@nifrajs/authjs 0.0.0-bootstrap.0 → 4.0.0

package/LICENSE

@@ -0,0 +1,21 @@
+MIT License
+
+Copyright (c) 2026 Nifra Authors
+
+Permission is hereby granted, free of charge, to any person obtaining a copy
+of this software and associated documentation files (the "Software"), to deal
+in the Software without restriction, including without limitation the rights
+to use, copy, modify, merge, publish, distribute, sublicense, and/or sell
+copies of the Software, and to permit persons to whom the Software is
+furnished to do so, subject to the following conditions:
+
+The above copyright notice and this permission notice shall be included in all
+copies or substantial portions of the Software.
+
+THE SOFTWARE IS PROVIDED "AS IS", WITHOUT WARRANTY OF ANY KIND, EXPRESS OR
+IMPLIED, INCLUDING BUT NOT LIMITED TO THE WARRANTIES OF MERCHANTABILITY,
+FITNESS FOR A PARTICULAR PURPOSE AND NONINFRINGEMENT. IN NO EVENT SHALL THE
+AUTHORS OR COPYRIGHT HOLDERS BE LIABLE FOR ANY CLAIM, DAMAGES OR OTHER
+LIABILITY, WHETHER IN AN ACTION OF CONTRACT, TORT OR OTHERWISE, ARISING FROM,
+OUT OF OR IN CONNECTION WITH THE SOFTWARE OR THE USE OR OTHER DEALINGS IN THE
+SOFTWARE.

package/README.md

@@ -0,0 +1,36 @@
+# `@nifrajs/authjs`
+
+Official [Auth.js](https://authjs.dev) integration for nifra - backend mount, session helpers,
+route guards, a framework-agnostic client, and React bindings.
+
+```ts
+import { authjs, getSession, requireAuthUser } from "@nifrajs/authjs"
+import GitHub from "@auth/core/providers/github"
+
+const authConfig = {
+  providers: [GitHub({ clientId: process.env.GITHUB_ID! })],
+  secret: process.env.AUTH_SECRET!,
+  trustHost: true,
+}
+
+export const app = server()
+  .use(authjs(authConfig)) // serves /api/auth/* (sign-in, callbacks, session, sign-out)
+  .get("/me", async (c) => ({ user: (await getSession(c.req, authConfig))?.user ?? null }))
+```
+
+- `authjs(config, options?)` - identity plugin mounting Auth.js at `/api/auth/*` (GET + POST).
+  Secrets resolve per request (explicit → platform binding → `process.env`); missing fails loud.
+- `getSession(req, config, options?)` - `Session | null`, usable in handlers and loaders. Pass the
+  mount's `authUrl`, `trustProxy` and `basePath` so the session is read where the mount serves it.
+- `requireAuthUser(req, config, { redirectTo? })` - returns the user or throws a 401/redirect.
+- `@nifrajs/authjs/client` - `createAuthClient()` (session, sign-in, sign-out) for any frontend.
+- `@nifrajs/web-react/auth` - `<AuthSessionProvider>` + `useAuthSession()`.
+
+Auth.js itself does the security-critical work (PKCE, state, token verification); this package
+is the nifra-shaped surface over `@auth/core`. See `/docs/auth` (Auth.js section) for the full
+guide, including proxies (`authUrl`) and edge secret bindings.
+
+## For AI agents
+
+Start with [`LLM.md`](./LLM.md) - this package's contract card. For the wider framework, see the
+repository [`llms-full.txt`](../../llms-full.txt) corpus.

package/dist/client.d.ts

@@ -0,0 +1,54 @@
+/**
+ * Framework-agnostic Auth.js client - `fetch` against the mounted Auth.js endpoints, no DOM
+ * framework involved. Every UI adapter builds on this: pass it a base path (default
+ * `/api/auth`, matching the backend mount default) and an optional `fetch` override for tests
+ * or loaders that must forward headers.
+ *
+ * ```ts
+ * import { createAuthClient } from "@nifrajs/authjs/client"
+ *
+ * const auth = createAuthClient()
+ * await auth.signIn("github") // posts sign-in, then navigates to the provider (browser only)
+ * await auth.signOut() // posts signout, then navigates home
+ * const session = await auth.getSession() // works anywhere fetch does
+ * ```
+ */
+import type { Session } from "@auth/core/types";
+export type { Session } from "@auth/core/types";
+export interface AuthClientOptions {
+    /** Auth.js mount path. Default `"/api/auth"`. */
+    readonly basePath?: string;
+    /** `fetch` implementation. Default global `fetch` - override in tests or to forward headers. */
+    readonly fetch?: typeof fetch;
+}
+export interface SignInOptions {
+    /** Where the provider returns afterwards. Default the current page. */
+    readonly callbackUrl?: string;
+}
+export interface SignOutOptions {
+    /** Where to land after sign-out. Default `"/"`. Set `redirect: false` to stay put. */
+    readonly callbackUrl?: string;
+    readonly redirect?: boolean;
+}
+/**
+ * Build `/api/auth/signin/:provider?callbackUrl=…` without touching `window` (testable).
+ *
+ * @deprecated Auth.js v5 accepts only a CSRF-carrying POST at this path and answers a GET - a link
+ * or a navigation here - with an error. Call `signIn()`, which submits that POST.
+ */
+export declare function signInUrl(providerId: string, options: {
+    readonly basePath?: string;
+    readonly callbackUrl: string;
+}): string;
+export interface AuthClient {
+    /** The Auth.js session, or `null` when unauthenticated. Usable anywhere `fetch` runs. */
+    getSession(init?: RequestInit): Promise<Session | null>;
+    /** Start an OAuth/OIDC sign-in (browser only): posts the CSRF-protected sign-in to Auth.js, then
+     * navigates to the provider page it answers with. */
+    signIn(providerId: string, options?: SignInOptions): Promise<void>;
+    /** Sign out via the CSRF-protected endpoint, then navigate (unless `redirect: false`). */
+    signOut(options?: SignOutOptions): Promise<void>;
+}
+/** Create the client. Stateless - every call hits the endpoints, so servers stay authoritative. */
+export declare function createAuthClient(options?: AuthClientOptions): AuthClient;
+//# sourceMappingURL=client.d.ts.map

package/dist/client.d.ts.map

@@ -0,0 +1 @@
+{"version":3,"file":"client.d.ts","sourceRoot":"","sources":["../src/client.ts"],"names":[],"mappings":"AAAA;;;;;;;;;;;;;;GAcG;AACH,OAAO,KAAK,EAAE,OAAO,EAAE,MAAM,kBAAkB,CAAA;AAE/C,YAAY,EAAE,OAAO,EAAE,MAAM,kBAAkB,CAAA;AAE/C,MAAM,WAAW,iBAAiB;IAChC,iDAAiD;IACjD,QAAQ,CAAC,QAAQ,CAAC,EAAE,MAAM,CAAA;IAC1B,gGAAgG;IAChG,QAAQ,CAAC,KAAK,CAAC,EAAE,OAAO,KAAK,CAAA;CAC9B;AAED,MAAM,WAAW,aAAa;IAC5B,uEAAuE;IACvE,QAAQ,CAAC,WAAW,CAAC,EAAE,MAAM,CAAA;CAC9B;AAED,MAAM,WAAW,cAAc;IAC7B,sFAAsF;IACtF,QAAQ,CAAC,WAAW,CAAC,EAAE,MAAM,CAAA;IAC7B,QAAQ,CAAC,QAAQ,CAAC,EAAE,OAAO,CAAA;CAC5B;AAED;;;;;GAKG;AACH,wBAAgB,SAAS,CACvB,UAAU,EAAE,MAAM,EAClB,OAAO,EAAE;IAAE,QAAQ,CAAC,QAAQ,CAAC,EAAE,MAAM,CAAC;IAAC,QAAQ,CAAC,WAAW,EAAE,MAAM,CAAA;CAAE,GACpE,MAAM,CAGR;AAwDD,MAAM,WAAW,UAAU;IACzB,yFAAyF;IACzF,UAAU,CAAC,IAAI,CAAC,EAAE,WAAW,GAAG,OAAO,CAAC,OAAO,GAAG,IAAI,CAAC,CAAA;IACvD;yDACqD;IACrD,MAAM,CAAC,UAAU,EAAE,MAAM,EAAE,OAAO,CAAC,EAAE,aAAa,GAAG,OAAO,CAAC,IAAI,CAAC,CAAA;IAClE,0FAA0F;IAC1F,OAAO,CAAC,OAAO,CAAC,EAAE,cAAc,GAAG,OAAO,CAAC,IAAI,CAAC,CAAA;CACjD;AAED,mGAAmG;AACnG,wBAAgB,gBAAgB,CAAC,OAAO,GAAE,iBAAsB,GAAG,UAAU,CAoD5E"}

package/dist/client.js

@@ -0,0 +1,119 @@
+/**
+ * Build `/api/auth/signin/:provider?callbackUrl=…` without touching `window` (testable).
+ *
+ * @deprecated Auth.js v5 accepts only a CSRF-carrying POST at this path and answers a GET - a link
+ * or a navigation here - with an error. Call `signIn()`, which submits that POST.
+ */
+export function signInUrl(providerId, options) {
+    const base = options.basePath ?? "/api/auth";
+    return `${base}/signin/${encodeURIComponent(providerId)}?callbackUrl=${encodeURIComponent(options.callbackUrl)}`;
+}
+const currentUrl = () => {
+    if (typeof window === "undefined" || typeof window.location?.href !== "string") {
+        throw new Error("[nifra/authjs] signIn needs a browser page (no window.location.href)");
+    }
+    return window.location.href;
+};
+function isSafeRelativePath(value) {
+    if (!value.startsWith("/") || value.startsWith("//"))
+        return false;
+    for (let i = 1; i < value.length; i++) {
+        const code = value.charCodeAt(i);
+        if (code <= 0x1f || code === 0x7f || code === 0x5c)
+            return false;
+    }
+    return true;
+}
+/** Where Auth.js sent a sign-in: the provider's authorization page, usually on another origin. It
+ * came from the auth endpoint, not the caller, so only a non-web scheme (`javascript:`) is refused. */
+function providerNavigationTarget(value) {
+    try {
+        const target = new URL(value, window.location.href);
+        if (target.protocol === "http:" || target.protocol === "https:")
+            return target.href;
+    }
+    catch {
+        // An unparseable answer falls back to the home path, as an unsafe callback does.
+    }
+    return "/";
+}
+/** Keep post-auth navigation on this origin; an unsafe callback is never an external redirect. */
+function safeNavigationTarget(value) {
+    if (isSafeRelativePath(value))
+        return value;
+    if (typeof window !== "undefined" && typeof window.location?.href === "string") {
+        try {
+            const target = new URL(value, window.location.href);
+            if ((target.protocol === "http:" || target.protocol === "https:") &&
+                target.origin === window.location.origin) {
+                return target.href;
+            }
+        }
+        catch {
+            // Invalid callback URLs fall back to the home path rather than becoming a navigation sink.
+        }
+    }
+    return "/";
+}
+const navigate = (url, target = safeNavigationTarget) => {
+    if (typeof window === "undefined" || typeof window.location?.assign !== "function") {
+        throw new Error("[nifra/authjs] navigation needs a browser page");
+    }
+    window.location.assign(target(url));
+};
+/** Create the client. Stateless - every call hits the endpoints, so servers stay authoritative. */
+export function createAuthClient(options = {}) {
+    const base = options.basePath ?? "/api/auth";
+    const impl = options.fetch ?? fetch;
+    const csrfToken = async (action) => {
+        const csrf = (await (await impl(`${base}/csrf`)).json());
+        if (typeof csrf.csrfToken !== "string" || csrf.csrfToken === "") {
+            throw new Error(`[nifra/authjs] ${action}: CSRF token endpoint did not answer`);
+        }
+        return csrf.csrfToken;
+    };
+    return {
+        async getSession(init) {
+            const response = await impl(`${base}/session`, init);
+            if (!response.ok)
+                return null;
+            const session = (await response.json());
+            return session?.user ? session : null;
+        },
+        async signIn(providerId, signInOptions = {}) {
+            const callbackUrl = signInOptions.callbackUrl ?? currentUrl();
+            const token = await csrfToken("signIn");
+            // `X-Auth-Return-Redirect` makes Auth.js answer `{ url }` instead of a 302 that `fetch` would
+            // follow on its own, so the browser navigates to the provider itself.
+            const response = await impl(`${base}/signin/${encodeURIComponent(providerId)}`, {
+                method: "POST",
+                headers: {
+                    "content-type": "application/x-www-form-urlencoded",
+                    "x-auth-return-redirect": "1",
+                },
+                body: new URLSearchParams({ csrfToken: token, callbackUrl }),
+            });
+            const answer = response.ok ? await response.json().catch(() => null) : null;
+            const url = typeof answer === "object" && answer !== null ? Reflect.get(answer, "url") : undefined;
+            if (typeof url !== "string" || url === "") {
+                throw new Error(`[nifra/authjs] signIn failed (HTTP ${response.status})`);
+            }
+            navigate(url, providerNavigationTarget);
+        },
+        async signOut(signOutOptions = {}) {
+            const token = await csrfToken("signOut");
+            const callbackUrl = signOutOptions.callbackUrl ?? "/";
+            const response = await impl(`${base}/signout`, {
+                method: "POST",
+                headers: { "content-type": "application/x-www-form-urlencoded" },
+                body: new URLSearchParams({ csrfToken: token, callbackUrl }),
+            });
+            if (!response.ok) {
+                throw new Error(`[nifra/authjs] signOut failed (HTTP ${response.status})`);
+            }
+            if (signOutOptions.redirect !== false)
+                navigate(callbackUrl);
+        },
+    };
+}
+//# sourceMappingURL=client.js.map

package/dist/client.js.map

@@ -0,0 +1 @@
+{"version":3,"file":"client.js","sourceRoot":"","sources":["../src/client.ts"],"names":[],"mappings":"AAqCA;;;;;GAKG;AACH,MAAM,UAAU,SAAS,CACvB,UAAkB,EAClB,OAAqE;IAErE,MAAM,IAAI,GAAG,OAAO,CAAC,QAAQ,IAAI,WAAW,CAAA;IAC5C,OAAO,GAAG,IAAI,WAAW,kBAAkB,CAAC,UAAU,CAAC,gBAAgB,kBAAkB,CAAC,OAAO,CAAC,WAAW,CAAC,EAAE,CAAA;AAClH,CAAC;AAED,MAAM,UAAU,GAAG,GAAW,EAAE;IAC9B,IAAI,OAAO,MAAM,KAAK,WAAW,IAAI,OAAO,MAAM,CAAC,QAAQ,EAAE,IAAI,KAAK,QAAQ,EAAE,CAAC;QAC/E,MAAM,IAAI,KAAK,CAAC,sEAAsE,CAAC,CAAA;IACzF,CAAC;IACD,OAAO,MAAM,CAAC,QAAQ,CAAC,IAAI,CAAA;AAC7B,CAAC,CAAA;AAED,SAAS,kBAAkB,CAAC,KAAa;IACvC,IAAI,CAAC,KAAK,CAAC,UAAU,CAAC,GAAG,CAAC,IAAI,KAAK,CAAC,UAAU,CAAC,IAAI,CAAC;QAAE,OAAO,KAAK,CAAA;IAClE,KAAK,IAAI,CAAC,GAAG,CAAC,EAAE,CAAC,GAAG,KAAK,CAAC,MAAM,EAAE,CAAC,EAAE,EAAE,CAAC;QACtC,MAAM,IAAI,GAAG,KAAK,CAAC,UAAU,CAAC,CAAC,CAAC,CAAA;QAChC,IAAI,IAAI,IAAI,IAAI,IAAI,IAAI,KAAK,IAAI,IAAI,IAAI,KAAK,IAAI;YAAE,OAAO,KAAK,CAAA;IAClE,CAAC;IACD,OAAO,IAAI,CAAA;AACb,CAAC;AAED;uGACuG;AACvG,SAAS,wBAAwB,CAAC,KAAa;IAC7C,IAAI,CAAC;QACH,MAAM,MAAM,GAAG,IAAI,GAAG,CAAC,KAAK,EAAE,MAAM,CAAC,QAAQ,CAAC,IAAI,CAAC,CAAA;QACnD,IAAI,MAAM,CAAC,QAAQ,KAAK,OAAO,IAAI,MAAM,CAAC,QAAQ,KAAK,QAAQ;YAAE,OAAO,MAAM,CAAC,IAAI,CAAA;IACrF,CAAC;IAAC,MAAM,CAAC;QACP,iFAAiF;IACnF,CAAC;IACD,OAAO,GAAG,CAAA;AACZ,CAAC;AAED,kGAAkG;AAClG,SAAS,oBAAoB,CAAC,KAAa;IACzC,IAAI,kBAAkB,CAAC,KAAK,CAAC;QAAE,OAAO,KAAK,CAAA;IAC3C,IAAI,OAAO,MAAM,KAAK,WAAW,IAAI,OAAO,MAAM,CAAC,QAAQ,EAAE,IAAI,KAAK,QAAQ,EAAE,CAAC;QAC/E,IAAI,CAAC;YACH,MAAM,MAAM,GAAG,IAAI,GAAG,CAAC,KAAK,EAAE,MAAM,CAAC,QAAQ,CAAC,IAAI,CAAC,CAAA;YACnD,IACE,CAAC,MAAM,CAAC,QAAQ,KAAK,OAAO,IAAI,MAAM,CAAC,QAAQ,KAAK,QAAQ,CAAC;gBAC7D,MAAM,CAAC,MAAM,KAAK,MAAM,CAAC,QAAQ,CAAC,MAAM,EACxC,CAAC;gBACD,OAAO,MAAM,CAAC,IAAI,CAAA;YACpB,CAAC;QACH,CAAC;QAAC,MAAM,CAAC;YACP,2FAA2F;QAC7F,CAAC;IACH,CAAC;IACD,OAAO,GAAG,CAAA;AACZ,CAAC;AAED,MAAM,QAAQ,GAAG,CAAC,GAAW,EAAE,SAAkC,oBAAoB,EAAQ,EAAE;IAC7F,IAAI,OAAO,MAAM,KAAK,WAAW,IAAI,OAAO,MAAM,CAAC,QAAQ,EAAE,MAAM,KAAK,UAAU,EAAE,CAAC;QACnF,MAAM,IAAI,KAAK,CAAC,gDAAgD,CAAC,CAAA;IACnE,CAAC;IACD,MAAM,CAAC,QAAQ,CAAC,MAAM,CAAC,MAAM,CAAC,GAAG,CAAC,CAAC,CAAA;AACrC,CAAC,CAAA;AAYD,mGAAmG;AACnG,MAAM,UAAU,gBAAgB,CAAC,UAA6B,EAAE;IAC9D,MAAM,IAAI,GAAG,OAAO,CAAC,QAAQ,IAAI,WAAW,CAAA;IAC5C,MAAM,IAAI,GAAG,OAAO,CAAC,KAAK,IAAI,KAAK,CAAA;IACnC,MAAM,SAAS,GAAG,KAAK,EAAE,MAAc,EAAmB,EAAE;QAC1D,MAAM,IAAI,GAAG,CAAC,MAAM,CAAC,MAAM,IAAI,CAAC,GAAG,IAAI,OAAO,CAAC,CAAC,CAAC,IAAI,EAAE,CAA4B,CAAA;QACnF,IAAI,OAAO,IAAI,CAAC,SAAS,KAAK,QAAQ,IAAI,IAAI,CAAC,SAAS,KAAK,EAAE,EAAE,CAAC;YAChE,MAAM,IAAI,KAAK,CAAC,kBAAkB,MAAM,sCAAsC,CAAC,CAAA;QACjF,CAAC;QACD,OAAO,IAAI,CAAC,SAAS,CAAA;IACvB,CAAC,CAAA;IACD,OAAO;QACL,KAAK,CAAC,UAAU,CAAC,IAAkB;YACjC,MAAM,QAAQ,GAAG,MAAM,IAAI,CAAC,GAAG,IAAI,UAAU,EAAE,IAAI,CAAC,CAAA;YACpD,IAAI,CAAC,QAAQ,CAAC,EAAE;gBAAE,OAAO,IAAI,CAAA;YAC7B,MAAM,OAAO,GAAG,CAAC,MAAM,QAAQ,CAAC,IAAI,EAAE,CAAmB,CAAA;YACzD,OAAO,OAAO,EAAE,IAAI,CAAC,CAAC,CAAC,OAAO,CAAC,CAAC,CAAC,IAAI,CAAA;QACvC,CAAC;QACD,KAAK,CAAC,MAAM,CAAC,UAAkB,EAAE,gBAA+B,EAAE;YAChE,MAAM,WAAW,GAAG,aAAa,CAAC,WAAW,IAAI,UAAU,EAAE,CAAA;YAC7D,MAAM,KAAK,GAAG,MAAM,SAAS,CAAC,QAAQ,CAAC,CAAA;YACvC,8FAA8F;YAC9F,sEAAsE;YACtE,MAAM,QAAQ,GAAG,MAAM,IAAI,CAAC,GAAG,IAAI,WAAW,kBAAkB,CAAC,UAAU,CAAC,EAAE,EAAE;gBAC9E,MAAM,EAAE,MAAM;gBACd,OAAO,EAAE;oBACP,cAAc,EAAE,mCAAmC;oBACnD,wBAAwB,EAAE,GAAG;iBAC9B;gBACD,IAAI,EAAE,IAAI,eAAe,CAAC,EAAE,SAAS,EAAE,KAAK,EAAE,WAAW,EAAE,CAAC;aAC7D,CAAC,CAAA;YACF,MAAM,MAAM,GAAY,QAAQ,CAAC,EAAE,CAAC,CAAC,CAAC,MAAM,QAAQ,CAAC,IAAI,EAAE,CAAC,KAAK,CAAC,GAAG,EAAE,CAAC,IAAI,CAAC,CAAC,CAAC,CAAC,IAAI,CAAA;YACpF,MAAM,GAAG,GACP,OAAO,MAAM,KAAK,QAAQ,IAAI,MAAM,KAAK,IAAI,CAAC,CAAC,CAAC,OAAO,CAAC,GAAG,CAAC,MAAM,EAAE,KAAK,CAAC,CAAC,CAAC,CAAC,SAAS,CAAA;YACxF,IAAI,OAAO,GAAG,KAAK,QAAQ,IAAI,GAAG,KAAK,EAAE,EAAE,CAAC;gBAC1C,MAAM,IAAI,KAAK,CAAC,sCAAsC,QAAQ,CAAC,MAAM,GAAG,CAAC,CAAA;YAC3E,CAAC;YACD,QAAQ,CAAC,GAAG,EAAE,wBAAwB,CAAC,CAAA;QACzC,CAAC;QACD,KAAK,CAAC,OAAO,CAAC,iBAAiC,EAAE;YAC/C,MAAM,KAAK,GAAG,MAAM,SAAS,CAAC,SAAS,CAAC,CAAA;YACxC,MAAM,WAAW,GAAG,cAAc,CAAC,WAAW,IAAI,GAAG,CAAA;YACrD,MAAM,QAAQ,GAAG,MAAM,IAAI,CAAC,GAAG,IAAI,UAAU,EAAE;gBAC7C,MAAM,EAAE,MAAM;gBACd,OAAO,EAAE,EAAE,cAAc,EAAE,mCAAmC,EAAE;gBAChE,IAAI,EAAE,IAAI,eAAe,CAAC,EAAE,SAAS,EAAE,KAAK,EAAE,WAAW,EAAE,CAAC;aAC7D,CAAC,CAAA;YACF,IAAI,CAAC,QAAQ,CAAC,EAAE,EAAE,CAAC;gBACjB,MAAM,IAAI,KAAK,CAAC,uCAAuC,QAAQ,CAAC,MAAM,GAAG,CAAC,CAAA;YAC5E,CAAC;YACD,IAAI,cAAc,CAAC,QAAQ,KAAK,KAAK;gBAAE,QAAQ,CAAC,WAAW,CAAC,CAAA;QAC9D,CAAC;KACF,CAAA;AACH,CAAC"}

package/dist/index.d.ts

@@ -0,0 +1,83 @@
+/**
+ * Official Auth.js integration for nifra - backend half. Mount the full Auth.js surface
+ * (OAuth/OIDC sign-in, callbacks, session, sign-out, CSRF) into a nifra app, read the session in
+ * handlers and loaders, and guard routes - with Auth.js, not a reimplementation, doing the
+ * security-critical work (PKCE, state, token verification, session cookies).
+ *
+ * ```ts
+ * import { authjs, requireAuthUser } from "@nifrajs/authjs"
+ * import GitHub from "@auth/core/providers/github"
+ *
+ * const auth = {
+ *   providers: [GitHub({ clientId: process.env.GITHUB_ID! })],
+ *   secret: process.env.AUTH_SECRET,
+ *   trustHost: true, // or a canonical origin: AuthJSOptions.authUrl / AUTH_URL
+ * }
+ *
+ * export const app = server()
+ *   .use(authjs(auth))
+ *   .get("/me", async (c) => ({ user: await requireAuthUser(c.req, auth) }))
+ * ```
+ *
+ * Frontend half: `createAuthClient` in `@nifrajs/authjs/client`, plus `<AuthSessionProvider>` /
+ * `useAuthSession()` in `@nifrajs/web-react/auth` (other adapters wrap the agnostic client the
+ * same way `@nifrajs/web-react/i18n` wraps `@nifrajs/i18n`).
+ */
+import type { AuthConfig } from "@auth/core";
+import type { Session } from "@auth/core/types";
+export type { Session } from "@auth/core/types";
+/** The Auth.js config this integration drives - everything `@auth/core` accepts except `raw`. */
+export type AuthJSConfig = Omit<AuthConfig, "raw">;
+export interface AuthJSOptions {
+    /** Mount path for Auth.js routes. Defaults to `config.basePath`, then `"/api/auth"`. */
+    readonly basePath?: string;
+    /** Public origin (e.g. `"https://app.example.com"`); falls back to the `AUTH_URL` variable.
+     * Every request is rewritten onto it, so Auth.js trusts it and neither the Host header nor
+     * forwarded headers can replace it. Without one, Auth.js trusts the Host header only when
+     * `trustHost` (or `AUTH_TRUST_HOST`) says so, or outside production. */
+    readonly authUrl?: string;
+    /** Trust proxy-provided `x-forwarded-*` headers when `authUrl` is absent. Default `false`.
+     * Enable only when the deployment strips and replaces those headers at a trusted proxy. */
+    readonly trustProxy?: boolean;
+    /** Session secret. Falls back to the `secretEnv` platform binding, then `process.env`. Missing
+     * everywhere fails loud (500) on first use - Auth.js cannot sign cookies without it. */
+    readonly secret?: string;
+    /** Platform-binding name carrying the secret on edge runtimes (no `process.env` there).
+     * Default `"AUTH_SECRET"`. */
+    readonly secretEnv?: string;
+}
+/**
+ * Mount an Auth.js instance into a nifra app: serves `${basePath}/*` (default `/api/auth/*`) for
+ * `GET` + `POST`, so sign-in, OAuth callbacks, session, sign-out, and CSRF all run on your server
+ * through `@auth/core` itself. A type-IDENTITY plugin (see `defineIdentityPlugin`): mounting never
+ * changes the route registry's type, so the typed client keeps working below the mount.
+ *
+ * Idempotent (named `"authjs"` - applying twice mounts once).
+ */
+export declare function authjs(config: AuthJSConfig, options?: AuthJSOptions): import("@nifrajs/core").IdentityPlugin<never>;
+/** What a guard does when the check fails: 302 to `redirectTo` (same-origin path), else 401 JSON.
+ * Pass the `basePath`, `authUrl` and `trustProxy` the mount was given, so the session is read on
+ * the origin and path the mount serves it from. */
+export interface AuthGuardOptions extends Pick<AuthJSOptions, "basePath" | "authUrl" | "trustProxy"> {
+    readonly redirectTo?: string;
+    /** Secret override for this call. */
+    readonly secret?: string | string[];
+    /** Platform binding object used when `config.secret` is not present. */
+    readonly env?: unknown;
+    /** Secret key in `env`; defaults to `AUTH_SECRET`. */
+    readonly secretEnv?: string;
+}
+/**
+ * Resolve the Auth.js session for a request - `null` when unauthenticated. Takes the raw `Request`
+ * so it works in handlers (`c.req`), loaders/actions (`request`), and middleware. Mirrors the
+ * session-callback interception `@hono/auth-js` uses: the full `{ session, user }` flows through
+ * your configured `callbacks.session` first.
+ */
+export declare function getSession(req: Request, config: AuthJSConfig, options?: AuthGuardOptions): Promise<Session | null>;
+/**
+ * Require an authenticated user. Returns `session.user`; otherwise throws a `status(...)` render
+ * (302/401) - control flow, caught by nifra's plain-data lane like `@nifrajs/auth` guards. Call at
+ * the top of a protected handler/loader/action.
+ */
+export declare function requireAuthUser(req: Request, config: AuthJSConfig, options?: AuthGuardOptions): Promise<NonNullable<Session["user"]>>;
+//# sourceMappingURL=index.d.ts.map

package/dist/index.d.ts.map

@@ -0,0 +1 @@
+{"version":3,"file":"index.d.ts","sourceRoot":"","sources":["../src/index.ts"],"names":[],"mappings":"AAAA;;;;;;;;;;;;;;;;;;;;;;;;GAwBG;AAEH,OAAO,KAAK,EAAE,UAAU,EAAkB,MAAM,YAAY,CAAA;AAC5D,OAAO,KAAK,EAAE,OAAO,EAAE,MAAM,kBAAkB,CAAA;AAI/C,YAAY,EAAE,OAAO,EAAE,MAAM,kBAAkB,CAAA;AAE/C,iGAAiG;AACjG,MAAM,MAAM,YAAY,GAAG,IAAI,CAAC,UAAU,EAAE,KAAK,CAAC,CAAA;AAElD,MAAM,WAAW,aAAa;IAC5B,wFAAwF;IACxF,QAAQ,CAAC,QAAQ,CAAC,EAAE,MAAM,CAAA;IAC1B;;;4EAGwE;IACxE,QAAQ,CAAC,OAAO,CAAC,EAAE,MAAM,CAAA;IACzB;+FAC2F;IAC3F,QAAQ,CAAC,UAAU,CAAC,EAAE,OAAO,CAAA;IAC7B;4FACwF;IACxF,QAAQ,CAAC,MAAM,CAAC,EAAE,MAAM,CAAA;IACxB;kCAC8B;IAC9B,QAAQ,CAAC,SAAS,CAAC,EAAE,MAAM,CAAA;CAC5B;AA6JD;;;;;;;GAOG;AACH,wBAAgB,MAAM,CAAC,MAAM,EAAE,YAAY,EAAE,OAAO,GAAE,aAAkB,iDAqCvE;AAED;;mDAEmD;AACnD,MAAM,WAAW,gBACf,SAAQ,IAAI,CAAC,aAAa,EAAE,UAAU,GAAG,SAAS,GAAG,YAAY,CAAC;IAClE,QAAQ,CAAC,UAAU,CAAC,EAAE,MAAM,CAAA;IAC5B,qCAAqC;IACrC,QAAQ,CAAC,MAAM,CAAC,EAAE,MAAM,GAAG,MAAM,EAAE,CAAA;IACnC,wEAAwE;IACxE,QAAQ,CAAC,GAAG,CAAC,EAAE,OAAO,CAAA;IACtB,sDAAsD;IACtD,QAAQ,CAAC,SAAS,CAAC,EAAE,MAAM,CAAA;CAC5B;AAaD;;;;;GAKG;AACH,wBAAsB,UAAU,CAC9B,GAAG,EAAE,OAAO,EACZ,MAAM,EAAE,YAAY,EACpB,OAAO,GAAE,gBAAqB,GAC7B,OAAO,CAAC,OAAO,GAAG,IAAI,CAAC,CAoBzB;AAED;;;;GAIG;AACH,wBAAsB,eAAe,CACnC,GAAG,EAAE,OAAO,EACZ,MAAM,EAAE,YAAY,EACpB,OAAO,GAAE,gBAAqB,GAC7B,OAAO,CAAC,WAAW,CAAC,OAAO,CAAC,MAAM,CAAC,CAAC,CAAC,CAIvC"}

package/dist/index.js

@@ -0,0 +1,253 @@
+/**
+ * Official Auth.js integration for nifra - backend half. Mount the full Auth.js surface
+ * (OAuth/OIDC sign-in, callbacks, session, sign-out, CSRF) into a nifra app, read the session in
+ * handlers and loaders, and guard routes - with Auth.js, not a reimplementation, doing the
+ * security-critical work (PKCE, state, token verification, session cookies).
+ *
+ * ```ts
+ * import { authjs, requireAuthUser } from "@nifrajs/authjs"
+ * import GitHub from "@auth/core/providers/github"
+ *
+ * const auth = {
+ *   providers: [GitHub({ clientId: process.env.GITHUB_ID! })],
+ *   secret: process.env.AUTH_SECRET,
+ *   trustHost: true, // or a canonical origin: AuthJSOptions.authUrl / AUTH_URL
+ * }
+ *
+ * export const app = server()
+ *   .use(authjs(auth))
+ *   .get("/me", async (c) => ({ user: await requireAuthUser(c.req, auth) }))
+ * ```
+ *
+ * Frontend half: `createAuthClient` in `@nifrajs/authjs/client`, plus `<AuthSessionProvider>` /
+ * `useAuthSession()` in `@nifrajs/web-react/auth` (other adapters wrap the agnostic client the
+ * same way `@nifrajs/web-react/i18n` wraps `@nifrajs/i18n`).
+ */
+import { defineIdentityPlugin, isSameOriginPath, status } from "@nifrajs/core/server";
+const HANDLED_METHODS = ["GET", "POST"];
+/** Read a secret from the process environment where one exists (never on edge workers). */
+function readEnvSecret(name) {
+    if (typeof process === "undefined")
+        return undefined;
+    const value = process.env?.[name];
+    return typeof value === "string" && value !== "" ? value : undefined;
+}
+/** Resolve the Auth.js secret: explicit config (a rotation list passes through untouched -
+ * Auth.js itself tries each entry), platform binding, then the process environment. */
+function resolveSecret(env, secretEnv, configured) {
+    if (configured !== undefined)
+        return typeof configured === "string" ? configured : [...configured];
+    const name = secretEnv ?? "AUTH_SECRET";
+    const fromEnv = typeof env === "object" && env !== null ? env[name] : undefined;
+    if (typeof fromEnv === "string" && fromEnv !== "")
+        return fromEnv;
+    return readEnvSecret(name);
+}
+/** Validate the configured public origin once; request headers must never redefine it. */
+function canonicalPublicOrigin(value) {
+    let url;
+    try {
+        url = new URL(value);
+    }
+    catch {
+        throw new Error("[nifra/authjs] authUrl must be an absolute http(s) origin");
+    }
+    if ((url.protocol !== "http:" && url.protocol !== "https:") ||
+        url.username !== "" ||
+        url.password !== "" ||
+        url.pathname !== "/" ||
+        url.search !== "" ||
+        url.hash !== "") {
+        throw new Error("[nifra/authjs] authUrl must be an absolute http(s) origin");
+    }
+    return url.origin;
+}
+/** What Auth.js reads its documented variables from (`AUTH_URL`, `AUTH_TRUST_HOST`, `NODE_ENV`,
+ * `AUTH_<PROVIDER>_ID`, ...): the platform bindings, then the process environment. */
+function authEnv(bindings) {
+    const bound = typeof bindings === "object" && bindings !== null ? bindings : undefined;
+    const processEnv = typeof process === "undefined" ? undefined : process.env;
+    return new Proxy({}, {
+        get: (_target, key) => {
+            if (typeof key !== "string")
+                return undefined;
+            if (bound !== undefined && Object.hasOwn(bound, key))
+                return Reflect.get(bound, key);
+            return processEnv?.[key];
+        },
+    });
+}
+/** The origin of the documented `AUTH_URL` (or `NEXTAUTH_URL`), which may carry a path. */
+function envOrigin(env) {
+    const value = env.AUTH_URL ?? env.NEXTAUTH_URL;
+    if (value === undefined || value === "")
+        return undefined;
+    let url;
+    try {
+        url = new URL(String(value));
+    }
+    catch {
+        throw new Error("[nifra/authjs] AUTH_URL must be an absolute http(s) URL");
+    }
+    if (url.protocol !== "http:" && url.protocol !== "https:") {
+        throw new Error("[nifra/authjs] AUTH_URL must be an absolute http(s) URL");
+    }
+    return url.origin;
+}
+function normalizeBasePath(value) {
+    let base = value ?? "/api/auth";
+    while (base.endsWith("/"))
+        base = base.slice(0, -1);
+    return base === "" ? "/api/auth" : base;
+}
+/**
+ * The config Auth.js runs with - never the caller's object, which `setEnvDefaults` would mutate.
+ * `basePath` is always explicit: core applies no default of its own here, and an unset basePath
+ * answers every action (even `/csrf`) with a flat 400.
+ */
+function activeConfig(config, basePath, secret, origin, env, applyEnvDefaults) {
+    const active = {
+        ...config,
+        basePath,
+        secret: typeof secret === "string" ? secret : [...secret],
+    };
+    // A request is rewritten onto a configured origin, so its Host header names nothing. Without
+    // one, trusting the Host header is Auth.js's own rule: `trustHost`, `AUTH_TRUST_HOST`, or a
+    // `NODE_ENV` other than production.
+    if (origin !== undefined)
+        active.trustHost ??= true;
+    applyEnvDefaults(env, active, true);
+    return active;
+}
+/** Remove proxy routing metadata so Auth.js cannot derive a URL from attacker-controlled headers. */
+function sanitizePublicRequest(req, url, host) {
+    const rewritten = new Request(url, req);
+    rewritten.headers.delete("forwarded");
+    rewritten.headers.delete("x-forwarded-host");
+    rewritten.headers.delete("x-forwarded-proto");
+    rewritten.headers.delete("host");
+    rewritten.headers.set("host", host);
+    return rewritten;
+}
+/** Derive the public request URL: the configured origin, else the request's own, with forwarded
+ * headers trusted only on an explicit opt-in. */
+function publicUrl(req, origin, trustProxy) {
+    const url = new URL(req.url);
+    if (origin !== undefined) {
+        const target = new URL(origin);
+        url.protocol = target.protocol;
+        url.host = target.host;
+        return url;
+    }
+    if (!trustProxy)
+        return url;
+    const proto = req.headers.get("x-forwarded-proto");
+    const host = req.headers.get("x-forwarded-host") ?? req.headers.get("host");
+    if (proto === null && host === null)
+        return url;
+    const forwarded = new URL(req.url);
+    try {
+        if (proto !== null) {
+            const protocol = proto.endsWith(":") ? proto : `${proto}:`;
+            if (protocol !== "http:" && protocol !== "https:")
+                throw new Error("invalid proxy protocol");
+            forwarded.protocol = protocol;
+        }
+        if (host !== null)
+            forwarded.host = host;
+    }
+    catch {
+        return url;
+    }
+    return forwarded;
+}
+/** Rewrite a request onto its public URL, preserving method/headers/body. */
+function publicRequest(req, origin, trustProxy) {
+    const url = publicUrl(req, origin, trustProxy);
+    return sanitizePublicRequest(req, url.href, url.host);
+}
+/**
+ * Mount an Auth.js instance into a nifra app: serves `${basePath}/*` (default `/api/auth/*`) for
+ * `GET` + `POST`, so sign-in, OAuth callbacks, session, sign-out, and CSRF all run on your server
+ * through `@auth/core` itself. A type-IDENTITY plugin (see `defineIdentityPlugin`): mounting never
+ * changes the route registry's type, so the typed client keeps working below the mount.
+ *
+ * Idempotent (named `"authjs"` - applying twice mounts once).
+ */
+export function authjs(config, options = {}) {
+    const base = normalizeBasePath(options.basePath ?? config.basePath);
+    const pattern = `${base}/*`;
+    const publicOrigin = options.authUrl === undefined ? undefined : canonicalPublicOrigin(options.authUrl);
+    return defineIdentityPlugin("authjs", (app) => {
+        for (const method of HANDLED_METHODS) {
+            // `register`'s handler is typed `(context: never) => unknown`; the framework invokes it with
+            // the real Context, so reading `c.req`/`c.env` is sound. Auth.js's Response passes through.
+            app.register(method, pattern, undefined, async (c) => {
+                const secret = resolveSecret(c.env, options.secretEnv, options.secret ?? config.secret);
+                if (secret === undefined) {
+                    return status(500, { ok: false, error: "auth_misconfigured" });
+                }
+                const env = authEnv(c.env);
+                let origin;
+                try {
+                    origin = publicOrigin ?? envOrigin(env);
+                }
+                catch {
+                    return status(500, { ok: false, error: "auth_misconfigured" });
+                }
+                const { Auth, setEnvDefaults } = await import("@auth/core");
+                const active = activeConfig(config, base, secret, origin, env, setEnvDefaults);
+                return Auth(publicRequest(c.req, origin, options.trustProxy === true), active);
+            });
+        }
+        return app;
+    });
+}
+const guardRejection = (options) => {
+    const to = options.redirectTo;
+    if (to === undefined)
+        return status(401, { ok: false, error: "unauthorized" });
+    if (!isSameOriginPath(to)) {
+        throw new Error(`[nifra/authjs] guard redirectTo must be a same-origin path beginning with "/" (got ${JSON.stringify(to)})`);
+    }
+    return status(302, undefined, { headers: { location: to } });
+};
+/**
+ * Resolve the Auth.js session for a request - `null` when unauthenticated. Takes the raw `Request`
+ * so it works in handlers (`c.req`), loaders/actions (`request`), and middleware. Mirrors the
+ * session-callback interception `@hono/auth-js` uses: the full `{ session, user }` flows through
+ * your configured `callbacks.session` first.
+ */
+export async function getSession(req, config, options = {}) {
+    const secret = resolveSecret(options.env, options.secretEnv, options.secret ?? config.secret);
+    if (secret === undefined) {
+        throw new Error("[nifra/authjs] getSession needs config.secret, options.secret, or AUTH_SECRET");
+    }
+    const env = authEnv(options.env);
+    const origin = options.authUrl === undefined ? envOrigin(env) : canonicalPublicOrigin(options.authUrl);
+    const base = normalizeBasePath(options.basePath ?? config.basePath);
+    const { Auth, setEnvDefaults } = await import("@auth/core");
+    const active = activeConfig(config, base, secret, origin, env, setEnvDefaults);
+    // Read where the mount serves it: the public origin's scheme picks the `__Secure-` cookie names.
+    const url = publicUrl(req, origin, options.trustProxy === true);
+    const sessionReq = new Request(`${url.origin}${base}/session`, {
+        headers: { cookie: req.headers.get("cookie") ?? "" },
+    });
+    const response = await Auth(sessionReq, active);
+    if (!response.ok)
+        return null;
+    const session = (await response.json());
+    return session?.user ? session : null;
+}
+/**
+ * Require an authenticated user. Returns `session.user`; otherwise throws a `status(...)` render
+ * (302/401) - control flow, caught by nifra's plain-data lane like `@nifrajs/auth` guards. Call at
+ * the top of a protected handler/loader/action.
+ */
+export async function requireAuthUser(req, config, options = {}) {
+    const session = await getSession(req, config, options);
+    if (session?.user)
+        return session.user;
+    throw guardRejection(options);
+}
+//# sourceMappingURL=index.js.map

package/dist/index.js.map

@@ -0,0 +1 @@
+{"version":3,"file":"index.js","sourceRoot":"","sources":["../src/index.ts"],"names":[],"mappings":"AAAA;;;;;;;;;;;;;;;;;;;;;;;;GAwBG;AAKH,OAAO,EAAE,oBAAoB,EAAE,gBAAgB,EAAE,MAAM,EAAE,MAAM,sBAAsB,CAAA;AA0BrF,MAAM,eAAe,GAAG,CAAC,KAAK,EAAE,MAAM,CAAU,CAAA;AAEhD,2FAA2F;AAC3F,SAAS,aAAa,CAAC,IAAY;IACjC,IAAI,OAAO,OAAO,KAAK,WAAW;QAAE,OAAO,SAAS,CAAA;IACpD,MAAM,KAAK,GAAG,OAAO,CAAC,GAAG,EAAE,CAAC,IAAI,CAAC,CAAA;IACjC,OAAO,OAAO,KAAK,KAAK,QAAQ,IAAI,KAAK,KAAK,EAAE,CAAC,CAAC,CAAC,KAAK,CAAC,CAAC,CAAC,SAAS,CAAA;AACtE,CAAC;AAED;uFACuF;AACvF,SAAS,aAAa,CACpB,GAAY,EACZ,SAA6B,EAC7B,UAAkD;IAElD,IAAI,UAAU,KAAK,SAAS;QAAE,OAAO,OAAO,UAAU,KAAK,QAAQ,CAAC,CAAC,CAAC,UAAU,CAAC,CAAC,CAAC,CAAC,GAAG,UAAU,CAAC,CAAA;IAClG,MAAM,IAAI,GAAG,SAAS,IAAI,aAAa,CAAA;IACvC,MAAM,OAAO,GACX,OAAO,GAAG,KAAK,QAAQ,IAAI,GAAG,KAAK,IAAI,CAAC,CAAC,CAAE,GAA+B,CAAC,IAAI,CAAC,CAAC,CAAC,CAAC,SAAS,CAAA;IAC9F,IAAI,OAAO,OAAO,KAAK,QAAQ,IAAI,OAAO,KAAK,EAAE;QAAE,OAAO,OAAO,CAAA;IACjE,OAAO,aAAa,CAAC,IAAI,CAAC,CAAA;AAC5B,CAAC;AAED,0FAA0F;AAC1F,SAAS,qBAAqB,CAAC,KAAa;IAC1C,IAAI,GAAQ,CAAA;IACZ,IAAI,CAAC;QACH,GAAG,GAAG,IAAI,GAAG,CAAC,KAAK,CAAC,CAAA;IACtB,CAAC;IAAC,MAAM,CAAC;QACP,MAAM,IAAI,KAAK,CAAC,2DAA2D,CAAC,CAAA;IAC9E,CAAC;IACD,IACE,CAAC,GAAG,CAAC,QAAQ,KAAK,OAAO,IAAI,GAAG,CAAC,QAAQ,KAAK,QAAQ,CAAC;QACvD,GAAG,CAAC,QAAQ,KAAK,EAAE;QACnB,GAAG,CAAC,QAAQ,KAAK,EAAE;QACnB,GAAG,CAAC,QAAQ,KAAK,GAAG;QACpB,GAAG,CAAC,MAAM,KAAK,EAAE;QACjB,GAAG,CAAC,IAAI,KAAK,EAAE,EACf,CAAC;QACD,MAAM,IAAI,KAAK,CAAC,2DAA2D,CAAC,CAAA;IAC9E,CAAC;IACD,OAAO,GAAG,CAAC,MAAM,CAAA;AACnB,CAAC;AAED;sFACsF;AACtF,SAAS,OAAO,CAAC,QAAiB;IAChC,MAAM,KAAK,GAAG,OAAO,QAAQ,KAAK,QAAQ,IAAI,QAAQ,KAAK,IAAI,CAAC,CAAC,CAAC,QAAQ,CAAC,CAAC,CAAC,SAAS,CAAA;IACtF,MAAM,UAAU,GAAG,OAAO,OAAO,KAAK,WAAW,CAAC,CAAC,CAAC,SAAS,CAAC,CAAC,CAAC,OAAO,CAAC,GAAG,CAAA;IAC3E,OAAO,IAAI,KAAK,CACd,EAAE,EACF;QACE,GAAG,EAAE,CAAC,OAAO,EAAE,GAAG,EAAE,EAAE;YACpB,IAAI,OAAO,GAAG,KAAK,QAAQ;gBAAE,OAAO,SAAS,CAAA;YAC7C,IAAI,KAAK,KAAK,SAAS,IAAI,MAAM,CAAC,MAAM,CAAC,KAAK,EAAE,GAAG,CAAC;gBAAE,OAAO,OAAO,CAAC,GAAG,CAAC,KAAK,EAAE,GAAG,CAAC,CAAA;YACpF,OAAO,UAAU,EAAE,CAAC,GAAG,CAAC,CAAA;QAC1B,CAAC;KACF,CACF,CAAA;AACH,CAAC;AAED,2FAA2F;AAC3F,SAAS,SAAS,CAAC,GAA4B;IAC7C,MAAM,KAAK,GAAG,GAAG,CAAC,QAAQ,IAAI,GAAG,CAAC,YAAY,CAAA;IAC9C,IAAI,KAAK,KAAK,SAAS,IAAI,KAAK,KAAK,EAAE;QAAE,OAAO,SAAS,CAAA;IACzD,IAAI,GAAQ,CAAA;IACZ,IAAI,CAAC;QACH,GAAG,GAAG,IAAI,GAAG,CAAC,MAAM,CAAC,KAAK,CAAC,CAAC,CAAA;IAC9B,CAAC;IAAC,MAAM,CAAC;QACP,MAAM,IAAI,KAAK,CAAC,yDAAyD,CAAC,CAAA;IAC5E,CAAC;IACD,IAAI,GAAG,CAAC,QAAQ,KAAK,OAAO,IAAI,GAAG,CAAC,QAAQ,KAAK,QAAQ,EAAE,CAAC;QAC1D,MAAM,IAAI,KAAK,CAAC,yDAAyD,CAAC,CAAA;IAC5E,CAAC;IACD,OAAO,GAAG,CAAC,MAAM,CAAA;AACnB,CAAC;AAED,SAAS,iBAAiB,CAAC,KAAyB;IAClD,IAAI,IAAI,GAAG,KAAK,IAAI,WAAW,CAAA;IAC/B,OAAO,IAAI,CAAC,QAAQ,CAAC,GAAG,CAAC;QAAE,IAAI,GAAG,IAAI,CAAC,KAAK,CAAC,CAAC,EAAE,CAAC,CAAC,CAAC,CAAA;IACnD,OAAO,IAAI,KAAK,EAAE,CAAC,CAAC,CAAC,WAAW,CAAC,CAAC,CAAC,IAAI,CAAA;AACzC,CAAC;AAED;;;;GAIG;AACH,SAAS,YAAY,CACnB,MAAoB,EACpB,QAAgB,EAChB,MAAyB,EACzB,MAA0B,EAC1B,GAA4B,EAC5B,gBAAuC;IAEvC,MAAM,MAAM,GAAe;QACzB,GAAG,MAAM;QACT,QAAQ;QACR,MAAM,EAAE,OAAO,MAAM,KAAK,QAAQ,CAAC,CAAC,CAAC,MAAM,CAAC,CAAC,CAAC,CAAC,GAAG,MAAM,CAAC;KAC1D,CAAA;IACD,6FAA6F;IAC7F,4FAA4F;IAC5F,oCAAoC;IACpC,IAAI,MAAM,KAAK,SAAS;QAAE,MAAM,CAAC,SAAS,KAAK,IAAI,CAAA;IACnD,gBAAgB,CAAC,GAAG,EAAE,MAAM,EAAE,IAAI,CAAC,CAAA;IACnC,OAAO,MAAM,CAAA;AACf,CAAC;AAED,qGAAqG;AACrG,SAAS,qBAAqB,CAAC,GAAY,EAAE,GAAW,EAAE,IAAY;IACpE,MAAM,SAAS,GAAG,IAAI,OAAO,CAAC,GAAG,EAAE,GAAG,CAAC,CAAA;IACvC,SAAS,CAAC,OAAO,CAAC,MAAM,CAAC,WAAW,CAAC,CAAA;IACrC,SAAS,CAAC,OAAO,CAAC,MAAM,CAAC,kBAAkB,CAAC,CAAA;IAC5C,SAAS,CAAC,OAAO,CAAC,MAAM,CAAC,mBAAmB,CAAC,CAAA;IAC7C,SAAS,CAAC,OAAO,CAAC,MAAM,CAAC,MAAM,CAAC,CAAA;IAChC,SAAS,CAAC,OAAO,CAAC,GAAG,CAAC,MAAM,EAAE,IAAI,CAAC,CAAA;IACnC,OAAO,SAAS,CAAA;AAClB,CAAC;AAED;iDACiD;AACjD,SAAS,SAAS,CAAC,GAAY,EAAE,MAA0B,EAAE,UAAmB;IAC9E,MAAM,GAAG,GAAG,IAAI,GAAG,CAAC,GAAG,CAAC,GAAG,CAAC,CAAA;IAC5B,IAAI,MAAM,KAAK,SAAS,EAAE,CAAC;QACzB,MAAM,MAAM,GAAG,IAAI,GAAG,CAAC,MAAM,CAAC,CAAA;QAC9B,GAAG,CAAC,QAAQ,GAAG,MAAM,CAAC,QAAQ,CAAA;QAC9B,GAAG,CAAC,IAAI,GAAG,MAAM,CAAC,IAAI,CAAA;QACtB,OAAO,GAAG,CAAA;IACZ,CAAC;IACD,IAAI,CAAC,UAAU;QAAE,OAAO,GAAG,CAAA;IAC3B,MAAM,KAAK,GAAG,GAAG,CAAC,OAAO,CAAC,GAAG,CAAC,mBAAmB,CAAC,CAAA;IAClD,MAAM,IAAI,GAAG,GAAG,CAAC,OAAO,CAAC,GAAG,CAAC,kBAAkB,CAAC,IAAI,GAAG,CAAC,OAAO,CAAC,GAAG,CAAC,MAAM,CAAC,CAAA;IAC3E,IAAI,KAAK,KAAK,IAAI,IAAI,IAAI,KAAK,IAAI;QAAE,OAAO,GAAG,CAAA;IAC/C,MAAM,SAAS,GAAG,IAAI,GAAG,CAAC,GAAG,CAAC,GAAG,CAAC,CAAA;IAClC,IAAI,CAAC;QACH,IAAI,KAAK,KAAK,IAAI,EAAE,CAAC;YACnB,MAAM,QAAQ,GAAG,KAAK,CAAC,QAAQ,CAAC,GAAG,CAAC,CAAC,CAAC,CAAC,KAAK,CAAC,CAAC,CAAC,GAAG,KAAK,GAAG,CAAA;YAC1D,IAAI,QAAQ,KAAK,OAAO,IAAI,QAAQ,KAAK,QAAQ;gBAAE,MAAM,IAAI,KAAK,CAAC,wBAAwB,CAAC,CAAA;YAC5F,SAAS,CAAC,QAAQ,GAAG,QAAQ,CAAA;QAC/B,CAAC;QACD,IAAI,IAAI,KAAK,IAAI;YAAE,SAAS,CAAC,IAAI,GAAG,IAAI,CAAA;IAC1C,CAAC;IAAC,MAAM,CAAC;QACP,OAAO,GAAG,CAAA;IACZ,CAAC;IACD,OAAO,SAAS,CAAA;AAClB,CAAC;AAED,6EAA6E;AAC7E,SAAS,aAAa,CAAC,GAAY,EAAE,MAA0B,EAAE,UAAmB;IAClF,MAAM,GAAG,GAAG,SAAS,CAAC,GAAG,EAAE,MAAM,EAAE,UAAU,CAAC,CAAA;IAC9C,OAAO,qBAAqB,CAAC,GAAG,EAAE,GAAG,CAAC,IAAI,EAAE,GAAG,CAAC,IAAI,CAAC,CAAA;AACvD,CAAC;AAED;;;;;;;GAOG;AACH,MAAM,UAAU,MAAM,CAAC,MAAoB,EAAE,UAAyB,EAAE;IACtE,MAAM,IAAI,GAAG,iBAAiB,CAAC,OAAO,CAAC,QAAQ,IAAI,MAAM,CAAC,QAAQ,CAAC,CAAA;IACnE,MAAM,OAAO,GAAG,GAAG,IAAI,IAAI,CAAA;IAC3B,MAAM,YAAY,GAChB,OAAO,CAAC,OAAO,KAAK,SAAS,CAAC,CAAC,CAAC,SAAS,CAAC,CAAC,CAAC,qBAAqB,CAAC,OAAO,CAAC,OAAO,CAAC,CAAA;IACpF,OAAO,oBAAoB,CAAC,QAAQ,EAAE,CAAsB,GAAM,EAAK,EAAE;QACvE,KAAK,MAAM,MAAM,IAAI,eAAe,EAAE,CAAC;YACrC,6FAA6F;YAC7F,4FAA4F;YAC5F,GAAG,CAAC,QAAQ,CACV,MAAM,EACN,OAAO,EACP,SAAS,EACT,KAAK,EAAE,CAIN,EAAE,EAAE;gBACH,MAAM,MAAM,GAAG,aAAa,CAAC,CAAC,CAAC,GAAG,EAAE,OAAO,CAAC,SAAS,EAAE,OAAO,CAAC,MAAM,IAAI,MAAM,CAAC,MAAM,CAAC,CAAA;gBACvF,IAAI,MAAM,KAAK,SAAS,EAAE,CAAC;oBACzB,OAAO,MAAM,CAAC,GAAG,EAAE,EAAE,EAAE,EAAE,KAAK,EAAE,KAAK,EAAE,oBAAoB,EAAE,CAAC,CAAA;gBAChE,CAAC;gBACD,MAAM,GAAG,GAAG,OAAO,CAAC,CAAC,CAAC,GAAG,CAAC,CAAA;gBAC1B,IAAI,MAA0B,CAAA;gBAC9B,IAAI,CAAC;oBACH,MAAM,GAAG,YAAY,IAAI,SAAS,CAAC,GAAG,CAAC,CAAA;gBACzC,CAAC;gBAAC,MAAM,CAAC;oBACP,OAAO,MAAM,CAAC,GAAG,EAAE,EAAE,EAAE,EAAE,KAAK,EAAE,KAAK,EAAE,oBAAoB,EAAE,CAAC,CAAA;gBAChE,CAAC;gBACD,MAAM,EAAE,IAAI,EAAE,cAAc,EAAE,GAAG,MAAM,MAAM,CAAC,YAAY,CAAC,CAAA;gBAC3D,MAAM,MAAM,GAAG,YAAY,CAAC,MAAM,EAAE,IAAI,EAAE,MAAM,EAAE,MAAM,EAAE,GAAG,EAAE,cAAc,CAAC,CAAA;gBAC9E,OAAO,IAAI,CAAC,aAAa,CAAC,CAAC,CAAC,GAAG,EAAE,MAAM,EAAE,OAAO,CAAC,UAAU,KAAK,IAAI,CAAC,EAAE,MAAM,CAAC,CAAA;YAChF,CAAC,CACF,CAAA;QACH,CAAC;QACD,OAAO,GAAG,CAAA;IACZ,CAAC,CAAC,CAAA;AACJ,CAAC;AAgBD,MAAM,cAAc,GAAG,CAAC,OAAyB,EAAkB,EAAE;IACnE,MAAM,EAAE,GAAG,OAAO,CAAC,UAAU,CAAA;IAC7B,IAAI,EAAE,KAAK,SAAS;QAAE,OAAO,MAAM,CAAC,GAAG,EAAE,EAAE,EAAE,EAAE,KAAK,EAAE,KAAK,EAAE,cAAc,EAAE,CAAC,CAAA;IAC9E,IAAI,CAAC,gBAAgB,CAAC,EAAE,CAAC,EAAE,CAAC;QAC1B,MAAM,IAAI,KAAK,CACb,sFAAsF,IAAI,CAAC,SAAS,CAAC,EAAE,CAAC,GAAG,CAC5G,CAAA;IACH,CAAC;IACD,OAAO,MAAM,CAAC,GAAG,EAAE,SAAS,EAAE,EAAE,OAAO,EAAE,EAAE,QAAQ,EAAE,EAAE,EAAE,EAAE,CAAC,CAAA;AAC9D,CAAC,CAAA;AAED;;;;;GAKG;AACH,MAAM,CAAC,KAAK,UAAU,UAAU,CAC9B,GAAY,EACZ,MAAoB,EACpB,UAA4B,EAAE;IAE9B,MAAM,MAAM,GAAG,aAAa,CAAC,OAAO,CAAC,GAAG,EAAE,OAAO,CAAC,SAAS,EAAE,OAAO,CAAC,MAAM,IAAI,MAAM,CAAC,MAAM,CAAC,CAAA;IAC7F,IAAI,MAAM,KAAK,SAAS,EAAE,CAAC;QACzB,MAAM,IAAI,KAAK,CAAC,+EAA+E,CAAC,CAAA;IAClG,CAAC;IACD,MAAM,GAAG,GAAG,OAAO,CAAC,OAAO,CAAC,GAAG,CAAC,CAAA;IAChC,MAAM,MAAM,GACV,OAAO,CAAC,OAAO,KAAK,SAAS,CAAC,CAAC,CAAC,SAAS,CAAC,GAAG,CAAC,CAAC,CAAC,CAAC,qBAAqB,CAAC,OAAO,CAAC,OAAO,CAAC,CAAA;IACzF,MAAM,IAAI,GAAG,iBAAiB,CAAC,OAAO,CAAC,QAAQ,IAAI,MAAM,CAAC,QAAQ,CAAC,CAAA;IACnE,MAAM,EAAE,IAAI,EAAE,cAAc,EAAE,GAAG,MAAM,MAAM,CAAC,YAAY,CAAC,CAAA;IAC3D,MAAM,MAAM,GAAG,YAAY,CAAC,MAAM,EAAE,IAAI,EAAE,MAAM,EAAE,MAAM,EAAE,GAAG,EAAE,cAAc,CAAC,CAAA;IAC9E,iGAAiG;IACjG,MAAM,GAAG,GAAG,SAAS,CAAC,GAAG,EAAE,MAAM,EAAE,OAAO,CAAC,UAAU,KAAK,IAAI,CAAC,CAAA;IAC/D,MAAM,UAAU,GAAG,IAAI,OAAO,CAAC,GAAG,GAAG,CAAC,MAAM,GAAG,IAAI,UAAU,EAAE;QAC7D,OAAO,EAAE,EAAE,MAAM,EAAE,GAAG,CAAC,OAAO,CAAC,GAAG,CAAC,QAAQ,CAAC,IAAI,EAAE,EAAE;KACrD,CAAC,CAAA;IACF,MAAM,QAAQ,GAAG,MAAM,IAAI,CAAC,UAAU,EAAE,MAAM,CAAC,CAAA;IAC/C,IAAI,CAAC,QAAQ,CAAC,EAAE;QAAE,OAAO,IAAI,CAAA;IAC7B,MAAM,OAAO,GAAG,CAAC,MAAM,QAAQ,CAAC,IAAI,EAAE,CAAmB,CAAA;IACzD,OAAO,OAAO,EAAE,IAAI,CAAC,CAAC,CAAC,OAAO,CAAC,CAAC,CAAC,IAAI,CAAA;AACvC,CAAC;AAED;;;;GAIG;AACH,MAAM,CAAC,KAAK,UAAU,eAAe,CACnC,GAAY,EACZ,MAAoB,EACpB,UAA4B,EAAE;IAE9B,MAAM,OAAO,GAAG,MAAM,UAAU,CAAC,GAAG,EAAE,MAAM,EAAE,OAAO,CAAC,CAAA;IACtD,IAAI,OAAO,EAAE,IAAI;QAAE,OAAO,OAAO,CAAC,IAAI,CAAA;IACtC,MAAM,cAAc,CAAC,OAAO,CAAC,CAAA;AAC/B,CAAC"}

package/package.json

@@ -1 +1,64 @@
-{"name":"@nifrajs/authjs","version":"0.0.0-bootstrap.0","description":"Placeholder; the real package publishes from github.com/nifrajs/nifra","license":"MIT","repository":{"type":"git","url":"git+https://github.com/nifrajs/nifra.git","directory":"packages/authjs"}}
+{
+  "name": "@nifrajs/authjs",
+  "version": "4.0.0",
+  "description": "Official Auth.js integration for nifra - mount Auth.js (OAuth, OIDC, credentials, WebAuthn-ready) into a nifra app, read sessions in handlers and loaders, guard routes, and drive it all from any frontend.",
+  "keywords": [
+    "bun",
+    "typescript",
+    "nifra",
+    "auth",
+    "authjs",
+    "oauth",
+    "oidc",
+    "session"
+  ],
+  "type": "module",
+  "nifra": {
+    "environment": "library"
+  },
+  "main": "./dist/index.js",
+  "module": "./dist/index.js",
+  "types": "./dist/index.d.ts",
+  "exports": {
+    ".": {
+      "bun": "./src/index.ts",
+      "types": "./dist/index.d.ts",
+      "default": "./dist/index.js"
+    },
+    "./client": {
+      "bun": "./src/client.ts",
+      "types": "./dist/client.d.ts",
+      "default": "./dist/client.js"
+    }
+  },
+  "files": [
+    "dist",
+    "src"
+  ],
+  "sideEffects": false,
+  "scripts": {
+    "build": "tsc -p tsconfig.build.json && bun run ../../scripts/fix-dts.ts dist"
+  },
+  "license": "MIT",
+  "publishConfig": {
+    "access": "public"
+  },
+  "dependencies": {
+    "@auth/core": "^0.41.3"
+  },
+  "peerDependencies": {
+    "@nifrajs/core": "^4.0.0"
+  },
+  "devDependencies": {
+    "@nifrajs/core": "workspace:*"
+  },
+  "repository": {
+    "type": "git",
+    "url": "git+https://github.com/nifrajs/nifra.git",
+    "directory": "packages/authjs"
+  },
+  "bugs": {
+    "url": "https://github.com/nifrajs/nifra/issues"
+  },
+  "homepage": "https://github.com/nifrajs/nifra#readme"
+}

package/src/client.ts

@@ -0,0 +1,169 @@
+/**
+ * Framework-agnostic Auth.js client - `fetch` against the mounted Auth.js endpoints, no DOM
+ * framework involved. Every UI adapter builds on this: pass it a base path (default
+ * `/api/auth`, matching the backend mount default) and an optional `fetch` override for tests
+ * or loaders that must forward headers.
+ *
+ * ```ts
+ * import { createAuthClient } from "@nifrajs/authjs/client"
+ *
+ * const auth = createAuthClient()
+ * await auth.signIn("github") // posts sign-in, then navigates to the provider (browser only)
+ * await auth.signOut() // posts signout, then navigates home
+ * const session = await auth.getSession() // works anywhere fetch does
+ * ```
+ */
+import type { Session } from "@auth/core/types"
+
+export type { Session } from "@auth/core/types"
+
+export interface AuthClientOptions {
+  /** Auth.js mount path. Default `"/api/auth"`. */
+  readonly basePath?: string
+  /** `fetch` implementation. Default global `fetch` - override in tests or to forward headers. */
+  readonly fetch?: typeof fetch
+}
+
+export interface SignInOptions {
+  /** Where the provider returns afterwards. Default the current page. */
+  readonly callbackUrl?: string
+}
+
+export interface SignOutOptions {
+  /** Where to land after sign-out. Default `"/"`. Set `redirect: false` to stay put. */
+  readonly callbackUrl?: string
+  readonly redirect?: boolean
+}
+
+/**
+ * Build `/api/auth/signin/:provider?callbackUrl=…` without touching `window` (testable).
+ *
+ * @deprecated Auth.js v5 accepts only a CSRF-carrying POST at this path and answers a GET - a link
+ * or a navigation here - with an error. Call `signIn()`, which submits that POST.
+ */
+export function signInUrl(
+  providerId: string,
+  options: { readonly basePath?: string; readonly callbackUrl: string },
+): string {
+  const base = options.basePath ?? "/api/auth"
+  return `${base}/signin/${encodeURIComponent(providerId)}?callbackUrl=${encodeURIComponent(options.callbackUrl)}`
+}
+
+const currentUrl = (): string => {
+  if (typeof window === "undefined" || typeof window.location?.href !== "string") {
+    throw new Error("[nifra/authjs] signIn needs a browser page (no window.location.href)")
+  }
+  return window.location.href
+}
+
+function isSafeRelativePath(value: string): boolean {
+  if (!value.startsWith("/") || value.startsWith("//")) return false
+  for (let i = 1; i < value.length; i++) {
+    const code = value.charCodeAt(i)
+    if (code <= 0x1f || code === 0x7f || code === 0x5c) return false
+  }
+  return true
+}
+
+/** Where Auth.js sent a sign-in: the provider's authorization page, usually on another origin. It
+ * came from the auth endpoint, not the caller, so only a non-web scheme (`javascript:`) is refused. */
+function providerNavigationTarget(value: string): string {
+  try {
+    const target = new URL(value, window.location.href)
+    if (target.protocol === "http:" || target.protocol === "https:") return target.href
+  } catch {
+    // An unparseable answer falls back to the home path, as an unsafe callback does.
+  }
+  return "/"
+}
+
+/** Keep post-auth navigation on this origin; an unsafe callback is never an external redirect. */
+function safeNavigationTarget(value: string): string {
+  if (isSafeRelativePath(value)) return value
+  if (typeof window !== "undefined" && typeof window.location?.href === "string") {
+    try {
+      const target = new URL(value, window.location.href)
+      if (
+        (target.protocol === "http:" || target.protocol === "https:") &&
+        target.origin === window.location.origin
+      ) {
+        return target.href
+      }
+    } catch {
+      // Invalid callback URLs fall back to the home path rather than becoming a navigation sink.
+    }
+  }
+  return "/"
+}
+
+const navigate = (url: string, target: (url: string) => string = safeNavigationTarget): void => {
+  if (typeof window === "undefined" || typeof window.location?.assign !== "function") {
+    throw new Error("[nifra/authjs] navigation needs a browser page")
+  }
+  window.location.assign(target(url))
+}
+
+export interface AuthClient {
+  /** The Auth.js session, or `null` when unauthenticated. Usable anywhere `fetch` runs. */
+  getSession(init?: RequestInit): Promise<Session | null>
+  /** Start an OAuth/OIDC sign-in (browser only): posts the CSRF-protected sign-in to Auth.js, then
+   * navigates to the provider page it answers with. */
+  signIn(providerId: string, options?: SignInOptions): Promise<void>
+  /** Sign out via the CSRF-protected endpoint, then navigate (unless `redirect: false`). */
+  signOut(options?: SignOutOptions): Promise<void>
+}
+
+/** Create the client. Stateless - every call hits the endpoints, so servers stay authoritative. */
+export function createAuthClient(options: AuthClientOptions = {}): AuthClient {
+  const base = options.basePath ?? "/api/auth"
+  const impl = options.fetch ?? fetch
+  const csrfToken = async (action: string): Promise<string> => {
+    const csrf = (await (await impl(`${base}/csrf`)).json()) as { csrfToken?: unknown }
+    if (typeof csrf.csrfToken !== "string" || csrf.csrfToken === "") {
+      throw new Error(`[nifra/authjs] ${action}: CSRF token endpoint did not answer`)
+    }
+    return csrf.csrfToken
+  }
+  return {
+    async getSession(init?: RequestInit): Promise<Session | null> {
+      const response = await impl(`${base}/session`, init)
+      if (!response.ok) return null
+      const session = (await response.json()) as Session | null
+      return session?.user ? session : null
+    },
+    async signIn(providerId: string, signInOptions: SignInOptions = {}): Promise<void> {
+      const callbackUrl = signInOptions.callbackUrl ?? currentUrl()
+      const token = await csrfToken("signIn")
+      // `X-Auth-Return-Redirect` makes Auth.js answer `{ url }` instead of a 302 that `fetch` would
+      // follow on its own, so the browser navigates to the provider itself.
+      const response = await impl(`${base}/signin/${encodeURIComponent(providerId)}`, {
+        method: "POST",
+        headers: {
+          "content-type": "application/x-www-form-urlencoded",
+          "x-auth-return-redirect": "1",
+        },
+        body: new URLSearchParams({ csrfToken: token, callbackUrl }),
+      })
+      const answer: unknown = response.ok ? await response.json().catch(() => null) : null
+      const url =
+        typeof answer === "object" && answer !== null ? Reflect.get(answer, "url") : undefined
+      if (typeof url !== "string" || url === "") {
+        throw new Error(`[nifra/authjs] signIn failed (HTTP ${response.status})`)
+      }
+      navigate(url, providerNavigationTarget)
+    },
+    async signOut(signOutOptions: SignOutOptions = {}): Promise<void> {
+      const token = await csrfToken("signOut")
+      const callbackUrl = signOutOptions.callbackUrl ?? "/"
+      const response = await impl(`${base}/signout`, {
+        method: "POST",
+        headers: { "content-type": "application/x-www-form-urlencoded" },
+        body: new URLSearchParams({ csrfToken: token, callbackUrl }),
+      })
+      if (!response.ok) {
+        throw new Error(`[nifra/authjs] signOut failed (HTTP ${response.status})`)
+      }
+      if (signOutOptions.redirect !== false) navigate(callbackUrl)
+    },
+  }
+}

package/src/index.ts

@@ -0,0 +1,328 @@
+/**
+ * Official Auth.js integration for nifra - backend half. Mount the full Auth.js surface
+ * (OAuth/OIDC sign-in, callbacks, session, sign-out, CSRF) into a nifra app, read the session in
+ * handlers and loaders, and guard routes - with Auth.js, not a reimplementation, doing the
+ * security-critical work (PKCE, state, token verification, session cookies).
+ *
+ * ```ts
+ * import { authjs, requireAuthUser } from "@nifrajs/authjs"
+ * import GitHub from "@auth/core/providers/github"
+ *
+ * const auth = {
+ *   providers: [GitHub({ clientId: process.env.GITHUB_ID! })],
+ *   secret: process.env.AUTH_SECRET,
+ *   trustHost: true, // or a canonical origin: AuthJSOptions.authUrl / AUTH_URL
+ * }
+ *
+ * export const app = server()
+ *   .use(authjs(auth))
+ *   .get("/me", async (c) => ({ user: await requireAuthUser(c.req, auth) }))
+ * ```
+ *
+ * Frontend half: `createAuthClient` in `@nifrajs/authjs/client`, plus `<AuthSessionProvider>` /
+ * `useAuthSession()` in `@nifrajs/web-react/auth` (other adapters wrap the agnostic client the
+ * same way `@nifrajs/web-react/i18n` wraps `@nifrajs/i18n`).
+ */
+
+import type { AuthConfig, setEnvDefaults } from "@auth/core"
+import type { Session } from "@auth/core/types"
+import type { AnyServer, Platform, ResponseResult } from "@nifrajs/core/server"
+import { defineIdentityPlugin, isSameOriginPath, status } from "@nifrajs/core/server"
+
+export type { Session } from "@auth/core/types"
+
+/** The Auth.js config this integration drives - everything `@auth/core` accepts except `raw`. */
+export type AuthJSConfig = Omit<AuthConfig, "raw">
+
+export interface AuthJSOptions {
+  /** Mount path for Auth.js routes. Defaults to `config.basePath`, then `"/api/auth"`. */
+  readonly basePath?: string
+  /** Public origin (e.g. `"https://app.example.com"`); falls back to the `AUTH_URL` variable.
+   * Every request is rewritten onto it, so Auth.js trusts it and neither the Host header nor
+   * forwarded headers can replace it. Without one, Auth.js trusts the Host header only when
+   * `trustHost` (or `AUTH_TRUST_HOST`) says so, or outside production. */
+  readonly authUrl?: string
+  /** Trust proxy-provided `x-forwarded-*` headers when `authUrl` is absent. Default `false`.
+   * Enable only when the deployment strips and replaces those headers at a trusted proxy. */
+  readonly trustProxy?: boolean
+  /** Session secret. Falls back to the `secretEnv` platform binding, then `process.env`. Missing
+   * everywhere fails loud (500) on first use - Auth.js cannot sign cookies without it. */
+  readonly secret?: string
+  /** Platform-binding name carrying the secret on edge runtimes (no `process.env` there).
+   * Default `"AUTH_SECRET"`. */
+  readonly secretEnv?: string
+}
+
+const HANDLED_METHODS = ["GET", "POST"] as const
+
+/** Read a secret from the process environment where one exists (never on edge workers). */
+function readEnvSecret(name: string): string | undefined {
+  if (typeof process === "undefined") return undefined
+  const value = process.env?.[name]
+  return typeof value === "string" && value !== "" ? value : undefined
+}
+
+/** Resolve the Auth.js secret: explicit config (a rotation list passes through untouched -
+ * Auth.js itself tries each entry), platform binding, then the process environment. */
+function resolveSecret(
+  env: unknown,
+  secretEnv: string | undefined,
+  configured: string | readonly string[] | undefined,
+): string | string[] | undefined {
+  if (configured !== undefined) return typeof configured === "string" ? configured : [...configured]
+  const name = secretEnv ?? "AUTH_SECRET"
+  const fromEnv =
+    typeof env === "object" && env !== null ? (env as Record<string, unknown>)[name] : undefined
+  if (typeof fromEnv === "string" && fromEnv !== "") return fromEnv
+  return readEnvSecret(name)
+}
+
+/** Validate the configured public origin once; request headers must never redefine it. */
+function canonicalPublicOrigin(value: string): string {
+  let url: URL
+  try {
+    url = new URL(value)
+  } catch {
+    throw new Error("[nifra/authjs] authUrl must be an absolute http(s) origin")
+  }
+  if (
+    (url.protocol !== "http:" && url.protocol !== "https:") ||
+    url.username !== "" ||
+    url.password !== "" ||
+    url.pathname !== "/" ||
+    url.search !== "" ||
+    url.hash !== ""
+  ) {
+    throw new Error("[nifra/authjs] authUrl must be an absolute http(s) origin")
+  }
+  return url.origin
+}
+
+/** What Auth.js reads its documented variables from (`AUTH_URL`, `AUTH_TRUST_HOST`, `NODE_ENV`,
+ * `AUTH_<PROVIDER>_ID`, ...): the platform bindings, then the process environment. */
+function authEnv(bindings: unknown): Record<string, unknown> {
+  const bound = typeof bindings === "object" && bindings !== null ? bindings : undefined
+  const processEnv = typeof process === "undefined" ? undefined : process.env
+  return new Proxy(
+    {},
+    {
+      get: (_target, key) => {
+        if (typeof key !== "string") return undefined
+        if (bound !== undefined && Object.hasOwn(bound, key)) return Reflect.get(bound, key)
+        return processEnv?.[key]
+      },
+    },
+  )
+}
+
+/** The origin of the documented `AUTH_URL` (or `NEXTAUTH_URL`), which may carry a path. */
+function envOrigin(env: Record<string, unknown>): string | undefined {
+  const value = env.AUTH_URL ?? env.NEXTAUTH_URL
+  if (value === undefined || value === "") return undefined
+  let url: URL
+  try {
+    url = new URL(String(value))
+  } catch {
+    throw new Error("[nifra/authjs] AUTH_URL must be an absolute http(s) URL")
+  }
+  if (url.protocol !== "http:" && url.protocol !== "https:") {
+    throw new Error("[nifra/authjs] AUTH_URL must be an absolute http(s) URL")
+  }
+  return url.origin
+}
+
+function normalizeBasePath(value: string | undefined): string {
+  let base = value ?? "/api/auth"
+  while (base.endsWith("/")) base = base.slice(0, -1)
+  return base === "" ? "/api/auth" : base
+}
+
+/**
+ * The config Auth.js runs with - never the caller's object, which `setEnvDefaults` would mutate.
+ * `basePath` is always explicit: core applies no default of its own here, and an unset basePath
+ * answers every action (even `/csrf`) with a flat 400.
+ */
+function activeConfig(
+  config: AuthJSConfig,
+  basePath: string,
+  secret: string | string[],
+  origin: string | undefined,
+  env: Record<string, unknown>,
+  applyEnvDefaults: typeof setEnvDefaults,
+): AuthConfig {
+  const active: AuthConfig = {
+    ...config,
+    basePath,
+    secret: typeof secret === "string" ? secret : [...secret],
+  }
+  // A request is rewritten onto a configured origin, so its Host header names nothing. Without
+  // one, trusting the Host header is Auth.js's own rule: `trustHost`, `AUTH_TRUST_HOST`, or a
+  // `NODE_ENV` other than production.
+  if (origin !== undefined) active.trustHost ??= true
+  applyEnvDefaults(env, active, true)
+  return active
+}
+
+/** Remove proxy routing metadata so Auth.js cannot derive a URL from attacker-controlled headers. */
+function sanitizePublicRequest(req: Request, url: string, host: string): Request {
+  const rewritten = new Request(url, req)
+  rewritten.headers.delete("forwarded")
+  rewritten.headers.delete("x-forwarded-host")
+  rewritten.headers.delete("x-forwarded-proto")
+  rewritten.headers.delete("host")
+  rewritten.headers.set("host", host)
+  return rewritten
+}
+
+/** Derive the public request URL: the configured origin, else the request's own, with forwarded
+ * headers trusted only on an explicit opt-in. */
+function publicUrl(req: Request, origin: string | undefined, trustProxy: boolean): URL {
+  const url = new URL(req.url)
+  if (origin !== undefined) {
+    const target = new URL(origin)
+    url.protocol = target.protocol
+    url.host = target.host
+    return url
+  }
+  if (!trustProxy) return url
+  const proto = req.headers.get("x-forwarded-proto")
+  const host = req.headers.get("x-forwarded-host") ?? req.headers.get("host")
+  if (proto === null && host === null) return url
+  const forwarded = new URL(req.url)
+  try {
+    if (proto !== null) {
+      const protocol = proto.endsWith(":") ? proto : `${proto}:`
+      if (protocol !== "http:" && protocol !== "https:") throw new Error("invalid proxy protocol")
+      forwarded.protocol = protocol
+    }
+    if (host !== null) forwarded.host = host
+  } catch {
+    return url
+  }
+  return forwarded
+}
+
+/** Rewrite a request onto its public URL, preserving method/headers/body. */
+function publicRequest(req: Request, origin: string | undefined, trustProxy: boolean): Request {
+  const url = publicUrl(req, origin, trustProxy)
+  return sanitizePublicRequest(req, url.href, url.host)
+}
+
+/**
+ * Mount an Auth.js instance into a nifra app: serves `${basePath}/*` (default `/api/auth/*`) for
+ * `GET` + `POST`, so sign-in, OAuth callbacks, session, sign-out, and CSRF all run on your server
+ * through `@auth/core` itself. A type-IDENTITY plugin (see `defineIdentityPlugin`): mounting never
+ * changes the route registry's type, so the typed client keeps working below the mount.
+ *
+ * Idempotent (named `"authjs"` - applying twice mounts once).
+ */
+export function authjs(config: AuthJSConfig, options: AuthJSOptions = {}) {
+  const base = normalizeBasePath(options.basePath ?? config.basePath)
+  const pattern = `${base}/*`
+  const publicOrigin =
+    options.authUrl === undefined ? undefined : canonicalPublicOrigin(options.authUrl)
+  return defineIdentityPlugin("authjs", <S extends AnyServer>(app: S): S => {
+    for (const method of HANDLED_METHODS) {
+      // `register`'s handler is typed `(context: never) => unknown`; the framework invokes it with
+      // the real Context, so reading `c.req`/`c.env` is sound. Auth.js's Response passes through.
+      app.register(
+        method,
+        pattern,
+        undefined,
+        async (c: {
+          readonly req: Request
+          readonly env: unknown
+          readonly platform?: Platform
+        }) => {
+          const secret = resolveSecret(c.env, options.secretEnv, options.secret ?? config.secret)
+          if (secret === undefined) {
+            return status(500, { ok: false, error: "auth_misconfigured" })
+          }
+          const env = authEnv(c.env)
+          let origin: string | undefined
+          try {
+            origin = publicOrigin ?? envOrigin(env)
+          } catch {
+            return status(500, { ok: false, error: "auth_misconfigured" })
+          }
+          const { Auth, setEnvDefaults } = await import("@auth/core")
+          const active = activeConfig(config, base, secret, origin, env, setEnvDefaults)
+          return Auth(publicRequest(c.req, origin, options.trustProxy === true), active)
+        },
+      )
+    }
+    return app
+  })
+}
+
+/** What a guard does when the check fails: 302 to `redirectTo` (same-origin path), else 401 JSON.
+ * Pass the `basePath`, `authUrl` and `trustProxy` the mount was given, so the session is read on
+ * the origin and path the mount serves it from. */
+export interface AuthGuardOptions
+  extends Pick<AuthJSOptions, "basePath" | "authUrl" | "trustProxy"> {
+  readonly redirectTo?: string
+  /** Secret override for this call. */
+  readonly secret?: string | string[]
+  /** Platform binding object used when `config.secret` is not present. */
+  readonly env?: unknown
+  /** Secret key in `env`; defaults to `AUTH_SECRET`. */
+  readonly secretEnv?: string
+}
+
+const guardRejection = (options: AuthGuardOptions): ResponseResult => {
+  const to = options.redirectTo
+  if (to === undefined) return status(401, { ok: false, error: "unauthorized" })
+  if (!isSameOriginPath(to)) {
+    throw new Error(
+      `[nifra/authjs] guard redirectTo must be a same-origin path beginning with "/" (got ${JSON.stringify(to)})`,
+    )
+  }
+  return status(302, undefined, { headers: { location: to } })
+}
+
+/**
+ * Resolve the Auth.js session for a request - `null` when unauthenticated. Takes the raw `Request`
+ * so it works in handlers (`c.req`), loaders/actions (`request`), and middleware. Mirrors the
+ * session-callback interception `@hono/auth-js` uses: the full `{ session, user }` flows through
+ * your configured `callbacks.session` first.
+ */
+export async function getSession(
+  req: Request,
+  config: AuthJSConfig,
+  options: AuthGuardOptions = {},
+): Promise<Session | null> {
+  const secret = resolveSecret(options.env, options.secretEnv, options.secret ?? config.secret)
+  if (secret === undefined) {
+    throw new Error("[nifra/authjs] getSession needs config.secret, options.secret, or AUTH_SECRET")
+  }
+  const env = authEnv(options.env)
+  const origin =
+    options.authUrl === undefined ? envOrigin(env) : canonicalPublicOrigin(options.authUrl)
+  const base = normalizeBasePath(options.basePath ?? config.basePath)
+  const { Auth, setEnvDefaults } = await import("@auth/core")
+  const active = activeConfig(config, base, secret, origin, env, setEnvDefaults)
+  // Read where the mount serves it: the public origin's scheme picks the `__Secure-` cookie names.
+  const url = publicUrl(req, origin, options.trustProxy === true)
+  const sessionReq = new Request(`${url.origin}${base}/session`, {
+    headers: { cookie: req.headers.get("cookie") ?? "" },
+  })
+  const response = await Auth(sessionReq, active)
+  if (!response.ok) return null
+  const session = (await response.json()) as Session | null
+  return session?.user ? session : null
+}
+
+/**
+ * Require an authenticated user. Returns `session.user`; otherwise throws a `status(...)` render
+ * (302/401) - control flow, caught by nifra's plain-data lane like `@nifrajs/auth` guards. Call at
+ * the top of a protected handler/loader/action.
+ */
+export async function requireAuthUser(
+  req: Request,
+  config: AuthJSConfig,
+  options: AuthGuardOptions = {},
+): Promise<NonNullable<Session["user"]>> {
+  const session = await getSession(req, config, options)
+  if (session?.user) return session.user
+  throw guardRejection(options)
+}