@geekapps/auth-nextjs 0.1.0

package/dist/server.js

@@ -0,0 +1,701 @@
+// src/server.ts
+import { cookies, headers } from "next/headers";
+import { redirect } from "next/navigation";
+import { NextResponse } from "next/server";
+import { createRemoteJWKSet, jwtVerify } from "jose";
+var MAX_ACCOUNTS = 8;
+function normalizeBaseUrl(url) {
+  return url.replace(/\/$/, "");
+}
+function normalizeBasePath(path = "/api/auth") {
+  if (!path.startsWith("/")) return `/${path}`;
+  return path.replace(/\/$/, "");
+}
+function createUrl(baseUrl, path) {
+  if (/^https?:\/\//.test(path)) return path;
+  const normalizedPath = path.startsWith("/") ? path : `/${path}`;
+  return `${normalizeBaseUrl(baseUrl)}${normalizedPath}`;
+}
+function env(name) {
+  const value = process.env[name];
+  return value && value.trim().length > 0 ? value : void 0;
+}
+function resolveIssuer(input) {
+  return normalizeBaseUrl(
+    input.issuer ?? env("GEEKAPPS_AUTH_ISSUER") ?? env("GEEKAPPS_AUTH_API_URL") ?? "http://localhost:3020"
+  );
+}
+function resolveClientId(input) {
+  return input.clientId ?? env("GEEKAPPS_AUTH_CLIENT_ID") ?? "";
+}
+function resolveClientSecret(input) {
+  return input.clientSecret ?? env("GEEKAPPS_AUTH_CLIENT_SECRET");
+}
+function applyServerClientCredentials(headers2, config) {
+  if (!config.clientId || !config.clientSecret) {
+    return;
+  }
+  headers2.set("x-geekapps-client-id", config.clientId);
+  headers2.set("x-geekapps-client-secret", config.clientSecret);
+}
+function resolveConfiguredRedirectUri(input) {
+  return input.redirectUri ?? env("GEEKAPPS_AUTH_REDIRECT_URI");
+}
+function hashClientId(clientId) {
+  let h = 5381;
+  for (let i = 0; i < clientId.length; i++) {
+    h = (h << 5) + h ^ clientId.charCodeAt(i) & 255;
+    h = h >>> 0;
+  }
+  return h.toString(16).padStart(8, "0");
+}
+function deriveCookiePrefix(clientId) {
+  if (!clientId) return "gk";
+  return `gk_${hashClientId(clientId)}`;
+}
+function requestOrigin(request) {
+  const forwardedProto = request.headers.get("x-forwarded-proto");
+  const forwardedHost = request.headers.get("x-forwarded-host");
+  const host = forwardedHost ?? request.headers.get("host");
+  if (host) {
+    return `${forwardedProto ?? request.nextUrl.protocol.replace(":", "")}://${host}`;
+  }
+  return request.nextUrl.origin;
+}
+function resolveRedirectUri(config, request) {
+  return config.redirectUri ?? `${requestOrigin(request)}${config.basePath}/callback`;
+}
+function tokenFromResponse(data) {
+  return {
+    accessToken: data.accessToken ?? data.access_token ?? data.tokens?.accessToken ?? data.tokens?.access_token ?? null,
+    refreshToken: data.refreshToken ?? data.refresh_token ?? data.tokens?.refreshToken ?? data.tokens?.refresh_token ?? null,
+    idToken: data.idToken ?? data.id_token ?? data.tokens?.idToken ?? data.tokens?.id_token ?? null,
+    sessionId: data.sessionId ?? data.session_id ?? data.tokens?.sessionId ?? data.tokens?.session_id ?? null
+  };
+}
+function decodeJwtPayload(token) {
+  try {
+    const parts = token.split(".");
+    if (parts.length < 2) return null;
+    const payload = parts[1];
+    if (!payload) return null;
+    return JSON.parse(Buffer.from(payload, "base64url").toString("utf8"));
+  } catch {
+    return null;
+  }
+}
+function parseAccountFromJwt(tokens) {
+  if (!tokens.accessToken) return null;
+  const jwtToParse = tokens.idToken ?? tokens.accessToken;
+  const payload = decodeJwtPayload(jwtToParse);
+  if (!payload) return null;
+  const sub = typeof payload.sub === "string" ? payload.sub : null;
+  const id = sub ?? tokens.sessionId;
+  if (!id) return null;
+  return {
+    id,
+    accessToken: tokens.accessToken,
+    refreshToken: tokens.refreshToken,
+    idToken: tokens.idToken ?? null,
+    sessionId: tokens.sessionId,
+    user: {
+      sub: id,
+      name: typeof payload.name === "string" ? payload.name : null,
+      email: typeof payload.email === "string" ? payload.email : null,
+      picture: typeof payload.picture === "string" ? payload.picture : null,
+      phone: typeof payload.phone_number === "string" ? payload.phone_number : null
+    }
+  };
+}
+function getCookieNames(prefix) {
+  return {
+    active: `${prefix}_active`,
+    count: `${prefix}_count`,
+    activeOrganizationId: `${prefix}_ao`,
+    tokenPub: `${prefix}_tp`,
+    slotMeta: (n) => `${prefix}_m${n}`,
+    slotAt: (n) => `${prefix}_at${n}`,
+    slotRt: (n) => `${prefix}_rt${n}`
+  };
+}
+function encodeMeta(account) {
+  const m = { id: account.id };
+  if (account.sessionId) m.sid = account.sessionId;
+  if (account.user.name) m.n = account.user.name;
+  if (account.user.email) m.e = account.user.email;
+  if (account.user.picture) m.p = account.user.picture;
+  return Buffer.from(JSON.stringify(m), "utf8").toString("base64url");
+}
+function decodeMeta(value) {
+  try {
+    const m = JSON.parse(Buffer.from(value, "base64url").toString("utf8"));
+    return m.id ? m : null;
+  } catch {
+    return null;
+  }
+}
+function getCookieOptions(config) {
+  return {
+    httpOnly: true,
+    secure: config.secureCookies ?? process.env.NODE_ENV === "production",
+    sameSite: "lax",
+    path: "/",
+    ...config.cookieDomain ? { domain: config.cookieDomain } : {}
+  };
+}
+async function readBody(request) {
+  const text = await request.text();
+  if (!text) return void 0;
+  try {
+    return JSON.parse(text);
+  } catch {
+    return text;
+  }
+}
+function appendSearchParams(url, request) {
+  const target = new URL(url);
+  request.nextUrl.searchParams.forEach((value, key) => {
+    target.searchParams.set(key, value);
+  });
+  return target.toString();
+}
+function routeFromRequest(request, basePath) {
+  const pathname = request.nextUrl.pathname;
+  if (!pathname.startsWith(basePath)) return pathname;
+  const route = pathname.slice(basePath.length);
+  return route || "/";
+}
+function isJsonResponse(response) {
+  return response.headers.get("content-type")?.includes("application/json");
+}
+async function responseFromApi(response) {
+  if (response.status === 204) return new NextResponse(null, { status: 204 });
+  const body = isJsonResponse(response) ? await response.json().catch(() => null) : await response.text();
+  return NextResponse.json(body, { status: response.status });
+}
+var _remoteJWKSCache = /* @__PURE__ */ new Map();
+function getRemoteJWKS(issuer) {
+  if (!_remoteJWKSCache.has(issuer)) {
+    _remoteJWKSCache.set(issuer, createRemoteJWKSet(new URL(`${issuer}/.well-known/jwks.json`)));
+  }
+  return _remoteJWKSCache.get(issuer);
+}
+async function verifyToken(token, issuer) {
+  try {
+    const { payload } = await jwtVerify(token, getRemoteJWKS(issuer), {
+      algorithms: ["RS256"],
+      issuer
+    });
+    return payload;
+  } catch {
+    return null;
+  }
+}
+function configureGeekappsAuth(input = {}) {
+  const clientId = resolveClientId(input);
+  const config = {
+    ...input,
+    issuer: resolveIssuer(input),
+    clientId,
+    clientSecret: resolveClientSecret(input),
+    redirectUri: resolveConfiguredRedirectUri(input),
+    afterSignInRedirectTo: input.afterSignInRedirectTo ?? input.redirectTo ?? "/",
+    basePath: normalizeBasePath(input.basePath),
+    cookiePrefix: deriveCookiePrefix(clientId)
+  };
+  const cn = getCookieNames(config.cookiePrefix);
+  async function getCount() {
+    const cookieStore = await cookies();
+    const raw = cookieStore.get(cn.count)?.value;
+    const n = raw ? Number.parseInt(raw, 10) : 0;
+    return Number.isNaN(n) ? 0 : n;
+  }
+  async function getActiveIndex() {
+    const cookieStore = await cookies();
+    const raw = cookieStore.get(cn.active)?.value;
+    if (!raw) return 0;
+    const n = Number.parseInt(raw, 10);
+    return Number.isNaN(n) ? 0 : n;
+  }
+  function readSlot(cookieStore, n) {
+    const at = cookieStore.get(cn.slotAt(n))?.value;
+    if (!at) return null;
+    const meta = decodeMeta(cookieStore.get(cn.slotMeta(n))?.value ?? "");
+    if (!meta) return null;
+    return {
+      id: meta.id,
+      accessToken: at,
+      refreshToken: cookieStore.get(cn.slotRt(n))?.value ?? null,
+      idToken: null,
+      // not stored in cookies; claims are in meta
+      sessionId: meta.sid ?? null,
+      user: {
+        sub: meta.id,
+        name: meta.n ?? null,
+        email: meta.e ?? null,
+        picture: meta.p ?? null
+      }
+    };
+  }
+  function writeSlot(cookieStore, n, account) {
+    const opts = { ...getCookieOptions(config), maxAge: 60 * 60 * 24 * 30 };
+    cookieStore.set(cn.slotMeta(n), encodeMeta(account), opts);
+    cookieStore.set(cn.slotAt(n), account.accessToken, opts);
+    if (account.refreshToken) cookieStore.set(cn.slotRt(n), account.refreshToken, opts);
+  }
+  function clearSlot(cookieStore, n) {
+    const clear = { ...getCookieOptions(config), maxAge: 0 };
+    cookieStore.set(cn.slotMeta(n), "", clear);
+    cookieStore.set(cn.slotAt(n), "", clear);
+    cookieStore.set(cn.slotRt(n), "", clear);
+  }
+  async function getAccountsList() {
+    const [cookieStore, count] = await Promise.all([cookies(), getCount()]);
+    const accounts = [];
+    for (let i = 1; i <= count; i++) {
+      const slot = readSlot(cookieStore, i);
+      if (slot) accounts.push(slot);
+    }
+    return accounts;
+  }
+  async function getActiveAccount() {
+    const [cookieStore, activeIdx, count] = await Promise.all([cookies(), getActiveIndex(), getCount()]);
+    if (count === 0) return null;
+    if (activeIdx >= 1 && activeIdx <= count) {
+      const slot = readSlot(cookieStore, activeIdx);
+      if (slot) return slot;
+    }
+    return readSlot(cookieStore, 1);
+  }
+  async function getAccessToken() {
+    const active = await getActiveAccount();
+    return active?.accessToken ?? null;
+  }
+  async function getRefreshToken() {
+    const active = await getActiveAccount();
+    return active?.refreshToken ?? null;
+  }
+  async function getSession() {
+    const active = await getActiveAccount();
+    if (!active) return null;
+    return {
+      accessToken: active.accessToken,
+      refreshToken: active.refreshToken,
+      idToken: active.idToken,
+      sessionId: active.sessionId
+    };
+  }
+  async function getUser() {
+    const active = await getActiveAccount();
+    return active?.user ?? null;
+  }
+  async function getOrganizations() {
+    const cookieStore = await cookies();
+    const currentOrgId = cookieStore.get(cn.activeOrganizationId)?.value ?? null;
+    try {
+      const data = await apiRequest("/organizations");
+      const organizations = Array.isArray(data) ? data : data.organizations;
+      return { organizations, currentOrgId };
+    } catch {
+      return { organizations: [], currentOrgId };
+    }
+  }
+  function clearPublicTokenCookie(cookieStore) {
+    if (cookieStore.get(cn.tokenPub)?.value) {
+      cookieStore.set(cn.tokenPub, "", { httpOnly: false, maxAge: 0, path: "/" });
+    }
+  }
+  async function saveAccountToList(tokens) {
+    const account = parseAccountFromJwt(tokens);
+    if (!account) return;
+    const cookieStore = await cookies();
+    const opts = { ...getCookieOptions(config), maxAge: 60 * 60 * 24 * 30 };
+    const count = await getCount();
+    let targetSlot = 0;
+    for (let i = 1; i <= count; i++) {
+      const existing = readSlot(cookieStore, i);
+      if (existing?.id === account.id) {
+        targetSlot = i;
+        break;
+      }
+    }
+    if (targetSlot === 0) {
+      if (count >= MAX_ACCOUNTS) return;
+      targetSlot = count + 1;
+      cookieStore.set(cn.count, String(targetSlot), opts);
+    }
+    writeSlot(cookieStore, targetSlot, account);
+    cookieStore.set(cn.active, String(targetSlot), opts);
+    clearPublicTokenCookie(cookieStore);
+  }
+  const setSessionCookies = saveAccountToList;
+  async function switchAccount(accountId) {
+    const [cookieStore, count] = await Promise.all([cookies(), getCount()]);
+    const opts = { ...getCookieOptions(config), maxAge: 60 * 60 * 24 * 30 };
+    for (let i = 1; i <= count; i++) {
+      const slot = readSlot(cookieStore, i);
+      if (slot && (slot.id === accountId || slot.sessionId === accountId)) {
+        cookieStore.set(cn.active, String(i), opts);
+        clearPublicTokenCookie(cookieStore);
+        return true;
+      }
+    }
+    return false;
+  }
+  async function removeActiveAccount() {
+    const [cookieStore, activeIdx, count] = await Promise.all([cookies(), getActiveIndex(), getCount()]);
+    const opts = { ...getCookieOptions(config), maxAge: 60 * 60 * 24 * 30 };
+    const clear = { ...getCookieOptions(config), maxAge: 0 };
+    if (count === 0) return;
+    const remaining = [];
+    for (let i = 1; i <= count; i++) {
+      if (i === activeIdx) continue;
+      const slot = readSlot(cookieStore, i);
+      if (slot) remaining.push(slot);
+    }
+    for (let i = 1; i <= count; i++) {
+      clearSlot(cookieStore, i);
+    }
+    if (remaining.length === 0) {
+      cookieStore.set(cn.count, "0", clear);
+      cookieStore.set(cn.active, "0", clear);
+      await clearPublicTokenCookie(cookieStore);
+      return;
+    }
+    for (let i = 0; i < remaining.length; i++) {
+      await writeSlot(cookieStore, i + 1, remaining[i]);
+    }
+    cookieStore.set(cn.count, String(remaining.length), opts);
+    cookieStore.set(cn.active, "1", opts);
+    clearPublicTokenCookie(cookieStore);
+  }
+  async function clearAllSessionCookies() {
+    const [cookieStore, count] = await Promise.all([cookies(), getCount()]);
+    const clear = { ...getCookieOptions(config), maxAge: 0 };
+    for (let i = 1; i <= count; i++) {
+      clearSlot(cookieStore, i);
+    }
+    cookieStore.set(cn.count, "0", clear);
+    cookieStore.set(cn.active, "0", clear);
+    clearPublicTokenCookie(cookieStore);
+  }
+  async function tryRefreshTokens() {
+    const refreshToken = await getRefreshToken();
+    if (!refreshToken || !config.clientId) return null;
+    const basicAuth = Buffer.from(`${config.clientId}:${config.clientSecret ?? ""}`).toString("base64");
+    const response = await fetch(createUrl(config.issuer, "/auth/refresh"), {
+      method: "POST",
+      headers: {
+        "content-type": "application/x-www-form-urlencoded",
+        authorization: `Basic ${basicAuth}`
+      },
+      body: new URLSearchParams({
+        grant_type: "refresh_token",
+        refresh_token: refreshToken
+      }),
+      cache: "no-store"
+    });
+    if (!response.ok) return null;
+    const data = await response.json().catch(() => null);
+    if (!data) return null;
+    const tokens = tokenFromResponse(data);
+    if (!tokens.accessToken) return null;
+    await saveAccountToList(tokens);
+    return tokens.accessToken;
+  }
+  async function apiRequest(path, init = {}) {
+    const accessToken = await getAccessToken();
+    const requestHeaders = new Headers(init.headers);
+    if (accessToken) requestHeaders.set("authorization", `Bearer ${accessToken}`);
+    applyServerClientCredentials(requestHeaders, config);
+    if (init.body !== void 0 && !requestHeaders.has("content-type")) {
+      requestHeaders.set("content-type", "application/json");
+    }
+    const response = await fetch(createUrl(config.issuer, path), {
+      ...init,
+      headers: requestHeaders,
+      cache: "no-store"
+    });
+    if (response.status === 401) {
+      const newAccessToken = await tryRefreshTokens();
+      if (newAccessToken) {
+        const retryHeaders = new Headers(init.headers);
+        retryHeaders.set("authorization", `Bearer ${newAccessToken}`);
+        applyServerClientCredentials(retryHeaders, config);
+        if (init.body !== void 0 && !retryHeaders.has("content-type")) {
+          retryHeaders.set("content-type", "application/json");
+        }
+        const retryResponse = await fetch(createUrl(config.issuer, path), {
+          ...init,
+          headers: retryHeaders,
+          cache: "no-store"
+        });
+        if (!retryResponse.ok) {
+          const error = await retryResponse.json().catch(() => null);
+          throw new Error(error?.error_description ?? error?.error ?? error?.message ?? `Auth API error ${retryResponse.status}`);
+        }
+        if (retryResponse.status === 204) return null;
+        return await retryResponse.json();
+      }
+    }
+    if (!response.ok) {
+      const error = await response.json().catch(() => null);
+      throw new Error(error?.error_description ?? error?.error ?? error?.message ?? `Auth API error ${response.status}`);
+    }
+    if (response.status === 204) return null;
+    return await response.json();
+  }
+  function createApiClient() {
+    return {
+      get: (path) => apiRequest(path),
+      post: (path, body) => apiRequest(path, { method: "POST", body: body === void 0 ? void 0 : JSON.stringify(body) }),
+      patch: (path, body) => apiRequest(path, { method: "PATCH", body: body === void 0 ? void 0 : JSON.stringify(body) }),
+      put: (path, body) => apiRequest(path, { method: "PUT", body: body === void 0 ? void 0 : JSON.stringify(body) }),
+      delete: (path) => apiRequest(path, { method: "DELETE" })
+    };
+  }
+  async function requireUser(options = {}) {
+    const accessToken = await getAccessToken();
+    if (!accessToken) {
+      redirect(options.redirectTo ?? "/");
+    }
+    return accessToken;
+  }
+  function createAuthorizeRedirect(request, mode) {
+    const redirectTo = request.nextUrl.searchParams.get("redirectTo") ?? config.afterSignInRedirectTo ?? "/";
+    const flowId = request.nextUrl.searchParams.get("flow_id");
+    const url = new URL(createUrl(config.issuer, mode === "google" ? "/auth/google" : "/authorize"));
+    if (!config.clientId) {
+      return NextResponse.json(
+        { error: "missing_client_id", message: "Missing GEEKAPPS_AUTH_CLIENT_ID or clientId." },
+        { status: 500 }
+      );
+    }
+    url.searchParams.set("client_id", config.clientId);
+    url.searchParams.set("redirect_uri", resolveRedirectUri(config, request));
+    url.searchParams.set("response_type", "code");
+    url.searchParams.set("scope", (config.scopes ?? ["openid", "profile", "email"]).join(" "));
+    url.searchParams.set("state", Buffer.from(JSON.stringify({ redirectTo, mode })).toString("base64url"));
+    if (mode === "register") url.searchParams.set("screen_hint", "signup");
+    if (mode === "add-account") url.searchParams.set("prompt", "login");
+    if (flowId) url.searchParams.set("flow_id", flowId);
+    return NextResponse.redirect(url);
+  }
+  async function exchangeCode(request) {
+    const code = request.nextUrl.searchParams.get("code");
+    const state = request.nextUrl.searchParams.get("state");
+    if (!code) return NextResponse.redirect(new URL("/error?error=missing_code", request.url));
+    if (!config.clientId) {
+      return NextResponse.json(
+        { error: "missing_client_id", message: "Missing GEEKAPPS_AUTH_CLIENT_ID or clientId." },
+        { status: 500 }
+      );
+    }
+    const basicAuth = Buffer.from(
+      `${config.clientId}:${config.clientSecret ?? ""}`
+    ).toString("base64");
+    const response = await fetch(createUrl(config.issuer, "/auth/token"), {
+      method: "POST",
+      headers: {
+        "content-type": "application/x-www-form-urlencoded",
+        authorization: `Basic ${basicAuth}`
+      },
+      body: new URLSearchParams({
+        grant_type: "authorization_code",
+        code,
+        redirect_uri: resolveRedirectUri(config, request)
+      }),
+      cache: "no-store"
+    });
+    const data = await response.json().catch(() => ({}));
+    if (!response.ok) {
+      return NextResponse.json(data, { status: response.status });
+    }
+    await saveAccountToList(tokenFromResponse(data));
+    let redirectTo = config.afterSignInRedirectTo ?? "/";
+    if (state) {
+      try {
+        const parsed = JSON.parse(Buffer.from(state, "base64url").toString("utf8"));
+        redirectTo = parsed.redirectTo ?? redirectTo;
+      } catch {
+      }
+    }
+    return NextResponse.redirect(new URL(redirectTo, request.url));
+  }
+  function mapLocalPathToApiPath(route) {
+    if (route === "/me") return "/auth/me";
+    if (route === "/accounts/switch") return "/auth/accounts/switch";
+    if (route === "/organizations/active") return "/auth/organizations/active";
+    if (route === "/permissions/check") return "/auth/permissions/check";
+    if (route === "/login/password") return "/auth/login/password";
+    if (route === "/register/password") return "/auth/register/password";
+    if (route === "/passwordless/link") return "/auth/passwordless/link";
+    return route;
+  }
+  async function handleAccountsLocal() {
+    const [accounts, activeIdx] = await Promise.all([getAccountsList(), getActiveIndex()]);
+    return NextResponse.json({
+      accounts: accounts.map((a, i) => ({
+        id: a.id,
+        sessionId: a.sessionId ?? a.id,
+        isActive: i + 1 === activeIdx,
+        user: {
+          id: a.user.sub,
+          name: a.user.name ?? null,
+          email: a.user.email ?? null,
+          imageUrl: a.user.picture ?? null,
+          phone: a.user.phone ?? null
+        }
+      }))
+    });
+  }
+  async function handleOrganizationsLocal() {
+    const cookieStore = await cookies();
+    const activeOrgId = cookieStore.get(cn.activeOrganizationId)?.value ?? null;
+    try {
+      const data = await apiRequest("/auth/organizations");
+      const organizations = Array.isArray(data) ? data : data.organizations;
+      return NextResponse.json({ organizations, currentOrgId: activeOrgId });
+    } catch {
+      return NextResponse.json({ organizations: [], currentOrgId: activeOrgId });
+    }
+  }
+  async function handleSwitchAccountLocal(request) {
+    const body = await readBody(request);
+    const targetId = body && typeof body === "object" ? String(
+      body.accountId ?? body.sessionId ?? ""
+    ) : "";
+    if (!targetId) {
+      return NextResponse.json({ error: "accountId required" }, { status: 400 });
+    }
+    const switched = await switchAccount(targetId);
+    if (!switched) {
+      return NextResponse.json({ error: "Account not found" }, { status: 404 });
+    }
+    return NextResponse.json({ ok: true });
+  }
+  async function proxy(request, route) {
+    const accessToken = await getAccessToken();
+    const body = ["GET", "HEAD"].includes(request.method) ? void 0 : await readBody(request);
+    const url = appendSearchParams(createUrl(config.issuer, mapLocalPathToApiPath(route)), request);
+    const requestHeaders = new Headers();
+    if (accessToken) requestHeaders.set("authorization", `Bearer ${accessToken}`);
+    applyServerClientCredentials(requestHeaders, config);
+    if (body !== void 0) requestHeaders.set("content-type", "application/json");
+    const response = await fetch(url, {
+      method: request.method,
+      headers: requestHeaders,
+      body: body === void 0 ? void 0 : typeof body === "string" ? body : JSON.stringify(body),
+      cache: "no-store"
+    });
+    const data = isJsonResponse(response) ? await response.json().catch(() => null) : null;
+    if (data) {
+      const tokens = tokenFromResponse(data);
+      if (tokens.accessToken || tokens.refreshToken || tokens.idToken || tokens.sessionId) {
+        await saveAccountToList(tokens);
+      }
+      return NextResponse.json(data, { status: response.status });
+    }
+    return responseFromApi(response);
+  }
+  async function handle(request) {
+    const route = routeFromRequest(request, config.basePath);
+    if (request.method === "GET" && route === "/sign-in") return createAuthorizeRedirect(request, "login");
+    if (request.method === "GET" && route === "/sign-up") return createAuthorizeRedirect(request, "register");
+    if (request.method === "GET" && route === "/add-account") return createAuthorizeRedirect(request, "add-account");
+    if (request.method === "GET" && route === "/login/google") return createAuthorizeRedirect(request, "google");
+    if (request.method === "GET" && route === "/callback") return exchangeCode(request);
+    if (request.method === "GET" && route === "/token") {
+      const accessToken = await getAccessToken();
+      if (!accessToken) return NextResponse.json({ error: "missing_token" }, { status: 401 });
+      return NextResponse.json({ accessToken });
+    }
+    if (request.method === "GET" && route === "/accounts") return handleAccountsLocal();
+    if (request.method === "POST" && route === "/accounts/switch") return handleSwitchAccountLocal(request);
+    if (request.method === "GET" && route === "/organizations") return handleOrganizationsLocal();
+    if (request.method === "POST" && route === "/organizations") {
+      const accessToken = await getAccessToken();
+      const body = await readBody(request);
+      if (body && accessToken && !body.applicationId) {
+        const claims = decodeJwtPayload(accessToken);
+        const applicationId = (typeof claims?.application_id === "string" ? claims.application_id : null) ?? (typeof claims?.client_id === "string" ? claims.client_id : null) ?? (typeof claims?.applicationId === "string" ? claims.applicationId : null);
+        if (applicationId) body.applicationId = applicationId;
+      }
+      const url = createUrl(config.issuer, "/organizations");
+      const requestHeaders = new Headers();
+      if (accessToken) requestHeaders.set("authorization", `Bearer ${accessToken}`);
+      applyServerClientCredentials(requestHeaders, config);
+      if (body !== void 0) requestHeaders.set("content-type", "application/json");
+      const response = await fetch(url, {
+        method: "POST",
+        headers: requestHeaders,
+        body: JSON.stringify(body),
+        cache: "no-store"
+      });
+      return responseFromApi(response);
+    }
+    if (request.method === "POST" && route === "/sign-out") {
+      await apiRequest("/auth/sign-out", { method: "POST" }).catch(() => null);
+      await removeActiveAccount();
+      return NextResponse.json({ ok: true });
+    }
+    if (request.method === "POST" && route === "/sign-out-all") {
+      await apiRequest("/auth/sign-out-all", { method: "POST" }).catch(() => null);
+      await clearAllSessionCookies();
+      return NextResponse.json({ ok: true });
+    }
+    if (request.method === "POST" && route === "/organizations/active") {
+      const body = await readBody(request);
+      const organizationId = body && typeof body === "object" && "organizationId" in body ? body.organizationId : null;
+      const response = NextResponse.json({ ok: true });
+      if (typeof organizationId === "string") {
+        const cookieOpts = {
+          httpOnly: true,
+          sameSite: "lax",
+          path: "/",
+          secure: process.env.NODE_ENV === "production",
+          maxAge: 60 * 60 * 24 * 7
+        };
+        response.cookies.set(cn.activeOrganizationId, organizationId, cookieOpts);
+      }
+      return response;
+    }
+    return proxy(request, route);
+  }
+  return {
+    handlers: {
+      GET: handle,
+      POST: handle,
+      PATCH: handle,
+      DELETE: handle
+    },
+    GetSession: getSession,
+    GetUser: getUser,
+    GetOrganizations: getOrganizations,
+    SaveSession: saveAccountToList,
+    GetAccessToken: getAccessToken,
+    GetRefreshToken: getRefreshToken,
+    TryRefreshTokens: tryRefreshTokens,
+    RequireUser: requireUser,
+    CreateAuthApiClient: createApiClient,
+    cookiePrefix: config.cookiePrefix,
+    VerifyToken: (token) => verifyToken(token, config.issuer),
+    SignInUrl: async (redirectTo) => {
+      const headerStore = await headers();
+      const host = headerStore.get("host") ?? "localhost";
+      const protocol = headerStore.get("x-forwarded-proto") ?? "http";
+      const url = new URL(`${protocol}://${host}${config.basePath}/sign-in`);
+      if (redirectTo) url.searchParams.set("redirectTo", redirectTo);
+      return url.toString();
+    }
+  };
+}
+function handlers(options) {
+  return configureGeekappsAuth(options).handlers;
+}
+export {
+  configureGeekappsAuth,
+  handlers,
+  verifyToken
+};
+//# sourceMappingURL=server.js.map