@lemondouble/lemon-auth 0.5.0 → 0.7.1

package/README.md

@@ -10,6 +10,24 @@
 pnpm add @lemondouble/lemon-auth
 ```
 
+## 로컬 개발 Mock User
+
+로컬 개발에서 auth-server, OAuth, JWT 쿠키 없이 로그인 상태를 재현하려면 `.env.local`에 mock user를 설정합니다.
+
+```bash
+NEXT_PUBLIC_LEMON_AUTH_MOCK_USER='{"uid":"local-user","nickname":"Local User","profileImageUrl":"","role":"admin","approvedClients":["*"]}'
+```
+
+`NODE_ENV === "production"`에서는 이 값이 있어도 무시됩니다. `approvedClients`에 `"*"`를 넣으면 모든 `clientId`를 승인된 것으로 처리합니다.
+
+Mock User가 활성화되면:
+
+- `getUser()`, `getSession()`, `requireAuth()`, `requireClient()`는 mock user를 로그인 유저처럼 반환합니다.
+- `createAuthProxy()`는 mock user를 인증 성공으로 처리하고, `clientId` 승인 체크는 유지합니다.
+- `loginUrl(redirectUrl)`은 `redirectUrl`을 그대로 반환합니다.
+- `profileUrl(redirectUrl?)`은 `redirectUrl ?? "/"`를 반환합니다.
+- `refreshToken()`은 `true`, `logout()`은 no-op 후 `true`를 반환합니다.
+
 ## 엔트리포인트
 
 | 경로 | 환경 | 용도 |
@@ -26,7 +44,7 @@ Server Components, Route Handlers, Server Actions에서 사용합니다.
 
 ### `verifyAccessToken()`
 
-쿠키에서 `access_token`을 읽어 JWKS(ES256)로 검증합니다.
+쿠키에서 `lemon_access_token`을 읽어 JWKS(ES256)로 검증합니다.
 
 ```ts
 import { verifyAccessToken } from "@lemondouble/lemon-auth/server";
@@ -39,6 +57,7 @@ const claims = await verifyAccessToken();
 
 ```ts
 interface AccessTokenClaims {
+  token_type: "access";     // access token 여부
   sub: string;              // 사용자 UUID
   nickname: string;         // 닉네임
   profile_image_url: string; // 프로필 이미지 URL
@@ -98,6 +117,34 @@ interface LemonUser {
 }
 ```
 
+### `getSession(options?)`
+
+로그인 상태와 클라이언트 승인 상태를 함께 반환합니다.
+
+```ts
+import { getSession } from "@lemondouble/lemon-auth/server";
+
+const CLIENT_ID = process.env.CLIENT_ID!;
+
+export default async function Page() {
+  const session = await getSession({ clientId: CLIENT_ID });
+
+  if (session.type === "none") return <p>로그인이 필요합니다</p>;
+  if (session.type === "unapproved") return <p>관리자 승인이 필요합니다</p>;
+
+  return <p>{session.user.nickname}님 환영합니다</p>;
+}
+```
+
+반환되는 `LemonSession`:
+
+```ts
+type LemonSession =
+  | { type: "none" }
+  | { type: "unapproved"; user: LemonUser }
+  | { type: "authenticated"; user: LemonUser };
+```
+
 ### `requireAuth(redirectTo?)`
 
 인증된 유저를 반환합니다. 미인증이면 `redirectTo`로 redirect합니다.
@@ -117,7 +164,7 @@ export default async function ProtectedPage() {
 |---------|------|--------|------|
 | `redirectTo` | `string` | `"/"` | 미인증 시 redirect 경로 |
 
-### `requireClient(clientId, redirectTo?)`
+### `requireClient(clientId, options?)`
 
 `requireAuth()` + `approved_clients` 체크. 관리자가 승인한 사용자만 접근할 수 있는 서비스에서 사용합니다.
 
@@ -127,8 +174,10 @@ import { requireClient } from "@lemondouble/lemon-auth/server";
 const CLIENT_ID = process.env.CLIENT_ID!;
 
 export default async function Page() {
-  const user = await requireClient(CLIENT_ID);
-  // approved_clients에 CLIENT_ID가 없으면 Error("Client not approved") throw
+  const user = await requireClient(CLIENT_ID, {
+    loginRedirectTo: "/",
+    unapprovedRedirectTo: "/pending-approval",
+  });
   return <p>{user.nickname}</p>;
 }
 ```
@@ -136,9 +185,10 @@ export default async function Page() {
 | 파라미터 | 타입 | 기본값 | 설명 |
 |---------|------|--------|------|
 | `clientId` | `string` | (필수) | 체크할 클라이언트 UUID |
-| `redirectTo` | `string` | `"/"` | 미인증 시 redirect 경로 |
+| `options.loginRedirectTo` | `string` | `"/"` | 미인증 시 redirect 경로 |
+| `options.unapprovedRedirectTo` | `string` | `undefined` | 로그인은 됐지만 클라이언트 미승인 시 redirect 경로. 미설정 시 auth-server `/error?code=FORBIDDEN`로 redirect (proxy 동작과 동일) |
 
-### `refreshTokenFromCookie(refreshTokenCookie)`
+### `refreshTokenFromCookie(refreshTokenCookie, deviceIdCookie?)`
 
 서버사이드에서 토큰 갱신을 수행합니다. Route Handler 등에서 수동으로 갱신할 때 사용합니다.
 
@@ -147,10 +197,11 @@ import { refreshTokenFromCookie } from "@lemondouble/lemon-auth/server";
 
 export async function POST(request: Request) {
   const cookieStore = await cookies();
-  const refreshToken = cookieStore.get("refresh_token")?.value;
+  const refreshToken = cookieStore.get("lemon_refresh_token")?.value;
+  const deviceId = cookieStore.get("device_id")?.value;
   if (!refreshToken) return new Response(null, { status: 401 });
 
-  const result = await refreshTokenFromCookie(refreshToken);
+  const result = await refreshTokenFromCookie(refreshToken, deviceId);
   // result: { ok: boolean, setCookieHeaders: string[] }
 
   if (!result.ok) return new Response(null, { status: 401 });
@@ -176,8 +227,9 @@ import {
   LOGOUT_URL,            // "https://auth.lemondouble.com/api/token/logout"
   PROFILE_URL,           // "https://auth.lemondouble.com/api/user/me"
   PROFILE_PAGE_URL,      // "https://auth.lemondouble.com/profile"
-  ACCESS_TOKEN_COOKIE,   // "access_token"
-  REFRESH_TOKEN_COOKIE,  // "refresh_token"
+  ACCESS_TOKEN_COOKIE,   // "lemon_access_token"
+  REFRESH_TOKEN_COOKIE,  // "lemon_refresh_token"
+  DEVICE_ID_COOKIE,      // "device_id"
 } from "@lemondouble/lemon-auth/server";
 ```
 
@@ -195,12 +247,16 @@ import { createAuthProxy } from "@lemondouble/lemon-auth/proxy";
 
 export default createAuthProxy({
   publicPaths: ["/", "/about", "/api/public/*"],
+  bypassPaths: ["/workbox-*"],
   clientId: process.env.CLIENT_ID,
-  loginRedirectUrl: "https://myapp.lemondouble.com",
+  loginRedirectUrl: (request) => request.url,
+  unapprovedRedirectUrl: "/pending-approval",
 });
 
 export const config = {
-  matcher: ["/((?!_next/static|_next/image|favicon.ico).*)"],
+  matcher: [
+    "/((?!_next/static|_next/image|sw.js|manifest.webmanifest|favicon.ico|.*\\.(?:png|jpg|jpeg|gif|webp|svg|ico|woff|woff2|ttf|eot|otf)$).*)",
+  ],
 };
 ```
 
@@ -209,24 +265,86 @@ export const config = {
 | 옵션 | 타입 | 기본값 | 설명 |
 |------|------|--------|------|
 | `publicPaths` | `string[]` | `[]` | 인증 없이 접근 가능한 경로. `*`로 끝나면 prefix 매칭 (예: `"/api/public/*"`) |
+| `bypassPaths` | `string[]` | `[]` | proxy가 refresh도 하지 않고 바로 통과시킬 추가 경로. 기본 PWA 경로(`/sw.js`, `/manifest.webmanifest` 등)는 항상 bypass |
+| `apiPaths` | `string[]` | `["/api/*"]` | 보호 API 경로. 인증 실패 시 redirect 대신 JSON 응답을 반환한다. disable하려면 `[]` |
 | `clientId` | `string` | `undefined` | 설정 시 `approved_clients`에 포함 여부를 체크 |
-| `loginRedirectUrl` | `string` | `undefined` | 미인증 시 Google 로그인 후 돌아올 URL. 미설정 시 `"/"` 로 redirect |
+| `loginRedirectUrl` | `string \| (request: NextRequest) => string` | `undefined` | 미인증 시 Google 로그인 후 돌아올 URL. deep link 보존이 필요하면 `(request) => request.url` 사용. 미설정 시 `"/"` 로 redirect |
+| `unapprovedRedirectUrl` | `string \| (request: NextRequest) => string` | `undefined` | 로그인은 됐지만 `clientId` 미승인일 때 redirect할 URL. 미설정 시 auth-server `/error?code=FORBIDDEN`로 redirect (무한 loop 방지) |
 | `onAuthSuccess` | `(claims, request, response) => Promise<NextResponse> \| NextResponse` | `undefined` | 보호 경로에서 인증 성공 시 호출되는 콜백. DB 동기화, 헤더 주입 등 앱별 로직에 사용 |
 
 #### 동작 방식
 
+**Bypass 경로** (기본 PWA/정적 리소스 + `bypassPaths`):
+
+1. `/sw.js`, `/manifest.webmanifest`, `/manifest.json`, `/favicon.ico` 등은 인증/갱신 없이 항상 통과
+2. 가능하면 `matcher`에서도 제외해 proxy 실행 자체를 피하는 것을 권장
+
 **보호 경로** (`publicPaths`에 해당하지 않는 경로):
 
-1. `access_token` 쿠키가 있고 만료까지 60초 이상 남았으면 → JWKS 검증 → `onAuthSuccess` 호출 → 통과
-2. 만료 임박이거나 검증 실패 시 `refresh_token`으로 자동 갱신 시도
-3. 갱신 성공 → 새 토큰 쿠키 설정 → `onAuthSuccess` 호출 → 통과
-4. 갱신 실패 → 로그인 페이지로 redirect
+1. `lemon_access_token` 쿠키가 있고 만료까지 60초 이상 남았으면 → JWKS 검증 → `onAuthSuccess` 호출 → 통과
+2. 로그인은 됐지만 `clientId` 미승인이면 `unapprovedRedirectUrl`로 redirect
+3. 만료 임박이거나 검증 실패 시 `lemon_refresh_token` + `device_id`로 자동 갱신 시도
+4. 갱신 성공 → 새 토큰 쿠키 설정 → `onAuthSuccess` 호출 → 통과
+5. 갱신 실패 → `loginRedirectUrl`을 `redirect_url`로 담아 로그인 페이지로 redirect
+
+`loginRedirectUrl`은 고정 URL 문자열과 요청별 resolver 함수를 모두 지원합니다.
+
+```ts
+createAuthProxy({
+  // 로그인 후 항상 같은 화면으로 복귀
+  loginRedirectUrl: "https://myapp.lemondouble.com/dashboard",
+});
+
+createAuthProxy({
+  // 로그인 후 사용자가 원래 요청한 path/query로 복귀
+  loginRedirectUrl: (request) => request.url,
+});
+```
 
 **공개 경로** (`publicPaths`에 해당하는 경로):
 
 1. 토큰이 만료 임박이면 백그라운드로 갱신 (실패해도 통과)
 2. 인증 여부와 무관하게 항상 통과
 
+**API 경로** (`apiPaths` 매칭, 기본 `/api/*`):
+
+보호 경로 중 `apiPaths`에 매칭되는 요청은 인증 실패 시 redirect 대신 JSON 응답을 반환합니다. fetch 호출이 OAuth HTML로 리다이렉트되어 계약이 깨지는 문제를 방지합니다.
+
+| 상황 | 응답 |
+|------|------|
+| 미인증 (access/refresh 모두 실패) | `401 { "code": "UNAUTHORIZED" }` |
+| 미승인 (`clientId` 미포함) | `403 { "code": "FORBIDDEN" }` |
+
+`PROXY_AUTH_ERROR` 상수와 `ProxyAuthErrorCode` 타입을 export합니다.
+
+```ts
+import { PROXY_AUTH_ERROR } from "@lemondouble/lemon-auth/proxy";
+import type { ProxyAuthErrorCode } from "@lemondouble/lemon-auth/proxy";
+
+const res = await fetch("/api/users");
+if (!res.ok) {
+  const data = (await res.json()) as { code: ProxyAuthErrorCode };
+  if (data.code === PROXY_AUTH_ERROR.UNAUTHORIZED) {
+    // 재로그인 유도
+  }
+  if (data.code === PROXY_AUTH_ERROR.FORBIDDEN) {
+    // "권한 없음" 표시
+  }
+}
+```
+
+`/api/*` 외의 경로(예: tRPC, GraphQL)도 JSON 응답을 받게 하려면 `apiPaths`에 추가합니다.
+
+```ts
+import { DEFAULT_API_PATHS } from "@lemondouble/lemon-auth/proxy";
+
+createAuthProxy({
+  apiPaths: [...DEFAULT_API_PATHS, "/trpc/*"],
+});
+```
+
+`apiPaths: []`로 두면 모든 보호 경로가 redirect로 동작합니다 (이전 버전 동작).
+
 ---
 
 ## Client — `@lemondouble/lemon-auth/client`
@@ -310,8 +428,8 @@ export default async function RootLayout({ children }: { children: React.ReactNo
 |------|------|-----------------|
 | 정상 요청 (proxy 실행됨) | 있음 | 아무것도 안 함 (skip) |
 | PWA 캐시 히트 + 갱신 시도 중 | 없음 | `fallback` 렌더 |
-| PWA 캐시 히트 + 유효한 refresh_token | 없음 | 갱신 → `router.refresh()` |
-| PWA 캐시 히트 + 만료된 refresh_token | 없음 | 갱신 실패 → `children` 렌더 |
+| PWA 캐시 히트 + 유효한 `lemon_refresh_token` | 없음 | 갱신 → `router.refresh()` |
+| PWA 캐시 히트 + 만료된 `lemon_refresh_token` | 없음 | 갱신 실패 → `children` 렌더 |
 
 ### `loginUrl(redirectUrl)`
 
@@ -326,11 +444,15 @@ loginUrl("https://myapp.lemondouble.com/dashboard")
 
 | 파라미터 | 타입 | 설명 |
 |---------|------|------|
-| `redirectUrl` | `string` | 로그인 완료 후 돌아올 URL (`https://` + `*.lemondouble.com`만 허용) |
+| `redirectUrl` | `string` | 로그인 완료 후 돌아올 절대 URL (`https://` + `lemondouble.com` 또는 `*.lemondouble.com`만 허용) |
+
+허용되지 않는 URL이면 `Error`를 throw합니다. Mock User가 활성화된 로컬 개발 환경에서는 검증하지 않고 `redirectUrl`을 그대로 반환합니다.
 
 ### `logout()`
 
-로그아웃을 수행합니다. refresh_token을 폐기하고 쿠키를 삭제합니다.
+로그아웃을 수행합니다. `lemon_refresh_token`을 폐기하고 쿠키를 삭제합니다.
+서버 응답이 성공이면 `true`, 실패 응답 또는 네트워크 예외면 `false`를 반환합니다.
+반환값을 무시하고 기존처럼 `await logout()`만 호출해도 됩니다.
 
 ```tsx
 "use client";
@@ -338,7 +460,10 @@ import { logout } from "@lemondouble/lemon-auth/client";
 
 function LogoutButton() {
   const handleLogout = async () => {
-    await logout();
+    const ok = await logout();
+    if (!ok) {
+      // 필요하면 실패 안내를 표시
+    }
     window.location.href = "/";
   };
 
@@ -397,6 +522,7 @@ interface LemonUser {
 }
 
 interface AccessTokenClaims extends JWTPayload {
+  token_type: "access";
   sub: string;
   nickname: string;
   profile_image_url: string;
@@ -416,34 +542,52 @@ interface UserProfile {
 
 ## 전체 연동 예시
 
-새 Next.js 16 프로젝트에 인증을 추가하는 최소 예시입니다.
+새 Next.js 16 프로젝트에 인증을 추가하는 권장 예시입니다.
 
 ### 1. proxy.ts — 토큰 자동 갱신
 
 ```ts
-import { createAuthProxy } from "@lemondouble/lemon-auth/proxy";
+import {
+  createAuthProxy,
+  DEFAULT_API_PATHS,
+} from "@lemondouble/lemon-auth/proxy";
 
 export default createAuthProxy({
-  publicPaths: ["/", "/login"],
+  publicPaths: ["/", "/login", "/pending-approval", "/api/public/*"],
+  bypassPaths: ["/workbox-*"],
+  apiPaths: DEFAULT_API_PATHS,
   clientId: process.env.CLIENT_ID,
-  loginRedirectUrl: process.env.NEXT_PUBLIC_BASE_URL,
+  loginRedirectUrl: (request) => request.url,
+  unapprovedRedirectUrl: "/pending-approval",
 });
 
 export const config = {
-  matcher: ["/((?!_next/static|_next/image|favicon.ico).*)"],
+  matcher: [
+    "/((?!_next/static|_next/image|sw.js|manifest.webmanifest|favicon.ico|.*\\.(?:png|jpg|jpeg|gif|webp|svg|ico|woff|woff2|ttf|eot|otf)$).*)",
+  ],
 };
 ```
 
+`loginRedirectUrl: (request) => request.url`은 로그인 후 사용자가 원래 요청한 path/query로 돌아오게 합니다.
+`apiPaths`에 매칭되는 보호 API는 인증 실패 시 redirect 대신 `401/403` JSON 응답을 반환합니다.
+기본 PWA 파일(`/sw.js`, `/manifest.webmanifest` 등)은 항상 bypass되며, 앱에서 추가로 생성하는 workbox 파일은 `bypassPaths`에 넣을 수 있습니다.
+
 `onAuthSuccess`를 사용하면 인증 성공 후 DB 동기화, 헤더 주입 등 앱별 로직을 끼워넣을 수 있습니다:
 
 ```ts
-import { createAuthProxy } from "@lemondouble/lemon-auth/proxy";
+import {
+  createAuthProxy,
+  DEFAULT_API_PATHS,
+} from "@lemondouble/lemon-auth/proxy";
 import { upsertUser } from "@/lib/db";
 
 export default createAuthProxy({
-  publicPaths: ["/", "/login"],
+  publicPaths: ["/", "/login", "/pending-approval", "/api/public/*"],
+  bypassPaths: ["/workbox-*"],
+  apiPaths: DEFAULT_API_PATHS,
   clientId: process.env.CLIENT_ID,
-  loginRedirectUrl: process.env.NEXT_PUBLIC_BASE_URL,
+  loginRedirectUrl: (request) => request.url,
+  unapprovedRedirectUrl: "/pending-approval",
   onAuthSuccess: async (claims, request, response) => {
     await upsertUser(claims);
     response.headers.set("x-user-uid", claims.sub);
@@ -517,7 +661,12 @@ import { logout } from "@lemondouble/lemon-auth/client";
 
 export function LogoutButton() {
   return (
-    <button onClick={async () => { await logout(); window.location.href = "/"; }}>
+    <button
+      onClick={async () => {
+        await logout();
+        window.location.href = "/";
+      }}
+    >
       로그아웃
     </button>
   );

package/dist/chunk-6W24RWSJ.js

@@ -0,0 +1,16 @@
+// src/claims.ts
+function isAccessTokenClaims(payload) {
+  return payload.token_type === "access" && typeof payload.sub === "string" && typeof payload.nickname === "string" && typeof payload.profile_image_url === "string" && (payload.role === "user" || payload.role === "admin") && Array.isArray(payload.approved_clients) && payload.approved_clients.every((clientId) => typeof clientId === "string");
+}
+
+// src/approval.ts
+function isApprovedClient(approvedClients, clientId) {
+  if (!clientId) return true;
+  return approvedClients.includes(clientId) || approvedClients.includes("*");
+}
+
+export {
+  isAccessTokenClaims,
+  isApprovedClient
+};
+//# sourceMappingURL=chunk-6W24RWSJ.js.map

package/dist/chunk-6W24RWSJ.js.map

@@ -0,0 +1 @@
+{"version":3,"sources":["../src/claims.ts","../src/approval.ts"],"sourcesContent":["import type { JWTPayload } from \"jose\";\nimport type { AccessTokenClaims } from \"./types.js\";\n\nexport function isAccessTokenClaims(\n  payload: JWTPayload\n): payload is AccessTokenClaims {\n  return (\n    payload.token_type === \"access\" &&\n    typeof payload.sub === \"string\" &&\n    typeof payload.nickname === \"string\" &&\n    typeof payload.profile_image_url === \"string\" &&\n    (payload.role === \"user\" || payload.role === \"admin\") &&\n    Array.isArray(payload.approved_clients) &&\n    payload.approved_clients.every((clientId) => typeof clientId === \"string\")\n  );\n}\n","export function isApprovedClient(\n  approvedClients: string[],\n  clientId?: string\n): boolean {\n  if (!clientId) return true;\n  return approvedClients.includes(clientId) || approvedClients.includes(\"*\");\n}\n"],"mappings":";AAGO,SAAS,oBACd,SAC8B;AAC9B,SACE,QAAQ,eAAe,YACvB,OAAO,QAAQ,QAAQ,YACvB,OAAO,QAAQ,aAAa,YAC5B,OAAO,QAAQ,sBAAsB,aACpC,QAAQ,SAAS,UAAU,QAAQ,SAAS,YAC7C,MAAM,QAAQ,QAAQ,gBAAgB,KACtC,QAAQ,iBAAiB,MAAM,CAAC,aAAa,OAAO,aAAa,QAAQ;AAE7E;;;ACfO,SAAS,iBACd,iBACA,UACS;AACT,MAAI,CAAC,SAAU,QAAO;AACtB,SAAO,gBAAgB,SAAS,QAAQ,KAAK,gBAAgB,SAAS,GAAG;AAC3E;","names":[]}

package/dist/chunk-OX5MDVSR.js

@@ -0,0 +1,120 @@
+// src/constants.ts
+var AUTH_SERVER_URL = "https://auth.lemondouble.com";
+var JWKS_URL = `${AUTH_SERVER_URL}/.well-known/jwks.json`;
+var LOGIN_URL = `${AUTH_SERVER_URL}/api/oauth2/google/login`;
+var REFRESH_URL = `${AUTH_SERVER_URL}/api/token/refresh`;
+var LOGOUT_URL = `${AUTH_SERVER_URL}/api/token/logout`;
+var PROFILE_URL = `${AUTH_SERVER_URL}/api/user/me`;
+var PROFILE_PAGE_URL = `${AUTH_SERVER_URL}/profile`;
+var ACCESS_TOKEN_COOKIE = "lemon_access_token";
+var REFRESH_TOKEN_COOKIE = "lemon_refresh_token";
+var DEVICE_ID_COOKIE = "device_id";
+
+// src/mock.ts
+var LEMON_AUTH_MOCK_USER_ENV = "NEXT_PUBLIC_LEMON_AUTH_MOCK_USER";
+function isMockAuthEnabled() {
+  return !isProduction() && Boolean(readMockUserEnv());
+}
+function getMockUser() {
+  const raw = readMockUserEnv();
+  if (isProduction() || !raw) return null;
+  return parseMockUser(raw);
+}
+function getMockAccessTokenClaims() {
+  const user = getMockUser();
+  if (!user) return null;
+  const now = Math.floor(Date.now() / 1e3);
+  return {
+    token_type: "access",
+    sub: user.uid,
+    nickname: user.nickname,
+    profile_image_url: user.profileImageUrl,
+    role: user.role,
+    approved_clients: user.approvedClients,
+    iss: "lemon-auth-mock",
+    iat: now,
+    exp: now + 60 * 60 * 24 * 365
+  };
+}
+function readMockUserEnv() {
+  try {
+    return process.env.NEXT_PUBLIC_LEMON_AUTH_MOCK_USER;
+  } catch {
+    return void 0;
+  }
+}
+function isProduction() {
+  try {
+    return process.env.NODE_ENV === "production";
+  } catch {
+    return false;
+  }
+}
+function parseMockUser(raw) {
+  let data;
+  try {
+    data = JSON.parse(raw);
+  } catch {
+    throw new Error(
+      `${LEMON_AUTH_MOCK_USER_ENV} must be a valid JSON object`
+    );
+  }
+  if (!isRecord(data)) {
+    throw new Error(`${LEMON_AUTH_MOCK_USER_ENV} must be a JSON object`);
+  }
+  return {
+    uid: readOptionalString(data.uid, "local-user", "uid"),
+    nickname: readOptionalString(data.nickname, "Local User", "nickname"),
+    profileImageUrl: readOptionalString(
+      data.profileImageUrl ?? data.profile_image_url,
+      "",
+      "profileImageUrl"
+    ),
+    role: readOptionalRole(data.role, "admin"),
+    approvedClients: readOptionalStringArray(
+      data.approvedClients ?? data.approved_clients,
+      ["*"],
+      "approvedClients"
+    )
+  };
+}
+function isRecord(value) {
+  return typeof value === "object" && value !== null && !Array.isArray(value);
+}
+function readOptionalString(value, fallback, field) {
+  if (value === void 0 || value === null) return fallback;
+  if (typeof value === "string") return value;
+  throw new Error(`${LEMON_AUTH_MOCK_USER_ENV}.${field} must be a string`);
+}
+function readOptionalRole(value, fallback) {
+  if (value === void 0 || value === null) return fallback;
+  if (value === "user" || value === "admin") return value;
+  throw new Error(
+    `${LEMON_AUTH_MOCK_USER_ENV}.role must be "user" or "admin"`
+  );
+}
+function readOptionalStringArray(value, fallback, field) {
+  if (value === void 0 || value === null) return fallback;
+  if (Array.isArray(value) && value.every((item) => typeof item === "string")) {
+    return value;
+  }
+  throw new Error(
+    `${LEMON_AUTH_MOCK_USER_ENV}.${field} must be a string array`
+  );
+}
+
+export {
+  AUTH_SERVER_URL,
+  JWKS_URL,
+  LOGIN_URL,
+  REFRESH_URL,
+  LOGOUT_URL,
+  PROFILE_URL,
+  PROFILE_PAGE_URL,
+  ACCESS_TOKEN_COOKIE,
+  REFRESH_TOKEN_COOKIE,
+  DEVICE_ID_COOKIE,
+  isMockAuthEnabled,
+  getMockAccessTokenClaims
+};
+//# sourceMappingURL=chunk-OX5MDVSR.js.map

package/dist/chunk-OX5MDVSR.js.map

@@ -0,0 +1 @@
+{"version":3,"sources":["../src/constants.ts","../src/mock.ts"],"sourcesContent":["export const AUTH_SERVER_URL = \"https://auth.lemondouble.com\";\nexport const JWKS_URL = `${AUTH_SERVER_URL}/.well-known/jwks.json`;\nexport const LOGIN_URL = `${AUTH_SERVER_URL}/api/oauth2/google/login`;\nexport const REFRESH_URL = `${AUTH_SERVER_URL}/api/token/refresh`;\nexport const LOGOUT_URL = `${AUTH_SERVER_URL}/api/token/logout`;\nexport const PROFILE_URL = `${AUTH_SERVER_URL}/api/user/me`;\nexport const PROFILE_PAGE_URL = `${AUTH_SERVER_URL}/profile`;\n\nexport const ACCESS_TOKEN_COOKIE = \"lemon_access_token\";\nexport const REFRESH_TOKEN_COOKIE = \"lemon_refresh_token\";\nexport const DEVICE_ID_COOKIE = \"device_id\";\n","import type { AccessTokenClaims, LemonUser } from \"./types.js\";\n\nexport const LEMON_AUTH_MOCK_USER_ENV =\n  \"NEXT_PUBLIC_LEMON_AUTH_MOCK_USER\";\n\nexport function isMockAuthEnabled(): boolean {\n  return !isProduction() && Boolean(readMockUserEnv());\n}\n\nexport function getMockUser(): LemonUser | null {\n  const raw = readMockUserEnv();\n  if (isProduction() || !raw) return null;\n  return parseMockUser(raw);\n}\n\nexport function getMockAccessTokenClaims(): AccessTokenClaims | null {\n  const user = getMockUser();\n  if (!user) return null;\n\n  const now = Math.floor(Date.now() / 1000);\n  return {\n    token_type: \"access\",\n    sub: user.uid,\n    nickname: user.nickname,\n    profile_image_url: user.profileImageUrl,\n    role: user.role,\n    approved_clients: user.approvedClients,\n    iss: \"lemon-auth-mock\",\n    iat: now,\n    exp: now + 60 * 60 * 24 * 365,\n  };\n}\n\nfunction readMockUserEnv(): string | undefined {\n  try {\n    return process.env.NEXT_PUBLIC_LEMON_AUTH_MOCK_USER;\n  } catch {\n    return undefined;\n  }\n}\n\nfunction isProduction(): boolean {\n  try {\n    return process.env.NODE_ENV === \"production\";\n  } catch {\n    return false;\n  }\n}\n\nfunction parseMockUser(raw: string): LemonUser {\n  let data: unknown;\n  try {\n    data = JSON.parse(raw);\n  } catch {\n    throw new Error(\n      `${LEMON_AUTH_MOCK_USER_ENV} must be a valid JSON object`\n    );\n  }\n\n  if (!isRecord(data)) {\n    throw new Error(`${LEMON_AUTH_MOCK_USER_ENV} must be a JSON object`);\n  }\n\n  return {\n    uid: readOptionalString(data.uid, \"local-user\", \"uid\"),\n    nickname: readOptionalString(data.nickname, \"Local User\", \"nickname\"),\n    profileImageUrl: readOptionalString(\n      data.profileImageUrl ?? data.profile_image_url,\n      \"\",\n      \"profileImageUrl\"\n    ),\n    role: readOptionalRole(data.role, \"admin\"),\n    approvedClients: readOptionalStringArray(\n      data.approvedClients ?? data.approved_clients,\n      [\"*\"],\n      \"approvedClients\"\n    ),\n  };\n}\n\nfunction isRecord(value: unknown): value is Record<string, unknown> {\n  return typeof value === \"object\" && value !== null && !Array.isArray(value);\n}\n\nfunction readOptionalString(\n  value: unknown,\n  fallback: string,\n  field: string\n): string {\n  if (value === undefined || value === null) return fallback;\n  if (typeof value === \"string\") return value;\n  throw new Error(`${LEMON_AUTH_MOCK_USER_ENV}.${field} must be a string`);\n}\n\nfunction readOptionalRole(\n  value: unknown,\n  fallback: LemonUser[\"role\"]\n): LemonUser[\"role\"] {\n  if (value === undefined || value === null) return fallback;\n  if (value === \"user\" || value === \"admin\") return value;\n  throw new Error(\n    `${LEMON_AUTH_MOCK_USER_ENV}.role must be \"user\" or \"admin\"`\n  );\n}\n\nfunction readOptionalStringArray(\n  value: unknown,\n  fallback: string[],\n  field: string\n): string[] {\n  if (value === undefined || value === null) return fallback;\n  if (\n    Array.isArray(value) &&\n    value.every((item) => typeof item === \"string\")\n  ) {\n    return value;\n  }\n  throw new Error(\n    `${LEMON_AUTH_MOCK_USER_ENV}.${field} must be a string array`\n  );\n}\n"],"mappings":";AAAO,IAAM,kBAAkB;AACxB,IAAM,WAAW,GAAG,eAAe;AACnC,IAAM,YAAY,GAAG,eAAe;AACpC,IAAM,cAAc,GAAG,eAAe;AACtC,IAAM,aAAa,GAAG,eAAe;AACrC,IAAM,cAAc,GAAG,eAAe;AACtC,IAAM,mBAAmB,GAAG,eAAe;AAE3C,IAAM,sBAAsB;AAC5B,IAAM,uBAAuB;AAC7B,IAAM,mBAAmB;;;ACRzB,IAAM,2BACX;AAEK,SAAS,oBAA6B;AAC3C,SAAO,CAAC,aAAa,KAAK,QAAQ,gBAAgB,CAAC;AACrD;AAEO,SAAS,cAAgC;AAC9C,QAAM,MAAM,gBAAgB;AAC5B,MAAI,aAAa,KAAK,CAAC,IAAK,QAAO;AACnC,SAAO,cAAc,GAAG;AAC1B;AAEO,SAAS,2BAAqD;AACnE,QAAM,OAAO,YAAY;AACzB,MAAI,CAAC,KAAM,QAAO;AAElB,QAAM,MAAM,KAAK,MAAM,KAAK,IAAI,IAAI,GAAI;AACxC,SAAO;AAAA,IACL,YAAY;AAAA,IACZ,KAAK,KAAK;AAAA,IACV,UAAU,KAAK;AAAA,IACf,mBAAmB,KAAK;AAAA,IACxB,MAAM,KAAK;AAAA,IACX,kBAAkB,KAAK;AAAA,IACvB,KAAK;AAAA,IACL,KAAK;AAAA,IACL,KAAK,MAAM,KAAK,KAAK,KAAK;AAAA,EAC5B;AACF;AAEA,SAAS,kBAAsC;AAC7C,MAAI;AACF,WAAO,QAAQ,IAAI;AAAA,EACrB,QAAQ;AACN,WAAO;AAAA,EACT;AACF;AAEA,SAAS,eAAwB;AAC/B,MAAI;AACF,WAAO,QAAQ,IAAI,aAAa;AAAA,EAClC,QAAQ;AACN,WAAO;AAAA,EACT;AACF;AAEA,SAAS,cAAc,KAAwB;AAC7C,MAAI;AACJ,MAAI;AACF,WAAO,KAAK,MAAM,GAAG;AAAA,EACvB,QAAQ;AACN,UAAM,IAAI;AAAA,MACR,GAAG,wBAAwB;AAAA,IAC7B;AAAA,EACF;AAEA,MAAI,CAAC,SAAS,IAAI,GAAG;AACnB,UAAM,IAAI,MAAM,GAAG,wBAAwB,wBAAwB;AAAA,EACrE;AAEA,SAAO;AAAA,IACL,KAAK,mBAAmB,KAAK,KAAK,cAAc,KAAK;AAAA,IACrD,UAAU,mBAAmB,KAAK,UAAU,cAAc,UAAU;AAAA,IACpE,iBAAiB;AAAA,MACf,KAAK,mBAAmB,KAAK;AAAA,MAC7B;AAAA,MACA;AAAA,IACF;AAAA,IACA,MAAM,iBAAiB,KAAK,MAAM,OAAO;AAAA,IACzC,iBAAiB;AAAA,MACf,KAAK,mBAAmB,KAAK;AAAA,MAC7B,CAAC,GAAG;AAAA,MACJ;AAAA,IACF;AAAA,EACF;AACF;AAEA,SAAS,SAAS,OAAkD;AAClE,SAAO,OAAO,UAAU,YAAY,UAAU,QAAQ,CAAC,MAAM,QAAQ,KAAK;AAC5E;AAEA,SAAS,mBACP,OACA,UACA,OACQ;AACR,MAAI,UAAU,UAAa,UAAU,KAAM,QAAO;AAClD,MAAI,OAAO,UAAU,SAAU,QAAO;AACtC,QAAM,IAAI,MAAM,GAAG,wBAAwB,IAAI,KAAK,mBAAmB;AACzE;AAEA,SAAS,iBACP,OACA,UACmB;AACnB,MAAI,UAAU,UAAa,UAAU,KAAM,QAAO;AAClD,MAAI,UAAU,UAAU,UAAU,QAAS,QAAO;AAClD,QAAM,IAAI;AAAA,IACR,GAAG,wBAAwB;AAAA,EAC7B;AACF;AAEA,SAAS,wBACP,OACA,UACA,OACU;AACV,MAAI,UAAU,UAAa,UAAU,KAAM,QAAO;AAClD,MACE,MAAM,QAAQ,KAAK,KACnB,MAAM,MAAM,CAAC,SAAS,OAAO,SAAS,QAAQ,GAC9C;AACA,WAAO;AAAA,EACT;AACA,QAAM,IAAI;AAAA,IACR,GAAG,wBAAwB,IAAI,KAAK;AAAA,EACtC;AACF;","names":[]}

package/dist/client/index.d.ts

@@ -1,5 +1,5 @@
 import * as react_jsx_runtime from 'react/jsx-runtime';
-import { L as LemonUser } from '../types-CgrEUXwM.js';
+import { a as LemonUser } from '../types-B5uRY2Si.js';
 import * as react from 'react';
 import 'jose';
 
@@ -20,7 +20,7 @@ declare function AutoTokenRefresh({ children, fallback, }: {
 
 declare function loginUrl(redirectUrl: string): string;
 declare function profileUrl(redirectUrl?: string): string;
-declare function logout(): Promise<void>;
+declare function logout(): Promise<boolean>;
 declare function refreshToken(): Promise<boolean>;
 
 export { AuthProvider, AutoTokenRefresh, LemonUser, loginUrl, logout, profileUrl, refreshToken, useAuth };

package/dist/client/index.js

@@ -1,10 +1,14 @@
 "use client";
 import {
+  ACCESS_TOKEN_COOKIE,
+  DEVICE_ID_COOKIE,
   LOGIN_URL,
   LOGOUT_URL,
   PROFILE_PAGE_URL,
-  REFRESH_URL
-} from "../chunk-3ARMB6QF.js";
+  REFRESH_TOKEN_COOKIE,
+  REFRESH_URL,
+  isMockAuthEnabled
+} from "../chunk-OX5MDVSR.js";
 
 // src/client/context.tsx
 import { createContext, useContext } from "react";
@@ -28,27 +32,101 @@ import { useEffect, useState } from "react";
 import { useRouter } from "next/navigation";
 
 // src/client/url.ts
+var LOGOUT_COOKIE_NAMES = [
+  ACCESS_TOKEN_COOKIE,
+  REFRESH_TOKEN_COOKIE,
+  DEVICE_ID_COOKIE
+];
 function loginUrl(redirectUrl) {
+  if (isMockAuthEnabled()) return redirectUrl;
+  assertValidLoginRedirectUrl(redirectUrl);
   return `${LOGIN_URL}?redirect_url=${encodeURIComponent(redirectUrl)}`;
 }
 function profileUrl(redirectUrl) {
+  if (isMockAuthEnabled()) return redirectUrl ?? "/";
   if (redirectUrl) {
     return `${PROFILE_PAGE_URL}?redirect_url=${encodeURIComponent(redirectUrl)}`;
   }
   return PROFILE_PAGE_URL;
 }
 async function logout() {
-  await fetch(LOGOUT_URL, {
-    method: "POST",
-    credentials: "include"
-  });
+  if (isMockAuthEnabled()) {
+    expireAuthCookies();
+    return true;
+  }
+  try {
+    const res = await fetch(LOGOUT_URL, {
+      method: "POST",
+      credentials: "include"
+    });
+    return res.ok;
+  } catch {
+    return false;
+  } finally {
+    expireAuthCookies();
+  }
 }
 async function refreshToken() {
-  const res = await fetch(REFRESH_URL, {
-    method: "POST",
-    credentials: "include"
-  });
-  return res.ok;
+  if (isMockAuthEnabled()) return true;
+  try {
+    const res = await fetch(REFRESH_URL, {
+      method: "POST",
+      credentials: "include"
+    });
+    return res.ok;
+  } catch {
+    return false;
+  }
+}
+function expireAuthCookies() {
+  if (typeof document === "undefined") return;
+  for (const name of LOGOUT_COOKIE_NAMES) {
+    for (const domain of getCookieDomains()) {
+      document.cookie = [
+        `${name}=`,
+        "Max-Age=0",
+        "Path=/",
+        "SameSite=Lax",
+        domain ? `Domain=${domain}` : ""
+      ].filter(Boolean).join("; ");
+    }
+  }
+}
+function getCookieDomains() {
+  if (typeof window === "undefined") return [""];
+  const { hostname } = window.location;
+  if (!hostname || hostname === "localhost" || isIpAddress(hostname)) {
+    return [""];
+  }
+  const labels = hostname.split(".");
+  const domains = [""];
+  for (let i = 0; i < labels.length - 1; i += 1) {
+    domains.push(`.${labels.slice(i).join(".")}`);
+  }
+  return domains;
+}
+function isIpAddress(hostname) {
+  return /^[\d.]+$/.test(hostname) || hostname.includes(":");
+}
+function assertValidLoginRedirectUrl(redirectUrl) {
+  let url;
+  try {
+    url = new URL(redirectUrl);
+  } catch {
+    throw new Error("loginUrl redirectUrl must be a valid absolute URL");
+  }
+  if (url.protocol !== "https:") {
+    throw new Error("loginUrl redirectUrl must use https");
+  }
+  if (!isAllowedLoginRedirectHost(url.hostname)) {
+    throw new Error(
+      "loginUrl redirectUrl host must be lemondouble.com or a subdomain of lemondouble.com"
+    );
+  }
+}
+function isAllowedLoginRedirectHost(hostname) {
+  const normalized = hostname.toLowerCase();
+  return normalized === "lemondouble.com" || normalized.endsWith(".lemondouble.com");
 }
 
 // src/client/auto-token-refresh.tsx