@incorta/auth 1.0.0

package/dist/express.cjs

@@ -0,0 +1,134 @@
+"use strict";
+var __defProp = Object.defineProperty;
+var __getOwnPropDesc = Object.getOwnPropertyDescriptor;
+var __getOwnPropNames = Object.getOwnPropertyNames;
+var __hasOwnProp = Object.prototype.hasOwnProperty;
+var __export = (target, all) => {
+  for (var name in all)
+    __defProp(target, name, { get: all[name], enumerable: true });
+};
+var __copyProps = (to, from, except, desc) => {
+  if (from && typeof from === "object" || typeof from === "function") {
+    for (let key of __getOwnPropNames(from))
+      if (!__hasOwnProp.call(to, key) && key !== except)
+        __defProp(to, key, { get: () => from[key], enumerable: !(desc = __getOwnPropDesc(from, key)) || desc.enumerable });
+  }
+  return to;
+};
+var __toCommonJS = (mod) => __copyProps(__defProp({}, "__esModule", { value: true }), mod);
+
+// src/express.ts
+var express_exports = {};
+__export(express_exports, {
+  incortaAuth: () => incortaAuth,
+  requireAuth: () => requireAuth
+});
+module.exports = __toCommonJS(express_exports);
+
+// src/node.ts
+async function toWebRequest(req) {
+  const proto = req.headers["x-forwarded-proto"]?.split(",")[0]?.trim() ?? (req.socket.encrypted ? "https" : "http");
+  const host = req.headers.host ?? "localhost";
+  const path = req.originalUrl ?? req.url ?? "/";
+  const url = `${proto}://${host}${path}`;
+  const headers = new Headers();
+  for (let i = 0; i < req.rawHeaders.length; i += 2) {
+    headers.append(req.rawHeaders[i], req.rawHeaders[i + 1]);
+  }
+  const method = req.method ?? "GET";
+  let body;
+  if (method !== "GET" && method !== "HEAD") {
+    const chunks = [];
+    for await (const chunk of req) {
+      chunks.push(Buffer.isBuffer(chunk) ? chunk : Buffer.from(chunk));
+    }
+    if (chunks.length) {
+      const bytes = new Uint8Array(chunks.reduce((n, c) => n + c.length, 0));
+      let offset = 0;
+      for (const chunk of chunks) {
+        bytes.set(chunk, offset);
+        offset += chunk.length;
+      }
+      body = bytes;
+    }
+  }
+  return new Request(url, { method, headers, body });
+}
+async function sendWebResponse(res, response) {
+  res.statusCode = response.status;
+  response.headers.forEach((value, name) => {
+    if (name.toLowerCase() === "set-cookie") return;
+    res.setHeader(name, value);
+  });
+  const setCookies = response.headers.getSetCookie();
+  if (setCookies.length) res.setHeader("set-cookie", setCookies);
+  if (response.body) {
+    const buffer = Buffer.from(await response.arrayBuffer());
+    res.end(buffer);
+  } else {
+    res.end();
+  }
+}
+function toNodeHandler(auth) {
+  return async (req, res) => {
+    const request = await toWebRequest(req);
+    const response = await auth.handler(request);
+    await sendWebResponse(res, response);
+  };
+}
+
+// src/express.ts
+function incortaAuth(auth) {
+  const nodeHandler = toNodeHandler(auth);
+  const { basePath } = auth.config;
+  return async (req, res, next) => {
+    try {
+      const path = (req.originalUrl ?? req.url ?? "/").split("?")[0];
+      if (path === basePath || path.startsWith(`${basePath}/`)) {
+        await nodeHandler(req, res);
+        return;
+      }
+      req.incortaAuth = await auth.getSession(await toWebRequest(req));
+      next();
+    } catch (error) {
+      next(error);
+    }
+  };
+}
+function requireAuth(auth, options = {}) {
+  const mode = options.unauthenticated ?? "auto";
+  const { basePath } = auth.config;
+  return async (req, res, next) => {
+    try {
+      if (req.incortaAuth === void 0) {
+        req.incortaAuth = await auth.getSession(await toWebRequest(req));
+      }
+      if (req.incortaAuth) {
+        next();
+        return;
+      }
+      const wantsHtml = (req.headers.accept ?? "").includes("text/html");
+      if (mode === "redirect" || mode === "auto" && wantsHtml) {
+        const returnTo = req.originalUrl ?? req.url ?? "/";
+        res.statusCode = 302;
+        res.setHeader(
+          "location",
+          `${basePath}/login?redirect_to=${encodeURIComponent(returnTo)}`
+        );
+        res.end();
+        return;
+      }
+      res.statusCode = 401;
+      res.setHeader("content-type", "application/json; charset=utf-8");
+      res.end(JSON.stringify({ error: "unauthenticated" }));
+    } catch (error) {
+      next(error);
+    }
+  };
+}
+// Annotate the CommonJS export names for ESM import in node:
+0 && (module.exports = {
+  incortaAuth,
+  requireAuth
+});
+//# sourceMappingURL=express.cjs.map

package/dist/express.cjs.map

@@ -0,0 +1 @@
+{"version":3,"sources":["../src/express.ts","../src/node.ts"],"sourcesContent":["import type { IncomingMessage, ServerResponse } from \"node:http\";\nimport type { AuthSession, IncortaAuth } from \"./index.js\";\nimport { toNodeHandler, toWebRequest } from \"./node.js\";\n\nexport type { AuthSession, IncortaAuth } from \"./index.js\";\n\n/**\n * Minimal structural types so this adapter works with Express 4/5 (and\n * anything Connect-compatible) without depending on Express itself.\n */\nexport interface AuthedRequest extends IncomingMessage {\n  originalUrl?: string;\n  /** Populated by `incortaAuth()`: the current session, or null when signed out. */\n  incortaAuth?: AuthSession | null;\n}\ntype NextFunction = (err?: unknown) => void;\ntype Middleware = (\n  req: AuthedRequest,\n  res: ServerResponse,\n  next: NextFunction,\n) => void | Promise<void>;\n\n/**\n * Express/Connect middleware that serves the auth routes (under\n * `auth.config.basePath`) and attaches the current session to every other\n * request as `req.incortaAuth`.\n *\n * ```ts\n * const auth = createIncortaAuth();\n * app.use(incortaAuth(auth));\n * app.get(\"/api/me\", requireAuth(auth), (req, res) => res.json(req.incortaAuth.user));\n * ```\n */\nexport function incortaAuth(auth: IncortaAuth): Middleware {\n  const nodeHandler = toNodeHandler(auth);\n  const { basePath } = auth.config;\n\n  return async (req, res, next) => {\n    try {\n      const path = (req.originalUrl ?? req.url ?? \"/\").split(\"?\")[0];\n      if (path === basePath || path.startsWith(`${basePath}/`)) {\n        await nodeHandler(req, res);\n        return;\n      }\n      req.incortaAuth = await auth.getSession(await toWebRequest(req));\n      next();\n    } catch (error) {\n      next(error);\n    }\n  };\n}\n\nexport interface RequireAuthOptions {\n  /**\n   * How to reject unauthenticated requests:\n   * - `\"redirect\"`: 302 to the login route (which bounces through Incorta login\n   *   and back to the original URL) — right for page routes.\n   * - `\"json\"`: 401 `{ error: \"unauthenticated\" }` — right for API routes.\n   * - `\"auto\"` (default): redirect when the request accepts text/html, 401 otherwise.\n   */\n  unauthenticated?: \"redirect\" | \"json\" | \"auto\";\n}\n\n/** Guards a route: only signed-in Incorta users get through. */\nexport function requireAuth(auth: IncortaAuth, options: RequireAuthOptions = {}): Middleware {\n  const mode = options.unauthenticated ?? \"auto\";\n  const { basePath } = auth.config;\n\n  return async (req, res, next) => {\n    try {\n      if (req.incortaAuth === undefined) {\n        req.incortaAuth = await auth.getSession(await toWebRequest(req));\n      }\n      if (req.incortaAuth) {\n        next();\n        return;\n      }\n\n      const wantsHtml = (req.headers.accept ?? \"\").includes(\"text/html\");\n      if (mode === \"redirect\" || (mode === \"auto\" && wantsHtml)) {\n        const returnTo = req.originalUrl ?? req.url ?? \"/\";\n        res.statusCode = 302;\n        res.setHeader(\n          \"location\",\n          `${basePath}/login?redirect_to=${encodeURIComponent(returnTo)}`,\n        );\n        res.end();\n        return;\n      }\n\n      res.statusCode = 401;\n      res.setHeader(\"content-type\", \"application/json; charset=utf-8\");\n      res.end(JSON.stringify({ error: \"unauthenticated\" }));\n    } catch (error) {\n      next(error);\n    }\n  };\n}\n","import type { IncomingMessage, ServerResponse } from \"node:http\";\nimport type { IncortaAuth } from \"./index.js\";\n\nexport type { IncortaAuth } from \"./index.js\";\n\n/**\n * Builds a web-standard `Request` from a Node request. Buffers the body (the\n * auth routes are GET/POST-without-body, so this stays tiny).\n */\nexport async function toWebRequest(req: IncomingMessage): Promise<Request> {\n  const proto =\n    (req.headers[\"x-forwarded-proto\"] as string | undefined)?.split(\",\")[0]?.trim() ??\n    ((req.socket as { encrypted?: boolean }).encrypted ? \"https\" : \"http\");\n  const host = req.headers.host ?? \"localhost\";\n  // Express rewrites req.url when routers are mounted — originalUrl keeps the full path.\n  const path = (req as { originalUrl?: string }).originalUrl ?? req.url ?? \"/\";\n  const url = `${proto}://${host}${path}`;\n\n  const headers = new Headers();\n  for (let i = 0; i < req.rawHeaders.length; i += 2) {\n    headers.append(req.rawHeaders[i], req.rawHeaders[i + 1]);\n  }\n\n  const method = req.method ?? \"GET\";\n  let body: BodyInit | undefined;\n  if (method !== \"GET\" && method !== \"HEAD\") {\n    const chunks: Buffer[] = [];\n    for await (const chunk of req) {\n      chunks.push(Buffer.isBuffer(chunk) ? chunk : Buffer.from(chunk));\n    }\n    if (chunks.length) {\n      const bytes = new Uint8Array(chunks.reduce((n, c) => n + c.length, 0));\n      let offset = 0;\n      for (const chunk of chunks) {\n        bytes.set(chunk, offset);\n        offset += chunk.length;\n      }\n      body = bytes;\n    }\n  }\n\n  return new Request(url, { method, headers, body });\n}\n\nexport async function sendWebResponse(\n  res: ServerResponse,\n  response: Response,\n): Promise<void> {\n  res.statusCode = response.status;\n  response.headers.forEach((value, name) => {\n    if (name.toLowerCase() === \"set-cookie\") return; // handled below, needs the un-joined list\n    res.setHeader(name, value);\n  });\n  const setCookies = response.headers.getSetCookie();\n  if (setCookies.length) res.setHeader(\"set-cookie\", setCookies);\n\n  if (response.body) {\n    const buffer = Buffer.from(await response.arrayBuffer());\n    res.end(buffer);\n  } else {\n    res.end();\n  }\n}\n\n/**\n * Adapts the auth handler to a plain Node `(req, res)` listener:\n *\n * ```ts\n * import http from \"node:http\";\n * const authListener = toNodeHandler(auth);\n * http.createServer((req, res) => {\n *   if (req.url?.startsWith(\"/auth\")) return authListener(req, res);\n *   // ... your app\n * });\n * ```\n */\nexport function toNodeHandler(auth: IncortaAuth) {\n  return async (req: IncomingMessage, res: ServerResponse): Promise<void> => {\n    const request = await toWebRequest(req);\n    const response = await auth.handler(request);\n    await sendWebResponse(res, response);\n  };\n}\n\n/** Reads the current session from a Node request (returns null when signed out). */\nexport async function getNodeSession(auth: IncortaAuth, req: IncomingMessage) {\n  return auth.getSession(await toWebRequest(req));\n}\n"],"mappings":";;;;;;;;;;;;;;;;;;;;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;;;ACSA,eAAsB,aAAa,KAAwC;AACzE,QAAM,QACH,IAAI,QAAQ,mBAAmB,GAA0B,MAAM,GAAG,EAAE,CAAC,GAAG,KAAK,MAC5E,IAAI,OAAmC,YAAY,UAAU;AACjE,QAAM,OAAO,IAAI,QAAQ,QAAQ;AAEjC,QAAM,OAAQ,IAAiC,eAAe,IAAI,OAAO;AACzE,QAAM,MAAM,GAAG,KAAK,MAAM,IAAI,GAAG,IAAI;AAErC,QAAM,UAAU,IAAI,QAAQ;AAC5B,WAAS,IAAI,GAAG,IAAI,IAAI,WAAW,QAAQ,KAAK,GAAG;AACjD,YAAQ,OAAO,IAAI,WAAW,CAAC,GAAG,IAAI,WAAW,IAAI,CAAC,CAAC;AAAA,EACzD;AAEA,QAAM,SAAS,IAAI,UAAU;AAC7B,MAAI;AACJ,MAAI,WAAW,SAAS,WAAW,QAAQ;AACzC,UAAM,SAAmB,CAAC;AAC1B,qBAAiB,SAAS,KAAK;AAC7B,aAAO,KAAK,OAAO,SAAS,KAAK,IAAI,QAAQ,OAAO,KAAK,KAAK,CAAC;AAAA,IACjE;AACA,QAAI,OAAO,QAAQ;AACjB,YAAM,QAAQ,IAAI,WAAW,OAAO,OAAO,CAAC,GAAG,MAAM,IAAI,EAAE,QAAQ,CAAC,CAAC;AACrE,UAAI,SAAS;AACb,iBAAW,SAAS,QAAQ;AAC1B,cAAM,IAAI,OAAO,MAAM;AACvB,kBAAU,MAAM;AAAA,MAClB;AACA,aAAO;AAAA,IACT;AAAA,EACF;AAEA,SAAO,IAAI,QAAQ,KAAK,EAAE,QAAQ,SAAS,KAAK,CAAC;AACnD;AAEA,eAAsB,gBACpB,KACA,UACe;AACf,MAAI,aAAa,SAAS;AAC1B,WAAS,QAAQ,QAAQ,CAAC,OAAO,SAAS;AACxC,QAAI,KAAK,YAAY,MAAM,aAAc;AACzC,QAAI,UAAU,MAAM,KAAK;AAAA,EAC3B,CAAC;AACD,QAAM,aAAa,SAAS,QAAQ,aAAa;AACjD,MAAI,WAAW,OAAQ,KAAI,UAAU,cAAc,UAAU;AAE7D,MAAI,SAAS,MAAM;AACjB,UAAM,SAAS,OAAO,KAAK,MAAM,SAAS,YAAY,CAAC;AACvD,QAAI,IAAI,MAAM;AAAA,EAChB,OAAO;AACL,QAAI,IAAI;AAAA,EACV;AACF;AAcO,SAAS,cAAc,MAAmB;AAC/C,SAAO,OAAO,KAAsB,QAAuC;AACzE,UAAM,UAAU,MAAM,aAAa,GAAG;AACtC,UAAM,WAAW,MAAM,KAAK,QAAQ,OAAO;AAC3C,UAAM,gBAAgB,KAAK,QAAQ;AAAA,EACrC;AACF;;;ADjDO,SAAS,YAAY,MAA+B;AACzD,QAAM,cAAc,cAAc,IAAI;AACtC,QAAM,EAAE,SAAS,IAAI,KAAK;AAE1B,SAAO,OAAO,KAAK,KAAK,SAAS;AAC/B,QAAI;AACF,YAAM,QAAQ,IAAI,eAAe,IAAI,OAAO,KAAK,MAAM,GAAG,EAAE,CAAC;AAC7D,UAAI,SAAS,YAAY,KAAK,WAAW,GAAG,QAAQ,GAAG,GAAG;AACxD,cAAM,YAAY,KAAK,GAAG;AAC1B;AAAA,MACF;AACA,UAAI,cAAc,MAAM,KAAK,WAAW,MAAM,aAAa,GAAG,CAAC;AAC/D,WAAK;AAAA,IACP,SAAS,OAAO;AACd,WAAK,KAAK;AAAA,IACZ;AAAA,EACF;AACF;AAcO,SAAS,YAAY,MAAmB,UAA8B,CAAC,GAAe;AAC3F,QAAM,OAAO,QAAQ,mBAAmB;AACxC,QAAM,EAAE,SAAS,IAAI,KAAK;AAE1B,SAAO,OAAO,KAAK,KAAK,SAAS;AAC/B,QAAI;AACF,UAAI,IAAI,gBAAgB,QAAW;AACjC,YAAI,cAAc,MAAM,KAAK,WAAW,MAAM,aAAa,GAAG,CAAC;AAAA,MACjE;AACA,UAAI,IAAI,aAAa;AACnB,aAAK;AACL;AAAA,MACF;AAEA,YAAM,aAAa,IAAI,QAAQ,UAAU,IAAI,SAAS,WAAW;AACjE,UAAI,SAAS,cAAe,SAAS,UAAU,WAAY;AACzD,cAAM,WAAW,IAAI,eAAe,IAAI,OAAO;AAC/C,YAAI,aAAa;AACjB,YAAI;AAAA,UACF;AAAA,UACA,GAAG,QAAQ,sBAAsB,mBAAmB,QAAQ,CAAC;AAAA,QAC/D;AACA,YAAI,IAAI;AACR;AAAA,MACF;AAEA,UAAI,aAAa;AACjB,UAAI,UAAU,gBAAgB,iCAAiC;AAC/D,UAAI,IAAI,KAAK,UAAU,EAAE,OAAO,kBAAkB,CAAC,CAAC;AAAA,IACtD,SAAS,OAAO;AACd,WAAK,KAAK;AAAA,IACZ;AAAA,EACF;AACF;","names":[]}

package/dist/express.d.cts

@@ -0,0 +1,42 @@
+import { IncomingMessage, ServerResponse } from 'node:http';
+import { AuthSession, IncortaAuth } from './index.cjs';
+import './config-B-2cbZDV.cjs';
+import 'jose';
+
+/**
+ * Minimal structural types so this adapter works with Express 4/5 (and
+ * anything Connect-compatible) without depending on Express itself.
+ */
+interface AuthedRequest extends IncomingMessage {
+    originalUrl?: string;
+    /** Populated by `incortaAuth()`: the current session, or null when signed out. */
+    incortaAuth?: AuthSession | null;
+}
+type NextFunction = (err?: unknown) => void;
+type Middleware = (req: AuthedRequest, res: ServerResponse, next: NextFunction) => void | Promise<void>;
+/**
+ * Express/Connect middleware that serves the auth routes (under
+ * `auth.config.basePath`) and attaches the current session to every other
+ * request as `req.incortaAuth`.
+ *
+ * ```ts
+ * const auth = createIncortaAuth();
+ * app.use(incortaAuth(auth));
+ * app.get("/api/me", requireAuth(auth), (req, res) => res.json(req.incortaAuth.user));
+ * ```
+ */
+declare function incortaAuth(auth: IncortaAuth): Middleware;
+interface RequireAuthOptions {
+    /**
+     * How to reject unauthenticated requests:
+     * - `"redirect"`: 302 to the login route (which bounces through Incorta login
+     *   and back to the original URL) — right for page routes.
+     * - `"json"`: 401 `{ error: "unauthenticated" }` — right for API routes.
+     * - `"auto"` (default): redirect when the request accepts text/html, 401 otherwise.
+     */
+    unauthenticated?: "redirect" | "json" | "auto";
+}
+/** Guards a route: only signed-in Incorta users get through. */
+declare function requireAuth(auth: IncortaAuth, options?: RequireAuthOptions): Middleware;
+
+export { AuthSession, type AuthedRequest, IncortaAuth, type RequireAuthOptions, incortaAuth, requireAuth };

package/dist/express.d.ts

@@ -0,0 +1,42 @@
+import { IncomingMessage, ServerResponse } from 'node:http';
+import { AuthSession, IncortaAuth } from './index.js';
+import './config-B-2cbZDV.js';
+import 'jose';
+
+/**
+ * Minimal structural types so this adapter works with Express 4/5 (and
+ * anything Connect-compatible) without depending on Express itself.
+ */
+interface AuthedRequest extends IncomingMessage {
+    originalUrl?: string;
+    /** Populated by `incortaAuth()`: the current session, or null when signed out. */
+    incortaAuth?: AuthSession | null;
+}
+type NextFunction = (err?: unknown) => void;
+type Middleware = (req: AuthedRequest, res: ServerResponse, next: NextFunction) => void | Promise<void>;
+/**
+ * Express/Connect middleware that serves the auth routes (under
+ * `auth.config.basePath`) and attaches the current session to every other
+ * request as `req.incortaAuth`.
+ *
+ * ```ts
+ * const auth = createIncortaAuth();
+ * app.use(incortaAuth(auth));
+ * app.get("/api/me", requireAuth(auth), (req, res) => res.json(req.incortaAuth.user));
+ * ```
+ */
+declare function incortaAuth(auth: IncortaAuth): Middleware;
+interface RequireAuthOptions {
+    /**
+     * How to reject unauthenticated requests:
+     * - `"redirect"`: 302 to the login route (which bounces through Incorta login
+     *   and back to the original URL) — right for page routes.
+     * - `"json"`: 401 `{ error: "unauthenticated" }` — right for API routes.
+     * - `"auto"` (default): redirect when the request accepts text/html, 401 otherwise.
+     */
+    unauthenticated?: "redirect" | "json" | "auto";
+}
+/** Guards a route: only signed-in Incorta users get through. */
+declare function requireAuth(auth: IncortaAuth, options?: RequireAuthOptions): Middleware;
+
+export { AuthSession, type AuthedRequest, IncortaAuth, type RequireAuthOptions, incortaAuth, requireAuth };

package/dist/express.js

@@ -0,0 +1,59 @@
+import {
+  toNodeHandler,
+  toWebRequest
+} from "./chunk-LNPECE7W.js";
+
+// src/express.ts
+function incortaAuth(auth) {
+  const nodeHandler = toNodeHandler(auth);
+  const { basePath } = auth.config;
+  return async (req, res, next) => {
+    try {
+      const path = (req.originalUrl ?? req.url ?? "/").split("?")[0];
+      if (path === basePath || path.startsWith(`${basePath}/`)) {
+        await nodeHandler(req, res);
+        return;
+      }
+      req.incortaAuth = await auth.getSession(await toWebRequest(req));
+      next();
+    } catch (error) {
+      next(error);
+    }
+  };
+}
+function requireAuth(auth, options = {}) {
+  const mode = options.unauthenticated ?? "auto";
+  const { basePath } = auth.config;
+  return async (req, res, next) => {
+    try {
+      if (req.incortaAuth === void 0) {
+        req.incortaAuth = await auth.getSession(await toWebRequest(req));
+      }
+      if (req.incortaAuth) {
+        next();
+        return;
+      }
+      const wantsHtml = (req.headers.accept ?? "").includes("text/html");
+      if (mode === "redirect" || mode === "auto" && wantsHtml) {
+        const returnTo = req.originalUrl ?? req.url ?? "/";
+        res.statusCode = 302;
+        res.setHeader(
+          "location",
+          `${basePath}/login?redirect_to=${encodeURIComponent(returnTo)}`
+        );
+        res.end();
+        return;
+      }
+      res.statusCode = 401;
+      res.setHeader("content-type", "application/json; charset=utf-8");
+      res.end(JSON.stringify({ error: "unauthenticated" }));
+    } catch (error) {
+      next(error);
+    }
+  };
+}
+export {
+  incortaAuth,
+  requireAuth
+};
+//# sourceMappingURL=express.js.map

package/dist/express.js.map

@@ -0,0 +1 @@
+{"version":3,"sources":["../src/express.ts"],"sourcesContent":["import type { IncomingMessage, ServerResponse } from \"node:http\";\nimport type { AuthSession, IncortaAuth } from \"./index.js\";\nimport { toNodeHandler, toWebRequest } from \"./node.js\";\n\nexport type { AuthSession, IncortaAuth } from \"./index.js\";\n\n/**\n * Minimal structural types so this adapter works with Express 4/5 (and\n * anything Connect-compatible) without depending on Express itself.\n */\nexport interface AuthedRequest extends IncomingMessage {\n  originalUrl?: string;\n  /** Populated by `incortaAuth()`: the current session, or null when signed out. */\n  incortaAuth?: AuthSession | null;\n}\ntype NextFunction = (err?: unknown) => void;\ntype Middleware = (\n  req: AuthedRequest,\n  res: ServerResponse,\n  next: NextFunction,\n) => void | Promise<void>;\n\n/**\n * Express/Connect middleware that serves the auth routes (under\n * `auth.config.basePath`) and attaches the current session to every other\n * request as `req.incortaAuth`.\n *\n * ```ts\n * const auth = createIncortaAuth();\n * app.use(incortaAuth(auth));\n * app.get(\"/api/me\", requireAuth(auth), (req, res) => res.json(req.incortaAuth.user));\n * ```\n */\nexport function incortaAuth(auth: IncortaAuth): Middleware {\n  const nodeHandler = toNodeHandler(auth);\n  const { basePath } = auth.config;\n\n  return async (req, res, next) => {\n    try {\n      const path = (req.originalUrl ?? req.url ?? \"/\").split(\"?\")[0];\n      if (path === basePath || path.startsWith(`${basePath}/`)) {\n        await nodeHandler(req, res);\n        return;\n      }\n      req.incortaAuth = await auth.getSession(await toWebRequest(req));\n      next();\n    } catch (error) {\n      next(error);\n    }\n  };\n}\n\nexport interface RequireAuthOptions {\n  /**\n   * How to reject unauthenticated requests:\n   * - `\"redirect\"`: 302 to the login route (which bounces through Incorta login\n   *   and back to the original URL) — right for page routes.\n   * - `\"json\"`: 401 `{ error: \"unauthenticated\" }` — right for API routes.\n   * - `\"auto\"` (default): redirect when the request accepts text/html, 401 otherwise.\n   */\n  unauthenticated?: \"redirect\" | \"json\" | \"auto\";\n}\n\n/** Guards a route: only signed-in Incorta users get through. */\nexport function requireAuth(auth: IncortaAuth, options: RequireAuthOptions = {}): Middleware {\n  const mode = options.unauthenticated ?? \"auto\";\n  const { basePath } = auth.config;\n\n  return async (req, res, next) => {\n    try {\n      if (req.incortaAuth === undefined) {\n        req.incortaAuth = await auth.getSession(await toWebRequest(req));\n      }\n      if (req.incortaAuth) {\n        next();\n        return;\n      }\n\n      const wantsHtml = (req.headers.accept ?? \"\").includes(\"text/html\");\n      if (mode === \"redirect\" || (mode === \"auto\" && wantsHtml)) {\n        const returnTo = req.originalUrl ?? req.url ?? \"/\";\n        res.statusCode = 302;\n        res.setHeader(\n          \"location\",\n          `${basePath}/login?redirect_to=${encodeURIComponent(returnTo)}`,\n        );\n        res.end();\n        return;\n      }\n\n      res.statusCode = 401;\n      res.setHeader(\"content-type\", \"application/json; charset=utf-8\");\n      res.end(JSON.stringify({ error: \"unauthenticated\" }));\n    } catch (error) {\n      next(error);\n    }\n  };\n}\n"],"mappings":";;;;;;AAiCO,SAAS,YAAY,MAA+B;AACzD,QAAM,cAAc,cAAc,IAAI;AACtC,QAAM,EAAE,SAAS,IAAI,KAAK;AAE1B,SAAO,OAAO,KAAK,KAAK,SAAS;AAC/B,QAAI;AACF,YAAM,QAAQ,IAAI,eAAe,IAAI,OAAO,KAAK,MAAM,GAAG,EAAE,CAAC;AAC7D,UAAI,SAAS,YAAY,KAAK,WAAW,GAAG,QAAQ,GAAG,GAAG;AACxD,cAAM,YAAY,KAAK,GAAG;AAC1B;AAAA,MACF;AACA,UAAI,cAAc,MAAM,KAAK,WAAW,MAAM,aAAa,GAAG,CAAC;AAC/D,WAAK;AAAA,IACP,SAAS,OAAO;AACd,WAAK,KAAK;AAAA,IACZ;AAAA,EACF;AACF;AAcO,SAAS,YAAY,MAAmB,UAA8B,CAAC,GAAe;AAC3F,QAAM,OAAO,QAAQ,mBAAmB;AACxC,QAAM,EAAE,SAAS,IAAI,KAAK;AAE1B,SAAO,OAAO,KAAK,KAAK,SAAS;AAC/B,QAAI;AACF,UAAI,IAAI,gBAAgB,QAAW;AACjC,YAAI,cAAc,MAAM,KAAK,WAAW,MAAM,aAAa,GAAG,CAAC;AAAA,MACjE;AACA,UAAI,IAAI,aAAa;AACnB,aAAK;AACL;AAAA,MACF;AAEA,YAAM,aAAa,IAAI,QAAQ,UAAU,IAAI,SAAS,WAAW;AACjE,UAAI,SAAS,cAAe,SAAS,UAAU,WAAY;AACzD,cAAM,WAAW,IAAI,eAAe,IAAI,OAAO;AAC/C,YAAI,aAAa;AACjB,YAAI;AAAA,UACF;AAAA,UACA,GAAG,QAAQ,sBAAsB,mBAAmB,QAAQ,CAAC;AAAA,QAC/D;AACA,YAAI,IAAI;AACR;AAAA,MACF;AAEA,UAAI,aAAa;AACjB,UAAI,UAAU,gBAAgB,iCAAiC;AAC/D,UAAI,IAAI,KAAK,UAAU,EAAE,OAAO,kBAAkB,CAAC,CAAC;AAAA,IACtD,SAAS,OAAO;AACd,WAAK,KAAK;AAAA,IACZ;AAAA,EACF;AACF;","names":[]}