@seamless-auth/core 0.9.0 → 0.11.0

package/dist/handlers/internalMetrics.d.ts

@@ -1,3 +1,5 @@
+import { type QueryInput } from "../proxyRequest.js";
+import type { ResultFailure } from "../result.js";
 type BaseOpts = {
     authServerUrl: string;
     authorization?: string;
@@ -5,12 +7,11 @@ type BaseOpts = {
     forwardedClientIp?: string;
 };
 type WithQuery = BaseOpts & {
-    query?: Record<string, string | number | boolean | undefined>;
+    query?: QueryInput;
 };
-type Result = {
+type Result = ResultFailure & {
     status: number;
     body?: any;
-    error?: string;
 };
 export declare const getAuthEventSummaryHandler: (opts: WithQuery) => Promise<Result>;
 export declare const getAuthEventTimeseriesHandler: (opts: WithQuery) => Promise<Result>;

package/dist/handlers/internalMetrics.d.ts.map

@@ -1 +1 @@
-{"version":3,"file":"internalMetrics.d.ts","sourceRoot":"","sources":["../../src/handlers/internalMetrics.ts"],"names":[],"mappings":"AAEA,KAAK,QAAQ,GAAG;IACd,aAAa,EAAE,MAAM,CAAC;IACtB,aAAa,CAAC,EAAE,MAAM,CAAC;IACvB,oBAAoB,CAAC,EAAE,MAAM,CAAC;IAC9B,iBAAiB,CAAC,EAAE,MAAM,CAAC;CAC5B,CAAC;AAEF,KAAK,SAAS,GAAG,QAAQ,GAAG;IAC1B,KAAK,CAAC,EAAE,MAAM,CAAC,MAAM,EAAE,MAAM,GAAG,MAAM,GAAG,OAAO,GAAG,SAAS,CAAC,CAAC;CAC/D,CAAC;AAEF,KAAK,MAAM,GAAG;IACZ,MAAM,EAAE,MAAM,CAAC;IACf,IAAI,CAAC,EAAE,GAAG,CAAC;IACX,KAAK,CAAC,EAAE,MAAM,CAAC;CAChB,CAAC;AAuCF,eAAO,MAAM,0BAA0B,GAAI,MAAM,SAAS,oBACd,CAAC;AAE7C,eAAO,MAAM,6BAA6B,GAAI,MAAM,SAAS,oBACd,CAAC;AAEhD,eAAO,MAAM,oBAAoB,GAAI,MAAM,QAAQ,oBACH,CAAC;AAEjD,eAAO,MAAM,2BAA2B,GAAI,MAAM,QAAQ,oBACf,CAAC;AAE5C,eAAO,MAAM,0BAA0B,GAAI,MAAM,QAAQ,oBACf,CAAC;AAE3C,eAAO,MAAM,6BAA6B,GAAI,MAAM,SAAS,oBACjB,CAAC"}
+{"version":3,"file":"internalMetrics.d.ts","sourceRoot":"","sources":["../../src/handlers/internalMetrics.ts"],"names":[],"mappings":"AACA,OAAO,EAAoB,KAAK,UAAU,EAAE,MAAM,oBAAoB,CAAC;AACvE,OAAO,KAAK,EAAE,aAAa,EAAE,MAAM,cAAc,CAAC;AAGlD,KAAK,QAAQ,GAAG;IACd,aAAa,EAAE,MAAM,CAAC;IACtB,aAAa,CAAC,EAAE,MAAM,CAAC;IACvB,oBAAoB,CAAC,EAAE,MAAM,CAAC;IAC9B,iBAAiB,CAAC,EAAE,MAAM,CAAC;CAC5B,CAAC;AAEF,KAAK,SAAS,GAAG,QAAQ,GAAG;IAC1B,KAAK,CAAC,EAAE,UAAU,CAAC;CACpB,CAAC;AAEF,KAAK,MAAM,GAAG,aAAa,GAAG;IAC5B,MAAM,EAAE,MAAM,CAAC;IACf,IAAI,CAAC,EAAE,GAAG,CAAC;CACZ,CAAC;AA4BF,eAAO,MAAM,0BAA0B,GAAI,MAAM,SAAS,oBACd,CAAC;AAE7C,eAAO,MAAM,6BAA6B,GAAI,MAAM,SAAS,oBACd,CAAC;AAEhD,eAAO,MAAM,oBAAoB,GAAI,MAAM,QAAQ,oBACH,CAAC;AAEjD,eAAO,MAAM,2BAA2B,GAAI,MAAM,QAAQ,oBACf,CAAC;AAE5C,eAAO,MAAM,0BAA0B,GAAI,MAAM,QAAQ,oBACf,CAAC;AAE3C,eAAO,MAAM,6BAA6B,GAAI,MAAM,SAAS,oBACjB,CAAC"}

package/dist/handlers/internalMetrics.js

@@ -1,14 +1,8 @@
 import { authFetch } from "../authFetch.js";
-function buildUrl(base, query) {
-    if (!query)
-        return base;
-    const qs = new URLSearchParams(Object.entries(query)
-        .filter(([, v]) => v !== undefined && v !== null)
-        .map(([k, v]) => [k, String(v)])).toString();
-    return qs ? `${base}?${qs}` : base;
-}
+import { buildUpstreamUrl } from "../proxyRequest.js";
+import { readUpstreamFailure } from "../upstreamError.js";
 async function get(path, opts) {
-    const up = await authFetch(buildUrl(`${opts.authServerUrl}${path}`, opts.query), {
+    const up = await authFetch(buildUpstreamUrl(opts.authServerUrl, path, opts.query), {
         method: "GET",
         authorization: opts.authorization,
         serviceAuthorization: opts.serviceAuthorization,
@@ -18,7 +12,7 @@ async function get(path, opts) {
     if (!up.ok) {
         return {
             status: up.status,
-            error: data?.error || "internal_request_failed",
+            ...readUpstreamFailure(data, "internal_request_failed"),
         };
     }
     return {

package/dist/handlers/internalMetrics.js.map

@@ -1 +1 @@
-{"version":3,"file":"internalMetrics.js","sourceRoot":"","sources":["../../src/handlers/internalMetrics.ts"],"names":[],"mappings":"AAAA,OAAO,EAAE,SAAS,EAAE,MAAM,iBAAiB,CAAC;AAmB5C,SAAS,QAAQ,CAAC,IAAY,EAAE,KAA0B;IACxD,IAAI,CAAC,KAAK;QAAE,OAAO,IAAI,CAAC;IACxB,MAAM,EAAE,GAAG,IAAI,eAAe,CAC5B,MAAM,CAAC,OAAO,CAAC,KAAK,CAAC;SAClB,MAAM,CAAC,CAAC,CAAC,EAAE,CAAC,CAAC,EAAE,EAAE,CAAC,CAAC,KAAK,SAAS,IAAI,CAAC,KAAK,IAAI,CAAC;SAChD,GAAG,CAAC,CAAC,CAAC,CAAC,EAAE,CAAC,CAAC,EAAE,EAAE,CAAC,CAAC,CAAC,EAAE,MAAM,CAAC,CAAC,CAAC,CAAC,CAAC,CACnC,CAAC,QAAQ,EAAE,CAAC;IAEb,OAAO,EAAE,CAAC,CAAC,CAAC,GAAG,IAAI,IAAI,EAAE,EAAE,CAAC,CAAC,CAAC,IAAI,CAAC;AACrC,CAAC;AAED,KAAK,UAAU,GAAG,CAAC,IAAY,EAAE,IAAe;IAC9C,MAAM,EAAE,GAAG,MAAM,SAAS,CACxB,QAAQ,CAAC,GAAG,IAAI,CAAC,aAAa,GAAG,IAAI,EAAE,EAAE,IAAI,CAAC,KAAK,CAAC,EACpD;QACE,MAAM,EAAE,KAAK;QACb,aAAa,EAAE,IAAI,CAAC,aAAa;QACjC,oBAAoB,EAAE,IAAI,CAAC,oBAAoB;QAC/C,iBAAiB,EAAE,IAAI,CAAC,iBAAiB;KAC1C,CACF,CAAC;IAEF,MAAM,IAAI,GAAG,MAAM,EAAE,CAAC,IAAI,EAAE,CAAC;IAE7B,IAAI,CAAC,EAAE,CAAC,EAAE,EAAE,CAAC;QACX,OAAO;YACL,MAAM,EAAE,EAAE,CAAC,MAAM;YACjB,KAAK,EAAE,IAAI,EAAE,KAAK,IAAI,yBAAyB;SAChD,CAAC;IACJ,CAAC;IAED,OAAO;QACL,MAAM,EAAE,EAAE,CAAC,MAAM;QACjB,IAAI,EAAE,IAAI;KACX,CAAC;AACJ,CAAC;AAED,MAAM,CAAC,MAAM,0BAA0B,GAAG,CAAC,IAAe,EAAE,EAAE,CAC5D,GAAG,CAAC,+BAA+B,EAAE,IAAI,CAAC,CAAC;AAE7C,MAAM,CAAC,MAAM,6BAA6B,GAAG,CAAC,IAAe,EAAE,EAAE,CAC/D,GAAG,CAAC,kCAAkC,EAAE,IAAI,CAAC,CAAC;AAEhD,MAAM,CAAC,MAAM,oBAAoB,GAAG,CAAC,IAAc,EAAE,EAAE,CACrD,GAAG,CAAC,mCAAmC,EAAE,IAAI,CAAC,CAAC;AAEjD,MAAM,CAAC,MAAM,2BAA2B,GAAG,CAAC,IAAc,EAAE,EAAE,CAC5D,GAAG,CAAC,8BAA8B,EAAE,IAAI,CAAC,CAAC;AAE5C,MAAM,CAAC,MAAM,0BAA0B,GAAG,CAAC,IAAc,EAAE,EAAE,CAC3D,GAAG,CAAC,6BAA6B,EAAE,IAAI,CAAC,CAAC;AAE3C,MAAM,CAAC,MAAM,6BAA6B,GAAG,CAAC,IAAe,EAAE,EAAE,CAC/D,GAAG,CAAC,+BAA+B,EAAE,IAAI,CAAC,CAAC"}
+{"version":3,"file":"internalMetrics.js","sourceRoot":"","sources":["../../src/handlers/internalMetrics.ts"],"names":[],"mappings":"AAAA,OAAO,EAAE,SAAS,EAAE,MAAM,iBAAiB,CAAC;AAC5C,OAAO,EAAE,gBAAgB,EAAmB,MAAM,oBAAoB,CAAC;AAEvE,OAAO,EAAE,mBAAmB,EAAE,MAAM,qBAAqB,CAAC;AAkB1D,KAAK,UAAU,GAAG,CAAC,IAAY,EAAE,IAAe;IAC9C,MAAM,EAAE,GAAG,MAAM,SAAS,CACxB,gBAAgB,CAAC,IAAI,CAAC,aAAa,EAAE,IAAI,EAAE,IAAI,CAAC,KAAK,CAAC,EACtD;QACE,MAAM,EAAE,KAAK;QACb,aAAa,EAAE,IAAI,CAAC,aAAa;QACjC,oBAAoB,EAAE,IAAI,CAAC,oBAAoB;QAC/C,iBAAiB,EAAE,IAAI,CAAC,iBAAiB;KAC1C,CACF,CAAC;IAEF,MAAM,IAAI,GAAG,MAAM,EAAE,CAAC,IAAI,EAAE,CAAC;IAE7B,IAAI,CAAC,EAAE,CAAC,EAAE,EAAE,CAAC;QACX,OAAO;YACL,MAAM,EAAE,EAAE,CAAC,MAAM;YACjB,GAAG,mBAAmB,CAAC,IAAI,EAAE,yBAAyB,CAAC;SACxD,CAAC;IACJ,CAAC;IAED,OAAO;QACL,MAAM,EAAE,EAAE,CAAC,MAAM;QACjB,IAAI,EAAE,IAAI;KACX,CAAC;AACJ,CAAC;AAED,MAAM,CAAC,MAAM,0BAA0B,GAAG,CAAC,IAAe,EAAE,EAAE,CAC5D,GAAG,CAAC,+BAA+B,EAAE,IAAI,CAAC,CAAC;AAE7C,MAAM,CAAC,MAAM,6BAA6B,GAAG,CAAC,IAAe,EAAE,EAAE,CAC/D,GAAG,CAAC,kCAAkC,EAAE,IAAI,CAAC,CAAC;AAEhD,MAAM,CAAC,MAAM,oBAAoB,GAAG,CAAC,IAAc,EAAE,EAAE,CACrD,GAAG,CAAC,mCAAmC,EAAE,IAAI,CAAC,CAAC;AAEjD,MAAM,CAAC,MAAM,2BAA2B,GAAG,CAAC,IAAc,EAAE,EAAE,CAC5D,GAAG,CAAC,8BAA8B,EAAE,IAAI,CAAC,CAAC;AAE5C,MAAM,CAAC,MAAM,0BAA0B,GAAG,CAAC,IAAc,EAAE,EAAE,CAC3D,GAAG,CAAC,6BAA6B,EAAE,IAAI,CAAC,CAAC;AAE3C,MAAM,CAAC,MAAM,6BAA6B,GAAG,CAAC,IAAe,EAAE,EAAE,CAC/D,GAAG,CAAC,+BAA+B,EAAE,IAAI,CAAC,CAAC"}

package/dist/handlers/login.d.ts

@@ -1,3 +1,4 @@
+import type { ResultFailure } from "../result.js";
 import type { CookiePayload } from "../ensureCookies.js";
 export interface LoginInput {
     body: unknown;
@@ -10,14 +11,13 @@ export interface LoginOptions {
     serviceAuthorization?: string;
     forwardedClientIp?: string;
 }
-export interface LoginResult {
+export interface LoginResult extends ResultFailure {
     status: number;
     body?: {
         message?: string;
         identifierType?: string;
         loginMethods?: string[];
     };
-    error?: unknown;
     setCookies?: {
         name: string;
         value: CookiePayload;

package/dist/handlers/login.d.ts.map

@@ -1 +1 @@
-{"version":3,"file":"login.d.ts","sourceRoot":"","sources":["../../src/handlers/login.ts"],"names":[],"mappings":"AACA,OAAO,KAAK,EAAE,aAAa,EAAE,MAAM,qBAAqB,CAAC;AAGzD,MAAM,WAAW,UAAU;IACzB,IAAI,EAAE,OAAO,CAAC;CACf;AAED,MAAM,WAAW,YAAY;IAC3B,aAAa,EAAE,MAAM,CAAC;IACtB,QAAQ,EAAE,MAAM,CAAC;IACjB,YAAY,CAAC,EAAE,MAAM,CAAC;IACtB,iBAAiB,EAAE,MAAM,CAAC;IAC1B,oBAAoB,CAAC,EAAE,MAAM,CAAC;IAC9B,iBAAiB,CAAC,EAAE,MAAM,CAAC;CAC5B;AAED,MAAM,WAAW,WAAW;IAC1B,MAAM,EAAE,MAAM,CAAC;IACf,IAAI,CAAC,EAAE;QACL,OAAO,CAAC,EAAE,MAAM,CAAC;QACjB,cAAc,CAAC,EAAE,MAAM,CAAC;QACxB,YAAY,CAAC,EAAE,MAAM,EAAE,CAAC;KACzB,CAAC;IACF,KAAK,CAAC,EAAE,OAAO,CAAC;IAChB,UAAU,CAAC,EAAE;QACX,IAAI,EAAE,MAAM,CAAC;QACb,KAAK,EAAE,aAAa,CAAC;QACrB,GAAG,EAAE,MAAM,CAAC;QACZ,MAAM,CAAC,EAAE,MAAM,CAAC;KACjB,EAAE,CAAC;CACL;AAED,wBAAsB,YAAY,CAChC,KAAK,EAAE,UAAU,EACjB,IAAI,EAAE,YAAY,GACjB,OAAO,CAAC,WAAW,CAAC,CAyDtB"}
+{"version":3,"file":"login.d.ts","sourceRoot":"","sources":["../../src/handlers/login.ts"],"names":[],"mappings":"AAEA,OAAO,KAAK,EAAE,aAAa,EAAE,MAAM,cAAc,CAAC;AAClD,OAAO,KAAK,EAAE,aAAa,EAAE,MAAM,qBAAqB,CAAC;AAGzD,MAAM,WAAW,UAAU;IACzB,IAAI,EAAE,OAAO,CAAC;CACf;AAED,MAAM,WAAW,YAAY;IAC3B,aAAa,EAAE,MAAM,CAAC;IACtB,QAAQ,EAAE,MAAM,CAAC;IACjB,YAAY,CAAC,EAAE,MAAM,CAAC;IACtB,iBAAiB,EAAE,MAAM,CAAC;IAC1B,oBAAoB,CAAC,EAAE,MAAM,CAAC;IAC9B,iBAAiB,CAAC,EAAE,MAAM,CAAC;CAC5B;AAED,MAAM,WAAW,WAAY,SAAQ,aAAa;IAChD,MAAM,EAAE,MAAM,CAAC;IACf,IAAI,CAAC,EAAE;QACL,OAAO,CAAC,EAAE,MAAM,CAAC;QACjB,cAAc,CAAC,EAAE,MAAM,CAAC;QACxB,YAAY,CAAC,EAAE,MAAM,EAAE,CAAC;KACzB,CAAC;IACF,UAAU,CAAC,EAAE;QACX,IAAI,EAAE,MAAM,CAAC;QACb,KAAK,EAAE,aAAa,CAAC;QACrB,GAAG,EAAE,MAAM,CAAC;QACZ,MAAM,CAAC,EAAE,MAAM,CAAC;KACjB,EAAE,CAAC;CACL;AAED,wBAAsB,YAAY,CAChC,KAAK,EAAE,UAAU,EACjB,IAAI,EAAE,YAAY,GACjB,OAAO,CAAC,WAAW,CAAC,CA+CtB"}

package/dist/handlers/login.js

@@ -1,5 +1,6 @@
 import { authFetch } from "../authFetch.js";
-import { verifySignedAuthResponse } from "../verifySignedAuthResponse.js";
+import { readPassthroughFailure } from "../upstreamError.js";
+import { verifyUpstreamSession } from "../upstreamSession.js";
 export async function loginHandler(input, opts) {
     const up = await authFetch(`${opts.authServerUrl}/login`, {
         method: "POST",
@@ -11,16 +12,12 @@ export async function loginHandler(input, opts) {
     if (!up.ok) {
         return {
             status: up.status,
-            error: data,
+            ...readPassthroughFailure(data),
         };
     }
-    const verified = await verifySignedAuthResponse(data.token, opts.authServerUrl, opts.audience);
-    if (!verified) {
-        throw new Error("Invalid signed response from Auth Server");
-    }
-    if (verified.sub !== data.sub) {
-        throw new Error("Signature mismatch with data payload");
-    }
+    // Login issues only the pre-auth cookie, so it verifies the response without
+    // building session cookies from it.
+    await verifyUpstreamSession(data, opts.authServerUrl, opts.audience);
     const body = {
         ...(typeof data.message === "string" ? { message: data.message } : {}),
         ...(typeof data.identifierType === "string"

package/dist/handlers/login.js.map

@@ -1 +1 @@
-{"version":3,"file":"login.js","sourceRoot":"","sources":["../../src/handlers/login.ts"],"names":[],"mappings":"AAAA,OAAO,EAAE,SAAS,EAAE,MAAM,iBAAiB,CAAC;AAE5C,OAAO,EAAE,wBAAwB,EAAE,MAAM,gCAAgC,CAAC;AA+B1E,MAAM,CAAC,KAAK,UAAU,YAAY,CAChC,KAAiB,EACjB,IAAkB;IAElB,MAAM,EAAE,GAAG,MAAM,SAAS,CAAC,GAAG,IAAI,CAAC,aAAa,QAAQ,EAAE;QACxD,MAAM,EAAE,MAAM;QACd,IAAI,EAAE,KAAK,CAAC,IAAI;QAChB,oBAAoB,EAAE,IAAI,CAAC,oBAAoB;QAC/C,iBAAiB,EAAE,IAAI,CAAC,iBAAiB;KAC1C,CAAC,CAAC;IAEH,MAAM,IAAI,GAAG,MAAM,EAAE,CAAC,IAAI,EAAE,CAAC;IAE7B,IAAI,CAAC,EAAE,CAAC,EAAE,EAAE,CAAC;QACX,OAAO;YACL,MAAM,EAAE,EAAE,CAAC,MAAM;YACjB,KAAK,EAAE,IAAI;SACZ,CAAC;IACJ,CAAC;IAED,MAAM,QAAQ,GAAG,MAAM,wBAAwB,CAC7C,IAAI,CAAC,KAAK,EACV,IAAI,CAAC,aAAa,EAClB,IAAI,CAAC,QAAQ,CACd,CAAC;IAEF,IAAI,CAAC,QAAQ,EAAE,CAAC;QACd,MAAM,IAAI,KAAK,CAAC,0CAA0C,CAAC,CAAC;IAC9D,CAAC;IAED,IAAI,QAAQ,CAAC,GAAG,KAAK,IAAI,CAAC,GAAG,EAAE,CAAC;QAC9B,MAAM,IAAI,KAAK,CAAC,sCAAsC,CAAC,CAAC;IAC1D,CAAC;IAED,MAAM,IAAI,GAAG;QACX,GAAG,CAAC,OAAO,IAAI,CAAC,OAAO,KAAK,QAAQ,CAAC,CAAC,CAAC,EAAE,OAAO,EAAE,IAAI,CAAC,OAAO,EAAE,CAAC,CAAC,CAAC,EAAE,CAAC;QACtE,GAAG,CAAC,OAAO,IAAI,CAAC,cAAc,KAAK,QAAQ;YACzC,CAAC,CAAC,EAAE,cAAc,EAAE,IAAI,CAAC,cAAc,EAAE;YACzC,CAAC,CAAC,EAAE,CAAC;QACP,GAAG,CAAC,KAAK,CAAC,OAAO,CAAC,IAAI,CAAC,YAAY,CAAC;YAClC,CAAC,CAAC;gBACE,YAAY,EAAE,IAAI,CAAC,YAAY,CAAC,MAAM,CACpC,CAAC,IAAa,EAAE,EAAE,CAAC,OAAO,IAAI,KAAK,QAAQ,CAC5C;aACF;YACH,CAAC,CAAC,EAAE,CAAC;KACR,CAAC;IAEF,OAAO;QACL,MAAM,EAAE,EAAE,CAAC,MAAM;QACjB,IAAI;QACJ,UAAU,EAAE;YACV;gBACE,IAAI,EAAE,IAAI,CAAC,iBAAiB;gBAC5B,KAAK,EAAE,EAAE,GAAG,EAAE,IAAI,CAAC,GAAG,EAAE,KAAK,EAAE,IAAI,CAAC,KAAK,EAAE;gBAC3C,GAAG,EAAE,IAAI,CAAC,GAAG;gBACb,MAAM,EAAE,IAAI,CAAC,YAAY;aAC1B;SACF;KACF,CAAC;AACJ,CAAC"}
+{"version":3,"file":"login.js","sourceRoot":"","sources":["../../src/handlers/login.ts"],"names":[],"mappings":"AAAA,OAAO,EAAE,SAAS,EAAE,MAAM,iBAAiB,CAAC;AAC5C,OAAO,EAAE,sBAAsB,EAAE,MAAM,qBAAqB,CAAC;AAG7D,OAAO,EAAE,qBAAqB,EAAE,MAAM,uBAAuB,CAAC;AA8B9D,MAAM,CAAC,KAAK,UAAU,YAAY,CAChC,KAAiB,EACjB,IAAkB;IAElB,MAAM,EAAE,GAAG,MAAM,SAAS,CAAC,GAAG,IAAI,CAAC,aAAa,QAAQ,EAAE;QACxD,MAAM,EAAE,MAAM;QACd,IAAI,EAAE,KAAK,CAAC,IAAI;QAChB,oBAAoB,EAAE,IAAI,CAAC,oBAAoB;QAC/C,iBAAiB,EAAE,IAAI,CAAC,iBAAiB;KAC1C,CAAC,CAAC;IAEH,MAAM,IAAI,GAAG,MAAM,EAAE,CAAC,IAAI,EAAE,CAAC;IAE7B,IAAI,CAAC,EAAE,CAAC,EAAE,EAAE,CAAC;QACX,OAAO;YACL,MAAM,EAAE,EAAE,CAAC,MAAM;YACjB,GAAG,sBAAsB,CAAC,IAAI,CAAC;SAChC,CAAC;IACJ,CAAC;IAED,6EAA6E;IAC7E,oCAAoC;IACpC,MAAM,qBAAqB,CAAC,IAAI,EAAE,IAAI,CAAC,aAAa,EAAE,IAAI,CAAC,QAAQ,CAAC,CAAC;IAErE,MAAM,IAAI,GAAG;QACX,GAAG,CAAC,OAAO,IAAI,CAAC,OAAO,KAAK,QAAQ,CAAC,CAAC,CAAC,EAAE,OAAO,EAAE,IAAI,CAAC,OAAO,EAAE,CAAC,CAAC,CAAC,EAAE,CAAC;QACtE,GAAG,CAAC,OAAO,IAAI,CAAC,cAAc,KAAK,QAAQ;YACzC,CAAC,CAAC,EAAE,cAAc,EAAE,IAAI,CAAC,cAAc,EAAE;YACzC,CAAC,CAAC,EAAE,CAAC;QACP,GAAG,CAAC,KAAK,CAAC,OAAO,CAAC,IAAI,CAAC,YAAY,CAAC;YAClC,CAAC,CAAC;gBACE,YAAY,EAAE,IAAI,CAAC,YAAY,CAAC,MAAM,CACpC,CAAC,IAAa,EAAE,EAAE,CAAC,OAAO,IAAI,KAAK,QAAQ,CAC5C;aACF;YACH,CAAC,CAAC,EAAE,CAAC;KACR,CAAC;IAEF,OAAO;QACL,MAAM,EAAE,EAAE,CAAC,MAAM;QACjB,IAAI;QACJ,UAAU,EAAE;YACV;gBACE,IAAI,EAAE,IAAI,CAAC,iBAAiB;gBAC5B,KAAK,EAAE,EAAE,GAAG,EAAE,IAAI,CAAC,GAAG,EAAE,KAAK,EAAE,IAAI,CAAC,KAAK,EAAE;gBAC3C,GAAG,EAAE,IAAI,CAAC,GAAG;gBACb,MAAM,EAAE,IAAI,CAAC,YAAY;aAC1B;SACF;KACF,CAAC;AACJ,CAAC"}

package/dist/handlers/logout.d.ts.map

@@ -1 +1 @@
-{"version":3,"file":"logout.d.ts","sourceRoot":"","sources":["../../src/handlers/logout.ts"],"names":[],"mappings":"AAEA,MAAM,WAAW,aAAa;IAC5B,aAAa,EAAE,MAAM,CAAC;IACtB,gBAAgB,EAAE,MAAM,CAAC;IACzB,sBAAsB,EAAE,MAAM,CAAC;IAC/B,iBAAiB,EAAE,MAAM,CAAC;IAC1B,aAAa,CAAC,EAAE,MAAM,CAAC;IACvB,oBAAoB,CAAC,EAAE,MAAM,CAAC;IAC9B,iBAAiB,CAAC,EAAE,MAAM,CAAC;IAC3B,KAAK,CAAC,EAAE,WAAW,CAAC;CACrB;AAED,MAAM,WAAW,YAAY;IAC3B,MAAM,EAAE,MAAM,CAAC;IACf,YAAY,EAAE,MAAM,EAAE,CAAC;CACxB;AAED,MAAM,MAAM,WAAW,GAAG,iBAAiB,GAAG,cAAc,CAAC;AAM7D,wBAAsB,aAAa,CAAC,IAAI,EAAE,aAAa,GAAG,OAAO,CAAC,YAAY,CAAC,CAiB9E;AAED,wBAAgB,2BAA2B,CAAC,IAAI,EAAE,IAAI,CAAC,aAAa,EAAE,OAAO,CAAC,yBAE7E;AAED,wBAAgB,wBAAwB,CAAC,IAAI,EAAE,IAAI,CAAC,aAAa,EAAE,OAAO,CAAC,yBAE1E"}
+{"version":3,"file":"logout.d.ts","sourceRoot":"","sources":["../../src/handlers/logout.ts"],"names":[],"mappings":"AAEA,MAAM,WAAW,aAAa;IAC5B,aAAa,EAAE,MAAM,CAAC;IACtB,gBAAgB,EAAE,MAAM,CAAC;IACzB,sBAAsB,EAAE,MAAM,CAAC;IAC/B,iBAAiB,EAAE,MAAM,CAAC;IAC1B,aAAa,CAAC,EAAE,MAAM,CAAC;IACvB,oBAAoB,CAAC,EAAE,MAAM,CAAC;IAC9B,iBAAiB,CAAC,EAAE,MAAM,CAAC;IAC3B,KAAK,CAAC,EAAE,WAAW,CAAC;CACrB;AAED,MAAM,WAAW,YAAY;IAC3B,MAAM,EAAE,MAAM,CAAC;IACf,YAAY,EAAE,MAAM,EAAE,CAAC;CACxB;AAED,MAAM,MAAM,WAAW,GAAG,iBAAiB,GAAG,cAAc,CAAC;AAM7D,wBAAsB,aAAa,CACjC,IAAI,EAAE,aAAa,GAClB,OAAO,CAAC,YAAY,CAAC,CAoBvB;AAED,wBAAgB,2BAA2B,CACzC,IAAI,EAAE,IAAI,CAAC,aAAa,EAAE,OAAO,CAAC,yBAGnC;AAED,wBAAgB,wBAAwB,CAAC,IAAI,EAAE,IAAI,CAAC,aAAa,EAAE,OAAO,CAAC,yBAE1E"}

package/dist/handlers/logout.js.map

@@ -1 +1 @@
-{"version":3,"file":"logout.js","sourceRoot":"","sources":["../../src/handlers/logout.ts"],"names":[],"mappings":"AAAA,OAAO,EAAE,SAAS,EAAE,MAAM,iBAAiB,CAAC;AAoB5C,SAAS,aAAa,CAAC,KAAkB;IACvC,OAAO,KAAK,KAAK,cAAc,CAAC,CAAC,CAAC,aAAa,CAAC,CAAC,CAAC,SAAS,CAAC;AAC9D,CAAC;AAED,MAAM,CAAC,KAAK,UAAU,aAAa,CAAC,IAAmB;IACrD,MAAM,KAAK,GAAG,IAAI,CAAC,KAAK,IAAI,cAAc,CAAC;IAC3C,MAAM,QAAQ,GAAG,MAAM,SAAS,CAAC,GAAG,IAAI,CAAC,aAAa,GAAG,aAAa,CAAC,KAAK,CAAC,EAAE,EAAE;QAC/E,MAAM,EAAE,QAAQ;QAChB,aAAa,EAAE,IAAI,CAAC,aAAa;QACjC,oBAAoB,EAAE,IAAI,CAAC,oBAAoB;QAC/C,iBAAiB,EAAE,IAAI,CAAC,iBAAiB;KAC1C,CAAC,CAAC;IAEH,OAAO;QACL,MAAM,EAAE,QAAQ,CAAC,EAAE,CAAC,CAAC,CAAC,GAAG,CAAC,CAAC,CAAC,QAAQ,CAAC,MAAM;QAC3C,YAAY,EAAE;YACZ,IAAI,CAAC,gBAAgB;YACrB,IAAI,CAAC,sBAAsB;YAC3B,IAAI,CAAC,iBAAiB;SACvB;KACF,CAAC;AACJ,CAAC;AAED,MAAM,UAAU,2BAA2B,CAAC,IAAkC;IAC5E,OAAO,aAAa,CAAC,EAAE,GAAG,IAAI,EAAE,KAAK,EAAE,iBAAiB,EAAE,CAAC,CAAC;AAC9D,CAAC;AAED,MAAM,UAAU,wBAAwB,CAAC,IAAkC;IACzE,OAAO,aAAa,CAAC,EAAE,GAAG,IAAI,EAAE,KAAK,EAAE,cAAc,EAAE,CAAC,CAAC;AAC3D,CAAC"}
+{"version":3,"file":"logout.js","sourceRoot":"","sources":["../../src/handlers/logout.ts"],"names":[],"mappings":"AAAA,OAAO,EAAE,SAAS,EAAE,MAAM,iBAAiB,CAAC;AAoB5C,SAAS,aAAa,CAAC,KAAkB;IACvC,OAAO,KAAK,KAAK,cAAc,CAAC,CAAC,CAAC,aAAa,CAAC,CAAC,CAAC,SAAS,CAAC;AAC9D,CAAC;AAED,MAAM,CAAC,KAAK,UAAU,aAAa,CACjC,IAAmB;IAEnB,MAAM,KAAK,GAAG,IAAI,CAAC,KAAK,IAAI,cAAc,CAAC;IAC3C,MAAM,QAAQ,GAAG,MAAM,SAAS,CAC9B,GAAG,IAAI,CAAC,aAAa,GAAG,aAAa,CAAC,KAAK,CAAC,EAAE,EAC9C;QACE,MAAM,EAAE,QAAQ;QAChB,aAAa,EAAE,IAAI,CAAC,aAAa;QACjC,oBAAoB,EAAE,IAAI,CAAC,oBAAoB;QAC/C,iBAAiB,EAAE,IAAI,CAAC,iBAAiB;KAC1C,CACF,CAAC;IAEF,OAAO;QACL,MAAM,EAAE,QAAQ,CAAC,EAAE,CAAC,CAAC,CAAC,GAAG,CAAC,CAAC,CAAC,QAAQ,CAAC,MAAM;QAC3C,YAAY,EAAE;YACZ,IAAI,CAAC,gBAAgB;YACrB,IAAI,CAAC,sBAAsB;YAC3B,IAAI,CAAC,iBAAiB;SACvB;KACF,CAAC;AACJ,CAAC;AAED,MAAM,UAAU,2BAA2B,CACzC,IAAkC;IAElC,OAAO,aAAa,CAAC,EAAE,GAAG,IAAI,EAAE,KAAK,EAAE,iBAAiB,EAAE,CAAC,CAAC;AAC9D,CAAC;AAED,MAAM,UAAU,wBAAwB,CAAC,IAAkC;IACzE,OAAO,aAAa,CAAC,EAAE,GAAG,IAAI,EAAE,KAAK,EAAE,cAAc,EAAE,CAAC,CAAC;AAC3D,CAAC"}

package/dist/handlers/me.d.ts

@@ -1,3 +1,4 @@
+import type { ResultFailure } from "../result.js";
 export interface MeOptions {
     authServerUrl: string;
     preAuthCookieName: string;
@@ -5,13 +6,12 @@ export interface MeOptions {
     serviceAuthorization?: string;
     forwardedClientIp?: string;
 }
-export interface MeResult {
+export interface MeResult extends ResultFailure {
     status: number;
     body?: {
         user: unknown;
         credentials?: unknown;
     };
-    error?: string;
     clearCookies?: string[];
 }
 export declare function meHandler(opts: MeOptions): Promise<MeResult>;

package/dist/handlers/me.d.ts.map

@@ -1 +1 @@
-{"version":3,"file":"me.d.ts","sourceRoot":"","sources":["../../src/handlers/me.ts"],"names":[],"mappings":"AAEA,MAAM,WAAW,SAAS;IACxB,aAAa,EAAE,MAAM,CAAC;IACtB,iBAAiB,EAAE,MAAM,CAAC;IAC1B,aAAa,CAAC,EAAE,MAAM,CAAC;IACvB,oBAAoB,CAAC,EAAE,MAAM,CAAC;IAC9B,iBAAiB,CAAC,EAAE,MAAM,CAAC;CAC5B;AAED,MAAM,WAAW,QAAQ;IACvB,MAAM,EAAE,MAAM,CAAC;IACf,IAAI,CAAC,EAAE;QACL,IAAI,EAAE,OAAO,CAAC;QACd,WAAW,CAAC,EAAE,OAAO,CAAC;KACvB,CAAC;IACF,KAAK,CAAC,EAAE,MAAM,CAAC;IACf,YAAY,CAAC,EAAE,MAAM,EAAE,CAAC;CACzB;AAED,wBAAsB,SAAS,CAAC,IAAI,EAAE,SAAS,GAAG,OAAO,CAAC,QAAQ,CAAC,CA2BlE"}
+{"version":3,"file":"me.d.ts","sourceRoot":"","sources":["../../src/handlers/me.ts"],"names":[],"mappings":"AACA,OAAO,KAAK,EAAE,aAAa,EAAE,MAAM,cAAc,CAAC;AAElD,MAAM,WAAW,SAAS;IACxB,aAAa,EAAE,MAAM,CAAC;IACtB,iBAAiB,EAAE,MAAM,CAAC;IAC1B,aAAa,CAAC,EAAE,MAAM,CAAC;IACvB,oBAAoB,CAAC,EAAE,MAAM,CAAC;IAC9B,iBAAiB,CAAC,EAAE,MAAM,CAAC;CAC5B;AAED,MAAM,WAAW,QAAS,SAAQ,aAAa;IAC7C,MAAM,EAAE,MAAM,CAAC;IACf,IAAI,CAAC,EAAE;QACL,IAAI,EAAE,OAAO,CAAC;QACd,WAAW,CAAC,EAAE,OAAO,CAAC;KACvB,CAAC;IACF,YAAY,CAAC,EAAE,MAAM,EAAE,CAAC;CACzB;AAED,wBAAsB,SAAS,CAAC,IAAI,EAAE,SAAS,GAAG,OAAO,CAAC,QAAQ,CAAC,CA2BlE"}

package/dist/handlers/me.js

@@ -11,7 +11,7 @@ export async function meHandler(opts) {
     if (!data?.user) {
         return {
             status: 401,
-            error: "unauthenticated",
+            errorCode: "unauthenticated",
             clearCookies,
         };
     }

package/dist/handlers/me.js.map

@@ -1 +1 @@
-{"version":3,"file":"me.js","sourceRoot":"","sources":["../../src/handlers/me.ts"],"names":[],"mappings":"AAAA,OAAO,EAAE,SAAS,EAAE,MAAM,iBAAiB,CAAC;AAoB5C,MAAM,CAAC,KAAK,UAAU,SAAS,CAAC,IAAe;IAC7C,MAAM,EAAE,GAAG,MAAM,SAAS,CAAC,GAAG,IAAI,CAAC,aAAa,WAAW,EAAE;QAC3D,MAAM,EAAE,KAAK;QACb,aAAa,EAAE,IAAI,CAAC,aAAa;QACjC,oBAAoB,EAAE,IAAI,CAAC,oBAAoB;QAC/C,iBAAiB,EAAE,IAAI,CAAC,iBAAiB;KAC1C,CAAC,CAAC;IAEH,MAAM,IAAI,GAAG,MAAM,EAAE,CAAC,IAAI,EAAE,CAAC;IAC7B,MAAM,YAAY,GAAG,CAAC,IAAI,CAAC,iBAAiB,CAAC,CAAC;IAE9C,IAAI,CAAC,IAAI,EAAE,IAAI,EAAE,CAAC;QAChB,OAAO;YACL,MAAM,EAAE,GAAG;YACX,KAAK,EAAE,iBAAiB;YACxB,YAAY;SACb,CAAC;IACJ,CAAC;IAED,OAAO;QACL,MAAM,EAAE,GAAG;QACX,IAAI,EAAE;YACJ,IAAI,EAAE,IAAI,CAAC,IAAI;YACf,WAAW,EAAE,IAAI,CAAC,WAAW;SAC9B;QACD,YAAY;KACb,CAAC;AACJ,CAAC"}
+{"version":3,"file":"me.js","sourceRoot":"","sources":["../../src/handlers/me.ts"],"names":[],"mappings":"AAAA,OAAO,EAAE,SAAS,EAAE,MAAM,iBAAiB,CAAC;AAoB5C,MAAM,CAAC,KAAK,UAAU,SAAS,CAAC,IAAe;IAC7C,MAAM,EAAE,GAAG,MAAM,SAAS,CAAC,GAAG,IAAI,CAAC,aAAa,WAAW,EAAE;QAC3D,MAAM,EAAE,KAAK;QACb,aAAa,EAAE,IAAI,CAAC,aAAa;QACjC,oBAAoB,EAAE,IAAI,CAAC,oBAAoB;QAC/C,iBAAiB,EAAE,IAAI,CAAC,iBAAiB;KAC1C,CAAC,CAAC;IAEH,MAAM,IAAI,GAAG,MAAM,EAAE,CAAC,IAAI,EAAE,CAAC;IAC7B,MAAM,YAAY,GAAG,CAAC,IAAI,CAAC,iBAAiB,CAAC,CAAC;IAE9C,IAAI,CAAC,IAAI,EAAE,IAAI,EAAE,CAAC;QAChB,OAAO;YACL,MAAM,EAAE,GAAG;YACX,SAAS,EAAE,iBAAiB;YAC5B,YAAY;SACb,CAAC;IACJ,CAAC;IAED,OAAO;QACL,MAAM,EAAE,GAAG;QACX,IAAI,EAAE;YACJ,IAAI,EAAE,IAAI,CAAC,IAAI;YACf,WAAW,EAAE,IAAI,CAAC,WAAW;SAC9B;QACD,YAAY;KACb,CAAC;AACJ,CAAC"}

package/dist/handlers/oauthHandlers.d.ts

@@ -1,3 +1,4 @@
+import type { ResultFailure } from "../result.js";
 import type { CookiePayload } from "../ensureCookies.js";
 export interface OAuthHandlerOptions {
     authServerUrl: string;
@@ -12,10 +13,9 @@ export interface OAuthRequestInput {
     serviceAuthorization?: string;
     forwardedClientIp?: string;
 }
-export interface OAuthHandlerResult {
+export interface OAuthHandlerResult extends ResultFailure {
     status: number;
     body?: unknown;
-    error?: unknown;
     setCookies?: {
         name: string;
         value: CookiePayload;
@@ -24,17 +24,21 @@ export interface OAuthHandlerResult {
     }[];
 }
 export declare function listOAuthProvidersHandler(opts: Pick<OAuthHandlerOptions, "authServerUrl">): Promise<{
-    body: any;
+    errorCode?: string;
+    errorBody?: unknown;
+    details?: unknown;
     status: number;
 } | {
-    error: any;
+    body: any;
     status: number;
 }>;
 export declare function startOAuthLoginHandler(input: OAuthRequestInput, opts: Pick<OAuthHandlerOptions, "authServerUrl">): Promise<{
-    body: any;
+    errorCode?: string;
+    errorBody?: unknown;
+    details?: unknown;
     status: number;
 } | {
-    error: any;
+    body: any;
     status: number;
 }>;
 export declare function finishOAuthLoginHandler(input: OAuthRequestInput, opts: OAuthHandlerOptions): Promise<OAuthHandlerResult>;

package/dist/handlers/oauthHandlers.d.ts.map

@@ -1 +1 @@
-{"version":3,"file":"oauthHandlers.d.ts","sourceRoot":"","sources":["../../src/handlers/oauthHandlers.ts"],"names":[],"mappings":"AACA,OAAO,KAAK,EAAE,aAAa,EAAE,MAAM,qBAAqB,CAAC;AAGzD,MAAM,WAAW,mBAAmB;IAClC,aAAa,EAAE,MAAM,CAAC;IACtB,QAAQ,EAAE,MAAM,CAAC;IACjB,YAAY,CAAC,EAAE,MAAM,CAAC;IACtB,gBAAgB,EAAE,MAAM,CAAC;IACzB,iBAAiB,EAAE,MAAM,CAAC;CAC3B;AAED,MAAM,WAAW,iBAAiB;IAChC,UAAU,CAAC,EAAE,MAAM,CAAC;IACpB,IAAI,CAAC,EAAE,OAAO,CAAC;IACf,oBAAoB,CAAC,EAAE,MAAM,CAAC;IAC9B,iBAAiB,CAAC,EAAE,MAAM,CAAC;CAC5B;AAED,MAAM,WAAW,kBAAkB;IACjC,MAAM,EAAE,MAAM,CAAC;IACf,IAAI,CAAC,EAAE,OAAO,CAAC;IACf,KAAK,CAAC,EAAE,OAAO,CAAC;IAChB,UAAU,CAAC,EAAE;QACX,IAAI,EAAE,MAAM,CAAC;QACb,KAAK,EAAE,aAAa,CAAC;QACrB,GAAG,EAAE,MAAM,CAAC;QACZ,MAAM,CAAC,EAAE,MAAM,CAAC;KACjB,EAAE,CAAC;CACL;AAED,wBAAsB,yBAAyB,CAC7C,IAAI,EAAE,IAAI,CAAC,mBAAmB,EAAE,eAAe,CAAC;;;;;;GAYjD;AAED,wBAAsB,sBAAsB,CAC1C,KAAK,EAAE,iBAAiB,EACxB,IAAI,EAAE,IAAI,CAAC,mBAAmB,EAAE,eAAe,CAAC;;;;;;GAkBjD;AAED,wBAAsB,uBAAuB,CAC3C,KAAK,EAAE,iBAAiB,EACxB,IAAI,EAAE,mBAAmB,GACxB,OAAO,CAAC,kBAAkB,CAAC,CAoE7B"}
+{"version":3,"file":"oauthHandlers.d.ts","sourceRoot":"","sources":["../../src/handlers/oauthHandlers.ts"],"names":[],"mappings":"AAGA,OAAO,KAAK,EAAE,aAAa,EAAE,MAAM,cAAc,CAAC;AAClD,OAAO,KAAK,EAAE,aAAa,EAAE,MAAM,qBAAqB,CAAC;AAEzD,MAAM,WAAW,mBAAmB;IAClC,aAAa,EAAE,MAAM,CAAC;IACtB,QAAQ,EAAE,MAAM,CAAC;IACjB,YAAY,CAAC,EAAE,MAAM,CAAC;IACtB,gBAAgB,EAAE,MAAM,CAAC;IACzB,iBAAiB,EAAE,MAAM,CAAC;CAC3B;AAED,MAAM,WAAW,iBAAiB;IAChC,UAAU,CAAC,EAAE,MAAM,CAAC;IACpB,IAAI,CAAC,EAAE,OAAO,CAAC;IACf,oBAAoB,CAAC,EAAE,MAAM,CAAC;IAC9B,iBAAiB,CAAC,EAAE,MAAM,CAAC;CAC5B;AAED,MAAM,WAAW,kBAAmB,SAAQ,aAAa;IACvD,MAAM,EAAE,MAAM,CAAC;IACf,IAAI,CAAC,EAAE,OAAO,CAAC;IACf,UAAU,CAAC,EAAE;QACX,IAAI,EAAE,MAAM,CAAC;QACb,KAAK,EAAE,aAAa,CAAC;QACrB,GAAG,EAAE,MAAM,CAAC;QACZ,MAAM,CAAC,EAAE,MAAM,CAAC;KACjB,EAAE,CAAC;CACL;AAED,wBAAsB,yBAAyB,CAC7C,IAAI,EAAE,IAAI,CAAC,mBAAmB,EAAE,eAAe,CAAC;;;;;;;;GAYjD;AAED,wBAAsB,sBAAsB,CAC1C,KAAK,EAAE,iBAAiB,EACxB,IAAI,EAAE,IAAI,CAAC,mBAAmB,EAAE,eAAe,CAAC;;;;;;;;GAkBjD;AAED,wBAAsB,uBAAuB,CAC3C,KAAK,EAAE,iBAAiB,EACxB,IAAI,EAAE,mBAAmB,GACxB,OAAO,CAAC,kBAAkB,CAAC,CA+B7B"}

package/dist/handlers/oauthHandlers.js

@@ -1,5 +1,6 @@
 import { authFetch } from "../authFetch.js";
-import { verifySignedAuthResponse } from "../verifySignedAuthResponse.js";
+import { issueSessionCookies } from "../upstreamSession.js";
+import { readPassthroughFailure } from "../upstreamError.js";
 export async function listOAuthProvidersHandler(opts) {
     const up = await authFetch(`${opts.authServerUrl}/oauth/providers`, {
         method: "GET",
@@ -7,7 +8,7 @@ export async function listOAuthProvidersHandler(opts) {
     const data = await up.json();
     return {
         status: up.status,
-        ...(up.ok ? { body: data } : { error: data }),
+        ...(up.ok ? { body: data } : readPassthroughFailure(data)),
     };
 }
 export async function startOAuthLoginHandler(input, opts) {
@@ -20,7 +21,7 @@ export async function startOAuthLoginHandler(input, opts) {
     const data = await up.json();
     return {
         status: up.status,
-        ...(up.ok ? { body: data } : { error: data }),
+        ...(up.ok ? { body: data } : readPassthroughFailure(data)),
     };
 }
 export async function finishOAuthLoginHandler(input, opts) {
@@ -34,47 +35,19 @@ export async function finishOAuthLoginHandler(input, opts) {
     if (!up.ok) {
         return {
             status: up.status,
-            error: data,
+            ...readPassthroughFailure(data),
         };
     }
-    const verifiedAccessToken = await verifySignedAuthResponse(data.token, opts.authServerUrl, opts.audience);
-    if (!verifiedAccessToken) {
-        throw new Error("Invalid signed response from Auth Server");
-    }
-    if (verifiedAccessToken.sub !== data.sub) {
-        throw new Error("Signature mismatch with data payload");
-    }
-    const sessionId = typeof verifiedAccessToken.sid === "string"
-        ? verifiedAccessToken.sid
-        : undefined;
     return {
         status: up.status,
         body: data,
-        setCookies: [
-            {
-                name: opts.accessCookieName,
-                value: {
-                    sub: data.sub,
-                    ...(sessionId === undefined ? {} : { sessionId }),
-                    token: data.token,
-                    roles: data.roles,
-                    email: data.email,
-                    phone: data.phone,
-                    organizationId: data.organizationId ?? null,
-                },
-                ttl: data.ttl,
-                domain: opts.cookieDomain,
-            },
-            {
-                name: opts.refreshCookieName,
-                value: {
-                    sub: data.sub,
-                    refreshToken: data.refreshToken,
-                },
-                ttl: data.refreshTtl,
-                domain: opts.cookieDomain,
-            },
-        ],
+        setCookies: await issueSessionCookies(data, {
+            authServerUrl: opts.authServerUrl,
+            audience: opts.audience,
+            accessCookieName: opts.accessCookieName,
+            refreshCookieName: opts.refreshCookieName,
+            cookieDomain: opts.cookieDomain,
+        }),
     };
 }
 //# sourceMappingURL=oauthHandlers.js.map

package/dist/handlers/oauthHandlers.js.map

@@ -1 +1 @@
-{"version":3,"file":"oauthHandlers.js","sourceRoot":"","sources":["../../src/handlers/oauthHandlers.ts"],"names":[],"mappings":"AAAA,OAAO,EAAE,SAAS,EAAE,MAAM,iBAAiB,CAAC;AAE5C,OAAO,EAAE,wBAAwB,EAAE,MAAM,gCAAgC,CAAC;AA6B1E,MAAM,CAAC,KAAK,UAAU,yBAAyB,CAC7C,IAAgD;IAEhD,MAAM,EAAE,GAAG,MAAM,SAAS,CAAC,GAAG,IAAI,CAAC,aAAa,kBAAkB,EAAE;QAClE,MAAM,EAAE,KAAK;KACd,CAAC,CAAC;IAEH,MAAM,IAAI,GAAG,MAAM,EAAE,CAAC,IAAI,EAAE,CAAC;IAE7B,OAAO;QACL,MAAM,EAAE,EAAE,CAAC,MAAM;QACjB,GAAG,CAAC,EAAE,CAAC,EAAE,CAAC,CAAC,CAAC,EAAE,IAAI,EAAE,IAAI,EAAE,CAAC,CAAC,CAAC,EAAE,KAAK,EAAE,IAAI,EAAE,CAAC;KAC9C,CAAC;AACJ,CAAC;AAED,MAAM,CAAC,KAAK,UAAU,sBAAsB,CAC1C,KAAwB,EACxB,IAAgD;IAEhD,MAAM,EAAE,GAAG,MAAM,SAAS,CACxB,GAAG,IAAI,CAAC,aAAa,UAAU,kBAAkB,CAAC,KAAK,CAAC,UAAW,CAAC,QAAQ,EAC5E;QACE,MAAM,EAAE,MAAM;QACd,IAAI,EAAE,KAAK,CAAC,IAAI;QAChB,oBAAoB,EAAE,KAAK,CAAC,oBAAoB;QAChD,iBAAiB,EAAE,KAAK,CAAC,iBAAiB;KAC3C,CACF,CAAC;IAEF,MAAM,IAAI,GAAG,MAAM,EAAE,CAAC,IAAI,EAAE,CAAC;IAE7B,OAAO;QACL,MAAM,EAAE,EAAE,CAAC,MAAM;QACjB,GAAG,CAAC,EAAE,CAAC,EAAE,CAAC,CAAC,CAAC,EAAE,IAAI,EAAE,IAAI,EAAE,CAAC,CAAC,CAAC,EAAE,KAAK,EAAE,IAAI,EAAE,CAAC;KAC9C,CAAC;AACJ,CAAC;AAED,MAAM,CAAC,KAAK,UAAU,uBAAuB,CAC3C,KAAwB,EACxB,IAAyB;IAEzB,MAAM,EAAE,GAAG,MAAM,SAAS,CACxB,GAAG,IAAI,CAAC,aAAa,UAAU,kBAAkB,CAAC,KAAK,CAAC,UAAW,CAAC,WAAW,EAC/E;QACE,MAAM,EAAE,MAAM;QACd,IAAI,EAAE,KAAK,CAAC,IAAI;QAChB,oBAAoB,EAAE,KAAK,CAAC,oBAAoB;QAChD,iBAAiB,EAAE,KAAK,CAAC,iBAAiB;KAC3C,CACF,CAAC;IAEF,MAAM,IAAI,GAAG,MAAM,EAAE,CAAC,IAAI,EAAE,CAAC;IAE7B,IAAI,CAAC,EAAE,CAAC,EAAE,EAAE,CAAC;QACX,OAAO;YACL,MAAM,EAAE,EAAE,CAAC,MAAM;YACjB,KAAK,EAAE,IAAI;SACZ,CAAC;IACJ,CAAC;IAED,MAAM,mBAAmB,GAAG,MAAM,wBAAwB,CACxD,IAAI,CAAC,KAAK,EACV,IAAI,CAAC,aAAa,EAClB,IAAI,CAAC,QAAQ,CACd,CAAC;IAEF,IAAI,CAAC,mBAAmB,EAAE,CAAC;QACzB,MAAM,IAAI,KAAK,CAAC,0CAA0C,CAAC,CAAC;IAC9D,CAAC;IAED,IAAI,mBAAmB,CAAC,GAAG,KAAK,IAAI,CAAC,GAAG,EAAE,CAAC;QACzC,MAAM,IAAI,KAAK,CAAC,sCAAsC,CAAC,CAAC;IAC1D,CAAC;IAED,MAAM,SAAS,GACb,OAAO,mBAAmB,CAAC,GAAG,KAAK,QAAQ;QACzC,CAAC,CAAC,mBAAmB,CAAC,GAAG;QACzB,CAAC,CAAC,SAAS,CAAC;IAEhB,OAAO;QACL,MAAM,EAAE,EAAE,CAAC,MAAM;QACjB,IAAI,EAAE,IAAI;QACV,UAAU,EAAE;YACV;gBACE,IAAI,EAAE,IAAI,CAAC,gBAAgB;gBAC3B,KAAK,EAAE;oBACL,GAAG,EAAE,IAAI,CAAC,GAAG;oBACb,GAAG,CAAC,SAAS,KAAK,SAAS,CAAC,CAAC,CAAC,EAAE,CAAC,CAAC,CAAC,EAAE,SAAS,EAAE,CAAC;oBACjD,KAAK,EAAE,IAAI,CAAC,KAAK;oBACjB,KAAK,EAAE,IAAI,CAAC,KAAK;oBACjB,KAAK,EAAE,IAAI,CAAC,KAAK;oBACjB,KAAK,EAAE,IAAI,CAAC,KAAK;oBACjB,cAAc,EAAE,IAAI,CAAC,cAAc,IAAI,IAAI;iBAC5C;gBACD,GAAG,EAAE,IAAI,CAAC,GAAG;gBACb,MAAM,EAAE,IAAI,CAAC,YAAY;aAC1B;YACD;gBACE,IAAI,EAAE,IAAI,CAAC,iBAAiB;gBAC5B,KAAK,EAAE;oBACL,GAAG,EAAE,IAAI,CAAC,GAAG;oBACb,YAAY,EAAE,IAAI,CAAC,YAAY;iBAChC;gBACD,GAAG,EAAE,IAAI,CAAC,UAAU;gBACpB,MAAM,EAAE,IAAI,CAAC,YAAY;aAC1B;SACF;KACF,CAAC;AACJ,CAAC"}
+{"version":3,"file":"oauthHandlers.js","sourceRoot":"","sources":["../../src/handlers/oauthHandlers.ts"],"names":[],"mappings":"AAAA,OAAO,EAAE,SAAS,EAAE,MAAM,iBAAiB,CAAC;AAC5C,OAAO,EAAE,mBAAmB,EAAE,MAAM,uBAAuB,CAAC;AAC5D,OAAO,EAAE,sBAAsB,EAAE,MAAM,qBAAqB,CAAC;AA8B7D,MAAM,CAAC,KAAK,UAAU,yBAAyB,CAC7C,IAAgD;IAEhD,MAAM,EAAE,GAAG,MAAM,SAAS,CAAC,GAAG,IAAI,CAAC,aAAa,kBAAkB,EAAE;QAClE,MAAM,EAAE,KAAK;KACd,CAAC,CAAC;IAEH,MAAM,IAAI,GAAG,MAAM,EAAE,CAAC,IAAI,EAAE,CAAC;IAE7B,OAAO;QACL,MAAM,EAAE,EAAE,CAAC,MAAM;QACjB,GAAG,CAAC,EAAE,CAAC,EAAE,CAAC,CAAC,CAAC,EAAE,IAAI,EAAE,IAAI,EAAE,CAAC,CAAC,CAAC,sBAAsB,CAAC,IAAI,CAAC,CAAC;KAC3D,CAAC;AACJ,CAAC;AAED,MAAM,CAAC,KAAK,UAAU,sBAAsB,CAC1C,KAAwB,EACxB,IAAgD;IAEhD,MAAM,EAAE,GAAG,MAAM,SAAS,CACxB,GAAG,IAAI,CAAC,aAAa,UAAU,kBAAkB,CAAC,KAAK,CAAC,UAAW,CAAC,QAAQ,EAC5E;QACE,MAAM,EAAE,MAAM;QACd,IAAI,EAAE,KAAK,CAAC,IAAI;QAChB,oBAAoB,EAAE,KAAK,CAAC,oBAAoB;QAChD,iBAAiB,EAAE,KAAK,CAAC,iBAAiB;KAC3C,CACF,CAAC;IAEF,MAAM,IAAI,GAAG,MAAM,EAAE,CAAC,IAAI,EAAE,CAAC;IAE7B,OAAO;QACL,MAAM,EAAE,EAAE,CAAC,MAAM;QACjB,GAAG,CAAC,EAAE,CAAC,EAAE,CAAC,CAAC,CAAC,EAAE,IAAI,EAAE,IAAI,EAAE,CAAC,CAAC,CAAC,sBAAsB,CAAC,IAAI,CAAC,CAAC;KAC3D,CAAC;AACJ,CAAC;AAED,MAAM,CAAC,KAAK,UAAU,uBAAuB,CAC3C,KAAwB,EACxB,IAAyB;IAEzB,MAAM,EAAE,GAAG,MAAM,SAAS,CACxB,GAAG,IAAI,CAAC,aAAa,UAAU,kBAAkB,CAAC,KAAK,CAAC,UAAW,CAAC,WAAW,EAC/E;QACE,MAAM,EAAE,MAAM;QACd,IAAI,EAAE,KAAK,CAAC,IAAI;QAChB,oBAAoB,EAAE,KAAK,CAAC,oBAAoB;QAChD,iBAAiB,EAAE,KAAK,CAAC,iBAAiB;KAC3C,CACF,CAAC;IAEF,MAAM,IAAI,GAAG,MAAM,EAAE,CAAC,IAAI,EAAE,CAAC;IAE7B,IAAI,CAAC,EAAE,CAAC,EAAE,EAAE,CAAC;QACX,OAAO;YACL,MAAM,EAAE,EAAE,CAAC,MAAM;YACjB,GAAG,sBAAsB,CAAC,IAAI,CAAC;SAChC,CAAC;IACJ,CAAC;IAED,OAAO;QACL,MAAM,EAAE,EAAE,CAAC,MAAM;QACjB,IAAI,EAAE,IAAI;QACV,UAAU,EAAE,MAAM,mBAAmB,CAAC,IAAI,EAAE;YAC1C,aAAa,EAAE,IAAI,CAAC,aAAa;YACjC,QAAQ,EAAE,IAAI,CAAC,QAAQ;YACvB,gBAAgB,EAAE,IAAI,CAAC,gBAAgB;YACvC,iBAAiB,EAAE,IAAI,CAAC,iBAAiB;YACzC,YAAY,EAAE,IAAI,CAAC,YAAY;SAChC,CAAC;KACH,CAAC;AACJ,CAAC"}

package/dist/handlers/pollMagicLinkConfirmationHandler.d.ts

@@ -1,3 +1,4 @@
+import type { ResultFailure } from "../result.js";
 import type { CookiePayload } from "../ensureCookies.js";
 export interface PollMagicLinkConfirmationInput {
     authorization?: string;
@@ -11,10 +12,9 @@ export interface PollMagicLinkConfirmationOptions {
     refreshCookieName: string;
     serviceAuthorization?: string;
 }
-export interface PollMagicLinkConfirmationResult {
+export interface PollMagicLinkConfirmationResult extends ResultFailure {
     status: number;
     body?: unknown;
-    error?: unknown;
     setCookies?: {
         name: string;
         value: CookiePayload;

package/dist/handlers/pollMagicLinkConfirmationHandler.d.ts.map

@@ -1 +1 @@
-{"version":3,"file":"pollMagicLinkConfirmationHandler.d.ts","sourceRoot":"","sources":["../../src/handlers/pollMagicLinkConfirmationHandler.ts"],"names":[],"mappings":"AACA,OAAO,KAAK,EAAE,aAAa,EAAE,MAAM,qBAAqB,CAAC;AAGzD,MAAM,WAAW,8BAA8B;IAC7C,aAAa,CAAC,EAAE,MAAM,CAAC;IACvB,iBAAiB,CAAC,EAAE,MAAM,CAAC;CAC5B;AAED,MAAM,WAAW,gCAAgC;IAC/C,aAAa,EAAE,MAAM,CAAC;IACtB,QAAQ,EAAE,MAAM,CAAC;IACjB,YAAY,CAAC,EAAE,MAAM,CAAC;IACtB,gBAAgB,EAAE,MAAM,CAAC;IACzB,iBAAiB,EAAE,MAAM,CAAC;IAC1B,oBAAoB,CAAC,EAAE,MAAM,CAAC;CAC/B;AAED,MAAM,WAAW,+BAA+B;IAC9C,MAAM,EAAE,MAAM,CAAC;IACf,IAAI,CAAC,EAAE,OAAO,CAAC;IACf,KAAK,CAAC,EAAE,OAAO,CAAC;IAChB,UAAU,CAAC,EAAE;QACX,IAAI,EAAE,MAAM,CAAC;QACb,KAAK,EAAE,aAAa,CAAC;QACrB,GAAG,EAAE,MAAM,CAAC;QACZ,MAAM,CAAC,EAAE,MAAM,CAAC;KACjB,EAAE,CAAC;CACL;AAED,wBAAsB,gCAAgC,CACpD,KAAK,EAAE,8BAA8B,EACrC,IAAI,EAAE,gCAAgC,GACrC,OAAO,CAAC,+BAA+B,CAAC,CA8E1C"}
+{"version":3,"file":"pollMagicLinkConfirmationHandler.d.ts","sourceRoot":"","sources":["../../src/handlers/pollMagicLinkConfirmationHandler.ts"],"names":[],"mappings":"AAGA,OAAO,KAAK,EAAE,aAAa,EAAE,MAAM,cAAc,CAAC;AAClD,OAAO,KAAK,EAAE,aAAa,EAAE,MAAM,qBAAqB,CAAC;AAEzD,MAAM,WAAW,8BAA8B;IAC7C,aAAa,CAAC,EAAE,MAAM,CAAC;IACvB,iBAAiB,CAAC,EAAE,MAAM,CAAC;CAC5B;AAED,MAAM,WAAW,gCAAgC;IAC/C,aAAa,EAAE,MAAM,CAAC;IACtB,QAAQ,EAAE,MAAM,CAAC;IACjB,YAAY,CAAC,EAAE,MAAM,CAAC;IACtB,gBAAgB,EAAE,MAAM,CAAC;IACzB,iBAAiB,EAAE,MAAM,CAAC;IAC1B,oBAAoB,CAAC,EAAE,MAAM,CAAC;CAC/B;AAED,MAAM,WAAW,+BAAgC,SAAQ,aAAa;IACpE,MAAM,EAAE,MAAM,CAAC;IACf,IAAI,CAAC,EAAE,OAAO,CAAC;IACf,UAAU,CAAC,EAAE;QACX,IAAI,EAAE,MAAM,CAAC;QACb,KAAK,EAAE,aAAa,CAAC;QACrB,GAAG,EAAE,MAAM,CAAC;QACZ,MAAM,CAAC,EAAE,MAAM,CAAC;KACjB,EAAE,CAAC;CACL;AAED,wBAAsB,gCAAgC,CACpD,KAAK,EAAE,8BAA8B,EACrC,IAAI,EAAE,gCAAgC,GACrC,OAAO,CAAC,+BAA+B,CAAC,CAyC1C"}

package/dist/handlers/pollMagicLinkConfirmationHandler.js

@@ -1,5 +1,6 @@
 import { authFetch } from "../authFetch.js";
-import { verifySignedAuthResponse } from "../verifySignedAuthResponse.js";
+import { issueSessionCookies } from "../upstreamSession.js";
+import { readPassthroughFailure } from "../upstreamError.js";
 export async function pollMagicLinkConfirmationHandler(input, opts) {
     const up = await authFetch(`${opts.authServerUrl}/magic-link/check`, {
         method: "GET",
@@ -16,7 +17,7 @@ export async function pollMagicLinkConfirmationHandler(input, opts) {
     if (!up.ok) {
         return {
             status: up.status,
-            error: data,
+            ...readPassthroughFailure(data),
         };
     }
     if (!data?.token || !data?.refreshToken || !data?.sub) {
@@ -25,44 +26,16 @@ export async function pollMagicLinkConfirmationHandler(input, opts) {
             body: data,
         };
     }
-    const verifiedAccessToken = await verifySignedAuthResponse(data.token, opts.authServerUrl, opts.audience);
-    if (!verifiedAccessToken) {
-        throw new Error("Invalid signed response from Auth Server");
-    }
-    if (verifiedAccessToken.sub !== data.sub) {
-        throw new Error("Signature mismatch with data payload");
-    }
-    const sessionId = typeof verifiedAccessToken.sid === "string"
-        ? verifiedAccessToken.sid
-        : undefined;
     return {
         status: 200,
         body: data,
-        setCookies: [
-            {
-                name: opts.accessCookieName,
-                value: {
-                    sub: data.sub,
-                    ...(sessionId === undefined ? {} : { sessionId }),
-                    token: data.token,
-                    roles: data.roles,
-                    email: data.email,
-                    phone: data.phone,
-                    organizationId: data.organizationId ?? null,
-                },
-                ttl: data.ttl,
-                domain: opts.cookieDomain,
-            },
-            {
-                name: opts.refreshCookieName,
-                value: {
-                    sub: data.sub,
-                    refreshToken: data.refreshToken,
-                },
-                ttl: data.refreshTtl,
-                domain: opts.cookieDomain,
-            },
-        ],
+        setCookies: await issueSessionCookies(data, {
+            authServerUrl: opts.authServerUrl,
+            audience: opts.audience,
+            accessCookieName: opts.accessCookieName,
+            refreshCookieName: opts.refreshCookieName,
+            cookieDomain: opts.cookieDomain,
+        }),
     };
 }
 //# sourceMappingURL=pollMagicLinkConfirmationHandler.js.map

package/dist/handlers/pollMagicLinkConfirmationHandler.js.map

@@ -1 +1 @@
-{"version":3,"file":"pollMagicLinkConfirmationHandler.js","sourceRoot":"","sources":["../../src/handlers/pollMagicLinkConfirmationHandler.ts"],"names":[],"mappings":"AAAA,OAAO,EAAE,SAAS,EAAE,MAAM,iBAAiB,CAAC;AAE5C,OAAO,EAAE,wBAAwB,EAAE,MAAM,gCAAgC,CAAC;AA4B1E,MAAM,CAAC,KAAK,UAAU,gCAAgC,CACpD,KAAqC,EACrC,IAAsC;IAEtC,MAAM,EAAE,GAAG,MAAM,SAAS,CAAC,GAAG,IAAI,CAAC,aAAa,mBAAmB,EAAE;QACnE,MAAM,EAAE,KAAK;QACb,aAAa,EAAE,KAAK,CAAC,aAAa;QAClC,iBAAiB,EAAE,KAAK,CAAC,iBAAiB;QAC1C,oBAAoB,EAAE,IAAI,CAAC,oBAAoB;KAChD,CAAC,CAAC;IAEH,IAAI,EAAE,CAAC,MAAM,KAAK,GAAG,EAAE,CAAC;QACtB,OAAO;YACL,MAAM,EAAE,GAAG;SACZ,CAAC;IACJ,CAAC;IAED,MAAM,IAAI,GAAG,MAAM,EAAE,CAAC,IAAI,EAAE,CAAC;IAE7B,IAAI,CAAC,EAAE,CAAC,EAAE,EAAE,CAAC;QACX,OAAO;YACL,MAAM,EAAE,EAAE,CAAC,MAAM;YACjB,KAAK,EAAE,IAAI;SACZ,CAAC;IACJ,CAAC;IAED,IAAI,CAAC,IAAI,EAAE,KAAK,IAAI,CAAC,IAAI,EAAE,YAAY,IAAI,CAAC,IAAI,EAAE,GAAG,EAAE,CAAC;QACtD,OAAO;YACL,MAAM,EAAE,EAAE,CAAC,MAAM;YACjB,IAAI,EAAE,IAAI;SACX,CAAC;IACJ,CAAC;IAED,MAAM,mBAAmB,GAAG,MAAM,wBAAwB,CACxD,IAAI,CAAC,KAAK,EACV,IAAI,CAAC,aAAa,EAClB,IAAI,CAAC,QAAQ,CACd,CAAC;IAEF,IAAI,CAAC,mBAAmB,EAAE,CAAC;QACzB,MAAM,IAAI,KAAK,CAAC,0CAA0C,CAAC,CAAC;IAC9D,CAAC;IAED,IAAI,mBAAmB,CAAC,GAAG,KAAK,IAAI,CAAC,GAAG,EAAE,CAAC;QACzC,MAAM,IAAI,KAAK,CAAC,sCAAsC,CAAC,CAAC;IAC1D,CAAC;IAED,MAAM,SAAS,GACb,OAAO,mBAAmB,CAAC,GAAG,KAAK,QAAQ;QACzC,CAAC,CAAC,mBAAmB,CAAC,GAAG;QACzB,CAAC,CAAC,SAAS,CAAC;IAEhB,OAAO;QACL,MAAM,EAAE,GAAG;QACX,IAAI,EAAE,IAAI;QACV,UAAU,EAAE;YACV;gBACE,IAAI,EAAE,IAAI,CAAC,gBAAgB;gBAC3B,KAAK,EAAE;oBACL,GAAG,EAAE,IAAI,CAAC,GAAG;oBACb,GAAG,CAAC,SAAS,KAAK,SAAS,CAAC,CAAC,CAAC,EAAE,CAAC,CAAC,CAAC,EAAE,SAAS,EAAE,CAAC;oBACjD,KAAK,EAAE,IAAI,CAAC,KAAK;oBACjB,KAAK,EAAE,IAAI,CAAC,KAAK;oBACjB,KAAK,EAAE,IAAI,CAAC,KAAK;oBACjB,KAAK,EAAE,IAAI,CAAC,KAAK;oBACjB,cAAc,EAAE,IAAI,CAAC,cAAc,IAAI,IAAI;iBAC5C;gBACD,GAAG,EAAE,IAAI,CAAC,GAAG;gBACb,MAAM,EAAE,IAAI,CAAC,YAAY;aAC1B;YACD;gBACE,IAAI,EAAE,IAAI,CAAC,iBAAiB;gBAC5B,KAAK,EAAE;oBACL,GAAG,EAAE,IAAI,CAAC,GAAG;oBACb,YAAY,EAAE,IAAI,CAAC,YAAY;iBAChC;gBACD,GAAG,EAAE,IAAI,CAAC,UAAU;gBACpB,MAAM,EAAE,IAAI,CAAC,YAAY;aAC1B;SACF;KACF,CAAC;AACJ,CAAC"}
+{"version":3,"file":"pollMagicLinkConfirmationHandler.js","sourceRoot":"","sources":["../../src/handlers/pollMagicLinkConfirmationHandler.ts"],"names":[],"mappings":"AAAA,OAAO,EAAE,SAAS,EAAE,MAAM,iBAAiB,CAAC;AAC5C,OAAO,EAAE,mBAAmB,EAAE,MAAM,uBAAuB,CAAC;AAC5D,OAAO,EAAE,sBAAsB,EAAE,MAAM,qBAAqB,CAAC;AA6B7D,MAAM,CAAC,KAAK,UAAU,gCAAgC,CACpD,KAAqC,EACrC,IAAsC;IAEtC,MAAM,EAAE,GAAG,MAAM,SAAS,CAAC,GAAG,IAAI,CAAC,aAAa,mBAAmB,EAAE;QACnE,MAAM,EAAE,KAAK;QACb,aAAa,EAAE,KAAK,CAAC,aAAa;QAClC,iBAAiB,EAAE,KAAK,CAAC,iBAAiB;QAC1C,oBAAoB,EAAE,IAAI,CAAC,oBAAoB;KAChD,CAAC,CAAC;IAEH,IAAI,EAAE,CAAC,MAAM,KAAK,GAAG,EAAE,CAAC;QACtB,OAAO;YACL,MAAM,EAAE,GAAG;SACZ,CAAC;IACJ,CAAC;IAED,MAAM,IAAI,GAAG,MAAM,EAAE,CAAC,IAAI,EAAE,CAAC;IAE7B,IAAI,CAAC,EAAE,CAAC,EAAE,EAAE,CAAC;QACX,OAAO;YACL,MAAM,EAAE,EAAE,CAAC,MAAM;YACjB,GAAG,sBAAsB,CAAC,IAAI,CAAC;SAChC,CAAC;IACJ,CAAC;IAED,IAAI,CAAC,IAAI,EAAE,KAAK,IAAI,CAAC,IAAI,EAAE,YAAY,IAAI,CAAC,IAAI,EAAE,GAAG,EAAE,CAAC;QACtD,OAAO;YACL,MAAM,EAAE,EAAE,CAAC,MAAM;YACjB,IAAI,EAAE,IAAI;SACX,CAAC;IACJ,CAAC;IAED,OAAO;QACL,MAAM,EAAE,GAAG;QACX,IAAI,EAAE,IAAI;QACV,UAAU,EAAE,MAAM,mBAAmB,CAAC,IAAI,EAAE;YAC1C,aAAa,EAAE,IAAI,CAAC,aAAa;YACjC,QAAQ,EAAE,IAAI,CAAC,QAAQ;YACvB,gBAAgB,EAAE,IAAI,CAAC,gBAAgB;YACvC,iBAAiB,EAAE,IAAI,CAAC,iBAAiB;YACzC,YAAY,EAAE,IAAI,CAAC,YAAY;SAChC,CAAC;KACH,CAAC;AACJ,CAAC"}

package/dist/handlers/register.d.ts

@@ -1,3 +1,4 @@
+import type { ResultFailure } from "../result.js";
 import type { CookiePayload } from "../ensureCookies.js";
 export interface RegisterInput {
     body: unknown;
@@ -10,10 +11,9 @@ export interface RegisterOptions {
     forwardedClientIp?: string;
     serviceAuthorization?: string;
 }
-export interface RegisterResult {
+export interface RegisterResult extends ResultFailure {
     status: number;
     body?: unknown;
-    error?: unknown;
     setCookies?: {
         name: string;
         value: CookiePayload;

package/dist/handlers/register.d.ts.map

@@ -1 +1 @@
-{"version":3,"file":"register.d.ts","sourceRoot":"","sources":["../../src/handlers/register.ts"],"names":[],"mappings":"AACA,OAAO,KAAK,EAAE,aAAa,EAAE,MAAM,qBAAqB,CAAC;AAEzD,MAAM,WAAW,aAAa;IAC5B,IAAI,EAAE,OAAO,CAAC;CACf;AAED,MAAM,WAAW,eAAe;IAC9B,aAAa,EAAE,MAAM,CAAC;IACtB,YAAY,CAAC,EAAE,MAAM,CAAC;IACtB,sBAAsB,EAAE,MAAM,CAAC;IAC/B,gBAAgB,CAAC,EAAE,OAAO,CAAC;IAC3B,iBAAiB,CAAC,EAAE,MAAM,CAAC;IAC3B,oBAAoB,CAAC,EAAE,MAAM,CAAC;CAC/B;AAED,MAAM,WAAW,cAAc;IAC7B,MAAM,EAAE,MAAM,CAAC;IACf,IAAI,CAAC,EAAE,OAAO,CAAC;IACf,KAAK,CAAC,EAAE,OAAO,CAAC;IAChB,UAAU,CAAC,EAAE;QACX,IAAI,EAAE,MAAM,CAAC;QACb,KAAK,EAAE,aAAa,CAAC;QACrB,GAAG,EAAE,MAAM,CAAC;QACZ,MAAM,CAAC,EAAE,MAAM,CAAC;KACjB,EAAE,CAAC;CACL;AAED,wBAAsB,eAAe,CACnC,KAAK,EAAE,aAAa,EACpB,IAAI,EAAE,eAAe,GACpB,OAAO,CAAC,cAAc,CAAC,CAoCzB"}
+{"version":3,"file":"register.d.ts","sourceRoot":"","sources":["../../src/handlers/register.ts"],"names":[],"mappings":"AAGA,OAAO,KAAK,EAAE,aAAa,EAAE,MAAM,cAAc,CAAC;AAClD,OAAO,KAAK,EAAE,aAAa,EAAE,MAAM,qBAAqB,CAAC;AAEzD,MAAM,WAAW,aAAa;IAC5B,IAAI,EAAE,OAAO,CAAC;CACf;AAED,MAAM,WAAW,eAAe;IAC9B,aAAa,EAAE,MAAM,CAAC;IACtB,YAAY,CAAC,EAAE,MAAM,CAAC;IACtB,sBAAsB,EAAE,MAAM,CAAC;IAC/B,gBAAgB,CAAC,EAAE,OAAO,CAAC;IAC3B,iBAAiB,CAAC,EAAE,MAAM,CAAC;IAC3B,oBAAoB,CAAC,EAAE,MAAM,CAAC;CAC/B;AAED,MAAM,WAAW,cAAe,SAAQ,aAAa;IACnD,MAAM,EAAE,MAAM,CAAC;IACf,IAAI,CAAC,EAAE,OAAO,CAAC;IACf,UAAU,CAAC,EAAE;QACX,IAAI,EAAE,MAAM,CAAC;QACb,KAAK,EAAE,aAAa,CAAC;QACrB,GAAG,EAAE,MAAM,CAAC;QACZ,MAAM,CAAC,EAAE,MAAM,CAAC;KACjB,EAAE,CAAC;CACL;AAED,wBAAsB,eAAe,CACnC,KAAK,EAAE,aAAa,EACpB,IAAI,EAAE,eAAe,GACpB,OAAO,CAAC,cAAc,CAAC,CAkCzB"}

package/dist/handlers/register.js

@@ -1,4 +1,6 @@
 import { authFetch } from "../authFetch.js";
+import { readPassthroughFailure } from "../upstreamError.js";
+import { EXTERNAL_DELIVERY_HEADERS } from "../apiContract.js";
 export async function registerHandler(input, opts) {
     const up = await authFetch(`${opts.authServerUrl}/registration/register`, {
         method: "POST",
@@ -7,9 +9,7 @@ export async function registerHandler(input, opts) {
         serviceAuthorization: opts.serviceAuthorization,
         ...(opts.externalDelivery
             ? {
-                headers: {
-                    "x-seamless-auth-delivery-mode": "external",
-                },
+                headers: EXTERNAL_DELIVERY_HEADERS,
             }
             : {}),
     });
@@ -17,7 +17,7 @@ export async function registerHandler(input, opts) {
     if (!up.ok) {
         return {
             status: up.status,
-            error: data,
+            ...readPassthroughFailure(data),
         };
     }
     return {

package/dist/handlers/register.js.map

@@ -1 +1 @@
-{"version":3,"file":"register.js","sourceRoot":"","sources":["../../src/handlers/register.ts"],"names":[],"mappings":"AAAA,OAAO,EAAE,SAAS,EAAE,MAAM,iBAAiB,CAAC;AA4B5C,MAAM,CAAC,KAAK,UAAU,eAAe,CACnC,KAAoB,EACpB,IAAqB;IAErB,MAAM,EAAE,GAAG,MAAM,SAAS,CAAC,GAAG,IAAI,CAAC,aAAa,wBAAwB,EAAE;QACxE,MAAM,EAAE,MAAM;QACd,IAAI,EAAE,KAAK,CAAC,IAAI;QAChB,iBAAiB,EAAE,IAAI,CAAC,iBAAiB;QACzC,oBAAoB,EAAE,IAAI,CAAC,oBAAoB;QAC/C,GAAG,CAAC,IAAI,CAAC,gBAAgB;YACvB,CAAC,CAAC;gBACE,OAAO,EAAE;oBACP,+BAA+B,EAAE,UAAU;iBAC5C;aACF;YACH,CAAC,CAAC,EAAE,CAAC;KACR,CAAC,CAAC;IAEH,MAAM,IAAI,GAAG,MAAM,EAAE,CAAC,IAAI,EAAE,CAAC;IAE7B,IAAI,CAAC,EAAE,CAAC,EAAE,EAAE,CAAC;QACX,OAAO;YACL,MAAM,EAAE,EAAE,CAAC,MAAM;YACjB,KAAK,EAAE,IAAI;SACZ,CAAC;IACJ,CAAC;IAED,OAAO;QACL,MAAM,EAAE,GAAG;QACX,IAAI,EAAE,IAAI;QACV,UAAU,EAAE;YACV;gBACE,IAAI,EAAE,IAAI,CAAC,sBAAsB;gBACjC,KAAK,EAAE,EAAE,GAAG,EAAE,IAAI,CAAC,GAAG,EAAE,KAAK,EAAE,IAAI,CAAC,KAAK,EAAE;gBAC3C,GAAG,EAAE,IAAI,CAAC,GAAG;gBACb,MAAM,EAAE,IAAI,CAAC,YAAY;aAC1B;SACF;KACF,CAAC;AACJ,CAAC"}
+{"version":3,"file":"register.js","sourceRoot":"","sources":["../../src/handlers/register.ts"],"names":[],"mappings":"AAAA,OAAO,EAAE,SAAS,EAAE,MAAM,iBAAiB,CAAC;AAC5C,OAAO,EAAE,sBAAsB,EAAE,MAAM,qBAAqB,CAAC;AAC7D,OAAO,EAAE,yBAAyB,EAAE,MAAM,mBAAmB,CAAC;AA4B9D,MAAM,CAAC,KAAK,UAAU,eAAe,CACnC,KAAoB,EACpB,IAAqB;IAErB,MAAM,EAAE,GAAG,MAAM,SAAS,CAAC,GAAG,IAAI,CAAC,aAAa,wBAAwB,EAAE;QACxE,MAAM,EAAE,MAAM;QACd,IAAI,EAAE,KAAK,CAAC,IAAI;QAChB,iBAAiB,EAAE,IAAI,CAAC,iBAAiB;QACzC,oBAAoB,EAAE,IAAI,CAAC,oBAAoB;QAC/C,GAAG,CAAC,IAAI,CAAC,gBAAgB;YACvB,CAAC,CAAC;gBACE,OAAO,EAAE,yBAAyB;aACnC;YACH,CAAC,CAAC,EAAE,CAAC;KACR,CAAC,CAAC;IAEH,MAAM,IAAI,GAAG,MAAM,EAAE,CAAC,IAAI,EAAE,CAAC;IAE7B,IAAI,CAAC,EAAE,CAAC,EAAE,EAAE,CAAC;QACX,OAAO;YACL,MAAM,EAAE,EAAE,CAAC,MAAM;YACjB,GAAG,sBAAsB,CAAC,IAAI,CAAC;SAChC,CAAC;IACJ,CAAC;IAED,OAAO;QACL,MAAM,EAAE,GAAG;QACX,IAAI,EAAE,IAAI;QACV,UAAU,EAAE;YACV;gBACE,IAAI,EAAE,IAAI,CAAC,sBAAsB;gBACjC,KAAK,EAAE,EAAE,GAAG,EAAE,IAAI,CAAC,GAAG,EAAE,KAAK,EAAE,IAAI,CAAC,KAAK,EAAE;gBAC3C,GAAG,EAAE,IAAI,CAAC,GAAG;gBACb,MAAM,EAAE,IAAI,CAAC,YAAY;aAC1B;SACF;KACF,CAAC;AACJ,CAAC"}

package/dist/handlers/requestMagicLinkHandler.d.ts

@@ -1,3 +1,4 @@
+import type { ResultFailure } from "../result.js";
 export interface RequestMagicLinkInput {
     authorization?: string;
 }
@@ -7,10 +8,9 @@ export interface RequestMagicLinkOptions {
     forwardedClientIp?: string;
     serviceAuthorization?: string;
 }
-export interface RequestMagicLinkResult {
+export interface RequestMagicLinkResult extends ResultFailure {
     status: number;
     body?: unknown;
-    error?: unknown;
 }
 export declare function requestMagicLinkHandler(input: RequestMagicLinkInput, opts: RequestMagicLinkOptions): Promise<RequestMagicLinkResult>;
 //# sourceMappingURL=requestMagicLinkHandler.d.ts.map

package/dist/handlers/requestMagicLinkHandler.d.ts.map

@@ -1 +1 @@
-{"version":3,"file":"requestMagicLinkHandler.d.ts","sourceRoot":"","sources":["../../src/handlers/requestMagicLinkHandler.ts"],"names":[],"mappings":"AAEA,MAAM,WAAW,qBAAqB;IACpC,aAAa,CAAC,EAAE,MAAM,CAAC;CACxB;AAED,MAAM,WAAW,uBAAuB;IACtC,aAAa,EAAE,MAAM,CAAC;IACtB,gBAAgB,CAAC,EAAE,OAAO,CAAC;IAC3B,iBAAiB,CAAC,EAAE,MAAM,CAAC;IAC3B,oBAAoB,CAAC,EAAE,MAAM,CAAC;CAC/B;AAED,MAAM,WAAW,sBAAsB;IACrC,MAAM,EAAE,MAAM,CAAC;IACf,IAAI,CAAC,EAAE,OAAO,CAAC;IACf,KAAK,CAAC,EAAE,OAAO,CAAC;CACjB;AAED,wBAAsB,uBAAuB,CAC3C,KAAK,EAAE,qBAAqB,EAC5B,IAAI,EAAE,uBAAuB,GAC5B,OAAO,CAAC,sBAAsB,CAAC,CA4BjC"}
+{"version":3,"file":"requestMagicLinkHandler.d.ts","sourceRoot":"","sources":["../../src/handlers/requestMagicLinkHandler.ts"],"names":[],"mappings":"AAGA,OAAO,KAAK,EAAE,aAAa,EAAE,MAAM,cAAc,CAAC;AAElD,MAAM,WAAW,qBAAqB;IACpC,aAAa,CAAC,EAAE,MAAM,CAAC;CACxB;AAED,MAAM,WAAW,uBAAuB;IACtC,aAAa,EAAE,MAAM,CAAC;IACtB,gBAAgB,CAAC,EAAE,OAAO,CAAC;IAC3B,iBAAiB,CAAC,EAAE,MAAM,CAAC;IAC3B,oBAAoB,CAAC,EAAE,MAAM,CAAC;CAC/B;AAED,MAAM,WAAW,sBAAuB,SAAQ,aAAa;IAC3D,MAAM,EAAE,MAAM,CAAC;IACf,IAAI,CAAC,EAAE,OAAO,CAAC;CAChB;AAED,wBAAsB,uBAAuB,CAC3C,KAAK,EAAE,qBAAqB,EAC5B,IAAI,EAAE,uBAAuB,GAC5B,OAAO,CAAC,sBAAsB,CAAC,CA0BjC"}

package/dist/handlers/requestMagicLinkHandler.js

@@ -1,4 +1,6 @@
 import { authFetch } from "../authFetch.js";
+import { readPassthroughFailure } from "../upstreamError.js";
+import { EXTERNAL_DELIVERY_HEADERS } from "../apiContract.js";
 export async function requestMagicLinkHandler(input, opts) {
     const up = await authFetch(`${opts.authServerUrl}/magic-link`, {
         method: "GET",
@@ -7,9 +9,7 @@ export async function requestMagicLinkHandler(input, opts) {
         serviceAuthorization: opts.serviceAuthorization,
         ...(opts.externalDelivery
             ? {
-                headers: {
-                    "x-seamless-auth-delivery-mode": "external",
-                },
+                headers: EXTERNAL_DELIVERY_HEADERS,
             }
             : {}),
     });
@@ -17,7 +17,7 @@ export async function requestMagicLinkHandler(input, opts) {
     if (!up.ok) {
         return {
             status: up.status,
-            error: data,
+            ...readPassthroughFailure(data),
         };
     }
     return {

package/dist/handlers/requestMagicLinkHandler.js.map

@@ -1 +1 @@
-{"version":3,"file":"requestMagicLinkHandler.js","sourceRoot":"","sources":["../../src/handlers/requestMagicLinkHandler.ts"],"names":[],"mappings":"AAAA,OAAO,EAAE,SAAS,EAAE,MAAM,iBAAiB,CAAC;AAmB5C,MAAM,CAAC,KAAK,UAAU,uBAAuB,CAC3C,KAA4B,EAC5B,IAA6B;IAE7B,MAAM,EAAE,GAAG,MAAM,SAAS,CAAC,GAAG,IAAI,CAAC,aAAa,aAAa,EAAE;QAC7D,MAAM,EAAE,KAAK;QACb,aAAa,EAAE,KAAK,CAAC,aAAa;QAClC,iBAAiB,EAAE,IAAI,CAAC,iBAAiB;QACzC,oBAAoB,EAAE,IAAI,CAAC,oBAAoB;QAC/C,GAAG,CAAC,IAAI,CAAC,gBAAgB;YACvB,CAAC,CAAC;gBACE,OAAO,EAAE;oBACP,+BAA+B,EAAE,UAAU;iBAC5C;aACF;YACH,CAAC,CAAC,EAAE,CAAC;KACR,CAAC,CAAC;IAEH,MAAM,IAAI,GAAG,MAAM,EAAE,CAAC,IAAI,EAAE,CAAC;IAE7B,IAAI,CAAC,EAAE,CAAC,EAAE,EAAE,CAAC;QACX,OAAO;YACL,MAAM,EAAE,EAAE,CAAC,MAAM;YACjB,KAAK,EAAE,IAAI;SACZ,CAAC;IACJ,CAAC;IAED,OAAO;QACL,MAAM,EAAE,EAAE,CAAC,MAAM;QACjB,IAAI,EAAE,IAAI;KACX,CAAC;AACJ,CAAC"}
+{"version":3,"file":"requestMagicLinkHandler.js","sourceRoot":"","sources":["../../src/handlers/requestMagicLinkHandler.ts"],"names":[],"mappings":"AAAA,OAAO,EAAE,SAAS,EAAE,MAAM,iBAAiB,CAAC;AAC5C,OAAO,EAAE,sBAAsB,EAAE,MAAM,qBAAqB,CAAC;AAC7D,OAAO,EAAE,yBAAyB,EAAE,MAAM,mBAAmB,CAAC;AAmB9D,MAAM,CAAC,KAAK,UAAU,uBAAuB,CAC3C,KAA4B,EAC5B,IAA6B;IAE7B,MAAM,EAAE,GAAG,MAAM,SAAS,CAAC,GAAG,IAAI,CAAC,aAAa,aAAa,EAAE;QAC7D,MAAM,EAAE,KAAK;QACb,aAAa,EAAE,KAAK,CAAC,aAAa;QAClC,iBAAiB,EAAE,IAAI,CAAC,iBAAiB;QACzC,oBAAoB,EAAE,IAAI,CAAC,oBAAoB;QAC/C,GAAG,CAAC,IAAI,CAAC,gBAAgB;YACvB,CAAC,CAAC;gBACE,OAAO,EAAE,yBAAyB;aACnC;YACH,CAAC,CAAC,EAAE,CAAC;KACR,CAAC,CAAC;IAEH,MAAM,IAAI,GAAG,MAAM,EAAE,CAAC,IAAI,EAAE,CAAC;IAE7B,IAAI,CAAC,EAAE,CAAC,EAAE,EAAE,CAAC;QACX,OAAO;YACL,MAAM,EAAE,EAAE,CAAC,MAAM;YACjB,GAAG,sBAAsB,CAAC,IAAI,CAAC;SAChC,CAAC;IACJ,CAAC;IAED,OAAO;QACL,MAAM,EAAE,EAAE,CAAC,MAAM;QACjB,IAAI,EAAE,IAAI;KACX,CAAC;AACJ,CAAC"}

package/dist/handlers/requestOtpHandler.d.ts

@@ -1,3 +1,4 @@
+import type { ResultFailure } from "../result.js";
 export interface RequestOtpInput {
     authorization?: string;
     flow?: "registration" | "login";
@@ -9,10 +10,9 @@ export interface RequestOtpOptions {
     forwardedClientIp?: string;
     serviceAuthorization?: string;
 }
-export interface RequestOtpResult {
+export interface RequestOtpResult extends ResultFailure {
     status: number;
     body?: unknown;
-    error?: unknown;
 }
 export declare function requestOtpHandler(input: RequestOtpInput, opts: RequestOtpOptions): Promise<RequestOtpResult>;
 //# sourceMappingURL=requestOtpHandler.d.ts.map

package/dist/handlers/requestOtpHandler.d.ts.map

@@ -1 +1 @@
-{"version":3,"file":"requestOtpHandler.d.ts","sourceRoot":"","sources":["../../src/handlers/requestOtpHandler.ts"],"names":[],"mappings":"AAEA,MAAM,WAAW,eAAe;IAC9B,aAAa,CAAC,EAAE,MAAM,CAAC;IACvB,IAAI,CAAC,EAAE,cAAc,GAAG,OAAO,CAAC;IAChC,IAAI,EAAE,OAAO,GAAG,OAAO,CAAC;CACzB;AAED,MAAM,WAAW,iBAAiB;IAChC,aAAa,EAAE,MAAM,CAAC;IACtB,gBAAgB,CAAC,EAAE,OAAO,CAAC;IAC3B,iBAAiB,CAAC,EAAE,MAAM,CAAC;IAC3B,oBAAoB,CAAC,EAAE,MAAM,CAAC;CAC/B;AAED,MAAM,WAAW,gBAAgB;IAC/B,MAAM,EAAE,MAAM,CAAC;IACf,IAAI,CAAC,EAAE,OAAO,CAAC;IACf,KAAK,CAAC,EAAE,OAAO,CAAC;CACjB;AAED,wBAAsB,iBAAiB,CACrC,KAAK,EAAE,eAAe,EACtB,IAAI,EAAE,iBAAiB,GACtB,OAAO,CAAC,gBAAgB,CAAC,CAsC3B"}
+{"version":3,"file":"requestOtpHandler.d.ts","sourceRoot":"","sources":["../../src/handlers/requestOtpHandler.ts"],"names":[],"mappings":"AAGA,OAAO,KAAK,EAAE,aAAa,EAAE,MAAM,cAAc,CAAC;AAElD,MAAM,WAAW,eAAe;IAC9B,aAAa,CAAC,EAAE,MAAM,CAAC;IACvB,IAAI,CAAC,EAAE,cAAc,GAAG,OAAO,CAAC;IAChC,IAAI,EAAE,OAAO,GAAG,OAAO,CAAC;CACzB;AAED,MAAM,WAAW,iBAAiB;IAChC,aAAa,EAAE,MAAM,CAAC;IACtB,gBAAgB,CAAC,EAAE,OAAO,CAAC;IAC3B,iBAAiB,CAAC,EAAE,MAAM,CAAC;IAC3B,oBAAoB,CAAC,EAAE,MAAM,CAAC;CAC/B;AAED,MAAM,WAAW,gBAAiB,SAAQ,aAAa;IACrD,MAAM,EAAE,MAAM,CAAC;IACf,IAAI,CAAC,EAAE,OAAO,CAAC;CAChB;AAED,wBAAsB,iBAAiB,CACrC,KAAK,EAAE,eAAe,EACtB,IAAI,EAAE,iBAAiB,GACtB,OAAO,CAAC,gBAAgB,CAAC,CAoC3B"}