@robelest/convex-auth 0.0.4-preview.2 → 0.0.4-preview.21

package/dist/server/ssr.js

@@ -0,0 +1,786 @@
+import { isLocalHost } from "./utils.js";
+import { Fx } from "@robelest/fx";
+import { makeFunctionReference } from "convex/server";
+import { ConvexError } from "convex/values";
+import { parse, serialize } from "cookie";
+import { ConvexHttpClient } from "convex/browser";
+import { jwtDecode } from "jwt-decode";
+
+//#region src/server/ssr.ts
+const signInActionRef = makeFunctionReference("auth:signIn");
+const signOutActionRef = makeFunctionReference("auth:signOut");
+const TOKEN_COOKIE_BASE_NAME = "__convexAuthJWT";
+const REFRESH_COOKIE_BASE_NAME = "__convexAuthRefreshToken";
+const VERIFIER_COOKIE_BASE_NAME = "__convexAuthOAuthVerifier";
+const DERIVED_COOKIE_NAMESPACE_FALLBACK = "convexauth";
+/**
+* Derive the cookie names used for auth tokens.
+*
+* On localhost the names are unprefixed; on production hosts they
+* use the `__Host-` prefix for tighter security.
+*
+* @param host - The `Host` header value. Omit to use unprefixed names.
+* @param cookieNamespace - Optional namespace suffix for cookie isolation.
+* @returns An object with `token`, `refreshToken`, and `verifier` cookie names.
+*/
+function authCookieNames(host, cookieNamespace) {
+	const prefix = isLocalHost(host) ? "" : "__Host-";
+	const namespace = normalizeCookieNamespace(cookieNamespace);
+	const suffix = namespace === null ? "" : `_${namespace}`;
+	return {
+		token: `${prefix}${TOKEN_COOKIE_BASE_NAME}${suffix}`,
+		refreshToken: `${prefix}${REFRESH_COOKIE_BASE_NAME}${suffix}`,
+		verifier: `${prefix}${VERIFIER_COOKIE_BASE_NAME}${suffix}`
+	};
+}
+/**
+* Parse auth cookie values from a raw `Cookie` header string.
+*
+* @param cookieHeader - The raw `Cookie` header, or `null`/`undefined`.
+* @param host - The `Host` header, used to determine cookie name prefixes.
+* @param cookieNamespace - Optional namespace suffix for cookie isolation.
+* @returns Parsed {@link AuthCookies} with `token`, `refreshToken`, and `verifier`.
+*/
+function parseAuthCookies(cookieHeader, host, cookieNamespace) {
+	const names = authCookieNames(host, cookieNamespace);
+	const parsed = parse(cookieHeader ?? "");
+	return {
+		token: parsed[names.token] ?? null,
+		refreshToken: parsed[names.refreshToken] ?? null,
+		verifier: parsed[names.verifier] ?? null
+	};
+}
+/**
+* Serialize auth cookies into `Set-Cookie` header strings.
+*
+* Nulled-out values produce deletion cookies (maxAge 0, expired date).
+*
+* @param cookies - The auth cookie values to serialize.
+* @param host - The `Host` header, used for cookie name prefixes and `Secure` flag.
+* @param config - Cookie lifetime config. Defaults to session cookies.
+* @param cookieNamespace - Optional namespace suffix for cookie isolation.
+* @returns An array of three `Set-Cookie` header strings.
+*/
+function serializeAuthCookies(cookies, host, config = { maxAge: null }, cookieNamespace) {
+	const names = authCookieNames(host, cookieNamespace);
+	const base = {
+		path: "/",
+		httpOnly: true,
+		sameSite: "lax",
+		secure: !isLocalHost(host)
+	};
+	const maxAge = config.maxAge ?? void 0;
+	return [
+		serialize(names.token, cookies.token ?? "", {
+			...base,
+			maxAge: cookies.token === null ? 0 : maxAge,
+			expires: cookies.token === null ? /* @__PURE__ */ new Date(0) : void 0
+		}),
+		serialize(names.refreshToken, cookies.refreshToken ?? "", {
+			...base,
+			maxAge: cookies.refreshToken === null ? 0 : maxAge,
+			expires: cookies.refreshToken === null ? /* @__PURE__ */ new Date(0) : void 0
+		}),
+		serialize(names.verifier, cookies.verifier ?? "", {
+			...base,
+			maxAge: cookies.verifier === null ? 0 : maxAge,
+			expires: cookies.verifier === null ? /* @__PURE__ */ new Date(0) : void 0
+		})
+	];
+}
+/**
+* Build structured cookie objects for any SSR framework.
+*
+* Use with SvelteKit's `event.cookies.set()`, TanStack Start's `setCookie()`,
+* Next.js's `cookies().set()`, or any other framework cookie API.
+*
+* @param cookies - The auth cookie values to convert.
+* @param host - The `Host` header, used for cookie name prefixes and `Secure`.
+* @param config - Cookie lifetime config. Defaults to session cookies.
+* @param cookieNamespace - Optional namespace suffix for cookie isolation.
+* @returns Structured cookie descriptors ready for framework cookie APIs.
+*/
+function structuredAuthCookies(cookies, host, config = { maxAge: null }, cookieNamespace) {
+	const names = authCookieNames(host, cookieNamespace);
+	const base = {
+		path: "/",
+		httpOnly: true,
+		secure: !isLocalHost(host),
+		sameSite: "lax"
+	};
+	const maxAge = config.maxAge ?? void 0;
+	return [
+		{
+			name: names.token,
+			value: cookies.token ?? "",
+			options: {
+				...base,
+				maxAge: cookies.token === null ? 0 : maxAge,
+				expires: cookies.token === null ? /* @__PURE__ */ new Date(0) : void 0
+			}
+		},
+		{
+			name: names.refreshToken,
+			value: cookies.refreshToken ?? "",
+			options: {
+				...base,
+				maxAge: cookies.refreshToken === null ? 0 : maxAge,
+				expires: cookies.refreshToken === null ? /* @__PURE__ */ new Date(0) : void 0
+			}
+		},
+		{
+			name: names.verifier,
+			value: cookies.verifier ?? "",
+			options: {
+				...base,
+				maxAge: cookies.verifier === null ? 0 : maxAge,
+				expires: cookies.verifier === null ? /* @__PURE__ */ new Date(0) : void 0
+			}
+		}
+	];
+}
+/**
+* Check whether a request pathname matches the auth proxy route.
+*
+* Handles trailing-slash ambiguity: both `/api/auth` and `/api/auth/`
+* match regardless of how `apiRoute` is configured.
+*
+* @param pathname - The request URL pathname.
+* @param apiRoute - The configured proxy route (e.g. `"/api/auth"`).
+* @returns `true` when the pathname matches the proxy route.
+*
+* @see {@link server}
+*/
+function shouldProxyAuthAction(pathname, apiRoute) {
+	if (apiRoute.endsWith("/")) return pathname === apiRoute || pathname === apiRoute.slice(0, -1);
+	return pathname === apiRoute || pathname === `${apiRoute}/`;
+}
+const REQUIRED_TOKEN_LIFETIME_MS = 6e4;
+const MINIMUM_REQUIRED_TOKEN_LIFETIME_MS = 1e4;
+function normalizeCookieNamespace(cookieNamespace) {
+	if (cookieNamespace === void 0 || cookieNamespace === null) return null;
+	const normalized = cookieNamespace.trim().replace(/[^a-zA-Z0-9]+/g, "_").replace(/^_+|_+$/g, "").toLowerCase();
+	return normalized.length > 0 ? normalized : null;
+}
+/**
+* Safely check if a string is a valid URL without throwing.
+*/
+function canParseUrl(value) {
+	try {
+		new URL(value);
+		return true;
+	} catch {
+		return false;
+	}
+}
+function serializeAuthCookie(cookie) {
+	const parts = [`${cookie.name}=${cookie.value}`, `Path=${cookie.options.path}`];
+	if (cookie.options.httpOnly) parts.push("HttpOnly");
+	if (cookie.options.secure) parts.push("Secure");
+	if (cookie.options.sameSite) parts.push(`SameSite=${cookie.options.sameSite}`);
+	if (cookie.options.maxAge !== void 0) parts.push(`Max-Age=${cookie.options.maxAge}`);
+	if (cookie.options.expires) parts.push(`Expires=${cookie.options.expires.toUTCString()}`);
+	return parts.join("; ");
+}
+function buildRedirectResponse(location, cookies) {
+	const headers = new Headers({ Location: location });
+	for (const cookie of cookies) headers.append("Set-Cookie", serializeAuthCookie(cookie));
+	return new Response(null, {
+		status: 302,
+		headers
+	});
+}
+function deriveCookieNamespaceFromUrl(url) {
+	if (!canParseUrl(url)) return DERIVED_COOKIE_NAMESPACE_FALLBACK;
+	const parsed = new URL(url);
+	return normalizeCookieNamespace(`${parsed.hostname}${parsed.pathname}`) ?? DERIVED_COOKIE_NAMESPACE_FALLBACK;
+}
+function normalizeIssuer(value) {
+	if (!canParseUrl(value)) return value.replace(/\/+$/, "");
+	const parsed = new URL(value);
+	const pathname = parsed.pathname === "/" ? "" : parsed.pathname.replace(/\/+$/, "");
+	return `${parsed.protocol}//${parsed.host}${pathname}`;
+}
+function convexSiteIssuerFromCloudUrl(value) {
+	if (!canParseUrl(value)) return null;
+	const parsed = new URL(value);
+	if (!parsed.hostname.endsWith(".convex.cloud")) return null;
+	parsed.hostname = parsed.hostname.slice(0, -13) + ".convex.site";
+	return normalizeIssuer(parsed.toString());
+}
+function defaultAcceptedIssuersForUrl(value) {
+	const issuers = [normalizeIssuer(value)];
+	const siteIssuer = convexSiteIssuerFromCloudUrl(value);
+	if (siteIssuer !== null) issuers.push(siteIssuer);
+	return issuers;
+}
+/**
+* Create an SSR auth helper for server-side frameworks.
+*
+* Handles cookie-based token management, OAuth code exchange,
+* and automatic JWT refresh on page loads. Works with any
+* framework that gives you a `Request` object — SvelteKit,
+* TanStack Start, Remix, Next.js, etc.
+*
+* @param options - SSR configuration (Convex API URL, issuer rules, proxy route, cookie lifetime).
+* @returns An object with `token`, `verify`, `proxy`, and `refresh` methods.
+*
+* @example SvelteKit hooks
+* ```ts
+* // src/hooks.server.ts
+* import { server } from '@robelest/convex-auth/server';
+*
+* const auth = server({ url: CONVEX_URL });
+*
+* export const handle = async ({ event, resolve }) => {
+*   const { cookies, token } = await auth.refresh(event.request);
+*   for (const c of cookies) event.cookies.set(c.name, c.value, c.options);
+*   event.locals.token = token;
+*   return resolve(event);
+* };
+* ```
+*
+* @example Generic proxy endpoint
+* ```ts
+* if (shouldProxyAuthAction(url.pathname, '/api/auth')) {
+*   return auth.proxy(request);
+* }
+* ```
+*
+* @param options - Server-side auth configuration including Convex URL,
+*   accepted issuers, proxy route, and cookie behavior.
+* @returns SSR helpers for reading tokens, refreshing cookies, and proxying
+*   auth actions through an httpOnly-cookie layer.
+*
+* @see {@link shouldProxyAuthAction}
+*/
+function server(options) {
+	const convexUrl = options.url;
+	const apiRoute = options.apiRoute ?? "/api/auth";
+	const cookieConfig = { maxAge: options.cookieMaxAge ?? null };
+	const verbose = options.verbose ?? false;
+	const cookieNamespace = normalizeCookieNamespace(options.cookieNamespace) ?? deriveCookieNamespaceFromUrl(convexUrl);
+	const acceptedIssuers = new Set((options.acceptedIssuers ?? defaultAcceptedIssuersForUrl(convexUrl)).map(normalizeIssuer).filter((issuer) => issuer.length > 0));
+	return {
+		token(request) {
+			return parseAuthCookies(request.headers.get("cookie"), request.headers.get("host") ?? new URL(request.url).host, cookieNamespace).token;
+		},
+		async verify(request) {
+			const token = parseAuthCookies(request.headers.get("cookie"), request.headers.get("host") ?? new URL(request.url).host, cookieNamespace).token;
+			if (token === null) return false;
+			const decodedToken = await Fx.run(Fx.attempt(async () => jwtDecode(token), (decoded) => decoded, () => null));
+			if (decodedToken?.exp === void 0 || decodedToken.iss === void 0) return false;
+			if (!acceptedIssuers.has(normalizeIssuer(decodedToken.iss))) return false;
+			return decodedToken.exp * 1e3 > Date.now();
+		},
+		async proxy(request) {
+			const requestDispatch = !shouldProxyAuthAction(new URL(request.url).pathname, apiRoute) ? { kind: "invalidRoute" } : request.method !== "POST" ? { kind: "invalidMethod" } : (() => {
+				const originHeader = request.headers.get("origin");
+				if (originHeader === null) return false;
+				const forwardedProtoHeader = request.headers.get("x-forwarded-proto");
+				const protocol = forwardedProtoHeader !== null ? (() => {
+					const forwardedProto = forwardedProtoHeader.split(",")[0]?.trim();
+					if (forwardedProto !== void 0 && forwardedProto.length > 0) return forwardedProto.endsWith(":") ? forwardedProto : `${forwardedProto}:`;
+					return new URL(request.url).protocol;
+				})() : new URL(request.url).protocol;
+				const requestHost = request.headers.get("host") ?? new URL(request.url).host;
+				const hostCandidate = `${protocol}//${requestHost}`;
+				const host$1 = canParseUrl(hostCandidate) ? new URL(hostCandidate).host : requestHost;
+				if (!canParseUrl(originHeader)) return true;
+				const originUrl = new URL(originHeader);
+				return originUrl.host !== host$1 || originUrl.protocol !== protocol;
+			})() ? { kind: "invalidOrigin" } : { kind: "valid" };
+			const validationErrorResponse = await Fx.run(Fx.match(requestDispatch, requestDispatch.kind, {
+				invalidRoute: () => new Response("Invalid route", { status: 404 }),
+				invalidMethod: () => new Response("Invalid method", { status: 405 }),
+				invalidOrigin: () => new Response("Invalid origin", { status: 403 }),
+				valid: () => null
+			}));
+			if (validationErrorResponse !== null) return validationErrorResponse;
+			const body = await Fx.run(Fx.attempt(async () => {
+				const parsed = await request.json();
+				if (typeof parsed !== "object" || parsed === null) return null;
+				return parsed;
+			}, (parsed) => parsed, () => null));
+			if (body === null) return new Response("Invalid request body", { status: 400 });
+			const action = body.action;
+			const args = typeof body.args === "object" && body.args !== null ? body.args : {};
+			const actionDispatch = action === "auth:signIn" ? { action: "sessionStart" } : action === "auth:signOut" ? { action: "sessionStop" } : null;
+			if (actionDispatch === null) return new Response("Invalid action", { status: 400 });
+			const host = request.headers.get("host") ?? new URL(request.url).host;
+			const currentCookies = parseAuthCookies(request.headers.get("cookie"), host, cookieNamespace);
+			return Fx.run(Fx.match(actionDispatch, actionDispatch.action, {
+				sessionStart: (_) => Fx.from({
+					ok: async () => {
+						const refreshDispatch = args.refreshToken === void 0 ? { kind: "passthrough" } : currentCookies.refreshToken === null ? { kind: "refreshRequestedWithoutCookie" } : {
+							kind: "hydrateRefreshFromCookie",
+							refreshToken: currentCookies.refreshToken
+						};
+						const refreshResponse = await Fx.run(Fx.match(refreshDispatch, refreshDispatch.kind, {
+							passthrough: async () => null,
+							hydrateRefreshFromCookie: async ({ refreshToken }) => {
+								args.refreshToken = refreshToken;
+								return null;
+							},
+							refreshRequestedWithoutCookie: async () => {
+								const currentToken = currentCookies.token;
+								const decodedToken = currentToken === null ? null : await Fx.run(Fx.attempt(async () => jwtDecode(currentToken), (decoded) => decoded, () => null));
+								const tokenDispatch = currentToken !== null && decodedToken?.exp !== void 0 && decodedToken.iss !== void 0 && acceptedIssuers.has(normalizeIssuer(decodedToken.iss)) && decodedToken.exp * 1e3 > Date.now() ? {
+									kind: "validToken",
+									token: currentToken
+								} : { kind: "missingToken" };
+								return await Fx.run(Fx.match(tokenDispatch, tokenDispatch.kind, {
+									validToken: ({ token }) => new Response(JSON.stringify({ tokens: {
+										token,
+										refreshToken: "dummy"
+									} }), {
+										status: 200,
+										headers: { "Content-Type": "application/json" }
+									}),
+									missingToken: () => new Response(JSON.stringify({ tokens: null }), {
+										status: 200,
+										headers: { "Content-Type": "application/json" }
+									})
+								}));
+							}
+						}));
+						const refreshDecision = refreshResponse !== null ? {
+							kind: "shortCircuit",
+							response: refreshResponse
+						} : { kind: "continue" };
+						const maybeShortCircuitResponse = await Fx.run(Fx.match(refreshDecision, refreshDecision.kind, {
+							shortCircuit: ({ response }) => response,
+							continue: () => null
+						}));
+						if (maybeShortCircuitResponse !== null) return maybeShortCircuitResponse;
+						const client = new ConvexHttpClient(convexUrl);
+						const authDispatch = args.refreshToken === void 0 && args.params?.code === void 0 && currentCookies.token !== null ? {
+							kind: "attachAuth",
+							token: currentCookies.token
+						} : { kind: "skipAuth" };
+						await Fx.run(Fx.match(authDispatch, authDispatch.kind, {
+							attachAuth: ({ token }) => {
+								client.setAuth(token);
+							},
+							skipAuth: () => void 0
+						}));
+						return Fx.run(Fx.from({
+							ok: () => client.action(signInActionRef, args),
+							err: (error) => error
+						}).pipe(Fx.fold({
+							ok: (result) => Fx.run(Fx.match(result, result.kind, {
+								redirect: (redirectResult) => {
+									const response = new Response(JSON.stringify({
+										kind: "redirect",
+										redirect: redirectResult.redirect,
+										verifier: redirectResult.verifier
+									}), {
+										status: 200,
+										headers: { "Content-Type": "application/json" }
+									});
+									for (const value of serializeAuthCookies({
+										...currentCookies,
+										verifier: redirectResult.verifier
+									}, host, cookieConfig, cookieNamespace)) response.headers.append("Set-Cookie", value);
+									return Fx.succeed(response);
+								},
+								signedIn: (signedInResult) => {
+									const response = new Response(JSON.stringify({
+										kind: "signedIn",
+										tokens: signedInResult.tokens === null ? null : {
+											token: signedInResult.tokens.token,
+											refreshToken: "dummy"
+										}
+									}), {
+										status: 200,
+										headers: { "Content-Type": "application/json" }
+									});
+									for (const value of serializeAuthCookies({
+										token: signedInResult.tokens?.token ?? null,
+										refreshToken: signedInResult.tokens?.refreshToken ?? null,
+										verifier: null
+									}, host, cookieConfig, cookieNamespace)) response.headers.append("Set-Cookie", value);
+									return Fx.succeed(response);
+								},
+								started: (startedResult) => Fx.succeed(new Response(JSON.stringify(startedResult), {
+									status: 200,
+									headers: { "Content-Type": "application/json" }
+								})),
+								passkeyOptions: (passkeyOptionsResult) => Fx.succeed(new Response(JSON.stringify(passkeyOptionsResult), {
+									status: 200,
+									headers: { "Content-Type": "application/json" }
+								})),
+								totpRequired: (totpRequiredResult) => Fx.succeed(new Response(JSON.stringify(totpRequiredResult), {
+									status: 200,
+									headers: { "Content-Type": "application/json" }
+								})),
+								totpSetup: (totpSetupResult) => Fx.succeed(new Response(JSON.stringify(totpSetupResult), {
+									status: 200,
+									headers: { "Content-Type": "application/json" }
+								})),
+								deviceCode: (deviceCodeResult) => Fx.succeed(new Response(JSON.stringify(deviceCodeResult), {
+									status: 200,
+									headers: { "Content-Type": "application/json" }
+								}))
+							})),
+							err: (error) => {
+								const errorBody = error instanceof ConvexError && typeof error.data === "object" && error.data !== null && "code" in error.data ? {
+									error: error.data.message ?? String(error),
+									authError: error.data
+								} : { error: error instanceof Error ? error.message : String(error) };
+								const response = new Response(JSON.stringify(errorBody), {
+									status: 400,
+									headers: { "Content-Type": "application/json" }
+								});
+								const clearSession = args.refreshToken !== void 0 && error instanceof ConvexError && typeof error.data === "object" && error.data !== null && error.data.code === "INVALID_REFRESH_TOKEN";
+								for (const value of serializeAuthCookies({
+									token: clearSession ? null : currentCookies.token,
+									refreshToken: clearSession ? null : currentCookies.refreshToken,
+									verifier: null
+								}, host, cookieConfig, cookieNamespace)) response.headers.append("Set-Cookie", value);
+								return response;
+							}
+						})));
+					},
+					err: (e) => e
+				}),
+				sessionStop: (_) => Fx.from({
+					ok: async () => {
+						await Fx.run(Fx.from({
+							ok: () => (() => {
+								const client = new ConvexHttpClient(convexUrl);
+								if (currentCookies.token !== null) client.setAuth(currentCookies.token);
+								return client.action(signOutActionRef);
+							})(),
+							err: (error) => error
+						}).pipe(Fx.recover((error) => {
+							console.error("[convex-auth/server] proxy sign-out failed", error);
+							const fallbackDispatch = currentCookies.refreshToken !== null ? {
+								kind: "attemptFallback",
+								refreshToken: currentCookies.refreshToken
+							} : { kind: "skipFallback" };
+							return Fx.match(fallbackDispatch, fallbackDispatch.kind, {
+								attemptFallback: ({ refreshToken }) => Fx.from({
+									ok: async () => {
+										const refreshed = await new ConvexHttpClient(convexUrl).action(signInActionRef, { refreshToken });
+										const refreshedTokens = await Fx.run(Fx.match(refreshed, refreshed.kind, {
+											signedIn: (signedInResult) => Fx.succeed(signedInResult.tokens),
+											redirect: () => Fx.fatal(/* @__PURE__ */ new Error("Invalid `auth:signIn` result for sign-out fallback refresh")),
+											started: () => Fx.fatal(/* @__PURE__ */ new Error("Invalid `auth:signIn` result for sign-out fallback refresh")),
+											passkeyOptions: () => Fx.fatal(/* @__PURE__ */ new Error("Invalid `auth:signIn` result for sign-out fallback refresh")),
+											totpRequired: () => Fx.fatal(/* @__PURE__ */ new Error("Invalid `auth:signIn` result for sign-out fallback refresh")),
+											totpSetup: () => Fx.fatal(/* @__PURE__ */ new Error("Invalid `auth:signIn` result for sign-out fallback refresh")),
+											deviceCode: () => Fx.fatal(/* @__PURE__ */ new Error("Invalid `auth:signIn` result for sign-out fallback refresh"))
+										}));
+										const fallbackSignOutDispatch = refreshedTokens !== null ? {
+											kind: "signOutWithRefreshed",
+											token: refreshedTokens.token
+										} : { kind: "skipRefreshedSignOut" };
+										await Fx.run(Fx.match(fallbackSignOutDispatch, fallbackSignOutDispatch.kind, {
+											signOutWithRefreshed: ({ token }) => Fx.from({
+												ok: async () => {
+													const client = new ConvexHttpClient(convexUrl);
+													client.setAuth(token);
+													await client.action(signOutActionRef);
+												},
+												err: (error$1) => error$1
+											}),
+											skipRefreshedSignOut: () => Fx.succeed(void 0)
+										}));
+									},
+									err: (fallbackError) => fallbackError
+								}).pipe(Fx.recover((fallbackError) => {
+									console.error("[convex-auth/server] proxy sign-out fallback failed", fallbackError);
+									return Fx.succeed(void 0);
+								})),
+								skipFallback: () => Fx.succeed(void 0)
+							});
+						}), Fx.map(() => void 0)));
+						const response = new Response(JSON.stringify(null), {
+							status: 200,
+							headers: { "Content-Type": "application/json" }
+						});
+						for (const value of serializeAuthCookies({
+							token: null,
+							refreshToken: null,
+							verifier: null
+						}, host, cookieConfig, cookieNamespace)) response.headers.append("Set-Cookie", value);
+						return response;
+					},
+					err: (e) => e
+				})
+			}));
+		},
+		async refresh(request) {
+			const host = request.headers.get("host") ?? new URL(request.url).host;
+			const currentCookies = parseAuthCookies(request.headers.get("cookie"), host, cookieNamespace);
+			const currentToken = currentCookies.token;
+			const originHeader = request.headers.get("origin");
+			const forwardedProtoHeader = request.headers.get("x-forwarded-proto");
+			const protocol = forwardedProtoHeader !== null ? (() => {
+				const forwardedProto = forwardedProtoHeader.split(",")[0]?.trim();
+				if (forwardedProto !== void 0 && forwardedProto.length > 0) return forwardedProto.endsWith(":") ? forwardedProto : `${forwardedProto}:`;
+				return new URL(request.url).protocol;
+			})() : new URL(request.url).protocol;
+			const requestHost = request.headers.get("host") ?? new URL(request.url).host;
+			const hostCandidate = `${protocol}//${requestHost}`;
+			const normalizedHost = canParseUrl(hostCandidate) ? new URL(hostCandidate).host : requestHost;
+			const originUrl = originHeader !== null && canParseUrl(originHeader) ? new URL(originHeader) : null;
+			const corsDispatch = originHeader !== null && (originUrl === null || originUrl.host !== normalizedHost || originUrl.protocol !== protocol) ? { kind: "crossOrigin" } : { kind: "sameOrigin" };
+			const corsRefreshResult = await Fx.run(Fx.match(corsDispatch, corsDispatch.kind, {
+				crossOrigin: () => ({
+					redirect: false,
+					cookies: [],
+					token: null
+				}),
+				sameOrigin: () => null
+			}));
+			if (corsRefreshResult !== null) return corsRefreshResult;
+			const requestUrl = new URL(request.url);
+			const code = requestUrl.searchParams.get("code");
+			const shouldHandleCode = options.shouldHandleCode === void 0 ? true : typeof options.shouldHandleCode === "function" ? await options.shouldHandleCode(request) : options.shouldHandleCode;
+			const codeExchangeDispatch = code !== null && request.method === "GET" && request.headers.get("accept")?.includes("text/html") && shouldHandleCode ? {
+				kind: "exchange",
+				code
+			} : { kind: "skip" };
+			const codeExchangeResult = await Fx.run(Fx.match(codeExchangeDispatch, codeExchangeDispatch.kind, {
+				exchange: async ({ code: verificationCode }) => {
+					const redirectUrl = new URL(requestUrl.toString());
+					return Fx.run(Fx.from({
+						ok: async () => {
+							const result = await new ConvexHttpClient(convexUrl).action(signInActionRef, {
+								params: { code: verificationCode },
+								verifier: currentCookies.verifier ?? void 0
+							});
+							return {
+								kind: "signedIn",
+								tokens: await Fx.run(Fx.match(result, result.kind, {
+									signedIn: (signedInResult) => Fx.succeed(signedInResult.tokens),
+									redirect: () => Fx.fatal(/* @__PURE__ */ new Error("Invalid `auth:signIn` result for code exchange")),
+									started: () => Fx.fatal(/* @__PURE__ */ new Error("Invalid `auth:signIn` result for code exchange")),
+									passkeyOptions: () => Fx.fatal(/* @__PURE__ */ new Error("Invalid `auth:signIn` result for code exchange")),
+									totpRequired: () => Fx.fatal(/* @__PURE__ */ new Error("Invalid `auth:signIn` result for code exchange")),
+									totpSetup: () => Fx.fatal(/* @__PURE__ */ new Error("Invalid `auth:signIn` result for code exchange")),
+									deviceCode: () => Fx.fatal(/* @__PURE__ */ new Error("Invalid `auth:signIn` result for code exchange"))
+								}))
+							};
+						},
+						err: (error) => error
+					}).pipe(Fx.fold({
+						ok: (result) => {
+							redirectUrl.searchParams.delete("code");
+							const cookies = structuredAuthCookies({
+								token: result.tokens?.token ?? null,
+								refreshToken: result.tokens?.refreshToken ?? null,
+								verifier: null
+							}, host, cookieConfig, cookieNamespace);
+							return {
+								redirect: true,
+								response: buildRedirectResponse(redirectUrl.toString(), cookies)
+							};
+						},
+						err: (error) => {
+							console.error("[convex-auth/server] code exchange failed", error);
+							const errorCode = error instanceof ConvexError && typeof error.data === "object" && error.data !== null && typeof error.data.code === "string" ? error.data.code : null;
+							if (!(errorCode === "OAUTH_INVALID_STATE" || errorCode === "OAUTH_PROVIDER_ERROR" || errorCode === "OAUTH_MISSING_ID_TOKEN" || errorCode === "OAUTH_INVALID_PROFILE" || errorCode === "OAUTH_MISSING_VERIFIER" || errorCode === "INVALID_VERIFIER" || errorCode === "INVALID_VERIFICATION_CODE")) return {
+								redirect: false,
+								cookies: [],
+								token: currentCookies.token
+							};
+							redirectUrl.searchParams.delete("code");
+							const cookies = structuredAuthCookies({
+								token: currentCookies.token,
+								refreshToken: currentCookies.refreshToken,
+								verifier: null
+							}, host, cookieConfig, cookieNamespace);
+							return {
+								redirect: true,
+								response: buildRedirectResponse(redirectUrl.toString(), cookies)
+							};
+						}
+					})));
+				},
+				skip: async () => null
+			}));
+			const codeExchangeDecision = codeExchangeResult !== null ? {
+				kind: "done",
+				result: codeExchangeResult
+			} : { kind: "continue" };
+			const maybeCodeExchangeResult = await Fx.run(Fx.match(codeExchangeDecision, codeExchangeDecision.kind, {
+				done: ({ result }) => result,
+				continue: () => null
+			}));
+			if (maybeCodeExchangeResult !== null) return maybeCodeExchangeResult;
+			const tokens = await Fx.run(Fx.gen(function* () {
+				const { token, refreshToken } = currentCookies;
+				const malformedRefreshTokenDispatch = refreshToken !== null && (refreshToken.trim().length === 0 || refreshToken === "dummy") ? { kind: "malformed" } : { kind: "ok" };
+				const malformedRefreshTokenResult = yield* Fx.match(malformedRefreshTokenDispatch, malformedRefreshTokenDispatch.kind, {
+					malformed: () => {
+						if (verbose) console.debug(`${(/* @__PURE__ */ new Date()).toISOString()} [convex-auth/server] Refresh token cookie malformed, clearing auth cookies`);
+						return null;
+					},
+					ok: () => void 0
+				});
+				if (malformedRefreshTokenResult !== void 0) return malformedRefreshTokenResult;
+				const decodedToken = token === null ? null : yield* Fx.attempt(async () => jwtDecode(token), (decoded) => decoded, () => null);
+				const issuerDispatch = decodedToken?.iss !== void 0 && !acceptedIssuers.has(normalizeIssuer(decodedToken.iss)) ? { kind: "issuerMismatch" } : { kind: "issuerOk" };
+				const issuerResult = yield* Fx.match(issuerDispatch, issuerDispatch.kind, {
+					issuerMismatch: () => {
+						if (verbose) console.debug(`${(/* @__PURE__ */ new Date()).toISOString()} [convex-auth/server] Access token issuer mismatch, clearing auth cookies`);
+						return null;
+					},
+					issuerOk: () => void 0
+				});
+				if (issuerResult !== void 0) return issuerResult;
+				const tokenState = token === null ? refreshToken === null ? { kind: "none" } : {
+					kind: "refreshOnly",
+					refreshToken
+				} : refreshToken === null ? {
+					kind: "accessOnly",
+					token
+				} : {
+					kind: "both",
+					token,
+					refreshToken
+				};
+				return yield* Fx.match(tokenState, tokenState.kind, {
+					none: () => {
+						if (verbose) console.debug(`${(/* @__PURE__ */ new Date()).toISOString()} [convex-auth/server] No auth cookies found, skipping refresh`);
+						return Fx.succeed(void 0);
+					},
+					refreshOnly: ({ refreshToken: refreshTokenValue }) => {
+						if (verbose) console.debug(`${(/* @__PURE__ */ new Date()).toISOString()} [convex-auth/server] Access token cookie missing, attempting refresh-token recovery`);
+						return Fx.from({
+							ok: async () => {
+								const result = await new ConvexHttpClient(convexUrl).action(signInActionRef, { refreshToken: refreshTokenValue });
+								const tokens$1 = await Fx.run(Fx.match(result, result.kind, {
+									signedIn: (signedInResult) => Fx.succeed(signedInResult.tokens),
+									redirect: () => Fx.fatal(/* @__PURE__ */ new Error("Invalid `auth:signIn` result for token refresh")),
+									started: () => Fx.fatal(/* @__PURE__ */ new Error("Invalid `auth:signIn` result for token refresh")),
+									passkeyOptions: () => Fx.fatal(/* @__PURE__ */ new Error("Invalid `auth:signIn` result for token refresh")),
+									totpRequired: () => Fx.fatal(/* @__PURE__ */ new Error("Invalid `auth:signIn` result for token refresh")),
+									totpSetup: () => Fx.fatal(/* @__PURE__ */ new Error("Invalid `auth:signIn` result for token refresh")),
+									deviceCode: () => Fx.fatal(/* @__PURE__ */ new Error("Invalid `auth:signIn` result for token refresh"))
+								}));
+								if (verbose) console.debug(`${(/* @__PURE__ */ new Date()).toISOString()} [convex-auth/server] Refreshed tokens, null=${tokens$1 === null}`);
+								return tokens$1;
+							},
+							err: (error) => error
+						}).pipe(Fx.recover((error) => {
+							console.error("[convex-auth/server] refresh-token exchange failed", error);
+							if ((error instanceof ConvexError && typeof error.data === "object" && error.data !== null && typeof error.data.code === "string" ? error.data.code : null) === "INVALID_REFRESH_TOKEN") {
+								if (verbose) console.debug(`${(/* @__PURE__ */ new Date()).toISOString()} [convex-auth/server] Refresh token rejected, clearing auth cookies`);
+								return Fx.succeed(null);
+							}
+							if (verbose) console.debug(`${(/* @__PURE__ */ new Date()).toISOString()} [convex-auth/server] Token refresh failed transiently, keeping current cookies`);
+							return Fx.succeed(void 0);
+						}));
+					},
+					accessOnly: () => {
+						const accessOnlyDispatch = decodedToken?.exp !== void 0 && decodedToken.iss !== void 0 && acceptedIssuers.has(normalizeIssuer(decodedToken.iss)) && decodedToken.exp * 1e3 > Date.now() ? { kind: "accessValid" } : { kind: "accessInvalid" };
+						return Fx.match(accessOnlyDispatch, accessOnlyDispatch.kind, {
+							accessValid: () => {
+								if (verbose) console.debug(`${(/* @__PURE__ */ new Date()).toISOString()} [convex-auth/server] Refresh token cookie missing but access token still valid`);
+								return Fx.succeed(void 0);
+							},
+							accessInvalid: () => {
+								if (verbose) console.debug(`${(/* @__PURE__ */ new Date()).toISOString()} [convex-auth/server] Refresh token cookie missing and access token invalid, clearing`);
+								return Fx.succeed(null);
+							}
+						});
+					},
+					both: ({ refreshToken: refreshTokenValue }) => {
+						const bothDecodeDispatch = decodedToken?.exp === void 0 || decodedToken.iat === void 0 ? { kind: "undecodable" } : {
+							kind: "decoded",
+							decodedToken
+						};
+						return Fx.match(bothDecodeDispatch, bothDecodeDispatch.kind, {
+							undecodable: () => {
+								if (verbose) console.debug(`${(/* @__PURE__ */ new Date()).toISOString()} [convex-auth/server] Failed to decode access token, attempting refresh-token recovery`);
+								return Fx.from({
+									ok: async () => {
+										const result = await new ConvexHttpClient(convexUrl).action(signInActionRef, { refreshToken: refreshTokenValue });
+										const tokens$1 = await Fx.run(Fx.match(result, result.kind, {
+											signedIn: (signedInResult) => Fx.succeed(signedInResult.tokens),
+											redirect: () => Fx.fatal(/* @__PURE__ */ new Error("Invalid `auth:signIn` result for token refresh")),
+											started: () => Fx.fatal(/* @__PURE__ */ new Error("Invalid `auth:signIn` result for token refresh")),
+											passkeyOptions: () => Fx.fatal(/* @__PURE__ */ new Error("Invalid `auth:signIn` result for token refresh")),
+											totpRequired: () => Fx.fatal(/* @__PURE__ */ new Error("Invalid `auth:signIn` result for token refresh")),
+											totpSetup: () => Fx.fatal(/* @__PURE__ */ new Error("Invalid `auth:signIn` result for token refresh")),
+											deviceCode: () => Fx.fatal(/* @__PURE__ */ new Error("Invalid `auth:signIn` result for token refresh"))
+										}));
+										if (verbose) console.debug(`${(/* @__PURE__ */ new Date()).toISOString()} [convex-auth/server] Refreshed tokens, null=${tokens$1 === null}`);
+										return tokens$1;
+									},
+									err: (error) => error
+								}).pipe(Fx.recover((error) => {
+									console.error("[convex-auth/server] refresh-token exchange failed", error);
+									if ((error instanceof ConvexError && typeof error.data === "object" && error.data !== null && typeof error.data.code === "string" ? error.data.code : null) === "INVALID_REFRESH_TOKEN") {
+										if (verbose) console.debug(`${(/* @__PURE__ */ new Date()).toISOString()} [convex-auth/server] Refresh token rejected, clearing auth cookies`);
+										return Fx.succeed(null);
+									}
+									if (verbose) console.debug(`${(/* @__PURE__ */ new Date()).toISOString()} [convex-auth/server] Token refresh failed transiently, keeping current cookies`);
+									return Fx.succeed(void 0);
+								}));
+							},
+							decoded: ({ decodedToken: decodedAccessToken }) => {
+								const totalTokenLifetimeMs = decodedAccessToken.exp * 1e3 - decodedAccessToken.iat * 1e3;
+								const minimumExpiration = Date.now() + Math.min(REQUIRED_TOKEN_LIFETIME_MS, Math.max(MINIMUM_REQUIRED_TOKEN_LIFETIME_MS, totalTokenLifetimeMs / 10));
+								const expirationDispatch = decodedAccessToken.exp * 1e3 > minimumExpiration ? { kind: "skipRefresh" } : { kind: "refresh" };
+								return Fx.match(expirationDispatch, expirationDispatch.kind, {
+									skipRefresh: () => {
+										if (verbose) console.debug(`${(/* @__PURE__ */ new Date()).toISOString()} [convex-auth/server] Token valid long enough, skipping refresh`);
+										return Fx.succeed(void 0);
+									},
+									refresh: () => Fx.from({
+										ok: async () => {
+											const result = await new ConvexHttpClient(convexUrl).action(signInActionRef, { refreshToken: refreshTokenValue });
+											const tokens$1 = await Fx.run(Fx.match(result, result.kind, {
+												signedIn: (signedInResult) => Fx.succeed(signedInResult.tokens),
+												redirect: () => Fx.fatal(/* @__PURE__ */ new Error("Invalid `auth:signIn` result for token refresh")),
+												started: () => Fx.fatal(/* @__PURE__ */ new Error("Invalid `auth:signIn` result for token refresh")),
+												passkeyOptions: () => Fx.fatal(/* @__PURE__ */ new Error("Invalid `auth:signIn` result for token refresh")),
+												totpRequired: () => Fx.fatal(/* @__PURE__ */ new Error("Invalid `auth:signIn` result for token refresh")),
+												totpSetup: () => Fx.fatal(/* @__PURE__ */ new Error("Invalid `auth:signIn` result for token refresh")),
+												deviceCode: () => Fx.fatal(/* @__PURE__ */ new Error("Invalid `auth:signIn` result for token refresh"))
+											}));
+											if (verbose) console.debug(`${(/* @__PURE__ */ new Date()).toISOString()} [convex-auth/server] Refreshed tokens, null=${tokens$1 === null}`);
+											return tokens$1;
+										},
+										err: (error) => error
+									}).pipe(Fx.recover((error) => {
+										console.error("[convex-auth/server] refresh-token exchange failed", error);
+										if ((error instanceof ConvexError && typeof error.data === "object" && error.data !== null && typeof error.data.code === "string" ? error.data.code : null) === "INVALID_REFRESH_TOKEN") {
+											if (verbose) console.debug(`${(/* @__PURE__ */ new Date()).toISOString()} [convex-auth/server] Refresh token rejected, clearing auth cookies`);
+											return Fx.succeed(null);
+										}
+										if (verbose) console.debug(`${(/* @__PURE__ */ new Date()).toISOString()} [convex-auth/server] Token refresh failed transiently, keeping current cookies`);
+										return Fx.succeed(void 0);
+									}))
+								});
+							}
+						});
+					}
+				});
+			}));
+			if (tokens === void 0) return {
+				redirect: false,
+				cookies: [],
+				token: currentToken
+			};
+			return {
+				redirect: false,
+				cookies: structuredAuthCookies({
+					token: tokens?.token ?? null,
+					refreshToken: tokens?.refreshToken ?? null,
+					verifier: null
+				}, host, cookieConfig, cookieNamespace),
+				token: tokens?.token ?? null
+			};
+		}
+	};
+}
+
+//#endregion
+export { authCookieNames, parseAuthCookies, serializeAuthCookies, server, shouldProxyAuthAction, structuredAuthCookies };
+//# sourceMappingURL=ssr.js.map