@poly-x/next 0.1.1 → 0.3.0

package/dist/server-session-pY-nzh5x.mjs

@@ -1,207 +0,0 @@
-import { PolyXError, SessionExpiredError, SessionRevokedError } from "@poly-x/core";
-//#region src/cookie-codec.ts
-/**
-* AES-GCM sealing of the session cookie (F007 / ADR-0004). The key is derived
-* (SHA-256) from the consumer's `POLYX_SESSION_SECRET`; AES-GCM gives
-* confidentiality + tamper-detection together, so any corruption, truncation,
-* or wrong-secret input decrypts to `null` rather than a partial session.
-* Web Crypto is universal (Node ≥20 + edge runtimes), so this runs anywhere a
-* Next route handler runs.
-*/
-const IV_BYTES = 12;
-/**
-* Browsers cap a single cookie at roughly 4096 bytes for the whole `Set-Cookie` pair —
-* name, value and attributes together — and enforce it by DISCARDING the cookie without
-* an error. For a session cookie that failure is invisible and badly misleading: the
-* platform authenticates, the handler answers 200, and the user is bounced back to
-* sign-in on the next request because the cookie was never stored.
-*
-* poly-x-sdk/ADR-0006 measured a live Odin session at 2628 bytes and recorded the missing
-* guard as an open follow-up; a per-tenant flag that inflates the JWT is enough to cross
-* the line. We fail loudly here instead.
-*/
-const SESSION_COOKIE_MAX_BYTES = 4096;
-/** Attributes `buildSessionCookieOptions` always sets: `Path=/; HttpOnly; Secure; SameSite=Lax`. */
-const COOKIE_ATTRIBUTE_BYTES = 45;
-/** Bytes the whole `Set-Cookie` pair will occupy for this value under this cookie name. */
-function sealedCookieByteLength(value, cookieName = "polyx_session") {
-	return new TextEncoder().encode(cookieName).length + 1 + value.length + COOKIE_ATTRIBUTE_BYTES;
-}
-/**
-* Thrown when a sealed session would exceed what a browser will store. Never includes the
-* session itself — the claims that caused the overflow are exactly the data we must not log.
-*/
-var SessionCookieTooLargeError = class extends PolyXError {
-	bytes;
-	limit;
-	constructor(bytes, limit, cookieName) {
-		super(`PolyX session cookie is ${bytes} bytes, over the ~${limit}-byte browser limit for "${cookieName}". The browser would discard it silently and the user would appear signed out. Reduce what the platform puts in the session — the usual cause is a tenant configured to embed full permissions in the JWT (includeFullPermissionInJwt).`, { code: "SESSION_COOKIE_TOO_LARGE" });
-		this.bytes = bytes;
-		this.limit = limit;
-	}
-};
-function base64UrlEncode(bytes) {
-	let binary = "";
-	for (const byte of bytes) binary += String.fromCharCode(byte);
-	return btoa(binary).replace(/\+/g, "-").replace(/\//g, "_").replace(/=+$/, "");
-}
-function base64UrlDecode(text) {
-	const base64 = text.replace(/-/g, "+").replace(/_/g, "/");
-	const padded = base64 + "=".repeat((4 - base64.length % 4) % 4);
-	const binary = atob(padded);
-	const bytes = new Uint8Array(binary.length);
-	for (let i = 0; i < binary.length; i += 1) bytes[i] = binary.charCodeAt(i);
-	return bytes;
-}
-async function deriveKey(secret) {
-	const hash = await crypto.subtle.digest("SHA-256", new TextEncoder().encode(secret));
-	return crypto.subtle.importKey("raw", hash, "AES-GCM", false, ["encrypt", "decrypt"]);
-}
-async function sealSession(session, secret, options = {}) {
-	const key = await deriveKey(secret);
-	const iv = crypto.getRandomValues(new Uint8Array(IV_BYTES));
-	const plaintext = new TextEncoder().encode(JSON.stringify(session));
-	const ciphertext = new Uint8Array(await crypto.subtle.encrypt({
-		name: "AES-GCM",
-		iv
-	}, key, plaintext));
-	const packed = new Uint8Array(iv.length + ciphertext.length);
-	packed.set(iv);
-	packed.set(ciphertext, iv.length);
-	const sealed = base64UrlEncode(packed);
-	const cookieName = options.cookieName ?? "polyx_session";
-	const bytes = sealedCookieByteLength(sealed, cookieName);
-	if (bytes > 4096) throw new SessionCookieTooLargeError(bytes, SESSION_COOKIE_MAX_BYTES, cookieName);
-	return sealed;
-}
-async function openSession(token, secret) {
-	try {
-		const packed = base64UrlDecode(token);
-		if (packed.length <= IV_BYTES) return null;
-		const iv = packed.slice(0, IV_BYTES);
-		const ciphertext = packed.slice(IV_BYTES);
-		const key = await deriveKey(secret);
-		const plaintext = await crypto.subtle.decrypt({
-			name: "AES-GCM",
-			iv
-		}, key, ciphertext);
-		return JSON.parse(new TextDecoder().decode(plaintext));
-	} catch {
-		return null;
-	}
-}
-//#endregion
-//#region src/cookie-adapter.ts
-/**
-* Attributes for the session cookie (ADR-0004 secure custody). `secure` is decided at
-* write time from the actual transport: a `Secure` cookie is silently dropped by the
-* browser over plain http, so http/localhost dev must set `secure:false` while https
-* always sets `secure:true`. This is not a downgrade — `Secure` carries no meaning on
-* http; setting it there just breaks the session. httpOnly/sameSite/path are unchanged.
-*/
-function buildSessionCookieOptions(secure) {
-	return {
-		httpOnly: true,
-		secure,
-		sameSite: "lax",
-		path: "/"
-	};
-}
-//#endregion
-//#region src/server-session.ts
-/**
-* The framework-agnostic BFF session controller (F007): tokens sealed in an
-* httpOnly cookie on the consumer's domain, exchanged/refreshed server-side.
-* Composes core's AuthClient with a CookieAdapter seam; fully unit-testable.
-*/
-const DEFAULT_SESSION_COOKIE = "polyx_session";
-var ServerSession = class {
-	authClient;
-	secret;
-	cookies;
-	cookieName;
-	secure;
-	constructor(options) {
-		this.authClient = options.authClient;
-		this.secret = options.secret;
-		this.cookies = options.cookies;
-		this.cookieName = options.cookieName ?? "polyx_session";
-		this.secure = options.secure ?? true;
-	}
-	async establishFromCode(code, codeVerifier, redirectUri, forwardedHeaders) {
-		const stored = await this.authClient.exchangeCode({
-			code,
-			codeVerifier,
-			redirectUri,
-			forwardedHeaders
-		});
-		await this.write(stored);
-		return stored;
-	}
-	async read() {
-		const raw = this.cookies.get(this.cookieName);
-		if (!raw) return null;
-		return openSession(raw, this.secret);
-	}
-	/** Rotate the tokens; clears the cookie (returns null) on a terminal refresh failure. */
-	async refresh() {
-		const current = await this.read();
-		if (!current) return null;
-		try {
-			const next = await this.authClient.createRefresher()(current);
-			await this.write(next);
-			return next;
-		} catch (error) {
-			if (error instanceof SessionRevokedError || error instanceof SessionExpiredError) {
-				this.clear();
-				return null;
-			}
-			if (error instanceof SessionCookieTooLargeError) {
-				console.error(`[polyx] ${error.message}`);
-				this.clear();
-				return null;
-			}
-			throw error;
-		}
-	}
-	/**
-	* End the session upstream, then locally. `device` revokes this session; `everywhere`
-	* revokes every session for the user (FR-SSO-5).
-	*
-	* Order is load-bearing: revocation is authenticated with the access token sealed in the
-	* cookie, so the cookie must be read before it is dropped. The upstream call is
-	* best-effort — an unreachable platform must not strand the user half-signed-in — but the
-	* call itself is real: the ecosystem logout the SDK used before resolves its session from
-	* a browser cookie, which a server-to-server fetch never carries, so it silently revoked
-	* nothing and answered 200.
-	*/
-	async revoke(scope = "device") {
-		const current = await this.read();
-		if (current) try {
-			await this.authClient.revokeSession(current.tokens.accessToken, scope);
-		} catch {}
-		this.clear();
-	}
-	clear() {
-		this.cookies.delete(this.cookieName);
-	}
-	async write(session) {
-		const sealed = await sealSession(session, this.secret, { cookieName: this.cookieName });
-		this.cookies.set(this.cookieName, sealed, buildSessionCookieOptions(this.secure));
-	}
-};
-function toAuthContext(session) {
-	if (!session) return {
-		isSignedIn: false,
-		userId: null,
-		claims: null
-	};
-	return {
-		isSignedIn: true,
-		userId: session.session.claims.userId,
-		organizationId: session.session.claims.organizationId,
-		claims: session.session.claims
-	};
-}
-//#endregion
-export { SessionCookieTooLargeError as a, sealedCookieByteLength as c, SESSION_COOKIE_MAX_BYTES as i, ServerSession as n, openSession as o, toAuthContext as r, sealSession as s, DEFAULT_SESSION_COOKIE as t };