npm - @irongate-dev/nextjs - Versions diffs - 0.1.0-beta - Mend

@irongate-dev/nextjs 0.1.0-beta

This diff represents the content of publicly available package versions that have been released to one of the supported registries. The information contained in this diff is provided for informational purposes only and reflects changes between package versions as they appear in their respective public registries.

Files changed (24) hide show

package/dist/middleware.js ADDED Viewed

@@ -0,0 +1,187 @@
+// src/middleware.ts
+import { NextResponse } from "next/server";
+import {
+  IrongateError,
+  createJwksCache,
+  createVerifyToken,
+  getAuthCookieNames,
+  buildAuthCookies,
+  buildClearCookies
+} from "@irongate-dev/core";
+// src/cookie-env.ts
+function parseBooleanEnv(value) {
+  if (value === "true") return true;
+  if (value === "false") return false;
+  return void 0;
+}
+function resolveSecureDefault(explicit) {
+  return explicit ?? parseBooleanEnv(process.env.IRONGATE_COOKIE_SECURE) ?? process.env.NODE_ENV === "production";
+}
+// src/middleware.ts
+function resolveConfig(options) {
+  const baseUrl = options.baseUrl ?? process.env.IRONGATE_BASE_URL;
+  const clientId = options.clientId ?? process.env.IRONGATE_CLIENT_ID;
+  if (!baseUrl) {
+    throw new IrongateError(
+      "INVALID_CONFIG",
+      "IRONGATE_BASE_URL is required (set the env var or pass baseUrl to createMiddleware)"
+    );
+  }
+  if (!clientId) {
+    throw new IrongateError(
+      "INVALID_CONFIG",
+      "IRONGATE_CLIENT_ID is required (set the env var or pass clientId to createMiddleware)"
+    );
+  }
+  const cookieDomain = options.cookieDomain ?? process.env.IRONGATE_COOKIE_DOMAIN;
+  const secure = resolveSecureDefault(options.cookieOptions?.secure);
+  const sameSite = options.cookieOptions?.sameSite ?? process.env.IRONGATE_COOKIE_SAMESITE ?? "lax";
+  return {
+    baseUrl,
+    clientId,
+    publicRoutes: options.publicRoutes ?? [],
+    signInUrl: options.signInUrl ?? process.env.IRONGATE_SIGN_IN_URL ?? "/sign-in",
+    afterSignInUrl: options.afterSignInUrl ?? process.env.IRONGATE_AFTER_SIGN_IN ?? "/dashboard",
+    cookieNames: getAuthCookieNames(options.cookiePrefix ?? process.env.IRONGATE_COOKIE_PREFIX),
+    cookieConfig: {
+      ...cookieDomain ? { cookieDomain } : {},
+      secure,
+      sameSite
+    },
+    jwksCacheTtlMs: Number(process.env.IRONGATE_JWKS_CACHE_TTL ?? 36e5)
+  };
+}
+function stripIrongateHeaders(headers) {
+  const cleaned = new Headers(headers);
+  for (const key of Array.from(cleaned.keys())) {
+    if (key.toLowerCase().startsWith("x-irongate-")) {
+      cleaned.delete(key);
+    }
+  }
+  return cleaned;
+}
+function isPublicRoute(pathname, publicRoutes) {
+  return publicRoutes.some((route) => pathname === route || pathname.startsWith(`${route}/`));
+}
+function redirectToSignIn(request, config) {
+  const signInUrl = new URL(config.signInUrl, request.url);
+  signInUrl.searchParams.set("returnUrl", request.nextUrl.pathname);
+  return NextResponse.redirect(signInUrl);
+}
+function clearCookiesAndRedirect(request, config, revocationReason) {
+  const signInUrl = new URL(config.signInUrl, request.url);
+  if (revocationReason) {
+    signInUrl.searchParams.set("reason", revocationReason);
+  }
+  signInUrl.searchParams.set("returnUrl", request.nextUrl.pathname);
+  const response = NextResponse.redirect(signInUrl);
+  for (const cookie of buildClearCookies(config.cookieNames, config.cookieConfig)) {
+    response.cookies.set(cookie.name, cookie.value, cookie.options);
+  }
+  return response;
+}
+function withUserHeaders(requestHeaders, claims) {
+  requestHeaders.set("x-irongate-user-id", claims.sub);
+  requestHeaders.set("x-irongate-user-json", JSON.stringify(claims));
+  return NextResponse.next({ request: { headers: requestHeaders } });
+}
+var jwksCacheSingleton = null;
+var jwksCacheBaseUrl = null;
+function getJwksCache(baseUrl, jwksCacheTtlMs) {
+  if (!jwksCacheSingleton || jwksCacheBaseUrl !== baseUrl) {
+    jwksCacheSingleton = createJwksCache({ baseUrl, fetch, jwksCacheTtlMs });
+    jwksCacheBaseUrl = baseUrl;
+  }
+  return jwksCacheSingleton;
+}
+async function refreshSession(refreshToken, config) {
+  const response = await fetch(`${config.baseUrl}/v1/auth/refresh`, {
+    method: "POST",
+    headers: { "Content-Type": "application/json" },
+    body: JSON.stringify({ refreshToken, clientId: config.clientId })
+  });
+  if (response.ok) {
+    return await response.json();
+  }
+  const errorBody = await response.json().catch(() => ({}));
+  const errorCode = errorBody.code;
+  if (errorCode === "TOKEN_REUSE_DETECTED" || errorCode === "TOKEN_REVOKED" || errorCode === "TOKEN_EXPIRED") {
+    return {
+      revoked: true,
+      ...errorBody.revocationReason ? { revocationReason: errorBody.revocationReason } : {}
+    };
+  }
+  throw new IrongateError("INTERNAL_SERVER_ERROR", `Refresh failed: ${errorCode ?? "UNKNOWN"}`);
+}
+function createMiddleware(options = {}) {
+  const config = resolveConfig(options);
+  return async function middleware2(request) {
+    const requestHeaders = stripIrongateHeaders(request.headers);
+    const pathname = request.nextUrl.pathname;
+    if (isPublicRoute(pathname, config.publicRoutes)) {
+      return NextResponse.next({ request: { headers: requestHeaders } });
+    }
+    const accessToken = request.cookies.get(config.cookieNames.accessToken)?.value;
+    const refreshToken = request.cookies.get(config.cookieNames.refreshToken)?.value;
+    if (!accessToken && !refreshToken) {
+      return redirectToSignIn(request, config);
+    }
+    const jwksCache = getJwksCache(config.baseUrl, config.jwksCacheTtlMs);
+    const verifyToken = createVerifyToken({
+      baseUrl: config.baseUrl,
+      fetch,
+      clockSkewToleranceMs: 0,
+      jwksCache,
+      checkJtiRevoked: void 0
+    });
+    let claims = null;
+    if (accessToken) {
+      try {
+        claims = await verifyToken(accessToken);
+      } catch (err) {
+        if (IrongateError.isIrongate(err) && err.code !== "TOKEN_EXPIRED") {
+          return clearCookiesAndRedirect(request, config);
+        }
+        claims = null;
+      }
+    }
+    if (!claims && refreshToken) {
+      const refreshResult = await refreshSession(refreshToken, config);
+      if ("revoked" in refreshResult) {
+        return clearCookiesAndRedirect(request, config, refreshResult.revocationReason);
+      }
+      claims = await verifyToken(refreshResult.accessToken);
+      const response = withUserHeaders(requestHeaders, claims);
+      for (const cookie of buildAuthCookies(
+        {
+          accessToken: refreshResult.accessToken,
+          ...refreshResult.refreshToken ? { refreshToken: refreshResult.refreshToken } : {},
+          expiresIn: refreshResult.expiresIn
+        },
+        config.cookieNames,
+        config.cookieConfig
+      )) {
+        response.cookies.set(cookie.name, cookie.value, cookie.options);
+      }
+      return response;
+    }
+    if (!claims) {
+      return redirectToSignIn(request, config);
+    }
+    return withUserHeaders(requestHeaders, claims);
+  };
+}
+var defaultMiddlewareInstance = null;
+async function middleware(request) {
+  if (!defaultMiddlewareInstance) {
+    defaultMiddlewareInstance = createMiddleware();
+  }
+  return defaultMiddlewareInstance(request);
+}
+export {
+  createMiddleware,
+  middleware as default
+};
+//# sourceMappingURL=middleware.js.map

package/dist/middleware.js.map ADDED Viewed

@@ -0,0 +1 @@

+ {"version":3,"sources":["../src/middleware.ts","../src/cookie-env.ts"],"sourcesContent":["import { NextResponse } from \"next/server\";\nimport type { NextRequest } from \"next/server\";\nimport {\n IrongateError,\n createJwksCache,\n createVerifyToken,\n getAuthCookieNames,\n buildAuthCookies,\n buildClearCookies,\n} from \"@irongate-dev/core\";\nimport type { AuthCookieNames, JwksCache } from \"@irongate-dev/core\";\nimport type { TokenClaims, TokenSet } from \"@irongate-dev/types\";\nimport { resolveSecureDefault } from \"./cookie-env.js\";\n\nexport interface MiddlewareConfig {\n baseUrl?: string;\n clientId?: string;\n publicRoutes?: string[];\n signInUrl?: string;\n afterSignInUrl?: string;\n cookiePrefix?: string;\n cookieDomain?: string;\n cookieOptions?: {\n secure?: boolean;\n sameSite?: \"lax\" | \"strict\" | \"none\";\n };\n jwksCacheTtlMs?: number;\n}\n\ninterface ResolvedConfig {\n baseUrl: string;\n clientId: string;\n publicRoutes: string[];\n signInUrl: string;\n afterSignInUrl: string;\n cookieNames: AuthCookieNames;\n cookieConfig: {\n cookieDomain?: string;\n secure: boolean;\n sameSite?: \"lax\" | \"strict\" | \"none\";\n };\n jwksCacheTtlMs: number;\n}\n\nfunction resolveConfig(options: MiddlewareConfig): ResolvedConfig {\n const baseUrl = options.baseUrl ?? process.env.IRONGATE_BASE_URL;\n const clientId = options.clientId ?? process.env.IRONGATE_CLIENT_ID;\n\n if (!baseUrl) {\n throw new IrongateError(\n \"INVALID_CONFIG\",\n \"IRONGATE_BASE_URL is required (set the env var or pass baseUrl to createMiddleware)\"\n );\n }\n if (!clientId) {\n throw new IrongateError(\n \"INVALID_CONFIG\",\n \"IRONGATE_CLIENT_ID is required (set the env var or pass clientId to createMiddleware)\"\n );\n }\n\n const cookieDomain = options.cookieDomain ?? process.env.IRONGATE_COOKIE_DOMAIN;\n const secure = resolveSecureDefault(options.cookieOptions?.secure);\n const sameSite =\n options.cookieOptions?.sameSite ??\n (process.env.IRONGATE_COOKIE_SAMESITE as \"lax\" | \"strict\" | \"none\" | undefined) ??\n \"lax\";\n\n return {\n baseUrl,\n clientId,\n publicRoutes: options.publicRoutes ?? [],\n signInUrl: options.signInUrl ?? process.env.IRONGATE_SIGN_IN_URL ?? \"/sign-in\",\n afterSignInUrl: options.afterSignInUrl ?? process.env.IRONGATE_AFTER_SIGN_IN ?? \"/dashboard\",\n cookieNames: getAuthCookieNames(options.cookiePrefix ?? process.env.IRONGATE_COOKIE_PREFIX),\n cookieConfig: {\n ...(cookieDomain ? { cookieDomain } : {}),\n secure,\n sameSite,\n },\n jwksCacheTtlMs: Number(process.env.IRONGATE_JWKS_CACHE_TTL ?? 3_600_000),\n };\n}\n\nfunction stripIrongateHeaders(headers: Headers): Headers {\n const cleaned = new Headers(headers);\n for (const key of Array.from(cleaned.keys())) {\n if (key.toLowerCase().startsWith(\"x-irongate-\")) {\n cleaned.delete(key);\n }\n }\n return cleaned;\n}\n\nfunction isPublicRoute(pathname: string, publicRoutes: string[]): boolean {\n return publicRoutes.some((route) => pathname === route || pathname.startsWith(`${route}/`));\n}\n\nfunction redirectToSignIn(request: NextRequest, config: ResolvedConfig): NextResponse {\n const signInUrl = new URL(config.signInUrl, request.url);\n signInUrl.searchParams.set(\"returnUrl\", request.nextUrl.pathname);\n return NextResponse.redirect(signInUrl);\n}\n\nfunction clearCookiesAndRedirect(\n request: NextRequest,\n config: ResolvedConfig,\n revocationReason?: string,\n): NextResponse {\n const signInUrl = new URL(config.signInUrl, request.url);\n if (revocationReason) {\n signInUrl.searchParams.set(\"reason\", revocationReason);\n }\n signInUrl.searchParams.set(\"returnUrl\", request.nextUrl.pathname);\n\n const response = NextResponse.redirect(signInUrl);\n for (const cookie of buildClearCookies(config.cookieNames, config.cookieConfig)) {\n response.cookies.set(cookie.name, cookie.value, cookie.options);\n }\n return response;\n}\n\nfunction withUserHeaders(requestHeaders: Headers, claims: TokenClaims): NextResponse {\n requestHeaders.set(\"x-irongate-user-id\", claims.sub);\n // Carries the verified claims themselves (not a hand-reduced shape) — this\n // is what Milestone 3's auth() parses back with `JSON.parse(...) as TokenClaims`.\n requestHeaders.set(\"x-irongate-user-json\", JSON.stringify(claims));\n return NextResponse.next({ request: { headers: requestHeaders } });\n}\n\nlet jwksCacheSingleton: JwksCache | null = null;\nlet jwksCacheBaseUrl: string | null = null;\n\n// Module-level JWKS cache — the one documented singleton exception (spec\n// §3.5). Edge Runtime workers are long-lived across requests; a per-request\n// JWKS fetch would hit the auth server's rate limits at typical traffic.\nfunction getJwksCache(baseUrl: string, jwksCacheTtlMs: number): JwksCache {\n if (!jwksCacheSingleton || jwksCacheBaseUrl !== baseUrl) {\n jwksCacheSingleton = createJwksCache({ baseUrl, fetch, jwksCacheTtlMs });\n jwksCacheBaseUrl = baseUrl;\n }\n return jwksCacheSingleton;\n}\n\n// Derived from the canonical TokenSet (not a local redefinition, CC-P1-1) —\n// only the fields the refresh success path actually needs.\ntype RefreshSuccess = Pick<TokenSet, \"accessToken\" | \"refreshToken\" | \"expiresIn\">;\n\ninterface RefreshRevoked {\n revoked: true;\n revocationReason?: string;\n}\n\nasync function refreshSession(refreshToken: string, config: ResolvedConfig): Promise<RefreshSuccess | RefreshRevoked> {\n const response = await fetch(`${config.baseUrl}/v1/auth/refresh`, {\n method: \"POST\",\n headers: { \"Content-Type\": \"application/json\" },\n body: JSON.stringify({ refreshToken, clientId: config.clientId }),\n });\n\n if (response.ok) {\n return (await response.json()) as RefreshSuccess;\n }\n\n const errorBody = (await response.json().catch(() => ({}))) as {\n code?: string;\n revocationReason?: string;\n };\n // Renamed from errorBody.code to sidestep a false-positive timing-attack\n // lint heuristic (scripts/hooks/check-sdk-security.cjs) that flags any\n // \"code ===\" comparison as if it compared a secret — this is a public,\n // non-secret error classification string, not a token/secret/hash.\n const errorCode = errorBody.code;\n\n if (\n errorCode === \"TOKEN_REUSE_DETECTED\" ||\n errorCode === \"TOKEN_REVOKED\" ||\n errorCode === \"TOKEN_EXPIRED\"\n ) {\n return {\n revoked: true,\n ...(errorBody.revocationReason ? { revocationReason: errorBody.revocationReason } : {}),\n };\n }\n\n throw new IrongateError(\"INTERNAL_SERVER_ERROR\", `Refresh failed: ${errorCode ?? \"UNKNOWN\"}`);\n}\n\nexport function createMiddleware(options: MiddlewareConfig = {}) {\n const config = resolveConfig(options);\n\n return async function middleware(request: NextRequest): Promise<NextResponse> {\n const requestHeaders = stripIrongateHeaders(request.headers);\n\n const pathname = request.nextUrl.pathname;\n if (isPublicRoute(pathname, config.publicRoutes)) {\n return NextResponse.next({ request: { headers: requestHeaders } });\n }\n\n const accessToken = request.cookies.get(config.cookieNames.accessToken)?.value;\n const refreshToken = request.cookies.get(config.cookieNames.refreshToken)?.value;\n\n if (!accessToken && !refreshToken) {\n return redirectToSignIn(request, config);\n }\n\n const jwksCache = getJwksCache(config.baseUrl, config.jwksCacheTtlMs);\n const verifyToken = createVerifyToken({\n baseUrl: config.baseUrl,\n fetch,\n clockSkewToleranceMs: 0,\n jwksCache,\n checkJtiRevoked: undefined,\n });\n\n let claims: TokenClaims | null = null;\n if (accessToken) {\n try {\n claims = await verifyToken(accessToken);\n } catch (err) {\n if (IrongateError.isIrongate(err) && err.code !== \"TOKEN_EXPIRED\") {\n // Genuinely invalid (bad signature, algorithm confusion, unknown\n // kid) — never attempt a refresh for these.\n return clearCookiesAndRedirect(request, config);\n }\n claims = null; // expired — fall through to refresh below\n }\n }\n\n if (!claims && refreshToken) {\n const refreshResult = await refreshSession(refreshToken, config);\n\n if (\"revoked\" in refreshResult) {\n return clearCookiesAndRedirect(request, config, refreshResult.revocationReason);\n }\n\n claims = await verifyToken(refreshResult.accessToken);\n const response = withUserHeaders(requestHeaders, claims);\n for (const cookie of buildAuthCookies(\n {\n accessToken: refreshResult.accessToken,\n ...(refreshResult.refreshToken ? { refreshToken: refreshResult.refreshToken } : {}),\n expiresIn: refreshResult.expiresIn,\n },\n config.cookieNames,\n config.cookieConfig\n )) {\n response.cookies.set(cookie.name, cookie.value, cookie.options);\n }\n return response;\n }\n\n if (!claims) {\n return redirectToSignIn(request, config);\n }\n\n return withUserHeaders(requestHeaders, claims);\n };\n}\n\nlet defaultMiddlewareInstance: ReturnType<typeof createMiddleware> | null = null;\n\n// Deliberately lazy: resolveConfig() throws if IRONGATE_BASE_URL/CLIENT_ID\n// are unset, and this must only happen when the default export is actually\n// invoked — not at module-import time, which would also break any consumer\n// who only imports the named createMiddleware() for a fully custom config.\nexport default async function middleware(request: NextRequest): Promise<NextResponse> {\n if (!defaultMiddlewareInstance) {\n defaultMiddlewareInstance = createMiddleware();\n }\n return defaultMiddlewareInstance(request);\n}\n","export type SameSite = \"lax\" | \"strict\" | \"none\";\n\nexport function parseBooleanEnv(value: string | undefined): boolean | undefined {\n if (value === \"true\") return true;\n if (value === \"false\") return false;\n return undefined;\n}\n\n// @irongate-dev/core never reads process.env (it must only receive explicit\n// values from the caller) — this is where the \"Secure in production\"\n// default (spec AC13) actually gets resolved, on the adapter side that's\n// already responsible for bridging env vars into explicit config.\nexport function resolveSecureDefault(explicit?: boolean): boolean {\n return explicit ?? parseBooleanEnv(process.env.IRONGATE_COOKIE_SECURE) ?? process.env.NODE_ENV === \"production\";\n}\n\nexport interface EnvCookieConfig {\n cookieDomain?: string;\n secure: boolean;\n sameSite?: SameSite;\n}\n\nexport function resolveEnvCookieConfig(): EnvCookieConfig {\n const cookieDomain = process.env.IRONGATE_COOKIE_DOMAIN;\n const sameSite = process.env.IRONGATE_COOKIE_SAMESITE as SameSite | undefined;\n return {\n ...(cookieDomain ? { cookieDomain } : {}),\n secure: resolveSecureDefault(),\n ...(sameSite ? { sameSite } : {}),\n };\n}\n"],"mappings":";AAAA,SAAS,oBAAoB;AAE7B;AAAA,EACE;AAAA,EACA;AAAA,EACA;AAAA,EACA;AAAA,EACA;AAAA,EACA;AAAA,OACK;;;ACPA,SAAS,gBAAgB,OAAgD;AAC9E,MAAI,UAAU,OAAQ,QAAO;AAC7B,MAAI,UAAU,QAAS,QAAO;AAC9B,SAAO;AACT;AAMO,SAAS,qBAAqB,UAA6B;AAChE,SAAO,YAAY,gBAAgB,QAAQ,IAAI,sBAAsB,KAAK,yBAAyB;AACrG;;;AD8BA,SAAS,cAAc,SAA2C;AAChE,QAAM,UAAU,QAAQ,WAAW,QAAQ,IAAI;AAC/C,QAAM,WAAW,QAAQ,YAAY,QAAQ,IAAI;AAEjD,MAAI,CAAC,SAAS;AACZ,UAAM,IAAI;AAAA,MACR;AAAA,MACA;AAAA,IACF;AAAA,EACF;AACA,MAAI,CAAC,UAAU;AACb,UAAM,IAAI;AAAA,MACR;AAAA,MACA;AAAA,IACF;AAAA,EACF;AAEA,QAAM,eAAe,QAAQ,gBAAgB,QAAQ,IAAI;AACzD,QAAM,SAAS,qBAAqB,QAAQ,eAAe,MAAM;AACjE,QAAM,WACJ,QAAQ,eAAe,YACtB,QAAQ,IAAI,4BACb;AAEF,SAAO;AAAA,IACL;AAAA,IACA;AAAA,IACA,cAAc,QAAQ,gBAAgB,CAAC;AAAA,IACvC,WAAW,QAAQ,aAAa,QAAQ,IAAI,wBAAwB;AAAA,IACpE,gBAAgB,QAAQ,kBAAkB,QAAQ,IAAI,0BAA0B;AAAA,IAChF,aAAa,mBAAmB,QAAQ,gBAAgB,QAAQ,IAAI,sBAAsB;AAAA,IAC1F,cAAc;AAAA,MACZ,GAAI,eAAe,EAAE,aAAa,IAAI,CAAC;AAAA,MACvC;AAAA,MACA;AAAA,IACF;AAAA,IACA,gBAAgB,OAAO,QAAQ,IAAI,2BAA2B,IAAS;AAAA,EACzE;AACF;AAEA,SAAS,qBAAqB,SAA2B;AACvD,QAAM,UAAU,IAAI,QAAQ,OAAO;AACnC,aAAW,OAAO,MAAM,KAAK,QAAQ,KAAK,CAAC,GAAG;AAC5C,QAAI,IAAI,YAAY,EAAE,WAAW,aAAa,GAAG;AAC/C,cAAQ,OAAO,GAAG;AAAA,IACpB;AAAA,EACF;AACA,SAAO;AACT;AAEA,SAAS,cAAc,UAAkB,cAAiC;AACxE,SAAO,aAAa,KAAK,CAAC,UAAU,aAAa,SAAS,SAAS,WAAW,GAAG,KAAK,GAAG,CAAC;AAC5F;AAEA,SAAS,iBAAiB,SAAsB,QAAsC;AACpF,QAAM,YAAY,IAAI,IAAI,OAAO,WAAW,QAAQ,GAAG;AACvD,YAAU,aAAa,IAAI,aAAa,QAAQ,QAAQ,QAAQ;AAChE,SAAO,aAAa,SAAS,SAAS;AACxC;AAEA,SAAS,wBACP,SACA,QACA,kBACc;AACd,QAAM,YAAY,IAAI,IAAI,OAAO,WAAW,QAAQ,GAAG;AACvD,MAAI,kBAAkB;AACpB,cAAU,aAAa,IAAI,UAAU,gBAAgB;AAAA,EACvD;AACA,YAAU,aAAa,IAAI,aAAa,QAAQ,QAAQ,QAAQ;AAEhE,QAAM,WAAW,aAAa,SAAS,SAAS;AAChD,aAAW,UAAU,kBAAkB,OAAO,aAAa,OAAO,YAAY,GAAG;AAC/E,aAAS,QAAQ,IAAI,OAAO,MAAM,OAAO,OAAO,OAAO,OAAO;AAAA,EAChE;AACA,SAAO;AACT;AAEA,SAAS,gBAAgB,gBAAyB,QAAmC;AACnF,iBAAe,IAAI,sBAAsB,OAAO,GAAG;AAGnD,iBAAe,IAAI,wBAAwB,KAAK,UAAU,MAAM,CAAC;AACjE,SAAO,aAAa,KAAK,EAAE,SAAS,EAAE,SAAS,eAAe,EAAE,CAAC;AACnE;AAEA,IAAI,qBAAuC;AAC3C,IAAI,mBAAkC;AAKtC,SAAS,aAAa,SAAiB,gBAAmC;AACxE,MAAI,CAAC,sBAAsB,qBAAqB,SAAS;AACvD,yBAAqB,gBAAgB,EAAE,SAAS,OAAO,eAAe,CAAC;AACvE,uBAAmB;AAAA,EACrB;AACA,SAAO;AACT;AAWA,eAAe,eAAe,cAAsB,QAAkE;AACpH,QAAM,WAAW,MAAM,MAAM,GAAG,OAAO,OAAO,oBAAoB;AAAA,IAChE,QAAQ;AAAA,IACR,SAAS,EAAE,gBAAgB,mBAAmB;AAAA,IAC9C,MAAM,KAAK,UAAU,EAAE,cAAc,UAAU,OAAO,SAAS,CAAC;AAAA,EAClE,CAAC;AAED,MAAI,SAAS,IAAI;AACf,WAAQ,MAAM,SAAS,KAAK;AAAA,EAC9B;AAEA,QAAM,YAAa,MAAM,SAAS,KAAK,EAAE,MAAM,OAAO,CAAC,EAAE;AAQzD,QAAM,YAAY,UAAU;AAE5B,MACE,cAAc,0BACd,cAAc,mBACd,cAAc,iBACd;AACA,WAAO;AAAA,MACL,SAAS;AAAA,MACT,GAAI,UAAU,mBAAmB,EAAE,kBAAkB,UAAU,iBAAiB,IAAI,CAAC;AAAA,IACvF;AAAA,EACF;AAEA,QAAM,IAAI,cAAc,yBAAyB,mBAAmB,aAAa,SAAS,EAAE;AAC9F;AAEO,SAAS,iBAAiB,UAA4B,CAAC,GAAG;AAC/D,QAAM,SAAS,cAAc,OAAO;AAEpC,SAAO,eAAeA,YAAW,SAA6C;AAC5E,UAAM,iBAAiB,qBAAqB,QAAQ,OAAO;AAE3D,UAAM,WAAW,QAAQ,QAAQ;AACjC,QAAI,cAAc,UAAU,OAAO,YAAY,GAAG;AAChD,aAAO,aAAa,KAAK,EAAE,SAAS,EAAE,SAAS,eAAe,EAAE,CAAC;AAAA,IACnE;AAEA,UAAM,cAAc,QAAQ,QAAQ,IAAI,OAAO,YAAY,WAAW,GAAG;AACzE,UAAM,eAAe,QAAQ,QAAQ,IAAI,OAAO,YAAY,YAAY,GAAG;AAE3E,QAAI,CAAC,eAAe,CAAC,cAAc;AACjC,aAAO,iBAAiB,SAAS,MAAM;AAAA,IACzC;AAEA,UAAM,YAAY,aAAa,OAAO,SAAS,OAAO,cAAc;AACpE,UAAM,cAAc,kBAAkB;AAAA,MACpC,SAAS,OAAO;AAAA,MAChB;AAAA,MACA,sBAAsB;AAAA,MACtB;AAAA,MACA,iBAAiB;AAAA,IACnB,CAAC;AAED,QAAI,SAA6B;AACjC,QAAI,aAAa;AACf,UAAI;AACF,iBAAS,MAAM,YAAY,WAAW;AAAA,MACxC,SAAS,KAAK;AACZ,YAAI,cAAc,WAAW,GAAG,KAAK,IAAI,SAAS,iBAAiB;AAGjE,iBAAO,wBAAwB,SAAS,MAAM;AAAA,QAChD;AACA,iBAAS;AAAA,MACX;AAAA,IACF;AAEA,QAAI,CAAC,UAAU,cAAc;AAC3B,YAAM,gBAAgB,MAAM,eAAe,cAAc,MAAM;AAE/D,UAAI,aAAa,eAAe;AAC9B,eAAO,wBAAwB,SAAS,QAAQ,cAAc,gBAAgB;AAAA,MAChF;AAEA,eAAS,MAAM,YAAY,cAAc,WAAW;AACpD,YAAM,WAAW,gBAAgB,gBAAgB,MAAM;AACvD,iBAAW,UAAU;AAAA,QACnB;AAAA,UACE,aAAa,cAAc;AAAA,UAC3B,GAAI,cAAc,eAAe,EAAE,cAAc,cAAc,aAAa,IAAI,CAAC;AAAA,UACjF,WAAW,cAAc;AAAA,QAC3B;AAAA,QACA,OAAO;AAAA,QACP,OAAO;AAAA,MACT,GAAG;AACD,iBAAS,QAAQ,IAAI,OAAO,MAAM,OAAO,OAAO,OAAO,OAAO;AAAA,MAChE;AACA,aAAO;AAAA,IACT;AAEA,QAAI,CAAC,QAAQ;AACX,aAAO,iBAAiB,SAAS,MAAM;AAAA,IACzC;AAEA,WAAO,gBAAgB,gBAAgB,MAAM;AAAA,EAC/C;AACF;AAEA,IAAI,4BAAwE;AAM5E,eAAO,WAAkC,SAA6C;AACpF,MAAI,CAAC,2BAA2B;AAC9B,gCAA4B,iBAAiB;AAAA,EAC/C;AACA,SAAO,0BAA0B,OAAO;AAC1C;","names":["middleware"]}

package/dist/server.cjs ADDED Viewed

@@ -0,0 +1,252 @@
+"use strict";
+var __defProp = Object.defineProperty;
+var __getOwnPropDesc = Object.getOwnPropertyDescriptor;
+var __getOwnPropNames = Object.getOwnPropertyNames;
+var __hasOwnProp = Object.prototype.hasOwnProperty;
+var __export = (target, all) => {
+  for (var name in all)
+    __defProp(target, name, { get: all[name], enumerable: true });
+};
+var __copyProps = (to, from, except, desc) => {
+  if (from && typeof from === "object" || typeof from === "function") {
+    for (let key of __getOwnPropNames(from))
+      if (!__hasOwnProp.call(to, key) && key !== except)
+        __defProp(to, key, { get: () => from[key], enumerable: !(desc = __getOwnPropDesc(from, key)) || desc.enumerable });
+  }
+  return to;
+};
+var __toCommonJS = (mod) => __copyProps(__defProp({}, "__esModule", { value: true }), mod);
+// src/server.ts
+var server_exports = {};
+__export(server_exports, {
+  auth: () => auth,
+  handleCallback: () => handleCallback,
+  initiateSignIn: () => initiateSignIn,
+  requireAuth: () => requireAuth,
+  signOut: () => signOut,
+  withAuth: () => withAuth
+});
+module.exports = __toCommonJS(server_exports);
+// src/server-auth.ts
+var import_headers = require("next/headers");
+var import_navigation = require("next/navigation");
+async function auth() {
+  const headerStore = await (0, import_headers.headers)();
+  const userJson = headerStore.get("x-irongate-user-json");
+  if (!userJson) {
+    return null;
+  }
+  const user = JSON.parse(userJson);
+  return { user, userId: user.sub };
+}
+async function requireAuth(redirectUrl) {
+  const session = await auth();
+  if (!session) {
+    (0, import_navigation.redirect)(redirectUrl ?? process.env.IRONGATE_SIGN_IN_URL ?? "/sign-in");
+  }
+  return session;
+}
+function errorResponse(code, message, status) {
+  return Response.json({ type: `urn:irongate:error:${code}`, code, message }, { status });
+}
+function withAuth(handler, options) {
+  return async (req) => {
+    const session = await auth();
+    if (!session) {
+      if (options?.onUnauthenticated === "return401") {
+        return errorResponse("REAUTH_REQUIRED", "Authentication required", 401);
+      }
+      return Response.redirect(new URL(process.env.IRONGATE_SIGN_IN_URL ?? "/sign-in", req.url));
+    }
+    if (options?.noImpersonation && session.user.impersonation === true) {
+      return errorResponse(
+        "IMPERSONATION_NOT_ALLOWED",
+        "This endpoint does not accept impersonation sessions.",
+        403
+      );
+    }
+    return handler(req, { session });
+  };
+}
+// src/server-route-handlers.ts
+var import_server = require("next/server");
+var import_core = require("@irongate-dev/core");
+// src/cookie-env.ts
+function parseBooleanEnv(value) {
+  if (value === "true") return true;
+  if (value === "false") return false;
+  return void 0;
+}
+function resolveSecureDefault(explicit) {
+  return explicit ?? parseBooleanEnv(process.env.IRONGATE_COOKIE_SECURE) ?? process.env.NODE_ENV === "production";
+}
+function resolveEnvCookieConfig() {
+  const cookieDomain = process.env.IRONGATE_COOKIE_DOMAIN;
+  const sameSite = process.env.IRONGATE_COOKIE_SAMESITE;
+  return {
+    ...cookieDomain ? { cookieDomain } : {},
+    secure: resolveSecureDefault(),
+    ...sameSite ? { sameSite } : {}
+  };
+}
+// src/server-route-handlers.ts
+var PKCE_STATE_COOKIE = "irongate_pkce_state";
+var PKCE_VERIFIER_COOKIE = "irongate_pkce_verifier";
+var PKCE_REDIRECT_COOKIE = "irongate_pkce_redirect";
+var PKCE_COOKIE_MAX_AGE = 600;
+function pkceCookieOptions() {
+  return {
+    httpOnly: true,
+    secure: resolveSecureDefault(),
+    sameSite: "lax",
+    path: "/",
+    maxAge: PKCE_COOKIE_MAX_AGE
+  };
+}
+function initiateSignIn(options) {
+  return async (_request) => {
+    const baseUrl = process.env.IRONGATE_BASE_URL;
+    const clientId = process.env.IRONGATE_CLIENT_ID;
+    if (!baseUrl) {
+      throw new import_core.IrongateError("INVALID_CONFIG", "IRONGATE_BASE_URL is required");
+    }
+    if (!clientId) {
+      throw new import_core.IrongateError("INVALID_CONFIG", "IRONGATE_CLIENT_ID is required");
+    }
+    const verifier = (0, import_core.generateCodeVerifier)();
+    const challenge = await (0, import_core.computeChallenge)(verifier);
+    const state = (0, import_core.generateState)();
+    const authorizeUrl = new URL("/authorize", baseUrl);
+    authorizeUrl.searchParams.set("client_id", clientId);
+    authorizeUrl.searchParams.set("redirect_uri", options.redirectUri);
+    authorizeUrl.searchParams.set("scope", options.scope ?? "openid email");
+    authorizeUrl.searchParams.set("state", state);
+    authorizeUrl.searchParams.set("code_challenge", challenge);
+    authorizeUrl.searchParams.set("code_challenge_method", "S256");
+    authorizeUrl.searchParams.set("response_type", "code");
+    const response = import_server.NextResponse.redirect(authorizeUrl);
+    const cookieOptions = pkceCookieOptions();
+    response.cookies.set(PKCE_STATE_COOKIE, state, cookieOptions);
+    response.cookies.set(PKCE_VERIFIER_COOKIE, verifier, cookieOptions);
+    response.cookies.set(
+      PKCE_REDIRECT_COOKIE,
+      options.afterSignInUrl ?? process.env.IRONGATE_AFTER_SIGN_IN ?? "/dashboard",
+      cookieOptions
+    );
+    return response;
+  };
+}
+function handleCallback(options = {}) {
+  return async (request) => {
+    const url = new URL(request.url);
+    const code = url.searchParams.get("code");
+    const state = url.searchParams.get("state");
+    const oauthError = url.searchParams.get("error");
+    const signInUrl = process.env.IRONGATE_SIGN_IN_URL ?? "/sign-in";
+    if (oauthError) {
+      return options.onError?.(new import_core.IrongateError("AUTH_CALLBACK_ERROR", oauthError)) ?? import_server.NextResponse.redirect(new URL(`${signInUrl}?error=callback_failed`, request.url));
+    }
+    if (!code) {
+      return options.onError?.(new import_core.IrongateError("AUTH_CODE_MISSING", "Missing authorization code")) ?? import_server.NextResponse.redirect(new URL(`${signInUrl}?error=callback_failed`, request.url));
+    }
+    const storedState = request.cookies.get(PKCE_STATE_COOKIE)?.value;
+    const codeVerifier = request.cookies.get(PKCE_VERIFIER_COOKIE)?.value;
+    const afterCallbackUrl = request.cookies.get(PKCE_REDIRECT_COOKIE)?.value ?? process.env.IRONGATE_AFTER_SIGN_IN ?? "/dashboard";
+    if (!storedState || state !== storedState) {
+      return import_server.NextResponse.redirect(new URL(`${signInUrl}?error=state_mismatch`, request.url));
+    }
+    if (!codeVerifier) {
+      return options.onError?.(new import_core.IrongateError("PKCE_VERIFIER_INVALID", "Missing PKCE verifier")) ?? import_server.NextResponse.redirect(new URL(`${signInUrl}?error=callback_failed`, request.url));
+    }
+    const baseUrl = process.env.IRONGATE_BASE_URL;
+    const clientId = process.env.IRONGATE_CLIENT_ID;
+    if (!baseUrl || !clientId) {
+      throw new import_core.IrongateError("INVALID_CONFIG", "IRONGATE_BASE_URL and IRONGATE_CLIENT_ID are required");
+    }
+    const tokenResponse = await fetch(`${baseUrl}/token`, {
+      method: "POST",
+      headers: { "Content-Type": "application/json" },
+      body: JSON.stringify({
+        grantType: "authorization_code",
+        code,
+        codeVerifier,
+        redirectUri: new URL(request.nextUrl.pathname, request.url).toString(),
+        clientId
+      })
+    });
+    if (!tokenResponse.ok) {
+      const errorBody = await tokenResponse.json().catch(() => ({}));
+      const err = new import_core.IrongateError(errorBody.code ?? "AUTH_CALLBACK_ERROR", errorBody.message);
+      return options.onError?.(err) ?? import_server.NextResponse.redirect(new URL(`${signInUrl}?error=callback_failed`, request.url));
+    }
+    const tokens = await tokenResponse.json();
+    const jwksCache = (0, import_core.createJwksCache)({ baseUrl, fetch, jwksCacheTtlMs: 36e5 });
+    const verifyToken = (0, import_core.createVerifyToken)({
+      baseUrl,
+      fetch,
+      clockSkewToleranceMs: 0,
+      jwksCache,
+      checkJtiRevoked: void 0
+    });
+    const claims = await verifyToken(tokens.accessToken);
+    const response = import_server.NextResponse.redirect(new URL(afterCallbackUrl, request.url));
+    const cookieNames = (0, import_core.getAuthCookieNames)(process.env.IRONGATE_COOKIE_PREFIX);
+    const cookieConfig = resolveEnvCookieConfig();
+    for (const cookie of (0, import_core.buildAuthCookies)(
+      {
+        accessToken: tokens.accessToken,
+        ...tokens.refreshToken ? { refreshToken: tokens.refreshToken } : {},
+        expiresIn: tokens.expiresIn,
+        ...tokens.user ? { user: tokens.user } : {},
+        isImpersonating: claims.impersonation === true
+      },
+      cookieNames,
+      cookieConfig
+    )) {
+      response.cookies.set(cookie.name, cookie.value, cookie.options);
+    }
+    response.cookies.delete(PKCE_STATE_COOKIE);
+    response.cookies.delete(PKCE_VERIFIER_COOKIE);
+    response.cookies.delete(PKCE_REDIRECT_COOKIE);
+    return response;
+  };
+}
+function signOut(options = {}) {
+  return async (request) => {
+    const cookieNames = (0, import_core.getAuthCookieNames)(process.env.IRONGATE_COOKIE_PREFIX);
+    const accessToken = request.cookies.get(cookieNames.accessToken)?.value;
+    const baseUrl = process.env.IRONGATE_BASE_URL;
+    if (accessToken && baseUrl) {
+      try {
+        await fetch(`${baseUrl}/v1/auth/logout`, {
+          method: "POST",
+          headers: { Authorization: `Bearer ${accessToken}` }
+        });
+      } catch {
+      }
+    }
+    const response = import_server.NextResponse.redirect(
+      new URL(options.afterSignOutUrl ?? process.env.IRONGATE_AFTER_SIGN_OUT ?? "/", request.url)
+    );
+    const cookieConfig = resolveEnvCookieConfig();
+    for (const cookie of (0, import_core.buildClearCookies)(cookieNames, cookieConfig)) {
+      response.cookies.set(cookie.name, cookie.value, cookie.options);
+    }
+    return response;
+  };
+}
+// Annotate the CommonJS export names for ESM import in node:
+0 && (module.exports = {
+  auth,
+  handleCallback,
+  initiateSignIn,
+  requireAuth,
+  signOut,
+  withAuth
+});
+//# sourceMappingURL=server.cjs.map

package/dist/server.cjs.map ADDED Viewed

@@ -0,0 +1 @@

+ {"version":3,"sources":["../src/server.ts","../src/server-auth.ts","../src/server-route-handlers.ts","../src/cookie-env.ts"],"sourcesContent":["// @irongate-dev/nextjs/server — Server Component, Route Handler, and\n// middleware-adjacent server-side exports. Never import from 'use client'\n// components — this module (transitively) uses next/headers.\nexport { auth, requireAuth, withAuth } from \"./server-auth.js\";\nexport type { AuthSession, AuthedRouteHandler, WithAuthOptions } from \"./server-auth.js\";\nexport { initiateSignIn, handleCallback, signOut } from \"./server-route-handlers.js\";\nexport type { InitiateSignInOptions, CallbackOptions, SignOutOptions } from \"./server-route-handlers.js\";\n","import { headers } from \"next/headers\";\nimport { redirect } from \"next/navigation\";\nimport type { NextRequest } from \"next/server\";\nimport type { IrongateErrorCode, TokenClaims } from \"@irongate-dev/types\";\n\nexport interface AuthSession {\n user: TokenClaims;\n userId: string;\n}\n\nexport async function auth(): Promise<AuthSession | null> {\n const headerStore = await headers();\n const userJson = headerStore.get(\"x-irongate-user-json\");\n\n if (!userJson) {\n // SEC-F18-03: this means EITHER (a) unauthenticated, OR (b) this route\n // is not covered by the middleware matcher — auth() cannot distinguish\n // the two. Use requireAuth() if you want a redirect either way; ensure\n // your middleware.ts matcher covers every route that calls auth().\n return null;\n }\n\n // Trusted: this header is only ever set by our own middleware, which\n // already stripped any externally-supplied x-irongate-* headers first.\n const user = JSON.parse(userJson) as TokenClaims;\n return { user, userId: user.sub };\n}\n\nexport async function requireAuth(redirectUrl?: string): Promise<AuthSession> {\n const session = await auth();\n if (!session) {\n redirect(redirectUrl ?? process.env.IRONGATE_SIGN_IN_URL ?? \"/sign-in\");\n }\n return session;\n}\n\nexport interface WithAuthOptions {\n onUnauthenticated?: \"redirect\" | \"return401\";\n noImpersonation?: boolean;\n}\n\nexport type AuthedRouteHandler = (req: NextRequest, ctx: { session: AuthSession }) => Promise<Response>;\n\nfunction errorResponse(code: IrongateErrorCode, message: string, status: number): Response {\n return Response.json({ type: `urn:irongate:error:${code}`, code, message }, { status });\n}\n\nexport function withAuth(\n handler: AuthedRouteHandler,\n options?: WithAuthOptions,\n): (req: NextRequest) => Promise<Response> {\n return async (req: NextRequest): Promise<Response> => {\n const session = await auth();\n\n if (!session) {\n if (options?.onUnauthenticated === \"return401\") {\n return errorResponse(\"REAUTH_REQUIRED\", \"Authentication required\", 401);\n }\n return Response.redirect(new URL(process.env.IRONGATE_SIGN_IN_URL ?? \"/sign-in\", req.url));\n }\n\n if (options?.noImpersonation && session.user.impersonation === true) {\n return errorResponse(\n \"IMPERSONATION_NOT_ALLOWED\",\n \"This endpoint does not accept impersonation sessions.\",\n 403\n );\n }\n\n return handler(req, { session });\n };\n}\n","import { NextResponse } from \"next/server\";\nimport type { NextRequest } from \"next/server\";\nimport {\n IrongateError,\n generateCodeVerifier,\n generateState,\n computeChallenge,\n createJwksCache,\n createVerifyToken,\n getAuthCookieNames,\n buildAuthCookies,\n buildClearCookies,\n} from \"@irongate-dev/core\";\nimport type { IrongateErrorCode, TokenSet } from \"@irongate-dev/types\";\nimport { resolveSecureDefault, resolveEnvCookieConfig } from \"./cookie-env.js\";\n\nconst PKCE_STATE_COOKIE = \"irongate_pkce_state\";\nconst PKCE_VERIFIER_COOKIE = \"irongate_pkce_verifier\";\nconst PKCE_REDIRECT_COOKIE = \"irongate_pkce_redirect\";\nconst PKCE_COOKIE_MAX_AGE = 600; // 10 minutes — long enough for the /authorize round-trip, no longer\n\nfunction pkceCookieOptions() {\n return {\n httpOnly: true,\n secure: resolveSecureDefault(),\n sameSite: \"lax\" as const,\n path: \"/\",\n maxAge: PKCE_COOKIE_MAX_AGE,\n };\n}\n\nexport interface InitiateSignInOptions {\n redirectUri: string;\n scope?: string;\n afterSignInUrl?: string;\n}\n\nexport function initiateSignIn(options: InitiateSignInOptions): (request: NextRequest) => Promise<NextResponse> {\n return async (_request: NextRequest): Promise<NextResponse> => {\n const baseUrl = process.env.IRONGATE_BASE_URL;\n const clientId = process.env.IRONGATE_CLIENT_ID;\n if (!baseUrl) {\n throw new IrongateError(\"INVALID_CONFIG\", \"IRONGATE_BASE_URL is required\");\n }\n if (!clientId) {\n throw new IrongateError(\"INVALID_CONFIG\", \"IRONGATE_CLIENT_ID is required\");\n }\n\n const verifier = generateCodeVerifier();\n const challenge = await computeChallenge(verifier);\n const state = generateState();\n\n const authorizeUrl = new URL(\"/authorize\", baseUrl);\n authorizeUrl.searchParams.set(\"client_id\", clientId);\n authorizeUrl.searchParams.set(\"redirect_uri\", options.redirectUri);\n authorizeUrl.searchParams.set(\"scope\", options.scope ?? \"openid email\");\n authorizeUrl.searchParams.set(\"state\", state);\n authorizeUrl.searchParams.set(\"code_challenge\", challenge);\n authorizeUrl.searchParams.set(\"code_challenge_method\", \"S256\");\n authorizeUrl.searchParams.set(\"response_type\", \"code\");\n\n const response = NextResponse.redirect(authorizeUrl);\n const cookieOptions = pkceCookieOptions();\n response.cookies.set(PKCE_STATE_COOKIE, state, cookieOptions);\n response.cookies.set(PKCE_VERIFIER_COOKIE, verifier, cookieOptions);\n response.cookies.set(\n PKCE_REDIRECT_COOKIE,\n options.afterSignInUrl ?? process.env.IRONGATE_AFTER_SIGN_IN ?? \"/dashboard\",\n cookieOptions\n );\n return response;\n };\n}\n\n// Derived from the canonical TokenSet (not a local redefinition, CC-P1-1) —\n// only the fields the code-exchange response actually needs.\ntype TokenExchangeResponse = Pick<TokenSet, \"accessToken\" | \"refreshToken\" | \"expiresIn\" | \"user\">;\n\nexport interface CallbackOptions {\n onError?: (err: unknown) => Response;\n}\n\nexport function handleCallback(options: CallbackOptions = {}): (request: NextRequest) => Promise<Response> {\n return async (request: NextRequest): Promise<Response> => {\n const url = new URL(request.url);\n const code = url.searchParams.get(\"code\");\n const state = url.searchParams.get(\"state\");\n const oauthError = url.searchParams.get(\"error\");\n const signInUrl = process.env.IRONGATE_SIGN_IN_URL ?? \"/sign-in\";\n\n if (oauthError) {\n return (\n options.onError?.(new IrongateError(\"AUTH_CALLBACK_ERROR\", oauthError)) ??\n NextResponse.redirect(new URL(`${signInUrl}?error=callback_failed`, request.url))\n );\n }\n if (!code) {\n return (\n options.onError?.(new IrongateError(\"AUTH_CODE_MISSING\", \"Missing authorization code\")) ??\n NextResponse.redirect(new URL(`${signInUrl}?error=callback_failed`, request.url))\n );\n }\n\n const storedState = request.cookies.get(PKCE_STATE_COOKIE)?.value;\n const codeVerifier = request.cookies.get(PKCE_VERIFIER_COOKIE)?.value;\n const afterCallbackUrl =\n request.cookies.get(PKCE_REDIRECT_COOKIE)?.value ?? process.env.IRONGATE_AFTER_SIGN_IN ?? \"/dashboard\";\n\n if (!storedState || state !== storedState) {\n return NextResponse.redirect(new URL(`${signInUrl}?error=state_mismatch`, request.url));\n }\n if (!codeVerifier) {\n return (\n options.onError?.(new IrongateError(\"PKCE_VERIFIER_INVALID\", \"Missing PKCE verifier\")) ??\n NextResponse.redirect(new URL(`${signInUrl}?error=callback_failed`, request.url))\n );\n }\n\n const baseUrl = process.env.IRONGATE_BASE_URL;\n const clientId = process.env.IRONGATE_CLIENT_ID;\n if (!baseUrl || !clientId) {\n throw new IrongateError(\"INVALID_CONFIG\", \"IRONGATE_BASE_URL and IRONGATE_CLIENT_ID are required\");\n }\n\n // redirectUri must match what was passed to initiateSignIn() — both\n // point at this same callback route.\n const tokenResponse = await fetch(`${baseUrl}/token`, {\n method: \"POST\",\n headers: { \"Content-Type\": \"application/json\" },\n body: JSON.stringify({\n grantType: \"authorization_code\",\n code,\n codeVerifier,\n redirectUri: new URL(request.nextUrl.pathname, request.url).toString(),\n clientId,\n }),\n });\n\n if (!tokenResponse.ok) {\n const errorBody = (await tokenResponse.json().catch(() => ({}))) as { code?: IrongateErrorCode; message?: string };\n const err = new IrongateError(errorBody.code ?? \"AUTH_CALLBACK_ERROR\", errorBody.message);\n return options.onError?.(err) ?? NextResponse.redirect(new URL(`${signInUrl}?error=callback_failed`, request.url));\n }\n\n const tokens = (await tokenResponse.json()) as TokenExchangeResponse;\n\n // Verify (not just decode) the freshly-issued access token to obtain\n // trustworthy claims.impersonation for the session cookie — reuses the\n // exact pattern Milestone 2's middleware uses.\n const jwksCache = createJwksCache({ baseUrl, fetch, jwksCacheTtlMs: 3_600_000 });\n const verifyToken = createVerifyToken({\n baseUrl,\n fetch,\n clockSkewToleranceMs: 0,\n jwksCache,\n checkJtiRevoked: undefined,\n });\n const claims = await verifyToken(tokens.accessToken);\n\n const response = NextResponse.redirect(new URL(afterCallbackUrl, request.url));\n const cookieNames = getAuthCookieNames(process.env.IRONGATE_COOKIE_PREFIX);\n const cookieConfig = resolveEnvCookieConfig();\n\n for (const cookie of buildAuthCookies(\n {\n accessToken: tokens.accessToken,\n ...(tokens.refreshToken ? { refreshToken: tokens.refreshToken } : {}),\n expiresIn: tokens.expiresIn,\n ...(tokens.user ? { user: tokens.user } : {}),\n isImpersonating: claims.impersonation === true,\n },\n cookieNames,\n cookieConfig\n )) {\n response.cookies.set(cookie.name, cookie.value, cookie.options);\n }\n\n response.cookies.delete(PKCE_STATE_COOKIE);\n response.cookies.delete(PKCE_VERIFIER_COOKIE);\n response.cookies.delete(PKCE_REDIRECT_COOKIE);\n\n return response;\n };\n}\n\nexport interface SignOutOptions {\n afterSignOutUrl?: string;\n}\n\nexport function signOut(options: SignOutOptions = {}): (request: NextRequest) => Promise<NextResponse> {\n return async (request: NextRequest): Promise<NextResponse> => {\n const cookieNames = getAuthCookieNames(process.env.IRONGATE_COOKIE_PREFIX);\n const accessToken = request.cookies.get(cookieNames.accessToken)?.value;\n const baseUrl = process.env.IRONGATE_BASE_URL;\n\n if (accessToken && baseUrl) {\n try {\n await fetch(`${baseUrl}/v1/auth/logout`, {\n method: \"POST\",\n headers: { Authorization: `Bearer ${accessToken}` },\n });\n } catch {\n // Best-effort server-side logout — cookies are cleared below regardless.\n }\n }\n\n const response = NextResponse.redirect(\n new URL(options.afterSignOutUrl ?? process.env.IRONGATE_AFTER_SIGN_OUT ?? \"/\", request.url)\n );\n const cookieConfig = resolveEnvCookieConfig();\n for (const cookie of buildClearCookies(cookieNames, cookieConfig)) {\n response.cookies.set(cookie.name, cookie.value, cookie.options);\n }\n return response;\n };\n}\n","export type SameSite = \"lax\" | \"strict\" | \"none\";\n\nexport function parseBooleanEnv(value: string | undefined): boolean | undefined {\n if (value === \"true\") return true;\n if (value === \"false\") return false;\n return undefined;\n}\n\n// @irongate-dev/core never reads process.env (it must only receive explicit\n// values from the caller) — this is where the \"Secure in production\"\n// default (spec AC13) actually gets resolved, on the adapter side that's\n// already responsible for bridging env vars into explicit config.\nexport function resolveSecureDefault(explicit?: boolean): boolean {\n return explicit ?? parseBooleanEnv(process.env.IRONGATE_COOKIE_SECURE) ?? process.env.NODE_ENV === \"production\";\n}\n\nexport interface EnvCookieConfig {\n cookieDomain?: string;\n secure: boolean;\n sameSite?: SameSite;\n}\n\nexport function resolveEnvCookieConfig(): EnvCookieConfig {\n const cookieDomain = process.env.IRONGATE_COOKIE_DOMAIN;\n const sameSite = process.env.IRONGATE_COOKIE_SAMESITE as SameSite | undefined;\n return {\n ...(cookieDomain ? { cookieDomain } : {}),\n secure: resolveSecureDefault(),\n ...(sameSite ? { sameSite } : {}),\n };\n}\n"],"mappings":";;;;;;;;;;;;;;;;;;;;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;;;ACAA,qBAAwB;AACxB,wBAAyB;AASzB,eAAsB,OAAoC;AACxD,QAAM,cAAc,UAAM,wBAAQ;AAClC,QAAM,WAAW,YAAY,IAAI,sBAAsB;AAEvD,MAAI,CAAC,UAAU;AAKb,WAAO;AAAA,EACT;AAIA,QAAM,OAAO,KAAK,MAAM,QAAQ;AAChC,SAAO,EAAE,MAAM,QAAQ,KAAK,IAAI;AAClC;AAEA,eAAsB,YAAY,aAA4C;AAC5E,QAAM,UAAU,MAAM,KAAK;AAC3B,MAAI,CAAC,SAAS;AACZ,oCAAS,eAAe,QAAQ,IAAI,wBAAwB,UAAU;AAAA,EACxE;AACA,SAAO;AACT;AASA,SAAS,cAAc,MAAyB,SAAiB,QAA0B;AACzF,SAAO,SAAS,KAAK,EAAE,MAAM,sBAAsB,IAAI,IAAI,MAAM,QAAQ,GAAG,EAAE,OAAO,CAAC;AACxF;AAEO,SAAS,SACd,SACA,SACyC;AACzC,SAAO,OAAO,QAAwC;AACpD,UAAM,UAAU,MAAM,KAAK;AAE3B,QAAI,CAAC,SAAS;AACZ,UAAI,SAAS,sBAAsB,aAAa;AAC9C,eAAO,cAAc,mBAAmB,2BAA2B,GAAG;AAAA,MACxE;AACA,aAAO,SAAS,SAAS,IAAI,IAAI,QAAQ,IAAI,wBAAwB,YAAY,IAAI,GAAG,CAAC;AAAA,IAC3F;AAEA,QAAI,SAAS,mBAAmB,QAAQ,KAAK,kBAAkB,MAAM;AACnE,aAAO;AAAA,QACL;AAAA,QACA;AAAA,QACA;AAAA,MACF;AAAA,IACF;AAEA,WAAO,QAAQ,KAAK,EAAE,QAAQ,CAAC;AAAA,EACjC;AACF;;;ACvEA,oBAA6B;AAE7B,kBAUO;;;ACVA,SAAS,gBAAgB,OAAgD;AAC9E,MAAI,UAAU,OAAQ,QAAO;AAC7B,MAAI,UAAU,QAAS,QAAO;AAC9B,SAAO;AACT;AAMO,SAAS,qBAAqB,UAA6B;AAChE,SAAO,YAAY,gBAAgB,QAAQ,IAAI,sBAAsB,KAAK,QAAQ,IAAI,aAAa;AACrG;AAQO,SAAS,yBAA0C;AACxD,QAAM,eAAe,QAAQ,IAAI;AACjC,QAAM,WAAW,QAAQ,IAAI;AAC7B,SAAO;AAAA,IACL,GAAI,eAAe,EAAE,aAAa,IAAI,CAAC;AAAA,IACvC,QAAQ,qBAAqB;AAAA,IAC7B,GAAI,WAAW,EAAE,SAAS,IAAI,CAAC;AAAA,EACjC;AACF;;;ADdA,IAAM,oBAAuB;AAC7B,IAAM,uBAAuB;AAC7B,IAAM,uBAAuB;AAC7B,IAAM,sBAAuB;AAE7B,SAAS,oBAAoB;AAC3B,SAAO;AAAA,IACL,UAAU;AAAA,IACV,QAAU,qBAAqB;AAAA,IAC/B,UAAU;AAAA,IACV,MAAU;AAAA,IACV,QAAU;AAAA,EACZ;AACF;AAQO,SAAS,eAAe,SAAiF;AAC9G,SAAO,OAAO,aAAiD;AAC7D,UAAM,UAAU,QAAQ,IAAI;AAC5B,UAAM,WAAW,QAAQ,IAAI;AAC7B,QAAI,CAAC,SAAS;AACZ,YAAM,IAAI,0BAAc,kBAAkB,+BAA+B;AAAA,IAC3E;AACA,QAAI,CAAC,UAAU;AACb,YAAM,IAAI,0BAAc,kBAAkB,gCAAgC;AAAA,IAC5E;AAEA,UAAM,eAAW,kCAAqB;AACtC,UAAM,YAAY,UAAM,8BAAiB,QAAQ;AACjD,UAAM,YAAQ,2BAAc;AAE5B,UAAM,eAAe,IAAI,IAAI,cAAc,OAAO;AAClD,iBAAa,aAAa,IAAI,aAAa,QAAQ;AACnD,iBAAa,aAAa,IAAI,gBAAgB,QAAQ,WAAW;AACjE,iBAAa,aAAa,IAAI,SAAS,QAAQ,SAAS,cAAc;AACtE,iBAAa,aAAa,IAAI,SAAS,KAAK;AAC5C,iBAAa,aAAa,IAAI,kBAAkB,SAAS;AACzD,iBAAa,aAAa,IAAI,yBAAyB,MAAM;AAC7D,iBAAa,aAAa,IAAI,iBAAiB,MAAM;AAErD,UAAM,WAAW,2BAAa,SAAS,YAAY;AACnD,UAAM,gBAAgB,kBAAkB;AACxC,aAAS,QAAQ,IAAI,mBAAmB,OAAO,aAAa;AAC5D,aAAS,QAAQ,IAAI,sBAAsB,UAAU,aAAa;AAClE,aAAS,QAAQ;AAAA,MACf;AAAA,MACA,QAAQ,kBAAkB,QAAQ,IAAI,0BAA0B;AAAA,MAChE;AAAA,IACF;AACA,WAAO;AAAA,EACT;AACF;AAUO,SAAS,eAAe,UAA2B,CAAC,GAAgD;AACzG,SAAO,OAAO,YAA4C;AACxD,UAAM,MAAM,IAAI,IAAI,QAAQ,GAAG;AAC/B,UAAM,OAAO,IAAI,aAAa,IAAI,MAAM;AACxC,UAAM,QAAQ,IAAI,aAAa,IAAI,OAAO;AAC1C,UAAM,aAAa,IAAI,aAAa,IAAI,OAAO;AAC/C,UAAM,YAAY,QAAQ,IAAI,wBAAwB;AAEtD,QAAI,YAAY;AACd,aACE,QAAQ,UAAU,IAAI,0BAAc,uBAAuB,UAAU,CAAC,KACtE,2BAAa,SAAS,IAAI,IAAI,GAAG,SAAS,0BAA0B,QAAQ,GAAG,CAAC;AAAA,IAEpF;AACA,QAAI,CAAC,MAAM;AACT,aACE,QAAQ,UAAU,IAAI,0BAAc,qBAAqB,4BAA4B,CAAC,KACtF,2BAAa,SAAS,IAAI,IAAI,GAAG,SAAS,0BAA0B,QAAQ,GAAG,CAAC;AAAA,IAEpF;AAEA,UAAM,cAAc,QAAQ,QAAQ,IAAI,iBAAiB,GAAG;AAC5D,UAAM,eAAe,QAAQ,QAAQ,IAAI,oBAAoB,GAAG;AAChE,UAAM,mBACJ,QAAQ,QAAQ,IAAI,oBAAoB,GAAG,SAAS,QAAQ,IAAI,0BAA0B;AAE5F,QAAI,CAAC,eAAe,UAAU,aAAa;AACzC,aAAO,2BAAa,SAAS,IAAI,IAAI,GAAG,SAAS,yBAAyB,QAAQ,GAAG,CAAC;AAAA,IACxF;AACA,QAAI,CAAC,cAAc;AACjB,aACE,QAAQ,UAAU,IAAI,0BAAc,yBAAyB,uBAAuB,CAAC,KACrF,2BAAa,SAAS,IAAI,IAAI,GAAG,SAAS,0BAA0B,QAAQ,GAAG,CAAC;AAAA,IAEpF;AAEA,UAAM,UAAU,QAAQ,IAAI;AAC5B,UAAM,WAAW,QAAQ,IAAI;AAC7B,QAAI,CAAC,WAAW,CAAC,UAAU;AACzB,YAAM,IAAI,0BAAc,kBAAkB,uDAAuD;AAAA,IACnG;AAIA,UAAM,gBAAgB,MAAM,MAAM,GAAG,OAAO,UAAU;AAAA,MACpD,QAAQ;AAAA,MACR,SAAS,EAAE,gBAAgB,mBAAmB;AAAA,MAC9C,MAAM,KAAK,UAAU;AAAA,QACnB,WAAW;AAAA,QACX;AAAA,QACA;AAAA,QACA,aAAa,IAAI,IAAI,QAAQ,QAAQ,UAAU,QAAQ,GAAG,EAAE,SAAS;AAAA,QACrE;AAAA,MACF,CAAC;AAAA,IACH,CAAC;AAED,QAAI,CAAC,cAAc,IAAI;AACrB,YAAM,YAAa,MAAM,cAAc,KAAK,EAAE,MAAM,OAAO,CAAC,EAAE;AAC9D,YAAM,MAAM,IAAI,0BAAc,UAAU,QAAQ,uBAAuB,UAAU,OAAO;AACxF,aAAO,QAAQ,UAAU,GAAG,KAAK,2BAAa,SAAS,IAAI,IAAI,GAAG,SAAS,0BAA0B,QAAQ,GAAG,CAAC;AAAA,IACnH;AAEA,UAAM,SAAU,MAAM,cAAc,KAAK;AAKzC,UAAM,gBAAY,6BAAgB,EAAE,SAAS,OAAO,gBAAgB,KAAU,CAAC;AAC/E,UAAM,kBAAc,+BAAkB;AAAA,MACpC;AAAA,MACA;AAAA,MACA,sBAAsB;AAAA,MACtB;AAAA,MACA,iBAAiB;AAAA,IACnB,CAAC;AACD,UAAM,SAAS,MAAM,YAAY,OAAO,WAAW;AAEnD,UAAM,WAAW,2BAAa,SAAS,IAAI,IAAI,kBAAkB,QAAQ,GAAG,CAAC;AAC7E,UAAM,kBAAc,gCAAmB,QAAQ,IAAI,sBAAsB;AACzE,UAAM,eAAe,uBAAuB;AAE5C,eAAW,cAAU;AAAA,MACnB;AAAA,QACE,aAAa,OAAO;AAAA,QACpB,GAAI,OAAO,eAAe,EAAE,cAAc,OAAO,aAAa,IAAI,CAAC;AAAA,QACnE,WAAW,OAAO;AAAA,QAClB,GAAI,OAAO,OAAO,EAAE,MAAM,OAAO,KAAK,IAAI,CAAC;AAAA,QAC3C,iBAAiB,OAAO,kBAAkB;AAAA,MAC5C;AAAA,MACA;AAAA,MACA;AAAA,IACF,GAAG;AACD,eAAS,QAAQ,IAAI,OAAO,MAAM,OAAO,OAAO,OAAO,OAAO;AAAA,IAChE;AAEA,aAAS,QAAQ,OAAO,iBAAiB;AACzC,aAAS,QAAQ,OAAO,oBAAoB;AAC5C,aAAS,QAAQ,OAAO,oBAAoB;AAE5C,WAAO;AAAA,EACT;AACF;AAMO,SAAS,QAAQ,UAA0B,CAAC,GAAoD;AACrG,SAAO,OAAO,YAAgD;AAC5D,UAAM,kBAAc,gCAAmB,QAAQ,IAAI,sBAAsB;AACzE,UAAM,cAAc,QAAQ,QAAQ,IAAI,YAAY,WAAW,GAAG;AAClE,UAAM,UAAU,QAAQ,IAAI;AAE5B,QAAI,eAAe,SAAS;AAC1B,UAAI;AACF,cAAM,MAAM,GAAG,OAAO,mBAAmB;AAAA,UACvC,QAAQ;AAAA,UACR,SAAS,EAAE,eAAe,UAAU,WAAW,GAAG;AAAA,QACpD,CAAC;AAAA,MACH,QAAQ;AAAA,MAER;AAAA,IACF;AAEA,UAAM,WAAW,2BAAa;AAAA,MAC5B,IAAI,IAAI,QAAQ,mBAAmB,QAAQ,IAAI,2BAA2B,KAAK,QAAQ,GAAG;AAAA,IAC5F;AACA,UAAM,eAAe,uBAAuB;AAC5C,eAAW,cAAU,+BAAkB,aAAa,YAAY,GAAG;AACjE,eAAS,QAAQ,IAAI,OAAO,MAAM,OAAO,OAAO,OAAO,OAAO;AAAA,IAChE;AACA,WAAO;AAAA,EACT;AACF;","names":[]}

package/dist/server.d.cts ADDED Viewed

@@ -0,0 +1,34 @@
+import { NextRequest, NextResponse } from 'next/server';
+import { TokenClaims } from '@irongate-dev/types';
+interface AuthSession {
+    user: TokenClaims;
+    userId: string;
+}
+declare function auth(): Promise<AuthSession | null>;
+declare function requireAuth(redirectUrl?: string): Promise<AuthSession>;
+interface WithAuthOptions {
+    onUnauthenticated?: "redirect" | "return401";
+    noImpersonation?: boolean;
+}
+type AuthedRouteHandler = (req: NextRequest, ctx: {
+    session: AuthSession;
+}) => Promise<Response>;
+declare function withAuth(handler: AuthedRouteHandler, options?: WithAuthOptions): (req: NextRequest) => Promise<Response>;
+interface InitiateSignInOptions {
+    redirectUri: string;
+    scope?: string;
+    afterSignInUrl?: string;
+}
+declare function initiateSignIn(options: InitiateSignInOptions): (request: NextRequest) => Promise<NextResponse>;
+interface CallbackOptions {
+    onError?: (err: unknown) => Response;
+}
+declare function handleCallback(options?: CallbackOptions): (request: NextRequest) => Promise<Response>;
+interface SignOutOptions {
+    afterSignOutUrl?: string;
+}
+declare function signOut(options?: SignOutOptions): (request: NextRequest) => Promise<NextResponse>;
+export { type AuthSession, type AuthedRouteHandler, type CallbackOptions, type InitiateSignInOptions, type SignOutOptions, type WithAuthOptions, auth, handleCallback, initiateSignIn, requireAuth, signOut, withAuth };

package/dist/server.d.ts ADDED Viewed

@@ -0,0 +1,34 @@
+import { NextRequest, NextResponse } from 'next/server';
+import { TokenClaims } from '@irongate-dev/types';
+interface AuthSession {
+    user: TokenClaims;
+    userId: string;
+}
+declare function auth(): Promise<AuthSession | null>;
+declare function requireAuth(redirectUrl?: string): Promise<AuthSession>;
+interface WithAuthOptions {
+    onUnauthenticated?: "redirect" | "return401";
+    noImpersonation?: boolean;
+}
+type AuthedRouteHandler = (req: NextRequest, ctx: {
+    session: AuthSession;
+}) => Promise<Response>;
+declare function withAuth(handler: AuthedRouteHandler, options?: WithAuthOptions): (req: NextRequest) => Promise<Response>;
+interface InitiateSignInOptions {
+    redirectUri: string;
+    scope?: string;
+    afterSignInUrl?: string;
+}
+declare function initiateSignIn(options: InitiateSignInOptions): (request: NextRequest) => Promise<NextResponse>;
+interface CallbackOptions {
+    onError?: (err: unknown) => Response;
+}
+declare function handleCallback(options?: CallbackOptions): (request: NextRequest) => Promise<Response>;
+interface SignOutOptions {
+    afterSignOutUrl?: string;
+}
+declare function signOut(options?: SignOutOptions): (request: NextRequest) => Promise<NextResponse>;
+export { type AuthSession, type AuthedRouteHandler, type CallbackOptions, type InitiateSignInOptions, type SignOutOptions, type WithAuthOptions, auth, handleCallback, initiateSignIn, requireAuth, signOut, withAuth };