@scalemule/nextjs 0.1.13 → 0.1.15

package/dist/server/index.js

@@ -3,6 +3,7 @@
 var money = require('@scalemule/money');
 var headers = require('next/headers');
 var server = require('next/server');
+var ledvery = require('@scalemule/ledvery');
 var crypto$1 = require('crypto');
 
 var __create = Object.create;
@@ -1918,11 +1919,12 @@ var require_semver2 = __commonJS({
 
 // src/types/index.ts
 var ScaleMuleApiError = class extends Error {
-  constructor(error) {
+  constructor(error, status) {
     super(error.message);
     this.name = "ScaleMuleApiError";
     this.code = error.code;
     this.field = error.field;
+    this.status = status;
   }
 };
 
@@ -3780,6 +3782,314 @@ function createAnalyticsRoutes(config = {}) {
   return { POST };
 }
 
+// src/server/ledvery-cookies.ts
+var SM_LEDVERY_STATE_COOKIE = "sm_ledvery_state";
+var SM_LEDVERY_PKCE_VERIFIER_COOKIE = "sm_ledvery_pkce_verifier";
+var SM_LEDVERY_NONCE_COOKIE = "sm_ledvery_nonce";
+var SM_LEDVERY_ID_TOKEN_COOKIE = "sm_ledvery_id_token";
+var SM_LEDVERY_ACCESS_TOKEN_COOKIE = "sm_ledvery_access_token";
+var FLOW_COOKIE_MAX_AGE = 60 * 10;
+var SESSION_COOKIE_MAX_AGE = 60 * 60;
+function flowCookieOptions() {
+  return {
+    httpOnly: true,
+    secure: process.env.NODE_ENV === "production",
+    sameSite: "lax",
+    path: "/",
+    maxAge: FLOW_COOKIE_MAX_AGE
+  };
+}
+function sessionCookieOptions(maxAge) {
+  return {
+    httpOnly: true,
+    secure: process.env.NODE_ENV === "production",
+    sameSite: "lax",
+    path: "/",
+    maxAge: maxAge ? Math.min(maxAge, SESSION_COOKIE_MAX_AGE) : SESSION_COOKIE_MAX_AGE
+  };
+}
+function setLedveryFlowCookies(response, params) {
+  const opts = flowCookieOptions();
+  setCookie(response, SM_LEDVERY_STATE_COOKIE, params.state, opts);
+  setCookie(response, SM_LEDVERY_PKCE_VERIFIER_COOKIE, params.codeVerifier, opts);
+  setCookie(response, SM_LEDVERY_NONCE_COOKIE, params.nonce, opts);
+}
+function validateAndConsumeLedveryFlowCookies(request, callbackState) {
+  const cookieState = getCookie(request, SM_LEDVERY_STATE_COOKIE);
+  const codeVerifier = getCookie(request, SM_LEDVERY_PKCE_VERIFIER_COOKIE);
+  const nonce = getCookie(request, SM_LEDVERY_NONCE_COOKIE);
+  if (!cookieState) return "Missing Ledvery state cookie - session may have expired";
+  if (!callbackState) return "Missing state parameter in callback";
+  if (!constantTimeEqual(cookieState, callbackState)) return "Ledvery state mismatch - possible CSRF attack";
+  if (!codeVerifier) return "Missing PKCE verifier cookie";
+  if (!nonce) return "Missing nonce cookie";
+  return { codeVerifier, nonce };
+}
+function setLedverySession(response, session, opts) {
+  const cookieOpts = sessionCookieOptions(opts?.cookies?.maxAge);
+  if (opts?.cookies?.domain) cookieOpts.domain = opts.cookies.domain;
+  if (opts?.cookies?.path) cookieOpts.path = opts.cookies.path;
+  if (opts?.cookies?.sameSite) cookieOpts.sameSite = opts.cookies.sameSite;
+  if (opts?.cookies?.secure !== void 0) cookieOpts.secure = opts.cookies.secure;
+  const sessionPayload = JSON.stringify({
+    claims: session.claims,
+    expiresAt: session.expiresAt
+  });
+  setCookie(response, SM_LEDVERY_ID_TOKEN_COOKIE, sessionPayload, cookieOpts);
+  if (opts?.storeAccessToken && session.accessToken) {
+    setCookie(response, SM_LEDVERY_ACCESS_TOKEN_COOKIE, session.accessToken, cookieOpts);
+  }
+}
+function getLedverySession(request) {
+  const raw = getCookie(request, SM_LEDVERY_ID_TOKEN_COOKIE);
+  if (!raw) return null;
+  try {
+    const parsed = JSON.parse(raw);
+    return {
+      idToken: "",
+      // not stored in cookie for size
+      claims: parsed.claims,
+      expiresAt: parsed.expiresAt
+    };
+  } catch {
+    return null;
+  }
+}
+function clearLedverySession(response) {
+  deleteCookie(response, SM_LEDVERY_ID_TOKEN_COOKIE);
+  deleteCookie(response, SM_LEDVERY_ACCESS_TOKEN_COOKIE);
+}
+function clearLedveryFlowCookies(response) {
+  deleteCookie(response, SM_LEDVERY_STATE_COOKIE);
+  deleteCookie(response, SM_LEDVERY_PKCE_VERIFIER_COOKIE);
+  deleteCookie(response, SM_LEDVERY_NONCE_COOKIE);
+}
+function getCookie(request, name) {
+  const header = request.headers.get("cookie") || "";
+  const match = header.match(new RegExp(`(?:^|;\\s*)${name}=([^;]*)`));
+  return match ? decodeURIComponent(match[1]) : void 0;
+}
+function setCookie(response, name, value, opts) {
+  const parts = [
+    `${name}=${encodeURIComponent(value)}`,
+    `Path=${opts.path}`,
+    `Max-Age=${opts.maxAge}`,
+    `SameSite=${opts.sameSite.charAt(0).toUpperCase() + opts.sameSite.slice(1)}`
+  ];
+  if (opts.httpOnly) parts.push("HttpOnly");
+  if (opts.secure) parts.push("Secure");
+  if (opts.domain) parts.push(`Domain=${opts.domain}`);
+  response.headers.append("Set-Cookie", parts.join("; "));
+}
+function deleteCookie(response, name) {
+  response.headers.append("Set-Cookie", `${name}=; Path=/; Max-Age=0; HttpOnly; SameSite=Lax`);
+}
+
+// src/server/redirect.ts
+function normalizeOrigin(origin) {
+  try {
+    const u = new URL(origin);
+    return `${u.protocol}//${u.host}`.toLowerCase();
+  } catch {
+    return null;
+  }
+}
+function isSafeSchemeRelative(input) {
+  return !(input.startsWith("//") || input.startsWith("\\"));
+}
+function validateSafeRedirect(input, opts = {}) {
+  const defaultPath = opts.defaultPath ?? "/";
+  if (!input || typeof input !== "string") return defaultPath;
+  const trimmed = input.trim();
+  if (!trimmed) return defaultPath;
+  if (!isSafeSchemeRelative(trimmed)) return defaultPath;
+  const colon = trimmed.indexOf(":");
+  if (colon > 0 && colon < 15) {
+    const scheme = trimmed.slice(0, colon).toLowerCase();
+    if (/^[a-z][a-z0-9+.-]*$/.test(scheme) && scheme !== "http" && scheme !== "https") {
+      return defaultPath;
+    }
+  }
+  if (trimmed.startsWith("/")) {
+    if (trimmed.length > 1 && trimmed[1] === "\\") return defaultPath;
+    return trimmed;
+  }
+  const allowed = (opts.allowedOrigins ?? []).map(normalizeOrigin).filter((o) => o !== null);
+  try {
+    const parsed = new URL(trimmed);
+    const origin = `${parsed.protocol}//${parsed.host}`.toLowerCase();
+    if (!allowed.includes(origin)) return defaultPath;
+    if (opts.stripSameOriginHost !== false) {
+      return `${parsed.pathname}${parsed.search}${parsed.hash}` || "/";
+    }
+    return trimmed;
+  } catch {
+    return defaultPath;
+  }
+}
+function isSafeRedirect(input, opts = {}) {
+  if (!input || typeof input !== "string") return false;
+  const defaultPath = `__unsafe_sentinel_${Math.random()}`;
+  const resolved = validateSafeRedirect(input, { ...opts, defaultPath });
+  return resolved !== defaultPath;
+}
+
+// src/server/ledvery.ts
+function createLedveryRoutes(config) {
+  const client = new ledvery.LedveryClient({
+    issuer: config.issuer,
+    clientId: config.clientId,
+    clientSecret: config.clientSecret,
+    redirectUri: config.redirectUri,
+    fetch: config.fetch
+  });
+  const postLoginRedirect = config.postLoginRedirect || "/";
+  const postLogoutRedirect = config.postLogoutRedirect || "/";
+  const defaultScope = config.defaultScope || "openid email profile";
+  async function handleLogin(request) {
+    const url = new URL(request.url);
+    const returnTo = url.searchParams.get("returnTo");
+    const validatedReturnTo = validateSafeRedirect(returnTo, { defaultPath: postLoginRedirect });
+    const authResult = await client.createAuthorizationUrl({
+      scope: defaultScope
+    });
+    const response = new Response(null, {
+      status: 302,
+      headers: { Location: authResult.url }
+    });
+    setLedveryFlowCookies(response, {
+      state: authResult.state,
+      codeVerifier: authResult.codeVerifier,
+      nonce: authResult.nonce
+    });
+    if (validatedReturnTo !== postLoginRedirect) {
+      response.headers.append(
+        "Set-Cookie",
+        `sm_ledvery_return_to=${encodeURIComponent(validatedReturnTo)}; Path=/; Max-Age=600; HttpOnly; SameSite=Lax${process.env.NODE_ENV === "production" ? "; Secure" : ""}`
+      );
+    }
+    return response;
+  }
+  async function handleCallback(request) {
+    const url = new URL(request.url);
+    const code = url.searchParams.get("code");
+    const callbackState = url.searchParams.get("state");
+    if (!code) {
+      const error = url.searchParams.get("error");
+      const errorDesc = url.searchParams.get("error_description");
+      return new Response(
+        JSON.stringify({ error: error || "missing_code", message: errorDesc || "No authorization code in callback" }),
+        { status: 403, headers: { "Content-Type": "application/json" } }
+      );
+    }
+    const flowResult = validateAndConsumeLedveryFlowCookies(request, callbackState);
+    if (typeof flowResult === "string") {
+      return new Response(
+        JSON.stringify({ error: "state_mismatch", message: flowResult }),
+        { status: 403, headers: { "Content-Type": "application/json" } }
+      );
+    }
+    let session;
+    try {
+      session = await client.exchangeCode({
+        code,
+        codeVerifier: flowResult.codeVerifier,
+        receivedState: callbackState,
+        expectedState: getCookieValue(request, "sm_ledvery_state"),
+        expectedNonce: flowResult.nonce
+      });
+    } catch (err) {
+      return new Response(
+        JSON.stringify({ error: "code_exchange_failed", message: err instanceof Error ? err.message : "Code exchange failed" }),
+        { status: 403, headers: { "Content-Type": "application/json" } }
+      );
+    }
+    const returnTo = getCookieValue(request, "sm_ledvery_return_to");
+    const redirectTo = validateSafeRedirect(returnTo, { defaultPath: postLoginRedirect });
+    const response = new Response(null, {
+      status: 302,
+      headers: { Location: redirectTo }
+    });
+    setLedverySession(response, {
+      idToken: session.idToken,
+      accessToken: session.accessToken,
+      claims: session.claims,
+      expiresAt: session.expiresAt.toISOString()
+    }, {
+      storeAccessToken: config.storeAccessToken,
+      cookies: config.cookies
+    });
+    clearLedveryFlowCookies(response);
+    response.headers.append("Set-Cookie", "sm_ledvery_return_to=; Path=/; Max-Age=0; HttpOnly; SameSite=Lax");
+    return response;
+  }
+  function handleSession(request) {
+    const session = getLedverySession(request);
+    if (!session) {
+      return new Response(JSON.stringify({ session: null }), {
+        status: 200,
+        headers: { "Content-Type": "application/json" }
+      });
+    }
+    const expiresAt = new Date(session.expiresAt);
+    if (expiresAt <= /* @__PURE__ */ new Date()) {
+      return new Response(JSON.stringify({ session: null }), {
+        status: 200,
+        headers: { "Content-Type": "application/json" }
+      });
+    }
+    return new Response(
+      JSON.stringify({
+        session: {
+          sub: session.claims.sub,
+          email: session.claims.email,
+          email_verified: session.claims.email_verified,
+          name: session.claims.name,
+          idp: session.claims.idp,
+          expiresAt: session.expiresAt
+        }
+      }),
+      { status: 200, headers: { "Content-Type": "application/json" } }
+    );
+  }
+  function handleLogout(_request) {
+    const response = new Response(null, {
+      status: 302,
+      headers: { Location: postLogoutRedirect }
+    });
+    clearLedverySession(response);
+    return response;
+  }
+  async function handler(request, context) {
+    const params = await context.params;
+    const action = params.action?.[0] || "";
+    switch (action) {
+      case "login":
+        return handleLogin(request);
+      case "callback":
+        return handleCallback(request);
+      case "session":
+        return handleSession(request);
+      case "logout":
+        return handleLogout();
+      default:
+        return new Response(
+          JSON.stringify({ error: "not_found", message: `Unknown Ledvery route: ${action}` }),
+          { status: 404, headers: { "Content-Type": "application/json" } }
+        );
+    }
+  }
+  return {
+    GET: handler,
+    POST: handler
+  };
+}
+function getCookieValue(request, name) {
+  const header = request.headers.get("cookie") || "";
+  const match = header.match(new RegExp(`(?:^|;\\s*)${name}=([^;]*)`));
+  return match ? decodeURIComponent(match[1]) : void 0;
+}
+
 // src/server/push.ts
 function errorResponse2(code, message, status) {
   return new Response(
@@ -5096,55 +5406,6 @@ async function prefetchBundles(keys) {
   await Promise.all(keys.map((key) => getBundle(key)));
 }
 
-// src/server/redirect.ts
-function normalizeOrigin(origin) {
-  try {
-    const u = new URL(origin);
-    return `${u.protocol}//${u.host}`.toLowerCase();
-  } catch {
-    return null;
-  }
-}
-function isSafeSchemeRelative(input) {
-  return !(input.startsWith("//") || input.startsWith("\\"));
-}
-function validateSafeRedirect(input, opts = {}) {
-  const defaultPath = opts.defaultPath ?? "/";
-  if (!input || typeof input !== "string") return defaultPath;
-  const trimmed = input.trim();
-  if (!trimmed) return defaultPath;
-  if (!isSafeSchemeRelative(trimmed)) return defaultPath;
-  const colon = trimmed.indexOf(":");
-  if (colon > 0 && colon < 15) {
-    const scheme = trimmed.slice(0, colon).toLowerCase();
-    if (/^[a-z][a-z0-9+.-]*$/.test(scheme) && scheme !== "http" && scheme !== "https") {
-      return defaultPath;
-    }
-  }
-  if (trimmed.startsWith("/")) {
-    if (trimmed.length > 1 && trimmed[1] === "\\") return defaultPath;
-    return trimmed;
-  }
-  const allowed = (opts.allowedOrigins ?? []).map(normalizeOrigin).filter((o) => o !== null);
-  try {
-    const parsed = new URL(trimmed);
-    const origin = `${parsed.protocol}//${parsed.host}`.toLowerCase();
-    if (!allowed.includes(origin)) return defaultPath;
-    if (opts.stripSameOriginHost !== false) {
-      return `${parsed.pathname}${parsed.search}${parsed.hash}` || "/";
-    }
-    return trimmed;
-  } catch {
-    return defaultPath;
-  }
-}
-function isSafeRedirect(input, opts = {}) {
-  if (!input || typeof input !== "string") return false;
-  const defaultPath = `__unsafe_sentinel_${Math.random()}`;
-  const resolved = validateSafeRedirect(input, { ...opts, defaultPath });
-  return resolved !== defaultPath;
-}
-
 // src/server/security-headers.ts
 var DEFAULT_PERMISSIONS_POLICY = {
   // Conference track features — allow self-origin only.
@@ -5219,6 +5480,11 @@ exports.DEFAULT_PERMISSIONS_POLICY = DEFAULT_PERMISSIONS_POLICY;
 exports.KNOWN_ACCOUNTS_COOKIE_NAME = KNOWN_ACCOUNTS_COOKIE_NAME;
 exports.OAUTH_STATE_COOKIE_NAME = OAUTH_STATE_COOKIE_NAME;
 exports.SESSION_COOKIE_NAME = SESSION_COOKIE_NAME;
+exports.SM_LEDVERY_ACCESS_TOKEN_COOKIE = SM_LEDVERY_ACCESS_TOKEN_COOKIE;
+exports.SM_LEDVERY_ID_TOKEN_COOKIE = SM_LEDVERY_ID_TOKEN_COOKIE;
+exports.SM_LEDVERY_NONCE_COOKIE = SM_LEDVERY_NONCE_COOKIE;
+exports.SM_LEDVERY_PKCE_VERIFIER_COOKIE = SM_LEDVERY_PKCE_VERIFIER_COOKIE;
+exports.SM_LEDVERY_STATE_COOKIE = SM_LEDVERY_STATE_COOKIE;
 exports.ScaleMuleError = ScaleMuleError;
 exports.ScaleMuleServer = ScaleMuleServer;
 exports.USER_ID_COOKIE_NAME = USER_ID_COOKIE_NAME;
@@ -5235,6 +5501,7 @@ exports.configureSecrets = configureSecrets;
 exports.createAnalyticsRoutes = createAnalyticsRoutes;
 exports.createAuthMiddleware = createAuthMiddleware;
 exports.createAuthRoutes = createAuthRoutes;
+exports.createLedveryRoutes = createLedveryRoutes;
 exports.createNotificationRoutes = createNotificationRoutes;
 exports.createPushRoutes = createPushRoutes;
 exports.createServerClient = createServerClient;
@@ -5251,6 +5518,7 @@ exports.getBundle = getBundle;
 exports.getCSRFToken = getCSRFToken;
 exports.getKnownAccountsCookieRaw = getKnownAccountsCookieRaw;
 exports.getKnownAccountsFromRequest = getKnownAccountsFromRequest;
+exports.getLedverySession = getLedverySession;
 exports.getMySqlBundle = getMySqlBundle;
 exports.getOAuthBundle = getOAuthBundle;
 exports.getPostgresBundle = getPostgresBundle;