@lemondouble/lemon-auth 0.4.0 → 0.7.0

package/README.md

@@ -10,6 +10,24 @@
 pnpm add @lemondouble/lemon-auth
 ```
 
+## 로컬 개발 Mock User
+
+로컬 개발에서 auth-server, OAuth, JWT 쿠키 없이 로그인 상태를 재현하려면 `.env.local`에 mock user를 설정합니다.
+
+```bash
+NEXT_PUBLIC_LEMON_AUTH_MOCK_USER='{"uid":"local-user","nickname":"Local User","profileImageUrl":"","role":"admin","approvedClients":["*"]}'
+```
+
+`NODE_ENV === "production"`에서는 이 값이 있어도 무시됩니다. `approvedClients`에 `"*"`를 넣으면 모든 `clientId`를 승인된 것으로 처리합니다.
+
+Mock User가 활성화되면:
+
+- `getUser()`, `getSession()`, `requireAuth()`, `requireClient()`는 mock user를 로그인 유저처럼 반환합니다.
+- `createAuthProxy()`는 mock user를 인증 성공으로 처리하고, `clientId` 승인 체크는 유지합니다.
+- `loginUrl(redirectUrl)`은 `redirectUrl`을 그대로 반환합니다.
+- `profileUrl(redirectUrl?)`은 `redirectUrl ?? "/"`를 반환합니다.
+- `refreshToken()`은 `true`, `logout()`은 no-op 후 `true`를 반환합니다.
+
 ## 엔트리포인트
 
 | 경로 | 환경 | 용도 |
@@ -26,7 +44,7 @@ Server Components, Route Handlers, Server Actions에서 사용합니다.
 
 ### `verifyAccessToken()`
 
-쿠키에서 `access_token`을 읽어 JWKS(ES256)로 검증합니다.
+쿠키에서 `lemon_access_token`을 읽어 JWKS(ES256)로 검증합니다.
 
 ```ts
 import { verifyAccessToken } from "@lemondouble/lemon-auth/server";
@@ -39,6 +57,7 @@ const claims = await verifyAccessToken();
 
 ```ts
 interface AccessTokenClaims {
+  token_type: "access";     // access token 여부
   sub: string;              // 사용자 UUID
   nickname: string;         // 닉네임
   profile_image_url: string; // 프로필 이미지 URL
@@ -98,6 +117,34 @@ interface LemonUser {
 }
 ```
 
+### `getSession(options?)`
+
+로그인 상태와 클라이언트 승인 상태를 함께 반환합니다.
+
+```ts
+import { getSession } from "@lemondouble/lemon-auth/server";
+
+const CLIENT_ID = process.env.CLIENT_ID!;
+
+export default async function Page() {
+  const session = await getSession({ clientId: CLIENT_ID });
+
+  if (session.type === "none") return <p>로그인이 필요합니다</p>;
+  if (session.type === "unapproved") return <p>관리자 승인이 필요합니다</p>;
+
+  return <p>{session.user.nickname}님 환영합니다</p>;
+}
+```
+
+반환되는 `LemonSession`:
+
+```ts
+type LemonSession =
+  | { type: "none" }
+  | { type: "unapproved"; user: LemonUser }
+  | { type: "authenticated"; user: LemonUser };
+```
+
 ### `requireAuth(redirectTo?)`
 
 인증된 유저를 반환합니다. 미인증이면 `redirectTo`로 redirect합니다.
@@ -117,7 +164,7 @@ export default async function ProtectedPage() {
 |---------|------|--------|------|
 | `redirectTo` | `string` | `"/"` | 미인증 시 redirect 경로 |
 
-### `requireClient(clientId, redirectTo?)`
+### `requireClient(clientId, options?)`
 
 `requireAuth()` + `approved_clients` 체크. 관리자가 승인한 사용자만 접근할 수 있는 서비스에서 사용합니다.
 
@@ -127,8 +174,10 @@ import { requireClient } from "@lemondouble/lemon-auth/server";
 const CLIENT_ID = process.env.CLIENT_ID!;
 
 export default async function Page() {
-  const user = await requireClient(CLIENT_ID);
-  // approved_clients에 CLIENT_ID가 없으면 Error("Client not approved") throw
+  const user = await requireClient(CLIENT_ID, {
+    loginRedirectTo: "/",
+    unapprovedRedirectTo: "/pending-approval",
+  });
   return <p>{user.nickname}</p>;
 }
 ```
@@ -136,9 +185,10 @@ export default async function Page() {
 | 파라미터 | 타입 | 기본값 | 설명 |
 |---------|------|--------|------|
 | `clientId` | `string` | (필수) | 체크할 클라이언트 UUID |
-| `redirectTo` | `string` | `"/"` | 미인증 시 redirect 경로 |
+| `options.loginRedirectTo` | `string` | `"/"` | 미인증 시 redirect 경로 |
+| `options.unapprovedRedirectTo` | `string` | `undefined` | 로그인은 됐지만 클라이언트 미승인 시 redirect 경로. 미설정 시 auth-server `/error?code=FORBIDDEN`로 redirect (proxy 동작과 동일) |
 
-### `refreshTokenFromCookie(refreshTokenCookie)`
+### `refreshTokenFromCookie(refreshTokenCookie, deviceIdCookie?)`
 
 서버사이드에서 토큰 갱신을 수행합니다. Route Handler 등에서 수동으로 갱신할 때 사용합니다.
 
@@ -147,10 +197,11 @@ import { refreshTokenFromCookie } from "@lemondouble/lemon-auth/server";
 
 export async function POST(request: Request) {
   const cookieStore = await cookies();
-  const refreshToken = cookieStore.get("refresh_token")?.value;
+  const refreshToken = cookieStore.get("lemon_refresh_token")?.value;
+  const deviceId = cookieStore.get("device_id")?.value;
   if (!refreshToken) return new Response(null, { status: 401 });
 
-  const result = await refreshTokenFromCookie(refreshToken);
+  const result = await refreshTokenFromCookie(refreshToken, deviceId);
   // result: { ok: boolean, setCookieHeaders: string[] }
 
   if (!result.ok) return new Response(null, { status: 401 });
@@ -176,8 +227,9 @@ import {
   LOGOUT_URL,            // "https://auth.lemondouble.com/api/token/logout"
   PROFILE_URL,           // "https://auth.lemondouble.com/api/user/me"
   PROFILE_PAGE_URL,      // "https://auth.lemondouble.com/profile"
-  ACCESS_TOKEN_COOKIE,   // "access_token"
-  REFRESH_TOKEN_COOKIE,  // "refresh_token"
+  ACCESS_TOKEN_COOKIE,   // "lemon_access_token"
+  REFRESH_TOKEN_COOKIE,  // "lemon_refresh_token"
+  DEVICE_ID_COOKIE,      // "device_id"
 } from "@lemondouble/lemon-auth/server";
 ```
 
@@ -195,12 +247,16 @@ import { createAuthProxy } from "@lemondouble/lemon-auth/proxy";
 
 export default createAuthProxy({
   publicPaths: ["/", "/about", "/api/public/*"],
+  bypassPaths: ["/workbox-*"],
   clientId: process.env.CLIENT_ID,
-  loginRedirectUrl: "https://myapp.lemondouble.com",
+  loginRedirectUrl: (request) => request.url,
+  unapprovedRedirectUrl: "/pending-approval",
 });
 
 export const config = {
-  matcher: ["/((?!_next/static|_next/image|favicon.ico).*)"],
+  matcher: [
+    "/((?!_next/static|_next/image|sw.js|manifest.webmanifest|favicon.ico|.*\\.(?:png|jpg|jpeg|gif|webp|svg|ico|woff|woff2|ttf|eot|otf)$).*)",
+  ],
 };
 ```
 
@@ -209,24 +265,86 @@ export const config = {
 | 옵션 | 타입 | 기본값 | 설명 |
 |------|------|--------|------|
 | `publicPaths` | `string[]` | `[]` | 인증 없이 접근 가능한 경로. `*`로 끝나면 prefix 매칭 (예: `"/api/public/*"`) |
+| `bypassPaths` | `string[]` | `[]` | proxy가 refresh도 하지 않고 바로 통과시킬 추가 경로. 기본 PWA 경로(`/sw.js`, `/manifest.webmanifest` 등)는 항상 bypass |
+| `apiPaths` | `string[]` | `["/api/*"]` | 보호 API 경로. 인증 실패 시 redirect 대신 JSON 응답을 반환한다. disable하려면 `[]` |
 | `clientId` | `string` | `undefined` | 설정 시 `approved_clients`에 포함 여부를 체크 |
-| `loginRedirectUrl` | `string` | `undefined` | 미인증 시 Google 로그인 후 돌아올 URL. 미설정 시 `"/"` 로 redirect |
+| `loginRedirectUrl` | `string \| (request: NextRequest) => string` | `undefined` | 미인증 시 Google 로그인 후 돌아올 URL. deep link 보존이 필요하면 `(request) => request.url` 사용. 미설정 시 `"/"` 로 redirect |
+| `unapprovedRedirectUrl` | `string \| (request: NextRequest) => string` | `undefined` | 로그인은 됐지만 `clientId` 미승인일 때 redirect할 URL. 미설정 시 auth-server `/error?code=FORBIDDEN`로 redirect (무한 loop 방지) |
 | `onAuthSuccess` | `(claims, request, response) => Promise<NextResponse> \| NextResponse` | `undefined` | 보호 경로에서 인증 성공 시 호출되는 콜백. DB 동기화, 헤더 주입 등 앱별 로직에 사용 |
 
 #### 동작 방식
 
+**Bypass 경로** (기본 PWA/정적 리소스 + `bypassPaths`):
+
+1. `/sw.js`, `/manifest.webmanifest`, `/manifest.json`, `/favicon.ico` 등은 인증/갱신 없이 항상 통과
+2. 가능하면 `matcher`에서도 제외해 proxy 실행 자체를 피하는 것을 권장
+
 **보호 경로** (`publicPaths`에 해당하지 않는 경로):
 
-1. `access_token` 쿠키가 있고 만료까지 60초 이상 남았으면 → JWKS 검증 → `onAuthSuccess` 호출 → 통과
-2. 만료 임박이거나 검증 실패 시 `refresh_token`으로 자동 갱신 시도
-3. 갱신 성공 → 새 토큰 쿠키 설정 → `onAuthSuccess` 호출 → 통과
-4. 갱신 실패 → 로그인 페이지로 redirect
+1. `lemon_access_token` 쿠키가 있고 만료까지 60초 이상 남았으면 → JWKS 검증 → `onAuthSuccess` 호출 → 통과
+2. 로그인은 됐지만 `clientId` 미승인이면 `unapprovedRedirectUrl`로 redirect
+3. 만료 임박이거나 검증 실패 시 `lemon_refresh_token` + `device_id`로 자동 갱신 시도
+4. 갱신 성공 → 새 토큰 쿠키 설정 → `onAuthSuccess` 호출 → 통과
+5. 갱신 실패 → `loginRedirectUrl`을 `redirect_url`로 담아 로그인 페이지로 redirect
+
+`loginRedirectUrl`은 고정 URL 문자열과 요청별 resolver 함수를 모두 지원합니다.
+
+```ts
+createAuthProxy({
+  // 로그인 후 항상 같은 화면으로 복귀
+  loginRedirectUrl: "https://myapp.lemondouble.com/dashboard",
+});
+
+createAuthProxy({
+  // 로그인 후 사용자가 원래 요청한 path/query로 복귀
+  loginRedirectUrl: (request) => request.url,
+});
+```
 
 **공개 경로** (`publicPaths`에 해당하는 경로):
 
 1. 토큰이 만료 임박이면 백그라운드로 갱신 (실패해도 통과)
 2. 인증 여부와 무관하게 항상 통과
 
+**API 경로** (`apiPaths` 매칭, 기본 `/api/*`):
+
+보호 경로 중 `apiPaths`에 매칭되는 요청은 인증 실패 시 redirect 대신 JSON 응답을 반환합니다. fetch 호출이 OAuth HTML로 리다이렉트되어 계약이 깨지는 문제를 방지합니다.
+
+| 상황 | 응답 |
+|------|------|
+| 미인증 (access/refresh 모두 실패) | `401 { "code": "UNAUTHORIZED" }` |
+| 미승인 (`clientId` 미포함) | `403 { "code": "FORBIDDEN" }` |
+
+`PROXY_AUTH_ERROR` 상수와 `ProxyAuthErrorCode` 타입을 export합니다.
+
+```ts
+import { PROXY_AUTH_ERROR } from "@lemondouble/lemon-auth/proxy";
+import type { ProxyAuthErrorCode } from "@lemondouble/lemon-auth/proxy";
+
+const res = await fetch("/api/users");
+if (!res.ok) {
+  const data = (await res.json()) as { code: ProxyAuthErrorCode };
+  if (data.code === PROXY_AUTH_ERROR.UNAUTHORIZED) {
+    // 재로그인 유도
+  }
+  if (data.code === PROXY_AUTH_ERROR.FORBIDDEN) {
+    // "권한 없음" 표시
+  }
+}
+```
+
+`/api/*` 외의 경로(예: tRPC, GraphQL)도 JSON 응답을 받게 하려면 `apiPaths`에 추가합니다.
+
+```ts
+import { DEFAULT_API_PATHS } from "@lemondouble/lemon-auth/proxy";
+
+createAuthProxy({
+  apiPaths: [...DEFAULT_API_PATHS, "/trpc/*"],
+});
+```
+
+`apiPaths: []`로 두면 모든 보호 경로가 redirect로 동작합니다 (이전 버전 동작).
+
 ---
 
 ## Client — `@lemondouble/lemon-auth/client`
@@ -310,8 +428,8 @@ export default async function RootLayout({ children }: { children: React.ReactNo
 |------|------|-----------------|
 | 정상 요청 (proxy 실행됨) | 있음 | 아무것도 안 함 (skip) |
 | PWA 캐시 히트 + 갱신 시도 중 | 없음 | `fallback` 렌더 |
-| PWA 캐시 히트 + 유효한 refresh_token | 없음 | 갱신 → `router.refresh()` |
-| PWA 캐시 히트 + 만료된 refresh_token | 없음 | 갱신 실패 → `children` 렌더 |
+| PWA 캐시 히트 + 유효한 `lemon_refresh_token` | 없음 | 갱신 → `router.refresh()` |
+| PWA 캐시 히트 + 만료된 `lemon_refresh_token` | 없음 | 갱신 실패 → `children` 렌더 |
 
 ### `loginUrl(redirectUrl)`
 
@@ -326,11 +444,15 @@ loginUrl("https://myapp.lemondouble.com/dashboard")
 
 | 파라미터 | 타입 | 설명 |
 |---------|------|------|
-| `redirectUrl` | `string` | 로그인 완료 후 돌아올 URL (`https://` + `*.lemondouble.com`만 허용) |
+| `redirectUrl` | `string` | 로그인 완료 후 돌아올 절대 URL (`https://` + `lemondouble.com` 또는 `*.lemondouble.com`만 허용) |
+
+허용되지 않는 URL이면 `Error`를 throw합니다. Mock User가 활성화된 로컬 개발 환경에서는 검증하지 않고 `redirectUrl`을 그대로 반환합니다.
 
 ### `logout()`
 
-로그아웃을 수행합니다. refresh_token을 폐기하고 쿠키를 삭제합니다.
+로그아웃을 수행합니다. `lemon_refresh_token`을 폐기하고 쿠키를 삭제합니다.
+서버 응답이 성공이면 `true`, 실패 응답 또는 네트워크 예외면 `false`를 반환합니다.
+반환값을 무시하고 기존처럼 `await logout()`만 호출해도 됩니다.
 
 ```tsx
 "use client";
@@ -338,7 +460,10 @@ import { logout } from "@lemondouble/lemon-auth/client";
 
 function LogoutButton() {
   const handleLogout = async () => {
-    await logout();
+    const ok = await logout();
+    if (!ok) {
+      // 필요하면 실패 안내를 표시
+    }
     window.location.href = "/";
   };
 
@@ -397,6 +522,7 @@ interface LemonUser {
 }
 
 interface AccessTokenClaims extends JWTPayload {
+  token_type: "access";
   sub: string;
   nickname: string;
   profile_image_url: string;
@@ -416,34 +542,52 @@ interface UserProfile {
 
 ## 전체 연동 예시
 
-새 Next.js 16 프로젝트에 인증을 추가하는 최소 예시입니다.
+새 Next.js 16 프로젝트에 인증을 추가하는 권장 예시입니다.
 
 ### 1. proxy.ts — 토큰 자동 갱신
 
 ```ts
-import { createAuthProxy } from "@lemondouble/lemon-auth/proxy";
+import {
+  createAuthProxy,
+  DEFAULT_API_PATHS,
+} from "@lemondouble/lemon-auth/proxy";
 
 export default createAuthProxy({
-  publicPaths: ["/", "/login"],
+  publicPaths: ["/", "/login", "/pending-approval", "/api/public/*"],
+  bypassPaths: ["/workbox-*"],
+  apiPaths: DEFAULT_API_PATHS,
   clientId: process.env.CLIENT_ID,
-  loginRedirectUrl: process.env.NEXT_PUBLIC_BASE_URL,
+  loginRedirectUrl: (request) => request.url,
+  unapprovedRedirectUrl: "/pending-approval",
 });
 
 export const config = {
-  matcher: ["/((?!_next/static|_next/image|favicon.ico).*)"],
+  matcher: [
+    "/((?!_next/static|_next/image|sw.js|manifest.webmanifest|favicon.ico|.*\\.(?:png|jpg|jpeg|gif|webp|svg|ico|woff|woff2|ttf|eot|otf)$).*)",
+  ],
 };
 ```
 
+`loginRedirectUrl: (request) => request.url`은 로그인 후 사용자가 원래 요청한 path/query로 돌아오게 합니다.
+`apiPaths`에 매칭되는 보호 API는 인증 실패 시 redirect 대신 `401/403` JSON 응답을 반환합니다.
+기본 PWA 파일(`/sw.js`, `/manifest.webmanifest` 등)은 항상 bypass되며, 앱에서 추가로 생성하는 workbox 파일은 `bypassPaths`에 넣을 수 있습니다.
+
 `onAuthSuccess`를 사용하면 인증 성공 후 DB 동기화, 헤더 주입 등 앱별 로직을 끼워넣을 수 있습니다:
 
 ```ts
-import { createAuthProxy } from "@lemondouble/lemon-auth/proxy";
+import {
+  createAuthProxy,
+  DEFAULT_API_PATHS,
+} from "@lemondouble/lemon-auth/proxy";
 import { upsertUser } from "@/lib/db";
 
 export default createAuthProxy({
-  publicPaths: ["/", "/login"],
+  publicPaths: ["/", "/login", "/pending-approval", "/api/public/*"],
+  bypassPaths: ["/workbox-*"],
+  apiPaths: DEFAULT_API_PATHS,
   clientId: process.env.CLIENT_ID,
-  loginRedirectUrl: process.env.NEXT_PUBLIC_BASE_URL,
+  loginRedirectUrl: (request) => request.url,
+  unapprovedRedirectUrl: "/pending-approval",
   onAuthSuccess: async (claims, request, response) => {
     await upsertUser(claims);
     response.headers.set("x-user-uid", claims.sub);
@@ -517,7 +661,12 @@ import { logout } from "@lemondouble/lemon-auth/client";
 
 export function LogoutButton() {
   return (
-    <button onClick={async () => { await logout(); window.location.href = "/"; }}>
+    <button
+      onClick={async () => {
+        await logout();
+        window.location.href = "/";
+      }}
+    >
       로그아웃
     </button>
   );

package/dist/chunk-6W24RWSJ.js

@@ -0,0 +1,16 @@
+// src/claims.ts
+function isAccessTokenClaims(payload) {
+  return payload.token_type === "access" && typeof payload.sub === "string" && typeof payload.nickname === "string" && typeof payload.profile_image_url === "string" && (payload.role === "user" || payload.role === "admin") && Array.isArray(payload.approved_clients) && payload.approved_clients.every((clientId) => typeof clientId === "string");
+}
+
+// src/approval.ts
+function isApprovedClient(approvedClients, clientId) {
+  if (!clientId) return true;
+  return approvedClients.includes(clientId) || approvedClients.includes("*");
+}
+
+export {
+  isAccessTokenClaims,
+  isApprovedClient
+};
+//# sourceMappingURL=chunk-6W24RWSJ.js.map

package/dist/chunk-6W24RWSJ.js.map

@@ -0,0 +1 @@
+{"version":3,"sources":["../src/claims.ts","../src/approval.ts"],"sourcesContent":["import type { JWTPayload } from \"jose\";\nimport type { AccessTokenClaims } from \"./types.js\";\n\nexport function isAccessTokenClaims(\n  payload: JWTPayload\n): payload is AccessTokenClaims {\n  return (\n    payload.token_type === \"access\" &&\n    typeof payload.sub === \"string\" &&\n    typeof payload.nickname === \"string\" &&\n    typeof payload.profile_image_url === \"string\" &&\n    (payload.role === \"user\" || payload.role === \"admin\") &&\n    Array.isArray(payload.approved_clients) &&\n    payload.approved_clients.every((clientId) => typeof clientId === \"string\")\n  );\n}\n","export function isApprovedClient(\n  approvedClients: string[],\n  clientId?: string\n): boolean {\n  if (!clientId) return true;\n  return approvedClients.includes(clientId) || approvedClients.includes(\"*\");\n}\n"],"mappings":";AAGO,SAAS,oBACd,SAC8B;AAC9B,SACE,QAAQ,eAAe,YACvB,OAAO,QAAQ,QAAQ,YACvB,OAAO,QAAQ,aAAa,YAC5B,OAAO,QAAQ,sBAAsB,aACpC,QAAQ,SAAS,UAAU,QAAQ,SAAS,YAC7C,MAAM,QAAQ,QAAQ,gBAAgB,KACtC,QAAQ,iBAAiB,MAAM,CAAC,aAAa,OAAO,aAAa,QAAQ;AAE7E;;;ACfO,SAAS,iBACd,iBACA,UACS;AACT,MAAI,CAAC,SAAU,QAAO;AACtB,SAAO,gBAAgB,SAAS,QAAQ,KAAK,gBAAgB,SAAS,GAAG;AAC3E;","names":[]}

package/dist/chunk-OX5MDVSR.js

@@ -0,0 +1,120 @@
+// src/constants.ts
+var AUTH_SERVER_URL = "https://auth.lemondouble.com";
+var JWKS_URL = `${AUTH_SERVER_URL}/.well-known/jwks.json`;
+var LOGIN_URL = `${AUTH_SERVER_URL}/api/oauth2/google/login`;
+var REFRESH_URL = `${AUTH_SERVER_URL}/api/token/refresh`;
+var LOGOUT_URL = `${AUTH_SERVER_URL}/api/token/logout`;
+var PROFILE_URL = `${AUTH_SERVER_URL}/api/user/me`;
+var PROFILE_PAGE_URL = `${AUTH_SERVER_URL}/profile`;
+var ACCESS_TOKEN_COOKIE = "lemon_access_token";
+var REFRESH_TOKEN_COOKIE = "lemon_refresh_token";
+var DEVICE_ID_COOKIE = "device_id";
+
+// src/mock.ts
+var LEMON_AUTH_MOCK_USER_ENV = "NEXT_PUBLIC_LEMON_AUTH_MOCK_USER";
+function isMockAuthEnabled() {
+  return !isProduction() && Boolean(readMockUserEnv());
+}
+function getMockUser() {
+  const raw = readMockUserEnv();
+  if (isProduction() || !raw) return null;
+  return parseMockUser(raw);
+}
+function getMockAccessTokenClaims() {
+  const user = getMockUser();
+  if (!user) return null;
+  const now = Math.floor(Date.now() / 1e3);
+  return {
+    token_type: "access",
+    sub: user.uid,
+    nickname: user.nickname,
+    profile_image_url: user.profileImageUrl,
+    role: user.role,
+    approved_clients: user.approvedClients,
+    iss: "lemon-auth-mock",
+    iat: now,
+    exp: now + 60 * 60 * 24 * 365
+  };
+}
+function readMockUserEnv() {
+  try {
+    return process.env.NEXT_PUBLIC_LEMON_AUTH_MOCK_USER;
+  } catch {
+    return void 0;
+  }
+}
+function isProduction() {
+  try {
+    return process.env.NODE_ENV === "production";
+  } catch {
+    return false;
+  }
+}
+function parseMockUser(raw) {
+  let data;
+  try {
+    data = JSON.parse(raw);
+  } catch {
+    throw new Error(
+      `${LEMON_AUTH_MOCK_USER_ENV} must be a valid JSON object`
+    );
+  }
+  if (!isRecord(data)) {
+    throw new Error(`${LEMON_AUTH_MOCK_USER_ENV} must be a JSON object`);
+  }
+  return {
+    uid: readOptionalString(data.uid, "local-user", "uid"),
+    nickname: readOptionalString(data.nickname, "Local User", "nickname"),
+    profileImageUrl: readOptionalString(
+      data.profileImageUrl ?? data.profile_image_url,
+      "",
+      "profileImageUrl"
+    ),
+    role: readOptionalRole(data.role, "admin"),
+    approvedClients: readOptionalStringArray(
+      data.approvedClients ?? data.approved_clients,
+      ["*"],
+      "approvedClients"
+    )
+  };
+}
+function isRecord(value) {
+  return typeof value === "object" && value !== null && !Array.isArray(value);
+}
+function readOptionalString(value, fallback, field) {
+  if (value === void 0 || value === null) return fallback;
+  if (typeof value === "string") return value;
+  throw new Error(`${LEMON_AUTH_MOCK_USER_ENV}.${field} must be a string`);
+}
+function readOptionalRole(value, fallback) {
+  if (value === void 0 || value === null) return fallback;
+  if (value === "user" || value === "admin") return value;
+  throw new Error(
+    `${LEMON_AUTH_MOCK_USER_ENV}.role must be "user" or "admin"`
+  );
+}
+function readOptionalStringArray(value, fallback, field) {
+  if (value === void 0 || value === null) return fallback;
+  if (Array.isArray(value) && value.every((item) => typeof item === "string")) {
+    return value;
+  }
+  throw new Error(
+    `${LEMON_AUTH_MOCK_USER_ENV}.${field} must be a string array`
+  );
+}
+
+export {
+  AUTH_SERVER_URL,
+  JWKS_URL,
+  LOGIN_URL,
+  REFRESH_URL,
+  LOGOUT_URL,
+  PROFILE_URL,
+  PROFILE_PAGE_URL,
+  ACCESS_TOKEN_COOKIE,
+  REFRESH_TOKEN_COOKIE,
+  DEVICE_ID_COOKIE,
+  isMockAuthEnabled,
+  getMockAccessTokenClaims
+};
+//# sourceMappingURL=chunk-OX5MDVSR.js.map

package/dist/chunk-OX5MDVSR.js.map

@@ -0,0 +1 @@
+{"version":3,"sources":["../src/constants.ts","../src/mock.ts"],"sourcesContent":["export const AUTH_SERVER_URL = \"https://auth.lemondouble.com\";\nexport const JWKS_URL = `${AUTH_SERVER_URL}/.well-known/jwks.json`;\nexport const LOGIN_URL = `${AUTH_SERVER_URL}/api/oauth2/google/login`;\nexport const REFRESH_URL = `${AUTH_SERVER_URL}/api/token/refresh`;\nexport const LOGOUT_URL = `${AUTH_SERVER_URL}/api/token/logout`;\nexport const PROFILE_URL = `${AUTH_SERVER_URL}/api/user/me`;\nexport const PROFILE_PAGE_URL = `${AUTH_SERVER_URL}/profile`;\n\nexport const ACCESS_TOKEN_COOKIE = \"lemon_access_token\";\nexport const REFRESH_TOKEN_COOKIE = \"lemon_refresh_token\";\nexport const DEVICE_ID_COOKIE = \"device_id\";\n","import type { AccessTokenClaims, LemonUser } from \"./types.js\";\n\nexport const LEMON_AUTH_MOCK_USER_ENV =\n  \"NEXT_PUBLIC_LEMON_AUTH_MOCK_USER\";\n\nexport function isMockAuthEnabled(): boolean {\n  return !isProduction() && Boolean(readMockUserEnv());\n}\n\nexport function getMockUser(): LemonUser | null {\n  const raw = readMockUserEnv();\n  if (isProduction() || !raw) return null;\n  return parseMockUser(raw);\n}\n\nexport function getMockAccessTokenClaims(): AccessTokenClaims | null {\n  const user = getMockUser();\n  if (!user) return null;\n\n  const now = Math.floor(Date.now() / 1000);\n  return {\n    token_type: \"access\",\n    sub: user.uid,\n    nickname: user.nickname,\n    profile_image_url: user.profileImageUrl,\n    role: user.role,\n    approved_clients: user.approvedClients,\n    iss: \"lemon-auth-mock\",\n    iat: now,\n    exp: now + 60 * 60 * 24 * 365,\n  };\n}\n\nfunction readMockUserEnv(): string | undefined {\n  try {\n    return process.env.NEXT_PUBLIC_LEMON_AUTH_MOCK_USER;\n  } catch {\n    return undefined;\n  }\n}\n\nfunction isProduction(): boolean {\n  try {\n    return process.env.NODE_ENV === \"production\";\n  } catch {\n    return false;\n  }\n}\n\nfunction parseMockUser(raw: string): LemonUser {\n  let data: unknown;\n  try {\n    data = JSON.parse(raw);\n  } catch {\n    throw new Error(\n      `${LEMON_AUTH_MOCK_USER_ENV} must be a valid JSON object`\n    );\n  }\n\n  if (!isRecord(data)) {\n    throw new Error(`${LEMON_AUTH_MOCK_USER_ENV} must be a JSON object`);\n  }\n\n  return {\n    uid: readOptionalString(data.uid, \"local-user\", \"uid\"),\n    nickname: readOptionalString(data.nickname, \"Local User\", \"nickname\"),\n    profileImageUrl: readOptionalString(\n      data.profileImageUrl ?? data.profile_image_url,\n      \"\",\n      \"profileImageUrl\"\n    ),\n    role: readOptionalRole(data.role, \"admin\"),\n    approvedClients: readOptionalStringArray(\n      data.approvedClients ?? data.approved_clients,\n      [\"*\"],\n      \"approvedClients\"\n    ),\n  };\n}\n\nfunction isRecord(value: unknown): value is Record<string, unknown> {\n  return typeof value === \"object\" && value !== null && !Array.isArray(value);\n}\n\nfunction readOptionalString(\n  value: unknown,\n  fallback: string,\n  field: string\n): string {\n  if (value === undefined || value === null) return fallback;\n  if (typeof value === \"string\") return value;\n  throw new Error(`${LEMON_AUTH_MOCK_USER_ENV}.${field} must be a string`);\n}\n\nfunction readOptionalRole(\n  value: unknown,\n  fallback: LemonUser[\"role\"]\n): LemonUser[\"role\"] {\n  if (value === undefined || value === null) return fallback;\n  if (value === \"user\" || value === \"admin\") return value;\n  throw new Error(\n    `${LEMON_AUTH_MOCK_USER_ENV}.role must be \"user\" or \"admin\"`\n  );\n}\n\nfunction readOptionalStringArray(\n  value: unknown,\n  fallback: string[],\n  field: string\n): string[] {\n  if (value === undefined || value === null) return fallback;\n  if (\n    Array.isArray(value) &&\n    value.every((item) => typeof item === \"string\")\n  ) {\n    return value;\n  }\n  throw new Error(\n    `${LEMON_AUTH_MOCK_USER_ENV}.${field} must be a string array`\n  );\n}\n"],"mappings":";AAAO,IAAM,kBAAkB;AACxB,IAAM,WAAW,GAAG,eAAe;AACnC,IAAM,YAAY,GAAG,eAAe;AACpC,IAAM,cAAc,GAAG,eAAe;AACtC,IAAM,aAAa,GAAG,eAAe;AACrC,IAAM,cAAc,GAAG,eAAe;AACtC,IAAM,mBAAmB,GAAG,eAAe;AAE3C,IAAM,sBAAsB;AAC5B,IAAM,uBAAuB;AAC7B,IAAM,mBAAmB;;;ACRzB,IAAM,2BACX;AAEK,SAAS,oBAA6B;AAC3C,SAAO,CAAC,aAAa,KAAK,QAAQ,gBAAgB,CAAC;AACrD;AAEO,SAAS,cAAgC;AAC9C,QAAM,MAAM,gBAAgB;AAC5B,MAAI,aAAa,KAAK,CAAC,IAAK,QAAO;AACnC,SAAO,cAAc,GAAG;AAC1B;AAEO,SAAS,2BAAqD;AACnE,QAAM,OAAO,YAAY;AACzB,MAAI,CAAC,KAAM,QAAO;AAElB,QAAM,MAAM,KAAK,MAAM,KAAK,IAAI,IAAI,GAAI;AACxC,SAAO;AAAA,IACL,YAAY;AAAA,IACZ,KAAK,KAAK;AAAA,IACV,UAAU,KAAK;AAAA,IACf,mBAAmB,KAAK;AAAA,IACxB,MAAM,KAAK;AAAA,IACX,kBAAkB,KAAK;AAAA,IACvB,KAAK;AAAA,IACL,KAAK;AAAA,IACL,KAAK,MAAM,KAAK,KAAK,KAAK;AAAA,EAC5B;AACF;AAEA,SAAS,kBAAsC;AAC7C,MAAI;AACF,WAAO,QAAQ,IAAI;AAAA,EACrB,QAAQ;AACN,WAAO;AAAA,EACT;AACF;AAEA,SAAS,eAAwB;AAC/B,MAAI;AACF,WAAO,QAAQ,IAAI,aAAa;AAAA,EAClC,QAAQ;AACN,WAAO;AAAA,EACT;AACF;AAEA,SAAS,cAAc,KAAwB;AAC7C,MAAI;AACJ,MAAI;AACF,WAAO,KAAK,MAAM,GAAG;AAAA,EACvB,QAAQ;AACN,UAAM,IAAI;AAAA,MACR,GAAG,wBAAwB;AAAA,IAC7B;AAAA,EACF;AAEA,MAAI,CAAC,SAAS,IAAI,GAAG;AACnB,UAAM,IAAI,MAAM,GAAG,wBAAwB,wBAAwB;AAAA,EACrE;AAEA,SAAO;AAAA,IACL,KAAK,mBAAmB,KAAK,KAAK,cAAc,KAAK;AAAA,IACrD,UAAU,mBAAmB,KAAK,UAAU,cAAc,UAAU;AAAA,IACpE,iBAAiB;AAAA,MACf,KAAK,mBAAmB,KAAK;AAAA,MAC7B;AAAA,MACA;AAAA,IACF;AAAA,IACA,MAAM,iBAAiB,KAAK,MAAM,OAAO;AAAA,IACzC,iBAAiB;AAAA,MACf,KAAK,mBAAmB,KAAK;AAAA,MAC7B,CAAC,GAAG;AAAA,MACJ;AAAA,IACF;AAAA,EACF;AACF;AAEA,SAAS,SAAS,OAAkD;AAClE,SAAO,OAAO,UAAU,YAAY,UAAU,QAAQ,CAAC,MAAM,QAAQ,KAAK;AAC5E;AAEA,SAAS,mBACP,OACA,UACA,OACQ;AACR,MAAI,UAAU,UAAa,UAAU,KAAM,QAAO;AAClD,MAAI,OAAO,UAAU,SAAU,QAAO;AACtC,QAAM,IAAI,MAAM,GAAG,wBAAwB,IAAI,KAAK,mBAAmB;AACzE;AAEA,SAAS,iBACP,OACA,UACmB;AACnB,MAAI,UAAU,UAAa,UAAU,KAAM,QAAO;AAClD,MAAI,UAAU,UAAU,UAAU,QAAS,QAAO;AAClD,QAAM,IAAI;AAAA,IACR,GAAG,wBAAwB;AAAA,EAC7B;AACF;AAEA,SAAS,wBACP,OACA,UACA,OACU;AACV,MAAI,UAAU,UAAa,UAAU,KAAM,QAAO;AAClD,MACE,MAAM,QAAQ,KAAK,KACnB,MAAM,MAAM,CAAC,SAAS,OAAO,SAAS,QAAQ,GAC9C;AACA,WAAO;AAAA,EACT;AACA,QAAM,IAAI;AAAA,IACR,GAAG,wBAAwB,IAAI,KAAK;AAAA,EACtC;AACF;","names":[]}

package/dist/client/index.d.ts

@@ -1,5 +1,5 @@
 import * as react_jsx_runtime from 'react/jsx-runtime';
-import { L as LemonUser } from '../types-CgrEUXwM.js';
+import { a as LemonUser } from '../types-B5uRY2Si.js';
 import * as react from 'react';
 import 'jose';
 
@@ -20,7 +20,7 @@ declare function AutoTokenRefresh({ children, fallback, }: {
 
 declare function loginUrl(redirectUrl: string): string;
 declare function profileUrl(redirectUrl?: string): string;
-declare function logout(): Promise<void>;
+declare function logout(): Promise<boolean>;
 declare function refreshToken(): Promise<boolean>;
 
 export { AuthProvider, AutoTokenRefresh, LemonUser, loginUrl, logout, profileUrl, refreshToken, useAuth };

package/dist/client/index.js

@@ -1,10 +1,14 @@
 "use client";
 import {
+  ACCESS_TOKEN_COOKIE,
+  DEVICE_ID_COOKIE,
   LOGIN_URL,
   LOGOUT_URL,
   PROFILE_PAGE_URL,
-  REFRESH_URL
-} from "../chunk-B2EFAFKY.js";
+  REFRESH_TOKEN_COOKIE,
+  REFRESH_URL,
+  isMockAuthEnabled
+} from "../chunk-OX5MDVSR.js";
 
 // src/client/context.tsx
 import { createContext, useContext } from "react";
@@ -28,27 +32,101 @@ import { useEffect, useState } from "react";
 import { useRouter } from "next/navigation";
 
 // src/client/url.ts
+var LOGOUT_COOKIE_NAMES = [
+  ACCESS_TOKEN_COOKIE,
+  REFRESH_TOKEN_COOKIE,
+  DEVICE_ID_COOKIE
+];
 function loginUrl(redirectUrl) {
+  if (isMockAuthEnabled()) return redirectUrl;
+  assertValidLoginRedirectUrl(redirectUrl);
   return `${LOGIN_URL}?redirect_url=${encodeURIComponent(redirectUrl)}`;
 }
 function profileUrl(redirectUrl) {
+  if (isMockAuthEnabled()) return redirectUrl ?? "/";
   if (redirectUrl) {
     return `${PROFILE_PAGE_URL}?redirect_url=${encodeURIComponent(redirectUrl)}`;
   }
   return PROFILE_PAGE_URL;
 }
 async function logout() {
-  await fetch(LOGOUT_URL, {
-    method: "POST",
-    credentials: "include"
-  });
+  if (isMockAuthEnabled()) {
+    expireAuthCookies();
+    return true;
+  }
+  try {
+    const res = await fetch(LOGOUT_URL, {
+      method: "POST",
+      credentials: "include"
+    });
+    return res.ok;
+  } catch {
+    return false;
+  } finally {
+    expireAuthCookies();
+  }
 }
 async function refreshToken() {
-  const res = await fetch(REFRESH_URL, {
-    method: "POST",
-    credentials: "include"
-  });
-  return res.ok;
+  if (isMockAuthEnabled()) return true;
+  try {
+    const res = await fetch(REFRESH_URL, {
+      method: "POST",
+      credentials: "include"
+    });
+    return res.ok;
+  } catch {
+    return false;
+  }
+}
+function expireAuthCookies() {
+  if (typeof document === "undefined") return;
+  for (const name of LOGOUT_COOKIE_NAMES) {
+    for (const domain of getCookieDomains()) {
+      document.cookie = [
+        `${name}=`,
+        "Max-Age=0",
+        "Path=/",
+        "SameSite=Lax",
+        domain ? `Domain=${domain}` : ""
+      ].filter(Boolean).join("; ");
+    }
+  }
+}
+function getCookieDomains() {
+  if (typeof window === "undefined") return [""];
+  const { hostname } = window.location;
+  if (!hostname || hostname === "localhost" || isIpAddress(hostname)) {
+    return [""];
+  }
+  const labels = hostname.split(".");
+  const domains = [""];
+  for (let i = 0; i < labels.length - 1; i += 1) {
+    domains.push(`.${labels.slice(i).join(".")}`);
+  }
+  return domains;
+}
+function isIpAddress(hostname) {
+  return /^[\d.]+$/.test(hostname) || hostname.includes(":");
+}
+function assertValidLoginRedirectUrl(redirectUrl) {
+  let url;
+  try {
+    url = new URL(redirectUrl);
+  } catch {
+    throw new Error("loginUrl redirectUrl must be a valid absolute URL");
+  }
+  if (url.protocol !== "https:") {
+    throw new Error("loginUrl redirectUrl must use https");
+  }
+  if (!isAllowedLoginRedirectHost(url.hostname)) {
+    throw new Error(
+      "loginUrl redirectUrl host must be lemondouble.com or a subdomain of lemondouble.com"
+    );
+  }
+}
+function isAllowedLoginRedirectHost(hostname) {
+  const normalized = hostname.toLowerCase();
+  return normalized === "lemondouble.com" || normalized.endsWith(".lemondouble.com");
 }
 
 // src/client/auto-token-refresh.tsx

package/dist/client/index.js.map

@@ -1 +1 @@
-{"version":3,"sources":["../../src/client/context.tsx","../../src/client/auto-token-refresh.tsx","../../src/client/url.ts"],"sourcesContent":["\"use client\";\n\nimport { createContext, useContext } from \"react\";\nimport type { LemonUser } from \"../types.js\";\n\ninterface AuthContextValue {\n  user: LemonUser | null;\n  isAuthenticated: boolean;\n}\n\nconst AuthContext = createContext<AuthContextValue>({\n  user: null,\n  isAuthenticated: false,\n});\n\nexport function AuthProvider({\n  user,\n  children,\n}: {\n  user: LemonUser | null;\n  children: React.ReactNode;\n}) {\n  return (\n    <AuthContext value={{ user, isAuthenticated: user !== null }}>\n      {children}\n    </AuthContext>\n  );\n}\n\nexport function useAuth(): AuthContextValue {\n  return useContext(AuthContext);\n}\n","\"use client\";\n\nimport { useEffect, useState } from \"react\";\nimport { useRouter } from \"next/navigation\";\nimport { useAuth } from \"./context.js\";\nimport { refreshToken } from \"./url.js\";\n\nexport function AutoTokenRefresh({\n  children,\n  fallback,\n}: {\n  children?: React.ReactNode;\n  fallback: React.ReactNode;\n}) {\n  const { isAuthenticated } = useAuth();\n  const router = useRouter();\n  const [status, setStatus] = useState<\"loading\" | \"failed\">(\"loading\");\n\n  useEffect(() => {\n    if (isAuthenticated) return;\n\n    let ignore = false;\n\n    refreshToken().then((ok) => {\n      if (ignore) return;\n      if (ok) {\n        router.refresh();\n      } else {\n        setStatus(\"failed\");\n      }\n    });\n\n    return () => {\n      ignore = true;\n    };\n  }, [isAuthenticated, router]);\n\n  if (isAuthenticated) return null;\n  if (status === \"loading\") return fallback ?? null;\n  return children ?? null;\n}\n","import {\n  LOGIN_URL,\n  LOGOUT_URL,\n  PROFILE_PAGE_URL,\n  REFRESH_URL,\n} from \"../constants.js\";\n\nexport function loginUrl(redirectUrl: string): string {\n  return `${LOGIN_URL}?redirect_url=${encodeURIComponent(redirectUrl)}`;\n}\n\nexport function profileUrl(redirectUrl?: string): string {\n  if (redirectUrl) {\n    return `${PROFILE_PAGE_URL}?redirect_url=${encodeURIComponent(redirectUrl)}`;\n  }\n  return PROFILE_PAGE_URL;\n}\n\nexport async function logout(): Promise<void> {\n  await fetch(LOGOUT_URL, {\n    method: \"POST\",\n    credentials: \"include\",\n  });\n}\n\nexport async function refreshToken(): Promise<boolean> {\n  const res = await fetch(REFRESH_URL, {\n    method: \"POST\",\n    credentials: \"include\",\n  });\n  return res.ok;\n}\n"],"mappings":";;;;;;;;AAEA,SAAS,eAAe,kBAAkB;AAqBtC;AAbJ,IAAM,cAAc,cAAgC;AAAA,EAClD,MAAM;AAAA,EACN,iBAAiB;AACnB,CAAC;AAEM,SAAS,aAAa;AAAA,EAC3B;AAAA,EACA;AACF,GAGG;AACD,SACE,oBAAC,eAAY,OAAO,EAAE,MAAM,iBAAiB,SAAS,KAAK,GACxD,UACH;AAEJ;AAEO,SAAS,UAA4B;AAC1C,SAAO,WAAW,WAAW;AAC/B;;;AC7BA,SAAS,WAAW,gBAAgB;AACpC,SAAS,iBAAiB;;;ACInB,SAAS,SAAS,aAA6B;AACpD,SAAO,GAAG,SAAS,iBAAiB,mBAAmB,WAAW,CAAC;AACrE;AAEO,SAAS,WAAW,aAA8B;AACvD,MAAI,aAAa;AACf,WAAO,GAAG,gBAAgB,iBAAiB,mBAAmB,WAAW,CAAC;AAAA,EAC5E;AACA,SAAO;AACT;AAEA,eAAsB,SAAwB;AAC5C,QAAM,MAAM,YAAY;AAAA,IACtB,QAAQ;AAAA,IACR,aAAa;AAAA,EACf,CAAC;AACH;AAEA,eAAsB,eAAiC;AACrD,QAAM,MAAM,MAAM,MAAM,aAAa;AAAA,IACnC,QAAQ;AAAA,IACR,aAAa;AAAA,EACf,CAAC;AACD,SAAO,IAAI;AACb;;;ADxBO,SAAS,iBAAiB;AAAA,EAC/B;AAAA,EACA;AACF,GAGG;AACD,QAAM,EAAE,gBAAgB,IAAI,QAAQ;AACpC,QAAM,SAAS,UAAU;AACzB,QAAM,CAAC,QAAQ,SAAS,IAAI,SAA+B,SAAS;AAEpE,YAAU,MAAM;AACd,QAAI,gBAAiB;AAErB,QAAI,SAAS;AAEb,iBAAa,EAAE,KAAK,CAAC,OAAO;AAC1B,UAAI,OAAQ;AACZ,UAAI,IAAI;AACN,eAAO,QAAQ;AAAA,MACjB,OAAO;AACL,kBAAU,QAAQ;AAAA,MACpB;AAAA,IACF,CAAC;AAED,WAAO,MAAM;AACX,eAAS;AAAA,IACX;AAAA,EACF,GAAG,CAAC,iBAAiB,MAAM,CAAC;AAE5B,MAAI,gBAAiB,QAAO;AAC5B,MAAI,WAAW,UAAW,QAAO,YAAY;AAC7C,SAAO,YAAY;AACrB;","names":[]}
+{"version":3,"sources":["../../src/client/context.tsx","../../src/client/auto-token-refresh.tsx","../../src/client/url.ts"],"sourcesContent":["\"use client\";\n\nimport { createContext, useContext } from \"react\";\nimport type { LemonUser } from \"../types.js\";\n\ninterface AuthContextValue {\n  user: LemonUser | null;\n  isAuthenticated: boolean;\n}\n\nconst AuthContext = createContext<AuthContextValue>({\n  user: null,\n  isAuthenticated: false,\n});\n\nexport function AuthProvider({\n  user,\n  children,\n}: {\n  user: LemonUser | null;\n  children: React.ReactNode;\n}) {\n  return (\n    <AuthContext value={{ user, isAuthenticated: user !== null }}>\n      {children}\n    </AuthContext>\n  );\n}\n\nexport function useAuth(): AuthContextValue {\n  return useContext(AuthContext);\n}\n","\"use client\";\n\nimport { useEffect, useState } from \"react\";\nimport { useRouter } from \"next/navigation\";\nimport { useAuth } from \"./context.js\";\nimport { refreshToken } from \"./url.js\";\n\nexport function AutoTokenRefresh({\n  children,\n  fallback,\n}: {\n  children?: React.ReactNode;\n  fallback: React.ReactNode;\n}) {\n  const { isAuthenticated } = useAuth();\n  const router = useRouter();\n  const [status, setStatus] = useState<\"loading\" | \"failed\">(\"loading\");\n\n  useEffect(() => {\n    if (isAuthenticated) return;\n\n    let ignore = false;\n\n    refreshToken().then((ok) => {\n      if (ignore) return;\n      if (ok) {\n        router.refresh();\n      } else {\n        setStatus(\"failed\");\n      }\n    });\n\n    return () => {\n      ignore = true;\n    };\n  }, [isAuthenticated, router]);\n\n  if (isAuthenticated) return null;\n  if (status === \"loading\") return fallback ?? null;\n  return children ?? null;\n}\n","import {\n  ACCESS_TOKEN_COOKIE,\n  DEVICE_ID_COOKIE,\n  LOGIN_URL,\n  LOGOUT_URL,\n  PROFILE_PAGE_URL,\n  REFRESH_URL,\n  REFRESH_TOKEN_COOKIE,\n} from \"../constants.js\";\nimport { isMockAuthEnabled } from \"../mock.js\";\n\nconst LOGOUT_COOKIE_NAMES = [\n  ACCESS_TOKEN_COOKIE,\n  REFRESH_TOKEN_COOKIE,\n  DEVICE_ID_COOKIE,\n];\n\nexport function loginUrl(redirectUrl: string): string {\n  if (isMockAuthEnabled()) return redirectUrl;\n  assertValidLoginRedirectUrl(redirectUrl);\n  return `${LOGIN_URL}?redirect_url=${encodeURIComponent(redirectUrl)}`;\n}\n\nexport function profileUrl(redirectUrl?: string): string {\n  if (isMockAuthEnabled()) return redirectUrl ?? \"/\";\n  if (redirectUrl) {\n    return `${PROFILE_PAGE_URL}?redirect_url=${encodeURIComponent(redirectUrl)}`;\n  }\n  return PROFILE_PAGE_URL;\n}\n\nexport async function logout(): Promise<boolean> {\n  if (isMockAuthEnabled()) {\n    expireAuthCookies();\n    return true;\n  }\n\n  try {\n    const res = await fetch(LOGOUT_URL, {\n      method: \"POST\",\n      credentials: \"include\",\n    });\n    return res.ok;\n  } catch {\n    return false;\n  } finally {\n    expireAuthCookies();\n  }\n}\n\nexport async function refreshToken(): Promise<boolean> {\n  if (isMockAuthEnabled()) return true;\n\n  try {\n    const res = await fetch(REFRESH_URL, {\n      method: \"POST\",\n      credentials: \"include\",\n    });\n    return res.ok;\n  } catch {\n    return false;\n  }\n}\n\nfunction expireAuthCookies(): void {\n  if (typeof document === \"undefined\") return;\n\n  for (const name of LOGOUT_COOKIE_NAMES) {\n    for (const domain of getCookieDomains()) {\n      document.cookie = [\n        `${name}=`,\n        \"Max-Age=0\",\n        \"Path=/\",\n        \"SameSite=Lax\",\n        domain ? `Domain=${domain}` : \"\",\n      ]\n        .filter(Boolean)\n        .join(\"; \");\n    }\n  }\n}\n\nfunction getCookieDomains(): string[] {\n  if (typeof window === \"undefined\") return [\"\"];\n\n  const { hostname } = window.location;\n  if (!hostname || hostname === \"localhost\" || isIpAddress(hostname)) {\n    return [\"\"];\n  }\n\n  const labels = hostname.split(\".\");\n  const domains = [\"\"];\n  for (let i = 0; i < labels.length - 1; i += 1) {\n    domains.push(`.${labels.slice(i).join(\".\")}`);\n  }\n  return domains;\n}\n\nfunction isIpAddress(hostname: string): boolean {\n  return /^[\\d.]+$/.test(hostname) || hostname.includes(\":\");\n}\n\nfunction assertValidLoginRedirectUrl(redirectUrl: string): void {\n  let url: URL;\n  try {\n    url = new URL(redirectUrl);\n  } catch {\n    throw new Error(\"loginUrl redirectUrl must be a valid absolute URL\");\n  }\n\n  if (url.protocol !== \"https:\") {\n    throw new Error(\"loginUrl redirectUrl must use https\");\n  }\n\n  if (!isAllowedLoginRedirectHost(url.hostname)) {\n    throw new Error(\n      \"loginUrl redirectUrl host must be lemondouble.com or a subdomain of lemondouble.com\"\n    );\n  }\n}\n\nfunction isAllowedLoginRedirectHost(hostname: string): boolean {\n  const normalized = hostname.toLowerCase();\n  return (\n    normalized === \"lemondouble.com\" ||\n    normalized.endsWith(\".lemondouble.com\")\n  );\n}\n"],"mappings":";;;;;;;;;;;;AAEA,SAAS,eAAe,kBAAkB;AAqBtC;AAbJ,IAAM,cAAc,cAAgC;AAAA,EAClD,MAAM;AAAA,EACN,iBAAiB;AACnB,CAAC;AAEM,SAAS,aAAa;AAAA,EAC3B;AAAA,EACA;AACF,GAGG;AACD,SACE,oBAAC,eAAY,OAAO,EAAE,MAAM,iBAAiB,SAAS,KAAK,GACxD,UACH;AAEJ;AAEO,SAAS,UAA4B;AAC1C,SAAO,WAAW,WAAW;AAC/B;;;AC7BA,SAAS,WAAW,gBAAgB;AACpC,SAAS,iBAAiB;;;ACQ1B,IAAM,sBAAsB;AAAA,EAC1B;AAAA,EACA;AAAA,EACA;AACF;AAEO,SAAS,SAAS,aAA6B;AACpD,MAAI,kBAAkB,EAAG,QAAO;AAChC,8BAA4B,WAAW;AACvC,SAAO,GAAG,SAAS,iBAAiB,mBAAmB,WAAW,CAAC;AACrE;AAEO,SAAS,WAAW,aAA8B;AACvD,MAAI,kBAAkB,EAAG,QAAO,eAAe;AAC/C,MAAI,aAAa;AACf,WAAO,GAAG,gBAAgB,iBAAiB,mBAAmB,WAAW,CAAC;AAAA,EAC5E;AACA,SAAO;AACT;AAEA,eAAsB,SAA2B;AAC/C,MAAI,kBAAkB,GAAG;AACvB,sBAAkB;AAClB,WAAO;AAAA,EACT;AAEA,MAAI;AACF,UAAM,MAAM,MAAM,MAAM,YAAY;AAAA,MAClC,QAAQ;AAAA,MACR,aAAa;AAAA,IACf,CAAC;AACD,WAAO,IAAI;AAAA,EACb,QAAQ;AACN,WAAO;AAAA,EACT,UAAE;AACA,sBAAkB;AAAA,EACpB;AACF;AAEA,eAAsB,eAAiC;AACrD,MAAI,kBAAkB,EAAG,QAAO;AAEhC,MAAI;AACF,UAAM,MAAM,MAAM,MAAM,aAAa;AAAA,MACnC,QAAQ;AAAA,MACR,aAAa;AAAA,IACf,CAAC;AACD,WAAO,IAAI;AAAA,EACb,QAAQ;AACN,WAAO;AAAA,EACT;AACF;AAEA,SAAS,oBAA0B;AACjC,MAAI,OAAO,aAAa,YAAa;AAErC,aAAW,QAAQ,qBAAqB;AACtC,eAAW,UAAU,iBAAiB,GAAG;AACvC,eAAS,SAAS;AAAA,QAChB,GAAG,IAAI;AAAA,QACP;AAAA,QACA;AAAA,QACA;AAAA,QACA,SAAS,UAAU,MAAM,KAAK;AAAA,MAChC,EACG,OAAO,OAAO,EACd,KAAK,IAAI;AAAA,IACd;AAAA,EACF;AACF;AAEA,SAAS,mBAA6B;AACpC,MAAI,OAAO,WAAW,YAAa,QAAO,CAAC,EAAE;AAE7C,QAAM,EAAE,SAAS,IAAI,OAAO;AAC5B,MAAI,CAAC,YAAY,aAAa,eAAe,YAAY,QAAQ,GAAG;AAClE,WAAO,CAAC,EAAE;AAAA,EACZ;AAEA,QAAM,SAAS,SAAS,MAAM,GAAG;AACjC,QAAM,UAAU,CAAC,EAAE;AACnB,WAAS,IAAI,GAAG,IAAI,OAAO,SAAS,GAAG,KAAK,GAAG;AAC7C,YAAQ,KAAK,IAAI,OAAO,MAAM,CAAC,EAAE,KAAK,GAAG,CAAC,EAAE;AAAA,EAC9C;AACA,SAAO;AACT;AAEA,SAAS,YAAY,UAA2B;AAC9C,SAAO,WAAW,KAAK,QAAQ,KAAK,SAAS,SAAS,GAAG;AAC3D;AAEA,SAAS,4BAA4B,aAA2B;AAC9D,MAAI;AACJ,MAAI;AACF,UAAM,IAAI,IAAI,WAAW;AAAA,EAC3B,QAAQ;AACN,UAAM,IAAI,MAAM,mDAAmD;AAAA,EACrE;AAEA,MAAI,IAAI,aAAa,UAAU;AAC7B,UAAM,IAAI,MAAM,qCAAqC;AAAA,EACvD;AAEA,MAAI,CAAC,2BAA2B,IAAI,QAAQ,GAAG;AAC7C,UAAM,IAAI;AAAA,MACR;AAAA,IACF;AAAA,EACF;AACF;AAEA,SAAS,2BAA2B,UAA2B;AAC7D,QAAM,aAAa,SAAS,YAAY;AACxC,SACE,eAAe,qBACf,WAAW,SAAS,kBAAkB;AAE1C;;;ADxHO,SAAS,iBAAiB;AAAA,EAC/B;AAAA,EACA;AACF,GAGG;AACD,QAAM,EAAE,gBAAgB,IAAI,QAAQ;AACpC,QAAM,SAAS,UAAU;AACzB,QAAM,CAAC,QAAQ,SAAS,IAAI,SAA+B,SAAS;AAEpE,YAAU,MAAM;AACd,QAAI,gBAAiB;AAErB,QAAI,SAAS;AAEb,iBAAa,EAAE,KAAK,CAAC,OAAO;AAC1B,UAAI,OAAQ;AACZ,UAAI,IAAI;AACN,eAAO,QAAQ;AAAA,MACjB,OAAO;AACL,kBAAU,QAAQ;AAAA,MACpB;AAAA,IACF,CAAC;AAED,WAAO,MAAM;AACX,eAAS;AAAA,IACX;AAAA,EACF,GAAG,CAAC,iBAAiB,MAAM,CAAC;AAE5B,MAAI,gBAAiB,QAAO;AAC5B,MAAI,WAAW,UAAW,QAAO,YAAY;AAC7C,SAAO,YAAY;AACrB;","names":[]}

package/dist/proxy/index.d.ts

@@ -1,14 +1,25 @@
 import { NextRequest, NextResponse } from 'next/server';
-import { A as AccessTokenClaims } from '../types-CgrEUXwM.js';
-export { L as LemonUser } from '../types-CgrEUXwM.js';
+import { A as AccessTokenClaims } from '../types-B5uRY2Si.js';
+export { a as LemonUser } from '../types-B5uRY2Si.js';
 import 'jose';
 
+declare const DEFAULT_AUTH_BYPASS_PATHS: string[];
+declare const DEFAULT_API_PATHS: string[];
+declare const PROXY_AUTH_ERROR: {
+    readonly UNAUTHORIZED: "UNAUTHORIZED";
+    readonly FORBIDDEN: "FORBIDDEN";
+};
+type ProxyAuthErrorCode = (typeof PROXY_AUTH_ERROR)[keyof typeof PROXY_AUTH_ERROR];
+type LoginRedirectUrl = string | ((request: NextRequest) => string);
 interface AuthProxyOptions {
     publicPaths?: string[];
+    bypassPaths?: string[];
+    apiPaths?: string[];
     clientId?: string;
-    loginRedirectUrl?: string;
+    loginRedirectUrl?: LoginRedirectUrl;
+    unapprovedRedirectUrl?: LoginRedirectUrl;
     onAuthSuccess?: (claims: AccessTokenClaims, request: NextRequest, response: NextResponse) => Promise<NextResponse> | NextResponse;
 }
 declare function createAuthProxy(options?: AuthProxyOptions): (request: NextRequest) => Promise<NextResponse>;
 
-export { AccessTokenClaims, type AuthProxyOptions, createAuthProxy };
+export { AccessTokenClaims, type AuthProxyOptions, DEFAULT_API_PATHS, DEFAULT_AUTH_BYPASS_PATHS, type LoginRedirectUrl, PROXY_AUTH_ERROR, type ProxyAuthErrorCode, createAuthProxy };

package/dist/proxy/index.js

@@ -1,63 +1,145 @@
+import {
+  isAccessTokenClaims,
+  isApprovedClient
+} from "../chunk-6W24RWSJ.js";
 import {
   ACCESS_TOKEN_COOKIE,
   AUTH_SERVER_URL,
+  DEVICE_ID_COOKIE,
   JWKS_URL,
   LOGIN_URL,
   REFRESH_TOKEN_COOKIE,
-  REFRESH_URL
-} from "../chunk-B2EFAFKY.js";
+  REFRESH_URL,
+  getMockAccessTokenClaims
+} from "../chunk-OX5MDVSR.js";
 
 // src/proxy/index.ts
 import { NextResponse } from "next/server";
 import { createRemoteJWKSet, jwtVerify } from "jose";
 var REFRESH_BUFFER_SECONDS = 60;
+var DEFAULT_AUTH_BYPASS_PATHS = [
+  "/sw.js",
+  "/service-worker.js",
+  "/manifest.webmanifest",
+  "/manifest.json",
+  "/favicon.ico",
+  "/robots.txt",
+  "/sitemap.xml",
+  "/browserconfig.xml",
+  "/apple-touch-icon.png",
+  "/apple-touch-icon-*",
+  "/icon-*",
+  "/icons/*"
+];
+var DEFAULT_API_PATHS = ["/api/*"];
+var PROXY_AUTH_ERROR = {
+  UNAUTHORIZED: "UNAUTHORIZED",
+  FORBIDDEN: "FORBIDDEN"
+};
 var jwks = createRemoteJWKSet(new URL(JWKS_URL));
 function createAuthProxy(options = {}) {
-  const { publicPaths = [], clientId, loginRedirectUrl, onAuthSuccess } = options;
+  const {
+    publicPaths = [],
+    bypassPaths = [],
+    apiPaths = DEFAULT_API_PATHS,
+    clientId,
+    loginRedirectUrl,
+    unapprovedRedirectUrl,
+    onAuthSuccess
+  } = options;
+  const effectiveBypassPaths = [
+    ...DEFAULT_AUTH_BYPASS_PATHS,
+    ...bypassPaths
+  ];
   return async function proxy(request) {
     const { pathname } = request.nextUrl;
+    if (isPublicPath(pathname, effectiveBypassPaths)) {
+      return NextResponse.next();
+    }
     if (isPublicPath(pathname, publicPaths)) {
       return maybeRefreshAndContinue(request);
     }
+    const isApiRequest = isPublicPath(pathname, apiPaths);
+    const mockClaims = getMockAccessTokenClaims();
+    if (mockClaims) {
+      return handleVerifiedClaims(
+        mockClaims,
+        request,
+        isApiRequest,
+        clientId,
+        unapprovedRedirectUrl,
+        onAuthSuccess,
+        NextResponse.next()
+      );
+    }
     const accessToken = request.cookies.get(ACCESS_TOKEN_COOKIE)?.value;
     const refreshToken = request.cookies.get(REFRESH_TOKEN_COOKIE)?.value;
+    const deviceId = request.cookies.get(DEVICE_ID_COOKIE)?.value;
     if (accessToken && isTokenFresh(accessToken)) {
       const claims = await verifyToken(accessToken);
       if (claims) {
-        if (clientId && !claims.approved_clients.includes(clientId)) {
-          return redirectToLogin(request, loginRedirectUrl);
-        }
-        const response = NextResponse.next();
-        return onAuthSuccess ? await onAuthSuccess(claims, request, response) : response;
+        return handleVerifiedClaims(
+          claims,
+          request,
+          isApiRequest,
+          clientId,
+          unapprovedRedirectUrl,
+          onAuthSuccess,
+          NextResponse.next()
+        );
       }
     }
     if (refreshToken) {
-      const result = await tryRefresh(refreshToken);
+      const result = await tryRefresh(refreshToken, deviceId);
       if (result) {
         const claims = await verifyToken(result.newAccessToken);
         if (claims) {
-          if (clientId && !claims.approved_clients.includes(clientId)) {
-            return redirectToLogin(request, loginRedirectUrl);
-          }
           const response = NextResponse.next();
           for (const header of result.setCookieHeaders) {
             response.headers.append("Set-Cookie", header);
           }
-          return onAuthSuccess ? await onAuthSuccess(claims, request, response) : response;
+          return handleVerifiedClaims(
+            claims,
+            request,
+            isApiRequest,
+            clientId,
+            unapprovedRedirectUrl,
+            onAuthSuccess,
+            response
+          );
         }
       }
     }
-    return redirectToLogin(request, loginRedirectUrl);
+    return isApiRequest ? unauthorizedJson() : redirectToLogin(request, loginRedirectUrl);
   };
 }
+async function handleVerifiedClaims(claims, request, isApiRequest, clientId, unapprovedRedirectUrl, onAuthSuccess, response) {
+  if (!isApprovedClient(claims.approved_clients, clientId)) {
+    return isApiRequest ? forbiddenJson() : redirectToUnapproved(request, unapprovedRedirectUrl);
+  }
+  return onAuthSuccess ? await onAuthSuccess(claims, request, response) : response;
+}
+function unauthorizedJson() {
+  return NextResponse.json(
+    { code: PROXY_AUTH_ERROR.UNAUTHORIZED },
+    { status: 401 }
+  );
+}
+function forbiddenJson() {
+  return NextResponse.json(
+    { code: PROXY_AUTH_ERROR.FORBIDDEN },
+    { status: 403 }
+  );
+}
 async function maybeRefreshAndContinue(request) {
   const accessToken = request.cookies.get(ACCESS_TOKEN_COOKIE)?.value;
   const refreshToken = request.cookies.get(REFRESH_TOKEN_COOKIE)?.value;
+  const deviceId = request.cookies.get(DEVICE_ID_COOKIE)?.value;
   if (accessToken && isTokenFresh(accessToken)) {
     return NextResponse.next();
   }
   if (refreshToken) {
-    const result = await tryRefresh(refreshToken);
+    const result = await tryRefresh(refreshToken, deviceId);
     if (result) {
       const response = NextResponse.next();
       for (const header of result.setCookieHeaders) {
@@ -85,16 +167,16 @@ async function verifyToken(token) {
     const { payload } = await jwtVerify(token, jwks, {
       issuer: AUTH_SERVER_URL
     });
-    return payload;
+    return isAccessTokenClaims(payload) ? payload : null;
   } catch {
     return null;
   }
 }
-async function tryRefresh(refreshToken) {
+async function tryRefresh(refreshToken, deviceId) {
   try {
     const res = await fetch(REFRESH_URL, {
       method: "POST",
-      headers: { Cookie: `refresh_token=${refreshToken}` }
+      headers: { Cookie: buildRefreshCookieHeader(refreshToken, deviceId) }
     });
     if (!res.ok) return null;
     const setCookieHeaders = res.headers.getSetCookie();
@@ -105,9 +187,16 @@ async function tryRefresh(refreshToken) {
     return null;
   }
 }
+function buildRefreshCookieHeader(refreshToken, deviceId) {
+  const cookies = [`${REFRESH_TOKEN_COOKIE}=${refreshToken}`];
+  if (deviceId) {
+    cookies.push(`${DEVICE_ID_COOKIE}=${deviceId}`);
+  }
+  return cookies.join("; ");
+}
 function extractAccessToken(setCookieHeaders) {
   for (const header of setCookieHeaders) {
-    const match = header.match(/^access_token=([^;]+)/);
+    const match = header.match(new RegExp(`^${ACCESS_TOKEN_COOKIE}=([^;]+)`));
     if (match) return match[1];
   }
   return null;
@@ -121,13 +210,33 @@ function isPublicPath(pathname, publicPaths) {
   });
 }
 function redirectToLogin(request, loginRedirectUrl) {
-  if (loginRedirectUrl) {
-    const url = `${LOGIN_URL}?redirect_url=${encodeURIComponent(loginRedirectUrl)}`;
+  const redirectUrl = resolveLoginRedirectUrl(request, loginRedirectUrl);
+  if (redirectUrl) {
+    const url = `${LOGIN_URL}?redirect_url=${encodeURIComponent(redirectUrl)}`;
     return NextResponse.redirect(new URL(url, request.url));
   }
   return NextResponse.redirect(new URL("/", request.url));
 }
+function redirectToUnapproved(request, unapprovedRedirectUrl) {
+  const redirectUrl = resolveLoginRedirectUrl(request, unapprovedRedirectUrl);
+  if (redirectUrl) {
+    return NextResponse.redirect(new URL(redirectUrl, request.url));
+  }
+  const errorUrl = new URL(`${AUTH_SERVER_URL}/error`);
+  errorUrl.searchParams.set("code", PROXY_AUTH_ERROR.FORBIDDEN);
+  errorUrl.searchParams.set("from", request.url);
+  return NextResponse.redirect(errorUrl);
+}
+function resolveLoginRedirectUrl(request, loginRedirectUrl) {
+  if (typeof loginRedirectUrl === "function") {
+    return loginRedirectUrl(request);
+  }
+  return loginRedirectUrl;
+}
 export {
+  DEFAULT_API_PATHS,
+  DEFAULT_AUTH_BYPASS_PATHS,
+  PROXY_AUTH_ERROR,
   createAuthProxy
 };
 //# sourceMappingURL=index.js.map

package/dist/proxy/index.js.map

@@ -1 +1 @@
-{"version":3,"sources":["../../src/proxy/index.ts"],"sourcesContent":["import { NextRequest, NextResponse } from \"next/server\";\nimport {\n  ACCESS_TOKEN_COOKIE,\n  REFRESH_TOKEN_COOKIE,\n  AUTH_SERVER_URL,\n  REFRESH_URL,\n  JWKS_URL,\n  LOGIN_URL,\n} from \"../constants.js\";\nimport { createRemoteJWKSet, jwtVerify } from \"jose\";\nimport type { AccessTokenClaims } from \"../types.js\";\n\nconst REFRESH_BUFFER_SECONDS = 60;\n\nconst jwks = createRemoteJWKSet(new URL(JWKS_URL));\n\nexport interface AuthProxyOptions {\n  publicPaths?: string[];\n  clientId?: string;\n  loginRedirectUrl?: string;\n  onAuthSuccess?: (\n    claims: AccessTokenClaims,\n    request: NextRequest,\n    response: NextResponse\n  ) => Promise<NextResponse> | NextResponse;\n}\n\nexport function createAuthProxy(options: AuthProxyOptions = {}) {\n  const { publicPaths = [], clientId, loginRedirectUrl, onAuthSuccess } =\n    options;\n\n  return async function proxy(request: NextRequest): Promise<NextResponse> {\n    const { pathname } = request.nextUrl;\n\n    if (isPublicPath(pathname, publicPaths)) {\n      return maybeRefreshAndContinue(request);\n    }\n\n    const accessToken = request.cookies.get(ACCESS_TOKEN_COOKIE)?.value;\n    const refreshToken = request.cookies.get(REFRESH_TOKEN_COOKIE)?.value;\n\n    if (accessToken && isTokenFresh(accessToken)) {\n      const claims = await verifyToken(accessToken);\n      if (claims) {\n        if (clientId && !claims.approved_clients.includes(clientId)) {\n          return redirectToLogin(request, loginRedirectUrl);\n        }\n        const response = NextResponse.next();\n        return onAuthSuccess\n          ? await onAuthSuccess(claims, request, response)\n          : response;\n      }\n    }\n\n    if (refreshToken) {\n      const result = await tryRefresh(refreshToken);\n      if (result) {\n        const claims = await verifyToken(result.newAccessToken);\n        if (claims) {\n          if (clientId && !claims.approved_clients.includes(clientId)) {\n            return redirectToLogin(request, loginRedirectUrl);\n          }\n          const response = NextResponse.next();\n          for (const header of result.setCookieHeaders) {\n            response.headers.append(\"Set-Cookie\", header);\n          }\n          return onAuthSuccess\n            ? await onAuthSuccess(claims, request, response)\n            : response;\n        }\n      }\n    }\n\n    return redirectToLogin(request, loginRedirectUrl);\n  };\n}\n\nasync function maybeRefreshAndContinue(\n  request: NextRequest\n): Promise<NextResponse> {\n  const accessToken = request.cookies.get(ACCESS_TOKEN_COOKIE)?.value;\n  const refreshToken = request.cookies.get(REFRESH_TOKEN_COOKIE)?.value;\n\n  if (accessToken && isTokenFresh(accessToken)) {\n    return NextResponse.next();\n  }\n\n  if (refreshToken) {\n    const result = await tryRefresh(refreshToken);\n    if (result) {\n      const response = NextResponse.next();\n      for (const header of result.setCookieHeaders) {\n        response.headers.append(\"Set-Cookie\", header);\n      }\n      return response;\n    }\n  }\n\n  return NextResponse.next();\n}\n\nfunction isTokenFresh(token: string): boolean {\n  try {\n    const parts = token.split(\".\");\n    if (parts.length !== 3) return false;\n    const payload = JSON.parse(\n      Buffer.from(parts[1], \"base64url\").toString()\n    );\n    return (\n      typeof payload.exp === \"number\" &&\n      payload.exp > Math.floor(Date.now() / 1000) + REFRESH_BUFFER_SECONDS\n    );\n  } catch {\n    return false;\n  }\n}\n\nasync function verifyToken(\n  token: string\n): Promise<AccessTokenClaims | null> {\n  try {\n    const { payload } = await jwtVerify(token, jwks, {\n      issuer: AUTH_SERVER_URL,\n    });\n    return payload as unknown as AccessTokenClaims;\n  } catch {\n    return null;\n  }\n}\n\ninterface RefreshSuccess {\n  newAccessToken: string;\n  setCookieHeaders: string[];\n}\n\nasync function tryRefresh(\n  refreshToken: string\n): Promise<RefreshSuccess | null> {\n  try {\n    const res = await fetch(REFRESH_URL, {\n      method: \"POST\",\n      headers: { Cookie: `refresh_token=${refreshToken}` },\n    });\n\n    if (!res.ok) return null;\n\n    const setCookieHeaders = res.headers.getSetCookie();\n    const newAccessToken = extractAccessToken(setCookieHeaders);\n    if (!newAccessToken) return null;\n\n    return { newAccessToken, setCookieHeaders };\n  } catch {\n    return null;\n  }\n}\n\nfunction extractAccessToken(setCookieHeaders: string[]): string | null {\n  for (const header of setCookieHeaders) {\n    const match = header.match(/^access_token=([^;]+)/);\n    if (match) return match[1];\n  }\n  return null;\n}\n\nfunction isPublicPath(pathname: string, publicPaths: string[]): boolean {\n  return publicPaths.some((p) => {\n    if (p.endsWith(\"*\")) {\n      return pathname.startsWith(p.slice(0, -1));\n    }\n    return pathname === p;\n  });\n}\n\nfunction redirectToLogin(\n  request: NextRequest,\n  loginRedirectUrl?: string\n): NextResponse {\n  if (loginRedirectUrl) {\n    const url = `${LOGIN_URL}?redirect_url=${encodeURIComponent(loginRedirectUrl)}`;\n    return NextResponse.redirect(new URL(url, request.url));\n  }\n  return NextResponse.redirect(new URL(\"/\", request.url));\n}\n\nexport type { AccessTokenClaims } from \"../types.js\";\nexport type { LemonUser } from \"../types.js\";\n"],"mappings":";;;;;;;;;;AAAA,SAAsB,oBAAoB;AAS1C,SAAS,oBAAoB,iBAAiB;AAG9C,IAAM,yBAAyB;AAE/B,IAAM,OAAO,mBAAmB,IAAI,IAAI,QAAQ,CAAC;AAa1C,SAAS,gBAAgB,UAA4B,CAAC,GAAG;AAC9D,QAAM,EAAE,cAAc,CAAC,GAAG,UAAU,kBAAkB,cAAc,IAClE;AAEF,SAAO,eAAe,MAAM,SAA6C;AACvE,UAAM,EAAE,SAAS,IAAI,QAAQ;AAE7B,QAAI,aAAa,UAAU,WAAW,GAAG;AACvC,aAAO,wBAAwB,OAAO;AAAA,IACxC;AAEA,UAAM,cAAc,QAAQ,QAAQ,IAAI,mBAAmB,GAAG;AAC9D,UAAM,eAAe,QAAQ,QAAQ,IAAI,oBAAoB,GAAG;AAEhE,QAAI,eAAe,aAAa,WAAW,GAAG;AAC5C,YAAM,SAAS,MAAM,YAAY,WAAW;AAC5C,UAAI,QAAQ;AACV,YAAI,YAAY,CAAC,OAAO,iBAAiB,SAAS,QAAQ,GAAG;AAC3D,iBAAO,gBAAgB,SAAS,gBAAgB;AAAA,QAClD;AACA,cAAM,WAAW,aAAa,KAAK;AACnC,eAAO,gBACH,MAAM,cAAc,QAAQ,SAAS,QAAQ,IAC7C;AAAA,MACN;AAAA,IACF;AAEA,QAAI,cAAc;AAChB,YAAM,SAAS,MAAM,WAAW,YAAY;AAC5C,UAAI,QAAQ;AACV,cAAM,SAAS,MAAM,YAAY,OAAO,cAAc;AACtD,YAAI,QAAQ;AACV,cAAI,YAAY,CAAC,OAAO,iBAAiB,SAAS,QAAQ,GAAG;AAC3D,mBAAO,gBAAgB,SAAS,gBAAgB;AAAA,UAClD;AACA,gBAAM,WAAW,aAAa,KAAK;AACnC,qBAAW,UAAU,OAAO,kBAAkB;AAC5C,qBAAS,QAAQ,OAAO,cAAc,MAAM;AAAA,UAC9C;AACA,iBAAO,gBACH,MAAM,cAAc,QAAQ,SAAS,QAAQ,IAC7C;AAAA,QACN;AAAA,MACF;AAAA,IACF;AAEA,WAAO,gBAAgB,SAAS,gBAAgB;AAAA,EAClD;AACF;AAEA,eAAe,wBACb,SACuB;AACvB,QAAM,cAAc,QAAQ,QAAQ,IAAI,mBAAmB,GAAG;AAC9D,QAAM,eAAe,QAAQ,QAAQ,IAAI,oBAAoB,GAAG;AAEhE,MAAI,eAAe,aAAa,WAAW,GAAG;AAC5C,WAAO,aAAa,KAAK;AAAA,EAC3B;AAEA,MAAI,cAAc;AAChB,UAAM,SAAS,MAAM,WAAW,YAAY;AAC5C,QAAI,QAAQ;AACV,YAAM,WAAW,aAAa,KAAK;AACnC,iBAAW,UAAU,OAAO,kBAAkB;AAC5C,iBAAS,QAAQ,OAAO,cAAc,MAAM;AAAA,MAC9C;AACA,aAAO;AAAA,IACT;AAAA,EACF;AAEA,SAAO,aAAa,KAAK;AAC3B;AAEA,SAAS,aAAa,OAAwB;AAC5C,MAAI;AACF,UAAM,QAAQ,MAAM,MAAM,GAAG;AAC7B,QAAI,MAAM,WAAW,EAAG,QAAO;AAC/B,UAAM,UAAU,KAAK;AAAA,MACnB,OAAO,KAAK,MAAM,CAAC,GAAG,WAAW,EAAE,SAAS;AAAA,IAC9C;AACA,WACE,OAAO,QAAQ,QAAQ,YACvB,QAAQ,MAAM,KAAK,MAAM,KAAK,IAAI,IAAI,GAAI,IAAI;AAAA,EAElD,QAAQ;AACN,WAAO;AAAA,EACT;AACF;AAEA,eAAe,YACb,OACmC;AACnC,MAAI;AACF,UAAM,EAAE,QAAQ,IAAI,MAAM,UAAU,OAAO,MAAM;AAAA,MAC/C,QAAQ;AAAA,IACV,CAAC;AACD,WAAO;AAAA,EACT,QAAQ;AACN,WAAO;AAAA,EACT;AACF;AAOA,eAAe,WACb,cACgC;AAChC,MAAI;AACF,UAAM,MAAM,MAAM,MAAM,aAAa;AAAA,MACnC,QAAQ;AAAA,MACR,SAAS,EAAE,QAAQ,iBAAiB,YAAY,GAAG;AAAA,IACrD,CAAC;AAED,QAAI,CAAC,IAAI,GAAI,QAAO;AAEpB,UAAM,mBAAmB,IAAI,QAAQ,aAAa;AAClD,UAAM,iBAAiB,mBAAmB,gBAAgB;AAC1D,QAAI,CAAC,eAAgB,QAAO;AAE5B,WAAO,EAAE,gBAAgB,iBAAiB;AAAA,EAC5C,QAAQ;AACN,WAAO;AAAA,EACT;AACF;AAEA,SAAS,mBAAmB,kBAA2C;AACrE,aAAW,UAAU,kBAAkB;AACrC,UAAM,QAAQ,OAAO,MAAM,uBAAuB;AAClD,QAAI,MAAO,QAAO,MAAM,CAAC;AAAA,EAC3B;AACA,SAAO;AACT;AAEA,SAAS,aAAa,UAAkB,aAAgC;AACtE,SAAO,YAAY,KAAK,CAAC,MAAM;AAC7B,QAAI,EAAE,SAAS,GAAG,GAAG;AACnB,aAAO,SAAS,WAAW,EAAE,MAAM,GAAG,EAAE,CAAC;AAAA,IAC3C;AACA,WAAO,aAAa;AAAA,EACtB,CAAC;AACH;AAEA,SAAS,gBACP,SACA,kBACc;AACd,MAAI,kBAAkB;AACpB,UAAM,MAAM,GAAG,SAAS,iBAAiB,mBAAmB,gBAAgB,CAAC;AAC7E,WAAO,aAAa,SAAS,IAAI,IAAI,KAAK,QAAQ,GAAG,CAAC;AAAA,EACxD;AACA,SAAO,aAAa,SAAS,IAAI,IAAI,KAAK,QAAQ,GAAG,CAAC;AACxD;","names":[]}
+{"version":3,"sources":["../../src/proxy/index.ts"],"sourcesContent":["import { NextRequest, NextResponse } from \"next/server\";\nimport {\n  ACCESS_TOKEN_COOKIE,\n  REFRESH_TOKEN_COOKIE,\n  DEVICE_ID_COOKIE,\n  AUTH_SERVER_URL,\n  REFRESH_URL,\n  JWKS_URL,\n  LOGIN_URL,\n} from \"../constants.js\";\nimport { createRemoteJWKSet, jwtVerify } from \"jose\";\nimport type { AccessTokenClaims } from \"../types.js\";\nimport { isAccessTokenClaims } from \"../claims.js\";\nimport { isApprovedClient } from \"../approval.js\";\nimport { getMockAccessTokenClaims } from \"../mock.js\";\n\nconst REFRESH_BUFFER_SECONDS = 60;\n\nexport const DEFAULT_AUTH_BYPASS_PATHS = [\n  \"/sw.js\",\n  \"/service-worker.js\",\n  \"/manifest.webmanifest\",\n  \"/manifest.json\",\n  \"/favicon.ico\",\n  \"/robots.txt\",\n  \"/sitemap.xml\",\n  \"/browserconfig.xml\",\n  \"/apple-touch-icon.png\",\n  \"/apple-touch-icon-*\",\n  \"/icon-*\",\n  \"/icons/*\",\n];\n\nexport const DEFAULT_API_PATHS = [\"/api/*\"];\n\nexport const PROXY_AUTH_ERROR = {\n  UNAUTHORIZED: \"UNAUTHORIZED\",\n  FORBIDDEN: \"FORBIDDEN\",\n} as const;\nexport type ProxyAuthErrorCode =\n  (typeof PROXY_AUTH_ERROR)[keyof typeof PROXY_AUTH_ERROR];\n\nconst jwks = createRemoteJWKSet(new URL(JWKS_URL));\n\nexport type LoginRedirectUrl = string | ((request: NextRequest) => string);\n\nexport interface AuthProxyOptions {\n  publicPaths?: string[];\n  bypassPaths?: string[];\n  apiPaths?: string[];\n  clientId?: string;\n  loginRedirectUrl?: LoginRedirectUrl;\n  unapprovedRedirectUrl?: LoginRedirectUrl;\n  onAuthSuccess?: (\n    claims: AccessTokenClaims,\n    request: NextRequest,\n    response: NextResponse\n  ) => Promise<NextResponse> | NextResponse;\n}\n\nexport function createAuthProxy(options: AuthProxyOptions = {}) {\n  const {\n    publicPaths = [],\n    bypassPaths = [],\n    apiPaths = DEFAULT_API_PATHS,\n    clientId,\n    loginRedirectUrl,\n    unapprovedRedirectUrl,\n    onAuthSuccess,\n  } = options;\n  const effectiveBypassPaths = [\n    ...DEFAULT_AUTH_BYPASS_PATHS,\n    ...bypassPaths,\n  ];\n\n  return async function proxy(request: NextRequest): Promise<NextResponse> {\n    const { pathname } = request.nextUrl;\n\n    if (isPublicPath(pathname, effectiveBypassPaths)) {\n      return NextResponse.next();\n    }\n\n    if (isPublicPath(pathname, publicPaths)) {\n      return maybeRefreshAndContinue(request);\n    }\n\n    const isApiRequest = isPublicPath(pathname, apiPaths);\n    const mockClaims = getMockAccessTokenClaims();\n    if (mockClaims) {\n      return handleVerifiedClaims(\n        mockClaims,\n        request,\n        isApiRequest,\n        clientId,\n        unapprovedRedirectUrl,\n        onAuthSuccess,\n        NextResponse.next()\n      );\n    }\n\n    const accessToken = request.cookies.get(ACCESS_TOKEN_COOKIE)?.value;\n    const refreshToken = request.cookies.get(REFRESH_TOKEN_COOKIE)?.value;\n    const deviceId = request.cookies.get(DEVICE_ID_COOKIE)?.value;\n\n    if (accessToken && isTokenFresh(accessToken)) {\n      const claims = await verifyToken(accessToken);\n      if (claims) {\n        return handleVerifiedClaims(\n          claims,\n          request,\n          isApiRequest,\n          clientId,\n          unapprovedRedirectUrl,\n          onAuthSuccess,\n          NextResponse.next()\n        );\n      }\n    }\n\n    if (refreshToken) {\n      const result = await tryRefresh(refreshToken, deviceId);\n      if (result) {\n        const claims = await verifyToken(result.newAccessToken);\n        if (claims) {\n          const response = NextResponse.next();\n          for (const header of result.setCookieHeaders) {\n            response.headers.append(\"Set-Cookie\", header);\n          }\n          return handleVerifiedClaims(\n            claims,\n            request,\n            isApiRequest,\n            clientId,\n            unapprovedRedirectUrl,\n            onAuthSuccess,\n            response\n          );\n        }\n      }\n    }\n\n    return isApiRequest\n      ? unauthorizedJson()\n      : redirectToLogin(request, loginRedirectUrl);\n  };\n}\n\nasync function handleVerifiedClaims(\n  claims: AccessTokenClaims,\n  request: NextRequest,\n  isApiRequest: boolean,\n  clientId: string | undefined,\n  unapprovedRedirectUrl: LoginRedirectUrl | undefined,\n  onAuthSuccess: AuthProxyOptions[\"onAuthSuccess\"],\n  response: NextResponse\n): Promise<NextResponse> {\n  if (!isApprovedClient(claims.approved_clients, clientId)) {\n    return isApiRequest\n      ? forbiddenJson()\n      : redirectToUnapproved(request, unapprovedRedirectUrl);\n  }\n\n  return onAuthSuccess\n    ? await onAuthSuccess(claims, request, response)\n    : response;\n}\n\nfunction unauthorizedJson(): NextResponse {\n  return NextResponse.json(\n    { code: PROXY_AUTH_ERROR.UNAUTHORIZED },\n    { status: 401 }\n  );\n}\n\nfunction forbiddenJson(): NextResponse {\n  return NextResponse.json(\n    { code: PROXY_AUTH_ERROR.FORBIDDEN },\n    { status: 403 }\n  );\n}\n\nasync function maybeRefreshAndContinue(\n  request: NextRequest\n): Promise<NextResponse> {\n  const accessToken = request.cookies.get(ACCESS_TOKEN_COOKIE)?.value;\n  const refreshToken = request.cookies.get(REFRESH_TOKEN_COOKIE)?.value;\n  const deviceId = request.cookies.get(DEVICE_ID_COOKIE)?.value;\n\n  if (accessToken && isTokenFresh(accessToken)) {\n    return NextResponse.next();\n  }\n\n  if (refreshToken) {\n    const result = await tryRefresh(refreshToken, deviceId);\n    if (result) {\n      const response = NextResponse.next();\n      for (const header of result.setCookieHeaders) {\n        response.headers.append(\"Set-Cookie\", header);\n      }\n      return response;\n    }\n  }\n\n  return NextResponse.next();\n}\n\nfunction isTokenFresh(token: string): boolean {\n  try {\n    const parts = token.split(\".\");\n    if (parts.length !== 3) return false;\n    const payload = JSON.parse(\n      Buffer.from(parts[1], \"base64url\").toString()\n    );\n    return (\n      typeof payload.exp === \"number\" &&\n      payload.exp > Math.floor(Date.now() / 1000) + REFRESH_BUFFER_SECONDS\n    );\n  } catch {\n    return false;\n  }\n}\n\nasync function verifyToken(\n  token: string\n): Promise<AccessTokenClaims | null> {\n  try {\n    const { payload } = await jwtVerify(token, jwks, {\n      issuer: AUTH_SERVER_URL,\n    });\n    return isAccessTokenClaims(payload) ? payload : null;\n  } catch {\n    return null;\n  }\n}\n\ninterface RefreshSuccess {\n  newAccessToken: string;\n  setCookieHeaders: string[];\n}\n\nasync function tryRefresh(\n  refreshToken: string,\n  deviceId?: string\n): Promise<RefreshSuccess | null> {\n  try {\n    const res = await fetch(REFRESH_URL, {\n      method: \"POST\",\n      headers: { Cookie: buildRefreshCookieHeader(refreshToken, deviceId) },\n    });\n\n    if (!res.ok) return null;\n\n    const setCookieHeaders = res.headers.getSetCookie();\n    const newAccessToken = extractAccessToken(setCookieHeaders);\n    if (!newAccessToken) return null;\n\n    return { newAccessToken, setCookieHeaders };\n  } catch {\n    return null;\n  }\n}\n\nfunction buildRefreshCookieHeader(\n  refreshToken: string,\n  deviceId?: string\n): string {\n  const cookies = [`${REFRESH_TOKEN_COOKIE}=${refreshToken}`];\n  if (deviceId) {\n    cookies.push(`${DEVICE_ID_COOKIE}=${deviceId}`);\n  }\n  return cookies.join(\"; \");\n}\n\nfunction extractAccessToken(setCookieHeaders: string[]): string | null {\n  for (const header of setCookieHeaders) {\n    const match = header.match(new RegExp(`^${ACCESS_TOKEN_COOKIE}=([^;]+)`));\n    if (match) return match[1];\n  }\n  return null;\n}\n\nfunction isPublicPath(pathname: string, publicPaths: string[]): boolean {\n  return publicPaths.some((p) => {\n    if (p.endsWith(\"*\")) {\n      return pathname.startsWith(p.slice(0, -1));\n    }\n    return pathname === p;\n  });\n}\n\nfunction redirectToLogin(\n  request: NextRequest,\n  loginRedirectUrl?: LoginRedirectUrl\n): NextResponse {\n  const redirectUrl = resolveLoginRedirectUrl(request, loginRedirectUrl);\n  if (redirectUrl) {\n    const url = `${LOGIN_URL}?redirect_url=${encodeURIComponent(redirectUrl)}`;\n    return NextResponse.redirect(new URL(url, request.url));\n  }\n  return NextResponse.redirect(new URL(\"/\", request.url));\n}\n\nfunction redirectToUnapproved(\n  request: NextRequest,\n  unapprovedRedirectUrl?: LoginRedirectUrl\n): NextResponse {\n  const redirectUrl = resolveLoginRedirectUrl(request, unapprovedRedirectUrl);\n  if (redirectUrl) {\n    return NextResponse.redirect(new URL(redirectUrl, request.url));\n  }\n  const errorUrl = new URL(`${AUTH_SERVER_URL}/error`);\n  errorUrl.searchParams.set(\"code\", PROXY_AUTH_ERROR.FORBIDDEN);\n  errorUrl.searchParams.set(\"from\", request.url);\n  return NextResponse.redirect(errorUrl);\n}\n\nfunction resolveLoginRedirectUrl(\n  request: NextRequest,\n  loginRedirectUrl?: LoginRedirectUrl\n): string | undefined {\n  if (typeof loginRedirectUrl === \"function\") {\n    return loginRedirectUrl(request);\n  }\n  return loginRedirectUrl;\n}\n\nexport type { AccessTokenClaims } from \"../types.js\";\nexport type { LemonUser } from \"../types.js\";\n"],"mappings":";;;;;;;;;;;;;;;;AAAA,SAAsB,oBAAoB;AAU1C,SAAS,oBAAoB,iBAAiB;AAM9C,IAAM,yBAAyB;AAExB,IAAM,4BAA4B;AAAA,EACvC;AAAA,EACA;AAAA,EACA;AAAA,EACA;AAAA,EACA;AAAA,EACA;AAAA,EACA;AAAA,EACA;AAAA,EACA;AAAA,EACA;AAAA,EACA;AAAA,EACA;AACF;AAEO,IAAM,oBAAoB,CAAC,QAAQ;AAEnC,IAAM,mBAAmB;AAAA,EAC9B,cAAc;AAAA,EACd,WAAW;AACb;AAIA,IAAM,OAAO,mBAAmB,IAAI,IAAI,QAAQ,CAAC;AAkB1C,SAAS,gBAAgB,UAA4B,CAAC,GAAG;AAC9D,QAAM;AAAA,IACJ,cAAc,CAAC;AAAA,IACf,cAAc,CAAC;AAAA,IACf,WAAW;AAAA,IACX;AAAA,IACA;AAAA,IACA;AAAA,IACA;AAAA,EACF,IAAI;AACJ,QAAM,uBAAuB;AAAA,IAC3B,GAAG;AAAA,IACH,GAAG;AAAA,EACL;AAEA,SAAO,eAAe,MAAM,SAA6C;AACvE,UAAM,EAAE,SAAS,IAAI,QAAQ;AAE7B,QAAI,aAAa,UAAU,oBAAoB,GAAG;AAChD,aAAO,aAAa,KAAK;AAAA,IAC3B;AAEA,QAAI,aAAa,UAAU,WAAW,GAAG;AACvC,aAAO,wBAAwB,OAAO;AAAA,IACxC;AAEA,UAAM,eAAe,aAAa,UAAU,QAAQ;AACpD,UAAM,aAAa,yBAAyB;AAC5C,QAAI,YAAY;AACd,aAAO;AAAA,QACL;AAAA,QACA;AAAA,QACA;AAAA,QACA;AAAA,QACA;AAAA,QACA;AAAA,QACA,aAAa,KAAK;AAAA,MACpB;AAAA,IACF;AAEA,UAAM,cAAc,QAAQ,QAAQ,IAAI,mBAAmB,GAAG;AAC9D,UAAM,eAAe,QAAQ,QAAQ,IAAI,oBAAoB,GAAG;AAChE,UAAM,WAAW,QAAQ,QAAQ,IAAI,gBAAgB,GAAG;AAExD,QAAI,eAAe,aAAa,WAAW,GAAG;AAC5C,YAAM,SAAS,MAAM,YAAY,WAAW;AAC5C,UAAI,QAAQ;AACV,eAAO;AAAA,UACL;AAAA,UACA;AAAA,UACA;AAAA,UACA;AAAA,UACA;AAAA,UACA;AAAA,UACA,aAAa,KAAK;AAAA,QACpB;AAAA,MACF;AAAA,IACF;AAEA,QAAI,cAAc;AAChB,YAAM,SAAS,MAAM,WAAW,cAAc,QAAQ;AACtD,UAAI,QAAQ;AACV,cAAM,SAAS,MAAM,YAAY,OAAO,cAAc;AACtD,YAAI,QAAQ;AACV,gBAAM,WAAW,aAAa,KAAK;AACnC,qBAAW,UAAU,OAAO,kBAAkB;AAC5C,qBAAS,QAAQ,OAAO,cAAc,MAAM;AAAA,UAC9C;AACA,iBAAO;AAAA,YACL;AAAA,YACA;AAAA,YACA;AAAA,YACA;AAAA,YACA;AAAA,YACA;AAAA,YACA;AAAA,UACF;AAAA,QACF;AAAA,MACF;AAAA,IACF;AAEA,WAAO,eACH,iBAAiB,IACjB,gBAAgB,SAAS,gBAAgB;AAAA,EAC/C;AACF;AAEA,eAAe,qBACb,QACA,SACA,cACA,UACA,uBACA,eACA,UACuB;AACvB,MAAI,CAAC,iBAAiB,OAAO,kBAAkB,QAAQ,GAAG;AACxD,WAAO,eACH,cAAc,IACd,qBAAqB,SAAS,qBAAqB;AAAA,EACzD;AAEA,SAAO,gBACH,MAAM,cAAc,QAAQ,SAAS,QAAQ,IAC7C;AACN;AAEA,SAAS,mBAAiC;AACxC,SAAO,aAAa;AAAA,IAClB,EAAE,MAAM,iBAAiB,aAAa;AAAA,IACtC,EAAE,QAAQ,IAAI;AAAA,EAChB;AACF;AAEA,SAAS,gBAA8B;AACrC,SAAO,aAAa;AAAA,IAClB,EAAE,MAAM,iBAAiB,UAAU;AAAA,IACnC,EAAE,QAAQ,IAAI;AAAA,EAChB;AACF;AAEA,eAAe,wBACb,SACuB;AACvB,QAAM,cAAc,QAAQ,QAAQ,IAAI,mBAAmB,GAAG;AAC9D,QAAM,eAAe,QAAQ,QAAQ,IAAI,oBAAoB,GAAG;AAChE,QAAM,WAAW,QAAQ,QAAQ,IAAI,gBAAgB,GAAG;AAExD,MAAI,eAAe,aAAa,WAAW,GAAG;AAC5C,WAAO,aAAa,KAAK;AAAA,EAC3B;AAEA,MAAI,cAAc;AAChB,UAAM,SAAS,MAAM,WAAW,cAAc,QAAQ;AACtD,QAAI,QAAQ;AACV,YAAM,WAAW,aAAa,KAAK;AACnC,iBAAW,UAAU,OAAO,kBAAkB;AAC5C,iBAAS,QAAQ,OAAO,cAAc,MAAM;AAAA,MAC9C;AACA,aAAO;AAAA,IACT;AAAA,EACF;AAEA,SAAO,aAAa,KAAK;AAC3B;AAEA,SAAS,aAAa,OAAwB;AAC5C,MAAI;AACF,UAAM,QAAQ,MAAM,MAAM,GAAG;AAC7B,QAAI,MAAM,WAAW,EAAG,QAAO;AAC/B,UAAM,UAAU,KAAK;AAAA,MACnB,OAAO,KAAK,MAAM,CAAC,GAAG,WAAW,EAAE,SAAS;AAAA,IAC9C;AACA,WACE,OAAO,QAAQ,QAAQ,YACvB,QAAQ,MAAM,KAAK,MAAM,KAAK,IAAI,IAAI,GAAI,IAAI;AAAA,EAElD,QAAQ;AACN,WAAO;AAAA,EACT;AACF;AAEA,eAAe,YACb,OACmC;AACnC,MAAI;AACF,UAAM,EAAE,QAAQ,IAAI,MAAM,UAAU,OAAO,MAAM;AAAA,MAC/C,QAAQ;AAAA,IACV,CAAC;AACD,WAAO,oBAAoB,OAAO,IAAI,UAAU;AAAA,EAClD,QAAQ;AACN,WAAO;AAAA,EACT;AACF;AAOA,eAAe,WACb,cACA,UACgC;AAChC,MAAI;AACF,UAAM,MAAM,MAAM,MAAM,aAAa;AAAA,MACnC,QAAQ;AAAA,MACR,SAAS,EAAE,QAAQ,yBAAyB,cAAc,QAAQ,EAAE;AAAA,IACtE,CAAC;AAED,QAAI,CAAC,IAAI,GAAI,QAAO;AAEpB,UAAM,mBAAmB,IAAI,QAAQ,aAAa;AAClD,UAAM,iBAAiB,mBAAmB,gBAAgB;AAC1D,QAAI,CAAC,eAAgB,QAAO;AAE5B,WAAO,EAAE,gBAAgB,iBAAiB;AAAA,EAC5C,QAAQ;AACN,WAAO;AAAA,EACT;AACF;AAEA,SAAS,yBACP,cACA,UACQ;AACR,QAAM,UAAU,CAAC,GAAG,oBAAoB,IAAI,YAAY,EAAE;AAC1D,MAAI,UAAU;AACZ,YAAQ,KAAK,GAAG,gBAAgB,IAAI,QAAQ,EAAE;AAAA,EAChD;AACA,SAAO,QAAQ,KAAK,IAAI;AAC1B;AAEA,SAAS,mBAAmB,kBAA2C;AACrE,aAAW,UAAU,kBAAkB;AACrC,UAAM,QAAQ,OAAO,MAAM,IAAI,OAAO,IAAI,mBAAmB,UAAU,CAAC;AACxE,QAAI,MAAO,QAAO,MAAM,CAAC;AAAA,EAC3B;AACA,SAAO;AACT;AAEA,SAAS,aAAa,UAAkB,aAAgC;AACtE,SAAO,YAAY,KAAK,CAAC,MAAM;AAC7B,QAAI,EAAE,SAAS,GAAG,GAAG;AACnB,aAAO,SAAS,WAAW,EAAE,MAAM,GAAG,EAAE,CAAC;AAAA,IAC3C;AACA,WAAO,aAAa;AAAA,EACtB,CAAC;AACH;AAEA,SAAS,gBACP,SACA,kBACc;AACd,QAAM,cAAc,wBAAwB,SAAS,gBAAgB;AACrE,MAAI,aAAa;AACf,UAAM,MAAM,GAAG,SAAS,iBAAiB,mBAAmB,WAAW,CAAC;AACxE,WAAO,aAAa,SAAS,IAAI,IAAI,KAAK,QAAQ,GAAG,CAAC;AAAA,EACxD;AACA,SAAO,aAAa,SAAS,IAAI,IAAI,KAAK,QAAQ,GAAG,CAAC;AACxD;AAEA,SAAS,qBACP,SACA,uBACc;AACd,QAAM,cAAc,wBAAwB,SAAS,qBAAqB;AAC1E,MAAI,aAAa;AACf,WAAO,aAAa,SAAS,IAAI,IAAI,aAAa,QAAQ,GAAG,CAAC;AAAA,EAChE;AACA,QAAM,WAAW,IAAI,IAAI,GAAG,eAAe,QAAQ;AACnD,WAAS,aAAa,IAAI,QAAQ,iBAAiB,SAAS;AAC5D,WAAS,aAAa,IAAI,QAAQ,QAAQ,GAAG;AAC7C,SAAO,aAAa,SAAS,QAAQ;AACvC;AAEA,SAAS,wBACP,SACA,kBACoB;AACpB,MAAI,OAAO,qBAAqB,YAAY;AAC1C,WAAO,iBAAiB,OAAO;AAAA,EACjC;AACA,SAAO;AACT;","names":[]}

package/dist/server/index.d.ts

@@ -1,19 +1,27 @@
-import { A as AccessTokenClaims, L as LemonUser } from '../types-CgrEUXwM.js';
-export { U as UserProfile } from '../types-CgrEUXwM.js';
+import { A as AccessTokenClaims, L as LemonSession, a as LemonUser } from '../types-B5uRY2Si.js';
+export { U as UserProfile } from '../types-B5uRY2Si.js';
 import 'jose';
 
 declare function verifyAccessToken(): Promise<AccessTokenClaims | null>;
 declare function verifyAccessTokenString(token: string): Promise<AccessTokenClaims | null>;
 
 declare const getUser: () => Promise<LemonUser | null>;
+interface GetSessionOptions {
+    clientId?: string;
+}
+declare function getSession(options?: GetSessionOptions): Promise<LemonSession>;
 declare function requireAuth(redirectTo?: string): Promise<LemonUser>;
-declare function requireClient(clientId: string, redirectTo?: string): Promise<LemonUser>;
+interface RequireClientOptions {
+    loginRedirectTo?: string;
+    unapprovedRedirectTo?: string;
+}
+declare function requireClient(clientId: string, optionsOrRedirectTo?: string | RequireClientOptions): Promise<LemonUser>;
 
 interface RefreshResult {
     ok: boolean;
     setCookieHeaders: string[];
 }
-declare function refreshTokenFromCookie(refreshTokenCookie: string): Promise<RefreshResult>;
+declare function refreshTokenFromCookie(refreshTokenCookie: string, deviceIdCookie?: string): Promise<RefreshResult>;
 
 declare const AUTH_SERVER_URL = "https://auth.lemondouble.com";
 declare const JWKS_URL = "https://auth.lemondouble.com/.well-known/jwks.json";
@@ -22,7 +30,8 @@ declare const REFRESH_URL = "https://auth.lemondouble.com/api/token/refresh";
 declare const LOGOUT_URL = "https://auth.lemondouble.com/api/token/logout";
 declare const PROFILE_URL = "https://auth.lemondouble.com/api/user/me";
 declare const PROFILE_PAGE_URL = "https://auth.lemondouble.com/profile";
-declare const ACCESS_TOKEN_COOKIE = "access_token";
-declare const REFRESH_TOKEN_COOKIE = "refresh_token";
+declare const ACCESS_TOKEN_COOKIE = "lemon_access_token";
+declare const REFRESH_TOKEN_COOKIE = "lemon_refresh_token";
+declare const DEVICE_ID_COOKIE = "device_id";
 
-export { ACCESS_TOKEN_COOKIE, AUTH_SERVER_URL, AccessTokenClaims, JWKS_URL, LOGIN_URL, LOGOUT_URL, LemonUser, PROFILE_PAGE_URL, PROFILE_URL, REFRESH_TOKEN_COOKIE, REFRESH_URL, type RefreshResult, getUser, refreshTokenFromCookie, requireAuth, requireClient, verifyAccessToken, verifyAccessTokenString };
+export { ACCESS_TOKEN_COOKIE, AUTH_SERVER_URL, AccessTokenClaims, DEVICE_ID_COOKIE, type GetSessionOptions, JWKS_URL, LOGIN_URL, LOGOUT_URL, LemonSession, LemonUser, PROFILE_PAGE_URL, PROFILE_URL, REFRESH_TOKEN_COOKIE, REFRESH_URL, type RefreshResult, type RequireClientOptions, getSession, getUser, refreshTokenFromCookie, requireAuth, requireClient, verifyAccessToken, verifyAccessTokenString };

package/dist/server/index.js

@@ -1,20 +1,29 @@
+import {
+  isAccessTokenClaims,
+  isApprovedClient
+} from "../chunk-6W24RWSJ.js";
 import {
   ACCESS_TOKEN_COOKIE,
   AUTH_SERVER_URL,
+  DEVICE_ID_COOKIE,
   JWKS_URL,
   LOGIN_URL,
   LOGOUT_URL,
   PROFILE_PAGE_URL,
   PROFILE_URL,
   REFRESH_TOKEN_COOKIE,
-  REFRESH_URL
-} from "../chunk-B2EFAFKY.js";
+  REFRESH_URL,
+  getMockAccessTokenClaims,
+  isMockAuthEnabled
+} from "../chunk-OX5MDVSR.js";
 
 // src/server/verify.ts
 import { createRemoteJWKSet, jwtVerify } from "jose";
 import { cookies } from "next/headers";
 var jwks = createRemoteJWKSet(new URL(JWKS_URL));
 async function verifyAccessToken() {
+  const mockClaims = getMockAccessTokenClaims();
+  if (mockClaims) return mockClaims;
   const cookieStore = await cookies();
   const token = cookieStore.get(ACCESS_TOKEN_COOKIE)?.value;
   if (!token) return null;
@@ -22,17 +31,19 @@ async function verifyAccessToken() {
     const { payload } = await jwtVerify(token, jwks, {
       issuer: AUTH_SERVER_URL
     });
-    return payload;
+    return isAccessTokenClaims(payload) ? payload : null;
   } catch {
     return null;
   }
 }
 async function verifyAccessTokenString(token) {
+  const mockClaims = getMockAccessTokenClaims();
+  if (mockClaims) return mockClaims;
   try {
     const { payload } = await jwtVerify(token, jwks, {
       issuer: AUTH_SERVER_URL
     });
-    return payload;
+    return isAccessTokenClaims(payload) ? payload : null;
   } catch {
     return null;
   }
@@ -55,25 +66,47 @@ var getUser = cache(async () => {
   if (!claims) return null;
   return claimsToUser(claims);
 });
+var getSessionByClientId = cache(
+  async (clientId) => {
+    const user = await getUser();
+    if (!user) return { type: "none" };
+    if (!isApprovedClient(user.approvedClients, clientId)) {
+      return { type: "unapproved", user };
+    }
+    return { type: "authenticated", user };
+  }
+);
+async function getSession(options = {}) {
+  return getSessionByClientId(options.clientId);
+}
 async function requireAuth(redirectTo = "/") {
   const user = await getUser();
   if (user) return user;
   redirect(redirectTo);
 }
-async function requireClient(clientId, redirectTo = "/") {
-  const user = await requireAuth(redirectTo);
-  if (!user.approvedClients.includes(clientId)) {
-    throw new Error("Client not approved");
+async function requireClient(clientId, optionsOrRedirectTo = "/") {
+  const options = typeof optionsOrRedirectTo === "string" ? { loginRedirectTo: optionsOrRedirectTo } : optionsOrRedirectTo;
+  const session = await getSession({ clientId });
+  if (session.type === "none") {
+    redirect(options.loginRedirectTo ?? "/");
   }
-  return user;
+  if (session.type === "unapproved") {
+    redirect(
+      options.unapprovedRedirectTo ?? `${AUTH_SERVER_URL}/error?code=FORBIDDEN`
+    );
+  }
+  return session.user;
 }
 
 // src/server/refresh.ts
-async function refreshTokenFromCookie(refreshTokenCookie) {
+async function refreshTokenFromCookie(refreshTokenCookie, deviceIdCookie) {
+  if (isMockAuthEnabled()) {
+    return { ok: true, setCookieHeaders: [] };
+  }
   const res = await fetch(REFRESH_URL, {
     method: "POST",
     headers: {
-      Cookie: `refresh_token=${refreshTokenCookie}`
+      Cookie: buildRefreshCookieHeader(refreshTokenCookie, deviceIdCookie)
     }
   });
   if (!res.ok) {
@@ -82,9 +115,17 @@ async function refreshTokenFromCookie(refreshTokenCookie) {
   const setCookieHeaders = res.headers.getSetCookie();
   return { ok: true, setCookieHeaders };
 }
+function buildRefreshCookieHeader(refreshTokenCookie, deviceIdCookie) {
+  const cookies2 = [`${REFRESH_TOKEN_COOKIE}=${refreshTokenCookie}`];
+  if (deviceIdCookie) {
+    cookies2.push(`${DEVICE_ID_COOKIE}=${deviceIdCookie}`);
+  }
+  return cookies2.join("; ");
+}
 export {
   ACCESS_TOKEN_COOKIE,
   AUTH_SERVER_URL,
+  DEVICE_ID_COOKIE,
   JWKS_URL,
   LOGIN_URL,
   LOGOUT_URL,
@@ -92,6 +133,7 @@ export {
   PROFILE_URL,
   REFRESH_TOKEN_COOKIE,
   REFRESH_URL,
+  getSession,
   getUser,
   refreshTokenFromCookie,
   requireAuth,

package/dist/server/index.js.map

@@ -1 +1 @@
-{"version":3,"sources":["../../src/server/verify.ts","../../src/server/user.ts","../../src/server/refresh.ts"],"sourcesContent":["import { createRemoteJWKSet, jwtVerify } from \"jose\";\nimport { cookies } from \"next/headers\";\nimport type { AccessTokenClaims } from \"../types.js\";\nimport { JWKS_URL, AUTH_SERVER_URL, ACCESS_TOKEN_COOKIE } from \"../constants.js\";\n\nconst jwks = createRemoteJWKSet(new URL(JWKS_URL));\n\nexport async function verifyAccessToken(): Promise<AccessTokenClaims | null> {\n  const cookieStore = await cookies();\n  const token = cookieStore.get(ACCESS_TOKEN_COOKIE)?.value;\n  if (!token) return null;\n\n  try {\n    const { payload } = await jwtVerify(token, jwks, {\n      issuer: AUTH_SERVER_URL,\n    });\n    return payload as unknown as AccessTokenClaims;\n  } catch {\n    return null;\n  }\n}\n\nexport async function verifyAccessTokenString(\n  token: string\n): Promise<AccessTokenClaims | null> {\n  try {\n    const { payload } = await jwtVerify(token, jwks, {\n      issuer: AUTH_SERVER_URL,\n    });\n    return payload as unknown as AccessTokenClaims;\n  } catch {\n    return null;\n  }\n}\n","import { cache } from \"react\";\nimport { redirect } from \"next/navigation\";\nimport type { LemonUser } from \"../types.js\";\nimport { verifyAccessToken } from \"./verify.js\";\n\nfunction claimsToUser(\n  claims: NonNullable<Awaited<ReturnType<typeof verifyAccessToken>>>\n): LemonUser {\n  return {\n    uid: claims.sub,\n    nickname: claims.nickname,\n    profileImageUrl: claims.profile_image_url,\n    role: claims.role,\n    approvedClients: claims.approved_clients,\n  };\n}\n\nexport const getUser = cache(async (): Promise<LemonUser | null> => {\n  const claims = await verifyAccessToken();\n  if (!claims) return null;\n  return claimsToUser(claims);\n});\n\nexport async function requireAuth(redirectTo = \"/\"): Promise<LemonUser> {\n  const user = await getUser();\n  if (user) return user;\n  redirect(redirectTo);\n}\n\nexport async function requireClient(\n  clientId: string,\n  redirectTo = \"/\"\n): Promise<LemonUser> {\n  const user = await requireAuth(redirectTo);\n  if (!user.approvedClients.includes(clientId)) {\n    throw new Error(\"Client not approved\");\n  }\n  return user;\n}\n","import { REFRESH_URL } from \"../constants.js\";\n\nexport interface RefreshResult {\n  ok: boolean;\n  setCookieHeaders: string[];\n}\n\nexport async function refreshTokenFromCookie(\n  refreshTokenCookie: string\n): Promise<RefreshResult> {\n  const res = await fetch(REFRESH_URL, {\n    method: \"POST\",\n    headers: {\n      Cookie: `refresh_token=${refreshTokenCookie}`,\n    },\n  });\n\n  if (!res.ok) {\n    return { ok: false, setCookieHeaders: [] };\n  }\n\n  const setCookieHeaders = res.headers.getSetCookie();\n  return { ok: true, setCookieHeaders };\n}\n"],"mappings":";;;;;;;;;;;;;AAAA,SAAS,oBAAoB,iBAAiB;AAC9C,SAAS,eAAe;AAIxB,IAAM,OAAO,mBAAmB,IAAI,IAAI,QAAQ,CAAC;AAEjD,eAAsB,oBAAuD;AAC3E,QAAM,cAAc,MAAM,QAAQ;AAClC,QAAM,QAAQ,YAAY,IAAI,mBAAmB,GAAG;AACpD,MAAI,CAAC,MAAO,QAAO;AAEnB,MAAI;AACF,UAAM,EAAE,QAAQ,IAAI,MAAM,UAAU,OAAO,MAAM;AAAA,MAC/C,QAAQ;AAAA,IACV,CAAC;AACD,WAAO;AAAA,EACT,QAAQ;AACN,WAAO;AAAA,EACT;AACF;AAEA,eAAsB,wBACpB,OACmC;AACnC,MAAI;AACF,UAAM,EAAE,QAAQ,IAAI,MAAM,UAAU,OAAO,MAAM;AAAA,MAC/C,QAAQ;AAAA,IACV,CAAC;AACD,WAAO;AAAA,EACT,QAAQ;AACN,WAAO;AAAA,EACT;AACF;;;ACjCA,SAAS,aAAa;AACtB,SAAS,gBAAgB;AAIzB,SAAS,aACP,QACW;AACX,SAAO;AAAA,IACL,KAAK,OAAO;AAAA,IACZ,UAAU,OAAO;AAAA,IACjB,iBAAiB,OAAO;AAAA,IACxB,MAAM,OAAO;AAAA,IACb,iBAAiB,OAAO;AAAA,EAC1B;AACF;AAEO,IAAM,UAAU,MAAM,YAAuC;AAClE,QAAM,SAAS,MAAM,kBAAkB;AACvC,MAAI,CAAC,OAAQ,QAAO;AACpB,SAAO,aAAa,MAAM;AAC5B,CAAC;AAED,eAAsB,YAAY,aAAa,KAAyB;AACtE,QAAM,OAAO,MAAM,QAAQ;AAC3B,MAAI,KAAM,QAAO;AACjB,WAAS,UAAU;AACrB;AAEA,eAAsB,cACpB,UACA,aAAa,KACO;AACpB,QAAM,OAAO,MAAM,YAAY,UAAU;AACzC,MAAI,CAAC,KAAK,gBAAgB,SAAS,QAAQ,GAAG;AAC5C,UAAM,IAAI,MAAM,qBAAqB;AAAA,EACvC;AACA,SAAO;AACT;;;AC/BA,eAAsB,uBACpB,oBACwB;AACxB,QAAM,MAAM,MAAM,MAAM,aAAa;AAAA,IACnC,QAAQ;AAAA,IACR,SAAS;AAAA,MACP,QAAQ,iBAAiB,kBAAkB;AAAA,IAC7C;AAAA,EACF,CAAC;AAED,MAAI,CAAC,IAAI,IAAI;AACX,WAAO,EAAE,IAAI,OAAO,kBAAkB,CAAC,EAAE;AAAA,EAC3C;AAEA,QAAM,mBAAmB,IAAI,QAAQ,aAAa;AAClD,SAAO,EAAE,IAAI,MAAM,iBAAiB;AACtC;","names":[]}
+{"version":3,"sources":["../../src/server/verify.ts","../../src/server/user.ts","../../src/server/refresh.ts"],"sourcesContent":["import { createRemoteJWKSet, jwtVerify } from \"jose\";\nimport { cookies } from \"next/headers\";\nimport type { AccessTokenClaims } from \"../types.js\";\nimport { JWKS_URL, AUTH_SERVER_URL, ACCESS_TOKEN_COOKIE } from \"../constants.js\";\nimport { isAccessTokenClaims } from \"../claims.js\";\nimport { getMockAccessTokenClaims } from \"../mock.js\";\n\nconst jwks = createRemoteJWKSet(new URL(JWKS_URL));\n\nexport async function verifyAccessToken(): Promise<AccessTokenClaims | null> {\n  const mockClaims = getMockAccessTokenClaims();\n  if (mockClaims) return mockClaims;\n\n  const cookieStore = await cookies();\n  const token = cookieStore.get(ACCESS_TOKEN_COOKIE)?.value;\n  if (!token) return null;\n\n  try {\n    const { payload } = await jwtVerify(token, jwks, {\n      issuer: AUTH_SERVER_URL,\n    });\n    return isAccessTokenClaims(payload) ? payload : null;\n  } catch {\n    return null;\n  }\n}\n\nexport async function verifyAccessTokenString(\n  token: string\n): Promise<AccessTokenClaims | null> {\n  const mockClaims = getMockAccessTokenClaims();\n  if (mockClaims) return mockClaims;\n\n  try {\n    const { payload } = await jwtVerify(token, jwks, {\n      issuer: AUTH_SERVER_URL,\n    });\n    return isAccessTokenClaims(payload) ? payload : null;\n  } catch {\n    return null;\n  }\n}\n","import { cache } from \"react\";\nimport { redirect } from \"next/navigation\";\nimport type { LemonSession, LemonUser } from \"../types.js\";\nimport { AUTH_SERVER_URL } from \"../constants.js\";\nimport { isApprovedClient } from \"../approval.js\";\nimport { verifyAccessToken } from \"./verify.js\";\n\nfunction claimsToUser(\n  claims: NonNullable<Awaited<ReturnType<typeof verifyAccessToken>>>\n): LemonUser {\n  return {\n    uid: claims.sub,\n    nickname: claims.nickname,\n    profileImageUrl: claims.profile_image_url,\n    role: claims.role,\n    approvedClients: claims.approved_clients,\n  };\n}\n\nexport const getUser = cache(async (): Promise<LemonUser | null> => {\n  const claims = await verifyAccessToken();\n  if (!claims) return null;\n  return claimsToUser(claims);\n});\n\nexport interface GetSessionOptions {\n  clientId?: string;\n}\n\nconst getSessionByClientId = cache(\n  async (clientId?: string): Promise<LemonSession> => {\n    const user = await getUser();\n    if (!user) return { type: \"none\" };\n    if (!isApprovedClient(user.approvedClients, clientId)) {\n      return { type: \"unapproved\", user };\n    }\n    return { type: \"authenticated\", user };\n  }\n);\n\nexport async function getSession(\n  options: GetSessionOptions = {}\n): Promise<LemonSession> {\n  return getSessionByClientId(options.clientId);\n}\n\nexport async function requireAuth(redirectTo = \"/\"): Promise<LemonUser> {\n  const user = await getUser();\n  if (user) return user;\n  redirect(redirectTo);\n}\n\nexport interface RequireClientOptions {\n  loginRedirectTo?: string;\n  unapprovedRedirectTo?: string;\n}\n\nexport async function requireClient(\n  clientId: string,\n  optionsOrRedirectTo: string | RequireClientOptions = \"/\"\n): Promise<LemonUser> {\n  const options =\n    typeof optionsOrRedirectTo === \"string\"\n      ? { loginRedirectTo: optionsOrRedirectTo }\n      : optionsOrRedirectTo;\n  const session = await getSession({ clientId });\n  if (session.type === \"none\") {\n    redirect(options.loginRedirectTo ?? \"/\");\n  }\n  if (session.type === \"unapproved\") {\n    redirect(\n      options.unapprovedRedirectTo ??\n        `${AUTH_SERVER_URL}/error?code=FORBIDDEN`\n    );\n  }\n  return session.user;\n}\n","import {\n  DEVICE_ID_COOKIE,\n  REFRESH_TOKEN_COOKIE,\n  REFRESH_URL,\n} from \"../constants.js\";\nimport { isMockAuthEnabled } from \"../mock.js\";\n\nexport interface RefreshResult {\n  ok: boolean;\n  setCookieHeaders: string[];\n}\n\nexport async function refreshTokenFromCookie(\n  refreshTokenCookie: string,\n  deviceIdCookie?: string\n): Promise<RefreshResult> {\n  if (isMockAuthEnabled()) {\n    return { ok: true, setCookieHeaders: [] };\n  }\n\n  const res = await fetch(REFRESH_URL, {\n    method: \"POST\",\n    headers: {\n      Cookie: buildRefreshCookieHeader(refreshTokenCookie, deviceIdCookie),\n    },\n  });\n\n  if (!res.ok) {\n    return { ok: false, setCookieHeaders: [] };\n  }\n\n  const setCookieHeaders = res.headers.getSetCookie();\n  return { ok: true, setCookieHeaders };\n}\n\nfunction buildRefreshCookieHeader(\n  refreshTokenCookie: string,\n  deviceIdCookie?: string\n): string {\n  const cookies = [`${REFRESH_TOKEN_COOKIE}=${refreshTokenCookie}`];\n  if (deviceIdCookie) {\n    cookies.push(`${DEVICE_ID_COOKIE}=${deviceIdCookie}`);\n  }\n  return cookies.join(\"; \");\n}\n"],"mappings":";;;;;;;;;;;;;;;;;;;;AAAA,SAAS,oBAAoB,iBAAiB;AAC9C,SAAS,eAAe;AAMxB,IAAM,OAAO,mBAAmB,IAAI,IAAI,QAAQ,CAAC;AAEjD,eAAsB,oBAAuD;AAC3E,QAAM,aAAa,yBAAyB;AAC5C,MAAI,WAAY,QAAO;AAEvB,QAAM,cAAc,MAAM,QAAQ;AAClC,QAAM,QAAQ,YAAY,IAAI,mBAAmB,GAAG;AACpD,MAAI,CAAC,MAAO,QAAO;AAEnB,MAAI;AACF,UAAM,EAAE,QAAQ,IAAI,MAAM,UAAU,OAAO,MAAM;AAAA,MAC/C,QAAQ;AAAA,IACV,CAAC;AACD,WAAO,oBAAoB,OAAO,IAAI,UAAU;AAAA,EAClD,QAAQ;AACN,WAAO;AAAA,EACT;AACF;AAEA,eAAsB,wBACpB,OACmC;AACnC,QAAM,aAAa,yBAAyB;AAC5C,MAAI,WAAY,QAAO;AAEvB,MAAI;AACF,UAAM,EAAE,QAAQ,IAAI,MAAM,UAAU,OAAO,MAAM;AAAA,MAC/C,QAAQ;AAAA,IACV,CAAC;AACD,WAAO,oBAAoB,OAAO,IAAI,UAAU;AAAA,EAClD,QAAQ;AACN,WAAO;AAAA,EACT;AACF;;;ACzCA,SAAS,aAAa;AACtB,SAAS,gBAAgB;AAMzB,SAAS,aACP,QACW;AACX,SAAO;AAAA,IACL,KAAK,OAAO;AAAA,IACZ,UAAU,OAAO;AAAA,IACjB,iBAAiB,OAAO;AAAA,IACxB,MAAM,OAAO;AAAA,IACb,iBAAiB,OAAO;AAAA,EAC1B;AACF;AAEO,IAAM,UAAU,MAAM,YAAuC;AAClE,QAAM,SAAS,MAAM,kBAAkB;AACvC,MAAI,CAAC,OAAQ,QAAO;AACpB,SAAO,aAAa,MAAM;AAC5B,CAAC;AAMD,IAAM,uBAAuB;AAAA,EAC3B,OAAO,aAA6C;AAClD,UAAM,OAAO,MAAM,QAAQ;AAC3B,QAAI,CAAC,KAAM,QAAO,EAAE,MAAM,OAAO;AACjC,QAAI,CAAC,iBAAiB,KAAK,iBAAiB,QAAQ,GAAG;AACrD,aAAO,EAAE,MAAM,cAAc,KAAK;AAAA,IACpC;AACA,WAAO,EAAE,MAAM,iBAAiB,KAAK;AAAA,EACvC;AACF;AAEA,eAAsB,WACpB,UAA6B,CAAC,GACP;AACvB,SAAO,qBAAqB,QAAQ,QAAQ;AAC9C;AAEA,eAAsB,YAAY,aAAa,KAAyB;AACtE,QAAM,OAAO,MAAM,QAAQ;AAC3B,MAAI,KAAM,QAAO;AACjB,WAAS,UAAU;AACrB;AAOA,eAAsB,cACpB,UACA,sBAAqD,KACjC;AACpB,QAAM,UACJ,OAAO,wBAAwB,WAC3B,EAAE,iBAAiB,oBAAoB,IACvC;AACN,QAAM,UAAU,MAAM,WAAW,EAAE,SAAS,CAAC;AAC7C,MAAI,QAAQ,SAAS,QAAQ;AAC3B,aAAS,QAAQ,mBAAmB,GAAG;AAAA,EACzC;AACA,MAAI,QAAQ,SAAS,cAAc;AACjC;AAAA,MACE,QAAQ,wBACN,GAAG,eAAe;AAAA,IACtB;AAAA,EACF;AACA,SAAO,QAAQ;AACjB;;;AChEA,eAAsB,uBACpB,oBACA,gBACwB;AACxB,MAAI,kBAAkB,GAAG;AACvB,WAAO,EAAE,IAAI,MAAM,kBAAkB,CAAC,EAAE;AAAA,EAC1C;AAEA,QAAM,MAAM,MAAM,MAAM,aAAa;AAAA,IACnC,QAAQ;AAAA,IACR,SAAS;AAAA,MACP,QAAQ,yBAAyB,oBAAoB,cAAc;AAAA,IACrE;AAAA,EACF,CAAC;AAED,MAAI,CAAC,IAAI,IAAI;AACX,WAAO,EAAE,IAAI,OAAO,kBAAkB,CAAC,EAAE;AAAA,EAC3C;AAEA,QAAM,mBAAmB,IAAI,QAAQ,aAAa;AAClD,SAAO,EAAE,IAAI,MAAM,iBAAiB;AACtC;AAEA,SAAS,yBACP,oBACA,gBACQ;AACR,QAAMA,WAAU,CAAC,GAAG,oBAAoB,IAAI,kBAAkB,EAAE;AAChE,MAAI,gBAAgB;AAClB,IAAAA,SAAQ,KAAK,GAAG,gBAAgB,IAAI,cAAc,EAAE;AAAA,EACtD;AACA,SAAOA,SAAQ,KAAK,IAAI;AAC1B;","names":["cookies"]}

package/dist/{types-CgrEUXwM.d.ts → types-B5uRY2Si.d.ts}

@@ -1,6 +1,7 @@
 import { JWTPayload } from 'jose';
 
 interface AccessTokenClaims extends JWTPayload {
+    token_type: "access";
     sub: string;
     nickname: string;
     profile_image_url: string;
@@ -14,6 +15,15 @@ interface LemonUser {
     role: "user" | "admin";
     approvedClients: string[];
 }
+type LemonSession = {
+    type: "none";
+} | {
+    type: "unapproved";
+    user: LemonUser;
+} | {
+    type: "authenticated";
+    user: LemonUser;
+};
 interface UserProfile {
     uid: string;
     nickname: string;
@@ -21,4 +31,4 @@ interface UserProfile {
     role: "user" | "admin";
 }
 
-export type { AccessTokenClaims as A, LemonUser as L, UserProfile as U };
+export type { AccessTokenClaims as A, LemonSession as L, UserProfile as U, LemonUser as a };

package/package.json

@@ -1,6 +1,6 @@
 {
   "name": "@lemondouble/lemon-auth",
-  "version": "0.4.0",
+  "version": "0.7.0",
   "repository": {
     "type": "git",
     "url": "https://github.com/LemonDouble/lemon-auth"

package/dist/chunk-B2EFAFKY.js

@@ -1,23 +0,0 @@
-// src/constants.ts
-var AUTH_SERVER_URL = "https://auth.lemondouble.com";
-var JWKS_URL = `${AUTH_SERVER_URL}/.well-known/jwks.json`;
-var LOGIN_URL = `${AUTH_SERVER_URL}/api/oauth2/google/login`;
-var REFRESH_URL = `${AUTH_SERVER_URL}/api/token/refresh`;
-var LOGOUT_URL = `${AUTH_SERVER_URL}/api/token/logout`;
-var PROFILE_URL = `${AUTH_SERVER_URL}/api/user/me`;
-var PROFILE_PAGE_URL = `${AUTH_SERVER_URL}/profile`;
-var ACCESS_TOKEN_COOKIE = "access_token";
-var REFRESH_TOKEN_COOKIE = "refresh_token";
-
-export {
-  AUTH_SERVER_URL,
-  JWKS_URL,
-  LOGIN_URL,
-  REFRESH_URL,
-  LOGOUT_URL,
-  PROFILE_URL,
-  PROFILE_PAGE_URL,
-  ACCESS_TOKEN_COOKIE,
-  REFRESH_TOKEN_COOKIE
-};
-//# sourceMappingURL=chunk-B2EFAFKY.js.map

package/dist/chunk-B2EFAFKY.js.map

@@ -1 +0,0 @@
-{"version":3,"sources":["../src/constants.ts"],"sourcesContent":["export const AUTH_SERVER_URL = \"https://auth.lemondouble.com\";\nexport const JWKS_URL = `${AUTH_SERVER_URL}/.well-known/jwks.json`;\nexport const LOGIN_URL = `${AUTH_SERVER_URL}/api/oauth2/google/login`;\nexport const REFRESH_URL = `${AUTH_SERVER_URL}/api/token/refresh`;\nexport const LOGOUT_URL = `${AUTH_SERVER_URL}/api/token/logout`;\nexport const PROFILE_URL = `${AUTH_SERVER_URL}/api/user/me`;\nexport const PROFILE_PAGE_URL = `${AUTH_SERVER_URL}/profile`;\n\nexport const ACCESS_TOKEN_COOKIE = \"access_token\";\nexport const REFRESH_TOKEN_COOKIE = \"refresh_token\";\n"],"mappings":";AAAO,IAAM,kBAAkB;AACxB,IAAM,WAAW,GAAG,eAAe;AACnC,IAAM,YAAY,GAAG,eAAe;AACpC,IAAM,cAAc,GAAG,eAAe;AACtC,IAAM,aAAa,GAAG,eAAe;AACrC,IAAM,cAAc,GAAG,eAAe;AACtC,IAAM,mBAAmB,GAAG,eAAe;AAE3C,IAAM,sBAAsB;AAC5B,IAAM,uBAAuB;","names":[]}