@propelauth/nextjs 0.1.6 → 0.1.8

package/dist/server/index.mjs.map

@@ -1 +1 @@
-{"version":3,"sources":["../../src/loginMethod.ts","../../src/user.ts","../../src/server/exceptions.ts","../../src/server/shared.ts","../../src/server/api.ts"],"sourcesContent":["export enum SocialLoginProvider {\n    Google = 'Google',\n    GitHub = 'GitHub',\n    Microsoft = 'Microsoft',\n    Slack = 'Slack',\n    LinkedIn = 'LinkedIn',\n    Salesforce = 'Salesforce',\n    Xero = 'Xero',\n    QuickBooksOnline = 'QuickBooks Online',\n}\n\nexport enum SamlLoginProvider {\n    Google = 'Google',\n    Rippling = 'Rippling',\n    OneLogin = 'OneLogin',\n    JumpCloud = 'JumpCloud',\n    Okta = 'Okta',\n    Azure = 'Azure',\n    Duo = 'Duo',\n    Generic = 'Generic',\n}\n\ntype InternalPasswordLoginMethod = {\n    login_method: 'password'\n}\n\ntype InternalMagicLinkLoginMethod = {\n    login_method: 'magic_link'\n}\n\ntype InternalSocialSsoLoginMethod = {\n    login_method: 'social_sso'\n    provider: SocialLoginProvider\n}\n\ntype InternalEmailConfirmationLinkLoginMethod = {\n    login_method: 'email_confirmation_link'\n}\n\ntype InternalSamlSsoLoginMethod = {\n    login_method: 'saml_sso'\n    provider: SamlLoginProvider\n    org_id: string\n}\n\ntype InternalImpersonationLoginMethod = {\n    login_method: 'impersonation'\n}\n\ntype InternalGeneratedFromBackendApiLoginMethod = {\n    login_method: 'generated_from_backend_api'\n}\n\ntype InternalUnknownLoginMethod = {\n    login_method: 'unknown'\n}\n\nexport type InternalLoginMethod =\n    | InternalPasswordLoginMethod\n    | InternalMagicLinkLoginMethod\n    | InternalSocialSsoLoginMethod\n    | InternalEmailConfirmationLinkLoginMethod\n    | InternalSamlSsoLoginMethod\n    | InternalImpersonationLoginMethod\n    | InternalGeneratedFromBackendApiLoginMethod\n    | InternalUnknownLoginMethod\n\ntype PasswordLoginMethod = {\n    loginMethod: 'password'\n}\n\ntype MagicLinkLoginMethod = {\n    loginMethod: 'magic_link'\n}\n\ntype SocialSsoLoginMethod = {\n    loginMethod: 'social_sso'\n    provider: SocialLoginProvider\n}\n\ntype EmailConfirmationLinkLoginMethod = {\n    loginMethod: 'email_confirmation_link'\n}\n\ntype SamlSsoLoginMethod = {\n    loginMethod: 'saml_sso'\n    provider: SamlLoginProvider\n    orgId: string\n}\n\ntype ImpersonationLoginMethod = {\n    loginMethod: 'impersonation'\n}\n\ntype GeneratedFromBackendApiLoginMethod = {\n    loginMethod: 'generated_from_backend_api'\n}\n\ntype UnknownLoginMethod = {\n    loginMethod: 'unknown'\n}\n\nexport type LoginMethod =\n    | PasswordLoginMethod\n    | MagicLinkLoginMethod\n    | SocialSsoLoginMethod\n    | EmailConfirmationLinkLoginMethod\n    | SamlSsoLoginMethod\n    | ImpersonationLoginMethod\n    | GeneratedFromBackendApiLoginMethod\n    | UnknownLoginMethod\n\nexport function toLoginMethod(snake_case?: InternalLoginMethod): LoginMethod {\n    if (!snake_case) {\n        return { loginMethod: 'unknown' }\n    }\n\n    switch (snake_case.login_method) {\n        case 'password':\n            return { loginMethod: 'password' }\n        case 'magic_link':\n            return { loginMethod: 'magic_link' }\n        case 'social_sso':\n            return { loginMethod: 'social_sso', provider: snake_case.provider }\n        case 'email_confirmation_link':\n            return { loginMethod: 'email_confirmation_link' }\n        case 'saml_sso':\n            return { loginMethod: 'saml_sso', provider: snake_case.provider, orgId: snake_case.org_id }\n        case 'impersonation':\n            return { loginMethod: 'impersonation' }\n        case 'generated_from_backend_api':\n            return { loginMethod: 'generated_from_backend_api' }\n        default:\n            return { loginMethod: 'unknown' }\n    }\n}\n","import { InternalLoginMethod, LoginMethod, toLoginMethod } from './loginMethod'\n\nexport class UserFromToken {\n    public userId: string\n\n    public activeOrgId?: string\n    public orgIdToOrgMemberInfo?: OrgIdToOrgMemberInfo\n\n    // Metadata about the user\n    public email: string\n    public firstName?: string\n    public lastName?: string\n    public username?: string\n    public properties?: { [key: string]: unknown }\n    public loginMethod?: LoginMethod\n\n    // If you used our migration APIs to migrate this user from a different system,\n    //   this is their original ID from that system.\n    public legacyUserId?: string\n    public impersonatorUserId?: string\n\n    constructor(\n        userId: string,\n        email: string,\n        orgIdToOrgMemberInfo?: OrgIdToOrgMemberInfo,\n        firstName?: string,\n        lastName?: string,\n        username?: string,\n        legacyUserId?: string,\n        impersonatorUserId?: string,\n        properties?: { [key: string]: unknown },\n        activeOrgId?: string,\n        loginMethod?: LoginMethod\n    ) {\n        this.userId = userId\n\n        this.activeOrgId = activeOrgId\n        this.orgIdToOrgMemberInfo = orgIdToOrgMemberInfo\n\n        this.email = email\n        this.firstName = firstName\n        this.lastName = lastName\n        this.username = username\n\n        this.legacyUserId = legacyUserId\n        this.impersonatorUserId = impersonatorUserId\n\n        this.properties = properties\n        this.loginMethod = loginMethod\n    }\n\n    public getActiveOrg(): OrgMemberInfo | undefined {\n        if (!this.activeOrgId || !this.orgIdToOrgMemberInfo) {\n            return undefined\n        }\n\n        return this.orgIdToOrgMemberInfo[this.activeOrgId]\n    }\n\n    public getActiveOrgId(): string | undefined {\n        return this.activeOrgId\n    }\n\n    public getOrg(orgId: string): OrgMemberInfo | undefined {\n        if (!this.orgIdToOrgMemberInfo) {\n            return undefined\n        }\n\n        return this.orgIdToOrgMemberInfo[orgId]\n    }\n\n    public getOrgByName(orgName: string): OrgMemberInfo | undefined {\n        if (!this.orgIdToOrgMemberInfo) {\n            return undefined\n        }\n\n        const urlSafeOrgName = orgName.toLowerCase().replace(/ /g, '-')\n        for (const orgId in this.orgIdToOrgMemberInfo) {\n            const orgMemberInfo = this.orgIdToOrgMemberInfo[orgId]\n            if (orgMemberInfo.urlSafeOrgName === urlSafeOrgName) {\n                return orgMemberInfo\n            }\n        }\n\n        return undefined\n    }\n\n    public getOrgs(): OrgMemberInfo[] {\n        if (!this.orgIdToOrgMemberInfo) {\n            return []\n        }\n\n        return Object.values(this.orgIdToOrgMemberInfo)\n    }\n\n    public isImpersonating(): boolean {\n        return !!this.impersonatorUserId\n    }\n\n    public static fromJSON(json: string): UserFromToken {\n        const obj = JSON.parse(json)\n        const orgIdToOrgMemberInfo: OrgIdToOrgMemberInfo = {}\n        for (const orgId in obj.orgIdToOrgMemberInfo) {\n            orgIdToOrgMemberInfo[orgId] = OrgMemberInfo.fromJSON(JSON.stringify(obj.orgIdToOrgMemberInfo[orgId]))\n        }\n        return new UserFromToken(\n            obj.userId,\n            obj.email,\n            orgIdToOrgMemberInfo,\n            obj.firstName,\n            obj.lastName,\n            obj.username,\n            obj.legacyUserId,\n            obj.impersonatorUserId,\n            obj.properties,\n            obj.activeOrgId,\n            obj.loginMethod\n        )\n    }\n\n    public static fromJwtPayload(payload: InternalUser): UserFromToken {\n        let activeOrgId: string | undefined\n        let orgIdToOrgMemberInfo: OrgIdToOrgMemberInfo | undefined\n\n        if (payload.org_member_info) {\n            activeOrgId = payload.org_member_info.org_id\n            orgIdToOrgMemberInfo = toOrgIdToOrgMemberInfo({ [activeOrgId]: payload.org_member_info })\n        } else {\n            activeOrgId = undefined\n            orgIdToOrgMemberInfo = toOrgIdToOrgMemberInfo(payload.org_id_to_org_member_info)\n        }\n\n        const loginMethod = toLoginMethod(payload.login_method)\n\n        return new UserFromToken(\n            payload.user_id,\n            payload.email,\n            orgIdToOrgMemberInfo,\n            payload.first_name,\n            payload.last_name,\n            payload.username,\n            payload.legacy_user_id,\n            payload.impersonatorUserId,\n            payload.properties,\n            activeOrgId,\n            loginMethod\n        )\n    }\n}\n\nexport type OrgIdToOrgMemberInfo = {\n    [orgId: string]: OrgMemberInfo\n}\n\nexport enum OrgRoleStructure {\n    SingleRole = \"single_role_in_hierarchy\",\n    MultiRole = \"multi_role\",\n}\n\nexport class OrgMemberInfo {\n    public orgId: string\n    public orgName: string\n    public orgMetadata: { [key: string]: any }\n    public urlSafeOrgName: string\n    public orgRoleStructure: OrgRoleStructure\n\n    public userAssignedRole: string\n    public userInheritedRolesPlusCurrentRole: string[]\n    public userPermissions: string[]\n    public userAssignedAdditionalRoles: string[]\n\n    constructor(\n        orgId: string,\n        orgName: string,\n        orgMetadata: { [key: string]: any },\n        urlSafeOrgName: string,\n        userAssignedRole: string,\n        userInheritedRolesPlusCurrentRole: string[],\n        userPermissions: string[],\n        orgRoleStructure: OrgRoleStructure,\n        userAssignedAdditionalRoles: string[]\n    ) {\n        this.orgId = orgId\n        this.orgName = orgName\n        this.orgMetadata = orgMetadata\n        this.urlSafeOrgName = urlSafeOrgName\n        this.orgRoleStructure = orgRoleStructure\n\n        this.userAssignedRole = userAssignedRole\n        this.userInheritedRolesPlusCurrentRole = userInheritedRolesPlusCurrentRole\n        this.userPermissions = userPermissions\n        this.userAssignedAdditionalRoles = userAssignedAdditionalRoles\n    }\n\n    // validation methods\n\n    public isRole(role: string): boolean {\n        if (this.orgRoleStructure === OrgRoleStructure.MultiRole) {\n            return this.userAssignedRole === role || this.userAssignedAdditionalRoles.includes(role)\n        } else {\n            return this.userAssignedRole === role\n        }\n    }\n\n    public isAtLeastRole(role: string): boolean {\n        if (this.orgRoleStructure === OrgRoleStructure.MultiRole) {\n            return this.userAssignedRole === role || this.userAssignedAdditionalRoles.includes(role)\n        } else {\n            return this.userInheritedRolesPlusCurrentRole.includes(role)\n        }\n    }\n\n    public hasPermission(permission: string): boolean {\n        return this.userPermissions.includes(permission)\n    }\n\n    public hasAllPermissions(permissions: string[]): boolean {\n        return permissions.every((permission) => this.hasPermission(permission))\n    }\n\n    public static fromJSON(json: string): OrgMemberInfo {\n        const obj = JSON.parse(json)\n        return new OrgMemberInfo(\n            obj.orgId,\n            obj.orgName,\n            obj.orgMetadata,\n            obj.urlSafeOrgName,\n            obj.userAssignedRole,\n            obj.userInheritedRolesPlusCurrentRole,\n            obj.userPermissions,\n            obj.orgRoleStructure,\n            obj.userAssignedAdditionalRoles\n        )\n    }\n\n    // getters for the private fields\n\n    get assignedRole(): string {\n        return this.userAssignedRole\n    }\n\n    get assignedRoles(): string[] {\n        if (this.orgRoleStructure === OrgRoleStructure.MultiRole) {\n            return this.userAssignedAdditionalRoles.concat(this.userAssignedRole)\n        } else {\n            return [this.userAssignedRole]\n        }\n    }\n\n    get inheritedRolesPlusCurrentRole(): string[] {\n        if (this.orgRoleStructure === OrgRoleStructure.MultiRole) {\n            return this.userAssignedAdditionalRoles.concat(this.userAssignedRole)\n        } else {\n            return this.userInheritedRolesPlusCurrentRole\n        }\n    }\n\n    get permissions(): string[] {\n        return this.userPermissions\n    }\n}\n\n// These Internal types exist since the server returns snake case, but typescript/javascript\n// convention is camelCase.\nexport type InternalOrgMemberInfo = {\n    org_id: string\n    org_name: string\n    org_metadata: { [key: string]: any }\n    url_safe_org_name: string\n    org_role_structure: OrgRoleStructure\n    user_role: string\n    inherited_user_roles_plus_current_role: string[]\n    user_permissions: string[]\n    additional_roles: string[]\n}\n\nexport type InternalUser = {\n    user_id: string\n\n    org_member_info?: InternalOrgMemberInfo\n    org_id_to_org_member_info?: { [org_id: string]: InternalOrgMemberInfo }\n\n    email: string\n    first_name?: string\n    last_name?: string\n    username?: string\n    properties?: { [key: string]: unknown }\n    login_method?: InternalLoginMethod\n\n    // If you used our migration APIs to migrate this user from a different system, this is their original ID from that system.\n    legacy_user_id?: string\n    impersonatorUserId?: string\n}\n\nexport function toUser(snake_case: InternalUser): UserFromToken {\n    return UserFromToken.fromJwtPayload(snake_case)\n}\n\nexport function toOrgIdToOrgMemberInfo(snake_case?: {\n    [org_id: string]: InternalOrgMemberInfo\n}): OrgIdToOrgMemberInfo | undefined {\n    if (snake_case === undefined) {\n        return undefined\n    }\n    const camelCase: OrgIdToOrgMemberInfo = {}\n\n    for (const key of Object.keys(snake_case)) {\n        const snakeCaseValue = snake_case[key]\n        if (snakeCaseValue) {\n            camelCase[key] = new OrgMemberInfo(\n                snakeCaseValue.org_id,\n                snakeCaseValue.org_name,\n                snakeCaseValue.org_metadata,\n                snakeCaseValue.url_safe_org_name,\n                snakeCaseValue.user_role,\n                snakeCaseValue.inherited_user_roles_plus_current_role,\n                snakeCaseValue.user_permissions,\n                snakeCaseValue.org_role_structure,\n                snakeCaseValue.additional_roles\n            )\n        }\n    }\n\n    return camelCase\n}\n","export class UnauthorizedException extends Error {\n    readonly message: string\n    readonly status: number\n\n    constructor(message: string) {\n        super(message)\n        this.message = message\n        this.status = 401\n    }\n}\n\nexport class ConfigurationException extends Error {\n    readonly message: string\n    readonly status: number\n\n    constructor(message: string) {\n        super(message)\n        this.message = message\n        this.status = 500\n    }\n}\n","import { ResponseCookie } from 'next/dist/compiled/@edge-runtime/cookies'\nimport { InternalUser, toUser, UserFromToken } from '../user'\nimport { ConfigurationException, UnauthorizedException } from './exceptions'\nimport * as jose from 'jose'\n\ntype RefreshAndAccessTokens = {\n    refreshToken: string\n    accessToken: string\n    error: 'none'\n}\n\ntype RefreshAndAccessTokensUnauthorizedError = {\n    error: 'unauthorized'\n}\n\ntype RefreshAndAccessTokensUnexpectedError = {\n    error: 'unexpected'\n}\n\nexport type RefreshTokenResponse =\n    | RefreshAndAccessTokens\n    | RefreshAndAccessTokensUnauthorizedError\n    | RefreshAndAccessTokensUnexpectedError\n\nexport const LOGIN_PATH = '/api/auth/login'\nexport const CALLBACK_PATH = '/api/auth/callback'\nexport const USERINFO_PATH = '/api/auth/userinfo'\nexport const LOGOUT_PATH = '/api/auth/logout'\nexport const ACCESS_TOKEN_COOKIE_NAME = '__pa_at'\nexport const REFRESH_TOKEN_COOKIE_NAME = '__pa_rt'\nexport const STATE_COOKIE_NAME = '__pa_state'\nexport const CUSTOM_HEADER_FOR_ACCESS_TOKEN = 'x-propelauth-access-token'\nexport const CUSTOM_HEADER_FOR_URL = 'x-propelauth-current-url'\nexport const CUSTOM_HEADER_FOR_PATH = 'x-propelauth-current-path'\nexport const RETURN_TO_PATH_COOKIE_NAME = '__pa_return_to_path'\n\nexport const COOKIE_OPTIONS: Partial<ResponseCookie> = {\n    httpOnly: true,\n    sameSite: 'lax',\n    secure: true,\n    path: '/',\n}\n\nexport function getAuthUrlOrigin() {\n    return getAuthUrl().origin\n}\n\nexport function getAuthUrl() {\n    const authUrl = process.env.NEXT_PUBLIC_AUTH_URL\n    if (!authUrl) {\n        throw new Error('NEXT_PUBLIC_AUTH_URL is not set')\n    }\n    return new URL(authUrl)\n}\n\nexport function getRedirectUri() {\n    const redirectUri = process.env.PROPELAUTH_REDIRECT_URI\n    if (!redirectUri) {\n        throw new Error('PROPELAUTH_REDIRECT_URI is not set')\n    }\n    return redirectUri\n}\n\nexport function getIntegrationApiKey() {\n    const integrationApiKey = process.env.PROPELAUTH_API_KEY\n    if (!integrationApiKey) {\n        throw new Error('PROPELAUTH_API_KEY is not set')\n    }\n    return integrationApiKey\n}\n\nexport function getVerifierKey() {\n    const verifierKey = process.env.PROPELAUTH_VERIFIER_KEY\n    if (!verifierKey) {\n        throw new Error('PROPELAUTH_VERIFIER_KEY is not set')\n    }\n    return verifierKey.replace(/\\\\n/g, '\\n')\n}\n\nexport async function refreshTokenWithAccessAndRefreshToken(\n    refreshToken: string,\n    activeOrgId?: string\n): Promise<RefreshTokenResponse> {\n    const body = {\n        refresh_token: refreshToken,\n    }\n\n    const queryParams = new URLSearchParams()\n    if (activeOrgId) {\n        queryParams.set('with_active_org_support', 'true')\n        queryParams.set('active_org_id', activeOrgId)\n    }\n\n    const url = `${getAuthUrlOrigin()}/api/backend/v1/refresh_token?${queryParams.toString()}`\n    const response = await fetch(url, {\n        method: 'POST',\n        body: JSON.stringify(body),\n        headers: {\n            'Content-Type': 'application/json',\n            Authorization: 'Bearer ' + getIntegrationApiKey(),\n        },\n    })\n\n    if (response.ok) {\n        const data = await response.json()\n        const newRefreshToken = data.refresh_token\n        const { access_token: accessToken, expires_at_seconds: expiresAtSeconds } = data.access_token\n\n        return {\n            refreshToken: newRefreshToken,\n            accessToken,\n            error: 'none',\n        }\n    } else if (response.status === 400 || response.status === 401) {\n        return { error: 'unauthorized' }\n    } else {\n        return { error: 'unexpected' }\n    }\n}\n\nexport async function validateAccessTokenOrUndefined(\n    accessToken: string | undefined\n): Promise<UserFromToken | undefined> {\n    try {\n        return await validateAccessToken(accessToken)\n    } catch (err) {\n        if (err instanceof ConfigurationException) {\n            throw err\n        } else if (err instanceof UnauthorizedException) {\n            return undefined\n        } else {\n            console.info('Error validating access token', err)\n            return undefined\n        }\n    }\n}\n\nexport async function validateAccessToken(accessToken: string | undefined): Promise<UserFromToken> {\n    let publicKey\n    try {\n        publicKey = await jose.importSPKI(getVerifierKey(), 'RS256')\n    } catch (err) {\n        console.error(\"Verifier key is invalid. Make sure it's specified correctly, including the newlines.\", err)\n        throw new ConfigurationException('Invalid verifier key')\n    }\n\n    if (!accessToken) {\n        throw new UnauthorizedException('No access token provided')\n    }\n\n    let accessTokenWithoutBearer = accessToken\n    if (accessToken.toLowerCase().startsWith('bearer ')) {\n        accessTokenWithoutBearer = accessToken.substring('bearer '.length)\n    }\n\n    try {\n        const { payload } = await jose.jwtVerify(accessTokenWithoutBearer, publicKey, {\n            issuer: getAuthUrlOrigin(),\n            algorithms: ['RS256'],\n        })\n\n        return toUser(<InternalUser>payload)\n    } catch (e) {\n        if (e instanceof Error) {\n            throw new UnauthorizedException(e.message)\n        } else {\n            throw new UnauthorizedException('Unable to decode jwt')\n        }\n    }\n}\n","import {getApis} from \"@propelauth/node-apis\";\nimport {getAuthUrl, getIntegrationApiKey} from \"./shared\";\n\nexport const getPropelAuthApis = () => {\n    const authUrl = getAuthUrl()\n    const integrationApiKey = getIntegrationApiKey()\n\n    return getApis(authUrl, integrationApiKey)\n}"],"mappings":";;;;;;;;;;;;;;;;;;;;;;AAgHO,SAAS,cAAc,YAA+C;AACzE,MAAI,CAAC,YAAY;AACb,WAAO,EAAE,aAAa,UAAU;AAAA,EACpC;AAEA,UAAQ,WAAW,cAAc;AAAA,IAC7B,KAAK;AACD,aAAO,EAAE,aAAa,WAAW;AAAA,IACrC,KAAK;AACD,aAAO,EAAE,aAAa,aAAa;AAAA,IACvC,KAAK;AACD,aAAO,EAAE,aAAa,cAAc,UAAU,WAAW,SAAS;AAAA,IACtE,KAAK;AACD,aAAO,EAAE,aAAa,0BAA0B;AAAA,IACpD,KAAK;AACD,aAAO,EAAE,aAAa,YAAY,UAAU,WAAW,UAAU,OAAO,WAAW,OAAO;AAAA,IAC9F,KAAK;AACD,aAAO,EAAE,aAAa,gBAAgB;AAAA,IAC1C,KAAK;AACD,aAAO,EAAE,aAAa,6BAA6B;AAAA,IACvD;AACI,aAAO,EAAE,aAAa,UAAU;AAAA,EACxC;AACJ;;;ACrIO,IAAM,gBAAN,MAAoB;AAAA,EAmBvB,YACI,QACA,OACA,sBACA,WACA,UACA,UACA,cACA,oBACA,YACA,aACA,aACF;AACE,SAAK,SAAS;AAEd,SAAK,cAAc;AACnB,SAAK,uBAAuB;AAE5B,SAAK,QAAQ;AACb,SAAK,YAAY;AACjB,SAAK,WAAW;AAChB,SAAK,WAAW;AAEhB,SAAK,eAAe;AACpB,SAAK,qBAAqB;AAE1B,SAAK,aAAa;AAClB,SAAK,cAAc;AAAA,EACvB;AAAA,EAEO,eAA0C;AAC7C,QAAI,CAAC,KAAK,eAAe,CAAC,KAAK,sBAAsB;AACjD,aAAO;AAAA,IACX;AAEA,WAAO,KAAK,qBAAqB,KAAK,WAAW;AAAA,EACrD;AAAA,EAEO,iBAAqC;AACxC,WAAO,KAAK;AAAA,EAChB;AAAA,EAEO,OAAO,OAA0C;AACpD,QAAI,CAAC,KAAK,sBAAsB;AAC5B,aAAO;AAAA,IACX;AAEA,WAAO,KAAK,qBAAqB,KAAK;AAAA,EAC1C;AAAA,EAEO,aAAa,SAA4C;AAC5D,QAAI,CAAC,KAAK,sBAAsB;AAC5B,aAAO;AAAA,IACX;AAEA,UAAM,iBAAiB,QAAQ,YAAY,EAAE,QAAQ,MAAM,GAAG;AAC9D,eAAW,SAAS,KAAK,sBAAsB;AAC3C,YAAM,gBAAgB,KAAK,qBAAqB,KAAK;AACrD,UAAI,cAAc,mBAAmB,gBAAgB;AACjD,eAAO;AAAA,MACX;AAAA,IACJ;AAEA,WAAO;AAAA,EACX;AAAA,EAEO,UAA2B;AAC9B,QAAI,CAAC,KAAK,sBAAsB;AAC5B,aAAO,CAAC;AAAA,IACZ;AAEA,WAAO,OAAO,OAAO,KAAK,oBAAoB;AAAA,EAClD;AAAA,EAEO,kBAA2B;AAC9B,WAAO,CAAC,CAAC,KAAK;AAAA,EAClB;AAAA,EAEA,OAAc,SAAS,MAA6B;AAChD,UAAM,MAAM,KAAK,MAAM,IAAI;AAC3B,UAAM,uBAA6C,CAAC;AACpD,eAAW,SAAS,IAAI,sBAAsB;AAC1C,2BAAqB,KAAK,IAAI,cAAc,SAAS,KAAK,UAAU,IAAI,qBAAqB,KAAK,CAAC,CAAC;AAAA,IACxG;AACA,WAAO,IAAI;AAAA,MACP,IAAI;AAAA,MACJ,IAAI;AAAA,MACJ;AAAA,MACA,IAAI;AAAA,MACJ,IAAI;AAAA,MACJ,IAAI;AAAA,MACJ,IAAI;AAAA,MACJ,IAAI;AAAA,MACJ,IAAI;AAAA,MACJ,IAAI;AAAA,MACJ,IAAI;AAAA,IACR;AAAA,EACJ;AAAA,EAEA,OAAc,eAAe,SAAsC;AAC/D,QAAI;AACJ,QAAI;AAEJ,QAAI,QAAQ,iBAAiB;AACzB,oBAAc,QAAQ,gBAAgB;AACtC,6BAAuB,uBAAuB,EAAE,CAAC,WAAW,GAAG,QAAQ,gBAAgB,CAAC;AAAA,IAC5F,OAAO;AACH,oBAAc;AACd,6BAAuB,uBAAuB,QAAQ,yBAAyB;AAAA,IACnF;AAEA,UAAM,cAAc,cAAc,QAAQ,YAAY;AAEtD,WAAO,IAAI;AAAA,MACP,QAAQ;AAAA,MACR,QAAQ;AAAA,MACR;AAAA,MACA,QAAQ;AAAA,MACR,QAAQ;AAAA,MACR,QAAQ;AAAA,MACR,QAAQ;AAAA,MACR,QAAQ;AAAA,MACR,QAAQ;AAAA,MACR;AAAA,MACA;AAAA,IACJ;AAAA,EACJ;AACJ;AAWO,IAAM,gBAAN,MAAoB;AAAA,EAYvB,YACI,OACA,SACA,aACA,gBACA,kBACA,mCACA,iBACA,kBACA,6BACF;AACE,SAAK,QAAQ;AACb,SAAK,UAAU;AACf,SAAK,cAAc;AACnB,SAAK,iBAAiB;AACtB,SAAK,mBAAmB;AAExB,SAAK,mBAAmB;AACxB,SAAK,oCAAoC;AACzC,SAAK,kBAAkB;AACvB,SAAK,8BAA8B;AAAA,EACvC;AAAA;AAAA,EAIO,OAAO,MAAuB;AACjC,QAAI,KAAK,qBAAqB,8BAA4B;AACtD,aAAO,KAAK,qBAAqB,QAAQ,KAAK,4BAA4B,SAAS,IAAI;AAAA,IAC3F,OAAO;AACH,aAAO,KAAK,qBAAqB;AAAA,IACrC;AAAA,EACJ;AAAA,EAEO,cAAc,MAAuB;AACxC,QAAI,KAAK,qBAAqB,8BAA4B;AACtD,aAAO,KAAK,qBAAqB,QAAQ,KAAK,4BAA4B,SAAS,IAAI;AAAA,IAC3F,OAAO;AACH,aAAO,KAAK,kCAAkC,SAAS,IAAI;AAAA,IAC/D;AAAA,EACJ;AAAA,EAEO,cAAc,YAA6B;AAC9C,WAAO,KAAK,gBAAgB,SAAS,UAAU;AAAA,EACnD;AAAA,EAEO,kBAAkB,aAAgC;AACrD,WAAO,YAAY,MAAM,CAAC,eAAe,KAAK,cAAc,UAAU,CAAC;AAAA,EAC3E;AAAA,EAEA,OAAc,SAAS,MAA6B;AAChD,UAAM,MAAM,KAAK,MAAM,IAAI;AAC3B,WAAO,IAAI;AAAA,MACP,IAAI;AAAA,MACJ,IAAI;AAAA,MACJ,IAAI;AAAA,MACJ,IAAI;AAAA,MACJ,IAAI;AAAA,MACJ,IAAI;AAAA,MACJ,IAAI;AAAA,MACJ,IAAI;AAAA,MACJ,IAAI;AAAA,IACR;AAAA,EACJ;AAAA;AAAA,EAIA,IAAI,eAAuB;AACvB,WAAO,KAAK;AAAA,EAChB;AAAA,EAEA,IAAI,gBAA0B;AAC1B,QAAI,KAAK,qBAAqB,8BAA4B;AACtD,aAAO,KAAK,4BAA4B,OAAO,KAAK,gBAAgB;AAAA,IACxE,OAAO;AACH,aAAO,CAAC,KAAK,gBAAgB;AAAA,IACjC;AAAA,EACJ;AAAA,EAEA,IAAI,gCAA0C;AAC1C,QAAI,KAAK,qBAAqB,8BAA4B;AACtD,aAAO,KAAK,4BAA4B,OAAO,KAAK,gBAAgB;AAAA,IACxE,OAAO;AACH,aAAO,KAAK;AAAA,IAChB;AAAA,EACJ;AAAA,EAEA,IAAI,cAAwB;AACxB,WAAO,KAAK;AAAA,EAChB;AACJ;AAkCO,SAAS,OAAO,YAAyC;AAC5D,SAAO,cAAc,eAAe,UAAU;AAClD;AAEO,SAAS,uBAAuB,YAEF;AACjC,MAAI,eAAe,QAAW;AAC1B,WAAO;AAAA,EACX;AACA,QAAM,YAAkC,CAAC;AAEzC,aAAW,OAAO,OAAO,KAAK,UAAU,GAAG;AACvC,UAAM,iBAAiB,WAAW,GAAG;AACrC,QAAI,gBAAgB;AAChB,gBAAU,GAAG,IAAI,IAAI;AAAA,QACjB,eAAe;AAAA,QACf,eAAe;AAAA,QACf,eAAe;AAAA,QACf,eAAe;AAAA,QACf,eAAe;AAAA,QACf,eAAe;AAAA,QACf,eAAe;AAAA,QACf,eAAe;AAAA,QACf,eAAe;AAAA,MACnB;AAAA,IACJ;AAAA,EACJ;AAEA,SAAO;AACX;;;ACpUO,IAAM,wBAAN,cAAoC,MAAM;AAAA,EAI7C,YAAY,SAAiB;AACzB,UAAM,OAAO;AACb,SAAK,UAAU;AACf,SAAK,SAAS;AAAA,EAClB;AACJ;AAEO,IAAM,yBAAN,cAAqC,MAAM;AAAA,EAI9C,YAAY,SAAiB;AACzB,UAAM,OAAO;AACb,SAAK,UAAU;AACf,SAAK,SAAS;AAAA,EAClB;AACJ;;;ACjBA,YAAY,UAAU;AAwCf,SAAS,mBAAmB;AAC/B,SAAO,WAAW,EAAE;AACxB;AAEO,SAAS,aAAa;AACzB,QAAM,UAAU,QAAQ,IAAI;AAC5B,MAAI,CAAC,SAAS;AACV,UAAM,IAAI,MAAM,iCAAiC;AAAA,EACrD;AACA,SAAO,IAAI,IAAI,OAAO;AAC1B;AAUO,SAAS,uBAAuB;AACnC,QAAM,oBAAoB,QAAQ,IAAI;AACtC,MAAI,CAAC,mBAAmB;AACpB,UAAM,IAAI,MAAM,+BAA+B;AAAA,EACnD;AACA,SAAO;AACX;AAEO,SAAS,iBAAiB;AAC7B,QAAM,cAAc,QAAQ,IAAI;AAChC,MAAI,CAAC,aAAa;AACd,UAAM,IAAI,MAAM,oCAAoC;AAAA,EACxD;AACA,SAAO,YAAY,QAAQ,QAAQ,IAAI;AAC3C;AA2CA,SAAsB,+BAClB,aACkC;AAAA;AAClC,QAAI;AACA,aAAO,MAAM,oBAAoB,WAAW;AAAA,IAChD,SAAS,KAAP;AACE,UAAI,eAAe,wBAAwB;AACvC,cAAM;AAAA,MACV,WAAW,eAAe,uBAAuB;AAC7C,eAAO;AAAA,MACX,OAAO;AACH,gBAAQ,KAAK,iCAAiC,GAAG;AACjD,eAAO;AAAA,MACX;AAAA,IACJ;AAAA,EACJ;AAAA;AAEA,SAAsB,oBAAoB,aAAyD;AAAA;AAC/F,QAAI;AACJ,QAAI;AACA,kBAAY,MAAW,gBAAW,eAAe,GAAG,OAAO;AAAA,IAC/D,SAAS,KAAP;AACE,cAAQ,MAAM,wFAAwF,GAAG;AACzG,YAAM,IAAI,uBAAuB,sBAAsB;AAAA,IAC3D;AAEA,QAAI,CAAC,aAAa;AACd,YAAM,IAAI,sBAAsB,0BAA0B;AAAA,IAC9D;AAEA,QAAI,2BAA2B;AAC/B,QAAI,YAAY,YAAY,EAAE,WAAW,SAAS,GAAG;AACjD,iCAA2B,YAAY,UAAU,UAAU,MAAM;AAAA,IACrE;AAEA,QAAI;AACA,YAAM,EAAE,QAAQ,IAAI,MAAW,eAAU,0BAA0B,WAAW;AAAA,QAC1E,QAAQ,iBAAiB;AAAA,QACzB,YAAY,CAAC,OAAO;AAAA,MACxB,CAAC;AAED,aAAO,OAAqB,OAAO;AAAA,IACvC,SAAS,GAAP;AACE,UAAI,aAAa,OAAO;AACpB,cAAM,IAAI,sBAAsB,EAAE,OAAO;AAAA,MAC7C,OAAO;AACH,cAAM,IAAI,sBAAsB,sBAAsB;AAAA,MAC1D;AAAA,IACJ;AAAA,EACJ;AAAA;;;ACzKA,SAAQ,eAAc;AAGf,IAAM,oBAAoB,MAAM;AACnC,QAAM,UAAU,WAAW;AAC3B,QAAM,oBAAoB,qBAAqB;AAE/C,SAAO,QAAQ,SAAS,iBAAiB;AAC7C;","names":[]}
+{"version":3,"sources":["../../src/loginMethod.ts","../../src/user.ts","../../src/server/exceptions.ts","../../src/server/shared.ts","../../src/server/api.ts"],"sourcesContent":["export enum SocialLoginProvider {\n    Google = 'Google',\n    GitHub = 'GitHub',\n    Microsoft = 'Microsoft',\n    Slack = 'Slack',\n    LinkedIn = 'LinkedIn',\n    Salesforce = 'Salesforce',\n    Xero = 'Xero',\n    QuickBooksOnline = 'QuickBooks Online',\n}\n\nexport enum SamlLoginProvider {\n    Google = 'Google',\n    Rippling = 'Rippling',\n    OneLogin = 'OneLogin',\n    JumpCloud = 'JumpCloud',\n    Okta = 'Okta',\n    Azure = 'Azure',\n    Duo = 'Duo',\n    Generic = 'Generic',\n}\n\ntype InternalPasswordLoginMethod = {\n    login_method: 'password'\n}\n\ntype InternalMagicLinkLoginMethod = {\n    login_method: 'magic_link'\n}\n\ntype InternalSocialSsoLoginMethod = {\n    login_method: 'social_sso'\n    provider: SocialLoginProvider\n}\n\ntype InternalEmailConfirmationLinkLoginMethod = {\n    login_method: 'email_confirmation_link'\n}\n\ntype InternalSamlSsoLoginMethod = {\n    login_method: 'saml_sso'\n    provider: SamlLoginProvider\n    org_id: string\n}\n\ntype InternalImpersonationLoginMethod = {\n    login_method: 'impersonation'\n}\n\ntype InternalGeneratedFromBackendApiLoginMethod = {\n    login_method: 'generated_from_backend_api'\n}\n\ntype InternalUnknownLoginMethod = {\n    login_method: 'unknown'\n}\n\nexport type InternalLoginMethod =\n    | InternalPasswordLoginMethod\n    | InternalMagicLinkLoginMethod\n    | InternalSocialSsoLoginMethod\n    | InternalEmailConfirmationLinkLoginMethod\n    | InternalSamlSsoLoginMethod\n    | InternalImpersonationLoginMethod\n    | InternalGeneratedFromBackendApiLoginMethod\n    | InternalUnknownLoginMethod\n\ntype PasswordLoginMethod = {\n    loginMethod: 'password'\n}\n\ntype MagicLinkLoginMethod = {\n    loginMethod: 'magic_link'\n}\n\ntype SocialSsoLoginMethod = {\n    loginMethod: 'social_sso'\n    provider: SocialLoginProvider\n}\n\ntype EmailConfirmationLinkLoginMethod = {\n    loginMethod: 'email_confirmation_link'\n}\n\ntype SamlSsoLoginMethod = {\n    loginMethod: 'saml_sso'\n    provider: SamlLoginProvider\n    orgId: string\n}\n\ntype ImpersonationLoginMethod = {\n    loginMethod: 'impersonation'\n}\n\ntype GeneratedFromBackendApiLoginMethod = {\n    loginMethod: 'generated_from_backend_api'\n}\n\ntype UnknownLoginMethod = {\n    loginMethod: 'unknown'\n}\n\nexport type LoginMethod =\n    | PasswordLoginMethod\n    | MagicLinkLoginMethod\n    | SocialSsoLoginMethod\n    | EmailConfirmationLinkLoginMethod\n    | SamlSsoLoginMethod\n    | ImpersonationLoginMethod\n    | GeneratedFromBackendApiLoginMethod\n    | UnknownLoginMethod\n\nexport function toLoginMethod(snake_case?: InternalLoginMethod): LoginMethod {\n    if (!snake_case) {\n        return { loginMethod: 'unknown' }\n    }\n\n    switch (snake_case.login_method) {\n        case 'password':\n            return { loginMethod: 'password' }\n        case 'magic_link':\n            return { loginMethod: 'magic_link' }\n        case 'social_sso':\n            return { loginMethod: 'social_sso', provider: snake_case.provider }\n        case 'email_confirmation_link':\n            return { loginMethod: 'email_confirmation_link' }\n        case 'saml_sso':\n            return { loginMethod: 'saml_sso', provider: snake_case.provider, orgId: snake_case.org_id }\n        case 'impersonation':\n            return { loginMethod: 'impersonation' }\n        case 'generated_from_backend_api':\n            return { loginMethod: 'generated_from_backend_api' }\n        default:\n            return { loginMethod: 'unknown' }\n    }\n}\n","import { InternalLoginMethod, LoginMethod, toLoginMethod } from './loginMethod'\n\nexport class UserFromToken {\n    public userId: string\n\n    public activeOrgId?: string\n    public orgIdToOrgMemberInfo?: OrgIdToOrgMemberInfo\n\n    // Metadata about the user\n    public email: string\n    public firstName?: string\n    public lastName?: string\n    public username?: string\n    public properties?: { [key: string]: unknown }\n    public loginMethod?: LoginMethod\n\n    // If you used our migration APIs to migrate this user from a different system,\n    //   this is their original ID from that system.\n    public legacyUserId?: string\n    public impersonatorUserId?: string\n\n    constructor(\n        userId: string,\n        email: string,\n        orgIdToOrgMemberInfo?: OrgIdToOrgMemberInfo,\n        firstName?: string,\n        lastName?: string,\n        username?: string,\n        legacyUserId?: string,\n        impersonatorUserId?: string,\n        properties?: { [key: string]: unknown },\n        activeOrgId?: string,\n        loginMethod?: LoginMethod\n    ) {\n        this.userId = userId\n\n        this.activeOrgId = activeOrgId\n        this.orgIdToOrgMemberInfo = orgIdToOrgMemberInfo\n\n        this.email = email\n        this.firstName = firstName\n        this.lastName = lastName\n        this.username = username\n\n        this.legacyUserId = legacyUserId\n        this.impersonatorUserId = impersonatorUserId\n\n        this.properties = properties\n        this.loginMethod = loginMethod\n    }\n\n    public getActiveOrg(): OrgMemberInfo | undefined {\n        if (!this.activeOrgId || !this.orgIdToOrgMemberInfo) {\n            return undefined\n        }\n\n        return this.orgIdToOrgMemberInfo[this.activeOrgId]\n    }\n\n    public getActiveOrgId(): string | undefined {\n        return this.activeOrgId\n    }\n\n    public getOrg(orgId: string): OrgMemberInfo | undefined {\n        if (!this.orgIdToOrgMemberInfo) {\n            return undefined\n        }\n\n        return this.orgIdToOrgMemberInfo[orgId]\n    }\n\n    public getOrgByName(orgName: string): OrgMemberInfo | undefined {\n        if (!this.orgIdToOrgMemberInfo) {\n            return undefined\n        }\n\n        const urlSafeOrgName = orgName.toLowerCase().replace(/ /g, '-')\n        for (const orgId in this.orgIdToOrgMemberInfo) {\n            const orgMemberInfo = this.orgIdToOrgMemberInfo[orgId]\n            if (orgMemberInfo.urlSafeOrgName === urlSafeOrgName) {\n                return orgMemberInfo\n            }\n        }\n\n        return undefined\n    }\n\n    public getOrgs(): OrgMemberInfo[] {\n        if (!this.orgIdToOrgMemberInfo) {\n            return []\n        }\n\n        return Object.values(this.orgIdToOrgMemberInfo)\n    }\n\n    public isImpersonating(): boolean {\n        return !!this.impersonatorUserId\n    }\n\n    public static fromJSON(json: string): UserFromToken {\n        const obj = JSON.parse(json)\n        const orgIdToOrgMemberInfo: OrgIdToOrgMemberInfo = {}\n        for (const orgId in obj.orgIdToOrgMemberInfo) {\n            orgIdToOrgMemberInfo[orgId] = OrgMemberInfo.fromJSON(JSON.stringify(obj.orgIdToOrgMemberInfo[orgId]))\n        }\n        return new UserFromToken(\n            obj.userId,\n            obj.email,\n            orgIdToOrgMemberInfo,\n            obj.firstName,\n            obj.lastName,\n            obj.username,\n            obj.legacyUserId,\n            obj.impersonatorUserId,\n            obj.properties,\n            obj.activeOrgId,\n            obj.loginMethod\n        )\n    }\n\n    public static fromJwtPayload(payload: InternalUser): UserFromToken {\n        let activeOrgId: string | undefined\n        let orgIdToOrgMemberInfo: OrgIdToOrgMemberInfo | undefined\n\n        if (payload.org_member_info) {\n            activeOrgId = payload.org_member_info.org_id\n            orgIdToOrgMemberInfo = toOrgIdToOrgMemberInfo({ [activeOrgId]: payload.org_member_info })\n        } else {\n            activeOrgId = undefined\n            orgIdToOrgMemberInfo = toOrgIdToOrgMemberInfo(payload.org_id_to_org_member_info)\n        }\n\n        const loginMethod = toLoginMethod(payload.login_method)\n\n        return new UserFromToken(\n            payload.user_id,\n            payload.email,\n            orgIdToOrgMemberInfo,\n            payload.first_name,\n            payload.last_name,\n            payload.username,\n            payload.legacy_user_id,\n            payload.impersonator_user_id,\n            payload.properties,\n            activeOrgId,\n            loginMethod\n        )\n    }\n}\n\nexport type OrgIdToOrgMemberInfo = {\n    [orgId: string]: OrgMemberInfo\n}\n\nexport enum OrgRoleStructure {\n    SingleRole = \"single_role_in_hierarchy\",\n    MultiRole = \"multi_role\",\n}\n\nexport class OrgMemberInfo {\n    public orgId: string\n    public orgName: string\n    public orgMetadata: { [key: string]: any }\n    public urlSafeOrgName: string\n    public orgRoleStructure: OrgRoleStructure\n\n    public userAssignedRole: string\n    public userInheritedRolesPlusCurrentRole: string[]\n    public userPermissions: string[]\n    public userAssignedAdditionalRoles: string[]\n\n    constructor(\n        orgId: string,\n        orgName: string,\n        orgMetadata: { [key: string]: any },\n        urlSafeOrgName: string,\n        userAssignedRole: string,\n        userInheritedRolesPlusCurrentRole: string[],\n        userPermissions: string[],\n        orgRoleStructure: OrgRoleStructure,\n        userAssignedAdditionalRoles: string[]\n    ) {\n        this.orgId = orgId\n        this.orgName = orgName\n        this.orgMetadata = orgMetadata\n        this.urlSafeOrgName = urlSafeOrgName\n        this.orgRoleStructure = orgRoleStructure\n\n        this.userAssignedRole = userAssignedRole\n        this.userInheritedRolesPlusCurrentRole = userInheritedRolesPlusCurrentRole\n        this.userPermissions = userPermissions\n        this.userAssignedAdditionalRoles = userAssignedAdditionalRoles\n    }\n\n    // validation methods\n\n    public isRole(role: string): boolean {\n        if (this.orgRoleStructure === OrgRoleStructure.MultiRole) {\n            return this.userAssignedRole === role || this.userAssignedAdditionalRoles.includes(role)\n        } else {\n            return this.userAssignedRole === role\n        }\n    }\n\n    public isAtLeastRole(role: string): boolean {\n        if (this.orgRoleStructure === OrgRoleStructure.MultiRole) {\n            return this.userAssignedRole === role || this.userAssignedAdditionalRoles.includes(role)\n        } else {\n            return this.userInheritedRolesPlusCurrentRole.includes(role)\n        }\n    }\n\n    public hasPermission(permission: string): boolean {\n        return this.userPermissions.includes(permission)\n    }\n\n    public hasAllPermissions(permissions: string[]): boolean {\n        return permissions.every((permission) => this.hasPermission(permission))\n    }\n\n    public static fromJSON(json: string): OrgMemberInfo {\n        const obj = JSON.parse(json)\n        return new OrgMemberInfo(\n            obj.orgId,\n            obj.orgName,\n            obj.orgMetadata,\n            obj.urlSafeOrgName,\n            obj.userAssignedRole,\n            obj.userInheritedRolesPlusCurrentRole,\n            obj.userPermissions,\n            obj.orgRoleStructure,\n            obj.userAssignedAdditionalRoles\n        )\n    }\n\n    // getters for the private fields\n\n    get assignedRole(): string {\n        return this.userAssignedRole\n    }\n\n    get assignedRoles(): string[] {\n        if (this.orgRoleStructure === OrgRoleStructure.MultiRole) {\n            return this.userAssignedAdditionalRoles.concat(this.userAssignedRole)\n        } else {\n            return [this.userAssignedRole]\n        }\n    }\n\n    get inheritedRolesPlusCurrentRole(): string[] {\n        if (this.orgRoleStructure === OrgRoleStructure.MultiRole) {\n            return this.userAssignedAdditionalRoles.concat(this.userAssignedRole)\n        } else {\n            return this.userInheritedRolesPlusCurrentRole\n        }\n    }\n\n    get permissions(): string[] {\n        return this.userPermissions\n    }\n}\n\n// These Internal types exist since the server returns snake case, but typescript/javascript\n// convention is camelCase.\nexport type InternalOrgMemberInfo = {\n    org_id: string\n    org_name: string\n    org_metadata: { [key: string]: any }\n    url_safe_org_name: string\n    org_role_structure: OrgRoleStructure\n    user_role: string\n    inherited_user_roles_plus_current_role: string[]\n    user_permissions: string[]\n    additional_roles: string[]\n}\n\nexport type InternalUser = {\n    user_id: string\n\n    org_member_info?: InternalOrgMemberInfo\n    org_id_to_org_member_info?: { [org_id: string]: InternalOrgMemberInfo }\n\n    email: string\n    first_name?: string\n    last_name?: string\n    username?: string\n    properties?: { [key: string]: unknown }\n    login_method?: InternalLoginMethod\n\n    // If you used our migration APIs to migrate this user from a different system, this is their original ID from that system.\n    legacy_user_id?: string\n    impersonator_user_id?: string\n}\n\nexport function toUser(snake_case: InternalUser): UserFromToken {\n    return UserFromToken.fromJwtPayload(snake_case)\n}\n\nexport function toOrgIdToOrgMemberInfo(snake_case?: {\n    [org_id: string]: InternalOrgMemberInfo\n}): OrgIdToOrgMemberInfo | undefined {\n    if (snake_case === undefined) {\n        return undefined\n    }\n    const camelCase: OrgIdToOrgMemberInfo = {}\n\n    for (const key of Object.keys(snake_case)) {\n        const snakeCaseValue = snake_case[key]\n        if (snakeCaseValue) {\n            camelCase[key] = new OrgMemberInfo(\n                snakeCaseValue.org_id,\n                snakeCaseValue.org_name,\n                snakeCaseValue.org_metadata,\n                snakeCaseValue.url_safe_org_name,\n                snakeCaseValue.user_role,\n                snakeCaseValue.inherited_user_roles_plus_current_role,\n                snakeCaseValue.user_permissions,\n                snakeCaseValue.org_role_structure,\n                snakeCaseValue.additional_roles\n            )\n        }\n    }\n\n    return camelCase\n}\n","export class UnauthorizedException extends Error {\n    readonly message: string\n    readonly status: number\n\n    constructor(message: string) {\n        super(message)\n        this.message = message\n        this.status = 401\n    }\n}\n\nexport class ConfigurationException extends Error {\n    readonly message: string\n    readonly status: number\n\n    constructor(message: string) {\n        super(message)\n        this.message = message\n        this.status = 500\n    }\n}\n","import { ResponseCookie } from 'next/dist/compiled/@edge-runtime/cookies'\nimport { InternalUser, toUser, UserFromToken } from '../user'\nimport { ConfigurationException, UnauthorizedException } from './exceptions'\nimport * as jose from 'jose'\n\ntype RefreshAndAccessTokens = {\n    refreshToken: string\n    accessToken: string\n    error: 'none'\n}\n\ntype RefreshAndAccessTokensUnauthorizedError = {\n    error: 'unauthorized'\n}\n\ntype RefreshAndAccessTokensUnexpectedError = {\n    error: 'unexpected'\n}\n\nexport type RefreshTokenResponse =\n    | RefreshAndAccessTokens\n    | RefreshAndAccessTokensUnauthorizedError\n    | RefreshAndAccessTokensUnexpectedError\n\nexport const LOGIN_PATH = '/api/auth/login'\nexport const CALLBACK_PATH = '/api/auth/callback'\nexport const USERINFO_PATH = '/api/auth/userinfo'\nexport const LOGOUT_PATH = '/api/auth/logout'\nexport const ACCESS_TOKEN_COOKIE_NAME = '__pa_at'\nexport const REFRESH_TOKEN_COOKIE_NAME = '__pa_rt'\nexport const STATE_COOKIE_NAME = '__pa_state'\nexport const CUSTOM_HEADER_FOR_ACCESS_TOKEN = 'x-propelauth-access-token'\nexport const CUSTOM_HEADER_FOR_URL = 'x-propelauth-current-url'\nexport const CUSTOM_HEADER_FOR_PATH = 'x-propelauth-current-path'\nexport const RETURN_TO_PATH_COOKIE_NAME = '__pa_return_to_path'\n\nexport const COOKIE_OPTIONS: Partial<ResponseCookie> = {\n    httpOnly: true,\n    secure: true,\n    path: '/',\n}\n\nexport function getAuthUrlOrigin() {\n    return getAuthUrl().origin\n}\n\nexport function getAuthUrl() {\n    const authUrl = process.env.NEXT_PUBLIC_AUTH_URL\n    if (!authUrl) {\n        throw new Error('NEXT_PUBLIC_AUTH_URL is not set')\n    }\n    return new URL(authUrl)\n}\n\nexport function getRedirectUri() {\n    const redirectUri = process.env.PROPELAUTH_REDIRECT_URI\n    if (!redirectUri) {\n        throw new Error('PROPELAUTH_REDIRECT_URI is not set')\n    }\n    return redirectUri\n}\n\nexport function getIntegrationApiKey() {\n    const integrationApiKey = process.env.PROPELAUTH_API_KEY\n    if (!integrationApiKey) {\n        throw new Error('PROPELAUTH_API_KEY is not set')\n    }\n    return integrationApiKey\n}\n\nexport function getVerifierKey() {\n    const verifierKey = process.env.PROPELAUTH_VERIFIER_KEY\n    if (!verifierKey) {\n        throw new Error('PROPELAUTH_VERIFIER_KEY is not set')\n    }\n    return verifierKey.replace(/\\\\n/g, '\\n')\n}\n\nexport function getSameSiteCookieValue(): \"none\" | \"lax\" | \"strict\" {\n    const sameSiteOverride = process.env.PROPELAUTH_SAME_SITE_COOKIE_OVERRIDE\n    if (sameSiteOverride === 'none') {\n        return 'none'\n    } else if (sameSiteOverride === 'lax') {\n        return 'lax'\n    } else if (sameSiteOverride === 'strict') {\n        return 'strict'\n    } else if (sameSiteOverride) {\n        throw new Error(\n            'Invalid value for PROPELAUTH_SAME_SITE_COOKIE_OVERRIDE, must be one of \"none\", \"lax\", or \"strict\"'\n        )\n    } else {\n        return 'lax'\n    }\n}\n\nexport async function refreshTokenWithAccessAndRefreshToken(\n    refreshToken: string,\n    activeOrgId?: string\n): Promise<RefreshTokenResponse> {\n    const body = {\n        refresh_token: refreshToken,\n    }\n\n    const queryParams = new URLSearchParams()\n    if (activeOrgId) {\n        queryParams.set('with_active_org_support', 'true')\n        queryParams.set('active_org_id', activeOrgId)\n    }\n\n    const url = `${getAuthUrlOrigin()}/api/backend/v1/refresh_token?${queryParams.toString()}`\n    const response = await fetch(url, {\n        method: 'POST',\n        body: JSON.stringify(body),\n        headers: {\n            'Content-Type': 'application/json',\n            Authorization: 'Bearer ' + getIntegrationApiKey(),\n        },\n    })\n\n    if (response.ok) {\n        const data = await response.json()\n        const newRefreshToken = data.refresh_token\n        const { access_token: accessToken, expires_at_seconds: expiresAtSeconds } = data.access_token\n\n        return {\n            refreshToken: newRefreshToken,\n            accessToken,\n            error: 'none',\n        }\n    } else if (response.status === 400 || response.status === 401) {\n        return { error: 'unauthorized' }\n    } else {\n        return { error: 'unexpected' }\n    }\n}\n\nexport async function validateAccessTokenOrUndefined(\n    accessToken: string | undefined\n): Promise<UserFromToken | undefined> {\n    try {\n        return await validateAccessToken(accessToken)\n    } catch (err) {\n        if (err instanceof ConfigurationException) {\n            throw err\n        } else if (err instanceof UnauthorizedException) {\n            return undefined\n        } else {\n            console.info('Error validating access token', err)\n            return undefined\n        }\n    }\n}\n\nexport async function validateAccessToken(accessToken: string | undefined): Promise<UserFromToken> {\n    let publicKey\n    try {\n        publicKey = await jose.importSPKI(getVerifierKey(), 'RS256')\n    } catch (err) {\n        console.error(\"Verifier key is invalid. Make sure it's specified correctly, including the newlines.\", err)\n        throw new ConfigurationException('Invalid verifier key')\n    }\n\n    if (!accessToken) {\n        throw new UnauthorizedException('No access token provided')\n    }\n\n    let accessTokenWithoutBearer = accessToken\n    if (accessToken.toLowerCase().startsWith('bearer ')) {\n        accessTokenWithoutBearer = accessToken.substring('bearer '.length)\n    }\n\n    try {\n        const { payload } = await jose.jwtVerify(accessTokenWithoutBearer, publicKey, {\n            issuer: getAuthUrlOrigin(),\n            algorithms: ['RS256'],\n        })\n\n        return toUser(<InternalUser>payload)\n    } catch (e) {\n        if (e instanceof Error) {\n            throw new UnauthorizedException(e.message)\n        } else {\n            throw new UnauthorizedException('Unable to decode jwt')\n        }\n    }\n}\n","import {getApis} from \"@propelauth/node-apis\";\nimport {getAuthUrl, getIntegrationApiKey} from \"./shared\";\n\nexport const getPropelAuthApis = () => {\n    const authUrl = getAuthUrl()\n    const integrationApiKey = getIntegrationApiKey()\n\n    return getApis(authUrl, integrationApiKey)\n}"],"mappings":";;;;;;;;;;;;;;;;;;;;;;AAgHO,SAAS,cAAc,YAA+C;AACzE,MAAI,CAAC,YAAY;AACb,WAAO,EAAE,aAAa,UAAU;AAAA,EACpC;AAEA,UAAQ,WAAW,cAAc;AAAA,IAC7B,KAAK;AACD,aAAO,EAAE,aAAa,WAAW;AAAA,IACrC,KAAK;AACD,aAAO,EAAE,aAAa,aAAa;AAAA,IACvC,KAAK;AACD,aAAO,EAAE,aAAa,cAAc,UAAU,WAAW,SAAS;AAAA,IACtE,KAAK;AACD,aAAO,EAAE,aAAa,0BAA0B;AAAA,IACpD,KAAK;AACD,aAAO,EAAE,aAAa,YAAY,UAAU,WAAW,UAAU,OAAO,WAAW,OAAO;AAAA,IAC9F,KAAK;AACD,aAAO,EAAE,aAAa,gBAAgB;AAAA,IAC1C,KAAK;AACD,aAAO,EAAE,aAAa,6BAA6B;AAAA,IACvD;AACI,aAAO,EAAE,aAAa,UAAU;AAAA,EACxC;AACJ;;;ACrIO,IAAM,gBAAN,MAAoB;AAAA,EAmBvB,YACI,QACA,OACA,sBACA,WACA,UACA,UACA,cACA,oBACA,YACA,aACA,aACF;AACE,SAAK,SAAS;AAEd,SAAK,cAAc;AACnB,SAAK,uBAAuB;AAE5B,SAAK,QAAQ;AACb,SAAK,YAAY;AACjB,SAAK,WAAW;AAChB,SAAK,WAAW;AAEhB,SAAK,eAAe;AACpB,SAAK,qBAAqB;AAE1B,SAAK,aAAa;AAClB,SAAK,cAAc;AAAA,EACvB;AAAA,EAEO,eAA0C;AAC7C,QAAI,CAAC,KAAK,eAAe,CAAC,KAAK,sBAAsB;AACjD,aAAO;AAAA,IACX;AAEA,WAAO,KAAK,qBAAqB,KAAK,WAAW;AAAA,EACrD;AAAA,EAEO,iBAAqC;AACxC,WAAO,KAAK;AAAA,EAChB;AAAA,EAEO,OAAO,OAA0C;AACpD,QAAI,CAAC,KAAK,sBAAsB;AAC5B,aAAO;AAAA,IACX;AAEA,WAAO,KAAK,qBAAqB,KAAK;AAAA,EAC1C;AAAA,EAEO,aAAa,SAA4C;AAC5D,QAAI,CAAC,KAAK,sBAAsB;AAC5B,aAAO;AAAA,IACX;AAEA,UAAM,iBAAiB,QAAQ,YAAY,EAAE,QAAQ,MAAM,GAAG;AAC9D,eAAW,SAAS,KAAK,sBAAsB;AAC3C,YAAM,gBAAgB,KAAK,qBAAqB,KAAK;AACrD,UAAI,cAAc,mBAAmB,gBAAgB;AACjD,eAAO;AAAA,MACX;AAAA,IACJ;AAEA,WAAO;AAAA,EACX;AAAA,EAEO,UAA2B;AAC9B,QAAI,CAAC,KAAK,sBAAsB;AAC5B,aAAO,CAAC;AAAA,IACZ;AAEA,WAAO,OAAO,OAAO,KAAK,oBAAoB;AAAA,EAClD;AAAA,EAEO,kBAA2B;AAC9B,WAAO,CAAC,CAAC,KAAK;AAAA,EAClB;AAAA,EAEA,OAAc,SAAS,MAA6B;AAChD,UAAM,MAAM,KAAK,MAAM,IAAI;AAC3B,UAAM,uBAA6C,CAAC;AACpD,eAAW,SAAS,IAAI,sBAAsB;AAC1C,2BAAqB,KAAK,IAAI,cAAc,SAAS,KAAK,UAAU,IAAI,qBAAqB,KAAK,CAAC,CAAC;AAAA,IACxG;AACA,WAAO,IAAI;AAAA,MACP,IAAI;AAAA,MACJ,IAAI;AAAA,MACJ;AAAA,MACA,IAAI;AAAA,MACJ,IAAI;AAAA,MACJ,IAAI;AAAA,MACJ,IAAI;AAAA,MACJ,IAAI;AAAA,MACJ,IAAI;AAAA,MACJ,IAAI;AAAA,MACJ,IAAI;AAAA,IACR;AAAA,EACJ;AAAA,EAEA,OAAc,eAAe,SAAsC;AAC/D,QAAI;AACJ,QAAI;AAEJ,QAAI,QAAQ,iBAAiB;AACzB,oBAAc,QAAQ,gBAAgB;AACtC,6BAAuB,uBAAuB,EAAE,CAAC,WAAW,GAAG,QAAQ,gBAAgB,CAAC;AAAA,IAC5F,OAAO;AACH,oBAAc;AACd,6BAAuB,uBAAuB,QAAQ,yBAAyB;AAAA,IACnF;AAEA,UAAM,cAAc,cAAc,QAAQ,YAAY;AAEtD,WAAO,IAAI;AAAA,MACP,QAAQ;AAAA,MACR,QAAQ;AAAA,MACR;AAAA,MACA,QAAQ;AAAA,MACR,QAAQ;AAAA,MACR,QAAQ;AAAA,MACR,QAAQ;AAAA,MACR,QAAQ;AAAA,MACR,QAAQ;AAAA,MACR;AAAA,MACA;AAAA,IACJ;AAAA,EACJ;AACJ;AAWO,IAAM,gBAAN,MAAoB;AAAA,EAYvB,YACI,OACA,SACA,aACA,gBACA,kBACA,mCACA,iBACA,kBACA,6BACF;AACE,SAAK,QAAQ;AACb,SAAK,UAAU;AACf,SAAK,cAAc;AACnB,SAAK,iBAAiB;AACtB,SAAK,mBAAmB;AAExB,SAAK,mBAAmB;AACxB,SAAK,oCAAoC;AACzC,SAAK,kBAAkB;AACvB,SAAK,8BAA8B;AAAA,EACvC;AAAA;AAAA,EAIO,OAAO,MAAuB;AACjC,QAAI,KAAK,qBAAqB,8BAA4B;AACtD,aAAO,KAAK,qBAAqB,QAAQ,KAAK,4BAA4B,SAAS,IAAI;AAAA,IAC3F,OAAO;AACH,aAAO,KAAK,qBAAqB;AAAA,IACrC;AAAA,EACJ;AAAA,EAEO,cAAc,MAAuB;AACxC,QAAI,KAAK,qBAAqB,8BAA4B;AACtD,aAAO,KAAK,qBAAqB,QAAQ,KAAK,4BAA4B,SAAS,IAAI;AAAA,IAC3F,OAAO;AACH,aAAO,KAAK,kCAAkC,SAAS,IAAI;AAAA,IAC/D;AAAA,EACJ;AAAA,EAEO,cAAc,YAA6B;AAC9C,WAAO,KAAK,gBAAgB,SAAS,UAAU;AAAA,EACnD;AAAA,EAEO,kBAAkB,aAAgC;AACrD,WAAO,YAAY,MAAM,CAAC,eAAe,KAAK,cAAc,UAAU,CAAC;AAAA,EAC3E;AAAA,EAEA,OAAc,SAAS,MAA6B;AAChD,UAAM,MAAM,KAAK,MAAM,IAAI;AAC3B,WAAO,IAAI;AAAA,MACP,IAAI;AAAA,MACJ,IAAI;AAAA,MACJ,IAAI;AAAA,MACJ,IAAI;AAAA,MACJ,IAAI;AAAA,MACJ,IAAI;AAAA,MACJ,IAAI;AAAA,MACJ,IAAI;AAAA,MACJ,IAAI;AAAA,IACR;AAAA,EACJ;AAAA;AAAA,EAIA,IAAI,eAAuB;AACvB,WAAO,KAAK;AAAA,EAChB;AAAA,EAEA,IAAI,gBAA0B;AAC1B,QAAI,KAAK,qBAAqB,8BAA4B;AACtD,aAAO,KAAK,4BAA4B,OAAO,KAAK,gBAAgB;AAAA,IACxE,OAAO;AACH,aAAO,CAAC,KAAK,gBAAgB;AAAA,IACjC;AAAA,EACJ;AAAA,EAEA,IAAI,gCAA0C;AAC1C,QAAI,KAAK,qBAAqB,8BAA4B;AACtD,aAAO,KAAK,4BAA4B,OAAO,KAAK,gBAAgB;AAAA,IACxE,OAAO;AACH,aAAO,KAAK;AAAA,IAChB;AAAA,EACJ;AAAA,EAEA,IAAI,cAAwB;AACxB,WAAO,KAAK;AAAA,EAChB;AACJ;AAkCO,SAAS,OAAO,YAAyC;AAC5D,SAAO,cAAc,eAAe,UAAU;AAClD;AAEO,SAAS,uBAAuB,YAEF;AACjC,MAAI,eAAe,QAAW;AAC1B,WAAO;AAAA,EACX;AACA,QAAM,YAAkC,CAAC;AAEzC,aAAW,OAAO,OAAO,KAAK,UAAU,GAAG;AACvC,UAAM,iBAAiB,WAAW,GAAG;AACrC,QAAI,gBAAgB;AAChB,gBAAU,GAAG,IAAI,IAAI;AAAA,QACjB,eAAe;AAAA,QACf,eAAe;AAAA,QACf,eAAe;AAAA,QACf,eAAe;AAAA,QACf,eAAe;AAAA,QACf,eAAe;AAAA,QACf,eAAe;AAAA,QACf,eAAe;AAAA,QACf,eAAe;AAAA,MACnB;AAAA,IACJ;AAAA,EACJ;AAEA,SAAO;AACX;;;ACpUO,IAAM,wBAAN,cAAoC,MAAM;AAAA,EAI7C,YAAY,SAAiB;AACzB,UAAM,OAAO;AACb,SAAK,UAAU;AACf,SAAK,SAAS;AAAA,EAClB;AACJ;AAEO,IAAM,yBAAN,cAAqC,MAAM;AAAA,EAI9C,YAAY,SAAiB;AACzB,UAAM,OAAO;AACb,SAAK,UAAU;AACf,SAAK,SAAS;AAAA,EAClB;AACJ;;;ACjBA,YAAY,UAAU;AAuCf,SAAS,mBAAmB;AAC/B,SAAO,WAAW,EAAE;AACxB;AAEO,SAAS,aAAa;AACzB,QAAM,UAAU,QAAQ,IAAI;AAC5B,MAAI,CAAC,SAAS;AACV,UAAM,IAAI,MAAM,iCAAiC;AAAA,EACrD;AACA,SAAO,IAAI,IAAI,OAAO;AAC1B;AAUO,SAAS,uBAAuB;AACnC,QAAM,oBAAoB,QAAQ,IAAI;AACtC,MAAI,CAAC,mBAAmB;AACpB,UAAM,IAAI,MAAM,+BAA+B;AAAA,EACnD;AACA,SAAO;AACX;AAEO,SAAS,iBAAiB;AAC7B,QAAM,cAAc,QAAQ,IAAI;AAChC,MAAI,CAAC,aAAa;AACd,UAAM,IAAI,MAAM,oCAAoC;AAAA,EACxD;AACA,SAAO,YAAY,QAAQ,QAAQ,IAAI;AAC3C;AA4DA,SAAsB,+BAClB,aACkC;AAAA;AAClC,QAAI;AACA,aAAO,MAAM,oBAAoB,WAAW;AAAA,IAChD,SAAS,KAAP;AACE,UAAI,eAAe,wBAAwB;AACvC,cAAM;AAAA,MACV,WAAW,eAAe,uBAAuB;AAC7C,eAAO;AAAA,MACX,OAAO;AACH,gBAAQ,KAAK,iCAAiC,GAAG;AACjD,eAAO;AAAA,MACX;AAAA,IACJ;AAAA,EACJ;AAAA;AAEA,SAAsB,oBAAoB,aAAyD;AAAA;AAC/F,QAAI;AACJ,QAAI;AACA,kBAAY,MAAW,gBAAW,eAAe,GAAG,OAAO;AAAA,IAC/D,SAAS,KAAP;AACE,cAAQ,MAAM,wFAAwF,GAAG;AACzG,YAAM,IAAI,uBAAuB,sBAAsB;AAAA,IAC3D;AAEA,QAAI,CAAC,aAAa;AACd,YAAM,IAAI,sBAAsB,0BAA0B;AAAA,IAC9D;AAEA,QAAI,2BAA2B;AAC/B,QAAI,YAAY,YAAY,EAAE,WAAW,SAAS,GAAG;AACjD,iCAA2B,YAAY,UAAU,UAAU,MAAM;AAAA,IACrE;AAEA,QAAI;AACA,YAAM,EAAE,QAAQ,IAAI,MAAW,eAAU,0BAA0B,WAAW;AAAA,QAC1E,QAAQ,iBAAiB;AAAA,QACzB,YAAY,CAAC,OAAO;AAAA,MACxB,CAAC;AAED,aAAO,OAAqB,OAAO;AAAA,IACvC,SAAS,GAAP;AACE,UAAI,aAAa,OAAO;AACpB,cAAM,IAAI,sBAAsB,EAAE,OAAO;AAAA,MAC7C,OAAO;AACH,cAAM,IAAI,sBAAsB,sBAAsB;AAAA,MAC1D;AAAA,IACJ;AAAA,EACJ;AAAA;;;ACzLA,SAAQ,eAAc;AAGf,IAAM,oBAAoB,MAAM;AACnC,QAAM,UAAU,WAAW;AAC3B,QAAM,oBAAoB,qBAAqB;AAE/C,SAAO,QAAQ,SAAS,iBAAiB;AAC7C;","names":[]}

package/dist/server/pages/index.d.ts

@@ -163,7 +163,7 @@ type InternalUser = {
     };
     login_method?: InternalLoginMethod;
     legacy_user_id?: string;
-    impersonatorUserId?: string;
+    impersonator_user_id?: string;
 };
 
 type AuthInfo = {

package/dist/server/pages/index.js

@@ -173,7 +173,7 @@ var UserFromToken = class {
       payload.last_name,
       payload.username,
       payload.legacy_user_id,
-      payload.impersonatorUserId,
+      payload.impersonator_user_id,
       payload.properties,
       activeOrgId,
       loginMethod
@@ -320,6 +320,22 @@ function getVerifierKey() {
   }
   return verifierKey.replace(/\\n/g, "\n");
 }
+function getSameSiteCookieValue() {
+  const sameSiteOverride = process.env.PROPELAUTH_SAME_SITE_COOKIE_OVERRIDE;
+  if (sameSiteOverride === "none") {
+    return "none";
+  } else if (sameSiteOverride === "lax") {
+    return "lax";
+  } else if (sameSiteOverride === "strict") {
+    return "strict";
+  } else if (sameSiteOverride) {
+    throw new Error(
+      'Invalid value for PROPELAUTH_SAME_SITE_COOKIE_OVERRIDE, must be one of "none", "lax", or "strict"'
+    );
+  } else {
+    return "lax";
+  }
+}
 function refreshTokenWithAccessAndRefreshToken(refreshToken, activeOrgId) {
   return __async(this, null, function* () {
     const body = {
@@ -412,6 +428,7 @@ function getAuthInfoFromServerSideProps(props, forceRefresh = false) {
     const accessToken = props.req.cookies[ACCESS_TOKEN_COOKIE_NAME];
     const refreshToken = props.req.cookies[REFRESH_TOKEN_COOKIE_NAME];
     const activeOrgId = props.req.cookies[ACTIVE_ORG_ID_COOKIE_NAME];
+    const sameSite = getSameSiteCookieValue();
     if (accessToken && !forceRefresh) {
       const user = yield validateAccessTokenOrUndefined(accessToken);
       if (user) {
@@ -427,8 +444,8 @@ function getAuthInfoFromServerSideProps(props, forceRefresh = false) {
         throw new Error("Unexpected error while refreshing access token");
       } else if (response.error === "unauthorized") {
         props.res.setHeader("Set-Cookie", [
-          `${ACCESS_TOKEN_COOKIE_NAME}=; Path=/; HttpOnly; Secure; SameSite=Lax; Max-Age=0`,
-          `${REFRESH_TOKEN_COOKIE_NAME}=; Path=/; HttpOnly; Secure; SameSite=Lax; Max-Age=0`
+          `${ACCESS_TOKEN_COOKIE_NAME}=; Path=/; HttpOnly; Secure; SameSite=${sameSite}; Max-Age=0`,
+          `${REFRESH_TOKEN_COOKIE_NAME}=; Path=/; HttpOnly; Secure; SameSite=${sameSite}; Max-Age=0`
         ]);
         return {
           user: void 0,
@@ -437,8 +454,8 @@ function getAuthInfoFromServerSideProps(props, forceRefresh = false) {
       } else {
         const user = yield validateAccessToken(response.accessToken);
         props.res.setHeader("Set-Cookie", [
-          `${ACCESS_TOKEN_COOKIE_NAME}=${response.accessToken}; Path=/; HttpOnly; Secure; SameSite=Lax`,
-          `${REFRESH_TOKEN_COOKIE_NAME}=${response.refreshToken}; Path=/; HttpOnly; Secure; SameSite=Lax`
+          `${ACCESS_TOKEN_COOKIE_NAME}=${response.accessToken}; Path=/; HttpOnly; Secure; SameSite=${sameSite}`,
+          `${REFRESH_TOKEN_COOKIE_NAME}=${response.refreshToken}; Path=/; HttpOnly; Secure; SameSite=${sameSite}`
         ]);
         return {
           user,
@@ -463,6 +480,7 @@ function getAuthInfoFromApiRouteRequest(req, res, forceRefresh = false) {
     const accessToken = req.cookies[ACCESS_TOKEN_COOKIE_NAME];
     const refreshToken = req.cookies[REFRESH_TOKEN_COOKIE_NAME];
     const activeOrgId = req.cookies[ACTIVE_ORG_ID_COOKIE_NAME];
+    const sameSite = getSameSiteCookieValue();
     if (accessToken && !forceRefresh) {
       const user = yield validateAccessTokenOrUndefined(accessToken);
       if (user) {
@@ -478,8 +496,8 @@ function getAuthInfoFromApiRouteRequest(req, res, forceRefresh = false) {
         throw new Error("Unexpected error while refreshing access token");
       } else if (response.error === "unauthorized") {
         res.setHeader("Set-Cookie", [
-          `${ACCESS_TOKEN_COOKIE_NAME}=; Path=/; HttpOnly; Secure; SameSite=Lax; Max-Age=0`,
-          `${REFRESH_TOKEN_COOKIE_NAME}=; Path=/; HttpOnly; Secure; SameSite=Lax; Max-Age=0`
+          `${ACCESS_TOKEN_COOKIE_NAME}=; Path=/; HttpOnly; Secure; SameSite=${sameSite}; Max-Age=0`,
+          `${REFRESH_TOKEN_COOKIE_NAME}=; Path=/; HttpOnly; Secure; SameSite=${sameSite}; Max-Age=0`
         ]);
         return {
           user: void 0,
@@ -488,8 +506,8 @@ function getAuthInfoFromApiRouteRequest(req, res, forceRefresh = false) {
       } else {
         const user = yield validateAccessToken(response.accessToken);
         res.setHeader("Set-Cookie", [
-          `${ACCESS_TOKEN_COOKIE_NAME}=${response.accessToken}; Path=/; HttpOnly; Secure; SameSite=Lax`,
-          `${REFRESH_TOKEN_COOKIE_NAME}=${response.refreshToken}; Path=/; HttpOnly; Secure; SameSite=Lax`
+          `${ACCESS_TOKEN_COOKIE_NAME}=${response.accessToken}; Path=/; HttpOnly; Secure; SameSite=${sameSite}`,
+          `${REFRESH_TOKEN_COOKIE_NAME}=${response.refreshToken}; Path=/; HttpOnly; Secure; SameSite=${sameSite}`
         ]);
         return {
           user,

package/dist/server/pages/index.js.map

@@ -1 +1 @@
-{"version":3,"sources":["../../../src/server/pages-index.ts","../../../src/loginMethod.ts","../../../src/user.ts","../../../src/server/exceptions.ts","../../../src/server/shared.ts","../../../src/shared.ts","../../../src/server/pages.ts"],"sourcesContent":["export {\n    getUserFromServerSideProps,\n    getUserFromApiRouteRequest,\n    getAuthInfoFromApiRouteRequest,\n    getAuthInfoFromServerSideProps\n} from \"./pages\"\nexport type {AuthInfo} from \"./pages\"","export enum SocialLoginProvider {\n    Google = 'Google',\n    GitHub = 'GitHub',\n    Microsoft = 'Microsoft',\n    Slack = 'Slack',\n    LinkedIn = 'LinkedIn',\n    Salesforce = 'Salesforce',\n    Xero = 'Xero',\n    QuickBooksOnline = 'QuickBooks Online',\n}\n\nexport enum SamlLoginProvider {\n    Google = 'Google',\n    Rippling = 'Rippling',\n    OneLogin = 'OneLogin',\n    JumpCloud = 'JumpCloud',\n    Okta = 'Okta',\n    Azure = 'Azure',\n    Duo = 'Duo',\n    Generic = 'Generic',\n}\n\ntype InternalPasswordLoginMethod = {\n    login_method: 'password'\n}\n\ntype InternalMagicLinkLoginMethod = {\n    login_method: 'magic_link'\n}\n\ntype InternalSocialSsoLoginMethod = {\n    login_method: 'social_sso'\n    provider: SocialLoginProvider\n}\n\ntype InternalEmailConfirmationLinkLoginMethod = {\n    login_method: 'email_confirmation_link'\n}\n\ntype InternalSamlSsoLoginMethod = {\n    login_method: 'saml_sso'\n    provider: SamlLoginProvider\n    org_id: string\n}\n\ntype InternalImpersonationLoginMethod = {\n    login_method: 'impersonation'\n}\n\ntype InternalGeneratedFromBackendApiLoginMethod = {\n    login_method: 'generated_from_backend_api'\n}\n\ntype InternalUnknownLoginMethod = {\n    login_method: 'unknown'\n}\n\nexport type InternalLoginMethod =\n    | InternalPasswordLoginMethod\n    | InternalMagicLinkLoginMethod\n    | InternalSocialSsoLoginMethod\n    | InternalEmailConfirmationLinkLoginMethod\n    | InternalSamlSsoLoginMethod\n    | InternalImpersonationLoginMethod\n    | InternalGeneratedFromBackendApiLoginMethod\n    | InternalUnknownLoginMethod\n\ntype PasswordLoginMethod = {\n    loginMethod: 'password'\n}\n\ntype MagicLinkLoginMethod = {\n    loginMethod: 'magic_link'\n}\n\ntype SocialSsoLoginMethod = {\n    loginMethod: 'social_sso'\n    provider: SocialLoginProvider\n}\n\ntype EmailConfirmationLinkLoginMethod = {\n    loginMethod: 'email_confirmation_link'\n}\n\ntype SamlSsoLoginMethod = {\n    loginMethod: 'saml_sso'\n    provider: SamlLoginProvider\n    orgId: string\n}\n\ntype ImpersonationLoginMethod = {\n    loginMethod: 'impersonation'\n}\n\ntype GeneratedFromBackendApiLoginMethod = {\n    loginMethod: 'generated_from_backend_api'\n}\n\ntype UnknownLoginMethod = {\n    loginMethod: 'unknown'\n}\n\nexport type LoginMethod =\n    | PasswordLoginMethod\n    | MagicLinkLoginMethod\n    | SocialSsoLoginMethod\n    | EmailConfirmationLinkLoginMethod\n    | SamlSsoLoginMethod\n    | ImpersonationLoginMethod\n    | GeneratedFromBackendApiLoginMethod\n    | UnknownLoginMethod\n\nexport function toLoginMethod(snake_case?: InternalLoginMethod): LoginMethod {\n    if (!snake_case) {\n        return { loginMethod: 'unknown' }\n    }\n\n    switch (snake_case.login_method) {\n        case 'password':\n            return { loginMethod: 'password' }\n        case 'magic_link':\n            return { loginMethod: 'magic_link' }\n        case 'social_sso':\n            return { loginMethod: 'social_sso', provider: snake_case.provider }\n        case 'email_confirmation_link':\n            return { loginMethod: 'email_confirmation_link' }\n        case 'saml_sso':\n            return { loginMethod: 'saml_sso', provider: snake_case.provider, orgId: snake_case.org_id }\n        case 'impersonation':\n            return { loginMethod: 'impersonation' }\n        case 'generated_from_backend_api':\n            return { loginMethod: 'generated_from_backend_api' }\n        default:\n            return { loginMethod: 'unknown' }\n    }\n}\n","import { InternalLoginMethod, LoginMethod, toLoginMethod } from './loginMethod'\n\nexport class UserFromToken {\n    public userId: string\n\n    public activeOrgId?: string\n    public orgIdToOrgMemberInfo?: OrgIdToOrgMemberInfo\n\n    // Metadata about the user\n    public email: string\n    public firstName?: string\n    public lastName?: string\n    public username?: string\n    public properties?: { [key: string]: unknown }\n    public loginMethod?: LoginMethod\n\n    // If you used our migration APIs to migrate this user from a different system,\n    //   this is their original ID from that system.\n    public legacyUserId?: string\n    public impersonatorUserId?: string\n\n    constructor(\n        userId: string,\n        email: string,\n        orgIdToOrgMemberInfo?: OrgIdToOrgMemberInfo,\n        firstName?: string,\n        lastName?: string,\n        username?: string,\n        legacyUserId?: string,\n        impersonatorUserId?: string,\n        properties?: { [key: string]: unknown },\n        activeOrgId?: string,\n        loginMethod?: LoginMethod\n    ) {\n        this.userId = userId\n\n        this.activeOrgId = activeOrgId\n        this.orgIdToOrgMemberInfo = orgIdToOrgMemberInfo\n\n        this.email = email\n        this.firstName = firstName\n        this.lastName = lastName\n        this.username = username\n\n        this.legacyUserId = legacyUserId\n        this.impersonatorUserId = impersonatorUserId\n\n        this.properties = properties\n        this.loginMethod = loginMethod\n    }\n\n    public getActiveOrg(): OrgMemberInfo | undefined {\n        if (!this.activeOrgId || !this.orgIdToOrgMemberInfo) {\n            return undefined\n        }\n\n        return this.orgIdToOrgMemberInfo[this.activeOrgId]\n    }\n\n    public getActiveOrgId(): string | undefined {\n        return this.activeOrgId\n    }\n\n    public getOrg(orgId: string): OrgMemberInfo | undefined {\n        if (!this.orgIdToOrgMemberInfo) {\n            return undefined\n        }\n\n        return this.orgIdToOrgMemberInfo[orgId]\n    }\n\n    public getOrgByName(orgName: string): OrgMemberInfo | undefined {\n        if (!this.orgIdToOrgMemberInfo) {\n            return undefined\n        }\n\n        const urlSafeOrgName = orgName.toLowerCase().replace(/ /g, '-')\n        for (const orgId in this.orgIdToOrgMemberInfo) {\n            const orgMemberInfo = this.orgIdToOrgMemberInfo[orgId]\n            if (orgMemberInfo.urlSafeOrgName === urlSafeOrgName) {\n                return orgMemberInfo\n            }\n        }\n\n        return undefined\n    }\n\n    public getOrgs(): OrgMemberInfo[] {\n        if (!this.orgIdToOrgMemberInfo) {\n            return []\n        }\n\n        return Object.values(this.orgIdToOrgMemberInfo)\n    }\n\n    public isImpersonating(): boolean {\n        return !!this.impersonatorUserId\n    }\n\n    public static fromJSON(json: string): UserFromToken {\n        const obj = JSON.parse(json)\n        const orgIdToOrgMemberInfo: OrgIdToOrgMemberInfo = {}\n        for (const orgId in obj.orgIdToOrgMemberInfo) {\n            orgIdToOrgMemberInfo[orgId] = OrgMemberInfo.fromJSON(JSON.stringify(obj.orgIdToOrgMemberInfo[orgId]))\n        }\n        return new UserFromToken(\n            obj.userId,\n            obj.email,\n            orgIdToOrgMemberInfo,\n            obj.firstName,\n            obj.lastName,\n            obj.username,\n            obj.legacyUserId,\n            obj.impersonatorUserId,\n            obj.properties,\n            obj.activeOrgId,\n            obj.loginMethod\n        )\n    }\n\n    public static fromJwtPayload(payload: InternalUser): UserFromToken {\n        let activeOrgId: string | undefined\n        let orgIdToOrgMemberInfo: OrgIdToOrgMemberInfo | undefined\n\n        if (payload.org_member_info) {\n            activeOrgId = payload.org_member_info.org_id\n            orgIdToOrgMemberInfo = toOrgIdToOrgMemberInfo({ [activeOrgId]: payload.org_member_info })\n        } else {\n            activeOrgId = undefined\n            orgIdToOrgMemberInfo = toOrgIdToOrgMemberInfo(payload.org_id_to_org_member_info)\n        }\n\n        const loginMethod = toLoginMethod(payload.login_method)\n\n        return new UserFromToken(\n            payload.user_id,\n            payload.email,\n            orgIdToOrgMemberInfo,\n            payload.first_name,\n            payload.last_name,\n            payload.username,\n            payload.legacy_user_id,\n            payload.impersonatorUserId,\n            payload.properties,\n            activeOrgId,\n            loginMethod\n        )\n    }\n}\n\nexport type OrgIdToOrgMemberInfo = {\n    [orgId: string]: OrgMemberInfo\n}\n\nexport enum OrgRoleStructure {\n    SingleRole = \"single_role_in_hierarchy\",\n    MultiRole = \"multi_role\",\n}\n\nexport class OrgMemberInfo {\n    public orgId: string\n    public orgName: string\n    public orgMetadata: { [key: string]: any }\n    public urlSafeOrgName: string\n    public orgRoleStructure: OrgRoleStructure\n\n    public userAssignedRole: string\n    public userInheritedRolesPlusCurrentRole: string[]\n    public userPermissions: string[]\n    public userAssignedAdditionalRoles: string[]\n\n    constructor(\n        orgId: string,\n        orgName: string,\n        orgMetadata: { [key: string]: any },\n        urlSafeOrgName: string,\n        userAssignedRole: string,\n        userInheritedRolesPlusCurrentRole: string[],\n        userPermissions: string[],\n        orgRoleStructure: OrgRoleStructure,\n        userAssignedAdditionalRoles: string[]\n    ) {\n        this.orgId = orgId\n        this.orgName = orgName\n        this.orgMetadata = orgMetadata\n        this.urlSafeOrgName = urlSafeOrgName\n        this.orgRoleStructure = orgRoleStructure\n\n        this.userAssignedRole = userAssignedRole\n        this.userInheritedRolesPlusCurrentRole = userInheritedRolesPlusCurrentRole\n        this.userPermissions = userPermissions\n        this.userAssignedAdditionalRoles = userAssignedAdditionalRoles\n    }\n\n    // validation methods\n\n    public isRole(role: string): boolean {\n        if (this.orgRoleStructure === OrgRoleStructure.MultiRole) {\n            return this.userAssignedRole === role || this.userAssignedAdditionalRoles.includes(role)\n        } else {\n            return this.userAssignedRole === role\n        }\n    }\n\n    public isAtLeastRole(role: string): boolean {\n        if (this.orgRoleStructure === OrgRoleStructure.MultiRole) {\n            return this.userAssignedRole === role || this.userAssignedAdditionalRoles.includes(role)\n        } else {\n            return this.userInheritedRolesPlusCurrentRole.includes(role)\n        }\n    }\n\n    public hasPermission(permission: string): boolean {\n        return this.userPermissions.includes(permission)\n    }\n\n    public hasAllPermissions(permissions: string[]): boolean {\n        return permissions.every((permission) => this.hasPermission(permission))\n    }\n\n    public static fromJSON(json: string): OrgMemberInfo {\n        const obj = JSON.parse(json)\n        return new OrgMemberInfo(\n            obj.orgId,\n            obj.orgName,\n            obj.orgMetadata,\n            obj.urlSafeOrgName,\n            obj.userAssignedRole,\n            obj.userInheritedRolesPlusCurrentRole,\n            obj.userPermissions,\n            obj.orgRoleStructure,\n            obj.userAssignedAdditionalRoles\n        )\n    }\n\n    // getters for the private fields\n\n    get assignedRole(): string {\n        return this.userAssignedRole\n    }\n\n    get assignedRoles(): string[] {\n        if (this.orgRoleStructure === OrgRoleStructure.MultiRole) {\n            return this.userAssignedAdditionalRoles.concat(this.userAssignedRole)\n        } else {\n            return [this.userAssignedRole]\n        }\n    }\n\n    get inheritedRolesPlusCurrentRole(): string[] {\n        if (this.orgRoleStructure === OrgRoleStructure.MultiRole) {\n            return this.userAssignedAdditionalRoles.concat(this.userAssignedRole)\n        } else {\n            return this.userInheritedRolesPlusCurrentRole\n        }\n    }\n\n    get permissions(): string[] {\n        return this.userPermissions\n    }\n}\n\n// These Internal types exist since the server returns snake case, but typescript/javascript\n// convention is camelCase.\nexport type InternalOrgMemberInfo = {\n    org_id: string\n    org_name: string\n    org_metadata: { [key: string]: any }\n    url_safe_org_name: string\n    org_role_structure: OrgRoleStructure\n    user_role: string\n    inherited_user_roles_plus_current_role: string[]\n    user_permissions: string[]\n    additional_roles: string[]\n}\n\nexport type InternalUser = {\n    user_id: string\n\n    org_member_info?: InternalOrgMemberInfo\n    org_id_to_org_member_info?: { [org_id: string]: InternalOrgMemberInfo }\n\n    email: string\n    first_name?: string\n    last_name?: string\n    username?: string\n    properties?: { [key: string]: unknown }\n    login_method?: InternalLoginMethod\n\n    // If you used our migration APIs to migrate this user from a different system, this is their original ID from that system.\n    legacy_user_id?: string\n    impersonatorUserId?: string\n}\n\nexport function toUser(snake_case: InternalUser): UserFromToken {\n    return UserFromToken.fromJwtPayload(snake_case)\n}\n\nexport function toOrgIdToOrgMemberInfo(snake_case?: {\n    [org_id: string]: InternalOrgMemberInfo\n}): OrgIdToOrgMemberInfo | undefined {\n    if (snake_case === undefined) {\n        return undefined\n    }\n    const camelCase: OrgIdToOrgMemberInfo = {}\n\n    for (const key of Object.keys(snake_case)) {\n        const snakeCaseValue = snake_case[key]\n        if (snakeCaseValue) {\n            camelCase[key] = new OrgMemberInfo(\n                snakeCaseValue.org_id,\n                snakeCaseValue.org_name,\n                snakeCaseValue.org_metadata,\n                snakeCaseValue.url_safe_org_name,\n                snakeCaseValue.user_role,\n                snakeCaseValue.inherited_user_roles_plus_current_role,\n                snakeCaseValue.user_permissions,\n                snakeCaseValue.org_role_structure,\n                snakeCaseValue.additional_roles\n            )\n        }\n    }\n\n    return camelCase\n}\n","export class UnauthorizedException extends Error {\n    readonly message: string\n    readonly status: number\n\n    constructor(message: string) {\n        super(message)\n        this.message = message\n        this.status = 401\n    }\n}\n\nexport class ConfigurationException extends Error {\n    readonly message: string\n    readonly status: number\n\n    constructor(message: string) {\n        super(message)\n        this.message = message\n        this.status = 500\n    }\n}\n","import { ResponseCookie } from 'next/dist/compiled/@edge-runtime/cookies'\nimport { InternalUser, toUser, UserFromToken } from '../user'\nimport { ConfigurationException, UnauthorizedException } from './exceptions'\nimport * as jose from 'jose'\n\ntype RefreshAndAccessTokens = {\n    refreshToken: string\n    accessToken: string\n    error: 'none'\n}\n\ntype RefreshAndAccessTokensUnauthorizedError = {\n    error: 'unauthorized'\n}\n\ntype RefreshAndAccessTokensUnexpectedError = {\n    error: 'unexpected'\n}\n\nexport type RefreshTokenResponse =\n    | RefreshAndAccessTokens\n    | RefreshAndAccessTokensUnauthorizedError\n    | RefreshAndAccessTokensUnexpectedError\n\nexport const LOGIN_PATH = '/api/auth/login'\nexport const CALLBACK_PATH = '/api/auth/callback'\nexport const USERINFO_PATH = '/api/auth/userinfo'\nexport const LOGOUT_PATH = '/api/auth/logout'\nexport const ACCESS_TOKEN_COOKIE_NAME = '__pa_at'\nexport const REFRESH_TOKEN_COOKIE_NAME = '__pa_rt'\nexport const STATE_COOKIE_NAME = '__pa_state'\nexport const CUSTOM_HEADER_FOR_ACCESS_TOKEN = 'x-propelauth-access-token'\nexport const CUSTOM_HEADER_FOR_URL = 'x-propelauth-current-url'\nexport const CUSTOM_HEADER_FOR_PATH = 'x-propelauth-current-path'\nexport const RETURN_TO_PATH_COOKIE_NAME = '__pa_return_to_path'\n\nexport const COOKIE_OPTIONS: Partial<ResponseCookie> = {\n    httpOnly: true,\n    sameSite: 'lax',\n    secure: true,\n    path: '/',\n}\n\nexport function getAuthUrlOrigin() {\n    return getAuthUrl().origin\n}\n\nexport function getAuthUrl() {\n    const authUrl = process.env.NEXT_PUBLIC_AUTH_URL\n    if (!authUrl) {\n        throw new Error('NEXT_PUBLIC_AUTH_URL is not set')\n    }\n    return new URL(authUrl)\n}\n\nexport function getRedirectUri() {\n    const redirectUri = process.env.PROPELAUTH_REDIRECT_URI\n    if (!redirectUri) {\n        throw new Error('PROPELAUTH_REDIRECT_URI is not set')\n    }\n    return redirectUri\n}\n\nexport function getIntegrationApiKey() {\n    const integrationApiKey = process.env.PROPELAUTH_API_KEY\n    if (!integrationApiKey) {\n        throw new Error('PROPELAUTH_API_KEY is not set')\n    }\n    return integrationApiKey\n}\n\nexport function getVerifierKey() {\n    const verifierKey = process.env.PROPELAUTH_VERIFIER_KEY\n    if (!verifierKey) {\n        throw new Error('PROPELAUTH_VERIFIER_KEY is not set')\n    }\n    return verifierKey.replace(/\\\\n/g, '\\n')\n}\n\nexport async function refreshTokenWithAccessAndRefreshToken(\n    refreshToken: string,\n    activeOrgId?: string\n): Promise<RefreshTokenResponse> {\n    const body = {\n        refresh_token: refreshToken,\n    }\n\n    const queryParams = new URLSearchParams()\n    if (activeOrgId) {\n        queryParams.set('with_active_org_support', 'true')\n        queryParams.set('active_org_id', activeOrgId)\n    }\n\n    const url = `${getAuthUrlOrigin()}/api/backend/v1/refresh_token?${queryParams.toString()}`\n    const response = await fetch(url, {\n        method: 'POST',\n        body: JSON.stringify(body),\n        headers: {\n            'Content-Type': 'application/json',\n            Authorization: 'Bearer ' + getIntegrationApiKey(),\n        },\n    })\n\n    if (response.ok) {\n        const data = await response.json()\n        const newRefreshToken = data.refresh_token\n        const { access_token: accessToken, expires_at_seconds: expiresAtSeconds } = data.access_token\n\n        return {\n            refreshToken: newRefreshToken,\n            accessToken,\n            error: 'none',\n        }\n    } else if (response.status === 400 || response.status === 401) {\n        return { error: 'unauthorized' }\n    } else {\n        return { error: 'unexpected' }\n    }\n}\n\nexport async function validateAccessTokenOrUndefined(\n    accessToken: string | undefined\n): Promise<UserFromToken | undefined> {\n    try {\n        return await validateAccessToken(accessToken)\n    } catch (err) {\n        if (err instanceof ConfigurationException) {\n            throw err\n        } else if (err instanceof UnauthorizedException) {\n            return undefined\n        } else {\n            console.info('Error validating access token', err)\n            return undefined\n        }\n    }\n}\n\nexport async function validateAccessToken(accessToken: string | undefined): Promise<UserFromToken> {\n    let publicKey\n    try {\n        publicKey = await jose.importSPKI(getVerifierKey(), 'RS256')\n    } catch (err) {\n        console.error(\"Verifier key is invalid. Make sure it's specified correctly, including the newlines.\", err)\n        throw new ConfigurationException('Invalid verifier key')\n    }\n\n    if (!accessToken) {\n        throw new UnauthorizedException('No access token provided')\n    }\n\n    let accessTokenWithoutBearer = accessToken\n    if (accessToken.toLowerCase().startsWith('bearer ')) {\n        accessTokenWithoutBearer = accessToken.substring('bearer '.length)\n    }\n\n    try {\n        const { payload } = await jose.jwtVerify(accessTokenWithoutBearer, publicKey, {\n            issuer: getAuthUrlOrigin(),\n            algorithms: ['RS256'],\n        })\n\n        return toUser(<InternalUser>payload)\n    } catch (e) {\n        if (e instanceof Error) {\n            throw new UnauthorizedException(e.message)\n        } else {\n            throw new UnauthorizedException('Unable to decode jwt')\n        }\n    }\n}\n","export const ACTIVE_ORG_ID_COOKIE_NAME = '__pa_org_id'\n","import {GetServerSidePropsContext, NextApiRequest, NextApiResponse} from 'next'\nimport {\n    ACCESS_TOKEN_COOKIE_NAME,\n    REFRESH_TOKEN_COOKIE_NAME,\n    refreshTokenWithAccessAndRefreshToken,\n    validateAccessToken,\n    validateAccessTokenOrUndefined,\n} from './shared'\nimport {ACTIVE_ORG_ID_COOKIE_NAME} from '../shared'\nimport {UserFromToken} from \"../user\";\n\nexport type AuthInfo = {\n    user: UserFromToken\n    accessToken: string\n} | {\n    user: undefined\n    accessToken: undefined\n}\n\nexport async function getAuthInfoFromServerSideProps(props: GetServerSidePropsContext, forceRefresh: boolean = false): Promise<AuthInfo> {\n    const accessToken = props.req.cookies[ACCESS_TOKEN_COOKIE_NAME]\n    const refreshToken = props.req.cookies[REFRESH_TOKEN_COOKIE_NAME]\n    const activeOrgId = props.req.cookies[ACTIVE_ORG_ID_COOKIE_NAME]\n\n    // If we are authenticated, we can continue\n    if (accessToken && !forceRefresh) {\n        const user = await validateAccessTokenOrUndefined(accessToken)\n        if (user) {\n            return {\n                user,\n                accessToken,\n            }\n        }\n    }\n\n    // Otherwise, we need to refresh the access token\n    if (refreshToken) {\n        const response = await refreshTokenWithAccessAndRefreshToken(refreshToken, activeOrgId)\n        if (response.error === 'unexpected') {\n            throw new Error('Unexpected error while refreshing access token')\n        } else if (response.error === 'unauthorized') {\n            props.res.setHeader('Set-Cookie', [\n                `${ACCESS_TOKEN_COOKIE_NAME}=; Path=/; HttpOnly; Secure; SameSite=Lax; Max-Age=0`,\n                `${REFRESH_TOKEN_COOKIE_NAME}=; Path=/; HttpOnly; Secure; SameSite=Lax; Max-Age=0`,\n            ])\n            return {\n                user: undefined,\n                accessToken: undefined,\n            }\n        } else {\n            const user = await validateAccessToken(response.accessToken)\n            props.res.setHeader('Set-Cookie', [\n                `${ACCESS_TOKEN_COOKIE_NAME}=${response.accessToken}; Path=/; HttpOnly; Secure; SameSite=Lax`,\n                `${REFRESH_TOKEN_COOKIE_NAME}=${response.refreshToken}; Path=/; HttpOnly; Secure; SameSite=Lax`,\n            ])\n            return {\n                user,\n                accessToken: response.accessToken\n            }\n        }\n    }\n\n    return {\n        user: undefined,\n        accessToken: undefined,\n    }\n}\n\nexport async function getUserFromServerSideProps(props: GetServerSidePropsContext, forceRefresh: boolean = false) {\n    const {user} = await getAuthInfoFromServerSideProps(props, forceRefresh)\n    return user\n}\n\nexport async function getAuthInfoFromApiRouteRequest(\n    req: NextApiRequest,\n    res: NextApiResponse,\n    forceRefresh: boolean = false\n): Promise<AuthInfo> {\n    const accessToken = req.cookies[ACCESS_TOKEN_COOKIE_NAME]\n    const refreshToken = req.cookies[REFRESH_TOKEN_COOKIE_NAME]\n    const activeOrgId = req.cookies[ACTIVE_ORG_ID_COOKIE_NAME]\n\n    // If we are authenticated, we can continue\n    if (accessToken && !forceRefresh) {\n        const user = await validateAccessTokenOrUndefined(accessToken)\n        if (user) {\n            return {\n                user,\n                accessToken,\n            }\n        }\n    }\n\n    // Otherwise, we need to refresh the access token\n    if (refreshToken) {\n        const response = await refreshTokenWithAccessAndRefreshToken(refreshToken, activeOrgId)\n        if (response.error === 'unexpected') {\n            throw new Error('Unexpected error while refreshing access token')\n        } else if (response.error === 'unauthorized') {\n            res.setHeader('Set-Cookie', [\n                `${ACCESS_TOKEN_COOKIE_NAME}=; Path=/; HttpOnly; Secure; SameSite=Lax; Max-Age=0`,\n                `${REFRESH_TOKEN_COOKIE_NAME}=; Path=/; HttpOnly; Secure; SameSite=Lax; Max-Age=0`,\n            ])\n            return {\n                user: undefined,\n                accessToken: undefined,\n            }\n        } else {\n            const user = await validateAccessToken(response.accessToken)\n            res.setHeader('Set-Cookie', [\n                `${ACCESS_TOKEN_COOKIE_NAME}=${response.accessToken}; Path=/; HttpOnly; Secure; SameSite=Lax`,\n                `${REFRESH_TOKEN_COOKIE_NAME}=${response.refreshToken}; Path=/; HttpOnly; Secure; SameSite=Lax`,\n            ])\n            return {\n                user,\n                accessToken: response.accessToken,\n            }\n        }\n    }\n\n    return {\n        user: undefined,\n        accessToken: undefined,\n    }\n}\n\nexport async function getUserFromApiRouteRequest(\n    req: NextApiRequest,\n    res: NextApiResponse,\n    forceRefresh: boolean = false\n) {\n    const {user} = await getAuthInfoFromApiRouteRequest(req, res, forceRefresh)\n    return user\n}\n"],"mappings":";;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;;;ACgHO,SAAS,cAAc,YAA+C;AACzE,MAAI,CAAC,YAAY;AACb,WAAO,EAAE,aAAa,UAAU;AAAA,EACpC;AAEA,UAAQ,WAAW,cAAc;AAAA,IAC7B,KAAK;AACD,aAAO,EAAE,aAAa,WAAW;AAAA,IACrC,KAAK;AACD,aAAO,EAAE,aAAa,aAAa;AAAA,IACvC,KAAK;AACD,aAAO,EAAE,aAAa,cAAc,UAAU,WAAW,SAAS;AAAA,IACtE,KAAK;AACD,aAAO,EAAE,aAAa,0BAA0B;AAAA,IACpD,KAAK;AACD,aAAO,EAAE,aAAa,YAAY,UAAU,WAAW,UAAU,OAAO,WAAW,OAAO;AAAA,IAC9F,KAAK;AACD,aAAO,EAAE,aAAa,gBAAgB;AAAA,IAC1C,KAAK;AACD,aAAO,EAAE,aAAa,6BAA6B;AAAA,IACvD;AACI,aAAO,EAAE,aAAa,UAAU;AAAA,EACxC;AACJ;;;ACrIO,IAAM,gBAAN,MAAoB;AAAA,EAmBvB,YACI,QACA,OACA,sBACA,WACA,UACA,UACA,cACA,oBACA,YACA,aACA,aACF;AACE,SAAK,SAAS;AAEd,SAAK,cAAc;AACnB,SAAK,uBAAuB;AAE5B,SAAK,QAAQ;AACb,SAAK,YAAY;AACjB,SAAK,WAAW;AAChB,SAAK,WAAW;AAEhB,SAAK,eAAe;AACpB,SAAK,qBAAqB;AAE1B,SAAK,aAAa;AAClB,SAAK,cAAc;AAAA,EACvB;AAAA,EAEO,eAA0C;AAC7C,QAAI,CAAC,KAAK,eAAe,CAAC,KAAK,sBAAsB;AACjD,aAAO;AAAA,IACX;AAEA,WAAO,KAAK,qBAAqB,KAAK,WAAW;AAAA,EACrD;AAAA,EAEO,iBAAqC;AACxC,WAAO,KAAK;AAAA,EAChB;AAAA,EAEO,OAAO,OAA0C;AACpD,QAAI,CAAC,KAAK,sBAAsB;AAC5B,aAAO;AAAA,IACX;AAEA,WAAO,KAAK,qBAAqB,KAAK;AAAA,EAC1C;AAAA,EAEO,aAAa,SAA4C;AAC5D,QAAI,CAAC,KAAK,sBAAsB;AAC5B,aAAO;AAAA,IACX;AAEA,UAAM,iBAAiB,QAAQ,YAAY,EAAE,QAAQ,MAAM,GAAG;AAC9D,eAAW,SAAS,KAAK,sBAAsB;AAC3C,YAAM,gBAAgB,KAAK,qBAAqB,KAAK;AACrD,UAAI,cAAc,mBAAmB,gBAAgB;AACjD,eAAO;AAAA,MACX;AAAA,IACJ;AAEA,WAAO;AAAA,EACX;AAAA,EAEO,UAA2B;AAC9B,QAAI,CAAC,KAAK,sBAAsB;AAC5B,aAAO,CAAC;AAAA,IACZ;AAEA,WAAO,OAAO,OAAO,KAAK,oBAAoB;AAAA,EAClD;AAAA,EAEO,kBAA2B;AAC9B,WAAO,CAAC,CAAC,KAAK;AAAA,EAClB;AAAA,EAEA,OAAc,SAAS,MAA6B;AAChD,UAAM,MAAM,KAAK,MAAM,IAAI;AAC3B,UAAM,uBAA6C,CAAC;AACpD,eAAW,SAAS,IAAI,sBAAsB;AAC1C,2BAAqB,KAAK,IAAI,cAAc,SAAS,KAAK,UAAU,IAAI,qBAAqB,KAAK,CAAC,CAAC;AAAA,IACxG;AACA,WAAO,IAAI;AAAA,MACP,IAAI;AAAA,MACJ,IAAI;AAAA,MACJ;AAAA,MACA,IAAI;AAAA,MACJ,IAAI;AAAA,MACJ,IAAI;AAAA,MACJ,IAAI;AAAA,MACJ,IAAI;AAAA,MACJ,IAAI;AAAA,MACJ,IAAI;AAAA,MACJ,IAAI;AAAA,IACR;AAAA,EACJ;AAAA,EAEA,OAAc,eAAe,SAAsC;AAC/D,QAAI;AACJ,QAAI;AAEJ,QAAI,QAAQ,iBAAiB;AACzB,oBAAc,QAAQ,gBAAgB;AACtC,6BAAuB,uBAAuB,EAAE,CAAC,WAAW,GAAG,QAAQ,gBAAgB,CAAC;AAAA,IAC5F,OAAO;AACH,oBAAc;AACd,6BAAuB,uBAAuB,QAAQ,yBAAyB;AAAA,IACnF;AAEA,UAAM,cAAc,cAAc,QAAQ,YAAY;AAEtD,WAAO,IAAI;AAAA,MACP,QAAQ;AAAA,MACR,QAAQ;AAAA,MACR;AAAA,MACA,QAAQ;AAAA,MACR,QAAQ;AAAA,MACR,QAAQ;AAAA,MACR,QAAQ;AAAA,MACR,QAAQ;AAAA,MACR,QAAQ;AAAA,MACR;AAAA,MACA;AAAA,IACJ;AAAA,EACJ;AACJ;AAWO,IAAM,gBAAN,MAAoB;AAAA,EAYvB,YACI,OACA,SACA,aACA,gBACA,kBACA,mCACA,iBACA,kBACA,6BACF;AACE,SAAK,QAAQ;AACb,SAAK,UAAU;AACf,SAAK,cAAc;AACnB,SAAK,iBAAiB;AACtB,SAAK,mBAAmB;AAExB,SAAK,mBAAmB;AACxB,SAAK,oCAAoC;AACzC,SAAK,kBAAkB;AACvB,SAAK,8BAA8B;AAAA,EACvC;AAAA;AAAA,EAIO,OAAO,MAAuB;AACjC,QAAI,KAAK,qBAAqB,8BAA4B;AACtD,aAAO,KAAK,qBAAqB,QAAQ,KAAK,4BAA4B,SAAS,IAAI;AAAA,IAC3F,OAAO;AACH,aAAO,KAAK,qBAAqB;AAAA,IACrC;AAAA,EACJ;AAAA,EAEO,cAAc,MAAuB;AACxC,QAAI,KAAK,qBAAqB,8BAA4B;AACtD,aAAO,KAAK,qBAAqB,QAAQ,KAAK,4BAA4B,SAAS,IAAI;AAAA,IAC3F,OAAO;AACH,aAAO,KAAK,kCAAkC,SAAS,IAAI;AAAA,IAC/D;AAAA,EACJ;AAAA,EAEO,cAAc,YAA6B;AAC9C,WAAO,KAAK,gBAAgB,SAAS,UAAU;AAAA,EACnD;AAAA,EAEO,kBAAkB,aAAgC;AACrD,WAAO,YAAY,MAAM,CAAC,eAAe,KAAK,cAAc,UAAU,CAAC;AAAA,EAC3E;AAAA,EAEA,OAAc,SAAS,MAA6B;AAChD,UAAM,MAAM,KAAK,MAAM,IAAI;AAC3B,WAAO,IAAI;AAAA,MACP,IAAI;AAAA,MACJ,IAAI;AAAA,MACJ,IAAI;AAAA,MACJ,IAAI;AAAA,MACJ,IAAI;AAAA,MACJ,IAAI;AAAA,MACJ,IAAI;AAAA,MACJ,IAAI;AAAA,MACJ,IAAI;AAAA,IACR;AAAA,EACJ;AAAA;AAAA,EAIA,IAAI,eAAuB;AACvB,WAAO,KAAK;AAAA,EAChB;AAAA,EAEA,IAAI,gBAA0B;AAC1B,QAAI,KAAK,qBAAqB,8BAA4B;AACtD,aAAO,KAAK,4BAA4B,OAAO,KAAK,gBAAgB;AAAA,IACxE,OAAO;AACH,aAAO,CAAC,KAAK,gBAAgB;AAAA,IACjC;AAAA,EACJ;AAAA,EAEA,IAAI,gCAA0C;AAC1C,QAAI,KAAK,qBAAqB,8BAA4B;AACtD,aAAO,KAAK,4BAA4B,OAAO,KAAK,gBAAgB;AAAA,IACxE,OAAO;AACH,aAAO,KAAK;AAAA,IAChB;AAAA,EACJ;AAAA,EAEA,IAAI,cAAwB;AACxB,WAAO,KAAK;AAAA,EAChB;AACJ;AAkCO,SAAS,OAAO,YAAyC;AAC5D,SAAO,cAAc,eAAe,UAAU;AAClD;AAEO,SAAS,uBAAuB,YAEF;AACjC,MAAI,eAAe,QAAW;AAC1B,WAAO;AAAA,EACX;AACA,QAAM,YAAkC,CAAC;AAEzC,aAAW,OAAO,OAAO,KAAK,UAAU,GAAG;AACvC,UAAM,iBAAiB,WAAW,GAAG;AACrC,QAAI,gBAAgB;AAChB,gBAAU,GAAG,IAAI,IAAI;AAAA,QACjB,eAAe;AAAA,QACf,eAAe;AAAA,QACf,eAAe;AAAA,QACf,eAAe;AAAA,QACf,eAAe;AAAA,QACf,eAAe;AAAA,QACf,eAAe;AAAA,QACf,eAAe;AAAA,QACf,eAAe;AAAA,MACnB;AAAA,IACJ;AAAA,EACJ;AAEA,SAAO;AACX;;;ACpUO,IAAM,wBAAN,cAAoC,MAAM;AAAA,EAI7C,YAAY,SAAiB;AACzB,UAAM,OAAO;AACb,SAAK,UAAU;AACf,SAAK,SAAS;AAAA,EAClB;AACJ;AAEO,IAAM,yBAAN,cAAqC,MAAM;AAAA,EAI9C,YAAY,SAAiB;AACzB,UAAM,OAAO;AACb,SAAK,UAAU;AACf,SAAK,SAAS;AAAA,EAClB;AACJ;;;ACjBA,WAAsB;AAyBf,IAAM,2BAA2B;AACjC,IAAM,4BAA4B;AAclC,SAAS,mBAAmB;AAC/B,SAAO,WAAW,EAAE;AACxB;AAEO,SAAS,aAAa;AACzB,QAAM,UAAU,QAAQ,IAAI;AAC5B,MAAI,CAAC,SAAS;AACV,UAAM,IAAI,MAAM,iCAAiC;AAAA,EACrD;AACA,SAAO,IAAI,IAAI,OAAO;AAC1B;AAUO,SAAS,uBAAuB;AACnC,QAAM,oBAAoB,QAAQ,IAAI;AACtC,MAAI,CAAC,mBAAmB;AACpB,UAAM,IAAI,MAAM,+BAA+B;AAAA,EACnD;AACA,SAAO;AACX;AAEO,SAAS,iBAAiB;AAC7B,QAAM,cAAc,QAAQ,IAAI;AAChC,MAAI,CAAC,aAAa;AACd,UAAM,IAAI,MAAM,oCAAoC;AAAA,EACxD;AACA,SAAO,YAAY,QAAQ,QAAQ,IAAI;AAC3C;AAEA,SAAsB,sCAClB,cACA,aAC6B;AAAA;AAC7B,UAAM,OAAO;AAAA,MACT,eAAe;AAAA,IACnB;AAEA,UAAM,cAAc,IAAI,gBAAgB;AACxC,QAAI,aAAa;AACb,kBAAY,IAAI,2BAA2B,MAAM;AACjD,kBAAY,IAAI,iBAAiB,WAAW;AAAA,IAChD;AAEA,UAAM,MAAM,GAAG,iBAAiB,kCAAkC,YAAY,SAAS;AACvF,UAAM,WAAW,MAAM,MAAM,KAAK;AAAA,MAC9B,QAAQ;AAAA,MACR,MAAM,KAAK,UAAU,IAAI;AAAA,MACzB,SAAS;AAAA,QACL,gBAAgB;AAAA,QAChB,eAAe,YAAY,qBAAqB;AAAA,MACpD;AAAA,IACJ,CAAC;AAED,QAAI,SAAS,IAAI;AACb,YAAM,OAAO,MAAM,SAAS,KAAK;AACjC,YAAM,kBAAkB,KAAK;AAC7B,YAAM,EAAE,cAAc,aAAa,oBAAoB,iBAAiB,IAAI,KAAK;AAEjF,aAAO;AAAA,QACH,cAAc;AAAA,QACd;AAAA,QACA,OAAO;AAAA,MACX;AAAA,IACJ,WAAW,SAAS,WAAW,OAAO,SAAS,WAAW,KAAK;AAC3D,aAAO,EAAE,OAAO,eAAe;AAAA,IACnC,OAAO;AACH,aAAO,EAAE,OAAO,aAAa;AAAA,IACjC;AAAA,EACJ;AAAA;AAEA,SAAsB,+BAClB,aACkC;AAAA;AAClC,QAAI;AACA,aAAO,MAAM,oBAAoB,WAAW;AAAA,IAChD,SAAS,KAAP;AACE,UAAI,eAAe,wBAAwB;AACvC,cAAM;AAAA,MACV,WAAW,eAAe,uBAAuB;AAC7C,eAAO;AAAA,MACX,OAAO;AACH,gBAAQ,KAAK,iCAAiC,GAAG;AACjD,eAAO;AAAA,MACX;AAAA,IACJ;AAAA,EACJ;AAAA;AAEA,SAAsB,oBAAoB,aAAyD;AAAA;AAC/F,QAAI;AACJ,QAAI;AACA,kBAAY,MAAW,gBAAW,eAAe,GAAG,OAAO;AAAA,IAC/D,SAAS,KAAP;AACE,cAAQ,MAAM,wFAAwF,GAAG;AACzG,YAAM,IAAI,uBAAuB,sBAAsB;AAAA,IAC3D;AAEA,QAAI,CAAC,aAAa;AACd,YAAM,IAAI,sBAAsB,0BAA0B;AAAA,IAC9D;AAEA,QAAI,2BAA2B;AAC/B,QAAI,YAAY,YAAY,EAAE,WAAW,SAAS,GAAG;AACjD,iCAA2B,YAAY,UAAU,UAAU,MAAM;AAAA,IACrE;AAEA,QAAI;AACA,YAAM,EAAE,QAAQ,IAAI,MAAW,eAAU,0BAA0B,WAAW;AAAA,QAC1E,QAAQ,iBAAiB;AAAA,QACzB,YAAY,CAAC,OAAO;AAAA,MACxB,CAAC;AAED,aAAO,OAAqB,OAAO;AAAA,IACvC,SAAS,GAAP;AACE,UAAI,aAAa,OAAO;AACpB,cAAM,IAAI,sBAAsB,EAAE,OAAO;AAAA,MAC7C,OAAO;AACH,cAAM,IAAI,sBAAsB,sBAAsB;AAAA,MAC1D;AAAA,IACJ;AAAA,EACJ;AAAA;;;ACzKO,IAAM,4BAA4B;;;ACmBzC,SAAsB,+BAA+B,OAAkC,eAAwB,OAA0B;AAAA;AACrI,UAAM,cAAc,MAAM,IAAI,QAAQ,wBAAwB;AAC9D,UAAM,eAAe,MAAM,IAAI,QAAQ,yBAAyB;AAChE,UAAM,cAAc,MAAM,IAAI,QAAQ,yBAAyB;AAG/D,QAAI,eAAe,CAAC,cAAc;AAC9B,YAAM,OAAO,MAAM,+BAA+B,WAAW;AAC7D,UAAI,MAAM;AACN,eAAO;AAAA,UACH;AAAA,UACA;AAAA,QACJ;AAAA,MACJ;AAAA,IACJ;AAGA,QAAI,cAAc;AACd,YAAM,WAAW,MAAM,sCAAsC,cAAc,WAAW;AACtF,UAAI,SAAS,UAAU,cAAc;AACjC,cAAM,IAAI,MAAM,gDAAgD;AAAA,MACpE,WAAW,SAAS,UAAU,gBAAgB;AAC1C,cAAM,IAAI,UAAU,cAAc;AAAA,UAC9B,GAAG;AAAA,UACH,GAAG;AAAA,QACP,CAAC;AACD,eAAO;AAAA,UACH,MAAM;AAAA,UACN,aAAa;AAAA,QACjB;AAAA,MACJ,OAAO;AACH,cAAM,OAAO,MAAM,oBAAoB,SAAS,WAAW;AAC3D,cAAM,IAAI,UAAU,cAAc;AAAA,UAC9B,GAAG,4BAA4B,SAAS;AAAA,UACxC,GAAG,6BAA6B,SAAS;AAAA,QAC7C,CAAC;AACD,eAAO;AAAA,UACH;AAAA,UACA,aAAa,SAAS;AAAA,QAC1B;AAAA,MACJ;AAAA,IACJ;AAEA,WAAO;AAAA,MACH,MAAM;AAAA,MACN,aAAa;AAAA,IACjB;AAAA,EACJ;AAAA;AAEA,SAAsB,2BAA2B,OAAkC,eAAwB,OAAO;AAAA;AAC9G,UAAM,EAAC,KAAI,IAAI,MAAM,+BAA+B,OAAO,YAAY;AACvE,WAAO;AAAA,EACX;AAAA;AAEA,SAAsB,+BAClB,KACA,KACA,eAAwB,OACP;AAAA;AACjB,UAAM,cAAc,IAAI,QAAQ,wBAAwB;AACxD,UAAM,eAAe,IAAI,QAAQ,yBAAyB;AAC1D,UAAM,cAAc,IAAI,QAAQ,yBAAyB;AAGzD,QAAI,eAAe,CAAC,cAAc;AAC9B,YAAM,OAAO,MAAM,+BAA+B,WAAW;AAC7D,UAAI,MAAM;AACN,eAAO;AAAA,UACH;AAAA,UACA;AAAA,QACJ;AAAA,MACJ;AAAA,IACJ;AAGA,QAAI,cAAc;AACd,YAAM,WAAW,MAAM,sCAAsC,cAAc,WAAW;AACtF,UAAI,SAAS,UAAU,cAAc;AACjC,cAAM,IAAI,MAAM,gDAAgD;AAAA,MACpE,WAAW,SAAS,UAAU,gBAAgB;AAC1C,YAAI,UAAU,cAAc;AAAA,UACxB,GAAG;AAAA,UACH,GAAG;AAAA,QACP,CAAC;AACD,eAAO;AAAA,UACH,MAAM;AAAA,UACN,aAAa;AAAA,QACjB;AAAA,MACJ,OAAO;AACH,cAAM,OAAO,MAAM,oBAAoB,SAAS,WAAW;AAC3D,YAAI,UAAU,cAAc;AAAA,UACxB,GAAG,4BAA4B,SAAS;AAAA,UACxC,GAAG,6BAA6B,SAAS;AAAA,QAC7C,CAAC;AACD,eAAO;AAAA,UACH;AAAA,UACA,aAAa,SAAS;AAAA,QAC1B;AAAA,MACJ;AAAA,IACJ;AAEA,WAAO;AAAA,MACH,MAAM;AAAA,MACN,aAAa;AAAA,IACjB;AAAA,EACJ;AAAA;AAEA,SAAsB,2BAClB,KACA,KACA,eAAwB,OAC1B;AAAA;AACE,UAAM,EAAC,KAAI,IAAI,MAAM,+BAA+B,KAAK,KAAK,YAAY;AAC1E,WAAO;AAAA,EACX;AAAA;","names":[]}
+{"version":3,"sources":["../../../src/server/pages-index.ts","../../../src/loginMethod.ts","../../../src/user.ts","../../../src/server/exceptions.ts","../../../src/server/shared.ts","../../../src/shared.ts","../../../src/server/pages.ts"],"sourcesContent":["export {\n    getUserFromServerSideProps,\n    getUserFromApiRouteRequest,\n    getAuthInfoFromApiRouteRequest,\n    getAuthInfoFromServerSideProps\n} from \"./pages\"\nexport type {AuthInfo} from \"./pages\"","export enum SocialLoginProvider {\n    Google = 'Google',\n    GitHub = 'GitHub',\n    Microsoft = 'Microsoft',\n    Slack = 'Slack',\n    LinkedIn = 'LinkedIn',\n    Salesforce = 'Salesforce',\n    Xero = 'Xero',\n    QuickBooksOnline = 'QuickBooks Online',\n}\n\nexport enum SamlLoginProvider {\n    Google = 'Google',\n    Rippling = 'Rippling',\n    OneLogin = 'OneLogin',\n    JumpCloud = 'JumpCloud',\n    Okta = 'Okta',\n    Azure = 'Azure',\n    Duo = 'Duo',\n    Generic = 'Generic',\n}\n\ntype InternalPasswordLoginMethod = {\n    login_method: 'password'\n}\n\ntype InternalMagicLinkLoginMethod = {\n    login_method: 'magic_link'\n}\n\ntype InternalSocialSsoLoginMethod = {\n    login_method: 'social_sso'\n    provider: SocialLoginProvider\n}\n\ntype InternalEmailConfirmationLinkLoginMethod = {\n    login_method: 'email_confirmation_link'\n}\n\ntype InternalSamlSsoLoginMethod = {\n    login_method: 'saml_sso'\n    provider: SamlLoginProvider\n    org_id: string\n}\n\ntype InternalImpersonationLoginMethod = {\n    login_method: 'impersonation'\n}\n\ntype InternalGeneratedFromBackendApiLoginMethod = {\n    login_method: 'generated_from_backend_api'\n}\n\ntype InternalUnknownLoginMethod = {\n    login_method: 'unknown'\n}\n\nexport type InternalLoginMethod =\n    | InternalPasswordLoginMethod\n    | InternalMagicLinkLoginMethod\n    | InternalSocialSsoLoginMethod\n    | InternalEmailConfirmationLinkLoginMethod\n    | InternalSamlSsoLoginMethod\n    | InternalImpersonationLoginMethod\n    | InternalGeneratedFromBackendApiLoginMethod\n    | InternalUnknownLoginMethod\n\ntype PasswordLoginMethod = {\n    loginMethod: 'password'\n}\n\ntype MagicLinkLoginMethod = {\n    loginMethod: 'magic_link'\n}\n\ntype SocialSsoLoginMethod = {\n    loginMethod: 'social_sso'\n    provider: SocialLoginProvider\n}\n\ntype EmailConfirmationLinkLoginMethod = {\n    loginMethod: 'email_confirmation_link'\n}\n\ntype SamlSsoLoginMethod = {\n    loginMethod: 'saml_sso'\n    provider: SamlLoginProvider\n    orgId: string\n}\n\ntype ImpersonationLoginMethod = {\n    loginMethod: 'impersonation'\n}\n\ntype GeneratedFromBackendApiLoginMethod = {\n    loginMethod: 'generated_from_backend_api'\n}\n\ntype UnknownLoginMethod = {\n    loginMethod: 'unknown'\n}\n\nexport type LoginMethod =\n    | PasswordLoginMethod\n    | MagicLinkLoginMethod\n    | SocialSsoLoginMethod\n    | EmailConfirmationLinkLoginMethod\n    | SamlSsoLoginMethod\n    | ImpersonationLoginMethod\n    | GeneratedFromBackendApiLoginMethod\n    | UnknownLoginMethod\n\nexport function toLoginMethod(snake_case?: InternalLoginMethod): LoginMethod {\n    if (!snake_case) {\n        return { loginMethod: 'unknown' }\n    }\n\n    switch (snake_case.login_method) {\n        case 'password':\n            return { loginMethod: 'password' }\n        case 'magic_link':\n            return { loginMethod: 'magic_link' }\n        case 'social_sso':\n            return { loginMethod: 'social_sso', provider: snake_case.provider }\n        case 'email_confirmation_link':\n            return { loginMethod: 'email_confirmation_link' }\n        case 'saml_sso':\n            return { loginMethod: 'saml_sso', provider: snake_case.provider, orgId: snake_case.org_id }\n        case 'impersonation':\n            return { loginMethod: 'impersonation' }\n        case 'generated_from_backend_api':\n            return { loginMethod: 'generated_from_backend_api' }\n        default:\n            return { loginMethod: 'unknown' }\n    }\n}\n","import { InternalLoginMethod, LoginMethod, toLoginMethod } from './loginMethod'\n\nexport class UserFromToken {\n    public userId: string\n\n    public activeOrgId?: string\n    public orgIdToOrgMemberInfo?: OrgIdToOrgMemberInfo\n\n    // Metadata about the user\n    public email: string\n    public firstName?: string\n    public lastName?: string\n    public username?: string\n    public properties?: { [key: string]: unknown }\n    public loginMethod?: LoginMethod\n\n    // If you used our migration APIs to migrate this user from a different system,\n    //   this is their original ID from that system.\n    public legacyUserId?: string\n    public impersonatorUserId?: string\n\n    constructor(\n        userId: string,\n        email: string,\n        orgIdToOrgMemberInfo?: OrgIdToOrgMemberInfo,\n        firstName?: string,\n        lastName?: string,\n        username?: string,\n        legacyUserId?: string,\n        impersonatorUserId?: string,\n        properties?: { [key: string]: unknown },\n        activeOrgId?: string,\n        loginMethod?: LoginMethod\n    ) {\n        this.userId = userId\n\n        this.activeOrgId = activeOrgId\n        this.orgIdToOrgMemberInfo = orgIdToOrgMemberInfo\n\n        this.email = email\n        this.firstName = firstName\n        this.lastName = lastName\n        this.username = username\n\n        this.legacyUserId = legacyUserId\n        this.impersonatorUserId = impersonatorUserId\n\n        this.properties = properties\n        this.loginMethod = loginMethod\n    }\n\n    public getActiveOrg(): OrgMemberInfo | undefined {\n        if (!this.activeOrgId || !this.orgIdToOrgMemberInfo) {\n            return undefined\n        }\n\n        return this.orgIdToOrgMemberInfo[this.activeOrgId]\n    }\n\n    public getActiveOrgId(): string | undefined {\n        return this.activeOrgId\n    }\n\n    public getOrg(orgId: string): OrgMemberInfo | undefined {\n        if (!this.orgIdToOrgMemberInfo) {\n            return undefined\n        }\n\n        return this.orgIdToOrgMemberInfo[orgId]\n    }\n\n    public getOrgByName(orgName: string): OrgMemberInfo | undefined {\n        if (!this.orgIdToOrgMemberInfo) {\n            return undefined\n        }\n\n        const urlSafeOrgName = orgName.toLowerCase().replace(/ /g, '-')\n        for (const orgId in this.orgIdToOrgMemberInfo) {\n            const orgMemberInfo = this.orgIdToOrgMemberInfo[orgId]\n            if (orgMemberInfo.urlSafeOrgName === urlSafeOrgName) {\n                return orgMemberInfo\n            }\n        }\n\n        return undefined\n    }\n\n    public getOrgs(): OrgMemberInfo[] {\n        if (!this.orgIdToOrgMemberInfo) {\n            return []\n        }\n\n        return Object.values(this.orgIdToOrgMemberInfo)\n    }\n\n    public isImpersonating(): boolean {\n        return !!this.impersonatorUserId\n    }\n\n    public static fromJSON(json: string): UserFromToken {\n        const obj = JSON.parse(json)\n        const orgIdToOrgMemberInfo: OrgIdToOrgMemberInfo = {}\n        for (const orgId in obj.orgIdToOrgMemberInfo) {\n            orgIdToOrgMemberInfo[orgId] = OrgMemberInfo.fromJSON(JSON.stringify(obj.orgIdToOrgMemberInfo[orgId]))\n        }\n        return new UserFromToken(\n            obj.userId,\n            obj.email,\n            orgIdToOrgMemberInfo,\n            obj.firstName,\n            obj.lastName,\n            obj.username,\n            obj.legacyUserId,\n            obj.impersonatorUserId,\n            obj.properties,\n            obj.activeOrgId,\n            obj.loginMethod\n        )\n    }\n\n    public static fromJwtPayload(payload: InternalUser): UserFromToken {\n        let activeOrgId: string | undefined\n        let orgIdToOrgMemberInfo: OrgIdToOrgMemberInfo | undefined\n\n        if (payload.org_member_info) {\n            activeOrgId = payload.org_member_info.org_id\n            orgIdToOrgMemberInfo = toOrgIdToOrgMemberInfo({ [activeOrgId]: payload.org_member_info })\n        } else {\n            activeOrgId = undefined\n            orgIdToOrgMemberInfo = toOrgIdToOrgMemberInfo(payload.org_id_to_org_member_info)\n        }\n\n        const loginMethod = toLoginMethod(payload.login_method)\n\n        return new UserFromToken(\n            payload.user_id,\n            payload.email,\n            orgIdToOrgMemberInfo,\n            payload.first_name,\n            payload.last_name,\n            payload.username,\n            payload.legacy_user_id,\n            payload.impersonator_user_id,\n            payload.properties,\n            activeOrgId,\n            loginMethod\n        )\n    }\n}\n\nexport type OrgIdToOrgMemberInfo = {\n    [orgId: string]: OrgMemberInfo\n}\n\nexport enum OrgRoleStructure {\n    SingleRole = \"single_role_in_hierarchy\",\n    MultiRole = \"multi_role\",\n}\n\nexport class OrgMemberInfo {\n    public orgId: string\n    public orgName: string\n    public orgMetadata: { [key: string]: any }\n    public urlSafeOrgName: string\n    public orgRoleStructure: OrgRoleStructure\n\n    public userAssignedRole: string\n    public userInheritedRolesPlusCurrentRole: string[]\n    public userPermissions: string[]\n    public userAssignedAdditionalRoles: string[]\n\n    constructor(\n        orgId: string,\n        orgName: string,\n        orgMetadata: { [key: string]: any },\n        urlSafeOrgName: string,\n        userAssignedRole: string,\n        userInheritedRolesPlusCurrentRole: string[],\n        userPermissions: string[],\n        orgRoleStructure: OrgRoleStructure,\n        userAssignedAdditionalRoles: string[]\n    ) {\n        this.orgId = orgId\n        this.orgName = orgName\n        this.orgMetadata = orgMetadata\n        this.urlSafeOrgName = urlSafeOrgName\n        this.orgRoleStructure = orgRoleStructure\n\n        this.userAssignedRole = userAssignedRole\n        this.userInheritedRolesPlusCurrentRole = userInheritedRolesPlusCurrentRole\n        this.userPermissions = userPermissions\n        this.userAssignedAdditionalRoles = userAssignedAdditionalRoles\n    }\n\n    // validation methods\n\n    public isRole(role: string): boolean {\n        if (this.orgRoleStructure === OrgRoleStructure.MultiRole) {\n            return this.userAssignedRole === role || this.userAssignedAdditionalRoles.includes(role)\n        } else {\n            return this.userAssignedRole === role\n        }\n    }\n\n    public isAtLeastRole(role: string): boolean {\n        if (this.orgRoleStructure === OrgRoleStructure.MultiRole) {\n            return this.userAssignedRole === role || this.userAssignedAdditionalRoles.includes(role)\n        } else {\n            return this.userInheritedRolesPlusCurrentRole.includes(role)\n        }\n    }\n\n    public hasPermission(permission: string): boolean {\n        return this.userPermissions.includes(permission)\n    }\n\n    public hasAllPermissions(permissions: string[]): boolean {\n        return permissions.every((permission) => this.hasPermission(permission))\n    }\n\n    public static fromJSON(json: string): OrgMemberInfo {\n        const obj = JSON.parse(json)\n        return new OrgMemberInfo(\n            obj.orgId,\n            obj.orgName,\n            obj.orgMetadata,\n            obj.urlSafeOrgName,\n            obj.userAssignedRole,\n            obj.userInheritedRolesPlusCurrentRole,\n            obj.userPermissions,\n            obj.orgRoleStructure,\n            obj.userAssignedAdditionalRoles\n        )\n    }\n\n    // getters for the private fields\n\n    get assignedRole(): string {\n        return this.userAssignedRole\n    }\n\n    get assignedRoles(): string[] {\n        if (this.orgRoleStructure === OrgRoleStructure.MultiRole) {\n            return this.userAssignedAdditionalRoles.concat(this.userAssignedRole)\n        } else {\n            return [this.userAssignedRole]\n        }\n    }\n\n    get inheritedRolesPlusCurrentRole(): string[] {\n        if (this.orgRoleStructure === OrgRoleStructure.MultiRole) {\n            return this.userAssignedAdditionalRoles.concat(this.userAssignedRole)\n        } else {\n            return this.userInheritedRolesPlusCurrentRole\n        }\n    }\n\n    get permissions(): string[] {\n        return this.userPermissions\n    }\n}\n\n// These Internal types exist since the server returns snake case, but typescript/javascript\n// convention is camelCase.\nexport type InternalOrgMemberInfo = {\n    org_id: string\n    org_name: string\n    org_metadata: { [key: string]: any }\n    url_safe_org_name: string\n    org_role_structure: OrgRoleStructure\n    user_role: string\n    inherited_user_roles_plus_current_role: string[]\n    user_permissions: string[]\n    additional_roles: string[]\n}\n\nexport type InternalUser = {\n    user_id: string\n\n    org_member_info?: InternalOrgMemberInfo\n    org_id_to_org_member_info?: { [org_id: string]: InternalOrgMemberInfo }\n\n    email: string\n    first_name?: string\n    last_name?: string\n    username?: string\n    properties?: { [key: string]: unknown }\n    login_method?: InternalLoginMethod\n\n    // If you used our migration APIs to migrate this user from a different system, this is their original ID from that system.\n    legacy_user_id?: string\n    impersonator_user_id?: string\n}\n\nexport function toUser(snake_case: InternalUser): UserFromToken {\n    return UserFromToken.fromJwtPayload(snake_case)\n}\n\nexport function toOrgIdToOrgMemberInfo(snake_case?: {\n    [org_id: string]: InternalOrgMemberInfo\n}): OrgIdToOrgMemberInfo | undefined {\n    if (snake_case === undefined) {\n        return undefined\n    }\n    const camelCase: OrgIdToOrgMemberInfo = {}\n\n    for (const key of Object.keys(snake_case)) {\n        const snakeCaseValue = snake_case[key]\n        if (snakeCaseValue) {\n            camelCase[key] = new OrgMemberInfo(\n                snakeCaseValue.org_id,\n                snakeCaseValue.org_name,\n                snakeCaseValue.org_metadata,\n                snakeCaseValue.url_safe_org_name,\n                snakeCaseValue.user_role,\n                snakeCaseValue.inherited_user_roles_plus_current_role,\n                snakeCaseValue.user_permissions,\n                snakeCaseValue.org_role_structure,\n                snakeCaseValue.additional_roles\n            )\n        }\n    }\n\n    return camelCase\n}\n","export class UnauthorizedException extends Error {\n    readonly message: string\n    readonly status: number\n\n    constructor(message: string) {\n        super(message)\n        this.message = message\n        this.status = 401\n    }\n}\n\nexport class ConfigurationException extends Error {\n    readonly message: string\n    readonly status: number\n\n    constructor(message: string) {\n        super(message)\n        this.message = message\n        this.status = 500\n    }\n}\n","import { ResponseCookie } from 'next/dist/compiled/@edge-runtime/cookies'\nimport { InternalUser, toUser, UserFromToken } from '../user'\nimport { ConfigurationException, UnauthorizedException } from './exceptions'\nimport * as jose from 'jose'\n\ntype RefreshAndAccessTokens = {\n    refreshToken: string\n    accessToken: string\n    error: 'none'\n}\n\ntype RefreshAndAccessTokensUnauthorizedError = {\n    error: 'unauthorized'\n}\n\ntype RefreshAndAccessTokensUnexpectedError = {\n    error: 'unexpected'\n}\n\nexport type RefreshTokenResponse =\n    | RefreshAndAccessTokens\n    | RefreshAndAccessTokensUnauthorizedError\n    | RefreshAndAccessTokensUnexpectedError\n\nexport const LOGIN_PATH = '/api/auth/login'\nexport const CALLBACK_PATH = '/api/auth/callback'\nexport const USERINFO_PATH = '/api/auth/userinfo'\nexport const LOGOUT_PATH = '/api/auth/logout'\nexport const ACCESS_TOKEN_COOKIE_NAME = '__pa_at'\nexport const REFRESH_TOKEN_COOKIE_NAME = '__pa_rt'\nexport const STATE_COOKIE_NAME = '__pa_state'\nexport const CUSTOM_HEADER_FOR_ACCESS_TOKEN = 'x-propelauth-access-token'\nexport const CUSTOM_HEADER_FOR_URL = 'x-propelauth-current-url'\nexport const CUSTOM_HEADER_FOR_PATH = 'x-propelauth-current-path'\nexport const RETURN_TO_PATH_COOKIE_NAME = '__pa_return_to_path'\n\nexport const COOKIE_OPTIONS: Partial<ResponseCookie> = {\n    httpOnly: true,\n    secure: true,\n    path: '/',\n}\n\nexport function getAuthUrlOrigin() {\n    return getAuthUrl().origin\n}\n\nexport function getAuthUrl() {\n    const authUrl = process.env.NEXT_PUBLIC_AUTH_URL\n    if (!authUrl) {\n        throw new Error('NEXT_PUBLIC_AUTH_URL is not set')\n    }\n    return new URL(authUrl)\n}\n\nexport function getRedirectUri() {\n    const redirectUri = process.env.PROPELAUTH_REDIRECT_URI\n    if (!redirectUri) {\n        throw new Error('PROPELAUTH_REDIRECT_URI is not set')\n    }\n    return redirectUri\n}\n\nexport function getIntegrationApiKey() {\n    const integrationApiKey = process.env.PROPELAUTH_API_KEY\n    if (!integrationApiKey) {\n        throw new Error('PROPELAUTH_API_KEY is not set')\n    }\n    return integrationApiKey\n}\n\nexport function getVerifierKey() {\n    const verifierKey = process.env.PROPELAUTH_VERIFIER_KEY\n    if (!verifierKey) {\n        throw new Error('PROPELAUTH_VERIFIER_KEY is not set')\n    }\n    return verifierKey.replace(/\\\\n/g, '\\n')\n}\n\nexport function getSameSiteCookieValue(): \"none\" | \"lax\" | \"strict\" {\n    const sameSiteOverride = process.env.PROPELAUTH_SAME_SITE_COOKIE_OVERRIDE\n    if (sameSiteOverride === 'none') {\n        return 'none'\n    } else if (sameSiteOverride === 'lax') {\n        return 'lax'\n    } else if (sameSiteOverride === 'strict') {\n        return 'strict'\n    } else if (sameSiteOverride) {\n        throw new Error(\n            'Invalid value for PROPELAUTH_SAME_SITE_COOKIE_OVERRIDE, must be one of \"none\", \"lax\", or \"strict\"'\n        )\n    } else {\n        return 'lax'\n    }\n}\n\nexport async function refreshTokenWithAccessAndRefreshToken(\n    refreshToken: string,\n    activeOrgId?: string\n): Promise<RefreshTokenResponse> {\n    const body = {\n        refresh_token: refreshToken,\n    }\n\n    const queryParams = new URLSearchParams()\n    if (activeOrgId) {\n        queryParams.set('with_active_org_support', 'true')\n        queryParams.set('active_org_id', activeOrgId)\n    }\n\n    const url = `${getAuthUrlOrigin()}/api/backend/v1/refresh_token?${queryParams.toString()}`\n    const response = await fetch(url, {\n        method: 'POST',\n        body: JSON.stringify(body),\n        headers: {\n            'Content-Type': 'application/json',\n            Authorization: 'Bearer ' + getIntegrationApiKey(),\n        },\n    })\n\n    if (response.ok) {\n        const data = await response.json()\n        const newRefreshToken = data.refresh_token\n        const { access_token: accessToken, expires_at_seconds: expiresAtSeconds } = data.access_token\n\n        return {\n            refreshToken: newRefreshToken,\n            accessToken,\n            error: 'none',\n        }\n    } else if (response.status === 400 || response.status === 401) {\n        return { error: 'unauthorized' }\n    } else {\n        return { error: 'unexpected' }\n    }\n}\n\nexport async function validateAccessTokenOrUndefined(\n    accessToken: string | undefined\n): Promise<UserFromToken | undefined> {\n    try {\n        return await validateAccessToken(accessToken)\n    } catch (err) {\n        if (err instanceof ConfigurationException) {\n            throw err\n        } else if (err instanceof UnauthorizedException) {\n            return undefined\n        } else {\n            console.info('Error validating access token', err)\n            return undefined\n        }\n    }\n}\n\nexport async function validateAccessToken(accessToken: string | undefined): Promise<UserFromToken> {\n    let publicKey\n    try {\n        publicKey = await jose.importSPKI(getVerifierKey(), 'RS256')\n    } catch (err) {\n        console.error(\"Verifier key is invalid. Make sure it's specified correctly, including the newlines.\", err)\n        throw new ConfigurationException('Invalid verifier key')\n    }\n\n    if (!accessToken) {\n        throw new UnauthorizedException('No access token provided')\n    }\n\n    let accessTokenWithoutBearer = accessToken\n    if (accessToken.toLowerCase().startsWith('bearer ')) {\n        accessTokenWithoutBearer = accessToken.substring('bearer '.length)\n    }\n\n    try {\n        const { payload } = await jose.jwtVerify(accessTokenWithoutBearer, publicKey, {\n            issuer: getAuthUrlOrigin(),\n            algorithms: ['RS256'],\n        })\n\n        return toUser(<InternalUser>payload)\n    } catch (e) {\n        if (e instanceof Error) {\n            throw new UnauthorizedException(e.message)\n        } else {\n            throw new UnauthorizedException('Unable to decode jwt')\n        }\n    }\n}\n","export const ACTIVE_ORG_ID_COOKIE_NAME = '__pa_org_id'\n","import { GetServerSidePropsContext, NextApiRequest, NextApiResponse } from 'next'\nimport {\n    ACCESS_TOKEN_COOKIE_NAME,\n    getSameSiteCookieValue,\n    REFRESH_TOKEN_COOKIE_NAME,\n    refreshTokenWithAccessAndRefreshToken,\n    validateAccessToken,\n    validateAccessTokenOrUndefined,\n} from './shared'\nimport { ACTIVE_ORG_ID_COOKIE_NAME } from '../shared'\nimport { UserFromToken } from '../user'\n\nexport type AuthInfo =\n    | {\n          user: UserFromToken\n          accessToken: string\n      }\n    | {\n          user: undefined\n          accessToken: undefined\n      }\n\nexport async function getAuthInfoFromServerSideProps(\n    props: GetServerSidePropsContext,\n    forceRefresh: boolean = false\n): Promise<AuthInfo> {\n    const accessToken = props.req.cookies[ACCESS_TOKEN_COOKIE_NAME]\n    const refreshToken = props.req.cookies[REFRESH_TOKEN_COOKIE_NAME]\n    const activeOrgId = props.req.cookies[ACTIVE_ORG_ID_COOKIE_NAME]\n    const sameSite = getSameSiteCookieValue()\n\n    // If we are authenticated, we can continue\n    if (accessToken && !forceRefresh) {\n        const user = await validateAccessTokenOrUndefined(accessToken)\n        if (user) {\n            return {\n                user,\n                accessToken,\n            }\n        }\n    }\n\n    // Otherwise, we need to refresh the access token\n    if (refreshToken) {\n        const response = await refreshTokenWithAccessAndRefreshToken(refreshToken, activeOrgId)\n        if (response.error === 'unexpected') {\n            throw new Error('Unexpected error while refreshing access token')\n        } else if (response.error === 'unauthorized') {\n            props.res.setHeader('Set-Cookie', [\n                `${ACCESS_TOKEN_COOKIE_NAME}=; Path=/; HttpOnly; Secure; SameSite=${sameSite}; Max-Age=0`,\n                `${REFRESH_TOKEN_COOKIE_NAME}=; Path=/; HttpOnly; Secure; SameSite=${sameSite}; Max-Age=0`,\n            ])\n            return {\n                user: undefined,\n                accessToken: undefined,\n            }\n        } else {\n            const user = await validateAccessToken(response.accessToken)\n            props.res.setHeader('Set-Cookie', [\n                `${ACCESS_TOKEN_COOKIE_NAME}=${response.accessToken}; Path=/; HttpOnly; Secure; SameSite=${sameSite}`,\n                `${REFRESH_TOKEN_COOKIE_NAME}=${response.refreshToken}; Path=/; HttpOnly; Secure; SameSite=${sameSite}`,\n            ])\n            return {\n                user,\n                accessToken: response.accessToken,\n            }\n        }\n    }\n\n    return {\n        user: undefined,\n        accessToken: undefined,\n    }\n}\n\nexport async function getUserFromServerSideProps(props: GetServerSidePropsContext, forceRefresh: boolean = false) {\n    const { user } = await getAuthInfoFromServerSideProps(props, forceRefresh)\n    return user\n}\n\nexport async function getAuthInfoFromApiRouteRequest(\n    req: NextApiRequest,\n    res: NextApiResponse,\n    forceRefresh: boolean = false\n): Promise<AuthInfo> {\n    const accessToken = req.cookies[ACCESS_TOKEN_COOKIE_NAME]\n    const refreshToken = req.cookies[REFRESH_TOKEN_COOKIE_NAME]\n    const activeOrgId = req.cookies[ACTIVE_ORG_ID_COOKIE_NAME]\n    const sameSite = getSameSiteCookieValue()\n\n    // If we are authenticated, we can continue\n    if (accessToken && !forceRefresh) {\n        const user = await validateAccessTokenOrUndefined(accessToken)\n        if (user) {\n            return {\n                user,\n                accessToken,\n            }\n        }\n    }\n\n    // Otherwise, we need to refresh the access token\n    if (refreshToken) {\n        const response = await refreshTokenWithAccessAndRefreshToken(refreshToken, activeOrgId)\n        if (response.error === 'unexpected') {\n            throw new Error('Unexpected error while refreshing access token')\n        } else if (response.error === 'unauthorized') {\n            res.setHeader('Set-Cookie', [\n                `${ACCESS_TOKEN_COOKIE_NAME}=; Path=/; HttpOnly; Secure; SameSite=${sameSite}; Max-Age=0`,\n                `${REFRESH_TOKEN_COOKIE_NAME}=; Path=/; HttpOnly; Secure; SameSite=${sameSite}; Max-Age=0`,\n            ])\n            return {\n                user: undefined,\n                accessToken: undefined,\n            }\n        } else {\n            const user = await validateAccessToken(response.accessToken)\n            res.setHeader('Set-Cookie', [\n                `${ACCESS_TOKEN_COOKIE_NAME}=${response.accessToken}; Path=/; HttpOnly; Secure; SameSite=${sameSite}`,\n                `${REFRESH_TOKEN_COOKIE_NAME}=${response.refreshToken}; Path=/; HttpOnly; Secure; SameSite=${sameSite}`,\n            ])\n            return {\n                user,\n                accessToken: response.accessToken,\n            }\n        }\n    }\n\n    return {\n        user: undefined,\n        accessToken: undefined,\n    }\n}\n\nexport async function getUserFromApiRouteRequest(\n    req: NextApiRequest,\n    res: NextApiResponse,\n    forceRefresh: boolean = false\n) {\n    const { user } = await getAuthInfoFromApiRouteRequest(req, res, forceRefresh)\n    return user\n}\n"],"mappings":";;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;;;ACgHO,SAAS,cAAc,YAA+C;AACzE,MAAI,CAAC,YAAY;AACb,WAAO,EAAE,aAAa,UAAU;AAAA,EACpC;AAEA,UAAQ,WAAW,cAAc;AAAA,IAC7B,KAAK;AACD,aAAO,EAAE,aAAa,WAAW;AAAA,IACrC,KAAK;AACD,aAAO,EAAE,aAAa,aAAa;AAAA,IACvC,KAAK;AACD,aAAO,EAAE,aAAa,cAAc,UAAU,WAAW,SAAS;AAAA,IACtE,KAAK;AACD,aAAO,EAAE,aAAa,0BAA0B;AAAA,IACpD,KAAK;AACD,aAAO,EAAE,aAAa,YAAY,UAAU,WAAW,UAAU,OAAO,WAAW,OAAO;AAAA,IAC9F,KAAK;AACD,aAAO,EAAE,aAAa,gBAAgB;AAAA,IAC1C,KAAK;AACD,aAAO,EAAE,aAAa,6BAA6B;AAAA,IACvD;AACI,aAAO,EAAE,aAAa,UAAU;AAAA,EACxC;AACJ;;;ACrIO,IAAM,gBAAN,MAAoB;AAAA,EAmBvB,YACI,QACA,OACA,sBACA,WACA,UACA,UACA,cACA,oBACA,YACA,aACA,aACF;AACE,SAAK,SAAS;AAEd,SAAK,cAAc;AACnB,SAAK,uBAAuB;AAE5B,SAAK,QAAQ;AACb,SAAK,YAAY;AACjB,SAAK,WAAW;AAChB,SAAK,WAAW;AAEhB,SAAK,eAAe;AACpB,SAAK,qBAAqB;AAE1B,SAAK,aAAa;AAClB,SAAK,cAAc;AAAA,EACvB;AAAA,EAEO,eAA0C;AAC7C,QAAI,CAAC,KAAK,eAAe,CAAC,KAAK,sBAAsB;AACjD,aAAO;AAAA,IACX;AAEA,WAAO,KAAK,qBAAqB,KAAK,WAAW;AAAA,EACrD;AAAA,EAEO,iBAAqC;AACxC,WAAO,KAAK;AAAA,EAChB;AAAA,EAEO,OAAO,OAA0C;AACpD,QAAI,CAAC,KAAK,sBAAsB;AAC5B,aAAO;AAAA,IACX;AAEA,WAAO,KAAK,qBAAqB,KAAK;AAAA,EAC1C;AAAA,EAEO,aAAa,SAA4C;AAC5D,QAAI,CAAC,KAAK,sBAAsB;AAC5B,aAAO;AAAA,IACX;AAEA,UAAM,iBAAiB,QAAQ,YAAY,EAAE,QAAQ,MAAM,GAAG;AAC9D,eAAW,SAAS,KAAK,sBAAsB;AAC3C,YAAM,gBAAgB,KAAK,qBAAqB,KAAK;AACrD,UAAI,cAAc,mBAAmB,gBAAgB;AACjD,eAAO;AAAA,MACX;AAAA,IACJ;AAEA,WAAO;AAAA,EACX;AAAA,EAEO,UAA2B;AAC9B,QAAI,CAAC,KAAK,sBAAsB;AAC5B,aAAO,CAAC;AAAA,IACZ;AAEA,WAAO,OAAO,OAAO,KAAK,oBAAoB;AAAA,EAClD;AAAA,EAEO,kBAA2B;AAC9B,WAAO,CAAC,CAAC,KAAK;AAAA,EAClB;AAAA,EAEA,OAAc,SAAS,MAA6B;AAChD,UAAM,MAAM,KAAK,MAAM,IAAI;AAC3B,UAAM,uBAA6C,CAAC;AACpD,eAAW,SAAS,IAAI,sBAAsB;AAC1C,2BAAqB,KAAK,IAAI,cAAc,SAAS,KAAK,UAAU,IAAI,qBAAqB,KAAK,CAAC,CAAC;AAAA,IACxG;AACA,WAAO,IAAI;AAAA,MACP,IAAI;AAAA,MACJ,IAAI;AAAA,MACJ;AAAA,MACA,IAAI;AAAA,MACJ,IAAI;AAAA,MACJ,IAAI;AAAA,MACJ,IAAI;AAAA,MACJ,IAAI;AAAA,MACJ,IAAI;AAAA,MACJ,IAAI;AAAA,MACJ,IAAI;AAAA,IACR;AAAA,EACJ;AAAA,EAEA,OAAc,eAAe,SAAsC;AAC/D,QAAI;AACJ,QAAI;AAEJ,QAAI,QAAQ,iBAAiB;AACzB,oBAAc,QAAQ,gBAAgB;AACtC,6BAAuB,uBAAuB,EAAE,CAAC,WAAW,GAAG,QAAQ,gBAAgB,CAAC;AAAA,IAC5F,OAAO;AACH,oBAAc;AACd,6BAAuB,uBAAuB,QAAQ,yBAAyB;AAAA,IACnF;AAEA,UAAM,cAAc,cAAc,QAAQ,YAAY;AAEtD,WAAO,IAAI;AAAA,MACP,QAAQ;AAAA,MACR,QAAQ;AAAA,MACR;AAAA,MACA,QAAQ;AAAA,MACR,QAAQ;AAAA,MACR,QAAQ;AAAA,MACR,QAAQ;AAAA,MACR,QAAQ;AAAA,MACR,QAAQ;AAAA,MACR;AAAA,MACA;AAAA,IACJ;AAAA,EACJ;AACJ;AAWO,IAAM,gBAAN,MAAoB;AAAA,EAYvB,YACI,OACA,SACA,aACA,gBACA,kBACA,mCACA,iBACA,kBACA,6BACF;AACE,SAAK,QAAQ;AACb,SAAK,UAAU;AACf,SAAK,cAAc;AACnB,SAAK,iBAAiB;AACtB,SAAK,mBAAmB;AAExB,SAAK,mBAAmB;AACxB,SAAK,oCAAoC;AACzC,SAAK,kBAAkB;AACvB,SAAK,8BAA8B;AAAA,EACvC;AAAA;AAAA,EAIO,OAAO,MAAuB;AACjC,QAAI,KAAK,qBAAqB,8BAA4B;AACtD,aAAO,KAAK,qBAAqB,QAAQ,KAAK,4BAA4B,SAAS,IAAI;AAAA,IAC3F,OAAO;AACH,aAAO,KAAK,qBAAqB;AAAA,IACrC;AAAA,EACJ;AAAA,EAEO,cAAc,MAAuB;AACxC,QAAI,KAAK,qBAAqB,8BAA4B;AACtD,aAAO,KAAK,qBAAqB,QAAQ,KAAK,4BAA4B,SAAS,IAAI;AAAA,IAC3F,OAAO;AACH,aAAO,KAAK,kCAAkC,SAAS,IAAI;AAAA,IAC/D;AAAA,EACJ;AAAA,EAEO,cAAc,YAA6B;AAC9C,WAAO,KAAK,gBAAgB,SAAS,UAAU;AAAA,EACnD;AAAA,EAEO,kBAAkB,aAAgC;AACrD,WAAO,YAAY,MAAM,CAAC,eAAe,KAAK,cAAc,UAAU,CAAC;AAAA,EAC3E;AAAA,EAEA,OAAc,SAAS,MAA6B;AAChD,UAAM,MAAM,KAAK,MAAM,IAAI;AAC3B,WAAO,IAAI;AAAA,MACP,IAAI;AAAA,MACJ,IAAI;AAAA,MACJ,IAAI;AAAA,MACJ,IAAI;AAAA,MACJ,IAAI;AAAA,MACJ,IAAI;AAAA,MACJ,IAAI;AAAA,MACJ,IAAI;AAAA,MACJ,IAAI;AAAA,IACR;AAAA,EACJ;AAAA;AAAA,EAIA,IAAI,eAAuB;AACvB,WAAO,KAAK;AAAA,EAChB;AAAA,EAEA,IAAI,gBAA0B;AAC1B,QAAI,KAAK,qBAAqB,8BAA4B;AACtD,aAAO,KAAK,4BAA4B,OAAO,KAAK,gBAAgB;AAAA,IACxE,OAAO;AACH,aAAO,CAAC,KAAK,gBAAgB;AAAA,IACjC;AAAA,EACJ;AAAA,EAEA,IAAI,gCAA0C;AAC1C,QAAI,KAAK,qBAAqB,8BAA4B;AACtD,aAAO,KAAK,4BAA4B,OAAO,KAAK,gBAAgB;AAAA,IACxE,OAAO;AACH,aAAO,KAAK;AAAA,IAChB;AAAA,EACJ;AAAA,EAEA,IAAI,cAAwB;AACxB,WAAO,KAAK;AAAA,EAChB;AACJ;AAkCO,SAAS,OAAO,YAAyC;AAC5D,SAAO,cAAc,eAAe,UAAU;AAClD;AAEO,SAAS,uBAAuB,YAEF;AACjC,MAAI,eAAe,QAAW;AAC1B,WAAO;AAAA,EACX;AACA,QAAM,YAAkC,CAAC;AAEzC,aAAW,OAAO,OAAO,KAAK,UAAU,GAAG;AACvC,UAAM,iBAAiB,WAAW,GAAG;AACrC,QAAI,gBAAgB;AAChB,gBAAU,GAAG,IAAI,IAAI;AAAA,QACjB,eAAe;AAAA,QACf,eAAe;AAAA,QACf,eAAe;AAAA,QACf,eAAe;AAAA,QACf,eAAe;AAAA,QACf,eAAe;AAAA,QACf,eAAe;AAAA,QACf,eAAe;AAAA,QACf,eAAe;AAAA,MACnB;AAAA,IACJ;AAAA,EACJ;AAEA,SAAO;AACX;;;ACpUO,IAAM,wBAAN,cAAoC,MAAM;AAAA,EAI7C,YAAY,SAAiB;AACzB,UAAM,OAAO;AACb,SAAK,UAAU;AACf,SAAK,SAAS;AAAA,EAClB;AACJ;AAEO,IAAM,yBAAN,cAAqC,MAAM;AAAA,EAI9C,YAAY,SAAiB;AACzB,UAAM,OAAO;AACb,SAAK,UAAU;AACf,SAAK,SAAS;AAAA,EAClB;AACJ;;;ACjBA,WAAsB;AAyBf,IAAM,2BAA2B;AACjC,IAAM,4BAA4B;AAalC,SAAS,mBAAmB;AAC/B,SAAO,WAAW,EAAE;AACxB;AAEO,SAAS,aAAa;AACzB,QAAM,UAAU,QAAQ,IAAI;AAC5B,MAAI,CAAC,SAAS;AACV,UAAM,IAAI,MAAM,iCAAiC;AAAA,EACrD;AACA,SAAO,IAAI,IAAI,OAAO;AAC1B;AAUO,SAAS,uBAAuB;AACnC,QAAM,oBAAoB,QAAQ,IAAI;AACtC,MAAI,CAAC,mBAAmB;AACpB,UAAM,IAAI,MAAM,+BAA+B;AAAA,EACnD;AACA,SAAO;AACX;AAEO,SAAS,iBAAiB;AAC7B,QAAM,cAAc,QAAQ,IAAI;AAChC,MAAI,CAAC,aAAa;AACd,UAAM,IAAI,MAAM,oCAAoC;AAAA,EACxD;AACA,SAAO,YAAY,QAAQ,QAAQ,IAAI;AAC3C;AAEO,SAAS,yBAAoD;AAChE,QAAM,mBAAmB,QAAQ,IAAI;AACrC,MAAI,qBAAqB,QAAQ;AAC7B,WAAO;AAAA,EACX,WAAW,qBAAqB,OAAO;AACnC,WAAO;AAAA,EACX,WAAW,qBAAqB,UAAU;AACtC,WAAO;AAAA,EACX,WAAW,kBAAkB;AACzB,UAAM,IAAI;AAAA,MACN;AAAA,IACJ;AAAA,EACJ,OAAO;AACH,WAAO;AAAA,EACX;AACJ;AAEA,SAAsB,sCAClB,cACA,aAC6B;AAAA;AAC7B,UAAM,OAAO;AAAA,MACT,eAAe;AAAA,IACnB;AAEA,UAAM,cAAc,IAAI,gBAAgB;AACxC,QAAI,aAAa;AACb,kBAAY,IAAI,2BAA2B,MAAM;AACjD,kBAAY,IAAI,iBAAiB,WAAW;AAAA,IAChD;AAEA,UAAM,MAAM,GAAG,iBAAiB,kCAAkC,YAAY,SAAS;AACvF,UAAM,WAAW,MAAM,MAAM,KAAK;AAAA,MAC9B,QAAQ;AAAA,MACR,MAAM,KAAK,UAAU,IAAI;AAAA,MACzB,SAAS;AAAA,QACL,gBAAgB;AAAA,QAChB,eAAe,YAAY,qBAAqB;AAAA,MACpD;AAAA,IACJ,CAAC;AAED,QAAI,SAAS,IAAI;AACb,YAAM,OAAO,MAAM,SAAS,KAAK;AACjC,YAAM,kBAAkB,KAAK;AAC7B,YAAM,EAAE,cAAc,aAAa,oBAAoB,iBAAiB,IAAI,KAAK;AAEjF,aAAO;AAAA,QACH,cAAc;AAAA,QACd;AAAA,QACA,OAAO;AAAA,MACX;AAAA,IACJ,WAAW,SAAS,WAAW,OAAO,SAAS,WAAW,KAAK;AAC3D,aAAO,EAAE,OAAO,eAAe;AAAA,IACnC,OAAO;AACH,aAAO,EAAE,OAAO,aAAa;AAAA,IACjC;AAAA,EACJ;AAAA;AAEA,SAAsB,+BAClB,aACkC;AAAA;AAClC,QAAI;AACA,aAAO,MAAM,oBAAoB,WAAW;AAAA,IAChD,SAAS,KAAP;AACE,UAAI,eAAe,wBAAwB;AACvC,cAAM;AAAA,MACV,WAAW,eAAe,uBAAuB;AAC7C,eAAO;AAAA,MACX,OAAO;AACH,gBAAQ,KAAK,iCAAiC,GAAG;AACjD,eAAO;AAAA,MACX;AAAA,IACJ;AAAA,EACJ;AAAA;AAEA,SAAsB,oBAAoB,aAAyD;AAAA;AAC/F,QAAI;AACJ,QAAI;AACA,kBAAY,MAAW,gBAAW,eAAe,GAAG,OAAO;AAAA,IAC/D,SAAS,KAAP;AACE,cAAQ,MAAM,wFAAwF,GAAG;AACzG,YAAM,IAAI,uBAAuB,sBAAsB;AAAA,IAC3D;AAEA,QAAI,CAAC,aAAa;AACd,YAAM,IAAI,sBAAsB,0BAA0B;AAAA,IAC9D;AAEA,QAAI,2BAA2B;AAC/B,QAAI,YAAY,YAAY,EAAE,WAAW,SAAS,GAAG;AACjD,iCAA2B,YAAY,UAAU,UAAU,MAAM;AAAA,IACrE;AAEA,QAAI;AACA,YAAM,EAAE,QAAQ,IAAI,MAAW,eAAU,0BAA0B,WAAW;AAAA,QAC1E,QAAQ,iBAAiB;AAAA,QACzB,YAAY,CAAC,OAAO;AAAA,MACxB,CAAC;AAED,aAAO,OAAqB,OAAO;AAAA,IACvC,SAAS,GAAP;AACE,UAAI,aAAa,OAAO;AACpB,cAAM,IAAI,sBAAsB,EAAE,OAAO;AAAA,MAC7C,OAAO;AACH,cAAM,IAAI,sBAAsB,sBAAsB;AAAA,MAC1D;AAAA,IACJ;AAAA,EACJ;AAAA;;;ACzLO,IAAM,4BAA4B;;;ACsBzC,SAAsB,+BAClB,OACA,eAAwB,OACP;AAAA;AACjB,UAAM,cAAc,MAAM,IAAI,QAAQ,wBAAwB;AAC9D,UAAM,eAAe,MAAM,IAAI,QAAQ,yBAAyB;AAChE,UAAM,cAAc,MAAM,IAAI,QAAQ,yBAAyB;AAC/D,UAAM,WAAW,uBAAuB;AAGxC,QAAI,eAAe,CAAC,cAAc;AAC9B,YAAM,OAAO,MAAM,+BAA+B,WAAW;AAC7D,UAAI,MAAM;AACN,eAAO;AAAA,UACH;AAAA,UACA;AAAA,QACJ;AAAA,MACJ;AAAA,IACJ;AAGA,QAAI,cAAc;AACd,YAAM,WAAW,MAAM,sCAAsC,cAAc,WAAW;AACtF,UAAI,SAAS,UAAU,cAAc;AACjC,cAAM,IAAI,MAAM,gDAAgD;AAAA,MACpE,WAAW,SAAS,UAAU,gBAAgB;AAC1C,cAAM,IAAI,UAAU,cAAc;AAAA,UAC9B,GAAG,iEAAiE;AAAA,UACpE,GAAG,kEAAkE;AAAA,QACzE,CAAC;AACD,eAAO;AAAA,UACH,MAAM;AAAA,UACN,aAAa;AAAA,QACjB;AAAA,MACJ,OAAO;AACH,cAAM,OAAO,MAAM,oBAAoB,SAAS,WAAW;AAC3D,cAAM,IAAI,UAAU,cAAc;AAAA,UAC9B,GAAG,4BAA4B,SAAS,mDAAmD;AAAA,UAC3F,GAAG,6BAA6B,SAAS,oDAAoD;AAAA,QACjG,CAAC;AACD,eAAO;AAAA,UACH;AAAA,UACA,aAAa,SAAS;AAAA,QAC1B;AAAA,MACJ;AAAA,IACJ;AAEA,WAAO;AAAA,MACH,MAAM;AAAA,MACN,aAAa;AAAA,IACjB;AAAA,EACJ;AAAA;AAEA,SAAsB,2BAA2B,OAAkC,eAAwB,OAAO;AAAA;AAC9G,UAAM,EAAE,KAAK,IAAI,MAAM,+BAA+B,OAAO,YAAY;AACzE,WAAO;AAAA,EACX;AAAA;AAEA,SAAsB,+BAClB,KACA,KACA,eAAwB,OACP;AAAA;AACjB,UAAM,cAAc,IAAI,QAAQ,wBAAwB;AACxD,UAAM,eAAe,IAAI,QAAQ,yBAAyB;AAC1D,UAAM,cAAc,IAAI,QAAQ,yBAAyB;AACzD,UAAM,WAAW,uBAAuB;AAGxC,QAAI,eAAe,CAAC,cAAc;AAC9B,YAAM,OAAO,MAAM,+BAA+B,WAAW;AAC7D,UAAI,MAAM;AACN,eAAO;AAAA,UACH;AAAA,UACA;AAAA,QACJ;AAAA,MACJ;AAAA,IACJ;AAGA,QAAI,cAAc;AACd,YAAM,WAAW,MAAM,sCAAsC,cAAc,WAAW;AACtF,UAAI,SAAS,UAAU,cAAc;AACjC,cAAM,IAAI,MAAM,gDAAgD;AAAA,MACpE,WAAW,SAAS,UAAU,gBAAgB;AAC1C,YAAI,UAAU,cAAc;AAAA,UACxB,GAAG,iEAAiE;AAAA,UACpE,GAAG,kEAAkE;AAAA,QACzE,CAAC;AACD,eAAO;AAAA,UACH,MAAM;AAAA,UACN,aAAa;AAAA,QACjB;AAAA,MACJ,OAAO;AACH,cAAM,OAAO,MAAM,oBAAoB,SAAS,WAAW;AAC3D,YAAI,UAAU,cAAc;AAAA,UACxB,GAAG,4BAA4B,SAAS,mDAAmD;AAAA,UAC3F,GAAG,6BAA6B,SAAS,oDAAoD;AAAA,QACjG,CAAC;AACD,eAAO;AAAA,UACH;AAAA,UACA,aAAa,SAAS;AAAA,QAC1B;AAAA,MACJ;AAAA,IACJ;AAEA,WAAO;AAAA,MACH,MAAM;AAAA,MACN,aAAa;AAAA,IACjB;AAAA,EACJ;AAAA;AAEA,SAAsB,2BAClB,KACA,KACA,eAAwB,OAC1B;AAAA;AACE,UAAM,EAAE,KAAK,IAAI,MAAM,+BAA+B,KAAK,KAAK,YAAY;AAC5E,WAAO;AAAA,EACX;AAAA;","names":[]}

package/dist/server/pages/index.mjs

@@ -135,7 +135,7 @@ var UserFromToken = class {
       payload.last_name,
       payload.username,
       payload.legacy_user_id,
-      payload.impersonatorUserId,
+      payload.impersonator_user_id,
       payload.properties,
       activeOrgId,
       loginMethod
@@ -282,6 +282,22 @@ function getVerifierKey() {
   }
   return verifierKey.replace(/\\n/g, "\n");
 }
+function getSameSiteCookieValue() {
+  const sameSiteOverride = process.env.PROPELAUTH_SAME_SITE_COOKIE_OVERRIDE;
+  if (sameSiteOverride === "none") {
+    return "none";
+  } else if (sameSiteOverride === "lax") {
+    return "lax";
+  } else if (sameSiteOverride === "strict") {
+    return "strict";
+  } else if (sameSiteOverride) {
+    throw new Error(
+      'Invalid value for PROPELAUTH_SAME_SITE_COOKIE_OVERRIDE, must be one of "none", "lax", or "strict"'
+    );
+  } else {
+    return "lax";
+  }
+}
 function refreshTokenWithAccessAndRefreshToken(refreshToken, activeOrgId) {
   return __async(this, null, function* () {
     const body = {
@@ -374,6 +390,7 @@ function getAuthInfoFromServerSideProps(props, forceRefresh = false) {
     const accessToken = props.req.cookies[ACCESS_TOKEN_COOKIE_NAME];
     const refreshToken = props.req.cookies[REFRESH_TOKEN_COOKIE_NAME];
     const activeOrgId = props.req.cookies[ACTIVE_ORG_ID_COOKIE_NAME];
+    const sameSite = getSameSiteCookieValue();
     if (accessToken && !forceRefresh) {
       const user = yield validateAccessTokenOrUndefined(accessToken);
       if (user) {
@@ -389,8 +406,8 @@ function getAuthInfoFromServerSideProps(props, forceRefresh = false) {
         throw new Error("Unexpected error while refreshing access token");
       } else if (response.error === "unauthorized") {
         props.res.setHeader("Set-Cookie", [
-          `${ACCESS_TOKEN_COOKIE_NAME}=; Path=/; HttpOnly; Secure; SameSite=Lax; Max-Age=0`,
-          `${REFRESH_TOKEN_COOKIE_NAME}=; Path=/; HttpOnly; Secure; SameSite=Lax; Max-Age=0`
+          `${ACCESS_TOKEN_COOKIE_NAME}=; Path=/; HttpOnly; Secure; SameSite=${sameSite}; Max-Age=0`,
+          `${REFRESH_TOKEN_COOKIE_NAME}=; Path=/; HttpOnly; Secure; SameSite=${sameSite}; Max-Age=0`
         ]);
         return {
           user: void 0,
@@ -399,8 +416,8 @@ function getAuthInfoFromServerSideProps(props, forceRefresh = false) {
       } else {
         const user = yield validateAccessToken(response.accessToken);
         props.res.setHeader("Set-Cookie", [
-          `${ACCESS_TOKEN_COOKIE_NAME}=${response.accessToken}; Path=/; HttpOnly; Secure; SameSite=Lax`,
-          `${REFRESH_TOKEN_COOKIE_NAME}=${response.refreshToken}; Path=/; HttpOnly; Secure; SameSite=Lax`
+          `${ACCESS_TOKEN_COOKIE_NAME}=${response.accessToken}; Path=/; HttpOnly; Secure; SameSite=${sameSite}`,
+          `${REFRESH_TOKEN_COOKIE_NAME}=${response.refreshToken}; Path=/; HttpOnly; Secure; SameSite=${sameSite}`
         ]);
         return {
           user,
@@ -425,6 +442,7 @@ function getAuthInfoFromApiRouteRequest(req, res, forceRefresh = false) {
     const accessToken = req.cookies[ACCESS_TOKEN_COOKIE_NAME];
     const refreshToken = req.cookies[REFRESH_TOKEN_COOKIE_NAME];
     const activeOrgId = req.cookies[ACTIVE_ORG_ID_COOKIE_NAME];
+    const sameSite = getSameSiteCookieValue();
     if (accessToken && !forceRefresh) {
       const user = yield validateAccessTokenOrUndefined(accessToken);
       if (user) {
@@ -440,8 +458,8 @@ function getAuthInfoFromApiRouteRequest(req, res, forceRefresh = false) {
         throw new Error("Unexpected error while refreshing access token");
       } else if (response.error === "unauthorized") {
         res.setHeader("Set-Cookie", [
-          `${ACCESS_TOKEN_COOKIE_NAME}=; Path=/; HttpOnly; Secure; SameSite=Lax; Max-Age=0`,
-          `${REFRESH_TOKEN_COOKIE_NAME}=; Path=/; HttpOnly; Secure; SameSite=Lax; Max-Age=0`
+          `${ACCESS_TOKEN_COOKIE_NAME}=; Path=/; HttpOnly; Secure; SameSite=${sameSite}; Max-Age=0`,
+          `${REFRESH_TOKEN_COOKIE_NAME}=; Path=/; HttpOnly; Secure; SameSite=${sameSite}; Max-Age=0`
         ]);
         return {
           user: void 0,
@@ -450,8 +468,8 @@ function getAuthInfoFromApiRouteRequest(req, res, forceRefresh = false) {
       } else {
         const user = yield validateAccessToken(response.accessToken);
         res.setHeader("Set-Cookie", [
-          `${ACCESS_TOKEN_COOKIE_NAME}=${response.accessToken}; Path=/; HttpOnly; Secure; SameSite=Lax`,
-          `${REFRESH_TOKEN_COOKIE_NAME}=${response.refreshToken}; Path=/; HttpOnly; Secure; SameSite=Lax`
+          `${ACCESS_TOKEN_COOKIE_NAME}=${response.accessToken}; Path=/; HttpOnly; Secure; SameSite=${sameSite}`,
+          `${REFRESH_TOKEN_COOKIE_NAME}=${response.refreshToken}; Path=/; HttpOnly; Secure; SameSite=${sameSite}`
         ]);
         return {
           user,