@oauth42/next 0.4.8 → 0.5.0

package/dist/middleware/index.d.ts

@@ -1,39 +1,2 @@
-import { NextRequest, NextResponse } from 'next/server';
-
-interface OAuth42AuthOptions {
-    pages?: {
-        signIn?: string;
-        error?: string;
-    };
-    callbacks?: {
-        authorized?: (params: {
-            token: any;
-            req: NextRequest;
-        }) => boolean | Promise<boolean>;
-    };
-    protectedPaths?: string[];
-    publicPaths?: string[];
-    /**
-     * Cookie prefix for custom cookie names. Must match the prefix used in createAuth().
-     * E.g., 'oauth42-portal' will look for cookie 'oauth42-portal.session-token'
-     */
-    cookiePrefix?: string;
-}
-/**
- * Middleware helper for protecting routes with OAuth42
- *
- * This middleware handles:
- * 1. Route protection (redirect to login if no session)
- * 2. Token refresh (refresh expired tokens and update cookie)
- */
-declare function withOAuth42Auth(options?: OAuth42AuthOptions): (req: NextRequest) => Promise<NextResponse<unknown>>;
-/**
- * Helper to create middleware configuration
- */
-declare function createMiddlewareConfig(protectedPaths?: string[], publicPaths?: string[]): {
-    matcher: string[];
-    protectedPaths: string[];
-    publicPaths: string[];
-};
-
-export { type OAuth42AuthOptions, createMiddlewareConfig, withOAuth42Auth };
+export { O as OAuth42AuthOptions, c as createMiddlewareConfig, w as withOAuth42Auth } from '../index-Cfqxl9r2.js';
+import 'next/server';

package/dist/middleware/index.js

@@ -28,10 +28,54 @@ module.exports = __toCommonJS(middleware_exports);
 // src/server/middleware.ts
 var import_server = require("next/server");
 var import_jwt = require("next-auth/jwt");
+
+// src/server/backend-session.ts
+function isBackendSessionMode(mode) {
+  return mode === "backend";
+}
+function sessionEndpoint(issuer) {
+  return `${issuer.replace(/\/$/, "")}/api/sdk/sessions`;
+}
+async function resolveBackendSession(params) {
+  const response = await fetch(`${sessionEndpoint(params.issuer)}/resolve`, {
+    method: "POST",
+    headers: { "Content-Type": "application/json" },
+    body: JSON.stringify({
+      session_id: params.sessionId,
+      client_id: params.clientId,
+      client_secret: params.clientSecret,
+      issuer: params.issuer
+    })
+  });
+  if (response.status === 401 || response.status === 403 || response.status === 404) {
+    return null;
+  }
+  if (!response.ok) {
+    throw new Error(`OAuth42 backend session resolve failed: ${response.status}`);
+  }
+  return response.json();
+}
+
+// src/server/middleware.ts
 var ALLOWED_COOKIE_SIZE = 4096;
 var ESTIMATED_EMPTY_COOKIE_SIZE = 163;
 var CHUNK_SIZE = ALLOWED_COOKIE_SIZE - ESTIMATED_EMPTY_COOKIE_SIZE;
+var REFRESH_RACE_GRACE_SECONDS = 60;
+var DEFAULT_SESSION_MAX_AGE_SECONDS = 365 * 24 * 60 * 60;
 var pendingRefreshes = /* @__PURE__ */ new Map();
+function shouldPreserveSessionOnRefreshFailure(params) {
+  if (params.error !== "invalid_grant" || !params.expiresAt) {
+    return false;
+  }
+  return params.now - params.expiresAt <= REFRESH_RACE_GRACE_SECONDS;
+}
+function resolveRefreshConfig(options, token) {
+  return {
+    clientId: options.clientId || token.clientId || process.env.OAUTH42_CLIENT_ID,
+    clientSecret: options.clientSecret || token.clientSecret || process.env.OAUTH42_CLIENT_SECRET,
+    issuer: options.issuer || token.issuer || process.env.OAUTH42_ISSUER || "https://localhost:8443"
+  };
+}
 async function refreshTokens(refreshToken, clientId, clientSecret, issuer) {
   try {
     const tokenUrl = `${issuer}/oauth2/token`;
@@ -66,9 +110,6 @@ async function refreshTokens(refreshToken, clientId, clientSecret, issuer) {
 }
 function withOAuth42Auth(options = {}) {
   const secret = process.env.NEXTAUTH_SECRET;
-  const clientId = process.env.OAUTH42_CLIENT_ID;
-  const clientSecret = process.env.OAUTH42_CLIENT_SECRET;
-  const issuer = process.env.OAUTH42_ISSUER || "https://localhost:8443";
   if (!secret) {
     console.warn("[OAuth42 Middleware] NEXTAUTH_SECRET not set");
   }
@@ -93,6 +134,42 @@ function withOAuth42Auth(options = {}) {
       url.searchParams.set("callbackUrl", pathname);
       return import_server.NextResponse.redirect(url);
     }
+    const refreshConfig = resolveRefreshConfig(options, token);
+    if (isBackendSessionMode(options.sessionStore)) {
+      const sessionId = token.oauth42SessionId;
+      if (!sessionId || !refreshConfig.clientId || !refreshConfig.clientSecret) {
+        const signInUrl = options.pages?.signIn || "/auth/signin";
+        const url = new URL(signInUrl, req.url);
+        url.searchParams.set("callbackUrl", pathname);
+        const response = import_server.NextResponse.redirect(url);
+        response.cookies.delete(cookieName);
+        return response;
+      }
+      const backendSession = await resolveBackendSession({
+        issuer: refreshConfig.issuer,
+        clientId: refreshConfig.clientId,
+        clientSecret: refreshConfig.clientSecret,
+        sessionId
+      }).catch((error) => {
+        console.error("[OAuth42 Middleware] Backend session resolve failed:", error);
+        return null;
+      });
+      if (!backendSession) {
+        const signInUrl = options.pages?.signIn || "/auth/signin";
+        const url = new URL(signInUrl, req.url);
+        url.searchParams.set("callbackUrl", pathname);
+        const response = import_server.NextResponse.redirect(url);
+        response.cookies.delete(cookieName);
+        return response;
+      }
+      const requestHeaders = new Headers(req.headers);
+      requestHeaders.set("x-oauth42-refreshed-token", backendSession.access_token);
+      return import_server.NextResponse.next({
+        request: {
+          headers: requestHeaders
+        }
+      });
+    }
     const expiresAt = token.expiresAt;
     const now = Math.floor(Date.now() / 1e3);
     const bufferSeconds = 15;
@@ -106,7 +183,7 @@ function withOAuth42Auth(options = {}) {
         path: pathname
       });
     }
-    if (needsRefresh && token.refreshToken && clientId && clientSecret) {
+    if (needsRefresh && token.refreshToken && refreshConfig.clientId && refreshConfig.clientSecret) {
       const userId = token.sub;
       let refreshPromise = pendingRefreshes.get(userId);
       if (refreshPromise) {
@@ -115,11 +192,14 @@ function withOAuth42Auth(options = {}) {
         console.log("[OAuth42 Middleware] Access token expired, refreshing...");
         refreshPromise = refreshTokens(
           token.refreshToken,
-          clientId,
-          clientSecret,
-          issuer
+          refreshConfig.clientId,
+          refreshConfig.clientSecret,
+          refreshConfig.issuer
         ).finally(() => {
-          setTimeout(() => pendingRefreshes.delete(userId), 3e4);
+          const cleanupTimer = setTimeout(() => pendingRefreshes.delete(userId), 3e4);
+          if (typeof cleanupTimer === "object" && "unref" in cleanupTimer) {
+            cleanupTimer.unref();
+          }
         });
         pendingRefreshes.set(userId, refreshPromise);
       }
@@ -146,7 +226,8 @@ function withOAuth42Auth(options = {}) {
           httpOnly: true,
           sameSite: "lax",
           path: "/",
-          secure: process.env.NODE_ENV === "production"
+          secure: process.env.NODE_ENV === "production",
+          maxAge: options.session?.maxAge ?? DEFAULT_SESSION_MAX_AGE_SECONDS
         };
         if (newJwt.length <= CHUNK_SIZE) {
           response.cookies.set(cookieName, newJwt, cookieOptions);
@@ -194,7 +275,23 @@ function withOAuth42Auth(options = {}) {
         });
         return response;
       } else {
-        console.log("[OAuth42 Middleware] Refresh failed (likely token blacklisted after deploy), clearing session");
+        if (shouldPreserveSessionOnRefreshFailure({
+          error: refreshed.error,
+          expiresAt,
+          now
+        })) {
+          console.warn(
+            "[OAuth42 Middleware] Refresh failed with invalid_grant for a recently expired token; preserving session cookie for likely parallel refresh race",
+            {
+              expiresAt,
+              now,
+              expiredAgo: now - expiresAt,
+              path: pathname
+            }
+          );
+          return import_server.NextResponse.next();
+        }
+        console.log("[OAuth42 Middleware] Refresh failed, clearing session");
         const signInUrl = options.pages?.signIn || "/auth/signin";
         const url = new URL(signInUrl, req.url);
         url.searchParams.set("callbackUrl", pathname);

package/dist/middleware/index.js.map

@@ -1 +1 @@
-{"version":3,"sources":["../../src/middleware/index.ts","../../src/server/middleware.ts"],"sourcesContent":["// Edge-compatible middleware exports\n// This file is separate from server/index.ts to avoid pulling in Node.js modules\n\nexport { withOAuth42Auth, createMiddlewareConfig } from '../server/middleware';\nexport type { OAuth42AuthOptions } from '../server/middleware';\n","import { NextRequest, NextResponse } from 'next/server';\nimport { getToken, encode } from 'next-auth/jwt';\n\n/**\n * Cookie chunking constants — must match NextAuth's SessionStore behavior.\n * NextAuth splits cookies at ALLOWED_COOKIE_SIZE (4096) minus overhead (163).\n * When middleware re-encodes the JWT after a token refresh, the cookie must be\n * chunked the same way, otherwise:\n *   - A single cookie > ~4 KB is silently rejected by the browser\n *   - Leftover chunk cookies from the original session cause SessionStore to\n *     concatenate old chunks with the new base cookie, producing garbage\n */\nconst ALLOWED_COOKIE_SIZE = 4096;\nconst ESTIMATED_EMPTY_COOKIE_SIZE = 163;\nconst CHUNK_SIZE = ALLOWED_COOKIE_SIZE - ESTIMATED_EMPTY_COOKIE_SIZE;\n\n/**\n * In-flight refresh tracking to prevent parallel refresh calls.\n * Key: user ID (from token.sub), Value: Promise that resolves with refresh result\n */\nconst pendingRefreshes = new Map<string, Promise<{\n  success: boolean;\n  accessToken?: string;\n  refreshToken?: string;\n  expiresAt?: number;\n  error?: string;\n}>>();\n\nexport interface OAuth42AuthOptions {\n  pages?: {\n    signIn?: string;\n    error?: string;\n  };\n  callbacks?: {\n    authorized?: (params: { token: any; req: NextRequest }) => boolean | Promise<boolean>;\n  };\n  protectedPaths?: string[];\n  publicPaths?: string[];\n  /**\n   * Cookie prefix for custom cookie names. Must match the prefix used in createAuth().\n   * E.g., 'oauth42-portal' will look for cookie 'oauth42-portal.session-token'\n   */\n  cookiePrefix?: string;\n}\n\n/**\n * Refresh tokens by calling the OAuth42 backend directly\n */\nasync function refreshTokens(\n  refreshToken: string,\n  clientId: string,\n  clientSecret: string,\n  issuer: string\n): Promise<{ success: boolean; accessToken?: string; refreshToken?: string; expiresAt?: number; error?: string }> {\n  try {\n    const tokenUrl = `${issuer}/oauth2/token`;\n\n    const response = await fetch(tokenUrl, {\n      method: 'POST',\n      headers: {\n        'Content-Type': 'application/x-www-form-urlencoded',\n      },\n      body: new URLSearchParams({\n        grant_type: 'refresh_token',\n        refresh_token: refreshToken,\n        client_id: clientId,\n        client_secret: clientSecret,\n      }),\n    });\n\n    const data = await response.json();\n\n    if (!response.ok) {\n      console.error('[OAuth42 Middleware] Token refresh failed:', data);\n      return { success: false, error: data.error || 'refresh_failed' };\n    }\n\n    console.log('[OAuth42 Middleware] Token refreshed successfully');\n    return {\n      success: true,\n      accessToken: data.access_token,\n      refreshToken: data.refresh_token,\n      expiresAt: Math.floor(Date.now() / 1000) + (data.expires_in || 3600),\n    };\n  } catch (error) {\n    console.error('[OAuth42 Middleware] Token refresh error:', error);\n    return { success: false, error: 'refresh_error' };\n  }\n}\n\n/**\n * Middleware helper for protecting routes with OAuth42\n *\n * This middleware handles:\n * 1. Route protection (redirect to login if no session)\n * 2. Token refresh (refresh expired tokens and update cookie)\n */\nexport function withOAuth42Auth(options: OAuth42AuthOptions = {}) {\n  const secret = process.env.NEXTAUTH_SECRET;\n  const clientId = process.env.OAUTH42_CLIENT_ID;\n  const clientSecret = process.env.OAUTH42_CLIENT_SECRET;\n  const issuer = process.env.OAUTH42_ISSUER || 'https://localhost:8443';\n\n  if (!secret) {\n    console.warn('[OAuth42 Middleware] NEXTAUTH_SECRET not set');\n  }\n\n  return async function middleware(req: NextRequest) {\n    // Build cookie name - if prefix is provided, use custom name\n    const cookieName = options.cookiePrefix\n      ? `${options.cookiePrefix}.session-token`\n      : 'next-auth.session-token';\n\n    const token = await getToken({\n      req: req as any,\n      secret,\n      cookieName,\n    });\n\n    const pathname = req.nextUrl.pathname;\n\n    // Check if path is explicitly public\n    if (options.publicPaths?.some(path => pathname.startsWith(path))) {\n      return NextResponse.next();\n    }\n\n    // Check if path needs protection\n    const needsProtection = options.protectedPaths\n      ? options.protectedPaths.some(path => pathname.startsWith(path))\n      : true; // Default to protecting all paths\n\n    if (!needsProtection) {\n      return NextResponse.next();\n    }\n\n    // No token at all - redirect to sign in\n    if (!token) {\n      const signInUrl = options.pages?.signIn || '/auth/signin';\n      const url = new URL(signInUrl, req.url);\n      url.searchParams.set('callbackUrl', pathname);\n      return NextResponse.redirect(url);\n    }\n\n    // Check if access token is expired or expiring soon (15 second buffer)\n    // Buffer must be less than the token TTL to have a valid window\n    const expiresAt = token.expiresAt as number | undefined;\n    const now = Math.floor(Date.now() / 1000);\n    const bufferSeconds = 15;\n    const needsRefresh = expiresAt && now >= expiresAt - bufferSeconds;\n\n    if (needsRefresh) {\n      console.log('[OAuth42 Middleware] Token needs refresh:', {\n        expiresAt,\n        now,\n        expiredAgo: expiresAt ? now - expiresAt : 'n/a',\n        accessTokenPrefix: (token.accessToken as string)?.substring(0, 20),\n        path: pathname,\n      });\n    }\n\n    if (needsRefresh && token.refreshToken && clientId && clientSecret) {\n      const userId = token.sub as string;\n\n      // Check if there's already a refresh in progress for this user\n      let refreshPromise = pendingRefreshes.get(userId);\n\n      if (refreshPromise) {\n        console.log('[OAuth42 Middleware] Waiting for in-flight refresh...');\n      } else {\n        console.log('[OAuth42 Middleware] Access token expired, refreshing...');\n\n        // Create the refresh promise and store it.\n        // Keep the entry for 30s after completion so late-arriving requests\n        // (with stale cookies) reuse the cached result instead of triggering\n        // a new refresh with the already-rotated token. See issue #470.\n        refreshPromise = refreshTokens(\n          token.refreshToken as string,\n          clientId,\n          clientSecret,\n          issuer\n        ).finally(() => {\n          setTimeout(() => pendingRefreshes.delete(userId), 30000);\n        });\n\n        pendingRefreshes.set(userId, refreshPromise);\n      }\n\n      const refreshed = await refreshPromise;\n\n      if (refreshed.success && refreshed.accessToken && refreshed.refreshToken) {\n        // Update the token with new values\n        const updatedToken = {\n          ...token,\n          accessToken: refreshed.accessToken,\n          refreshToken: refreshed.refreshToken,\n          expiresAt: refreshed.expiresAt,\n        };\n\n        // Re-encode the JWT\n        const newJwt = await encode({\n          token: updatedToken,\n          secret: secret!,\n        });\n\n        // Create response with request headers that pass the new token to API routes\n        // This is necessary because API routes read from the request, not the response cookie\n        const requestHeaders = new Headers(req.headers);\n        requestHeaders.set('x-oauth42-refreshed-token', refreshed.accessToken);\n\n        const response = NextResponse.next({\n          request: {\n            headers: requestHeaders,\n          },\n        });\n\n        const cookieOptions = {\n          httpOnly: true,\n          sameSite: 'lax' as const,\n          path: '/',\n          secure: process.env.NODE_ENV === 'production',\n        };\n\n        // Set cookie with chunking matching NextAuth's SessionStore behavior.\n        // Without chunking, a JWT > ~4 KB is silently rejected by the browser,\n        // causing an infinite refresh loop where every request re-triggers\n        // token refresh but the cookie never persists.\n        if (newJwt.length <= CHUNK_SIZE) {\n          // Fits in a single cookie\n          response.cookies.set(cookieName, newJwt, cookieOptions);\n          // Clean up any leftover chunk cookies from a previously chunked session\n          for (let i = 0; ; i++) {\n            const chunkName = `${cookieName}.${i}`;\n            if (req.cookies.has(chunkName)) {\n              response.cookies.set(chunkName, '', { ...cookieOptions, maxAge: 0 });\n            } else {\n              break;\n            }\n          }\n        } else {\n          // Cookie too large — chunk it like NextAuth does\n          const chunkCount = Math.ceil(newJwt.length / CHUNK_SIZE);\n          for (let i = 0; i < chunkCount; i++) {\n            const chunkName = `${cookieName}.${i}`;\n            const chunkValue = newJwt.slice(i * CHUNK_SIZE, (i + 1) * CHUNK_SIZE);\n            response.cookies.set(chunkName, chunkValue, cookieOptions);\n          }\n          // Delete the base cookie so SessionStore only reads chunks\n          response.cookies.set(cookieName, '', { ...cookieOptions, maxAge: 0 });\n          // Clean up any extra old chunks beyond the new count\n          for (let i = chunkCount; ; i++) {\n            const chunkName = `${cookieName}.${i}`;\n            if (req.cookies.has(chunkName)) {\n              response.cookies.set(chunkName, '', { ...cookieOptions, maxAge: 0 });\n            } else {\n              break;\n            }\n          }\n        }\n\n        // Log details to help diagnose cookie persistence issues\n        const existingChunks = [];\n        for (let i = 0; ; i++) {\n          if (req.cookies.has(`${cookieName}.${i}`)) {\n            existingChunks.push(i);\n          } else {\n            break;\n          }\n        }\n        console.log(`[OAuth42 Middleware] Token refresh complete:`, {\n          jwtBytes: newJwt.length,\n          chunked: newJwt.length > CHUNK_SIZE,\n          existingBaseCooke: req.cookies.has(cookieName),\n          existingChunks: existingChunks.length > 0 ? existingChunks : 'none',\n          newAccessTokenPrefix: refreshed.accessToken?.substring(0, 20),\n          newExpiresAt: refreshed.expiresAt,\n          cookieName,\n        });\n        return response;\n      } else {\n        // Refresh failed - clear cookie and redirect to sign in (no error, just let user log in fresh)\n        console.log('[OAuth42 Middleware] Refresh failed (likely token blacklisted after deploy), clearing session');\n        const signInUrl = options.pages?.signIn || '/auth/signin';\n        const url = new URL(signInUrl, req.url);\n        url.searchParams.set('callbackUrl', pathname);\n        // DO NOT set error parameter - just redirect silently\n\n        const response = NextResponse.redirect(url);\n        // Clear the base session cookie and any chunk cookies\n        response.cookies.delete(cookieName);\n        for (let i = 0; ; i++) {\n          const chunkName = `${cookieName}.${i}`;\n          if (req.cookies.has(chunkName)) {\n            response.cookies.delete(chunkName);\n          } else {\n            break;\n          }\n        }\n        return response;\n      }\n    }\n\n    // Check custom authorization callback\n    if (options.callbacks?.authorized) {\n      const isAuthorized = await options.callbacks.authorized({ token, req });\n      if (!isAuthorized) {\n        const signInUrl = options.pages?.signIn || '/auth/signin';\n        const url = new URL(signInUrl, req.url);\n        url.searchParams.set('callbackUrl', pathname);\n        return NextResponse.redirect(url);\n      }\n    }\n\n    return NextResponse.next();\n  };\n}\n\n/**\n * Helper to create middleware configuration\n */\nexport function createMiddlewareConfig(\n  protectedPaths: string[] = ['/protected'],\n  publicPaths: string[] = ['/auth', '/api/auth']\n) {\n  return {\n    matcher: [\n      /*\n       * Match all request paths except for the ones starting with:\n       * - _next/static (static files)\n       * - _next/image (image optimization files)\n       * - favicon.ico (favicon file)\n       * - public folder\n       */\n      '/((?!_next/static|_next/image|favicon.ico|public).*)',\n    ],\n    protectedPaths,\n    publicPaths,\n  };\n}\n"],"mappings":";;;;;;;;;;;;;;;;;;;;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;;;ACAA,oBAA0C;AAC1C,iBAAiC;AAWjC,IAAM,sBAAsB;AAC5B,IAAM,8BAA8B;AACpC,IAAM,aAAa,sBAAsB;AAMzC,IAAM,mBAAmB,oBAAI,IAMzB;AAsBJ,eAAe,cACb,cACA,UACA,cACA,QACgH;AAChH,MAAI;AACF,UAAM,WAAW,GAAG,MAAM;AAE1B,UAAM,WAAW,MAAM,MAAM,UAAU;AAAA,MACrC,QAAQ;AAAA,MACR,SAAS;AAAA,QACP,gBAAgB;AAAA,MAClB;AAAA,MACA,MAAM,IAAI,gBAAgB;AAAA,QACxB,YAAY;AAAA,QACZ,eAAe;AAAA,QACf,WAAW;AAAA,QACX,eAAe;AAAA,MACjB,CAAC;AAAA,IACH,CAAC;AAED,UAAM,OAAO,MAAM,SAAS,KAAK;AAEjC,QAAI,CAAC,SAAS,IAAI;AAChB,cAAQ,MAAM,8CAA8C,IAAI;AAChE,aAAO,EAAE,SAAS,OAAO,OAAO,KAAK,SAAS,iBAAiB;AAAA,IACjE;AAEA,YAAQ,IAAI,mDAAmD;AAC/D,WAAO;AAAA,MACL,SAAS;AAAA,MACT,aAAa,KAAK;AAAA,MAClB,cAAc,KAAK;AAAA,MACnB,WAAW,KAAK,MAAM,KAAK,IAAI,IAAI,GAAI,KAAK,KAAK,cAAc;AAAA,IACjE;AAAA,EACF,SAAS,OAAO;AACd,YAAQ,MAAM,6CAA6C,KAAK;AAChE,WAAO,EAAE,SAAS,OAAO,OAAO,gBAAgB;AAAA,EAClD;AACF;AASO,SAAS,gBAAgB,UAA8B,CAAC,GAAG;AAChE,QAAM,SAAS,QAAQ,IAAI;AAC3B,QAAM,WAAW,QAAQ,IAAI;AAC7B,QAAM,eAAe,QAAQ,IAAI;AACjC,QAAM,SAAS,QAAQ,IAAI,kBAAkB;AAE7C,MAAI,CAAC,QAAQ;AACX,YAAQ,KAAK,8CAA8C;AAAA,EAC7D;AAEA,SAAO,eAAe,WAAW,KAAkB;AAEjD,UAAM,aAAa,QAAQ,eACvB,GAAG,QAAQ,YAAY,mBACvB;AAEJ,UAAM,QAAQ,UAAM,qBAAS;AAAA,MAC3B;AAAA,MACA;AAAA,MACA;AAAA,IACF,CAAC;AAED,UAAM,WAAW,IAAI,QAAQ;AAG7B,QAAI,QAAQ,aAAa,KAAK,UAAQ,SAAS,WAAW,IAAI,CAAC,GAAG;AAChE,aAAO,2BAAa,KAAK;AAAA,IAC3B;AAGA,UAAM,kBAAkB,QAAQ,iBAC5B,QAAQ,eAAe,KAAK,UAAQ,SAAS,WAAW,IAAI,CAAC,IAC7D;AAEJ,QAAI,CAAC,iBAAiB;AACpB,aAAO,2BAAa,KAAK;AAAA,IAC3B;AAGA,QAAI,CAAC,OAAO;AACV,YAAM,YAAY,QAAQ,OAAO,UAAU;AAC3C,YAAM,MAAM,IAAI,IAAI,WAAW,IAAI,GAAG;AACtC,UAAI,aAAa,IAAI,eAAe,QAAQ;AAC5C,aAAO,2BAAa,SAAS,GAAG;AAAA,IAClC;AAIA,UAAM,YAAY,MAAM;AACxB,UAAM,MAAM,KAAK,MAAM,KAAK,IAAI,IAAI,GAAI;AACxC,UAAM,gBAAgB;AACtB,UAAM,eAAe,aAAa,OAAO,YAAY;AAErD,QAAI,cAAc;AAChB,cAAQ,IAAI,6CAA6C;AAAA,QACvD;AAAA,QACA;AAAA,QACA,YAAY,YAAY,MAAM,YAAY;AAAA,QAC1C,mBAAoB,MAAM,aAAwB,UAAU,GAAG,EAAE;AAAA,QACjE,MAAM;AAAA,MACR,CAAC;AAAA,IACH;AAEA,QAAI,gBAAgB,MAAM,gBAAgB,YAAY,cAAc;AAClE,YAAM,SAAS,MAAM;AAGrB,UAAI,iBAAiB,iBAAiB,IAAI,MAAM;AAEhD,UAAI,gBAAgB;AAClB,gBAAQ,IAAI,uDAAuD;AAAA,MACrE,OAAO;AACL,gBAAQ,IAAI,0DAA0D;AAMtE,yBAAiB;AAAA,UACf,MAAM;AAAA,UACN;AAAA,UACA;AAAA,UACA;AAAA,QACF,EAAE,QAAQ,MAAM;AACd,qBAAW,MAAM,iBAAiB,OAAO,MAAM,GAAG,GAAK;AAAA,QACzD,CAAC;AAED,yBAAiB,IAAI,QAAQ,cAAc;AAAA,MAC7C;AAEA,YAAM,YAAY,MAAM;AAExB,UAAI,UAAU,WAAW,UAAU,eAAe,UAAU,cAAc;AAExE,cAAM,eAAe;AAAA,UACnB,GAAG;AAAA,UACH,aAAa,UAAU;AAAA,UACvB,cAAc,UAAU;AAAA,UACxB,WAAW,UAAU;AAAA,QACvB;AAGA,cAAM,SAAS,UAAM,mBAAO;AAAA,UAC1B,OAAO;AAAA,UACP;AAAA,QACF,CAAC;AAID,cAAM,iBAAiB,IAAI,QAAQ,IAAI,OAAO;AAC9C,uBAAe,IAAI,6BAA6B,UAAU,WAAW;AAErE,cAAM,WAAW,2BAAa,KAAK;AAAA,UACjC,SAAS;AAAA,YACP,SAAS;AAAA,UACX;AAAA,QACF,CAAC;AAED,cAAM,gBAAgB;AAAA,UACpB,UAAU;AAAA,UACV,UAAU;AAAA,UACV,MAAM;AAAA,UACN,QAAQ,QAAQ,IAAI,aAAa;AAAA,QACnC;AAMA,YAAI,OAAO,UAAU,YAAY;AAE/B,mBAAS,QAAQ,IAAI,YAAY,QAAQ,aAAa;AAEtD,mBAAS,IAAI,KAAK,KAAK;AACrB,kBAAM,YAAY,GAAG,UAAU,IAAI,CAAC;AACpC,gBAAI,IAAI,QAAQ,IAAI,SAAS,GAAG;AAC9B,uBAAS,QAAQ,IAAI,WAAW,IAAI,EAAE,GAAG,eAAe,QAAQ,EAAE,CAAC;AAAA,YACrE,OAAO;AACL;AAAA,YACF;AAAA,UACF;AAAA,QACF,OAAO;AAEL,gBAAM,aAAa,KAAK,KAAK,OAAO,SAAS,UAAU;AACvD,mBAAS,IAAI,GAAG,IAAI,YAAY,KAAK;AACnC,kBAAM,YAAY,GAAG,UAAU,IAAI,CAAC;AACpC,kBAAM,aAAa,OAAO,MAAM,IAAI,aAAa,IAAI,KAAK,UAAU;AACpE,qBAAS,QAAQ,IAAI,WAAW,YAAY,aAAa;AAAA,UAC3D;AAEA,mBAAS,QAAQ,IAAI,YAAY,IAAI,EAAE,GAAG,eAAe,QAAQ,EAAE,CAAC;AAEpE,mBAAS,IAAI,cAAc,KAAK;AAC9B,kBAAM,YAAY,GAAG,UAAU,IAAI,CAAC;AACpC,gBAAI,IAAI,QAAQ,IAAI,SAAS,GAAG;AAC9B,uBAAS,QAAQ,IAAI,WAAW,IAAI,EAAE,GAAG,eAAe,QAAQ,EAAE,CAAC;AAAA,YACrE,OAAO;AACL;AAAA,YACF;AAAA,UACF;AAAA,QACF;AAGA,cAAM,iBAAiB,CAAC;AACxB,iBAAS,IAAI,KAAK,KAAK;AACrB,cAAI,IAAI,QAAQ,IAAI,GAAG,UAAU,IAAI,CAAC,EAAE,GAAG;AACzC,2BAAe,KAAK,CAAC;AAAA,UACvB,OAAO;AACL;AAAA,UACF;AAAA,QACF;AACA,gBAAQ,IAAI,gDAAgD;AAAA,UAC1D,UAAU,OAAO;AAAA,UACjB,SAAS,OAAO,SAAS;AAAA,UACzB,mBAAmB,IAAI,QAAQ,IAAI,UAAU;AAAA,UAC7C,gBAAgB,eAAe,SAAS,IAAI,iBAAiB;AAAA,UAC7D,sBAAsB,UAAU,aAAa,UAAU,GAAG,EAAE;AAAA,UAC5D,cAAc,UAAU;AAAA,UACxB;AAAA,QACF,CAAC;AACD,eAAO;AAAA,MACT,OAAO;AAEL,gBAAQ,IAAI,+FAA+F;AAC3G,cAAM,YAAY,QAAQ,OAAO,UAAU;AAC3C,cAAM,MAAM,IAAI,IAAI,WAAW,IAAI,GAAG;AACtC,YAAI,aAAa,IAAI,eAAe,QAAQ;AAG5C,cAAM,WAAW,2BAAa,SAAS,GAAG;AAE1C,iBAAS,QAAQ,OAAO,UAAU;AAClC,iBAAS,IAAI,KAAK,KAAK;AACrB,gBAAM,YAAY,GAAG,UAAU,IAAI,CAAC;AACpC,cAAI,IAAI,QAAQ,IAAI,SAAS,GAAG;AAC9B,qBAAS,QAAQ,OAAO,SAAS;AAAA,UACnC,OAAO;AACL;AAAA,UACF;AAAA,QACF;AACA,eAAO;AAAA,MACT;AAAA,IACF;AAGA,QAAI,QAAQ,WAAW,YAAY;AACjC,YAAM,eAAe,MAAM,QAAQ,UAAU,WAAW,EAAE,OAAO,IAAI,CAAC;AACtE,UAAI,CAAC,cAAc;AACjB,cAAM,YAAY,QAAQ,OAAO,UAAU;AAC3C,cAAM,MAAM,IAAI,IAAI,WAAW,IAAI,GAAG;AACtC,YAAI,aAAa,IAAI,eAAe,QAAQ;AAC5C,eAAO,2BAAa,SAAS,GAAG;AAAA,MAClC;AAAA,IACF;AAEA,WAAO,2BAAa,KAAK;AAAA,EAC3B;AACF;AAKO,SAAS,uBACd,iBAA2B,CAAC,YAAY,GACxC,cAAwB,CAAC,SAAS,WAAW,GAC7C;AACA,SAAO;AAAA,IACL,SAAS;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA,MAQP;AAAA,IACF;AAAA,IACA;AAAA,IACA;AAAA,EACF;AACF;","names":[]}
+{"version":3,"sources":["../../src/middleware/index.ts","../../src/server/middleware.ts","../../src/server/backend-session.ts"],"sourcesContent":["// Edge-compatible middleware exports\n// This file is separate from server/index.ts to avoid pulling in Node.js modules\n\nexport { withOAuth42Auth, createMiddlewareConfig } from '../server/middleware';\nexport type { OAuth42AuthOptions } from '../server/middleware';\n","import { NextRequest, NextResponse } from 'next/server';\nimport { getToken, encode } from 'next-auth/jwt';\nimport {\n  isBackendSessionMode,\n  resolveBackendSession,\n  type SessionStoreMode,\n} from './backend-session';\n\n/**\n * Cookie chunking constants — must match NextAuth's SessionStore behavior.\n * NextAuth splits cookies at ALLOWED_COOKIE_SIZE (4096) minus overhead (163).\n * When middleware re-encodes the JWT after a token refresh, the cookie must be\n * chunked the same way, otherwise:\n *   - A single cookie > ~4 KB is silently rejected by the browser\n *   - Leftover chunk cookies from the original session cause SessionStore to\n *     concatenate old chunks with the new base cookie, producing garbage\n */\nconst ALLOWED_COOKIE_SIZE = 4096;\nconst ESTIMATED_EMPTY_COOKIE_SIZE = 163;\nconst CHUNK_SIZE = ALLOWED_COOKIE_SIZE - ESTIMATED_EMPTY_COOKIE_SIZE;\nconst REFRESH_RACE_GRACE_SECONDS = 60;\nconst DEFAULT_SESSION_MAX_AGE_SECONDS = 365 * 24 * 60 * 60;\n\n/**\n * In-flight refresh tracking to prevent parallel refresh calls.\n * Key: user ID (from token.sub), Value: Promise that resolves with refresh result\n */\nconst pendingRefreshes = new Map<string, Promise<{\n  success: boolean;\n  accessToken?: string;\n  refreshToken?: string;\n  expiresAt?: number;\n  error?: string;\n}>>();\n\nexport interface OAuth42AuthOptions {\n  pages?: {\n    signIn?: string;\n    error?: string;\n  };\n  callbacks?: {\n    authorized?: (params: { token: any; req: NextRequest }) => boolean | Promise<boolean>;\n  };\n  protectedPaths?: string[];\n  publicPaths?: string[];\n  /**\n   * Cookie prefix for custom cookie names. Must match the prefix used in createAuth().\n   * E.g., 'oauth42-portal' will look for cookie 'oauth42-portal.session-token'\n   */\n  cookiePrefix?: string;\n  /**\n   * OAuth client credentials for middleware refresh. When omitted, the middleware\n   * prefers credentials embedded in the NextAuth token by createAuth(), then\n   * falls back to OAUTH42_CLIENT_ID / OAUTH42_CLIENT_SECRET.\n   */\n  clientId?: string;\n  clientSecret?: string;\n  issuer?: string;\n  /**\n   * \"backend\" keeps OAuth token material in the Rust backend and stores only\n   * an opaque backend session id in the NextAuth JWT cookie.\n   */\n  sessionStore?: SessionStoreMode;\n  /**\n   * Session cookie lifetime. Should match createAuth({ session.maxAge }).\n   * Defaults to OAuth42's persistent-session policy of 365 days.\n   */\n  session?: {\n    maxAge?: number;\n  };\n}\n\nexport function shouldPreserveSessionOnRefreshFailure(params: {\n  error?: string;\n  expiresAt?: number;\n  now: number;\n}): boolean {\n  if (params.error !== 'invalid_grant' || !params.expiresAt) {\n    return false;\n  }\n\n  return params.now - params.expiresAt <= REFRESH_RACE_GRACE_SECONDS;\n}\n\nexport function resolveRefreshConfig(\n  options: OAuth42AuthOptions,\n  token: any\n): { clientId?: string; clientSecret?: string; issuer: string } {\n  return {\n    clientId:\n      options.clientId ||\n      (token.clientId as string | undefined) ||\n      process.env.OAUTH42_CLIENT_ID,\n    clientSecret:\n      options.clientSecret ||\n      (token.clientSecret as string | undefined) ||\n      process.env.OAUTH42_CLIENT_SECRET,\n    issuer:\n      options.issuer ||\n      (token.issuer as string | undefined) ||\n      process.env.OAUTH42_ISSUER ||\n      'https://localhost:8443',\n  };\n}\n\n/**\n * Refresh tokens by calling the OAuth42 backend directly\n */\nasync function refreshTokens(\n  refreshToken: string,\n  clientId: string,\n  clientSecret: string,\n  issuer: string\n): Promise<{ success: boolean; accessToken?: string; refreshToken?: string; expiresAt?: number; error?: string }> {\n  try {\n    const tokenUrl = `${issuer}/oauth2/token`;\n\n    const response = await fetch(tokenUrl, {\n      method: 'POST',\n      headers: {\n        'Content-Type': 'application/x-www-form-urlencoded',\n      },\n      body: new URLSearchParams({\n        grant_type: 'refresh_token',\n        refresh_token: refreshToken,\n        client_id: clientId,\n        client_secret: clientSecret,\n      }),\n    });\n\n    const data = await response.json();\n\n    if (!response.ok) {\n      console.error('[OAuth42 Middleware] Token refresh failed:', data);\n      return { success: false, error: data.error || 'refresh_failed' };\n    }\n\n    console.log('[OAuth42 Middleware] Token refreshed successfully');\n    return {\n      success: true,\n      accessToken: data.access_token,\n      refreshToken: data.refresh_token,\n      expiresAt: Math.floor(Date.now() / 1000) + (data.expires_in || 3600),\n    };\n  } catch (error) {\n    console.error('[OAuth42 Middleware] Token refresh error:', error);\n    return { success: false, error: 'refresh_error' };\n  }\n}\n\n/**\n * Middleware helper for protecting routes with OAuth42\n *\n * This middleware handles:\n * 1. Route protection (redirect to login if no session)\n * 2. Token refresh (refresh expired tokens and update cookie)\n */\nexport function withOAuth42Auth(options: OAuth42AuthOptions = {}) {\n  const secret = process.env.NEXTAUTH_SECRET;\n\n  if (!secret) {\n    console.warn('[OAuth42 Middleware] NEXTAUTH_SECRET not set');\n  }\n\n  return async function middleware(req: NextRequest) {\n    // Build cookie name - if prefix is provided, use custom name\n    const cookieName = options.cookiePrefix\n      ? `${options.cookiePrefix}.session-token`\n      : 'next-auth.session-token';\n\n    const token = await getToken({\n      req: req as any,\n      secret,\n      cookieName,\n    });\n\n    const pathname = req.nextUrl.pathname;\n\n    // Check if path is explicitly public\n    if (options.publicPaths?.some(path => pathname.startsWith(path))) {\n      return NextResponse.next();\n    }\n\n    // Check if path needs protection\n    const needsProtection = options.protectedPaths\n      ? options.protectedPaths.some(path => pathname.startsWith(path))\n      : true; // Default to protecting all paths\n\n    if (!needsProtection) {\n      return NextResponse.next();\n    }\n\n    // No token at all - redirect to sign in\n    if (!token) {\n      const signInUrl = options.pages?.signIn || '/auth/signin';\n      const url = new URL(signInUrl, req.url);\n      url.searchParams.set('callbackUrl', pathname);\n      return NextResponse.redirect(url);\n    }\n\n    const refreshConfig = resolveRefreshConfig(options, token);\n\n    if (isBackendSessionMode(options.sessionStore)) {\n      const sessionId = token.oauth42SessionId as string | undefined;\n      if (!sessionId || !refreshConfig.clientId || !refreshConfig.clientSecret) {\n        const signInUrl = options.pages?.signIn || '/auth/signin';\n        const url = new URL(signInUrl, req.url);\n        url.searchParams.set('callbackUrl', pathname);\n        const response = NextResponse.redirect(url);\n        response.cookies.delete(cookieName);\n        return response;\n      }\n\n      const backendSession = await resolveBackendSession({\n        issuer: refreshConfig.issuer,\n        clientId: refreshConfig.clientId,\n        clientSecret: refreshConfig.clientSecret,\n        sessionId,\n      }).catch(error => {\n        console.error('[OAuth42 Middleware] Backend session resolve failed:', error);\n        return null;\n      });\n\n      if (!backendSession) {\n        const signInUrl = options.pages?.signIn || '/auth/signin';\n        const url = new URL(signInUrl, req.url);\n        url.searchParams.set('callbackUrl', pathname);\n        const response = NextResponse.redirect(url);\n        response.cookies.delete(cookieName);\n        return response;\n      }\n\n      const requestHeaders = new Headers(req.headers);\n      requestHeaders.set('x-oauth42-refreshed-token', backendSession.access_token);\n      return NextResponse.next({\n        request: {\n          headers: requestHeaders,\n        },\n      });\n    }\n\n    // Check if access token is expired or expiring soon (15 second buffer)\n    // Buffer must be less than the token TTL to have a valid window\n    const expiresAt = token.expiresAt as number | undefined;\n    const now = Math.floor(Date.now() / 1000);\n    const bufferSeconds = 15;\n    const needsRefresh = expiresAt && now >= expiresAt - bufferSeconds;\n\n    if (needsRefresh) {\n      console.log('[OAuth42 Middleware] Token needs refresh:', {\n        expiresAt,\n        now,\n        expiredAgo: expiresAt ? now - expiresAt : 'n/a',\n        accessTokenPrefix: (token.accessToken as string)?.substring(0, 20),\n        path: pathname,\n      });\n    }\n\n    if (needsRefresh && token.refreshToken && refreshConfig.clientId && refreshConfig.clientSecret) {\n      const userId = token.sub as string;\n\n      // Check if there's already a refresh in progress for this user\n      let refreshPromise = pendingRefreshes.get(userId);\n\n      if (refreshPromise) {\n        console.log('[OAuth42 Middleware] Waiting for in-flight refresh...');\n      } else {\n        console.log('[OAuth42 Middleware] Access token expired, refreshing...');\n\n        // Create the refresh promise and store it.\n        // Keep the entry for 30s after completion so late-arriving requests\n        // (with stale cookies) reuse the cached result instead of triggering\n        // a new refresh with the already-rotated token. See issue #470.\n        refreshPromise = refreshTokens(\n          token.refreshToken as string,\n          refreshConfig.clientId,\n          refreshConfig.clientSecret,\n          refreshConfig.issuer\n        ).finally(() => {\n          const cleanupTimer = setTimeout(() => pendingRefreshes.delete(userId), 30000);\n          if (typeof cleanupTimer === 'object' && 'unref' in cleanupTimer) {\n            cleanupTimer.unref();\n          }\n        });\n\n        pendingRefreshes.set(userId, refreshPromise);\n      }\n\n      const refreshed = await refreshPromise;\n\n      if (refreshed.success && refreshed.accessToken && refreshed.refreshToken) {\n        // Update the token with new values\n        const updatedToken = {\n          ...token,\n          accessToken: refreshed.accessToken,\n          refreshToken: refreshed.refreshToken,\n          expiresAt: refreshed.expiresAt,\n        };\n\n        // Re-encode the JWT\n        const newJwt = await encode({\n          token: updatedToken,\n          secret: secret!,\n        });\n\n        // Create response with request headers that pass the new token to API routes\n        // This is necessary because API routes read from the request, not the response cookie\n        const requestHeaders = new Headers(req.headers);\n        requestHeaders.set('x-oauth42-refreshed-token', refreshed.accessToken);\n\n        const response = NextResponse.next({\n          request: {\n            headers: requestHeaders,\n          },\n        });\n\n        const cookieOptions = {\n          httpOnly: true,\n          sameSite: 'lax' as const,\n          path: '/',\n          secure: process.env.NODE_ENV === 'production',\n          maxAge: options.session?.maxAge ?? DEFAULT_SESSION_MAX_AGE_SECONDS,\n        };\n\n        // Set cookie with chunking matching NextAuth's SessionStore behavior.\n        // Without chunking, a JWT > ~4 KB is silently rejected by the browser,\n        // causing an infinite refresh loop where every request re-triggers\n        // token refresh but the cookie never persists.\n        if (newJwt.length <= CHUNK_SIZE) {\n          // Fits in a single cookie\n          response.cookies.set(cookieName, newJwt, cookieOptions);\n          // Clean up any leftover chunk cookies from a previously chunked session\n          for (let i = 0; ; i++) {\n            const chunkName = `${cookieName}.${i}`;\n            if (req.cookies.has(chunkName)) {\n              response.cookies.set(chunkName, '', { ...cookieOptions, maxAge: 0 });\n            } else {\n              break;\n            }\n          }\n        } else {\n          // Cookie too large — chunk it like NextAuth does\n          const chunkCount = Math.ceil(newJwt.length / CHUNK_SIZE);\n          for (let i = 0; i < chunkCount; i++) {\n            const chunkName = `${cookieName}.${i}`;\n            const chunkValue = newJwt.slice(i * CHUNK_SIZE, (i + 1) * CHUNK_SIZE);\n            response.cookies.set(chunkName, chunkValue, cookieOptions);\n          }\n          // Delete the base cookie so SessionStore only reads chunks\n          response.cookies.set(cookieName, '', { ...cookieOptions, maxAge: 0 });\n          // Clean up any extra old chunks beyond the new count\n          for (let i = chunkCount; ; i++) {\n            const chunkName = `${cookieName}.${i}`;\n            if (req.cookies.has(chunkName)) {\n              response.cookies.set(chunkName, '', { ...cookieOptions, maxAge: 0 });\n            } else {\n              break;\n            }\n          }\n        }\n\n        // Log details to help diagnose cookie persistence issues\n        const existingChunks = [];\n        for (let i = 0; ; i++) {\n          if (req.cookies.has(`${cookieName}.${i}`)) {\n            existingChunks.push(i);\n          } else {\n            break;\n          }\n        }\n        console.log(`[OAuth42 Middleware] Token refresh complete:`, {\n          jwtBytes: newJwt.length,\n          chunked: newJwt.length > CHUNK_SIZE,\n          existingBaseCooke: req.cookies.has(cookieName),\n          existingChunks: existingChunks.length > 0 ? existingChunks : 'none',\n          newAccessTokenPrefix: refreshed.accessToken?.substring(0, 20),\n          newExpiresAt: refreshed.expiresAt,\n          cookieName,\n        });\n        return response;\n      } else {\n        if (shouldPreserveSessionOnRefreshFailure({\n          error: refreshed.error,\n          expiresAt,\n          now,\n        })) {\n          console.warn(\n            '[OAuth42 Middleware] Refresh failed with invalid_grant for a recently expired token; preserving session cookie for likely parallel refresh race',\n            {\n              expiresAt,\n              now,\n              expiredAgo: now - expiresAt,\n              path: pathname,\n            }\n          );\n          return NextResponse.next();\n        }\n\n        // Refresh failed - clear cookie and redirect to sign in (no error, just let user log in fresh)\n        console.log('[OAuth42 Middleware] Refresh failed, clearing session');\n        const signInUrl = options.pages?.signIn || '/auth/signin';\n        const url = new URL(signInUrl, req.url);\n        url.searchParams.set('callbackUrl', pathname);\n        // DO NOT set error parameter - just redirect silently\n\n        const response = NextResponse.redirect(url);\n        // Clear the base session cookie and any chunk cookies\n        response.cookies.delete(cookieName);\n        for (let i = 0; ; i++) {\n          const chunkName = `${cookieName}.${i}`;\n          if (req.cookies.has(chunkName)) {\n            response.cookies.delete(chunkName);\n          } else {\n            break;\n          }\n        }\n        return response;\n      }\n    }\n\n    // Check custom authorization callback\n    if (options.callbacks?.authorized) {\n      const isAuthorized = await options.callbacks.authorized({ token, req });\n      if (!isAuthorized) {\n        const signInUrl = options.pages?.signIn || '/auth/signin';\n        const url = new URL(signInUrl, req.url);\n        url.searchParams.set('callbackUrl', pathname);\n        return NextResponse.redirect(url);\n      }\n    }\n\n    return NextResponse.next();\n  };\n}\n\n/**\n * Helper to create middleware configuration\n */\nexport function createMiddlewareConfig(\n  protectedPaths: string[] = ['/protected'],\n  publicPaths: string[] = ['/auth', '/api/auth']\n) {\n  return {\n    matcher: [\n      /*\n       * Match all request paths except for the ones starting with:\n       * - _next/static (static files)\n       * - _next/image (image optimization files)\n       * - favicon.ico (favicon file)\n       * - public folder\n       */\n      '/((?!_next/static|_next/image|favicon.ico|public).*)',\n    ],\n    protectedPaths,\n    publicPaths,\n  };\n}\n","export type SessionStoreMode = 'jwt' | 'backend';\n\nexport interface BackendSessionUser {\n  sub?: string;\n  email?: string;\n  username?: string;\n  name?: string;\n  emailVerified?: boolean;\n  groups?: string[];\n}\n\nexport interface BackendSessionResponse {\n  session_id: string;\n  access_token: string;\n  expires_at: number;\n  id_token?: string;\n  user?: BackendSessionUser;\n}\n\nexport interface BackendSessionConfig {\n  issuer: string;\n  clientId: string;\n  clientSecret: string;\n}\n\nexport function isBackendSessionMode(mode?: SessionStoreMode): boolean {\n  return mode === 'backend';\n}\n\nfunction sessionEndpoint(issuer: string): string {\n  return `${issuer.replace(/\\/$/, '')}/api/sdk/sessions`;\n}\n\nexport async function createBackendSession(params: BackendSessionConfig & {\n  accessToken: string;\n  refreshToken: string;\n  expiresAt?: number;\n  idToken?: string;\n  user?: BackendSessionUser;\n}): Promise<BackendSessionResponse> {\n  const response = await fetch(sessionEndpoint(params.issuer), {\n    method: 'POST',\n    headers: { 'Content-Type': 'application/json' },\n    body: JSON.stringify({\n      access_token: params.accessToken,\n      refresh_token: params.refreshToken,\n      expires_at: params.expiresAt ?? Math.floor(Date.now() / 1000) + 3600,\n      id_token: params.idToken,\n      client_id: params.clientId,\n      client_secret: params.clientSecret,\n      issuer: params.issuer,\n      user: params.user,\n    }),\n  });\n\n  if (!response.ok) {\n    throw new Error(`OAuth42 backend session create failed: ${response.status}`);\n  }\n\n  return response.json();\n}\n\nexport async function resolveBackendSession(params: BackendSessionConfig & {\n  sessionId: string;\n}): Promise<BackendSessionResponse | null> {\n  const response = await fetch(`${sessionEndpoint(params.issuer)}/resolve`, {\n    method: 'POST',\n    headers: { 'Content-Type': 'application/json' },\n    body: JSON.stringify({\n      session_id: params.sessionId,\n      client_id: params.clientId,\n      client_secret: params.clientSecret,\n      issuer: params.issuer,\n    }),\n  });\n\n  if (response.status === 401 || response.status === 403 || response.status === 404) {\n    return null;\n  }\n\n  if (!response.ok) {\n    throw new Error(`OAuth42 backend session resolve failed: ${response.status}`);\n  }\n\n  return response.json();\n}\n\nexport async function revokeBackendSession(params: BackendSessionConfig & {\n  sessionId: string;\n}): Promise<void> {\n  await fetch(sessionEndpoint(params.issuer), {\n    method: 'DELETE',\n    headers: { 'Content-Type': 'application/json' },\n    body: JSON.stringify({\n      session_id: params.sessionId,\n      client_id: params.clientId,\n      client_secret: params.clientSecret,\n    }),\n  });\n}\n"],"mappings":";;;;;;;;;;;;;;;;;;;;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;;;ACAA,oBAA0C;AAC1C,iBAAiC;;;ACwB1B,SAAS,qBAAqB,MAAkC;AACrE,SAAO,SAAS;AAClB;AAEA,SAAS,gBAAgB,QAAwB;AAC/C,SAAO,GAAG,OAAO,QAAQ,OAAO,EAAE,CAAC;AACrC;AA+BA,eAAsB,sBAAsB,QAED;AACzC,QAAM,WAAW,MAAM,MAAM,GAAG,gBAAgB,OAAO,MAAM,CAAC,YAAY;AAAA,IACxE,QAAQ;AAAA,IACR,SAAS,EAAE,gBAAgB,mBAAmB;AAAA,IAC9C,MAAM,KAAK,UAAU;AAAA,MACnB,YAAY,OAAO;AAAA,MACnB,WAAW,OAAO;AAAA,MAClB,eAAe,OAAO;AAAA,MACtB,QAAQ,OAAO;AAAA,IACjB,CAAC;AAAA,EACH,CAAC;AAED,MAAI,SAAS,WAAW,OAAO,SAAS,WAAW,OAAO,SAAS,WAAW,KAAK;AACjF,WAAO;AAAA,EACT;AAEA,MAAI,CAAC,SAAS,IAAI;AAChB,UAAM,IAAI,MAAM,2CAA2C,SAAS,MAAM,EAAE;AAAA,EAC9E;AAEA,SAAO,SAAS,KAAK;AACvB;;;ADpEA,IAAM,sBAAsB;AAC5B,IAAM,8BAA8B;AACpC,IAAM,aAAa,sBAAsB;AACzC,IAAM,6BAA6B;AACnC,IAAM,kCAAkC,MAAM,KAAK,KAAK;AAMxD,IAAM,mBAAmB,oBAAI,IAMzB;AAuCG,SAAS,sCAAsC,QAI1C;AACV,MAAI,OAAO,UAAU,mBAAmB,CAAC,OAAO,WAAW;AACzD,WAAO;AAAA,EACT;AAEA,SAAO,OAAO,MAAM,OAAO,aAAa;AAC1C;AAEO,SAAS,qBACd,SACA,OAC8D;AAC9D,SAAO;AAAA,IACL,UACE,QAAQ,YACP,MAAM,YACP,QAAQ,IAAI;AAAA,IACd,cACE,QAAQ,gBACP,MAAM,gBACP,QAAQ,IAAI;AAAA,IACd,QACE,QAAQ,UACP,MAAM,UACP,QAAQ,IAAI,kBACZ;AAAA,EACJ;AACF;AAKA,eAAe,cACb,cACA,UACA,cACA,QACgH;AAChH,MAAI;AACF,UAAM,WAAW,GAAG,MAAM;AAE1B,UAAM,WAAW,MAAM,MAAM,UAAU;AAAA,MACrC,QAAQ;AAAA,MACR,SAAS;AAAA,QACP,gBAAgB;AAAA,MAClB;AAAA,MACA,MAAM,IAAI,gBAAgB;AAAA,QACxB,YAAY;AAAA,QACZ,eAAe;AAAA,QACf,WAAW;AAAA,QACX,eAAe;AAAA,MACjB,CAAC;AAAA,IACH,CAAC;AAED,UAAM,OAAO,MAAM,SAAS,KAAK;AAEjC,QAAI,CAAC,SAAS,IAAI;AAChB,cAAQ,MAAM,8CAA8C,IAAI;AAChE,aAAO,EAAE,SAAS,OAAO,OAAO,KAAK,SAAS,iBAAiB;AAAA,IACjE;AAEA,YAAQ,IAAI,mDAAmD;AAC/D,WAAO;AAAA,MACL,SAAS;AAAA,MACT,aAAa,KAAK;AAAA,MAClB,cAAc,KAAK;AAAA,MACnB,WAAW,KAAK,MAAM,KAAK,IAAI,IAAI,GAAI,KAAK,KAAK,cAAc;AAAA,IACjE;AAAA,EACF,SAAS,OAAO;AACd,YAAQ,MAAM,6CAA6C,KAAK;AAChE,WAAO,EAAE,SAAS,OAAO,OAAO,gBAAgB;AAAA,EAClD;AACF;AASO,SAAS,gBAAgB,UAA8B,CAAC,GAAG;AAChE,QAAM,SAAS,QAAQ,IAAI;AAE3B,MAAI,CAAC,QAAQ;AACX,YAAQ,KAAK,8CAA8C;AAAA,EAC7D;AAEA,SAAO,eAAe,WAAW,KAAkB;AAEjD,UAAM,aAAa,QAAQ,eACvB,GAAG,QAAQ,YAAY,mBACvB;AAEJ,UAAM,QAAQ,UAAM,qBAAS;AAAA,MAC3B;AAAA,MACA;AAAA,MACA;AAAA,IACF,CAAC;AAED,UAAM,WAAW,IAAI,QAAQ;AAG7B,QAAI,QAAQ,aAAa,KAAK,UAAQ,SAAS,WAAW,IAAI,CAAC,GAAG;AAChE,aAAO,2BAAa,KAAK;AAAA,IAC3B;AAGA,UAAM,kBAAkB,QAAQ,iBAC5B,QAAQ,eAAe,KAAK,UAAQ,SAAS,WAAW,IAAI,CAAC,IAC7D;AAEJ,QAAI,CAAC,iBAAiB;AACpB,aAAO,2BAAa,KAAK;AAAA,IAC3B;AAGA,QAAI,CAAC,OAAO;AACV,YAAM,YAAY,QAAQ,OAAO,UAAU;AAC3C,YAAM,MAAM,IAAI,IAAI,WAAW,IAAI,GAAG;AACtC,UAAI,aAAa,IAAI,eAAe,QAAQ;AAC5C,aAAO,2BAAa,SAAS,GAAG;AAAA,IAClC;AAEA,UAAM,gBAAgB,qBAAqB,SAAS,KAAK;AAEzD,QAAI,qBAAqB,QAAQ,YAAY,GAAG;AAC9C,YAAM,YAAY,MAAM;AACxB,UAAI,CAAC,aAAa,CAAC,cAAc,YAAY,CAAC,cAAc,cAAc;AACxE,cAAM,YAAY,QAAQ,OAAO,UAAU;AAC3C,cAAM,MAAM,IAAI,IAAI,WAAW,IAAI,GAAG;AACtC,YAAI,aAAa,IAAI,eAAe,QAAQ;AAC5C,cAAM,WAAW,2BAAa,SAAS,GAAG;AAC1C,iBAAS,QAAQ,OAAO,UAAU;AAClC,eAAO;AAAA,MACT;AAEA,YAAM,iBAAiB,MAAM,sBAAsB;AAAA,QACjD,QAAQ,cAAc;AAAA,QACtB,UAAU,cAAc;AAAA,QACxB,cAAc,cAAc;AAAA,QAC5B;AAAA,MACF,CAAC,EAAE,MAAM,WAAS;AAChB,gBAAQ,MAAM,wDAAwD,KAAK;AAC3E,eAAO;AAAA,MACT,CAAC;AAED,UAAI,CAAC,gBAAgB;AACnB,cAAM,YAAY,QAAQ,OAAO,UAAU;AAC3C,cAAM,MAAM,IAAI,IAAI,WAAW,IAAI,GAAG;AACtC,YAAI,aAAa,IAAI,eAAe,QAAQ;AAC5C,cAAM,WAAW,2BAAa,SAAS,GAAG;AAC1C,iBAAS,QAAQ,OAAO,UAAU;AAClC,eAAO;AAAA,MACT;AAEA,YAAM,iBAAiB,IAAI,QAAQ,IAAI,OAAO;AAC9C,qBAAe,IAAI,6BAA6B,eAAe,YAAY;AAC3E,aAAO,2BAAa,KAAK;AAAA,QACvB,SAAS;AAAA,UACP,SAAS;AAAA,QACX;AAAA,MACF,CAAC;AAAA,IACH;AAIA,UAAM,YAAY,MAAM;AACxB,UAAM,MAAM,KAAK,MAAM,KAAK,IAAI,IAAI,GAAI;AACxC,UAAM,gBAAgB;AACtB,UAAM,eAAe,aAAa,OAAO,YAAY;AAErD,QAAI,cAAc;AAChB,cAAQ,IAAI,6CAA6C;AAAA,QACvD;AAAA,QACA;AAAA,QACA,YAAY,YAAY,MAAM,YAAY;AAAA,QAC1C,mBAAoB,MAAM,aAAwB,UAAU,GAAG,EAAE;AAAA,QACjE,MAAM;AAAA,MACR,CAAC;AAAA,IACH;AAEA,QAAI,gBAAgB,MAAM,gBAAgB,cAAc,YAAY,cAAc,cAAc;AAC9F,YAAM,SAAS,MAAM;AAGrB,UAAI,iBAAiB,iBAAiB,IAAI,MAAM;AAEhD,UAAI,gBAAgB;AAClB,gBAAQ,IAAI,uDAAuD;AAAA,MACrE,OAAO;AACL,gBAAQ,IAAI,0DAA0D;AAMtE,yBAAiB;AAAA,UACf,MAAM;AAAA,UACN,cAAc;AAAA,UACd,cAAc;AAAA,UACd,cAAc;AAAA,QAChB,EAAE,QAAQ,MAAM;AACd,gBAAM,eAAe,WAAW,MAAM,iBAAiB,OAAO,MAAM,GAAG,GAAK;AAC5E,cAAI,OAAO,iBAAiB,YAAY,WAAW,cAAc;AAC/D,yBAAa,MAAM;AAAA,UACrB;AAAA,QACF,CAAC;AAED,yBAAiB,IAAI,QAAQ,cAAc;AAAA,MAC7C;AAEA,YAAM,YAAY,MAAM;AAExB,UAAI,UAAU,WAAW,UAAU,eAAe,UAAU,cAAc;AAExE,cAAM,eAAe;AAAA,UACnB,GAAG;AAAA,UACH,aAAa,UAAU;AAAA,UACvB,cAAc,UAAU;AAAA,UACxB,WAAW,UAAU;AAAA,QACvB;AAGA,cAAM,SAAS,UAAM,mBAAO;AAAA,UAC1B,OAAO;AAAA,UACP;AAAA,QACF,CAAC;AAID,cAAM,iBAAiB,IAAI,QAAQ,IAAI,OAAO;AAC9C,uBAAe,IAAI,6BAA6B,UAAU,WAAW;AAErE,cAAM,WAAW,2BAAa,KAAK;AAAA,UACjC,SAAS;AAAA,YACP,SAAS;AAAA,UACX;AAAA,QACF,CAAC;AAED,cAAM,gBAAgB;AAAA,UACpB,UAAU;AAAA,UACV,UAAU;AAAA,UACV,MAAM;AAAA,UACN,QAAQ,QAAQ,IAAI,aAAa;AAAA,UACjC,QAAQ,QAAQ,SAAS,UAAU;AAAA,QACrC;AAMA,YAAI,OAAO,UAAU,YAAY;AAE/B,mBAAS,QAAQ,IAAI,YAAY,QAAQ,aAAa;AAEtD,mBAAS,IAAI,KAAK,KAAK;AACrB,kBAAM,YAAY,GAAG,UAAU,IAAI,CAAC;AACpC,gBAAI,IAAI,QAAQ,IAAI,SAAS,GAAG;AAC9B,uBAAS,QAAQ,IAAI,WAAW,IAAI,EAAE,GAAG,eAAe,QAAQ,EAAE,CAAC;AAAA,YACrE,OAAO;AACL;AAAA,YACF;AAAA,UACF;AAAA,QACF,OAAO;AAEL,gBAAM,aAAa,KAAK,KAAK,OAAO,SAAS,UAAU;AACvD,mBAAS,IAAI,GAAG,IAAI,YAAY,KAAK;AACnC,kBAAM,YAAY,GAAG,UAAU,IAAI,CAAC;AACpC,kBAAM,aAAa,OAAO,MAAM,IAAI,aAAa,IAAI,KAAK,UAAU;AACpE,qBAAS,QAAQ,IAAI,WAAW,YAAY,aAAa;AAAA,UAC3D;AAEA,mBAAS,QAAQ,IAAI,YAAY,IAAI,EAAE,GAAG,eAAe,QAAQ,EAAE,CAAC;AAEpE,mBAAS,IAAI,cAAc,KAAK;AAC9B,kBAAM,YAAY,GAAG,UAAU,IAAI,CAAC;AACpC,gBAAI,IAAI,QAAQ,IAAI,SAAS,GAAG;AAC9B,uBAAS,QAAQ,IAAI,WAAW,IAAI,EAAE,GAAG,eAAe,QAAQ,EAAE,CAAC;AAAA,YACrE,OAAO;AACL;AAAA,YACF;AAAA,UACF;AAAA,QACF;AAGA,cAAM,iBAAiB,CAAC;AACxB,iBAAS,IAAI,KAAK,KAAK;AACrB,cAAI,IAAI,QAAQ,IAAI,GAAG,UAAU,IAAI,CAAC,EAAE,GAAG;AACzC,2BAAe,KAAK,CAAC;AAAA,UACvB,OAAO;AACL;AAAA,UACF;AAAA,QACF;AACA,gBAAQ,IAAI,gDAAgD;AAAA,UAC1D,UAAU,OAAO;AAAA,UACjB,SAAS,OAAO,SAAS;AAAA,UACzB,mBAAmB,IAAI,QAAQ,IAAI,UAAU;AAAA,UAC7C,gBAAgB,eAAe,SAAS,IAAI,iBAAiB;AAAA,UAC7D,sBAAsB,UAAU,aAAa,UAAU,GAAG,EAAE;AAAA,UAC5D,cAAc,UAAU;AAAA,UACxB;AAAA,QACF,CAAC;AACD,eAAO;AAAA,MACT,OAAO;AACL,YAAI,sCAAsC;AAAA,UACxC,OAAO,UAAU;AAAA,UACjB;AAAA,UACA;AAAA,QACF,CAAC,GAAG;AACF,kBAAQ;AAAA,YACN;AAAA,YACA;AAAA,cACE;AAAA,cACA;AAAA,cACA,YAAY,MAAM;AAAA,cAClB,MAAM;AAAA,YACR;AAAA,UACF;AACA,iBAAO,2BAAa,KAAK;AAAA,QAC3B;AAGA,gBAAQ,IAAI,uDAAuD;AACnE,cAAM,YAAY,QAAQ,OAAO,UAAU;AAC3C,cAAM,MAAM,IAAI,IAAI,WAAW,IAAI,GAAG;AACtC,YAAI,aAAa,IAAI,eAAe,QAAQ;AAG5C,cAAM,WAAW,2BAAa,SAAS,GAAG;AAE1C,iBAAS,QAAQ,OAAO,UAAU;AAClC,iBAAS,IAAI,KAAK,KAAK;AACrB,gBAAM,YAAY,GAAG,UAAU,IAAI,CAAC;AACpC,cAAI,IAAI,QAAQ,IAAI,SAAS,GAAG;AAC9B,qBAAS,QAAQ,OAAO,SAAS;AAAA,UACnC,OAAO;AACL;AAAA,UACF;AAAA,QACF;AACA,eAAO;AAAA,MACT;AAAA,IACF;AAGA,QAAI,QAAQ,WAAW,YAAY;AACjC,YAAM,eAAe,MAAM,QAAQ,UAAU,WAAW,EAAE,OAAO,IAAI,CAAC;AACtE,UAAI,CAAC,cAAc;AACjB,cAAM,YAAY,QAAQ,OAAO,UAAU;AAC3C,cAAM,MAAM,IAAI,IAAI,WAAW,IAAI,GAAG;AACtC,YAAI,aAAa,IAAI,eAAe,QAAQ;AAC5C,eAAO,2BAAa,SAAS,GAAG;AAAA,MAClC;AAAA,IACF;AAEA,WAAO,2BAAa,KAAK;AAAA,EAC3B;AACF;AAKO,SAAS,uBACd,iBAA2B,CAAC,YAAY,GACxC,cAAwB,CAAC,SAAS,WAAW,GAC7C;AACA,SAAO;AAAA,IACL,SAAS;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA,MAQP;AAAA,IACF;AAAA,IACA;AAAA,IACA;AAAA,EACF;AACF;","names":[]}

package/dist/middleware/index.mjs

@@ -1,10 +1,54 @@
 // src/server/middleware.ts
 import { NextResponse } from "next/server";
 import { getToken, encode } from "next-auth/jwt";
+
+// src/server/backend-session.ts
+function isBackendSessionMode(mode) {
+  return mode === "backend";
+}
+function sessionEndpoint(issuer) {
+  return `${issuer.replace(/\/$/, "")}/api/sdk/sessions`;
+}
+async function resolveBackendSession(params) {
+  const response = await fetch(`${sessionEndpoint(params.issuer)}/resolve`, {
+    method: "POST",
+    headers: { "Content-Type": "application/json" },
+    body: JSON.stringify({
+      session_id: params.sessionId,
+      client_id: params.clientId,
+      client_secret: params.clientSecret,
+      issuer: params.issuer
+    })
+  });
+  if (response.status === 401 || response.status === 403 || response.status === 404) {
+    return null;
+  }
+  if (!response.ok) {
+    throw new Error(`OAuth42 backend session resolve failed: ${response.status}`);
+  }
+  return response.json();
+}
+
+// src/server/middleware.ts
 var ALLOWED_COOKIE_SIZE = 4096;
 var ESTIMATED_EMPTY_COOKIE_SIZE = 163;
 var CHUNK_SIZE = ALLOWED_COOKIE_SIZE - ESTIMATED_EMPTY_COOKIE_SIZE;
+var REFRESH_RACE_GRACE_SECONDS = 60;
+var DEFAULT_SESSION_MAX_AGE_SECONDS = 365 * 24 * 60 * 60;
 var pendingRefreshes = /* @__PURE__ */ new Map();
+function shouldPreserveSessionOnRefreshFailure(params) {
+  if (params.error !== "invalid_grant" || !params.expiresAt) {
+    return false;
+  }
+  return params.now - params.expiresAt <= REFRESH_RACE_GRACE_SECONDS;
+}
+function resolveRefreshConfig(options, token) {
+  return {
+    clientId: options.clientId || token.clientId || process.env.OAUTH42_CLIENT_ID,
+    clientSecret: options.clientSecret || token.clientSecret || process.env.OAUTH42_CLIENT_SECRET,
+    issuer: options.issuer || token.issuer || process.env.OAUTH42_ISSUER || "https://localhost:8443"
+  };
+}
 async function refreshTokens(refreshToken, clientId, clientSecret, issuer) {
   try {
     const tokenUrl = `${issuer}/oauth2/token`;
@@ -39,9 +83,6 @@ async function refreshTokens(refreshToken, clientId, clientSecret, issuer) {
 }
 function withOAuth42Auth(options = {}) {
   const secret = process.env.NEXTAUTH_SECRET;
-  const clientId = process.env.OAUTH42_CLIENT_ID;
-  const clientSecret = process.env.OAUTH42_CLIENT_SECRET;
-  const issuer = process.env.OAUTH42_ISSUER || "https://localhost:8443";
   if (!secret) {
     console.warn("[OAuth42 Middleware] NEXTAUTH_SECRET not set");
   }
@@ -66,6 +107,42 @@ function withOAuth42Auth(options = {}) {
       url.searchParams.set("callbackUrl", pathname);
       return NextResponse.redirect(url);
     }
+    const refreshConfig = resolveRefreshConfig(options, token);
+    if (isBackendSessionMode(options.sessionStore)) {
+      const sessionId = token.oauth42SessionId;
+      if (!sessionId || !refreshConfig.clientId || !refreshConfig.clientSecret) {
+        const signInUrl = options.pages?.signIn || "/auth/signin";
+        const url = new URL(signInUrl, req.url);
+        url.searchParams.set("callbackUrl", pathname);
+        const response = NextResponse.redirect(url);
+        response.cookies.delete(cookieName);
+        return response;
+      }
+      const backendSession = await resolveBackendSession({
+        issuer: refreshConfig.issuer,
+        clientId: refreshConfig.clientId,
+        clientSecret: refreshConfig.clientSecret,
+        sessionId
+      }).catch((error) => {
+        console.error("[OAuth42 Middleware] Backend session resolve failed:", error);
+        return null;
+      });
+      if (!backendSession) {
+        const signInUrl = options.pages?.signIn || "/auth/signin";
+        const url = new URL(signInUrl, req.url);
+        url.searchParams.set("callbackUrl", pathname);
+        const response = NextResponse.redirect(url);
+        response.cookies.delete(cookieName);
+        return response;
+      }
+      const requestHeaders = new Headers(req.headers);
+      requestHeaders.set("x-oauth42-refreshed-token", backendSession.access_token);
+      return NextResponse.next({
+        request: {
+          headers: requestHeaders
+        }
+      });
+    }
     const expiresAt = token.expiresAt;
     const now = Math.floor(Date.now() / 1e3);
     const bufferSeconds = 15;
@@ -79,7 +156,7 @@ function withOAuth42Auth(options = {}) {
         path: pathname
       });
     }
-    if (needsRefresh && token.refreshToken && clientId && clientSecret) {
+    if (needsRefresh && token.refreshToken && refreshConfig.clientId && refreshConfig.clientSecret) {
       const userId = token.sub;
       let refreshPromise = pendingRefreshes.get(userId);
       if (refreshPromise) {
@@ -88,11 +165,14 @@ function withOAuth42Auth(options = {}) {
         console.log("[OAuth42 Middleware] Access token expired, refreshing...");
         refreshPromise = refreshTokens(
           token.refreshToken,
-          clientId,
-          clientSecret,
-          issuer
+          refreshConfig.clientId,
+          refreshConfig.clientSecret,
+          refreshConfig.issuer
         ).finally(() => {
-          setTimeout(() => pendingRefreshes.delete(userId), 3e4);
+          const cleanupTimer = setTimeout(() => pendingRefreshes.delete(userId), 3e4);
+          if (typeof cleanupTimer === "object" && "unref" in cleanupTimer) {
+            cleanupTimer.unref();
+          }
         });
         pendingRefreshes.set(userId, refreshPromise);
       }
@@ -119,7 +199,8 @@ function withOAuth42Auth(options = {}) {
           httpOnly: true,
           sameSite: "lax",
           path: "/",
-          secure: process.env.NODE_ENV === "production"
+          secure: process.env.NODE_ENV === "production",
+          maxAge: options.session?.maxAge ?? DEFAULT_SESSION_MAX_AGE_SECONDS
         };
         if (newJwt.length <= CHUNK_SIZE) {
           response.cookies.set(cookieName, newJwt, cookieOptions);
@@ -167,7 +248,23 @@ function withOAuth42Auth(options = {}) {
         });
         return response;
       } else {
-        console.log("[OAuth42 Middleware] Refresh failed (likely token blacklisted after deploy), clearing session");
+        if (shouldPreserveSessionOnRefreshFailure({
+          error: refreshed.error,
+          expiresAt,
+          now
+        })) {
+          console.warn(
+            "[OAuth42 Middleware] Refresh failed with invalid_grant for a recently expired token; preserving session cookie for likely parallel refresh race",
+            {
+              expiresAt,
+              now,
+              expiredAgo: now - expiresAt,
+              path: pathname
+            }
+          );
+          return NextResponse.next();
+        }
+        console.log("[OAuth42 Middleware] Refresh failed, clearing session");
         const signInUrl = options.pages?.signIn || "/auth/signin";
         const url = new URL(signInUrl, req.url);
         url.searchParams.set("callbackUrl", pathname);

package/dist/middleware/index.mjs.map

@@ -1 +1 @@
-{"version":3,"sources":["../../src/server/middleware.ts"],"sourcesContent":["import { NextRequest, NextResponse } from 'next/server';\nimport { getToken, encode } from 'next-auth/jwt';\n\n/**\n * Cookie chunking constants — must match NextAuth's SessionStore behavior.\n * NextAuth splits cookies at ALLOWED_COOKIE_SIZE (4096) minus overhead (163).\n * When middleware re-encodes the JWT after a token refresh, the cookie must be\n * chunked the same way, otherwise:\n *   - A single cookie > ~4 KB is silently rejected by the browser\n *   - Leftover chunk cookies from the original session cause SessionStore to\n *     concatenate old chunks with the new base cookie, producing garbage\n */\nconst ALLOWED_COOKIE_SIZE = 4096;\nconst ESTIMATED_EMPTY_COOKIE_SIZE = 163;\nconst CHUNK_SIZE = ALLOWED_COOKIE_SIZE - ESTIMATED_EMPTY_COOKIE_SIZE;\n\n/**\n * In-flight refresh tracking to prevent parallel refresh calls.\n * Key: user ID (from token.sub), Value: Promise that resolves with refresh result\n */\nconst pendingRefreshes = new Map<string, Promise<{\n  success: boolean;\n  accessToken?: string;\n  refreshToken?: string;\n  expiresAt?: number;\n  error?: string;\n}>>();\n\nexport interface OAuth42AuthOptions {\n  pages?: {\n    signIn?: string;\n    error?: string;\n  };\n  callbacks?: {\n    authorized?: (params: { token: any; req: NextRequest }) => boolean | Promise<boolean>;\n  };\n  protectedPaths?: string[];\n  publicPaths?: string[];\n  /**\n   * Cookie prefix for custom cookie names. Must match the prefix used in createAuth().\n   * E.g., 'oauth42-portal' will look for cookie 'oauth42-portal.session-token'\n   */\n  cookiePrefix?: string;\n}\n\n/**\n * Refresh tokens by calling the OAuth42 backend directly\n */\nasync function refreshTokens(\n  refreshToken: string,\n  clientId: string,\n  clientSecret: string,\n  issuer: string\n): Promise<{ success: boolean; accessToken?: string; refreshToken?: string; expiresAt?: number; error?: string }> {\n  try {\n    const tokenUrl = `${issuer}/oauth2/token`;\n\n    const response = await fetch(tokenUrl, {\n      method: 'POST',\n      headers: {\n        'Content-Type': 'application/x-www-form-urlencoded',\n      },\n      body: new URLSearchParams({\n        grant_type: 'refresh_token',\n        refresh_token: refreshToken,\n        client_id: clientId,\n        client_secret: clientSecret,\n      }),\n    });\n\n    const data = await response.json();\n\n    if (!response.ok) {\n      console.error('[OAuth42 Middleware] Token refresh failed:', data);\n      return { success: false, error: data.error || 'refresh_failed' };\n    }\n\n    console.log('[OAuth42 Middleware] Token refreshed successfully');\n    return {\n      success: true,\n      accessToken: data.access_token,\n      refreshToken: data.refresh_token,\n      expiresAt: Math.floor(Date.now() / 1000) + (data.expires_in || 3600),\n    };\n  } catch (error) {\n    console.error('[OAuth42 Middleware] Token refresh error:', error);\n    return { success: false, error: 'refresh_error' };\n  }\n}\n\n/**\n * Middleware helper for protecting routes with OAuth42\n *\n * This middleware handles:\n * 1. Route protection (redirect to login if no session)\n * 2. Token refresh (refresh expired tokens and update cookie)\n */\nexport function withOAuth42Auth(options: OAuth42AuthOptions = {}) {\n  const secret = process.env.NEXTAUTH_SECRET;\n  const clientId = process.env.OAUTH42_CLIENT_ID;\n  const clientSecret = process.env.OAUTH42_CLIENT_SECRET;\n  const issuer = process.env.OAUTH42_ISSUER || 'https://localhost:8443';\n\n  if (!secret) {\n    console.warn('[OAuth42 Middleware] NEXTAUTH_SECRET not set');\n  }\n\n  return async function middleware(req: NextRequest) {\n    // Build cookie name - if prefix is provided, use custom name\n    const cookieName = options.cookiePrefix\n      ? `${options.cookiePrefix}.session-token`\n      : 'next-auth.session-token';\n\n    const token = await getToken({\n      req: req as any,\n      secret,\n      cookieName,\n    });\n\n    const pathname = req.nextUrl.pathname;\n\n    // Check if path is explicitly public\n    if (options.publicPaths?.some(path => pathname.startsWith(path))) {\n      return NextResponse.next();\n    }\n\n    // Check if path needs protection\n    const needsProtection = options.protectedPaths\n      ? options.protectedPaths.some(path => pathname.startsWith(path))\n      : true; // Default to protecting all paths\n\n    if (!needsProtection) {\n      return NextResponse.next();\n    }\n\n    // No token at all - redirect to sign in\n    if (!token) {\n      const signInUrl = options.pages?.signIn || '/auth/signin';\n      const url = new URL(signInUrl, req.url);\n      url.searchParams.set('callbackUrl', pathname);\n      return NextResponse.redirect(url);\n    }\n\n    // Check if access token is expired or expiring soon (15 second buffer)\n    // Buffer must be less than the token TTL to have a valid window\n    const expiresAt = token.expiresAt as number | undefined;\n    const now = Math.floor(Date.now() / 1000);\n    const bufferSeconds = 15;\n    const needsRefresh = expiresAt && now >= expiresAt - bufferSeconds;\n\n    if (needsRefresh) {\n      console.log('[OAuth42 Middleware] Token needs refresh:', {\n        expiresAt,\n        now,\n        expiredAgo: expiresAt ? now - expiresAt : 'n/a',\n        accessTokenPrefix: (token.accessToken as string)?.substring(0, 20),\n        path: pathname,\n      });\n    }\n\n    if (needsRefresh && token.refreshToken && clientId && clientSecret) {\n      const userId = token.sub as string;\n\n      // Check if there's already a refresh in progress for this user\n      let refreshPromise = pendingRefreshes.get(userId);\n\n      if (refreshPromise) {\n        console.log('[OAuth42 Middleware] Waiting for in-flight refresh...');\n      } else {\n        console.log('[OAuth42 Middleware] Access token expired, refreshing...');\n\n        // Create the refresh promise and store it.\n        // Keep the entry for 30s after completion so late-arriving requests\n        // (with stale cookies) reuse the cached result instead of triggering\n        // a new refresh with the already-rotated token. See issue #470.\n        refreshPromise = refreshTokens(\n          token.refreshToken as string,\n          clientId,\n          clientSecret,\n          issuer\n        ).finally(() => {\n          setTimeout(() => pendingRefreshes.delete(userId), 30000);\n        });\n\n        pendingRefreshes.set(userId, refreshPromise);\n      }\n\n      const refreshed = await refreshPromise;\n\n      if (refreshed.success && refreshed.accessToken && refreshed.refreshToken) {\n        // Update the token with new values\n        const updatedToken = {\n          ...token,\n          accessToken: refreshed.accessToken,\n          refreshToken: refreshed.refreshToken,\n          expiresAt: refreshed.expiresAt,\n        };\n\n        // Re-encode the JWT\n        const newJwt = await encode({\n          token: updatedToken,\n          secret: secret!,\n        });\n\n        // Create response with request headers that pass the new token to API routes\n        // This is necessary because API routes read from the request, not the response cookie\n        const requestHeaders = new Headers(req.headers);\n        requestHeaders.set('x-oauth42-refreshed-token', refreshed.accessToken);\n\n        const response = NextResponse.next({\n          request: {\n            headers: requestHeaders,\n          },\n        });\n\n        const cookieOptions = {\n          httpOnly: true,\n          sameSite: 'lax' as const,\n          path: '/',\n          secure: process.env.NODE_ENV === 'production',\n        };\n\n        // Set cookie with chunking matching NextAuth's SessionStore behavior.\n        // Without chunking, a JWT > ~4 KB is silently rejected by the browser,\n        // causing an infinite refresh loop where every request re-triggers\n        // token refresh but the cookie never persists.\n        if (newJwt.length <= CHUNK_SIZE) {\n          // Fits in a single cookie\n          response.cookies.set(cookieName, newJwt, cookieOptions);\n          // Clean up any leftover chunk cookies from a previously chunked session\n          for (let i = 0; ; i++) {\n            const chunkName = `${cookieName}.${i}`;\n            if (req.cookies.has(chunkName)) {\n              response.cookies.set(chunkName, '', { ...cookieOptions, maxAge: 0 });\n            } else {\n              break;\n            }\n          }\n        } else {\n          // Cookie too large — chunk it like NextAuth does\n          const chunkCount = Math.ceil(newJwt.length / CHUNK_SIZE);\n          for (let i = 0; i < chunkCount; i++) {\n            const chunkName = `${cookieName}.${i}`;\n            const chunkValue = newJwt.slice(i * CHUNK_SIZE, (i + 1) * CHUNK_SIZE);\n            response.cookies.set(chunkName, chunkValue, cookieOptions);\n          }\n          // Delete the base cookie so SessionStore only reads chunks\n          response.cookies.set(cookieName, '', { ...cookieOptions, maxAge: 0 });\n          // Clean up any extra old chunks beyond the new count\n          for (let i = chunkCount; ; i++) {\n            const chunkName = `${cookieName}.${i}`;\n            if (req.cookies.has(chunkName)) {\n              response.cookies.set(chunkName, '', { ...cookieOptions, maxAge: 0 });\n            } else {\n              break;\n            }\n          }\n        }\n\n        // Log details to help diagnose cookie persistence issues\n        const existingChunks = [];\n        for (let i = 0; ; i++) {\n          if (req.cookies.has(`${cookieName}.${i}`)) {\n            existingChunks.push(i);\n          } else {\n            break;\n          }\n        }\n        console.log(`[OAuth42 Middleware] Token refresh complete:`, {\n          jwtBytes: newJwt.length,\n          chunked: newJwt.length > CHUNK_SIZE,\n          existingBaseCooke: req.cookies.has(cookieName),\n          existingChunks: existingChunks.length > 0 ? existingChunks : 'none',\n          newAccessTokenPrefix: refreshed.accessToken?.substring(0, 20),\n          newExpiresAt: refreshed.expiresAt,\n          cookieName,\n        });\n        return response;\n      } else {\n        // Refresh failed - clear cookie and redirect to sign in (no error, just let user log in fresh)\n        console.log('[OAuth42 Middleware] Refresh failed (likely token blacklisted after deploy), clearing session');\n        const signInUrl = options.pages?.signIn || '/auth/signin';\n        const url = new URL(signInUrl, req.url);\n        url.searchParams.set('callbackUrl', pathname);\n        // DO NOT set error parameter - just redirect silently\n\n        const response = NextResponse.redirect(url);\n        // Clear the base session cookie and any chunk cookies\n        response.cookies.delete(cookieName);\n        for (let i = 0; ; i++) {\n          const chunkName = `${cookieName}.${i}`;\n          if (req.cookies.has(chunkName)) {\n            response.cookies.delete(chunkName);\n          } else {\n            break;\n          }\n        }\n        return response;\n      }\n    }\n\n    // Check custom authorization callback\n    if (options.callbacks?.authorized) {\n      const isAuthorized = await options.callbacks.authorized({ token, req });\n      if (!isAuthorized) {\n        const signInUrl = options.pages?.signIn || '/auth/signin';\n        const url = new URL(signInUrl, req.url);\n        url.searchParams.set('callbackUrl', pathname);\n        return NextResponse.redirect(url);\n      }\n    }\n\n    return NextResponse.next();\n  };\n}\n\n/**\n * Helper to create middleware configuration\n */\nexport function createMiddlewareConfig(\n  protectedPaths: string[] = ['/protected'],\n  publicPaths: string[] = ['/auth', '/api/auth']\n) {\n  return {\n    matcher: [\n      /*\n       * Match all request paths except for the ones starting with:\n       * - _next/static (static files)\n       * - _next/image (image optimization files)\n       * - favicon.ico (favicon file)\n       * - public folder\n       */\n      '/((?!_next/static|_next/image|favicon.ico|public).*)',\n    ],\n    protectedPaths,\n    publicPaths,\n  };\n}\n"],"mappings":";AAAA,SAAsB,oBAAoB;AAC1C,SAAS,UAAU,cAAc;AAWjC,IAAM,sBAAsB;AAC5B,IAAM,8BAA8B;AACpC,IAAM,aAAa,sBAAsB;AAMzC,IAAM,mBAAmB,oBAAI,IAMzB;AAsBJ,eAAe,cACb,cACA,UACA,cACA,QACgH;AAChH,MAAI;AACF,UAAM,WAAW,GAAG,MAAM;AAE1B,UAAM,WAAW,MAAM,MAAM,UAAU;AAAA,MACrC,QAAQ;AAAA,MACR,SAAS;AAAA,QACP,gBAAgB;AAAA,MAClB;AAAA,MACA,MAAM,IAAI,gBAAgB;AAAA,QACxB,YAAY;AAAA,QACZ,eAAe;AAAA,QACf,WAAW;AAAA,QACX,eAAe;AAAA,MACjB,CAAC;AAAA,IACH,CAAC;AAED,UAAM,OAAO,MAAM,SAAS,KAAK;AAEjC,QAAI,CAAC,SAAS,IAAI;AAChB,cAAQ,MAAM,8CAA8C,IAAI;AAChE,aAAO,EAAE,SAAS,OAAO,OAAO,KAAK,SAAS,iBAAiB;AAAA,IACjE;AAEA,YAAQ,IAAI,mDAAmD;AAC/D,WAAO;AAAA,MACL,SAAS;AAAA,MACT,aAAa,KAAK;AAAA,MAClB,cAAc,KAAK;AAAA,MACnB,WAAW,KAAK,MAAM,KAAK,IAAI,IAAI,GAAI,KAAK,KAAK,cAAc;AAAA,IACjE;AAAA,EACF,SAAS,OAAO;AACd,YAAQ,MAAM,6CAA6C,KAAK;AAChE,WAAO,EAAE,SAAS,OAAO,OAAO,gBAAgB;AAAA,EAClD;AACF;AASO,SAAS,gBAAgB,UAA8B,CAAC,GAAG;AAChE,QAAM,SAAS,QAAQ,IAAI;AAC3B,QAAM,WAAW,QAAQ,IAAI;AAC7B,QAAM,eAAe,QAAQ,IAAI;AACjC,QAAM,SAAS,QAAQ,IAAI,kBAAkB;AAE7C,MAAI,CAAC,QAAQ;AACX,YAAQ,KAAK,8CAA8C;AAAA,EAC7D;AAEA,SAAO,eAAe,WAAW,KAAkB;AAEjD,UAAM,aAAa,QAAQ,eACvB,GAAG,QAAQ,YAAY,mBACvB;AAEJ,UAAM,QAAQ,MAAM,SAAS;AAAA,MAC3B;AAAA,MACA;AAAA,MACA;AAAA,IACF,CAAC;AAED,UAAM,WAAW,IAAI,QAAQ;AAG7B,QAAI,QAAQ,aAAa,KAAK,UAAQ,SAAS,WAAW,IAAI,CAAC,GAAG;AAChE,aAAO,aAAa,KAAK;AAAA,IAC3B;AAGA,UAAM,kBAAkB,QAAQ,iBAC5B,QAAQ,eAAe,KAAK,UAAQ,SAAS,WAAW,IAAI,CAAC,IAC7D;AAEJ,QAAI,CAAC,iBAAiB;AACpB,aAAO,aAAa,KAAK;AAAA,IAC3B;AAGA,QAAI,CAAC,OAAO;AACV,YAAM,YAAY,QAAQ,OAAO,UAAU;AAC3C,YAAM,MAAM,IAAI,IAAI,WAAW,IAAI,GAAG;AACtC,UAAI,aAAa,IAAI,eAAe,QAAQ;AAC5C,aAAO,aAAa,SAAS,GAAG;AAAA,IAClC;AAIA,UAAM,YAAY,MAAM;AACxB,UAAM,MAAM,KAAK,MAAM,KAAK,IAAI,IAAI,GAAI;AACxC,UAAM,gBAAgB;AACtB,UAAM,eAAe,aAAa,OAAO,YAAY;AAErD,QAAI,cAAc;AAChB,cAAQ,IAAI,6CAA6C;AAAA,QACvD;AAAA,QACA;AAAA,QACA,YAAY,YAAY,MAAM,YAAY;AAAA,QAC1C,mBAAoB,MAAM,aAAwB,UAAU,GAAG,EAAE;AAAA,QACjE,MAAM;AAAA,MACR,CAAC;AAAA,IACH;AAEA,QAAI,gBAAgB,MAAM,gBAAgB,YAAY,cAAc;AAClE,YAAM,SAAS,MAAM;AAGrB,UAAI,iBAAiB,iBAAiB,IAAI,MAAM;AAEhD,UAAI,gBAAgB;AAClB,gBAAQ,IAAI,uDAAuD;AAAA,MACrE,OAAO;AACL,gBAAQ,IAAI,0DAA0D;AAMtE,yBAAiB;AAAA,UACf,MAAM;AAAA,UACN;AAAA,UACA;AAAA,UACA;AAAA,QACF,EAAE,QAAQ,MAAM;AACd,qBAAW,MAAM,iBAAiB,OAAO,MAAM,GAAG,GAAK;AAAA,QACzD,CAAC;AAED,yBAAiB,IAAI,QAAQ,cAAc;AAAA,MAC7C;AAEA,YAAM,YAAY,MAAM;AAExB,UAAI,UAAU,WAAW,UAAU,eAAe,UAAU,cAAc;AAExE,cAAM,eAAe;AAAA,UACnB,GAAG;AAAA,UACH,aAAa,UAAU;AAAA,UACvB,cAAc,UAAU;AAAA,UACxB,WAAW,UAAU;AAAA,QACvB;AAGA,cAAM,SAAS,MAAM,OAAO;AAAA,UAC1B,OAAO;AAAA,UACP;AAAA,QACF,CAAC;AAID,cAAM,iBAAiB,IAAI,QAAQ,IAAI,OAAO;AAC9C,uBAAe,IAAI,6BAA6B,UAAU,WAAW;AAErE,cAAM,WAAW,aAAa,KAAK;AAAA,UACjC,SAAS;AAAA,YACP,SAAS;AAAA,UACX;AAAA,QACF,CAAC;AAED,cAAM,gBAAgB;AAAA,UACpB,UAAU;AAAA,UACV,UAAU;AAAA,UACV,MAAM;AAAA,UACN,QAAQ,QAAQ,IAAI,aAAa;AAAA,QACnC;AAMA,YAAI,OAAO,UAAU,YAAY;AAE/B,mBAAS,QAAQ,IAAI,YAAY,QAAQ,aAAa;AAEtD,mBAAS,IAAI,KAAK,KAAK;AACrB,kBAAM,YAAY,GAAG,UAAU,IAAI,CAAC;AACpC,gBAAI,IAAI,QAAQ,IAAI,SAAS,GAAG;AAC9B,uBAAS,QAAQ,IAAI,WAAW,IAAI,EAAE,GAAG,eAAe,QAAQ,EAAE,CAAC;AAAA,YACrE,OAAO;AACL;AAAA,YACF;AAAA,UACF;AAAA,QACF,OAAO;AAEL,gBAAM,aAAa,KAAK,KAAK,OAAO,SAAS,UAAU;AACvD,mBAAS,IAAI,GAAG,IAAI,YAAY,KAAK;AACnC,kBAAM,YAAY,GAAG,UAAU,IAAI,CAAC;AACpC,kBAAM,aAAa,OAAO,MAAM,IAAI,aAAa,IAAI,KAAK,UAAU;AACpE,qBAAS,QAAQ,IAAI,WAAW,YAAY,aAAa;AAAA,UAC3D;AAEA,mBAAS,QAAQ,IAAI,YAAY,IAAI,EAAE,GAAG,eAAe,QAAQ,EAAE,CAAC;AAEpE,mBAAS,IAAI,cAAc,KAAK;AAC9B,kBAAM,YAAY,GAAG,UAAU,IAAI,CAAC;AACpC,gBAAI,IAAI,QAAQ,IAAI,SAAS,GAAG;AAC9B,uBAAS,QAAQ,IAAI,WAAW,IAAI,EAAE,GAAG,eAAe,QAAQ,EAAE,CAAC;AAAA,YACrE,OAAO;AACL;AAAA,YACF;AAAA,UACF;AAAA,QACF;AAGA,cAAM,iBAAiB,CAAC;AACxB,iBAAS,IAAI,KAAK,KAAK;AACrB,cAAI,IAAI,QAAQ,IAAI,GAAG,UAAU,IAAI,CAAC,EAAE,GAAG;AACzC,2BAAe,KAAK,CAAC;AAAA,UACvB,OAAO;AACL;AAAA,UACF;AAAA,QACF;AACA,gBAAQ,IAAI,gDAAgD;AAAA,UAC1D,UAAU,OAAO;AAAA,UACjB,SAAS,OAAO,SAAS;AAAA,UACzB,mBAAmB,IAAI,QAAQ,IAAI,UAAU;AAAA,UAC7C,gBAAgB,eAAe,SAAS,IAAI,iBAAiB;AAAA,UAC7D,sBAAsB,UAAU,aAAa,UAAU,GAAG,EAAE;AAAA,UAC5D,cAAc,UAAU;AAAA,UACxB;AAAA,QACF,CAAC;AACD,eAAO;AAAA,MACT,OAAO;AAEL,gBAAQ,IAAI,+FAA+F;AAC3G,cAAM,YAAY,QAAQ,OAAO,UAAU;AAC3C,cAAM,MAAM,IAAI,IAAI,WAAW,IAAI,GAAG;AACtC,YAAI,aAAa,IAAI,eAAe,QAAQ;AAG5C,cAAM,WAAW,aAAa,SAAS,GAAG;AAE1C,iBAAS,QAAQ,OAAO,UAAU;AAClC,iBAAS,IAAI,KAAK,KAAK;AACrB,gBAAM,YAAY,GAAG,UAAU,IAAI,CAAC;AACpC,cAAI,IAAI,QAAQ,IAAI,SAAS,GAAG;AAC9B,qBAAS,QAAQ,OAAO,SAAS;AAAA,UACnC,OAAO;AACL;AAAA,UACF;AAAA,QACF;AACA,eAAO;AAAA,MACT;AAAA,IACF;AAGA,QAAI,QAAQ,WAAW,YAAY;AACjC,YAAM,eAAe,MAAM,QAAQ,UAAU,WAAW,EAAE,OAAO,IAAI,CAAC;AACtE,UAAI,CAAC,cAAc;AACjB,cAAM,YAAY,QAAQ,OAAO,UAAU;AAC3C,cAAM,MAAM,IAAI,IAAI,WAAW,IAAI,GAAG;AACtC,YAAI,aAAa,IAAI,eAAe,QAAQ;AAC5C,eAAO,aAAa,SAAS,GAAG;AAAA,MAClC;AAAA,IACF;AAEA,WAAO,aAAa,KAAK;AAAA,EAC3B;AACF;AAKO,SAAS,uBACd,iBAA2B,CAAC,YAAY,GACxC,cAAwB,CAAC,SAAS,WAAW,GAC7C;AACA,SAAO;AAAA,IACL,SAAS;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA,MAQP;AAAA,IACF;AAAA,IACA;AAAA,IACA;AAAA,EACF;AACF;","names":[]}
+{"version":3,"sources":["../../src/server/middleware.ts","../../src/server/backend-session.ts"],"sourcesContent":["import { NextRequest, NextResponse } from 'next/server';\nimport { getToken, encode } from 'next-auth/jwt';\nimport {\n  isBackendSessionMode,\n  resolveBackendSession,\n  type SessionStoreMode,\n} from './backend-session';\n\n/**\n * Cookie chunking constants — must match NextAuth's SessionStore behavior.\n * NextAuth splits cookies at ALLOWED_COOKIE_SIZE (4096) minus overhead (163).\n * When middleware re-encodes the JWT after a token refresh, the cookie must be\n * chunked the same way, otherwise:\n *   - A single cookie > ~4 KB is silently rejected by the browser\n *   - Leftover chunk cookies from the original session cause SessionStore to\n *     concatenate old chunks with the new base cookie, producing garbage\n */\nconst ALLOWED_COOKIE_SIZE = 4096;\nconst ESTIMATED_EMPTY_COOKIE_SIZE = 163;\nconst CHUNK_SIZE = ALLOWED_COOKIE_SIZE - ESTIMATED_EMPTY_COOKIE_SIZE;\nconst REFRESH_RACE_GRACE_SECONDS = 60;\nconst DEFAULT_SESSION_MAX_AGE_SECONDS = 365 * 24 * 60 * 60;\n\n/**\n * In-flight refresh tracking to prevent parallel refresh calls.\n * Key: user ID (from token.sub), Value: Promise that resolves with refresh result\n */\nconst pendingRefreshes = new Map<string, Promise<{\n  success: boolean;\n  accessToken?: string;\n  refreshToken?: string;\n  expiresAt?: number;\n  error?: string;\n}>>();\n\nexport interface OAuth42AuthOptions {\n  pages?: {\n    signIn?: string;\n    error?: string;\n  };\n  callbacks?: {\n    authorized?: (params: { token: any; req: NextRequest }) => boolean | Promise<boolean>;\n  };\n  protectedPaths?: string[];\n  publicPaths?: string[];\n  /**\n   * Cookie prefix for custom cookie names. Must match the prefix used in createAuth().\n   * E.g., 'oauth42-portal' will look for cookie 'oauth42-portal.session-token'\n   */\n  cookiePrefix?: string;\n  /**\n   * OAuth client credentials for middleware refresh. When omitted, the middleware\n   * prefers credentials embedded in the NextAuth token by createAuth(), then\n   * falls back to OAUTH42_CLIENT_ID / OAUTH42_CLIENT_SECRET.\n   */\n  clientId?: string;\n  clientSecret?: string;\n  issuer?: string;\n  /**\n   * \"backend\" keeps OAuth token material in the Rust backend and stores only\n   * an opaque backend session id in the NextAuth JWT cookie.\n   */\n  sessionStore?: SessionStoreMode;\n  /**\n   * Session cookie lifetime. Should match createAuth({ session.maxAge }).\n   * Defaults to OAuth42's persistent-session policy of 365 days.\n   */\n  session?: {\n    maxAge?: number;\n  };\n}\n\nexport function shouldPreserveSessionOnRefreshFailure(params: {\n  error?: string;\n  expiresAt?: number;\n  now: number;\n}): boolean {\n  if (params.error !== 'invalid_grant' || !params.expiresAt) {\n    return false;\n  }\n\n  return params.now - params.expiresAt <= REFRESH_RACE_GRACE_SECONDS;\n}\n\nexport function resolveRefreshConfig(\n  options: OAuth42AuthOptions,\n  token: any\n): { clientId?: string; clientSecret?: string; issuer: string } {\n  return {\n    clientId:\n      options.clientId ||\n      (token.clientId as string | undefined) ||\n      process.env.OAUTH42_CLIENT_ID,\n    clientSecret:\n      options.clientSecret ||\n      (token.clientSecret as string | undefined) ||\n      process.env.OAUTH42_CLIENT_SECRET,\n    issuer:\n      options.issuer ||\n      (token.issuer as string | undefined) ||\n      process.env.OAUTH42_ISSUER ||\n      'https://localhost:8443',\n  };\n}\n\n/**\n * Refresh tokens by calling the OAuth42 backend directly\n */\nasync function refreshTokens(\n  refreshToken: string,\n  clientId: string,\n  clientSecret: string,\n  issuer: string\n): Promise<{ success: boolean; accessToken?: string; refreshToken?: string; expiresAt?: number; error?: string }> {\n  try {\n    const tokenUrl = `${issuer}/oauth2/token`;\n\n    const response = await fetch(tokenUrl, {\n      method: 'POST',\n      headers: {\n        'Content-Type': 'application/x-www-form-urlencoded',\n      },\n      body: new URLSearchParams({\n        grant_type: 'refresh_token',\n        refresh_token: refreshToken,\n        client_id: clientId,\n        client_secret: clientSecret,\n      }),\n    });\n\n    const data = await response.json();\n\n    if (!response.ok) {\n      console.error('[OAuth42 Middleware] Token refresh failed:', data);\n      return { success: false, error: data.error || 'refresh_failed' };\n    }\n\n    console.log('[OAuth42 Middleware] Token refreshed successfully');\n    return {\n      success: true,\n      accessToken: data.access_token,\n      refreshToken: data.refresh_token,\n      expiresAt: Math.floor(Date.now() / 1000) + (data.expires_in || 3600),\n    };\n  } catch (error) {\n    console.error('[OAuth42 Middleware] Token refresh error:', error);\n    return { success: false, error: 'refresh_error' };\n  }\n}\n\n/**\n * Middleware helper for protecting routes with OAuth42\n *\n * This middleware handles:\n * 1. Route protection (redirect to login if no session)\n * 2. Token refresh (refresh expired tokens and update cookie)\n */\nexport function withOAuth42Auth(options: OAuth42AuthOptions = {}) {\n  const secret = process.env.NEXTAUTH_SECRET;\n\n  if (!secret) {\n    console.warn('[OAuth42 Middleware] NEXTAUTH_SECRET not set');\n  }\n\n  return async function middleware(req: NextRequest) {\n    // Build cookie name - if prefix is provided, use custom name\n    const cookieName = options.cookiePrefix\n      ? `${options.cookiePrefix}.session-token`\n      : 'next-auth.session-token';\n\n    const token = await getToken({\n      req: req as any,\n      secret,\n      cookieName,\n    });\n\n    const pathname = req.nextUrl.pathname;\n\n    // Check if path is explicitly public\n    if (options.publicPaths?.some(path => pathname.startsWith(path))) {\n      return NextResponse.next();\n    }\n\n    // Check if path needs protection\n    const needsProtection = options.protectedPaths\n      ? options.protectedPaths.some(path => pathname.startsWith(path))\n      : true; // Default to protecting all paths\n\n    if (!needsProtection) {\n      return NextResponse.next();\n    }\n\n    // No token at all - redirect to sign in\n    if (!token) {\n      const signInUrl = options.pages?.signIn || '/auth/signin';\n      const url = new URL(signInUrl, req.url);\n      url.searchParams.set('callbackUrl', pathname);\n      return NextResponse.redirect(url);\n    }\n\n    const refreshConfig = resolveRefreshConfig(options, token);\n\n    if (isBackendSessionMode(options.sessionStore)) {\n      const sessionId = token.oauth42SessionId as string | undefined;\n      if (!sessionId || !refreshConfig.clientId || !refreshConfig.clientSecret) {\n        const signInUrl = options.pages?.signIn || '/auth/signin';\n        const url = new URL(signInUrl, req.url);\n        url.searchParams.set('callbackUrl', pathname);\n        const response = NextResponse.redirect(url);\n        response.cookies.delete(cookieName);\n        return response;\n      }\n\n      const backendSession = await resolveBackendSession({\n        issuer: refreshConfig.issuer,\n        clientId: refreshConfig.clientId,\n        clientSecret: refreshConfig.clientSecret,\n        sessionId,\n      }).catch(error => {\n        console.error('[OAuth42 Middleware] Backend session resolve failed:', error);\n        return null;\n      });\n\n      if (!backendSession) {\n        const signInUrl = options.pages?.signIn || '/auth/signin';\n        const url = new URL(signInUrl, req.url);\n        url.searchParams.set('callbackUrl', pathname);\n        const response = NextResponse.redirect(url);\n        response.cookies.delete(cookieName);\n        return response;\n      }\n\n      const requestHeaders = new Headers(req.headers);\n      requestHeaders.set('x-oauth42-refreshed-token', backendSession.access_token);\n      return NextResponse.next({\n        request: {\n          headers: requestHeaders,\n        },\n      });\n    }\n\n    // Check if access token is expired or expiring soon (15 second buffer)\n    // Buffer must be less than the token TTL to have a valid window\n    const expiresAt = token.expiresAt as number | undefined;\n    const now = Math.floor(Date.now() / 1000);\n    const bufferSeconds = 15;\n    const needsRefresh = expiresAt && now >= expiresAt - bufferSeconds;\n\n    if (needsRefresh) {\n      console.log('[OAuth42 Middleware] Token needs refresh:', {\n        expiresAt,\n        now,\n        expiredAgo: expiresAt ? now - expiresAt : 'n/a',\n        accessTokenPrefix: (token.accessToken as string)?.substring(0, 20),\n        path: pathname,\n      });\n    }\n\n    if (needsRefresh && token.refreshToken && refreshConfig.clientId && refreshConfig.clientSecret) {\n      const userId = token.sub as string;\n\n      // Check if there's already a refresh in progress for this user\n      let refreshPromise = pendingRefreshes.get(userId);\n\n      if (refreshPromise) {\n        console.log('[OAuth42 Middleware] Waiting for in-flight refresh...');\n      } else {\n        console.log('[OAuth42 Middleware] Access token expired, refreshing...');\n\n        // Create the refresh promise and store it.\n        // Keep the entry for 30s after completion so late-arriving requests\n        // (with stale cookies) reuse the cached result instead of triggering\n        // a new refresh with the already-rotated token. See issue #470.\n        refreshPromise = refreshTokens(\n          token.refreshToken as string,\n          refreshConfig.clientId,\n          refreshConfig.clientSecret,\n          refreshConfig.issuer\n        ).finally(() => {\n          const cleanupTimer = setTimeout(() => pendingRefreshes.delete(userId), 30000);\n          if (typeof cleanupTimer === 'object' && 'unref' in cleanupTimer) {\n            cleanupTimer.unref();\n          }\n        });\n\n        pendingRefreshes.set(userId, refreshPromise);\n      }\n\n      const refreshed = await refreshPromise;\n\n      if (refreshed.success && refreshed.accessToken && refreshed.refreshToken) {\n        // Update the token with new values\n        const updatedToken = {\n          ...token,\n          accessToken: refreshed.accessToken,\n          refreshToken: refreshed.refreshToken,\n          expiresAt: refreshed.expiresAt,\n        };\n\n        // Re-encode the JWT\n        const newJwt = await encode({\n          token: updatedToken,\n          secret: secret!,\n        });\n\n        // Create response with request headers that pass the new token to API routes\n        // This is necessary because API routes read from the request, not the response cookie\n        const requestHeaders = new Headers(req.headers);\n        requestHeaders.set('x-oauth42-refreshed-token', refreshed.accessToken);\n\n        const response = NextResponse.next({\n          request: {\n            headers: requestHeaders,\n          },\n        });\n\n        const cookieOptions = {\n          httpOnly: true,\n          sameSite: 'lax' as const,\n          path: '/',\n          secure: process.env.NODE_ENV === 'production',\n          maxAge: options.session?.maxAge ?? DEFAULT_SESSION_MAX_AGE_SECONDS,\n        };\n\n        // Set cookie with chunking matching NextAuth's SessionStore behavior.\n        // Without chunking, a JWT > ~4 KB is silently rejected by the browser,\n        // causing an infinite refresh loop where every request re-triggers\n        // token refresh but the cookie never persists.\n        if (newJwt.length <= CHUNK_SIZE) {\n          // Fits in a single cookie\n          response.cookies.set(cookieName, newJwt, cookieOptions);\n          // Clean up any leftover chunk cookies from a previously chunked session\n          for (let i = 0; ; i++) {\n            const chunkName = `${cookieName}.${i}`;\n            if (req.cookies.has(chunkName)) {\n              response.cookies.set(chunkName, '', { ...cookieOptions, maxAge: 0 });\n            } else {\n              break;\n            }\n          }\n        } else {\n          // Cookie too large — chunk it like NextAuth does\n          const chunkCount = Math.ceil(newJwt.length / CHUNK_SIZE);\n          for (let i = 0; i < chunkCount; i++) {\n            const chunkName = `${cookieName}.${i}`;\n            const chunkValue = newJwt.slice(i * CHUNK_SIZE, (i + 1) * CHUNK_SIZE);\n            response.cookies.set(chunkName, chunkValue, cookieOptions);\n          }\n          // Delete the base cookie so SessionStore only reads chunks\n          response.cookies.set(cookieName, '', { ...cookieOptions, maxAge: 0 });\n          // Clean up any extra old chunks beyond the new count\n          for (let i = chunkCount; ; i++) {\n            const chunkName = `${cookieName}.${i}`;\n            if (req.cookies.has(chunkName)) {\n              response.cookies.set(chunkName, '', { ...cookieOptions, maxAge: 0 });\n            } else {\n              break;\n            }\n          }\n        }\n\n        // Log details to help diagnose cookie persistence issues\n        const existingChunks = [];\n        for (let i = 0; ; i++) {\n          if (req.cookies.has(`${cookieName}.${i}`)) {\n            existingChunks.push(i);\n          } else {\n            break;\n          }\n        }\n        console.log(`[OAuth42 Middleware] Token refresh complete:`, {\n          jwtBytes: newJwt.length,\n          chunked: newJwt.length > CHUNK_SIZE,\n          existingBaseCooke: req.cookies.has(cookieName),\n          existingChunks: existingChunks.length > 0 ? existingChunks : 'none',\n          newAccessTokenPrefix: refreshed.accessToken?.substring(0, 20),\n          newExpiresAt: refreshed.expiresAt,\n          cookieName,\n        });\n        return response;\n      } else {\n        if (shouldPreserveSessionOnRefreshFailure({\n          error: refreshed.error,\n          expiresAt,\n          now,\n        })) {\n          console.warn(\n            '[OAuth42 Middleware] Refresh failed with invalid_grant for a recently expired token; preserving session cookie for likely parallel refresh race',\n            {\n              expiresAt,\n              now,\n              expiredAgo: now - expiresAt,\n              path: pathname,\n            }\n          );\n          return NextResponse.next();\n        }\n\n        // Refresh failed - clear cookie and redirect to sign in (no error, just let user log in fresh)\n        console.log('[OAuth42 Middleware] Refresh failed, clearing session');\n        const signInUrl = options.pages?.signIn || '/auth/signin';\n        const url = new URL(signInUrl, req.url);\n        url.searchParams.set('callbackUrl', pathname);\n        // DO NOT set error parameter - just redirect silently\n\n        const response = NextResponse.redirect(url);\n        // Clear the base session cookie and any chunk cookies\n        response.cookies.delete(cookieName);\n        for (let i = 0; ; i++) {\n          const chunkName = `${cookieName}.${i}`;\n          if (req.cookies.has(chunkName)) {\n            response.cookies.delete(chunkName);\n          } else {\n            break;\n          }\n        }\n        return response;\n      }\n    }\n\n    // Check custom authorization callback\n    if (options.callbacks?.authorized) {\n      const isAuthorized = await options.callbacks.authorized({ token, req });\n      if (!isAuthorized) {\n        const signInUrl = options.pages?.signIn || '/auth/signin';\n        const url = new URL(signInUrl, req.url);\n        url.searchParams.set('callbackUrl', pathname);\n        return NextResponse.redirect(url);\n      }\n    }\n\n    return NextResponse.next();\n  };\n}\n\n/**\n * Helper to create middleware configuration\n */\nexport function createMiddlewareConfig(\n  protectedPaths: string[] = ['/protected'],\n  publicPaths: string[] = ['/auth', '/api/auth']\n) {\n  return {\n    matcher: [\n      /*\n       * Match all request paths except for the ones starting with:\n       * - _next/static (static files)\n       * - _next/image (image optimization files)\n       * - favicon.ico (favicon file)\n       * - public folder\n       */\n      '/((?!_next/static|_next/image|favicon.ico|public).*)',\n    ],\n    protectedPaths,\n    publicPaths,\n  };\n}\n","export type SessionStoreMode = 'jwt' | 'backend';\n\nexport interface BackendSessionUser {\n  sub?: string;\n  email?: string;\n  username?: string;\n  name?: string;\n  emailVerified?: boolean;\n  groups?: string[];\n}\n\nexport interface BackendSessionResponse {\n  session_id: string;\n  access_token: string;\n  expires_at: number;\n  id_token?: string;\n  user?: BackendSessionUser;\n}\n\nexport interface BackendSessionConfig {\n  issuer: string;\n  clientId: string;\n  clientSecret: string;\n}\n\nexport function isBackendSessionMode(mode?: SessionStoreMode): boolean {\n  return mode === 'backend';\n}\n\nfunction sessionEndpoint(issuer: string): string {\n  return `${issuer.replace(/\\/$/, '')}/api/sdk/sessions`;\n}\n\nexport async function createBackendSession(params: BackendSessionConfig & {\n  accessToken: string;\n  refreshToken: string;\n  expiresAt?: number;\n  idToken?: string;\n  user?: BackendSessionUser;\n}): Promise<BackendSessionResponse> {\n  const response = await fetch(sessionEndpoint(params.issuer), {\n    method: 'POST',\n    headers: { 'Content-Type': 'application/json' },\n    body: JSON.stringify({\n      access_token: params.accessToken,\n      refresh_token: params.refreshToken,\n      expires_at: params.expiresAt ?? Math.floor(Date.now() / 1000) + 3600,\n      id_token: params.idToken,\n      client_id: params.clientId,\n      client_secret: params.clientSecret,\n      issuer: params.issuer,\n      user: params.user,\n    }),\n  });\n\n  if (!response.ok) {\n    throw new Error(`OAuth42 backend session create failed: ${response.status}`);\n  }\n\n  return response.json();\n}\n\nexport async function resolveBackendSession(params: BackendSessionConfig & {\n  sessionId: string;\n}): Promise<BackendSessionResponse | null> {\n  const response = await fetch(`${sessionEndpoint(params.issuer)}/resolve`, {\n    method: 'POST',\n    headers: { 'Content-Type': 'application/json' },\n    body: JSON.stringify({\n      session_id: params.sessionId,\n      client_id: params.clientId,\n      client_secret: params.clientSecret,\n      issuer: params.issuer,\n    }),\n  });\n\n  if (response.status === 401 || response.status === 403 || response.status === 404) {\n    return null;\n  }\n\n  if (!response.ok) {\n    throw new Error(`OAuth42 backend session resolve failed: ${response.status}`);\n  }\n\n  return response.json();\n}\n\nexport async function revokeBackendSession(params: BackendSessionConfig & {\n  sessionId: string;\n}): Promise<void> {\n  await fetch(sessionEndpoint(params.issuer), {\n    method: 'DELETE',\n    headers: { 'Content-Type': 'application/json' },\n    body: JSON.stringify({\n      session_id: params.sessionId,\n      client_id: params.clientId,\n      client_secret: params.clientSecret,\n    }),\n  });\n}\n"],"mappings":";AAAA,SAAsB,oBAAoB;AAC1C,SAAS,UAAU,cAAc;;;ACwB1B,SAAS,qBAAqB,MAAkC;AACrE,SAAO,SAAS;AAClB;AAEA,SAAS,gBAAgB,QAAwB;AAC/C,SAAO,GAAG,OAAO,QAAQ,OAAO,EAAE,CAAC;AACrC;AA+BA,eAAsB,sBAAsB,QAED;AACzC,QAAM,WAAW,MAAM,MAAM,GAAG,gBAAgB,OAAO,MAAM,CAAC,YAAY;AAAA,IACxE,QAAQ;AAAA,IACR,SAAS,EAAE,gBAAgB,mBAAmB;AAAA,IAC9C,MAAM,KAAK,UAAU;AAAA,MACnB,YAAY,OAAO;AAAA,MACnB,WAAW,OAAO;AAAA,MAClB,eAAe,OAAO;AAAA,MACtB,QAAQ,OAAO;AAAA,IACjB,CAAC;AAAA,EACH,CAAC;AAED,MAAI,SAAS,WAAW,OAAO,SAAS,WAAW,OAAO,SAAS,WAAW,KAAK;AACjF,WAAO;AAAA,EACT;AAEA,MAAI,CAAC,SAAS,IAAI;AAChB,UAAM,IAAI,MAAM,2CAA2C,SAAS,MAAM,EAAE;AAAA,EAC9E;AAEA,SAAO,SAAS,KAAK;AACvB;;;ADpEA,IAAM,sBAAsB;AAC5B,IAAM,8BAA8B;AACpC,IAAM,aAAa,sBAAsB;AACzC,IAAM,6BAA6B;AACnC,IAAM,kCAAkC,MAAM,KAAK,KAAK;AAMxD,IAAM,mBAAmB,oBAAI,IAMzB;AAuCG,SAAS,sCAAsC,QAI1C;AACV,MAAI,OAAO,UAAU,mBAAmB,CAAC,OAAO,WAAW;AACzD,WAAO;AAAA,EACT;AAEA,SAAO,OAAO,MAAM,OAAO,aAAa;AAC1C;AAEO,SAAS,qBACd,SACA,OAC8D;AAC9D,SAAO;AAAA,IACL,UACE,QAAQ,YACP,MAAM,YACP,QAAQ,IAAI;AAAA,IACd,cACE,QAAQ,gBACP,MAAM,gBACP,QAAQ,IAAI;AAAA,IACd,QACE,QAAQ,UACP,MAAM,UACP,QAAQ,IAAI,kBACZ;AAAA,EACJ;AACF;AAKA,eAAe,cACb,cACA,UACA,cACA,QACgH;AAChH,MAAI;AACF,UAAM,WAAW,GAAG,MAAM;AAE1B,UAAM,WAAW,MAAM,MAAM,UAAU;AAAA,MACrC,QAAQ;AAAA,MACR,SAAS;AAAA,QACP,gBAAgB;AAAA,MAClB;AAAA,MACA,MAAM,IAAI,gBAAgB;AAAA,QACxB,YAAY;AAAA,QACZ,eAAe;AAAA,QACf,WAAW;AAAA,QACX,eAAe;AAAA,MACjB,CAAC;AAAA,IACH,CAAC;AAED,UAAM,OAAO,MAAM,SAAS,KAAK;AAEjC,QAAI,CAAC,SAAS,IAAI;AAChB,cAAQ,MAAM,8CAA8C,IAAI;AAChE,aAAO,EAAE,SAAS,OAAO,OAAO,KAAK,SAAS,iBAAiB;AAAA,IACjE;AAEA,YAAQ,IAAI,mDAAmD;AAC/D,WAAO;AAAA,MACL,SAAS;AAAA,MACT,aAAa,KAAK;AAAA,MAClB,cAAc,KAAK;AAAA,MACnB,WAAW,KAAK,MAAM,KAAK,IAAI,IAAI,GAAI,KAAK,KAAK,cAAc;AAAA,IACjE;AAAA,EACF,SAAS,OAAO;AACd,YAAQ,MAAM,6CAA6C,KAAK;AAChE,WAAO,EAAE,SAAS,OAAO,OAAO,gBAAgB;AAAA,EAClD;AACF;AASO,SAAS,gBAAgB,UAA8B,CAAC,GAAG;AAChE,QAAM,SAAS,QAAQ,IAAI;AAE3B,MAAI,CAAC,QAAQ;AACX,YAAQ,KAAK,8CAA8C;AAAA,EAC7D;AAEA,SAAO,eAAe,WAAW,KAAkB;AAEjD,UAAM,aAAa,QAAQ,eACvB,GAAG,QAAQ,YAAY,mBACvB;AAEJ,UAAM,QAAQ,MAAM,SAAS;AAAA,MAC3B;AAAA,MACA;AAAA,MACA;AAAA,IACF,CAAC;AAED,UAAM,WAAW,IAAI,QAAQ;AAG7B,QAAI,QAAQ,aAAa,KAAK,UAAQ,SAAS,WAAW,IAAI,CAAC,GAAG;AAChE,aAAO,aAAa,KAAK;AAAA,IAC3B;AAGA,UAAM,kBAAkB,QAAQ,iBAC5B,QAAQ,eAAe,KAAK,UAAQ,SAAS,WAAW,IAAI,CAAC,IAC7D;AAEJ,QAAI,CAAC,iBAAiB;AACpB,aAAO,aAAa,KAAK;AAAA,IAC3B;AAGA,QAAI,CAAC,OAAO;AACV,YAAM,YAAY,QAAQ,OAAO,UAAU;AAC3C,YAAM,MAAM,IAAI,IAAI,WAAW,IAAI,GAAG;AACtC,UAAI,aAAa,IAAI,eAAe,QAAQ;AAC5C,aAAO,aAAa,SAAS,GAAG;AAAA,IAClC;AAEA,UAAM,gBAAgB,qBAAqB,SAAS,KAAK;AAEzD,QAAI,qBAAqB,QAAQ,YAAY,GAAG;AAC9C,YAAM,YAAY,MAAM;AACxB,UAAI,CAAC,aAAa,CAAC,cAAc,YAAY,CAAC,cAAc,cAAc;AACxE,cAAM,YAAY,QAAQ,OAAO,UAAU;AAC3C,cAAM,MAAM,IAAI,IAAI,WAAW,IAAI,GAAG;AACtC,YAAI,aAAa,IAAI,eAAe,QAAQ;AAC5C,cAAM,WAAW,aAAa,SAAS,GAAG;AAC1C,iBAAS,QAAQ,OAAO,UAAU;AAClC,eAAO;AAAA,MACT;AAEA,YAAM,iBAAiB,MAAM,sBAAsB;AAAA,QACjD,QAAQ,cAAc;AAAA,QACtB,UAAU,cAAc;AAAA,QACxB,cAAc,cAAc;AAAA,QAC5B;AAAA,MACF,CAAC,EAAE,MAAM,WAAS;AAChB,gBAAQ,MAAM,wDAAwD,KAAK;AAC3E,eAAO;AAAA,MACT,CAAC;AAED,UAAI,CAAC,gBAAgB;AACnB,cAAM,YAAY,QAAQ,OAAO,UAAU;AAC3C,cAAM,MAAM,IAAI,IAAI,WAAW,IAAI,GAAG;AACtC,YAAI,aAAa,IAAI,eAAe,QAAQ;AAC5C,cAAM,WAAW,aAAa,SAAS,GAAG;AAC1C,iBAAS,QAAQ,OAAO,UAAU;AAClC,eAAO;AAAA,MACT;AAEA,YAAM,iBAAiB,IAAI,QAAQ,IAAI,OAAO;AAC9C,qBAAe,IAAI,6BAA6B,eAAe,YAAY;AAC3E,aAAO,aAAa,KAAK;AAAA,QACvB,SAAS;AAAA,UACP,SAAS;AAAA,QACX;AAAA,MACF,CAAC;AAAA,IACH;AAIA,UAAM,YAAY,MAAM;AACxB,UAAM,MAAM,KAAK,MAAM,KAAK,IAAI,IAAI,GAAI;AACxC,UAAM,gBAAgB;AACtB,UAAM,eAAe,aAAa,OAAO,YAAY;AAErD,QAAI,cAAc;AAChB,cAAQ,IAAI,6CAA6C;AAAA,QACvD;AAAA,QACA;AAAA,QACA,YAAY,YAAY,MAAM,YAAY;AAAA,QAC1C,mBAAoB,MAAM,aAAwB,UAAU,GAAG,EAAE;AAAA,QACjE,MAAM;AAAA,MACR,CAAC;AAAA,IACH;AAEA,QAAI,gBAAgB,MAAM,gBAAgB,cAAc,YAAY,cAAc,cAAc;AAC9F,YAAM,SAAS,MAAM;AAGrB,UAAI,iBAAiB,iBAAiB,IAAI,MAAM;AAEhD,UAAI,gBAAgB;AAClB,gBAAQ,IAAI,uDAAuD;AAAA,MACrE,OAAO;AACL,gBAAQ,IAAI,0DAA0D;AAMtE,yBAAiB;AAAA,UACf,MAAM;AAAA,UACN,cAAc;AAAA,UACd,cAAc;AAAA,UACd,cAAc;AAAA,QAChB,EAAE,QAAQ,MAAM;AACd,gBAAM,eAAe,WAAW,MAAM,iBAAiB,OAAO,MAAM,GAAG,GAAK;AAC5E,cAAI,OAAO,iBAAiB,YAAY,WAAW,cAAc;AAC/D,yBAAa,MAAM;AAAA,UACrB;AAAA,QACF,CAAC;AAED,yBAAiB,IAAI,QAAQ,cAAc;AAAA,MAC7C;AAEA,YAAM,YAAY,MAAM;AAExB,UAAI,UAAU,WAAW,UAAU,eAAe,UAAU,cAAc;AAExE,cAAM,eAAe;AAAA,UACnB,GAAG;AAAA,UACH,aAAa,UAAU;AAAA,UACvB,cAAc,UAAU;AAAA,UACxB,WAAW,UAAU;AAAA,QACvB;AAGA,cAAM,SAAS,MAAM,OAAO;AAAA,UAC1B,OAAO;AAAA,UACP;AAAA,QACF,CAAC;AAID,cAAM,iBAAiB,IAAI,QAAQ,IAAI,OAAO;AAC9C,uBAAe,IAAI,6BAA6B,UAAU,WAAW;AAErE,cAAM,WAAW,aAAa,KAAK;AAAA,UACjC,SAAS;AAAA,YACP,SAAS;AAAA,UACX;AAAA,QACF,CAAC;AAED,cAAM,gBAAgB;AAAA,UACpB,UAAU;AAAA,UACV,UAAU;AAAA,UACV,MAAM;AAAA,UACN,QAAQ,QAAQ,IAAI,aAAa;AAAA,UACjC,QAAQ,QAAQ,SAAS,UAAU;AAAA,QACrC;AAMA,YAAI,OAAO,UAAU,YAAY;AAE/B,mBAAS,QAAQ,IAAI,YAAY,QAAQ,aAAa;AAEtD,mBAAS,IAAI,KAAK,KAAK;AACrB,kBAAM,YAAY,GAAG,UAAU,IAAI,CAAC;AACpC,gBAAI,IAAI,QAAQ,IAAI,SAAS,GAAG;AAC9B,uBAAS,QAAQ,IAAI,WAAW,IAAI,EAAE,GAAG,eAAe,QAAQ,EAAE,CAAC;AAAA,YACrE,OAAO;AACL;AAAA,YACF;AAAA,UACF;AAAA,QACF,OAAO;AAEL,gBAAM,aAAa,KAAK,KAAK,OAAO,SAAS,UAAU;AACvD,mBAAS,IAAI,GAAG,IAAI,YAAY,KAAK;AACnC,kBAAM,YAAY,GAAG,UAAU,IAAI,CAAC;AACpC,kBAAM,aAAa,OAAO,MAAM,IAAI,aAAa,IAAI,KAAK,UAAU;AACpE,qBAAS,QAAQ,IAAI,WAAW,YAAY,aAAa;AAAA,UAC3D;AAEA,mBAAS,QAAQ,IAAI,YAAY,IAAI,EAAE,GAAG,eAAe,QAAQ,EAAE,CAAC;AAEpE,mBAAS,IAAI,cAAc,KAAK;AAC9B,kBAAM,YAAY,GAAG,UAAU,IAAI,CAAC;AACpC,gBAAI,IAAI,QAAQ,IAAI,SAAS,GAAG;AAC9B,uBAAS,QAAQ,IAAI,WAAW,IAAI,EAAE,GAAG,eAAe,QAAQ,EAAE,CAAC;AAAA,YACrE,OAAO;AACL;AAAA,YACF;AAAA,UACF;AAAA,QACF;AAGA,cAAM,iBAAiB,CAAC;AACxB,iBAAS,IAAI,KAAK,KAAK;AACrB,cAAI,IAAI,QAAQ,IAAI,GAAG,UAAU,IAAI,CAAC,EAAE,GAAG;AACzC,2BAAe,KAAK,CAAC;AAAA,UACvB,OAAO;AACL;AAAA,UACF;AAAA,QACF;AACA,gBAAQ,IAAI,gDAAgD;AAAA,UAC1D,UAAU,OAAO;AAAA,UACjB,SAAS,OAAO,SAAS;AAAA,UACzB,mBAAmB,IAAI,QAAQ,IAAI,UAAU;AAAA,UAC7C,gBAAgB,eAAe,SAAS,IAAI,iBAAiB;AAAA,UAC7D,sBAAsB,UAAU,aAAa,UAAU,GAAG,EAAE;AAAA,UAC5D,cAAc,UAAU;AAAA,UACxB;AAAA,QACF,CAAC;AACD,eAAO;AAAA,MACT,OAAO;AACL,YAAI,sCAAsC;AAAA,UACxC,OAAO,UAAU;AAAA,UACjB;AAAA,UACA;AAAA,QACF,CAAC,GAAG;AACF,kBAAQ;AAAA,YACN;AAAA,YACA;AAAA,cACE;AAAA,cACA;AAAA,cACA,YAAY,MAAM;AAAA,cAClB,MAAM;AAAA,YACR;AAAA,UACF;AACA,iBAAO,aAAa,KAAK;AAAA,QAC3B;AAGA,gBAAQ,IAAI,uDAAuD;AACnE,cAAM,YAAY,QAAQ,OAAO,UAAU;AAC3C,cAAM,MAAM,IAAI,IAAI,WAAW,IAAI,GAAG;AACtC,YAAI,aAAa,IAAI,eAAe,QAAQ;AAG5C,cAAM,WAAW,aAAa,SAAS,GAAG;AAE1C,iBAAS,QAAQ,OAAO,UAAU;AAClC,iBAAS,IAAI,KAAK,KAAK;AACrB,gBAAM,YAAY,GAAG,UAAU,IAAI,CAAC;AACpC,cAAI,IAAI,QAAQ,IAAI,SAAS,GAAG;AAC9B,qBAAS,QAAQ,OAAO,SAAS;AAAA,UACnC,OAAO;AACL;AAAA,UACF;AAAA,QACF;AACA,eAAO;AAAA,MACT;AAAA,IACF;AAGA,QAAI,QAAQ,WAAW,YAAY;AACjC,YAAM,eAAe,MAAM,QAAQ,UAAU,WAAW,EAAE,OAAO,IAAI,CAAC;AACtE,UAAI,CAAC,cAAc;AACjB,cAAM,YAAY,QAAQ,OAAO,UAAU;AAC3C,cAAM,MAAM,IAAI,IAAI,WAAW,IAAI,GAAG;AACtC,YAAI,aAAa,IAAI,eAAe,QAAQ;AAC5C,eAAO,aAAa,SAAS,GAAG;AAAA,MAClC;AAAA,IACF;AAEA,WAAO,aAAa,KAAK;AAAA,EAC3B;AACF;AAKO,SAAS,uBACd,iBAA2B,CAAC,YAAY,GACxC,cAAwB,CAAC,SAAS,WAAW,GAC7C;AACA,SAAO;AAAA,IACL,SAAS;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA,MAQP;AAAA,IACF;AAAA,IACA;AAAA,IACA;AAAA,EACF;AACF;","names":[]}

package/dist/server/index.d.mts

@@ -1,6 +1,6 @@
-export { C as CreateAuthOptions, a as OAuth42Provider, c as createAuth, f as createHandlers, g as getOAuth42Session, d as getServerSession, r as refreshAccessToken, w as withOAuth42ServerSideProps, e as withOAuth42Session } from '../auth-BThRQMzh.mjs';
+export { C as CreateAuthOptions, a as OAuth42Provider, c as createAuth, f as createHandlers, g as getOAuth42Session, d as getServerSession, r as refreshAccessToken, w as withOAuth42ServerSideProps, e as withOAuth42Session } from '../auth-D3tAruwx.mjs';
 export { default as NextAuth, NextAuthOptions } from 'next-auth';
-export { OAuth42AuthOptions, createMiddlewareConfig, withOAuth42Auth } from '../middleware/index.mjs';
+export { B as BackendSessionConfig, a as BackendSessionResponse, b as BackendSessionUser, O as OAuth42AuthOptions, S as SessionStoreMode, d as createBackendSession, c as createMiddlewareConfig, r as resolveBackendSession, e as revokeBackendSession, w as withOAuth42Auth } from '../index-Cfqxl9r2.mjs';
 import { NextRequest, NextResponse } from 'next/server';
 import 'next-auth/providers/oauth';
 import 'next';

package/dist/server/index.d.ts

@@ -1,6 +1,6 @@
-export { C as CreateAuthOptions, a as OAuth42Provider, c as createAuth, f as createHandlers, g as getOAuth42Session, d as getServerSession, r as refreshAccessToken, w as withOAuth42ServerSideProps, e as withOAuth42Session } from '../auth-BThRQMzh.js';
+export { C as CreateAuthOptions, a as OAuth42Provider, c as createAuth, f as createHandlers, g as getOAuth42Session, d as getServerSession, r as refreshAccessToken, w as withOAuth42ServerSideProps, e as withOAuth42Session } from '../auth-CYMPe3k0.js';
 export { default as NextAuth, NextAuthOptions } from 'next-auth';
-export { OAuth42AuthOptions, createMiddlewareConfig, withOAuth42Auth } from '../middleware/index.js';
+export { B as BackendSessionConfig, a as BackendSessionResponse, b as BackendSessionUser, O as OAuth42AuthOptions, S as SessionStoreMode, d as createBackendSession, c as createMiddlewareConfig, r as resolveBackendSession, e as revokeBackendSession, w as withOAuth42Auth } from '../index-Cfqxl9r2.js';
 import { NextRequest, NextResponse } from 'next/server';
 import 'next-auth/providers/oauth';
 import 'next';