@mohasinac/appkit 2.1.1 → 2.2.0

package/dist/providers/auth-firebase/index.d.cts

@@ -1,137 +0,0 @@
-interface AuthPayload {
-    uid: string;
-    email: string | null;
-    /** Application-level role string, e.g. "admin" | "seller" | "user" */
-    role: string;
-    emailVerified: boolean;
-    /** Any extra custom claims stored on the token */
-    claims?: Record<string, unknown>;
-}
-interface AuthUser {
-    uid: string;
-    email: string | null;
-    displayName: string | null;
-    photoURL: string | null;
-    role: string;
-    emailVerified: boolean;
-    disabled: boolean;
-    createdAt: string;
-}
-interface CreateUserInput {
-    email: string;
-    password?: string;
-    displayName?: string;
-    photoURL?: string;
-    role?: string;
-    emailVerified?: boolean;
-}
-/**
- * Server-side authentication operations.
- * Implemented by @mohasinac/auth-firebase, @mohasinac/auth-nextauth, @mohasinac/auth-clerk.
- */
-interface IAuthProvider {
-    verifyToken(token: string): Promise<AuthPayload>;
-    createCustomToken(uid: string, claims?: Record<string, unknown>): Promise<string>;
-    getUser(uid: string): Promise<AuthUser | null>;
-    createUser(data: CreateUserInput): Promise<AuthUser>;
-    updateUser(uid: string, data: Partial<CreateUserInput>): Promise<AuthUser>;
-    deleteUser(uid: string): Promise<void>;
-    revokeTokens(uid: string): Promise<void>;
-}
-/**
- * Session cookie management (HTTP-only, server-side).
- * Implemented alongside IAuthProvider by the same auth package.
- */
-interface ISessionProvider {
-    /** Creates a session cookie value from a verified auth payload. */
-    createSession(payload: AuthPayload): Promise<string>;
-    /** Verifies a session cookie and returns the auth payload. */
-    verifySession(cookie: string): Promise<AuthPayload>;
-    /** Invalidates a session cookie. */
-    destroySession(cookie: string): Promise<void>;
-}
-
-/**
- * firebaseAuthProvider — IAuthProvider
- *
- * Implements `@mohasinac/contracts` `IAuthProvider` using the Firebase Admin SDK.
- * Server-side only.  Never import this in browser/client-component code.
- */
-
-declare const firebaseAuthProvider: IAuthProvider;
-
-/**
- * firebaseSessionProvider — ISessionProvider
- *
- * Implements `@mohasinac/contracts` `ISessionProvider` using Firebase Admin SDK
- * session cookies (HTTP-only, 5-day TTL by default).
- *
- * Server-side only.
- */
-
-declare const firebaseSessionProvider: ISessionProvider;
-/**
- * Mint a Firebase session cookie from a raw Firebase ID token string.
- *
- * Use this in your `POST /api/auth/session` route handler.
- *
- * @param idToken   The ID token from `firebase.auth().currentUser.getIdToken()`.
- * @param expiresIn Cookie duration in milliseconds (default: 5 days).
- */
-declare function createSessionCookieFromToken(idToken: string, expiresIn?: number): Promise<string>;
-
-/**
- * Server-side Firebase Auth helper functions.
- *
- * Drop-in replacements for the functions in `src/lib/firebase/auth-server.ts`.
- * All functions use the shared `getAdminAuth()` singleton from `@mohasinac/db-firebase`.
- */
-
-/** Verify a Firebase ID token. Returns null for expected auth failures. */
-declare function verifyIdToken(token: string): Promise<AuthPayload | null>;
-/** Verify a Firebase session cookie. Returns null for expected auth failures. */
-declare function verifySessionCookie(cookie: string): Promise<AuthPayload | null>;
-/**
- * Create a middleware auth chain function.
- *
- * Returns an async function that reads the `__session` (or `idToken`) cookie
- * from a `RequestCookies`-like object and returns the decoded `AuthPayload`.
- *
- * @example
- * ```ts
- * import { createMiddlewareAuthChain } from "@mohasinac/auth-firebase";
- *
- * const getUser = createMiddlewareAuthChain();
- * const user = await getUser(request.cookies);
- * ```
- */
-declare function createMiddlewareAuthChain(): (cookies: {
-    get(name: string): {
-        value: string;
-    } | undefined;
-}) => Promise<AuthPayload | null>;
-/**
- * Require a valid session — throws if not authenticated.
- *
- * @param cookies  `RequestCookies` from `request.cookies` (middleware) or
- *                 `await cookies()` from `next/headers` (RSC / API route).
- */
-declare function requireAuth(cookies: {
-    get(name: string): {
-        value: string;
-    } | undefined;
-}): Promise<AuthPayload>;
-/**
- * Require a specific role — throws 401/403 if not authenticated or wrong role.
- *
- * @param cookies  Cookie store (same as `requireAuth`).
- * @param role     A single role string or an array of allowed roles.
- * @param resolveRole  Optional async function to resolve the role from the DB.
- */
-declare function requireRole(cookies: {
-    get(name: string): {
-        value: string;
-    } | undefined;
-}, role: string | string[], resolveRole?: (uid: string) => Promise<string>): Promise<AuthPayload>;
-
-export { createMiddlewareAuthChain, createSessionCookieFromToken, firebaseAuthProvider, firebaseSessionProvider, requireAuth, requireRole, verifyIdToken, verifySessionCookie };

package/dist/providers/auth-firebase/index.js.map

@@ -1 +0,0 @@
-{"version":3,"sources":["../../../src/providers/db-firebase/admin.ts","../../../src/providers/auth-firebase/provider.ts","../../../src/providers/auth-firebase/session.ts","../../../src/providers/auth-firebase/helpers.ts"],"names":["EXPECTED_AUTH_CODES"],"mappings":";;;;;;;;;;;;;;;;;;;;;;;;;;;;;AAgCA,SAAS,gBAAgB,GAAA,EAAqB;AAC5C,EAAA,OAAO,GAAA,CACJ,OAAA,CAAQ,cAAA,EAAgB,EAAE,CAAA,CAC1B,OAAA,CAAQ,MAAA,EAAQ,IAAI,CAAA,CACpB,OAAA,CAAQ,OAAA,EAAS,IAAI,EACrB,IAAA,EAAK;AACV;AAmBA,SAAS,IAAO,GAAA,EAAwC;AAzDxD,EAAA,IAAA,EAAA;AA0DE,EAAA,OAAA,CAAQ,EAAA,GAAA,UAAA,CAAW,GAAG,CAAA,KAAd,IAAA,GAAA,EAAA,GAA4C,IAAA;AACtD;AACA,SAAS,GAAA,CAAO,KAA8B,KAAA,EAAgB;AAC5D,EAAC,UAAA,CAAuC,GAAG,CAAA,GAAI,KAAA;AACjD;AAIO,SAAS,WAAA,GAAmB;AAlEnC,EAAA,IAAA,EAAA,EAAA,EAAA,EAAA,EAAA,EAAA,EAAA,EAAA,EAAA;AAmEE,EAAA,MAAM,MAAA,GAAS,IAAS,kCAAkC,CAAA;AAC1D,EAAA,IAAI,QAAQ,OAAO,MAAA;AAEnB,EAAA,IAAI,OAAA,GAAU,MAAA,EAAQ;AACpB,IAAA,MAAM,QAAA,GAAW,OAAA,EAAQ,CAAE,CAAC,CAAA;AAC5B,IAAA,GAAA,CAAI,oCAAoC,QAAQ,CAAA;AAChD,IAAA,OAAO,QAAA;AAAA,EACT;AAEA,EAAA,MAAM,OAAA,GAAe,IAAA,CAAA,IAAA,CAAK,OAAA,CAAQ,GAAA,IAAO,yBAAyB,CAAA;AAClE,EAAA,IAAI,GAAA;AAEJ,EAAA,IAAI;AACF,IAAA,IAAO,EAAA,CAAA,UAAA,CAAW,OAAO,CAAA,EAAG;AAC1B,MAAA,MAAM,KAAK,IAAA,CAAK,KAAA,CAAS,EAAA,CAAA,YAAA,CAAa,OAAA,EAAS,MAAM,CAAC,CAAA;AACtD,MAAA,MAAM,SACJ,EAAA,GAAA,OAAA,CAAQ,GAAA,CAAI,sCAAZ,IAAA,GAAA,EAAA,GACA,CAAA,QAAA,EAAW,GAAG,UAAU,CAAA,4BAAA,CAAA;AAE1B,MAAA,GAAA,GAAM,aAAA,CAAc,EAAE,UAAA,EAAY,IAAA,CAAK,OAAO,CAAA,EAAG,WAAA,EAAa,OAAO,CAAA;AAAA,IACvE,CAAA,MAAA,IACE,QAAQ,GAAA,CAAI,yBAAA,IACZ,QAAQ,GAAA,CAAI,2BAAA,IACZ,OAAA,CAAQ,GAAA,CAAI,0BAAA,EACZ;AACA,MAAA,MAAM,SAAA,GAAY,OAAA,CAAQ,GAAA,CAAI,yBAAA,CAA0B,IAAA,EAAK;AAC7D,MAAA,MAAM,KAAA,GAAA,CACJ,EAAA,GAAA,CAAA,EAAA,GAAA,CAAA,EAAA,GAAA,OAAA,CAAQ,GAAA,CAAI,2BAAA,KAAZ,mBAAyC,IAAA,EAAA,KAAzC,IAAA,GAAA,EAAA,GAAA,CACA,EAAA,GAAA,OAAA,CAAQ,GAAA,CAAI,iCAAA,KAAZ,IAAA,GAAA,KAAA,CAAA,GAAA,EAAA,CAA+C,IAAA,EAAA,KAD/C,IAAA,GAAA,EAAA,GAEA,WAAW,SAAS,CAAA,4BAAA,CAAA;AAEtB,MAAA,GAAA,GAAM,aAAA,CAAc;AAAA,QAClB,YAAY,IAAA,CAAK;AAAA,UACf,SAAA;AAAA,UACA,WAAA,EAAa,OAAA,CAAQ,GAAA,CAAI,2BAAA,CAA4B,IAAA,EAAK;AAAA,UAC1D,UAAA,EAAY,eAAA,CAAgB,OAAA,CAAQ,GAAA,CAAI,0BAA0B;AAAA,SACnE,CAAA;AAAA,QACD,WAAA,EAAa;AAAA,OACd,CAAA;AAAA,IACH,CAAA,MAAO;AACL,MAAA,MAAM,IAAI,KAAA;AAAA,QACR;AAAA,OAIF;AAAA,IACF;AAAA,EACF,SAAS,GAAA,EAAK;AACZ,IAAA,OAAA,CAAQ,KAAA;AAAA,MACN,0DAAA;AAAA,MACA;AAAA,KACF;AACA,IAAA,MAAM,GAAA;AAAA,EACR;AAEA,EAAA,GAAA,CAAI,oCAAoC,GAAG,CAAA;AAC3C,EAAA,OAAO,GAAA;AACT;AAIO,SAAS,YAAA,GAAqB;AACnC,EAAA,MAAM,MAAA,GAAS,IAAU,mCAAmC,CAAA;AAC5D,EAAA,IAAI,QAAQ,OAAO,MAAA;AACnB,EAAA,MAAM,IAAA,GAAO,OAAA,CAAQ,WAAA,EAAa,CAAA;AAClC,EAAA,GAAA,CAAI,qCAAqC,IAAI,CAAA;AAC7C,EAAA,OAAO,IAAA;AACT;;;ACtHA,IAAM,mBAAA,uBAA0B,GAAA,CAAI;AAAA,EAClC,qBAAA;AAAA,EACA,uBAAA;AAAA,EACA,uBAAA;AAAA,EACA,6BAAA;AAAA,EACA,6BAAA;AAAA,EACA,oBAAA;AAAA,EACA;AACF,CAAC,CAAA;AAED,SAAS,oBAAoB,GAAA,EAAuB;AA1BpD,EAAA,IAAA,EAAA;AA2BE,EAAA,OAAO,mBAAA,CAAoB,GAAA,CAAA,CAAK,EAAA,GAAA,GAAA,CAA0B,IAAA,KAA1B,YAAkC,EAAE,CAAA;AACtE;AAEA,SAAS,cAAc,OAAA,EAMP;AApChB,EAAA,IAAA,EAAA,EAAA,EAAA,EAAA,EAAA;AAqCE,EAAA,OAAO;AAAA,IACL,KAAK,OAAA,CAAQ,GAAA;AAAA,IACb,KAAA,EAAA,CAAO,EAAA,GAAA,OAAA,CAAQ,KAAA,KAAR,IAAA,GAAA,EAAA,GAAiB,IAAA;AAAA,IACxB,IAAA,EAAA,CAAO,EAAA,GAAA,OAAA,CAAQ,IAAA,KAAR,IAAA,GAAA,EAAA,GAAuC,MAAA;AAAA,IAC9C,aAAA,EAAA,CAAe,EAAA,GAAA,OAAA,CAAQ,cAAA,KAAR,IAAA,GAAA,EAAA,GAA0B,KAAA;AAAA,IACzC,QAAQ,MAAA,CAAO,WAAA;AAAA,MACb,MAAA,CAAO,OAAA,CAAQ,OAAO,CAAA,CAAE,MAAA;AAAA,QACtB,CAAC,CAAC,CAAC,CAAA,KACD,CAAC;AAAA,UACC,KAAA;AAAA,UACA,OAAA;AAAA,UACA,gBAAA;AAAA,UACA,KAAA;AAAA,UACA,KAAA;AAAA,UACA,KAAA;AAAA,UACA,KAAA;AAAA,UACA,KAAA;AAAA,UACA,WAAA;AAAA,UACA;AAAA,SACF,CAAE,SAAS,CAAC;AAAA;AAChB;AACF,GACF;AACF;AAEA,SAAS,WAAW,MAAA,EASP;AAvEb,EAAA,IAAA,EAAA,EAAA,EAAA,EAAA,EAAA,EAAA,EAAA,EAAA,EAAA,EAAA,EAAA;AAwEE,EAAA,OAAO;AAAA,IACL,KAAK,MAAA,CAAO,GAAA;AAAA,IACZ,KAAA,EAAA,CAAO,EAAA,GAAA,MAAA,CAAO,KAAA,KAAP,IAAA,GAAA,EAAA,GAAgB,IAAA;AAAA,IACvB,WAAA,EAAA,CAAa,EAAA,GAAA,MAAA,CAAO,WAAA,KAAP,IAAA,GAAA,EAAA,GAAsB,IAAA;AAAA,IACnC,QAAA,EAAA,CAAU,EAAA,GAAA,MAAA,CAAO,QAAA,KAAP,IAAA,GAAA,EAAA,GAAmB,IAAA;AAAA,IAC7B,IAAA,EAAA,CAAO,EAAA,GAAA,CAAA,EAAA,GAAA,MAAA,CAAO,YAAA,KAAP,IAAA,GAAA,MAAA,GAAA,EAAA,CAAsB,YAAtB,IAAA,GAAA,EAAA,GAAwD,MAAA;AAAA,IAC/D,eAAe,MAAA,CAAO,aAAA;AAAA,IACtB,UAAU,MAAA,CAAO,QAAA;AAAA,IACjB,SAAA,EAAA,CAAW,YAAO,QAAA,CAAS,YAAA,KAAhB,6BAAgC,IAAI,IAAA,CAAK,CAAC,CAAA,EAAE,WAAA;AAAY,GACrE;AACF;AAEO,IAAM,oBAAA,GAAsC;AAAA,EACjD,MAAM,YAAY,KAAA,EAAqC;AACrD,IAAA,IAAI;AACF,MAAA,MAAM,OAAA,GAAU,MAAM,YAAA,EAAa,CAAE,cAAc,KAAK,CAAA;AACxD,MAAA,OAAO,cAAc,OAAO,CAAA;AAAA,IAC9B,SAAS,GAAA,EAAK;AACZ,MAAA,IAAI,CAAC,mBAAA,CAAoB,GAAG,CAAA,EAAG;AAC7B,QAAA,OAAA,CAAQ,KAAA;AAAA,UACN,uDAAA;AAAA,UACA;AAAA,SACF;AAAA,MACF;AACA,MAAA,MAAM,GAAA;AAAA,IACR;AAAA,EACF,CAAA;AAAA,EAEA,MAAM,iBAAA,CACJ,GAAA,EACA,MAAA,EACiB;AACjB,IAAA,OAAO,YAAA,EAAa,CAAE,iBAAA,CAAkB,GAAA,EAAK,MAAM,CAAA;AAAA,EACrD,CAAA;AAAA,EAEA,MAAM,QAAQ,GAAA,EAAuC;AACnD,IAAA,IAAI;AACF,MAAA,MAAM,MAAA,GAAS,MAAM,YAAA,EAAa,CAAE,QAAQ,GAAG,CAAA;AAC/C,MAAA,OAAO,WAAW,MAAM,CAAA;AAAA,IAC1B,SAAS,GAAA,EAAK;AACZ,MAAA,IAAK,IAA0B,IAAA,KAAS,qBAAA;AACtC,QAAA,OAAO,IAAA;AACT,MAAA,MAAM,GAAA;AAAA,IACR;AAAA,EACF,CAAA;AAAA,EAEA,MAAM,WAAW,IAAA,EAA0C;AAtH7D,IAAA,IAAA,EAAA;AAuHI,IAAA,MAAM,MAAA,GAAS,MAAM,YAAA,EAAa,CAAE,UAAA,CAAW;AAAA,MAC7C,OAAO,IAAA,CAAK,KAAA;AAAA,MACZ,UAAU,IAAA,CAAK,QAAA;AAAA,MACf,aAAa,IAAA,CAAK,WAAA;AAAA,MAClB,UAAU,IAAA,CAAK,QAAA;AAAA,MACf,aAAA,EAAA,CAAe,EAAA,GAAA,IAAA,CAAK,aAAA,KAAL,IAAA,GAAA,EAAA,GAAsB;AAAA,KACtC,CAAA;AACD,IAAA,IAAI,KAAK,IAAA,EAAM;AACb,MAAA,MAAM,YAAA,GAAe,mBAAA,CAAoB,MAAA,CAAO,KAAK,EAAE,IAAA,EAAM,IAAA,CAAK,IAAA,EAAM,CAAA;AAExE,MAAA,MAAM,UAAU,MAAM,YAAA,EAAa,CAAE,OAAA,CAAQ,OAAO,GAAG,CAAA;AACvD,MAAA,OAAO,WAAW,OAAO,CAAA;AAAA,IAC3B;AACA,IAAA,OAAO,WAAW,MAAM,CAAA;AAAA,EAC1B,CAAA;AAAA,EAEA,MAAM,UAAA,CACJ,GAAA,EACA,IAAA,EACmB;AACnB,IAAA,MAAM,MAAA,GAAS,MAAM,YAAA,EAAa,CAAE,WAAW,GAAA,EAAK;AAAA,MAClD,OAAO,IAAA,CAAK,KAAA;AAAA,MACZ,UAAU,IAAA,CAAK,QAAA;AAAA,MACf,aAAa,IAAA,CAAK,WAAA;AAAA,MAClB,UAAU,IAAA,CAAK,QAAA;AAAA,MACf,eAAe,IAAA,CAAK;AAAA,KACrB,CAAA;AACD,IAAA,IAAI,IAAA,CAAK,SAAS,MAAA,EAAW;AAC3B,MAAA,MAAM,YAAA,GAAe,mBAAA,CAAoB,GAAA,EAAK,EAAE,IAAA,EAAM,IAAA,CAAK,MAAM,CAAA;AAAA,IACnE;AACA,IAAA,MAAM,UAAU,MAAM,YAAA,EAAa,CAAE,OAAA,CAAQ,OAAO,GAAG,CAAA;AACvD,IAAA,OAAO,WAAW,OAAO,CAAA;AAAA,EAC3B,CAAA;AAAA,EAEA,MAAM,WAAW,GAAA,EAA4B;AAC3C,IAAA,MAAM,YAAA,EAAa,CAAE,UAAA,CAAW,GAAG,CAAA;AAAA,EACrC,CAAA;AAAA,EAEA,MAAM,aAAa,GAAA,EAA4B;AAC7C,IAAA,MAAM,YAAA,EAAa,CAAE,mBAAA,CAAoB,GAAG,CAAA;AAAA,EAC9C;AACF;;;ACnJA,IAAM,qBAAA,GAAwB,EAAA,GAAK,EAAA,GAAK,EAAA,GAAK,CAAA,GAAI,GAAA;AAEjD,IAAM,sBAAA,uBAA6B,GAAA,CAAI;AAAA,EACrC,6BAAA;AAAA,EACA,6BAAA;AAAA,EACA,oBAAA;AAAA,EACA,qBAAA;AAAA,EACA;AACF,CAAC,CAAA;AAEM,IAAM,uBAAA,GAA4C;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA,EASvD,MAAM,cAAc,OAAA,EAAuC;AAMzD,IAAA,MAAM,IAAI,KAAA;AAAA,MACR;AAAA,KAEF;AAAA,EACF,CAAA;AAAA,EAEA,MAAM,cAAc,MAAA,EAAsC;AA5C5D,IAAA,IAAA,EAAA,EAAA,EAAA,EAAA,EAAA,EAAA,EAAA;AA6CI,IAAA,IAAI;AACF,MAAA,MAAM,UAAU,MAAM,YAAA,EAAa,CAAE,mBAAA,CAAoB,QAAQ,IAAI,CAAA;AACrE,MAAA,OAAO;AAAA,QACL,KAAK,OAAA,CAAQ,GAAA;AAAA,QACb,KAAA,EAAA,CAAO,EAAA,GAAA,OAAA,CAAQ,KAAA,KAAR,IAAA,GAAA,EAAA,GAAiB,IAAA;AAAA,QACxB,IAAA,EAAA,CAAO,EAAA,GAAA,OAAA,CAAQ,IAAA,KAAR,IAAA,GAAA,EAAA,GAAuC,MAAA;AAAA,QAC9C,aAAA,EAAA,CAAe,EAAA,GAAA,OAAA,CAAQ,cAAA,KAAR,IAAA,GAAA,EAAA,GAA0B,KAAA;AAAA,QACzC,QAAQ,MAAA,CAAO,WAAA;AAAA,UACb,MAAA,CAAO,OAAA,CAAQ,OAAO,CAAA,CAAE,MAAA;AAAA,YACtB,CAAC,CAAC,CAAC,CAAA,KACD,CAAC;AAAA,cACC,KAAA;AAAA,cACA,OAAA;AAAA,cACA,gBAAA;AAAA,cACA,KAAA;AAAA,cACA,KAAA;AAAA,cACA,KAAA;AAAA,cACA,KAAA;AAAA,cACA,KAAA;AAAA,cACA,WAAA;AAAA,cACA;AAAA,aACF,CAAE,SAAS,CAAC;AAAA;AAChB;AACF,OACF;AAAA,IACF,SAAS,GAAA,EAAK;AACZ,MAAA,IAAI,CAAC,sBAAA,CAAuB,GAAA,CAAA,CAAK,SAA0B,IAAA,KAA1B,IAAA,GAAA,EAAA,GAAkC,EAAE,CAAA,EAAG;AACtE,QAAA,OAAA,CAAQ,KAAA;AAAA,UACN,gEAAA;AAAA,UACA;AAAA,SACF;AAAA,MACF;AACA,MAAA,MAAM,GAAA;AAAA,IACR;AAAA,EACF,CAAA;AAAA,EAEA,MAAM,eAAe,MAAA,EAA+B;AAClD,IAAA,IAAI;AACF,MAAA,MAAM,UAAU,MAAM,YAAA,EAAa,CAAE,mBAAA,CAAoB,QAAQ,KAAK,CAAA;AACtE,MAAA,MAAM,YAAA,EAAa,CAAE,mBAAA,CAAoB,OAAA,CAAQ,GAAG,CAAA;AAAA,IACtD,CAAA,CAAA,OAAQ,CAAA,EAAA;AAAA,IAER;AAAA,EACF;AACF;AAUA,eAAsB,4BAAA,CACpB,OAAA,EACA,SAAA,GAAoB,qBAAA,EACH;AACjB,EAAA,OAAO,cAAa,CAAE,mBAAA,CAAoB,OAAA,EAAS,EAAE,WAAW,CAAA;AAClE;;;AC3FA,IAAMA,oBAAAA,uBAA0B,GAAA,CAAI;AAAA,EAClC,qBAAA;AAAA,EACA,uBAAA;AAAA,EACA,uBAAA;AAAA,EACA,6BAAA;AAAA,EACA,6BAAA;AAAA,EACA,oBAAA;AAAA,EACA;AACF,CAAC,CAAA;AAKD,eAAsB,cACpB,KAAA,EAC6B;AA5B/B,EAAA,IAAA,EAAA,EAAA,EAAA,EAAA,EAAA,EAAA,EAAA;AA6BE,EAAA,IAAI;AACF,IAAA,MAAM,OAAA,GAAU,MAAM,YAAA,EAAa,CAAE,cAAc,KAAK,CAAA;AACxD,IAAA,OAAO;AAAA,MACL,KAAK,OAAA,CAAQ,GAAA;AAAA,MACb,KAAA,EAAA,CAAO,EAAA,GAAA,OAAA,CAAQ,KAAA,KAAR,IAAA,GAAA,EAAA,GAAiB,IAAA;AAAA,MACxB,IAAA,EAAA,CAAO,EAAA,GAAA,OAAA,CAAQ,IAAA,KAAR,IAAA,GAAA,EAAA,GAAuC,MAAA;AAAA,MAC9C,aAAA,EAAA,CAAe,EAAA,GAAA,OAAA,CAAQ,cAAA,KAAR,IAAA,GAAA,EAAA,GAA0B;AAAA,KAC3C;AAAA,EACF,SAAS,GAAA,EAAK;AACZ,IAAA,IAAI,CAACA,oBAAAA,CAAoB,GAAA,CAAA,CAAK,SAA0B,IAAA,KAA1B,IAAA,GAAA,EAAA,GAAkC,EAAE,CAAA,EAAG;AACnE,MAAA,OAAA,CAAQ,KAAA;AAAA,QACN,uDAAA;AAAA,QACA;AAAA,OACF;AAAA,IACF;AACA,IAAA,OAAO,IAAA;AAAA,EACT;AACF;AAGA,eAAsB,oBACpB,MAAA,EAC6B;AAnD/B,EAAA,IAAA,EAAA,EAAA,EAAA,EAAA,EAAA,EAAA,EAAA;AAoDE,EAAA,IAAI;AACF,IAAA,MAAM,UAAU,MAAM,YAAA,EAAa,CAAE,mBAAA,CAAoB,QAAQ,IAAI,CAAA;AACrE,IAAA,OAAO;AAAA,MACL,KAAK,OAAA,CAAQ,GAAA;AAAA,MACb,KAAA,EAAA,CAAO,EAAA,GAAA,OAAA,CAAQ,KAAA,KAAR,IAAA,GAAA,EAAA,GAAiB,IAAA;AAAA,MACxB,IAAA,EAAA,CAAO,EAAA,GAAA,OAAA,CAAQ,IAAA,KAAR,IAAA,GAAA,EAAA,GAAuC,MAAA;AAAA,MAC9C,aAAA,EAAA,CAAe,EAAA,GAAA,OAAA,CAAQ,cAAA,KAAR,IAAA,GAAA,EAAA,GAA0B;AAAA,KAC3C;AAAA,EACF,SAAS,GAAA,EAAK;AACZ,IAAA,IAAI,CAACA,oBAAAA,CAAoB,GAAA,CAAA,CAAK,SAA0B,IAAA,KAA1B,IAAA,GAAA,EAAA,GAAkC,EAAE,CAAA,EAAG;AACnE,MAAA,OAAA,CAAQ,KAAA;AAAA,QACN,gEAAA;AAAA,QACA;AAAA,OACF;AAAA,IACF;AACA,IAAA,OAAO,IAAA;AAAA,EACT;AACF;AAgBO,SAAS,yBAAA,GAA4B;AAC1C,EAAA,OAAO,eAAe,QAAQ,OAAA,EAEE;AAxFlC,IAAA,IAAA,EAAA,EAAA,EAAA;AAyFI,IAAA,MAAM,OAAA,GAAA,CAAU,EAAA,GAAA,OAAA,CAAQ,GAAA,CAAI,WAAW,MAAvB,IAAA,GAAA,MAAA,GAAA,EAAA,CAA0B,KAAA;AAC1C,IAAA,IAAI,OAAA,EAAS;AACX,MAAA,MAAM,IAAA,GAAO,MAAM,mBAAA,CAAoB,OAAO,CAAA;AAC9C,MAAA,IAAI,MAAM,OAAO,IAAA;AAAA,IACnB;AAEA,IAAA,MAAM,OAAA,GAAA,CAAU,EAAA,GAAA,OAAA,CAAQ,GAAA,CAAI,SAAS,MAArB,IAAA,GAAA,MAAA,GAAA,EAAA,CAAwB,KAAA;AACxC,IAAA,IAAI,OAAA,EAAS;AACX,MAAA,OAAO,cAAc,OAAO,CAAA;AAAA,IAC9B;AAEA,IAAA,OAAO,IAAA;AAAA,EACT,CAAA;AACF;AAQA,eAAsB,YAAY,OAAA,EAET;AACvB,EAAA,MAAM,QAAQ,yBAAA,EAA0B;AACxC,EAAA,MAAM,IAAA,GAAO,MAAM,KAAA,CAAM,OAAO,CAAA;AAChC,EAAA,IAAI,CAAC,IAAA,EAAM;AACT,IAAA,MAAM,MAAA,CAAO,OAAO,IAAI,KAAA,CAAM,cAAc,CAAA,EAAG,EAAE,UAAA,EAAY,GAAA,EAAK,CAAA;AAAA,EACpE;AACA,EAAA,OAAO,IAAA;AACT;AASA,eAAsB,WAAA,CACpB,OAAA,EACA,IAAA,EACA,WAAA,EACsB;AACtB,EAAA,MAAM,IAAA,GAAO,MAAM,WAAA,CAAY,OAAO,CAAA;AACtC,EAAA,MAAM,UAAU,KAAA,CAAM,OAAA,CAAQ,IAAI,CAAA,GAAI,IAAA,GAAO,CAAC,IAAI,CAAA;AAElD,EAAA,IAAI,WAAW,IAAA,CAAK,IAAA;AACpB,EAAA,IAAI,WAAA,EAAa;AACf,IAAA,QAAA,GAAW,MAAM,WAAA,CAAY,IAAA,CAAK,GAAG,CAAA;AAAA,EACvC;AAEA,EAAA,IAAI,CAAC,OAAA,CAAQ,QAAA,CAAS,QAAQ,CAAA,EAAG;AAC/B,IAAA,MAAM,MAAA,CAAO,MAAA;AAAA,MACX,IAAI,KAAA,CAAM,CAAA,gCAAA,EAA8B,QAAQ,IAAA,CAAK,KAAK,CAAC,CAAA,CAAE,CAAA;AAAA,MAC7D,EAAE,YAAY,GAAA;AAAI,KACpB;AAAA,EACF;AAEA,EAAA,OAAO,aAAA,CAAA,cAAA,CAAA,EAAA,EAAK,IAAA,CAAA,EAAL,EAAW,IAAA,EAAM,QAAA,EAAS,CAAA;AACnC","file":"index.js","sourcesContent":["/**\n * Firebase Admin SDK singletons.\n *\n * Supports two init methods (checked in order):\n *   1. `firebase-admin-key.json` in process.cwd() — development\n *   2. FIREBASE_ADMIN_PROJECT_ID / CLIENT_EMAIL / PRIVATE_KEY env vars — production\n *\n * All getters are lazy — the SDK is not touched until first use.\n */\n\nimport { initializeApp, getApps, cert, type App } from \"firebase-admin/app\";\nimport { getAuth, type Auth } from \"firebase-admin/auth\";\nimport { getFirestore, type Firestore } from \"firebase-admin/firestore\";\nimport {\n  getStorage as getFirebaseStorage,\n  type Storage,\n} from \"firebase-admin/storage\";\nimport { getDatabase, type Database } from \"firebase-admin/database\";\nimport * as path from \"path\";\nimport * as fs from \"fs\";\n\n// ─── Private key normalisation ────────────────────────────────────────────────\n//\n// Vercel (and other platforms) can store the private key in several formats:\n//   1. Literal \\n sequences  (common — copied from JSON value)\n//   2. Real newlines          (set via CLI / multiline input)\n//   3. Windows \\r\\n endings   (copied on Windows)\n//   4. Wrapped in double-quotes (pasted with JSON quotes intact)\n//\n// OpenSSL 3 (Node 18+) rejects malformed PEM — ensure the key is normalised\n// before passing it to `cert()`.\n//\nfunction parsePrivateKey(raw: string): string {\n  return raw\n    .replace(/^[\"']|[\"']$/g, \"\") // strip optional surrounding quotes\n    .replace(/\\\\n/g, \"\\n\") // literal \\n → real newline\n    .replace(/\\r\\n/g, \"\\n\") // Windows CRLF → LF\n    .trim();\n}\n\n// ─── Global singletons ────────────────────────────────────────────────────────\n// Stored on globalThis so all module instances (pnpm deduplication may create\n// multiple copies of this package in the same process) share one SDK instance.\n\ndeclare global {\n  // eslint-disable-next-line no-var\n  var __mohasinac_firebase_admin_app__: App | null | undefined;\n  // eslint-disable-next-line no-var\n  var __mohasinac_firebase_admin_auth__: Auth | null | undefined;\n  // eslint-disable-next-line no-var\n  var __mohasinac_firebase_admin_db__: Firestore | null | undefined;\n  // eslint-disable-next-line no-var\n  var __mohasinac_firebase_admin_storage__: Storage | null | undefined;\n  // eslint-disable-next-line no-var\n  var __mohasinac_firebase_admin_rtdb__: Database | null | undefined;\n}\n\nfunction get<T>(key: keyof typeof globalThis): T | null {\n  return (globalThis[key] as T | null | undefined) ?? null;\n}\nfunction set<T>(key: keyof typeof globalThis, value: T): void {\n  (globalThis as Record<string, unknown>)[key] = value;\n}\n\n// ─── App ──────────────────────────────────────────────────────────────────────\n\nexport function getAdminApp(): App {\n  const cached = get<App>(\"__mohasinac_firebase_admin_app__\");\n  if (cached) return cached;\n\n  if (getApps().length) {\n    const existing = getApps()[0];\n    set(\"__mohasinac_firebase_admin_app__\", existing);\n    return existing;\n  }\n\n  const keyPath = path.join(process.cwd(), \"firebase-admin-key.json\");\n  let app: App;\n\n  try {\n    if (fs.existsSync(keyPath)) {\n      const sa = JSON.parse(fs.readFileSync(keyPath, \"utf8\"));\n      const dbUrl =\n        process.env.NEXT_PUBLIC_FIREBASE_DATABASE_URL ??\n        `https://${sa.project_id}-default-rtdb.firebaseio.com`;\n\n      app = initializeApp({ credential: cert(keyPath), databaseURL: dbUrl });\n    } else if (\n      process.env.FIREBASE_ADMIN_PROJECT_ID &&\n      process.env.FIREBASE_ADMIN_CLIENT_EMAIL &&\n      process.env.FIREBASE_ADMIN_PRIVATE_KEY\n    ) {\n      const projectId = process.env.FIREBASE_ADMIN_PROJECT_ID.trim();\n      const dbUrl =\n        process.env.FIREBASE_ADMIN_DATABASE_URL?.trim() ??\n        process.env.NEXT_PUBLIC_FIREBASE_DATABASE_URL?.trim() ??\n        `https://${projectId}-default-rtdb.firebaseio.com`;\n\n      app = initializeApp({\n        credential: cert({\n          projectId,\n          clientEmail: process.env.FIREBASE_ADMIN_CLIENT_EMAIL.trim(),\n          privateKey: parsePrivateKey(process.env.FIREBASE_ADMIN_PRIVATE_KEY),\n        }),\n        databaseURL: dbUrl,\n      });\n    } else {\n      throw new Error(\n        \"@mohasinac/db-firebase: Firebase Admin credentials not found.\\n\" +\n          \"Add firebase-admin-key.json to project root, or set \" +\n          \"FIREBASE_ADMIN_PROJECT_ID, FIREBASE_ADMIN_CLIENT_EMAIL, \" +\n          \"FIREBASE_ADMIN_PRIVATE_KEY environment variables.\",\n      );\n    }\n  } catch (err) {\n    console.error(\n      \"[@mohasinac/db-firebase] Failed to initialise Admin SDK:\",\n      err,\n    );\n    throw err;\n  }\n\n  set(\"__mohasinac_firebase_admin_app__\", app);\n  return app;\n}\n\n// ─── Auth ─────────────────────────────────────────────────────────────────────\n\nexport function getAdminAuth(): Auth {\n  const cached = get<Auth>(\"__mohasinac_firebase_admin_auth__\");\n  if (cached) return cached;\n  const auth = getAuth(getAdminApp());\n  set(\"__mohasinac_firebase_admin_auth__\", auth);\n  return auth;\n}\n\n// ─── Firestore ────────────────────────────────────────────────────────────────\n\nexport function getAdminDb(): Firestore {\n  const cached = get<Firestore>(\"__mohasinac_firebase_admin_db__\");\n  if (cached) return cached;\n  const db = getFirestore(getAdminApp());\n  try {\n    // settings() can only be called once per Firestore instance — guard for\n    // HMR reloads and duplicate module instances.\n    db.settings({ ignoreUndefinedProperties: true });\n  } catch {\n    // Already configured — safe to ignore.\n  }\n  set(\"__mohasinac_firebase_admin_db__\", db);\n  return db;\n}\n\n// ─── Cloud Storage ────────────────────────────────────────────────────────────\n\nexport function getAdminStorage(): Storage {\n  const cached = get<Storage>(\"__mohasinac_firebase_admin_storage__\");\n  if (cached) return cached;\n  const storage = getFirebaseStorage(getAdminApp());\n  set(\"__mohasinac_firebase_admin_storage__\", storage);\n  return storage;\n}\n\n// ─── Realtime DB ──────────────────────────────────────────────────────────────\n\nexport function getAdminRealtimeDb(): Database {\n  const cached = get<Database>(\"__mohasinac_firebase_admin_rtdb__\");\n  if (cached) return cached;\n  const rtdb = getDatabase(getAdminApp());\n  set(\"__mohasinac_firebase_admin_rtdb__\", rtdb);\n  return rtdb;\n}\n\n/** Reset all singletons — useful in tests. */\nexport function _resetAdminSingletons(): void {\n  set(\"__mohasinac_firebase_admin_app__\", null);\n  set(\"__mohasinac_firebase_admin_auth__\", null);\n  set(\"__mohasinac_firebase_admin_db__\", null);\n  set(\"__mohasinac_firebase_admin_storage__\", null);\n  set(\"__mohasinac_firebase_admin_rtdb__\", null);\n}\n","/**\n * firebaseAuthProvider — IAuthProvider\n *\n * Implements `@mohasinac/contracts` `IAuthProvider` using the Firebase Admin SDK.\n * Server-side only.  Never import this in browser/client-component code.\n */\n\nimport type {\n  IAuthProvider,\n  AuthPayload,\n  AuthUser,\n  CreateUserInput,\n} from \"@mohasinac/contracts\";\nimport { getAdminAuth } from \"@mohasinac/db-firebase\";\n\n/** Firebase error codes that represent a normal \"not authenticated\" state. */\nconst EXPECTED_AUTH_CODES = new Set([\n  \"auth/argument-error\",\n  \"auth/id-token-expired\",\n  \"auth/id-token-revoked\",\n  \"auth/session-cookie-expired\",\n  \"auth/session-cookie-revoked\",\n  \"auth/user-disabled\",\n  \"auth/user-not-found\",\n]);\n\nfunction isExpectedAuthError(err: unknown): boolean {\n  return EXPECTED_AUTH_CODES.has((err as { code?: string }).code ?? \"\");\n}\n\nfunction toAuthPayload(decoded: {\n  uid: string;\n  email?: string | null;\n  role?: string;\n  email_verified?: boolean;\n  [k: string]: unknown;\n}): AuthPayload {\n  return {\n    uid: decoded.uid,\n    email: decoded.email ?? null,\n    role: (decoded.role as string | undefined) ?? \"user\",\n    emailVerified: decoded.email_verified ?? false,\n    claims: Object.fromEntries(\n      Object.entries(decoded).filter(\n        ([k]) =>\n          ![\n            \"uid\",\n            \"email\",\n            \"email_verified\",\n            \"iat\",\n            \"exp\",\n            \"aud\",\n            \"iss\",\n            \"sub\",\n            \"auth_time\",\n            \"firebase\",\n          ].includes(k),\n      ),\n    ),\n  };\n}\n\nfunction toAuthUser(record: {\n  uid: string;\n  email?: string;\n  displayName?: string;\n  photoURL?: string;\n  emailVerified: boolean;\n  disabled: boolean;\n  metadata: { creationTime?: string };\n  customClaims?: Record<string, unknown>;\n}): AuthUser {\n  return {\n    uid: record.uid,\n    email: record.email ?? null,\n    displayName: record.displayName ?? null,\n    photoURL: record.photoURL ?? null,\n    role: (record.customClaims?.[\"role\"] as string | undefined) ?? \"user\",\n    emailVerified: record.emailVerified,\n    disabled: record.disabled,\n    createdAt: record.metadata.creationTime ?? new Date(0).toISOString(),\n  };\n}\n\nexport const firebaseAuthProvider: IAuthProvider = {\n  async verifyToken(token: string): Promise<AuthPayload> {\n    try {\n      const decoded = await getAdminAuth().verifyIdToken(token);\n      return toAuthPayload(decoded);\n    } catch (err) {\n      if (!isExpectedAuthError(err)) {\n        console.error(\n          \"[@mohasinac/auth-firebase] Token verification failed:\",\n          err,\n        );\n      }\n      throw err;\n    }\n  },\n\n  async createCustomToken(\n    uid: string,\n    claims?: Record<string, unknown>,\n  ): Promise<string> {\n    return getAdminAuth().createCustomToken(uid, claims);\n  },\n\n  async getUser(uid: string): Promise<AuthUser | null> {\n    try {\n      const record = await getAdminAuth().getUser(uid);\n      return toAuthUser(record);\n    } catch (err) {\n      if ((err as { code?: string }).code === \"auth/user-not-found\")\n        return null;\n      throw err;\n    }\n  },\n\n  async createUser(data: CreateUserInput): Promise<AuthUser> {\n    const record = await getAdminAuth().createUser({\n      email: data.email,\n      password: data.password,\n      displayName: data.displayName,\n      photoURL: data.photoURL,\n      emailVerified: data.emailVerified ?? false,\n    });\n    if (data.role) {\n      await getAdminAuth().setCustomUserClaims(record.uid, { role: data.role });\n      // Re-fetch to get updated claims\n      const updated = await getAdminAuth().getUser(record.uid);\n      return toAuthUser(updated);\n    }\n    return toAuthUser(record);\n  },\n\n  async updateUser(\n    uid: string,\n    data: Partial<CreateUserInput>,\n  ): Promise<AuthUser> {\n    const record = await getAdminAuth().updateUser(uid, {\n      email: data.email,\n      password: data.password,\n      displayName: data.displayName,\n      photoURL: data.photoURL,\n      emailVerified: data.emailVerified,\n    });\n    if (data.role !== undefined) {\n      await getAdminAuth().setCustomUserClaims(uid, { role: data.role });\n    }\n    const updated = await getAdminAuth().getUser(record.uid);\n    return toAuthUser(updated);\n  },\n\n  async deleteUser(uid: string): Promise<void> {\n    await getAdminAuth().deleteUser(uid);\n  },\n\n  async revokeTokens(uid: string): Promise<void> {\n    await getAdminAuth().revokeRefreshTokens(uid);\n  },\n};\n","/**\n * firebaseSessionProvider — ISessionProvider\n *\n * Implements `@mohasinac/contracts` `ISessionProvider` using Firebase Admin SDK\n * session cookies (HTTP-only, 5-day TTL by default).\n *\n * Server-side only.\n */\n\nimport type { ISessionProvider, AuthPayload } from \"@mohasinac/contracts\";\nimport { getAdminAuth } from \"@mohasinac/db-firebase\";\n\n/** Default session duration: 5 days (in milliseconds). */\nconst DEFAULT_EXPIRES_IN_MS = 60 * 60 * 24 * 5 * 1000;\n\nconst EXPECTED_SESSION_CODES = new Set([\n  \"auth/session-cookie-expired\",\n  \"auth/session-cookie-revoked\",\n  \"auth/user-disabled\",\n  \"auth/user-not-found\",\n  \"auth/argument-error\",\n]);\n\nexport const firebaseSessionProvider: ISessionProvider = {\n  /**\n   * `payload` must be an `AuthPayload` from a freshly verified ID token.\n   * The underlying Firebase API expects an ID token string, not just a UID.\n   * If you have the raw ID token, use `createSessionCookieFromToken()` instead.\n   *\n   * Here we create a custom token → exchange for an effective session.\n   * In practice, callers should use `createSessionCookieFromToken()`.\n   */\n  async createSession(payload: AuthPayload): Promise<string> {\n    void payload;\n    // Custom tokens cannot be used to mint a session cookie directly —\n    // createSession via ISessionProvider is called at the point where\n    // the caller already has a verified payload.  We delegate to a helper\n    // that is invoked in the auth API route where the raw ID token is available.\n    throw new Error(\n      \"Use createSessionCookieFromToken(idToken) instead of createSession(payload). \" +\n        \"Firebase session cookies must be created from a raw ID token string.\",\n    );\n  },\n\n  async verifySession(cookie: string): Promise<AuthPayload> {\n    try {\n      const decoded = await getAdminAuth().verifySessionCookie(cookie, true);\n      return {\n        uid: decoded.uid,\n        email: decoded.email ?? null,\n        role: (decoded.role as string | undefined) ?? \"user\",\n        emailVerified: decoded.email_verified ?? false,\n        claims: Object.fromEntries(\n          Object.entries(decoded).filter(\n            ([k]) =>\n              ![\n                \"uid\",\n                \"email\",\n                \"email_verified\",\n                \"iat\",\n                \"exp\",\n                \"aud\",\n                \"iss\",\n                \"sub\",\n                \"auth_time\",\n                \"firebase\",\n              ].includes(k),\n          ),\n        ),\n      };\n    } catch (err) {\n      if (!EXPECTED_SESSION_CODES.has((err as { code?: string }).code ?? \"\")) {\n        console.error(\n          \"[@mohasinac/auth-firebase] Session cookie verification failed:\",\n          err,\n        );\n      }\n      throw err;\n    }\n  },\n\n  async destroySession(cookie: string): Promise<void> {\n    try {\n      const decoded = await getAdminAuth().verifySessionCookie(cookie, false);\n      await getAdminAuth().revokeRefreshTokens(decoded.uid);\n    } catch {\n      // Best-effort: if cookie is already invalid, treat as already destroyed\n    }\n  },\n};\n\n/**\n * Mint a Firebase session cookie from a raw Firebase ID token string.\n *\n * Use this in your `POST /api/auth/session` route handler.\n *\n * @param idToken   The ID token from `firebase.auth().currentUser.getIdToken()`.\n * @param expiresIn Cookie duration in milliseconds (default: 5 days).\n */\nexport async function createSessionCookieFromToken(\n  idToken: string,\n  expiresIn: number = DEFAULT_EXPIRES_IN_MS,\n): Promise<string> {\n  return getAdminAuth().createSessionCookie(idToken, { expiresIn });\n}\n","/**\n * Server-side Firebase Auth helper functions.\n *\n * Drop-in replacements for the functions in `src/lib/firebase/auth-server.ts`.\n * All functions use the shared `getAdminAuth()` singleton from `@mohasinac/db-firebase`.\n */\n\nimport type { AuthPayload } from \"@mohasinac/contracts\";\nimport { getAdminAuth } from \"@mohasinac/db-firebase\";\nimport { createSessionCookieFromToken } from \"./session.js\";\n\nexport { createSessionCookieFromToken };\n\nconst EXPECTED_AUTH_CODES = new Set([\n  \"auth/argument-error\",\n  \"auth/id-token-expired\",\n  \"auth/id-token-revoked\",\n  \"auth/session-cookie-expired\",\n  \"auth/session-cookie-revoked\",\n  \"auth/user-disabled\",\n  \"auth/user-not-found\",\n]);\n\n// ─── Token helpers ────────────────────────────────────────────────────────────\n\n/** Verify a Firebase ID token. Returns null for expected auth failures. */\nexport async function verifyIdToken(\n  token: string,\n): Promise<AuthPayload | null> {\n  try {\n    const decoded = await getAdminAuth().verifyIdToken(token);\n    return {\n      uid: decoded.uid,\n      email: decoded.email ?? null,\n      role: (decoded.role as string | undefined) ?? \"user\",\n      emailVerified: decoded.email_verified ?? false,\n    };\n  } catch (err) {\n    if (!EXPECTED_AUTH_CODES.has((err as { code?: string }).code ?? \"\")) {\n      console.error(\n        \"[@mohasinac/auth-firebase] Token verification failed:\",\n        err,\n      );\n    }\n    return null;\n  }\n}\n\n/** Verify a Firebase session cookie. Returns null for expected auth failures. */\nexport async function verifySessionCookie(\n  cookie: string,\n): Promise<AuthPayload | null> {\n  try {\n    const decoded = await getAdminAuth().verifySessionCookie(cookie, true);\n    return {\n      uid: decoded.uid,\n      email: decoded.email ?? null,\n      role: (decoded.role as string | undefined) ?? \"user\",\n      emailVerified: decoded.email_verified ?? false,\n    };\n  } catch (err) {\n    if (!EXPECTED_AUTH_CODES.has((err as { code?: string }).code ?? \"\")) {\n      console.error(\n        \"[@mohasinac/auth-firebase] Session cookie verification failed:\",\n        err,\n      );\n    }\n    return null;\n  }\n}\n\n/**\n * Create a middleware auth chain function.\n *\n * Returns an async function that reads the `__session` (or `idToken`) cookie\n * from a `RequestCookies`-like object and returns the decoded `AuthPayload`.\n *\n * @example\n * ```ts\n * import { createMiddlewareAuthChain } from \"@mohasinac/auth-firebase\";\n *\n * const getUser = createMiddlewareAuthChain();\n * const user = await getUser(request.cookies);\n * ```\n */\nexport function createMiddlewareAuthChain() {\n  return async function getUser(cookies: {\n    get(name: string): { value: string } | undefined;\n  }): Promise<AuthPayload | null> {\n    const session = cookies.get(\"__session\")?.value;\n    if (session) {\n      const user = await verifySessionCookie(session);\n      if (user) return user;\n    }\n\n    const idToken = cookies.get(\"idToken\")?.value;\n    if (idToken) {\n      return verifyIdToken(idToken);\n    }\n\n    return null;\n  };\n}\n\n/**\n * Require a valid session — throws if not authenticated.\n *\n * @param cookies  `RequestCookies` from `request.cookies` (middleware) or\n *                 `await cookies()` from `next/headers` (RSC / API route).\n */\nexport async function requireAuth(cookies: {\n  get(name: string): { value: string } | undefined;\n}): Promise<AuthPayload> {\n  const chain = createMiddlewareAuthChain();\n  const user = await chain(cookies);\n  if (!user) {\n    throw Object.assign(new Error(\"Unauthorized\"), { statusCode: 401 });\n  }\n  return user;\n}\n\n/**\n * Require a specific role — throws 401/403 if not authenticated or wrong role.\n *\n * @param cookies  Cookie store (same as `requireAuth`).\n * @param role     A single role string or an array of allowed roles.\n * @param resolveRole  Optional async function to resolve the role from the DB.\n */\nexport async function requireRole(\n  cookies: { get(name: string): { value: string } | undefined },\n  role: string | string[],\n  resolveRole?: (uid: string) => Promise<string>,\n): Promise<AuthPayload> {\n  const user = await requireAuth(cookies);\n  const allowed = Array.isArray(role) ? role : [role];\n\n  let userRole = user.role;\n  if (resolveRole) {\n    userRole = await resolveRole(user.uid);\n  }\n\n  if (!allowed.includes(userRole)) {\n    throw Object.assign(\n      new Error(`Forbidden — requires role: ${allowed.join(\" | \")}`),\n      { statusCode: 403 },\n    );\n  }\n\n  return { ...user, role: userRole };\n}\n"]}