });
-	} catch (error) {
-		logger.error("Failed to initiate OAuth login", error instanceof Error ? error : void 0);
-		throw new Error("Login failed");
-	}
-}
-/**
-* Handle OAuth callback
-* 
-* Handles OAuth authorization response including success and error cases.
-* 
-* Error Handling:
-* - `access_denied`: User doesn't have access to this application
-*   - For apps with landing page: Redirect home with error cookie
-*   - For apps without landing page: Redirect home with error cookie (must handle specially)
-* - `login_required`: No active identity session
-*   - Redirect to home to start fresh login
-*/
-async function handleCallback(request) {
-	try {
-		const config = getAuthConfig();
-		const hasLandingPage = getEffectiveHasLandingPage(config);
-		const url = new URL(request.url);
-		const code = url.searchParams.get("code");
-		const state = url.searchParams.get("state");
-		const error = url.searchParams.get("error");
-		const errorDescription = url.searchParams.get("error_description");
-		logger.info("🔍 DEBUG: OAuth callback received", {
-			fullUrl: url.toString(),
-			origin: url.origin,
-			pathname: url.pathname,
-			hasCode: !!code,
-			hasState: !!state,
-			error,
-			errorDescription,
-			clientId: config.clientId,
-			redirectUri: config.redirectUri
-		});
-		if (error) {
-			logger.error("OAuth callback error", void 0, {
-				error,
-				errorDescription,
-				clientId: config.clientId,
-				applicationType: config.applicationType,
-				hasLandingPage
-			});
-			if (error === "access_denied") {
-				logger.warn("Access denied for this application", { clientId: config.clientId });
-				const headers$2 = await destroyAuthSession(request);
-				headers$2.append("Set-Cookie", `${AUTH_ERROR_COOKIE}=access_denied; Path=/; HttpOnly; SameSite=Lax; Max-Age=300`);
-				headers$2.append("Set-Cookie", `${AUTH_ERROR_DESC_COOKIE}=${encodeURIComponent(errorDescription || "You do not have access to this application.")}; Path=/; SameSite=Lax; Max-Age=300`);
-				const redirectUri$1 = new URL(config.redirectUri);
-				const baseUrl$1 = redirectUri$1.origin;
-				logger.info("Redirecting to /auth/login to show access_denied error", {
-					hasLandingPage,
-					baseUrl: baseUrl$1,
-					configRedirectUri: config.redirectUri
-				});
-				return createRedirectResponse(`${baseUrl$1}/auth/login`, { headers: headers$2 });
-			}
-			if (error === "login_required") {
-				logger.info("Login required, user session may have expired");
-				const headers$2 = await destroyAuthSession(request);
-				const redirectUri$1 = new URL(config.redirectUri);
-				const baseUrl$1 = redirectUri$1.origin;
-				return createRedirectResponse(baseUrl$1, { headers: headers$2 });
-			}
-			const headers$1 = await destroyAuthSession(request);
-			headers$1.append("Set-Cookie", `${AUTH_ERROR_COOKIE}=${encodeURIComponent(error)}; Path=/; HttpOnly; SameSite=Lax; Max-Age=300`);
-			if (errorDescription) headers$1.append("Set-Cookie", `${AUTH_ERROR_DESC_COOKIE}=${encodeURIComponent(errorDescription)}; Path=/; SameSite=Lax; Max-Age=300`);
-			const redirectUri = new URL(config.redirectUri);
-			const baseUrl = redirectUri.origin;
-			return createRedirectResponse(baseUrl, { headers: headers$1 });
-		}
-		if (!code || !state) throw new Error("Missing required callback parameters");
-		const cookies = request.headers.get("Cookie");
-		const oauthStateRegex = new RegExp(`${OAUTH_STATE_COOKIE}=([^;]+)`);
-		const cookieMatch = cookies?.match(oauthStateRegex);
-		const stateId = cookieMatch?.[1];
-		if (!stateId) throw new Error("OAuth state ID not found in cookie");
-		const oauthState = await getOAuthState(stateId);
-		if (!oauthState) throw new Error("No OAuth state found - state may have expired");
-		if (oauthState.state !== state) throw new Error(`OAuth state mismatch`);
-		const stateAge = Date.now() - oauthState.createdAt;
-		if (stateAge > 10 * 60 * 1e3) throw new Error("OAuth state expired");
-		const { authorizationServer, client } = await getOAuthConfig();
-		const clientAuth = getClientAuth();
-		logger.info("Initiating token exchange");
-		const currentUrl = new URL(request.url);
-		const callbackParameters = oauth.validateAuthResponse(authorizationServer, client, currentUrl, oauthState.state);
-		const tokenEndpointResponse = await oauth.authorizationCodeGrantRequest(authorizationServer, client, clientAuth, callbackParameters, config.redirectUri, oauthState.codeVerifier);
-		if (!tokenEndpointResponse.ok) {
-			const errorText = await tokenEndpointResponse.text().catch(() => "Unable to read response");
-			logger.error("Token endpoint error", void 0, { errorText });
-			throw new Error("Token exchange failed");
-		}
-		const tokenResult = await oauth.processAuthorizationCodeResponse(authorizationServer, client, tokenEndpointResponse, { expectedNonce: oauthState.nonce });
-		logger.info("Token exchange completed successfully");
-		let claims = {};
-		if (tokenResult.id_token) try {
-			const payload = tokenResult.id_token.split(".")[1];
-			const base64 = payload.replace(/-/g, "+").replace(/_/g, "/");
-			const binaryString = atob(base64);
-			const bytes = new Uint8Array(binaryString.length);
-			for (let i = 0; i < binaryString.length; i++) bytes[i] = binaryString.charCodeAt(i);
-			claims = JSON.parse(new TextDecoder("utf-8").decode(bytes));
-		} catch (decodeError) {
-			logger.error("Failed to decode ID token", decodeError instanceof Error ? decodeError : void 0);
-			throw new Error("Invalid ID token received");
-		}
-		const newSessionData = await createSessionData(tokenResult, claims);
-		const sessionHeaders = await createAuthSession(request, newSessionData);
-		await deleteOAuthState(stateId);
-		const headers = new Headers(sessionHeaders);
-		headers.append("Set-Cookie", `${OAUTH_STATE_COOKIE}=; Path=/; HttpOnly; SameSite=Lax; Max-Age=0`);
-		logger.info("OAuth callback processed successfully");
-		const redirectUrl = oauthState.returnUrl || "/";
-		return createRedirectResponse(redirectUrl, { headers });
-	} catch (error) {
-		logger.error("OAuth callback failed", error instanceof Error ? error : void 0);
-		try {
-			const cookies = request.headers.get("Cookie");
-			const oauthStateRegex = new RegExp(`${OAUTH_STATE_COOKIE}=([^;]+)`);
-			const cookieMatch = cookies?.match(oauthStateRegex);
-			const stateId = cookieMatch?.[1];
-			if (stateId) await deleteOAuthState(stateId);
-		} catch {}
-		await destroyAuthSession(request);
-		throw new Error("Authentication failed");
-	}
-}
-/**
-* Logout user
-* 
-* Backend uses id_token_hint to identify which tokens to revoke.
-* 
-* **Scenario 1: Full SSO Logout (Manual Sign Out)**
-* - Query param: sso_logout=true
-* - Result: Full logout + identity cookie cleared
-* - User must re-authenticate everywhere
-* 
-* **Scenario 2: Standard Logout (Automatic/Token Expired)**
-* - No sso_logout param
-* - Result: Tokens revoked based on id_token_hint
-* - Backend determines which tokens to revoke
-* 
-* Configuration:
-* - `OIDC_SSO_LOGOUT` env var ('true' | 'false') - default behavior
-* - Query param `sso_logout=true` - override for full logout
-*/
-async function logout(request) {
-	try {
-		const config = getAuthConfig();
-		const url = new URL(request.url);
-		const ssoLogout = url.searchParams.get("sso_logout") === "true" || getEffectiveSsoLogout(config);
-		const returnUrl = url.searchParams.get("returnUrl");
-		logger.info("Logout initiated", {
-			clientId: config.clientId,
-			ssoLogout
-		});
-		const sessionData = await getAuthSession(request);
-		const idToken = sessionData.idToken;
-		const sessionHeaders = await destroyAuthSession(request);
-		const headers = new Headers(sessionHeaders);
-		if (returnUrl) headers.append("Set-Cookie", `logout_return_url=${encodeURIComponent(returnUrl)}; Path=/; HttpOnly; SameSite=Lax; Max-Age=300`);
-		if (idToken) try {
-			const { authorizationServer } = await getOAuthConfig();
-			if (authorizationServer.end_session_endpoint) {
-				const endSessionUrl = new URL(authorizationServer.end_session_endpoint);
-				endSessionUrl.searchParams.set("id_token_hint", idToken);
-				if (ssoLogout) {
-					endSessionUrl.searchParams.set("sso_logout", "true");
-					logger.info("Performing full SSO logout (identity cookie will be cleared)");
-				} else logger.info("Performing standard logout (tokens revoked based on id_token_hint)");
-				if (config.postLogoutRedirectUri) endSessionUrl.searchParams.set("post_logout_redirect_uri", config.postLogoutRedirectUri);
-				return createRedirectResponse(endSessionUrl.toString(), { headers });
-			}
-		} catch {}
-		const baseUrl = new URL(request.url).origin;
-		const registeredPath = config.postLogoutRedirectUri || "/";
-		const finalRedirectUrl = registeredPath.startsWith("http") ? registeredPath : `${baseUrl}${registeredPath}`;
-		logger.info("Logout completed", { redirectUrl: finalRedirectUrl });
-		return createRedirectResponse(finalRedirectUrl, { headers });
-	} catch (error) {
-		logger.error("Logout failed", error instanceof Error ? error : void 0);
-		const headers = await destroyAuthSession(request);
-		return createRedirectResponse("/", { headers });
-	}
-}
-/**
-* Get current user from session
-*/
-async function getUser(request) {
-	try {
-		const sessionData = await getAuthSession(request);
-		return sessionData.user || null;
-	} catch (error) {
-		logger.error("Failed to get user", error instanceof Error ? error : void 0);
-		return null;
-	}
-}
-/**
-* Require authenticated user (throws redirect to login if not authenticated)
-*/
-async function requireAuth(request) {
-	const user = await getUser(request);
-	if (!user) {
-		const url = new URL(request.url);
-		const returnUrl = `${url.pathname}${url.search}`;
-		logger.info("No user found, starting OAuth flow", { returnUrl });
-		throw await login(request, returnUrl);
-	}
-	return user;
-}
-/**
-* Get access token from session
-*/
-async function getAccessToken(request) {
-	try {
-		const sessionData = await getAuthSession(request);
-		return sessionData.accessToken || null;
-	} catch (error) {
-		logger.error("Failed to get access token", error instanceof Error ? error : void 0);
-		return null;
-	}
-}
-/**
-* Refresh tokens
-*/
-async function refreshTokens(request, refreshToken) {
-	try {
-		const sessionData = await getAuthSession(request);
-		const tokenToRefresh = refreshToken || sessionData.refreshToken;
-		if (!tokenToRefresh) {
-			logger.warn("No refresh token available");
-			return {
-				success: false,
-				error: "No refresh token available",
-				shouldLogout: true
-			};
-		}
-		const { authorizationServer, client } = await getOAuthConfig();
-		const clientAuth = getClientAuth();
-		logger.info("Initiating token refresh");
-		const refreshResponse = await oauth.refreshTokenGrantRequest(authorizationServer, client, clientAuth, tokenToRefresh);
-		if (!refreshResponse.ok) {
-			const errorText = await refreshResponse.text().catch(() => "Unknown error");
-			logger.error("Token refresh failed", void 0, {
-				status: refreshResponse.status,
-				errorText
-			});
-			let errorData = {};
-			try {
-				errorData = JSON.parse(errorText);
-			} catch {}
-			const shouldLogout = refreshResponse.status === 400 || errorData.error === "invalid_grant" || errorData.error === "invalid_token" || refreshResponse.status === 401;
-			return {
-				success: false,
-				error: `Token refresh failed: ${errorData.error_description || errorData.error || "Unknown"}`,
-				shouldLogout
-			};
-		}
-		const refreshResult = await oauth.processRefreshTokenResponse(authorizationServer, client, refreshResponse);
-		logger.info("Token refresh successful");
-		const newRefreshToken = refreshResult.refresh_token || tokenToRefresh;
-		const expiresAt = refreshResult.expires_in ? Date.now() + refreshResult.expires_in * 1e3 : sessionData.expiresAt;
-		await updateAuthSession(request, {
-			accessToken: refreshResult.access_token,
-			refreshToken: newRefreshToken,
-			idToken: refreshResult.id_token,
-			expiresAt,
-			lastActivity: Date.now()
-		});
-		return {
-			success: true,
-			tokens: {
-				access_token: refreshResult.access_token,
-				refresh_token: newRefreshToken,
-				id_token: refreshResult.id_token,
-				expires_in: refreshResult.expires_in
-			}
-		};
-	} catch (error) {
-		logger.error("Token refresh failed with exception", error instanceof Error ? error : void 0);
-		const shouldLogout = error instanceof Error && (error.message.includes("invalid_grant") || error.message.includes("invalid_token") || error.message.includes("unauthorized"));
-		return {
-			success: false,
-			error: error instanceof Error ? error.message : "Token refresh failed",
-			shouldLogout
-		};
-	}
-}
-/**
-* Clear auth server cache (useful for testing)
-*/
-function clearAuthServerCache() {
-	authServerCache = null;
-}
-
-//#endregion
-export { clearAuthErrorHeaders, clearAuthServerCache, configureAuthClaimMapping, createRedirectResponse, extractUserInfo, getAccessToken, getAuthError, getUser, handleCallback, hasAuthError, login, logout, refreshTokens, requireAuth, resetAuthClaimMapping };
-//# sourceMappingURL=auth.server-Cx2h2qu3.js.map