@pontive/pontkit-server 1.2.1 → 1.3.0

package/dist/index.js

@@ -1,6 +1,6 @@
-import { jwtVerify as I, createLocalJWKSet as Z, jwtDecrypt as Q, EncryptJWT as q } from "jose";
-const b = 3500, T = 16;
-function S(t) {
+import { jwtVerify as R, createLocalJWKSet as Q, jwtDecrypt as q, EncryptJWT as ee } from "jose";
+const v = 3500, $ = 16;
+function U(t) {
   const e = /* @__PURE__ */ new Map();
   if (!t) return e;
   for (const r of t.split(";")) {
@@ -11,122 +11,122 @@ function S(t) {
   }
   return e;
 }
-function $(t) {
+function L(t) {
   return [...t].map(([e, r]) => `${e}=${r}`).join("; ");
 }
-function C(t, e, r) {
+function b(t, e, r) {
   const n = [`${t}=${e}`, "Path=/", "HttpOnly", "SameSite=Lax", `Max-Age=${r.maxAge}`];
   return r.secure && n.push("Secure"), n.join("; ");
 }
-function U(t, e) {
+function C(t, e) {
   return e === 0 ? t : `${t}.${e}`;
 }
-function ee(t, e) {
+function te(t, e) {
   const r = t.get(e);
   if (r === void 0) return null;
   let n = r;
-  for (let s = 1; s < T; s++) {
-    const a = t.get(U(e, s));
+  for (let s = 1; s < $; s++) {
+    const a = t.get(C(e, s));
     if (a === void 0) break;
     n += a;
   }
   return n;
 }
-function te(t, e, r, n) {
-  const s = [], a = Math.max(1, Math.ceil(r.length / b));
+function re(t, e, r, n) {
+  const s = [], a = Math.max(1, Math.ceil(r.length / v));
   for (let c = 0; c < a; c++) {
-    const d = r.slice(c * b, (c + 1) * b);
-    t.set(U(e, c), d), s.push(C(U(e, c), d, n));
+    const u = r.slice(c * v, (c + 1) * v);
+    t.set(C(e, c), u), s.push(b(C(e, c), u, n));
   }
-  for (let c = a; c < T; c++) {
-    const d = U(e, c);
-    if (!t.has(d)) break;
-    t.delete(d), s.push(C(d, "", { ...n, maxAge: 0 }));
+  for (let c = a; c < $; c++) {
+    const u = C(e, c);
+    if (!t.has(u)) break;
+    t.delete(u), s.push(b(u, "", { ...n, maxAge: 0 }));
   }
   return s;
 }
-function R(t, e, r) {
+function M(t, e, r) {
   const n = [];
-  for (let s = 0; s < T; s++) {
-    const a = U(e, s);
+  for (let s = 0; s < $; s++) {
+    const a = C(e, s);
     if (!t.has(a)) {
       if (s > 0) break;
       continue;
     }
-    t.delete(a), n.push(C(a, "", { maxAge: 0, secure: r }));
+    t.delete(a), n.push(b(a, "", { maxAge: 0, secure: r }));
   }
   return n;
 }
-class W extends Error {
+class K extends Error {
   constructor(e, r, n) {
     super(`token endpoint ${e} ${r}: ${n}`), this.status = e, this.code = r;
   }
   status;
   code;
 }
-const re = 600 * 1e3, A = /* @__PURE__ */ new Map(), L = /* @__PURE__ */ new Map();
-function ne(t) {
+const ne = 600 * 1e3, T = /* @__PURE__ */ new Map(), N = /* @__PURE__ */ new Map();
+function se(t) {
   return t.replace(/\/+$/, "");
 }
-function P(t, e) {
-  const r = ne(t);
-  let n = A.get(r);
+function x(t, e) {
+  const r = se(t);
+  let n = T.get(r);
   return n || (n = e(`${r}/.well-known/openid-configuration`).then(async (s) => {
     if (!s.ok) throw new Error(`OIDC discovery failed for ${r}: ${s.status}`);
     return await s.json();
   }).catch((s) => {
-    throw A.delete(r), s;
-  }), A.set(r, n)), n;
+    throw T.delete(r), s;
+  }), T.set(r, n)), n;
 }
-async function M(t, e, r) {
-  const n = L.get(t);
-  if (n && !r && Date.now() - n.at < re) return n.set;
+async function H(t, e, r) {
+  const n = N.get(t);
+  if (n && !r && Date.now() - n.at < ne) return n.set;
   const s = await e(t);
   if (!s.ok) throw new Error(`JWKS fetch failed for ${t}: ${s.status}`);
-  const a = Z(await s.json());
-  return L.set(t, { at: Date.now(), set: a }), a;
+  const a = Q(await s.json());
+  return N.set(t, { at: Date.now(), set: a }), a;
 }
-function K(t) {
+function V(t) {
   let e = "";
   for (const r of t) e += String.fromCharCode(r);
   return btoa(e).replace(/\+/g, "-").replace(/\//g, "_").replace(/=+$/, "");
 }
-function v() {
-  return K(crypto.getRandomValues(new Uint8Array(32)));
+function I() {
+  return V(crypto.getRandomValues(new Uint8Array(32)));
 }
-async function se(t) {
+async function oe(t) {
   const e = await crypto.subtle.digest("SHA-256", new TextEncoder().encode(t));
-  return K(new Uint8Array(e));
+  return V(new Uint8Array(e));
 }
-async function oe(t) {
+async function J(t) {
   return [...new Uint8Array(await crypto.subtle.digest("SHA-256", new TextEncoder().encode(t)))].map((r) => r.toString(16).padStart(2, "0")).join("");
 }
 async function ie(t, e, r) {
-  const n = await P(t.issuer, e), s = new URL(n.authorization_endpoint);
+  const n = await x(t.issuer, e), s = new URL(n.authorization_endpoint);
   return s.searchParams.set("response_type", "code"), s.searchParams.set("client_id", t.clientId), s.searchParams.set("redirect_uri", r.redirectUri), s.searchParams.set("scope", r.scopes), s.searchParams.set("state", r.state), s.searchParams.set("nonce", r.nonce), s.searchParams.set("code_challenge", r.codeChallenge), s.searchParams.set("code_challenge_method", "S256"), r.prompt && s.searchParams.set("prompt", r.prompt), s.toString();
 }
-async function F(t, e, r) {
-  const n = await P(t.issuer, e), s = new URLSearchParams(r);
+async function z(t, e, r) {
+  const n = await x(t.issuer, e), s = new URLSearchParams(r);
   s.set("client_id", t.clientId);
   const a = { "content-type": "application/x-www-form-urlencoded" };
   if (t.clientSecret) {
-    const d = `${encodeURIComponent(t.clientId)}:${encodeURIComponent(t.clientSecret)}`;
-    a.authorization = `Basic ${btoa(d)}`;
+    const u = `${encodeURIComponent(t.clientId)}:${encodeURIComponent(t.clientSecret)}`;
+    a.authorization = `Basic ${btoa(u)}`;
   }
   const c = await e(n.token_endpoint, { method: "POST", headers: a, body: s });
   if (!c.ok) {
-    let d = "unknown_error", h = "";
+    let u = "unknown_error", h = "";
     try {
-      const _ = await c.json();
-      d = _.error ?? d, h = _.error_description ?? "";
+      const f = await c.json();
+      u = f.error ?? u, h = f.error_description ?? "";
     } catch {
     }
-    throw new W(c.status, d, h);
+    throw new K(c.status, u, h);
   }
   return await c.json();
 }
 function ae(t, e, r) {
-  return F(t, e, {
+  return z(t, e, {
     grant_type: "authorization_code",
     code: r.code,
     code_verifier: r.codeVerifier,
@@ -134,33 +134,40 @@ function ae(t, e, r) {
   });
 }
 function ce(t, e, r) {
-  return F(t, e, { grant_type: "refresh_token", refresh_token: r });
+  return z(t, e, { grant_type: "refresh_token", refresh_token: r });
 }
-async function V(t, e, r) {
-  const n = await P(t.issuer, e), s = { issuer: n.issuer, audience: t.clientId };
+async function G(t, e, r) {
+  const n = await x(t.issuer, e), s = { issuer: n.issuer, audience: t.clientId };
   try {
-    return (await I(r, await M(n.jwks_uri, e, !1), s)).payload;
+    return (await R(r, await H(n.jwks_uri, e, !1), s)).payload;
   } catch (a) {
     if (a.code !== "ERR_JWKS_NO_MATCHING_KEY") throw a;
-    return (await I(r, await M(n.jwks_uri, e, !0), s)).payload;
+    return (await R(r, await H(n.jwks_uri, e, !0), s)).payload;
   }
 }
 async function ue(t, e, r, n) {
-  const s = await V(t, e, r);
+  const s = await G(t, e, r);
   if (s.nonce !== n) throw new Error("id_token nonce does not match the sign-in request");
   return s;
 }
 async function de(t, e, r) {
-  const n = await P(t.issuer, e);
+  const n = await x(t.issuer, e);
+  if (!n.userinfo_endpoint) return null;
+  const s = await e(n.userinfo_endpoint, { headers: { authorization: `Bearer ${r}` } });
+  if (!s.ok) throw new Error(`userinfo ${s.status}`);
+  return await s.json();
+}
+async function le(t, e, r) {
+  const n = await x(t.issuer, e);
   if (!n.end_session_endpoint) return null;
   const s = new URL(n.end_session_endpoint);
   return s.searchParams.set("client_id", t.clientId), s.searchParams.set("post_logout_redirect_uri", r.postLogoutRedirectUri), r.sessionId && s.searchParams.set("logout_hint", r.sessionId), s.toString();
 }
-const le = "__Host-pontive_access", he = "__Secure-pontive_session_state";
-function fe(t) {
+const he = "__Host-pontive_access", fe = "__Secure-pontive_session_state";
+function we(t) {
   const e = (r) => typeof t[r] == "string" ? t[r] : void 0;
   return {
-    id: t.sub ?? "",
+    id: e("sub") ?? "",
     email: e("email"),
     name: e("name") ?? e("email"),
     username: e("preferred_username"),
@@ -168,22 +175,37 @@ function fe(t) {
     emailVerified: t.email_verified === !0
   };
 }
-function we(t) {
-  const e = { issuer: t.issuer, clientId: t.clientId };
-  async function r(n) {
-    const s = S(n).get(le);
-    if (!s) return null;
-    let a;
+function pe(t) {
+  const e = { issuer: t.issuer, clientId: t.clientId }, r = /* @__PURE__ */ new Map();
+  function n(c) {
+    for (const [u, h] of r)
+      h.expiresAt <= c && r.delete(u);
+  }
+  async function s(c, u) {
+    const h = Date.now();
+    n(h);
+    const f = await J(c), w = r.get(f);
+    if (w) return w.profile;
+    const p = de(e, t.fetch, c).catch((E) => (r.delete(f), t.logger.warn("[pontive] could not read the user's profile:", E instanceof Error ? E.message : String(E)), null));
+    return r.set(f, { expiresAt: u, profile: p }), p;
+  }
+  async function a(c) {
+    const u = U(c).get(he);
+    if (!u) return null;
+    let h;
     try {
-      a = await V(e, t.fetch, s);
-    } catch (c) {
-      return c.code !== "ERR_JWT_EXPIRED" && t.logger.warn("[pontive] access token cookie refused:", c instanceof Error ? c.message : String(c)), null;
+      h = await G(e, t.fetch, u);
+    } catch (p) {
+      return p.code !== "ERR_JWT_EXPIRED" && t.logger.warn("[pontive] access token cookie refused:", p instanceof Error ? p.message : String(p)), null;
     }
+    const f = (h.exp ?? 0) * 1e3, w = await s(u, f);
     return {
-      user: fe(a),
-      accessToken: s,
-      expiresAt: (a.exp ?? 0) * 1e3,
-      sessionId: typeof a.sid == "string" ? a.sid : void 0
+      // The token's own claims win for sub: the profile describes the user the
+      // token names, never another one.
+      user: we({ ...w, ...h, sub: h.sub }),
+      accessToken: u,
+      expiresAt: f,
+      sessionId: typeof h.sid == "string" ? h.sid : void 0
     };
   }
   return {
@@ -191,17 +213,17 @@ function we(t) {
     async handle() {
       return null;
     },
-    getSession: r,
-    async refresh(n) {
-      const s = n.headers.get("cookie"), a = await r(s), c = { session: a, setCookies: [], cookieHeader: s ?? "" };
-      if (a || !S(s).has(he)) return c;
-      const d = new URL(n.url), h = new URL(`${t.authPath}/oauth2/session`, d.origin);
-      return h.searchParams.set("client_id", t.clientId), h.searchParams.set("return_to", d.pathname + d.search), { ...c, handshake: h.pathname + h.search };
+    getSession: a,
+    async refresh(c) {
+      const u = c.headers.get("cookie"), h = await a(u), f = { session: h, setCookies: [], cookieHeader: u ?? "" };
+      if (h || !U(u).has(fe)) return f;
+      const w = new URL(c.url), p = new URL(`${t.authPath}/oauth2/session`, w.origin);
+      return p.searchParams.set("client_id", t.clientId), p.searchParams.set("return_to", w.pathname + w.search), { ...f, handshake: p.pathname + p.search };
     }
   };
 }
-const pe = 10080 * 60;
-function ge(t) {
+const ge = 10080 * 60;
+function ke(t) {
   const e = t.clientSecret ? "server" : "browser", r = ["issuer", "clientId"];
   e === "server" && r.push("sessionSecret");
   for (const n of r)
@@ -230,22 +252,22 @@ function ge(t) {
     prompt: t.prompt,
     cookieName: t.cookieName ?? "pontive_session",
     secureCookies: t.secureCookies,
-    sessionMaxAgeSeconds: t.sessionMaxAgeSeconds ?? pe,
+    sessionMaxAgeSeconds: t.sessionMaxAgeSeconds ?? ge,
     refreshSkewSeconds: t.refreshSkewSeconds ?? 60,
     fetch: t.fetch ?? ((...n) => fetch(...n)),
     logger: t.logger ?? console
   };
 }
-const ke = 3e4;
-class me {
-  constructor(e = ke) {
+const me = 3e4;
+class Se {
+  constructor(e = me) {
     this.recentMs = e;
   }
   recentMs;
   inFlight = /* @__PURE__ */ new Map();
   recent = /* @__PURE__ */ new Map();
   async run(e, r) {
-    const n = await oe(e);
+    const n = await J(e);
     this.sweep();
     const s = this.recent.get(n);
     if (s) return s.result;
@@ -258,32 +280,32 @@ class me {
       n.at < e && this.recent.delete(r);
   }
 }
-const N = /* @__PURE__ */ new Map();
-function J(t) {
-  let e = N.get(t);
-  return e || (e = crypto.subtle.digest("SHA-256", new TextEncoder().encode(t)).then((r) => new Uint8Array(r)), N.set(t, e)), e;
+const D = /* @__PURE__ */ new Map();
+function B(t) {
+  let e = D.get(t);
+  return e || (e = crypto.subtle.digest("SHA-256", new TextEncoder().encode(t)).then((r) => new Uint8Array(r)), D.set(t, e)), e;
 }
-async function H(t, e, r) {
-  return new q(t).setProtectedHeader({ alg: "dir", enc: "A256GCM" }).setIssuedAt().setExpirationTime(`${r}s`).encrypt(await J(e));
+async function O(t, e, r) {
+  return new ee(t).setProtectedHeader({ alg: "dir", enc: "A256GCM" }).setIssuedAt().setExpirationTime(`${r}s`).encrypt(await B(e));
 }
-async function D(t, e) {
+async function j(t, e) {
   try {
-    const { payload: r } = await Q(t, await J(e));
+    const { payload: r } = await q(t, await B(e));
     return r;
   } catch {
     return null;
   }
 }
-const Se = 900, O = 600;
-function _e(t, e) {
+const _e = 900, W = 600;
+function ye(t, e) {
   return t && t.startsWith("/") && !t.startsWith("//") && !t.startsWith("/\\") ? t : e;
 }
-function m(t, e = []) {
+function y(t, e = []) {
   const r = new Headers({ location: t, "cache-control": "no-store" });
   for (const n of e) r.append("set-cookie", n);
   return new Response(null, { status: 302, headers: r });
 }
-function E(t, e) {
+function P(t, e) {
   if (t.baseUrl) return t.baseUrl;
   const r = e.headers.get("x-forwarded-host")?.split(",")[0]?.trim() || e.headers.get("host")?.trim();
   if (r) {
@@ -295,7 +317,7 @@ function E(t, e) {
   }
   return new URL(e.url).origin;
 }
-function ye(t) {
+function Ue(t) {
   const e = (n) => typeof t[n] == "string" ? t[n] : void 0, r = e("name") ?? ([e("given_name"), e("family_name")].filter(Boolean).join(" ") || void 0) ?? e("email");
   return {
     id: t.sub ?? "",
@@ -306,86 +328,86 @@ function ye(t) {
     emailVerified: t.email_verified === !0
   };
 }
-function j(t) {
-  return Date.now() + (t.expires_in ?? Se) * 1e3;
+function F(t) {
+  return Date.now() + (t.expires_in ?? _e) * 1e3;
 }
 function Ce(t) {
-  const e = ge(t);
-  if (e.mode === "browser") return we(e);
-  const r = { issuer: e.issuer, clientId: e.clientId, clientSecret: e.clientSecret }, n = `${e.cookieName}_tx`, s = new me(), a = (o) => e.secureCookies ?? E(e, o).startsWith("https:"), c = (o) => e.redirectUri ?? `${E(e, o)}${e.basePath}/callback`, d = (o, i) => {
-    const u = new URL(e.signInPath, E(e, o));
-    return i && u.searchParams.set("error", i), u.toString();
+  const e = ke(t);
+  if (e.mode === "browser") return pe(e);
+  const r = { issuer: e.issuer, clientId: e.clientId, clientSecret: e.clientSecret }, n = `${e.cookieName}_tx`, s = new Se(), a = (o) => e.secureCookies ?? P(e, o).startsWith("https:"), c = (o) => e.redirectUri ?? `${P(e, o)}${e.basePath}/callback`, u = (o, i) => {
+    const d = new URL(e.signInPath, P(e, o));
+    return i && d.searchParams.set("error", i), d.toString();
   };
   async function h(o) {
-    const i = ee(o, e.cookieName);
+    const i = te(o, e.cookieName);
     if (i === null) return null;
-    const u = await D(i, e.sessionSecret);
-    return u || e.logger.warn("[pontive] session cookie could not be read (sealed with another secret, or truncated)"), u;
+    const d = await j(i, e.sessionSecret);
+    return d || e.logger.warn("[pontive] session cookie could not be read (sealed with another secret, or truncated)"), d;
   }
-  async function _(o, i, u) {
-    const l = await H({ ...i }, e.sessionSecret, e.sessionMaxAgeSeconds);
-    return te(o, e.cookieName, l, { maxAge: e.sessionMaxAgeSeconds, secure: a(u) });
+  async function f(o, i, d) {
+    const l = await O({ ...i }, e.sessionSecret, e.sessionMaxAgeSeconds);
+    return re(o, e.cookieName, l, { maxAge: e.sessionMaxAgeSeconds, secure: a(d) });
   }
-  function y(o) {
-    const { refreshToken: i, ...u } = o;
-    return u;
+  function w(o) {
+    const { refreshToken: i, ...d } = o;
+    return d;
   }
-  async function G(o) {
-    const i = new URL(o.url), u = {
-      state: v(),
-      verifier: v(),
-      nonce: v(),
-      returnTo: _e(i.searchParams.get("returnTo") ?? i.searchParams.get("next"), e.afterSignInPath)
+  async function p(o) {
+    const i = new URL(o.url), d = {
+      state: I(),
+      verifier: I(),
+      nonce: I(),
+      returnTo: ye(i.searchParams.get("returnTo") ?? i.searchParams.get("next"), e.afterSignInPath)
     }, l = await ie(r, e.fetch, {
       redirectUri: c(o),
       scopes: e.scopes,
-      state: u.state,
-      nonce: u.nonce,
-      codeChallenge: await se(u.verifier),
+      state: d.state,
+      nonce: d.nonce,
+      codeChallenge: await oe(d.verifier),
       prompt: e.prompt
-    }), f = await H({ ...u }, e.sessionSecret, O);
-    return m(l, [C(n, f, { maxAge: O, secure: a(o) })]);
+    }), g = await O({ ...d }, e.sessionSecret, W);
+    return y(l, [b(n, g, { maxAge: W, secure: a(o) })]);
   }
-  async function z(o) {
-    const i = new URL(o.url), u = S(o.headers.get("cookie")), l = [C(n, "", { maxAge: 0, secure: a(o) })], f = i.searchParams.get("error");
-    if (f) return m(d(o, f), l);
-    const w = u.get(n), k = w ? await D(w, e.sessionSecret) : null, p = i.searchParams.get("code");
-    if (!k || !p || i.searchParams.get("state") !== k.state)
-      return m(d(o, "invalid_state"), l);
+  async function E(o) {
+    const i = new URL(o.url), d = U(o.headers.get("cookie")), l = [b(n, "", { maxAge: 0, secure: a(o) })], g = i.searchParams.get("error");
+    if (g) return y(u(o, g), l);
+    const k = d.get(n), _ = k ? await j(k, e.sessionSecret) : null, m = i.searchParams.get("code");
+    if (!_ || !m || i.searchParams.get("state") !== _.state)
+      return y(u(o, "invalid_state"), l);
     try {
-      const g = await ae(r, e.fetch, {
-        code: p,
-        codeVerifier: k.verifier,
+      const S = await ae(r, e.fetch, {
+        code: m,
+        codeVerifier: _.verifier,
         redirectUri: c(o)
       });
-      if (!g.id_token) throw new Error("the token response carried no id_token; is the openid scope requested?");
-      const x = await ue(r, e.fetch, g.id_token, k.nonce), Y = {
-        user: ye(x),
-        accessToken: g.access_token,
-        refreshToken: g.refresh_token,
-        expiresAt: j(g),
-        sessionId: typeof x.sid == "string" ? x.sid : void 0
+      if (!S.id_token) throw new Error("the token response carried no id_token; is the openid scope requested?");
+      const A = await ue(r, e.fetch, S.id_token, _.nonce), Z = {
+        user: Ue(A),
+        accessToken: S.access_token,
+        refreshToken: S.refresh_token,
+        expiresAt: F(S),
+        sessionId: typeof A.sid == "string" ? A.sid : void 0
       };
-      l.push(...await _(u, Y, o));
-    } catch (g) {
-      return e.logger.warn("[pontive] sign-in failed:", g instanceof Error ? g.message : String(g)), m(d(o, "exchange_failed"), l);
+      l.push(...await f(d, Z, o));
+    } catch (S) {
+      return e.logger.warn("[pontive] sign-in failed:", S instanceof Error ? S.message : String(S)), y(u(o, "exchange_failed"), l);
     }
-    return m(new URL(k.returnTo, E(e, o)).toString(), l);
+    return y(new URL(_.returnTo, P(e, o)).toString(), l);
   }
-  async function B(o) {
-    const i = S(o.headers.get("cookie")), u = await h(i), l = R(i, e.cookieName, a(o));
-    let f = d(o);
+  async function X(o) {
+    const i = U(o.headers.get("cookie")), d = await h(i), l = M(i, e.cookieName, a(o));
+    let g = u(o);
     try {
-      f = await de(r, e.fetch, {
-        postLogoutRedirectUri: d(o),
-        sessionId: u?.sessionId
-      }) ?? f;
-    } catch (w) {
-      e.logger.warn("[pontive] could not reach the issuer to end its session:", w instanceof Error ? w.message : String(w));
+      g = await le(r, e.fetch, {
+        postLogoutRedirectUri: u(o),
+        sessionId: d?.sessionId
+      }) ?? g;
+    } catch (k) {
+      e.logger.warn("[pontive] could not reach the issuer to end its session:", k instanceof Error ? k.message : String(k));
     }
-    return m(f, l);
+    return y(g, l);
   }
-  async function X(o) {
+  async function Y(o) {
     try {
       const i = await ce(r, e.fetch, o.refreshToken);
       return {
@@ -393,10 +415,10 @@ function Ce(t) {
         accessToken: i.access_token,
         // A response without one means rotation is off: the token in hand is still current.
         refreshToken: i.refresh_token ?? o.refreshToken,
-        expiresAt: j(i)
+        expiresAt: F(i)
       };
     } catch (i) {
-      if (i instanceof W && i.status >= 400 && i.status < 500)
+      if (i instanceof K && i.status >= 400 && i.status < 500)
         return e.logger.warn("[pontive] refresh refused; signing out:", i.message), null;
       throw i;
     }
@@ -405,42 +427,42 @@ function Ce(t) {
     async handle(o) {
       const { pathname: i } = new URL(o.url);
       if (!i.startsWith(`${e.basePath}/`)) return null;
-      const u = i.slice(e.basePath.length + 1);
-      return u === "login" && o.method === "GET" ? G(o) : u === "callback" && o.method === "GET" ? z(o) : u === "logout" && (o.method === "GET" || o.method === "POST") ? B(o) : null;
+      const d = i.slice(e.basePath.length + 1);
+      return d === "login" && o.method === "GET" ? p(o) : d === "callback" && o.method === "GET" ? E(o) : d === "logout" && (o.method === "GET" || o.method === "POST") ? X(o) : null;
     },
     async getSession(o) {
-      const i = await h(S(o));
+      const i = await h(U(o));
       return i ? Date.now() >= i.expiresAt ? (e.logger.warn(
         "[pontive] the session's access token has expired and getSession cannot refresh it. Run the SDK's middleware on this path so it refreshes before the request is handled."
-      ), null) : y(i) : null;
+      ), null) : w(i) : null;
     },
     async refresh(o) {
-      const i = S(o.headers.get("cookie")), u = (p) => ({
-        session: p,
+      const i = U(o.headers.get("cookie")), d = (m) => ({
+        session: m,
         setCookies: [],
         cookieHeader: o.headers.get("cookie") ?? ""
       }), l = await h(i);
-      if (!l) return u(null);
+      if (!l) return d(null);
       if (new URL(o.url).pathname.startsWith(`${e.basePath}/`))
-        return u(Date.now() < l.expiresAt ? y(l) : null);
-      if (Date.now() < l.expiresAt - e.refreshSkewSeconds * 1e3) return u(y(l));
-      const f = () => ({ session: null, setCookies: R(i, e.cookieName, a(o)), cookieHeader: $(i) });
-      if (!l.refreshToken) return f();
-      let w;
+        return d(Date.now() < l.expiresAt ? w(l) : null);
+      if (Date.now() < l.expiresAt - e.refreshSkewSeconds * 1e3) return d(w(l));
+      const g = () => ({ session: null, setCookies: M(i, e.cookieName, a(o)), cookieHeader: L(i) });
+      if (!l.refreshToken) return g();
+      let k;
       try {
-        w = await s.run(l.refreshToken, () => X(l));
-      } catch (p) {
-        return e.logger.warn("[pontive] refresh failed, will retry:", p instanceof Error ? p.message : String(p)), u(Date.now() < l.expiresAt ? y(l) : null);
+        k = await s.run(l.refreshToken, () => Y(l));
+      } catch (m) {
+        return e.logger.warn("[pontive] refresh failed, will retry:", m instanceof Error ? m.message : String(m)), d(Date.now() < l.expiresAt ? w(l) : null);
       }
-      if (!w) return f();
-      const k = await _(i, w, o);
-      return { session: y(w), setCookies: k, cookieHeader: $(i) };
+      if (!k) return g();
+      const _ = await f(i, k, o);
+      return { session: w(k), setCookies: _, cookieHeader: L(i) };
     }
   };
 }
 export {
-  le as ACCESS_COOKIE,
-  he as SESSION_HINT_COOKIE,
+  he as ACCESS_COOKIE,
+  fe as SESSION_HINT_COOKIE,
   Ce as createServerAuth
 };
 //# sourceMappingURL=index.js.map