@spfn/auth 0.2.0-beta.8 → 0.2.0-beta.81

package/dist/nextjs/server.js

@@ -5,8 +5,157 @@ import "server-only";
 import { redirect } from "next/navigation";
 
 // src/nextjs/session-helpers.ts
+import * as jose2 from "jose";
 import { cookies } from "next/headers.js";
-import { sealSession, unsealSession, COOKIE_NAMES, getSessionTtl, parseDuration } from "@spfn/auth/server";
+
+// src/server/lib/session.ts
+import * as jose from "jose";
+import { env } from "@spfn/auth/config";
+import { env as coreEnv } from "@spfn/core/config";
+
+// src/server/logger.ts
+import { logger as rootLogger } from "@spfn/core/logger";
+var authLogger = {
+  plugin: rootLogger.child("@spfn/auth:plugin"),
+  middleware: rootLogger.child("@spfn/auth:middleware"),
+  interceptor: {
+    general: rootLogger.child("@spfn/auth:interceptor:general"),
+    login: rootLogger.child("@spfn/auth:interceptor:login"),
+    keyRotation: rootLogger.child("@spfn/auth:interceptor:key-rotation"),
+    oauth: rootLogger.child("@spfn/auth:interceptor:oauth")
+  },
+  session: rootLogger.child("@spfn/auth:session"),
+  service: rootLogger.child("@spfn/auth:service"),
+  setup: rootLogger.child("@spfn/auth:setup"),
+  email: rootLogger.child("@spfn/auth:email"),
+  sms: rootLogger.child("@spfn/auth:sms")
+};
+
+// src/server/lib/session.ts
+async function getSessionSecretKey() {
+  const secret = env.SPFN_AUTH_SESSION_SECRET;
+  const encoder = new TextEncoder();
+  const data = encoder.encode(secret);
+  const hashBuffer = await crypto.subtle.digest("SHA-256", data);
+  return new Uint8Array(hashBuffer);
+}
+async function getSecretFingerprint() {
+  const key = await getSessionSecretKey();
+  const hash = await crypto.subtle.digest("SHA-256", key.buffer);
+  const hex = Array.from(new Uint8Array(hash)).map((b) => b.toString(16).padStart(2, "0")).join("");
+  return hex.slice(0, 8);
+}
+async function sealSession(data, ttl = 60 * 60 * 24 * 7) {
+  const secret = await getSessionSecretKey();
+  const result = await new jose.EncryptJWT({ data }).setProtectedHeader({ alg: "dir", enc: "A256GCM" }).setIssuedAt().setExpirationTime(`${ttl}s`).setIssuer("spfn-auth").setAudience("spfn-client").encrypt(secret);
+  if (coreEnv.NODE_ENV !== "production") {
+    const fingerprint = await getSecretFingerprint();
+    authLogger.session.debug(`Sealed session`, {
+      secretFingerprint: fingerprint,
+      resultLength: result.length,
+      resultPrefix: result.slice(0, 20)
+    });
+  }
+  return result;
+}
+async function unsealSession(jwt) {
+  try {
+    const secret = await getSessionSecretKey();
+    const { payload } = await jose.jwtDecrypt(jwt, secret, {
+      issuer: "spfn-auth",
+      audience: "spfn-client"
+    });
+    return payload.data;
+  } catch (err) {
+    if (err instanceof jose.errors.JWTExpired) {
+      throw new Error("Session expired");
+    }
+    if (err instanceof jose.errors.JWEDecryptionFailed) {
+      if (coreEnv.NODE_ENV !== "production") {
+        const fingerprint = await getSecretFingerprint();
+        authLogger.session.warn(`JWE decryption failed`, {
+          secretFingerprint: fingerprint,
+          jwtLength: jwt.length,
+          jwtPrefix: jwt.slice(0, 20),
+          jwtSuffix: jwt.slice(-10)
+        });
+      }
+      throw new Error("Invalid session");
+    }
+    if (err instanceof jose.errors.JWTClaimValidationFailed) {
+      throw new Error("Session validation failed");
+    }
+    throw new Error("Failed to unseal session");
+  }
+}
+
+// src/server/lib/config.ts
+import { env as env2 } from "@spfn/auth/config";
+function getCookieSuffix() {
+  const port = process.env.PORT;
+  return port ? `_${port}` : "";
+}
+var COOKIE_NAMES = {
+  /** Encrypted session data (userId, privateKey, keyId, algorithm) */
+  get SESSION() {
+    return `spfn_session${getCookieSuffix()}`;
+  },
+  /** Current key ID (for key rotation) */
+  get SESSION_KEY_ID() {
+    return `spfn_session_key_id${getCookieSuffix()}`;
+  },
+  /** Pending OAuth session (privateKey, keyId, algorithm) - temporary during OAuth flow */
+  get OAUTH_PENDING() {
+    return `spfn_oauth_pending${getCookieSuffix()}`;
+  },
+  /** OAuth CSRF nonce — double-submit against the (encrypted) state.nonce at callback */
+  get OAUTH_CSRF() {
+    return `spfn_oauth_csrf${getCookieSuffix()}`;
+  }
+};
+function parseDuration(duration) {
+  if (typeof duration === "number") {
+    return duration;
+  }
+  const match = duration.match(/^(\d+)([dhms]?)$/);
+  if (!match) {
+    throw new Error(`Invalid duration format: ${duration}. Use format like '30d', '12h', '45m', '3600s', or plain number.`);
+  }
+  const value = parseInt(match[1], 10);
+  const unit = match[2] || "s";
+  switch (unit) {
+    case "d":
+      return value * 24 * 60 * 60;
+    case "h":
+      return value * 60 * 60;
+    case "m":
+      return value * 60;
+    case "s":
+      return value;
+    default:
+      throw new Error(`Unknown duration unit: ${unit}`);
+  }
+}
+var globalConfig = {
+  sessionTtl: "7d"
+  // Default: 7 days
+};
+function getSessionTtl(override) {
+  if (override !== void 0) {
+    return parseDuration(override);
+  }
+  if (globalConfig.sessionTtl !== void 0) {
+    return parseDuration(globalConfig.sessionTtl);
+  }
+  const envTtl = env2.SPFN_AUTH_SESSION_TTL;
+  if (envTtl) {
+    return parseDuration(envTtl);
+  }
+  return 7 * 24 * 60 * 60;
+}
+
+// src/nextjs/session-helpers.ts
+import { env as env3 } from "@spfn/auth/config";
 import { logger } from "@spfn/core/logger";
 async function saveSession(data, options) {
   let maxAge;
@@ -20,7 +169,7 @@ async function saveSession(data, options) {
   cookieStore.set(COOKIE_NAMES.SESSION, token, {
     httpOnly: true,
     secure: process.env.NODE_ENV === "production",
-    sameSite: "strict",
+    sameSite: "lax",
     path: "/",
     maxAge
   });
@@ -32,13 +181,12 @@ async function getSession() {
     return null;
   }
   try {
-    logger.debug("Validating session cookie", { cookie: sessionCookie.value });
+    logger.debug("Validating session cookie", { present: true });
     const session = await unsealSession(sessionCookie.value);
     return {
       userId: session.userId
     };
   } catch (error) {
-    console.error(error);
     logger.debug("Session validation failed", {
       error: error instanceof Error ? error.message : String(error)
     });
@@ -50,30 +198,47 @@ async function clearSession() {
   cookieStore.delete(COOKIE_NAMES.SESSION);
   cookieStore.delete(COOKIE_NAMES.SESSION_KEY_ID);
 }
-
-// src/nextjs/guards/require-auth.tsx
-import { Fragment, jsx } from "react/jsx-runtime";
-async function RequireAuth({
-  children,
-  redirectTo = "/auth/login",
-  fallback
-}) {
-  const session = await getSession();
-  if (!session) {
-    if (fallback) {
-      return /* @__PURE__ */ jsx(Fragment, { children: fallback });
-    }
-    redirect(redirectTo);
+async function getPendingSessionKey() {
+  const secret = env3.SPFN_AUTH_SESSION_SECRET;
+  const encoder = new TextEncoder();
+  const data = encoder.encode(`oauth-pending:${secret}`);
+  const hashBuffer = await crypto.subtle.digest("SHA-256", data);
+  return new Uint8Array(hashBuffer);
+}
+async function sealPendingSession(data, ttl = 600) {
+  const key = await getPendingSessionKey();
+  return await new jose2.EncryptJWT({ data }).setProtectedHeader({ alg: "dir", enc: "A256GCM" }).setIssuedAt().setExpirationTime(`${ttl}s`).setIssuer("spfn-auth").setAudience("spfn-oauth").encrypt(key);
+}
+async function unsealPendingSession(jwt) {
+  const key = await getPendingSessionKey();
+  const { payload } = await jose2.jwtDecrypt(jwt, key, {
+    issuer: "spfn-auth",
+    audience: "spfn-oauth"
+  });
+  return payload.data;
+}
+async function getPendingSession() {
+  const cookieStore = await cookies();
+  const pendingCookie = cookieStore.get(COOKIE_NAMES.OAUTH_PENDING);
+  if (!pendingCookie) {
+    return null;
+  }
+  try {
+    return await unsealPendingSession(pendingCookie.value);
+  } catch (error) {
+    logger.debug("Pending session validation failed", {
+      error: error instanceof Error ? error.message : String(error)
+    });
+    return null;
   }
-  return /* @__PURE__ */ jsx(Fragment, { children });
 }
-
-// src/nextjs/guards/require-role.tsx
-import { redirect as redirect2 } from "next/navigation";
+async function clearPendingSession() {
+  const cookieStore = await cookies();
+  cookieStore.delete(COOKIE_NAMES.OAUTH_PENDING);
+}
 
 // src/nextjs/guards/auth-utils.ts
 import { authApi } from "@spfn/auth";
-import { authLogger } from "@spfn/auth/server";
 async function getAuthSessionData() {
   try {
     const session = await authApi.getAuthSession.call();
@@ -111,7 +276,29 @@ async function hasAnyPermission(requiredPermissions) {
   return requiredPermissions.some((permission) => userPermissionNames.includes(permission));
 }
 
+// src/nextjs/guards/require-auth.tsx
+import { Fragment, jsx } from "react/jsx-runtime";
+async function RequireAuth({
+  children,
+  redirectTo = "/auth/login",
+  fallback
+}) {
+  const session = await getSession();
+  if (!session) {
+    if (fallback) {
+      return /* @__PURE__ */ jsx(Fragment, { children: fallback });
+    }
+    redirect(redirectTo);
+  }
+  const serverSession = await getAuthSessionData();
+  if (!serverSession) {
+    redirect(redirectTo);
+  }
+  return /* @__PURE__ */ jsx(Fragment, { children });
+}
+
 // src/nextjs/guards/require-role.tsx
+import { redirect as redirect2 } from "next/navigation";
 import { Fragment as Fragment2, jsx as jsx2 } from "react/jsx-runtime";
 async function RequireRole({
   roles,
@@ -163,16 +350,93 @@ async function RequirePermission({
   }
   return /* @__PURE__ */ jsx3(Fragment3, { children });
 }
+
+// src/nextjs/oauth-handlers.ts
+import { NextResponse } from "next/server";
+import { cookies as cookies2 } from "next/headers.js";
+import { env as env4 } from "@spfn/core/config";
+import { logger as logger2 } from "@spfn/core/logger";
+function createOAuthCallbackHandler(options) {
+  const defaultRedirect = options?.defaultRedirectUrl || "/";
+  const errorRedirect = options?.errorRedirectUrl || "/auth/error";
+  return async (request) => {
+    const searchParams = request.nextUrl.searchParams;
+    const userId = searchParams.get("userId");
+    const keyId = searchParams.get("keyId");
+    const returnUrl = searchParams.get("returnUrl") || defaultRedirect;
+    const error = searchParams.get("error");
+    if (error) {
+      const errorUrl = new URL(errorRedirect, request.url);
+      errorUrl.searchParams.set("error", error);
+      return NextResponse.redirect(errorUrl);
+    }
+    if (!userId || !keyId) {
+      logger2.error("OAuth callback missing required params", { userId: !!userId, keyId: !!keyId });
+      const errorUrl = new URL(errorRedirect, request.url);
+      errorUrl.searchParams.set("error", "Missing required parameters");
+      return NextResponse.redirect(errorUrl);
+    }
+    try {
+      const cookieStore = await cookies2();
+      const pendingCookie = cookieStore.get(COOKIE_NAMES.OAUTH_PENDING);
+      if (!pendingCookie) {
+        throw new Error("OAuth session expired. Please try again.");
+      }
+      const pendingSession = await unsealPendingSession(pendingCookie.value);
+      if (pendingSession.keyId !== keyId) {
+        throw new Error("Session mismatch. Please try again.");
+      }
+      const ttl = getSessionTtl();
+      const sessionToken = await sealSession({
+        userId,
+        privateKey: pendingSession.privateKey,
+        keyId: pendingSession.keyId,
+        algorithm: pendingSession.algorithm
+      }, ttl);
+      const redirectUrl = new URL(returnUrl, request.url);
+      const response = NextResponse.redirect(redirectUrl);
+      response.cookies.set(COOKIE_NAMES.SESSION, sessionToken, {
+        httpOnly: true,
+        secure: env4.NODE_ENV === "production",
+        sameSite: "lax",
+        maxAge: ttl,
+        path: "/"
+      });
+      response.cookies.set(COOKIE_NAMES.SESSION_KEY_ID, keyId, {
+        httpOnly: true,
+        secure: env4.NODE_ENV === "production",
+        sameSite: "lax",
+        maxAge: ttl,
+        path: "/"
+      });
+      response.cookies.delete(COOKIE_NAMES.OAUTH_PENDING);
+      logger2.debug("OAuth callback completed", { userId, keyId });
+      return response;
+    } catch (error2) {
+      const err = error2;
+      logger2.error("OAuth callback failed", { error: err.message });
+      const errorUrl = new URL(errorRedirect, request.url);
+      errorUrl.searchParams.set("error", err.message);
+      return NextResponse.redirect(errorUrl);
+    }
+  };
+}
 export {
   RequireAuth,
   RequirePermission,
   RequireRole,
+  clearPendingSession,
   clearSession,
+  createOAuthCallbackHandler,
+  getAuthSessionData,
+  getPendingSession,
   getSession,
   getUserPermissions,
   getUserRole,
   hasAnyPermission,
   hasAnyRole,
-  saveSession
+  saveSession,
+  sealPendingSession,
+  unsealPendingSession
 };
 //# sourceMappingURL=server.js.map

package/dist/nextjs/server.js.map

@@ -1 +1 @@
-{"version":3,"sources":["../../src/nextjs/server.ts","../../src/nextjs/guards/require-auth.tsx","../../src/nextjs/session-helpers.ts","../../src/nextjs/guards/require-role.tsx","../../src/nextjs/guards/auth-utils.ts","../../src/nextjs/guards/require-permission.tsx"],"sourcesContent":["import \"server-only\";\n\nexport { RequireAuth } from './guards/require-auth';\nexport type { RequireAuthProps } from './guards/require-auth';\n\nexport { RequireRole } from './guards/require-role';\nexport type { RequireRoleProps } from './guards/require-role';\n\nexport { RequirePermission } from './guards/require-permission';\nexport type { RequirePermissionProps } from './guards/require-permission';\n\nexport { getUserRole, getUserPermissions, hasAnyRole, hasAnyPermission } from './guards/auth-utils';\n\n// Session helpers\nexport {\n    saveSession,\n    getSession,\n    clearSession,\n    type SessionData,\n    type PublicSession,\n    type SaveSessionOptions\n} from './session-helpers';","/**\n * RequireAuth Guard Component\n *\n * Requires user to be authenticated\n */\n\nimport { redirect } from 'next/navigation';\nimport { getSession } from '../session-helpers';\nimport type { ReactNode } from 'react';\n\nexport interface RequireAuthProps\n{\n    /**\n     * Children to render if authenticated\n     */\n    children: ReactNode;\n\n    /**\n     * Path to redirect to if not authenticated\n     * @default '/login'\n     */\n    redirectTo?: string;\n\n    /**\n     * Fallback UI to show instead of redirecting\n     */\n    fallback?: ReactNode;\n}\n\n/**\n * Require Authentication Guard\n *\n * Ensures user is logged in before rendering children\n *\n * @example\n * ```tsx\n * <RequireAuth redirectTo=\"/login\">\n *   <DashboardContent />\n * </RequireAuth>\n * ```\n *\n * @example With fallback\n * ```tsx\n * <RequireAuth fallback={<LoginPrompt />}>\n *   <PrivateContent />\n * </RequireAuth>\n * ```\n */\nexport async function RequireAuth({\n    children,\n    redirectTo = '/auth/login',\n    fallback,\n}: RequireAuthProps)\n{\n    const session = await getSession();\n\n    if (!session)\n    {\n        if (fallback)\n        {\n            return <>{fallback}</>;\n        }\n\n        redirect(redirectTo);\n    }\n\n    return <>{children}</>;\n}","/**\n * Session helpers for Next.js\n *\n * Server-side only (uses next/headers)\n */\n\nimport { cookies } from 'next/headers.js';\nimport { sealSession, unsealSession, COOKIE_NAMES, getSessionTtl, parseDuration, type SessionData } from '@spfn/auth/server';\nimport { logger } from '@spfn/core/logger';\n\nexport type { SessionData };\n\n/**\n * Public session information (excludes sensitive data)\n */\nexport interface PublicSession\n{\n    /** User ID */\n    userId: string;\n}\n\n/**\n * Options for saveSession\n */\nexport interface SaveSessionOptions\n{\n    /**\n     * Session TTL (time to live)\n     *\n     * Supports:\n     * - Number: seconds (e.g., 2592000)\n     * - String: duration format ('30d', '12h', '45m', '3600s')\n     *\n     * If not provided, uses global configuration:\n     * 1. Global config (configureAuth)\n     * 2. Environment variable (SPFN_AUTH_SESSION_TTL)\n     * 3. Default (7d)\n     */\n    maxAge?: number | string;\n\n    /**\n     * Remember me option\n     *\n     * When true, uses extended session duration (if configured)\n     */\n    remember?: boolean;\n}\n\n/**\n * Save session to HttpOnly cookie\n *\n * @param data - Session data to save\n * @param options - Session options (maxAge, remember)\n *\n * @example\n * ```typescript\n * // Use global configuration\n * await saveSession(sessionData);\n *\n * // Custom TTL with duration string\n * await saveSession(sessionData, { maxAge: '30d' });\n *\n * // Custom TTL in seconds\n * await saveSession(sessionData, { maxAge: 2592000 });\n *\n * // Remember me\n * await saveSession(sessionData, { remember: true });\n * ```\n */\nexport async function saveSession(\n    data: SessionData,\n    options?: SaveSessionOptions\n): Promise<void>\n{\n    // Calculate maxAge\n    let maxAge: number;\n\n    if (options?.maxAge !== undefined)\n    {\n        // Custom maxAge provided\n        maxAge = typeof options.maxAge === 'number'\n            ? options.maxAge\n            : parseDuration(options.maxAge);\n    }\n    else\n    {\n        // Use getSessionTtl for consistent configuration\n        maxAge = getSessionTtl();\n    }\n\n    const token = await sealSession(data, maxAge);\n    const cookieStore = await cookies();\n\n    cookieStore.set(COOKIE_NAMES.SESSION, token, {\n        httpOnly: true,\n        secure: process.env.NODE_ENV === 'production',\n        sameSite: 'strict',\n        path: '/',\n        maxAge\n    });\n}\n\n/**\n * Get session from HttpOnly cookie\n *\n * Returns public session info only (excludes privateKey, algorithm, keyId)\n */\nexport async function getSession(): Promise<PublicSession | null>\n{\n    const cookieStore = await cookies();\n    const sessionCookie = cookieStore.get(COOKIE_NAMES.SESSION);\n\n    if (!sessionCookie)\n    {\n        return null;\n    }\n\n    try\n    {\n        logger.debug('Validating session cookie', { cookie: sessionCookie.value });\n        const session = await unsealSession(sessionCookie.value);\n        // Return only public information\n        return {\n            userId: session.userId,\n        };\n    }\n    catch (error)\n    {\n        console.error(error);\n\n        // Session expired or invalid - log in dev mode\n        // Note: Cannot delete cookies in Server Components (read-only)\n        // Invalid cookies will be cleaned up on next login/logout via Route Handler or Server Action\n        logger.debug('Session validation failed', {\n            error: error instanceof Error ? error.message : String(error)\n        });\n\n        return null;\n    }\n}\n\n/**\n * Clear session cookie\n */\nexport async function clearSession(): Promise<void>\n{\n    const cookieStore = await cookies();\n    cookieStore.delete(COOKIE_NAMES.SESSION);\n    cookieStore.delete(COOKIE_NAMES.SESSION_KEY_ID);\n}\n","/**\n * RequireRole Guard Component\n *\n * Requires user to have at least one of the specified roles\n */\n\nimport { redirect } from 'next/navigation';\nimport { getSession } from '../session-helpers';\nimport { hasAnyRole } from './auth-utils';\nimport type { ReactNode } from 'react';\n\nexport interface RequireRoleProps\n{\n    /**\n     * Required role(s) - user must have at least one\n     */\n    roles: string | string[];\n\n    /**\n     * Children to render if user has required role\n     */\n    children: ReactNode;\n\n    /**\n     * Path to redirect to if user doesn't have role\n     * @default '/unauthorized'\n     */\n    redirectTo?: string;\n\n    /**\n     * Fallback UI to show instead of redirecting\n     */\n    fallback?: ReactNode;\n}\n\n/**\n * Require Role Guard\n *\n * Ensures user has at least one of the specified roles\n *\n * @example Single role\n * ```tsx\n * <RequireRole roles=\"admin\">\n *   <AdminPanel />\n * </RequireRole>\n * ```\n *\n * @example Multiple roles (OR condition)\n * ```tsx\n * <RequireRole roles={['admin', 'manager']}>\n *   <ManagementDashboard />\n * </RequireRole>\n * ```\n *\n * @example With fallback\n * ```tsx\n * <RequireRole roles=\"admin\" fallback={<AccessDenied />}>\n *   <AdminContent />\n * </RequireRole>\n * ```\n */\nexport async function RequireRole({\n    roles,\n    children,\n    redirectTo = '/unauthorized',\n    fallback,\n}: RequireRoleProps)\n{\n    const session = await getSession();\n\n    // Not authenticated\n    if (!session)\n    {\n        if (fallback)\n        {\n            return <>{fallback}</>;\n        }\n\n        redirect('/login');\n    }\n\n    // Normalize to array\n    const requiredRoles = Array.isArray(roles) ? roles : [roles];\n\n    // Check if user has any of the required roles\n    const hasRole = await hasAnyRole(requiredRoles);\n\n    if (!hasRole)\n    {\n        if (fallback)\n        {\n            return <>{fallback}</>;\n        }\n\n        redirect(redirectTo);\n    }\n\n    return <>{children}</>;\n}","/**\n * Server-side auth utilities for guards\n *\n * Uses authApi to check permissions in real-time\n */\n\nimport { authApi } from '@spfn/auth';\nimport { authLogger } from '@spfn/auth/server';\n\n/**\n * Get current auth session with roles and permissions via API\n */\nasync function getAuthSessionData()\n{\n    try\n    {\n        const session = await authApi.getAuthSession.call();\n        authLogger.middleware.debug('Auth session retrieved', { name: session.role?.name });\n\n        return session;\n    }\n    catch (error)\n    {\n        authLogger.middleware.error('Failed to get auth session', { error });\n        return null;\n    }\n}\n\n/**\n * Get user role\n */\nexport async function getUserRole(): Promise<string | null>\n{\n    const session = await getAuthSessionData();\n    return session?.role?.name || null;\n}\n\n/**\n * Get user permissions\n */\nexport async function getUserPermissions(): Promise<string[]>\n{\n    const session = await getAuthSessionData();\n\n    if (!session)\n    {\n        return [];\n    }\n\n    return session.permissions?.map((p: any) => p.name) || [];\n}\n\n/**\n * Check if user has any of the specified roles\n */\nexport async function hasAnyRole(requiredRoles: string[]): Promise<boolean>\n{\n    const session = await getAuthSessionData();\n    if (!session)\n    {\n        return false;\n    }\n\n    return requiredRoles.includes(session.role?.name);\n}\n\n/**\n * Check if user has any of the specified permissions\n */\nexport async function hasAnyPermission(requiredPermissions: string[]): Promise<boolean>\n{\n    const session = await getAuthSessionData();\n\n    if (!session)\n    {\n        return false;\n    }\n\n    const userPermissionNames = session.permissions?.map((p: any) => p.name) || [];\n    return requiredPermissions.some(permission => userPermissionNames.includes(permission));\n}\n","/**\n * RequirePermission Guard Component\n *\n * Requires user to have at least one of the specified permissions\n */\n\nimport { redirect } from 'next/navigation';\nimport { getSession } from '../session-helpers';\nimport { hasAnyPermission } from './auth-utils';\nimport type { ReactNode } from 'react';\n\nexport interface RequirePermissionProps\n{\n    /**\n     * Required permission(s) - user must have at least one\n     */\n    permissions: string | string[];\n\n    /**\n     * Children to render if user has required permission\n     */\n    children: ReactNode;\n\n    /**\n     * Path to redirect to if user doesn't have permission\n     * @default '/unauthorized'\n     */\n    redirectTo?: string;\n\n    /**\n     * Fallback UI to show instead of redirecting\n     */\n    fallback?: ReactNode;\n}\n\n/**\n * Require Permission Guard\n *\n * Ensures user has at least one of the specified permissions\n *\n * @example Single permission\n * ```tsx\n * <RequirePermission permissions=\"user:delete\">\n *   <DeleteUserButton />\n * </RequirePermission>\n * ```\n *\n * @example Multiple permissions (OR condition)\n * ```tsx\n * <RequirePermission permissions={['user:delete', 'user:update']}>\n *   <UserManagement />\n * </RequirePermission>\n * ```\n *\n * @example With fallback\n * ```tsx\n * <RequirePermission permissions=\"project:create\" fallback={<UpgradePrompt />}>\n *   <CreateProject />\n * </RequirePermission>\n * ```\n */\nexport async function RequirePermission({\n    permissions,\n    children,\n    redirectTo = '/unauthorized',\n    fallback,\n}: RequirePermissionProps)\n{\n    const session = await getSession();\n\n    // Not authenticated\n    if (!session)\n    {\n        if (fallback)\n        {\n            return <>{fallback}</>;\n        }\n\n        redirect('/login');\n    }\n\n    // Normalize to array\n    const requiredPermissions = Array.isArray(permissions) ? permissions : [permissions];\n\n    // Check if user has any of the required permissions\n    const hasPermission = await hasAnyPermission(requiredPermissions);\n\n    if (!hasPermission)\n    {\n        if (fallback)\n        {\n            return <>{fallback}</>;\n        }\n\n        redirect(redirectTo);\n    }\n\n    return <>{children}</>;\n}"],"mappings":";AAAA,OAAO;;;ACMP,SAAS,gBAAgB;;;ACAzB,SAAS,eAAe;AACxB,SAAS,aAAa,eAAe,cAAc,eAAe,qBAAuC;AACzG,SAAS,cAAc;AA6DvB,eAAsB,YAClB,MACA,SAEJ;AAEI,MAAI;AAEJ,MAAI,SAAS,WAAW,QACxB;AAEI,aAAS,OAAO,QAAQ,WAAW,WAC7B,QAAQ,SACR,cAAc,QAAQ,MAAM;AAAA,EACtC,OAEA;AAEI,aAAS,cAAc;AAAA,EAC3B;AAEA,QAAM,QAAQ,MAAM,YAAY,MAAM,MAAM;AAC5C,QAAM,cAAc,MAAM,QAAQ;AAElC,cAAY,IAAI,aAAa,SAAS,OAAO;AAAA,IACzC,UAAU;AAAA,IACV,QAAQ,QAAQ,IAAI,aAAa;AAAA,IACjC,UAAU;AAAA,IACV,MAAM;AAAA,IACN;AAAA,EACJ,CAAC;AACL;AAOA,eAAsB,aACtB;AACI,QAAM,cAAc,MAAM,QAAQ;AAClC,QAAM,gBAAgB,YAAY,IAAI,aAAa,OAAO;AAE1D,MAAI,CAAC,eACL;AACI,WAAO;AAAA,EACX;AAEA,MACA;AACI,WAAO,MAAM,6BAA6B,EAAE,QAAQ,cAAc,MAAM,CAAC;AACzE,UAAM,UAAU,MAAM,cAAc,cAAc,KAAK;AAEvD,WAAO;AAAA,MACH,QAAQ,QAAQ;AAAA,IACpB;AAAA,EACJ,SACO,OACP;AACI,YAAQ,MAAM,KAAK;AAKnB,WAAO,MAAM,6BAA6B;AAAA,MACtC,OAAO,iBAAiB,QAAQ,MAAM,UAAU,OAAO,KAAK;AAAA,IAChE,CAAC;AAED,WAAO;AAAA,EACX;AACJ;AAKA,eAAsB,eACtB;AACI,QAAM,cAAc,MAAM,QAAQ;AAClC,cAAY,OAAO,aAAa,OAAO;AACvC,cAAY,OAAO,aAAa,cAAc;AAClD;;;ADzFmB;AAZnB,eAAsB,YAAY;AAAA,EAC9B;AAAA,EACA,aAAa;AAAA,EACb;AACJ,GACA;AACI,QAAM,UAAU,MAAM,WAAW;AAEjC,MAAI,CAAC,SACL;AACI,QAAI,UACJ;AACI,aAAO,gCAAG,oBAAS;AAAA,IACvB;AAEA,aAAS,UAAU;AAAA,EACvB;AAEA,SAAO,gCAAG,UAAS;AACvB;;;AE7DA,SAAS,YAAAA,iBAAgB;;;ACAzB,SAAS,eAAe;AACxB,SAAS,kBAAkB;AAK3B,eAAe,qBACf;AACI,MACA;AACI,UAAM,UAAU,MAAM,QAAQ,eAAe,KAAK;AAClD,eAAW,WAAW,MAAM,0BAA0B,EAAE,MAAM,QAAQ,MAAM,KAAK,CAAC;AAElF,WAAO;AAAA,EACX,SACO,OACP;AACI,eAAW,WAAW,MAAM,8BAA8B,EAAE,MAAM,CAAC;AACnE,WAAO;AAAA,EACX;AACJ;AAKA,eAAsB,cACtB;AACI,QAAM,UAAU,MAAM,mBAAmB;AACzC,SAAO,SAAS,MAAM,QAAQ;AAClC;AAKA,eAAsB,qBACtB;AACI,QAAM,UAAU,MAAM,mBAAmB;AAEzC,MAAI,CAAC,SACL;AACI,WAAO,CAAC;AAAA,EACZ;AAEA,SAAO,QAAQ,aAAa,IAAI,CAAC,MAAW,EAAE,IAAI,KAAK,CAAC;AAC5D;AAKA,eAAsB,WAAW,eACjC;AACI,QAAM,UAAU,MAAM,mBAAmB;AACzC,MAAI,CAAC,SACL;AACI,WAAO;AAAA,EACX;AAEA,SAAO,cAAc,SAAS,QAAQ,MAAM,IAAI;AACpD;AAKA,eAAsB,iBAAiB,qBACvC;AACI,QAAM,UAAU,MAAM,mBAAmB;AAEzC,MAAI,CAAC,SACL;AACI,WAAO;AAAA,EACX;AAEA,QAAM,sBAAsB,QAAQ,aAAa,IAAI,CAAC,MAAW,EAAE,IAAI,KAAK,CAAC;AAC7E,SAAO,oBAAoB,KAAK,gBAAc,oBAAoB,SAAS,UAAU,CAAC;AAC1F;;;ADLmB,qBAAAC,WAAA,OAAAC,YAAA;AAdnB,eAAsB,YAAY;AAAA,EAC9B;AAAA,EACA;AAAA,EACA,aAAa;AAAA,EACb;AACJ,GACA;AACI,QAAM,UAAU,MAAM,WAAW;AAGjC,MAAI,CAAC,SACL;AACI,QAAI,UACJ;AACI,aAAO,gBAAAA,KAAAD,WAAA,EAAG,oBAAS;AAAA,IACvB;AAEA,IAAAE,UAAS,QAAQ;AAAA,EACrB;AAGA,QAAM,gBAAgB,MAAM,QAAQ,KAAK,IAAI,QAAQ,CAAC,KAAK;AAG3D,QAAM,UAAU,MAAM,WAAW,aAAa;AAE9C,MAAI,CAAC,SACL;AACI,QAAI,UACJ;AACI,aAAO,gBAAAD,KAAAD,WAAA,EAAG,oBAAS;AAAA,IACvB;AAEA,IAAAE,UAAS,UAAU;AAAA,EACvB;AAEA,SAAO,gBAAAD,KAAAD,WAAA,EAAG,UAAS;AACvB;;;AE5FA,SAAS,YAAAG,iBAAgB;AAqEN,qBAAAC,WAAA,OAAAC,YAAA;AAdnB,eAAsB,kBAAkB;AAAA,EACpC;AAAA,EACA;AAAA,EACA,aAAa;AAAA,EACb;AACJ,GACA;AACI,QAAM,UAAU,MAAM,WAAW;AAGjC,MAAI,CAAC,SACL;AACI,QAAI,UACJ;AACI,aAAO,gBAAAA,KAAAD,WAAA,EAAG,oBAAS;AAAA,IACvB;AAEA,IAAAE,UAAS,QAAQ;AAAA,EACrB;AAGA,QAAM,sBAAsB,MAAM,QAAQ,WAAW,IAAI,cAAc,CAAC,WAAW;AAGnF,QAAM,gBAAgB,MAAM,iBAAiB,mBAAmB;AAEhE,MAAI,CAAC,eACL;AACI,QAAI,UACJ;AACI,aAAO,gBAAAD,KAAAD,WAAA,EAAG,oBAAS;AAAA,IACvB;AAEA,IAAAE,UAAS,UAAU;AAAA,EACvB;AAEA,SAAO,gBAAAD,KAAAD,WAAA,EAAG,UAAS;AACvB;","names":["redirect","Fragment","jsx","redirect","redirect","Fragment","jsx","redirect"]}
+{"version":3,"sources":["../../src/nextjs/server.ts","../../src/nextjs/guards/require-auth.tsx","../../src/nextjs/session-helpers.ts","../../src/server/lib/session.ts","../../src/server/logger.ts","../../src/server/lib/config.ts","../../src/nextjs/guards/auth-utils.ts","../../src/nextjs/guards/require-role.tsx","../../src/nextjs/guards/require-permission.tsx","../../src/nextjs/oauth-handlers.ts"],"sourcesContent":["import 'server-only';\n\nexport { RequireAuth } from './guards/require-auth';\nexport type { RequireAuthProps } from './guards/require-auth';\n\nexport { RequireRole } from './guards/require-role';\nexport type { RequireRoleProps } from './guards/require-role';\n\nexport { RequirePermission } from './guards/require-permission';\nexport type { RequirePermissionProps } from './guards/require-permission';\n\nexport { getAuthSessionData, getUserRole, getUserPermissions, hasAnyRole, hasAnyPermission } from './guards/auth-utils';\n\n// Session helpers\nexport {\n    saveSession,\n    getSession,\n    clearSession,\n    // Pending session (OAuth)\n    sealPendingSession,\n    unsealPendingSession,\n    getPendingSession,\n    clearPendingSession,\n    type SessionData,\n    type PublicSession,\n    type SaveSessionOptions,\n    type PendingSessionData,\n} from './session-helpers';\n\n// OAuth handlers\nexport {\n    createOAuthCallbackHandler,\n    type OAuthCallbackOptions,\n} from './oauth-handlers';\n","/**\n * RequireAuth Guard Component\n *\n * Requires user to be authenticated\n */\n\nimport { redirect } from 'next/navigation';\nimport { getSession } from '../session-helpers';\nimport { getAuthSessionData } from './auth-utils';\nimport type { ReactNode } from 'react';\n\nexport interface RequireAuthProps\n{\n    /**\n     * Children to render if authenticated\n     */\n    children: ReactNode;\n\n    /**\n     * Path to redirect to if not authenticated\n     * @default '/login'\n     */\n    redirectTo?: string;\n\n    /**\n     * Fallback UI to show instead of redirecting\n     */\n    fallback?: ReactNode;\n}\n\n/**\n * Require Authentication Guard\n *\n * Ensures user is logged in before rendering children\n *\n * @example\n * ```tsx\n * <RequireAuth redirectTo=\"/login\">\n *   <DashboardContent />\n * </RequireAuth>\n * ```\n *\n * @example With fallback\n * ```tsx\n * <RequireAuth fallback={<LoginPrompt />}>\n *   <PrivateContent />\n * </RequireAuth>\n * ```\n */\nexport async function RequireAuth({\n    children,\n    redirectTo = '/auth/login',\n    fallback,\n}: RequireAuthProps)\n{\n    const session = await getSession();\n\n    if (!session)\n    {\n        if (fallback)\n        {\n            return <>{fallback}</>;\n        }\n\n        redirect(redirectTo);\n    }\n\n    // Validate server-side session (key expiry, user status, etc.)\n    const serverSession = await getAuthSessionData();\n\n    if (!serverSession)\n    {\n        // Note: clearSession() cannot be called in Server Components (Next.js 16+)\n        // The RPC proxy interceptor handles session cleanup on 401 responses\n        redirect(redirectTo);\n    }\n\n    return <>{children}</>;\n}\n","/**\n * Session helpers for Next.js\n *\n * Server-side only (uses next/headers)\n */\n\nimport * as jose from 'jose';\nimport { cookies } from 'next/headers.js';\nimport { sealSession, unsealSession, type SessionData } from '../server/lib/session';\nimport { COOKIE_NAMES, getSessionTtl, parseDuration } from '../server/lib/config';\nimport { type KeyAlgorithmType } from '../server/types';\nimport { env } from '@spfn/auth/config';\nimport { logger } from '@spfn/core/logger';\n\nexport type { SessionData };\n\n/**\n * Pending OAuth session data (before user ID is known)\n */\nexport interface PendingSessionData\n{\n    privateKey: string;\n    keyId: string;\n    algorithm: KeyAlgorithmType;\n}\n\n/**\n * Public session information (excludes sensitive data)\n */\nexport interface PublicSession\n{\n    /** User ID */\n    userId: string;\n}\n\n/**\n * Options for saveSession\n */\nexport interface SaveSessionOptions\n{\n    /**\n     * Session TTL (time to live)\n     *\n     * Supports:\n     * - Number: seconds (e.g., 2592000)\n     * - String: duration format ('30d', '12h', '45m', '3600s')\n     *\n     * If not provided, uses global configuration:\n     * 1. Global config (configureAuth)\n     * 2. Environment variable (SPFN_AUTH_SESSION_TTL)\n     * 3. Default (7d)\n     */\n    maxAge?: number | string;\n\n    /**\n     * Remember me option\n     *\n     * When true, uses extended session duration (if configured)\n     */\n    remember?: boolean;\n}\n\n/**\n * Save session to HttpOnly cookie\n *\n * @param data - Session data to save\n * @param options - Session options (maxAge, remember)\n *\n * @example\n * ```typescript\n * // Use global configuration\n * await saveSession(sessionData);\n *\n * // Custom TTL with duration string\n * await saveSession(sessionData, { maxAge: '30d' });\n *\n * // Custom TTL in seconds\n * await saveSession(sessionData, { maxAge: 2592000 });\n *\n * // Remember me\n * await saveSession(sessionData, { remember: true });\n * ```\n */\nexport async function saveSession(\n    data: SessionData,\n    options?: SaveSessionOptions,\n): Promise<void>\n{\n    // Calculate maxAge\n    let maxAge: number;\n\n    if (options?.maxAge !== undefined)\n    {\n        // Custom maxAge provided\n        maxAge = typeof options.maxAge === 'number'\n            ? options.maxAge\n            : parseDuration(options.maxAge);\n    }\n    else\n    {\n        // Use getSessionTtl for consistent configuration\n        maxAge = getSessionTtl();\n    }\n\n    const token = await sealSession(data, maxAge);\n    const cookieStore = await cookies();\n\n    cookieStore.set(COOKIE_NAMES.SESSION, token, {\n        httpOnly: true,\n        secure: process.env.NODE_ENV === 'production',\n        sameSite: 'lax',\n        path: '/',\n        maxAge,\n    });\n}\n\n/**\n * Get session from HttpOnly cookie\n *\n * Returns public session info only (excludes privateKey, algorithm, keyId)\n */\nexport async function getSession(): Promise<PublicSession | null>\n{\n    const cookieStore = await cookies();\n    const sessionCookie = cookieStore.get(COOKIE_NAMES.SESSION);\n\n    if (!sessionCookie)\n    {\n        return null;\n    }\n\n    try\n    {\n        // Never log the cookie value — it's the sealed session token.\n        logger.debug('Validating session cookie', { present: true });\n        const session = await unsealSession(sessionCookie.value);\n\n        // Return only public information\n        return {\n            userId: session.userId,\n        };\n    }\n    catch (error)\n    {\n        // Session expired or invalid\n        // Note: Cannot delete cookies in Server Components (read-only)\n        // Use validateSessionMiddleware() in Next.js middleware for automatic cleanup\n        logger.debug('Session validation failed', {\n            error: error instanceof Error ? error.message : String(error),\n        });\n\n        return null;\n    }\n}\n\n/**\n * Clear session cookie\n */\nexport async function clearSession(): Promise<void>\n{\n    const cookieStore = await cookies();\n    cookieStore.delete(COOKIE_NAMES.SESSION);\n    cookieStore.delete(COOKIE_NAMES.SESSION_KEY_ID);\n}\n\n// ============================================================================\n// Pending OAuth Session (for OAuth flow)\n// ============================================================================\n\n/**\n * Get encryption key for pending session\n */\nasync function getPendingSessionKey(): Promise<Uint8Array>\n{\n    const secret = env.SPFN_AUTH_SESSION_SECRET;\n    const encoder = new TextEncoder();\n    const data = encoder.encode(`oauth-pending:${secret}`);\n    const hashBuffer = await crypto.subtle.digest('SHA-256', data);\n\n    return new Uint8Array(hashBuffer);\n}\n\n/**\n * Seal pending session data (for OAuth flow)\n *\n * @param data - Pending session data (privateKey, keyId, algorithm)\n * @param ttl - Time to live in seconds (default: 10 minutes)\n */\nexport async function sealPendingSession(\n    data: PendingSessionData,\n    ttl: number = 600,\n): Promise<string>\n{\n    const key = await getPendingSessionKey();\n\n    return await new jose.EncryptJWT({ data })\n        .setProtectedHeader({ alg: 'dir', enc: 'A256GCM' })\n        .setIssuedAt()\n        .setExpirationTime(`${ttl}s`)\n        .setIssuer('spfn-auth')\n        .setAudience('spfn-oauth')\n        .encrypt(key);\n}\n\n/**\n * Unseal pending session data\n *\n * @param jwt - Encrypted pending session token\n */\nexport async function unsealPendingSession(jwt: string): Promise<PendingSessionData>\n{\n    const key = await getPendingSessionKey();\n\n    const { payload } = await jose.jwtDecrypt(jwt, key, {\n        issuer: 'spfn-auth',\n        audience: 'spfn-oauth',\n    });\n\n    return payload.data as PendingSessionData;\n}\n\n/**\n * Get pending session from cookie\n */\nexport async function getPendingSession(): Promise<PendingSessionData | null>\n{\n    const cookieStore = await cookies();\n    const pendingCookie = cookieStore.get(COOKIE_NAMES.OAUTH_PENDING);\n\n    if (!pendingCookie)\n    {\n        return null;\n    }\n\n    try\n    {\n        return await unsealPendingSession(pendingCookie.value);\n    }\n    catch (error)\n    {\n        logger.debug('Pending session validation failed', {\n            error: error instanceof Error ? error.message : String(error),\n        });\n\n        return null;\n    }\n}\n\n/**\n * Clear pending session cookie\n */\nexport async function clearPendingSession(): Promise<void>\n{\n    const cookieStore = await cookies();\n    cookieStore.delete(COOKIE_NAMES.OAUTH_PENDING);\n}\n","/**\n * @spfn/auth - Client Session Management\n *\n * Uses Jose JWE (JSON Web Encryption) to securely store session data in cookies\n * More efficient than Iron Session with better Edge Runtime support\n */\n\nimport * as jose from 'jose';\nimport { env } from '@spfn/auth/config';\nimport { env as coreEnv } from '@spfn/core/config';\nimport { authLogger } from '../logger';\n\nimport { type KeyAlgorithmType } from '../types';\n\nexport interface SessionData\n{\n    userId: string;\n    privateKey: string;     // Base64 encoded DER\n    keyId: string;\n    algorithm: KeyAlgorithmType;\n}\n\n/**\n * Get session secret key derived from environment\n * Must be at least 32 characters (256-bit)\n *\n * Derives a 32-byte key using SHA-256 to ensure compatibility with Jose A256GCM\n */\nasync function getSessionSecretKey(): Promise<Uint8Array>\n{\n    const secret = env.SPFN_AUTH_SESSION_SECRET;\n\n    // Derive a 32-byte key using SHA-256 for A256GCM compatibility\n    // Use Web Crypto API for universal compatibility (browser + Node.js)\n    const encoder = new TextEncoder();\n    const data = encoder.encode(secret);\n    const hashBuffer = await crypto.subtle.digest('SHA-256', data);\n\n    return new Uint8Array(hashBuffer);\n}\n\n/**\n * Get a short fingerprint of the current secret key for debugging\n * Logs only the first 8 hex chars of the SHA-256 hash — safe to expose\n */\nasync function getSecretFingerprint(): Promise<string>\n{\n    const key = await getSessionSecretKey();\n    const hash = await crypto.subtle.digest('SHA-256', key.buffer as ArrayBuffer);\n    const hex = Array.from(new Uint8Array(hash))\n        .map((b) => b.toString(16).padStart(2, '0'))\n        .join('');\n\n    return hex.slice(0, 8);\n}\n\n/**\n * Seal session data into encrypted JWT (JWE)\n *\n * @param data - Session data to encrypt\n * @param ttl - Time to live in seconds (default: 7 days)\n * @returns Encrypted JWT string\n */\nexport async function sealSession(\n    data: SessionData,\n    ttl: number = 60 * 60 * 24 * 7, // 7 days\n): Promise<string>\n{\n    const secret = await getSessionSecretKey();\n\n    const result = await new jose.EncryptJWT({ data })\n        .setProtectedHeader({ alg: 'dir', enc: 'A256GCM' })\n        .setIssuedAt()\n        .setExpirationTime(`${ttl}s`)\n        .setIssuer('spfn-auth')\n        .setAudience('spfn-client')\n        .encrypt(secret);\n\n    if (coreEnv.NODE_ENV !== 'production')\n    {\n        const fingerprint = await getSecretFingerprint();\n        authLogger.session.debug(`Sealed session`, {\n            secretFingerprint: fingerprint,\n            resultLength: result.length,\n            resultPrefix: result.slice(0, 20),\n        });\n    }\n\n    return result;\n}\n\n/**\n * Unseal encrypted JWT (JWE) to session data\n *\n * @param jwt - Encrypted JWT string\n * @returns Session data\n * @throws Error if session is invalid or expired\n */\nexport async function unsealSession(jwt: string): Promise<SessionData>\n{\n    try\n    {\n        const secret = await getSessionSecretKey();\n\n        const { payload } = await jose.jwtDecrypt(jwt, secret, {\n            issuer: 'spfn-auth',\n            audience: 'spfn-client',\n        });\n\n        return payload.data as SessionData;\n    }\n    catch (err)\n    {\n        if (err instanceof jose.errors.JWTExpired)\n        {\n            throw new Error('Session expired');\n        }\n\n        if (err instanceof jose.errors.JWEDecryptionFailed)\n        {\n            // Log secret fingerprint for debugging cross-process key mismatch\n            if (coreEnv.NODE_ENV !== 'production')\n            {\n                const fingerprint = await getSecretFingerprint();\n                authLogger.session.warn(`JWE decryption failed`, {\n                    secretFingerprint: fingerprint,\n                    jwtLength: jwt.length,\n                    jwtPrefix: jwt.slice(0, 20),\n                    jwtSuffix: jwt.slice(-10),\n                });\n            }\n\n            throw new Error('Invalid session');\n        }\n\n        if (err instanceof jose.errors.JWTClaimValidationFailed)\n        {\n            throw new Error('Session validation failed');\n        }\n\n        throw new Error('Failed to unseal session');\n    }\n}\n\n/**\n * Get session metadata without decrypting\n *\n * @param jwt - Encrypted JWT string\n * @returns Session metadata or null if invalid\n */\nexport async function getSessionInfo(jwt: string): Promise<{\n    issuedAt: Date;\n    expiresAt: Date;\n    issuer: string;\n    audience: string;\n} | null>\n{\n    const secret = await getSessionSecretKey();\n\n    try\n    {\n        const { payload } = await jose.jwtDecrypt(jwt, secret);\n\n        return {\n            issuedAt: new Date(payload.iat! * 1000),\n            expiresAt: new Date(payload.exp! * 1000),\n            issuer: payload.iss || '',\n            audience: Array.isArray(payload.aud) ? payload.aud[0] : payload.aud || '',\n        };\n    }\n    catch (err)\n    {\n        // Log error for debugging but return null for graceful handling\n        if (coreEnv.NODE_ENV !== 'production')\n        {\n            authLogger.session.warn('Failed to get session info:', err instanceof Error ? err.message : 'Unknown error');\n        }\n\n        return null;\n    }\n}\n\n/**\n * Check if session is about to expire (within threshold)\n *\n * @param jwt - Encrypted JWT string\n * @param thresholdHours - Hours before expiry to trigger refresh (default: 24)\n * @returns True if session should be refreshed\n */\nexport async function shouldRefreshSession(\n    jwt: string,\n    thresholdHours: number = 24,\n): Promise<boolean>\n{\n    const info = await getSessionInfo(jwt);\n\n    if (!info)\n    {\n        return true;\n    }\n\n    const hoursRemaining = (info.expiresAt.getTime() - Date.now()) / (1000 * 60 * 60);\n\n    return hoursRemaining < thresholdHours;\n}\n","/**\n * @spfn/auth - Centralized Logger\n *\n * All auth package loggers with consistent naming\n */\n\nimport { logger as rootLogger } from '@spfn/core/logger';\n\nexport const authLogger = {\n    plugin: rootLogger.child('@spfn/auth:plugin'),\n    middleware: rootLogger.child('@spfn/auth:middleware'),\n    interceptor: {\n        general: rootLogger.child('@spfn/auth:interceptor:general'),\n        login: rootLogger.child('@spfn/auth:interceptor:login'),\n        keyRotation: rootLogger.child('@spfn/auth:interceptor:key-rotation'),\n        oauth: rootLogger.child('@spfn/auth:interceptor:oauth'),\n    },\n    session: rootLogger.child('@spfn/auth:session'),\n    service: rootLogger.child('@spfn/auth:service'),\n    setup: rootLogger.child('@spfn/auth:setup'),\n    email: rootLogger.child('@spfn/auth:email'),\n    sms: rootLogger.child('@spfn/auth:sms'),\n};\n","/**\n * @spfn/auth - Global Configuration\n *\n * Manages global auth configuration including session TTL\n */\n\nimport { env } from '@spfn/auth/config';\n\nimport type { SocialProvider } from '../types';\n\n/**\n * Cookie name suffix derived from PORT to isolate sessions across\n * multiple local dev instances running on the same domain (localhost).\n */\nfunction getCookieSuffix(): string\n{\n    const port = process.env.PORT;\n\n    return port ? `_${port}` : '';\n}\n\n/**\n * Cookie names used by SPFN Auth\n *\n * Names include a port-based suffix so that multiple dev instances\n * on different ports don't overwrite each other's cookies.\n */\nexport const COOKIE_NAMES = {\n    /** Encrypted session data (userId, privateKey, keyId, algorithm) */\n    get SESSION() \n    {\n        return `spfn_session${getCookieSuffix()}`; \n    },\n    /** Current key ID (for key rotation) */\n    get SESSION_KEY_ID() \n    {\n        return `spfn_session_key_id${getCookieSuffix()}`; \n    },\n    /** Pending OAuth session (privateKey, keyId, algorithm) - temporary during OAuth flow */\n    get OAUTH_PENDING()\n    {\n        return `spfn_oauth_pending${getCookieSuffix()}`;\n    },\n    /** OAuth CSRF nonce — double-submit against the (encrypted) state.nonce at callback */\n    get OAUTH_CSRF()\n    {\n        return `spfn_oauth_csrf${getCookieSuffix()}`;\n    },\n};\n\n/**\n * OAuth CSRF 쿠키를 PORT 접미사와 무관하게 전부 수집한다.\n *\n * 쿠키를 심는 쪽은 Next.js 프로세스, 읽는 쪽은 API 프로세스라 분리 배포에서는\n * 두 프로세스의 PORT가 달라 COOKIE_NAMES.OAUTH_CSRF 정확 일치 조회가 빗나간다.\n * nonce 자체가 랜덤값이고 암호화된 state의 nonce와 대조되므로, 접미사가 다른\n * spfn_oauth_csrf* 후보를 모두 대조 대상으로 넘겨도 안전하다.\n */\nexport function matchOAuthCsrfCookies(\n    cookies: Record<string, string>,\n): { name: string; value: string }[]\n{\n    return Object.entries(cookies)\n        .filter(([name]) => /^spfn_oauth_csrf(_\\d+)?$/.test(name))\n        .map(([name, value]) => ({ name, value }));\n}\n\n/**\n * Parse duration string to seconds\n *\n * Supports: '30d', '12h', '45m', '3600s', or plain number\n *\n * @example\n * parseDuration('30d')   // 2592000 (30 days in seconds)\n * parseDuration('12h')   // 43200\n * parseDuration('45m')   // 2700\n * parseDuration('3600')  // 3600\n */\nexport function parseDuration(duration: string | number): number\n{\n    if (typeof duration === 'number')\n    {\n        return duration;\n    }\n\n    const match = duration.match(/^(\\d+)([dhms]?)$/);\n    if (!match)\n    {\n        throw new Error(`Invalid duration format: ${duration}. Use format like '30d', '12h', '45m', '3600s', or plain number.`);\n    }\n\n    const value = parseInt(match[1], 10);\n    const unit = match[2] || 's';\n\n    switch (unit)\n    {\n        case 'd':\n            return value * 24 * 60 * 60;\n        case 'h':\n            return value * 60 * 60;\n        case 'm':\n            return value * 60;\n        case 's':\n            return value;\n        default:\n            throw new Error(`Unknown duration unit: ${unit}`);\n    }\n}\n\n/**\n * Registration channel passed to the beforeRegister hook\n *\n * - credentials: email/phone + password registration\n * - oauth: new-user signup through a social provider (web or native flow)\n * - invitation: invitation acceptance\n */\nexport type RegisterChannel = 'credentials' | 'oauth' | 'invitation';\n\n/**\n * Context passed to the beforeRegister hook\n *\n * Credentials (password, keys) are intentionally excluded — the hook is a\n * policy gate, not a credential handler.\n */\nexport interface BeforeRegisterContext\n{\n    channel: RegisterChannel;\n    /** Social provider — only set when channel is 'oauth' */\n    provider?: SocialProvider;\n    email?: string;\n    /**\n     * Whether the email is verified — only set when channel is 'oauth'.\n     * OAuth providers may report an unverified (spoofable) email; the created\n     * account stores it as null in that case, so email-based policies must\n     * check this flag. credentials/invitation emails are already verified.\n     */\n    emailVerified?: boolean;\n    phone?: string;\n    /** App-supplied registration metadata (register params / OAuth start params / invitation) */\n    metadata?: Record<string, unknown>;\n}\n\n/**\n * Auth configuration\n */\nexport interface AuthConfig\n{\n    /**\n     * Default session TTL in seconds or duration string\n     *\n     * Supports:\n     * - Number: seconds (e.g., 2592000)\n     * - String: '30d', '12h', '45m', '3600s'\n     *\n     * @default 7d (7 days)\n     */\n    sessionTtl?: string | number;\n\n    /**\n     * App-injected validator that runs before a new user row is created,\n     * on every registration channel (credentials, oauth, invitation).\n     *\n     * Throw to reject the registration — RegistrationRejectedError (403) is\n     * the recommended error; any HttpError subclass keeps its own status.\n     * Runs after built-in checks (verification token, duplicate account),\n     * so existing error precedence is unchanged. Not called for admin\n     * seeding (initializeAuth) or when linking a social account to an\n     * existing user.\n     *\n     * Runs inside the registration DB transaction on every channel — keep it\n     * fast. A slow call (e.g. an external policy API) holds a pooled DB\n     * connection open for its full duration on every signup.\n     *\n     * @example\n     * ```typescript\n     * configureAuth({\n     *     beforeRegister: async ({ channel, metadata }) =>\n     *     {\n     *         if (channel === 'credentials' && !isOldEnough(metadata?.birthDate))\n     *         {\n     *             throw new RegistrationRejectedError({ message: 'Age requirement not met' });\n     *         }\n     *     },\n     * });\n     * ```\n     */\n    beforeRegister?: (context: BeforeRegisterContext) => void | Promise<void>;\n}\n\n/**\n * Global auth configuration state\n */\nlet globalConfig: AuthConfig = {\n    sessionTtl: '7d', // Default: 7 days\n};\n\n/**\n * Configure global auth settings\n *\n * @param config - Auth configuration\n *\n * @example\n * ```typescript\n * configureAuth({\n *   sessionTtl: '30d',  // 30 days\n * });\n * ```\n */\nexport function configureAuth(config: AuthConfig): void\n{\n    globalConfig = {\n        ...globalConfig,\n        ...config,\n    };\n}\n\n/**\n * Get current auth configuration\n */\nexport function getAuthConfig(): AuthConfig\n{\n    return { ...globalConfig };\n}\n\n/**\n * Run the app-injected beforeRegister hook if configured — throws to reject.\n *\n * Single entry point for every registration channel so a new channel cannot\n * forget the configured-check. Callers invoke this right before creating the\n * user row.\n */\nexport async function runBeforeRegister(context: BeforeRegisterContext): Promise<void>\n{\n    const { beforeRegister } = globalConfig;\n\n    if (beforeRegister)\n    {\n        await beforeRegister(context);\n    }\n}\n\n/**\n * Get session TTL in seconds\n *\n * Priority:\n * 1. Runtime override (remember parameter)\n * 2. Global config (configureAuth)\n * 3. Environment variable (SPFN_AUTH_SESSION_TTL) - via config module\n * 4. Default (7 days)\n */\nexport function getSessionTtl(override?: string | number): number\n{\n    // 1. Runtime override\n    if (override !== undefined)\n    {\n        return parseDuration(override);\n    }\n\n    // 2. Global config\n    if (globalConfig.sessionTtl !== undefined)\n    {\n        return parseDuration(globalConfig.sessionTtl);\n    }\n\n    // 3. Environment variable (from config module)\n    const envTtl = env.SPFN_AUTH_SESSION_TTL;\n    if (envTtl)\n    {\n        return parseDuration(envTtl);\n    }\n\n    // 4. Default: 7 days\n    return 7 * 24 * 60 * 60;\n}\n","/**\n * Server-side auth utilities for guards\n *\n * Uses authApi to check permissions in real-time\n */\n\nimport { authApi } from '@spfn/auth';\nimport { authLogger } from '../../server/logger';\n\n/**\n * Get current auth session with roles and permissions via API\n */\nexport async function getAuthSessionData()\n{\n    try\n    {\n        const session = await authApi.getAuthSession.call();\n        authLogger.middleware.debug('Auth session retrieved', { name: session.role?.name });\n\n        return session;\n    }\n    catch (error)\n    {\n        authLogger.middleware.error('Failed to get auth session', { error });\n\n        return null;\n    }\n}\n\n/**\n * Get user role\n */\nexport async function getUserRole(): Promise<string | null>\n{\n    const session = await getAuthSessionData();\n\n    return session?.role?.name || null;\n}\n\n/**\n * Get user permissions\n */\nexport async function getUserPermissions(): Promise<string[]>\n{\n    const session = await getAuthSessionData();\n\n    if (!session)\n    {\n        return [];\n    }\n\n    return session.permissions?.map((p: any) => p.name) || [];\n}\n\n/**\n * Check if user has any of the specified roles\n */\nexport async function hasAnyRole(requiredRoles: string[]): Promise<boolean>\n{\n    const session = await getAuthSessionData();\n    if (!session)\n    {\n        return false;\n    }\n\n    return requiredRoles.includes(session.role?.name);\n}\n\n/**\n * Check if user has any of the specified permissions\n */\nexport async function hasAnyPermission(requiredPermissions: string[]): Promise<boolean>\n{\n    const session = await getAuthSessionData();\n\n    if (!session)\n    {\n        return false;\n    }\n\n    const userPermissionNames = session.permissions?.map((p: any) => p.name) || [];\n\n    return requiredPermissions.some(permission => userPermissionNames.includes(permission));\n}\n","/**\n * RequireRole Guard Component\n *\n * Requires user to have at least one of the specified roles\n */\n\nimport { redirect } from 'next/navigation';\nimport { getSession } from '../session-helpers';\nimport { hasAnyRole } from './auth-utils';\nimport type { ReactNode } from 'react';\n\nexport interface RequireRoleProps\n{\n    /**\n     * Required role(s) - user must have at least one\n     */\n    roles: string | string[];\n\n    /**\n     * Children to render if user has required role\n     */\n    children: ReactNode;\n\n    /**\n     * Path to redirect to if user doesn't have role\n     * @default '/unauthorized'\n     */\n    redirectTo?: string;\n\n    /**\n     * Fallback UI to show instead of redirecting\n     */\n    fallback?: ReactNode;\n}\n\n/**\n * Require Role Guard\n *\n * Ensures user has at least one of the specified roles\n *\n * @example Single role\n * ```tsx\n * <RequireRole roles=\"admin\">\n *   <AdminPanel />\n * </RequireRole>\n * ```\n *\n * @example Multiple roles (OR condition)\n * ```tsx\n * <RequireRole roles={['admin', 'manager']}>\n *   <ManagementDashboard />\n * </RequireRole>\n * ```\n *\n * @example With fallback\n * ```tsx\n * <RequireRole roles=\"admin\" fallback={<AccessDenied />}>\n *   <AdminContent />\n * </RequireRole>\n * ```\n */\nexport async function RequireRole({\n    roles,\n    children,\n    redirectTo = '/unauthorized',\n    fallback,\n}: RequireRoleProps)\n{\n    const session = await getSession();\n\n    // Not authenticated\n    if (!session)\n    {\n        if (fallback)\n        {\n            return <>{fallback}</>;\n        }\n\n        redirect('/login');\n    }\n\n    // Normalize to array\n    const requiredRoles = Array.isArray(roles) ? roles : [roles];\n\n    // Check if user has any of the required roles\n    const hasRole = await hasAnyRole(requiredRoles);\n\n    if (!hasRole)\n    {\n        if (fallback)\n        {\n            return <>{fallback}</>;\n        }\n\n        redirect(redirectTo);\n    }\n\n    return <>{children}</>;\n}\n","/**\n * RequirePermission Guard Component\n *\n * Requires user to have at least one of the specified permissions\n */\n\nimport { redirect } from 'next/navigation';\nimport { getSession } from '../session-helpers';\nimport { hasAnyPermission } from './auth-utils';\nimport type { ReactNode } from 'react';\n\nexport interface RequirePermissionProps\n{\n    /**\n     * Required permission(s) - user must have at least one\n     */\n    permissions: string | string[];\n\n    /**\n     * Children to render if user has required permission\n     */\n    children: ReactNode;\n\n    /**\n     * Path to redirect to if user doesn't have permission\n     * @default '/unauthorized'\n     */\n    redirectTo?: string;\n\n    /**\n     * Fallback UI to show instead of redirecting\n     */\n    fallback?: ReactNode;\n}\n\n/**\n * Require Permission Guard\n *\n * Ensures user has at least one of the specified permissions\n *\n * @example Single permission\n * ```tsx\n * <RequirePermission permissions=\"user:delete\">\n *   <DeleteUserButton />\n * </RequirePermission>\n * ```\n *\n * @example Multiple permissions (OR condition)\n * ```tsx\n * <RequirePermission permissions={['user:delete', 'user:update']}>\n *   <UserManagement />\n * </RequirePermission>\n * ```\n *\n * @example With fallback\n * ```tsx\n * <RequirePermission permissions=\"project:create\" fallback={<UpgradePrompt />}>\n *   <CreateProject />\n * </RequirePermission>\n * ```\n */\nexport async function RequirePermission({\n    permissions,\n    children,\n    redirectTo = '/unauthorized',\n    fallback,\n}: RequirePermissionProps)\n{\n    const session = await getSession();\n\n    // Not authenticated\n    if (!session)\n    {\n        if (fallback)\n        {\n            return <>{fallback}</>;\n        }\n\n        redirect('/login');\n    }\n\n    // Normalize to array\n    const requiredPermissions = Array.isArray(permissions) ? permissions : [permissions];\n\n    // Check if user has any of the required permissions\n    const hasPermission = await hasAnyPermission(requiredPermissions);\n\n    if (!hasPermission)\n    {\n        if (fallback)\n        {\n            return <>{fallback}</>;\n        }\n\n        redirect(redirectTo);\n    }\n\n    return <>{children}</>;\n}\n","/**\n * OAuth Handlers for Next.js\n *\n * Helper functions to create OAuth callback route handlers\n */\n\nimport { NextRequest, NextResponse } from 'next/server';\nimport { cookies } from 'next/headers.js';\nimport { sealSession } from '../server/lib/session';\nimport { COOKIE_NAMES, getSessionTtl } from '../server/lib/config';\nimport { env } from '@spfn/core/config';\nimport { logger } from '@spfn/core/logger';\nimport { unsealPendingSession } from './session-helpers';\n\nexport interface OAuthCallbackOptions\n{\n    /**\n     * Default redirect URL if returnUrl is not provided\n     * @default '/'\n     */\n    defaultRedirectUrl?: string;\n\n    /**\n     * Error redirect URL\n     * @default '/auth/error'\n     */\n    errorRedirectUrl?: string;\n}\n\n/**\n * Create OAuth callback handler for Next.js API Route\n *\n * Handles the final step of OAuth flow:\n * 1. Gets userId, keyId from query params (set by backend)\n * 2. Gets privateKey from pending session cookie\n * 3. Creates full session and saves to cookie\n * 4. Redirects to returnUrl\n *\n * @example\n * ```typescript\n * // /api/auth/callback/route.ts\n * import { createOAuthCallbackHandler } from '@spfn/auth/nextjs/server';\n * export const GET = createOAuthCallbackHandler();\n * ```\n */\nexport function createOAuthCallbackHandler(options?: OAuthCallbackOptions)\n{\n    const defaultRedirect = options?.defaultRedirectUrl || '/';\n    const errorRedirect = options?.errorRedirectUrl || '/auth/error';\n\n    return async (request: NextRequest): Promise<NextResponse> =>\n    {\n        const searchParams = request.nextUrl.searchParams;\n        const userId = searchParams.get('userId');\n        const keyId = searchParams.get('keyId');\n        const returnUrl = searchParams.get('returnUrl') || defaultRedirect;\n        const error = searchParams.get('error');\n\n        // Handle error from backend\n        if (error)\n        {\n            const errorUrl = new URL(errorRedirect, request.url);\n            errorUrl.searchParams.set('error', error);\n\n            return NextResponse.redirect(errorUrl);\n        }\n\n        // Validate required params\n        if (!userId || !keyId)\n        {\n            logger.error('OAuth callback missing required params', { userId: !!userId, keyId: !!keyId });\n            const errorUrl = new URL(errorRedirect, request.url);\n            errorUrl.searchParams.set('error', 'Missing required parameters');\n\n            return NextResponse.redirect(errorUrl);\n        }\n\n        try\n        {\n            // Get pending session from cookie\n            const cookieStore = await cookies();\n            const pendingCookie = cookieStore.get(COOKIE_NAMES.OAUTH_PENDING);\n\n            if (!pendingCookie)\n            {\n                throw new Error('OAuth session expired. Please try again.');\n            }\n\n            const pendingSession = await unsealPendingSession(pendingCookie.value);\n\n            // Verify keyId matches\n            if (pendingSession.keyId !== keyId)\n            {\n                throw new Error('Session mismatch. Please try again.');\n            }\n\n            // Create full session\n            const ttl = getSessionTtl();\n            const sessionToken = await sealSession({\n                userId,\n                privateKey: pendingSession.privateKey,\n                keyId: pendingSession.keyId,\n                algorithm: pendingSession.algorithm,\n            }, ttl);\n\n            // Build redirect response\n            const redirectUrl = new URL(returnUrl, request.url);\n            const response = NextResponse.redirect(redirectUrl);\n\n            // Set session cookie\n            response.cookies.set(COOKIE_NAMES.SESSION, sessionToken, {\n                httpOnly: true,\n                secure: env.NODE_ENV === 'production',\n                sameSite: 'lax',\n                maxAge: ttl,\n                path: '/',\n            });\n\n            // Set keyId cookie\n            response.cookies.set(COOKIE_NAMES.SESSION_KEY_ID, keyId, {\n                httpOnly: true,\n                secure: env.NODE_ENV === 'production',\n                sameSite: 'lax',\n                maxAge: ttl,\n                path: '/',\n            });\n\n            // Clear pending session cookie\n            response.cookies.delete(COOKIE_NAMES.OAUTH_PENDING);\n\n            logger.debug('OAuth callback completed', { userId, keyId });\n\n            return response;\n        }\n        catch (error)\n        {\n            const err = error as Error;\n            logger.error('OAuth callback failed', { error: err.message });\n\n            const errorUrl = new URL(errorRedirect, request.url);\n            errorUrl.searchParams.set('error', err.message);\n\n            return NextResponse.redirect(errorUrl);\n        }\n    };\n}\n"],"mappings":";AAAA,OAAO;;;ACMP,SAAS,gBAAgB;;;ACAzB,YAAYA,WAAU;AACtB,SAAS,eAAe;;;ACAxB,YAAY,UAAU;AACtB,SAAS,WAAW;AACpB,SAAS,OAAO,eAAe;;;ACH/B,SAAS,UAAU,kBAAkB;AAE9B,IAAM,aAAa;AAAA,EACtB,QAAQ,WAAW,MAAM,mBAAmB;AAAA,EAC5C,YAAY,WAAW,MAAM,uBAAuB;AAAA,EACpD,aAAa;AAAA,IACT,SAAS,WAAW,MAAM,gCAAgC;AAAA,IAC1D,OAAO,WAAW,MAAM,8BAA8B;AAAA,IACtD,aAAa,WAAW,MAAM,qCAAqC;AAAA,IACnE,OAAO,WAAW,MAAM,8BAA8B;AAAA,EAC1D;AAAA,EACA,SAAS,WAAW,MAAM,oBAAoB;AAAA,EAC9C,SAAS,WAAW,MAAM,oBAAoB;AAAA,EAC9C,OAAO,WAAW,MAAM,kBAAkB;AAAA,EAC1C,OAAO,WAAW,MAAM,kBAAkB;AAAA,EAC1C,KAAK,WAAW,MAAM,gBAAgB;AAC1C;;;ADMA,eAAe,sBACf;AACI,QAAM,SAAS,IAAI;AAInB,QAAM,UAAU,IAAI,YAAY;AAChC,QAAM,OAAO,QAAQ,OAAO,MAAM;AAClC,QAAM,aAAa,MAAM,OAAO,OAAO,OAAO,WAAW,IAAI;AAE7D,SAAO,IAAI,WAAW,UAAU;AACpC;AAMA,eAAe,uBACf;AACI,QAAM,MAAM,MAAM,oBAAoB;AACtC,QAAM,OAAO,MAAM,OAAO,OAAO,OAAO,WAAW,IAAI,MAAqB;AAC5E,QAAM,MAAM,MAAM,KAAK,IAAI,WAAW,IAAI,CAAC,EACtC,IAAI,CAAC,MAAM,EAAE,SAAS,EAAE,EAAE,SAAS,GAAG,GAAG,CAAC,EAC1C,KAAK,EAAE;AAEZ,SAAO,IAAI,MAAM,GAAG,CAAC;AACzB;AASA,eAAsB,YAClB,MACA,MAAc,KAAK,KAAK,KAAK,GAEjC;AACI,QAAM,SAAS,MAAM,oBAAoB;AAEzC,QAAM,SAAS,MAAM,IAAS,gBAAW,EAAE,KAAK,CAAC,EAC5C,mBAAmB,EAAE,KAAK,OAAO,KAAK,UAAU,CAAC,EACjD,YAAY,EACZ,kBAAkB,GAAG,GAAG,GAAG,EAC3B,UAAU,WAAW,EACrB,YAAY,aAAa,EACzB,QAAQ,MAAM;AAEnB,MAAI,QAAQ,aAAa,cACzB;AACI,UAAM,cAAc,MAAM,qBAAqB;AAC/C,eAAW,QAAQ,MAAM,kBAAkB;AAAA,MACvC,mBAAmB;AAAA,MACnB,cAAc,OAAO;AAAA,MACrB,cAAc,OAAO,MAAM,GAAG,EAAE;AAAA,IACpC,CAAC;AAAA,EACL;AAEA,SAAO;AACX;AASA,eAAsB,cAAc,KACpC;AACI,MACA;AACI,UAAM,SAAS,MAAM,oBAAoB;AAEzC,UAAM,EAAE,QAAQ,IAAI,MAAW,gBAAW,KAAK,QAAQ;AAAA,MACnD,QAAQ;AAAA,MACR,UAAU;AAAA,IACd,CAAC;AAED,WAAO,QAAQ;AAAA,EACnB,SACO,KACP;AACI,QAAI,eAAoB,YAAO,YAC/B;AACI,YAAM,IAAI,MAAM,iBAAiB;AAAA,IACrC;AAEA,QAAI,eAAoB,YAAO,qBAC/B;AAEI,UAAI,QAAQ,aAAa,cACzB;AACI,cAAM,cAAc,MAAM,qBAAqB;AAC/C,mBAAW,QAAQ,KAAK,yBAAyB;AAAA,UAC7C,mBAAmB;AAAA,UACnB,WAAW,IAAI;AAAA,UACf,WAAW,IAAI,MAAM,GAAG,EAAE;AAAA,UAC1B,WAAW,IAAI,MAAM,GAAG;AAAA,QAC5B,CAAC;AAAA,MACL;AAEA,YAAM,IAAI,MAAM,iBAAiB;AAAA,IACrC;AAEA,QAAI,eAAoB,YAAO,0BAC/B;AACI,YAAM,IAAI,MAAM,2BAA2B;AAAA,IAC/C;AAEA,UAAM,IAAI,MAAM,0BAA0B;AAAA,EAC9C;AACJ;;;AExIA,SAAS,OAAAC,YAAW;AAQpB,SAAS,kBACT;AACI,QAAM,OAAO,QAAQ,IAAI;AAEzB,SAAO,OAAO,IAAI,IAAI,KAAK;AAC/B;AAQO,IAAM,eAAe;AAAA;AAAA,EAExB,IAAI,UACJ;AACI,WAAO,eAAe,gBAAgB,CAAC;AAAA,EAC3C;AAAA;AAAA,EAEA,IAAI,iBACJ;AACI,WAAO,sBAAsB,gBAAgB,CAAC;AAAA,EAClD;AAAA;AAAA,EAEA,IAAI,gBACJ;AACI,WAAO,qBAAqB,gBAAgB,CAAC;AAAA,EACjD;AAAA;AAAA,EAEA,IAAI,aACJ;AACI,WAAO,kBAAkB,gBAAgB,CAAC;AAAA,EAC9C;AACJ;AA8BO,SAAS,cAAc,UAC9B;AACI,MAAI,OAAO,aAAa,UACxB;AACI,WAAO;AAAA,EACX;AAEA,QAAM,QAAQ,SAAS,MAAM,kBAAkB;AAC/C,MAAI,CAAC,OACL;AACI,UAAM,IAAI,MAAM,4BAA4B,QAAQ,kEAAkE;AAAA,EAC1H;AAEA,QAAM,QAAQ,SAAS,MAAM,CAAC,GAAG,EAAE;AACnC,QAAM,OAAO,MAAM,CAAC,KAAK;AAEzB,UAAQ,MACR;AAAA,IACI,KAAK;AACD,aAAO,QAAQ,KAAK,KAAK;AAAA,IAC7B,KAAK;AACD,aAAO,QAAQ,KAAK;AAAA,IACxB,KAAK;AACD,aAAO,QAAQ;AAAA,IACnB,KAAK;AACD,aAAO;AAAA,IACX;AACI,YAAM,IAAI,MAAM,0BAA0B,IAAI,EAAE;AAAA,EACxD;AACJ;AAqFA,IAAI,eAA2B;AAAA,EAC3B,YAAY;AAAA;AAChB;AAwDO,SAAS,cAAc,UAC9B;AAEI,MAAI,aAAa,QACjB;AACI,WAAO,cAAc,QAAQ;AAAA,EACjC;AAGA,MAAI,aAAa,eAAe,QAChC;AACI,WAAO,cAAc,aAAa,UAAU;AAAA,EAChD;AAGA,QAAM,SAASC,KAAI;AACnB,MAAI,QACJ;AACI,WAAO,cAAc,MAAM;AAAA,EAC/B;AAGA,SAAO,IAAI,KAAK,KAAK;AACzB;;;AHtQA,SAAS,OAAAC,YAAW;AACpB,SAAS,cAAc;AAuEvB,eAAsB,YAClB,MACA,SAEJ;AAEI,MAAI;AAEJ,MAAI,SAAS,WAAW,QACxB;AAEI,aAAS,OAAO,QAAQ,WAAW,WAC7B,QAAQ,SACR,cAAc,QAAQ,MAAM;AAAA,EACtC,OAEA;AAEI,aAAS,cAAc;AAAA,EAC3B;AAEA,QAAM,QAAQ,MAAM,YAAY,MAAM,MAAM;AAC5C,QAAM,cAAc,MAAM,QAAQ;AAElC,cAAY,IAAI,aAAa,SAAS,OAAO;AAAA,IACzC,UAAU;AAAA,IACV,QAAQ,QAAQ,IAAI,aAAa;AAAA,IACjC,UAAU;AAAA,IACV,MAAM;AAAA,IACN;AAAA,EACJ,CAAC;AACL;AAOA,eAAsB,aACtB;AACI,QAAM,cAAc,MAAM,QAAQ;AAClC,QAAM,gBAAgB,YAAY,IAAI,aAAa,OAAO;AAE1D,MAAI,CAAC,eACL;AACI,WAAO;AAAA,EACX;AAEA,MACA;AAEI,WAAO,MAAM,6BAA6B,EAAE,SAAS,KAAK,CAAC;AAC3D,UAAM,UAAU,MAAM,cAAc,cAAc,KAAK;AAGvD,WAAO;AAAA,MACH,QAAQ,QAAQ;AAAA,IACpB;AAAA,EACJ,SACO,OACP;AAII,WAAO,MAAM,6BAA6B;AAAA,MACtC,OAAO,iBAAiB,QAAQ,MAAM,UAAU,OAAO,KAAK;AAAA,IAChE,CAAC;AAED,WAAO;AAAA,EACX;AACJ;AAKA,eAAsB,eACtB;AACI,QAAM,cAAc,MAAM,QAAQ;AAClC,cAAY,OAAO,aAAa,OAAO;AACvC,cAAY,OAAO,aAAa,cAAc;AAClD;AASA,eAAe,uBACf;AACI,QAAM,SAASA,KAAI;AACnB,QAAM,UAAU,IAAI,YAAY;AAChC,QAAM,OAAO,QAAQ,OAAO,iBAAiB,MAAM,EAAE;AACrD,QAAM,aAAa,MAAM,OAAO,OAAO,OAAO,WAAW,IAAI;AAE7D,SAAO,IAAI,WAAW,UAAU;AACpC;AAQA,eAAsB,mBAClB,MACA,MAAc,KAElB;AACI,QAAM,MAAM,MAAM,qBAAqB;AAEvC,SAAO,MAAM,IAAS,iBAAW,EAAE,KAAK,CAAC,EACpC,mBAAmB,EAAE,KAAK,OAAO,KAAK,UAAU,CAAC,EACjD,YAAY,EACZ,kBAAkB,GAAG,GAAG,GAAG,EAC3B,UAAU,WAAW,EACrB,YAAY,YAAY,EACxB,QAAQ,GAAG;AACpB;AAOA,eAAsB,qBAAqB,KAC3C;AACI,QAAM,MAAM,MAAM,qBAAqB;AAEvC,QAAM,EAAE,QAAQ,IAAI,MAAW,iBAAW,KAAK,KAAK;AAAA,IAChD,QAAQ;AAAA,IACR,UAAU;AAAA,EACd,CAAC;AAED,SAAO,QAAQ;AACnB;AAKA,eAAsB,oBACtB;AACI,QAAM,cAAc,MAAM,QAAQ;AAClC,QAAM,gBAAgB,YAAY,IAAI,aAAa,aAAa;AAEhE,MAAI,CAAC,eACL;AACI,WAAO;AAAA,EACX;AAEA,MACA;AACI,WAAO,MAAM,qBAAqB,cAAc,KAAK;AAAA,EACzD,SACO,OACP;AACI,WAAO,MAAM,qCAAqC;AAAA,MAC9C,OAAO,iBAAiB,QAAQ,MAAM,UAAU,OAAO,KAAK;AAAA,IAChE,CAAC;AAED,WAAO;AAAA,EACX;AACJ;AAKA,eAAsB,sBACtB;AACI,QAAM,cAAc,MAAM,QAAQ;AAClC,cAAY,OAAO,aAAa,aAAa;AACjD;;;AIzPA,SAAS,eAAe;AAMxB,eAAsB,qBACtB;AACI,MACA;AACI,UAAM,UAAU,MAAM,QAAQ,eAAe,KAAK;AAClD,eAAW,WAAW,MAAM,0BAA0B,EAAE,MAAM,QAAQ,MAAM,KAAK,CAAC;AAElF,WAAO;AAAA,EACX,SACO,OACP;AACI,eAAW,WAAW,MAAM,8BAA8B,EAAE,MAAM,CAAC;AAEnE,WAAO;AAAA,EACX;AACJ;AAKA,eAAsB,cACtB;AACI,QAAM,UAAU,MAAM,mBAAmB;AAEzC,SAAO,SAAS,MAAM,QAAQ;AAClC;AAKA,eAAsB,qBACtB;AACI,QAAM,UAAU,MAAM,mBAAmB;AAEzC,MAAI,CAAC,SACL;AACI,WAAO,CAAC;AAAA,EACZ;AAEA,SAAO,QAAQ,aAAa,IAAI,CAAC,MAAW,EAAE,IAAI,KAAK,CAAC;AAC5D;AAKA,eAAsB,WAAW,eACjC;AACI,QAAM,UAAU,MAAM,mBAAmB;AACzC,MAAI,CAAC,SACL;AACI,WAAO;AAAA,EACX;AAEA,SAAO,cAAc,SAAS,QAAQ,MAAM,IAAI;AACpD;AAKA,eAAsB,iBAAiB,qBACvC;AACI,QAAM,UAAU,MAAM,mBAAmB;AAEzC,MAAI,CAAC,SACL;AACI,WAAO;AAAA,EACX;AAEA,QAAM,sBAAsB,QAAQ,aAAa,IAAI,CAAC,MAAW,EAAE,IAAI,KAAK,CAAC;AAE7E,SAAO,oBAAoB,KAAK,gBAAc,oBAAoB,SAAS,UAAU,CAAC;AAC1F;;;ALtBmB;AAZnB,eAAsB,YAAY;AAAA,EAC9B;AAAA,EACA,aAAa;AAAA,EACb;AACJ,GACA;AACI,QAAM,UAAU,MAAM,WAAW;AAEjC,MAAI,CAAC,SACL;AACI,QAAI,UACJ;AACI,aAAO,gCAAG,oBAAS;AAAA,IACvB;AAEA,aAAS,UAAU;AAAA,EACvB;AAGA,QAAM,gBAAgB,MAAM,mBAAmB;AAE/C,MAAI,CAAC,eACL;AAGI,aAAS,UAAU;AAAA,EACvB;AAEA,SAAO,gCAAG,UAAS;AACvB;;;AMxEA,SAAS,YAAAC,iBAAgB;AAqEN,qBAAAC,WAAA,OAAAC,YAAA;AAdnB,eAAsB,YAAY;AAAA,EAC9B;AAAA,EACA;AAAA,EACA,aAAa;AAAA,EACb;AACJ,GACA;AACI,QAAM,UAAU,MAAM,WAAW;AAGjC,MAAI,CAAC,SACL;AACI,QAAI,UACJ;AACI,aAAO,gBAAAA,KAAAD,WAAA,EAAG,oBAAS;AAAA,IACvB;AAEA,IAAAE,UAAS,QAAQ;AAAA,EACrB;AAGA,QAAM,gBAAgB,MAAM,QAAQ,KAAK,IAAI,QAAQ,CAAC,KAAK;AAG3D,QAAM,UAAU,MAAM,WAAW,aAAa;AAE9C,MAAI,CAAC,SACL;AACI,QAAI,UACJ;AACI,aAAO,gBAAAD,KAAAD,WAAA,EAAG,oBAAS;AAAA,IACvB;AAEA,IAAAE,UAAS,UAAU;AAAA,EACvB;AAEA,SAAO,gBAAAD,KAAAD,WAAA,EAAG,UAAS;AACvB;;;AC5FA,SAAS,YAAAG,iBAAgB;AAqEN,qBAAAC,WAAA,OAAAC,YAAA;AAdnB,eAAsB,kBAAkB;AAAA,EACpC;AAAA,EACA;AAAA,EACA,aAAa;AAAA,EACb;AACJ,GACA;AACI,QAAM,UAAU,MAAM,WAAW;AAGjC,MAAI,CAAC,SACL;AACI,QAAI,UACJ;AACI,aAAO,gBAAAA,KAAAD,WAAA,EAAG,oBAAS;AAAA,IACvB;AAEA,IAAAE,UAAS,QAAQ;AAAA,EACrB;AAGA,QAAM,sBAAsB,MAAM,QAAQ,WAAW,IAAI,cAAc,CAAC,WAAW;AAGnF,QAAM,gBAAgB,MAAM,iBAAiB,mBAAmB;AAEhE,MAAI,CAAC,eACL;AACI,QAAI,UACJ;AACI,aAAO,gBAAAD,KAAAD,WAAA,EAAG,oBAAS;AAAA,IACvB;AAEA,IAAAE,UAAS,UAAU;AAAA,EACvB;AAEA,SAAO,gBAAAD,KAAAD,WAAA,EAAG,UAAS;AACvB;;;AC5FA,SAAsB,oBAAoB;AAC1C,SAAS,WAAAG,gBAAe;AAGxB,SAAS,OAAAC,YAAW;AACpB,SAAS,UAAAC,eAAc;AAkChB,SAAS,2BAA2B,SAC3C;AACI,QAAM,kBAAkB,SAAS,sBAAsB;AACvD,QAAM,gBAAgB,SAAS,oBAAoB;AAEnD,SAAO,OAAO,YACd;AACI,UAAM,eAAe,QAAQ,QAAQ;AACrC,UAAM,SAAS,aAAa,IAAI,QAAQ;AACxC,UAAM,QAAQ,aAAa,IAAI,OAAO;AACtC,UAAM,YAAY,aAAa,IAAI,WAAW,KAAK;AACnD,UAAM,QAAQ,aAAa,IAAI,OAAO;AAGtC,QAAI,OACJ;AACI,YAAM,WAAW,IAAI,IAAI,eAAe,QAAQ,GAAG;AACnD,eAAS,aAAa,IAAI,SAAS,KAAK;AAExC,aAAO,aAAa,SAAS,QAAQ;AAAA,IACzC;AAGA,QAAI,CAAC,UAAU,CAAC,OAChB;AACI,MAAAC,QAAO,MAAM,0CAA0C,EAAE,QAAQ,CAAC,CAAC,QAAQ,OAAO,CAAC,CAAC,MAAM,CAAC;AAC3F,YAAM,WAAW,IAAI,IAAI,eAAe,QAAQ,GAAG;AACnD,eAAS,aAAa,IAAI,SAAS,6BAA6B;AAEhE,aAAO,aAAa,SAAS,QAAQ;AAAA,IACzC;AAEA,QACA;AAEI,YAAM,cAAc,MAAMC,SAAQ;AAClC,YAAM,gBAAgB,YAAY,IAAI,aAAa,aAAa;AAEhE,UAAI,CAAC,eACL;AACI,cAAM,IAAI,MAAM,0CAA0C;AAAA,MAC9D;AAEA,YAAM,iBAAiB,MAAM,qBAAqB,cAAc,KAAK;AAGrE,UAAI,eAAe,UAAU,OAC7B;AACI,cAAM,IAAI,MAAM,qCAAqC;AAAA,MACzD;AAGA,YAAM,MAAM,cAAc;AAC1B,YAAM,eAAe,MAAM,YAAY;AAAA,QACnC;AAAA,QACA,YAAY,eAAe;AAAA,QAC3B,OAAO,eAAe;AAAA,QACtB,WAAW,eAAe;AAAA,MAC9B,GAAG,GAAG;AAGN,YAAM,cAAc,IAAI,IAAI,WAAW,QAAQ,GAAG;AAClD,YAAM,WAAW,aAAa,SAAS,WAAW;AAGlD,eAAS,QAAQ,IAAI,aAAa,SAAS,cAAc;AAAA,QACrD,UAAU;AAAA,QACV,QAAQC,KAAI,aAAa;AAAA,QACzB,UAAU;AAAA,QACV,QAAQ;AAAA,QACR,MAAM;AAAA,MACV,CAAC;AAGD,eAAS,QAAQ,IAAI,aAAa,gBAAgB,OAAO;AAAA,QACrD,UAAU;AAAA,QACV,QAAQA,KAAI,aAAa;AAAA,QACzB,UAAU;AAAA,QACV,QAAQ;AAAA,QACR,MAAM;AAAA,MACV,CAAC;AAGD,eAAS,QAAQ,OAAO,aAAa,aAAa;AAElD,MAAAF,QAAO,MAAM,4BAA4B,EAAE,QAAQ,MAAM,CAAC;AAE1D,aAAO;AAAA,IACX,SACOG,QACP;AACI,YAAM,MAAMA;AACZ,MAAAH,QAAO,MAAM,yBAAyB,EAAE,OAAO,IAAI,QAAQ,CAAC;AAE5D,YAAM,WAAW,IAAI,IAAI,eAAe,QAAQ,GAAG;AACnD,eAAS,aAAa,IAAI,SAAS,IAAI,OAAO;AAE9C,aAAO,aAAa,SAAS,QAAQ;AAAA,IACzC;AAAA,EACJ;AACJ;","names":["jose","env","env","env","redirect","Fragment","jsx","redirect","redirect","Fragment","jsx","redirect","cookies","env","logger","logger","cookies","env","error"]}