@kanzo-tech/auth 0.18.0 → 0.20.0

package/dist/next-routes.js

@@ -1,82 +1,102 @@
-import { isSameSite as m } from "./same-site.js";
-import { relyingParty as k } from "./server.js";
-import { AuthError as R } from "./types.js";
-const d = { "content-type": "application/json", "cache-control": "no-store" };
-function y(t) {
-  const n = t.lastIndexOf("/");
-  return { action: t.slice(n + 1), base: n <= 0 ? "" : t.slice(0, n) };
+import { isSameSite as y } from "./same-site.js";
+import { relyingParty as b } from "./server.js";
+import { AuthError as w } from "./types.js";
+const f = { "content-type": "application/json", "cache-control": "no-store" }, k = "/auth/problem";
+function P(e) {
+  const n = e.lastIndexOf("/");
+  return { action: e.slice(n + 1), base: n <= 0 ? "" : e.slice(0, n) };
 }
-function g(t, n) {
-  if (!(t === null || t.length === 0))
+function g(e, n) {
+  if (!(e === null || e.length === 0))
     try {
-      const r = new URL(t, n);
-      return r.origin === n ? r.href : void 0;
+      const a = new URL(e, n);
+      return a.origin === n ? a.href : void 0;
     } catch {
       return;
     }
 }
-function h(t, n) {
-  const r = new Headers({ location: t, "cache-control": "no-store" });
-  for (const i of n) r.append("set-cookie", i);
-  return new Response(null, { status: 302, headers: r });
+function h(e, n) {
+  const a = new Headers({ location: e, "cache-control": "no-store" });
+  for (const c of n) a.append("set-cookie", c);
+  return new Response(null, { status: 302, headers: a });
 }
-function f(t) {
-  if (!(t instanceof R)) throw t;
-  return new Response(JSON.stringify({ error: t.code, message: t.message }), {
-    status: t.code === "session.absent" ? 401 : 400,
-    headers: d
+function T(e) {
+  if (e === "idp/silent" || e === "session/silent") return 504;
+  if (e === "idp/unreachable") return 502;
+  if (e === "session/unavailable") return 503;
+}
+function p(e) {
+  if (!(e instanceof w)) throw e;
+  return new Response(JSON.stringify({ error: e.code, message: e.message }), {
+    status: T(e.code) ?? (e.code === "session/absent" ? 401 : 400),
+    headers: f
   });
 }
-function S(t) {
+function E(e) {
   let n;
-  const r = (s) => ((n == null ? void 0 : n.redirectUri) !== s && (n = { redirectUri: s, auth: k({ ...t, redirectUri: s }) }), n.auth), i = async (s) => {
-    const o = new URL(s.url), { action: l, base: w } = y(o.pathname), u = s.headers.get("cookie"), a = r(t.redirectUri ?? `${o.origin}${w}/callback`);
-    if (l !== "callback" && l !== "signin" && !m(s))
+  const a = (s) => ((n == null ? void 0 : n.redirectUri) !== s && (n = { redirectUri: s, auth: b({ ...e, redirectUri: s }) }), n.auth), c = (s, r) => {
+    if (!(s instanceof w)) throw s;
+    const i = new URL(e.problemPage ?? k, r);
+    return i.searchParams.set("code", s.code), h(i.href, []);
+  }, d = async (s) => {
+    const r = new URL(s.url), { action: i, base: m } = P(r.pathname), l = s.headers.get("cookie"), u = a(e.redirectUri ?? `${r.origin}${m}/callback`);
+    if (i !== "callback" && i !== "signin" && !y(s))
       return new Response(null, { status: 403, headers: { "cache-control": "no-store" } });
-    switch (l) {
+    switch (i) {
       case "signin":
         try {
-          const e = await a.begin({
-            returnTo: g(o.searchParams.get("returnTo"), o.origin) ?? "/",
-            organization: o.searchParams.get("organization") ?? void 0
+          const t = await u.begin({
+            returnTo: g(r.searchParams.get("returnTo"), r.origin) ?? "/",
+            organization: r.searchParams.get("organization") ?? void 0
           });
-          return h(e.url, e.cookies);
-        } catch (e) {
-          return f(e);
+          return h(t.url, t.cookies);
+        } catch (t) {
+          return c(t, r.origin);
         }
       case "callback":
         try {
-          const e = await a.complete({ url: o, cookie: u });
-          return h(e.returnTo, e.cookies);
-        } catch (e) {
-          return f(e);
+          const t = await u.complete({ url: r, cookie: l });
+          return h(t.returnTo, t.cookies);
+        } catch (t) {
+          return c(t, r.origin);
         }
       case "signout": {
-        const e = g(o.searchParams.get("returnTo"), o.origin), c = await a.end(u, { returnTo: e });
-        return h(c.url, c.cookies);
+        const t = g(r.searchParams.get("returnTo"), r.origin);
+        try {
+          const o = await u.end(l, { returnTo: t });
+          return h(o.url, o.cookies);
+        } catch (o) {
+          return c(o, r.origin);
+        }
       }
       case "session": {
-        const e = await a.read(u);
-        return e === null ? new Response(null, { status: 401, headers: { "cache-control": "no-store" } }) : new Response(JSON.stringify(e), { status: 200, headers: d });
+        let t;
+        try {
+          t = await u.read(l);
+        } catch (o) {
+          return p(o);
+        }
+        return t === null ? new Response(null, { status: 401, headers: { "cache-control": "no-store" } }) : new Response(JSON.stringify(t), { status: 200, headers: f });
       }
       case "refresh": {
         if (s.method !== "POST")
           return new Response(null, { status: 405, headers: { allow: "POST" } });
         try {
-          const e = await a.refresh(u), c = new Headers(d);
-          for (const p of e.cookies) c.append("set-cookie", p);
-          return new Response(JSON.stringify(e.session), { status: 200, headers: c });
-        } catch (e) {
-          return f(e);
+          const t = await u.refresh(l), o = new Headers(f);
+          for (const R of t.cookies) o.append("set-cookie", R);
+          return new Response(JSON.stringify(t.session), { status: 200, headers: o });
+        } catch (t) {
+          return p(t);
         }
       }
       default:
         return new Response(null, { status: 404 });
     }
   };
-  return { GET: i, POST: i };
+  return { GET: d, POST: d };
 }
 export {
-  S as authRoutes
+  E as authRoutes,
+  T as outage
 };
 //# sourceMappingURL=next-routes.js.map

package/dist/next-routes.js.map

@@ -1 +1 @@
-{"version":3,"file":"next-routes.js","sources":["../src/next-routes.ts"],"sourcesContent":["import { isSameSite } from \"./same-site\";\nimport type { AuthSessionConfig } from \"./next-session\";\nimport { relyingParty, type RelyingParty } from \"./server\";\nimport { AuthError } from \"./types\";\n\n/**\n * The five routes a Backend For Frontend needs, as one App Router catch-all.\n *\n * ```ts\n * // app/api/auth/[...auth]/route.ts\n * export const { GET, POST } = authRoutes({ issuer, clientId, clientSecret, secret });\n * ```\n *\n * `relyingParty` already does the whole flow in strings — a URL and a `Cookie` header in, a URL and\n * `Set-Cookie` values out — so the only thing written here is the translation into `Request` and\n * `Response`, plus the two decisions that translation forces: what a route answers when there is\n * no session, and where it is willing to send a browser afterwards.\n *\n * **Nothing in this module imports `next`.** An App Router route handler is handed a standard\n * `Request` and may answer with a standard `Response`, so the framework's own types would buy\n * nothing and would make this half untestable without it. The door earns its subpath through\n * `next-session.ts` and `next-middleware.ts`, which genuinely cannot be written without `next`.\n *\n * ## The other end of the contract\n *\n * `bffAuth` in the root barrel is the browser half, and it is specific: it `GET`s\n * `${basePath}/session` and reads **401 as \"nobody is signed in\"**, not as a failure; it `POST`s\n * `${basePath}/refresh` when a request of its own comes back 401, and retries that request once if\n * the renewal worked; it navigates to `${basePath}/signin?returnTo=…&organization=…` and\n * `${basePath}/signout?returnTo=…`. Those five paths and those status codes are the contract, and\n * `next-routes.test.ts` drives a real `bffAuth` against these handlers rather than trusting the\n * two descriptions to agree.\n *\n * ## Which routes a cross-site request may reach\n *\n * `callback` and `signin` must be reachable from anywhere — one *is* a navigation from the\n * identity provider, and the other is a link somebody is allowed to put on another page. The other\n * three are not: `signout` reached cross-site is a logout anyone can cause, `refresh` is a\n * rotation anyone can cause, and `session` is a person's identity read from a page that is not\n * ours. `same-site.ts` carries the check and the reason the package rather than the product owes\n * it.\n */\n\n/** The session endpoint answers about a person; no cache may ever hold that answer. */\nconst PRIVATE = { \"content-type\": \"application/json\", \"cache-control\": \"no-store\" } as const;\n\nexport interface AuthRoutesConfig extends AuthSessionConfig {\n  /**\n   * Override the callback URL. Absent, it is derived from the incoming request: the origin it\n   * arrived at, the path this route file sits on, and `/callback`.\n   *\n   * Deriving it trusts the `Host` header, which is chosen by whoever made the request. That is a\n   * bounded trust — a forged host produces a `redirect_uri` Keycloak has not registered, and\n   * Keycloak refuses it — but a deployment behind a proxy that rewrites the host should say the\n   * URL out loud here rather than discover this.\n   */\n  readonly redirectUri?: string;\n}\n\nexport interface AuthRouteHandlers {\n  GET(request: Request): Promise<Response>;\n  POST(request: Request): Promise<Response>;\n}\n\n/** The last path segment, and everything before it. `/api/auth/signin` → `signin`, `/api/auth`. */\nfunction split(pathname: string): { readonly action: string; readonly base: string } {\n  const cut = pathname.lastIndexOf(\"/\");\n  return { action: pathname.slice(cut + 1), base: cut <= 0 ? \"\" : pathname.slice(0, cut) };\n}\n\n/**\n * A `returnTo` confined to this origin, or `undefined`.\n *\n * Without this the sign-in route is an open redirect: `?returnTo=https://evil.test` is carried\n * through the whole flow and spent on a browser that has just proved who it is, which is the most\n * valuable moment to hijack. The check is here, where the string arrives from a query parameter,\n * and deliberately *not* repeated on the callback — what comes back out at the callback was\n * sealed into a cookie by us, so re-checking it would only make it unclear which check is the\n * real one.\n */\nfunction sameOrigin(candidate: string | null, origin: string): string | undefined {\n  if (candidate === null || candidate.length === 0) return undefined;\n  try {\n    const target = new URL(candidate, origin);\n    return target.origin === origin ? target.href : undefined;\n  } catch {\n    return undefined;\n  }\n}\n\n/**\n * A redirect that can carry cookies.\n *\n * `Response.redirect()` cannot: its headers are immutable, and a callback that cannot set a cookie\n * is a sign-in that never completes. And `append`, never `set` — the callback answers with **two**\n * `Set-Cookie` values, the session it just issued and the transaction it just spent, and `set`\n * would silently keep only the last of them.\n */\nfunction redirect(url: string, cookies: readonly string[]): Response {\n  const headers = new Headers({ location: url, \"cache-control\": \"no-store\" });\n  for (const cookie of cookies) headers.append(\"set-cookie\", cookie);\n  return new Response(null, { status: 302, headers });\n}\n\n/**\n * An `AuthError` as a status and a code a product can route on.\n *\n * Anything else is rethrown: a failure this module has no reading of is Next's to report, and\n * flattening it into a 400 here would hide a misconfiguration behind a message about credentials.\n */\nfunction failure(error: unknown): Response {\n  if (!(error instanceof AuthError)) throw error;\n  return new Response(JSON.stringify({ error: error.code, message: error.message }), {\n    status: error.code === \"session.absent\" ? 401 : 400,\n    headers: PRIVATE,\n  });\n}\n\nexport function authRoutes(config: AuthRoutesConfig): AuthRouteHandlers {\n  // One instance, rebuilt only when the callback URL it was built for changes. A `Map` keyed by\n  // origin would grow without bound on a stream of forged `Host` headers; a single slot cannot,\n  // and it self-heals, because the next genuine request derives its own URL again. What it costs\n  // in that case is a re-discovery, which is the right price for a request that lied.\n  let current: { readonly redirectUri: string; readonly auth: RelyingParty } | undefined;\n  const authFor = (redirectUri: string): RelyingParty => {\n    if (current?.redirectUri !== redirectUri) {\n      current = { redirectUri, auth: relyingParty({ ...config, redirectUri }) };\n    }\n    return current.auth;\n  };\n\n  const handle = async (request: Request): Promise<Response> => {\n    const url = new URL(request.url);\n    const { action, base } = split(url.pathname);\n    const cookie = request.headers.get(\"cookie\");\n    const auth = authFor(config.redirectUri ?? `${url.origin}${base}/callback`);\n\n    if (action !== \"callback\" && action !== \"signin\" && !isSameSite(request)) {\n      return new Response(null, { status: 403, headers: { \"cache-control\": \"no-store\" } });\n    }\n\n    switch (action) {\n      case \"signin\": {\n        try {\n          const started = await auth.begin({\n            returnTo: sameOrigin(url.searchParams.get(\"returnTo\"), url.origin) ?? \"/\",\n            organization: url.searchParams.get(\"organization\") ?? undefined,\n          });\n          return redirect(started.url, started.cookies);\n        } catch (error) {\n          // `organization` arrives from a query parameter and `begin` refuses one that is not an\n          // alias, because a space in it injects scopes. Without this `catch` that refusal is a\n          // 500 on a link somebody typed wrong.\n          return failure(error);\n        }\n      }\n\n      case \"callback\": {\n        try {\n          const done = await auth.complete({ url, cookie });\n          return redirect(done.returnTo, done.cookies);\n        } catch (error) {\n          return failure(error);\n        }\n      }\n\n      case \"signout\": {\n        const returnTo = sameOrigin(url.searchParams.get(\"returnTo\"), url.origin);\n        const ended = await auth.end(cookie, { returnTo });\n        return redirect(ended.url, ended.cookies);\n      }\n\n      case \"session\": {\n        const session = await auth.read(cookie);\n        // 401 and no body at all. `bffAuth` reads this status as \"nobody is signed in\" and stops;\n        // a body would be parsed by something eventually, and an error shape arriving where a\n        // `Session` is expected is the failure `readSession` exists to refuse.\n        if (session === null) {\n          return new Response(null, { status: 401, headers: { \"cache-control\": \"no-store\" } });\n        }\n        return new Response(JSON.stringify(session), { status: 200, headers: PRIVATE });\n      }\n\n      case \"refresh\": {\n        // `POST` only, and it is the one route here that constrains its verb. The others are\n        // reached by navigation, where the verb is the browser's to choose; this one spends a\n        // refresh token, and a `GET` that spends something is a link, a prefetch and a preview\n        // pane away from spending it. The 405 says so rather than answering 404 for a route that\n        // is plainly there.\n        if (request.method !== \"POST\") {\n          return new Response(null, { status: 405, headers: { allow: \"POST\" } });\n        }\n        try {\n          const renewed = await auth.refresh(cookie);\n          const headers = new Headers(PRIVATE);\n          for (const value of renewed.cookies) headers.append(\"set-cookie\", value);\n          return new Response(JSON.stringify(renewed.session), { status: 200, headers });\n        } catch (error) {\n          // A refused refresh is the end of the session, and `failure` already answers 401 for\n          // `session.absent`. `token.exchange-failed` is a 400 and means the same thing to the\n          // browser: there is nothing left to renew, go and sign in.\n          return failure(error);\n        }\n      }\n\n      default:\n        return new Response(null, { status: 404 });\n    }\n  };\n\n  // One handler behind both verbs. Every route here is reached by navigation or by `fetch`, and\n  // which verb a product uses for sign-out — a link or a form — is its choice, not ours to\n  // constrain with a second table that could drift from this one. `refresh` is the exception and\n  // checks its own method, because it is the only one that spends something.\n  return { GET: handle, POST: handle };\n}\n"],"names":["PRIVATE","split","pathname","cut","sameOrigin","candidate","origin","target","redirect","url","cookies","headers","cookie","failure","error","AuthError","authRoutes","config","current","authFor","redirectUri","relyingParty","handle","request","action","base","auth","isSameSite","started","done","returnTo","ended","session","renewed","value"],"mappings":";;;AA4CA,MAAMA,IAAU,EAAE,gBAAgB,oBAAoB,iBAAiB,WAAA;AAqBvE,SAASC,EAAMC,GAAsE;AACnF,QAAMC,IAAMD,EAAS,YAAY,GAAG;AACpC,SAAO,EAAE,QAAQA,EAAS,MAAMC,IAAM,CAAC,GAAG,MAAMA,KAAO,IAAI,KAAKD,EAAS,MAAM,GAAGC,CAAG,EAAA;AACvF;AAYA,SAASC,EAAWC,GAA0BC,GAAoC;AAChF,MAAI,EAAAD,MAAc,QAAQA,EAAU,WAAW;AAC/C,QAAI;AACF,YAAME,IAAS,IAAI,IAAIF,GAAWC,CAAM;AACxC,aAAOC,EAAO,WAAWD,IAASC,EAAO,OAAO;AAAA,IAClD,QAAQ;AACN;AAAA,IACF;AACF;AAUA,SAASC,EAASC,GAAaC,GAAsC;AACnE,QAAMC,IAAU,IAAI,QAAQ,EAAE,UAAUF,GAAK,iBAAiB,YAAY;AAC1E,aAAWG,KAAUF,EAAS,CAAAC,EAAQ,OAAO,cAAcC,CAAM;AACjE,SAAO,IAAI,SAAS,MAAM,EAAE,QAAQ,KAAK,SAAAD,GAAS;AACpD;AAQA,SAASE,EAAQC,GAA0B;AACzC,MAAI,EAAEA,aAAiBC,GAAY,OAAMD;AACzC,SAAO,IAAI,SAAS,KAAK,UAAU,EAAE,OAAOA,EAAM,MAAM,SAASA,EAAM,QAAA,CAAS,GAAG;AAAA,IACjF,QAAQA,EAAM,SAAS,mBAAmB,MAAM;AAAA,IAChD,SAASd;AAAA,EAAA,CACV;AACH;AAEO,SAASgB,EAAWC,GAA6C;AAKtE,MAAIC;AACJ,QAAMC,IAAU,CAACC,QACXF,KAAA,gBAAAA,EAAS,iBAAgBE,MAC3BF,IAAU,EAAE,aAAAE,GAAa,MAAMC,EAAa,EAAE,GAAGJ,GAAQ,aAAAG,EAAA,CAAa,EAAA,IAEjEF,EAAQ,OAGXI,IAAS,OAAOC,MAAwC;AAC5D,UAAMd,IAAM,IAAI,IAAIc,EAAQ,GAAG,GACzB,EAAE,QAAAC,GAAQ,MAAAC,EAAA,IAASxB,EAAMQ,EAAI,QAAQ,GACrCG,IAASW,EAAQ,QAAQ,IAAI,QAAQ,GACrCG,IAAOP,EAAQF,EAAO,eAAe,GAAGR,EAAI,MAAM,GAAGgB,CAAI,WAAW;AAE1E,QAAID,MAAW,cAAcA,MAAW,YAAY,CAACG,EAAWJ,CAAO;AACrE,aAAO,IAAI,SAAS,MAAM,EAAE,QAAQ,KAAK,SAAS,EAAE,iBAAiB,WAAA,GAAc;AAGrF,YAAQC,GAAA;AAAA,MACN,KAAK;AACH,YAAI;AACF,gBAAMI,IAAU,MAAMF,EAAK,MAAM;AAAA,YAC/B,UAAUtB,EAAWK,EAAI,aAAa,IAAI,UAAU,GAAGA,EAAI,MAAM,KAAK;AAAA,YACtE,cAAcA,EAAI,aAAa,IAAI,cAAc,KAAK;AAAA,UAAA,CACvD;AACD,iBAAOD,EAASoB,EAAQ,KAAKA,EAAQ,OAAO;AAAA,QAC9C,SAASd,GAAO;AAId,iBAAOD,EAAQC,CAAK;AAAA,QACtB;AAAA,MAGF,KAAK;AACH,YAAI;AACF,gBAAMe,IAAO,MAAMH,EAAK,SAAS,EAAE,KAAAjB,GAAK,QAAAG,GAAQ;AAChD,iBAAOJ,EAASqB,EAAK,UAAUA,EAAK,OAAO;AAAA,QAC7C,SAASf,GAAO;AACd,iBAAOD,EAAQC,CAAK;AAAA,QACtB;AAAA,MAGF,KAAK,WAAW;AACd,cAAMgB,IAAW1B,EAAWK,EAAI,aAAa,IAAI,UAAU,GAAGA,EAAI,MAAM,GAClEsB,IAAQ,MAAML,EAAK,IAAId,GAAQ,EAAE,UAAAkB,GAAU;AACjD,eAAOtB,EAASuB,EAAM,KAAKA,EAAM,OAAO;AAAA,MAC1C;AAAA,MAEA,KAAK,WAAW;AACd,cAAMC,IAAU,MAAMN,EAAK,KAAKd,CAAM;AAItC,eAAIoB,MAAY,OACP,IAAI,SAAS,MAAM,EAAE,QAAQ,KAAK,SAAS,EAAE,iBAAiB,WAAA,GAAc,IAE9E,IAAI,SAAS,KAAK,UAAUA,CAAO,GAAG,EAAE,QAAQ,KAAK,SAAShC,GAAS;AAAA,MAChF;AAAA,MAEA,KAAK,WAAW;AAMd,YAAIuB,EAAQ,WAAW;AACrB,iBAAO,IAAI,SAAS,MAAM,EAAE,QAAQ,KAAK,SAAS,EAAE,OAAO,OAAA,GAAU;AAEvE,YAAI;AACF,gBAAMU,IAAU,MAAMP,EAAK,QAAQd,CAAM,GACnCD,IAAU,IAAI,QAAQX,CAAO;AACnC,qBAAWkC,KAASD,EAAQ,QAAS,CAAAtB,EAAQ,OAAO,cAAcuB,CAAK;AACvE,iBAAO,IAAI,SAAS,KAAK,UAAUD,EAAQ,OAAO,GAAG,EAAE,QAAQ,KAAK,SAAAtB,GAAS;AAAA,QAC/E,SAASG,GAAO;AAId,iBAAOD,EAAQC,CAAK;AAAA,QACtB;AAAA,MACF;AAAA,MAEA;AACE,eAAO,IAAI,SAAS,MAAM,EAAE,QAAQ,KAAK;AAAA,IAAA;AAAA,EAE/C;AAMA,SAAO,EAAE,KAAKQ,GAAQ,MAAMA,EAAA;AAC9B;"}
+{"version":3,"file":"next-routes.js","sources":["../src/next-routes.ts"],"sourcesContent":["import { isSameSite } from \"./same-site\";\nimport type { AuthSessionConfig } from \"./next-session\";\nimport { relyingParty, type RelyingParty } from \"./server\";\nimport { AuthError, type AuthErrorCode } from \"./types\";\n\n/**\n * The five routes a Backend For Frontend needs, as one App Router catch-all.\n *\n * ```ts\n * // app/api/auth/[...auth]/route.ts\n * export const { GET, POST } = authRoutes({ issuer, clientId, clientSecret, secret });\n * ```\n *\n * `relyingParty` already does the whole flow in strings — a URL and a `Cookie` header in, a URL and\n * `Set-Cookie` values out — so the only thing written here is the translation into `Request` and\n * `Response`, plus the two decisions that translation forces: what a route answers when there is\n * no session, and where it is willing to send a browser afterwards.\n *\n * **Nothing in this module imports `next`.** An App Router route handler is handed a standard\n * `Request` and may answer with a standard `Response`, so the framework's own types would buy\n * nothing and would make this half untestable without it. The door earns its subpath through\n * `next-session.ts` and `next-middleware.ts`, which genuinely cannot be written without `next`.\n *\n * ## The other end of the contract\n *\n * `bffAuth` in the root barrel is the browser half, and it is specific: it `GET`s\n * `${basePath}/session` and reads **401 as \"nobody is signed in\"**, not as a failure; it `POST`s\n * `${basePath}/refresh` when a request of its own comes back 401, and retries that request once if\n * the renewal worked; it navigates to `${basePath}/signin?returnTo=…&organization=…` and\n * `${basePath}/signout?returnTo=…`. Those five paths and those status codes are the contract, and\n * `next-routes.test.ts` drives a real `bffAuth` against these handlers rather than trusting the\n * two descriptions to agree.\n *\n * ## A failure on a navigation is a page, not a body\n *\n * `signin`, `callback` and `signout` are reached by the browser's address bar, so an `AuthError`\n * there answers with a redirect to the product's {@link AuthRoutesConfig.problemPage}, the code in\n * `?code=`, where the product renders it in its own words. `session` and `refresh` are reached by\n * `fetch`, and answer with a status and `{ error, message }`.\n *\n * ## Which routes a cross-site request may reach\n *\n * `callback` and `signin` must be reachable from anywhere — one *is* a navigation from the\n * identity provider, and the other is a link somebody is allowed to put on another page. The other\n * three are not: `signout` reached cross-site is a logout anyone can cause, `refresh` is a\n * rotation anyone can cause, and `session` is a person's identity read from a page that is not\n * ours. `same-site.ts` carries the check and the reason the package rather than the product owes\n * it.\n */\n\n/** The session endpoint answers about a person; no cache may ever hold that answer. */\nconst PRIVATE = { \"content-type\": \"application/json\", \"cache-control\": \"no-store\" } as const;\n\nexport interface AuthRoutesConfig extends AuthSessionConfig {\n  /**\n   * Override the callback URL. Absent, it is derived from the incoming request: the origin it\n   * arrived at, the path this route file sits on, and `/callback`.\n   *\n   * Deriving it trusts the `Host` header, which is chosen by whoever made the request. That is a\n   * bounded trust — a forged host produces a `redirect_uri` Keycloak has not registered, and\n   * Keycloak refuses it — but a deployment behind a proxy that rewrites the host should say the\n   * URL out loud here rather than discover this.\n   */\n  readonly redirectUri?: string;\n  /**\n   * The product's page that renders a failed sign-in, sign-in callback or sign-out, reached as\n   * `?code=<AuthErrorCode>`. Default `/auth/problem`. `authMiddleware` keeps the same default\n   * public: whoever lands here has, by definition, no session.\n   */\n  readonly problemPage?: string;\n}\n\n/** Where a failed navigation is sent; `authMiddleware` holds the same default. */\nconst PROBLEM_PAGE = \"/auth/problem\";\n\nexport interface AuthRouteHandlers {\n  GET(request: Request): Promise<Response>;\n  POST(request: Request): Promise<Response>;\n}\n\n/** The last path segment, and everything before it. `/api/auth/signin` → `signin`, `/api/auth`. */\nfunction split(pathname: string): { readonly action: string; readonly base: string } {\n  const cut = pathname.lastIndexOf(\"/\");\n  return { action: pathname.slice(cut + 1), base: cut <= 0 ? \"\" : pathname.slice(0, cut) };\n}\n\n/**\n * A `returnTo` confined to this origin, or `undefined`.\n *\n * Without this the sign-in route is an open redirect: `?returnTo=https://evil.test` is carried\n * through the whole flow and spent on a browser that has just proved who it is, which is the most\n * valuable moment to hijack. The check is here, where the string arrives from a query parameter,\n * and deliberately *not* repeated on the callback — what comes back out at the callback was\n * sealed into a cookie by us, so re-checking it would only make it unclear which check is the\n * real one.\n */\nfunction sameOrigin(candidate: string | null, origin: string): string | undefined {\n  if (candidate === null || candidate.length === 0) return undefined;\n  try {\n    const target = new URL(candidate, origin);\n    return target.origin === origin ? target.href : undefined;\n  } catch {\n    return undefined; // not a URL at all: dropped like a foreign one, and the sign-in goes to `/`\n  }\n}\n\n/**\n * A redirect that can carry cookies.\n *\n * `Response.redirect()` cannot: its headers are immutable, and a callback that cannot set a cookie\n * is a sign-in that never completes. And `append`, never `set` — the callback answers with **two**\n * `Set-Cookie` values, the session it just issued and the transaction it just spent, and `set`\n * would silently keep only the last of them.\n */\nfunction redirect(url: string, cookies: readonly string[]): Response {\n  const headers = new Headers({ location: url, \"cache-control\": \"no-store\" });\n  for (const cookie of cookies) headers.append(\"set-cookie\", cookie);\n  return new Response(null, { status: 302, headers });\n}\n\n/** The status for a party that did not answer, or `undefined` for a refusal. */\nexport function outage(code: AuthErrorCode): number | undefined {\n  if (code === \"idp/silent\" || code === \"session/silent\") return 504;\n  if (code === \"idp/unreachable\") return 502;\n  if (code === \"session/unavailable\") return 503;\n  return undefined;\n}\n\n/**\n * An `AuthError` as a status and a code a product can route on.\n *\n * Anything else is rethrown: a failure this module has no reading of is Next's to report, and\n * flattening it into a 400 here would hide a misconfiguration behind a message about credentials.\n */\nfunction failure(error: unknown): Response {\n  if (!(error instanceof AuthError)) throw error;\n  return new Response(JSON.stringify({ error: error.code, message: error.message }), {\n    status: outage(error.code) ?? (error.code === \"session/absent\" ? 401 : 400),\n    headers: PRIVATE,\n  });\n}\n\nexport function authRoutes(config: AuthRoutesConfig): AuthRouteHandlers {\n  // One instance, rebuilt only when the callback URL it was built for changes. A `Map` keyed by\n  // origin would grow without bound on a stream of forged `Host` headers; a single slot cannot,\n  // and it self-heals, because the next genuine request derives its own URL again. What it costs\n  // in that case is a re-discovery, which is the right price for a request that lied.\n  let current: { readonly redirectUri: string; readonly auth: RelyingParty } | undefined;\n  const authFor = (redirectUri: string): RelyingParty => {\n    if (current?.redirectUri !== redirectUri) {\n      current = { redirectUri, auth: relyingParty({ ...config, redirectUri }) };\n    }\n    return current.auth;\n  };\n\n  /** An `AuthError` on a navigation, as the product's page; anything else rethrown, as in `failure`. */\n  const problem = (error: unknown, origin: string): Response => {\n    if (!(error instanceof AuthError)) throw error;\n    const page = new URL(config.problemPage ?? PROBLEM_PAGE, origin);\n    page.searchParams.set(\"code\", error.code);\n    return redirect(page.href, []);\n  };\n\n  const handle = async (request: Request): Promise<Response> => {\n    const url = new URL(request.url);\n    const { action, base } = split(url.pathname);\n    const cookie = request.headers.get(\"cookie\");\n    const auth = authFor(config.redirectUri ?? `${url.origin}${base}/callback`);\n\n    if (action !== \"callback\" && action !== \"signin\" && !isSameSite(request)) {\n      return new Response(null, { status: 403, headers: { \"cache-control\": \"no-store\" } });\n    }\n\n    switch (action) {\n      case \"signin\": {\n        try {\n          const started = await auth.begin({\n            returnTo: sameOrigin(url.searchParams.get(\"returnTo\"), url.origin) ?? \"/\",\n            organization: url.searchParams.get(\"organization\") ?? undefined,\n          });\n          return redirect(started.url, started.cookies);\n        } catch (error) {\n          // `organization` arrives from a query parameter and `begin` refuses one that is not an\n          // alias, because a space in it injects scopes; and the IdP may be down. Without this\n          // `catch` either is a 500 on a link.\n          return problem(error, url.origin);\n        }\n      }\n\n      case \"callback\": {\n        try {\n          const done = await auth.complete({ url, cookie });\n          return redirect(done.returnTo, done.cookies);\n        } catch (error) {\n          return problem(error, url.origin);\n        }\n      }\n\n      case \"signout\": {\n        const returnTo = sameOrigin(url.searchParams.get(\"returnTo\"), url.origin);\n        try {\n          const ended = await auth.end(cookie, { returnTo });\n          return redirect(ended.url, ended.cookies);\n        } catch (error) {\n          return problem(error, url.origin);\n        }\n      }\n\n      case \"session\": {\n        let session: Awaited<ReturnType<RelyingParty[\"read\"]>>;\n        try {\n          session = await auth.read(cookie);\n        } catch (error) {\n          return failure(error);\n        }\n        // 401 and no body at all. `bffAuth` reads this status as \"nobody is signed in\" and stops;\n        // a body would be parsed by something eventually, and an error shape arriving where a\n        // `Session` is expected is the failure `readSession` exists to refuse.\n        if (session === null) {\n          return new Response(null, { status: 401, headers: { \"cache-control\": \"no-store\" } });\n        }\n        return new Response(JSON.stringify(session), { status: 200, headers: PRIVATE });\n      }\n\n      case \"refresh\": {\n        // `POST` only, and it is the one route here that constrains its verb. The others are\n        // reached by navigation, where the verb is the browser's to choose; this one spends a\n        // refresh token, and a `GET` that spends something is a link, a prefetch and a preview\n        // pane away from spending it. The 405 says so rather than answering 404 for a route that\n        // is plainly there.\n        if (request.method !== \"POST\") {\n          return new Response(null, { status: 405, headers: { allow: \"POST\" } });\n        }\n        try {\n          const renewed = await auth.refresh(cookie);\n          const headers = new Headers(PRIVATE);\n          for (const value of renewed.cookies) headers.append(\"set-cookie\", value);\n          return new Response(JSON.stringify(renewed.session), { status: 200, headers });\n        } catch (error) {\n          // A refused refresh is the end of the session, and `failure` already answers 401 for\n          // `session/absent`. `token/exchange-failed` is a 400 and means the same thing to the\n          // browser: there is nothing left to renew, go and sign in. An outage is a 5xx, which\n          // `bffAuth` does not read as an ended session.\n          return failure(error);\n        }\n      }\n\n      default:\n        return new Response(null, { status: 404 });\n    }\n  };\n\n  // One handler behind both verbs. Every route here is reached by navigation or by `fetch`, and\n  // which verb a product uses for sign-out — a link or a form — is its choice, not ours to\n  // constrain with a second table that could drift from this one. `refresh` is the exception and\n  // checks its own method, because it is the only one that spends something.\n  return { GET: handle, POST: handle };\n}\n"],"names":["PRIVATE","PROBLEM_PAGE","split","pathname","cut","sameOrigin","candidate","origin","target","redirect","url","cookies","headers","cookie","outage","code","failure","error","AuthError","authRoutes","config","current","authFor","redirectUri","relyingParty","problem","page","handle","request","action","base","auth","isSameSite","started","done","returnTo","ended","session","renewed","value"],"mappings":";;;AAmDA,MAAMA,IAAU,EAAE,gBAAgB,oBAAoB,iBAAiB,WAAA,GAsBjEC,IAAe;AAQrB,SAASC,EAAMC,GAAsE;AACnF,QAAMC,IAAMD,EAAS,YAAY,GAAG;AACpC,SAAO,EAAE,QAAQA,EAAS,MAAMC,IAAM,CAAC,GAAG,MAAMA,KAAO,IAAI,KAAKD,EAAS,MAAM,GAAGC,CAAG,EAAA;AACvF;AAYA,SAASC,EAAWC,GAA0BC,GAAoC;AAChF,MAAI,EAAAD,MAAc,QAAQA,EAAU,WAAW;AAC/C,QAAI;AACF,YAAME,IAAS,IAAI,IAAIF,GAAWC,CAAM;AACxC,aAAOC,EAAO,WAAWD,IAASC,EAAO,OAAO;AAAA,IAClD,QAAQ;AACN;AAAA,IACF;AACF;AAUA,SAASC,EAASC,GAAaC,GAAsC;AACnE,QAAMC,IAAU,IAAI,QAAQ,EAAE,UAAUF,GAAK,iBAAiB,YAAY;AAC1E,aAAWG,KAAUF,EAAS,CAAAC,EAAQ,OAAO,cAAcC,CAAM;AACjE,SAAO,IAAI,SAAS,MAAM,EAAE,QAAQ,KAAK,SAAAD,GAAS;AACpD;AAGO,SAASE,EAAOC,GAAyC;AAC9D,MAAIA,MAAS,gBAAgBA,MAAS,iBAAkB,QAAO;AAC/D,MAAIA,MAAS,kBAAmB,QAAO;AACvC,MAAIA,MAAS,sBAAuB,QAAO;AAE7C;AAQA,SAASC,EAAQC,GAA0B;AACzC,MAAI,EAAEA,aAAiBC,GAAY,OAAMD;AACzC,SAAO,IAAI,SAAS,KAAK,UAAU,EAAE,OAAOA,EAAM,MAAM,SAASA,EAAM,QAAA,CAAS,GAAG;AAAA,IACjF,QAAQH,EAAOG,EAAM,IAAI,MAAMA,EAAM,SAAS,mBAAmB,MAAM;AAAA,IACvE,SAASjB;AAAA,EAAA,CACV;AACH;AAEO,SAASmB,EAAWC,GAA6C;AAKtE,MAAIC;AACJ,QAAMC,IAAU,CAACC,QACXF,KAAA,gBAAAA,EAAS,iBAAgBE,MAC3BF,IAAU,EAAE,aAAAE,GAAa,MAAMC,EAAa,EAAE,GAAGJ,GAAQ,aAAAG,EAAA,CAAa,EAAA,IAEjEF,EAAQ,OAIXI,IAAU,CAACR,GAAgBV,MAA6B;AAC5D,QAAI,EAAEU,aAAiBC,GAAY,OAAMD;AACzC,UAAMS,IAAO,IAAI,IAAIN,EAAO,eAAenB,GAAcM,CAAM;AAC/D,WAAAmB,EAAK,aAAa,IAAI,QAAQT,EAAM,IAAI,GACjCR,EAASiB,EAAK,MAAM,EAAE;AAAA,EAC/B,GAEMC,IAAS,OAAOC,MAAwC;AAC5D,UAAMlB,IAAM,IAAI,IAAIkB,EAAQ,GAAG,GACzB,EAAE,QAAAC,GAAQ,MAAAC,EAAA,IAAS5B,EAAMQ,EAAI,QAAQ,GACrCG,IAASe,EAAQ,QAAQ,IAAI,QAAQ,GACrCG,IAAOT,EAAQF,EAAO,eAAe,GAAGV,EAAI,MAAM,GAAGoB,CAAI,WAAW;AAE1E,QAAID,MAAW,cAAcA,MAAW,YAAY,CAACG,EAAWJ,CAAO;AACrE,aAAO,IAAI,SAAS,MAAM,EAAE,QAAQ,KAAK,SAAS,EAAE,iBAAiB,WAAA,GAAc;AAGrF,YAAQC,GAAA;AAAA,MACN,KAAK;AACH,YAAI;AACF,gBAAMI,IAAU,MAAMF,EAAK,MAAM;AAAA,YAC/B,UAAU1B,EAAWK,EAAI,aAAa,IAAI,UAAU,GAAGA,EAAI,MAAM,KAAK;AAAA,YACtE,cAAcA,EAAI,aAAa,IAAI,cAAc,KAAK;AAAA,UAAA,CACvD;AACD,iBAAOD,EAASwB,EAAQ,KAAKA,EAAQ,OAAO;AAAA,QAC9C,SAAShB,GAAO;AAId,iBAAOQ,EAAQR,GAAOP,EAAI,MAAM;AAAA,QAClC;AAAA,MAGF,KAAK;AACH,YAAI;AACF,gBAAMwB,IAAO,MAAMH,EAAK,SAAS,EAAE,KAAArB,GAAK,QAAAG,GAAQ;AAChD,iBAAOJ,EAASyB,EAAK,UAAUA,EAAK,OAAO;AAAA,QAC7C,SAASjB,GAAO;AACd,iBAAOQ,EAAQR,GAAOP,EAAI,MAAM;AAAA,QAClC;AAAA,MAGF,KAAK,WAAW;AACd,cAAMyB,IAAW9B,EAAWK,EAAI,aAAa,IAAI,UAAU,GAAGA,EAAI,MAAM;AACxE,YAAI;AACF,gBAAM0B,IAAQ,MAAML,EAAK,IAAIlB,GAAQ,EAAE,UAAAsB,GAAU;AACjD,iBAAO1B,EAAS2B,EAAM,KAAKA,EAAM,OAAO;AAAA,QAC1C,SAASnB,GAAO;AACd,iBAAOQ,EAAQR,GAAOP,EAAI,MAAM;AAAA,QAClC;AAAA,MACF;AAAA,MAEA,KAAK,WAAW;AACd,YAAI2B;AACJ,YAAI;AACF,UAAAA,IAAU,MAAMN,EAAK,KAAKlB,CAAM;AAAA,QAClC,SAASI,GAAO;AACd,iBAAOD,EAAQC,CAAK;AAAA,QACtB;AAIA,eAAIoB,MAAY,OACP,IAAI,SAAS,MAAM,EAAE,QAAQ,KAAK,SAAS,EAAE,iBAAiB,WAAA,GAAc,IAE9E,IAAI,SAAS,KAAK,UAAUA,CAAO,GAAG,EAAE,QAAQ,KAAK,SAASrC,GAAS;AAAA,MAChF;AAAA,MAEA,KAAK,WAAW;AAMd,YAAI4B,EAAQ,WAAW;AACrB,iBAAO,IAAI,SAAS,MAAM,EAAE,QAAQ,KAAK,SAAS,EAAE,OAAO,OAAA,GAAU;AAEvE,YAAI;AACF,gBAAMU,IAAU,MAAMP,EAAK,QAAQlB,CAAM,GACnCD,IAAU,IAAI,QAAQZ,CAAO;AACnC,qBAAWuC,KAASD,EAAQ,QAAS,CAAA1B,EAAQ,OAAO,cAAc2B,CAAK;AACvE,iBAAO,IAAI,SAAS,KAAK,UAAUD,EAAQ,OAAO,GAAG,EAAE,QAAQ,KAAK,SAAA1B,GAAS;AAAA,QAC/E,SAASK,GAAO;AAKd,iBAAOD,EAAQC,CAAK;AAAA,QACtB;AAAA,MACF;AAAA,MAEA;AACE,eAAO,IAAI,SAAS,MAAM,EAAE,QAAQ,KAAK;AAAA,IAAA;AAAA,EAE/C;AAMA,SAAO,EAAE,KAAKU,GAAQ,MAAMA,EAAA;AAC9B;"}

package/dist/server.d.ts.map

@@ -1 +1 @@
-{"version":3,"file":"server.d.ts","sourceRoot":"","sources":["../src/server.ts"],"names":[],"mappings":"AAaA,OAAO,EAAU,KAAK,YAAY,EAAE,MAAM,UAAU,CAAC;AAErD,OAAO,EAAsC,KAAK,YAAY,EAAE,MAAM,SAAS,CAAC;AAChF,OAAO,EAAiC,KAAK,OAAO,EAAE,KAAK,aAAa,EAAE,MAAM,SAAS,CAAC;AAyI1F,4FAA4F;AAC5F,MAAM,WAAW,QAAQ;IACvB,QAAQ,CAAC,GAAG,EAAE,MAAM,CAAC;IACrB,QAAQ,CAAC,OAAO,EAAE,SAAS,MAAM,EAAE,CAAC;CACrC;AAED,8BAA8B;AAC9B,MAAM,WAAW,OAAO;IACtB,QAAQ,CAAC,OAAO,EAAE,OAAO,CAAC;IAC1B,QAAQ,CAAC,OAAO,EAAE,SAAS,MAAM,EAAE,CAAC;CACrC;AAED,+GAA+G;AAC/G,MAAM,WAAW,QAAS,SAAQ,OAAO;IACvC,QAAQ,CAAC,QAAQ,EAAE,MAAM,CAAC;CAC3B;AAED;;;;;;;GAOG;AACH,MAAM,WAAW,KAAK;IACpB,QAAQ,CAAC,WAAW,EAAE,MAAM,CAAC;IAC7B,QAAQ,CAAC,OAAO,EAAE,OAAO,CAAC;IAC1B,QAAQ,CAAC,OAAO,EAAE,SAAS,MAAM,EAAE,CAAC;CACrC;AAeD,MAAM,WAAW,kBAAmB,SAAQ,YAAY;IACtD,yEAAyE;IACzE,QAAQ,CAAC,WAAW,EAAE,MAAM,CAAC;IAC7B,sEAAsE;IACtE,QAAQ,CAAC,MAAM,EAAE,MAAM,GAAG,UAAU,CAAC;IACrC,oFAAoF;IACpF,QAAQ,CAAC,KAAK,CAAC,EAAE,MAAM,CAAC;IACxB,4FAA4F;IAC5F,QAAQ,CAAC,KAAK,CAAC,EAAE,YAAY,CAAC;IAC9B,+DAA+D;IAC/D,QAAQ,CAAC,MAAM,CAAC,EAAE,MAAM,CAAC;IACzB,gGAAgG;IAChG,QAAQ,CAAC,qBAAqB,CAAC,EAAE,MAAM,CAAC;CACzC;AAED,MAAM,WAAW,YAAY;IAC3B,kFAAkF;IAClF,KAAK,CAAC,OAAO,CAAC,EAAE,aAAa,GAAG,OAAO,CAAC,QAAQ,CAAC,CAAC;IAClD,+FAA+F;IAC/F,QAAQ,CAAC,OAAO,EAAE;QAAE,QAAQ,CAAC,GAAG,EAAE,MAAM,GAAG,GAAG,CAAC;QAAC,QAAQ,CAAC,MAAM,EAAE,MAAM,GAAG,IAAI,CAAA;KAAE,GAAG,OAAO,CAAC,QAAQ,CAAC,CAAC;IACrG,gGAAgG;IAChG,IAAI,CAAC,MAAM,EAAE,MAAM,GAAG,IAAI,GAAG,SAAS,GAAG,OAAO,CAAC,OAAO,GAAG,IAAI,CAAC,CAAC;IACjE;;;;;;;;;;;;OAYG;IACH,KAAK,CACH,MAAM,EAAE,MAAM,GAAG,IAAI,GAAG,SAAS,EACjC,OAAO,CAAC,EAAE;QAAE,QAAQ,CAAC,WAAW,CAAC,EAAE,MAAM,CAAA;KAAE,GAC1C,OAAO,CAAC,KAAK,GAAG,IAAI,CAAC,CAAC;IACzB;;;;;OAKG;IACH,OAAO,CAAC,MAAM,EAAE,MAAM,GAAG,IAAI,GAAG,SAAS,GAAG,OAAO,CAAC,OAAO,CAAC,CAAC;IAC7D,gGAAgG;IAChG,GAAG,CAAC,MAAM,EAAE,MAAM,GAAG,IAAI,GAAG,SAAS,EAAE,OAAO,CAAC,EAAE;QAAE,QAAQ,CAAC,QAAQ,CAAC,EAAE,MAAM,CAAA;KAAE,GAAG,OAAO,CAAC,QAAQ,CAAC,CAAC;CACrG;AAkBD,wBAAgB,YAAY,CAAC,MAAM,EAAE,kBAAkB,GAAG,YAAY,CAuPrE;AAED,OAAO,EAAE,MAAM,EAAE,aAAa,EAAE,KAAK,MAAM,EAAE,KAAK,YAAY,EAAE,MAAM,UAAU,CAAC;AACjF,OAAO,EAAE,YAAY,EAAE,WAAW,EAAE,KAAK,YAAY,EAAE,KAAK,kBAAkB,EAAE,MAAM,kBAAkB,CAAC;AACzG,OAAO,EACL,cAAc,EACd,WAAW,EACX,KAAK,aAAa,EAClB,KAAK,YAAY,EACjB,KAAK,aAAa,EAClB,KAAK,iBAAiB,GACvB,MAAM,SAAS,CAAC"}
+{"version":3,"file":"server.d.ts","sourceRoot":"","sources":["../src/server.ts"],"names":[],"mappings":"AAcA,OAAO,EAAU,KAAK,YAAY,EAAE,MAAM,UAAU,CAAC;AAErD,OAAO,EAAsC,KAAK,YAAY,EAAE,MAAM,SAAS,CAAC;AAChF,OAAO,EAAiC,KAAK,OAAO,EAAE,KAAK,aAAa,EAAE,MAAM,SAAS,CAAC;AAiL1F,4FAA4F;AAC5F,MAAM,WAAW,QAAQ;IACvB,QAAQ,CAAC,GAAG,EAAE,MAAM,CAAC;IACrB,QAAQ,CAAC,OAAO,EAAE,SAAS,MAAM,EAAE,CAAC;CACrC;AAED,8BAA8B;AAC9B,MAAM,WAAW,OAAO;IACtB,QAAQ,CAAC,OAAO,EAAE,OAAO,CAAC;IAC1B,QAAQ,CAAC,OAAO,EAAE,SAAS,MAAM,EAAE,CAAC;CACrC;AAED,+GAA+G;AAC/G,MAAM,WAAW,QAAS,SAAQ,OAAO;IACvC,QAAQ,CAAC,QAAQ,EAAE,MAAM,CAAC;CAC3B;AAED;;;;;;;GAOG;AACH,MAAM,WAAW,KAAK;IACpB,QAAQ,CAAC,WAAW,EAAE,MAAM,CAAC;IAC7B,QAAQ,CAAC,OAAO,EAAE,OAAO,CAAC;IAC1B,QAAQ,CAAC,OAAO,EAAE,SAAS,MAAM,EAAE,CAAC;CACrC;AAeD,MAAM,WAAW,kBAAmB,SAAQ,YAAY;IACtD,yEAAyE;IACzE,QAAQ,CAAC,WAAW,EAAE,MAAM,CAAC;IAC7B,sEAAsE;IACtE,QAAQ,CAAC,MAAM,EAAE,MAAM,GAAG,UAAU,CAAC;IACrC,oFAAoF;IACpF,QAAQ,CAAC,KAAK,CAAC,EAAE,MAAM,CAAC;IACxB,4FAA4F;IAC5F,QAAQ,CAAC,KAAK,CAAC,EAAE,YAAY,CAAC;IAC9B,+DAA+D;IAC/D,QAAQ,CAAC,MAAM,CAAC,EAAE,MAAM,CAAC;IACzB,gGAAgG;IAChG,QAAQ,CAAC,qBAAqB,CAAC,EAAE,MAAM,CAAC;CACzC;AAED,MAAM,WAAW,YAAY;IAC3B,kFAAkF;IAClF,KAAK,CAAC,OAAO,CAAC,EAAE,aAAa,GAAG,OAAO,CAAC,QAAQ,CAAC,CAAC;IAClD,+FAA+F;IAC/F,QAAQ,CAAC,OAAO,EAAE;QAAE,QAAQ,CAAC,GAAG,EAAE,MAAM,GAAG,GAAG,CAAC;QAAC,QAAQ,CAAC,MAAM,EAAE,MAAM,GAAG,IAAI,CAAA;KAAE,GAAG,OAAO,CAAC,QAAQ,CAAC,CAAC;IACrG,gGAAgG;IAChG,IAAI,CAAC,MAAM,EAAE,MAAM,GAAG,IAAI,GAAG,SAAS,GAAG,OAAO,CAAC,OAAO,GAAG,IAAI,CAAC,CAAC;IACjE;;;;;;;;;;;;OAYG;IACH,KAAK,CACH,MAAM,EAAE,MAAM,GAAG,IAAI,GAAG,SAAS,EACjC,OAAO,CAAC,EAAE;QAAE,QAAQ,CAAC,WAAW,CAAC,EAAE,MAAM,CAAA;KAAE,GAC1C,OAAO,CAAC,KAAK,GAAG,IAAI,CAAC,CAAC;IACzB;;;;;OAKG;IACH,OAAO,CAAC,MAAM,EAAE,MAAM,GAAG,IAAI,GAAG,SAAS,GAAG,OAAO,CAAC,OAAO,CAAC,CAAC;IAC7D,gGAAgG;IAChG,GAAG,CAAC,MAAM,EAAE,MAAM,GAAG,IAAI,GAAG,SAAS,EAAE,OAAO,CAAC,EAAE;QAAE,QAAQ,CAAC,QAAQ,CAAC,EAAE,MAAM,CAAA;KAAE,GAAG,OAAO,CAAC,QAAQ,CAAC,CAAC;CACrG;AAkBD,wBAAgB,YAAY,CAAC,MAAM,EAAE,kBAAkB,GAAG,YAAY,CA0QrE;AAED,OAAO,EAAE,MAAM,EAAE,aAAa,EAAE,KAAK,MAAM,EAAE,KAAK,YAAY,EAAE,MAAM,UAAU,CAAC;AACjF,OAAO,EAAE,YAAY,EAAE,WAAW,EAAE,KAAK,YAAY,EAAE,KAAK,kBAAkB,EAAE,MAAM,kBAAkB,CAAC;AACzG,OAAO,EACL,cAAc,EACd,WAAW,EACX,KAAK,aAAa,EAClB,KAAK,YAAY,EACjB,KAAK,aAAa,EAClB,KAAK,iBAAiB,GACvB,MAAM,SAAS,CAAC"}

package/dist/server.js

@@ -1,182 +1,224 @@
-import { buildEndSessionUrl as p, randomPKCECodeVerifier as E, randomState as x, randomNonce as I, calculatePKCECodeChallenge as b, buildAuthorizationUrl as z, refreshTokenGrant as N, authorizationCodeGrant as O } from "openid-client";
-import { claims as C } from "./claims.js";
-import { sealedCookie as g } from "./cookie-session.js";
-import { cookieValue as B } from "./cookie-session.js";
-import { issuer as S } from "./issuer.js";
-import { rewriteOrigin as q } from "./issuer.js";
-import { keyedSingleFlight as D } from "./single-flight.js";
-import { statelessStore as U } from "./store.js";
-import { ticketStore as te } from "./store.js";
-import { AuthError as v } from "./types.js";
-const A = "openid profile email", L = 480 * 60, R = 600, F = 60;
-function l(n, c, i) {
-  const d = new v(n, c);
-  throw i !== void 0 && (d.cause = i), d;
+import { buildEndSessionUrl as O, randomPKCECodeVerifier as x, randomState as N, randomNonce as S, calculatePKCECodeChallenge as v, buildAuthorizationUrl as z, refreshTokenGrant as C, authorizationCodeGrant as D } from "openid-client";
+import { claims as U } from "./claims.js";
+import { sealedCookie as E } from "./cookie-session.js";
+import { cookieValue as ae } from "./cookie-session.js";
+import { DEADLINE as L } from "./deadline.js";
+import { issuer as R } from "./issuer.js";
+import { rewriteOrigin as se } from "./issuer.js";
+import { keyedSingleFlight as P } from "./single-flight.js";
+import { statelessStore as F } from "./store.js";
+import { ticketStore as ce } from "./store.js";
+import { AuthError as m } from "./types.js";
+const I = "openid profile email", M = 480 * 60, G = 600, H = 60;
+function h(n, s, a) {
+  throw new m(n, s, {}, a === void 0 ? void 0 : { cause: a });
 }
 function y(n) {
   if (typeof n != "object" || n === null || !("code" in n)) return;
-  const c = n.code;
-  return typeof c == "string" ? c : void 0;
+  const s = n.code;
+  return typeof s == "string" ? s : void 0;
 }
-function _(n) {
-  const c = y(n);
-  if (c === "OAUTH_JWT_CLAIM_COMPARISON_FAILED") {
-    let i = n;
-    for (let d = 0; d < 4 && typeof i == "object" && i !== null; d++) {
-      if (i.claim === "nonce") return !0;
-      i = i.cause;
+function b(n) {
+  const s = y(n);
+  if (s === "OAUTH_JWT_CLAIM_COMPARISON_FAILED") {
+    let a = n;
+    for (let l = 0; l < 4 && typeof a == "object" && a !== null; l++) {
+      if (a.claim === "nonce") return !0;
+      a = a.cause;
     }
     return !1;
   }
-  return c === "OAUTH_INVALID_RESPONSE" && n instanceof Error && n.cause instanceof Error && n.cause.message.includes('"nonce"');
+  return s === "OAUTH_INVALID_RESPONSE" && n instanceof Error && n.cause instanceof Error && n.cause.message.includes('"nonce"');
 }
-function P(n) {
+function Z(n) {
   return y(n) === "OAUTH_KEY_SELECTION_FAILED";
 }
-const G = /^(\*|[A-Za-z0-9](?:[A-Za-z0-9._-]{0,62}[A-Za-z0-9])?)$/, M = D();
-function X(n) {
-  const c = S(n), i = n.store ?? U(), d = g({
+function K(n) {
+  const s = y(n);
+  if (s === "OAUTH_TIMEOUT") return "idp/silent";
+  if (s === "OAUTH_RESPONSE_IS_NOT_CONFORM" || n instanceof TypeError && s === void 0) return "idp/unreachable";
+}
+const V = /^(\*|[A-Za-z0-9](?:[A-Za-z0-9._-]{0,62}[A-Za-z0-9])?)$/, W = P();
+function $(n) {
+  const s = (a) => h("session/unavailable", "the session store did not answer", a);
+  return {
+    async put(a) {
+      try {
+        return await n.put(a);
+      } catch (l) {
+        return s(l);
+      }
+    },
+    async get(a) {
+      try {
+        return await n.get(a);
+      } catch (l) {
+        return s(l);
+      }
+    },
+    async drop(a) {
+      try {
+        await n.drop(a);
+      } catch (l) {
+        s(l);
+      }
+    }
+  };
+}
+function te(n) {
+  const s = R(n), a = $(n.store ?? F()), l = L, k = (t, e, o) => {
+    const r = K(t) ?? e;
+    return new m(r, o, r === "idp/silent" ? { after: l } : {}, { cause: t });
+  }, w = async () => {
+    try {
+      return await s.configuration();
+    } catch (t) {
+      throw k(t, "idp/unreachable", "the IdP's discovery document could not be read");
+    }
+  }, f = E({
     name: "kanzo-session",
     secret: n.secret,
-    maxAge: n.maxAge ?? L
-  }), k = g({
+    maxAge: n.maxAge ?? M
+  }), T = E({
     name: "kanzo-auth",
     secret: n.secret,
-    maxAge: R
-  }), m = async (t) => {
-    const e = await d.read(t);
-    return e === null ? null : i.get(e.ticket);
-  }, w = async (t, e) => {
-    const o = t.claims(), a = o === void 0 ? e == null ? void 0 : e.session : C(o, n);
-    a === void 0 && l("token.exchange-failed", "the token response carried no ID token, so it names nobody");
-    const s = t.expiresIn(), r = {
-      session: a,
+    maxAge: G
+  }), A = async (t) => {
+    const e = await f.read(t);
+    return e === null ? null : a.get(e.ticket);
+  }, _ = async (t, e) => {
+    const o = t.claims(), r = o === void 0 ? e == null ? void 0 : e.session : U(o, n);
+    r === void 0 && h("token/exchange-failed", "the token response carried no ID token, so it names nobody");
+    const i = t.expiresIn(), c = {
+      session: r,
       accessToken: t.access_token,
-      accessTokenExpiresAt: s === void 0 ? void 0 : Date.now() + s * 1e3,
+      accessTokenExpiresAt: i === void 0 ? void 0 : Date.now() + i * 1e3,
       // RFC 10017 requires rotation, so the newly issued token is the only one still valid. An
       // authorization server that did not rotate returns none, and the one we hold stays good.
       refreshToken: t.refresh_token ?? (e == null ? void 0 : e.refreshToken),
       idToken: t.id_token ?? (e == null ? void 0 : e.idToken)
-    }, f = await i.put(r);
-    return { renewed: { session: a, cookies: [await d.seal({ ticket: f })] }, record: r };
-  }, T = async (t) => {
-    const e = await d.read(t), o = e === null ? null : await i.get(e.ticket);
-    (e === null || o === null) && l("session.absent", "there is no session cookie to refresh");
-    const a = o.refreshToken;
-    return a === void 0 && l("session.absent", "the session holds no refresh token, so it cannot be renewed"), M(e.ticket, async () => {
-      let s;
+    }, u = await a.put(c);
+    return { renewed: { session: r, cookies: [await f.seal({ ticket: u })] }, record: c };
+  }, g = async (t) => {
+    const e = await f.read(t), o = e === null ? null : await a.get(e.ticket);
+    (e === null || o === null) && h("session/absent", "there is no session cookie to refresh");
+    const r = o.refreshToken;
+    return r === void 0 && h("session/absent", "the session holds no refresh token, so it cannot be renewed"), W(e.ticket, async () => {
+      let i;
       try {
-        s = await N(await c.configuration(), a);
-      } catch (r) {
-        l("token.exchange-failed", "the refresh token was refused", r);
+        i = await C(await w(), r);
+      } catch (c) {
+        throw c instanceof m ? c : k(c, "token/exchange-failed", "the refresh token was refused");
       }
-      return await i.drop(e.ticket), w(s, o);
+      return await a.drop(e.ticket), _(i, o);
     });
   };
   return {
     async begin(t = {}) {
-      const e = await c.configuration(), o = E(), a = x(), s = I();
-      t.organization !== void 0 && !G.test(t.organization) && l(
-        "organization.invalid",
+      const e = await w(), o = x(), r = N(), i = S();
+      t.organization !== void 0 && !V.test(t.organization) && h(
+        "organization/invalid",
         `\`${t.organization}\` is not an organization alias, and a scope is a space-delimited list: see ORGANIZATION`
       );
-      const r = {
+      const c = {
         redirect_uri: n.redirectUri,
         // `organization:<alias>` asks Keycloak for one; a product with many asks for
         // `organization:*` through `scope`, because plain `organization` prompts for a choice.
-        scope: t.organization === void 0 ? n.scope ?? A : `${n.scope ?? A} organization:${t.organization}`,
-        code_challenge: await b(o),
+        scope: t.organization === void 0 ? n.scope ?? I : `${n.scope ?? I} organization:${t.organization}`,
+        code_challenge: await v(o),
         code_challenge_method: "S256",
-        state: a,
-        nonce: s
+        state: r,
+        nonce: i
       };
       return {
-        url: z(e, r).href,
+        url: z(e, c).href,
         cookies: [
-          await k.seal({ state: a, nonce: s, verifier: o, returnTo: t.returnTo ?? "/" })
+          await T.seal({ state: r, nonce: i, verifier: o, returnTo: t.returnTo ?? "/" })
         ]
       };
     },
     async complete(t) {
-      const e = await k.read(t.cookie);
-      e === null && l(
-        "callback.state-mismatch",
+      const e = await T.read(t.cookie);
+      e === null && h(
+        "callback/state-mismatch",
         "the callback arrived with no transaction cookie, so there is nothing to match its `state` against"
       );
       const o = new URL(t.url);
-      o.searchParams.get("state") !== e.state && l(
-        "callback.state-mismatch",
+      o.searchParams.get("state") !== e.state && h(
+        "callback/state-mismatch",
         "the callback's `state` is not the one this browser was sent with"
       );
-      const a = {
+      const r = {
         pkceCodeVerifier: e.verifier,
         expectedState: e.state,
         expectedNonce: e.nonce
-      }, s = (h) => O(h, o, a);
-      let r;
+      }, i = (d) => D(d, o, r);
+      let c;
       try {
-        r = await s(await c.configuration());
-      } catch (h) {
-        _(h) && l(
-          "callback.nonce-mismatch",
+        c = await i(await w());
+      } catch (d) {
+        if (d instanceof m) throw d;
+        if (b(d) && h(
+          "callback/nonce-mismatch",
           "the ID token's `nonce` is not the one this transaction sent",
-          h
-        ), P(h) || l("token.exchange-failed", "the authorization code could not be exchanged", h);
+          d
+        ), !Z(d))
+          throw k(d, "token/exchange-failed", "the authorization code could not be exchanged");
         try {
-          r = await s(await c.rediscover());
-        } catch (u) {
-          _(u) && l(
-            "callback.nonce-mismatch",
+          c = await i(await s.rediscover());
+        } catch (p) {
+          throw b(p) && h(
+            "callback/nonce-mismatch",
             "the ID token's `nonce` is not the one this transaction sent",
-            u
-          ), l(
-            "token.exchange-failed",
-            "the ID token did not verify, and did not verify against freshly discovered keys either",
-            u
+            p
+          ), k(
+            p,
+            "token/exchange-failed",
+            "the ID token did not verify, and did not verify against freshly discovered keys either"
           );
         }
       }
-      const { renewed: f } = await w(r, null);
+      const { renewed: u } = await _(c, null);
       return {
-        ...f,
-        cookies: [...f.cookies, k.clear()],
+        ...u,
+        cookies: [...u.cookies, T.clear()],
         returnTo: e.returnTo
       };
     },
     async read(t) {
       var e;
-      return ((e = await m(t)) == null ? void 0 : e.session) ?? null;
+      return ((e = await A(t)) == null ? void 0 : e.session) ?? null;
     },
     async token(t, e = {}) {
-      const o = await m(t);
+      const o = await A(t);
       if (o === null) return null;
-      const a = (e.renewWithin ?? F) * 1e3, s = o.accessToken, r = o.accessTokenExpiresAt !== void 0 && o.accessTokenExpiresAt - Date.now() <= a;
-      if (s !== void 0 && !r)
-        return { accessToken: s, session: o.session, cookies: [] };
-      const { renewed: f, record: h } = await T(t);
-      return h.accessToken === void 0 && l("token.exchange-failed", "the token response carried no access token"), { accessToken: h.accessToken, session: f.session, cookies: f.cookies };
+      const r = (e.renewWithin ?? H) * 1e3, i = o.accessToken, c = o.accessTokenExpiresAt !== void 0 && o.accessTokenExpiresAt - Date.now() <= r;
+      if (i !== void 0 && !c)
+        return { accessToken: i, session: o.session, cookies: [] };
+      const { renewed: u, record: d } = await g(t);
+      return d.accessToken === void 0 && h("token/exchange-failed", "the token response carried no access token"), { accessToken: d.accessToken, session: u.session, cookies: u.cookies };
     },
     async refresh(t) {
-      return (await T(t)).renewed;
+      return (await g(t)).renewed;
     },
     async end(t, e = {}) {
-      const o = await d.read(t), a = o === null ? null : await i.get(o.ticket);
-      o !== null && await i.drop(o.ticket);
-      const s = {}, r = e.returnTo ?? n.postLogoutRedirectUri;
-      return r !== void 0 && (s.post_logout_redirect_uri = r), (a == null ? void 0 : a.idToken) !== void 0 && (s.id_token_hint = a.idToken), {
-        url: p(await c.configuration(), s).href,
-        cookies: [d.clear()]
+      const o = await f.read(t), r = o === null ? null : await a.get(o.ticket);
+      o !== null && await a.drop(o.ticket);
+      const i = {}, c = e.returnTo ?? n.postLogoutRedirectUri;
+      return c !== void 0 && (i.post_logout_redirect_uri = c), (r == null ? void 0 : r.idToken) !== void 0 && (i.id_token_hint = r.idToken), {
+        url: O(await w(), i).href,
+        cookies: [f.clear()]
       };
     }
   };
 }
 export {
-  B as cookieValue,
-  S as issuer,
-  X as relyingParty,
-  q as rewriteOrigin,
-  g as sealedCookie,
-  U as statelessStore,
-  te as ticketStore
+  ae as cookieValue,
+  R as issuer,
+  te as relyingParty,
+  se as rewriteOrigin,
+  E as sealedCookie,
+  F as statelessStore,
+  ce as ticketStore
 };
 //# sourceMappingURL=server.js.map