@kanzo-tech/auth 0.29.1 → 0.30.0

package/dist/index.d.ts.map

@@ -1 +1 @@
-{"version":3,"file":"index.d.ts","sourceRoot":"","sources":["../src/index.ts"],"names":[],"mappings":"AAAA;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;GAkDG;AAEH,OAAO,EAAE,UAAU,EAAE,KAAK,WAAW,EAAE,MAAM,WAAW,CAAC;AACzD,OAAO,EAAE,SAAS,EAAE,KAAK,WAAW,EAAE,MAAM,cAAc,CAAC;AAC3D,YAAY,EAAE,gBAAgB,EAAE,UAAU,EAAE,MAAM,gBAAgB,CAAC;AACnE,OAAO,EAAE,YAAY,EAAE,MAAM,iBAAiB,CAAC;AAC/C,OAAO,EAAE,OAAO,EAAE,WAAW,EAAE,KAAK,aAAa,EAAE,MAAM,YAAY,CAAC;AACtE,OAAO,EAAE,GAAG,EAAE,cAAc,EAAE,MAAM,OAAO,CAAC;AAC5C,OAAO,EAAE,MAAM,EAAE,KAAK,YAAY,EAAE,MAAM,UAAU,CAAC;AACrD,OAAO,EAAE,IAAI,EAAE,MAAM,QAAQ,CAAC;AAC9B,OAAO,EAAE,oBAAoB,EAAE,MAAM,QAAQ,CAAC;AAC9C,OAAO,EAAE,YAAY,EAAE,MAAM,iBAAiB,CAAC;AAC/C,OAAO,EACL,SAAS,EACT,KAAK,IAAI,EACT,KAAK,aAAa,EAClB,KAAK,QAAQ,EACb,KAAK,YAAY,EACjB,KAAK,OAAO,EACZ,KAAK,aAAa,GACnB,MAAM,SAAS,CAAC;AACjB,OAAO,EAAE,eAAe,EAAE,MAAM,oBAAoB,CAAC;AACrD,OAAO,EAAE,UAAU,EAAE,MAAM,eAAe,CAAC"}
+{"version":3,"file":"index.d.ts","sourceRoot":"","sources":["../src/index.ts"],"names":[],"mappings":"AAAA;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;GA6CG;AAEH,OAAO,EAAE,UAAU,EAAE,KAAK,WAAW,EAAE,MAAM,WAAW,CAAC;AACzD,YAAY,EAAE,gBAAgB,EAAE,UAAU,EAAE,MAAM,gBAAgB,CAAC;AACnE,OAAO,EAAE,YAAY,EAAE,MAAM,iBAAiB,CAAC;AAC/C,OAAO,EAAE,OAAO,EAAE,WAAW,EAAE,KAAK,aAAa,EAAE,MAAM,YAAY,CAAC;AACtE,OAAO,EAAE,GAAG,EAAE,cAAc,EAAE,MAAM,OAAO,CAAC;AAC5C,OAAO,EAAE,MAAM,EAAE,KAAK,YAAY,EAAE,MAAM,UAAU,CAAC;AACrD,OAAO,EAAE,IAAI,EAAE,MAAM,QAAQ,CAAC;AAC9B,OAAO,EAAE,YAAY,EAAE,MAAM,iBAAiB,CAAC;AAC/C,OAAO,EACL,SAAS,EACT,KAAK,IAAI,EACT,KAAK,aAAa,EAClB,KAAK,QAAQ,EACb,KAAK,YAAY,EACjB,KAAK,OAAO,EACZ,KAAK,aAAa,GACnB,MAAM,SAAS,CAAC;AACjB,OAAO,EAAE,UAAU,EAAE,MAAM,eAAe,CAAC"}

package/dist/index.js

@@ -1,29 +1,23 @@
-import { accountUrl as t } from "./account.js";
-import { authFetch as f } from "./auth-fetch.js";
-import { AuthProvider as a } from "./auth-provider.js";
+import { accountUrl as e } from "./account.js";
+import { AuthProvider as f } from "./auth-provider.js";
 import { bffAuth as p, readSession as x } from "./bff-auth.js";
-import { can as s, organizationOf as u } from "./can.js";
-import { claims as c } from "./claims.js";
-import { Gate as l } from "./gate.js";
-import { organizationFromHost as A } from "./host.js";
-import { singleFlight as d } from "./single-flight.js";
-import { AuthError as S } from "./types.js";
-import { useOrganization as v } from "./use-organization.js";
-import { useSession as G } from "./use-session.js";
+import { can as a, organizationOf as n } from "./can.js";
+import { claims as u } from "./claims.js";
+import { Gate as h } from "./gate.js";
+import { singleFlight as g } from "./single-flight.js";
+import { AuthError as d } from "./types.js";
+import { useSession as b } from "./use-session.js";
 export {
-  S as AuthError,
-  a as AuthProvider,
-  l as Gate,
-  t as accountUrl,
-  f as authFetch,
+  d as AuthError,
+  f as AuthProvider,
+  h as Gate,
+  e as accountUrl,
   p as bffAuth,
-  s as can,
-  c as claims,
-  A as organizationFromHost,
-  u as organizationOf,
+  a as can,
+  u as claims,
+  n as organizationOf,
   x as readSession,
-  d as singleFlight,
-  v as useOrganization,
-  G as useSession
+  g as singleFlight,
+  b as useSession
 };
 //# sourceMappingURL=index.js.map

package/dist/index.js.map

@@ -1 +1 @@
-{"version":3,"file":"index.js","sources":[],"sourcesContent":[],"names":[],"mappings":";;;;;;;;;;;;"}
+{"version":3,"file":"index.js","sources":[],"sourcesContent":[],"names":[],"mappings":";;;;;;;;;"}

package/dist/issuer.d.ts

@@ -1,4 +1,5 @@
 import { Configuration, CryptoKey, CustomFetch, PrivateKey } from 'openid-client';
+import { JWTVerifyGetKey } from 'jose';
 /**
  * Discovery and client configuration for the confidential client behind `./server`.
  *
@@ -77,7 +78,22 @@ export interface Issuer {
      * still stale at the moment something is.
      */
     rediscover(): Promise<Configuration>;
+    /**
+     * The realm's signing keys, for verifying a token this client did not fetch itself — a
+     * back-channel logout token, which Keycloak posts to us rather than handing over a channel we
+     * opened.
+     *
+     * `jose`'s remote key set over the discovered `jwks_uri`, reached through the same transport as
+     * discovery, so an `internalOrigin` applies to it too. It re-fetches on a key id it has not seen,
+     * at most once per cooldown, which is the same reactive answer to rotation as {@link rediscover}.
+     */
+    keys(): Promise<JWTVerifyGetKey>;
 }
+/**
+ * `path` without its trailing slashes, in one pass. A regex like `/\/+$/` backtracks on a long
+ * run of slashes, and these strings come from configuration a library does not control.
+ */
+export declare function withoutTrailingSlashes(path: string): string;
 /**
  * A `fetch` that replaces one origin with another before sending.
  *

package/dist/issuer.d.ts.map

@@ -1 +1 @@
-{"version":3,"file":"issuer.d.ts","sourceRoot":"","sources":["../src/issuer.ts"],"names":[],"mappings":"AAAA,OAAO,EAQL,KAAK,aAAa,EAClB,KAAK,SAAS,EACd,KAAK,WAAW,EAEhB,KAAK,UAAU,EAChB,MAAM,eAAe,CAAC;AAIvB;;;;;;;;;;;;;;;GAeG;AAEH,MAAM,WAAW,YAAY;IAC3B,oGAAoG;IACpG,QAAQ,CAAC,MAAM,EAAE,MAAM,CAAC;IACxB,QAAQ,CAAC,QAAQ,EAAE,MAAM,CAAC;IAC1B,yFAAyF;IACzF,QAAQ,CAAC,YAAY,CAAC,EAAE,MAAM,CAAC;IAC/B;;;OAGG;IACH,QAAQ,CAAC,UAAU,CAAC,EAAE,SAAS,GAAG,UAAU,CAAC;IAC7C;;;OAGG;IACH,QAAQ,CAAC,cAAc,CAAC,EAAE,MAAM,CAAC;IACjC,iGAAiG;IACjG,QAAQ,CAAC,KAAK,CAAC,EAAE,OAAO,UAAU,CAAC,KAAK,CAAC;IACzC;;;;OAIG;IACH,QAAQ,CAAC,iBAAiB,CAAC,EAAE,OAAO,CAAC;IACrC;;;;;;;;;;;;;;;;;OAiBG;IACH,QAAQ,CAAC,gBAAgB,CAAC,EAAE,OAAO,CAAC;CACrC;AAED;;;;;;GAMG;AACH,MAAM,WAAW,MAAM;IACrB,qGAAqG;IACrG,aAAa,IAAI,OAAO,CAAC,aAAa,CAAC,CAAC;IACxC;;;;;;OAMG;IACH,UAAU,IAAI,OAAO,CAAC,aAAa,CAAC,CAAC;CACtC;AAED;;;;;;GAMG;AACH,wBAAgB,aAAa,CAC3B,IAAI,EAAE,MAAM,EACZ,EAAE,EAAE,MAAM,EACV,IAAI,GAAE,OAAO,UAAU,CAAC,KAAwB,GAC/C,WAAW,CAQb;AAED,wBAAgB,MAAM,CAAC,MAAM,EAAE,YAAY,GAAG,MAAM,CAuDnD"}
+{"version":3,"file":"issuer.d.ts","sourceRoot":"","sources":["../src/issuer.ts"],"names":[],"mappings":"AAAA,OAAO,EAQL,KAAK,aAAa,EAClB,KAAK,SAAS,EACd,KAAK,WAAW,EAEhB,KAAK,UAAU,EAChB,MAAM,eAAe,CAAC;AACvB,OAAO,EAAgD,KAAK,eAAe,EAAE,MAAM,MAAM,CAAC;AAI1F;;;;;;;;;;;;;;;GAeG;AAEH,MAAM,WAAW,YAAY;IAC3B,oGAAoG;IACpG,QAAQ,CAAC,MAAM,EAAE,MAAM,CAAC;IACxB,QAAQ,CAAC,QAAQ,EAAE,MAAM,CAAC;IAC1B,yFAAyF;IACzF,QAAQ,CAAC,YAAY,CAAC,EAAE,MAAM,CAAC;IAC/B;;;OAGG;IACH,QAAQ,CAAC,UAAU,CAAC,EAAE,SAAS,GAAG,UAAU,CAAC;IAC7C;;;OAGG;IACH,QAAQ,CAAC,cAAc,CAAC,EAAE,MAAM,CAAC;IACjC,iGAAiG;IACjG,QAAQ,CAAC,KAAK,CAAC,EAAE,OAAO,UAAU,CAAC,KAAK,CAAC;IACzC;;;;OAIG;IACH,QAAQ,CAAC,iBAAiB,CAAC,EAAE,OAAO,CAAC;IACrC;;;;;;;;;;;;;;;;;OAiBG;IACH,QAAQ,CAAC,gBAAgB,CAAC,EAAE,OAAO,CAAC;CACrC;AAED;;;;;;GAMG;AACH,MAAM,WAAW,MAAM;IACrB,qGAAqG;IACrG,aAAa,IAAI,OAAO,CAAC,aAAa,CAAC,CAAC;IACxC;;;;;;OAMG;IACH,UAAU,IAAI,OAAO,CAAC,aAAa,CAAC,CAAC;IACrC;;;;;;;;OAQG;IACH,IAAI,IAAI,OAAO,CAAC,eAAe,CAAC,CAAC;CAClC;AAED;;;GAGG;AACH,wBAAgB,sBAAsB,CAAC,IAAI,EAAE,MAAM,GAAG,MAAM,CAI3D;AAED;;;;;;GAMG;AACH,wBAAgB,aAAa,CAC3B,IAAI,EAAE,MAAM,EACZ,EAAE,EAAE,MAAM,EACV,IAAI,GAAE,OAAO,UAAU,CAAC,KAAwB,GAC/C,WAAW,CAQb;AAED,wBAAgB,MAAM,CAAC,MAAM,EAAE,YAAY,GAAG,MAAM,CAuEnD"}

package/dist/issuer.js

@@ -1,42 +1,60 @@
-import { customFetch as v, allowInsecureRequests as d, enableNonRepudiationChecks as m, PrivateKeyJwt as w, ClientSecretPost as y, discovery as R } from "openid-client";
-import { singleFlight as S } from "./single-flight.js";
-import { DEADLINE as b } from "./deadline.js";
-function I(e, s, o = globalThis.fetch) {
-  const t = new URL(e).origin, n = s.replace(/\/+$/, "");
-  return (r, c) => o(
-    r.startsWith(t) ? `${n}${r.slice(t.length)}` : r,
-    c
+import { allowInsecureRequests as y, enableNonRepudiationChecks as R, PrivateKeyJwt as S, ClientSecretPost as f, discovery as I, customFetch as L } from "openid-client";
+import { createRemoteJWKSet as T, customFetch as b } from "jose";
+import { singleFlight as g } from "./single-flight.js";
+import { DEADLINE as m } from "./deadline.js";
+function F(e) {
+  let t = e.length;
+  for (; t > 0 && e[t - 1] === "/"; ) t--;
+  return e.slice(0, t);
+}
+function K(e, t, a = globalThis.fetch) {
+  const n = new URL(e).origin, o = F(t);
+  return (s, u) => a(
+    s.startsWith(n) ? `${o}${s.slice(n.length)}` : s,
+    u
   );
 }
-function K(e) {
-  const s = new URL(e.issuer), o = e.fetch ?? ((i, p) => globalThis.fetch(i, p)), t = e.internalOrigin ?? s.origin, n = {
-    [v]: I(e.issuer, t, o),
-    timeout: b / 1e3
-  }, r = new URL(t).protocol === "https:", c = [
-    ...e.allowInsecureHttp === !0 ? [d] : [],
-    ...e.verifySignatures ?? !r ? [m] : []
+function D(e) {
+  const t = new URL(e.issuer), a = e.fetch ?? ((r, h) => globalThis.fetch(r, h)), n = e.internalOrigin ?? t.origin, o = K(e.issuer, n, a), s = {
+    [L]: o,
+    timeout: m / 1e3
+  }, u = new URL(n).protocol === "https:", d = [
+    ...e.allowInsecureHttp === !0 ? [y] : [],
+    ...e.verifySignatures ?? !u ? [R] : []
   ];
-  c.length > 0 && (n.execute = c);
-  const u = e.privateKey !== void 0 ? w(e.privateKey) : y(e.clientSecret), h = e.clientSecret !== void 0 ? { client_secret: e.clientSecret } : {};
-  let a;
-  const l = S(async () => {
-    const i = await R(s, e.clientId, h, u, n);
-    return a = i, i;
+  d.length > 0 && (s.execute = d);
+  const w = e.privateKey !== void 0 ? S(e.privateKey) : f(e.clientSecret), v = e.clientSecret !== void 0 ? { client_secret: e.clientSecret } : {};
+  let c, i;
+  const l = g(async () => {
+    const r = await I(t, e.clientId, v, w, s);
+    return c = r, r;
   });
   return {
     async configuration() {
-      return a ?? l();
+      return c ?? l();
     },
     // A `rediscover()` that lands while a discovery is already running joins that one rather than
     // starting a newer one. It is the narrow price of single-flight, and it is bounded: the call
     // it joins is at most one request old, and a second failure rediscovers again.
     async rediscover() {
-      return a = void 0, l();
+      return c = void 0, l();
+    },
+    async keys() {
+      const r = (c ?? await l()).serverMetadata().jwks_uri;
+      if (r === void 0) throw new TypeError("the IdP's discovery document names no `jwks_uri`");
+      return (i == null ? void 0 : i.uri) !== r && (i = {
+        uri: r,
+        set: T(new URL(r), {
+          [b]: (h, p) => o(h, p),
+          timeoutDuration: m
+        })
+      }), i.set;
     }
   };
 }
 export {
-  K as issuer,
-  I as rewriteOrigin
+  D as issuer,
+  K as rewriteOrigin,
+  F as withoutTrailingSlashes
 };
 //# sourceMappingURL=issuer.js.map

package/dist/issuer.js.map

@@ -1 +1 @@
-{"version":3,"file":"issuer.js","sources":["../src/issuer.ts"],"sourcesContent":["import {\n  ClientSecretPost,\n  PrivateKeyJwt,\n  allowInsecureRequests,\n  customFetch,\n  enableNonRepudiationChecks,\n  discovery,\n  type ClientMetadata,\n  type Configuration,\n  type CryptoKey,\n  type CustomFetch,\n  type DiscoveryRequestOptions,\n  type PrivateKey,\n} from \"openid-client\";\nimport { singleFlight } from \"./single-flight\";\nimport { DEADLINE } from \"./deadline\";\n\n/**\n * Discovery and client configuration for the confidential client behind `./server`.\n *\n * Two things live here that a plain `discovery()` call does not give you, and both come from\n * running this against Keycloak in anger:\n *\n * 1. **The issuer's origin can be rewritten for server→Keycloak traffic.** The browser must be\n *    sent to the public issuer, and the server usually cannot reach it — in a cluster it reaches\n *    `http://keycloak:8080`. Rewriting the *transport* rather than the issuer keeps the two\n *    truthful at once: discovery still validates the `issuer` in the document against the public\n *    URL, because that is what Keycloak puts there.\n * 2. **Discovery is allowed to fail.** Keycloak is frequently not up when the application is, and\n *    a library that hides a retry loop inside itself takes that decision away from the caller. A\n *    failed discovery is simply not cached, so the *next* call tries again — the retry is the\n *    caller's `await`, on the caller's schedule.\n */\n\nexport interface IssuerConfig {\n  /** The **public** issuer URL, exactly as Keycloak reports it: `https://id.example/realms/kanzo`. */\n  readonly issuer: string;\n  readonly clientId: string;\n  /** Client secret authentication. Used when {@link IssuerConfig.privateKey} is absent. */\n  readonly clientSecret?: string;\n  /**\n   * `private_key_jwt`, which is the stronger of the two: the secret never travels. Preferred\n   * wherever the deployment can hold a key, and it wins over `clientSecret` when both are given.\n   */\n  readonly privateKey?: CryptoKey | PrivateKey;\n  /**\n   * Where *this process* reaches Keycloak, when that is not where the browser reaches it —\n   * `http://keycloak:8080`. Only the origin is replaced; the path is the issuer's own.\n   */\n  readonly internalOrigin?: string;\n  /** Injectable for tests, and the seam the origin rewrite is built on. Defaults to the global. */\n  readonly fetch?: typeof globalThis.fetch;\n  /**\n   * Allow a plain-HTTP issuer. A compose file on a laptop serves `http://localhost:8080`, and\n   * without this nothing local can be configured at all. It is not needed for an HTTP\n   * {@link IssuerConfig.internalOrigin}: the rewrite happens below the protocol check.\n   */\n  readonly allowInsecureHttp?: boolean;\n  /**\n   * Verify the ID token's signature, and not only its claims.\n   *\n   * **Defaults to whether the token endpoint is actually reached over TLS**, rather than to a flat\n   * `false`. The specification lets a code grant skip this — an ID token arriving over a TLS\n   * connection to the token endpoint, from a request authenticated as this client, is vouched for\n   * by the channel (OpenID Connect Core §3.1.3.7 step 6) — and `openid-client` leaves it off for\n   * that reason, which is why a sign-in fetches no JWKS at all.\n   *\n   * But the exemption is a claim *about the channel*, and an {@link IssuerConfig.internalOrigin} of\n   * `http://keycloak:8080` withdraws it: the hop TLS was supposed to protect is plaintext inside\n   * the cluster, so nothing is vouching for anything. Inheriting the reference's default there\n   * would be inheriting its conclusion without its premise. So the default is derived from the\n   * effective origin's protocol, and it can still be set explicitly either way.\n   *\n   * On, it costs one JWKS fetch, cached — and it is what makes {@link Issuer.rediscover} reachable\n   * on a key rotation.\n   */\n  readonly verifySignatures?: boolean;\n}\n\n/**\n * A configuration that discovers on demand.\n *\n * Holding the handle rather than the {@link Configuration} is what makes rotation expressible:\n * `rediscover()` throws the current one away, and with it the JWKS that openid-client cached\n * inside it.\n */\nexport interface Issuer {\n  /** The configuration, discovering once and reusing it. Rejects — and caches nothing — on failure. */\n  configuration(): Promise<Configuration>;\n  /**\n   * Discard what was discovered and fetch it again.\n   *\n   * This is the answer to signing-key rotation, and it is deliberately *reactive*: the trigger is\n   * a verification that failed, never a timer. A timer refreshes when nothing is wrong and is\n   * still stale at the moment something is.\n   */\n  rediscover(): Promise<Configuration>;\n}\n\n/**\n * A `fetch` that replaces one origin with another before sending.\n *\n * `from` may be any URL — its origin is what is taken — so the issuer URL itself can be passed\n * without the caller splitting it first. When the two origins are equal this is a pass-through,\n * which is why there is no second code path for \"no rewrite configured\".\n */\nexport function rewriteOrigin(\n  from: string,\n  to: string,\n  base: typeof globalThis.fetch = globalThis.fetch,\n): CustomFetch {\n  const source = new URL(from).origin;\n  const target = to.replace(/\\/+$/, \"\");\n  return (url, options) =>\n    base(\n      url.startsWith(source) ? `${target}${url.slice(source.length)}` : url,\n      options as unknown as RequestInit,\n    );\n}\n\nexport function issuer(config: IssuerConfig): Issuer {\n  const server = new URL(config.issuer);\n  const base: typeof globalThis.fetch =\n    config.fetch ?? ((input, init) => globalThis.fetch(input, init));\n\n  const reachedAt = config.internalOrigin ?? server.origin;\n\n  const options: DiscoveryRequestOptions = {\n    [customFetch]: rewriteOrigin(config.issuer, reachedAt, base),\n    timeout: DEADLINE / 1000,\n  };\n\n  // The channel is what the specification's exemption rests on, so the default asks whether there\n  // is one rather than assuming it. Explicit beats derived in both directions.\n  const overTls = new URL(reachedAt).protocol === \"https:\";\n  const execute = [\n    ...(config.allowInsecureHttp === true ? [allowInsecureRequests] : []),\n    ...((config.verifySignatures ?? !overTls) ? [enableNonRepudiationChecks] : []),\n  ];\n  if (execute.length > 0) options.execute = execute;\n\n  // `private_key_jwt` over a shared secret wherever the deployment can hold a key. `None()` is\n  // absent on purpose: this door is the confidential client, and a public one belongs behind\n  // `./browser` where PKCE alone is the protection.\n  const clientAuth =\n    config.privateKey !== undefined\n      ? PrivateKeyJwt(config.privateKey)\n      : ClientSecretPost(config.clientSecret);\n\n  const metadata: Partial<ClientMetadata> =\n    config.clientSecret !== undefined ? { client_secret: config.clientSecret } : {};\n\n  let current: Configuration | undefined;\n\n  // Single-flight for the reason it exists everywhere in this package: six requests arriving\n  // during a cold start would otherwise each fetch the discovery document. Here the slot is\n  // cleared on failure, which *is* the caller-driven retry — the next `await` starts a new attempt.\n  const fetchOnce = singleFlight(async () => {\n    const discovered = await discovery(server, config.clientId, metadata, clientAuth, options);\n    current = discovered;\n    return discovered;\n  });\n\n  return {\n    async configuration() {\n      return current ?? fetchOnce();\n    },\n    // A `rediscover()` that lands while a discovery is already running joins that one rather than\n    // starting a newer one. It is the narrow price of single-flight, and it is bounded: the call\n    // it joins is at most one request old, and a second failure rediscovers again.\n    async rediscover() {\n      current = undefined;\n      return fetchOnce();\n    },\n  };\n}\n"],"names":["rewriteOrigin","from","to","base","source","target","url","options","issuer","config","server","input","init","reachedAt","customFetch","DEADLINE","overTls","execute","allowInsecureRequests","enableNonRepudiationChecks","clientAuth","PrivateKeyJwt","ClientSecretPost","metadata","current","fetchOnce","singleFlight","discovered","discovery"],"mappings":";;;AA0GO,SAASA,EACdC,GACAC,GACAC,IAAgC,WAAW,OAC9B;AACb,QAAMC,IAAS,IAAI,IAAIH,CAAI,EAAE,QACvBI,IAASH,EAAG,QAAQ,QAAQ,EAAE;AACpC,SAAO,CAACI,GAAKC,MACXJ;AAAA,IACEG,EAAI,WAAWF,CAAM,IAAI,GAAGC,CAAM,GAAGC,EAAI,MAAMF,EAAO,MAAM,CAAC,KAAKE;AAAA,IAClEC;AAAA,EAAA;AAEN;AAEO,SAASC,EAAOC,GAA8B;AACnD,QAAMC,IAAS,IAAI,IAAID,EAAO,MAAM,GAC9BN,IACJM,EAAO,UAAU,CAACE,GAAOC,MAAS,WAAW,MAAMD,GAAOC,CAAI,IAE1DC,IAAYJ,EAAO,kBAAkBC,EAAO,QAE5CH,IAAmC;AAAA,IACvC,CAACO,CAAW,GAAGd,EAAcS,EAAO,QAAQI,GAAWV,CAAI;AAAA,IAC3D,SAASY,IAAW;AAAA,EAAA,GAKhBC,IAAU,IAAI,IAAIH,CAAS,EAAE,aAAa,UAC1CI,IAAU;AAAA,IACd,GAAIR,EAAO,sBAAsB,KAAO,CAACS,CAAqB,IAAI,CAAA;AAAA,IAClE,GAAKT,EAAO,oBAAoB,CAACO,IAAW,CAACG,CAA0B,IAAI,CAAA;AAAA,EAAC;AAE9E,EAAIF,EAAQ,SAAS,MAAGV,EAAQ,UAAUU;AAK1C,QAAMG,IACJX,EAAO,eAAe,SAClBY,EAAcZ,EAAO,UAAU,IAC/Ba,EAAiBb,EAAO,YAAY,GAEpCc,IACJd,EAAO,iBAAiB,SAAY,EAAE,eAAeA,EAAO,aAAA,IAAiB,CAAA;AAE/E,MAAIe;AAKJ,QAAMC,IAAYC,EAAa,YAAY;AACzC,UAAMC,IAAa,MAAMC,EAAUlB,GAAQD,EAAO,UAAUc,GAAUH,GAAYb,CAAO;AACzF,WAAAiB,IAAUG,GACHA;AAAA,EACT,CAAC;AAED,SAAO;AAAA,IACL,MAAM,gBAAgB;AACpB,aAAOH,KAAWC,EAAA;AAAA,IACpB;AAAA;AAAA;AAAA;AAAA,IAIA,MAAM,aAAa;AACjB,aAAAD,IAAU,QACHC,EAAA;AAAA,IACT;AAAA,EAAA;AAEJ;"}
+{"version":3,"file":"issuer.js","sources":["../src/issuer.ts"],"sourcesContent":["import {\n  ClientSecretPost,\n  PrivateKeyJwt,\n  allowInsecureRequests,\n  customFetch,\n  enableNonRepudiationChecks,\n  discovery,\n  type ClientMetadata,\n  type Configuration,\n  type CryptoKey,\n  type CustomFetch,\n  type DiscoveryRequestOptions,\n  type PrivateKey,\n} from \"openid-client\";\nimport { createRemoteJWKSet, customFetch as jwksFetch, type JWTVerifyGetKey } from \"jose\";\nimport { singleFlight } from \"./single-flight\";\nimport { DEADLINE } from \"./deadline\";\n\n/**\n * Discovery and client configuration for the confidential client behind `./server`.\n *\n * Two things live here that a plain `discovery()` call does not give you, and both come from\n * running this against Keycloak in anger:\n *\n * 1. **The issuer's origin can be rewritten for server→Keycloak traffic.** The browser must be\n *    sent to the public issuer, and the server usually cannot reach it — in a cluster it reaches\n *    `http://keycloak:8080`. Rewriting the *transport* rather than the issuer keeps the two\n *    truthful at once: discovery still validates the `issuer` in the document against the public\n *    URL, because that is what Keycloak puts there.\n * 2. **Discovery is allowed to fail.** Keycloak is frequently not up when the application is, and\n *    a library that hides a retry loop inside itself takes that decision away from the caller. A\n *    failed discovery is simply not cached, so the *next* call tries again — the retry is the\n *    caller's `await`, on the caller's schedule.\n */\n\nexport interface IssuerConfig {\n  /** The **public** issuer URL, exactly as Keycloak reports it: `https://id.example/realms/kanzo`. */\n  readonly issuer: string;\n  readonly clientId: string;\n  /** Client secret authentication. Used when {@link IssuerConfig.privateKey} is absent. */\n  readonly clientSecret?: string;\n  /**\n   * `private_key_jwt`, which is the stronger of the two: the secret never travels. Preferred\n   * wherever the deployment can hold a key, and it wins over `clientSecret` when both are given.\n   */\n  readonly privateKey?: CryptoKey | PrivateKey;\n  /**\n   * Where *this process* reaches Keycloak, when that is not where the browser reaches it —\n   * `http://keycloak:8080`. Only the origin is replaced; the path is the issuer's own.\n   */\n  readonly internalOrigin?: string;\n  /** Injectable for tests, and the seam the origin rewrite is built on. Defaults to the global. */\n  readonly fetch?: typeof globalThis.fetch;\n  /**\n   * Allow a plain-HTTP issuer. A compose file on a laptop serves `http://localhost:8080`, and\n   * without this nothing local can be configured at all. It is not needed for an HTTP\n   * {@link IssuerConfig.internalOrigin}: the rewrite happens below the protocol check.\n   */\n  readonly allowInsecureHttp?: boolean;\n  /**\n   * Verify the ID token's signature, and not only its claims.\n   *\n   * **Defaults to whether the token endpoint is actually reached over TLS**, rather than to a flat\n   * `false`. The specification lets a code grant skip this — an ID token arriving over a TLS\n   * connection to the token endpoint, from a request authenticated as this client, is vouched for\n   * by the channel (OpenID Connect Core §3.1.3.7 step 6) — and `openid-client` leaves it off for\n   * that reason, which is why a sign-in fetches no JWKS at all.\n   *\n   * But the exemption is a claim *about the channel*, and an {@link IssuerConfig.internalOrigin} of\n   * `http://keycloak:8080` withdraws it: the hop TLS was supposed to protect is plaintext inside\n   * the cluster, so nothing is vouching for anything. Inheriting the reference's default there\n   * would be inheriting its conclusion without its premise. So the default is derived from the\n   * effective origin's protocol, and it can still be set explicitly either way.\n   *\n   * On, it costs one JWKS fetch, cached — and it is what makes {@link Issuer.rediscover} reachable\n   * on a key rotation.\n   */\n  readonly verifySignatures?: boolean;\n}\n\n/**\n * A configuration that discovers on demand.\n *\n * Holding the handle rather than the {@link Configuration} is what makes rotation expressible:\n * `rediscover()` throws the current one away, and with it the JWKS that openid-client cached\n * inside it.\n */\nexport interface Issuer {\n  /** The configuration, discovering once and reusing it. Rejects — and caches nothing — on failure. */\n  configuration(): Promise<Configuration>;\n  /**\n   * Discard what was discovered and fetch it again.\n   *\n   * This is the answer to signing-key rotation, and it is deliberately *reactive*: the trigger is\n   * a verification that failed, never a timer. A timer refreshes when nothing is wrong and is\n   * still stale at the moment something is.\n   */\n  rediscover(): Promise<Configuration>;\n  /**\n   * The realm's signing keys, for verifying a token this client did not fetch itself — a\n   * back-channel logout token, which Keycloak posts to us rather than handing over a channel we\n   * opened.\n   *\n   * `jose`'s remote key set over the discovered `jwks_uri`, reached through the same transport as\n   * discovery, so an `internalOrigin` applies to it too. It re-fetches on a key id it has not seen,\n   * at most once per cooldown, which is the same reactive answer to rotation as {@link rediscover}.\n   */\n  keys(): Promise<JWTVerifyGetKey>;\n}\n\n/**\n * `path` without its trailing slashes, in one pass. A regex like `/\\/+$/` backtracks on a long\n * run of slashes, and these strings come from configuration a library does not control.\n */\nexport function withoutTrailingSlashes(path: string): string {\n  let end = path.length;\n  while (end > 0 && path[end - 1] === \"/\") end--;\n  return path.slice(0, end);\n}\n\n/**\n * A `fetch` that replaces one origin with another before sending.\n *\n * `from` may be any URL — its origin is what is taken — so the issuer URL itself can be passed\n * without the caller splitting it first. When the two origins are equal this is a pass-through,\n * which is why there is no second code path for \"no rewrite configured\".\n */\nexport function rewriteOrigin(\n  from: string,\n  to: string,\n  base: typeof globalThis.fetch = globalThis.fetch,\n): CustomFetch {\n  const source = new URL(from).origin;\n  const target = withoutTrailingSlashes(to);\n  return (url, options) =>\n    base(\n      url.startsWith(source) ? `${target}${url.slice(source.length)}` : url,\n      options as unknown as RequestInit,\n    );\n}\n\nexport function issuer(config: IssuerConfig): Issuer {\n  const server = new URL(config.issuer);\n  const base: typeof globalThis.fetch =\n    config.fetch ?? ((input, init) => globalThis.fetch(input, init));\n\n  const reachedAt = config.internalOrigin ?? server.origin;\n\n  const transport = rewriteOrigin(config.issuer, reachedAt, base);\n  const options: DiscoveryRequestOptions = {\n    [customFetch]: transport,\n    timeout: DEADLINE / 1000,\n  };\n\n  // The channel is what the specification's exemption rests on, so the default asks whether there\n  // is one rather than assuming it. Explicit beats derived in both directions.\n  const overTls = new URL(reachedAt).protocol === \"https:\";\n  const execute = [\n    ...(config.allowInsecureHttp === true ? [allowInsecureRequests] : []),\n    ...((config.verifySignatures ?? !overTls) ? [enableNonRepudiationChecks] : []),\n  ];\n  if (execute.length > 0) options.execute = execute;\n\n  // `private_key_jwt` over a shared secret wherever the deployment can hold a key. `None()` is\n  // absent on purpose: this door is the confidential client, and a public one belongs behind\n  // `./browser` where PKCE alone is the protection.\n  const clientAuth =\n    config.privateKey !== undefined\n      ? PrivateKeyJwt(config.privateKey)\n      : ClientSecretPost(config.clientSecret);\n\n  const metadata: Partial<ClientMetadata> =\n    config.clientSecret !== undefined ? { client_secret: config.clientSecret } : {};\n\n  let current: Configuration | undefined;\n  let keys: { readonly uri: string; readonly set: JWTVerifyGetKey } | undefined;\n\n  // Single-flight for the reason it exists everywhere in this package: six requests arriving\n  // during a cold start would otherwise each fetch the discovery document. Here the slot is\n  // cleared on failure, which *is* the caller-driven retry — the next `await` starts a new attempt.\n  const fetchOnce = singleFlight(async () => {\n    const discovered = await discovery(server, config.clientId, metadata, clientAuth, options);\n    current = discovered;\n    return discovered;\n  });\n\n  return {\n    async configuration() {\n      return current ?? fetchOnce();\n    },\n    // A `rediscover()` that lands while a discovery is already running joins that one rather than\n    // starting a newer one. It is the narrow price of single-flight, and it is bounded: the call\n    // it joins is at most one request old, and a second failure rediscovers again.\n    async rediscover() {\n      current = undefined;\n      return fetchOnce();\n    },\n    async keys() {\n      const uri = (current ?? (await fetchOnce())).serverMetadata().jwks_uri;\n      if (uri === undefined) throw new TypeError(\"the IdP's discovery document names no `jwks_uri`\");\n      if (keys?.uri !== uri) {\n        keys = {\n          uri,\n          set: createRemoteJWKSet(new URL(uri), {\n            [jwksFetch]: (url, init) => transport(url, init as never),\n            timeoutDuration: DEADLINE,\n          }),\n        };\n      }\n      return keys.set;\n    },\n  };\n}\n"],"names":["withoutTrailingSlashes","path","end","rewriteOrigin","from","to","base","source","target","url","options","issuer","config","server","input","init","reachedAt","transport","customFetch","DEADLINE","overTls","execute","allowInsecureRequests","enableNonRepudiationChecks","clientAuth","PrivateKeyJwt","ClientSecretPost","metadata","current","keys","fetchOnce","singleFlight","discovered","discovery","uri","createRemoteJWKSet","jwksFetch"],"mappings":";;;;AAkHO,SAASA,EAAuBC,GAAsB;AAC3D,MAAIC,IAAMD,EAAK;AACf,SAAOC,IAAM,KAAKD,EAAKC,IAAM,CAAC,MAAM,MAAK,CAAAA;AACzC,SAAOD,EAAK,MAAM,GAAGC,CAAG;AAC1B;AASO,SAASC,EACdC,GACAC,GACAC,IAAgC,WAAW,OAC9B;AACb,QAAMC,IAAS,IAAI,IAAIH,CAAI,EAAE,QACvBI,IAASR,EAAuBK,CAAE;AACxC,SAAO,CAACI,GAAKC,MACXJ;AAAA,IACEG,EAAI,WAAWF,CAAM,IAAI,GAAGC,CAAM,GAAGC,EAAI,MAAMF,EAAO,MAAM,CAAC,KAAKE;AAAA,IAClEC;AAAA,EAAA;AAEN;AAEO,SAASC,EAAOC,GAA8B;AACnD,QAAMC,IAAS,IAAI,IAAID,EAAO,MAAM,GAC9BN,IACJM,EAAO,UAAU,CAACE,GAAOC,MAAS,WAAW,MAAMD,GAAOC,CAAI,IAE1DC,IAAYJ,EAAO,kBAAkBC,EAAO,QAE5CI,IAAYd,EAAcS,EAAO,QAAQI,GAAWV,CAAI,GACxDI,IAAmC;AAAA,IACvC,CAACQ,CAAW,GAAGD;AAAA,IACf,SAASE,IAAW;AAAA,EAAA,GAKhBC,IAAU,IAAI,IAAIJ,CAAS,EAAE,aAAa,UAC1CK,IAAU;AAAA,IACd,GAAIT,EAAO,sBAAsB,KAAO,CAACU,CAAqB,IAAI,CAAA;AAAA,IAClE,GAAKV,EAAO,oBAAoB,CAACQ,IAAW,CAACG,CAA0B,IAAI,CAAA;AAAA,EAAC;AAE9E,EAAIF,EAAQ,SAAS,MAAGX,EAAQ,UAAUW;AAK1C,QAAMG,IACJZ,EAAO,eAAe,SAClBa,EAAcb,EAAO,UAAU,IAC/Bc,EAAiBd,EAAO,YAAY,GAEpCe,IACJf,EAAO,iBAAiB,SAAY,EAAE,eAAeA,EAAO,aAAA,IAAiB,CAAA;AAE/E,MAAIgB,GACAC;AAKJ,QAAMC,IAAYC,EAAa,YAAY;AACzC,UAAMC,IAAa,MAAMC,EAAUpB,GAAQD,EAAO,UAAUe,GAAUH,GAAYd,CAAO;AACzF,WAAAkB,IAAUI,GACHA;AAAA,EACT,CAAC;AAED,SAAO;AAAA,IACL,MAAM,gBAAgB;AACpB,aAAOJ,KAAWE,EAAA;AAAA,IACpB;AAAA;AAAA;AAAA;AAAA,IAIA,MAAM,aAAa;AACjB,aAAAF,IAAU,QACHE,EAAA;AAAA,IACT;AAAA,IACA,MAAM,OAAO;AACX,YAAMI,KAAON,KAAY,MAAME,EAAA,GAAc,iBAAiB;AAC9D,UAAII,MAAQ,OAAW,OAAM,IAAI,UAAU,kDAAkD;AAC7F,cAAIL,KAAA,gBAAAA,EAAM,SAAQK,MAChBL,IAAO;AAAA,QACL,KAAAK;AAAA,QACA,KAAKC,EAAmB,IAAI,IAAID,CAAG,GAAG;AAAA,UACpC,CAACE,CAAS,GAAG,CAAC3B,GAAKM,MAASE,EAAUR,GAAKM,CAAa;AAAA,UACxD,iBAAiBI;AAAA,QAAA,CAClB;AAAA,MAAA,IAGEU,EAAK;AAAA,IACd;AAAA,EAAA;AAEJ;"}

package/dist/next-auth.d.ts

@@ -0,0 +1,66 @@
+import { NextRequest, NextResponse } from 'next/server';
+import { KanzoAuthConfig } from './next-bound';
+import { ApiHandlers } from './next-proxy';
+import { RouteHandlers } from './next-routes';
+import { Session } from './types';
+export type { KanzoAuthConfig } from './next-bound';
+/**
+ * `kanzoAuth` — the whole Backend For Frontend as one object: a proxy that is the session
+ * authority, the auth routes, the resource-server forwarder and the session a server component
+ * reads.
+ *
+ * ```ts
+ * // lib/auth.ts
+ * export const auth = kanzoAuth(async () => ({ issuer, clientId, clientSecret, secret, store }));
+ *
+ * // proxy.ts
+ * export const proxy = (request: NextRequest) => auth.proxy(request);
+ *
+ * // app/api/auth/[...auth]/route.ts
+ * export const { GET, POST } = auth.routes;
+ *
+ * // any server component
+ * const session = await auth.session({ required: true });
+ * ```
+ *
+ * ## One object, because one relying party
+ *
+ * Auth0's v4 SDK is one `Auth0Client` for the same reason. Every piece here talks to the same
+ * issuer with the same secret and the same store, and a renewal in the proxy must be the renewal
+ * the forwarder joins. Five factories each holding their own relying party meant five discovery
+ * caches and five configs that had to agree by hand; one instance means they cannot disagree.
+ *
+ * ## Bound on first request, not at import
+ *
+ * `next build` imports every route module with no secrets in the environment, so the config is a
+ * function — possibly async, for a secret read from a file or a vault — called the first time a
+ * request needs it. The built instance is remembered; a failure is not, so a deployment that
+ * started before its IdP or its secret was ready recovers on the next request instead of
+ * remembering the outage. `routes` and `api` are plain handler objects that exist at import, which
+ * is what a route file's `export const { GET, POST } = …` needs.
+ */
+export interface KanzoAuth {
+    /**
+     * Next's `proxy.ts`: the session authority for every page.
+     *
+     * It renews an access token that is about to expire, ends a session the IdP refused to renew,
+     * and sends a browser with no live session to sign in carrying the URL it asked for — or, for a
+     * request that is not a navigation, answers 401. `headers` are added to the request the page
+     * sees, for a CSP nonce.
+     */
+    proxy(request: NextRequest, options?: {
+        readonly headers?: HeadersInit;
+    }): Promise<NextResponse>;
+    /** `signin`, `callback`, `signout`, `session`, `refresh` and `backchannel-logout`, for `[...auth]/route.ts`. */
+    readonly routes: RouteHandlers;
+    /** Every verb a route file exports, forwarding to `api.target`. 404 without `api`. */
+    readonly api: ApiHandlers;
+    /** The session this request carries, read once per request, or `null`. */
+    session(): Promise<Session | null>;
+    /** The session, or a redirect to sign in that comes back to this page. */
+    session(options: {
+        readonly required: true;
+    }): Promise<Session>;
+}
+export declare function kanzoAuth(config: KanzoAuthConfig | (() => KanzoAuthConfig | Promise<KanzoAuthConfig>)): KanzoAuth;
+//# sourceMappingURL=next-auth.d.ts.map

package/dist/next-auth.d.ts.map

@@ -0,0 +1 @@
+{"version":3,"file":"next-auth.d.ts","sourceRoot":"","sources":["../src/next-auth.ts"],"names":[],"mappings":"AAEA,OAAO,KAAK,EAAE,WAAW,EAAE,YAAY,EAAE,MAAM,aAAa,CAAC;AAE7D,OAAO,EAA4C,KAAK,eAAe,EAAE,MAAM,cAAc,CAAC;AAE9F,OAAO,EAAW,KAAK,WAAW,EAAE,MAAM,cAAc,CAAC;AACzD,OAAO,EAAU,KAAK,aAAa,EAAE,MAAM,eAAe,CAAC;AAE3D,OAAO,KAAK,EAAE,OAAO,EAAE,MAAM,SAAS,CAAC;AAEvC,YAAY,EAAE,eAAe,EAAE,MAAM,cAAc,CAAC;AAEpD;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;GAkCG;AAEH,MAAM,WAAW,SAAS;IACxB;;;;;;;OAOG;IACH,KAAK,CAAC,OAAO,EAAE,WAAW,EAAE,OAAO,CAAC,EAAE;QAAE,QAAQ,CAAC,OAAO,CAAC,EAAE,WAAW,CAAA;KAAE,GAAG,OAAO,CAAC,YAAY,CAAC,CAAC;IACjG,gHAAgH;IAChH,QAAQ,CAAC,MAAM,EAAE,aAAa,CAAC;IAC/B,sFAAsF;IACtF,QAAQ,CAAC,GAAG,EAAE,WAAW,CAAC;IAC1B,0EAA0E;IAC1E,OAAO,IAAI,OAAO,CAAC,OAAO,GAAG,IAAI,CAAC,CAAC;IACnC,0EAA0E;IAC1E,OAAO,CAAC,OAAO,EAAE;QAAE,QAAQ,CAAC,QAAQ,EAAE,IAAI,CAAA;KAAE,GAAG,OAAO,CAAC,OAAO,CAAC,CAAC;CACjE;AAmBD,wBAAgB,SAAS,CACvB,MAAM,EAAE,eAAe,GAAG,CAAC,MAAM,eAAe,GAAG,OAAO,CAAC,eAAe,CAAC,CAAC,GAC3E,SAAS,CAyCX"}

package/dist/next-auth.js

@@ -0,0 +1,43 @@
+import { cookies as m, headers as d } from "next/headers";
+import { redirect as f } from "next/navigation";
+import { cache as h } from "react";
+import { withTenant as w, URL_HEADER as y, bind as p } from "./next-bound.js";
+import { gate as g } from "./next-gate.js";
+import { forward as $ } from "./next-proxy.js";
+import { routes as b } from "./next-routes.js";
+import { singleFlight as R } from "./single-flight.js";
+function U(n) {
+  const e = n.get(y);
+  if (e !== null)
+    try {
+      return new URL(e);
+    } catch {
+    }
+  return new URL(`https://${n.get("host") ?? "localhost"}/`);
+}
+function j(n) {
+  let e;
+  const c = R(async () => (e = p(typeof n == "function" ? await n() : n), e)), a = async () => e ?? c(), u = h(async () => {
+    const t = await a(), [r, o] = await Promise.all([m(), d()]), s = U(o), i = await t.party.read(r.toString());
+    return i === null ? { session: null, url: s } : {
+      session: w(i, await t.tenant({ url: s, headers: o, cookies: r })),
+      url: s
+    };
+  });
+  async function l(t) {
+    const { session: r, url: o } = await u();
+    if (r !== null || (t == null ? void 0 : t.required) !== !0) return r;
+    const s = `${(await a()).basePath}/signin`;
+    f(`${s}?returnTo=${encodeURIComponent(`${o.pathname}${o.search}`)}`);
+  }
+  return {
+    proxy: async (t, r) => g(await a(), t, r == null ? void 0 : r.headers),
+    routes: b(a),
+    api: $(a),
+    session: l
+  };
+}
+export {
+  j as kanzoAuth
+};
+//# sourceMappingURL=next-auth.js.map

package/dist/next-auth.js.map

@@ -0,0 +1 @@
+{"version":3,"file":"next-auth.js","sources":["../src/next-auth.ts"],"sourcesContent":["import { cookies, headers } from \"next/headers\";\nimport { redirect } from \"next/navigation\";\nimport type { NextRequest, NextResponse } from \"next/server\";\nimport { cache } from \"react\";\nimport { bind, URL_HEADER, withTenant, type Bound, type KanzoAuthConfig } from \"./next-bound\";\nimport { gate } from \"./next-gate\";\nimport { forward, type ApiHandlers } from \"./next-proxy\";\nimport { routes, type RouteHandlers } from \"./next-routes\";\nimport { singleFlight } from \"./single-flight\";\nimport type { Session } from \"./types\";\n\nexport type { KanzoAuthConfig } from \"./next-bound\";\n\n/**\n * `kanzoAuth` — the whole Backend For Frontend as one object: a proxy that is the session\n * authority, the auth routes, the resource-server forwarder and the session a server component\n * reads.\n *\n * ```ts\n * // lib/auth.ts\n * export const auth = kanzoAuth(async () => ({ issuer, clientId, clientSecret, secret, store }));\n *\n * // proxy.ts\n * export const proxy = (request: NextRequest) => auth.proxy(request);\n *\n * // app/api/auth/[...auth]/route.ts\n * export const { GET, POST } = auth.routes;\n *\n * // any server component\n * const session = await auth.session({ required: true });\n * ```\n *\n * ## One object, because one relying party\n *\n * Auth0's v4 SDK is one `Auth0Client` for the same reason. Every piece here talks to the same\n * issuer with the same secret and the same store, and a renewal in the proxy must be the renewal\n * the forwarder joins. Five factories each holding their own relying party meant five discovery\n * caches and five configs that had to agree by hand; one instance means they cannot disagree.\n *\n * ## Bound on first request, not at import\n *\n * `next build` imports every route module with no secrets in the environment, so the config is a\n * function — possibly async, for a secret read from a file or a vault — called the first time a\n * request needs it. The built instance is remembered; a failure is not, so a deployment that\n * started before its IdP or its secret was ready recovers on the next request instead of\n * remembering the outage. `routes` and `api` are plain handler objects that exist at import, which\n * is what a route file's `export const { GET, POST } = …` needs.\n */\n\nexport interface KanzoAuth {\n  /**\n   * Next's `proxy.ts`: the session authority for every page.\n   *\n   * It renews an access token that is about to expire, ends a session the IdP refused to renew,\n   * and sends a browser with no live session to sign in carrying the URL it asked for — or, for a\n   * request that is not a navigation, answers 401. `headers` are added to the request the page\n   * sees, for a CSP nonce.\n   */\n  proxy(request: NextRequest, options?: { readonly headers?: HeadersInit }): Promise<NextResponse>;\n  /** `signin`, `callback`, `signout`, `session`, `refresh` and `backchannel-logout`, for `[...auth]/route.ts`. */\n  readonly routes: RouteHandlers;\n  /** Every verb a route file exports, forwarding to `api.target`. 404 without `api`. */\n  readonly api: ApiHandlers;\n  /** The session this request carries, read once per request, or `null`. */\n  session(): Promise<Session | null>;\n  /** The session, or a redirect to sign in that comes back to this page. */\n  session(options: { readonly required: true }): Promise<Session>;\n}\n\n/**\n * The URL a server component is rendering, from the header the proxy set — which it deletes from\n * every incoming request first, so a browser cannot choose it. A page the proxy does not run on\n * has only its host.\n */\nfunction renderedUrl(incoming: Headers): URL {\n  const forwarded = incoming.get(URL_HEADER);\n  if (forwarded !== null) {\n    try {\n      return new URL(forwarded);\n    } catch {\n      /* not a URL: read as absent */\n    }\n  }\n  return new URL(`https://${incoming.get(\"host\") ?? \"localhost\"}/`);\n}\n\nexport function kanzoAuth(\n  config: KanzoAuthConfig | (() => KanzoAuthConfig | Promise<KanzoAuthConfig>),\n): KanzoAuth {\n  // The instance is kept and the attempt is not: concurrent first requests share one build, and a\n  // build that threw leaves nothing behind, so the next request builds again — `issuer`'s shape.\n  let bound: Bound | undefined;\n  const build = singleFlight(async () => {\n    bound = bind(typeof config === \"function\" ? await config() : config);\n    return bound;\n  });\n  const instance = async (): Promise<Bound> => bound ?? build();\n\n  // React's `cache` scopes the read to one server request, so a layout, a breadcrumb and a menu\n  // asking in one render unseal the cookie and read the store once.\n  const current = cache(async (): Promise<{ readonly session: Session | null; readonly url: URL }> => {\n    const bound = await instance();\n    const [jar, incoming] = await Promise.all([cookies(), headers()]);\n    const url = renderedUrl(incoming);\n    const found = await bound.party.read(jar.toString());\n    if (found === null) return { session: null, url };\n    return {\n      session: withTenant(found, await bound.tenant({ url, headers: incoming, cookies: jar })),\n      url,\n    };\n  });\n\n  async function session(): Promise<Session | null>;\n  async function session(options: { readonly required: true }): Promise<Session>;\n  async function session(options?: { readonly required: true }): Promise<Session | null> {\n    const { session: found, url } = await current();\n    if (found !== null || options?.required !== true) return found;\n    // AuthKit's `ensureSignedIn`: the proxy normally sends this browser to sign in before the page\n    // renders, so this is the page the proxy does not run on, or a session that ended mid-render.\n    const signIn = `${(await instance()).basePath}/signin`;\n    redirect(`${signIn}?returnTo=${encodeURIComponent(`${url.pathname}${url.search}`)}`);\n  }\n\n  return {\n    proxy: async (request, options) => gate(await instance(), request, options?.headers),\n    routes: routes(instance),\n    api: forward(instance),\n    session,\n  };\n}\n"],"names":["renderedUrl","incoming","forwarded","URL_HEADER","kanzoAuth","config","bound","build","singleFlight","bind","instance","current","cache","jar","cookies","headers","url","found","withTenant","session","options","signIn","redirect","request","gate","routes","forward"],"mappings":";;;;;;;;AA0EA,SAASA,EAAYC,GAAwB;AAC3C,QAAMC,IAAYD,EAAS,IAAIE,CAAU;AACzC,MAAID,MAAc;AAChB,QAAI;AACF,aAAO,IAAI,IAAIA,CAAS;AAAA,IAC1B,QAAQ;AAAA,IAER;AAEF,SAAO,IAAI,IAAI,WAAWD,EAAS,IAAI,MAAM,KAAK,WAAW,GAAG;AAClE;AAEO,SAASG,EACdC,GACW;AAGX,MAAIC;AACJ,QAAMC,IAAQC,EAAa,aACzBF,IAAQG,EAAK,OAAOJ,KAAW,aAAa,MAAMA,EAAA,IAAWA,CAAM,GAC5DC,EACR,GACKI,IAAW,YAA4BJ,KAASC,EAAA,GAIhDI,IAAUC,EAAM,YAA8E;AAClG,UAAMN,IAAQ,MAAMI,EAAA,GACd,CAACG,GAAKZ,CAAQ,IAAI,MAAM,QAAQ,IAAI,CAACa,EAAA,GAAWC,EAAA,CAAS,CAAC,GAC1DC,IAAMhB,EAAYC,CAAQ,GAC1BgB,IAAQ,MAAMX,EAAM,MAAM,KAAKO,EAAI,UAAU;AACnD,WAAII,MAAU,OAAa,EAAE,SAAS,MAAM,KAAAD,EAAA,IACrC;AAAA,MACL,SAASE,EAAWD,GAAO,MAAMX,EAAM,OAAO,EAAE,KAAAU,GAAK,SAASf,GAAU,SAASY,EAAA,CAAK,CAAC;AAAA,MACvF,KAAAG;AAAA,IAAA;AAAA,EAEJ,CAAC;AAID,iBAAeG,EAAQC,GAAgE;AACrF,UAAM,EAAE,SAASH,GAAO,KAAAD,EAAA,IAAQ,MAAML,EAAA;AACtC,QAAIM,MAAU,SAAQG,KAAA,gBAAAA,EAAS,cAAa,GAAM,QAAOH;AAGzD,UAAMI,IAAS,IAAI,MAAMX,EAAA,GAAY,QAAQ;AAC7C,IAAAY,EAAS,GAAGD,CAAM,aAAa,mBAAmB,GAAGL,EAAI,QAAQ,GAAGA,EAAI,MAAM,EAAE,CAAC,EAAE;AAAA,EACrF;AAEA,SAAO;AAAA,IACL,OAAO,OAAOO,GAASH,MAAYI,EAAK,MAAMd,KAAYa,GAASH,KAAA,gBAAAA,EAAS,OAAO;AAAA,IACnF,QAAQK,EAAOf,CAAQ;AAAA,IACvB,KAAKgB,EAAQhB,CAAQ;AAAA,IACrB,SAAAS;AAAA,EAAA;AAEJ;"}

package/dist/next-bound.d.ts

@@ -0,0 +1,82 @@
+import { RelyingParty, RelyingPartyConfig } from './server';
+import { Session } from './types';
+/**
+ * A `kanzoAuth` config once read: one relying party, and the settings the proxy, the routes and
+ * the forwarder share. In a module of its own so those three can take it without importing the
+ * door that builds them.
+ */
+/**
+ * What a tenant resolver is handed. The proxy, the routes and a server component each build it
+ * from the request in front of them — a server component from the `x-kanzo-url` the proxy
+ * forwarded — so the same function answers the same way in all three.
+ */
+type TenantRequest = {
+    readonly url: URL;
+    readonly headers: Headers;
+    readonly cookies: {
+        get(name: string): {
+            readonly value: string;
+        } | undefined;
+    };
+};
+export interface KanzoAuthConfig extends RelyingPartyConfig {
+    /**
+     * The organization a request addresses: a hostname's first label, a path segment, a cookie, or
+     * one fixed alias for a deployment per tenant. Its answer is `Session.organization`, and the
+     * organization `can` asks inside by default. Absent, sessions carry no current tenant.
+     */
+    readonly organization?: (request: TenantRequest) => string | undefined | Promise<string | undefined>;
+    /** Where `routes` is mounted. Default `/api/auth`. */
+    readonly basePath?: string;
+    /**
+     * The product's page for a failed sign-in, callback or sign-out, and for a session store that
+     * does not answer, reached as `?code=<AuthErrorCode>`. Default `/auth/problem`. Always public:
+     * whoever is sent there has no session, and sending them to sign in instead is a loop when
+     * signing in is what failed.
+     */
+    readonly problemPage?: string;
+    /**
+     * Path prefixes the proxy lets through without a session — a health probe, a legal notice.
+     * Matched on segment boundaries: `/health` opens `/health/live` and not `/healthcare`.
+     */
+    readonly public?: readonly string[];
+    /**
+     * Override the callback URL. Absent, it is derived from the request: its origin, the path the
+     * routes sit on, and `/callback`. Deriving it trusts `Host`, which is bounded — Keycloak refuses
+     * a `redirect_uri` it has not registered — but a deployment behind a proxy that rewrites the
+     * host says the URL out loud here.
+     */
+    readonly redirectUri?: string;
+    /** Seconds of access-token lifetime below which a request renews it. Default 60. */
+    readonly renewWithin?: number;
+    /**
+     * Forward `mount` to a resource server at `target` with the access token as a bearer — the
+     * token-mediating backend. The proxy leaves `mount` alone; `api` answers it.
+     */
+    readonly api?: {
+        readonly mount: string;
+        readonly target: string;
+    };
+}
+/** What a `kanzoAuth` instance is once its config has been read: one relying party and its settings. */
+export interface Bound {
+    readonly party: RelyingParty;
+    readonly basePath: string;
+    readonly problemPage: string;
+    readonly redirectUri?: string;
+    readonly renewWithin?: number;
+    readonly api?: {
+        readonly mount: string;
+        readonly target: URL;
+    };
+    /** Prefixes the proxy lets through: the routes, the forwarder, the problem page, and `public`. */
+    readonly open: readonly string[];
+    tenant(request: TenantRequest): Promise<string | undefined>;
+}
+/** The request header the proxy forwards the URL on — AuthKit's `x-url` — for a server component to read. */
+export declare const URL_HEADER = "x-kanzo-url";
+export declare function bind(config: KanzoAuthConfig): Bound;
+/** The current tenant on a session, when there is one. */
+export declare function withTenant(session: Session, organization: string | undefined): Session;
+export {};
+//# sourceMappingURL=next-bound.d.ts.map

package/dist/next-bound.d.ts.map

@@ -0,0 +1 @@
+{"version":3,"file":"next-bound.d.ts","sourceRoot":"","sources":["../src/next-bound.ts"],"names":[],"mappings":"AAAA,OAAO,EAAgB,KAAK,YAAY,EAAE,KAAK,kBAAkB,EAAE,MAAM,UAAU,CAAC;AACpF,OAAO,KAAK,EAAE,OAAO,EAAE,MAAM,SAAS,CAAC;AAGvC;;;;GAIG;AAEH;;;;GAIG;AACH,KAAK,aAAa,GAAG;IACnB,QAAQ,CAAC,GAAG,EAAE,GAAG,CAAC;IAClB,QAAQ,CAAC,OAAO,EAAE,OAAO,CAAC;IAC1B,QAAQ,CAAC,OAAO,EAAE;QAAE,GAAG,CAAC,IAAI,EAAE,MAAM,GAAG;YAAE,QAAQ,CAAC,KAAK,EAAE,MAAM,CAAA;SAAE,GAAG,SAAS,CAAA;KAAE,CAAC;CACjF,CAAC;AAEF,MAAM,WAAW,eAAgB,SAAQ,kBAAkB;IACzD;;;;OAIG;IACH,QAAQ,CAAC,YAAY,CAAC,EAAE,CAAC,OAAO,EAAE,aAAa,KAAK,MAAM,GAAG,SAAS,GAAG,OAAO,CAAC,MAAM,GAAG,SAAS,CAAC,CAAC;IACrG,sDAAsD;IACtD,QAAQ,CAAC,QAAQ,CAAC,EAAE,MAAM,CAAC;IAC3B;;;;;OAKG;IACH,QAAQ,CAAC,WAAW,CAAC,EAAE,MAAM,CAAC;IAC9B;;;OAGG;IACH,QAAQ,CAAC,MAAM,CAAC,EAAE,SAAS,MAAM,EAAE,CAAC;IACpC;;;;;OAKG;IACH,QAAQ,CAAC,WAAW,CAAC,EAAE,MAAM,CAAC;IAC9B,oFAAoF;IACpF,QAAQ,CAAC,WAAW,CAAC,EAAE,MAAM,CAAC;IAC9B;;;OAGG;IACH,QAAQ,CAAC,GAAG,CAAC,EAAE;QAAE,QAAQ,CAAC,KAAK,EAAE,MAAM,CAAC;QAAC,QAAQ,CAAC,MAAM,EAAE,MAAM,CAAA;KAAE,CAAC;CACpE;AAED,wGAAwG;AACxG,MAAM,WAAW,KAAK;IACpB,QAAQ,CAAC,KAAK,EAAE,YAAY,CAAC;IAC7B,QAAQ,CAAC,QAAQ,EAAE,MAAM,CAAC;IAC1B,QAAQ,CAAC,WAAW,EAAE,MAAM,CAAC;IAC7B,QAAQ,CAAC,WAAW,CAAC,EAAE,MAAM,CAAC;IAC9B,QAAQ,CAAC,WAAW,CAAC,EAAE,MAAM,CAAC;IAC9B,QAAQ,CAAC,GAAG,CAAC,EAAE;QAAE,QAAQ,CAAC,KAAK,EAAE,MAAM,CAAC;QAAC,QAAQ,CAAC,MAAM,EAAE,GAAG,CAAA;KAAE,CAAC;IAChE,kGAAkG;IAClG,QAAQ,CAAC,IAAI,EAAE,SAAS,MAAM,EAAE,CAAC;IACjC,MAAM,CAAC,OAAO,EAAE,aAAa,GAAG,OAAO,CAAC,MAAM,GAAG,SAAS,CAAC,CAAC;CAC7D;AAED,6GAA6G;AAC7G,eAAO,MAAM,UAAU,gBAAgB,CAAC;AAGxC,wBAAgB,IAAI,CAAC,MAAM,EAAE,eAAe,GAAG,KAAK,CAoBnD;AAED,0DAA0D;AAC1D,wBAAgB,UAAU,CAAC,OAAO,EAAE,OAAO,EAAE,YAAY,EAAE,MAAM,GAAG,SAAS,GAAG,OAAO,CAEtF"}

package/dist/next-bound.js

@@ -0,0 +1,27 @@
+import { relyingParty as p } from "./server.js";
+import { withoutTrailingSlashes as a } from "./issuer.js";
+const d = "x-kanzo-url";
+function h(t) {
+  const r = a(t.basePath ?? "/api/auth"), i = t.problemPage ?? "/auth/problem", e = t.api === void 0 ? void 0 : { mount: a(t.api.mount), target: new URL(t.api.target) }, n = t.organization;
+  return {
+    party: p(t),
+    basePath: r,
+    problemPage: i,
+    redirectUri: t.redirectUri,
+    renewWithin: t.renewWithin,
+    api: e,
+    open: [r, i, ...e === void 0 ? [] : [e.mount], ...t.public ?? []].map(
+      a
+    ),
+    tenant: async (o) => n === void 0 ? void 0 : n(o)
+  };
+}
+function l(t, r) {
+  return r === void 0 ? t : { ...t, organization: r };
+}
+export {
+  d as URL_HEADER,
+  h as bind,
+  l as withTenant
+};
+//# sourceMappingURL=next-bound.js.map

package/dist/next-bound.js.map

@@ -0,0 +1 @@
+{"version":3,"file":"next-bound.js","sources":["../src/next-bound.ts"],"sourcesContent":["import { relyingParty, type RelyingParty, type RelyingPartyConfig } from \"./server\";\nimport type { Session } from \"./types\";\nimport { withoutTrailingSlashes } from \"./issuer\";\n\n/**\n * A `kanzoAuth` config once read: one relying party, and the settings the proxy, the routes and\n * the forwarder share. In a module of its own so those three can take it without importing the\n * door that builds them.\n */\n\n/**\n * What a tenant resolver is handed. The proxy, the routes and a server component each build it\n * from the request in front of them — a server component from the `x-kanzo-url` the proxy\n * forwarded — so the same function answers the same way in all three.\n */\ntype TenantRequest = {\n  readonly url: URL;\n  readonly headers: Headers;\n  readonly cookies: { get(name: string): { readonly value: string } | undefined };\n};\n\nexport interface KanzoAuthConfig extends RelyingPartyConfig {\n  /**\n   * The organization a request addresses: a hostname's first label, a path segment, a cookie, or\n   * one fixed alias for a deployment per tenant. Its answer is `Session.organization`, and the\n   * organization `can` asks inside by default. Absent, sessions carry no current tenant.\n   */\n  readonly organization?: (request: TenantRequest) => string | undefined | Promise<string | undefined>;\n  /** Where `routes` is mounted. Default `/api/auth`. */\n  readonly basePath?: string;\n  /**\n   * The product's page for a failed sign-in, callback or sign-out, and for a session store that\n   * does not answer, reached as `?code=<AuthErrorCode>`. Default `/auth/problem`. Always public:\n   * whoever is sent there has no session, and sending them to sign in instead is a loop when\n   * signing in is what failed.\n   */\n  readonly problemPage?: string;\n  /**\n   * Path prefixes the proxy lets through without a session — a health probe, a legal notice.\n   * Matched on segment boundaries: `/health` opens `/health/live` and not `/healthcare`.\n   */\n  readonly public?: readonly string[];\n  /**\n   * Override the callback URL. Absent, it is derived from the request: its origin, the path the\n   * routes sit on, and `/callback`. Deriving it trusts `Host`, which is bounded — Keycloak refuses\n   * a `redirect_uri` it has not registered — but a deployment behind a proxy that rewrites the\n   * host says the URL out loud here.\n   */\n  readonly redirectUri?: string;\n  /** Seconds of access-token lifetime below which a request renews it. Default 60. */\n  readonly renewWithin?: number;\n  /**\n   * Forward `mount` to a resource server at `target` with the access token as a bearer — the\n   * token-mediating backend. The proxy leaves `mount` alone; `api` answers it.\n   */\n  readonly api?: { readonly mount: string; readonly target: string };\n}\n\n/** What a `kanzoAuth` instance is once its config has been read: one relying party and its settings. */\nexport interface Bound {\n  readonly party: RelyingParty;\n  readonly basePath: string;\n  readonly problemPage: string;\n  readonly redirectUri?: string;\n  readonly renewWithin?: number;\n  readonly api?: { readonly mount: string; readonly target: URL };\n  /** Prefixes the proxy lets through: the routes, the forwarder, the problem page, and `public`. */\n  readonly open: readonly string[];\n  tenant(request: TenantRequest): Promise<string | undefined>;\n}\n\n/** The request header the proxy forwards the URL on — AuthKit's `x-url` — for a server component to read. */\nexport const URL_HEADER = \"x-kanzo-url\";\n\n\nexport function bind(config: KanzoAuthConfig): Bound {\n  const basePath = withoutTrailingSlashes(config.basePath ?? \"/api/auth\");\n  const problemPage = config.problemPage ?? \"/auth/problem\";\n  const api =\n    config.api === undefined\n      ? undefined\n      : { mount: withoutTrailingSlashes(config.api.mount), target: new URL(config.api.target) };\n  const resolve = config.organization;\n  return {\n    party: relyingParty(config),\n    basePath,\n    problemPage,\n    redirectUri: config.redirectUri,\n    renewWithin: config.renewWithin,\n    api,\n    open: [basePath, problemPage, ...(api === undefined ? [] : [api.mount]), ...(config.public ?? [])].map(\n      withoutTrailingSlashes,\n    ),\n    tenant: async (request) => (resolve === undefined ? undefined : resolve(request)),\n  };\n}\n\n/** The current tenant on a session, when there is one. */\nexport function withTenant(session: Session, organization: string | undefined): Session {\n  return organization === undefined ? session : { ...session, organization };\n}\n\n"],"names":["URL_HEADER","bind","config","basePath","withoutTrailingSlashes","problemPage","api","resolve","relyingParty","request","withTenant","session","organization"],"mappings":";;AAwEO,MAAMA,IAAa;AAGnB,SAASC,EAAKC,GAAgC;AACnD,QAAMC,IAAWC,EAAuBF,EAAO,YAAY,WAAW,GAChEG,IAAcH,EAAO,eAAe,iBACpCI,IACJJ,EAAO,QAAQ,SACX,SACA,EAAE,OAAOE,EAAuBF,EAAO,IAAI,KAAK,GAAG,QAAQ,IAAI,IAAIA,EAAO,IAAI,MAAM,EAAA,GACpFK,IAAUL,EAAO;AACvB,SAAO;AAAA,IACL,OAAOM,EAAaN,CAAM;AAAA,IAC1B,UAAAC;AAAA,IACA,aAAAE;AAAA,IACA,aAAaH,EAAO;AAAA,IACpB,aAAaA,EAAO;AAAA,IACpB,KAAAI;AAAA,IACA,MAAM,CAACH,GAAUE,GAAa,GAAIC,MAAQ,SAAY,CAAA,IAAK,CAACA,EAAI,KAAK,GAAI,GAAIJ,EAAO,UAAU,CAAA,CAAG,EAAE;AAAA,MACjGE;AAAA,IAAA;AAAA,IAEF,QAAQ,OAAOK,MAAaF,MAAY,SAAY,SAAYA,EAAQE,CAAO;AAAA,EAAA;AAEnF;AAGO,SAASC,EAAWC,GAAkBC,GAA2C;AACtF,SAAOA,MAAiB,SAAYD,IAAU,EAAE,GAAGA,GAAS,cAAAC,EAAA;AAC9D;"}

package/dist/next-gate.d.ts

@@ -0,0 +1,4 @@
+import { NextResponse, NextRequest } from 'next/server';
+import { Bound } from './next-bound';
+export declare function gate(bound: Bound, request: NextRequest, extra?: HeadersInit): Promise<NextResponse>;
+//# sourceMappingURL=next-gate.d.ts.map

package/dist/next-gate.d.ts.map

@@ -0,0 +1 @@
+{"version":3,"file":"next-gate.d.ts","sourceRoot":"","sources":["../src/next-gate.ts"],"names":[],"mappings":"AAAA,OAAO,EAAE,YAAY,EAAE,KAAK,WAAW,EAAE,MAAM,aAAa,CAAC;AAC7D,OAAO,EAAc,KAAK,KAAK,EAAE,MAAM,cAAc,CAAC;AA6FtD,wBAAsB,IAAI,CACxB,KAAK,EAAE,KAAK,EACZ,OAAO,EAAE,WAAW,EACpB,KAAK,CAAC,EAAE,WAAW,GAClB,OAAO,CAAC,YAAY,CAAC,CAmDvB"}

package/dist/next-gate.js

@@ -0,0 +1,74 @@
+import { NextResponse as h } from "next/server";
+import { URL_HEADER as m } from "./next-bound.js";
+import { outage as p } from "./next-routes.js";
+import { AuthError as k } from "./types.js";
+function w(t) {
+  return t.slice(t.lastIndexOf("/") + 1).includes(".");
+}
+function g(t, r) {
+  return r.some((a) => t === a || t.startsWith(`${a}/`));
+}
+function b(t) {
+  const [r = "", ...a] = t.split(";").map((o) => o.trim()), c = r.indexOf("="), n = { name: r.slice(0, c), value: r.slice(c + 1) };
+  for (const o of a) {
+    const [l = "", i = ""] = o.split("=");
+    switch (l.toLowerCase()) {
+      case "path":
+        n.path = i;
+        break;
+      case "httponly":
+        n.httpOnly = !0;
+        break;
+      case "secure":
+        n.secure = !0;
+        break;
+      case "samesite":
+        n.sameSite = i.toLowerCase();
+        break;
+      case "max-age":
+        n.maxAge = Number(i);
+        break;
+    }
+  }
+  return n;
+}
+async function v(t, r, a) {
+  const { pathname: c, search: n } = r.nextUrl, o = new Headers(r.headers);
+  for (const e of [...o.keys()])
+    e.startsWith("x-kanzo-") && o.delete(e);
+  o.set(m, r.url), new Headers(a).forEach((e, s) => o.set(s, e));
+  const l = () => h.next({ request: { headers: o } });
+  if (w(c) || g(c, t.open)) return l();
+  const i = r.headers.get("sec-fetch-mode"), u = i === null || i === "navigate";
+  let f;
+  try {
+    f = await t.party.token(r.headers.get("cookie"), { renewWithin: t.renewWithin });
+  } catch (e) {
+    if (!(e instanceof k)) throw e;
+    if (e.code === "idp/unreachable" || e.code === "idp/silent") return l();
+    if (!u)
+      return new h(null, {
+        status: p(e.code) ?? 500,
+        headers: { "cache-control": "no-store" }
+      });
+    const s = new URL(t.problemPage, r.url);
+    return s.searchParams.set("code", e.code), h.redirect(s, 307);
+  }
+  if (f.ended) {
+    let e;
+    if (u) {
+      const s = new URL(`${t.basePath}/signin`, r.url);
+      s.searchParams.set("returnTo", `${c}${n}`), e = h.redirect(s, 307);
+    } else
+      e = new h(null, { status: 401, headers: { "cache-control": "no-store" } });
+    for (const s of f.cookies) e.headers.append("set-cookie", s);
+    return e;
+  }
+  const d = l();
+  for (const e of f.cookies) d.cookies.set(b(e));
+  return d;
+}
+export {
+  v as gate
+};
+//# sourceMappingURL=next-gate.js.map

package/dist/next-gate.js.map

@@ -0,0 +1 @@
+{"version":3,"file":"next-gate.js","sources":["../src/next-gate.ts"],"sourcesContent":["import { NextResponse, type NextRequest } from \"next/server\";\nimport { URL_HEADER, type Bound } from \"./next-bound\";\nimport { outage } from \"./next-routes\";\nimport type { Ended, Token } from \"./server\";\nimport { AuthError } from \"./types\";\n\n/**\n * The proxy as the session authority: WorkOS AuthKit's `authkitProxy`, which renews and enforces\n * where the URL is known, over a Duende-style session that is updated in place.\n *\n * Next 16 runs `proxy.ts` on Node and only on Node, so the edge's reason for checking a cookie's\n * mere presence is gone. This reads the record — one store read per request — and acts on it\n * before any page renders:\n *\n * - **A live session within a minute of expiry is renewed.** Under a ticket store the tokens are\n *   rewritten under the same ticket and the cookie does not change. Under the stateless store the\n *   re-sealed cookie is set with `response.cookies.set`, which Next also merges into this same\n *   request's `cookies()`, so the page renders with the session the browser will hold.\n * - **No live session** — none, forgotten by the store, or refused by the IdP, which is a realm\n *   whose SSO session went idle — **clears the cookie and asks for a sign-in.** A navigation is\n *   sent to `signin?returnTo=<path+search>`; anything else answers a bare 401, because a prefetch,\n *   a server action or an RSC fetch cannot follow a sign-in and must not start one. The Next\n *   router answers a 401 to its own fetch with a hard navigation, which comes back through here as\n *   a navigation.\n * - **A store that does not answer** sends a navigation to the problem page with its code; **an\n *   IdP that does not answer** is passed through untouched, because the session it could not renew\n *   is still the person's, and a page that renders is better than a sign-in that cannot finish.\n *\n * ## Navigation or not, by Fetch Metadata\n *\n * `Sec-Fetch-Mode` (W3C Fetch Metadata) is set by the browser and cannot be set by script:\n * `navigate` is a document load, `cors`/`no-cors`/`same-origin` is everything else. Next strips its\n * own RSC headers before the proxy sees them, so this is the one signal that survives. An absent\n * header is a client that is not a browser, or one too old to send it, and is treated as a\n * navigation — a redirect it can follow is the more useful answer.\n *\n * ## The URL, forwarded\n *\n * Every request leaves with `x-kanzo-url` set to the URL it arrived at — AuthKit's `x-url` — and\n * with every incoming `x-kanzo-*` header deleted first, so a browser cannot choose what a server\n * component reads there. `session({ required: true })` signs in back to it, and the tenant\n * resolver reads the same URL the routes do.\n */\n\n/** A path whose last segment carries a dot: a static file, not a page. */\nfunction isFile(pathname: string): boolean {\n  return pathname.slice(pathname.lastIndexOf(\"/\") + 1).includes(\".\");\n}\n\n/** On a segment boundary, so `/health` opens `/health/live` and not `/healthcare`. */\nfunction under(pathname: string, prefixes: readonly string[]): boolean {\n  return prefixes.some((prefix) => pathname === prefix || pathname.startsWith(`${prefix}/`));\n}\n\n/**\n * A `Set-Cookie` value as the attributes `response.cookies.set` takes, which is the call that makes\n * Next merge the cookie into this request's `cookies()`. A raw `Set-Cookie` header reaches the\n * browser and not the page being rendered.\n */\nfunction asCookie(header: string) {\n  const [pair = \"\", ...attributes] = header.split(\";\").map((part) => part.trim());\n  const eq = pair.indexOf(\"=\");\n  const cookie: {\n    name: string;\n    value: string;\n    path?: string;\n    httpOnly?: boolean;\n    secure?: boolean;\n    sameSite?: \"lax\" | \"strict\" | \"none\";\n    maxAge?: number;\n  } = { name: pair.slice(0, eq), value: pair.slice(eq + 1) };\n  for (const attribute of attributes) {\n    const [key = \"\", value = \"\"] = attribute.split(\"=\");\n    switch (key.toLowerCase()) {\n      case \"path\":\n        cookie.path = value;\n        break;\n      case \"httponly\":\n        cookie.httpOnly = true;\n        break;\n      case \"secure\":\n        cookie.secure = true;\n        break;\n      case \"samesite\":\n        cookie.sameSite = value.toLowerCase() as \"lax\" | \"strict\" | \"none\";\n        break;\n      case \"max-age\":\n        cookie.maxAge = Number(value);\n        break;\n    }\n  }\n  return cookie;\n}\n\nexport async function gate(\n  bound: Bound,\n  request: NextRequest,\n  extra?: HeadersInit,\n): Promise<NextResponse> {\n  const { pathname, search } = request.nextUrl;\n\n  const forwarded = new Headers(request.headers);\n  for (const name of [...forwarded.keys()]) {\n    if (name.startsWith(\"x-kanzo-\")) forwarded.delete(name);\n  }\n  forwarded.set(URL_HEADER, request.url);\n  new Headers(extra).forEach((value, name) => forwarded.set(name, value));\n  const through = () => NextResponse.next({ request: { headers: forwarded } });\n\n  if (isFile(pathname) || under(pathname, bound.open)) return through();\n\n  const mode = request.headers.get(\"sec-fetch-mode\");\n  const navigation = mode === null || mode === \"navigate\";\n\n  let held: Token | Ended;\n  try {\n    held = await bound.party.token(request.headers.get(\"cookie\"), { renewWithin: bound.renewWithin });\n  } catch (error) {\n    if (!(error instanceof AuthError)) throw error;\n    if (error.code === \"idp/unreachable\" || error.code === \"idp/silent\") return through();\n    if (!navigation) {\n      return new NextResponse(null, {\n        status: outage(error.code) ?? 500,\n        headers: { \"cache-control\": \"no-store\" },\n      });\n    }\n    const problem = new URL(bound.problemPage, request.url);\n    problem.searchParams.set(\"code\", error.code);\n    return NextResponse.redirect(problem, 307);\n  }\n\n  if (held.ended) {\n    let answer: NextResponse;\n    if (navigation) {\n      const signIn = new URL(`${bound.basePath}/signin`, request.url);\n      // `routes` confines `returnTo` to this origin before sealing it; this relies on that check\n      // rather than repeating it.\n      signIn.searchParams.set(\"returnTo\", `${pathname}${search}`);\n      answer = NextResponse.redirect(signIn, 307);\n    } else {\n      answer = new NextResponse(null, { status: 401, headers: { \"cache-control\": \"no-store\" } });\n    }\n    for (const cookie of held.cookies) answer.headers.append(\"set-cookie\", cookie);\n    return answer;\n  }\n\n  const response = through();\n  for (const cookie of held.cookies) response.cookies.set(asCookie(cookie));\n  return response;\n}\n"],"names":["isFile","pathname","under","prefixes","prefix","asCookie","header","pair","attributes","part","eq","cookie","attribute","key","value","gate","bound","request","extra","search","forwarded","name","URL_HEADER","through","NextResponse","mode","navigation","held","error","AuthError","outage","problem","answer","signIn","response"],"mappings":";;;;AA6CA,SAASA,EAAOC,GAA2B;AACzC,SAAOA,EAAS,MAAMA,EAAS,YAAY,GAAG,IAAI,CAAC,EAAE,SAAS,GAAG;AACnE;AAGA,SAASC,EAAMD,GAAkBE,GAAsC;AACrE,SAAOA,EAAS,KAAK,CAACC,MAAWH,MAAaG,KAAUH,EAAS,WAAW,GAAGG,CAAM,GAAG,CAAC;AAC3F;AAOA,SAASC,EAASC,GAAgB;AAChC,QAAM,CAACC,IAAO,IAAI,GAAGC,CAAU,IAAIF,EAAO,MAAM,GAAG,EAAE,IAAI,CAACG,MAASA,EAAK,MAAM,GACxEC,IAAKH,EAAK,QAAQ,GAAG,GACrBI,IAQF,EAAE,MAAMJ,EAAK,MAAM,GAAGG,CAAE,GAAG,OAAOH,EAAK,MAAMG,IAAK,CAAC,EAAA;AACvD,aAAWE,KAAaJ,GAAY;AAClC,UAAM,CAACK,IAAM,IAAIC,IAAQ,EAAE,IAAIF,EAAU,MAAM,GAAG;AAClD,YAAQC,EAAI,eAAY;AAAA,MACtB,KAAK;AACH,QAAAF,EAAO,OAAOG;AACd;AAAA,MACF,KAAK;AACH,QAAAH,EAAO,WAAW;AAClB;AAAA,MACF,KAAK;AACH,QAAAA,EAAO,SAAS;AAChB;AAAA,MACF,KAAK;AACH,QAAAA,EAAO,WAAWG,EAAM,YAAA;AACxB;AAAA,MACF,KAAK;AACH,QAAAH,EAAO,SAAS,OAAOG,CAAK;AAC5B;AAAA,IAAA;AAAA,EAEN;AACA,SAAOH;AACT;AAEA,eAAsBI,EACpBC,GACAC,GACAC,GACuB;AACvB,QAAM,EAAE,UAAAjB,GAAU,QAAAkB,EAAA,IAAWF,EAAQ,SAE/BG,IAAY,IAAI,QAAQH,EAAQ,OAAO;AAC7C,aAAWI,KAAQ,CAAC,GAAGD,EAAU,KAAA,CAAM;AACrC,IAAIC,EAAK,WAAW,UAAU,KAAGD,EAAU,OAAOC,CAAI;AAExD,EAAAD,EAAU,IAAIE,GAAYL,EAAQ,GAAG,GACrC,IAAI,QAAQC,CAAK,EAAE,QAAQ,CAACJ,GAAOO,MAASD,EAAU,IAAIC,GAAMP,CAAK,CAAC;AACtE,QAAMS,IAAU,MAAMC,EAAa,KAAK,EAAE,SAAS,EAAE,SAASJ,EAAA,GAAa;AAE3E,MAAIpB,EAAOC,CAAQ,KAAKC,EAAMD,GAAUe,EAAM,IAAI,EAAG,QAAOO,EAAA;AAE5D,QAAME,IAAOR,EAAQ,QAAQ,IAAI,gBAAgB,GAC3CS,IAAaD,MAAS,QAAQA,MAAS;AAE7C,MAAIE;AACJ,MAAI;AACF,IAAAA,IAAO,MAAMX,EAAM,MAAM,MAAMC,EAAQ,QAAQ,IAAI,QAAQ,GAAG,EAAE,aAAaD,EAAM,aAAa;AAAA,EAClG,SAASY,GAAO;AACd,QAAI,EAAEA,aAAiBC,GAAY,OAAMD;AACzC,QAAIA,EAAM,SAAS,qBAAqBA,EAAM,SAAS,qBAAqBL,EAAA;AAC5E,QAAI,CAACG;AACH,aAAO,IAAIF,EAAa,MAAM;AAAA,QAC5B,QAAQM,EAAOF,EAAM,IAAI,KAAK;AAAA,QAC9B,SAAS,EAAE,iBAAiB,WAAA;AAAA,MAAW,CACxC;AAEH,UAAMG,IAAU,IAAI,IAAIf,EAAM,aAAaC,EAAQ,GAAG;AACtD,WAAAc,EAAQ,aAAa,IAAI,QAAQH,EAAM,IAAI,GACpCJ,EAAa,SAASO,GAAS,GAAG;AAAA,EAC3C;AAEA,MAAIJ,EAAK,OAAO;AACd,QAAIK;AACJ,QAAIN,GAAY;AACd,YAAMO,IAAS,IAAI,IAAI,GAAGjB,EAAM,QAAQ,WAAWC,EAAQ,GAAG;AAG9D,MAAAgB,EAAO,aAAa,IAAI,YAAY,GAAGhC,CAAQ,GAAGkB,CAAM,EAAE,GAC1Da,IAASR,EAAa,SAASS,GAAQ,GAAG;AAAA,IAC5C;AACE,MAAAD,IAAS,IAAIR,EAAa,MAAM,EAAE,QAAQ,KAAK,SAAS,EAAE,iBAAiB,WAAA,GAAc;AAE3F,eAAWb,KAAUgB,EAAK,WAAgB,QAAQ,OAAO,cAAchB,CAAM;AAC7E,WAAOqB;AAAA,EACT;AAEA,QAAME,IAAWX,EAAA;AACjB,aAAWZ,KAAUgB,EAAK,QAAS,CAAAO,EAAS,QAAQ,IAAI7B,EAASM,CAAM,CAAC;AACxE,SAAOuB;AACT;"}