@propelauth/nextjs 0.0.60 → 0.0.67

This diff represents the content of publicly available package versions that have been released to one of the supported registries. The information contained in this diff is provided for informational purposes only and reflects changes between package versions as they appear in their respective public registries.
@@ -1 +1 @@
1
- {"version":3,"sources":["../../src/server/index.ts","../../src/server/exceptions.ts","../../src/server/server-actions.ts","../../src/user.ts","../../src/server/validators.ts","../../src/server/auth.ts"],"sourcesContent":["export type {OrgIdToOrgMemberInfo, OrgMemberInfo, User} from \"../user\"\nexport {UnauthorizedException, ConfigurationException} from \"./exceptions\"\nexport type {ServerActions} from \"./server-actions\"\nexport {initializeAuth} from \"./auth\"\nexport type {InitializeAuthOptions} from \"./auth\"\nexport type {LoggedInProps, LoggedOutProps} from \"../status-types\"\n","export class UnauthorizedException extends Error {\n readonly message: string\n readonly status: number\n\n constructor(message: string) {\n super(message)\n this.message = message\n this.status = 401\n }\n}\n\nexport class ConfigurationException extends Error {\n readonly message: string\n readonly status: number\n\n constructor(message: string) {\n super(message)\n this.message = message\n this.status = 500\n }\n}\n","import * as jose from \"jose\"\nimport {cookies, headers} from \"next/headers\"\nimport {redirect} from \"next/navigation\"\nimport {ConfigurationException, UnauthorizedException} from \"./exceptions\"\nimport {InternalUser, OrgMemberInfo, toOrgIdToOrgMemberInfo, toUser, User} from \"../user\"\nimport {NextRequest, NextResponse} from \"next/server\";\nimport {ResponseCookie} from \"next/dist/compiled/@edge-runtime/cookies\";\n\ntype RefreshAndAccessTokens = {\n refreshToken: string\n accessToken: string\n error: \"none\"\n}\n\ntype RefreshAndAccessTokensUnauthorizedError = {\n error: \"unauthorized\"\n}\n\ntype RefreshAndAccessTokensUnexpectedError = {\n error: \"unexpected\"\n}\n\ntype RefreshTokenResponse = RefreshAndAccessTokens | RefreshAndAccessTokensUnauthorizedError | RefreshAndAccessTokensUnexpectedError\n\nexport const LOGIN_PATH = \"/api/auth/login\"\nexport const CALLBACK_PATH = \"/api/auth/callback\"\nexport const USERINFO_PATH= \"/api/auth/userinfo\"\nexport const LOGOUT_PATH = \"/api/auth/logout\"\nexport const ACCESS_TOKEN_COOKIE_NAME = \"__pa_at\"\nexport const REFRESH_TOKEN_COOKIE_NAME = \"__pa_rt\"\nexport const STATE_COOKIE_NAME = \"__pa_state\"\nexport const CUSTOM_HEADER_FOR_ACCESS_TOKEN = \"x-propelauth-access-token\"\n\nconst COOKIE_OPTIONS: Partial<ResponseCookie> = {\n httpOnly: true,\n sameSite: \"lax\",\n secure: true,\n path: \"/\",\n}\n\nexport type ServerActionArgs = {\n authUrlOrigin: string\n redirectUri: string\n integrationApiKey: string\n verifierKey: string\n postLoginPathFn: (user: User) => string\n}\n\n\nexport type ServerActions = {\n getUser: () => Promise<User | undefined>\n getUserOrRedirect: () => Promise<User>\n validateAccessToken: (accessToken: string) => Promise<User>\n validateAccessTokenOrUndefined: (accessToken: string) => Promise<User | undefined>\n getRouteHandler: (req: NextRequest, { params }: { params: { slug: string } }) => Response | Promise<Response>\n postRouteHandler: (req: NextRequest, { params }: { params: { slug: string } }) => Response | Promise<Response>\n authMiddleware: (req: NextRequest) => Promise<Response>\n}\n\nexport function getServerActions({\n authUrlOrigin,\n postLoginPathFn,\n verifierKey,\n integrationApiKey,\n redirectUri,\n}: ServerActionArgs): ServerActions {\n const publicKeyPromise = jose.importSPKI(verifierKey, \"RS256\")\n async function getUserOrRedirect(): Promise<User> {\n const user = await getUser()\n if (user) {\n return user\n } else {\n redirect(LOGIN_PATH)\n throw new Error(\"Redirecting to login\")\n }\n }\n\n async function getUser(): Promise<User | undefined> {\n const accessToken = headers().get(CUSTOM_HEADER_FOR_ACCESS_TOKEN) || cookies().get(ACCESS_TOKEN_COOKIE_NAME)?.value\n if (accessToken) {\n const user = await validateAccessTokenOrUndefined(accessToken)\n if (user) {\n return user\n }\n }\n return undefined\n }\n\n // Purpose of this middleware is just to keep the access token cookie alive\n // In an ideal world, this could be done in `getUser`, however, you can't\n // set a cookie in a server component.\n // There also doesn't seem to be any way right now to set a cookie in a\n // middleware and pass it forward (you can only set them on the response).\n // You CAN, however, pass in custom headers,\n // so we'll use CUSTOM_HEADER_FOR_ACCESS_TOKEN as a workaround\n async function authMiddleware(req: NextRequest): Promise<Response> {\n if (req.headers.has(CUSTOM_HEADER_FOR_ACCESS_TOKEN)) {\n throw new Error(`${CUSTOM_HEADER_FOR_ACCESS_TOKEN} is set which is for internal use only`)\n } else if (req.nextUrl.pathname === CALLBACK_PATH || req.nextUrl.pathname === LOGOUT_PATH) {\n // Don't do anything for the callback or logout paths, as they will modify the cookies themselves\n return NextResponse.next()\n }\n\n const accessToken = req.cookies.get(ACCESS_TOKEN_COOKIE_NAME)?.value\n const refreshToken = req.cookies.get(REFRESH_TOKEN_COOKIE_NAME)?.value\n\n // For the userinfo endpoint, we want to get the most up-to-date info, so we'll refresh the access token\n if (req.nextUrl.pathname === USERINFO_PATH && refreshToken) {\n const response = await refreshTokenWithAccessAndRefreshToken(refreshToken)\n if (response.error === \"unexpected\") {\n throw new Error(\"Unexpected error while refreshing access token\")\n } else if (response.error === \"unauthorized\") {\n const headers = new Headers()\n headers.append(\"Set-Cookie\", `${ACCESS_TOKEN_COOKIE_NAME}=; Path=/; HttpOnly; Secure; SameSite=Lax; Max-Age=0`)\n headers.append(\"Set-Cookie\", `${REFRESH_TOKEN_COOKIE_NAME}=; Path=/; HttpOnly; Secure; SameSite=Lax; Max-Age=0`)\n return new Response(\"Unauthorized\", {status: 401, headers})\n } else {\n const headers = new Headers(req.headers)\n // Pass along the new access token in a header since cookies don't work\n headers.append(CUSTOM_HEADER_FOR_ACCESS_TOKEN, response.accessToken)\n const nextResponse = NextResponse.next({\n request: {\n headers\n }\n })\n nextResponse.cookies.set(ACCESS_TOKEN_COOKIE_NAME, response.accessToken, COOKIE_OPTIONS)\n nextResponse.cookies.set(REFRESH_TOKEN_COOKIE_NAME, response.refreshToken, COOKIE_OPTIONS)\n return nextResponse\n }\n }\n\n // If we are authenticated, we can continue\n if (accessToken) {\n const user = await validateAccessTokenOrUndefined(accessToken)\n if (user) {\n return NextResponse.next()\n }\n }\n\n // Otherwise, we need to refresh the access token\n if (refreshToken) {\n const response = await refreshTokenWithAccessAndRefreshToken(refreshToken)\n if (response.error === \"unexpected\") {\n throw new Error(\"Unexpected error while refreshing access token\")\n } else if (response.error === \"unauthorized\") {\n const response = NextResponse.next()\n response.cookies.delete(ACCESS_TOKEN_COOKIE_NAME)\n response.cookies.delete(REFRESH_TOKEN_COOKIE_NAME)\n return response\n } else {\n const headers = new Headers(req.headers)\n // Pass along the new access token in a header since cookies don't work\n headers.append(CUSTOM_HEADER_FOR_ACCESS_TOKEN, response.accessToken)\n const nextResponse = NextResponse.next({\n request: {\n headers\n }\n })\n nextResponse.cookies.set(ACCESS_TOKEN_COOKIE_NAME, response.accessToken, COOKIE_OPTIONS)\n nextResponse.cookies.set(REFRESH_TOKEN_COOKIE_NAME, response.refreshToken, COOKIE_OPTIONS)\n return nextResponse\n }\n }\n\n return NextResponse.next()\n }\n\n function getRouteHandler(req: NextRequest, { params }: { params: { slug: string } }) {\n if (params.slug === \"login\") {\n return loginGetHandler()\n } else if (params.slug === \"signup\") {\n return signupGetHandler()\n } else if (params.slug === \"callback\") {\n return callbackGetHandler(req)\n } else if (params.slug === \"userinfo\") {\n return userinfoGetHandler(req)\n } else {\n return new Response(\"\", { status: 404 })\n }\n }\n\n function postRouteHandler(req: NextRequest, { params }: { params: { slug: string } }) {\n if (params.slug === \"logout\") {\n return logoutPostHandler(req)\n } else {\n return new Response(\"\", { status: 404 })\n }\n }\n\n function loginGetHandler() {\n const state = randomState()\n const authorize_url =\n authUrlOrigin + \"/propelauth/ssr/authorize?redirect_uri=\" + redirectUri + \"&state=\" + state\n return new Response(null, {\n status: 302,\n headers: {\n Location: authorize_url,\n \"Set-Cookie\": `${STATE_COOKIE_NAME}=${state}; Path=/; HttpOnly; Secure; SameSite=Lax`,\n }\n })\n }\n\n function signupGetHandler() {\n const state = randomState()\n const authorize_url =\n authUrlOrigin + \"/propelauth/ssr/authorize?redirect_uri=\" + redirectUri + \"&state=\" + state + \"&signup=true\"\n return new Response(null, {\n status: 302,\n headers: {\n Location: authorize_url,\n \"Set-Cookie\": `${STATE_COOKIE_NAME}=${state}; Path=/; HttpOnly; Secure; SameSite=Lax`,\n }\n })\n }\n\n async function callbackGetHandler(req: NextRequest) {\n const oauthState = req.cookies.get(STATE_COOKIE_NAME)?.value\n if (!oauthState || oauthState.length !== 64) {\n console.log(\"No oauth state found\")\n return new Response(null, { status: 302, headers: { Location: LOGIN_PATH } })\n }\n\n const queryParams = req.nextUrl.searchParams\n const state = queryParams.get(\"state\")\n const code = queryParams.get(\"code\")\n if (state !== oauthState) {\n console.log(\"Mismatch between states, redirecting to login\")\n return new Response(null, { status: 302, headers: { Location: LOGIN_PATH } })\n }\n\n const oauth_token_body = {\n redirect_uri: redirectUri,\n code,\n }\n const url = `${authUrlOrigin}/propelauth/ssr/token`\n const response = await fetch(url, {\n method: \"POST\",\n body: JSON.stringify(oauth_token_body),\n headers: {\n \"Content-Type\": \"application/json\",\n Authorization: \"Bearer \" + integrationApiKey,\n },\n })\n\n if (response.ok) {\n const data = await response.json()\n\n const accessToken = data.access_token\n const user = await validateAccessToken(accessToken)\n const path = postLoginPathFn(user)\n if (!path) {\n console.log(\"postLoginPathFn returned undefined\")\n return new Response(\"Unexpected error\", { status: 500 })\n }\n\n const headers = new Headers()\n headers.append(\"Location\", path)\n headers.append(\"Set-Cookie\", `${ACCESS_TOKEN_COOKIE_NAME}=${accessToken}; Path=/; HttpOnly; Secure; SameSite=Lax`)\n headers.append(\"Set-Cookie\", `${REFRESH_TOKEN_COOKIE_NAME}=${data.refresh_token}; Path=/; HttpOnly; Secure; SameSite=Lax`)\n return new Response(null, {\n status: 302,\n headers\n })\n } else if (response.status === 401) {\n return new Response(\"Unexpected error\", { status: 500 })\n } else {\n return new Response(\"Unexpected error\", { status: 500 })\n }\n }\n\n async function userinfoGetHandler(req: NextRequest) {\n const accessToken = req.headers.get(CUSTOM_HEADER_FOR_ACCESS_TOKEN) || req.cookies.get(ACCESS_TOKEN_COOKIE_NAME)?.value\n if (accessToken) {\n const path = `${authUrlOrigin}/propelauth/oauth/userinfo`\n const response = await fetch(path, {\n headers: {\n \"Content-Type\": \"application/json\",\n \"Authorization\": \"Bearer \" + accessToken,\n }\n })\n if (response.ok) {\n const data = await response.json()\n\n const user = new User(\n data.user_id,\n data.email,\n toOrgIdToOrgMemberInfo(data.org_id_to_org_info),\n data.first_name,\n data.last_name,\n data.username,\n data.legacy_user_id,\n data.impersonator_user_id,\n )\n\n return new Response(JSON.stringify(user), {\n status: 200,\n headers: {\n \"Content-Type\": \"application/json\",\n }\n })\n } else if (response.status === 401) {\n return new Response(null, { status: 401 })\n } else {\n return new Response(null, { status: 500 })\n }\n }\n return new Response(null, { status: 401 })\n }\n\n async function refreshTokenWithAccessAndRefreshToken(refreshToken: string): Promise<RefreshTokenResponse> {\n const body = {\n refresh_token: refreshToken,\n }\n const url = `${authUrlOrigin}/api/backend/v1/refresh_token`\n const response = await fetch(url, {\n method: \"POST\",\n body: JSON.stringify(body),\n headers: {\n \"Content-Type\": \"application/json\",\n Authorization: \"Bearer \" + integrationApiKey,\n },\n })\n\n if (response.ok) {\n const data = await response.json()\n const newRefreshToken = data.refresh_token\n const {\n access_token: accessToken,\n expires_at_seconds: expiresAtSeconds,\n } = data.access_token\n\n return {\n refreshToken: newRefreshToken,\n accessToken,\n error: \"none\",\n }\n } else if (response.status === 400) {\n return { error: \"unauthorized\" }\n } else {\n return { error: \"unexpected\" }\n }\n }\n\n async function logoutPostHandler(req: NextRequest) {\n const refresh_token = req.cookies.get(REFRESH_TOKEN_COOKIE_NAME)?.value\n if (!refresh_token) {\n const headers = new Headers()\n headers.append(\"Set-Cookie\", `${ACCESS_TOKEN_COOKIE_NAME}=; Path=/; HttpOnly; Secure; SameSite=Lax; Max-Age=0`)\n headers.append(\"Set-Cookie\", `${REFRESH_TOKEN_COOKIE_NAME}=; Path=/; HttpOnly; Secure; SameSite=Lax; Max-Age=0`)\n return new Response(null, { status: 200, headers })\n }\n\n const logoutBody = { refresh_token }\n const url = `${authUrlOrigin}/api/backend/v1/logout`\n const response = await fetch(url, {\n method: \"POST\",\n body: JSON.stringify(logoutBody),\n headers: {\n \"Content-Type\": \"application/json\",\n Authorization: \"Bearer \" + integrationApiKey,\n },\n })\n\n if (!response.ok) {\n console.log(\n \"Unable to logout, clearing cookies and continuing anyway\",\n response.status,\n response.statusText\n )\n }\n const headers = new Headers()\n headers.append(\"Set-Cookie\", `${ACCESS_TOKEN_COOKIE_NAME}=; Path=/; HttpOnly; Secure; SameSite=Lax; Max-Age=0`)\n headers.append(\"Set-Cookie\", `${REFRESH_TOKEN_COOKIE_NAME}=; Path=/; HttpOnly; Secure; SameSite=Lax; Max-Age=0`)\n return new Response(null, { status: 200, headers })\n }\n\n async function validateAccessTokenOrUndefined(accessToken: string | undefined): Promise<User | undefined> {\n try {\n return await validateAccessToken(accessToken)\n } catch (err) {\n if (err instanceof ConfigurationException) {\n throw err\n } else if (err instanceof UnauthorizedException) {\n return undefined\n } else {\n console.log(\"Error validating access token\", err)\n return undefined\n }\n }\n }\n\n async function validateAccessToken(accessToken: string | undefined): Promise<User> {\n let publicKey\n try {\n publicKey = await publicKeyPromise\n } catch (err) {\n console.error(\"Verifier key is invalid. Make sure it's specified correctly, including the newlines.\", err)\n throw new ConfigurationException(\"Invalid verifier key\")\n }\n\n if (!accessToken) {\n throw new UnauthorizedException(\"No access token provided\")\n }\n\n let accessTokenWithoutBearer = accessToken\n if (accessToken.toLowerCase().startsWith(\"bearer \")) {\n accessTokenWithoutBearer = accessToken.substring(\"bearer \".length)\n }\n\n try {\n const { payload } = await jose.jwtVerify(accessTokenWithoutBearer, publicKey, {\n issuer: authUrlOrigin,\n algorithms: [\"RS256\"],\n })\n\n return toUser(<InternalUser>payload)\n } catch (e) {\n if (e instanceof Error) {\n throw new UnauthorizedException(e.message)\n } else {\n throw new UnauthorizedException(\"Unable to decode jwt\")\n }\n }\n }\n\n return {\n getUser,\n getUserOrRedirect,\n validateAccessToken,\n validateAccessTokenOrUndefined,\n getRouteHandler,\n postRouteHandler,\n authMiddleware,\n }\n}\n\nfunction randomState(): string {\n const randomBytes = crypto.getRandomValues(new Uint8Array(32))\n return Array.from(randomBytes)\n .map((b) => b.toString(16).padStart(2, \"0\"))\n .join(\"\")\n}","export class User {\n public userId: string\n public orgIdToOrgMemberInfo?: OrgIdToOrgMemberInfo\n\n // Metadata about the user\n public email: string\n public firstName?: string\n public lastName?: string\n public username?: string\n\n // If you used our migration APIs to migrate this user from a different system,\n // this is their original ID from that system.\n public legacyUserId?: string\n public impersonatorUserId?: string\n\n constructor(\n userId: string,\n email: string,\n orgIdToOrgMemberInfo?: OrgIdToOrgMemberInfo,\n firstName?: string,\n lastName?: string,\n username?: string,\n legacyUserId?: string,\n impersonatorUserId?: string\n ) {\n this.userId = userId\n this.orgIdToOrgMemberInfo = orgIdToOrgMemberInfo\n\n this.email = email\n this.firstName = firstName\n this.lastName = lastName\n this.username = username\n\n this.legacyUserId = legacyUserId\n this.impersonatorUserId = impersonatorUserId\n }\n\n public getOrg(orgId: string): OrgMemberInfo | undefined {\n if (!this.orgIdToOrgMemberInfo) {\n return undefined\n }\n\n return this.orgIdToOrgMemberInfo[orgId]\n }\n\n public getOrgByName(orgName: string): OrgMemberInfo | undefined {\n if (!this.orgIdToOrgMemberInfo) {\n return undefined\n }\n\n const urlSafeOrgName = orgName.toLowerCase().replace(/ /g, \"-\")\n for (const orgId in this.orgIdToOrgMemberInfo) {\n const orgMemberInfo = this.orgIdToOrgMemberInfo[orgId]\n if (orgMemberInfo.urlSafeOrgName === urlSafeOrgName) {\n return orgMemberInfo\n }\n }\n\n return undefined\n }\n\n public getOrgs(): OrgMemberInfo[] {\n if (!this.orgIdToOrgMemberInfo) {\n return []\n }\n\n return Object.values(this.orgIdToOrgMemberInfo)\n }\n\n public isImpersonating(): boolean {\n return !!this.impersonatorUserId\n }\n\n public static fromJSON(json: string): User {\n const obj = JSON.parse(json)\n const orgIdToOrgMemberInfo: OrgIdToOrgMemberInfo = {}\n for (const orgId in obj.orgIdToOrgMemberInfo) {\n orgIdToOrgMemberInfo[orgId] = OrgMemberInfo.fromJSON(\n JSON.stringify(obj.orgIdToOrgMemberInfo[orgId])\n )\n }\n return new User(\n obj.userId,\n obj.email,\n orgIdToOrgMemberInfo,\n obj.firstName,\n obj.lastName,\n obj.username,\n obj.legacyUserId,\n obj.impersonatorUserId\n )\n }\n}\n\nexport type OrgIdToOrgMemberInfo = {\n [orgId: string]: OrgMemberInfo\n}\n\nexport class OrgMemberInfo {\n public orgId: string\n public orgName: string\n public orgMetadata: { [key: string]: any }\n public urlSafeOrgName: string\n\n private userAssignedRole: string\n private userInheritedRolesPlusCurrentRole: string[]\n private userPermissions: string[]\n\n constructor(\n orgId: string,\n orgName: string,\n orgMetadata: { [key: string]: any },\n urlSafeOrgName: string,\n userAssignedRole: string,\n userInheritedRolesPlusCurrentRole: string[],\n userPermissions: string[]\n ) {\n this.orgId = orgId\n this.orgName = orgName\n this.orgMetadata = orgMetadata\n this.urlSafeOrgName = urlSafeOrgName\n\n this.userAssignedRole = userAssignedRole\n this.userInheritedRolesPlusCurrentRole = userInheritedRolesPlusCurrentRole\n this.userPermissions = userPermissions\n }\n\n // validation methods\n\n public isRole(role: string): boolean {\n return this.userAssignedRole === role\n }\n\n public isAtLeastRole(role: string): boolean {\n return this.userInheritedRolesPlusCurrentRole.includes(role)\n }\n\n public hasPermission(permission: string): boolean {\n return this.userPermissions.includes(permission)\n }\n\n public hasAllPermissions(permissions: string[]): boolean {\n return permissions.every((permission) => this.hasPermission(permission))\n }\n\n public static fromJSON(json: string): OrgMemberInfo {\n const obj = JSON.parse(json)\n return new OrgMemberInfo(\n obj.orgId,\n obj.orgName,\n obj.orgMetadata,\n obj.urlSafeOrgName,\n obj.userAssignedRole,\n obj.userInheritedRolesPlusCurrentRole,\n obj.userPermissions\n )\n }\n\n // getters for the private fields\n\n get assignedRole(): string {\n return this.userAssignedRole\n }\n\n get inheritedRolesPlusCurrentRole(): string[] {\n return this.userInheritedRolesPlusCurrentRole\n }\n\n get permissions(): string[] {\n return this.userPermissions\n }\n}\n\n// These Internal types exist since the server returns snake case, but typescript/javascript\n// convention is camelCase.\nexport type InternalOrgMemberInfo = {\n org_id: string\n org_name: string\n org_metadata: { [key: string]: any }\n url_safe_org_name: string\n user_role: string\n inherited_user_roles_plus_current_role: string[]\n user_permissions: string[]\n}\nexport type InternalUser = {\n user_id: string\n org_id_to_org_member_info?: { [org_id: string]: InternalOrgMemberInfo }\n\n email: string\n first_name?: string\n last_name?: string\n username?: string\n\n // If you used our migration APIs to migrate this user from a different system, this is their original ID from that system.\n legacy_user_id?: string\n impersonatorUserId?: string\n}\n\nexport function toUser(snake_case: InternalUser): User {\n return new User(\n snake_case.user_id,\n snake_case.email,\n toOrgIdToOrgMemberInfo(snake_case.org_id_to_org_member_info),\n snake_case.first_name,\n snake_case.last_name,\n snake_case.username,\n snake_case.legacy_user_id,\n snake_case.impersonatorUserId\n )\n}\n\nexport function toOrgIdToOrgMemberInfo(snake_case?: {\n [org_id: string]: InternalOrgMemberInfo\n}): OrgIdToOrgMemberInfo | undefined {\n if (snake_case === undefined) {\n return undefined\n }\n const camelCase: OrgIdToOrgMemberInfo = {}\n\n for (const key of Object.keys(snake_case)) {\n const snakeCaseValue = snake_case[key]\n if (snakeCaseValue) {\n camelCase[key] = new OrgMemberInfo(\n snakeCaseValue.org_id,\n snakeCaseValue.org_name,\n snakeCaseValue.org_metadata,\n snakeCaseValue.url_safe_org_name,\n snakeCaseValue.user_role,\n snakeCaseValue.inherited_user_roles_plus_current_role,\n snakeCaseValue.user_permissions\n )\n }\n }\n\n return camelCase\n}\n","export function validateAuthUrl(authUrl: string): URL {\n try {\n return new URL(authUrl)\n } catch (e) {\n console.error(\"Invalid authUrl\", e)\n throw new Error(\"Unable to initialize auth client\")\n }\n}\n","import { getServerActions } from \"./server-actions\"\nimport { User } from \"../user\"\nimport { validateAuthUrl } from \"./validators\"\n\nexport type InitializeAuthOptions = {\n authUrl: string\n redirectUri: string\n integrationApiKey: string\n verifierKey: string\n postLoginRedirectPathFn?: (user: User) => string\n}\n\nexport function initializeAuth(opts: InitializeAuthOptions) {\n const authUrl = validateAuthUrl(opts.authUrl).origin\n const postLoginPathFn =\n opts.postLoginRedirectPathFn ||\n function () {\n return \"/\"\n }\n\n return getServerActions({\n authUrlOrigin: authUrl,\n verifierKey: opts.verifierKey,\n redirectUri: opts.redirectUri,\n integrationApiKey: opts.integrationApiKey,\n postLoginPathFn,\n })\n}\n"],"mappings":";;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;;;ACAO,IAAM,wBAAN,cAAoC,MAAM;AAAA,EAI7C,YAAY,SAAiB;AACzB,UAAM,OAAO;AACb,SAAK,UAAU;AACf,SAAK,SAAS;AAAA,EAClB;AACJ;AAEO,IAAM,yBAAN,cAAqC,MAAM;AAAA,EAI9C,YAAY,SAAiB;AACzB,UAAM,OAAO;AACb,SAAK,UAAU;AACf,SAAK,SAAS;AAAA,EAClB;AACJ;;;ACpBA,WAAsB;AACtB,qBAA+B;AAC/B,wBAAuB;;;ACFhB,IAAM,OAAN,MAAW;AAAA,EAed,YACI,QACA,OACA,sBACA,WACA,UACA,UACA,cACA,oBACF;AACE,SAAK,SAAS;AACd,SAAK,uBAAuB;AAE5B,SAAK,QAAQ;AACb,SAAK,YAAY;AACjB,SAAK,WAAW;AAChB,SAAK,WAAW;AAEhB,SAAK,eAAe;AACpB,SAAK,qBAAqB;AAAA,EAC9B;AAAA,EAEO,OAAO,OAA0C;AACpD,QAAI,CAAC,KAAK,sBAAsB;AAC5B,aAAO;AAAA,IACX;AAEA,WAAO,KAAK,qBAAqB,KAAK;AAAA,EAC1C;AAAA,EAEO,aAAa,SAA4C;AAC5D,QAAI,CAAC,KAAK,sBAAsB;AAC5B,aAAO;AAAA,IACX;AAEA,UAAM,iBAAiB,QAAQ,YAAY,EAAE,QAAQ,MAAM,GAAG;AAC9D,eAAW,SAAS,KAAK,sBAAsB;AAC3C,YAAM,gBAAgB,KAAK,qBAAqB,KAAK;AACrD,UAAI,cAAc,mBAAmB,gBAAgB;AACjD,eAAO;AAAA,MACX;AAAA,IACJ;AAEA,WAAO;AAAA,EACX;AAAA,EAEO,UAA2B;AAC9B,QAAI,CAAC,KAAK,sBAAsB;AAC5B,aAAO,CAAC;AAAA,IACZ;AAEA,WAAO,OAAO,OAAO,KAAK,oBAAoB;AAAA,EAClD;AAAA,EAEO,kBAA2B;AAC9B,WAAO,CAAC,CAAC,KAAK;AAAA,EAClB;AAAA,EAEA,OAAc,SAAS,MAAoB;AACvC,UAAM,MAAM,KAAK,MAAM,IAAI;AAC3B,UAAM,uBAA6C,CAAC;AACpD,eAAW,SAAS,IAAI,sBAAsB;AAC1C,2BAAqB,KAAK,IAAI,cAAc;AAAA,QACxC,KAAK,UAAU,IAAI,qBAAqB,KAAK,CAAC;AAAA,MAClD;AAAA,IACJ;AACA,WAAO,IAAI;AAAA,MACP,IAAI;AAAA,MACJ,IAAI;AAAA,MACJ;AAAA,MACA,IAAI;AAAA,MACJ,IAAI;AAAA,MACJ,IAAI;AAAA,MACJ,IAAI;AAAA,MACJ,IAAI;AAAA,IACR;AAAA,EACJ;AACJ;AAMO,IAAM,gBAAN,MAAoB;AAAA,EAUvB,YACI,OACA,SACA,aACA,gBACA,kBACA,mCACA,iBACF;AACE,SAAK,QAAQ;AACb,SAAK,UAAU;AACf,SAAK,cAAc;AACnB,SAAK,iBAAiB;AAEtB,SAAK,mBAAmB;AACxB,SAAK,oCAAoC;AACzC,SAAK,kBAAkB;AAAA,EAC3B;AAAA;AAAA,EAIO,OAAO,MAAuB;AACjC,WAAO,KAAK,qBAAqB;AAAA,EACrC;AAAA,EAEO,cAAc,MAAuB;AACxC,WAAO,KAAK,kCAAkC,SAAS,IAAI;AAAA,EAC/D;AAAA,EAEO,cAAc,YAA6B;AAC9C,WAAO,KAAK,gBAAgB,SAAS,UAAU;AAAA,EACnD;AAAA,EAEO,kBAAkB,aAAgC;AACrD,WAAO,YAAY,MAAM,CAAC,eAAe,KAAK,cAAc,UAAU,CAAC;AAAA,EAC3E;AAAA,EAEA,OAAc,SAAS,MAA6B;AAChD,UAAM,MAAM,KAAK,MAAM,IAAI;AAC3B,WAAO,IAAI;AAAA,MACP,IAAI;AAAA,MACJ,IAAI;AAAA,MACJ,IAAI;AAAA,MACJ,IAAI;AAAA,MACJ,IAAI;AAAA,MACJ,IAAI;AAAA,MACJ,IAAI;AAAA,IACR;AAAA,EACJ;AAAA;AAAA,EAIA,IAAI,eAAuB;AACvB,WAAO,KAAK;AAAA,EAChB;AAAA,EAEA,IAAI,gCAA0C;AAC1C,WAAO,KAAK;AAAA,EAChB;AAAA,EAEA,IAAI,cAAwB;AACxB,WAAO,KAAK;AAAA,EAChB;AACJ;AA2BO,SAAS,OAAO,YAAgC;AACnD,SAAO,IAAI;AAAA,IACP,WAAW;AAAA,IACX,WAAW;AAAA,IACX,uBAAuB,WAAW,yBAAyB;AAAA,IAC3D,WAAW;AAAA,IACX,WAAW;AAAA,IACX,WAAW;AAAA,IACX,WAAW;AAAA,IACX,WAAW;AAAA,EACf;AACJ;AAEO,SAAS,uBAAuB,YAEF;AACjC,MAAI,eAAe,QAAW;AAC1B,WAAO;AAAA,EACX;AACA,QAAM,YAAkC,CAAC;AAEzC,aAAW,OAAO,OAAO,KAAK,UAAU,GAAG;AACvC,UAAM,iBAAiB,WAAW,GAAG;AACrC,QAAI,gBAAgB;AAChB,gBAAU,GAAG,IAAI,IAAI;AAAA,QACjB,eAAe;AAAA,QACf,eAAe;AAAA,QACf,eAAe;AAAA,QACf,eAAe;AAAA,QACf,eAAe;AAAA,QACf,eAAe;AAAA,QACf,eAAe;AAAA,MACnB;AAAA,IACJ;AAAA,EACJ;AAEA,SAAO;AACX;;;ADtOA,oBAAwC;AAmBjC,IAAM,aAAa;AACnB,IAAM,gBAAgB;AACtB,IAAM,gBAAe;AACrB,IAAM,cAAc;AACpB,IAAM,2BAA2B;AACjC,IAAM,4BAA4B;AAClC,IAAM,oBAAoB;AAC1B,IAAM,iCAAiC;AAE9C,IAAM,iBAA0C;AAAA,EAC5C,UAAU;AAAA,EACV,UAAU;AAAA,EACV,QAAQ;AAAA,EACR,MAAM;AACV;AAqBO,SAAS,iBAAiB;AAAA,EAC7B;AAAA,EACA;AAAA,EACA;AAAA,EACA;AAAA,EACA;AACJ,GAAoC;AAChC,QAAM,mBAAwB,gBAAW,aAAa,OAAO;AAC7D,WAAe,oBAAmC;AAAA;AAC9C,YAAM,OAAO,MAAM,QAAQ;AAC3B,UAAI,MAAM;AACN,eAAO;AAAA,MACX,OAAO;AACH,wCAAS,UAAU;AACnB,cAAM,IAAI,MAAM,sBAAsB;AAAA,MAC1C;AAAA,IACJ;AAAA;AAEA,WAAe,UAAqC;AAAA;AA7ExD;AA8EQ,YAAM,kBAAc,wBAAQ,EAAE,IAAI,8BAA8B,OAAK,iCAAQ,EAAE,IAAI,wBAAwB,MAAtC,mBAAyC;AAC9G,UAAI,aAAa;AACb,cAAM,OAAO,MAAM,+BAA+B,WAAW;AAC7D,YAAI,MAAM;AACN,iBAAO;AAAA,QACX;AAAA,MACJ;AACA,aAAO;AAAA,IACX;AAAA;AASA,WAAe,eAAe,KAAqC;AAAA;AA/FvE;AAgGQ,UAAI,IAAI,QAAQ,IAAI,8BAA8B,GAAG;AACjD,cAAM,IAAI,MAAM,GAAG,sEAAsE;AAAA,MAC7F,WAAW,IAAI,QAAQ,aAAa,iBAAiB,IAAI,QAAQ,aAAa,aAAa;AAEvF,eAAO,2BAAa,KAAK;AAAA,MAC7B;AAEA,YAAM,eAAc,SAAI,QAAQ,IAAI,wBAAwB,MAAxC,mBAA2C;AAC/D,YAAM,gBAAe,SAAI,QAAQ,IAAI,yBAAyB,MAAzC,mBAA4C;AAGjE,UAAI,IAAI,QAAQ,aAAa,iBAAiB,cAAc;AACxD,cAAM,WAAW,MAAM,sCAAsC,YAAY;AACzE,YAAI,SAAS,UAAU,cAAc;AACjC,gBAAM,IAAI,MAAM,gDAAgD;AAAA,QACpE,WAAW,SAAS,UAAU,gBAAgB;AAC1C,gBAAMA,WAAU,IAAI,QAAQ;AAC5B,UAAAA,SAAQ,OAAO,cAAc,GAAG,8EAA8E;AAC9G,UAAAA,SAAQ,OAAO,cAAc,GAAG,+EAA+E;AAC/G,iBAAO,IAAI,SAAS,gBAAgB,EAAC,QAAQ,KAAK,SAAAA,SAAO,CAAC;AAAA,QAC9D,OAAO;AACH,gBAAMA,WAAU,IAAI,QAAQ,IAAI,OAAO;AAEvC,UAAAA,SAAQ,OAAO,gCAAgC,SAAS,WAAW;AACnE,gBAAM,eAAe,2BAAa,KAAK;AAAA,YACnC,SAAS;AAAA,cACL,SAAAA;AAAA,YACJ;AAAA,UACJ,CAAC;AACD,uBAAa,QAAQ,IAAI,0BAA0B,SAAS,aAAa,cAAc;AACvF,uBAAa,QAAQ,IAAI,2BAA2B,SAAS,cAAc,cAAc;AACzF,iBAAO;AAAA,QACX;AAAA,MACJ;AAGA,UAAI,aAAa;AACb,cAAM,OAAO,MAAM,+BAA+B,WAAW;AAC7D,YAAI,MAAM;AACN,iBAAO,2BAAa,KAAK;AAAA,QAC7B;AAAA,MACJ;AAGA,UAAI,cAAc;AACd,cAAM,WAAW,MAAM,sCAAsC,YAAY;AACzE,YAAI,SAAS,UAAU,cAAc;AACjC,gBAAM,IAAI,MAAM,gDAAgD;AAAA,QACpE,WAAW,SAAS,UAAU,gBAAgB;AAC1C,gBAAMC,YAAW,2BAAa,KAAK;AACnC,UAAAA,UAAS,QAAQ,OAAO,wBAAwB;AAChD,UAAAA,UAAS,QAAQ,OAAO,yBAAyB;AACjD,iBAAOA;AAAA,QACX,OAAO;AACH,gBAAMD,WAAU,IAAI,QAAQ,IAAI,OAAO;AAEvC,UAAAA,SAAQ,OAAO,gCAAgC,SAAS,WAAW;AACnE,gBAAM,eAAe,2BAAa,KAAK;AAAA,YACnC,SAAS;AAAA,cACL,SAAAA;AAAA,YACJ;AAAA,UACJ,CAAC;AACD,uBAAa,QAAQ,IAAI,0BAA0B,SAAS,aAAa,cAAc;AACvF,uBAAa,QAAQ,IAAI,2BAA2B,SAAS,cAAc,cAAc;AACzF,iBAAO;AAAA,QACX;AAAA,MACJ;AAEA,aAAO,2BAAa,KAAK;AAAA,IAC7B;AAAA;AAEA,WAAS,gBAAgB,KAAkB,EAAE,OAAO,GAAiC;AACjF,QAAI,OAAO,SAAS,SAAS;AACzB,aAAO,gBAAgB;AAAA,IAC3B,WAAW,OAAO,SAAS,UAAU;AACjC,aAAO,iBAAiB;AAAA,IAC5B,WAAW,OAAO,SAAS,YAAY;AACnC,aAAO,mBAAmB,GAAG;AAAA,IACjC,WAAW,OAAO,SAAS,YAAY;AACnC,aAAO,mBAAmB,GAAG;AAAA,IACjC,OAAO;AACH,aAAO,IAAI,SAAS,IAAI,EAAE,QAAQ,IAAI,CAAC;AAAA,IAC3C;AAAA,EACJ;AAEA,WAAS,iBAAiB,KAAkB,EAAE,OAAO,GAAiC;AAClF,QAAI,OAAO,SAAS,UAAU;AAC1B,aAAO,kBAAkB,GAAG;AAAA,IAChC,OAAO;AACH,aAAO,IAAI,SAAS,IAAI,EAAE,QAAQ,IAAI,CAAC;AAAA,IAC3C;AAAA,EACJ;AAEA,WAAS,kBAAkB;AACvB,UAAM,QAAQ,YAAY;AAC1B,UAAM,gBACF,gBAAgB,4CAA4C,cAAc,YAAY;AAC1F,WAAO,IAAI,SAAS,MAAM;AAAA,MACtB,QAAQ;AAAA,MACR,SAAS;AAAA,QACL,UAAU;AAAA,QACV,cAAc,GAAG,qBAAqB;AAAA,MAC1C;AAAA,IACJ,CAAC;AAAA,EACL;AAEA,WAAS,mBAAmB;AACxB,UAAM,QAAQ,YAAY;AAC1B,UAAM,gBACF,gBAAgB,4CAA4C,cAAc,YAAY,QAAQ;AAClG,WAAO,IAAI,SAAS,MAAM;AAAA,MACtB,QAAQ;AAAA,MACR,SAAS;AAAA,QACL,UAAU;AAAA,QACV,cAAc,GAAG,qBAAqB;AAAA,MAC1C;AAAA,IACJ,CAAC;AAAA,EACL;AAEA,WAAe,mBAAmB,KAAkB;AAAA;AAvNxD;AAwNQ,YAAM,cAAa,SAAI,QAAQ,IAAI,iBAAiB,MAAjC,mBAAoC;AACvD,UAAI,CAAC,cAAc,WAAW,WAAW,IAAI;AACzC,gBAAQ,IAAI,sBAAsB;AAClC,eAAO,IAAI,SAAS,MAAM,EAAE,QAAQ,KAAK,SAAS,EAAE,UAAU,WAAW,EAAE,CAAC;AAAA,MAChF;AAEA,YAAM,cAAc,IAAI,QAAQ;AAChC,YAAM,QAAQ,YAAY,IAAI,OAAO;AACrC,YAAM,OAAO,YAAY,IAAI,MAAM;AACnC,UAAI,UAAU,YAAY;AACtB,gBAAQ,IAAI,+CAA+C;AAC3D,eAAO,IAAI,SAAS,MAAM,EAAE,QAAQ,KAAK,SAAS,EAAE,UAAU,WAAW,EAAE,CAAC;AAAA,MAChF;AAEA,YAAM,mBAAmB;AAAA,QACrB,cAAc;AAAA,QACd;AAAA,MACJ;AACA,YAAM,MAAM,GAAG;AACf,YAAM,WAAW,MAAM,MAAM,KAAK;AAAA,QAC9B,QAAQ;AAAA,QACR,MAAM,KAAK,UAAU,gBAAgB;AAAA,QACrC,SAAS;AAAA,UACL,gBAAgB;AAAA,UAChB,eAAe,YAAY;AAAA,QAC/B;AAAA,MACJ,CAAC;AAED,UAAI,SAAS,IAAI;AACb,cAAM,OAAO,MAAM,SAAS,KAAK;AAEjC,cAAM,cAAc,KAAK;AACzB,cAAM,OAAO,MAAM,oBAAoB,WAAW;AAClD,cAAM,OAAO,gBAAgB,IAAI;AACjC,YAAI,CAAC,MAAM;AACP,kBAAQ,IAAI,oCAAoC;AAChD,iBAAO,IAAI,SAAS,oBAAoB,EAAE,QAAQ,IAAI,CAAC;AAAA,QAC3D;AAEA,cAAMA,WAAU,IAAI,QAAQ;AAC5B,QAAAA,SAAQ,OAAO,YAAY,IAAI;AAC/B,QAAAA,SAAQ,OAAO,cAAc,GAAG,4BAA4B,qDAAqD;AACjH,QAAAA,SAAQ,OAAO,cAAc,GAAG,6BAA6B,KAAK,uDAAuD;AACzH,eAAO,IAAI,SAAS,MAAM;AAAA,UACtB,QAAQ;AAAA,UACR,SAAAA;AAAA,QACJ,CAAC;AAAA,MACL,WAAW,SAAS,WAAW,KAAK;AAChC,eAAO,IAAI,SAAS,oBAAoB,EAAE,QAAQ,IAAI,CAAC;AAAA,MAC3D,OAAO;AACH,eAAO,IAAI,SAAS,oBAAoB,EAAE,QAAQ,IAAI,CAAC;AAAA,MAC3D;AAAA,IACJ;AAAA;AAEA,WAAe,mBAAmB,KAAkB;AAAA;AA9QxD;AA+QQ,YAAM,cAAc,IAAI,QAAQ,IAAI,8BAA8B,OAAK,SAAI,QAAQ,IAAI,wBAAwB,MAAxC,mBAA2C;AAClH,UAAI,aAAa;AACb,cAAM,OAAO,GAAG;AAChB,cAAM,WAAW,MAAM,MAAM,MAAM;AAAA,UAC/B,SAAS;AAAA,YACL,gBAAgB;AAAA,YAChB,iBAAiB,YAAY;AAAA,UACjC;AAAA,QACJ,CAAC;AACD,YAAI,SAAS,IAAI;AACb,gBAAM,OAAO,MAAM,SAAS,KAAK;AAEjC,gBAAM,OAAO,IAAI;AAAA,YACb,KAAK;AAAA,YACL,KAAK;AAAA,YACL,uBAAuB,KAAK,kBAAkB;AAAA,YAC9C,KAAK;AAAA,YACL,KAAK;AAAA,YACL,KAAK;AAAA,YACL,KAAK;AAAA,YACL,KAAK;AAAA,UACT;AAEA,iBAAO,IAAI,SAAS,KAAK,UAAU,IAAI,GAAG;AAAA,YACtC,QAAQ;AAAA,YACR,SAAS;AAAA,cACL,gBAAgB;AAAA,YACpB;AAAA,UACJ,CAAC;AAAA,QACL,WAAW,SAAS,WAAW,KAAK;AAChC,iBAAO,IAAI,SAAS,MAAM,EAAE,QAAQ,IAAI,CAAC;AAAA,QAC7C,OAAO;AACH,iBAAO,IAAI,SAAS,MAAM,EAAE,QAAQ,IAAI,CAAC;AAAA,QAC7C;AAAA,MACJ;AACA,aAAO,IAAI,SAAS,MAAM,EAAE,QAAQ,IAAI,CAAC;AAAA,IAC7C;AAAA;AAEA,WAAe,sCAAsC,cAAqD;AAAA;AACtG,YAAM,OAAO;AAAA,QACT,eAAe;AAAA,MACnB;AACA,YAAM,MAAM,GAAG;AACf,YAAM,WAAW,MAAM,MAAM,KAAK;AAAA,QAC9B,QAAQ;AAAA,QACR,MAAM,KAAK,UAAU,IAAI;AAAA,QACzB,SAAS;AAAA,UACL,gBAAgB;AAAA,UAChB,eAAe,YAAY;AAAA,QAC/B;AAAA,MACJ,CAAC;AAED,UAAI,SAAS,IAAI;AACb,cAAM,OAAO,MAAM,SAAS,KAAK;AACjC,cAAM,kBAAkB,KAAK;AAC7B,cAAM;AAAA,UACF,cAAc;AAAA,UACd,oBAAoB;AAAA,QACxB,IAAI,KAAK;AAET,eAAO;AAAA,UACH,cAAc;AAAA,UACd;AAAA,UACA,OAAO;AAAA,QACX;AAAA,MACJ,WAAW,SAAS,WAAW,KAAK;AAChC,eAAO,EAAE,OAAO,eAAe;AAAA,MACnC,OAAO;AACH,eAAO,EAAE,OAAO,aAAa;AAAA,MACjC;AAAA,IACJ;AAAA;AAEA,WAAe,kBAAkB,KAAkB;AAAA;AAvVvD;AAwVQ,YAAM,iBAAgB,SAAI,QAAQ,IAAI,yBAAyB,MAAzC,mBAA4C;AAClE,UAAI,CAAC,eAAe;AAChB,cAAMA,WAAU,IAAI,QAAQ;AAC5B,QAAAA,SAAQ,OAAO,cAAc,GAAG,8EAA8E;AAC9G,QAAAA,SAAQ,OAAO,cAAc,GAAG,+EAA+E;AAC/G,eAAO,IAAI,SAAS,MAAM,EAAE,QAAQ,KAAK,SAAAA,SAAQ,CAAC;AAAA,MACtD;AAEA,YAAM,aAAa,EAAE,cAAc;AACnC,YAAM,MAAM,GAAG;AACf,YAAM,WAAW,MAAM,MAAM,KAAK;AAAA,QAC9B,QAAQ;AAAA,QACR,MAAM,KAAK,UAAU,UAAU;AAAA,QAC/B,SAAS;AAAA,UACL,gBAAgB;AAAA,UAChB,eAAe,YAAY;AAAA,QAC/B;AAAA,MACJ,CAAC;AAED,UAAI,CAAC,SAAS,IAAI;AACd,gBAAQ;AAAA,UACJ;AAAA,UACA,SAAS;AAAA,UACT,SAAS;AAAA,QACb;AAAA,MACJ;AACA,YAAMA,WAAU,IAAI,QAAQ;AAC5B,MAAAA,SAAQ,OAAO,cAAc,GAAG,8EAA8E;AAC9G,MAAAA,SAAQ,OAAO,cAAc,GAAG,+EAA+E;AAC/G,aAAO,IAAI,SAAS,MAAM,EAAE,QAAQ,KAAK,SAAAA,SAAQ,CAAC;AAAA,IACtD;AAAA;AAEA,WAAe,+BAA+B,aAA4D;AAAA;AACtG,UAAI;AACA,eAAO,MAAM,oBAAoB,WAAW;AAAA,MAChD,SAAS,KAAP;AACE,YAAI,eAAe,wBAAwB;AACvC,gBAAM;AAAA,QACV,WAAW,eAAe,uBAAuB;AAC7C,iBAAO;AAAA,QACX,OAAO;AACH,kBAAQ,IAAI,iCAAiC,GAAG;AAChD,iBAAO;AAAA,QACX;AAAA,MACJ;AAAA,IACJ;AAAA;AAEA,WAAe,oBAAoB,aAAgD;AAAA;AAC/E,UAAI;AACJ,UAAI;AACA,oBAAY,MAAM;AAAA,MACtB,SAAS,KAAP;AACE,gBAAQ,MAAM,wFAAwF,GAAG;AACzG,cAAM,IAAI,uBAAuB,sBAAsB;AAAA,MAC3D;AAEA,UAAI,CAAC,aAAa;AACd,cAAM,IAAI,sBAAsB,0BAA0B;AAAA,MAC9D;AAEA,UAAI,2BAA2B;AAC/B,UAAI,YAAY,YAAY,EAAE,WAAW,SAAS,GAAG;AACjD,mCAA2B,YAAY,UAAU,UAAU,MAAM;AAAA,MACrE;AAEA,UAAI;AACA,cAAM,EAAE,QAAQ,IAAI,MAAW,eAAU,0BAA0B,WAAW;AAAA,UAC1E,QAAQ;AAAA,UACR,YAAY,CAAC,OAAO;AAAA,QACxB,CAAC;AAED,eAAO,OAAqB,OAAO;AAAA,MACvC,SAAS,GAAP;AACE,YAAI,aAAa,OAAO;AACpB,gBAAM,IAAI,sBAAsB,EAAE,OAAO;AAAA,QAC7C,OAAO;AACH,gBAAM,IAAI,sBAAsB,sBAAsB;AAAA,QAC1D;AAAA,MACJ;AAAA,IACJ;AAAA;AAEA,SAAO;AAAA,IACH;AAAA,IACA;AAAA,IACA;AAAA,IACA;AAAA,IACA;AAAA,IACA;AAAA,IACA;AAAA,EACJ;AACJ;AAEA,SAAS,cAAsB;AAC3B,QAAM,cAAc,OAAO,gBAAgB,IAAI,WAAW,EAAE,CAAC;AAC7D,SAAO,MAAM,KAAK,WAAW,EACxB,IAAI,CAAC,MAAM,EAAE,SAAS,EAAE,EAAE,SAAS,GAAG,GAAG,CAAC,EAC1C,KAAK,EAAE;AAChB;;;AEzbO,SAAS,gBAAgB,SAAsB;AAClD,MAAI;AACA,WAAO,IAAI,IAAI,OAAO;AAAA,EAC1B,SAAS,GAAP;AACE,YAAQ,MAAM,mBAAmB,CAAC;AAClC,UAAM,IAAI,MAAM,kCAAkC;AAAA,EACtD;AACJ;;;ACKO,SAAS,eAAe,MAA6B;AACxD,QAAM,UAAU,gBAAgB,KAAK,OAAO,EAAE;AAC9C,QAAM,kBACF,KAAK,2BACL,WAAY;AACR,WAAO;AAAA,EACX;AAEJ,SAAO,iBAAiB;AAAA,IACpB,eAAe;AAAA,IACf,aAAa,KAAK;AAAA,IAClB,aAAa,KAAK;AAAA,IAClB,mBAAmB,KAAK;AAAA,IACxB;AAAA,EACJ,CAAC;AACL;","names":["headers","response"]}
1
+ {"version":3,"sources":["../../src/server/index.ts","../../src/user.ts","../../src/server/exceptions.ts","../../src/server/shared.ts"],"sourcesContent":["export {validateAccessToken, validateAccessTokenOrUndefined} from \"./shared\"\nexport type {OrgIdToOrgMemberInfo} from \"../user\"\nexport {User, OrgMemberInfo} from \"../user\"\nexport {UnauthorizedException, ConfigurationException} from \"./exceptions\"\n","export class User {\n public userId: string\n public orgIdToOrgMemberInfo?: OrgIdToOrgMemberInfo\n\n // Metadata about the user\n public email: string\n public firstName?: string\n public lastName?: string\n public username?: string\n\n // If you used our migration APIs to migrate this user from a different system,\n // this is their original ID from that system.\n public legacyUserId?: string\n public impersonatorUserId?: string\n\n constructor(\n userId: string,\n email: string,\n orgIdToOrgMemberInfo?: OrgIdToOrgMemberInfo,\n firstName?: string,\n lastName?: string,\n username?: string,\n legacyUserId?: string,\n impersonatorUserId?: string\n ) {\n this.userId = userId\n this.orgIdToOrgMemberInfo = orgIdToOrgMemberInfo\n\n this.email = email\n this.firstName = firstName\n this.lastName = lastName\n this.username = username\n\n this.legacyUserId = legacyUserId\n this.impersonatorUserId = impersonatorUserId\n }\n\n public getOrg(orgId: string): OrgMemberInfo | undefined {\n if (!this.orgIdToOrgMemberInfo) {\n return undefined\n }\n\n return this.orgIdToOrgMemberInfo[orgId]\n }\n\n public getOrgByName(orgName: string): OrgMemberInfo | undefined {\n if (!this.orgIdToOrgMemberInfo) {\n return undefined\n }\n\n const urlSafeOrgName = orgName.toLowerCase().replace(/ /g, \"-\")\n for (const orgId in this.orgIdToOrgMemberInfo) {\n const orgMemberInfo = this.orgIdToOrgMemberInfo[orgId]\n if (orgMemberInfo.urlSafeOrgName === urlSafeOrgName) {\n return orgMemberInfo\n }\n }\n\n return undefined\n }\n\n public getOrgs(): OrgMemberInfo[] {\n if (!this.orgIdToOrgMemberInfo) {\n return []\n }\n\n return Object.values(this.orgIdToOrgMemberInfo)\n }\n\n public isImpersonating(): boolean {\n return !!this.impersonatorUserId\n }\n\n public static fromJSON(json: string): User {\n const obj = JSON.parse(json)\n const orgIdToOrgMemberInfo: OrgIdToOrgMemberInfo = {}\n for (const orgId in obj.orgIdToOrgMemberInfo) {\n orgIdToOrgMemberInfo[orgId] = OrgMemberInfo.fromJSON(\n JSON.stringify(obj.orgIdToOrgMemberInfo[orgId])\n )\n }\n return new User(\n obj.userId,\n obj.email,\n orgIdToOrgMemberInfo,\n obj.firstName,\n obj.lastName,\n obj.username,\n obj.legacyUserId,\n obj.impersonatorUserId\n )\n }\n}\n\nexport type OrgIdToOrgMemberInfo = {\n [orgId: string]: OrgMemberInfo\n}\n\nexport class OrgMemberInfo {\n public orgId: string\n public orgName: string\n public orgMetadata: { [key: string]: any }\n public urlSafeOrgName: string\n\n private userAssignedRole: string\n private userInheritedRolesPlusCurrentRole: string[]\n private userPermissions: string[]\n\n constructor(\n orgId: string,\n orgName: string,\n orgMetadata: { [key: string]: any },\n urlSafeOrgName: string,\n userAssignedRole: string,\n userInheritedRolesPlusCurrentRole: string[],\n userPermissions: string[]\n ) {\n this.orgId = orgId\n this.orgName = orgName\n this.orgMetadata = orgMetadata\n this.urlSafeOrgName = urlSafeOrgName\n\n this.userAssignedRole = userAssignedRole\n this.userInheritedRolesPlusCurrentRole = userInheritedRolesPlusCurrentRole\n this.userPermissions = userPermissions\n }\n\n // validation methods\n\n public isRole(role: string): boolean {\n return this.userAssignedRole === role\n }\n\n public isAtLeastRole(role: string): boolean {\n return this.userInheritedRolesPlusCurrentRole.includes(role)\n }\n\n public hasPermission(permission: string): boolean {\n return this.userPermissions.includes(permission)\n }\n\n public hasAllPermissions(permissions: string[]): boolean {\n return permissions.every((permission) => this.hasPermission(permission))\n }\n\n public static fromJSON(json: string): OrgMemberInfo {\n const obj = JSON.parse(json)\n return new OrgMemberInfo(\n obj.orgId,\n obj.orgName,\n obj.orgMetadata,\n obj.urlSafeOrgName,\n obj.userAssignedRole,\n obj.userInheritedRolesPlusCurrentRole,\n obj.userPermissions\n )\n }\n\n // getters for the private fields\n\n get assignedRole(): string {\n return this.userAssignedRole\n }\n\n get inheritedRolesPlusCurrentRole(): string[] {\n return this.userInheritedRolesPlusCurrentRole\n }\n\n get permissions(): string[] {\n return this.userPermissions\n }\n}\n\n// These Internal types exist since the server returns snake case, but typescript/javascript\n// convention is camelCase.\nexport type InternalOrgMemberInfo = {\n org_id: string\n org_name: string\n org_metadata: { [key: string]: any }\n url_safe_org_name: string\n user_role: string\n inherited_user_roles_plus_current_role: string[]\n user_permissions: string[]\n}\nexport type InternalUser = {\n user_id: string\n org_id_to_org_member_info?: { [org_id: string]: InternalOrgMemberInfo }\n\n email: string\n first_name?: string\n last_name?: string\n username?: string\n\n // If you used our migration APIs to migrate this user from a different system, this is their original ID from that system.\n legacy_user_id?: string\n impersonatorUserId?: string\n}\n\nexport function toUser(snake_case: InternalUser): User {\n return new User(\n snake_case.user_id,\n snake_case.email,\n toOrgIdToOrgMemberInfo(snake_case.org_id_to_org_member_info),\n snake_case.first_name,\n snake_case.last_name,\n snake_case.username,\n snake_case.legacy_user_id,\n snake_case.impersonatorUserId\n )\n}\n\nexport function toOrgIdToOrgMemberInfo(snake_case?: {\n [org_id: string]: InternalOrgMemberInfo\n}): OrgIdToOrgMemberInfo | undefined {\n if (snake_case === undefined) {\n return undefined\n }\n const camelCase: OrgIdToOrgMemberInfo = {}\n\n for (const key of Object.keys(snake_case)) {\n const snakeCaseValue = snake_case[key]\n if (snakeCaseValue) {\n camelCase[key] = new OrgMemberInfo(\n snakeCaseValue.org_id,\n snakeCaseValue.org_name,\n snakeCaseValue.org_metadata,\n snakeCaseValue.url_safe_org_name,\n snakeCaseValue.user_role,\n snakeCaseValue.inherited_user_roles_plus_current_role,\n snakeCaseValue.user_permissions\n )\n }\n }\n\n return camelCase\n}\n","export class UnauthorizedException extends Error {\n readonly message: string\n readonly status: number\n\n constructor(message: string) {\n super(message)\n this.message = message\n this.status = 401\n }\n}\n\nexport class ConfigurationException extends Error {\n readonly message: string\n readonly status: number\n\n constructor(message: string) {\n super(message)\n this.message = message\n this.status = 500\n }\n}\n","import {ResponseCookie} from \"next/dist/compiled/@edge-runtime/cookies\";\nimport {InternalUser, toUser, User} from \"../user\";\nimport {ConfigurationException, UnauthorizedException} from \"./exceptions\";\nimport * as jose from \"jose\";\n\ntype RefreshAndAccessTokens = {\n refreshToken: string\n accessToken: string\n error: \"none\"\n}\n\ntype RefreshAndAccessTokensUnauthorizedError = {\n error: \"unauthorized\"\n}\n\ntype RefreshAndAccessTokensUnexpectedError = {\n error: \"unexpected\"\n}\n\nexport type RefreshTokenResponse =\n RefreshAndAccessTokens\n | RefreshAndAccessTokensUnauthorizedError\n | RefreshAndAccessTokensUnexpectedError\n\nexport const LOGIN_PATH = \"/api/auth/login\"\nexport const CALLBACK_PATH = \"/api/auth/callback\"\nexport const USERINFO_PATH = \"/api/auth/userinfo\"\nexport const LOGOUT_PATH = \"/api/auth/logout\"\nexport const ACCESS_TOKEN_COOKIE_NAME = \"__pa_at\"\nexport const REFRESH_TOKEN_COOKIE_NAME = \"__pa_rt\"\nexport const STATE_COOKIE_NAME = \"__pa_state\"\nexport const CUSTOM_HEADER_FOR_ACCESS_TOKEN = \"x-propelauth-access-token\"\n\nexport const COOKIE_OPTIONS: Partial<ResponseCookie> = {\n httpOnly: true,\n sameSite: \"lax\",\n secure: true,\n path: \"/\",\n}\n\nexport function getAuthUrlOrigin() {\n const authUrl = process.env.NEXT_PUBLIC_AUTH_URL\n if (!authUrl) {\n throw new Error(\"NEXT_PUBLIC_AUTH_URL is not set\")\n }\n return new URL(authUrl).origin\n}\n\nexport function getRedirectUri() {\n const redirectUri = process.env.REDIRECT_URI\n if (!redirectUri) {\n throw new Error(\"REDIRECT_URI is not set\")\n }\n return redirectUri\n}\n\nexport function getIntegrationApiKey() {\n const integrationApiKey = process.env.PROPELAUTH_API_KEY\n if (!integrationApiKey) {\n throw new Error(\"PROPELAUTH_API_KEY is not set\")\n }\n return integrationApiKey\n}\n\nexport function getVerifierKey() {\n const verifierKey = process.env.VERIFIER_KEY\n if (!verifierKey) {\n throw new Error(\"VERIFIER_KEY is not set\")\n }\n return verifierKey.replace(/\\\\n/g, \"\\n\")\n}\n\nexport async function refreshTokenWithAccessAndRefreshToken(refreshToken: string): Promise<RefreshTokenResponse> {\n const body = {\n refresh_token: refreshToken,\n }\n const url = `${getAuthUrlOrigin()}/api/backend/v1/refresh_token`\n const response = await fetch(url, {\n method: \"POST\",\n body: JSON.stringify(body),\n headers: {\n \"Content-Type\": \"application/json\",\n Authorization: \"Bearer \" + getIntegrationApiKey(),\n },\n })\n\n if (response.ok) {\n const data = await response.json()\n const newRefreshToken = data.refresh_token\n const {\n access_token: accessToken,\n expires_at_seconds: expiresAtSeconds,\n } = data.access_token\n\n return {\n refreshToken: newRefreshToken,\n accessToken,\n error: \"none\",\n }\n } else if (response.status === 400) {\n return {error: \"unauthorized\"}\n } else {\n return {error: \"unexpected\"}\n }\n}\n\nexport async function validateAccessTokenOrUndefined(accessToken: string | undefined): Promise<User | undefined> {\n try {\n return await validateAccessToken(accessToken)\n } catch (err) {\n if (err instanceof ConfigurationException) {\n throw err\n } else if (err instanceof UnauthorizedException) {\n return undefined\n } else {\n console.log(\"Error validating access token\", err)\n return undefined\n }\n }\n}\n\nexport async function validateAccessToken(accessToken: string | undefined): Promise<User> {\n let publicKey\n try {\n publicKey = await jose.importSPKI(getVerifierKey(), \"RS256\")\n } catch (err) {\n console.error(\"Verifier key is invalid. Make sure it's specified correctly, including the newlines.\", err)\n throw new ConfigurationException(\"Invalid verifier key\")\n }\n\n if (!accessToken) {\n throw new UnauthorizedException(\"No access token provided\")\n }\n\n let accessTokenWithoutBearer = accessToken\n if (accessToken.toLowerCase().startsWith(\"bearer \")) {\n accessTokenWithoutBearer = accessToken.substring(\"bearer \".length)\n }\n\n try {\n const {payload} = await jose.jwtVerify(accessTokenWithoutBearer, publicKey, {\n issuer: getAuthUrlOrigin(),\n algorithms: [\"RS256\"],\n })\n\n return toUser(<InternalUser>payload)\n } catch (e) {\n if (e instanceof Error) {\n throw new UnauthorizedException(e.message)\n } else {\n throw new UnauthorizedException(\"Unable to decode jwt\")\n }\n }\n}\n"],"mappings":";;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;;;ACAO,IAAM,OAAN,MAAW;AAAA,EAed,YACI,QACA,OACA,sBACA,WACA,UACA,UACA,cACA,oBACF;AACE,SAAK,SAAS;AACd,SAAK,uBAAuB;AAE5B,SAAK,QAAQ;AACb,SAAK,YAAY;AACjB,SAAK,WAAW;AAChB,SAAK,WAAW;AAEhB,SAAK,eAAe;AACpB,SAAK,qBAAqB;AAAA,EAC9B;AAAA,EAEO,OAAO,OAA0C;AACpD,QAAI,CAAC,KAAK,sBAAsB;AAC5B,aAAO;AAAA,IACX;AAEA,WAAO,KAAK,qBAAqB,KAAK;AAAA,EAC1C;AAAA,EAEO,aAAa,SAA4C;AAC5D,QAAI,CAAC,KAAK,sBAAsB;AAC5B,aAAO;AAAA,IACX;AAEA,UAAM,iBAAiB,QAAQ,YAAY,EAAE,QAAQ,MAAM,GAAG;AAC9D,eAAW,SAAS,KAAK,sBAAsB;AAC3C,YAAM,gBAAgB,KAAK,qBAAqB,KAAK;AACrD,UAAI,cAAc,mBAAmB,gBAAgB;AACjD,eAAO;AAAA,MACX;AAAA,IACJ;AAEA,WAAO;AAAA,EACX;AAAA,EAEO,UAA2B;AAC9B,QAAI,CAAC,KAAK,sBAAsB;AAC5B,aAAO,CAAC;AAAA,IACZ;AAEA,WAAO,OAAO,OAAO,KAAK,oBAAoB;AAAA,EAClD;AAAA,EAEO,kBAA2B;AAC9B,WAAO,CAAC,CAAC,KAAK;AAAA,EAClB;AAAA,EAEA,OAAc,SAAS,MAAoB;AACvC,UAAM,MAAM,KAAK,MAAM,IAAI;AAC3B,UAAM,uBAA6C,CAAC;AACpD,eAAW,SAAS,IAAI,sBAAsB;AAC1C,2BAAqB,KAAK,IAAI,cAAc;AAAA,QACxC,KAAK,UAAU,IAAI,qBAAqB,KAAK,CAAC;AAAA,MAClD;AAAA,IACJ;AACA,WAAO,IAAI;AAAA,MACP,IAAI;AAAA,MACJ,IAAI;AAAA,MACJ;AAAA,MACA,IAAI;AAAA,MACJ,IAAI;AAAA,MACJ,IAAI;AAAA,MACJ,IAAI;AAAA,MACJ,IAAI;AAAA,IACR;AAAA,EACJ;AACJ;AAMO,IAAM,gBAAN,MAAoB;AAAA,EAUvB,YACI,OACA,SACA,aACA,gBACA,kBACA,mCACA,iBACF;AACE,SAAK,QAAQ;AACb,SAAK,UAAU;AACf,SAAK,cAAc;AACnB,SAAK,iBAAiB;AAEtB,SAAK,mBAAmB;AACxB,SAAK,oCAAoC;AACzC,SAAK,kBAAkB;AAAA,EAC3B;AAAA;AAAA,EAIO,OAAO,MAAuB;AACjC,WAAO,KAAK,qBAAqB;AAAA,EACrC;AAAA,EAEO,cAAc,MAAuB;AACxC,WAAO,KAAK,kCAAkC,SAAS,IAAI;AAAA,EAC/D;AAAA,EAEO,cAAc,YAA6B;AAC9C,WAAO,KAAK,gBAAgB,SAAS,UAAU;AAAA,EACnD;AAAA,EAEO,kBAAkB,aAAgC;AACrD,WAAO,YAAY,MAAM,CAAC,eAAe,KAAK,cAAc,UAAU,CAAC;AAAA,EAC3E;AAAA,EAEA,OAAc,SAAS,MAA6B;AAChD,UAAM,MAAM,KAAK,MAAM,IAAI;AAC3B,WAAO,IAAI;AAAA,MACP,IAAI;AAAA,MACJ,IAAI;AAAA,MACJ,IAAI;AAAA,MACJ,IAAI;AAAA,MACJ,IAAI;AAAA,MACJ,IAAI;AAAA,MACJ,IAAI;AAAA,IACR;AAAA,EACJ;AAAA;AAAA,EAIA,IAAI,eAAuB;AACvB,WAAO,KAAK;AAAA,EAChB;AAAA,EAEA,IAAI,gCAA0C;AAC1C,WAAO,KAAK;AAAA,EAChB;AAAA,EAEA,IAAI,cAAwB;AACxB,WAAO,KAAK;AAAA,EAChB;AACJ;AA2BO,SAAS,OAAO,YAAgC;AACnD,SAAO,IAAI;AAAA,IACP,WAAW;AAAA,IACX,WAAW;AAAA,IACX,uBAAuB,WAAW,yBAAyB;AAAA,IAC3D,WAAW;AAAA,IACX,WAAW;AAAA,IACX,WAAW;AAAA,IACX,WAAW;AAAA,IACX,WAAW;AAAA,EACf;AACJ;AAEO,SAAS,uBAAuB,YAEF;AACjC,MAAI,eAAe,QAAW;AAC1B,WAAO;AAAA,EACX;AACA,QAAM,YAAkC,CAAC;AAEzC,aAAW,OAAO,OAAO,KAAK,UAAU,GAAG;AACvC,UAAM,iBAAiB,WAAW,GAAG;AACrC,QAAI,gBAAgB;AAChB,gBAAU,GAAG,IAAI,IAAI;AAAA,QACjB,eAAe;AAAA,QACf,eAAe;AAAA,QACf,eAAe;AAAA,QACf,eAAe;AAAA,QACf,eAAe;AAAA,QACf,eAAe;AAAA,QACf,eAAe;AAAA,MACnB;AAAA,IACJ;AAAA,EACJ;AAEA,SAAO;AACX;;;AC3OO,IAAM,wBAAN,cAAoC,MAAM;AAAA,EAI7C,YAAY,SAAiB;AACzB,UAAM,OAAO;AACb,SAAK,UAAU;AACf,SAAK,SAAS;AAAA,EAClB;AACJ;AAEO,IAAM,yBAAN,cAAqC,MAAM;AAAA,EAI9C,YAAY,SAAiB;AACzB,UAAM,OAAO;AACb,SAAK,UAAU;AACf,SAAK,SAAS;AAAA,EAClB;AACJ;;;ACjBA,WAAsB;AAqCf,SAAS,mBAAmB;AAC/B,QAAM,UAAU,QAAQ,IAAI;AAC5B,MAAI,CAAC,SAAS;AACV,UAAM,IAAI,MAAM,iCAAiC;AAAA,EACrD;AACA,SAAO,IAAI,IAAI,OAAO,EAAE;AAC5B;AAkBO,SAAS,iBAAiB;AAC7B,QAAM,cAAc,QAAQ,IAAI;AAChC,MAAI,CAAC,aAAa;AACd,UAAM,IAAI,MAAM,yBAAyB;AAAA,EAC7C;AACA,SAAO,YAAY,QAAQ,QAAQ,IAAI;AAC3C;AAoCA,SAAsB,+BAA+B,aAA4D;AAAA;AAC7G,QAAI;AACA,aAAO,MAAM,oBAAoB,WAAW;AAAA,IAChD,SAAS,KAAP;AACE,UAAI,eAAe,wBAAwB;AACvC,cAAM;AAAA,MACV,WAAW,eAAe,uBAAuB;AAC7C,eAAO;AAAA,MACX,OAAO;AACH,gBAAQ,IAAI,iCAAiC,GAAG;AAChD,eAAO;AAAA,MACX;AAAA,IACJ;AAAA,EACJ;AAAA;AAEA,SAAsB,oBAAoB,aAAgD;AAAA;AACtF,QAAI;AACJ,QAAI;AACA,kBAAY,MAAW,gBAAW,eAAe,GAAG,OAAO;AAAA,IAC/D,SAAS,KAAP;AACE,cAAQ,MAAM,wFAAwF,GAAG;AACzG,YAAM,IAAI,uBAAuB,sBAAsB;AAAA,IAC3D;AAEA,QAAI,CAAC,aAAa;AACd,YAAM,IAAI,sBAAsB,0BAA0B;AAAA,IAC9D;AAEA,QAAI,2BAA2B;AAC/B,QAAI,YAAY,YAAY,EAAE,WAAW,SAAS,GAAG;AACjD,iCAA2B,YAAY,UAAU,UAAU,MAAM;AAAA,IACrE;AAEA,QAAI;AACA,YAAM,EAAC,QAAO,IAAI,MAAW,eAAU,0BAA0B,WAAW;AAAA,QACxE,QAAQ,iBAAiB;AAAA,QACzB,YAAY,CAAC,OAAO;AAAA,MACxB,CAAC;AAED,aAAO,OAAqB,OAAO;AAAA,IACvC,SAAS,GAAP;AACE,UAAI,aAAa,OAAO;AACpB,cAAM,IAAI,sBAAsB,EAAE,OAAO;AAAA,MAC7C,OAAO;AACH,cAAM,IAAI,sBAAsB,sBAAsB;AAAA,MAC1D;AAAA,IACJ;AAAA,EACJ;AAAA;","names":[]}
@@ -19,27 +19,6 @@ var __async = (__this, __arguments, generator) => {
19
19
  });
20
20
  };
21
21
 
22
- // src/server/exceptions.ts
23
- var UnauthorizedException = class extends Error {
24
- constructor(message) {
25
- super(message);
26
- this.message = message;
27
- this.status = 401;
28
- }
29
- };
30
- var ConfigurationException = class extends Error {
31
- constructor(message) {
32
- super(message);
33
- this.message = message;
34
- this.status = 500;
35
- }
36
- };
37
-
38
- // src/server/server-actions.ts
39
- import * as jose from "jose";
40
- import { cookies, headers } from "next/headers";
41
- import { redirect } from "next/navigation";
42
-
43
22
  // src/user.ts
44
23
  var User = class {
45
24
  constructor(userId, email, orgIdToOrgMemberInfo, firstName, lastName, username, legacyUserId, impersonatorUserId) {
@@ -180,405 +159,91 @@ function toOrgIdToOrgMemberInfo(snake_case) {
180
159
  return camelCase;
181
160
  }
182
161
 
183
- // src/server/server-actions.ts
184
- import { NextResponse } from "next/server";
185
- var LOGIN_PATH = "/api/auth/login";
186
- var CALLBACK_PATH = "/api/auth/callback";
187
- var USERINFO_PATH = "/api/auth/userinfo";
188
- var LOGOUT_PATH = "/api/auth/logout";
189
- var ACCESS_TOKEN_COOKIE_NAME = "__pa_at";
190
- var REFRESH_TOKEN_COOKIE_NAME = "__pa_rt";
191
- var STATE_COOKIE_NAME = "__pa_state";
192
- var CUSTOM_HEADER_FOR_ACCESS_TOKEN = "x-propelauth-access-token";
193
- var COOKIE_OPTIONS = {
194
- httpOnly: true,
195
- sameSite: "lax",
196
- secure: true,
197
- path: "/"
198
- };
199
- function getServerActions({
200
- authUrlOrigin,
201
- postLoginPathFn,
202
- verifierKey,
203
- integrationApiKey,
204
- redirectUri
205
- }) {
206
- const publicKeyPromise = jose.importSPKI(verifierKey, "RS256");
207
- function getUserOrRedirect() {
208
- return __async(this, null, function* () {
209
- const user = yield getUser();
210
- if (user) {
211
- return user;
212
- } else {
213
- redirect(LOGIN_PATH);
214
- throw new Error("Redirecting to login");
215
- }
216
- });
217
- }
218
- function getUser() {
219
- return __async(this, null, function* () {
220
- var _a;
221
- const accessToken = headers().get(CUSTOM_HEADER_FOR_ACCESS_TOKEN) || ((_a = cookies().get(ACCESS_TOKEN_COOKIE_NAME)) == null ? void 0 : _a.value);
222
- if (accessToken) {
223
- const user = yield validateAccessTokenOrUndefined(accessToken);
224
- if (user) {
225
- return user;
226
- }
227
- }
228
- return void 0;
229
- });
230
- }
231
- function authMiddleware(req) {
232
- return __async(this, null, function* () {
233
- var _a, _b;
234
- if (req.headers.has(CUSTOM_HEADER_FOR_ACCESS_TOKEN)) {
235
- throw new Error(`${CUSTOM_HEADER_FOR_ACCESS_TOKEN} is set which is for internal use only`);
236
- } else if (req.nextUrl.pathname === CALLBACK_PATH || req.nextUrl.pathname === LOGOUT_PATH) {
237
- return NextResponse.next();
238
- }
239
- const accessToken = (_a = req.cookies.get(ACCESS_TOKEN_COOKIE_NAME)) == null ? void 0 : _a.value;
240
- const refreshToken = (_b = req.cookies.get(REFRESH_TOKEN_COOKIE_NAME)) == null ? void 0 : _b.value;
241
- if (req.nextUrl.pathname === USERINFO_PATH && refreshToken) {
242
- const response = yield refreshTokenWithAccessAndRefreshToken(refreshToken);
243
- if (response.error === "unexpected") {
244
- throw new Error("Unexpected error while refreshing access token");
245
- } else if (response.error === "unauthorized") {
246
- const headers2 = new Headers();
247
- headers2.append("Set-Cookie", `${ACCESS_TOKEN_COOKIE_NAME}=; Path=/; HttpOnly; Secure; SameSite=Lax; Max-Age=0`);
248
- headers2.append("Set-Cookie", `${REFRESH_TOKEN_COOKIE_NAME}=; Path=/; HttpOnly; Secure; SameSite=Lax; Max-Age=0`);
249
- return new Response("Unauthorized", { status: 401, headers: headers2 });
250
- } else {
251
- const headers2 = new Headers(req.headers);
252
- headers2.append(CUSTOM_HEADER_FOR_ACCESS_TOKEN, response.accessToken);
253
- const nextResponse = NextResponse.next({
254
- request: {
255
- headers: headers2
256
- }
257
- });
258
- nextResponse.cookies.set(ACCESS_TOKEN_COOKIE_NAME, response.accessToken, COOKIE_OPTIONS);
259
- nextResponse.cookies.set(REFRESH_TOKEN_COOKIE_NAME, response.refreshToken, COOKIE_OPTIONS);
260
- return nextResponse;
261
- }
262
- }
263
- if (accessToken) {
264
- const user = yield validateAccessTokenOrUndefined(accessToken);
265
- if (user) {
266
- return NextResponse.next();
267
- }
268
- }
269
- if (refreshToken) {
270
- const response = yield refreshTokenWithAccessAndRefreshToken(refreshToken);
271
- if (response.error === "unexpected") {
272
- throw new Error("Unexpected error while refreshing access token");
273
- } else if (response.error === "unauthorized") {
274
- const response2 = NextResponse.next();
275
- response2.cookies.delete(ACCESS_TOKEN_COOKIE_NAME);
276
- response2.cookies.delete(REFRESH_TOKEN_COOKIE_NAME);
277
- return response2;
278
- } else {
279
- const headers2 = new Headers(req.headers);
280
- headers2.append(CUSTOM_HEADER_FOR_ACCESS_TOKEN, response.accessToken);
281
- const nextResponse = NextResponse.next({
282
- request: {
283
- headers: headers2
284
- }
285
- });
286
- nextResponse.cookies.set(ACCESS_TOKEN_COOKIE_NAME, response.accessToken, COOKIE_OPTIONS);
287
- nextResponse.cookies.set(REFRESH_TOKEN_COOKIE_NAME, response.refreshToken, COOKIE_OPTIONS);
288
- return nextResponse;
289
- }
290
- }
291
- return NextResponse.next();
292
- });
293
- }
294
- function getRouteHandler(req, { params }) {
295
- if (params.slug === "login") {
296
- return loginGetHandler();
297
- } else if (params.slug === "signup") {
298
- return signupGetHandler();
299
- } else if (params.slug === "callback") {
300
- return callbackGetHandler(req);
301
- } else if (params.slug === "userinfo") {
302
- return userinfoGetHandler(req);
303
- } else {
304
- return new Response("", { status: 404 });
305
- }
162
+ // src/server/exceptions.ts
163
+ var UnauthorizedException = class extends Error {
164
+ constructor(message) {
165
+ super(message);
166
+ this.message = message;
167
+ this.status = 401;
306
168
  }
307
- function postRouteHandler(req, { params }) {
308
- if (params.slug === "logout") {
309
- return logoutPostHandler(req);
310
- } else {
311
- return new Response("", { status: 404 });
312
- }
169
+ };
170
+ var ConfigurationException = class extends Error {
171
+ constructor(message) {
172
+ super(message);
173
+ this.message = message;
174
+ this.status = 500;
313
175
  }
314
- function loginGetHandler() {
315
- const state = randomState();
316
- const authorize_url = authUrlOrigin + "/propelauth/ssr/authorize?redirect_uri=" + redirectUri + "&state=" + state;
317
- return new Response(null, {
318
- status: 302,
319
- headers: {
320
- Location: authorize_url,
321
- "Set-Cookie": `${STATE_COOKIE_NAME}=${state}; Path=/; HttpOnly; Secure; SameSite=Lax`
322
- }
323
- });
176
+ };
177
+
178
+ // src/server/shared.ts
179
+ import * as jose from "jose";
180
+ function getAuthUrlOrigin() {
181
+ const authUrl = process.env.NEXT_PUBLIC_AUTH_URL;
182
+ if (!authUrl) {
183
+ throw new Error("NEXT_PUBLIC_AUTH_URL is not set");
324
184
  }
325
- function signupGetHandler() {
326
- const state = randomState();
327
- const authorize_url = authUrlOrigin + "/propelauth/ssr/authorize?redirect_uri=" + redirectUri + "&state=" + state + "&signup=true";
328
- return new Response(null, {
329
- status: 302,
330
- headers: {
331
- Location: authorize_url,
332
- "Set-Cookie": `${STATE_COOKIE_NAME}=${state}; Path=/; HttpOnly; Secure; SameSite=Lax`
333
- }
334
- });
185
+ return new URL(authUrl).origin;
186
+ }
187
+ function getVerifierKey() {
188
+ const verifierKey = process.env.VERIFIER_KEY;
189
+ if (!verifierKey) {
190
+ throw new Error("VERIFIER_KEY is not set");
335
191
  }
336
- function callbackGetHandler(req) {
337
- return __async(this, null, function* () {
338
- var _a;
339
- const oauthState = (_a = req.cookies.get(STATE_COOKIE_NAME)) == null ? void 0 : _a.value;
340
- if (!oauthState || oauthState.length !== 64) {
341
- console.log("No oauth state found");
342
- return new Response(null, { status: 302, headers: { Location: LOGIN_PATH } });
343
- }
344
- const queryParams = req.nextUrl.searchParams;
345
- const state = queryParams.get("state");
346
- const code = queryParams.get("code");
347
- if (state !== oauthState) {
348
- console.log("Mismatch between states, redirecting to login");
349
- return new Response(null, { status: 302, headers: { Location: LOGIN_PATH } });
350
- }
351
- const oauth_token_body = {
352
- redirect_uri: redirectUri,
353
- code
354
- };
355
- const url = `${authUrlOrigin}/propelauth/ssr/token`;
356
- const response = yield fetch(url, {
357
- method: "POST",
358
- body: JSON.stringify(oauth_token_body),
359
- headers: {
360
- "Content-Type": "application/json",
361
- Authorization: "Bearer " + integrationApiKey
362
- }
363
- });
364
- if (response.ok) {
365
- const data = yield response.json();
366
- const accessToken = data.access_token;
367
- const user = yield validateAccessToken(accessToken);
368
- const path = postLoginPathFn(user);
369
- if (!path) {
370
- console.log("postLoginPathFn returned undefined");
371
- return new Response("Unexpected error", { status: 500 });
372
- }
373
- const headers2 = new Headers();
374
- headers2.append("Location", path);
375
- headers2.append("Set-Cookie", `${ACCESS_TOKEN_COOKIE_NAME}=${accessToken}; Path=/; HttpOnly; Secure; SameSite=Lax`);
376
- headers2.append("Set-Cookie", `${REFRESH_TOKEN_COOKIE_NAME}=${data.refresh_token}; Path=/; HttpOnly; Secure; SameSite=Lax`);
377
- return new Response(null, {
378
- status: 302,
379
- headers: headers2
380
- });
381
- } else if (response.status === 401) {
382
- return new Response("Unexpected error", { status: 500 });
192
+ return verifierKey.replace(/\\n/g, "\n");
193
+ }
194
+ function validateAccessTokenOrUndefined(accessToken) {
195
+ return __async(this, null, function* () {
196
+ try {
197
+ return yield validateAccessToken(accessToken);
198
+ } catch (err) {
199
+ if (err instanceof ConfigurationException) {
200
+ throw err;
201
+ } else if (err instanceof UnauthorizedException) {
202
+ return void 0;
383
203
  } else {
384
- return new Response("Unexpected error", { status: 500 });
204
+ console.log("Error validating access token", err);
205
+ return void 0;
385
206
  }
386
- });
387
- }
388
- function userinfoGetHandler(req) {
389
- return __async(this, null, function* () {
390
- var _a;
391
- const accessToken = req.headers.get(CUSTOM_HEADER_FOR_ACCESS_TOKEN) || ((_a = req.cookies.get(ACCESS_TOKEN_COOKIE_NAME)) == null ? void 0 : _a.value);
392
- if (accessToken) {
393
- const path = `${authUrlOrigin}/propelauth/oauth/userinfo`;
394
- const response = yield fetch(path, {
395
- headers: {
396
- "Content-Type": "application/json",
397
- "Authorization": "Bearer " + accessToken
398
- }
399
- });
400
- if (response.ok) {
401
- const data = yield response.json();
402
- const user = new User(
403
- data.user_id,
404
- data.email,
405
- toOrgIdToOrgMemberInfo(data.org_id_to_org_info),
406
- data.first_name,
407
- data.last_name,
408
- data.username,
409
- data.legacy_user_id,
410
- data.impersonator_user_id
411
- );
412
- return new Response(JSON.stringify(user), {
413
- status: 200,
414
- headers: {
415
- "Content-Type": "application/json"
416
- }
417
- });
418
- } else if (response.status === 401) {
419
- return new Response(null, { status: 401 });
420
- } else {
421
- return new Response(null, { status: 500 });
422
- }
423
- }
424
- return new Response(null, { status: 401 });
425
- });
426
- }
427
- function refreshTokenWithAccessAndRefreshToken(refreshToken) {
428
- return __async(this, null, function* () {
429
- const body = {
430
- refresh_token: refreshToken
431
- };
432
- const url = `${authUrlOrigin}/api/backend/v1/refresh_token`;
433
- const response = yield fetch(url, {
434
- method: "POST",
435
- body: JSON.stringify(body),
436
- headers: {
437
- "Content-Type": "application/json",
438
- Authorization: "Bearer " + integrationApiKey
439
- }
207
+ }
208
+ });
209
+ }
210
+ function validateAccessToken(accessToken) {
211
+ return __async(this, null, function* () {
212
+ let publicKey;
213
+ try {
214
+ publicKey = yield jose.importSPKI(getVerifierKey(), "RS256");
215
+ } catch (err) {
216
+ console.error("Verifier key is invalid. Make sure it's specified correctly, including the newlines.", err);
217
+ throw new ConfigurationException("Invalid verifier key");
218
+ }
219
+ if (!accessToken) {
220
+ throw new UnauthorizedException("No access token provided");
221
+ }
222
+ let accessTokenWithoutBearer = accessToken;
223
+ if (accessToken.toLowerCase().startsWith("bearer ")) {
224
+ accessTokenWithoutBearer = accessToken.substring("bearer ".length);
225
+ }
226
+ try {
227
+ const { payload } = yield jose.jwtVerify(accessTokenWithoutBearer, publicKey, {
228
+ issuer: getAuthUrlOrigin(),
229
+ algorithms: ["RS256"]
440
230
  });
441
- if (response.ok) {
442
- const data = yield response.json();
443
- const newRefreshToken = data.refresh_token;
444
- const {
445
- access_token: accessToken,
446
- expires_at_seconds: expiresAtSeconds
447
- } = data.access_token;
448
- return {
449
- refreshToken: newRefreshToken,
450
- accessToken,
451
- error: "none"
452
- };
453
- } else if (response.status === 400) {
454
- return { error: "unauthorized" };
231
+ return toUser(payload);
232
+ } catch (e) {
233
+ if (e instanceof Error) {
234
+ throw new UnauthorizedException(e.message);
455
235
  } else {
456
- return { error: "unexpected" };
457
- }
458
- });
459
- }
460
- function logoutPostHandler(req) {
461
- return __async(this, null, function* () {
462
- var _a;
463
- const refresh_token = (_a = req.cookies.get(REFRESH_TOKEN_COOKIE_NAME)) == null ? void 0 : _a.value;
464
- if (!refresh_token) {
465
- const headers3 = new Headers();
466
- headers3.append("Set-Cookie", `${ACCESS_TOKEN_COOKIE_NAME}=; Path=/; HttpOnly; Secure; SameSite=Lax; Max-Age=0`);
467
- headers3.append("Set-Cookie", `${REFRESH_TOKEN_COOKIE_NAME}=; Path=/; HttpOnly; Secure; SameSite=Lax; Max-Age=0`);
468
- return new Response(null, { status: 200, headers: headers3 });
236
+ throw new UnauthorizedException("Unable to decode jwt");
469
237
  }
470
- const logoutBody = { refresh_token };
471
- const url = `${authUrlOrigin}/api/backend/v1/logout`;
472
- const response = yield fetch(url, {
473
- method: "POST",
474
- body: JSON.stringify(logoutBody),
475
- headers: {
476
- "Content-Type": "application/json",
477
- Authorization: "Bearer " + integrationApiKey
478
- }
479
- });
480
- if (!response.ok) {
481
- console.log(
482
- "Unable to logout, clearing cookies and continuing anyway",
483
- response.status,
484
- response.statusText
485
- );
486
- }
487
- const headers2 = new Headers();
488
- headers2.append("Set-Cookie", `${ACCESS_TOKEN_COOKIE_NAME}=; Path=/; HttpOnly; Secure; SameSite=Lax; Max-Age=0`);
489
- headers2.append("Set-Cookie", `${REFRESH_TOKEN_COOKIE_NAME}=; Path=/; HttpOnly; Secure; SameSite=Lax; Max-Age=0`);
490
- return new Response(null, { status: 200, headers: headers2 });
491
- });
492
- }
493
- function validateAccessTokenOrUndefined(accessToken) {
494
- return __async(this, null, function* () {
495
- try {
496
- return yield validateAccessToken(accessToken);
497
- } catch (err) {
498
- if (err instanceof ConfigurationException) {
499
- throw err;
500
- } else if (err instanceof UnauthorizedException) {
501
- return void 0;
502
- } else {
503
- console.log("Error validating access token", err);
504
- return void 0;
505
- }
506
- }
507
- });
508
- }
509
- function validateAccessToken(accessToken) {
510
- return __async(this, null, function* () {
511
- let publicKey;
512
- try {
513
- publicKey = yield publicKeyPromise;
514
- } catch (err) {
515
- console.error("Verifier key is invalid. Make sure it's specified correctly, including the newlines.", err);
516
- throw new ConfigurationException("Invalid verifier key");
517
- }
518
- if (!accessToken) {
519
- throw new UnauthorizedException("No access token provided");
520
- }
521
- let accessTokenWithoutBearer = accessToken;
522
- if (accessToken.toLowerCase().startsWith("bearer ")) {
523
- accessTokenWithoutBearer = accessToken.substring("bearer ".length);
524
- }
525
- try {
526
- const { payload } = yield jose.jwtVerify(accessTokenWithoutBearer, publicKey, {
527
- issuer: authUrlOrigin,
528
- algorithms: ["RS256"]
529
- });
530
- return toUser(payload);
531
- } catch (e) {
532
- if (e instanceof Error) {
533
- throw new UnauthorizedException(e.message);
534
- } else {
535
- throw new UnauthorizedException("Unable to decode jwt");
536
- }
537
- }
538
- });
539
- }
540
- return {
541
- getUser,
542
- getUserOrRedirect,
543
- validateAccessToken,
544
- validateAccessTokenOrUndefined,
545
- getRouteHandler,
546
- postRouteHandler,
547
- authMiddleware
548
- };
549
- }
550
- function randomState() {
551
- const randomBytes = crypto.getRandomValues(new Uint8Array(32));
552
- return Array.from(randomBytes).map((b) => b.toString(16).padStart(2, "0")).join("");
553
- }
554
-
555
- // src/server/validators.ts
556
- function validateAuthUrl(authUrl) {
557
- try {
558
- return new URL(authUrl);
559
- } catch (e) {
560
- console.error("Invalid authUrl", e);
561
- throw new Error("Unable to initialize auth client");
562
- }
563
- }
564
-
565
- // src/server/auth.ts
566
- function initializeAuth(opts) {
567
- const authUrl = validateAuthUrl(opts.authUrl).origin;
568
- const postLoginPathFn = opts.postLoginRedirectPathFn || function() {
569
- return "/";
570
- };
571
- return getServerActions({
572
- authUrlOrigin: authUrl,
573
- verifierKey: opts.verifierKey,
574
- redirectUri: opts.redirectUri,
575
- integrationApiKey: opts.integrationApiKey,
576
- postLoginPathFn
238
+ }
577
239
  });
578
240
  }
579
241
  export {
580
242
  ConfigurationException,
243
+ OrgMemberInfo,
581
244
  UnauthorizedException,
582
- initializeAuth
245
+ User,
246
+ validateAccessToken,
247
+ validateAccessTokenOrUndefined
583
248
  };
584
249
  //# sourceMappingURL=index.mjs.map