@irongate-dev/nextjs 0.1.0-beta

package/dist/server.js

@@ -0,0 +1,230 @@
+// src/server-auth.ts
+import { headers } from "next/headers";
+import { redirect } from "next/navigation";
+async function auth() {
+  const headerStore = await headers();
+  const userJson = headerStore.get("x-irongate-user-json");
+  if (!userJson) {
+    return null;
+  }
+  const user = JSON.parse(userJson);
+  return { user, userId: user.sub };
+}
+async function requireAuth(redirectUrl) {
+  const session = await auth();
+  if (!session) {
+    redirect(redirectUrl ?? process.env.IRONGATE_SIGN_IN_URL ?? "/sign-in");
+  }
+  return session;
+}
+function errorResponse(code, message, status) {
+  return Response.json({ type: `urn:irongate:error:${code}`, code, message }, { status });
+}
+function withAuth(handler, options) {
+  return async (req) => {
+    const session = await auth();
+    if (!session) {
+      if (options?.onUnauthenticated === "return401") {
+        return errorResponse("REAUTH_REQUIRED", "Authentication required", 401);
+      }
+      return Response.redirect(new URL(process.env.IRONGATE_SIGN_IN_URL ?? "/sign-in", req.url));
+    }
+    if (options?.noImpersonation && session.user.impersonation === true) {
+      return errorResponse(
+        "IMPERSONATION_NOT_ALLOWED",
+        "This endpoint does not accept impersonation sessions.",
+        403
+      );
+    }
+    return handler(req, { session });
+  };
+}
+
+// src/server-route-handlers.ts
+import { NextResponse } from "next/server";
+import {
+  IrongateError,
+  generateCodeVerifier,
+  generateState,
+  computeChallenge,
+  createJwksCache,
+  createVerifyToken,
+  getAuthCookieNames,
+  buildAuthCookies,
+  buildClearCookies
+} from "@irongate-dev/core";
+
+// src/cookie-env.ts
+function parseBooleanEnv(value) {
+  if (value === "true") return true;
+  if (value === "false") return false;
+  return void 0;
+}
+function resolveSecureDefault(explicit) {
+  return explicit ?? parseBooleanEnv(process.env.IRONGATE_COOKIE_SECURE) ?? process.env.NODE_ENV === "production";
+}
+function resolveEnvCookieConfig() {
+  const cookieDomain = process.env.IRONGATE_COOKIE_DOMAIN;
+  const sameSite = process.env.IRONGATE_COOKIE_SAMESITE;
+  return {
+    ...cookieDomain ? { cookieDomain } : {},
+    secure: resolveSecureDefault(),
+    ...sameSite ? { sameSite } : {}
+  };
+}
+
+// src/server-route-handlers.ts
+var PKCE_STATE_COOKIE = "irongate_pkce_state";
+var PKCE_VERIFIER_COOKIE = "irongate_pkce_verifier";
+var PKCE_REDIRECT_COOKIE = "irongate_pkce_redirect";
+var PKCE_COOKIE_MAX_AGE = 600;
+function pkceCookieOptions() {
+  return {
+    httpOnly: true,
+    secure: resolveSecureDefault(),
+    sameSite: "lax",
+    path: "/",
+    maxAge: PKCE_COOKIE_MAX_AGE
+  };
+}
+function initiateSignIn(options) {
+  return async (_request) => {
+    const baseUrl = process.env.IRONGATE_BASE_URL;
+    const clientId = process.env.IRONGATE_CLIENT_ID;
+    if (!baseUrl) {
+      throw new IrongateError("INVALID_CONFIG", "IRONGATE_BASE_URL is required");
+    }
+    if (!clientId) {
+      throw new IrongateError("INVALID_CONFIG", "IRONGATE_CLIENT_ID is required");
+    }
+    const verifier = generateCodeVerifier();
+    const challenge = await computeChallenge(verifier);
+    const state = generateState();
+    const authorizeUrl = new URL("/authorize", baseUrl);
+    authorizeUrl.searchParams.set("client_id", clientId);
+    authorizeUrl.searchParams.set("redirect_uri", options.redirectUri);
+    authorizeUrl.searchParams.set("scope", options.scope ?? "openid email");
+    authorizeUrl.searchParams.set("state", state);
+    authorizeUrl.searchParams.set("code_challenge", challenge);
+    authorizeUrl.searchParams.set("code_challenge_method", "S256");
+    authorizeUrl.searchParams.set("response_type", "code");
+    const response = NextResponse.redirect(authorizeUrl);
+    const cookieOptions = pkceCookieOptions();
+    response.cookies.set(PKCE_STATE_COOKIE, state, cookieOptions);
+    response.cookies.set(PKCE_VERIFIER_COOKIE, verifier, cookieOptions);
+    response.cookies.set(
+      PKCE_REDIRECT_COOKIE,
+      options.afterSignInUrl ?? process.env.IRONGATE_AFTER_SIGN_IN ?? "/dashboard",
+      cookieOptions
+    );
+    return response;
+  };
+}
+function handleCallback(options = {}) {
+  return async (request) => {
+    const url = new URL(request.url);
+    const code = url.searchParams.get("code");
+    const state = url.searchParams.get("state");
+    const oauthError = url.searchParams.get("error");
+    const signInUrl = process.env.IRONGATE_SIGN_IN_URL ?? "/sign-in";
+    if (oauthError) {
+      return options.onError?.(new IrongateError("AUTH_CALLBACK_ERROR", oauthError)) ?? NextResponse.redirect(new URL(`${signInUrl}?error=callback_failed`, request.url));
+    }
+    if (!code) {
+      return options.onError?.(new IrongateError("AUTH_CODE_MISSING", "Missing authorization code")) ?? NextResponse.redirect(new URL(`${signInUrl}?error=callback_failed`, request.url));
+    }
+    const storedState = request.cookies.get(PKCE_STATE_COOKIE)?.value;
+    const codeVerifier = request.cookies.get(PKCE_VERIFIER_COOKIE)?.value;
+    const afterCallbackUrl = request.cookies.get(PKCE_REDIRECT_COOKIE)?.value ?? process.env.IRONGATE_AFTER_SIGN_IN ?? "/dashboard";
+    if (!storedState || state !== storedState) {
+      return NextResponse.redirect(new URL(`${signInUrl}?error=state_mismatch`, request.url));
+    }
+    if (!codeVerifier) {
+      return options.onError?.(new IrongateError("PKCE_VERIFIER_INVALID", "Missing PKCE verifier")) ?? NextResponse.redirect(new URL(`${signInUrl}?error=callback_failed`, request.url));
+    }
+    const baseUrl = process.env.IRONGATE_BASE_URL;
+    const clientId = process.env.IRONGATE_CLIENT_ID;
+    if (!baseUrl || !clientId) {
+      throw new IrongateError("INVALID_CONFIG", "IRONGATE_BASE_URL and IRONGATE_CLIENT_ID are required");
+    }
+    const tokenResponse = await fetch(`${baseUrl}/token`, {
+      method: "POST",
+      headers: { "Content-Type": "application/json" },
+      body: JSON.stringify({
+        grantType: "authorization_code",
+        code,
+        codeVerifier,
+        redirectUri: new URL(request.nextUrl.pathname, request.url).toString(),
+        clientId
+      })
+    });
+    if (!tokenResponse.ok) {
+      const errorBody = await tokenResponse.json().catch(() => ({}));
+      const err = new IrongateError(errorBody.code ?? "AUTH_CALLBACK_ERROR", errorBody.message);
+      return options.onError?.(err) ?? NextResponse.redirect(new URL(`${signInUrl}?error=callback_failed`, request.url));
+    }
+    const tokens = await tokenResponse.json();
+    const jwksCache = createJwksCache({ baseUrl, fetch, jwksCacheTtlMs: 36e5 });
+    const verifyToken = createVerifyToken({
+      baseUrl,
+      fetch,
+      clockSkewToleranceMs: 0,
+      jwksCache,
+      checkJtiRevoked: void 0
+    });
+    const claims = await verifyToken(tokens.accessToken);
+    const response = NextResponse.redirect(new URL(afterCallbackUrl, request.url));
+    const cookieNames = getAuthCookieNames(process.env.IRONGATE_COOKIE_PREFIX);
+    const cookieConfig = resolveEnvCookieConfig();
+    for (const cookie of buildAuthCookies(
+      {
+        accessToken: tokens.accessToken,
+        ...tokens.refreshToken ? { refreshToken: tokens.refreshToken } : {},
+        expiresIn: tokens.expiresIn,
+        ...tokens.user ? { user: tokens.user } : {},
+        isImpersonating: claims.impersonation === true
+      },
+      cookieNames,
+      cookieConfig
+    )) {
+      response.cookies.set(cookie.name, cookie.value, cookie.options);
+    }
+    response.cookies.delete(PKCE_STATE_COOKIE);
+    response.cookies.delete(PKCE_VERIFIER_COOKIE);
+    response.cookies.delete(PKCE_REDIRECT_COOKIE);
+    return response;
+  };
+}
+function signOut(options = {}) {
+  return async (request) => {
+    const cookieNames = getAuthCookieNames(process.env.IRONGATE_COOKIE_PREFIX);
+    const accessToken = request.cookies.get(cookieNames.accessToken)?.value;
+    const baseUrl = process.env.IRONGATE_BASE_URL;
+    if (accessToken && baseUrl) {
+      try {
+        await fetch(`${baseUrl}/v1/auth/logout`, {
+          method: "POST",
+          headers: { Authorization: `Bearer ${accessToken}` }
+        });
+      } catch {
+      }
+    }
+    const response = NextResponse.redirect(
+      new URL(options.afterSignOutUrl ?? process.env.IRONGATE_AFTER_SIGN_OUT ?? "/", request.url)
+    );
+    const cookieConfig = resolveEnvCookieConfig();
+    for (const cookie of buildClearCookies(cookieNames, cookieConfig)) {
+      response.cookies.set(cookie.name, cookie.value, cookie.options);
+    }
+    return response;
+  };
+}
+export {
+  auth,
+  handleCallback,
+  initiateSignIn,
+  requireAuth,
+  signOut,
+  withAuth
+};
+//# sourceMappingURL=server.js.map

package/dist/server.js.map

@@ -0,0 +1 @@
+{"version":3,"sources":["../src/server-auth.ts","../src/server-route-handlers.ts","../src/cookie-env.ts"],"sourcesContent":["import { headers } from \"next/headers\";\nimport { redirect } from \"next/navigation\";\nimport type { NextRequest } from \"next/server\";\nimport type { IrongateErrorCode, TokenClaims } from \"@irongate-dev/types\";\n\nexport interface AuthSession {\n  user:   TokenClaims;\n  userId: string;\n}\n\nexport async function auth(): Promise<AuthSession | null> {\n  const headerStore = await headers();\n  const userJson = headerStore.get(\"x-irongate-user-json\");\n\n  if (!userJson) {\n    // SEC-F18-03: this means EITHER (a) unauthenticated, OR (b) this route\n    // is not covered by the middleware matcher — auth() cannot distinguish\n    // the two. Use requireAuth() if you want a redirect either way; ensure\n    // your middleware.ts matcher covers every route that calls auth().\n    return null;\n  }\n\n  // Trusted: this header is only ever set by our own middleware, which\n  // already stripped any externally-supplied x-irongate-* headers first.\n  const user = JSON.parse(userJson) as TokenClaims;\n  return { user, userId: user.sub };\n}\n\nexport async function requireAuth(redirectUrl?: string): Promise<AuthSession> {\n  const session = await auth();\n  if (!session) {\n    redirect(redirectUrl ?? process.env.IRONGATE_SIGN_IN_URL ?? \"/sign-in\");\n  }\n  return session;\n}\n\nexport interface WithAuthOptions {\n  onUnauthenticated?: \"redirect\" | \"return401\";\n  noImpersonation?:   boolean;\n}\n\nexport type AuthedRouteHandler = (req: NextRequest, ctx: { session: AuthSession }) => Promise<Response>;\n\nfunction errorResponse(code: IrongateErrorCode, message: string, status: number): Response {\n  return Response.json({ type: `urn:irongate:error:${code}`, code, message }, { status });\n}\n\nexport function withAuth(\n  handler: AuthedRouteHandler,\n  options?: WithAuthOptions,\n): (req: NextRequest) => Promise<Response> {\n  return async (req: NextRequest): Promise<Response> => {\n    const session = await auth();\n\n    if (!session) {\n      if (options?.onUnauthenticated === \"return401\") {\n        return errorResponse(\"REAUTH_REQUIRED\", \"Authentication required\", 401);\n      }\n      return Response.redirect(new URL(process.env.IRONGATE_SIGN_IN_URL ?? \"/sign-in\", req.url));\n    }\n\n    if (options?.noImpersonation && session.user.impersonation === true) {\n      return errorResponse(\n        \"IMPERSONATION_NOT_ALLOWED\",\n        \"This endpoint does not accept impersonation sessions.\",\n        403\n      );\n    }\n\n    return handler(req, { session });\n  };\n}\n","import { NextResponse } from \"next/server\";\nimport type { NextRequest } from \"next/server\";\nimport {\n  IrongateError,\n  generateCodeVerifier,\n  generateState,\n  computeChallenge,\n  createJwksCache,\n  createVerifyToken,\n  getAuthCookieNames,\n  buildAuthCookies,\n  buildClearCookies,\n} from \"@irongate-dev/core\";\nimport type { IrongateErrorCode, TokenSet } from \"@irongate-dev/types\";\nimport { resolveSecureDefault, resolveEnvCookieConfig } from \"./cookie-env.js\";\n\nconst PKCE_STATE_COOKIE    = \"irongate_pkce_state\";\nconst PKCE_VERIFIER_COOKIE = \"irongate_pkce_verifier\";\nconst PKCE_REDIRECT_COOKIE = \"irongate_pkce_redirect\";\nconst PKCE_COOKIE_MAX_AGE  = 600; // 10 minutes — long enough for the /authorize round-trip, no longer\n\nfunction pkceCookieOptions() {\n  return {\n    httpOnly: true,\n    secure:   resolveSecureDefault(),\n    sameSite: \"lax\" as const,\n    path:     \"/\",\n    maxAge:   PKCE_COOKIE_MAX_AGE,\n  };\n}\n\nexport interface InitiateSignInOptions {\n  redirectUri:     string;\n  scope?:          string;\n  afterSignInUrl?: string;\n}\n\nexport function initiateSignIn(options: InitiateSignInOptions): (request: NextRequest) => Promise<NextResponse> {\n  return async (_request: NextRequest): Promise<NextResponse> => {\n    const baseUrl = process.env.IRONGATE_BASE_URL;\n    const clientId = process.env.IRONGATE_CLIENT_ID;\n    if (!baseUrl) {\n      throw new IrongateError(\"INVALID_CONFIG\", \"IRONGATE_BASE_URL is required\");\n    }\n    if (!clientId) {\n      throw new IrongateError(\"INVALID_CONFIG\", \"IRONGATE_CLIENT_ID is required\");\n    }\n\n    const verifier = generateCodeVerifier();\n    const challenge = await computeChallenge(verifier);\n    const state = generateState();\n\n    const authorizeUrl = new URL(\"/authorize\", baseUrl);\n    authorizeUrl.searchParams.set(\"client_id\", clientId);\n    authorizeUrl.searchParams.set(\"redirect_uri\", options.redirectUri);\n    authorizeUrl.searchParams.set(\"scope\", options.scope ?? \"openid email\");\n    authorizeUrl.searchParams.set(\"state\", state);\n    authorizeUrl.searchParams.set(\"code_challenge\", challenge);\n    authorizeUrl.searchParams.set(\"code_challenge_method\", \"S256\");\n    authorizeUrl.searchParams.set(\"response_type\", \"code\");\n\n    const response = NextResponse.redirect(authorizeUrl);\n    const cookieOptions = pkceCookieOptions();\n    response.cookies.set(PKCE_STATE_COOKIE, state, cookieOptions);\n    response.cookies.set(PKCE_VERIFIER_COOKIE, verifier, cookieOptions);\n    response.cookies.set(\n      PKCE_REDIRECT_COOKIE,\n      options.afterSignInUrl ?? process.env.IRONGATE_AFTER_SIGN_IN ?? \"/dashboard\",\n      cookieOptions\n    );\n    return response;\n  };\n}\n\n// Derived from the canonical TokenSet (not a local redefinition, CC-P1-1) —\n// only the fields the code-exchange response actually needs.\ntype TokenExchangeResponse = Pick<TokenSet, \"accessToken\" | \"refreshToken\" | \"expiresIn\" | \"user\">;\n\nexport interface CallbackOptions {\n  onError?: (err: unknown) => Response;\n}\n\nexport function handleCallback(options: CallbackOptions = {}): (request: NextRequest) => Promise<Response> {\n  return async (request: NextRequest): Promise<Response> => {\n    const url = new URL(request.url);\n    const code = url.searchParams.get(\"code\");\n    const state = url.searchParams.get(\"state\");\n    const oauthError = url.searchParams.get(\"error\");\n    const signInUrl = process.env.IRONGATE_SIGN_IN_URL ?? \"/sign-in\";\n\n    if (oauthError) {\n      return (\n        options.onError?.(new IrongateError(\"AUTH_CALLBACK_ERROR\", oauthError)) ??\n        NextResponse.redirect(new URL(`${signInUrl}?error=callback_failed`, request.url))\n      );\n    }\n    if (!code) {\n      return (\n        options.onError?.(new IrongateError(\"AUTH_CODE_MISSING\", \"Missing authorization code\")) ??\n        NextResponse.redirect(new URL(`${signInUrl}?error=callback_failed`, request.url))\n      );\n    }\n\n    const storedState = request.cookies.get(PKCE_STATE_COOKIE)?.value;\n    const codeVerifier = request.cookies.get(PKCE_VERIFIER_COOKIE)?.value;\n    const afterCallbackUrl =\n      request.cookies.get(PKCE_REDIRECT_COOKIE)?.value ?? process.env.IRONGATE_AFTER_SIGN_IN ?? \"/dashboard\";\n\n    if (!storedState || state !== storedState) {\n      return NextResponse.redirect(new URL(`${signInUrl}?error=state_mismatch`, request.url));\n    }\n    if (!codeVerifier) {\n      return (\n        options.onError?.(new IrongateError(\"PKCE_VERIFIER_INVALID\", \"Missing PKCE verifier\")) ??\n        NextResponse.redirect(new URL(`${signInUrl}?error=callback_failed`, request.url))\n      );\n    }\n\n    const baseUrl = process.env.IRONGATE_BASE_URL;\n    const clientId = process.env.IRONGATE_CLIENT_ID;\n    if (!baseUrl || !clientId) {\n      throw new IrongateError(\"INVALID_CONFIG\", \"IRONGATE_BASE_URL and IRONGATE_CLIENT_ID are required\");\n    }\n\n    // redirectUri must match what was passed to initiateSignIn() — both\n    // point at this same callback route.\n    const tokenResponse = await fetch(`${baseUrl}/token`, {\n      method: \"POST\",\n      headers: { \"Content-Type\": \"application/json\" },\n      body: JSON.stringify({\n        grantType: \"authorization_code\",\n        code,\n        codeVerifier,\n        redirectUri: new URL(request.nextUrl.pathname, request.url).toString(),\n        clientId,\n      }),\n    });\n\n    if (!tokenResponse.ok) {\n      const errorBody = (await tokenResponse.json().catch(() => ({}))) as { code?: IrongateErrorCode; message?: string };\n      const err = new IrongateError(errorBody.code ?? \"AUTH_CALLBACK_ERROR\", errorBody.message);\n      return options.onError?.(err) ?? NextResponse.redirect(new URL(`${signInUrl}?error=callback_failed`, request.url));\n    }\n\n    const tokens = (await tokenResponse.json()) as TokenExchangeResponse;\n\n    // Verify (not just decode) the freshly-issued access token to obtain\n    // trustworthy claims.impersonation for the session cookie — reuses the\n    // exact pattern Milestone 2's middleware uses.\n    const jwksCache = createJwksCache({ baseUrl, fetch, jwksCacheTtlMs: 3_600_000 });\n    const verifyToken = createVerifyToken({\n      baseUrl,\n      fetch,\n      clockSkewToleranceMs: 0,\n      jwksCache,\n      checkJtiRevoked: undefined,\n    });\n    const claims = await verifyToken(tokens.accessToken);\n\n    const response = NextResponse.redirect(new URL(afterCallbackUrl, request.url));\n    const cookieNames = getAuthCookieNames(process.env.IRONGATE_COOKIE_PREFIX);\n    const cookieConfig = resolveEnvCookieConfig();\n\n    for (const cookie of buildAuthCookies(\n      {\n        accessToken: tokens.accessToken,\n        ...(tokens.refreshToken ? { refreshToken: tokens.refreshToken } : {}),\n        expiresIn: tokens.expiresIn,\n        ...(tokens.user ? { user: tokens.user } : {}),\n        isImpersonating: claims.impersonation === true,\n      },\n      cookieNames,\n      cookieConfig\n    )) {\n      response.cookies.set(cookie.name, cookie.value, cookie.options);\n    }\n\n    response.cookies.delete(PKCE_STATE_COOKIE);\n    response.cookies.delete(PKCE_VERIFIER_COOKIE);\n    response.cookies.delete(PKCE_REDIRECT_COOKIE);\n\n    return response;\n  };\n}\n\nexport interface SignOutOptions {\n  afterSignOutUrl?: string;\n}\n\nexport function signOut(options: SignOutOptions = {}): (request: NextRequest) => Promise<NextResponse> {\n  return async (request: NextRequest): Promise<NextResponse> => {\n    const cookieNames = getAuthCookieNames(process.env.IRONGATE_COOKIE_PREFIX);\n    const accessToken = request.cookies.get(cookieNames.accessToken)?.value;\n    const baseUrl = process.env.IRONGATE_BASE_URL;\n\n    if (accessToken && baseUrl) {\n      try {\n        await fetch(`${baseUrl}/v1/auth/logout`, {\n          method: \"POST\",\n          headers: { Authorization: `Bearer ${accessToken}` },\n        });\n      } catch {\n        // Best-effort server-side logout — cookies are cleared below regardless.\n      }\n    }\n\n    const response = NextResponse.redirect(\n      new URL(options.afterSignOutUrl ?? process.env.IRONGATE_AFTER_SIGN_OUT ?? \"/\", request.url)\n    );\n    const cookieConfig = resolveEnvCookieConfig();\n    for (const cookie of buildClearCookies(cookieNames, cookieConfig)) {\n      response.cookies.set(cookie.name, cookie.value, cookie.options);\n    }\n    return response;\n  };\n}\n","export type SameSite = \"lax\" | \"strict\" | \"none\";\n\nexport function parseBooleanEnv(value: string | undefined): boolean | undefined {\n  if (value === \"true\") return true;\n  if (value === \"false\") return false;\n  return undefined;\n}\n\n// @irongate-dev/core never reads process.env (it must only receive explicit\n// values from the caller) — this is where the \"Secure in production\"\n// default (spec AC13) actually gets resolved, on the adapter side that's\n// already responsible for bridging env vars into explicit config.\nexport function resolveSecureDefault(explicit?: boolean): boolean {\n  return explicit ?? parseBooleanEnv(process.env.IRONGATE_COOKIE_SECURE) ?? process.env.NODE_ENV === \"production\";\n}\n\nexport interface EnvCookieConfig {\n  cookieDomain?: string;\n  secure:        boolean;\n  sameSite?:     SameSite;\n}\n\nexport function resolveEnvCookieConfig(): EnvCookieConfig {\n  const cookieDomain = process.env.IRONGATE_COOKIE_DOMAIN;\n  const sameSite = process.env.IRONGATE_COOKIE_SAMESITE as SameSite | undefined;\n  return {\n    ...(cookieDomain ? { cookieDomain } : {}),\n    secure: resolveSecureDefault(),\n    ...(sameSite ? { sameSite } : {}),\n  };\n}\n"],"mappings":";AAAA,SAAS,eAAe;AACxB,SAAS,gBAAgB;AASzB,eAAsB,OAAoC;AACxD,QAAM,cAAc,MAAM,QAAQ;AAClC,QAAM,WAAW,YAAY,IAAI,sBAAsB;AAEvD,MAAI,CAAC,UAAU;AAKb,WAAO;AAAA,EACT;AAIA,QAAM,OAAO,KAAK,MAAM,QAAQ;AAChC,SAAO,EAAE,MAAM,QAAQ,KAAK,IAAI;AAClC;AAEA,eAAsB,YAAY,aAA4C;AAC5E,QAAM,UAAU,MAAM,KAAK;AAC3B,MAAI,CAAC,SAAS;AACZ,aAAS,eAAe,QAAQ,IAAI,wBAAwB,UAAU;AAAA,EACxE;AACA,SAAO;AACT;AASA,SAAS,cAAc,MAAyB,SAAiB,QAA0B;AACzF,SAAO,SAAS,KAAK,EAAE,MAAM,sBAAsB,IAAI,IAAI,MAAM,QAAQ,GAAG,EAAE,OAAO,CAAC;AACxF;AAEO,SAAS,SACd,SACA,SACyC;AACzC,SAAO,OAAO,QAAwC;AACpD,UAAM,UAAU,MAAM,KAAK;AAE3B,QAAI,CAAC,SAAS;AACZ,UAAI,SAAS,sBAAsB,aAAa;AAC9C,eAAO,cAAc,mBAAmB,2BAA2B,GAAG;AAAA,MACxE;AACA,aAAO,SAAS,SAAS,IAAI,IAAI,QAAQ,IAAI,wBAAwB,YAAY,IAAI,GAAG,CAAC;AAAA,IAC3F;AAEA,QAAI,SAAS,mBAAmB,QAAQ,KAAK,kBAAkB,MAAM;AACnE,aAAO;AAAA,QACL;AAAA,QACA;AAAA,QACA;AAAA,MACF;AAAA,IACF;AAEA,WAAO,QAAQ,KAAK,EAAE,QAAQ,CAAC;AAAA,EACjC;AACF;;;ACvEA,SAAS,oBAAoB;AAE7B;AAAA,EACE;AAAA,EACA;AAAA,EACA;AAAA,EACA;AAAA,EACA;AAAA,EACA;AAAA,EACA;AAAA,EACA;AAAA,EACA;AAAA,OACK;;;ACVA,SAAS,gBAAgB,OAAgD;AAC9E,MAAI,UAAU,OAAQ,QAAO;AAC7B,MAAI,UAAU,QAAS,QAAO;AAC9B,SAAO;AACT;AAMO,SAAS,qBAAqB,UAA6B;AAChE,SAAO,YAAY,gBAAgB,QAAQ,IAAI,sBAAsB,KAAK,QAAQ,IAAI,aAAa;AACrG;AAQO,SAAS,yBAA0C;AACxD,QAAM,eAAe,QAAQ,IAAI;AACjC,QAAM,WAAW,QAAQ,IAAI;AAC7B,SAAO;AAAA,IACL,GAAI,eAAe,EAAE,aAAa,IAAI,CAAC;AAAA,IACvC,QAAQ,qBAAqB;AAAA,IAC7B,GAAI,WAAW,EAAE,SAAS,IAAI,CAAC;AAAA,EACjC;AACF;;;ADdA,IAAM,oBAAuB;AAC7B,IAAM,uBAAuB;AAC7B,IAAM,uBAAuB;AAC7B,IAAM,sBAAuB;AAE7B,SAAS,oBAAoB;AAC3B,SAAO;AAAA,IACL,UAAU;AAAA,IACV,QAAU,qBAAqB;AAAA,IAC/B,UAAU;AAAA,IACV,MAAU;AAAA,IACV,QAAU;AAAA,EACZ;AACF;AAQO,SAAS,eAAe,SAAiF;AAC9G,SAAO,OAAO,aAAiD;AAC7D,UAAM,UAAU,QAAQ,IAAI;AAC5B,UAAM,WAAW,QAAQ,IAAI;AAC7B,QAAI,CAAC,SAAS;AACZ,YAAM,IAAI,cAAc,kBAAkB,+BAA+B;AAAA,IAC3E;AACA,QAAI,CAAC,UAAU;AACb,YAAM,IAAI,cAAc,kBAAkB,gCAAgC;AAAA,IAC5E;AAEA,UAAM,WAAW,qBAAqB;AACtC,UAAM,YAAY,MAAM,iBAAiB,QAAQ;AACjD,UAAM,QAAQ,cAAc;AAE5B,UAAM,eAAe,IAAI,IAAI,cAAc,OAAO;AAClD,iBAAa,aAAa,IAAI,aAAa,QAAQ;AACnD,iBAAa,aAAa,IAAI,gBAAgB,QAAQ,WAAW;AACjE,iBAAa,aAAa,IAAI,SAAS,QAAQ,SAAS,cAAc;AACtE,iBAAa,aAAa,IAAI,SAAS,KAAK;AAC5C,iBAAa,aAAa,IAAI,kBAAkB,SAAS;AACzD,iBAAa,aAAa,IAAI,yBAAyB,MAAM;AAC7D,iBAAa,aAAa,IAAI,iBAAiB,MAAM;AAErD,UAAM,WAAW,aAAa,SAAS,YAAY;AACnD,UAAM,gBAAgB,kBAAkB;AACxC,aAAS,QAAQ,IAAI,mBAAmB,OAAO,aAAa;AAC5D,aAAS,QAAQ,IAAI,sBAAsB,UAAU,aAAa;AAClE,aAAS,QAAQ;AAAA,MACf;AAAA,MACA,QAAQ,kBAAkB,QAAQ,IAAI,0BAA0B;AAAA,MAChE;AAAA,IACF;AACA,WAAO;AAAA,EACT;AACF;AAUO,SAAS,eAAe,UAA2B,CAAC,GAAgD;AACzG,SAAO,OAAO,YAA4C;AACxD,UAAM,MAAM,IAAI,IAAI,QAAQ,GAAG;AAC/B,UAAM,OAAO,IAAI,aAAa,IAAI,MAAM;AACxC,UAAM,QAAQ,IAAI,aAAa,IAAI,OAAO;AAC1C,UAAM,aAAa,IAAI,aAAa,IAAI,OAAO;AAC/C,UAAM,YAAY,QAAQ,IAAI,wBAAwB;AAEtD,QAAI,YAAY;AACd,aACE,QAAQ,UAAU,IAAI,cAAc,uBAAuB,UAAU,CAAC,KACtE,aAAa,SAAS,IAAI,IAAI,GAAG,SAAS,0BAA0B,QAAQ,GAAG,CAAC;AAAA,IAEpF;AACA,QAAI,CAAC,MAAM;AACT,aACE,QAAQ,UAAU,IAAI,cAAc,qBAAqB,4BAA4B,CAAC,KACtF,aAAa,SAAS,IAAI,IAAI,GAAG,SAAS,0BAA0B,QAAQ,GAAG,CAAC;AAAA,IAEpF;AAEA,UAAM,cAAc,QAAQ,QAAQ,IAAI,iBAAiB,GAAG;AAC5D,UAAM,eAAe,QAAQ,QAAQ,IAAI,oBAAoB,GAAG;AAChE,UAAM,mBACJ,QAAQ,QAAQ,IAAI,oBAAoB,GAAG,SAAS,QAAQ,IAAI,0BAA0B;AAE5F,QAAI,CAAC,eAAe,UAAU,aAAa;AACzC,aAAO,aAAa,SAAS,IAAI,IAAI,GAAG,SAAS,yBAAyB,QAAQ,GAAG,CAAC;AAAA,IACxF;AACA,QAAI,CAAC,cAAc;AACjB,aACE,QAAQ,UAAU,IAAI,cAAc,yBAAyB,uBAAuB,CAAC,KACrF,aAAa,SAAS,IAAI,IAAI,GAAG,SAAS,0BAA0B,QAAQ,GAAG,CAAC;AAAA,IAEpF;AAEA,UAAM,UAAU,QAAQ,IAAI;AAC5B,UAAM,WAAW,QAAQ,IAAI;AAC7B,QAAI,CAAC,WAAW,CAAC,UAAU;AACzB,YAAM,IAAI,cAAc,kBAAkB,uDAAuD;AAAA,IACnG;AAIA,UAAM,gBAAgB,MAAM,MAAM,GAAG,OAAO,UAAU;AAAA,MACpD,QAAQ;AAAA,MACR,SAAS,EAAE,gBAAgB,mBAAmB;AAAA,MAC9C,MAAM,KAAK,UAAU;AAAA,QACnB,WAAW;AAAA,QACX;AAAA,QACA;AAAA,QACA,aAAa,IAAI,IAAI,QAAQ,QAAQ,UAAU,QAAQ,GAAG,EAAE,SAAS;AAAA,QACrE;AAAA,MACF,CAAC;AAAA,IACH,CAAC;AAED,QAAI,CAAC,cAAc,IAAI;AACrB,YAAM,YAAa,MAAM,cAAc,KAAK,EAAE,MAAM,OAAO,CAAC,EAAE;AAC9D,YAAM,MAAM,IAAI,cAAc,UAAU,QAAQ,uBAAuB,UAAU,OAAO;AACxF,aAAO,QAAQ,UAAU,GAAG,KAAK,aAAa,SAAS,IAAI,IAAI,GAAG,SAAS,0BAA0B,QAAQ,GAAG,CAAC;AAAA,IACnH;AAEA,UAAM,SAAU,MAAM,cAAc,KAAK;AAKzC,UAAM,YAAY,gBAAgB,EAAE,SAAS,OAAO,gBAAgB,KAAU,CAAC;AAC/E,UAAM,cAAc,kBAAkB;AAAA,MACpC;AAAA,MACA;AAAA,MACA,sBAAsB;AAAA,MACtB;AAAA,MACA,iBAAiB;AAAA,IACnB,CAAC;AACD,UAAM,SAAS,MAAM,YAAY,OAAO,WAAW;AAEnD,UAAM,WAAW,aAAa,SAAS,IAAI,IAAI,kBAAkB,QAAQ,GAAG,CAAC;AAC7E,UAAM,cAAc,mBAAmB,QAAQ,IAAI,sBAAsB;AACzE,UAAM,eAAe,uBAAuB;AAE5C,eAAW,UAAU;AAAA,MACnB;AAAA,QACE,aAAa,OAAO;AAAA,QACpB,GAAI,OAAO,eAAe,EAAE,cAAc,OAAO,aAAa,IAAI,CAAC;AAAA,QACnE,WAAW,OAAO;AAAA,QAClB,GAAI,OAAO,OAAO,EAAE,MAAM,OAAO,KAAK,IAAI,CAAC;AAAA,QAC3C,iBAAiB,OAAO,kBAAkB;AAAA,MAC5C;AAAA,MACA;AAAA,MACA;AAAA,IACF,GAAG;AACD,eAAS,QAAQ,IAAI,OAAO,MAAM,OAAO,OAAO,OAAO,OAAO;AAAA,IAChE;AAEA,aAAS,QAAQ,OAAO,iBAAiB;AACzC,aAAS,QAAQ,OAAO,oBAAoB;AAC5C,aAAS,QAAQ,OAAO,oBAAoB;AAE5C,WAAO;AAAA,EACT;AACF;AAMO,SAAS,QAAQ,UAA0B,CAAC,GAAoD;AACrG,SAAO,OAAO,YAAgD;AAC5D,UAAM,cAAc,mBAAmB,QAAQ,IAAI,sBAAsB;AACzE,UAAM,cAAc,QAAQ,QAAQ,IAAI,YAAY,WAAW,GAAG;AAClE,UAAM,UAAU,QAAQ,IAAI;AAE5B,QAAI,eAAe,SAAS;AAC1B,UAAI;AACF,cAAM,MAAM,GAAG,OAAO,mBAAmB;AAAA,UACvC,QAAQ;AAAA,UACR,SAAS,EAAE,eAAe,UAAU,WAAW,GAAG;AAAA,QACpD,CAAC;AAAA,MACH,QAAQ;AAAA,MAER;AAAA,IACF;AAEA,UAAM,WAAW,aAAa;AAAA,MAC5B,IAAI,IAAI,QAAQ,mBAAmB,QAAQ,IAAI,2BAA2B,KAAK,QAAQ,GAAG;AAAA,IAC5F;AACA,UAAM,eAAe,uBAAuB;AAC5C,eAAW,UAAU,kBAAkB,aAAa,YAAY,GAAG;AACjE,eAAS,QAAQ,IAAI,OAAO,MAAM,OAAO,OAAO,OAAO,OAAO;AAAA,IAChE;AACA,WAAO;AAAA,EACT;AACF;","names":[]}

package/package.json

@@ -0,0 +1,66 @@
+{
+  "name": "@irongate-dev/nextjs",
+  "version": "0.1.0-beta",
+  "description": "Next.js adapter for Irongate authentication (App Router + Pages Router)",
+  "type": "module",
+  "sideEffects": false,
+  "publishConfig": {
+    "access": "public"
+  },
+  "exports": {
+    ".": {
+      "types": "./dist/index.d.ts",
+      "import": "./dist/index.js",
+      "require": "./dist/index.cjs"
+    },
+    "./server": {
+      "types": "./dist/server.d.ts",
+      "import": "./dist/server.js",
+      "require": "./dist/server.cjs"
+    },
+    "./middleware": {
+      "types": "./dist/middleware.d.ts",
+      "import": "./dist/middleware.js",
+      "require": "./dist/middleware.cjs"
+    },
+    "./client": {
+      "types": "./dist/client.d.ts",
+      "import": "./dist/client.js",
+      "require": "./dist/client.cjs"
+    }
+  },
+  "main": "./dist/index.cjs",
+  "module": "./dist/index.js",
+  "types": "./dist/index.d.ts",
+  "files": [
+    "dist"
+  ],
+  "dependencies": {
+    "@irongate-dev/core": "0.1.0-beta",
+    "@irongate-dev/react": "0.1.0-beta",
+    "@irongate-dev/types": "0.1.0-beta"
+  },
+  "peerDependencies": {
+    "next": ">=14.0.0",
+    "react": ">=18.0.0"
+  },
+  "devDependencies": {
+    "next": "^15.5.21",
+    "react": "^18.3.0",
+    "react-dom": "^18.3.0",
+    "@types/react": "^18.3.0",
+    "@types/react-dom": "^18.3.0",
+    "@testing-library/react": "^16.0.1",
+    "happy-dom": "^20.8.9",
+    "tsup": "^8.0.0",
+    "typescript": "5.4.x",
+    "vitest": "^3.2.6"
+  },
+  "scripts": {
+    "build": "tsup",
+    "typecheck": "tsc --noEmit",
+    "test": "vitest run --passWithNoTests",
+    "lint": "eslint src/",
+    "clean": "rm -rf dist"
+  }
+}