@lemondouble/lemon-auth 0.10.0 → 0.11.0

package/dist/{chunk-ICPDIWYK.js → chunk-TKMZEMW7.js}

@@ -31,23 +31,18 @@ async function logout() {
     return false;
   }
 }
-async function refreshSession() {
-  if (isMockAuthEnabled()) return "ok";
+async function refreshToken() {
+  if (isMockAuthEnabled()) return true;
   try {
     const res = await fetch(REFRESH_URL, {
       method: "POST",
       credentials: "include"
     });
-    if (res.ok) return "ok";
-    if (res.status === 401 || res.status === 403) return "unauthorized";
-    return "unavailable";
+    return res.ok;
   } catch {
-    return "unavailable";
+    return false;
   }
 }
-async function refreshToken() {
-  return await refreshSession() === "ok";
-}
 function assertValidLoginRedirectUrl(redirectUrl) {
   let url;
   try {
@@ -73,7 +68,6 @@ export {
   loginUrl,
   profileUrl,
   logout,
-  refreshSession,
   refreshToken
 };
-//# sourceMappingURL=chunk-ICPDIWYK.js.map
+//# sourceMappingURL=chunk-TKMZEMW7.js.map

package/dist/chunk-TKMZEMW7.js.map

@@ -0,0 +1 @@
+{"version":3,"sources":["../src/client/url.ts"],"sourcesContent":["import {\n  LOGIN_URL,\n  LOGOUT_URL,\n  PROFILE_PAGE_URL,\n  REFRESH_URL,\n} from \"../constants.js\";\nimport { isMockAuthEnabled } from \"../mock.js\";\n\nexport function loginUrl(redirectUrl: string): string {\n  if (isMockAuthEnabled()) return redirectUrl;\n  assertValidLoginRedirectUrl(redirectUrl);\n  return `${LOGIN_URL}?redirect_url=${encodeURIComponent(redirectUrl)}`;\n}\n\nexport function profileUrl(redirectUrl?: string): string {\n  if (isMockAuthEnabled()) return redirectUrl ?? \"/\";\n  if (redirectUrl) {\n    return `${PROFILE_PAGE_URL}?redirect_url=${encodeURIComponent(redirectUrl)}`;\n  }\n  return PROFILE_PAGE_URL;\n}\n\n/** 쿠키는 httpOnly 라 삭제는 응답의 Set-Cookie 가 한다. */\nexport async function logout(): Promise<boolean> {\n  if (isMockAuthEnabled()) return true;\n\n  try {\n    const res = await fetch(LOGOUT_URL, {\n      method: \"POST\",\n      credentials: \"include\",\n    });\n    return res.ok;\n  } catch {\n    return false;\n  }\n}\n\nexport async function refreshToken(): Promise<boolean> {\n  if (isMockAuthEnabled()) return true;\n\n  try {\n    const res = await fetch(REFRESH_URL, {\n      method: \"POST\",\n      credentials: \"include\",\n    });\n    return res.ok;\n  } catch {\n    return false;\n  }\n}\n\nfunction assertValidLoginRedirectUrl(redirectUrl: string): void {\n  let url: URL;\n  try {\n    url = new URL(redirectUrl);\n  } catch {\n    throw new Error(\"loginUrl redirectUrl must be a valid absolute URL\");\n  }\n\n  if (url.protocol !== \"https:\") {\n    throw new Error(\"loginUrl redirectUrl must use https\");\n  }\n\n  if (!isAllowedLoginRedirectHost(url.hostname)) {\n    throw new Error(\n      \"loginUrl redirectUrl host must be lemondouble.com or a subdomain of lemondouble.com\"\n    );\n  }\n}\n\nfunction isAllowedLoginRedirectHost(hostname: string): boolean {\n  const normalized = hostname.toLowerCase();\n  return (\n    normalized === \"lemondouble.com\" ||\n    normalized.endsWith(\".lemondouble.com\")\n  );\n}\n"],"mappings":";;;;;;;;;AAQO,SAAS,SAAS,aAA6B;AACpD,MAAI,kBAAkB,EAAG,QAAO;AAChC,8BAA4B,WAAW;AACvC,SAAO,GAAG,SAAS,iBAAiB,mBAAmB,WAAW,CAAC;AACrE;AAEO,SAAS,WAAW,aAA8B;AACvD,MAAI,kBAAkB,EAAG,QAAO,eAAe;AAC/C,MAAI,aAAa;AACf,WAAO,GAAG,gBAAgB,iBAAiB,mBAAmB,WAAW,CAAC;AAAA,EAC5E;AACA,SAAO;AACT;AAGA,eAAsB,SAA2B;AAC/C,MAAI,kBAAkB,EAAG,QAAO;AAEhC,MAAI;AACF,UAAM,MAAM,MAAM,MAAM,YAAY;AAAA,MAClC,QAAQ;AAAA,MACR,aAAa;AAAA,IACf,CAAC;AACD,WAAO,IAAI;AAAA,EACb,QAAQ;AACN,WAAO;AAAA,EACT;AACF;AAEA,eAAsB,eAAiC;AACrD,MAAI,kBAAkB,EAAG,QAAO;AAEhC,MAAI;AACF,UAAM,MAAM,MAAM,MAAM,aAAa;AAAA,MACnC,QAAQ;AAAA,MACR,aAAa;AAAA,IACf,CAAC;AACD,WAAO,IAAI;AAAA,EACb,QAAQ;AACN,WAAO;AAAA,EACT;AACF;AAEA,SAAS,4BAA4B,aAA2B;AAC9D,MAAI;AACJ,MAAI;AACF,UAAM,IAAI,IAAI,WAAW;AAAA,EAC3B,QAAQ;AACN,UAAM,IAAI,MAAM,mDAAmD;AAAA,EACrE;AAEA,MAAI,IAAI,aAAa,UAAU;AAC7B,UAAM,IAAI,MAAM,qCAAqC;AAAA,EACvD;AAEA,MAAI,CAAC,2BAA2B,IAAI,QAAQ,GAAG;AAC7C,UAAM,IAAI;AAAA,MACR;AAAA,IACF;AAAA,EACF;AACF;AAEA,SAAS,2BAA2B,UAA2B;AAC7D,QAAM,aAAa,SAAS,YAAY;AACxC,SACE,eAAe,qBACf,WAAW,SAAS,kBAAkB;AAE1C;","names":[]}

package/dist/client/index.d.ts

@@ -1,7 +1,6 @@
 import * as react_jsx_runtime from 'react/jsx-runtime';
-import { a as LemonUser } from '../url-qhLR3uNu.js';
-export { l as loginUrl, b as logout, p as profileUrl, r as refreshToken } from '../url-qhLR3uNu.js';
-import * as react from 'react';
+import { a as LemonUser } from '../url-O6F1o0px.js';
+export { l as loginUrl, b as logout, p as profileUrl, r as refreshToken } from '../url-O6F1o0px.js';
 
 interface AuthContextValue {
     user: LemonUser | null;
@@ -13,27 +12,4 @@ declare function AuthProvider({ user, children, }: {
 }): react_jsx_runtime.JSX.Element;
 declare function useAuth(): AuthContextValue;
 
-/**
- * 토큰을 갱신하는 유일한 주체. 프록시가 만료된 세션을 이리로 보낸다.
- *
- * 갱신을 서버(미들웨어)가 아니라 브라우저가 하는 이유는 두 가지다.
- *
- *   1. 미들웨어는 요청마다 별도 인스턴스로 떠서 서로를 모른다. 프리페치가
- *      깔리면 같은 refresh token 으로 갱신이 동시에 나가고, 회전 경쟁이 난다.
- *      브라우저의 복구 경로는 한 번에 하나만 뜬다.
- *   2. 브라우저 요청에는 진짜 UA 와 WAF 통과 쿠키가 실린다. 서버간 fetch 는
- *      UA 가 런타임 기본값이라 봇 방어에 걸릴 수 있다.
- *
- * 끝나면 router 가 아니라 window.location 으로 next 에 간다. 소프트 네비는
- * 루트 레이아웃(과 AuthProvider)을 다시 렌더하지 않으므로, 옛 세션 스냅샷이
- * 남아 화면이 어긋나거나 라우터 캐시에 굳은 리다이렉트가 되살아난다.
- *
- * 실패해도 next 로 간다. 죽은 토큰이면 서버가 401 응답에서 세션 쿠키를
- * 지워 주므로(auth-server v2026.08.03.2+), 이후 판단 — 로그인으로 보낼지,
- * 익명으로 보여줄지 — 는 프록시와 DAL 이 알아서 한다.
- */
-declare function SessionRestore({ fallback }: {
-    fallback: React.ReactNode;
-}): string | number | bigint | boolean | Iterable<react.ReactNode> | Promise<string | number | bigint | boolean | react.ReactPortal | react.ReactElement<unknown, string | react.JSXElementConstructor<any>> | Iterable<react.ReactNode> | null | undefined> | react_jsx_runtime.JSX.Element | null | undefined;
-
-export { AuthProvider, LemonUser, SessionRestore, useAuth };
+export { AuthProvider, LemonUser, useAuth };

package/dist/client/index.js

@@ -3,9 +3,8 @@ import {
   loginUrl,
   logout,
   profileUrl,
-  refreshSession,
   refreshToken
-} from "../chunk-ICPDIWYK.js";
+} from "../chunk-TKMZEMW7.js";
 import "../chunk-JIXVTKLG.js";
 
 // src/client/context.tsx
@@ -24,59 +23,8 @@ function AuthProvider({
 function useAuth() {
   return useContext(AuthContext);
 }
-
-// src/client/session-restore.tsx
-import { useEffect, useState } from "react";
-import { useSearchParams } from "next/navigation";
-import { jsx as jsx2, jsxs } from "react/jsx-runtime";
-function SessionRestore({ fallback }) {
-  const searchParams = useSearchParams();
-  const [unavailable, setUnavailable] = useState(false);
-  useEffect(() => {
-    let ignore = false;
-    const next = safeNextPath(searchParams.get("next"));
-    refreshSession().then((result) => {
-      if (ignore) return;
-      if (result === "unavailable") {
-        setUnavailable(true);
-        return;
-      }
-      window.location.replace(next);
-    });
-    return () => {
-      ignore = true;
-    };
-  }, [searchParams]);
-  if (unavailable) {
-    return /* @__PURE__ */ jsxs(
-      "div",
-      {
-        style: {
-          minHeight: "100dvh",
-          display: "flex",
-          flexDirection: "column",
-          alignItems: "center",
-          justifyContent: "center",
-          gap: 12
-        },
-        children: [
-          /* @__PURE__ */ jsx2("p", { children: "\uC778\uC99D \uC11C\uBC84\uC5D0 \uC5F0\uACB0\uD558\uC9C0 \uBABB\uD588\uC2B5\uB2C8\uB2E4." }),
-          /* @__PURE__ */ jsx2("button", { type: "button", onClick: () => window.location.reload(), children: "\uB2E4\uC2DC \uC2DC\uB3C4" })
-        ]
-      }
-    );
-  }
-  return fallback;
-}
-function safeNextPath(next) {
-  if (!next) return "/";
-  if (!next.startsWith("/")) return "/";
-  if (next.startsWith("//")) return "/";
-  return next;
-}
 export {
   AuthProvider,
-  SessionRestore,
   loginUrl,
   logout,
   profileUrl,

package/dist/client/index.js.map

@@ -1 +1 @@
-{"version":3,"sources":["../../src/client/context.tsx","../../src/client/session-restore.tsx"],"sourcesContent":["\"use client\";\n\nimport { createContext, useContext } from \"react\";\nimport type { LemonUser } from \"../types.js\";\n\ninterface AuthContextValue {\n  user: LemonUser | null;\n  isAuthenticated: boolean;\n}\n\nconst AuthContext = createContext<AuthContextValue>({\n  user: null,\n  isAuthenticated: false,\n});\n\nexport function AuthProvider({\n  user,\n  children,\n}: {\n  user: LemonUser | null;\n  children: React.ReactNode;\n}) {\n  return (\n    <AuthContext value={{ user, isAuthenticated: user !== null }}>\n      {children}\n    </AuthContext>\n  );\n}\n\nexport function useAuth(): AuthContextValue {\n  return useContext(AuthContext);\n}\n","\"use client\";\n\nimport { useEffect, useState } from \"react\";\nimport { useSearchParams } from \"next/navigation\";\nimport { refreshSession } from \"./url.js\";\n\n/**\n * 토큰을 갱신하는 유일한 주체. 프록시가 만료된 세션을 이리로 보낸다.\n *\n * 갱신을 서버(미들웨어)가 아니라 브라우저가 하는 이유는 두 가지다.\n *\n *   1. 미들웨어는 요청마다 별도 인스턴스로 떠서 서로를 모른다. 프리페치가\n *      깔리면 같은 refresh token 으로 갱신이 동시에 나가고, 회전 경쟁이 난다.\n *      브라우저의 복구 경로는 한 번에 하나만 뜬다.\n *   2. 브라우저 요청에는 진짜 UA 와 WAF 통과 쿠키가 실린다. 서버간 fetch 는\n *      UA 가 런타임 기본값이라 봇 방어에 걸릴 수 있다.\n *\n * 끝나면 router 가 아니라 window.location 으로 next 에 간다. 소프트 네비는\n * 루트 레이아웃(과 AuthProvider)을 다시 렌더하지 않으므로, 옛 세션 스냅샷이\n * 남아 화면이 어긋나거나 라우터 캐시에 굳은 리다이렉트가 되살아난다.\n *\n * 실패해도 next 로 간다. 죽은 토큰이면 서버가 401 응답에서 세션 쿠키를\n * 지워 주므로(auth-server v2026.08.03.2+), 이후 판단 — 로그인으로 보낼지,\n * 익명으로 보여줄지 — 는 프록시와 DAL 이 알아서 한다.\n */\nexport function SessionRestore({ fallback }: { fallback: React.ReactNode }) {\n  const searchParams = useSearchParams();\n  const [unavailable, setUnavailable] = useState(false);\n\n  useEffect(() => {\n    let ignore = false;\n    const next = safeNextPath(searchParams.get(\"next\"));\n\n    refreshSession().then((result) => {\n      if (ignore) return;\n\n      if (result === \"unavailable\") {\n        // 서버 · 네트워크 사정이다. 토큰은 살아 있을 수 있으므로\n        // 로그인으로 보내지 않고 재시도만 권한다.\n        setUnavailable(true);\n        return;\n      }\n\n      window.location.replace(next);\n    });\n\n    return () => {\n      ignore = true;\n    };\n  }, [searchParams]);\n\n  if (unavailable) {\n    return (\n      <div\n        style={{\n          minHeight: \"100dvh\",\n          display: \"flex\",\n          flexDirection: \"column\",\n          alignItems: \"center\",\n          justifyContent: \"center\",\n          gap: 12,\n        }}\n      >\n        <p>인증 서버에 연결하지 못했습니다.</p>\n        <button type=\"button\" onClick={() => window.location.reload()}>\n          다시 시도\n        </button>\n      </div>\n    );\n  }\n\n  return fallback;\n}\n\n/**\n * next 파라미터는 사용자가 조작할 수 있으므로 열린 리다이렉트가 되지 않게\n * 같은 출처의 경로만 허용한다. `//evil.com` 은 브라우저가 프로토콜 상대\n * URL 로 읽으므로 반드시 걸러야 한다.\n */\nfunction safeNextPath(next: string | null): string {\n  if (!next) return \"/\";\n  if (!next.startsWith(\"/\")) return \"/\";\n  if (next.startsWith(\"//\")) return \"/\";\n  return next;\n}\n"],"mappings":";;;;;;;;;;AAEA,SAAS,eAAe,kBAAkB;AAqBtC;AAbJ,IAAM,cAAc,cAAgC;AAAA,EAClD,MAAM;AAAA,EACN,iBAAiB;AACnB,CAAC;AAEM,SAAS,aAAa;AAAA,EAC3B;AAAA,EACA;AACF,GAGG;AACD,SACE,oBAAC,eAAY,OAAO,EAAE,MAAM,iBAAiB,SAAS,KAAK,GACxD,UACH;AAEJ;AAEO,SAAS,UAA4B;AAC1C,SAAO,WAAW,WAAW;AAC/B;;;AC7BA,SAAS,WAAW,gBAAgB;AACpC,SAAS,uBAAuB;AAkD1B,SAUE,OAAAA,MAVF;AA5BC,SAAS,eAAe,EAAE,SAAS,GAAkC;AAC1E,QAAM,eAAe,gBAAgB;AACrC,QAAM,CAAC,aAAa,cAAc,IAAI,SAAS,KAAK;AAEpD,YAAU,MAAM;AACd,QAAI,SAAS;AACb,UAAM,OAAO,aAAa,aAAa,IAAI,MAAM,CAAC;AAElD,mBAAe,EAAE,KAAK,CAAC,WAAW;AAChC,UAAI,OAAQ;AAEZ,UAAI,WAAW,eAAe;AAG5B,uBAAe,IAAI;AACnB;AAAA,MACF;AAEA,aAAO,SAAS,QAAQ,IAAI;AAAA,IAC9B,CAAC;AAED,WAAO,MAAM;AACX,eAAS;AAAA,IACX;AAAA,EACF,GAAG,CAAC,YAAY,CAAC;AAEjB,MAAI,aAAa;AACf,WACE;AAAA,MAAC;AAAA;AAAA,QACC,OAAO;AAAA,UACL,WAAW;AAAA,UACX,SAAS;AAAA,UACT,eAAe;AAAA,UACf,YAAY;AAAA,UACZ,gBAAgB;AAAA,UAChB,KAAK;AAAA,QACP;AAAA,QAEA;AAAA,0BAAAA,KAAC,OAAE,sGAAkB;AAAA,UACrB,gBAAAA,KAAC,YAAO,MAAK,UAAS,SAAS,MAAM,OAAO,SAAS,OAAO,GAAG,uCAE/D;AAAA;AAAA;AAAA,IACF;AAAA,EAEJ;AAEA,SAAO;AACT;AAOA,SAAS,aAAa,MAA6B;AACjD,MAAI,CAAC,KAAM,QAAO;AAClB,MAAI,CAAC,KAAK,WAAW,GAAG,EAAG,QAAO;AAClC,MAAI,KAAK,WAAW,IAAI,EAAG,QAAO;AAClC,SAAO;AACT;","names":["jsx"]}
+{"version":3,"sources":["../../src/client/context.tsx"],"sourcesContent":["\"use client\";\n\nimport { createContext, useContext } from \"react\";\nimport type { LemonUser } from \"../types.js\";\n\ninterface AuthContextValue {\n  user: LemonUser | null;\n  isAuthenticated: boolean;\n}\n\nconst AuthContext = createContext<AuthContextValue>({\n  user: null,\n  isAuthenticated: false,\n});\n\nexport function AuthProvider({\n  user,\n  children,\n}: {\n  user: LemonUser | null;\n  children: React.ReactNode;\n}) {\n  return (\n    <AuthContext value={{ user, isAuthenticated: user !== null }}>\n      {children}\n    </AuthContext>\n  );\n}\n\nexport function useAuth(): AuthContextValue {\n  return useContext(AuthContext);\n}\n"],"mappings":";;;;;;;;;AAEA,SAAS,eAAe,kBAAkB;AAqBtC;AAbJ,IAAM,cAAc,cAAgC;AAAA,EAClD,MAAM;AAAA,EACN,iBAAiB;AACnB,CAAC;AAEM,SAAS,aAAa;AAAA,EAC3B;AAAA,EACA;AACF,GAGG;AACD,SACE,oBAAC,eAAY,OAAO,EAAE,MAAM,iBAAiB,SAAS,KAAK,GACxD,UACH;AAEJ;AAEO,SAAS,UAA4B;AAC1C,SAAO,WAAW,WAAW;AAC/B;","names":[]}