@scalemule/nextjs 0.1.14 → 0.1.16

package/dist/server/ledvery.js

@@ -0,0 +1,331 @@
+'use strict';
+
+var ledvery = require('@scalemule/ledvery');
+
+// src/server/ledvery.ts
+
+// src/server/timing.ts
+function constantTimeEqual(a, b) {
+  const maxLength = Math.max(a.length, b.length);
+  let mismatch = a.length ^ b.length;
+  for (let i = 0; i < maxLength; i++) {
+    const aCode = i < a.length ? a.charCodeAt(i) : 0;
+    const bCode = i < b.length ? b.charCodeAt(i) : 0;
+    mismatch |= aCode ^ bCode;
+  }
+  return mismatch === 0;
+}
+
+// src/server/ledvery-cookies.ts
+var SM_LEDVERY_STATE_COOKIE = "sm_ledvery_state";
+var SM_LEDVERY_PKCE_VERIFIER_COOKIE = "sm_ledvery_pkce_verifier";
+var SM_LEDVERY_NONCE_COOKIE = "sm_ledvery_nonce";
+var SM_LEDVERY_ID_TOKEN_COOKIE = "sm_ledvery_id_token";
+var SM_LEDVERY_ACCESS_TOKEN_COOKIE = "sm_ledvery_access_token";
+var FLOW_COOKIE_MAX_AGE = 60 * 10;
+var SESSION_COOKIE_MAX_AGE = 60 * 60;
+function flowCookieOptions() {
+  return {
+    httpOnly: true,
+    secure: process.env.NODE_ENV === "production",
+    sameSite: "lax",
+    path: "/",
+    maxAge: FLOW_COOKIE_MAX_AGE
+  };
+}
+function sessionCookieOptions(maxAge) {
+  return {
+    httpOnly: true,
+    secure: process.env.NODE_ENV === "production",
+    sameSite: "lax",
+    path: "/",
+    maxAge: maxAge ? Math.min(maxAge, SESSION_COOKIE_MAX_AGE) : SESSION_COOKIE_MAX_AGE
+  };
+}
+function setLedveryFlowCookies(response, params) {
+  const opts = flowCookieOptions();
+  setCookie(response, SM_LEDVERY_STATE_COOKIE, params.state, opts);
+  setCookie(response, SM_LEDVERY_PKCE_VERIFIER_COOKIE, params.codeVerifier, opts);
+  setCookie(response, SM_LEDVERY_NONCE_COOKIE, params.nonce, opts);
+}
+function validateAndConsumeLedveryFlowCookies(request, callbackState) {
+  const cookieState = getCookie(request, SM_LEDVERY_STATE_COOKIE);
+  const codeVerifier = getCookie(request, SM_LEDVERY_PKCE_VERIFIER_COOKIE);
+  const nonce = getCookie(request, SM_LEDVERY_NONCE_COOKIE);
+  if (!cookieState) return "Missing Ledvery state cookie - session may have expired";
+  if (!callbackState) return "Missing state parameter in callback";
+  if (!constantTimeEqual(cookieState, callbackState)) return "Ledvery state mismatch - possible CSRF attack";
+  if (!codeVerifier) return "Missing PKCE verifier cookie";
+  if (!nonce) return "Missing nonce cookie";
+  return { codeVerifier, nonce };
+}
+function setLedverySession(response, session, opts) {
+  const cookieOpts = sessionCookieOptions(opts?.cookies?.maxAge);
+  if (opts?.cookies?.domain) cookieOpts.domain = opts.cookies.domain;
+  if (opts?.cookies?.path) cookieOpts.path = opts.cookies.path;
+  if (opts?.cookies?.sameSite) cookieOpts.sameSite = opts.cookies.sameSite;
+  if (opts?.cookies?.secure !== void 0) cookieOpts.secure = opts.cookies.secure;
+  const sessionPayload = JSON.stringify({
+    claims: session.claims,
+    expiresAt: session.expiresAt
+  });
+  setCookie(response, SM_LEDVERY_ID_TOKEN_COOKIE, sessionPayload, cookieOpts);
+  if (opts?.storeAccessToken && session.accessToken) {
+    setCookie(response, SM_LEDVERY_ACCESS_TOKEN_COOKIE, session.accessToken, cookieOpts);
+  }
+}
+function getLedverySession(request) {
+  const raw = getCookie(request, SM_LEDVERY_ID_TOKEN_COOKIE);
+  if (!raw) return null;
+  try {
+    const parsed = JSON.parse(raw);
+    return {
+      idToken: "",
+      // not stored in cookie for size
+      claims: parsed.claims,
+      expiresAt: parsed.expiresAt
+    };
+  } catch {
+    return null;
+  }
+}
+function clearLedverySession(response) {
+  deleteCookie(response, SM_LEDVERY_ID_TOKEN_COOKIE);
+  deleteCookie(response, SM_LEDVERY_ACCESS_TOKEN_COOKIE);
+}
+function clearLedveryFlowCookies(response) {
+  deleteCookie(response, SM_LEDVERY_STATE_COOKIE);
+  deleteCookie(response, SM_LEDVERY_PKCE_VERIFIER_COOKIE);
+  deleteCookie(response, SM_LEDVERY_NONCE_COOKIE);
+}
+function getCookie(request, name) {
+  const header = request.headers.get("cookie") || "";
+  const match = header.match(new RegExp(`(?:^|;\\s*)${name}=([^;]*)`));
+  return match ? decodeURIComponent(match[1]) : void 0;
+}
+function setCookie(response, name, value, opts) {
+  const parts = [
+    `${name}=${encodeURIComponent(value)}`,
+    `Path=${opts.path}`,
+    `Max-Age=${opts.maxAge}`,
+    `SameSite=${opts.sameSite.charAt(0).toUpperCase() + opts.sameSite.slice(1)}`
+  ];
+  if (opts.httpOnly) parts.push("HttpOnly");
+  if (opts.secure) parts.push("Secure");
+  if (opts.domain) parts.push(`Domain=${opts.domain}`);
+  response.headers.append("Set-Cookie", parts.join("; "));
+}
+function deleteCookie(response, name) {
+  response.headers.append("Set-Cookie", `${name}=; Path=/; Max-Age=0; HttpOnly; SameSite=Lax`);
+}
+
+// src/server/redirect.ts
+function normalizeOrigin(origin) {
+  try {
+    const u = new URL(origin);
+    return `${u.protocol}//${u.host}`.toLowerCase();
+  } catch {
+    return null;
+  }
+}
+function isSafeSchemeRelative(input) {
+  return !(input.startsWith("//") || input.startsWith("\\"));
+}
+function validateSafeRedirect(input, opts = {}) {
+  const defaultPath = opts.defaultPath ?? "/";
+  if (!input || typeof input !== "string") return defaultPath;
+  const trimmed = input.trim();
+  if (!trimmed) return defaultPath;
+  if (!isSafeSchemeRelative(trimmed)) return defaultPath;
+  const colon = trimmed.indexOf(":");
+  if (colon > 0 && colon < 15) {
+    const scheme = trimmed.slice(0, colon).toLowerCase();
+    if (/^[a-z][a-z0-9+.-]*$/.test(scheme) && scheme !== "http" && scheme !== "https") {
+      return defaultPath;
+    }
+  }
+  if (trimmed.startsWith("/")) {
+    if (trimmed.length > 1 && trimmed[1] === "\\") return defaultPath;
+    return trimmed;
+  }
+  const allowed = (opts.allowedOrigins ?? []).map(normalizeOrigin).filter((o) => o !== null);
+  try {
+    const parsed = new URL(trimmed);
+    const origin = `${parsed.protocol}//${parsed.host}`.toLowerCase();
+    if (!allowed.includes(origin)) return defaultPath;
+    if (opts.stripSameOriginHost !== false) {
+      return `${parsed.pathname}${parsed.search}${parsed.hash}` || "/";
+    }
+    return trimmed;
+  } catch {
+    return defaultPath;
+  }
+}
+
+// src/server/ledvery.ts
+function createLedveryRoutes(config) {
+  const client = new ledvery.LedveryClient({
+    issuer: config.issuer,
+    clientId: config.clientId,
+    clientSecret: config.clientSecret,
+    redirectUri: config.redirectUri,
+    fetch: config.fetch
+  });
+  const postLoginRedirect = config.postLoginRedirect || "/";
+  const postLogoutRedirect = config.postLogoutRedirect || "/";
+  const defaultScope = config.defaultScope || "openid email profile";
+  async function handleLogin(request) {
+    const url = new URL(request.url);
+    const returnTo = url.searchParams.get("returnTo");
+    const validatedReturnTo = validateSafeRedirect(returnTo, { defaultPath: postLoginRedirect });
+    const authResult = await client.createAuthorizationUrl({
+      scope: defaultScope
+    });
+    const response = new Response(null, {
+      status: 302,
+      headers: { Location: authResult.url }
+    });
+    setLedveryFlowCookies(response, {
+      state: authResult.state,
+      codeVerifier: authResult.codeVerifier,
+      nonce: authResult.nonce
+    });
+    if (validatedReturnTo !== postLoginRedirect) {
+      response.headers.append(
+        "Set-Cookie",
+        `sm_ledvery_return_to=${encodeURIComponent(validatedReturnTo)}; Path=/; Max-Age=600; HttpOnly; SameSite=Lax${process.env.NODE_ENV === "production" ? "; Secure" : ""}`
+      );
+    }
+    return response;
+  }
+  async function handleCallback(request) {
+    const url = new URL(request.url);
+    const code = url.searchParams.get("code");
+    const callbackState = url.searchParams.get("state");
+    if (!code) {
+      const error = url.searchParams.get("error");
+      const errorDesc = url.searchParams.get("error_description");
+      return new Response(
+        JSON.stringify({ error: error || "missing_code", message: errorDesc || "No authorization code in callback" }),
+        { status: 403, headers: { "Content-Type": "application/json" } }
+      );
+    }
+    const flowResult = validateAndConsumeLedveryFlowCookies(request, callbackState);
+    if (typeof flowResult === "string") {
+      return new Response(
+        JSON.stringify({ error: "state_mismatch", message: flowResult }),
+        { status: 403, headers: { "Content-Type": "application/json" } }
+      );
+    }
+    let session;
+    try {
+      session = await client.exchangeCode({
+        code,
+        codeVerifier: flowResult.codeVerifier,
+        receivedState: callbackState,
+        expectedState: getCookieValue(request, "sm_ledvery_state"),
+        expectedNonce: flowResult.nonce
+      });
+    } catch (err) {
+      return new Response(
+        JSON.stringify({ error: "code_exchange_failed", message: err instanceof Error ? err.message : "Code exchange failed" }),
+        { status: 403, headers: { "Content-Type": "application/json" } }
+      );
+    }
+    const returnTo = getCookieValue(request, "sm_ledvery_return_to");
+    const redirectTo = validateSafeRedirect(returnTo, { defaultPath: postLoginRedirect });
+    const response = new Response(null, {
+      status: 302,
+      headers: { Location: redirectTo }
+    });
+    setLedverySession(response, {
+      idToken: session.idToken,
+      accessToken: session.accessToken,
+      claims: session.claims,
+      expiresAt: session.expiresAt.toISOString()
+    }, {
+      storeAccessToken: config.storeAccessToken,
+      cookies: config.cookies
+    });
+    clearLedveryFlowCookies(response);
+    response.headers.append("Set-Cookie", "sm_ledvery_return_to=; Path=/; Max-Age=0; HttpOnly; SameSite=Lax");
+    return response;
+  }
+  function handleSession(request) {
+    const session = getLedverySession(request);
+    if (!session) {
+      return new Response(JSON.stringify({ session: null }), {
+        status: 200,
+        headers: { "Content-Type": "application/json" }
+      });
+    }
+    const expiresAt = new Date(session.expiresAt);
+    if (expiresAt <= /* @__PURE__ */ new Date()) {
+      return new Response(JSON.stringify({ session: null }), {
+        status: 200,
+        headers: { "Content-Type": "application/json" }
+      });
+    }
+    return new Response(
+      JSON.stringify({
+        session: {
+          sub: session.claims.sub,
+          email: session.claims.email,
+          email_verified: session.claims.email_verified,
+          name: session.claims.name,
+          idp: session.claims.idp,
+          expiresAt: session.expiresAt
+        }
+      }),
+      { status: 200, headers: { "Content-Type": "application/json" } }
+    );
+  }
+  function handleLogout(_request) {
+    if (config.gatewayUrl) {
+      const rpLogoutUrl = `${config.gatewayUrl}/v1/auth/oauth/ledvery/logout?post_logout_redirect_uri=${encodeURIComponent(postLogoutRedirect)}`;
+      const response2 = new Response(null, {
+        status: 302,
+        headers: { Location: rpLogoutUrl }
+      });
+      clearLedverySession(response2);
+      return response2;
+    }
+    const response = new Response(null, {
+      status: 302,
+      headers: { Location: postLogoutRedirect }
+    });
+    clearLedverySession(response);
+    return response;
+  }
+  async function handler(request, context) {
+    const params = await context.params;
+    const action = params.action?.[0] || "";
+    switch (action) {
+      case "login":
+        return handleLogin(request);
+      case "callback":
+        return handleCallback(request);
+      case "session":
+        return handleSession(request);
+      case "logout":
+        return handleLogout();
+      default:
+        return new Response(
+          JSON.stringify({ error: "not_found", message: `Unknown Ledvery route: ${action}` }),
+          { status: 404, headers: { "Content-Type": "application/json" } }
+        );
+    }
+  }
+  return {
+    GET: handler,
+    POST: handler
+  };
+}
+function getCookieValue(request, name) {
+  const header = request.headers.get("cookie") || "";
+  const match = header.match(new RegExp(`(?:^|;\\s*)${name}=([^;]*)`));
+  return match ? decodeURIComponent(match[1]) : void 0;
+}
+
+exports.createLedveryRoutes = createLedveryRoutes;
+exports.getLedverySession = getLedverySession;

package/dist/server/ledvery.mjs

@@ -0,0 +1,328 @@
+import { LedveryClient } from '@scalemule/ledvery';
+
+// src/server/ledvery.ts
+
+// src/server/timing.ts
+function constantTimeEqual(a, b) {
+  const maxLength = Math.max(a.length, b.length);
+  let mismatch = a.length ^ b.length;
+  for (let i = 0; i < maxLength; i++) {
+    const aCode = i < a.length ? a.charCodeAt(i) : 0;
+    const bCode = i < b.length ? b.charCodeAt(i) : 0;
+    mismatch |= aCode ^ bCode;
+  }
+  return mismatch === 0;
+}
+
+// src/server/ledvery-cookies.ts
+var SM_LEDVERY_STATE_COOKIE = "sm_ledvery_state";
+var SM_LEDVERY_PKCE_VERIFIER_COOKIE = "sm_ledvery_pkce_verifier";
+var SM_LEDVERY_NONCE_COOKIE = "sm_ledvery_nonce";
+var SM_LEDVERY_ID_TOKEN_COOKIE = "sm_ledvery_id_token";
+var SM_LEDVERY_ACCESS_TOKEN_COOKIE = "sm_ledvery_access_token";
+var FLOW_COOKIE_MAX_AGE = 60 * 10;
+var SESSION_COOKIE_MAX_AGE = 60 * 60;
+function flowCookieOptions() {
+  return {
+    httpOnly: true,
+    secure: process.env.NODE_ENV === "production",
+    sameSite: "lax",
+    path: "/",
+    maxAge: FLOW_COOKIE_MAX_AGE
+  };
+}
+function sessionCookieOptions(maxAge) {
+  return {
+    httpOnly: true,
+    secure: process.env.NODE_ENV === "production",
+    sameSite: "lax",
+    path: "/",
+    maxAge: maxAge ? Math.min(maxAge, SESSION_COOKIE_MAX_AGE) : SESSION_COOKIE_MAX_AGE
+  };
+}
+function setLedveryFlowCookies(response, params) {
+  const opts = flowCookieOptions();
+  setCookie(response, SM_LEDVERY_STATE_COOKIE, params.state, opts);
+  setCookie(response, SM_LEDVERY_PKCE_VERIFIER_COOKIE, params.codeVerifier, opts);
+  setCookie(response, SM_LEDVERY_NONCE_COOKIE, params.nonce, opts);
+}
+function validateAndConsumeLedveryFlowCookies(request, callbackState) {
+  const cookieState = getCookie(request, SM_LEDVERY_STATE_COOKIE);
+  const codeVerifier = getCookie(request, SM_LEDVERY_PKCE_VERIFIER_COOKIE);
+  const nonce = getCookie(request, SM_LEDVERY_NONCE_COOKIE);
+  if (!cookieState) return "Missing Ledvery state cookie - session may have expired";
+  if (!callbackState) return "Missing state parameter in callback";
+  if (!constantTimeEqual(cookieState, callbackState)) return "Ledvery state mismatch - possible CSRF attack";
+  if (!codeVerifier) return "Missing PKCE verifier cookie";
+  if (!nonce) return "Missing nonce cookie";
+  return { codeVerifier, nonce };
+}
+function setLedverySession(response, session, opts) {
+  const cookieOpts = sessionCookieOptions(opts?.cookies?.maxAge);
+  if (opts?.cookies?.domain) cookieOpts.domain = opts.cookies.domain;
+  if (opts?.cookies?.path) cookieOpts.path = opts.cookies.path;
+  if (opts?.cookies?.sameSite) cookieOpts.sameSite = opts.cookies.sameSite;
+  if (opts?.cookies?.secure !== void 0) cookieOpts.secure = opts.cookies.secure;
+  const sessionPayload = JSON.stringify({
+    claims: session.claims,
+    expiresAt: session.expiresAt
+  });
+  setCookie(response, SM_LEDVERY_ID_TOKEN_COOKIE, sessionPayload, cookieOpts);
+  if (opts?.storeAccessToken && session.accessToken) {
+    setCookie(response, SM_LEDVERY_ACCESS_TOKEN_COOKIE, session.accessToken, cookieOpts);
+  }
+}
+function getLedverySession(request) {
+  const raw = getCookie(request, SM_LEDVERY_ID_TOKEN_COOKIE);
+  if (!raw) return null;
+  try {
+    const parsed = JSON.parse(raw);
+    return {
+      idToken: "",
+      // not stored in cookie for size
+      claims: parsed.claims,
+      expiresAt: parsed.expiresAt
+    };
+  } catch {
+    return null;
+  }
+}
+function clearLedverySession(response) {
+  deleteCookie(response, SM_LEDVERY_ID_TOKEN_COOKIE);
+  deleteCookie(response, SM_LEDVERY_ACCESS_TOKEN_COOKIE);
+}
+function clearLedveryFlowCookies(response) {
+  deleteCookie(response, SM_LEDVERY_STATE_COOKIE);
+  deleteCookie(response, SM_LEDVERY_PKCE_VERIFIER_COOKIE);
+  deleteCookie(response, SM_LEDVERY_NONCE_COOKIE);
+}
+function getCookie(request, name) {
+  const header = request.headers.get("cookie") || "";
+  const match = header.match(new RegExp(`(?:^|;\\s*)${name}=([^;]*)`));
+  return match ? decodeURIComponent(match[1]) : void 0;
+}
+function setCookie(response, name, value, opts) {
+  const parts = [
+    `${name}=${encodeURIComponent(value)}`,
+    `Path=${opts.path}`,
+    `Max-Age=${opts.maxAge}`,
+    `SameSite=${opts.sameSite.charAt(0).toUpperCase() + opts.sameSite.slice(1)}`
+  ];
+  if (opts.httpOnly) parts.push("HttpOnly");
+  if (opts.secure) parts.push("Secure");
+  if (opts.domain) parts.push(`Domain=${opts.domain}`);
+  response.headers.append("Set-Cookie", parts.join("; "));
+}
+function deleteCookie(response, name) {
+  response.headers.append("Set-Cookie", `${name}=; Path=/; Max-Age=0; HttpOnly; SameSite=Lax`);
+}
+
+// src/server/redirect.ts
+function normalizeOrigin(origin) {
+  try {
+    const u = new URL(origin);
+    return `${u.protocol}//${u.host}`.toLowerCase();
+  } catch {
+    return null;
+  }
+}
+function isSafeSchemeRelative(input) {
+  return !(input.startsWith("//") || input.startsWith("\\"));
+}
+function validateSafeRedirect(input, opts = {}) {
+  const defaultPath = opts.defaultPath ?? "/";
+  if (!input || typeof input !== "string") return defaultPath;
+  const trimmed = input.trim();
+  if (!trimmed) return defaultPath;
+  if (!isSafeSchemeRelative(trimmed)) return defaultPath;
+  const colon = trimmed.indexOf(":");
+  if (colon > 0 && colon < 15) {
+    const scheme = trimmed.slice(0, colon).toLowerCase();
+    if (/^[a-z][a-z0-9+.-]*$/.test(scheme) && scheme !== "http" && scheme !== "https") {
+      return defaultPath;
+    }
+  }
+  if (trimmed.startsWith("/")) {
+    if (trimmed.length > 1 && trimmed[1] === "\\") return defaultPath;
+    return trimmed;
+  }
+  const allowed = (opts.allowedOrigins ?? []).map(normalizeOrigin).filter((o) => o !== null);
+  try {
+    const parsed = new URL(trimmed);
+    const origin = `${parsed.protocol}//${parsed.host}`.toLowerCase();
+    if (!allowed.includes(origin)) return defaultPath;
+    if (opts.stripSameOriginHost !== false) {
+      return `${parsed.pathname}${parsed.search}${parsed.hash}` || "/";
+    }
+    return trimmed;
+  } catch {
+    return defaultPath;
+  }
+}
+
+// src/server/ledvery.ts
+function createLedveryRoutes(config) {
+  const client = new LedveryClient({
+    issuer: config.issuer,
+    clientId: config.clientId,
+    clientSecret: config.clientSecret,
+    redirectUri: config.redirectUri,
+    fetch: config.fetch
+  });
+  const postLoginRedirect = config.postLoginRedirect || "/";
+  const postLogoutRedirect = config.postLogoutRedirect || "/";
+  const defaultScope = config.defaultScope || "openid email profile";
+  async function handleLogin(request) {
+    const url = new URL(request.url);
+    const returnTo = url.searchParams.get("returnTo");
+    const validatedReturnTo = validateSafeRedirect(returnTo, { defaultPath: postLoginRedirect });
+    const authResult = await client.createAuthorizationUrl({
+      scope: defaultScope
+    });
+    const response = new Response(null, {
+      status: 302,
+      headers: { Location: authResult.url }
+    });
+    setLedveryFlowCookies(response, {
+      state: authResult.state,
+      codeVerifier: authResult.codeVerifier,
+      nonce: authResult.nonce
+    });
+    if (validatedReturnTo !== postLoginRedirect) {
+      response.headers.append(
+        "Set-Cookie",
+        `sm_ledvery_return_to=${encodeURIComponent(validatedReturnTo)}; Path=/; Max-Age=600; HttpOnly; SameSite=Lax${process.env.NODE_ENV === "production" ? "; Secure" : ""}`
+      );
+    }
+    return response;
+  }
+  async function handleCallback(request) {
+    const url = new URL(request.url);
+    const code = url.searchParams.get("code");
+    const callbackState = url.searchParams.get("state");
+    if (!code) {
+      const error = url.searchParams.get("error");
+      const errorDesc = url.searchParams.get("error_description");
+      return new Response(
+        JSON.stringify({ error: error || "missing_code", message: errorDesc || "No authorization code in callback" }),
+        { status: 403, headers: { "Content-Type": "application/json" } }
+      );
+    }
+    const flowResult = validateAndConsumeLedveryFlowCookies(request, callbackState);
+    if (typeof flowResult === "string") {
+      return new Response(
+        JSON.stringify({ error: "state_mismatch", message: flowResult }),
+        { status: 403, headers: { "Content-Type": "application/json" } }
+      );
+    }
+    let session;
+    try {
+      session = await client.exchangeCode({
+        code,
+        codeVerifier: flowResult.codeVerifier,
+        receivedState: callbackState,
+        expectedState: getCookieValue(request, "sm_ledvery_state"),
+        expectedNonce: flowResult.nonce
+      });
+    } catch (err) {
+      return new Response(
+        JSON.stringify({ error: "code_exchange_failed", message: err instanceof Error ? err.message : "Code exchange failed" }),
+        { status: 403, headers: { "Content-Type": "application/json" } }
+      );
+    }
+    const returnTo = getCookieValue(request, "sm_ledvery_return_to");
+    const redirectTo = validateSafeRedirect(returnTo, { defaultPath: postLoginRedirect });
+    const response = new Response(null, {
+      status: 302,
+      headers: { Location: redirectTo }
+    });
+    setLedverySession(response, {
+      idToken: session.idToken,
+      accessToken: session.accessToken,
+      claims: session.claims,
+      expiresAt: session.expiresAt.toISOString()
+    }, {
+      storeAccessToken: config.storeAccessToken,
+      cookies: config.cookies
+    });
+    clearLedveryFlowCookies(response);
+    response.headers.append("Set-Cookie", "sm_ledvery_return_to=; Path=/; Max-Age=0; HttpOnly; SameSite=Lax");
+    return response;
+  }
+  function handleSession(request) {
+    const session = getLedverySession(request);
+    if (!session) {
+      return new Response(JSON.stringify({ session: null }), {
+        status: 200,
+        headers: { "Content-Type": "application/json" }
+      });
+    }
+    const expiresAt = new Date(session.expiresAt);
+    if (expiresAt <= /* @__PURE__ */ new Date()) {
+      return new Response(JSON.stringify({ session: null }), {
+        status: 200,
+        headers: { "Content-Type": "application/json" }
+      });
+    }
+    return new Response(
+      JSON.stringify({
+        session: {
+          sub: session.claims.sub,
+          email: session.claims.email,
+          email_verified: session.claims.email_verified,
+          name: session.claims.name,
+          idp: session.claims.idp,
+          expiresAt: session.expiresAt
+        }
+      }),
+      { status: 200, headers: { "Content-Type": "application/json" } }
+    );
+  }
+  function handleLogout(_request) {
+    if (config.gatewayUrl) {
+      const rpLogoutUrl = `${config.gatewayUrl}/v1/auth/oauth/ledvery/logout?post_logout_redirect_uri=${encodeURIComponent(postLogoutRedirect)}`;
+      const response2 = new Response(null, {
+        status: 302,
+        headers: { Location: rpLogoutUrl }
+      });
+      clearLedverySession(response2);
+      return response2;
+    }
+    const response = new Response(null, {
+      status: 302,
+      headers: { Location: postLogoutRedirect }
+    });
+    clearLedverySession(response);
+    return response;
+  }
+  async function handler(request, context) {
+    const params = await context.params;
+    const action = params.action?.[0] || "";
+    switch (action) {
+      case "login":
+        return handleLogin(request);
+      case "callback":
+        return handleCallback(request);
+      case "session":
+        return handleSession(request);
+      case "logout":
+        return handleLogout();
+      default:
+        return new Response(
+          JSON.stringify({ error: "not_found", message: `Unknown Ledvery route: ${action}` }),
+          { status: 404, headers: { "Content-Type": "application/json" } }
+        );
+    }
+  }
+  return {
+    GET: handler,
+    POST: handler
+  };
+}
+function getCookieValue(request, name) {
+  const header = request.headers.get("cookie") || "";
+  const match = header.match(new RegExp(`(?:^|;\\s*)${name}=([^;]*)`));
+  return match ? decodeURIComponent(match[1]) : void 0;
+}
+
+export { createLedveryRoutes, getLedverySession };

package/dist/server/webhook-handler.d.mts

@@ -1,3 +1,3 @@
-export { g as createWebhookHandler } from '../webhook-handler-BqzCYRNJ.mjs';
+export { g as createWebhookHandler } from '../webhook-handler-CUp_A0_p.mjs';
 import '@scalemule/money';
-import '../index-BIIUrnPr.mjs';
+import '../index-DTWyUcyd.mjs';

package/dist/server/webhook-handler.d.ts

@@ -1,3 +1,3 @@
-export { g as createWebhookHandler } from '../webhook-handler-BjFbqZuq.js';
+export { g as createWebhookHandler } from '../webhook-handler-C07AK4QB.js';
 import '@scalemule/money';
-import '../index-BIIUrnPr.js';
+import '../index-DTWyUcyd.js';

package/dist/testing.d.mts

@@ -1,6 +1,6 @@
 import * as react_jsx_runtime from 'react/jsx-runtime';
 import { ReactNode } from 'react';
-import { U as User, A as ApiError, a9 as StorageFile } from './index-BIIUrnPr.mjs';
+import { U as User, A as ApiError, a9 as StorageFile } from './index-DTWyUcyd.mjs';
 
 interface MockUserOptions {
     id?: string;

package/dist/testing.d.ts

@@ -1,6 +1,6 @@
 import * as react_jsx_runtime from 'react/jsx-runtime';
 import { ReactNode } from 'react';
-import { U as User, A as ApiError, a9 as StorageFile } from './index-BIIUrnPr.js';
+import { U as User, A as ApiError, a9 as StorageFile } from './index-DTWyUcyd.js';
 
 interface MockUserOptions {
     id?: string;