@enterprisestandard/react 0.0.5-beta.20260115.1 → 0.0.5-beta.20260115.2

package/dist/sso.js

@@ -0,0 +1,820 @@
+import { idTokenClaimsSchema, oidcCallbackSchema, tokenResponseSchema } from './types/oidc-schema';
+import { must } from './utils';
+const jwksCache = new Map();
+export function sso(config) {
+    let configWithDefaults;
+    const handlerDefaults = {
+        loginUrl: config?.loginUrl,
+        userUrl: config?.userUrl,
+        errorUrl: config?.errorUrl,
+        landingUrl: config?.landingUrl,
+        tokenUrl: config?.tokenUrl,
+        refreshUrl: config?.refreshUrl,
+        jwksUrl: config?.jwksUrl,
+        logoutUrl: config?.logoutUrl,
+        logoutBackChannelUrl: config?.logoutBackChannelUrl,
+        validation: config?.validation,
+    };
+    configWithDefaults = !config
+        ? undefined
+        : {
+            ...config,
+            authority: must(config.authority, "Missing 'authority' from SSO Config"),
+            token_url: must(config.token_url, "Missing 'token_url' from SSO Config"),
+            authorization_url: must(config.authorization_url, "Missing 'authorization_url' from SSO Config"),
+            client_id: must(config.client_id, "Missing 'client_id' from SSO Config"),
+            redirect_uri: must(config.redirect_uri, "Missing 'redirect_uri' from SSO Config"),
+            scope: must(config.scope, "Missing 'scope' from SSO Config"),
+            response_type: config.response_type ?? 'code',
+            cookies_secure: config.cookies_secure !== undefined ? config.cookies_secure : true,
+            cookies_same_site: config.cookies_same_site !== undefined ? config.cookies_same_site : 'Strict',
+            cookies_prefix: config.cookies_prefix ?? `es.sso.${config.client_id}`,
+            cookies_path: config.cookies_path ?? '/',
+        };
+    async function getUser(request) {
+        if (!configWithDefaults) {
+            throw new Error('Enterprise Standard SSO Manager not initialized');
+        }
+        try {
+            const { tokens } = await getTokenFromCookies(request);
+            if (!tokens)
+                return undefined;
+            return await parseUser(tokens);
+        }
+        catch (error) {
+            console.error('Error parsing user from cookies:', error);
+            return undefined;
+        }
+    }
+    async function getRequiredUser(request) {
+        const user = await getUser(request);
+        if (user)
+            return user;
+        throw new Response('Unauthorized', {
+            status: 401,
+            statusText: 'Unauthorized',
+        });
+    }
+    async function initiateLogin({ landingUrl, errorUrl }, requestUrl) {
+        if (!configWithDefaults) {
+            throw new Error('Enterprise Standard SSO Manager not initialized');
+        }
+        const state = generateRandomString();
+        const codeVerifier = generateRandomString(64);
+        // Normalize redirect_uri - use request URL if available, otherwise use the stored value
+        let normalizedRedirectUri = configWithDefaults.redirect_uri;
+        try {
+            new URL(normalizedRedirectUri);
+        }
+        catch {
+            // If redirect_uri is not a valid URL, try to construct it from request URL
+            if (requestUrl) {
+                try {
+                    const baseUrl = new URL(requestUrl);
+                    const path = normalizedRedirectUri.startsWith('//')
+                        ? normalizedRedirectUri.slice(1)
+                        : normalizedRedirectUri.startsWith('/')
+                            ? normalizedRedirectUri
+                            : `/${normalizedRedirectUri}`;
+                    normalizedRedirectUri = new URL(path, baseUrl.origin).toString();
+                }
+                catch {
+                    // If we can't construct it, use authorization_url's origin as fallback
+                    try {
+                        const authUrl = new URL(configWithDefaults.authorization_url);
+                        const path = normalizedRedirectUri.startsWith('//')
+                            ? normalizedRedirectUri.slice(1)
+                            : normalizedRedirectUri.startsWith('/')
+                                ? normalizedRedirectUri
+                                : `/${normalizedRedirectUri}`;
+                        normalizedRedirectUri = new URL(path, authUrl.origin).toString();
+                    }
+                    catch {
+                        throw new Error(`Invalid redirect_uri: "${configWithDefaults.redirect_uri}". It must be a valid absolute URL.`);
+                    }
+                }
+            }
+        }
+        const url = new URL(configWithDefaults.authorization_url);
+        url.searchParams.append('client_id', configWithDefaults.client_id);
+        url.searchParams.append('redirect_uri', normalizedRedirectUri);
+        url.searchParams.append('response_type', 'code');
+        url.searchParams.append('scope', configWithDefaults.scope);
+        url.searchParams.append('state', state);
+        const codeChallenge = await pkceChallengeFromVerifier(codeVerifier);
+        url.searchParams.append('code_challenge', codeChallenge);
+        url.searchParams.append('code_challenge_method', 'S256');
+        const val = {
+            state,
+            codeVerifier,
+            landingUrl,
+            errorUrl,
+        };
+        return new Response('Redirecting to SSO Provider', {
+            status: 302,
+            headers: {
+                Location: url.toString(),
+                'Set-Cookie': createCookie('state', val, 86400),
+            },
+        });
+    }
+    async function logout(request, _config) {
+        if (!configWithDefaults) {
+            throw new Error('Enterprise Standard SSO Manager not initialized');
+        }
+        // Try to revoke the refresh token on the server
+        try {
+            const refreshToken = getCookie('refresh', request);
+            if (refreshToken) {
+                await revokeToken(refreshToken);
+            }
+        }
+        catch (error) {
+            console.warn('Failed to revoke token:', error);
+        }
+        // Delete session from session store if configured
+        if (configWithDefaults.session_store) {
+            try {
+                const user = await getUser(request);
+                if (user?.sso?.profile.sid) {
+                    const sid = user.sso.profile.sid;
+                    await configWithDefaults.session_store.delete(sid);
+                    console.log(`Session ${sid} deleted from store`);
+                }
+            }
+            catch (error) {
+                console.warn('Failed to delete session:', error);
+                // Don't fail logout if session deletion fails
+            }
+        }
+        // Clear cookies
+        const clearHeaders = [
+            ['Set-Cookie', clearCookie('access')],
+            ['Set-Cookie', clearCookie('id')],
+            ['Set-Cookie', clearCookie('refresh')],
+            ['Set-Cookie', clearCookie('control')],
+            ['Set-Cookie', clearCookie('state')],
+        ];
+        // Check for redirect query parameter
+        const url = new URL(request.url);
+        const redirectTo = url.searchParams.get('redirect');
+        if (redirectTo) {
+            return new Response('Logged out', {
+                status: 302,
+                headers: [['Location', redirectTo], ...clearHeaders],
+            });
+        }
+        // Check if this is an AJAX request (expects JSON response)
+        const accept = request.headers.get('accept');
+        const isAjax = accept?.includes('application/json') || accept?.includes('text/javascript');
+        if (isAjax) {
+            return new Response(JSON.stringify({ success: true, message: 'Logged out' }), {
+                status: 200,
+                headers: [['Content-Type', 'application/json'], ...clearHeaders],
+            });
+        }
+        else {
+            return new Response(`
+          <!DOCTYPE html><html lang="en"><body>
+            <h1>Logout Complete</h1>
+            <div style="display: none">
+              It is not recommended to show the default logout page. Include '?redirect=/someHomePage' or logout asynchronously.
+              Check the <a href="https://EnterpriseStandard.com/sso#logout">Enterprise Standard Packages</a> for more information.
+            </div>
+          </body></html>
+        `, {
+                status: 200,
+                headers: [['Content-Type', 'text/html'], ...clearHeaders],
+            });
+        }
+    }
+    async function logoutBackChannel(request) {
+        if (!configWithDefaults) {
+            throw new Error('Enterprise Standard SSO Manager not initialized');
+        }
+        if (!configWithDefaults.session_store) {
+            throw new Error('Back-Channel Logout requires session_store configuration');
+        }
+        try {
+            // Parse the logout token from the request body
+            const contentType = request.headers.get('content-type');
+            if (!contentType || !contentType.includes('application/x-www-form-urlencoded')) {
+                return new Response('Invalid Content-Type, expected application/x-www-form-urlencoded', {
+                    status: 400,
+                });
+            }
+            const body = await request.text();
+            const params = new URLSearchParams(body);
+            const logoutToken = params.get('logout_token');
+            if (!logoutToken) {
+                return new Response('Missing logout_token parameter', { status: 400 });
+            }
+            // Parse and verify the logout token JWT
+            const claims = await parseJwt(logoutToken);
+            // Extract sid (session ID) from the logout token
+            const sid = claims.sid;
+            if (!sid) {
+                console.warn('Back-Channel Logout: logout_token missing sid claim');
+                return new Response('Invalid logout_token: missing sid claim', { status: 400 });
+            }
+            // Delete the session from the store
+            await configWithDefaults.session_store.delete(sid);
+            console.log(`Back-Channel Logout: successfully deleted session ${sid}`);
+            return new Response('OK', { status: 200 });
+        }
+        catch (error) {
+            console.error('Error during back-channel logout:', error);
+            return new Response('Internal Server Error', { status: 500 });
+        }
+    }
+    async function callbackHandler(request, validation) {
+        if (!configWithDefaults) {
+            throw new Error('Enterprise Standard SSO Manager not initialized');
+        }
+        const url = new URL(request.url);
+        const params = new URLSearchParams(url.search);
+        // Validate callback parameters using StandardSchema
+        const callbackParamsValidator = validation?.callbackParams ?? oidcCallbackSchema('builtin');
+        const paramsObject = Object.fromEntries(params.entries());
+        const paramsResult = await callbackParamsValidator['~standard'].validate(paramsObject);
+        if ('issues' in paramsResult) {
+            return new Response(JSON.stringify({
+                error: 'validation_failed',
+                message: 'OIDC callback parameters validation failed',
+                issues: paramsResult.issues?.map((i) => ({
+                    path: i.path?.join('.'),
+                    message: i.message,
+                })),
+            }), {
+                status: 400,
+                headers: { 'Content-Type': 'application/json' },
+            });
+        }
+        const { code: codeFromUrl, state: stateFromUrl } = paramsResult.value;
+        try {
+            const cookie = getCookie('state', request, true);
+            const { codeVerifier, state, landingUrl } = cookie ?? {};
+            must(codeVerifier, 'OIDC "codeVerifier" was not present in cookies, ensure that the SSO login was initiated correctly');
+            must(state, 'OIDC "stateVerifier" was not present in cookies, ensure that the SSO login was initiated correctly');
+            must(landingUrl, 'OIDC "landingUrl" was not present in cookies');
+            if (stateFromUrl !== state) {
+                throw new Error('SSO State Verifier failed, the "state" request parameter does not equal the "state" in the SSO cookie');
+            }
+            const tokenResponse = await exchangeCodeForToken(codeFromUrl, codeVerifier, validation, request.url);
+            const user = await parseUser(tokenResponse, validation);
+            // Create session if session_store is configured
+            if (configWithDefaults.session_store) {
+                try {
+                    const sid = user.sso.profile.sid;
+                    const sub = user.id;
+                    if (sid && sub) {
+                        const session = {
+                            sid,
+                            sub,
+                            createdAt: new Date(),
+                            lastActivityAt: new Date(),
+                        };
+                        await configWithDefaults.session_store.create(session);
+                    }
+                    else {
+                        console.warn('Session creation skipped: missing sid or sub in ID token claims');
+                    }
+                }
+                catch (error) {
+                    console.warn('Failed to create session:', error);
+                    // Don't fail the login if session creation fails
+                }
+            }
+            // Store/update user if user_store is configured
+            if (configWithDefaults.user_store) {
+                try {
+                    const sub = user.id;
+                    if (sub) {
+                        const now = new Date();
+                        const existingUser = await configWithDefaults.user_store.get(sub);
+                        // Only create new users if JIT provisioning is enabled
+                        // Always update existing users
+                        if (existingUser || configWithDefaults.enable_jit_user_provisioning) {
+                            // Merge existing custom data with updated user info
+                            // This preserves TUserData fields that were previously set
+                            const storedUser = {
+                                ...(existingUser ?? {}),
+                                ...user,
+                                id: sub,
+                                createdAt: existingUser?.createdAt ?? now,
+                                updatedAt: now,
+                            };
+                            await configWithDefaults.user_store.upsert(storedUser);
+                        }
+                        else {
+                            console.warn('JIT user provisioning disabled: user not found in store and will not be created');
+                        }
+                    }
+                    else {
+                        console.warn('User storage skipped: missing sub in ID token claims');
+                    }
+                }
+                catch (error) {
+                    console.warn('Failed to store user:', error);
+                    // Don't fail the login if user storage fails
+                }
+            }
+            return new Response('Authentication successful, redirecting', {
+                status: 302,
+                headers: [
+                    ['Location', landingUrl],
+                    ['Set-Cookie', clearCookie('state')],
+                    ...createJwtCookies(tokenResponse, user.sso.expires),
+                ],
+            });
+        }
+        catch (error) {
+            console.error('Error during sign-in callback:', error);
+            try {
+                const cookie = getCookie('state', request, true);
+                const { errorUrl } = cookie ?? {};
+                if (errorUrl) {
+                    return new Response('Redirecting to error url', {
+                        status: 302,
+                        headers: [['Location', errorUrl]],
+                    });
+                }
+            }
+            catch (_err) {
+                console.warn('Error parsing the errorUrl from the OIDC cookie');
+            }
+            console.warn('No error page was found in the cookies. The user will be shown a default error page.');
+            return new Response('An error occurred during authentication, please return to the application homepage and try again.', {
+                status: 500,
+            });
+        }
+    }
+    async function parseUser(token, validation) {
+        if (!configWithDefaults) {
+            throw new Error('Enterprise Standard SSO Manager not initialized');
+        }
+        const idToken = await parseJwt(token.id_token, validation);
+        const expiresIn = Number(token.refresh_expires_in ?? token.expires_in ?? 3600);
+        const expires = token.expires ? new Date(token.expires) : new Date(Date.now() + expiresIn * 1000);
+        return {
+            id: idToken.sub,
+            userName: idToken.preferred_username || '',
+            name: idToken.name || '',
+            email: idToken.email || '',
+            emails: [
+                {
+                    value: idToken.email || '',
+                    primary: true,
+                },
+            ],
+            avatarUrl: idToken.picture,
+            sso: {
+                profile: {
+                    ...idToken,
+                    iss: idToken.iss || configWithDefaults.authority,
+                    aud: idToken.aud || configWithDefaults.client_id,
+                },
+                tenant: {
+                    id: idToken.idp || idToken.iss || configWithDefaults.authority,
+                    name: idToken.iss || configWithDefaults.authority,
+                },
+                scope: token.scope,
+                tokenType: token.token_type,
+                sessionState: token.session_state,
+                expires,
+            },
+        };
+    }
+    async function exchangeCodeForToken(code, codeVerifier, validation, requestUrl) {
+        if (!configWithDefaults) {
+            throw new Error('Enterprise Standard SSO Manager not initialized');
+        }
+        const tokenUrl = configWithDefaults.token_url;
+        // Normalize redirect_uri - use the same logic as in initiateLogin
+        let normalizedRedirectUri = configWithDefaults.redirect_uri;
+        try {
+            new URL(normalizedRedirectUri);
+        }
+        catch {
+            // If redirect_uri is not a valid URL, try to construct it from request URL
+            if (requestUrl) {
+                try {
+                    const baseUrl = new URL(requestUrl);
+                    const path = normalizedRedirectUri.startsWith('//')
+                        ? normalizedRedirectUri.slice(1)
+                        : normalizedRedirectUri.startsWith('/')
+                            ? normalizedRedirectUri
+                            : `/${normalizedRedirectUri}`;
+                    normalizedRedirectUri = new URL(path, baseUrl.origin).toString();
+                }
+                catch {
+                    // If we can't construct it, use token_url's origin as fallback
+                    try {
+                        const tokenUrlObj = new URL(tokenUrl);
+                        const path = normalizedRedirectUri.startsWith('//')
+                            ? normalizedRedirectUri.slice(1)
+                            : normalizedRedirectUri.startsWith('/')
+                                ? normalizedRedirectUri
+                                : `/${normalizedRedirectUri}`;
+                        normalizedRedirectUri = new URL(path, tokenUrlObj.origin).toString();
+                    }
+                    catch {
+                        throw new Error(`Invalid redirect_uri: "${configWithDefaults.redirect_uri}". It must be a valid absolute URL.`);
+                    }
+                }
+            }
+        }
+        const body = new URLSearchParams();
+        body.append('grant_type', 'authorization_code');
+        body.append('code', code);
+        body.append('redirect_uri', normalizedRedirectUri);
+        body.append('client_id', configWithDefaults.client_id);
+        if (configWithDefaults.client_secret) {
+            body.append('client_secret', configWithDefaults.client_secret);
+        }
+        body.append('code_verifier', codeVerifier);
+        try {
+            const response = await fetch(tokenUrl, {
+                method: 'POST',
+                headers: {
+                    'Content-Type': 'application/x-www-form-urlencoded',
+                    Accept: 'application/json',
+                },
+                body: body.toString(),
+            });
+            const data = await response.json();
+            if (!response.ok) {
+                console.error('Token exchange error:', data);
+                throw new Error(`Token exchange failed: ${data.error || response.statusText} - ${data.error_description || ''}`.trim());
+            }
+            // Validate token response using StandardSchema
+            const tokenResponseValidator = validation?.tokenResponse ?? tokenResponseSchema('builtin');
+            const tokenResult = await tokenResponseValidator['~standard'].validate(data);
+            if ('issues' in tokenResult) {
+                console.error('Token response validation failed:', tokenResult.issues);
+                throw new Error(`Token response validation failed: ${tokenResult.issues?.map((i) => i.message).join('; ')}`);
+            }
+            return tokenResult.value;
+        }
+        catch (error) {
+            console.error('Error during token exchange:', error);
+            throw error;
+        }
+    }
+    async function refreshToken(refreshToken) {
+        return retryWithBackoff(async () => {
+            if (!configWithDefaults) {
+                throw new Error('Enterprise Standard SSO Manager not initialized');
+            }
+            const tokenUrl = configWithDefaults.token_url;
+            const body = new URLSearchParams();
+            body.append('grant_type', 'refresh_token');
+            body.append('refresh_token', refreshToken);
+            body.append('client_id', configWithDefaults.client_id);
+            const response = await fetch(tokenUrl, {
+                method: 'POST',
+                headers: {
+                    'Content-Type': 'application/x-www-form-urlencoded',
+                    Accept: 'application/json',
+                },
+                body: body.toString(),
+            });
+            const data = await response.json();
+            if (!response.ok) {
+                console.error('Token refresh error:', data);
+                throw new Error(`Token refresh failed: ${data.error || response.statusText} - ${data.error_description || ''}`.trim());
+            }
+            return data;
+        });
+    }
+    async function revokeToken(token) {
+        try {
+            if (!configWithDefaults) {
+                throw new Error('Enterprise Standard SSO Manager not initialized');
+            }
+            // Only attempt revocation if a revocation endpoint is explicitly configured
+            if (!configWithDefaults.revocation_endpoint) {
+                return;
+            }
+            const body = new URLSearchParams();
+            body.append('token', token);
+            body.append('token_type_hint', 'refresh_token');
+            body.append('client_id', configWithDefaults.client_id);
+            const response = await fetch(configWithDefaults.revocation_endpoint, {
+                method: 'POST',
+                headers: {
+                    'Content-Type': 'application/x-www-form-urlencoded',
+                },
+                body: body.toString(),
+            });
+            if (!response.ok) {
+                console.warn('Token revocation failed:', response.status, response.statusText);
+            }
+            else {
+                console.log('Token revoked successfully');
+            }
+        }
+        catch (error) {
+            console.warn('Error revoking token:', error);
+        }
+    }
+    async function fetchJwks() {
+        if (!configWithDefaults) {
+            throw new Error('Enterprise Standard SSO Manager not initialized');
+        }
+        const url = configWithDefaults.jwks_uri || `${configWithDefaults.authority}/protocol/openid-connect/certs`;
+        const cached = jwksCache.get(url);
+        if (cached)
+            return cached;
+        return retryWithBackoff(async () => {
+            if (!configWithDefaults)
+                throw new Error('SSO Manager not initialized');
+            const response = await fetch(url);
+            if (!response.ok)
+                throw new Error('Failed to fetch JWKS');
+            const jwks = await response.json();
+            jwksCache.set(url, jwks);
+            return jwks;
+        });
+    }
+    async function retryWithBackoff(operation, maxRetries = 3, baseDelay = 1000, maxDelay = 30000) {
+        let lastError = new Error('Placeholder Error');
+        for (let attempt = 0; attempt <= maxRetries; attempt++) {
+            try {
+                return await operation();
+            }
+            catch (error) {
+                lastError = error instanceof Error ? error : new Error(String(error));
+                // Don't retry on authentication errors (4xx) or client errors
+                if (error instanceof Error && error.message.includes('400')) {
+                    throw error;
+                }
+                if (attempt === maxRetries) {
+                    throw lastError;
+                }
+                // Exponential backoff with jitter
+                const delay = Math.min(baseDelay * 2 ** attempt, maxDelay);
+                const jitter = Math.random() * 0.1 * delay;
+                await new Promise((resolve) => setTimeout(resolve, delay + jitter));
+                console.warn(`Retry attempt ${attempt + 1} after ${delay + jitter}ms delay`);
+            }
+        }
+        throw lastError;
+    }
+    async function parseJwt(token, validation) {
+        try {
+            const parts = token.split('.');
+            if (parts.length !== 3)
+                throw new Error('Invalid JWT');
+            const header = JSON.parse(atob(parts[0].replace(/-/g, '+').replace(/_/g, '/')));
+            const payload = JSON.parse(atob(parts[1].replace(/-/g, '+').replace(/_/g, '/')));
+            const signature = parts[2].replace(/-/g, '+').replace(/_/g, '/');
+            const publicKey = await getPublicKey(header.kid);
+            const encoder = new TextEncoder();
+            const data = encoder.encode(`${parts[0]}.${parts[1]}`);
+            const isValid = await crypto.subtle.verify('RSASSA-PKCS1-v1_5', publicKey, Uint8Array.from(atob(signature), (c) => c.charCodeAt(0)), data);
+            if (!isValid)
+                throw new Error('Invalid JWT signature');
+            // Validate ID token claims using StandardSchema
+            const idTokenClaimsValidator = validation?.idTokenClaims ?? idTokenClaimsSchema('builtin');
+            const claimsResult = await idTokenClaimsValidator['~standard'].validate(payload);
+            if ('issues' in claimsResult) {
+                console.error('ID token claims validation failed:', claimsResult.issues);
+                throw new Error(`ID token claims validation failed: ${claimsResult.issues?.map((i) => i.message).join('; ')}`);
+            }
+            return claimsResult.value;
+        }
+        catch (e) {
+            console.error('Error verifying JWT:', e);
+            throw e;
+        }
+    }
+    function generateRandomString(length = 32) {
+        const array = new Uint8Array(length);
+        crypto.getRandomValues(array);
+        return Array.from(array, (byte) => byte.toString(16).padStart(2, '0'))
+            .join('')
+            .substring(0, length);
+    }
+    async function pkceChallengeFromVerifier(verifier) {
+        const encoder = new TextEncoder();
+        const data = encoder.encode(verifier);
+        const hashBuffer = await crypto.subtle.digest('SHA-256', data);
+        const hashArray = Array.from(new Uint8Array(hashBuffer));
+        const hashBase64 = btoa(String.fromCharCode(...hashArray))
+            .replace(/\+/g, '-')
+            .replace(/\//g, '_')
+            .replace(/=+$/, '');
+        return hashBase64;
+    }
+    async function getPublicKey(kid) {
+        const jwks = await fetchJwks();
+        const key = jwks.keys.find((k) => k.kid === kid);
+        if (!key)
+            throw new Error('Public key not found');
+        const publicKey = await crypto.subtle.importKey('jwk', {
+            kty: key.kty,
+            n: key.n,
+            e: key.e,
+        }, { name: 'RSASSA-PKCS1-v1_5', hash: 'SHA-256' }, false, ['verify']);
+        return publicKey;
+    }
+    function createJwtCookies(token, expires) {
+        const control = {
+            expires_in: token.expires_in,
+            refresh_expires_in: token.refresh_expires_in,
+            scope: token.scope,
+            session_state: token.session_state,
+            token_type: token.token_type,
+            expires: expires.toISOString(),
+        };
+        return [
+            ['Set-Cookie', createCookie('access', token.access_token, expires)],
+            ['Set-Cookie', createCookie('id', token.id_token, expires)],
+            ['Set-Cookie', createCookie('refresh', token.refresh_token ?? '', expires)],
+            ['Set-Cookie', createCookie('control', control, expires)],
+        ];
+    }
+    async function getTokenFromCookies(req) {
+        const access_token = getCookie('access', req);
+        const id_token = getCookie('id', req);
+        const refresh_token = getCookie('refresh', req);
+        const control = getCookie('control', req, true);
+        if (!access_token || !id_token || !refresh_token || !control) {
+            return { tokens: undefined, refreshHeaders: [] };
+        }
+        let tokenResponse = {
+            access_token,
+            id_token,
+            refresh_token,
+            ...control,
+        };
+        // Check if access token is expired
+        if (control.expires && refresh_token && Date.now() > new Date(control.expires).getTime()) {
+            tokenResponse = await refreshToken(refresh_token);
+            // Create new cookies with refreshed tokens
+            const user = await parseUser(tokenResponse);
+            const refreshHeaders = createJwtCookies(tokenResponse, user.sso.expires);
+            return { tokens: tokenResponse, refreshHeaders };
+        }
+        return { tokens: tokenResponse, refreshHeaders: [] };
+    }
+    async function getJwt(request) {
+        const { tokens } = await getTokenFromCookies(request);
+        if (!tokens)
+            return undefined;
+        return tokens.access_token;
+    }
+    function createCookie(name, value, expires) {
+        if (!configWithDefaults) {
+            throw new Error('Enterprise Standard SSO Manager not initialized');
+        }
+        name = `${configWithDefaults.cookies_prefix}.${name}`;
+        if (typeof value !== 'string') {
+            value = btoa(JSON.stringify(value));
+        }
+        let exp;
+        if (expires instanceof Date) {
+            exp = `Expires=${expires.toUTCString()}`;
+        }
+        else if (typeof expires === 'number') {
+            exp = `Max-Age=${expires}`;
+        }
+        else {
+            throw new Error('Invalid expires type', expires);
+        }
+        if (value.length > 4000) {
+            throw new Error(`Error setting cookie: ${name}. Cookie length is: ${value.length}`);
+        }
+        return `${name}=${value}; ${exp}; Path=${configWithDefaults.cookies_path}; HttpOnly;${configWithDefaults.cookies_secure ? ' Secure;' : ''} SameSite=${configWithDefaults.cookies_same_site};`;
+    }
+    function clearCookie(name) {
+        if (!configWithDefaults) {
+            throw new Error('Enterprise Standard SSO Manager not initialized');
+        }
+        return `${configWithDefaults.cookies_prefix}.${name}=; Max-Age=0; Path=${configWithDefaults.cookies_path}; HttpOnly;${configWithDefaults.cookies_secure ? ' Secure;' : ''} SameSite=${configWithDefaults.cookies_same_site};`;
+    }
+    function getCookie(name, req, parse = false) {
+        if (!configWithDefaults) {
+            throw new Error('Enterprise Standard SSO Manager not initialized');
+        }
+        const header = req.headers.get('cookie');
+        if (!header)
+            return null;
+        const cookie = header
+            .split(';')
+            .find((row) => row.trim().startsWith(`${configWithDefaults.cookies_prefix}.${name}=`));
+        if (!cookie)
+            return null;
+        const val = cookie.split('=')[1].trim();
+        if (!parse)
+            return val;
+        const str = atob(val);
+        return JSON.parse(str);
+    }
+    async function handler(request, es) {
+        const { loginUrl, userUrl, errorUrl, landingUrl, tokenUrl, refreshUrl, logoutUrl, logoutBackChannelUrl, jwksUrl, validation, } = { ...handlerDefaults, ...es?.sso };
+        if (!configWithDefaults) {
+            throw new Error('Enterprise Standard SSO Manager not initialized');
+        }
+        if (!loginUrl) {
+            console.error('loginUrl is required');
+        }
+        const path = new URL(request.url).pathname;
+        // Handle both absolute URLs and relative paths for redirect_uri
+        let redirectUriPath;
+        try {
+            // Try to parse as absolute URL first
+            redirectUriPath = new URL(configWithDefaults.redirect_uri).pathname;
+        }
+        catch {
+            // If it's not a valid URL, try to construct from request URL
+            try {
+                const requestUrl = new URL(request.url);
+                // If redirect_uri starts with //, it's a protocol-relative URL, treat as path
+                const redirectUri = configWithDefaults.redirect_uri.startsWith('//')
+                    ? configWithDefaults.redirect_uri.slice(1)
+                    : configWithDefaults.redirect_uri;
+                // Construct full URL from request origin + redirect_uri path
+                redirectUriPath = new URL(redirectUri, requestUrl.origin).pathname;
+            }
+            catch {
+                // Fallback: treat as path directly
+                redirectUriPath = configWithDefaults.redirect_uri.startsWith('/')
+                    ? configWithDefaults.redirect_uri
+                    : `/${configWithDefaults.redirect_uri}`;
+            }
+        }
+        if (redirectUriPath === path) {
+            return callbackHandler(request, validation);
+        }
+        if (loginUrl === path) {
+            return initiateLogin({
+                landingUrl: landingUrl || '/',
+                errorUrl,
+            }, request.url);
+        }
+        if (userUrl === path) {
+            const { tokens, refreshHeaders } = await getTokenFromCookies(request);
+            if (!tokens) {
+                return new Response('User not logged in', { status: 401 });
+            }
+            const user = await parseUser(tokens);
+            return new Response(JSON.stringify(user), {
+                headers: [['Content-Type', 'application/json'], ...refreshHeaders],
+            });
+        }
+        if (tokenUrl === path) {
+            const { tokens, refreshHeaders } = await getTokenFromCookies(request);
+            if (!tokens) {
+                return new Response('User not logged in', { status: 401 });
+            }
+            return new Response(JSON.stringify({
+                token: tokens.access_token,
+                expires: tokens.expires,
+            }), {
+                headers: [['Content-Type', 'application/json'], ...refreshHeaders],
+            });
+        }
+        if (refreshUrl === path) {
+            const refresh_token = getCookie('refresh', request);
+            if (!refresh_token) {
+                return new Response('User not logged in', { status: 401 });
+            }
+            // Force a token refresh
+            const newTokenResponse = await refreshToken(refresh_token);
+            const user = await parseUser(newTokenResponse);
+            const refreshHeaders = createJwtCookies(newTokenResponse, user.sso.expires);
+            return new Response('Refresh Complete', {
+                status: 200,
+                headers: refreshHeaders,
+            });
+        }
+        if (logoutUrl === path) {
+            return logout(request, { landingUrl: landingUrl || '/' });
+        }
+        if (logoutBackChannelUrl === path) {
+            return logoutBackChannel(request);
+        }
+        if (jwksUrl === path) {
+            const jwks = await fetchJwks();
+            return new Response(JSON.stringify(jwks), {
+                headers: [['Content-Type', 'application/json']],
+            });
+        }
+        return new Response('Not Found', { status: 404 });
+    }
+    if (!configWithDefaults) {
+        throw new Error('Enterprise Standard SSO Manager not initialized');
+    }
+    return {
+        ...configWithDefaults,
+        getUser,
+        getRequiredUser,
+        getJwt,
+        initiateLogin,
+        logout,
+        callbackHandler,
+        handler,
+    };
+}