@eminuckan/spine 0.2.2 → 0.3.0

package/dist/auth.server-D5oiz9aF.js

@@ -0,0 +1,1066 @@
+import { logger } from "./logging-DviiAkLx.js";
+import { AUTH_ERROR_COOKIE_PREFIX, createAuthSession, createOAuthState, deleteOAuthState, destroyAuthSession, destroyAuthSessionsByIdentitySession, destroyAuthSessionsBySid, destroyAuthSessionsForUser, getAuthSession, getOAuthState, listAuthSessionDataForUser, updateAuthSession } from "./redis-session-storage.server-v2VcpFsQ.js";
+import * as oidc from "openid-client";
+import { createRemoteJWKSet, jwtVerify } from "jose";
+
+//#region src/http/response.ts
+/**
+* Create a redirect response without relying on a router/framework helper.
+*/
+function createRedirectResponse(location, init = {}) {
+	const headers = new Headers(init.headers);
+	headers.set("Location", location);
+	return new Response(null, {
+		status: init.status ?? 302,
+		headers
+	});
+}
+
+//#endregion
+//#region src/auth/authorization-parameters.ts
+const RESERVED_AUTHORIZATION_PARAMETER_NAMES = new Set([
+	"client_id",
+	"code_challenge",
+	"code_challenge_method",
+	"kc_action",
+	"nonce",
+	"prompt",
+	"redirect_uri",
+	"response_mode",
+	"response_type",
+	"scope",
+	"state"
+]);
+const DEFAULT_EXTRA_AUTHORIZATION_PARAMETER_NAMES = new Set([
+	"acr_values",
+	"kc_idp_hint",
+	"login_hint",
+	"ui_locales"
+]);
+function isAllowedExtraAuthorizationParameter(key, allowedNames, allowedPrefixes) {
+	const normalized = key.toLowerCase();
+	return allowedNames.has(normalized) || allowedPrefixes.some((prefix) => normalized.startsWith(prefix));
+}
+function sanitizeExtraAuthorizationParameters(params, options = {}) {
+	if (!params) return {};
+	const allowedNames = new Set([...DEFAULT_EXTRA_AUTHORIZATION_PARAMETER_NAMES, ...(options.extraAuthParamNames ?? []).map((name) => name.trim().toLowerCase()).filter(Boolean)]);
+	const allowedPrefixes = (options.extraAuthParamPrefixes ?? []).map((prefix) => prefix.trim().toLowerCase()).filter(Boolean);
+	const sanitized = {};
+	for (const [key, value] of Object.entries(params)) {
+		const normalizedKey = key.trim();
+		if (normalizedKey.length === 0 || RESERVED_AUTHORIZATION_PARAMETER_NAMES.has(normalizedKey.toLowerCase()) || !isAllowedExtraAuthorizationParameter(normalizedKey, allowedNames, allowedPrefixes) || value === null || value === void 0) continue;
+		const normalizedValue = String(value).trim();
+		if (normalizedValue.length === 0) continue;
+		sanitized[normalizedKey] = normalizedValue;
+	}
+	return sanitized;
+}
+function normalizePublicAuthorizationStateContext(context) {
+	if (!context) return null;
+	const normalized = {};
+	for (const [key, value] of Object.entries(context)) {
+		const normalizedKey = key.trim();
+		if (normalizedKey.length === 0 || RESERVED_AUTHORIZATION_PARAMETER_NAMES.has(normalizedKey.toLowerCase()) || value === null || value === void 0) continue;
+		const normalizedValue = String(value).trim();
+		if (normalizedValue.length === 0) continue;
+		normalized[normalizedKey] = normalizedValue;
+	}
+	return Object.keys(normalized).length > 0 ? normalized : null;
+}
+function buildAuthorizationState(baseState, publicStateContext) {
+	const normalizedContext = normalizePublicAuthorizationStateContext(publicStateContext);
+	if (!normalizedContext) return baseState;
+	return `${baseState}.${Buffer.from(JSON.stringify(normalizedContext), "utf8").toString("base64url")}`;
+}
+
+//#endregion
+//#region src/auth/auth.server.ts
+/**
+* Get effective hasLandingPage setting based on config
+*/
+function getEffectiveHasLandingPage(config) {
+	if (config.hasLandingPage !== void 0) return config.hasLandingPage;
+	switch (config.applicationType) {
+		case "no-landing-page":
+		case "dashboard": return false;
+		case "landing-page":
+		case "tenant-app": return true;
+		default: return true;
+	}
+}
+/**
+* Create OAuth configuration from environment variables
+*/
+function createAuthConfig() {
+	const requiredEnvVars = {
+		authority: process.env.OIDC_AUTHORITY,
+		clientId: process.env.OIDC_CLIENT_ID,
+		redirectUri: process.env.OIDC_REDIRECT_URI
+	};
+	for (const [key, value] of Object.entries(requiredEnvVars)) if (!value) throw new Error(`Missing required environment variable: OIDC_${key.toUpperCase()}`);
+	const appTypeEnv = process.env.OIDC_APPLICATION_TYPE?.toLowerCase();
+	let applicationType = "custom";
+	if (appTypeEnv === "no-landing-page" || appTypeEnv === "no_landing_page") applicationType = "no-landing-page";
+	else if (appTypeEnv === "landing-page" || appTypeEnv === "landing_page") applicationType = "landing-page";
+	else if (appTypeEnv === "dashboard") applicationType = "dashboard";
+	else if (appTypeEnv === "tenant-app" || appTypeEnv === "tenant_app") applicationType = "tenant-app";
+	const clientAuthMethod = parseOidcClientAuthMethod(process.env.OIDC_CLIENT_AUTH_METHOD, process.env.OIDC_CLIENT_SECRET ? "client_secret_post" : "none");
+	const hasLandingPage = process.env.OIDC_HAS_LANDING_PAGE !== void 0 ? process.env.OIDC_HAS_LANDING_PAGE === "true" : void 0;
+	return {
+		authority: requiredEnvVars.authority,
+		clientId: requiredEnvVars.clientId,
+		clientSecret: process.env.OIDC_CLIENT_SECRET,
+		clientAuthMethod,
+		redirectUri: requiredEnvVars.redirectUri,
+		scope: process.env.OIDC_SCOPE || "openid profile email api",
+		postLogoutRedirectUri: process.env.OIDC_POST_LOGOUT_REDIRECT_URI,
+		applicationType,
+		hasLandingPage
+	};
+}
+function parseOidcClientAuthMethod(value, fallback) {
+	const normalized = value?.trim().toLowerCase();
+	switch (normalized) {
+		case void 0:
+		case "": return fallback;
+		case "none": return "none";
+		case "client_secret_post":
+		case "post": return "client_secret_post";
+		case "client_secret_basic":
+		case "basic": return "client_secret_basic";
+		default: throw new Error(`Unsupported OIDC_CLIENT_AUTH_METHOD: ${value}`);
+	}
+}
+let OIDC_CONFIG = null;
+function getAuthConfig() {
+	if (!OIDC_CONFIG) OIDC_CONFIG = createAuthConfig();
+	return OIDC_CONFIG;
+}
+let authServerCache = null;
+const CACHE_TTL = 60 * 60 * 1e3;
+const jwksCache = new Map();
+function normalizeIssuer(value) {
+	const normalized = value?.trim().replace(/\/+$/, "");
+	return normalized && normalized.length > 0 ? normalized : null;
+}
+function getJwtClaims(token) {
+	if (!token) return null;
+	try {
+		const [, payload] = token.split(".");
+		if (!payload) return null;
+		return JSON.parse(Buffer.from(payload, "base64url").toString("utf8"));
+	} catch {
+		return null;
+	}
+}
+function getJwtIssuer(token) {
+	const issuer = getJwtClaims(token)?.iss;
+	return typeof issuer === "string" ? normalizeIssuer(issuer) : null;
+}
+function canUseIdTokenHint(idToken, expectedIssuer) {
+	if (!idToken) return false;
+	const tokenIssuer = getJwtIssuer(idToken);
+	return tokenIssuer !== null && tokenIssuer === normalizeIssuer(expectedIssuer);
+}
+function sanitizeLogoutReturnUrl(returnUrl, request) {
+	if (!returnUrl) return null;
+	try {
+		const requestUrl = new URL(request.url);
+		const decodedReturnUrl = decodeURIComponent(returnUrl);
+		if (decodedReturnUrl.startsWith("/") && !decodedReturnUrl.startsWith("//")) return isAuthLoopPath(decodedReturnUrl) ? null : decodedReturnUrl;
+		const candidateUrl = new URL(decodedReturnUrl);
+		if (candidateUrl.origin !== requestUrl.origin) return null;
+		const sameOriginPath = `${candidateUrl.pathname}${candidateUrl.search}${candidateUrl.hash}`;
+		return isAuthLoopPath(sameOriginPath) ? null : sameOriginPath;
+	} catch {
+		return null;
+	}
+}
+function appendApplicationInitiatedActionResult(returnUrl, action, status) {
+	if (!action && !status) return returnUrl;
+	try {
+		const isRelative = returnUrl.startsWith("/") && !returnUrl.startsWith("//");
+		const url = new URL(returnUrl, isRelative ? "http://spine.local" : void 0);
+		if (action) url.searchParams.set("kc_action", action);
+		if (status) url.searchParams.set("kc_action_status", status);
+		return isRelative ? `${url.pathname}${url.search}${url.hash}` : url.toString();
+	} catch {
+		const params = new URLSearchParams();
+		if (action) params.set("kc_action", action);
+		if (status) params.set("kc_action_status", status);
+		const separator = returnUrl.includes("?") ? "&" : "?";
+		return `${returnUrl}${separator}${params.toString()}`;
+	}
+}
+function isAuthLoopPath(path) {
+	const normalized = path.split("#")[0].split("?")[0].replace(/\/+$/, "") || "/";
+	return normalized === "/auth/logout" || normalized === "/auth/callback";
+}
+function isLocalInsecureIssuer(authority) {
+	try {
+		const issuer = new URL(authority);
+		return issuer.protocol === "http:" && [
+			"localhost",
+			"127.0.0.1",
+			"::1",
+			"[::1]"
+		].includes(issuer.hostname);
+	} catch {
+		return false;
+	}
+}
+function shouldAllowInsecureOidcRequests(authority) {
+	if (process.env.NODE_ENV === "production") return false;
+	if (process.env.OIDC_ALLOW_INSECURE_REQUESTS === "true") return true;
+	return isLocalInsecureIssuer(authority);
+}
+function getDiscoveryOptions() {
+	const config = getAuthConfig();
+	return shouldAllowInsecureOidcRequests(config.authority) ? {
+		algorithm: "oidc",
+		execute: [oidc.allowInsecureRequests]
+	} : { algorithm: "oidc" };
+}
+function getClientMetadata(config) {
+	return config.clientAuthMethod === "none" ? void 0 : config.clientSecret;
+}
+function getClientAuthentication(config) {
+	switch (config.clientAuthMethod) {
+		case "client_secret_basic":
+			if (!config.clientSecret) throw new Error("OIDC_CLIENT_SECRET is required for client_secret_basic authentication");
+			return oidc.ClientSecretBasic(config.clientSecret);
+		case "client_secret_post":
+			if (!config.clientSecret) throw new Error("OIDC_CLIENT_SECRET is required for client_secret_post authentication");
+			return oidc.ClientSecretPost(config.clientSecret);
+		case "none":
+		default: return oidc.None();
+	}
+}
+function getOAuthErrorMessage(error) {
+	if (error instanceof oidc.ResponseBodyError) return error.error_description || error.error || error.message;
+	if (error instanceof Error) return error.message;
+	return "Unknown error";
+}
+function shouldLogoutAfterOAuthError(error) {
+	if (error instanceof oidc.ResponseBodyError) return error.status === 400 || error.status === 401 || error.error === "invalid_grant" || error.error === "invalid_token";
+	const message = error instanceof Error ? error.message.toLowerCase() : "";
+	return message.includes("invalid_grant") || message.includes("invalid_token") || message.includes("unauthorized");
+}
+function getLogoutScope(url) {
+	const requestedScope = url.searchParams.get("logout") ?? url.searchParams.get("logout_scope") ?? url.searchParams.get("scope");
+	const normalized = requestedScope?.trim().toLowerCase();
+	if (normalized === "local" || normalized === "application" || normalized === "app" || normalized === "current-device") return "local";
+	if (normalized === "all" || normalized === "all-local" || normalized === "all-devices" || normalized === "everywhere") return "all";
+	if (url.searchParams.get("local_only") === "true" || url.searchParams.get("client_id_only") === "true") return "local";
+	return "identity";
+}
+function getAbsoluteRedirectUrl(request, redirectUrl) {
+	if (/^https?:\/\//i.test(redirectUrl)) return redirectUrl;
+	return new URL(redirectUrl, new URL(request.url).origin).toString();
+}
+async function revokeTokenBestEffort(configuration, token, tokenTypeHint) {
+	if (!token) return;
+	try {
+		await oidc.tokenRevocation(configuration, token, { token_type_hint: tokenTypeHint });
+	} catch (error) {
+		logger.warn("OIDC token revocation failed", {
+			tokenTypeHint,
+			error: getOAuthErrorMessage(error)
+		});
+	}
+}
+async function revokeSessionTokensBestEffort(sessionData) {
+	if (!sessionData.refreshToken && !sessionData.accessToken) return;
+	try {
+		const configuration = await getOAuthConfig();
+		await revokeTokenBestEffort(configuration, sessionData.refreshToken, "refresh_token");
+		await revokeTokenBestEffort(configuration, sessionData.accessToken, "access_token");
+	} catch (error) {
+		logger.warn("Skipping OIDC token revocation because provider configuration is unavailable", { error: getOAuthErrorMessage(error) });
+	}
+}
+async function revokeAndDestroyAllUserSessionsBestEffort(userId) {
+	const sessions = await listAuthSessionDataForUser(userId);
+	try {
+		const configuration = await getOAuthConfig();
+		for (const { data } of sessions) {
+			await revokeTokenBestEffort(configuration, data.refreshToken, "refresh_token");
+			await revokeTokenBestEffort(configuration, data.accessToken, "access_token");
+		}
+	} catch (error) {
+		logger.warn("Skipping all-session token revocation because provider configuration is unavailable", { error: getOAuthErrorMessage(error) });
+	}
+	return await destroyAuthSessionsForUser(userId);
+}
+function getClaimsFromTokenResponse(tokenResult) {
+	const claims = tokenResult.claims();
+	if (claims) return claims;
+	return getJwtClaims(tokenResult.id_token) ?? {};
+}
+/**
+* Get OIDC configuration with caching.
+*/
+async function getOAuthConfig() {
+	const config = getAuthConfig();
+	const now = Date.now();
+	if (authServerCache && now - authServerCache.cachedAt < CACHE_TTL) return authServerCache.configuration;
+	try {
+		const configuration = await oidc.discovery(new URL(config.authority), config.clientId, getClientMetadata(config), getClientAuthentication(config), getDiscoveryOptions());
+		authServerCache = {
+			configuration,
+			cachedAt: now
+		};
+		logger.info("OIDC discovery completed successfully", {
+			issuer: configuration.serverMetadata().issuer,
+			clientId: config.clientId,
+			clientAuthMethod: config.clientAuthMethod
+		});
+		return configuration;
+	} catch (error) {
+		logger.error("OIDC discovery failed", error instanceof Error ? error : void 0, {
+			authority: config.authority,
+			clientId: config.clientId
+		});
+		throw new Error(`OIDC discovery failed: ${getOAuthErrorMessage(error)}`);
+	}
+}
+function getJwks(jwksUri) {
+	const cachedJwks = jwksCache.get(jwksUri);
+	if (cachedJwks) return cachedJwks;
+	const jwks = createRemoteJWKSet(new URL(jwksUri));
+	jwksCache.set(jwksUri, jwks);
+	return jwks;
+}
+async function getLogoutTokenFromRequest(request) {
+	const contentType = request.headers.get("content-type") ?? "";
+	if (contentType.includes("application/json")) {
+		const body = await request.json().catch(() => null);
+		return typeof body?.logout_token === "string" ? body.logout_token : null;
+	}
+	const formData = await request.formData().catch(() => null);
+	const logoutToken = formData?.get("logout_token");
+	return typeof logoutToken === "string" ? logoutToken : null;
+}
+function validateBackChannelLogoutClaims(payload, clientId) {
+	const events = payload.events;
+	const hasBackChannelEvent = events && typeof events === "object" && !Array.isArray(events) && "http://schemas.openid.net/event/backchannel-logout" in events;
+	if (!hasBackChannelEvent) throw new Error("Invalid back-channel logout token: missing back-channel logout event");
+	if ("nonce" in payload) throw new Error("Invalid back-channel logout token: nonce is not allowed");
+	const audience = payload.aud;
+	const hasClientAudience = Array.isArray(audience) ? audience.includes(clientId) : audience === clientId;
+	if (!hasClientAudience) throw new Error("Invalid back-channel logout token: audience mismatch");
+	const subject = typeof payload.sub === "string" ? payload.sub : void 0;
+	const sid = typeof payload.sid === "string" ? payload.sid : void 0;
+	if (!subject && !sid) throw new Error("Invalid back-channel logout token: subject or sid is required");
+	return {
+		issuer: typeof payload.iss === "string" ? payload.iss : void 0,
+		subject,
+		sid
+	};
+}
+const DEFAULT_AUTH_CLAIM_MAPPING = {
+	subject: ["sub"],
+	name: [
+		"name",
+		"preferred_username",
+		"email"
+	],
+	email: ["email"],
+	givenName: ["given_name", "givenName"],
+	familyName: ["family_name", "familyName"],
+	picture: ["picture", "avatar_url"],
+	locale: ["locale"],
+	zoneinfo: ["zoneinfo"],
+	updatedAt: ["updated_at"],
+	tenantIds: ["tenant_ids"],
+	tenantRoles: ["tenant_roles"],
+	permissions: [
+		"app_perms",
+		"permissions",
+		"scope"
+	],
+	isOnboarded: ["is_onboarded"]
+};
+let authClaimMapping = { ...DEFAULT_AUTH_CLAIM_MAPPING };
+function normalizeClaimKeys(keys) {
+	if (!Array.isArray(keys)) return [];
+	return Array.from(new Set(keys.map((key) => key.trim()).filter((key) => key.length > 0)));
+}
+/**
+* Configure claim mapping so different providers/backends can project their
+* own claim names onto the shared auth/session primitives.
+*/
+function configureAuthClaimMapping(mapping) {
+	authClaimMapping = {
+		subject: mapping.subject !== void 0 ? normalizeClaimKeys(mapping.subject) : DEFAULT_AUTH_CLAIM_MAPPING.subject,
+		name: mapping.name !== void 0 ? normalizeClaimKeys(mapping.name) : DEFAULT_AUTH_CLAIM_MAPPING.name,
+		email: mapping.email !== void 0 ? normalizeClaimKeys(mapping.email) : DEFAULT_AUTH_CLAIM_MAPPING.email,
+		givenName: mapping.givenName !== void 0 ? normalizeClaimKeys(mapping.givenName) : DEFAULT_AUTH_CLAIM_MAPPING.givenName,
+		familyName: mapping.familyName !== void 0 ? normalizeClaimKeys(mapping.familyName) : DEFAULT_AUTH_CLAIM_MAPPING.familyName,
+		picture: mapping.picture !== void 0 ? normalizeClaimKeys(mapping.picture) : DEFAULT_AUTH_CLAIM_MAPPING.picture,
+		locale: mapping.locale !== void 0 ? normalizeClaimKeys(mapping.locale) : DEFAULT_AUTH_CLAIM_MAPPING.locale,
+		zoneinfo: mapping.zoneinfo !== void 0 ? normalizeClaimKeys(mapping.zoneinfo) : DEFAULT_AUTH_CLAIM_MAPPING.zoneinfo,
+		updatedAt: mapping.updatedAt !== void 0 ? normalizeClaimKeys(mapping.updatedAt) : DEFAULT_AUTH_CLAIM_MAPPING.updatedAt,
+		tenantIds: mapping.tenantIds !== void 0 ? normalizeClaimKeys(mapping.tenantIds) : DEFAULT_AUTH_CLAIM_MAPPING.tenantIds,
+		tenantRoles: mapping.tenantRoles !== void 0 ? normalizeClaimKeys(mapping.tenantRoles) : DEFAULT_AUTH_CLAIM_MAPPING.tenantRoles,
+		permissions: mapping.permissions !== void 0 ? normalizeClaimKeys(mapping.permissions) : DEFAULT_AUTH_CLAIM_MAPPING.permissions,
+		isOnboarded: mapping.isOnboarded !== void 0 ? normalizeClaimKeys(mapping.isOnboarded) : DEFAULT_AUTH_CLAIM_MAPPING.isOnboarded
+	};
+}
+/**
+* Reset claim mapping to the built-in defaults.
+*/
+function resetAuthClaimMapping() {
+	authClaimMapping = { ...DEFAULT_AUTH_CLAIM_MAPPING };
+}
+function getConfiguredAuthClaimMapping() {
+	return authClaimMapping;
+}
+function getFirstClaimValue(claims, claimKeys) {
+	for (const claimKey of claimKeys) if (claimKey in claims) return {
+		key: claimKey,
+		value: claims[claimKey]
+	};
+	return {};
+}
+function getStringClaim(claims, claimKeys) {
+	const { value } = getFirstClaimValue(claims, claimKeys);
+	if (typeof value === "string") {
+		const trimmed = value.trim();
+		return trimmed.length > 0 ? trimmed : void 0;
+	}
+	if (typeof value === "number" || typeof value === "boolean") return `${value}`;
+	return void 0;
+}
+function getNumberClaim(claims, claimKeys) {
+	const { value } = getFirstClaimValue(claims, claimKeys);
+	if (typeof value === "number" && Number.isFinite(value)) return value;
+	if (typeof value === "string") {
+		const parsed = Number(value);
+		return Number.isFinite(parsed) ? parsed : void 0;
+	}
+	return void 0;
+}
+function getBooleanClaim(claims, claimKeys, defaultValue = false) {
+	const { value } = getFirstClaimValue(claims, claimKeys);
+	if (typeof value === "boolean") return value;
+	if (typeof value === "string") return value.toLowerCase() === "true";
+	return defaultValue;
+}
+/**
+* Parse JSON safely
+*/
+function parseJson(value) {
+	try {
+		return JSON.parse(value);
+	} catch {
+		return null;
+	}
+}
+/**
+* Convert value to string array
+*/
+function toStringArray(value) {
+	if (!value) return [];
+	if (Array.isArray(value)) return value.map((item) => typeof item === "string" ? item.trim() : `${item}`.trim()).filter((item) => item.length > 0);
+	if (typeof value === "string") {
+		const trimmed = value.trim();
+		if (!trimmed) return [];
+		if (trimmed.startsWith("[")) {
+			const parsed = parseJson(trimmed);
+			if (Array.isArray(parsed)) return parsed.map((item) => typeof item === "string" ? item.trim() : `${item}`.trim()).filter((item) => item.length > 0);
+		}
+		if (trimmed.includes(",")) return trimmed.split(",").map((item) => item.trim()).filter((item) => item.length > 0);
+		return [trimmed];
+	}
+	return [];
+}
+function toScopeArray(value) {
+	if (typeof value === "string") return value.trim().split(/\s+/).filter((item) => item.length > 0);
+	return toStringArray(value);
+}
+/**
+* Extract user info from ID token claims
+*/
+function extractUserInfo(claims) {
+	const claimMapping = getConfiguredAuthClaimMapping();
+	let tenants = [];
+	const { value: rawTenantIds } = getFirstClaimValue(claims, claimMapping.tenantIds);
+	if (rawTenantIds !== void 0) if (typeof rawTenantIds === "string" && rawTenantIds.trim().startsWith("[")) {
+		const parsed = parseJson(rawTenantIds.trim());
+		if (Array.isArray(parsed)) tenants = parsed.map((id) => typeof id === "string" ? id.trim() : `${id}`.trim()).filter((id) => id.length > 0);
+	} else tenants = toStringArray(rawTenantIds);
+	const tenantRoles = {};
+	const { value: rawRoles } = getFirstClaimValue(claims, claimMapping.tenantRoles);
+	if (rawRoles !== void 0) {
+		let parsedRoles = rawRoles;
+		if (typeof rawRoles === "string" && rawRoles.trim().startsWith("{")) parsedRoles = parseJson(rawRoles.trim()) ?? rawRoles;
+		if (parsedRoles && typeof parsedRoles === "object" && !Array.isArray(parsedRoles)) for (const [tenantId, roleValue] of Object.entries(parsedRoles)) {
+			const roleIds = toStringArray(roleValue);
+			if (roleIds.length > 0) tenantRoles[tenantId] = roleIds;
+		}
+	}
+	const permissionClaim = getFirstClaimValue(claims, claimMapping.permissions);
+	const permissions = permissionClaim.key === "scope" ? toScopeArray(permissionClaim.value) : toStringArray(permissionClaim.value);
+	const isOnboarded = getBooleanClaim(claims, claimMapping.isOnboarded);
+	return {
+		tenants,
+		isOnboarded,
+		tenantRoles,
+		permissions
+	};
+}
+/**
+* Create session data from token result
+*/
+async function createSessionData(tokenResult, claims) {
+	const claimMapping = getConfiguredAuthClaimMapping();
+	const baseUser = {
+		sub: getStringClaim(claims, claimMapping.subject) || "unknown",
+		name: getStringClaim(claims, claimMapping.name) || getStringClaim(claims, claimMapping.email) || "User",
+		email: getStringClaim(claims, claimMapping.email),
+		givenName: getStringClaim(claims, claimMapping.givenName),
+		familyName: getStringClaim(claims, claimMapping.familyName),
+		picture: getStringClaim(claims, claimMapping.picture),
+		locale: getStringClaim(claims, claimMapping.locale),
+		zoneinfo: getStringClaim(claims, claimMapping.zoneinfo),
+		updated_at: getNumberClaim(claims, claimMapping.updatedAt)
+	};
+	const expiresAt = tokenResult.expires_in ? Date.now() + tokenResult.expires_in * 1e3 : void 0;
+	const now = Date.now();
+	const sessionState = tokenResult.session_state;
+	return {
+		userId: baseUser.sub,
+		accessToken: tokenResult.access_token,
+		refreshToken: tokenResult.refresh_token,
+		idToken: tokenResult.id_token,
+		expiresAt,
+		issuer: getStringClaim(claims, ["iss"]),
+		sid: getStringClaim(claims, ["sid"]),
+		sessionState: typeof sessionState === "string" ? sessionState : void 0,
+		clientId: getAuthConfig().clientId,
+		user: baseUser,
+		createdAt: now,
+		lastActivity: now
+	};
+}
+const AUTH_ERROR_COOKIE = `${AUTH_ERROR_COOKIE_PREFIX}_auth_error`;
+const AUTH_ERROR_DESC_COOKIE = `${AUTH_ERROR_COOKIE_PREFIX}_auth_error_desc`;
+const OAUTH_STATE_COOKIE = `${AUTH_ERROR_COOKIE_PREFIX}_oauth_state_id`;
+/**
+* Check if there's an auth error in cookies
+* 
+* This should be called by apps (especially those without landing pages like Dashboard)
+* BEFORE starting OAuth flow to prevent redirect loops.
+* 
+* @example
+* ```ts
+* // In dashboard's index route loader
+* const authError = getAuthError(request);
+* if (authError) {
+*   return { authError }; // Show error to user
+* }
+* // No error, proceed with session check
+* const user = await getUser(request);
+* if (!user) {
+*   return login(request);
+* }
+* ```
+*/
+function getAuthError(request) {
+	const cookies = request.headers.get("Cookie");
+	if (!cookies) return null;
+	const errorRegex = new RegExp(`${AUTH_ERROR_COOKIE}=([^;]+)`);
+	const errorMatch = cookies.match(errorRegex);
+	if (!errorMatch) return null;
+	const error = decodeURIComponent(errorMatch[1]);
+	if (!error) return null;
+	const descRegex = new RegExp(`${AUTH_ERROR_DESC_COOKIE}=([^;]+)`);
+	const descMatch = cookies.match(descRegex);
+	const description = descMatch ? decodeURIComponent(descMatch[1]) : void 0;
+	return {
+		error,
+		description
+	};
+}
+/**
+* Clear auth error cookies
+* 
+* Call this after displaying the error to the user
+*/
+function clearAuthErrorHeaders() {
+	const headers = new Headers();
+	headers.append("Set-Cookie", `${AUTH_ERROR_COOKIE}=; Path=/; Max-Age=0`);
+	headers.append("Set-Cookie", `${AUTH_ERROR_DESC_COOKIE}=; Path=/; Max-Age=0`);
+	return headers;
+}
+/**
+* Check if request has auth error (quick check without parsing)
+*/
+function hasAuthError(request) {
+	const cookies = request.headers.get("Cookie");
+	return cookies?.includes(`${AUTH_ERROR_COOKIE}=`) ?? false;
+}
+/**
+* Initiate OAuth login flow
+* 
+* @param request - The incoming request
+* @param returnUrlOrOptions - Either a return URL string or LoginOptions object
+*/
+async function login(request, returnUrlOrOptions) {
+	try {
+		const config = getAuthConfig();
+		const options = typeof returnUrlOrOptions === "string" ? { returnUrl: returnUrlOrOptions } : returnUrlOrOptions || {};
+		const cookies = request.headers.get("Cookie");
+		const hasError = cookies?.includes(`${AUTH_ERROR_COOKIE}=`);
+		if (hasError) {
+			logger.warn("Auth error cookie detected, preventing redirect loop");
+			const headers$1 = new Headers();
+			headers$1.append("Set-Cookie", `${AUTH_ERROR_COOKIE}=; Path=/; Max-Age=0`);
+			const redirectUri = new URL(config.redirectUri);
+			const baseUrl = redirectUri.origin;
+			return createRedirectResponse(baseUrl, { headers: headers$1 });
+		}
+		const oidcConfig = await getOAuthConfig();
+		const codeVerifier = oidc.randomPKCECodeVerifier();
+		const codeChallenge = await oidc.calculatePKCECodeChallenge(codeVerifier);
+		const extraAuthParams = sanitizeExtraAuthorizationParameters(options.extraAuthParams, options);
+		const state = buildAuthorizationState(oidc.randomState(), options.publicStateContext);
+		const nonce = oidc.randomNonce();
+		const oauthState = {
+			state,
+			codeVerifier,
+			nonce,
+			returnUrl: options.returnUrl,
+			kcAction: options.kcAction,
+			createdAt: Date.now()
+		};
+		logger.info("Creating OAuth state", {
+			returnUrl: options.returnUrl,
+			prompt: options.prompt,
+			kcAction: options.kcAction,
+			extraAuthParamKeys: Object.keys(extraAuthParams)
+		});
+		const stateId = await createOAuthState(oauthState);
+		const authorizationParameters = {
+			redirect_uri: config.redirectUri,
+			scope: config.scope,
+			state,
+			nonce,
+			code_challenge: codeChallenge,
+			code_challenge_method: "S256",
+			...extraAuthParams
+		};
+		if (options.prompt) authorizationParameters.prompt = options.prompt;
+		if (options.kcAction) authorizationParameters.kc_action = options.kcAction;
+		const authorizationUrl = oidc.buildAuthorizationUrl(oidcConfig, authorizationParameters);
+		const headers = new Headers();
+		headers.append("Set-Cookie", `${OAUTH_STATE_COOKIE}=${stateId}; Path=/; HttpOnly; SameSite=Lax; Max-Age=600`);
+		logger.info("OIDC authorization flow initiated", {
+			clientId: config.clientId,
+			redirectUri: config.redirectUri,
+			scope: config.scope,
+			authorizationEndpoint: oidcConfig.serverMetadata().authorization_endpoint,
+			stateId,
+			prompt: options.prompt,
+			kcAction: options.kcAction
+		});
+		return createRedirectResponse(authorizationUrl.toString(), { headers });
+	} catch (error) {
+		logger.error("Failed to initiate OAuth login", error instanceof Error ? error : void 0);
+		throw new Error("Login failed");
+	}
+}
+/**
+* Handle OAuth callback
+* 
+* Handles OAuth authorization response including success and error cases.
+* 
+* Error Handling:
+* - `access_denied`: User doesn't have access to this application
+*   - For apps with landing page: Redirect home with error cookie
+*   - For apps without landing page: Redirect home with error cookie (must handle specially)
+* - `login_required`: No active identity session
+*   - Redirect to home to start fresh login
+*/
+async function handleCallback(request) {
+	try {
+		const config = getAuthConfig();
+		const hasLandingPage = getEffectiveHasLandingPage(config);
+		const url = new URL(request.url);
+		const code = url.searchParams.get("code");
+		const state = url.searchParams.get("state");
+		const error = url.searchParams.get("error");
+		const errorDescription = url.searchParams.get("error_description");
+		const kcAction = url.searchParams.get("kc_action");
+		const kcActionStatus = url.searchParams.get("kc_action_status");
+		logger.info("OIDC callback received", {
+			hasCode: !!code,
+			hasState: !!state,
+			error,
+			errorDescription,
+			kcAction,
+			kcActionStatus,
+			clientId: config.clientId,
+			redirectUri: config.redirectUri
+		});
+		if (error) {
+			if (kcActionStatus && state) {
+				const cookies$1 = request.headers.get("Cookie");
+				const oauthStateRegex$1 = new RegExp(`${OAUTH_STATE_COOKIE}=([^;]+)`);
+				const cookieMatch$1 = cookies$1?.match(oauthStateRegex$1);
+				const stateId$1 = cookieMatch$1?.[1];
+				if (stateId$1) {
+					const oauthState$1 = await getOAuthState(stateId$1);
+					const stateAge$1 = oauthState$1 ? Date.now() - oauthState$1.createdAt : Number.POSITIVE_INFINITY;
+					if (oauthState$1 && oauthState$1.state === state && stateAge$1 <= 10 * 60 * 1e3) {
+						await deleteOAuthState(stateId$1);
+						const headers$2 = new Headers();
+						headers$2.append("Set-Cookie", `${OAUTH_STATE_COOKIE}=; Path=/; HttpOnly; SameSite=Lax; Max-Age=0`);
+						const redirectUrl$1 = appendApplicationInitiatedActionResult(oauthState$1.returnUrl || "/", kcAction || oauthState$1.kcAction, kcActionStatus);
+						logger.info("Application initiated action returned with OAuth error", {
+							error,
+							errorDescription,
+							kcAction: kcAction || oauthState$1.kcAction,
+							kcActionStatus
+						});
+						return createRedirectResponse(redirectUrl$1, { headers: headers$2 });
+					}
+				}
+			}
+			logger.error("OAuth callback error", void 0, {
+				error,
+				errorDescription,
+				clientId: config.clientId,
+				applicationType: config.applicationType,
+				hasLandingPage
+			});
+			if (error === "access_denied") {
+				logger.warn("Access denied for this application", { clientId: config.clientId });
+				const headers$2 = await destroyAuthSession(request);
+				headers$2.append("Set-Cookie", `${AUTH_ERROR_COOKIE}=access_denied; Path=/; HttpOnly; SameSite=Lax; Max-Age=300`);
+				headers$2.append("Set-Cookie", `${AUTH_ERROR_DESC_COOKIE}=${encodeURIComponent(errorDescription || "You do not have access to this application.")}; Path=/; SameSite=Lax; Max-Age=300`);
+				const redirectUri$1 = new URL(config.redirectUri);
+				const baseUrl$1 = redirectUri$1.origin;
+				logger.info("Redirecting to /auth/login to show access_denied error", {
+					hasLandingPage,
+					baseUrl: baseUrl$1,
+					configRedirectUri: config.redirectUri
+				});
+				return createRedirectResponse(`${baseUrl$1}/auth/login`, { headers: headers$2 });
+			}
+			if (error === "login_required") {
+				logger.info("Login required, user session may have expired");
+				const headers$2 = await destroyAuthSession(request);
+				const redirectUri$1 = new URL(config.redirectUri);
+				const baseUrl$1 = redirectUri$1.origin;
+				return createRedirectResponse(baseUrl$1, { headers: headers$2 });
+			}
+			const headers$1 = await destroyAuthSession(request);
+			headers$1.append("Set-Cookie", `${AUTH_ERROR_COOKIE}=${encodeURIComponent(error)}; Path=/; HttpOnly; SameSite=Lax; Max-Age=300`);
+			if (errorDescription) headers$1.append("Set-Cookie", `${AUTH_ERROR_DESC_COOKIE}=${encodeURIComponent(errorDescription)}; Path=/; SameSite=Lax; Max-Age=300`);
+			const redirectUri = new URL(config.redirectUri);
+			const baseUrl = redirectUri.origin;
+			return createRedirectResponse(baseUrl, { headers: headers$1 });
+		}
+		const cookies = request.headers.get("Cookie");
+		const oauthStateRegex = new RegExp(`${OAUTH_STATE_COOKIE}=([^;]+)`);
+		const cookieMatch = cookies?.match(oauthStateRegex);
+		const stateId = cookieMatch?.[1];
+		if (!stateId) throw new Error("OAuth state ID not found in cookie");
+		const oauthState = await getOAuthState(stateId);
+		if (!oauthState) throw new Error("No OAuth state found - state may have expired");
+		if (!state) throw new Error("Missing required callback state parameter");
+		if (oauthState.state !== state) throw new Error(`OAuth state mismatch`);
+		const stateAge = Date.now() - oauthState.createdAt;
+		if (stateAge > 10 * 60 * 1e3) throw new Error("OAuth state expired");
+		if (!code) {
+			if (kcActionStatus) {
+				await deleteOAuthState(stateId);
+				const headers$1 = new Headers();
+				headers$1.append("Set-Cookie", `${OAUTH_STATE_COOKIE}=; Path=/; HttpOnly; SameSite=Lax; Max-Age=0`);
+				const redirectUrl$1 = appendApplicationInitiatedActionResult(oauthState.returnUrl || "/", kcAction || oauthState.kcAction, kcActionStatus);
+				logger.info("Application initiated action returned without authorization code", {
+					kcAction: kcAction || oauthState.kcAction,
+					kcActionStatus
+				});
+				return createRedirectResponse(redirectUrl$1, { headers: headers$1 });
+			}
+			throw new Error("Missing required callback code parameter");
+		}
+		logger.info("Initiating token exchange");
+		const oidcConfig = await getOAuthConfig();
+		const tokenResult = await oidc.authorizationCodeGrant(oidcConfig, url, {
+			pkceCodeVerifier: oauthState.codeVerifier,
+			expectedState: oauthState.state,
+			expectedNonce: oauthState.nonce,
+			idTokenExpected: config.scope.split(/\s+/).includes("openid")
+		});
+		logger.info("Token exchange completed successfully");
+		const claims = getClaimsFromTokenResponse(tokenResult);
+		const newSessionData = await createSessionData(tokenResult, claims);
+		const sessionHeaders = await createAuthSession(request, newSessionData);
+		await deleteOAuthState(stateId);
+		const headers = new Headers(sessionHeaders);
+		headers.append("Set-Cookie", `${OAUTH_STATE_COOKIE}=; Path=/; HttpOnly; SameSite=Lax; Max-Age=0`);
+		logger.info("OAuth callback processed successfully");
+		const redirectUrl = appendApplicationInitiatedActionResult(oauthState.returnUrl || "/", kcAction || oauthState.kcAction, kcActionStatus);
+		return createRedirectResponse(redirectUrl, { headers });
+	} catch (error) {
+		logger.error("OAuth callback failed", error instanceof Error ? error : void 0);
+		try {
+			const cookies = request.headers.get("Cookie");
+			const oauthStateRegex = new RegExp(`${OAUTH_STATE_COOKIE}=([^;]+)`);
+			const cookieMatch = cookies?.match(oauthStateRegex);
+			const stateId = cookieMatch?.[1];
+			if (stateId) await deleteOAuthState(stateId);
+		} catch {}
+		await destroyAuthSession(request);
+		throw new Error("Authentication failed");
+	}
+}
+/**
+* Logout user.
+*
+* Default logout follows OIDC RP-Initiated Logout and ends the identity
+* provider session. Automatic/session-expiry cleanup can request
+* `/auth/logout?logout=local` to clear only this app's Redis session without
+* bouncing the browser through the identity provider or revoking SSO tokens.
+*/
+async function logout(request) {
+	try {
+		const config = getAuthConfig();
+		const url = new URL(request.url);
+		const logoutScope = getLogoutScope(url);
+		const returnUrl = sanitizeLogoutReturnUrl(url.searchParams.get("returnUrl"), request);
+		logger.info("Logout initiated", {
+			clientId: config.clientId,
+			logoutScope
+		});
+		const sessionData = await getAuthSession(request);
+		const idToken = sessionData.idToken;
+		if (logoutScope === "local") {
+			const headers$1 = await destroyAuthSession(request);
+			const redirectUrl = returnUrl || "/";
+			const absoluteRedirectUrl = getAbsoluteRedirectUrl(request, redirectUrl);
+			headers$1.append("Set-Cookie", "logout_return_url=; Path=/; HttpOnly; SameSite=Lax; Max-Age=0");
+			logger.info("Local application logout completed", { redirectUrl: absoluteRedirectUrl });
+			return createRedirectResponse(absoluteRedirectUrl, { headers: headers$1 });
+		}
+		const sessionHeaders = new Headers();
+		if (logoutScope === "all" && sessionData.userId) {
+			await revokeAndDestroyAllUserSessionsBestEffort(sessionData.userId);
+			sessionHeaders.append("Set-Cookie", "logout_return_url=; Path=/; HttpOnly; SameSite=Lax; Max-Age=0");
+			const expiredHeaders = await destroyAuthSession(request);
+			expiredHeaders.forEach((value, key) => sessionHeaders.append(key, value));
+		} else {
+			await revokeSessionTokensBestEffort(sessionData);
+			const expiredHeaders = await destroyAuthSession(request);
+			expiredHeaders.forEach((value, key) => sessionHeaders.append(key, value));
+		}
+		const headers = new Headers(sessionHeaders);
+		if (returnUrl) headers.append("Set-Cookie", `logout_return_url=${encodeURIComponent(returnUrl)}; Path=/; HttpOnly; SameSite=Lax; Max-Age=300`);
+		else headers.append("Set-Cookie", "logout_return_url=; Path=/; HttpOnly; SameSite=Lax; Max-Age=0");
+		try {
+			const oidcConfig = await getOAuthConfig();
+			const serverMetadata = oidcConfig.serverMetadata();
+			const logoutParameters = {};
+			const expectedIssuer = serverMetadata.issuer ?? config.authority;
+			if (idToken && canUseIdTokenHint(idToken, expectedIssuer)) logoutParameters.id_token_hint = idToken;
+			else if (idToken) logger.warn("Skipping id_token_hint because the session token issuer does not match the active OIDC provider", {
+				tokenIssuer: getJwtIssuer(idToken),
+				expectedIssuer: normalizeIssuer(expectedIssuer),
+				clientId: config.clientId
+			});
+			if (config.postLogoutRedirectUri) logoutParameters.post_logout_redirect_uri = config.postLogoutRedirectUri;
+			const endSessionUrl = oidc.buildEndSessionUrl(oidcConfig, logoutParameters);
+			logger.info("RP-Initiated Logout redirect created", {
+				endSessionEndpoint: serverMetadata.end_session_endpoint,
+				hasIdTokenHint: Boolean(logoutParameters.id_token_hint)
+			});
+			return createRedirectResponse(endSessionUrl.toString(), { headers });
+		} catch (error) {
+			logger.warn("OIDC end_session endpoint unavailable, falling back to local redirect", { error: getOAuthErrorMessage(error) });
+		}
+		const registeredPath = config.postLogoutRedirectUri || "/";
+		const finalRedirectUrl = getAbsoluteRedirectUrl(request, registeredPath);
+		logger.info("Logout completed", { redirectUrl: finalRedirectUrl });
+		return createRedirectResponse(finalRedirectUrl, { headers });
+	} catch (error) {
+		logger.error("Logout failed", error instanceof Error ? error : void 0);
+		const headers = await destroyAuthSession(request);
+		return createRedirectResponse("/", { headers });
+	}
+}
+/**
+* Handle an OIDC Back-Channel Logout request from Keycloak or another OP.
+*
+* Configure the client Backchannel logout URL to this endpoint. The logout
+* token is signature-verified against the provider JWKS, issuer/audience are
+* checked, and all matching local Redis sessions are destroyed by `sid` first,
+* falling back to `sub` when the OP omits a session id.
+*/
+async function handleBackChannelLogout(request) {
+	if (request.method !== "POST") return Response.json({ error: "method_not_allowed" }, { status: 405 });
+	try {
+		const config = getAuthConfig();
+		const oidcConfig = await getOAuthConfig();
+		const serverMetadata = oidcConfig.serverMetadata();
+		const logoutToken = await getLogoutTokenFromRequest(request);
+		if (!logoutToken) return Response.json({ error: "missing_logout_token" }, { status: 400 });
+		if (!serverMetadata.jwks_uri) throw new Error("OIDC provider does not expose jwks_uri");
+		const { payload } = await jwtVerify(logoutToken, getJwks(serverMetadata.jwks_uri), {
+			issuer: serverMetadata.issuer ?? config.authority,
+			audience: config.clientId,
+			clockTolerance: 60
+		});
+		const claims = validateBackChannelLogoutClaims(payload, config.clientId);
+		const destroyedSessions = await destroyAuthSessionsByIdentitySession({
+			sid: claims.sid,
+			userId: claims.subject
+		});
+		const result = {
+			destroyedSessions,
+			issuer: claims.issuer,
+			subject: claims.subject,
+			sid: claims.sid
+		};
+		logger.info("Back-channel logout processed", { ...result });
+		return Response.json({
+			success: true,
+			...result
+		});
+	} catch (error) {
+		logger.error("Back-channel logout failed", error instanceof Error ? error : void 0);
+		return Response.json({
+			error: "invalid_logout_token",
+			error_description: getOAuthErrorMessage(error)
+		}, { status: 400 });
+	}
+}
+/**
+* Handle OIDC Front-Channel Logout iframe/browser requests.
+*
+* Front-channel logout cannot carry a signed logout token, so this validates the
+* issuer and applies local cleanup only when a `sid` is present.
+*/
+async function handleFrontChannelLogout(request) {
+	try {
+		const config = getAuthConfig();
+		const oidcConfig = await getOAuthConfig();
+		const serverMetadata = oidcConfig.serverMetadata();
+		const url = new URL(request.url);
+		const issuer = url.searchParams.get("iss");
+		const sid = url.searchParams.get("sid");
+		const expectedIssuer = normalizeIssuer(serverMetadata.issuer ?? config.authority);
+		if (!issuer || normalizeIssuer(issuer) !== expectedIssuer) return new Response(null, { status: 204 });
+		const destroyedSessions = sid ? await destroyAuthSessionsBySid(sid) : 0;
+		const result = {
+			destroyedSessions,
+			issuer,
+			sid: sid ?? void 0
+		};
+		logger.info("Front-channel logout processed", { ...result });
+		return new Response(null, {
+			status: 204,
+			headers: { "Cache-Control": "no-store" }
+		});
+	} catch (error) {
+		logger.warn("Front-channel logout ignored", { error: getOAuthErrorMessage(error) });
+		return new Response(null, { status: 204 });
+	}
+}
+/**
+* Get current user from session
+*/
+async function getUser(request) {
+	try {
+		const sessionData = await getAuthSession(request);
+		return sessionData.user || null;
+	} catch (error) {
+		logger.error("Failed to get user", error instanceof Error ? error : void 0);
+		return null;
+	}
+}
+/**
+* Require authenticated user (throws redirect to login if not authenticated)
+*/
+async function requireAuth(request) {
+	const user = await getUser(request);
+	if (!user) {
+		const url = new URL(request.url);
+		const returnUrl = `${url.pathname}${url.search}`;
+		logger.info("No user found, starting OAuth flow", { returnUrl });
+		throw await login(request, returnUrl);
+	}
+	return user;
+}
+/**
+* Get access token from session
+*/
+async function getAccessToken(request) {
+	try {
+		const sessionData = await getAuthSession(request);
+		return sessionData.accessToken || null;
+	} catch (error) {
+		logger.error("Failed to get access token", error instanceof Error ? error : void 0);
+		return null;
+	}
+}
+/**
+* Refresh tokens
+*/
+async function refreshTokens(request, refreshToken) {
+	try {
+		const sessionData = await getAuthSession(request);
+		const tokenToRefresh = refreshToken || sessionData.refreshToken;
+		if (!tokenToRefresh) {
+			logger.warn("No refresh token available");
+			return {
+				success: false,
+				error: "No refresh token available",
+				shouldLogout: true
+			};
+		}
+		logger.info("Initiating token refresh");
+		const oidcConfig = await getOAuthConfig();
+		const refreshResult = await oidc.refreshTokenGrant(oidcConfig, tokenToRefresh);
+		logger.info("Token refresh successful");
+		const newRefreshToken = refreshResult.refresh_token || tokenToRefresh;
+		const expiresAt = refreshResult.expires_in ? Date.now() + refreshResult.expires_in * 1e3 : sessionData.expiresAt;
+		await updateAuthSession(request, {
+			accessToken: refreshResult.access_token,
+			refreshToken: newRefreshToken,
+			idToken: refreshResult.id_token,
+			expiresAt,
+			lastActivity: Date.now()
+		});
+		return {
+			success: true,
+			tokens: {
+				access_token: refreshResult.access_token,
+				refresh_token: newRefreshToken,
+				id_token: refreshResult.id_token,
+				expires_in: refreshResult.expires_in
+			}
+		};
+	} catch (error) {
+		logger.error("Token refresh failed with exception", error instanceof Error ? error : void 0);
+		return {
+			success: false,
+			error: getOAuthErrorMessage(error),
+			shouldLogout: shouldLogoutAfterOAuthError(error)
+		};
+	}
+}
+/**
+* Clear auth server cache (useful for testing)
+*/
+function clearAuthServerCache() {
+	authServerCache = null;
+	jwksCache.clear();
+}
+
+//#endregion
+export { clearAuthErrorHeaders, clearAuthServerCache, configureAuthClaimMapping, createRedirectResponse, extractUserInfo, getAccessToken, getAuthError, getUser, handleBackChannelLogout, handleCallback, handleFrontChannelLogout, hasAuthError, login, logout, refreshTokens, requireAuth, resetAuthClaimMapping };
+//# sourceMappingURL=auth.server-D5oiz9aF.js.map