@nihplod/sso-sdk 1.0.0

package/dist/next/index.js.map

@@ -0,0 +1 @@
+{"version":3,"sources":["../../src/next/index.ts","../../src/next/middleware.ts","../../src/next/constants.ts","../../src/next/callback.ts","../../src/next/logout.ts"],"sourcesContent":["/**\n * @nihplod/sso-sdk/next\n *\n * Next.js App Router 绑定：\n * - createSsoMiddleware: Next.js Middleware 辅助函数\n * - createCallbackRouteHandler: App Router 回调 Route Handler\n * - createLogoutRouteHandler: App Router 登出 Route Handler\n */\n\nexport { createSsoMiddleware } from \"./middleware\";\nexport type { SsoMiddlewareConfig } from \"./middleware\";\n\nexport { createCallbackRouteHandler } from \"./callback\";\nexport type { CallbackRouteConfig } from \"./callback\";\n\nexport { createLogoutRouteHandler } from \"./logout\";\nexport type { LogoutRouteConfig } from \"./logout\";\n\nexport {\n  DEFAULT_ACCESS_TOKEN_COOKIE_NAME,\n  DEFAULT_REFRESH_TOKEN_COOKIE_NAME,\n  DEFAULT_STATE_COOKIE_NAME,\n  DEFAULT_RETURN_COOKIE_NAME,\n  DEFAULT_VERIFIER_COOKIE_NAME,\n  getHostCookieOptions,\n  getSecureCookieOptions,\n} from \"./constants\";\n","/**\r\n * Next.js Middleware 辅助函数\r\n *\r\n * 在 Edge Runtime 中运行，自动检测未认证请求并重定向到 SSO 登录页。\r\n *\r\n * ⚠️ Edge Runtime 限制：\r\n * - 不能使用 Node.js crypto 模块\r\n * - PKCE code_challenge 使用 Web Crypto API 的 crypto.subtle.digest(SHA-256)\r\n *   （Edge Runtime 18+ 完全支持此 API）\r\n *\r\n * 用法 (src/middleware.ts):\r\n * ```ts\r\n * import { createSsoMiddleware } from \"@nihplod/sso-sdk/next\";\r\n *\r\n * export const middleware = createSsoMiddleware({\r\n *   clientId: \"my-app\",\r\n *   ssoBaseUrl: \"https://nihplod.cn\",\r\n *   redirectUri: \"https://myapp.com/api/auth/callback\",\r\n *   publicPaths: [\"/\", \"/public\", \"/api/public\"],\r\n * });\r\n * ```\r\n */\r\n\r\nimport { NextRequest, NextResponse } from \"next/server\";\r\nimport {\r\n  DEFAULT_ACCESS_TOKEN_COOKIE_NAME,\r\n  DEFAULT_STATE_COOKIE_NAME,\r\n  DEFAULT_RETURN_COOKIE_NAME,\r\n  DEFAULT_VERIFIER_COOKIE_NAME,\r\n  getHostCookieOptions,\r\n  getSecureCookieOptions,\r\n} from \"./constants\";\r\n\r\n// ============================================\r\n// 类型定义\r\n// ============================================\r\n\r\nexport interface SsoMiddlewareConfig {\r\n  /** OAuth Client ID */\r\n  clientId: string;\r\n\r\n  /** SSO 中心地址 */\r\n  ssoBaseUrl: string;\r\n\r\n  /** 回调 URL（须与注册的 redirect_uri 一致） */\r\n  redirectUri: string;\r\n\r\n  /** 请求的 scope（空格分隔），默认 \"openid profile\" */\r\n  scopes?: string;\r\n\r\n  /** 公开路由前缀（不需要认证） */\r\n  publicPaths?: string[];\r\n\r\n  /** 回调路径（不触发重定向），默认 \"/api/auth/callback\" */\r\n  callbackPath?: string;\r\n\r\n  /**\r\n   * 主站用户会话 Cookie 名称，用于检测是否已有 SSO 会话。\r\n   * 默认 \"__Host-user_token\"（与主站 C 端登录 Cookie 一致）。\r\n   */\r\n  ssoCookieName?: string;\r\n\r\n  /**\r\n   * OAuth Client Secret（Confidential Client 使用）\r\n   * 浏览器端 Public Client 应省略。\r\n   */\r\n  clientSecret?: string;\r\n\r\n  /** Access Token Cookie 名称，默认 __Host-nihplod_sso_at */\r\n  accessTokenCookieName?: string;\r\n\r\n  /** State Cookie 名称，默认 __Host-nihplod_sso_state */\r\n  stateCookieName?: string;\r\n\r\n  /** Return URL Cookie 名称，默认 __Host-nihplod_sso_return */\r\n  returnUrlCookieName?: string;\r\n\r\n  /** PKCE Verifier Cookie 名称，默认 __Secure-nihplod_sso_verifier */\r\n  verifierCookieName?: string;\r\n}\r\n\r\n// ============================================\r\n// 工具函数\r\n// ============================================\r\n\r\n/**\r\n * 生成安全随机字符串（Edge Runtime 兼容）\r\n * 使用 crypto.getRandomValues（Edge Runtime 支持）\r\n * 拒绝采样法保证 charset 均匀分布\r\n */\r\nfunction generateRandomString(length: number): string {\r\n  const chars =\r\n    \"ABCDEFGHIJKLMNOPQRSTUVWXYZabcdefghijklmnopqrstuvwxyz0123456789-._~\";\r\n  const maxValid = Math.floor(256 / chars.length) * chars.length;\r\n  let result = \"\";\r\n\r\n  while (result.length < length) {\r\n    const array = new Uint8Array(length * 2);\r\n    crypto.getRandomValues(array);\r\n    for (let i = 0; i < array.length && result.length < length; i++) {\r\n      if (array[i] >= maxValid) continue;\r\n      result += chars[array[i] % chars.length];\r\n    }\r\n  }\r\n  return result;\r\n}\r\n\r\n/**\r\n * 计算 PKCE S256 code_challenge（Edge Runtime 兼容）\r\n *\r\n * 使用 Web Crypto API 的 crypto.subtle.digest(\"SHA-256\")，\r\n * Edge Runtime 18+ 完全支持。\r\n */\r\nasync function computeCodeChallenge(verifier: string): Promise<string> {\r\n  const encoder = new TextEncoder();\r\n  const data = encoder.encode(verifier);\r\n  const hash = await crypto.subtle.digest(\"SHA-256\", data);\r\n  const bytes = new Uint8Array(hash);\r\n  let binary = \"\";\r\n  for (let i = 0; i < bytes.byteLength; i++) {\r\n    binary += String.fromCharCode(bytes[i]);\r\n  }\r\n  return btoa(binary).replace(/\\+/g, \"-\").replace(/\\//g, \"_\").replace(/=+$/, \"\");\r\n}\r\n\r\n/**\r\n * 路径匹配（支持 /:path* 通配符）\r\n */\r\nfunction matchesPath(pathname: string, paths: string[]): boolean {\r\n  return paths.some((path) => {\r\n    if (pathname === path) return true;\r\n    if (path.endsWith(\"/:path*\") && pathname.startsWith(path.replace(\"/:path*\", \"\"))) return true;\r\n    if (pathname.startsWith(path + \"/\")) return true;\r\n    return false;\r\n  });\r\n}\r\n\r\n/**\r\n * 从 JWT 中解码 payload（不验证签名，仅用于 Edge Runtime 快速检查 exp）\r\n */\r\nfunction decodeJwtPayload(token: string): Record<string, unknown> | null {\r\n  try {\r\n    const parts = token.split(\".\");\r\n    if (parts.length !== 3) return null;\r\n    const payload = parts[1];\r\n    // base64url decode (Edge Runtime 兼容)\r\n    const base64 = payload.replace(/-/g, \"+\").replace(/_/g, \"/\");\r\n    const decoded = atob(base64);\r\n    return JSON.parse(decoded) as Record<string, unknown>;\r\n  } catch {\r\n    return null;\r\n  }\r\n}\r\n\r\n/**\r\n * 通过主站 Introspection 端点校验 access_token 是否仍有效。\r\n * Confidential Client（BFF）应配置 clientSecret，防止伪造 Cookie 绕过。\r\n */\r\nasync function introspectAccessToken(\r\n  token: string,\r\n  ssoBaseUrl: string,\r\n  clientId: string,\r\n  clientSecret?: string\r\n): Promise<boolean> {\r\n  try {\r\n    const body = new URLSearchParams({\r\n      token,\r\n      token_type_hint: \"access_token\",\r\n      client_id: clientId,\r\n    });\r\n    if (clientSecret) {\r\n      body.set(\"client_secret\", clientSecret);\r\n    }\r\n\r\n    const res = await fetch(`${ssoBaseUrl}/api/oauth/introspect`, {\r\n      method: \"POST\",\r\n      headers: { \"Content-Type\": \"application/x-www-form-urlencoded\" },\r\n      body: body.toString(),\r\n    });\r\n\r\n    if (!res.ok) return false;\r\n    const data = (await res.json()) as { active?: boolean };\r\n    return data.active === true;\r\n  } catch {\r\n    return false;\r\n  }\r\n}\r\n\r\n// ============================================\r\n// Middleware 工厂函数\r\n// ============================================\r\n\r\nexport function createSsoMiddleware(config: SsoMiddlewareConfig) {\r\n  const {\r\n    clientId,\r\n    clientSecret,\r\n    ssoBaseUrl,\r\n    redirectUri,\r\n    scopes = \"openid profile\",\r\n    publicPaths = [],\r\n    callbackPath = \"/api/auth/callback\",\r\n    ssoCookieName = \"__Host-user_token\",\r\n    accessTokenCookieName = DEFAULT_ACCESS_TOKEN_COOKIE_NAME,\r\n    stateCookieName = DEFAULT_STATE_COOKIE_NAME,\r\n    returnUrlCookieName = DEFAULT_RETURN_COOKIE_NAME,\r\n    verifierCookieName = DEFAULT_VERIFIER_COOKIE_NAME,\r\n  } = config;\r\n\r\n  // 规范化 ssoBaseUrl\r\n  const normalizedBase = ssoBaseUrl.replace(/\\/+$/, \"\");\r\n\r\n  return async function ssoMiddleware(request: NextRequest) {\r\n    const { pathname } = request.nextUrl;\r\n\r\n    // Exclude Next.js internal routes and static assets\r\n    if (\r\n      pathname.startsWith(\"/_next/\") ||\r\n      pathname.startsWith(\"/favicon.ico\") ||\r\n      pathname.match(/\\.(ico|png|jpg|jpeg|svg|css|js|woff2?)$/)\r\n    ) {\r\n      return NextResponse.next();\r\n    }\r\n\r\n    // Callback path: let the callback handler deal with it\r\n    if (pathname === callbackPath) {\r\n      return NextResponse.next();\r\n    }\r\n\r\n    // Public paths: no auth required\r\n    const allPublicPaths = [callbackPath, ...publicPaths];\r\n    if (matchesPath(pathname, allPublicPaths)) {\r\n      return NextResponse.next();\r\n    }\r\n\r\n    // Check for existing SSO session\r\n    const ssoSession = request.cookies.get(ssoCookieName);\r\n    if (ssoSession?.value) {\r\n      return NextResponse.next();\r\n    }\r\n\r\n    // Check for access_token in cookie (set by callback handler)\r\n    const accessTokenCookie = request.cookies.get(accessTokenCookieName);\r\n    if (accessTokenCookie?.value) {\r\n      // 调用 Introspection 精确校验 token 是否仍有效。\r\n      // Confidential Client 携带 clientSecret；Public Client 仅传 clientId。\r\n      const tokenActive = await introspectAccessToken(\r\n        accessTokenCookie.value,\r\n        normalizedBase,\r\n        clientId,\r\n        clientSecret\r\n      );\r\n\r\n      if (tokenActive) {\r\n        return NextResponse.next();\r\n      }\r\n      // Token 无效或已过期：清除 cookie 并继续到 SSO 重定向\r\n    }\r\n\r\n    // No auth: redirect to SSO\r\n    const state = generateRandomString(32);\r\n    const verifier = generateRandomString(64);\r\n\r\n    // 在 Edge Runtime 中计算 PKCE code_challenge（SHA-256 + base64url）\r\n    const challenge = await computeCodeChallenge(verifier);\r\n\r\n    const authorizeParams = new URLSearchParams();\r\n    authorizeParams.set(\"response_type\", \"code\");\r\n    authorizeParams.set(\"client_id\", clientId);\r\n    authorizeParams.set(\"redirect_uri\", redirectUri);\r\n    authorizeParams.set(\"scope\", scopes);\r\n    authorizeParams.set(\"state\", state);\r\n    authorizeParams.set(\"code_challenge\", challenge);\r\n    authorizeParams.set(\"code_challenge_method\", \"S256\");\r\n\r\n    const loginUrl = new URL(\"/api/oauth/authorize\", normalizedBase);\r\n    loginUrl.search = authorizeParams.toString();\r\n\r\n    const response = NextResponse.redirect(loginUrl);\r\n\r\n    // Set state cookie for CSRF verification on callback\r\n    response.cookies.set(stateCookieName, state, getHostCookieOptions(600));\r\n\r\n    // Set PKCE verifier cookie（httpOnly，供 callback handler 使用）\r\n    // 使用 __Secure- 前缀，允许写入 callbackPath\r\n    response.cookies.set(verifierCookieName, verifier, getSecureCookieOptions(600, callbackPath));\r\n\r\n    // Set return URL cookie\r\n    response.cookies.set(returnUrlCookieName, request.url, getHostCookieOptions(600));\r\n\r\n    // 如果存在过期的 access_token cookie，立即清除\r\n    if (accessTokenCookie?.value) {\r\n      response.cookies.set(accessTokenCookieName, \"\", getHostCookieOptions(0));\r\n    }\r\n\r\n    return response;\r\n  };\r\n}\r\n","/**\n * Next.js 集成默认 Cookie 名称\n *\n * 除 verifier 外统一使用 __Host- 前缀，要求：\n * - Secure\n * - Path=/\n * - 无 Domain 属性\n *\n * verifier 需要写入回调路径（非 /），因此使用 __Secure- 前缀。\n */\n\nexport const DEFAULT_ACCESS_TOKEN_COOKIE_NAME = \"__Host-nihplod_sso_at\";\nexport const DEFAULT_REFRESH_TOKEN_COOKIE_NAME = \"__Host-nihplod_sso_rt\";\nexport const DEFAULT_ID_TOKEN_COOKIE_NAME = \"__Host-nihplod_sso_id\";\nexport const DEFAULT_STATE_COOKIE_NAME = \"__Host-nihplod_sso_state\";\nexport const DEFAULT_RETURN_COOKIE_NAME = \"__Host-nihplod_sso_return\";\n// Verifier 需要写入回调路径（非 /），因此使用 __Secure- 前缀而非 __Host-\nexport const DEFAULT_VERIFIER_COOKIE_NAME = \"__Secure-nihplod_sso_verifier\";\n\n/** __Host- 前缀 Cookie 的安全选项（Path 必须为 /） */\nexport function getHostCookieOptions(maxAge?: number): {\n  httpOnly: true;\n  secure: true;\n  sameSite: \"lax\";\n  path: \"/\";\n  maxAge?: number;\n} {\n  return {\n    httpOnly: true,\n    secure: true,\n    sameSite: \"lax\",\n    path: \"/\",\n    ...(maxAge !== undefined ? { maxAge } : {}),\n  };\n}\n\n/** __Secure- 前缀 Cookie 的安全选项（允许自定义 Path） */\nexport function getSecureCookieOptions(\n  maxAge?: number,\n  path = \"/\"\n): {\n  httpOnly: true;\n  secure: true;\n  sameSite: \"lax\";\n  path: string;\n  maxAge?: number;\n} {\n  return {\n    httpOnly: true,\n    secure: true,\n    sameSite: \"lax\",\n    path,\n    ...(maxAge !== undefined ? { maxAge } : {}),\n  };\n}\n","/**\r\n * App Router 回调 Route Handler\r\n *\r\n * 在 /api/auth/callback 路由中处理 OAuth 回调：\r\n * 1. 验证 state 参数\r\n * 2. 用授权码交换 token\r\n * 3. 设置 session cookie\r\n * 4. 重定向到原始页面\r\n *\r\n * ⚠️ 此 handler 仅运行在 Node.js Runtime（非 Edge），可以使用 crypto.subtle。\r\n *\r\n * 用法 (src/app/api/auth/callback/route.ts):\r\n * ```ts\r\n * import { createCallbackRouteHandler } from \"@nihplod/sso-sdk/next\";\r\n *\r\n * export const GET = createCallbackRouteHandler({\r\n *   clientId: \"my-app\",\r\n *   ssoBaseUrl: \"https://nihplod.cn\",\r\n *   redirectUri: \"https://myapp.com/api/auth/callback\",\r\n *   tokenCookieName: \"nihplod_sso_at\",\r\n * });\r\n * ```\r\n */\r\n\r\nimport { NextRequest, NextResponse } from \"next/server\";\r\nimport {\r\n  DEFAULT_ACCESS_TOKEN_COOKIE_NAME,\r\n  DEFAULT_REFRESH_TOKEN_COOKIE_NAME,\r\n  DEFAULT_ID_TOKEN_COOKIE_NAME,\r\n  DEFAULT_STATE_COOKIE_NAME,\r\n  DEFAULT_RETURN_COOKIE_NAME,\r\n  DEFAULT_VERIFIER_COOKIE_NAME,\r\n  getHostCookieOptions,\r\n  getSecureCookieOptions,\r\n} from \"./constants\";\r\n\r\n// ============================================\r\n// 类型定义\r\n// ============================================\r\n\r\nexport interface CallbackRouteConfig {\r\n  /** OAuth Client ID */\r\n  clientId: string;\r\n\r\n  /** SSO 中心地址 */\r\n  ssoBaseUrl: string;\r\n\r\n  /** 回调 URL（须与注册的 redirect_uri 一致） */\r\n  redirectUri: string;\r\n\r\n  /**\r\n   * OAuth Client Secret（可选）。\r\n   * 对于 Confidential Client（BFF/Next.js），应传入 clientSecret\r\n   * 以提供第二因素认证。对于 Public Client（SPA），应省略此字段。\r\n   */\r\n  clientSecret?: string;\r\n\r\n  /** 成功回调后重定向的默认路径，默认 \"/\" */\r\n  defaultReturnPath?: string;\r\n\r\n  /** Access Token Cookie 名称，默认 __Host-nihplod_sso_at */\r\n  accessTokenCookieName?: string;\r\n\r\n  /** Refresh Token Cookie 名称，默认 __Host-nihplod_sso_rt */\r\n  refreshTokenCookieName?: string;\r\n\r\n  /** ID Token Cookie 名称，默认 __Host-nihplod_sso_id */\r\n  idTokenCookieName?: string;\r\n\r\n  /** State Cookie 名称，默认 __Host-nihplod_sso_state */\r\n  stateCookieName?: string;\r\n\r\n  /** Return URL Cookie 名称，默认 __Host-nihplod_sso_return */\r\n  returnUrlCookieName?: string;\r\n\r\n  /** PKCE Verifier Cookie 名称，默认 __Secure-nihplod_sso_verifier */\r\n  verifierCookieName?: string;\r\n}\r\n\r\n// ============================================\r\n// 工具函数\r\n// ============================================\r\n\r\n/**\r\n * 校验回调后的 returnUrl 是否可信。\r\n * 仅允许：相对路径（且不以 // 开头）或与当前 origin 完全一致。\r\n */\r\nfunction isTrustedReturnUrl(url: string, currentOrigin: string): boolean {\r\n  if (!url) return false;\r\n  if (url.startsWith(\"/\") && !url.startsWith(\"//\")) return true;\r\n  try {\r\n    return new URL(url).origin === currentOrigin;\r\n  } catch {\r\n    return false;\r\n  }\r\n}\r\n\r\n// ============================================\r\n// ID Token 预校验（写 Cookie 之前）\r\n// ============================================\r\n\r\ninterface JwksKey {\r\n  kty: string;\r\n  kid?: string;\r\n  alg?: string;\r\n  use?: string;\r\n  n?: string;\r\n  e?: string;\r\n}\r\n\r\ninterface Jwks {\r\n  keys: JwksKey[];\r\n}\r\n\r\nfunction base64UrlDecode(input: string): Uint8Array {\r\n  const base64 = input.replace(/-/g, \"+\").replace(/_/g, \"/\");\r\n  const padded = base64.padEnd(base64.length + ((4 - (base64.length % 4)) % 4), \"=\");\r\n  const binary = atob(padded);\r\n  const bytes = new Uint8Array(binary.length);\r\n  for (let i = 0; i < binary.length; i++) {\r\n    bytes[i] = binary.charCodeAt(i);\r\n  }\r\n  return bytes;\r\n}\r\n\r\nfunction decodeJwtPayload(token: string): Record<string, unknown> | null {\r\n  try {\r\n    const parts = token.split(\".\");\r\n    if (parts.length !== 3) return null;\r\n    const json = new TextDecoder().decode(base64UrlDecode(parts[1]));\r\n    return JSON.parse(json) as Record<string, unknown>;\r\n  } catch {\r\n    return null;\r\n  }\r\n}\r\n\r\nfunction decodeJwtHeader(token: string): Record<string, unknown> | null {\r\n  try {\r\n    const parts = token.split(\".\");\r\n    if (parts.length !== 3) return null;\r\n    const json = new TextDecoder().decode(base64UrlDecode(parts[0]));\r\n    return JSON.parse(json) as Record<string, unknown>;\r\n  } catch {\r\n    return null;\r\n  }\r\n}\r\n\r\nasync function fetchJwks(baseUrl: string): Promise<Jwks | null> {\r\n  try {\r\n    const res = await fetch(`${baseUrl}/api/oauth/jwks`);\r\n    if (!res.ok) return null;\r\n    return (await res.json()) as Jwks;\r\n  } catch {\r\n    return null;\r\n  }\r\n}\r\n\r\nasync function verifyRs256Signature(token: string, jwk: JwksKey): Promise<boolean> {\r\n  try {\r\n    const [headerB64, payloadB64, signature] = token.split(\".\");\r\n    if (!signature || !jwk.n || !jwk.e) return false;\r\n\r\n    const cryptoKey = await crypto.subtle.importKey(\r\n      \"jwk\",\r\n      { kty: \"RSA\", n: jwk.n, e: jwk.e, alg: \"RS256\", ext: false },\r\n      { name: \"RSASSA-PKCS1-v1_5\", hash: \"SHA-256\" },\r\n      false,\r\n      [\"verify\"]\r\n    );\r\n\r\n    const signatureBytes = base64UrlDecode(signature);\r\n    const data = new TextEncoder().encode(`${headerB64}.${payloadB64}`);\r\n    return await crypto.subtle.verify(\r\n      \"RSASSA-PKCS1-v1_5\",\r\n      cryptoKey,\r\n      signatureBytes as unknown as BufferSource,\r\n      data as unknown as BufferSource\r\n    );\r\n  } catch {\r\n    return false;\r\n  }\r\n}\r\n\r\nasync function computeAtHash(accessToken: string): Promise<string> {\r\n  const hash = await crypto.subtle.digest(\r\n    \"SHA-256\",\r\n    new TextEncoder().encode(accessToken)\r\n  );\r\n  const bytes = new Uint8Array(hash);\r\n  const half = bytes.slice(0, bytes.length / 2);\r\n  let binary = \"\";\r\n  for (const b of half) {\r\n    binary += String.fromCharCode(b);\r\n  }\r\n  return btoa(binary).replace(/\\+/g, \"-\").replace(/\\//g, \"_\").replace(/=+$/, \"\");\r\n}\r\n\r\n/**\r\n * 在设置 Cookie 前校验 ID Token 基本声明与签名。\r\n * HS256 场景下无法验证签名（Confidential/BFF 应配置 RS256），仅校验声明与 at_hash。\r\n */\r\nasync function validateIdToken(\r\n  idToken: string,\r\n  accessToken: string,\r\n  expectedIssuer: string,\r\n  expectedClientId: string\r\n): Promise<void> {\r\n  const header = decodeJwtHeader(idToken);\r\n  if (!header) throw new Error(\"ID Token 格式错误\");\r\n\r\n  const alg = header.alg;\r\n  if (typeof alg !== \"string\" || (alg !== \"RS256\" && alg !== \"HS256\")) {\r\n    throw new Error(`不支持的 ID Token 签名算法: ${alg}`);\r\n  }\r\n\r\n  if (alg === \"RS256\") {\r\n    const jwks = await fetchJwks(expectedIssuer);\r\n    if (!jwks) throw new Error(\"无法获取 JWKS\");\r\n    const kid = typeof header.kid === \"string\" ? header.kid : undefined;\r\n    const key = jwks.keys.find(\r\n      (k) =>\r\n        k.kty === \"RSA\" &&\r\n        k.alg === \"RS256\" &&\r\n        k.use === \"sig\" &&\r\n        (kid ? k.kid === kid : true)\r\n    );\r\n    if (!key) throw new Error(\"JWKS 中未找到匹配公钥\");\r\n    const valid = await verifyRs256Signature(idToken, key);\r\n    if (!valid) throw new Error(\"ID Token 签名验证失败\");\r\n  }\r\n\r\n  // HS256：对称密钥不应通过 JWKS 暴露给 BFF，Confidential Client 应迁移到 RS256\r\n  if (alg === \"HS256\") {\r\n    // eslint-disable-next-line no-console\r\n    console.warn(\r\n      \"[SSO SDK/Next] ID Token 使用 HS256 签名。建议主站启用 RS256 以获得完整签名验证。\"\r\n    );\r\n  }\r\n\r\n  const payload = decodeJwtPayload(idToken);\r\n  if (!payload) throw new Error(\"ID Token payload 解析失败\");\r\n\r\n  const normalizedIssuer = expectedIssuer.replace(/\\/+$/, \"\");\r\n  const tokenIssuer =\r\n    typeof payload.iss === \"string\" ? payload.iss.replace(/\\/+$/, \"\") : \"\";\r\n  if (tokenIssuer !== normalizedIssuer) {\r\n    throw new Error(\"ID Token issuer 不匹配\");\r\n  }\r\n\r\n  const aud = payload.aud;\r\n  const audArr = Array.isArray(aud) ? aud : [aud];\r\n  if (!audArr.includes(expectedClientId)) {\r\n    throw new Error(\"ID Token audience 不匹配\");\r\n  }\r\n\r\n  if (typeof payload.exp === \"number\" && Date.now() >= payload.exp * 1000) {\r\n    throw new Error(\"ID Token 已过期\");\r\n  }\r\n  if (typeof payload.sub !== \"string\" || !payload.sub) {\r\n    throw new Error(\"ID Token 缺少 sub\");\r\n  }\r\n\r\n  if (typeof payload.at_hash === \"string\" && payload.at_hash) {\r\n    const actual = await computeAtHash(accessToken);\r\n    if (actual !== payload.at_hash) {\r\n      throw new Error(\"ID Token at_hash 不匹配\");\r\n    }\r\n  }\r\n}\r\n\r\n// ============================================\r\n// Route Handler 工厂函数\r\n// ============================================\r\n\r\nexport function createCallbackRouteHandler(config: CallbackRouteConfig) {\r\n  const {\r\n    clientId,\r\n    ssoBaseUrl,\r\n    redirectUri,\r\n    clientSecret,\r\n    defaultReturnPath = \"/\",\r\n    accessTokenCookieName = DEFAULT_ACCESS_TOKEN_COOKIE_NAME,\r\n    refreshTokenCookieName = DEFAULT_REFRESH_TOKEN_COOKIE_NAME,\r\n    idTokenCookieName = DEFAULT_ID_TOKEN_COOKIE_NAME,\r\n    stateCookieName = DEFAULT_STATE_COOKIE_NAME,\r\n    returnUrlCookieName = DEFAULT_RETURN_COOKIE_NAME,\r\n    verifierCookieName = DEFAULT_VERIFIER_COOKIE_NAME,\r\n  } = config;\r\n\r\n  const normalizedBase = ssoBaseUrl.replace(/\\/+$/, \"\");\r\n\r\n  return async function GET(request: NextRequest) {\r\n    const { searchParams } = request.nextUrl;\r\n\r\n    // 检查错误\r\n    const error = searchParams.get(\"error\");\r\n    if (error) {\r\n      const desc = searchParams.get(\"error_description\") || error;\r\n      return NextResponse.json(\r\n        { error: \"authorization_failed\", error_description: desc },\r\n        { status: 400 }\r\n      );\r\n    }\r\n\r\n    const code = searchParams.get(\"code\");\r\n    const returnedState = searchParams.get(\"state\");\r\n\r\n    if (!code) {\r\n      return NextResponse.json(\r\n        {\r\n          error: \"invalid_request\",\r\n          error_description: \"缺少 authorization code\",\r\n        },\r\n        { status: 400 }\r\n      );\r\n    }\r\n\r\n    // 验证 state（从 cookie 中读取原始 state，CSRF 必需）\r\n    const savedState = request.cookies.get(stateCookieName)?.value;\r\n    if (!savedState) {\r\n      return NextResponse.json(\r\n        {\r\n          error: \"invalid_request\",\r\n          error_description: \"State 参数缺失，请重新发起授权请求\",\r\n        },\r\n        { status: 400 }\r\n      );\r\n    }\r\n    if (returnedState !== savedState) {\r\n      return NextResponse.json(\r\n        {\r\n          error: \"invalid_request\",\r\n          error_description: \"State 参数不匹配，可能存在 CSRF 攻击\",\r\n        },\r\n        { status: 400 }\r\n      );\r\n    }\r\n\r\n    // 读取 PKCE code_verifier（middleware 存入的 httpOnly cookie）\r\n    const verifier = request.cookies.get(verifierCookieName)?.value;\r\n    if (!verifier) {\r\n      return NextResponse.json(\r\n        {\r\n          error: \"invalid_request\",\r\n          error_description: \"PKCE verifier 缺失，请重新发起授权请求\",\r\n        },\r\n        { status: 400 }\r\n      );\r\n    }\r\n\r\n    // 交换 token\r\n    const tokenEndpoint = `${normalizedBase}/api/oauth/token`;\r\n    const body = new URLSearchParams();\r\n    body.set(\"grant_type\", \"authorization_code\");\r\n    body.set(\"code\", code);\r\n    body.set(\"client_id\", clientId);\r\n    body.set(\"redirect_uri\", redirectUri);\r\n    body.set(\"code_verifier\", verifier);\r\n    if (clientSecret) {\r\n      body.set(\"client_secret\", clientSecret);\r\n    }\r\n\r\n    // 带重试的 token 交换（1 次重试 + 指数退避）\r\n    let res: Response;\r\n    let lastError: unknown;\r\n    const maxRetries = 1;\r\n\r\n    for (let attempt = 0; attempt <= maxRetries; attempt++) {\r\n      if (attempt > 0) {\r\n        // 指数退避：1s * 2^attempt\r\n        await new Promise((r) => setTimeout(r, 1000 * Math.pow(2, attempt - 1)));\r\n      }\r\n      try {\r\n        res = await fetch(tokenEndpoint, {\r\n          method: \"POST\",\r\n          headers: { \"Content-Type\": \"application/x-www-form-urlencoded\" },\r\n          body: body.toString(),\r\n        });\r\n        lastError = null;\r\n        break;\r\n      } catch (err) {\r\n        lastError = err;\r\n        if (attempt >= maxRetries) {\r\n          return NextResponse.json(\r\n            { error: \"server_error\", error_description: \"Token 请求失败，已重试仍不可达\" },\r\n            { status: 502 }\r\n          );\r\n        }\r\n      }\r\n    }\r\n\r\n    if (lastError || !res!) {\r\n      return NextResponse.json(\r\n        { error: \"server_error\", error_description: \"Token 请求失败\" },\r\n        { status: 502 }\r\n      );\r\n    }\r\n\r\n    if (!res.ok) {\r\n      let errData: Record<string, unknown> = {};\r\n      try {\r\n        errData = await res.json();\r\n      } catch { /* ignore */ }\r\n      return NextResponse.json(\r\n        {\r\n          error: \"token_request_failed\",\r\n          error_description:\r\n            (errData.error_description as string) || `Token 请求失败: HTTP ${res.status}`,\r\n        },\r\n        { status: 502 }\r\n      );\r\n    }\r\n\r\n    const tokenData: {\r\n      access_token: string;\r\n      token_type: string;\r\n      expires_in: number;\r\n      refresh_token: string;\r\n      id_token?: string;\r\n    } = await res.json();\r\n\r\n    // 在设置 Cookie 前预校验 ID Token：防止伪造 token 写入浏览器\r\n    if (tokenData.id_token) {\r\n      try {\r\n        await validateIdToken(\r\n          tokenData.id_token,\r\n          tokenData.access_token,\r\n          normalizedBase,\r\n          clientId\r\n        );\r\n      } catch (err) {\r\n        return NextResponse.json(\r\n          {\r\n            error: \"id_token_invalid\",\r\n            error_description: err instanceof Error ? err.message : \"ID Token 验证失败\",\r\n          },\r\n          { status: 400 }\r\n        );\r\n      }\r\n    }\r\n\r\n    // 读取 return URL，并做开放重定向防护\r\n    const rawReturnUrl =\r\n      request.cookies.get(returnUrlCookieName)?.value || defaultReturnPath;\r\n    const returnUrl = isTrustedReturnUrl(rawReturnUrl, request.nextUrl.origin)\r\n      ? rawReturnUrl\r\n      : \"/\";\r\n\r\n    // 重定向并设置 cookie\r\n    const response = NextResponse.redirect(new URL(returnUrl, request.url));\r\n\r\n    // 设置 access_token cookie (httpOnly, Secure, SameSite=Lax, Path=/)\r\n    response.cookies.set(accessTokenCookieName, tokenData.access_token, {\r\n      ...getHostCookieOptions(tokenData.expires_in),\r\n    });\r\n\r\n    // 设置 refresh_token cookie（使用服务端返回的过期时间动态计算）\r\n    // 服务端 refresh_token 通常是 30 天，此处使用 expires_in 映射（若响应包含）\r\n    // 回退到 30 天默认值\r\n    const refreshMaxAge =\r\n      (tokenData as Record<string, unknown>).refresh_expires_in != null\r\n        ? (tokenData as Record<string, unknown>).refresh_expires_in as number\r\n        : 30 * 24 * 60 * 60;\r\n\r\n    response.cookies.set(refreshTokenCookieName, tokenData.refresh_token, {\r\n      ...getHostCookieOptions(refreshMaxAge),\r\n    });\r\n\r\n    // 设置 id_token cookie，用于 RP-Initiated Logout 的 id_token_hint\r\n    if (tokenData.id_token) {\r\n      response.cookies.set(idTokenCookieName, tokenData.id_token, {\r\n        ...getHostCookieOptions(refreshMaxAge),\r\n      });\r\n    }\r\n\r\n    // 清除临时 cookies: state / return URL\r\n    response.cookies.set(stateCookieName, \"\", getHostCookieOptions(0));\r\n    response.cookies.set(returnUrlCookieName, \"\", getHostCookieOptions(0));\r\n\r\n    // 清除 PKCE verifier cookie，必须使用写入时的 path（callbackPath）\r\n    // 由于 callback handler 不知道 middleware 的 callbackPath，这里保守地\r\n    // 同时清除 path=/ 和 path=当前请求路径两种可能\r\n    response.cookies.set(verifierCookieName, \"\", getSecureCookieOptions(0, \"/\"));\r\n    response.cookies.set(verifierCookieName, \"\", getSecureCookieOptions(0, request.nextUrl.pathname));\r\n\r\n    return response;\r\n  };\r\n}\r\n","/**\n * App Router 登出 Route Handler\n *\n * 在 /api/auth/logout 路由中处理本地登出 + RP-Initiated Logout：\n * 1. 从 cookie 读取 refresh_token 并调用 revocation_endpoint 撤销\n * 2. 清除所有 SSO cookie\n * 3. 可选重定向到 SSO 中心登出页\n *\n * 用法 (src/app/api/auth/logout/route.ts):\n * ```ts\n * import { createLogoutRouteHandler } from \"@nihplod/sso-sdk/next\";\n *\n * export const GET = createLogoutRouteHandler({\n *   clientId: \"my-app\",\n *   clientSecret: \"optional-secret\",\n *   ssoBaseUrl: \"https://nihplod.cn\",\n *   redirectUri: \"https://myapp.com/api/auth/callback\",\n *   postLogoutRedirectUri: \"https://myapp.com/\",\n * });\n * ```\n */\n\nimport { NextRequest, NextResponse } from \"next/server\";\nimport {\n  DEFAULT_ACCESS_TOKEN_COOKIE_NAME,\n  DEFAULT_REFRESH_TOKEN_COOKIE_NAME,\n  DEFAULT_ID_TOKEN_COOKIE_NAME,\n  DEFAULT_STATE_COOKIE_NAME,\n  DEFAULT_RETURN_COOKIE_NAME,\n  DEFAULT_VERIFIER_COOKIE_NAME,\n  getHostCookieOptions,\n  getSecureCookieOptions,\n} from \"./constants\";\n\n// ============================================\n// 类型定义\n// ============================================\n\nexport interface LogoutRouteConfig {\n  /** OAuth Client ID */\n  clientId: string;\n\n  /** SSO 中心地址 */\n  ssoBaseUrl: string;\n\n  /** 回调 URL（与注册 redirect_uri 一致，用于构造 post_logout_redirect_uri） */\n  redirectUri: string;\n\n  /**\n   * OAuth Client Secret（可选）。\n   * 撤销 refresh_token 时，Confidential Client 需要认证。\n   */\n  clientSecret?: string;\n\n  /** 登出后跳转回子项目的地址，默认取 redirectUri 的 origin */\n  postLogoutRedirectUri?: string;\n\n  /** 是否重定向到 SSO 中心登出页，默认 true */\n  redirectToSso?: boolean;\n\n  /** Access Token Cookie 名称 */\n  accessTokenCookieName?: string;\n\n  /** Refresh Token Cookie 名称 */\n  refreshTokenCookieName?: string;\n\n  /** ID Token Cookie 名称，默认 __Host-nihplod_sso_id */\n  idTokenCookieName?: string;\n\n  /** State Cookie 名称 */\n  stateCookieName?: string;\n\n  /** Return URL Cookie 名称 */\n  returnUrlCookieName?: string;\n\n  /** PKCE Verifier Cookie 名称 */\n  verifierCookieName?: string;\n\n  /** 回调路径（用于清除 verifier cookie），默认 \"/api/auth/callback\" */\n  callbackPath?: string;\n}\n\ninterface OidcDiscovery {\n  issuer: string;\n  end_session_endpoint?: string;\n  revocation_endpoint?: string;\n  [key: string]: unknown;\n}\n\n// ============================================\n// 工具函数\n// ============================================\n\nasync function fetchDiscovery(ssoBaseUrl: string): Promise<OidcDiscovery | null> {\n  try {\n    const controller = new AbortController();\n    setTimeout(() => controller.abort(), 5000);\n    const res = await fetch(\n      `${ssoBaseUrl}/api/oauth/.well-known/openid-configuration`,\n      { signal: controller.signal }\n    );\n    if (!res.ok) return null;\n    return (await res.json()) as OidcDiscovery;\n  } catch {\n    return null;\n  }\n}\n\n// ============================================\n// Route Handler 工厂函数\n// ============================================\n\nexport function createLogoutRouteHandler(config: LogoutRouteConfig) {\n  const {\n    clientId,\n    ssoBaseUrl,\n    redirectUri,\n    clientSecret,\n    postLogoutRedirectUri = new URL(redirectUri).origin + \"/\",\n    redirectToSso = true,\n    accessTokenCookieName = DEFAULT_ACCESS_TOKEN_COOKIE_NAME,\n    refreshTokenCookieName = DEFAULT_REFRESH_TOKEN_COOKIE_NAME,\n    idTokenCookieName = DEFAULT_ID_TOKEN_COOKIE_NAME,\n    stateCookieName = DEFAULT_STATE_COOKIE_NAME,\n    returnUrlCookieName = DEFAULT_RETURN_COOKIE_NAME,\n    verifierCookieName = DEFAULT_VERIFIER_COOKIE_NAME,\n    callbackPath = \"/api/auth/callback\",\n  } = config;\n\n  const normalizedBase = ssoBaseUrl.replace(/\\/+$/, \"\");\n\n  return async function GET(request: NextRequest) {\n    const refreshToken = request.cookies.get(refreshTokenCookieName)?.value;\n    const idTokenHint = request.cookies.get(idTokenCookieName)?.value;\n\n    // 1. best-effort 撤销服务端 refresh_token\n    if (refreshToken) {\n      try {\n        const discovery = await fetchDiscovery(normalizedBase);\n        const revokeUrl =\n          discovery?.revocation_endpoint || `${normalizedBase}/api/oauth/revoke`;\n        const body = new URLSearchParams({\n          token: refreshToken,\n          token_type_hint: \"refresh_token\",\n          client_id: clientId,\n        });\n        if (clientSecret) {\n          body.set(\"client_secret\", clientSecret);\n        }\n        await fetch(revokeUrl, {\n          method: \"POST\",\n          headers: { \"Content-Type\": \"application/x-www-form-urlencoded\" },\n          body: body.toString(),\n        });\n      } catch {\n        // 撤销失败不影响本地登出\n      }\n    }\n\n    // 2. 准备本地清除 SSO cookie 的响应\n    const clearCookies = (res: NextResponse) => {\n      res.cookies.set(accessTokenCookieName, \"\", getHostCookieOptions(0));\n      res.cookies.set(refreshTokenCookieName, \"\", getHostCookieOptions(0));\n      res.cookies.set(idTokenCookieName, \"\", getHostCookieOptions(0));\n      res.cookies.set(stateCookieName, \"\", getHostCookieOptions(0));\n      res.cookies.set(returnUrlCookieName, \"\", getHostCookieOptions(0));\n      res.cookies.set(verifierCookieName, \"\", getSecureCookieOptions(0, \"/\"));\n      res.cookies.set(verifierCookieName, \"\", getSecureCookieOptions(0, callbackPath));\n      return res;\n    };\n\n    // 3. 若需要 RP-Initiated Logout，重定向到 SSO 中心，同时必须清除本地 Cookie\n    if (redirectToSso) {\n      const discovery = await fetchDiscovery(normalizedBase);\n      const endSessionEndpoint =\n        discovery?.end_session_endpoint || `${normalizedBase}/logout`;\n      const logoutUrl = new URL(endSessionEndpoint);\n      logoutUrl.searchParams.set(\"client_id\", clientId);\n      logoutUrl.searchParams.set(\n        \"post_logout_redirect_uri\",\n        postLogoutRedirectUri\n      );\n      if (idTokenHint) {\n        logoutUrl.searchParams.set(\"id_token_hint\", idTokenHint);\n      }\n      return clearCookies(NextResponse.redirect(logoutUrl.toString()));\n    }\n\n    return clearCookies(\n      NextResponse.redirect(request.nextUrl.origin + \"/\")\n    );\n  };\n}\n"],"mappings":";;;;;;;;;;;;;;;;;;;;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;;;ACuBA,oBAA0C;;;ACZnC,IAAM,mCAAmC;AACzC,IAAM,oCAAoC;AAC1C,IAAM,+BAA+B;AACrC,IAAM,4BAA4B;AAClC,IAAM,6BAA6B;AAEnC,IAAM,+BAA+B;AAGrC,SAAS,qBAAqB,QAMnC;AACA,SAAO;AAAA,IACL,UAAU;AAAA,IACV,QAAQ;AAAA,IACR,UAAU;AAAA,IACV,MAAM;AAAA,IACN,GAAI,WAAW,SAAY,EAAE,OAAO,IAAI,CAAC;AAAA,EAC3C;AACF;AAGO,SAAS,uBACd,QACA,OAAO,KAOP;AACA,SAAO;AAAA,IACL,UAAU;AAAA,IACV,QAAQ;AAAA,IACR,UAAU;AAAA,IACV;AAAA,IACA,GAAI,WAAW,SAAY,EAAE,OAAO,IAAI,CAAC;AAAA,EAC3C;AACF;;;ADoCA,SAAS,qBAAqB,QAAwB;AACpD,QAAM,QACJ;AACF,QAAM,WAAW,KAAK,MAAM,MAAM,MAAM,MAAM,IAAI,MAAM;AACxD,MAAI,SAAS;AAEb,SAAO,OAAO,SAAS,QAAQ;AAC7B,UAAM,QAAQ,IAAI,WAAW,SAAS,CAAC;AACvC,WAAO,gBAAgB,KAAK;AAC5B,aAAS,IAAI,GAAG,IAAI,MAAM,UAAU,OAAO,SAAS,QAAQ,KAAK;AAC/D,UAAI,MAAM,CAAC,KAAK,SAAU;AAC1B,gBAAU,MAAM,MAAM,CAAC,IAAI,MAAM,MAAM;AAAA,IACzC;AAAA,EACF;AACA,SAAO;AACT;AAQA,eAAe,qBAAqB,UAAmC;AACrE,QAAM,UAAU,IAAI,YAAY;AAChC,QAAM,OAAO,QAAQ,OAAO,QAAQ;AACpC,QAAM,OAAO,MAAM,OAAO,OAAO,OAAO,WAAW,IAAI;AACvD,QAAM,QAAQ,IAAI,WAAW,IAAI;AACjC,MAAI,SAAS;AACb,WAAS,IAAI,GAAG,IAAI,MAAM,YAAY,KAAK;AACzC,cAAU,OAAO,aAAa,MAAM,CAAC,CAAC;AAAA,EACxC;AACA,SAAO,KAAK,MAAM,EAAE,QAAQ,OAAO,GAAG,EAAE,QAAQ,OAAO,GAAG,EAAE,QAAQ,OAAO,EAAE;AAC/E;AAKA,SAAS,YAAY,UAAkB,OAA0B;AAC/D,SAAO,MAAM,KAAK,CAAC,SAAS;AAC1B,QAAI,aAAa,KAAM,QAAO;AAC9B,QAAI,KAAK,SAAS,SAAS,KAAK,SAAS,WAAW,KAAK,QAAQ,WAAW,EAAE,CAAC,EAAG,QAAO;AACzF,QAAI,SAAS,WAAW,OAAO,GAAG,EAAG,QAAO;AAC5C,WAAO;AAAA,EACT,CAAC;AACH;AAuBA,eAAe,sBACb,OACA,YACA,UACA,cACkB;AAClB,MAAI;AACF,UAAM,OAAO,IAAI,gBAAgB;AAAA,MAC/B;AAAA,MACA,iBAAiB;AAAA,MACjB,WAAW;AAAA,IACb,CAAC;AACD,QAAI,cAAc;AAChB,WAAK,IAAI,iBAAiB,YAAY;AAAA,IACxC;AAEA,UAAM,MAAM,MAAM,MAAM,GAAG,UAAU,yBAAyB;AAAA,MAC5D,QAAQ;AAAA,MACR,SAAS,EAAE,gBAAgB,oCAAoC;AAAA,MAC/D,MAAM,KAAK,SAAS;AAAA,IACtB,CAAC;AAED,QAAI,CAAC,IAAI,GAAI,QAAO;AACpB,UAAM,OAAQ,MAAM,IAAI,KAAK;AAC7B,WAAO,KAAK,WAAW;AAAA,EACzB,QAAQ;AACN,WAAO;AAAA,EACT;AACF;AAMO,SAAS,oBAAoB,QAA6B;AAC/D,QAAM;AAAA,IACJ;AAAA,IACA;AAAA,IACA;AAAA,IACA;AAAA,IACA,SAAS;AAAA,IACT,cAAc,CAAC;AAAA,IACf,eAAe;AAAA,IACf,gBAAgB;AAAA,IAChB,wBAAwB;AAAA,IACxB,kBAAkB;AAAA,IAClB,sBAAsB;AAAA,IACtB,qBAAqB;AAAA,EACvB,IAAI;AAGJ,QAAM,iBAAiB,WAAW,QAAQ,QAAQ,EAAE;AAEpD,SAAO,eAAe,cAAc,SAAsB;AACxD,UAAM,EAAE,SAAS,IAAI,QAAQ;AAG7B,QACE,SAAS,WAAW,SAAS,KAC7B,SAAS,WAAW,cAAc,KAClC,SAAS,MAAM,yCAAyC,GACxD;AACA,aAAO,2BAAa,KAAK;AAAA,IAC3B;AAGA,QAAI,aAAa,cAAc;AAC7B,aAAO,2BAAa,KAAK;AAAA,IAC3B;AAGA,UAAM,iBAAiB,CAAC,cAAc,GAAG,WAAW;AACpD,QAAI,YAAY,UAAU,cAAc,GAAG;AACzC,aAAO,2BAAa,KAAK;AAAA,IAC3B;AAGA,UAAM,aAAa,QAAQ,QAAQ,IAAI,aAAa;AACpD,QAAI,YAAY,OAAO;AACrB,aAAO,2BAAa,KAAK;AAAA,IAC3B;AAGA,UAAM,oBAAoB,QAAQ,QAAQ,IAAI,qBAAqB;AACnE,QAAI,mBAAmB,OAAO;AAG5B,YAAM,cAAc,MAAM;AAAA,QACxB,kBAAkB;AAAA,QAClB;AAAA,QACA;AAAA,QACA;AAAA,MACF;AAEA,UAAI,aAAa;AACf,eAAO,2BAAa,KAAK;AAAA,MAC3B;AAAA,IAEF;AAGA,UAAM,QAAQ,qBAAqB,EAAE;AACrC,UAAM,WAAW,qBAAqB,EAAE;AAGxC,UAAM,YAAY,MAAM,qBAAqB,QAAQ;AAErD,UAAM,kBAAkB,IAAI,gBAAgB;AAC5C,oBAAgB,IAAI,iBAAiB,MAAM;AAC3C,oBAAgB,IAAI,aAAa,QAAQ;AACzC,oBAAgB,IAAI,gBAAgB,WAAW;AAC/C,oBAAgB,IAAI,SAAS,MAAM;AACnC,oBAAgB,IAAI,SAAS,KAAK;AAClC,oBAAgB,IAAI,kBAAkB,SAAS;AAC/C,oBAAgB,IAAI,yBAAyB,MAAM;AAEnD,UAAM,WAAW,IAAI,IAAI,wBAAwB,cAAc;AAC/D,aAAS,SAAS,gBAAgB,SAAS;AAE3C,UAAM,WAAW,2BAAa,SAAS,QAAQ;AAG/C,aAAS,QAAQ,IAAI,iBAAiB,OAAO,qBAAqB,GAAG,CAAC;AAItE,aAAS,QAAQ,IAAI,oBAAoB,UAAU,uBAAuB,KAAK,YAAY,CAAC;AAG5F,aAAS,QAAQ,IAAI,qBAAqB,QAAQ,KAAK,qBAAqB,GAAG,CAAC;AAGhF,QAAI,mBAAmB,OAAO;AAC5B,eAAS,QAAQ,IAAI,uBAAuB,IAAI,qBAAqB,CAAC,CAAC;AAAA,IACzE;AAEA,WAAO;AAAA,EACT;AACF;;;AEhRA,IAAAA,iBAA0C;AA+D1C,SAAS,mBAAmB,KAAa,eAAgC;AACvE,MAAI,CAAC,IAAK,QAAO;AACjB,MAAI,IAAI,WAAW,GAAG,KAAK,CAAC,IAAI,WAAW,IAAI,EAAG,QAAO;AACzD,MAAI;AACF,WAAO,IAAI,IAAI,GAAG,EAAE,WAAW;AAAA,EACjC,QAAQ;AACN,WAAO;AAAA,EACT;AACF;AAmBA,SAAS,gBAAgB,OAA2B;AAClD,QAAM,SAAS,MAAM,QAAQ,MAAM,GAAG,EAAE,QAAQ,MAAM,GAAG;AACzD,QAAM,SAAS,OAAO,OAAO,OAAO,UAAW,IAAK,OAAO,SAAS,KAAM,GAAI,GAAG;AACjF,QAAM,SAAS,KAAK,MAAM;AAC1B,QAAM,QAAQ,IAAI,WAAW,OAAO,MAAM;AAC1C,WAAS,IAAI,GAAG,IAAI,OAAO,QAAQ,KAAK;AACtC,UAAM,CAAC,IAAI,OAAO,WAAW,CAAC;AAAA,EAChC;AACA,SAAO;AACT;AAEA,SAAS,iBAAiB,OAA+C;AACvE,MAAI;AACF,UAAM,QAAQ,MAAM,MAAM,GAAG;AAC7B,QAAI,MAAM,WAAW,EAAG,QAAO;AAC/B,UAAM,OAAO,IAAI,YAAY,EAAE,OAAO,gBAAgB,MAAM,CAAC,CAAC,CAAC;AAC/D,WAAO,KAAK,MAAM,IAAI;AAAA,EACxB,QAAQ;AACN,WAAO;AAAA,EACT;AACF;AAEA,SAAS,gBAAgB,OAA+C;AACtE,MAAI;AACF,UAAM,QAAQ,MAAM,MAAM,GAAG;AAC7B,QAAI,MAAM,WAAW,EAAG,QAAO;AAC/B,UAAM,OAAO,IAAI,YAAY,EAAE,OAAO,gBAAgB,MAAM,CAAC,CAAC,CAAC;AAC/D,WAAO,KAAK,MAAM,IAAI;AAAA,EACxB,QAAQ;AACN,WAAO;AAAA,EACT;AACF;AAEA,eAAe,UAAU,SAAuC;AAC9D,MAAI;AACF,UAAM,MAAM,MAAM,MAAM,GAAG,OAAO,iBAAiB;AACnD,QAAI,CAAC,IAAI,GAAI,QAAO;AACpB,WAAQ,MAAM,IAAI,KAAK;AAAA,EACzB,QAAQ;AACN,WAAO;AAAA,EACT;AACF;AAEA,eAAe,qBAAqB,OAAe,KAAgC;AACjF,MAAI;AACF,UAAM,CAAC,WAAW,YAAY,SAAS,IAAI,MAAM,MAAM,GAAG;AAC1D,QAAI,CAAC,aAAa,CAAC,IAAI,KAAK,CAAC,IAAI,EAAG,QAAO;AAE3C,UAAM,YAAY,MAAM,OAAO,OAAO;AAAA,MACpC;AAAA,MACA,EAAE,KAAK,OAAO,GAAG,IAAI,GAAG,GAAG,IAAI,GAAG,KAAK,SAAS,KAAK,MAAM;AAAA,MAC3D,EAAE,MAAM,qBAAqB,MAAM,UAAU;AAAA,MAC7C;AAAA,MACA,CAAC,QAAQ;AAAA,IACX;AAEA,UAAM,iBAAiB,gBAAgB,SAAS;AAChD,UAAM,OAAO,IAAI,YAAY,EAAE,OAAO,GAAG,SAAS,IAAI,UAAU,EAAE;AAClE,WAAO,MAAM,OAAO,OAAO;AAAA,MACzB;AAAA,MACA;AAAA,MACA;AAAA,MACA;AAAA,IACF;AAAA,EACF,QAAQ;AACN,WAAO;AAAA,EACT;AACF;AAEA,eAAe,cAAc,aAAsC;AACjE,QAAM,OAAO,MAAM,OAAO,OAAO;AAAA,IAC/B;AAAA,IACA,IAAI,YAAY,EAAE,OAAO,WAAW;AAAA,EACtC;AACA,QAAM,QAAQ,IAAI,WAAW,IAAI;AACjC,QAAM,OAAO,MAAM,MAAM,GAAG,MAAM,SAAS,CAAC;AAC5C,MAAI,SAAS;AACb,aAAW,KAAK,MAAM;AACpB,cAAU,OAAO,aAAa,CAAC;AAAA,EACjC;AACA,SAAO,KAAK,MAAM,EAAE,QAAQ,OAAO,GAAG,EAAE,QAAQ,OAAO,GAAG,EAAE,QAAQ,OAAO,EAAE;AAC/E;AAMA,eAAe,gBACb,SACA,aACA,gBACA,kBACe;AACf,QAAM,SAAS,gBAAgB,OAAO;AACtC,MAAI,CAAC,OAAQ,OAAM,IAAI,MAAM,mCAAe;AAE5C,QAAM,MAAM,OAAO;AACnB,MAAI,OAAO,QAAQ,YAAa,QAAQ,WAAW,QAAQ,SAAU;AACnE,UAAM,IAAI,MAAM,+DAAuB,GAAG,EAAE;AAAA,EAC9C;AAEA,MAAI,QAAQ,SAAS;AACnB,UAAM,OAAO,MAAM,UAAU,cAAc;AAC3C,QAAI,CAAC,KAAM,OAAM,IAAI,MAAM,+BAAW;AACtC,UAAM,MAAM,OAAO,OAAO,QAAQ,WAAW,OAAO,MAAM;AAC1D,UAAM,MAAM,KAAK,KAAK;AAAA,MACpB,CAAC,MACC,EAAE,QAAQ,SACV,EAAE,QAAQ,WACV,EAAE,QAAQ,UACT,MAAM,EAAE,QAAQ,MAAM;AAAA,IAC3B;AACA,QAAI,CAAC,IAAK,OAAM,IAAI,MAAM,uDAAe;AACzC,UAAM,QAAQ,MAAM,qBAAqB,SAAS,GAAG;AACrD,QAAI,CAAC,MAAO,OAAM,IAAI,MAAM,+CAAiB;AAAA,EAC/C;AAGA,MAAI,QAAQ,SAAS;AAEnB,YAAQ;AAAA,MACN;AAAA,IACF;AAAA,EACF;AAEA,QAAM,UAAU,iBAAiB,OAAO;AACxC,MAAI,CAAC,QAAS,OAAM,IAAI,MAAM,2CAAuB;AAErD,QAAM,mBAAmB,eAAe,QAAQ,QAAQ,EAAE;AAC1D,QAAM,cACJ,OAAO,QAAQ,QAAQ,WAAW,QAAQ,IAAI,QAAQ,QAAQ,EAAE,IAAI;AACtE,MAAI,gBAAgB,kBAAkB;AACpC,UAAM,IAAI,MAAM,oCAAqB;AAAA,EACvC;AAEA,QAAM,MAAM,QAAQ;AACpB,QAAM,SAAS,MAAM,QAAQ,GAAG,IAAI,MAAM,CAAC,GAAG;AAC9C,MAAI,CAAC,OAAO,SAAS,gBAAgB,GAAG;AACtC,UAAM,IAAI,MAAM,sCAAuB;AAAA,EACzC;AAEA,MAAI,OAAO,QAAQ,QAAQ,YAAY,KAAK,IAAI,KAAK,QAAQ,MAAM,KAAM;AACvE,UAAM,IAAI,MAAM,6BAAc;AAAA,EAChC;AACA,MAAI,OAAO,QAAQ,QAAQ,YAAY,CAAC,QAAQ,KAAK;AACnD,UAAM,IAAI,MAAM,2BAAiB;AAAA,EACnC;AAEA,MAAI,OAAO,QAAQ,YAAY,YAAY,QAAQ,SAAS;AAC1D,UAAM,SAAS,MAAM,cAAc,WAAW;AAC9C,QAAI,WAAW,QAAQ,SAAS;AAC9B,YAAM,IAAI,MAAM,qCAAsB;AAAA,IACxC;AAAA,EACF;AACF;AAMO,SAAS,2BAA2B,QAA6B;AACtE,QAAM;AAAA,IACJ;AAAA,IACA;AAAA,IACA;AAAA,IACA;AAAA,IACA,oBAAoB;AAAA,IACpB,wBAAwB;AAAA,IACxB,yBAAyB;AAAA,IACzB,oBAAoB;AAAA,IACpB,kBAAkB;AAAA,IAClB,sBAAsB;AAAA,IACtB,qBAAqB;AAAA,EACvB,IAAI;AAEJ,QAAM,iBAAiB,WAAW,QAAQ,QAAQ,EAAE;AAEpD,SAAO,eAAe,IAAI,SAAsB;AAC9C,UAAM,EAAE,aAAa,IAAI,QAAQ;AAGjC,UAAM,QAAQ,aAAa,IAAI,OAAO;AACtC,QAAI,OAAO;AACT,YAAM,OAAO,aAAa,IAAI,mBAAmB,KAAK;AACtD,aAAO,4BAAa;AAAA,QAClB,EAAE,OAAO,wBAAwB,mBAAmB,KAAK;AAAA,QACzD,EAAE,QAAQ,IAAI;AAAA,MAChB;AAAA,IACF;AAEA,UAAM,OAAO,aAAa,IAAI,MAAM;AACpC,UAAM,gBAAgB,aAAa,IAAI,OAAO;AAE9C,QAAI,CAAC,MAAM;AACT,aAAO,4BAAa;AAAA,QAClB;AAAA,UACE,OAAO;AAAA,UACP,mBAAmB;AAAA,QACrB;AAAA,QACA,EAAE,QAAQ,IAAI;AAAA,MAChB;AAAA,IACF;AAGA,UAAM,aAAa,QAAQ,QAAQ,IAAI,eAAe,GAAG;AACzD,QAAI,CAAC,YAAY;AACf,aAAO,4BAAa;AAAA,QAClB;AAAA,UACE,OAAO;AAAA,UACP,mBAAmB;AAAA,QACrB;AAAA,QACA,EAAE,QAAQ,IAAI;AAAA,MAChB;AAAA,IACF;AACA,QAAI,kBAAkB,YAAY;AAChC,aAAO,4BAAa;AAAA,QAClB;AAAA,UACE,OAAO;AAAA,UACP,mBAAmB;AAAA,QACrB;AAAA,QACA,EAAE,QAAQ,IAAI;AAAA,MAChB;AAAA,IACF;AAGA,UAAM,WAAW,QAAQ,QAAQ,IAAI,kBAAkB,GAAG;AAC1D,QAAI,CAAC,UAAU;AACb,aAAO,4BAAa;AAAA,QAClB;AAAA,UACE,OAAO;AAAA,UACP,mBAAmB;AAAA,QACrB;AAAA,QACA,EAAE,QAAQ,IAAI;AAAA,MAChB;AAAA,IACF;AAGA,UAAM,gBAAgB,GAAG,cAAc;AACvC,UAAM,OAAO,IAAI,gBAAgB;AACjC,SAAK,IAAI,cAAc,oBAAoB;AAC3C,SAAK,IAAI,QAAQ,IAAI;AACrB,SAAK,IAAI,aAAa,QAAQ;AAC9B,SAAK,IAAI,gBAAgB,WAAW;AACpC,SAAK,IAAI,iBAAiB,QAAQ;AAClC,QAAI,cAAc;AAChB,WAAK,IAAI,iBAAiB,YAAY;AAAA,IACxC;AAGA,QAAI;AACJ,QAAI;AACJ,UAAM,aAAa;AAEnB,aAAS,UAAU,GAAG,WAAW,YAAY,WAAW;AACtD,UAAI,UAAU,GAAG;AAEf,cAAM,IAAI,QAAQ,CAAC,MAAM,WAAW,GAAG,MAAO,KAAK,IAAI,GAAG,UAAU,CAAC,CAAC,CAAC;AAAA,MACzE;AACA,UAAI;AACF,cAAM,MAAM,MAAM,eAAe;AAAA,UAC/B,QAAQ;AAAA,UACR,SAAS,EAAE,gBAAgB,oCAAoC;AAAA,UAC/D,MAAM,KAAK,SAAS;AAAA,QACtB,CAAC;AACD,oBAAY;AACZ;AAAA,MACF,SAAS,KAAK;AACZ,oBAAY;AACZ,YAAI,WAAW,YAAY;AACzB,iBAAO,4BAAa;AAAA,YAClB,EAAE,OAAO,gBAAgB,mBAAmB,iFAAqB;AAAA,YACjE,EAAE,QAAQ,IAAI;AAAA,UAChB;AAAA,QACF;AAAA,MACF;AAAA,IACF;AAEA,QAAI,aAAa,CAAC,KAAM;AACtB,aAAO,4BAAa;AAAA,QAClB,EAAE,OAAO,gBAAgB,mBAAmB,iCAAa;AAAA,QACzD,EAAE,QAAQ,IAAI;AAAA,MAChB;AAAA,IACF;AAEA,QAAI,CAAC,IAAI,IAAI;AACX,UAAI,UAAmC,CAAC;AACxC,UAAI;AACF,kBAAU,MAAM,IAAI,KAAK;AAAA,MAC3B,QAAQ;AAAA,MAAe;AACvB,aAAO,4BAAa;AAAA,QAClB;AAAA,UACE,OAAO;AAAA,UACP,mBACG,QAAQ,qBAAgC,wCAAoB,IAAI,MAAM;AAAA,QAC3E;AAAA,QACA,EAAE,QAAQ,IAAI;AAAA,MAChB;AAAA,IACF;AAEA,UAAM,YAMF,MAAM,IAAI,KAAK;AAGnB,QAAI,UAAU,UAAU;AACtB,UAAI;AACF,cAAM;AAAA,UACJ,UAAU;AAAA,UACV,UAAU;AAAA,UACV;AAAA,UACA;AAAA,QACF;AAAA,MACF,SAAS,KAAK;AACZ,eAAO,4BAAa;AAAA,UAClB;AAAA,YACE,OAAO;AAAA,YACP,mBAAmB,eAAe,QAAQ,IAAI,UAAU;AAAA,UAC1D;AAAA,UACA,EAAE,QAAQ,IAAI;AAAA,QAChB;AAAA,MACF;AAAA,IACF;AAGA,UAAM,eACJ,QAAQ,QAAQ,IAAI,mBAAmB,GAAG,SAAS;AACrD,UAAM,YAAY,mBAAmB,cAAc,QAAQ,QAAQ,MAAM,IACrE,eACA;AAGJ,UAAM,WAAW,4BAAa,SAAS,IAAI,IAAI,WAAW,QAAQ,GAAG,CAAC;AAGtE,aAAS,QAAQ,IAAI,uBAAuB,UAAU,cAAc;AAAA,MAClE,GAAG,qBAAqB,UAAU,UAAU;AAAA,IAC9C,CAAC;AAKD,UAAM,gBACH,UAAsC,sBAAsB,OACxD,UAAsC,qBACvC,KAAK,KAAK,KAAK;AAErB,aAAS,QAAQ,IAAI,wBAAwB,UAAU,eAAe;AAAA,MACpE,GAAG,qBAAqB,aAAa;AAAA,IACvC,CAAC;AAGD,QAAI,UAAU,UAAU;AACtB,eAAS,QAAQ,IAAI,mBAAmB,UAAU,UAAU;AAAA,QAC1D,GAAG,qBAAqB,aAAa;AAAA,MACvC,CAAC;AAAA,IACH;AAGA,aAAS,QAAQ,IAAI,iBAAiB,IAAI,qBAAqB,CAAC,CAAC;AACjE,aAAS,QAAQ,IAAI,qBAAqB,IAAI,qBAAqB,CAAC,CAAC;AAKrE,aAAS,QAAQ,IAAI,oBAAoB,IAAI,uBAAuB,GAAG,GAAG,CAAC;AAC3E,aAAS,QAAQ,IAAI,oBAAoB,IAAI,uBAAuB,GAAG,QAAQ,QAAQ,QAAQ,CAAC;AAEhG,WAAO;AAAA,EACT;AACF;;;ACjdA,IAAAC,iBAA0C;AAuE1C,eAAe,eAAe,YAAmD;AAC/E,MAAI;AACF,UAAM,aAAa,IAAI,gBAAgB;AACvC,eAAW,MAAM,WAAW,MAAM,GAAG,GAAI;AACzC,UAAM,MAAM,MAAM;AAAA,MAChB,GAAG,UAAU;AAAA,MACb,EAAE,QAAQ,WAAW,OAAO;AAAA,IAC9B;AACA,QAAI,CAAC,IAAI,GAAI,QAAO;AACpB,WAAQ,MAAM,IAAI,KAAK;AAAA,EACzB,QAAQ;AACN,WAAO;AAAA,EACT;AACF;AAMO,SAAS,yBAAyB,QAA2B;AAClE,QAAM;AAAA,IACJ;AAAA,IACA;AAAA,IACA;AAAA,IACA;AAAA,IACA,wBAAwB,IAAI,IAAI,WAAW,EAAE,SAAS;AAAA,IACtD,gBAAgB;AAAA,IAChB,wBAAwB;AAAA,IACxB,yBAAyB;AAAA,IACzB,oBAAoB;AAAA,IACpB,kBAAkB;AAAA,IAClB,sBAAsB;AAAA,IACtB,qBAAqB;AAAA,IACrB,eAAe;AAAA,EACjB,IAAI;AAEJ,QAAM,iBAAiB,WAAW,QAAQ,QAAQ,EAAE;AAEpD,SAAO,eAAe,IAAI,SAAsB;AAC9C,UAAM,eAAe,QAAQ,QAAQ,IAAI,sBAAsB,GAAG;AAClE,UAAM,cAAc,QAAQ,QAAQ,IAAI,iBAAiB,GAAG;AAG5D,QAAI,cAAc;AAChB,UAAI;AACF,cAAM,YAAY,MAAM,eAAe,cAAc;AACrD,cAAM,YACJ,WAAW,uBAAuB,GAAG,cAAc;AACrD,cAAM,OAAO,IAAI,gBAAgB;AAAA,UAC/B,OAAO;AAAA,UACP,iBAAiB;AAAA,UACjB,WAAW;AAAA,QACb,CAAC;AACD,YAAI,cAAc;AAChB,eAAK,IAAI,iBAAiB,YAAY;AAAA,QACxC;AACA,cAAM,MAAM,WAAW;AAAA,UACrB,QAAQ;AAAA,UACR,SAAS,EAAE,gBAAgB,oCAAoC;AAAA,UAC/D,MAAM,KAAK,SAAS;AAAA,QACtB,CAAC;AAAA,MACH,QAAQ;AAAA,MAER;AAAA,IACF;AAGA,UAAM,eAAe,CAAC,QAAsB;AAC1C,UAAI,QAAQ,IAAI,uBAAuB,IAAI,qBAAqB,CAAC,CAAC;AAClE,UAAI,QAAQ,IAAI,wBAAwB,IAAI,qBAAqB,CAAC,CAAC;AACnE,UAAI,QAAQ,IAAI,mBAAmB,IAAI,qBAAqB,CAAC,CAAC;AAC9D,UAAI,QAAQ,IAAI,iBAAiB,IAAI,qBAAqB,CAAC,CAAC;AAC5D,UAAI,QAAQ,IAAI,qBAAqB,IAAI,qBAAqB,CAAC,CAAC;AAChE,UAAI,QAAQ,IAAI,oBAAoB,IAAI,uBAAuB,GAAG,GAAG,CAAC;AACtE,UAAI,QAAQ,IAAI,oBAAoB,IAAI,uBAAuB,GAAG,YAAY,CAAC;AAC/E,aAAO;AAAA,IACT;AAGA,QAAI,eAAe;AACjB,YAAM,YAAY,MAAM,eAAe,cAAc;AACrD,YAAM,qBACJ,WAAW,wBAAwB,GAAG,cAAc;AACtD,YAAM,YAAY,IAAI,IAAI,kBAAkB;AAC5C,gBAAU,aAAa,IAAI,aAAa,QAAQ;AAChD,gBAAU,aAAa;AAAA,QACrB;AAAA,QACA;AAAA,MACF;AACA,UAAI,aAAa;AACf,kBAAU,aAAa,IAAI,iBAAiB,WAAW;AAAA,MACzD;AACA,aAAO,aAAa,4BAAa,SAAS,UAAU,SAAS,CAAC,CAAC;AAAA,IACjE;AAEA,WAAO;AAAA,MACL,4BAAa,SAAS,QAAQ,QAAQ,SAAS,GAAG;AAAA,IACpD;AAAA,EACF;AACF;","names":["import_server","import_server"]}

package/dist/next/index.mjs

@@ -0,0 +1,547 @@
+// src/next/middleware.ts
+import { NextResponse } from "next/server";
+
+// src/next/constants.ts
+var DEFAULT_ACCESS_TOKEN_COOKIE_NAME = "__Host-nihplod_sso_at";
+var DEFAULT_REFRESH_TOKEN_COOKIE_NAME = "__Host-nihplod_sso_rt";
+var DEFAULT_ID_TOKEN_COOKIE_NAME = "__Host-nihplod_sso_id";
+var DEFAULT_STATE_COOKIE_NAME = "__Host-nihplod_sso_state";
+var DEFAULT_RETURN_COOKIE_NAME = "__Host-nihplod_sso_return";
+var DEFAULT_VERIFIER_COOKIE_NAME = "__Secure-nihplod_sso_verifier";
+function getHostCookieOptions(maxAge) {
+  return {
+    httpOnly: true,
+    secure: true,
+    sameSite: "lax",
+    path: "/",
+    ...maxAge !== void 0 ? { maxAge } : {}
+  };
+}
+function getSecureCookieOptions(maxAge, path = "/") {
+  return {
+    httpOnly: true,
+    secure: true,
+    sameSite: "lax",
+    path,
+    ...maxAge !== void 0 ? { maxAge } : {}
+  };
+}
+
+// src/next/middleware.ts
+function generateRandomString(length) {
+  const chars = "ABCDEFGHIJKLMNOPQRSTUVWXYZabcdefghijklmnopqrstuvwxyz0123456789-._~";
+  const maxValid = Math.floor(256 / chars.length) * chars.length;
+  let result = "";
+  while (result.length < length) {
+    const array = new Uint8Array(length * 2);
+    crypto.getRandomValues(array);
+    for (let i = 0; i < array.length && result.length < length; i++) {
+      if (array[i] >= maxValid) continue;
+      result += chars[array[i] % chars.length];
+    }
+  }
+  return result;
+}
+async function computeCodeChallenge(verifier) {
+  const encoder = new TextEncoder();
+  const data = encoder.encode(verifier);
+  const hash = await crypto.subtle.digest("SHA-256", data);
+  const bytes = new Uint8Array(hash);
+  let binary = "";
+  for (let i = 0; i < bytes.byteLength; i++) {
+    binary += String.fromCharCode(bytes[i]);
+  }
+  return btoa(binary).replace(/\+/g, "-").replace(/\//g, "_").replace(/=+$/, "");
+}
+function matchesPath(pathname, paths) {
+  return paths.some((path) => {
+    if (pathname === path) return true;
+    if (path.endsWith("/:path*") && pathname.startsWith(path.replace("/:path*", ""))) return true;
+    if (pathname.startsWith(path + "/")) return true;
+    return false;
+  });
+}
+async function introspectAccessToken(token, ssoBaseUrl, clientId, clientSecret) {
+  try {
+    const body = new URLSearchParams({
+      token,
+      token_type_hint: "access_token",
+      client_id: clientId
+    });
+    if (clientSecret) {
+      body.set("client_secret", clientSecret);
+    }
+    const res = await fetch(`${ssoBaseUrl}/api/oauth/introspect`, {
+      method: "POST",
+      headers: { "Content-Type": "application/x-www-form-urlencoded" },
+      body: body.toString()
+    });
+    if (!res.ok) return false;
+    const data = await res.json();
+    return data.active === true;
+  } catch {
+    return false;
+  }
+}
+function createSsoMiddleware(config) {
+  const {
+    clientId,
+    clientSecret,
+    ssoBaseUrl,
+    redirectUri,
+    scopes = "openid profile",
+    publicPaths = [],
+    callbackPath = "/api/auth/callback",
+    ssoCookieName = "__Host-user_token",
+    accessTokenCookieName = DEFAULT_ACCESS_TOKEN_COOKIE_NAME,
+    stateCookieName = DEFAULT_STATE_COOKIE_NAME,
+    returnUrlCookieName = DEFAULT_RETURN_COOKIE_NAME,
+    verifierCookieName = DEFAULT_VERIFIER_COOKIE_NAME
+  } = config;
+  const normalizedBase = ssoBaseUrl.replace(/\/+$/, "");
+  return async function ssoMiddleware(request) {
+    const { pathname } = request.nextUrl;
+    if (pathname.startsWith("/_next/") || pathname.startsWith("/favicon.ico") || pathname.match(/\.(ico|png|jpg|jpeg|svg|css|js|woff2?)$/)) {
+      return NextResponse.next();
+    }
+    if (pathname === callbackPath) {
+      return NextResponse.next();
+    }
+    const allPublicPaths = [callbackPath, ...publicPaths];
+    if (matchesPath(pathname, allPublicPaths)) {
+      return NextResponse.next();
+    }
+    const ssoSession = request.cookies.get(ssoCookieName);
+    if (ssoSession?.value) {
+      return NextResponse.next();
+    }
+    const accessTokenCookie = request.cookies.get(accessTokenCookieName);
+    if (accessTokenCookie?.value) {
+      const tokenActive = await introspectAccessToken(
+        accessTokenCookie.value,
+        normalizedBase,
+        clientId,
+        clientSecret
+      );
+      if (tokenActive) {
+        return NextResponse.next();
+      }
+    }
+    const state = generateRandomString(32);
+    const verifier = generateRandomString(64);
+    const challenge = await computeCodeChallenge(verifier);
+    const authorizeParams = new URLSearchParams();
+    authorizeParams.set("response_type", "code");
+    authorizeParams.set("client_id", clientId);
+    authorizeParams.set("redirect_uri", redirectUri);
+    authorizeParams.set("scope", scopes);
+    authorizeParams.set("state", state);
+    authorizeParams.set("code_challenge", challenge);
+    authorizeParams.set("code_challenge_method", "S256");
+    const loginUrl = new URL("/api/oauth/authorize", normalizedBase);
+    loginUrl.search = authorizeParams.toString();
+    const response = NextResponse.redirect(loginUrl);
+    response.cookies.set(stateCookieName, state, getHostCookieOptions(600));
+    response.cookies.set(verifierCookieName, verifier, getSecureCookieOptions(600, callbackPath));
+    response.cookies.set(returnUrlCookieName, request.url, getHostCookieOptions(600));
+    if (accessTokenCookie?.value) {
+      response.cookies.set(accessTokenCookieName, "", getHostCookieOptions(0));
+    }
+    return response;
+  };
+}
+
+// src/next/callback.ts
+import { NextResponse as NextResponse2 } from "next/server";
+function isTrustedReturnUrl(url, currentOrigin) {
+  if (!url) return false;
+  if (url.startsWith("/") && !url.startsWith("//")) return true;
+  try {
+    return new URL(url).origin === currentOrigin;
+  } catch {
+    return false;
+  }
+}
+function base64UrlDecode(input) {
+  const base64 = input.replace(/-/g, "+").replace(/_/g, "/");
+  const padded = base64.padEnd(base64.length + (4 - base64.length % 4) % 4, "=");
+  const binary = atob(padded);
+  const bytes = new Uint8Array(binary.length);
+  for (let i = 0; i < binary.length; i++) {
+    bytes[i] = binary.charCodeAt(i);
+  }
+  return bytes;
+}
+function decodeJwtPayload(token) {
+  try {
+    const parts = token.split(".");
+    if (parts.length !== 3) return null;
+    const json = new TextDecoder().decode(base64UrlDecode(parts[1]));
+    return JSON.parse(json);
+  } catch {
+    return null;
+  }
+}
+function decodeJwtHeader(token) {
+  try {
+    const parts = token.split(".");
+    if (parts.length !== 3) return null;
+    const json = new TextDecoder().decode(base64UrlDecode(parts[0]));
+    return JSON.parse(json);
+  } catch {
+    return null;
+  }
+}
+async function fetchJwks(baseUrl) {
+  try {
+    const res = await fetch(`${baseUrl}/api/oauth/jwks`);
+    if (!res.ok) return null;
+    return await res.json();
+  } catch {
+    return null;
+  }
+}
+async function verifyRs256Signature(token, jwk) {
+  try {
+    const [headerB64, payloadB64, signature] = token.split(".");
+    if (!signature || !jwk.n || !jwk.e) return false;
+    const cryptoKey = await crypto.subtle.importKey(
+      "jwk",
+      { kty: "RSA", n: jwk.n, e: jwk.e, alg: "RS256", ext: false },
+      { name: "RSASSA-PKCS1-v1_5", hash: "SHA-256" },
+      false,
+      ["verify"]
+    );
+    const signatureBytes = base64UrlDecode(signature);
+    const data = new TextEncoder().encode(`${headerB64}.${payloadB64}`);
+    return await crypto.subtle.verify(
+      "RSASSA-PKCS1-v1_5",
+      cryptoKey,
+      signatureBytes,
+      data
+    );
+  } catch {
+    return false;
+  }
+}
+async function computeAtHash(accessToken) {
+  const hash = await crypto.subtle.digest(
+    "SHA-256",
+    new TextEncoder().encode(accessToken)
+  );
+  const bytes = new Uint8Array(hash);
+  const half = bytes.slice(0, bytes.length / 2);
+  let binary = "";
+  for (const b of half) {
+    binary += String.fromCharCode(b);
+  }
+  return btoa(binary).replace(/\+/g, "-").replace(/\//g, "_").replace(/=+$/, "");
+}
+async function validateIdToken(idToken, accessToken, expectedIssuer, expectedClientId) {
+  const header = decodeJwtHeader(idToken);
+  if (!header) throw new Error("ID Token \u683C\u5F0F\u9519\u8BEF");
+  const alg = header.alg;
+  if (typeof alg !== "string" || alg !== "RS256" && alg !== "HS256") {
+    throw new Error(`\u4E0D\u652F\u6301\u7684 ID Token \u7B7E\u540D\u7B97\u6CD5: ${alg}`);
+  }
+  if (alg === "RS256") {
+    const jwks = await fetchJwks(expectedIssuer);
+    if (!jwks) throw new Error("\u65E0\u6CD5\u83B7\u53D6 JWKS");
+    const kid = typeof header.kid === "string" ? header.kid : void 0;
+    const key = jwks.keys.find(
+      (k) => k.kty === "RSA" && k.alg === "RS256" && k.use === "sig" && (kid ? k.kid === kid : true)
+    );
+    if (!key) throw new Error("JWKS \u4E2D\u672A\u627E\u5230\u5339\u914D\u516C\u94A5");
+    const valid = await verifyRs256Signature(idToken, key);
+    if (!valid) throw new Error("ID Token \u7B7E\u540D\u9A8C\u8BC1\u5931\u8D25");
+  }
+  if (alg === "HS256") {
+    console.warn(
+      "[SSO SDK/Next] ID Token \u4F7F\u7528 HS256 \u7B7E\u540D\u3002\u5EFA\u8BAE\u4E3B\u7AD9\u542F\u7528 RS256 \u4EE5\u83B7\u5F97\u5B8C\u6574\u7B7E\u540D\u9A8C\u8BC1\u3002"
+    );
+  }
+  const payload = decodeJwtPayload(idToken);
+  if (!payload) throw new Error("ID Token payload \u89E3\u6790\u5931\u8D25");
+  const normalizedIssuer = expectedIssuer.replace(/\/+$/, "");
+  const tokenIssuer = typeof payload.iss === "string" ? payload.iss.replace(/\/+$/, "") : "";
+  if (tokenIssuer !== normalizedIssuer) {
+    throw new Error("ID Token issuer \u4E0D\u5339\u914D");
+  }
+  const aud = payload.aud;
+  const audArr = Array.isArray(aud) ? aud : [aud];
+  if (!audArr.includes(expectedClientId)) {
+    throw new Error("ID Token audience \u4E0D\u5339\u914D");
+  }
+  if (typeof payload.exp === "number" && Date.now() >= payload.exp * 1e3) {
+    throw new Error("ID Token \u5DF2\u8FC7\u671F");
+  }
+  if (typeof payload.sub !== "string" || !payload.sub) {
+    throw new Error("ID Token \u7F3A\u5C11 sub");
+  }
+  if (typeof payload.at_hash === "string" && payload.at_hash) {
+    const actual = await computeAtHash(accessToken);
+    if (actual !== payload.at_hash) {
+      throw new Error("ID Token at_hash \u4E0D\u5339\u914D");
+    }
+  }
+}
+function createCallbackRouteHandler(config) {
+  const {
+    clientId,
+    ssoBaseUrl,
+    redirectUri,
+    clientSecret,
+    defaultReturnPath = "/",
+    accessTokenCookieName = DEFAULT_ACCESS_TOKEN_COOKIE_NAME,
+    refreshTokenCookieName = DEFAULT_REFRESH_TOKEN_COOKIE_NAME,
+    idTokenCookieName = DEFAULT_ID_TOKEN_COOKIE_NAME,
+    stateCookieName = DEFAULT_STATE_COOKIE_NAME,
+    returnUrlCookieName = DEFAULT_RETURN_COOKIE_NAME,
+    verifierCookieName = DEFAULT_VERIFIER_COOKIE_NAME
+  } = config;
+  const normalizedBase = ssoBaseUrl.replace(/\/+$/, "");
+  return async function GET(request) {
+    const { searchParams } = request.nextUrl;
+    const error = searchParams.get("error");
+    if (error) {
+      const desc = searchParams.get("error_description") || error;
+      return NextResponse2.json(
+        { error: "authorization_failed", error_description: desc },
+        { status: 400 }
+      );
+    }
+    const code = searchParams.get("code");
+    const returnedState = searchParams.get("state");
+    if (!code) {
+      return NextResponse2.json(
+        {
+          error: "invalid_request",
+          error_description: "\u7F3A\u5C11 authorization code"
+        },
+        { status: 400 }
+      );
+    }
+    const savedState = request.cookies.get(stateCookieName)?.value;
+    if (!savedState) {
+      return NextResponse2.json(
+        {
+          error: "invalid_request",
+          error_description: "State \u53C2\u6570\u7F3A\u5931\uFF0C\u8BF7\u91CD\u65B0\u53D1\u8D77\u6388\u6743\u8BF7\u6C42"
+        },
+        { status: 400 }
+      );
+    }
+    if (returnedState !== savedState) {
+      return NextResponse2.json(
+        {
+          error: "invalid_request",
+          error_description: "State \u53C2\u6570\u4E0D\u5339\u914D\uFF0C\u53EF\u80FD\u5B58\u5728 CSRF \u653B\u51FB"
+        },
+        { status: 400 }
+      );
+    }
+    const verifier = request.cookies.get(verifierCookieName)?.value;
+    if (!verifier) {
+      return NextResponse2.json(
+        {
+          error: "invalid_request",
+          error_description: "PKCE verifier \u7F3A\u5931\uFF0C\u8BF7\u91CD\u65B0\u53D1\u8D77\u6388\u6743\u8BF7\u6C42"
+        },
+        { status: 400 }
+      );
+    }
+    const tokenEndpoint = `${normalizedBase}/api/oauth/token`;
+    const body = new URLSearchParams();
+    body.set("grant_type", "authorization_code");
+    body.set("code", code);
+    body.set("client_id", clientId);
+    body.set("redirect_uri", redirectUri);
+    body.set("code_verifier", verifier);
+    if (clientSecret) {
+      body.set("client_secret", clientSecret);
+    }
+    let res;
+    let lastError;
+    const maxRetries = 1;
+    for (let attempt = 0; attempt <= maxRetries; attempt++) {
+      if (attempt > 0) {
+        await new Promise((r) => setTimeout(r, 1e3 * Math.pow(2, attempt - 1)));
+      }
+      try {
+        res = await fetch(tokenEndpoint, {
+          method: "POST",
+          headers: { "Content-Type": "application/x-www-form-urlencoded" },
+          body: body.toString()
+        });
+        lastError = null;
+        break;
+      } catch (err) {
+        lastError = err;
+        if (attempt >= maxRetries) {
+          return NextResponse2.json(
+            { error: "server_error", error_description: "Token \u8BF7\u6C42\u5931\u8D25\uFF0C\u5DF2\u91CD\u8BD5\u4ECD\u4E0D\u53EF\u8FBE" },
+            { status: 502 }
+          );
+        }
+      }
+    }
+    if (lastError || !res) {
+      return NextResponse2.json(
+        { error: "server_error", error_description: "Token \u8BF7\u6C42\u5931\u8D25" },
+        { status: 502 }
+      );
+    }
+    if (!res.ok) {
+      let errData = {};
+      try {
+        errData = await res.json();
+      } catch {
+      }
+      return NextResponse2.json(
+        {
+          error: "token_request_failed",
+          error_description: errData.error_description || `Token \u8BF7\u6C42\u5931\u8D25: HTTP ${res.status}`
+        },
+        { status: 502 }
+      );
+    }
+    const tokenData = await res.json();
+    if (tokenData.id_token) {
+      try {
+        await validateIdToken(
+          tokenData.id_token,
+          tokenData.access_token,
+          normalizedBase,
+          clientId
+        );
+      } catch (err) {
+        return NextResponse2.json(
+          {
+            error: "id_token_invalid",
+            error_description: err instanceof Error ? err.message : "ID Token \u9A8C\u8BC1\u5931\u8D25"
+          },
+          { status: 400 }
+        );
+      }
+    }
+    const rawReturnUrl = request.cookies.get(returnUrlCookieName)?.value || defaultReturnPath;
+    const returnUrl = isTrustedReturnUrl(rawReturnUrl, request.nextUrl.origin) ? rawReturnUrl : "/";
+    const response = NextResponse2.redirect(new URL(returnUrl, request.url));
+    response.cookies.set(accessTokenCookieName, tokenData.access_token, {
+      ...getHostCookieOptions(tokenData.expires_in)
+    });
+    const refreshMaxAge = tokenData.refresh_expires_in != null ? tokenData.refresh_expires_in : 30 * 24 * 60 * 60;
+    response.cookies.set(refreshTokenCookieName, tokenData.refresh_token, {
+      ...getHostCookieOptions(refreshMaxAge)
+    });
+    if (tokenData.id_token) {
+      response.cookies.set(idTokenCookieName, tokenData.id_token, {
+        ...getHostCookieOptions(refreshMaxAge)
+      });
+    }
+    response.cookies.set(stateCookieName, "", getHostCookieOptions(0));
+    response.cookies.set(returnUrlCookieName, "", getHostCookieOptions(0));
+    response.cookies.set(verifierCookieName, "", getSecureCookieOptions(0, "/"));
+    response.cookies.set(verifierCookieName, "", getSecureCookieOptions(0, request.nextUrl.pathname));
+    return response;
+  };
+}
+
+// src/next/logout.ts
+import { NextResponse as NextResponse3 } from "next/server";
+async function fetchDiscovery(ssoBaseUrl) {
+  try {
+    const controller = new AbortController();
+    setTimeout(() => controller.abort(), 5e3);
+    const res = await fetch(
+      `${ssoBaseUrl}/api/oauth/.well-known/openid-configuration`,
+      { signal: controller.signal }
+    );
+    if (!res.ok) return null;
+    return await res.json();
+  } catch {
+    return null;
+  }
+}
+function createLogoutRouteHandler(config) {
+  const {
+    clientId,
+    ssoBaseUrl,
+    redirectUri,
+    clientSecret,
+    postLogoutRedirectUri = new URL(redirectUri).origin + "/",
+    redirectToSso = true,
+    accessTokenCookieName = DEFAULT_ACCESS_TOKEN_COOKIE_NAME,
+    refreshTokenCookieName = DEFAULT_REFRESH_TOKEN_COOKIE_NAME,
+    idTokenCookieName = DEFAULT_ID_TOKEN_COOKIE_NAME,
+    stateCookieName = DEFAULT_STATE_COOKIE_NAME,
+    returnUrlCookieName = DEFAULT_RETURN_COOKIE_NAME,
+    verifierCookieName = DEFAULT_VERIFIER_COOKIE_NAME,
+    callbackPath = "/api/auth/callback"
+  } = config;
+  const normalizedBase = ssoBaseUrl.replace(/\/+$/, "");
+  return async function GET(request) {
+    const refreshToken = request.cookies.get(refreshTokenCookieName)?.value;
+    const idTokenHint = request.cookies.get(idTokenCookieName)?.value;
+    if (refreshToken) {
+      try {
+        const discovery = await fetchDiscovery(normalizedBase);
+        const revokeUrl = discovery?.revocation_endpoint || `${normalizedBase}/api/oauth/revoke`;
+        const body = new URLSearchParams({
+          token: refreshToken,
+          token_type_hint: "refresh_token",
+          client_id: clientId
+        });
+        if (clientSecret) {
+          body.set("client_secret", clientSecret);
+        }
+        await fetch(revokeUrl, {
+          method: "POST",
+          headers: { "Content-Type": "application/x-www-form-urlencoded" },
+          body: body.toString()
+        });
+      } catch {
+      }
+    }
+    const clearCookies = (res) => {
+      res.cookies.set(accessTokenCookieName, "", getHostCookieOptions(0));
+      res.cookies.set(refreshTokenCookieName, "", getHostCookieOptions(0));
+      res.cookies.set(idTokenCookieName, "", getHostCookieOptions(0));
+      res.cookies.set(stateCookieName, "", getHostCookieOptions(0));
+      res.cookies.set(returnUrlCookieName, "", getHostCookieOptions(0));
+      res.cookies.set(verifierCookieName, "", getSecureCookieOptions(0, "/"));
+      res.cookies.set(verifierCookieName, "", getSecureCookieOptions(0, callbackPath));
+      return res;
+    };
+    if (redirectToSso) {
+      const discovery = await fetchDiscovery(normalizedBase);
+      const endSessionEndpoint = discovery?.end_session_endpoint || `${normalizedBase}/logout`;
+      const logoutUrl = new URL(endSessionEndpoint);
+      logoutUrl.searchParams.set("client_id", clientId);
+      logoutUrl.searchParams.set(
+        "post_logout_redirect_uri",
+        postLogoutRedirectUri
+      );
+      if (idTokenHint) {
+        logoutUrl.searchParams.set("id_token_hint", idTokenHint);
+      }
+      return clearCookies(NextResponse3.redirect(logoutUrl.toString()));
+    }
+    return clearCookies(
+      NextResponse3.redirect(request.nextUrl.origin + "/")
+    );
+  };
+}
+export {
+  DEFAULT_ACCESS_TOKEN_COOKIE_NAME,
+  DEFAULT_REFRESH_TOKEN_COOKIE_NAME,
+  DEFAULT_RETURN_COOKIE_NAME,
+  DEFAULT_STATE_COOKIE_NAME,
+  DEFAULT_VERIFIER_COOKIE_NAME,
+  createCallbackRouteHandler,
+  createLogoutRouteHandler,
+  createSsoMiddleware,
+  getHostCookieOptions,
+  getSecureCookieOptions
+};
+//# sourceMappingURL=index.mjs.map