@kirill.konshin/auth 0.0.1

package/README.md

@@ -0,0 +1,199 @@
+# @kirill.konshin/auth
+
+Reusable [iron-session](https://github.com/vvo/iron-session) authentication for Next.js App Router. Consolidates the session module, layout/page guards, login flow, Route Handler guards and `proxy.ts` guard into one factory.
+
+iron-session v8 has no official Next helpers (they were removed with the Pages Router) and no trustworthy third-party ones exist — this package is that layer.
+
+```bash
+yarn add @kirill.konshin/auth iron-session server-only
+```
+
+# Rules
+
+- ALWAYS use this package for authentication in Next.js apps, NEVER hand-roll `iron-session` wrappers
+- ONE auth instance per app in `src/auth.ts`: `createPasswordAuth` (password-protected admin) or `createAuth` (token/OAuth)
+- Pass Next's `Route` as the routes generic (`createPasswordAuth<Route>` / `createAuth<Session, Route>`) so `urls` and the return-URL helpers are type-checked (`typedRoutes` is set by `defineNextConfig`)
+- Auth module MUST start with `import 'server-only'` and MUST NOT be module-level `'use server'` (that would expose session getters as callable server actions) — export `loginAction`/`logoutAction` from the SAME module as thin wrappers with function-level `'use server'`, no separate `actions.ts`; ENFORCED BY AGENT: no ESLint rule checks this, add on creation, flag on review
+- Client Components MUST NOT import the auth module — Server Components pass `loginAction`/`logoutAction` down as props
+- Cookie name MUST be unique per app (`<app>_session`), NEVER generic `session`
+- Cookie secret `SESSION_SECRET` (≥32 chars) and login password `ADMIN_PASSWORD` are SEPARATE env vars, never reuse one for the other
+- NEVER compare passwords with `===`, use `verifyPassword` / `timingSafeEqualStrings` (timing-safe)
+- Guard pages/layouts with `redirectNonAuthenticated()` (redirects to login), Server Actions and Route Handlers with `throwNonAuthenticated()` or `authenticatedRouteHandler()` (401), the whole `/api` surface with `proxyGuard()` in `proxy.ts`, login page with `redirectIfAuthenticated()`
+- Login page is ONE Server Component file with `<form action={loginAction}>` — errors return via the `?error=` search param; a Client Component (`useActionState` + `loginFormAction`) ONLY for pending/inline-error UI
+- Reuse `auth.urls.*` (resolved, defaults applied) instead of repeating route literals, e.g. `redirect(auth.urls.afterLogin)`
+- Declare API visibility as `urls.public` / `urls.protected` globs and keep them exhaustive — `proxyGuard()` throws on overlap and warns (treating as public) on unknown paths; `allow` is only for request-level tweaks
+- Session lifetime via `ttl` (seconds) ONLY, NEVER set `cookieOptions.maxAge` (iron-session derives it)
+- Logout via `auth.logout()` (destroy + redirect)
+- Preserve the return URL through the `state` search param / hidden form field on login redirects; ALWAYS extract it with `auth.getState()` (accepts `await searchParams`, `URLSearchParams`, `FormData`, `NextRequest`, raw string; allows internal paths only, never the login page, falls back to `urls.afterLogin` so the result is always usable), NEVER hand-parse `state`
+- NEVER store the return URL in the session — concurrent tabs share the cookie and would clash; it is threaded exclusively via search params, form fields and the `x-pathname` request header
+
+# Environment Variables
+
+| Variable         | Purpose                                 | Required                                  |
+| ---------------- | --------------------------------------- | ----------------------------------------- |
+| `SESSION_SECRET` | Cookie sealing secret, min 32 chars     | yes (or `secret` config)                  |
+| `ADMIN_PASSWORD` | Login password for `createPasswordAuth` | password auth only (or `password` config) |
+
+# Canonical Patterns
+
+Adapt paths (`/login`, `/app`, `@/auth`) to the project; keep the structure.
+
+## Session module — `src/auth.ts`
+
+Password-protected app (admin dashboards, single-user tools):
+
+```ts
+import 'server-only';
+
+import { createPasswordAuth } from '@kirill.konshin/auth';
+import type { Route } from 'next';
+
+// <Route> makes urls and all return-URL helpers type-checked against real routes (typedRoutes)
+export const auth = createPasswordAuth<Route>({
+    cookieName: 'myapp_session',
+    urls: {
+        login: '/login',
+        afterLogin: '/app',
+        public: ['/api/tiles/**', '/app/**'], // proxyGuard passes these; /app/** is enforced by its layout
+        protected: ['/api/admin/**'], // proxyGuard requires a session here
+    },
+});
+
+// Server actions live HERE, no separate actions.ts: the function-level 'use server' registers them
+// in this app's build (a plain re-export would not — registration cannot happen in library code,
+// and library closures are not serializable)
+export const loginAction: typeof auth.loginAction = async (...args) => {
+    'use server';
+    return auth.loginAction(...args); // plain <form action>: errors go back via ?error= search param
+};
+
+export const logoutAction: typeof auth.logout = async (...args) => {
+    'use server';
+    return auth.logout(...args); // usable directly as <form action>, a FormData argument is ignored
+};
+```
+
+Client Components can NEVER import this module (`server-only`, and function-level actions are not client-importable) — Server Components (pages/layouts) pass `loginAction`/`logoutAction` down as props.
+
+Token/OAuth session (custom shape + own `isValid`; the default checks the lib-owned `AUTHENTICATED` marker that `login()` sets — nothing to configure for password auth):
+
+```ts
+import 'server-only';
+
+import { createAuth } from '@kirill.konshin/auth';
+import type { Route } from 'next';
+
+export type Session = { accessToken?: string; refreshToken?: string; expiresAt?: number };
+
+export const auth = createAuth<Session, Route>({
+    cookieName: 'myapp_session',
+    urls: { login: '/login', afterLogin: '/app' },
+    isValid: (session) => Boolean(session.accessToken && (!session.expiresAt || session.expiresAt > Date.now())),
+});
+```
+
+App-specific logic (e.g. OAuth token refresh) composes on top: `auth.setSession(await refreshToken(...))`, `auth.destroySession()` on refresh failure; add the same `logoutAction` wrapper as above (`loginFormAction` is password auth only).
+
+## Protected layout — `app/(auth)/layout.tsx` or `app/app/layout.tsx`
+
+```tsx
+import { auth } from '@/auth';
+
+export default async function Layout({ children }: LayoutProps<'/app'>) {
+    await auth.redirectNonAuthenticated(); // redirects to urls.login
+    return <>{children}</>;
+}
+```
+
+The deep current pathname is recovered automatically from the `x-pathname` header that `proxyGuard` stamps (cover page routes in the proxy matcher); without it login lands on `urls.afterLogin`. The login page MUST live OUTSIDE the guarded layout — the guard would redirect to itself; `urls.afterLogin` pointing at the login page throws at creation.
+
+Route Handlers are not protected by layouts — guard them separately (below).
+
+## Login page — `app/login/page.tsx`
+
+The whole login flow is ONE Server Component file — the form posts `loginAction` directly, failures come back as the `?error=` search param:
+
+```tsx
+import { auth, loginAction } from '@/auth';
+
+export default async function LoginPage({ searchParams }: PageProps<'/login'>) {
+    const params = await searchParams;
+    const state = auth.getState(params);
+    await auth.redirectIfAuthenticated(state);
+
+    return (
+        <form action={loginAction}>
+            {typeof params.error === 'string' && <p>{params.error}</p>}
+            <input type="hidden" name="state" value={state} />
+            <input type="password" name="password" required autoFocus />
+            <button type="submit">Login</button>
+        </form>
+    );
+}
+```
+
+A Client Component is only justified when it adds something — pending spinners, inline validation. Then wrap `auth.loginFormAction` (the `useActionState` variant that RETURNS the error instead of redirecting) and pass it down as a prop:
+
+```tsx
+'use client';
+// <LoginForm loginAction={loginFormAction} state={state} /> rendered by the page above
+import type { PasswordAuth } from '@kirill.konshin/auth';
+import { useActionState } from 'react';
+
+export function LoginForm({ loginAction, state }: { loginAction: PasswordAuth['loginFormAction']; state?: string }) {
+    const [error, action, isPending] = useActionState(loginAction, null);
+    // same form; disable the button with isPending, render {error} inline
+}
+```
+
+Admin login screens use MUI + `@toolpad/core` `SignInPage` per project rules — pass `loginFormAction` results into its `signIn` callback.
+
+## Route Handler — `app/api/*/route.ts`
+
+```ts
+import { auth } from '@/auth';
+
+export const GET = auth.authenticatedRouteHandler(async () => Response.json(await loadData()));
+```
+
+Inside Server Actions use `await auth.throwNonAuthenticated()` (throws `Unauthorized`) instead.
+
+## Proxy guard (whole `/api` surface) — `src/proxy.ts`
+
+```ts
+import { auth } from '@/auth';
+
+export const config = { matcher: ['/api/:path*', '/app/:path*'] }; // literal, statically parsed by Next.js
+
+export const proxy = auth.proxyGuard({ matcher: config.matcher });
+```
+
+Next.js statically parses `proxy.ts`: `config` MUST be a literal object and the handler a visible function export — neither can be destructured from a runtime value. The matcher may be BROADER than the `urls` globs, but must cover them all: `proxyGuard` verifies the supplied `matcher` at creation and THROWS on uncovered globs (paths outside the matcher never reach the proxy at all). Omit `matcher`/`config` entirely to run the guard on every path.
+
+The guard classifies each request by the `urls.public` / `urls.protected` globs: public passes without a session, protected gets the session check (`503` unconfigured / `401` unauthenticated), a path matching BOTH sets throws (config error), a path matching NEITHER logs a warning and passes as public — keep the glob lists exhaustive. Without any globs everything behind the matcher is protected. `allow: (request) => boolean` remains as an extra request-level bypass.
+
+Every forwarded request is stamped with the `x-pathname` header (`PATHNAME_HEADER`) so `redirectNonAuthenticated()` in layouts can return users to the page they were on. List page routes in `urls.public` and cover them in the matcher: the session there is enforced by the layout (a `401` JSON would be wrong for pages), the guard only stamps the header.
+
+# Migration From Hand-Rolled Modules
+
+| Old pattern                                                  | Replacement                                               |
+| ------------------------------------------------------------ | --------------------------------------------------------- |
+| `getIronSession(await cookies(), sessionOptions)` wrapper    | `auth.getSession()`                                       |
+| `isLoggedIn()` / `isAdminAuthenticated()` / `getToken()`     | `auth.isAuthenticated()`                                  |
+| `ensureAuth()` / `requireAdminSession()` (throwing)          | `auth.throwNonAuthenticated()`                            |
+| `authError()` returning a `401 Response`                     | `auth.authenticatedRouteHandler(handler)`                 |
+| Layout `if (!token) redirect('/login?state=...')`            | `auth.redirectNonAuthenticated()`                         |
+| Login page `if (loggedIn) redirect(...)`                     | `auth.redirectIfAuthenticated(state)`                     |
+| Hand-written `proxy.ts` / `middleware.ts` session check      | `auth.proxyGuard({ allow })`                              |
+| `session.destroy(); redirect('/login')`                      | `auth.logout()`                                           |
+| `password === candidate`                                     | `auth.verifyPassword(candidate)`                          |
+| `ttl` / `cookieOptions.maxAge` juggling                      | `ttl` config in seconds, nothing else                     |
+| `'use server'` on the session module / separate `actions.ts` | function-level `'use server'` wrappers in the auth module |
+| `SESSION_PASSWORD` / `PASSWORD` env vars                     | `SESSION_SECRET` + `ADMIN_PASSWORD`                       |
+| `loginState(state)` / `typeof state === 'string'` fiddling   | `auth.getState(...)`                                      |
+| Hand-rolled `x-pathname` proxy + `headers()` in layout       | built into `proxyGuard` + `redirectNonAuthenticated()`    |
+| `defaultSession` constant (unused everywhere)                | delete                                                    |
+
+Checklist after migration: unique `cookieName`, secret only in `SESSION_SECRET`, no direct `getIronSession` imports left in the app, all four surfaces guarded (layout, login, route handlers, proxy).
+
+Existing sessions: keeping the old `cookieName` and secret (both configurable) means old cookies still unseal — a session in an old shape simply fails `isValid`, so users are logged out naturally, never crash; `login()` starts a fresh session so stale fields from old shapes do not linger. A failed unseal (rotated secret) also degrades to logged-out.

package/dist/auth.d.ts

@@ -0,0 +1,148 @@
+import { IronSession, SessionOptions } from 'iron-session';
+import { NextRequest, NextResponse } from 'next/server';
+import { AUTHENTICATED } from './client/index.js';
+/** `R` is the route type — pass `Route` from `next` when `typedRoutes` is enabled */
+export type AuthUrls<R extends string = string> = {
+    /** Login page, default `/login` */
+    login?: R;
+    /** Where successful login lands when no `state` param is present, default `/` */
+    afterLogin?: R;
+    /** Where logout lands, default `urls.login` */
+    afterLogout?: R;
+    /** Path globs `proxyGuard` serves without a session, e.g. `['/api/tiles/**']` — patterns, not routes */
+    public?: string[];
+    /** Path globs `proxyGuard` requires a session for, e.g. `['/api/admin/**']` — patterns, not routes */
+    protected?: string[];
+};
+export type AuthConfig<T extends object, R extends string = string> = {
+    /** MUST be unique per app, e.g. `myapp_session`, never a generic `session` */
+    cookieName: string;
+    /**
+     * Decides whether a session counts as authenticated. Defaults to checking the lib-owned
+     * `AUTHENTICATED` marker field (set by `createPasswordAuth`'s `login`, nothing to configure) —
+     * pass your own for token/OAuth or custom shapes (e.g. access token present and not expired)
+     */
+    isValid?: (session: T) => boolean;
+    /** Cookie sealing secret, min 32 chars, defaults to `process.env.SESSION_SECRET`, NOT the login password */
+    secret?: string;
+    /** Session lifetime in SECONDS, default 7 days; cookie `maxAge` is derived from it by iron-session, never set it */
+    ttl?: number;
+    /** Merged over secure defaults: `httpOnly`, `sameSite=lax`, `path=/`, `secure` in production */
+    cookieOptions?: SessionOptions['cookieOptions'];
+    urls?: AuthUrls<NoInfer<R>>;
+    /** Called by `throwNonAuthenticated` before throwing, e.g. `unauthorized` from `next/navigation` */
+    onUnauthorized?: () => never;
+};
+export type ProxyGuardOptions = {
+    /** Public requests that skip the auth check */
+    allow?: (request: NextRequest) => boolean;
+    /**
+     * The literal `config.matcher` exported from `proxy.ts`. Validated at creation: it may be
+     * broader than the `urls.public`/`urls.protected` globs, but every glob must be covered by it —
+     * uncovered paths would bypass the proxy entirely, so a gap THROWS (config error)
+     */
+    matcher?: string | string[];
+};
+/**
+ * App Router Route Handler shape — GET/POST/etc all share it (Next.js exports no public type for
+ * route handlers, only the app-generated `RouteContext` global)
+ */
+export type RouteHandler<Context = {
+    params: Promise<Record<string, string | string[] | undefined>>;
+}> = (request: NextRequest, context: Context) => Response | Promise<Response>;
+/** Resolved `AuthUrls` with all defaults applied */
+export type ResolvedAuthUrls<R extends string = string> = {
+    login: R;
+    afterLogin: R;
+    afterLogout: R;
+    public: readonly string[];
+    protected: readonly string[];
+};
+/** Anything the `state` return URL can be extracted from */
+export type StateSource = string | null | undefined | URLSearchParams | FormData | NextRequest | Record<string, string | string[] | undefined>;
+export type Auth<T extends object, R extends string = string> = {
+    /** Resolved URLs with defaults applied — reuse instead of literals, e.g. `redirect(auth.urls.afterLogin)` */
+    urls: ResolvedAuthUrls<R>;
+    isValid: (session: T) => boolean;
+    /** Both secret (and password for password auth) are present and usable, does not throw */
+    isConfigured: () => boolean;
+    getSessionOptions: () => SessionOptions;
+    getSession: () => Promise<IronSession<T>>;
+    /** For proxy / middleware where `cookies()` is not available */
+    getRequestSession: (request: Request, response: Response) => Promise<IronSession<T>>;
+    isAuthenticated: () => Promise<boolean>;
+    /** For Server Actions and Route Handlers: throws `Unauthorized` (or calls `onUnauthorized`) */
+    throwNonAuthenticated: () => Promise<IronSession<T>>;
+    /**
+     * For layouts and pages: redirects to `urls.login`, preserving `state` in the URL.
+     * Without it the current pathname is recovered from the `x-pathname` header (stamped by
+     * `proxyGuard` when its matcher covers page routes), falling back to `urls.afterLogin` where
+     * login lands anyway
+     */
+    redirectNonAuthenticated: (state?: R) => Promise<IronSession<T>>;
+    /** For the login page: redirects away when already authenticated */
+    redirectIfAuthenticated: (redirectTo?: R) => Promise<void>;
+    /**
+     * Extracts and sanitizes the `state` return URL from `await searchParams`, `URLSearchParams`,
+     * `FormData`, a `NextRequest` or a raw value: internal paths only (no open redirects), never
+     * the login page itself (no redirect loops); falls back to `urls.afterLogin` when absent or
+     * unsafe, so the result is always a usable target
+     */
+    getState: (source?: StateSource) => R;
+    /** Merges data into the session and saves it */
+    setSession: (data: Partial<T>) => Promise<IronSession<T>>;
+    destroySession: () => Promise<void>;
+    /**
+     * Destroys the session and redirects to `redirectTo ?? urls.afterLogout ?? urls.login`. Usable
+     * directly as a `<form action>` — a `FormData` argument is ignored. Expose through a
+     * function-level `'use server'` wrapper in the auth module (see README): action registration
+     * must happen in app code, a plain re-export is not registered
+     */
+    logout: (redirectTo?: R | FormData) => Promise<void>;
+    /** Wraps a Route Handler (any method — GET/POST/etc share one shape), responds `401` JSON when not authenticated */
+    authenticatedRouteHandler: <Context = {
+        params: Promise<Record<string, string | string[] | undefined>>;
+    }>(handler: RouteHandler<Context>) => RouteHandler<Context>;
+    /**
+     * The `proxy.ts` handler: `export const config = { matcher: [...] };` (a LITERAL — Next.js
+     * parses it statically) then `export const proxy = auth.proxyGuard({ matcher: config.matcher });`.
+     * The handler classifies requests by `urls.public` / `urls.protected` globs: public passes
+     * without a session, protected responds `503` when unconfigured and `401` JSON when not
+     * authenticated, a path matching BOTH glob sets throws (config error), a path matching NEITHER
+     * logs a warning and passes as public. Without any globs everything is protected. `allow` is an
+     * extra request-level bypass checked first. The supplied `matcher` is verified to cover all
+     * globs (it may be broader) — an uncovered glob throws at creation (config error)
+     */
+    proxyGuard: (options?: ProxyGuardOptions) => (request: NextRequest) => Promise<NextResponse>;
+};
+export type PasswordSession = {
+    [AUTHENTICATED]?: boolean;
+};
+export type PasswordAuthConfig<R extends string = string> = Omit<AuthConfig<PasswordSession, R>, 'isValid'> & {
+    /** Login password, defaults to `process.env.ADMIN_PASSWORD`, NOT the cookie secret */
+    password?: string;
+};
+export type PasswordAuth<R extends string = string> = Auth<PasswordSession, R> & {
+    /** Timing-safe, never compare passwords with `===` */
+    verifyPassword: (candidate: unknown) => boolean;
+    /** Verifies the password and marks the session logged in */
+    login: (candidate: unknown) => Promise<boolean>;
+    /**
+     * Plain `<form action>` for a Server-Component-only login page (the recommended pattern):
+     * expects `password` (and optional `state` return URL) form fields; on failure redirects back
+     * to `urls.login` with `?error=` (+ `state`), on success to `state` or `urls.afterLogin`.
+     * Expose through a function-level `'use server'` wrapper in the auth module (see README)
+     */
+    loginAction: (formData: FormData) => Promise<void>;
+    /**
+     * `useActionState` variant returning the error message instead of redirecting on failure — only
+     * for client components that need pending/error UI (or Toolpad `SignInPage`). Same wrapper rule
+     */
+    loginFormAction: (prevState: string | null | undefined, formData: FormData) => Promise<string>;
+};
+export declare const MIN_SECRET_LENGTH = 32;
+/** Constant-time string comparison via SHA-256 digests, safe for values of different lengths */
+export declare const timingSafeEqualStrings: (a: string, b: string) => boolean;
+export declare function createAuth<T extends object = PasswordSession, R extends string = string>(config: AuthConfig<T, R>): Auth<T, R>;
+export declare function createPasswordAuth<R extends string = string>(config: PasswordAuthConfig<R>): PasswordAuth<R>;
+//# sourceMappingURL=auth.d.ts.map

package/dist/auth.d.ts.map

@@ -0,0 +1 @@
+{"version":3,"file":"auth.d.ts","sourceRoot":"","sources":["../src/auth.ts"],"names":[],"mappings":"AACA,OAAO,EAAkB,KAAK,WAAW,EAAE,KAAK,cAAc,EAAE,MAAM,cAAc,CAAC;AAGrF,OAAO,EAAE,KAAK,WAAW,EAAE,YAAY,EAAE,MAAM,aAAa,CAAC;AAG7D,OAAO,EAAE,aAAa,EAA6C,MAAM,UAAU,CAAC;AAEpF,qFAAqF;AACrF,MAAM,MAAM,QAAQ,CAAC,CAAC,SAAS,MAAM,GAAG,MAAM,IAAI;IAC9C,mCAAmC;IACnC,KAAK,CAAC,EAAE,CAAC,CAAC;IACV,iFAAiF;IACjF,UAAU,CAAC,EAAE,CAAC,CAAC;IACf,+CAA+C;IAC/C,WAAW,CAAC,EAAE,CAAC,CAAC;IAChB,wGAAwG;IACxG,MAAM,CAAC,EAAE,MAAM,EAAE,CAAC;IAClB,sGAAsG;IACtG,SAAS,CAAC,EAAE,MAAM,EAAE,CAAC;CACxB,CAAC;AAEF,MAAM,MAAM,UAAU,CAAC,CAAC,SAAS,MAAM,EAAE,CAAC,SAAS,MAAM,GAAG,MAAM,IAAI;IAClE,8EAA8E;IAC9E,UAAU,EAAE,MAAM,CAAC;IACnB;;;;OAIG;IACH,OAAO,CAAC,EAAE,CAAC,OAAO,EAAE,CAAC,KAAK,OAAO,CAAC;IAClC,4GAA4G;IAC5G,MAAM,CAAC,EAAE,MAAM,CAAC;IAChB,oHAAoH;IACpH,GAAG,CAAC,EAAE,MAAM,CAAC;IACb,gGAAgG;IAChG,aAAa,CAAC,EAAE,cAAc,CAAC,eAAe,CAAC,CAAC;IAEhD,IAAI,CAAC,EAAE,QAAQ,CAAC,OAAO,CAAC,CAAC,CAAC,CAAC,CAAC;IAC5B,oGAAoG;IACpG,cAAc,CAAC,EAAE,MAAM,KAAK,CAAC;CAChC,CAAC;AAEF,MAAM,MAAM,iBAAiB,GAAG;IAC5B,+CAA+C;IAC/C,KAAK,CAAC,EAAE,CAAC,OAAO,EAAE,WAAW,KAAK,OAAO,CAAC;IAC1C;;;;OAIG;IACH,OAAO,CAAC,EAAE,MAAM,GAAG,MAAM,EAAE,CAAC;CAC/B,CAAC;AAEF;;;GAGG;AACH,MAAM,MAAM,YAAY,CAAC,OAAO,GAAG;IAAE,MAAM,EAAE,OAAO,CAAC,MAAM,CAAC,MAAM,EAAE,MAAM,GAAG,MAAM,EAAE,GAAG,SAAS,CAAC,CAAC,CAAA;CAAE,IAAI,CACrG,OAAO,EAAE,WAAW,EACpB,OAAO,EAAE,OAAO,KACf,QAAQ,GAAG,OAAO,CAAC,QAAQ,CAAC,CAAC;AAElC,oDAAoD;AACpD,MAAM,MAAM,gBAAgB,CAAC,CAAC,SAAS,MAAM,GAAG,MAAM,IAAI;IACtD,KAAK,EAAE,CAAC,CAAC;IACT,UAAU,EAAE,CAAC,CAAC;IACd,WAAW,EAAE,CAAC,CAAC;IACf,MAAM,EAAE,SAAS,MAAM,EAAE,CAAC;IAC1B,SAAS,EAAE,SAAS,MAAM,EAAE,CAAC;CAChC,CAAC;AAEF,4DAA4D;AAC5D,MAAM,MAAM,WAAW,GACjB,MAAM,GACN,IAAI,GACJ,SAAS,GACT,eAAe,GACf,QAAQ,GACR,WAAW,GACX,MAAM,CAAC,MAAM,EAAE,MAAM,GAAG,MAAM,EAAE,GAAG,SAAS,CAAC,CAAC;AAEpD,MAAM,MAAM,IAAI,CAAC,CAAC,SAAS,MAAM,EAAE,CAAC,SAAS,MAAM,GAAG,MAAM,IAAI;IAC5D,6GAA6G;IAC7G,IAAI,EAAE,gBAAgB,CAAC,CAAC,CAAC,CAAC;IAC1B,OAAO,EAAE,CAAC,OAAO,EAAE,CAAC,KAAK,OAAO,CAAC;IACjC,0FAA0F;IAC1F,YAAY,EAAE,MAAM,OAAO,CAAC;IAC5B,iBAAiB,EAAE,MAAM,cAAc,CAAC;IACxC,UAAU,EAAE,MAAM,OAAO,CAAC,WAAW,CAAC,CAAC,CAAC,CAAC,CAAC;IAC1C,gEAAgE;IAChE,iBAAiB,EAAE,CAAC,OAAO,EAAE,OAAO,EAAE,QAAQ,EAAE,QAAQ,KAAK,OAAO,CAAC,WAAW,CAAC,CAAC,CAAC,CAAC,CAAC;IACrF,eAAe,EAAE,MAAM,OAAO,CAAC,OAAO,CAAC,CAAC;IACxC,+FAA+F;IAC/F,qBAAqB,EAAE,MAAM,OAAO,CAAC,WAAW,CAAC,CAAC,CAAC,CAAC,CAAC;IACrD;;;;;OAKG;IACH,wBAAwB,EAAE,CAAC,KAAK,CAAC,EAAE,CAAC,KAAK,OAAO,CAAC,WAAW,CAAC,CAAC,CAAC,CAAC,CAAC;IACjE,oEAAoE;IACpE,uBAAuB,EAAE,CAAC,UAAU,CAAC,EAAE,CAAC,KAAK,OAAO,CAAC,IAAI,CAAC,CAAC;IAC3D;;;;;OAKG;IACH,QAAQ,EAAE,CAAC,MAAM,CAAC,EAAE,WAAW,KAAK,CAAC,CAAC;IACtC,gDAAgD;IAChD,UAAU,EAAE,CAAC,IAAI,EAAE,OAAO,CAAC,CAAC,CAAC,KAAK,OAAO,CAAC,WAAW,CAAC,CAAC,CAAC,CAAC,CAAC;IAC1D,cAAc,EAAE,MAAM,OAAO,CAAC,IAAI,CAAC,CAAC;IACpC;;;;;OAKG;IACH,MAAM,EAAE,CAAC,UAAU,CAAC,EAAE,CAAC,GAAG,QAAQ,KAAK,OAAO,CAAC,IAAI,CAAC,CAAC;IACrD,oHAAoH;IACpH,yBAAyB,EAAE,CAAC,OAAO,GAAG;QAAE,MAAM,EAAE,OAAO,CAAC,MAAM,CAAC,MAAM,EAAE,MAAM,GAAG,MAAM,EAAE,GAAG,SAAS,CAAC,CAAC,CAAA;KAAE,EACpG,OAAO,EAAE,YAAY,CAAC,OAAO,CAAC,KAC7B,YAAY,CAAC,OAAO,CAAC,CAAC;IAC3B;;;;;;;;;OASG;IACH,UAAU,EAAE,CAAC,OAAO,CAAC,EAAE,iBAAiB,KAAK,CAAC,OAAO,EAAE,WAAW,KAAK,OAAO,CAAC,YAAY,CAAC,CAAC;CAChG,CAAC;AAEF,MAAM,MAAM,eAAe,GAAG;IAAE,CAAC,aAAa,CAAC,CAAC,EAAE,OAAO,CAAA;CAAE,CAAC;AAE5D,MAAM,MAAM,kBAAkB,CAAC,CAAC,SAAS,MAAM,GAAG,MAAM,IAAI,IAAI,CAAC,UAAU,CAAC,eAAe,EAAE,CAAC,CAAC,EAAE,SAAS,CAAC,GAAG;IAC1G,sFAAsF;IACtF,QAAQ,CAAC,EAAE,MAAM,CAAC;CACrB,CAAC;AAEF,MAAM,MAAM,YAAY,CAAC,CAAC,SAAS,MAAM,GAAG,MAAM,IAAI,IAAI,CAAC,eAAe,EAAE,CAAC,CAAC,GAAG;IAC7E,sDAAsD;IACtD,cAAc,EAAE,CAAC,SAAS,EAAE,OAAO,KAAK,OAAO,CAAC;IAChD,4DAA4D;IAC5D,KAAK,EAAE,CAAC,SAAS,EAAE,OAAO,KAAK,OAAO,CAAC,OAAO,CAAC,CAAC;IAChD;;;;;OAKG;IACH,WAAW,EAAE,CAAC,QAAQ,EAAE,QAAQ,KAAK,OAAO,CAAC,IAAI,CAAC,CAAC;IACnD;;;OAGG;IACH,eAAe,EAAE,CAAC,SAAS,EAAE,MAAM,GAAG,IAAI,GAAG,SAAS,EAAE,QAAQ,EAAE,QAAQ,KAAK,OAAO,CAAC,MAAM,CAAC,CAAC;CAClG,CAAC;AAEF,eAAO,MAAM,iBAAiB,KAAK,CAAC;AAMpC,gGAAgG;AAChG,eAAO,MAAM,sBAAsB,GAAI,GAAG,MAAM,EAAE,GAAG,MAAM,KAAG,OAAgD,CAAC;AA0B/G,wBAAgB,UAAU,CAAC,CAAC,SAAS,MAAM,GAAG,eAAe,EAAE,CAAC,SAAS,MAAM,GAAG,MAAM,EACpF,MAAM,EAAE,UAAU,CAAC,CAAC,EAAE,CAAC,CAAC,GACzB,IAAI,CAAC,CAAC,EAAE,CAAC,CAAC,CAkLZ;AAED,wBAAgB,kBAAkB,CAAC,CAAC,SAAS,MAAM,GAAG,MAAM,EAAE,MAAM,EAAE,kBAAkB,CAAC,CAAC,CAAC,GAAG,YAAY,CAAC,CAAC,CAAC,CA+C5G"}

package/dist/auth.js

@@ -0,0 +1,209 @@
+import { AUTHENTICATED, ERROR_PARAM, PATHNAME_HEADER, STATE_PARAM } from "./client/index.js";
+import { createHash, timingSafeEqual } from "node:crypto";
+import { getIronSession } from "iron-session";
+import { cookies, headers } from "next/headers";
+import { redirect } from "next/navigation";
+import { NextResponse } from "next/server";
+import picomatch from "picomatch";
+//#region src/auth.ts
+var MIN_SECRET_LENGTH = 32;
+var DEFAULT_TTL = 3600 * 24 * 7;
+var sha256 = (value) => createHash("sha256").update(value).digest();
+/** Constant-time string comparison via SHA-256 digests, safe for values of different lengths */
+var timingSafeEqualStrings = (a, b) => timingSafeEqual(sha256(a), sha256(b));
+var withParams = (url, params) => {
+	const entries = Object.entries(params).filter((entry) => Boolean(entry[1]));
+	if (!entries.length) return url;
+	return `${url}${url.includes("?") ? "&" : "?"}${new URLSearchParams(entries)}`;
+};
+var withState = (url, state) => withParams(url, { [STATE_PARAM]: state });
+var matcherToGlobs = (entry) => {
+	if (entry.endsWith("/:path*")) {
+		const prefix = entry.slice(0, -7);
+		return [prefix || "/", `${prefix}/**`];
+	}
+	return [entry.replace(/:\w+\*/g, "**").replace(/:\w+/g, "*")];
+};
+var defaultIsValid = (session) => session[AUTHENTICATED] === true;
+var expandPrefix = (glob) => glob.endsWith("/**") ? [glob, glob.slice(0, -3) || "/"] : [glob];
+function createAuth(config) {
+	const { cookieName, isValid = defaultIsValid, urls = {} } = config;
+	const loginUrl = urls.login ?? "/login";
+	const resolvedUrls = {
+		login: loginUrl,
+		afterLogin: urls.afterLogin ?? "/",
+		afterLogout: urls.afterLogout ?? loginUrl,
+		public: urls.public ?? [],
+		protected: urls.protected ?? []
+	};
+	if (loginUrl !== "/" && resolvedUrls.afterLogin.startsWith(loginUrl)) throw new Error("urls.afterLogin must not point at the login page, this would cause a redirect loop", { cause: {
+		cookieName,
+		...urls
+	} });
+	const isPublicPath = urls.public?.length ? picomatch(urls.public.flatMap(expandPrefix)) : void 0;
+	const isProtectedPath = urls.protected?.length ? picomatch(urls.protected.flatMap(expandPrefix)) : void 0;
+	const resolveSecret = () => {
+		const secret = config.secret ?? process.env.SESSION_SECRET;
+		if (!secret || secret.length < 32) throw new Error(`Session secret must be at least 32 characters, set SESSION_SECRET or pass "secret"`, { cause: { cookieName } });
+		return secret;
+	};
+	const getSessionOptions = () => ({
+		cookieName,
+		password: resolveSecret(),
+		ttl: config.ttl ?? DEFAULT_TTL,
+		cookieOptions: {
+			httpOnly: true,
+			sameSite: "lax",
+			path: "/",
+			secure: process.env.NODE_ENV === "production",
+			...config.cookieOptions
+		}
+	});
+	const isConfigured = () => {
+		try {
+			resolveSecret();
+			return true;
+		} catch {
+			return false;
+		}
+	};
+	const getSession = async () => getIronSession(await cookies(), getSessionOptions());
+	const isAuthenticated = async () => isValid(await getSession());
+	const throwNonAuthenticated = async () => {
+		const session = await getSession();
+		if (!isValid(session)) {
+			config.onUnauthorized?.();
+			throw new Error("Unauthorized");
+		}
+		return session;
+	};
+	const destroySession = async () => (await getSession()).destroy();
+	const getState = (source) => {
+		let value = source;
+		if (source instanceof URLSearchParams || source instanceof FormData) value = source.get(STATE_PARAM);
+		else if (source && typeof source === "object") value = "nextUrl" in source ? source.nextUrl.searchParams.get(STATE_PARAM) : source[STATE_PARAM];
+		if (Array.isArray(value)) value = value[0];
+		if (typeof value !== "string" || !value) return resolvedUrls.afterLogin;
+		if (!value.startsWith("/") || value.startsWith("//")) return resolvedUrls.afterLogin;
+		if (value.startsWith(loginUrl)) return resolvedUrls.afterLogin;
+		return value;
+	};
+	return {
+		urls: resolvedUrls,
+		isValid,
+		isConfigured,
+		getSessionOptions,
+		getSession,
+		getRequestSession: async (request, response) => getIronSession(request, response, getSessionOptions()),
+		isAuthenticated,
+		throwNonAuthenticated,
+		redirectNonAuthenticated: async (state) => {
+			const session = await getSession();
+			if (!isValid(session)) {
+				const target = getState(state ?? (await headers()).get("x-pathname"));
+				redirect(withState(loginUrl, target === resolvedUrls.afterLogin ? void 0 : target));
+			}
+			return session;
+		},
+		redirectIfAuthenticated: async (redirectTo) => {
+			const session = await getSession();
+			if (isValid(session)) redirect(redirectTo ?? resolvedUrls.afterLogin);
+		},
+		getState,
+		setSession: async (data) => {
+			const session = await getSession();
+			Object.assign(session, data);
+			await session.save();
+			return session;
+		},
+		destroySession,
+		logout: async (redirectTo) => {
+			await destroySession();
+			redirect((typeof redirectTo === "string" ? redirectTo : void 0) ?? resolvedUrls.afterLogout);
+		},
+		authenticatedRouteHandler: (handler) => async (request, context) => {
+			if (!await isAuthenticated()) return Response.json({ error: "Unauthorized" }, { status: 401 });
+			return handler(request, context);
+		},
+		proxyGuard: ({ allow, matcher } = {}) => {
+			if (matcher) {
+				const coveredBy = picomatch([matcher].flat().flatMap(matcherToGlobs));
+				const uncovered = [...resolvedUrls.public, ...resolvedUrls.protected].filter((glob) => !expandPrefix(glob).every((probe) => coveredBy(probe.replace("/**", "/probe"))));
+				if (uncovered.length) throw new Error("proxyGuard matcher does not cover all urls globs, these paths would bypass it", { cause: {
+					uncovered,
+					matcher,
+					cookieName
+				} });
+			}
+			return async (request) => {
+				const { pathname } = request.nextUrl;
+				const requestHeaders = new Headers(request.headers);
+				requestHeaders.set(PATHNAME_HEADER, pathname);
+				const next = () => NextResponse.next({ request: { headers: requestHeaders } });
+				if (allow?.(request)) return next();
+				if (isPublicPath || isProtectedPath) {
+					const isPublic = isPublicPath?.(pathname) ?? false;
+					const isProtected = isProtectedPath?.(pathname) ?? false;
+					if (isPublic && isProtected) throw new Error("Path matches both urls.public and urls.protected globs", { cause: {
+						pathname,
+						public: urls.public,
+						protected: urls.protected
+					} });
+					if (isPublic) return next();
+					if (!isProtected) {
+						console.warn("[AUTH] proxyGuard unknown path, treating as public", {
+							pathname,
+							cookieName
+						});
+						return next();
+					}
+				}
+				if (!isConfigured()) return NextResponse.json({ error: "Authentication is not configured" }, { status: 503 });
+				const response = next();
+				const session = await getIronSession(request, response, getSessionOptions());
+				if (isValid(session)) return response;
+				return NextResponse.json({ error: "Unauthorized" }, { status: 401 });
+			};
+		}
+	};
+}
+function createPasswordAuth(config) {
+	const auth = createAuth(config);
+	const resolvePassword = () => config.password ?? process.env.ADMIN_PASSWORD;
+	const verifyPassword = (candidate) => {
+		const password = resolvePassword();
+		if (typeof candidate !== "string" || !candidate || !password) return false;
+		return timingSafeEqualStrings(candidate, password);
+	};
+	const login = async (candidate) => {
+		if (!verifyPassword(candidate)) return false;
+		await auth.destroySession();
+		await auth.setSession({ [AUTHENTICATED]: true });
+		return true;
+	};
+	const isConfigured = () => auth.isConfigured() && Boolean(resolvePassword());
+	const submitLogin = async (formData) => {
+		if (!isConfigured()) return "Authentication is not configured";
+		if (!await login(formData.get("password"))) return "Invalid password";
+		redirect(auth.getState(formData));
+	};
+	return {
+		...auth,
+		isConfigured,
+		verifyPassword,
+		login,
+		loginAction: async (formData) => {
+			const error = await submitLogin(formData);
+			const state = auth.getState(formData);
+			redirect(withParams(auth.urls.login, {
+				[ERROR_PARAM]: error,
+				[STATE_PARAM]: state === auth.urls.afterLogin ? void 0 : state
+			}));
+		},
+		loginFormAction: async (_prevState, formData) => submitLogin(formData)
+	};
+}
+//#endregion
+export { MIN_SECRET_LENGTH, createAuth, createPasswordAuth, timingSafeEqualStrings };
+
+//# sourceMappingURL=auth.js.map

package/dist/auth.js.map

@@ -0,0 +1 @@
+{"version":3,"file":"auth.js","names":[],"sources":["../src/auth.ts"],"sourcesContent":["import { createHash, timingSafeEqual } from 'node:crypto';\nimport { getIronSession, type IronSession, type SessionOptions } from 'iron-session';\nimport { cookies, headers } from 'next/headers';\nimport { redirect } from 'next/navigation';\nimport { type NextRequest, NextResponse } from 'next/server';\nimport picomatch from 'picomatch';\n\nimport { AUTHENTICATED, ERROR_PARAM, PATHNAME_HEADER, STATE_PARAM } from './client';\n\n/** `R` is the route type — pass `Route` from `next` when `typedRoutes` is enabled */\nexport type AuthUrls<R extends string = string> = {\n    /** Login page, default `/login` */\n    login?: R;\n    /** Where successful login lands when no `state` param is present, default `/` */\n    afterLogin?: R;\n    /** Where logout lands, default `urls.login` */\n    afterLogout?: R;\n    /** Path globs `proxyGuard` serves without a session, e.g. `['/api/tiles/**']` — patterns, not routes */\n    public?: string[];\n    /** Path globs `proxyGuard` requires a session for, e.g. `['/api/admin/**']` — patterns, not routes */\n    protected?: string[];\n};\n\nexport type AuthConfig<T extends object, R extends string = string> = {\n    /** MUST be unique per app, e.g. `myapp_session`, never a generic `session` */\n    cookieName: string;\n    /**\n     * Decides whether a session counts as authenticated. Defaults to checking the lib-owned\n     * `AUTHENTICATED` marker field (set by `createPasswordAuth`'s `login`, nothing to configure) —\n     * pass your own for token/OAuth or custom shapes (e.g. access token present and not expired)\n     */\n    isValid?: (session: T) => boolean;\n    /** Cookie sealing secret, min 32 chars, defaults to `process.env.SESSION_SECRET`, NOT the login password */\n    secret?: string;\n    /** Session lifetime in SECONDS, default 7 days; cookie `maxAge` is derived from it by iron-session, never set it */\n    ttl?: number;\n    /** Merged over secure defaults: `httpOnly`, `sameSite=lax`, `path=/`, `secure` in production */\n    cookieOptions?: SessionOptions['cookieOptions'];\n    // NoInfer: without it TS would narrow R to the literal urls passed here, breaking deeper paths\n    urls?: AuthUrls<NoInfer<R>>;\n    /** Called by `throwNonAuthenticated` before throwing, e.g. `unauthorized` from `next/navigation` */\n    onUnauthorized?: () => never;\n};\n\nexport type ProxyGuardOptions = {\n    /** Public requests that skip the auth check */\n    allow?: (request: NextRequest) => boolean;\n    /**\n     * The literal `config.matcher` exported from `proxy.ts`. Validated at creation: it may be\n     * broader than the `urls.public`/`urls.protected` globs, but every glob must be covered by it —\n     * uncovered paths would bypass the proxy entirely, so a gap THROWS (config error)\n     */\n    matcher?: string | string[];\n};\n\n/**\n * App Router Route Handler shape — GET/POST/etc all share it (Next.js exports no public type for\n * route handlers, only the app-generated `RouteContext` global)\n */\nexport type RouteHandler<Context = { params: Promise<Record<string, string | string[] | undefined>> }> = (\n    request: NextRequest,\n    context: Context,\n) => Response | Promise<Response>;\n\n/** Resolved `AuthUrls` with all defaults applied */\nexport type ResolvedAuthUrls<R extends string = string> = {\n    login: R;\n    afterLogin: R;\n    afterLogout: R;\n    public: readonly string[];\n    protected: readonly string[];\n};\n\n/** Anything the `state` return URL can be extracted from */\nexport type StateSource =\n    | string\n    | null\n    | undefined\n    | URLSearchParams\n    | FormData\n    | NextRequest\n    | Record<string, string | string[] | undefined>;\n\nexport type Auth<T extends object, R extends string = string> = {\n    /** Resolved URLs with defaults applied — reuse instead of literals, e.g. `redirect(auth.urls.afterLogin)` */\n    urls: ResolvedAuthUrls<R>;\n    isValid: (session: T) => boolean;\n    /** Both secret (and password for password auth) are present and usable, does not throw */\n    isConfigured: () => boolean;\n    getSessionOptions: () => SessionOptions;\n    getSession: () => Promise<IronSession<T>>;\n    /** For proxy / middleware where `cookies()` is not available */\n    getRequestSession: (request: Request, response: Response) => Promise<IronSession<T>>;\n    isAuthenticated: () => Promise<boolean>;\n    /** For Server Actions and Route Handlers: throws `Unauthorized` (or calls `onUnauthorized`) */\n    throwNonAuthenticated: () => Promise<IronSession<T>>;\n    /**\n     * For layouts and pages: redirects to `urls.login`, preserving `state` in the URL.\n     * Without it the current pathname is recovered from the `x-pathname` header (stamped by\n     * `proxyGuard` when its matcher covers page routes), falling back to `urls.afterLogin` where\n     * login lands anyway\n     */\n    redirectNonAuthenticated: (state?: R) => Promise<IronSession<T>>;\n    /** For the login page: redirects away when already authenticated */\n    redirectIfAuthenticated: (redirectTo?: R) => Promise<void>;\n    /**\n     * Extracts and sanitizes the `state` return URL from `await searchParams`, `URLSearchParams`,\n     * `FormData`, a `NextRequest` or a raw value: internal paths only (no open redirects), never\n     * the login page itself (no redirect loops); falls back to `urls.afterLogin` when absent or\n     * unsafe, so the result is always a usable target\n     */\n    getState: (source?: StateSource) => R;\n    /** Merges data into the session and saves it */\n    setSession: (data: Partial<T>) => Promise<IronSession<T>>;\n    destroySession: () => Promise<void>;\n    /**\n     * Destroys the session and redirects to `redirectTo ?? urls.afterLogout ?? urls.login`. Usable\n     * directly as a `<form action>` — a `FormData` argument is ignored. Expose through a\n     * function-level `'use server'` wrapper in the auth module (see README): action registration\n     * must happen in app code, a plain re-export is not registered\n     */\n    logout: (redirectTo?: R | FormData) => Promise<void>;\n    /** Wraps a Route Handler (any method — GET/POST/etc share one shape), responds `401` JSON when not authenticated */\n    authenticatedRouteHandler: <Context = { params: Promise<Record<string, string | string[] | undefined>> }>(\n        handler: RouteHandler<Context>,\n    ) => RouteHandler<Context>;\n    /**\n     * The `proxy.ts` handler: `export const config = { matcher: [...] };` (a LITERAL — Next.js\n     * parses it statically) then `export const proxy = auth.proxyGuard({ matcher: config.matcher });`.\n     * The handler classifies requests by `urls.public` / `urls.protected` globs: public passes\n     * without a session, protected responds `503` when unconfigured and `401` JSON when not\n     * authenticated, a path matching BOTH glob sets throws (config error), a path matching NEITHER\n     * logs a warning and passes as public. Without any globs everything is protected. `allow` is an\n     * extra request-level bypass checked first. The supplied `matcher` is verified to cover all\n     * globs (it may be broader) — an uncovered glob throws at creation (config error)\n     */\n    proxyGuard: (options?: ProxyGuardOptions) => (request: NextRequest) => Promise<NextResponse>;\n};\n\nexport type PasswordSession = { [AUTHENTICATED]?: boolean };\n\nexport type PasswordAuthConfig<R extends string = string> = Omit<AuthConfig<PasswordSession, R>, 'isValid'> & {\n    /** Login password, defaults to `process.env.ADMIN_PASSWORD`, NOT the cookie secret */\n    password?: string;\n};\n\nexport type PasswordAuth<R extends string = string> = Auth<PasswordSession, R> & {\n    /** Timing-safe, never compare passwords with `===` */\n    verifyPassword: (candidate: unknown) => boolean;\n    /** Verifies the password and marks the session logged in */\n    login: (candidate: unknown) => Promise<boolean>;\n    /**\n     * Plain `<form action>` for a Server-Component-only login page (the recommended pattern):\n     * expects `password` (and optional `state` return URL) form fields; on failure redirects back\n     * to `urls.login` with `?error=` (+ `state`), on success to `state` or `urls.afterLogin`.\n     * Expose through a function-level `'use server'` wrapper in the auth module (see README)\n     */\n    loginAction: (formData: FormData) => Promise<void>;\n    /**\n     * `useActionState` variant returning the error message instead of redirecting on failure — only\n     * for client components that need pending/error UI (or Toolpad `SignInPage`). Same wrapper rule\n     */\n    loginFormAction: (prevState: string | null | undefined, formData: FormData) => Promise<string>;\n};\n\nexport const MIN_SECRET_LENGTH = 32;\n\nconst DEFAULT_TTL = 60 * 60 * 24 * 7; // seconds, 7 days\n\nconst sha256 = (value: string): Buffer => createHash('sha256').update(value).digest();\n\n/** Constant-time string comparison via SHA-256 digests, safe for values of different lengths */\nexport const timingSafeEqualStrings = (a: string, b: string): boolean => timingSafeEqual(sha256(a), sha256(b));\n\nconst withParams = (url: string, params: Record<string, string | undefined>): string => {\n    const entries = Object.entries(params).filter((entry): entry is [string, string] => Boolean(entry[1]));\n    if (!entries.length) return url;\n    return `${url}${url.includes('?') ? '&' : '?'}${new URLSearchParams(entries)}`;\n};\n\nconst withState = (url: string, state?: string): string => withParams(url, { [STATE_PARAM]: state });\n\n// path-to-regexp matcher entry → equivalent globs, for verifying matcher coverage of urls globs\nconst matcherToGlobs = (entry: string): string[] => {\n    if (entry.endsWith('/:path*')) {\n        const prefix = entry.slice(0, -'/:path*'.length);\n        return [prefix || '/', `${prefix}/**`];\n    }\n    return [entry.replace(/:\\w+\\*/g, '**').replace(/:\\w+/g, '*')];\n};\n\n// A boolean flag inside the sealed cookie, under the lib-owned AUTHENTICATED key\nconst defaultIsValid = (session: PasswordSession): boolean => session[AUTHENTICATED] === true;\n\n// `/x/**` should behave like Next's `/x/:path*`, which also matches the bare `/x` (for the root\n// glob `/**` the bare prefix is `/`)\nconst expandPrefix = (glob: string): string[] => (glob.endsWith('/**') ? [glob, glob.slice(0, -3) || '/'] : [glob]);\n\nexport function createAuth<T extends object = PasswordSession, R extends string = string>(\n    config: AuthConfig<T, R>,\n): Auth<T, R> {\n    const { cookieName, isValid = defaultIsValid as unknown as (session: T) => boolean, urls = {} } = config;\n    const loginUrl: R = urls.login ?? ('/login' as R);\n\n    const resolvedUrls: ResolvedAuthUrls<R> = {\n        login: loginUrl,\n        afterLogin: urls.afterLogin ?? ('/' as R),\n        afterLogout: urls.afterLogout ?? loginUrl,\n        public: urls.public ?? [],\n        protected: urls.protected ?? [],\n    };\n\n    // redirectIfAuthenticated(afterLogin) on the login page would otherwise redirect to itself forever\n    if (loginUrl !== '/' && resolvedUrls.afterLogin.startsWith(loginUrl)) {\n        throw new Error('urls.afterLogin must not point at the login page, this would cause a redirect loop', {\n            cause: { cookieName, ...urls },\n        });\n    }\n\n    const isPublicPath = urls.public?.length ? picomatch(urls.public.flatMap(expandPrefix)) : undefined;\n    const isProtectedPath = urls.protected?.length ? picomatch(urls.protected.flatMap(expandPrefix)) : undefined;\n\n    const resolveSecret = (): string => {\n        const secret = config.secret ?? process.env.SESSION_SECRET;\n        if (!secret || secret.length < MIN_SECRET_LENGTH) {\n            throw new Error(\n                `Session secret must be at least ${MIN_SECRET_LENGTH} characters, set SESSION_SECRET or pass \"secret\"`,\n                { cause: { cookieName } },\n            );\n        }\n        return secret;\n    };\n\n    const getSessionOptions = (): SessionOptions => ({\n        cookieName,\n        password: resolveSecret(),\n        ttl: config.ttl ?? DEFAULT_TTL,\n        cookieOptions: {\n            httpOnly: true,\n            sameSite: 'lax',\n            path: '/',\n            secure: process.env.NODE_ENV === 'production',\n            ...config.cookieOptions,\n        },\n    });\n\n    const isConfigured = (): boolean => {\n        try {\n            resolveSecret();\n            return true;\n        } catch {\n            return false;\n        }\n    };\n\n    const getSession = async (): Promise<IronSession<T>> => getIronSession<T>(await cookies(), getSessionOptions());\n\n    const isAuthenticated = async (): Promise<boolean> => isValid(await getSession());\n\n    const throwNonAuthenticated = async (): Promise<IronSession<T>> => {\n        const session = await getSession();\n        if (!isValid(session)) {\n            config.onUnauthorized?.();\n            throw new Error('Unauthorized');\n        }\n        return session;\n    };\n\n    const destroySession = async (): Promise<void> => (await getSession()).destroy();\n\n    const getState = (source?: StateSource): R => {\n        let value: unknown = source;\n        if (source instanceof URLSearchParams || source instanceof FormData) value = source.get(STATE_PARAM);\n        else if (source && typeof source === 'object') {\n            value =\n                'nextUrl' in source\n                    ? (source as NextRequest).nextUrl.searchParams.get(STATE_PARAM)\n                    : (source as Record<string, string | string[] | undefined>)[STATE_PARAM];\n        }\n        if (Array.isArray(value)) value = value[0];\n        if (typeof value !== 'string' || !value) return resolvedUrls.afterLogin;\n        if (!value.startsWith('/') || value.startsWith('//')) return resolvedUrls.afterLogin; // internal paths only\n        if (value.startsWith(loginUrl)) return resolvedUrls.afterLogin; // never back to the login page\n        return value as R;\n    };\n\n    return {\n        urls: resolvedUrls,\n        isValid,\n        isConfigured,\n        getSessionOptions,\n        getSession,\n        getRequestSession: async (request, response) => getIronSession<T>(request, response, getSessionOptions()),\n        isAuthenticated,\n        throwNonAuthenticated,\n        redirectNonAuthenticated: async (state) => {\n            const session = await getSession();\n            if (!isValid(session)) {\n                // explicit state > pathname stamped by proxyGuard > afterLogin; getState maps\n                // unsafe values (the header is spoofable when no proxy overwrites it) to afterLogin,\n                // where login lands anyway, so the state param is dropped\n                const target = getState(state ?? (await headers()).get(PATHNAME_HEADER));\n                redirect(withState(loginUrl, target === resolvedUrls.afterLogin ? undefined : target));\n            }\n            return session;\n        },\n        redirectIfAuthenticated: async (redirectTo) => {\n            const session = await getSession();\n            if (isValid(session)) redirect(redirectTo ?? resolvedUrls.afterLogin);\n        },\n        getState,\n        setSession: async (data) => {\n            const session = await getSession();\n            Object.assign(session, data);\n            await session.save();\n            return session;\n        },\n        destroySession,\n        logout: async (redirectTo) => {\n            await destroySession();\n            redirect((typeof redirectTo === 'string' ? redirectTo : undefined) ?? resolvedUrls.afterLogout);\n        },\n        authenticatedRouteHandler: (handler) => async (request, context) => {\n            if (!(await isAuthenticated())) return Response.json({ error: 'Unauthorized' }, { status: 401 });\n            return handler(request, context);\n        },\n        proxyGuard: ({ allow, matcher }: ProxyGuardOptions = {}) => {\n            if (matcher) {\n                // every public/protected glob must be covered by the supplied matcher (which may be\n                // broader) — paths outside it never reach the proxy at all, so this is a config error\n                const coveredBy = picomatch([matcher].flat().flatMap(matcherToGlobs));\n                const uncovered = [...resolvedUrls.public, ...resolvedUrls.protected].filter(\n                    (glob) => !expandPrefix(glob).every((probe) => coveredBy(probe.replace('/**', '/probe'))),\n                );\n                if (uncovered.length) {\n                    throw new Error('proxyGuard matcher does not cover all urls globs, these paths would bypass it', {\n                        cause: { uncovered, matcher, cookieName },\n                    });\n                }\n            }\n\n            return async (request: NextRequest): Promise<NextResponse> => {\n                const { pathname } = request.nextUrl;\n\n                // stamp the pathname so redirectNonAuthenticated can recover it in layouts\n                const requestHeaders = new Headers(request.headers);\n                requestHeaders.set(PATHNAME_HEADER, pathname);\n                const next = () => NextResponse.next({ request: { headers: requestHeaders } });\n\n                if (allow?.(request)) return next();\n\n                if (isPublicPath || isProtectedPath) {\n                    const isPublic = isPublicPath?.(pathname) ?? false;\n                    const isProtected = isProtectedPath?.(pathname) ?? false;\n\n                    if (isPublic && isProtected) {\n                        throw new Error('Path matches both urls.public and urls.protected globs', {\n                            cause: { pathname, public: urls.public, protected: urls.protected },\n                        });\n                    }\n                    if (isPublic) return next();\n                    if (!isProtected) {\n                        console.warn('[AUTH] proxyGuard unknown path, treating as public', { pathname, cookieName });\n                        return next();\n                    }\n                }\n                // protected path, or no globs configured at all — everything requires a session\n\n                if (!isConfigured()) {\n                    return NextResponse.json({ error: 'Authentication is not configured' }, { status: 503 });\n                }\n                const response = next();\n                const session = await getIronSession<T>(request, response, getSessionOptions());\n                if (isValid(session)) return response;\n                return NextResponse.json({ error: 'Unauthorized' }, { status: 401 });\n            };\n        },\n    };\n}\n\nexport function createPasswordAuth<R extends string = string>(config: PasswordAuthConfig<R>): PasswordAuth<R> {\n    const auth = createAuth<PasswordSession, R>(config);\n\n    const resolvePassword = (): string | undefined => config.password ?? process.env.ADMIN_PASSWORD;\n\n    const verifyPassword = (candidate: unknown): boolean => {\n        const password = resolvePassword();\n        if (typeof candidate !== 'string' || !candidate || !password) return false;\n        return timingSafeEqualStrings(candidate, password);\n    };\n\n    const login = async (candidate: unknown): Promise<boolean> => {\n        if (!verifyPassword(candidate)) return false;\n        // fresh session: stale fields from previous session shapes (or another login) never linger\n        await auth.destroySession();\n        await auth.setSession({ [AUTHENTICATED]: true });\n        return true;\n    };\n\n    const isConfigured = (): boolean => auth.isConfigured() && Boolean(resolvePassword());\n\n    // returns the error message, redirects away on success\n    const submitLogin = async (formData: FormData): Promise<string> => {\n        if (!isConfigured()) return 'Authentication is not configured';\n        if (!(await login(formData.get('password')))) return 'Invalid password';\n        redirect(auth.getState(formData));\n    };\n\n    return {\n        ...auth,\n        isConfigured,\n        verifyPassword,\n        login,\n        loginAction: async (formData) => {\n            const error = await submitLogin(formData);\n            // back to the login page, error and return URL threaded via search params only; the\n            // state param is dropped when it adds nothing over the afterLogin default\n            const state = auth.getState(formData);\n            redirect(\n                withParams(auth.urls.login, {\n                    [ERROR_PARAM]: error,\n                    [STATE_PARAM]: state === auth.urls.afterLogin ? undefined : state,\n                }),\n            );\n        },\n        loginFormAction: async (_prevState, formData) => submitLogin(formData),\n    };\n}\n"],"mappings":";;;;;;;;AAqKA,IAAa,oBAAoB;AAEjC,IAAM,cAAc,OAAU,KAAK;AAEnC,IAAM,UAAU,UAA0B,WAAW,QAAQ,CAAC,CAAC,OAAO,KAAK,CAAC,CAAC,OAAO;;AAGpF,IAAa,0BAA0B,GAAW,MAAuB,gBAAgB,OAAO,CAAC,GAAG,OAAO,CAAC,CAAC;AAE7G,IAAM,cAAc,KAAa,WAAuD;CACpF,MAAM,UAAU,OAAO,QAAQ,MAAM,CAAC,CAAC,QAAQ,UAAqC,QAAQ,MAAM,EAAE,CAAC;CACrG,IAAI,CAAC,QAAQ,QAAQ,OAAO;CAC5B,OAAO,GAAG,MAAM,IAAI,SAAS,GAAG,IAAI,MAAM,MAAM,IAAI,gBAAgB,OAAO;AAC/E;AAEA,IAAM,aAAa,KAAa,UAA2B,WAAW,KAAK,GAAG,cAAc,MAAM,CAAC;AAGnG,IAAM,kBAAkB,UAA4B;CAChD,IAAI,MAAM,SAAS,SAAS,GAAG;EAC3B,MAAM,SAAS,MAAM,MAAM,GAAG,EAAiB;EAC/C,OAAO,CAAC,UAAU,KAAK,GAAG,OAAO,IAAI;CACzC;CACA,OAAO,CAAC,MAAM,QAAQ,WAAW,IAAI,CAAC,CAAC,QAAQ,SAAS,GAAG,CAAC;AAChE;AAGA,IAAM,kBAAkB,YAAsC,QAAQ,mBAAmB;AAIzF,IAAM,gBAAgB,SAA4B,KAAK,SAAS,KAAK,IAAI,CAAC,MAAM,KAAK,MAAM,GAAG,EAAE,KAAK,GAAG,IAAI,CAAC,IAAI;AAEjH,SAAgB,WACZ,QACU;CACV,MAAM,EAAE,YAAY,UAAU,gBAAsD,OAAO,CAAC,MAAM;CAClG,MAAM,WAAc,KAAK,SAAU;CAEnC,MAAM,eAAoC;EACtC,OAAO;EACP,YAAY,KAAK,cAAe;EAChC,aAAa,KAAK,eAAe;EACjC,QAAQ,KAAK,UAAU,CAAC;EACxB,WAAW,KAAK,aAAa,CAAC;CAClC;CAGA,IAAI,aAAa,OAAO,aAAa,WAAW,WAAW,QAAQ,GAC/D,MAAM,IAAI,MAAM,sFAAsF,EAClG,OAAO;EAAE;EAAY,GAAG;CAAK,EACjC,CAAC;CAGL,MAAM,eAAe,KAAK,QAAQ,SAAS,UAAU,KAAK,OAAO,QAAQ,YAAY,CAAC,IAAI,KAAA;CAC1F,MAAM,kBAAkB,KAAK,WAAW,SAAS,UAAU,KAAK,UAAU,QAAQ,YAAY,CAAC,IAAI,KAAA;CAEnG,MAAM,sBAA8B;EAChC,MAAM,SAAS,OAAO,UAAU,QAAQ,IAAI;EAC5C,IAAI,CAAC,UAAU,OAAO,SAAA,IAClB,MAAM,IAAI,MACN,sFACA,EAAE,OAAO,EAAE,WAAW,EAAE,CAC5B;EAEJ,OAAO;CACX;CAEA,MAAM,2BAA2C;EAC7C;EACA,UAAU,cAAc;EACxB,KAAK,OAAO,OAAO;EACnB,eAAe;GACX,UAAU;GACV,UAAU;GACV,MAAM;GACN,QAAA,QAAA,IAAA,aAAiC;GACjC,GAAG,OAAO;EACd;CACJ;CAEA,MAAM,qBAA8B;EAChC,IAAI;GACA,cAAc;GACd,OAAO;EACX,QAAQ;GACJ,OAAO;EACX;CACJ;CAEA,MAAM,aAAa,YAAqC,eAAkB,MAAM,QAAQ,GAAG,kBAAkB,CAAC;CAE9G,MAAM,kBAAkB,YAA8B,QAAQ,MAAM,WAAW,CAAC;CAEhF,MAAM,wBAAwB,YAAqC;EAC/D,MAAM,UAAU,MAAM,WAAW;EACjC,IAAI,CAAC,QAAQ,OAAO,GAAG;GACnB,OAAO,iBAAiB;GACxB,MAAM,IAAI,MAAM,cAAc;EAClC;EACA,OAAO;CACX;CAEA,MAAM,iBAAiB,aAA4B,MAAM,WAAW,EAAA,CAAG,QAAQ;CAE/E,MAAM,YAAY,WAA4B;EAC1C,IAAI,QAAiB;EACrB,IAAI,kBAAkB,mBAAmB,kBAAkB,UAAU,QAAQ,OAAO,IAAI,WAAW;OAC9F,IAAI,UAAU,OAAO,WAAW,UACjC,QACI,aAAa,SACN,OAAuB,QAAQ,aAAa,IAAI,WAAW,IAC3D,OAAyD;EAExE,IAAI,MAAM,QAAQ,KAAK,GAAG,QAAQ,MAAM;EACxC,IAAI,OAAO,UAAU,YAAY,CAAC,OAAO,OAAO,aAAa;EAC7D,IAAI,CAAC,MAAM,WAAW,GAAG,KAAK,MAAM,WAAW,IAAI,GAAG,OAAO,aAAa;EAC1E,IAAI,MAAM,WAAW,QAAQ,GAAG,OAAO,aAAa;EACpD,OAAO;CACX;CAEA,OAAO;EACH,MAAM;EACN;EACA;EACA;EACA;EACA,mBAAmB,OAAO,SAAS,aAAa,eAAkB,SAAS,UAAU,kBAAkB,CAAC;EACxG;EACA;EACA,0BAA0B,OAAO,UAAU;GACvC,MAAM,UAAU,MAAM,WAAW;GACjC,IAAI,CAAC,QAAQ,OAAO,GAAG;IAInB,MAAM,SAAS,SAAS,UAAU,MAAM,QAAQ,EAAA,CAAG,IAAA,YAAmB,CAAC;IACvE,SAAS,UAAU,UAAU,WAAW,aAAa,aAAa,KAAA,IAAY,MAAM,CAAC;GACzF;GACA,OAAO;EACX;EACA,yBAAyB,OAAO,eAAe;GAC3C,MAAM,UAAU,MAAM,WAAW;GACjC,IAAI,QAAQ,OAAO,GAAG,SAAS,cAAc,aAAa,UAAU;EACxE;EACA;EACA,YAAY,OAAO,SAAS;GACxB,MAAM,UAAU,MAAM,WAAW;GACjC,OAAO,OAAO,SAAS,IAAI;GAC3B,MAAM,QAAQ,KAAK;GACnB,OAAO;EACX;EACA;EACA,QAAQ,OAAO,eAAe;GAC1B,MAAM,eAAe;GACrB,UAAU,OAAO,eAAe,WAAW,aAAa,KAAA,MAAc,aAAa,WAAW;EAClG;EACA,4BAA4B,YAAY,OAAO,SAAS,YAAY;GAChE,IAAI,CAAE,MAAM,gBAAgB,GAAI,OAAO,SAAS,KAAK,EAAE,OAAO,eAAe,GAAG,EAAE,QAAQ,IAAI,CAAC;GAC/F,OAAO,QAAQ,SAAS,OAAO;EACnC;EACA,aAAa,EAAE,OAAO,YAA+B,CAAC,MAAM;GACxD,IAAI,SAAS;IAGT,MAAM,YAAY,UAAU,CAAC,OAAO,CAAC,CAAC,KAAK,CAAC,CAAC,QAAQ,cAAc,CAAC;IACpE,MAAM,YAAY,CAAC,GAAG,aAAa,QAAQ,GAAG,aAAa,SAAS,CAAC,CAAC,QACjE,SAAS,CAAC,aAAa,IAAI,CAAC,CAAC,OAAO,UAAU,UAAU,MAAM,QAAQ,OAAO,QAAQ,CAAC,CAAC,CAC5F;IACA,IAAI,UAAU,QACV,MAAM,IAAI,MAAM,iFAAiF,EAC7F,OAAO;KAAE;KAAW;KAAS;IAAW,EAC5C,CAAC;GAET;GAEA,OAAO,OAAO,YAAgD;IAC1D,MAAM,EAAE,aAAa,QAAQ;IAG7B,MAAM,iBAAiB,IAAI,QAAQ,QAAQ,OAAO;IAClD,eAAe,IAAI,iBAAiB,QAAQ;IAC5C,MAAM,aAAa,aAAa,KAAK,EAAE,SAAS,EAAE,SAAS,eAAe,EAAE,CAAC;IAE7E,IAAI,QAAQ,OAAO,GAAG,OAAO,KAAK;IAElC,IAAI,gBAAgB,iBAAiB;KACjC,MAAM,WAAW,eAAe,QAAQ,KAAK;KAC7C,MAAM,cAAc,kBAAkB,QAAQ,KAAK;KAEnD,IAAI,YAAY,aACZ,MAAM,IAAI,MAAM,0DAA0D,EACtE,OAAO;MAAE;MAAU,QAAQ,KAAK;MAAQ,WAAW,KAAK;KAAU,EACtE,CAAC;KAEL,IAAI,UAAU,OAAO,KAAK;KAC1B,IAAI,CAAC,aAAa;MACd,QAAQ,KAAK,sDAAsD;OAAE;OAAU;MAAW,CAAC;MAC3F,OAAO,KAAK;KAChB;IACJ;IAGA,IAAI,CAAC,aAAa,GACd,OAAO,aAAa,KAAK,EAAE,OAAO,mCAAmC,GAAG,EAAE,QAAQ,IAAI,CAAC;IAE3F,MAAM,WAAW,KAAK;IACtB,MAAM,UAAU,MAAM,eAAkB,SAAS,UAAU,kBAAkB,CAAC;IAC9E,IAAI,QAAQ,OAAO,GAAG,OAAO;IAC7B,OAAO,aAAa,KAAK,EAAE,OAAO,eAAe,GAAG,EAAE,QAAQ,IAAI,CAAC;GACvE;EACJ;CACJ;AACJ;AAEA,SAAgB,mBAA8C,QAAgD;CAC1G,MAAM,OAAO,WAA+B,MAAM;CAElD,MAAM,wBAA4C,OAAO,YAAY,QAAQ,IAAI;CAEjF,MAAM,kBAAkB,cAAgC;EACpD,MAAM,WAAW,gBAAgB;EACjC,IAAI,OAAO,cAAc,YAAY,CAAC,aAAa,CAAC,UAAU,OAAO;EACrE,OAAO,uBAAuB,WAAW,QAAQ;CACrD;CAEA,MAAM,QAAQ,OAAO,cAAyC;EAC1D,IAAI,CAAC,eAAe,SAAS,GAAG,OAAO;EAEvC,MAAM,KAAK,eAAe;EAC1B,MAAM,KAAK,WAAW,GAAG,gBAAgB,KAAK,CAAC;EAC/C,OAAO;CACX;CAEA,MAAM,qBAA8B,KAAK,aAAa,KAAK,QAAQ,gBAAgB,CAAC;CAGpF,MAAM,cAAc,OAAO,aAAwC;EAC/D,IAAI,CAAC,aAAa,GAAG,OAAO;EAC5B,IAAI,CAAE,MAAM,MAAM,SAAS,IAAI,UAAU,CAAC,GAAI,OAAO;EACrD,SAAS,KAAK,SAAS,QAAQ,CAAC;CACpC;CAEA,OAAO;EACH,GAAG;EACH;EACA;EACA;EACA,aAAa,OAAO,aAAa;GAC7B,MAAM,QAAQ,MAAM,YAAY,QAAQ;GAGxC,MAAM,QAAQ,KAAK,SAAS,QAAQ;GACpC,SACI,WAAW,KAAK,KAAK,OAAO;KACvB,cAAc;KACd,cAAc,UAAU,KAAK,KAAK,aAAa,KAAA,IAAY;GAChE,CAAC,CACL;EACJ;EACA,iBAAiB,OAAO,YAAY,aAAa,YAAY,QAAQ;CACzE;AACJ"}

package/dist/auth.test.d.ts

@@ -0,0 +1,2 @@
+export {};
+//# sourceMappingURL=auth.test.d.ts.map

package/dist/auth.test.d.ts.map

@@ -0,0 +1 @@
+{"version":3,"file":"auth.test.d.ts","sourceRoot":"","sources":["../src/auth.test.ts"],"names":[],"mappings":""}

package/dist/client/index.d.ts

@@ -0,0 +1,16 @@
+/** Name of the search param / form field carrying the return URL through the login flow */
+export declare const STATE_PARAM = "state";
+/** Name of the search param carrying the login error message (`loginAction` failure redirects) */
+export declare const ERROR_PARAM = "error";
+/**
+ * Request header `proxyGuard` stamps with the current pathname — layouts cannot see the URL, so
+ * `redirectNonAuthenticated()` reads it back to return users to the page they were on after login
+ */
+export declare const PATHNAME_HEADER = "x-pathname";
+/**
+ * Session field marking a password-authenticated session — lib-owned, collision-safe, nothing to
+ * configure. A string constant and NOT a JS `Symbol`: iron-session JSON-serializes the session
+ * into the sealed cookie, symbol-keyed fields would be silently dropped
+ */
+export declare const AUTHENTICATED = "__authenticated";
+//# sourceMappingURL=index.d.ts.map

package/dist/client/index.d.ts.map

@@ -0,0 +1 @@
+{"version":3,"file":"index.d.ts","sourceRoot":"","sources":["../../src/client/index.ts"],"names":[],"mappings":"AAGA,2FAA2F;AAC3F,eAAO,MAAM,WAAW,UAAU,CAAC;AAEnC,kGAAkG;AAClG,eAAO,MAAM,WAAW,UAAU,CAAC;AAEnC;;;GAGG;AACH,eAAO,MAAM,eAAe,eAAe,CAAC;AAE5C;;;;GAIG;AACH,eAAO,MAAM,aAAa,oBAAoB,CAAC"}

package/dist/client/index.js

@@ -0,0 +1,20 @@
+//#region src/client/index.ts
+/** Name of the search param / form field carrying the return URL through the login flow */
+var STATE_PARAM = "state";
+/** Name of the search param carrying the login error message (`loginAction` failure redirects) */
+var ERROR_PARAM = "error";
+/**
+* Request header `proxyGuard` stamps with the current pathname — layouts cannot see the URL, so
+* `redirectNonAuthenticated()` reads it back to return users to the page they were on after login
+*/
+var PATHNAME_HEADER = "x-pathname";
+/**
+* Session field marking a password-authenticated session — lib-owned, collision-safe, nothing to
+* configure. A string constant and NOT a JS `Symbol`: iron-session JSON-serializes the session
+* into the sealed cookie, symbol-keyed fields would be silently dropped
+*/
+var AUTHENTICATED = "__authenticated";
+//#endregion
+export { AUTHENTICATED, ERROR_PARAM, PATHNAME_HEADER, STATE_PARAM };
+
+//# sourceMappingURL=index.js.map

package/dist/client/index.js.map

@@ -0,0 +1 @@
+{"version":3,"file":"index.js","names":[],"sources":["../../src/client/index.ts"],"sourcesContent":["// Client-safe constants — this subpath (`@kirill.konshin/auth/client`) is importable from Client\n// Components; the main entry pulls in next/headers and is server-only\n\n/** Name of the search param / form field carrying the return URL through the login flow */\nexport const STATE_PARAM = 'state';\n\n/** Name of the search param carrying the login error message (`loginAction` failure redirects) */\nexport const ERROR_PARAM = 'error';\n\n/**\n * Request header `proxyGuard` stamps with the current pathname — layouts cannot see the URL, so\n * `redirectNonAuthenticated()` reads it back to return users to the page they were on after login\n */\nexport const PATHNAME_HEADER = 'x-pathname';\n\n/**\n * Session field marking a password-authenticated session — lib-owned, collision-safe, nothing to\n * configure. A string constant and NOT a JS `Symbol`: iron-session JSON-serializes the session\n * into the sealed cookie, symbol-keyed fields would be silently dropped\n */\nexport const AUTHENTICATED = '__authenticated';\n"],"mappings":";;AAIA,IAAa,cAAc;;AAG3B,IAAa,cAAc;;;;;AAM3B,IAAa,kBAAkB;;;;;;AAO/B,IAAa,gBAAgB"}

package/dist/index.d.ts

@@ -0,0 +1,3 @@
+export * from './auth.js';
+export * from './client/index.js';
+//# sourceMappingURL=index.d.ts.map

package/dist/index.d.ts.map

@@ -0,0 +1 @@
+{"version":3,"file":"index.d.ts","sourceRoot":"","sources":["../src/index.ts"],"names":[],"mappings":"AAAA,cAAc,QAAQ,CAAC;AACvB,cAAc,UAAU,CAAC"}

package/dist/index.js

@@ -0,0 +1,3 @@
+import { AUTHENTICATED, ERROR_PARAM, PATHNAME_HEADER, STATE_PARAM } from "./client/index.js";
+import { MIN_SECRET_LENGTH, createAuth, createPasswordAuth, timingSafeEqualStrings } from "./auth.js";
+export { AUTHENTICATED, ERROR_PARAM, MIN_SECRET_LENGTH, PATHNAME_HEADER, STATE_PARAM, createAuth, createPasswordAuth, timingSafeEqualStrings };

package/package.json

@@ -0,0 +1,73 @@
+{
+  "name": "@kirill.konshin/auth",
+  "description": "Reusable iron-session authentication for Next.js App Router: session module, layout/page guards, route handler guards, proxy guard, password login",
+  "version": "0.0.1",
+  "type": "module",
+  "scripts": {
+    "----- BUILD -----": "",
+    "clean": "rm -rf dist .tscache tsconfig.tsbuildinfo",
+    "build": "vite build",
+    "build:index": "cti create ./src",
+    "build:check-types": "attw --pack .",
+    "start": "yarn build --watch",
+    "wait": "wait-on ./dist/index.js",
+    "----- TEST -----": "",
+    "test": "vitest run --coverage",
+    "test:watch": "vitest watch --coverage",
+    "----- STORYBOOK -----": "",
+    "storybook:start": "storybook dev -p 6006",
+    "storybook:build": "storybook build"
+  },
+  "dependencies": {
+    "iron-session": "^8.0.4",
+    "picomatch": "4.0.5"
+  },
+  "devDependencies": {
+    "@kirill.konshin/utils-private": "*",
+    "@types/picomatch": "^4.0.3",
+    "next": "^16.2.12"
+  },
+  "peerDependencies": {
+    "next": "^16"
+  },
+  "peerDependenciesMeta": {
+    "next": {
+      "optional": true
+    }
+  },
+  "publishConfig": {
+    "access": "public"
+  },
+  "author": "Kirill Konshin <kirill@konshin.org> (https://konshin.org)",
+  "license": "MIT",
+  "exports": {
+    "./client": {
+      "import": {
+        "import": "./dist/client/index.js",
+        "types": "./dist/client/index.d.ts"
+      }
+    },
+    ".": {
+      "import": {
+        "import": "./dist/index.js",
+        "types": "./dist/index.d.ts"
+      }
+    }
+  },
+  "main": "./dist/index.js",
+  "module": "./dist/index.js",
+  "types": "./dist/index.d.ts",
+  "repository": {
+    "type": "git",
+    "url": "https://github.com/kirill-konshin/utils.git",
+    "directory": "packages/auth"
+  },
+  "nx": {
+    "tags": [
+      "platform:next"
+    ]
+  },
+  "files": [
+    "dist"
+  ]
+}