@lemondouble/lemon-auth 0.1.0

package/dist/chunk-B2EFAFKY.js

@@ -0,0 +1,23 @@
+// src/constants.ts
+var AUTH_SERVER_URL = "https://auth.lemondouble.com";
+var JWKS_URL = `${AUTH_SERVER_URL}/.well-known/jwks.json`;
+var LOGIN_URL = `${AUTH_SERVER_URL}/api/oauth2/google/login`;
+var REFRESH_URL = `${AUTH_SERVER_URL}/api/token/refresh`;
+var LOGOUT_URL = `${AUTH_SERVER_URL}/api/token/logout`;
+var PROFILE_URL = `${AUTH_SERVER_URL}/api/user/me`;
+var PROFILE_PAGE_URL = `${AUTH_SERVER_URL}/profile`;
+var ACCESS_TOKEN_COOKIE = "access_token";
+var REFRESH_TOKEN_COOKIE = "refresh_token";
+
+export {
+  AUTH_SERVER_URL,
+  JWKS_URL,
+  LOGIN_URL,
+  REFRESH_URL,
+  LOGOUT_URL,
+  PROFILE_URL,
+  PROFILE_PAGE_URL,
+  ACCESS_TOKEN_COOKIE,
+  REFRESH_TOKEN_COOKIE
+};
+//# sourceMappingURL=chunk-B2EFAFKY.js.map

package/dist/chunk-B2EFAFKY.js.map

@@ -0,0 +1 @@
+{"version":3,"sources":["../src/constants.ts"],"sourcesContent":["export const AUTH_SERVER_URL = \"https://auth.lemondouble.com\";\nexport const JWKS_URL = `${AUTH_SERVER_URL}/.well-known/jwks.json`;\nexport const LOGIN_URL = `${AUTH_SERVER_URL}/api/oauth2/google/login`;\nexport const REFRESH_URL = `${AUTH_SERVER_URL}/api/token/refresh`;\nexport const LOGOUT_URL = `${AUTH_SERVER_URL}/api/token/logout`;\nexport const PROFILE_URL = `${AUTH_SERVER_URL}/api/user/me`;\nexport const PROFILE_PAGE_URL = `${AUTH_SERVER_URL}/profile`;\n\nexport const ACCESS_TOKEN_COOKIE = \"access_token\";\nexport const REFRESH_TOKEN_COOKIE = \"refresh_token\";\n"],"mappings":";AAAO,IAAM,kBAAkB;AACxB,IAAM,WAAW,GAAG,eAAe;AACnC,IAAM,YAAY,GAAG,eAAe;AACpC,IAAM,cAAc,GAAG,eAAe;AACtC,IAAM,aAAa,GAAG,eAAe;AACrC,IAAM,cAAc,GAAG,eAAe;AACtC,IAAM,mBAAmB,GAAG,eAAe;AAE3C,IAAM,sBAAsB;AAC5B,IAAM,uBAAuB;","names":[]}

package/dist/client/index.d.ts

@@ -0,0 +1,20 @@
+import * as react_jsx_runtime from 'react/jsx-runtime';
+import { L as LemonUser } from '../types-CgrEUXwM.js';
+import 'jose';
+
+interface AuthContextValue {
+    user: LemonUser | null;
+    isAuthenticated: boolean;
+}
+declare function AuthProvider({ user, children, }: {
+    user: LemonUser | null;
+    children: React.ReactNode;
+}): react_jsx_runtime.JSX.Element;
+declare function useAuth(): AuthContextValue;
+
+declare function loginUrl(redirectUrl: string): string;
+declare function profileUrl(redirectUrl?: string): string;
+declare function logout(): Promise<void>;
+declare function refreshToken(): Promise<boolean>;
+
+export { AuthProvider, LemonUser, loginUrl, logout, profileUrl, refreshToken, useAuth };

package/dist/client/index.js

@@ -0,0 +1,56 @@
+import {
+  LOGIN_URL,
+  LOGOUT_URL,
+  PROFILE_PAGE_URL,
+  REFRESH_URL
+} from "../chunk-B2EFAFKY.js";
+
+// src/client/context.tsx
+import { createContext, useContext } from "react";
+import { jsx } from "react/jsx-runtime";
+var AuthContext = createContext({
+  user: null,
+  isAuthenticated: false
+});
+function AuthProvider({
+  user,
+  children
+}) {
+  return /* @__PURE__ */ jsx(AuthContext, { value: { user, isAuthenticated: user !== null }, children });
+}
+function useAuth() {
+  return useContext(AuthContext);
+}
+
+// src/client/url.ts
+function loginUrl(redirectUrl) {
+  return `${LOGIN_URL}?redirect_url=${encodeURIComponent(redirectUrl)}`;
+}
+function profileUrl(redirectUrl) {
+  if (redirectUrl) {
+    return `${PROFILE_PAGE_URL}?redirect_url=${encodeURIComponent(redirectUrl)}`;
+  }
+  return PROFILE_PAGE_URL;
+}
+async function logout() {
+  await fetch(LOGOUT_URL, {
+    method: "POST",
+    credentials: "include"
+  });
+}
+async function refreshToken() {
+  const res = await fetch(REFRESH_URL, {
+    method: "POST",
+    credentials: "include"
+  });
+  return res.ok;
+}
+export {
+  AuthProvider,
+  loginUrl,
+  logout,
+  profileUrl,
+  refreshToken,
+  useAuth
+};
+//# sourceMappingURL=index.js.map

package/dist/client/index.js.map

@@ -0,0 +1 @@
+{"version":3,"sources":["../../src/client/context.tsx","../../src/client/url.ts"],"sourcesContent":["\"use client\";\n\nimport { createContext, useContext } from \"react\";\nimport type { LemonUser } from \"../types.js\";\n\ninterface AuthContextValue {\n  user: LemonUser | null;\n  isAuthenticated: boolean;\n}\n\nconst AuthContext = createContext<AuthContextValue>({\n  user: null,\n  isAuthenticated: false,\n});\n\nexport function AuthProvider({\n  user,\n  children,\n}: {\n  user: LemonUser | null;\n  children: React.ReactNode;\n}) {\n  return (\n    <AuthContext value={{ user, isAuthenticated: user !== null }}>\n      {children}\n    </AuthContext>\n  );\n}\n\nexport function useAuth(): AuthContextValue {\n  return useContext(AuthContext);\n}\n","import {\n  LOGIN_URL,\n  LOGOUT_URL,\n  PROFILE_PAGE_URL,\n  REFRESH_URL,\n} from \"../constants.js\";\n\nexport function loginUrl(redirectUrl: string): string {\n  return `${LOGIN_URL}?redirect_url=${encodeURIComponent(redirectUrl)}`;\n}\n\nexport function profileUrl(redirectUrl?: string): string {\n  if (redirectUrl) {\n    return `${PROFILE_PAGE_URL}?redirect_url=${encodeURIComponent(redirectUrl)}`;\n  }\n  return PROFILE_PAGE_URL;\n}\n\nexport async function logout(): Promise<void> {\n  await fetch(LOGOUT_URL, {\n    method: \"POST\",\n    credentials: \"include\",\n  });\n}\n\nexport async function refreshToken(): Promise<boolean> {\n  const res = await fetch(REFRESH_URL, {\n    method: \"POST\",\n    credentials: \"include\",\n  });\n  return res.ok;\n}\n"],"mappings":";;;;;;;;AAEA,SAAS,eAAe,kBAAkB;AAqBtC;AAbJ,IAAM,cAAc,cAAgC;AAAA,EAClD,MAAM;AAAA,EACN,iBAAiB;AACnB,CAAC;AAEM,SAAS,aAAa;AAAA,EAC3B;AAAA,EACA;AACF,GAGG;AACD,SACE,oBAAC,eAAY,OAAO,EAAE,MAAM,iBAAiB,SAAS,KAAK,GACxD,UACH;AAEJ;AAEO,SAAS,UAA4B;AAC1C,SAAO,WAAW,WAAW;AAC/B;;;ACxBO,SAAS,SAAS,aAA6B;AACpD,SAAO,GAAG,SAAS,iBAAiB,mBAAmB,WAAW,CAAC;AACrE;AAEO,SAAS,WAAW,aAA8B;AACvD,MAAI,aAAa;AACf,WAAO,GAAG,gBAAgB,iBAAiB,mBAAmB,WAAW,CAAC;AAAA,EAC5E;AACA,SAAO;AACT;AAEA,eAAsB,SAAwB;AAC5C,QAAM,MAAM,YAAY;AAAA,IACtB,QAAQ;AAAA,IACR,aAAa;AAAA,EACf,CAAC;AACH;AAEA,eAAsB,eAAiC;AACrD,QAAM,MAAM,MAAM,MAAM,aAAa;AAAA,IACnC,QAAQ;AAAA,IACR,aAAa;AAAA,EACf,CAAC;AACD,SAAO,IAAI;AACb;","names":[]}

package/dist/proxy/index.d.ts

@@ -0,0 +1,12 @@
+import { NextRequest, NextResponse } from 'next/server';
+export { A as AccessTokenClaims, L as LemonUser } from '../types-CgrEUXwM.js';
+import 'jose';
+
+interface AuthProxyOptions {
+    publicPaths?: string[];
+    clientId?: string;
+    loginRedirectUrl?: string;
+}
+declare function createAuthProxy(options?: AuthProxyOptions): (request: NextRequest) => Promise<NextResponse>;
+
+export { type AuthProxyOptions, createAuthProxy };

package/dist/proxy/index.js

@@ -0,0 +1,132 @@
+import {
+  ACCESS_TOKEN_COOKIE,
+  AUTH_SERVER_URL,
+  JWKS_URL,
+  LOGIN_URL,
+  REFRESH_TOKEN_COOKIE,
+  REFRESH_URL
+} from "../chunk-B2EFAFKY.js";
+
+// src/proxy/index.ts
+import { NextResponse } from "next/server";
+import { createRemoteJWKSet, jwtVerify } from "jose";
+var REFRESH_BUFFER_SECONDS = 60;
+var jwks = createRemoteJWKSet(new URL(JWKS_URL));
+function createAuthProxy(options = {}) {
+  const { publicPaths = [], clientId, loginRedirectUrl } = options;
+  return async function proxy(request) {
+    const { pathname } = request.nextUrl;
+    if (isPublicPath(pathname, publicPaths)) {
+      return maybeRefreshAndContinue(request);
+    }
+    const accessToken = request.cookies.get(ACCESS_TOKEN_COOKIE)?.value;
+    const refreshToken = request.cookies.get(REFRESH_TOKEN_COOKIE)?.value;
+    if (accessToken && isTokenFresh(accessToken)) {
+      const claims = await verifyToken(accessToken);
+      if (claims) {
+        if (clientId && !claims.approved_clients.includes(clientId)) {
+          return redirectToLogin(request, loginRedirectUrl);
+        }
+        return NextResponse.next();
+      }
+    }
+    if (refreshToken) {
+      const result = await tryRefresh(refreshToken);
+      if (result) {
+        const claims = await verifyToken(result.newAccessToken);
+        if (claims) {
+          if (clientId && !claims.approved_clients.includes(clientId)) {
+            return redirectToLogin(request, loginRedirectUrl);
+          }
+          const response = NextResponse.next();
+          for (const header of result.setCookieHeaders) {
+            response.headers.append("Set-Cookie", header);
+          }
+          return response;
+        }
+      }
+    }
+    return redirectToLogin(request, loginRedirectUrl);
+  };
+}
+async function maybeRefreshAndContinue(request) {
+  const accessToken = request.cookies.get(ACCESS_TOKEN_COOKIE)?.value;
+  const refreshToken = request.cookies.get(REFRESH_TOKEN_COOKIE)?.value;
+  if (accessToken && isTokenFresh(accessToken)) {
+    return NextResponse.next();
+  }
+  if (refreshToken) {
+    const result = await tryRefresh(refreshToken);
+    if (result) {
+      const response = NextResponse.next();
+      for (const header of result.setCookieHeaders) {
+        response.headers.append("Set-Cookie", header);
+      }
+      return response;
+    }
+  }
+  return NextResponse.next();
+}
+function isTokenFresh(token) {
+  try {
+    const parts = token.split(".");
+    if (parts.length !== 3) return false;
+    const payload = JSON.parse(
+      Buffer.from(parts[1], "base64url").toString()
+    );
+    return typeof payload.exp === "number" && payload.exp > Math.floor(Date.now() / 1e3) + REFRESH_BUFFER_SECONDS;
+  } catch {
+    return false;
+  }
+}
+async function verifyToken(token) {
+  try {
+    const { payload } = await jwtVerify(token, jwks, {
+      issuer: AUTH_SERVER_URL
+    });
+    return payload;
+  } catch {
+    return null;
+  }
+}
+async function tryRefresh(refreshToken) {
+  try {
+    const res = await fetch(REFRESH_URL, {
+      method: "POST",
+      headers: { Cookie: `refresh_token=${refreshToken}` }
+    });
+    if (!res.ok) return null;
+    const setCookieHeaders = res.headers.getSetCookie();
+    const newAccessToken = extractAccessToken(setCookieHeaders);
+    if (!newAccessToken) return null;
+    return { newAccessToken, setCookieHeaders };
+  } catch {
+    return null;
+  }
+}
+function extractAccessToken(setCookieHeaders) {
+  for (const header of setCookieHeaders) {
+    const match = header.match(/^access_token=([^;]+)/);
+    if (match) return match[1];
+  }
+  return null;
+}
+function isPublicPath(pathname, publicPaths) {
+  return publicPaths.some((p) => {
+    if (p.endsWith("*")) {
+      return pathname.startsWith(p.slice(0, -1));
+    }
+    return pathname === p;
+  });
+}
+function redirectToLogin(request, loginRedirectUrl) {
+  if (loginRedirectUrl) {
+    const url = `${LOGIN_URL}?redirect_url=${encodeURIComponent(loginRedirectUrl)}`;
+    return NextResponse.redirect(new URL(url, request.url));
+  }
+  return NextResponse.redirect(new URL("/", request.url));
+}
+export {
+  createAuthProxy
+};
+//# sourceMappingURL=index.js.map

package/dist/proxy/index.js.map

@@ -0,0 +1 @@
+{"version":3,"sources":["../../src/proxy/index.ts"],"sourcesContent":["import { NextRequest, NextResponse } from \"next/server\";\nimport {\n  ACCESS_TOKEN_COOKIE,\n  REFRESH_TOKEN_COOKIE,\n  AUTH_SERVER_URL,\n  REFRESH_URL,\n  JWKS_URL,\n  LOGIN_URL,\n} from \"../constants.js\";\nimport { createRemoteJWKSet, jwtVerify } from \"jose\";\nimport type { AccessTokenClaims } from \"../types.js\";\n\nconst REFRESH_BUFFER_SECONDS = 60;\n\nconst jwks = createRemoteJWKSet(new URL(JWKS_URL));\n\nexport interface AuthProxyOptions {\n  publicPaths?: string[];\n  clientId?: string;\n  loginRedirectUrl?: string;\n}\n\nexport function createAuthProxy(options: AuthProxyOptions = {}) {\n  const { publicPaths = [], clientId, loginRedirectUrl } = options;\n\n  return async function proxy(request: NextRequest): Promise<NextResponse> {\n    const { pathname } = request.nextUrl;\n\n    if (isPublicPath(pathname, publicPaths)) {\n      return maybeRefreshAndContinue(request);\n    }\n\n    const accessToken = request.cookies.get(ACCESS_TOKEN_COOKIE)?.value;\n    const refreshToken = request.cookies.get(REFRESH_TOKEN_COOKIE)?.value;\n\n    if (accessToken && isTokenFresh(accessToken)) {\n      const claims = await verifyToken(accessToken);\n      if (claims) {\n        if (clientId && !claims.approved_clients.includes(clientId)) {\n          return redirectToLogin(request, loginRedirectUrl);\n        }\n        return NextResponse.next();\n      }\n    }\n\n    if (refreshToken) {\n      const result = await tryRefresh(refreshToken);\n      if (result) {\n        const claims = await verifyToken(result.newAccessToken);\n        if (claims) {\n          if (clientId && !claims.approved_clients.includes(clientId)) {\n            return redirectToLogin(request, loginRedirectUrl);\n          }\n          const response = NextResponse.next();\n          for (const header of result.setCookieHeaders) {\n            response.headers.append(\"Set-Cookie\", header);\n          }\n          return response;\n        }\n      }\n    }\n\n    return redirectToLogin(request, loginRedirectUrl);\n  };\n}\n\nasync function maybeRefreshAndContinue(\n  request: NextRequest\n): Promise<NextResponse> {\n  const accessToken = request.cookies.get(ACCESS_TOKEN_COOKIE)?.value;\n  const refreshToken = request.cookies.get(REFRESH_TOKEN_COOKIE)?.value;\n\n  if (accessToken && isTokenFresh(accessToken)) {\n    return NextResponse.next();\n  }\n\n  if (refreshToken) {\n    const result = await tryRefresh(refreshToken);\n    if (result) {\n      const response = NextResponse.next();\n      for (const header of result.setCookieHeaders) {\n        response.headers.append(\"Set-Cookie\", header);\n      }\n      return response;\n    }\n  }\n\n  return NextResponse.next();\n}\n\nfunction isTokenFresh(token: string): boolean {\n  try {\n    const parts = token.split(\".\");\n    if (parts.length !== 3) return false;\n    const payload = JSON.parse(\n      Buffer.from(parts[1], \"base64url\").toString()\n    );\n    return (\n      typeof payload.exp === \"number\" &&\n      payload.exp > Math.floor(Date.now() / 1000) + REFRESH_BUFFER_SECONDS\n    );\n  } catch {\n    return false;\n  }\n}\n\nasync function verifyToken(\n  token: string\n): Promise<AccessTokenClaims | null> {\n  try {\n    const { payload } = await jwtVerify(token, jwks, {\n      issuer: AUTH_SERVER_URL,\n    });\n    return payload as unknown as AccessTokenClaims;\n  } catch {\n    return null;\n  }\n}\n\ninterface RefreshSuccess {\n  newAccessToken: string;\n  setCookieHeaders: string[];\n}\n\nasync function tryRefresh(\n  refreshToken: string\n): Promise<RefreshSuccess | null> {\n  try {\n    const res = await fetch(REFRESH_URL, {\n      method: \"POST\",\n      headers: { Cookie: `refresh_token=${refreshToken}` },\n    });\n\n    if (!res.ok) return null;\n\n    const setCookieHeaders = res.headers.getSetCookie();\n    const newAccessToken = extractAccessToken(setCookieHeaders);\n    if (!newAccessToken) return null;\n\n    return { newAccessToken, setCookieHeaders };\n  } catch {\n    return null;\n  }\n}\n\nfunction extractAccessToken(setCookieHeaders: string[]): string | null {\n  for (const header of setCookieHeaders) {\n    const match = header.match(/^access_token=([^;]+)/);\n    if (match) return match[1];\n  }\n  return null;\n}\n\nfunction isPublicPath(pathname: string, publicPaths: string[]): boolean {\n  return publicPaths.some((p) => {\n    if (p.endsWith(\"*\")) {\n      return pathname.startsWith(p.slice(0, -1));\n    }\n    return pathname === p;\n  });\n}\n\nfunction redirectToLogin(\n  request: NextRequest,\n  loginRedirectUrl?: string\n): NextResponse {\n  if (loginRedirectUrl) {\n    const url = `${LOGIN_URL}?redirect_url=${encodeURIComponent(loginRedirectUrl)}`;\n    return NextResponse.redirect(new URL(url, request.url));\n  }\n  return NextResponse.redirect(new URL(\"/\", request.url));\n}\n\nexport type { AccessTokenClaims } from \"../types.js\";\nexport type { LemonUser } from \"../types.js\";\n"],"mappings":";;;;;;;;;;AAAA,SAAsB,oBAAoB;AAS1C,SAAS,oBAAoB,iBAAiB;AAG9C,IAAM,yBAAyB;AAE/B,IAAM,OAAO,mBAAmB,IAAI,IAAI,QAAQ,CAAC;AAQ1C,SAAS,gBAAgB,UAA4B,CAAC,GAAG;AAC9D,QAAM,EAAE,cAAc,CAAC,GAAG,UAAU,iBAAiB,IAAI;AAEzD,SAAO,eAAe,MAAM,SAA6C;AACvE,UAAM,EAAE,SAAS,IAAI,QAAQ;AAE7B,QAAI,aAAa,UAAU,WAAW,GAAG;AACvC,aAAO,wBAAwB,OAAO;AAAA,IACxC;AAEA,UAAM,cAAc,QAAQ,QAAQ,IAAI,mBAAmB,GAAG;AAC9D,UAAM,eAAe,QAAQ,QAAQ,IAAI,oBAAoB,GAAG;AAEhE,QAAI,eAAe,aAAa,WAAW,GAAG;AAC5C,YAAM,SAAS,MAAM,YAAY,WAAW;AAC5C,UAAI,QAAQ;AACV,YAAI,YAAY,CAAC,OAAO,iBAAiB,SAAS,QAAQ,GAAG;AAC3D,iBAAO,gBAAgB,SAAS,gBAAgB;AAAA,QAClD;AACA,eAAO,aAAa,KAAK;AAAA,MAC3B;AAAA,IACF;AAEA,QAAI,cAAc;AAChB,YAAM,SAAS,MAAM,WAAW,YAAY;AAC5C,UAAI,QAAQ;AACV,cAAM,SAAS,MAAM,YAAY,OAAO,cAAc;AACtD,YAAI,QAAQ;AACV,cAAI,YAAY,CAAC,OAAO,iBAAiB,SAAS,QAAQ,GAAG;AAC3D,mBAAO,gBAAgB,SAAS,gBAAgB;AAAA,UAClD;AACA,gBAAM,WAAW,aAAa,KAAK;AACnC,qBAAW,UAAU,OAAO,kBAAkB;AAC5C,qBAAS,QAAQ,OAAO,cAAc,MAAM;AAAA,UAC9C;AACA,iBAAO;AAAA,QACT;AAAA,MACF;AAAA,IACF;AAEA,WAAO,gBAAgB,SAAS,gBAAgB;AAAA,EAClD;AACF;AAEA,eAAe,wBACb,SACuB;AACvB,QAAM,cAAc,QAAQ,QAAQ,IAAI,mBAAmB,GAAG;AAC9D,QAAM,eAAe,QAAQ,QAAQ,IAAI,oBAAoB,GAAG;AAEhE,MAAI,eAAe,aAAa,WAAW,GAAG;AAC5C,WAAO,aAAa,KAAK;AAAA,EAC3B;AAEA,MAAI,cAAc;AAChB,UAAM,SAAS,MAAM,WAAW,YAAY;AAC5C,QAAI,QAAQ;AACV,YAAM,WAAW,aAAa,KAAK;AACnC,iBAAW,UAAU,OAAO,kBAAkB;AAC5C,iBAAS,QAAQ,OAAO,cAAc,MAAM;AAAA,MAC9C;AACA,aAAO;AAAA,IACT;AAAA,EACF;AAEA,SAAO,aAAa,KAAK;AAC3B;AAEA,SAAS,aAAa,OAAwB;AAC5C,MAAI;AACF,UAAM,QAAQ,MAAM,MAAM,GAAG;AAC7B,QAAI,MAAM,WAAW,EAAG,QAAO;AAC/B,UAAM,UAAU,KAAK;AAAA,MACnB,OAAO,KAAK,MAAM,CAAC,GAAG,WAAW,EAAE,SAAS;AAAA,IAC9C;AACA,WACE,OAAO,QAAQ,QAAQ,YACvB,QAAQ,MAAM,KAAK,MAAM,KAAK,IAAI,IAAI,GAAI,IAAI;AAAA,EAElD,QAAQ;AACN,WAAO;AAAA,EACT;AACF;AAEA,eAAe,YACb,OACmC;AACnC,MAAI;AACF,UAAM,EAAE,QAAQ,IAAI,MAAM,UAAU,OAAO,MAAM;AAAA,MAC/C,QAAQ;AAAA,IACV,CAAC;AACD,WAAO;AAAA,EACT,QAAQ;AACN,WAAO;AAAA,EACT;AACF;AAOA,eAAe,WACb,cACgC;AAChC,MAAI;AACF,UAAM,MAAM,MAAM,MAAM,aAAa;AAAA,MACnC,QAAQ;AAAA,MACR,SAAS,EAAE,QAAQ,iBAAiB,YAAY,GAAG;AAAA,IACrD,CAAC;AAED,QAAI,CAAC,IAAI,GAAI,QAAO;AAEpB,UAAM,mBAAmB,IAAI,QAAQ,aAAa;AAClD,UAAM,iBAAiB,mBAAmB,gBAAgB;AAC1D,QAAI,CAAC,eAAgB,QAAO;AAE5B,WAAO,EAAE,gBAAgB,iBAAiB;AAAA,EAC5C,QAAQ;AACN,WAAO;AAAA,EACT;AACF;AAEA,SAAS,mBAAmB,kBAA2C;AACrE,aAAW,UAAU,kBAAkB;AACrC,UAAM,QAAQ,OAAO,MAAM,uBAAuB;AAClD,QAAI,MAAO,QAAO,MAAM,CAAC;AAAA,EAC3B;AACA,SAAO;AACT;AAEA,SAAS,aAAa,UAAkB,aAAgC;AACtE,SAAO,YAAY,KAAK,CAAC,MAAM;AAC7B,QAAI,EAAE,SAAS,GAAG,GAAG;AACnB,aAAO,SAAS,WAAW,EAAE,MAAM,GAAG,EAAE,CAAC;AAAA,IAC3C;AACA,WAAO,aAAa;AAAA,EACtB,CAAC;AACH;AAEA,SAAS,gBACP,SACA,kBACc;AACd,MAAI,kBAAkB;AACpB,UAAM,MAAM,GAAG,SAAS,iBAAiB,mBAAmB,gBAAgB,CAAC;AAC7E,WAAO,aAAa,SAAS,IAAI,IAAI,KAAK,QAAQ,GAAG,CAAC;AAAA,EACxD;AACA,SAAO,aAAa,SAAS,IAAI,IAAI,KAAK,QAAQ,GAAG,CAAC;AACxD;","names":[]}

package/dist/server/index.d.ts

@@ -0,0 +1,28 @@
+import { A as AccessTokenClaims, L as LemonUser } from '../types-CgrEUXwM.js';
+export { U as UserProfile } from '../types-CgrEUXwM.js';
+import 'jose';
+
+declare function verifyAccessToken(): Promise<AccessTokenClaims | null>;
+declare function verifyAccessTokenString(token: string): Promise<AccessTokenClaims | null>;
+
+declare const getUser: () => Promise<LemonUser | null>;
+declare function requireAuth(redirectTo?: string): Promise<LemonUser>;
+declare function requireClient(clientId: string, redirectTo?: string): Promise<LemonUser>;
+
+interface RefreshResult {
+    ok: boolean;
+    setCookieHeaders: string[];
+}
+declare function refreshTokenFromCookie(refreshTokenCookie: string): Promise<RefreshResult>;
+
+declare const AUTH_SERVER_URL = "https://auth.lemondouble.com";
+declare const JWKS_URL = "https://auth.lemondouble.com/.well-known/jwks.json";
+declare const LOGIN_URL = "https://auth.lemondouble.com/api/oauth2/google/login";
+declare const REFRESH_URL = "https://auth.lemondouble.com/api/token/refresh";
+declare const LOGOUT_URL = "https://auth.lemondouble.com/api/token/logout";
+declare const PROFILE_URL = "https://auth.lemondouble.com/api/user/me";
+declare const PROFILE_PAGE_URL = "https://auth.lemondouble.com/profile";
+declare const ACCESS_TOKEN_COOKIE = "access_token";
+declare const REFRESH_TOKEN_COOKIE = "refresh_token";
+
+export { ACCESS_TOKEN_COOKIE, AUTH_SERVER_URL, AccessTokenClaims, JWKS_URL, LOGIN_URL, LOGOUT_URL, LemonUser, PROFILE_PAGE_URL, PROFILE_URL, REFRESH_TOKEN_COOKIE, REFRESH_URL, type RefreshResult, getUser, refreshTokenFromCookie, requireAuth, requireClient, verifyAccessToken, verifyAccessTokenString };

package/dist/server/index.js

@@ -0,0 +1,102 @@
+import {
+  ACCESS_TOKEN_COOKIE,
+  AUTH_SERVER_URL,
+  JWKS_URL,
+  LOGIN_URL,
+  LOGOUT_URL,
+  PROFILE_PAGE_URL,
+  PROFILE_URL,
+  REFRESH_TOKEN_COOKIE,
+  REFRESH_URL
+} from "../chunk-B2EFAFKY.js";
+
+// src/server/verify.ts
+import { createRemoteJWKSet, jwtVerify } from "jose";
+import { cookies } from "next/headers";
+var jwks = createRemoteJWKSet(new URL(JWKS_URL));
+async function verifyAccessToken() {
+  const cookieStore = await cookies();
+  const token = cookieStore.get(ACCESS_TOKEN_COOKIE)?.value;
+  if (!token) return null;
+  try {
+    const { payload } = await jwtVerify(token, jwks, {
+      issuer: AUTH_SERVER_URL
+    });
+    return payload;
+  } catch {
+    return null;
+  }
+}
+async function verifyAccessTokenString(token) {
+  try {
+    const { payload } = await jwtVerify(token, jwks, {
+      issuer: AUTH_SERVER_URL
+    });
+    return payload;
+  } catch {
+    return null;
+  }
+}
+
+// src/server/user.ts
+import { cache } from "react";
+import { redirect } from "next/navigation";
+function claimsToUser(claims) {
+  return {
+    uid: claims.sub,
+    nickname: claims.nickname,
+    profileImageUrl: claims.profile_image_url,
+    role: claims.role,
+    approvedClients: claims.approved_clients
+  };
+}
+var getUser = cache(async () => {
+  const claims = await verifyAccessToken();
+  if (!claims) return null;
+  return claimsToUser(claims);
+});
+async function requireAuth(redirectTo = "/") {
+  const user = await getUser();
+  if (user) return user;
+  redirect(redirectTo);
+}
+async function requireClient(clientId, redirectTo = "/") {
+  const user = await requireAuth(redirectTo);
+  if (!user.approvedClients.includes(clientId)) {
+    throw new Error("Client not approved");
+  }
+  return user;
+}
+
+// src/server/refresh.ts
+async function refreshTokenFromCookie(refreshTokenCookie) {
+  const res = await fetch(REFRESH_URL, {
+    method: "POST",
+    headers: {
+      Cookie: `refresh_token=${refreshTokenCookie}`
+    }
+  });
+  if (!res.ok) {
+    return { ok: false, setCookieHeaders: [] };
+  }
+  const setCookieHeaders = res.headers.getSetCookie();
+  return { ok: true, setCookieHeaders };
+}
+export {
+  ACCESS_TOKEN_COOKIE,
+  AUTH_SERVER_URL,
+  JWKS_URL,
+  LOGIN_URL,
+  LOGOUT_URL,
+  PROFILE_PAGE_URL,
+  PROFILE_URL,
+  REFRESH_TOKEN_COOKIE,
+  REFRESH_URL,
+  getUser,
+  refreshTokenFromCookie,
+  requireAuth,
+  requireClient,
+  verifyAccessToken,
+  verifyAccessTokenString
+};
+//# sourceMappingURL=index.js.map

package/dist/server/index.js.map

@@ -0,0 +1 @@
+{"version":3,"sources":["../../src/server/verify.ts","../../src/server/user.ts","../../src/server/refresh.ts"],"sourcesContent":["import { createRemoteJWKSet, jwtVerify } from \"jose\";\nimport { cookies } from \"next/headers\";\nimport type { AccessTokenClaims } from \"../types.js\";\nimport { JWKS_URL, AUTH_SERVER_URL, ACCESS_TOKEN_COOKIE } from \"../constants.js\";\n\nconst jwks = createRemoteJWKSet(new URL(JWKS_URL));\n\nexport async function verifyAccessToken(): Promise<AccessTokenClaims | null> {\n  const cookieStore = await cookies();\n  const token = cookieStore.get(ACCESS_TOKEN_COOKIE)?.value;\n  if (!token) return null;\n\n  try {\n    const { payload } = await jwtVerify(token, jwks, {\n      issuer: AUTH_SERVER_URL,\n    });\n    return payload as unknown as AccessTokenClaims;\n  } catch {\n    return null;\n  }\n}\n\nexport async function verifyAccessTokenString(\n  token: string\n): Promise<AccessTokenClaims | null> {\n  try {\n    const { payload } = await jwtVerify(token, jwks, {\n      issuer: AUTH_SERVER_URL,\n    });\n    return payload as unknown as AccessTokenClaims;\n  } catch {\n    return null;\n  }\n}\n","import { cache } from \"react\";\nimport { redirect } from \"next/navigation\";\nimport type { LemonUser } from \"../types.js\";\nimport { verifyAccessToken } from \"./verify.js\";\n\nfunction claimsToUser(\n  claims: NonNullable<Awaited<ReturnType<typeof verifyAccessToken>>>\n): LemonUser {\n  return {\n    uid: claims.sub,\n    nickname: claims.nickname,\n    profileImageUrl: claims.profile_image_url,\n    role: claims.role,\n    approvedClients: claims.approved_clients,\n  };\n}\n\nexport const getUser = cache(async (): Promise<LemonUser | null> => {\n  const claims = await verifyAccessToken();\n  if (!claims) return null;\n  return claimsToUser(claims);\n});\n\nexport async function requireAuth(redirectTo = \"/\"): Promise<LemonUser> {\n  const user = await getUser();\n  if (user) return user;\n  redirect(redirectTo);\n}\n\nexport async function requireClient(\n  clientId: string,\n  redirectTo = \"/\"\n): Promise<LemonUser> {\n  const user = await requireAuth(redirectTo);\n  if (!user.approvedClients.includes(clientId)) {\n    throw new Error(\"Client not approved\");\n  }\n  return user;\n}\n","import { REFRESH_URL } from \"../constants.js\";\n\nexport interface RefreshResult {\n  ok: boolean;\n  setCookieHeaders: string[];\n}\n\nexport async function refreshTokenFromCookie(\n  refreshTokenCookie: string\n): Promise<RefreshResult> {\n  const res = await fetch(REFRESH_URL, {\n    method: \"POST\",\n    headers: {\n      Cookie: `refresh_token=${refreshTokenCookie}`,\n    },\n  });\n\n  if (!res.ok) {\n    return { ok: false, setCookieHeaders: [] };\n  }\n\n  const setCookieHeaders = res.headers.getSetCookie();\n  return { ok: true, setCookieHeaders };\n}\n"],"mappings":";;;;;;;;;;;;;AAAA,SAAS,oBAAoB,iBAAiB;AAC9C,SAAS,eAAe;AAIxB,IAAM,OAAO,mBAAmB,IAAI,IAAI,QAAQ,CAAC;AAEjD,eAAsB,oBAAuD;AAC3E,QAAM,cAAc,MAAM,QAAQ;AAClC,QAAM,QAAQ,YAAY,IAAI,mBAAmB,GAAG;AACpD,MAAI,CAAC,MAAO,QAAO;AAEnB,MAAI;AACF,UAAM,EAAE,QAAQ,IAAI,MAAM,UAAU,OAAO,MAAM;AAAA,MAC/C,QAAQ;AAAA,IACV,CAAC;AACD,WAAO;AAAA,EACT,QAAQ;AACN,WAAO;AAAA,EACT;AACF;AAEA,eAAsB,wBACpB,OACmC;AACnC,MAAI;AACF,UAAM,EAAE,QAAQ,IAAI,MAAM,UAAU,OAAO,MAAM;AAAA,MAC/C,QAAQ;AAAA,IACV,CAAC;AACD,WAAO;AAAA,EACT,QAAQ;AACN,WAAO;AAAA,EACT;AACF;;;ACjCA,SAAS,aAAa;AACtB,SAAS,gBAAgB;AAIzB,SAAS,aACP,QACW;AACX,SAAO;AAAA,IACL,KAAK,OAAO;AAAA,IACZ,UAAU,OAAO;AAAA,IACjB,iBAAiB,OAAO;AAAA,IACxB,MAAM,OAAO;AAAA,IACb,iBAAiB,OAAO;AAAA,EAC1B;AACF;AAEO,IAAM,UAAU,MAAM,YAAuC;AAClE,QAAM,SAAS,MAAM,kBAAkB;AACvC,MAAI,CAAC,OAAQ,QAAO;AACpB,SAAO,aAAa,MAAM;AAC5B,CAAC;AAED,eAAsB,YAAY,aAAa,KAAyB;AACtE,QAAM,OAAO,MAAM,QAAQ;AAC3B,MAAI,KAAM,QAAO;AACjB,WAAS,UAAU;AACrB;AAEA,eAAsB,cACpB,UACA,aAAa,KACO;AACpB,QAAM,OAAO,MAAM,YAAY,UAAU;AACzC,MAAI,CAAC,KAAK,gBAAgB,SAAS,QAAQ,GAAG;AAC5C,UAAM,IAAI,MAAM,qBAAqB;AAAA,EACvC;AACA,SAAO;AACT;;;AC/BA,eAAsB,uBACpB,oBACwB;AACxB,QAAM,MAAM,MAAM,MAAM,aAAa;AAAA,IACnC,QAAQ;AAAA,IACR,SAAS;AAAA,MACP,QAAQ,iBAAiB,kBAAkB;AAAA,IAC7C;AAAA,EACF,CAAC;AAED,MAAI,CAAC,IAAI,IAAI;AACX,WAAO,EAAE,IAAI,OAAO,kBAAkB,CAAC,EAAE;AAAA,EAC3C;AAEA,QAAM,mBAAmB,IAAI,QAAQ,aAAa;AAClD,SAAO,EAAE,IAAI,MAAM,iBAAiB;AACtC;","names":[]}

package/dist/types-CgrEUXwM.d.ts

@@ -0,0 +1,24 @@
+import { JWTPayload } from 'jose';
+
+interface AccessTokenClaims extends JWTPayload {
+    sub: string;
+    nickname: string;
+    profile_image_url: string;
+    role: "user" | "admin";
+    approved_clients: string[];
+}
+interface LemonUser {
+    uid: string;
+    nickname: string;
+    profileImageUrl: string;
+    role: "user" | "admin";
+    approvedClients: string[];
+}
+interface UserProfile {
+    uid: string;
+    nickname: string;
+    profile_image_url: string;
+    role: "user" | "admin";
+}
+
+export type { AccessTokenClaims as A, LemonUser as L, UserProfile as U };

package/package.json

@@ -0,0 +1,50 @@
+{
+  "name": "@lemondouble/lemon-auth",
+  "version": "0.1.0",
+  "description": "Auth library for *.lemondouble.com services",
+  "type": "module",
+  "exports": {
+    "./server": {
+      "types": "./dist/server/index.d.ts",
+      "import": "./dist/server/index.js"
+    },
+    "./client": {
+      "types": "./dist/client/index.d.ts",
+      "import": "./dist/client/index.js"
+    },
+    "./proxy": {
+      "types": "./dist/proxy/index.d.ts",
+      "import": "./dist/proxy/index.js"
+    }
+  },
+  "files": [
+    "dist"
+  ],
+  "scripts": {
+    "build": "tsup",
+    "dev": "tsup --watch",
+    "typecheck": "tsc --noEmit",
+    "prepublishOnly": "npm run build"
+  },
+  "peerDependencies": {
+    "next": ">=16.0.0",
+    "react": ">=19.0.0"
+  },
+  "dependencies": {
+    "jose": "^6.2.2"
+  },
+  "keywords": [
+    "auth",
+    "lemondouble",
+    "next.js",
+    "jwt"
+  ],
+  "author": "lemondouble",
+  "license": "MIT",
+  "devDependencies": {
+    "@types/node": "^25.6.0",
+    "@types/react": "^19.2.14",
+    "tsup": "^8.5.1",
+    "typescript": "^6.0.3"
+  }
+}