@segmentstream/app 0.0.0-stage → 0.38.0

package/dist/pkce.js

@@ -0,0 +1,40 @@
+// Web Crypto only, so the same code runs in the Node.js and Edge runtimes.
+export function base64UrlEncode(bytes) {
+    let binary = "";
+    for (const byte of bytes) {
+        binary += String.fromCharCode(byte);
+    }
+    return btoa(binary).replace(/\+/g, "-").replace(/\//g, "_").replace(/=+$/, "");
+}
+export function base64UrlDecode(value) {
+    const base64 = value.replace(/-/g, "+").replace(/_/g, "/");
+    const padded = base64 + "=".repeat((4 - (base64.length % 4)) % 4);
+    const binary = atob(padded);
+    const bytes = new Uint8Array(binary.length);
+    for (let index = 0; index < binary.length; index += 1) {
+        bytes[index] = binary.charCodeAt(index);
+    }
+    return bytes;
+}
+/** A URL-safe random value carrying `byteLength` bytes of entropy. */
+export function randomToken(byteLength = 32) {
+    const bytes = new Uint8Array(byteLength);
+    crypto.getRandomValues(bytes);
+    return base64UrlEncode(bytes);
+}
+/** The RFC 7636 S256 code challenge for a code verifier. */
+export async function createCodeChallenge(codeVerifier) {
+    const digest = await crypto.subtle.digest("SHA-256", new TextEncoder().encode(codeVerifier));
+    return base64UrlEncode(new Uint8Array(digest));
+}
+/** Compares two strings without short-circuiting on the first differing character. */
+export function constantTimeEqual(left, right) {
+    if (left.length !== right.length) {
+        return false;
+    }
+    let difference = 0;
+    for (let index = 0; index < left.length; index += 1) {
+        difference |= left.charCodeAt(index) ^ right.charCodeAt(index);
+    }
+    return difference === 0;
+}

package/dist/proxy.d.ts

@@ -0,0 +1,25 @@
+import { NextResponse } from "next/server";
+import type { NextRequest } from "next/server";
+import type { AppContext } from "./context.js";
+export interface ProxyOptions {
+    /**
+     * Paths that do not require a signed-in user. Each entry matches itself and everything
+     * below it on path-segment boundaries: `/health` matches `/health` and `/health/db`,
+     * not `/healthy`.
+     */
+    readonly publicPaths?: readonly string[];
+    /**
+     * An app page that a Telegram Web launch opens when it cannot sign in, for example because the
+     * browser refuses the session cookie inside Telegram's frame. Telegram must be enabled in
+     * `channels`, and the path must be covered by `publicPaths`. The page receives `error`, the
+     * machine code, and `returnTo`, the launched path and query without Telegram's launch data.
+     * Without it, a failed launch stays on a blank page.
+     */
+    readonly channelLaunchFailurePath?: string;
+}
+export type SegmentStreamProxy = (request: NextRequest) => Promise<NextResponse>;
+export declare function createProxy(context: AppContext, options?: ProxyOptions): SegmentStreamProxy;
+/** Discovery probes never start browser authentication, including probes for unsupported metadata. */
+export declare function wellKnownResponse(request: NextRequest, ontologyUrl?: string): NextResponse | undefined;
+export declare function normalizePublicPath(path: string): string;
+export declare function matchesPathPrefix(pathname: string, prefix: string): boolean;

package/dist/proxy.js

@@ -0,0 +1,135 @@
+import { NextResponse } from "next/server";
+import { hasChannelApps, trimTrailingSlashes } from "./config.js";
+import { clearSessionCookies, cookiePolicyFor, replaceRequestCookies, safeReturnTo, setSessionCookies, } from "./cookies.js";
+import { SDK_ROUTE_PREFIX, isApiRequest, signInRedirect, unauthenticatedResponse, } from "./sign-in.js";
+export function createProxy(context, options = {}) {
+    const publicPaths = (options.publicPaths ?? []).map(normalizePublicPath);
+    const refreshes = new Map();
+    /**
+     * A page load and the prefetches it triggers arrive together with the same expired
+     * session. They share one refresh instead of each spending the refresh token.
+     */
+    function refreshSession(refreshToken) {
+        const pending = refreshes.get(refreshToken);
+        if (pending !== undefined) {
+            return pending;
+        }
+        const exchange = context
+            .requestToken({ grantType: "refresh_token", refreshToken })
+            .finally(() => refreshes.delete(refreshToken));
+        refreshes.set(refreshToken, exchange);
+        return exchange;
+    }
+    return async function proxy(request) {
+        const pathname = request.nextUrl.pathname;
+        const discovery = wellKnownResponse(request);
+        if (discovery !== undefined) {
+            return discovery;
+        }
+        if (matchesPathPrefix(pathname, SDK_ROUTE_PREFIX) ||
+            publicPaths.some((path) => matchesPathPrefix(pathname, path))) {
+            return NextResponse.next();
+        }
+        const policy = cookiePolicyFor(request.nextUrl, context.config.workspaceId);
+        const accessToken = request.cookies.get(policy.names.session)?.value;
+        if (accessToken !== undefined && accessToken !== "") {
+            const verification = await context.verifyToken(accessToken);
+            if (verification.status === "valid") {
+                return NextResponse.next();
+            }
+            if (verification.status === "unavailable" && hasChannelApps(context.config.channels)) {
+                return sessionUnavailable(context, request, policy);
+            }
+        }
+        const refreshToken = request.cookies.get(policy.names.refresh)?.value;
+        if (refreshToken === undefined || refreshToken === "") {
+            return startSignIn(context, request, policy, accessToken !== undefined);
+        }
+        const exchange = await refreshSession(refreshToken);
+        if (exchange.status === "rejected") {
+            return startSignIn(context, request, policy, true);
+        }
+        if (exchange.status === "unavailable") {
+            return sessionUnavailable(context, request, policy);
+        }
+        const verification = await context.verifyToken(exchange.tokens.accessToken);
+        if (verification.status === "valid") {
+            return continueWithSession(request, policy, exchange.tokens);
+        }
+        if (verification.status === "unavailable") {
+            // The refresh token was rotated; keep the new one even though this request cannot proceed.
+            const response = await sessionUnavailable(context, request, policy);
+            setSessionCookies(response, policy, exchange.tokens);
+            return response;
+        }
+        return startSignIn(context, request, policy, true);
+    };
+}
+const ONTOLOGY_METADATA_PATHS = new Set([
+    "/.well-known/oauth-protected-resource",
+    "/.well-known/oauth-protected-resource/mcp",
+    "/.well-known/oauth-authorization-server",
+]);
+/** Discovery probes never start browser authentication, including probes for unsupported metadata. */
+export function wellKnownResponse(request, ontologyUrl) {
+    const { pathname, search } = request.nextUrl;
+    if (!matchesPathPrefix(pathname, "/.well-known")) {
+        return undefined;
+    }
+    if (ONTOLOGY_METADATA_PATHS.has(pathname)) {
+        return ontologyUrl === undefined
+            ? NextResponse.next()
+            : NextResponse.rewrite(new URL(`${pathname}${search}`, ontologyUrl));
+    }
+    // The issuer is the root origin, so RFC 8414 does not define an AS document suffixed by /mcp.
+    // This service also does not publish OpenID Connect discovery metadata.
+    return NextResponse.json({ error: "not_found" }, { status: 404 });
+}
+/**
+ * SegmentStream is unreachable. APIs and opted-in channel apps get a retryable 503. Other legacy
+ * pages restart sign-in, which ends on the callback's error page. Channel apps must not exchange a
+ * different identity after failed verification. Session cookies are kept.
+ */
+async function sessionUnavailable(context, request, policy) {
+    if (isApiRequest(request) || hasChannelApps(context.config.channels)) {
+        return NextResponse.json({ error: "session_refresh_unavailable" }, { status: 503, headers: { "cache-control": "no-store", "retry-after": "5" } });
+    }
+    return startSignIn(context, request, policy, false);
+}
+async function startSignIn(context, request, policy, clearSession) {
+    if (isApiRequest(request)) {
+        const response = unauthenticatedResponse();
+        if (clearSession) {
+            clearSessionCookies(response, policy);
+        }
+        return response;
+    }
+    const returnTo = safeReturnTo(`${request.nextUrl.pathname}${request.nextUrl.search}`);
+    return signInRedirect({ config: context.config, request, returnTo, clearSession });
+}
+/**
+ * Lets the current request render with the refreshed session. Response cookies set
+ * through `NextResponse.cookies` are merged into `cookies()` by Next.js, and the
+ * rewritten `Cookie` request header covers Route Handlers that read `request.cookies`.
+ */
+function continueWithSession(request, policy, tokens) {
+    const requestHeaders = new Headers(request.headers);
+    requestHeaders.set("cookie", replaceRequestCookies(request.headers.get("cookie"), {
+        [policy.names.session]: tokens.accessToken,
+        [policy.names.refresh]: tokens.refreshToken,
+    }));
+    const response = NextResponse.next({ request: { headers: requestHeaders } });
+    setSessionCookies(response, policy, tokens);
+    return response;
+}
+export function normalizePublicPath(path) {
+    const withLeadingSlash = path.startsWith("/") ? path : `/${path}`;
+    const trimmed = trimTrailingSlashes(withLeadingSlash);
+    return trimmed === "" ? "/" : trimmed;
+}
+export function matchesPathPrefix(pathname, prefix) {
+    if (prefix === "/") {
+        return true;
+    }
+    return pathname === prefix || pathname.startsWith(`${prefix}/`);
+}

package/dist/request-timing.d.ts

@@ -0,0 +1,6 @@
+/**
+ * Time an app Route Handler until it returns response headers. Streaming/rendering after that
+ * point is excluded. Logs contain no URL, cookies, body or error text. Server Components need
+ * framework instrumentation for complete page timing; a Next.js proxy only times authentication.
+ */
+export declare function withRequestTiming<R extends Request, A extends unknown[]>(handler: (request: R, ...args: A) => Promise<Response>): (request: R, ...args: A) => Promise<Response>;

package/dist/request-timing.js

@@ -0,0 +1,53 @@
+import { unstable_rethrow } from "next/navigation";
+import { getRedirectStatusCodeFromError } from "next/dist/client/components/redirect.js";
+import { isRedirectError } from "next/dist/client/components/redirect-error.js";
+import { getAccessFallbackHTTPStatus, isHTTPAccessFallbackError, } from "next/dist/client/components/http-access-fallback/http-access-fallback.js";
+/**
+ * Time an app Route Handler until it returns response headers. Streaming/rendering after that
+ * point is excluded. Logs contain no URL, cookies, body or error text. Server Components need
+ * framework instrumentation for complete page timing; a Next.js proxy only times authentication.
+ */
+export function withRequestTiming(handler) {
+    return async (request, ...args) => {
+        const started = performance.now();
+        const requestId = crypto.randomUUID();
+        let status = 500;
+        let durationMs;
+        try {
+            const response = await handler(request, ...args);
+            const headers = new Headers(response.headers);
+            durationMs = Math.round((performance.now() - started) * 100) / 100;
+            status = response.status;
+            headers.append("server-timing", `app;dur=${durationMs}`);
+            headers.set("x-request-id", requestId);
+            return new Response(response.body, {
+                status,
+                statusText: response.statusText,
+                headers,
+            });
+        }
+        catch (error) {
+            try {
+                unstable_rethrow(error);
+            }
+            catch {
+                // Next owns the eventual response for control-flow exceptions, outside this wrapper.
+                status = isRedirectError(error)
+                    ? getRedirectStatusCodeFromError(error)
+                    : isHTTPAccessFallbackError(error)
+                        ? getAccessFallbackHTTPStatus(error)
+                        : null;
+            }
+            throw error;
+        }
+        finally {
+            console.info(JSON.stringify({
+                event: "app.request",
+                requestId,
+                method: request.method,
+                status,
+                durationMs: durationMs ?? Math.round((performance.now() - started) * 100) / 100,
+            }));
+        }
+    };
+}

package/dist/return-to.d.ts

@@ -0,0 +1,2 @@
+/** Reduces a return path to a same-origin relative path, falling back to `/`. */
+export declare function safeReturnTo(value: string | null | undefined): string;

package/dist/return-to.js

@@ -0,0 +1,24 @@
+/** Reduces a return path to a same-origin relative path, falling back to `/`. */
+export function safeReturnTo(value) {
+    if (typeof value !== "string" ||
+        !value.startsWith("/") ||
+        value.startsWith("//") ||
+        value.startsWith("/\\")) {
+        return "/";
+    }
+    if (/[\u0000-\u001f\u007f]/.test(value)) {
+        return "/";
+    }
+    const placeholderOrigin = "https://return-to.invalid";
+    let url;
+    try {
+        url = new URL(value, placeholderOrigin);
+    }
+    catch {
+        return "/";
+    }
+    if (url.origin !== placeholderOrigin) {
+        return "/";
+    }
+    return `${url.pathname}${url.search}${url.hash}`;
+}

package/dist/server.d.ts

@@ -0,0 +1,11 @@
+import type { AppContext } from "./context.js";
+import type { AppUser } from "./tokens.js";
+export interface ServerSession {
+    readonly getUser: () => Promise<AppUser | null>;
+    readonly requireUser: () => Promise<AppUser>;
+    readonly getAccessToken: () => Promise<string | null>;
+    readonly signOut: (options?: {
+        readonly redirectTo?: string;
+    }) => Promise<never>;
+}
+export declare function createServerSession(context: AppContext): ServerSession;

package/dist/server.js

@@ -0,0 +1,80 @@
+import { cookies, headers } from "next/headers";
+import { redirect } from "next/navigation";
+import { cookiePolicyFor, isLoopbackHostname, safeReturnTo, sessionCookieCandidates, } from "./cookies.js";
+import { SIGNED_OUT_PATH, SIGN_IN_PATH } from "./sign-in.js";
+export function createServerSession(context) {
+    async function verifiedSession() {
+        const cookieStore = await cookies();
+        const headerStore = await headers();
+        const hostname = hostnameOf(headerStore.get("host"));
+        for (const name of sessionCookieCandidates(hostname, context.config.workspaceId)) {
+            const token = cookieStore.get(name)?.value;
+            if (token === undefined || token === "") {
+                continue;
+            }
+            const verification = await context.verifyToken(token);
+            if (verification.status === "valid") {
+                return verification;
+            }
+        }
+        return null;
+    }
+    async function getUser() {
+        const session = await verifiedSession();
+        // Ontology roles come with Neon Auth; the legacy sign-in has none.
+        return session === null ? null : { ...session.user, roles: [], permissions: [] };
+    }
+    async function requireUser() {
+        const user = await getUser();
+        if (user === null) {
+            // `unauthorized()` needs the experimental `authInterrupts` flag, so restart sign-in instead.
+            redirect(SIGN_IN_PATH);
+        }
+        return user;
+    }
+    async function getAccessToken() {
+        const session = await verifiedSession();
+        return session?.token ?? null;
+    }
+    /** Revokes the app session and clears its cookies, as `POST /api/segmentstream/sign-out` does. */
+    async function signOut(options = {}) {
+        const cookieStore = await cookies();
+        const hostname = hostnameOf((await headers()).get("host"));
+        const policies = [
+            cookiePolicyFor(new URL("https://app.invalid"), context.config.workspaceId),
+            ...(isLoopbackHostname(hostname)
+                ? [cookiePolicyFor(new URL("http://localhost"), context.config.workspaceId)]
+                : []),
+        ];
+        for (const policy of policies) {
+            const refreshToken = cookieStore.get(policy.names.refresh)?.value;
+            if (refreshToken !== undefined && refreshToken !== "") {
+                await context.revokeSession(refreshToken);
+            }
+            for (const name of [policy.names.session, policy.names.refresh]) {
+                // `__Host-` cookies are only replaced when the clearing cookie repeats Secure and Path=/.
+                cookieStore.set(name, "", {
+                    httpOnly: true,
+                    secure: policy.secure,
+                    sameSite: "lax",
+                    path: "/",
+                    maxAge: 0,
+                    expires: new Date(0),
+                });
+            }
+        }
+        redirect(safeReturnTo(options.redirectTo ?? SIGNED_OUT_PATH));
+    }
+    return { getUser, requireUser, getAccessToken, signOut };
+}
+function hostnameOf(host) {
+    if (host === null || host === "") {
+        return "";
+    }
+    try {
+        return new URL(`http://${host}`).hostname;
+    }
+    catch {
+        return "";
+    }
+}

package/dist/sessions.d.ts

@@ -0,0 +1,27 @@
+import type { ResolvedConfig } from "./config.js";
+import type { SessionTokens } from "./cookies.js";
+export type Fetch = typeof fetch;
+export type TokenGrant = {
+    readonly grantType: "authorization_code";
+    readonly code: string;
+    readonly codeVerifier: string;
+    readonly redirectUri: string;
+} | {
+    readonly grantType: "refresh_token";
+    readonly refreshToken: string;
+};
+export type TokenExchange = {
+    readonly status: "issued";
+    readonly tokens: SessionTokens;
+} | {
+    readonly status: "rejected";
+    readonly httpStatus: number;
+    readonly code: string | null;
+} | {
+    readonly status: "unavailable";
+};
+/** Calls the SegmentStream app-session endpoints from the app's server. */
+export declare function createSessionClient(config: ResolvedConfig, fetchImplementation: Fetch): {
+    requestToken: (grant: TokenGrant) => Promise<TokenExchange>;
+    revoke: (refreshToken: string) => Promise<void>;
+};

package/dist/sessions.js

@@ -0,0 +1,72 @@
+const REQUEST_TIMEOUT_MS = 10_000;
+/** Calls the SegmentStream app-session endpoints from the app's server. */
+export function createSessionClient(config, fetchImplementation) {
+    async function post(path, body) {
+        return fetchImplementation(`${config.baseUrl}${path}`, {
+            method: "POST",
+            headers: { "content-type": "application/json", accept: "application/json" },
+            body: JSON.stringify(body),
+            cache: "no-store",
+            redirect: "error",
+            signal: AbortSignal.timeout(REQUEST_TIMEOUT_MS),
+        });
+    }
+    async function requestToken(grant) {
+        let response;
+        try {
+            response = await post("/api/v1/app-sessions/token", grant);
+        }
+        catch {
+            return { status: "unavailable" };
+        }
+        const body = await readJson(response);
+        if (response.ok) {
+            const tokens = sessionTokensFrom(body);
+            return tokens === null ? { status: "unavailable" } : { status: "issued", tokens };
+        }
+        if (response.status >= 500 || response.status === 429) {
+            return { status: "unavailable" };
+        }
+        return { status: "rejected", httpStatus: response.status, code: errorCodeFrom(body) };
+    }
+    async function revoke(refreshToken) {
+        try {
+            const response = await post("/api/v1/app-sessions/revoke", { refreshToken });
+            await response.body?.cancel();
+        }
+        catch {
+            // Sign-out is best effort: the local cookies are cleared either way.
+        }
+    }
+    return { requestToken, revoke };
+}
+async function readJson(response) {
+    try {
+        return await response.json();
+    }
+    catch {
+        return null;
+    }
+}
+function sessionTokensFrom(body) {
+    if (typeof body !== "object" || body === null) {
+        return null;
+    }
+    const { accessToken, expiresIn, refreshToken } = body;
+    if (typeof accessToken !== "string" ||
+        typeof refreshToken !== "string" ||
+        typeof expiresIn !== "number") {
+        return null;
+    }
+    if (accessToken === "" || refreshToken === "" || !Number.isFinite(expiresIn) || expiresIn <= 0) {
+        return null;
+    }
+    return { accessToken, expiresIn, refreshToken };
+}
+function errorCodeFrom(body) {
+    if (typeof body !== "object" || body === null) {
+        return null;
+    }
+    const { error } = body;
+    return typeof error === "string" ? error : null;
+}

package/dist/sign-in.d.ts

@@ -0,0 +1,37 @@
+import { NextResponse } from "next/server";
+import type { NextRequest } from "next/server";
+import type { ResolvedConfig } from "./config.js";
+export declare const SDK_ROUTE_PREFIX = "/api/segmentstream";
+export declare const CALLBACK_PATH = "/api/segmentstream/callback";
+export declare const SIGN_IN_PATH = "/api/segmentstream/sign-in";
+export declare const SIGNED_OUT_PATH = "/api/segmentstream/signed-out";
+/**
+ * Requests that cannot follow a cross-origin sign-in redirect: anything other than a
+ * top-level page navigation. They receive a 401 instead of a redirect.
+ */
+export declare function isApiRequest(request: NextRequest): boolean;
+/**
+ * Machine-readable lifecycle signals let the workspace choose its recovery UI. No request is
+ * replayed and a permanently pinned page is never put into an automatic reload loop.
+ */
+export declare function revisionUnavailableResponse(_request: Request, cause?: unknown): NextResponse;
+export declare function unauthenticatedResponse(): NextResponse;
+export interface SignInRedirectInput {
+    readonly config: ResolvedConfig;
+    readonly request: NextRequest;
+    readonly returnTo: string;
+    readonly clearSession: boolean;
+}
+/**
+ * Starts the authorization-code flow with PKCE by redirecting to SegmentStream. Each
+ * sign-in keeps its flow in a cookie named after its `state`, so tabs that start
+ * signing in at the same time do not overwrite each other.
+ */
+export declare function signInRedirect(input: SignInRedirectInput): Promise<NextResponse>;
+export interface AuthorizationUrlInput {
+    readonly config: ResolvedConfig;
+    readonly redirectUri: string;
+    readonly state: string;
+    readonly codeChallenge: string;
+}
+export declare function authorizationUrl(input: AuthorizationUrlInput): URL;

package/dist/sign-in.js

@@ -0,0 +1,95 @@
+import { NextResponse } from "next/server";
+import { MAX_PENDING_AUTH_FLOWS, clearCookie, clearSessionCookies, cookiePolicyFor, pendingAuthFlowCookies, setAuthFlowCookie, } from "./cookies.js";
+import { createCodeChallenge, randomToken } from "./pkce.js";
+import { SegmentStreamApiError } from "./errors.js";
+export const SDK_ROUTE_PREFIX = "/api/segmentstream";
+export const CALLBACK_PATH = `${SDK_ROUTE_PREFIX}/callback`;
+export const SIGN_IN_PATH = `${SDK_ROUTE_PREFIX}/sign-in`;
+export const SIGNED_OUT_PATH = `${SDK_ROUTE_PREFIX}/signed-out`;
+/** Longer return paths are dropped so several pending sign-ins still fit in request headers. */
+const MAX_RETURN_TO_LENGTH = 1024;
+/**
+ * Requests that cannot follow a cross-origin sign-in redirect: anything other than a
+ * top-level page navigation. They receive a 401 instead of a redirect.
+ */
+export function isApiRequest(request) {
+    if (request.method !== "GET") {
+        return true;
+    }
+    if (request.nextUrl.pathname === "/api" || request.nextUrl.pathname.startsWith("/api/")) {
+        return true;
+    }
+    // Next.js strips some Flight headers before Proxy runs; `_rsc` and Accept still identify those requests.
+    if (request.headers.get("purpose") === "prefetch" ||
+        request.headers.get("sec-purpose")?.includes("prefetch"))
+        return true;
+    const flightHeaders = ["rsc", "next-router-prefetch", "next-router-state-tree", "next-action"];
+    if (flightHeaders.some((header) => request.headers.has(header)) ||
+        request.nextUrl.searchParams.has("_rsc")) {
+        return true;
+    }
+    return !(request.headers.get("accept") ?? "").includes("text/html");
+}
+/**
+ * Machine-readable lifecycle signals let the workspace choose its recovery UI. No request is
+ * replayed and a permanently pinned page is never put into an automatic reload loop.
+ */
+export function revisionUnavailableResponse(_request, cause) {
+    const failure = cause instanceof SegmentStreamApiError
+        ? cause
+        : new SegmentStreamApiError({
+            code: "browser_auth_configuration_unavailable",
+            status: 503,
+            detail: "browser_auth_configuration_unavailable",
+            retryable: true,
+        });
+    return NextResponse.json({ error: failure.code, retryable: failure.retryable }, {
+        status: failure.status,
+        headers: {
+            "cache-control": "no-store",
+            "x-segmentstream-error": failure.code,
+            ...(failure.code === "deployment_switching" ? { "retry-after": "1" } : {}),
+        },
+    });
+}
+export function unauthenticatedResponse() {
+    return NextResponse.json({ error: "unauthenticated" }, { status: 401, headers: { "cache-control": "no-store" } });
+}
+/**
+ * Starts the authorization-code flow with PKCE by redirecting to SegmentStream. Each
+ * sign-in keeps its flow in a cookie named after its `state`, so tabs that start
+ * signing in at the same time do not overwrite each other.
+ */
+export async function signInRedirect(input) {
+    const { config, request, clearSession } = input;
+    const policy = cookiePolicyFor(request.nextUrl, config.workspaceId);
+    const state = randomToken();
+    const codeVerifier = randomToken();
+    const codeChallenge = await createCodeChallenge(codeVerifier);
+    const redirectUri = `${request.nextUrl.origin}${CALLBACK_PATH}`;
+    const returnTo = input.returnTo.length <= MAX_RETURN_TO_LENGTH ? input.returnTo : "/";
+    const authorizeUrl = authorizationUrl({ config, redirectUri, state, codeChallenge });
+    const response = NextResponse.redirect(authorizeUrl, 307);
+    const pending = pendingAuthFlowCookies(policy, request.cookies.getAll().map((cookie) => cookie.name));
+    response.headers.set("cache-control", "no-store");
+    if (pending.length >= MAX_PENDING_AUTH_FLOWS) {
+        for (const name of pending) {
+            clearCookie(response, policy, name);
+        }
+    }
+    setAuthFlowCookie(response, policy, { state, codeVerifier, redirectUri, returnTo });
+    if (clearSession) {
+        clearSessionCookies(response, policy);
+    }
+    return response;
+}
+export function authorizationUrl(input) {
+    const url = new URL(`${input.config.baseUrl}/auth/apps/authorize`);
+    url.searchParams.set("workspace_id", input.config.workspaceId);
+    url.searchParams.set("organization_id", input.config.organizationId);
+    url.searchParams.set("redirect_uri", input.redirectUri);
+    url.searchParams.set("state", input.state);
+    url.searchParams.set("code_challenge", input.codeChallenge);
+    url.searchParams.set("code_challenge_method", "S256");
+    return url;
+}