@lemondouble/lemon-auth 0.7.0 → 0.7.1

package/dist/proxy/index.js

@@ -94,10 +94,10 @@ function createAuthProxy(options = {}) {
       if (result) {
         const claims = await verifyToken(result.newAccessToken);
         if (claims) {
-          const response = NextResponse.next();
-          for (const header of result.setCookieHeaders) {
-            response.headers.append("Set-Cookie", header);
-          }
+          const response = nextWithRefreshedCookies(
+            request,
+            result.setCookieHeaders
+          );
           return handleVerifiedClaims(
             claims,
             request,
@@ -141,15 +141,33 @@ async function maybeRefreshAndContinue(request) {
   if (refreshToken) {
     const result = await tryRefresh(refreshToken, deviceId);
     if (result) {
-      const response = NextResponse.next();
-      for (const header of result.setCookieHeaders) {
-        response.headers.append("Set-Cookie", header);
-      }
-      return response;
+      return nextWithRefreshedCookies(request, result.setCookieHeaders);
     }
   }
   return NextResponse.next();
 }
+function nextWithRefreshedCookies(request, setCookieHeaders) {
+  const merged = /* @__PURE__ */ new Map();
+  for (const { name, value } of request.cookies.getAll()) {
+    merged.set(name, value);
+  }
+  for (const header of setCookieHeaders) {
+    const pair = header.split(";")[0] ?? "";
+    const separator = pair.indexOf("=");
+    if (separator <= 0) continue;
+    merged.set(pair.slice(0, separator).trim(), pair.slice(separator + 1).trim());
+  }
+  const requestHeaders = new Headers(request.headers);
+  requestHeaders.set(
+    "cookie",
+    Array.from(merged, ([name, value]) => `${name}=${value}`).join("; ")
+  );
+  const response = NextResponse.next({ request: { headers: requestHeaders } });
+  for (const header of setCookieHeaders) {
+    response.headers.append("Set-Cookie", header);
+  }
+  return response;
+}
 function isTokenFresh(token) {
   try {
     const parts = token.split(".");

package/dist/proxy/index.js.map

@@ -1 +1 @@
-{"version":3,"sources":["../../src/proxy/index.ts"],"sourcesContent":["import { NextRequest, NextResponse } from \"next/server\";\nimport {\n  ACCESS_TOKEN_COOKIE,\n  REFRESH_TOKEN_COOKIE,\n  DEVICE_ID_COOKIE,\n  AUTH_SERVER_URL,\n  REFRESH_URL,\n  JWKS_URL,\n  LOGIN_URL,\n} from \"../constants.js\";\nimport { createRemoteJWKSet, jwtVerify } from \"jose\";\nimport type { AccessTokenClaims } from \"../types.js\";\nimport { isAccessTokenClaims } from \"../claims.js\";\nimport { isApprovedClient } from \"../approval.js\";\nimport { getMockAccessTokenClaims } from \"../mock.js\";\n\nconst REFRESH_BUFFER_SECONDS = 60;\n\nexport const DEFAULT_AUTH_BYPASS_PATHS = [\n  \"/sw.js\",\n  \"/service-worker.js\",\n  \"/manifest.webmanifest\",\n  \"/manifest.json\",\n  \"/favicon.ico\",\n  \"/robots.txt\",\n  \"/sitemap.xml\",\n  \"/browserconfig.xml\",\n  \"/apple-touch-icon.png\",\n  \"/apple-touch-icon-*\",\n  \"/icon-*\",\n  \"/icons/*\",\n];\n\nexport const DEFAULT_API_PATHS = [\"/api/*\"];\n\nexport const PROXY_AUTH_ERROR = {\n  UNAUTHORIZED: \"UNAUTHORIZED\",\n  FORBIDDEN: \"FORBIDDEN\",\n} as const;\nexport type ProxyAuthErrorCode =\n  (typeof PROXY_AUTH_ERROR)[keyof typeof PROXY_AUTH_ERROR];\n\nconst jwks = createRemoteJWKSet(new URL(JWKS_URL));\n\nexport type LoginRedirectUrl = string | ((request: NextRequest) => string);\n\nexport interface AuthProxyOptions {\n  publicPaths?: string[];\n  bypassPaths?: string[];\n  apiPaths?: string[];\n  clientId?: string;\n  loginRedirectUrl?: LoginRedirectUrl;\n  unapprovedRedirectUrl?: LoginRedirectUrl;\n  onAuthSuccess?: (\n    claims: AccessTokenClaims,\n    request: NextRequest,\n    response: NextResponse\n  ) => Promise<NextResponse> | NextResponse;\n}\n\nexport function createAuthProxy(options: AuthProxyOptions = {}) {\n  const {\n    publicPaths = [],\n    bypassPaths = [],\n    apiPaths = DEFAULT_API_PATHS,\n    clientId,\n    loginRedirectUrl,\n    unapprovedRedirectUrl,\n    onAuthSuccess,\n  } = options;\n  const effectiveBypassPaths = [\n    ...DEFAULT_AUTH_BYPASS_PATHS,\n    ...bypassPaths,\n  ];\n\n  return async function proxy(request: NextRequest): Promise<NextResponse> {\n    const { pathname } = request.nextUrl;\n\n    if (isPublicPath(pathname, effectiveBypassPaths)) {\n      return NextResponse.next();\n    }\n\n    if (isPublicPath(pathname, publicPaths)) {\n      return maybeRefreshAndContinue(request);\n    }\n\n    const isApiRequest = isPublicPath(pathname, apiPaths);\n    const mockClaims = getMockAccessTokenClaims();\n    if (mockClaims) {\n      return handleVerifiedClaims(\n        mockClaims,\n        request,\n        isApiRequest,\n        clientId,\n        unapprovedRedirectUrl,\n        onAuthSuccess,\n        NextResponse.next()\n      );\n    }\n\n    const accessToken = request.cookies.get(ACCESS_TOKEN_COOKIE)?.value;\n    const refreshToken = request.cookies.get(REFRESH_TOKEN_COOKIE)?.value;\n    const deviceId = request.cookies.get(DEVICE_ID_COOKIE)?.value;\n\n    if (accessToken && isTokenFresh(accessToken)) {\n      const claims = await verifyToken(accessToken);\n      if (claims) {\n        return handleVerifiedClaims(\n          claims,\n          request,\n          isApiRequest,\n          clientId,\n          unapprovedRedirectUrl,\n          onAuthSuccess,\n          NextResponse.next()\n        );\n      }\n    }\n\n    if (refreshToken) {\n      const result = await tryRefresh(refreshToken, deviceId);\n      if (result) {\n        const claims = await verifyToken(result.newAccessToken);\n        if (claims) {\n          const response = NextResponse.next();\n          for (const header of result.setCookieHeaders) {\n            response.headers.append(\"Set-Cookie\", header);\n          }\n          return handleVerifiedClaims(\n            claims,\n            request,\n            isApiRequest,\n            clientId,\n            unapprovedRedirectUrl,\n            onAuthSuccess,\n            response\n          );\n        }\n      }\n    }\n\n    return isApiRequest\n      ? unauthorizedJson()\n      : redirectToLogin(request, loginRedirectUrl);\n  };\n}\n\nasync function handleVerifiedClaims(\n  claims: AccessTokenClaims,\n  request: NextRequest,\n  isApiRequest: boolean,\n  clientId: string | undefined,\n  unapprovedRedirectUrl: LoginRedirectUrl | undefined,\n  onAuthSuccess: AuthProxyOptions[\"onAuthSuccess\"],\n  response: NextResponse\n): Promise<NextResponse> {\n  if (!isApprovedClient(claims.approved_clients, clientId)) {\n    return isApiRequest\n      ? forbiddenJson()\n      : redirectToUnapproved(request, unapprovedRedirectUrl);\n  }\n\n  return onAuthSuccess\n    ? await onAuthSuccess(claims, request, response)\n    : response;\n}\n\nfunction unauthorizedJson(): NextResponse {\n  return NextResponse.json(\n    { code: PROXY_AUTH_ERROR.UNAUTHORIZED },\n    { status: 401 }\n  );\n}\n\nfunction forbiddenJson(): NextResponse {\n  return NextResponse.json(\n    { code: PROXY_AUTH_ERROR.FORBIDDEN },\n    { status: 403 }\n  );\n}\n\nasync function maybeRefreshAndContinue(\n  request: NextRequest\n): Promise<NextResponse> {\n  const accessToken = request.cookies.get(ACCESS_TOKEN_COOKIE)?.value;\n  const refreshToken = request.cookies.get(REFRESH_TOKEN_COOKIE)?.value;\n  const deviceId = request.cookies.get(DEVICE_ID_COOKIE)?.value;\n\n  if (accessToken && isTokenFresh(accessToken)) {\n    return NextResponse.next();\n  }\n\n  if (refreshToken) {\n    const result = await tryRefresh(refreshToken, deviceId);\n    if (result) {\n      const response = NextResponse.next();\n      for (const header of result.setCookieHeaders) {\n        response.headers.append(\"Set-Cookie\", header);\n      }\n      return response;\n    }\n  }\n\n  return NextResponse.next();\n}\n\nfunction isTokenFresh(token: string): boolean {\n  try {\n    const parts = token.split(\".\");\n    if (parts.length !== 3) return false;\n    const payload = JSON.parse(\n      Buffer.from(parts[1], \"base64url\").toString()\n    );\n    return (\n      typeof payload.exp === \"number\" &&\n      payload.exp > Math.floor(Date.now() / 1000) + REFRESH_BUFFER_SECONDS\n    );\n  } catch {\n    return false;\n  }\n}\n\nasync function verifyToken(\n  token: string\n): Promise<AccessTokenClaims | null> {\n  try {\n    const { payload } = await jwtVerify(token, jwks, {\n      issuer: AUTH_SERVER_URL,\n    });\n    return isAccessTokenClaims(payload) ? payload : null;\n  } catch {\n    return null;\n  }\n}\n\ninterface RefreshSuccess {\n  newAccessToken: string;\n  setCookieHeaders: string[];\n}\n\nasync function tryRefresh(\n  refreshToken: string,\n  deviceId?: string\n): Promise<RefreshSuccess | null> {\n  try {\n    const res = await fetch(REFRESH_URL, {\n      method: \"POST\",\n      headers: { Cookie: buildRefreshCookieHeader(refreshToken, deviceId) },\n    });\n\n    if (!res.ok) return null;\n\n    const setCookieHeaders = res.headers.getSetCookie();\n    const newAccessToken = extractAccessToken(setCookieHeaders);\n    if (!newAccessToken) return null;\n\n    return { newAccessToken, setCookieHeaders };\n  } catch {\n    return null;\n  }\n}\n\nfunction buildRefreshCookieHeader(\n  refreshToken: string,\n  deviceId?: string\n): string {\n  const cookies = [`${REFRESH_TOKEN_COOKIE}=${refreshToken}`];\n  if (deviceId) {\n    cookies.push(`${DEVICE_ID_COOKIE}=${deviceId}`);\n  }\n  return cookies.join(\"; \");\n}\n\nfunction extractAccessToken(setCookieHeaders: string[]): string | null {\n  for (const header of setCookieHeaders) {\n    const match = header.match(new RegExp(`^${ACCESS_TOKEN_COOKIE}=([^;]+)`));\n    if (match) return match[1];\n  }\n  return null;\n}\n\nfunction isPublicPath(pathname: string, publicPaths: string[]): boolean {\n  return publicPaths.some((p) => {\n    if (p.endsWith(\"*\")) {\n      return pathname.startsWith(p.slice(0, -1));\n    }\n    return pathname === p;\n  });\n}\n\nfunction redirectToLogin(\n  request: NextRequest,\n  loginRedirectUrl?: LoginRedirectUrl\n): NextResponse {\n  const redirectUrl = resolveLoginRedirectUrl(request, loginRedirectUrl);\n  if (redirectUrl) {\n    const url = `${LOGIN_URL}?redirect_url=${encodeURIComponent(redirectUrl)}`;\n    return NextResponse.redirect(new URL(url, request.url));\n  }\n  return NextResponse.redirect(new URL(\"/\", request.url));\n}\n\nfunction redirectToUnapproved(\n  request: NextRequest,\n  unapprovedRedirectUrl?: LoginRedirectUrl\n): NextResponse {\n  const redirectUrl = resolveLoginRedirectUrl(request, unapprovedRedirectUrl);\n  if (redirectUrl) {\n    return NextResponse.redirect(new URL(redirectUrl, request.url));\n  }\n  const errorUrl = new URL(`${AUTH_SERVER_URL}/error`);\n  errorUrl.searchParams.set(\"code\", PROXY_AUTH_ERROR.FORBIDDEN);\n  errorUrl.searchParams.set(\"from\", request.url);\n  return NextResponse.redirect(errorUrl);\n}\n\nfunction resolveLoginRedirectUrl(\n  request: NextRequest,\n  loginRedirectUrl?: LoginRedirectUrl\n): string | undefined {\n  if (typeof loginRedirectUrl === \"function\") {\n    return loginRedirectUrl(request);\n  }\n  return loginRedirectUrl;\n}\n\nexport type { AccessTokenClaims } from \"../types.js\";\nexport type { LemonUser } from \"../types.js\";\n"],"mappings":";;;;;;;;;;;;;;;;AAAA,SAAsB,oBAAoB;AAU1C,SAAS,oBAAoB,iBAAiB;AAM9C,IAAM,yBAAyB;AAExB,IAAM,4BAA4B;AAAA,EACvC;AAAA,EACA;AAAA,EACA;AAAA,EACA;AAAA,EACA;AAAA,EACA;AAAA,EACA;AAAA,EACA;AAAA,EACA;AAAA,EACA;AAAA,EACA;AAAA,EACA;AACF;AAEO,IAAM,oBAAoB,CAAC,QAAQ;AAEnC,IAAM,mBAAmB;AAAA,EAC9B,cAAc;AAAA,EACd,WAAW;AACb;AAIA,IAAM,OAAO,mBAAmB,IAAI,IAAI,QAAQ,CAAC;AAkB1C,SAAS,gBAAgB,UAA4B,CAAC,GAAG;AAC9D,QAAM;AAAA,IACJ,cAAc,CAAC;AAAA,IACf,cAAc,CAAC;AAAA,IACf,WAAW;AAAA,IACX;AAAA,IACA;AAAA,IACA;AAAA,IACA;AAAA,EACF,IAAI;AACJ,QAAM,uBAAuB;AAAA,IAC3B,GAAG;AAAA,IACH,GAAG;AAAA,EACL;AAEA,SAAO,eAAe,MAAM,SAA6C;AACvE,UAAM,EAAE,SAAS,IAAI,QAAQ;AAE7B,QAAI,aAAa,UAAU,oBAAoB,GAAG;AAChD,aAAO,aAAa,KAAK;AAAA,IAC3B;AAEA,QAAI,aAAa,UAAU,WAAW,GAAG;AACvC,aAAO,wBAAwB,OAAO;AAAA,IACxC;AAEA,UAAM,eAAe,aAAa,UAAU,QAAQ;AACpD,UAAM,aAAa,yBAAyB;AAC5C,QAAI,YAAY;AACd,aAAO;AAAA,QACL;AAAA,QACA;AAAA,QACA;AAAA,QACA;AAAA,QACA;AAAA,QACA;AAAA,QACA,aAAa,KAAK;AAAA,MACpB;AAAA,IACF;AAEA,UAAM,cAAc,QAAQ,QAAQ,IAAI,mBAAmB,GAAG;AAC9D,UAAM,eAAe,QAAQ,QAAQ,IAAI,oBAAoB,GAAG;AAChE,UAAM,WAAW,QAAQ,QAAQ,IAAI,gBAAgB,GAAG;AAExD,QAAI,eAAe,aAAa,WAAW,GAAG;AAC5C,YAAM,SAAS,MAAM,YAAY,WAAW;AAC5C,UAAI,QAAQ;AACV,eAAO;AAAA,UACL;AAAA,UACA;AAAA,UACA;AAAA,UACA;AAAA,UACA;AAAA,UACA;AAAA,UACA,aAAa,KAAK;AAAA,QACpB;AAAA,MACF;AAAA,IACF;AAEA,QAAI,cAAc;AAChB,YAAM,SAAS,MAAM,WAAW,cAAc,QAAQ;AACtD,UAAI,QAAQ;AACV,cAAM,SAAS,MAAM,YAAY,OAAO,cAAc;AACtD,YAAI,QAAQ;AACV,gBAAM,WAAW,aAAa,KAAK;AACnC,qBAAW,UAAU,OAAO,kBAAkB;AAC5C,qBAAS,QAAQ,OAAO,cAAc,MAAM;AAAA,UAC9C;AACA,iBAAO;AAAA,YACL;AAAA,YACA;AAAA,YACA;AAAA,YACA;AAAA,YACA;AAAA,YACA;AAAA,YACA;AAAA,UACF;AAAA,QACF;AAAA,MACF;AAAA,IACF;AAEA,WAAO,eACH,iBAAiB,IACjB,gBAAgB,SAAS,gBAAgB;AAAA,EAC/C;AACF;AAEA,eAAe,qBACb,QACA,SACA,cACA,UACA,uBACA,eACA,UACuB;AACvB,MAAI,CAAC,iBAAiB,OAAO,kBAAkB,QAAQ,GAAG;AACxD,WAAO,eACH,cAAc,IACd,qBAAqB,SAAS,qBAAqB;AAAA,EACzD;AAEA,SAAO,gBACH,MAAM,cAAc,QAAQ,SAAS,QAAQ,IAC7C;AACN;AAEA,SAAS,mBAAiC;AACxC,SAAO,aAAa;AAAA,IAClB,EAAE,MAAM,iBAAiB,aAAa;AAAA,IACtC,EAAE,QAAQ,IAAI;AAAA,EAChB;AACF;AAEA,SAAS,gBAA8B;AACrC,SAAO,aAAa;AAAA,IAClB,EAAE,MAAM,iBAAiB,UAAU;AAAA,IACnC,EAAE,QAAQ,IAAI;AAAA,EAChB;AACF;AAEA,eAAe,wBACb,SACuB;AACvB,QAAM,cAAc,QAAQ,QAAQ,IAAI,mBAAmB,GAAG;AAC9D,QAAM,eAAe,QAAQ,QAAQ,IAAI,oBAAoB,GAAG;AAChE,QAAM,WAAW,QAAQ,QAAQ,IAAI,gBAAgB,GAAG;AAExD,MAAI,eAAe,aAAa,WAAW,GAAG;AAC5C,WAAO,aAAa,KAAK;AAAA,EAC3B;AAEA,MAAI,cAAc;AAChB,UAAM,SAAS,MAAM,WAAW,cAAc,QAAQ;AACtD,QAAI,QAAQ;AACV,YAAM,WAAW,aAAa,KAAK;AACnC,iBAAW,UAAU,OAAO,kBAAkB;AAC5C,iBAAS,QAAQ,OAAO,cAAc,MAAM;AAAA,MAC9C;AACA,aAAO;AAAA,IACT;AAAA,EACF;AAEA,SAAO,aAAa,KAAK;AAC3B;AAEA,SAAS,aAAa,OAAwB;AAC5C,MAAI;AACF,UAAM,QAAQ,MAAM,MAAM,GAAG;AAC7B,QAAI,MAAM,WAAW,EAAG,QAAO;AAC/B,UAAM,UAAU,KAAK;AAAA,MACnB,OAAO,KAAK,MAAM,CAAC,GAAG,WAAW,EAAE,SAAS;AAAA,IAC9C;AACA,WACE,OAAO,QAAQ,QAAQ,YACvB,QAAQ,MAAM,KAAK,MAAM,KAAK,IAAI,IAAI,GAAI,IAAI;AAAA,EAElD,QAAQ;AACN,WAAO;AAAA,EACT;AACF;AAEA,eAAe,YACb,OACmC;AACnC,MAAI;AACF,UAAM,EAAE,QAAQ,IAAI,MAAM,UAAU,OAAO,MAAM;AAAA,MAC/C,QAAQ;AAAA,IACV,CAAC;AACD,WAAO,oBAAoB,OAAO,IAAI,UAAU;AAAA,EAClD,QAAQ;AACN,WAAO;AAAA,EACT;AACF;AAOA,eAAe,WACb,cACA,UACgC;AAChC,MAAI;AACF,UAAM,MAAM,MAAM,MAAM,aAAa;AAAA,MACnC,QAAQ;AAAA,MACR,SAAS,EAAE,QAAQ,yBAAyB,cAAc,QAAQ,EAAE;AAAA,IACtE,CAAC;AAED,QAAI,CAAC,IAAI,GAAI,QAAO;AAEpB,UAAM,mBAAmB,IAAI,QAAQ,aAAa;AAClD,UAAM,iBAAiB,mBAAmB,gBAAgB;AAC1D,QAAI,CAAC,eAAgB,QAAO;AAE5B,WAAO,EAAE,gBAAgB,iBAAiB;AAAA,EAC5C,QAAQ;AACN,WAAO;AAAA,EACT;AACF;AAEA,SAAS,yBACP,cACA,UACQ;AACR,QAAM,UAAU,CAAC,GAAG,oBAAoB,IAAI,YAAY,EAAE;AAC1D,MAAI,UAAU;AACZ,YAAQ,KAAK,GAAG,gBAAgB,IAAI,QAAQ,EAAE;AAAA,EAChD;AACA,SAAO,QAAQ,KAAK,IAAI;AAC1B;AAEA,SAAS,mBAAmB,kBAA2C;AACrE,aAAW,UAAU,kBAAkB;AACrC,UAAM,QAAQ,OAAO,MAAM,IAAI,OAAO,IAAI,mBAAmB,UAAU,CAAC;AACxE,QAAI,MAAO,QAAO,MAAM,CAAC;AAAA,EAC3B;AACA,SAAO;AACT;AAEA,SAAS,aAAa,UAAkB,aAAgC;AACtE,SAAO,YAAY,KAAK,CAAC,MAAM;AAC7B,QAAI,EAAE,SAAS,GAAG,GAAG;AACnB,aAAO,SAAS,WAAW,EAAE,MAAM,GAAG,EAAE,CAAC;AAAA,IAC3C;AACA,WAAO,aAAa;AAAA,EACtB,CAAC;AACH;AAEA,SAAS,gBACP,SACA,kBACc;AACd,QAAM,cAAc,wBAAwB,SAAS,gBAAgB;AACrE,MAAI,aAAa;AACf,UAAM,MAAM,GAAG,SAAS,iBAAiB,mBAAmB,WAAW,CAAC;AACxE,WAAO,aAAa,SAAS,IAAI,IAAI,KAAK,QAAQ,GAAG,CAAC;AAAA,EACxD;AACA,SAAO,aAAa,SAAS,IAAI,IAAI,KAAK,QAAQ,GAAG,CAAC;AACxD;AAEA,SAAS,qBACP,SACA,uBACc;AACd,QAAM,cAAc,wBAAwB,SAAS,qBAAqB;AAC1E,MAAI,aAAa;AACf,WAAO,aAAa,SAAS,IAAI,IAAI,aAAa,QAAQ,GAAG,CAAC;AAAA,EAChE;AACA,QAAM,WAAW,IAAI,IAAI,GAAG,eAAe,QAAQ;AACnD,WAAS,aAAa,IAAI,QAAQ,iBAAiB,SAAS;AAC5D,WAAS,aAAa,IAAI,QAAQ,QAAQ,GAAG;AAC7C,SAAO,aAAa,SAAS,QAAQ;AACvC;AAEA,SAAS,wBACP,SACA,kBACoB;AACpB,MAAI,OAAO,qBAAqB,YAAY;AAC1C,WAAO,iBAAiB,OAAO;AAAA,EACjC;AACA,SAAO;AACT;","names":[]}
+{"version":3,"sources":["../../src/proxy/index.ts"],"sourcesContent":["import { NextRequest, NextResponse } from \"next/server\";\nimport {\n  ACCESS_TOKEN_COOKIE,\n  REFRESH_TOKEN_COOKIE,\n  DEVICE_ID_COOKIE,\n  AUTH_SERVER_URL,\n  REFRESH_URL,\n  JWKS_URL,\n  LOGIN_URL,\n} from \"../constants.js\";\nimport { createRemoteJWKSet, jwtVerify } from \"jose\";\nimport type { AccessTokenClaims } from \"../types.js\";\nimport { isAccessTokenClaims } from \"../claims.js\";\nimport { isApprovedClient } from \"../approval.js\";\nimport { getMockAccessTokenClaims } from \"../mock.js\";\n\nconst REFRESH_BUFFER_SECONDS = 60;\n\nexport const DEFAULT_AUTH_BYPASS_PATHS = [\n  \"/sw.js\",\n  \"/service-worker.js\",\n  \"/manifest.webmanifest\",\n  \"/manifest.json\",\n  \"/favicon.ico\",\n  \"/robots.txt\",\n  \"/sitemap.xml\",\n  \"/browserconfig.xml\",\n  \"/apple-touch-icon.png\",\n  \"/apple-touch-icon-*\",\n  \"/icon-*\",\n  \"/icons/*\",\n];\n\nexport const DEFAULT_API_PATHS = [\"/api/*\"];\n\nexport const PROXY_AUTH_ERROR = {\n  UNAUTHORIZED: \"UNAUTHORIZED\",\n  FORBIDDEN: \"FORBIDDEN\",\n} as const;\nexport type ProxyAuthErrorCode =\n  (typeof PROXY_AUTH_ERROR)[keyof typeof PROXY_AUTH_ERROR];\n\nconst jwks = createRemoteJWKSet(new URL(JWKS_URL));\n\nexport type LoginRedirectUrl = string | ((request: NextRequest) => string);\n\nexport interface AuthProxyOptions {\n  publicPaths?: string[];\n  bypassPaths?: string[];\n  apiPaths?: string[];\n  clientId?: string;\n  loginRedirectUrl?: LoginRedirectUrl;\n  unapprovedRedirectUrl?: LoginRedirectUrl;\n  onAuthSuccess?: (\n    claims: AccessTokenClaims,\n    request: NextRequest,\n    response: NextResponse\n  ) => Promise<NextResponse> | NextResponse;\n}\n\nexport function createAuthProxy(options: AuthProxyOptions = {}) {\n  const {\n    publicPaths = [],\n    bypassPaths = [],\n    apiPaths = DEFAULT_API_PATHS,\n    clientId,\n    loginRedirectUrl,\n    unapprovedRedirectUrl,\n    onAuthSuccess,\n  } = options;\n  const effectiveBypassPaths = [\n    ...DEFAULT_AUTH_BYPASS_PATHS,\n    ...bypassPaths,\n  ];\n\n  return async function proxy(request: NextRequest): Promise<NextResponse> {\n    const { pathname } = request.nextUrl;\n\n    if (isPublicPath(pathname, effectiveBypassPaths)) {\n      return NextResponse.next();\n    }\n\n    if (isPublicPath(pathname, publicPaths)) {\n      return maybeRefreshAndContinue(request);\n    }\n\n    const isApiRequest = isPublicPath(pathname, apiPaths);\n    const mockClaims = getMockAccessTokenClaims();\n    if (mockClaims) {\n      return handleVerifiedClaims(\n        mockClaims,\n        request,\n        isApiRequest,\n        clientId,\n        unapprovedRedirectUrl,\n        onAuthSuccess,\n        NextResponse.next()\n      );\n    }\n\n    const accessToken = request.cookies.get(ACCESS_TOKEN_COOKIE)?.value;\n    const refreshToken = request.cookies.get(REFRESH_TOKEN_COOKIE)?.value;\n    const deviceId = request.cookies.get(DEVICE_ID_COOKIE)?.value;\n\n    if (accessToken && isTokenFresh(accessToken)) {\n      const claims = await verifyToken(accessToken);\n      if (claims) {\n        return handleVerifiedClaims(\n          claims,\n          request,\n          isApiRequest,\n          clientId,\n          unapprovedRedirectUrl,\n          onAuthSuccess,\n          NextResponse.next()\n        );\n      }\n    }\n\n    if (refreshToken) {\n      const result = await tryRefresh(refreshToken, deviceId);\n      if (result) {\n        const claims = await verifyToken(result.newAccessToken);\n        if (claims) {\n          const response = nextWithRefreshedCookies(\n            request,\n            result.setCookieHeaders\n          );\n          return handleVerifiedClaims(\n            claims,\n            request,\n            isApiRequest,\n            clientId,\n            unapprovedRedirectUrl,\n            onAuthSuccess,\n            response\n          );\n        }\n      }\n    }\n\n    return isApiRequest\n      ? unauthorizedJson()\n      : redirectToLogin(request, loginRedirectUrl);\n  };\n}\n\nasync function handleVerifiedClaims(\n  claims: AccessTokenClaims,\n  request: NextRequest,\n  isApiRequest: boolean,\n  clientId: string | undefined,\n  unapprovedRedirectUrl: LoginRedirectUrl | undefined,\n  onAuthSuccess: AuthProxyOptions[\"onAuthSuccess\"],\n  response: NextResponse\n): Promise<NextResponse> {\n  if (!isApprovedClient(claims.approved_clients, clientId)) {\n    return isApiRequest\n      ? forbiddenJson()\n      : redirectToUnapproved(request, unapprovedRedirectUrl);\n  }\n\n  return onAuthSuccess\n    ? await onAuthSuccess(claims, request, response)\n    : response;\n}\n\nfunction unauthorizedJson(): NextResponse {\n  return NextResponse.json(\n    { code: PROXY_AUTH_ERROR.UNAUTHORIZED },\n    { status: 401 }\n  );\n}\n\nfunction forbiddenJson(): NextResponse {\n  return NextResponse.json(\n    { code: PROXY_AUTH_ERROR.FORBIDDEN },\n    { status: 403 }\n  );\n}\n\nasync function maybeRefreshAndContinue(\n  request: NextRequest\n): Promise<NextResponse> {\n  const accessToken = request.cookies.get(ACCESS_TOKEN_COOKIE)?.value;\n  const refreshToken = request.cookies.get(REFRESH_TOKEN_COOKIE)?.value;\n  const deviceId = request.cookies.get(DEVICE_ID_COOKIE)?.value;\n\n  if (accessToken && isTokenFresh(accessToken)) {\n    return NextResponse.next();\n  }\n\n  if (refreshToken) {\n    const result = await tryRefresh(refreshToken, deviceId);\n    if (result) {\n      return nextWithRefreshedCookies(request, result.setCookieHeaders);\n    }\n  }\n\n  return NextResponse.next();\n}\n\n/**\n * 갱신된 토큰을 이 요청의 cookie 헤더에도 반영한 응답을 만든다.\n *\n * Set-Cookie 는 브라우저에만 적용된다. 그것만 붙이면 지금 이 요청을 처리하는\n * 서버 컴포넌트는 여전히 만료된 access token 을 읽고, 갱신에 성공했는데도\n * 그 요청은 로그아웃으로 판정된다. access token 이 만료된 뒤 첫 요청마다\n * 발생하며, PWA 콜드 스타트처럼 항상 만료 상태에서 시작하는 경우 매번 겪는다.\n *\n * Next.js 는 미들웨어가 넘긴 요청 헤더를 다운스트림에 그대로 전달하므로\n * cookie 헤더를 새 토큰으로 바꿔 끼워 같은 요청에서 인증이 보이게 한다.\n * (response.headers.append 는 NextResponse 의 쿠키 프록시를 우회하기 때문에\n *  Next 의 x-middleware-set-cookie 병합 경로도 타지 않는다)\n */\nfunction nextWithRefreshedCookies(\n  request: NextRequest,\n  setCookieHeaders: string[]\n): NextResponse {\n  const merged = new Map<string, string>();\n  for (const { name, value } of request.cookies.getAll()) {\n    merged.set(name, value);\n  }\n\n  // auth 서버는 도메인마다 같은 쿠키를 한 번씩 보내므로 이름 기준으로 덮어쓴다.\n  for (const header of setCookieHeaders) {\n    const pair = header.split(\";\")[0] ?? \"\";\n    const separator = pair.indexOf(\"=\");\n    if (separator <= 0) continue;\n    merged.set(pair.slice(0, separator).trim(), pair.slice(separator + 1).trim());\n  }\n\n  const requestHeaders = new Headers(request.headers);\n  requestHeaders.set(\n    \"cookie\",\n    Array.from(merged, ([name, value]) => `${name}=${value}`).join(\"; \")\n  );\n\n  const response = NextResponse.next({ request: { headers: requestHeaders } });\n  for (const header of setCookieHeaders) {\n    response.headers.append(\"Set-Cookie\", header);\n  }\n  return response;\n}\n\nfunction isTokenFresh(token: string): boolean {\n  try {\n    const parts = token.split(\".\");\n    if (parts.length !== 3) return false;\n    const payload = JSON.parse(\n      Buffer.from(parts[1], \"base64url\").toString()\n    );\n    return (\n      typeof payload.exp === \"number\" &&\n      payload.exp > Math.floor(Date.now() / 1000) + REFRESH_BUFFER_SECONDS\n    );\n  } catch {\n    return false;\n  }\n}\n\nasync function verifyToken(\n  token: string\n): Promise<AccessTokenClaims | null> {\n  try {\n    const { payload } = await jwtVerify(token, jwks, {\n      issuer: AUTH_SERVER_URL,\n    });\n    return isAccessTokenClaims(payload) ? payload : null;\n  } catch {\n    return null;\n  }\n}\n\ninterface RefreshSuccess {\n  newAccessToken: string;\n  setCookieHeaders: string[];\n}\n\nasync function tryRefresh(\n  refreshToken: string,\n  deviceId?: string\n): Promise<RefreshSuccess | null> {\n  try {\n    const res = await fetch(REFRESH_URL, {\n      method: \"POST\",\n      headers: { Cookie: buildRefreshCookieHeader(refreshToken, deviceId) },\n    });\n\n    if (!res.ok) return null;\n\n    const setCookieHeaders = res.headers.getSetCookie();\n    const newAccessToken = extractAccessToken(setCookieHeaders);\n    if (!newAccessToken) return null;\n\n    return { newAccessToken, setCookieHeaders };\n  } catch {\n    return null;\n  }\n}\n\nfunction buildRefreshCookieHeader(\n  refreshToken: string,\n  deviceId?: string\n): string {\n  const cookies = [`${REFRESH_TOKEN_COOKIE}=${refreshToken}`];\n  if (deviceId) {\n    cookies.push(`${DEVICE_ID_COOKIE}=${deviceId}`);\n  }\n  return cookies.join(\"; \");\n}\n\nfunction extractAccessToken(setCookieHeaders: string[]): string | null {\n  for (const header of setCookieHeaders) {\n    const match = header.match(new RegExp(`^${ACCESS_TOKEN_COOKIE}=([^;]+)`));\n    if (match) return match[1];\n  }\n  return null;\n}\n\nfunction isPublicPath(pathname: string, publicPaths: string[]): boolean {\n  return publicPaths.some((p) => {\n    if (p.endsWith(\"*\")) {\n      return pathname.startsWith(p.slice(0, -1));\n    }\n    return pathname === p;\n  });\n}\n\nfunction redirectToLogin(\n  request: NextRequest,\n  loginRedirectUrl?: LoginRedirectUrl\n): NextResponse {\n  const redirectUrl = resolveLoginRedirectUrl(request, loginRedirectUrl);\n  if (redirectUrl) {\n    const url = `${LOGIN_URL}?redirect_url=${encodeURIComponent(redirectUrl)}`;\n    return NextResponse.redirect(new URL(url, request.url));\n  }\n  return NextResponse.redirect(new URL(\"/\", request.url));\n}\n\nfunction redirectToUnapproved(\n  request: NextRequest,\n  unapprovedRedirectUrl?: LoginRedirectUrl\n): NextResponse {\n  const redirectUrl = resolveLoginRedirectUrl(request, unapprovedRedirectUrl);\n  if (redirectUrl) {\n    return NextResponse.redirect(new URL(redirectUrl, request.url));\n  }\n  const errorUrl = new URL(`${AUTH_SERVER_URL}/error`);\n  errorUrl.searchParams.set(\"code\", PROXY_AUTH_ERROR.FORBIDDEN);\n  errorUrl.searchParams.set(\"from\", request.url);\n  return NextResponse.redirect(errorUrl);\n}\n\nfunction resolveLoginRedirectUrl(\n  request: NextRequest,\n  loginRedirectUrl?: LoginRedirectUrl\n): string | undefined {\n  if (typeof loginRedirectUrl === \"function\") {\n    return loginRedirectUrl(request);\n  }\n  return loginRedirectUrl;\n}\n\nexport type { AccessTokenClaims } from \"../types.js\";\nexport type { LemonUser } from \"../types.js\";\n"],"mappings":";;;;;;;;;;;;;;;;AAAA,SAAsB,oBAAoB;AAU1C,SAAS,oBAAoB,iBAAiB;AAM9C,IAAM,yBAAyB;AAExB,IAAM,4BAA4B;AAAA,EACvC;AAAA,EACA;AAAA,EACA;AAAA,EACA;AAAA,EACA;AAAA,EACA;AAAA,EACA;AAAA,EACA;AAAA,EACA;AAAA,EACA;AAAA,EACA;AAAA,EACA;AACF;AAEO,IAAM,oBAAoB,CAAC,QAAQ;AAEnC,IAAM,mBAAmB;AAAA,EAC9B,cAAc;AAAA,EACd,WAAW;AACb;AAIA,IAAM,OAAO,mBAAmB,IAAI,IAAI,QAAQ,CAAC;AAkB1C,SAAS,gBAAgB,UAA4B,CAAC,GAAG;AAC9D,QAAM;AAAA,IACJ,cAAc,CAAC;AAAA,IACf,cAAc,CAAC;AAAA,IACf,WAAW;AAAA,IACX;AAAA,IACA;AAAA,IACA;AAAA,IACA;AAAA,EACF,IAAI;AACJ,QAAM,uBAAuB;AAAA,IAC3B,GAAG;AAAA,IACH,GAAG;AAAA,EACL;AAEA,SAAO,eAAe,MAAM,SAA6C;AACvE,UAAM,EAAE,SAAS,IAAI,QAAQ;AAE7B,QAAI,aAAa,UAAU,oBAAoB,GAAG;AAChD,aAAO,aAAa,KAAK;AAAA,IAC3B;AAEA,QAAI,aAAa,UAAU,WAAW,GAAG;AACvC,aAAO,wBAAwB,OAAO;AAAA,IACxC;AAEA,UAAM,eAAe,aAAa,UAAU,QAAQ;AACpD,UAAM,aAAa,yBAAyB;AAC5C,QAAI,YAAY;AACd,aAAO;AAAA,QACL;AAAA,QACA;AAAA,QACA;AAAA,QACA;AAAA,QACA;AAAA,QACA;AAAA,QACA,aAAa,KAAK;AAAA,MACpB;AAAA,IACF;AAEA,UAAM,cAAc,QAAQ,QAAQ,IAAI,mBAAmB,GAAG;AAC9D,UAAM,eAAe,QAAQ,QAAQ,IAAI,oBAAoB,GAAG;AAChE,UAAM,WAAW,QAAQ,QAAQ,IAAI,gBAAgB,GAAG;AAExD,QAAI,eAAe,aAAa,WAAW,GAAG;AAC5C,YAAM,SAAS,MAAM,YAAY,WAAW;AAC5C,UAAI,QAAQ;AACV,eAAO;AAAA,UACL;AAAA,UACA;AAAA,UACA;AAAA,UACA;AAAA,UACA;AAAA,UACA;AAAA,UACA,aAAa,KAAK;AAAA,QACpB;AAAA,MACF;AAAA,IACF;AAEA,QAAI,cAAc;AAChB,YAAM,SAAS,MAAM,WAAW,cAAc,QAAQ;AACtD,UAAI,QAAQ;AACV,cAAM,SAAS,MAAM,YAAY,OAAO,cAAc;AACtD,YAAI,QAAQ;AACV,gBAAM,WAAW;AAAA,YACf;AAAA,YACA,OAAO;AAAA,UACT;AACA,iBAAO;AAAA,YACL;AAAA,YACA;AAAA,YACA;AAAA,YACA;AAAA,YACA;AAAA,YACA;AAAA,YACA;AAAA,UACF;AAAA,QACF;AAAA,MACF;AAAA,IACF;AAEA,WAAO,eACH,iBAAiB,IACjB,gBAAgB,SAAS,gBAAgB;AAAA,EAC/C;AACF;AAEA,eAAe,qBACb,QACA,SACA,cACA,UACA,uBACA,eACA,UACuB;AACvB,MAAI,CAAC,iBAAiB,OAAO,kBAAkB,QAAQ,GAAG;AACxD,WAAO,eACH,cAAc,IACd,qBAAqB,SAAS,qBAAqB;AAAA,EACzD;AAEA,SAAO,gBACH,MAAM,cAAc,QAAQ,SAAS,QAAQ,IAC7C;AACN;AAEA,SAAS,mBAAiC;AACxC,SAAO,aAAa;AAAA,IAClB,EAAE,MAAM,iBAAiB,aAAa;AAAA,IACtC,EAAE,QAAQ,IAAI;AAAA,EAChB;AACF;AAEA,SAAS,gBAA8B;AACrC,SAAO,aAAa;AAAA,IAClB,EAAE,MAAM,iBAAiB,UAAU;AAAA,IACnC,EAAE,QAAQ,IAAI;AAAA,EAChB;AACF;AAEA,eAAe,wBACb,SACuB;AACvB,QAAM,cAAc,QAAQ,QAAQ,IAAI,mBAAmB,GAAG;AAC9D,QAAM,eAAe,QAAQ,QAAQ,IAAI,oBAAoB,GAAG;AAChE,QAAM,WAAW,QAAQ,QAAQ,IAAI,gBAAgB,GAAG;AAExD,MAAI,eAAe,aAAa,WAAW,GAAG;AAC5C,WAAO,aAAa,KAAK;AAAA,EAC3B;AAEA,MAAI,cAAc;AAChB,UAAM,SAAS,MAAM,WAAW,cAAc,QAAQ;AACtD,QAAI,QAAQ;AACV,aAAO,yBAAyB,SAAS,OAAO,gBAAgB;AAAA,IAClE;AAAA,EACF;AAEA,SAAO,aAAa,KAAK;AAC3B;AAeA,SAAS,yBACP,SACA,kBACc;AACd,QAAM,SAAS,oBAAI,IAAoB;AACvC,aAAW,EAAE,MAAM,MAAM,KAAK,QAAQ,QAAQ,OAAO,GAAG;AACtD,WAAO,IAAI,MAAM,KAAK;AAAA,EACxB;AAGA,aAAW,UAAU,kBAAkB;AACrC,UAAM,OAAO,OAAO,MAAM,GAAG,EAAE,CAAC,KAAK;AACrC,UAAM,YAAY,KAAK,QAAQ,GAAG;AAClC,QAAI,aAAa,EAAG;AACpB,WAAO,IAAI,KAAK,MAAM,GAAG,SAAS,EAAE,KAAK,GAAG,KAAK,MAAM,YAAY,CAAC,EAAE,KAAK,CAAC;AAAA,EAC9E;AAEA,QAAM,iBAAiB,IAAI,QAAQ,QAAQ,OAAO;AAClD,iBAAe;AAAA,IACb;AAAA,IACA,MAAM,KAAK,QAAQ,CAAC,CAAC,MAAM,KAAK,MAAM,GAAG,IAAI,IAAI,KAAK,EAAE,EAAE,KAAK,IAAI;AAAA,EACrE;AAEA,QAAM,WAAW,aAAa,KAAK,EAAE,SAAS,EAAE,SAAS,eAAe,EAAE,CAAC;AAC3E,aAAW,UAAU,kBAAkB;AACrC,aAAS,QAAQ,OAAO,cAAc,MAAM;AAAA,EAC9C;AACA,SAAO;AACT;AAEA,SAAS,aAAa,OAAwB;AAC5C,MAAI;AACF,UAAM,QAAQ,MAAM,MAAM,GAAG;AAC7B,QAAI,MAAM,WAAW,EAAG,QAAO;AAC/B,UAAM,UAAU,KAAK;AAAA,MACnB,OAAO,KAAK,MAAM,CAAC,GAAG,WAAW,EAAE,SAAS;AAAA,IAC9C;AACA,WACE,OAAO,QAAQ,QAAQ,YACvB,QAAQ,MAAM,KAAK,MAAM,KAAK,IAAI,IAAI,GAAI,IAAI;AAAA,EAElD,QAAQ;AACN,WAAO;AAAA,EACT;AACF;AAEA,eAAe,YACb,OACmC;AACnC,MAAI;AACF,UAAM,EAAE,QAAQ,IAAI,MAAM,UAAU,OAAO,MAAM;AAAA,MAC/C,QAAQ;AAAA,IACV,CAAC;AACD,WAAO,oBAAoB,OAAO,IAAI,UAAU;AAAA,EAClD,QAAQ;AACN,WAAO;AAAA,EACT;AACF;AAOA,eAAe,WACb,cACA,UACgC;AAChC,MAAI;AACF,UAAM,MAAM,MAAM,MAAM,aAAa;AAAA,MACnC,QAAQ;AAAA,MACR,SAAS,EAAE,QAAQ,yBAAyB,cAAc,QAAQ,EAAE;AAAA,IACtE,CAAC;AAED,QAAI,CAAC,IAAI,GAAI,QAAO;AAEpB,UAAM,mBAAmB,IAAI,QAAQ,aAAa;AAClD,UAAM,iBAAiB,mBAAmB,gBAAgB;AAC1D,QAAI,CAAC,eAAgB,QAAO;AAE5B,WAAO,EAAE,gBAAgB,iBAAiB;AAAA,EAC5C,QAAQ;AACN,WAAO;AAAA,EACT;AACF;AAEA,SAAS,yBACP,cACA,UACQ;AACR,QAAM,UAAU,CAAC,GAAG,oBAAoB,IAAI,YAAY,EAAE;AAC1D,MAAI,UAAU;AACZ,YAAQ,KAAK,GAAG,gBAAgB,IAAI,QAAQ,EAAE;AAAA,EAChD;AACA,SAAO,QAAQ,KAAK,IAAI;AAC1B;AAEA,SAAS,mBAAmB,kBAA2C;AACrE,aAAW,UAAU,kBAAkB;AACrC,UAAM,QAAQ,OAAO,MAAM,IAAI,OAAO,IAAI,mBAAmB,UAAU,CAAC;AACxE,QAAI,MAAO,QAAO,MAAM,CAAC;AAAA,EAC3B;AACA,SAAO;AACT;AAEA,SAAS,aAAa,UAAkB,aAAgC;AACtE,SAAO,YAAY,KAAK,CAAC,MAAM;AAC7B,QAAI,EAAE,SAAS,GAAG,GAAG;AACnB,aAAO,SAAS,WAAW,EAAE,MAAM,GAAG,EAAE,CAAC;AAAA,IAC3C;AACA,WAAO,aAAa;AAAA,EACtB,CAAC;AACH;AAEA,SAAS,gBACP,SACA,kBACc;AACd,QAAM,cAAc,wBAAwB,SAAS,gBAAgB;AACrE,MAAI,aAAa;AACf,UAAM,MAAM,GAAG,SAAS,iBAAiB,mBAAmB,WAAW,CAAC;AACxE,WAAO,aAAa,SAAS,IAAI,IAAI,KAAK,QAAQ,GAAG,CAAC;AAAA,EACxD;AACA,SAAO,aAAa,SAAS,IAAI,IAAI,KAAK,QAAQ,GAAG,CAAC;AACxD;AAEA,SAAS,qBACP,SACA,uBACc;AACd,QAAM,cAAc,wBAAwB,SAAS,qBAAqB;AAC1E,MAAI,aAAa;AACf,WAAO,aAAa,SAAS,IAAI,IAAI,aAAa,QAAQ,GAAG,CAAC;AAAA,EAChE;AACA,QAAM,WAAW,IAAI,IAAI,GAAG,eAAe,QAAQ;AACnD,WAAS,aAAa,IAAI,QAAQ,iBAAiB,SAAS;AAC5D,WAAS,aAAa,IAAI,QAAQ,QAAQ,GAAG;AAC7C,SAAO,aAAa,SAAS,QAAQ;AACvC;AAEA,SAAS,wBACP,SACA,kBACoB;AACpB,MAAI,OAAO,qBAAqB,YAAY;AAC1C,WAAO,iBAAiB,OAAO;AAAA,EACjC;AACA,SAAO;AACT;","names":[]}

package/package.json

@@ -1,6 +1,6 @@
 {
   "name": "@lemondouble/lemon-auth",
-  "version": "0.7.0",
+  "version": "0.7.1",
   "repository": {
     "type": "git",
     "url": "https://github.com/LemonDouble/lemon-auth"
@@ -24,6 +24,13 @@
   "files": [
     "dist"
   ],
+  "scripts": {
+    "build": "tsup",
+    "dev": "tsup --watch",
+    "typecheck": "tsc --noEmit",
+    "prepublishOnly": "pnpm run build"
+  },
+  "packageManager": "pnpm@10.25.0",
   "peerDependencies": {
     "next": ">=16.0.0",
     "react": ">=19.0.0"
@@ -44,10 +51,5 @@
     "@types/react": "^19.2.14",
     "tsup": "^8.5.1",
     "typescript": "^6.0.3"
-  },
-  "scripts": {
-    "build": "tsup",
-    "dev": "tsup --watch",
-    "typecheck": "tsc --noEmit"
   }
-}
+}