@govcore/middleware 0.1.0 → 0.1.3

package/dist/index.d.ts

@@ -1,5 +1,6 @@
-import { NextResponse, type NextRequest } from 'next/server';
-export interface CreateMiddlewareOptions {
+import { NextRequest, NextResponse } from 'next/server';
+
+interface CreateMiddlewareOptions {
     /** Path prefixes reachable without a session. */
     publicPaths?: string[];
     /** Path prefixes that require an instance-level role. */
@@ -26,7 +27,8 @@ export interface CreateMiddlewareOptions {
  * value it can't resolve to a literal (it reports "Unknown identifier" /
  * "Invalid segment configuration export"). Copy the literal inline instead.
  */
-export declare const defaultMatcher: string[];
+declare const defaultMatcher: string[];
 /** Build a Next.js middleware function from GovCore's route-protection rules. */
-export declare function createMiddleware(opts?: CreateMiddlewareOptions): (req: NextRequest) => Promise<NextResponse>;
-//# sourceMappingURL=index.d.ts.map
+declare function createMiddleware(opts?: CreateMiddlewareOptions): (req: NextRequest) => Promise<NextResponse>;
+
+export { type CreateMiddlewareOptions, createMiddleware, defaultMatcher };

package/dist/index.js

@@ -1,99 +1,70 @@
-// @govcore/middleware — the edge-safe Next.js route-protection factory.
-//
-// Deliberately NOT next-auth's `auth()` wrapper: that re-issues (rolls) the
-// session cookie on its responses, making the middleware itself a resurrection
-// emitter that fights the #782 guard. `getToken` is a read-only decode — this
-// middleware never writes session cookies (ADR-0003). Edge-safe: token decode +
-// pure arithmetic, no DB. The only cross-package import is @govcore/auth's pure
-// `logout-marker` subpath (no next-auth/db pulled in).
-import { getToken } from 'next-auth/jwt';
-import { NextResponse } from 'next/server';
-import { LOGGED_OUT_MARKER_COOKIE, isResurrectedSession } from '@govcore/auth/logout-marker';
-const DEFAULT_PUBLIC_PATHS = ['/login', '/setup', '/error', '/api/auth', '/maintenance'];
-/**
- * Matcher that excludes static assets and the Auth.js endpoints (they manage
- * their own cookies). Provided as the canonical reference value.
- *
- * NOTE: do NOT use this directly in `export const config = { matcher }` — Next.js
- * statically parses the middleware `config` export at build time and rejects any
- * value it can't resolve to a literal (it reports "Unknown identifier" /
- * "Invalid segment configuration export"). Copy the literal inline instead.
- */
-export const defaultMatcher = ['/((?!_next/static|_next/image|favicon.ico|api/auth).*)'];
-/**
- * Absolute redirect that never echoes the container bind address (#807). Next
- * middleware requires an absolute Location; behind a TLS-terminating proxy the
- * request origin can be `0.0.0.0:3000`, which we rebuild from the forwarded host
- * or NEXT_PUBLIC_APP_URL.
- */
+// src/index.ts
+import { getToken } from "next-auth/jwt";
+import { NextResponse } from "next/server";
+import { LOGGED_OUT_MARKER_COOKIE, isResurrectedSession } from "@govcore/auth/logout-marker";
+var DEFAULT_PUBLIC_PATHS = ["/login", "/setup", "/error", "/api/auth", "/maintenance"];
+var defaultMatcher = ["/((?!_next/static|_next/image|favicon.ico|api/auth).*)"];
 function redirectTo(req, path) {
-    const target = new URL(path, req.nextUrl.origin);
-    if (target.hostname === '0.0.0.0') {
-        const fwdHost = req.headers.get('x-forwarded-host')?.split(',')[0].trim();
-        const fwdProto = req.headers.get('x-forwarded-proto')?.split(',')[0].trim();
-        const base = (fwdHost && !fwdHost.startsWith('0.0.0.0') && `${fwdProto || 'https'}://${fwdHost}`) ||
-            process.env.NEXT_PUBLIC_APP_URL ||
-            null;
-        if (base) {
-            try {
-                return NextResponse.redirect(new URL(path, base));
-            }
-            catch {
-                /* malformed base — fall through */
-            }
-        }
+  const target = new URL(path, req.nextUrl.origin);
+  if (target.hostname === "0.0.0.0") {
+    const fwdHost = req.headers.get("x-forwarded-host")?.split(",")[0].trim();
+    const fwdProto = req.headers.get("x-forwarded-proto")?.split(",")[0].trim();
+    const base = fwdHost && !fwdHost.startsWith("0.0.0.0") && `${fwdProto || "https"}://${fwdHost}` || process.env.NEXT_PUBLIC_APP_URL || null;
+    if (base) {
+      try {
+        return NextResponse.redirect(new URL(path, base));
+      } catch {
+      }
     }
-    return NextResponse.redirect(target);
+  }
+  return NextResponse.redirect(target);
 }
-/** Read-only session decode — checks both secure and plain cookie salts. */
 async function decodeSession(req, secret) {
-    return ((await getToken({ req, secret, secureCookie: true, salt: '__Secure-authjs.session-token' })) ??
-        (await getToken({ req, secret, secureCookie: false, salt: 'authjs.session-token' })));
+  return await getToken({ req, secret, secureCookie: true, salt: "__Secure-authjs.session-token" }) ?? await getToken({ req, secret, secureCookie: false, salt: "authjs.session-token" });
 }
-/** Build a Next.js middleware function from GovCore's route-protection rules. */
-export function createMiddleware(opts = {}) {
-    const publicPaths = opts.publicPaths ?? DEFAULT_PUBLIC_PATHS;
-    const instanceOnlyPaths = opts.instanceOnlyPaths ?? ['/instance'];
-    const instanceRole = opts.instanceRole ?? 'instance_admin';
-    const maintenanceBypassRole = opts.maintenanceBypassRole ?? 'admin';
-    const loginPath = opts.loginPath ?? '/login';
-    const maintenancePath = opts.maintenancePath ?? '/maintenance';
-    const homePath = opts.homePath ?? '/';
-    return async function middleware(req) {
-        const { pathname } = req.nextUrl;
-        const isPublic = publicPaths.some((p) => pathname.startsWith(p));
-        const isStatic = pathname.startsWith('/_next') || pathname === '/favicon.ico';
-        if (isPublic || isStatic)
-            return NextResponse.next();
-        const secret = opts.authSecret ?? process.env.AUTH_SECRET;
-        const token = await decodeSession(req, secret);
-        // #782 — post-logout resurrection guard. Reject (and actively delete) any
-        // session token issued before the logged-out marker (plus the guard window).
-        const loggedOutMarker = req.cookies.get(LOGGED_OUT_MARKER_COOKIE)?.value;
-        if (token && isResurrectedSession(loggedOutMarker, token.iat)) {
-            const res = redirectTo(req, loginPath);
-            for (const cookie of req.cookies.getAll()) {
-                if (cookie.name.includes('authjs.session-token')) {
-                    res.cookies.set(cookie.name, '', {
-                        maxAge: 0,
-                        expires: new Date(0),
-                        path: '/',
-                        secure: cookie.name.startsWith('__Secure-'),
-                    });
-                }
-            }
-            return res;
-        }
-        if (!token)
-            return redirectTo(req, loginPath);
-        const maintenanceMode = opts.maintenanceMode ?? process.env.MAINTENANCE_MODE === 'true';
-        if (maintenanceMode && token.role !== maintenanceBypassRole) {
-            return redirectTo(req, maintenancePath);
-        }
-        if (instanceOnlyPaths.some((p) => pathname.startsWith(p)) &&
-            token.instanceRole !== instanceRole) {
-            return redirectTo(req, homePath);
+function createMiddleware(opts = {}) {
+  const publicPaths = opts.publicPaths ?? DEFAULT_PUBLIC_PATHS;
+  const instanceOnlyPaths = opts.instanceOnlyPaths ?? ["/instance"];
+  const instanceRole = opts.instanceRole ?? "instance_admin";
+  const maintenanceBypassRole = opts.maintenanceBypassRole ?? "admin";
+  const loginPath = opts.loginPath ?? "/login";
+  const maintenancePath = opts.maintenancePath ?? "/maintenance";
+  const homePath = opts.homePath ?? "/";
+  return async function middleware(req) {
+    const { pathname } = req.nextUrl;
+    const isPublic = publicPaths.some((p) => pathname.startsWith(p));
+    const isStatic = pathname.startsWith("/_next") || pathname === "/favicon.ico";
+    if (isPublic || isStatic) return NextResponse.next();
+    const secret = opts.authSecret ?? process.env.AUTH_SECRET;
+    const token = await decodeSession(req, secret);
+    const loggedOutMarker = req.cookies.get(LOGGED_OUT_MARKER_COOKIE)?.value;
+    if (token && isResurrectedSession(loggedOutMarker, token.iat)) {
+      const res = redirectTo(req, loginPath);
+      for (const cookie of req.cookies.getAll()) {
+        if (cookie.name.includes("authjs.session-token")) {
+          res.cookies.set(cookie.name, "", {
+            maxAge: 0,
+            expires: /* @__PURE__ */ new Date(0),
+            path: "/",
+            secure: cookie.name.startsWith("__Secure-")
+          });
         }
-        return NextResponse.next();
-    };
+      }
+      return res;
+    }
+    if (!token) return redirectTo(req, loginPath);
+    const maintenanceMode = opts.maintenanceMode ?? process.env.MAINTENANCE_MODE === "true";
+    if (maintenanceMode && token.role !== maintenanceBypassRole) {
+      return redirectTo(req, maintenancePath);
+    }
+    if (instanceOnlyPaths.some((p) => pathname.startsWith(p)) && token.instanceRole !== instanceRole) {
+      return redirectTo(req, homePath);
+    }
+    return NextResponse.next();
+  };
 }
+export {
+  createMiddleware,
+  defaultMatcher
+};
+//# sourceMappingURL=index.js.map

package/dist/index.js.map

@@ -0,0 +1 @@
+{"version":3,"sources":["../src/index.ts"],"sourcesContent":["// @govcore/middleware — the edge-safe Next.js route-protection factory.\n//\n// Deliberately NOT next-auth's `auth()` wrapper: that re-issues (rolls) the\n// session cookie on its responses, making the middleware itself a resurrection\n// emitter that fights the #782 guard. `getToken` is a read-only decode — this\n// middleware never writes session cookies (ADR-0003). Edge-safe: token decode +\n// pure arithmetic, no DB. The only cross-package import is @govcore/auth's pure\n// `logout-marker` subpath (no next-auth/db pulled in).\n\nimport { getToken, type JWT } from 'next-auth/jwt'\nimport { NextResponse, type NextRequest } from 'next/server'\nimport { LOGGED_OUT_MARKER_COOKIE, isResurrectedSession } from '@govcore/auth/logout-marker'\n\nexport interface CreateMiddlewareOptions {\n  /** Path prefixes reachable without a session. */\n  publicPaths?: string[]\n  /** Path prefixes that require an instance-level role. */\n  instanceOnlyPaths?: string[]\n  /** The `instanceRole` value that satisfies instanceOnlyPaths. Default 'instance_admin'. */\n  instanceRole?: string\n  /** When true, only `maintenanceBypassRole` may pass; everyone else → maintenancePath. */\n  maintenanceMode?: boolean\n  /** Role allowed through during maintenance. Default 'admin'. */\n  maintenanceBypassRole?: string\n  loginPath?: string\n  maintenancePath?: string\n  /** Where instance-only violations are sent. Default '/'. */\n  homePath?: string\n  /** Auth.js secret. Defaults to process.env.AUTH_SECRET. */\n  authSecret?: string\n}\n\nconst DEFAULT_PUBLIC_PATHS = ['/login', '/setup', '/error', '/api/auth', '/maintenance']\n\n/**\n * Matcher that excludes static assets and the Auth.js endpoints (they manage\n * their own cookies). Provided as the canonical reference value.\n *\n * NOTE: do NOT use this directly in `export const config = { matcher }` — Next.js\n * statically parses the middleware `config` export at build time and rejects any\n * value it can't resolve to a literal (it reports \"Unknown identifier\" /\n * \"Invalid segment configuration export\"). Copy the literal inline instead.\n */\nexport const defaultMatcher = ['/((?!_next/static|_next/image|favicon.ico|api/auth).*)']\n\n/**\n * Absolute redirect that never echoes the container bind address (#807). Next\n * middleware requires an absolute Location; behind a TLS-terminating proxy the\n * request origin can be `0.0.0.0:3000`, which we rebuild from the forwarded host\n * or NEXT_PUBLIC_APP_URL.\n */\nfunction redirectTo(req: NextRequest, path: string): NextResponse {\n  const target = new URL(path, req.nextUrl.origin)\n  if (target.hostname === '0.0.0.0') {\n    const fwdHost = req.headers.get('x-forwarded-host')?.split(',')[0].trim()\n    const fwdProto = req.headers.get('x-forwarded-proto')?.split(',')[0].trim()\n    const base =\n      (fwdHost && !fwdHost.startsWith('0.0.0.0') && `${fwdProto || 'https'}://${fwdHost}`) ||\n      process.env.NEXT_PUBLIC_APP_URL ||\n      null\n    if (base) {\n      try {\n        return NextResponse.redirect(new URL(path, base))\n      } catch {\n        /* malformed base — fall through */\n      }\n    }\n  }\n  return NextResponse.redirect(target)\n}\n\n/** Read-only session decode — checks both secure and plain cookie salts. */\nasync function decodeSession(req: NextRequest, secret: string | undefined): Promise<JWT | null> {\n  return (\n    (await getToken({ req, secret, secureCookie: true, salt: '__Secure-authjs.session-token' })) ??\n    (await getToken({ req, secret, secureCookie: false, salt: 'authjs.session-token' }))\n  )\n}\n\n/** Build a Next.js middleware function from GovCore's route-protection rules. */\nexport function createMiddleware(opts: CreateMiddlewareOptions = {}) {\n  const publicPaths = opts.publicPaths ?? DEFAULT_PUBLIC_PATHS\n  const instanceOnlyPaths = opts.instanceOnlyPaths ?? ['/instance']\n  const instanceRole = opts.instanceRole ?? 'instance_admin'\n  const maintenanceBypassRole = opts.maintenanceBypassRole ?? 'admin'\n  const loginPath = opts.loginPath ?? '/login'\n  const maintenancePath = opts.maintenancePath ?? '/maintenance'\n  const homePath = opts.homePath ?? '/'\n\n  return async function middleware(req: NextRequest): Promise<NextResponse> {\n    const { pathname } = req.nextUrl\n\n    const isPublic = publicPaths.some((p) => pathname.startsWith(p))\n    const isStatic = pathname.startsWith('/_next') || pathname === '/favicon.ico'\n    if (isPublic || isStatic) return NextResponse.next()\n\n    const secret = opts.authSecret ?? process.env.AUTH_SECRET\n    const token = await decodeSession(req, secret)\n\n    // #782 — post-logout resurrection guard. Reject (and actively delete) any\n    // session token issued before the logged-out marker (plus the guard window).\n    const loggedOutMarker = req.cookies.get(LOGGED_OUT_MARKER_COOKIE)?.value\n    if (token && isResurrectedSession(loggedOutMarker, token.iat as number | undefined)) {\n      const res = redirectTo(req, loginPath)\n      for (const cookie of req.cookies.getAll()) {\n        if (cookie.name.includes('authjs.session-token')) {\n          res.cookies.set(cookie.name, '', {\n            maxAge: 0,\n            expires: new Date(0),\n            path: '/',\n            secure: cookie.name.startsWith('__Secure-'),\n          })\n        }\n      }\n      return res\n    }\n\n    if (!token) return redirectTo(req, loginPath)\n\n    const maintenanceMode = opts.maintenanceMode ?? process.env.MAINTENANCE_MODE === 'true'\n    if (maintenanceMode && token.role !== maintenanceBypassRole) {\n      return redirectTo(req, maintenancePath)\n    }\n\n    if (\n      instanceOnlyPaths.some((p) => pathname.startsWith(p)) &&\n      token.instanceRole !== instanceRole\n    ) {\n      return redirectTo(req, homePath)\n    }\n\n    return NextResponse.next()\n  }\n}\n"],"mappings":";AASA,SAAS,gBAA0B;AACnC,SAAS,oBAAsC;AAC/C,SAAS,0BAA0B,4BAA4B;AAqB/D,IAAM,uBAAuB,CAAC,UAAU,UAAU,UAAU,aAAa,cAAc;AAWhF,IAAM,iBAAiB,CAAC,wDAAwD;AAQvF,SAAS,WAAW,KAAkB,MAA4B;AAChE,QAAM,SAAS,IAAI,IAAI,MAAM,IAAI,QAAQ,MAAM;AAC/C,MAAI,OAAO,aAAa,WAAW;AACjC,UAAM,UAAU,IAAI,QAAQ,IAAI,kBAAkB,GAAG,MAAM,GAAG,EAAE,CAAC,EAAE,KAAK;AACxE,UAAM,WAAW,IAAI,QAAQ,IAAI,mBAAmB,GAAG,MAAM,GAAG,EAAE,CAAC,EAAE,KAAK;AAC1E,UAAM,OACH,WAAW,CAAC,QAAQ,WAAW,SAAS,KAAK,GAAG,YAAY,OAAO,MAAM,OAAO,MACjF,QAAQ,IAAI,uBACZ;AACF,QAAI,MAAM;AACR,UAAI;AACF,eAAO,aAAa,SAAS,IAAI,IAAI,MAAM,IAAI,CAAC;AAAA,MAClD,QAAQ;AAAA,MAER;AAAA,IACF;AAAA,EACF;AACA,SAAO,aAAa,SAAS,MAAM;AACrC;AAGA,eAAe,cAAc,KAAkB,QAAiD;AAC9F,SACG,MAAM,SAAS,EAAE,KAAK,QAAQ,cAAc,MAAM,MAAM,gCAAgC,CAAC,KACzF,MAAM,SAAS,EAAE,KAAK,QAAQ,cAAc,OAAO,MAAM,uBAAuB,CAAC;AAEtF;AAGO,SAAS,iBAAiB,OAAgC,CAAC,GAAG;AACnE,QAAM,cAAc,KAAK,eAAe;AACxC,QAAM,oBAAoB,KAAK,qBAAqB,CAAC,WAAW;AAChE,QAAM,eAAe,KAAK,gBAAgB;AAC1C,QAAM,wBAAwB,KAAK,yBAAyB;AAC5D,QAAM,YAAY,KAAK,aAAa;AACpC,QAAM,kBAAkB,KAAK,mBAAmB;AAChD,QAAM,WAAW,KAAK,YAAY;AAElC,SAAO,eAAe,WAAW,KAAyC;AACxE,UAAM,EAAE,SAAS,IAAI,IAAI;AAEzB,UAAM,WAAW,YAAY,KAAK,CAAC,MAAM,SAAS,WAAW,CAAC,CAAC;AAC/D,UAAM,WAAW,SAAS,WAAW,QAAQ,KAAK,aAAa;AAC/D,QAAI,YAAY,SAAU,QAAO,aAAa,KAAK;AAEnD,UAAM,SAAS,KAAK,cAAc,QAAQ,IAAI;AAC9C,UAAM,QAAQ,MAAM,cAAc,KAAK,MAAM;AAI7C,UAAM,kBAAkB,IAAI,QAAQ,IAAI,wBAAwB,GAAG;AACnE,QAAI,SAAS,qBAAqB,iBAAiB,MAAM,GAAyB,GAAG;AACnF,YAAM,MAAM,WAAW,KAAK,SAAS;AACrC,iBAAW,UAAU,IAAI,QAAQ,OAAO,GAAG;AACzC,YAAI,OAAO,KAAK,SAAS,sBAAsB,GAAG;AAChD,cAAI,QAAQ,IAAI,OAAO,MAAM,IAAI;AAAA,YAC/B,QAAQ;AAAA,YACR,SAAS,oBAAI,KAAK,CAAC;AAAA,YACnB,MAAM;AAAA,YACN,QAAQ,OAAO,KAAK,WAAW,WAAW;AAAA,UAC5C,CAAC;AAAA,QACH;AAAA,MACF;AACA,aAAO;AAAA,IACT;AAEA,QAAI,CAAC,MAAO,QAAO,WAAW,KAAK,SAAS;AAE5C,UAAM,kBAAkB,KAAK,mBAAmB,QAAQ,IAAI,qBAAqB;AACjF,QAAI,mBAAmB,MAAM,SAAS,uBAAuB;AAC3D,aAAO,WAAW,KAAK,eAAe;AAAA,IACxC;AAEA,QACE,kBAAkB,KAAK,CAAC,MAAM,SAAS,WAAW,CAAC,CAAC,KACpD,MAAM,iBAAiB,cACvB;AACA,aAAO,WAAW,KAAK,QAAQ;AAAA,IACjC;AAEA,WAAO,aAAa,KAAK;AAAA,EAC3B;AACF;","names":[]}

package/package.json

@@ -1,14 +1,14 @@
 {
   "name": "@govcore/middleware",
-  "version": "0.1.0",
+  "version": "0.1.3",
   "description": "Edge-safe Next.js middleware factory: read-only session decode, resurrection guard, instance/maintenance gating",
   "type": "module",
-  "main": "./src/index.ts",
-  "types": "./src/index.ts",
+  "main": "./dist/index.js",
+  "types": "./dist/index.d.ts",
   "exports": {
     ".": {
-      "types": "./src/index.ts",
-      "default": "./src/index.ts"
+      "types": "./dist/index.d.ts",
+      "default": "./dist/index.js"
     }
   },
   "publishConfig": {
@@ -16,17 +16,33 @@
   },
   "dependencies": {
     "next-auth": "^5.0.0-beta.25",
-    "@govcore/auth": "0.1.0"
+    "@govcore/auth": "0.3.1"
   },
   "peerDependencies": {
     "next": "^15.0.0"
   },
   "devDependencies": {
     "next": "^15.5.0",
-    "typescript": "^5.5.0"
+    "typescript": "^5.5.0",
+    "tsup": "^8.3.0"
+  },
+  "module": "./dist/index.js",
+  "files": [
+    "dist"
+  ],
+  "tsup": {
+    "entry": [
+      "src/index.ts"
+    ],
+    "format": [
+      "esm"
+    ],
+    "dts": true,
+    "clean": true,
+    "sourcemap": true
   },
   "scripts": {
-    "build": "tsc -p tsconfig.json",
-    "dev": "tsc -p tsconfig.json --watch"
+    "build": "tsup",
+    "dev": "tsup --watch"
   }
 }

package/CHANGELOG.md

@@ -1,26 +0,0 @@
-# @govcore/middleware
-
-## 0.1.0
-
-### Minor Changes
-
-- ca7cadb: Phase 3 — route protection and identity.
-
-  `@govcore/auth`: `createAuth` factory wrapping Auth.js (NextAuth v5) — injected
-  OIDC providers + local credentials (bcrypt), the Drizzle adapter over
-  `@govcore/schema`, the invite-based SSO provisioning guard, JWT/session callbacks
-  that stamp the active org/role from the membership model, login/logout audit, and
-  the resurrection-guard marker. Plus `hashPassword`/`verifyPassword`/`validatePassword`
-  and an edge-safe `./logout-marker` subpath. GovEA's product-specific per-org
-  policy (lockout/session-timeout/password-expiry) is intentionally not included.
-
-  `@govcore/middleware`: edge-safe `createMiddleware` factory — read-only `getToken`
-  decode (never writes cookies, ADR-0003), the #782 post-logout resurrection guard,
-  the #807 bind-address-safe redirect, and configurable public/instance-only/
-  maintenance gating, plus `defaultMatcher`.
-
-### Patch Changes
-
-- Updated dependencies [ca7cadb]
-- Updated dependencies [18bed9e]
-  - @govcore/auth@0.1.0

package/dist/index.d.ts.map

@@ -1 +0,0 @@
-{"version":3,"file":"index.d.ts","sourceRoot":"","sources":["../src/index.ts"],"names":[],"mappings":"AAUA,OAAO,EAAE,YAAY,EAAE,KAAK,WAAW,EAAE,MAAM,aAAa,CAAA;AAG5D,MAAM,WAAW,uBAAuB;IACtC,iDAAiD;IACjD,WAAW,CAAC,EAAE,MAAM,EAAE,CAAA;IACtB,yDAAyD;IACzD,iBAAiB,CAAC,EAAE,MAAM,EAAE,CAAA;IAC5B,2FAA2F;IAC3F,YAAY,CAAC,EAAE,MAAM,CAAA;IACrB,yFAAyF;IACzF,eAAe,CAAC,EAAE,OAAO,CAAA;IACzB,gEAAgE;IAChE,qBAAqB,CAAC,EAAE,MAAM,CAAA;IAC9B,SAAS,CAAC,EAAE,MAAM,CAAA;IAClB,eAAe,CAAC,EAAE,MAAM,CAAA;IACxB,4DAA4D;IAC5D,QAAQ,CAAC,EAAE,MAAM,CAAA;IACjB,2DAA2D;IAC3D,UAAU,CAAC,EAAE,MAAM,CAAA;CACpB;AAID;;;;;;;;GAQG;AACH,eAAO,MAAM,cAAc,UAA6D,CAAA;AAoCxF,iFAAiF;AACjF,wBAAgB,gBAAgB,CAAC,IAAI,GAAE,uBAA4B,IAShC,KAAK,WAAW,KAAG,OAAO,CAAC,YAAY,CAAC,CA4C1E"}

package/src/index.ts

@@ -1,134 +0,0 @@
-// @govcore/middleware — the edge-safe Next.js route-protection factory.
-//
-// Deliberately NOT next-auth's `auth()` wrapper: that re-issues (rolls) the
-// session cookie on its responses, making the middleware itself a resurrection
-// emitter that fights the #782 guard. `getToken` is a read-only decode — this
-// middleware never writes session cookies (ADR-0003). Edge-safe: token decode +
-// pure arithmetic, no DB. The only cross-package import is @govcore/auth's pure
-// `logout-marker` subpath (no next-auth/db pulled in).
-
-import { getToken, type JWT } from 'next-auth/jwt'
-import { NextResponse, type NextRequest } from 'next/server'
-import { LOGGED_OUT_MARKER_COOKIE, isResurrectedSession } from '@govcore/auth/logout-marker'
-
-export interface CreateMiddlewareOptions {
-  /** Path prefixes reachable without a session. */
-  publicPaths?: string[]
-  /** Path prefixes that require an instance-level role. */
-  instanceOnlyPaths?: string[]
-  /** The `instanceRole` value that satisfies instanceOnlyPaths. Default 'instance_admin'. */
-  instanceRole?: string
-  /** When true, only `maintenanceBypassRole` may pass; everyone else → maintenancePath. */
-  maintenanceMode?: boolean
-  /** Role allowed through during maintenance. Default 'admin'. */
-  maintenanceBypassRole?: string
-  loginPath?: string
-  maintenancePath?: string
-  /** Where instance-only violations are sent. Default '/'. */
-  homePath?: string
-  /** Auth.js secret. Defaults to process.env.AUTH_SECRET. */
-  authSecret?: string
-}
-
-const DEFAULT_PUBLIC_PATHS = ['/login', '/setup', '/error', '/api/auth', '/maintenance']
-
-/**
- * Matcher that excludes static assets and the Auth.js endpoints (they manage
- * their own cookies). Provided as the canonical reference value.
- *
- * NOTE: do NOT use this directly in `export const config = { matcher }` — Next.js
- * statically parses the middleware `config` export at build time and rejects any
- * value it can't resolve to a literal (it reports "Unknown identifier" /
- * "Invalid segment configuration export"). Copy the literal inline instead.
- */
-export const defaultMatcher = ['/((?!_next/static|_next/image|favicon.ico|api/auth).*)']
-
-/**
- * Absolute redirect that never echoes the container bind address (#807). Next
- * middleware requires an absolute Location; behind a TLS-terminating proxy the
- * request origin can be `0.0.0.0:3000`, which we rebuild from the forwarded host
- * or NEXT_PUBLIC_APP_URL.
- */
-function redirectTo(req: NextRequest, path: string): NextResponse {
-  const target = new URL(path, req.nextUrl.origin)
-  if (target.hostname === '0.0.0.0') {
-    const fwdHost = req.headers.get('x-forwarded-host')?.split(',')[0].trim()
-    const fwdProto = req.headers.get('x-forwarded-proto')?.split(',')[0].trim()
-    const base =
-      (fwdHost && !fwdHost.startsWith('0.0.0.0') && `${fwdProto || 'https'}://${fwdHost}`) ||
-      process.env.NEXT_PUBLIC_APP_URL ||
-      null
-    if (base) {
-      try {
-        return NextResponse.redirect(new URL(path, base))
-      } catch {
-        /* malformed base — fall through */
-      }
-    }
-  }
-  return NextResponse.redirect(target)
-}
-
-/** Read-only session decode — checks both secure and plain cookie salts. */
-async function decodeSession(req: NextRequest, secret: string | undefined): Promise<JWT | null> {
-  return (
-    (await getToken({ req, secret, secureCookie: true, salt: '__Secure-authjs.session-token' })) ??
-    (await getToken({ req, secret, secureCookie: false, salt: 'authjs.session-token' }))
-  )
-}
-
-/** Build a Next.js middleware function from GovCore's route-protection rules. */
-export function createMiddleware(opts: CreateMiddlewareOptions = {}) {
-  const publicPaths = opts.publicPaths ?? DEFAULT_PUBLIC_PATHS
-  const instanceOnlyPaths = opts.instanceOnlyPaths ?? ['/instance']
-  const instanceRole = opts.instanceRole ?? 'instance_admin'
-  const maintenanceBypassRole = opts.maintenanceBypassRole ?? 'admin'
-  const loginPath = opts.loginPath ?? '/login'
-  const maintenancePath = opts.maintenancePath ?? '/maintenance'
-  const homePath = opts.homePath ?? '/'
-
-  return async function middleware(req: NextRequest): Promise<NextResponse> {
-    const { pathname } = req.nextUrl
-
-    const isPublic = publicPaths.some((p) => pathname.startsWith(p))
-    const isStatic = pathname.startsWith('/_next') || pathname === '/favicon.ico'
-    if (isPublic || isStatic) return NextResponse.next()
-
-    const secret = opts.authSecret ?? process.env.AUTH_SECRET
-    const token = await decodeSession(req, secret)
-
-    // #782 — post-logout resurrection guard. Reject (and actively delete) any
-    // session token issued before the logged-out marker (plus the guard window).
-    const loggedOutMarker = req.cookies.get(LOGGED_OUT_MARKER_COOKIE)?.value
-    if (token && isResurrectedSession(loggedOutMarker, token.iat as number | undefined)) {
-      const res = redirectTo(req, loginPath)
-      for (const cookie of req.cookies.getAll()) {
-        if (cookie.name.includes('authjs.session-token')) {
-          res.cookies.set(cookie.name, '', {
-            maxAge: 0,
-            expires: new Date(0),
-            path: '/',
-            secure: cookie.name.startsWith('__Secure-'),
-          })
-        }
-      }
-      return res
-    }
-
-    if (!token) return redirectTo(req, loginPath)
-
-    const maintenanceMode = opts.maintenanceMode ?? process.env.MAINTENANCE_MODE === 'true'
-    if (maintenanceMode && token.role !== maintenanceBypassRole) {
-      return redirectTo(req, maintenancePath)
-    }
-
-    if (
-      instanceOnlyPaths.some((p) => pathname.startsWith(p)) &&
-      token.instanceRole !== instanceRole
-    ) {
-      return redirectTo(req, homePath)
-    }
-
-    return NextResponse.next()
-  }
-}