@kanzo-tech/auth 0.29.1 → 0.30.1

package/dist/next-session.js

@@ -1,11 +0,0 @@
-import { cookies as o } from "next/headers";
-import { cache as i } from "react";
-import { relyingParty as e } from "./server.js";
-function m(r) {
-  const t = e({ ...r, redirectUri: "" });
-  return i(async () => t.read((await o()).toString()));
-}
-export {
-  m as authSession
-};
-//# sourceMappingURL=next-session.js.map

package/dist/next-session.js.map

@@ -1 +0,0 @@
-{"version":3,"file":"next-session.js","sources":["../src/next-session.ts"],"sourcesContent":["import { cookies } from \"next/headers\";\nimport { cache } from \"react\";\nimport { relyingParty, type RelyingPartyConfig } from \"./server\";\nimport type { Session } from \"./types\";\n\n/**\n * The session a React Server Component can read, without a request object in hand.\n *\n * An RSC is handed no `Request`; `next/headers` is how it reaches the one it is rendering for, and\n * that import is what makes this module — and only this module of the three — Node-only. It is\n * also what earns the whole door its place on a subpath: *a part belongs on a subpath only if it\n * imports that subpath's engine.*\n *\n * ## Why a factory, when the call site is `await getSession()`\n *\n * The call site is preserved exactly; what moved is where the binding is made. A\n * zero-argument import would have to find its secret somewhere ambient — an environment variable\n * this package would then be naming and documenting forever — and it could never be given a\n * {@link SessionStore}, which is an object and not a string. So the consumer binds it once, in the\n * same module that already holds the config it hands {@link authRoutes}:\n *\n * ```ts\n * // auth.ts\n * export const getSession = authSession({ issuer, clientId, clientSecret, secret });\n * ```\n *\n * and every server component writes `await getSession()`. That also makes the three names of this\n * door one shape — `authRoutes`, `authSession`, `authMiddleware` are all factories over a config —\n * rather than two factories and an exception.\n *\n * ## `cache`, and what it is for\n *\n * React's `cache` scopes memoization to one request, so a page that asks in a layout, in a\n * breadcrumb and in a menu unseals the cookie once. A host that wraps its own reader does it for\n * exactly this reason. **It is dormant outside a React request scope** — `cache`\n * with no dispatcher simply calls through — which is why the test beside this file asserts the\n * answers and not the number of reads.\n */\n\n/**\n * What reading a session needs, which is strictly less than signing one in.\n *\n * `redirectUri` is absent because no authorization request is built here: {@link RelyingParty.read}\n * unseals a cookie and asks the store, and neither of those has a browser to send anywhere.\n */\nexport type AuthSessionConfig = Omit<RelyingPartyConfig, \"redirectUri\">;\n\nexport function authSession(config: AuthSessionConfig): () => Promise<Session | null> {\n  // The redirect URI is a required field of the confidential client and an unused one on this\n  // path. Naming it here rather than making it optional on `RelyingPartyConfig` keeps the type that\n  // signs people in honest: a sign-in without a redirect URI is a configuration error.\n  const auth = relyingParty({ ...config, redirectUri: \"\" });\n\n  return cache(async () => auth.read((await cookies()).toString()));\n}\n"],"names":["authSession","config","auth","relyingParty","cache","cookies"],"mappings":";;;AA+CO,SAASA,EAAYC,GAA0D;AAIpF,QAAMC,IAAOC,EAAa,EAAE,GAAGF,GAAQ,aAAa,IAAI;AAExD,SAAOG,EAAM,YAAYF,EAAK,MAAM,MAAMG,EAAA,GAAW,SAAA,CAAU,CAAC;AAClE;"}

package/dist/next-token.d.ts

@@ -1,56 +0,0 @@
-import { AuthSessionConfig } from './next-session';
-import { Token } from './server';
-/**
- * The access token a request carries, renewed when it is about to expire.
- *
- * ```ts
- * // auth.ts
- * export const getToken = authToken({ issuer, clientId, clientSecret, secret });
- *
- * // app/api/reports/route.ts
- * export async function GET(request: Request) {
- *   const held = await getToken(request.headers.get("cookie"));
- *   if (held === null) return new Response(null, { status: 401 });
- *
- *   const upstream = await fetch(REPORTS, {
- *     headers: { authorization: `Bearer ${held.accessToken}` },
- *   });
- *   const answer = new Response(upstream.body, upstream);
- *   for (const cookie of held.cookies) answer.headers.append("set-cookie", cookie);
- *   return answer;
- * }
- * ```
- *
- * This is the complement of {@link authSession}: that one answers *who*, this one answers *with
- * what*. Both are factories over the same config, for the reason `next-session.ts` gives.
- *
- * ## Why this exists at all, rather than a product reaching into the cookie
- *
- * Without it the only way to a bearer token is to rebuild the sealed cookie by hand — the same
- * name, the same `maxAge`, the same secret — and open it. That is this package's protocol,
- * reimplemented in a product, held together by nothing but two constants agreeing: change the
- * default cookie name or the default lifetime here and that product breaks in silence. A protocol
- * a consumer must re-derive is a protocol the package failed to expose.
- *
- * ## The cookie is an argument, and that is the API design
- *
- * There is no zero-argument form, and the absence is the point. **A React Server Component cannot
- * write cookies in Next**, and a renewal it dropped would not be a stale token — under the
- * rotation RFC 10017 requires, the refresh token this call spent is gone and the one it minted was
- * never persisted, so the session is over. A zero-argument form reading `next/headers` would work
- * in an RSC exactly well enough to destroy the session on the first renewal.
- *
- * So the signature asks for the `Cookie` header, which a **route handler**, a **middleware** and a
- * **server action** have and an RSC does not — and each of those can send the `Set-Cookie` that
- * comes back. An RSC that wants to know who is signed in calls {@link authSession}, which only
- * ever reads.
- *
- * ## Attaching `cookies` is not optional
- *
- * It is empty when nothing was renewed. When it is not empty it carries the only refresh token
- * still valid, and dropping it ends the session at the next renewal.
- */
-export declare function authToken(config: AuthSessionConfig): (cookie: string | null | undefined, options?: {
-    readonly renewWithin?: number;
-}) => Promise<Token | null>;
-//# sourceMappingURL=next-token.d.ts.map

package/dist/next-token.d.ts.map

@@ -1 +0,0 @@
-{"version":3,"file":"next-token.d.ts","sourceRoot":"","sources":["../src/next-token.ts"],"names":[],"mappings":"AAAA,OAAO,KAAK,EAAE,iBAAiB,EAAE,MAAM,gBAAgB,CAAC;AACxD,OAAO,EAAgB,KAAK,KAAK,EAAE,MAAM,UAAU,CAAC;AAEpD;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;GAiDG;AACH,wBAAgB,SAAS,CACvB,MAAM,EAAE,iBAAiB,GACxB,CAAC,MAAM,EAAE,MAAM,GAAG,IAAI,GAAG,SAAS,EAAE,OAAO,CAAC,EAAE;IAAE,QAAQ,CAAC,WAAW,CAAC,EAAE,MAAM,CAAA;CAAE,KAAK,OAAO,CAAC,KAAK,GAAG,IAAI,CAAC,CAM3G"}

package/dist/next-token.js

@@ -1,9 +0,0 @@
-import { relyingParty as o } from "./server.js";
-function u(r) {
-  const t = o({ ...r, redirectUri: "" });
-  return (e, n) => t.token(e, n);
-}
-export {
-  u as authToken
-};
-//# sourceMappingURL=next-token.js.map

package/dist/next-token.js.map

@@ -1 +0,0 @@
-{"version":3,"file":"next-token.js","sources":["../src/next-token.ts"],"sourcesContent":["import type { AuthSessionConfig } from \"./next-session\";\nimport { relyingParty, type Token } from \"./server\";\n\n/**\n * The access token a request carries, renewed when it is about to expire.\n *\n * ```ts\n * // auth.ts\n * export const getToken = authToken({ issuer, clientId, clientSecret, secret });\n *\n * // app/api/reports/route.ts\n * export async function GET(request: Request) {\n *   const held = await getToken(request.headers.get(\"cookie\"));\n *   if (held === null) return new Response(null, { status: 401 });\n *\n *   const upstream = await fetch(REPORTS, {\n *     headers: { authorization: `Bearer ${held.accessToken}` },\n *   });\n *   const answer = new Response(upstream.body, upstream);\n *   for (const cookie of held.cookies) answer.headers.append(\"set-cookie\", cookie);\n *   return answer;\n * }\n * ```\n *\n * This is the complement of {@link authSession}: that one answers *who*, this one answers *with\n * what*. Both are factories over the same config, for the reason `next-session.ts` gives.\n *\n * ## Why this exists at all, rather than a product reaching into the cookie\n *\n * Without it the only way to a bearer token is to rebuild the sealed cookie by hand — the same\n * name, the same `maxAge`, the same secret — and open it. That is this package's protocol,\n * reimplemented in a product, held together by nothing but two constants agreeing: change the\n * default cookie name or the default lifetime here and that product breaks in silence. A protocol\n * a consumer must re-derive is a protocol the package failed to expose.\n *\n * ## The cookie is an argument, and that is the API design\n *\n * There is no zero-argument form, and the absence is the point. **A React Server Component cannot\n * write cookies in Next**, and a renewal it dropped would not be a stale token — under the\n * rotation RFC 10017 requires, the refresh token this call spent is gone and the one it minted was\n * never persisted, so the session is over. A zero-argument form reading `next/headers` would work\n * in an RSC exactly well enough to destroy the session on the first renewal.\n *\n * So the signature asks for the `Cookie` header, which a **route handler**, a **middleware** and a\n * **server action** have and an RSC does not — and each of those can send the `Set-Cookie` that\n * comes back. An RSC that wants to know who is signed in calls {@link authSession}, which only\n * ever reads.\n *\n * ## Attaching `cookies` is not optional\n *\n * It is empty when nothing was renewed. When it is not empty it carries the only refresh token\n * still valid, and dropping it ends the session at the next renewal.\n */\nexport function authToken(\n  config: AuthSessionConfig,\n): (cookie: string | null | undefined, options?: { readonly renewWithin?: number }) => Promise<Token | null> {\n  // The redirect URI is a required field of the confidential client and an unused one on this\n  // path — no authorization request is built here — for the reason `next-session.ts` spells out.\n  const auth = relyingParty({ ...config, redirectUri: \"\" });\n\n  return (cookie, options) => auth.token(cookie, options);\n}\n"],"names":["authToken","config","auth","relyingParty","cookie","options"],"mappings":";AAqDO,SAASA,EACdC,GAC2G;AAG3G,QAAMC,IAAOC,EAAa,EAAE,GAAGF,GAAQ,aAAa,IAAI;AAExD,SAAO,CAACG,GAAQC,MAAYH,EAAK,MAAME,GAAQC,CAAO;AACxD;"}

package/dist/use-organization.d.ts

@@ -1,22 +0,0 @@
-import { Organization } from './types';
-/**
- * Which organization this view is *in*, resolved per render rather than stored.
- *
- * The session says which organizations you belong to; the URL says which one you are looking at.
- * `Session` in `types.ts` carries why the second is never stored.
- *
- * `alias` names the organization explicitly; omitted, it is read from the hostname. A hostname
- * naming an organization this person does not belong to yields `organization: undefined` and
- * `isMember: false` — never a throw, and **never the first organization instead**. Falling back
- * is how someone ends up reading another customer's data believing it is their own.
- *
- * `isMember` answers about the *candidate*, so it is a different question from
- * `organizations.length > 0`: a product with one membership addressed at the wrong host is a member
- * of something and a member of nothing here.
- */
-export declare function useOrganization(alias?: string): {
-    readonly organization: Organization | undefined;
-    readonly organizations: readonly Organization[];
-    readonly isMember: boolean;
-};
-//# sourceMappingURL=use-organization.d.ts.map

package/dist/use-organization.d.ts.map

@@ -1 +0,0 @@
-{"version":3,"file":"use-organization.d.ts","sourceRoot":"","sources":["../src/use-organization.ts"],"names":[],"mappings":"AAKA,OAAO,KAAK,EAAE,YAAY,EAAE,MAAM,SAAS,CAAC;AAG5C;;;;;;;;;;;;;;GAcG;AACH,wBAAgB,eAAe,CAAC,KAAK,CAAC,EAAE,MAAM,GAAG;IAC/C,QAAQ,CAAC,YAAY,EAAE,YAAY,GAAG,SAAS,CAAC;IAChD,QAAQ,CAAC,aAAa,EAAE,SAAS,YAAY,EAAE,CAAC;IAChD,QAAQ,CAAC,QAAQ,EAAE,OAAO,CAAC;CAC5B,CAmBA"}

package/dist/use-organization.js

@@ -1,20 +0,0 @@
-"use client";
-import { useMemo as r } from "react";
-import { organizationOf as a } from "./can.js";
-import { organizationFromHost as e } from "./host.js";
-import { useSession as m } from "./use-session.js";
-function c(i) {
-  const { session: o } = m();
-  return r(() => {
-    const n = i ?? (typeof window > "u" ? void 0 : e(window.location.hostname)), t = n === void 0 ? void 0 : a(o, n);
-    return {
-      organization: t,
-      organizations: (o == null ? void 0 : o.organizations) ?? [],
-      isMember: t !== void 0
-    };
-  }, [i, o]);
-}
-export {
-  c as useOrganization
-};
-//# sourceMappingURL=use-organization.js.map

package/dist/use-organization.js.map

@@ -1 +0,0 @@
-{"version":3,"file":"use-organization.js","sources":["../src/use-organization.ts"],"sourcesContent":["\"use client\";\n\nimport { useMemo } from \"react\";\nimport { organizationOf } from \"./can\";\nimport { organizationFromHost } from \"./host\";\nimport type { Organization } from \"./types\";\nimport { useSession } from \"./use-session\";\n\n/**\n * Which organization this view is *in*, resolved per render rather than stored.\n *\n * The session says which organizations you belong to; the URL says which one you are looking at.\n * `Session` in `types.ts` carries why the second is never stored.\n *\n * `alias` names the organization explicitly; omitted, it is read from the hostname. A hostname\n * naming an organization this person does not belong to yields `organization: undefined` and\n * `isMember: false` — never a throw, and **never the first organization instead**. Falling back\n * is how someone ends up reading another customer's data believing it is their own.\n *\n * `isMember` answers about the *candidate*, so it is a different question from\n * `organizations.length > 0`: a product with one membership addressed at the wrong host is a member\n * of something and a member of nothing here.\n */\nexport function useOrganization(alias?: string): {\n  readonly organization: Organization | undefined;\n  readonly organizations: readonly Organization[];\n  readonly isMember: boolean;\n} {\n  const { session } = useSession();\n\n  return useMemo(() => {\n    // Read at render, and undefined on a server. There is no hydration mismatch to manage: the\n    // session itself arrives in the provider's effect, so the server render and the first client\n    // render both resolve against `null` and agree whatever the hostname says.\n    const candidate =\n      alias ??\n      (typeof window === \"undefined\" ? undefined : organizationFromHost(window.location.hostname));\n\n    const organization = candidate === undefined ? undefined : organizationOf(session, candidate);\n\n    return {\n      organization,\n      organizations: session?.organizations ?? [],\n      isMember: organization !== undefined,\n    };\n  }, [alias, session]);\n}\n"],"names":[],"mappings":";;;;;AAuBO;AAKL;AAEA;AAIE;AAMA;AAAO;AACL;AACyC;AACd;AAAA;AAGjC;;;;"}