@jazzmind/busibox-app 3.0.18

package/dist/lib/authz/session-route-handlers.d.ts

@@ -0,0 +1,70 @@
+/**
+ * Shared session route handler factory for sub-apps (agents, admin, chat,
+ * documents, media, appbuilder).
+ *
+ * Each sub-app's auth/session route supports three operations:
+ *   GET  — Return current session from app-scoped cookie
+ *   POST {token} — SSO token exchange (set app-scoped cookies)
+ *   POST {} — Token refresh (exchange SSO token for fresh API token)
+ *
+ * Usage in each app's api/auth/session/route.ts:
+ *   import { createSessionRouteHandlers } from '@jazzmind/busibox-app/lib/authz/session-route-handlers';
+ *   export const { GET, POST } = createSessionRouteHandlers('busibox-agents');
+ */
+import { NextRequest, NextResponse } from 'next/server';
+/**
+ * Create GET and POST route handlers for a sub-app's /api/auth/session endpoint.
+ *
+ * @param appNameDefault - The default APP_NAME value (e.g. 'busibox-agents').
+ *                         Overridden by process.env.APP_NAME at runtime.
+ */
+export declare function createSessionRouteHandlers(appNameDefault: string): {
+    GET: (request: NextRequest) => Promise<NextResponse<{
+        success: boolean;
+        data: {
+            user: {
+                id: string;
+                email: string;
+                status: "ACTIVE";
+                roles: string[];
+                displayName: string | undefined;
+                firstName: string | undefined;
+                lastName: string | undefined;
+                avatarUrl: string | undefined;
+                favoriteColor: string | undefined;
+            };
+        };
+    }> | NextResponse<{
+        success: boolean;
+        data: {
+            user: null;
+        };
+    }>>;
+    POST: (request: NextRequest) => Promise<NextResponse<{
+        error: string;
+        message: string;
+    }> | NextResponse<{
+        success: boolean;
+        user: {
+            id: string;
+            email: string;
+            roles: string[];
+            displayName: string | undefined;
+            firstName: string | undefined;
+            lastName: string | undefined;
+            avatarUrl: string | undefined;
+            favoriteColor: string | undefined;
+        };
+    }> | NextResponse<{
+        success: boolean;
+        error: string;
+    }> | NextResponse<{
+        error: string;
+        requiresReauth: boolean;
+    }> | NextResponse<{
+        success: boolean;
+        token: string;
+        expiresIn: number;
+    }>>;
+};
+//# sourceMappingURL=session-route-handlers.d.ts.map

package/dist/lib/authz/session-route-handlers.d.ts.map

@@ -0,0 +1 @@
+{"version":3,"file":"session-route-handlers.d.ts","sourceRoot":"","sources":["../../../src/lib/authz/session-route-handlers.ts"],"names":[],"mappings":"AAAA;;;;;;;;;;;;GAYG;AAEH,OAAO,EAAE,WAAW,EAAE,YAAY,EAAE,MAAM,aAAa,CAAC;AA2ExD;;;;;GAKG;AACH,wBAAgB,0BAA0B,CAAC,cAAc,EAAE,MAAM;mBAInC,WAAW;;;;;;;;;;;;;;;;;;;;;oBAoCV,WAAW;;;;;;;;;;;;;;;;;;;;;;;;;;EA0HzC"}

package/dist/lib/authz/session-route-handlers.js

@@ -0,0 +1,200 @@
+/**
+ * Shared session route handler factory for sub-apps (agents, admin, chat,
+ * documents, media, appbuilder).
+ *
+ * Each sub-app's auth/session route supports three operations:
+ *   GET  — Return current session from app-scoped cookie
+ *   POST {token} — SSO token exchange (set app-scoped cookies)
+ *   POST {} — Token refresh (exchange SSO token for fresh API token)
+ *
+ * Usage in each app's api/auth/session/route.ts:
+ *   import { createSessionRouteHandlers } from '@jazzmind/busibox-app/lib/authz/session-route-handlers';
+ *   export const { GET, POST } = createSessionRouteHandlers('busibox-agents');
+ */
+import { NextResponse } from 'next/server';
+import { getSessionFromRequest, getTokenFromRequest, isTokenExpired, sanitizeAppName, validateSSOToken, createSessionFromSSO, } from './index';
+import { getApiToken } from './next-client';
+function getCookieConfig(appName) {
+    const sanitized = sanitizeAppName(appName);
+    const envMaxAge = process.env.SSO_COOKIE_MAX_AGE
+        ? parseInt(process.env.SSO_COOKIE_MAX_AGE, 10)
+        : null;
+    return {
+        sessionCookieName: `${sanitized}-session`,
+        authCookieName: `${sanitized}-auth-token`,
+        basePath: process.env.NEXT_PUBLIC_BASE_PATH || '/',
+        isProduction: process.env.NODE_ENV === 'production',
+        authTokenMaxAge: envMaxAge || 60 * 60 * 6, // 6 hours
+    };
+}
+function extractUserFromSession(ssoSession) {
+    if (!ssoSession)
+        return null;
+    return {
+        id: ssoSession.userId,
+        email: ssoSession.email,
+        status: 'ACTIVE',
+        roles: ssoSession.roles,
+        displayName: ssoSession.displayName,
+        firstName: ssoSession.firstName,
+        lastName: ssoSession.lastName,
+        avatarUrl: ssoSession.avatarUrl,
+        favoriteColor: ssoSession.favoriteColor,
+    };
+}
+function extractUserFromJwt(payload) {
+    const userId = (payload.sub || payload.user_id || payload.userId);
+    if (!userId)
+        return null;
+    const roles = Array.isArray(payload.roles)
+        ? payload.roles
+            .map((r) => (typeof r === 'string' ? r : r.name || ''))
+            .filter(Boolean)
+        : [];
+    return {
+        id: String(userId),
+        email: payload.email ||
+            payload.preferred_username ||
+            String(userId),
+        status: 'ACTIVE',
+        roles,
+        displayName: typeof payload.name === 'string' ? payload.name : undefined,
+        firstName: typeof payload.given_name === 'string' ? payload.given_name : undefined,
+        lastName: typeof payload.family_name === 'string' ? payload.family_name : undefined,
+        avatarUrl: typeof payload.picture === 'string' ? payload.picture : undefined,
+        favoriteColor: typeof payload.favorite_color === 'string' ? payload.favorite_color : undefined,
+    };
+}
+/**
+ * Create GET and POST route handlers for a sub-app's /api/auth/session endpoint.
+ *
+ * @param appNameDefault - The default APP_NAME value (e.g. 'busibox-agents').
+ *                         Overridden by process.env.APP_NAME at runtime.
+ */
+export function createSessionRouteHandlers(appNameDefault) {
+    const APP_NAME = process.env.APP_NAME || appNameDefault;
+    const VERBOSE = process.env.VERBOSE_AUTH_LOGGING === 'true';
+    async function GET(request) {
+        try {
+            const ssoSession = getSessionFromRequest(request);
+            const user = extractUserFromSession(ssoSession);
+            if (user) {
+                return NextResponse.json({ success: true, data: { user } });
+            }
+            const token = getTokenFromRequest(request);
+            if (!token || isTokenExpired(token)) {
+                return NextResponse.json({ success: false, data: { user: null } });
+            }
+            let payload;
+            try {
+                const parts = token.split('.');
+                if (parts.length !== 3) {
+                    return NextResponse.json({ success: false, data: { user: null } });
+                }
+                payload = JSON.parse(atob(parts[1].replace(/-/g, '+').replace(/_/g, '/')));
+            }
+            catch {
+                return NextResponse.json({ success: false, data: { user: null } });
+            }
+            const jwtUser = extractUserFromJwt(payload);
+            if (!jwtUser) {
+                return NextResponse.json({ success: false, data: { user: null } });
+            }
+            return NextResponse.json({ success: true, data: { user: jwtUser } });
+        }
+        catch (error) {
+            console.error('[auth/session] GET error:', error);
+            return NextResponse.json({ success: false, data: { user: null } });
+        }
+    }
+    async function POST(request) {
+        let body = {};
+        try {
+            body = await request.json();
+        }
+        catch {
+            // Empty body -> treat as refresh
+        }
+        if (body.token) {
+            return handleSSOExchange(body.token);
+        }
+        return handleRefresh(request);
+    }
+    async function handleSSOExchange(token) {
+        try {
+            if (isTokenExpired(token)) {
+                return NextResponse.json({ error: 'token_expired', message: 'Token has expired.' }, { status: 401 });
+            }
+            const validation = await validateSSOToken(token, { appName: APP_NAME });
+            if (!validation.valid) {
+                if (VERBOSE)
+                    console.log('[auth/session] SSO validation failed:', validation.error);
+                return NextResponse.json({ success: false, error: 'Invalid token', details: validation.error }, { status: 401 });
+            }
+            const session = createSessionFromSSO(validation);
+            const config = getCookieConfig(APP_NAME);
+            const response = NextResponse.json({
+                success: true,
+                user: {
+                    id: session.userId,
+                    email: session.email,
+                    roles: session.roles,
+                    displayName: session.displayName,
+                    firstName: session.firstName,
+                    lastName: session.lastName,
+                    avatarUrl: session.avatarUrl,
+                    favoriteColor: session.favoriteColor,
+                },
+            });
+            response.cookies.set(config.sessionCookieName, JSON.stringify(session), {
+                httpOnly: true,
+                secure: config.isProduction,
+                sameSite: 'lax',
+                maxAge: 60 * 60 * 24,
+                path: config.basePath,
+            });
+            response.cookies.set(config.authCookieName, token, {
+                httpOnly: true,
+                secure: config.isProduction,
+                sameSite: 'lax',
+                maxAge: config.authTokenMaxAge,
+                path: config.basePath,
+            });
+            if (VERBOSE) {
+                console.log(`[auth/session] SSO exchange OK for ${session.userId}, cookies: ${config.sessionCookieName}, ${config.authCookieName}`);
+            }
+            return response;
+        }
+        catch (error) {
+            console.error('[auth/session] SSO exchange error:', error);
+            return NextResponse.json({ success: false, error: 'SSO failed' }, { status: 500 });
+        }
+    }
+    async function handleRefresh(request) {
+        try {
+            const ssoToken = getTokenFromRequest(request);
+            if (!ssoToken) {
+                return NextResponse.json({ error: 'No token to refresh', requiresReauth: true }, { status: 401 });
+            }
+            if (isTokenExpired(ssoToken)) {
+                return NextResponse.json({ error: 'SSO token expired', requiresReauth: true }, { status: 401 });
+            }
+            const apiToken = await getApiToken(ssoToken, 'agent-api');
+            return NextResponse.json({
+                success: true,
+                token: apiToken,
+                expiresIn: 900,
+            });
+        }
+        catch (error) {
+            console.error('[auth/session] Refresh error:', error);
+            const msg = error instanceof Error ? error.message : String(error);
+            if (msg.includes('Invalid SSO token') || msg.includes('expired')) {
+                return NextResponse.json({ error: 'Token refresh failed', requiresReauth: true }, { status: 401 });
+            }
+            return NextResponse.json({ error: 'Token refresh failed', message: msg }, { status: 500 });
+        }
+    }
+    return { GET, POST };
+}
+//# sourceMappingURL=session-route-handlers.js.map

package/dist/lib/authz/session-route-handlers.js.map

@@ -0,0 +1 @@
+{"version":3,"file":"session-route-handlers.js","sourceRoot":"","sources":["../../../src/lib/authz/session-route-handlers.ts"],"names":[],"mappings":"AAAA;;;;;;;;;;;;GAYG;AAEH,OAAO,EAAe,YAAY,EAAE,MAAM,aAAa,CAAC;AACxD,OAAO,EACL,qBAAqB,EACrB,mBAAmB,EACnB,cAAc,EACd,eAAe,EACf,gBAAgB,EAChB,oBAAoB,GACrB,MAAM,SAAS,CAAC;AACjB,OAAO,EAAE,WAAW,EAAE,MAAM,eAAe,CAAC;AAU5C,SAAS,eAAe,CAAC,OAAe;IACtC,MAAM,SAAS,GAAG,eAAe,CAAC,OAAO,CAAC,CAAC;IAC3C,MAAM,SAAS,GAAG,OAAO,CAAC,GAAG,CAAC,kBAAkB;QAC9C,CAAC,CAAC,QAAQ,CAAC,OAAO,CAAC,GAAG,CAAC,kBAAkB,EAAE,EAAE,CAAC;QAC9C,CAAC,CAAC,IAAI,CAAC;IACT,OAAO;QACL,iBAAiB,EAAE,GAAG,SAAS,UAAU;QACzC,cAAc,EAAE,GAAG,SAAS,aAAa;QACzC,QAAQ,EAAE,OAAO,CAAC,GAAG,CAAC,qBAAqB,IAAI,GAAG;QAClD,YAAY,EAAE,OAAO,CAAC,GAAG,CAAC,QAAQ,KAAK,YAAY;QACnD,eAAe,EAAE,SAAS,IAAI,EAAE,GAAG,EAAE,GAAG,CAAC,EAAE,UAAU;KACtD,CAAC;AACJ,CAAC;AAED,SAAS,sBAAsB,CAAC,UAAoD;IAClF,IAAI,CAAC,UAAU;QAAE,OAAO,IAAI,CAAC;IAC7B,OAAO;QACL,EAAE,EAAE,UAAU,CAAC,MAAM;QACrB,KAAK,EAAE,UAAU,CAAC,KAAK;QACvB,MAAM,EAAE,QAAiB;QACzB,KAAK,EAAE,UAAU,CAAC,KAAK;QACvB,WAAW,EAAE,UAAU,CAAC,WAAW;QACnC,SAAS,EAAE,UAAU,CAAC,SAAS;QAC/B,QAAQ,EAAE,UAAU,CAAC,QAAQ;QAC7B,SAAS,EAAE,UAAU,CAAC,SAAS;QAC/B,aAAa,EAAE,UAAU,CAAC,aAAa;KACxC,CAAC;AACJ,CAAC;AAED,SAAS,kBAAkB,CAAC,OAAgC;IAC1D,MAAM,MAAM,GAAG,CAAC,OAAO,CAAC,GAAG,IAAI,OAAO,CAAC,OAAO,IAAI,OAAO,CAAC,MAAM,CAAuB,CAAC;IACxF,IAAI,CAAC,MAAM;QAAE,OAAO,IAAI,CAAC;IAEzB,MAAM,KAAK,GAAa,KAAK,CAAC,OAAO,CAAC,OAAO,CAAC,KAAK,CAAC;QAClD,CAAC,CAAE,OAAO,CAAC,KAA2C;aACjD,GAAG,CAAC,CAAC,CAAC,EAAE,EAAE,CAAC,CAAC,OAAO,CAAC,KAAK,QAAQ,CAAC,CAAC,CAAC,CAAC,CAAC,CAAC,CAAC,CAAC,CAAC,IAAI,IAAI,EAAE,CAAC,CAAC;aACtD,MAAM,CAAC,OAAO,CAAC;QACpB,CAAC,CAAC,EAAE,CAAC;IAEP,OAAO;QACL,EAAE,EAAE,MAAM,CAAC,MAAM,CAAC;QAClB,KAAK,EACF,OAAO,CAAC,KAAgB;YACxB,OAAO,CAAC,kBAA6B;YACtC,MAAM,CAAC,MAAM,CAAC;QAChB,MAAM,EAAE,QAAiB;QACzB,KAAK;QACL,WAAW,EAAE,OAAO,OAAO,CAAC,IAAI,KAAK,QAAQ,CAAC,CAAC,CAAC,OAAO,CAAC,IAAI,CAAC,CAAC,CAAC,SAAS;QACxE,SAAS,EAAE,OAAO,OAAO,CAAC,UAAU,KAAK,QAAQ,CAAC,CAAC,CAAC,OAAO,CAAC,UAAU,CAAC,CAAC,CAAC,SAAS;QAClF,QAAQ,EAAE,OAAO,OAAO,CAAC,WAAW,KAAK,QAAQ,CAAC,CAAC,CAAC,OAAO,CAAC,WAAW,CAAC,CAAC,CAAC,SAAS;QACnF,SAAS,EAAE,OAAO,OAAO,CAAC,OAAO,KAAK,QAAQ,CAAC,CAAC,CAAC,OAAO,CAAC,OAAO,CAAC,CAAC,CAAC,SAAS;QAC5E,aAAa,EACX,OAAO,OAAO,CAAC,cAAc,KAAK,QAAQ,CAAC,CAAC,CAAC,OAAO,CAAC,cAAc,CAAC,CAAC,CAAC,SAAS;KAClF,CAAC;AACJ,CAAC;AAED;;;;;GAKG;AACH,MAAM,UAAU,0BAA0B,CAAC,cAAsB;IAC/D,MAAM,QAAQ,GAAG,OAAO,CAAC,GAAG,CAAC,QAAQ,IAAI,cAAc,CAAC;IACxD,MAAM,OAAO,GAAG,OAAO,CAAC,GAAG,CAAC,oBAAoB,KAAK,MAAM,CAAC;IAE5D,KAAK,UAAU,GAAG,CAAC,OAAoB;QACrC,IAAI,CAAC;YACH,MAAM,UAAU,GAAG,qBAAqB,CAAC,OAAO,CAAC,CAAC;YAClD,MAAM,IAAI,GAAG,sBAAsB,CAAC,UAAU,CAAC,CAAC;YAChD,IAAI,IAAI,EAAE,CAAC;gBACT,OAAO,YAAY,CAAC,IAAI,CAAC,EAAE,OAAO,EAAE,IAAI,EAAE,IAAI,EAAE,EAAE,IAAI,EAAE,EAAE,CAAC,CAAC;YAC9D,CAAC;YAED,MAAM,KAAK,GAAG,mBAAmB,CAAC,OAAO,CAAC,CAAC;YAC3C,IAAI,CAAC,KAAK,IAAI,cAAc,CAAC,KAAK,CAAC,EAAE,CAAC;gBACpC,OAAO,YAAY,CAAC,IAAI,CAAC,EAAE,OAAO,EAAE,KAAK,EAAE,IAAI,EAAE,EAAE,IAAI,EAAE,IAAI,EAAE,EAAE,CAAC,CAAC;YACrE,CAAC;YAED,IAAI,OAAgC,CAAC;YACrC,IAAI,CAAC;gBACH,MAAM,KAAK,GAAG,KAAK,CAAC,KAAK,CAAC,GAAG,CAAC,CAAC;gBAC/B,IAAI,KAAK,CAAC,MAAM,KAAK,CAAC,EAAE,CAAC;oBACvB,OAAO,YAAY,CAAC,IAAI,CAAC,EAAE,OAAO,EAAE,KAAK,EAAE,IAAI,EAAE,EAAE,IAAI,EAAE,IAAI,EAAE,EAAE,CAAC,CAAC;gBACrE,CAAC;gBACD,OAAO,GAAG,IAAI,CAAC,KAAK,CAAC,IAAI,CAAC,KAAK,CAAC,CAAC,CAAC,CAAC,OAAO,CAAC,IAAI,EAAE,GAAG,CAAC,CAAC,OAAO,CAAC,IAAI,EAAE,GAAG,CAAC,CAAC,CAAC,CAAC;YAC7E,CAAC;YAAC,MAAM,CAAC;gBACP,OAAO,YAAY,CAAC,IAAI,CAAC,EAAE,OAAO,EAAE,KAAK,EAAE,IAAI,EAAE,EAAE,IAAI,EAAE,IAAI,EAAE,EAAE,CAAC,CAAC;YACrE,CAAC;YAED,MAAM,OAAO,GAAG,kBAAkB,CAAC,OAAO,CAAC,CAAC;YAC5C,IAAI,CAAC,OAAO,EAAE,CAAC;gBACb,OAAO,YAAY,CAAC,IAAI,CAAC,EAAE,OAAO,EAAE,KAAK,EAAE,IAAI,EAAE,EAAE,IAAI,EAAE,IAAI,EAAE,EAAE,CAAC,CAAC;YACrE,CAAC;YAED,OAAO,YAAY,CAAC,IAAI,CAAC,EAAE,OAAO,EAAE,IAAI,EAAE,IAAI,EAAE,EAAE,IAAI,EAAE,OAAO,EAAE,EAAE,CAAC,CAAC;QACvE,CAAC;QAAC,OAAO,KAAK,EAAE,CAAC;YACf,OAAO,CAAC,KAAK,CAAC,2BAA2B,EAAE,KAAK,CAAC,CAAC;YAClD,OAAO,YAAY,CAAC,IAAI,CAAC,EAAE,OAAO,EAAE,KAAK,EAAE,IAAI,EAAE,EAAE,IAAI,EAAE,IAAI,EAAE,EAAE,CAAC,CAAC;QACrE,CAAC;IACH,CAAC;IAED,KAAK,UAAU,IAAI,CAAC,OAAoB;QACtC,IAAI,IAAI,GAAuB,EAAE,CAAC;QAClC,IAAI,CAAC;YACH,IAAI,GAAG,MAAM,OAAO,CAAC,IAAI,EAAE,CAAC;QAC9B,CAAC;QAAC,MAAM,CAAC;YACP,iCAAiC;QACnC,CAAC;QAED,IAAI,IAAI,CAAC,KAAK,EAAE,CAAC;YACf,OAAO,iBAAiB,CAAC,IAAI,CAAC,KAAK,CAAC,CAAC;QACvC,CAAC;QACD,OAAO,aAAa,CAAC,OAAO,CAAC,CAAC;IAChC,CAAC;IAED,KAAK,UAAU,iBAAiB,CAAC,KAAa;QAC5C,IAAI,CAAC;YACH,IAAI,cAAc,CAAC,KAAK,CAAC,EAAE,CAAC;gBAC1B,OAAO,YAAY,CAAC,IAAI,CACtB,EAAE,KAAK,EAAE,eAAe,EAAE,OAAO,EAAE,oBAAoB,EAAE,EACzD,EAAE,MAAM,EAAE,GAAG,EAAE,CAChB,CAAC;YACJ,CAAC;YAED,MAAM,UAAU,GAAG,MAAM,gBAAgB,CAAC,KAAK,EAAE,EAAE,OAAO,EAAE,QAAQ,EAAE,CAAC,CAAC;YACxE,IAAI,CAAC,UAAU,CAAC,KAAK,EAAE,CAAC;gBACtB,IAAI,OAAO;oBAAE,OAAO,CAAC,GAAG,CAAC,uCAAuC,EAAE,UAAU,CAAC,KAAK,CAAC,CAAC;gBACpF,OAAO,YAAY,CAAC,IAAI,CACtB,EAAE,OAAO,EAAE,KAAK,EAAE,KAAK,EAAE,eAAe,EAAE,OAAO,EAAE,UAAU,CAAC,KAAK,EAAE,EACrE,EAAE,MAAM,EAAE,GAAG,EAAE,CAChB,CAAC;YACJ,CAAC;YAED,MAAM,OAAO,GAAG,oBAAoB,CAAC,UAAU,CAAC,CAAC;YACjD,MAAM,MAAM,GAAG,eAAe,CAAC,QAAQ,CAAC,CAAC;YAEzC,MAAM,QAAQ,GAAG,YAAY,CAAC,IAAI,CAAC;gBACjC,OAAO,EAAE,IAAI;gBACb,IAAI,EAAE;oBACJ,EAAE,EAAE,OAAO,CAAC,MAAM;oBAClB,KAAK,EAAE,OAAO,CAAC,KAAK;oBACpB,KAAK,EAAE,OAAO,CAAC,KAAK;oBACpB,WAAW,EAAE,OAAO,CAAC,WAAW;oBAChC,SAAS,EAAE,OAAO,CAAC,SAAS;oBAC5B,QAAQ,EAAE,OAAO,CAAC,QAAQ;oBAC1B,SAAS,EAAE,OAAO,CAAC,SAAS;oBAC5B,aAAa,EAAE,OAAO,CAAC,aAAa;iBACrC;aACF,CAAC,CAAC;YAEH,QAAQ,CAAC,OAAO,CAAC,GAAG,CAAC,MAAM,CAAC,iBAAiB,EAAE,IAAI,CAAC,SAAS,CAAC,OAAO,CAAC,EAAE;gBACtE,QAAQ,EAAE,IAAI;gBACd,MAAM,EAAE,MAAM,CAAC,YAAY;gBAC3B,QAAQ,EAAE,KAAK;gBACf,MAAM,EAAE,EAAE,GAAG,EAAE,GAAG,EAAE;gBACpB,IAAI,EAAE,MAAM,CAAC,QAAQ;aACtB,CAAC,CAAC;YAEH,QAAQ,CAAC,OAAO,CAAC,GAAG,CAAC,MAAM,CAAC,cAAc,EAAE,KAAK,EAAE;gBACjD,QAAQ,EAAE,IAAI;gBACd,MAAM,EAAE,MAAM,CAAC,YAAY;gBAC3B,QAAQ,EAAE,KAAK;gBACf,MAAM,EAAE,MAAM,CAAC,eAAe;gBAC9B,IAAI,EAAE,MAAM,CAAC,QAAQ;aACtB,CAAC,CAAC;YAEH,IAAI,OAAO,EAAE,CAAC;gBACZ,OAAO,CAAC,GAAG,CACT,sCAAsC,OAAO,CAAC,MAAM,cAAc,MAAM,CAAC,iBAAiB,KAAK,MAAM,CAAC,cAAc,EAAE,CACvH,CAAC;YACJ,CAAC;YAED,OAAO,QAAQ,CAAC;QAClB,CAAC;QAAC,OAAO,KAAK,EAAE,CAAC;YACf,OAAO,CAAC,KAAK,CAAC,oCAAoC,EAAE,KAAK,CAAC,CAAC;YAC3D,OAAO,YAAY,CAAC,IAAI,CAAC,EAAE,OAAO,EAAE,KAAK,EAAE,KAAK,EAAE,YAAY,EAAE,EAAE,EAAE,MAAM,EAAE,GAAG,EAAE,CAAC,CAAC;QACrF,CAAC;IACH,CAAC;IAED,KAAK,UAAU,aAAa,CAAC,OAAoB;QAC/C,IAAI,CAAC;YACH,MAAM,QAAQ,GAAG,mBAAmB,CAAC,OAAO,CAAC,CAAC;YAE9C,IAAI,CAAC,QAAQ,EAAE,CAAC;gBACd,OAAO,YAAY,CAAC,IAAI,CACtB,EAAE,KAAK,EAAE,qBAAqB,EAAE,cAAc,EAAE,IAAI,EAAE,EACtD,EAAE,MAAM,EAAE,GAAG,EAAE,CAChB,CAAC;YACJ,CAAC;YAED,IAAI,cAAc,CAAC,QAAQ,CAAC,EAAE,CAAC;gBAC7B,OAAO,YAAY,CAAC,IAAI,CACtB,EAAE,KAAK,EAAE,mBAAmB,EAAE,cAAc,EAAE,IAAI,EAAE,EACpD,EAAE,MAAM,EAAE,GAAG,EAAE,CAChB,CAAC;YACJ,CAAC;YAED,MAAM,QAAQ,GAAG,MAAM,WAAW,CAAC,QAAQ,EAAE,WAAW,CAAC,CAAC;YAE1D,OAAO,YAAY,CAAC,IAAI,CAAC;gBACvB,OAAO,EAAE,IAAI;gBACb,KAAK,EAAE,QAAQ;gBACf,SAAS,EAAE,GAAG;aACf,CAAC,CAAC;QACL,CAAC;QAAC,OAAO,KAAK,EAAE,CAAC;YACf,OAAO,CAAC,KAAK,CAAC,+BAA+B,EAAE,KAAK,CAAC,CAAC;YAEtD,MAAM,GAAG,GAAG,KAAK,YAAY,KAAK,CAAC,CAAC,CAAC,KAAK,CAAC,OAAO,CAAC,CAAC,CAAC,MAAM,CAAC,KAAK,CAAC,CAAC;YACnE,IAAI,GAAG,CAAC,QAAQ,CAAC,mBAAmB,CAAC,IAAI,GAAG,CAAC,QAAQ,CAAC,SAAS,CAAC,EAAE,CAAC;gBACjE,OAAO,YAAY,CAAC,IAAI,CACtB,EAAE,KAAK,EAAE,sBAAsB,EAAE,cAAc,EAAE,IAAI,EAAE,EACvD,EAAE,MAAM,EAAE,GAAG,EAAE,CAChB,CAAC;YACJ,CAAC;YAED,OAAO,YAAY,CAAC,IAAI,CACtB,EAAE,KAAK,EAAE,sBAAsB,EAAE,OAAO,EAAE,GAAG,EAAE,EAC/C,EAAE,MAAM,EAAE,GAAG,EAAE,CAChB,CAAC;QACJ,CAAC;IACH,CAAC;IAED,OAAO,EAAE,GAAG,EAAE,IAAI,EAAE,CAAC;AACvB,CAAC"}

package/dist/lib/authz/sso-generator.d.ts

@@ -0,0 +1,51 @@
+/**
+ * SSO Token Generation (Zero Trust)
+ *
+ * Uses authz service OAuth2 token exchange (RFC 8693) to generate app-scoped tokens.
+ *
+ * Flow:
+ * 1. User requests access to an app (e.g., busibox-agents)
+ * 2. busibox-portal exchanges user's session JWT with authz for an app-scoped token
+ * 3. authz verifies user has access to the app via RBAC bindings
+ * 4. authz issues RS256 token with app_id claim and user's roles
+ * 5. External app validates token via authz JWKS: GET /.well-known/jwks.json
+ *
+ * Benefits:
+ * - Standardized OAuth2 flow (RFC 8693)
+ * - Asymmetric signing (RS256) with JWKS
+ * - Service-scoped tokens (audience enforcement)
+ * - App access controlled via authz RBAC bindings
+ * - Centralized audit logging
+ * - No client credentials needed - JWT proves identity
+ */
+/**
+ * User info for SSO token generation
+ */
+export interface SSOUserInfo {
+    id: string;
+    email: string;
+    roles: string[];
+    sessionJwt: string;
+}
+/**
+ * Generate an app-scoped access token for a user to access an external app.
+ *
+ * Zero Trust Flow:
+ * 1. Verify app exists and is active in busibox-portal DB
+ * 2. Exchange user's session JWT for an app-scoped token via authz
+ * 3. Authz verifies user has app access via RBAC bindings
+ * 4. Authz issues RS256 token with app_id claim
+ *
+ * The external app validates this token via authz JWKS endpoint:
+ * GET {authz_url}/.well-known/jwks.json
+ *
+ * @param userInfo - User info including id, email, roles, and sessionJwt
+ * @param appIdentifier - App identifier (UUID, stable audience, path, or name)
+ * @returns JWT token string and expiration date
+ */
+export declare function generateSSOToken(userInfo: SSOUserInfo, appIdentifier: string): Promise<{
+    token: string;
+    expiresAt: Date;
+    appUrl: string | null;
+}>;
+//# sourceMappingURL=sso-generator.d.ts.map

package/dist/lib/authz/sso-generator.d.ts.map

@@ -0,0 +1 @@
+{"version":3,"file":"sso-generator.d.ts","sourceRoot":"","sources":["../../../src/lib/authz/sso-generator.ts"],"names":[],"mappings":"AAAA;;;;;;;;;;;;;;;;;;;GAmBG;AAoBH;;GAEG;AACH,MAAM,WAAW,WAAW;IAC1B,EAAE,EAAE,MAAM,CAAC;IACX,KAAK,EAAE,MAAM,CAAC;IACd,KAAK,EAAE,MAAM,EAAE,CAAC;IAChB,UAAU,EAAE,MAAM,CAAC;CACpB;AAsBD;;;;;;;;;;;;;;;GAeG;AACH,wBAAsB,gBAAgB,CAAC,QAAQ,EAAE,WAAW,EAAE,aAAa,EAAE,MAAM,GAAG,OAAO,CAAC;IAC5F,KAAK,EAAE,MAAM,CAAC;IACd,SAAS,EAAE,IAAI,CAAC;IAChB,MAAM,EAAE,MAAM,GAAG,IAAI,CAAC;CACvB,CAAC,CAoHD"}

package/dist/lib/authz/sso-generator.js

@@ -0,0 +1,167 @@
+/**
+ * SSO Token Generation (Zero Trust)
+ *
+ * Uses authz service OAuth2 token exchange (RFC 8693) to generate app-scoped tokens.
+ *
+ * Flow:
+ * 1. User requests access to an app (e.g., busibox-agents)
+ * 2. busibox-portal exchanges user's session JWT with authz for an app-scoped token
+ * 3. authz verifies user has access to the app via RBAC bindings
+ * 4. authz issues RS256 token with app_id claim and user's roles
+ * 5. External app validates token via authz JWKS: GET /.well-known/jwks.json
+ *
+ * Benefits:
+ * - Standardized OAuth2 flow (RFC 8693)
+ * - Asymmetric signing (RS256) with JWKS
+ * - Service-scoped tokens (audience enforcement)
+ * - App access controlled via authz RBAC bindings
+ * - Centralized audit logging
+ * - No client credentials needed - JWT proves identity
+ */
+import { logOAuthTokenGenerated } from './audit';
+import { exchangeTokenZeroTrust } from '@jazzmind/busibox-app';
+import { getAuthzBaseUrl } from './next-client';
+import { getAppByIdFromStore, getAppConfigStoreContextForUser, listAppsFromStore, resolveStableSsoAudience } from '../deploy/app-config';
+/**
+ * Get audit client options for server-side audit logging.
+ */
+function getAuditOptions() {
+    return {
+        authzUrl: getAuthzBaseUrl(),
+    };
+}
+function normalizeIdentifier(value) {
+    return value.trim().toLowerCase();
+}
+function normalizePath(value) {
+    const trimmed = value.trim();
+    return trimmed.startsWith('/') ? trimmed.toLowerCase() : `/${trimmed.toLowerCase()}`;
+}
+function isPortalInternalBuiltInRoute(_url) {
+    // In the monorepo, all built-in apps (chat, documents, admin, etc.) run as
+    // separate Next.js apps with their own basePath. Nothing is portal-internal
+    // anymore — all apps need SSO token exchange.
+    return false;
+}
+// ============================================================================
+// Token Generation
+// ============================================================================
+/**
+ * Generate an app-scoped access token for a user to access an external app.
+ *
+ * Zero Trust Flow:
+ * 1. Verify app exists and is active in busibox-portal DB
+ * 2. Exchange user's session JWT for an app-scoped token via authz
+ * 3. Authz verifies user has app access via RBAC bindings
+ * 4. Authz issues RS256 token with app_id claim
+ *
+ * The external app validates this token via authz JWKS endpoint:
+ * GET {authz_url}/.well-known/jwks.json
+ *
+ * @param userInfo - User info including id, email, roles, and sessionJwt
+ * @param appIdentifier - App identifier (UUID, stable audience, path, or name)
+ * @returns JWT token string and expiration date
+ */
+export async function generateSSOToken(userInfo, appIdentifier) {
+    // Verify app exists and is active
+    const context = await getAppConfigStoreContextForUser(userInfo.id, userInfo.sessionJwt);
+    const requestedIdentifier = appIdentifier.trim();
+    let app = await getAppByIdFromStore(context.accessToken, requestedIdentifier);
+    if (!app) {
+        const allApps = await listAppsFromStore(context.accessToken);
+        const normalized = normalizeIdentifier(requestedIdentifier);
+        const pathLike = normalizePath(requestedIdentifier);
+        app =
+            allApps.find((candidate) => candidate.ssoAudience?.toLowerCase() === normalized) ||
+                allApps.find((candidate) => candidate.name.toLowerCase() === normalized) ||
+                allApps.find((candidate) => candidate.url?.toLowerCase() === pathLike) ||
+                allApps.find((candidate) => candidate.deployedPath?.toLowerCase() === pathLike) ||
+                null;
+    }
+    if (!app) {
+        throw new Error(`App not found: ${requestedIdentifier}`);
+    }
+    if (!app.isActive) {
+        throw new Error('App is not active');
+    }
+    // In the monorepo, all apps (BUILT_IN, LIBRARY, EXTERNAL) are separate
+    // Next.js apps and need SSO token exchange.
+    const allowSso = app.type === 'EXTERNAL' ||
+        app.type === 'LIBRARY' ||
+        app.type === 'BUILT_IN';
+    if (!allowSso) {
+        throw new Error('App does not support SSO authentication');
+    }
+    console.log('[SSO] Requesting app-scoped token from authz:', {
+        userId: userInfo.id,
+        requestedIdentifier,
+        appId: app.id,
+        appName: app.name,
+        ssoAudience: app.ssoAudience,
+    });
+    const audience = resolveStableSsoAudience(app);
+    // Exchange session JWT for app-scoped token via authz
+    // Authz will verify user has access to this app via RBAC bindings
+    // and issue RS256 token with app_id claim and user's roles
+    try {
+        const result = await exchangeTokenZeroTrust({
+            sessionJwt: userInfo.sessionJwt,
+            audience,
+            resourceId: app.id, // Canonical app UUID for RBAC check
+            purpose: 'sso-app-access',
+        }, {
+            authzBaseUrl: getAuthzBaseUrl(),
+            verbose: process.env.VERBOSE_AUTHZ_LOGGING === 'true',
+        });
+        const expiresAt = new Date(result.expiresAt);
+        console.log('[SSO] App-scoped token issued by authz:', {
+            userId: userInfo.id,
+            requestedIdentifier,
+            appId: app.id,
+            appName: app.name,
+            audience,
+            expiresIn: result.expiresIn,
+        });
+        // Log token generation (audit failure is non-fatal)
+        // Note: authz already logs the token issuance in its audit log
+        try {
+            const auditOptions = getAuditOptions();
+            await logOAuthTokenGenerated(userInfo.id, app.id, auditOptions);
+        }
+        catch (auditError) {
+            console.error('[SSO] Audit logging failed (non-fatal):', auditError);
+        }
+        // For deployed apps, use deployedPath (e.g., /myapp)
+        // For external web apps, use the URL directly
+        // local-dev:// URLs should use deployedPath once deployed
+        let appUrl = app.url;
+        if (app.deployedPath && app.lastDeploymentStatus === 'completed') {
+            appUrl = app.deployedPath;
+        }
+        else if (app.url?.startsWith('local-dev://')) {
+            // local-dev app not yet deployed - use deployedPath if available
+            appUrl = app.deployedPath || null;
+        }
+        return {
+            token: result.accessToken,
+            expiresAt,
+            appUrl,
+        };
+    }
+    catch (error) {
+        // Map authz errors to user-friendly messages
+        const errorMessage = error.message || String(error);
+        if (errorMessage.includes('user_does_not_have_app_access')) {
+            throw new Error('User does not have permission to access this app');
+        }
+        if (errorMessage.includes('403')) {
+            throw new Error('User does not have permission to access this app');
+        }
+        if (errorMessage.includes('session_revoked') || errorMessage.includes('expired')) {
+            throw new Error('Session has expired. Please log in again.');
+        }
+        console.error('[SSO] Token exchange failed:', error);
+        throw new Error(`Failed to generate app token: ${errorMessage}`);
+    }
+}
+//# sourceMappingURL=sso-generator.js.map

package/dist/lib/authz/sso-generator.js.map

@@ -0,0 +1 @@
+{"version":3,"file":"sso-generator.js","sourceRoot":"","sources":["../../../src/lib/authz/sso-generator.ts"],"names":[],"mappings":"AAAA;;;;;;;;;;;;;;;;;;;GAmBG;AAEH,OAAO,EAAE,sBAAsB,EAA2B,MAAM,SAAS,CAAC;AAC1E,OAAO,EAAE,sBAAsB,EAAE,MAAM,uBAAuB,CAAC;AAC/D,OAAO,EAAE,eAAe,EAAE,MAAM,eAAe,CAAC;AAChD,OAAO,EAAE,mBAAmB,EAAE,+BAA+B,EAAE,iBAAiB,EAAE,wBAAwB,EAAE,MAAM,sBAAsB,CAAC;AAEzI;;GAEG;AACH,SAAS,eAAe;IACtB,OAAO;QACL,QAAQ,EAAE,eAAe,EAAE;KAC5B,CAAC;AACJ,CAAC;AAgBD,SAAS,mBAAmB,CAAC,KAAa;IACxC,OAAO,KAAK,CAAC,IAAI,EAAE,CAAC,WAAW,EAAE,CAAC;AACpC,CAAC;AAED,SAAS,aAAa,CAAC,KAAa;IAClC,MAAM,OAAO,GAAG,KAAK,CAAC,IAAI,EAAE,CAAC;IAC7B,OAAO,OAAO,CAAC,UAAU,CAAC,GAAG,CAAC,CAAC,CAAC,CAAC,OAAO,CAAC,WAAW,EAAE,CAAC,CAAC,CAAC,IAAI,OAAO,CAAC,WAAW,EAAE,EAAE,CAAC;AACvF,CAAC;AAED,SAAS,4BAA4B,CAAC,IAAoB;IACxD,2EAA2E;IAC3E,4EAA4E;IAC5E,8CAA8C;IAC9C,OAAO,KAAK,CAAC;AACf,CAAC;AAED,+EAA+E;AAC/E,mBAAmB;AACnB,+EAA+E;AAE/E;;;;;;;;;;;;;;;GAeG;AACH,MAAM,CAAC,KAAK,UAAU,gBAAgB,CAAC,QAAqB,EAAE,aAAqB;IAKjF,kCAAkC;IAClC,MAAM,OAAO,GAAG,MAAM,+BAA+B,CAAC,QAAQ,CAAC,EAAE,EAAE,QAAQ,CAAC,UAAU,CAAC,CAAC;IACxF,MAAM,mBAAmB,GAAG,aAAa,CAAC,IAAI,EAAE,CAAC;IACjD,IAAI,GAAG,GAAG,MAAM,mBAAmB,CAAC,OAAO,CAAC,WAAW,EAAE,mBAAmB,CAAC,CAAC;IAC9E,IAAI,CAAC,GAAG,EAAE,CAAC;QACT,MAAM,OAAO,GAAG,MAAM,iBAAiB,CAAC,OAAO,CAAC,WAAW,CAAC,CAAC;QAC7D,MAAM,UAAU,GAAG,mBAAmB,CAAC,mBAAmB,CAAC,CAAC;QAC5D,MAAM,QAAQ,GAAG,aAAa,CAAC,mBAAmB,CAAC,CAAC;QACpD,GAAG;YACD,OAAO,CAAC,IAAI,CAAC,CAAC,SAAS,EAAE,EAAE,CAAC,SAAS,CAAC,WAAW,EAAE,WAAW,EAAE,KAAK,UAAU,CAAC;gBAChF,OAAO,CAAC,IAAI,CAAC,CAAC,SAAS,EAAE,EAAE,CAAC,SAAS,CAAC,IAAI,CAAC,WAAW,EAAE,KAAK,UAAU,CAAC;gBACxE,OAAO,CAAC,IAAI,CAAC,CAAC,SAAS,EAAE,EAAE,CAAC,SAAS,CAAC,GAAG,EAAE,WAAW,EAAE,KAAK,QAAQ,CAAC;gBACtE,OAAO,CAAC,IAAI,CAAC,CAAC,SAAS,EAAE,EAAE,CAAC,SAAS,CAAC,YAAY,EAAE,WAAW,EAAE,KAAK,QAAQ,CAAC;gBAC/E,IAAI,CAAC;IACT,CAAC;IAED,IAAI,CAAC,GAAG,EAAE,CAAC;QACT,MAAM,IAAI,KAAK,CAAC,kBAAkB,mBAAmB,EAAE,CAAC,CAAC;IAC3D,CAAC;IAED,IAAI,CAAC,GAAG,CAAC,QAAQ,EAAE,CAAC;QAClB,MAAM,IAAI,KAAK,CAAC,mBAAmB,CAAC,CAAC;IACvC,CAAC;IAED,uEAAuE;IACvE,4CAA4C;IAC5C,MAAM,QAAQ,GACZ,GAAG,CAAC,IAAI,KAAK,UAAU;QACvB,GAAG,CAAC,IAAI,KAAK,SAAS;QACtB,GAAG,CAAC,IAAI,KAAK,UAAU,CAAC;IAE1B,IAAI,CAAC,QAAQ,EAAE,CAAC;QACd,MAAM,IAAI,KAAK,CAAC,yCAAyC,CAAC,CAAC;IAC7D,CAAC;IAED,OAAO,CAAC,GAAG,CAAC,+CAA+C,EAAE;QAC3D,MAAM,EAAE,QAAQ,CAAC,EAAE;QACnB,mBAAmB;QACnB,KAAK,EAAE,GAAG,CAAC,EAAE;QACb,OAAO,EAAE,GAAG,CAAC,IAAI;QACjB,WAAW,EAAE,GAAG,CAAC,WAAW;KAC7B,CAAC,CAAC;IAEH,MAAM,QAAQ,GAAG,wBAAwB,CAAC,GAAG,CAAC,CAAC;IAE/C,sDAAsD;IACtD,kEAAkE;IAClE,2DAA2D;IAC3D,IAAI,CAAC;QACH,MAAM,MAAM,GAAG,MAAM,sBAAsB,CACzC;YACE,UAAU,EAAE,QAAQ,CAAC,UAAU;YAC/B,QAAQ;YACR,UAAU,EAAE,GAAG,CAAC,EAAE,EAAE,oCAAoC;YACxD,OAAO,EAAE,gBAAgB;SAC1B,EACD;YACE,YAAY,EAAE,eAAe,EAAE;YAC/B,OAAO,EAAE,OAAO,CAAC,GAAG,CAAC,qBAAqB,KAAK,MAAM;SACtD,CACF,CAAC;QAEF,MAAM,SAAS,GAAG,IAAI,IAAI,CAAC,MAAM,CAAC,SAAS,CAAC,CAAC;QAE7C,OAAO,CAAC,GAAG,CAAC,yCAAyC,EAAE;YACrD,MAAM,EAAE,QAAQ,CAAC,EAAE;YACnB,mBAAmB;YACnB,KAAK,EAAE,GAAG,CAAC,EAAE;YACb,OAAO,EAAE,GAAG,CAAC,IAAI;YACjB,QAAQ;YACR,SAAS,EAAE,MAAM,CAAC,SAAS;SAC5B,CAAC,CAAC;QAEH,oDAAoD;QACpD,+DAA+D;QAC/D,IAAI,CAAC;YACH,MAAM,YAAY,GAAG,eAAe,EAAE,CAAC;YACvC,MAAM,sBAAsB,CAAC,QAAQ,CAAC,EAAE,EAAE,GAAG,CAAC,EAAE,EAAE,YAAY,CAAC,CAAC;QAClE,CAAC;QAAC,OAAO,UAAU,EAAE,CAAC;YACpB,OAAO,CAAC,KAAK,CAAC,yCAAyC,EAAE,UAAU,CAAC,CAAC;QACvE,CAAC;QAED,qDAAqD;QACrD,8CAA8C;QAC9C,0DAA0D;QAC1D,IAAI,MAAM,GAAG,GAAG,CAAC,GAAG,CAAC;QACrB,IAAI,GAAG,CAAC,YAAY,IAAI,GAAG,CAAC,oBAAoB,KAAK,WAAW,EAAE,CAAC;YACjE,MAAM,GAAG,GAAG,CAAC,YAAY,CAAC;QAC5B,CAAC;aAAM,IAAI,GAAG,CAAC,GAAG,EAAE,UAAU,CAAC,cAAc,CAAC,EAAE,CAAC;YAC/C,iEAAiE;YACjE,MAAM,GAAG,GAAG,CAAC,YAAY,IAAI,IAAI,CAAC;QACpC,CAAC;QAED,OAAO;YACL,KAAK,EAAE,MAAM,CAAC,WAAW;YACzB,SAAS;YACT,MAAM;SACP,CAAC;IACJ,CAAC;IAAC,OAAO,KAAU,EAAE,CAAC;QACpB,6CAA6C;QAC7C,MAAM,YAAY,GAAG,KAAK,CAAC,OAAO,IAAI,MAAM,CAAC,KAAK,CAAC,CAAC;QAEpD,IAAI,YAAY,CAAC,QAAQ,CAAC,+BAA+B,CAAC,EAAE,CAAC;YAC3D,MAAM,IAAI,KAAK,CAAC,kDAAkD,CAAC,CAAC;QACtE,CAAC;QACD,IAAI,YAAY,CAAC,QAAQ,CAAC,KAAK,CAAC,EAAE,CAAC;YACjC,MAAM,IAAI,KAAK,CAAC,kDAAkD,CAAC,CAAC;QACtE,CAAC;QACD,IAAI,YAAY,CAAC,QAAQ,CAAC,iBAAiB,CAAC,IAAI,YAAY,CAAC,QAAQ,CAAC,SAAS,CAAC,EAAE,CAAC;YACjF,MAAM,IAAI,KAAK,CAAC,2CAA2C,CAAC,CAAC;QAC/D,CAAC;QAED,OAAO,CAAC,KAAK,CAAC,8BAA8B,EAAE,KAAK,CAAC,CAAC;QACrD,MAAM,IAAI,KAAK,CAAC,iCAAiC,YAAY,EAAE,CAAC,CAAC;IACnE,CAAC;AACH,CAAC"}

package/dist/lib/authz/sso-route-handler.d.ts

@@ -0,0 +1,117 @@
+/**
+ * Shared SSO Route Handler
+ *
+ * Provides reusable handlers for SSO token exchange in Busibox apps.
+ * Use these handlers in your app's /api/sso/route.ts to avoid code duplication.
+ *
+ * @example
+ * ```typescript
+ * // app/api/sso/route.ts
+ * import { handleSSOGet, handleSSOPost } from '@jazzmind/busibox-app/lib/authz';
+ *
+ * export const GET = handleSSOGet;
+ * export const POST = handleSSOPost;
+ * ```
+ */
+/**
+ * Request interface compatible with Next.js NextRequest
+ */
+interface NextRequestLike {
+    json(): Promise<{
+        token?: string;
+    }>;
+    nextUrl: {
+        searchParams: {
+            get(name: string): string | null;
+        };
+    };
+    headers: {
+        get(name: string): string | null;
+    };
+    url: string;
+}
+/**
+ * Response instance interface - what a response object looks like
+ */
+interface ResponseInstance {
+    cookies: {
+        set(name: string, value: string, options?: {
+            httpOnly?: boolean;
+            secure?: boolean;
+            sameSite?: 'strict' | 'lax' | 'none';
+            maxAge?: number;
+            path?: string;
+        }): void;
+    };
+}
+/**
+ * Options for SSO handlers
+ */
+export interface SSOHandlerOptions {
+    /** Override app name (default: process.env.APP_NAME or 'app') */
+    appName?: string;
+    /** Override base path (default: process.env.NEXT_PUBLIC_BASE_PATH or '/') */
+    basePath?: string;
+    /** Default fallback app name if APP_NAME not set */
+    defaultAppName?: string;
+    /** Enable verbose logging */
+    verbose?: boolean;
+    /**
+     * Override auth token cookie maxAge in seconds.
+     * Default: 21600 (6 hours).
+     * Also reads SSO_COOKIE_MAX_AGE env var.
+     * Useful for testing token refresh with shorter expiry.
+     */
+    authTokenMaxAge?: number;
+}
+/**
+ * Result of SSO POST handler
+ */
+export interface SSOPostResult {
+    success: boolean;
+    user?: {
+        id: string;
+        email: string;
+        roles: string[];
+        displayName?: string;
+        firstName?: string;
+        lastName?: string;
+        avatarUrl?: string;
+        favoriteColor?: string;
+    };
+    error?: string;
+    details?: string;
+}
+/**
+ * Handle SSO GET request (redirect-based flow)
+ *
+ * This handler validates the token from URL query params and redirects
+ * back to the app with session cookies set.
+ *
+ * @param request - Next.js NextRequest
+ * @param NextResponse - Next.js NextResponse class
+ * @param options - Optional configuration
+ * @returns NextResponse redirect with cookies set
+ */
+export declare function createSSOGetHandler<T extends ResponseInstance>(NextResponse: {
+    redirect(url: URL): T;
+}, options?: SSOHandlerOptions): (request: NextRequestLike) => Promise<T>;
+/**
+ * Handle SSO POST request (API-based flow)
+ *
+ * This handler validates the token from the request body and returns
+ * a JSON response with session cookies set. This is the preferred method
+ * as browsers properly process Set-Cookie headers from JSON responses.
+ *
+ * @param request - Next.js NextRequest
+ * @param NextResponse - Next.js NextResponse class
+ * @param options - Optional configuration
+ * @returns NextResponse with JSON body and cookies set
+ */
+export declare function createSSOPostHandler<T extends ResponseInstance>(NextResponse: {
+    json(body: unknown, init?: {
+        status?: number;
+    }): T;
+}, options?: SSOHandlerOptions): (request: NextRequestLike) => Promise<T>;
+export {};
+//# sourceMappingURL=sso-route-handler.d.ts.map

package/dist/lib/authz/sso-route-handler.d.ts.map

@@ -0,0 +1 @@
+{"version":3,"file":"sso-route-handler.d.ts","sourceRoot":"","sources":["../../../src/lib/authz/sso-route-handler.ts"],"names":[],"mappings":"AAAA;;;;;;;;;;;;;;GAcG;AAKH;;GAEG;AACH,UAAU,eAAe;IACvB,IAAI,IAAI,OAAO,CAAC;QAAE,KAAK,CAAC,EAAE,MAAM,CAAA;KAAE,CAAC,CAAC;IACpC,OAAO,EAAE;QACP,YAAY,EAAE;YACZ,GAAG,CAAC,IAAI,EAAE,MAAM,GAAG,MAAM,GAAG,IAAI,CAAC;SAClC,CAAC;KACH,CAAC;IACF,OAAO,EAAE;QACP,GAAG,CAAC,IAAI,EAAE,MAAM,GAAG,MAAM,GAAG,IAAI,CAAC;KAClC,CAAC;IACF,GAAG,EAAE,MAAM,CAAC;CACb;AAED;;GAEG;AACH,UAAU,gBAAgB;IACxB,OAAO,EAAE;QACP,GAAG,CAAC,IAAI,EAAE,MAAM,EAAE,KAAK,EAAE,MAAM,EAAE,OAAO,CAAC,EAAE;YACzC,QAAQ,CAAC,EAAE,OAAO,CAAC;YACnB,MAAM,CAAC,EAAE,OAAO,CAAC;YACjB,QAAQ,CAAC,EAAE,QAAQ,GAAG,KAAK,GAAG,MAAM,CAAC;YACrC,MAAM,CAAC,EAAE,MAAM,CAAC;YAChB,IAAI,CAAC,EAAE,MAAM,CAAC;SACf,GAAG,IAAI,CAAC;KACV,CAAC;CACH;AAUD;;GAEG;AACH,MAAM,WAAW,iBAAiB;IAChC,iEAAiE;IACjE,OAAO,CAAC,EAAE,MAAM,CAAC;IACjB,6EAA6E;IAC7E,QAAQ,CAAC,EAAE,MAAM,CAAC;IAClB,oDAAoD;IACpD,cAAc,CAAC,EAAE,MAAM,CAAC;IACxB,6BAA6B;IAC7B,OAAO,CAAC,EAAE,OAAO,CAAC;IAClB;;;;;OAKG;IACH,eAAe,CAAC,EAAE,MAAM,CAAC;CAC1B;AAED;;GAEG;AACH,MAAM,WAAW,aAAa;IAC5B,OAAO,EAAE,OAAO,CAAC;IACjB,IAAI,CAAC,EAAE;QACL,EAAE,EAAE,MAAM,CAAC;QACX,KAAK,EAAE,MAAM,CAAC;QACd,KAAK,EAAE,MAAM,EAAE,CAAC;QAChB,WAAW,CAAC,EAAE,MAAM,CAAC;QACrB,SAAS,CAAC,EAAE,MAAM,CAAC;QACnB,QAAQ,CAAC,EAAE,MAAM,CAAC;QAClB,SAAS,CAAC,EAAE,MAAM,CAAC;QACnB,aAAa,CAAC,EAAE,MAAM,CAAC;KACxB,CAAC;IACF,KAAK,CAAC,EAAE,MAAM,CAAC;IACf,OAAO,CAAC,EAAE,MAAM,CAAC;CAClB;AAkCD;;;;;;;;;;GAUG;AACH,wBAAgB,mBAAmB,CAAC,CAAC,SAAS,gBAAgB,EAC5D,YAAY,EAAE;IAAE,QAAQ,CAAC,GAAG,EAAE,GAAG,GAAG,CAAC,CAAA;CAAE,EACvC,OAAO,CAAC,EAAE,iBAAiB,GAC1B,CAAC,OAAO,EAAE,eAAe,KAAK,OAAO,CAAC,CAAC,CAAC,CAsF1C;AAED;;;;;;;;;;;GAWG;AACH,wBAAgB,oBAAoB,CAAC,CAAC,SAAS,gBAAgB,EAC7D,YAAY,EAAE;IAAE,IAAI,CAAC,IAAI,EAAE,OAAO,EAAE,IAAI,CAAC,EAAE;QAAE,MAAM,CAAC,EAAE,MAAM,CAAA;KAAE,GAAG,CAAC,CAAA;CAAE,EACpE,OAAO,CAAC,EAAE,iBAAiB,GAC1B,CAAC,OAAO,EAAE,eAAe,KAAK,OAAO,CAAC,CAAC,CAAC,CA+F1C"}