@eminuckan/spine 0.2.2 → 0.2.4

package/dist/query-client/index.js

@@ -1,3 +1,3 @@
-import { cachePresets, createQueryClient, createQueryKeyFactory, invalidationHelpers } from "../query-client-Bpe08pk9.js";
+import { cachePresets, createQueryClient, createQueryKeyFactory, invalidationHelpers } from "../query-client-Bh3TyB8W.js";
 
 export { cachePresets, createQueryClient, createQueryKeyFactory, invalidationHelpers };

package/dist/{query-client-Bpe08pk9.js → query-client-Bh3TyB8W.js}

@@ -38,7 +38,7 @@ function createDefaultLogoutHandler() {
 	return (returnUrl) => {
 		if (typeof window !== "undefined") {
 			const currentUrl = returnUrl || window.location.pathname + window.location.search;
-			window.location.href = `/auth/logout?returnUrl=${encodeURIComponent(currentUrl)}`;
+			window.location.href = `/auth/logout?logout=local&returnUrl=${encodeURIComponent(currentUrl)}`;
 		}
 	};
 }
@@ -171,4 +171,4 @@ const invalidationHelpers = {
 
 //#endregion
 export { cachePresets, createQueryClient, createQueryKeyFactory, invalidationHelpers };
-//# sourceMappingURL=query-client-Bpe08pk9.js.map
+//# sourceMappingURL=query-client-Bh3TyB8W.js.map

package/dist/query-client-Bh3TyB8W.js.map

@@ -0,0 +1 @@
+{"version":3,"file":"query-client-Bh3TyB8W.js","names":["DEFAULT_CONFIG: Required<Omit<QueryClientConfig, 'logger' | 'onLogout'>>","error: unknown","returnUrl?: string","config: QueryClientConfig","cachePresets: CachePresets","module: T","filters?: Record<string, unknown>","id: string","queryClient: QueryClient","module: string","queryKey: readonly unknown[]"],"sources":["../src/query-client/query-config.ts"],"sourcesContent":["/**\n * Query Client Configuration\n * \n * Optimized caching strategy for different types of data:\n * - Static data (rarely changes): Long staleTime and gcTime\n * - Dynamic data (changes frequently): Short staleTime\n * - Critical data (needs to be fresh): Very short staleTime with prefetching\n */\n\nimport { QueryClient, QueryCache, MutationCache } from '@tanstack/react-query';\nimport type { QueryClientConfig, CachePresets } from './types';\n\n/**\n * Default configuration\n */\nconst DEFAULT_CONFIG: Required<Omit<QueryClientConfig, 'logger' | 'onLogout'>> = {\n  staleTime: 5 * 60 * 1000, // 5 minutes\n  gcTime: 10 * 60 * 1000, // 10 minutes\n  maxRetries: 3,\n  maxMutationRetries: 1,\n  refetchOnWindowFocus: true,\n  refetchOnReconnect: false,\n  refetchOnMount: false,\n};\n\n/**\n * Check if error is a 401 Unauthorized error\n */\nfunction is401Error(error: unknown): boolean {\n  if (error instanceof Response) {\n    return error.status === 401;\n  }\n\n  if (error && typeof error === 'object' && 'status' in error) {\n    return (error as any).status === 401;\n  }\n\n  return false;\n}\n\n/**\n * Check if error requires logout (refresh token expired)\n */\nfunction shouldLogout(error: unknown): boolean {\n  if (error && typeof error === 'object') {\n    // Check for shouldLogout flag from server\n    if ('shouldLogout' in error && (error as any).shouldLogout === true) {\n      return true;\n    }\n\n    // Check for SESSION_EXPIRED code\n    if ('code' in error && (error as any).code === 'SESSION_EXPIRED') {\n      return true;\n    }\n  }\n\n  return false;\n}\n\n/**\n * Create default logout handler\n */\nfunction createDefaultLogoutHandler(): (returnUrl?: string) => void {\n  return (returnUrl?: string) => {\n    if (typeof window !== 'undefined') {\n      const currentUrl = returnUrl || window.location.pathname + window.location.search;\n      window.location.href = `/auth/logout?logout=local&returnUrl=${encodeURIComponent(currentUrl)}`;\n    }\n  };\n}\n\n/**\n * Create optimized QueryClient instance\n * \n * @param config - Configuration options\n * @returns Configured QueryClient with optimized defaults\n */\nexport function createQueryClient(config: QueryClientConfig = {}): QueryClient {\n  const {\n    staleTime,\n    gcTime,\n    maxRetries,\n    maxMutationRetries,\n    refetchOnWindowFocus,\n    refetchOnReconnect,\n    refetchOnMount,\n    logger,\n    onLogout,\n  } = { ...DEFAULT_CONFIG, ...config };\n\n  const handleLogout = onLogout || createDefaultLogoutHandler();\n\n  const queryClient = new QueryClient({\n    defaultOptions: {\n      queries: {\n        staleTime,\n        gcTime,\n        retry: (failureCount, error) => {\n          // Don't retry 401 errors - the fetch client handles refresh flows separately\n          if (is401Error(error)) {\n            logger?.debug?.('Query failed with 401, not retrying');\n            return false;\n          }\n          return failureCount < maxRetries;\n        },\n        retryDelay: (attemptIndex) => Math.min(1000 * 2 ** attemptIndex, 30000),\n        refetchOnWindowFocus,\n        refetchOnReconnect,\n        refetchOnMount,\n      },\n      mutations: {\n        retry: (failureCount, error) => {\n          if (is401Error(error)) {\n            logger?.debug?.('Mutation failed with 401, not retrying');\n            return false;\n          }\n          return failureCount < maxMutationRetries;\n        },\n        retryDelay: 1000,\n      },\n    },\n    queryCache: new QueryCache({\n      onError: (error) => {\n        if (shouldLogout(error)) {\n          handleLogout();\n          return;\n        }\n        logger?.error?.('Query error', error instanceof Error ? error : undefined, {\n          is401: is401Error(error),\n        });\n      },\n    }),\n    mutationCache: new MutationCache({\n      onError: (error) => {\n        if (shouldLogout(error)) {\n          handleLogout();\n          return;\n        }\n        logger?.error?.('Mutation error', error instanceof Error ? error : undefined, {\n          is401: is401Error(error),\n        });\n      },\n    }),\n  });\n\n  return queryClient;\n}\n\n/**\n * Cache Presets for different data types\n * \n * Use these presets for consistent caching across the application.\n */\nexport const cachePresets: CachePresets = {\n  /**\n   * Static data - rarely changes\n   * Good for: permissions, roles, system settings\n   */\n  static: {\n    staleTime: 30 * 60 * 1000, // 30 minutes\n    gcTime: 60 * 60 * 1000, // 1 hour\n    refetchOnWindowFocus: false,\n  },\n\n  /**\n   * Normal data - changes occasionally\n   * Good for: properties, users, organizations\n   */\n  normal: {\n    staleTime: 5 * 60 * 1000, // 5 minutes\n    gcTime: 10 * 60 * 1000, // 10 minutes\n    refetchOnWindowFocus: true,\n  },\n\n  /**\n   * Dynamic data - changes frequently\n   * Good for: transactions, activities, notifications\n   */\n  dynamic: {\n    staleTime: 1 * 60 * 1000, // 1 minute\n    gcTime: 5 * 60 * 1000, // 5 minutes\n    refetchOnWindowFocus: true,\n  },\n\n  /**\n   * Realtime data - always fresh\n   * Good for: live status, counters, dashboards\n   */\n  realtime: {\n    staleTime: 0, // Always stale\n    gcTime: 1 * 60 * 1000, // 1 minute\n    refetchOnWindowFocus: true,\n  },\n};\n\n/**\n * Create base query keys for a module\n */\nexport function createQueryKeyFactory<T extends string>(\n  module: T\n): {\n  all: readonly [T];\n  lists: () => readonly [T, 'list'];\n  list: (filters?: Record<string, unknown>) => readonly [T, 'list', Record<string, unknown>?];\n  details: () => readonly [T, 'detail'];\n  detail: (id: string) => readonly [T, 'detail', string];\n} {\n  return {\n    all: [module] as const,\n    lists: () => [module, 'list'] as const,\n    list: (filters?: Record<string, unknown>) => [module, 'list', filters] as const,\n    details: () => [module, 'detail'] as const,\n    detail: (id: string) => [module, 'detail', id] as const,\n  };\n}\n\n/**\n * Invalidation helpers for common patterns\n */\nexport const invalidationHelpers = {\n  /**\n   * Invalidate all queries for a module\n   */\n  invalidateModule: async (queryClient: QueryClient, module: string): Promise<void> => {\n    await queryClient.invalidateQueries({ queryKey: [module] });\n  },\n\n  /**\n   * Invalidate all list queries for a module\n   */\n  invalidateLists: async (queryClient: QueryClient, module: string): Promise<void> => {\n    await queryClient.invalidateQueries({ queryKey: [module, 'list'] });\n  },\n\n  /**\n   * Invalidate a specific detail query\n   */\n  invalidateDetail: async (\n    queryClient: QueryClient,\n    module: string,\n    id: string\n  ): Promise<void> => {\n    await queryClient.invalidateQueries({ queryKey: [module, 'detail', id] });\n  },\n\n  /**\n   * Invalidate and refetch (useful for critical data)\n   */\n  invalidateAndRefetch: async (queryClient: QueryClient, queryKey: readonly unknown[]): Promise<void> => {\n    await queryClient.invalidateQueries({ queryKey });\n    await queryClient.refetchQueries({ queryKey });\n  },\n};\n"],"mappings":";;;;;;AAeA,MAAMA,iBAA2E;CAC/E,WAAW,IAAI,KAAK;CACpB,QAAQ,KAAK,KAAK;CAClB,YAAY;CACZ,oBAAoB;CACpB,sBAAsB;CACtB,oBAAoB;CACpB,gBAAgB;AACjB;;;;AAKD,SAAS,WAAWC,OAAyB;AAC3C,KAAI,iBAAiB,SACnB,QAAO,MAAM,WAAW;AAG1B,KAAI,gBAAgB,UAAU,YAAY,YAAY,MACpD,QAAQ,MAAc,WAAW;AAGnC,QAAO;AACR;;;;AAKD,SAAS,aAAaA,OAAyB;AAC7C,KAAI,gBAAgB,UAAU,UAAU;AAEtC,MAAI,kBAAkB,SAAU,MAAc,iBAAiB,KAC7D,QAAO;AAIT,MAAI,UAAU,SAAU,MAAc,SAAS,kBAC7C,QAAO;CAEV;AAED,QAAO;AACR;;;;AAKD,SAAS,6BAA2D;AAClE,QAAO,CAACC,cAAuB;AAC7B,aAAW,WAAW,aAAa;GACjC,MAAM,aAAa,aAAa,OAAO,SAAS,WAAW,OAAO,SAAS;AAC3E,UAAO,SAAS,QAAQ,sCAAsC,mBAAmB,WAAW,CAAC;EAC9F;CACF;AACF;;;;;;;AAQD,SAAgB,kBAAkBC,SAA4B,CAAE,GAAe;CAC7E,MAAM,EACJ,WACA,QACA,YACA,oBACA,sBACA,oBACA,gBACA,QACA,UACD,GAAG;EAAE,GAAG;EAAgB,GAAG;CAAQ;CAEpC,MAAM,eAAe,YAAY,4BAA4B;CAE7D,MAAM,cAAc,IAAI,YAAY;EAClC,gBAAgB;GACd,SAAS;IACP;IACA;IACA,OAAO,CAAC,cAAc,UAAU;AAE9B,SAAI,WAAW,MAAM,EAAE;AACrB,cAAQ,QAAQ,sCAAsC;AACtD,aAAO;KACR;AACD,YAAO,eAAe;IACvB;IACD,YAAY,CAAC,iBAAiB,KAAK,IAAI,MAAO,KAAK,cAAc,IAAM;IACvE;IACA;IACA;GACD;GACD,WAAW;IACT,OAAO,CAAC,cAAc,UAAU;AAC9B,SAAI,WAAW,MAAM,EAAE;AACrB,cAAQ,QAAQ,yCAAyC;AACzD,aAAO;KACR;AACD,YAAO,eAAe;IACvB;IACD,YAAY;GACb;EACF;EACD,YAAY,IAAI,WAAW,EACzB,SAAS,CAAC,UAAU;AAClB,OAAI,aAAa,MAAM,EAAE;AACvB,kBAAc;AACd;GACD;AACD,WAAQ,QAAQ,eAAe,iBAAiB,QAAQ,gBAAmB,EACzE,OAAO,WAAW,MAAM,CACzB,EAAC;EACH,EACF;EACD,eAAe,IAAI,cAAc,EAC/B,SAAS,CAAC,UAAU;AAClB,OAAI,aAAa,MAAM,EAAE;AACvB,kBAAc;AACd;GACD;AACD,WAAQ,QAAQ,kBAAkB,iBAAiB,QAAQ,gBAAmB,EAC5E,OAAO,WAAW,MAAM,CACzB,EAAC;EACH,EACF;CACF;AAED,QAAO;AACR;;;;;;AAOD,MAAaC,eAA6B;CAKxC,QAAQ;EACN,WAAW,KAAK,KAAK;EACrB,QAAQ,KAAK,KAAK;EAClB,sBAAsB;CACvB;CAMD,QAAQ;EACN,WAAW,IAAI,KAAK;EACpB,QAAQ,KAAK,KAAK;EAClB,sBAAsB;CACvB;CAMD,SAAS;EACP,WAAW,IAAI,KAAK;EACpB,QAAQ,IAAI,KAAK;EACjB,sBAAsB;CACvB;CAMD,UAAU;EACR,WAAW;EACX,QAAQ,IAAI,KAAK;EACjB,sBAAsB;CACvB;AACF;;;;AAKD,SAAgB,sBACdC,QAOA;AACA,QAAO;EACL,KAAK,CAAC,MAAO;EACb,OAAO,MAAM,CAAC,QAAQ,MAAO;EAC7B,MAAM,CAACC,YAAsC;GAAC;GAAQ;GAAQ;EAAQ;EACtE,SAAS,MAAM,CAAC,QAAQ,QAAS;EACjC,QAAQ,CAACC,OAAe;GAAC;GAAQ;GAAU;EAAG;CAC/C;AACF;;;;AAKD,MAAa,sBAAsB;CAIjC,kBAAkB,OAAOC,aAA0BC,WAAkC;AACnF,QAAM,YAAY,kBAAkB,EAAE,UAAU,CAAC,MAAO,EAAE,EAAC;CAC5D;CAKD,iBAAiB,OAAOD,aAA0BC,WAAkC;AAClF,QAAM,YAAY,kBAAkB,EAAE,UAAU,CAAC,QAAQ,MAAO,EAAE,EAAC;CACpE;CAKD,kBAAkB,OAChBD,aACAC,QACAF,OACkB;AAClB,QAAM,YAAY,kBAAkB,EAAE,UAAU;GAAC;GAAQ;GAAU;EAAG,EAAE,EAAC;CAC1E;CAKD,sBAAsB,OAAOC,aAA0BE,aAAgD;AACrG,QAAM,YAAY,kBAAkB,EAAE,SAAU,EAAC;AACjD,QAAM,YAAY,eAAe,EAAE,SAAU,EAAC;CAC/C;AACF"}

package/dist/react-router/index.js

@@ -1,11 +1,13 @@
 import { LOG_LEVEL_PRIORITY, LogLevel, Logger, createLogger, defaultLoggerConfig, logger } from "../logging-_h2mi3L9.js";
-import { PERMISSION_MODULES, PermissionChecker, PermissionInitializer, ProtectedAction, ProtectedButton, ProtectedLink, ProtectedSection, getPermissionChecker, getPermissions, initializePermissions, useAllPermissions, useHasModulePermission, useHasPermission, useHasPermissions, useModulePermission, usePermission, usePermissionChecker, usePermissionStore, usePermissions } from "../permissions-D5ScGGnd.js";
-import { TenantProvider, configureTenantEndpoints, initializeTenantStore, useCurrentOrganization, useCurrentTenant, useOrganization, useTenant, useTenantStore, useTenantSwitcher } from "../tenant-C6KPaSCX.js";
-import { IdentityContextProvider, configureIdentityEndpoints, configureIdentityStore, resetIdentityStoreConfig, useHasSubscription, useIdentityContext, useIdentityStore, useIsOnboarded, useUserPermissions, useUserTenants } from "../identity-CFa1txoj.js";
-import { isApiClientError } from "../types-BnKaWdfe.js";
-import { ApiError, ErrorCodes, ErrorHandler, calculateBackoffDelay, createRetryFetch, fetchWithTimeout, handleApiError, isRetryableError, withRetry } from "../api-client-DsrxK05Z.js";
-import { IdentitySignalRClient, SignalRClient, cleanupSignalR, createIdentitySignalRClient, getIdentitySignalRClient, initializeSignalR } from "../signalr-SJ-1sIxw.js";
-import { cachePresets, createQueryClient, createQueryKeyFactory, invalidationHelpers } from "../query-client-Bpe08pk9.js";
-import "../src-CJ2RLi94.js";
+import { PermissionChecker } from "../permission-service-CvGpwI0d.js";
+import { PERMISSION_MODULES, PermissionInitializer, ProtectedAction, ProtectedButton, ProtectedLink, ProtectedSection, getPermissionChecker, getPermissions, initializePermissions, useAllPermissions, useHasModulePermission, useHasPermission, useHasPermissions, useModulePermission, usePermission, usePermissionChecker, usePermissionStore, usePermissions } from "../permissions-OUK8Eql2.js";
+import { evaluateAccessRequirement } from "../access-DlAqsVGQ.js";
+import { TenantProvider, configureTenantEndpoints, initializeTenantStore, useCurrentOrganization, useCurrentTenant, useOrganization, useTenant, useTenantStore, useTenantSwitcher } from "../tenant-BErqEENp.js";
+import { IdentityContextProvider, configureIdentityEndpoints, configureIdentityStore, resetIdentityStoreConfig, useHasSubscription, useIdentityContext, useIdentityStore, useIsOnboarded, useUserPermissions, useUserTenants } from "../identity-yT2ijZF0.js";
+import { isApiClientError } from "../types-BaaE6wjY.js";
+import { ApiError, ErrorCodes, ErrorHandler, calculateBackoffDelay, createRetryFetch, fetchWithTimeout, handleApiError, isRetryableError, withRetry } from "../api-client-CZapXIF8.js";
+import { IdentitySignalRClient, SignalRClient, cleanupSignalR, createIdentitySignalRClient, getIdentitySignalRClient, initializeSignalR } from "../signalr-CSfCz1Ik.js";
+import { cachePresets, createQueryClient, createQueryKeyFactory, invalidationHelpers } from "../query-client-Bh3TyB8W.js";
+import "../src-B9rDUgSb.js";
 
-export { ApiError, ErrorCodes, ErrorHandler, IdentityContextProvider, IdentitySignalRClient, LOG_LEVEL_PRIORITY, LogLevel, Logger, PERMISSION_MODULES, PermissionChecker, PermissionInitializer, ProtectedAction, ProtectedButton, ProtectedLink, ProtectedSection, SignalRClient, TenantProvider, cachePresets, calculateBackoffDelay, cleanupSignalR, configureIdentityEndpoints, configureIdentityStore, configureTenantEndpoints, createIdentitySignalRClient, createLogger, createQueryClient, createQueryKeyFactory, createRetryFetch, defaultLoggerConfig, fetchWithTimeout, getIdentitySignalRClient, getPermissionChecker, getPermissions, handleApiError, initializePermissions, initializeSignalR, initializeTenantStore, invalidationHelpers, isApiClientError, isRetryableError, logger, resetIdentityStoreConfig, useAllPermissions, useCurrentOrganization, useCurrentTenant, useHasModulePermission, useHasPermission, useHasPermissions, useHasSubscription, useIdentityContext, useIdentityStore, useIsOnboarded, useModulePermission, useOrganization, usePermission, usePermissionChecker, usePermissionStore, usePermissions, useTenant, useTenantStore, useTenantSwitcher, useUserPermissions, useUserTenants, withRetry };
+export { ApiError, ErrorCodes, ErrorHandler, IdentityContextProvider, IdentitySignalRClient, LOG_LEVEL_PRIORITY, LogLevel, Logger, PERMISSION_MODULES, PermissionChecker, PermissionInitializer, ProtectedAction, ProtectedButton, ProtectedLink, ProtectedSection, SignalRClient, TenantProvider, cachePresets, calculateBackoffDelay, cleanupSignalR, configureIdentityEndpoints, configureIdentityStore, configureTenantEndpoints, createIdentitySignalRClient, createLogger, createQueryClient, createQueryKeyFactory, createRetryFetch, defaultLoggerConfig, evaluateAccessRequirement, fetchWithTimeout, getIdentitySignalRClient, getPermissionChecker, getPermissions, handleApiError, initializePermissions, initializeSignalR, initializeTenantStore, invalidationHelpers, isApiClientError, isRetryableError, logger, resetIdentityStoreConfig, useAllPermissions, useCurrentOrganization, useCurrentTenant, useHasModulePermission, useHasPermission, useHasPermissions, useHasSubscription, useIdentityContext, useIdentityStore, useIsOnboarded, useModulePermission, useOrganization, usePermission, usePermissionChecker, usePermissionStore, usePermissions, useTenant, useTenantStore, useTenantSwitcher, useUserPermissions, useUserTenants, withRetry };

package/dist/react-router/server.js

@@ -1,18 +1,20 @@
 import { LOG_LEVEL_PRIORITY, LogLevel, Logger, createLogger, defaultLoggerConfig, logger } from "../logging-_h2mi3L9.js";
-import { PERMISSION_MODULES, PermissionChecker, PermissionInitializer, ProtectedAction, ProtectedButton, ProtectedLink, ProtectedSection, getPermissionChecker, getPermissions, initializePermissions, useAllPermissions, useHasModulePermission, useHasPermission, useHasPermissions, useModulePermission, usePermission, usePermissionChecker, usePermissionStore, usePermissions } from "../permissions-D5ScGGnd.js";
-import { TenantProvider, configureTenantEndpoints, initializeTenantStore, useCurrentOrganization, useCurrentTenant, useOrganization, useTenant, useTenantStore, useTenantSwitcher } from "../tenant-C6KPaSCX.js";
-import { IdentityContextProvider, configureIdentityEndpoints, configureIdentityStore, resetIdentityStoreConfig, useHasSubscription, useIdentityContext, useIdentityStore, useIsOnboarded, useUserPermissions, useUserTenants } from "../identity-CFa1txoj.js";
-import { isApiClientError } from "../types-BnKaWdfe.js";
-import { ApiError, ErrorCodes, ErrorHandler, calculateBackoffDelay, createRetryFetch, fetchWithTimeout, handleApiError, isRetryableError, withRetry } from "../api-client-DsrxK05Z.js";
-import { IdentitySignalRClient, SignalRClient, cleanupSignalR, createIdentitySignalRClient, getIdentitySignalRClient, initializeSignalR } from "../signalr-SJ-1sIxw.js";
-import { cachePresets, createQueryClient, createQueryKeyFactory, invalidationHelpers } from "../query-client-Bpe08pk9.js";
-import "../src-CJ2RLi94.js";
-import { AUTH_ERROR_COOKIE_PREFIX, cleanupExpiredOAuthStates, closeRedisConnection, createAuthSession, createOAuthState, deleteOAuthState, destroyAuthSession, getAuthSession, getOAuthState, isSessionValid, requireAuthSession, updateAuthSession } from "../redis-session-storage.server-BR_0y-QO.js";
-import { clearAuthErrorHeaders, clearAuthServerCache, configureAuthClaimMapping, extractUserInfo, getAccessToken, getAuthError, getUser, handleCallback, hasAuthError, login, logout, refreshTokens, requireAuth, resetAuthClaimMapping } from "../auth.server-Cx2h2qu3.js";
-import { attemptTokenRefresh, authRoute, configureRouteProtection, isTokenExpiredResponse, onboardingRoute, protectRoute, publicRoute, resetRouteProtectionConfig, shouldAttemptTokenRefresh, shouldRefreshToken, subscriptionRoute } from "../server-BHfKHKF_.js";
-import { clearActiveTenant, clearCurrentTenant, configureIdentityContextFetcher, configureTenantCookie, getActiveTenant, getAvailableTenants, getCurrentTenant, getTenantFromIdentityContext, initializeTenant, resetTenantCookieConfig, setActiveTenant, setCurrentTenant } from "../server-BxvRxjCK.js";
-import { clearIdentityContextCache, configureIdentityAPIFetcher, configurePermissionFetcher, contextToUserInfo, fetchIdentityContext, fetchUserPermissions, getIdentityContext, hasContextVersionChanged, updateContextVersion } from "../server-C3L8J7iE.js";
-import { checkPermission, configurePermissionRouteProtection, requirePermission, resetPermissionRouteProtection, withPermission } from "../server-CouYoZiw.js";
-import { createAPIConfigFactory, createApiClient, createFetchMiddleware } from "../server-DZmcd2Lr.js";
+import { PermissionChecker } from "../permission-service-CvGpwI0d.js";
+import { PERMISSION_MODULES, PermissionInitializer, ProtectedAction, ProtectedButton, ProtectedLink, ProtectedSection, getPermissionChecker, getPermissions, initializePermissions, useAllPermissions, useHasModulePermission, useHasPermission, useHasPermissions, useModulePermission, usePermission, usePermissionChecker, usePermissionStore, usePermissions } from "../permissions-OUK8Eql2.js";
+import { evaluateAccessRequirement } from "../access-DlAqsVGQ.js";
+import { TenantProvider, configureTenantEndpoints, initializeTenantStore, useCurrentOrganization, useCurrentTenant, useOrganization, useTenant, useTenantStore, useTenantSwitcher } from "../tenant-BErqEENp.js";
+import { IdentityContextProvider, configureIdentityEndpoints, configureIdentityStore, resetIdentityStoreConfig, useHasSubscription, useIdentityContext, useIdentityStore, useIsOnboarded, useUserPermissions, useUserTenants } from "../identity-yT2ijZF0.js";
+import { isApiClientError } from "../types-BaaE6wjY.js";
+import { ApiError, ErrorCodes, ErrorHandler, calculateBackoffDelay, createRetryFetch, fetchWithTimeout, handleApiError, isRetryableError, withRetry } from "../api-client-CZapXIF8.js";
+import { IdentitySignalRClient, SignalRClient, cleanupSignalR, createIdentitySignalRClient, getIdentitySignalRClient, initializeSignalR } from "../signalr-CSfCz1Ik.js";
+import { cachePresets, createQueryClient, createQueryKeyFactory, invalidationHelpers } from "../query-client-Bh3TyB8W.js";
+import "../src-B9rDUgSb.js";
+import { AUTH_ERROR_COOKIE_PREFIX, cleanupExpiredOAuthStates, closeRedisConnection, createAuthSession, createOAuthState, deleteOAuthState, destroyAuthSession, destroyAuthSessionById, destroyAuthSessionsByIdentitySession, destroyAuthSessionsBySessionState, destroyAuthSessionsBySid, destroyAuthSessionsForUser, getAuthSession, getAuthSessionById, getCurrentAuthSessionId, getOAuthState, isSessionValid, listAuthSessionDataForUser, listAuthSessionsForUser, listCurrentUserAuthSessions, requireAuthSession, updateAuthSession } from "../redis-session-storage.server-D0-72FV-.js";
+import { clearAuthErrorHeaders, clearAuthServerCache, configureAuthClaimMapping, extractUserInfo, getAccessToken, getAuthError, getUser, handleBackChannelLogout, handleCallback, handleFrontChannelLogout, hasAuthError, login, logout, refreshTokens, requireAuth, resetAuthClaimMapping } from "../auth.server-B3ODGIX4.js";
+import { attemptTokenRefresh, authRoute, configureRouteProtection, isTokenExpiredResponse, onboardingRoute, protectRoute, publicRoute, resetRouteProtectionConfig, shouldAttemptTokenRefresh, shouldRefreshToken, subscriptionRoute } from "../server-B7JN86_0.js";
+import { clearActiveTenant, clearCurrentTenant, configureIdentityContextFetcher, configureTenantCookie, getActiveTenant, getAvailableTenants, getCurrentTenant, getTenantFromIdentityContext, initializeTenant, resetTenantCookieConfig, setActiveTenant, setCurrentTenant } from "../server-Ce9jQRdL.js";
+import { clearIdentityContextCache, configureIdentityAPIFetcher, configurePermissionFetcher, contextToUserInfo, fetchIdentityContext, fetchUserPermissions, getIdentityContext, hasContextVersionChanged, updateContextVersion } from "../server-BmiuV28c.js";
+import { checkPermission, configurePermissionRouteProtection, requirePermission, resetPermissionRouteProtection, withPermission } from "../server-hGrElJMG.js";
+import { createAPIConfigFactory, createApiClient, createFetchMiddleware } from "../server-DeBlxoaW.js";
 
-export { AUTH_ERROR_COOKIE_PREFIX, ApiError, ErrorCodes, ErrorHandler, IdentityContextProvider, IdentitySignalRClient, LOG_LEVEL_PRIORITY, LogLevel, Logger, PERMISSION_MODULES, PermissionChecker, PermissionInitializer, ProtectedAction, ProtectedButton, ProtectedLink, ProtectedSection, SignalRClient, TenantProvider, attemptTokenRefresh, authRoute, cachePresets, calculateBackoffDelay, checkPermission, cleanupExpiredOAuthStates, cleanupSignalR, clearActiveTenant, clearAuthErrorHeaders, clearAuthServerCache, clearCurrentTenant, clearIdentityContextCache, closeRedisConnection, configureAuthClaimMapping, configureIdentityAPIFetcher, configureIdentityContextFetcher, configureIdentityEndpoints, configureIdentityStore, configurePermissionFetcher, configurePermissionRouteProtection, configureRouteProtection, configureTenantCookie, configureTenantEndpoints, contextToUserInfo, createAPIConfigFactory, createApiClient, createAuthSession, createFetchMiddleware, createIdentitySignalRClient, createLogger, createOAuthState, createQueryClient, createQueryKeyFactory, createRetryFetch, defaultLoggerConfig, deleteOAuthState, destroyAuthSession, extractUserInfo, fetchIdentityContext, fetchUserPermissions, fetchWithTimeout, getAccessToken, getActiveTenant, getAuthError, getAuthSession, getAvailableTenants, getCurrentTenant, getIdentityContext, getIdentitySignalRClient, getOAuthState, getPermissionChecker, getPermissions, getTenantFromIdentityContext, getUser, handleApiError, handleCallback, hasAuthError, hasContextVersionChanged, initializePermissions, initializeSignalR, initializeTenant, initializeTenantStore, invalidationHelpers, isApiClientError, isRetryableError, isSessionValid, isTokenExpiredResponse, logger, login, logout, onboardingRoute, protectRoute, publicRoute, refreshTokens, requireAuth, requireAuthSession, requirePermission, resetAuthClaimMapping, resetIdentityStoreConfig, resetPermissionRouteProtection, resetRouteProtectionConfig, resetTenantCookieConfig, setActiveTenant, setCurrentTenant, shouldAttemptTokenRefresh, shouldRefreshToken, subscriptionRoute, updateAuthSession, updateContextVersion, useAllPermissions, useCurrentOrganization, useCurrentTenant, useHasModulePermission, useHasPermission, useHasPermissions, useHasSubscription, useIdentityContext, useIdentityStore, useIsOnboarded, useModulePermission, useOrganization, usePermission, usePermissionChecker, usePermissionStore, usePermissions, useTenant, useTenantStore, useTenantSwitcher, useUserPermissions, useUserTenants, withPermission, withRetry };
+export { AUTH_ERROR_COOKIE_PREFIX, ApiError, ErrorCodes, ErrorHandler, IdentityContextProvider, IdentitySignalRClient, LOG_LEVEL_PRIORITY, LogLevel, Logger, PERMISSION_MODULES, PermissionChecker, PermissionInitializer, ProtectedAction, ProtectedButton, ProtectedLink, ProtectedSection, SignalRClient, TenantProvider, attemptTokenRefresh, authRoute, cachePresets, calculateBackoffDelay, checkPermission, cleanupExpiredOAuthStates, cleanupSignalR, clearActiveTenant, clearAuthErrorHeaders, clearAuthServerCache, clearCurrentTenant, clearIdentityContextCache, closeRedisConnection, configureAuthClaimMapping, configureIdentityAPIFetcher, configureIdentityContextFetcher, configureIdentityEndpoints, configureIdentityStore, configurePermissionFetcher, configurePermissionRouteProtection, configureRouteProtection, configureTenantCookie, configureTenantEndpoints, contextToUserInfo, createAPIConfigFactory, createApiClient, createAuthSession, createFetchMiddleware, createIdentitySignalRClient, createLogger, createOAuthState, createQueryClient, createQueryKeyFactory, createRetryFetch, defaultLoggerConfig, deleteOAuthState, destroyAuthSession, destroyAuthSessionById, destroyAuthSessionsByIdentitySession, destroyAuthSessionsBySessionState, destroyAuthSessionsBySid, destroyAuthSessionsForUser, evaluateAccessRequirement, extractUserInfo, fetchIdentityContext, fetchUserPermissions, fetchWithTimeout, getAccessToken, getActiveTenant, getAuthError, getAuthSession, getAuthSessionById, getAvailableTenants, getCurrentAuthSessionId, getCurrentTenant, getIdentityContext, getIdentitySignalRClient, getOAuthState, getPermissionChecker, getPermissions, getTenantFromIdentityContext, getUser, handleApiError, handleBackChannelLogout, handleCallback, handleFrontChannelLogout, hasAuthError, hasContextVersionChanged, initializePermissions, initializeSignalR, initializeTenant, initializeTenantStore, invalidationHelpers, isApiClientError, isRetryableError, isSessionValid, isTokenExpiredResponse, listAuthSessionDataForUser, listAuthSessionsForUser, listCurrentUserAuthSessions, logger, login, logout, onboardingRoute, protectRoute, publicRoute, refreshTokens, requireAuth, requireAuthSession, requirePermission, resetAuthClaimMapping, resetIdentityStoreConfig, resetPermissionRouteProtection, resetRouteProtectionConfig, resetTenantCookieConfig, setActiveTenant, setCurrentTenant, shouldAttemptTokenRefresh, shouldRefreshToken, subscriptionRoute, updateAuthSession, updateContextVersion, useAllPermissions, useCurrentOrganization, useCurrentTenant, useHasModulePermission, useHasPermission, useHasPermissions, useHasSubscription, useIdentityContext, useIdentityStore, useIsOnboarded, useModulePermission, useOrganization, usePermission, usePermissionChecker, usePermissionStore, usePermissions, useTenant, useTenantStore, useTenantSwitcher, useUserPermissions, useUserTenants, withPermission, withRetry };

package/dist/redis-session-storage.server-D0-72FV-.js

@@ -0,0 +1,500 @@
+import { logger } from "./logging-_h2mi3L9.js";
+import Redis from "ioredis";
+import { createCipheriv, createDecipheriv, createHmac, randomBytes, timingSafeEqual } from "node:crypto";
+
+//#region src/auth/redis-session-storage.server.ts
+let redis = null;
+function getRedis() {
+	if (!redis) {
+		redis = new Redis(process.env.REDIS_URL || "redis://localhost:6379");
+		redis.on("error", (err) => {
+			logger.error("Redis Client Error", err);
+		});
+		redis.on("connect", () => {
+			logger.info("Redis connected successfully");
+		});
+	}
+	return redis;
+}
+const KEY_PREFIX = process.env.REDIS_KEY_PREFIX || "";
+const REDIS_KEYS = {
+	oauthState: (stateId) => `${KEY_PREFIX}oauth:state:${stateId}`,
+	session: (sessionId) => `${KEY_PREFIX}session:${sessionId}`,
+	sessionByUser: (userId) => `${KEY_PREFIX}session:index:user:${userId}`,
+	sessionBySid: (sid) => `${KEY_PREFIX}session:index:sid:${sid}`,
+	sessionBySessionState: (sessionState) => `${KEY_PREFIX}session:index:session_state:${sessionState}`
+};
+const DEFAULT_SESSION_SECRET = "default-secret-change-in-production";
+const DEFAULT_SESSION_TTL = 60 * 60 * 24 * 7;
+const DEFAULT_OAUTH_STATE_TTL = 10 * 60;
+const OAUTH_STATE_TTL = resolvePositiveIntegerEnv("OAUTH_STATE_TTL", DEFAULT_OAUTH_STATE_TTL);
+const SESSION_TTL = resolvePositiveIntegerEnv("SESSION_DEFAULT_TTL", resolvePositiveIntegerEnv("SESSION_TTL", DEFAULT_SESSION_TTL));
+const SESSION_COOKIE_NAME = process.env.SESSION_COOKIE_NAME || "__session_id";
+const SESSION_SECRET = resolveSessionSecret();
+const SESSION_COOKIE_SECURE = resolveCookieSecure();
+const SESSION_COOKIE_PATH = "/";
+const SESSION_COOKIE_SAME_SITE = resolveCookieSameSite();
+const SESSION_COOKIE_DOMAIN = process.env.SESSION_COOKIE_DOMAIN?.trim();
+const SESSION_ENCRYPTION_ENABLED = resolveSessionEncryptionEnabled();
+const SESSION_ENCRYPTION_KEY = resolveSessionEncryptionKey(SESSION_ENCRYPTION_ENABLED);
+const AUTH_ERROR_COOKIE_PREFIX = SESSION_COOKIE_NAME.replace("_session", "").replace("__", "");
+function resolveBooleanEnv(name, defaultValue) {
+	const value = process.env[name]?.trim().toLowerCase();
+	if (!value) return defaultValue;
+	if ([
+		"1",
+		"true",
+		"yes",
+		"on"
+	].includes(value)) return true;
+	if ([
+		"0",
+		"false",
+		"no",
+		"off"
+	].includes(value)) return false;
+	throw new Error(`${name} must be a boolean value.`);
+}
+function resolvePositiveIntegerEnv(name, defaultValue) {
+	const value = process.env[name]?.trim();
+	if (!value) return defaultValue;
+	const parsed = Number(value);
+	if (!Number.isSafeInteger(parsed) || parsed <= 0) throw new Error(`${name} must be a positive integer.`);
+	return parsed;
+}
+function resolveSessionSecret() {
+	const secret = process.env.SESSION_SECRET?.trim();
+	if (!secret || secret === DEFAULT_SESSION_SECRET) {
+		if (process.env.NODE_ENV === "production") throw new Error("SESSION_SECRET must be set to a unique random value in production.");
+		return DEFAULT_SESSION_SECRET;
+	}
+	if (secret.length < 32) throw new Error("SESSION_SECRET must be at least 32 characters long.");
+	return secret;
+}
+function resolveCookieSecure() {
+	return resolveBooleanEnv("SESSION_COOKIE_SECURE", process.env.NODE_ENV === "production");
+}
+function resolveCookieSameSite() {
+	const value = process.env.SESSION_COOKIE_SAME_SITE?.trim().toLowerCase();
+	const sameSite = value === "strict" ? "Strict" : value === "none" ? "None" : "Lax";
+	if (sameSite === "None" && !SESSION_COOKIE_SECURE) throw new Error("SESSION_COOKIE_SAME_SITE=None requires SESSION_COOKIE_SECURE=true.");
+	return sameSite;
+}
+function resolveSessionEncryptionEnabled() {
+	const enabled = resolveBooleanEnv("SESSION_ENCRYPTION", process.env.NODE_ENV === "production");
+	if (process.env.NODE_ENV === "production" && !enabled) throw new Error("SESSION_ENCRYPTION cannot be disabled in production.");
+	return enabled;
+}
+function decodeBase64Url(value) {
+	const normalized = value.replace(/-/g, "+").replace(/_/g, "/");
+	const padded = normalized.padEnd(normalized.length + (4 - normalized.length % 4) % 4, "=");
+	return Buffer.from(padded, "base64");
+}
+function resolveSessionEncryptionKey(enabled) {
+	if (!enabled) return null;
+	const value = process.env.SESSION_ENCRYPTION_KEY?.trim();
+	if (!value) throw new Error("SESSION_ENCRYPTION_KEY is required when session encryption is enabled.");
+	const key = /^[0-9a-f]{64}$/i.test(value) ? Buffer.from(value, "hex") : decodeBase64Url(value);
+	if (key.length !== 32) throw new Error("SESSION_ENCRYPTION_KEY must decode to exactly 32 bytes. Generate one with: openssl rand -base64 32");
+	return key;
+}
+function parseCookieHeader(cookieHeader) {
+	if (!cookieHeader) return {};
+	return cookieHeader.split(";").map((part) => part.trim()).filter(Boolean).reduce((cookies, part) => {
+		const separatorIndex = part.indexOf("=");
+		if (separatorIndex <= 0) return cookies;
+		const name = part.slice(0, separatorIndex).trim();
+		const value = part.slice(separatorIndex + 1).trim();
+		if (!name) return cookies;
+		cookies[name] = value;
+		return cookies;
+	}, {});
+}
+function createCookieSignature(value, secret) {
+	return createHmac("sha256", secret).update(value).digest("base64url");
+}
+function safelyCompareValues(left, right) {
+	const leftBuffer = Buffer.from(left);
+	const rightBuffer = Buffer.from(right);
+	if (leftBuffer.length !== rightBuffer.length) return false;
+	return timingSafeEqual(leftBuffer, rightBuffer);
+}
+function signSessionId(sessionId) {
+	const signature = createCookieSignature(sessionId, SESSION_SECRET);
+	return `${sessionId}.${signature}`;
+}
+function unsignSessionId(cookieValue) {
+	if (!cookieValue) return null;
+	let decodedValue;
+	try {
+		decodedValue = decodeURIComponent(cookieValue);
+	} catch {
+		return null;
+	}
+	const separatorIndex = decodedValue.lastIndexOf(".");
+	if (separatorIndex <= 0 || separatorIndex === decodedValue.length - 1) return null;
+	const sessionId = decodedValue.slice(0, separatorIndex);
+	const signature = decodedValue.slice(separatorIndex + 1);
+	const expectedSignature = createCookieSignature(sessionId, SESSION_SECRET);
+	return safelyCompareValues(signature, expectedSignature) ? sessionId : null;
+}
+function serializeSessionCookieValue(sessionId, options) {
+	const signedValue = encodeURIComponent(signSessionId(sessionId));
+	const segments = [
+		`${SESSION_COOKIE_NAME}=${signedValue}`,
+		`Max-Age=${options.maxAge}`,
+		`Path=${SESSION_COOKIE_PATH}`,
+		`SameSite=${SESSION_COOKIE_SAME_SITE}`,
+		"HttpOnly"
+	];
+	if (SESSION_COOKIE_DOMAIN) segments.push(`Domain=${SESSION_COOKIE_DOMAIN}`);
+	if (SESSION_COOKIE_SECURE) segments.push("Secure");
+	return segments.join("; ");
+}
+function serializeExpiredSessionCookie() {
+	const segments = [
+		`${SESSION_COOKIE_NAME}=`,
+		"Max-Age=0",
+		`Path=${SESSION_COOKIE_PATH}`,
+		`SameSite=${SESSION_COOKIE_SAME_SITE}`,
+		"HttpOnly"
+	];
+	if (SESSION_COOKIE_DOMAIN) segments.push(`Domain=${SESSION_COOKIE_DOMAIN}`);
+	if (SESSION_COOKIE_SECURE) segments.push("Secure");
+	return segments.join("; ");
+}
+async function getSessionIdFromRequest(request) {
+	const cookies = parseCookieHeader(request.headers.get("Cookie"));
+	return unsignSessionId(cookies[SESSION_COOKIE_NAME]);
+}
+function getSessionIndexKeys(data) {
+	const keys = new Set();
+	if (data.userId) keys.add(REDIS_KEYS.sessionByUser(data.userId));
+	if (data.sid) keys.add(REDIS_KEYS.sessionBySid(data.sid));
+	if (data.sessionState) keys.add(REDIS_KEYS.sessionBySessionState(data.sessionState));
+	return Array.from(keys);
+}
+async function registerSessionIndexes(sessionId, data) {
+	const indexKeys = getSessionIndexKeys(data);
+	if (indexKeys.length === 0) return;
+	const redisClient = getRedis();
+	const pipeline = redisClient.pipeline();
+	for (const indexKey of indexKeys) {
+		pipeline.sadd(indexKey, sessionId);
+		pipeline.expire(indexKey, SESSION_TTL);
+	}
+	await pipeline.exec();
+}
+async function unregisterSessionIndexes(sessionId, data) {
+	const indexKeys = getSessionIndexKeys(data);
+	if (indexKeys.length === 0) return;
+	const redisClient = getRedis();
+	const pipeline = redisClient.pipeline();
+	for (const indexKey of indexKeys) pipeline.srem(indexKey, sessionId);
+	await pipeline.exec();
+}
+function parseSessionData(sessionData) {
+	if (!sessionData) return null;
+	try {
+		return JSON.parse(decodeSessionData(sessionData));
+	} catch (error) {
+		logger.error("Failed to parse session data", error instanceof Error ? error : void 0);
+		return null;
+	}
+}
+function encodeSessionData(data) {
+	const plaintext = JSON.stringify(data);
+	if (!SESSION_ENCRYPTION_KEY) return plaintext;
+	const iv = randomBytes(12);
+	const cipher = createCipheriv("aes-256-gcm", SESSION_ENCRYPTION_KEY, iv);
+	const ciphertext = Buffer.concat([cipher.update(plaintext, "utf8"), cipher.final()]);
+	const tag = cipher.getAuthTag();
+	return [
+		"enc:v1",
+		iv.toString("base64url"),
+		tag.toString("base64url"),
+		ciphertext.toString("base64url")
+	].join(":");
+}
+function decodeSessionData(value) {
+	if (!value.startsWith("enc:v1:")) {
+		if (SESSION_ENCRYPTION_ENABLED) logger.warn("Reading legacy plaintext auth session payload while session encryption is enabled.");
+		return value;
+	}
+	if (!SESSION_ENCRYPTION_KEY) throw new Error("Cannot decrypt auth session payload because SESSION_ENCRYPTION_KEY is not configured.");
+	const [, version, ivValue, tagValue, ciphertextValue] = value.split(":");
+	if (version !== "v1" || !ivValue || !tagValue || !ciphertextValue) throw new Error("Invalid encrypted auth session payload format.");
+	const decipher = createDecipheriv("aes-256-gcm", SESSION_ENCRYPTION_KEY, Buffer.from(ivValue, "base64url"));
+	decipher.setAuthTag(Buffer.from(tagValue, "base64url"));
+	return Buffer.concat([decipher.update(Buffer.from(ciphertextValue, "base64url")), decipher.final()]).toString("utf8");
+}
+async function readSessionData(sessionId) {
+	try {
+		const sessionData = await getRedis().get(REDIS_KEYS.session(sessionId));
+		if (!sessionData) {
+			logger.debug("Session not found in Redis", { sessionId });
+			return null;
+		}
+		await getRedis().expire(REDIS_KEYS.session(sessionId), SESSION_TTL);
+		return parseSessionData(sessionData);
+	} catch (error) {
+		logger.error("Failed to read session from Redis", error instanceof Error ? error : void 0);
+		return null;
+	}
+}
+async function writeSessionData(sessionId, data) {
+	try {
+		const existingSessionData = parseSessionData(await getRedis().get(REDIS_KEYS.session(sessionId)));
+		if (existingSessionData) await unregisterSessionIndexes(sessionId, existingSessionData);
+		await getRedis().setex(REDIS_KEYS.session(sessionId), SESSION_TTL, encodeSessionData(data));
+		await registerSessionIndexes(sessionId, data);
+		logger.debug("Updated Redis session", { sessionId });
+	} catch (error) {
+		logger.error("Failed to update session in Redis", error instanceof Error ? error : void 0);
+		throw error;
+	}
+}
+async function deleteSessionData(sessionId) {
+	try {
+		const existingSessionData = parseSessionData(await getRedis().get(REDIS_KEYS.session(sessionId)));
+		if (existingSessionData) await unregisterSessionIndexes(sessionId, existingSessionData);
+		await getRedis().del(REDIS_KEYS.session(sessionId));
+		logger.debug("Deleted Redis session", { sessionId });
+	} catch (error) {
+		logger.error("Failed to delete session from Redis", error instanceof Error ? error : void 0);
+	}
+}
+function mergeSessionData(existingData, updates) {
+	const nextData = { ...existingData };
+	Object.entries(updates).forEach(([key, value]) => {
+		if (value === void 0) {
+			delete nextData[key];
+			return;
+		}
+		nextData[key] = value;
+	});
+	return nextData;
+}
+async function getSessionIdsFromIndex(indexKey) {
+	const sessionIds = await getRedis().smembers(indexKey);
+	const activeSessionIds = [];
+	const staleSessionIds = [];
+	for (const sessionId of sessionIds) {
+		const exists = await getRedis().exists(REDIS_KEYS.session(sessionId));
+		if (exists) activeSessionIds.push(sessionId);
+		else staleSessionIds.push(sessionId);
+	}
+	if (staleSessionIds.length > 0) await getRedis().srem(indexKey, ...staleSessionIds);
+	return activeSessionIds;
+}
+function toAuthSessionSummary(sessionId, session, currentSessionId) {
+	return {
+		sessionId,
+		userId: session.userId,
+		email: session.user?.email,
+		name: session.user?.name,
+		issuer: session.issuer,
+		sid: session.sid,
+		sessionState: session.sessionState,
+		clientId: session.clientId,
+		ipAddress: session.ipAddress,
+		userAgent: session.userAgent,
+		createdAt: session.createdAt,
+		lastActivity: session.lastActivity,
+		expiresAt: session.expiresAt,
+		isCurrent: currentSessionId ? sessionId === currentSessionId : void 0
+	};
+}
+async function listSessionDataByIds(sessionIds) {
+	const sessions = [];
+	for (const sessionId of sessionIds) {
+		const data = await readSessionData(sessionId);
+		if (data) sessions.push({
+			sessionId,
+			data
+		});
+	}
+	return sessions;
+}
+function getRequestIpAddress(request) {
+	const forwardedFor = request.headers.get("x-forwarded-for")?.split(",")[0]?.trim();
+	return forwardedFor || request.headers.get("cf-connecting-ip")?.trim() || request.headers.get("x-real-ip")?.trim() || void 0;
+}
+async function createAuthSession(request, sessionData) {
+	const currentSessionId = await getSessionIdFromRequest(request);
+	const nextSessionId = crypto.randomUUID();
+	const nextSessionData = mergeSessionData({}, {
+		...sessionData,
+		sessionId: nextSessionId,
+		ipAddress: sessionData.ipAddress ?? getRequestIpAddress(request),
+		userAgent: sessionData.userAgent ?? request.headers.get("user-agent") ?? void 0
+	});
+	logger.debug("Creating auth session", { dataKeys: Object.keys(sessionData) });
+	if (currentSessionId) await deleteSessionData(currentSessionId);
+	await writeSessionData(nextSessionId, nextSessionData);
+	return new Headers({ "Set-Cookie": serializeSessionCookieValue(nextSessionId, { maxAge: SESSION_TTL }) });
+}
+async function getAuthSession(request) {
+	const sessionId = await getSessionIdFromRequest(request);
+	if (!sessionId) return {};
+	const session = await readSessionData(sessionId);
+	if (!session) return {};
+	return {
+		sessionId,
+		userId: session.userId,
+		accessToken: session.accessToken,
+		refreshToken: session.refreshToken,
+		idToken: session.idToken,
+		expiresAt: session.expiresAt,
+		issuer: session.issuer,
+		sid: session.sid,
+		sessionState: session.sessionState,
+		clientId: session.clientId,
+		ipAddress: session.ipAddress,
+		userAgent: session.userAgent,
+		user: session.user,
+		createdAt: session.createdAt,
+		lastActivity: session.lastActivity
+	};
+}
+async function updateAuthSession(request, updates) {
+	const currentSessionId = await getSessionIdFromRequest(request);
+	const currentSessionData = currentSessionId ? await readSessionData(currentSessionId) ?? {} : {};
+	const nextSessionId = currentSessionId ?? crypto.randomUUID();
+	const nextSessionData = mergeSessionData(currentSessionData, {
+		...updates,
+		sessionId: nextSessionId
+	});
+	await writeSessionData(nextSessionId, nextSessionData);
+	return new Headers({ "Set-Cookie": serializeSessionCookieValue(nextSessionId, { maxAge: SESSION_TTL }) });
+}
+async function destroyAuthSession(request) {
+	const sessionId = await getSessionIdFromRequest(request);
+	if (sessionId) await deleteSessionData(sessionId);
+	return new Headers({ "Set-Cookie": serializeExpiredSessionCookie() });
+}
+async function getCurrentAuthSessionId(request) {
+	return await getSessionIdFromRequest(request);
+}
+async function getAuthSessionById(sessionId) {
+	const session = await readSessionData(sessionId);
+	return session ? {
+		...session,
+		sessionId
+	} : null;
+}
+async function listAuthSessionDataForUser(userId) {
+	const sessionIds = await getSessionIdsFromIndex(REDIS_KEYS.sessionByUser(userId));
+	return await listSessionDataByIds(sessionIds);
+}
+async function listAuthSessionsForUser(userId, currentSessionId) {
+	const sessions = await listAuthSessionDataForUser(userId);
+	return sessions.map(({ sessionId, data }) => toAuthSessionSummary(sessionId, data, currentSessionId)).sort((left, right) => (right.lastActivity ?? right.createdAt ?? 0) - (left.lastActivity ?? left.createdAt ?? 0));
+}
+async function listCurrentUserAuthSessions(request) {
+	const currentSession = await getAuthSession(request);
+	if (!currentSession.userId) return [];
+	return await listAuthSessionsForUser(currentSession.userId, currentSession.sessionId);
+}
+async function destroyAuthSessionById(sessionId) {
+	const session = await readSessionData(sessionId);
+	if (!session) return false;
+	await deleteSessionData(sessionId);
+	return true;
+}
+async function destroyAuthSessionsForUser(userId) {
+	const sessionIds = await getSessionIdsFromIndex(REDIS_KEYS.sessionByUser(userId));
+	let destroyedSessions = 0;
+	for (const sessionId of sessionIds) if (await destroyAuthSessionById(sessionId)) destroyedSessions += 1;
+	return destroyedSessions;
+}
+async function destroyAuthSessionsBySid(sid) {
+	const sessionIds = await getSessionIdsFromIndex(REDIS_KEYS.sessionBySid(sid));
+	let destroyedSessions = 0;
+	for (const sessionId of sessionIds) if (await destroyAuthSessionById(sessionId)) destroyedSessions += 1;
+	return destroyedSessions;
+}
+async function destroyAuthSessionsBySessionState(sessionState) {
+	const sessionIds = await getSessionIdsFromIndex(REDIS_KEYS.sessionBySessionState(sessionState));
+	let destroyedSessions = 0;
+	for (const sessionId of sessionIds) if (await destroyAuthSessionById(sessionId)) destroyedSessions += 1;
+	return destroyedSessions;
+}
+async function destroyAuthSessionsByIdentitySession(params) {
+	if (params.sid) return await destroyAuthSessionsBySid(params.sid);
+	if (params.sessionState) return await destroyAuthSessionsBySessionState(params.sessionState);
+	if (params.userId) return await destroyAuthSessionsForUser(params.userId);
+	return 0;
+}
+async function requireAuthSession(request) {
+	const sessionData = await getAuthSession(request);
+	if (!sessionData.userId || !sessionData.accessToken) throw new Response("Unauthorized", { status: 401 });
+	return sessionData;
+}
+async function isSessionValid(request) {
+	try {
+		const sessionData = await getAuthSession(request);
+		if (!sessionData.user || !sessionData.accessToken) return false;
+		if (sessionData.expiresAt && Date.now() >= sessionData.expiresAt) return false;
+		return true;
+	} catch {
+		return false;
+	}
+}
+async function createOAuthState(state) {
+	const stateId = crypto.randomUUID();
+	const key = REDIS_KEYS.oauthState(stateId);
+	await getRedis().setex(key, OAUTH_STATE_TTL, JSON.stringify(state));
+	logger.debug("OAuth state created", {
+		stateId,
+		ttl: OAUTH_STATE_TTL
+	});
+	return stateId;
+}
+async function getOAuthState(stateId) {
+	const key = REDIS_KEYS.oauthState(stateId);
+	const data = await getRedis().get(key);
+	if (!data) {
+		logger.warn("OAuth state not found or expired", { stateId });
+		return null;
+	}
+	try {
+		return JSON.parse(data);
+	} catch (error) {
+		logger.error("Failed to parse OAuth state", error instanceof Error ? error : void 0);
+		return null;
+	}
+}
+async function deleteOAuthState(stateId) {
+	const key = REDIS_KEYS.oauthState(stateId);
+	await getRedis().del(key);
+	logger.debug("OAuth state deleted", { stateId });
+}
+async function cleanupExpiredOAuthStates() {
+	const pattern = REDIS_KEYS.oauthState("*");
+	const keys = await getRedis().keys(pattern);
+	let cleaned = 0;
+	for (const key of keys) {
+		const ttl = await getRedis().ttl(key);
+		if (ttl === -1) {
+			await getRedis().del(key);
+			cleaned++;
+		}
+	}
+	logger.info("OAuth state cleanup completed", {
+		cleaned,
+		total: keys.length
+	});
+	return cleaned;
+}
+async function closeRedisConnection() {
+	if (redis) {
+		await redis.quit();
+		redis = null;
+		logger.info("Redis connection closed");
+	}
+}
+
+//#endregion
+export { AUTH_ERROR_COOKIE_PREFIX, cleanupExpiredOAuthStates, closeRedisConnection, createAuthSession, createOAuthState, deleteOAuthState, destroyAuthSession, destroyAuthSessionById, destroyAuthSessionsByIdentitySession, destroyAuthSessionsBySessionState, destroyAuthSessionsBySid, destroyAuthSessionsForUser, getAuthSession, getAuthSessionById, getCurrentAuthSessionId, getOAuthState, isSessionValid, listAuthSessionDataForUser, listAuthSessionsForUser, listCurrentUserAuthSessions, requireAuthSession, updateAuthSession };
+//# sourceMappingURL=redis-session-storage.server-D0-72FV-.js.map