@propelauth/nextjs 0.0.63 → 0.0.67
This diff represents the content of publicly available package versions that have been released to one of the supported registries. The information contained in this diff is provided for informational purposes only and reflects changes between package versions as they appear in their respective public registries.
- package/dist/server/app-router/index.d.ts +75 -0
- package/dist/server/app-router/index.js +624 -0
- package/dist/server/app-router/index.js.map +1 -0
- package/dist/server/app-router/index.mjs +583 -0
- package/dist/server/app-router/index.mjs.map +1 -0
- package/dist/server/index.d.ts +4 -43
- package/dist/server/index.js +56 -423
- package/dist/server/index.js.map +1 -1
- package/dist/server/index.mjs +54 -422
- package/dist/server/index.mjs.map +1 -1
- package/dist/server/pages/index.d.ts +47 -0
- package/dist/server/pages/index.js +356 -0
- package/dist/server/pages/index.js.map +1 -0
- package/dist/server/pages/index.mjs +320 -0
- package/dist/server/pages/index.mjs.map +1 -0
- package/package.json +18 -1
@@ -0,0 +1 @@
|
|
1
|
+
{"version":3,"sources":["../../../src/server/exceptions.ts","../../../src/user.ts","../../../src/server/app-router.ts","../../../src/server/shared.ts"],"sourcesContent":["export class UnauthorizedException extends Error {\n readonly message: string\n readonly status: number\n\n constructor(message: string) {\n super(message)\n this.message = message\n this.status = 401\n }\n}\n\nexport class ConfigurationException extends Error {\n readonly message: string\n readonly status: number\n\n constructor(message: string) {\n super(message)\n this.message = message\n this.status = 500\n }\n}\n","export class User {\n public userId: string\n public orgIdToOrgMemberInfo?: OrgIdToOrgMemberInfo\n\n // Metadata about the user\n public email: string\n public firstName?: string\n public lastName?: string\n public username?: string\n\n // If you used our migration APIs to migrate this user from a different system,\n // this is their original ID from that system.\n public legacyUserId?: string\n public impersonatorUserId?: string\n\n constructor(\n userId: string,\n email: string,\n orgIdToOrgMemberInfo?: OrgIdToOrgMemberInfo,\n firstName?: string,\n lastName?: string,\n username?: string,\n legacyUserId?: string,\n impersonatorUserId?: string\n ) {\n this.userId = userId\n this.orgIdToOrgMemberInfo = orgIdToOrgMemberInfo\n\n this.email = email\n this.firstName = firstName\n this.lastName = lastName\n this.username = username\n\n this.legacyUserId = legacyUserId\n this.impersonatorUserId = impersonatorUserId\n }\n\n public getOrg(orgId: string): OrgMemberInfo | undefined {\n if (!this.orgIdToOrgMemberInfo) {\n return undefined\n }\n\n return this.orgIdToOrgMemberInfo[orgId]\n }\n\n public getOrgByName(orgName: string): OrgMemberInfo | undefined {\n if (!this.orgIdToOrgMemberInfo) {\n return undefined\n }\n\n const urlSafeOrgName = orgName.toLowerCase().replace(/ /g, \"-\")\n for (const orgId in this.orgIdToOrgMemberInfo) {\n const orgMemberInfo = this.orgIdToOrgMemberInfo[orgId]\n if (orgMemberInfo.urlSafeOrgName === urlSafeOrgName) {\n return orgMemberInfo\n }\n }\n\n return undefined\n }\n\n public getOrgs(): OrgMemberInfo[] {\n if (!this.orgIdToOrgMemberInfo) {\n return []\n }\n\n return Object.values(this.orgIdToOrgMemberInfo)\n }\n\n public isImpersonating(): boolean {\n return !!this.impersonatorUserId\n }\n\n public static fromJSON(json: string): User {\n const obj = JSON.parse(json)\n const orgIdToOrgMemberInfo: OrgIdToOrgMemberInfo = {}\n for (const orgId in obj.orgIdToOrgMemberInfo) {\n orgIdToOrgMemberInfo[orgId] = OrgMemberInfo.fromJSON(\n JSON.stringify(obj.orgIdToOrgMemberInfo[orgId])\n )\n }\n return new User(\n obj.userId,\n obj.email,\n orgIdToOrgMemberInfo,\n obj.firstName,\n obj.lastName,\n obj.username,\n obj.legacyUserId,\n obj.impersonatorUserId\n )\n }\n}\n\nexport type OrgIdToOrgMemberInfo = {\n [orgId: string]: OrgMemberInfo\n}\n\nexport class OrgMemberInfo {\n public orgId: string\n public orgName: string\n public orgMetadata: { [key: string]: any }\n public urlSafeOrgName: string\n\n private userAssignedRole: string\n private userInheritedRolesPlusCurrentRole: string[]\n private userPermissions: string[]\n\n constructor(\n orgId: string,\n orgName: string,\n orgMetadata: { [key: string]: any },\n urlSafeOrgName: string,\n userAssignedRole: string,\n userInheritedRolesPlusCurrentRole: string[],\n userPermissions: string[]\n ) {\n this.orgId = orgId\n this.orgName = orgName\n this.orgMetadata = orgMetadata\n this.urlSafeOrgName = urlSafeOrgName\n\n this.userAssignedRole = userAssignedRole\n this.userInheritedRolesPlusCurrentRole = userInheritedRolesPlusCurrentRole\n this.userPermissions = userPermissions\n }\n\n // validation methods\n\n public isRole(role: string): boolean {\n return this.userAssignedRole === role\n }\n\n public isAtLeastRole(role: string): boolean {\n return this.userInheritedRolesPlusCurrentRole.includes(role)\n }\n\n public hasPermission(permission: string): boolean {\n return this.userPermissions.includes(permission)\n }\n\n public hasAllPermissions(permissions: string[]): boolean {\n return permissions.every((permission) => this.hasPermission(permission))\n }\n\n public static fromJSON(json: string): OrgMemberInfo {\n const obj = JSON.parse(json)\n return new OrgMemberInfo(\n obj.orgId,\n obj.orgName,\n obj.orgMetadata,\n obj.urlSafeOrgName,\n obj.userAssignedRole,\n obj.userInheritedRolesPlusCurrentRole,\n obj.userPermissions\n )\n }\n\n // getters for the private fields\n\n get assignedRole(): string {\n return this.userAssignedRole\n }\n\n get inheritedRolesPlusCurrentRole(): string[] {\n return this.userInheritedRolesPlusCurrentRole\n }\n\n get permissions(): string[] {\n return this.userPermissions\n }\n}\n\n// These Internal types exist since the server returns snake case, but typescript/javascript\n// convention is camelCase.\nexport type InternalOrgMemberInfo = {\n org_id: string\n org_name: string\n org_metadata: { [key: string]: any }\n url_safe_org_name: string\n user_role: string\n inherited_user_roles_plus_current_role: string[]\n user_permissions: string[]\n}\nexport type InternalUser = {\n user_id: string\n org_id_to_org_member_info?: { [org_id: string]: InternalOrgMemberInfo }\n\n email: string\n first_name?: string\n last_name?: string\n username?: string\n\n // If you used our migration APIs to migrate this user from a different system, this is their original ID from that system.\n legacy_user_id?: string\n impersonatorUserId?: string\n}\n\nexport function toUser(snake_case: InternalUser): User {\n return new User(\n snake_case.user_id,\n snake_case.email,\n toOrgIdToOrgMemberInfo(snake_case.org_id_to_org_member_info),\n snake_case.first_name,\n snake_case.last_name,\n snake_case.username,\n snake_case.legacy_user_id,\n snake_case.impersonatorUserId\n )\n}\n\nexport function toOrgIdToOrgMemberInfo(snake_case?: {\n [org_id: string]: InternalOrgMemberInfo\n}): OrgIdToOrgMemberInfo | undefined {\n if (snake_case === undefined) {\n return undefined\n }\n const camelCase: OrgIdToOrgMemberInfo = {}\n\n for (const key of Object.keys(snake_case)) {\n const snakeCaseValue = snake_case[key]\n if (snakeCaseValue) {\n camelCase[key] = new OrgMemberInfo(\n snakeCaseValue.org_id,\n snakeCaseValue.org_name,\n snakeCaseValue.org_metadata,\n snakeCaseValue.url_safe_org_name,\n snakeCaseValue.user_role,\n snakeCaseValue.inherited_user_roles_plus_current_role,\n snakeCaseValue.user_permissions\n )\n }\n }\n\n return camelCase\n}\n","import {toOrgIdToOrgMemberInfo, User} from \"../user\";\nimport {redirect} from \"next/navigation\";\nimport {cookies, headers} from \"next/headers\";\nimport {NextRequest, NextResponse} from \"next/server\";\nimport {\n ACCESS_TOKEN_COOKIE_NAME,\n CALLBACK_PATH,\n COOKIE_OPTIONS,\n CUSTOM_HEADER_FOR_ACCESS_TOKEN,\n getAuthUrlOrigin,\n getIntegrationApiKey,\n getRedirectUri,\n LOGIN_PATH,\n LOGOUT_PATH,\n REFRESH_TOKEN_COOKIE_NAME,\n refreshTokenWithAccessAndRefreshToken,\n STATE_COOKIE_NAME,\n USERINFO_PATH,\n validateAccessToken,\n validateAccessTokenOrUndefined\n} from \"./shared\";\n\nexport async function getUserOrRedirect(): Promise<User> {\n const user = await getUser()\n if (user) {\n return user\n } else {\n redirect(LOGIN_PATH)\n throw new Error(\"Redirecting to login\")\n }\n}\n\nexport async function getUser(): Promise<User | undefined> {\n const accessToken = headers().get(CUSTOM_HEADER_FOR_ACCESS_TOKEN) || cookies().get(ACCESS_TOKEN_COOKIE_NAME)?.value\n if (accessToken) {\n const user = await validateAccessTokenOrUndefined(accessToken)\n if (user) {\n return user\n }\n }\n return undefined\n}\n\n// Purpose of this middleware is just to keep the access token cookie alive\n// In an ideal world, this could be done in `getUser`, however, you can't\n// set a cookie in a server component.\n// There also doesn't seem to be any way right now to set a cookie in a\n// middleware and pass it forward (you can only set them on the response).\n// You CAN, however, pass in custom headers,\n// so we'll use CUSTOM_HEADER_FOR_ACCESS_TOKEN as a workaround\nexport async function authMiddleware(req: NextRequest): Promise<Response> {\n if (req.headers.has(CUSTOM_HEADER_FOR_ACCESS_TOKEN)) {\n throw new Error(`${CUSTOM_HEADER_FOR_ACCESS_TOKEN} is set which is for internal use only`)\n } else if (req.nextUrl.pathname === CALLBACK_PATH || req.nextUrl.pathname === LOGOUT_PATH) {\n // Don't do anything for the callback or logout paths, as they will modify the cookies themselves\n return NextResponse.next()\n }\n\n const accessToken = req.cookies.get(ACCESS_TOKEN_COOKIE_NAME)?.value\n const refreshToken = req.cookies.get(REFRESH_TOKEN_COOKIE_NAME)?.value\n\n // For the userinfo endpoint, we want to get the most up-to-date info, so we'll refresh the access token\n if (req.nextUrl.pathname === USERINFO_PATH && refreshToken) {\n const response = await refreshTokenWithAccessAndRefreshToken(refreshToken)\n if (response.error === \"unexpected\") {\n throw new Error(\"Unexpected error while refreshing access token\")\n } else if (response.error === \"unauthorized\") {\n const headers = new Headers()\n headers.append(\"Set-Cookie\", `${ACCESS_TOKEN_COOKIE_NAME}=; Path=/; HttpOnly; Secure; SameSite=Lax; Max-Age=0`)\n headers.append(\"Set-Cookie\", `${REFRESH_TOKEN_COOKIE_NAME}=; Path=/; HttpOnly; Secure; SameSite=Lax; Max-Age=0`)\n return new Response(\"Unauthorized\", {status: 401, headers})\n } else {\n const headers = new Headers(req.headers)\n // Pass along the new access token in a header since cookies don't work\n headers.append(CUSTOM_HEADER_FOR_ACCESS_TOKEN, response.accessToken)\n const nextResponse = NextResponse.next({\n request: {\n headers\n }\n })\n nextResponse.cookies.set(ACCESS_TOKEN_COOKIE_NAME, response.accessToken, COOKIE_OPTIONS)\n nextResponse.cookies.set(REFRESH_TOKEN_COOKIE_NAME, response.refreshToken, COOKIE_OPTIONS)\n return nextResponse\n }\n }\n\n // If we are authenticated, we can continue\n if (accessToken) {\n const user = await validateAccessTokenOrUndefined(accessToken)\n if (user) {\n return NextResponse.next()\n }\n }\n\n // Otherwise, we need to refresh the access token\n if (refreshToken) {\n const response = await refreshTokenWithAccessAndRefreshToken(refreshToken)\n if (response.error === \"unexpected\") {\n throw new Error(\"Unexpected error while refreshing access token\")\n } else if (response.error === \"unauthorized\") {\n const response = NextResponse.next()\n response.cookies.delete(ACCESS_TOKEN_COOKIE_NAME)\n response.cookies.delete(REFRESH_TOKEN_COOKIE_NAME)\n return response\n } else {\n const headers = new Headers(req.headers)\n // Pass along the new access token in a header since cookies don't work\n headers.append(CUSTOM_HEADER_FOR_ACCESS_TOKEN, response.accessToken)\n const nextResponse = NextResponse.next({\n request: {\n headers\n }\n })\n nextResponse.cookies.set(ACCESS_TOKEN_COOKIE_NAME, response.accessToken, COOKIE_OPTIONS)\n nextResponse.cookies.set(REFRESH_TOKEN_COOKIE_NAME, response.refreshToken, COOKIE_OPTIONS)\n return nextResponse\n }\n }\n\n return NextResponse.next()\n}\n\nexport type RouteHandlerArgs = {\n postLoginRedirectPathFn?: (user: User, req: NextRequest) => string\n}\n\nexport function getRouteHandlers(args?: RouteHandlerArgs) {\n const authUrlOrigin = getAuthUrlOrigin()\n const redirectUri = getRedirectUri()\n const integrationApiKey = getIntegrationApiKey()\n\n function loginGetHandler() {\n const state = randomState()\n const authorize_url =\n authUrlOrigin + \"/propelauth/ssr/authorize?redirect_uri=\" + redirectUri + \"&state=\" + state\n return new Response(null, {\n status: 302,\n headers: {\n Location: authorize_url,\n \"Set-Cookie\": `${STATE_COOKIE_NAME}=${state}; Path=/; HttpOnly; Secure; SameSite=Lax`,\n }\n })\n }\n\n function signupGetHandler() {\n const state = randomState()\n const authorize_url =\n getAuthUrlOrigin() + \"/propelauth/ssr/authorize?redirect_uri=\" + redirectUri + \"&state=\" + state + \"&signup=true\"\n return new Response(null, {\n status: 302,\n headers: {\n Location: authorize_url,\n \"Set-Cookie\": `${STATE_COOKIE_NAME}=${state}; Path=/; HttpOnly; Secure; SameSite=Lax`,\n }\n })\n }\n\n async function callbackGetHandler(req: NextRequest) {\n const oauthState = req.cookies.get(STATE_COOKIE_NAME)?.value\n if (!oauthState || oauthState.length !== 64) {\n console.log(\"No oauth state found\")\n return new Response(null, {status: 302, headers: {Location: LOGIN_PATH}})\n }\n\n const queryParams = req.nextUrl.searchParams\n const state = queryParams.get(\"state\")\n const code = queryParams.get(\"code\")\n if (state !== oauthState) {\n console.log(\"Mismatch between states, redirecting to login\")\n return new Response(null, {status: 302, headers: {Location: LOGIN_PATH}})\n }\n\n const oauth_token_body = {\n redirect_uri: redirectUri,\n code,\n }\n const url = `${authUrlOrigin}/propelauth/ssr/token`\n const response = await fetch(url, {\n method: \"POST\",\n body: JSON.stringify(oauth_token_body),\n headers: {\n \"Content-Type\": \"application/json\",\n Authorization: \"Bearer \" + integrationApiKey,\n },\n })\n\n if (response.ok) {\n const data = await response.json()\n\n const accessToken = data.access_token\n const user = await validateAccessToken(accessToken)\n const path = args?.postLoginRedirectPathFn ? args.postLoginRedirectPathFn(user, req) : \"/\"\n if (!path) {\n console.log(\"postLoginPathFn returned undefined\")\n return new Response(\"Unexpected error\", {status: 500})\n }\n\n const headers = new Headers()\n headers.append(\"Location\", path)\n headers.append(\"Set-Cookie\", `${ACCESS_TOKEN_COOKIE_NAME}=${accessToken}; Path=/; HttpOnly; Secure; SameSite=Lax`)\n headers.append(\"Set-Cookie\", `${REFRESH_TOKEN_COOKIE_NAME}=${data.refresh_token}; Path=/; HttpOnly; Secure; SameSite=Lax`)\n return new Response(null, {\n status: 302,\n headers\n })\n } else if (response.status === 401) {\n return new Response(\"Unexpected error\", {status: 500})\n } else {\n return new Response(\"Unexpected error\", {status: 500})\n }\n }\n\n async function userinfoGetHandler(req: NextRequest) {\n const accessToken = req.headers.get(CUSTOM_HEADER_FOR_ACCESS_TOKEN) || req.cookies.get(ACCESS_TOKEN_COOKIE_NAME)?.value\n if (accessToken) {\n const path = `${authUrlOrigin}/propelauth/oauth/userinfo`\n const response = await fetch(path, {\n headers: {\n \"Content-Type\": \"application/json\",\n \"Authorization\": \"Bearer \" + accessToken,\n }\n })\n if (response.ok) {\n const data = await response.json()\n\n const user = new User(\n data.user_id,\n data.email,\n toOrgIdToOrgMemberInfo(data.org_id_to_org_info),\n data.first_name,\n data.last_name,\n data.username,\n data.legacy_user_id,\n data.impersonator_user_id,\n )\n\n return new Response(JSON.stringify(user), {\n status: 200,\n headers: {\n \"Content-Type\": \"application/json\",\n }\n })\n } else if (response.status === 401) {\n return new Response(null, {status: 401})\n } else {\n return new Response(null, {status: 500})\n }\n }\n return new Response(null, {status: 401})\n }\n\n async function logoutPostHandler(req: NextRequest) {\n const refresh_token = req.cookies.get(REFRESH_TOKEN_COOKIE_NAME)?.value\n if (!refresh_token) {\n const headers = new Headers()\n headers.append(\"Set-Cookie\", `${ACCESS_TOKEN_COOKIE_NAME}=; Path=/; HttpOnly; Secure; SameSite=Lax; Max-Age=0`)\n headers.append(\"Set-Cookie\", `${REFRESH_TOKEN_COOKIE_NAME}=; Path=/; HttpOnly; Secure; SameSite=Lax; Max-Age=0`)\n return new Response(null, {status: 200, headers})\n }\n\n const logoutBody = {refresh_token}\n const url = `${authUrlOrigin}/api/backend/v1/logout`\n const response = await fetch(url, {\n method: \"POST\",\n body: JSON.stringify(logoutBody),\n headers: {\n \"Content-Type\": \"application/json\",\n Authorization: \"Bearer \" + integrationApiKey,\n },\n })\n\n if (!response.ok) {\n console.log(\n \"Unable to logout, clearing cookies and continuing anyway\",\n response.status,\n response.statusText\n )\n }\n const headers = new Headers()\n headers.append(\"Set-Cookie\", `${ACCESS_TOKEN_COOKIE_NAME}=; Path=/; HttpOnly; Secure; SameSite=Lax; Max-Age=0`)\n headers.append(\"Set-Cookie\", `${REFRESH_TOKEN_COOKIE_NAME}=; Path=/; HttpOnly; Secure; SameSite=Lax; Max-Age=0`)\n return new Response(null, {status: 200, headers})\n }\n\n function getRouteHandler(req: NextRequest, {params}: { params: { slug: string } }) {\n if (params.slug === \"login\") {\n return loginGetHandler()\n } else if (params.slug === \"signup\") {\n return signupGetHandler()\n } else if (params.slug === \"callback\") {\n return callbackGetHandler(req)\n } else if (params.slug === \"userinfo\") {\n return userinfoGetHandler(req)\n } else {\n return new Response(\"\", {status: 404})\n }\n }\n\n function postRouteHandler(req: NextRequest, {params}: { params: { slug: string } }) {\n if (params.slug === \"logout\") {\n return logoutPostHandler(req)\n } else {\n return new Response(\"\", {status: 404})\n }\n }\n\n return {\n getRouteHandler,\n postRouteHandler\n }\n}\n\nfunction randomState(): string {\n const randomBytes = crypto.getRandomValues(new Uint8Array(32))\n return Array.from(randomBytes)\n .map((b) => b.toString(16).padStart(2, \"0\"))\n .join(\"\")\n}\n\n","import {ResponseCookie} from \"next/dist/compiled/@edge-runtime/cookies\";\nimport {InternalUser, toUser, User} from \"../user\";\nimport {ConfigurationException, UnauthorizedException} from \"./exceptions\";\nimport * as jose from \"jose\";\n\ntype RefreshAndAccessTokens = {\n refreshToken: string\n accessToken: string\n error: \"none\"\n}\n\ntype RefreshAndAccessTokensUnauthorizedError = {\n error: \"unauthorized\"\n}\n\ntype RefreshAndAccessTokensUnexpectedError = {\n error: \"unexpected\"\n}\n\nexport type RefreshTokenResponse =\n RefreshAndAccessTokens\n | RefreshAndAccessTokensUnauthorizedError\n | RefreshAndAccessTokensUnexpectedError\n\nexport const LOGIN_PATH = \"/api/auth/login\"\nexport const CALLBACK_PATH = \"/api/auth/callback\"\nexport const USERINFO_PATH = \"/api/auth/userinfo\"\nexport const LOGOUT_PATH = \"/api/auth/logout\"\nexport const ACCESS_TOKEN_COOKIE_NAME = \"__pa_at\"\nexport const REFRESH_TOKEN_COOKIE_NAME = \"__pa_rt\"\nexport const STATE_COOKIE_NAME = \"__pa_state\"\nexport const CUSTOM_HEADER_FOR_ACCESS_TOKEN = \"x-propelauth-access-token\"\n\nexport const COOKIE_OPTIONS: Partial<ResponseCookie> = {\n httpOnly: true,\n sameSite: \"lax\",\n secure: true,\n path: \"/\",\n}\n\nexport function getAuthUrlOrigin() {\n const authUrl = process.env.NEXT_PUBLIC_AUTH_URL\n if (!authUrl) {\n throw new Error(\"NEXT_PUBLIC_AUTH_URL is not set\")\n }\n return new URL(authUrl).origin\n}\n\nexport function getRedirectUri() {\n const redirectUri = process.env.REDIRECT_URI\n if (!redirectUri) {\n throw new Error(\"REDIRECT_URI is not set\")\n }\n return redirectUri\n}\n\nexport function getIntegrationApiKey() {\n const integrationApiKey = process.env.PROPELAUTH_API_KEY\n if (!integrationApiKey) {\n throw new Error(\"PROPELAUTH_API_KEY is not set\")\n }\n return integrationApiKey\n}\n\nexport function getVerifierKey() {\n const verifierKey = process.env.VERIFIER_KEY\n if (!verifierKey) {\n throw new Error(\"VERIFIER_KEY is not set\")\n }\n return verifierKey.replace(/\\\\n/g, \"\\n\")\n}\n\nexport async function refreshTokenWithAccessAndRefreshToken(refreshToken: string): Promise<RefreshTokenResponse> {\n const body = {\n refresh_token: refreshToken,\n }\n const url = `${getAuthUrlOrigin()}/api/backend/v1/refresh_token`\n const response = await fetch(url, {\n method: \"POST\",\n body: JSON.stringify(body),\n headers: {\n \"Content-Type\": \"application/json\",\n Authorization: \"Bearer \" + getIntegrationApiKey(),\n },\n })\n\n if (response.ok) {\n const data = await response.json()\n const newRefreshToken = data.refresh_token\n const {\n access_token: accessToken,\n expires_at_seconds: expiresAtSeconds,\n } = data.access_token\n\n return {\n refreshToken: newRefreshToken,\n accessToken,\n error: \"none\",\n }\n } else if (response.status === 400) {\n return {error: \"unauthorized\"}\n } else {\n return {error: \"unexpected\"}\n }\n}\n\nexport async function validateAccessTokenOrUndefined(accessToken: string | undefined): Promise<User | undefined> {\n try {\n return await validateAccessToken(accessToken)\n } catch (err) {\n if (err instanceof ConfigurationException) {\n throw err\n } else if (err instanceof UnauthorizedException) {\n return undefined\n } else {\n console.log(\"Error validating access token\", err)\n return undefined\n }\n }\n}\n\nexport async function validateAccessToken(accessToken: string | undefined): Promise<User> {\n let publicKey\n try {\n publicKey = await jose.importSPKI(getVerifierKey(), \"RS256\")\n } catch (err) {\n console.error(\"Verifier key is invalid. Make sure it's specified correctly, including the newlines.\", err)\n throw new ConfigurationException(\"Invalid verifier key\")\n }\n\n if (!accessToken) {\n throw new UnauthorizedException(\"No access token provided\")\n }\n\n let accessTokenWithoutBearer = accessToken\n if (accessToken.toLowerCase().startsWith(\"bearer \")) {\n accessTokenWithoutBearer = accessToken.substring(\"bearer \".length)\n }\n\n try {\n const {payload} = await jose.jwtVerify(accessTokenWithoutBearer, publicKey, {\n issuer: getAuthUrlOrigin(),\n algorithms: [\"RS256\"],\n })\n\n return toUser(<InternalUser>payload)\n } catch (e) {\n if (e instanceof Error) {\n throw new UnauthorizedException(e.message)\n } else {\n throw new UnauthorizedException(\"Unable to decode jwt\")\n }\n }\n}\n"],"mappings":";;;;;;;;;;;;;;;;;;;;;;AAAO,IAAM,wBAAN,cAAoC,MAAM;AAAA,EAI7C,YAAY,SAAiB;AACzB,UAAM,OAAO;AACb,SAAK,UAAU;AACf,SAAK,SAAS;AAAA,EAClB;AACJ;AAEO,IAAM,yBAAN,cAAqC,MAAM;AAAA,EAI9C,YAAY,SAAiB;AACzB,UAAM,OAAO;AACb,SAAK,UAAU;AACf,SAAK,SAAS;AAAA,EAClB;AACJ;;;ACpBO,IAAM,OAAN,MAAW;AAAA,EAed,YACI,QACA,OACA,sBACA,WACA,UACA,UACA,cACA,oBACF;AACE,SAAK,SAAS;AACd,SAAK,uBAAuB;AAE5B,SAAK,QAAQ;AACb,SAAK,YAAY;AACjB,SAAK,WAAW;AAChB,SAAK,WAAW;AAEhB,SAAK,eAAe;AACpB,SAAK,qBAAqB;AAAA,EAC9B;AAAA,EAEO,OAAO,OAA0C;AACpD,QAAI,CAAC,KAAK,sBAAsB;AAC5B,aAAO;AAAA,IACX;AAEA,WAAO,KAAK,qBAAqB,KAAK;AAAA,EAC1C;AAAA,EAEO,aAAa,SAA4C;AAC5D,QAAI,CAAC,KAAK,sBAAsB;AAC5B,aAAO;AAAA,IACX;AAEA,UAAM,iBAAiB,QAAQ,YAAY,EAAE,QAAQ,MAAM,GAAG;AAC9D,eAAW,SAAS,KAAK,sBAAsB;AAC3C,YAAM,gBAAgB,KAAK,qBAAqB,KAAK;AACrD,UAAI,cAAc,mBAAmB,gBAAgB;AACjD,eAAO;AAAA,MACX;AAAA,IACJ;AAEA,WAAO;AAAA,EACX;AAAA,EAEO,UAA2B;AAC9B,QAAI,CAAC,KAAK,sBAAsB;AAC5B,aAAO,CAAC;AAAA,IACZ;AAEA,WAAO,OAAO,OAAO,KAAK,oBAAoB;AAAA,EAClD;AAAA,EAEO,kBAA2B;AAC9B,WAAO,CAAC,CAAC,KAAK;AAAA,EAClB;AAAA,EAEA,OAAc,SAAS,MAAoB;AACvC,UAAM,MAAM,KAAK,MAAM,IAAI;AAC3B,UAAM,uBAA6C,CAAC;AACpD,eAAW,SAAS,IAAI,sBAAsB;AAC1C,2BAAqB,KAAK,IAAI,cAAc;AAAA,QACxC,KAAK,UAAU,IAAI,qBAAqB,KAAK,CAAC;AAAA,MAClD;AAAA,IACJ;AACA,WAAO,IAAI;AAAA,MACP,IAAI;AAAA,MACJ,IAAI;AAAA,MACJ;AAAA,MACA,IAAI;AAAA,MACJ,IAAI;AAAA,MACJ,IAAI;AAAA,MACJ,IAAI;AAAA,MACJ,IAAI;AAAA,IACR;AAAA,EACJ;AACJ;AAMO,IAAM,gBAAN,MAAoB;AAAA,EAUvB,YACI,OACA,SACA,aACA,gBACA,kBACA,mCACA,iBACF;AACE,SAAK,QAAQ;AACb,SAAK,UAAU;AACf,SAAK,cAAc;AACnB,SAAK,iBAAiB;AAEtB,SAAK,mBAAmB;AACxB,SAAK,oCAAoC;AACzC,SAAK,kBAAkB;AAAA,EAC3B;AAAA;AAAA,EAIO,OAAO,MAAuB;AACjC,WAAO,KAAK,qBAAqB;AAAA,EACrC;AAAA,EAEO,cAAc,MAAuB;AACxC,WAAO,KAAK,kCAAkC,SAAS,IAAI;AAAA,EAC/D;AAAA,EAEO,cAAc,YAA6B;AAC9C,WAAO,KAAK,gBAAgB,SAAS,UAAU;AAAA,EACnD;AAAA,EAEO,kBAAkB,aAAgC;AACrD,WAAO,YAAY,MAAM,CAAC,eAAe,KAAK,cAAc,UAAU,CAAC;AAAA,EAC3E;AAAA,EAEA,OAAc,SAAS,MAA6B;AAChD,UAAM,MAAM,KAAK,MAAM,IAAI;AAC3B,WAAO,IAAI;AAAA,MACP,IAAI;AAAA,MACJ,IAAI;AAAA,MACJ,IAAI;AAAA,MACJ,IAAI;AAAA,MACJ,IAAI;AAAA,MACJ,IAAI;AAAA,MACJ,IAAI;AAAA,IACR;AAAA,EACJ;AAAA;AAAA,EAIA,IAAI,eAAuB;AACvB,WAAO,KAAK;AAAA,EAChB;AAAA,EAEA,IAAI,gCAA0C;AAC1C,WAAO,KAAK;AAAA,EAChB;AAAA,EAEA,IAAI,cAAwB;AACxB,WAAO,KAAK;AAAA,EAChB;AACJ;AA2BO,SAAS,OAAO,YAAgC;AACnD,SAAO,IAAI;AAAA,IACP,WAAW;AAAA,IACX,WAAW;AAAA,IACX,uBAAuB,WAAW,yBAAyB;AAAA,IAC3D,WAAW;AAAA,IACX,WAAW;AAAA,IACX,WAAW;AAAA,IACX,WAAW;AAAA,IACX,WAAW;AAAA,EACf;AACJ;AAEO,SAAS,uBAAuB,YAEF;AACjC,MAAI,eAAe,QAAW;AAC1B,WAAO;AAAA,EACX;AACA,QAAM,YAAkC,CAAC;AAEzC,aAAW,OAAO,OAAO,KAAK,UAAU,GAAG;AACvC,UAAM,iBAAiB,WAAW,GAAG;AACrC,QAAI,gBAAgB;AAChB,gBAAU,GAAG,IAAI,IAAI;AAAA,QACjB,eAAe;AAAA,QACf,eAAe;AAAA,QACf,eAAe;AAAA,QACf,eAAe;AAAA,QACf,eAAe;AAAA,QACf,eAAe;AAAA,QACf,eAAe;AAAA,MACnB;AAAA,IACJ;AAAA,EACJ;AAEA,SAAO;AACX;;;AC1OA,SAAQ,gBAAe;AACvB,SAAQ,SAAS,eAAc;AAC/B,SAAqB,oBAAmB;;;ACAxC,YAAY,UAAU;AAqBf,IAAM,aAAa;AACnB,IAAM,gBAAgB;AACtB,IAAM,gBAAgB;AACtB,IAAM,cAAc;AACpB,IAAM,2BAA2B;AACjC,IAAM,4BAA4B;AAClC,IAAM,oBAAoB;AAC1B,IAAM,iCAAiC;AAEvC,IAAM,iBAA0C;AAAA,EACnD,UAAU;AAAA,EACV,UAAU;AAAA,EACV,QAAQ;AAAA,EACR,MAAM;AACV;AAEO,SAAS,mBAAmB;AAC/B,QAAM,UAAU,QAAQ,IAAI;AAC5B,MAAI,CAAC,SAAS;AACV,UAAM,IAAI,MAAM,iCAAiC;AAAA,EACrD;AACA,SAAO,IAAI,IAAI,OAAO,EAAE;AAC5B;AAEO,SAAS,iBAAiB;AAC7B,QAAM,cAAc,QAAQ,IAAI;AAChC,MAAI,CAAC,aAAa;AACd,UAAM,IAAI,MAAM,yBAAyB;AAAA,EAC7C;AACA,SAAO;AACX;AAEO,SAAS,uBAAuB;AACnC,QAAM,oBAAoB,QAAQ,IAAI;AACtC,MAAI,CAAC,mBAAmB;AACpB,UAAM,IAAI,MAAM,+BAA+B;AAAA,EACnD;AACA,SAAO;AACX;AAEO,SAAS,iBAAiB;AAC7B,QAAM,cAAc,QAAQ,IAAI;AAChC,MAAI,CAAC,aAAa;AACd,UAAM,IAAI,MAAM,yBAAyB;AAAA,EAC7C;AACA,SAAO,YAAY,QAAQ,QAAQ,IAAI;AAC3C;AAEA,SAAsB,sCAAsC,cAAqD;AAAA;AAC7G,UAAM,OAAO;AAAA,MACT,eAAe;AAAA,IACnB;AACA,UAAM,MAAM,GAAG,iBAAiB;AAChC,UAAM,WAAW,MAAM,MAAM,KAAK;AAAA,MAC9B,QAAQ;AAAA,MACR,MAAM,KAAK,UAAU,IAAI;AAAA,MACzB,SAAS;AAAA,QACL,gBAAgB;AAAA,QAChB,eAAe,YAAY,qBAAqB;AAAA,MACpD;AAAA,IACJ,CAAC;AAED,QAAI,SAAS,IAAI;AACb,YAAM,OAAO,MAAM,SAAS,KAAK;AACjC,YAAM,kBAAkB,KAAK;AAC7B,YAAM;AAAA,QACF,cAAc;AAAA,QACd,oBAAoB;AAAA,MACxB,IAAI,KAAK;AAET,aAAO;AAAA,QACH,cAAc;AAAA,QACd;AAAA,QACA,OAAO;AAAA,MACX;AAAA,IACJ,WAAW,SAAS,WAAW,KAAK;AAChC,aAAO,EAAC,OAAO,eAAc;AAAA,IACjC,OAAO;AACH,aAAO,EAAC,OAAO,aAAY;AAAA,IAC/B;AAAA,EACJ;AAAA;AAEA,SAAsB,+BAA+B,aAA4D;AAAA;AAC7G,QAAI;AACA,aAAO,MAAM,oBAAoB,WAAW;AAAA,IAChD,SAAS,KAAP;AACE,UAAI,eAAe,wBAAwB;AACvC,cAAM;AAAA,MACV,WAAW,eAAe,uBAAuB;AAC7C,eAAO;AAAA,MACX,OAAO;AACH,gBAAQ,IAAI,iCAAiC,GAAG;AAChD,eAAO;AAAA,MACX;AAAA,IACJ;AAAA,EACJ;AAAA;AAEA,SAAsB,oBAAoB,aAAgD;AAAA;AACtF,QAAI;AACJ,QAAI;AACA,kBAAY,MAAW,gBAAW,eAAe,GAAG,OAAO;AAAA,IAC/D,SAAS,KAAP;AACE,cAAQ,MAAM,wFAAwF,GAAG;AACzG,YAAM,IAAI,uBAAuB,sBAAsB;AAAA,IAC3D;AAEA,QAAI,CAAC,aAAa;AACd,YAAM,IAAI,sBAAsB,0BAA0B;AAAA,IAC9D;AAEA,QAAI,2BAA2B;AAC/B,QAAI,YAAY,YAAY,EAAE,WAAW,SAAS,GAAG;AACjD,iCAA2B,YAAY,UAAU,UAAU,MAAM;AAAA,IACrE;AAEA,QAAI;AACA,YAAM,EAAC,QAAO,IAAI,MAAW,eAAU,0BAA0B,WAAW;AAAA,QACxE,QAAQ,iBAAiB;AAAA,QACzB,YAAY,CAAC,OAAO;AAAA,MACxB,CAAC;AAED,aAAO,OAAqB,OAAO;AAAA,IACvC,SAAS,GAAP;AACE,UAAI,aAAa,OAAO;AACpB,cAAM,IAAI,sBAAsB,EAAE,OAAO;AAAA,MAC7C,OAAO;AACH,cAAM,IAAI,sBAAsB,sBAAsB;AAAA,MAC1D;AAAA,IACJ;AAAA,EACJ;AAAA;;;ADnIA,SAAsB,oBAAmC;AAAA;AACrD,UAAM,OAAO,MAAM,QAAQ;AAC3B,QAAI,MAAM;AACN,aAAO;AAAA,IACX,OAAO;AACH,eAAS,UAAU;AACnB,YAAM,IAAI,MAAM,sBAAsB;AAAA,IAC1C;AAAA,EACJ;AAAA;AAEA,SAAsB,UAAqC;AAAA;AAhC3D;AAiCI,UAAM,cAAc,QAAQ,EAAE,IAAI,8BAA8B,OAAK,aAAQ,EAAE,IAAI,wBAAwB,MAAtC,mBAAyC;AAC9G,QAAI,aAAa;AACb,YAAM,OAAO,MAAM,+BAA+B,WAAW;AAC7D,UAAI,MAAM;AACN,eAAO;AAAA,MACX;AAAA,IACJ;AACA,WAAO;AAAA,EACX;AAAA;AASA,SAAsB,eAAe,KAAqC;AAAA;AAlD1E;AAmDI,QAAI,IAAI,QAAQ,IAAI,8BAA8B,GAAG;AACjD,YAAM,IAAI,MAAM,GAAG,sEAAsE;AAAA,IAC7F,WAAW,IAAI,QAAQ,aAAa,iBAAiB,IAAI,QAAQ,aAAa,aAAa;AAEvF,aAAO,aAAa,KAAK;AAAA,IAC7B;AAEA,UAAM,eAAc,SAAI,QAAQ,IAAI,wBAAwB,MAAxC,mBAA2C;AAC/D,UAAM,gBAAe,SAAI,QAAQ,IAAI,yBAAyB,MAAzC,mBAA4C;AAGjE,QAAI,IAAI,QAAQ,aAAa,iBAAiB,cAAc;AACxD,YAAM,WAAW,MAAM,sCAAsC,YAAY;AACzE,UAAI,SAAS,UAAU,cAAc;AACjC,cAAM,IAAI,MAAM,gDAAgD;AAAA,MACpE,WAAW,SAAS,UAAU,gBAAgB;AAC1C,cAAMA,WAAU,IAAI,QAAQ;AAC5B,QAAAA,SAAQ,OAAO,cAAc,GAAG,8EAA8E;AAC9G,QAAAA,SAAQ,OAAO,cAAc,GAAG,+EAA+E;AAC/G,eAAO,IAAI,SAAS,gBAAgB,EAAC,QAAQ,KAAK,SAAAA,SAAO,CAAC;AAAA,MAC9D,OAAO;AACH,cAAMA,WAAU,IAAI,QAAQ,IAAI,OAAO;AAEvC,QAAAA,SAAQ,OAAO,gCAAgC,SAAS,WAAW;AACnE,cAAM,eAAe,aAAa,KAAK;AAAA,UACnC,SAAS;AAAA,YACL,SAAAA;AAAA,UACJ;AAAA,QACJ,CAAC;AACD,qBAAa,QAAQ,IAAI,0BAA0B,SAAS,aAAa,cAAc;AACvF,qBAAa,QAAQ,IAAI,2BAA2B,SAAS,cAAc,cAAc;AACzF,eAAO;AAAA,MACX;AAAA,IACJ;AAGA,QAAI,aAAa;AACb,YAAM,OAAO,MAAM,+BAA+B,WAAW;AAC7D,UAAI,MAAM;AACN,eAAO,aAAa,KAAK;AAAA,MAC7B;AAAA,IACJ;AAGA,QAAI,cAAc;AACd,YAAM,WAAW,MAAM,sCAAsC,YAAY;AACzE,UAAI,SAAS,UAAU,cAAc;AACjC,cAAM,IAAI,MAAM,gDAAgD;AAAA,MACpE,WAAW,SAAS,UAAU,gBAAgB;AAC1C,cAAMC,YAAW,aAAa,KAAK;AACnC,QAAAA,UAAS,QAAQ,OAAO,wBAAwB;AAChD,QAAAA,UAAS,QAAQ,OAAO,yBAAyB;AACjD,eAAOA;AAAA,MACX,OAAO;AACH,cAAMD,WAAU,IAAI,QAAQ,IAAI,OAAO;AAEvC,QAAAA,SAAQ,OAAO,gCAAgC,SAAS,WAAW;AACnE,cAAM,eAAe,aAAa,KAAK;AAAA,UACnC,SAAS;AAAA,YACL,SAAAA;AAAA,UACJ;AAAA,QACJ,CAAC;AACD,qBAAa,QAAQ,IAAI,0BAA0B,SAAS,aAAa,cAAc;AACvF,qBAAa,QAAQ,IAAI,2BAA2B,SAAS,cAAc,cAAc;AACzF,eAAO;AAAA,MACX;AAAA,IACJ;AAEA,WAAO,aAAa,KAAK;AAAA,EAC7B;AAAA;AAMO,SAAS,iBAAiB,MAAyB;AACtD,QAAM,gBAAgB,iBAAiB;AACvC,QAAM,cAAc,eAAe;AACnC,QAAM,oBAAoB,qBAAqB;AAE/C,WAAS,kBAAkB;AACvB,UAAM,QAAQ,YAAY;AAC1B,UAAM,gBACF,gBAAgB,4CAA4C,cAAc,YAAY;AAC1F,WAAO,IAAI,SAAS,MAAM;AAAA,MACtB,QAAQ;AAAA,MACR,SAAS;AAAA,QACL,UAAU;AAAA,QACV,cAAc,GAAG,qBAAqB;AAAA,MAC1C;AAAA,IACJ,CAAC;AAAA,EACL;AAEA,WAAS,mBAAmB;AACxB,UAAM,QAAQ,YAAY;AAC1B,UAAM,gBACF,iBAAiB,IAAI,4CAA4C,cAAc,YAAY,QAAQ;AACvG,WAAO,IAAI,SAAS,MAAM;AAAA,MACtB,QAAQ;AAAA,MACR,SAAS;AAAA,QACL,UAAU;AAAA,QACV,cAAc,GAAG,qBAAqB;AAAA,MAC1C;AAAA,IACJ,CAAC;AAAA,EACL;AAEA,WAAe,mBAAmB,KAAkB;AAAA;AA7JxD;AA8JQ,YAAM,cAAa,SAAI,QAAQ,IAAI,iBAAiB,MAAjC,mBAAoC;AACvD,UAAI,CAAC,cAAc,WAAW,WAAW,IAAI;AACzC,gBAAQ,IAAI,sBAAsB;AAClC,eAAO,IAAI,SAAS,MAAM,EAAC,QAAQ,KAAK,SAAS,EAAC,UAAU,WAAU,EAAC,CAAC;AAAA,MAC5E;AAEA,YAAM,cAAc,IAAI,QAAQ;AAChC,YAAM,QAAQ,YAAY,IAAI,OAAO;AACrC,YAAM,OAAO,YAAY,IAAI,MAAM;AACnC,UAAI,UAAU,YAAY;AACtB,gBAAQ,IAAI,+CAA+C;AAC3D,eAAO,IAAI,SAAS,MAAM,EAAC,QAAQ,KAAK,SAAS,EAAC,UAAU,WAAU,EAAC,CAAC;AAAA,MAC5E;AAEA,YAAM,mBAAmB;AAAA,QACrB,cAAc;AAAA,QACd;AAAA,MACJ;AACA,YAAM,MAAM,GAAG;AACf,YAAM,WAAW,MAAM,MAAM,KAAK;AAAA,QAC9B,QAAQ;AAAA,QACR,MAAM,KAAK,UAAU,gBAAgB;AAAA,QACrC,SAAS;AAAA,UACL,gBAAgB;AAAA,UAChB,eAAe,YAAY;AAAA,QAC/B;AAAA,MACJ,CAAC;AAED,UAAI,SAAS,IAAI;AACb,cAAM,OAAO,MAAM,SAAS,KAAK;AAEjC,cAAM,cAAc,KAAK;AACzB,cAAM,OAAO,MAAM,oBAAoB,WAAW;AAClD,cAAM,QAAO,6BAAM,2BAA0B,KAAK,wBAAwB,MAAM,GAAG,IAAI;AACvF,YAAI,CAAC,MAAM;AACP,kBAAQ,IAAI,oCAAoC;AAChD,iBAAO,IAAI,SAAS,oBAAoB,EAAC,QAAQ,IAAG,CAAC;AAAA,QACzD;AAEA,cAAMA,WAAU,IAAI,QAAQ;AAC5B,QAAAA,SAAQ,OAAO,YAAY,IAAI;AAC/B,QAAAA,SAAQ,OAAO,cAAc,GAAG,4BAA4B,qDAAqD;AACjH,QAAAA,SAAQ,OAAO,cAAc,GAAG,6BAA6B,KAAK,uDAAuD;AACzH,eAAO,IAAI,SAAS,MAAM;AAAA,UACtB,QAAQ;AAAA,UACR,SAAAA;AAAA,QACJ,CAAC;AAAA,MACL,WAAW,SAAS,WAAW,KAAK;AAChC,eAAO,IAAI,SAAS,oBAAoB,EAAC,QAAQ,IAAG,CAAC;AAAA,MACzD,OAAO;AACH,eAAO,IAAI,SAAS,oBAAoB,EAAC,QAAQ,IAAG,CAAC;AAAA,MACzD;AAAA,IACJ;AAAA;AAEA,WAAe,mBAAmB,KAAkB;AAAA;AApNxD;AAqNQ,YAAM,cAAc,IAAI,QAAQ,IAAI,8BAA8B,OAAK,SAAI,QAAQ,IAAI,wBAAwB,MAAxC,mBAA2C;AAClH,UAAI,aAAa;AACb,cAAM,OAAO,GAAG;AAChB,cAAM,WAAW,MAAM,MAAM,MAAM;AAAA,UAC/B,SAAS;AAAA,YACL,gBAAgB;AAAA,YAChB,iBAAiB,YAAY;AAAA,UACjC;AAAA,QACJ,CAAC;AACD,YAAI,SAAS,IAAI;AACb,gBAAM,OAAO,MAAM,SAAS,KAAK;AAEjC,gBAAM,OAAO,IAAI;AAAA,YACb,KAAK;AAAA,YACL,KAAK;AAAA,YACL,uBAAuB,KAAK,kBAAkB;AAAA,YAC9C,KAAK;AAAA,YACL,KAAK;AAAA,YACL,KAAK;AAAA,YACL,KAAK;AAAA,YACL,KAAK;AAAA,UACT;AAEA,iBAAO,IAAI,SAAS,KAAK,UAAU,IAAI,GAAG;AAAA,YACtC,QAAQ;AAAA,YACR,SAAS;AAAA,cACL,gBAAgB;AAAA,YACpB;AAAA,UACJ,CAAC;AAAA,QACL,WAAW,SAAS,WAAW,KAAK;AAChC,iBAAO,IAAI,SAAS,MAAM,EAAC,QAAQ,IAAG,CAAC;AAAA,QAC3C,OAAO;AACH,iBAAO,IAAI,SAAS,MAAM,EAAC,QAAQ,IAAG,CAAC;AAAA,QAC3C;AAAA,MACJ;AACA,aAAO,IAAI,SAAS,MAAM,EAAC,QAAQ,IAAG,CAAC;AAAA,IAC3C;AAAA;AAEA,WAAe,kBAAkB,KAAkB;AAAA;AA3PvD;AA4PQ,YAAM,iBAAgB,SAAI,QAAQ,IAAI,yBAAyB,MAAzC,mBAA4C;AAClE,UAAI,CAAC,eAAe;AAChB,cAAMA,WAAU,IAAI,QAAQ;AAC5B,QAAAA,SAAQ,OAAO,cAAc,GAAG,8EAA8E;AAC9G,QAAAA,SAAQ,OAAO,cAAc,GAAG,+EAA+E;AAC/G,eAAO,IAAI,SAAS,MAAM,EAAC,QAAQ,KAAK,SAAAA,SAAO,CAAC;AAAA,MACpD;AAEA,YAAM,aAAa,EAAC,cAAa;AACjC,YAAM,MAAM,GAAG;AACf,YAAM,WAAW,MAAM,MAAM,KAAK;AAAA,QAC9B,QAAQ;AAAA,QACR,MAAM,KAAK,UAAU,UAAU;AAAA,QAC/B,SAAS;AAAA,UACL,gBAAgB;AAAA,UAChB,eAAe,YAAY;AAAA,QAC/B;AAAA,MACJ,CAAC;AAED,UAAI,CAAC,SAAS,IAAI;AACd,gBAAQ;AAAA,UACJ;AAAA,UACA,SAAS;AAAA,UACT,SAAS;AAAA,QACb;AAAA,MACJ;AACA,YAAMA,WAAU,IAAI,QAAQ;AAC5B,MAAAA,SAAQ,OAAO,cAAc,GAAG,8EAA8E;AAC9G,MAAAA,SAAQ,OAAO,cAAc,GAAG,+EAA+E;AAC/G,aAAO,IAAI,SAAS,MAAM,EAAC,QAAQ,KAAK,SAAAA,SAAO,CAAC;AAAA,IACpD;AAAA;AAEA,WAAS,gBAAgB,KAAkB,EAAC,OAAM,GAAiC;AAC/E,QAAI,OAAO,SAAS,SAAS;AACzB,aAAO,gBAAgB;AAAA,IAC3B,WAAW,OAAO,SAAS,UAAU;AACjC,aAAO,iBAAiB;AAAA,IAC5B,WAAW,OAAO,SAAS,YAAY;AACnC,aAAO,mBAAmB,GAAG;AAAA,IACjC,WAAW,OAAO,SAAS,YAAY;AACnC,aAAO,mBAAmB,GAAG;AAAA,IACjC,OAAO;AACH,aAAO,IAAI,SAAS,IAAI,EAAC,QAAQ,IAAG,CAAC;AAAA,IACzC;AAAA,EACJ;AAEA,WAAS,iBAAiB,KAAkB,EAAC,OAAM,GAAiC;AAChF,QAAI,OAAO,SAAS,UAAU;AAC1B,aAAO,kBAAkB,GAAG;AAAA,IAChC,OAAO;AACH,aAAO,IAAI,SAAS,IAAI,EAAC,QAAQ,IAAG,CAAC;AAAA,IACzC;AAAA,EACJ;AAEA,SAAO;AAAA,IACH;AAAA,IACA;AAAA,EACJ;AACJ;AAEA,SAAS,cAAsB;AAC3B,QAAM,cAAc,OAAO,gBAAgB,IAAI,WAAW,EAAE,CAAC;AAC7D,SAAO,MAAM,KAAK,WAAW,EACxB,IAAI,CAAC,MAAM,EAAE,SAAS,EAAE,EAAE,SAAS,GAAG,GAAG,CAAC,EAC1C,KAAK,EAAE;AAChB;","names":["headers","response"]}
|
package/dist/server/index.d.ts
CHANGED
@@ -1,6 +1,3 @@
|
|
1
|
-
import { NextRequest } from 'next/server';
|
2
|
-
import { GetServerSidePropsContext } from 'next';
|
3
|
-
|
4
1
|
declare class User {
|
5
2
|
userId: string;
|
6
3
|
orgIdToOrgMemberInfo?: OrgIdToOrgMemberInfo;
|
@@ -43,6 +40,9 @@ declare class OrgMemberInfo {
|
|
43
40
|
get permissions(): string[];
|
44
41
|
}
|
45
42
|
|
43
|
+
declare function validateAccessTokenOrUndefined(accessToken: string | undefined): Promise<User | undefined>;
|
44
|
+
declare function validateAccessToken(accessToken: string | undefined): Promise<User>;
|
45
|
+
|
46
46
|
declare class UnauthorizedException extends Error {
|
47
47
|
readonly message: string;
|
48
48
|
readonly status: number;
|
@@ -54,43 +54,4 @@ declare class ConfigurationException extends Error {
|
|
54
54
|
constructor(message: string);
|
55
55
|
}
|
56
56
|
|
57
|
-
|
58
|
-
getUser: () => Promise<User | undefined>;
|
59
|
-
getUserOrRedirect: () => Promise<User>;
|
60
|
-
getUserFromServerSideProps: (context: GetServerSidePropsContext) => Promise<User | undefined>;
|
61
|
-
validateAccessToken: (accessToken: string) => Promise<User>;
|
62
|
-
validateAccessTokenOrUndefined: (accessToken: string) => Promise<User | undefined>;
|
63
|
-
getRouteHandler: (req: NextRequest, { params }: {
|
64
|
-
params: {
|
65
|
-
slug: string;
|
66
|
-
};
|
67
|
-
}) => Response | Promise<Response>;
|
68
|
-
postRouteHandler: (req: NextRequest, { params }: {
|
69
|
-
params: {
|
70
|
-
slug: string;
|
71
|
-
};
|
72
|
-
}) => Response | Promise<Response>;
|
73
|
-
authMiddleware: (req: NextRequest) => Promise<Response>;
|
74
|
-
};
|
75
|
-
|
76
|
-
type InitializeAuthOptions = {
|
77
|
-
authUrl: string;
|
78
|
-
redirectUri: string;
|
79
|
-
integrationApiKey: string;
|
80
|
-
verifierKey: string;
|
81
|
-
postLoginRedirectPathFn?: (user: User) => string;
|
82
|
-
};
|
83
|
-
declare function initializeAuth(opts: InitializeAuthOptions): ServerActions;
|
84
|
-
|
85
|
-
type LoggedInProps = {
|
86
|
-
loading: false;
|
87
|
-
isLoggedIn: true;
|
88
|
-
user: User;
|
89
|
-
};
|
90
|
-
type LoggedOutProps = {
|
91
|
-
loading: false;
|
92
|
-
isLoggedIn: false;
|
93
|
-
user: undefined;
|
94
|
-
};
|
95
|
-
|
96
|
-
export { ConfigurationException, InitializeAuthOptions, LoggedInProps, LoggedOutProps, OrgIdToOrgMemberInfo, OrgMemberInfo, ServerActions, UnauthorizedException, User, initializeAuth };
|
57
|
+
export { ConfigurationException, OrgIdToOrgMemberInfo, OrgMemberInfo, UnauthorizedException, User, validateAccessToken, validateAccessTokenOrUndefined };
|
package/dist/server/index.js
CHANGED
@@ -54,7 +54,8 @@ __export(server_exports, {
|
|
54
54
|
OrgMemberInfo: () => OrgMemberInfo,
|
55
55
|
UnauthorizedException: () => UnauthorizedException,
|
56
56
|
User: () => User,
|
57
|
-
|
57
|
+
validateAccessToken: () => validateAccessToken,
|
58
|
+
validateAccessTokenOrUndefined: () => validateAccessTokenOrUndefined
|
58
59
|
});
|
59
60
|
module.exports = __toCommonJS(server_exports);
|
60
61
|
|
@@ -214,436 +215,67 @@ var ConfigurationException = class extends Error {
|
|
214
215
|
}
|
215
216
|
};
|
216
217
|
|
217
|
-
// src/server/
|
218
|
+
// src/server/shared.ts
|
218
219
|
var jose = __toESM(require("jose"));
|
219
|
-
|
220
|
-
|
221
|
-
|
222
|
-
|
223
|
-
var CALLBACK_PATH = "/api/auth/callback";
|
224
|
-
var USERINFO_PATH = "/api/auth/userinfo";
|
225
|
-
var LOGOUT_PATH = "/api/auth/logout";
|
226
|
-
var ACCESS_TOKEN_COOKIE_NAME = "__pa_at";
|
227
|
-
var REFRESH_TOKEN_COOKIE_NAME = "__pa_rt";
|
228
|
-
var STATE_COOKIE_NAME = "__pa_state";
|
229
|
-
var CUSTOM_HEADER_FOR_ACCESS_TOKEN = "x-propelauth-access-token";
|
230
|
-
var COOKIE_OPTIONS = {
|
231
|
-
httpOnly: true,
|
232
|
-
sameSite: "lax",
|
233
|
-
secure: true,
|
234
|
-
path: "/"
|
235
|
-
};
|
236
|
-
function getServerActions({
|
237
|
-
authUrlOrigin,
|
238
|
-
postLoginPathFn,
|
239
|
-
verifierKey,
|
240
|
-
integrationApiKey,
|
241
|
-
redirectUri
|
242
|
-
}) {
|
243
|
-
const publicKeyPromise = jose.importSPKI(verifierKey, "RS256");
|
244
|
-
function getUserOrRedirect() {
|
245
|
-
return __async(this, null, function* () {
|
246
|
-
const user = yield getUser();
|
247
|
-
if (user) {
|
248
|
-
return user;
|
249
|
-
} else {
|
250
|
-
(0, import_navigation.redirect)(LOGIN_PATH);
|
251
|
-
throw new Error("Redirecting to login");
|
252
|
-
}
|
253
|
-
});
|
220
|
+
function getAuthUrlOrigin() {
|
221
|
+
const authUrl = process.env.NEXT_PUBLIC_AUTH_URL;
|
222
|
+
if (!authUrl) {
|
223
|
+
throw new Error("NEXT_PUBLIC_AUTH_URL is not set");
|
254
224
|
}
|
255
|
-
|
256
|
-
|
257
|
-
|
258
|
-
|
259
|
-
|
260
|
-
|
261
|
-
if (user) {
|
262
|
-
return user;
|
263
|
-
}
|
264
|
-
}
|
265
|
-
return void 0;
|
266
|
-
});
|
225
|
+
return new URL(authUrl).origin;
|
226
|
+
}
|
227
|
+
function getVerifierKey() {
|
228
|
+
const verifierKey = process.env.VERIFIER_KEY;
|
229
|
+
if (!verifierKey) {
|
230
|
+
throw new Error("VERIFIER_KEY is not set");
|
267
231
|
}
|
268
|
-
|
269
|
-
|
270
|
-
|
271
|
-
|
272
|
-
|
273
|
-
|
274
|
-
|
275
|
-
|
276
|
-
|
277
|
-
|
278
|
-
|
279
|
-
|
280
|
-
|
281
|
-
|
282
|
-
} else if (response.error === "unauthorized") {
|
283
|
-
const headers2 = new Headers();
|
284
|
-
headers2.append("Set-Cookie", `${ACCESS_TOKEN_COOKIE_NAME}=; Path=/; HttpOnly; Secure; SameSite=Lax; Max-Age=0`);
|
285
|
-
headers2.append("Set-Cookie", `${REFRESH_TOKEN_COOKIE_NAME}=; Path=/; HttpOnly; Secure; SameSite=Lax; Max-Age=0`);
|
286
|
-
return new Response("Unauthorized", { status: 401, headers: headers2 });
|
287
|
-
} else {
|
288
|
-
const headers2 = new Headers(req.headers);
|
289
|
-
headers2.append(CUSTOM_HEADER_FOR_ACCESS_TOKEN, response.accessToken);
|
290
|
-
const nextResponse = import_server.NextResponse.next({
|
291
|
-
request: {
|
292
|
-
headers: headers2
|
293
|
-
}
|
294
|
-
});
|
295
|
-
nextResponse.cookies.set(ACCESS_TOKEN_COOKIE_NAME, response.accessToken, COOKIE_OPTIONS);
|
296
|
-
nextResponse.cookies.set(REFRESH_TOKEN_COOKIE_NAME, response.refreshToken, COOKIE_OPTIONS);
|
297
|
-
return nextResponse;
|
298
|
-
}
|
299
|
-
}
|
300
|
-
if (accessToken) {
|
301
|
-
const user = yield validateAccessTokenOrUndefined(accessToken);
|
302
|
-
if (user) {
|
303
|
-
return import_server.NextResponse.next();
|
304
|
-
}
|
305
|
-
}
|
306
|
-
if (refreshToken) {
|
307
|
-
const response = yield refreshTokenWithAccessAndRefreshToken(refreshToken);
|
308
|
-
if (response.error === "unexpected") {
|
309
|
-
throw new Error("Unexpected error while refreshing access token");
|
310
|
-
} else if (response.error === "unauthorized") {
|
311
|
-
const response2 = import_server.NextResponse.next();
|
312
|
-
response2.cookies.delete(ACCESS_TOKEN_COOKIE_NAME);
|
313
|
-
response2.cookies.delete(REFRESH_TOKEN_COOKIE_NAME);
|
314
|
-
return response2;
|
315
|
-
} else {
|
316
|
-
const headers2 = new Headers(req.headers);
|
317
|
-
headers2.append(CUSTOM_HEADER_FOR_ACCESS_TOKEN, response.accessToken);
|
318
|
-
const nextResponse = import_server.NextResponse.next({
|
319
|
-
request: {
|
320
|
-
headers: headers2
|
321
|
-
}
|
322
|
-
});
|
323
|
-
nextResponse.cookies.set(ACCESS_TOKEN_COOKIE_NAME, response.accessToken, COOKIE_OPTIONS);
|
324
|
-
nextResponse.cookies.set(REFRESH_TOKEN_COOKIE_NAME, response.refreshToken, COOKIE_OPTIONS);
|
325
|
-
return nextResponse;
|
326
|
-
}
|
232
|
+
return verifierKey.replace(/\\n/g, "\n");
|
233
|
+
}
|
234
|
+
function validateAccessTokenOrUndefined(accessToken) {
|
235
|
+
return __async(this, null, function* () {
|
236
|
+
try {
|
237
|
+
return yield validateAccessToken(accessToken);
|
238
|
+
} catch (err) {
|
239
|
+
if (err instanceof ConfigurationException) {
|
240
|
+
throw err;
|
241
|
+
} else if (err instanceof UnauthorizedException) {
|
242
|
+
return void 0;
|
243
|
+
} else {
|
244
|
+
console.log("Error validating access token", err);
|
245
|
+
return void 0;
|
327
246
|
}
|
328
|
-
return import_server.NextResponse.next();
|
329
|
-
});
|
330
|
-
}
|
331
|
-
function getRouteHandler(req, { params }) {
|
332
|
-
if (params.slug === "login") {
|
333
|
-
return loginGetHandler();
|
334
|
-
} else if (params.slug === "signup") {
|
335
|
-
return signupGetHandler();
|
336
|
-
} else if (params.slug === "callback") {
|
337
|
-
return callbackGetHandler(req);
|
338
|
-
} else if (params.slug === "userinfo") {
|
339
|
-
return userinfoGetHandler(req);
|
340
|
-
} else {
|
341
|
-
return new Response("", { status: 404 });
|
342
247
|
}
|
343
|
-
}
|
344
|
-
|
345
|
-
|
346
|
-
|
347
|
-
|
348
|
-
|
248
|
+
});
|
249
|
+
}
|
250
|
+
function validateAccessToken(accessToken) {
|
251
|
+
return __async(this, null, function* () {
|
252
|
+
let publicKey;
|
253
|
+
try {
|
254
|
+
publicKey = yield jose.importSPKI(getVerifierKey(), "RS256");
|
255
|
+
} catch (err) {
|
256
|
+
console.error("Verifier key is invalid. Make sure it's specified correctly, including the newlines.", err);
|
257
|
+
throw new ConfigurationException("Invalid verifier key");
|
349
258
|
}
|
350
|
-
|
351
|
-
|
352
|
-
|
353
|
-
|
354
|
-
|
355
|
-
|
356
|
-
|
357
|
-
|
358
|
-
|
359
|
-
|
360
|
-
|
361
|
-
}
|
362
|
-
function signupGetHandler() {
|
363
|
-
const state = randomState();
|
364
|
-
const authorize_url = authUrlOrigin + "/propelauth/ssr/authorize?redirect_uri=" + redirectUri + "&state=" + state + "&signup=true";
|
365
|
-
return new Response(null, {
|
366
|
-
status: 302,
|
367
|
-
headers: {
|
368
|
-
Location: authorize_url,
|
369
|
-
"Set-Cookie": `${STATE_COOKIE_NAME}=${state}; Path=/; HttpOnly; Secure; SameSite=Lax`
|
370
|
-
}
|
371
|
-
});
|
372
|
-
}
|
373
|
-
function callbackGetHandler(req) {
|
374
|
-
return __async(this, null, function* () {
|
375
|
-
var _a;
|
376
|
-
const oauthState = (_a = req.cookies.get(STATE_COOKIE_NAME)) == null ? void 0 : _a.value;
|
377
|
-
if (!oauthState || oauthState.length !== 64) {
|
378
|
-
console.log("No oauth state found");
|
379
|
-
return new Response(null, { status: 302, headers: { Location: LOGIN_PATH } });
|
380
|
-
}
|
381
|
-
const queryParams = req.nextUrl.searchParams;
|
382
|
-
const state = queryParams.get("state");
|
383
|
-
const code = queryParams.get("code");
|
384
|
-
if (state !== oauthState) {
|
385
|
-
console.log("Mismatch between states, redirecting to login");
|
386
|
-
return new Response(null, { status: 302, headers: { Location: LOGIN_PATH } });
|
387
|
-
}
|
388
|
-
const oauth_token_body = {
|
389
|
-
redirect_uri: redirectUri,
|
390
|
-
code
|
391
|
-
};
|
392
|
-
const url = `${authUrlOrigin}/propelauth/ssr/token`;
|
393
|
-
const response = yield fetch(url, {
|
394
|
-
method: "POST",
|
395
|
-
body: JSON.stringify(oauth_token_body),
|
396
|
-
headers: {
|
397
|
-
"Content-Type": "application/json",
|
398
|
-
Authorization: "Bearer " + integrationApiKey
|
399
|
-
}
|
400
|
-
});
|
401
|
-
if (response.ok) {
|
402
|
-
const data = yield response.json();
|
403
|
-
const accessToken = data.access_token;
|
404
|
-
const user = yield validateAccessToken(accessToken);
|
405
|
-
const path = postLoginPathFn(user);
|
406
|
-
if (!path) {
|
407
|
-
console.log("postLoginPathFn returned undefined");
|
408
|
-
return new Response("Unexpected error", { status: 500 });
|
409
|
-
}
|
410
|
-
const headers2 = new Headers();
|
411
|
-
headers2.append("Location", path);
|
412
|
-
headers2.append("Set-Cookie", `${ACCESS_TOKEN_COOKIE_NAME}=${accessToken}; Path=/; HttpOnly; Secure; SameSite=Lax`);
|
413
|
-
headers2.append("Set-Cookie", `${REFRESH_TOKEN_COOKIE_NAME}=${data.refresh_token}; Path=/; HttpOnly; Secure; SameSite=Lax`);
|
414
|
-
return new Response(null, {
|
415
|
-
status: 302,
|
416
|
-
headers: headers2
|
417
|
-
});
|
418
|
-
} else if (response.status === 401) {
|
419
|
-
return new Response("Unexpected error", { status: 500 });
|
420
|
-
} else {
|
421
|
-
return new Response("Unexpected error", { status: 500 });
|
422
|
-
}
|
423
|
-
});
|
424
|
-
}
|
425
|
-
function userinfoGetHandler(req) {
|
426
|
-
return __async(this, null, function* () {
|
427
|
-
var _a;
|
428
|
-
const accessToken = req.headers.get(CUSTOM_HEADER_FOR_ACCESS_TOKEN) || ((_a = req.cookies.get(ACCESS_TOKEN_COOKIE_NAME)) == null ? void 0 : _a.value);
|
429
|
-
if (accessToken) {
|
430
|
-
const path = `${authUrlOrigin}/propelauth/oauth/userinfo`;
|
431
|
-
const response = yield fetch(path, {
|
432
|
-
headers: {
|
433
|
-
"Content-Type": "application/json",
|
434
|
-
"Authorization": "Bearer " + accessToken
|
435
|
-
}
|
436
|
-
});
|
437
|
-
if (response.ok) {
|
438
|
-
const data = yield response.json();
|
439
|
-
const user = new User(
|
440
|
-
data.user_id,
|
441
|
-
data.email,
|
442
|
-
toOrgIdToOrgMemberInfo(data.org_id_to_org_info),
|
443
|
-
data.first_name,
|
444
|
-
data.last_name,
|
445
|
-
data.username,
|
446
|
-
data.legacy_user_id,
|
447
|
-
data.impersonator_user_id
|
448
|
-
);
|
449
|
-
return new Response(JSON.stringify(user), {
|
450
|
-
status: 200,
|
451
|
-
headers: {
|
452
|
-
"Content-Type": "application/json"
|
453
|
-
}
|
454
|
-
});
|
455
|
-
} else if (response.status === 401) {
|
456
|
-
return new Response(null, { status: 401 });
|
457
|
-
} else {
|
458
|
-
return new Response(null, { status: 500 });
|
459
|
-
}
|
460
|
-
}
|
461
|
-
return new Response(null, { status: 401 });
|
462
|
-
});
|
463
|
-
}
|
464
|
-
function getUserFromServerSideProps(props) {
|
465
|
-
return __async(this, null, function* () {
|
466
|
-
const accessToken = props.req.cookies[ACCESS_TOKEN_COOKIE_NAME];
|
467
|
-
const refreshToken = props.req.cookies[REFRESH_TOKEN_COOKIE_NAME];
|
468
|
-
if (accessToken) {
|
469
|
-
const user = yield validateAccessTokenOrUndefined(accessToken);
|
470
|
-
if (user) {
|
471
|
-
return user;
|
472
|
-
}
|
473
|
-
}
|
474
|
-
if (refreshToken) {
|
475
|
-
const response = yield refreshTokenWithAccessAndRefreshToken(refreshToken);
|
476
|
-
if (response.error === "unexpected") {
|
477
|
-
throw new Error("Unexpected error while refreshing access token");
|
478
|
-
} else if (response.error === "unauthorized") {
|
479
|
-
props.res.setHeader("Set-Cookie", [
|
480
|
-
`${ACCESS_TOKEN_COOKIE_NAME}=; Path=/; HttpOnly; Secure; SameSite=Lax; Max-Age=0`,
|
481
|
-
`${REFRESH_TOKEN_COOKIE_NAME}=; Path=/; HttpOnly; Secure; SameSite=Lax; Max-Age=0`
|
482
|
-
]);
|
483
|
-
return void 0;
|
484
|
-
} else {
|
485
|
-
const user = yield validateAccessToken(response.accessToken);
|
486
|
-
props.res.setHeader("Set-Cookie", [
|
487
|
-
`${ACCESS_TOKEN_COOKIE_NAME}=${response.accessToken}; Path=/; HttpOnly; Secure; SameSite=Lax`,
|
488
|
-
`${REFRESH_TOKEN_COOKIE_NAME}=${response.refreshToken}; Path=/; HttpOnly; Secure; SameSite=Lax`
|
489
|
-
]);
|
490
|
-
return user;
|
491
|
-
}
|
492
|
-
}
|
493
|
-
return void 0;
|
494
|
-
});
|
495
|
-
}
|
496
|
-
function refreshTokenWithAccessAndRefreshToken(refreshToken) {
|
497
|
-
return __async(this, null, function* () {
|
498
|
-
const body = {
|
499
|
-
refresh_token: refreshToken
|
500
|
-
};
|
501
|
-
const url = `${authUrlOrigin}/api/backend/v1/refresh_token`;
|
502
|
-
const response = yield fetch(url, {
|
503
|
-
method: "POST",
|
504
|
-
body: JSON.stringify(body),
|
505
|
-
headers: {
|
506
|
-
"Content-Type": "application/json",
|
507
|
-
Authorization: "Bearer " + integrationApiKey
|
508
|
-
}
|
259
|
+
if (!accessToken) {
|
260
|
+
throw new UnauthorizedException("No access token provided");
|
261
|
+
}
|
262
|
+
let accessTokenWithoutBearer = accessToken;
|
263
|
+
if (accessToken.toLowerCase().startsWith("bearer ")) {
|
264
|
+
accessTokenWithoutBearer = accessToken.substring("bearer ".length);
|
265
|
+
}
|
266
|
+
try {
|
267
|
+
const { payload } = yield jose.jwtVerify(accessTokenWithoutBearer, publicKey, {
|
268
|
+
issuer: getAuthUrlOrigin(),
|
269
|
+
algorithms: ["RS256"]
|
509
270
|
});
|
510
|
-
|
511
|
-
|
512
|
-
|
513
|
-
|
514
|
-
access_token: accessToken,
|
515
|
-
expires_at_seconds: expiresAtSeconds
|
516
|
-
} = data.access_token;
|
517
|
-
return {
|
518
|
-
refreshToken: newRefreshToken,
|
519
|
-
accessToken,
|
520
|
-
error: "none"
|
521
|
-
};
|
522
|
-
} else if (response.status === 400) {
|
523
|
-
return { error: "unauthorized" };
|
271
|
+
return toUser(payload);
|
272
|
+
} catch (e) {
|
273
|
+
if (e instanceof Error) {
|
274
|
+
throw new UnauthorizedException(e.message);
|
524
275
|
} else {
|
525
|
-
|
526
|
-
}
|
527
|
-
});
|
528
|
-
}
|
529
|
-
function logoutPostHandler(req) {
|
530
|
-
return __async(this, null, function* () {
|
531
|
-
var _a;
|
532
|
-
const refresh_token = (_a = req.cookies.get(REFRESH_TOKEN_COOKIE_NAME)) == null ? void 0 : _a.value;
|
533
|
-
if (!refresh_token) {
|
534
|
-
const headers3 = new Headers();
|
535
|
-
headers3.append("Set-Cookie", `${ACCESS_TOKEN_COOKIE_NAME}=; Path=/; HttpOnly; Secure; SameSite=Lax; Max-Age=0`);
|
536
|
-
headers3.append("Set-Cookie", `${REFRESH_TOKEN_COOKIE_NAME}=; Path=/; HttpOnly; Secure; SameSite=Lax; Max-Age=0`);
|
537
|
-
return new Response(null, { status: 200, headers: headers3 });
|
538
|
-
}
|
539
|
-
const logoutBody = { refresh_token };
|
540
|
-
const url = `${authUrlOrigin}/api/backend/v1/logout`;
|
541
|
-
const response = yield fetch(url, {
|
542
|
-
method: "POST",
|
543
|
-
body: JSON.stringify(logoutBody),
|
544
|
-
headers: {
|
545
|
-
"Content-Type": "application/json",
|
546
|
-
Authorization: "Bearer " + integrationApiKey
|
547
|
-
}
|
548
|
-
});
|
549
|
-
if (!response.ok) {
|
550
|
-
console.log(
|
551
|
-
"Unable to logout, clearing cookies and continuing anyway",
|
552
|
-
response.status,
|
553
|
-
response.statusText
|
554
|
-
);
|
555
|
-
}
|
556
|
-
const headers2 = new Headers();
|
557
|
-
headers2.append("Set-Cookie", `${ACCESS_TOKEN_COOKIE_NAME}=; Path=/; HttpOnly; Secure; SameSite=Lax; Max-Age=0`);
|
558
|
-
headers2.append("Set-Cookie", `${REFRESH_TOKEN_COOKIE_NAME}=; Path=/; HttpOnly; Secure; SameSite=Lax; Max-Age=0`);
|
559
|
-
return new Response(null, { status: 200, headers: headers2 });
|
560
|
-
});
|
561
|
-
}
|
562
|
-
function validateAccessTokenOrUndefined(accessToken) {
|
563
|
-
return __async(this, null, function* () {
|
564
|
-
try {
|
565
|
-
return yield validateAccessToken(accessToken);
|
566
|
-
} catch (err) {
|
567
|
-
if (err instanceof ConfigurationException) {
|
568
|
-
throw err;
|
569
|
-
} else if (err instanceof UnauthorizedException) {
|
570
|
-
return void 0;
|
571
|
-
} else {
|
572
|
-
console.log("Error validating access token", err);
|
573
|
-
return void 0;
|
574
|
-
}
|
575
|
-
}
|
576
|
-
});
|
577
|
-
}
|
578
|
-
function validateAccessToken(accessToken) {
|
579
|
-
return __async(this, null, function* () {
|
580
|
-
let publicKey;
|
581
|
-
try {
|
582
|
-
publicKey = yield publicKeyPromise;
|
583
|
-
} catch (err) {
|
584
|
-
console.error("Verifier key is invalid. Make sure it's specified correctly, including the newlines.", err);
|
585
|
-
throw new ConfigurationException("Invalid verifier key");
|
586
|
-
}
|
587
|
-
if (!accessToken) {
|
588
|
-
throw new UnauthorizedException("No access token provided");
|
276
|
+
throw new UnauthorizedException("Unable to decode jwt");
|
589
277
|
}
|
590
|
-
|
591
|
-
if (accessToken.toLowerCase().startsWith("bearer ")) {
|
592
|
-
accessTokenWithoutBearer = accessToken.substring("bearer ".length);
|
593
|
-
}
|
594
|
-
try {
|
595
|
-
const { payload } = yield jose.jwtVerify(accessTokenWithoutBearer, publicKey, {
|
596
|
-
issuer: authUrlOrigin,
|
597
|
-
algorithms: ["RS256"]
|
598
|
-
});
|
599
|
-
return toUser(payload);
|
600
|
-
} catch (e) {
|
601
|
-
if (e instanceof Error) {
|
602
|
-
throw new UnauthorizedException(e.message);
|
603
|
-
} else {
|
604
|
-
throw new UnauthorizedException("Unable to decode jwt");
|
605
|
-
}
|
606
|
-
}
|
607
|
-
});
|
608
|
-
}
|
609
|
-
return {
|
610
|
-
getUser,
|
611
|
-
getUserOrRedirect,
|
612
|
-
getUserFromServerSideProps,
|
613
|
-
validateAccessToken,
|
614
|
-
validateAccessTokenOrUndefined,
|
615
|
-
getRouteHandler,
|
616
|
-
postRouteHandler,
|
617
|
-
authMiddleware
|
618
|
-
};
|
619
|
-
}
|
620
|
-
function randomState() {
|
621
|
-
const randomBytes = crypto.getRandomValues(new Uint8Array(32));
|
622
|
-
return Array.from(randomBytes).map((b) => b.toString(16).padStart(2, "0")).join("");
|
623
|
-
}
|
624
|
-
|
625
|
-
// src/server/validators.ts
|
626
|
-
function validateAuthUrl(authUrl) {
|
627
|
-
try {
|
628
|
-
return new URL(authUrl);
|
629
|
-
} catch (e) {
|
630
|
-
console.error("Invalid authUrl", e);
|
631
|
-
throw new Error("Unable to initialize auth client");
|
632
|
-
}
|
633
|
-
}
|
634
|
-
|
635
|
-
// src/server/auth.ts
|
636
|
-
function initializeAuth(opts) {
|
637
|
-
const authUrl = validateAuthUrl(opts.authUrl).origin;
|
638
|
-
const postLoginPathFn = opts.postLoginRedirectPathFn || function() {
|
639
|
-
return "/";
|
640
|
-
};
|
641
|
-
return getServerActions({
|
642
|
-
authUrlOrigin: authUrl,
|
643
|
-
verifierKey: opts.verifierKey,
|
644
|
-
redirectUri: opts.redirectUri,
|
645
|
-
integrationApiKey: opts.integrationApiKey,
|
646
|
-
postLoginPathFn
|
278
|
+
}
|
647
279
|
});
|
648
280
|
}
|
649
281
|
// Annotate the CommonJS export names for ESM import in node:
|
@@ -652,6 +284,7 @@ function initializeAuth(opts) {
|
|
652
284
|
OrgMemberInfo,
|
653
285
|
UnauthorizedException,
|
654
286
|
User,
|
655
|
-
|
287
|
+
validateAccessToken,
|
288
|
+
validateAccessTokenOrUndefined
|
656
289
|
});
|
657
290
|
//# sourceMappingURL=index.js.map
|