@lemondouble/lemon-auth 0.9.1 → 0.10.0

package/README.md

@@ -22,7 +22,7 @@ NEXT_PUBLIC_LEMON_AUTH_MOCK_USER='{"uid":"local-user","nickname":"Local User","p
 
 Mock User가 활성화되면:
 
-- `getUser()`, `getSession()`, `requireAuth()`, `requireClient()`는 mock user를 로그인 유저처럼 반환합니다.
+- `getUser()`, `getSession()`, `requireClient()`는 mock user를 로그인 유저처럼 반환합니다.
 - `createAuthProxy()`는 모든 요청을 통과시킵니다. 승인 체크는 DAL에서 수행됩니다.
 - `loginUrl(redirectUrl)`은 `redirectUrl`을 그대로 반환합니다.
 - `profileUrl(redirectUrl?)`은 `redirectUrl ?? "/"`를 반환합니다.
@@ -32,7 +32,7 @@ Mock User가 활성화되면:
 
 | 경로 | 환경 | 용도 |
 |------|------|------|
-| `@lemondouble/lemon-auth/server` | Server Components, Route Handlers, Server Actions | JWT 검증, 유저 조회, 인증 체크 |
+| `@lemondouble/lemon-auth/server` | Server Components, Route Handlers, Server Actions | 유저 조회, 인증 체크, URL 헬퍼 |
 | `@lemondouble/lemon-auth/client` | Client Components | AuthProvider, useAuth 훅, URL 헬퍼 |
 | `@lemondouble/lemon-auth/proxy` | proxy.ts | 쿠키 기반 optimistic check |
 
@@ -42,55 +42,9 @@ Mock User가 활성화되면:
 
 Server Components, Route Handlers, Server Actions에서 사용합니다.
 
-### `verifyAccessToken()`
-
-쿠키에서 `lemon_access_token`을 읽어 JWKS(ES256)로 검증합니다.
-
-```ts
-import { verifyAccessToken } from "@lemondouble/lemon-auth/server";
-
-const claims = await verifyAccessToken();
-// → AccessTokenClaims | null
-```
-
-반환되는 `AccessTokenClaims`:
-
-```ts
-interface AccessTokenClaims {
-  token_type: "access";     // access token 여부
-  sub: string;              // 사용자 UUID
-  nickname: string;         // 닉네임
-  profile_image_url: string; // 프로필 이미지 URL
-  role: "user" | "admin";   // 역할
-  approved_clients: string[]; // 승인된 클라이언트 ID 목록
-  iss: string;              // issuer (https://auth.lemondouble.com)
-  exp: number;              // 만료 시간
-  iat: number;              // 발급 시간
-}
-```
-
-### `verifyAccessTokenString(token)`
-
-토큰 문자열을 직접 전달하여 검증합니다. 쿠키 대신 `Authorization` 헤더 등에서 토큰을 꺼낼 때 사용합니다.
-
-```ts
-import { verifyAccessTokenString } from "@lemondouble/lemon-auth/server";
-
-// Route Handler에서 Authorization 헤더 사용 예시
-export async function GET(request: Request) {
-  const token = request.headers.get("Authorization")?.replace("Bearer ", "");
-  if (!token) return new Response(null, { status: 401 });
-
-  const claims = await verifyAccessTokenString(token);
-  if (!claims) return new Response(null, { status: 401 });
-
-  return Response.json({ userId: claims.sub });
-}
-```
-
 ### `getUser()`
 
-`verifyAccessToken()`을 호출하고 결과를 `LemonUser` 객체로 변환합니다.
+쿠키의 `lemon_access_token`을 JWKS(ES256)로 검증하고 `LemonUser` 객체로 변환합니다.
 React `cache()`로 감싸져 있어서 **같은 요청 내에서 여러 번 호출해도 JWT 검증은 1회만** 실행됩니다.
 
 ```ts
@@ -117,9 +71,9 @@ interface LemonUser {
 }
 ```
 
-### `getSession(options?)`
+### `getSession({ clientId })`
 
-로그인 상태와 클라이언트 승인 상태를 함께 반환합니다.
+로그인 상태와 클라이언트 승인 상태를 함께 반환합니다. `clientId`는 필수입니다. 빈 값(환경변수 누락 등)이면 모든 유저가 `unapproved`가 됩니다. 승인 없이 로그인 여부만 필요하면 `getUser()`를 씁니다.
 
 ```ts
 import { getSession } from "@lemondouble/lemon-auth/server";
@@ -145,28 +99,9 @@ type LemonSession =
   | { type: "authenticated"; user: LemonUser };
 ```
 
-### `requireAuth(redirectTo?)`
-
-인증된 유저를 반환합니다. 미인증이면 `redirectTo`로 redirect합니다.
-
-```ts
-import { requireAuth } from "@lemondouble/lemon-auth/server";
-
-export default async function ProtectedPage() {
-  const user = await requireAuth();        // 미인증 시 "/" 로 redirect
-  // const user = await requireAuth("/login"); // 미인증 시 "/login" 으로 redirect
-
-  return <p>{user.nickname}님의 대시보드</p>;
-}
-```
-
-| 파라미터 | 타입 | 기본값 | 설명 |
-|---------|------|--------|------|
-| `redirectTo` | `string` | `"/"` | 미인증 시 redirect 경로 |
-
 ### `requireClient(clientId, options?)`
 
-`requireAuth()` + `approved_clients` 체크. 관리자가 승인한 사용자만 접근할 수 있는 서비스에서 사용합니다.
+로그인 + `approved_clients` 체크. 관리자가 승인한 사용자만 접근할 수 있는 서비스에서 사용합니다.
 
 ```ts
 import { requireClient } from "@lemondouble/lemon-auth/server";
@@ -186,25 +121,14 @@ export default async function Page() {
 |---------|------|--------|------|
 | `clientId` | `string` | (필수) | 체크할 클라이언트 UUID |
 | `options.loginRedirectTo` | `string` | `"/"` | 미인증 시 redirect 경로 |
-| `options.unapprovedRedirectTo` | `string` | `undefined` | 로그인은 됐지만 클라이언트 미승인 시 redirect 경로. 미설정 시 auth-server `/error?code=FORBIDDEN`로 redirect (proxy 동작과 동일) |
+| `options.unapprovedRedirectTo` | `string` | auth-server `/error?code=FORBIDDEN` | 로그인은 됐지만 클라이언트 미승인 시 redirect 경로 |
 
-### 상수
+### `loginUrl()` / `profileUrl()`
 
-서버 엔트리포인트에서 모든 상수를 re-export합니다.
+Client 엔트리포인트의 같은 함수를 Server Component에서도 쓸 수 있게 re-export합니다. 사용법은 [Client](#client--lemondoublelemon-authclient) 참고.
 
 ```ts
-import {
-  AUTH_SERVER_URL,       // "https://auth.lemondouble.com"
-  JWKS_URL,              // "https://auth.lemondouble.com/.well-known/jwks.json"
-  LOGIN_URL,             // "https://auth.lemondouble.com/api/oauth2/google/login"
-  REFRESH_URL,           // "https://auth.lemondouble.com/api/token/refresh"
-  LOGOUT_URL,            // "https://auth.lemondouble.com/api/token/logout"
-  PROFILE_URL,           // "https://auth.lemondouble.com/api/user/me"
-  PROFILE_PAGE_URL,      // "https://auth.lemondouble.com/profile"
-  ACCESS_TOKEN_COOKIE,   // "lemon_access_token"
-  REFRESH_TOKEN_COOKIE,  // "lemon_refresh_token"
-  DEVICE_ID_COOKIE,      // "device_id"
-} from "@lemondouble/lemon-auth/server";
+import { loginUrl, profileUrl } from "@lemondouble/lemon-auth/server";
 ```
 
 ---
@@ -234,7 +158,6 @@ import { createAuthProxy } from "@lemondouble/lemon-auth/proxy";
 
 export default createAuthProxy({
   publicPaths: ["/", "/about", "/api/public/*"],
-  bypassPaths: ["/workbox-*"],
   loginRedirectUrl: (request) => request.url,
 });
 
@@ -250,23 +173,23 @@ export const config = {
 | 옵션 | 타입 | 기본값 | 설명 |
 |------|------|--------|------|
 | `publicPaths` | `string[]` | `[]` | 로그인 없이 열어둘 경로. 익명이면 통과, 만료 세션이면 복구를 거친다. `*`로 끝나면 prefix 매칭 (예: `"/api/public/*"`) |
-| `bypassPaths` | `string[]` | `[]` | proxy가 아무 판단 없이 통과시킬 추가 경로. 기본 PWA 경로(`/sw.js`, `/manifest.webmanifest` 등)는 항상 bypass |
 | `apiPaths` | `string[]` | `["/api/*"]` | 보호 API 경로. 인증 실패 시 redirect 대신 401 JSON을 반환한다. disable하려면 `[]` |
 | `loginRedirectUrl` | `string \| (request: NextRequest) => string` | `undefined` | 미인증 시 Google 로그인 후 돌아올 URL. deep link 보존이 필요하면 `(request) => request.url` 사용. 미설정 시 `"/"` 로 redirect |
-| `restorePath` | `string` | `"/auth/restore"` | `<SessionRestore />` 를 마운트한 경로. 프록시가 자동으로 통과시키므로 `publicPaths` 에 넣지 않아도 된다 |
 
 #### 동작 방식
 
+`<SessionRestore />`는 반드시 `/auth/restore`에 마운트합니다.
+
 요청은 위에서부터 순서대로 판정됩니다.
 
-1. `restorePath` → 통과 (여기서 복구 경로로 보내면 무한 루프)
-2. bypass 경로 (기본 PWA/정적 리소스 + `bypassPaths`) → 통과
+1. `/auth/restore` → 통과 (여기서 복구 경로로 보내면 무한 루프)
+2. PWA·정적 리소스 경로(`/sw.js`, `/manifest.webmanifest`, `/icons/*` 등) → 통과
 3. `lemon_access_token` 이 있고 만료까지 60초 이상 → 통과
 4. — 여기부터는 만료된 요청 —
    `apiPaths` 매칭 → 공개 경로면 통과, 아니면 `401 { code: "UNAUTHORIZED" }`
 5. 비-GET 요청 (서버 액션 등) → 통과. 리다이렉트하면 액션 프로토콜이
    깨지므로, DAL 이 거부하게 둡니다
-6. `lemon_refresh_token` 있음 → `restorePath?next=<원래 경로>` 로 redirect.
+6. `lemon_refresh_token` 있음 → `/auth/restore?next=<원래 경로>` 로 redirect.
    **공개 경로도 포함입니다**
 7. 공개 경로 → 통과 (익명 방문자)
 8. 나머지 → `loginRedirectUrl` 을 담아 로그인 페이지로 redirect
@@ -277,7 +200,7 @@ export const config = {
 
 **프리페치 요청**: 다른 요청과 똑같이 처리합니다. 통과시키면 만료된 토큰으로
 페이지가 렌더되고 거기서 나온 redirect 가 라우터 캐시에 굳어, 어느 링크를 눌러도
-같은 곳으로 튀게 됩니다. 반면 프록시가 돌려주는 `restorePath` 리다이렉트는 굳어도
+같은 곳으로 튀게 됩니다. 반면 프록시가 돌려주는 복구 경로 리다이렉트는 굳어도
 해가 없습니다 — 복구 경로는 막다른 길이 아니라 세션을 되살리고 `next` 로
 되돌려 보내므로 목적지도 보존됩니다.
 
@@ -299,6 +222,16 @@ createAuthProxy({
 });
 ```
 
+### 0.9.x → 0.10.0 마이그레이션
+
+쓰이지 않던 API를 정리했습니다.
+
+- 제거: `requireAuth`, `verifyAccessToken`, `verifyAccessTokenString`, `/server`의 URL·쿠키 상수, `AccessTokenClaims`·`UserProfile` 타입
+- 제거: proxy의 `bypassPaths`·`restorePath` 옵션, `DEFAULT_AUTH_BYPASS_PATHS`·`DEFAULT_RESTORE_PATH`·`PROXY_AUTH_ERROR`
+- `getSession()`의 `clientId`가 필수가 됐습니다. 빈 값이면 승인 검사를 건너뛰던(fail-open) 동작이 `unapproved`로 바뀝니다.
+- `requireClient()`의 두 번째 인자는 옵션 객체만 받습니다.
+- `LOGIN_URL`·`PROFILE_PAGE_URL`로 URL을 직접 만들던 곳은 `/server`에서 `loginUrl()`·`profileUrl()`을 import해 씁니다.
+
 ### 0.8.x → 0.9.0 마이그레이션
 
 갱신 주체가 `<SessionRestore />` 하나로 통일되고, 실패 처리가 서버로
@@ -309,7 +242,7 @@ createAuthProxy({
 레이아웃에서 마운트와 import 를 지웁니다. 공개 경로의 만료 세션은 이제
 프록시가 복구 경로로 보내 처리합니다.
 
-**2. `publicPaths` 에서 복구 경로 제거** — `restorePath` 는 프록시가 자동으로
+**2. `publicPaths` 에서 복구 경로 제거** — `/auth/restore` 는 프록시가 자동으로
 통과시킵니다. 남겨둬도 해는 없지만 필요 없습니다.
 
 **3. `refreshTokenFromCookie` 제거** — 서버사이드 갱신 진입점이 사라졌습니다.
@@ -330,25 +263,6 @@ createAuthProxy({
 | 상황 | 응답 |
 |------|------|
 | 미인증 (access/refresh 모두 실패) | `401 { "code": "UNAUTHORIZED" }` |
-| 미승인 (`clientId` 미포함) | `403 { "code": "FORBIDDEN" }` |
-
-`PROXY_AUTH_ERROR` 상수와 `ProxyAuthErrorCode` 타입을 export합니다.
-
-```ts
-import { PROXY_AUTH_ERROR } from "@lemondouble/lemon-auth/proxy";
-import type { ProxyAuthErrorCode } from "@lemondouble/lemon-auth/proxy";
-
-const res = await fetch("/api/users");
-if (!res.ok) {
-  const data = (await res.json()) as { code: ProxyAuthErrorCode };
-  if (data.code === PROXY_AUTH_ERROR.UNAUTHORIZED) {
-    // 재로그인 유도
-  }
-  if (data.code === PROXY_AUTH_ERROR.FORBIDDEN) {
-    // "권한 없음" 표시
-  }
-}
-```
 
 `/api/*` 외의 경로(예: tRPC, GraphQL)도 JSON 응답을 받게 하려면 `apiPaths`에 추가합니다.
 
@@ -521,38 +435,9 @@ const ok = await refreshToken();
 
 ## 타입
 
-세 엔트리포인트 모두에서 타입을 import할 수 있습니다.
-
 ```ts
-import type { LemonUser, AccessTokenClaims } from "@lemondouble/lemon-auth/server";
+import type { LemonSession, LemonUser } from "@lemondouble/lemon-auth/server";
 import type { LemonUser } from "@lemondouble/lemon-auth/client";
-import type { LemonUser, AccessTokenClaims } from "@lemondouble/lemon-auth/proxy";
-```
-
-```ts
-interface LemonUser {
-  uid: string;
-  nickname: string;
-  profileImageUrl: string;
-  role: "user" | "admin";
-  approvedClients: string[];
-}
-
-interface AccessTokenClaims extends JWTPayload {
-  token_type: "access";
-  sub: string;
-  nickname: string;
-  profile_image_url: string;
-  role: "user" | "admin";
-  approved_clients: string[];
-}
-
-interface UserProfile {
-  uid: string;
-  nickname: string;
-  profile_image_url: string;
-  role: "user" | "admin";
-}
 ```
 
 ---
@@ -564,10 +449,7 @@ interface UserProfile {
 ### 1. proxy.ts — optimistic check
 
 ```ts
-import {
-  createAuthProxy,
-  DEFAULT_API_PATHS,
-} from "@lemondouble/lemon-auth/proxy";
+import { createAuthProxy } from "@lemondouble/lemon-auth/proxy";
 
 export default createAuthProxy({
   publicPaths: [
@@ -576,8 +458,6 @@ export default createAuthProxy({
     "/pending-approval",
     "/api/public/*",
   ],
-  bypassPaths: ["/workbox-*"],
-  apiPaths: DEFAULT_API_PATHS,
   loginRedirectUrl: (request) => request.url,
 });
 
@@ -589,8 +469,7 @@ export const config = {
 ```
 
 `loginRedirectUrl: (request) => request.url`은 로그인 후 사용자가 원래 요청한 path/query로 돌아오게 합니다.
-`apiPaths`에 매칭되는 보호 API는 인증 실패 시 redirect 대신 `401` JSON 응답을 반환합니다.
-기본 PWA 파일(`/sw.js`, `/manifest.webmanifest` 등)은 항상 bypass되며, 앱에서 추가로 생성하는 workbox 파일은 `bypassPaths`에 넣을 수 있습니다.
+`/api/*` 보호 API는 인증 실패 시 redirect 대신 `401` JSON 응답을 반환합니다.
 복구 경로(`/auth/restore`)는 프록시가 자동으로 통과시키므로 `publicPaths` 에 넣지 않습니다.
 
 사용자 DB 동기화 같은 작업은 **프록시가 아니라 DAL 에서** 하십시오. 프록시는
@@ -677,10 +556,12 @@ export function LoginButton() {
 ### 5. app/dashboard/page.tsx — 보호 페이지
 
 ```tsx
-import { requireAuth } from "@lemondouble/lemon-auth/server";
+import { requireClient } from "@lemondouble/lemon-auth/server";
 
 export default async function Dashboard() {
-  const user = await requireAuth();
+  const user = await requireClient(process.env.CLIENT_ID!, {
+    unapprovedRedirectTo: "/pending-approval",
+  });
   return <h1>{user.nickname}님의 대시보드</h1>;
 }
 ```

package/dist/chunk-ICPDIWYK.js

@@ -0,0 +1,79 @@
+import {
+  LOGIN_URL,
+  LOGOUT_URL,
+  PROFILE_PAGE_URL,
+  REFRESH_URL,
+  isMockAuthEnabled
+} from "./chunk-JIXVTKLG.js";
+
+// src/client/url.ts
+function loginUrl(redirectUrl) {
+  if (isMockAuthEnabled()) return redirectUrl;
+  assertValidLoginRedirectUrl(redirectUrl);
+  return `${LOGIN_URL}?redirect_url=${encodeURIComponent(redirectUrl)}`;
+}
+function profileUrl(redirectUrl) {
+  if (isMockAuthEnabled()) return redirectUrl ?? "/";
+  if (redirectUrl) {
+    return `${PROFILE_PAGE_URL}?redirect_url=${encodeURIComponent(redirectUrl)}`;
+  }
+  return PROFILE_PAGE_URL;
+}
+async function logout() {
+  if (isMockAuthEnabled()) return true;
+  try {
+    const res = await fetch(LOGOUT_URL, {
+      method: "POST",
+      credentials: "include"
+    });
+    return res.ok;
+  } catch {
+    return false;
+  }
+}
+async function refreshSession() {
+  if (isMockAuthEnabled()) return "ok";
+  try {
+    const res = await fetch(REFRESH_URL, {
+      method: "POST",
+      credentials: "include"
+    });
+    if (res.ok) return "ok";
+    if (res.status === 401 || res.status === 403) return "unauthorized";
+    return "unavailable";
+  } catch {
+    return "unavailable";
+  }
+}
+async function refreshToken() {
+  return await refreshSession() === "ok";
+}
+function assertValidLoginRedirectUrl(redirectUrl) {
+  let url;
+  try {
+    url = new URL(redirectUrl);
+  } catch {
+    throw new Error("loginUrl redirectUrl must be a valid absolute URL");
+  }
+  if (url.protocol !== "https:") {
+    throw new Error("loginUrl redirectUrl must use https");
+  }
+  if (!isAllowedLoginRedirectHost(url.hostname)) {
+    throw new Error(
+      "loginUrl redirectUrl host must be lemondouble.com or a subdomain of lemondouble.com"
+    );
+  }
+}
+function isAllowedLoginRedirectHost(hostname) {
+  const normalized = hostname.toLowerCase();
+  return normalized === "lemondouble.com" || normalized.endsWith(".lemondouble.com");
+}
+
+export {
+  loginUrl,
+  profileUrl,
+  logout,
+  refreshSession,
+  refreshToken
+};
+//# sourceMappingURL=chunk-ICPDIWYK.js.map

package/dist/chunk-ICPDIWYK.js.map

@@ -0,0 +1 @@
+{"version":3,"sources":["../src/client/url.ts"],"sourcesContent":["import {\n  LOGIN_URL,\n  LOGOUT_URL,\n  PROFILE_PAGE_URL,\n  REFRESH_URL,\n} from \"../constants.js\";\nimport { isMockAuthEnabled } from \"../mock.js\";\n\nexport function loginUrl(redirectUrl: string): string {\n  if (isMockAuthEnabled()) return redirectUrl;\n  assertValidLoginRedirectUrl(redirectUrl);\n  return `${LOGIN_URL}?redirect_url=${encodeURIComponent(redirectUrl)}`;\n}\n\nexport function profileUrl(redirectUrl?: string): string {\n  if (isMockAuthEnabled()) return redirectUrl ?? \"/\";\n  if (redirectUrl) {\n    return `${PROFILE_PAGE_URL}?redirect_url=${encodeURIComponent(redirectUrl)}`;\n  }\n  return PROFILE_PAGE_URL;\n}\n\n/**\n * 로그아웃. 쿠키 삭제는 응답의 Set-Cookie 가 한다 — 세션 쿠키는 httpOnly\n * 라서 JS 로는 지울 수 없다.\n */\nexport async function logout(): Promise<boolean> {\n  if (isMockAuthEnabled()) return true;\n\n  try {\n    const res = await fetch(LOGOUT_URL, {\n      method: \"POST\",\n      credentials: \"include\",\n    });\n    return res.ok;\n  } catch {\n    return false;\n  }\n}\n\nexport type RefreshSessionResult = \"ok\" | \"unauthorized\" | \"unavailable\";\n\n/**\n * 세션 갱신. 쿠키 반영은 응답의 Set-Cookie 가 한다.\n *\n * \"unauthorized\" 는 refresh token 이 죽은 것이고, 서버가 그 응답에서 세션\n * 쿠키를 함께 지워준다. \"unavailable\" 은 서버 · 네트워크 사정이므로 세션이\n * 죽었다고 판단하면 안 된다.\n */\nexport async function refreshSession(): Promise<RefreshSessionResult> {\n  if (isMockAuthEnabled()) return \"ok\";\n\n  try {\n    const res = await fetch(REFRESH_URL, {\n      method: \"POST\",\n      credentials: \"include\",\n    });\n    if (res.ok) return \"ok\";\n    if (res.status === 401 || res.status === 403) return \"unauthorized\";\n    return \"unavailable\";\n  } catch {\n    return \"unavailable\";\n  }\n}\n\nexport async function refreshToken(): Promise<boolean> {\n  return (await refreshSession()) === \"ok\";\n}\n\nfunction assertValidLoginRedirectUrl(redirectUrl: string): void {\n  let url: URL;\n  try {\n    url = new URL(redirectUrl);\n  } catch {\n    throw new Error(\"loginUrl redirectUrl must be a valid absolute URL\");\n  }\n\n  if (url.protocol !== \"https:\") {\n    throw new Error(\"loginUrl redirectUrl must use https\");\n  }\n\n  if (!isAllowedLoginRedirectHost(url.hostname)) {\n    throw new Error(\n      \"loginUrl redirectUrl host must be lemondouble.com or a subdomain of lemondouble.com\"\n    );\n  }\n}\n\nfunction isAllowedLoginRedirectHost(hostname: string): boolean {\n  const normalized = hostname.toLowerCase();\n  return (\n    normalized === \"lemondouble.com\" ||\n    normalized.endsWith(\".lemondouble.com\")\n  );\n}\n"],"mappings":";;;;;;;;;AAQO,SAAS,SAAS,aAA6B;AACpD,MAAI,kBAAkB,EAAG,QAAO;AAChC,8BAA4B,WAAW;AACvC,SAAO,GAAG,SAAS,iBAAiB,mBAAmB,WAAW,CAAC;AACrE;AAEO,SAAS,WAAW,aAA8B;AACvD,MAAI,kBAAkB,EAAG,QAAO,eAAe;AAC/C,MAAI,aAAa;AACf,WAAO,GAAG,gBAAgB,iBAAiB,mBAAmB,WAAW,CAAC;AAAA,EAC5E;AACA,SAAO;AACT;AAMA,eAAsB,SAA2B;AAC/C,MAAI,kBAAkB,EAAG,QAAO;AAEhC,MAAI;AACF,UAAM,MAAM,MAAM,MAAM,YAAY;AAAA,MAClC,QAAQ;AAAA,MACR,aAAa;AAAA,IACf,CAAC;AACD,WAAO,IAAI;AAAA,EACb,QAAQ;AACN,WAAO;AAAA,EACT;AACF;AAWA,eAAsB,iBAAgD;AACpE,MAAI,kBAAkB,EAAG,QAAO;AAEhC,MAAI;AACF,UAAM,MAAM,MAAM,MAAM,aAAa;AAAA,MACnC,QAAQ;AAAA,MACR,aAAa;AAAA,IACf,CAAC;AACD,QAAI,IAAI,GAAI,QAAO;AACnB,QAAI,IAAI,WAAW,OAAO,IAAI,WAAW,IAAK,QAAO;AACrD,WAAO;AAAA,EACT,QAAQ;AACN,WAAO;AAAA,EACT;AACF;AAEA,eAAsB,eAAiC;AACrD,SAAQ,MAAM,eAAe,MAAO;AACtC;AAEA,SAAS,4BAA4B,aAA2B;AAC9D,MAAI;AACJ,MAAI;AACF,UAAM,IAAI,IAAI,WAAW;AAAA,EAC3B,QAAQ;AACN,UAAM,IAAI,MAAM,mDAAmD;AAAA,EACrE;AAEA,MAAI,IAAI,aAAa,UAAU;AAC7B,UAAM,IAAI,MAAM,qCAAqC;AAAA,EACvD;AAEA,MAAI,CAAC,2BAA2B,IAAI,QAAQ,GAAG;AAC7C,UAAM,IAAI;AAAA,MACR;AAAA,IACF;AAAA,EACF;AACF;AAEA,SAAS,2BAA2B,UAA2B;AAC7D,QAAM,aAAa,SAAS,YAAY;AACxC,SACE,eAAe,qBACf,WAAW,SAAS,kBAAkB;AAE1C;","names":[]}

package/dist/{chunk-OX5MDVSR.js → chunk-JIXVTKLG.js}

@@ -8,7 +8,6 @@ var PROFILE_URL = `${AUTH_SERVER_URL}/api/user/me`;
 var PROFILE_PAGE_URL = `${AUTH_SERVER_URL}/profile`;
 var ACCESS_TOKEN_COOKIE = "lemon_access_token";
 var REFRESH_TOKEN_COOKIE = "lemon_refresh_token";
-var DEVICE_ID_COOKIE = "device_id";
 
 // src/mock.ts
 var LEMON_AUTH_MOCK_USER_ENV = "NEXT_PUBLIC_LEMON_AUTH_MOCK_USER";
@@ -109,12 +108,10 @@ export {
   LOGIN_URL,
   REFRESH_URL,
   LOGOUT_URL,
-  PROFILE_URL,
   PROFILE_PAGE_URL,
   ACCESS_TOKEN_COOKIE,
   REFRESH_TOKEN_COOKIE,
-  DEVICE_ID_COOKIE,
   isMockAuthEnabled,
   getMockAccessTokenClaims
 };
-//# sourceMappingURL=chunk-OX5MDVSR.js.map
+//# sourceMappingURL=chunk-JIXVTKLG.js.map

package/dist/{chunk-OX5MDVSR.js.map → chunk-JIXVTKLG.js.map}

@@ -1 +1 @@
-{"version":3,"sources":["../src/constants.ts","../src/mock.ts"],"sourcesContent":["export const AUTH_SERVER_URL = \"https://auth.lemondouble.com\";\nexport const JWKS_URL = `${AUTH_SERVER_URL}/.well-known/jwks.json`;\nexport const LOGIN_URL = `${AUTH_SERVER_URL}/api/oauth2/google/login`;\nexport const REFRESH_URL = `${AUTH_SERVER_URL}/api/token/refresh`;\nexport const LOGOUT_URL = `${AUTH_SERVER_URL}/api/token/logout`;\nexport const PROFILE_URL = `${AUTH_SERVER_URL}/api/user/me`;\nexport const PROFILE_PAGE_URL = `${AUTH_SERVER_URL}/profile`;\n\nexport const ACCESS_TOKEN_COOKIE = \"lemon_access_token\";\nexport const REFRESH_TOKEN_COOKIE = \"lemon_refresh_token\";\nexport const DEVICE_ID_COOKIE = \"device_id\";\n","import type { AccessTokenClaims, LemonUser } from \"./types.js\";\n\nexport const LEMON_AUTH_MOCK_USER_ENV =\n  \"NEXT_PUBLIC_LEMON_AUTH_MOCK_USER\";\n\nexport function isMockAuthEnabled(): boolean {\n  return !isProduction() && Boolean(readMockUserEnv());\n}\n\nexport function getMockUser(): LemonUser | null {\n  const raw = readMockUserEnv();\n  if (isProduction() || !raw) return null;\n  return parseMockUser(raw);\n}\n\nexport function getMockAccessTokenClaims(): AccessTokenClaims | null {\n  const user = getMockUser();\n  if (!user) return null;\n\n  const now = Math.floor(Date.now() / 1000);\n  return {\n    token_type: \"access\",\n    sub: user.uid,\n    nickname: user.nickname,\n    profile_image_url: user.profileImageUrl,\n    role: user.role,\n    approved_clients: user.approvedClients,\n    iss: \"lemon-auth-mock\",\n    iat: now,\n    exp: now + 60 * 60 * 24 * 365,\n  };\n}\n\nfunction readMockUserEnv(): string | undefined {\n  try {\n    return process.env.NEXT_PUBLIC_LEMON_AUTH_MOCK_USER;\n  } catch {\n    return undefined;\n  }\n}\n\nfunction isProduction(): boolean {\n  try {\n    return process.env.NODE_ENV === \"production\";\n  } catch {\n    return false;\n  }\n}\n\nfunction parseMockUser(raw: string): LemonUser {\n  let data: unknown;\n  try {\n    data = JSON.parse(raw);\n  } catch {\n    throw new Error(\n      `${LEMON_AUTH_MOCK_USER_ENV} must be a valid JSON object`\n    );\n  }\n\n  if (!isRecord(data)) {\n    throw new Error(`${LEMON_AUTH_MOCK_USER_ENV} must be a JSON object`);\n  }\n\n  return {\n    uid: readOptionalString(data.uid, \"local-user\", \"uid\"),\n    nickname: readOptionalString(data.nickname, \"Local User\", \"nickname\"),\n    profileImageUrl: readOptionalString(\n      data.profileImageUrl ?? data.profile_image_url,\n      \"\",\n      \"profileImageUrl\"\n    ),\n    role: readOptionalRole(data.role, \"admin\"),\n    approvedClients: readOptionalStringArray(\n      data.approvedClients ?? data.approved_clients,\n      [\"*\"],\n      \"approvedClients\"\n    ),\n  };\n}\n\nfunction isRecord(value: unknown): value is Record<string, unknown> {\n  return typeof value === \"object\" && value !== null && !Array.isArray(value);\n}\n\nfunction readOptionalString(\n  value: unknown,\n  fallback: string,\n  field: string\n): string {\n  if (value === undefined || value === null) return fallback;\n  if (typeof value === \"string\") return value;\n  throw new Error(`${LEMON_AUTH_MOCK_USER_ENV}.${field} must be a string`);\n}\n\nfunction readOptionalRole(\n  value: unknown,\n  fallback: LemonUser[\"role\"]\n): LemonUser[\"role\"] {\n  if (value === undefined || value === null) return fallback;\n  if (value === \"user\" || value === \"admin\") return value;\n  throw new Error(\n    `${LEMON_AUTH_MOCK_USER_ENV}.role must be \"user\" or \"admin\"`\n  );\n}\n\nfunction readOptionalStringArray(\n  value: unknown,\n  fallback: string[],\n  field: string\n): string[] {\n  if (value === undefined || value === null) return fallback;\n  if (\n    Array.isArray(value) &&\n    value.every((item) => typeof item === \"string\")\n  ) {\n    return value;\n  }\n  throw new Error(\n    `${LEMON_AUTH_MOCK_USER_ENV}.${field} must be a string array`\n  );\n}\n"],"mappings":";AAAO,IAAM,kBAAkB;AACxB,IAAM,WAAW,GAAG,eAAe;AACnC,IAAM,YAAY,GAAG,eAAe;AACpC,IAAM,cAAc,GAAG,eAAe;AACtC,IAAM,aAAa,GAAG,eAAe;AACrC,IAAM,cAAc,GAAG,eAAe;AACtC,IAAM,mBAAmB,GAAG,eAAe;AAE3C,IAAM,sBAAsB;AAC5B,IAAM,uBAAuB;AAC7B,IAAM,mBAAmB;;;ACRzB,IAAM,2BACX;AAEK,SAAS,oBAA6B;AAC3C,SAAO,CAAC,aAAa,KAAK,QAAQ,gBAAgB,CAAC;AACrD;AAEO,SAAS,cAAgC;AAC9C,QAAM,MAAM,gBAAgB;AAC5B,MAAI,aAAa,KAAK,CAAC,IAAK,QAAO;AACnC,SAAO,cAAc,GAAG;AAC1B;AAEO,SAAS,2BAAqD;AACnE,QAAM,OAAO,YAAY;AACzB,MAAI,CAAC,KAAM,QAAO;AAElB,QAAM,MAAM,KAAK,MAAM,KAAK,IAAI,IAAI,GAAI;AACxC,SAAO;AAAA,IACL,YAAY;AAAA,IACZ,KAAK,KAAK;AAAA,IACV,UAAU,KAAK;AAAA,IACf,mBAAmB,KAAK;AAAA,IACxB,MAAM,KAAK;AAAA,IACX,kBAAkB,KAAK;AAAA,IACvB,KAAK;AAAA,IACL,KAAK;AAAA,IACL,KAAK,MAAM,KAAK,KAAK,KAAK;AAAA,EAC5B;AACF;AAEA,SAAS,kBAAsC;AAC7C,MAAI;AACF,WAAO,QAAQ,IAAI;AAAA,EACrB,QAAQ;AACN,WAAO;AAAA,EACT;AACF;AAEA,SAAS,eAAwB;AAC/B,MAAI;AACF,WAAO,QAAQ,IAAI,aAAa;AAAA,EAClC,QAAQ;AACN,WAAO;AAAA,EACT;AACF;AAEA,SAAS,cAAc,KAAwB;AAC7C,MAAI;AACJ,MAAI;AACF,WAAO,KAAK,MAAM,GAAG;AAAA,EACvB,QAAQ;AACN,UAAM,IAAI;AAAA,MACR,GAAG,wBAAwB;AAAA,IAC7B;AAAA,EACF;AAEA,MAAI,CAAC,SAAS,IAAI,GAAG;AACnB,UAAM,IAAI,MAAM,GAAG,wBAAwB,wBAAwB;AAAA,EACrE;AAEA,SAAO;AAAA,IACL,KAAK,mBAAmB,KAAK,KAAK,cAAc,KAAK;AAAA,IACrD,UAAU,mBAAmB,KAAK,UAAU,cAAc,UAAU;AAAA,IACpE,iBAAiB;AAAA,MACf,KAAK,mBAAmB,KAAK;AAAA,MAC7B;AAAA,MACA;AAAA,IACF;AAAA,IACA,MAAM,iBAAiB,KAAK,MAAM,OAAO;AAAA,IACzC,iBAAiB;AAAA,MACf,KAAK,mBAAmB,KAAK;AAAA,MAC7B,CAAC,GAAG;AAAA,MACJ;AAAA,IACF;AAAA,EACF;AACF;AAEA,SAAS,SAAS,OAAkD;AAClE,SAAO,OAAO,UAAU,YAAY,UAAU,QAAQ,CAAC,MAAM,QAAQ,KAAK;AAC5E;AAEA,SAAS,mBACP,OACA,UACA,OACQ;AACR,MAAI,UAAU,UAAa,UAAU,KAAM,QAAO;AAClD,MAAI,OAAO,UAAU,SAAU,QAAO;AACtC,QAAM,IAAI,MAAM,GAAG,wBAAwB,IAAI,KAAK,mBAAmB;AACzE;AAEA,SAAS,iBACP,OACA,UACmB;AACnB,MAAI,UAAU,UAAa,UAAU,KAAM,QAAO;AAClD,MAAI,UAAU,UAAU,UAAU,QAAS,QAAO;AAClD,QAAM,IAAI;AAAA,IACR,GAAG,wBAAwB;AAAA,EAC7B;AACF;AAEA,SAAS,wBACP,OACA,UACA,OACU;AACV,MAAI,UAAU,UAAa,UAAU,KAAM,QAAO;AAClD,MACE,MAAM,QAAQ,KAAK,KACnB,MAAM,MAAM,CAAC,SAAS,OAAO,SAAS,QAAQ,GAC9C;AACA,WAAO;AAAA,EACT;AACA,QAAM,IAAI;AAAA,IACR,GAAG,wBAAwB,IAAI,KAAK;AAAA,EACtC;AACF;","names":[]}
+{"version":3,"sources":["../src/constants.ts","../src/mock.ts"],"sourcesContent":["export const AUTH_SERVER_URL = \"https://auth.lemondouble.com\";\nexport const JWKS_URL = `${AUTH_SERVER_URL}/.well-known/jwks.json`;\nexport const LOGIN_URL = `${AUTH_SERVER_URL}/api/oauth2/google/login`;\nexport const REFRESH_URL = `${AUTH_SERVER_URL}/api/token/refresh`;\nexport const LOGOUT_URL = `${AUTH_SERVER_URL}/api/token/logout`;\nexport const PROFILE_URL = `${AUTH_SERVER_URL}/api/user/me`;\nexport const PROFILE_PAGE_URL = `${AUTH_SERVER_URL}/profile`;\n\nexport const ACCESS_TOKEN_COOKIE = \"lemon_access_token\";\nexport const REFRESH_TOKEN_COOKIE = \"lemon_refresh_token\";\nexport const DEVICE_ID_COOKIE = \"device_id\";\n","import type { AccessTokenClaims, LemonUser } from \"./types.js\";\n\nexport const LEMON_AUTH_MOCK_USER_ENV =\n  \"NEXT_PUBLIC_LEMON_AUTH_MOCK_USER\";\n\nexport function isMockAuthEnabled(): boolean {\n  return !isProduction() && Boolean(readMockUserEnv());\n}\n\nexport function getMockUser(): LemonUser | null {\n  const raw = readMockUserEnv();\n  if (isProduction() || !raw) return null;\n  return parseMockUser(raw);\n}\n\nexport function getMockAccessTokenClaims(): AccessTokenClaims | null {\n  const user = getMockUser();\n  if (!user) return null;\n\n  const now = Math.floor(Date.now() / 1000);\n  return {\n    token_type: \"access\",\n    sub: user.uid,\n    nickname: user.nickname,\n    profile_image_url: user.profileImageUrl,\n    role: user.role,\n    approved_clients: user.approvedClients,\n    iss: \"lemon-auth-mock\",\n    iat: now,\n    exp: now + 60 * 60 * 24 * 365,\n  };\n}\n\nfunction readMockUserEnv(): string | undefined {\n  try {\n    return process.env.NEXT_PUBLIC_LEMON_AUTH_MOCK_USER;\n  } catch {\n    return undefined;\n  }\n}\n\nfunction isProduction(): boolean {\n  try {\n    return process.env.NODE_ENV === \"production\";\n  } catch {\n    return false;\n  }\n}\n\nfunction parseMockUser(raw: string): LemonUser {\n  let data: unknown;\n  try {\n    data = JSON.parse(raw);\n  } catch {\n    throw new Error(\n      `${LEMON_AUTH_MOCK_USER_ENV} must be a valid JSON object`\n    );\n  }\n\n  if (!isRecord(data)) {\n    throw new Error(`${LEMON_AUTH_MOCK_USER_ENV} must be a JSON object`);\n  }\n\n  return {\n    uid: readOptionalString(data.uid, \"local-user\", \"uid\"),\n    nickname: readOptionalString(data.nickname, \"Local User\", \"nickname\"),\n    profileImageUrl: readOptionalString(\n      data.profileImageUrl ?? data.profile_image_url,\n      \"\",\n      \"profileImageUrl\"\n    ),\n    role: readOptionalRole(data.role, \"admin\"),\n    approvedClients: readOptionalStringArray(\n      data.approvedClients ?? data.approved_clients,\n      [\"*\"],\n      \"approvedClients\"\n    ),\n  };\n}\n\nfunction isRecord(value: unknown): value is Record<string, unknown> {\n  return typeof value === \"object\" && value !== null && !Array.isArray(value);\n}\n\nfunction readOptionalString(\n  value: unknown,\n  fallback: string,\n  field: string\n): string {\n  if (value === undefined || value === null) return fallback;\n  if (typeof value === \"string\") return value;\n  throw new Error(`${LEMON_AUTH_MOCK_USER_ENV}.${field} must be a string`);\n}\n\nfunction readOptionalRole(\n  value: unknown,\n  fallback: LemonUser[\"role\"]\n): LemonUser[\"role\"] {\n  if (value === undefined || value === null) return fallback;\n  if (value === \"user\" || value === \"admin\") return value;\n  throw new Error(\n    `${LEMON_AUTH_MOCK_USER_ENV}.role must be \"user\" or \"admin\"`\n  );\n}\n\nfunction readOptionalStringArray(\n  value: unknown,\n  fallback: string[],\n  field: string\n): string[] {\n  if (value === undefined || value === null) return fallback;\n  if (\n    Array.isArray(value) &&\n    value.every((item) => typeof item === \"string\")\n  ) {\n    return value;\n  }\n  throw new Error(\n    `${LEMON_AUTH_MOCK_USER_ENV}.${field} must be a string array`\n  );\n}\n"],"mappings":";AAAO,IAAM,kBAAkB;AACxB,IAAM,WAAW,GAAG,eAAe;AACnC,IAAM,YAAY,GAAG,eAAe;AACpC,IAAM,cAAc,GAAG,eAAe;AACtC,IAAM,aAAa,GAAG,eAAe;AACrC,IAAM,cAAc,GAAG,eAAe;AACtC,IAAM,mBAAmB,GAAG,eAAe;AAE3C,IAAM,sBAAsB;AAC5B,IAAM,uBAAuB;;;ACP7B,IAAM,2BACX;AAEK,SAAS,oBAA6B;AAC3C,SAAO,CAAC,aAAa,KAAK,QAAQ,gBAAgB,CAAC;AACrD;AAEO,SAAS,cAAgC;AAC9C,QAAM,MAAM,gBAAgB;AAC5B,MAAI,aAAa,KAAK,CAAC,IAAK,QAAO;AACnC,SAAO,cAAc,GAAG;AAC1B;AAEO,SAAS,2BAAqD;AACnE,QAAM,OAAO,YAAY;AACzB,MAAI,CAAC,KAAM,QAAO;AAElB,QAAM,MAAM,KAAK,MAAM,KAAK,IAAI,IAAI,GAAI;AACxC,SAAO;AAAA,IACL,YAAY;AAAA,IACZ,KAAK,KAAK;AAAA,IACV,UAAU,KAAK;AAAA,IACf,mBAAmB,KAAK;AAAA,IACxB,MAAM,KAAK;AAAA,IACX,kBAAkB,KAAK;AAAA,IACvB,KAAK;AAAA,IACL,KAAK;AAAA,IACL,KAAK,MAAM,KAAK,KAAK,KAAK;AAAA,EAC5B;AACF;AAEA,SAAS,kBAAsC;AAC7C,MAAI;AACF,WAAO,QAAQ,IAAI;AAAA,EACrB,QAAQ;AACN,WAAO;AAAA,EACT;AACF;AAEA,SAAS,eAAwB;AAC/B,MAAI;AACF,WAAO,QAAQ,IAAI,aAAa;AAAA,EAClC,QAAQ;AACN,WAAO;AAAA,EACT;AACF;AAEA,SAAS,cAAc,KAAwB;AAC7C,MAAI;AACJ,MAAI;AACF,WAAO,KAAK,MAAM,GAAG;AAAA,EACvB,QAAQ;AACN,UAAM,IAAI;AAAA,MACR,GAAG,wBAAwB;AAAA,IAC7B;AAAA,EACF;AAEA,MAAI,CAAC,SAAS,IAAI,GAAG;AACnB,UAAM,IAAI,MAAM,GAAG,wBAAwB,wBAAwB;AAAA,EACrE;AAEA,SAAO;AAAA,IACL,KAAK,mBAAmB,KAAK,KAAK,cAAc,KAAK;AAAA,IACrD,UAAU,mBAAmB,KAAK,UAAU,cAAc,UAAU;AAAA,IACpE,iBAAiB;AAAA,MACf,KAAK,mBAAmB,KAAK;AAAA,MAC7B;AAAA,MACA;AAAA,IACF;AAAA,IACA,MAAM,iBAAiB,KAAK,MAAM,OAAO;AAAA,IACzC,iBAAiB;AAAA,MACf,KAAK,mBAAmB,KAAK;AAAA,MAC7B,CAAC,GAAG;AAAA,MACJ;AAAA,IACF;AAAA,EACF;AACF;AAEA,SAAS,SAAS,OAAkD;AAClE,SAAO,OAAO,UAAU,YAAY,UAAU,QAAQ,CAAC,MAAM,QAAQ,KAAK;AAC5E;AAEA,SAAS,mBACP,OACA,UACA,OACQ;AACR,MAAI,UAAU,UAAa,UAAU,KAAM,QAAO;AAClD,MAAI,OAAO,UAAU,SAAU,QAAO;AACtC,QAAM,IAAI,MAAM,GAAG,wBAAwB,IAAI,KAAK,mBAAmB;AACzE;AAEA,SAAS,iBACP,OACA,UACmB;AACnB,MAAI,UAAU,UAAa,UAAU,KAAM,QAAO;AAClD,MAAI,UAAU,UAAU,UAAU,QAAS,QAAO;AAClD,QAAM,IAAI;AAAA,IACR,GAAG,wBAAwB;AAAA,EAC7B;AACF;AAEA,SAAS,wBACP,OACA,UACA,OACU;AACV,MAAI,UAAU,UAAa,UAAU,KAAM,QAAO;AAClD,MACE,MAAM,QAAQ,KAAK,KACnB,MAAM,MAAM,CAAC,SAAS,OAAO,SAAS,QAAQ,GAC9C;AACA,WAAO;AAAA,EACT;AACA,QAAM,IAAI;AAAA,IACR,GAAG,wBAAwB,IAAI,KAAK;AAAA,EACtC;AACF;","names":[]}

package/dist/client/index.d.ts

@@ -1,7 +1,7 @@
 import * as react_jsx_runtime from 'react/jsx-runtime';
-import { a as LemonUser } from '../types-B5uRY2Si.js';
+import { a as LemonUser } from '../url-qhLR3uNu.js';
+export { l as loginUrl, b as logout, p as profileUrl, r as refreshToken } from '../url-qhLR3uNu.js';
 import * as react from 'react';
-import 'jose';
 
 interface AuthContextValue {
     user: LemonUser | null;
@@ -36,13 +36,4 @@ declare function SessionRestore({ fallback }: {
     fallback: React.ReactNode;
 }): string | number | bigint | boolean | Iterable<react.ReactNode> | Promise<string | number | bigint | boolean | react.ReactPortal | react.ReactElement<unknown, string | react.JSXElementConstructor<any>> | Iterable<react.ReactNode> | null | undefined> | react_jsx_runtime.JSX.Element | null | undefined;
 
-declare function loginUrl(redirectUrl: string): string;
-declare function profileUrl(redirectUrl?: string): string;
-/**
- * 로그아웃. 쿠키 삭제는 응답의 Set-Cookie 가 한다 — 세션 쿠키는 httpOnly
- * 라서 JS 로는 지울 수 없다.
- */
-declare function logout(): Promise<boolean>;
-declare function refreshToken(): Promise<boolean>;
-
-export { AuthProvider, LemonUser, SessionRestore, loginUrl, logout, profileUrl, refreshToken, useAuth };
+export { AuthProvider, LemonUser, SessionRestore, useAuth };

package/dist/client/index.js

@@ -1,11 +1,12 @@
 "use client";
 import {
-  LOGIN_URL,
-  LOGOUT_URL,
-  PROFILE_PAGE_URL,
-  REFRESH_URL,
-  isMockAuthEnabled
-} from "../chunk-OX5MDVSR.js";
+  loginUrl,
+  logout,
+  profileUrl,
+  refreshSession,
+  refreshToken
+} from "../chunk-ICPDIWYK.js";
+import "../chunk-JIXVTKLG.js";
 
 // src/client/context.tsx
 import { createContext, useContext } from "react";
@@ -27,71 +28,6 @@ function useAuth() {
 // src/client/session-restore.tsx
 import { useEffect, useState } from "react";
 import { useSearchParams } from "next/navigation";
-
-// src/client/url.ts
-function loginUrl(redirectUrl) {
-  if (isMockAuthEnabled()) return redirectUrl;
-  assertValidLoginRedirectUrl(redirectUrl);
-  return `${LOGIN_URL}?redirect_url=${encodeURIComponent(redirectUrl)}`;
-}
-function profileUrl(redirectUrl) {
-  if (isMockAuthEnabled()) return redirectUrl ?? "/";
-  if (redirectUrl) {
-    return `${PROFILE_PAGE_URL}?redirect_url=${encodeURIComponent(redirectUrl)}`;
-  }
-  return PROFILE_PAGE_URL;
-}
-async function logout() {
-  if (isMockAuthEnabled()) return true;
-  try {
-    const res = await fetch(LOGOUT_URL, {
-      method: "POST",
-      credentials: "include"
-    });
-    return res.ok;
-  } catch {
-    return false;
-  }
-}
-async function refreshSession() {
-  if (isMockAuthEnabled()) return "ok";
-  try {
-    const res = await fetch(REFRESH_URL, {
-      method: "POST",
-      credentials: "include"
-    });
-    if (res.ok) return "ok";
-    if (res.status === 401 || res.status === 403) return "unauthorized";
-    return "unavailable";
-  } catch {
-    return "unavailable";
-  }
-}
-async function refreshToken() {
-  return await refreshSession() === "ok";
-}
-function assertValidLoginRedirectUrl(redirectUrl) {
-  let url;
-  try {
-    url = new URL(redirectUrl);
-  } catch {
-    throw new Error("loginUrl redirectUrl must be a valid absolute URL");
-  }
-  if (url.protocol !== "https:") {
-    throw new Error("loginUrl redirectUrl must use https");
-  }
-  if (!isAllowedLoginRedirectHost(url.hostname)) {
-    throw new Error(
-      "loginUrl redirectUrl host must be lemondouble.com or a subdomain of lemondouble.com"
-    );
-  }
-}
-function isAllowedLoginRedirectHost(hostname) {
-  const normalized = hostname.toLowerCase();
-  return normalized === "lemondouble.com" || normalized.endsWith(".lemondouble.com");
-}
-
-// src/client/session-restore.tsx
 import { jsx as jsx2, jsxs } from "react/jsx-runtime";
 function SessionRestore({ fallback }) {
   const searchParams = useSearchParams();

package/dist/client/index.js.map

@@ -1 +1 @@
-{"version":3,"sources":["../../src/client/context.tsx","../../src/client/session-restore.tsx","../../src/client/url.ts"],"sourcesContent":["\"use client\";\n\nimport { createContext, useContext } from \"react\";\nimport type { LemonUser } from \"../types.js\";\n\ninterface AuthContextValue {\n  user: LemonUser | null;\n  isAuthenticated: boolean;\n}\n\nconst AuthContext = createContext<AuthContextValue>({\n  user: null,\n  isAuthenticated: false,\n});\n\nexport function AuthProvider({\n  user,\n  children,\n}: {\n  user: LemonUser | null;\n  children: React.ReactNode;\n}) {\n  return (\n    <AuthContext value={{ user, isAuthenticated: user !== null }}>\n      {children}\n    </AuthContext>\n  );\n}\n\nexport function useAuth(): AuthContextValue {\n  return useContext(AuthContext);\n}\n","\"use client\";\n\nimport { useEffect, useState } from \"react\";\nimport { useSearchParams } from \"next/navigation\";\nimport { refreshSession } from \"./url.js\";\n\n/**\n * 토큰을 갱신하는 유일한 주체. 프록시가 만료된 세션을 이리로 보낸다.\n *\n * 갱신을 서버(미들웨어)가 아니라 브라우저가 하는 이유는 두 가지다.\n *\n *   1. 미들웨어는 요청마다 별도 인스턴스로 떠서 서로를 모른다. 프리페치가\n *      깔리면 같은 refresh token 으로 갱신이 동시에 나가고, 회전 경쟁이 난다.\n *      브라우저의 복구 경로는 한 번에 하나만 뜬다.\n *   2. 브라우저 요청에는 진짜 UA 와 WAF 통과 쿠키가 실린다. 서버간 fetch 는\n *      UA 가 런타임 기본값이라 봇 방어에 걸릴 수 있다.\n *\n * 끝나면 router 가 아니라 window.location 으로 next 에 간다. 소프트 네비는\n * 루트 레이아웃(과 AuthProvider)을 다시 렌더하지 않으므로, 옛 세션 스냅샷이\n * 남아 화면이 어긋나거나 라우터 캐시에 굳은 리다이렉트가 되살아난다.\n *\n * 실패해도 next 로 간다. 죽은 토큰이면 서버가 401 응답에서 세션 쿠키를\n * 지워 주므로(auth-server v2026.08.03.2+), 이후 판단 — 로그인으로 보낼지,\n * 익명으로 보여줄지 — 는 프록시와 DAL 이 알아서 한다.\n */\nexport function SessionRestore({ fallback }: { fallback: React.ReactNode }) {\n  const searchParams = useSearchParams();\n  const [unavailable, setUnavailable] = useState(false);\n\n  useEffect(() => {\n    let ignore = false;\n    const next = safeNextPath(searchParams.get(\"next\"));\n\n    refreshSession().then((result) => {\n      if (ignore) return;\n\n      if (result === \"unavailable\") {\n        // 서버 · 네트워크 사정이다. 토큰은 살아 있을 수 있으므로\n        // 로그인으로 보내지 않고 재시도만 권한다.\n        setUnavailable(true);\n        return;\n      }\n\n      window.location.replace(next);\n    });\n\n    return () => {\n      ignore = true;\n    };\n  }, [searchParams]);\n\n  if (unavailable) {\n    return (\n      <div\n        style={{\n          minHeight: \"100dvh\",\n          display: \"flex\",\n          flexDirection: \"column\",\n          alignItems: \"center\",\n          justifyContent: \"center\",\n          gap: 12,\n        }}\n      >\n        <p>인증 서버에 연결하지 못했습니다.</p>\n        <button type=\"button\" onClick={() => window.location.reload()}>\n          다시 시도\n        </button>\n      </div>\n    );\n  }\n\n  return fallback;\n}\n\n/**\n * next 파라미터는 사용자가 조작할 수 있으므로 열린 리다이렉트가 되지 않게\n * 같은 출처의 경로만 허용한다. `//evil.com` 은 브라우저가 프로토콜 상대\n * URL 로 읽으므로 반드시 걸러야 한다.\n */\nfunction safeNextPath(next: string | null): string {\n  if (!next) return \"/\";\n  if (!next.startsWith(\"/\")) return \"/\";\n  if (next.startsWith(\"//\")) return \"/\";\n  return next;\n}\n","import {\n  LOGIN_URL,\n  LOGOUT_URL,\n  PROFILE_PAGE_URL,\n  REFRESH_URL,\n} from \"../constants.js\";\nimport { isMockAuthEnabled } from \"../mock.js\";\n\nexport function loginUrl(redirectUrl: string): string {\n  if (isMockAuthEnabled()) return redirectUrl;\n  assertValidLoginRedirectUrl(redirectUrl);\n  return `${LOGIN_URL}?redirect_url=${encodeURIComponent(redirectUrl)}`;\n}\n\nexport function profileUrl(redirectUrl?: string): string {\n  if (isMockAuthEnabled()) return redirectUrl ?? \"/\";\n  if (redirectUrl) {\n    return `${PROFILE_PAGE_URL}?redirect_url=${encodeURIComponent(redirectUrl)}`;\n  }\n  return PROFILE_PAGE_URL;\n}\n\n/**\n * 로그아웃. 쿠키 삭제는 응답의 Set-Cookie 가 한다 — 세션 쿠키는 httpOnly\n * 라서 JS 로는 지울 수 없다.\n */\nexport async function logout(): Promise<boolean> {\n  if (isMockAuthEnabled()) return true;\n\n  try {\n    const res = await fetch(LOGOUT_URL, {\n      method: \"POST\",\n      credentials: \"include\",\n    });\n    return res.ok;\n  } catch {\n    return false;\n  }\n}\n\nexport type RefreshSessionResult = \"ok\" | \"unauthorized\" | \"unavailable\";\n\n/**\n * 세션 갱신. 쿠키 반영은 응답의 Set-Cookie 가 한다.\n *\n * \"unauthorized\" 는 refresh token 이 죽은 것이고, 서버가 그 응답에서 세션\n * 쿠키를 함께 지워준다. \"unavailable\" 은 서버 · 네트워크 사정이므로 세션이\n * 죽었다고 판단하면 안 된다.\n */\nexport async function refreshSession(): Promise<RefreshSessionResult> {\n  if (isMockAuthEnabled()) return \"ok\";\n\n  try {\n    const res = await fetch(REFRESH_URL, {\n      method: \"POST\",\n      credentials: \"include\",\n    });\n    if (res.ok) return \"ok\";\n    if (res.status === 401 || res.status === 403) return \"unauthorized\";\n    return \"unavailable\";\n  } catch {\n    return \"unavailable\";\n  }\n}\n\nexport async function refreshToken(): Promise<boolean> {\n  return (await refreshSession()) === \"ok\";\n}\n\nfunction assertValidLoginRedirectUrl(redirectUrl: string): void {\n  let url: URL;\n  try {\n    url = new URL(redirectUrl);\n  } catch {\n    throw new Error(\"loginUrl redirectUrl must be a valid absolute URL\");\n  }\n\n  if (url.protocol !== \"https:\") {\n    throw new Error(\"loginUrl redirectUrl must use https\");\n  }\n\n  if (!isAllowedLoginRedirectHost(url.hostname)) {\n    throw new Error(\n      \"loginUrl redirectUrl host must be lemondouble.com or a subdomain of lemondouble.com\"\n    );\n  }\n}\n\nfunction isAllowedLoginRedirectHost(hostname: string): boolean {\n  const normalized = hostname.toLowerCase();\n  return (\n    normalized === \"lemondouble.com\" ||\n    normalized.endsWith(\".lemondouble.com\")\n  );\n}\n"],"mappings":";;;;;;;;;AAEA,SAAS,eAAe,kBAAkB;AAqBtC;AAbJ,IAAM,cAAc,cAAgC;AAAA,EAClD,MAAM;AAAA,EACN,iBAAiB;AACnB,CAAC;AAEM,SAAS,aAAa;AAAA,EAC3B;AAAA,EACA;AACF,GAGG;AACD,SACE,oBAAC,eAAY,OAAO,EAAE,MAAM,iBAAiB,SAAS,KAAK,GACxD,UACH;AAEJ;AAEO,SAAS,UAA4B;AAC1C,SAAO,WAAW,WAAW;AAC/B;;;AC7BA,SAAS,WAAW,gBAAgB;AACpC,SAAS,uBAAuB;;;ACKzB,SAAS,SAAS,aAA6B;AACpD,MAAI,kBAAkB,EAAG,QAAO;AAChC,8BAA4B,WAAW;AACvC,SAAO,GAAG,SAAS,iBAAiB,mBAAmB,WAAW,CAAC;AACrE;AAEO,SAAS,WAAW,aAA8B;AACvD,MAAI,kBAAkB,EAAG,QAAO,eAAe;AAC/C,MAAI,aAAa;AACf,WAAO,GAAG,gBAAgB,iBAAiB,mBAAmB,WAAW,CAAC;AAAA,EAC5E;AACA,SAAO;AACT;AAMA,eAAsB,SAA2B;AAC/C,MAAI,kBAAkB,EAAG,QAAO;AAEhC,MAAI;AACF,UAAM,MAAM,MAAM,MAAM,YAAY;AAAA,MAClC,QAAQ;AAAA,MACR,aAAa;AAAA,IACf,CAAC;AACD,WAAO,IAAI;AAAA,EACb,QAAQ;AACN,WAAO;AAAA,EACT;AACF;AAWA,eAAsB,iBAAgD;AACpE,MAAI,kBAAkB,EAAG,QAAO;AAEhC,MAAI;AACF,UAAM,MAAM,MAAM,MAAM,aAAa;AAAA,MACnC,QAAQ;AAAA,MACR,aAAa;AAAA,IACf,CAAC;AACD,QAAI,IAAI,GAAI,QAAO;AACnB,QAAI,IAAI,WAAW,OAAO,IAAI,WAAW,IAAK,QAAO;AACrD,WAAO;AAAA,EACT,QAAQ;AACN,WAAO;AAAA,EACT;AACF;AAEA,eAAsB,eAAiC;AACrD,SAAQ,MAAM,eAAe,MAAO;AACtC;AAEA,SAAS,4BAA4B,aAA2B;AAC9D,MAAI;AACJ,MAAI;AACF,UAAM,IAAI,IAAI,WAAW;AAAA,EAC3B,QAAQ;AACN,UAAM,IAAI,MAAM,mDAAmD;AAAA,EACrE;AAEA,MAAI,IAAI,aAAa,UAAU;AAC7B,UAAM,IAAI,MAAM,qCAAqC;AAAA,EACvD;AAEA,MAAI,CAAC,2BAA2B,IAAI,QAAQ,GAAG;AAC7C,UAAM,IAAI;AAAA,MACR;AAAA,IACF;AAAA,EACF;AACF;AAEA,SAAS,2BAA2B,UAA2B;AAC7D,QAAM,aAAa,SAAS,YAAY;AACxC,SACE,eAAe,qBACf,WAAW,SAAS,kBAAkB;AAE1C;;;ADzCM,SAUE,OAAAA,MAVF;AA5BC,SAAS,eAAe,EAAE,SAAS,GAAkC;AAC1E,QAAM,eAAe,gBAAgB;AACrC,QAAM,CAAC,aAAa,cAAc,IAAI,SAAS,KAAK;AAEpD,YAAU,MAAM;AACd,QAAI,SAAS;AACb,UAAM,OAAO,aAAa,aAAa,IAAI,MAAM,CAAC;AAElD,mBAAe,EAAE,KAAK,CAAC,WAAW;AAChC,UAAI,OAAQ;AAEZ,UAAI,WAAW,eAAe;AAG5B,uBAAe,IAAI;AACnB;AAAA,MACF;AAEA,aAAO,SAAS,QAAQ,IAAI;AAAA,IAC9B,CAAC;AAED,WAAO,MAAM;AACX,eAAS;AAAA,IACX;AAAA,EACF,GAAG,CAAC,YAAY,CAAC;AAEjB,MAAI,aAAa;AACf,WACE;AAAA,MAAC;AAAA;AAAA,QACC,OAAO;AAAA,UACL,WAAW;AAAA,UACX,SAAS;AAAA,UACT,eAAe;AAAA,UACf,YAAY;AAAA,UACZ,gBAAgB;AAAA,UAChB,KAAK;AAAA,QACP;AAAA,QAEA;AAAA,0BAAAA,KAAC,OAAE,sGAAkB;AAAA,UACrB,gBAAAA,KAAC,YAAO,MAAK,UAAS,SAAS,MAAM,OAAO,SAAS,OAAO,GAAG,uCAE/D;AAAA;AAAA;AAAA,IACF;AAAA,EAEJ;AAEA,SAAO;AACT;AAOA,SAAS,aAAa,MAA6B;AACjD,MAAI,CAAC,KAAM,QAAO;AAClB,MAAI,CAAC,KAAK,WAAW,GAAG,EAAG,QAAO;AAClC,MAAI,KAAK,WAAW,IAAI,EAAG,QAAO;AAClC,SAAO;AACT;","names":["jsx"]}
+{"version":3,"sources":["../../src/client/context.tsx","../../src/client/session-restore.tsx"],"sourcesContent":["\"use client\";\n\nimport { createContext, useContext } from \"react\";\nimport type { LemonUser } from \"../types.js\";\n\ninterface AuthContextValue {\n  user: LemonUser | null;\n  isAuthenticated: boolean;\n}\n\nconst AuthContext = createContext<AuthContextValue>({\n  user: null,\n  isAuthenticated: false,\n});\n\nexport function AuthProvider({\n  user,\n  children,\n}: {\n  user: LemonUser | null;\n  children: React.ReactNode;\n}) {\n  return (\n    <AuthContext value={{ user, isAuthenticated: user !== null }}>\n      {children}\n    </AuthContext>\n  );\n}\n\nexport function useAuth(): AuthContextValue {\n  return useContext(AuthContext);\n}\n","\"use client\";\n\nimport { useEffect, useState } from \"react\";\nimport { useSearchParams } from \"next/navigation\";\nimport { refreshSession } from \"./url.js\";\n\n/**\n * 토큰을 갱신하는 유일한 주체. 프록시가 만료된 세션을 이리로 보낸다.\n *\n * 갱신을 서버(미들웨어)가 아니라 브라우저가 하는 이유는 두 가지다.\n *\n *   1. 미들웨어는 요청마다 별도 인스턴스로 떠서 서로를 모른다. 프리페치가\n *      깔리면 같은 refresh token 으로 갱신이 동시에 나가고, 회전 경쟁이 난다.\n *      브라우저의 복구 경로는 한 번에 하나만 뜬다.\n *   2. 브라우저 요청에는 진짜 UA 와 WAF 통과 쿠키가 실린다. 서버간 fetch 는\n *      UA 가 런타임 기본값이라 봇 방어에 걸릴 수 있다.\n *\n * 끝나면 router 가 아니라 window.location 으로 next 에 간다. 소프트 네비는\n * 루트 레이아웃(과 AuthProvider)을 다시 렌더하지 않으므로, 옛 세션 스냅샷이\n * 남아 화면이 어긋나거나 라우터 캐시에 굳은 리다이렉트가 되살아난다.\n *\n * 실패해도 next 로 간다. 죽은 토큰이면 서버가 401 응답에서 세션 쿠키를\n * 지워 주므로(auth-server v2026.08.03.2+), 이후 판단 — 로그인으로 보낼지,\n * 익명으로 보여줄지 — 는 프록시와 DAL 이 알아서 한다.\n */\nexport function SessionRestore({ fallback }: { fallback: React.ReactNode }) {\n  const searchParams = useSearchParams();\n  const [unavailable, setUnavailable] = useState(false);\n\n  useEffect(() => {\n    let ignore = false;\n    const next = safeNextPath(searchParams.get(\"next\"));\n\n    refreshSession().then((result) => {\n      if (ignore) return;\n\n      if (result === \"unavailable\") {\n        // 서버 · 네트워크 사정이다. 토큰은 살아 있을 수 있으므로\n        // 로그인으로 보내지 않고 재시도만 권한다.\n        setUnavailable(true);\n        return;\n      }\n\n      window.location.replace(next);\n    });\n\n    return () => {\n      ignore = true;\n    };\n  }, [searchParams]);\n\n  if (unavailable) {\n    return (\n      <div\n        style={{\n          minHeight: \"100dvh\",\n          display: \"flex\",\n          flexDirection: \"column\",\n          alignItems: \"center\",\n          justifyContent: \"center\",\n          gap: 12,\n        }}\n      >\n        <p>인증 서버에 연결하지 못했습니다.</p>\n        <button type=\"button\" onClick={() => window.location.reload()}>\n          다시 시도\n        </button>\n      </div>\n    );\n  }\n\n  return fallback;\n}\n\n/**\n * next 파라미터는 사용자가 조작할 수 있으므로 열린 리다이렉트가 되지 않게\n * 같은 출처의 경로만 허용한다. `//evil.com` 은 브라우저가 프로토콜 상대\n * URL 로 읽으므로 반드시 걸러야 한다.\n */\nfunction safeNextPath(next: string | null): string {\n  if (!next) return \"/\";\n  if (!next.startsWith(\"/\")) return \"/\";\n  if (next.startsWith(\"//\")) return \"/\";\n  return next;\n}\n"],"mappings":";;;;;;;;;;AAEA,SAAS,eAAe,kBAAkB;AAqBtC;AAbJ,IAAM,cAAc,cAAgC;AAAA,EAClD,MAAM;AAAA,EACN,iBAAiB;AACnB,CAAC;AAEM,SAAS,aAAa;AAAA,EAC3B;AAAA,EACA;AACF,GAGG;AACD,SACE,oBAAC,eAAY,OAAO,EAAE,MAAM,iBAAiB,SAAS,KAAK,GACxD,UACH;AAEJ;AAEO,SAAS,UAA4B;AAC1C,SAAO,WAAW,WAAW;AAC/B;;;AC7BA,SAAS,WAAW,gBAAgB;AACpC,SAAS,uBAAuB;AAkD1B,SAUE,OAAAA,MAVF;AA5BC,SAAS,eAAe,EAAE,SAAS,GAAkC;AAC1E,QAAM,eAAe,gBAAgB;AACrC,QAAM,CAAC,aAAa,cAAc,IAAI,SAAS,KAAK;AAEpD,YAAU,MAAM;AACd,QAAI,SAAS;AACb,UAAM,OAAO,aAAa,aAAa,IAAI,MAAM,CAAC;AAElD,mBAAe,EAAE,KAAK,CAAC,WAAW;AAChC,UAAI,OAAQ;AAEZ,UAAI,WAAW,eAAe;AAG5B,uBAAe,IAAI;AACnB;AAAA,MACF;AAEA,aAAO,SAAS,QAAQ,IAAI;AAAA,IAC9B,CAAC;AAED,WAAO,MAAM;AACX,eAAS;AAAA,IACX;AAAA,EACF,GAAG,CAAC,YAAY,CAAC;AAEjB,MAAI,aAAa;AACf,WACE;AAAA,MAAC;AAAA;AAAA,QACC,OAAO;AAAA,UACL,WAAW;AAAA,UACX,SAAS;AAAA,UACT,eAAe;AAAA,UACf,YAAY;AAAA,UACZ,gBAAgB;AAAA,UAChB,KAAK;AAAA,QACP;AAAA,QAEA;AAAA,0BAAAA,KAAC,OAAE,sGAAkB;AAAA,UACrB,gBAAAA,KAAC,YAAO,MAAK,UAAS,SAAS,MAAM,OAAO,SAAS,OAAO,GAAG,uCAE/D;AAAA;AAAA;AAAA,IACF;AAAA,EAEJ;AAEA,SAAO;AACT;AAOA,SAAS,aAAa,MAA6B;AACjD,MAAI,CAAC,KAAM,QAAO;AAClB,MAAI,CAAC,KAAK,WAAW,GAAG,EAAG,QAAO;AAClC,MAAI,KAAK,WAAW,IAAI,EAAG,QAAO;AAClC,SAAO;AACT;","names":["jsx"]}

package/dist/proxy/index.d.ts

@@ -1,26 +1,14 @@
 import { NextRequest, NextResponse } from 'next/server';
 
-declare const DEFAULT_AUTH_BYPASS_PATHS: string[];
 declare const DEFAULT_API_PATHS: string[];
-/** 앱이 <SessionRestore /> 를 마운트해야 하는 기본 경로. */
-declare const DEFAULT_RESTORE_PATH = "/auth/restore";
-declare const PROXY_AUTH_ERROR: {
-    readonly UNAUTHORIZED: "UNAUTHORIZED";
-    readonly FORBIDDEN: "FORBIDDEN";
-};
-type ProxyAuthErrorCode = (typeof PROXY_AUTH_ERROR)[keyof typeof PROXY_AUTH_ERROR];
 type LoginRedirectUrl = string | ((request: NextRequest) => string);
 interface AuthProxyOptions {
     /** 로그인 없이 열어둘 경로. 익명이면 통과, 만료 세션이면 복구를 거친다. */
     publicPaths?: string[];
-    /** 프록시 자체를 건너뛸 경로. 정적 파일 등. */
-    bypassPaths?: string[];
     /** 리다이렉트 대신 401 JSON 을 돌려줄 경로. 기본 `/api/*`. */
     apiPaths?: string[];
     loginRedirectUrl?: LoginRedirectUrl;
-    /** <SessionRestore /> 를 마운트한 경로. 기본 `/auth/restore`. */
-    restorePath?: string;
 }
 declare function createAuthProxy(options?: AuthProxyOptions): (request: NextRequest) => Promise<NextResponse>;
 
-export { type AuthProxyOptions, DEFAULT_API_PATHS, DEFAULT_AUTH_BYPASS_PATHS, DEFAULT_RESTORE_PATH, type LoginRedirectUrl, PROXY_AUTH_ERROR, type ProxyAuthErrorCode, createAuthProxy };
+export { type AuthProxyOptions, DEFAULT_API_PATHS, type LoginRedirectUrl, createAuthProxy };

package/dist/proxy/index.js

@@ -3,12 +3,12 @@ import {
   LOGIN_URL,
   REFRESH_TOKEN_COOKIE,
   isMockAuthEnabled
-} from "../chunk-OX5MDVSR.js";
+} from "../chunk-JIXVTKLG.js";
 
 // src/proxy/index.ts
 import { NextResponse } from "next/server";
 var REFRESH_BUFFER_SECONDS = 60;
-var DEFAULT_AUTH_BYPASS_PATHS = [
+var AUTH_BYPASS_PATHS = [
   "/sw.js",
   "/service-worker.js",
   "/manifest.webmanifest",
@@ -23,26 +23,19 @@ var DEFAULT_AUTH_BYPASS_PATHS = [
   "/icons/*"
 ];
 var DEFAULT_API_PATHS = ["/api/*"];
-var DEFAULT_RESTORE_PATH = "/auth/restore";
-var PROXY_AUTH_ERROR = {
-  UNAUTHORIZED: "UNAUTHORIZED",
-  FORBIDDEN: "FORBIDDEN"
-};
+var RESTORE_PATH = "/auth/restore";
 function createAuthProxy(options = {}) {
   const {
     publicPaths = [],
-    bypassPaths = [],
     apiPaths = DEFAULT_API_PATHS,
-    loginRedirectUrl,
-    restorePath = DEFAULT_RESTORE_PATH
+    loginRedirectUrl
   } = options;
-  const effectiveBypassPaths = [...DEFAULT_AUTH_BYPASS_PATHS, ...bypassPaths];
   return async function proxy(request) {
     const { pathname } = request.nextUrl;
-    if (pathname === restorePath) {
+    if (pathname === RESTORE_PATH) {
       return NextResponse.next();
     }
-    if (isPublicPath(pathname, effectiveBypassPaths)) {
+    if (isPublicPath(pathname, AUTH_BYPASS_PATHS)) {
       return NextResponse.next();
     }
     if (isMockAuthEnabled()) {
@@ -58,7 +51,7 @@ function createAuthProxy(options = {}) {
         return NextResponse.next();
       }
       return NextResponse.json(
-        { code: PROXY_AUTH_ERROR.UNAUTHORIZED },
+        { code: "UNAUTHORIZED" },
         { status: 401 }
       );
     }
@@ -66,7 +59,7 @@ function createAuthProxy(options = {}) {
       return NextResponse.next();
     }
     if (request.cookies.get(REFRESH_TOKEN_COOKIE)?.value) {
-      const restore = new URL(restorePath, request.url);
+      const restore = new URL(RESTORE_PATH, request.url);
       restore.searchParams.set("next", pathname + request.nextUrl.search);
       return NextResponse.redirect(restore);
     }
@@ -106,9 +99,6 @@ function redirectToLogin(request, loginRedirectUrl) {
 }
 export {
   DEFAULT_API_PATHS,
-  DEFAULT_AUTH_BYPASS_PATHS,
-  DEFAULT_RESTORE_PATH,
-  PROXY_AUTH_ERROR,
   createAuthProxy
 };
 //# sourceMappingURL=index.js.map

package/dist/proxy/index.js.map

@@ -1 +1 @@
-{"version":3,"sources":["../../src/proxy/index.ts"],"sourcesContent":["import { NextRequest, NextResponse } from \"next/server\";\nimport {\n  ACCESS_TOKEN_COOKIE,\n  REFRESH_TOKEN_COOKIE,\n  LOGIN_URL,\n} from \"../constants.js\";\nimport { isMockAuthEnabled } from \"../mock.js\";\n\n/**\n * 프록시는 라우팅 결정만 한다: 신선하면 통과, 아니면 복구 경로로.\n *\n * Next.js 공식 인증 가이드의 optimistic check 다. 프리페치를 포함한 모든\n * 요청에서 돌기 때문에 쿠키의 exp 만 읽고, 네트워크 · DB · 서명 검증을\n * 하지 않는다. 보안 판단은 DAL(getSession / requireAuth)이 한다.\n *\n * 갱신 주체는 restorePath 에 마운트된 <SessionRestore /> 하나뿐이다.\n * 공개 경로도 refresh 쿠키가 남아 있으면 복구를 거치게 해서, 만료된 세션이\n * \"로그아웃 상태로 렌더됐다가 뒤늦게 뒤집히는\" 화면을 없앤다. (0.8.x 까지는\n * 이 몫을 레이아웃의 <AutoTokenRefresh /> 가 맡았는데, 복구 경로와 갱신\n * 주체가 둘이 되는 문제가 있었다)\n *\n * 0.7.x 까지는 프록시가 직접 auth 서버로 갱신을 보냈다. 미들웨어는 요청마다\n * 별도 인스턴스로 떠서 직렬화가 안 되므로, 프리페치가 겹치면 같은 refresh\n * token 으로 갱신이 동시에 나가 회전 경쟁이 났고 계정 토큰이 통째로\n * 폐기되는 일이 반복됐다. 다시 여기에 네트워크 호출을 넣지 말 것.\n */\n\nconst REFRESH_BUFFER_SECONDS = 60;\n\nexport const DEFAULT_AUTH_BYPASS_PATHS = [\n  \"/sw.js\",\n  \"/service-worker.js\",\n  \"/manifest.webmanifest\",\n  \"/manifest.json\",\n  \"/favicon.ico\",\n  \"/robots.txt\",\n  \"/sitemap.xml\",\n  \"/browserconfig.xml\",\n  \"/apple-touch-icon.png\",\n  \"/apple-touch-icon-*\",\n  \"/icon-*\",\n  \"/icons/*\",\n];\n\nexport const DEFAULT_API_PATHS = [\"/api/*\"];\n\n/** 앱이 <SessionRestore /> 를 마운트해야 하는 기본 경로. */\nexport const DEFAULT_RESTORE_PATH = \"/auth/restore\";\n\nexport const PROXY_AUTH_ERROR = {\n  UNAUTHORIZED: \"UNAUTHORIZED\",\n  FORBIDDEN: \"FORBIDDEN\",\n} as const;\nexport type ProxyAuthErrorCode =\n  (typeof PROXY_AUTH_ERROR)[keyof typeof PROXY_AUTH_ERROR];\n\nexport type LoginRedirectUrl = string | ((request: NextRequest) => string);\n\nexport interface AuthProxyOptions {\n  /** 로그인 없이 열어둘 경로. 익명이면 통과, 만료 세션이면 복구를 거친다. */\n  publicPaths?: string[];\n  /** 프록시 자체를 건너뛸 경로. 정적 파일 등. */\n  bypassPaths?: string[];\n  /** 리다이렉트 대신 401 JSON 을 돌려줄 경로. 기본 `/api/*`. */\n  apiPaths?: string[];\n  loginRedirectUrl?: LoginRedirectUrl;\n  /** <SessionRestore /> 를 마운트한 경로. 기본 `/auth/restore`. */\n  restorePath?: string;\n}\n\nexport function createAuthProxy(options: AuthProxyOptions = {}) {\n  const {\n    publicPaths = [],\n    bypassPaths = [],\n    apiPaths = DEFAULT_API_PATHS,\n    loginRedirectUrl,\n    restorePath = DEFAULT_RESTORE_PATH,\n  } = options;\n  const effectiveBypassPaths = [...DEFAULT_AUTH_BYPASS_PATHS, ...bypassPaths];\n\n  return async function proxy(request: NextRequest): Promise<NextResponse> {\n    const { pathname } = request.nextUrl;\n\n    // 복구 경로 자신은 항상 통과. 여기서 복구 경로로 보내면 무한 루프다.\n    if (pathname === restorePath) {\n      return NextResponse.next();\n    }\n\n    if (isPublicPath(pathname, effectiveBypassPaths)) {\n      return NextResponse.next();\n    }\n\n    if (isMockAuthEnabled()) {\n      return NextResponse.next();\n    }\n\n    const accessToken = request.cookies.get(ACCESS_TOKEN_COOKIE)?.value;\n    if (accessToken && isTokenFresh(accessToken)) {\n      return NextResponse.next();\n    }\n\n    // --- 여기부터는 access token 이 없거나 만료가 임박한 요청 ---\n\n    const isPublic = isPublicPath(pathname, publicPaths);\n\n    if (isPublicPath(pathname, apiPaths)) {\n      // API 는 리다이렉트를 따라가봐야 HTML 을 받을 뿐이다. 401 을 주고\n      // 클라이언트가 복구하게 한다.\n      if (isPublic) {\n        return NextResponse.next();\n      }\n      return NextResponse.json(\n        { code: PROXY_AUTH_ERROR.UNAUTHORIZED },\n        { status: 401 }\n      );\n    }\n\n    // 서버 액션 등 비-GET 을 리다이렉트하면 액션 프로토콜이 깨진다.\n    // 통과시키고 DAL 이 거부하게 둔다.\n    if (request.method !== \"GET\") {\n      return NextResponse.next();\n    }\n\n    // refresh 가 남아 있으면 아직 로그인이 풀린 게 아니다. 브라우저가\n    // 갱신할 수 있도록 복구 경로로 보낸다. 프리페치가 이 리다이렉트를\n    // 캐시에 굳혀도 해가 없다 — 복구 경로는 스스로 세션을 되살리고\n    // next 로 되돌려 보내므로 목적지가 보존된다.\n    if (request.cookies.get(REFRESH_TOKEN_COOKIE)?.value) {\n      const restore = new URL(restorePath, request.url);\n      restore.searchParams.set(\"next\", pathname + request.nextUrl.search);\n      return NextResponse.redirect(restore);\n    }\n\n    if (isPublic) {\n      return NextResponse.next();\n    }\n\n    return redirectToLogin(request, loginRedirectUrl);\n  };\n}\n\n/**\n * exp 만 본다. 서명은 검증하지 않는다.\n *\n * 위조한 토큰으로 이 검사를 통과할 수는 있으나, 그래봐야 DAL 에서 걸린다.\n * 프록시의 판단은 \"어느 화면으로 보낼까\" 이지 \"권한이 있는가\" 가 아니다.\n */\nfunction isTokenFresh(token: string): boolean {\n  try {\n    const parts = token.split(\".\");\n    if (parts.length !== 3) return false;\n    const payload = JSON.parse(\n      Buffer.from(parts[1], \"base64url\").toString()\n    ) as { exp?: unknown };\n    return (\n      typeof payload.exp === \"number\" &&\n      payload.exp > Math.floor(Date.now() / 1000) + REFRESH_BUFFER_SECONDS\n    );\n  } catch {\n    return false;\n  }\n}\n\nfunction isPublicPath(pathname: string, publicPaths: string[]): boolean {\n  return publicPaths.some((p) => {\n    if (p.endsWith(\"*\")) {\n      return pathname.startsWith(p.slice(0, -1));\n    }\n    return pathname === p;\n  });\n}\n\nfunction redirectToLogin(\n  request: NextRequest,\n  loginRedirectUrl: LoginRedirectUrl | undefined\n): NextResponse {\n  const redirectUrl =\n    typeof loginRedirectUrl === \"function\"\n      ? loginRedirectUrl(request)\n      : loginRedirectUrl;\n\n  if (redirectUrl) {\n    const url = `${LOGIN_URL}?redirect_url=${encodeURIComponent(redirectUrl)}`;\n    return NextResponse.redirect(new URL(url, request.url));\n  }\n  return NextResponse.redirect(new URL(\"/\", request.url));\n}\n"],"mappings":";;;;;;;;AAAA,SAAsB,oBAAoB;AA2B1C,IAAM,yBAAyB;AAExB,IAAM,4BAA4B;AAAA,EACvC;AAAA,EACA;AAAA,EACA;AAAA,EACA;AAAA,EACA;AAAA,EACA;AAAA,EACA;AAAA,EACA;AAAA,EACA;AAAA,EACA;AAAA,EACA;AAAA,EACA;AACF;AAEO,IAAM,oBAAoB,CAAC,QAAQ;AAGnC,IAAM,uBAAuB;AAE7B,IAAM,mBAAmB;AAAA,EAC9B,cAAc;AAAA,EACd,WAAW;AACb;AAkBO,SAAS,gBAAgB,UAA4B,CAAC,GAAG;AAC9D,QAAM;AAAA,IACJ,cAAc,CAAC;AAAA,IACf,cAAc,CAAC;AAAA,IACf,WAAW;AAAA,IACX;AAAA,IACA,cAAc;AAAA,EAChB,IAAI;AACJ,QAAM,uBAAuB,CAAC,GAAG,2BAA2B,GAAG,WAAW;AAE1E,SAAO,eAAe,MAAM,SAA6C;AACvE,UAAM,EAAE,SAAS,IAAI,QAAQ;AAG7B,QAAI,aAAa,aAAa;AAC5B,aAAO,aAAa,KAAK;AAAA,IAC3B;AAEA,QAAI,aAAa,UAAU,oBAAoB,GAAG;AAChD,aAAO,aAAa,KAAK;AAAA,IAC3B;AAEA,QAAI,kBAAkB,GAAG;AACvB,aAAO,aAAa,KAAK;AAAA,IAC3B;AAEA,UAAM,cAAc,QAAQ,QAAQ,IAAI,mBAAmB,GAAG;AAC9D,QAAI,eAAe,aAAa,WAAW,GAAG;AAC5C,aAAO,aAAa,KAAK;AAAA,IAC3B;AAIA,UAAM,WAAW,aAAa,UAAU,WAAW;AAEnD,QAAI,aAAa,UAAU,QAAQ,GAAG;AAGpC,UAAI,UAAU;AACZ,eAAO,aAAa,KAAK;AAAA,MAC3B;AACA,aAAO,aAAa;AAAA,QAClB,EAAE,MAAM,iBAAiB,aAAa;AAAA,QACtC,EAAE,QAAQ,IAAI;AAAA,MAChB;AAAA,IACF;AAIA,QAAI,QAAQ,WAAW,OAAO;AAC5B,aAAO,aAAa,KAAK;AAAA,IAC3B;AAMA,QAAI,QAAQ,QAAQ,IAAI,oBAAoB,GAAG,OAAO;AACpD,YAAM,UAAU,IAAI,IAAI,aAAa,QAAQ,GAAG;AAChD,cAAQ,aAAa,IAAI,QAAQ,WAAW,QAAQ,QAAQ,MAAM;AAClE,aAAO,aAAa,SAAS,OAAO;AAAA,IACtC;AAEA,QAAI,UAAU;AACZ,aAAO,aAAa,KAAK;AAAA,IAC3B;AAEA,WAAO,gBAAgB,SAAS,gBAAgB;AAAA,EAClD;AACF;AAQA,SAAS,aAAa,OAAwB;AAC5C,MAAI;AACF,UAAM,QAAQ,MAAM,MAAM,GAAG;AAC7B,QAAI,MAAM,WAAW,EAAG,QAAO;AAC/B,UAAM,UAAU,KAAK;AAAA,MACnB,OAAO,KAAK,MAAM,CAAC,GAAG,WAAW,EAAE,SAAS;AAAA,IAC9C;AACA,WACE,OAAO,QAAQ,QAAQ,YACvB,QAAQ,MAAM,KAAK,MAAM,KAAK,IAAI,IAAI,GAAI,IAAI;AAAA,EAElD,QAAQ;AACN,WAAO;AAAA,EACT;AACF;AAEA,SAAS,aAAa,UAAkB,aAAgC;AACtE,SAAO,YAAY,KAAK,CAAC,MAAM;AAC7B,QAAI,EAAE,SAAS,GAAG,GAAG;AACnB,aAAO,SAAS,WAAW,EAAE,MAAM,GAAG,EAAE,CAAC;AAAA,IAC3C;AACA,WAAO,aAAa;AAAA,EACtB,CAAC;AACH;AAEA,SAAS,gBACP,SACA,kBACc;AACd,QAAM,cACJ,OAAO,qBAAqB,aACxB,iBAAiB,OAAO,IACxB;AAEN,MAAI,aAAa;AACf,UAAM,MAAM,GAAG,SAAS,iBAAiB,mBAAmB,WAAW,CAAC;AACxE,WAAO,aAAa,SAAS,IAAI,IAAI,KAAK,QAAQ,GAAG,CAAC;AAAA,EACxD;AACA,SAAO,aAAa,SAAS,IAAI,IAAI,KAAK,QAAQ,GAAG,CAAC;AACxD;","names":[]}
+{"version":3,"sources":["../../src/proxy/index.ts"],"sourcesContent":["import { NextRequest, NextResponse } from \"next/server\";\nimport {\n  ACCESS_TOKEN_COOKIE,\n  REFRESH_TOKEN_COOKIE,\n  LOGIN_URL,\n} from \"../constants.js\";\nimport { isMockAuthEnabled } from \"../mock.js\";\n\n/**\n * 프록시는 라우팅 결정만 한다: 신선하면 통과, 아니면 복구 경로로.\n *\n * Next.js 공식 인증 가이드의 optimistic check 다. 프리페치를 포함한 모든\n * 요청에서 돌기 때문에 쿠키의 exp 만 읽고, 네트워크 · DB · 서명 검증을\n * 하지 않는다. 보안 판단은 DAL(getSession / requireAuth)이 한다.\n *\n * 갱신 주체는 RESTORE_PATH 에 마운트된 <SessionRestore /> 하나뿐이다.\n * 공개 경로도 refresh 쿠키가 남아 있으면 복구를 거치게 해서, 만료된 세션이\n * \"로그아웃 상태로 렌더됐다가 뒤늦게 뒤집히는\" 화면을 없앤다. (0.8.x 까지는\n * 이 몫을 레이아웃의 <AutoTokenRefresh /> 가 맡았는데, 복구 경로와 갱신\n * 주체가 둘이 되는 문제가 있었다)\n *\n * 0.7.x 까지는 프록시가 직접 auth 서버로 갱신을 보냈다. 미들웨어는 요청마다\n * 별도 인스턴스로 떠서 직렬화가 안 되므로, 프리페치가 겹치면 같은 refresh\n * token 으로 갱신이 동시에 나가 회전 경쟁이 났고 계정 토큰이 통째로\n * 폐기되는 일이 반복됐다. 다시 여기에 네트워크 호출을 넣지 말 것.\n */\n\nconst REFRESH_BUFFER_SECONDS = 60;\n\nconst AUTH_BYPASS_PATHS = [\n  \"/sw.js\",\n  \"/service-worker.js\",\n  \"/manifest.webmanifest\",\n  \"/manifest.json\",\n  \"/favicon.ico\",\n  \"/robots.txt\",\n  \"/sitemap.xml\",\n  \"/browserconfig.xml\",\n  \"/apple-touch-icon.png\",\n  \"/apple-touch-icon-*\",\n  \"/icon-*\",\n  \"/icons/*\",\n];\n\nexport const DEFAULT_API_PATHS = [\"/api/*\"];\n\n/** 앱이 <SessionRestore /> 를 마운트해야 하는 경로. */\nconst RESTORE_PATH = \"/auth/restore\";\n\nexport type LoginRedirectUrl = string | ((request: NextRequest) => string);\n\nexport interface AuthProxyOptions {\n  /** 로그인 없이 열어둘 경로. 익명이면 통과, 만료 세션이면 복구를 거친다. */\n  publicPaths?: string[];\n  /** 리다이렉트 대신 401 JSON 을 돌려줄 경로. 기본 `/api/*`. */\n  apiPaths?: string[];\n  loginRedirectUrl?: LoginRedirectUrl;\n}\n\nexport function createAuthProxy(options: AuthProxyOptions = {}) {\n  const {\n    publicPaths = [],\n    apiPaths = DEFAULT_API_PATHS,\n    loginRedirectUrl,\n  } = options;\n\n  return async function proxy(request: NextRequest): Promise<NextResponse> {\n    const { pathname } = request.nextUrl;\n\n    // 복구 경로 자신은 항상 통과. 여기서 복구 경로로 보내면 무한 루프다.\n    if (pathname === RESTORE_PATH) {\n      return NextResponse.next();\n    }\n\n    if (isPublicPath(pathname, AUTH_BYPASS_PATHS)) {\n      return NextResponse.next();\n    }\n\n    if (isMockAuthEnabled()) {\n      return NextResponse.next();\n    }\n\n    const accessToken = request.cookies.get(ACCESS_TOKEN_COOKIE)?.value;\n    if (accessToken && isTokenFresh(accessToken)) {\n      return NextResponse.next();\n    }\n\n    // --- 여기부터는 access token 이 없거나 만료가 임박한 요청 ---\n\n    const isPublic = isPublicPath(pathname, publicPaths);\n\n    if (isPublicPath(pathname, apiPaths)) {\n      // API 는 리다이렉트를 따라가봐야 HTML 을 받을 뿐이다. 401 을 주고\n      // 클라이언트가 복구하게 한다.\n      if (isPublic) {\n        return NextResponse.next();\n      }\n      return NextResponse.json(\n        { code: \"UNAUTHORIZED\" },\n        { status: 401 }\n      );\n    }\n\n    // 서버 액션 등 비-GET 을 리다이렉트하면 액션 프로토콜이 깨진다.\n    // 통과시키고 DAL 이 거부하게 둔다.\n    if (request.method !== \"GET\") {\n      return NextResponse.next();\n    }\n\n    // refresh 가 남아 있으면 아직 로그인이 풀린 게 아니다. 브라우저가\n    // 갱신할 수 있도록 복구 경로로 보낸다. 프리페치가 이 리다이렉트를\n    // 캐시에 굳혀도 해가 없다 — 복구 경로는 스스로 세션을 되살리고\n    // next 로 되돌려 보내므로 목적지가 보존된다.\n    if (request.cookies.get(REFRESH_TOKEN_COOKIE)?.value) {\n      const restore = new URL(RESTORE_PATH, request.url);\n      restore.searchParams.set(\"next\", pathname + request.nextUrl.search);\n      return NextResponse.redirect(restore);\n    }\n\n    if (isPublic) {\n      return NextResponse.next();\n    }\n\n    return redirectToLogin(request, loginRedirectUrl);\n  };\n}\n\n/**\n * exp 만 본다. 서명은 검증하지 않는다.\n *\n * 위조한 토큰으로 이 검사를 통과할 수는 있으나, 그래봐야 DAL 에서 걸린다.\n * 프록시의 판단은 \"어느 화면으로 보낼까\" 이지 \"권한이 있는가\" 가 아니다.\n */\nfunction isTokenFresh(token: string): boolean {\n  try {\n    const parts = token.split(\".\");\n    if (parts.length !== 3) return false;\n    const payload = JSON.parse(\n      Buffer.from(parts[1], \"base64url\").toString()\n    ) as { exp?: unknown };\n    return (\n      typeof payload.exp === \"number\" &&\n      payload.exp > Math.floor(Date.now() / 1000) + REFRESH_BUFFER_SECONDS\n    );\n  } catch {\n    return false;\n  }\n}\n\nfunction isPublicPath(pathname: string, publicPaths: string[]): boolean {\n  return publicPaths.some((p) => {\n    if (p.endsWith(\"*\")) {\n      return pathname.startsWith(p.slice(0, -1));\n    }\n    return pathname === p;\n  });\n}\n\nfunction redirectToLogin(\n  request: NextRequest,\n  loginRedirectUrl: LoginRedirectUrl | undefined\n): NextResponse {\n  const redirectUrl =\n    typeof loginRedirectUrl === \"function\"\n      ? loginRedirectUrl(request)\n      : loginRedirectUrl;\n\n  if (redirectUrl) {\n    const url = `${LOGIN_URL}?redirect_url=${encodeURIComponent(redirectUrl)}`;\n    return NextResponse.redirect(new URL(url, request.url));\n  }\n  return NextResponse.redirect(new URL(\"/\", request.url));\n}\n"],"mappings":";;;;;;;;AAAA,SAAsB,oBAAoB;AA2B1C,IAAM,yBAAyB;AAE/B,IAAM,oBAAoB;AAAA,EACxB;AAAA,EACA;AAAA,EACA;AAAA,EACA;AAAA,EACA;AAAA,EACA;AAAA,EACA;AAAA,EACA;AAAA,EACA;AAAA,EACA;AAAA,EACA;AAAA,EACA;AACF;AAEO,IAAM,oBAAoB,CAAC,QAAQ;AAG1C,IAAM,eAAe;AAYd,SAAS,gBAAgB,UAA4B,CAAC,GAAG;AAC9D,QAAM;AAAA,IACJ,cAAc,CAAC;AAAA,IACf,WAAW;AAAA,IACX;AAAA,EACF,IAAI;AAEJ,SAAO,eAAe,MAAM,SAA6C;AACvE,UAAM,EAAE,SAAS,IAAI,QAAQ;AAG7B,QAAI,aAAa,cAAc;AAC7B,aAAO,aAAa,KAAK;AAAA,IAC3B;AAEA,QAAI,aAAa,UAAU,iBAAiB,GAAG;AAC7C,aAAO,aAAa,KAAK;AAAA,IAC3B;AAEA,QAAI,kBAAkB,GAAG;AACvB,aAAO,aAAa,KAAK;AAAA,IAC3B;AAEA,UAAM,cAAc,QAAQ,QAAQ,IAAI,mBAAmB,GAAG;AAC9D,QAAI,eAAe,aAAa,WAAW,GAAG;AAC5C,aAAO,aAAa,KAAK;AAAA,IAC3B;AAIA,UAAM,WAAW,aAAa,UAAU,WAAW;AAEnD,QAAI,aAAa,UAAU,QAAQ,GAAG;AAGpC,UAAI,UAAU;AACZ,eAAO,aAAa,KAAK;AAAA,MAC3B;AACA,aAAO,aAAa;AAAA,QAClB,EAAE,MAAM,eAAe;AAAA,QACvB,EAAE,QAAQ,IAAI;AAAA,MAChB;AAAA,IACF;AAIA,QAAI,QAAQ,WAAW,OAAO;AAC5B,aAAO,aAAa,KAAK;AAAA,IAC3B;AAMA,QAAI,QAAQ,QAAQ,IAAI,oBAAoB,GAAG,OAAO;AACpD,YAAM,UAAU,IAAI,IAAI,cAAc,QAAQ,GAAG;AACjD,cAAQ,aAAa,IAAI,QAAQ,WAAW,QAAQ,QAAQ,MAAM;AAClE,aAAO,aAAa,SAAS,OAAO;AAAA,IACtC;AAEA,QAAI,UAAU;AACZ,aAAO,aAAa,KAAK;AAAA,IAC3B;AAEA,WAAO,gBAAgB,SAAS,gBAAgB;AAAA,EAClD;AACF;AAQA,SAAS,aAAa,OAAwB;AAC5C,MAAI;AACF,UAAM,QAAQ,MAAM,MAAM,GAAG;AAC7B,QAAI,MAAM,WAAW,EAAG,QAAO;AAC/B,UAAM,UAAU,KAAK;AAAA,MACnB,OAAO,KAAK,MAAM,CAAC,GAAG,WAAW,EAAE,SAAS;AAAA,IAC9C;AACA,WACE,OAAO,QAAQ,QAAQ,YACvB,QAAQ,MAAM,KAAK,MAAM,KAAK,IAAI,IAAI,GAAI,IAAI;AAAA,EAElD,QAAQ;AACN,WAAO;AAAA,EACT;AACF;AAEA,SAAS,aAAa,UAAkB,aAAgC;AACtE,SAAO,YAAY,KAAK,CAAC,MAAM;AAC7B,QAAI,EAAE,SAAS,GAAG,GAAG;AACnB,aAAO,SAAS,WAAW,EAAE,MAAM,GAAG,EAAE,CAAC;AAAA,IAC3C;AACA,WAAO,aAAa;AAAA,EACtB,CAAC;AACH;AAEA,SAAS,gBACP,SACA,kBACc;AACd,QAAM,cACJ,OAAO,qBAAqB,aACxB,iBAAiB,OAAO,IACxB;AAEN,MAAI,aAAa;AACf,UAAM,MAAM,GAAG,SAAS,iBAAiB,mBAAmB,WAAW,CAAC;AACxE,WAAO,aAAa,SAAS,IAAI,IAAI,KAAK,QAAQ,GAAG,CAAC;AAAA,EACxD;AACA,SAAO,aAAa,SAAS,IAAI,IAAI,KAAK,QAAQ,GAAG,CAAC;AACxD;","names":[]}

package/dist/server/index.d.ts

@@ -1,31 +1,13 @@
-import { A as AccessTokenClaims, L as LemonSession, a as LemonUser } from '../types-B5uRY2Si.js';
-export { U as UserProfile } from '../types-B5uRY2Si.js';
-import 'jose';
-
-declare function verifyAccessToken(): Promise<AccessTokenClaims | null>;
-declare function verifyAccessTokenString(token: string): Promise<AccessTokenClaims | null>;
+import { L as LemonSession, a as LemonUser } from '../url-qhLR3uNu.js';
+export { l as loginUrl, p as profileUrl } from '../url-qhLR3uNu.js';
 
 declare const getUser: () => Promise<LemonUser | null>;
-interface GetSessionOptions {
-    clientId?: string;
-}
-declare function getSession(options?: GetSessionOptions): Promise<LemonSession>;
-declare function requireAuth(redirectTo?: string): Promise<LemonUser>;
-interface RequireClientOptions {
+declare function getSession({ clientId, }: {
+    clientId: string;
+}): Promise<LemonSession>;
+declare function requireClient(clientId: string, { loginRedirectTo, unapprovedRedirectTo, }?: {
     loginRedirectTo?: string;
     unapprovedRedirectTo?: string;
-}
-declare function requireClient(clientId: string, optionsOrRedirectTo?: string | RequireClientOptions): Promise<LemonUser>;
-
-declare const AUTH_SERVER_URL = "https://auth.lemondouble.com";
-declare const JWKS_URL = "https://auth.lemondouble.com/.well-known/jwks.json";
-declare const LOGIN_URL = "https://auth.lemondouble.com/api/oauth2/google/login";
-declare const REFRESH_URL = "https://auth.lemondouble.com/api/token/refresh";
-declare const LOGOUT_URL = "https://auth.lemondouble.com/api/token/logout";
-declare const PROFILE_URL = "https://auth.lemondouble.com/api/user/me";
-declare const PROFILE_PAGE_URL = "https://auth.lemondouble.com/profile";
-declare const ACCESS_TOKEN_COOKIE = "lemon_access_token";
-declare const REFRESH_TOKEN_COOKIE = "lemon_refresh_token";
-declare const DEVICE_ID_COOKIE = "device_id";
+}): Promise<LemonUser>;
 
-export { ACCESS_TOKEN_COOKIE, AUTH_SERVER_URL, AccessTokenClaims, DEVICE_ID_COOKIE, type GetSessionOptions, JWKS_URL, LOGIN_URL, LOGOUT_URL, LemonSession, LemonUser, PROFILE_PAGE_URL, PROFILE_URL, REFRESH_TOKEN_COOKIE, REFRESH_URL, type RequireClientOptions, getSession, getUser, requireAuth, requireClient, verifyAccessToken, verifyAccessTokenString };
+export { LemonSession, LemonUser, getSession, getUser, requireClient };

package/dist/server/index.js

@@ -1,16 +1,17 @@
+import {
+  loginUrl,
+  profileUrl
+} from "../chunk-ICPDIWYK.js";
 import {
   ACCESS_TOKEN_COOKIE,
   AUTH_SERVER_URL,
-  DEVICE_ID_COOKIE,
   JWKS_URL,
-  LOGIN_URL,
-  LOGOUT_URL,
-  PROFILE_PAGE_URL,
-  PROFILE_URL,
-  REFRESH_TOKEN_COOKIE,
-  REFRESH_URL,
   getMockAccessTokenClaims
-} from "../chunk-OX5MDVSR.js";
+} from "../chunk-JIXVTKLG.js";
+
+// src/server/user.ts
+import { cache } from "react";
+import { redirect } from "next/navigation";
 
 // src/server/verify.ts
 import { createRemoteJWKSet, jwtVerify } from "jose";
@@ -45,12 +46,16 @@ function errorCode(error) {
 
 // src/server/verify.ts
 var jwks = createRemoteJWKSet(new URL(JWKS_URL));
-async function verify(token) {
+async function verifyAccessToken() {
+  const mockClaims = getMockAccessTokenClaims();
+  if (mockClaims) return mockClaims;
+  const cookieStore = await cookies();
+  const token = cookieStore.get(ACCESS_TOKEN_COOKIE)?.value;
+  if (!token) return null;
   try {
     const { payload } = await jwtVerify(token, jwks, {
       issuer: AUTH_SERVER_URL,
-      // 발급자(자택 k3s)와 검증자(Vercel)의 시계가 몇 초 어긋나면, 방금
-      // 발급된 토큰이 nbf 미래로 거부되어 로그인 직후 로그아웃으로 보인다.
+      // 발급자(자택 k3s)와 검증자(Vercel)의 시계 어긋남 허용
       clockTolerance: 10
     });
     if (isAccessTokenClaims(payload)) return payload;
@@ -64,38 +69,6 @@ async function verify(token) {
     return null;
   }
 }
-async function verifyAccessToken() {
-  const mockClaims = getMockAccessTokenClaims();
-  if (mockClaims) return mockClaims;
-  const cookieStore = await cookies();
-  const token = cookieStore.get(ACCESS_TOKEN_COOKIE)?.value;
-  if (!token) return null;
-  return verify(token);
-}
-async function verifyAccessTokenString(token) {
-  const mockClaims = getMockAccessTokenClaims();
-  if (mockClaims) return mockClaims;
-  return verify(token);
-}
-
-// src/server/user.ts
-import { cache } from "react";
-import { redirect } from "next/navigation";
-
-// src/approval.ts
-var warnedMissingClientId = false;
-function isApprovedClient(approvedClients, clientId) {
-  if (!clientId) {
-    if (!warnedMissingClientId) {
-      warnedMissingClientId = true;
-      warnAuth(
-        "clientId not provided \u2014 approval check is disabled (all users pass). \uC124\uC815 \uB204\uB77D\uC774 \uC544\uB2CC\uC9C0 \uD655\uC778\uD560 \uAC83."
-      );
-    }
-    return true;
-  }
-  return approvedClients.includes(clientId) || approvedClients.includes("*");
-}
 
 // src/server/user.ts
 function claimsToUser(claims) {
@@ -122,43 +95,29 @@ var getSessionByClientId = cache(
     return { type: "authenticated", user };
   }
 );
-async function getSession(options = {}) {
-  return getSessionByClientId(options.clientId);
-}
-async function requireAuth(redirectTo = "/") {
-  const user = await getUser();
-  if (user) return user;
-  redirect(redirectTo);
+async function getSession({
+  clientId
+}) {
+  return getSessionByClientId(clientId);
 }
-async function requireClient(clientId, optionsOrRedirectTo = "/") {
-  const options = typeof optionsOrRedirectTo === "string" ? { loginRedirectTo: optionsOrRedirectTo } : optionsOrRedirectTo;
+async function requireClient(clientId, {
+  loginRedirectTo = "/",
+  unapprovedRedirectTo = `${AUTH_SERVER_URL}/error?code=FORBIDDEN`
+} = {}) {
   const session = await getSession({ clientId });
-  if (session.type === "none") {
-    redirect(options.loginRedirectTo ?? "/");
-  }
-  if (session.type === "unapproved") {
-    redirect(
-      options.unapprovedRedirectTo ?? `${AUTH_SERVER_URL}/error?code=FORBIDDEN`
-    );
-  }
+  if (session.type === "none") redirect(loginRedirectTo);
+  if (session.type === "unapproved") redirect(unapprovedRedirectTo);
   return session.user;
 }
+function isApprovedClient(approvedClients, clientId) {
+  if (!clientId) return false;
+  return approvedClients.includes(clientId) || approvedClients.includes("*");
+}
 export {
-  ACCESS_TOKEN_COOKIE,
-  AUTH_SERVER_URL,
-  DEVICE_ID_COOKIE,
-  JWKS_URL,
-  LOGIN_URL,
-  LOGOUT_URL,
-  PROFILE_PAGE_URL,
-  PROFILE_URL,
-  REFRESH_TOKEN_COOKIE,
-  REFRESH_URL,
   getSession,
   getUser,
-  requireAuth,
-  requireClient,
-  verifyAccessToken,
-  verifyAccessTokenString
+  loginUrl,
+  profileUrl,
+  requireClient
 };
 //# sourceMappingURL=index.js.map

package/dist/server/index.js.map

@@ -1 +1 @@
-{"version":3,"sources":["../../src/server/verify.ts","../../src/claims.ts","../../src/log.ts","../../src/server/user.ts","../../src/approval.ts"],"sourcesContent":["import { createRemoteJWKSet, jwtVerify } from \"jose\";\nimport { cookies } from \"next/headers\";\nimport type { AccessTokenClaims } from \"../types.js\";\nimport { JWKS_URL, AUTH_SERVER_URL, ACCESS_TOKEN_COOKIE } from \"../constants.js\";\nimport { isAccessTokenClaims } from \"../claims.js\";\nimport { getMockAccessTokenClaims } from \"../mock.js\";\nimport { warnAuth, errorCode } from \"../log.js\";\n\nconst jwks = createRemoteJWKSet(new URL(JWKS_URL));\n\n/**\n * 검증과 진단을 한 곳에 모은다.\n *\n * 예전에는 아래 두 export 가 같은 try/catch 를 각자 갖고 있었다. 그러면\n * 로깅을 붙일 때도 벌마다 갈리고, 한쪽만 고치는 일이 생긴다.\n */\nasync function verify(token: string): Promise<AccessTokenClaims | null> {\n  try {\n    const { payload } = await jwtVerify(token, jwks, {\n      issuer: AUTH_SERVER_URL,\n      // 발급자(자택 k3s)와 검증자(Vercel)의 시계가 몇 초 어긋나면, 방금\n      // 발급된 토큰이 nbf 미래로 거부되어 로그인 직후 로그아웃으로 보인다.\n      clockTolerance: 10,\n    });\n    if (isAccessTokenClaims(payload)) return payload;\n    warnAuth(\"access token claims shape mismatch\");\n    return null;\n  } catch (error) {\n    // 정상 만료는 갱신으로 이어지는 흔한 경로라 남기지 않는다. 나머지는\n    // 원인이 전혀 다르다 — 특히 ERR_JWKS_NO_MATCHING_KEY 는 키 로테이션이나\n    // JWKS 도달 실패이고, 이걸 위조 토큰과 뭉개면 전 사용자가 조용히\n    // 로그아웃된 이유를 알 수 없게 된다.\n    const code = errorCode(error);\n    if (code !== \"ERR_JWT_EXPIRED\") {\n      warnAuth(\"access token verification failed\", { code });\n    }\n    return null;\n  }\n}\n\nexport async function verifyAccessToken(): Promise<AccessTokenClaims | null> {\n  const mockClaims = getMockAccessTokenClaims();\n  if (mockClaims) return mockClaims;\n\n  const cookieStore = await cookies();\n  const token = cookieStore.get(ACCESS_TOKEN_COOKIE)?.value;\n  if (!token) return null;\n\n  return verify(token);\n}\n\nexport async function verifyAccessTokenString(\n  token: string\n): Promise<AccessTokenClaims | null> {\n  const mockClaims = getMockAccessTokenClaims();\n  if (mockClaims) return mockClaims;\n\n  return verify(token);\n}\n","import type { JWTPayload } from \"jose\";\nimport type { AccessTokenClaims } from \"./types.js\";\n\nexport function isAccessTokenClaims(\n  payload: JWTPayload\n): payload is AccessTokenClaims {\n  return (\n    payload.token_type === \"access\" &&\n    typeof payload.sub === \"string\" &&\n    typeof payload.nickname === \"string\" &&\n    typeof payload.profile_image_url === \"string\" &&\n    (payload.role === \"user\" || payload.role === \"admin\") &&\n    Array.isArray(payload.approved_clients) &&\n    payload.approved_clients.every((clientId) => typeof clientId === \"string\")\n  );\n}\n","/**\n * 진단 로그.\n *\n * 이 라이브러리는 오랫동안 실패를 전부 `null` 하나로만 알렸다. 2026-07-19 에\n * auth 서버 앞의 Cloudflare Bot Fight Mode 가 프록시의 갱신 요청을 403\n * (`cf-mitigated: challenge`) 으로 막았을 때, 남은 흔적이 하나도 없어서\n * 원인을 찾는 데 반나절이 걸렸다. 앱 쪽에 임시 진단 코드를 심고 프로덕션에\n * 두 번 배포한 뒤에야 응답 코드를 볼 수 있었다.\n *\n * 그래서 실패에는 최소한의 사실을 남긴다.\n *\n * **토큰 값은 절대 남기지 않는다.** JWT 는 base64url 이라 \"접두 8자\" 같은\n * 안전해 보이는 일부만으로도 헤더와 payload 앞부분이 그대로 복원된다.\n * `sub`, `nickname`, `approved_clients` 가 거기 들어 있다. 남길 수 있는 것은\n * 쿠키 **이름**, HTTP 상태 코드, 에러 코드처럼 값이 아닌 사실뿐이다.\n */\n\nconst PREFIX = \"[lemon-auth]\";\n\nexport function warnAuth(\n  event: string,\n  detail?: Record<string, unknown>\n): void {\n  if (detail === undefined) {\n    console.warn(`${PREFIX} ${event}`);\n    return;\n  }\n  console.warn(`${PREFIX} ${event}`, JSON.stringify(detail));\n}\n\n/**\n * 에러에서 값 노출 없이 식별자만 뽑는다.\n *\n * jose 는 `ERR_JWKS_NO_MATCHING_KEY`(키 로테이션), `ERR_JWT_EXPIRED`(정상 만료),\n * `ERR_JWS_SIGNATURE_VERIFICATION_FAILED`(위조 또는 설정 오류) 처럼 원인이\n * 전혀 다른 실패를 구분 가능한 `code` 로 준다. 이걸 뭉개면 JWKS 장애와\n * 위조 토큰이 같은 증상으로 보인다.\n *\n * undici 의 네트워크 실패는 `cause.code` 에 `ENOTFOUND` 같은 값이 들어간다.\n */\nexport function errorCode(error: unknown): string {\n  if (typeof error === \"object\" && error !== null) {\n    const { code, cause } = error as { code?: unknown; cause?: unknown };\n    if (typeof code === \"string\") return code;\n    if (typeof cause === \"object\" && cause !== null) {\n      const causeCode = (cause as { code?: unknown }).code;\n      if (typeof causeCode === \"string\") return causeCode;\n    }\n  }\n  if (error instanceof Error) return error.name;\n  return \"unknown\";\n}\n","import { cache } from \"react\";\nimport { redirect } from \"next/navigation\";\nimport type { LemonSession, LemonUser } from \"../types.js\";\nimport { AUTH_SERVER_URL } from \"../constants.js\";\nimport { isApprovedClient } from \"../approval.js\";\nimport { verifyAccessToken } from \"./verify.js\";\n\nfunction claimsToUser(\n  claims: NonNullable<Awaited<ReturnType<typeof verifyAccessToken>>>\n): LemonUser {\n  return {\n    uid: claims.sub,\n    nickname: claims.nickname,\n    profileImageUrl: claims.profile_image_url,\n    role: claims.role,\n    approvedClients: claims.approved_clients,\n  };\n}\n\nexport const getUser = cache(async (): Promise<LemonUser | null> => {\n  const claims = await verifyAccessToken();\n  if (!claims) return null;\n  return claimsToUser(claims);\n});\n\nexport interface GetSessionOptions {\n  clientId?: string;\n}\n\nconst getSessionByClientId = cache(\n  async (clientId?: string): Promise<LemonSession> => {\n    const user = await getUser();\n    if (!user) return { type: \"none\" };\n    if (!isApprovedClient(user.approvedClients, clientId)) {\n      return { type: \"unapproved\", user };\n    }\n    return { type: \"authenticated\", user };\n  }\n);\n\nexport async function getSession(\n  options: GetSessionOptions = {}\n): Promise<LemonSession> {\n  return getSessionByClientId(options.clientId);\n}\n\nexport async function requireAuth(redirectTo = \"/\"): Promise<LemonUser> {\n  const user = await getUser();\n  if (user) return user;\n  redirect(redirectTo);\n}\n\nexport interface RequireClientOptions {\n  loginRedirectTo?: string;\n  unapprovedRedirectTo?: string;\n}\n\nexport async function requireClient(\n  clientId: string,\n  optionsOrRedirectTo: string | RequireClientOptions = \"/\"\n): Promise<LemonUser> {\n  const options =\n    typeof optionsOrRedirectTo === \"string\"\n      ? { loginRedirectTo: optionsOrRedirectTo }\n      : optionsOrRedirectTo;\n  const session = await getSession({ clientId });\n  if (session.type === \"none\") {\n    redirect(options.loginRedirectTo ?? \"/\");\n  }\n  if (session.type === \"unapproved\") {\n    redirect(\n      options.unapprovedRedirectTo ??\n        `${AUTH_SERVER_URL}/error?code=FORBIDDEN`\n    );\n  }\n  return session.user;\n}\n","import { warnAuth } from \"./log.js\";\n\n/** fail-open 경고를 요청마다 찍지 않기 위한 플래그. */\nlet warnedMissingClientId = false;\n\nexport function isApprovedClient(\n  approvedClients: string[],\n  clientId?: string\n): boolean {\n  if (!clientId) {\n    // clientId 를 안 넘기면 승인 검사가 통째로 열린다(fail-open). 이 라이브러리를\n    // clientId 없이 쓰는 앱도 있으므로 동작은 유지하지만, 환경변수가 배포에서\n    // 빠져서 이렇게 된 경우와 구분이 안 된다. 후자는 인증이 사실상 없는 상태라\n    // 조용히 넘어가면 안 된다.\n    if (!warnedMissingClientId) {\n      warnedMissingClientId = true;\n      warnAuth(\n        \"clientId not provided — approval check is disabled (all users pass). \" +\n          \"설정 누락이 아닌지 확인할 것.\"\n      );\n    }\n    return true;\n  }\n  return approvedClients.includes(clientId) || approvedClients.includes(\"*\");\n}\n"],"mappings":";;;;;;;;;;;;;;;AAAA,SAAS,oBAAoB,iBAAiB;AAC9C,SAAS,eAAe;;;ACEjB,SAAS,oBACd,SAC8B;AAC9B,SACE,QAAQ,eAAe,YACvB,OAAO,QAAQ,QAAQ,YACvB,OAAO,QAAQ,aAAa,YAC5B,OAAO,QAAQ,sBAAsB,aACpC,QAAQ,SAAS,UAAU,QAAQ,SAAS,YAC7C,MAAM,QAAQ,QAAQ,gBAAgB,KACtC,QAAQ,iBAAiB,MAAM,CAAC,aAAa,OAAO,aAAa,QAAQ;AAE7E;;;ACEA,IAAM,SAAS;AAER,SAAS,SACd,OACA,QACM;AACN,MAAI,WAAW,QAAW;AACxB,YAAQ,KAAK,GAAG,MAAM,IAAI,KAAK,EAAE;AACjC;AAAA,EACF;AACA,UAAQ,KAAK,GAAG,MAAM,IAAI,KAAK,IAAI,KAAK,UAAU,MAAM,CAAC;AAC3D;AAYO,SAAS,UAAU,OAAwB;AAChD,MAAI,OAAO,UAAU,YAAY,UAAU,MAAM;AAC/C,UAAM,EAAE,MAAM,MAAM,IAAI;AACxB,QAAI,OAAO,SAAS,SAAU,QAAO;AACrC,QAAI,OAAO,UAAU,YAAY,UAAU,MAAM;AAC/C,YAAM,YAAa,MAA6B;AAChD,UAAI,OAAO,cAAc,SAAU,QAAO;AAAA,IAC5C;AAAA,EACF;AACA,MAAI,iBAAiB,MAAO,QAAO,MAAM;AACzC,SAAO;AACT;;;AF3CA,IAAM,OAAO,mBAAmB,IAAI,IAAI,QAAQ,CAAC;AAQjD,eAAe,OAAO,OAAkD;AACtE,MAAI;AACF,UAAM,EAAE,QAAQ,IAAI,MAAM,UAAU,OAAO,MAAM;AAAA,MAC/C,QAAQ;AAAA;AAAA;AAAA,MAGR,gBAAgB;AAAA,IAClB,CAAC;AACD,QAAI,oBAAoB,OAAO,EAAG,QAAO;AACzC,aAAS,oCAAoC;AAC7C,WAAO;AAAA,EACT,SAAS,OAAO;AAKd,UAAM,OAAO,UAAU,KAAK;AAC5B,QAAI,SAAS,mBAAmB;AAC9B,eAAS,oCAAoC,EAAE,KAAK,CAAC;AAAA,IACvD;AACA,WAAO;AAAA,EACT;AACF;AAEA,eAAsB,oBAAuD;AAC3E,QAAM,aAAa,yBAAyB;AAC5C,MAAI,WAAY,QAAO;AAEvB,QAAM,cAAc,MAAM,QAAQ;AAClC,QAAM,QAAQ,YAAY,IAAI,mBAAmB,GAAG;AACpD,MAAI,CAAC,MAAO,QAAO;AAEnB,SAAO,OAAO,KAAK;AACrB;AAEA,eAAsB,wBACpB,OACmC;AACnC,QAAM,aAAa,yBAAyB;AAC5C,MAAI,WAAY,QAAO;AAEvB,SAAO,OAAO,KAAK;AACrB;;;AG1DA,SAAS,aAAa;AACtB,SAAS,gBAAgB;;;ACEzB,IAAI,wBAAwB;AAErB,SAAS,iBACd,iBACA,UACS;AACT,MAAI,CAAC,UAAU;AAKb,QAAI,CAAC,uBAAuB;AAC1B,8BAAwB;AACxB;AAAA,QACE;AAAA,MAEF;AAAA,IACF;AACA,WAAO;AAAA,EACT;AACA,SAAO,gBAAgB,SAAS,QAAQ,KAAK,gBAAgB,SAAS,GAAG;AAC3E;;;ADjBA,SAAS,aACP,QACW;AACX,SAAO;AAAA,IACL,KAAK,OAAO;AAAA,IACZ,UAAU,OAAO;AAAA,IACjB,iBAAiB,OAAO;AAAA,IACxB,MAAM,OAAO;AAAA,IACb,iBAAiB,OAAO;AAAA,EAC1B;AACF;AAEO,IAAM,UAAU,MAAM,YAAuC;AAClE,QAAM,SAAS,MAAM,kBAAkB;AACvC,MAAI,CAAC,OAAQ,QAAO;AACpB,SAAO,aAAa,MAAM;AAC5B,CAAC;AAMD,IAAM,uBAAuB;AAAA,EAC3B,OAAO,aAA6C;AAClD,UAAM,OAAO,MAAM,QAAQ;AAC3B,QAAI,CAAC,KAAM,QAAO,EAAE,MAAM,OAAO;AACjC,QAAI,CAAC,iBAAiB,KAAK,iBAAiB,QAAQ,GAAG;AACrD,aAAO,EAAE,MAAM,cAAc,KAAK;AAAA,IACpC;AACA,WAAO,EAAE,MAAM,iBAAiB,KAAK;AAAA,EACvC;AACF;AAEA,eAAsB,WACpB,UAA6B,CAAC,GACP;AACvB,SAAO,qBAAqB,QAAQ,QAAQ;AAC9C;AAEA,eAAsB,YAAY,aAAa,KAAyB;AACtE,QAAM,OAAO,MAAM,QAAQ;AAC3B,MAAI,KAAM,QAAO;AACjB,WAAS,UAAU;AACrB;AAOA,eAAsB,cACpB,UACA,sBAAqD,KACjC;AACpB,QAAM,UACJ,OAAO,wBAAwB,WAC3B,EAAE,iBAAiB,oBAAoB,IACvC;AACN,QAAM,UAAU,MAAM,WAAW,EAAE,SAAS,CAAC;AAC7C,MAAI,QAAQ,SAAS,QAAQ;AAC3B,aAAS,QAAQ,mBAAmB,GAAG;AAAA,EACzC;AACA,MAAI,QAAQ,SAAS,cAAc;AACjC;AAAA,MACE,QAAQ,wBACN,GAAG,eAAe;AAAA,IACtB;AAAA,EACF;AACA,SAAO,QAAQ;AACjB;","names":[]}
+{"version":3,"sources":["../../src/server/user.ts","../../src/server/verify.ts","../../src/claims.ts","../../src/log.ts"],"sourcesContent":["import { cache } from \"react\";\nimport { redirect } from \"next/navigation\";\nimport type { AccessTokenClaims, LemonSession, LemonUser } from \"../types.js\";\nimport { AUTH_SERVER_URL } from \"../constants.js\";\nimport { verifyAccessToken } from \"./verify.js\";\n\nfunction claimsToUser(claims: AccessTokenClaims): LemonUser {\n  return {\n    uid: claims.sub,\n    nickname: claims.nickname,\n    profileImageUrl: claims.profile_image_url,\n    role: claims.role,\n    approvedClients: claims.approved_clients,\n  };\n}\n\nexport const getUser = cache(async (): Promise<LemonUser | null> => {\n  const claims = await verifyAccessToken();\n  if (!claims) return null;\n  return claimsToUser(claims);\n});\n\nconst getSessionByClientId = cache(\n  async (clientId: string): Promise<LemonSession> => {\n    const user = await getUser();\n    if (!user) return { type: \"none\" };\n    if (!isApprovedClient(user.approvedClients, clientId)) {\n      return { type: \"unapproved\", user };\n    }\n    return { type: \"authenticated\", user };\n  }\n);\n\nexport async function getSession({\n  clientId,\n}: {\n  clientId: string;\n}): Promise<LemonSession> {\n  return getSessionByClientId(clientId);\n}\n\nexport async function requireClient(\n  clientId: string,\n  {\n    loginRedirectTo = \"/\",\n    unapprovedRedirectTo = `${AUTH_SERVER_URL}/error?code=FORBIDDEN`,\n  }: { loginRedirectTo?: string; unapprovedRedirectTo?: string } = {}\n): Promise<LemonUser> {\n  const session = await getSession({ clientId });\n  if (session.type === \"none\") redirect(loginRedirectTo);\n  if (session.type === \"unapproved\") redirect(unapprovedRedirectTo);\n  return session.user;\n}\n\n// clientId 가 비어 있으면(환경변수 누락) 아무도 승인되지 않는다. \"*\" 는 mock user 용이다.\nfunction isApprovedClient(approvedClients: string[], clientId: string): boolean {\n  if (!clientId) return false;\n  return approvedClients.includes(clientId) || approvedClients.includes(\"*\");\n}\n","import { createRemoteJWKSet, jwtVerify } from \"jose\";\nimport { cookies } from \"next/headers\";\nimport type { AccessTokenClaims } from \"../types.js\";\nimport { JWKS_URL, AUTH_SERVER_URL, ACCESS_TOKEN_COOKIE } from \"../constants.js\";\nimport { isAccessTokenClaims } from \"../claims.js\";\nimport { getMockAccessTokenClaims } from \"../mock.js\";\nimport { warnAuth, errorCode } from \"../log.js\";\n\nconst jwks = createRemoteJWKSet(new URL(JWKS_URL));\n\nexport async function verifyAccessToken(): Promise<AccessTokenClaims | null> {\n  const mockClaims = getMockAccessTokenClaims();\n  if (mockClaims) return mockClaims;\n\n  const cookieStore = await cookies();\n  const token = cookieStore.get(ACCESS_TOKEN_COOKIE)?.value;\n  if (!token) return null;\n\n  try {\n    const { payload } = await jwtVerify(token, jwks, {\n      issuer: AUTH_SERVER_URL,\n      // 발급자(자택 k3s)와 검증자(Vercel)의 시계 어긋남 허용\n      clockTolerance: 10,\n    });\n    if (isAccessTokenClaims(payload)) return payload;\n    warnAuth(\"access token claims shape mismatch\");\n    return null;\n  } catch (error) {\n    // 정상 만료는 흔한 경로라 남기지 않는다. 키 로테이션·JWKS 장애와 위조를 구분하려고 code 를 남긴다.\n    const code = errorCode(error);\n    if (code !== \"ERR_JWT_EXPIRED\") {\n      warnAuth(\"access token verification failed\", { code });\n    }\n    return null;\n  }\n}\n","import type { JWTPayload } from \"jose\";\nimport type { AccessTokenClaims } from \"./types.js\";\n\nexport function isAccessTokenClaims(\n  payload: JWTPayload\n): payload is AccessTokenClaims {\n  return (\n    payload.token_type === \"access\" &&\n    typeof payload.sub === \"string\" &&\n    typeof payload.nickname === \"string\" &&\n    typeof payload.profile_image_url === \"string\" &&\n    (payload.role === \"user\" || payload.role === \"admin\") &&\n    Array.isArray(payload.approved_clients) &&\n    payload.approved_clients.every((clientId) => typeof clientId === \"string\")\n  );\n}\n","/**\n * 진단 로그.\n *\n * 이 라이브러리는 오랫동안 실패를 전부 `null` 하나로만 알렸다. 2026-07-19 에\n * auth 서버 앞의 Cloudflare Bot Fight Mode 가 프록시의 갱신 요청을 403\n * (`cf-mitigated: challenge`) 으로 막았을 때, 남은 흔적이 하나도 없어서\n * 원인을 찾는 데 반나절이 걸렸다. 앱 쪽에 임시 진단 코드를 심고 프로덕션에\n * 두 번 배포한 뒤에야 응답 코드를 볼 수 있었다.\n *\n * 그래서 실패에는 최소한의 사실을 남긴다.\n *\n * **토큰 값은 절대 남기지 않는다.** JWT 는 base64url 이라 \"접두 8자\" 같은\n * 안전해 보이는 일부만으로도 헤더와 payload 앞부분이 그대로 복원된다.\n * `sub`, `nickname`, `approved_clients` 가 거기 들어 있다. 남길 수 있는 것은\n * 쿠키 **이름**, HTTP 상태 코드, 에러 코드처럼 값이 아닌 사실뿐이다.\n */\n\nconst PREFIX = \"[lemon-auth]\";\n\nexport function warnAuth(\n  event: string,\n  detail?: Record<string, unknown>\n): void {\n  if (detail === undefined) {\n    console.warn(`${PREFIX} ${event}`);\n    return;\n  }\n  console.warn(`${PREFIX} ${event}`, JSON.stringify(detail));\n}\n\n/**\n * 에러에서 값 노출 없이 식별자만 뽑는다.\n *\n * jose 는 `ERR_JWKS_NO_MATCHING_KEY`(키 로테이션), `ERR_JWT_EXPIRED`(정상 만료),\n * `ERR_JWS_SIGNATURE_VERIFICATION_FAILED`(위조 또는 설정 오류) 처럼 원인이\n * 전혀 다른 실패를 구분 가능한 `code` 로 준다. 이걸 뭉개면 JWKS 장애와\n * 위조 토큰이 같은 증상으로 보인다.\n *\n * undici 의 네트워크 실패는 `cause.code` 에 `ENOTFOUND` 같은 값이 들어간다.\n */\nexport function errorCode(error: unknown): string {\n  if (typeof error === \"object\" && error !== null) {\n    const { code, cause } = error as { code?: unknown; cause?: unknown };\n    if (typeof code === \"string\") return code;\n    if (typeof cause === \"object\" && cause !== null) {\n      const causeCode = (cause as { code?: unknown }).code;\n      if (typeof causeCode === \"string\") return causeCode;\n    }\n  }\n  if (error instanceof Error) return error.name;\n  return \"unknown\";\n}\n"],"mappings":";;;;;;;;;;;;AAAA,SAAS,aAAa;AACtB,SAAS,gBAAgB;;;ACDzB,SAAS,oBAAoB,iBAAiB;AAC9C,SAAS,eAAe;;;ACEjB,SAAS,oBACd,SAC8B;AAC9B,SACE,QAAQ,eAAe,YACvB,OAAO,QAAQ,QAAQ,YACvB,OAAO,QAAQ,aAAa,YAC5B,OAAO,QAAQ,sBAAsB,aACpC,QAAQ,SAAS,UAAU,QAAQ,SAAS,YAC7C,MAAM,QAAQ,QAAQ,gBAAgB,KACtC,QAAQ,iBAAiB,MAAM,CAAC,aAAa,OAAO,aAAa,QAAQ;AAE7E;;;ACEA,IAAM,SAAS;AAER,SAAS,SACd,OACA,QACM;AACN,MAAI,WAAW,QAAW;AACxB,YAAQ,KAAK,GAAG,MAAM,IAAI,KAAK,EAAE;AACjC;AAAA,EACF;AACA,UAAQ,KAAK,GAAG,MAAM,IAAI,KAAK,IAAI,KAAK,UAAU,MAAM,CAAC;AAC3D;AAYO,SAAS,UAAU,OAAwB;AAChD,MAAI,OAAO,UAAU,YAAY,UAAU,MAAM;AAC/C,UAAM,EAAE,MAAM,MAAM,IAAI;AACxB,QAAI,OAAO,SAAS,SAAU,QAAO;AACrC,QAAI,OAAO,UAAU,YAAY,UAAU,MAAM;AAC/C,YAAM,YAAa,MAA6B;AAChD,UAAI,OAAO,cAAc,SAAU,QAAO;AAAA,IAC5C;AAAA,EACF;AACA,MAAI,iBAAiB,MAAO,QAAO,MAAM;AACzC,SAAO;AACT;;;AF3CA,IAAM,OAAO,mBAAmB,IAAI,IAAI,QAAQ,CAAC;AAEjD,eAAsB,oBAAuD;AAC3E,QAAM,aAAa,yBAAyB;AAC5C,MAAI,WAAY,QAAO;AAEvB,QAAM,cAAc,MAAM,QAAQ;AAClC,QAAM,QAAQ,YAAY,IAAI,mBAAmB,GAAG;AACpD,MAAI,CAAC,MAAO,QAAO;AAEnB,MAAI;AACF,UAAM,EAAE,QAAQ,IAAI,MAAM,UAAU,OAAO,MAAM;AAAA,MAC/C,QAAQ;AAAA;AAAA,MAER,gBAAgB;AAAA,IAClB,CAAC;AACD,QAAI,oBAAoB,OAAO,EAAG,QAAO;AACzC,aAAS,oCAAoC;AAC7C,WAAO;AAAA,EACT,SAAS,OAAO;AAEd,UAAM,OAAO,UAAU,KAAK;AAC5B,QAAI,SAAS,mBAAmB;AAC9B,eAAS,oCAAoC,EAAE,KAAK,CAAC;AAAA,IACvD;AACA,WAAO;AAAA,EACT;AACF;;;AD7BA,SAAS,aAAa,QAAsC;AAC1D,SAAO;AAAA,IACL,KAAK,OAAO;AAAA,IACZ,UAAU,OAAO;AAAA,IACjB,iBAAiB,OAAO;AAAA,IACxB,MAAM,OAAO;AAAA,IACb,iBAAiB,OAAO;AAAA,EAC1B;AACF;AAEO,IAAM,UAAU,MAAM,YAAuC;AAClE,QAAM,SAAS,MAAM,kBAAkB;AACvC,MAAI,CAAC,OAAQ,QAAO;AACpB,SAAO,aAAa,MAAM;AAC5B,CAAC;AAED,IAAM,uBAAuB;AAAA,EAC3B,OAAO,aAA4C;AACjD,UAAM,OAAO,MAAM,QAAQ;AAC3B,QAAI,CAAC,KAAM,QAAO,EAAE,MAAM,OAAO;AACjC,QAAI,CAAC,iBAAiB,KAAK,iBAAiB,QAAQ,GAAG;AACrD,aAAO,EAAE,MAAM,cAAc,KAAK;AAAA,IACpC;AACA,WAAO,EAAE,MAAM,iBAAiB,KAAK;AAAA,EACvC;AACF;AAEA,eAAsB,WAAW;AAAA,EAC/B;AACF,GAE0B;AACxB,SAAO,qBAAqB,QAAQ;AACtC;AAEA,eAAsB,cACpB,UACA;AAAA,EACE,kBAAkB;AAAA,EAClB,uBAAuB,GAAG,eAAe;AAC3C,IAAiE,CAAC,GAC9C;AACpB,QAAM,UAAU,MAAM,WAAW,EAAE,SAAS,CAAC;AAC7C,MAAI,QAAQ,SAAS,OAAQ,UAAS,eAAe;AACrD,MAAI,QAAQ,SAAS,aAAc,UAAS,oBAAoB;AAChE,SAAO,QAAQ;AACjB;AAGA,SAAS,iBAAiB,iBAA2B,UAA2B;AAC9E,MAAI,CAAC,SAAU,QAAO;AACtB,SAAO,gBAAgB,SAAS,QAAQ,KAAK,gBAAgB,SAAS,GAAG;AAC3E;","names":[]}

package/dist/url-qhLR3uNu.d.ts

@@ -0,0 +1,27 @@
+interface LemonUser {
+    uid: string;
+    nickname: string;
+    profileImageUrl: string;
+    role: "user" | "admin";
+    approvedClients: string[];
+}
+type LemonSession = {
+    type: "none";
+} | {
+    type: "unapproved";
+    user: LemonUser;
+} | {
+    type: "authenticated";
+    user: LemonUser;
+};
+
+declare function loginUrl(redirectUrl: string): string;
+declare function profileUrl(redirectUrl?: string): string;
+/**
+ * 로그아웃. 쿠키 삭제는 응답의 Set-Cookie 가 한다 — 세션 쿠키는 httpOnly
+ * 라서 JS 로는 지울 수 없다.
+ */
+declare function logout(): Promise<boolean>;
+declare function refreshToken(): Promise<boolean>;
+
+export { type LemonSession as L, type LemonUser as a, logout as b, loginUrl as l, profileUrl as p, refreshToken as r };

package/package.json

@@ -1,6 +1,6 @@
 {
   "name": "@lemondouble/lemon-auth",
-  "version": "0.9.1",
+  "version": "0.10.0",
   "repository": {
     "type": "git",
     "url": "https://github.com/LemonDouble/lemon-auth"

package/dist/types-B5uRY2Si.d.ts

@@ -1,34 +0,0 @@
-import { JWTPayload } from 'jose';
-
-interface AccessTokenClaims extends JWTPayload {
-    token_type: "access";
-    sub: string;
-    nickname: string;
-    profile_image_url: string;
-    role: "user" | "admin";
-    approved_clients: string[];
-}
-interface LemonUser {
-    uid: string;
-    nickname: string;
-    profileImageUrl: string;
-    role: "user" | "admin";
-    approvedClients: string[];
-}
-type LemonSession = {
-    type: "none";
-} | {
-    type: "unapproved";
-    user: LemonUser;
-} | {
-    type: "authenticated";
-    user: LemonUser;
-};
-interface UserProfile {
-    uid: string;
-    nickname: string;
-    profile_image_url: string;
-    role: "user" | "admin";
-}
-
-export type { AccessTokenClaims as A, LemonSession as L, UserProfile as U, LemonUser as a };