@oauth42/next 0.2.4 → 0.2.5

package/dist/client/index.d.mts

@@ -290,10 +290,13 @@ declare function simulateApproval(challengeId: string, selectedCode: string): Pr
     success: boolean;
 }>;
 /**
- * Logout the current user
+ * Logout the current user from the app only (app-level logout)
  *
- * Calls the logout API route to clear backend session and oauth42_session cookie,
- * then calls next-auth signOut to clear the next-auth session and redirect.
+ * This clears the next-auth session for this app only. The user remains
+ * logged into the OAuth42 provider and will auto-authenticate on next login.
+ * This is standard SSO behavior.
+ *
+ * For provider-level logout (sign out of all apps), use logoutEverywhere().
  *
  * @param callbackUrl - URL to redirect to after logout (default: '/')
  *
@@ -309,5 +312,28 @@ declare function simulateApproval(challengeId: string, selectedCode: string): Pr
 declare function logout(options?: {
     callbackUrl?: string;
 }): Promise<void>;
+/**
+ * Logout the current user from ALL apps using OAuth42 (provider-level logout)
+ *
+ * This redirects to the OAuth42 provider's logout endpoint to clear the
+ * oauth42_session cookie, effectively logging the user out of all apps.
+ *
+ * Use this when testing fresh login flows or when the user explicitly
+ * wants to sign out of everything.
+ *
+ * @param issuer - The OAuth42 issuer URL (e.g., 'https://localhost:8443')
+ * @param callbackUrl - URL to redirect to after logout (default: current origin)
+ *
+ * @example
+ * ```tsx
+ * import { logoutEverywhere } from '@oauth42/next/client';
+ *
+ * const handleLogoutEverywhere = () => {
+ *   const issuer = process.env.NEXT_PUBLIC_OAUTH42_ISSUER || 'https://localhost:8443';
+ *   logoutEverywhere(issuer, '/auth/signin');
+ * };
+ * ```
+ */
+declare function logoutEverywhere(issuer: string, callbackUrl?: string): void;
 
-export { type AuthError, AuthStatus, type AuthStatusProps, DEFAULT_HOSTED_AUTH_CONFIG, type HostedAuthConfig, type HostedAuthOptions, type LoginWithAuthenticatorOptions, type LoginWithPasswordOptions, type OAuth42Session, ProtectedComponent, type ProtectedComponentProps, SignInButton, type SignInButtonProps, SignOutButton, type SignOutButtonProps, type UseOAuth42SessionReturn, UserProfile, type UserProfileProps, completeAuthenticatorLogin, initiateAuthenticatorLogin, loginWithPassword, logout, redirectToHostedAuth, simulateApproval, useOAuth42Session, useOAuth42Tokens, useOAuth42User, useRequireAuth, verifyState };
+export { type AuthError, AuthStatus, type AuthStatusProps, DEFAULT_HOSTED_AUTH_CONFIG, type HostedAuthConfig, type HostedAuthOptions, type LoginWithAuthenticatorOptions, type LoginWithPasswordOptions, type OAuth42Session, ProtectedComponent, type ProtectedComponentProps, SignInButton, type SignInButtonProps, SignOutButton, type SignOutButtonProps, type UseOAuth42SessionReturn, UserProfile, type UserProfileProps, completeAuthenticatorLogin, initiateAuthenticatorLogin, loginWithPassword, logout, logoutEverywhere, redirectToHostedAuth, simulateApproval, useOAuth42Session, useOAuth42Tokens, useOAuth42User, useRequireAuth, verifyState };

package/dist/client/index.d.ts

@@ -290,10 +290,13 @@ declare function simulateApproval(challengeId: string, selectedCode: string): Pr
     success: boolean;
 }>;
 /**
- * Logout the current user
+ * Logout the current user from the app only (app-level logout)
  *
- * Calls the logout API route to clear backend session and oauth42_session cookie,
- * then calls next-auth signOut to clear the next-auth session and redirect.
+ * This clears the next-auth session for this app only. The user remains
+ * logged into the OAuth42 provider and will auto-authenticate on next login.
+ * This is standard SSO behavior.
+ *
+ * For provider-level logout (sign out of all apps), use logoutEverywhere().
  *
  * @param callbackUrl - URL to redirect to after logout (default: '/')
  *
@@ -309,5 +312,28 @@ declare function simulateApproval(challengeId: string, selectedCode: string): Pr
 declare function logout(options?: {
     callbackUrl?: string;
 }): Promise<void>;
+/**
+ * Logout the current user from ALL apps using OAuth42 (provider-level logout)
+ *
+ * This redirects to the OAuth42 provider's logout endpoint to clear the
+ * oauth42_session cookie, effectively logging the user out of all apps.
+ *
+ * Use this when testing fresh login flows or when the user explicitly
+ * wants to sign out of everything.
+ *
+ * @param issuer - The OAuth42 issuer URL (e.g., 'https://localhost:8443')
+ * @param callbackUrl - URL to redirect to after logout (default: current origin)
+ *
+ * @example
+ * ```tsx
+ * import { logoutEverywhere } from '@oauth42/next/client';
+ *
+ * const handleLogoutEverywhere = () => {
+ *   const issuer = process.env.NEXT_PUBLIC_OAUTH42_ISSUER || 'https://localhost:8443';
+ *   logoutEverywhere(issuer, '/auth/signin');
+ * };
+ * ```
+ */
+declare function logoutEverywhere(issuer: string, callbackUrl?: string): void;
 
-export { type AuthError, AuthStatus, type AuthStatusProps, DEFAULT_HOSTED_AUTH_CONFIG, type HostedAuthConfig, type HostedAuthOptions, type LoginWithAuthenticatorOptions, type LoginWithPasswordOptions, type OAuth42Session, ProtectedComponent, type ProtectedComponentProps, SignInButton, type SignInButtonProps, SignOutButton, type SignOutButtonProps, type UseOAuth42SessionReturn, UserProfile, type UserProfileProps, completeAuthenticatorLogin, initiateAuthenticatorLogin, loginWithPassword, logout, redirectToHostedAuth, simulateApproval, useOAuth42Session, useOAuth42Tokens, useOAuth42User, useRequireAuth, verifyState };
+export { type AuthError, AuthStatus, type AuthStatusProps, DEFAULT_HOSTED_AUTH_CONFIG, type HostedAuthConfig, type HostedAuthOptions, type LoginWithAuthenticatorOptions, type LoginWithPasswordOptions, type OAuth42Session, ProtectedComponent, type ProtectedComponentProps, SignInButton, type SignInButtonProps, SignOutButton, type SignOutButtonProps, type UseOAuth42SessionReturn, UserProfile, type UserProfileProps, completeAuthenticatorLogin, initiateAuthenticatorLogin, loginWithPassword, logout, logoutEverywhere, redirectToHostedAuth, simulateApproval, useOAuth42Session, useOAuth42Tokens, useOAuth42User, useRequireAuth, verifyState };

package/dist/client/index.js

@@ -41,6 +41,7 @@ __export(client_exports, {
   initiateAuthenticatorLogin: () => initiateAuthenticatorLogin,
   loginWithPassword: () => loginWithPassword,
   logout: () => logout,
+  logoutEverywhere: () => logoutEverywhere,
   redirectToHostedAuth: () => redirectToHostedAuth,
   signIn: () => import_react4.signIn,
   signOut: () => import_react4.signOut,
@@ -388,26 +389,16 @@ async function simulateApproval(challengeId, selectedCode) {
   }
 }
 async function logout(options) {
-  try {
-    const { getSession } = await import("next-auth/react");
-    const session = await getSession();
-    if (session?.accessToken) {
-      await fetch("/api/auth/logout", {
-        method: "POST",
-        headers: {
-          "Authorization": `Bearer ${session.accessToken}`
-        }
-      });
-    }
-  } catch (error) {
-    console.error("[Logout] Failed to call logout API:", error);
-  }
   const { signOut: signOut4 } = await import("next-auth/react");
   await signOut4({
     callbackUrl: options?.callbackUrl || "/",
     redirect: true
   });
 }
+function logoutEverywhere(issuer, callbackUrl) {
+  const redirectUri = callbackUrl || window.location.origin;
+  window.location.href = `${issuer}/auth/logout?redirect_uri=${encodeURIComponent(redirectUri)}`;
+}
 // Annotate the CommonJS export names for ESM import in node:
 0 && (module.exports = {
   AuthStatus,
@@ -421,6 +412,7 @@ async function logout(options) {
   initiateAuthenticatorLogin,
   loginWithPassword,
   logout,
+  logoutEverywhere,
   redirectToHostedAuth,
   signIn,
   signOut,

package/dist/client/index.js.map

@@ -1 +1 @@
-{"version":3,"sources":["../../src/client/index.ts","../../src/client/hooks.ts","../../src/client/components.tsx","../../src/utils/hosted-auth.ts","../../src/client/auth.ts"],"sourcesContent":["// Client-side exports\n\n// Re-export commonly used next-auth/react functions\nexport { signIn, signOut, useSession, SessionProvider } from 'next-auth/react';\nexport type { Session } from 'next-auth';\nexport {\n  useOAuth42Session,\n  useOAuth42User,\n  useOAuth42Tokens,\n  useRequireAuth,\n} from './hooks';\n\nexport type {\n  OAuth42Session,\n  UseOAuth42SessionReturn,\n} from './hooks';\n\nexport {\n  SignInButton,\n  SignOutButton,\n  UserProfile,\n  AuthStatus,\n  ProtectedComponent,\n} from './components';\n\nexport type {\n  SignInButtonProps,\n  SignOutButtonProps,\n  UserProfileProps,\n  AuthStatusProps,\n  ProtectedComponentProps,\n} from './components';\n\n// Hosted auth utilities\nexport {\n  redirectToHostedAuth,\n  verifyState,\n  DEFAULT_HOSTED_AUTH_CONFIG,\n} from '../utils/hosted-auth';\n\nexport type {\n  HostedAuthOptions,\n  HostedAuthConfig,\n} from '../utils/hosted-auth';\n\n// Custom authentication utilities\nexport {\n  loginWithPassword,\n  initiateAuthenticatorLogin,\n  completeAuthenticatorLogin,\n  simulateApproval,\n  logout,\n} from './auth';\n\nexport type {\n  LoginWithPasswordOptions,\n  LoginWithAuthenticatorOptions,\n  AuthError,\n} from './auth';","import { useSession, signIn, signOut } from 'next-auth/react';\nimport { useCallback, useEffect, useState } from 'react';\n\nexport type OAuth42Session<E = {}> = ({\n  user?: {\n    email?: string | null;\n    name?: string | null;\n    image?: string | null;\n    username?: string;\n    emailVerified?: boolean;\n  };\n  accessToken?: string;\n  idToken?: string;\n  expires?: string;\n}) & E;\n\nexport interface UseOAuth42SessionReturn<E = {}> {\n  session: OAuth42Session<E> | null;\n  loading: boolean;\n  error: Error | null;\n  isAuthenticated: boolean;\n  signIn: () => Promise<void>;\n  signOut: () => Promise<void>;\n}\n\n/**\n * Hook to manage OAuth42 session with optional extra fields\n */\nexport function useOAuth42Session<E = {}>(): UseOAuth42SessionReturn<E> {\n  const { data: session, status } = useSession();\n  const [error, setError] = useState<Error | null>(null);\n  \n  const handleSignIn = useCallback(async () => {\n    try {\n      setError(null);\n      await signIn('oauth42');\n    } catch (err) {\n      setError(err as Error);\n    }\n  }, []);\n  \n  const handleSignOut = useCallback(async () => {\n    try {\n      setError(null);\n      await signOut();\n    } catch (err) {\n      setError(err as Error);\n    }\n  }, []);\n  \n  return {\n    session: session as unknown as OAuth42Session<E> | null,\n    loading: status === 'loading',\n    error,\n    isAuthenticated: status === 'authenticated',\n    signIn: handleSignIn,\n    signOut: handleSignOut,\n  };\n}\n\n/**\n * Hook to get the current OAuth42 user\n */\nexport function useOAuth42User<E = {}>() {\n  const { session, isAuthenticated } = useOAuth42Session<E>();\n  \n  return {\n    user: isAuthenticated ? session?.user : null,\n    isAuthenticated,\n  };\n}\n\n/**\n * Hook to manage OAuth42 tokens\n */\nexport function useOAuth42Tokens<E = {}>() {\n  const { session } = useOAuth42Session<E>();\n  const [isExpired, setIsExpired] = useState(false);\n  \n  useEffect(() => {\n    if (session?.expires) {\n      const expiryTime = new Date(session.expires).getTime();\n      const now = Date.now();\n      setIsExpired(now >= expiryTime);\n      \n      // Set a timer to update expiry status\n      const timeUntilExpiry = expiryTime - now;\n      if (timeUntilExpiry > 0) {\n        const timer = setTimeout(() => {\n          setIsExpired(true);\n        }, timeUntilExpiry);\n        \n        return () => clearTimeout(timer);\n      }\n    }\n  }, [session?.expires]);\n  \n  return {\n    accessToken: session?.accessToken,\n    idToken: session?.idToken,\n    isExpired,\n    refreshToken: async () => {\n      // Trigger a session refresh\n      await signIn('oauth42');\n    },\n  };\n}\n\n/**\n * Hook for protected routes\n */\nexport function useRequireAuth(redirectTo: string = '/auth/signin') {\n  const { isAuthenticated, loading } = useOAuth42Session();\n  const [isRedirecting, setIsRedirecting] = useState(false);\n  \n  useEffect(() => {\n    if (!loading && !isAuthenticated && !isRedirecting) {\n      setIsRedirecting(true);\n      if (typeof window !== 'undefined') {\n        window.location.href = redirectTo;\n      }\n    }\n  }, [isAuthenticated, loading, redirectTo, isRedirecting]);\n  \n  return {\n    isAuthenticated,\n    loading: loading || isRedirecting,\n  };\n}\n","import React from 'react';\nimport { signIn, signOut } from 'next-auth/react';\nimport { useOAuth42Session, useOAuth42User } from './hooks';\n\nexport interface SignInButtonProps {\n  children?: React.ReactNode;\n  className?: string;\n  callbackUrl?: string;\n  onClick?: () => void;\n}\n\n/**\n * Sign in button component\n */\nexport function SignInButton({ \n  children = 'Sign in with OAuth42', \n  className = '',\n  callbackUrl = '/',\n  onClick\n}: SignInButtonProps) {\n  const handleClick = async () => {\n    if (onClick) onClick();\n    await signIn('oauth42', { callbackUrl });\n  };\n  \n  return (\n    <button\n      onClick={handleClick}\n      className={className}\n      type=\"button\"\n    >\n      {children}\n    </button>\n  );\n}\n\nexport interface SignOutButtonProps {\n  children?: React.ReactNode;\n  className?: string;\n  callbackUrl?: string;\n  onClick?: () => void;\n}\n\n/**\n * Sign out button component\n */\nexport function SignOutButton({ \n  children = 'Sign out', \n  className = '',\n  callbackUrl = '/',\n  onClick\n}: SignOutButtonProps) {\n  const handleClick = async () => {\n    if (onClick) onClick();\n    await signOut({ callbackUrl });\n  };\n  \n  return (\n    <button\n      onClick={handleClick}\n      className={className}\n      type=\"button\"\n    >\n      {children}\n    </button>\n  );\n}\n\nexport interface UserProfileProps {\n  className?: string;\n  showEmail?: boolean;\n  showName?: boolean;\n  showImage?: boolean;\n  loadingComponent?: React.ReactNode;\n  notAuthenticatedComponent?: React.ReactNode;\n}\n\n/**\n * User profile display component\n */\nexport function UserProfile({\n  className = '',\n  showEmail = true,\n  showName = true,\n  showImage = true,\n  loadingComponent = <div>Loading...</div>,\n  notAuthenticatedComponent = <div>Not authenticated</div>,\n}: UserProfileProps) {\n  const { session, loading, isAuthenticated } = useOAuth42Session();\n  \n  if (loading) {\n    return <>{loadingComponent}</>;\n  }\n  \n  if (!isAuthenticated || !session?.user) {\n    return <>{notAuthenticatedComponent}</>;\n  }\n  \n  const { user } = session;\n  \n  return (\n    <div className={className}>\n      {showImage && user.image && (\n        <img \n          src={user.image} \n          alt={user.name || 'User'} \n          style={{ width: 50, height: 50, borderRadius: '50%' }}\n        />\n      )}\n      {showName && user.name && <div>{user.name}</div>}\n      {showEmail && user.email && <div>{user.email}</div>}\n    </div>\n  );\n}\n\nexport interface AuthStatusProps {\n  authenticatedComponent?: React.ReactNode;\n  unauthenticatedComponent?: React.ReactNode;\n  loadingComponent?: React.ReactNode;\n}\n\n/**\n * Conditional rendering based on auth status\n */\nexport function AuthStatus({\n  authenticatedComponent,\n  unauthenticatedComponent,\n  loadingComponent = <div>Loading...</div>,\n}: AuthStatusProps) {\n  const { isAuthenticated, loading } = useOAuth42Session();\n  \n  if (loading) {\n    return <>{loadingComponent}</>;\n  }\n  \n  return <>{isAuthenticated ? authenticatedComponent : unauthenticatedComponent}</>;\n}\n\nexport interface ProtectedComponentProps {\n  children: React.ReactNode;\n  fallback?: React.ReactNode;\n  loadingComponent?: React.ReactNode;\n}\n\n/**\n * Wrapper component for protected content\n */\nexport function ProtectedComponent({\n  children,\n  fallback = <SignInButton />,\n  loadingComponent = <div>Loading...</div>,\n}: ProtectedComponentProps) {\n  const { isAuthenticated, loading } = useOAuth42Session();\n  \n  if (loading) {\n    return <>{loadingComponent}</>;\n  }\n  \n  if (!isAuthenticated) {\n    return <>{fallback}</>;\n  }\n  \n  return <>{children}</>;\n}","/**\n * Utilities for OAuth42 Hosted Authentication\n */\n\nexport interface HostedAuthOptions {\n  /** OAuth2 client ID */\n  clientId: string;\n  /** Redirect URI after authentication */\n  redirectUri: string;\n  /** OAuth2 scopes (space-separated) */\n  scope?: string;\n  /** OAuth2 state parameter for CSRF protection */\n  state?: string;\n  /** Base URL for hosted auth (defaults to production) */\n  baseUrl?: string;\n}\n\n/**\n * Generate a random state parameter for CSRF protection\n */\nfunction generateState(): string {\n  const array = new Uint8Array(32);\n  crypto.getRandomValues(array);\n  return Array.from(array, byte => byte.toString(16).padStart(2, '0')).join('');\n}\n\n/**\n * Redirect to OAuth42 hosted authentication pages\n *\n * @example\n * ```ts\n * import { redirectToHostedAuth } from '@oauth42/next/client';\n *\n * function LoginButton() {\n *   return (\n *     <button onClick={() => redirectToHostedAuth({\n *       clientId: process.env.NEXT_PUBLIC_OAUTH42_CLIENT_ID!,\n *       redirectUri: `${window.location.origin}/api/auth/callback`,\n *     })}>\n *       Sign in with OAuth42\n *     </button>\n *   );\n * }\n * ```\n */\nexport function redirectToHostedAuth(options: HostedAuthOptions): void {\n  const {\n    clientId,\n    redirectUri,\n    scope = 'openid profile email',\n    state = generateState(),\n    baseUrl = 'https://auth.oauth42.com',\n  } = options;\n\n  const params = new URLSearchParams({\n    client_id: clientId,\n    redirect_uri: redirectUri,\n    response_type: 'code',\n    scope,\n    state,\n  });\n\n  const authUrl = `${baseUrl}/login?${params.toString()}`;\n\n  // Store state in sessionStorage for verification on callback\n  if (typeof window !== 'undefined') {\n    sessionStorage.setItem('oauth42_state', state);\n    window.location.href = authUrl;\n  }\n}\n\n/**\n * Verify state parameter on OAuth2 callback\n * Call this in your callback page to verify the state matches\n *\n * @example\n * ```ts\n * import { verifyState } from '@oauth42/next/client';\n *\n * export default function CallbackPage() {\n *   const searchParams = useSearchParams();\n *   const state = searchParams.get('state');\n *\n *   if (!verifyState(state)) {\n *     return <div>Invalid state parameter</div>;\n *   }\n *\n *   // Continue with token exchange...\n * }\n * ```\n */\nexport function verifyState(state: string | null): boolean {\n  if (typeof window === 'undefined') return false;\n  if (!state) return false;\n\n  const storedState = sessionStorage.getItem('oauth42_state');\n  sessionStorage.removeItem('oauth42_state');\n\n  return storedState === state;\n}\n\n/**\n * Configuration for hosted authentication\n */\nexport interface HostedAuthConfig {\n  /** Enable hosted authentication */\n  enabled: boolean;\n  /** Base URL for hosted auth pages (optional, defaults to production) */\n  baseUrl?: string;\n  /** Feature flags for hosted auth */\n  features?: {\n    /** Allow user signup */\n    signup?: boolean;\n    /** Allow social login */\n    socialLogin?: boolean;\n    /** Allow password reset */\n    passwordReset?: boolean;\n  };\n}\n\n/**\n * Default hosted auth configuration\n */\nexport const DEFAULT_HOSTED_AUTH_CONFIG: HostedAuthConfig = {\n  enabled: true,\n  baseUrl: 'https://auth.oauth42.com',\n  features: {\n    signup: true,\n    socialLogin: false,\n    passwordReset: true,\n  },\n};\n","/**\n * OAuth42 Custom Authentication Utilities\n *\n * Provides functions for implementing custom login UIs in customer apps\n * while properly handling OAuth2 PKCE flows and next-auth integration.\n */\n\nimport { signIn } from 'next-auth/react';\n\n// PKCE utilities\nfunction base64URLEncode(buffer: ArrayBuffer): string {\n  const bytes = new Uint8Array(buffer);\n  let binary = '';\n  for (let i = 0; i < bytes.byteLength; i++) {\n    binary += String.fromCharCode(bytes[i]);\n  }\n  return btoa(binary)\n    .replace(/\\+/g, '-')\n    .replace(/\\//g, '_')\n    .replace(/=/g, '');\n}\n\nasync function generateCodeVerifier(): Promise<string> {\n  const array = new Uint8Array(32);\n  crypto.getRandomValues(array);\n  return base64URLEncode(array.buffer);\n}\n\nasync function generateCodeChallenge(verifier: string): Promise<string> {\n  const encoder = new TextEncoder();\n  const data = encoder.encode(verifier);\n  const hash = await crypto.subtle.digest('SHA-256', data);\n  return base64URLEncode(hash);\n}\n\nfunction generateState(): string {\n  const array = new Uint8Array(32);\n  crypto.getRandomValues(array);\n  return base64URLEncode(array.buffer);\n}\n\nexport interface LoginWithPasswordOptions {\n  email: string;\n  password: string;\n  mfaCode?: string;\n  /**\n   * URL to redirect to after successful authentication.\n   * If not provided, will redirect to '/'\n   */\n  callbackUrl?: string;\n}\n\nexport interface LoginWithAuthenticatorOptions {\n  email: string;\n  sessionId: string;\n  /**\n   * URL to redirect to after successful authentication.\n   * If not provided, will redirect to '/'\n   */\n  callbackUrl?: string;\n}\n\nexport interface AuthError {\n  error: string;\n  error_description?: string;\n  requires_enrollment?: boolean;\n  enrollment_token?: string;\n  requires_mfa?: boolean;\n}\n\n/**\n * Authenticate with email/password and complete OAuth PKCE flow\n *\n * This function handles the full authentication flow:\n * 1. Authenticates with the backend using credentials\n * 2. Uses the access token to authorize the OAuth client\n * 3. Exchanges authorization code for tokens via next-auth\n *\n * @example\n * ```tsx\n * const result = await loginWithPassword({\n *   email: 'user@example.com',\n *   password: 'password123',\n *   callbackUrl: '/dashboard'\n * });\n *\n * if (result.success) {\n *   // User is authenticated, next-auth session is set\n * } else if (result.requires_mfa) {\n *   // Prompt for MFA code and call again with mfaCode\n * }\n * ```\n */\nexport async function loginWithPassword(\n  options: LoginWithPasswordOptions\n): Promise<{ success: boolean; access_token?: string } & Partial<AuthError>> {\n  try {\n    // Step 1: Authenticate with backend to get access token\n    const loginResponse = await fetch('/api/auth/login', {\n      method: 'POST',\n      headers: { 'Content-Type': 'application/json' },\n      body: JSON.stringify({\n        email: options.email,\n        password: options.password,\n        ...(options.mfaCode ? { mfa_code: options.mfaCode } : {}),\n      }),\n    });\n\n    if (!loginResponse.ok) {\n      const errorData = await loginResponse.json().catch(() => ({}));\n      const desc: string = errorData?.error_description || errorData?.message || '';\n\n      // Handle special cases\n      if (loginResponse.status === 403 && errorData?.requires_enrollment) {\n        return {\n          success: false,\n          error: 'enrollment_required',\n          error_description: 'MFA enrollment required',\n          requires_enrollment: true,\n          enrollment_token: errorData.enrollment_token,\n        };\n      }\n\n      if (loginResponse.status === 403 && /mfa required/i.test(desc)) {\n        return {\n          success: false,\n          error: 'mfa_required',\n          error_description: 'MFA code required',\n          requires_mfa: true,\n        };\n      }\n\n      if (loginResponse.status === 401 && /invalid mfa code/i.test(desc)) {\n        return {\n          success: false,\n          error: 'invalid_mfa_code',\n          error_description: 'Invalid MFA code',\n          requires_mfa: true,\n        };\n      }\n\n      return {\n        success: false,\n        error: 'authentication_failed',\n        error_description: desc || 'Invalid credentials',\n      };\n    }\n\n    const { access_token } = await loginResponse.json();\n\n    // Return access token for the application to use in OAuth authorize flow\n    return { success: true, access_token };\n  } catch (error) {\n    console.error('Login error:', error);\n    return {\n      success: false,\n      error: 'network_error',\n      error_description: 'Failed to connect to authentication server',\n    };\n  }\n}\n\n/**\n * Initiate authenticator (passwordless) login and return challenge code\n *\n * @example\n * ```tsx\n * const result = await initiateAuthenticatorLogin({\n *   email: 'user@example.com',\n *   sessionId: crypto.randomUUID()\n * });\n *\n * if (result.success) {\n *   // Display result.challengeCode to user\n *   // Wait for WebSocket approval or poll for completion\n * }\n * ```\n */\nexport async function initiateAuthenticatorLogin(\n  options: LoginWithAuthenticatorOptions\n): Promise<{\n  success: boolean;\n  challengeCode?: string;\n  challengeId?: string;\n} & Partial<AuthError>> {\n  try {\n    const response = await fetch('/api/auth/passwordless/initiate', {\n      method: 'POST',\n      headers: { 'Content-Type': 'application/json' },\n      body: JSON.stringify({\n        email: options.email,\n        session_id: options.sessionId,\n      }),\n    });\n\n    if (!response.ok) {\n      const errorData = await response.json().catch(() => ({}));\n      return {\n        success: false,\n        error: 'initiation_failed',\n        error_description: errorData.error_description || 'Failed to create challenge',\n      };\n    }\n\n    const data = await response.json();\n\n    return {\n      success: true,\n      challengeCode: data.challenge_code,\n      challengeId: data.challenge_id,\n    };\n  } catch (error) {\n    console.error('Authenticator login error:', error);\n    return {\n      success: false,\n      error: 'network_error',\n      error_description: 'Failed to connect to authentication server',\n    };\n  }\n}\n\n/**\n * Complete authenticator login after approval\n *\n * Call this after receiving approval notification via WebSocket\n * or after the user has approved on their mobile device.\n * Returns the access token for the application to use in OAuth authorize flow.\n *\n * @param accessToken - Access token received from approval payload\n */\nexport async function completeAuthenticatorLogin(\n  accessToken: string\n): Promise<{ success: boolean; access_token: string }> {\n  return { success: true, access_token: accessToken };\n}\n\n/**\n * Simulate approval for testing (development only)\n *\n * @param challengeId - The challenge ID to approve\n * @param selectedCode - The code that was displayed to the user\n */\nexport async function simulateApproval(\n  challengeId: string,\n  selectedCode: string\n): Promise<{ success: boolean }> {\n  try {\n    await fetch('/api/auth/challenge/approve', {\n      method: 'POST',\n      headers: { 'Content-Type': 'application/json' },\n      body: JSON.stringify({\n        challenge_id: challengeId,\n        selected_code: selectedCode,\n      }),\n    });\n\n    return { success: true };\n  } catch (error) {\n    console.error('Simulated approval failed:', error);\n    return { success: false };\n  }\n}\n\n/**\n * Logout the current user\n *\n * Calls the logout API route to clear backend session and oauth42_session cookie,\n * then calls next-auth signOut to clear the next-auth session and redirect.\n *\n * @param callbackUrl - URL to redirect to after logout (default: '/')\n *\n * @example\n * ```tsx\n * import { logout } from '@oauth42/next/client';\n *\n * const handleLogout = async () => {\n *   await logout({ callbackUrl: '/login' });\n * };\n * ```\n */\nexport async function logout(options?: { callbackUrl?: string }): Promise<void> {\n  try {\n    // Get the current session to retrieve the access token\n    const { getSession } = await import('next-auth/react');\n    const session: any = await getSession();\n\n    // Call logout API route to clear backend session and oauth42_session cookie\n    if (session?.accessToken) {\n      await fetch('/api/auth/logout', {\n        method: 'POST',\n        headers: {\n          'Authorization': `Bearer ${session.accessToken}`,\n        },\n      });\n    }\n  } catch (error) {\n    console.error('[Logout] Failed to call logout API:', error);\n    // Continue with signOut anyway\n  }\n\n  // Import signOut from next-auth/react\n  const { signOut } = await import('next-auth/react');\n\n  // Clear next-auth session\n  await signOut({\n    callbackUrl: options?.callbackUrl || '/',\n    redirect: true\n  });\n}\n"],"mappings":";;;;;;;;;;;;;;;;;;;;;;;;;;;;;;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAGA,IAAAA,gBAA6D;;;ACH7D,mBAA4C;AAC5C,IAAAC,gBAAiD;AA2B1C,SAAS,oBAAwD;AACtE,QAAM,EAAE,MAAM,SAAS,OAAO,QAAI,yBAAW;AAC7C,QAAM,CAAC,OAAO,QAAQ,QAAI,wBAAuB,IAAI;AAErD,QAAM,mBAAe,2BAAY,YAAY;AAC3C,QAAI;AACF,eAAS,IAAI;AACb,gBAAM,qBAAO,SAAS;AAAA,IACxB,SAAS,KAAK;AACZ,eAAS,GAAY;AAAA,IACvB;AAAA,EACF,GAAG,CAAC,CAAC;AAEL,QAAM,oBAAgB,2BAAY,YAAY;AAC5C,QAAI;AACF,eAAS,IAAI;AACb,gBAAM,sBAAQ;AAAA,IAChB,SAAS,KAAK;AACZ,eAAS,GAAY;AAAA,IACvB;AAAA,EACF,GAAG,CAAC,CAAC;AAEL,SAAO;AAAA,IACL;AAAA,IACA,SAAS,WAAW;AAAA,IACpB;AAAA,IACA,iBAAiB,WAAW;AAAA,IAC5B,QAAQ;AAAA,IACR,SAAS;AAAA,EACX;AACF;AAKO,SAAS,iBAAyB;AACvC,QAAM,EAAE,SAAS,gBAAgB,IAAI,kBAAqB;AAE1D,SAAO;AAAA,IACL,MAAM,kBAAkB,SAAS,OAAO;AAAA,IACxC;AAAA,EACF;AACF;AAKO,SAAS,mBAA2B;AACzC,QAAM,EAAE,QAAQ,IAAI,kBAAqB;AACzC,QAAM,CAAC,WAAW,YAAY,QAAI,wBAAS,KAAK;AAEhD,+BAAU,MAAM;AACd,QAAI,SAAS,SAAS;AACpB,YAAM,aAAa,IAAI,KAAK,QAAQ,OAAO,EAAE,QAAQ;AACrD,YAAM,MAAM,KAAK,IAAI;AACrB,mBAAa,OAAO,UAAU;AAG9B,YAAM,kBAAkB,aAAa;AACrC,UAAI,kBAAkB,GAAG;AACvB,cAAM,QAAQ,WAAW,MAAM;AAC7B,uBAAa,IAAI;AAAA,QACnB,GAAG,eAAe;AAElB,eAAO,MAAM,aAAa,KAAK;AAAA,MACjC;AAAA,IACF;AAAA,EACF,GAAG,CAAC,SAAS,OAAO,CAAC;AAErB,SAAO;AAAA,IACL,aAAa,SAAS;AAAA,IACtB,SAAS,SAAS;AAAA,IAClB;AAAA,IACA,cAAc,YAAY;AAExB,gBAAM,qBAAO,SAAS;AAAA,IACxB;AAAA,EACF;AACF;AAKO,SAAS,eAAe,aAAqB,gBAAgB;AAClE,QAAM,EAAE,iBAAiB,QAAQ,IAAI,kBAAkB;AACvD,QAAM,CAAC,eAAe,gBAAgB,QAAI,wBAAS,KAAK;AAExD,+BAAU,MAAM;AACd,QAAI,CAAC,WAAW,CAAC,mBAAmB,CAAC,eAAe;AAClD,uBAAiB,IAAI;AACrB,UAAI,OAAO,WAAW,aAAa;AACjC,eAAO,SAAS,OAAO;AAAA,MACzB;AAAA,IACF;AAAA,EACF,GAAG,CAAC,iBAAiB,SAAS,YAAY,aAAa,CAAC;AAExD,SAAO;AAAA,IACL;AAAA,IACA,SAAS,WAAW;AAAA,EACtB;AACF;;;AC/HA,IAAAC,gBAAgC;AAyB5B;AAZG,SAAS,aAAa;AAAA,EAC3B,WAAW;AAAA,EACX,YAAY;AAAA,EACZ,cAAc;AAAA,EACd;AACF,GAAsB;AACpB,QAAM,cAAc,YAAY;AAC9B,QAAI,QAAS,SAAQ;AACrB,cAAM,sBAAO,WAAW,EAAE,YAAY,CAAC;AAAA,EACzC;AAEA,SACE;AAAA,IAAC;AAAA;AAAA,MACC,SAAS;AAAA,MACT;AAAA,MACA,MAAK;AAAA,MAEJ;AAAA;AAAA,EACH;AAEJ;AAYO,SAAS,cAAc;AAAA,EAC5B,WAAW;AAAA,EACX,YAAY;AAAA,EACZ,cAAc;AAAA,EACd;AACF,GAAuB;AACrB,QAAM,cAAc,YAAY;AAC9B,QAAI,QAAS,SAAQ;AACrB,cAAM,uBAAQ,EAAE,YAAY,CAAC;AAAA,EAC/B;AAEA,SACE;AAAA,IAAC;AAAA;AAAA,MACC,SAAS;AAAA,MACT;AAAA,MACA,MAAK;AAAA,MAEJ;AAAA;AAAA,EACH;AAEJ;AAcO,SAAS,YAAY;AAAA,EAC1B,YAAY;AAAA,EACZ,YAAY;AAAA,EACZ,WAAW;AAAA,EACX,YAAY;AAAA,EACZ,mBAAmB,4CAAC,SAAI,wBAAU;AAAA,EAClC,4BAA4B,4CAAC,SAAI,+BAAiB;AACpD,GAAqB;AACnB,QAAM,EAAE,SAAS,SAAS,gBAAgB,IAAI,kBAAkB;AAEhE,MAAI,SAAS;AACX,WAAO,2EAAG,4BAAiB;AAAA,EAC7B;AAEA,MAAI,CAAC,mBAAmB,CAAC,SAAS,MAAM;AACtC,WAAO,2EAAG,qCAA0B;AAAA,EACtC;AAEA,QAAM,EAAE,KAAK,IAAI;AAEjB,SACE,6CAAC,SAAI,WACF;AAAA,iBAAa,KAAK,SACjB;AAAA,MAAC;AAAA;AAAA,QACC,KAAK,KAAK;AAAA,QACV,KAAK,KAAK,QAAQ;AAAA,QAClB,OAAO,EAAE,OAAO,IAAI,QAAQ,IAAI,cAAc,MAAM;AAAA;AAAA,IACtD;AAAA,IAED,YAAY,KAAK,QAAQ,4CAAC,SAAK,eAAK,MAAK;AAAA,IACzC,aAAa,KAAK,SAAS,4CAAC,SAAK,eAAK,OAAM;AAAA,KAC/C;AAEJ;AAWO,SAAS,WAAW;AAAA,EACzB;AAAA,EACA;AAAA,EACA,mBAAmB,4CAAC,SAAI,wBAAU;AACpC,GAAoB;AAClB,QAAM,EAAE,iBAAiB,QAAQ,IAAI,kBAAkB;AAEvD,MAAI,SAAS;AACX,WAAO,2EAAG,4BAAiB;AAAA,EAC7B;AAEA,SAAO,2EAAG,4BAAkB,yBAAyB,0BAAyB;AAChF;AAWO,SAAS,mBAAmB;AAAA,EACjC;AAAA,EACA,WAAW,4CAAC,gBAAa;AAAA,EACzB,mBAAmB,4CAAC,SAAI,wBAAU;AACpC,GAA4B;AAC1B,QAAM,EAAE,iBAAiB,QAAQ,IAAI,kBAAkB;AAEvD,MAAI,SAAS;AACX,WAAO,2EAAG,4BAAiB;AAAA,EAC7B;AAEA,MAAI,CAAC,iBAAiB;AACpB,WAAO,2EAAG,oBAAS;AAAA,EACrB;AAEA,SAAO,2EAAG,UAAS;AACrB;;;AC/IA,SAAS,gBAAwB;AAC/B,QAAM,QAAQ,IAAI,WAAW,EAAE;AAC/B,SAAO,gBAAgB,KAAK;AAC5B,SAAO,MAAM,KAAK,OAAO,UAAQ,KAAK,SAAS,EAAE,EAAE,SAAS,GAAG,GAAG,CAAC,EAAE,KAAK,EAAE;AAC9E;AAqBO,SAAS,qBAAqB,SAAkC;AACrE,QAAM;AAAA,IACJ;AAAA,IACA;AAAA,IACA,QAAQ;AAAA,IACR,QAAQ,cAAc;AAAA,IACtB,UAAU;AAAA,EACZ,IAAI;AAEJ,QAAM,SAAS,IAAI,gBAAgB;AAAA,IACjC,WAAW;AAAA,IACX,cAAc;AAAA,IACd,eAAe;AAAA,IACf;AAAA,IACA;AAAA,EACF,CAAC;AAED,QAAM,UAAU,GAAG,OAAO,UAAU,OAAO,SAAS,CAAC;AAGrD,MAAI,OAAO,WAAW,aAAa;AACjC,mBAAe,QAAQ,iBAAiB,KAAK;AAC7C,WAAO,SAAS,OAAO;AAAA,EACzB;AACF;AAsBO,SAAS,YAAY,OAA+B;AACzD,MAAI,OAAO,WAAW,YAAa,QAAO;AAC1C,MAAI,CAAC,MAAO,QAAO;AAEnB,QAAM,cAAc,eAAe,QAAQ,eAAe;AAC1D,iBAAe,WAAW,eAAe;AAEzC,SAAO,gBAAgB;AACzB;AAwBO,IAAM,6BAA+C;AAAA,EAC1D,SAAS;AAAA,EACT,SAAS;AAAA,EACT,UAAU;AAAA,IACR,QAAQ;AAAA,IACR,aAAa;AAAA,IACb,eAAe;AAAA,EACjB;AACF;;;ACtCA,eAAsB,kBACpB,SAC2E;AAC3E,MAAI;AAEF,UAAM,gBAAgB,MAAM,MAAM,mBAAmB;AAAA,MACnD,QAAQ;AAAA,MACR,SAAS,EAAE,gBAAgB,mBAAmB;AAAA,MAC9C,MAAM,KAAK,UAAU;AAAA,QACnB,OAAO,QAAQ;AAAA,QACf,UAAU,QAAQ;AAAA,QAClB,GAAI,QAAQ,UAAU,EAAE,UAAU,QAAQ,QAAQ,IAAI,CAAC;AAAA,MACzD,CAAC;AAAA,IACH,CAAC;AAED,QAAI,CAAC,cAAc,IAAI;AACrB,YAAM,YAAY,MAAM,cAAc,KAAK,EAAE,MAAM,OAAO,CAAC,EAAE;AAC7D,YAAM,OAAe,WAAW,qBAAqB,WAAW,WAAW;AAG3E,UAAI,cAAc,WAAW,OAAO,WAAW,qBAAqB;AAClE,eAAO;AAAA,UACL,SAAS;AAAA,UACT,OAAO;AAAA,UACP,mBAAmB;AAAA,UACnB,qBAAqB;AAAA,UACrB,kBAAkB,UAAU;AAAA,QAC9B;AAAA,MACF;AAEA,UAAI,cAAc,WAAW,OAAO,gBAAgB,KAAK,IAAI,GAAG;AAC9D,eAAO;AAAA,UACL,SAAS;AAAA,UACT,OAAO;AAAA,UACP,mBAAmB;AAAA,UACnB,cAAc;AAAA,QAChB;AAAA,MACF;AAEA,UAAI,cAAc,WAAW,OAAO,oBAAoB,KAAK,IAAI,GAAG;AAClE,eAAO;AAAA,UACL,SAAS;AAAA,UACT,OAAO;AAAA,UACP,mBAAmB;AAAA,UACnB,cAAc;AAAA,QAChB;AAAA,MACF;AAEA,aAAO;AAAA,QACL,SAAS;AAAA,QACT,OAAO;AAAA,QACP,mBAAmB,QAAQ;AAAA,MAC7B;AAAA,IACF;AAEA,UAAM,EAAE,aAAa,IAAI,MAAM,cAAc,KAAK;AAGlD,WAAO,EAAE,SAAS,MAAM,aAAa;AAAA,EACvC,SAAS,OAAO;AACd,YAAQ,MAAM,gBAAgB,KAAK;AACnC,WAAO;AAAA,MACL,SAAS;AAAA,MACT,OAAO;AAAA,MACP,mBAAmB;AAAA,IACrB;AAAA,EACF;AACF;AAkBA,eAAsB,2BACpB,SAKsB;AACtB,MAAI;AACF,UAAM,WAAW,MAAM,MAAM,mCAAmC;AAAA,MAC9D,QAAQ;AAAA,MACR,SAAS,EAAE,gBAAgB,mBAAmB;AAAA,MAC9C,MAAM,KAAK,UAAU;AAAA,QACnB,OAAO,QAAQ;AAAA,QACf,YAAY,QAAQ;AAAA,MACtB,CAAC;AAAA,IACH,CAAC;AAED,QAAI,CAAC,SAAS,IAAI;AAChB,YAAM,YAAY,MAAM,SAAS,KAAK,EAAE,MAAM,OAAO,CAAC,EAAE;AACxD,aAAO;AAAA,QACL,SAAS;AAAA,QACT,OAAO;AAAA,QACP,mBAAmB,UAAU,qBAAqB;AAAA,MACpD;AAAA,IACF;AAEA,UAAM,OAAO,MAAM,SAAS,KAAK;AAEjC,WAAO;AAAA,MACL,SAAS;AAAA,MACT,eAAe,KAAK;AAAA,MACpB,aAAa,KAAK;AAAA,IACpB;AAAA,EACF,SAAS,OAAO;AACd,YAAQ,MAAM,8BAA8B,KAAK;AACjD,WAAO;AAAA,MACL,SAAS;AAAA,MACT,OAAO;AAAA,MACP,mBAAmB;AAAA,IACrB;AAAA,EACF;AACF;AAWA,eAAsB,2BACpB,aACqD;AACrD,SAAO,EAAE,SAAS,MAAM,cAAc,YAAY;AACpD;AAQA,eAAsB,iBACpB,aACA,cAC+B;AAC/B,MAAI;AACF,UAAM,MAAM,+BAA+B;AAAA,MACzC,QAAQ;AAAA,MACR,SAAS,EAAE,gBAAgB,mBAAmB;AAAA,MAC9C,MAAM,KAAK,UAAU;AAAA,QACnB,cAAc;AAAA,QACd,eAAe;AAAA,MACjB,CAAC;AAAA,IACH,CAAC;AAED,WAAO,EAAE,SAAS,KAAK;AAAA,EACzB,SAAS,OAAO;AACd,YAAQ,MAAM,8BAA8B,KAAK;AACjD,WAAO,EAAE,SAAS,MAAM;AAAA,EAC1B;AACF;AAmBA,eAAsB,OAAO,SAAmD;AAC9E,MAAI;AAEF,UAAM,EAAE,WAAW,IAAI,MAAM,OAAO,iBAAiB;AACrD,UAAM,UAAe,MAAM,WAAW;AAGtC,QAAI,SAAS,aAAa;AACxB,YAAM,MAAM,oBAAoB;AAAA,QAC9B,QAAQ;AAAA,QACR,SAAS;AAAA,UACP,iBAAiB,UAAU,QAAQ,WAAW;AAAA,QAChD;AAAA,MACF,CAAC;AAAA,IACH;AAAA,EACF,SAAS,OAAO;AACd,YAAQ,MAAM,uCAAuC,KAAK;AAAA,EAE5D;AAGA,QAAM,EAAE,SAAAC,SAAQ,IAAI,MAAM,OAAO,iBAAiB;AAGlD,QAAMA,SAAQ;AAAA,IACZ,aAAa,SAAS,eAAe;AAAA,IACrC,UAAU;AAAA,EACZ,CAAC;AACH;","names":["import_react","import_react","import_react","signOut"]}
+{"version":3,"sources":["../../src/client/index.ts","../../src/client/hooks.ts","../../src/client/components.tsx","../../src/utils/hosted-auth.ts","../../src/client/auth.ts"],"sourcesContent":["// Client-side exports\n\n// Re-export commonly used next-auth/react functions\nexport { signIn, signOut, useSession, SessionProvider } from 'next-auth/react';\nexport type { Session } from 'next-auth';\nexport {\n  useOAuth42Session,\n  useOAuth42User,\n  useOAuth42Tokens,\n  useRequireAuth,\n} from './hooks';\n\nexport type {\n  OAuth42Session,\n  UseOAuth42SessionReturn,\n} from './hooks';\n\nexport {\n  SignInButton,\n  SignOutButton,\n  UserProfile,\n  AuthStatus,\n  ProtectedComponent,\n} from './components';\n\nexport type {\n  SignInButtonProps,\n  SignOutButtonProps,\n  UserProfileProps,\n  AuthStatusProps,\n  ProtectedComponentProps,\n} from './components';\n\n// Hosted auth utilities\nexport {\n  redirectToHostedAuth,\n  verifyState,\n  DEFAULT_HOSTED_AUTH_CONFIG,\n} from '../utils/hosted-auth';\n\nexport type {\n  HostedAuthOptions,\n  HostedAuthConfig,\n} from '../utils/hosted-auth';\n\n// Custom authentication utilities\nexport {\n  loginWithPassword,\n  initiateAuthenticatorLogin,\n  completeAuthenticatorLogin,\n  simulateApproval,\n  logout,\n  logoutEverywhere,\n} from './auth';\n\nexport type {\n  LoginWithPasswordOptions,\n  LoginWithAuthenticatorOptions,\n  AuthError,\n} from './auth';","import { useSession, signIn, signOut } from 'next-auth/react';\nimport { useCallback, useEffect, useState } from 'react';\n\nexport type OAuth42Session<E = {}> = ({\n  user?: {\n    email?: string | null;\n    name?: string | null;\n    image?: string | null;\n    username?: string;\n    emailVerified?: boolean;\n  };\n  accessToken?: string;\n  idToken?: string;\n  expires?: string;\n}) & E;\n\nexport interface UseOAuth42SessionReturn<E = {}> {\n  session: OAuth42Session<E> | null;\n  loading: boolean;\n  error: Error | null;\n  isAuthenticated: boolean;\n  signIn: () => Promise<void>;\n  signOut: () => Promise<void>;\n}\n\n/**\n * Hook to manage OAuth42 session with optional extra fields\n */\nexport function useOAuth42Session<E = {}>(): UseOAuth42SessionReturn<E> {\n  const { data: session, status } = useSession();\n  const [error, setError] = useState<Error | null>(null);\n  \n  const handleSignIn = useCallback(async () => {\n    try {\n      setError(null);\n      await signIn('oauth42');\n    } catch (err) {\n      setError(err as Error);\n    }\n  }, []);\n  \n  const handleSignOut = useCallback(async () => {\n    try {\n      setError(null);\n      await signOut();\n    } catch (err) {\n      setError(err as Error);\n    }\n  }, []);\n  \n  return {\n    session: session as unknown as OAuth42Session<E> | null,\n    loading: status === 'loading',\n    error,\n    isAuthenticated: status === 'authenticated',\n    signIn: handleSignIn,\n    signOut: handleSignOut,\n  };\n}\n\n/**\n * Hook to get the current OAuth42 user\n */\nexport function useOAuth42User<E = {}>() {\n  const { session, isAuthenticated } = useOAuth42Session<E>();\n  \n  return {\n    user: isAuthenticated ? session?.user : null,\n    isAuthenticated,\n  };\n}\n\n/**\n * Hook to manage OAuth42 tokens\n */\nexport function useOAuth42Tokens<E = {}>() {\n  const { session } = useOAuth42Session<E>();\n  const [isExpired, setIsExpired] = useState(false);\n  \n  useEffect(() => {\n    if (session?.expires) {\n      const expiryTime = new Date(session.expires).getTime();\n      const now = Date.now();\n      setIsExpired(now >= expiryTime);\n      \n      // Set a timer to update expiry status\n      const timeUntilExpiry = expiryTime - now;\n      if (timeUntilExpiry > 0) {\n        const timer = setTimeout(() => {\n          setIsExpired(true);\n        }, timeUntilExpiry);\n        \n        return () => clearTimeout(timer);\n      }\n    }\n  }, [session?.expires]);\n  \n  return {\n    accessToken: session?.accessToken,\n    idToken: session?.idToken,\n    isExpired,\n    refreshToken: async () => {\n      // Trigger a session refresh\n      await signIn('oauth42');\n    },\n  };\n}\n\n/**\n * Hook for protected routes\n */\nexport function useRequireAuth(redirectTo: string = '/auth/signin') {\n  const { isAuthenticated, loading } = useOAuth42Session();\n  const [isRedirecting, setIsRedirecting] = useState(false);\n  \n  useEffect(() => {\n    if (!loading && !isAuthenticated && !isRedirecting) {\n      setIsRedirecting(true);\n      if (typeof window !== 'undefined') {\n        window.location.href = redirectTo;\n      }\n    }\n  }, [isAuthenticated, loading, redirectTo, isRedirecting]);\n  \n  return {\n    isAuthenticated,\n    loading: loading || isRedirecting,\n  };\n}\n","import React from 'react';\nimport { signIn, signOut } from 'next-auth/react';\nimport { useOAuth42Session, useOAuth42User } from './hooks';\n\nexport interface SignInButtonProps {\n  children?: React.ReactNode;\n  className?: string;\n  callbackUrl?: string;\n  onClick?: () => void;\n}\n\n/**\n * Sign in button component\n */\nexport function SignInButton({ \n  children = 'Sign in with OAuth42', \n  className = '',\n  callbackUrl = '/',\n  onClick\n}: SignInButtonProps) {\n  const handleClick = async () => {\n    if (onClick) onClick();\n    await signIn('oauth42', { callbackUrl });\n  };\n  \n  return (\n    <button\n      onClick={handleClick}\n      className={className}\n      type=\"button\"\n    >\n      {children}\n    </button>\n  );\n}\n\nexport interface SignOutButtonProps {\n  children?: React.ReactNode;\n  className?: string;\n  callbackUrl?: string;\n  onClick?: () => void;\n}\n\n/**\n * Sign out button component\n */\nexport function SignOutButton({ \n  children = 'Sign out', \n  className = '',\n  callbackUrl = '/',\n  onClick\n}: SignOutButtonProps) {\n  const handleClick = async () => {\n    if (onClick) onClick();\n    await signOut({ callbackUrl });\n  };\n  \n  return (\n    <button\n      onClick={handleClick}\n      className={className}\n      type=\"button\"\n    >\n      {children}\n    </button>\n  );\n}\n\nexport interface UserProfileProps {\n  className?: string;\n  showEmail?: boolean;\n  showName?: boolean;\n  showImage?: boolean;\n  loadingComponent?: React.ReactNode;\n  notAuthenticatedComponent?: React.ReactNode;\n}\n\n/**\n * User profile display component\n */\nexport function UserProfile({\n  className = '',\n  showEmail = true,\n  showName = true,\n  showImage = true,\n  loadingComponent = <div>Loading...</div>,\n  notAuthenticatedComponent = <div>Not authenticated</div>,\n}: UserProfileProps) {\n  const { session, loading, isAuthenticated } = useOAuth42Session();\n  \n  if (loading) {\n    return <>{loadingComponent}</>;\n  }\n  \n  if (!isAuthenticated || !session?.user) {\n    return <>{notAuthenticatedComponent}</>;\n  }\n  \n  const { user } = session;\n  \n  return (\n    <div className={className}>\n      {showImage && user.image && (\n        <img \n          src={user.image} \n          alt={user.name || 'User'} \n          style={{ width: 50, height: 50, borderRadius: '50%' }}\n        />\n      )}\n      {showName && user.name && <div>{user.name}</div>}\n      {showEmail && user.email && <div>{user.email}</div>}\n    </div>\n  );\n}\n\nexport interface AuthStatusProps {\n  authenticatedComponent?: React.ReactNode;\n  unauthenticatedComponent?: React.ReactNode;\n  loadingComponent?: React.ReactNode;\n}\n\n/**\n * Conditional rendering based on auth status\n */\nexport function AuthStatus({\n  authenticatedComponent,\n  unauthenticatedComponent,\n  loadingComponent = <div>Loading...</div>,\n}: AuthStatusProps) {\n  const { isAuthenticated, loading } = useOAuth42Session();\n  \n  if (loading) {\n    return <>{loadingComponent}</>;\n  }\n  \n  return <>{isAuthenticated ? authenticatedComponent : unauthenticatedComponent}</>;\n}\n\nexport interface ProtectedComponentProps {\n  children: React.ReactNode;\n  fallback?: React.ReactNode;\n  loadingComponent?: React.ReactNode;\n}\n\n/**\n * Wrapper component for protected content\n */\nexport function ProtectedComponent({\n  children,\n  fallback = <SignInButton />,\n  loadingComponent = <div>Loading...</div>,\n}: ProtectedComponentProps) {\n  const { isAuthenticated, loading } = useOAuth42Session();\n  \n  if (loading) {\n    return <>{loadingComponent}</>;\n  }\n  \n  if (!isAuthenticated) {\n    return <>{fallback}</>;\n  }\n  \n  return <>{children}</>;\n}","/**\n * Utilities for OAuth42 Hosted Authentication\n */\n\nexport interface HostedAuthOptions {\n  /** OAuth2 client ID */\n  clientId: string;\n  /** Redirect URI after authentication */\n  redirectUri: string;\n  /** OAuth2 scopes (space-separated) */\n  scope?: string;\n  /** OAuth2 state parameter for CSRF protection */\n  state?: string;\n  /** Base URL for hosted auth (defaults to production) */\n  baseUrl?: string;\n}\n\n/**\n * Generate a random state parameter for CSRF protection\n */\nfunction generateState(): string {\n  const array = new Uint8Array(32);\n  crypto.getRandomValues(array);\n  return Array.from(array, byte => byte.toString(16).padStart(2, '0')).join('');\n}\n\n/**\n * Redirect to OAuth42 hosted authentication pages\n *\n * @example\n * ```ts\n * import { redirectToHostedAuth } from '@oauth42/next/client';\n *\n * function LoginButton() {\n *   return (\n *     <button onClick={() => redirectToHostedAuth({\n *       clientId: process.env.NEXT_PUBLIC_OAUTH42_CLIENT_ID!,\n *       redirectUri: `${window.location.origin}/api/auth/callback`,\n *     })}>\n *       Sign in with OAuth42\n *     </button>\n *   );\n * }\n * ```\n */\nexport function redirectToHostedAuth(options: HostedAuthOptions): void {\n  const {\n    clientId,\n    redirectUri,\n    scope = 'openid profile email',\n    state = generateState(),\n    baseUrl = 'https://auth.oauth42.com',\n  } = options;\n\n  const params = new URLSearchParams({\n    client_id: clientId,\n    redirect_uri: redirectUri,\n    response_type: 'code',\n    scope,\n    state,\n  });\n\n  const authUrl = `${baseUrl}/login?${params.toString()}`;\n\n  // Store state in sessionStorage for verification on callback\n  if (typeof window !== 'undefined') {\n    sessionStorage.setItem('oauth42_state', state);\n    window.location.href = authUrl;\n  }\n}\n\n/**\n * Verify state parameter on OAuth2 callback\n * Call this in your callback page to verify the state matches\n *\n * @example\n * ```ts\n * import { verifyState } from '@oauth42/next/client';\n *\n * export default function CallbackPage() {\n *   const searchParams = useSearchParams();\n *   const state = searchParams.get('state');\n *\n *   if (!verifyState(state)) {\n *     return <div>Invalid state parameter</div>;\n *   }\n *\n *   // Continue with token exchange...\n * }\n * ```\n */\nexport function verifyState(state: string | null): boolean {\n  if (typeof window === 'undefined') return false;\n  if (!state) return false;\n\n  const storedState = sessionStorage.getItem('oauth42_state');\n  sessionStorage.removeItem('oauth42_state');\n\n  return storedState === state;\n}\n\n/**\n * Configuration for hosted authentication\n */\nexport interface HostedAuthConfig {\n  /** Enable hosted authentication */\n  enabled: boolean;\n  /** Base URL for hosted auth pages (optional, defaults to production) */\n  baseUrl?: string;\n  /** Feature flags for hosted auth */\n  features?: {\n    /** Allow user signup */\n    signup?: boolean;\n    /** Allow social login */\n    socialLogin?: boolean;\n    /** Allow password reset */\n    passwordReset?: boolean;\n  };\n}\n\n/**\n * Default hosted auth configuration\n */\nexport const DEFAULT_HOSTED_AUTH_CONFIG: HostedAuthConfig = {\n  enabled: true,\n  baseUrl: 'https://auth.oauth42.com',\n  features: {\n    signup: true,\n    socialLogin: false,\n    passwordReset: true,\n  },\n};\n","/**\n * OAuth42 Custom Authentication Utilities\n *\n * Provides functions for implementing custom login UIs in customer apps\n * while properly handling OAuth2 PKCE flows and next-auth integration.\n */\n\nimport { signIn } from 'next-auth/react';\n\n// PKCE utilities\nfunction base64URLEncode(buffer: ArrayBuffer): string {\n  const bytes = new Uint8Array(buffer);\n  let binary = '';\n  for (let i = 0; i < bytes.byteLength; i++) {\n    binary += String.fromCharCode(bytes[i]);\n  }\n  return btoa(binary)\n    .replace(/\\+/g, '-')\n    .replace(/\\//g, '_')\n    .replace(/=/g, '');\n}\n\nasync function generateCodeVerifier(): Promise<string> {\n  const array = new Uint8Array(32);\n  crypto.getRandomValues(array);\n  return base64URLEncode(array.buffer);\n}\n\nasync function generateCodeChallenge(verifier: string): Promise<string> {\n  const encoder = new TextEncoder();\n  const data = encoder.encode(verifier);\n  const hash = await crypto.subtle.digest('SHA-256', data);\n  return base64URLEncode(hash);\n}\n\nfunction generateState(): string {\n  const array = new Uint8Array(32);\n  crypto.getRandomValues(array);\n  return base64URLEncode(array.buffer);\n}\n\nexport interface LoginWithPasswordOptions {\n  email: string;\n  password: string;\n  mfaCode?: string;\n  /**\n   * URL to redirect to after successful authentication.\n   * If not provided, will redirect to '/'\n   */\n  callbackUrl?: string;\n}\n\nexport interface LoginWithAuthenticatorOptions {\n  email: string;\n  sessionId: string;\n  /**\n   * URL to redirect to after successful authentication.\n   * If not provided, will redirect to '/'\n   */\n  callbackUrl?: string;\n}\n\nexport interface AuthError {\n  error: string;\n  error_description?: string;\n  requires_enrollment?: boolean;\n  enrollment_token?: string;\n  requires_mfa?: boolean;\n}\n\n/**\n * Authenticate with email/password and complete OAuth PKCE flow\n *\n * This function handles the full authentication flow:\n * 1. Authenticates with the backend using credentials\n * 2. Uses the access token to authorize the OAuth client\n * 3. Exchanges authorization code for tokens via next-auth\n *\n * @example\n * ```tsx\n * const result = await loginWithPassword({\n *   email: 'user@example.com',\n *   password: 'password123',\n *   callbackUrl: '/dashboard'\n * });\n *\n * if (result.success) {\n *   // User is authenticated, next-auth session is set\n * } else if (result.requires_mfa) {\n *   // Prompt for MFA code and call again with mfaCode\n * }\n * ```\n */\nexport async function loginWithPassword(\n  options: LoginWithPasswordOptions\n): Promise<{ success: boolean; access_token?: string } & Partial<AuthError>> {\n  try {\n    // Step 1: Authenticate with backend to get access token\n    const loginResponse = await fetch('/api/auth/login', {\n      method: 'POST',\n      headers: { 'Content-Type': 'application/json' },\n      body: JSON.stringify({\n        email: options.email,\n        password: options.password,\n        ...(options.mfaCode ? { mfa_code: options.mfaCode } : {}),\n      }),\n    });\n\n    if (!loginResponse.ok) {\n      const errorData = await loginResponse.json().catch(() => ({}));\n      const desc: string = errorData?.error_description || errorData?.message || '';\n\n      // Handle special cases\n      if (loginResponse.status === 403 && errorData?.requires_enrollment) {\n        return {\n          success: false,\n          error: 'enrollment_required',\n          error_description: 'MFA enrollment required',\n          requires_enrollment: true,\n          enrollment_token: errorData.enrollment_token,\n        };\n      }\n\n      if (loginResponse.status === 403 && /mfa required/i.test(desc)) {\n        return {\n          success: false,\n          error: 'mfa_required',\n          error_description: 'MFA code required',\n          requires_mfa: true,\n        };\n      }\n\n      if (loginResponse.status === 401 && /invalid mfa code/i.test(desc)) {\n        return {\n          success: false,\n          error: 'invalid_mfa_code',\n          error_description: 'Invalid MFA code',\n          requires_mfa: true,\n        };\n      }\n\n      return {\n        success: false,\n        error: 'authentication_failed',\n        error_description: desc || 'Invalid credentials',\n      };\n    }\n\n    const { access_token } = await loginResponse.json();\n\n    // Return access token for the application to use in OAuth authorize flow\n    return { success: true, access_token };\n  } catch (error) {\n    console.error('Login error:', error);\n    return {\n      success: false,\n      error: 'network_error',\n      error_description: 'Failed to connect to authentication server',\n    };\n  }\n}\n\n/**\n * Initiate authenticator (passwordless) login and return challenge code\n *\n * @example\n * ```tsx\n * const result = await initiateAuthenticatorLogin({\n *   email: 'user@example.com',\n *   sessionId: crypto.randomUUID()\n * });\n *\n * if (result.success) {\n *   // Display result.challengeCode to user\n *   // Wait for WebSocket approval or poll for completion\n * }\n * ```\n */\nexport async function initiateAuthenticatorLogin(\n  options: LoginWithAuthenticatorOptions\n): Promise<{\n  success: boolean;\n  challengeCode?: string;\n  challengeId?: string;\n} & Partial<AuthError>> {\n  try {\n    const response = await fetch('/api/auth/passwordless/initiate', {\n      method: 'POST',\n      headers: { 'Content-Type': 'application/json' },\n      body: JSON.stringify({\n        email: options.email,\n        session_id: options.sessionId,\n      }),\n    });\n\n    if (!response.ok) {\n      const errorData = await response.json().catch(() => ({}));\n      return {\n        success: false,\n        error: 'initiation_failed',\n        error_description: errorData.error_description || 'Failed to create challenge',\n      };\n    }\n\n    const data = await response.json();\n\n    return {\n      success: true,\n      challengeCode: data.challenge_code,\n      challengeId: data.challenge_id,\n    };\n  } catch (error) {\n    console.error('Authenticator login error:', error);\n    return {\n      success: false,\n      error: 'network_error',\n      error_description: 'Failed to connect to authentication server',\n    };\n  }\n}\n\n/**\n * Complete authenticator login after approval\n *\n * Call this after receiving approval notification via WebSocket\n * or after the user has approved on their mobile device.\n * Returns the access token for the application to use in OAuth authorize flow.\n *\n * @param accessToken - Access token received from approval payload\n */\nexport async function completeAuthenticatorLogin(\n  accessToken: string\n): Promise<{ success: boolean; access_token: string }> {\n  return { success: true, access_token: accessToken };\n}\n\n/**\n * Simulate approval for testing (development only)\n *\n * @param challengeId - The challenge ID to approve\n * @param selectedCode - The code that was displayed to the user\n */\nexport async function simulateApproval(\n  challengeId: string,\n  selectedCode: string\n): Promise<{ success: boolean }> {\n  try {\n    await fetch('/api/auth/challenge/approve', {\n      method: 'POST',\n      headers: { 'Content-Type': 'application/json' },\n      body: JSON.stringify({\n        challenge_id: challengeId,\n        selected_code: selectedCode,\n      }),\n    });\n\n    return { success: true };\n  } catch (error) {\n    console.error('Simulated approval failed:', error);\n    return { success: false };\n  }\n}\n\n/**\n * Logout the current user from the app only (app-level logout)\n *\n * This clears the next-auth session for this app only. The user remains\n * logged into the OAuth42 provider and will auto-authenticate on next login.\n * This is standard SSO behavior.\n *\n * For provider-level logout (sign out of all apps), use logoutEverywhere().\n *\n * @param callbackUrl - URL to redirect to after logout (default: '/')\n *\n * @example\n * ```tsx\n * import { logout } from '@oauth42/next/client';\n *\n * const handleLogout = async () => {\n *   await logout({ callbackUrl: '/login' });\n * };\n * ```\n */\nexport async function logout(options?: { callbackUrl?: string }): Promise<void> {\n  // Import signOut from next-auth/react\n  const { signOut } = await import('next-auth/react');\n\n  // Clear next-auth session (app-level only)\n  await signOut({\n    callbackUrl: options?.callbackUrl || '/',\n    redirect: true\n  });\n}\n\n/**\n * Logout the current user from ALL apps using OAuth42 (provider-level logout)\n *\n * This redirects to the OAuth42 provider's logout endpoint to clear the\n * oauth42_session cookie, effectively logging the user out of all apps.\n *\n * Use this when testing fresh login flows or when the user explicitly\n * wants to sign out of everything.\n *\n * @param issuer - The OAuth42 issuer URL (e.g., 'https://localhost:8443')\n * @param callbackUrl - URL to redirect to after logout (default: current origin)\n *\n * @example\n * ```tsx\n * import { logoutEverywhere } from '@oauth42/next/client';\n *\n * const handleLogoutEverywhere = () => {\n *   const issuer = process.env.NEXT_PUBLIC_OAUTH42_ISSUER || 'https://localhost:8443';\n *   logoutEverywhere(issuer, '/auth/signin');\n * };\n * ```\n */\nexport function logoutEverywhere(issuer: string, callbackUrl?: string): void {\n  const redirectUri = callbackUrl || window.location.origin;\n\n  // Redirect to OAuth42 provider logout endpoint\n  // This clears the oauth42_session cookie and redirects back\n  window.location.href = `${issuer}/auth/logout?redirect_uri=${encodeURIComponent(redirectUri)}`;\n}\n"],"mappings":";;;;;;;;;;;;;;;;;;;;;;;;;;;;;;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAGA,IAAAA,gBAA6D;;;ACH7D,mBAA4C;AAC5C,IAAAC,gBAAiD;AA2B1C,SAAS,oBAAwD;AACtE,QAAM,EAAE,MAAM,SAAS,OAAO,QAAI,yBAAW;AAC7C,QAAM,CAAC,OAAO,QAAQ,QAAI,wBAAuB,IAAI;AAErD,QAAM,mBAAe,2BAAY,YAAY;AAC3C,QAAI;AACF,eAAS,IAAI;AACb,gBAAM,qBAAO,SAAS;AAAA,IACxB,SAAS,KAAK;AACZ,eAAS,GAAY;AAAA,IACvB;AAAA,EACF,GAAG,CAAC,CAAC;AAEL,QAAM,oBAAgB,2BAAY,YAAY;AAC5C,QAAI;AACF,eAAS,IAAI;AACb,gBAAM,sBAAQ;AAAA,IAChB,SAAS,KAAK;AACZ,eAAS,GAAY;AAAA,IACvB;AAAA,EACF,GAAG,CAAC,CAAC;AAEL,SAAO;AAAA,IACL;AAAA,IACA,SAAS,WAAW;AAAA,IACpB;AAAA,IACA,iBAAiB,WAAW;AAAA,IAC5B,QAAQ;AAAA,IACR,SAAS;AAAA,EACX;AACF;AAKO,SAAS,iBAAyB;AACvC,QAAM,EAAE,SAAS,gBAAgB,IAAI,kBAAqB;AAE1D,SAAO;AAAA,IACL,MAAM,kBAAkB,SAAS,OAAO;AAAA,IACxC;AAAA,EACF;AACF;AAKO,SAAS,mBAA2B;AACzC,QAAM,EAAE,QAAQ,IAAI,kBAAqB;AACzC,QAAM,CAAC,WAAW,YAAY,QAAI,wBAAS,KAAK;AAEhD,+BAAU,MAAM;AACd,QAAI,SAAS,SAAS;AACpB,YAAM,aAAa,IAAI,KAAK,QAAQ,OAAO,EAAE,QAAQ;AACrD,YAAM,MAAM,KAAK,IAAI;AACrB,mBAAa,OAAO,UAAU;AAG9B,YAAM,kBAAkB,aAAa;AACrC,UAAI,kBAAkB,GAAG;AACvB,cAAM,QAAQ,WAAW,MAAM;AAC7B,uBAAa,IAAI;AAAA,QACnB,GAAG,eAAe;AAElB,eAAO,MAAM,aAAa,KAAK;AAAA,MACjC;AAAA,IACF;AAAA,EACF,GAAG,CAAC,SAAS,OAAO,CAAC;AAErB,SAAO;AAAA,IACL,aAAa,SAAS;AAAA,IACtB,SAAS,SAAS;AAAA,IAClB;AAAA,IACA,cAAc,YAAY;AAExB,gBAAM,qBAAO,SAAS;AAAA,IACxB;AAAA,EACF;AACF;AAKO,SAAS,eAAe,aAAqB,gBAAgB;AAClE,QAAM,EAAE,iBAAiB,QAAQ,IAAI,kBAAkB;AACvD,QAAM,CAAC,eAAe,gBAAgB,QAAI,wBAAS,KAAK;AAExD,+BAAU,MAAM;AACd,QAAI,CAAC,WAAW,CAAC,mBAAmB,CAAC,eAAe;AAClD,uBAAiB,IAAI;AACrB,UAAI,OAAO,WAAW,aAAa;AACjC,eAAO,SAAS,OAAO;AAAA,MACzB;AAAA,IACF;AAAA,EACF,GAAG,CAAC,iBAAiB,SAAS,YAAY,aAAa,CAAC;AAExD,SAAO;AAAA,IACL;AAAA,IACA,SAAS,WAAW;AAAA,EACtB;AACF;;;AC/HA,IAAAC,gBAAgC;AAyB5B;AAZG,SAAS,aAAa;AAAA,EAC3B,WAAW;AAAA,EACX,YAAY;AAAA,EACZ,cAAc;AAAA,EACd;AACF,GAAsB;AACpB,QAAM,cAAc,YAAY;AAC9B,QAAI,QAAS,SAAQ;AACrB,cAAM,sBAAO,WAAW,EAAE,YAAY,CAAC;AAAA,EACzC;AAEA,SACE;AAAA,IAAC;AAAA;AAAA,MACC,SAAS;AAAA,MACT;AAAA,MACA,MAAK;AAAA,MAEJ;AAAA;AAAA,EACH;AAEJ;AAYO,SAAS,cAAc;AAAA,EAC5B,WAAW;AAAA,EACX,YAAY;AAAA,EACZ,cAAc;AAAA,EACd;AACF,GAAuB;AACrB,QAAM,cAAc,YAAY;AAC9B,QAAI,QAAS,SAAQ;AACrB,cAAM,uBAAQ,EAAE,YAAY,CAAC;AAAA,EAC/B;AAEA,SACE;AAAA,IAAC;AAAA;AAAA,MACC,SAAS;AAAA,MACT;AAAA,MACA,MAAK;AAAA,MAEJ;AAAA;AAAA,EACH;AAEJ;AAcO,SAAS,YAAY;AAAA,EAC1B,YAAY;AAAA,EACZ,YAAY;AAAA,EACZ,WAAW;AAAA,EACX,YAAY;AAAA,EACZ,mBAAmB,4CAAC,SAAI,wBAAU;AAAA,EAClC,4BAA4B,4CAAC,SAAI,+BAAiB;AACpD,GAAqB;AACnB,QAAM,EAAE,SAAS,SAAS,gBAAgB,IAAI,kBAAkB;AAEhE,MAAI,SAAS;AACX,WAAO,2EAAG,4BAAiB;AAAA,EAC7B;AAEA,MAAI,CAAC,mBAAmB,CAAC,SAAS,MAAM;AACtC,WAAO,2EAAG,qCAA0B;AAAA,EACtC;AAEA,QAAM,EAAE,KAAK,IAAI;AAEjB,SACE,6CAAC,SAAI,WACF;AAAA,iBAAa,KAAK,SACjB;AAAA,MAAC;AAAA;AAAA,QACC,KAAK,KAAK;AAAA,QACV,KAAK,KAAK,QAAQ;AAAA,QAClB,OAAO,EAAE,OAAO,IAAI,QAAQ,IAAI,cAAc,MAAM;AAAA;AAAA,IACtD;AAAA,IAED,YAAY,KAAK,QAAQ,4CAAC,SAAK,eAAK,MAAK;AAAA,IACzC,aAAa,KAAK,SAAS,4CAAC,SAAK,eAAK,OAAM;AAAA,KAC/C;AAEJ;AAWO,SAAS,WAAW;AAAA,EACzB;AAAA,EACA;AAAA,EACA,mBAAmB,4CAAC,SAAI,wBAAU;AACpC,GAAoB;AAClB,QAAM,EAAE,iBAAiB,QAAQ,IAAI,kBAAkB;AAEvD,MAAI,SAAS;AACX,WAAO,2EAAG,4BAAiB;AAAA,EAC7B;AAEA,SAAO,2EAAG,4BAAkB,yBAAyB,0BAAyB;AAChF;AAWO,SAAS,mBAAmB;AAAA,EACjC;AAAA,EACA,WAAW,4CAAC,gBAAa;AAAA,EACzB,mBAAmB,4CAAC,SAAI,wBAAU;AACpC,GAA4B;AAC1B,QAAM,EAAE,iBAAiB,QAAQ,IAAI,kBAAkB;AAEvD,MAAI,SAAS;AACX,WAAO,2EAAG,4BAAiB;AAAA,EAC7B;AAEA,MAAI,CAAC,iBAAiB;AACpB,WAAO,2EAAG,oBAAS;AAAA,EACrB;AAEA,SAAO,2EAAG,UAAS;AACrB;;;AC/IA,SAAS,gBAAwB;AAC/B,QAAM,QAAQ,IAAI,WAAW,EAAE;AAC/B,SAAO,gBAAgB,KAAK;AAC5B,SAAO,MAAM,KAAK,OAAO,UAAQ,KAAK,SAAS,EAAE,EAAE,SAAS,GAAG,GAAG,CAAC,EAAE,KAAK,EAAE;AAC9E;AAqBO,SAAS,qBAAqB,SAAkC;AACrE,QAAM;AAAA,IACJ;AAAA,IACA;AAAA,IACA,QAAQ;AAAA,IACR,QAAQ,cAAc;AAAA,IACtB,UAAU;AAAA,EACZ,IAAI;AAEJ,QAAM,SAAS,IAAI,gBAAgB;AAAA,IACjC,WAAW;AAAA,IACX,cAAc;AAAA,IACd,eAAe;AAAA,IACf;AAAA,IACA;AAAA,EACF,CAAC;AAED,QAAM,UAAU,GAAG,OAAO,UAAU,OAAO,SAAS,CAAC;AAGrD,MAAI,OAAO,WAAW,aAAa;AACjC,mBAAe,QAAQ,iBAAiB,KAAK;AAC7C,WAAO,SAAS,OAAO;AAAA,EACzB;AACF;AAsBO,SAAS,YAAY,OAA+B;AACzD,MAAI,OAAO,WAAW,YAAa,QAAO;AAC1C,MAAI,CAAC,MAAO,QAAO;AAEnB,QAAM,cAAc,eAAe,QAAQ,eAAe;AAC1D,iBAAe,WAAW,eAAe;AAEzC,SAAO,gBAAgB;AACzB;AAwBO,IAAM,6BAA+C;AAAA,EAC1D,SAAS;AAAA,EACT,SAAS;AAAA,EACT,UAAU;AAAA,IACR,QAAQ;AAAA,IACR,aAAa;AAAA,IACb,eAAe;AAAA,EACjB;AACF;;;ACtCA,eAAsB,kBACpB,SAC2E;AAC3E,MAAI;AAEF,UAAM,gBAAgB,MAAM,MAAM,mBAAmB;AAAA,MACnD,QAAQ;AAAA,MACR,SAAS,EAAE,gBAAgB,mBAAmB;AAAA,MAC9C,MAAM,KAAK,UAAU;AAAA,QACnB,OAAO,QAAQ;AAAA,QACf,UAAU,QAAQ;AAAA,QAClB,GAAI,QAAQ,UAAU,EAAE,UAAU,QAAQ,QAAQ,IAAI,CAAC;AAAA,MACzD,CAAC;AAAA,IACH,CAAC;AAED,QAAI,CAAC,cAAc,IAAI;AACrB,YAAM,YAAY,MAAM,cAAc,KAAK,EAAE,MAAM,OAAO,CAAC,EAAE;AAC7D,YAAM,OAAe,WAAW,qBAAqB,WAAW,WAAW;AAG3E,UAAI,cAAc,WAAW,OAAO,WAAW,qBAAqB;AAClE,eAAO;AAAA,UACL,SAAS;AAAA,UACT,OAAO;AAAA,UACP,mBAAmB;AAAA,UACnB,qBAAqB;AAAA,UACrB,kBAAkB,UAAU;AAAA,QAC9B;AAAA,MACF;AAEA,UAAI,cAAc,WAAW,OAAO,gBAAgB,KAAK,IAAI,GAAG;AAC9D,eAAO;AAAA,UACL,SAAS;AAAA,UACT,OAAO;AAAA,UACP,mBAAmB;AAAA,UACnB,cAAc;AAAA,QAChB;AAAA,MACF;AAEA,UAAI,cAAc,WAAW,OAAO,oBAAoB,KAAK,IAAI,GAAG;AAClE,eAAO;AAAA,UACL,SAAS;AAAA,UACT,OAAO;AAAA,UACP,mBAAmB;AAAA,UACnB,cAAc;AAAA,QAChB;AAAA,MACF;AAEA,aAAO;AAAA,QACL,SAAS;AAAA,QACT,OAAO;AAAA,QACP,mBAAmB,QAAQ;AAAA,MAC7B;AAAA,IACF;AAEA,UAAM,EAAE,aAAa,IAAI,MAAM,cAAc,KAAK;AAGlD,WAAO,EAAE,SAAS,MAAM,aAAa;AAAA,EACvC,SAAS,OAAO;AACd,YAAQ,MAAM,gBAAgB,KAAK;AACnC,WAAO;AAAA,MACL,SAAS;AAAA,MACT,OAAO;AAAA,MACP,mBAAmB;AAAA,IACrB;AAAA,EACF;AACF;AAkBA,eAAsB,2BACpB,SAKsB;AACtB,MAAI;AACF,UAAM,WAAW,MAAM,MAAM,mCAAmC;AAAA,MAC9D,QAAQ;AAAA,MACR,SAAS,EAAE,gBAAgB,mBAAmB;AAAA,MAC9C,MAAM,KAAK,UAAU;AAAA,QACnB,OAAO,QAAQ;AAAA,QACf,YAAY,QAAQ;AAAA,MACtB,CAAC;AAAA,IACH,CAAC;AAED,QAAI,CAAC,SAAS,IAAI;AAChB,YAAM,YAAY,MAAM,SAAS,KAAK,EAAE,MAAM,OAAO,CAAC,EAAE;AACxD,aAAO;AAAA,QACL,SAAS;AAAA,QACT,OAAO;AAAA,QACP,mBAAmB,UAAU,qBAAqB;AAAA,MACpD;AAAA,IACF;AAEA,UAAM,OAAO,MAAM,SAAS,KAAK;AAEjC,WAAO;AAAA,MACL,SAAS;AAAA,MACT,eAAe,KAAK;AAAA,MACpB,aAAa,KAAK;AAAA,IACpB;AAAA,EACF,SAAS,OAAO;AACd,YAAQ,MAAM,8BAA8B,KAAK;AACjD,WAAO;AAAA,MACL,SAAS;AAAA,MACT,OAAO;AAAA,MACP,mBAAmB;AAAA,IACrB;AAAA,EACF;AACF;AAWA,eAAsB,2BACpB,aACqD;AACrD,SAAO,EAAE,SAAS,MAAM,cAAc,YAAY;AACpD;AAQA,eAAsB,iBACpB,aACA,cAC+B;AAC/B,MAAI;AACF,UAAM,MAAM,+BAA+B;AAAA,MACzC,QAAQ;AAAA,MACR,SAAS,EAAE,gBAAgB,mBAAmB;AAAA,MAC9C,MAAM,KAAK,UAAU;AAAA,QACnB,cAAc;AAAA,QACd,eAAe;AAAA,MACjB,CAAC;AAAA,IACH,CAAC;AAED,WAAO,EAAE,SAAS,KAAK;AAAA,EACzB,SAAS,OAAO;AACd,YAAQ,MAAM,8BAA8B,KAAK;AACjD,WAAO,EAAE,SAAS,MAAM;AAAA,EAC1B;AACF;AAsBA,eAAsB,OAAO,SAAmD;AAE9E,QAAM,EAAE,SAAAC,SAAQ,IAAI,MAAM,OAAO,iBAAiB;AAGlD,QAAMA,SAAQ;AAAA,IACZ,aAAa,SAAS,eAAe;AAAA,IACrC,UAAU;AAAA,EACZ,CAAC;AACH;AAwBO,SAAS,iBAAiB,QAAgB,aAA4B;AAC3E,QAAM,cAAc,eAAe,OAAO,SAAS;AAInD,SAAO,SAAS,OAAO,GAAG,MAAM,6BAA6B,mBAAmB,WAAW,CAAC;AAC9F;","names":["import_react","import_react","import_react","signOut"]}

package/dist/client/index.mjs

@@ -334,26 +334,16 @@ async function simulateApproval(challengeId, selectedCode) {
   }
 }
 async function logout(options) {
-  try {
-    const { getSession } = await import("next-auth/react");
-    const session = await getSession();
-    if (session?.accessToken) {
-      await fetch("/api/auth/logout", {
-        method: "POST",
-        headers: {
-          "Authorization": `Bearer ${session.accessToken}`
-        }
-      });
-    }
-  } catch (error) {
-    console.error("[Logout] Failed to call logout API:", error);
-  }
   const { signOut: signOut4 } = await import("next-auth/react");
   await signOut4({
     callbackUrl: options?.callbackUrl || "/",
     redirect: true
   });
 }
+function logoutEverywhere(issuer, callbackUrl) {
+  const redirectUri = callbackUrl || window.location.origin;
+  window.location.href = `${issuer}/auth/logout?redirect_uri=${encodeURIComponent(redirectUri)}`;
+}
 export {
   AuthStatus,
   DEFAULT_HOSTED_AUTH_CONFIG,
@@ -366,6 +356,7 @@ export {
   initiateAuthenticatorLogin,
   loginWithPassword,
   logout,
+  logoutEverywhere,
   redirectToHostedAuth,
   signIn3 as signIn,
   signOut3 as signOut,

package/dist/client/index.mjs.map

@@ -1 +1 @@
-{"version":3,"sources":["../../src/client/index.ts","../../src/client/hooks.ts","../../src/client/components.tsx","../../src/utils/hosted-auth.ts","../../src/client/auth.ts"],"sourcesContent":["// Client-side exports\n\n// Re-export commonly used next-auth/react functions\nexport { signIn, signOut, useSession, SessionProvider } from 'next-auth/react';\nexport type { Session } from 'next-auth';\nexport {\n  useOAuth42Session,\n  useOAuth42User,\n  useOAuth42Tokens,\n  useRequireAuth,\n} from './hooks';\n\nexport type {\n  OAuth42Session,\n  UseOAuth42SessionReturn,\n} from './hooks';\n\nexport {\n  SignInButton,\n  SignOutButton,\n  UserProfile,\n  AuthStatus,\n  ProtectedComponent,\n} from './components';\n\nexport type {\n  SignInButtonProps,\n  SignOutButtonProps,\n  UserProfileProps,\n  AuthStatusProps,\n  ProtectedComponentProps,\n} from './components';\n\n// Hosted auth utilities\nexport {\n  redirectToHostedAuth,\n  verifyState,\n  DEFAULT_HOSTED_AUTH_CONFIG,\n} from '../utils/hosted-auth';\n\nexport type {\n  HostedAuthOptions,\n  HostedAuthConfig,\n} from '../utils/hosted-auth';\n\n// Custom authentication utilities\nexport {\n  loginWithPassword,\n  initiateAuthenticatorLogin,\n  completeAuthenticatorLogin,\n  simulateApproval,\n  logout,\n} from './auth';\n\nexport type {\n  LoginWithPasswordOptions,\n  LoginWithAuthenticatorOptions,\n  AuthError,\n} from './auth';","import { useSession, signIn, signOut } from 'next-auth/react';\nimport { useCallback, useEffect, useState } from 'react';\n\nexport type OAuth42Session<E = {}> = ({\n  user?: {\n    email?: string | null;\n    name?: string | null;\n    image?: string | null;\n    username?: string;\n    emailVerified?: boolean;\n  };\n  accessToken?: string;\n  idToken?: string;\n  expires?: string;\n}) & E;\n\nexport interface UseOAuth42SessionReturn<E = {}> {\n  session: OAuth42Session<E> | null;\n  loading: boolean;\n  error: Error | null;\n  isAuthenticated: boolean;\n  signIn: () => Promise<void>;\n  signOut: () => Promise<void>;\n}\n\n/**\n * Hook to manage OAuth42 session with optional extra fields\n */\nexport function useOAuth42Session<E = {}>(): UseOAuth42SessionReturn<E> {\n  const { data: session, status } = useSession();\n  const [error, setError] = useState<Error | null>(null);\n  \n  const handleSignIn = useCallback(async () => {\n    try {\n      setError(null);\n      await signIn('oauth42');\n    } catch (err) {\n      setError(err as Error);\n    }\n  }, []);\n  \n  const handleSignOut = useCallback(async () => {\n    try {\n      setError(null);\n      await signOut();\n    } catch (err) {\n      setError(err as Error);\n    }\n  }, []);\n  \n  return {\n    session: session as unknown as OAuth42Session<E> | null,\n    loading: status === 'loading',\n    error,\n    isAuthenticated: status === 'authenticated',\n    signIn: handleSignIn,\n    signOut: handleSignOut,\n  };\n}\n\n/**\n * Hook to get the current OAuth42 user\n */\nexport function useOAuth42User<E = {}>() {\n  const { session, isAuthenticated } = useOAuth42Session<E>();\n  \n  return {\n    user: isAuthenticated ? session?.user : null,\n    isAuthenticated,\n  };\n}\n\n/**\n * Hook to manage OAuth42 tokens\n */\nexport function useOAuth42Tokens<E = {}>() {\n  const { session } = useOAuth42Session<E>();\n  const [isExpired, setIsExpired] = useState(false);\n  \n  useEffect(() => {\n    if (session?.expires) {\n      const expiryTime = new Date(session.expires).getTime();\n      const now = Date.now();\n      setIsExpired(now >= expiryTime);\n      \n      // Set a timer to update expiry status\n      const timeUntilExpiry = expiryTime - now;\n      if (timeUntilExpiry > 0) {\n        const timer = setTimeout(() => {\n          setIsExpired(true);\n        }, timeUntilExpiry);\n        \n        return () => clearTimeout(timer);\n      }\n    }\n  }, [session?.expires]);\n  \n  return {\n    accessToken: session?.accessToken,\n    idToken: session?.idToken,\n    isExpired,\n    refreshToken: async () => {\n      // Trigger a session refresh\n      await signIn('oauth42');\n    },\n  };\n}\n\n/**\n * Hook for protected routes\n */\nexport function useRequireAuth(redirectTo: string = '/auth/signin') {\n  const { isAuthenticated, loading } = useOAuth42Session();\n  const [isRedirecting, setIsRedirecting] = useState(false);\n  \n  useEffect(() => {\n    if (!loading && !isAuthenticated && !isRedirecting) {\n      setIsRedirecting(true);\n      if (typeof window !== 'undefined') {\n        window.location.href = redirectTo;\n      }\n    }\n  }, [isAuthenticated, loading, redirectTo, isRedirecting]);\n  \n  return {\n    isAuthenticated,\n    loading: loading || isRedirecting,\n  };\n}\n","import React from 'react';\nimport { signIn, signOut } from 'next-auth/react';\nimport { useOAuth42Session, useOAuth42User } from './hooks';\n\nexport interface SignInButtonProps {\n  children?: React.ReactNode;\n  className?: string;\n  callbackUrl?: string;\n  onClick?: () => void;\n}\n\n/**\n * Sign in button component\n */\nexport function SignInButton({ \n  children = 'Sign in with OAuth42', \n  className = '',\n  callbackUrl = '/',\n  onClick\n}: SignInButtonProps) {\n  const handleClick = async () => {\n    if (onClick) onClick();\n    await signIn('oauth42', { callbackUrl });\n  };\n  \n  return (\n    <button\n      onClick={handleClick}\n      className={className}\n      type=\"button\"\n    >\n      {children}\n    </button>\n  );\n}\n\nexport interface SignOutButtonProps {\n  children?: React.ReactNode;\n  className?: string;\n  callbackUrl?: string;\n  onClick?: () => void;\n}\n\n/**\n * Sign out button component\n */\nexport function SignOutButton({ \n  children = 'Sign out', \n  className = '',\n  callbackUrl = '/',\n  onClick\n}: SignOutButtonProps) {\n  const handleClick = async () => {\n    if (onClick) onClick();\n    await signOut({ callbackUrl });\n  };\n  \n  return (\n    <button\n      onClick={handleClick}\n      className={className}\n      type=\"button\"\n    >\n      {children}\n    </button>\n  );\n}\n\nexport interface UserProfileProps {\n  className?: string;\n  showEmail?: boolean;\n  showName?: boolean;\n  showImage?: boolean;\n  loadingComponent?: React.ReactNode;\n  notAuthenticatedComponent?: React.ReactNode;\n}\n\n/**\n * User profile display component\n */\nexport function UserProfile({\n  className = '',\n  showEmail = true,\n  showName = true,\n  showImage = true,\n  loadingComponent = <div>Loading...</div>,\n  notAuthenticatedComponent = <div>Not authenticated</div>,\n}: UserProfileProps) {\n  const { session, loading, isAuthenticated } = useOAuth42Session();\n  \n  if (loading) {\n    return <>{loadingComponent}</>;\n  }\n  \n  if (!isAuthenticated || !session?.user) {\n    return <>{notAuthenticatedComponent}</>;\n  }\n  \n  const { user } = session;\n  \n  return (\n    <div className={className}>\n      {showImage && user.image && (\n        <img \n          src={user.image} \n          alt={user.name || 'User'} \n          style={{ width: 50, height: 50, borderRadius: '50%' }}\n        />\n      )}\n      {showName && user.name && <div>{user.name}</div>}\n      {showEmail && user.email && <div>{user.email}</div>}\n    </div>\n  );\n}\n\nexport interface AuthStatusProps {\n  authenticatedComponent?: React.ReactNode;\n  unauthenticatedComponent?: React.ReactNode;\n  loadingComponent?: React.ReactNode;\n}\n\n/**\n * Conditional rendering based on auth status\n */\nexport function AuthStatus({\n  authenticatedComponent,\n  unauthenticatedComponent,\n  loadingComponent = <div>Loading...</div>,\n}: AuthStatusProps) {\n  const { isAuthenticated, loading } = useOAuth42Session();\n  \n  if (loading) {\n    return <>{loadingComponent}</>;\n  }\n  \n  return <>{isAuthenticated ? authenticatedComponent : unauthenticatedComponent}</>;\n}\n\nexport interface ProtectedComponentProps {\n  children: React.ReactNode;\n  fallback?: React.ReactNode;\n  loadingComponent?: React.ReactNode;\n}\n\n/**\n * Wrapper component for protected content\n */\nexport function ProtectedComponent({\n  children,\n  fallback = <SignInButton />,\n  loadingComponent = <div>Loading...</div>,\n}: ProtectedComponentProps) {\n  const { isAuthenticated, loading } = useOAuth42Session();\n  \n  if (loading) {\n    return <>{loadingComponent}</>;\n  }\n  \n  if (!isAuthenticated) {\n    return <>{fallback}</>;\n  }\n  \n  return <>{children}</>;\n}","/**\n * Utilities for OAuth42 Hosted Authentication\n */\n\nexport interface HostedAuthOptions {\n  /** OAuth2 client ID */\n  clientId: string;\n  /** Redirect URI after authentication */\n  redirectUri: string;\n  /** OAuth2 scopes (space-separated) */\n  scope?: string;\n  /** OAuth2 state parameter for CSRF protection */\n  state?: string;\n  /** Base URL for hosted auth (defaults to production) */\n  baseUrl?: string;\n}\n\n/**\n * Generate a random state parameter for CSRF protection\n */\nfunction generateState(): string {\n  const array = new Uint8Array(32);\n  crypto.getRandomValues(array);\n  return Array.from(array, byte => byte.toString(16).padStart(2, '0')).join('');\n}\n\n/**\n * Redirect to OAuth42 hosted authentication pages\n *\n * @example\n * ```ts\n * import { redirectToHostedAuth } from '@oauth42/next/client';\n *\n * function LoginButton() {\n *   return (\n *     <button onClick={() => redirectToHostedAuth({\n *       clientId: process.env.NEXT_PUBLIC_OAUTH42_CLIENT_ID!,\n *       redirectUri: `${window.location.origin}/api/auth/callback`,\n *     })}>\n *       Sign in with OAuth42\n *     </button>\n *   );\n * }\n * ```\n */\nexport function redirectToHostedAuth(options: HostedAuthOptions): void {\n  const {\n    clientId,\n    redirectUri,\n    scope = 'openid profile email',\n    state = generateState(),\n    baseUrl = 'https://auth.oauth42.com',\n  } = options;\n\n  const params = new URLSearchParams({\n    client_id: clientId,\n    redirect_uri: redirectUri,\n    response_type: 'code',\n    scope,\n    state,\n  });\n\n  const authUrl = `${baseUrl}/login?${params.toString()}`;\n\n  // Store state in sessionStorage for verification on callback\n  if (typeof window !== 'undefined') {\n    sessionStorage.setItem('oauth42_state', state);\n    window.location.href = authUrl;\n  }\n}\n\n/**\n * Verify state parameter on OAuth2 callback\n * Call this in your callback page to verify the state matches\n *\n * @example\n * ```ts\n * import { verifyState } from '@oauth42/next/client';\n *\n * export default function CallbackPage() {\n *   const searchParams = useSearchParams();\n *   const state = searchParams.get('state');\n *\n *   if (!verifyState(state)) {\n *     return <div>Invalid state parameter</div>;\n *   }\n *\n *   // Continue with token exchange...\n * }\n * ```\n */\nexport function verifyState(state: string | null): boolean {\n  if (typeof window === 'undefined') return false;\n  if (!state) return false;\n\n  const storedState = sessionStorage.getItem('oauth42_state');\n  sessionStorage.removeItem('oauth42_state');\n\n  return storedState === state;\n}\n\n/**\n * Configuration for hosted authentication\n */\nexport interface HostedAuthConfig {\n  /** Enable hosted authentication */\n  enabled: boolean;\n  /** Base URL for hosted auth pages (optional, defaults to production) */\n  baseUrl?: string;\n  /** Feature flags for hosted auth */\n  features?: {\n    /** Allow user signup */\n    signup?: boolean;\n    /** Allow social login */\n    socialLogin?: boolean;\n    /** Allow password reset */\n    passwordReset?: boolean;\n  };\n}\n\n/**\n * Default hosted auth configuration\n */\nexport const DEFAULT_HOSTED_AUTH_CONFIG: HostedAuthConfig = {\n  enabled: true,\n  baseUrl: 'https://auth.oauth42.com',\n  features: {\n    signup: true,\n    socialLogin: false,\n    passwordReset: true,\n  },\n};\n","/**\n * OAuth42 Custom Authentication Utilities\n *\n * Provides functions for implementing custom login UIs in customer apps\n * while properly handling OAuth2 PKCE flows and next-auth integration.\n */\n\nimport { signIn } from 'next-auth/react';\n\n// PKCE utilities\nfunction base64URLEncode(buffer: ArrayBuffer): string {\n  const bytes = new Uint8Array(buffer);\n  let binary = '';\n  for (let i = 0; i < bytes.byteLength; i++) {\n    binary += String.fromCharCode(bytes[i]);\n  }\n  return btoa(binary)\n    .replace(/\\+/g, '-')\n    .replace(/\\//g, '_')\n    .replace(/=/g, '');\n}\n\nasync function generateCodeVerifier(): Promise<string> {\n  const array = new Uint8Array(32);\n  crypto.getRandomValues(array);\n  return base64URLEncode(array.buffer);\n}\n\nasync function generateCodeChallenge(verifier: string): Promise<string> {\n  const encoder = new TextEncoder();\n  const data = encoder.encode(verifier);\n  const hash = await crypto.subtle.digest('SHA-256', data);\n  return base64URLEncode(hash);\n}\n\nfunction generateState(): string {\n  const array = new Uint8Array(32);\n  crypto.getRandomValues(array);\n  return base64URLEncode(array.buffer);\n}\n\nexport interface LoginWithPasswordOptions {\n  email: string;\n  password: string;\n  mfaCode?: string;\n  /**\n   * URL to redirect to after successful authentication.\n   * If not provided, will redirect to '/'\n   */\n  callbackUrl?: string;\n}\n\nexport interface LoginWithAuthenticatorOptions {\n  email: string;\n  sessionId: string;\n  /**\n   * URL to redirect to after successful authentication.\n   * If not provided, will redirect to '/'\n   */\n  callbackUrl?: string;\n}\n\nexport interface AuthError {\n  error: string;\n  error_description?: string;\n  requires_enrollment?: boolean;\n  enrollment_token?: string;\n  requires_mfa?: boolean;\n}\n\n/**\n * Authenticate with email/password and complete OAuth PKCE flow\n *\n * This function handles the full authentication flow:\n * 1. Authenticates with the backend using credentials\n * 2. Uses the access token to authorize the OAuth client\n * 3. Exchanges authorization code for tokens via next-auth\n *\n * @example\n * ```tsx\n * const result = await loginWithPassword({\n *   email: 'user@example.com',\n *   password: 'password123',\n *   callbackUrl: '/dashboard'\n * });\n *\n * if (result.success) {\n *   // User is authenticated, next-auth session is set\n * } else if (result.requires_mfa) {\n *   // Prompt for MFA code and call again with mfaCode\n * }\n * ```\n */\nexport async function loginWithPassword(\n  options: LoginWithPasswordOptions\n): Promise<{ success: boolean; access_token?: string } & Partial<AuthError>> {\n  try {\n    // Step 1: Authenticate with backend to get access token\n    const loginResponse = await fetch('/api/auth/login', {\n      method: 'POST',\n      headers: { 'Content-Type': 'application/json' },\n      body: JSON.stringify({\n        email: options.email,\n        password: options.password,\n        ...(options.mfaCode ? { mfa_code: options.mfaCode } : {}),\n      }),\n    });\n\n    if (!loginResponse.ok) {\n      const errorData = await loginResponse.json().catch(() => ({}));\n      const desc: string = errorData?.error_description || errorData?.message || '';\n\n      // Handle special cases\n      if (loginResponse.status === 403 && errorData?.requires_enrollment) {\n        return {\n          success: false,\n          error: 'enrollment_required',\n          error_description: 'MFA enrollment required',\n          requires_enrollment: true,\n          enrollment_token: errorData.enrollment_token,\n        };\n      }\n\n      if (loginResponse.status === 403 && /mfa required/i.test(desc)) {\n        return {\n          success: false,\n          error: 'mfa_required',\n          error_description: 'MFA code required',\n          requires_mfa: true,\n        };\n      }\n\n      if (loginResponse.status === 401 && /invalid mfa code/i.test(desc)) {\n        return {\n          success: false,\n          error: 'invalid_mfa_code',\n          error_description: 'Invalid MFA code',\n          requires_mfa: true,\n        };\n      }\n\n      return {\n        success: false,\n        error: 'authentication_failed',\n        error_description: desc || 'Invalid credentials',\n      };\n    }\n\n    const { access_token } = await loginResponse.json();\n\n    // Return access token for the application to use in OAuth authorize flow\n    return { success: true, access_token };\n  } catch (error) {\n    console.error('Login error:', error);\n    return {\n      success: false,\n      error: 'network_error',\n      error_description: 'Failed to connect to authentication server',\n    };\n  }\n}\n\n/**\n * Initiate authenticator (passwordless) login and return challenge code\n *\n * @example\n * ```tsx\n * const result = await initiateAuthenticatorLogin({\n *   email: 'user@example.com',\n *   sessionId: crypto.randomUUID()\n * });\n *\n * if (result.success) {\n *   // Display result.challengeCode to user\n *   // Wait for WebSocket approval or poll for completion\n * }\n * ```\n */\nexport async function initiateAuthenticatorLogin(\n  options: LoginWithAuthenticatorOptions\n): Promise<{\n  success: boolean;\n  challengeCode?: string;\n  challengeId?: string;\n} & Partial<AuthError>> {\n  try {\n    const response = await fetch('/api/auth/passwordless/initiate', {\n      method: 'POST',\n      headers: { 'Content-Type': 'application/json' },\n      body: JSON.stringify({\n        email: options.email,\n        session_id: options.sessionId,\n      }),\n    });\n\n    if (!response.ok) {\n      const errorData = await response.json().catch(() => ({}));\n      return {\n        success: false,\n        error: 'initiation_failed',\n        error_description: errorData.error_description || 'Failed to create challenge',\n      };\n    }\n\n    const data = await response.json();\n\n    return {\n      success: true,\n      challengeCode: data.challenge_code,\n      challengeId: data.challenge_id,\n    };\n  } catch (error) {\n    console.error('Authenticator login error:', error);\n    return {\n      success: false,\n      error: 'network_error',\n      error_description: 'Failed to connect to authentication server',\n    };\n  }\n}\n\n/**\n * Complete authenticator login after approval\n *\n * Call this after receiving approval notification via WebSocket\n * or after the user has approved on their mobile device.\n * Returns the access token for the application to use in OAuth authorize flow.\n *\n * @param accessToken - Access token received from approval payload\n */\nexport async function completeAuthenticatorLogin(\n  accessToken: string\n): Promise<{ success: boolean; access_token: string }> {\n  return { success: true, access_token: accessToken };\n}\n\n/**\n * Simulate approval for testing (development only)\n *\n * @param challengeId - The challenge ID to approve\n * @param selectedCode - The code that was displayed to the user\n */\nexport async function simulateApproval(\n  challengeId: string,\n  selectedCode: string\n): Promise<{ success: boolean }> {\n  try {\n    await fetch('/api/auth/challenge/approve', {\n      method: 'POST',\n      headers: { 'Content-Type': 'application/json' },\n      body: JSON.stringify({\n        challenge_id: challengeId,\n        selected_code: selectedCode,\n      }),\n    });\n\n    return { success: true };\n  } catch (error) {\n    console.error('Simulated approval failed:', error);\n    return { success: false };\n  }\n}\n\n/**\n * Logout the current user\n *\n * Calls the logout API route to clear backend session and oauth42_session cookie,\n * then calls next-auth signOut to clear the next-auth session and redirect.\n *\n * @param callbackUrl - URL to redirect to after logout (default: '/')\n *\n * @example\n * ```tsx\n * import { logout } from '@oauth42/next/client';\n *\n * const handleLogout = async () => {\n *   await logout({ callbackUrl: '/login' });\n * };\n * ```\n */\nexport async function logout(options?: { callbackUrl?: string }): Promise<void> {\n  try {\n    // Get the current session to retrieve the access token\n    const { getSession } = await import('next-auth/react');\n    const session: any = await getSession();\n\n    // Call logout API route to clear backend session and oauth42_session cookie\n    if (session?.accessToken) {\n      await fetch('/api/auth/logout', {\n        method: 'POST',\n        headers: {\n          'Authorization': `Bearer ${session.accessToken}`,\n        },\n      });\n    }\n  } catch (error) {\n    console.error('[Logout] Failed to call logout API:', error);\n    // Continue with signOut anyway\n  }\n\n  // Import signOut from next-auth/react\n  const { signOut } = await import('next-auth/react');\n\n  // Clear next-auth session\n  await signOut({\n    callbackUrl: options?.callbackUrl || '/',\n    redirect: true\n  });\n}\n"],"mappings":";AAGA,SAAS,UAAAA,SAAQ,WAAAC,UAAS,cAAAC,aAAY,uBAAuB;;;ACH7D,SAAS,YAAY,QAAQ,eAAe;AAC5C,SAAS,aAAa,WAAW,gBAAgB;AA2B1C,SAAS,oBAAwD;AACtE,QAAM,EAAE,MAAM,SAAS,OAAO,IAAI,WAAW;AAC7C,QAAM,CAAC,OAAO,QAAQ,IAAI,SAAuB,IAAI;AAErD,QAAM,eAAe,YAAY,YAAY;AAC3C,QAAI;AACF,eAAS,IAAI;AACb,YAAM,OAAO,SAAS;AAAA,IACxB,SAAS,KAAK;AACZ,eAAS,GAAY;AAAA,IACvB;AAAA,EACF,GAAG,CAAC,CAAC;AAEL,QAAM,gBAAgB,YAAY,YAAY;AAC5C,QAAI;AACF,eAAS,IAAI;AACb,YAAM,QAAQ;AAAA,IAChB,SAAS,KAAK;AACZ,eAAS,GAAY;AAAA,IACvB;AAAA,EACF,GAAG,CAAC,CAAC;AAEL,SAAO;AAAA,IACL;AAAA,IACA,SAAS,WAAW;AAAA,IACpB;AAAA,IACA,iBAAiB,WAAW;AAAA,IAC5B,QAAQ;AAAA,IACR,SAAS;AAAA,EACX;AACF;AAKO,SAAS,iBAAyB;AACvC,QAAM,EAAE,SAAS,gBAAgB,IAAI,kBAAqB;AAE1D,SAAO;AAAA,IACL,MAAM,kBAAkB,SAAS,OAAO;AAAA,IACxC;AAAA,EACF;AACF;AAKO,SAAS,mBAA2B;AACzC,QAAM,EAAE,QAAQ,IAAI,kBAAqB;AACzC,QAAM,CAAC,WAAW,YAAY,IAAI,SAAS,KAAK;AAEhD,YAAU,MAAM;AACd,QAAI,SAAS,SAAS;AACpB,YAAM,aAAa,IAAI,KAAK,QAAQ,OAAO,EAAE,QAAQ;AACrD,YAAM,MAAM,KAAK,IAAI;AACrB,mBAAa,OAAO,UAAU;AAG9B,YAAM,kBAAkB,aAAa;AACrC,UAAI,kBAAkB,GAAG;AACvB,cAAM,QAAQ,WAAW,MAAM;AAC7B,uBAAa,IAAI;AAAA,QACnB,GAAG,eAAe;AAElB,eAAO,MAAM,aAAa,KAAK;AAAA,MACjC;AAAA,IACF;AAAA,EACF,GAAG,CAAC,SAAS,OAAO,CAAC;AAErB,SAAO;AAAA,IACL,aAAa,SAAS;AAAA,IACtB,SAAS,SAAS;AAAA,IAClB;AAAA,IACA,cAAc,YAAY;AAExB,YAAM,OAAO,SAAS;AAAA,IACxB;AAAA,EACF;AACF;AAKO,SAAS,eAAe,aAAqB,gBAAgB;AAClE,QAAM,EAAE,iBAAiB,QAAQ,IAAI,kBAAkB;AACvD,QAAM,CAAC,eAAe,gBAAgB,IAAI,SAAS,KAAK;AAExD,YAAU,MAAM;AACd,QAAI,CAAC,WAAW,CAAC,mBAAmB,CAAC,eAAe;AAClD,uBAAiB,IAAI;AACrB,UAAI,OAAO,WAAW,aAAa;AACjC,eAAO,SAAS,OAAO;AAAA,MACzB;AAAA,IACF;AAAA,EACF,GAAG,CAAC,iBAAiB,SAAS,YAAY,aAAa,CAAC;AAExD,SAAO;AAAA,IACL;AAAA,IACA,SAAS,WAAW;AAAA,EACtB;AACF;;;AC/HA,SAAS,UAAAC,SAAQ,WAAAC,gBAAe;AAyB5B,SAiEO,UAjEP,KA2EA,YA3EA;AAZG,SAAS,aAAa;AAAA,EAC3B,WAAW;AAAA,EACX,YAAY;AAAA,EACZ,cAAc;AAAA,EACd;AACF,GAAsB;AACpB,QAAM,cAAc,YAAY;AAC9B,QAAI,QAAS,SAAQ;AACrB,UAAMC,QAAO,WAAW,EAAE,YAAY,CAAC;AAAA,EACzC;AAEA,SACE;AAAA,IAAC;AAAA;AAAA,MACC,SAAS;AAAA,MACT;AAAA,MACA,MAAK;AAAA,MAEJ;AAAA;AAAA,EACH;AAEJ;AAYO,SAAS,cAAc;AAAA,EAC5B,WAAW;AAAA,EACX,YAAY;AAAA,EACZ,cAAc;AAAA,EACd;AACF,GAAuB;AACrB,QAAM,cAAc,YAAY;AAC9B,QAAI,QAAS,SAAQ;AACrB,UAAMC,SAAQ,EAAE,YAAY,CAAC;AAAA,EAC/B;AAEA,SACE;AAAA,IAAC;AAAA;AAAA,MACC,SAAS;AAAA,MACT;AAAA,MACA,MAAK;AAAA,MAEJ;AAAA;AAAA,EACH;AAEJ;AAcO,SAAS,YAAY;AAAA,EAC1B,YAAY;AAAA,EACZ,YAAY;AAAA,EACZ,WAAW;AAAA,EACX,YAAY;AAAA,EACZ,mBAAmB,oBAAC,SAAI,wBAAU;AAAA,EAClC,4BAA4B,oBAAC,SAAI,+BAAiB;AACpD,GAAqB;AACnB,QAAM,EAAE,SAAS,SAAS,gBAAgB,IAAI,kBAAkB;AAEhE,MAAI,SAAS;AACX,WAAO,gCAAG,4BAAiB;AAAA,EAC7B;AAEA,MAAI,CAAC,mBAAmB,CAAC,SAAS,MAAM;AACtC,WAAO,gCAAG,qCAA0B;AAAA,EACtC;AAEA,QAAM,EAAE,KAAK,IAAI;AAEjB,SACE,qBAAC,SAAI,WACF;AAAA,iBAAa,KAAK,SACjB;AAAA,MAAC;AAAA;AAAA,QACC,KAAK,KAAK;AAAA,QACV,KAAK,KAAK,QAAQ;AAAA,QAClB,OAAO,EAAE,OAAO,IAAI,QAAQ,IAAI,cAAc,MAAM;AAAA;AAAA,IACtD;AAAA,IAED,YAAY,KAAK,QAAQ,oBAAC,SAAK,eAAK,MAAK;AAAA,IACzC,aAAa,KAAK,SAAS,oBAAC,SAAK,eAAK,OAAM;AAAA,KAC/C;AAEJ;AAWO,SAAS,WAAW;AAAA,EACzB;AAAA,EACA;AAAA,EACA,mBAAmB,oBAAC,SAAI,wBAAU;AACpC,GAAoB;AAClB,QAAM,EAAE,iBAAiB,QAAQ,IAAI,kBAAkB;AAEvD,MAAI,SAAS;AACX,WAAO,gCAAG,4BAAiB;AAAA,EAC7B;AAEA,SAAO,gCAAG,4BAAkB,yBAAyB,0BAAyB;AAChF;AAWO,SAAS,mBAAmB;AAAA,EACjC;AAAA,EACA,WAAW,oBAAC,gBAAa;AAAA,EACzB,mBAAmB,oBAAC,SAAI,wBAAU;AACpC,GAA4B;AAC1B,QAAM,EAAE,iBAAiB,QAAQ,IAAI,kBAAkB;AAEvD,MAAI,SAAS;AACX,WAAO,gCAAG,4BAAiB;AAAA,EAC7B;AAEA,MAAI,CAAC,iBAAiB;AACpB,WAAO,gCAAG,oBAAS;AAAA,EACrB;AAEA,SAAO,gCAAG,UAAS;AACrB;;;AC/IA,SAAS,gBAAwB;AAC/B,QAAM,QAAQ,IAAI,WAAW,EAAE;AAC/B,SAAO,gBAAgB,KAAK;AAC5B,SAAO,MAAM,KAAK,OAAO,UAAQ,KAAK,SAAS,EAAE,EAAE,SAAS,GAAG,GAAG,CAAC,EAAE,KAAK,EAAE;AAC9E;AAqBO,SAAS,qBAAqB,SAAkC;AACrE,QAAM;AAAA,IACJ;AAAA,IACA;AAAA,IACA,QAAQ;AAAA,IACR,QAAQ,cAAc;AAAA,IACtB,UAAU;AAAA,EACZ,IAAI;AAEJ,QAAM,SAAS,IAAI,gBAAgB;AAAA,IACjC,WAAW;AAAA,IACX,cAAc;AAAA,IACd,eAAe;AAAA,IACf;AAAA,IACA;AAAA,EACF,CAAC;AAED,QAAM,UAAU,GAAG,OAAO,UAAU,OAAO,SAAS,CAAC;AAGrD,MAAI,OAAO,WAAW,aAAa;AACjC,mBAAe,QAAQ,iBAAiB,KAAK;AAC7C,WAAO,SAAS,OAAO;AAAA,EACzB;AACF;AAsBO,SAAS,YAAY,OAA+B;AACzD,MAAI,OAAO,WAAW,YAAa,QAAO;AAC1C,MAAI,CAAC,MAAO,QAAO;AAEnB,QAAM,cAAc,eAAe,QAAQ,eAAe;AAC1D,iBAAe,WAAW,eAAe;AAEzC,SAAO,gBAAgB;AACzB;AAwBO,IAAM,6BAA+C;AAAA,EAC1D,SAAS;AAAA,EACT,SAAS;AAAA,EACT,UAAU;AAAA,IACR,QAAQ;AAAA,IACR,aAAa;AAAA,IACb,eAAe;AAAA,EACjB;AACF;;;ACtCA,eAAsB,kBACpB,SAC2E;AAC3E,MAAI;AAEF,UAAM,gBAAgB,MAAM,MAAM,mBAAmB;AAAA,MACnD,QAAQ;AAAA,MACR,SAAS,EAAE,gBAAgB,mBAAmB;AAAA,MAC9C,MAAM,KAAK,UAAU;AAAA,QACnB,OAAO,QAAQ;AAAA,QACf,UAAU,QAAQ;AAAA,QAClB,GAAI,QAAQ,UAAU,EAAE,UAAU,QAAQ,QAAQ,IAAI,CAAC;AAAA,MACzD,CAAC;AAAA,IACH,CAAC;AAED,QAAI,CAAC,cAAc,IAAI;AACrB,YAAM,YAAY,MAAM,cAAc,KAAK,EAAE,MAAM,OAAO,CAAC,EAAE;AAC7D,YAAM,OAAe,WAAW,qBAAqB,WAAW,WAAW;AAG3E,UAAI,cAAc,WAAW,OAAO,WAAW,qBAAqB;AAClE,eAAO;AAAA,UACL,SAAS;AAAA,UACT,OAAO;AAAA,UACP,mBAAmB;AAAA,UACnB,qBAAqB;AAAA,UACrB,kBAAkB,UAAU;AAAA,QAC9B;AAAA,MACF;AAEA,UAAI,cAAc,WAAW,OAAO,gBAAgB,KAAK,IAAI,GAAG;AAC9D,eAAO;AAAA,UACL,SAAS;AAAA,UACT,OAAO;AAAA,UACP,mBAAmB;AAAA,UACnB,cAAc;AAAA,QAChB;AAAA,MACF;AAEA,UAAI,cAAc,WAAW,OAAO,oBAAoB,KAAK,IAAI,GAAG;AAClE,eAAO;AAAA,UACL,SAAS;AAAA,UACT,OAAO;AAAA,UACP,mBAAmB;AAAA,UACnB,cAAc;AAAA,QAChB;AAAA,MACF;AAEA,aAAO;AAAA,QACL,SAAS;AAAA,QACT,OAAO;AAAA,QACP,mBAAmB,QAAQ;AAAA,MAC7B;AAAA,IACF;AAEA,UAAM,EAAE,aAAa,IAAI,MAAM,cAAc,KAAK;AAGlD,WAAO,EAAE,SAAS,MAAM,aAAa;AAAA,EACvC,SAAS,OAAO;AACd,YAAQ,MAAM,gBAAgB,KAAK;AACnC,WAAO;AAAA,MACL,SAAS;AAAA,MACT,OAAO;AAAA,MACP,mBAAmB;AAAA,IACrB;AAAA,EACF;AACF;AAkBA,eAAsB,2BACpB,SAKsB;AACtB,MAAI;AACF,UAAM,WAAW,MAAM,MAAM,mCAAmC;AAAA,MAC9D,QAAQ;AAAA,MACR,SAAS,EAAE,gBAAgB,mBAAmB;AAAA,MAC9C,MAAM,KAAK,UAAU;AAAA,QACnB,OAAO,QAAQ;AAAA,QACf,YAAY,QAAQ;AAAA,MACtB,CAAC;AAAA,IACH,CAAC;AAED,QAAI,CAAC,SAAS,IAAI;AAChB,YAAM,YAAY,MAAM,SAAS,KAAK,EAAE,MAAM,OAAO,CAAC,EAAE;AACxD,aAAO;AAAA,QACL,SAAS;AAAA,QACT,OAAO;AAAA,QACP,mBAAmB,UAAU,qBAAqB;AAAA,MACpD;AAAA,IACF;AAEA,UAAM,OAAO,MAAM,SAAS,KAAK;AAEjC,WAAO;AAAA,MACL,SAAS;AAAA,MACT,eAAe,KAAK;AAAA,MACpB,aAAa,KAAK;AAAA,IACpB;AAAA,EACF,SAAS,OAAO;AACd,YAAQ,MAAM,8BAA8B,KAAK;AACjD,WAAO;AAAA,MACL,SAAS;AAAA,MACT,OAAO;AAAA,MACP,mBAAmB;AAAA,IACrB;AAAA,EACF;AACF;AAWA,eAAsB,2BACpB,aACqD;AACrD,SAAO,EAAE,SAAS,MAAM,cAAc,YAAY;AACpD;AAQA,eAAsB,iBACpB,aACA,cAC+B;AAC/B,MAAI;AACF,UAAM,MAAM,+BAA+B;AAAA,MACzC,QAAQ;AAAA,MACR,SAAS,EAAE,gBAAgB,mBAAmB;AAAA,MAC9C,MAAM,KAAK,UAAU;AAAA,QACnB,cAAc;AAAA,QACd,eAAe;AAAA,MACjB,CAAC;AAAA,IACH,CAAC;AAED,WAAO,EAAE,SAAS,KAAK;AAAA,EACzB,SAAS,OAAO;AACd,YAAQ,MAAM,8BAA8B,KAAK;AACjD,WAAO,EAAE,SAAS,MAAM;AAAA,EAC1B;AACF;AAmBA,eAAsB,OAAO,SAAmD;AAC9E,MAAI;AAEF,UAAM,EAAE,WAAW,IAAI,MAAM,OAAO,iBAAiB;AACrD,UAAM,UAAe,MAAM,WAAW;AAGtC,QAAI,SAAS,aAAa;AACxB,YAAM,MAAM,oBAAoB;AAAA,QAC9B,QAAQ;AAAA,QACR,SAAS;AAAA,UACP,iBAAiB,UAAU,QAAQ,WAAW;AAAA,QAChD;AAAA,MACF,CAAC;AAAA,IACH;AAAA,EACF,SAAS,OAAO;AACd,YAAQ,MAAM,uCAAuC,KAAK;AAAA,EAE5D;AAGA,QAAM,EAAE,SAAAC,SAAQ,IAAI,MAAM,OAAO,iBAAiB;AAGlD,QAAMA,SAAQ;AAAA,IACZ,aAAa,SAAS,eAAe;AAAA,IACrC,UAAU;AAAA,EACZ,CAAC;AACH;","names":["signIn","signOut","useSession","signIn","signOut","signIn","signOut","signOut"]}
+{"version":3,"sources":["../../src/client/index.ts","../../src/client/hooks.ts","../../src/client/components.tsx","../../src/utils/hosted-auth.ts","../../src/client/auth.ts"],"sourcesContent":["// Client-side exports\n\n// Re-export commonly used next-auth/react functions\nexport { signIn, signOut, useSession, SessionProvider } from 'next-auth/react';\nexport type { Session } from 'next-auth';\nexport {\n  useOAuth42Session,\n  useOAuth42User,\n  useOAuth42Tokens,\n  useRequireAuth,\n} from './hooks';\n\nexport type {\n  OAuth42Session,\n  UseOAuth42SessionReturn,\n} from './hooks';\n\nexport {\n  SignInButton,\n  SignOutButton,\n  UserProfile,\n  AuthStatus,\n  ProtectedComponent,\n} from './components';\n\nexport type {\n  SignInButtonProps,\n  SignOutButtonProps,\n  UserProfileProps,\n  AuthStatusProps,\n  ProtectedComponentProps,\n} from './components';\n\n// Hosted auth utilities\nexport {\n  redirectToHostedAuth,\n  verifyState,\n  DEFAULT_HOSTED_AUTH_CONFIG,\n} from '../utils/hosted-auth';\n\nexport type {\n  HostedAuthOptions,\n  HostedAuthConfig,\n} from '../utils/hosted-auth';\n\n// Custom authentication utilities\nexport {\n  loginWithPassword,\n  initiateAuthenticatorLogin,\n  completeAuthenticatorLogin,\n  simulateApproval,\n  logout,\n  logoutEverywhere,\n} from './auth';\n\nexport type {\n  LoginWithPasswordOptions,\n  LoginWithAuthenticatorOptions,\n  AuthError,\n} from './auth';","import { useSession, signIn, signOut } from 'next-auth/react';\nimport { useCallback, useEffect, useState } from 'react';\n\nexport type OAuth42Session<E = {}> = ({\n  user?: {\n    email?: string | null;\n    name?: string | null;\n    image?: string | null;\n    username?: string;\n    emailVerified?: boolean;\n  };\n  accessToken?: string;\n  idToken?: string;\n  expires?: string;\n}) & E;\n\nexport interface UseOAuth42SessionReturn<E = {}> {\n  session: OAuth42Session<E> | null;\n  loading: boolean;\n  error: Error | null;\n  isAuthenticated: boolean;\n  signIn: () => Promise<void>;\n  signOut: () => Promise<void>;\n}\n\n/**\n * Hook to manage OAuth42 session with optional extra fields\n */\nexport function useOAuth42Session<E = {}>(): UseOAuth42SessionReturn<E> {\n  const { data: session, status } = useSession();\n  const [error, setError] = useState<Error | null>(null);\n  \n  const handleSignIn = useCallback(async () => {\n    try {\n      setError(null);\n      await signIn('oauth42');\n    } catch (err) {\n      setError(err as Error);\n    }\n  }, []);\n  \n  const handleSignOut = useCallback(async () => {\n    try {\n      setError(null);\n      await signOut();\n    } catch (err) {\n      setError(err as Error);\n    }\n  }, []);\n  \n  return {\n    session: session as unknown as OAuth42Session<E> | null,\n    loading: status === 'loading',\n    error,\n    isAuthenticated: status === 'authenticated',\n    signIn: handleSignIn,\n    signOut: handleSignOut,\n  };\n}\n\n/**\n * Hook to get the current OAuth42 user\n */\nexport function useOAuth42User<E = {}>() {\n  const { session, isAuthenticated } = useOAuth42Session<E>();\n  \n  return {\n    user: isAuthenticated ? session?.user : null,\n    isAuthenticated,\n  };\n}\n\n/**\n * Hook to manage OAuth42 tokens\n */\nexport function useOAuth42Tokens<E = {}>() {\n  const { session } = useOAuth42Session<E>();\n  const [isExpired, setIsExpired] = useState(false);\n  \n  useEffect(() => {\n    if (session?.expires) {\n      const expiryTime = new Date(session.expires).getTime();\n      const now = Date.now();\n      setIsExpired(now >= expiryTime);\n      \n      // Set a timer to update expiry status\n      const timeUntilExpiry = expiryTime - now;\n      if (timeUntilExpiry > 0) {\n        const timer = setTimeout(() => {\n          setIsExpired(true);\n        }, timeUntilExpiry);\n        \n        return () => clearTimeout(timer);\n      }\n    }\n  }, [session?.expires]);\n  \n  return {\n    accessToken: session?.accessToken,\n    idToken: session?.idToken,\n    isExpired,\n    refreshToken: async () => {\n      // Trigger a session refresh\n      await signIn('oauth42');\n    },\n  };\n}\n\n/**\n * Hook for protected routes\n */\nexport function useRequireAuth(redirectTo: string = '/auth/signin') {\n  const { isAuthenticated, loading } = useOAuth42Session();\n  const [isRedirecting, setIsRedirecting] = useState(false);\n  \n  useEffect(() => {\n    if (!loading && !isAuthenticated && !isRedirecting) {\n      setIsRedirecting(true);\n      if (typeof window !== 'undefined') {\n        window.location.href = redirectTo;\n      }\n    }\n  }, [isAuthenticated, loading, redirectTo, isRedirecting]);\n  \n  return {\n    isAuthenticated,\n    loading: loading || isRedirecting,\n  };\n}\n","import React from 'react';\nimport { signIn, signOut } from 'next-auth/react';\nimport { useOAuth42Session, useOAuth42User } from './hooks';\n\nexport interface SignInButtonProps {\n  children?: React.ReactNode;\n  className?: string;\n  callbackUrl?: string;\n  onClick?: () => void;\n}\n\n/**\n * Sign in button component\n */\nexport function SignInButton({ \n  children = 'Sign in with OAuth42', \n  className = '',\n  callbackUrl = '/',\n  onClick\n}: SignInButtonProps) {\n  const handleClick = async () => {\n    if (onClick) onClick();\n    await signIn('oauth42', { callbackUrl });\n  };\n  \n  return (\n    <button\n      onClick={handleClick}\n      className={className}\n      type=\"button\"\n    >\n      {children}\n    </button>\n  );\n}\n\nexport interface SignOutButtonProps {\n  children?: React.ReactNode;\n  className?: string;\n  callbackUrl?: string;\n  onClick?: () => void;\n}\n\n/**\n * Sign out button component\n */\nexport function SignOutButton({ \n  children = 'Sign out', \n  className = '',\n  callbackUrl = '/',\n  onClick\n}: SignOutButtonProps) {\n  const handleClick = async () => {\n    if (onClick) onClick();\n    await signOut({ callbackUrl });\n  };\n  \n  return (\n    <button\n      onClick={handleClick}\n      className={className}\n      type=\"button\"\n    >\n      {children}\n    </button>\n  );\n}\n\nexport interface UserProfileProps {\n  className?: string;\n  showEmail?: boolean;\n  showName?: boolean;\n  showImage?: boolean;\n  loadingComponent?: React.ReactNode;\n  notAuthenticatedComponent?: React.ReactNode;\n}\n\n/**\n * User profile display component\n */\nexport function UserProfile({\n  className = '',\n  showEmail = true,\n  showName = true,\n  showImage = true,\n  loadingComponent = <div>Loading...</div>,\n  notAuthenticatedComponent = <div>Not authenticated</div>,\n}: UserProfileProps) {\n  const { session, loading, isAuthenticated } = useOAuth42Session();\n  \n  if (loading) {\n    return <>{loadingComponent}</>;\n  }\n  \n  if (!isAuthenticated || !session?.user) {\n    return <>{notAuthenticatedComponent}</>;\n  }\n  \n  const { user } = session;\n  \n  return (\n    <div className={className}>\n      {showImage && user.image && (\n        <img \n          src={user.image} \n          alt={user.name || 'User'} \n          style={{ width: 50, height: 50, borderRadius: '50%' }}\n        />\n      )}\n      {showName && user.name && <div>{user.name}</div>}\n      {showEmail && user.email && <div>{user.email}</div>}\n    </div>\n  );\n}\n\nexport interface AuthStatusProps {\n  authenticatedComponent?: React.ReactNode;\n  unauthenticatedComponent?: React.ReactNode;\n  loadingComponent?: React.ReactNode;\n}\n\n/**\n * Conditional rendering based on auth status\n */\nexport function AuthStatus({\n  authenticatedComponent,\n  unauthenticatedComponent,\n  loadingComponent = <div>Loading...</div>,\n}: AuthStatusProps) {\n  const { isAuthenticated, loading } = useOAuth42Session();\n  \n  if (loading) {\n    return <>{loadingComponent}</>;\n  }\n  \n  return <>{isAuthenticated ? authenticatedComponent : unauthenticatedComponent}</>;\n}\n\nexport interface ProtectedComponentProps {\n  children: React.ReactNode;\n  fallback?: React.ReactNode;\n  loadingComponent?: React.ReactNode;\n}\n\n/**\n * Wrapper component for protected content\n */\nexport function ProtectedComponent({\n  children,\n  fallback = <SignInButton />,\n  loadingComponent = <div>Loading...</div>,\n}: ProtectedComponentProps) {\n  const { isAuthenticated, loading } = useOAuth42Session();\n  \n  if (loading) {\n    return <>{loadingComponent}</>;\n  }\n  \n  if (!isAuthenticated) {\n    return <>{fallback}</>;\n  }\n  \n  return <>{children}</>;\n}","/**\n * Utilities for OAuth42 Hosted Authentication\n */\n\nexport interface HostedAuthOptions {\n  /** OAuth2 client ID */\n  clientId: string;\n  /** Redirect URI after authentication */\n  redirectUri: string;\n  /** OAuth2 scopes (space-separated) */\n  scope?: string;\n  /** OAuth2 state parameter for CSRF protection */\n  state?: string;\n  /** Base URL for hosted auth (defaults to production) */\n  baseUrl?: string;\n}\n\n/**\n * Generate a random state parameter for CSRF protection\n */\nfunction generateState(): string {\n  const array = new Uint8Array(32);\n  crypto.getRandomValues(array);\n  return Array.from(array, byte => byte.toString(16).padStart(2, '0')).join('');\n}\n\n/**\n * Redirect to OAuth42 hosted authentication pages\n *\n * @example\n * ```ts\n * import { redirectToHostedAuth } from '@oauth42/next/client';\n *\n * function LoginButton() {\n *   return (\n *     <button onClick={() => redirectToHostedAuth({\n *       clientId: process.env.NEXT_PUBLIC_OAUTH42_CLIENT_ID!,\n *       redirectUri: `${window.location.origin}/api/auth/callback`,\n *     })}>\n *       Sign in with OAuth42\n *     </button>\n *   );\n * }\n * ```\n */\nexport function redirectToHostedAuth(options: HostedAuthOptions): void {\n  const {\n    clientId,\n    redirectUri,\n    scope = 'openid profile email',\n    state = generateState(),\n    baseUrl = 'https://auth.oauth42.com',\n  } = options;\n\n  const params = new URLSearchParams({\n    client_id: clientId,\n    redirect_uri: redirectUri,\n    response_type: 'code',\n    scope,\n    state,\n  });\n\n  const authUrl = `${baseUrl}/login?${params.toString()}`;\n\n  // Store state in sessionStorage for verification on callback\n  if (typeof window !== 'undefined') {\n    sessionStorage.setItem('oauth42_state', state);\n    window.location.href = authUrl;\n  }\n}\n\n/**\n * Verify state parameter on OAuth2 callback\n * Call this in your callback page to verify the state matches\n *\n * @example\n * ```ts\n * import { verifyState } from '@oauth42/next/client';\n *\n * export default function CallbackPage() {\n *   const searchParams = useSearchParams();\n *   const state = searchParams.get('state');\n *\n *   if (!verifyState(state)) {\n *     return <div>Invalid state parameter</div>;\n *   }\n *\n *   // Continue with token exchange...\n * }\n * ```\n */\nexport function verifyState(state: string | null): boolean {\n  if (typeof window === 'undefined') return false;\n  if (!state) return false;\n\n  const storedState = sessionStorage.getItem('oauth42_state');\n  sessionStorage.removeItem('oauth42_state');\n\n  return storedState === state;\n}\n\n/**\n * Configuration for hosted authentication\n */\nexport interface HostedAuthConfig {\n  /** Enable hosted authentication */\n  enabled: boolean;\n  /** Base URL for hosted auth pages (optional, defaults to production) */\n  baseUrl?: string;\n  /** Feature flags for hosted auth */\n  features?: {\n    /** Allow user signup */\n    signup?: boolean;\n    /** Allow social login */\n    socialLogin?: boolean;\n    /** Allow password reset */\n    passwordReset?: boolean;\n  };\n}\n\n/**\n * Default hosted auth configuration\n */\nexport const DEFAULT_HOSTED_AUTH_CONFIG: HostedAuthConfig = {\n  enabled: true,\n  baseUrl: 'https://auth.oauth42.com',\n  features: {\n    signup: true,\n    socialLogin: false,\n    passwordReset: true,\n  },\n};\n","/**\n * OAuth42 Custom Authentication Utilities\n *\n * Provides functions for implementing custom login UIs in customer apps\n * while properly handling OAuth2 PKCE flows and next-auth integration.\n */\n\nimport { signIn } from 'next-auth/react';\n\n// PKCE utilities\nfunction base64URLEncode(buffer: ArrayBuffer): string {\n  const bytes = new Uint8Array(buffer);\n  let binary = '';\n  for (let i = 0; i < bytes.byteLength; i++) {\n    binary += String.fromCharCode(bytes[i]);\n  }\n  return btoa(binary)\n    .replace(/\\+/g, '-')\n    .replace(/\\//g, '_')\n    .replace(/=/g, '');\n}\n\nasync function generateCodeVerifier(): Promise<string> {\n  const array = new Uint8Array(32);\n  crypto.getRandomValues(array);\n  return base64URLEncode(array.buffer);\n}\n\nasync function generateCodeChallenge(verifier: string): Promise<string> {\n  const encoder = new TextEncoder();\n  const data = encoder.encode(verifier);\n  const hash = await crypto.subtle.digest('SHA-256', data);\n  return base64URLEncode(hash);\n}\n\nfunction generateState(): string {\n  const array = new Uint8Array(32);\n  crypto.getRandomValues(array);\n  return base64URLEncode(array.buffer);\n}\n\nexport interface LoginWithPasswordOptions {\n  email: string;\n  password: string;\n  mfaCode?: string;\n  /**\n   * URL to redirect to after successful authentication.\n   * If not provided, will redirect to '/'\n   */\n  callbackUrl?: string;\n}\n\nexport interface LoginWithAuthenticatorOptions {\n  email: string;\n  sessionId: string;\n  /**\n   * URL to redirect to after successful authentication.\n   * If not provided, will redirect to '/'\n   */\n  callbackUrl?: string;\n}\n\nexport interface AuthError {\n  error: string;\n  error_description?: string;\n  requires_enrollment?: boolean;\n  enrollment_token?: string;\n  requires_mfa?: boolean;\n}\n\n/**\n * Authenticate with email/password and complete OAuth PKCE flow\n *\n * This function handles the full authentication flow:\n * 1. Authenticates with the backend using credentials\n * 2. Uses the access token to authorize the OAuth client\n * 3. Exchanges authorization code for tokens via next-auth\n *\n * @example\n * ```tsx\n * const result = await loginWithPassword({\n *   email: 'user@example.com',\n *   password: 'password123',\n *   callbackUrl: '/dashboard'\n * });\n *\n * if (result.success) {\n *   // User is authenticated, next-auth session is set\n * } else if (result.requires_mfa) {\n *   // Prompt for MFA code and call again with mfaCode\n * }\n * ```\n */\nexport async function loginWithPassword(\n  options: LoginWithPasswordOptions\n): Promise<{ success: boolean; access_token?: string } & Partial<AuthError>> {\n  try {\n    // Step 1: Authenticate with backend to get access token\n    const loginResponse = await fetch('/api/auth/login', {\n      method: 'POST',\n      headers: { 'Content-Type': 'application/json' },\n      body: JSON.stringify({\n        email: options.email,\n        password: options.password,\n        ...(options.mfaCode ? { mfa_code: options.mfaCode } : {}),\n      }),\n    });\n\n    if (!loginResponse.ok) {\n      const errorData = await loginResponse.json().catch(() => ({}));\n      const desc: string = errorData?.error_description || errorData?.message || '';\n\n      // Handle special cases\n      if (loginResponse.status === 403 && errorData?.requires_enrollment) {\n        return {\n          success: false,\n          error: 'enrollment_required',\n          error_description: 'MFA enrollment required',\n          requires_enrollment: true,\n          enrollment_token: errorData.enrollment_token,\n        };\n      }\n\n      if (loginResponse.status === 403 && /mfa required/i.test(desc)) {\n        return {\n          success: false,\n          error: 'mfa_required',\n          error_description: 'MFA code required',\n          requires_mfa: true,\n        };\n      }\n\n      if (loginResponse.status === 401 && /invalid mfa code/i.test(desc)) {\n        return {\n          success: false,\n          error: 'invalid_mfa_code',\n          error_description: 'Invalid MFA code',\n          requires_mfa: true,\n        };\n      }\n\n      return {\n        success: false,\n        error: 'authentication_failed',\n        error_description: desc || 'Invalid credentials',\n      };\n    }\n\n    const { access_token } = await loginResponse.json();\n\n    // Return access token for the application to use in OAuth authorize flow\n    return { success: true, access_token };\n  } catch (error) {\n    console.error('Login error:', error);\n    return {\n      success: false,\n      error: 'network_error',\n      error_description: 'Failed to connect to authentication server',\n    };\n  }\n}\n\n/**\n * Initiate authenticator (passwordless) login and return challenge code\n *\n * @example\n * ```tsx\n * const result = await initiateAuthenticatorLogin({\n *   email: 'user@example.com',\n *   sessionId: crypto.randomUUID()\n * });\n *\n * if (result.success) {\n *   // Display result.challengeCode to user\n *   // Wait for WebSocket approval or poll for completion\n * }\n * ```\n */\nexport async function initiateAuthenticatorLogin(\n  options: LoginWithAuthenticatorOptions\n): Promise<{\n  success: boolean;\n  challengeCode?: string;\n  challengeId?: string;\n} & Partial<AuthError>> {\n  try {\n    const response = await fetch('/api/auth/passwordless/initiate', {\n      method: 'POST',\n      headers: { 'Content-Type': 'application/json' },\n      body: JSON.stringify({\n        email: options.email,\n        session_id: options.sessionId,\n      }),\n    });\n\n    if (!response.ok) {\n      const errorData = await response.json().catch(() => ({}));\n      return {\n        success: false,\n        error: 'initiation_failed',\n        error_description: errorData.error_description || 'Failed to create challenge',\n      };\n    }\n\n    const data = await response.json();\n\n    return {\n      success: true,\n      challengeCode: data.challenge_code,\n      challengeId: data.challenge_id,\n    };\n  } catch (error) {\n    console.error('Authenticator login error:', error);\n    return {\n      success: false,\n      error: 'network_error',\n      error_description: 'Failed to connect to authentication server',\n    };\n  }\n}\n\n/**\n * Complete authenticator login after approval\n *\n * Call this after receiving approval notification via WebSocket\n * or after the user has approved on their mobile device.\n * Returns the access token for the application to use in OAuth authorize flow.\n *\n * @param accessToken - Access token received from approval payload\n */\nexport async function completeAuthenticatorLogin(\n  accessToken: string\n): Promise<{ success: boolean; access_token: string }> {\n  return { success: true, access_token: accessToken };\n}\n\n/**\n * Simulate approval for testing (development only)\n *\n * @param challengeId - The challenge ID to approve\n * @param selectedCode - The code that was displayed to the user\n */\nexport async function simulateApproval(\n  challengeId: string,\n  selectedCode: string\n): Promise<{ success: boolean }> {\n  try {\n    await fetch('/api/auth/challenge/approve', {\n      method: 'POST',\n      headers: { 'Content-Type': 'application/json' },\n      body: JSON.stringify({\n        challenge_id: challengeId,\n        selected_code: selectedCode,\n      }),\n    });\n\n    return { success: true };\n  } catch (error) {\n    console.error('Simulated approval failed:', error);\n    return { success: false };\n  }\n}\n\n/**\n * Logout the current user from the app only (app-level logout)\n *\n * This clears the next-auth session for this app only. The user remains\n * logged into the OAuth42 provider and will auto-authenticate on next login.\n * This is standard SSO behavior.\n *\n * For provider-level logout (sign out of all apps), use logoutEverywhere().\n *\n * @param callbackUrl - URL to redirect to after logout (default: '/')\n *\n * @example\n * ```tsx\n * import { logout } from '@oauth42/next/client';\n *\n * const handleLogout = async () => {\n *   await logout({ callbackUrl: '/login' });\n * };\n * ```\n */\nexport async function logout(options?: { callbackUrl?: string }): Promise<void> {\n  // Import signOut from next-auth/react\n  const { signOut } = await import('next-auth/react');\n\n  // Clear next-auth session (app-level only)\n  await signOut({\n    callbackUrl: options?.callbackUrl || '/',\n    redirect: true\n  });\n}\n\n/**\n * Logout the current user from ALL apps using OAuth42 (provider-level logout)\n *\n * This redirects to the OAuth42 provider's logout endpoint to clear the\n * oauth42_session cookie, effectively logging the user out of all apps.\n *\n * Use this when testing fresh login flows or when the user explicitly\n * wants to sign out of everything.\n *\n * @param issuer - The OAuth42 issuer URL (e.g., 'https://localhost:8443')\n * @param callbackUrl - URL to redirect to after logout (default: current origin)\n *\n * @example\n * ```tsx\n * import { logoutEverywhere } from '@oauth42/next/client';\n *\n * const handleLogoutEverywhere = () => {\n *   const issuer = process.env.NEXT_PUBLIC_OAUTH42_ISSUER || 'https://localhost:8443';\n *   logoutEverywhere(issuer, '/auth/signin');\n * };\n * ```\n */\nexport function logoutEverywhere(issuer: string, callbackUrl?: string): void {\n  const redirectUri = callbackUrl || window.location.origin;\n\n  // Redirect to OAuth42 provider logout endpoint\n  // This clears the oauth42_session cookie and redirects back\n  window.location.href = `${issuer}/auth/logout?redirect_uri=${encodeURIComponent(redirectUri)}`;\n}\n"],"mappings":";AAGA,SAAS,UAAAA,SAAQ,WAAAC,UAAS,cAAAC,aAAY,uBAAuB;;;ACH7D,SAAS,YAAY,QAAQ,eAAe;AAC5C,SAAS,aAAa,WAAW,gBAAgB;AA2B1C,SAAS,oBAAwD;AACtE,QAAM,EAAE,MAAM,SAAS,OAAO,IAAI,WAAW;AAC7C,QAAM,CAAC,OAAO,QAAQ,IAAI,SAAuB,IAAI;AAErD,QAAM,eAAe,YAAY,YAAY;AAC3C,QAAI;AACF,eAAS,IAAI;AACb,YAAM,OAAO,SAAS;AAAA,IACxB,SAAS,KAAK;AACZ,eAAS,GAAY;AAAA,IACvB;AAAA,EACF,GAAG,CAAC,CAAC;AAEL,QAAM,gBAAgB,YAAY,YAAY;AAC5C,QAAI;AACF,eAAS,IAAI;AACb,YAAM,QAAQ;AAAA,IAChB,SAAS,KAAK;AACZ,eAAS,GAAY;AAAA,IACvB;AAAA,EACF,GAAG,CAAC,CAAC;AAEL,SAAO;AAAA,IACL;AAAA,IACA,SAAS,WAAW;AAAA,IACpB;AAAA,IACA,iBAAiB,WAAW;AAAA,IAC5B,QAAQ;AAAA,IACR,SAAS;AAAA,EACX;AACF;AAKO,SAAS,iBAAyB;AACvC,QAAM,EAAE,SAAS,gBAAgB,IAAI,kBAAqB;AAE1D,SAAO;AAAA,IACL,MAAM,kBAAkB,SAAS,OAAO;AAAA,IACxC;AAAA,EACF;AACF;AAKO,SAAS,mBAA2B;AACzC,QAAM,EAAE,QAAQ,IAAI,kBAAqB;AACzC,QAAM,CAAC,WAAW,YAAY,IAAI,SAAS,KAAK;AAEhD,YAAU,MAAM;AACd,QAAI,SAAS,SAAS;AACpB,YAAM,aAAa,IAAI,KAAK,QAAQ,OAAO,EAAE,QAAQ;AACrD,YAAM,MAAM,KAAK,IAAI;AACrB,mBAAa,OAAO,UAAU;AAG9B,YAAM,kBAAkB,aAAa;AACrC,UAAI,kBAAkB,GAAG;AACvB,cAAM,QAAQ,WAAW,MAAM;AAC7B,uBAAa,IAAI;AAAA,QACnB,GAAG,eAAe;AAElB,eAAO,MAAM,aAAa,KAAK;AAAA,MACjC;AAAA,IACF;AAAA,EACF,GAAG,CAAC,SAAS,OAAO,CAAC;AAErB,SAAO;AAAA,IACL,aAAa,SAAS;AAAA,IACtB,SAAS,SAAS;AAAA,IAClB;AAAA,IACA,cAAc,YAAY;AAExB,YAAM,OAAO,SAAS;AAAA,IACxB;AAAA,EACF;AACF;AAKO,SAAS,eAAe,aAAqB,gBAAgB;AAClE,QAAM,EAAE,iBAAiB,QAAQ,IAAI,kBAAkB;AACvD,QAAM,CAAC,eAAe,gBAAgB,IAAI,SAAS,KAAK;AAExD,YAAU,MAAM;AACd,QAAI,CAAC,WAAW,CAAC,mBAAmB,CAAC,eAAe;AAClD,uBAAiB,IAAI;AACrB,UAAI,OAAO,WAAW,aAAa;AACjC,eAAO,SAAS,OAAO;AAAA,MACzB;AAAA,IACF;AAAA,EACF,GAAG,CAAC,iBAAiB,SAAS,YAAY,aAAa,CAAC;AAExD,SAAO;AAAA,IACL;AAAA,IACA,SAAS,WAAW;AAAA,EACtB;AACF;;;AC/HA,SAAS,UAAAC,SAAQ,WAAAC,gBAAe;AAyB5B,SAiEO,UAjEP,KA2EA,YA3EA;AAZG,SAAS,aAAa;AAAA,EAC3B,WAAW;AAAA,EACX,YAAY;AAAA,EACZ,cAAc;AAAA,EACd;AACF,GAAsB;AACpB,QAAM,cAAc,YAAY;AAC9B,QAAI,QAAS,SAAQ;AACrB,UAAMC,QAAO,WAAW,EAAE,YAAY,CAAC;AAAA,EACzC;AAEA,SACE;AAAA,IAAC;AAAA;AAAA,MACC,SAAS;AAAA,MACT;AAAA,MACA,MAAK;AAAA,MAEJ;AAAA;AAAA,EACH;AAEJ;AAYO,SAAS,cAAc;AAAA,EAC5B,WAAW;AAAA,EACX,YAAY;AAAA,EACZ,cAAc;AAAA,EACd;AACF,GAAuB;AACrB,QAAM,cAAc,YAAY;AAC9B,QAAI,QAAS,SAAQ;AACrB,UAAMC,SAAQ,EAAE,YAAY,CAAC;AAAA,EAC/B;AAEA,SACE;AAAA,IAAC;AAAA;AAAA,MACC,SAAS;AAAA,MACT;AAAA,MACA,MAAK;AAAA,MAEJ;AAAA;AAAA,EACH;AAEJ;AAcO,SAAS,YAAY;AAAA,EAC1B,YAAY;AAAA,EACZ,YAAY;AAAA,EACZ,WAAW;AAAA,EACX,YAAY;AAAA,EACZ,mBAAmB,oBAAC,SAAI,wBAAU;AAAA,EAClC,4BAA4B,oBAAC,SAAI,+BAAiB;AACpD,GAAqB;AACnB,QAAM,EAAE,SAAS,SAAS,gBAAgB,IAAI,kBAAkB;AAEhE,MAAI,SAAS;AACX,WAAO,gCAAG,4BAAiB;AAAA,EAC7B;AAEA,MAAI,CAAC,mBAAmB,CAAC,SAAS,MAAM;AACtC,WAAO,gCAAG,qCAA0B;AAAA,EACtC;AAEA,QAAM,EAAE,KAAK,IAAI;AAEjB,SACE,qBAAC,SAAI,WACF;AAAA,iBAAa,KAAK,SACjB;AAAA,MAAC;AAAA;AAAA,QACC,KAAK,KAAK;AAAA,QACV,KAAK,KAAK,QAAQ;AAAA,QAClB,OAAO,EAAE,OAAO,IAAI,QAAQ,IAAI,cAAc,MAAM;AAAA;AAAA,IACtD;AAAA,IAED,YAAY,KAAK,QAAQ,oBAAC,SAAK,eAAK,MAAK;AAAA,IACzC,aAAa,KAAK,SAAS,oBAAC,SAAK,eAAK,OAAM;AAAA,KAC/C;AAEJ;AAWO,SAAS,WAAW;AAAA,EACzB;AAAA,EACA;AAAA,EACA,mBAAmB,oBAAC,SAAI,wBAAU;AACpC,GAAoB;AAClB,QAAM,EAAE,iBAAiB,QAAQ,IAAI,kBAAkB;AAEvD,MAAI,SAAS;AACX,WAAO,gCAAG,4BAAiB;AAAA,EAC7B;AAEA,SAAO,gCAAG,4BAAkB,yBAAyB,0BAAyB;AAChF;AAWO,SAAS,mBAAmB;AAAA,EACjC;AAAA,EACA,WAAW,oBAAC,gBAAa;AAAA,EACzB,mBAAmB,oBAAC,SAAI,wBAAU;AACpC,GAA4B;AAC1B,QAAM,EAAE,iBAAiB,QAAQ,IAAI,kBAAkB;AAEvD,MAAI,SAAS;AACX,WAAO,gCAAG,4BAAiB;AAAA,EAC7B;AAEA,MAAI,CAAC,iBAAiB;AACpB,WAAO,gCAAG,oBAAS;AAAA,EACrB;AAEA,SAAO,gCAAG,UAAS;AACrB;;;AC/IA,SAAS,gBAAwB;AAC/B,QAAM,QAAQ,IAAI,WAAW,EAAE;AAC/B,SAAO,gBAAgB,KAAK;AAC5B,SAAO,MAAM,KAAK,OAAO,UAAQ,KAAK,SAAS,EAAE,EAAE,SAAS,GAAG,GAAG,CAAC,EAAE,KAAK,EAAE;AAC9E;AAqBO,SAAS,qBAAqB,SAAkC;AACrE,QAAM;AAAA,IACJ;AAAA,IACA;AAAA,IACA,QAAQ;AAAA,IACR,QAAQ,cAAc;AAAA,IACtB,UAAU;AAAA,EACZ,IAAI;AAEJ,QAAM,SAAS,IAAI,gBAAgB;AAAA,IACjC,WAAW;AAAA,IACX,cAAc;AAAA,IACd,eAAe;AAAA,IACf;AAAA,IACA;AAAA,EACF,CAAC;AAED,QAAM,UAAU,GAAG,OAAO,UAAU,OAAO,SAAS,CAAC;AAGrD,MAAI,OAAO,WAAW,aAAa;AACjC,mBAAe,QAAQ,iBAAiB,KAAK;AAC7C,WAAO,SAAS,OAAO;AAAA,EACzB;AACF;AAsBO,SAAS,YAAY,OAA+B;AACzD,MAAI,OAAO,WAAW,YAAa,QAAO;AAC1C,MAAI,CAAC,MAAO,QAAO;AAEnB,QAAM,cAAc,eAAe,QAAQ,eAAe;AAC1D,iBAAe,WAAW,eAAe;AAEzC,SAAO,gBAAgB;AACzB;AAwBO,IAAM,6BAA+C;AAAA,EAC1D,SAAS;AAAA,EACT,SAAS;AAAA,EACT,UAAU;AAAA,IACR,QAAQ;AAAA,IACR,aAAa;AAAA,IACb,eAAe;AAAA,EACjB;AACF;;;ACtCA,eAAsB,kBACpB,SAC2E;AAC3E,MAAI;AAEF,UAAM,gBAAgB,MAAM,MAAM,mBAAmB;AAAA,MACnD,QAAQ;AAAA,MACR,SAAS,EAAE,gBAAgB,mBAAmB;AAAA,MAC9C,MAAM,KAAK,UAAU;AAAA,QACnB,OAAO,QAAQ;AAAA,QACf,UAAU,QAAQ;AAAA,QAClB,GAAI,QAAQ,UAAU,EAAE,UAAU,QAAQ,QAAQ,IAAI,CAAC;AAAA,MACzD,CAAC;AAAA,IACH,CAAC;AAED,QAAI,CAAC,cAAc,IAAI;AACrB,YAAM,YAAY,MAAM,cAAc,KAAK,EAAE,MAAM,OAAO,CAAC,EAAE;AAC7D,YAAM,OAAe,WAAW,qBAAqB,WAAW,WAAW;AAG3E,UAAI,cAAc,WAAW,OAAO,WAAW,qBAAqB;AAClE,eAAO;AAAA,UACL,SAAS;AAAA,UACT,OAAO;AAAA,UACP,mBAAmB;AAAA,UACnB,qBAAqB;AAAA,UACrB,kBAAkB,UAAU;AAAA,QAC9B;AAAA,MACF;AAEA,UAAI,cAAc,WAAW,OAAO,gBAAgB,KAAK,IAAI,GAAG;AAC9D,eAAO;AAAA,UACL,SAAS;AAAA,UACT,OAAO;AAAA,UACP,mBAAmB;AAAA,UACnB,cAAc;AAAA,QAChB;AAAA,MACF;AAEA,UAAI,cAAc,WAAW,OAAO,oBAAoB,KAAK,IAAI,GAAG;AAClE,eAAO;AAAA,UACL,SAAS;AAAA,UACT,OAAO;AAAA,UACP,mBAAmB;AAAA,UACnB,cAAc;AAAA,QAChB;AAAA,MACF;AAEA,aAAO;AAAA,QACL,SAAS;AAAA,QACT,OAAO;AAAA,QACP,mBAAmB,QAAQ;AAAA,MAC7B;AAAA,IACF;AAEA,UAAM,EAAE,aAAa,IAAI,MAAM,cAAc,KAAK;AAGlD,WAAO,EAAE,SAAS,MAAM,aAAa;AAAA,EACvC,SAAS,OAAO;AACd,YAAQ,MAAM,gBAAgB,KAAK;AACnC,WAAO;AAAA,MACL,SAAS;AAAA,MACT,OAAO;AAAA,MACP,mBAAmB;AAAA,IACrB;AAAA,EACF;AACF;AAkBA,eAAsB,2BACpB,SAKsB;AACtB,MAAI;AACF,UAAM,WAAW,MAAM,MAAM,mCAAmC;AAAA,MAC9D,QAAQ;AAAA,MACR,SAAS,EAAE,gBAAgB,mBAAmB;AAAA,MAC9C,MAAM,KAAK,UAAU;AAAA,QACnB,OAAO,QAAQ;AAAA,QACf,YAAY,QAAQ;AAAA,MACtB,CAAC;AAAA,IACH,CAAC;AAED,QAAI,CAAC,SAAS,IAAI;AAChB,YAAM,YAAY,MAAM,SAAS,KAAK,EAAE,MAAM,OAAO,CAAC,EAAE;AACxD,aAAO;AAAA,QACL,SAAS;AAAA,QACT,OAAO;AAAA,QACP,mBAAmB,UAAU,qBAAqB;AAAA,MACpD;AAAA,IACF;AAEA,UAAM,OAAO,MAAM,SAAS,KAAK;AAEjC,WAAO;AAAA,MACL,SAAS;AAAA,MACT,eAAe,KAAK;AAAA,MACpB,aAAa,KAAK;AAAA,IACpB;AAAA,EACF,SAAS,OAAO;AACd,YAAQ,MAAM,8BAA8B,KAAK;AACjD,WAAO;AAAA,MACL,SAAS;AAAA,MACT,OAAO;AAAA,MACP,mBAAmB;AAAA,IACrB;AAAA,EACF;AACF;AAWA,eAAsB,2BACpB,aACqD;AACrD,SAAO,EAAE,SAAS,MAAM,cAAc,YAAY;AACpD;AAQA,eAAsB,iBACpB,aACA,cAC+B;AAC/B,MAAI;AACF,UAAM,MAAM,+BAA+B;AAAA,MACzC,QAAQ;AAAA,MACR,SAAS,EAAE,gBAAgB,mBAAmB;AAAA,MAC9C,MAAM,KAAK,UAAU;AAAA,QACnB,cAAc;AAAA,QACd,eAAe;AAAA,MACjB,CAAC;AAAA,IACH,CAAC;AAED,WAAO,EAAE,SAAS,KAAK;AAAA,EACzB,SAAS,OAAO;AACd,YAAQ,MAAM,8BAA8B,KAAK;AACjD,WAAO,EAAE,SAAS,MAAM;AAAA,EAC1B;AACF;AAsBA,eAAsB,OAAO,SAAmD;AAE9E,QAAM,EAAE,SAAAC,SAAQ,IAAI,MAAM,OAAO,iBAAiB;AAGlD,QAAMA,SAAQ;AAAA,IACZ,aAAa,SAAS,eAAe;AAAA,IACrC,UAAU;AAAA,EACZ,CAAC;AACH;AAwBO,SAAS,iBAAiB,QAAgB,aAA4B;AAC3E,QAAM,cAAc,eAAe,OAAO,SAAS;AAInD,SAAO,SAAS,OAAO,GAAG,MAAM,6BAA6B,mBAAmB,WAAW,CAAC;AAC9F;","names":["signIn","signOut","useSession","signIn","signOut","signIn","signOut","signOut"]}

package/dist/index.js

@@ -170,6 +170,7 @@ function createAuth(options = {}) {
         session.idToken = token.idToken;
         if (session.user) {
           session.user.email = token.email;
+          session.user.name = token.name;
           session.user.username = token.username;
           session.user.emailVerified = token.emailVerified;
         }

package/dist/index.js.map

@@ -1 +1 @@
-{"version":3,"sources":["../src/index.ts","../src/provider.ts","../src/server/auth.ts","../src/server/session.ts","../src/server/middleware.ts"],"sourcesContent":["// Main exports\nexport { OAuth42Provider } from './provider';\nexport type { OAuth42Profile, OAuth42ProviderOptions } from './provider';\n\n// Server-side exports\nexport { createAuth, getServerSession, refreshAccessToken } from './server/auth';\nexport type { CreateAuthOptions } from './server/auth';\n\nexport { withOAuth42Auth, createMiddlewareConfig } from './server/middleware';\nexport type { OAuth42AuthOptions } from './server/middleware';\n\nexport { getOAuth42Session, withOAuth42Session, withOAuth42ServerSideProps } from './server/session';\n\n// Type exports\nexport type { OAuth42Config } from './types';\n\n// Re-export NextAuth types for convenience\nexport type { Session, User } from 'next-auth';","import type { OAuthConfig, OAuthUserConfig } from 'next-auth/providers/oauth';\n\nexport interface OAuth42Profile {\n  sub: string;\n  email: string;\n  email_verified?: boolean;\n  name?: string;\n  given_name?: string;\n  family_name?: string;\n  picture?: string;\n  username?: string;\n  id?: string;\n}\n\nexport interface OAuth42ProviderOptions {\n  clientId: string;\n  clientSecret: string;\n  issuer?: string;\n  authorizationUrl?: string;\n  tokenUrl?: string;\n  userinfoUrl?: string;\n  scopes?: string[];\n  pkceEnabled?: boolean;\n}\n\nexport function OAuth42Provider<P extends OAuth42Profile>(\n  options: OAuthUserConfig<P> & Partial<OAuth42ProviderOptions>\n): OAuthConfig<P> {\n  const issuer = options.issuer || process.env.OAUTH42_ISSUER || 'https://oauth42.com';\n  const baseUrl = issuer.replace(/\\/$/, '');\n  \n  return {\n    id: 'oauth42',\n    name: 'OAuth42',\n    type: 'oauth',\n    version: '2.0',\n    \n    // Use OIDC discovery to automatically find endpoints\n    wellKnown: `${baseUrl}/.well-known/openid-configuration`,\n    \n    // Also set individual endpoints for compatibility\n    authorization: {\n      url: `${baseUrl}/oauth2/authorize`,\n      params: {\n        scope: (options.scopes || ['openid', 'profile', 'email']).join(' '),\n        response_type: 'code',\n      },\n    },\n    token: `${baseUrl}/oauth2/token`,\n    userinfo: `${baseUrl}/oauth2/userinfo`,\n    \n    client: {\n      id: options.clientId,\n      secret: options.clientSecret,\n      token_endpoint_auth_method: 'client_secret_post',\n      id_token_signed_response_alg: 'HS256', // OAuth42 uses HS256 for ID tokens\n    },\n    \n    issuer: baseUrl,\n    \n    checks: options.pkceEnabled !== false ? ['pkce', 'state'] : ['state'],\n    \n    profile(profile: OAuth42Profile, tokens: any) {\n      return {\n        id: profile.sub || profile.id || profile.email,\n        email: profile.email,\n        emailVerified: profile.email_verified ? new Date() : null,\n        name: profile.name || `${profile.given_name || ''} ${profile.family_name || ''}`.trim(),\n        image: profile.picture,\n      };\n    },\n    \n    style: {\n      logo: '/oauth42-logo.svg',\n      bg: '#1e40af',\n      text: '#ffffff',\n    },\n    \n    options,\n  };\n}","import NextAuthDefault from 'next-auth';\nimport type { NextAuthOptions } from 'next-auth';\nimport { OAuth42Provider, OAuth42Profile } from '../provider';\nimport { getOAuth42Session } from './session';\n\n// Handle both CommonJS and ESM exports\nconst NextAuth = (NextAuthDefault as any).default || NextAuthDefault;\n\nexport { type NextAuthOptions };\n\nexport interface CreateAuthOptions {\n  clientId?: string;\n  clientSecret?: string;\n  issuer?: string;\n  scopes?: string[];\n  pkceEnabled?: boolean;\n  debug?: boolean;\n  callbacks?: NextAuthOptions['callbacks'];\n  pages?: NextAuthOptions['pages'];\n  session?: NextAuthOptions['session'];\n}\n\n/**\n * Create a pre-configured NextAuth instance for OAuth42\n * This provides a simplified setup with sensible defaults\n */\nexport function createAuth(options: CreateAuthOptions = {}) {\n  const clientId = options.clientId || process.env.OAUTH42_CLIENT_ID;\n  const clientSecret = options.clientSecret || process.env.OAUTH42_CLIENT_SECRET;\n  \n  if (!clientId || !clientSecret) {\n    throw new Error(\n      'OAuth42 client credentials are required. ' +\n      'Set OAUTH42_CLIENT_ID and OAUTH42_CLIENT_SECRET environment variables ' +\n      'or pass them in the options.'\n    );\n  }\n  \n  const authOptions: NextAuthOptions = {\n    providers: [\n      OAuth42Provider({\n        clientId,\n        clientSecret,\n        issuer: options.issuer,\n        scopes: options.scopes,\n        pkceEnabled: options.pkceEnabled,\n      }),\n    ],\n    \n    callbacks: {\n      async jwt({ token, account, profile }) {\n        // Store OAuth tokens in the JWT\n        if (account) {\n          token.accessToken = account.access_token;\n          token.refreshToken = account.refresh_token;\n          token.expiresAt = account.expires_at;\n          token.idToken = account.id_token;\n        }\n        \n        // Add user profile data\n        if (profile) {\n          const oauth42Profile = profile as OAuth42Profile;\n          token.email = oauth42Profile.email;\n          token.username = oauth42Profile.username;\n          token.emailVerified = oauth42Profile.email_verified;\n        }\n        \n        // Call custom callback if provided\n        if (options.callbacks?.jwt) {\n          return options.callbacks.jwt({ token, account, profile } as any);\n        }\n        \n        return token;\n      },\n      \n      async session({ session, token }) {\n        // Add OAuth42-specific data to session\n        session.accessToken = token.accessToken as string;\n        session.idToken = token.idToken as string;\n        \n        if (session.user) {\n          session.user.email = token.email as string;\n          session.user.username = token.username as string;\n          session.user.emailVerified = token.emailVerified as boolean;\n        }\n        \n        // Call custom callback if provided\n        if (options.callbacks?.session) {\n          return options.callbacks.session({ session, token } as any);\n        }\n        \n        return session;\n      },\n      \n      ...options.callbacks,\n    },\n    \n    pages: {\n      signIn: '/auth/signin',\n      signOut: '/auth/signout',\n      error: '/auth/error',\n      ...options.pages,\n    },\n    \n    session: {\n      strategy: 'jwt',\n      ...options.session,\n    },\n    \n    debug: options.debug || process.env.NODE_ENV === 'development',\n    \n    secret: process.env.NEXTAUTH_SECRET,\n  };\n  \n  // Return the configuration and a function to create handlers\n  return {\n    auth: authOptions,\n    handlers: NextAuth(authOptions),\n  };\n}\n\n/**\n * Create NextAuth handlers for API routes\n */\nexport function createHandlers(authOptions: NextAuthOptions) {\n  const handler = NextAuth(authOptions);\n  return { GET: handler, POST: handler };\n}\n\n/**\n * Helper to get the current session server-side\n * @deprecated Use getOAuth42Session instead - this is now just an alias for backward compatibility\n * \n * This function is maintained for backward compatibility but internally\n * calls getOAuth42Session which properly handles both App Router and Pages Router\n */\nexport const getServerSession = getOAuth42Session;\n\n/**\n * Token refresh helper\n */\nexport async function refreshAccessToken(token: any, clientId: string, clientSecret: string, issuer?: string) {\n  try {\n    const baseUrl = issuer || process.env.OAUTH42_ISSUER || 'https://oauth42.com';\n    const tokenUrl = `${baseUrl}/oauth2/token`;\n    \n    // In development, we need to handle self-signed certificates\n    const fetchOptions: any = {\n      method: 'POST',\n      headers: {\n        'Content-Type': 'application/x-www-form-urlencoded',\n      },\n      body: new URLSearchParams({\n        grant_type: 'refresh_token',\n        refresh_token: token.refreshToken,\n        client_id: clientId,\n        client_secret: clientSecret,\n      }),\n    };\n    \n    // Add agent for self-signed certificates in development\n    if (process.env.NODE_ENV !== 'production' && tokenUrl.startsWith('https://')) {\n      const https = await import('https');\n      fetchOptions.agent = new https.Agent({\n        rejectUnauthorized: false\n      });\n    }\n    \n    const response = await fetch(tokenUrl, fetchOptions);\n    const refreshedTokens = await response.json();\n    \n    if (!response.ok) {\n      throw refreshedTokens;\n    }\n    \n    return {\n      ...token,\n      accessToken: refreshedTokens.access_token,\n      refreshToken: refreshedTokens.refresh_token ?? token.refreshToken,\n      // Store expiration time in seconds (Unix timestamp)\n      expiresAt: Math.floor(Date.now() / 1000) + (refreshedTokens.expires_in || 3600),\n      // Explicitly remove any error property on successful refresh\n      error: undefined,\n    };\n  } catch (error) {\n    console.error('Failed to refresh access token:', error);\n    return {\n      ...token,\n      error: 'RefreshAccessTokenError',\n    };\n  }\n}","import { getServerSession as getNextAuthSession } from 'next-auth';\nimport { NextAuthOptions } from 'next-auth';\nimport { GetServerSidePropsContext, NextApiRequest, NextApiResponse } from 'next';\n\n/**\n * Get the OAuth42 session server-side\n * \n * This is the primary method for retrieving sessions in OAuth42 SDK.\n * Supports both Pages Router and App Router:\n * \n * App Router:\n * ```ts\n * const session = await getOAuth42Session(authOptions);\n * ```\n * \n * Pages Router:\n * ```ts\n * const session = await getOAuth42Session(req, res, authOptions);\n * ```\n */\nexport async function getOAuth42Session(\n  ...args: \n    | [GetServerSidePropsContext['req'], GetServerSidePropsContext['res'], NextAuthOptions]\n    | [NextApiRequest, NextApiResponse, NextAuthOptions]\n    | [NextAuthOptions]\n) {\n  return getNextAuthSession(...args as any);\n}\n\n/**\n * Helper for protecting API routes\n */\nexport function withOAuth42Session(\n  handler: (req: NextApiRequest, res: NextApiResponse, session: any) => Promise<void> | void,\n  authOptions: NextAuthOptions\n) {\n  return async (req: NextApiRequest, res: NextApiResponse) => {\n    const session = await getOAuth42Session(req, res, authOptions);\n    \n    if (!session) {\n      return res.status(401).json({ error: 'Unauthorized' });\n    }\n    \n    return handler(req, res, session);\n  };\n}\n\n/**\n * Helper for protecting server-side props\n */\nexport function withOAuth42ServerSideProps(\n  getServerSideProps: (\n    context: GetServerSidePropsContext,\n    session: any\n  ) => Promise<any>,\n  authOptions: NextAuthOptions\n) {\n  return async (context: GetServerSidePropsContext) => {\n    const session = await getOAuth42Session(\n      context.req,\n      context.res,\n      authOptions\n    );\n    \n    if (!session) {\n      return {\n        redirect: {\n          destination: '/auth/signin',\n          permanent: false,\n        },\n      };\n    }\n    \n    return getServerSideProps(context, session);\n  };\n}","import { NextRequest, NextResponse } from 'next/server';\nimport { getToken } from 'next-auth/jwt';\n\nexport interface OAuth42AuthOptions {\n  pages?: {\n    signIn?: string;\n    error?: string;\n  };\n  callbacks?: {\n    authorized?: (params: { token: any; req: NextRequest }) => boolean | Promise<boolean>;\n  };\n  protectedPaths?: string[];\n  publicPaths?: string[];\n}\n\n/**\n * Middleware helper for protecting routes with OAuth42\n */\nexport function withOAuth42Auth(options: OAuth42AuthOptions = {}) {\n  return async function middleware(req: NextRequest) {\n    const token = await getToken({ \n      req: req as any, \n      secret: process.env.NEXTAUTH_SECRET \n    });\n    \n    const pathname = req.nextUrl.pathname;\n    \n    // Check if path is explicitly public\n    if (options.publicPaths?.some(path => pathname.startsWith(path))) {\n      return NextResponse.next();\n    }\n    \n    // Check if path needs protection\n    const needsProtection = options.protectedPaths\n      ? options.protectedPaths.some(path => pathname.startsWith(path))\n      : true; // Default to protecting all paths\n    \n    if (!needsProtection) {\n      return NextResponse.next();\n    }\n    \n    // Check authorization\n    let isAuthorized = !!token;\n    \n    if (options.callbacks?.authorized) {\n      isAuthorized = await options.callbacks.authorized({ token, req });\n    }\n    \n    if (!isAuthorized) {\n      const signInUrl = options.pages?.signIn || '/auth/signin';\n      const url = new URL(signInUrl, req.url);\n      url.searchParams.set('callbackUrl', pathname);\n      return NextResponse.redirect(url);\n    }\n    \n    return NextResponse.next();\n  };\n}\n\n/**\n * Helper to create middleware configuration\n */\nexport function createMiddlewareConfig(\n  protectedPaths: string[] = ['/protected'],\n  publicPaths: string[] = ['/auth', '/api/auth']\n) {\n  return {\n    matcher: [\n      /*\n       * Match all request paths except for the ones starting with:\n       * - _next/static (static files)\n       * - _next/image (image optimization files)\n       * - favicon.ico (favicon file)\n       * - public folder\n       */\n      '/((?!_next/static|_next/image|favicon.ico|public).*)',\n    ],\n    protectedPaths,\n    publicPaths,\n  };\n}"],"mappings":";;;;;;;;;;;;;;;;;;;;;;;;;;;;;;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;;;ACyBO,SAAS,gBACd,SACgB;AAChB,QAAM,SAAS,QAAQ,UAAU,QAAQ,IAAI,kBAAkB;AAC/D,QAAM,UAAU,OAAO,QAAQ,OAAO,EAAE;AAExC,SAAO;AAAA,IACL,IAAI;AAAA,IACJ,MAAM;AAAA,IACN,MAAM;AAAA,IACN,SAAS;AAAA;AAAA,IAGT,WAAW,GAAG,OAAO;AAAA;AAAA,IAGrB,eAAe;AAAA,MACb,KAAK,GAAG,OAAO;AAAA,MACf,QAAQ;AAAA,QACN,QAAQ,QAAQ,UAAU,CAAC,UAAU,WAAW,OAAO,GAAG,KAAK,GAAG;AAAA,QAClE,eAAe;AAAA,MACjB;AAAA,IACF;AAAA,IACA,OAAO,GAAG,OAAO;AAAA,IACjB,UAAU,GAAG,OAAO;AAAA,IAEpB,QAAQ;AAAA,MACN,IAAI,QAAQ;AAAA,MACZ,QAAQ,QAAQ;AAAA,MAChB,4BAA4B;AAAA,MAC5B,8BAA8B;AAAA;AAAA,IAChC;AAAA,IAEA,QAAQ;AAAA,IAER,QAAQ,QAAQ,gBAAgB,QAAQ,CAAC,QAAQ,OAAO,IAAI,CAAC,OAAO;AAAA,IAEpE,QAAQ,SAAyB,QAAa;AAC5C,aAAO;AAAA,QACL,IAAI,QAAQ,OAAO,QAAQ,MAAM,QAAQ;AAAA,QACzC,OAAO,QAAQ;AAAA,QACf,eAAe,QAAQ,iBAAiB,oBAAI,KAAK,IAAI;AAAA,QACrD,MAAM,QAAQ,QAAQ,GAAG,QAAQ,cAAc,EAAE,IAAI,QAAQ,eAAe,EAAE,GAAG,KAAK;AAAA,QACtF,OAAO,QAAQ;AAAA,MACjB;AAAA,IACF;AAAA,IAEA,OAAO;AAAA,MACL,MAAM;AAAA,MACN,IAAI;AAAA,MACJ,MAAM;AAAA,IACR;AAAA,IAEA;AAAA,EACF;AACF;;;AChFA,IAAAA,oBAA4B;;;ACA5B,uBAAuD;AAoBvD,eAAsB,qBACjB,MAIH;AACA,aAAO,iBAAAC,kBAAmB,GAAG,IAAW;AAC1C;AAKO,SAAS,mBACd,SACA,aACA;AACA,SAAO,OAAO,KAAqB,QAAyB;AAC1D,UAAM,UAAU,MAAM,kBAAkB,KAAK,KAAK,WAAW;AAE7D,QAAI,CAAC,SAAS;AACZ,aAAO,IAAI,OAAO,GAAG,EAAE,KAAK,EAAE,OAAO,eAAe,CAAC;AAAA,IACvD;AAEA,WAAO,QAAQ,KAAK,KAAK,OAAO;AAAA,EAClC;AACF;AAKO,SAAS,2BACd,oBAIA,aACA;AACA,SAAO,OAAO,YAAuC;AACnD,UAAM,UAAU,MAAM;AAAA,MACpB,QAAQ;AAAA,MACR,QAAQ;AAAA,MACR;AAAA,IACF;AAEA,QAAI,CAAC,SAAS;AACZ,aAAO;AAAA,QACL,UAAU;AAAA,UACR,aAAa;AAAA,UACb,WAAW;AAAA,QACb;AAAA,MACF;AAAA,IACF;AAEA,WAAO,mBAAmB,SAAS,OAAO;AAAA,EAC5C;AACF;;;ADrEA,IAAM,WAAY,kBAAAC,QAAwB,WAAW,kBAAAA;AAoB9C,SAAS,WAAW,UAA6B,CAAC,GAAG;AAC1D,QAAM,WAAW,QAAQ,YAAY,QAAQ,IAAI;AACjD,QAAM,eAAe,QAAQ,gBAAgB,QAAQ,IAAI;AAEzD,MAAI,CAAC,YAAY,CAAC,cAAc;AAC9B,UAAM,IAAI;AAAA,MACR;AAAA,IAGF;AAAA,EACF;AAEA,QAAM,cAA+B;AAAA,IACnC,WAAW;AAAA,MACT,gBAAgB;AAAA,QACd;AAAA,QACA;AAAA,QACA,QAAQ,QAAQ;AAAA,QAChB,QAAQ,QAAQ;AAAA,QAChB,aAAa,QAAQ;AAAA,MACvB,CAAC;AAAA,IACH;AAAA,IAEA,WAAW;AAAA,MACT,MAAM,IAAI,EAAE,OAAO,SAAS,QAAQ,GAAG;AAErC,YAAI,SAAS;AACX,gBAAM,cAAc,QAAQ;AAC5B,gBAAM,eAAe,QAAQ;AAC7B,gBAAM,YAAY,QAAQ;AAC1B,gBAAM,UAAU,QAAQ;AAAA,QAC1B;AAGA,YAAI,SAAS;AACX,gBAAM,iBAAiB;AACvB,gBAAM,QAAQ,eAAe;AAC7B,gBAAM,WAAW,eAAe;AAChC,gBAAM,gBAAgB,eAAe;AAAA,QACvC;AAGA,YAAI,QAAQ,WAAW,KAAK;AAC1B,iBAAO,QAAQ,UAAU,IAAI,EAAE,OAAO,SAAS,QAAQ,CAAQ;AAAA,QACjE;AAEA,eAAO;AAAA,MACT;AAAA,MAEA,MAAM,QAAQ,EAAE,SAAS,MAAM,GAAG;AAEhC,gBAAQ,cAAc,MAAM;AAC5B,gBAAQ,UAAU,MAAM;AAExB,YAAI,QAAQ,MAAM;AAChB,kBAAQ,KAAK,QAAQ,MAAM;AAC3B,kBAAQ,KAAK,WAAW,MAAM;AAC9B,kBAAQ,KAAK,gBAAgB,MAAM;AAAA,QACrC;AAGA,YAAI,QAAQ,WAAW,SAAS;AAC9B,iBAAO,QAAQ,UAAU,QAAQ,EAAE,SAAS,MAAM,CAAQ;AAAA,QAC5D;AAEA,eAAO;AAAA,MACT;AAAA,MAEA,GAAG,QAAQ;AAAA,IACb;AAAA,IAEA,OAAO;AAAA,MACL,QAAQ;AAAA,MACR,SAAS;AAAA,MACT,OAAO;AAAA,MACP,GAAG,QAAQ;AAAA,IACb;AAAA,IAEA,SAAS;AAAA,MACP,UAAU;AAAA,MACV,GAAG,QAAQ;AAAA,IACb;AAAA,IAEA,OAAO,QAAQ,SAAS,QAAQ,IAAI,aAAa;AAAA,IAEjD,QAAQ,QAAQ,IAAI;AAAA,EACtB;AAGA,SAAO;AAAA,IACL,MAAM;AAAA,IACN,UAAU,SAAS,WAAW;AAAA,EAChC;AACF;AAiBO,IAAM,mBAAmB;AAKhC,eAAsB,mBAAmB,OAAY,UAAkB,cAAsB,QAAiB;AAC5G,MAAI;AACF,UAAM,UAAU,UAAU,QAAQ,IAAI,kBAAkB;AACxD,UAAM,WAAW,GAAG,OAAO;AAG3B,UAAM,eAAoB;AAAA,MACxB,QAAQ;AAAA,MACR,SAAS;AAAA,QACP,gBAAgB;AAAA,MAClB;AAAA,MACA,MAAM,IAAI,gBAAgB;AAAA,QACxB,YAAY;AAAA,QACZ,eAAe,MAAM;AAAA,QACrB,WAAW;AAAA,QACX,eAAe;AAAA,MACjB,CAAC;AAAA,IACH;AAGA,QAAI,QAAQ,IAAI,aAAa,gBAAgB,SAAS,WAAW,UAAU,GAAG;AAC5E,YAAM,QAAQ,MAAM,OAAO,OAAO;AAClC,mBAAa,QAAQ,IAAI,MAAM,MAAM;AAAA,QACnC,oBAAoB;AAAA,MACtB,CAAC;AAAA,IACH;AAEA,UAAM,WAAW,MAAM,MAAM,UAAU,YAAY;AACnD,UAAM,kBAAkB,MAAM,SAAS,KAAK;AAE5C,QAAI,CAAC,SAAS,IAAI;AAChB,YAAM;AAAA,IACR;AAEA,WAAO;AAAA,MACL,GAAG;AAAA,MACH,aAAa,gBAAgB;AAAA,MAC7B,cAAc,gBAAgB,iBAAiB,MAAM;AAAA;AAAA,MAErD,WAAW,KAAK,MAAM,KAAK,IAAI,IAAI,GAAI,KAAK,gBAAgB,cAAc;AAAA;AAAA,MAE1E,OAAO;AAAA,IACT;AAAA,EACF,SAAS,OAAO;AACd,YAAQ,MAAM,mCAAmC,KAAK;AACtD,WAAO;AAAA,MACL,GAAG;AAAA,MACH,OAAO;AAAA,IACT;AAAA,EACF;AACF;;;AE/LA,oBAA0C;AAC1C,iBAAyB;AAiBlB,SAAS,gBAAgB,UAA8B,CAAC,GAAG;AAChE,SAAO,eAAe,WAAW,KAAkB;AACjD,UAAM,QAAQ,UAAM,qBAAS;AAAA,MAC3B;AAAA,MACA,QAAQ,QAAQ,IAAI;AAAA,IACtB,CAAC;AAED,UAAM,WAAW,IAAI,QAAQ;AAG7B,QAAI,QAAQ,aAAa,KAAK,UAAQ,SAAS,WAAW,IAAI,CAAC,GAAG;AAChE,aAAO,2BAAa,KAAK;AAAA,IAC3B;AAGA,UAAM,kBAAkB,QAAQ,iBAC5B,QAAQ,eAAe,KAAK,UAAQ,SAAS,WAAW,IAAI,CAAC,IAC7D;AAEJ,QAAI,CAAC,iBAAiB;AACpB,aAAO,2BAAa,KAAK;AAAA,IAC3B;AAGA,QAAI,eAAe,CAAC,CAAC;AAErB,QAAI,QAAQ,WAAW,YAAY;AACjC,qBAAe,MAAM,QAAQ,UAAU,WAAW,EAAE,OAAO,IAAI,CAAC;AAAA,IAClE;AAEA,QAAI,CAAC,cAAc;AACjB,YAAM,YAAY,QAAQ,OAAO,UAAU;AAC3C,YAAM,MAAM,IAAI,IAAI,WAAW,IAAI,GAAG;AACtC,UAAI,aAAa,IAAI,eAAe,QAAQ;AAC5C,aAAO,2BAAa,SAAS,GAAG;AAAA,IAClC;AAEA,WAAO,2BAAa,KAAK;AAAA,EAC3B;AACF;AAKO,SAAS,uBACd,iBAA2B,CAAC,YAAY,GACxC,cAAwB,CAAC,SAAS,WAAW,GAC7C;AACA,SAAO;AAAA,IACL,SAAS;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA,MAQP;AAAA,IACF;AAAA,IACA;AAAA,IACA;AAAA,EACF;AACF;","names":["import_next_auth","getNextAuthSession","NextAuthDefault"]}
+{"version":3,"sources":["../src/index.ts","../src/provider.ts","../src/server/auth.ts","../src/server/session.ts","../src/server/middleware.ts"],"sourcesContent":["// Main exports\nexport { OAuth42Provider } from './provider';\nexport type { OAuth42Profile, OAuth42ProviderOptions } from './provider';\n\n// Server-side exports\nexport { createAuth, getServerSession, refreshAccessToken } from './server/auth';\nexport type { CreateAuthOptions } from './server/auth';\n\nexport { withOAuth42Auth, createMiddlewareConfig } from './server/middleware';\nexport type { OAuth42AuthOptions } from './server/middleware';\n\nexport { getOAuth42Session, withOAuth42Session, withOAuth42ServerSideProps } from './server/session';\n\n// Type exports\nexport type { OAuth42Config } from './types';\n\n// Re-export NextAuth types for convenience\nexport type { Session, User } from 'next-auth';","import type { OAuthConfig, OAuthUserConfig } from 'next-auth/providers/oauth';\n\nexport interface OAuth42Profile {\n  sub: string;\n  email: string;\n  email_verified?: boolean;\n  name?: string;\n  given_name?: string;\n  family_name?: string;\n  picture?: string;\n  username?: string;\n  id?: string;\n}\n\nexport interface OAuth42ProviderOptions {\n  clientId: string;\n  clientSecret: string;\n  issuer?: string;\n  authorizationUrl?: string;\n  tokenUrl?: string;\n  userinfoUrl?: string;\n  scopes?: string[];\n  pkceEnabled?: boolean;\n}\n\nexport function OAuth42Provider<P extends OAuth42Profile>(\n  options: OAuthUserConfig<P> & Partial<OAuth42ProviderOptions>\n): OAuthConfig<P> {\n  const issuer = options.issuer || process.env.OAUTH42_ISSUER || 'https://oauth42.com';\n  const baseUrl = issuer.replace(/\\/$/, '');\n  \n  return {\n    id: 'oauth42',\n    name: 'OAuth42',\n    type: 'oauth',\n    version: '2.0',\n    \n    // Use OIDC discovery to automatically find endpoints\n    wellKnown: `${baseUrl}/.well-known/openid-configuration`,\n    \n    // Also set individual endpoints for compatibility\n    authorization: {\n      url: `${baseUrl}/oauth2/authorize`,\n      params: {\n        scope: (options.scopes || ['openid', 'profile', 'email']).join(' '),\n        response_type: 'code',\n      },\n    },\n    token: `${baseUrl}/oauth2/token`,\n    userinfo: `${baseUrl}/oauth2/userinfo`,\n    \n    client: {\n      id: options.clientId,\n      secret: options.clientSecret,\n      token_endpoint_auth_method: 'client_secret_post',\n      id_token_signed_response_alg: 'HS256', // OAuth42 uses HS256 for ID tokens\n    },\n    \n    issuer: baseUrl,\n    \n    checks: options.pkceEnabled !== false ? ['pkce', 'state'] : ['state'],\n    \n    profile(profile: OAuth42Profile, tokens: any) {\n      return {\n        id: profile.sub || profile.id || profile.email,\n        email: profile.email,\n        emailVerified: profile.email_verified ? new Date() : null,\n        name: profile.name || `${profile.given_name || ''} ${profile.family_name || ''}`.trim(),\n        image: profile.picture,\n      };\n    },\n    \n    style: {\n      logo: '/oauth42-logo.svg',\n      bg: '#1e40af',\n      text: '#ffffff',\n    },\n    \n    options,\n  };\n}","import NextAuthDefault from 'next-auth';\nimport type { NextAuthOptions } from 'next-auth';\nimport { OAuth42Provider, OAuth42Profile } from '../provider';\nimport { getOAuth42Session } from './session';\n\n// Handle both CommonJS and ESM exports\nconst NextAuth = (NextAuthDefault as any).default || NextAuthDefault;\n\nexport { type NextAuthOptions };\n\nexport interface CreateAuthOptions {\n  clientId?: string;\n  clientSecret?: string;\n  issuer?: string;\n  scopes?: string[];\n  pkceEnabled?: boolean;\n  debug?: boolean;\n  callbacks?: NextAuthOptions['callbacks'];\n  pages?: NextAuthOptions['pages'];\n  session?: NextAuthOptions['session'];\n}\n\n/**\n * Create a pre-configured NextAuth instance for OAuth42\n * This provides a simplified setup with sensible defaults\n */\nexport function createAuth(options: CreateAuthOptions = {}) {\n  const clientId = options.clientId || process.env.OAUTH42_CLIENT_ID;\n  const clientSecret = options.clientSecret || process.env.OAUTH42_CLIENT_SECRET;\n  \n  if (!clientId || !clientSecret) {\n    throw new Error(\n      'OAuth42 client credentials are required. ' +\n      'Set OAUTH42_CLIENT_ID and OAUTH42_CLIENT_SECRET environment variables ' +\n      'or pass them in the options.'\n    );\n  }\n  \n  const authOptions: NextAuthOptions = {\n    providers: [\n      OAuth42Provider({\n        clientId,\n        clientSecret,\n        issuer: options.issuer,\n        scopes: options.scopes,\n        pkceEnabled: options.pkceEnabled,\n      }),\n    ],\n    \n    callbacks: {\n      async jwt({ token, account, profile }) {\n        // Store OAuth tokens in the JWT\n        if (account) {\n          token.accessToken = account.access_token;\n          token.refreshToken = account.refresh_token;\n          token.expiresAt = account.expires_at;\n          token.idToken = account.id_token;\n        }\n        \n        // Add user profile data\n        if (profile) {\n          const oauth42Profile = profile as OAuth42Profile;\n          token.email = oauth42Profile.email;\n          token.username = oauth42Profile.username;\n          token.emailVerified = oauth42Profile.email_verified;\n        }\n        \n        // Call custom callback if provided\n        if (options.callbacks?.jwt) {\n          return options.callbacks.jwt({ token, account, profile } as any);\n        }\n        \n        return token;\n      },\n      \n      async session({ session, token }) {\n        // Add OAuth42-specific data to session\n        session.accessToken = token.accessToken as string;\n        session.idToken = token.idToken as string;\n\n        if (session.user) {\n          session.user.email = token.email as string;\n          session.user.name = token.name as string;\n          session.user.username = token.username as string;\n          session.user.emailVerified = token.emailVerified as boolean;\n        }\n\n        // Call custom callback if provided\n        if (options.callbacks?.session) {\n          return options.callbacks.session({ session, token } as any);\n        }\n\n        return session;\n      },\n      \n      ...options.callbacks,\n    },\n    \n    pages: {\n      signIn: '/auth/signin',\n      signOut: '/auth/signout',\n      error: '/auth/error',\n      ...options.pages,\n    },\n    \n    session: {\n      strategy: 'jwt',\n      ...options.session,\n    },\n    \n    debug: options.debug || process.env.NODE_ENV === 'development',\n    \n    secret: process.env.NEXTAUTH_SECRET,\n  };\n  \n  // Return the configuration and a function to create handlers\n  return {\n    auth: authOptions,\n    handlers: NextAuth(authOptions),\n  };\n}\n\n/**\n * Create NextAuth handlers for API routes\n */\nexport function createHandlers(authOptions: NextAuthOptions) {\n  const handler = NextAuth(authOptions);\n  return { GET: handler, POST: handler };\n}\n\n/**\n * Helper to get the current session server-side\n * @deprecated Use getOAuth42Session instead - this is now just an alias for backward compatibility\n * \n * This function is maintained for backward compatibility but internally\n * calls getOAuth42Session which properly handles both App Router and Pages Router\n */\nexport const getServerSession = getOAuth42Session;\n\n/**\n * Token refresh helper\n */\nexport async function refreshAccessToken(token: any, clientId: string, clientSecret: string, issuer?: string) {\n  try {\n    const baseUrl = issuer || process.env.OAUTH42_ISSUER || 'https://oauth42.com';\n    const tokenUrl = `${baseUrl}/oauth2/token`;\n    \n    // In development, we need to handle self-signed certificates\n    const fetchOptions: any = {\n      method: 'POST',\n      headers: {\n        'Content-Type': 'application/x-www-form-urlencoded',\n      },\n      body: new URLSearchParams({\n        grant_type: 'refresh_token',\n        refresh_token: token.refreshToken,\n        client_id: clientId,\n        client_secret: clientSecret,\n      }),\n    };\n    \n    // Add agent for self-signed certificates in development\n    if (process.env.NODE_ENV !== 'production' && tokenUrl.startsWith('https://')) {\n      const https = await import('https');\n      fetchOptions.agent = new https.Agent({\n        rejectUnauthorized: false\n      });\n    }\n    \n    const response = await fetch(tokenUrl, fetchOptions);\n    const refreshedTokens = await response.json();\n    \n    if (!response.ok) {\n      throw refreshedTokens;\n    }\n    \n    return {\n      ...token,\n      accessToken: refreshedTokens.access_token,\n      refreshToken: refreshedTokens.refresh_token ?? token.refreshToken,\n      // Store expiration time in seconds (Unix timestamp)\n      expiresAt: Math.floor(Date.now() / 1000) + (refreshedTokens.expires_in || 3600),\n      // Explicitly remove any error property on successful refresh\n      error: undefined,\n    };\n  } catch (error) {\n    console.error('Failed to refresh access token:', error);\n    return {\n      ...token,\n      error: 'RefreshAccessTokenError',\n    };\n  }\n}","import { getServerSession as getNextAuthSession } from 'next-auth';\nimport { NextAuthOptions } from 'next-auth';\nimport { GetServerSidePropsContext, NextApiRequest, NextApiResponse } from 'next';\n\n/**\n * Get the OAuth42 session server-side\n * \n * This is the primary method for retrieving sessions in OAuth42 SDK.\n * Supports both Pages Router and App Router:\n * \n * App Router:\n * ```ts\n * const session = await getOAuth42Session(authOptions);\n * ```\n * \n * Pages Router:\n * ```ts\n * const session = await getOAuth42Session(req, res, authOptions);\n * ```\n */\nexport async function getOAuth42Session(\n  ...args: \n    | [GetServerSidePropsContext['req'], GetServerSidePropsContext['res'], NextAuthOptions]\n    | [NextApiRequest, NextApiResponse, NextAuthOptions]\n    | [NextAuthOptions]\n) {\n  return getNextAuthSession(...args as any);\n}\n\n/**\n * Helper for protecting API routes\n */\nexport function withOAuth42Session(\n  handler: (req: NextApiRequest, res: NextApiResponse, session: any) => Promise<void> | void,\n  authOptions: NextAuthOptions\n) {\n  return async (req: NextApiRequest, res: NextApiResponse) => {\n    const session = await getOAuth42Session(req, res, authOptions);\n    \n    if (!session) {\n      return res.status(401).json({ error: 'Unauthorized' });\n    }\n    \n    return handler(req, res, session);\n  };\n}\n\n/**\n * Helper for protecting server-side props\n */\nexport function withOAuth42ServerSideProps(\n  getServerSideProps: (\n    context: GetServerSidePropsContext,\n    session: any\n  ) => Promise<any>,\n  authOptions: NextAuthOptions\n) {\n  return async (context: GetServerSidePropsContext) => {\n    const session = await getOAuth42Session(\n      context.req,\n      context.res,\n      authOptions\n    );\n    \n    if (!session) {\n      return {\n        redirect: {\n          destination: '/auth/signin',\n          permanent: false,\n        },\n      };\n    }\n    \n    return getServerSideProps(context, session);\n  };\n}","import { NextRequest, NextResponse } from 'next/server';\nimport { getToken } from 'next-auth/jwt';\n\nexport interface OAuth42AuthOptions {\n  pages?: {\n    signIn?: string;\n    error?: string;\n  };\n  callbacks?: {\n    authorized?: (params: { token: any; req: NextRequest }) => boolean | Promise<boolean>;\n  };\n  protectedPaths?: string[];\n  publicPaths?: string[];\n}\n\n/**\n * Middleware helper for protecting routes with OAuth42\n */\nexport function withOAuth42Auth(options: OAuth42AuthOptions = {}) {\n  return async function middleware(req: NextRequest) {\n    const token = await getToken({ \n      req: req as any, \n      secret: process.env.NEXTAUTH_SECRET \n    });\n    \n    const pathname = req.nextUrl.pathname;\n    \n    // Check if path is explicitly public\n    if (options.publicPaths?.some(path => pathname.startsWith(path))) {\n      return NextResponse.next();\n    }\n    \n    // Check if path needs protection\n    const needsProtection = options.protectedPaths\n      ? options.protectedPaths.some(path => pathname.startsWith(path))\n      : true; // Default to protecting all paths\n    \n    if (!needsProtection) {\n      return NextResponse.next();\n    }\n    \n    // Check authorization\n    let isAuthorized = !!token;\n    \n    if (options.callbacks?.authorized) {\n      isAuthorized = await options.callbacks.authorized({ token, req });\n    }\n    \n    if (!isAuthorized) {\n      const signInUrl = options.pages?.signIn || '/auth/signin';\n      const url = new URL(signInUrl, req.url);\n      url.searchParams.set('callbackUrl', pathname);\n      return NextResponse.redirect(url);\n    }\n    \n    return NextResponse.next();\n  };\n}\n\n/**\n * Helper to create middleware configuration\n */\nexport function createMiddlewareConfig(\n  protectedPaths: string[] = ['/protected'],\n  publicPaths: string[] = ['/auth', '/api/auth']\n) {\n  return {\n    matcher: [\n      /*\n       * Match all request paths except for the ones starting with:\n       * - _next/static (static files)\n       * - _next/image (image optimization files)\n       * - favicon.ico (favicon file)\n       * - public folder\n       */\n      '/((?!_next/static|_next/image|favicon.ico|public).*)',\n    ],\n    protectedPaths,\n    publicPaths,\n  };\n}"],"mappings":";;;;;;;;;;;;;;;;;;;;;;;;;;;;;;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;;;ACyBO,SAAS,gBACd,SACgB;AAChB,QAAM,SAAS,QAAQ,UAAU,QAAQ,IAAI,kBAAkB;AAC/D,QAAM,UAAU,OAAO,QAAQ,OAAO,EAAE;AAExC,SAAO;AAAA,IACL,IAAI;AAAA,IACJ,MAAM;AAAA,IACN,MAAM;AAAA,IACN,SAAS;AAAA;AAAA,IAGT,WAAW,GAAG,OAAO;AAAA;AAAA,IAGrB,eAAe;AAAA,MACb,KAAK,GAAG,OAAO;AAAA,MACf,QAAQ;AAAA,QACN,QAAQ,QAAQ,UAAU,CAAC,UAAU,WAAW,OAAO,GAAG,KAAK,GAAG;AAAA,QAClE,eAAe;AAAA,MACjB;AAAA,IACF;AAAA,IACA,OAAO,GAAG,OAAO;AAAA,IACjB,UAAU,GAAG,OAAO;AAAA,IAEpB,QAAQ;AAAA,MACN,IAAI,QAAQ;AAAA,MACZ,QAAQ,QAAQ;AAAA,MAChB,4BAA4B;AAAA,MAC5B,8BAA8B;AAAA;AAAA,IAChC;AAAA,IAEA,QAAQ;AAAA,IAER,QAAQ,QAAQ,gBAAgB,QAAQ,CAAC,QAAQ,OAAO,IAAI,CAAC,OAAO;AAAA,IAEpE,QAAQ,SAAyB,QAAa;AAC5C,aAAO;AAAA,QACL,IAAI,QAAQ,OAAO,QAAQ,MAAM,QAAQ;AAAA,QACzC,OAAO,QAAQ;AAAA,QACf,eAAe,QAAQ,iBAAiB,oBAAI,KAAK,IAAI;AAAA,QACrD,MAAM,QAAQ,QAAQ,GAAG,QAAQ,cAAc,EAAE,IAAI,QAAQ,eAAe,EAAE,GAAG,KAAK;AAAA,QACtF,OAAO,QAAQ;AAAA,MACjB;AAAA,IACF;AAAA,IAEA,OAAO;AAAA,MACL,MAAM;AAAA,MACN,IAAI;AAAA,MACJ,MAAM;AAAA,IACR;AAAA,IAEA;AAAA,EACF;AACF;;;AChFA,IAAAA,oBAA4B;;;ACA5B,uBAAuD;AAoBvD,eAAsB,qBACjB,MAIH;AACA,aAAO,iBAAAC,kBAAmB,GAAG,IAAW;AAC1C;AAKO,SAAS,mBACd,SACA,aACA;AACA,SAAO,OAAO,KAAqB,QAAyB;AAC1D,UAAM,UAAU,MAAM,kBAAkB,KAAK,KAAK,WAAW;AAE7D,QAAI,CAAC,SAAS;AACZ,aAAO,IAAI,OAAO,GAAG,EAAE,KAAK,EAAE,OAAO,eAAe,CAAC;AAAA,IACvD;AAEA,WAAO,QAAQ,KAAK,KAAK,OAAO;AAAA,EAClC;AACF;AAKO,SAAS,2BACd,oBAIA,aACA;AACA,SAAO,OAAO,YAAuC;AACnD,UAAM,UAAU,MAAM;AAAA,MACpB,QAAQ;AAAA,MACR,QAAQ;AAAA,MACR;AAAA,IACF;AAEA,QAAI,CAAC,SAAS;AACZ,aAAO;AAAA,QACL,UAAU;AAAA,UACR,aAAa;AAAA,UACb,WAAW;AAAA,QACb;AAAA,MACF;AAAA,IACF;AAEA,WAAO,mBAAmB,SAAS,OAAO;AAAA,EAC5C;AACF;;;ADrEA,IAAM,WAAY,kBAAAC,QAAwB,WAAW,kBAAAA;AAoB9C,SAAS,WAAW,UAA6B,CAAC,GAAG;AAC1D,QAAM,WAAW,QAAQ,YAAY,QAAQ,IAAI;AACjD,QAAM,eAAe,QAAQ,gBAAgB,QAAQ,IAAI;AAEzD,MAAI,CAAC,YAAY,CAAC,cAAc;AAC9B,UAAM,IAAI;AAAA,MACR;AAAA,IAGF;AAAA,EACF;AAEA,QAAM,cAA+B;AAAA,IACnC,WAAW;AAAA,MACT,gBAAgB;AAAA,QACd;AAAA,QACA;AAAA,QACA,QAAQ,QAAQ;AAAA,QAChB,QAAQ,QAAQ;AAAA,QAChB,aAAa,QAAQ;AAAA,MACvB,CAAC;AAAA,IACH;AAAA,IAEA,WAAW;AAAA,MACT,MAAM,IAAI,EAAE,OAAO,SAAS,QAAQ,GAAG;AAErC,YAAI,SAAS;AACX,gBAAM,cAAc,QAAQ;AAC5B,gBAAM,eAAe,QAAQ;AAC7B,gBAAM,YAAY,QAAQ;AAC1B,gBAAM,UAAU,QAAQ;AAAA,QAC1B;AAGA,YAAI,SAAS;AACX,gBAAM,iBAAiB;AACvB,gBAAM,QAAQ,eAAe;AAC7B,gBAAM,WAAW,eAAe;AAChC,gBAAM,gBAAgB,eAAe;AAAA,QACvC;AAGA,YAAI,QAAQ,WAAW,KAAK;AAC1B,iBAAO,QAAQ,UAAU,IAAI,EAAE,OAAO,SAAS,QAAQ,CAAQ;AAAA,QACjE;AAEA,eAAO;AAAA,MACT;AAAA,MAEA,MAAM,QAAQ,EAAE,SAAS,MAAM,GAAG;AAEhC,gBAAQ,cAAc,MAAM;AAC5B,gBAAQ,UAAU,MAAM;AAExB,YAAI,QAAQ,MAAM;AAChB,kBAAQ,KAAK,QAAQ,MAAM;AAC3B,kBAAQ,KAAK,OAAO,MAAM;AAC1B,kBAAQ,KAAK,WAAW,MAAM;AAC9B,kBAAQ,KAAK,gBAAgB,MAAM;AAAA,QACrC;AAGA,YAAI,QAAQ,WAAW,SAAS;AAC9B,iBAAO,QAAQ,UAAU,QAAQ,EAAE,SAAS,MAAM,CAAQ;AAAA,QAC5D;AAEA,eAAO;AAAA,MACT;AAAA,MAEA,GAAG,QAAQ;AAAA,IACb;AAAA,IAEA,OAAO;AAAA,MACL,QAAQ;AAAA,MACR,SAAS;AAAA,MACT,OAAO;AAAA,MACP,GAAG,QAAQ;AAAA,IACb;AAAA,IAEA,SAAS;AAAA,MACP,UAAU;AAAA,MACV,GAAG,QAAQ;AAAA,IACb;AAAA,IAEA,OAAO,QAAQ,SAAS,QAAQ,IAAI,aAAa;AAAA,IAEjD,QAAQ,QAAQ,IAAI;AAAA,EACtB;AAGA,SAAO;AAAA,IACL,MAAM;AAAA,IACN,UAAU,SAAS,WAAW;AAAA,EAChC;AACF;AAiBO,IAAM,mBAAmB;AAKhC,eAAsB,mBAAmB,OAAY,UAAkB,cAAsB,QAAiB;AAC5G,MAAI;AACF,UAAM,UAAU,UAAU,QAAQ,IAAI,kBAAkB;AACxD,UAAM,WAAW,GAAG,OAAO;AAG3B,UAAM,eAAoB;AAAA,MACxB,QAAQ;AAAA,MACR,SAAS;AAAA,QACP,gBAAgB;AAAA,MAClB;AAAA,MACA,MAAM,IAAI,gBAAgB;AAAA,QACxB,YAAY;AAAA,QACZ,eAAe,MAAM;AAAA,QACrB,WAAW;AAAA,QACX,eAAe;AAAA,MACjB,CAAC;AAAA,IACH;AAGA,QAAI,QAAQ,IAAI,aAAa,gBAAgB,SAAS,WAAW,UAAU,GAAG;AAC5E,YAAM,QAAQ,MAAM,OAAO,OAAO;AAClC,mBAAa,QAAQ,IAAI,MAAM,MAAM;AAAA,QACnC,oBAAoB;AAAA,MACtB,CAAC;AAAA,IACH;AAEA,UAAM,WAAW,MAAM,MAAM,UAAU,YAAY;AACnD,UAAM,kBAAkB,MAAM,SAAS,KAAK;AAE5C,QAAI,CAAC,SAAS,IAAI;AAChB,YAAM;AAAA,IACR;AAEA,WAAO;AAAA,MACL,GAAG;AAAA,MACH,aAAa,gBAAgB;AAAA,MAC7B,cAAc,gBAAgB,iBAAiB,MAAM;AAAA;AAAA,MAErD,WAAW,KAAK,MAAM,KAAK,IAAI,IAAI,GAAI,KAAK,gBAAgB,cAAc;AAAA;AAAA,MAE1E,OAAO;AAAA,IACT;AAAA,EACF,SAAS,OAAO;AACd,YAAQ,MAAM,mCAAmC,KAAK;AACtD,WAAO;AAAA,MACL,GAAG;AAAA,MACH,OAAO;AAAA,IACT;AAAA,EACF;AACF;;;AEhMA,oBAA0C;AAC1C,iBAAyB;AAiBlB,SAAS,gBAAgB,UAA8B,CAAC,GAAG;AAChE,SAAO,eAAe,WAAW,KAAkB;AACjD,UAAM,QAAQ,UAAM,qBAAS;AAAA,MAC3B;AAAA,MACA,QAAQ,QAAQ,IAAI;AAAA,IACtB,CAAC;AAED,UAAM,WAAW,IAAI,QAAQ;AAG7B,QAAI,QAAQ,aAAa,KAAK,UAAQ,SAAS,WAAW,IAAI,CAAC,GAAG;AAChE,aAAO,2BAAa,KAAK;AAAA,IAC3B;AAGA,UAAM,kBAAkB,QAAQ,iBAC5B,QAAQ,eAAe,KAAK,UAAQ,SAAS,WAAW,IAAI,CAAC,IAC7D;AAEJ,QAAI,CAAC,iBAAiB;AACpB,aAAO,2BAAa,KAAK;AAAA,IAC3B;AAGA,QAAI,eAAe,CAAC,CAAC;AAErB,QAAI,QAAQ,WAAW,YAAY;AACjC,qBAAe,MAAM,QAAQ,UAAU,WAAW,EAAE,OAAO,IAAI,CAAC;AAAA,IAClE;AAEA,QAAI,CAAC,cAAc;AACjB,YAAM,YAAY,QAAQ,OAAO,UAAU;AAC3C,YAAM,MAAM,IAAI,IAAI,WAAW,IAAI,GAAG;AACtC,UAAI,aAAa,IAAI,eAAe,QAAQ;AAC5C,aAAO,2BAAa,SAAS,GAAG;AAAA,IAClC;AAEA,WAAO,2BAAa,KAAK;AAAA,EAC3B;AACF;AAKO,SAAS,uBACd,iBAA2B,CAAC,YAAY,GACxC,cAAwB,CAAC,SAAS,WAAW,GAC7C;AACA,SAAO;AAAA,IACL,SAAS;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA,MAQP;AAAA,IACF;AAAA,IACA;AAAA,IACA;AAAA,EACF;AACF;","names":["import_next_auth","getNextAuthSession","NextAuthDefault"]}

package/dist/index.mjs

@@ -126,6 +126,7 @@ function createAuth(options = {}) {
         session.idToken = token.idToken;
         if (session.user) {
           session.user.email = token.email;
+          session.user.name = token.name;
           session.user.username = token.username;
           session.user.emailVerified = token.emailVerified;
         }

package/dist/index.mjs.map

@@ -1 +1 @@
-{"version":3,"sources":["../src/provider.ts","../src/server/auth.ts","../src/server/session.ts","../src/server/middleware.ts"],"sourcesContent":["import type { OAuthConfig, OAuthUserConfig } from 'next-auth/providers/oauth';\n\nexport interface OAuth42Profile {\n  sub: string;\n  email: string;\n  email_verified?: boolean;\n  name?: string;\n  given_name?: string;\n  family_name?: string;\n  picture?: string;\n  username?: string;\n  id?: string;\n}\n\nexport interface OAuth42ProviderOptions {\n  clientId: string;\n  clientSecret: string;\n  issuer?: string;\n  authorizationUrl?: string;\n  tokenUrl?: string;\n  userinfoUrl?: string;\n  scopes?: string[];\n  pkceEnabled?: boolean;\n}\n\nexport function OAuth42Provider<P extends OAuth42Profile>(\n  options: OAuthUserConfig<P> & Partial<OAuth42ProviderOptions>\n): OAuthConfig<P> {\n  const issuer = options.issuer || process.env.OAUTH42_ISSUER || 'https://oauth42.com';\n  const baseUrl = issuer.replace(/\\/$/, '');\n  \n  return {\n    id: 'oauth42',\n    name: 'OAuth42',\n    type: 'oauth',\n    version: '2.0',\n    \n    // Use OIDC discovery to automatically find endpoints\n    wellKnown: `${baseUrl}/.well-known/openid-configuration`,\n    \n    // Also set individual endpoints for compatibility\n    authorization: {\n      url: `${baseUrl}/oauth2/authorize`,\n      params: {\n        scope: (options.scopes || ['openid', 'profile', 'email']).join(' '),\n        response_type: 'code',\n      },\n    },\n    token: `${baseUrl}/oauth2/token`,\n    userinfo: `${baseUrl}/oauth2/userinfo`,\n    \n    client: {\n      id: options.clientId,\n      secret: options.clientSecret,\n      token_endpoint_auth_method: 'client_secret_post',\n      id_token_signed_response_alg: 'HS256', // OAuth42 uses HS256 for ID tokens\n    },\n    \n    issuer: baseUrl,\n    \n    checks: options.pkceEnabled !== false ? ['pkce', 'state'] : ['state'],\n    \n    profile(profile: OAuth42Profile, tokens: any) {\n      return {\n        id: profile.sub || profile.id || profile.email,\n        email: profile.email,\n        emailVerified: profile.email_verified ? new Date() : null,\n        name: profile.name || `${profile.given_name || ''} ${profile.family_name || ''}`.trim(),\n        image: profile.picture,\n      };\n    },\n    \n    style: {\n      logo: '/oauth42-logo.svg',\n      bg: '#1e40af',\n      text: '#ffffff',\n    },\n    \n    options,\n  };\n}","import NextAuthDefault from 'next-auth';\nimport type { NextAuthOptions } from 'next-auth';\nimport { OAuth42Provider, OAuth42Profile } from '../provider';\nimport { getOAuth42Session } from './session';\n\n// Handle both CommonJS and ESM exports\nconst NextAuth = (NextAuthDefault as any).default || NextAuthDefault;\n\nexport { type NextAuthOptions };\n\nexport interface CreateAuthOptions {\n  clientId?: string;\n  clientSecret?: string;\n  issuer?: string;\n  scopes?: string[];\n  pkceEnabled?: boolean;\n  debug?: boolean;\n  callbacks?: NextAuthOptions['callbacks'];\n  pages?: NextAuthOptions['pages'];\n  session?: NextAuthOptions['session'];\n}\n\n/**\n * Create a pre-configured NextAuth instance for OAuth42\n * This provides a simplified setup with sensible defaults\n */\nexport function createAuth(options: CreateAuthOptions = {}) {\n  const clientId = options.clientId || process.env.OAUTH42_CLIENT_ID;\n  const clientSecret = options.clientSecret || process.env.OAUTH42_CLIENT_SECRET;\n  \n  if (!clientId || !clientSecret) {\n    throw new Error(\n      'OAuth42 client credentials are required. ' +\n      'Set OAUTH42_CLIENT_ID and OAUTH42_CLIENT_SECRET environment variables ' +\n      'or pass them in the options.'\n    );\n  }\n  \n  const authOptions: NextAuthOptions = {\n    providers: [\n      OAuth42Provider({\n        clientId,\n        clientSecret,\n        issuer: options.issuer,\n        scopes: options.scopes,\n        pkceEnabled: options.pkceEnabled,\n      }),\n    ],\n    \n    callbacks: {\n      async jwt({ token, account, profile }) {\n        // Store OAuth tokens in the JWT\n        if (account) {\n          token.accessToken = account.access_token;\n          token.refreshToken = account.refresh_token;\n          token.expiresAt = account.expires_at;\n          token.idToken = account.id_token;\n        }\n        \n        // Add user profile data\n        if (profile) {\n          const oauth42Profile = profile as OAuth42Profile;\n          token.email = oauth42Profile.email;\n          token.username = oauth42Profile.username;\n          token.emailVerified = oauth42Profile.email_verified;\n        }\n        \n        // Call custom callback if provided\n        if (options.callbacks?.jwt) {\n          return options.callbacks.jwt({ token, account, profile } as any);\n        }\n        \n        return token;\n      },\n      \n      async session({ session, token }) {\n        // Add OAuth42-specific data to session\n        session.accessToken = token.accessToken as string;\n        session.idToken = token.idToken as string;\n        \n        if (session.user) {\n          session.user.email = token.email as string;\n          session.user.username = token.username as string;\n          session.user.emailVerified = token.emailVerified as boolean;\n        }\n        \n        // Call custom callback if provided\n        if (options.callbacks?.session) {\n          return options.callbacks.session({ session, token } as any);\n        }\n        \n        return session;\n      },\n      \n      ...options.callbacks,\n    },\n    \n    pages: {\n      signIn: '/auth/signin',\n      signOut: '/auth/signout',\n      error: '/auth/error',\n      ...options.pages,\n    },\n    \n    session: {\n      strategy: 'jwt',\n      ...options.session,\n    },\n    \n    debug: options.debug || process.env.NODE_ENV === 'development',\n    \n    secret: process.env.NEXTAUTH_SECRET,\n  };\n  \n  // Return the configuration and a function to create handlers\n  return {\n    auth: authOptions,\n    handlers: NextAuth(authOptions),\n  };\n}\n\n/**\n * Create NextAuth handlers for API routes\n */\nexport function createHandlers(authOptions: NextAuthOptions) {\n  const handler = NextAuth(authOptions);\n  return { GET: handler, POST: handler };\n}\n\n/**\n * Helper to get the current session server-side\n * @deprecated Use getOAuth42Session instead - this is now just an alias for backward compatibility\n * \n * This function is maintained for backward compatibility but internally\n * calls getOAuth42Session which properly handles both App Router and Pages Router\n */\nexport const getServerSession = getOAuth42Session;\n\n/**\n * Token refresh helper\n */\nexport async function refreshAccessToken(token: any, clientId: string, clientSecret: string, issuer?: string) {\n  try {\n    const baseUrl = issuer || process.env.OAUTH42_ISSUER || 'https://oauth42.com';\n    const tokenUrl = `${baseUrl}/oauth2/token`;\n    \n    // In development, we need to handle self-signed certificates\n    const fetchOptions: any = {\n      method: 'POST',\n      headers: {\n        'Content-Type': 'application/x-www-form-urlencoded',\n      },\n      body: new URLSearchParams({\n        grant_type: 'refresh_token',\n        refresh_token: token.refreshToken,\n        client_id: clientId,\n        client_secret: clientSecret,\n      }),\n    };\n    \n    // Add agent for self-signed certificates in development\n    if (process.env.NODE_ENV !== 'production' && tokenUrl.startsWith('https://')) {\n      const https = await import('https');\n      fetchOptions.agent = new https.Agent({\n        rejectUnauthorized: false\n      });\n    }\n    \n    const response = await fetch(tokenUrl, fetchOptions);\n    const refreshedTokens = await response.json();\n    \n    if (!response.ok) {\n      throw refreshedTokens;\n    }\n    \n    return {\n      ...token,\n      accessToken: refreshedTokens.access_token,\n      refreshToken: refreshedTokens.refresh_token ?? token.refreshToken,\n      // Store expiration time in seconds (Unix timestamp)\n      expiresAt: Math.floor(Date.now() / 1000) + (refreshedTokens.expires_in || 3600),\n      // Explicitly remove any error property on successful refresh\n      error: undefined,\n    };\n  } catch (error) {\n    console.error('Failed to refresh access token:', error);\n    return {\n      ...token,\n      error: 'RefreshAccessTokenError',\n    };\n  }\n}","import { getServerSession as getNextAuthSession } from 'next-auth';\nimport { NextAuthOptions } from 'next-auth';\nimport { GetServerSidePropsContext, NextApiRequest, NextApiResponse } from 'next';\n\n/**\n * Get the OAuth42 session server-side\n * \n * This is the primary method for retrieving sessions in OAuth42 SDK.\n * Supports both Pages Router and App Router:\n * \n * App Router:\n * ```ts\n * const session = await getOAuth42Session(authOptions);\n * ```\n * \n * Pages Router:\n * ```ts\n * const session = await getOAuth42Session(req, res, authOptions);\n * ```\n */\nexport async function getOAuth42Session(\n  ...args: \n    | [GetServerSidePropsContext['req'], GetServerSidePropsContext['res'], NextAuthOptions]\n    | [NextApiRequest, NextApiResponse, NextAuthOptions]\n    | [NextAuthOptions]\n) {\n  return getNextAuthSession(...args as any);\n}\n\n/**\n * Helper for protecting API routes\n */\nexport function withOAuth42Session(\n  handler: (req: NextApiRequest, res: NextApiResponse, session: any) => Promise<void> | void,\n  authOptions: NextAuthOptions\n) {\n  return async (req: NextApiRequest, res: NextApiResponse) => {\n    const session = await getOAuth42Session(req, res, authOptions);\n    \n    if (!session) {\n      return res.status(401).json({ error: 'Unauthorized' });\n    }\n    \n    return handler(req, res, session);\n  };\n}\n\n/**\n * Helper for protecting server-side props\n */\nexport function withOAuth42ServerSideProps(\n  getServerSideProps: (\n    context: GetServerSidePropsContext,\n    session: any\n  ) => Promise<any>,\n  authOptions: NextAuthOptions\n) {\n  return async (context: GetServerSidePropsContext) => {\n    const session = await getOAuth42Session(\n      context.req,\n      context.res,\n      authOptions\n    );\n    \n    if (!session) {\n      return {\n        redirect: {\n          destination: '/auth/signin',\n          permanent: false,\n        },\n      };\n    }\n    \n    return getServerSideProps(context, session);\n  };\n}","import { NextRequest, NextResponse } from 'next/server';\nimport { getToken } from 'next-auth/jwt';\n\nexport interface OAuth42AuthOptions {\n  pages?: {\n    signIn?: string;\n    error?: string;\n  };\n  callbacks?: {\n    authorized?: (params: { token: any; req: NextRequest }) => boolean | Promise<boolean>;\n  };\n  protectedPaths?: string[];\n  publicPaths?: string[];\n}\n\n/**\n * Middleware helper for protecting routes with OAuth42\n */\nexport function withOAuth42Auth(options: OAuth42AuthOptions = {}) {\n  return async function middleware(req: NextRequest) {\n    const token = await getToken({ \n      req: req as any, \n      secret: process.env.NEXTAUTH_SECRET \n    });\n    \n    const pathname = req.nextUrl.pathname;\n    \n    // Check if path is explicitly public\n    if (options.publicPaths?.some(path => pathname.startsWith(path))) {\n      return NextResponse.next();\n    }\n    \n    // Check if path needs protection\n    const needsProtection = options.protectedPaths\n      ? options.protectedPaths.some(path => pathname.startsWith(path))\n      : true; // Default to protecting all paths\n    \n    if (!needsProtection) {\n      return NextResponse.next();\n    }\n    \n    // Check authorization\n    let isAuthorized = !!token;\n    \n    if (options.callbacks?.authorized) {\n      isAuthorized = await options.callbacks.authorized({ token, req });\n    }\n    \n    if (!isAuthorized) {\n      const signInUrl = options.pages?.signIn || '/auth/signin';\n      const url = new URL(signInUrl, req.url);\n      url.searchParams.set('callbackUrl', pathname);\n      return NextResponse.redirect(url);\n    }\n    \n    return NextResponse.next();\n  };\n}\n\n/**\n * Helper to create middleware configuration\n */\nexport function createMiddlewareConfig(\n  protectedPaths: string[] = ['/protected'],\n  publicPaths: string[] = ['/auth', '/api/auth']\n) {\n  return {\n    matcher: [\n      /*\n       * Match all request paths except for the ones starting with:\n       * - _next/static (static files)\n       * - _next/image (image optimization files)\n       * - favicon.ico (favicon file)\n       * - public folder\n       */\n      '/((?!_next/static|_next/image|favicon.ico|public).*)',\n    ],\n    protectedPaths,\n    publicPaths,\n  };\n}"],"mappings":";AAyBO,SAAS,gBACd,SACgB;AAChB,QAAM,SAAS,QAAQ,UAAU,QAAQ,IAAI,kBAAkB;AAC/D,QAAM,UAAU,OAAO,QAAQ,OAAO,EAAE;AAExC,SAAO;AAAA,IACL,IAAI;AAAA,IACJ,MAAM;AAAA,IACN,MAAM;AAAA,IACN,SAAS;AAAA;AAAA,IAGT,WAAW,GAAG,OAAO;AAAA;AAAA,IAGrB,eAAe;AAAA,MACb,KAAK,GAAG,OAAO;AAAA,MACf,QAAQ;AAAA,QACN,QAAQ,QAAQ,UAAU,CAAC,UAAU,WAAW,OAAO,GAAG,KAAK,GAAG;AAAA,QAClE,eAAe;AAAA,MACjB;AAAA,IACF;AAAA,IACA,OAAO,GAAG,OAAO;AAAA,IACjB,UAAU,GAAG,OAAO;AAAA,IAEpB,QAAQ;AAAA,MACN,IAAI,QAAQ;AAAA,MACZ,QAAQ,QAAQ;AAAA,MAChB,4BAA4B;AAAA,MAC5B,8BAA8B;AAAA;AAAA,IAChC;AAAA,IAEA,QAAQ;AAAA,IAER,QAAQ,QAAQ,gBAAgB,QAAQ,CAAC,QAAQ,OAAO,IAAI,CAAC,OAAO;AAAA,IAEpE,QAAQ,SAAyB,QAAa;AAC5C,aAAO;AAAA,QACL,IAAI,QAAQ,OAAO,QAAQ,MAAM,QAAQ;AAAA,QACzC,OAAO,QAAQ;AAAA,QACf,eAAe,QAAQ,iBAAiB,oBAAI,KAAK,IAAI;AAAA,QACrD,MAAM,QAAQ,QAAQ,GAAG,QAAQ,cAAc,EAAE,IAAI,QAAQ,eAAe,EAAE,GAAG,KAAK;AAAA,QACtF,OAAO,QAAQ;AAAA,MACjB;AAAA,IACF;AAAA,IAEA,OAAO;AAAA,MACL,MAAM;AAAA,MACN,IAAI;AAAA,MACJ,MAAM;AAAA,IACR;AAAA,IAEA;AAAA,EACF;AACF;;;AChFA,OAAO,qBAAqB;;;ACA5B,SAAS,oBAAoB,0BAA0B;AAoBvD,eAAsB,qBACjB,MAIH;AACA,SAAO,mBAAmB,GAAG,IAAW;AAC1C;AAKO,SAAS,mBACd,SACA,aACA;AACA,SAAO,OAAO,KAAqB,QAAyB;AAC1D,UAAM,UAAU,MAAM,kBAAkB,KAAK,KAAK,WAAW;AAE7D,QAAI,CAAC,SAAS;AACZ,aAAO,IAAI,OAAO,GAAG,EAAE,KAAK,EAAE,OAAO,eAAe,CAAC;AAAA,IACvD;AAEA,WAAO,QAAQ,KAAK,KAAK,OAAO;AAAA,EAClC;AACF;AAKO,SAAS,2BACd,oBAIA,aACA;AACA,SAAO,OAAO,YAAuC;AACnD,UAAM,UAAU,MAAM;AAAA,MACpB,QAAQ;AAAA,MACR,QAAQ;AAAA,MACR;AAAA,IACF;AAEA,QAAI,CAAC,SAAS;AACZ,aAAO;AAAA,QACL,UAAU;AAAA,UACR,aAAa;AAAA,UACb,WAAW;AAAA,QACb;AAAA,MACF;AAAA,IACF;AAEA,WAAO,mBAAmB,SAAS,OAAO;AAAA,EAC5C;AACF;;;ADrEA,IAAM,WAAY,gBAAwB,WAAW;AAoB9C,SAAS,WAAW,UAA6B,CAAC,GAAG;AAC1D,QAAM,WAAW,QAAQ,YAAY,QAAQ,IAAI;AACjD,QAAM,eAAe,QAAQ,gBAAgB,QAAQ,IAAI;AAEzD,MAAI,CAAC,YAAY,CAAC,cAAc;AAC9B,UAAM,IAAI;AAAA,MACR;AAAA,IAGF;AAAA,EACF;AAEA,QAAM,cAA+B;AAAA,IACnC,WAAW;AAAA,MACT,gBAAgB;AAAA,QACd;AAAA,QACA;AAAA,QACA,QAAQ,QAAQ;AAAA,QAChB,QAAQ,QAAQ;AAAA,QAChB,aAAa,QAAQ;AAAA,MACvB,CAAC;AAAA,IACH;AAAA,IAEA,WAAW;AAAA,MACT,MAAM,IAAI,EAAE,OAAO,SAAS,QAAQ,GAAG;AAErC,YAAI,SAAS;AACX,gBAAM,cAAc,QAAQ;AAC5B,gBAAM,eAAe,QAAQ;AAC7B,gBAAM,YAAY,QAAQ;AAC1B,gBAAM,UAAU,QAAQ;AAAA,QAC1B;AAGA,YAAI,SAAS;AACX,gBAAM,iBAAiB;AACvB,gBAAM,QAAQ,eAAe;AAC7B,gBAAM,WAAW,eAAe;AAChC,gBAAM,gBAAgB,eAAe;AAAA,QACvC;AAGA,YAAI,QAAQ,WAAW,KAAK;AAC1B,iBAAO,QAAQ,UAAU,IAAI,EAAE,OAAO,SAAS,QAAQ,CAAQ;AAAA,QACjE;AAEA,eAAO;AAAA,MACT;AAAA,MAEA,MAAM,QAAQ,EAAE,SAAS,MAAM,GAAG;AAEhC,gBAAQ,cAAc,MAAM;AAC5B,gBAAQ,UAAU,MAAM;AAExB,YAAI,QAAQ,MAAM;AAChB,kBAAQ,KAAK,QAAQ,MAAM;AAC3B,kBAAQ,KAAK,WAAW,MAAM;AAC9B,kBAAQ,KAAK,gBAAgB,MAAM;AAAA,QACrC;AAGA,YAAI,QAAQ,WAAW,SAAS;AAC9B,iBAAO,QAAQ,UAAU,QAAQ,EAAE,SAAS,MAAM,CAAQ;AAAA,QAC5D;AAEA,eAAO;AAAA,MACT;AAAA,MAEA,GAAG,QAAQ;AAAA,IACb;AAAA,IAEA,OAAO;AAAA,MACL,QAAQ;AAAA,MACR,SAAS;AAAA,MACT,OAAO;AAAA,MACP,GAAG,QAAQ;AAAA,IACb;AAAA,IAEA,SAAS;AAAA,MACP,UAAU;AAAA,MACV,GAAG,QAAQ;AAAA,IACb;AAAA,IAEA,OAAO,QAAQ,SAAS,QAAQ,IAAI,aAAa;AAAA,IAEjD,QAAQ,QAAQ,IAAI;AAAA,EACtB;AAGA,SAAO;AAAA,IACL,MAAM;AAAA,IACN,UAAU,SAAS,WAAW;AAAA,EAChC;AACF;AAiBO,IAAM,mBAAmB;AAKhC,eAAsB,mBAAmB,OAAY,UAAkB,cAAsB,QAAiB;AAC5G,MAAI;AACF,UAAM,UAAU,UAAU,QAAQ,IAAI,kBAAkB;AACxD,UAAM,WAAW,GAAG,OAAO;AAG3B,UAAM,eAAoB;AAAA,MACxB,QAAQ;AAAA,MACR,SAAS;AAAA,QACP,gBAAgB;AAAA,MAClB;AAAA,MACA,MAAM,IAAI,gBAAgB;AAAA,QACxB,YAAY;AAAA,QACZ,eAAe,MAAM;AAAA,QACrB,WAAW;AAAA,QACX,eAAe;AAAA,MACjB,CAAC;AAAA,IACH;AAGA,QAAI,QAAQ,IAAI,aAAa,gBAAgB,SAAS,WAAW,UAAU,GAAG;AAC5E,YAAM,QAAQ,MAAM,OAAO,OAAO;AAClC,mBAAa,QAAQ,IAAI,MAAM,MAAM;AAAA,QACnC,oBAAoB;AAAA,MACtB,CAAC;AAAA,IACH;AAEA,UAAM,WAAW,MAAM,MAAM,UAAU,YAAY;AACnD,UAAM,kBAAkB,MAAM,SAAS,KAAK;AAE5C,QAAI,CAAC,SAAS,IAAI;AAChB,YAAM;AAAA,IACR;AAEA,WAAO;AAAA,MACL,GAAG;AAAA,MACH,aAAa,gBAAgB;AAAA,MAC7B,cAAc,gBAAgB,iBAAiB,MAAM;AAAA;AAAA,MAErD,WAAW,KAAK,MAAM,KAAK,IAAI,IAAI,GAAI,KAAK,gBAAgB,cAAc;AAAA;AAAA,MAE1E,OAAO;AAAA,IACT;AAAA,EACF,SAAS,OAAO;AACd,YAAQ,MAAM,mCAAmC,KAAK;AACtD,WAAO;AAAA,MACL,GAAG;AAAA,MACH,OAAO;AAAA,IACT;AAAA,EACF;AACF;;;AE/LA,SAAsB,oBAAoB;AAC1C,SAAS,gBAAgB;AAiBlB,SAAS,gBAAgB,UAA8B,CAAC,GAAG;AAChE,SAAO,eAAe,WAAW,KAAkB;AACjD,UAAM,QAAQ,MAAM,SAAS;AAAA,MAC3B;AAAA,MACA,QAAQ,QAAQ,IAAI;AAAA,IACtB,CAAC;AAED,UAAM,WAAW,IAAI,QAAQ;AAG7B,QAAI,QAAQ,aAAa,KAAK,UAAQ,SAAS,WAAW,IAAI,CAAC,GAAG;AAChE,aAAO,aAAa,KAAK;AAAA,IAC3B;AAGA,UAAM,kBAAkB,QAAQ,iBAC5B,QAAQ,eAAe,KAAK,UAAQ,SAAS,WAAW,IAAI,CAAC,IAC7D;AAEJ,QAAI,CAAC,iBAAiB;AACpB,aAAO,aAAa,KAAK;AAAA,IAC3B;AAGA,QAAI,eAAe,CAAC,CAAC;AAErB,QAAI,QAAQ,WAAW,YAAY;AACjC,qBAAe,MAAM,QAAQ,UAAU,WAAW,EAAE,OAAO,IAAI,CAAC;AAAA,IAClE;AAEA,QAAI,CAAC,cAAc;AACjB,YAAM,YAAY,QAAQ,OAAO,UAAU;AAC3C,YAAM,MAAM,IAAI,IAAI,WAAW,IAAI,GAAG;AACtC,UAAI,aAAa,IAAI,eAAe,QAAQ;AAC5C,aAAO,aAAa,SAAS,GAAG;AAAA,IAClC;AAEA,WAAO,aAAa,KAAK;AAAA,EAC3B;AACF;AAKO,SAAS,uBACd,iBAA2B,CAAC,YAAY,GACxC,cAAwB,CAAC,SAAS,WAAW,GAC7C;AACA,SAAO;AAAA,IACL,SAAS;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA,MAQP;AAAA,IACF;AAAA,IACA;AAAA,IACA;AAAA,EACF;AACF;","names":[]}
+{"version":3,"sources":["../src/provider.ts","../src/server/auth.ts","../src/server/session.ts","../src/server/middleware.ts"],"sourcesContent":["import type { OAuthConfig, OAuthUserConfig } from 'next-auth/providers/oauth';\n\nexport interface OAuth42Profile {\n  sub: string;\n  email: string;\n  email_verified?: boolean;\n  name?: string;\n  given_name?: string;\n  family_name?: string;\n  picture?: string;\n  username?: string;\n  id?: string;\n}\n\nexport interface OAuth42ProviderOptions {\n  clientId: string;\n  clientSecret: string;\n  issuer?: string;\n  authorizationUrl?: string;\n  tokenUrl?: string;\n  userinfoUrl?: string;\n  scopes?: string[];\n  pkceEnabled?: boolean;\n}\n\nexport function OAuth42Provider<P extends OAuth42Profile>(\n  options: OAuthUserConfig<P> & Partial<OAuth42ProviderOptions>\n): OAuthConfig<P> {\n  const issuer = options.issuer || process.env.OAUTH42_ISSUER || 'https://oauth42.com';\n  const baseUrl = issuer.replace(/\\/$/, '');\n  \n  return {\n    id: 'oauth42',\n    name: 'OAuth42',\n    type: 'oauth',\n    version: '2.0',\n    \n    // Use OIDC discovery to automatically find endpoints\n    wellKnown: `${baseUrl}/.well-known/openid-configuration`,\n    \n    // Also set individual endpoints for compatibility\n    authorization: {\n      url: `${baseUrl}/oauth2/authorize`,\n      params: {\n        scope: (options.scopes || ['openid', 'profile', 'email']).join(' '),\n        response_type: 'code',\n      },\n    },\n    token: `${baseUrl}/oauth2/token`,\n    userinfo: `${baseUrl}/oauth2/userinfo`,\n    \n    client: {\n      id: options.clientId,\n      secret: options.clientSecret,\n      token_endpoint_auth_method: 'client_secret_post',\n      id_token_signed_response_alg: 'HS256', // OAuth42 uses HS256 for ID tokens\n    },\n    \n    issuer: baseUrl,\n    \n    checks: options.pkceEnabled !== false ? ['pkce', 'state'] : ['state'],\n    \n    profile(profile: OAuth42Profile, tokens: any) {\n      return {\n        id: profile.sub || profile.id || profile.email,\n        email: profile.email,\n        emailVerified: profile.email_verified ? new Date() : null,\n        name: profile.name || `${profile.given_name || ''} ${profile.family_name || ''}`.trim(),\n        image: profile.picture,\n      };\n    },\n    \n    style: {\n      logo: '/oauth42-logo.svg',\n      bg: '#1e40af',\n      text: '#ffffff',\n    },\n    \n    options,\n  };\n}","import NextAuthDefault from 'next-auth';\nimport type { NextAuthOptions } from 'next-auth';\nimport { OAuth42Provider, OAuth42Profile } from '../provider';\nimport { getOAuth42Session } from './session';\n\n// Handle both CommonJS and ESM exports\nconst NextAuth = (NextAuthDefault as any).default || NextAuthDefault;\n\nexport { type NextAuthOptions };\n\nexport interface CreateAuthOptions {\n  clientId?: string;\n  clientSecret?: string;\n  issuer?: string;\n  scopes?: string[];\n  pkceEnabled?: boolean;\n  debug?: boolean;\n  callbacks?: NextAuthOptions['callbacks'];\n  pages?: NextAuthOptions['pages'];\n  session?: NextAuthOptions['session'];\n}\n\n/**\n * Create a pre-configured NextAuth instance for OAuth42\n * This provides a simplified setup with sensible defaults\n */\nexport function createAuth(options: CreateAuthOptions = {}) {\n  const clientId = options.clientId || process.env.OAUTH42_CLIENT_ID;\n  const clientSecret = options.clientSecret || process.env.OAUTH42_CLIENT_SECRET;\n  \n  if (!clientId || !clientSecret) {\n    throw new Error(\n      'OAuth42 client credentials are required. ' +\n      'Set OAUTH42_CLIENT_ID and OAUTH42_CLIENT_SECRET environment variables ' +\n      'or pass them in the options.'\n    );\n  }\n  \n  const authOptions: NextAuthOptions = {\n    providers: [\n      OAuth42Provider({\n        clientId,\n        clientSecret,\n        issuer: options.issuer,\n        scopes: options.scopes,\n        pkceEnabled: options.pkceEnabled,\n      }),\n    ],\n    \n    callbacks: {\n      async jwt({ token, account, profile }) {\n        // Store OAuth tokens in the JWT\n        if (account) {\n          token.accessToken = account.access_token;\n          token.refreshToken = account.refresh_token;\n          token.expiresAt = account.expires_at;\n          token.idToken = account.id_token;\n        }\n        \n        // Add user profile data\n        if (profile) {\n          const oauth42Profile = profile as OAuth42Profile;\n          token.email = oauth42Profile.email;\n          token.username = oauth42Profile.username;\n          token.emailVerified = oauth42Profile.email_verified;\n        }\n        \n        // Call custom callback if provided\n        if (options.callbacks?.jwt) {\n          return options.callbacks.jwt({ token, account, profile } as any);\n        }\n        \n        return token;\n      },\n      \n      async session({ session, token }) {\n        // Add OAuth42-specific data to session\n        session.accessToken = token.accessToken as string;\n        session.idToken = token.idToken as string;\n\n        if (session.user) {\n          session.user.email = token.email as string;\n          session.user.name = token.name as string;\n          session.user.username = token.username as string;\n          session.user.emailVerified = token.emailVerified as boolean;\n        }\n\n        // Call custom callback if provided\n        if (options.callbacks?.session) {\n          return options.callbacks.session({ session, token } as any);\n        }\n\n        return session;\n      },\n      \n      ...options.callbacks,\n    },\n    \n    pages: {\n      signIn: '/auth/signin',\n      signOut: '/auth/signout',\n      error: '/auth/error',\n      ...options.pages,\n    },\n    \n    session: {\n      strategy: 'jwt',\n      ...options.session,\n    },\n    \n    debug: options.debug || process.env.NODE_ENV === 'development',\n    \n    secret: process.env.NEXTAUTH_SECRET,\n  };\n  \n  // Return the configuration and a function to create handlers\n  return {\n    auth: authOptions,\n    handlers: NextAuth(authOptions),\n  };\n}\n\n/**\n * Create NextAuth handlers for API routes\n */\nexport function createHandlers(authOptions: NextAuthOptions) {\n  const handler = NextAuth(authOptions);\n  return { GET: handler, POST: handler };\n}\n\n/**\n * Helper to get the current session server-side\n * @deprecated Use getOAuth42Session instead - this is now just an alias for backward compatibility\n * \n * This function is maintained for backward compatibility but internally\n * calls getOAuth42Session which properly handles both App Router and Pages Router\n */\nexport const getServerSession = getOAuth42Session;\n\n/**\n * Token refresh helper\n */\nexport async function refreshAccessToken(token: any, clientId: string, clientSecret: string, issuer?: string) {\n  try {\n    const baseUrl = issuer || process.env.OAUTH42_ISSUER || 'https://oauth42.com';\n    const tokenUrl = `${baseUrl}/oauth2/token`;\n    \n    // In development, we need to handle self-signed certificates\n    const fetchOptions: any = {\n      method: 'POST',\n      headers: {\n        'Content-Type': 'application/x-www-form-urlencoded',\n      },\n      body: new URLSearchParams({\n        grant_type: 'refresh_token',\n        refresh_token: token.refreshToken,\n        client_id: clientId,\n        client_secret: clientSecret,\n      }),\n    };\n    \n    // Add agent for self-signed certificates in development\n    if (process.env.NODE_ENV !== 'production' && tokenUrl.startsWith('https://')) {\n      const https = await import('https');\n      fetchOptions.agent = new https.Agent({\n        rejectUnauthorized: false\n      });\n    }\n    \n    const response = await fetch(tokenUrl, fetchOptions);\n    const refreshedTokens = await response.json();\n    \n    if (!response.ok) {\n      throw refreshedTokens;\n    }\n    \n    return {\n      ...token,\n      accessToken: refreshedTokens.access_token,\n      refreshToken: refreshedTokens.refresh_token ?? token.refreshToken,\n      // Store expiration time in seconds (Unix timestamp)\n      expiresAt: Math.floor(Date.now() / 1000) + (refreshedTokens.expires_in || 3600),\n      // Explicitly remove any error property on successful refresh\n      error: undefined,\n    };\n  } catch (error) {\n    console.error('Failed to refresh access token:', error);\n    return {\n      ...token,\n      error: 'RefreshAccessTokenError',\n    };\n  }\n}","import { getServerSession as getNextAuthSession } from 'next-auth';\nimport { NextAuthOptions } from 'next-auth';\nimport { GetServerSidePropsContext, NextApiRequest, NextApiResponse } from 'next';\n\n/**\n * Get the OAuth42 session server-side\n * \n * This is the primary method for retrieving sessions in OAuth42 SDK.\n * Supports both Pages Router and App Router:\n * \n * App Router:\n * ```ts\n * const session = await getOAuth42Session(authOptions);\n * ```\n * \n * Pages Router:\n * ```ts\n * const session = await getOAuth42Session(req, res, authOptions);\n * ```\n */\nexport async function getOAuth42Session(\n  ...args: \n    | [GetServerSidePropsContext['req'], GetServerSidePropsContext['res'], NextAuthOptions]\n    | [NextApiRequest, NextApiResponse, NextAuthOptions]\n    | [NextAuthOptions]\n) {\n  return getNextAuthSession(...args as any);\n}\n\n/**\n * Helper for protecting API routes\n */\nexport function withOAuth42Session(\n  handler: (req: NextApiRequest, res: NextApiResponse, session: any) => Promise<void> | void,\n  authOptions: NextAuthOptions\n) {\n  return async (req: NextApiRequest, res: NextApiResponse) => {\n    const session = await getOAuth42Session(req, res, authOptions);\n    \n    if (!session) {\n      return res.status(401).json({ error: 'Unauthorized' });\n    }\n    \n    return handler(req, res, session);\n  };\n}\n\n/**\n * Helper for protecting server-side props\n */\nexport function withOAuth42ServerSideProps(\n  getServerSideProps: (\n    context: GetServerSidePropsContext,\n    session: any\n  ) => Promise<any>,\n  authOptions: NextAuthOptions\n) {\n  return async (context: GetServerSidePropsContext) => {\n    const session = await getOAuth42Session(\n      context.req,\n      context.res,\n      authOptions\n    );\n    \n    if (!session) {\n      return {\n        redirect: {\n          destination: '/auth/signin',\n          permanent: false,\n        },\n      };\n    }\n    \n    return getServerSideProps(context, session);\n  };\n}","import { NextRequest, NextResponse } from 'next/server';\nimport { getToken } from 'next-auth/jwt';\n\nexport interface OAuth42AuthOptions {\n  pages?: {\n    signIn?: string;\n    error?: string;\n  };\n  callbacks?: {\n    authorized?: (params: { token: any; req: NextRequest }) => boolean | Promise<boolean>;\n  };\n  protectedPaths?: string[];\n  publicPaths?: string[];\n}\n\n/**\n * Middleware helper for protecting routes with OAuth42\n */\nexport function withOAuth42Auth(options: OAuth42AuthOptions = {}) {\n  return async function middleware(req: NextRequest) {\n    const token = await getToken({ \n      req: req as any, \n      secret: process.env.NEXTAUTH_SECRET \n    });\n    \n    const pathname = req.nextUrl.pathname;\n    \n    // Check if path is explicitly public\n    if (options.publicPaths?.some(path => pathname.startsWith(path))) {\n      return NextResponse.next();\n    }\n    \n    // Check if path needs protection\n    const needsProtection = options.protectedPaths\n      ? options.protectedPaths.some(path => pathname.startsWith(path))\n      : true; // Default to protecting all paths\n    \n    if (!needsProtection) {\n      return NextResponse.next();\n    }\n    \n    // Check authorization\n    let isAuthorized = !!token;\n    \n    if (options.callbacks?.authorized) {\n      isAuthorized = await options.callbacks.authorized({ token, req });\n    }\n    \n    if (!isAuthorized) {\n      const signInUrl = options.pages?.signIn || '/auth/signin';\n      const url = new URL(signInUrl, req.url);\n      url.searchParams.set('callbackUrl', pathname);\n      return NextResponse.redirect(url);\n    }\n    \n    return NextResponse.next();\n  };\n}\n\n/**\n * Helper to create middleware configuration\n */\nexport function createMiddlewareConfig(\n  protectedPaths: string[] = ['/protected'],\n  publicPaths: string[] = ['/auth', '/api/auth']\n) {\n  return {\n    matcher: [\n      /*\n       * Match all request paths except for the ones starting with:\n       * - _next/static (static files)\n       * - _next/image (image optimization files)\n       * - favicon.ico (favicon file)\n       * - public folder\n       */\n      '/((?!_next/static|_next/image|favicon.ico|public).*)',\n    ],\n    protectedPaths,\n    publicPaths,\n  };\n}"],"mappings":";AAyBO,SAAS,gBACd,SACgB;AAChB,QAAM,SAAS,QAAQ,UAAU,QAAQ,IAAI,kBAAkB;AAC/D,QAAM,UAAU,OAAO,QAAQ,OAAO,EAAE;AAExC,SAAO;AAAA,IACL,IAAI;AAAA,IACJ,MAAM;AAAA,IACN,MAAM;AAAA,IACN,SAAS;AAAA;AAAA,IAGT,WAAW,GAAG,OAAO;AAAA;AAAA,IAGrB,eAAe;AAAA,MACb,KAAK,GAAG,OAAO;AAAA,MACf,QAAQ;AAAA,QACN,QAAQ,QAAQ,UAAU,CAAC,UAAU,WAAW,OAAO,GAAG,KAAK,GAAG;AAAA,QAClE,eAAe;AAAA,MACjB;AAAA,IACF;AAAA,IACA,OAAO,GAAG,OAAO;AAAA,IACjB,UAAU,GAAG,OAAO;AAAA,IAEpB,QAAQ;AAAA,MACN,IAAI,QAAQ;AAAA,MACZ,QAAQ,QAAQ;AAAA,MAChB,4BAA4B;AAAA,MAC5B,8BAA8B;AAAA;AAAA,IAChC;AAAA,IAEA,QAAQ;AAAA,IAER,QAAQ,QAAQ,gBAAgB,QAAQ,CAAC,QAAQ,OAAO,IAAI,CAAC,OAAO;AAAA,IAEpE,QAAQ,SAAyB,QAAa;AAC5C,aAAO;AAAA,QACL,IAAI,QAAQ,OAAO,QAAQ,MAAM,QAAQ;AAAA,QACzC,OAAO,QAAQ;AAAA,QACf,eAAe,QAAQ,iBAAiB,oBAAI,KAAK,IAAI;AAAA,QACrD,MAAM,QAAQ,QAAQ,GAAG,QAAQ,cAAc,EAAE,IAAI,QAAQ,eAAe,EAAE,GAAG,KAAK;AAAA,QACtF,OAAO,QAAQ;AAAA,MACjB;AAAA,IACF;AAAA,IAEA,OAAO;AAAA,MACL,MAAM;AAAA,MACN,IAAI;AAAA,MACJ,MAAM;AAAA,IACR;AAAA,IAEA;AAAA,EACF;AACF;;;AChFA,OAAO,qBAAqB;;;ACA5B,SAAS,oBAAoB,0BAA0B;AAoBvD,eAAsB,qBACjB,MAIH;AACA,SAAO,mBAAmB,GAAG,IAAW;AAC1C;AAKO,SAAS,mBACd,SACA,aACA;AACA,SAAO,OAAO,KAAqB,QAAyB;AAC1D,UAAM,UAAU,MAAM,kBAAkB,KAAK,KAAK,WAAW;AAE7D,QAAI,CAAC,SAAS;AACZ,aAAO,IAAI,OAAO,GAAG,EAAE,KAAK,EAAE,OAAO,eAAe,CAAC;AAAA,IACvD;AAEA,WAAO,QAAQ,KAAK,KAAK,OAAO;AAAA,EAClC;AACF;AAKO,SAAS,2BACd,oBAIA,aACA;AACA,SAAO,OAAO,YAAuC;AACnD,UAAM,UAAU,MAAM;AAAA,MACpB,QAAQ;AAAA,MACR,QAAQ;AAAA,MACR;AAAA,IACF;AAEA,QAAI,CAAC,SAAS;AACZ,aAAO;AAAA,QACL,UAAU;AAAA,UACR,aAAa;AAAA,UACb,WAAW;AAAA,QACb;AAAA,MACF;AAAA,IACF;AAEA,WAAO,mBAAmB,SAAS,OAAO;AAAA,EAC5C;AACF;;;ADrEA,IAAM,WAAY,gBAAwB,WAAW;AAoB9C,SAAS,WAAW,UAA6B,CAAC,GAAG;AAC1D,QAAM,WAAW,QAAQ,YAAY,QAAQ,IAAI;AACjD,QAAM,eAAe,QAAQ,gBAAgB,QAAQ,IAAI;AAEzD,MAAI,CAAC,YAAY,CAAC,cAAc;AAC9B,UAAM,IAAI;AAAA,MACR;AAAA,IAGF;AAAA,EACF;AAEA,QAAM,cAA+B;AAAA,IACnC,WAAW;AAAA,MACT,gBAAgB;AAAA,QACd;AAAA,QACA;AAAA,QACA,QAAQ,QAAQ;AAAA,QAChB,QAAQ,QAAQ;AAAA,QAChB,aAAa,QAAQ;AAAA,MACvB,CAAC;AAAA,IACH;AAAA,IAEA,WAAW;AAAA,MACT,MAAM,IAAI,EAAE,OAAO,SAAS,QAAQ,GAAG;AAErC,YAAI,SAAS;AACX,gBAAM,cAAc,QAAQ;AAC5B,gBAAM,eAAe,QAAQ;AAC7B,gBAAM,YAAY,QAAQ;AAC1B,gBAAM,UAAU,QAAQ;AAAA,QAC1B;AAGA,YAAI,SAAS;AACX,gBAAM,iBAAiB;AACvB,gBAAM,QAAQ,eAAe;AAC7B,gBAAM,WAAW,eAAe;AAChC,gBAAM,gBAAgB,eAAe;AAAA,QACvC;AAGA,YAAI,QAAQ,WAAW,KAAK;AAC1B,iBAAO,QAAQ,UAAU,IAAI,EAAE,OAAO,SAAS,QAAQ,CAAQ;AAAA,QACjE;AAEA,eAAO;AAAA,MACT;AAAA,MAEA,MAAM,QAAQ,EAAE,SAAS,MAAM,GAAG;AAEhC,gBAAQ,cAAc,MAAM;AAC5B,gBAAQ,UAAU,MAAM;AAExB,YAAI,QAAQ,MAAM;AAChB,kBAAQ,KAAK,QAAQ,MAAM;AAC3B,kBAAQ,KAAK,OAAO,MAAM;AAC1B,kBAAQ,KAAK,WAAW,MAAM;AAC9B,kBAAQ,KAAK,gBAAgB,MAAM;AAAA,QACrC;AAGA,YAAI,QAAQ,WAAW,SAAS;AAC9B,iBAAO,QAAQ,UAAU,QAAQ,EAAE,SAAS,MAAM,CAAQ;AAAA,QAC5D;AAEA,eAAO;AAAA,MACT;AAAA,MAEA,GAAG,QAAQ;AAAA,IACb;AAAA,IAEA,OAAO;AAAA,MACL,QAAQ;AAAA,MACR,SAAS;AAAA,MACT,OAAO;AAAA,MACP,GAAG,QAAQ;AAAA,IACb;AAAA,IAEA,SAAS;AAAA,MACP,UAAU;AAAA,MACV,GAAG,QAAQ;AAAA,IACb;AAAA,IAEA,OAAO,QAAQ,SAAS,QAAQ,IAAI,aAAa;AAAA,IAEjD,QAAQ,QAAQ,IAAI;AAAA,EACtB;AAGA,SAAO;AAAA,IACL,MAAM;AAAA,IACN,UAAU,SAAS,WAAW;AAAA,EAChC;AACF;AAiBO,IAAM,mBAAmB;AAKhC,eAAsB,mBAAmB,OAAY,UAAkB,cAAsB,QAAiB;AAC5G,MAAI;AACF,UAAM,UAAU,UAAU,QAAQ,IAAI,kBAAkB;AACxD,UAAM,WAAW,GAAG,OAAO;AAG3B,UAAM,eAAoB;AAAA,MACxB,QAAQ;AAAA,MACR,SAAS;AAAA,QACP,gBAAgB;AAAA,MAClB;AAAA,MACA,MAAM,IAAI,gBAAgB;AAAA,QACxB,YAAY;AAAA,QACZ,eAAe,MAAM;AAAA,QACrB,WAAW;AAAA,QACX,eAAe;AAAA,MACjB,CAAC;AAAA,IACH;AAGA,QAAI,QAAQ,IAAI,aAAa,gBAAgB,SAAS,WAAW,UAAU,GAAG;AAC5E,YAAM,QAAQ,MAAM,OAAO,OAAO;AAClC,mBAAa,QAAQ,IAAI,MAAM,MAAM;AAAA,QACnC,oBAAoB;AAAA,MACtB,CAAC;AAAA,IACH;AAEA,UAAM,WAAW,MAAM,MAAM,UAAU,YAAY;AACnD,UAAM,kBAAkB,MAAM,SAAS,KAAK;AAE5C,QAAI,CAAC,SAAS,IAAI;AAChB,YAAM;AAAA,IACR;AAEA,WAAO;AAAA,MACL,GAAG;AAAA,MACH,aAAa,gBAAgB;AAAA,MAC7B,cAAc,gBAAgB,iBAAiB,MAAM;AAAA;AAAA,MAErD,WAAW,KAAK,MAAM,KAAK,IAAI,IAAI,GAAI,KAAK,gBAAgB,cAAc;AAAA;AAAA,MAE1E,OAAO;AAAA,IACT;AAAA,EACF,SAAS,OAAO;AACd,YAAQ,MAAM,mCAAmC,KAAK;AACtD,WAAO;AAAA,MACL,GAAG;AAAA,MACH,OAAO;AAAA,IACT;AAAA,EACF;AACF;;;AEhMA,SAAsB,oBAAoB;AAC1C,SAAS,gBAAgB;AAiBlB,SAAS,gBAAgB,UAA8B,CAAC,GAAG;AAChE,SAAO,eAAe,WAAW,KAAkB;AACjD,UAAM,QAAQ,MAAM,SAAS;AAAA,MAC3B;AAAA,MACA,QAAQ,QAAQ,IAAI;AAAA,IACtB,CAAC;AAED,UAAM,WAAW,IAAI,QAAQ;AAG7B,QAAI,QAAQ,aAAa,KAAK,UAAQ,SAAS,WAAW,IAAI,CAAC,GAAG;AAChE,aAAO,aAAa,KAAK;AAAA,IAC3B;AAGA,UAAM,kBAAkB,QAAQ,iBAC5B,QAAQ,eAAe,KAAK,UAAQ,SAAS,WAAW,IAAI,CAAC,IAC7D;AAEJ,QAAI,CAAC,iBAAiB;AACpB,aAAO,aAAa,KAAK;AAAA,IAC3B;AAGA,QAAI,eAAe,CAAC,CAAC;AAErB,QAAI,QAAQ,WAAW,YAAY;AACjC,qBAAe,MAAM,QAAQ,UAAU,WAAW,EAAE,OAAO,IAAI,CAAC;AAAA,IAClE;AAEA,QAAI,CAAC,cAAc;AACjB,YAAM,YAAY,QAAQ,OAAO,UAAU;AAC3C,YAAM,MAAM,IAAI,IAAI,WAAW,IAAI,GAAG;AACtC,UAAI,aAAa,IAAI,eAAe,QAAQ;AAC5C,aAAO,aAAa,SAAS,GAAG;AAAA,IAClC;AAEA,WAAO,aAAa,KAAK;AAAA,EAC3B;AACF;AAKO,SAAS,uBACd,iBAA2B,CAAC,YAAY,GACxC,cAAwB,CAAC,SAAS,WAAW,GAC7C;AACA,SAAO;AAAA,IACL,SAAS;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA,MAQP;AAAA,IACF;AAAA,IACA;AAAA,IACA;AAAA,EACF;AACF;","names":[]}

package/dist/server/index.js

@@ -173,6 +173,7 @@ function createAuth(options = {}) {
         session.idToken = token.idToken;
         if (session.user) {
           session.user.email = token.email;
+          session.user.name = token.name;
           session.user.username = token.username;
           session.user.emailVerified = token.emailVerified;
         }

package/dist/server/index.js.map

@@ -1 +1 @@
-{"version":3,"sources":["../../src/server/index.ts","../../src/server/auth.ts","../../src/provider.ts","../../src/server/session.ts","../../src/server/middleware.ts","../../src/server/hosted-auth-callback.ts"],"sourcesContent":["// Server-side exports\nexport { createAuth, createHandlers, getServerSession, refreshAccessToken } from './auth';\nexport type { CreateAuthOptions, NextAuthOptions } from './auth';\n\n// Re-export NextAuth from next-auth\nexport { default as NextAuth } from 'next-auth';\n\n// Re-export OAuth42Provider\nexport { OAuth42Provider } from '../provider';\n\nexport { withOAuth42Auth, createMiddlewareConfig } from './middleware';\nexport type { OAuth42AuthOptions } from './middleware';\n\nexport { getOAuth42Session, withOAuth42Session, withOAuth42ServerSideProps } from './session';\n\n// Hosted auth callback handler\nexport { createHostedAuthCallback } from './hosted-auth-callback';\nexport type { HostedAuthCallbackOptions } from './hosted-auth-callback';","import NextAuthDefault from 'next-auth';\nimport type { NextAuthOptions } from 'next-auth';\nimport { OAuth42Provider, OAuth42Profile } from '../provider';\nimport { getOAuth42Session } from './session';\n\n// Handle both CommonJS and ESM exports\nconst NextAuth = (NextAuthDefault as any).default || NextAuthDefault;\n\nexport { type NextAuthOptions };\n\nexport interface CreateAuthOptions {\n  clientId?: string;\n  clientSecret?: string;\n  issuer?: string;\n  scopes?: string[];\n  pkceEnabled?: boolean;\n  debug?: boolean;\n  callbacks?: NextAuthOptions['callbacks'];\n  pages?: NextAuthOptions['pages'];\n  session?: NextAuthOptions['session'];\n}\n\n/**\n * Create a pre-configured NextAuth instance for OAuth42\n * This provides a simplified setup with sensible defaults\n */\nexport function createAuth(options: CreateAuthOptions = {}) {\n  const clientId = options.clientId || process.env.OAUTH42_CLIENT_ID;\n  const clientSecret = options.clientSecret || process.env.OAUTH42_CLIENT_SECRET;\n  \n  if (!clientId || !clientSecret) {\n    throw new Error(\n      'OAuth42 client credentials are required. ' +\n      'Set OAUTH42_CLIENT_ID and OAUTH42_CLIENT_SECRET environment variables ' +\n      'or pass them in the options.'\n    );\n  }\n  \n  const authOptions: NextAuthOptions = {\n    providers: [\n      OAuth42Provider({\n        clientId,\n        clientSecret,\n        issuer: options.issuer,\n        scopes: options.scopes,\n        pkceEnabled: options.pkceEnabled,\n      }),\n    ],\n    \n    callbacks: {\n      async jwt({ token, account, profile }) {\n        // Store OAuth tokens in the JWT\n        if (account) {\n          token.accessToken = account.access_token;\n          token.refreshToken = account.refresh_token;\n          token.expiresAt = account.expires_at;\n          token.idToken = account.id_token;\n        }\n        \n        // Add user profile data\n        if (profile) {\n          const oauth42Profile = profile as OAuth42Profile;\n          token.email = oauth42Profile.email;\n          token.username = oauth42Profile.username;\n          token.emailVerified = oauth42Profile.email_verified;\n        }\n        \n        // Call custom callback if provided\n        if (options.callbacks?.jwt) {\n          return options.callbacks.jwt({ token, account, profile } as any);\n        }\n        \n        return token;\n      },\n      \n      async session({ session, token }) {\n        // Add OAuth42-specific data to session\n        session.accessToken = token.accessToken as string;\n        session.idToken = token.idToken as string;\n        \n        if (session.user) {\n          session.user.email = token.email as string;\n          session.user.username = token.username as string;\n          session.user.emailVerified = token.emailVerified as boolean;\n        }\n        \n        // Call custom callback if provided\n        if (options.callbacks?.session) {\n          return options.callbacks.session({ session, token } as any);\n        }\n        \n        return session;\n      },\n      \n      ...options.callbacks,\n    },\n    \n    pages: {\n      signIn: '/auth/signin',\n      signOut: '/auth/signout',\n      error: '/auth/error',\n      ...options.pages,\n    },\n    \n    session: {\n      strategy: 'jwt',\n      ...options.session,\n    },\n    \n    debug: options.debug || process.env.NODE_ENV === 'development',\n    \n    secret: process.env.NEXTAUTH_SECRET,\n  };\n  \n  // Return the configuration and a function to create handlers\n  return {\n    auth: authOptions,\n    handlers: NextAuth(authOptions),\n  };\n}\n\n/**\n * Create NextAuth handlers for API routes\n */\nexport function createHandlers(authOptions: NextAuthOptions) {\n  const handler = NextAuth(authOptions);\n  return { GET: handler, POST: handler };\n}\n\n/**\n * Helper to get the current session server-side\n * @deprecated Use getOAuth42Session instead - this is now just an alias for backward compatibility\n * \n * This function is maintained for backward compatibility but internally\n * calls getOAuth42Session which properly handles both App Router and Pages Router\n */\nexport const getServerSession = getOAuth42Session;\n\n/**\n * Token refresh helper\n */\nexport async function refreshAccessToken(token: any, clientId: string, clientSecret: string, issuer?: string) {\n  try {\n    const baseUrl = issuer || process.env.OAUTH42_ISSUER || 'https://oauth42.com';\n    const tokenUrl = `${baseUrl}/oauth2/token`;\n    \n    // In development, we need to handle self-signed certificates\n    const fetchOptions: any = {\n      method: 'POST',\n      headers: {\n        'Content-Type': 'application/x-www-form-urlencoded',\n      },\n      body: new URLSearchParams({\n        grant_type: 'refresh_token',\n        refresh_token: token.refreshToken,\n        client_id: clientId,\n        client_secret: clientSecret,\n      }),\n    };\n    \n    // Add agent for self-signed certificates in development\n    if (process.env.NODE_ENV !== 'production' && tokenUrl.startsWith('https://')) {\n      const https = await import('https');\n      fetchOptions.agent = new https.Agent({\n        rejectUnauthorized: false\n      });\n    }\n    \n    const response = await fetch(tokenUrl, fetchOptions);\n    const refreshedTokens = await response.json();\n    \n    if (!response.ok) {\n      throw refreshedTokens;\n    }\n    \n    return {\n      ...token,\n      accessToken: refreshedTokens.access_token,\n      refreshToken: refreshedTokens.refresh_token ?? token.refreshToken,\n      // Store expiration time in seconds (Unix timestamp)\n      expiresAt: Math.floor(Date.now() / 1000) + (refreshedTokens.expires_in || 3600),\n      // Explicitly remove any error property on successful refresh\n      error: undefined,\n    };\n  } catch (error) {\n    console.error('Failed to refresh access token:', error);\n    return {\n      ...token,\n      error: 'RefreshAccessTokenError',\n    };\n  }\n}","import type { OAuthConfig, OAuthUserConfig } from 'next-auth/providers/oauth';\n\nexport interface OAuth42Profile {\n  sub: string;\n  email: string;\n  email_verified?: boolean;\n  name?: string;\n  given_name?: string;\n  family_name?: string;\n  picture?: string;\n  username?: string;\n  id?: string;\n}\n\nexport interface OAuth42ProviderOptions {\n  clientId: string;\n  clientSecret: string;\n  issuer?: string;\n  authorizationUrl?: string;\n  tokenUrl?: string;\n  userinfoUrl?: string;\n  scopes?: string[];\n  pkceEnabled?: boolean;\n}\n\nexport function OAuth42Provider<P extends OAuth42Profile>(\n  options: OAuthUserConfig<P> & Partial<OAuth42ProviderOptions>\n): OAuthConfig<P> {\n  const issuer = options.issuer || process.env.OAUTH42_ISSUER || 'https://oauth42.com';\n  const baseUrl = issuer.replace(/\\/$/, '');\n  \n  return {\n    id: 'oauth42',\n    name: 'OAuth42',\n    type: 'oauth',\n    version: '2.0',\n    \n    // Use OIDC discovery to automatically find endpoints\n    wellKnown: `${baseUrl}/.well-known/openid-configuration`,\n    \n    // Also set individual endpoints for compatibility\n    authorization: {\n      url: `${baseUrl}/oauth2/authorize`,\n      params: {\n        scope: (options.scopes || ['openid', 'profile', 'email']).join(' '),\n        response_type: 'code',\n      },\n    },\n    token: `${baseUrl}/oauth2/token`,\n    userinfo: `${baseUrl}/oauth2/userinfo`,\n    \n    client: {\n      id: options.clientId,\n      secret: options.clientSecret,\n      token_endpoint_auth_method: 'client_secret_post',\n      id_token_signed_response_alg: 'HS256', // OAuth42 uses HS256 for ID tokens\n    },\n    \n    issuer: baseUrl,\n    \n    checks: options.pkceEnabled !== false ? ['pkce', 'state'] : ['state'],\n    \n    profile(profile: OAuth42Profile, tokens: any) {\n      return {\n        id: profile.sub || profile.id || profile.email,\n        email: profile.email,\n        emailVerified: profile.email_verified ? new Date() : null,\n        name: profile.name || `${profile.given_name || ''} ${profile.family_name || ''}`.trim(),\n        image: profile.picture,\n      };\n    },\n    \n    style: {\n      logo: '/oauth42-logo.svg',\n      bg: '#1e40af',\n      text: '#ffffff',\n    },\n    \n    options,\n  };\n}","import { getServerSession as getNextAuthSession } from 'next-auth';\nimport { NextAuthOptions } from 'next-auth';\nimport { GetServerSidePropsContext, NextApiRequest, NextApiResponse } from 'next';\n\n/**\n * Get the OAuth42 session server-side\n * \n * This is the primary method for retrieving sessions in OAuth42 SDK.\n * Supports both Pages Router and App Router:\n * \n * App Router:\n * ```ts\n * const session = await getOAuth42Session(authOptions);\n * ```\n * \n * Pages Router:\n * ```ts\n * const session = await getOAuth42Session(req, res, authOptions);\n * ```\n */\nexport async function getOAuth42Session(\n  ...args: \n    | [GetServerSidePropsContext['req'], GetServerSidePropsContext['res'], NextAuthOptions]\n    | [NextApiRequest, NextApiResponse, NextAuthOptions]\n    | [NextAuthOptions]\n) {\n  return getNextAuthSession(...args as any);\n}\n\n/**\n * Helper for protecting API routes\n */\nexport function withOAuth42Session(\n  handler: (req: NextApiRequest, res: NextApiResponse, session: any) => Promise<void> | void,\n  authOptions: NextAuthOptions\n) {\n  return async (req: NextApiRequest, res: NextApiResponse) => {\n    const session = await getOAuth42Session(req, res, authOptions);\n    \n    if (!session) {\n      return res.status(401).json({ error: 'Unauthorized' });\n    }\n    \n    return handler(req, res, session);\n  };\n}\n\n/**\n * Helper for protecting server-side props\n */\nexport function withOAuth42ServerSideProps(\n  getServerSideProps: (\n    context: GetServerSidePropsContext,\n    session: any\n  ) => Promise<any>,\n  authOptions: NextAuthOptions\n) {\n  return async (context: GetServerSidePropsContext) => {\n    const session = await getOAuth42Session(\n      context.req,\n      context.res,\n      authOptions\n    );\n    \n    if (!session) {\n      return {\n        redirect: {\n          destination: '/auth/signin',\n          permanent: false,\n        },\n      };\n    }\n    \n    return getServerSideProps(context, session);\n  };\n}","import { NextRequest, NextResponse } from 'next/server';\nimport { getToken } from 'next-auth/jwt';\n\nexport interface OAuth42AuthOptions {\n  pages?: {\n    signIn?: string;\n    error?: string;\n  };\n  callbacks?: {\n    authorized?: (params: { token: any; req: NextRequest }) => boolean | Promise<boolean>;\n  };\n  protectedPaths?: string[];\n  publicPaths?: string[];\n}\n\n/**\n * Middleware helper for protecting routes with OAuth42\n */\nexport function withOAuth42Auth(options: OAuth42AuthOptions = {}) {\n  return async function middleware(req: NextRequest) {\n    const token = await getToken({ \n      req: req as any, \n      secret: process.env.NEXTAUTH_SECRET \n    });\n    \n    const pathname = req.nextUrl.pathname;\n    \n    // Check if path is explicitly public\n    if (options.publicPaths?.some(path => pathname.startsWith(path))) {\n      return NextResponse.next();\n    }\n    \n    // Check if path needs protection\n    const needsProtection = options.protectedPaths\n      ? options.protectedPaths.some(path => pathname.startsWith(path))\n      : true; // Default to protecting all paths\n    \n    if (!needsProtection) {\n      return NextResponse.next();\n    }\n    \n    // Check authorization\n    let isAuthorized = !!token;\n    \n    if (options.callbacks?.authorized) {\n      isAuthorized = await options.callbacks.authorized({ token, req });\n    }\n    \n    if (!isAuthorized) {\n      const signInUrl = options.pages?.signIn || '/auth/signin';\n      const url = new URL(signInUrl, req.url);\n      url.searchParams.set('callbackUrl', pathname);\n      return NextResponse.redirect(url);\n    }\n    \n    return NextResponse.next();\n  };\n}\n\n/**\n * Helper to create middleware configuration\n */\nexport function createMiddlewareConfig(\n  protectedPaths: string[] = ['/protected'],\n  publicPaths: string[] = ['/auth', '/api/auth']\n) {\n  return {\n    matcher: [\n      /*\n       * Match all request paths except for the ones starting with:\n       * - _next/static (static files)\n       * - _next/image (image optimization files)\n       * - favicon.ico (favicon file)\n       * - public folder\n       */\n      '/((?!_next/static|_next/image|favicon.ico|public).*)',\n    ],\n    protectedPaths,\n    publicPaths,\n  };\n}","import { NextRequest, NextResponse } from 'next/server';\nimport https from 'https';\nimport { encode } from 'next-auth/jwt';\n\nexport interface HostedAuthCallbackOptions {\n  /**\n   * OAuth42 issuer URL (e.g., 'https://api.oauth42.com' or 'https://localhost:8443')\n   */\n  issuer?: string;\n\n  /**\n   * OAuth2 client ID\n   */\n  clientId?: string;\n\n  /**\n   * OAuth2 client secret\n   */\n  clientSecret?: string;\n\n  /**\n   * Application base URL (e.g., 'http://localhost:3000')\n   */\n  baseUrl?: string;\n\n  /**\n   * NextAuth secret for JWT encoding\n   */\n  nextAuthSecret?: string;\n\n  /**\n   * URL to redirect to after successful authentication\n   * @default '/dashboard'\n   */\n  redirectUrl?: string;\n\n  /**\n   * URL to redirect to on error\n   * @default '/'\n   */\n  errorUrl?: string;\n}\n\n/**\n * Creates a handler for OAuth42 hosted auth callback that integrates with NextAuth.\n *\n * This function handles the OAuth callback, exchanges the authorization code for tokens,\n * fetches user info, and creates a NextAuth-compatible session cookie.\n *\n * @example\n * ```typescript\n * // app/api/oauth/callback/route.ts\n * import { createHostedAuthCallback } from '@oauth42/next/server';\n *\n * export const GET = createHostedAuthCallback({\n *   redirectUrl: '/dashboard',\n * });\n * ```\n */\nexport function createHostedAuthCallback(options: HostedAuthCallbackOptions = {}) {\n  return async function GET(request: NextRequest) {\n    const {\n      issuer = process.env.OAUTH42_ISSUER || 'https://api.oauth42.com',\n      clientId = process.env.OAUTH42_CLIENT_ID,\n      clientSecret = process.env.OAUTH42_CLIENT_SECRET,\n      baseUrl = process.env.NEXTAUTH_URL,\n      nextAuthSecret = process.env.NEXTAUTH_SECRET,\n      redirectUrl = '/dashboard',\n      errorUrl = '/',\n    } = options;\n\n    if (!clientId || !clientSecret) {\n      console.error('OAuth42 client credentials are required');\n      return NextResponse.redirect(new URL(`${errorUrl}?error=missing_credentials`, request.url));\n    }\n\n    if (!nextAuthSecret) {\n      console.error('NEXTAUTH_SECRET is required');\n      return NextResponse.redirect(new URL(`${errorUrl}?error=missing_secret`, request.url));\n    }\n\n    const searchParams = request.nextUrl.searchParams;\n    const code = searchParams.get('code');\n\n    if (!code) {\n      return NextResponse.redirect(new URL(`${errorUrl}?error=missing_code`, request.url));\n    }\n\n    try {\n      // Exchange authorization code for tokens\n      const tokenEndpoint = `${issuer}/oauth2/token`;\n\n      const body = new URLSearchParams({\n        grant_type: 'authorization_code',\n        code,\n        redirect_uri: `${baseUrl}/api/oauth/callback`,\n        client_id: clientId,\n        client_secret: clientSecret,\n      });\n\n      // For development, use custom agent to disable SSL verification\n      const fetchOptions: RequestInit = {\n        method: 'POST',\n        headers: {\n          'Content-Type': 'application/x-www-form-urlencoded',\n        },\n        body: body.toString(),\n      };\n\n      if (process.env.NODE_ENV !== 'production') {\n        const agent = new https.Agent({\n          rejectUnauthorized: false,\n        });\n        (fetchOptions as any).agent = agent;\n      }\n\n      const tokenResponse = await fetch(tokenEndpoint, fetchOptions);\n      const tokens = await tokenResponse.json();\n\n      if (!tokenResponse.ok) {\n        console.error('Token exchange failed:', tokens);\n        return NextResponse.redirect(new URL(`${errorUrl}?error=token_exchange_failed`, request.url));\n      }\n\n      // Fetch user info\n      const userInfoEndpoint = `${issuer}/oauth2/userinfo`;\n      const userInfoResponse = await fetch(userInfoEndpoint, {\n        headers: {\n          'Authorization': `Bearer ${tokens.access_token}`,\n        },\n        ...(process.env.NODE_ENV !== 'production' ? {\n          agent: new https.Agent({ rejectUnauthorized: false })\n        } as any : {})\n      });\n\n      const userInfo = await userInfoResponse.json();\n\n      // Create NextAuth-compatible session token\n      const sessionToken = await encode({\n        token: {\n          accessToken: tokens.access_token,\n          refreshToken: tokens.refresh_token,\n          expiresAt: Math.floor(Date.now() / 1000) + (tokens.expires_in || 3600),\n          idToken: tokens.id_token,\n          email: userInfo.email,\n          username: userInfo.username,\n          name: userInfo.name,\n          sub: userInfo.sub,\n        },\n        secret: nextAuthSecret,\n      });\n\n      const redirectResponse = NextResponse.redirect(new URL(redirectUrl, request.url));\n\n      // Set NextAuth session cookie\n      const cookieName = process.env.NODE_ENV === 'production'\n        ? '__Secure-next-auth.session-token'\n        : 'next-auth.session-token';\n\n      redirectResponse.cookies.set(cookieName, sessionToken, {\n        httpOnly: true,\n        secure: process.env.NODE_ENV === 'production',\n        sameSite: 'lax',\n        maxAge: 60 * 60 * 24 * 30, // 30 days\n        path: '/',\n      });\n\n      return redirectResponse;\n    } catch (error) {\n      console.error('OAuth callback error:', error);\n      return NextResponse.redirect(new URL(`${errorUrl}?error=callback_failed`, request.url));\n    }\n  };\n}\n"],"mappings":";;;;;;;;;;;;;;;;;;;;;;;;;;;;;;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;;;ACAA,IAAAA,oBAA4B;;;ACyBrB,SAAS,gBACd,SACgB;AAChB,QAAM,SAAS,QAAQ,UAAU,QAAQ,IAAI,kBAAkB;AAC/D,QAAM,UAAU,OAAO,QAAQ,OAAO,EAAE;AAExC,SAAO;AAAA,IACL,IAAI;AAAA,IACJ,MAAM;AAAA,IACN,MAAM;AAAA,IACN,SAAS;AAAA;AAAA,IAGT,WAAW,GAAG,OAAO;AAAA;AAAA,IAGrB,eAAe;AAAA,MACb,KAAK,GAAG,OAAO;AAAA,MACf,QAAQ;AAAA,QACN,QAAQ,QAAQ,UAAU,CAAC,UAAU,WAAW,OAAO,GAAG,KAAK,GAAG;AAAA,QAClE,eAAe;AAAA,MACjB;AAAA,IACF;AAAA,IACA,OAAO,GAAG,OAAO;AAAA,IACjB,UAAU,GAAG,OAAO;AAAA,IAEpB,QAAQ;AAAA,MACN,IAAI,QAAQ;AAAA,MACZ,QAAQ,QAAQ;AAAA,MAChB,4BAA4B;AAAA,MAC5B,8BAA8B;AAAA;AAAA,IAChC;AAAA,IAEA,QAAQ;AAAA,IAER,QAAQ,QAAQ,gBAAgB,QAAQ,CAAC,QAAQ,OAAO,IAAI,CAAC,OAAO;AAAA,IAEpE,QAAQ,SAAyB,QAAa;AAC5C,aAAO;AAAA,QACL,IAAI,QAAQ,OAAO,QAAQ,MAAM,QAAQ;AAAA,QACzC,OAAO,QAAQ;AAAA,QACf,eAAe,QAAQ,iBAAiB,oBAAI,KAAK,IAAI;AAAA,QACrD,MAAM,QAAQ,QAAQ,GAAG,QAAQ,cAAc,EAAE,IAAI,QAAQ,eAAe,EAAE,GAAG,KAAK;AAAA,QACtF,OAAO,QAAQ;AAAA,MACjB;AAAA,IACF;AAAA,IAEA,OAAO;AAAA,MACL,MAAM;AAAA,MACN,IAAI;AAAA,MACJ,MAAM;AAAA,IACR;AAAA,IAEA;AAAA,EACF;AACF;;;AChFA,uBAAuD;AAoBvD,eAAsB,qBACjB,MAIH;AACA,aAAO,iBAAAC,kBAAmB,GAAG,IAAW;AAC1C;AAKO,SAAS,mBACd,SACA,aACA;AACA,SAAO,OAAO,KAAqB,QAAyB;AAC1D,UAAM,UAAU,MAAM,kBAAkB,KAAK,KAAK,WAAW;AAE7D,QAAI,CAAC,SAAS;AACZ,aAAO,IAAI,OAAO,GAAG,EAAE,KAAK,EAAE,OAAO,eAAe,CAAC;AAAA,IACvD;AAEA,WAAO,QAAQ,KAAK,KAAK,OAAO;AAAA,EAClC;AACF;AAKO,SAAS,2BACd,oBAIA,aACA;AACA,SAAO,OAAO,YAAuC;AACnD,UAAM,UAAU,MAAM;AAAA,MACpB,QAAQ;AAAA,MACR,QAAQ;AAAA,MACR;AAAA,IACF;AAEA,QAAI,CAAC,SAAS;AACZ,aAAO;AAAA,QACL,UAAU;AAAA,UACR,aAAa;AAAA,UACb,WAAW;AAAA,QACb;AAAA,MACF;AAAA,IACF;AAEA,WAAO,mBAAmB,SAAS,OAAO;AAAA,EAC5C;AACF;;;AFrEA,IAAM,WAAY,kBAAAC,QAAwB,WAAW,kBAAAA;AAoB9C,SAAS,WAAW,UAA6B,CAAC,GAAG;AAC1D,QAAM,WAAW,QAAQ,YAAY,QAAQ,IAAI;AACjD,QAAM,eAAe,QAAQ,gBAAgB,QAAQ,IAAI;AAEzD,MAAI,CAAC,YAAY,CAAC,cAAc;AAC9B,UAAM,IAAI;AAAA,MACR;AAAA,IAGF;AAAA,EACF;AAEA,QAAM,cAA+B;AAAA,IACnC,WAAW;AAAA,MACT,gBAAgB;AAAA,QACd;AAAA,QACA;AAAA,QACA,QAAQ,QAAQ;AAAA,QAChB,QAAQ,QAAQ;AAAA,QAChB,aAAa,QAAQ;AAAA,MACvB,CAAC;AAAA,IACH;AAAA,IAEA,WAAW;AAAA,MACT,MAAM,IAAI,EAAE,OAAO,SAAS,QAAQ,GAAG;AAErC,YAAI,SAAS;AACX,gBAAM,cAAc,QAAQ;AAC5B,gBAAM,eAAe,QAAQ;AAC7B,gBAAM,YAAY,QAAQ;AAC1B,gBAAM,UAAU,QAAQ;AAAA,QAC1B;AAGA,YAAI,SAAS;AACX,gBAAM,iBAAiB;AACvB,gBAAM,QAAQ,eAAe;AAC7B,gBAAM,WAAW,eAAe;AAChC,gBAAM,gBAAgB,eAAe;AAAA,QACvC;AAGA,YAAI,QAAQ,WAAW,KAAK;AAC1B,iBAAO,QAAQ,UAAU,IAAI,EAAE,OAAO,SAAS,QAAQ,CAAQ;AAAA,QACjE;AAEA,eAAO;AAAA,MACT;AAAA,MAEA,MAAM,QAAQ,EAAE,SAAS,MAAM,GAAG;AAEhC,gBAAQ,cAAc,MAAM;AAC5B,gBAAQ,UAAU,MAAM;AAExB,YAAI,QAAQ,MAAM;AAChB,kBAAQ,KAAK,QAAQ,MAAM;AAC3B,kBAAQ,KAAK,WAAW,MAAM;AAC9B,kBAAQ,KAAK,gBAAgB,MAAM;AAAA,QACrC;AAGA,YAAI,QAAQ,WAAW,SAAS;AAC9B,iBAAO,QAAQ,UAAU,QAAQ,EAAE,SAAS,MAAM,CAAQ;AAAA,QAC5D;AAEA,eAAO;AAAA,MACT;AAAA,MAEA,GAAG,QAAQ;AAAA,IACb;AAAA,IAEA,OAAO;AAAA,MACL,QAAQ;AAAA,MACR,SAAS;AAAA,MACT,OAAO;AAAA,MACP,GAAG,QAAQ;AAAA,IACb;AAAA,IAEA,SAAS;AAAA,MACP,UAAU;AAAA,MACV,GAAG,QAAQ;AAAA,IACb;AAAA,IAEA,OAAO,QAAQ,SAAS,QAAQ,IAAI,aAAa;AAAA,IAEjD,QAAQ,QAAQ,IAAI;AAAA,EACtB;AAGA,SAAO;AAAA,IACL,MAAM;AAAA,IACN,UAAU,SAAS,WAAW;AAAA,EAChC;AACF;AAKO,SAAS,eAAe,aAA8B;AAC3D,QAAM,UAAU,SAAS,WAAW;AACpC,SAAO,EAAE,KAAK,SAAS,MAAM,QAAQ;AACvC;AASO,IAAM,mBAAmB;AAKhC,eAAsB,mBAAmB,OAAY,UAAkB,cAAsB,QAAiB;AAC5G,MAAI;AACF,UAAM,UAAU,UAAU,QAAQ,IAAI,kBAAkB;AACxD,UAAM,WAAW,GAAG,OAAO;AAG3B,UAAM,eAAoB;AAAA,MACxB,QAAQ;AAAA,MACR,SAAS;AAAA,QACP,gBAAgB;AAAA,MAClB;AAAA,MACA,MAAM,IAAI,gBAAgB;AAAA,QACxB,YAAY;AAAA,QACZ,eAAe,MAAM;AAAA,QACrB,WAAW;AAAA,QACX,eAAe;AAAA,MACjB,CAAC;AAAA,IACH;AAGA,QAAI,QAAQ,IAAI,aAAa,gBAAgB,SAAS,WAAW,UAAU,GAAG;AAC5E,YAAMC,SAAQ,MAAM,OAAO,OAAO;AAClC,mBAAa,QAAQ,IAAIA,OAAM,MAAM;AAAA,QACnC,oBAAoB;AAAA,MACtB,CAAC;AAAA,IACH;AAEA,UAAM,WAAW,MAAM,MAAM,UAAU,YAAY;AACnD,UAAM,kBAAkB,MAAM,SAAS,KAAK;AAE5C,QAAI,CAAC,SAAS,IAAI;AAChB,YAAM;AAAA,IACR;AAEA,WAAO;AAAA,MACL,GAAG;AAAA,MACH,aAAa,gBAAgB;AAAA,MAC7B,cAAc,gBAAgB,iBAAiB,MAAM;AAAA;AAAA,MAErD,WAAW,KAAK,MAAM,KAAK,IAAI,IAAI,GAAI,KAAK,gBAAgB,cAAc;AAAA;AAAA,MAE1E,OAAO;AAAA,IACT;AAAA,EACF,SAAS,OAAO;AACd,YAAQ,MAAM,mCAAmC,KAAK;AACtD,WAAO;AAAA,MACL,GAAG;AAAA,MACH,OAAO;AAAA,IACT;AAAA,EACF;AACF;;;AD1LA,IAAAC,oBAAoC;;;AILpC,oBAA0C;AAC1C,iBAAyB;AAiBlB,SAAS,gBAAgB,UAA8B,CAAC,GAAG;AAChE,SAAO,eAAe,WAAW,KAAkB;AACjD,UAAM,QAAQ,UAAM,qBAAS;AAAA,MAC3B;AAAA,MACA,QAAQ,QAAQ,IAAI;AAAA,IACtB,CAAC;AAED,UAAM,WAAW,IAAI,QAAQ;AAG7B,QAAI,QAAQ,aAAa,KAAK,UAAQ,SAAS,WAAW,IAAI,CAAC,GAAG;AAChE,aAAO,2BAAa,KAAK;AAAA,IAC3B;AAGA,UAAM,kBAAkB,QAAQ,iBAC5B,QAAQ,eAAe,KAAK,UAAQ,SAAS,WAAW,IAAI,CAAC,IAC7D;AAEJ,QAAI,CAAC,iBAAiB;AACpB,aAAO,2BAAa,KAAK;AAAA,IAC3B;AAGA,QAAI,eAAe,CAAC,CAAC;AAErB,QAAI,QAAQ,WAAW,YAAY;AACjC,qBAAe,MAAM,QAAQ,UAAU,WAAW,EAAE,OAAO,IAAI,CAAC;AAAA,IAClE;AAEA,QAAI,CAAC,cAAc;AACjB,YAAM,YAAY,QAAQ,OAAO,UAAU;AAC3C,YAAM,MAAM,IAAI,IAAI,WAAW,IAAI,GAAG;AACtC,UAAI,aAAa,IAAI,eAAe,QAAQ;AAC5C,aAAO,2BAAa,SAAS,GAAG;AAAA,IAClC;AAEA,WAAO,2BAAa,KAAK;AAAA,EAC3B;AACF;AAKO,SAAS,uBACd,iBAA2B,CAAC,YAAY,GACxC,cAAwB,CAAC,SAAS,WAAW,GAC7C;AACA,SAAO;AAAA,IACL,SAAS;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA,MAQP;AAAA,IACF;AAAA,IACA;AAAA,IACA;AAAA,EACF;AACF;;;AChFA,IAAAC,iBAA0C;AAC1C,mBAAkB;AAClB,IAAAC,cAAuB;AAyDhB,SAAS,yBAAyB,UAAqC,CAAC,GAAG;AAChF,SAAO,eAAe,IAAI,SAAsB;AAC9C,UAAM;AAAA,MACJ,SAAS,QAAQ,IAAI,kBAAkB;AAAA,MACvC,WAAW,QAAQ,IAAI;AAAA,MACvB,eAAe,QAAQ,IAAI;AAAA,MAC3B,UAAU,QAAQ,IAAI;AAAA,MACtB,iBAAiB,QAAQ,IAAI;AAAA,MAC7B,cAAc;AAAA,MACd,WAAW;AAAA,IACb,IAAI;AAEJ,QAAI,CAAC,YAAY,CAAC,cAAc;AAC9B,cAAQ,MAAM,yCAAyC;AACvD,aAAO,4BAAa,SAAS,IAAI,IAAI,GAAG,QAAQ,8BAA8B,QAAQ,GAAG,CAAC;AAAA,IAC5F;AAEA,QAAI,CAAC,gBAAgB;AACnB,cAAQ,MAAM,6BAA6B;AAC3C,aAAO,4BAAa,SAAS,IAAI,IAAI,GAAG,QAAQ,yBAAyB,QAAQ,GAAG,CAAC;AAAA,IACvF;AAEA,UAAM,eAAe,QAAQ,QAAQ;AACrC,UAAM,OAAO,aAAa,IAAI,MAAM;AAEpC,QAAI,CAAC,MAAM;AACT,aAAO,4BAAa,SAAS,IAAI,IAAI,GAAG,QAAQ,uBAAuB,QAAQ,GAAG,CAAC;AAAA,IACrF;AAEA,QAAI;AAEF,YAAM,gBAAgB,GAAG,MAAM;AAE/B,YAAM,OAAO,IAAI,gBAAgB;AAAA,QAC/B,YAAY;AAAA,QACZ;AAAA,QACA,cAAc,GAAG,OAAO;AAAA,QACxB,WAAW;AAAA,QACX,eAAe;AAAA,MACjB,CAAC;AAGD,YAAM,eAA4B;AAAA,QAChC,QAAQ;AAAA,QACR,SAAS;AAAA,UACP,gBAAgB;AAAA,QAClB;AAAA,QACA,MAAM,KAAK,SAAS;AAAA,MACtB;AAEA,UAAI,QAAQ,IAAI,aAAa,cAAc;AACzC,cAAM,QAAQ,IAAI,aAAAC,QAAM,MAAM;AAAA,UAC5B,oBAAoB;AAAA,QACtB,CAAC;AACD,QAAC,aAAqB,QAAQ;AAAA,MAChC;AAEA,YAAM,gBAAgB,MAAM,MAAM,eAAe,YAAY;AAC7D,YAAM,SAAS,MAAM,cAAc,KAAK;AAExC,UAAI,CAAC,cAAc,IAAI;AACrB,gBAAQ,MAAM,0BAA0B,MAAM;AAC9C,eAAO,4BAAa,SAAS,IAAI,IAAI,GAAG,QAAQ,gCAAgC,QAAQ,GAAG,CAAC;AAAA,MAC9F;AAGA,YAAM,mBAAmB,GAAG,MAAM;AAClC,YAAM,mBAAmB,MAAM,MAAM,kBAAkB;AAAA,QACrD,SAAS;AAAA,UACP,iBAAiB,UAAU,OAAO,YAAY;AAAA,QAChD;AAAA,QACA,GAAI,QAAQ,IAAI,aAAa,eAAe;AAAA,UAC1C,OAAO,IAAI,aAAAA,QAAM,MAAM,EAAE,oBAAoB,MAAM,CAAC;AAAA,QACtD,IAAW,CAAC;AAAA,MACd,CAAC;AAED,YAAM,WAAW,MAAM,iBAAiB,KAAK;AAG7C,YAAM,eAAe,UAAM,oBAAO;AAAA,QAChC,OAAO;AAAA,UACL,aAAa,OAAO;AAAA,UACpB,cAAc,OAAO;AAAA,UACrB,WAAW,KAAK,MAAM,KAAK,IAAI,IAAI,GAAI,KAAK,OAAO,cAAc;AAAA,UACjE,SAAS,OAAO;AAAA,UAChB,OAAO,SAAS;AAAA,UAChB,UAAU,SAAS;AAAA,UACnB,MAAM,SAAS;AAAA,UACf,KAAK,SAAS;AAAA,QAChB;AAAA,QACA,QAAQ;AAAA,MACV,CAAC;AAED,YAAM,mBAAmB,4BAAa,SAAS,IAAI,IAAI,aAAa,QAAQ,GAAG,CAAC;AAGhF,YAAM,aAAa,QAAQ,IAAI,aAAa,eACxC,qCACA;AAEJ,uBAAiB,QAAQ,IAAI,YAAY,cAAc;AAAA,QACrD,UAAU;AAAA,QACV,QAAQ,QAAQ,IAAI,aAAa;AAAA,QACjC,UAAU;AAAA,QACV,QAAQ,KAAK,KAAK,KAAK;AAAA;AAAA,QACvB,MAAM;AAAA,MACR,CAAC;AAED,aAAO;AAAA,IACT,SAAS,OAAO;AACd,cAAQ,MAAM,yBAAyB,KAAK;AAC5C,aAAO,4BAAa,SAAS,IAAI,IAAI,GAAG,QAAQ,0BAA0B,QAAQ,GAAG,CAAC;AAAA,IACxF;AAAA,EACF;AACF;","names":["import_next_auth","getNextAuthSession","NextAuthDefault","https","import_next_auth","import_server","import_jwt","https"]}
+{"version":3,"sources":["../../src/server/index.ts","../../src/server/auth.ts","../../src/provider.ts","../../src/server/session.ts","../../src/server/middleware.ts","../../src/server/hosted-auth-callback.ts"],"sourcesContent":["// Server-side exports\nexport { createAuth, createHandlers, getServerSession, refreshAccessToken } from './auth';\nexport type { CreateAuthOptions, NextAuthOptions } from './auth';\n\n// Re-export NextAuth from next-auth\nexport { default as NextAuth } from 'next-auth';\n\n// Re-export OAuth42Provider\nexport { OAuth42Provider } from '../provider';\n\nexport { withOAuth42Auth, createMiddlewareConfig } from './middleware';\nexport type { OAuth42AuthOptions } from './middleware';\n\nexport { getOAuth42Session, withOAuth42Session, withOAuth42ServerSideProps } from './session';\n\n// Hosted auth callback handler\nexport { createHostedAuthCallback } from './hosted-auth-callback';\nexport type { HostedAuthCallbackOptions } from './hosted-auth-callback';","import NextAuthDefault from 'next-auth';\nimport type { NextAuthOptions } from 'next-auth';\nimport { OAuth42Provider, OAuth42Profile } from '../provider';\nimport { getOAuth42Session } from './session';\n\n// Handle both CommonJS and ESM exports\nconst NextAuth = (NextAuthDefault as any).default || NextAuthDefault;\n\nexport { type NextAuthOptions };\n\nexport interface CreateAuthOptions {\n  clientId?: string;\n  clientSecret?: string;\n  issuer?: string;\n  scopes?: string[];\n  pkceEnabled?: boolean;\n  debug?: boolean;\n  callbacks?: NextAuthOptions['callbacks'];\n  pages?: NextAuthOptions['pages'];\n  session?: NextAuthOptions['session'];\n}\n\n/**\n * Create a pre-configured NextAuth instance for OAuth42\n * This provides a simplified setup with sensible defaults\n */\nexport function createAuth(options: CreateAuthOptions = {}) {\n  const clientId = options.clientId || process.env.OAUTH42_CLIENT_ID;\n  const clientSecret = options.clientSecret || process.env.OAUTH42_CLIENT_SECRET;\n  \n  if (!clientId || !clientSecret) {\n    throw new Error(\n      'OAuth42 client credentials are required. ' +\n      'Set OAUTH42_CLIENT_ID and OAUTH42_CLIENT_SECRET environment variables ' +\n      'or pass them in the options.'\n    );\n  }\n  \n  const authOptions: NextAuthOptions = {\n    providers: [\n      OAuth42Provider({\n        clientId,\n        clientSecret,\n        issuer: options.issuer,\n        scopes: options.scopes,\n        pkceEnabled: options.pkceEnabled,\n      }),\n    ],\n    \n    callbacks: {\n      async jwt({ token, account, profile }) {\n        // Store OAuth tokens in the JWT\n        if (account) {\n          token.accessToken = account.access_token;\n          token.refreshToken = account.refresh_token;\n          token.expiresAt = account.expires_at;\n          token.idToken = account.id_token;\n        }\n        \n        // Add user profile data\n        if (profile) {\n          const oauth42Profile = profile as OAuth42Profile;\n          token.email = oauth42Profile.email;\n          token.username = oauth42Profile.username;\n          token.emailVerified = oauth42Profile.email_verified;\n        }\n        \n        // Call custom callback if provided\n        if (options.callbacks?.jwt) {\n          return options.callbacks.jwt({ token, account, profile } as any);\n        }\n        \n        return token;\n      },\n      \n      async session({ session, token }) {\n        // Add OAuth42-specific data to session\n        session.accessToken = token.accessToken as string;\n        session.idToken = token.idToken as string;\n\n        if (session.user) {\n          session.user.email = token.email as string;\n          session.user.name = token.name as string;\n          session.user.username = token.username as string;\n          session.user.emailVerified = token.emailVerified as boolean;\n        }\n\n        // Call custom callback if provided\n        if (options.callbacks?.session) {\n          return options.callbacks.session({ session, token } as any);\n        }\n\n        return session;\n      },\n      \n      ...options.callbacks,\n    },\n    \n    pages: {\n      signIn: '/auth/signin',\n      signOut: '/auth/signout',\n      error: '/auth/error',\n      ...options.pages,\n    },\n    \n    session: {\n      strategy: 'jwt',\n      ...options.session,\n    },\n    \n    debug: options.debug || process.env.NODE_ENV === 'development',\n    \n    secret: process.env.NEXTAUTH_SECRET,\n  };\n  \n  // Return the configuration and a function to create handlers\n  return {\n    auth: authOptions,\n    handlers: NextAuth(authOptions),\n  };\n}\n\n/**\n * Create NextAuth handlers for API routes\n */\nexport function createHandlers(authOptions: NextAuthOptions) {\n  const handler = NextAuth(authOptions);\n  return { GET: handler, POST: handler };\n}\n\n/**\n * Helper to get the current session server-side\n * @deprecated Use getOAuth42Session instead - this is now just an alias for backward compatibility\n * \n * This function is maintained for backward compatibility but internally\n * calls getOAuth42Session which properly handles both App Router and Pages Router\n */\nexport const getServerSession = getOAuth42Session;\n\n/**\n * Token refresh helper\n */\nexport async function refreshAccessToken(token: any, clientId: string, clientSecret: string, issuer?: string) {\n  try {\n    const baseUrl = issuer || process.env.OAUTH42_ISSUER || 'https://oauth42.com';\n    const tokenUrl = `${baseUrl}/oauth2/token`;\n    \n    // In development, we need to handle self-signed certificates\n    const fetchOptions: any = {\n      method: 'POST',\n      headers: {\n        'Content-Type': 'application/x-www-form-urlencoded',\n      },\n      body: new URLSearchParams({\n        grant_type: 'refresh_token',\n        refresh_token: token.refreshToken,\n        client_id: clientId,\n        client_secret: clientSecret,\n      }),\n    };\n    \n    // Add agent for self-signed certificates in development\n    if (process.env.NODE_ENV !== 'production' && tokenUrl.startsWith('https://')) {\n      const https = await import('https');\n      fetchOptions.agent = new https.Agent({\n        rejectUnauthorized: false\n      });\n    }\n    \n    const response = await fetch(tokenUrl, fetchOptions);\n    const refreshedTokens = await response.json();\n    \n    if (!response.ok) {\n      throw refreshedTokens;\n    }\n    \n    return {\n      ...token,\n      accessToken: refreshedTokens.access_token,\n      refreshToken: refreshedTokens.refresh_token ?? token.refreshToken,\n      // Store expiration time in seconds (Unix timestamp)\n      expiresAt: Math.floor(Date.now() / 1000) + (refreshedTokens.expires_in || 3600),\n      // Explicitly remove any error property on successful refresh\n      error: undefined,\n    };\n  } catch (error) {\n    console.error('Failed to refresh access token:', error);\n    return {\n      ...token,\n      error: 'RefreshAccessTokenError',\n    };\n  }\n}","import type { OAuthConfig, OAuthUserConfig } from 'next-auth/providers/oauth';\n\nexport interface OAuth42Profile {\n  sub: string;\n  email: string;\n  email_verified?: boolean;\n  name?: string;\n  given_name?: string;\n  family_name?: string;\n  picture?: string;\n  username?: string;\n  id?: string;\n}\n\nexport interface OAuth42ProviderOptions {\n  clientId: string;\n  clientSecret: string;\n  issuer?: string;\n  authorizationUrl?: string;\n  tokenUrl?: string;\n  userinfoUrl?: string;\n  scopes?: string[];\n  pkceEnabled?: boolean;\n}\n\nexport function OAuth42Provider<P extends OAuth42Profile>(\n  options: OAuthUserConfig<P> & Partial<OAuth42ProviderOptions>\n): OAuthConfig<P> {\n  const issuer = options.issuer || process.env.OAUTH42_ISSUER || 'https://oauth42.com';\n  const baseUrl = issuer.replace(/\\/$/, '');\n  \n  return {\n    id: 'oauth42',\n    name: 'OAuth42',\n    type: 'oauth',\n    version: '2.0',\n    \n    // Use OIDC discovery to automatically find endpoints\n    wellKnown: `${baseUrl}/.well-known/openid-configuration`,\n    \n    // Also set individual endpoints for compatibility\n    authorization: {\n      url: `${baseUrl}/oauth2/authorize`,\n      params: {\n        scope: (options.scopes || ['openid', 'profile', 'email']).join(' '),\n        response_type: 'code',\n      },\n    },\n    token: `${baseUrl}/oauth2/token`,\n    userinfo: `${baseUrl}/oauth2/userinfo`,\n    \n    client: {\n      id: options.clientId,\n      secret: options.clientSecret,\n      token_endpoint_auth_method: 'client_secret_post',\n      id_token_signed_response_alg: 'HS256', // OAuth42 uses HS256 for ID tokens\n    },\n    \n    issuer: baseUrl,\n    \n    checks: options.pkceEnabled !== false ? ['pkce', 'state'] : ['state'],\n    \n    profile(profile: OAuth42Profile, tokens: any) {\n      return {\n        id: profile.sub || profile.id || profile.email,\n        email: profile.email,\n        emailVerified: profile.email_verified ? new Date() : null,\n        name: profile.name || `${profile.given_name || ''} ${profile.family_name || ''}`.trim(),\n        image: profile.picture,\n      };\n    },\n    \n    style: {\n      logo: '/oauth42-logo.svg',\n      bg: '#1e40af',\n      text: '#ffffff',\n    },\n    \n    options,\n  };\n}","import { getServerSession as getNextAuthSession } from 'next-auth';\nimport { NextAuthOptions } from 'next-auth';\nimport { GetServerSidePropsContext, NextApiRequest, NextApiResponse } from 'next';\n\n/**\n * Get the OAuth42 session server-side\n * \n * This is the primary method for retrieving sessions in OAuth42 SDK.\n * Supports both Pages Router and App Router:\n * \n * App Router:\n * ```ts\n * const session = await getOAuth42Session(authOptions);\n * ```\n * \n * Pages Router:\n * ```ts\n * const session = await getOAuth42Session(req, res, authOptions);\n * ```\n */\nexport async function getOAuth42Session(\n  ...args: \n    | [GetServerSidePropsContext['req'], GetServerSidePropsContext['res'], NextAuthOptions]\n    | [NextApiRequest, NextApiResponse, NextAuthOptions]\n    | [NextAuthOptions]\n) {\n  return getNextAuthSession(...args as any);\n}\n\n/**\n * Helper for protecting API routes\n */\nexport function withOAuth42Session(\n  handler: (req: NextApiRequest, res: NextApiResponse, session: any) => Promise<void> | void,\n  authOptions: NextAuthOptions\n) {\n  return async (req: NextApiRequest, res: NextApiResponse) => {\n    const session = await getOAuth42Session(req, res, authOptions);\n    \n    if (!session) {\n      return res.status(401).json({ error: 'Unauthorized' });\n    }\n    \n    return handler(req, res, session);\n  };\n}\n\n/**\n * Helper for protecting server-side props\n */\nexport function withOAuth42ServerSideProps(\n  getServerSideProps: (\n    context: GetServerSidePropsContext,\n    session: any\n  ) => Promise<any>,\n  authOptions: NextAuthOptions\n) {\n  return async (context: GetServerSidePropsContext) => {\n    const session = await getOAuth42Session(\n      context.req,\n      context.res,\n      authOptions\n    );\n    \n    if (!session) {\n      return {\n        redirect: {\n          destination: '/auth/signin',\n          permanent: false,\n        },\n      };\n    }\n    \n    return getServerSideProps(context, session);\n  };\n}","import { NextRequest, NextResponse } from 'next/server';\nimport { getToken } from 'next-auth/jwt';\n\nexport interface OAuth42AuthOptions {\n  pages?: {\n    signIn?: string;\n    error?: string;\n  };\n  callbacks?: {\n    authorized?: (params: { token: any; req: NextRequest }) => boolean | Promise<boolean>;\n  };\n  protectedPaths?: string[];\n  publicPaths?: string[];\n}\n\n/**\n * Middleware helper for protecting routes with OAuth42\n */\nexport function withOAuth42Auth(options: OAuth42AuthOptions = {}) {\n  return async function middleware(req: NextRequest) {\n    const token = await getToken({ \n      req: req as any, \n      secret: process.env.NEXTAUTH_SECRET \n    });\n    \n    const pathname = req.nextUrl.pathname;\n    \n    // Check if path is explicitly public\n    if (options.publicPaths?.some(path => pathname.startsWith(path))) {\n      return NextResponse.next();\n    }\n    \n    // Check if path needs protection\n    const needsProtection = options.protectedPaths\n      ? options.protectedPaths.some(path => pathname.startsWith(path))\n      : true; // Default to protecting all paths\n    \n    if (!needsProtection) {\n      return NextResponse.next();\n    }\n    \n    // Check authorization\n    let isAuthorized = !!token;\n    \n    if (options.callbacks?.authorized) {\n      isAuthorized = await options.callbacks.authorized({ token, req });\n    }\n    \n    if (!isAuthorized) {\n      const signInUrl = options.pages?.signIn || '/auth/signin';\n      const url = new URL(signInUrl, req.url);\n      url.searchParams.set('callbackUrl', pathname);\n      return NextResponse.redirect(url);\n    }\n    \n    return NextResponse.next();\n  };\n}\n\n/**\n * Helper to create middleware configuration\n */\nexport function createMiddlewareConfig(\n  protectedPaths: string[] = ['/protected'],\n  publicPaths: string[] = ['/auth', '/api/auth']\n) {\n  return {\n    matcher: [\n      /*\n       * Match all request paths except for the ones starting with:\n       * - _next/static (static files)\n       * - _next/image (image optimization files)\n       * - favicon.ico (favicon file)\n       * - public folder\n       */\n      '/((?!_next/static|_next/image|favicon.ico|public).*)',\n    ],\n    protectedPaths,\n    publicPaths,\n  };\n}","import { NextRequest, NextResponse } from 'next/server';\nimport https from 'https';\nimport { encode } from 'next-auth/jwt';\n\nexport interface HostedAuthCallbackOptions {\n  /**\n   * OAuth42 issuer URL (e.g., 'https://api.oauth42.com' or 'https://localhost:8443')\n   */\n  issuer?: string;\n\n  /**\n   * OAuth2 client ID\n   */\n  clientId?: string;\n\n  /**\n   * OAuth2 client secret\n   */\n  clientSecret?: string;\n\n  /**\n   * Application base URL (e.g., 'http://localhost:3000')\n   */\n  baseUrl?: string;\n\n  /**\n   * NextAuth secret for JWT encoding\n   */\n  nextAuthSecret?: string;\n\n  /**\n   * URL to redirect to after successful authentication\n   * @default '/dashboard'\n   */\n  redirectUrl?: string;\n\n  /**\n   * URL to redirect to on error\n   * @default '/'\n   */\n  errorUrl?: string;\n}\n\n/**\n * Creates a handler for OAuth42 hosted auth callback that integrates with NextAuth.\n *\n * This function handles the OAuth callback, exchanges the authorization code for tokens,\n * fetches user info, and creates a NextAuth-compatible session cookie.\n *\n * @example\n * ```typescript\n * // app/api/oauth/callback/route.ts\n * import { createHostedAuthCallback } from '@oauth42/next/server';\n *\n * export const GET = createHostedAuthCallback({\n *   redirectUrl: '/dashboard',\n * });\n * ```\n */\nexport function createHostedAuthCallback(options: HostedAuthCallbackOptions = {}) {\n  return async function GET(request: NextRequest) {\n    const {\n      issuer = process.env.OAUTH42_ISSUER || 'https://api.oauth42.com',\n      clientId = process.env.OAUTH42_CLIENT_ID,\n      clientSecret = process.env.OAUTH42_CLIENT_SECRET,\n      baseUrl = process.env.NEXTAUTH_URL,\n      nextAuthSecret = process.env.NEXTAUTH_SECRET,\n      redirectUrl = '/dashboard',\n      errorUrl = '/',\n    } = options;\n\n    if (!clientId || !clientSecret) {\n      console.error('OAuth42 client credentials are required');\n      return NextResponse.redirect(new URL(`${errorUrl}?error=missing_credentials`, request.url));\n    }\n\n    if (!nextAuthSecret) {\n      console.error('NEXTAUTH_SECRET is required');\n      return NextResponse.redirect(new URL(`${errorUrl}?error=missing_secret`, request.url));\n    }\n\n    const searchParams = request.nextUrl.searchParams;\n    const code = searchParams.get('code');\n\n    if (!code) {\n      return NextResponse.redirect(new URL(`${errorUrl}?error=missing_code`, request.url));\n    }\n\n    try {\n      // Exchange authorization code for tokens\n      const tokenEndpoint = `${issuer}/oauth2/token`;\n\n      const body = new URLSearchParams({\n        grant_type: 'authorization_code',\n        code,\n        redirect_uri: `${baseUrl}/api/oauth/callback`,\n        client_id: clientId,\n        client_secret: clientSecret,\n      });\n\n      // For development, use custom agent to disable SSL verification\n      const fetchOptions: RequestInit = {\n        method: 'POST',\n        headers: {\n          'Content-Type': 'application/x-www-form-urlencoded',\n        },\n        body: body.toString(),\n      };\n\n      if (process.env.NODE_ENV !== 'production') {\n        const agent = new https.Agent({\n          rejectUnauthorized: false,\n        });\n        (fetchOptions as any).agent = agent;\n      }\n\n      const tokenResponse = await fetch(tokenEndpoint, fetchOptions);\n      const tokens = await tokenResponse.json();\n\n      if (!tokenResponse.ok) {\n        console.error('Token exchange failed:', tokens);\n        return NextResponse.redirect(new URL(`${errorUrl}?error=token_exchange_failed`, request.url));\n      }\n\n      // Fetch user info\n      const userInfoEndpoint = `${issuer}/oauth2/userinfo`;\n      const userInfoResponse = await fetch(userInfoEndpoint, {\n        headers: {\n          'Authorization': `Bearer ${tokens.access_token}`,\n        },\n        ...(process.env.NODE_ENV !== 'production' ? {\n          agent: new https.Agent({ rejectUnauthorized: false })\n        } as any : {})\n      });\n\n      const userInfo = await userInfoResponse.json();\n\n      // Create NextAuth-compatible session token\n      const sessionToken = await encode({\n        token: {\n          accessToken: tokens.access_token,\n          refreshToken: tokens.refresh_token,\n          expiresAt: Math.floor(Date.now() / 1000) + (tokens.expires_in || 3600),\n          idToken: tokens.id_token,\n          email: userInfo.email,\n          username: userInfo.username,\n          name: userInfo.name,\n          sub: userInfo.sub,\n        },\n        secret: nextAuthSecret,\n      });\n\n      const redirectResponse = NextResponse.redirect(new URL(redirectUrl, request.url));\n\n      // Set NextAuth session cookie\n      const cookieName = process.env.NODE_ENV === 'production'\n        ? '__Secure-next-auth.session-token'\n        : 'next-auth.session-token';\n\n      redirectResponse.cookies.set(cookieName, sessionToken, {\n        httpOnly: true,\n        secure: process.env.NODE_ENV === 'production',\n        sameSite: 'lax',\n        maxAge: 60 * 60 * 24 * 30, // 30 days\n        path: '/',\n      });\n\n      return redirectResponse;\n    } catch (error) {\n      console.error('OAuth callback error:', error);\n      return NextResponse.redirect(new URL(`${errorUrl}?error=callback_failed`, request.url));\n    }\n  };\n}\n"],"mappings":";;;;;;;;;;;;;;;;;;;;;;;;;;;;;;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;;;ACAA,IAAAA,oBAA4B;;;ACyBrB,SAAS,gBACd,SACgB;AAChB,QAAM,SAAS,QAAQ,UAAU,QAAQ,IAAI,kBAAkB;AAC/D,QAAM,UAAU,OAAO,QAAQ,OAAO,EAAE;AAExC,SAAO;AAAA,IACL,IAAI;AAAA,IACJ,MAAM;AAAA,IACN,MAAM;AAAA,IACN,SAAS;AAAA;AAAA,IAGT,WAAW,GAAG,OAAO;AAAA;AAAA,IAGrB,eAAe;AAAA,MACb,KAAK,GAAG,OAAO;AAAA,MACf,QAAQ;AAAA,QACN,QAAQ,QAAQ,UAAU,CAAC,UAAU,WAAW,OAAO,GAAG,KAAK,GAAG;AAAA,QAClE,eAAe;AAAA,MACjB;AAAA,IACF;AAAA,IACA,OAAO,GAAG,OAAO;AAAA,IACjB,UAAU,GAAG,OAAO;AAAA,IAEpB,QAAQ;AAAA,MACN,IAAI,QAAQ;AAAA,MACZ,QAAQ,QAAQ;AAAA,MAChB,4BAA4B;AAAA,MAC5B,8BAA8B;AAAA;AAAA,IAChC;AAAA,IAEA,QAAQ;AAAA,IAER,QAAQ,QAAQ,gBAAgB,QAAQ,CAAC,QAAQ,OAAO,IAAI,CAAC,OAAO;AAAA,IAEpE,QAAQ,SAAyB,QAAa;AAC5C,aAAO;AAAA,QACL,IAAI,QAAQ,OAAO,QAAQ,MAAM,QAAQ;AAAA,QACzC,OAAO,QAAQ;AAAA,QACf,eAAe,QAAQ,iBAAiB,oBAAI,KAAK,IAAI;AAAA,QACrD,MAAM,QAAQ,QAAQ,GAAG,QAAQ,cAAc,EAAE,IAAI,QAAQ,eAAe,EAAE,GAAG,KAAK;AAAA,QACtF,OAAO,QAAQ;AAAA,MACjB;AAAA,IACF;AAAA,IAEA,OAAO;AAAA,MACL,MAAM;AAAA,MACN,IAAI;AAAA,MACJ,MAAM;AAAA,IACR;AAAA,IAEA;AAAA,EACF;AACF;;;AChFA,uBAAuD;AAoBvD,eAAsB,qBACjB,MAIH;AACA,aAAO,iBAAAC,kBAAmB,GAAG,IAAW;AAC1C;AAKO,SAAS,mBACd,SACA,aACA;AACA,SAAO,OAAO,KAAqB,QAAyB;AAC1D,UAAM,UAAU,MAAM,kBAAkB,KAAK,KAAK,WAAW;AAE7D,QAAI,CAAC,SAAS;AACZ,aAAO,IAAI,OAAO,GAAG,EAAE,KAAK,EAAE,OAAO,eAAe,CAAC;AAAA,IACvD;AAEA,WAAO,QAAQ,KAAK,KAAK,OAAO;AAAA,EAClC;AACF;AAKO,SAAS,2BACd,oBAIA,aACA;AACA,SAAO,OAAO,YAAuC;AACnD,UAAM,UAAU,MAAM;AAAA,MACpB,QAAQ;AAAA,MACR,QAAQ;AAAA,MACR;AAAA,IACF;AAEA,QAAI,CAAC,SAAS;AACZ,aAAO;AAAA,QACL,UAAU;AAAA,UACR,aAAa;AAAA,UACb,WAAW;AAAA,QACb;AAAA,MACF;AAAA,IACF;AAEA,WAAO,mBAAmB,SAAS,OAAO;AAAA,EAC5C;AACF;;;AFrEA,IAAM,WAAY,kBAAAC,QAAwB,WAAW,kBAAAA;AAoB9C,SAAS,WAAW,UAA6B,CAAC,GAAG;AAC1D,QAAM,WAAW,QAAQ,YAAY,QAAQ,IAAI;AACjD,QAAM,eAAe,QAAQ,gBAAgB,QAAQ,IAAI;AAEzD,MAAI,CAAC,YAAY,CAAC,cAAc;AAC9B,UAAM,IAAI;AAAA,MACR;AAAA,IAGF;AAAA,EACF;AAEA,QAAM,cAA+B;AAAA,IACnC,WAAW;AAAA,MACT,gBAAgB;AAAA,QACd;AAAA,QACA;AAAA,QACA,QAAQ,QAAQ;AAAA,QAChB,QAAQ,QAAQ;AAAA,QAChB,aAAa,QAAQ;AAAA,MACvB,CAAC;AAAA,IACH;AAAA,IAEA,WAAW;AAAA,MACT,MAAM,IAAI,EAAE,OAAO,SAAS,QAAQ,GAAG;AAErC,YAAI,SAAS;AACX,gBAAM,cAAc,QAAQ;AAC5B,gBAAM,eAAe,QAAQ;AAC7B,gBAAM,YAAY,QAAQ;AAC1B,gBAAM,UAAU,QAAQ;AAAA,QAC1B;AAGA,YAAI,SAAS;AACX,gBAAM,iBAAiB;AACvB,gBAAM,QAAQ,eAAe;AAC7B,gBAAM,WAAW,eAAe;AAChC,gBAAM,gBAAgB,eAAe;AAAA,QACvC;AAGA,YAAI,QAAQ,WAAW,KAAK;AAC1B,iBAAO,QAAQ,UAAU,IAAI,EAAE,OAAO,SAAS,QAAQ,CAAQ;AAAA,QACjE;AAEA,eAAO;AAAA,MACT;AAAA,MAEA,MAAM,QAAQ,EAAE,SAAS,MAAM,GAAG;AAEhC,gBAAQ,cAAc,MAAM;AAC5B,gBAAQ,UAAU,MAAM;AAExB,YAAI,QAAQ,MAAM;AAChB,kBAAQ,KAAK,QAAQ,MAAM;AAC3B,kBAAQ,KAAK,OAAO,MAAM;AAC1B,kBAAQ,KAAK,WAAW,MAAM;AAC9B,kBAAQ,KAAK,gBAAgB,MAAM;AAAA,QACrC;AAGA,YAAI,QAAQ,WAAW,SAAS;AAC9B,iBAAO,QAAQ,UAAU,QAAQ,EAAE,SAAS,MAAM,CAAQ;AAAA,QAC5D;AAEA,eAAO;AAAA,MACT;AAAA,MAEA,GAAG,QAAQ;AAAA,IACb;AAAA,IAEA,OAAO;AAAA,MACL,QAAQ;AAAA,MACR,SAAS;AAAA,MACT,OAAO;AAAA,MACP,GAAG,QAAQ;AAAA,IACb;AAAA,IAEA,SAAS;AAAA,MACP,UAAU;AAAA,MACV,GAAG,QAAQ;AAAA,IACb;AAAA,IAEA,OAAO,QAAQ,SAAS,QAAQ,IAAI,aAAa;AAAA,IAEjD,QAAQ,QAAQ,IAAI;AAAA,EACtB;AAGA,SAAO;AAAA,IACL,MAAM;AAAA,IACN,UAAU,SAAS,WAAW;AAAA,EAChC;AACF;AAKO,SAAS,eAAe,aAA8B;AAC3D,QAAM,UAAU,SAAS,WAAW;AACpC,SAAO,EAAE,KAAK,SAAS,MAAM,QAAQ;AACvC;AASO,IAAM,mBAAmB;AAKhC,eAAsB,mBAAmB,OAAY,UAAkB,cAAsB,QAAiB;AAC5G,MAAI;AACF,UAAM,UAAU,UAAU,QAAQ,IAAI,kBAAkB;AACxD,UAAM,WAAW,GAAG,OAAO;AAG3B,UAAM,eAAoB;AAAA,MACxB,QAAQ;AAAA,MACR,SAAS;AAAA,QACP,gBAAgB;AAAA,MAClB;AAAA,MACA,MAAM,IAAI,gBAAgB;AAAA,QACxB,YAAY;AAAA,QACZ,eAAe,MAAM;AAAA,QACrB,WAAW;AAAA,QACX,eAAe;AAAA,MACjB,CAAC;AAAA,IACH;AAGA,QAAI,QAAQ,IAAI,aAAa,gBAAgB,SAAS,WAAW,UAAU,GAAG;AAC5E,YAAMC,SAAQ,MAAM,OAAO,OAAO;AAClC,mBAAa,QAAQ,IAAIA,OAAM,MAAM;AAAA,QACnC,oBAAoB;AAAA,MACtB,CAAC;AAAA,IACH;AAEA,UAAM,WAAW,MAAM,MAAM,UAAU,YAAY;AACnD,UAAM,kBAAkB,MAAM,SAAS,KAAK;AAE5C,QAAI,CAAC,SAAS,IAAI;AAChB,YAAM;AAAA,IACR;AAEA,WAAO;AAAA,MACL,GAAG;AAAA,MACH,aAAa,gBAAgB;AAAA,MAC7B,cAAc,gBAAgB,iBAAiB,MAAM;AAAA;AAAA,MAErD,WAAW,KAAK,MAAM,KAAK,IAAI,IAAI,GAAI,KAAK,gBAAgB,cAAc;AAAA;AAAA,MAE1E,OAAO;AAAA,IACT;AAAA,EACF,SAAS,OAAO;AACd,YAAQ,MAAM,mCAAmC,KAAK;AACtD,WAAO;AAAA,MACL,GAAG;AAAA,MACH,OAAO;AAAA,IACT;AAAA,EACF;AACF;;;AD3LA,IAAAC,oBAAoC;;;AILpC,oBAA0C;AAC1C,iBAAyB;AAiBlB,SAAS,gBAAgB,UAA8B,CAAC,GAAG;AAChE,SAAO,eAAe,WAAW,KAAkB;AACjD,UAAM,QAAQ,UAAM,qBAAS;AAAA,MAC3B;AAAA,MACA,QAAQ,QAAQ,IAAI;AAAA,IACtB,CAAC;AAED,UAAM,WAAW,IAAI,QAAQ;AAG7B,QAAI,QAAQ,aAAa,KAAK,UAAQ,SAAS,WAAW,IAAI,CAAC,GAAG;AAChE,aAAO,2BAAa,KAAK;AAAA,IAC3B;AAGA,UAAM,kBAAkB,QAAQ,iBAC5B,QAAQ,eAAe,KAAK,UAAQ,SAAS,WAAW,IAAI,CAAC,IAC7D;AAEJ,QAAI,CAAC,iBAAiB;AACpB,aAAO,2BAAa,KAAK;AAAA,IAC3B;AAGA,QAAI,eAAe,CAAC,CAAC;AAErB,QAAI,QAAQ,WAAW,YAAY;AACjC,qBAAe,MAAM,QAAQ,UAAU,WAAW,EAAE,OAAO,IAAI,CAAC;AAAA,IAClE;AAEA,QAAI,CAAC,cAAc;AACjB,YAAM,YAAY,QAAQ,OAAO,UAAU;AAC3C,YAAM,MAAM,IAAI,IAAI,WAAW,IAAI,GAAG;AACtC,UAAI,aAAa,IAAI,eAAe,QAAQ;AAC5C,aAAO,2BAAa,SAAS,GAAG;AAAA,IAClC;AAEA,WAAO,2BAAa,KAAK;AAAA,EAC3B;AACF;AAKO,SAAS,uBACd,iBAA2B,CAAC,YAAY,GACxC,cAAwB,CAAC,SAAS,WAAW,GAC7C;AACA,SAAO;AAAA,IACL,SAAS;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA,MAQP;AAAA,IACF;AAAA,IACA;AAAA,IACA;AAAA,EACF;AACF;;;AChFA,IAAAC,iBAA0C;AAC1C,mBAAkB;AAClB,IAAAC,cAAuB;AAyDhB,SAAS,yBAAyB,UAAqC,CAAC,GAAG;AAChF,SAAO,eAAe,IAAI,SAAsB;AAC9C,UAAM;AAAA,MACJ,SAAS,QAAQ,IAAI,kBAAkB;AAAA,MACvC,WAAW,QAAQ,IAAI;AAAA,MACvB,eAAe,QAAQ,IAAI;AAAA,MAC3B,UAAU,QAAQ,IAAI;AAAA,MACtB,iBAAiB,QAAQ,IAAI;AAAA,MAC7B,cAAc;AAAA,MACd,WAAW;AAAA,IACb,IAAI;AAEJ,QAAI,CAAC,YAAY,CAAC,cAAc;AAC9B,cAAQ,MAAM,yCAAyC;AACvD,aAAO,4BAAa,SAAS,IAAI,IAAI,GAAG,QAAQ,8BAA8B,QAAQ,GAAG,CAAC;AAAA,IAC5F;AAEA,QAAI,CAAC,gBAAgB;AACnB,cAAQ,MAAM,6BAA6B;AAC3C,aAAO,4BAAa,SAAS,IAAI,IAAI,GAAG,QAAQ,yBAAyB,QAAQ,GAAG,CAAC;AAAA,IACvF;AAEA,UAAM,eAAe,QAAQ,QAAQ;AACrC,UAAM,OAAO,aAAa,IAAI,MAAM;AAEpC,QAAI,CAAC,MAAM;AACT,aAAO,4BAAa,SAAS,IAAI,IAAI,GAAG,QAAQ,uBAAuB,QAAQ,GAAG,CAAC;AAAA,IACrF;AAEA,QAAI;AAEF,YAAM,gBAAgB,GAAG,MAAM;AAE/B,YAAM,OAAO,IAAI,gBAAgB;AAAA,QAC/B,YAAY;AAAA,QACZ;AAAA,QACA,cAAc,GAAG,OAAO;AAAA,QACxB,WAAW;AAAA,QACX,eAAe;AAAA,MACjB,CAAC;AAGD,YAAM,eAA4B;AAAA,QAChC,QAAQ;AAAA,QACR,SAAS;AAAA,UACP,gBAAgB;AAAA,QAClB;AAAA,QACA,MAAM,KAAK,SAAS;AAAA,MACtB;AAEA,UAAI,QAAQ,IAAI,aAAa,cAAc;AACzC,cAAM,QAAQ,IAAI,aAAAC,QAAM,MAAM;AAAA,UAC5B,oBAAoB;AAAA,QACtB,CAAC;AACD,QAAC,aAAqB,QAAQ;AAAA,MAChC;AAEA,YAAM,gBAAgB,MAAM,MAAM,eAAe,YAAY;AAC7D,YAAM,SAAS,MAAM,cAAc,KAAK;AAExC,UAAI,CAAC,cAAc,IAAI;AACrB,gBAAQ,MAAM,0BAA0B,MAAM;AAC9C,eAAO,4BAAa,SAAS,IAAI,IAAI,GAAG,QAAQ,gCAAgC,QAAQ,GAAG,CAAC;AAAA,MAC9F;AAGA,YAAM,mBAAmB,GAAG,MAAM;AAClC,YAAM,mBAAmB,MAAM,MAAM,kBAAkB;AAAA,QACrD,SAAS;AAAA,UACP,iBAAiB,UAAU,OAAO,YAAY;AAAA,QAChD;AAAA,QACA,GAAI,QAAQ,IAAI,aAAa,eAAe;AAAA,UAC1C,OAAO,IAAI,aAAAA,QAAM,MAAM,EAAE,oBAAoB,MAAM,CAAC;AAAA,QACtD,IAAW,CAAC;AAAA,MACd,CAAC;AAED,YAAM,WAAW,MAAM,iBAAiB,KAAK;AAG7C,YAAM,eAAe,UAAM,oBAAO;AAAA,QAChC,OAAO;AAAA,UACL,aAAa,OAAO;AAAA,UACpB,cAAc,OAAO;AAAA,UACrB,WAAW,KAAK,MAAM,KAAK,IAAI,IAAI,GAAI,KAAK,OAAO,cAAc;AAAA,UACjE,SAAS,OAAO;AAAA,UAChB,OAAO,SAAS;AAAA,UAChB,UAAU,SAAS;AAAA,UACnB,MAAM,SAAS;AAAA,UACf,KAAK,SAAS;AAAA,QAChB;AAAA,QACA,QAAQ;AAAA,MACV,CAAC;AAED,YAAM,mBAAmB,4BAAa,SAAS,IAAI,IAAI,aAAa,QAAQ,GAAG,CAAC;AAGhF,YAAM,aAAa,QAAQ,IAAI,aAAa,eACxC,qCACA;AAEJ,uBAAiB,QAAQ,IAAI,YAAY,cAAc;AAAA,QACrD,UAAU;AAAA,QACV,QAAQ,QAAQ,IAAI,aAAa;AAAA,QACjC,UAAU;AAAA,QACV,QAAQ,KAAK,KAAK,KAAK;AAAA;AAAA,QACvB,MAAM;AAAA,MACR,CAAC;AAED,aAAO;AAAA,IACT,SAAS,OAAO;AACd,cAAQ,MAAM,yBAAyB,KAAK;AAC5C,aAAO,4BAAa,SAAS,IAAI,IAAI,GAAG,QAAQ,0BAA0B,QAAQ,GAAG,CAAC;AAAA,IACxF;AAAA,EACF;AACF;","names":["import_next_auth","getNextAuthSession","NextAuthDefault","https","import_next_auth","import_server","import_jwt","https"]}

package/dist/server/index.mjs

@@ -126,6 +126,7 @@ function createAuth(options = {}) {
         session.idToken = token.idToken;
         if (session.user) {
           session.user.email = token.email;
+          session.user.name = token.name;
           session.user.username = token.username;
           session.user.emailVerified = token.emailVerified;
         }

package/dist/server/index.mjs.map

@@ -1 +1 @@
-{"version":3,"sources":["../../src/server/auth.ts","../../src/provider.ts","../../src/server/session.ts","../../src/server/index.ts","../../src/server/middleware.ts","../../src/server/hosted-auth-callback.ts"],"sourcesContent":["import NextAuthDefault from 'next-auth';\nimport type { NextAuthOptions } from 'next-auth';\nimport { OAuth42Provider, OAuth42Profile } from '../provider';\nimport { getOAuth42Session } from './session';\n\n// Handle both CommonJS and ESM exports\nconst NextAuth = (NextAuthDefault as any).default || NextAuthDefault;\n\nexport { type NextAuthOptions };\n\nexport interface CreateAuthOptions {\n  clientId?: string;\n  clientSecret?: string;\n  issuer?: string;\n  scopes?: string[];\n  pkceEnabled?: boolean;\n  debug?: boolean;\n  callbacks?: NextAuthOptions['callbacks'];\n  pages?: NextAuthOptions['pages'];\n  session?: NextAuthOptions['session'];\n}\n\n/**\n * Create a pre-configured NextAuth instance for OAuth42\n * This provides a simplified setup with sensible defaults\n */\nexport function createAuth(options: CreateAuthOptions = {}) {\n  const clientId = options.clientId || process.env.OAUTH42_CLIENT_ID;\n  const clientSecret = options.clientSecret || process.env.OAUTH42_CLIENT_SECRET;\n  \n  if (!clientId || !clientSecret) {\n    throw new Error(\n      'OAuth42 client credentials are required. ' +\n      'Set OAUTH42_CLIENT_ID and OAUTH42_CLIENT_SECRET environment variables ' +\n      'or pass them in the options.'\n    );\n  }\n  \n  const authOptions: NextAuthOptions = {\n    providers: [\n      OAuth42Provider({\n        clientId,\n        clientSecret,\n        issuer: options.issuer,\n        scopes: options.scopes,\n        pkceEnabled: options.pkceEnabled,\n      }),\n    ],\n    \n    callbacks: {\n      async jwt({ token, account, profile }) {\n        // Store OAuth tokens in the JWT\n        if (account) {\n          token.accessToken = account.access_token;\n          token.refreshToken = account.refresh_token;\n          token.expiresAt = account.expires_at;\n          token.idToken = account.id_token;\n        }\n        \n        // Add user profile data\n        if (profile) {\n          const oauth42Profile = profile as OAuth42Profile;\n          token.email = oauth42Profile.email;\n          token.username = oauth42Profile.username;\n          token.emailVerified = oauth42Profile.email_verified;\n        }\n        \n        // Call custom callback if provided\n        if (options.callbacks?.jwt) {\n          return options.callbacks.jwt({ token, account, profile } as any);\n        }\n        \n        return token;\n      },\n      \n      async session({ session, token }) {\n        // Add OAuth42-specific data to session\n        session.accessToken = token.accessToken as string;\n        session.idToken = token.idToken as string;\n        \n        if (session.user) {\n          session.user.email = token.email as string;\n          session.user.username = token.username as string;\n          session.user.emailVerified = token.emailVerified as boolean;\n        }\n        \n        // Call custom callback if provided\n        if (options.callbacks?.session) {\n          return options.callbacks.session({ session, token } as any);\n        }\n        \n        return session;\n      },\n      \n      ...options.callbacks,\n    },\n    \n    pages: {\n      signIn: '/auth/signin',\n      signOut: '/auth/signout',\n      error: '/auth/error',\n      ...options.pages,\n    },\n    \n    session: {\n      strategy: 'jwt',\n      ...options.session,\n    },\n    \n    debug: options.debug || process.env.NODE_ENV === 'development',\n    \n    secret: process.env.NEXTAUTH_SECRET,\n  };\n  \n  // Return the configuration and a function to create handlers\n  return {\n    auth: authOptions,\n    handlers: NextAuth(authOptions),\n  };\n}\n\n/**\n * Create NextAuth handlers for API routes\n */\nexport function createHandlers(authOptions: NextAuthOptions) {\n  const handler = NextAuth(authOptions);\n  return { GET: handler, POST: handler };\n}\n\n/**\n * Helper to get the current session server-side\n * @deprecated Use getOAuth42Session instead - this is now just an alias for backward compatibility\n * \n * This function is maintained for backward compatibility but internally\n * calls getOAuth42Session which properly handles both App Router and Pages Router\n */\nexport const getServerSession = getOAuth42Session;\n\n/**\n * Token refresh helper\n */\nexport async function refreshAccessToken(token: any, clientId: string, clientSecret: string, issuer?: string) {\n  try {\n    const baseUrl = issuer || process.env.OAUTH42_ISSUER || 'https://oauth42.com';\n    const tokenUrl = `${baseUrl}/oauth2/token`;\n    \n    // In development, we need to handle self-signed certificates\n    const fetchOptions: any = {\n      method: 'POST',\n      headers: {\n        'Content-Type': 'application/x-www-form-urlencoded',\n      },\n      body: new URLSearchParams({\n        grant_type: 'refresh_token',\n        refresh_token: token.refreshToken,\n        client_id: clientId,\n        client_secret: clientSecret,\n      }),\n    };\n    \n    // Add agent for self-signed certificates in development\n    if (process.env.NODE_ENV !== 'production' && tokenUrl.startsWith('https://')) {\n      const https = await import('https');\n      fetchOptions.agent = new https.Agent({\n        rejectUnauthorized: false\n      });\n    }\n    \n    const response = await fetch(tokenUrl, fetchOptions);\n    const refreshedTokens = await response.json();\n    \n    if (!response.ok) {\n      throw refreshedTokens;\n    }\n    \n    return {\n      ...token,\n      accessToken: refreshedTokens.access_token,\n      refreshToken: refreshedTokens.refresh_token ?? token.refreshToken,\n      // Store expiration time in seconds (Unix timestamp)\n      expiresAt: Math.floor(Date.now() / 1000) + (refreshedTokens.expires_in || 3600),\n      // Explicitly remove any error property on successful refresh\n      error: undefined,\n    };\n  } catch (error) {\n    console.error('Failed to refresh access token:', error);\n    return {\n      ...token,\n      error: 'RefreshAccessTokenError',\n    };\n  }\n}","import type { OAuthConfig, OAuthUserConfig } from 'next-auth/providers/oauth';\n\nexport interface OAuth42Profile {\n  sub: string;\n  email: string;\n  email_verified?: boolean;\n  name?: string;\n  given_name?: string;\n  family_name?: string;\n  picture?: string;\n  username?: string;\n  id?: string;\n}\n\nexport interface OAuth42ProviderOptions {\n  clientId: string;\n  clientSecret: string;\n  issuer?: string;\n  authorizationUrl?: string;\n  tokenUrl?: string;\n  userinfoUrl?: string;\n  scopes?: string[];\n  pkceEnabled?: boolean;\n}\n\nexport function OAuth42Provider<P extends OAuth42Profile>(\n  options: OAuthUserConfig<P> & Partial<OAuth42ProviderOptions>\n): OAuthConfig<P> {\n  const issuer = options.issuer || process.env.OAUTH42_ISSUER || 'https://oauth42.com';\n  const baseUrl = issuer.replace(/\\/$/, '');\n  \n  return {\n    id: 'oauth42',\n    name: 'OAuth42',\n    type: 'oauth',\n    version: '2.0',\n    \n    // Use OIDC discovery to automatically find endpoints\n    wellKnown: `${baseUrl}/.well-known/openid-configuration`,\n    \n    // Also set individual endpoints for compatibility\n    authorization: {\n      url: `${baseUrl}/oauth2/authorize`,\n      params: {\n        scope: (options.scopes || ['openid', 'profile', 'email']).join(' '),\n        response_type: 'code',\n      },\n    },\n    token: `${baseUrl}/oauth2/token`,\n    userinfo: `${baseUrl}/oauth2/userinfo`,\n    \n    client: {\n      id: options.clientId,\n      secret: options.clientSecret,\n      token_endpoint_auth_method: 'client_secret_post',\n      id_token_signed_response_alg: 'HS256', // OAuth42 uses HS256 for ID tokens\n    },\n    \n    issuer: baseUrl,\n    \n    checks: options.pkceEnabled !== false ? ['pkce', 'state'] : ['state'],\n    \n    profile(profile: OAuth42Profile, tokens: any) {\n      return {\n        id: profile.sub || profile.id || profile.email,\n        email: profile.email,\n        emailVerified: profile.email_verified ? new Date() : null,\n        name: profile.name || `${profile.given_name || ''} ${profile.family_name || ''}`.trim(),\n        image: profile.picture,\n      };\n    },\n    \n    style: {\n      logo: '/oauth42-logo.svg',\n      bg: '#1e40af',\n      text: '#ffffff',\n    },\n    \n    options,\n  };\n}","import { getServerSession as getNextAuthSession } from 'next-auth';\nimport { NextAuthOptions } from 'next-auth';\nimport { GetServerSidePropsContext, NextApiRequest, NextApiResponse } from 'next';\n\n/**\n * Get the OAuth42 session server-side\n * \n * This is the primary method for retrieving sessions in OAuth42 SDK.\n * Supports both Pages Router and App Router:\n * \n * App Router:\n * ```ts\n * const session = await getOAuth42Session(authOptions);\n * ```\n * \n * Pages Router:\n * ```ts\n * const session = await getOAuth42Session(req, res, authOptions);\n * ```\n */\nexport async function getOAuth42Session(\n  ...args: \n    | [GetServerSidePropsContext['req'], GetServerSidePropsContext['res'], NextAuthOptions]\n    | [NextApiRequest, NextApiResponse, NextAuthOptions]\n    | [NextAuthOptions]\n) {\n  return getNextAuthSession(...args as any);\n}\n\n/**\n * Helper for protecting API routes\n */\nexport function withOAuth42Session(\n  handler: (req: NextApiRequest, res: NextApiResponse, session: any) => Promise<void> | void,\n  authOptions: NextAuthOptions\n) {\n  return async (req: NextApiRequest, res: NextApiResponse) => {\n    const session = await getOAuth42Session(req, res, authOptions);\n    \n    if (!session) {\n      return res.status(401).json({ error: 'Unauthorized' });\n    }\n    \n    return handler(req, res, session);\n  };\n}\n\n/**\n * Helper for protecting server-side props\n */\nexport function withOAuth42ServerSideProps(\n  getServerSideProps: (\n    context: GetServerSidePropsContext,\n    session: any\n  ) => Promise<any>,\n  authOptions: NextAuthOptions\n) {\n  return async (context: GetServerSidePropsContext) => {\n    const session = await getOAuth42Session(\n      context.req,\n      context.res,\n      authOptions\n    );\n    \n    if (!session) {\n      return {\n        redirect: {\n          destination: '/auth/signin',\n          permanent: false,\n        },\n      };\n    }\n    \n    return getServerSideProps(context, session);\n  };\n}","// Server-side exports\nexport { createAuth, createHandlers, getServerSession, refreshAccessToken } from './auth';\nexport type { CreateAuthOptions, NextAuthOptions } from './auth';\n\n// Re-export NextAuth from next-auth\nexport { default as NextAuth } from 'next-auth';\n\n// Re-export OAuth42Provider\nexport { OAuth42Provider } from '../provider';\n\nexport { withOAuth42Auth, createMiddlewareConfig } from './middleware';\nexport type { OAuth42AuthOptions } from './middleware';\n\nexport { getOAuth42Session, withOAuth42Session, withOAuth42ServerSideProps } from './session';\n\n// Hosted auth callback handler\nexport { createHostedAuthCallback } from './hosted-auth-callback';\nexport type { HostedAuthCallbackOptions } from './hosted-auth-callback';","import { NextRequest, NextResponse } from 'next/server';\nimport { getToken } from 'next-auth/jwt';\n\nexport interface OAuth42AuthOptions {\n  pages?: {\n    signIn?: string;\n    error?: string;\n  };\n  callbacks?: {\n    authorized?: (params: { token: any; req: NextRequest }) => boolean | Promise<boolean>;\n  };\n  protectedPaths?: string[];\n  publicPaths?: string[];\n}\n\n/**\n * Middleware helper for protecting routes with OAuth42\n */\nexport function withOAuth42Auth(options: OAuth42AuthOptions = {}) {\n  return async function middleware(req: NextRequest) {\n    const token = await getToken({ \n      req: req as any, \n      secret: process.env.NEXTAUTH_SECRET \n    });\n    \n    const pathname = req.nextUrl.pathname;\n    \n    // Check if path is explicitly public\n    if (options.publicPaths?.some(path => pathname.startsWith(path))) {\n      return NextResponse.next();\n    }\n    \n    // Check if path needs protection\n    const needsProtection = options.protectedPaths\n      ? options.protectedPaths.some(path => pathname.startsWith(path))\n      : true; // Default to protecting all paths\n    \n    if (!needsProtection) {\n      return NextResponse.next();\n    }\n    \n    // Check authorization\n    let isAuthorized = !!token;\n    \n    if (options.callbacks?.authorized) {\n      isAuthorized = await options.callbacks.authorized({ token, req });\n    }\n    \n    if (!isAuthorized) {\n      const signInUrl = options.pages?.signIn || '/auth/signin';\n      const url = new URL(signInUrl, req.url);\n      url.searchParams.set('callbackUrl', pathname);\n      return NextResponse.redirect(url);\n    }\n    \n    return NextResponse.next();\n  };\n}\n\n/**\n * Helper to create middleware configuration\n */\nexport function createMiddlewareConfig(\n  protectedPaths: string[] = ['/protected'],\n  publicPaths: string[] = ['/auth', '/api/auth']\n) {\n  return {\n    matcher: [\n      /*\n       * Match all request paths except for the ones starting with:\n       * - _next/static (static files)\n       * - _next/image (image optimization files)\n       * - favicon.ico (favicon file)\n       * - public folder\n       */\n      '/((?!_next/static|_next/image|favicon.ico|public).*)',\n    ],\n    protectedPaths,\n    publicPaths,\n  };\n}","import { NextRequest, NextResponse } from 'next/server';\nimport https from 'https';\nimport { encode } from 'next-auth/jwt';\n\nexport interface HostedAuthCallbackOptions {\n  /**\n   * OAuth42 issuer URL (e.g., 'https://api.oauth42.com' or 'https://localhost:8443')\n   */\n  issuer?: string;\n\n  /**\n   * OAuth2 client ID\n   */\n  clientId?: string;\n\n  /**\n   * OAuth2 client secret\n   */\n  clientSecret?: string;\n\n  /**\n   * Application base URL (e.g., 'http://localhost:3000')\n   */\n  baseUrl?: string;\n\n  /**\n   * NextAuth secret for JWT encoding\n   */\n  nextAuthSecret?: string;\n\n  /**\n   * URL to redirect to after successful authentication\n   * @default '/dashboard'\n   */\n  redirectUrl?: string;\n\n  /**\n   * URL to redirect to on error\n   * @default '/'\n   */\n  errorUrl?: string;\n}\n\n/**\n * Creates a handler for OAuth42 hosted auth callback that integrates with NextAuth.\n *\n * This function handles the OAuth callback, exchanges the authorization code for tokens,\n * fetches user info, and creates a NextAuth-compatible session cookie.\n *\n * @example\n * ```typescript\n * // app/api/oauth/callback/route.ts\n * import { createHostedAuthCallback } from '@oauth42/next/server';\n *\n * export const GET = createHostedAuthCallback({\n *   redirectUrl: '/dashboard',\n * });\n * ```\n */\nexport function createHostedAuthCallback(options: HostedAuthCallbackOptions = {}) {\n  return async function GET(request: NextRequest) {\n    const {\n      issuer = process.env.OAUTH42_ISSUER || 'https://api.oauth42.com',\n      clientId = process.env.OAUTH42_CLIENT_ID,\n      clientSecret = process.env.OAUTH42_CLIENT_SECRET,\n      baseUrl = process.env.NEXTAUTH_URL,\n      nextAuthSecret = process.env.NEXTAUTH_SECRET,\n      redirectUrl = '/dashboard',\n      errorUrl = '/',\n    } = options;\n\n    if (!clientId || !clientSecret) {\n      console.error('OAuth42 client credentials are required');\n      return NextResponse.redirect(new URL(`${errorUrl}?error=missing_credentials`, request.url));\n    }\n\n    if (!nextAuthSecret) {\n      console.error('NEXTAUTH_SECRET is required');\n      return NextResponse.redirect(new URL(`${errorUrl}?error=missing_secret`, request.url));\n    }\n\n    const searchParams = request.nextUrl.searchParams;\n    const code = searchParams.get('code');\n\n    if (!code) {\n      return NextResponse.redirect(new URL(`${errorUrl}?error=missing_code`, request.url));\n    }\n\n    try {\n      // Exchange authorization code for tokens\n      const tokenEndpoint = `${issuer}/oauth2/token`;\n\n      const body = new URLSearchParams({\n        grant_type: 'authorization_code',\n        code,\n        redirect_uri: `${baseUrl}/api/oauth/callback`,\n        client_id: clientId,\n        client_secret: clientSecret,\n      });\n\n      // For development, use custom agent to disable SSL verification\n      const fetchOptions: RequestInit = {\n        method: 'POST',\n        headers: {\n          'Content-Type': 'application/x-www-form-urlencoded',\n        },\n        body: body.toString(),\n      };\n\n      if (process.env.NODE_ENV !== 'production') {\n        const agent = new https.Agent({\n          rejectUnauthorized: false,\n        });\n        (fetchOptions as any).agent = agent;\n      }\n\n      const tokenResponse = await fetch(tokenEndpoint, fetchOptions);\n      const tokens = await tokenResponse.json();\n\n      if (!tokenResponse.ok) {\n        console.error('Token exchange failed:', tokens);\n        return NextResponse.redirect(new URL(`${errorUrl}?error=token_exchange_failed`, request.url));\n      }\n\n      // Fetch user info\n      const userInfoEndpoint = `${issuer}/oauth2/userinfo`;\n      const userInfoResponse = await fetch(userInfoEndpoint, {\n        headers: {\n          'Authorization': `Bearer ${tokens.access_token}`,\n        },\n        ...(process.env.NODE_ENV !== 'production' ? {\n          agent: new https.Agent({ rejectUnauthorized: false })\n        } as any : {})\n      });\n\n      const userInfo = await userInfoResponse.json();\n\n      // Create NextAuth-compatible session token\n      const sessionToken = await encode({\n        token: {\n          accessToken: tokens.access_token,\n          refreshToken: tokens.refresh_token,\n          expiresAt: Math.floor(Date.now() / 1000) + (tokens.expires_in || 3600),\n          idToken: tokens.id_token,\n          email: userInfo.email,\n          username: userInfo.username,\n          name: userInfo.name,\n          sub: userInfo.sub,\n        },\n        secret: nextAuthSecret,\n      });\n\n      const redirectResponse = NextResponse.redirect(new URL(redirectUrl, request.url));\n\n      // Set NextAuth session cookie\n      const cookieName = process.env.NODE_ENV === 'production'\n        ? '__Secure-next-auth.session-token'\n        : 'next-auth.session-token';\n\n      redirectResponse.cookies.set(cookieName, sessionToken, {\n        httpOnly: true,\n        secure: process.env.NODE_ENV === 'production',\n        sameSite: 'lax',\n        maxAge: 60 * 60 * 24 * 30, // 30 days\n        path: '/',\n      });\n\n      return redirectResponse;\n    } catch (error) {\n      console.error('OAuth callback error:', error);\n      return NextResponse.redirect(new URL(`${errorUrl}?error=callback_failed`, request.url));\n    }\n  };\n}\n"],"mappings":";AAAA,OAAO,qBAAqB;;;ACyBrB,SAAS,gBACd,SACgB;AAChB,QAAM,SAAS,QAAQ,UAAU,QAAQ,IAAI,kBAAkB;AAC/D,QAAM,UAAU,OAAO,QAAQ,OAAO,EAAE;AAExC,SAAO;AAAA,IACL,IAAI;AAAA,IACJ,MAAM;AAAA,IACN,MAAM;AAAA,IACN,SAAS;AAAA;AAAA,IAGT,WAAW,GAAG,OAAO;AAAA;AAAA,IAGrB,eAAe;AAAA,MACb,KAAK,GAAG,OAAO;AAAA,MACf,QAAQ;AAAA,QACN,QAAQ,QAAQ,UAAU,CAAC,UAAU,WAAW,OAAO,GAAG,KAAK,GAAG;AAAA,QAClE,eAAe;AAAA,MACjB;AAAA,IACF;AAAA,IACA,OAAO,GAAG,OAAO;AAAA,IACjB,UAAU,GAAG,OAAO;AAAA,IAEpB,QAAQ;AAAA,MACN,IAAI,QAAQ;AAAA,MACZ,QAAQ,QAAQ;AAAA,MAChB,4BAA4B;AAAA,MAC5B,8BAA8B;AAAA;AAAA,IAChC;AAAA,IAEA,QAAQ;AAAA,IAER,QAAQ,QAAQ,gBAAgB,QAAQ,CAAC,QAAQ,OAAO,IAAI,CAAC,OAAO;AAAA,IAEpE,QAAQ,SAAyB,QAAa;AAC5C,aAAO;AAAA,QACL,IAAI,QAAQ,OAAO,QAAQ,MAAM,QAAQ;AAAA,QACzC,OAAO,QAAQ;AAAA,QACf,eAAe,QAAQ,iBAAiB,oBAAI,KAAK,IAAI;AAAA,QACrD,MAAM,QAAQ,QAAQ,GAAG,QAAQ,cAAc,EAAE,IAAI,QAAQ,eAAe,EAAE,GAAG,KAAK;AAAA,QACtF,OAAO,QAAQ;AAAA,MACjB;AAAA,IACF;AAAA,IAEA,OAAO;AAAA,MACL,MAAM;AAAA,MACN,IAAI;AAAA,MACJ,MAAM;AAAA,IACR;AAAA,IAEA;AAAA,EACF;AACF;;;AChFA,SAAS,oBAAoB,0BAA0B;AAoBvD,eAAsB,qBACjB,MAIH;AACA,SAAO,mBAAmB,GAAG,IAAW;AAC1C;AAKO,SAAS,mBACd,SACA,aACA;AACA,SAAO,OAAO,KAAqB,QAAyB;AAC1D,UAAM,UAAU,MAAM,kBAAkB,KAAK,KAAK,WAAW;AAE7D,QAAI,CAAC,SAAS;AACZ,aAAO,IAAI,OAAO,GAAG,EAAE,KAAK,EAAE,OAAO,eAAe,CAAC;AAAA,IACvD;AAEA,WAAO,QAAQ,KAAK,KAAK,OAAO;AAAA,EAClC;AACF;AAKO,SAAS,2BACd,oBAIA,aACA;AACA,SAAO,OAAO,YAAuC;AACnD,UAAM,UAAU,MAAM;AAAA,MACpB,QAAQ;AAAA,MACR,QAAQ;AAAA,MACR;AAAA,IACF;AAEA,QAAI,CAAC,SAAS;AACZ,aAAO;AAAA,QACL,UAAU;AAAA,UACR,aAAa;AAAA,UACb,WAAW;AAAA,QACb;AAAA,MACF;AAAA,IACF;AAEA,WAAO,mBAAmB,SAAS,OAAO;AAAA,EAC5C;AACF;;;AFrEA,IAAM,WAAY,gBAAwB,WAAW;AAoB9C,SAAS,WAAW,UAA6B,CAAC,GAAG;AAC1D,QAAM,WAAW,QAAQ,YAAY,QAAQ,IAAI;AACjD,QAAM,eAAe,QAAQ,gBAAgB,QAAQ,IAAI;AAEzD,MAAI,CAAC,YAAY,CAAC,cAAc;AAC9B,UAAM,IAAI;AAAA,MACR;AAAA,IAGF;AAAA,EACF;AAEA,QAAM,cAA+B;AAAA,IACnC,WAAW;AAAA,MACT,gBAAgB;AAAA,QACd;AAAA,QACA;AAAA,QACA,QAAQ,QAAQ;AAAA,QAChB,QAAQ,QAAQ;AAAA,QAChB,aAAa,QAAQ;AAAA,MACvB,CAAC;AAAA,IACH;AAAA,IAEA,WAAW;AAAA,MACT,MAAM,IAAI,EAAE,OAAO,SAAS,QAAQ,GAAG;AAErC,YAAI,SAAS;AACX,gBAAM,cAAc,QAAQ;AAC5B,gBAAM,eAAe,QAAQ;AAC7B,gBAAM,YAAY,QAAQ;AAC1B,gBAAM,UAAU,QAAQ;AAAA,QAC1B;AAGA,YAAI,SAAS;AACX,gBAAM,iBAAiB;AACvB,gBAAM,QAAQ,eAAe;AAC7B,gBAAM,WAAW,eAAe;AAChC,gBAAM,gBAAgB,eAAe;AAAA,QACvC;AAGA,YAAI,QAAQ,WAAW,KAAK;AAC1B,iBAAO,QAAQ,UAAU,IAAI,EAAE,OAAO,SAAS,QAAQ,CAAQ;AAAA,QACjE;AAEA,eAAO;AAAA,MACT;AAAA,MAEA,MAAM,QAAQ,EAAE,SAAS,MAAM,GAAG;AAEhC,gBAAQ,cAAc,MAAM;AAC5B,gBAAQ,UAAU,MAAM;AAExB,YAAI,QAAQ,MAAM;AAChB,kBAAQ,KAAK,QAAQ,MAAM;AAC3B,kBAAQ,KAAK,WAAW,MAAM;AAC9B,kBAAQ,KAAK,gBAAgB,MAAM;AAAA,QACrC;AAGA,YAAI,QAAQ,WAAW,SAAS;AAC9B,iBAAO,QAAQ,UAAU,QAAQ,EAAE,SAAS,MAAM,CAAQ;AAAA,QAC5D;AAEA,eAAO;AAAA,MACT;AAAA,MAEA,GAAG,QAAQ;AAAA,IACb;AAAA,IAEA,OAAO;AAAA,MACL,QAAQ;AAAA,MACR,SAAS;AAAA,MACT,OAAO;AAAA,MACP,GAAG,QAAQ;AAAA,IACb;AAAA,IAEA,SAAS;AAAA,MACP,UAAU;AAAA,MACV,GAAG,QAAQ;AAAA,IACb;AAAA,IAEA,OAAO,QAAQ,SAAS,QAAQ,IAAI,aAAa;AAAA,IAEjD,QAAQ,QAAQ,IAAI;AAAA,EACtB;AAGA,SAAO;AAAA,IACL,MAAM;AAAA,IACN,UAAU,SAAS,WAAW;AAAA,EAChC;AACF;AAKO,SAAS,eAAe,aAA8B;AAC3D,QAAM,UAAU,SAAS,WAAW;AACpC,SAAO,EAAE,KAAK,SAAS,MAAM,QAAQ;AACvC;AASO,IAAM,mBAAmB;AAKhC,eAAsB,mBAAmB,OAAY,UAAkB,cAAsB,QAAiB;AAC5G,MAAI;AACF,UAAM,UAAU,UAAU,QAAQ,IAAI,kBAAkB;AACxD,UAAM,WAAW,GAAG,OAAO;AAG3B,UAAM,eAAoB;AAAA,MACxB,QAAQ;AAAA,MACR,SAAS;AAAA,QACP,gBAAgB;AAAA,MAClB;AAAA,MACA,MAAM,IAAI,gBAAgB;AAAA,QACxB,YAAY;AAAA,QACZ,eAAe,MAAM;AAAA,QACrB,WAAW;AAAA,QACX,eAAe;AAAA,MACjB,CAAC;AAAA,IACH;AAGA,QAAI,QAAQ,IAAI,aAAa,gBAAgB,SAAS,WAAW,UAAU,GAAG;AAC5E,YAAMA,SAAQ,MAAM,OAAO,OAAO;AAClC,mBAAa,QAAQ,IAAIA,OAAM,MAAM;AAAA,QACnC,oBAAoB;AAAA,MACtB,CAAC;AAAA,IACH;AAEA,UAAM,WAAW,MAAM,MAAM,UAAU,YAAY;AACnD,UAAM,kBAAkB,MAAM,SAAS,KAAK;AAE5C,QAAI,CAAC,SAAS,IAAI;AAChB,YAAM;AAAA,IACR;AAEA,WAAO;AAAA,MACL,GAAG;AAAA,MACH,aAAa,gBAAgB;AAAA,MAC7B,cAAc,gBAAgB,iBAAiB,MAAM;AAAA;AAAA,MAErD,WAAW,KAAK,MAAM,KAAK,IAAI,IAAI,GAAI,KAAK,gBAAgB,cAAc;AAAA;AAAA,MAE1E,OAAO;AAAA,IACT;AAAA,EACF,SAAS,OAAO;AACd,YAAQ,MAAM,mCAAmC,KAAK;AACtD,WAAO;AAAA,MACL,GAAG;AAAA,MACH,OAAO;AAAA,IACT;AAAA,EACF;AACF;;;AG1LA,SAAoB,WAAXC,gBAA2B;;;ACLpC,SAAsB,oBAAoB;AAC1C,SAAS,gBAAgB;AAiBlB,SAAS,gBAAgB,UAA8B,CAAC,GAAG;AAChE,SAAO,eAAe,WAAW,KAAkB;AACjD,UAAM,QAAQ,MAAM,SAAS;AAAA,MAC3B;AAAA,MACA,QAAQ,QAAQ,IAAI;AAAA,IACtB,CAAC;AAED,UAAM,WAAW,IAAI,QAAQ;AAG7B,QAAI,QAAQ,aAAa,KAAK,UAAQ,SAAS,WAAW,IAAI,CAAC,GAAG;AAChE,aAAO,aAAa,KAAK;AAAA,IAC3B;AAGA,UAAM,kBAAkB,QAAQ,iBAC5B,QAAQ,eAAe,KAAK,UAAQ,SAAS,WAAW,IAAI,CAAC,IAC7D;AAEJ,QAAI,CAAC,iBAAiB;AACpB,aAAO,aAAa,KAAK;AAAA,IAC3B;AAGA,QAAI,eAAe,CAAC,CAAC;AAErB,QAAI,QAAQ,WAAW,YAAY;AACjC,qBAAe,MAAM,QAAQ,UAAU,WAAW,EAAE,OAAO,IAAI,CAAC;AAAA,IAClE;AAEA,QAAI,CAAC,cAAc;AACjB,YAAM,YAAY,QAAQ,OAAO,UAAU;AAC3C,YAAM,MAAM,IAAI,IAAI,WAAW,IAAI,GAAG;AACtC,UAAI,aAAa,IAAI,eAAe,QAAQ;AAC5C,aAAO,aAAa,SAAS,GAAG;AAAA,IAClC;AAEA,WAAO,aAAa,KAAK;AAAA,EAC3B;AACF;AAKO,SAAS,uBACd,iBAA2B,CAAC,YAAY,GACxC,cAAwB,CAAC,SAAS,WAAW,GAC7C;AACA,SAAO;AAAA,IACL,SAAS;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA,MAQP;AAAA,IACF;AAAA,IACA;AAAA,IACA;AAAA,EACF;AACF;;;AChFA,SAAsB,gBAAAC,qBAAoB;AAC1C,OAAO,WAAW;AAClB,SAAS,cAAc;AAyDhB,SAAS,yBAAyB,UAAqC,CAAC,GAAG;AAChF,SAAO,eAAe,IAAI,SAAsB;AAC9C,UAAM;AAAA,MACJ,SAAS,QAAQ,IAAI,kBAAkB;AAAA,MACvC,WAAW,QAAQ,IAAI;AAAA,MACvB,eAAe,QAAQ,IAAI;AAAA,MAC3B,UAAU,QAAQ,IAAI;AAAA,MACtB,iBAAiB,QAAQ,IAAI;AAAA,MAC7B,cAAc;AAAA,MACd,WAAW;AAAA,IACb,IAAI;AAEJ,QAAI,CAAC,YAAY,CAAC,cAAc;AAC9B,cAAQ,MAAM,yCAAyC;AACvD,aAAOA,cAAa,SAAS,IAAI,IAAI,GAAG,QAAQ,8BAA8B,QAAQ,GAAG,CAAC;AAAA,IAC5F;AAEA,QAAI,CAAC,gBAAgB;AACnB,cAAQ,MAAM,6BAA6B;AAC3C,aAAOA,cAAa,SAAS,IAAI,IAAI,GAAG,QAAQ,yBAAyB,QAAQ,GAAG,CAAC;AAAA,IACvF;AAEA,UAAM,eAAe,QAAQ,QAAQ;AACrC,UAAM,OAAO,aAAa,IAAI,MAAM;AAEpC,QAAI,CAAC,MAAM;AACT,aAAOA,cAAa,SAAS,IAAI,IAAI,GAAG,QAAQ,uBAAuB,QAAQ,GAAG,CAAC;AAAA,IACrF;AAEA,QAAI;AAEF,YAAM,gBAAgB,GAAG,MAAM;AAE/B,YAAM,OAAO,IAAI,gBAAgB;AAAA,QAC/B,YAAY;AAAA,QACZ;AAAA,QACA,cAAc,GAAG,OAAO;AAAA,QACxB,WAAW;AAAA,QACX,eAAe;AAAA,MACjB,CAAC;AAGD,YAAM,eAA4B;AAAA,QAChC,QAAQ;AAAA,QACR,SAAS;AAAA,UACP,gBAAgB;AAAA,QAClB;AAAA,QACA,MAAM,KAAK,SAAS;AAAA,MACtB;AAEA,UAAI,QAAQ,IAAI,aAAa,cAAc;AACzC,cAAM,QAAQ,IAAI,MAAM,MAAM;AAAA,UAC5B,oBAAoB;AAAA,QACtB,CAAC;AACD,QAAC,aAAqB,QAAQ;AAAA,MAChC;AAEA,YAAM,gBAAgB,MAAM,MAAM,eAAe,YAAY;AAC7D,YAAM,SAAS,MAAM,cAAc,KAAK;AAExC,UAAI,CAAC,cAAc,IAAI;AACrB,gBAAQ,MAAM,0BAA0B,MAAM;AAC9C,eAAOA,cAAa,SAAS,IAAI,IAAI,GAAG,QAAQ,gCAAgC,QAAQ,GAAG,CAAC;AAAA,MAC9F;AAGA,YAAM,mBAAmB,GAAG,MAAM;AAClC,YAAM,mBAAmB,MAAM,MAAM,kBAAkB;AAAA,QACrD,SAAS;AAAA,UACP,iBAAiB,UAAU,OAAO,YAAY;AAAA,QAChD;AAAA,QACA,GAAI,QAAQ,IAAI,aAAa,eAAe;AAAA,UAC1C,OAAO,IAAI,MAAM,MAAM,EAAE,oBAAoB,MAAM,CAAC;AAAA,QACtD,IAAW,CAAC;AAAA,MACd,CAAC;AAED,YAAM,WAAW,MAAM,iBAAiB,KAAK;AAG7C,YAAM,eAAe,MAAM,OAAO;AAAA,QAChC,OAAO;AAAA,UACL,aAAa,OAAO;AAAA,UACpB,cAAc,OAAO;AAAA,UACrB,WAAW,KAAK,MAAM,KAAK,IAAI,IAAI,GAAI,KAAK,OAAO,cAAc;AAAA,UACjE,SAAS,OAAO;AAAA,UAChB,OAAO,SAAS;AAAA,UAChB,UAAU,SAAS;AAAA,UACnB,MAAM,SAAS;AAAA,UACf,KAAK,SAAS;AAAA,QAChB;AAAA,QACA,QAAQ;AAAA,MACV,CAAC;AAED,YAAM,mBAAmBA,cAAa,SAAS,IAAI,IAAI,aAAa,QAAQ,GAAG,CAAC;AAGhF,YAAM,aAAa,QAAQ,IAAI,aAAa,eACxC,qCACA;AAEJ,uBAAiB,QAAQ,IAAI,YAAY,cAAc;AAAA,QACrD,UAAU;AAAA,QACV,QAAQ,QAAQ,IAAI,aAAa;AAAA,QACjC,UAAU;AAAA,QACV,QAAQ,KAAK,KAAK,KAAK;AAAA;AAAA,QACvB,MAAM;AAAA,MACR,CAAC;AAED,aAAO;AAAA,IACT,SAAS,OAAO;AACd,cAAQ,MAAM,yBAAyB,KAAK;AAC5C,aAAOA,cAAa,SAAS,IAAI,IAAI,GAAG,QAAQ,0BAA0B,QAAQ,GAAG,CAAC;AAAA,IACxF;AAAA,EACF;AACF;","names":["https","default","NextResponse"]}
+{"version":3,"sources":["../../src/server/auth.ts","../../src/provider.ts","../../src/server/session.ts","../../src/server/index.ts","../../src/server/middleware.ts","../../src/server/hosted-auth-callback.ts"],"sourcesContent":["import NextAuthDefault from 'next-auth';\nimport type { NextAuthOptions } from 'next-auth';\nimport { OAuth42Provider, OAuth42Profile } from '../provider';\nimport { getOAuth42Session } from './session';\n\n// Handle both CommonJS and ESM exports\nconst NextAuth = (NextAuthDefault as any).default || NextAuthDefault;\n\nexport { type NextAuthOptions };\n\nexport interface CreateAuthOptions {\n  clientId?: string;\n  clientSecret?: string;\n  issuer?: string;\n  scopes?: string[];\n  pkceEnabled?: boolean;\n  debug?: boolean;\n  callbacks?: NextAuthOptions['callbacks'];\n  pages?: NextAuthOptions['pages'];\n  session?: NextAuthOptions['session'];\n}\n\n/**\n * Create a pre-configured NextAuth instance for OAuth42\n * This provides a simplified setup with sensible defaults\n */\nexport function createAuth(options: CreateAuthOptions = {}) {\n  const clientId = options.clientId || process.env.OAUTH42_CLIENT_ID;\n  const clientSecret = options.clientSecret || process.env.OAUTH42_CLIENT_SECRET;\n  \n  if (!clientId || !clientSecret) {\n    throw new Error(\n      'OAuth42 client credentials are required. ' +\n      'Set OAUTH42_CLIENT_ID and OAUTH42_CLIENT_SECRET environment variables ' +\n      'or pass them in the options.'\n    );\n  }\n  \n  const authOptions: NextAuthOptions = {\n    providers: [\n      OAuth42Provider({\n        clientId,\n        clientSecret,\n        issuer: options.issuer,\n        scopes: options.scopes,\n        pkceEnabled: options.pkceEnabled,\n      }),\n    ],\n    \n    callbacks: {\n      async jwt({ token, account, profile }) {\n        // Store OAuth tokens in the JWT\n        if (account) {\n          token.accessToken = account.access_token;\n          token.refreshToken = account.refresh_token;\n          token.expiresAt = account.expires_at;\n          token.idToken = account.id_token;\n        }\n        \n        // Add user profile data\n        if (profile) {\n          const oauth42Profile = profile as OAuth42Profile;\n          token.email = oauth42Profile.email;\n          token.username = oauth42Profile.username;\n          token.emailVerified = oauth42Profile.email_verified;\n        }\n        \n        // Call custom callback if provided\n        if (options.callbacks?.jwt) {\n          return options.callbacks.jwt({ token, account, profile } as any);\n        }\n        \n        return token;\n      },\n      \n      async session({ session, token }) {\n        // Add OAuth42-specific data to session\n        session.accessToken = token.accessToken as string;\n        session.idToken = token.idToken as string;\n\n        if (session.user) {\n          session.user.email = token.email as string;\n          session.user.name = token.name as string;\n          session.user.username = token.username as string;\n          session.user.emailVerified = token.emailVerified as boolean;\n        }\n\n        // Call custom callback if provided\n        if (options.callbacks?.session) {\n          return options.callbacks.session({ session, token } as any);\n        }\n\n        return session;\n      },\n      \n      ...options.callbacks,\n    },\n    \n    pages: {\n      signIn: '/auth/signin',\n      signOut: '/auth/signout',\n      error: '/auth/error',\n      ...options.pages,\n    },\n    \n    session: {\n      strategy: 'jwt',\n      ...options.session,\n    },\n    \n    debug: options.debug || process.env.NODE_ENV === 'development',\n    \n    secret: process.env.NEXTAUTH_SECRET,\n  };\n  \n  // Return the configuration and a function to create handlers\n  return {\n    auth: authOptions,\n    handlers: NextAuth(authOptions),\n  };\n}\n\n/**\n * Create NextAuth handlers for API routes\n */\nexport function createHandlers(authOptions: NextAuthOptions) {\n  const handler = NextAuth(authOptions);\n  return { GET: handler, POST: handler };\n}\n\n/**\n * Helper to get the current session server-side\n * @deprecated Use getOAuth42Session instead - this is now just an alias for backward compatibility\n * \n * This function is maintained for backward compatibility but internally\n * calls getOAuth42Session which properly handles both App Router and Pages Router\n */\nexport const getServerSession = getOAuth42Session;\n\n/**\n * Token refresh helper\n */\nexport async function refreshAccessToken(token: any, clientId: string, clientSecret: string, issuer?: string) {\n  try {\n    const baseUrl = issuer || process.env.OAUTH42_ISSUER || 'https://oauth42.com';\n    const tokenUrl = `${baseUrl}/oauth2/token`;\n    \n    // In development, we need to handle self-signed certificates\n    const fetchOptions: any = {\n      method: 'POST',\n      headers: {\n        'Content-Type': 'application/x-www-form-urlencoded',\n      },\n      body: new URLSearchParams({\n        grant_type: 'refresh_token',\n        refresh_token: token.refreshToken,\n        client_id: clientId,\n        client_secret: clientSecret,\n      }),\n    };\n    \n    // Add agent for self-signed certificates in development\n    if (process.env.NODE_ENV !== 'production' && tokenUrl.startsWith('https://')) {\n      const https = await import('https');\n      fetchOptions.agent = new https.Agent({\n        rejectUnauthorized: false\n      });\n    }\n    \n    const response = await fetch(tokenUrl, fetchOptions);\n    const refreshedTokens = await response.json();\n    \n    if (!response.ok) {\n      throw refreshedTokens;\n    }\n    \n    return {\n      ...token,\n      accessToken: refreshedTokens.access_token,\n      refreshToken: refreshedTokens.refresh_token ?? token.refreshToken,\n      // Store expiration time in seconds (Unix timestamp)\n      expiresAt: Math.floor(Date.now() / 1000) + (refreshedTokens.expires_in || 3600),\n      // Explicitly remove any error property on successful refresh\n      error: undefined,\n    };\n  } catch (error) {\n    console.error('Failed to refresh access token:', error);\n    return {\n      ...token,\n      error: 'RefreshAccessTokenError',\n    };\n  }\n}","import type { OAuthConfig, OAuthUserConfig } from 'next-auth/providers/oauth';\n\nexport interface OAuth42Profile {\n  sub: string;\n  email: string;\n  email_verified?: boolean;\n  name?: string;\n  given_name?: string;\n  family_name?: string;\n  picture?: string;\n  username?: string;\n  id?: string;\n}\n\nexport interface OAuth42ProviderOptions {\n  clientId: string;\n  clientSecret: string;\n  issuer?: string;\n  authorizationUrl?: string;\n  tokenUrl?: string;\n  userinfoUrl?: string;\n  scopes?: string[];\n  pkceEnabled?: boolean;\n}\n\nexport function OAuth42Provider<P extends OAuth42Profile>(\n  options: OAuthUserConfig<P> & Partial<OAuth42ProviderOptions>\n): OAuthConfig<P> {\n  const issuer = options.issuer || process.env.OAUTH42_ISSUER || 'https://oauth42.com';\n  const baseUrl = issuer.replace(/\\/$/, '');\n  \n  return {\n    id: 'oauth42',\n    name: 'OAuth42',\n    type: 'oauth',\n    version: '2.0',\n    \n    // Use OIDC discovery to automatically find endpoints\n    wellKnown: `${baseUrl}/.well-known/openid-configuration`,\n    \n    // Also set individual endpoints for compatibility\n    authorization: {\n      url: `${baseUrl}/oauth2/authorize`,\n      params: {\n        scope: (options.scopes || ['openid', 'profile', 'email']).join(' '),\n        response_type: 'code',\n      },\n    },\n    token: `${baseUrl}/oauth2/token`,\n    userinfo: `${baseUrl}/oauth2/userinfo`,\n    \n    client: {\n      id: options.clientId,\n      secret: options.clientSecret,\n      token_endpoint_auth_method: 'client_secret_post',\n      id_token_signed_response_alg: 'HS256', // OAuth42 uses HS256 for ID tokens\n    },\n    \n    issuer: baseUrl,\n    \n    checks: options.pkceEnabled !== false ? ['pkce', 'state'] : ['state'],\n    \n    profile(profile: OAuth42Profile, tokens: any) {\n      return {\n        id: profile.sub || profile.id || profile.email,\n        email: profile.email,\n        emailVerified: profile.email_verified ? new Date() : null,\n        name: profile.name || `${profile.given_name || ''} ${profile.family_name || ''}`.trim(),\n        image: profile.picture,\n      };\n    },\n    \n    style: {\n      logo: '/oauth42-logo.svg',\n      bg: '#1e40af',\n      text: '#ffffff',\n    },\n    \n    options,\n  };\n}","import { getServerSession as getNextAuthSession } from 'next-auth';\nimport { NextAuthOptions } from 'next-auth';\nimport { GetServerSidePropsContext, NextApiRequest, NextApiResponse } from 'next';\n\n/**\n * Get the OAuth42 session server-side\n * \n * This is the primary method for retrieving sessions in OAuth42 SDK.\n * Supports both Pages Router and App Router:\n * \n * App Router:\n * ```ts\n * const session = await getOAuth42Session(authOptions);\n * ```\n * \n * Pages Router:\n * ```ts\n * const session = await getOAuth42Session(req, res, authOptions);\n * ```\n */\nexport async function getOAuth42Session(\n  ...args: \n    | [GetServerSidePropsContext['req'], GetServerSidePropsContext['res'], NextAuthOptions]\n    | [NextApiRequest, NextApiResponse, NextAuthOptions]\n    | [NextAuthOptions]\n) {\n  return getNextAuthSession(...args as any);\n}\n\n/**\n * Helper for protecting API routes\n */\nexport function withOAuth42Session(\n  handler: (req: NextApiRequest, res: NextApiResponse, session: any) => Promise<void> | void,\n  authOptions: NextAuthOptions\n) {\n  return async (req: NextApiRequest, res: NextApiResponse) => {\n    const session = await getOAuth42Session(req, res, authOptions);\n    \n    if (!session) {\n      return res.status(401).json({ error: 'Unauthorized' });\n    }\n    \n    return handler(req, res, session);\n  };\n}\n\n/**\n * Helper for protecting server-side props\n */\nexport function withOAuth42ServerSideProps(\n  getServerSideProps: (\n    context: GetServerSidePropsContext,\n    session: any\n  ) => Promise<any>,\n  authOptions: NextAuthOptions\n) {\n  return async (context: GetServerSidePropsContext) => {\n    const session = await getOAuth42Session(\n      context.req,\n      context.res,\n      authOptions\n    );\n    \n    if (!session) {\n      return {\n        redirect: {\n          destination: '/auth/signin',\n          permanent: false,\n        },\n      };\n    }\n    \n    return getServerSideProps(context, session);\n  };\n}","// Server-side exports\nexport { createAuth, createHandlers, getServerSession, refreshAccessToken } from './auth';\nexport type { CreateAuthOptions, NextAuthOptions } from './auth';\n\n// Re-export NextAuth from next-auth\nexport { default as NextAuth } from 'next-auth';\n\n// Re-export OAuth42Provider\nexport { OAuth42Provider } from '../provider';\n\nexport { withOAuth42Auth, createMiddlewareConfig } from './middleware';\nexport type { OAuth42AuthOptions } from './middleware';\n\nexport { getOAuth42Session, withOAuth42Session, withOAuth42ServerSideProps } from './session';\n\n// Hosted auth callback handler\nexport { createHostedAuthCallback } from './hosted-auth-callback';\nexport type { HostedAuthCallbackOptions } from './hosted-auth-callback';","import { NextRequest, NextResponse } from 'next/server';\nimport { getToken } from 'next-auth/jwt';\n\nexport interface OAuth42AuthOptions {\n  pages?: {\n    signIn?: string;\n    error?: string;\n  };\n  callbacks?: {\n    authorized?: (params: { token: any; req: NextRequest }) => boolean | Promise<boolean>;\n  };\n  protectedPaths?: string[];\n  publicPaths?: string[];\n}\n\n/**\n * Middleware helper for protecting routes with OAuth42\n */\nexport function withOAuth42Auth(options: OAuth42AuthOptions = {}) {\n  return async function middleware(req: NextRequest) {\n    const token = await getToken({ \n      req: req as any, \n      secret: process.env.NEXTAUTH_SECRET \n    });\n    \n    const pathname = req.nextUrl.pathname;\n    \n    // Check if path is explicitly public\n    if (options.publicPaths?.some(path => pathname.startsWith(path))) {\n      return NextResponse.next();\n    }\n    \n    // Check if path needs protection\n    const needsProtection = options.protectedPaths\n      ? options.protectedPaths.some(path => pathname.startsWith(path))\n      : true; // Default to protecting all paths\n    \n    if (!needsProtection) {\n      return NextResponse.next();\n    }\n    \n    // Check authorization\n    let isAuthorized = !!token;\n    \n    if (options.callbacks?.authorized) {\n      isAuthorized = await options.callbacks.authorized({ token, req });\n    }\n    \n    if (!isAuthorized) {\n      const signInUrl = options.pages?.signIn || '/auth/signin';\n      const url = new URL(signInUrl, req.url);\n      url.searchParams.set('callbackUrl', pathname);\n      return NextResponse.redirect(url);\n    }\n    \n    return NextResponse.next();\n  };\n}\n\n/**\n * Helper to create middleware configuration\n */\nexport function createMiddlewareConfig(\n  protectedPaths: string[] = ['/protected'],\n  publicPaths: string[] = ['/auth', '/api/auth']\n) {\n  return {\n    matcher: [\n      /*\n       * Match all request paths except for the ones starting with:\n       * - _next/static (static files)\n       * - _next/image (image optimization files)\n       * - favicon.ico (favicon file)\n       * - public folder\n       */\n      '/((?!_next/static|_next/image|favicon.ico|public).*)',\n    ],\n    protectedPaths,\n    publicPaths,\n  };\n}","import { NextRequest, NextResponse } from 'next/server';\nimport https from 'https';\nimport { encode } from 'next-auth/jwt';\n\nexport interface HostedAuthCallbackOptions {\n  /**\n   * OAuth42 issuer URL (e.g., 'https://api.oauth42.com' or 'https://localhost:8443')\n   */\n  issuer?: string;\n\n  /**\n   * OAuth2 client ID\n   */\n  clientId?: string;\n\n  /**\n   * OAuth2 client secret\n   */\n  clientSecret?: string;\n\n  /**\n   * Application base URL (e.g., 'http://localhost:3000')\n   */\n  baseUrl?: string;\n\n  /**\n   * NextAuth secret for JWT encoding\n   */\n  nextAuthSecret?: string;\n\n  /**\n   * URL to redirect to after successful authentication\n   * @default '/dashboard'\n   */\n  redirectUrl?: string;\n\n  /**\n   * URL to redirect to on error\n   * @default '/'\n   */\n  errorUrl?: string;\n}\n\n/**\n * Creates a handler for OAuth42 hosted auth callback that integrates with NextAuth.\n *\n * This function handles the OAuth callback, exchanges the authorization code for tokens,\n * fetches user info, and creates a NextAuth-compatible session cookie.\n *\n * @example\n * ```typescript\n * // app/api/oauth/callback/route.ts\n * import { createHostedAuthCallback } from '@oauth42/next/server';\n *\n * export const GET = createHostedAuthCallback({\n *   redirectUrl: '/dashboard',\n * });\n * ```\n */\nexport function createHostedAuthCallback(options: HostedAuthCallbackOptions = {}) {\n  return async function GET(request: NextRequest) {\n    const {\n      issuer = process.env.OAUTH42_ISSUER || 'https://api.oauth42.com',\n      clientId = process.env.OAUTH42_CLIENT_ID,\n      clientSecret = process.env.OAUTH42_CLIENT_SECRET,\n      baseUrl = process.env.NEXTAUTH_URL,\n      nextAuthSecret = process.env.NEXTAUTH_SECRET,\n      redirectUrl = '/dashboard',\n      errorUrl = '/',\n    } = options;\n\n    if (!clientId || !clientSecret) {\n      console.error('OAuth42 client credentials are required');\n      return NextResponse.redirect(new URL(`${errorUrl}?error=missing_credentials`, request.url));\n    }\n\n    if (!nextAuthSecret) {\n      console.error('NEXTAUTH_SECRET is required');\n      return NextResponse.redirect(new URL(`${errorUrl}?error=missing_secret`, request.url));\n    }\n\n    const searchParams = request.nextUrl.searchParams;\n    const code = searchParams.get('code');\n\n    if (!code) {\n      return NextResponse.redirect(new URL(`${errorUrl}?error=missing_code`, request.url));\n    }\n\n    try {\n      // Exchange authorization code for tokens\n      const tokenEndpoint = `${issuer}/oauth2/token`;\n\n      const body = new URLSearchParams({\n        grant_type: 'authorization_code',\n        code,\n        redirect_uri: `${baseUrl}/api/oauth/callback`,\n        client_id: clientId,\n        client_secret: clientSecret,\n      });\n\n      // For development, use custom agent to disable SSL verification\n      const fetchOptions: RequestInit = {\n        method: 'POST',\n        headers: {\n          'Content-Type': 'application/x-www-form-urlencoded',\n        },\n        body: body.toString(),\n      };\n\n      if (process.env.NODE_ENV !== 'production') {\n        const agent = new https.Agent({\n          rejectUnauthorized: false,\n        });\n        (fetchOptions as any).agent = agent;\n      }\n\n      const tokenResponse = await fetch(tokenEndpoint, fetchOptions);\n      const tokens = await tokenResponse.json();\n\n      if (!tokenResponse.ok) {\n        console.error('Token exchange failed:', tokens);\n        return NextResponse.redirect(new URL(`${errorUrl}?error=token_exchange_failed`, request.url));\n      }\n\n      // Fetch user info\n      const userInfoEndpoint = `${issuer}/oauth2/userinfo`;\n      const userInfoResponse = await fetch(userInfoEndpoint, {\n        headers: {\n          'Authorization': `Bearer ${tokens.access_token}`,\n        },\n        ...(process.env.NODE_ENV !== 'production' ? {\n          agent: new https.Agent({ rejectUnauthorized: false })\n        } as any : {})\n      });\n\n      const userInfo = await userInfoResponse.json();\n\n      // Create NextAuth-compatible session token\n      const sessionToken = await encode({\n        token: {\n          accessToken: tokens.access_token,\n          refreshToken: tokens.refresh_token,\n          expiresAt: Math.floor(Date.now() / 1000) + (tokens.expires_in || 3600),\n          idToken: tokens.id_token,\n          email: userInfo.email,\n          username: userInfo.username,\n          name: userInfo.name,\n          sub: userInfo.sub,\n        },\n        secret: nextAuthSecret,\n      });\n\n      const redirectResponse = NextResponse.redirect(new URL(redirectUrl, request.url));\n\n      // Set NextAuth session cookie\n      const cookieName = process.env.NODE_ENV === 'production'\n        ? '__Secure-next-auth.session-token'\n        : 'next-auth.session-token';\n\n      redirectResponse.cookies.set(cookieName, sessionToken, {\n        httpOnly: true,\n        secure: process.env.NODE_ENV === 'production',\n        sameSite: 'lax',\n        maxAge: 60 * 60 * 24 * 30, // 30 days\n        path: '/',\n      });\n\n      return redirectResponse;\n    } catch (error) {\n      console.error('OAuth callback error:', error);\n      return NextResponse.redirect(new URL(`${errorUrl}?error=callback_failed`, request.url));\n    }\n  };\n}\n"],"mappings":";AAAA,OAAO,qBAAqB;;;ACyBrB,SAAS,gBACd,SACgB;AAChB,QAAM,SAAS,QAAQ,UAAU,QAAQ,IAAI,kBAAkB;AAC/D,QAAM,UAAU,OAAO,QAAQ,OAAO,EAAE;AAExC,SAAO;AAAA,IACL,IAAI;AAAA,IACJ,MAAM;AAAA,IACN,MAAM;AAAA,IACN,SAAS;AAAA;AAAA,IAGT,WAAW,GAAG,OAAO;AAAA;AAAA,IAGrB,eAAe;AAAA,MACb,KAAK,GAAG,OAAO;AAAA,MACf,QAAQ;AAAA,QACN,QAAQ,QAAQ,UAAU,CAAC,UAAU,WAAW,OAAO,GAAG,KAAK,GAAG;AAAA,QAClE,eAAe;AAAA,MACjB;AAAA,IACF;AAAA,IACA,OAAO,GAAG,OAAO;AAAA,IACjB,UAAU,GAAG,OAAO;AAAA,IAEpB,QAAQ;AAAA,MACN,IAAI,QAAQ;AAAA,MACZ,QAAQ,QAAQ;AAAA,MAChB,4BAA4B;AAAA,MAC5B,8BAA8B;AAAA;AAAA,IAChC;AAAA,IAEA,QAAQ;AAAA,IAER,QAAQ,QAAQ,gBAAgB,QAAQ,CAAC,QAAQ,OAAO,IAAI,CAAC,OAAO;AAAA,IAEpE,QAAQ,SAAyB,QAAa;AAC5C,aAAO;AAAA,QACL,IAAI,QAAQ,OAAO,QAAQ,MAAM,QAAQ;AAAA,QACzC,OAAO,QAAQ;AAAA,QACf,eAAe,QAAQ,iBAAiB,oBAAI,KAAK,IAAI;AAAA,QACrD,MAAM,QAAQ,QAAQ,GAAG,QAAQ,cAAc,EAAE,IAAI,QAAQ,eAAe,EAAE,GAAG,KAAK;AAAA,QACtF,OAAO,QAAQ;AAAA,MACjB;AAAA,IACF;AAAA,IAEA,OAAO;AAAA,MACL,MAAM;AAAA,MACN,IAAI;AAAA,MACJ,MAAM;AAAA,IACR;AAAA,IAEA;AAAA,EACF;AACF;;;AChFA,SAAS,oBAAoB,0BAA0B;AAoBvD,eAAsB,qBACjB,MAIH;AACA,SAAO,mBAAmB,GAAG,IAAW;AAC1C;AAKO,SAAS,mBACd,SACA,aACA;AACA,SAAO,OAAO,KAAqB,QAAyB;AAC1D,UAAM,UAAU,MAAM,kBAAkB,KAAK,KAAK,WAAW;AAE7D,QAAI,CAAC,SAAS;AACZ,aAAO,IAAI,OAAO,GAAG,EAAE,KAAK,EAAE,OAAO,eAAe,CAAC;AAAA,IACvD;AAEA,WAAO,QAAQ,KAAK,KAAK,OAAO;AAAA,EAClC;AACF;AAKO,SAAS,2BACd,oBAIA,aACA;AACA,SAAO,OAAO,YAAuC;AACnD,UAAM,UAAU,MAAM;AAAA,MACpB,QAAQ;AAAA,MACR,QAAQ;AAAA,MACR;AAAA,IACF;AAEA,QAAI,CAAC,SAAS;AACZ,aAAO;AAAA,QACL,UAAU;AAAA,UACR,aAAa;AAAA,UACb,WAAW;AAAA,QACb;AAAA,MACF;AAAA,IACF;AAEA,WAAO,mBAAmB,SAAS,OAAO;AAAA,EAC5C;AACF;;;AFrEA,IAAM,WAAY,gBAAwB,WAAW;AAoB9C,SAAS,WAAW,UAA6B,CAAC,GAAG;AAC1D,QAAM,WAAW,QAAQ,YAAY,QAAQ,IAAI;AACjD,QAAM,eAAe,QAAQ,gBAAgB,QAAQ,IAAI;AAEzD,MAAI,CAAC,YAAY,CAAC,cAAc;AAC9B,UAAM,IAAI;AAAA,MACR;AAAA,IAGF;AAAA,EACF;AAEA,QAAM,cAA+B;AAAA,IACnC,WAAW;AAAA,MACT,gBAAgB;AAAA,QACd;AAAA,QACA;AAAA,QACA,QAAQ,QAAQ;AAAA,QAChB,QAAQ,QAAQ;AAAA,QAChB,aAAa,QAAQ;AAAA,MACvB,CAAC;AAAA,IACH;AAAA,IAEA,WAAW;AAAA,MACT,MAAM,IAAI,EAAE,OAAO,SAAS,QAAQ,GAAG;AAErC,YAAI,SAAS;AACX,gBAAM,cAAc,QAAQ;AAC5B,gBAAM,eAAe,QAAQ;AAC7B,gBAAM,YAAY,QAAQ;AAC1B,gBAAM,UAAU,QAAQ;AAAA,QAC1B;AAGA,YAAI,SAAS;AACX,gBAAM,iBAAiB;AACvB,gBAAM,QAAQ,eAAe;AAC7B,gBAAM,WAAW,eAAe;AAChC,gBAAM,gBAAgB,eAAe;AAAA,QACvC;AAGA,YAAI,QAAQ,WAAW,KAAK;AAC1B,iBAAO,QAAQ,UAAU,IAAI,EAAE,OAAO,SAAS,QAAQ,CAAQ;AAAA,QACjE;AAEA,eAAO;AAAA,MACT;AAAA,MAEA,MAAM,QAAQ,EAAE,SAAS,MAAM,GAAG;AAEhC,gBAAQ,cAAc,MAAM;AAC5B,gBAAQ,UAAU,MAAM;AAExB,YAAI,QAAQ,MAAM;AAChB,kBAAQ,KAAK,QAAQ,MAAM;AAC3B,kBAAQ,KAAK,OAAO,MAAM;AAC1B,kBAAQ,KAAK,WAAW,MAAM;AAC9B,kBAAQ,KAAK,gBAAgB,MAAM;AAAA,QACrC;AAGA,YAAI,QAAQ,WAAW,SAAS;AAC9B,iBAAO,QAAQ,UAAU,QAAQ,EAAE,SAAS,MAAM,CAAQ;AAAA,QAC5D;AAEA,eAAO;AAAA,MACT;AAAA,MAEA,GAAG,QAAQ;AAAA,IACb;AAAA,IAEA,OAAO;AAAA,MACL,QAAQ;AAAA,MACR,SAAS;AAAA,MACT,OAAO;AAAA,MACP,GAAG,QAAQ;AAAA,IACb;AAAA,IAEA,SAAS;AAAA,MACP,UAAU;AAAA,MACV,GAAG,QAAQ;AAAA,IACb;AAAA,IAEA,OAAO,QAAQ,SAAS,QAAQ,IAAI,aAAa;AAAA,IAEjD,QAAQ,QAAQ,IAAI;AAAA,EACtB;AAGA,SAAO;AAAA,IACL,MAAM;AAAA,IACN,UAAU,SAAS,WAAW;AAAA,EAChC;AACF;AAKO,SAAS,eAAe,aAA8B;AAC3D,QAAM,UAAU,SAAS,WAAW;AACpC,SAAO,EAAE,KAAK,SAAS,MAAM,QAAQ;AACvC;AASO,IAAM,mBAAmB;AAKhC,eAAsB,mBAAmB,OAAY,UAAkB,cAAsB,QAAiB;AAC5G,MAAI;AACF,UAAM,UAAU,UAAU,QAAQ,IAAI,kBAAkB;AACxD,UAAM,WAAW,GAAG,OAAO;AAG3B,UAAM,eAAoB;AAAA,MACxB,QAAQ;AAAA,MACR,SAAS;AAAA,QACP,gBAAgB;AAAA,MAClB;AAAA,MACA,MAAM,IAAI,gBAAgB;AAAA,QACxB,YAAY;AAAA,QACZ,eAAe,MAAM;AAAA,QACrB,WAAW;AAAA,QACX,eAAe;AAAA,MACjB,CAAC;AAAA,IACH;AAGA,QAAI,QAAQ,IAAI,aAAa,gBAAgB,SAAS,WAAW,UAAU,GAAG;AAC5E,YAAMA,SAAQ,MAAM,OAAO,OAAO;AAClC,mBAAa,QAAQ,IAAIA,OAAM,MAAM;AAAA,QACnC,oBAAoB;AAAA,MACtB,CAAC;AAAA,IACH;AAEA,UAAM,WAAW,MAAM,MAAM,UAAU,YAAY;AACnD,UAAM,kBAAkB,MAAM,SAAS,KAAK;AAE5C,QAAI,CAAC,SAAS,IAAI;AAChB,YAAM;AAAA,IACR;AAEA,WAAO;AAAA,MACL,GAAG;AAAA,MACH,aAAa,gBAAgB;AAAA,MAC7B,cAAc,gBAAgB,iBAAiB,MAAM;AAAA;AAAA,MAErD,WAAW,KAAK,MAAM,KAAK,IAAI,IAAI,GAAI,KAAK,gBAAgB,cAAc;AAAA;AAAA,MAE1E,OAAO;AAAA,IACT;AAAA,EACF,SAAS,OAAO;AACd,YAAQ,MAAM,mCAAmC,KAAK;AACtD,WAAO;AAAA,MACL,GAAG;AAAA,MACH,OAAO;AAAA,IACT;AAAA,EACF;AACF;;;AG3LA,SAAoB,WAAXC,gBAA2B;;;ACLpC,SAAsB,oBAAoB;AAC1C,SAAS,gBAAgB;AAiBlB,SAAS,gBAAgB,UAA8B,CAAC,GAAG;AAChE,SAAO,eAAe,WAAW,KAAkB;AACjD,UAAM,QAAQ,MAAM,SAAS;AAAA,MAC3B;AAAA,MACA,QAAQ,QAAQ,IAAI;AAAA,IACtB,CAAC;AAED,UAAM,WAAW,IAAI,QAAQ;AAG7B,QAAI,QAAQ,aAAa,KAAK,UAAQ,SAAS,WAAW,IAAI,CAAC,GAAG;AAChE,aAAO,aAAa,KAAK;AAAA,IAC3B;AAGA,UAAM,kBAAkB,QAAQ,iBAC5B,QAAQ,eAAe,KAAK,UAAQ,SAAS,WAAW,IAAI,CAAC,IAC7D;AAEJ,QAAI,CAAC,iBAAiB;AACpB,aAAO,aAAa,KAAK;AAAA,IAC3B;AAGA,QAAI,eAAe,CAAC,CAAC;AAErB,QAAI,QAAQ,WAAW,YAAY;AACjC,qBAAe,MAAM,QAAQ,UAAU,WAAW,EAAE,OAAO,IAAI,CAAC;AAAA,IAClE;AAEA,QAAI,CAAC,cAAc;AACjB,YAAM,YAAY,QAAQ,OAAO,UAAU;AAC3C,YAAM,MAAM,IAAI,IAAI,WAAW,IAAI,GAAG;AACtC,UAAI,aAAa,IAAI,eAAe,QAAQ;AAC5C,aAAO,aAAa,SAAS,GAAG;AAAA,IAClC;AAEA,WAAO,aAAa,KAAK;AAAA,EAC3B;AACF;AAKO,SAAS,uBACd,iBAA2B,CAAC,YAAY,GACxC,cAAwB,CAAC,SAAS,WAAW,GAC7C;AACA,SAAO;AAAA,IACL,SAAS;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA,MAQP;AAAA,IACF;AAAA,IACA;AAAA,IACA;AAAA,EACF;AACF;;;AChFA,SAAsB,gBAAAC,qBAAoB;AAC1C,OAAO,WAAW;AAClB,SAAS,cAAc;AAyDhB,SAAS,yBAAyB,UAAqC,CAAC,GAAG;AAChF,SAAO,eAAe,IAAI,SAAsB;AAC9C,UAAM;AAAA,MACJ,SAAS,QAAQ,IAAI,kBAAkB;AAAA,MACvC,WAAW,QAAQ,IAAI;AAAA,MACvB,eAAe,QAAQ,IAAI;AAAA,MAC3B,UAAU,QAAQ,IAAI;AAAA,MACtB,iBAAiB,QAAQ,IAAI;AAAA,MAC7B,cAAc;AAAA,MACd,WAAW;AAAA,IACb,IAAI;AAEJ,QAAI,CAAC,YAAY,CAAC,cAAc;AAC9B,cAAQ,MAAM,yCAAyC;AACvD,aAAOA,cAAa,SAAS,IAAI,IAAI,GAAG,QAAQ,8BAA8B,QAAQ,GAAG,CAAC;AAAA,IAC5F;AAEA,QAAI,CAAC,gBAAgB;AACnB,cAAQ,MAAM,6BAA6B;AAC3C,aAAOA,cAAa,SAAS,IAAI,IAAI,GAAG,QAAQ,yBAAyB,QAAQ,GAAG,CAAC;AAAA,IACvF;AAEA,UAAM,eAAe,QAAQ,QAAQ;AACrC,UAAM,OAAO,aAAa,IAAI,MAAM;AAEpC,QAAI,CAAC,MAAM;AACT,aAAOA,cAAa,SAAS,IAAI,IAAI,GAAG,QAAQ,uBAAuB,QAAQ,GAAG,CAAC;AAAA,IACrF;AAEA,QAAI;AAEF,YAAM,gBAAgB,GAAG,MAAM;AAE/B,YAAM,OAAO,IAAI,gBAAgB;AAAA,QAC/B,YAAY;AAAA,QACZ;AAAA,QACA,cAAc,GAAG,OAAO;AAAA,QACxB,WAAW;AAAA,QACX,eAAe;AAAA,MACjB,CAAC;AAGD,YAAM,eAA4B;AAAA,QAChC,QAAQ;AAAA,QACR,SAAS;AAAA,UACP,gBAAgB;AAAA,QAClB;AAAA,QACA,MAAM,KAAK,SAAS;AAAA,MACtB;AAEA,UAAI,QAAQ,IAAI,aAAa,cAAc;AACzC,cAAM,QAAQ,IAAI,MAAM,MAAM;AAAA,UAC5B,oBAAoB;AAAA,QACtB,CAAC;AACD,QAAC,aAAqB,QAAQ;AAAA,MAChC;AAEA,YAAM,gBAAgB,MAAM,MAAM,eAAe,YAAY;AAC7D,YAAM,SAAS,MAAM,cAAc,KAAK;AAExC,UAAI,CAAC,cAAc,IAAI;AACrB,gBAAQ,MAAM,0BAA0B,MAAM;AAC9C,eAAOA,cAAa,SAAS,IAAI,IAAI,GAAG,QAAQ,gCAAgC,QAAQ,GAAG,CAAC;AAAA,MAC9F;AAGA,YAAM,mBAAmB,GAAG,MAAM;AAClC,YAAM,mBAAmB,MAAM,MAAM,kBAAkB;AAAA,QACrD,SAAS;AAAA,UACP,iBAAiB,UAAU,OAAO,YAAY;AAAA,QAChD;AAAA,QACA,GAAI,QAAQ,IAAI,aAAa,eAAe;AAAA,UAC1C,OAAO,IAAI,MAAM,MAAM,EAAE,oBAAoB,MAAM,CAAC;AAAA,QACtD,IAAW,CAAC;AAAA,MACd,CAAC;AAED,YAAM,WAAW,MAAM,iBAAiB,KAAK;AAG7C,YAAM,eAAe,MAAM,OAAO;AAAA,QAChC,OAAO;AAAA,UACL,aAAa,OAAO;AAAA,UACpB,cAAc,OAAO;AAAA,UACrB,WAAW,KAAK,MAAM,KAAK,IAAI,IAAI,GAAI,KAAK,OAAO,cAAc;AAAA,UACjE,SAAS,OAAO;AAAA,UAChB,OAAO,SAAS;AAAA,UAChB,UAAU,SAAS;AAAA,UACnB,MAAM,SAAS;AAAA,UACf,KAAK,SAAS;AAAA,QAChB;AAAA,QACA,QAAQ;AAAA,MACV,CAAC;AAED,YAAM,mBAAmBA,cAAa,SAAS,IAAI,IAAI,aAAa,QAAQ,GAAG,CAAC;AAGhF,YAAM,aAAa,QAAQ,IAAI,aAAa,eACxC,qCACA;AAEJ,uBAAiB,QAAQ,IAAI,YAAY,cAAc;AAAA,QACrD,UAAU;AAAA,QACV,QAAQ,QAAQ,IAAI,aAAa;AAAA,QACjC,UAAU;AAAA,QACV,QAAQ,KAAK,KAAK,KAAK;AAAA;AAAA,QACvB,MAAM;AAAA,MACR,CAAC;AAED,aAAO;AAAA,IACT,SAAS,OAAO;AACd,cAAQ,MAAM,yBAAyB,KAAK;AAC5C,aAAOA,cAAa,SAAS,IAAI,IAAI,GAAG,QAAQ,0BAA0B,QAAQ,GAAG,CAAC;AAAA,IACxF;AAAA,EACF;AACF;","names":["https","default","NextResponse"]}

package/package.json

@@ -1,6 +1,6 @@
 {
   "name": "@oauth42/next",
-  "version": "0.2.4",
+  "version": "0.2.5",
   "description": "Official OAuth42 SDK for Next.js applications",
   "main": "./dist/index.js",
   "module": "./dist/index.mjs",