@enterprisestandard/react 0.0.5-beta.20260115.2 → 0.0.5-beta.20260115.4

package/dist/sso.js

@@ -1,820 +0,0 @@
-import { idTokenClaimsSchema, oidcCallbackSchema, tokenResponseSchema } from './types/oidc-schema';
-import { must } from './utils';
-const jwksCache = new Map();
-export function sso(config) {
-    let configWithDefaults;
-    const handlerDefaults = {
-        loginUrl: config?.loginUrl,
-        userUrl: config?.userUrl,
-        errorUrl: config?.errorUrl,
-        landingUrl: config?.landingUrl,
-        tokenUrl: config?.tokenUrl,
-        refreshUrl: config?.refreshUrl,
-        jwksUrl: config?.jwksUrl,
-        logoutUrl: config?.logoutUrl,
-        logoutBackChannelUrl: config?.logoutBackChannelUrl,
-        validation: config?.validation,
-    };
-    configWithDefaults = !config
-        ? undefined
-        : {
-            ...config,
-            authority: must(config.authority, "Missing 'authority' from SSO Config"),
-            token_url: must(config.token_url, "Missing 'token_url' from SSO Config"),
-            authorization_url: must(config.authorization_url, "Missing 'authorization_url' from SSO Config"),
-            client_id: must(config.client_id, "Missing 'client_id' from SSO Config"),
-            redirect_uri: must(config.redirect_uri, "Missing 'redirect_uri' from SSO Config"),
-            scope: must(config.scope, "Missing 'scope' from SSO Config"),
-            response_type: config.response_type ?? 'code',
-            cookies_secure: config.cookies_secure !== undefined ? config.cookies_secure : true,
-            cookies_same_site: config.cookies_same_site !== undefined ? config.cookies_same_site : 'Strict',
-            cookies_prefix: config.cookies_prefix ?? `es.sso.${config.client_id}`,
-            cookies_path: config.cookies_path ?? '/',
-        };
-    async function getUser(request) {
-        if (!configWithDefaults) {
-            throw new Error('Enterprise Standard SSO Manager not initialized');
-        }
-        try {
-            const { tokens } = await getTokenFromCookies(request);
-            if (!tokens)
-                return undefined;
-            return await parseUser(tokens);
-        }
-        catch (error) {
-            console.error('Error parsing user from cookies:', error);
-            return undefined;
-        }
-    }
-    async function getRequiredUser(request) {
-        const user = await getUser(request);
-        if (user)
-            return user;
-        throw new Response('Unauthorized', {
-            status: 401,
-            statusText: 'Unauthorized',
-        });
-    }
-    async function initiateLogin({ landingUrl, errorUrl }, requestUrl) {
-        if (!configWithDefaults) {
-            throw new Error('Enterprise Standard SSO Manager not initialized');
-        }
-        const state = generateRandomString();
-        const codeVerifier = generateRandomString(64);
-        // Normalize redirect_uri - use request URL if available, otherwise use the stored value
-        let normalizedRedirectUri = configWithDefaults.redirect_uri;
-        try {
-            new URL(normalizedRedirectUri);
-        }
-        catch {
-            // If redirect_uri is not a valid URL, try to construct it from request URL
-            if (requestUrl) {
-                try {
-                    const baseUrl = new URL(requestUrl);
-                    const path = normalizedRedirectUri.startsWith('//')
-                        ? normalizedRedirectUri.slice(1)
-                        : normalizedRedirectUri.startsWith('/')
-                            ? normalizedRedirectUri
-                            : `/${normalizedRedirectUri}`;
-                    normalizedRedirectUri = new URL(path, baseUrl.origin).toString();
-                }
-                catch {
-                    // If we can't construct it, use authorization_url's origin as fallback
-                    try {
-                        const authUrl = new URL(configWithDefaults.authorization_url);
-                        const path = normalizedRedirectUri.startsWith('//')
-                            ? normalizedRedirectUri.slice(1)
-                            : normalizedRedirectUri.startsWith('/')
-                                ? normalizedRedirectUri
-                                : `/${normalizedRedirectUri}`;
-                        normalizedRedirectUri = new URL(path, authUrl.origin).toString();
-                    }
-                    catch {
-                        throw new Error(`Invalid redirect_uri: "${configWithDefaults.redirect_uri}". It must be a valid absolute URL.`);
-                    }
-                }
-            }
-        }
-        const url = new URL(configWithDefaults.authorization_url);
-        url.searchParams.append('client_id', configWithDefaults.client_id);
-        url.searchParams.append('redirect_uri', normalizedRedirectUri);
-        url.searchParams.append('response_type', 'code');
-        url.searchParams.append('scope', configWithDefaults.scope);
-        url.searchParams.append('state', state);
-        const codeChallenge = await pkceChallengeFromVerifier(codeVerifier);
-        url.searchParams.append('code_challenge', codeChallenge);
-        url.searchParams.append('code_challenge_method', 'S256');
-        const val = {
-            state,
-            codeVerifier,
-            landingUrl,
-            errorUrl,
-        };
-        return new Response('Redirecting to SSO Provider', {
-            status: 302,
-            headers: {
-                Location: url.toString(),
-                'Set-Cookie': createCookie('state', val, 86400),
-            },
-        });
-    }
-    async function logout(request, _config) {
-        if (!configWithDefaults) {
-            throw new Error('Enterprise Standard SSO Manager not initialized');
-        }
-        // Try to revoke the refresh token on the server
-        try {
-            const refreshToken = getCookie('refresh', request);
-            if (refreshToken) {
-                await revokeToken(refreshToken);
-            }
-        }
-        catch (error) {
-            console.warn('Failed to revoke token:', error);
-        }
-        // Delete session from session store if configured
-        if (configWithDefaults.session_store) {
-            try {
-                const user = await getUser(request);
-                if (user?.sso?.profile.sid) {
-                    const sid = user.sso.profile.sid;
-                    await configWithDefaults.session_store.delete(sid);
-                    console.log(`Session ${sid} deleted from store`);
-                }
-            }
-            catch (error) {
-                console.warn('Failed to delete session:', error);
-                // Don't fail logout if session deletion fails
-            }
-        }
-        // Clear cookies
-        const clearHeaders = [
-            ['Set-Cookie', clearCookie('access')],
-            ['Set-Cookie', clearCookie('id')],
-            ['Set-Cookie', clearCookie('refresh')],
-            ['Set-Cookie', clearCookie('control')],
-            ['Set-Cookie', clearCookie('state')],
-        ];
-        // Check for redirect query parameter
-        const url = new URL(request.url);
-        const redirectTo = url.searchParams.get('redirect');
-        if (redirectTo) {
-            return new Response('Logged out', {
-                status: 302,
-                headers: [['Location', redirectTo], ...clearHeaders],
-            });
-        }
-        // Check if this is an AJAX request (expects JSON response)
-        const accept = request.headers.get('accept');
-        const isAjax = accept?.includes('application/json') || accept?.includes('text/javascript');
-        if (isAjax) {
-            return new Response(JSON.stringify({ success: true, message: 'Logged out' }), {
-                status: 200,
-                headers: [['Content-Type', 'application/json'], ...clearHeaders],
-            });
-        }
-        else {
-            return new Response(`
-          <!DOCTYPE html><html lang="en"><body>
-            <h1>Logout Complete</h1>
-            <div style="display: none">
-              It is not recommended to show the default logout page. Include '?redirect=/someHomePage' or logout asynchronously.
-              Check the <a href="https://EnterpriseStandard.com/sso#logout">Enterprise Standard Packages</a> for more information.
-            </div>
-          </body></html>
-        `, {
-                status: 200,
-                headers: [['Content-Type', 'text/html'], ...clearHeaders],
-            });
-        }
-    }
-    async function logoutBackChannel(request) {
-        if (!configWithDefaults) {
-            throw new Error('Enterprise Standard SSO Manager not initialized');
-        }
-        if (!configWithDefaults.session_store) {
-            throw new Error('Back-Channel Logout requires session_store configuration');
-        }
-        try {
-            // Parse the logout token from the request body
-            const contentType = request.headers.get('content-type');
-            if (!contentType || !contentType.includes('application/x-www-form-urlencoded')) {
-                return new Response('Invalid Content-Type, expected application/x-www-form-urlencoded', {
-                    status: 400,
-                });
-            }
-            const body = await request.text();
-            const params = new URLSearchParams(body);
-            const logoutToken = params.get('logout_token');
-            if (!logoutToken) {
-                return new Response('Missing logout_token parameter', { status: 400 });
-            }
-            // Parse and verify the logout token JWT
-            const claims = await parseJwt(logoutToken);
-            // Extract sid (session ID) from the logout token
-            const sid = claims.sid;
-            if (!sid) {
-                console.warn('Back-Channel Logout: logout_token missing sid claim');
-                return new Response('Invalid logout_token: missing sid claim', { status: 400 });
-            }
-            // Delete the session from the store
-            await configWithDefaults.session_store.delete(sid);
-            console.log(`Back-Channel Logout: successfully deleted session ${sid}`);
-            return new Response('OK', { status: 200 });
-        }
-        catch (error) {
-            console.error('Error during back-channel logout:', error);
-            return new Response('Internal Server Error', { status: 500 });
-        }
-    }
-    async function callbackHandler(request, validation) {
-        if (!configWithDefaults) {
-            throw new Error('Enterprise Standard SSO Manager not initialized');
-        }
-        const url = new URL(request.url);
-        const params = new URLSearchParams(url.search);
-        // Validate callback parameters using StandardSchema
-        const callbackParamsValidator = validation?.callbackParams ?? oidcCallbackSchema('builtin');
-        const paramsObject = Object.fromEntries(params.entries());
-        const paramsResult = await callbackParamsValidator['~standard'].validate(paramsObject);
-        if ('issues' in paramsResult) {
-            return new Response(JSON.stringify({
-                error: 'validation_failed',
-                message: 'OIDC callback parameters validation failed',
-                issues: paramsResult.issues?.map((i) => ({
-                    path: i.path?.join('.'),
-                    message: i.message,
-                })),
-            }), {
-                status: 400,
-                headers: { 'Content-Type': 'application/json' },
-            });
-        }
-        const { code: codeFromUrl, state: stateFromUrl } = paramsResult.value;
-        try {
-            const cookie = getCookie('state', request, true);
-            const { codeVerifier, state, landingUrl } = cookie ?? {};
-            must(codeVerifier, 'OIDC "codeVerifier" was not present in cookies, ensure that the SSO login was initiated correctly');
-            must(state, 'OIDC "stateVerifier" was not present in cookies, ensure that the SSO login was initiated correctly');
-            must(landingUrl, 'OIDC "landingUrl" was not present in cookies');
-            if (stateFromUrl !== state) {
-                throw new Error('SSO State Verifier failed, the "state" request parameter does not equal the "state" in the SSO cookie');
-            }
-            const tokenResponse = await exchangeCodeForToken(codeFromUrl, codeVerifier, validation, request.url);
-            const user = await parseUser(tokenResponse, validation);
-            // Create session if session_store is configured
-            if (configWithDefaults.session_store) {
-                try {
-                    const sid = user.sso.profile.sid;
-                    const sub = user.id;
-                    if (sid && sub) {
-                        const session = {
-                            sid,
-                            sub,
-                            createdAt: new Date(),
-                            lastActivityAt: new Date(),
-                        };
-                        await configWithDefaults.session_store.create(session);
-                    }
-                    else {
-                        console.warn('Session creation skipped: missing sid or sub in ID token claims');
-                    }
-                }
-                catch (error) {
-                    console.warn('Failed to create session:', error);
-                    // Don't fail the login if session creation fails
-                }
-            }
-            // Store/update user if user_store is configured
-            if (configWithDefaults.user_store) {
-                try {
-                    const sub = user.id;
-                    if (sub) {
-                        const now = new Date();
-                        const existingUser = await configWithDefaults.user_store.get(sub);
-                        // Only create new users if JIT provisioning is enabled
-                        // Always update existing users
-                        if (existingUser || configWithDefaults.enable_jit_user_provisioning) {
-                            // Merge existing custom data with updated user info
-                            // This preserves TUserData fields that were previously set
-                            const storedUser = {
-                                ...(existingUser ?? {}),
-                                ...user,
-                                id: sub,
-                                createdAt: existingUser?.createdAt ?? now,
-                                updatedAt: now,
-                            };
-                            await configWithDefaults.user_store.upsert(storedUser);
-                        }
-                        else {
-                            console.warn('JIT user provisioning disabled: user not found in store and will not be created');
-                        }
-                    }
-                    else {
-                        console.warn('User storage skipped: missing sub in ID token claims');
-                    }
-                }
-                catch (error) {
-                    console.warn('Failed to store user:', error);
-                    // Don't fail the login if user storage fails
-                }
-            }
-            return new Response('Authentication successful, redirecting', {
-                status: 302,
-                headers: [
-                    ['Location', landingUrl],
-                    ['Set-Cookie', clearCookie('state')],
-                    ...createJwtCookies(tokenResponse, user.sso.expires),
-                ],
-            });
-        }
-        catch (error) {
-            console.error('Error during sign-in callback:', error);
-            try {
-                const cookie = getCookie('state', request, true);
-                const { errorUrl } = cookie ?? {};
-                if (errorUrl) {
-                    return new Response('Redirecting to error url', {
-                        status: 302,
-                        headers: [['Location', errorUrl]],
-                    });
-                }
-            }
-            catch (_err) {
-                console.warn('Error parsing the errorUrl from the OIDC cookie');
-            }
-            console.warn('No error page was found in the cookies. The user will be shown a default error page.');
-            return new Response('An error occurred during authentication, please return to the application homepage and try again.', {
-                status: 500,
-            });
-        }
-    }
-    async function parseUser(token, validation) {
-        if (!configWithDefaults) {
-            throw new Error('Enterprise Standard SSO Manager not initialized');
-        }
-        const idToken = await parseJwt(token.id_token, validation);
-        const expiresIn = Number(token.refresh_expires_in ?? token.expires_in ?? 3600);
-        const expires = token.expires ? new Date(token.expires) : new Date(Date.now() + expiresIn * 1000);
-        return {
-            id: idToken.sub,
-            userName: idToken.preferred_username || '',
-            name: idToken.name || '',
-            email: idToken.email || '',
-            emails: [
-                {
-                    value: idToken.email || '',
-                    primary: true,
-                },
-            ],
-            avatarUrl: idToken.picture,
-            sso: {
-                profile: {
-                    ...idToken,
-                    iss: idToken.iss || configWithDefaults.authority,
-                    aud: idToken.aud || configWithDefaults.client_id,
-                },
-                tenant: {
-                    id: idToken.idp || idToken.iss || configWithDefaults.authority,
-                    name: idToken.iss || configWithDefaults.authority,
-                },
-                scope: token.scope,
-                tokenType: token.token_type,
-                sessionState: token.session_state,
-                expires,
-            },
-        };
-    }
-    async function exchangeCodeForToken(code, codeVerifier, validation, requestUrl) {
-        if (!configWithDefaults) {
-            throw new Error('Enterprise Standard SSO Manager not initialized');
-        }
-        const tokenUrl = configWithDefaults.token_url;
-        // Normalize redirect_uri - use the same logic as in initiateLogin
-        let normalizedRedirectUri = configWithDefaults.redirect_uri;
-        try {
-            new URL(normalizedRedirectUri);
-        }
-        catch {
-            // If redirect_uri is not a valid URL, try to construct it from request URL
-            if (requestUrl) {
-                try {
-                    const baseUrl = new URL(requestUrl);
-                    const path = normalizedRedirectUri.startsWith('//')
-                        ? normalizedRedirectUri.slice(1)
-                        : normalizedRedirectUri.startsWith('/')
-                            ? normalizedRedirectUri
-                            : `/${normalizedRedirectUri}`;
-                    normalizedRedirectUri = new URL(path, baseUrl.origin).toString();
-                }
-                catch {
-                    // If we can't construct it, use token_url's origin as fallback
-                    try {
-                        const tokenUrlObj = new URL(tokenUrl);
-                        const path = normalizedRedirectUri.startsWith('//')
-                            ? normalizedRedirectUri.slice(1)
-                            : normalizedRedirectUri.startsWith('/')
-                                ? normalizedRedirectUri
-                                : `/${normalizedRedirectUri}`;
-                        normalizedRedirectUri = new URL(path, tokenUrlObj.origin).toString();
-                    }
-                    catch {
-                        throw new Error(`Invalid redirect_uri: "${configWithDefaults.redirect_uri}". It must be a valid absolute URL.`);
-                    }
-                }
-            }
-        }
-        const body = new URLSearchParams();
-        body.append('grant_type', 'authorization_code');
-        body.append('code', code);
-        body.append('redirect_uri', normalizedRedirectUri);
-        body.append('client_id', configWithDefaults.client_id);
-        if (configWithDefaults.client_secret) {
-            body.append('client_secret', configWithDefaults.client_secret);
-        }
-        body.append('code_verifier', codeVerifier);
-        try {
-            const response = await fetch(tokenUrl, {
-                method: 'POST',
-                headers: {
-                    'Content-Type': 'application/x-www-form-urlencoded',
-                    Accept: 'application/json',
-                },
-                body: body.toString(),
-            });
-            const data = await response.json();
-            if (!response.ok) {
-                console.error('Token exchange error:', data);
-                throw new Error(`Token exchange failed: ${data.error || response.statusText} - ${data.error_description || ''}`.trim());
-            }
-            // Validate token response using StandardSchema
-            const tokenResponseValidator = validation?.tokenResponse ?? tokenResponseSchema('builtin');
-            const tokenResult = await tokenResponseValidator['~standard'].validate(data);
-            if ('issues' in tokenResult) {
-                console.error('Token response validation failed:', tokenResult.issues);
-                throw new Error(`Token response validation failed: ${tokenResult.issues?.map((i) => i.message).join('; ')}`);
-            }
-            return tokenResult.value;
-        }
-        catch (error) {
-            console.error('Error during token exchange:', error);
-            throw error;
-        }
-    }
-    async function refreshToken(refreshToken) {
-        return retryWithBackoff(async () => {
-            if (!configWithDefaults) {
-                throw new Error('Enterprise Standard SSO Manager not initialized');
-            }
-            const tokenUrl = configWithDefaults.token_url;
-            const body = new URLSearchParams();
-            body.append('grant_type', 'refresh_token');
-            body.append('refresh_token', refreshToken);
-            body.append('client_id', configWithDefaults.client_id);
-            const response = await fetch(tokenUrl, {
-                method: 'POST',
-                headers: {
-                    'Content-Type': 'application/x-www-form-urlencoded',
-                    Accept: 'application/json',
-                },
-                body: body.toString(),
-            });
-            const data = await response.json();
-            if (!response.ok) {
-                console.error('Token refresh error:', data);
-                throw new Error(`Token refresh failed: ${data.error || response.statusText} - ${data.error_description || ''}`.trim());
-            }
-            return data;
-        });
-    }
-    async function revokeToken(token) {
-        try {
-            if (!configWithDefaults) {
-                throw new Error('Enterprise Standard SSO Manager not initialized');
-            }
-            // Only attempt revocation if a revocation endpoint is explicitly configured
-            if (!configWithDefaults.revocation_endpoint) {
-                return;
-            }
-            const body = new URLSearchParams();
-            body.append('token', token);
-            body.append('token_type_hint', 'refresh_token');
-            body.append('client_id', configWithDefaults.client_id);
-            const response = await fetch(configWithDefaults.revocation_endpoint, {
-                method: 'POST',
-                headers: {
-                    'Content-Type': 'application/x-www-form-urlencoded',
-                },
-                body: body.toString(),
-            });
-            if (!response.ok) {
-                console.warn('Token revocation failed:', response.status, response.statusText);
-            }
-            else {
-                console.log('Token revoked successfully');
-            }
-        }
-        catch (error) {
-            console.warn('Error revoking token:', error);
-        }
-    }
-    async function fetchJwks() {
-        if (!configWithDefaults) {
-            throw new Error('Enterprise Standard SSO Manager not initialized');
-        }
-        const url = configWithDefaults.jwks_uri || `${configWithDefaults.authority}/protocol/openid-connect/certs`;
-        const cached = jwksCache.get(url);
-        if (cached)
-            return cached;
-        return retryWithBackoff(async () => {
-            if (!configWithDefaults)
-                throw new Error('SSO Manager not initialized');
-            const response = await fetch(url);
-            if (!response.ok)
-                throw new Error('Failed to fetch JWKS');
-            const jwks = await response.json();
-            jwksCache.set(url, jwks);
-            return jwks;
-        });
-    }
-    async function retryWithBackoff(operation, maxRetries = 3, baseDelay = 1000, maxDelay = 30000) {
-        let lastError = new Error('Placeholder Error');
-        for (let attempt = 0; attempt <= maxRetries; attempt++) {
-            try {
-                return await operation();
-            }
-            catch (error) {
-                lastError = error instanceof Error ? error : new Error(String(error));
-                // Don't retry on authentication errors (4xx) or client errors
-                if (error instanceof Error && error.message.includes('400')) {
-                    throw error;
-                }
-                if (attempt === maxRetries) {
-                    throw lastError;
-                }
-                // Exponential backoff with jitter
-                const delay = Math.min(baseDelay * 2 ** attempt, maxDelay);
-                const jitter = Math.random() * 0.1 * delay;
-                await new Promise((resolve) => setTimeout(resolve, delay + jitter));
-                console.warn(`Retry attempt ${attempt + 1} after ${delay + jitter}ms delay`);
-            }
-        }
-        throw lastError;
-    }
-    async function parseJwt(token, validation) {
-        try {
-            const parts = token.split('.');
-            if (parts.length !== 3)
-                throw new Error('Invalid JWT');
-            const header = JSON.parse(atob(parts[0].replace(/-/g, '+').replace(/_/g, '/')));
-            const payload = JSON.parse(atob(parts[1].replace(/-/g, '+').replace(/_/g, '/')));
-            const signature = parts[2].replace(/-/g, '+').replace(/_/g, '/');
-            const publicKey = await getPublicKey(header.kid);
-            const encoder = new TextEncoder();
-            const data = encoder.encode(`${parts[0]}.${parts[1]}`);
-            const isValid = await crypto.subtle.verify('RSASSA-PKCS1-v1_5', publicKey, Uint8Array.from(atob(signature), (c) => c.charCodeAt(0)), data);
-            if (!isValid)
-                throw new Error('Invalid JWT signature');
-            // Validate ID token claims using StandardSchema
-            const idTokenClaimsValidator = validation?.idTokenClaims ?? idTokenClaimsSchema('builtin');
-            const claimsResult = await idTokenClaimsValidator['~standard'].validate(payload);
-            if ('issues' in claimsResult) {
-                console.error('ID token claims validation failed:', claimsResult.issues);
-                throw new Error(`ID token claims validation failed: ${claimsResult.issues?.map((i) => i.message).join('; ')}`);
-            }
-            return claimsResult.value;
-        }
-        catch (e) {
-            console.error('Error verifying JWT:', e);
-            throw e;
-        }
-    }
-    function generateRandomString(length = 32) {
-        const array = new Uint8Array(length);
-        crypto.getRandomValues(array);
-        return Array.from(array, (byte) => byte.toString(16).padStart(2, '0'))
-            .join('')
-            .substring(0, length);
-    }
-    async function pkceChallengeFromVerifier(verifier) {
-        const encoder = new TextEncoder();
-        const data = encoder.encode(verifier);
-        const hashBuffer = await crypto.subtle.digest('SHA-256', data);
-        const hashArray = Array.from(new Uint8Array(hashBuffer));
-        const hashBase64 = btoa(String.fromCharCode(...hashArray))
-            .replace(/\+/g, '-')
-            .replace(/\//g, '_')
-            .replace(/=+$/, '');
-        return hashBase64;
-    }
-    async function getPublicKey(kid) {
-        const jwks = await fetchJwks();
-        const key = jwks.keys.find((k) => k.kid === kid);
-        if (!key)
-            throw new Error('Public key not found');
-        const publicKey = await crypto.subtle.importKey('jwk', {
-            kty: key.kty,
-            n: key.n,
-            e: key.e,
-        }, { name: 'RSASSA-PKCS1-v1_5', hash: 'SHA-256' }, false, ['verify']);
-        return publicKey;
-    }
-    function createJwtCookies(token, expires) {
-        const control = {
-            expires_in: token.expires_in,
-            refresh_expires_in: token.refresh_expires_in,
-            scope: token.scope,
-            session_state: token.session_state,
-            token_type: token.token_type,
-            expires: expires.toISOString(),
-        };
-        return [
-            ['Set-Cookie', createCookie('access', token.access_token, expires)],
-            ['Set-Cookie', createCookie('id', token.id_token, expires)],
-            ['Set-Cookie', createCookie('refresh', token.refresh_token ?? '', expires)],
-            ['Set-Cookie', createCookie('control', control, expires)],
-        ];
-    }
-    async function getTokenFromCookies(req) {
-        const access_token = getCookie('access', req);
-        const id_token = getCookie('id', req);
-        const refresh_token = getCookie('refresh', req);
-        const control = getCookie('control', req, true);
-        if (!access_token || !id_token || !refresh_token || !control) {
-            return { tokens: undefined, refreshHeaders: [] };
-        }
-        let tokenResponse = {
-            access_token,
-            id_token,
-            refresh_token,
-            ...control,
-        };
-        // Check if access token is expired
-        if (control.expires && refresh_token && Date.now() > new Date(control.expires).getTime()) {
-            tokenResponse = await refreshToken(refresh_token);
-            // Create new cookies with refreshed tokens
-            const user = await parseUser(tokenResponse);
-            const refreshHeaders = createJwtCookies(tokenResponse, user.sso.expires);
-            return { tokens: tokenResponse, refreshHeaders };
-        }
-        return { tokens: tokenResponse, refreshHeaders: [] };
-    }
-    async function getJwt(request) {
-        const { tokens } = await getTokenFromCookies(request);
-        if (!tokens)
-            return undefined;
-        return tokens.access_token;
-    }
-    function createCookie(name, value, expires) {
-        if (!configWithDefaults) {
-            throw new Error('Enterprise Standard SSO Manager not initialized');
-        }
-        name = `${configWithDefaults.cookies_prefix}.${name}`;
-        if (typeof value !== 'string') {
-            value = btoa(JSON.stringify(value));
-        }
-        let exp;
-        if (expires instanceof Date) {
-            exp = `Expires=${expires.toUTCString()}`;
-        }
-        else if (typeof expires === 'number') {
-            exp = `Max-Age=${expires}`;
-        }
-        else {
-            throw new Error('Invalid expires type', expires);
-        }
-        if (value.length > 4000) {
-            throw new Error(`Error setting cookie: ${name}. Cookie length is: ${value.length}`);
-        }
-        return `${name}=${value}; ${exp}; Path=${configWithDefaults.cookies_path}; HttpOnly;${configWithDefaults.cookies_secure ? ' Secure;' : ''} SameSite=${configWithDefaults.cookies_same_site};`;
-    }
-    function clearCookie(name) {
-        if (!configWithDefaults) {
-            throw new Error('Enterprise Standard SSO Manager not initialized');
-        }
-        return `${configWithDefaults.cookies_prefix}.${name}=; Max-Age=0; Path=${configWithDefaults.cookies_path}; HttpOnly;${configWithDefaults.cookies_secure ? ' Secure;' : ''} SameSite=${configWithDefaults.cookies_same_site};`;
-    }
-    function getCookie(name, req, parse = false) {
-        if (!configWithDefaults) {
-            throw new Error('Enterprise Standard SSO Manager not initialized');
-        }
-        const header = req.headers.get('cookie');
-        if (!header)
-            return null;
-        const cookie = header
-            .split(';')
-            .find((row) => row.trim().startsWith(`${configWithDefaults.cookies_prefix}.${name}=`));
-        if (!cookie)
-            return null;
-        const val = cookie.split('=')[1].trim();
-        if (!parse)
-            return val;
-        const str = atob(val);
-        return JSON.parse(str);
-    }
-    async function handler(request, es) {
-        const { loginUrl, userUrl, errorUrl, landingUrl, tokenUrl, refreshUrl, logoutUrl, logoutBackChannelUrl, jwksUrl, validation, } = { ...handlerDefaults, ...es?.sso };
-        if (!configWithDefaults) {
-            throw new Error('Enterprise Standard SSO Manager not initialized');
-        }
-        if (!loginUrl) {
-            console.error('loginUrl is required');
-        }
-        const path = new URL(request.url).pathname;
-        // Handle both absolute URLs and relative paths for redirect_uri
-        let redirectUriPath;
-        try {
-            // Try to parse as absolute URL first
-            redirectUriPath = new URL(configWithDefaults.redirect_uri).pathname;
-        }
-        catch {
-            // If it's not a valid URL, try to construct from request URL
-            try {
-                const requestUrl = new URL(request.url);
-                // If redirect_uri starts with //, it's a protocol-relative URL, treat as path
-                const redirectUri = configWithDefaults.redirect_uri.startsWith('//')
-                    ? configWithDefaults.redirect_uri.slice(1)
-                    : configWithDefaults.redirect_uri;
-                // Construct full URL from request origin + redirect_uri path
-                redirectUriPath = new URL(redirectUri, requestUrl.origin).pathname;
-            }
-            catch {
-                // Fallback: treat as path directly
-                redirectUriPath = configWithDefaults.redirect_uri.startsWith('/')
-                    ? configWithDefaults.redirect_uri
-                    : `/${configWithDefaults.redirect_uri}`;
-            }
-        }
-        if (redirectUriPath === path) {
-            return callbackHandler(request, validation);
-        }
-        if (loginUrl === path) {
-            return initiateLogin({
-                landingUrl: landingUrl || '/',
-                errorUrl,
-            }, request.url);
-        }
-        if (userUrl === path) {
-            const { tokens, refreshHeaders } = await getTokenFromCookies(request);
-            if (!tokens) {
-                return new Response('User not logged in', { status: 401 });
-            }
-            const user = await parseUser(tokens);
-            return new Response(JSON.stringify(user), {
-                headers: [['Content-Type', 'application/json'], ...refreshHeaders],
-            });
-        }
-        if (tokenUrl === path) {
-            const { tokens, refreshHeaders } = await getTokenFromCookies(request);
-            if (!tokens) {
-                return new Response('User not logged in', { status: 401 });
-            }
-            return new Response(JSON.stringify({
-                token: tokens.access_token,
-                expires: tokens.expires,
-            }), {
-                headers: [['Content-Type', 'application/json'], ...refreshHeaders],
-            });
-        }
-        if (refreshUrl === path) {
-            const refresh_token = getCookie('refresh', request);
-            if (!refresh_token) {
-                return new Response('User not logged in', { status: 401 });
-            }
-            // Force a token refresh
-            const newTokenResponse = await refreshToken(refresh_token);
-            const user = await parseUser(newTokenResponse);
-            const refreshHeaders = createJwtCookies(newTokenResponse, user.sso.expires);
-            return new Response('Refresh Complete', {
-                status: 200,
-                headers: refreshHeaders,
-            });
-        }
-        if (logoutUrl === path) {
-            return logout(request, { landingUrl: landingUrl || '/' });
-        }
-        if (logoutBackChannelUrl === path) {
-            return logoutBackChannel(request);
-        }
-        if (jwksUrl === path) {
-            const jwks = await fetchJwks();
-            return new Response(JSON.stringify(jwks), {
-                headers: [['Content-Type', 'application/json']],
-            });
-        }
-        return new Response('Not Found', { status: 404 });
-    }
-    if (!configWithDefaults) {
-        throw new Error('Enterprise Standard SSO Manager not initialized');
-    }
-    return {
-        ...configWithDefaults,
-        getUser,
-        getRequiredUser,
-        getJwt,
-        initiateLogin,
-        logout,
-        callbackHandler,
-        handler,
-    };
-}