@iaurelius/accounts-nextjs 0.1.0

package/dist/cookies.js

@@ -0,0 +1,94 @@
+// The session lives in the browser, encrypted (JWE dir + A256GCM) with a key derived from the app's
+// secret: the tokens never reach JavaScript, and nobody can read or forge the cookie without the key.
+import { EncryptJWT, jwtDecrypt } from "jose";
+const enc = new TextEncoder();
+const keys = new Map();
+/** 256 bits for A256GCM from the secret (HKDF-SHA256), per purpose. */
+function keyFor(secret, purpose) {
+    const id = `${purpose}\u0000${secret}`;
+    let k = keys.get(id);
+    if (!k) {
+        k = (async () => {
+            const ikm = await crypto.subtle.importKey("raw", enc.encode(secret), "HKDF", false, ["deriveBits"]);
+            const bits = await crypto.subtle.deriveBits({ name: "HKDF", hash: "SHA-256", salt: enc.encode("@iaurelius/accounts-nextjs"), info: enc.encode(`${purpose} v1`) }, ikm, 256);
+            return new Uint8Array(bits);
+        })();
+        keys.set(id, k);
+    }
+    return k;
+}
+export async function seal(payload, secret, purpose, maxAgeSeconds) {
+    return new EncryptJWT(payload)
+        .setProtectedHeader({ alg: "dir", enc: "A256GCM" })
+        .setIssuedAt()
+        .setExpirationTime(Math.floor(Date.now() / 1000) + maxAgeSeconds)
+        .encrypt(await keyFor(secret, purpose));
+}
+/** The payload, or null for anything not sealed by us for this purpose, or expired. */
+export async function unseal(value, secret, purpose) {
+    if (!value)
+        return null;
+    try {
+        return (await jwtDecrypt(value, await keyFor(secret, purpose), { keyManagementAlgorithms: ["dir"], contentEncryptionAlgorithms: ["A256GCM"] })).payload;
+    }
+    catch {
+        return null;
+    }
+}
+export function parseCookies(header) {
+    const out = new Map();
+    for (const part of (header ?? "").split(";")) {
+        const i = part.indexOf("=");
+        if (i < 1)
+            continue;
+        const name = part.slice(0, i).trim();
+        if (!out.has(name))
+            out.set(name, part.slice(i + 1).trim());
+    }
+    return out;
+}
+export function serialize(name, value, o) {
+    const parts = [`${name}=${value}`, `Path=${o.path ?? "/"}`, "SameSite=Lax"];
+    if (o.httpOnly !== false)
+        parts.push("HttpOnly");
+    if (o.secure)
+        parts.push("Secure");
+    if (o.maxAge !== undefined)
+        parts.push(`Max-Age=${Math.max(0, Math.floor(o.maxAge))}`);
+    return parts.join("; ");
+}
+/** Browsers keep up to ~4 KB per cookie: a bigger session is split into name.0, name.1… */
+const CHUNK = 3800;
+/** The Set-Cookie headers that store `value` under `name` (chunked if needed) and drop the chunks it no longer uses. */
+export function writeChunked(name, value, existing, o) {
+    const out = [];
+    const chunks = value.length > CHUNK ? Array.from({ length: Math.ceil(value.length / CHUNK) }, (_, i) => value.slice(i * CHUNK, (i + 1) * CHUNK)) : null;
+    if (chunks) {
+        chunks.forEach((c, i) => out.push(serialize(`${name}.${i}`, c, o)));
+        if (existing.has(name))
+            out.push(serialize(name, "", { ...o, maxAge: 0 }));
+    }
+    else {
+        out.push(serialize(name, value, o));
+    }
+    for (const k of existing.keys()) {
+        const m = k.startsWith(`${name}.`) ? Number(k.slice(name.length + 1)) : NaN;
+        if (Number.isInteger(m) && (!chunks || m >= chunks.length))
+            out.push(serialize(k, "", { ...o, maxAge: 0 }));
+    }
+    return out;
+}
+export function readChunked(name, cookies) {
+    const whole = cookies.get(name);
+    if (whole)
+        return whole;
+    const parts = [];
+    for (let i = 0; cookies.has(`${name}.${i}`); i++)
+        parts.push(cookies.get(`${name}.${i}`));
+    return parts.length ? parts.join("") : undefined;
+}
+/** Set-Cookie headers that remove `name` and every chunk of it. */
+export function clearChunked(name, existing, o) {
+    return [...existing.keys()].filter((k) => k === name || /^\d+$/.test(k.slice(name.length + 1)) && k.startsWith(`${name}.`)).map((k) => serialize(k, "", { ...o, maxAge: 0 }));
+}
+//# sourceMappingURL=cookies.js.map

package/dist/cookies.js.map

@@ -0,0 +1 @@
+{"version":3,"file":"cookies.js","sourceRoot":"","sources":["../src/cookies.ts"],"names":[],"mappings":"AAAA,oGAAoG;AACpG,sGAAsG;AACtG,OAAO,EAAE,UAAU,EAAE,UAAU,EAAmB,MAAM,MAAM,CAAC;AAE/D,MAAM,GAAG,GAAG,IAAI,WAAW,EAAE,CAAC;AAC9B,MAAM,IAAI,GAAG,IAAI,GAAG,EAA+B,CAAC;AAEpD,uEAAuE;AACvE,SAAS,MAAM,CAAC,MAAc,EAAE,OAAe;IAC7C,MAAM,EAAE,GAAG,GAAG,OAAO,SAAS,MAAM,EAAE,CAAC;IACvC,IAAI,CAAC,GAAG,IAAI,CAAC,GAAG,CAAC,EAAE,CAAC,CAAC;IACrB,IAAI,CAAC,CAAC,EAAE,CAAC;QACP,CAAC,GAAG,CAAC,KAAK,IAAI,EAAE;YACd,MAAM,GAAG,GAAG,MAAM,MAAM,CAAC,MAAM,CAAC,SAAS,CAAC,KAAK,EAAE,GAAG,CAAC,MAAM,CAAC,MAAM,CAAC,EAAE,MAAM,EAAE,KAAK,EAAE,CAAC,YAAY,CAAC,CAAC,CAAC;YACpG,MAAM,IAAI,GAAG,MAAM,MAAM,CAAC,MAAM,CAAC,UAAU,CAAC,EAAE,IAAI,EAAE,MAAM,EAAE,IAAI,EAAE,SAAS,EAAE,IAAI,EAAE,GAAG,CAAC,MAAM,CAAC,4BAA4B,CAAC,EAAE,IAAI,EAAE,GAAG,CAAC,MAAM,CAAC,GAAG,OAAO,KAAK,CAAC,EAAE,EAAE,GAAG,EAAE,GAAG,CAAC,CAAC;YAC5K,OAAO,IAAI,UAAU,CAAC,IAAI,CAAC,CAAC;QAC9B,CAAC,CAAC,EAAE,CAAC;QACL,IAAI,CAAC,GAAG,CAAC,EAAE,EAAE,CAAC,CAAC,CAAC;IAClB,CAAC;IACD,OAAO,CAAC,CAAC;AACX,CAAC;AAED,MAAM,CAAC,KAAK,UAAU,IAAI,CAAC,OAAmB,EAAE,MAAc,EAAE,OAAe,EAAE,aAAqB;IACpG,OAAO,IAAI,UAAU,CAAC,OAAO,CAAC;SAC3B,kBAAkB,CAAC,EAAE,GAAG,EAAE,KAAK,EAAE,GAAG,EAAE,SAAS,EAAE,CAAC;SAClD,WAAW,EAAE;SACb,iBAAiB,CAAC,IAAI,CAAC,KAAK,CAAC,IAAI,CAAC,GAAG,EAAE,GAAG,IAAI,CAAC,GAAG,aAAa,CAAC;SAChE,OAAO,CAAC,MAAM,MAAM,CAAC,MAAM,EAAE,OAAO,CAAC,CAAC,CAAC;AAC5C,CAAC;AAED,uFAAuF;AACvF,MAAM,CAAC,KAAK,UAAU,MAAM,CAAuB,KAAyB,EAAE,MAAc,EAAE,OAAe;IAC3G,IAAI,CAAC,KAAK;QAAE,OAAO,IAAI,CAAC;IACxB,IAAI,CAAC;QACH,OAAO,CAAC,MAAM,UAAU,CAAC,KAAK,EAAE,MAAM,MAAM,CAAC,MAAM,EAAE,OAAO,CAAC,EAAE,EAAE,uBAAuB,EAAE,CAAC,KAAK,CAAC,EAAE,2BAA2B,EAAE,CAAC,SAAS,CAAC,EAAE,CAAC,CAAC,CAAC,OAAY,CAAC;IAC/J,CAAC;IAAC,MAAM,CAAC;QACP,OAAO,IAAI,CAAC;IACd,CAAC;AACH,CAAC;AAKD,MAAM,UAAU,YAAY,CAAC,MAAiC;IAC5D,MAAM,GAAG,GAAG,IAAI,GAAG,EAAkB,CAAC;IACtC,KAAK,MAAM,IAAI,IAAI,CAAC,MAAM,IAAI,EAAE,CAAC,CAAC,KAAK,CAAC,GAAG,CAAC,EAAE,CAAC;QAC7C,MAAM,CAAC,GAAG,IAAI,CAAC,OAAO,CAAC,GAAG,CAAC,CAAC;QAC5B,IAAI,CAAC,GAAG,CAAC;YAAE,SAAS;QACpB,MAAM,IAAI,GAAG,IAAI,CAAC,KAAK,CAAC,CAAC,EAAE,CAAC,CAAC,CAAC,IAAI,EAAE,CAAC;QACrC,IAAI,CAAC,GAAG,CAAC,GAAG,CAAC,IAAI,CAAC;YAAE,GAAG,CAAC,GAAG,CAAC,IAAI,EAAE,IAAI,CAAC,KAAK,CAAC,CAAC,GAAG,CAAC,CAAC,CAAC,IAAI,EAAE,CAAC,CAAC;IAC9D,CAAC;IACD,OAAO,GAAG,CAAC;AACb,CAAC;AAED,MAAM,UAAU,SAAS,CAAC,IAAY,EAAE,KAAa,EAAE,CAAgB;IACrE,MAAM,KAAK,GAAG,CAAC,GAAG,IAAI,IAAI,KAAK,EAAE,EAAE,QAAQ,CAAC,CAAC,IAAI,IAAI,GAAG,EAAE,EAAE,cAAc,CAAC,CAAC;IAC5E,IAAI,CAAC,CAAC,QAAQ,KAAK,KAAK;QAAE,KAAK,CAAC,IAAI,CAAC,UAAU,CAAC,CAAC;IACjD,IAAI,CAAC,CAAC,MAAM;QAAE,KAAK,CAAC,IAAI,CAAC,QAAQ,CAAC,CAAC;IACnC,IAAI,CAAC,CAAC,MAAM,KAAK,SAAS;QAAE,KAAK,CAAC,IAAI,CAAC,WAAW,IAAI,CAAC,GAAG,CAAC,CAAC,EAAE,IAAI,CAAC,KAAK,CAAC,CAAC,CAAC,MAAM,CAAC,CAAC,EAAE,CAAC,CAAC;IACvF,OAAO,KAAK,CAAC,IAAI,CAAC,IAAI,CAAC,CAAC;AAC1B,CAAC;AAED,2FAA2F;AAC3F,MAAM,KAAK,GAAG,IAAI,CAAC;AAEnB,wHAAwH;AACxH,MAAM,UAAU,YAAY,CAAC,IAAY,EAAE,KAAa,EAAE,QAA6B,EAAE,CAAgB;IACvG,MAAM,GAAG,GAAa,EAAE,CAAC;IACzB,MAAM,MAAM,GAAG,KAAK,CAAC,MAAM,GAAG,KAAK,CAAC,CAAC,CAAC,KAAK,CAAC,IAAI,CAAC,EAAE,MAAM,EAAE,IAAI,CAAC,IAAI,CAAC,KAAK,CAAC,MAAM,GAAG,KAAK,CAAC,EAAE,EAAE,CAAC,CAAC,EAAE,CAAC,EAAE,EAAE,CAAC,KAAK,CAAC,KAAK,CAAC,CAAC,GAAG,KAAK,EAAE,CAAC,CAAC,GAAG,CAAC,CAAC,GAAG,KAAK,CAAC,CAAC,CAAC,CAAC,CAAC,IAAI,CAAC;IACxJ,IAAI,MAAM,EAAE,CAAC;QACX,MAAM,CAAC,OAAO,CAAC,CAAC,CAAC,EAAE,CAAC,EAAE,EAAE,CAAC,GAAG,CAAC,IAAI,CAAC,SAAS,CAAC,GAAG,IAAI,IAAI,CAAC,EAAE,EAAE,CAAC,EAAE,CAAC,CAAC,CAAC,CAAC,CAAC;QACpE,IAAI,QAAQ,CAAC,GAAG,CAAC,IAAI,CAAC;YAAE,GAAG,CAAC,IAAI,CAAC,SAAS,CAAC,IAAI,EAAE,EAAE,EAAE,EAAE,GAAG,CAAC,EAAE,MAAM,EAAE,CAAC,EAAE,CAAC,CAAC,CAAC;IAC7E,CAAC;SAAM,CAAC;QACN,GAAG,CAAC,IAAI,CAAC,SAAS,CAAC,IAAI,EAAE,KAAK,EAAE,CAAC,CAAC,CAAC,CAAC;IACtC,CAAC;IACD,KAAK,MAAM,CAAC,IAAI,QAAQ,CAAC,IAAI,EAAE,EAAE,CAAC;QAChC,MAAM,CAAC,GAAG,CAAC,CAAC,UAAU,CAAC,GAAG,IAAI,GAAG,CAAC,CAAC,CAAC,CAAC,MAAM,CAAC,CAAC,CAAC,KAAK,CAAC,IAAI,CAAC,MAAM,GAAG,CAAC,CAAC,CAAC,CAAC,CAAC,CAAC,GAAG,CAAC;QAC5E,IAAI,MAAM,CAAC,SAAS,CAAC,CAAC,CAAC,IAAI,CAAC,CAAC,MAAM,IAAI,CAAC,IAAI,MAAM,CAAC,MAAM,CAAC;YAAE,GAAG,CAAC,IAAI,CAAC,SAAS,CAAC,CAAC,EAAE,EAAE,EAAE,EAAE,GAAG,CAAC,EAAE,MAAM,EAAE,CAAC,EAAE,CAAC,CAAC,CAAC;IAC9G,CAAC;IACD,OAAO,GAAG,CAAC;AACb,CAAC;AAED,MAAM,UAAU,WAAW,CAAC,IAAY,EAAE,OAA4B;IACpE,MAAM,KAAK,GAAG,OAAO,CAAC,GAAG,CAAC,IAAI,CAAC,CAAC;IAChC,IAAI,KAAK;QAAE,OAAO,KAAK,CAAC;IACxB,MAAM,KAAK,GAAa,EAAE,CAAC;IAC3B,KAAK,IAAI,CAAC,GAAG,CAAC,EAAE,OAAO,CAAC,GAAG,CAAC,GAAG,IAAI,IAAI,CAAC,EAAE,CAAC,EAAE,CAAC,EAAE;QAAE,KAAK,CAAC,IAAI,CAAC,OAAO,CAAC,GAAG,CAAC,GAAG,IAAI,IAAI,CAAC,EAAE,CAAE,CAAC,CAAC;IAC3F,OAAO,KAAK,CAAC,MAAM,CAAC,CAAC,CAAC,KAAK,CAAC,IAAI,CAAC,EAAE,CAAC,CAAC,CAAC,CAAC,SAAS,CAAC;AACnD,CAAC;AAED,mEAAmE;AACnE,MAAM,UAAU,YAAY,CAAC,IAAY,EAAE,QAA6B,EAAE,CAAgB;IACxF,OAAO,CAAC,GAAG,QAAQ,CAAC,IAAI,EAAE,CAAC,CAAC,MAAM,CAAC,CAAC,CAAC,EAAE,EAAE,CAAC,CAAC,KAAK,IAAI,IAAI,OAAO,CAAC,IAAI,CAAC,CAAC,CAAC,KAAK,CAAC,IAAI,CAAC,MAAM,GAAG,CAAC,CAAC,CAAC,IAAI,CAAC,CAAC,UAAU,CAAC,GAAG,IAAI,GAAG,CAAC,CAAC,CAAC,GAAG,CAAC,CAAC,CAAC,EAAE,EAAE,CAAC,SAAS,CAAC,CAAC,EAAE,EAAE,EAAE,EAAE,GAAG,CAAC,EAAE,MAAM,EAAE,CAAC,EAAE,CAAC,CAAC,CAAC;AAChL,CAAC"}

package/dist/handlers.d.ts

@@ -0,0 +1,8 @@
+import type { AccountsConfig } from "./config.js";
+export declare const originOf: (req: Request, cfg: AccountsConfig) => string;
+export declare const isSecure: (origin: string) => boolean;
+/** Only paths of this app: never another origin (no open redirect). */
+export declare function safeReturnPath(v: string | null, origin: string): string;
+/** The response for a request under basePath, or null if it is not one of ours. */
+export declare function handleAccountsRoute(req: Request, cfg: AccountsConfig): Promise<Response | null>;
+//# sourceMappingURL=handlers.d.ts.map

package/dist/handlers.d.ts.map

@@ -0,0 +1 @@
+{"version":3,"file":"handlers.d.ts","sourceRoot":"","sources":["../src/handlers.ts"],"names":[],"mappings":"AAIA,OAAO,KAAK,EAAE,cAAc,EAAE,MAAM,aAAa,CAAC;AAOlD,eAAO,MAAM,QAAQ,QAAS,OAAO,OAAO,cAAc,WAA0C,CAAC;AACrG,eAAO,MAAM,QAAQ,WAAY,MAAM,YAAkC,CAAC;AAE1E,uEAAuE;AACvE,wBAAgB,cAAc,CAAC,CAAC,EAAE,MAAM,GAAG,IAAI,EAAE,MAAM,EAAE,MAAM,GAAG,MAAM,CAWvE;AAoGD,mFAAmF;AACnF,wBAAsB,mBAAmB,CAAC,GAAG,EAAE,OAAO,EAAE,GAAG,EAAE,cAAc,GAAG,OAAO,CAAC,QAAQ,GAAG,IAAI,CAAC,CAqBrG"}

package/dist/handlers.js

@@ -0,0 +1,157 @@
+// The routes the SDK answers under basePath (/api/accounts), with Fetch API requests and responses:
+// sign-in, sign-up, callback, sign-out, session and token. The proxy calls them; no route files.
+import { verifyIdToken } from "@iaurelius/accounts";
+import { OAuthError, authorizationUrl, endSessionUrl, exchangeCode, pkce, randomString, revokeToken } from "@iaurelius/accounts/oidc";
+import { parseCookies, seal, serialize, unseal } from "./cookies.js";
+import { clearSession, infoOf, profileOf, readSession, resolveSession, writeSession } from "./session.js";
+const TX_COOKIE = "__accounts_tx_";
+const TX_MAX_AGE = 600;
+export const originOf = (req, cfg) => cfg.appUrl ?? new URL(req.url).origin;
+export const isSecure = (origin) => origin.startsWith("https://");
+/** Only paths of this app: never another origin (no open redirect). */
+export function safeReturnPath(v, origin) {
+    if (!v)
+        return "/";
+    try {
+        const u = new URL(v, origin);
+        const path = u.pathname + u.search + u.hash;
+        // Checked on the resolved path: "/.//evil.test" resolves to "//evil.test", another site for a browser.
+        if (u.origin !== origin || /^\/[\\/]/.test(path))
+            return "/";
+        return path;
+    }
+    catch {
+        return "/";
+    }
+}
+const noStore = { "cache-control": "no-store" };
+function redirect(location, setCookies = [], status = 303) {
+    const h = new Headers({ location, ...noStore });
+    for (const c of setCookies)
+        h.append("set-cookie", c);
+    return new Response(null, { status, headers: h });
+}
+function json(body, status = 200, setCookies = []) {
+    const h = new Headers({ "content-type": "application/json", ...noStore });
+    for (const c of setCookies)
+        h.append("set-cookie", c);
+    return new Response(JSON.stringify(body), { status, headers: h });
+}
+const escape = (s) => s.replace(/[&<>"']/g, (c) => `&#${c.charCodeAt(0)};`);
+/** A plain page that says what went wrong and how to try again. */
+function errorPage(code, message, retry, setCookies = []) {
+    const h = new Headers({ "content-type": "text/html; charset=utf-8", ...noStore });
+    for (const c of setCookies)
+        h.append("set-cookie", c);
+    const body = `<!doctype html><meta charset="utf-8"><meta name="viewport" content="width=device-width,initial-scale=1"><title>Sign-in failed</title><body style="font:16px/1.5 system-ui,sans-serif;max-width:32rem;margin:15vh auto;padding:0 16px"><h1 style="font-size:1.4rem">Sign-in failed</h1><p>${escape(message)}</p><p style="color:#666;font:13px ui-monospace,monospace">${escape(code)}</p><p><a href="${escape(retry)}">Try again</a></p></body>`;
+    return new Response(body, { status: 400, headers: h });
+}
+async function signIn(req, cfg, prompt) {
+    const origin = originOf(req, cfg);
+    const url = new URL(req.url);
+    const returnTo = safeReturnPath(url.searchParams.get("redirect_url"), origin);
+    const { verifier, challenge } = await pkce();
+    const state = randomString(24);
+    const nonce = randomString(24);
+    const tx = await seal({ typ: "tx", state, nonce, verifier, returnTo }, cfg.cookieSecret, "tx", TX_MAX_AGE);
+    // One cookie per sign-in: two tabs signing in at once do not overwrite each other.
+    const cookie = serialize(`${TX_COOKIE}${state.slice(0, 16)}`, tx, { secure: isSecure(origin), maxAge: TX_MAX_AGE, path: cfg.basePath });
+    const location = authorizationUrl({ issuer: cfg.issuer, clientId: cfg.clientId, redirectUri: `${origin}${cfg.basePath}/callback`, state, nonce, codeChallenge: challenge, resource: cfg.audience, prompt });
+    return redirect(location, [cookie], 302);
+}
+async function callback(req, cfg) {
+    const origin = originOf(req, cfg);
+    const secure = isSecure(origin);
+    const q = new URL(req.url).searchParams;
+    const state = q.get("state") ?? "";
+    const cookies = parseCookies(req.headers.get("cookie"));
+    const txName = `${TX_COOKIE}${state.slice(0, 16)}`;
+    const tx = state ? await unseal(cookies.get(txName), cfg.cookieSecret, "tx") : null;
+    const retry = `${cfg.basePath}/sign-in`;
+    const dropTx = [serialize(txName, "", { secure, maxAge: 0, path: cfg.basePath })];
+    if (!tx || tx.typ !== "tx" || tx.state !== state)
+        return errorPage("invalid_state", "This sign-in expired or was started in another browser. Start again from the app.", retry, dropTx);
+    const back = `${retry}?redirect_url=${encodeURIComponent(tx.returnTo)}`;
+    const error = q.get("error");
+    if (error) {
+        // Closing the hosted page is not an error: back where the person was.
+        if (error === "access_denied")
+            return redirect(`${origin}${tx.returnTo}`, dropTx);
+        return errorPage(error, q.get("error_description") ?? "The sign-in was not completed.", back, dropTx);
+    }
+    // RFC 9207: the answer must come from our application (Accounts always sends iss).
+    if (q.get("iss") !== cfg.issuer)
+        return errorPage("invalid_issuer", "The answer did not come from this app's sign-in.", back, dropTx);
+    const code = q.get("code");
+    if (!code)
+        return errorPage("invalid_request", "The answer has no code.", back, dropTx);
+    let session;
+    try {
+        const t = await exchangeCode({ issuer: cfg.issuer, clientId: cfg.clientId, clientSecret: cfg.clientSecret, fetch: cfg.fetch }, { code, redirectUri: `${origin}${cfg.basePath}/callback`, codeVerifier: tx.verifier, resource: cfg.audience });
+        if (!t.idToken)
+            throw new OAuthError("invalid_response", "No ID token: the app needs the openid scope.");
+        await verifyIdToken(t.idToken, { issuer: cfg.issuer, clientId: cfg.clientId, nonce: tx.nonce, fetch: cfg.fetch });
+        session = { at: t.accessToken, rt: t.refreshToken, it: t.idToken, exp: t.expiresAt, u: await profileOf(cfg, t.accessToken) };
+    }
+    catch (e) {
+        const oe = e instanceof OAuthError ? e : new OAuthError("server_error", "Could not complete the sign-in.");
+        return errorPage(oe.error, oe.message, back, dropTx);
+    }
+    // Absolute: Next's proxy refuses a relative Location.
+    return redirect(`${origin}${tx.returnTo}`, [...dropTx, ...(await writeSession(session, cookies, cfg, secure))]);
+}
+async function signOut(req, cfg) {
+    const origin = originOf(req, cfg);
+    // Only this app's own pages may sign someone out (a form POST from anywhere else is CSRF).
+    if (req.headers.get("origin") !== origin)
+        return json({ error: "forbidden", error_description: "Sign out from the app's own pages." }, 403);
+    const cookies = parseCookies(req.headers.get("cookie"));
+    const s = await readSession(cookies, cfg);
+    const cleared = clearSession(cookies, cfg, isSecure(origin));
+    const after = `${origin}${cfg.afterSignOutPath}`;
+    if (!s)
+        return redirect(after, cleared);
+    if (s.rt)
+        await revokeToken({ issuer: cfg.issuer, clientId: cfg.clientId, clientSecret: cfg.clientSecret, fetch: cfg.fetch }, { token: s.rt, hint: "refresh_token" });
+    // Also closes the session on the hosted pages, and comes back here.
+    return redirect(endSessionUrl({ issuer: cfg.issuer, clientId: cfg.clientId, idTokenHint: s.it, postLogoutRedirectUri: after }), cleared);
+}
+/** GET session: who is signed in, for the browser. GET token: the access token, for calling your API. */
+async function sessionRoute(req, cfg, withToken) {
+    const origin = originOf(req, cfg);
+    // Readable by this app's pages only (a script elsewhere cannot read it anyway: no CORS; this is belt and braces).
+    const site = req.headers.get("sec-fetch-site");
+    if (withToken && site && site !== "same-origin")
+        return json({ error: "forbidden" }, 403);
+    const cookies = parseCookies(req.headers.get("cookie"));
+    const { session, setCookies } = await resolveSession(cookies, cfg, isSecure(origin));
+    const info = session ? infoOf(session) : null;
+    if (withToken)
+        return session ? json({ token: session.at, expiresAt: session.exp }, 200, setCookies) : json({ token: null }, 401, setCookies);
+    return json(info ? { isSignedIn: true, ...info } : { isSignedIn: false }, 200, setCookies);
+}
+/** The response for a request under basePath, or null if it is not one of ours. */
+export async function handleAccountsRoute(req, cfg) {
+    const path = new URL(req.url).pathname;
+    if (!path.startsWith(`${cfg.basePath}/`))
+        return null;
+    const route = path.slice(cfg.basePath.length);
+    const get = req.method === "GET" || req.method === "HEAD";
+    switch (route) {
+        case "/sign-in":
+            return get ? signIn(req, cfg) : json({ error: "method_not_allowed" }, 405);
+        case "/sign-up":
+            return get ? signIn(req, cfg, "create") : json({ error: "method_not_allowed" }, 405);
+        case "/callback":
+            return get ? callback(req, cfg) : json({ error: "method_not_allowed" }, 405);
+        case "/sign-out":
+            return req.method === "POST" ? signOut(req, cfg) : json({ error: "method_not_allowed", error_description: "Sign out with a POST (<SignOutButton />)." }, 405);
+        case "/session":
+            return get ? sessionRoute(req, cfg, false) : json({ error: "method_not_allowed" }, 405);
+        case "/token":
+            return get ? sessionRoute(req, cfg, true) : json({ error: "method_not_allowed" }, 405);
+        default:
+            return json({ error: "not_found" }, 404);
+    }
+}
+//# sourceMappingURL=handlers.js.map

package/dist/handlers.js.map

@@ -0,0 +1 @@
+{"version":3,"file":"handlers.js","sourceRoot":"","sources":["../src/handlers.ts"],"names":[],"mappings":"AAAA,oGAAoG;AACpG,iGAAiG;AACjG,OAAO,EAAE,aAAa,EAAE,MAAM,qBAAqB,CAAC;AACpD,OAAO,EAAE,UAAU,EAAE,gBAAgB,EAAE,aAAa,EAAE,YAAY,EAAE,IAAI,EAAE,YAAY,EAAE,WAAW,EAAE,MAAM,0BAA0B,CAAC;AAEtI,OAAO,EAAE,YAAY,EAAE,IAAI,EAAE,SAAS,EAAE,MAAM,EAAE,MAAM,cAAc,CAAC;AACrE,OAAO,EAAE,YAAY,EAAE,MAAM,EAAE,SAAS,EAAE,WAAW,EAAE,cAAc,EAAE,YAAY,EAAgB,MAAM,cAAc,CAAC;AAExH,MAAM,SAAS,GAAG,gBAAgB,CAAC;AACnC,MAAM,UAAU,GAAG,GAAG,CAAC;AAEvB,MAAM,CAAC,MAAM,QAAQ,GAAG,CAAC,GAAY,EAAE,GAAmB,EAAE,EAAE,CAAC,GAAG,CAAC,MAAM,IAAI,IAAI,GAAG,CAAC,GAAG,CAAC,GAAG,CAAC,CAAC,MAAM,CAAC;AACrG,MAAM,CAAC,MAAM,QAAQ,GAAG,CAAC,MAAc,EAAE,EAAE,CAAC,MAAM,CAAC,UAAU,CAAC,UAAU,CAAC,CAAC;AAE1E,uEAAuE;AACvE,MAAM,UAAU,cAAc,CAAC,CAAgB,EAAE,MAAc;IAC7D,IAAI,CAAC,CAAC;QAAE,OAAO,GAAG,CAAC;IACnB,IAAI,CAAC;QACH,MAAM,CAAC,GAAG,IAAI,GAAG,CAAC,CAAC,EAAE,MAAM,CAAC,CAAC;QAC7B,MAAM,IAAI,GAAG,CAAC,CAAC,QAAQ,GAAG,CAAC,CAAC,MAAM,GAAG,CAAC,CAAC,IAAI,CAAC;QAC5C,uGAAuG;QACvG,IAAI,CAAC,CAAC,MAAM,KAAK,MAAM,IAAI,UAAU,CAAC,IAAI,CAAC,IAAI,CAAC;YAAE,OAAO,GAAG,CAAC;QAC7D,OAAO,IAAI,CAAC;IACd,CAAC;IAAC,MAAM,CAAC;QACP,OAAO,GAAG,CAAC;IACb,CAAC;AACH,CAAC;AAED,MAAM,OAAO,GAAG,EAAE,eAAe,EAAE,UAAU,EAAE,CAAC;AAChD,SAAS,QAAQ,CAAC,QAAgB,EAAE,UAAU,GAAa,EAAE,EAAE,MAAM,GAAG,GAAG;IACzE,MAAM,CAAC,GAAG,IAAI,OAAO,CAAC,EAAE,QAAQ,EAAE,GAAG,OAAO,EAAE,CAAC,CAAC;IAChD,KAAK,MAAM,CAAC,IAAI,UAAU;QAAE,CAAC,CAAC,MAAM,CAAC,YAAY,EAAE,CAAC,CAAC,CAAC;IACtD,OAAO,IAAI,QAAQ,CAAC,IAAI,EAAE,EAAE,MAAM,EAAE,OAAO,EAAE,CAAC,EAAE,CAAC,CAAC;AACpD,CAAC;AACD,SAAS,IAAI,CAAC,IAAa,EAAE,MAAM,GAAG,GAAG,EAAE,UAAU,GAAa,EAAE;IAClE,MAAM,CAAC,GAAG,IAAI,OAAO,CAAC,EAAE,cAAc,EAAE,kBAAkB,EAAE,GAAG,OAAO,EAAE,CAAC,CAAC;IAC1E,KAAK,MAAM,CAAC,IAAI,UAAU;QAAE,CAAC,CAAC,MAAM,CAAC,YAAY,EAAE,CAAC,CAAC,CAAC;IACtD,OAAO,IAAI,QAAQ,CAAC,IAAI,CAAC,SAAS,CAAC,IAAI,CAAC,EAAE,EAAE,MAAM,EAAE,OAAO,EAAE,CAAC,EAAE,CAAC,CAAC;AACpE,CAAC;AACD,MAAM,MAAM,GAAG,CAAC,CAAS,EAAE,EAAE,CAAC,CAAC,CAAC,OAAO,CAAC,UAAU,EAAE,CAAC,CAAC,EAAE,EAAE,CAAC,KAAK,CAAC,CAAC,UAAU,CAAC,CAAC,CAAC,GAAG,CAAC,CAAC;AACpF,mEAAmE;AACnE,SAAS,SAAS,CAAC,IAAY,EAAE,OAAe,EAAE,KAAa,EAAE,UAAU,GAAa,EAAE;IACxF,MAAM,CAAC,GAAG,IAAI,OAAO,CAAC,EAAE,cAAc,EAAE,0BAA0B,EAAE,GAAG,OAAO,EAAE,CAAC,CAAC;IAClF,KAAK,MAAM,CAAC,IAAI,UAAU;QAAE,CAAC,CAAC,MAAM,CAAC,YAAY,EAAE,CAAC,CAAC,CAAC;IACtD,MAAM,IAAI,GAAG,4RAA4R,MAAM,CAAC,OAAO,CAAC,8DAA8D,MAAM,CAAC,IAAI,CAAC,mBAAmB,MAAM,CAAC,KAAK,CAAC,4BAA4B,CAAC;IAC/b,OAAO,IAAI,QAAQ,CAAC,IAAI,EAAE,EAAE,MAAM,EAAE,GAAG,EAAE,OAAO,EAAE,CAAC,EAAE,CAAC,CAAC;AACzD,CAAC;AAED,KAAK,UAAU,MAAM,CAAC,GAAY,EAAE,GAAmB,EAAE,MAAiB;IACxE,MAAM,MAAM,GAAG,QAAQ,CAAC,GAAG,EAAE,GAAG,CAAC,CAAC;IAClC,MAAM,GAAG,GAAG,IAAI,GAAG,CAAC,GAAG,CAAC,GAAG,CAAC,CAAC;IAC7B,MAAM,QAAQ,GAAG,cAAc,CAAC,GAAG,CAAC,YAAY,CAAC,GAAG,CAAC,cAAc,CAAC,EAAE,MAAM,CAAC,CAAC;IAC9E,MAAM,EAAE,QAAQ,EAAE,SAAS,EAAE,GAAG,MAAM,IAAI,EAAE,CAAC;IAC7C,MAAM,KAAK,GAAG,YAAY,CAAC,EAAE,CAAC,CAAC;IAC/B,MAAM,KAAK,GAAG,YAAY,CAAC,EAAE,CAAC,CAAC;IAC/B,MAAM,EAAE,GAAG,MAAM,IAAI,CAAC,EAAE,GAAG,EAAE,IAAI,EAAE,KAAK,EAAE,KAAK,EAAE,QAAQ,EAAE,QAAQ,EAAE,EAAE,GAAG,CAAC,YAAY,EAAE,IAAI,EAAE,UAAU,CAAC,CAAC;IAC3G,mFAAmF;IACnF,MAAM,MAAM,GAAG,SAAS,CAAC,GAAG,SAAS,GAAG,KAAK,CAAC,KAAK,CAAC,CAAC,EAAE,EAAE,CAAC,EAAE,EAAE,EAAE,EAAE,EAAE,MAAM,EAAE,QAAQ,CAAC,MAAM,CAAC,EAAE,MAAM,EAAE,UAAU,EAAE,IAAI,EAAE,GAAG,CAAC,QAAQ,EAAE,CAAC,CAAC;IACxI,MAAM,QAAQ,GAAG,gBAAgB,CAAC,EAAE,MAAM,EAAE,GAAG,CAAC,MAAM,EAAE,QAAQ,EAAE,GAAG,CAAC,QAAQ,EAAE,WAAW,EAAE,GAAG,MAAM,GAAG,GAAG,CAAC,QAAQ,WAAW,EAAE,KAAK,EAAE,KAAK,EAAE,aAAa,EAAE,SAAS,EAAE,QAAQ,EAAE,GAAG,CAAC,QAAQ,EAAE,MAAM,EAAE,CAAC,CAAC;IAC5M,OAAO,QAAQ,CAAC,QAAQ,EAAE,CAAC,MAAM,CAAC,EAAE,GAAG,CAAC,CAAC;AAC3C,CAAC;AAED,KAAK,UAAU,QAAQ,CAAC,GAAY,EAAE,GAAmB;IACvD,MAAM,MAAM,GAAG,QAAQ,CAAC,GAAG,EAAE,GAAG,CAAC,CAAC;IAClC,MAAM,MAAM,GAAG,QAAQ,CAAC,MAAM,CAAC,CAAC;IAChC,MAAM,CAAC,GAAG,IAAI,GAAG,CAAC,GAAG,CAAC,GAAG,CAAC,CAAC,YAAY,CAAC;IACxC,MAAM,KAAK,GAAG,CAAC,CAAC,GAAG,CAAC,OAAO,CAAC,IAAI,EAAE,CAAC;IACnC,MAAM,OAAO,GAAG,YAAY,CAAC,GAAG,CAAC,OAAO,CAAC,GAAG,CAAC,QAAQ,CAAC,CAAC,CAAC;IACxD,MAAM,MAAM,GAAG,GAAG,SAAS,GAAG,KAAK,CAAC,KAAK,CAAC,CAAC,EAAE,EAAE,CAAC,EAAE,CAAC;IACnD,MAAM,EAAE,GAAG,KAAK,CAAC,CAAC,CAAC,MAAM,MAAM,CAAoF,OAAO,CAAC,GAAG,CAAC,MAAM,CAAC,EAAE,GAAG,CAAC,YAAY,EAAE,IAAI,CAAC,CAAC,CAAC,CAAC,IAAI,CAAC;IACvK,MAAM,KAAK,GAAG,GAAG,GAAG,CAAC,QAAQ,UAAU,CAAC;IACxC,MAAM,MAAM,GAAG,CAAC,SAAS,CAAC,MAAM,EAAE,EAAE,EAAE,EAAE,MAAM,EAAE,MAAM,EAAE,CAAC,EAAE,IAAI,EAAE,GAAG,CAAC,QAAQ,EAAE,CAAC,CAAC,CAAC;IAClF,IAAI,CAAC,EAAE,IAAI,EAAE,CAAC,GAAG,KAAK,IAAI,IAAI,EAAE,CAAC,KAAK,KAAK,KAAK;QAC9C,OAAO,SAAS,CAAC,eAAe,EAAE,mFAAmF,EAAE,KAAK,EAAE,MAAM,CAAC,CAAC;IACxI,MAAM,IAAI,GAAG,GAAG,KAAK,iBAAiB,kBAAkB,CAAC,EAAE,CAAC,QAAQ,CAAC,EAAE,CAAC;IACxE,MAAM,KAAK,GAAG,CAAC,CAAC,GAAG,CAAC,OAAO,CAAC,CAAC;IAC7B,IAAI,KAAK,EAAE,CAAC;QACV,sEAAsE;QACtE,IAAI,KAAK,KAAK,eAAe;YAAE,OAAO,QAAQ,CAAC,GAAG,MAAM,GAAG,EAAE,CAAC,QAAQ,EAAE,EAAE,MAAM,CAAC,CAAC;QAClF,OAAO,SAAS,CAAC,KAAK,EAAE,CAAC,CAAC,GAAG,CAAC,mBAAmB,CAAC,IAAI,gCAAgC,EAAE,IAAI,EAAE,MAAM,CAAC,CAAC;IACxG,CAAC;IACD,mFAAmF;IACnF,IAAI,CAAC,CAAC,GAAG,CAAC,KAAK,CAAC,KAAK,GAAG,CAAC,MAAM;QAAE,OAAO,SAAS,CAAC,gBAAgB,EAAE,kDAAkD,EAAE,IAAI,EAAE,MAAM,CAAC,CAAC;IACtI,MAAM,IAAI,GAAG,CAAC,CAAC,GAAG,CAAC,MAAM,CAAC,CAAC;IAC3B,IAAI,CAAC,IAAI;QAAE,OAAO,SAAS,CAAC,iBAAiB,EAAE,yBAAyB,EAAE,IAAI,EAAE,MAAM,CAAC,CAAC;IACxF,IAAI,OAAgB,CAAC;IACrB,IAAI,CAAC;QACH,MAAM,CAAC,GAAG,MAAM,YAAY,CAAC,EAAE,MAAM,EAAE,GAAG,CAAC,MAAM,EAAE,QAAQ,EAAE,GAAG,CAAC,QAAQ,EAAE,YAAY,EAAE,GAAG,CAAC,YAAY,EAAE,KAAK,EAAE,GAAG,CAAC,KAAK,EAAE,EAAE,EAAE,IAAI,EAAE,WAAW,EAAE,GAAG,MAAM,GAAG,GAAG,CAAC,QAAQ,WAAW,EAAE,YAAY,EAAE,EAAE,CAAC,QAAQ,EAAE,QAAQ,EAAE,GAAG,CAAC,QAAQ,EAAE,CAAC,CAAC;QAC9O,IAAI,CAAC,CAAC,CAAC,OAAO;YAAE,MAAM,IAAI,UAAU,CAAC,kBAAkB,EAAE,8CAA8C,CAAC,CAAC;QACzG,MAAM,aAAa,CAAC,CAAC,CAAC,OAAO,EAAE,EAAE,MAAM,EAAE,GAAG,CAAC,MAAM,EAAE,QAAQ,EAAE,GAAG,CAAC,QAAQ,EAAE,KAAK,EAAE,EAAE,CAAC,KAAK,EAAE,KAAK,EAAE,GAAG,CAAC,KAAK,EAAE,CAAC,CAAC;QAClH,OAAO,GAAG,EAAE,EAAE,EAAE,CAAC,CAAC,WAAW,EAAE,EAAE,EAAE,CAAC,CAAC,YAAY,EAAE,EAAE,EAAE,CAAC,CAAC,OAAO,EAAE,GAAG,EAAE,CAAC,CAAC,SAAS,EAAE,CAAC,EAAE,MAAM,SAAS,CAAC,GAAG,EAAE,CAAC,CAAC,WAAW,CAAC,EAAE,CAAC;IAC/H,CAAC;IAAC,OAAO,CAAC,EAAE,CAAC;QACX,MAAM,EAAE,GAAG,CAAC,YAAY,UAAU,CAAC,CAAC,CAAC,CAAC,CAAC,CAAC,CAAC,IAAI,UAAU,CAAC,cAAc,EAAE,iCAAiC,CAAC,CAAC;QAC3G,OAAO,SAAS,CAAC,EAAE,CAAC,KAAK,EAAE,EAAE,CAAC,OAAO,EAAE,IAAI,EAAE,MAAM,CAAC,CAAC;IACvD,CAAC;IACD,sDAAsD;IACtD,OAAO,QAAQ,CAAC,GAAG,MAAM,GAAG,EAAE,CAAC,QAAQ,EAAE,EAAE,CAAC,GAAG,MAAM,EAAE,GAAG,CAAC,MAAM,YAAY,CAAC,OAAO,EAAE,OAAO,EAAE,GAAG,EAAE,MAAM,CAAC,CAAC,CAAC,CAAC,CAAC;AAClH,CAAC;AAED,KAAK,UAAU,OAAO,CAAC,GAAY,EAAE,GAAmB;IACtD,MAAM,MAAM,GAAG,QAAQ,CAAC,GAAG,EAAE,GAAG,CAAC,CAAC;IAClC,2FAA2F;IAC3F,IAAI,GAAG,CAAC,OAAO,CAAC,GAAG,CAAC,QAAQ,CAAC,KAAK,MAAM;QAAE,OAAO,IAAI,CAAC,EAAE,KAAK,EAAE,WAAW,EAAE,iBAAiB,EAAE,oCAAoC,EAAE,EAAE,GAAG,CAAC,CAAC;IAC5I,MAAM,OAAO,GAAG,YAAY,CAAC,GAAG,CAAC,OAAO,CAAC,GAAG,CAAC,QAAQ,CAAC,CAAC,CAAC;IACxD,MAAM,CAAC,GAAG,MAAM,WAAW,CAAC,OAAO,EAAE,GAAG,CAAC,CAAC;IAC1C,MAAM,OAAO,GAAG,YAAY,CAAC,OAAO,EAAE,GAAG,EAAE,QAAQ,CAAC,MAAM,CAAC,CAAC,CAAC;IAC7D,MAAM,KAAK,GAAG,GAAG,MAAM,GAAG,GAAG,CAAC,gBAAgB,EAAE,CAAC;IACjD,IAAI,CAAC,CAAC;QAAE,OAAO,QAAQ,CAAC,KAAK,EAAE,OAAO,CAAC,CAAC;IACxC,IAAI,CAAC,CAAC,EAAE;QAAE,MAAM,WAAW,CAAC,EAAE,MAAM,EAAE,GAAG,CAAC,MAAM,EAAE,QAAQ,EAAE,GAAG,CAAC,QAAQ,EAAE,YAAY,EAAE,GAAG,CAAC,YAAY,EAAE,KAAK,EAAE,GAAG,CAAC,KAAK,EAAE,EAAE,EAAE,KAAK,EAAE,CAAC,CAAC,EAAE,EAAE,IAAI,EAAE,eAAe,EAAE,CAAC,CAAC;IACtK,oEAAoE;IACpE,OAAO,QAAQ,CAAC,aAAa,CAAC,EAAE,MAAM,EAAE,GAAG,CAAC,MAAM,EAAE,QAAQ,EAAE,GAAG,CAAC,QAAQ,EAAE,WAAW,EAAE,CAAC,CAAC,EAAE,EAAE,qBAAqB,EAAE,KAAK,EAAE,CAAC,EAAE,OAAO,CAAC,CAAC;AAC3I,CAAC;AAED,yGAAyG;AACzG,KAAK,UAAU,YAAY,CAAC,GAAY,EAAE,GAAmB,EAAE,SAAkB;IAC/E,MAAM,MAAM,GAAG,QAAQ,CAAC,GAAG,EAAE,GAAG,CAAC,CAAC;IAClC,kHAAkH;IAClH,MAAM,IAAI,GAAG,GAAG,CAAC,OAAO,CAAC,GAAG,CAAC,gBAAgB,CAAC,CAAC;IAC/C,IAAI,SAAS,IAAI,IAAI,IAAI,IAAI,KAAK,aAAa;QAAE,OAAO,IAAI,CAAC,EAAE,KAAK,EAAE,WAAW,EAAE,EAAE,GAAG,CAAC,CAAC;IAC1F,MAAM,OAAO,GAAG,YAAY,CAAC,GAAG,CAAC,OAAO,CAAC,GAAG,CAAC,QAAQ,CAAC,CAAC,CAAC;IACxD,MAAM,EAAE,OAAO,EAAE,UAAU,EAAE,GAAG,MAAM,cAAc,CAAC,OAAO,EAAE,GAAG,EAAE,QAAQ,CAAC,MAAM,CAAC,CAAC,CAAC;IACrF,MAAM,IAAI,GAAG,OAAO,CAAC,CAAC,CAAC,MAAM,CAAC,OAAO,CAAC,CAAC,CAAC,CAAC,IAAI,CAAC;IAC9C,IAAI,SAAS;QAAE,OAAO,OAAO,CAAC,CAAC,CAAC,IAAI,CAAC,EAAE,KAAK,EAAE,OAAO,CAAC,EAAE,EAAE,SAAS,EAAE,OAAO,CAAC,GAAG,EAAE,EAAE,GAAG,EAAE,UAAU,CAAC,CAAC,CAAC,CAAC,IAAI,CAAC,EAAE,KAAK,EAAE,IAAI,EAAE,EAAE,GAAG,EAAE,UAAU,CAAC,CAAC;IAC9I,OAAO,IAAI,CAAC,IAAI,CAAC,CAAC,CAAC,EAAE,UAAU,EAAE,IAAI,EAAE,GAAG,IAAI,EAAE,CAAC,CAAC,CAAC,EAAE,UAAU,EAAE,KAAK,EAAE,EAAE,GAAG,EAAE,UAAU,CAAC,CAAC;AAC7F,CAAC;AAED,mFAAmF;AACnF,MAAM,CAAC,KAAK,UAAU,mBAAmB,CAAC,GAAY,EAAE,GAAmB;IACzE,MAAM,IAAI,GAAG,IAAI,GAAG,CAAC,GAAG,CAAC,GAAG,CAAC,CAAC,QAAQ,CAAC;IACvC,IAAI,CAAC,IAAI,CAAC,UAAU,CAAC,GAAG,GAAG,CAAC,QAAQ,GAAG,CAAC;QAAE,OAAO,IAAI,CAAC;IACtD,MAAM,KAAK,GAAG,IAAI,CAAC,KAAK,CAAC,GAAG,CAAC,QAAQ,CAAC,MAAM,CAAC,CAAC;IAC9C,MAAM,GAAG,GAAG,GAAG,CAAC,MAAM,KAAK,KAAK,IAAI,GAAG,CAAC,MAAM,KAAK,MAAM,CAAC;IAC1D,QAAQ,KAAK,EAAE,CAAC;QACd,KAAK,UAAU;YACb,OAAO,GAAG,CAAC,CAAC,CAAC,MAAM,CAAC,GAAG,EAAE,GAAG,CAAC,CAAC,CAAC,CAAC,IAAI,CAAC,EAAE,KAAK,EAAE,oBAAoB,EAAE,EAAE,GAAG,CAAC,CAAC;QAC7E,KAAK,UAAU;YACb,OAAO,GAAG,CAAC,CAAC,CAAC,MAAM,CAAC,GAAG,EAAE,GAAG,EAAE,QAAQ,CAAC,CAAC,CAAC,CAAC,IAAI,CAAC,EAAE,KAAK,EAAE,oBAAoB,EAAE,EAAE,GAAG,CAAC,CAAC;QACvF,KAAK,WAAW;YACd,OAAO,GAAG,CAAC,CAAC,CAAC,QAAQ,CAAC,GAAG,EAAE,GAAG,CAAC,CAAC,CAAC,CAAC,IAAI,CAAC,EAAE,KAAK,EAAE,oBAAoB,EAAE,EAAE,GAAG,CAAC,CAAC;QAC/E,KAAK,WAAW;YACd,OAAO,GAAG,CAAC,MAAM,KAAK,MAAM,CAAC,CAAC,CAAC,OAAO,CAAC,GAAG,EAAE,GAAG,CAAC,CAAC,CAAC,CAAC,IAAI,CAAC,EAAE,KAAK,EAAE,oBAAoB,EAAE,iBAAiB,EAAE,2CAA2C,EAAE,EAAE,GAAG,CAAC,CAAC;QAChK,KAAK,UAAU;YACb,OAAO,GAAG,CAAC,CAAC,CAAC,YAAY,CAAC,GAAG,EAAE,GAAG,EAAE,KAAK,CAAC,CAAC,CAAC,CAAC,IAAI,CAAC,EAAE,KAAK,EAAE,oBAAoB,EAAE,EAAE,GAAG,CAAC,CAAC;QAC1F,KAAK,QAAQ;YACX,OAAO,GAAG,CAAC,CAAC,CAAC,YAAY,CAAC,GAAG,EAAE,GAAG,EAAE,IAAI,CAAC,CAAC,CAAC,CAAC,IAAI,CAAC,EAAE,KAAK,EAAE,oBAAoB,EAAE,EAAE,GAAG,CAAC,CAAC;QACzF;YACE,OAAO,IAAI,CAAC,EAAE,KAAK,EAAE,WAAW,EAAE,EAAE,GAAG,CAAC,CAAC;IAC7C,CAAC;AACH,CAAC"}

package/dist/index.d.ts

@@ -0,0 +1,2 @@
+export { AccountsClientProvider as AccountsProvider, SignInButton, SignOutButton, SignUpButton, SignedIn, SignedOut, UserButton, useAuth, useUser, type AccountsProviderProps, type AuthState, type Locale, type SessionUser, } from "./client.js";
+//# sourceMappingURL=index.d.ts.map

package/dist/index.d.ts.map

@@ -0,0 +1 @@
+{"version":3,"file":"index.d.ts","sourceRoot":"","sources":["../src/index.ts"],"names":[],"mappings":"AAEA,OAAO,EACL,sBAAsB,IAAI,gBAAgB,EAC1C,YAAY,EACZ,aAAa,EACb,YAAY,EACZ,QAAQ,EACR,SAAS,EACT,UAAU,EACV,OAAO,EACP,OAAO,EACP,KAAK,qBAAqB,EAC1B,KAAK,SAAS,EACd,KAAK,MAAM,EACX,KAAK,WAAW,GACjB,MAAM,aAAa,CAAC"}

package/dist/index.js

@@ -0,0 +1,4 @@
+// @iaurelius/accounts-nextjs in the browser (and client components): what the "react-server" build
+// (index.server.ts) exports too, with the provider and <SignedIn>/<SignedOut> of the client.
+export { AccountsClientProvider as AccountsProvider, SignInButton, SignOutButton, SignUpButton, SignedIn, SignedOut, UserButton, useAuth, useUser, } from "./client.js";
+//# sourceMappingURL=index.js.map

package/dist/index.js.map

@@ -0,0 +1 @@
+{"version":3,"file":"index.js","sourceRoot":"","sources":["../src/index.ts"],"names":[],"mappings":"AAAA,mGAAmG;AACnG,6FAA6F;AAC7F,OAAO,EACL,sBAAsB,IAAI,gBAAgB,EAC1C,YAAY,EACZ,aAAa,EACb,YAAY,EACZ,QAAQ,EACR,SAAS,EACT,UAAU,EACV,OAAO,EACP,OAAO,GAKR,MAAM,aAAa,CAAC"}

package/dist/index.server.d.ts

@@ -0,0 +1,3 @@
+export { AccountsProvider, SignedIn, SignedOut } from "./provider.server.js";
+export { SignInButton, SignOutButton, SignUpButton, UserButton, useAuth, useUser, type AccountsProviderProps, type AuthState, type Locale, type SessionUser } from "./client.js";
+//# sourceMappingURL=index.server.d.ts.map

package/dist/index.server.d.ts.map

@@ -0,0 +1 @@
+{"version":3,"file":"index.server.d.ts","sourceRoot":"","sources":["../src/index.server.ts"],"names":[],"mappings":"AAEA,OAAO,EAAE,gBAAgB,EAAE,QAAQ,EAAE,SAAS,EAAE,MAAM,sBAAsB,CAAC;AAC7E,OAAO,EAAE,YAAY,EAAE,aAAa,EAAE,YAAY,EAAE,UAAU,EAAE,OAAO,EAAE,OAAO,EAAE,KAAK,qBAAqB,EAAE,KAAK,SAAS,EAAE,KAAK,MAAM,EAAE,KAAK,WAAW,EAAE,MAAM,aAAa,CAAC"}

package/dist/index.server.js

@@ -0,0 +1,5 @@
+// @iaurelius/accounts-nextjs in server components (the "react-server" condition): the provider reads
+// the session on the server; the interactive parts are the client's.
+export { AccountsProvider, SignedIn, SignedOut } from "./provider.server.js";
+export { SignInButton, SignOutButton, SignUpButton, UserButton, useAuth, useUser } from "./client.js";
+//# sourceMappingURL=index.server.js.map

package/dist/index.server.js.map

@@ -0,0 +1 @@
+{"version":3,"file":"index.server.js","sourceRoot":"","sources":["../src/index.server.ts"],"names":[],"mappings":"AAAA,qGAAqG;AACrG,qEAAqE;AACrE,OAAO,EAAE,gBAAgB,EAAE,QAAQ,EAAE,SAAS,EAAE,MAAM,sBAAsB,CAAC;AAC7E,OAAO,EAAE,YAAY,EAAE,aAAa,EAAE,YAAY,EAAE,UAAU,EAAE,OAAO,EAAE,OAAO,EAA6E,MAAM,aAAa,CAAC"}

package/dist/provider.server.d.ts

@@ -0,0 +1,10 @@
+import type { ReactNode } from "react";
+import { type AccountsProviderProps } from "./client.js";
+export declare function AccountsProvider({ children, locale }: Pick<AccountsProviderProps, "children" | "locale">): Promise<import("react").JSX.Element>;
+export declare function SignedIn({ children }: {
+    children?: ReactNode;
+}): Promise<import("react").JSX.Element | null>;
+export declare function SignedOut({ children }: {
+    children?: ReactNode;
+}): Promise<import("react").JSX.Element | null>;
+//# sourceMappingURL=provider.server.d.ts.map

package/dist/provider.server.d.ts.map

@@ -0,0 +1 @@
+{"version":3,"file":"provider.server.d.ts","sourceRoot":"","sources":["../src/provider.server.tsx"],"names":[],"mappings":"AAEA,OAAO,KAAK,EAAE,SAAS,EAAE,MAAM,OAAO,CAAC;AACvC,OAAO,EAA0B,KAAK,qBAAqB,EAAkB,MAAM,aAAa,CAAC;AAIjG,wBAAsB,gBAAgB,CAAC,EAAE,QAAQ,EAAE,MAAM,EAAE,EAAE,IAAI,CAAC,qBAAqB,EAAE,UAAU,GAAG,QAAQ,CAAC,wCAW9G;AAED,wBAAsB,QAAQ,CAAC,EAAE,QAAQ,EAAE,EAAE;IAAE,QAAQ,CAAC,EAAE,SAAS,CAAA;CAAE,+CAEpE;AAED,wBAAsB,SAAS,CAAC,EAAE,QAAQ,EAAE,EAAE;IAAE,QAAQ,CAAC,EAAE,SAAS,CAAA;CAAE,+CAErE"}

package/dist/provider.server.js

@@ -0,0 +1,19 @@
+import { Fragment as _Fragment, jsx as _jsx } from "react/jsx-runtime";
+import { AccountsClientProvider } from "./client.js";
+import { configOf } from "./config.js";
+import { auth } from "./server.js";
+export async function AccountsProvider({ children, locale }) {
+    const a = await auth();
+    const cfg = configOf();
+    const initialState = a.isAuthenticated
+        ? { isLoaded: true, isSignedIn: true, user: a.user, sessionId: a.sessionId, orgId: a.orgId }
+        : { isLoaded: true, isSignedIn: false, user: null, sessionId: null, orgId: null };
+    return (_jsx(AccountsClientProvider, { initialState: initialState, issuer: cfg.issuer, basePath: cfg.basePath, locale: locale, children: children }));
+}
+export async function SignedIn({ children }) {
+    return (await auth()).isAuthenticated ? _jsx(_Fragment, { children: children }) : null;
+}
+export async function SignedOut({ children }) {
+    return (await auth()).isAuthenticated ? null : _jsx(_Fragment, { children: children });
+}
+//# sourceMappingURL=provider.server.js.map

package/dist/provider.server.js.map

@@ -0,0 +1 @@
+{"version":3,"file":"provider.server.js","sourceRoot":"","sources":["../src/provider.server.tsx"],"names":[],"mappings":";AAGA,OAAO,EAAE,sBAAsB,EAA8C,MAAM,aAAa,CAAC;AACjG,OAAO,EAAE,QAAQ,EAAE,MAAM,aAAa,CAAC;AACvC,OAAO,EAAE,IAAI,EAAE,MAAM,aAAa,CAAC;AAEnC,MAAM,CAAC,KAAK,UAAU,gBAAgB,CAAC,EAAE,QAAQ,EAAE,MAAM,EAAsD;IAC7G,MAAM,CAAC,GAAG,MAAM,IAAI,EAAE,CAAC;IACvB,MAAM,GAAG,GAAG,QAAQ,EAAE,CAAC;IACvB,MAAM,YAAY,GAAc,CAAC,CAAC,eAAe;QAC/C,CAAC,CAAC,EAAE,QAAQ,EAAE,IAAI,EAAE,UAAU,EAAE,IAAI,EAAE,IAAI,EAAE,CAAC,CAAC,IAAI,EAAE,SAAS,EAAE,CAAC,CAAC,SAAS,EAAE,KAAK,EAAE,CAAC,CAAC,KAAK,EAAE;QAC5F,CAAC,CAAC,EAAE,QAAQ,EAAE,IAAI,EAAE,UAAU,EAAE,KAAK,EAAE,IAAI,EAAE,IAAI,EAAE,SAAS,EAAE,IAAI,EAAE,KAAK,EAAE,IAAI,EAAE,CAAC;IACpF,OAAO,CACL,KAAC,sBAAsB,IAAC,YAAY,EAAE,YAAY,EAAE,MAAM,EAAE,GAAG,CAAC,MAAM,EAAE,QAAQ,EAAE,GAAG,CAAC,QAAQ,EAAE,MAAM,EAAE,MAAM,YAC3G,QAAQ,GACc,CAC1B,CAAC;AACJ,CAAC;AAED,MAAM,CAAC,KAAK,UAAU,QAAQ,CAAC,EAAE,QAAQ,EAA4B;IACnE,OAAO,CAAC,MAAM,IAAI,EAAE,CAAC,CAAC,eAAe,CAAC,CAAC,CAAC,4BAAG,QAAQ,GAAI,CAAC,CAAC,CAAC,IAAI,CAAC;AACjE,CAAC;AAED,MAAM,CAAC,KAAK,UAAU,SAAS,CAAC,EAAE,QAAQ,EAA4B;IACpE,OAAO,CAAC,MAAM,IAAI,EAAE,CAAC,CAAC,eAAe,CAAC,CAAC,CAAC,IAAI,CAAC,CAAC,CAAC,4BAAG,QAAQ,GAAI,CAAC;AACjE,CAAC"}

package/dist/proxy.d.ts

@@ -0,0 +1,17 @@
+import { type NextRequest } from "next/server.js";
+import { type AccountsOptions } from "./config.js";
+/** Headers the proxy sets for the rest of the request; one sent by the browser is dropped. */
+export declare const PATH_HEADER = "x-accounts-path";
+export type RouteMatcher = (req: {
+    nextUrl: {
+        pathname: string;
+    };
+} | Request) => boolean;
+/** A matcher from paths or patterns: "/dashboard(.*)" matches /dashboard and everything under it. */
+export declare function createRouteMatcher(patterns: (string | RegExp)[] | string | RegExp): RouteMatcher;
+export type AccountsMiddlewareOptions = AccountsOptions & {
+    /** Routes that need a signed-in person: pages redirect to the sign-in, API routes answer 401. */
+    protect?: (string | RegExp)[] | RouteMatcher;
+};
+export declare function accountsMiddleware(options?: AccountsMiddlewareOptions): (req: NextRequest) => Promise<Response>;
+//# sourceMappingURL=proxy.d.ts.map

package/dist/proxy.d.ts.map

@@ -0,0 +1 @@
+{"version":3,"file":"proxy.d.ts","sourceRoot":"","sources":["../src/proxy.ts"],"names":[],"mappings":"AAGA,OAAO,EAAgB,KAAK,WAAW,EAAE,MAAM,gBAAgB,CAAC;AAChE,OAAO,EAAY,KAAK,eAAe,EAAE,MAAM,aAAa,CAAC;AAK7D,8FAA8F;AAC9F,eAAO,MAAM,WAAW,oBAAoB,CAAC;AAE7C,MAAM,MAAM,YAAY,GAAG,CAAC,GAAG,EAAE;IAAE,OAAO,EAAE;QAAE,QAAQ,EAAE,MAAM,CAAA;KAAE,CAAA;CAAE,GAAG,OAAO,KAAK,OAAO,CAAC;AAEzF,qGAAqG;AACrG,wBAAgB,kBAAkB,CAAC,QAAQ,EAAE,CAAC,MAAM,GAAG,MAAM,CAAC,EAAE,GAAG,MAAM,GAAG,MAAM,GAAG,YAAY,CAMhG;AAED,MAAM,MAAM,yBAAyB,GAAG,eAAe,GAAG;IACxD,iGAAiG;IACjG,OAAO,CAAC,EAAE,CAAC,MAAM,GAAG,MAAM,CAAC,EAAE,GAAG,YAAY,CAAC;CAC9C,CAAC;AAIF,wBAAgB,kBAAkB,CAAC,OAAO,GAAE,yBAA8B,SAEvC,WAAW,KAAG,OAAO,CAAC,QAAQ,CAAC,CAmCjE"}

package/dist/proxy.js

@@ -0,0 +1,61 @@
+// accountsMiddleware(): the one line in proxy.ts (middleware.ts before Next 16). It answers the SDK's
+// routes, keeps the session fresh (refresh before the access token expires), protects the routes it is
+// told to, and hands the fresh session to the rest of the request (auth(), server components).
+import { NextResponse } from "next/server.js";
+import { configOf } from "./config.js";
+import { parseCookies } from "./cookies.js";
+import { handleAccountsRoute, isSecure, originOf } from "./handlers.js";
+import { applySetCookies, cookieHeader, resolveSession } from "./session.js";
+/** Headers the proxy sets for the rest of the request; one sent by the browser is dropped. */
+export const PATH_HEADER = "x-accounts-path";
+/** A matcher from paths or patterns: "/dashboard(.*)" matches /dashboard and everything under it. */
+export function createRouteMatcher(patterns) {
+    const list = (Array.isArray(patterns) ? patterns : [patterns]).map((p) => (p instanceof RegExp ? p : new RegExp(`^${p}$`)));
+    return (req) => {
+        const path = "nextUrl" in req ? req.nextUrl.pathname : new URL(req.url).pathname;
+        return list.some((r) => r.test(path));
+    };
+}
+const isApi = (req) => req.nextUrl.pathname.startsWith("/api/") || (req.headers.get("accept") ?? "").includes("application/json");
+export function accountsMiddleware(options = {}) {
+    const isProtected = !options.protect ? null : typeof options.protect === "function" ? options.protect : createRouteMatcher(options.protect);
+    return async function proxy(req) {
+        const cfg = configOf(options);
+        const own = await handleAccountsRoute(req, cfg);
+        if (own)
+            return own;
+        const origin = originOf(req, cfg);
+        const cookies = parseCookies(req.headers.get("cookie"));
+        const { session, setCookies } = await resolveSession(cookies, cfg, isSecure(origin));
+        if (!session && isProtected?.(req)) {
+            if (isApi(req)) {
+                const res = NextResponse.json({ error: "unauthorized", error_description: "Sign in first." }, { status: 401, headers: { "cache-control": "no-store" } });
+                for (const c of setCookies)
+                    res.headers.append("set-cookie", c);
+                return res;
+            }
+            const to = new URL(`${cfg.basePath}/sign-in`, origin);
+            to.searchParams.set("redirect_url", req.nextUrl.pathname + req.nextUrl.search);
+            const res = NextResponse.redirect(to, 307);
+            for (const c of setCookies)
+                res.headers.append("set-cookie", c);
+            return res;
+        }
+        // The rest of this request (auth(), server components) sees the session as it is now.
+        const headers = new Headers(req.headers);
+        headers.delete(PATH_HEADER);
+        headers.set(PATH_HEADER, req.nextUrl.pathname + req.nextUrl.search);
+        if (setCookies.length) {
+            const now = cookieHeader(applySetCookies(cookies, setCookies));
+            if (now)
+                headers.set("cookie", now);
+            else
+                headers.delete("cookie");
+        }
+        const res = NextResponse.next({ request: { headers } });
+        for (const c of setCookies)
+            res.headers.append("set-cookie", c);
+        return res;
+    };
+}
+//# sourceMappingURL=proxy.js.map

package/dist/proxy.js.map

@@ -0,0 +1 @@
+{"version":3,"file":"proxy.js","sourceRoot":"","sources":["../src/proxy.ts"],"names":[],"mappings":"AAAA,sGAAsG;AACtG,uGAAuG;AACvG,+FAA+F;AAC/F,OAAO,EAAE,YAAY,EAAoB,MAAM,gBAAgB,CAAC;AAChE,OAAO,EAAE,QAAQ,EAAwB,MAAM,aAAa,CAAC;AAC7D,OAAO,EAAE,YAAY,EAAE,MAAM,cAAc,CAAC;AAC5C,OAAO,EAAE,mBAAmB,EAAE,QAAQ,EAAE,QAAQ,EAAE,MAAM,eAAe,CAAC;AACxE,OAAO,EAAE,eAAe,EAAE,YAAY,EAAE,cAAc,EAAE,MAAM,cAAc,CAAC;AAE7E,8FAA8F;AAC9F,MAAM,CAAC,MAAM,WAAW,GAAG,iBAAiB,CAAC;AAI7C,qGAAqG;AACrG,MAAM,UAAU,kBAAkB,CAAC,QAA+C;IAChF,MAAM,IAAI,GAAG,CAAC,KAAK,CAAC,OAAO,CAAC,QAAQ,CAAC,CAAC,CAAC,CAAC,QAAQ,CAAC,CAAC,CAAC,CAAC,QAAQ,CAAC,CAAC,CAAC,GAAG,CAAC,CAAC,CAAC,EAAE,EAAE,CAAC,CAAC,CAAC,YAAY,MAAM,CAAC,CAAC,CAAC,CAAC,CAAC,CAAC,CAAC,IAAI,MAAM,CAAC,IAAI,CAAC,GAAG,CAAC,CAAC,CAAC,CAAC;IAC5H,OAAO,CAAC,GAAG,EAAE,EAAE;QACb,MAAM,IAAI,GAAG,SAAS,IAAI,GAAG,CAAC,CAAC,CAAC,GAAG,CAAC,OAAO,CAAC,QAAQ,CAAC,CAAC,CAAC,IAAI,GAAG,CAAC,GAAG,CAAC,GAAG,CAAC,CAAC,QAAQ,CAAC;QACjF,OAAO,IAAI,CAAC,IAAI,CAAC,CAAC,CAAC,EAAE,EAAE,CAAC,CAAC,CAAC,IAAI,CAAC,IAAI,CAAC,CAAC,CAAC;IACxC,CAAC,CAAC;AACJ,CAAC;AAOD,MAAM,KAAK,GAAG,CAAC,GAAgB,EAAE,EAAE,CAAC,GAAG,CAAC,OAAO,CAAC,QAAQ,CAAC,UAAU,CAAC,OAAO,CAAC,IAAI,CAAC,GAAG,CAAC,OAAO,CAAC,GAAG,CAAC,QAAQ,CAAC,IAAI,EAAE,CAAC,CAAC,QAAQ,CAAC,kBAAkB,CAAC,CAAC;AAE/I,MAAM,UAAU,kBAAkB,CAAC,OAAO,GAA8B,EAAE;IACxE,MAAM,WAAW,GAAwB,CAAC,OAAO,CAAC,OAAO,CAAC,CAAC,CAAC,IAAI,CAAC,CAAC,CAAC,OAAO,OAAO,CAAC,OAAO,KAAK,UAAU,CAAC,CAAC,CAAC,OAAO,CAAC,OAAO,CAAC,CAAC,CAAC,kBAAkB,CAAC,OAAO,CAAC,OAAO,CAAC,CAAC;IACjK,OAAO,KAAK,UAAU,KAAK,CAAC,GAAgB;QAC1C,MAAM,GAAG,GAAG,QAAQ,CAAC,OAAO,CAAC,CAAC;QAC9B,MAAM,GAAG,GAAG,MAAM,mBAAmB,CAAC,GAAG,EAAE,GAAG,CAAC,CAAC;QAChD,IAAI,GAAG;YAAE,OAAO,GAAG,CAAC;QAEpB,MAAM,MAAM,GAAG,QAAQ,CAAC,GAAG,EAAE,GAAG,CAAC,CAAC;QAClC,MAAM,OAAO,GAAG,YAAY,CAAC,GAAG,CAAC,OAAO,CAAC,GAAG,CAAC,QAAQ,CAAC,CAAC,CAAC;QACxD,MAAM,EAAE,OAAO,EAAE,UAAU,EAAE,GAAG,MAAM,cAAc,CAAC,OAAO,EAAE,GAAG,EAAE,QAAQ,CAAC,MAAM,CAAC,CAAC,CAAC;QAErF,IAAI,CAAC,OAAO,IAAI,WAAW,EAAE,CAAC,GAAG,CAAC,EAAE,CAAC;YACnC,IAAI,KAAK,CAAC,GAAG,CAAC,EAAE,CAAC;gBACf,MAAM,GAAG,GAAG,YAAY,CAAC,IAAI,CAAC,EAAE,KAAK,EAAE,cAAc,EAAE,iBAAiB,EAAE,gBAAgB,EAAE,EAAE,EAAE,MAAM,EAAE,GAAG,EAAE,OAAO,EAAE,EAAE,eAAe,EAAE,UAAU,EAAE,EAAE,CAAC,CAAC;gBACzJ,KAAK,MAAM,CAAC,IAAI,UAAU;oBAAE,GAAG,CAAC,OAAO,CAAC,MAAM,CAAC,YAAY,EAAE,CAAC,CAAC,CAAC;gBAChE,OAAO,GAAG,CAAC;YACb,CAAC;YACD,MAAM,EAAE,GAAG,IAAI,GAAG,CAAC,GAAG,GAAG,CAAC,QAAQ,UAAU,EAAE,MAAM,CAAC,CAAC;YACtD,EAAE,CAAC,YAAY,CAAC,GAAG,CAAC,cAAc,EAAE,GAAG,CAAC,OAAO,CAAC,QAAQ,GAAG,GAAG,CAAC,OAAO,CAAC,MAAM,CAAC,CAAC;YAC/E,MAAM,GAAG,GAAG,YAAY,CAAC,QAAQ,CAAC,EAAE,EAAE,GAAG,CAAC,CAAC;YAC3C,KAAK,MAAM,CAAC,IAAI,UAAU;gBAAE,GAAG,CAAC,OAAO,CAAC,MAAM,CAAC,YAAY,EAAE,CAAC,CAAC,CAAC;YAChE,OAAO,GAAG,CAAC;QACb,CAAC;QAED,sFAAsF;QACtF,MAAM,OAAO,GAAG,IAAI,OAAO,CAAC,GAAG,CAAC,OAAO,CAAC,CAAC;QACzC,OAAO,CAAC,MAAM,CAAC,WAAW,CAAC,CAAC;QAC5B,OAAO,CAAC,GAAG,CAAC,WAAW,EAAE,GAAG,CAAC,OAAO,CAAC,QAAQ,GAAG,GAAG,CAAC,OAAO,CAAC,MAAM,CAAC,CAAC;QACpE,IAAI,UAAU,CAAC,MAAM,EAAE,CAAC;YACtB,MAAM,GAAG,GAAG,YAAY,CAAC,eAAe,CAAC,OAAO,EAAE,UAAU,CAAC,CAAC,CAAC;YAC/D,IAAI,GAAG;gBAAE,OAAO,CAAC,GAAG,CAAC,QAAQ,EAAE,GAAG,CAAC,CAAC;;gBAC/B,OAAO,CAAC,MAAM,CAAC,QAAQ,CAAC,CAAC;QAChC,CAAC;QACD,MAAM,GAAG,GAAG,YAAY,CAAC,IAAI,CAAC,EAAE,OAAO,EAAE,EAAE,OAAO,EAAE,EAAE,CAAC,CAAC;QACxD,KAAK,MAAM,CAAC,IAAI,UAAU;YAAE,GAAG,CAAC,OAAO,CAAC,MAAM,CAAC,YAAY,EAAE,CAAC,CAAC,CAAC;QAChE,OAAO,GAAG,CAAC;IACb,CAAC,CAAC;AACJ,CAAC"}

package/dist/server.d.ts

@@ -0,0 +1,47 @@
+import { type SessionUser } from "@iaurelius/accounts/oidc";
+import { type AccountsOptions } from "./config.js";
+export { accountsMiddleware, createRouteMatcher, type AccountsMiddlewareOptions, type RouteMatcher } from "./proxy.js";
+export type { AccountsOptions } from "./config.js";
+export type { SessionUser } from "@iaurelius/accounts/oidc";
+type Base = {
+    /** Sends a signed-out person to the sign-in, and back here after it. */
+    redirectToSignIn: (opts?: {
+        returnTo?: string;
+    }) => never;
+};
+export type SignedInAuthObject = Base & {
+    isAuthenticated: true;
+    userId: string;
+    sessionId: string | null;
+    orgId: string | null;
+    /** The person, from the session's ID token (no request). For their latest data, currentUser(). */
+    user: SessionUser;
+    /** The access token, for calling your API (issued for ACCOUNTS_AUDIENCE). */
+    getToken: () => Promise<string>;
+    /** Does nothing: the person is signed in. */
+    protect: () => Promise<SignedInAuthObject>;
+};
+export type SignedOutAuthObject = Base & {
+    isAuthenticated: false;
+    userId: null;
+    sessionId: null;
+    orgId: null;
+    user: null;
+    getToken: () => Promise<null>;
+    /** Redirects to the sign-in (never returns). */
+    protect: () => Promise<never>;
+};
+export type AuthObject = SignedInAuthObject | SignedOutAuthObject;
+/**
+ * Who is signed in on this request. Needs accountsMiddleware() in proxy.ts, which keeps the session fresh.
+ * `await auth.protect()` returns the signed-in person, or sends a signed-out one to the sign-in.
+ */
+export declare const auth: (() => Promise<AuthObject>) & {
+    protect: () => Promise<SignedInAuthObject>;
+};
+export type CurrentUser = SessionUser & {
+    claims: Record<string, unknown>;
+};
+/** The signed-in person as the application has them now (its userinfo), or null. One request per render. */
+export declare const currentUser: (options?: Pick<AccountsOptions, "fetch">) => Promise<CurrentUser | null>;
+//# sourceMappingURL=server.d.ts.map

package/dist/server.d.ts.map

@@ -0,0 +1 @@
+{"version":3,"file":"server.d.ts","sourceRoot":"","sources":["../src/server.ts"],"names":[],"mappings":"AAKA,OAAO,EAAa,KAAK,WAAW,EAAE,MAAM,0BAA0B,CAAC;AACvE,OAAO,EAAY,KAAK,eAAe,EAAE,MAAM,aAAa,CAAC;AAI7D,OAAO,EAAE,kBAAkB,EAAE,kBAAkB,EAAE,KAAK,yBAAyB,EAAE,KAAK,YAAY,EAAE,MAAM,YAAY,CAAC;AACvH,YAAY,EAAE,eAAe,EAAE,MAAM,aAAa,CAAC;AACnD,YAAY,EAAE,WAAW,EAAE,MAAM,0BAA0B,CAAC;AAE5D,KAAK,IAAI,GAAG;IACV,wEAAwE;IACxE,gBAAgB,EAAE,CAAC,IAAI,CAAC,EAAE;QAAE,QAAQ,CAAC,EAAE,MAAM,CAAA;KAAE,KAAK,KAAK,CAAC;CAC3D,CAAC;AACF,MAAM,MAAM,kBAAkB,GAAG,IAAI,GAAG;IACtC,eAAe,EAAE,IAAI,CAAC;IACtB,MAAM,EAAE,MAAM,CAAC;IACf,SAAS,EAAE,MAAM,GAAG,IAAI,CAAC;IACzB,KAAK,EAAE,MAAM,GAAG,IAAI,CAAC;IACrB,kGAAkG;IAClG,IAAI,EAAE,WAAW,CAAC;IAClB,6EAA6E;IAC7E,QAAQ,EAAE,MAAM,OAAO,CAAC,MAAM,CAAC,CAAC;IAChC,6CAA6C;IAC7C,OAAO,EAAE,MAAM,OAAO,CAAC,kBAAkB,CAAC,CAAC;CAC5C,CAAC;AACF,MAAM,MAAM,mBAAmB,GAAG,IAAI,GAAG;IACvC,eAAe,EAAE,KAAK,CAAC;IACvB,MAAM,EAAE,IAAI,CAAC;IACb,SAAS,EAAE,IAAI,CAAC;IAChB,KAAK,EAAE,IAAI,CAAC;IACZ,IAAI,EAAE,IAAI,CAAC;IACX,QAAQ,EAAE,MAAM,OAAO,CAAC,IAAI,CAAC,CAAC;IAC9B,gDAAgD;IAChD,OAAO,EAAE,MAAM,OAAO,CAAC,KAAK,CAAC,CAAC;CAC/B,CAAC;AACF,MAAM,MAAM,UAAU,GAAG,kBAAkB,GAAG,mBAAmB,CAAC;AAqClE;;;GAGG;AACH,eAAO,MAAM,IAAI,SAA2B,OAAO,CAAC,UAAU,CAAC;mBAC1C,OAAO,CAAC,kBAAkB,CAAC;CAC9C,CAAC;AAEH,MAAM,MAAM,WAAW,GAAG,WAAW,GAAG;IAAE,MAAM,EAAE,MAAM,CAAC,MAAM,EAAE,OAAO,CAAC,CAAA;CAAE,CAAC;AAE5E,4GAA4G;AAC5G,eAAO,MAAM,WAAW,aAAyB,IAAI,CAAC,eAAe,EAAE,OAAO,CAAC,KAAQ,OAAO,CAAC,WAAW,GAAG,IAAI,CAgB/G,CAAC"}

package/dist/server.js

@@ -0,0 +1,72 @@
+// On the server: auth() and currentUser() in server components, route handlers and server actions,
+// and accountsMiddleware() for proxy.ts.
+import { cookies, headers } from "next/headers.js";
+import { redirect } from "next/navigation.js";
+import { cache } from "react";
+import { endpoints } from "@iaurelius/accounts/oidc";
+import { configOf } from "./config.js";
+import { PATH_HEADER } from "./proxy.js";
+import { infoOf, readSession } from "./session.js";
+export { accountsMiddleware, createRouteMatcher } from "./proxy.js";
+const readAuth = cache(async () => {
+    // Cookies first: that makes the route dynamic, so a build without settings does not try to prerender it.
+    const jar = await cookies();
+    const cfg = configOf();
+    const map = new Map(jar.getAll().map((c) => [c.name, c.value]));
+    const s = await readSession(map, cfg);
+    const current = (await headers()).get(PATH_HEADER) ?? "/";
+    const redirectToSignIn = (opts) => redirect(`${cfg.basePath}/sign-in?redirect_url=${encodeURIComponent(opts?.returnTo ?? current)}`);
+    const info = s && s.exp > Math.floor(Date.now() / 1000) ? infoOf(s) : null;
+    if (!s || !info) {
+        const out = {
+            isAuthenticated: false,
+            userId: null,
+            sessionId: null,
+            orgId: null,
+            user: null,
+            getToken: async () => null,
+            redirectToSignIn,
+            protect: async () => redirectToSignIn(),
+        };
+        return out;
+    }
+    const out = {
+        isAuthenticated: true,
+        userId: info.user.id,
+        sessionId: info.sessionId,
+        orgId: info.orgId,
+        user: info.user,
+        getToken: async () => s.at,
+        redirectToSignIn,
+        protect: async () => out,
+    };
+    return out;
+});
+/**
+ * Who is signed in on this request. Needs accountsMiddleware() in proxy.ts, which keeps the session fresh.
+ * `await auth.protect()` returns the signed-in person, or sends a signed-out one to the sign-in.
+ */
+export const auth = Object.assign(async () => readAuth(), {
+    protect: async () => (await readAuth()).protect(),
+});
+/** The signed-in person as the application has them now (its userinfo), or null. One request per render. */
+export const currentUser = cache(async (options = {}) => {
+    const a = await auth();
+    if (!a.isAuthenticated)
+        return null;
+    const cfg = configOf(options);
+    const f = cfg.fetch ?? ((i, init) => globalThis.fetch(i, init));
+    const res = await f(endpoints(cfg.issuer).userinfo, { headers: { authorization: `Bearer ${await a.getToken()}` }, cache: "no-store" });
+    if (!res.ok)
+        return null;
+    const c = (await res.json());
+    return {
+        id: String(c.sub ?? a.userId),
+        email: typeof c.email === "string" ? c.email : a.user.email,
+        emailVerified: c.email_verified === true,
+        name: typeof c.name === "string" && c.name ? c.name : null,
+        imageUrl: typeof c.picture === "string" && c.picture ? c.picture : null,
+        claims: c,
+    };
+});
+//# sourceMappingURL=server.js.map

package/dist/server.js.map

@@ -0,0 +1 @@
+{"version":3,"file":"server.js","sourceRoot":"","sources":["../src/server.ts"],"names":[],"mappings":"AAAA,mGAAmG;AACnG,yCAAyC;AACzC,OAAO,EAAE,OAAO,EAAE,OAAO,EAAE,MAAM,iBAAiB,CAAC;AACnD,OAAO,EAAE,QAAQ,EAAE,MAAM,oBAAoB,CAAC;AAC9C,OAAO,EAAE,KAAK,EAAE,MAAM,OAAO,CAAC;AAC9B,OAAO,EAAE,SAAS,EAAoB,MAAM,0BAA0B,CAAC;AACvE,OAAO,EAAE,QAAQ,EAAwB,MAAM,aAAa,CAAC;AAC7D,OAAO,EAAE,WAAW,EAAE,MAAM,YAAY,CAAC;AACzC,OAAO,EAAE,MAAM,EAAE,WAAW,EAAE,MAAM,cAAc,CAAC;AAEnD,OAAO,EAAE,kBAAkB,EAAE,kBAAkB,EAAqD,MAAM,YAAY,CAAC;AAgCvH,MAAM,QAAQ,GAAG,KAAK,CAAC,KAAK,IAAyB,EAAE;IACrD,yGAAyG;IACzG,MAAM,GAAG,GAAG,MAAM,OAAO,EAAE,CAAC;IAC5B,MAAM,GAAG,GAAG,QAAQ,EAAE,CAAC;IACvB,MAAM,GAAG,GAAG,IAAI,GAAG,CAAC,GAAG,CAAC,MAAM,EAAE,CAAC,GAAG,CAAC,CAAC,CAAC,EAAE,EAAE,CAAC,CAAC,CAAC,CAAC,IAAI,EAAE,CAAC,CAAC,KAAK,CAAU,CAAC,CAAC,CAAC;IACzE,MAAM,CAAC,GAAG,MAAM,WAAW,CAAC,GAAG,EAAE,GAAG,CAAC,CAAC;IACtC,MAAM,OAAO,GAAG,CAAC,MAAM,OAAO,EAAE,CAAC,CAAC,GAAG,CAAC,WAAW,CAAC,IAAI,GAAG,CAAC;IAC1D,MAAM,gBAAgB,GAAG,CAAC,IAA4B,EAAS,EAAE,CAAC,QAAQ,CAAC,GAAG,GAAG,CAAC,QAAQ,yBAAyB,kBAAkB,CAAC,IAAI,EAAE,QAAQ,IAAI,OAAO,CAAC,EAAE,CAAC,CAAC;IACpK,MAAM,IAAI,GAAG,CAAC,IAAI,CAAC,CAAC,GAAG,GAAG,IAAI,CAAC,KAAK,CAAC,IAAI,CAAC,GAAG,EAAE,GAAG,IAAI,CAAC,CAAC,CAAC,CAAC,MAAM,CAAC,CAAC,CAAC,CAAC,CAAC,CAAC,IAAI,CAAC;IAC3E,IAAI,CAAC,CAAC,IAAI,CAAC,IAAI,EAAE,CAAC;QAChB,MAAM,GAAG,GAAwB;YAC/B,eAAe,EAAE,KAAK;YACtB,MAAM,EAAE,IAAI;YACZ,SAAS,EAAE,IAAI;YACf,KAAK,EAAE,IAAI;YACX,IAAI,EAAE,IAAI;YACV,QAAQ,EAAE,KAAK,IAAI,EAAE,CAAC,IAAI;YAC1B,gBAAgB;YAChB,OAAO,EAAE,KAAK,IAAI,EAAE,CAAC,gBAAgB,EAAE;SACxC,CAAC;QACF,OAAO,GAAG,CAAC;IACb,CAAC;IACD,MAAM,GAAG,GAAuB;QAC9B,eAAe,EAAE,IAAI;QACrB,MAAM,EAAE,IAAI,CAAC,IAAI,CAAC,EAAE;QACpB,SAAS,EAAE,IAAI,CAAC,SAAS;QACzB,KAAK,EAAE,IAAI,CAAC,KAAK;QACjB,IAAI,EAAE,IAAI,CAAC,IAAI;QACf,QAAQ,EAAE,KAAK,IAAI,EAAE,CAAC,CAAC,CAAC,EAAE;QAC1B,gBAAgB;QAChB,OAAO,EAAE,KAAK,IAAI,EAAE,CAAC,GAAG;KACzB,CAAC;IACF,OAAO,GAAG,CAAC;AACb,CAAC,CAAC,CAAC;AAEH;;;GAGG;AACH,MAAM,CAAC,MAAM,IAAI,GAAG,MAAM,CAAC,MAAM,CAAC,KAAK,IAAyB,EAAE,CAAC,QAAQ,EAAE,EAAE;IAC7E,OAAO,EAAE,KAAK,IAAiC,EAAE,CAAC,CAAC,MAAM,QAAQ,EAAE,CAAC,CAAC,OAAO,EAAE;CAC/E,CAAC,CAAC;AAIH,4GAA4G;AAC5G,MAAM,CAAC,MAAM,WAAW,GAAG,KAAK,CAAC,KAAK,EAAE,OAAO,GAAmC,EAAE,EAA+B,EAAE;IACnH,MAAM,CAAC,GAAG,MAAM,IAAI,EAAE,CAAC;IACvB,IAAI,CAAC,CAAC,CAAC,eAAe;QAAE,OAAO,IAAI,CAAC;IACpC,MAAM,GAAG,GAAG,QAAQ,CAAC,OAAO,CAAC,CAAC;IAC9B,MAAM,CAAC,GAAG,GAAG,CAAC,KAAK,IAAI,CAAC,CAAC,CAAyB,EAAE,IAAkB,EAAE,EAAE,CAAC,UAAU,CAAC,KAAK,CAAC,CAAC,EAAE,IAAI,CAAC,CAAC,CAAC;IACtG,MAAM,GAAG,GAAG,MAAM,CAAC,CAAC,SAAS,CAAC,GAAG,CAAC,MAAM,CAAC,CAAC,QAAQ,EAAE,EAAE,OAAO,EAAE,EAAE,aAAa,EAAE,UAAU,MAAM,CAAC,CAAC,QAAQ,EAAE,EAAE,EAAE,EAAE,KAAK,EAAE,UAAU,EAAiB,CAAC,CAAC;IACtJ,IAAI,CAAC,GAAG,CAAC,EAAE;QAAE,OAAO,IAAI,CAAC;IACzB,MAAM,CAAC,GAAG,CAAC,MAAM,GAAG,CAAC,IAAI,EAAE,CAA4B,CAAC;IACxD,OAAO;QACL,EAAE,EAAE,MAAM,CAAC,CAAC,CAAC,GAAG,IAAI,CAAC,CAAC,MAAM,CAAC;QAC7B,KAAK,EAAE,OAAO,CAAC,CAAC,KAAK,KAAK,QAAQ,CAAC,CAAC,CAAC,CAAC,CAAC,KAAK,CAAC,CAAC,CAAC,CAAC,CAAC,IAAI,CAAC,KAAK;QAC3D,aAAa,EAAE,CAAC,CAAC,cAAc,KAAK,IAAI;QACxC,IAAI,EAAE,OAAO,CAAC,CAAC,IAAI,KAAK,QAAQ,IAAI,CAAC,CAAC,IAAI,CAAC,CAAC,CAAC,CAAC,CAAC,IAAI,CAAC,CAAC,CAAC,IAAI;QAC1D,QAAQ,EAAE,OAAO,CAAC,CAAC,OAAO,KAAK,QAAQ,IAAI,CAAC,CAAC,OAAO,CAAC,CAAC,CAAC,CAAC,CAAC,OAAO,CAAC,CAAC,CAAC,IAAI;QACvE,MAAM,EAAE,CAAC;KACV,CAAC;AACJ,CAAC,CAAC,CAAC"}