@eminuckan/spine 0.3.1 → 0.3.3

package/dist/{auth.server-D5oiz9aF.js → server-CqX2yCa4.mjs}

@@ -1,8 +1,7 @@
-import { logger } from "./logging-DviiAkLx.js";
-import { AUTH_ERROR_COOKIE_PREFIX, createAuthSession, createOAuthState, deleteOAuthState, destroyAuthSession, destroyAuthSessionsByIdentitySession, destroyAuthSessionsBySid, destroyAuthSessionsForUser, getAuthSession, getOAuthState, listAuthSessionDataForUser, updateAuthSession } from "./redis-session-storage.server-v2VcpFsQ.js";
+import { logger } from "./logging/index.mjs";
+import { S as updateAuthSession, a as createOAuthState, d as destroyAuthSessionsBySid, f as destroyAuthSessionsForUser, g as getOAuthState, i as createAuthSession, l as destroyAuthSessionsByIdentitySession, o as deleteOAuthState, p as getAuthSession, s as destroyAuthSession, t as AUTH_ERROR_COOKIE_PREFIX, v as listAuthSessionDataForUser } from "./redis-session-storage.server-DGgQcJ9B.mjs";
 import * as oidc from "openid-client";
 import { createRemoteJWKSet, jwtVerify } from "jose";
-
 //#region src/http/response.ts
 /**
 * Create a redirect response without relying on a router/framework helper.
@@ -15,10 +14,9 @@ function createRedirectResponse(location, init = {}) {
 		headers
 	});
 }
-
 //#endregion
 //#region src/auth/authorization-parameters.ts
-const RESERVED_AUTHORIZATION_PARAMETER_NAMES = new Set([
+const RESERVED_AUTHORIZATION_PARAMETER_NAMES = /* @__PURE__ */ new Set([
 	"client_id",
 	"code_challenge",
 	"code_challenge_method",
@@ -31,7 +29,7 @@ const RESERVED_AUTHORIZATION_PARAMETER_NAMES = new Set([
 	"scope",
 	"state"
 ]);
-const DEFAULT_EXTRA_AUTHORIZATION_PARAMETER_NAMES = new Set([
+const DEFAULT_EXTRA_AUTHORIZATION_PARAMETER_NAMES = /* @__PURE__ */ new Set([
 	"acr_values",
 	"kc_idp_hint",
 	"login_hint",
@@ -43,7 +41,7 @@ function isAllowedExtraAuthorizationParameter(key, allowedNames, allowedPrefixes
 }
 function sanitizeExtraAuthorizationParameters(params, options = {}) {
 	if (!params) return {};
-	const allowedNames = new Set([...DEFAULT_EXTRA_AUTHORIZATION_PARAMETER_NAMES, ...(options.extraAuthParamNames ?? []).map((name) => name.trim().toLowerCase()).filter(Boolean)]);
+	const allowedNames = /* @__PURE__ */ new Set([...DEFAULT_EXTRA_AUTHORIZATION_PARAMETER_NAMES, ...(options.extraAuthParamNames ?? []).map((name) => name.trim().toLowerCase()).filter(Boolean)]);
 	const allowedPrefixes = (options.extraAuthParamPrefixes ?? []).map((prefix) => prefix.trim().toLowerCase()).filter(Boolean);
 	const sanitized = {};
 	for (const [key, value] of Object.entries(params)) {
@@ -72,10 +70,19 @@ function buildAuthorizationState(baseState, publicStateContext) {
 	if (!normalizedContext) return baseState;
 	return `${baseState}.${Buffer.from(JSON.stringify(normalizedContext), "utf8").toString("base64url")}`;
 }
-
 //#endregion
 //#region src/auth/auth.server.ts
 /**
+* OpenID Connect Authentication Server Module
+*
+* Handles:
+* - Login flow (PKCE)
+* - Token exchange
+* - Token refresh
+* - Logout
+* - Session management
+*/
+/**
 * Get effective hasLandingPage setting based on config
 */
 function getEffectiveHasLandingPage(config) {
@@ -119,8 +126,7 @@ function createAuthConfig() {
 	};
 }
 function parseOidcClientAuthMethod(value, fallback) {
-	const normalized = value?.trim().toLowerCase();
-	switch (normalized) {
+	switch (value?.trim().toLowerCase()) {
 		case void 0:
 		case "": return fallback;
 		case "none": return "none";
@@ -137,8 +143,8 @@ function getAuthConfig() {
 	return OIDC_CONFIG;
 }
 let authServerCache = null;
-const CACHE_TTL = 60 * 60 * 1e3;
-const jwksCache = new Map();
+const CACHE_TTL = 3600 * 1e3;
+const jwksCache = /* @__PURE__ */ new Map();
 function normalizeIssuer(value) {
 	const normalized = value?.trim().replace(/\/+$/, "");
 	return normalized && normalized.length > 0 ? normalized : null;
@@ -188,10 +194,16 @@ function appendApplicationInitiatedActionResult(returnUrl, action, status) {
 		const params = new URLSearchParams();
 		if (action) params.set("kc_action", action);
 		if (status) params.set("kc_action_status", status);
-		const separator = returnUrl.includes("?") ? "&" : "?";
-		return `${returnUrl}${separator}${params.toString()}`;
+		return `${returnUrl}${returnUrl.includes("?") ? "&" : "?"}${params.toString()}`;
 	}
 }
+function createAuthorizationResponseUrl(requestUrl, redirectUri) {
+	const incomingUrl = new URL(requestUrl);
+	const authorizationResponseUrl = new URL(redirectUri);
+	authorizationResponseUrl.search = incomingUrl.search;
+	authorizationResponseUrl.hash = "";
+	return authorizationResponseUrl;
+}
 function isAuthLoopPath(path) {
 	const normalized = path.split("#")[0].split("?")[0].replace(/\/+$/, "") || "/";
 	return normalized === "/auth/logout" || normalized === "/auth/callback";
@@ -215,8 +227,7 @@ function shouldAllowInsecureOidcRequests(authority) {
 	return isLocalInsecureIssuer(authority);
 }
 function getDiscoveryOptions() {
-	const config = getAuthConfig();
-	return shouldAllowInsecureOidcRequests(config.authority) ? {
+	return shouldAllowInsecureOidcRequests(getAuthConfig().authority) ? {
 		algorithm: "oidc",
 		execute: [oidc.allowInsecureRequests]
 	} : { algorithm: "oidc" };
@@ -232,7 +243,6 @@ function getClientAuthentication(config) {
 		case "client_secret_post":
 			if (!config.clientSecret) throw new Error("OIDC_CLIENT_SECRET is required for client_secret_post authentication");
 			return oidc.ClientSecretPost(config.clientSecret);
-		case "none":
 		default: return oidc.None();
 	}
 }
@@ -247,8 +257,7 @@ function shouldLogoutAfterOAuthError(error) {
 	return message.includes("invalid_grant") || message.includes("invalid_token") || message.includes("unauthorized");
 }
 function getLogoutScope(url) {
-	const requestedScope = url.searchParams.get("logout") ?? url.searchParams.get("logout_scope") ?? url.searchParams.get("scope");
-	const normalized = requestedScope?.trim().toLowerCase();
+	const normalized = (url.searchParams.get("logout") ?? url.searchParams.get("logout_scope") ?? url.searchParams.get("scope"))?.trim().toLowerCase();
 	if (normalized === "local" || normalized === "application" || normalized === "app" || normalized === "current-device") return "local";
 	if (normalized === "all" || normalized === "all-local" || normalized === "all-devices" || normalized === "everywhere") return "all";
 	if (url.searchParams.get("local_only") === "true" || url.searchParams.get("client_id_only") === "true") return "local";
@@ -332,23 +341,19 @@ function getJwks(jwksUri) {
 	return jwks;
 }
 async function getLogoutTokenFromRequest(request) {
-	const contentType = request.headers.get("content-type") ?? "";
-	if (contentType.includes("application/json")) {
+	if ((request.headers.get("content-type") ?? "").includes("application/json")) {
 		const body = await request.json().catch(() => null);
 		return typeof body?.logout_token === "string" ? body.logout_token : null;
 	}
-	const formData = await request.formData().catch(() => null);
-	const logoutToken = formData?.get("logout_token");
+	const logoutToken = (await request.formData().catch(() => null))?.get("logout_token");
 	return typeof logoutToken === "string" ? logoutToken : null;
 }
 function validateBackChannelLogoutClaims(payload, clientId) {
 	const events = payload.events;
-	const hasBackChannelEvent = events && typeof events === "object" && !Array.isArray(events) && "http://schemas.openid.net/event/backchannel-logout" in events;
-	if (!hasBackChannelEvent) throw new Error("Invalid back-channel logout token: missing back-channel logout event");
+	if (!(events && typeof events === "object" && !Array.isArray(events) && "http://schemas.openid.net/event/backchannel-logout" in events)) throw new Error("Invalid back-channel logout token: missing back-channel logout event");
 	if ("nonce" in payload) throw new Error("Invalid back-channel logout token: nonce is not allowed");
 	const audience = payload.aud;
-	const hasClientAudience = Array.isArray(audience) ? audience.includes(clientId) : audience === clientId;
-	if (!hasClientAudience) throw new Error("Invalid back-channel logout token: audience mismatch");
+	if (!(Array.isArray(audience) ? audience.includes(clientId) : audience === clientId)) throw new Error("Invalid back-channel logout token: audience mismatch");
 	const subject = typeof payload.sub === "string" ? payload.sub : void 0;
 	const sid = typeof payload.sid === "string" ? payload.sid : void 0;
 	if (!subject && !sid) throw new Error("Invalid back-channel logout token: subject or sid is required");
@@ -430,7 +435,6 @@ function getStringClaim(claims, claimKeys) {
 		return trimmed.length > 0 ? trimmed : void 0;
 	}
 	if (typeof value === "number" || typeof value === "boolean") return `${value}`;
-	return void 0;
 }
 function getNumberClaim(claims, claimKeys) {
 	const { value } = getFirstClaimValue(claims, claimKeys);
@@ -439,7 +443,6 @@ function getNumberClaim(claims, claimKeys) {
 		const parsed = Number(value);
 		return Number.isFinite(parsed) ? parsed : void 0;
 	}
-	return void 0;
 }
 function getBooleanClaim(claims, claimKeys, defaultValue = false) {
 	const { value } = getFirstClaimValue(claims, claimKeys);
@@ -577,10 +580,9 @@ function getAuthError(request) {
 	if (!error) return null;
 	const descRegex = new RegExp(`${AUTH_ERROR_DESC_COOKIE}=([^;]+)`);
 	const descMatch = cookies.match(descRegex);
-	const description = descMatch ? decodeURIComponent(descMatch[1]) : void 0;
 	return {
 		error,
-		description
+		description: descMatch ? decodeURIComponent(descMatch[1]) : void 0
 	};
 }
 /**
@@ -598,8 +600,7 @@ function clearAuthErrorHeaders() {
 * Check if request has auth error (quick check without parsing)
 */
 function hasAuthError(request) {
-	const cookies = request.headers.get("Cookie");
-	return cookies?.includes(`${AUTH_ERROR_COOKIE}=`) ?? false;
+	return request.headers.get("Cookie")?.includes(`${AUTH_ERROR_COOKIE}=`) ?? false;
 }
 /**
 * Initiate OAuth login flow
@@ -611,15 +612,12 @@ async function login(request, returnUrlOrOptions) {
 	try {
 		const config = getAuthConfig();
 		const options = typeof returnUrlOrOptions === "string" ? { returnUrl: returnUrlOrOptions } : returnUrlOrOptions || {};
-		const cookies = request.headers.get("Cookie");
-		const hasError = cookies?.includes(`${AUTH_ERROR_COOKIE}=`);
-		if (hasError) {
+		if (request.headers.get("Cookie")?.includes(`${AUTH_ERROR_COOKIE}=`)) {
 			logger.warn("Auth error cookie detected, preventing redirect loop");
-			const headers$1 = new Headers();
-			headers$1.append("Set-Cookie", `${AUTH_ERROR_COOKIE}=; Path=/; Max-Age=0`);
-			const redirectUri = new URL(config.redirectUri);
-			const baseUrl = redirectUri.origin;
-			return createRedirectResponse(baseUrl, { headers: headers$1 });
+			const headers = new Headers();
+			headers.append("Set-Cookie", `${AUTH_ERROR_COOKIE}=; Path=/; Max-Age=0`);
+			const baseUrl = new URL(config.redirectUri).origin;
+			return createRedirectResponse(baseUrl, { headers });
 		}
 		const oidcConfig = await getOAuthConfig();
 		const codeVerifier = oidc.randomPKCECodeVerifier();
@@ -706,25 +704,24 @@ async function handleCallback(request) {
 		});
 		if (error) {
 			if (kcActionStatus && state) {
-				const cookies$1 = request.headers.get("Cookie");
-				const oauthStateRegex$1 = new RegExp(`${OAUTH_STATE_COOKIE}=([^;]+)`);
-				const cookieMatch$1 = cookies$1?.match(oauthStateRegex$1);
-				const stateId$1 = cookieMatch$1?.[1];
-				if (stateId$1) {
-					const oauthState$1 = await getOAuthState(stateId$1);
-					const stateAge$1 = oauthState$1 ? Date.now() - oauthState$1.createdAt : Number.POSITIVE_INFINITY;
-					if (oauthState$1 && oauthState$1.state === state && stateAge$1 <= 10 * 60 * 1e3) {
-						await deleteOAuthState(stateId$1);
-						const headers$2 = new Headers();
-						headers$2.append("Set-Cookie", `${OAUTH_STATE_COOKIE}=; Path=/; HttpOnly; SameSite=Lax; Max-Age=0`);
-						const redirectUrl$1 = appendApplicationInitiatedActionResult(oauthState$1.returnUrl || "/", kcAction || oauthState$1.kcAction, kcActionStatus);
+				const cookies = request.headers.get("Cookie");
+				const oauthStateRegex = new RegExp(`${OAUTH_STATE_COOKIE}=([^;]+)`);
+				const stateId = (cookies?.match(oauthStateRegex))?.[1];
+				if (stateId) {
+					const oauthState = await getOAuthState(stateId);
+					const stateAge = oauthState ? Date.now() - oauthState.createdAt : Number.POSITIVE_INFINITY;
+					if (oauthState && oauthState.state === state && stateAge <= 600 * 1e3) {
+						await deleteOAuthState(stateId);
+						const headers = new Headers();
+						headers.append("Set-Cookie", `${OAUTH_STATE_COOKIE}=; Path=/; HttpOnly; SameSite=Lax; Max-Age=0`);
+						const redirectUrl = appendApplicationInitiatedActionResult(oauthState.returnUrl || "/", kcAction || oauthState.kcAction, kcActionStatus);
 						logger.info("Application initiated action returned with OAuth error", {
 							error,
 							errorDescription,
-							kcAction: kcAction || oauthState$1.kcAction,
+							kcAction: kcAction || oauthState.kcAction,
 							kcActionStatus
 						});
-						return createRedirectResponse(redirectUrl$1, { headers: headers$2 });
+						return createRedirectResponse(redirectUrl, { headers });
 					}
 				}
 			}
@@ -737,82 +734,74 @@ async function handleCallback(request) {
 			});
 			if (error === "access_denied") {
 				logger.warn("Access denied for this application", { clientId: config.clientId });
-				const headers$2 = await destroyAuthSession(request);
-				headers$2.append("Set-Cookie", `${AUTH_ERROR_COOKIE}=access_denied; Path=/; HttpOnly; SameSite=Lax; Max-Age=300`);
-				headers$2.append("Set-Cookie", `${AUTH_ERROR_DESC_COOKIE}=${encodeURIComponent(errorDescription || "You do not have access to this application.")}; Path=/; SameSite=Lax; Max-Age=300`);
-				const redirectUri$1 = new URL(config.redirectUri);
-				const baseUrl$1 = redirectUri$1.origin;
+				const headers = await destroyAuthSession(request);
+				headers.append("Set-Cookie", `${AUTH_ERROR_COOKIE}=access_denied; Path=/; HttpOnly; SameSite=Lax; Max-Age=300`);
+				headers.append("Set-Cookie", `${AUTH_ERROR_DESC_COOKIE}=${encodeURIComponent(errorDescription || "You do not have access to this application.")}; Path=/; SameSite=Lax; Max-Age=300`);
+				const baseUrl = new URL(config.redirectUri).origin;
 				logger.info("Redirecting to /auth/login to show access_denied error", {
 					hasLandingPage,
-					baseUrl: baseUrl$1,
+					baseUrl,
 					configRedirectUri: config.redirectUri
 				});
-				return createRedirectResponse(`${baseUrl$1}/auth/login`, { headers: headers$2 });
+				return createRedirectResponse(`${baseUrl}/auth/login`, { headers });
 			}
 			if (error === "login_required") {
 				logger.info("Login required, user session may have expired");
-				const headers$2 = await destroyAuthSession(request);
-				const redirectUri$1 = new URL(config.redirectUri);
-				const baseUrl$1 = redirectUri$1.origin;
-				return createRedirectResponse(baseUrl$1, { headers: headers$2 });
+				const headers = await destroyAuthSession(request);
+				const baseUrl = new URL(config.redirectUri).origin;
+				return createRedirectResponse(baseUrl, { headers });
 			}
-			const headers$1 = await destroyAuthSession(request);
-			headers$1.append("Set-Cookie", `${AUTH_ERROR_COOKIE}=${encodeURIComponent(error)}; Path=/; HttpOnly; SameSite=Lax; Max-Age=300`);
-			if (errorDescription) headers$1.append("Set-Cookie", `${AUTH_ERROR_DESC_COOKIE}=${encodeURIComponent(errorDescription)}; Path=/; SameSite=Lax; Max-Age=300`);
-			const redirectUri = new URL(config.redirectUri);
-			const baseUrl = redirectUri.origin;
-			return createRedirectResponse(baseUrl, { headers: headers$1 });
+			const headers = await destroyAuthSession(request);
+			headers.append("Set-Cookie", `${AUTH_ERROR_COOKIE}=${encodeURIComponent(error)}; Path=/; HttpOnly; SameSite=Lax; Max-Age=300`);
+			if (errorDescription) headers.append("Set-Cookie", `${AUTH_ERROR_DESC_COOKIE}=${encodeURIComponent(errorDescription)}; Path=/; SameSite=Lax; Max-Age=300`);
+			const baseUrl = new URL(config.redirectUri).origin;
+			return createRedirectResponse(baseUrl, { headers });
 		}
 		const cookies = request.headers.get("Cookie");
 		const oauthStateRegex = new RegExp(`${OAUTH_STATE_COOKIE}=([^;]+)`);
-		const cookieMatch = cookies?.match(oauthStateRegex);
-		const stateId = cookieMatch?.[1];
+		const stateId = (cookies?.match(oauthStateRegex))?.[1];
 		if (!stateId) throw new Error("OAuth state ID not found in cookie");
 		const oauthState = await getOAuthState(stateId);
 		if (!oauthState) throw new Error("No OAuth state found - state may have expired");
 		if (!state) throw new Error("Missing required callback state parameter");
 		if (oauthState.state !== state) throw new Error(`OAuth state mismatch`);
-		const stateAge = Date.now() - oauthState.createdAt;
-		if (stateAge > 10 * 60 * 1e3) throw new Error("OAuth state expired");
+		if (Date.now() - oauthState.createdAt > 600 * 1e3) throw new Error("OAuth state expired");
 		if (!code) {
 			if (kcActionStatus) {
 				await deleteOAuthState(stateId);
-				const headers$1 = new Headers();
-				headers$1.append("Set-Cookie", `${OAUTH_STATE_COOKIE}=; Path=/; HttpOnly; SameSite=Lax; Max-Age=0`);
-				const redirectUrl$1 = appendApplicationInitiatedActionResult(oauthState.returnUrl || "/", kcAction || oauthState.kcAction, kcActionStatus);
+				const headers = new Headers();
+				headers.append("Set-Cookie", `${OAUTH_STATE_COOKIE}=; Path=/; HttpOnly; SameSite=Lax; Max-Age=0`);
+				const redirectUrl = appendApplicationInitiatedActionResult(oauthState.returnUrl || "/", kcAction || oauthState.kcAction, kcActionStatus);
 				logger.info("Application initiated action returned without authorization code", {
 					kcAction: kcAction || oauthState.kcAction,
 					kcActionStatus
 				});
-				return createRedirectResponse(redirectUrl$1, { headers: headers$1 });
+				return createRedirectResponse(redirectUrl, { headers });
 			}
 			throw new Error("Missing required callback code parameter");
 		}
 		logger.info("Initiating token exchange");
 		const oidcConfig = await getOAuthConfig();
-		const tokenResult = await oidc.authorizationCodeGrant(oidcConfig, url, {
+		const authorizationResponseUrl = createAuthorizationResponseUrl(request.url, config.redirectUri);
+		const tokenResult = await oidc.authorizationCodeGrant(oidcConfig, authorizationResponseUrl, {
 			pkceCodeVerifier: oauthState.codeVerifier,
 			expectedState: oauthState.state,
 			expectedNonce: oauthState.nonce,
 			idTokenExpected: config.scope.split(/\s+/).includes("openid")
 		});
 		logger.info("Token exchange completed successfully");
-		const claims = getClaimsFromTokenResponse(tokenResult);
-		const newSessionData = await createSessionData(tokenResult, claims);
-		const sessionHeaders = await createAuthSession(request, newSessionData);
+		const sessionHeaders = await createAuthSession(request, await createSessionData(tokenResult, getClaimsFromTokenResponse(tokenResult)));
 		await deleteOAuthState(stateId);
 		const headers = new Headers(sessionHeaders);
 		headers.append("Set-Cookie", `${OAUTH_STATE_COOKIE}=; Path=/; HttpOnly; SameSite=Lax; Max-Age=0`);
 		logger.info("OAuth callback processed successfully");
-		const redirectUrl = appendApplicationInitiatedActionResult(oauthState.returnUrl || "/", kcAction || oauthState.kcAction, kcActionStatus);
-		return createRedirectResponse(redirectUrl, { headers });
+		return createRedirectResponse(appendApplicationInitiatedActionResult(oauthState.returnUrl || "/", kcAction || oauthState.kcAction, kcActionStatus), { headers });
 	} catch (error) {
 		logger.error("OAuth callback failed", error instanceof Error ? error : void 0);
 		try {
 			const cookies = request.headers.get("Cookie");
 			const oauthStateRegex = new RegExp(`${OAUTH_STATE_COOKIE}=([^;]+)`);
-			const cookieMatch = cookies?.match(oauthStateRegex);
-			const stateId = cookieMatch?.[1];
+			const stateId = (cookies?.match(oauthStateRegex))?.[1];
 			if (stateId) await deleteOAuthState(stateId);
 		} catch {}
 		await destroyAuthSession(request);
@@ -840,23 +829,20 @@ async function logout(request) {
 		const sessionData = await getAuthSession(request);
 		const idToken = sessionData.idToken;
 		if (logoutScope === "local") {
-			const headers$1 = await destroyAuthSession(request);
-			const redirectUrl = returnUrl || "/";
-			const absoluteRedirectUrl = getAbsoluteRedirectUrl(request, redirectUrl);
-			headers$1.append("Set-Cookie", "logout_return_url=; Path=/; HttpOnly; SameSite=Lax; Max-Age=0");
+			const headers = await destroyAuthSession(request);
+			const absoluteRedirectUrl = getAbsoluteRedirectUrl(request, returnUrl || "/");
+			headers.append("Set-Cookie", "logout_return_url=; Path=/; HttpOnly; SameSite=Lax; Max-Age=0");
 			logger.info("Local application logout completed", { redirectUrl: absoluteRedirectUrl });
-			return createRedirectResponse(absoluteRedirectUrl, { headers: headers$1 });
+			return createRedirectResponse(absoluteRedirectUrl, { headers });
 		}
 		const sessionHeaders = new Headers();
 		if (logoutScope === "all" && sessionData.userId) {
 			await revokeAndDestroyAllUserSessionsBestEffort(sessionData.userId);
 			sessionHeaders.append("Set-Cookie", "logout_return_url=; Path=/; HttpOnly; SameSite=Lax; Max-Age=0");
-			const expiredHeaders = await destroyAuthSession(request);
-			expiredHeaders.forEach((value, key) => sessionHeaders.append(key, value));
+			(await destroyAuthSession(request)).forEach((value, key) => sessionHeaders.append(key, value));
 		} else {
 			await revokeSessionTokensBestEffort(sessionData);
-			const expiredHeaders = await destroyAuthSession(request);
-			expiredHeaders.forEach((value, key) => sessionHeaders.append(key, value));
+			(await destroyAuthSession(request)).forEach((value, key) => sessionHeaders.append(key, value));
 		}
 		const headers = new Headers(sessionHeaders);
 		if (returnUrl) headers.append("Set-Cookie", `logout_return_url=${encodeURIComponent(returnUrl)}; Path=/; HttpOnly; SameSite=Lax; Max-Age=300`);
@@ -882,14 +868,12 @@ async function logout(request) {
 		} catch (error) {
 			logger.warn("OIDC end_session endpoint unavailable, falling back to local redirect", { error: getOAuthErrorMessage(error) });
 		}
-		const registeredPath = config.postLogoutRedirectUri || "/";
-		const finalRedirectUrl = getAbsoluteRedirectUrl(request, registeredPath);
+		const finalRedirectUrl = getAbsoluteRedirectUrl(request, config.postLogoutRedirectUri || "/");
 		logger.info("Logout completed", { redirectUrl: finalRedirectUrl });
 		return createRedirectResponse(finalRedirectUrl, { headers });
 	} catch (error) {
 		logger.error("Logout failed", error instanceof Error ? error : void 0);
-		const headers = await destroyAuthSession(request);
-		return createRedirectResponse("/", { headers });
+		return createRedirectResponse("/", { headers: await destroyAuthSession(request) });
 	}
 }
 /**
@@ -904,8 +888,7 @@ async function handleBackChannelLogout(request) {
 	if (request.method !== "POST") return Response.json({ error: "method_not_allowed" }, { status: 405 });
 	try {
 		const config = getAuthConfig();
-		const oidcConfig = await getOAuthConfig();
-		const serverMetadata = oidcConfig.serverMetadata();
+		const serverMetadata = (await getOAuthConfig()).serverMetadata();
 		const logoutToken = await getLogoutTokenFromRequest(request);
 		if (!logoutToken) return Response.json({ error: "missing_logout_token" }, { status: 400 });
 		if (!serverMetadata.jwks_uri) throw new Error("OIDC provider does not expose jwks_uri");
@@ -915,12 +898,11 @@ async function handleBackChannelLogout(request) {
 			clockTolerance: 60
 		});
 		const claims = validateBackChannelLogoutClaims(payload, config.clientId);
-		const destroyedSessions = await destroyAuthSessionsByIdentitySession({
-			sid: claims.sid,
-			userId: claims.subject
-		});
 		const result = {
-			destroyedSessions,
+			destroyedSessions: await destroyAuthSessionsByIdentitySession({
+				sid: claims.sid,
+				userId: claims.subject
+			}),
 			issuer: claims.issuer,
 			subject: claims.subject,
 			sid: claims.sid
@@ -947,16 +929,14 @@ async function handleBackChannelLogout(request) {
 async function handleFrontChannelLogout(request) {
 	try {
 		const config = getAuthConfig();
-		const oidcConfig = await getOAuthConfig();
-		const serverMetadata = oidcConfig.serverMetadata();
+		const serverMetadata = (await getOAuthConfig()).serverMetadata();
 		const url = new URL(request.url);
 		const issuer = url.searchParams.get("iss");
 		const sid = url.searchParams.get("sid");
 		const expectedIssuer = normalizeIssuer(serverMetadata.issuer ?? config.authority);
 		if (!issuer || normalizeIssuer(issuer) !== expectedIssuer) return new Response(null, { status: 204 });
-		const destroyedSessions = sid ? await destroyAuthSessionsBySid(sid) : 0;
 		const result = {
-			destroyedSessions,
+			destroyedSessions: sid ? await destroyAuthSessionsBySid(sid) : 0,
 			issuer,
 			sid: sid ?? void 0
 		};
@@ -975,8 +955,7 @@ async function handleFrontChannelLogout(request) {
 */
 async function getUser(request) {
 	try {
-		const sessionData = await getAuthSession(request);
-		return sessionData.user || null;
+		return (await getAuthSession(request)).user || null;
 	} catch (error) {
 		logger.error("Failed to get user", error instanceof Error ? error : void 0);
 		return null;
@@ -1000,8 +979,7 @@ async function requireAuth(request) {
 */
 async function getAccessToken(request) {
 	try {
-		const sessionData = await getAuthSession(request);
-		return sessionData.accessToken || null;
+		return (await getAuthSession(request)).accessToken || null;
 	} catch (error) {
 		logger.error("Failed to get access token", error instanceof Error ? error : void 0);
 		return null;
@@ -1060,7 +1038,298 @@ function clearAuthServerCache() {
 	authServerCache = null;
 	jwksCache.clear();
 }
-
 //#endregion
-export { clearAuthErrorHeaders, clearAuthServerCache, configureAuthClaimMapping, createRedirectResponse, extractUserInfo, getAccessToken, getAuthError, getUser, handleBackChannelLogout, handleCallback, handleFrontChannelLogout, hasAuthError, login, logout, refreshTokens, requireAuth, resetAuthClaimMapping };
-//# sourceMappingURL=auth.server-D5oiz9aF.js.map
+//#region src/auth/route-protection.server.ts
+/**
+* Route Protection Server Module
+* 
+* Provides route protection utilities for different authentication levels.
+*/
+const REFRESH_THRESHOLD = resolveRefreshThreshold();
+function resolveRefreshThreshold() {
+	const configured = Number(process.env.OIDC_REFRESH_THRESHOLD_MS);
+	return Number.isFinite(configured) && configured > 0 ? configured : 6e4;
+}
+/**
+* Check if token needs refresh
+*/
+async function shouldRefreshToken(request) {
+	try {
+		const sessionData = await getAuthSession(request);
+		if (!sessionData.refreshToken || sessionData.refreshToken.length === 0) {
+			if (sessionData.expiresAt && Date.now() >= sessionData.expiresAt) {
+				logger.info("Token expired and no refresh token, forcing local application logout");
+				throw await logout(await createAutomaticLogoutRequest(request, "expired-no-refresh-token"));
+			}
+			return false;
+		}
+		if (!sessionData.expiresAt || !sessionData.accessToken) return false;
+		const now = Date.now();
+		let jwtExpiry = null;
+		try {
+			const tokenParts = sessionData.accessToken.split(".");
+			if (tokenParts.length === 3) {
+				const payload = JSON.parse(Buffer.from(tokenParts[1], "base64").toString());
+				if (payload.exp) jwtExpiry = payload.exp * 1e3;
+			}
+		} catch {}
+		return (jwtExpiry && jwtExpiry < sessionData.expiresAt ? jwtExpiry : sessionData.expiresAt) - now <= REFRESH_THRESHOLD;
+	} catch (error) {
+		logger.error("Error checking token refresh", error instanceof Error ? error : void 0);
+		return false;
+	}
+}
+/**
+* Auto-refresh tokens if needed
+*/
+async function autoRefreshTokens(request) {
+	try {
+		if (await shouldRefreshToken(request)) {
+			logger.info("Auto-refreshing tokens due to expiry");
+			const result = await refreshTokens(request);
+			if (result.success) logger.info("Auto-refresh completed successfully");
+			else {
+				logger.error("Auto-refresh failed", void 0, { error: result.error });
+				if (result.shouldLogout) {
+					logger.error("Refresh token invalid, forcing local application logout");
+					throw await logout(await createAutomaticLogoutRequest(request, "refresh-failed"));
+				}
+			}
+		}
+	} catch (error) {
+		if (error instanceof Response && error.status >= 300 && error.status < 400) throw error;
+		throw error;
+	}
+}
+let protectionConfig = {};
+/**
+* Configure route protection with identity, tenant, and app policy checkers
+*/
+function configureRouteProtection(config) {
+	protectionConfig = config;
+}
+/**
+* Reset route protection to its built-in defaults.
+*/
+function resetRouteProtectionConfig() {
+	protectionConfig = {};
+}
+function createRedirectFromConfig(redirect) {
+	return createRedirectResponse(redirect.location, {
+		headers: redirect.headers,
+		status: redirect.status
+	});
+}
+function getLoginReturnUrl(request, currentPath, protection) {
+	if (protectionConfig.getLoginReturnUrl) return protectionConfig.getLoginReturnUrl({
+		request,
+		currentPath,
+		protection
+	});
+	switch (protection) {
+		default: {
+			const url = new URL(request.url);
+			return url.pathname === "/" ? "/" : `${url.pathname}${url.search}`;
+		}
+	}
+}
+async function createAutomaticLogoutRequest(request, reason) {
+	if (protectionConfig.createAutomaticLogoutRequest) return protectionConfig.createAutomaticLogoutRequest({
+		request,
+		reason
+	});
+	const logoutUrl = new URL(request.url);
+	logoutUrl.pathname = "/auth/logout";
+	logoutUrl.searchParams.set("logout", "local");
+	return new Request(logoutUrl.toString(), { headers: request.headers });
+}
+function createRouteResolverContext(request, user, currentPath, protection) {
+	let identityContextPromise = null;
+	let currentTenantPromise = null;
+	let initializeTenantPromise = null;
+	return {
+		request,
+		user,
+		currentPath,
+		protection,
+		getIdentityContext: async (forceRefresh = false) => {
+			if (!protectionConfig.identityChecker) return null;
+			if (forceRefresh) return protectionConfig.identityChecker.getIdentityContext(request, user.sub, true);
+			if (!identityContextPromise) identityContextPromise = protectionConfig.identityChecker.getIdentityContext(request, user.sub);
+			return identityContextPromise;
+		},
+		getCurrentTenant: async () => {
+			if (!protectionConfig.tenantChecker) return null;
+			if (!currentTenantPromise) currentTenantPromise = protectionConfig.tenantChecker.getCurrentTenant(request);
+			return currentTenantPromise;
+		},
+		initializeTenant: async () => {
+			if (!protectionConfig.tenantChecker) return null;
+			if (!initializeTenantPromise) initializeTenantPromise = protectionConfig.tenantChecker.initializeTenant(request);
+			return initializeTenantPromise;
+		}
+	};
+}
+async function applyConfiguredRouteResolution(request, user, currentPath, protection) {
+	if (!protectionConfig.resolveRoute) return false;
+	const context = createRouteResolverContext(request, user, currentPath, protection);
+	try {
+		const result = await protectionConfig.resolveRoute(context);
+		if (result) throw createRedirectFromConfig(result);
+		return true;
+	} catch (error) {
+		if (error instanceof Response && error.status >= 300 && error.status < 400) throw error;
+		if (!protectionConfig.handleRouteError) throw error;
+		const recovery = await protectionConfig.handleRouteError({
+			...context,
+			error
+		});
+		if (recovery) throw createRedirectFromConfig(recovery);
+		throw error;
+	}
+}
+/**
+* Main route protection function
+*/
+async function protectRoute(request, protection, loaderFn) {
+	const url = new URL(request.url);
+	switch (protection) {
+		case "public": try {
+			await autoRefreshTokens(request);
+			return loaderFn(await getUser(request) ?? void 0);
+		} catch {
+			return loaderFn(void 0);
+		}
+		case "auth":
+		case "policy": try {
+			await autoRefreshTokens(request);
+			const user = await requireAuth(request);
+			await applyConfiguredRouteResolution(request, user, url.pathname, protection);
+			return loaderFn(user);
+		} catch (error) {
+			if (error instanceof Response && error.status >= 300 && error.status < 400) throw error;
+			throw await login(request, getLoginReturnUrl(request, url.pathname, protection));
+		}
+		case "onboarding-required": try {
+			await autoRefreshTokens(request);
+			const user = await requireAuth(request);
+			await applyConfiguredRouteResolution(request, user, url.pathname, "onboarding-required");
+			return loaderFn(user);
+		} catch (error) {
+			if (error instanceof Response && error.status >= 300 && error.status < 400) throw error;
+			throw await login(request, getLoginReturnUrl(request, url.pathname, "onboarding-required"));
+		}
+		case "subscription-required": try {
+			await autoRefreshTokens(request);
+			const user = await requireAuth(request);
+			await applyConfiguredRouteResolution(request, user, url.pathname, "subscription-required");
+			if (protectionConfig.tenantChecker) {
+				if (!await protectionConfig.tenantChecker.getCurrentTenant(request)) await protectionConfig.tenantChecker.initializeTenant(request);
+			}
+			return loaderFn(user);
+		} catch (error) {
+			if (error instanceof Response && error.status >= 300 && error.status < 400) throw error;
+			throw await login(request, getLoginReturnUrl(request, url.pathname, "subscription-required"));
+		}
+		default: throw new Error(`Unknown protection level: ${protection}`);
+	}
+}
+/**
+* Public route (optional auth)
+*/
+const publicRoute = (request, loaderFn) => protectRoute(request, "public", loaderFn);
+/**
+* Auth-protected route
+*/
+const authRoute = (request, loaderFn) => protectRoute(request, "auth", loaderFn);
+/**
+* Generic policy-protected route. Apps define policy in configureRouteProtection.
+*/
+const policyRoute = (request, loaderFn) => protectRoute(request, "policy", loaderFn);
+/**
+* Alias for auth-protected routes.
+*/
+const protectedRoute = authRoute;
+/**
+* Setup policy route
+*
+* @deprecated Use policyRoute with configureRouteProtection instead.
+*/
+const onboardingRoute = (request, loaderFn) => protectRoute(request, "onboarding-required", loaderFn);
+/**
+* Entitlement policy route
+*
+* @deprecated Use policyRoute with configureRouteProtection instead.
+*/
+const subscriptionRoute = (request, loaderFn) => protectRoute(request, "subscription-required", loaderFn);
+//#endregion
+//#region src/auth/token-refresh.server.ts
+/**
+* Token Refresh Server Module
+*/
+/**
+* Attempt to refresh the access token
+*/
+async function attemptTokenRefresh(request) {
+	try {
+		logger.info("Attempting token refresh due to 401 response");
+		const sessionData = await getAuthSession(request);
+		if (!sessionData.refreshToken) {
+			logger.warn("No refresh token available in session");
+			return {
+				success: false,
+				error: "No refresh token available",
+				shouldLogout: true
+			};
+		}
+		const refreshResult = await refreshTokens(request, sessionData.refreshToken);
+		if (!refreshResult.success) {
+			logger.error("Token refresh failed", void 0, {
+				error: refreshResult.error,
+				shouldLogout: refreshResult.shouldLogout
+			});
+			return {
+				success: false,
+				error: refreshResult.error,
+				shouldLogout: refreshResult.shouldLogout
+			};
+		}
+		const tokens = refreshResult.tokens;
+		if (!tokens || !tokens.access_token) {
+			logger.error("Token refresh succeeded but no access token returned");
+			return {
+				success: false,
+				error: "No access token in refresh response",
+				shouldLogout: true
+			};
+		}
+		logger.info("Token refresh successful");
+		return {
+			success: true,
+			newAccessToken: tokens.access_token
+		};
+	} catch (error) {
+		logger.error("Token refresh attempt failed", error instanceof Error ? error : void 0);
+		return {
+			success: false,
+			error: error instanceof Error ? error.message : "Unknown error",
+			shouldLogout: true
+		};
+	}
+}
+/**
+* Check if a response indicates token expiration
+*/
+function isTokenExpiredResponse(response) {
+	return response.status === 401;
+}
+/**
+* Check if token refresh should be attempted
+*/
+function shouldAttemptTokenRefresh(response, hasAuth) {
+	return hasAuth && isTokenExpiredResponse(response);
+}
+//#endregion
+export { resetAuthClaimMapping as A, handleCallback as C, logout as D, login as E, refreshTokens as O, handleBackChannelLogout as S, hasAuthError as T, createAuthorizationResponseUrl as _, configureRouteProtection as a, getAuthError as b, protectRoute as c, resetRouteProtectionConfig as d, shouldRefreshToken as f, configureAuthClaimMapping as g, clearAuthServerCache as h, authRoute as i, requireAuth as k, protectedRoute as l, clearAuthErrorHeaders as m, isTokenExpiredResponse as n, onboardingRoute as o, subscriptionRoute as p, shouldAttemptTokenRefresh as r, policyRoute as s, attemptTokenRefresh as t, publicRoute as u, extractUserInfo as v, handleFrontChannelLogout as w, getUser as x, getAccessToken as y };
+
+//# sourceMappingURL=server-CqX2yCa4.mjs.map