@lemondouble/lemon-auth 0.7.2 → 0.8.0

package/README.md

@@ -23,7 +23,7 @@ NEXT_PUBLIC_LEMON_AUTH_MOCK_USER='{"uid":"local-user","nickname":"Local User","p
 Mock User가 활성화되면:
 
 - `getUser()`, `getSession()`, `requireAuth()`, `requireClient()`는 mock user를 로그인 유저처럼 반환합니다.
-- `createAuthProxy()`는 mock user를 인증 성공으로 처리하고, `clientId` 승인 체크는 유지합니다.
+- `createAuthProxy()`는 모든 요청을 통과시킵니다. 승인 체크는 DAL에서 수행됩니다.
 - `loginUrl(redirectUrl)`은 `redirectUrl`을 그대로 반환합니다.
 - `profileUrl(redirectUrl?)`은 `redirectUrl ?? "/"`를 반환합니다.
 - `refreshToken()`은 `true`, `logout()`은 no-op 후 `true`를 반환합니다.
@@ -34,7 +34,7 @@ Mock User가 활성화되면:
 |------|------|------|
 | `@lemondouble/lemon-auth/server` | Server Components, Route Handlers, Server Actions | JWT 검증, 유저 조회, 인증 체크 |
 | `@lemondouble/lemon-auth/client` | Client Components | AuthProvider, useAuth 훅, URL 헬퍼 |
-| `@lemondouble/lemon-auth/proxy` | proxy.ts | 토큰 자동 갱신 프록시 |
+| `@lemondouble/lemon-auth/proxy` | proxy.ts | 쿠키 기반 optimistic check |
 
 ---
 
@@ -237,7 +237,20 @@ import {
 
 ## Proxy — `@lemondouble/lemon-auth/proxy`
 
-Next.js 16의 `proxy.ts`에서 사용합니다. 보호 경로 접근 시 JWT 검증 + 만료 임박 토큰 자동 갱신을 처리합니다.
+Next.js 16의 `proxy.ts`에서 사용합니다. **쿠키만 읽는 optimistic check** 만 합니다.
+
+> **0.8.0 에서 동작이 바뀌었습니다.** 프록시는 더 이상 토큰을 갱신하지 않고
+> JWT 서명도 검증하지 않습니다. 갱신은 `<SessionRestore />`(브라우저)가 맡고,
+> 진짜 검증은 DAL(`getSession` / `requireClient`)이 합니다. 마이그레이션은
+> [0.7.x → 0.8.0](#07x--080-마이그레이션) 참고.
+
+Next.js 공식 인증 가이드의 권장 구조를 그대로 따릅니다.
+
+> since Proxy runs on every route, including prefetched routes, it's important to
+> only read the session from the cookie (optimistic checks), and avoid database
+> checks to prevent performance issues.
+>
+> — [Next.js — Authentication](https://nextjs.org/docs/app/guides/authentication)
 
 ### `createAuthProxy(options?)`
 
@@ -246,11 +259,9 @@ Next.js 16의 `proxy.ts`에서 사용합니다. 보호 경로 접근 시 JWT 검
 import { createAuthProxy } from "@lemondouble/lemon-auth/proxy";
 
 export default createAuthProxy({
-  publicPaths: ["/", "/about", "/api/public/*"],
+  publicPaths: ["/", "/about", "/api/public/*", "/auth/restore"],
   bypassPaths: ["/workbox-*"],
-  clientId: process.env.CLIENT_ID,
   loginRedirectUrl: (request) => request.url,
-  unapprovedRedirectUrl: "/pending-approval",
 });
 
 export const config = {
@@ -266,26 +277,33 @@ export const config = {
 |------|------|--------|------|
 | `publicPaths` | `string[]` | `[]` | 인증 없이 접근 가능한 경로. `*`로 끝나면 prefix 매칭 (예: `"/api/public/*"`) |
 | `bypassPaths` | `string[]` | `[]` | proxy가 refresh도 하지 않고 바로 통과시킬 추가 경로. 기본 PWA 경로(`/sw.js`, `/manifest.webmanifest` 등)는 항상 bypass |
-| `apiPaths` | `string[]` | `["/api/*"]` | 보호 API 경로. 인증 실패 시 redirect 대신 JSON 응답을 반환한다. disable하려면 `[]` |
-| `clientId` | `string` | `undefined` | 설정 시 `approved_clients`에 포함 여부를 체크 |
+| `apiPaths` | `string[]` | `["/api/*"]` | 보호 API 경로. 인증 실패 시 redirect 대신 401 JSON을 반환한다. disable하려면 `[]` |
 | `loginRedirectUrl` | `string \| (request: NextRequest) => string` | `undefined` | 미인증 시 Google 로그인 후 돌아올 URL. deep link 보존이 필요하면 `(request) => request.url` 사용. 미설정 시 `"/"` 로 redirect |
-| `unapprovedRedirectUrl` | `string \| (request: NextRequest) => string` | `undefined` | 로그인은 됐지만 `clientId` 미승인일 때 redirect할 URL. 미설정 시 auth-server `/error?code=FORBIDDEN`로 redirect (무한 loop 방지) |
-| `onAuthSuccess` | `(claims, request, response) => Promise<NextResponse> \| NextResponse` | `undefined` | 보호 경로에서 인증 성공 시 호출되는 콜백. DB 동기화, 헤더 주입 등 앱별 로직에 사용 |
+| `restorePath` | `string` | `"/auth/restore"` | `<SessionRestore />` 를 마운트한 경로. **`publicPaths` 에도 넣어야 한다** (안 넣으면 무한 루프) |
 
 #### 동작 방식
 
 **Bypass 경로** (기본 PWA/정적 리소스 + `bypassPaths`):
 
-1. `/sw.js`, `/manifest.webmanifest`, `/manifest.json`, `/favicon.ico` 등은 인증/갱신 없이 항상 통과
+1. `/sw.js`, `/manifest.webmanifest`, `/favicon.ico` 등은 항상 통과
 2. 가능하면 `matcher`에서도 제외해 proxy 실행 자체를 피하는 것을 권장
 
+**프리페치 요청**: 다른 요청과 똑같이 처리합니다. 통과시키면 만료된 토큰으로
+페이지가 렌더되고 거기서 나온 redirect 가 라우터 캐시에 굳어, 어느 링크를 눌러도
+같은 곳으로 튀게 됩니다. 반면 프록시가 돌려주는 `restorePath` 리다이렉트는 굳어도
+해가 없습니다 — 복구 경로는 막다른 길이 아니라 세션을 되살리고 `next` 로
+되돌려 보내므로 목적지도 보존됩니다.
+
 **보호 경로** (`publicPaths`에 해당하지 않는 경로):
 
-1. `lemon_access_token` 쿠키가 있고 만료까지 60초 이상 남았으면 → JWKS 검증 → `onAuthSuccess` 호출 → 통과
-2. 로그인은 됐지만 `clientId` 미승인이면 `unapprovedRedirectUrl`로 redirect
-3. 만료 임박이거나 검증 실패 시 `lemon_refresh_token` + `device_id`로 자동 갱신 시도
-4. 갱신 성공 → 새 토큰 쿠키 설정 → `onAuthSuccess` 호출 → 통과
-5. 갱신 실패 → `loginRedirectUrl`을 `redirect_url`로 담아 로그인 페이지로 redirect
+1. `lemon_access_token` 이 있고 만료까지 60초 이상 남았으면 → 통과
+2. 아니고 `apiPaths` 에 해당하면 → `401 { code: "UNAUTHORIZED" }`
+3. 아니고 `lemon_refresh_token` 이 있으면 → `restorePath?next=<원래 경로>` 로 redirect
+4. 둘 다 없으면 → `loginRedirectUrl` 을 담아 로그인 페이지로 redirect
+
+`exp` 만 보고 **서명은 검증하지 않습니다.** 위조 토큰으로 이 검사는 통과할 수
+있으나 DAL 에서 걸립니다. 프록시의 판단은 "어느 화면으로 보낼까" 이지
+"권한이 있는가" 가 아닙니다. 권한 판단은 반드시 DAL 에서 하십시오.
 
 `loginRedirectUrl`은 고정 URL 문자열과 요청별 resolver 함수를 모두 지원합니다.
 
@@ -301,10 +319,55 @@ createAuthProxy({
 });
 ```
 
-**공개 경로** (`publicPaths`에 해당하는 경로):
+**공개 경로** (`publicPaths`에 해당하는 경로): 아무 판단 없이 통과합니다.
+만료된 세션은 루트 레이아웃의 `<AutoTokenRefresh />` 가 복구합니다.
+
+### 0.7.x → 0.8.0 마이그레이션
+
+프록시가 갱신을 하지 않게 되면서, 앱이 복구 경로를 마운트해야 합니다.
+
+**1. `<SessionRestore />` 를 마운트하고 `publicPaths` 에 추가**
 
-1. 토큰이 만료 임박이면 백그라운드로 갱신 (실패해도 통과)
-2. 인증 여부와 무관하게 항상 통과
+```tsx
+// app/auth/restore/page.tsx
+import { Suspense } from "react";
+import { SessionRestore } from "@lemondouble/lemon-auth/client";
+
+export const dynamic = "force-dynamic";
+
+export default function RestorePage() {
+  return (
+    <Suspense fallback={null}>
+      <SessionRestore fallback={<p>세션 복원 중...</p>} />
+    </Suspense>
+  );
+}
+```
+
+```ts
+// proxy.ts
+publicPaths: ["/", "/auth/restore", ...],
+```
+
+`useSearchParams()` 를 쓰므로 `<Suspense>` 로 감싸야 빌드가 통과합니다.
+
+**2. `<AutoTokenRefresh />` 를 루트 레이아웃으로**
+
+공개 경로에서 만료된 세션을 되살리는 안전망입니다. 특정 페이지에만 두면
+그 페이지를 거치지 않는 경로에는 복구 수단이 없습니다.
+
+**3. 제거된 옵션 정리**
+
+| 제거 | 대신 |
+|---|---|
+| `clientId` | DAL 의 `getSession({ clientId })` / `requireClient(clientId)` |
+| `unapprovedRedirectUrl` | `requireClient(clientId, { unapprovedRedirectTo })` |
+| `onAuthSuccess` | DAL. **미들웨어에서 DB 를 조회하지 마십시오** (아래) |
+
+`onAuthSuccess` 는 DB 동기화를 유도하는 훅이었으나, 프록시는 프리페치를 포함해
+모든 요청에서 돌기 때문에 그 자리에서 DB 를 건드리면 안 됩니다. 사용자 동기화
+같은 작업은 DAL(`getUser()` 를 부르는 곳)로 옮기고 React `cache()` 로 요청당
+한 번만 돌게 하십시오.
 
 **API 경로** (`apiPaths` 매칭, 기본 `/api/*`):
 
@@ -426,10 +489,49 @@ export default async function RootLayout({ children }: { children: React.ReactNo
 
 | 상황 | user | AutoTokenRefresh |
 |------|------|-----------------|
-| 정상 요청 (proxy 실행됨) | 있음 | 아무것도 안 함 (skip) |
-| PWA 캐시 히트 + 갱신 시도 중 | 없음 | `fallback` 렌더 |
-| PWA 캐시 히트 + 유효한 `lemon_refresh_token` | 없음 | 갱신 → `router.refresh()` |
-| PWA 캐시 히트 + 만료된 `lemon_refresh_token` | 없음 | 갱신 실패 → `children` 렌더 |
+| 정상 요청 | 있음 | 아무것도 안 함 (skip) |
+| 공개 경로 + 갱신 시도 중 | 없음 | `fallback` 렌더 |
+| 공개 경로 + 유효한 `lemon_refresh_token` | 없음 | 갱신 → `router.refresh()` |
+| 공개 경로 + 만료된 `lemon_refresh_token` | 없음 | 갱신 실패 → `children` 렌더 |
+
+**루트 레이아웃에 두십시오.** 특정 페이지에만 두면 그 페이지를 거치지 않는
+경로에는 복구 수단이 없습니다.
+
+### `<SessionRestore>`
+
+보호 경로에서 access token 이 만료됐을 때 프록시가 보내는 착지점입니다.
+`refreshToken()` 을 부른 뒤 `next` 파라미터가 가리키는 곳으로 되돌립니다.
+
+```tsx
+// app/auth/restore/page.tsx
+import { Suspense } from "react";
+import { SessionRestore } from "@lemondouble/lemon-auth/client";
+
+export const dynamic = "force-dynamic";
+
+export default function RestorePage() {
+  return (
+    <Suspense fallback={null}>
+      <SessionRestore fallback={<p>세션 복원 중...</p>} />
+    </Suspense>
+  );
+}
+```
+
+| prop | 타입 | 필수 | 설명 |
+|------|------|------|------|
+| `fallback` | `React.ReactNode` | **필수** | 갱신하는 동안 렌더할 UI |
+| `failedRedirectUrl` | `string` | 선택 | 갱신 실패 시 보낼 곳. 기본은 로그인 |
+
+- 이 경로를 프록시의 `publicPaths` 에 **반드시** 넣으십시오. 안 넣으면 프록시가
+  복구 경로를 다시 복구 경로로 보내 무한 루프가 됩니다.
+- `useSearchParams()` 를 쓰므로 `<Suspense>` 로 감싸야 빌드가 통과합니다.
+- `next` 는 같은 출처의 경로만 허용합니다. 열린 리다이렉트가 되지 않도록
+  `//evil.com` 같은 값은 `/` 로 떨어뜨립니다.
+
+**`<AutoTokenRefresh>` 와의 차이**: `AutoTokenRefresh` 는 공개 경로에서 화면을
+막지 않고 조용히 복구하는 안전망이고, `SessionRestore` 는 보호 경로 진입이
+막혔을 때 갱신하고 원래 목적지로 되돌리는 전용 착지점입니다. 둘 다 두십시오.
 
 ### `loginUrl(redirectUrl)`
 
@@ -544,7 +646,7 @@ interface UserProfile {
 
 새 Next.js 16 프로젝트에 인증을 추가하는 권장 예시입니다.
 
-### 1. proxy.ts — 토큰 자동 갱신
+### 1. proxy.ts — optimistic check
 
 ```ts
 import {
@@ -553,12 +655,16 @@ import {
 } from "@lemondouble/lemon-auth/proxy";
 
 export default createAuthProxy({
-  publicPaths: ["/", "/login", "/pending-approval", "/api/public/*"],
+  publicPaths: [
+    "/",
+    "/login",
+    "/pending-approval",
+    "/auth/restore",
+    "/api/public/*",
+  ],
   bypassPaths: ["/workbox-*"],
   apiPaths: DEFAULT_API_PATHS,
-  clientId: process.env.CLIENT_ID,
   loginRedirectUrl: (request) => request.url,
-  unapprovedRedirectUrl: "/pending-approval",
 });
 
 export const config = {
@@ -569,35 +675,48 @@ export const config = {
 ```
 
 `loginRedirectUrl: (request) => request.url`은 로그인 후 사용자가 원래 요청한 path/query로 돌아오게 합니다.
-`apiPaths`에 매칭되는 보호 API는 인증 실패 시 redirect 대신 `401/403` JSON 응답을 반환합니다.
+`apiPaths`에 매칭되는 보호 API는 인증 실패 시 redirect 대신 `401` JSON 응답을 반환합니다.
 기본 PWA 파일(`/sw.js`, `/manifest.webmanifest` 등)은 항상 bypass되며, 앱에서 추가로 생성하는 workbox 파일은 `bypassPaths`에 넣을 수 있습니다.
 
-`onAuthSuccess`를 사용하면 인증 성공 후 DB 동기화, 헤더 주입 등 앱별 로직을 끼워넣을 수 있습니다:
+**`/auth/restore` 를 `publicPaths` 에 넣는 것을 빠뜨리지 마십시오.** 프록시가
+복구 경로 자신을 다시 복구 경로로 보내 무한 루프가 됩니다.
+
+사용자 DB 동기화 같은 작업은 **프록시가 아니라 DAL 에서** 하십시오. 프록시는
+프리페치를 포함해 모든 요청에서 돌기 때문에, 그 자리에서 DB 를 건드리면 화면
+하나 여는 데 쿼리가 여러 번 나갑니다.
 
 ```ts
-import {
-  createAuthProxy,
-  DEFAULT_API_PATHS,
-} from "@lemondouble/lemon-auth/proxy";
+// lib/dal.ts
+import { cache } from "react";
+import { getUser } from "@lemondouble/lemon-auth/server";
 import { upsertUser } from "@/lib/db";
 
-export default createAuthProxy({
-  publicPaths: ["/", "/login", "/pending-approval", "/api/public/*"],
-  bypassPaths: ["/workbox-*"],
-  apiPaths: DEFAULT_API_PATHS,
-  clientId: process.env.CLIENT_ID,
-  loginRedirectUrl: (request) => request.url,
-  unapprovedRedirectUrl: "/pending-approval",
-  onAuthSuccess: async (claims, request, response) => {
-    await upsertUser(claims);
-    response.headers.set("x-user-uid", claims.sub);
-    response.headers.set("x-user-nickname", encodeURIComponent(claims.nickname));
-    return response;
-  },
+export const getCurrentUser = cache(async () => {
+  const user = await getUser();
+  if (!user) return null;
+  await upsertUser(user);   // React cache() 덕에 요청당 한 번만 돈다
+  return user;
 });
 ```
 
-### 2. app/layout.tsx — AuthProvider + AutoTokenRefresh
+### 2. app/auth/restore/page.tsx — 세션 복구 착지점
+
+```tsx
+import { Suspense } from "react";
+import { SessionRestore } from "@lemondouble/lemon-auth/client";
+
+export const dynamic = "force-dynamic";
+
+export default function RestorePage() {
+  return (
+    <Suspense fallback={null}>
+      <SessionRestore fallback={<p>세션 복원 중...</p>} />
+    </Suspense>
+  );
+}
+```
+
+### 3. app/layout.tsx — AuthProvider + AutoTokenRefresh
 
 ```tsx
 import { getUser } from "@lemondouble/lemon-auth/server";
@@ -618,7 +737,7 @@ export default async function RootLayout({ children }: { children: React.ReactNo
 }
 ```
 
-### 3. app/page.tsx — 공개 페이지 (로그인 버튼)
+### 4. app/page.tsx — 공개 페이지 (로그인 버튼)
 
 ```tsx
 import { getUser } from "@lemondouble/lemon-auth/server";
@@ -642,7 +761,7 @@ export function LoginButton() {
 }
 ```
 
-### 4. app/dashboard/page.tsx — 보호 페이지
+### 5. app/dashboard/page.tsx — 보호 페이지
 
 ```tsx
 import { requireAuth } from "@lemondouble/lemon-auth/server";
@@ -653,7 +772,7 @@ export default async function Dashboard() {
 }
 ```
 
-### 5. 로그아웃
+### 6. 로그아웃
 
 ```tsx
 "use client";

package/dist/client/index.d.ts

@@ -18,9 +18,34 @@ declare function AutoTokenRefresh({ children, fallback, }: {
     fallback: React.ReactNode;
 }): string | number | bigint | boolean | react.ReactElement<unknown, string | react.JSXElementConstructor<any>> | Iterable<react.ReactNode> | Promise<string | number | bigint | boolean | react.ReactPortal | react.ReactElement<unknown, string | react.JSXElementConstructor<any>> | Iterable<react.ReactNode> | null | undefined> | null;
 
+/**
+ * 토큰을 갱신하는 유일한 주체.
+ *
+ * 프록시는 쿠키만 읽고, access 가 만료됐는데 refresh 가 남아 있으면 이 경로로
+ * 보낸다. 여기서 브라우저가 직접 갱신한 뒤 원래 가려던 곳으로 돌려보낸다.
+ *
+ * 갱신을 서버(미들웨어)가 아니라 브라우저가 하는 이유는 두 가지다.
+ *
+ *   1. 미들웨어는 요청마다 별도 인스턴스로 떠서 서로를 모른다. 프리페치가
+ *      깔리면 같은 refresh token 으로 갱신이 동시에 나가고, 회전 경쟁이 난다.
+ *      브라우저는 JS 컨텍스트가 하나라 이 문제가 없다.
+ *   2. 브라우저 요청에는 진짜 UA 와 WAF 통과 쿠키가 실린다. 서버간 fetch 는
+ *      UA 가 런타임 기본값이라 봇 방어에 걸릴 수 있다.
+ *
+ * 앱은 이 컴포넌트를 프록시의 `restorePath`(기본 `/auth/restore`)에 마운트하고,
+ * 그 경로를 `publicPaths` 에 넣어야 한다. 안 그러면 프록시가 복구 경로 자신을
+ * 다시 복구 경로로 보내 무한 루프가 된다.
+ */
+declare function SessionRestore({ fallback, failedRedirectUrl, }: {
+    /** 갱신하는 동안 보여줄 것. */
+    fallback: React.ReactNode;
+    /** 갱신 실패 시 보낼 곳. 기본은 로그인. */
+    failedRedirectUrl?: string;
+}): react.ReactNode;
+
 declare function loginUrl(redirectUrl: string): string;
 declare function profileUrl(redirectUrl?: string): string;
 declare function logout(): Promise<boolean>;
 declare function refreshToken(): Promise<boolean>;
 
-export { AuthProvider, AutoTokenRefresh, LemonUser, loginUrl, logout, profileUrl, refreshToken, useAuth };
+export { AuthProvider, AutoTokenRefresh, LemonUser, SessionRestore, loginUrl, logout, profileUrl, refreshToken, useAuth };

package/dist/client/index.js

@@ -156,9 +156,51 @@ function AutoTokenRefresh({
   if (status === "loading") return fallback ?? null;
   return children ?? null;
 }
+
+// src/client/session-restore.tsx
+import { useEffect as useEffect2, useState as useState2 } from "react";
+import { useRouter as useRouter2, useSearchParams } from "next/navigation";
+function SessionRestore({
+  fallback,
+  failedRedirectUrl
+}) {
+  const { isAuthenticated } = useAuth();
+  const router = useRouter2();
+  const searchParams = useSearchParams();
+  const [failed, setFailed] = useState2(false);
+  useEffect2(() => {
+    let ignore = false;
+    const next = safeNextPath(searchParams.get("next"));
+    if (isAuthenticated) {
+      router.replace(next);
+      return;
+    }
+    refreshToken().then((ok) => {
+      if (ignore) return;
+      if (ok) {
+        router.replace(next);
+        return;
+      }
+      setFailed(true);
+      window.location.href = failedRedirectUrl ?? loginUrl(window.location.origin);
+    });
+    return () => {
+      ignore = true;
+    };
+  }, [isAuthenticated, router, searchParams, failedRedirectUrl]);
+  if (failed) return null;
+  return fallback;
+}
+function safeNextPath(next) {
+  if (!next) return "/";
+  if (!next.startsWith("/")) return "/";
+  if (next.startsWith("//")) return "/";
+  return next;
+}
 export {
   AuthProvider,
   AutoTokenRefresh,
+  SessionRestore,
   loginUrl,
   logout,
   profileUrl,

package/dist/client/index.js.map

@@ -1 +1 @@
-{"version":3,"sources":["../../src/client/context.tsx","../../src/client/auto-token-refresh.tsx","../../src/client/url.ts"],"sourcesContent":["\"use client\";\n\nimport { createContext, useContext } from \"react\";\nimport type { LemonUser } from \"../types.js\";\n\ninterface AuthContextValue {\n  user: LemonUser | null;\n  isAuthenticated: boolean;\n}\n\nconst AuthContext = createContext<AuthContextValue>({\n  user: null,\n  isAuthenticated: false,\n});\n\nexport function AuthProvider({\n  user,\n  children,\n}: {\n  user: LemonUser | null;\n  children: React.ReactNode;\n}) {\n  return (\n    <AuthContext value={{ user, isAuthenticated: user !== null }}>\n      {children}\n    </AuthContext>\n  );\n}\n\nexport function useAuth(): AuthContextValue {\n  return useContext(AuthContext);\n}\n","\"use client\";\n\nimport { useEffect, useState } from \"react\";\nimport { useRouter } from \"next/navigation\";\nimport { useAuth } from \"./context.js\";\nimport { refreshToken } from \"./url.js\";\n\nexport function AutoTokenRefresh({\n  children,\n  fallback,\n}: {\n  children?: React.ReactNode;\n  fallback: React.ReactNode;\n}) {\n  const { isAuthenticated } = useAuth();\n  const router = useRouter();\n  const [status, setStatus] = useState<\"loading\" | \"failed\">(\"loading\");\n\n  useEffect(() => {\n    if (isAuthenticated) return;\n\n    let ignore = false;\n\n    refreshToken().then((ok) => {\n      if (ignore) return;\n      if (ok) {\n        router.refresh();\n      } else {\n        setStatus(\"failed\");\n      }\n    });\n\n    return () => {\n      ignore = true;\n    };\n  }, [isAuthenticated, router]);\n\n  if (isAuthenticated) return null;\n  if (status === \"loading\") return fallback ?? null;\n  return children ?? null;\n}\n","import {\n  ACCESS_TOKEN_COOKIE,\n  DEVICE_ID_COOKIE,\n  LOGIN_URL,\n  LOGOUT_URL,\n  PROFILE_PAGE_URL,\n  REFRESH_URL,\n  REFRESH_TOKEN_COOKIE,\n} from \"../constants.js\";\nimport { isMockAuthEnabled } from \"../mock.js\";\n\nconst LOGOUT_COOKIE_NAMES = [\n  ACCESS_TOKEN_COOKIE,\n  REFRESH_TOKEN_COOKIE,\n  DEVICE_ID_COOKIE,\n];\n\nexport function loginUrl(redirectUrl: string): string {\n  if (isMockAuthEnabled()) return redirectUrl;\n  assertValidLoginRedirectUrl(redirectUrl);\n  return `${LOGIN_URL}?redirect_url=${encodeURIComponent(redirectUrl)}`;\n}\n\nexport function profileUrl(redirectUrl?: string): string {\n  if (isMockAuthEnabled()) return redirectUrl ?? \"/\";\n  if (redirectUrl) {\n    return `${PROFILE_PAGE_URL}?redirect_url=${encodeURIComponent(redirectUrl)}`;\n  }\n  return PROFILE_PAGE_URL;\n}\n\nexport async function logout(): Promise<boolean> {\n  if (isMockAuthEnabled()) {\n    expireAuthCookies();\n    return true;\n  }\n\n  try {\n    const res = await fetch(LOGOUT_URL, {\n      method: \"POST\",\n      credentials: \"include\",\n    });\n    return res.ok;\n  } catch {\n    return false;\n  } finally {\n    expireAuthCookies();\n  }\n}\n\nexport async function refreshToken(): Promise<boolean> {\n  if (isMockAuthEnabled()) return true;\n\n  try {\n    const res = await fetch(REFRESH_URL, {\n      method: \"POST\",\n      credentials: \"include\",\n    });\n    return res.ok;\n  } catch {\n    return false;\n  }\n}\n\nfunction expireAuthCookies(): void {\n  if (typeof document === \"undefined\") return;\n\n  for (const name of LOGOUT_COOKIE_NAMES) {\n    for (const domain of getCookieDomains()) {\n      document.cookie = [\n        `${name}=`,\n        \"Max-Age=0\",\n        \"Path=/\",\n        \"SameSite=Lax\",\n        domain ? `Domain=${domain}` : \"\",\n      ]\n        .filter(Boolean)\n        .join(\"; \");\n    }\n  }\n}\n\nfunction getCookieDomains(): string[] {\n  if (typeof window === \"undefined\") return [\"\"];\n\n  const { hostname } = window.location;\n  if (!hostname || hostname === \"localhost\" || isIpAddress(hostname)) {\n    return [\"\"];\n  }\n\n  const labels = hostname.split(\".\");\n  const domains = [\"\"];\n  for (let i = 0; i < labels.length - 1; i += 1) {\n    domains.push(`.${labels.slice(i).join(\".\")}`);\n  }\n  return domains;\n}\n\nfunction isIpAddress(hostname: string): boolean {\n  return /^[\\d.]+$/.test(hostname) || hostname.includes(\":\");\n}\n\nfunction assertValidLoginRedirectUrl(redirectUrl: string): void {\n  let url: URL;\n  try {\n    url = new URL(redirectUrl);\n  } catch {\n    throw new Error(\"loginUrl redirectUrl must be a valid absolute URL\");\n  }\n\n  if (url.protocol !== \"https:\") {\n    throw new Error(\"loginUrl redirectUrl must use https\");\n  }\n\n  if (!isAllowedLoginRedirectHost(url.hostname)) {\n    throw new Error(\n      \"loginUrl redirectUrl host must be lemondouble.com or a subdomain of lemondouble.com\"\n    );\n  }\n}\n\nfunction isAllowedLoginRedirectHost(hostname: string): boolean {\n  const normalized = hostname.toLowerCase();\n  return (\n    normalized === \"lemondouble.com\" ||\n    normalized.endsWith(\".lemondouble.com\")\n  );\n}\n"],"mappings":";;;;;;;;;;;;AAEA,SAAS,eAAe,kBAAkB;AAqBtC;AAbJ,IAAM,cAAc,cAAgC;AAAA,EAClD,MAAM;AAAA,EACN,iBAAiB;AACnB,CAAC;AAEM,SAAS,aAAa;AAAA,EAC3B;AAAA,EACA;AACF,GAGG;AACD,SACE,oBAAC,eAAY,OAAO,EAAE,MAAM,iBAAiB,SAAS,KAAK,GACxD,UACH;AAEJ;AAEO,SAAS,UAA4B;AAC1C,SAAO,WAAW,WAAW;AAC/B;;;AC7BA,SAAS,WAAW,gBAAgB;AACpC,SAAS,iBAAiB;;;ACQ1B,IAAM,sBAAsB;AAAA,EAC1B;AAAA,EACA;AAAA,EACA;AACF;AAEO,SAAS,SAAS,aAA6B;AACpD,MAAI,kBAAkB,EAAG,QAAO;AAChC,8BAA4B,WAAW;AACvC,SAAO,GAAG,SAAS,iBAAiB,mBAAmB,WAAW,CAAC;AACrE;AAEO,SAAS,WAAW,aAA8B;AACvD,MAAI,kBAAkB,EAAG,QAAO,eAAe;AAC/C,MAAI,aAAa;AACf,WAAO,GAAG,gBAAgB,iBAAiB,mBAAmB,WAAW,CAAC;AAAA,EAC5E;AACA,SAAO;AACT;AAEA,eAAsB,SAA2B;AAC/C,MAAI,kBAAkB,GAAG;AACvB,sBAAkB;AAClB,WAAO;AAAA,EACT;AAEA,MAAI;AACF,UAAM,MAAM,MAAM,MAAM,YAAY;AAAA,MAClC,QAAQ;AAAA,MACR,aAAa;AAAA,IACf,CAAC;AACD,WAAO,IAAI;AAAA,EACb,QAAQ;AACN,WAAO;AAAA,EACT,UAAE;AACA,sBAAkB;AAAA,EACpB;AACF;AAEA,eAAsB,eAAiC;AACrD,MAAI,kBAAkB,EAAG,QAAO;AAEhC,MAAI;AACF,UAAM,MAAM,MAAM,MAAM,aAAa;AAAA,MACnC,QAAQ;AAAA,MACR,aAAa;AAAA,IACf,CAAC;AACD,WAAO,IAAI;AAAA,EACb,QAAQ;AACN,WAAO;AAAA,EACT;AACF;AAEA,SAAS,oBAA0B;AACjC,MAAI,OAAO,aAAa,YAAa;AAErC,aAAW,QAAQ,qBAAqB;AACtC,eAAW,UAAU,iBAAiB,GAAG;AACvC,eAAS,SAAS;AAAA,QAChB,GAAG,IAAI;AAAA,QACP;AAAA,QACA;AAAA,QACA;AAAA,QACA,SAAS,UAAU,MAAM,KAAK;AAAA,MAChC,EACG,OAAO,OAAO,EACd,KAAK,IAAI;AAAA,IACd;AAAA,EACF;AACF;AAEA,SAAS,mBAA6B;AACpC,MAAI,OAAO,WAAW,YAAa,QAAO,CAAC,EAAE;AAE7C,QAAM,EAAE,SAAS,IAAI,OAAO;AAC5B,MAAI,CAAC,YAAY,aAAa,eAAe,YAAY,QAAQ,GAAG;AAClE,WAAO,CAAC,EAAE;AAAA,EACZ;AAEA,QAAM,SAAS,SAAS,MAAM,GAAG;AACjC,QAAM,UAAU,CAAC,EAAE;AACnB,WAAS,IAAI,GAAG,IAAI,OAAO,SAAS,GAAG,KAAK,GAAG;AAC7C,YAAQ,KAAK,IAAI,OAAO,MAAM,CAAC,EAAE,KAAK,GAAG,CAAC,EAAE;AAAA,EAC9C;AACA,SAAO;AACT;AAEA,SAAS,YAAY,UAA2B;AAC9C,SAAO,WAAW,KAAK,QAAQ,KAAK,SAAS,SAAS,GAAG;AAC3D;AAEA,SAAS,4BAA4B,aAA2B;AAC9D,MAAI;AACJ,MAAI;AACF,UAAM,IAAI,IAAI,WAAW;AAAA,EAC3B,QAAQ;AACN,UAAM,IAAI,MAAM,mDAAmD;AAAA,EACrE;AAEA,MAAI,IAAI,aAAa,UAAU;AAC7B,UAAM,IAAI,MAAM,qCAAqC;AAAA,EACvD;AAEA,MAAI,CAAC,2BAA2B,IAAI,QAAQ,GAAG;AAC7C,UAAM,IAAI;AAAA,MACR;AAAA,IACF;AAAA,EACF;AACF;AAEA,SAAS,2BAA2B,UAA2B;AAC7D,QAAM,aAAa,SAAS,YAAY;AACxC,SACE,eAAe,qBACf,WAAW,SAAS,kBAAkB;AAE1C;;;ADxHO,SAAS,iBAAiB;AAAA,EAC/B;AAAA,EACA;AACF,GAGG;AACD,QAAM,EAAE,gBAAgB,IAAI,QAAQ;AACpC,QAAM,SAAS,UAAU;AACzB,QAAM,CAAC,QAAQ,SAAS,IAAI,SAA+B,SAAS;AAEpE,YAAU,MAAM;AACd,QAAI,gBAAiB;AAErB,QAAI,SAAS;AAEb,iBAAa,EAAE,KAAK,CAAC,OAAO;AAC1B,UAAI,OAAQ;AACZ,UAAI,IAAI;AACN,eAAO,QAAQ;AAAA,MACjB,OAAO;AACL,kBAAU,QAAQ;AAAA,MACpB;AAAA,IACF,CAAC;AAED,WAAO,MAAM;AACX,eAAS;AAAA,IACX;AAAA,EACF,GAAG,CAAC,iBAAiB,MAAM,CAAC;AAE5B,MAAI,gBAAiB,QAAO;AAC5B,MAAI,WAAW,UAAW,QAAO,YAAY;AAC7C,SAAO,YAAY;AACrB;","names":[]}
+{"version":3,"sources":["../../src/client/context.tsx","../../src/client/auto-token-refresh.tsx","../../src/client/url.ts","../../src/client/session-restore.tsx"],"sourcesContent":["\"use client\";\n\nimport { createContext, useContext } from \"react\";\nimport type { LemonUser } from \"../types.js\";\n\ninterface AuthContextValue {\n  user: LemonUser | null;\n  isAuthenticated: boolean;\n}\n\nconst AuthContext = createContext<AuthContextValue>({\n  user: null,\n  isAuthenticated: false,\n});\n\nexport function AuthProvider({\n  user,\n  children,\n}: {\n  user: LemonUser | null;\n  children: React.ReactNode;\n}) {\n  return (\n    <AuthContext value={{ user, isAuthenticated: user !== null }}>\n      {children}\n    </AuthContext>\n  );\n}\n\nexport function useAuth(): AuthContextValue {\n  return useContext(AuthContext);\n}\n","\"use client\";\n\nimport { useEffect, useState } from \"react\";\nimport { useRouter } from \"next/navigation\";\nimport { useAuth } from \"./context.js\";\nimport { refreshToken } from \"./url.js\";\n\nexport function AutoTokenRefresh({\n  children,\n  fallback,\n}: {\n  children?: React.ReactNode;\n  fallback: React.ReactNode;\n}) {\n  const { isAuthenticated } = useAuth();\n  const router = useRouter();\n  const [status, setStatus] = useState<\"loading\" | \"failed\">(\"loading\");\n\n  useEffect(() => {\n    if (isAuthenticated) return;\n\n    let ignore = false;\n\n    refreshToken().then((ok) => {\n      if (ignore) return;\n      if (ok) {\n        router.refresh();\n      } else {\n        setStatus(\"failed\");\n      }\n    });\n\n    return () => {\n      ignore = true;\n    };\n  }, [isAuthenticated, router]);\n\n  if (isAuthenticated) return null;\n  if (status === \"loading\") return fallback ?? null;\n  return children ?? null;\n}\n","import {\n  ACCESS_TOKEN_COOKIE,\n  DEVICE_ID_COOKIE,\n  LOGIN_URL,\n  LOGOUT_URL,\n  PROFILE_PAGE_URL,\n  REFRESH_URL,\n  REFRESH_TOKEN_COOKIE,\n} from \"../constants.js\";\nimport { isMockAuthEnabled } from \"../mock.js\";\n\nconst LOGOUT_COOKIE_NAMES = [\n  ACCESS_TOKEN_COOKIE,\n  REFRESH_TOKEN_COOKIE,\n  DEVICE_ID_COOKIE,\n];\n\nexport function loginUrl(redirectUrl: string): string {\n  if (isMockAuthEnabled()) return redirectUrl;\n  assertValidLoginRedirectUrl(redirectUrl);\n  return `${LOGIN_URL}?redirect_url=${encodeURIComponent(redirectUrl)}`;\n}\n\nexport function profileUrl(redirectUrl?: string): string {\n  if (isMockAuthEnabled()) return redirectUrl ?? \"/\";\n  if (redirectUrl) {\n    return `${PROFILE_PAGE_URL}?redirect_url=${encodeURIComponent(redirectUrl)}`;\n  }\n  return PROFILE_PAGE_URL;\n}\n\nexport async function logout(): Promise<boolean> {\n  if (isMockAuthEnabled()) {\n    expireAuthCookies();\n    return true;\n  }\n\n  try {\n    const res = await fetch(LOGOUT_URL, {\n      method: \"POST\",\n      credentials: \"include\",\n    });\n    return res.ok;\n  } catch {\n    return false;\n  } finally {\n    expireAuthCookies();\n  }\n}\n\nexport async function refreshToken(): Promise<boolean> {\n  if (isMockAuthEnabled()) return true;\n\n  try {\n    const res = await fetch(REFRESH_URL, {\n      method: \"POST\",\n      credentials: \"include\",\n    });\n    return res.ok;\n  } catch {\n    return false;\n  }\n}\n\nfunction expireAuthCookies(): void {\n  if (typeof document === \"undefined\") return;\n\n  for (const name of LOGOUT_COOKIE_NAMES) {\n    for (const domain of getCookieDomains()) {\n      document.cookie = [\n        `${name}=`,\n        \"Max-Age=0\",\n        \"Path=/\",\n        \"SameSite=Lax\",\n        domain ? `Domain=${domain}` : \"\",\n      ]\n        .filter(Boolean)\n        .join(\"; \");\n    }\n  }\n}\n\nfunction getCookieDomains(): string[] {\n  if (typeof window === \"undefined\") return [\"\"];\n\n  const { hostname } = window.location;\n  if (!hostname || hostname === \"localhost\" || isIpAddress(hostname)) {\n    return [\"\"];\n  }\n\n  const labels = hostname.split(\".\");\n  const domains = [\"\"];\n  for (let i = 0; i < labels.length - 1; i += 1) {\n    domains.push(`.${labels.slice(i).join(\".\")}`);\n  }\n  return domains;\n}\n\nfunction isIpAddress(hostname: string): boolean {\n  return /^[\\d.]+$/.test(hostname) || hostname.includes(\":\");\n}\n\nfunction assertValidLoginRedirectUrl(redirectUrl: string): void {\n  let url: URL;\n  try {\n    url = new URL(redirectUrl);\n  } catch {\n    throw new Error(\"loginUrl redirectUrl must be a valid absolute URL\");\n  }\n\n  if (url.protocol !== \"https:\") {\n    throw new Error(\"loginUrl redirectUrl must use https\");\n  }\n\n  if (!isAllowedLoginRedirectHost(url.hostname)) {\n    throw new Error(\n      \"loginUrl redirectUrl host must be lemondouble.com or a subdomain of lemondouble.com\"\n    );\n  }\n}\n\nfunction isAllowedLoginRedirectHost(hostname: string): boolean {\n  const normalized = hostname.toLowerCase();\n  return (\n    normalized === \"lemondouble.com\" ||\n    normalized.endsWith(\".lemondouble.com\")\n  );\n}\n","\"use client\";\n\nimport { useEffect, useState } from \"react\";\nimport { useRouter, useSearchParams } from \"next/navigation\";\nimport { useAuth } from \"./context.js\";\nimport { loginUrl, refreshToken } from \"./url.js\";\n\n/**\n * 토큰을 갱신하는 유일한 주체.\n *\n * 프록시는 쿠키만 읽고, access 가 만료됐는데 refresh 가 남아 있으면 이 경로로\n * 보낸다. 여기서 브라우저가 직접 갱신한 뒤 원래 가려던 곳으로 돌려보낸다.\n *\n * 갱신을 서버(미들웨어)가 아니라 브라우저가 하는 이유는 두 가지다.\n *\n *   1. 미들웨어는 요청마다 별도 인스턴스로 떠서 서로를 모른다. 프리페치가\n *      깔리면 같은 refresh token 으로 갱신이 동시에 나가고, 회전 경쟁이 난다.\n *      브라우저는 JS 컨텍스트가 하나라 이 문제가 없다.\n *   2. 브라우저 요청에는 진짜 UA 와 WAF 통과 쿠키가 실린다. 서버간 fetch 는\n *      UA 가 런타임 기본값이라 봇 방어에 걸릴 수 있다.\n *\n * 앱은 이 컴포넌트를 프록시의 `restorePath`(기본 `/auth/restore`)에 마운트하고,\n * 그 경로를 `publicPaths` 에 넣어야 한다. 안 그러면 프록시가 복구 경로 자신을\n * 다시 복구 경로로 보내 무한 루프가 된다.\n */\nexport function SessionRestore({\n  fallback,\n  failedRedirectUrl,\n}: {\n  /** 갱신하는 동안 보여줄 것. */\n  fallback: React.ReactNode;\n  /** 갱신 실패 시 보낼 곳. 기본은 로그인. */\n  failedRedirectUrl?: string;\n}) {\n  const { isAuthenticated } = useAuth();\n  const router = useRouter();\n  const searchParams = useSearchParams();\n  const [failed, setFailed] = useState(false);\n\n  useEffect(() => {\n    let ignore = false;\n    const next = safeNextPath(searchParams.get(\"next\"));\n\n    // 이미 세션이 살아 있으면 갱신하지 않는다. 만료 구간에 굳은 리다이렉트를\n    // 뒤늦게 따라오는 경우가 있는데, 그때마다 토큰을 회전시키면 회전 경쟁의\n    // 빌미만 늘린다.\n    if (isAuthenticated) {\n      router.replace(next);\n      return;\n    }\n\n    refreshToken().then((ok) => {\n      if (ignore) return;\n\n      if (ok) {\n        router.replace(next);\n        return;\n      }\n\n      // 갱신이 실패했으면 refresh token 이 죽은 것이다. 다시 시도해봐야\n      // 같은 결과이므로 로그인으로 보낸다. 여기서 복구 경로로 되돌리면\n      // 무한 루프가 된다.\n      setFailed(true);\n      window.location.href =\n        failedRedirectUrl ?? loginUrl(window.location.origin);\n    });\n\n    return () => {\n      ignore = true;\n    };\n  }, [isAuthenticated, router, searchParams, failedRedirectUrl]);\n\n  if (failed) return null;\n  return fallback;\n}\n\n/**\n * next 파라미터는 사용자가 조작할 수 있으므로 열린 리다이렉트가 되지 않게\n * 같은 출처의 경로만 허용한다. `//evil.com` 은 브라우저가 프로토콜 상대\n * URL 로 읽으므로 반드시 걸러야 한다.\n */\nfunction safeNextPath(next: string | null): string {\n  if (!next) return \"/\";\n  if (!next.startsWith(\"/\")) return \"/\";\n  if (next.startsWith(\"//\")) return \"/\";\n  return next;\n}\n"],"mappings":";;;;;;;;;;;;AAEA,SAAS,eAAe,kBAAkB;AAqBtC;AAbJ,IAAM,cAAc,cAAgC;AAAA,EAClD,MAAM;AAAA,EACN,iBAAiB;AACnB,CAAC;AAEM,SAAS,aAAa;AAAA,EAC3B;AAAA,EACA;AACF,GAGG;AACD,SACE,oBAAC,eAAY,OAAO,EAAE,MAAM,iBAAiB,SAAS,KAAK,GACxD,UACH;AAEJ;AAEO,SAAS,UAA4B;AAC1C,SAAO,WAAW,WAAW;AAC/B;;;AC7BA,SAAS,WAAW,gBAAgB;AACpC,SAAS,iBAAiB;;;ACQ1B,IAAM,sBAAsB;AAAA,EAC1B;AAAA,EACA;AAAA,EACA;AACF;AAEO,SAAS,SAAS,aAA6B;AACpD,MAAI,kBAAkB,EAAG,QAAO;AAChC,8BAA4B,WAAW;AACvC,SAAO,GAAG,SAAS,iBAAiB,mBAAmB,WAAW,CAAC;AACrE;AAEO,SAAS,WAAW,aAA8B;AACvD,MAAI,kBAAkB,EAAG,QAAO,eAAe;AAC/C,MAAI,aAAa;AACf,WAAO,GAAG,gBAAgB,iBAAiB,mBAAmB,WAAW,CAAC;AAAA,EAC5E;AACA,SAAO;AACT;AAEA,eAAsB,SAA2B;AAC/C,MAAI,kBAAkB,GAAG;AACvB,sBAAkB;AAClB,WAAO;AAAA,EACT;AAEA,MAAI;AACF,UAAM,MAAM,MAAM,MAAM,YAAY;AAAA,MAClC,QAAQ;AAAA,MACR,aAAa;AAAA,IACf,CAAC;AACD,WAAO,IAAI;AAAA,EACb,QAAQ;AACN,WAAO;AAAA,EACT,UAAE;AACA,sBAAkB;AAAA,EACpB;AACF;AAEA,eAAsB,eAAiC;AACrD,MAAI,kBAAkB,EAAG,QAAO;AAEhC,MAAI;AACF,UAAM,MAAM,MAAM,MAAM,aAAa;AAAA,MACnC,QAAQ;AAAA,MACR,aAAa;AAAA,IACf,CAAC;AACD,WAAO,IAAI;AAAA,EACb,QAAQ;AACN,WAAO;AAAA,EACT;AACF;AAEA,SAAS,oBAA0B;AACjC,MAAI,OAAO,aAAa,YAAa;AAErC,aAAW,QAAQ,qBAAqB;AACtC,eAAW,UAAU,iBAAiB,GAAG;AACvC,eAAS,SAAS;AAAA,QAChB,GAAG,IAAI;AAAA,QACP;AAAA,QACA;AAAA,QACA;AAAA,QACA,SAAS,UAAU,MAAM,KAAK;AAAA,MAChC,EACG,OAAO,OAAO,EACd,KAAK,IAAI;AAAA,IACd;AAAA,EACF;AACF;AAEA,SAAS,mBAA6B;AACpC,MAAI,OAAO,WAAW,YAAa,QAAO,CAAC,EAAE;AAE7C,QAAM,EAAE,SAAS,IAAI,OAAO;AAC5B,MAAI,CAAC,YAAY,aAAa,eAAe,YAAY,QAAQ,GAAG;AAClE,WAAO,CAAC,EAAE;AAAA,EACZ;AAEA,QAAM,SAAS,SAAS,MAAM,GAAG;AACjC,QAAM,UAAU,CAAC,EAAE;AACnB,WAAS,IAAI,GAAG,IAAI,OAAO,SAAS,GAAG,KAAK,GAAG;AAC7C,YAAQ,KAAK,IAAI,OAAO,MAAM,CAAC,EAAE,KAAK,GAAG,CAAC,EAAE;AAAA,EAC9C;AACA,SAAO;AACT;AAEA,SAAS,YAAY,UAA2B;AAC9C,SAAO,WAAW,KAAK,QAAQ,KAAK,SAAS,SAAS,GAAG;AAC3D;AAEA,SAAS,4BAA4B,aAA2B;AAC9D,MAAI;AACJ,MAAI;AACF,UAAM,IAAI,IAAI,WAAW;AAAA,EAC3B,QAAQ;AACN,UAAM,IAAI,MAAM,mDAAmD;AAAA,EACrE;AAEA,MAAI,IAAI,aAAa,UAAU;AAC7B,UAAM,IAAI,MAAM,qCAAqC;AAAA,EACvD;AAEA,MAAI,CAAC,2BAA2B,IAAI,QAAQ,GAAG;AAC7C,UAAM,IAAI;AAAA,MACR;AAAA,IACF;AAAA,EACF;AACF;AAEA,SAAS,2BAA2B,UAA2B;AAC7D,QAAM,aAAa,SAAS,YAAY;AACxC,SACE,eAAe,qBACf,WAAW,SAAS,kBAAkB;AAE1C;;;ADxHO,SAAS,iBAAiB;AAAA,EAC/B;AAAA,EACA;AACF,GAGG;AACD,QAAM,EAAE,gBAAgB,IAAI,QAAQ;AACpC,QAAM,SAAS,UAAU;AACzB,QAAM,CAAC,QAAQ,SAAS,IAAI,SAA+B,SAAS;AAEpE,YAAU,MAAM;AACd,QAAI,gBAAiB;AAErB,QAAI,SAAS;AAEb,iBAAa,EAAE,KAAK,CAAC,OAAO;AAC1B,UAAI,OAAQ;AACZ,UAAI,IAAI;AACN,eAAO,QAAQ;AAAA,MACjB,OAAO;AACL,kBAAU,QAAQ;AAAA,MACpB;AAAA,IACF,CAAC;AAED,WAAO,MAAM;AACX,eAAS;AAAA,IACX;AAAA,EACF,GAAG,CAAC,iBAAiB,MAAM,CAAC;AAE5B,MAAI,gBAAiB,QAAO;AAC5B,MAAI,WAAW,UAAW,QAAO,YAAY;AAC7C,SAAO,YAAY;AACrB;;;AEtCA,SAAS,aAAAA,YAAW,YAAAC,iBAAgB;AACpC,SAAS,aAAAC,YAAW,uBAAuB;AAsBpC,SAAS,eAAe;AAAA,EAC7B;AAAA,EACA;AACF,GAKG;AACD,QAAM,EAAE,gBAAgB,IAAI,QAAQ;AACpC,QAAM,SAASC,WAAU;AACzB,QAAM,eAAe,gBAAgB;AACrC,QAAM,CAAC,QAAQ,SAAS,IAAIC,UAAS,KAAK;AAE1C,EAAAC,WAAU,MAAM;AACd,QAAI,SAAS;AACb,UAAM,OAAO,aAAa,aAAa,IAAI,MAAM,CAAC;AAKlD,QAAI,iBAAiB;AACnB,aAAO,QAAQ,IAAI;AACnB;AAAA,IACF;AAEA,iBAAa,EAAE,KAAK,CAAC,OAAO;AAC1B,UAAI,OAAQ;AAEZ,UAAI,IAAI;AACN,eAAO,QAAQ,IAAI;AACnB;AAAA,MACF;AAKA,gBAAU,IAAI;AACd,aAAO,SAAS,OACd,qBAAqB,SAAS,OAAO,SAAS,MAAM;AAAA,IACxD,CAAC;AAED,WAAO,MAAM;AACX,eAAS;AAAA,IACX;AAAA,EACF,GAAG,CAAC,iBAAiB,QAAQ,cAAc,iBAAiB,CAAC;AAE7D,MAAI,OAAQ,QAAO;AACnB,SAAO;AACT;AAOA,SAAS,aAAa,MAA6B;AACjD,MAAI,CAAC,KAAM,QAAO;AAClB,MAAI,CAAC,KAAK,WAAW,GAAG,EAAG,QAAO;AAClC,MAAI,KAAK,WAAW,IAAI,EAAG,QAAO;AAClC,SAAO;AACT;","names":["useEffect","useState","useRouter","useRouter","useState","useEffect"]}

package/dist/proxy/index.d.ts

@@ -1,10 +1,9 @@
 import { NextRequest, NextResponse } from 'next/server';
-import { A as AccessTokenClaims } from '../types-B5uRY2Si.js';
-export { a as LemonUser } from '../types-B5uRY2Si.js';
-import 'jose';
 
 declare const DEFAULT_AUTH_BYPASS_PATHS: string[];
 declare const DEFAULT_API_PATHS: string[];
+/** 앱이 <SessionRestore /> 를 마운트해야 하는 기본 경로. */
+declare const DEFAULT_RESTORE_PATH = "/auth/restore";
 declare const PROXY_AUTH_ERROR: {
     readonly UNAUTHORIZED: "UNAUTHORIZED";
     readonly FORBIDDEN: "FORBIDDEN";
@@ -12,14 +11,16 @@ declare const PROXY_AUTH_ERROR: {
 type ProxyAuthErrorCode = (typeof PROXY_AUTH_ERROR)[keyof typeof PROXY_AUTH_ERROR];
 type LoginRedirectUrl = string | ((request: NextRequest) => string);
 interface AuthProxyOptions {
+    /** 로그인 없이 열어둘 경로. 여기서는 아무 판단도 하지 않고 통과시킨다. */
     publicPaths?: string[];
+    /** 프록시 자체를 건너뛸 경로. 정적 파일 등. */
     bypassPaths?: string[];
+    /** 리다이렉트 대신 401 JSON 을 돌려줄 경로. 기본 `/api/*`. */
     apiPaths?: string[];
-    clientId?: string;
     loginRedirectUrl?: LoginRedirectUrl;
-    unapprovedRedirectUrl?: LoginRedirectUrl;
-    onAuthSuccess?: (claims: AccessTokenClaims, request: NextRequest, response: NextResponse) => Promise<NextResponse> | NextResponse;
+    /** <SessionRestore /> 를 마운트한 경로. 기본 `/auth/restore`. */
+    restorePath?: string;
 }
 declare function createAuthProxy(options?: AuthProxyOptions): (request: NextRequest) => Promise<NextResponse>;
 
-export { AccessTokenClaims, type AuthProxyOptions, DEFAULT_API_PATHS, DEFAULT_AUTH_BYPASS_PATHS, type LoginRedirectUrl, PROXY_AUTH_ERROR, type ProxyAuthErrorCode, createAuthProxy };
+export { type AuthProxyOptions, DEFAULT_API_PATHS, DEFAULT_AUTH_BYPASS_PATHS, DEFAULT_RESTORE_PATH, type LoginRedirectUrl, PROXY_AUTH_ERROR, type ProxyAuthErrorCode, createAuthProxy };

package/dist/proxy/index.js

@@ -1,23 +1,12 @@
-import {
-  errorCode,
-  isAccessTokenClaims,
-  isApprovedClient,
-  warnAuth
-} from "../chunk-K4U4PHX6.js";
 import {
   ACCESS_TOKEN_COOKIE,
-  AUTH_SERVER_URL,
-  DEVICE_ID_COOKIE,
-  JWKS_URL,
   LOGIN_URL,
   REFRESH_TOKEN_COOKIE,
-  REFRESH_URL,
-  getMockAccessTokenClaims
+  isMockAuthEnabled
 } from "../chunk-OX5MDVSR.js";
 
 // src/proxy/index.ts
 import { NextResponse } from "next/server";
-import { createRemoteJWKSet, jwtVerify } from "jose";
 var REFRESH_BUFFER_SECONDS = 60;
 var DEFAULT_AUTH_BYPASS_PATHS = [
   "/sw.js",
@@ -34,144 +23,49 @@ var DEFAULT_AUTH_BYPASS_PATHS = [
   "/icons/*"
 ];
 var DEFAULT_API_PATHS = ["/api/*"];
+var DEFAULT_RESTORE_PATH = "/auth/restore";
 var PROXY_AUTH_ERROR = {
   UNAUTHORIZED: "UNAUTHORIZED",
   FORBIDDEN: "FORBIDDEN"
 };
-var jwks = createRemoteJWKSet(new URL(JWKS_URL));
 function createAuthProxy(options = {}) {
   const {
     publicPaths = [],
     bypassPaths = [],
     apiPaths = DEFAULT_API_PATHS,
-    clientId,
     loginRedirectUrl,
-    unapprovedRedirectUrl,
-    onAuthSuccess
+    restorePath = DEFAULT_RESTORE_PATH
   } = options;
-  const effectiveBypassPaths = [
-    ...DEFAULT_AUTH_BYPASS_PATHS,
-    ...bypassPaths
-  ];
+  const effectiveBypassPaths = [...DEFAULT_AUTH_BYPASS_PATHS, ...bypassPaths];
   return async function proxy(request) {
     const { pathname } = request.nextUrl;
     if (isPublicPath(pathname, effectiveBypassPaths)) {
       return NextResponse.next();
     }
     if (isPublicPath(pathname, publicPaths)) {
-      return maybeRefreshAndContinue(request);
+      return NextResponse.next();
     }
-    const isApiRequest = isPublicPath(pathname, apiPaths);
-    const mockClaims = getMockAccessTokenClaims();
-    if (mockClaims) {
-      return handleVerifiedClaims(
-        mockClaims,
-        request,
-        isApiRequest,
-        clientId,
-        unapprovedRedirectUrl,
-        onAuthSuccess,
-        NextResponse.next()
-      );
+    if (isMockAuthEnabled()) {
+      return NextResponse.next();
     }
     const accessToken = request.cookies.get(ACCESS_TOKEN_COOKIE)?.value;
-    const refreshToken = request.cookies.get(REFRESH_TOKEN_COOKIE)?.value;
-    const deviceId = request.cookies.get(DEVICE_ID_COOKIE)?.value;
     if (accessToken && isTokenFresh(accessToken)) {
-      const claims = await verifyToken(accessToken);
-      if (claims) {
-        return handleVerifiedClaims(
-          claims,
-          request,
-          isApiRequest,
-          clientId,
-          unapprovedRedirectUrl,
-          onAuthSuccess,
-          NextResponse.next()
-        );
-      }
+      return NextResponse.next();
     }
-    if (refreshToken) {
-      const result = await tryRefresh(refreshToken, deviceId);
-      if (result) {
-        const claims = await verifyToken(result.newAccessToken);
-        if (claims) {
-          const response = nextWithRefreshedCookies(
-            request,
-            result.setCookieHeaders
-          );
-          return handleVerifiedClaims(
-            claims,
-            request,
-            isApiRequest,
-            clientId,
-            unapprovedRedirectUrl,
-            onAuthSuccess,
-            response
-          );
-        }
-      }
+    const isApiRequest = isPublicPath(pathname, apiPaths);
+    if (isApiRequest) {
+      return NextResponse.json(
+        { code: PROXY_AUTH_ERROR.UNAUTHORIZED },
+        { status: 401 }
+      );
     }
-    return isApiRequest ? unauthorizedJson() : redirectToLogin(request, loginRedirectUrl);
-  };
-}
-async function handleVerifiedClaims(claims, request, isApiRequest, clientId, unapprovedRedirectUrl, onAuthSuccess, response) {
-  if (!isApprovedClient(claims.approved_clients, clientId)) {
-    return isApiRequest ? forbiddenJson() : redirectToUnapproved(request, unapprovedRedirectUrl);
-  }
-  return onAuthSuccess ? await onAuthSuccess(claims, request, response) : response;
-}
-function unauthorizedJson() {
-  return NextResponse.json(
-    { code: PROXY_AUTH_ERROR.UNAUTHORIZED },
-    { status: 401 }
-  );
-}
-function forbiddenJson() {
-  return NextResponse.json(
-    { code: PROXY_AUTH_ERROR.FORBIDDEN },
-    { status: 403 }
-  );
-}
-async function maybeRefreshAndContinue(request) {
-  const accessToken = request.cookies.get(ACCESS_TOKEN_COOKIE)?.value;
-  const refreshToken = request.cookies.get(REFRESH_TOKEN_COOKIE)?.value;
-  const deviceId = request.cookies.get(DEVICE_ID_COOKIE)?.value;
-  if (accessToken && isTokenFresh(accessToken)) {
-    return NextResponse.next();
-  }
-  if (refreshToken) {
-    const result = await tryRefresh(refreshToken, deviceId);
-    if (result) {
-      return nextWithRefreshedCookies(request, result.setCookieHeaders);
+    if (request.cookies.get(REFRESH_TOKEN_COOKIE)?.value) {
+      const restore = new URL(restorePath, request.url);
+      restore.searchParams.set("next", pathname + request.nextUrl.search);
+      return NextResponse.redirect(restore);
     }
-    warnAuth("refresh failed on public path, continuing anonymously", {
-      path: request.nextUrl.pathname
-    });
-  }
-  return NextResponse.next();
-}
-function nextWithRefreshedCookies(request, setCookieHeaders) {
-  const merged = /* @__PURE__ */ new Map();
-  for (const { name, value } of request.cookies.getAll()) {
-    merged.set(name, value);
-  }
-  for (const header of setCookieHeaders) {
-    const pair = header.split(";")[0] ?? "";
-    const separator = pair.indexOf("=");
-    if (separator <= 0) continue;
-    merged.set(pair.slice(0, separator).trim(), pair.slice(separator + 1).trim());
-  }
-  const requestHeaders = new Headers(request.headers);
-  requestHeaders.set(
-    "cookie",
-    Array.from(merged, ([name, value]) => `${name}=${value}`).join("; ")
-  );
-  const response = NextResponse.next({ request: { headers: requestHeaders } });
-  for (const header of setCookieHeaders) {
-    response.headers.append("Set-Cookie", header);
-  }
-  return response;
+    return redirectToLogin(request, loginRedirectUrl);
+  };
 }
 function isTokenFresh(token) {
   try {
@@ -185,65 +79,6 @@ function isTokenFresh(token) {
     return false;
   }
 }
-async function verifyToken(token) {
-  try {
-    const { payload } = await jwtVerify(token, jwks, {
-      issuer: AUTH_SERVER_URL
-    });
-    if (isAccessTokenClaims(payload)) return payload;
-    warnAuth("access token claims shape mismatch");
-    return null;
-  } catch (error) {
-    const code = errorCode(error);
-    if (code !== "ERR_JWT_EXPIRED") {
-      warnAuth("access token verification failed", { code });
-    }
-    return null;
-  }
-}
-async function tryRefresh(refreshToken, deviceId) {
-  try {
-    const res = await fetch(REFRESH_URL, {
-      method: "POST",
-      headers: { Cookie: buildRefreshCookieHeader(refreshToken, deviceId) }
-    });
-    if (!res.ok) {
-      warnAuth("token refresh rejected", {
-        status: res.status,
-        server: res.headers.get("server"),
-        cfRay: res.headers.get("cf-ray"),
-        cfMitigated: res.headers.get("cf-mitigated")
-      });
-      return null;
-    }
-    const setCookieHeaders = res.headers.getSetCookie();
-    const newAccessToken = extractAccessToken(setCookieHeaders);
-    if (!newAccessToken) {
-      warnAuth("refresh succeeded but no access token cookie", {
-        cookieNames: setCookieHeaders.map((h) => h.split("=")[0])
-      });
-      return null;
-    }
-    return { newAccessToken, setCookieHeaders };
-  } catch (error) {
-    warnAuth("token refresh request failed", { code: errorCode(error) });
-    return null;
-  }
-}
-function buildRefreshCookieHeader(refreshToken, deviceId) {
-  const cookies = [`${REFRESH_TOKEN_COOKIE}=${refreshToken}`];
-  if (deviceId) {
-    cookies.push(`${DEVICE_ID_COOKIE}=${deviceId}`);
-  }
-  return cookies.join("; ");
-}
-function extractAccessToken(setCookieHeaders) {
-  for (const header of setCookieHeaders) {
-    const match = header.match(new RegExp(`^${ACCESS_TOKEN_COOKIE}=([^;]+)`));
-    if (match) return match[1];
-  }
-  return null;
-}
 function isPublicPath(pathname, publicPaths) {
   return publicPaths.some((p) => {
     if (p.endsWith("*")) {
@@ -253,32 +88,17 @@ function isPublicPath(pathname, publicPaths) {
   });
 }
 function redirectToLogin(request, loginRedirectUrl) {
-  const redirectUrl = resolveLoginRedirectUrl(request, loginRedirectUrl);
+  const redirectUrl = typeof loginRedirectUrl === "function" ? loginRedirectUrl(request) : loginRedirectUrl;
   if (redirectUrl) {
     const url = `${LOGIN_URL}?redirect_url=${encodeURIComponent(redirectUrl)}`;
     return NextResponse.redirect(new URL(url, request.url));
   }
   return NextResponse.redirect(new URL("/", request.url));
 }
-function redirectToUnapproved(request, unapprovedRedirectUrl) {
-  const redirectUrl = resolveLoginRedirectUrl(request, unapprovedRedirectUrl);
-  if (redirectUrl) {
-    return NextResponse.redirect(new URL(redirectUrl, request.url));
-  }
-  const errorUrl = new URL(`${AUTH_SERVER_URL}/error`);
-  errorUrl.searchParams.set("code", PROXY_AUTH_ERROR.FORBIDDEN);
-  errorUrl.searchParams.set("from", request.url);
-  return NextResponse.redirect(errorUrl);
-}
-function resolveLoginRedirectUrl(request, loginRedirectUrl) {
-  if (typeof loginRedirectUrl === "function") {
-    return loginRedirectUrl(request);
-  }
-  return loginRedirectUrl;
-}
 export {
   DEFAULT_API_PATHS,
   DEFAULT_AUTH_BYPASS_PATHS,
+  DEFAULT_RESTORE_PATH,
   PROXY_AUTH_ERROR,
   createAuthProxy
 };

package/dist/proxy/index.js.map

@@ -1 +1 @@
-{"version":3,"sources":["../../src/proxy/index.ts"],"sourcesContent":["import { NextRequest, NextResponse } from \"next/server\";\nimport {\n  ACCESS_TOKEN_COOKIE,\n  REFRESH_TOKEN_COOKIE,\n  DEVICE_ID_COOKIE,\n  AUTH_SERVER_URL,\n  REFRESH_URL,\n  JWKS_URL,\n  LOGIN_URL,\n} from \"../constants.js\";\nimport { createRemoteJWKSet, jwtVerify } from \"jose\";\nimport type { AccessTokenClaims } from \"../types.js\";\nimport { isAccessTokenClaims } from \"../claims.js\";\nimport { isApprovedClient } from \"../approval.js\";\nimport { getMockAccessTokenClaims } from \"../mock.js\";\nimport { warnAuth, errorCode } from \"../log.js\";\n\nconst REFRESH_BUFFER_SECONDS = 60;\n\nexport const DEFAULT_AUTH_BYPASS_PATHS = [\n  \"/sw.js\",\n  \"/service-worker.js\",\n  \"/manifest.webmanifest\",\n  \"/manifest.json\",\n  \"/favicon.ico\",\n  \"/robots.txt\",\n  \"/sitemap.xml\",\n  \"/browserconfig.xml\",\n  \"/apple-touch-icon.png\",\n  \"/apple-touch-icon-*\",\n  \"/icon-*\",\n  \"/icons/*\",\n];\n\nexport const DEFAULT_API_PATHS = [\"/api/*\"];\n\nexport const PROXY_AUTH_ERROR = {\n  UNAUTHORIZED: \"UNAUTHORIZED\",\n  FORBIDDEN: \"FORBIDDEN\",\n} as const;\nexport type ProxyAuthErrorCode =\n  (typeof PROXY_AUTH_ERROR)[keyof typeof PROXY_AUTH_ERROR];\n\nconst jwks = createRemoteJWKSet(new URL(JWKS_URL));\n\nexport type LoginRedirectUrl = string | ((request: NextRequest) => string);\n\nexport interface AuthProxyOptions {\n  publicPaths?: string[];\n  bypassPaths?: string[];\n  apiPaths?: string[];\n  clientId?: string;\n  loginRedirectUrl?: LoginRedirectUrl;\n  unapprovedRedirectUrl?: LoginRedirectUrl;\n  onAuthSuccess?: (\n    claims: AccessTokenClaims,\n    request: NextRequest,\n    response: NextResponse\n  ) => Promise<NextResponse> | NextResponse;\n}\n\nexport function createAuthProxy(options: AuthProxyOptions = {}) {\n  const {\n    publicPaths = [],\n    bypassPaths = [],\n    apiPaths = DEFAULT_API_PATHS,\n    clientId,\n    loginRedirectUrl,\n    unapprovedRedirectUrl,\n    onAuthSuccess,\n  } = options;\n  const effectiveBypassPaths = [\n    ...DEFAULT_AUTH_BYPASS_PATHS,\n    ...bypassPaths,\n  ];\n\n  return async function proxy(request: NextRequest): Promise<NextResponse> {\n    const { pathname } = request.nextUrl;\n\n    if (isPublicPath(pathname, effectiveBypassPaths)) {\n      return NextResponse.next();\n    }\n\n    if (isPublicPath(pathname, publicPaths)) {\n      return maybeRefreshAndContinue(request);\n    }\n\n    const isApiRequest = isPublicPath(pathname, apiPaths);\n    const mockClaims = getMockAccessTokenClaims();\n    if (mockClaims) {\n      return handleVerifiedClaims(\n        mockClaims,\n        request,\n        isApiRequest,\n        clientId,\n        unapprovedRedirectUrl,\n        onAuthSuccess,\n        NextResponse.next()\n      );\n    }\n\n    const accessToken = request.cookies.get(ACCESS_TOKEN_COOKIE)?.value;\n    const refreshToken = request.cookies.get(REFRESH_TOKEN_COOKIE)?.value;\n    const deviceId = request.cookies.get(DEVICE_ID_COOKIE)?.value;\n\n    if (accessToken && isTokenFresh(accessToken)) {\n      const claims = await verifyToken(accessToken);\n      if (claims) {\n        return handleVerifiedClaims(\n          claims,\n          request,\n          isApiRequest,\n          clientId,\n          unapprovedRedirectUrl,\n          onAuthSuccess,\n          NextResponse.next()\n        );\n      }\n    }\n\n    if (refreshToken) {\n      const result = await tryRefresh(refreshToken, deviceId);\n      if (result) {\n        const claims = await verifyToken(result.newAccessToken);\n        if (claims) {\n          const response = nextWithRefreshedCookies(\n            request,\n            result.setCookieHeaders\n          );\n          return handleVerifiedClaims(\n            claims,\n            request,\n            isApiRequest,\n            clientId,\n            unapprovedRedirectUrl,\n            onAuthSuccess,\n            response\n          );\n        }\n      }\n    }\n\n    return isApiRequest\n      ? unauthorizedJson()\n      : redirectToLogin(request, loginRedirectUrl);\n  };\n}\n\nasync function handleVerifiedClaims(\n  claims: AccessTokenClaims,\n  request: NextRequest,\n  isApiRequest: boolean,\n  clientId: string | undefined,\n  unapprovedRedirectUrl: LoginRedirectUrl | undefined,\n  onAuthSuccess: AuthProxyOptions[\"onAuthSuccess\"],\n  response: NextResponse\n): Promise<NextResponse> {\n  if (!isApprovedClient(claims.approved_clients, clientId)) {\n    return isApiRequest\n      ? forbiddenJson()\n      : redirectToUnapproved(request, unapprovedRedirectUrl);\n  }\n\n  return onAuthSuccess\n    ? await onAuthSuccess(claims, request, response)\n    : response;\n}\n\nfunction unauthorizedJson(): NextResponse {\n  return NextResponse.json(\n    { code: PROXY_AUTH_ERROR.UNAUTHORIZED },\n    { status: 401 }\n  );\n}\n\nfunction forbiddenJson(): NextResponse {\n  return NextResponse.json(\n    { code: PROXY_AUTH_ERROR.FORBIDDEN },\n    { status: 403 }\n  );\n}\n\nasync function maybeRefreshAndContinue(\n  request: NextRequest\n): Promise<NextResponse> {\n  const accessToken = request.cookies.get(ACCESS_TOKEN_COOKIE)?.value;\n  const refreshToken = request.cookies.get(REFRESH_TOKEN_COOKIE)?.value;\n  const deviceId = request.cookies.get(DEVICE_ID_COOKIE)?.value;\n\n  if (accessToken && isTokenFresh(accessToken)) {\n    return NextResponse.next();\n  }\n\n  if (refreshToken) {\n    const result = await tryRefresh(refreshToken, deviceId);\n    if (result) {\n      return nextWithRefreshedCookies(request, result.setCookieHeaders);\n    }\n    // 공개 경로라 요청은 그대로 통과시킨다. 다만 이 실패는 밖에서 보이지 않는다\n    // — 응답이 성공했을 때와 바이트 단위로 같기 때문이다. 유일한 증상은\n    // \"로그인 상태로 보여야 할 화면이 익명으로 렌더되는 것\" 이고, 그마저도\n    // 클라이언트 갱신(AutoTokenRefresh)이 있으면 가려진다. 그래서 여기서\n    // 한 줄이라도 남겨야 한다. tryRefresh 가 이미 사유를 찍었다.\n    warnAuth(\"refresh failed on public path, continuing anonymously\", {\n      path: request.nextUrl.pathname,\n    });\n  }\n\n  return NextResponse.next();\n}\n\n/**\n * 갱신된 토큰을 이 요청의 cookie 헤더에도 반영한 응답을 만든다.\n *\n * Set-Cookie 는 브라우저에만 적용된다. 그것만 붙이면 지금 이 요청을 처리하는\n * 서버 컴포넌트는 여전히 만료된 access token 을 읽고, 갱신에 성공했는데도\n * 그 요청은 로그아웃으로 판정된다. access token 이 만료된 뒤 첫 요청마다\n * 발생하며, PWA 콜드 스타트처럼 항상 만료 상태에서 시작하는 경우 매번 겪는다.\n *\n * Next.js 는 미들웨어가 넘긴 요청 헤더를 다운스트림에 그대로 전달하므로\n * cookie 헤더를 새 토큰으로 바꿔 끼워 같은 요청에서 인증이 보이게 한다.\n * (response.headers.append 는 NextResponse 의 쿠키 프록시를 우회하기 때문에\n *  Next 의 x-middleware-set-cookie 병합 경로도 타지 않는다)\n */\nfunction nextWithRefreshedCookies(\n  request: NextRequest,\n  setCookieHeaders: string[]\n): NextResponse {\n  const merged = new Map<string, string>();\n  for (const { name, value } of request.cookies.getAll()) {\n    merged.set(name, value);\n  }\n\n  // auth 서버는 도메인마다 같은 쿠키를 한 번씩 보내므로 이름 기준으로 덮어쓴다.\n  for (const header of setCookieHeaders) {\n    const pair = header.split(\";\")[0] ?? \"\";\n    const separator = pair.indexOf(\"=\");\n    if (separator <= 0) continue;\n    merged.set(pair.slice(0, separator).trim(), pair.slice(separator + 1).trim());\n  }\n\n  const requestHeaders = new Headers(request.headers);\n  requestHeaders.set(\n    \"cookie\",\n    Array.from(merged, ([name, value]) => `${name}=${value}`).join(\"; \")\n  );\n\n  const response = NextResponse.next({ request: { headers: requestHeaders } });\n  for (const header of setCookieHeaders) {\n    response.headers.append(\"Set-Cookie\", header);\n  }\n  return response;\n}\n\nfunction isTokenFresh(token: string): boolean {\n  try {\n    const parts = token.split(\".\");\n    if (parts.length !== 3) return false;\n    const payload = JSON.parse(\n      Buffer.from(parts[1], \"base64url\").toString()\n    );\n    return (\n      typeof payload.exp === \"number\" &&\n      payload.exp > Math.floor(Date.now() / 1000) + REFRESH_BUFFER_SECONDS\n    );\n  } catch {\n    return false;\n  }\n}\n\nasync function verifyToken(\n  token: string\n): Promise<AccessTokenClaims | null> {\n  try {\n    const { payload } = await jwtVerify(token, jwks, {\n      issuer: AUTH_SERVER_URL,\n    });\n    if (isAccessTokenClaims(payload)) return payload;\n    // 서명은 유효한데 클레임 모양이 다르다. auth 서버와 버전이 어긋났을 때 난다.\n    warnAuth(\"access token claims shape mismatch\");\n    return null;\n  } catch (error) {\n    // 정상 만료(ERR_JWT_EXPIRED)는 갱신으로 이어지므로 소음이다. 나머지는 남긴다.\n    // 특히 ERR_JWKS_NO_MATCHING_KEY 는 키 로테이션이나 JWKS 도달 실패라\n    // 위조 토큰과 구분되어야 한다.\n    const code = errorCode(error);\n    if (code !== \"ERR_JWT_EXPIRED\") {\n      warnAuth(\"access token verification failed\", { code });\n    }\n    return null;\n  }\n}\n\ninterface RefreshSuccess {\n  newAccessToken: string;\n  setCookieHeaders: string[];\n}\n\nasync function tryRefresh(\n  refreshToken: string,\n  deviceId?: string\n): Promise<RefreshSuccess | null> {\n  try {\n    const res = await fetch(REFRESH_URL, {\n      method: \"POST\",\n      headers: { Cookie: buildRefreshCookieHeader(refreshToken, deviceId) },\n    });\n\n    if (!res.ok) {\n      // 이 요청은 브라우저가 아니라 서버에서 나간다. UA 는 런타임 기본값이고\n      // cf_clearance 같은 챌린지 통과 쿠키도 없으므로, auth 서버 앞에 WAF 나\n      // 봇 방어가 있으면 origin 에 닿기 전에 잘린다. 2026-07-19 에 실제로\n      // Cloudflare Bot Fight Mode 가 403 + cf-mitigated: challenge 로 막았다.\n      // 그때 auth 서버 로그에는 아무것도 남지 않았다 — 도달을 못 했으니까.\n      // 그래서 상태 코드와 함께 edge 가 남긴 힌트를 같이 찍는다.\n      warnAuth(\"token refresh rejected\", {\n        status: res.status,\n        server: res.headers.get(\"server\"),\n        cfRay: res.headers.get(\"cf-ray\"),\n        cfMitigated: res.headers.get(\"cf-mitigated\"),\n      });\n      return null;\n    }\n\n    const setCookieHeaders = res.headers.getSetCookie();\n    const newAccessToken = extractAccessToken(setCookieHeaders);\n    if (!newAccessToken) {\n      // 200 인데 access token 이 없다. 쿠키 이름이 어긋났거나 중간 프록시가\n      // Set-Cookie 를 떨궜다. 값은 절대 찍지 않고 이름만 남긴다.\n      warnAuth(\"refresh succeeded but no access token cookie\", {\n        cookieNames: setCookieHeaders.map((h) => h.split(\"=\")[0]),\n      });\n      return null;\n    }\n\n    return { newAccessToken, setCookieHeaders };\n  } catch (error) {\n    // DNS · TLS · 타임아웃. auth 서버가 내려갔거나 경로가 막힌 경우다.\n    warnAuth(\"token refresh request failed\", { code: errorCode(error) });\n    return null;\n  }\n}\n\nfunction buildRefreshCookieHeader(\n  refreshToken: string,\n  deviceId?: string\n): string {\n  const cookies = [`${REFRESH_TOKEN_COOKIE}=${refreshToken}`];\n  if (deviceId) {\n    cookies.push(`${DEVICE_ID_COOKIE}=${deviceId}`);\n  }\n  return cookies.join(\"; \");\n}\n\nfunction extractAccessToken(setCookieHeaders: string[]): string | null {\n  for (const header of setCookieHeaders) {\n    const match = header.match(new RegExp(`^${ACCESS_TOKEN_COOKIE}=([^;]+)`));\n    if (match) return match[1];\n  }\n  return null;\n}\n\nfunction isPublicPath(pathname: string, publicPaths: string[]): boolean {\n  return publicPaths.some((p) => {\n    if (p.endsWith(\"*\")) {\n      return pathname.startsWith(p.slice(0, -1));\n    }\n    return pathname === p;\n  });\n}\n\nfunction redirectToLogin(\n  request: NextRequest,\n  loginRedirectUrl?: LoginRedirectUrl\n): NextResponse {\n  const redirectUrl = resolveLoginRedirectUrl(request, loginRedirectUrl);\n  if (redirectUrl) {\n    const url = `${LOGIN_URL}?redirect_url=${encodeURIComponent(redirectUrl)}`;\n    return NextResponse.redirect(new URL(url, request.url));\n  }\n  return NextResponse.redirect(new URL(\"/\", request.url));\n}\n\nfunction redirectToUnapproved(\n  request: NextRequest,\n  unapprovedRedirectUrl?: LoginRedirectUrl\n): NextResponse {\n  const redirectUrl = resolveLoginRedirectUrl(request, unapprovedRedirectUrl);\n  if (redirectUrl) {\n    return NextResponse.redirect(new URL(redirectUrl, request.url));\n  }\n  const errorUrl = new URL(`${AUTH_SERVER_URL}/error`);\n  errorUrl.searchParams.set(\"code\", PROXY_AUTH_ERROR.FORBIDDEN);\n  errorUrl.searchParams.set(\"from\", request.url);\n  return NextResponse.redirect(errorUrl);\n}\n\nfunction resolveLoginRedirectUrl(\n  request: NextRequest,\n  loginRedirectUrl?: LoginRedirectUrl\n): string | undefined {\n  if (typeof loginRedirectUrl === \"function\") {\n    return loginRedirectUrl(request);\n  }\n  return loginRedirectUrl;\n}\n\nexport type { AccessTokenClaims } from \"../types.js\";\nexport type { LemonUser } from \"../types.js\";\n"],"mappings":";;;;;;;;;;;;;;;;;;AAAA,SAAsB,oBAAoB;AAU1C,SAAS,oBAAoB,iBAAiB;AAO9C,IAAM,yBAAyB;AAExB,IAAM,4BAA4B;AAAA,EACvC;AAAA,EACA;AAAA,EACA;AAAA,EACA;AAAA,EACA;AAAA,EACA;AAAA,EACA;AAAA,EACA;AAAA,EACA;AAAA,EACA;AAAA,EACA;AAAA,EACA;AACF;AAEO,IAAM,oBAAoB,CAAC,QAAQ;AAEnC,IAAM,mBAAmB;AAAA,EAC9B,cAAc;AAAA,EACd,WAAW;AACb;AAIA,IAAM,OAAO,mBAAmB,IAAI,IAAI,QAAQ,CAAC;AAkB1C,SAAS,gBAAgB,UAA4B,CAAC,GAAG;AAC9D,QAAM;AAAA,IACJ,cAAc,CAAC;AAAA,IACf,cAAc,CAAC;AAAA,IACf,WAAW;AAAA,IACX;AAAA,IACA;AAAA,IACA;AAAA,IACA;AAAA,EACF,IAAI;AACJ,QAAM,uBAAuB;AAAA,IAC3B,GAAG;AAAA,IACH,GAAG;AAAA,EACL;AAEA,SAAO,eAAe,MAAM,SAA6C;AACvE,UAAM,EAAE,SAAS,IAAI,QAAQ;AAE7B,QAAI,aAAa,UAAU,oBAAoB,GAAG;AAChD,aAAO,aAAa,KAAK;AAAA,IAC3B;AAEA,QAAI,aAAa,UAAU,WAAW,GAAG;AACvC,aAAO,wBAAwB,OAAO;AAAA,IACxC;AAEA,UAAM,eAAe,aAAa,UAAU,QAAQ;AACpD,UAAM,aAAa,yBAAyB;AAC5C,QAAI,YAAY;AACd,aAAO;AAAA,QACL;AAAA,QACA;AAAA,QACA;AAAA,QACA;AAAA,QACA;AAAA,QACA;AAAA,QACA,aAAa,KAAK;AAAA,MACpB;AAAA,IACF;AAEA,UAAM,cAAc,QAAQ,QAAQ,IAAI,mBAAmB,GAAG;AAC9D,UAAM,eAAe,QAAQ,QAAQ,IAAI,oBAAoB,GAAG;AAChE,UAAM,WAAW,QAAQ,QAAQ,IAAI,gBAAgB,GAAG;AAExD,QAAI,eAAe,aAAa,WAAW,GAAG;AAC5C,YAAM,SAAS,MAAM,YAAY,WAAW;AAC5C,UAAI,QAAQ;AACV,eAAO;AAAA,UACL;AAAA,UACA;AAAA,UACA;AAAA,UACA;AAAA,UACA;AAAA,UACA;AAAA,UACA,aAAa,KAAK;AAAA,QACpB;AAAA,MACF;AAAA,IACF;AAEA,QAAI,cAAc;AAChB,YAAM,SAAS,MAAM,WAAW,cAAc,QAAQ;AACtD,UAAI,QAAQ;AACV,cAAM,SAAS,MAAM,YAAY,OAAO,cAAc;AACtD,YAAI,QAAQ;AACV,gBAAM,WAAW;AAAA,YACf;AAAA,YACA,OAAO;AAAA,UACT;AACA,iBAAO;AAAA,YACL;AAAA,YACA;AAAA,YACA;AAAA,YACA;AAAA,YACA;AAAA,YACA;AAAA,YACA;AAAA,UACF;AAAA,QACF;AAAA,MACF;AAAA,IACF;AAEA,WAAO,eACH,iBAAiB,IACjB,gBAAgB,SAAS,gBAAgB;AAAA,EAC/C;AACF;AAEA,eAAe,qBACb,QACA,SACA,cACA,UACA,uBACA,eACA,UACuB;AACvB,MAAI,CAAC,iBAAiB,OAAO,kBAAkB,QAAQ,GAAG;AACxD,WAAO,eACH,cAAc,IACd,qBAAqB,SAAS,qBAAqB;AAAA,EACzD;AAEA,SAAO,gBACH,MAAM,cAAc,QAAQ,SAAS,QAAQ,IAC7C;AACN;AAEA,SAAS,mBAAiC;AACxC,SAAO,aAAa;AAAA,IAClB,EAAE,MAAM,iBAAiB,aAAa;AAAA,IACtC,EAAE,QAAQ,IAAI;AAAA,EAChB;AACF;AAEA,SAAS,gBAA8B;AACrC,SAAO,aAAa;AAAA,IAClB,EAAE,MAAM,iBAAiB,UAAU;AAAA,IACnC,EAAE,QAAQ,IAAI;AAAA,EAChB;AACF;AAEA,eAAe,wBACb,SACuB;AACvB,QAAM,cAAc,QAAQ,QAAQ,IAAI,mBAAmB,GAAG;AAC9D,QAAM,eAAe,QAAQ,QAAQ,IAAI,oBAAoB,GAAG;AAChE,QAAM,WAAW,QAAQ,QAAQ,IAAI,gBAAgB,GAAG;AAExD,MAAI,eAAe,aAAa,WAAW,GAAG;AAC5C,WAAO,aAAa,KAAK;AAAA,EAC3B;AAEA,MAAI,cAAc;AAChB,UAAM,SAAS,MAAM,WAAW,cAAc,QAAQ;AACtD,QAAI,QAAQ;AACV,aAAO,yBAAyB,SAAS,OAAO,gBAAgB;AAAA,IAClE;AAMA,aAAS,yDAAyD;AAAA,MAChE,MAAM,QAAQ,QAAQ;AAAA,IACxB,CAAC;AAAA,EACH;AAEA,SAAO,aAAa,KAAK;AAC3B;AAeA,SAAS,yBACP,SACA,kBACc;AACd,QAAM,SAAS,oBAAI,IAAoB;AACvC,aAAW,EAAE,MAAM,MAAM,KAAK,QAAQ,QAAQ,OAAO,GAAG;AACtD,WAAO,IAAI,MAAM,KAAK;AAAA,EACxB;AAGA,aAAW,UAAU,kBAAkB;AACrC,UAAM,OAAO,OAAO,MAAM,GAAG,EAAE,CAAC,KAAK;AACrC,UAAM,YAAY,KAAK,QAAQ,GAAG;AAClC,QAAI,aAAa,EAAG;AACpB,WAAO,IAAI,KAAK,MAAM,GAAG,SAAS,EAAE,KAAK,GAAG,KAAK,MAAM,YAAY,CAAC,EAAE,KAAK,CAAC;AAAA,EAC9E;AAEA,QAAM,iBAAiB,IAAI,QAAQ,QAAQ,OAAO;AAClD,iBAAe;AAAA,IACb;AAAA,IACA,MAAM,KAAK,QAAQ,CAAC,CAAC,MAAM,KAAK,MAAM,GAAG,IAAI,IAAI,KAAK,EAAE,EAAE,KAAK,IAAI;AAAA,EACrE;AAEA,QAAM,WAAW,aAAa,KAAK,EAAE,SAAS,EAAE,SAAS,eAAe,EAAE,CAAC;AAC3E,aAAW,UAAU,kBAAkB;AACrC,aAAS,QAAQ,OAAO,cAAc,MAAM;AAAA,EAC9C;AACA,SAAO;AACT;AAEA,SAAS,aAAa,OAAwB;AAC5C,MAAI;AACF,UAAM,QAAQ,MAAM,MAAM,GAAG;AAC7B,QAAI,MAAM,WAAW,EAAG,QAAO;AAC/B,UAAM,UAAU,KAAK;AAAA,MACnB,OAAO,KAAK,MAAM,CAAC,GAAG,WAAW,EAAE,SAAS;AAAA,IAC9C;AACA,WACE,OAAO,QAAQ,QAAQ,YACvB,QAAQ,MAAM,KAAK,MAAM,KAAK,IAAI,IAAI,GAAI,IAAI;AAAA,EAElD,QAAQ;AACN,WAAO;AAAA,EACT;AACF;AAEA,eAAe,YACb,OACmC;AACnC,MAAI;AACF,UAAM,EAAE,QAAQ,IAAI,MAAM,UAAU,OAAO,MAAM;AAAA,MAC/C,QAAQ;AAAA,IACV,CAAC;AACD,QAAI,oBAAoB,OAAO,EAAG,QAAO;AAEzC,aAAS,oCAAoC;AAC7C,WAAO;AAAA,EACT,SAAS,OAAO;AAId,UAAM,OAAO,UAAU,KAAK;AAC5B,QAAI,SAAS,mBAAmB;AAC9B,eAAS,oCAAoC,EAAE,KAAK,CAAC;AAAA,IACvD;AACA,WAAO;AAAA,EACT;AACF;AAOA,eAAe,WACb,cACA,UACgC;AAChC,MAAI;AACF,UAAM,MAAM,MAAM,MAAM,aAAa;AAAA,MACnC,QAAQ;AAAA,MACR,SAAS,EAAE,QAAQ,yBAAyB,cAAc,QAAQ,EAAE;AAAA,IACtE,CAAC;AAED,QAAI,CAAC,IAAI,IAAI;AAOX,eAAS,0BAA0B;AAAA,QACjC,QAAQ,IAAI;AAAA,QACZ,QAAQ,IAAI,QAAQ,IAAI,QAAQ;AAAA,QAChC,OAAO,IAAI,QAAQ,IAAI,QAAQ;AAAA,QAC/B,aAAa,IAAI,QAAQ,IAAI,cAAc;AAAA,MAC7C,CAAC;AACD,aAAO;AAAA,IACT;AAEA,UAAM,mBAAmB,IAAI,QAAQ,aAAa;AAClD,UAAM,iBAAiB,mBAAmB,gBAAgB;AAC1D,QAAI,CAAC,gBAAgB;AAGnB,eAAS,gDAAgD;AAAA,QACvD,aAAa,iBAAiB,IAAI,CAAC,MAAM,EAAE,MAAM,GAAG,EAAE,CAAC,CAAC;AAAA,MAC1D,CAAC;AACD,aAAO;AAAA,IACT;AAEA,WAAO,EAAE,gBAAgB,iBAAiB;AAAA,EAC5C,SAAS,OAAO;AAEd,aAAS,gCAAgC,EAAE,MAAM,UAAU,KAAK,EAAE,CAAC;AACnE,WAAO;AAAA,EACT;AACF;AAEA,SAAS,yBACP,cACA,UACQ;AACR,QAAM,UAAU,CAAC,GAAG,oBAAoB,IAAI,YAAY,EAAE;AAC1D,MAAI,UAAU;AACZ,YAAQ,KAAK,GAAG,gBAAgB,IAAI,QAAQ,EAAE;AAAA,EAChD;AACA,SAAO,QAAQ,KAAK,IAAI;AAC1B;AAEA,SAAS,mBAAmB,kBAA2C;AACrE,aAAW,UAAU,kBAAkB;AACrC,UAAM,QAAQ,OAAO,MAAM,IAAI,OAAO,IAAI,mBAAmB,UAAU,CAAC;AACxE,QAAI,MAAO,QAAO,MAAM,CAAC;AAAA,EAC3B;AACA,SAAO;AACT;AAEA,SAAS,aAAa,UAAkB,aAAgC;AACtE,SAAO,YAAY,KAAK,CAAC,MAAM;AAC7B,QAAI,EAAE,SAAS,GAAG,GAAG;AACnB,aAAO,SAAS,WAAW,EAAE,MAAM,GAAG,EAAE,CAAC;AAAA,IAC3C;AACA,WAAO,aAAa;AAAA,EACtB,CAAC;AACH;AAEA,SAAS,gBACP,SACA,kBACc;AACd,QAAM,cAAc,wBAAwB,SAAS,gBAAgB;AACrE,MAAI,aAAa;AACf,UAAM,MAAM,GAAG,SAAS,iBAAiB,mBAAmB,WAAW,CAAC;AACxE,WAAO,aAAa,SAAS,IAAI,IAAI,KAAK,QAAQ,GAAG,CAAC;AAAA,EACxD;AACA,SAAO,aAAa,SAAS,IAAI,IAAI,KAAK,QAAQ,GAAG,CAAC;AACxD;AAEA,SAAS,qBACP,SACA,uBACc;AACd,QAAM,cAAc,wBAAwB,SAAS,qBAAqB;AAC1E,MAAI,aAAa;AACf,WAAO,aAAa,SAAS,IAAI,IAAI,aAAa,QAAQ,GAAG,CAAC;AAAA,EAChE;AACA,QAAM,WAAW,IAAI,IAAI,GAAG,eAAe,QAAQ;AACnD,WAAS,aAAa,IAAI,QAAQ,iBAAiB,SAAS;AAC5D,WAAS,aAAa,IAAI,QAAQ,QAAQ,GAAG;AAC7C,SAAO,aAAa,SAAS,QAAQ;AACvC;AAEA,SAAS,wBACP,SACA,kBACoB;AACpB,MAAI,OAAO,qBAAqB,YAAY;AAC1C,WAAO,iBAAiB,OAAO;AAAA,EACjC;AACA,SAAO;AACT;","names":[]}
+{"version":3,"sources":["../../src/proxy/index.ts"],"sourcesContent":["import { NextRequest, NextResponse } from \"next/server\";\nimport {\n  ACCESS_TOKEN_COOKIE,\n  REFRESH_TOKEN_COOKIE,\n  LOGIN_URL,\n} from \"../constants.js\";\nimport { isMockAuthEnabled } from \"../mock.js\";\n\n/**\n * 프록시는 optimistic check 만 한다.\n *\n * Next.js 공식 인증 가이드가 이렇게 못박고 있다.\n *\n *   since Proxy runs on every route, including prefetched routes, it's\n *   important to only read the session from the cookie (optimistic checks),\n *   and avoid database checks to prevent performance issues.\n *\n * 0.7.x 까지는 여기서 auth 서버로 refresh 요청을 보냈다. 그 결과 프리페치가\n * 깔릴 때마다 갱신이 동시에 여러 번 나갔고, Vercel 미들웨어는 요청마다 별도\n * 인스턴스로 뜨므로 직렬화할 방법도 없었다. 회전 경쟁이 나서 정상 요청이\n * 탈취로 오인되고 계정 토큰이 통째로 폐기되는 일이 반복됐다.\n *\n * 그래서 갱신 주체를 브라우저 하나로 옮겼다. 브라우저는 JS 컨텍스트가 하나라\n * 자연히 직렬화된다. 프록시는 쿠키만 읽고, 갱신이 필요하면 앱이 마운트한\n * 복구 경로로 넘긴다.\n *\n * 서명 검증도 하지 않는다. optimistic check 는 보안 판단이 아니라 화면 이동\n * 판단이다. 진짜 검증은 DAL(getSession / requireApprovedUser)이 한다.\n */\n\nconst REFRESH_BUFFER_SECONDS = 60;\n\nexport const DEFAULT_AUTH_BYPASS_PATHS = [\n  \"/sw.js\",\n  \"/service-worker.js\",\n  \"/manifest.webmanifest\",\n  \"/manifest.json\",\n  \"/favicon.ico\",\n  \"/robots.txt\",\n  \"/sitemap.xml\",\n  \"/browserconfig.xml\",\n  \"/apple-touch-icon.png\",\n  \"/apple-touch-icon-*\",\n  \"/icon-*\",\n  \"/icons/*\",\n];\n\nexport const DEFAULT_API_PATHS = [\"/api/*\"];\n\n/** 앱이 <SessionRestore /> 를 마운트해야 하는 기본 경로. */\nexport const DEFAULT_RESTORE_PATH = \"/auth/restore\";\n\nexport const PROXY_AUTH_ERROR = {\n  UNAUTHORIZED: \"UNAUTHORIZED\",\n  FORBIDDEN: \"FORBIDDEN\",\n} as const;\nexport type ProxyAuthErrorCode =\n  (typeof PROXY_AUTH_ERROR)[keyof typeof PROXY_AUTH_ERROR];\n\nexport type LoginRedirectUrl = string | ((request: NextRequest) => string);\n\nexport interface AuthProxyOptions {\n  /** 로그인 없이 열어둘 경로. 여기서는 아무 판단도 하지 않고 통과시킨다. */\n  publicPaths?: string[];\n  /** 프록시 자체를 건너뛸 경로. 정적 파일 등. */\n  bypassPaths?: string[];\n  /** 리다이렉트 대신 401 JSON 을 돌려줄 경로. 기본 `/api/*`. */\n  apiPaths?: string[];\n  loginRedirectUrl?: LoginRedirectUrl;\n  /** <SessionRestore /> 를 마운트한 경로. 기본 `/auth/restore`. */\n  restorePath?: string;\n}\n\nexport function createAuthProxy(options: AuthProxyOptions = {}) {\n  const {\n    publicPaths = [],\n    bypassPaths = [],\n    apiPaths = DEFAULT_API_PATHS,\n    loginRedirectUrl,\n    restorePath = DEFAULT_RESTORE_PATH,\n  } = options;\n  const effectiveBypassPaths = [...DEFAULT_AUTH_BYPASS_PATHS, ...bypassPaths];\n\n  return async function proxy(request: NextRequest): Promise<NextResponse> {\n    const { pathname } = request.nextUrl;\n\n    if (isPublicPath(pathname, effectiveBypassPaths)) {\n      return NextResponse.next();\n    }\n\n    if (isPublicPath(pathname, publicPaths)) {\n      return NextResponse.next();\n    }\n\n    if (isMockAuthEnabled()) {\n      return NextResponse.next();\n    }\n\n    const accessToken = request.cookies.get(ACCESS_TOKEN_COOKIE)?.value;\n    if (accessToken && isTokenFresh(accessToken)) {\n      return NextResponse.next();\n    }\n\n    const isApiRequest = isPublicPath(pathname, apiPaths);\n    if (isApiRequest) {\n      // API 는 리다이렉트를 따라가봐야 HTML 을 받을 뿐이다. 401 을 주고\n      // 클라이언트가 복구하게 한다.\n      return NextResponse.json(\n        { code: PROXY_AUTH_ERROR.UNAUTHORIZED },\n        { status: 401 }\n      );\n    }\n\n    // access 는 없지만 refresh 가 남아 있으면 아직 로그인이 풀린 게 아니다.\n    // 브라우저가 갱신할 수 있도록 복구 경로로 보낸다.\n    //\n    // 프리페치도 똑같이 처리한다. 프리페치를 그냥 통과시키면 만료된 토큰으로\n    // 페이지가 렌더되고, 거기서 나온 redirect 가 라우터 캐시에 굳어 어느 탭을\n    // 눌러도 같은 곳으로 튀게 된다(예전에 겪은 문제다). 반면 여기서 돌려주는\n    // 리다이렉트는 굳어도 해가 없다 — 복구 경로는 막다른 길이 아니라 스스로\n    // 세션을 되살리고 next 로 되돌려 보내므로 목적지도 보존된다.\n    if (request.cookies.get(REFRESH_TOKEN_COOKIE)?.value) {\n      const restore = new URL(restorePath, request.url);\n      restore.searchParams.set(\"next\", pathname + request.nextUrl.search);\n      return NextResponse.redirect(restore);\n    }\n\n    return redirectToLogin(request, loginRedirectUrl);\n  };\n}\n\n/**\n * exp 만 본다. 서명은 검증하지 않는다.\n *\n * 위조한 토큰으로 이 검사를 통과할 수는 있으나, 그래봐야 DAL 에서 걸린다.\n * 프록시의 판단은 \"어느 화면으로 보낼까\" 이지 \"권한이 있는가\" 가 아니다.\n */\nfunction isTokenFresh(token: string): boolean {\n  try {\n    const parts = token.split(\".\");\n    if (parts.length !== 3) return false;\n    const payload = JSON.parse(\n      Buffer.from(parts[1], \"base64url\").toString()\n    ) as { exp?: unknown };\n    return (\n      typeof payload.exp === \"number\" &&\n      payload.exp > Math.floor(Date.now() / 1000) + REFRESH_BUFFER_SECONDS\n    );\n  } catch {\n    return false;\n  }\n}\n\nfunction isPublicPath(pathname: string, publicPaths: string[]): boolean {\n  return publicPaths.some((p) => {\n    if (p.endsWith(\"*\")) {\n      return pathname.startsWith(p.slice(0, -1));\n    }\n    return pathname === p;\n  });\n}\n\nfunction redirectToLogin(\n  request: NextRequest,\n  loginRedirectUrl: LoginRedirectUrl | undefined\n): NextResponse {\n  const redirectUrl =\n    typeof loginRedirectUrl === \"function\"\n      ? loginRedirectUrl(request)\n      : loginRedirectUrl;\n\n  if (redirectUrl) {\n    const url = `${LOGIN_URL}?redirect_url=${encodeURIComponent(redirectUrl)}`;\n    return NextResponse.redirect(new URL(url, request.url));\n  }\n  return NextResponse.redirect(new URL(\"/\", request.url));\n}\n"],"mappings":";;;;;;;;AAAA,SAAsB,oBAAoB;AA8B1C,IAAM,yBAAyB;AAExB,IAAM,4BAA4B;AAAA,EACvC;AAAA,EACA;AAAA,EACA;AAAA,EACA;AAAA,EACA;AAAA,EACA;AAAA,EACA;AAAA,EACA;AAAA,EACA;AAAA,EACA;AAAA,EACA;AAAA,EACA;AACF;AAEO,IAAM,oBAAoB,CAAC,QAAQ;AAGnC,IAAM,uBAAuB;AAE7B,IAAM,mBAAmB;AAAA,EAC9B,cAAc;AAAA,EACd,WAAW;AACb;AAkBO,SAAS,gBAAgB,UAA4B,CAAC,GAAG;AAC9D,QAAM;AAAA,IACJ,cAAc,CAAC;AAAA,IACf,cAAc,CAAC;AAAA,IACf,WAAW;AAAA,IACX;AAAA,IACA,cAAc;AAAA,EAChB,IAAI;AACJ,QAAM,uBAAuB,CAAC,GAAG,2BAA2B,GAAG,WAAW;AAE1E,SAAO,eAAe,MAAM,SAA6C;AACvE,UAAM,EAAE,SAAS,IAAI,QAAQ;AAE7B,QAAI,aAAa,UAAU,oBAAoB,GAAG;AAChD,aAAO,aAAa,KAAK;AAAA,IAC3B;AAEA,QAAI,aAAa,UAAU,WAAW,GAAG;AACvC,aAAO,aAAa,KAAK;AAAA,IAC3B;AAEA,QAAI,kBAAkB,GAAG;AACvB,aAAO,aAAa,KAAK;AAAA,IAC3B;AAEA,UAAM,cAAc,QAAQ,QAAQ,IAAI,mBAAmB,GAAG;AAC9D,QAAI,eAAe,aAAa,WAAW,GAAG;AAC5C,aAAO,aAAa,KAAK;AAAA,IAC3B;AAEA,UAAM,eAAe,aAAa,UAAU,QAAQ;AACpD,QAAI,cAAc;AAGhB,aAAO,aAAa;AAAA,QAClB,EAAE,MAAM,iBAAiB,aAAa;AAAA,QACtC,EAAE,QAAQ,IAAI;AAAA,MAChB;AAAA,IACF;AAUA,QAAI,QAAQ,QAAQ,IAAI,oBAAoB,GAAG,OAAO;AACpD,YAAM,UAAU,IAAI,IAAI,aAAa,QAAQ,GAAG;AAChD,cAAQ,aAAa,IAAI,QAAQ,WAAW,QAAQ,QAAQ,MAAM;AAClE,aAAO,aAAa,SAAS,OAAO;AAAA,IACtC;AAEA,WAAO,gBAAgB,SAAS,gBAAgB;AAAA,EAClD;AACF;AAQA,SAAS,aAAa,OAAwB;AAC5C,MAAI;AACF,UAAM,QAAQ,MAAM,MAAM,GAAG;AAC7B,QAAI,MAAM,WAAW,EAAG,QAAO;AAC/B,UAAM,UAAU,KAAK;AAAA,MACnB,OAAO,KAAK,MAAM,CAAC,GAAG,WAAW,EAAE,SAAS;AAAA,IAC9C;AACA,WACE,OAAO,QAAQ,QAAQ,YACvB,QAAQ,MAAM,KAAK,MAAM,KAAK,IAAI,IAAI,GAAI,IAAI;AAAA,EAElD,QAAQ;AACN,WAAO;AAAA,EACT;AACF;AAEA,SAAS,aAAa,UAAkB,aAAgC;AACtE,SAAO,YAAY,KAAK,CAAC,MAAM;AAC7B,QAAI,EAAE,SAAS,GAAG,GAAG;AACnB,aAAO,SAAS,WAAW,EAAE,MAAM,GAAG,EAAE,CAAC;AAAA,IAC3C;AACA,WAAO,aAAa;AAAA,EACtB,CAAC;AACH;AAEA,SAAS,gBACP,SACA,kBACc;AACd,QAAM,cACJ,OAAO,qBAAqB,aACxB,iBAAiB,OAAO,IACxB;AAEN,MAAI,aAAa;AACf,UAAM,MAAM,GAAG,SAAS,iBAAiB,mBAAmB,WAAW,CAAC;AACxE,WAAO,aAAa,SAAS,IAAI,IAAI,KAAK,QAAQ,GAAG,CAAC;AAAA,EACxD;AACA,SAAO,aAAa,SAAS,IAAI,IAAI,KAAK,QAAQ,GAAG,CAAC;AACxD;","names":[]}

package/dist/server/index.js

@@ -1,9 +1,3 @@
-import {
-  errorCode,
-  isAccessTokenClaims,
-  isApprovedClient,
-  warnAuth
-} from "../chunk-K4U4PHX6.js";
 import {
   ACCESS_TOKEN_COOKIE,
   AUTH_SERVER_URL,
@@ -22,6 +16,35 @@ import {
 // src/server/verify.ts
 import { createRemoteJWKSet, jwtVerify } from "jose";
 import { cookies } from "next/headers";
+
+// src/claims.ts
+function isAccessTokenClaims(payload) {
+  return payload.token_type === "access" && typeof payload.sub === "string" && typeof payload.nickname === "string" && typeof payload.profile_image_url === "string" && (payload.role === "user" || payload.role === "admin") && Array.isArray(payload.approved_clients) && payload.approved_clients.every((clientId) => typeof clientId === "string");
+}
+
+// src/log.ts
+var PREFIX = "[lemon-auth]";
+function warnAuth(event, detail) {
+  if (detail === void 0) {
+    console.warn(`${PREFIX} ${event}`);
+    return;
+  }
+  console.warn(`${PREFIX} ${event}`, JSON.stringify(detail));
+}
+function errorCode(error) {
+  if (typeof error === "object" && error !== null) {
+    const { code, cause } = error;
+    if (typeof code === "string") return code;
+    if (typeof cause === "object" && cause !== null) {
+      const causeCode = cause.code;
+      if (typeof causeCode === "string") return causeCode;
+    }
+  }
+  if (error instanceof Error) return error.name;
+  return "unknown";
+}
+
+// src/server/verify.ts
 var jwks = createRemoteJWKSet(new URL(JWKS_URL));
 async function verify(token) {
   try {
@@ -56,6 +79,23 @@ async function verifyAccessTokenString(token) {
 // src/server/user.ts
 import { cache } from "react";
 import { redirect } from "next/navigation";
+
+// src/approval.ts
+var warnedMissingClientId = false;
+function isApprovedClient(approvedClients, clientId) {
+  if (!clientId) {
+    if (!warnedMissingClientId) {
+      warnedMissingClientId = true;
+      warnAuth(
+        "clientId not provided \u2014 approval check is disabled (all users pass). \uC124\uC815 \uB204\uB77D\uC774 \uC544\uB2CC\uC9C0 \uD655\uC778\uD560 \uAC83."
+      );
+    }
+    return true;
+  }
+  return approvedClients.includes(clientId) || approvedClients.includes("*");
+}
+
+// src/server/user.ts
 function claimsToUser(claims) {
   return {
     uid: claims.sub,

package/dist/server/index.js.map

@@ -1 +1 @@
-{"version":3,"sources":["../../src/server/verify.ts","../../src/server/user.ts","../../src/server/refresh.ts"],"sourcesContent":["import { createRemoteJWKSet, jwtVerify } from \"jose\";\nimport { cookies } from \"next/headers\";\nimport type { AccessTokenClaims } from \"../types.js\";\nimport { JWKS_URL, AUTH_SERVER_URL, ACCESS_TOKEN_COOKIE } from \"../constants.js\";\nimport { isAccessTokenClaims } from \"../claims.js\";\nimport { getMockAccessTokenClaims } from \"../mock.js\";\nimport { warnAuth, errorCode } from \"../log.js\";\n\nconst jwks = createRemoteJWKSet(new URL(JWKS_URL));\n\n/**\n * 검증과 진단을 한 곳에 모은다.\n *\n * 예전에는 아래 두 export 가 같은 try/catch 를 각자 갖고 있었다. 그러면\n * 로깅을 붙일 때도 벌마다 갈리고, 한쪽만 고치는 일이 생긴다.\n */\nasync function verify(token: string): Promise<AccessTokenClaims | null> {\n  try {\n    const { payload } = await jwtVerify(token, jwks, {\n      issuer: AUTH_SERVER_URL,\n    });\n    if (isAccessTokenClaims(payload)) return payload;\n    warnAuth(\"access token claims shape mismatch\");\n    return null;\n  } catch (error) {\n    // 정상 만료는 갱신으로 이어지는 흔한 경로라 남기지 않는다. 나머지는\n    // 원인이 전혀 다르다 — 특히 ERR_JWKS_NO_MATCHING_KEY 는 키 로테이션이나\n    // JWKS 도달 실패이고, 이걸 위조 토큰과 뭉개면 전 사용자가 조용히\n    // 로그아웃된 이유를 알 수 없게 된다.\n    const code = errorCode(error);\n    if (code !== \"ERR_JWT_EXPIRED\") {\n      warnAuth(\"access token verification failed\", { code });\n    }\n    return null;\n  }\n}\n\nexport async function verifyAccessToken(): Promise<AccessTokenClaims | null> {\n  const mockClaims = getMockAccessTokenClaims();\n  if (mockClaims) return mockClaims;\n\n  const cookieStore = await cookies();\n  const token = cookieStore.get(ACCESS_TOKEN_COOKIE)?.value;\n  if (!token) return null;\n\n  return verify(token);\n}\n\nexport async function verifyAccessTokenString(\n  token: string\n): Promise<AccessTokenClaims | null> {\n  const mockClaims = getMockAccessTokenClaims();\n  if (mockClaims) return mockClaims;\n\n  return verify(token);\n}\n","import { cache } from \"react\";\nimport { redirect } from \"next/navigation\";\nimport type { LemonSession, LemonUser } from \"../types.js\";\nimport { AUTH_SERVER_URL } from \"../constants.js\";\nimport { isApprovedClient } from \"../approval.js\";\nimport { verifyAccessToken } from \"./verify.js\";\n\nfunction claimsToUser(\n  claims: NonNullable<Awaited<ReturnType<typeof verifyAccessToken>>>\n): LemonUser {\n  return {\n    uid: claims.sub,\n    nickname: claims.nickname,\n    profileImageUrl: claims.profile_image_url,\n    role: claims.role,\n    approvedClients: claims.approved_clients,\n  };\n}\n\nexport const getUser = cache(async (): Promise<LemonUser | null> => {\n  const claims = await verifyAccessToken();\n  if (!claims) return null;\n  return claimsToUser(claims);\n});\n\nexport interface GetSessionOptions {\n  clientId?: string;\n}\n\nconst getSessionByClientId = cache(\n  async (clientId?: string): Promise<LemonSession> => {\n    const user = await getUser();\n    if (!user) return { type: \"none\" };\n    if (!isApprovedClient(user.approvedClients, clientId)) {\n      return { type: \"unapproved\", user };\n    }\n    return { type: \"authenticated\", user };\n  }\n);\n\nexport async function getSession(\n  options: GetSessionOptions = {}\n): Promise<LemonSession> {\n  return getSessionByClientId(options.clientId);\n}\n\nexport async function requireAuth(redirectTo = \"/\"): Promise<LemonUser> {\n  const user = await getUser();\n  if (user) return user;\n  redirect(redirectTo);\n}\n\nexport interface RequireClientOptions {\n  loginRedirectTo?: string;\n  unapprovedRedirectTo?: string;\n}\n\nexport async function requireClient(\n  clientId: string,\n  optionsOrRedirectTo: string | RequireClientOptions = \"/\"\n): Promise<LemonUser> {\n  const options =\n    typeof optionsOrRedirectTo === \"string\"\n      ? { loginRedirectTo: optionsOrRedirectTo }\n      : optionsOrRedirectTo;\n  const session = await getSession({ clientId });\n  if (session.type === \"none\") {\n    redirect(options.loginRedirectTo ?? \"/\");\n  }\n  if (session.type === \"unapproved\") {\n    redirect(\n      options.unapprovedRedirectTo ??\n        `${AUTH_SERVER_URL}/error?code=FORBIDDEN`\n    );\n  }\n  return session.user;\n}\n","import {\n  DEVICE_ID_COOKIE,\n  REFRESH_TOKEN_COOKIE,\n  REFRESH_URL,\n} from \"../constants.js\";\nimport { isMockAuthEnabled } from \"../mock.js\";\nimport { warnAuth } from \"../log.js\";\n\nexport interface RefreshResult {\n  ok: boolean;\n  setCookieHeaders: string[];\n}\n\nexport async function refreshTokenFromCookie(\n  refreshTokenCookie: string,\n  deviceIdCookie?: string\n): Promise<RefreshResult> {\n  if (isMockAuthEnabled()) {\n    return { ok: true, setCookieHeaders: [] };\n  }\n\n  const res = await fetch(REFRESH_URL, {\n    method: \"POST\",\n    headers: {\n      Cookie: buildRefreshCookieHeader(refreshTokenCookie, deviceIdCookie),\n    },\n  });\n\n  if (!res.ok) {\n    // proxy 의 tryRefresh 와 같은 이유로 남긴다. 이 요청도 서버에서 나가므로\n    // auth 서버 앞의 WAF · 봇 방어에 걸리면 origin 에 흔적이 남지 않는다.\n    // (이 함수는 proxy 와 달리 네트워크 예외를 잡지 않고 호출자에게 던진다)\n    warnAuth(\"token refresh rejected\", {\n      status: res.status,\n      server: res.headers.get(\"server\"),\n      cfRay: res.headers.get(\"cf-ray\"),\n      cfMitigated: res.headers.get(\"cf-mitigated\"),\n    });\n    return { ok: false, setCookieHeaders: [] };\n  }\n\n  const setCookieHeaders = res.headers.getSetCookie();\n  return { ok: true, setCookieHeaders };\n}\n\nfunction buildRefreshCookieHeader(\n  refreshTokenCookie: string,\n  deviceIdCookie?: string\n): string {\n  const cookies = [`${REFRESH_TOKEN_COOKIE}=${refreshTokenCookie}`];\n  if (deviceIdCookie) {\n    cookies.push(`${DEVICE_ID_COOKIE}=${deviceIdCookie}`);\n  }\n  return cookies.join(\"; \");\n}\n"],"mappings":";;;;;;;;;;;;;;;;;;;;;;AAAA,SAAS,oBAAoB,iBAAiB;AAC9C,SAAS,eAAe;AAOxB,IAAM,OAAO,mBAAmB,IAAI,IAAI,QAAQ,CAAC;AAQjD,eAAe,OAAO,OAAkD;AACtE,MAAI;AACF,UAAM,EAAE,QAAQ,IAAI,MAAM,UAAU,OAAO,MAAM;AAAA,MAC/C,QAAQ;AAAA,IACV,CAAC;AACD,QAAI,oBAAoB,OAAO,EAAG,QAAO;AACzC,aAAS,oCAAoC;AAC7C,WAAO;AAAA,EACT,SAAS,OAAO;AAKd,UAAM,OAAO,UAAU,KAAK;AAC5B,QAAI,SAAS,mBAAmB;AAC9B,eAAS,oCAAoC,EAAE,KAAK,CAAC;AAAA,IACvD;AACA,WAAO;AAAA,EACT;AACF;AAEA,eAAsB,oBAAuD;AAC3E,QAAM,aAAa,yBAAyB;AAC5C,MAAI,WAAY,QAAO;AAEvB,QAAM,cAAc,MAAM,QAAQ;AAClC,QAAM,QAAQ,YAAY,IAAI,mBAAmB,GAAG;AACpD,MAAI,CAAC,MAAO,QAAO;AAEnB,SAAO,OAAO,KAAK;AACrB;AAEA,eAAsB,wBACpB,OACmC;AACnC,QAAM,aAAa,yBAAyB;AAC5C,MAAI,WAAY,QAAO;AAEvB,SAAO,OAAO,KAAK;AACrB;;;ACvDA,SAAS,aAAa;AACtB,SAAS,gBAAgB;AAMzB,SAAS,aACP,QACW;AACX,SAAO;AAAA,IACL,KAAK,OAAO;AAAA,IACZ,UAAU,OAAO;AAAA,IACjB,iBAAiB,OAAO;AAAA,IACxB,MAAM,OAAO;AAAA,IACb,iBAAiB,OAAO;AAAA,EAC1B;AACF;AAEO,IAAM,UAAU,MAAM,YAAuC;AAClE,QAAM,SAAS,MAAM,kBAAkB;AACvC,MAAI,CAAC,OAAQ,QAAO;AACpB,SAAO,aAAa,MAAM;AAC5B,CAAC;AAMD,IAAM,uBAAuB;AAAA,EAC3B,OAAO,aAA6C;AAClD,UAAM,OAAO,MAAM,QAAQ;AAC3B,QAAI,CAAC,KAAM,QAAO,EAAE,MAAM,OAAO;AACjC,QAAI,CAAC,iBAAiB,KAAK,iBAAiB,QAAQ,GAAG;AACrD,aAAO,EAAE,MAAM,cAAc,KAAK;AAAA,IACpC;AACA,WAAO,EAAE,MAAM,iBAAiB,KAAK;AAAA,EACvC;AACF;AAEA,eAAsB,WACpB,UAA6B,CAAC,GACP;AACvB,SAAO,qBAAqB,QAAQ,QAAQ;AAC9C;AAEA,eAAsB,YAAY,aAAa,KAAyB;AACtE,QAAM,OAAO,MAAM,QAAQ;AAC3B,MAAI,KAAM,QAAO;AACjB,WAAS,UAAU;AACrB;AAOA,eAAsB,cACpB,UACA,sBAAqD,KACjC;AACpB,QAAM,UACJ,OAAO,wBAAwB,WAC3B,EAAE,iBAAiB,oBAAoB,IACvC;AACN,QAAM,UAAU,MAAM,WAAW,EAAE,SAAS,CAAC;AAC7C,MAAI,QAAQ,SAAS,QAAQ;AAC3B,aAAS,QAAQ,mBAAmB,GAAG;AAAA,EACzC;AACA,MAAI,QAAQ,SAAS,cAAc;AACjC;AAAA,MACE,QAAQ,wBACN,GAAG,eAAe;AAAA,IACtB;AAAA,EACF;AACA,SAAO,QAAQ;AACjB;;;AC/DA,eAAsB,uBACpB,oBACA,gBACwB;AACxB,MAAI,kBAAkB,GAAG;AACvB,WAAO,EAAE,IAAI,MAAM,kBAAkB,CAAC,EAAE;AAAA,EAC1C;AAEA,QAAM,MAAM,MAAM,MAAM,aAAa;AAAA,IACnC,QAAQ;AAAA,IACR,SAAS;AAAA,MACP,QAAQ,yBAAyB,oBAAoB,cAAc;AAAA,IACrE;AAAA,EACF,CAAC;AAED,MAAI,CAAC,IAAI,IAAI;AAIX,aAAS,0BAA0B;AAAA,MACjC,QAAQ,IAAI;AAAA,MACZ,QAAQ,IAAI,QAAQ,IAAI,QAAQ;AAAA,MAChC,OAAO,IAAI,QAAQ,IAAI,QAAQ;AAAA,MAC/B,aAAa,IAAI,QAAQ,IAAI,cAAc;AAAA,IAC7C,CAAC;AACD,WAAO,EAAE,IAAI,OAAO,kBAAkB,CAAC,EAAE;AAAA,EAC3C;AAEA,QAAM,mBAAmB,IAAI,QAAQ,aAAa;AAClD,SAAO,EAAE,IAAI,MAAM,iBAAiB;AACtC;AAEA,SAAS,yBACP,oBACA,gBACQ;AACR,QAAMA,WAAU,CAAC,GAAG,oBAAoB,IAAI,kBAAkB,EAAE;AAChE,MAAI,gBAAgB;AAClB,IAAAA,SAAQ,KAAK,GAAG,gBAAgB,IAAI,cAAc,EAAE;AAAA,EACtD;AACA,SAAOA,SAAQ,KAAK,IAAI;AAC1B;","names":["cookies"]}
+{"version":3,"sources":["../../src/server/verify.ts","../../src/claims.ts","../../src/log.ts","../../src/server/user.ts","../../src/approval.ts","../../src/server/refresh.ts"],"sourcesContent":["import { createRemoteJWKSet, jwtVerify } from \"jose\";\nimport { cookies } from \"next/headers\";\nimport type { AccessTokenClaims } from \"../types.js\";\nimport { JWKS_URL, AUTH_SERVER_URL, ACCESS_TOKEN_COOKIE } from \"../constants.js\";\nimport { isAccessTokenClaims } from \"../claims.js\";\nimport { getMockAccessTokenClaims } from \"../mock.js\";\nimport { warnAuth, errorCode } from \"../log.js\";\n\nconst jwks = createRemoteJWKSet(new URL(JWKS_URL));\n\n/**\n * 검증과 진단을 한 곳에 모은다.\n *\n * 예전에는 아래 두 export 가 같은 try/catch 를 각자 갖고 있었다. 그러면\n * 로깅을 붙일 때도 벌마다 갈리고, 한쪽만 고치는 일이 생긴다.\n */\nasync function verify(token: string): Promise<AccessTokenClaims | null> {\n  try {\n    const { payload } = await jwtVerify(token, jwks, {\n      issuer: AUTH_SERVER_URL,\n    });\n    if (isAccessTokenClaims(payload)) return payload;\n    warnAuth(\"access token claims shape mismatch\");\n    return null;\n  } catch (error) {\n    // 정상 만료는 갱신으로 이어지는 흔한 경로라 남기지 않는다. 나머지는\n    // 원인이 전혀 다르다 — 특히 ERR_JWKS_NO_MATCHING_KEY 는 키 로테이션이나\n    // JWKS 도달 실패이고, 이걸 위조 토큰과 뭉개면 전 사용자가 조용히\n    // 로그아웃된 이유를 알 수 없게 된다.\n    const code = errorCode(error);\n    if (code !== \"ERR_JWT_EXPIRED\") {\n      warnAuth(\"access token verification failed\", { code });\n    }\n    return null;\n  }\n}\n\nexport async function verifyAccessToken(): Promise<AccessTokenClaims | null> {\n  const mockClaims = getMockAccessTokenClaims();\n  if (mockClaims) return mockClaims;\n\n  const cookieStore = await cookies();\n  const token = cookieStore.get(ACCESS_TOKEN_COOKIE)?.value;\n  if (!token) return null;\n\n  return verify(token);\n}\n\nexport async function verifyAccessTokenString(\n  token: string\n): Promise<AccessTokenClaims | null> {\n  const mockClaims = getMockAccessTokenClaims();\n  if (mockClaims) return mockClaims;\n\n  return verify(token);\n}\n","import type { JWTPayload } from \"jose\";\nimport type { AccessTokenClaims } from \"./types.js\";\n\nexport function isAccessTokenClaims(\n  payload: JWTPayload\n): payload is AccessTokenClaims {\n  return (\n    payload.token_type === \"access\" &&\n    typeof payload.sub === \"string\" &&\n    typeof payload.nickname === \"string\" &&\n    typeof payload.profile_image_url === \"string\" &&\n    (payload.role === \"user\" || payload.role === \"admin\") &&\n    Array.isArray(payload.approved_clients) &&\n    payload.approved_clients.every((clientId) => typeof clientId === \"string\")\n  );\n}\n","/**\n * 진단 로그.\n *\n * 이 라이브러리는 오랫동안 실패를 전부 `null` 하나로만 알렸다. 2026-07-19 에\n * auth 서버 앞의 Cloudflare Bot Fight Mode 가 프록시의 갱신 요청을 403\n * (`cf-mitigated: challenge`) 으로 막았을 때, 남은 흔적이 하나도 없어서\n * 원인을 찾는 데 반나절이 걸렸다. 앱 쪽에 임시 진단 코드를 심고 프로덕션에\n * 두 번 배포한 뒤에야 응답 코드를 볼 수 있었다.\n *\n * 그래서 실패에는 최소한의 사실을 남긴다.\n *\n * **토큰 값은 절대 남기지 않는다.** JWT 는 base64url 이라 \"접두 8자\" 같은\n * 안전해 보이는 일부만으로도 헤더와 payload 앞부분이 그대로 복원된다.\n * `sub`, `nickname`, `approved_clients` 가 거기 들어 있다. 남길 수 있는 것은\n * 쿠키 **이름**, HTTP 상태 코드, 에러 코드처럼 값이 아닌 사실뿐이다.\n */\n\nconst PREFIX = \"[lemon-auth]\";\n\nexport function warnAuth(\n  event: string,\n  detail?: Record<string, unknown>\n): void {\n  if (detail === undefined) {\n    console.warn(`${PREFIX} ${event}`);\n    return;\n  }\n  console.warn(`${PREFIX} ${event}`, JSON.stringify(detail));\n}\n\n/**\n * 에러에서 값 노출 없이 식별자만 뽑는다.\n *\n * jose 는 `ERR_JWKS_NO_MATCHING_KEY`(키 로테이션), `ERR_JWT_EXPIRED`(정상 만료),\n * `ERR_JWS_SIGNATURE_VERIFICATION_FAILED`(위조 또는 설정 오류) 처럼 원인이\n * 전혀 다른 실패를 구분 가능한 `code` 로 준다. 이걸 뭉개면 JWKS 장애와\n * 위조 토큰이 같은 증상으로 보인다.\n *\n * undici 의 네트워크 실패는 `cause.code` 에 `ENOTFOUND` 같은 값이 들어간다.\n */\nexport function errorCode(error: unknown): string {\n  if (typeof error === \"object\" && error !== null) {\n    const { code, cause } = error as { code?: unknown; cause?: unknown };\n    if (typeof code === \"string\") return code;\n    if (typeof cause === \"object\" && cause !== null) {\n      const causeCode = (cause as { code?: unknown }).code;\n      if (typeof causeCode === \"string\") return causeCode;\n    }\n  }\n  if (error instanceof Error) return error.name;\n  return \"unknown\";\n}\n","import { cache } from \"react\";\nimport { redirect } from \"next/navigation\";\nimport type { LemonSession, LemonUser } from \"../types.js\";\nimport { AUTH_SERVER_URL } from \"../constants.js\";\nimport { isApprovedClient } from \"../approval.js\";\nimport { verifyAccessToken } from \"./verify.js\";\n\nfunction claimsToUser(\n  claims: NonNullable<Awaited<ReturnType<typeof verifyAccessToken>>>\n): LemonUser {\n  return {\n    uid: claims.sub,\n    nickname: claims.nickname,\n    profileImageUrl: claims.profile_image_url,\n    role: claims.role,\n    approvedClients: claims.approved_clients,\n  };\n}\n\nexport const getUser = cache(async (): Promise<LemonUser | null> => {\n  const claims = await verifyAccessToken();\n  if (!claims) return null;\n  return claimsToUser(claims);\n});\n\nexport interface GetSessionOptions {\n  clientId?: string;\n}\n\nconst getSessionByClientId = cache(\n  async (clientId?: string): Promise<LemonSession> => {\n    const user = await getUser();\n    if (!user) return { type: \"none\" };\n    if (!isApprovedClient(user.approvedClients, clientId)) {\n      return { type: \"unapproved\", user };\n    }\n    return { type: \"authenticated\", user };\n  }\n);\n\nexport async function getSession(\n  options: GetSessionOptions = {}\n): Promise<LemonSession> {\n  return getSessionByClientId(options.clientId);\n}\n\nexport async function requireAuth(redirectTo = \"/\"): Promise<LemonUser> {\n  const user = await getUser();\n  if (user) return user;\n  redirect(redirectTo);\n}\n\nexport interface RequireClientOptions {\n  loginRedirectTo?: string;\n  unapprovedRedirectTo?: string;\n}\n\nexport async function requireClient(\n  clientId: string,\n  optionsOrRedirectTo: string | RequireClientOptions = \"/\"\n): Promise<LemonUser> {\n  const options =\n    typeof optionsOrRedirectTo === \"string\"\n      ? { loginRedirectTo: optionsOrRedirectTo }\n      : optionsOrRedirectTo;\n  const session = await getSession({ clientId });\n  if (session.type === \"none\") {\n    redirect(options.loginRedirectTo ?? \"/\");\n  }\n  if (session.type === \"unapproved\") {\n    redirect(\n      options.unapprovedRedirectTo ??\n        `${AUTH_SERVER_URL}/error?code=FORBIDDEN`\n    );\n  }\n  return session.user;\n}\n","import { warnAuth } from \"./log.js\";\n\n/** fail-open 경고를 요청마다 찍지 않기 위한 플래그. */\nlet warnedMissingClientId = false;\n\nexport function isApprovedClient(\n  approvedClients: string[],\n  clientId?: string\n): boolean {\n  if (!clientId) {\n    // clientId 를 안 넘기면 승인 검사가 통째로 열린다(fail-open). 이 라이브러리를\n    // clientId 없이 쓰는 앱도 있으므로 동작은 유지하지만, 환경변수가 배포에서\n    // 빠져서 이렇게 된 경우와 구분이 안 된다. 후자는 인증이 사실상 없는 상태라\n    // 조용히 넘어가면 안 된다.\n    if (!warnedMissingClientId) {\n      warnedMissingClientId = true;\n      warnAuth(\n        \"clientId not provided — approval check is disabled (all users pass). \" +\n          \"설정 누락이 아닌지 확인할 것.\"\n      );\n    }\n    return true;\n  }\n  return approvedClients.includes(clientId) || approvedClients.includes(\"*\");\n}\n","import {\n  DEVICE_ID_COOKIE,\n  REFRESH_TOKEN_COOKIE,\n  REFRESH_URL,\n} from \"../constants.js\";\nimport { isMockAuthEnabled } from \"../mock.js\";\nimport { warnAuth } from \"../log.js\";\n\nexport interface RefreshResult {\n  ok: boolean;\n  setCookieHeaders: string[];\n}\n\nexport async function refreshTokenFromCookie(\n  refreshTokenCookie: string,\n  deviceIdCookie?: string\n): Promise<RefreshResult> {\n  if (isMockAuthEnabled()) {\n    return { ok: true, setCookieHeaders: [] };\n  }\n\n  const res = await fetch(REFRESH_URL, {\n    method: \"POST\",\n    headers: {\n      Cookie: buildRefreshCookieHeader(refreshTokenCookie, deviceIdCookie),\n    },\n  });\n\n  if (!res.ok) {\n    // proxy 의 tryRefresh 와 같은 이유로 남긴다. 이 요청도 서버에서 나가므로\n    // auth 서버 앞의 WAF · 봇 방어에 걸리면 origin 에 흔적이 남지 않는다.\n    // (이 함수는 proxy 와 달리 네트워크 예외를 잡지 않고 호출자에게 던진다)\n    warnAuth(\"token refresh rejected\", {\n      status: res.status,\n      server: res.headers.get(\"server\"),\n      cfRay: res.headers.get(\"cf-ray\"),\n      cfMitigated: res.headers.get(\"cf-mitigated\"),\n    });\n    return { ok: false, setCookieHeaders: [] };\n  }\n\n  const setCookieHeaders = res.headers.getSetCookie();\n  return { ok: true, setCookieHeaders };\n}\n\nfunction buildRefreshCookieHeader(\n  refreshTokenCookie: string,\n  deviceIdCookie?: string\n): string {\n  const cookies = [`${REFRESH_TOKEN_COOKIE}=${refreshTokenCookie}`];\n  if (deviceIdCookie) {\n    cookies.push(`${DEVICE_ID_COOKIE}=${deviceIdCookie}`);\n  }\n  return cookies.join(\"; \");\n}\n"],"mappings":";;;;;;;;;;;;;;;;AAAA,SAAS,oBAAoB,iBAAiB;AAC9C,SAAS,eAAe;;;ACEjB,SAAS,oBACd,SAC8B;AAC9B,SACE,QAAQ,eAAe,YACvB,OAAO,QAAQ,QAAQ,YACvB,OAAO,QAAQ,aAAa,YAC5B,OAAO,QAAQ,sBAAsB,aACpC,QAAQ,SAAS,UAAU,QAAQ,SAAS,YAC7C,MAAM,QAAQ,QAAQ,gBAAgB,KACtC,QAAQ,iBAAiB,MAAM,CAAC,aAAa,OAAO,aAAa,QAAQ;AAE7E;;;ACEA,IAAM,SAAS;AAER,SAAS,SACd,OACA,QACM;AACN,MAAI,WAAW,QAAW;AACxB,YAAQ,KAAK,GAAG,MAAM,IAAI,KAAK,EAAE;AACjC;AAAA,EACF;AACA,UAAQ,KAAK,GAAG,MAAM,IAAI,KAAK,IAAI,KAAK,UAAU,MAAM,CAAC;AAC3D;AAYO,SAAS,UAAU,OAAwB;AAChD,MAAI,OAAO,UAAU,YAAY,UAAU,MAAM;AAC/C,UAAM,EAAE,MAAM,MAAM,IAAI;AACxB,QAAI,OAAO,SAAS,SAAU,QAAO;AACrC,QAAI,OAAO,UAAU,YAAY,UAAU,MAAM;AAC/C,YAAM,YAAa,MAA6B;AAChD,UAAI,OAAO,cAAc,SAAU,QAAO;AAAA,IAC5C;AAAA,EACF;AACA,MAAI,iBAAiB,MAAO,QAAO,MAAM;AACzC,SAAO;AACT;;;AF3CA,IAAM,OAAO,mBAAmB,IAAI,IAAI,QAAQ,CAAC;AAQjD,eAAe,OAAO,OAAkD;AACtE,MAAI;AACF,UAAM,EAAE,QAAQ,IAAI,MAAM,UAAU,OAAO,MAAM;AAAA,MAC/C,QAAQ;AAAA,IACV,CAAC;AACD,QAAI,oBAAoB,OAAO,EAAG,QAAO;AACzC,aAAS,oCAAoC;AAC7C,WAAO;AAAA,EACT,SAAS,OAAO;AAKd,UAAM,OAAO,UAAU,KAAK;AAC5B,QAAI,SAAS,mBAAmB;AAC9B,eAAS,oCAAoC,EAAE,KAAK,CAAC;AAAA,IACvD;AACA,WAAO;AAAA,EACT;AACF;AAEA,eAAsB,oBAAuD;AAC3E,QAAM,aAAa,yBAAyB;AAC5C,MAAI,WAAY,QAAO;AAEvB,QAAM,cAAc,MAAM,QAAQ;AAClC,QAAM,QAAQ,YAAY,IAAI,mBAAmB,GAAG;AACpD,MAAI,CAAC,MAAO,QAAO;AAEnB,SAAO,OAAO,KAAK;AACrB;AAEA,eAAsB,wBACpB,OACmC;AACnC,QAAM,aAAa,yBAAyB;AAC5C,MAAI,WAAY,QAAO;AAEvB,SAAO,OAAO,KAAK;AACrB;;;AGvDA,SAAS,aAAa;AACtB,SAAS,gBAAgB;;;ACEzB,IAAI,wBAAwB;AAErB,SAAS,iBACd,iBACA,UACS;AACT,MAAI,CAAC,UAAU;AAKb,QAAI,CAAC,uBAAuB;AAC1B,8BAAwB;AACxB;AAAA,QACE;AAAA,MAEF;AAAA,IACF;AACA,WAAO;AAAA,EACT;AACA,SAAO,gBAAgB,SAAS,QAAQ,KAAK,gBAAgB,SAAS,GAAG;AAC3E;;;ADjBA,SAAS,aACP,QACW;AACX,SAAO;AAAA,IACL,KAAK,OAAO;AAAA,IACZ,UAAU,OAAO;AAAA,IACjB,iBAAiB,OAAO;AAAA,IACxB,MAAM,OAAO;AAAA,IACb,iBAAiB,OAAO;AAAA,EAC1B;AACF;AAEO,IAAM,UAAU,MAAM,YAAuC;AAClE,QAAM,SAAS,MAAM,kBAAkB;AACvC,MAAI,CAAC,OAAQ,QAAO;AACpB,SAAO,aAAa,MAAM;AAC5B,CAAC;AAMD,IAAM,uBAAuB;AAAA,EAC3B,OAAO,aAA6C;AAClD,UAAM,OAAO,MAAM,QAAQ;AAC3B,QAAI,CAAC,KAAM,QAAO,EAAE,MAAM,OAAO;AACjC,QAAI,CAAC,iBAAiB,KAAK,iBAAiB,QAAQ,GAAG;AACrD,aAAO,EAAE,MAAM,cAAc,KAAK;AAAA,IACpC;AACA,WAAO,EAAE,MAAM,iBAAiB,KAAK;AAAA,EACvC;AACF;AAEA,eAAsB,WACpB,UAA6B,CAAC,GACP;AACvB,SAAO,qBAAqB,QAAQ,QAAQ;AAC9C;AAEA,eAAsB,YAAY,aAAa,KAAyB;AACtE,QAAM,OAAO,MAAM,QAAQ;AAC3B,MAAI,KAAM,QAAO;AACjB,WAAS,UAAU;AACrB;AAOA,eAAsB,cACpB,UACA,sBAAqD,KACjC;AACpB,QAAM,UACJ,OAAO,wBAAwB,WAC3B,EAAE,iBAAiB,oBAAoB,IACvC;AACN,QAAM,UAAU,MAAM,WAAW,EAAE,SAAS,CAAC;AAC7C,MAAI,QAAQ,SAAS,QAAQ;AAC3B,aAAS,QAAQ,mBAAmB,GAAG;AAAA,EACzC;AACA,MAAI,QAAQ,SAAS,cAAc;AACjC;AAAA,MACE,QAAQ,wBACN,GAAG,eAAe;AAAA,IACtB;AAAA,EACF;AACA,SAAO,QAAQ;AACjB;;;AE/DA,eAAsB,uBACpB,oBACA,gBACwB;AACxB,MAAI,kBAAkB,GAAG;AACvB,WAAO,EAAE,IAAI,MAAM,kBAAkB,CAAC,EAAE;AAAA,EAC1C;AAEA,QAAM,MAAM,MAAM,MAAM,aAAa;AAAA,IACnC,QAAQ;AAAA,IACR,SAAS;AAAA,MACP,QAAQ,yBAAyB,oBAAoB,cAAc;AAAA,IACrE;AAAA,EACF,CAAC;AAED,MAAI,CAAC,IAAI,IAAI;AAIX,aAAS,0BAA0B;AAAA,MACjC,QAAQ,IAAI;AAAA,MACZ,QAAQ,IAAI,QAAQ,IAAI,QAAQ;AAAA,MAChC,OAAO,IAAI,QAAQ,IAAI,QAAQ;AAAA,MAC/B,aAAa,IAAI,QAAQ,IAAI,cAAc;AAAA,IAC7C,CAAC;AACD,WAAO,EAAE,IAAI,OAAO,kBAAkB,CAAC,EAAE;AAAA,EAC3C;AAEA,QAAM,mBAAmB,IAAI,QAAQ,aAAa;AAClD,SAAO,EAAE,IAAI,MAAM,iBAAiB;AACtC;AAEA,SAAS,yBACP,oBACA,gBACQ;AACR,QAAMA,WAAU,CAAC,GAAG,oBAAoB,IAAI,kBAAkB,EAAE;AAChE,MAAI,gBAAgB;AAClB,IAAAA,SAAQ,KAAK,GAAG,gBAAgB,IAAI,cAAc,EAAE;AAAA,EACtD;AACA,SAAOA,SAAQ,KAAK,IAAI;AAC1B;","names":["cookies"]}

package/package.json

@@ -1,6 +1,6 @@
 {
   "name": "@lemondouble/lemon-auth",
-  "version": "0.7.2",
+  "version": "0.8.0",
   "repository": {
     "type": "git",
     "url": "https://github.com/LemonDouble/lemon-auth"
@@ -24,13 +24,6 @@
   "files": [
     "dist"
   ],
-  "scripts": {
-    "build": "tsup",
-    "dev": "tsup --watch",
-    "typecheck": "tsc --noEmit",
-    "prepublishOnly": "pnpm run build"
-  },
-  "packageManager": "pnpm@10.25.0",
   "peerDependencies": {
     "next": ">=16.0.0",
     "react": ">=19.0.0"
@@ -51,5 +44,10 @@
     "@types/react": "^19.2.14",
     "tsup": "^8.5.1",
     "typescript": "^6.0.3"
+  },
+  "scripts": {
+    "build": "tsup",
+    "dev": "tsup --watch",
+    "typecheck": "tsc --noEmit"
   }
-}
+}

package/dist/chunk-K4U4PHX6.js

@@ -1,49 +0,0 @@
-// src/claims.ts
-function isAccessTokenClaims(payload) {
-  return payload.token_type === "access" && typeof payload.sub === "string" && typeof payload.nickname === "string" && typeof payload.profile_image_url === "string" && (payload.role === "user" || payload.role === "admin") && Array.isArray(payload.approved_clients) && payload.approved_clients.every((clientId) => typeof clientId === "string");
-}
-
-// src/log.ts
-var PREFIX = "[lemon-auth]";
-function warnAuth(event, detail) {
-  if (detail === void 0) {
-    console.warn(`${PREFIX} ${event}`);
-    return;
-  }
-  console.warn(`${PREFIX} ${event}`, JSON.stringify(detail));
-}
-function errorCode(error) {
-  if (typeof error === "object" && error !== null) {
-    const { code, cause } = error;
-    if (typeof code === "string") return code;
-    if (typeof cause === "object" && cause !== null) {
-      const causeCode = cause.code;
-      if (typeof causeCode === "string") return causeCode;
-    }
-  }
-  if (error instanceof Error) return error.name;
-  return "unknown";
-}
-
-// src/approval.ts
-var warnedMissingClientId = false;
-function isApprovedClient(approvedClients, clientId) {
-  if (!clientId) {
-    if (!warnedMissingClientId) {
-      warnedMissingClientId = true;
-      warnAuth(
-        "clientId not provided \u2014 approval check is disabled (all users pass). \uC124\uC815 \uB204\uB77D\uC774 \uC544\uB2CC\uC9C0 \uD655\uC778\uD560 \uAC83."
-      );
-    }
-    return true;
-  }
-  return approvedClients.includes(clientId) || approvedClients.includes("*");
-}
-
-export {
-  isAccessTokenClaims,
-  warnAuth,
-  errorCode,
-  isApprovedClient
-};
-//# sourceMappingURL=chunk-K4U4PHX6.js.map

package/dist/chunk-K4U4PHX6.js.map

@@ -1 +0,0 @@
-{"version":3,"sources":["../src/claims.ts","../src/log.ts","../src/approval.ts"],"sourcesContent":["import type { JWTPayload } from \"jose\";\nimport type { AccessTokenClaims } from \"./types.js\";\n\nexport function isAccessTokenClaims(\n  payload: JWTPayload\n): payload is AccessTokenClaims {\n  return (\n    payload.token_type === \"access\" &&\n    typeof payload.sub === \"string\" &&\n    typeof payload.nickname === \"string\" &&\n    typeof payload.profile_image_url === \"string\" &&\n    (payload.role === \"user\" || payload.role === \"admin\") &&\n    Array.isArray(payload.approved_clients) &&\n    payload.approved_clients.every((clientId) => typeof clientId === \"string\")\n  );\n}\n","/**\n * 진단 로그.\n *\n * 이 라이브러리는 오랫동안 실패를 전부 `null` 하나로만 알렸다. 2026-07-19 에\n * auth 서버 앞의 Cloudflare Bot Fight Mode 가 프록시의 갱신 요청을 403\n * (`cf-mitigated: challenge`) 으로 막았을 때, 남은 흔적이 하나도 없어서\n * 원인을 찾는 데 반나절이 걸렸다. 앱 쪽에 임시 진단 코드를 심고 프로덕션에\n * 두 번 배포한 뒤에야 응답 코드를 볼 수 있었다.\n *\n * 그래서 실패에는 최소한의 사실을 남긴다.\n *\n * **토큰 값은 절대 남기지 않는다.** JWT 는 base64url 이라 \"접두 8자\" 같은\n * 안전해 보이는 일부만으로도 헤더와 payload 앞부분이 그대로 복원된다.\n * `sub`, `nickname`, `approved_clients` 가 거기 들어 있다. 남길 수 있는 것은\n * 쿠키 **이름**, HTTP 상태 코드, 에러 코드처럼 값이 아닌 사실뿐이다.\n */\n\nconst PREFIX = \"[lemon-auth]\";\n\nexport function warnAuth(\n  event: string,\n  detail?: Record<string, unknown>\n): void {\n  if (detail === undefined) {\n    console.warn(`${PREFIX} ${event}`);\n    return;\n  }\n  console.warn(`${PREFIX} ${event}`, JSON.stringify(detail));\n}\n\n/**\n * 에러에서 값 노출 없이 식별자만 뽑는다.\n *\n * jose 는 `ERR_JWKS_NO_MATCHING_KEY`(키 로테이션), `ERR_JWT_EXPIRED`(정상 만료),\n * `ERR_JWS_SIGNATURE_VERIFICATION_FAILED`(위조 또는 설정 오류) 처럼 원인이\n * 전혀 다른 실패를 구분 가능한 `code` 로 준다. 이걸 뭉개면 JWKS 장애와\n * 위조 토큰이 같은 증상으로 보인다.\n *\n * undici 의 네트워크 실패는 `cause.code` 에 `ENOTFOUND` 같은 값이 들어간다.\n */\nexport function errorCode(error: unknown): string {\n  if (typeof error === \"object\" && error !== null) {\n    const { code, cause } = error as { code?: unknown; cause?: unknown };\n    if (typeof code === \"string\") return code;\n    if (typeof cause === \"object\" && cause !== null) {\n      const causeCode = (cause as { code?: unknown }).code;\n      if (typeof causeCode === \"string\") return causeCode;\n    }\n  }\n  if (error instanceof Error) return error.name;\n  return \"unknown\";\n}\n","import { warnAuth } from \"./log.js\";\n\n/** fail-open 경고를 요청마다 찍지 않기 위한 플래그. */\nlet warnedMissingClientId = false;\n\nexport function isApprovedClient(\n  approvedClients: string[],\n  clientId?: string\n): boolean {\n  if (!clientId) {\n    // clientId 를 안 넘기면 승인 검사가 통째로 열린다(fail-open). 이 라이브러리를\n    // clientId 없이 쓰는 앱도 있으므로 동작은 유지하지만, 환경변수가 배포에서\n    // 빠져서 이렇게 된 경우와 구분이 안 된다. 후자는 인증이 사실상 없는 상태라\n    // 조용히 넘어가면 안 된다.\n    if (!warnedMissingClientId) {\n      warnedMissingClientId = true;\n      warnAuth(\n        \"clientId not provided — approval check is disabled (all users pass). \" +\n          \"설정 누락이 아닌지 확인할 것.\"\n      );\n    }\n    return true;\n  }\n  return approvedClients.includes(clientId) || approvedClients.includes(\"*\");\n}\n"],"mappings":";AAGO,SAAS,oBACd,SAC8B;AAC9B,SACE,QAAQ,eAAe,YACvB,OAAO,QAAQ,QAAQ,YACvB,OAAO,QAAQ,aAAa,YAC5B,OAAO,QAAQ,sBAAsB,aACpC,QAAQ,SAAS,UAAU,QAAQ,SAAS,YAC7C,MAAM,QAAQ,QAAQ,gBAAgB,KACtC,QAAQ,iBAAiB,MAAM,CAAC,aAAa,OAAO,aAAa,QAAQ;AAE7E;;;ACEA,IAAM,SAAS;AAER,SAAS,SACd,OACA,QACM;AACN,MAAI,WAAW,QAAW;AACxB,YAAQ,KAAK,GAAG,MAAM,IAAI,KAAK,EAAE;AACjC;AAAA,EACF;AACA,UAAQ,KAAK,GAAG,MAAM,IAAI,KAAK,IAAI,KAAK,UAAU,MAAM,CAAC;AAC3D;AAYO,SAAS,UAAU,OAAwB;AAChD,MAAI,OAAO,UAAU,YAAY,UAAU,MAAM;AAC/C,UAAM,EAAE,MAAM,MAAM,IAAI;AACxB,QAAI,OAAO,SAAS,SAAU,QAAO;AACrC,QAAI,OAAO,UAAU,YAAY,UAAU,MAAM;AAC/C,YAAM,YAAa,MAA6B;AAChD,UAAI,OAAO,cAAc,SAAU,QAAO;AAAA,IAC5C;AAAA,EACF;AACA,MAAI,iBAAiB,MAAO,QAAO,MAAM;AACzC,SAAO;AACT;;;AChDA,IAAI,wBAAwB;AAErB,SAAS,iBACd,iBACA,UACS;AACT,MAAI,CAAC,UAAU;AAKb,QAAI,CAAC,uBAAuB;AAC1B,8BAAwB;AACxB;AAAA,QACE;AAAA,MAEF;AAAA,IACF;AACA,WAAO;AAAA,EACT;AACA,SAAO,gBAAgB,SAAS,QAAQ,KAAK,gBAAgB,SAAS,GAAG;AAC3E;","names":[]}