@oauth42/next 0.4.8 → 0.5.1

package/dist/{auth-BThRQMzh.d.ts → par-Cyu6M1e6.d.mts}

@@ -1,3 +1,4 @@
+import { a as OAuth42ClientAssertion, O as OAuth42DPoP, S as SessionStoreMode } from './index-BuZTiUds.mjs';
 import { OAuthUserConfig, OAuthConfig } from 'next-auth/providers/oauth';
 import * as next_auth from 'next-auth';
 import { NextAuthOptions } from 'next-auth';
@@ -17,15 +18,17 @@ interface OAuth42Profile {
 }
 interface OAuth42ProviderOptions {
     clientId: string;
-    clientSecret: string;
+    clientSecret?: string;
+    clientAssertionKey?: OAuth42ClientAssertion;
     issuer?: string;
     authorizationUrl?: string;
     tokenUrl?: string;
     userinfoUrl?: string;
     scopes?: string[];
     pkceEnabled?: boolean;
+    dpop?: OAuth42DPoP;
 }
-declare function OAuth42Provider<P extends OAuth42Profile>(options: OAuthUserConfig<P> & Partial<OAuth42ProviderOptions>): OAuthConfig<P>;
+declare function OAuth42Provider<P extends OAuth42Profile>(options: Omit<OAuthUserConfig<P>, 'clientSecret'> & Partial<OAuth42ProviderOptions>): OAuthConfig<P>;
 
 /**
  * Get the OAuth42 session server-side
@@ -43,10 +46,8 @@ declare function OAuth42Provider<P extends OAuth42Profile>(options: OAuthUserCon
  * const session = await getOAuth42Session(req, res, authOptions);
  * ```
  *
- * **Token Refresh Support:**
- * When middleware refreshes an expired token, it passes the new token via
- * the `x-oauth42-refreshed-token` header. This function automatically detects
- * and uses that refreshed token, ensuring API routes always have a valid token.
+ * Middleware forwards refreshed encrypted session cookies to the current request.
+ * Caller-supplied access-token headers are never an authentication source.
  */
 declare function getOAuth42Session(...args: [GetServerSidePropsContext['req'], GetServerSidePropsContext['res'], NextAuthOptions] | [NextApiRequest, NextApiResponse, NextAuthOptions] | [NextAuthOptions]): Promise<next_auth.Session | null>;
 /**
@@ -64,10 +65,23 @@ interface CreateAuthOptions {
     issuer?: string;
     scopes?: string[];
     pkceEnabled?: boolean;
+    /** Require PAR through the returned App Router handlers; never falls back. */
+    pushedAuthorization?: boolean;
+    dpop?: OAuth42DPoP;
+    clientAssertionKey?: OAuth42ClientAssertion;
     debug?: boolean;
     callbacks?: NextAuthOptions['callbacks'];
+    events?: NextAuthOptions['events'];
     pages?: NextAuthOptions['pages'];
     session?: NextAuthOptions['session'];
+    /**
+     * Session storage mode.
+     *
+     * - "jwt" keeps OAuth token material in the encrypted NextAuth JWT cookie.
+     * - "backend" stores token material behind a Rust-backend-owned opaque
+     *   session id. Next.js never talks to Redis directly.
+     */
+    sessionStore?: SessionStoreMode;
     /**
      * Unique prefix for cookie names to allow multiple apps on the same domain.
      * Each app should use a different prefix (e.g., 'portal', 'admin', 'bond').
@@ -105,10 +119,21 @@ declare const getServerSession: typeof getOAuth42Session;
  * Token refresh helper with simple per-process locking
  *
  * The lock prevents multiple concurrent refresh calls from the same process,
- * reducing unnecessary token churn. The backend also has a 10-second grace
- * period for blacklisted tokens, so concurrent requests across processes
- * will still succeed.
+ * reducing unnecessary token churn. Coordinate refresh across backend instances;
+ * the server rejects reuse of an already rotated refresh token.
  */
-declare function refreshAccessToken(token: any, clientId: string, clientSecret: string, issuer?: string): Promise<any>;
+declare function refreshAccessToken(token: any, clientId: string, clientSecret: string, issuer?: string, dpop?: OAuth42DPoP, clientAssertionKey?: OAuth42ClientAssertion): Promise<any>;
+
+interface PARConfig {
+    issuer: string;
+    clientId: string;
+    clientSecret?: string;
+    dpop?: OAuth42DPoP;
+    clientAssertionKey?: OAuth42ClientAssertion;
+}
+/** Transform only the authorization redirect produced by NextAuth after its
+ * state/nonce/PKCE cookies are set. All pushed parameters stay server-side. */
+declare function pushAuthorizationURL(value: string, config: PARConfig): Promise<string>;
+declare function withPushedAuthorization(handler: (...args: any[]) => any, config: PARConfig): (request: Request, context: unknown) => Promise<Response>;
 
-export { type CreateAuthOptions as C, type OAuth42Profile as O, OAuth42Provider as a, type OAuth42ProviderOptions as b, createAuth as c, getServerSession as d, withOAuth42Session as e, createHandlers as f, getOAuth42Session as g, refreshAccessToken as r, withOAuth42ServerSideProps as w };
+export { type CreateAuthOptions as C, OAuth42Provider as O, type PARConfig as P, createHandlers as a, getServerSession as b, createAuth as c, withOAuth42Session as d, withPushedAuthorization as e, type OAuth42Profile as f, getOAuth42Session as g, type OAuth42ProviderOptions as h, pushAuthorizationURL as p, refreshAccessToken as r, withOAuth42ServerSideProps as w };

package/dist/{auth-BThRQMzh.d.mts → par-DQNt8j-s.d.ts}

@@ -1,3 +1,4 @@
+import { a as OAuth42ClientAssertion, O as OAuth42DPoP, S as SessionStoreMode } from './index-BuZTiUds.js';
 import { OAuthUserConfig, OAuthConfig } from 'next-auth/providers/oauth';
 import * as next_auth from 'next-auth';
 import { NextAuthOptions } from 'next-auth';
@@ -17,15 +18,17 @@ interface OAuth42Profile {
 }
 interface OAuth42ProviderOptions {
     clientId: string;
-    clientSecret: string;
+    clientSecret?: string;
+    clientAssertionKey?: OAuth42ClientAssertion;
     issuer?: string;
     authorizationUrl?: string;
     tokenUrl?: string;
     userinfoUrl?: string;
     scopes?: string[];
     pkceEnabled?: boolean;
+    dpop?: OAuth42DPoP;
 }
-declare function OAuth42Provider<P extends OAuth42Profile>(options: OAuthUserConfig<P> & Partial<OAuth42ProviderOptions>): OAuthConfig<P>;
+declare function OAuth42Provider<P extends OAuth42Profile>(options: Omit<OAuthUserConfig<P>, 'clientSecret'> & Partial<OAuth42ProviderOptions>): OAuthConfig<P>;
 
 /**
  * Get the OAuth42 session server-side
@@ -43,10 +46,8 @@ declare function OAuth42Provider<P extends OAuth42Profile>(options: OAuthUserCon
  * const session = await getOAuth42Session(req, res, authOptions);
  * ```
  *
- * **Token Refresh Support:**
- * When middleware refreshes an expired token, it passes the new token via
- * the `x-oauth42-refreshed-token` header. This function automatically detects
- * and uses that refreshed token, ensuring API routes always have a valid token.
+ * Middleware forwards refreshed encrypted session cookies to the current request.
+ * Caller-supplied access-token headers are never an authentication source.
  */
 declare function getOAuth42Session(...args: [GetServerSidePropsContext['req'], GetServerSidePropsContext['res'], NextAuthOptions] | [NextApiRequest, NextApiResponse, NextAuthOptions] | [NextAuthOptions]): Promise<next_auth.Session | null>;
 /**
@@ -64,10 +65,23 @@ interface CreateAuthOptions {
     issuer?: string;
     scopes?: string[];
     pkceEnabled?: boolean;
+    /** Require PAR through the returned App Router handlers; never falls back. */
+    pushedAuthorization?: boolean;
+    dpop?: OAuth42DPoP;
+    clientAssertionKey?: OAuth42ClientAssertion;
     debug?: boolean;
     callbacks?: NextAuthOptions['callbacks'];
+    events?: NextAuthOptions['events'];
     pages?: NextAuthOptions['pages'];
     session?: NextAuthOptions['session'];
+    /**
+     * Session storage mode.
+     *
+     * - "jwt" keeps OAuth token material in the encrypted NextAuth JWT cookie.
+     * - "backend" stores token material behind a Rust-backend-owned opaque
+     *   session id. Next.js never talks to Redis directly.
+     */
+    sessionStore?: SessionStoreMode;
     /**
      * Unique prefix for cookie names to allow multiple apps on the same domain.
      * Each app should use a different prefix (e.g., 'portal', 'admin', 'bond').
@@ -105,10 +119,21 @@ declare const getServerSession: typeof getOAuth42Session;
  * Token refresh helper with simple per-process locking
  *
  * The lock prevents multiple concurrent refresh calls from the same process,
- * reducing unnecessary token churn. The backend also has a 10-second grace
- * period for blacklisted tokens, so concurrent requests across processes
- * will still succeed.
+ * reducing unnecessary token churn. Coordinate refresh across backend instances;
+ * the server rejects reuse of an already rotated refresh token.
  */
-declare function refreshAccessToken(token: any, clientId: string, clientSecret: string, issuer?: string): Promise<any>;
+declare function refreshAccessToken(token: any, clientId: string, clientSecret: string, issuer?: string, dpop?: OAuth42DPoP, clientAssertionKey?: OAuth42ClientAssertion): Promise<any>;
+
+interface PARConfig {
+    issuer: string;
+    clientId: string;
+    clientSecret?: string;
+    dpop?: OAuth42DPoP;
+    clientAssertionKey?: OAuth42ClientAssertion;
+}
+/** Transform only the authorization redirect produced by NextAuth after its
+ * state/nonce/PKCE cookies are set. All pushed parameters stay server-side. */
+declare function pushAuthorizationURL(value: string, config: PARConfig): Promise<string>;
+declare function withPushedAuthorization(handler: (...args: any[]) => any, config: PARConfig): (request: Request, context: unknown) => Promise<Response>;
 
-export { type CreateAuthOptions as C, type OAuth42Profile as O, OAuth42Provider as a, type OAuth42ProviderOptions as b, createAuth as c, getServerSession as d, withOAuth42Session as e, createHandlers as f, getOAuth42Session as g, refreshAccessToken as r, withOAuth42ServerSideProps as w };
+export { type CreateAuthOptions as C, OAuth42Provider as O, type PARConfig as P, createHandlers as a, getServerSession as b, createAuth as c, withOAuth42Session as d, withPushedAuthorization as e, type OAuth42Profile as f, getOAuth42Session as g, type OAuth42ProviderOptions as h, pushAuthorizationURL as p, refreshAccessToken as r, withOAuth42ServerSideProps as w };

package/dist/server/index.d.mts

@@ -1,15 +1,19 @@
-export { C as CreateAuthOptions, a as OAuth42Provider, c as createAuth, f as createHandlers, g as getOAuth42Session, d as getServerSession, r as refreshAccessToken, w as withOAuth42ServerSideProps, e as withOAuth42Session } from '../auth-BThRQMzh.mjs';
+export { C as CreateAuthOptions, O as OAuth42Provider, P as PARConfig, c as createAuth, a as createHandlers, g as getOAuth42Session, b as getServerSession, p as pushAuthorizationURL, r as refreshAccessToken, w as withOAuth42ServerSideProps, d as withOAuth42Session, e as withPushedAuthorization } from '../par-Cyu6M1e6.mjs';
 export { default as NextAuth, NextAuthOptions } from 'next-auth';
-export { OAuth42AuthOptions, createMiddlewareConfig, withOAuth42Auth } from '../middleware/index.mjs';
+import { O as OAuth42DPoP, a as OAuth42ClientAssertion } from '../index-BuZTiUds.mjs';
+export { B as BackendSessionConfig, b as BackendSessionResponse, c as BackendSessionUser, d as OAuth42AuthOptions, S as SessionStoreMode, e as createBackendSession, f as createMiddlewareConfig, r as resolveBackendSession, g as revokeBackendSession, w as withOAuth42Auth } from '../index-BuZTiUds.mjs';
 import { NextRequest, NextResponse } from 'next/server';
 import 'next-auth/providers/oauth';
 import 'next';
+import 'node:crypto';
 
 interface HostedAuthCallbackOptions {
     /**
      * OAuth42 issuer URL (e.g., 'https://api.oauth42.com' or 'https://localhost:8443')
      */
     issuer?: string;
+    dpop?: OAuth42DPoP;
+    clientAssertionKey?: OAuth42ClientAssertion;
     /**
      * OAuth2 client ID
      */
@@ -55,4 +59,4 @@ interface HostedAuthCallbackOptions {
  */
 declare function createHostedAuthCallback(options?: HostedAuthCallbackOptions): (request: NextRequest) => Promise<NextResponse<unknown>>;
 
-export { type HostedAuthCallbackOptions, createHostedAuthCallback };
+export { type HostedAuthCallbackOptions, OAuth42ClientAssertion, OAuth42DPoP, createHostedAuthCallback };

package/dist/server/index.d.ts

@@ -1,15 +1,19 @@
-export { C as CreateAuthOptions, a as OAuth42Provider, c as createAuth, f as createHandlers, g as getOAuth42Session, d as getServerSession, r as refreshAccessToken, w as withOAuth42ServerSideProps, e as withOAuth42Session } from '../auth-BThRQMzh.js';
+export { C as CreateAuthOptions, O as OAuth42Provider, P as PARConfig, c as createAuth, a as createHandlers, g as getOAuth42Session, b as getServerSession, p as pushAuthorizationURL, r as refreshAccessToken, w as withOAuth42ServerSideProps, d as withOAuth42Session, e as withPushedAuthorization } from '../par-DQNt8j-s.js';
 export { default as NextAuth, NextAuthOptions } from 'next-auth';
-export { OAuth42AuthOptions, createMiddlewareConfig, withOAuth42Auth } from '../middleware/index.js';
+import { O as OAuth42DPoP, a as OAuth42ClientAssertion } from '../index-BuZTiUds.js';
+export { B as BackendSessionConfig, b as BackendSessionResponse, c as BackendSessionUser, d as OAuth42AuthOptions, S as SessionStoreMode, e as createBackendSession, f as createMiddlewareConfig, r as resolveBackendSession, g as revokeBackendSession, w as withOAuth42Auth } from '../index-BuZTiUds.js';
 import { NextRequest, NextResponse } from 'next/server';
 import 'next-auth/providers/oauth';
 import 'next';
+import 'node:crypto';
 
 interface HostedAuthCallbackOptions {
     /**
      * OAuth42 issuer URL (e.g., 'https://api.oauth42.com' or 'https://localhost:8443')
      */
     issuer?: string;
+    dpop?: OAuth42DPoP;
+    clientAssertionKey?: OAuth42ClientAssertion;
     /**
      * OAuth2 client ID
      */
@@ -55,4 +59,4 @@ interface HostedAuthCallbackOptions {
  */
 declare function createHostedAuthCallback(options?: HostedAuthCallbackOptions): (request: NextRequest) => Promise<NextResponse<unknown>>;
 
-export { type HostedAuthCallbackOptions, createHostedAuthCallback };
+export { type HostedAuthCallbackOptions, OAuth42ClientAssertion, OAuth42DPoP, createHostedAuthCallback };