@spfn/auth 0.2.0-beta.8 → 0.2.1

package/dist/nextjs/api.js

@@ -3,7 +3,18 @@ import { registerInterceptors } from "@spfn/core/nextjs/server";
 
 // src/nextjs/interceptors/login-register.ts
 import { generateKeyPair, sealSession, getSessionTtl, COOKIE_NAMES, authLogger } from "@spfn/auth/server";
-import { env } from "@spfn/core/config";
+
+// src/nextjs/interceptors/cookie-options.ts
+function resolveSecure() {
+  const override = process.env.SPFN_AUTH_COOKIE_SECURE;
+  if (override !== void 0) {
+    return override === "true";
+  }
+  return process.env.NODE_ENV === "production";
+}
+var cookieSecure = resolveSecure();
+
+// src/nextjs/interceptors/login-register.ts
 var loginRegisterInterceptor = {
   pathPattern: /^\/_auth\/(login|register)$/,
   method: "POST",
@@ -54,7 +65,7 @@ var loginRegisterInterceptor = {
         value: sealed,
         options: {
           httpOnly: true,
-          secure: env.NODE_ENV === "production",
+          secure: cookieSecure,
           sameSite: "strict",
           maxAge: ttl,
           path: "/"
@@ -65,7 +76,7 @@ var loginRegisterInterceptor = {
         value: ctx.metadata.keyId,
         options: {
           httpOnly: true,
-          secure: env.NODE_ENV === "production",
+          secure: cookieSecure,
           sameSite: "strict",
           maxAge: ttl,
           path: "/"
@@ -81,7 +92,6 @@ var loginRegisterInterceptor = {
 
 // src/nextjs/interceptors/general-auth.ts
 import { unsealSession, sealSession as sealSession2, shouldRefreshSession, generateClientToken, getSessionTtl as getSessionTtl2, COOKIE_NAMES as COOKIE_NAMES2, authLogger as authLogger2 } from "@spfn/auth/server";
-import { env as env2 } from "@spfn/core/config";
 function requiresAuth(path) {
   const publicPaths = [
     /^\/_auth\/login$/,
@@ -116,7 +126,9 @@ var generalAuthInterceptor = {
       method: ctx.method,
       path: ctx.path,
       hasSession: !!sessionCookie,
-      sessionCookieValue: sessionCookie ? "***EXISTS***" : "NOT_FOUND"
+      sessionLength: sessionCookie?.length ?? 0,
+      sessionPrefix: sessionCookie?.slice(0, 20) ?? "",
+      sessionSuffix: sessionCookie?.slice(-10) ?? ""
     });
     if (!sessionCookie) {
       authLogger2.interceptor.general.debug("No session cookie, proceeding without auth");
@@ -152,8 +164,14 @@ var generalAuthInterceptor = {
       ctx.metadata.sessionValid = true;
     } catch (error) {
       const err = error;
-      if (err.message.includes("expired") || err.message.includes("invalid")) {
-        authLogger2.interceptor.general.warn("Session expired or invalid", { message: err.message });
+      const msg = err.message.toLowerCase();
+      if (msg.includes("expired") || msg.includes("invalid")) {
+        authLogger2.interceptor.general.warn("Session expired or invalid", {
+          message: err.message,
+          cookieLength: sessionCookie.length,
+          cookiePrefix: sessionCookie.slice(0, 20),
+          cookieSuffix: sessionCookie.slice(-10)
+        });
         authLogger2.interceptor.general.debug("Marking session for cleanup");
         ctx.metadata.clearSession = true;
         ctx.metadata.sessionValid = false;
@@ -164,6 +182,21 @@ var generalAuthInterceptor = {
     await next();
   },
   response: async (ctx, next) => {
+    if (ctx.response.status === 401 && ctx.metadata.sessionValid) {
+      authLogger2.interceptor.general.warn("Backend returned 401, clearing session");
+      ctx.setCookies.push({
+        name: COOKIE_NAMES2.SESSION,
+        value: "",
+        options: { maxAge: 0, path: "/" }
+      });
+      ctx.setCookies.push({
+        name: COOKIE_NAMES2.SESSION_KEY_ID,
+        value: "",
+        options: { maxAge: 0, path: "/" }
+      });
+      await next();
+      return;
+    }
     if (ctx.metadata.clearSession) {
       ctx.setCookies.push({
         name: COOKIE_NAMES2.SESSION,
@@ -191,7 +224,7 @@ var generalAuthInterceptor = {
           value: sealed,
           options: {
             httpOnly: true,
-            secure: env2.NODE_ENV === "production",
+            secure: cookieSecure,
             sameSite: "strict",
             maxAge: ttl,
             path: "/"
@@ -202,13 +235,17 @@ var generalAuthInterceptor = {
           value: sessionData.keyId,
           options: {
             httpOnly: true,
-            secure: process.env.NODE_ENV === "production",
+            secure: cookieSecure,
             sameSite: "strict",
             maxAge: ttl,
             path: "/"
           }
         });
-        authLogger2.interceptor.general.info("Session refreshed", { userId: sessionData.userId });
+        authLogger2.interceptor.general.info("Session refreshed", {
+          userId: sessionData.userId,
+          sealedLength: sealed.length,
+          sealedPrefix: sealed.slice(0, 20)
+        });
       } catch (error) {
         const err = error;
         authLogger2.interceptor.general.error("Failed to refresh session", err);
@@ -308,7 +345,7 @@ var keyRotationInterceptor = {
         value: sealed,
         options: {
           httpOnly: true,
-          secure: process.env.NODE_ENV === "production",
+          secure: cookieSecure,
           sameSite: "strict",
           maxAge: ttl,
           path: "/"
@@ -319,7 +356,7 @@ var keyRotationInterceptor = {
         value: ctx.metadata.newKeyId,
         options: {
           httpOnly: true,
-          secure: process.env.NODE_ENV === "production",
+          secure: cookieSecure,
           sameSite: "strict",
           maxAge: ttl,
           path: "/"
@@ -333,10 +370,195 @@ var keyRotationInterceptor = {
   }
 };
 
+// src/nextjs/interceptors/oauth.ts
+import {
+  generateKeyPair as generateKeyPair3,
+  createOAuthState,
+  sealSession as sealSession5,
+  COOKIE_NAMES as COOKIE_NAMES5,
+  getSessionTtl as getSessionTtl5,
+  authLogger as authLogger4
+} from "@spfn/auth/server";
+
+// src/nextjs/session-helpers.ts
+import * as jose from "jose";
+import { cookies } from "next/headers.js";
+import {
+  sealSession as sealSession4,
+  unsealSession as unsealSession3,
+  COOKIE_NAMES as COOKIE_NAMES4,
+  getSessionTtl as getSessionTtl4,
+  parseDuration
+} from "@spfn/auth/server";
+import { env } from "@spfn/auth/config";
+import { logger } from "@spfn/core/logger";
+async function getPendingSessionKey() {
+  const secret = env.SPFN_AUTH_SESSION_SECRET;
+  const encoder = new TextEncoder();
+  const data = encoder.encode(`oauth-pending:${secret}`);
+  const hashBuffer = await crypto.subtle.digest("SHA-256", data);
+  return new Uint8Array(hashBuffer);
+}
+async function sealPendingSession(data, ttl = 600) {
+  const key = await getPendingSessionKey();
+  return await new jose.EncryptJWT({ data }).setProtectedHeader({ alg: "dir", enc: "A256GCM" }).setIssuedAt().setExpirationTime(`${ttl}s`).setIssuer("spfn-auth").setAudience("spfn-oauth").encrypt(key);
+}
+async function unsealPendingSession(jwt) {
+  const key = await getPendingSessionKey();
+  const { payload } = await jose.jwtDecrypt(jwt, key, {
+    issuer: "spfn-auth",
+    audience: "spfn-oauth"
+  });
+  return payload.data;
+}
+
+// src/nextjs/interceptors/oauth.ts
+var oauthUrlInterceptor = {
+  pathPattern: /^\/_auth\/oauth\/\w+\/url$/,
+  method: "POST",
+  request: async (ctx, next) => {
+    const provider = ctx.path.split("/")[3];
+    const returnUrl = ctx.body?.returnUrl || "/";
+    const keyPair = generateKeyPair3("ES256");
+    const state = await createOAuthState({
+      provider,
+      returnUrl,
+      publicKey: keyPair.publicKey,
+      keyId: keyPair.keyId,
+      fingerprint: keyPair.fingerprint,
+      algorithm: keyPair.algorithm
+    });
+    if (!ctx.body) {
+      ctx.body = {};
+    }
+    ctx.body.state = state;
+    ctx.metadata.pendingSession = {
+      privateKey: keyPair.privateKey,
+      keyId: keyPair.keyId,
+      algorithm: keyPair.algorithm
+    };
+    authLogger4.interceptor.oauth?.debug?.("OAuth state created", {
+      provider,
+      keyId: keyPair.keyId
+    });
+    await next();
+  },
+  response: async (ctx, next) => {
+    if (ctx.response.ok && ctx.metadata.pendingSession) {
+      try {
+        const sealed = await sealPendingSession(ctx.metadata.pendingSession);
+        ctx.setCookies.push({
+          name: COOKIE_NAMES5.OAUTH_PENDING,
+          value: sealed,
+          options: {
+            httpOnly: true,
+            secure: cookieSecure,
+            sameSite: "lax",
+            // OAuth 리다이렉트 허용
+            maxAge: 600,
+            // 10분
+            path: "/"
+          }
+        });
+        authLogger4.interceptor.oauth?.debug?.("Pending session cookie set", {
+          keyId: ctx.metadata.pendingSession.keyId
+        });
+      } catch (error) {
+        const err = error;
+        authLogger4.interceptor.oauth?.error?.("Failed to set pending session", err);
+      }
+    }
+    await next();
+  }
+};
+var oauthFinalizeInterceptor = {
+  pathPattern: /^\/_auth\/oauth\/finalize$/,
+  method: "POST",
+  response: async (ctx, next) => {
+    if (!ctx.response.ok) {
+      await next();
+      return;
+    }
+    const pendingCookie = ctx.cookies.get(COOKIE_NAMES5.OAUTH_PENDING);
+    if (!pendingCookie) {
+      authLogger4.interceptor.oauth?.warn?.("No pending session cookie found");
+      await next();
+      return;
+    }
+    try {
+      const pendingSession = await unsealPendingSession(pendingCookie);
+      const { userId, keyId } = ctx.response.body || {};
+      if (!userId || !keyId) {
+        authLogger4.interceptor.oauth?.error?.("Missing userId or keyId in response");
+        await next();
+        return;
+      }
+      if (pendingSession.keyId !== keyId) {
+        authLogger4.interceptor.oauth?.error?.("KeyId mismatch", {
+          expected: pendingSession.keyId,
+          received: keyId
+        });
+        await next();
+        return;
+      }
+      const ttl = getSessionTtl5();
+      const sessionToken = await sealSession5({
+        userId,
+        privateKey: pendingSession.privateKey,
+        keyId: pendingSession.keyId,
+        algorithm: pendingSession.algorithm
+      }, ttl);
+      ctx.setCookies.push({
+        name: COOKIE_NAMES5.SESSION,
+        value: sessionToken,
+        options: {
+          httpOnly: true,
+          secure: cookieSecure,
+          sameSite: "strict",
+          maxAge: ttl,
+          path: "/"
+        }
+      });
+      ctx.setCookies.push({
+        name: COOKIE_NAMES5.SESSION_KEY_ID,
+        value: keyId,
+        options: {
+          httpOnly: true,
+          secure: cookieSecure,
+          sameSite: "strict",
+          maxAge: ttl,
+          path: "/"
+        }
+      });
+      ctx.setCookies.push({
+        name: COOKIE_NAMES5.OAUTH_PENDING,
+        value: "",
+        options: {
+          httpOnly: true,
+          secure: cookieSecure,
+          sameSite: "lax",
+          maxAge: 0,
+          path: "/"
+        }
+      });
+      authLogger4.interceptor.oauth?.debug?.("OAuth session finalized", {
+        userId,
+        keyId
+      });
+    } catch (error) {
+      const err = error;
+      authLogger4.interceptor.oauth?.error?.("Failed to finalize OAuth session", err);
+    }
+    await next();
+  }
+};
+
 // src/nextjs/interceptors/index.ts
 var authInterceptors = [
   loginRegisterInterceptor,
   keyRotationInterceptor,
+  oauthUrlInterceptor,
+  oauthFinalizeInterceptor,
   generalAuthInterceptor
 ];
 

package/dist/nextjs/api.js.map

@@ -1 +1 @@
-{"version":3,"sources":["../../src/nextjs/api.ts","../../src/nextjs/interceptors/login-register.ts","../../src/nextjs/interceptors/general-auth.ts","../../src/nextjs/interceptors/key-rotation.ts","../../src/nextjs/interceptors/index.ts"],"sourcesContent":["/**\n * @spfn/auth/adapters/nextjs/api\n *\n * Next.js Adapter for SPFN Auth\n *\n * Provides automatic interceptor registration for seamless auth flow:\n * - Session management (HttpOnly cookies)\n * - JWT generation and signing\n * - Public key encryption\n *\n * @requires next >= 13.0.0\n *\n * @example\n * ```typescript\n * // Just import to auto-register interceptors\n * import '@spfn/auth/nextjs/api';\n * ```\n */\n\n// Re-export interceptors for advanced usage\nimport { registerInterceptors } from \"@spfn/core/nextjs/server\";\nimport { authInterceptors } from './interceptors';\n\n// Auto-register interceptors on import\nregisterInterceptors('auth', authInterceptors);","/**\n * Login/Register Interceptor\n *\n * Automatically handles key generation and session management\n * for login and register endpoints\n */\n\nimport type { InterceptorRule } from '@spfn/core/nextjs';\nimport { generateKeyPair, sealSession, getSessionTtl, COOKIE_NAMES, authLogger } from '@spfn/auth/server';\nimport { env } from '@spfn/core/config';\n\n/**\n * Login and Register Interceptor\n *\n * Request: Generates key pair and adds publicKey to request body\n * Response: Saves privateKey to HttpOnly cookie\n */\nexport const loginRegisterInterceptor: InterceptorRule =\n    {\n        pathPattern: /^\\/_auth\\/(login|register)$/,\n        method: 'POST',\n\n        request: async (ctx, next) =>\n        {\n            // Get old session if exists (for key rotation on login)\n            const oldKeyId = ctx.cookies.get(COOKIE_NAMES.SESSION_KEY_ID);\n\n            // Extract remember option from request body (if provided)\n            const remember = ctx.body?.remember;\n\n            // Generate new key pair\n            const keyPair = generateKeyPair('ES256');\n\n            // Add publicKey data to request body\n            if (!ctx.body)\n            {\n                ctx.body = {};\n            }\n\n            ctx.body.publicKey = keyPair.publicKey;\n            ctx.body.keyId = keyPair.keyId;\n            ctx.body.fingerprint = keyPair.fingerprint;\n            ctx.body.algorithm = keyPair.algorithm;\n            ctx.body.keySize = Buffer.from(keyPair.publicKey, 'base64').length;\n\n            // Add oldKeyId for login (key rotation)\n            if (ctx.path === '/_auth/login' && oldKeyId)\n            {\n                ctx.body.oldKeyId = oldKeyId;\n            }\n\n            // Remove remember from body (not part of contract)\n            delete ctx.body.remember;\n\n            // Store privateKey and remember in metadata for response interceptor\n            ctx.metadata.privateKey = keyPair.privateKey;\n            ctx.metadata.keyId = keyPair.keyId;\n            ctx.metadata.algorithm = keyPair.algorithm;\n            ctx.metadata.remember = remember;\n\n            await next();\n        },\n\n        response: async (ctx, next) =>\n        {\n            // Only process successful responses\n            if (ctx.response.status !== 200)\n            {\n                await next();\n                return;\n            }\n\n            // Handle both wrapped ({ data: { userId } }) and direct ({ userId }) responses\n            const userData = ctx.response.body?.data || ctx.response.body;\n            if (!userData?.userId)\n            {\n                authLogger.interceptor.login.error('No userId in response');\n                await next();\n                return;\n            }\n\n            try\n            {\n                // Get session TTL (priority: runtime > global > env > default)\n                const ttl = getSessionTtl(ctx.metadata.remember);\n\n                // Encrypt session data\n                const sessionData =\n                    {\n                        userId: userData.userId,\n                        privateKey: ctx.metadata.privateKey,\n                        keyId: ctx.metadata.keyId,\n                        algorithm: ctx.metadata.algorithm,\n                    };\n\n                const sealed = await sealSession(sessionData, ttl);\n\n                // Set HttpOnly session cookie\n                ctx.setCookies.push({\n                    name: COOKIE_NAMES.SESSION,\n                    value: sealed,\n                    options: {\n                        httpOnly: true,\n                        secure: env.NODE_ENV === 'production',\n                        sameSite: 'strict',\n                        maxAge: ttl,\n                        path: '/',\n                    },\n                });\n\n                // Set keyId cookie (for oldKeyId lookup)\n                ctx.setCookies.push({\n                    name: COOKIE_NAMES.SESSION_KEY_ID,\n                    value: ctx.metadata.keyId,\n                    options: {\n                        httpOnly: true,\n                        secure: env.NODE_ENV === 'production',\n                        sameSite: 'strict',\n                        maxAge: ttl,\n                        path: '/',\n                    },\n                });\n            }\n            catch (error)\n            {\n                const err = error as Error;\n                authLogger.interceptor.login.error('Failed to save session', err);\n            }\n\n            await next();\n        },\n    };","/**\n * General Authentication Interceptor\n *\n * Handles authentication for all API requests except login/register\n * - Session validation and renewal\n * - JWT generation and signing\n * - Expired session cleanup\n */\n\nimport type { InterceptorRule } from '@spfn/core/nextjs';\nimport { unsealSession, sealSession, shouldRefreshSession, generateClientToken, getSessionTtl, COOKIE_NAMES, authLogger } from '@spfn/auth/server';\nimport { env } from '@spfn/core/config';\n\n/**\n * Check if path requires authentication\n */\nfunction requiresAuth(path: string): boolean\n{\n    // Paths that don't require auth\n    const publicPaths = [\n        /^\\/_auth\\/login$/,\n        /^\\/_auth\\/register$/,\n        /^\\/_auth\\/codes$/,           // Send verification code\n        /^\\/_auth\\/codes\\/verify$/,   // Verify code\n        /^\\/_auth\\/exists$/,           // Check account exists\n    ];\n\n    return !publicPaths.some((pattern) => pattern.test(path));\n}\n\n/**\n * General Authentication Interceptor\n *\n * Applies to all paths except login/register/codes\n * - Validates session\n * - Generates JWT token\n * - Refreshes session if needed\n * - Clears expired sessions\n */\nexport const generalAuthInterceptor: InterceptorRule =\n{\n    pathPattern: '*',  // Match all paths, filter by requiresAuth()\n    method: ['GET', 'POST', 'PUT', 'PATCH', 'DELETE'],\n\n    request: async (ctx, next) =>\n    {\n        // Skip if path doesn't require auth\n        if (!requiresAuth(ctx.path))\n        {\n            authLogger.interceptor.general.debug(`Public path, skipping auth: ${ctx.path}`);\n            await next();\n            return;\n        }\n\n        // Log available cookies\n        const cookieNames = Array.from(ctx.cookies.keys());\n        authLogger.interceptor.general.debug('Available cookies:', {\n            cookieNames,\n            totalCount: cookieNames.length,\n            lookingFor: COOKIE_NAMES.SESSION,\n        });\n\n        const sessionCookie = ctx.cookies.get(COOKIE_NAMES.SESSION);\n\n        authLogger.interceptor.general.debug('Request', {\n            method: ctx.method,\n            path: ctx.path,\n            hasSession: !!sessionCookie,\n            sessionCookieValue: sessionCookie ? '***EXISTS***' : 'NOT_FOUND',\n        });\n\n        // No session cookie\n        if (!sessionCookie)\n        {\n            authLogger.interceptor.general.debug('No session cookie, proceeding without auth');\n            // Let request proceed - server will return 401\n            await next();\n            return;\n        }\n\n        try\n        {\n            // Decrypt and validate session\n            const session = await unsealSession(sessionCookie);\n\n            authLogger.interceptor.general.debug('Session valid', {\n                userId: session.userId,\n                keyId: session.keyId,\n            });\n\n            // Check if session should be refreshed (within 24h of expiry)\n            const needsRefresh = await shouldRefreshSession(sessionCookie, 24);\n\n            if (needsRefresh)\n            {\n                authLogger.interceptor.general.debug('Session needs refresh (within 24h of expiry)');\n                // Mark for session renewal in response interceptor\n                ctx.metadata.refreshSession = true;\n                ctx.metadata.sessionData = session;\n            }\n\n            // Generate JWT token\n            const token = generateClientToken(\n                {\n                    userId: session.userId,\n                    keyId: session.keyId,\n                    timestamp: Date.now(),\n                },\n                session.privateKey,\n                session.algorithm,\n                { expiresIn: '15m' }\n            );\n\n            authLogger.interceptor.general.debug('Generated JWT token (expires in 15m)');\n\n            // Add authentication headers\n            ctx.headers['Authorization'] = `Bearer ${token}`;\n            ctx.headers['X-Key-Id'] = session.keyId;\n\n            // Store session info in metadata\n            ctx.metadata.userId = session.userId;\n            ctx.metadata.sessionValid = true;\n        }\n        catch (error)\n        {\n            const err = error as Error;\n\n            // Session expired or invalid\n            if (err.message.includes('expired') || err.message.includes('invalid'))\n            {\n                authLogger.interceptor.general.warn('Session expired or invalid', { message: err.message });\n                authLogger.interceptor.general.debug('Marking session for cleanup');\n\n                // Mark for cleanup in response interceptor\n                ctx.metadata.clearSession = true;\n                ctx.metadata.sessionValid = false;\n            }\n            else\n            {\n                authLogger.interceptor.general.error('Failed to process session', err);\n            }\n        }\n\n        await next();\n    },\n\n    response: async (ctx, next) =>\n    {\n        // Clear expired/invalid session\n        if (ctx.metadata.clearSession)\n        {\n            ctx.setCookies.push({\n                name: COOKIE_NAMES.SESSION,\n                value: '',\n                options: {\n                    maxAge: 0,\n                    path: '/',\n                },\n            });\n\n            ctx.setCookies.push({\n                name: COOKIE_NAMES.SESSION_KEY_ID,\n                value: '',\n                options: {\n                    maxAge: 0,\n                    path: '/',\n                },\n            });\n        }\n        // Refresh session if needed and request was successful\n        else if (ctx.metadata.refreshSession && ctx.response.status === 200)\n        {\n            try\n            {\n                const sessionData = ctx.metadata.sessionData;\n                const ttl = getSessionTtl();\n\n                // Re-encrypt session with new TTL\n                const sealed = await sealSession(sessionData, ttl);\n\n                // Update session cookie\n                ctx.setCookies.push({\n                    name: COOKIE_NAMES.SESSION,\n                    value: sealed,\n                    options: {\n                        httpOnly: true,\n                        secure: env.NODE_ENV === 'production',\n                        sameSite: 'strict',\n                        maxAge: ttl,\n                        path: '/',\n                    },\n                });\n\n                // Update keyId cookie\n                ctx.setCookies.push({\n                    name: COOKIE_NAMES.SESSION_KEY_ID,\n                    value: sessionData.keyId,\n                    options: {\n                        httpOnly: true,\n                        secure: process.env.NODE_ENV === 'production',\n                        sameSite: 'strict',\n                        maxAge: ttl,\n                        path: '/',\n                    },\n                });\n\n                authLogger.interceptor.general.info('Session refreshed', { userId: sessionData.userId });\n            }\n            catch (error)\n            {\n                const err = error as Error;\n                authLogger.interceptor.general.error('Failed to refresh session', err);\n            }\n        }\n        // Handle logout (clear session)\n        else if (ctx.path === '/_auth/logout' && ctx.response.ok)\n        {\n            ctx.setCookies.push({\n                name: COOKIE_NAMES.SESSION,\n                value: '',\n                options: {\n                    maxAge: 0,\n                    path: '/',\n                },\n            });\n\n            ctx.setCookies.push({\n                name: COOKIE_NAMES.SESSION_KEY_ID,\n                value: '',\n                options: {\n                    maxAge: 0,\n                    path: '/',\n                },\n            });\n        }\n\n        await next();\n    },\n};","/**\n * Key Rotation Interceptor\n *\n * Handles key rotation with new key generation and session update\n */\n\nimport type { InterceptorRule } from '@spfn/core/nextjs';\nimport { generateKeyPair, unsealSession, sealSession, generateClientToken, getSessionTtl, COOKIE_NAMES, authLogger } from '@spfn/auth/server';\n\n/**\n * Key Rotation Interceptor\n *\n * Request: Generates new key pair and adds to body, authenticates with current key\n * Response: Updates session with new privateKey\n */\nexport const keyRotationInterceptor: InterceptorRule =\n{\n    pathPattern: '/_auth/keys/rotate',\n    method: 'POST',\n\n    request: async (ctx, next) =>\n    {\n        const sessionCookie = ctx.cookies.get(COOKIE_NAMES.SESSION);\n\n        if (!sessionCookie)\n        {\n            await next();\n            return;\n        }\n\n        try\n        {\n            // Get current session\n            const currentSession = await unsealSession(sessionCookie);\n\n            // Generate new key pair\n            const newKeyPair = generateKeyPair('ES256');\n\n            // Add new publicKey to request body\n            if (!ctx.body)\n            {\n                ctx.body = {};\n            }\n\n            ctx.body.publicKey = newKeyPair.publicKey;\n            ctx.body.keyId = newKeyPair.keyId;\n            ctx.body.fingerprint = newKeyPair.fingerprint;\n            ctx.body.algorithm = newKeyPair.algorithm;\n            ctx.body.keySize = Buffer.from(newKeyPair.publicKey, 'base64').length;\n\n            console.log('New key generated:', newKeyPair);\n            console.log('publicKey:', newKeyPair.publicKey);\n            console.log('keyId:', newKeyPair.keyId);\n            console.log('fingerprint:', newKeyPair.fingerprint);\n\n            // Authenticate with CURRENT key\n            const token = generateClientToken(\n                {\n                    userId: currentSession.userId,\n                    keyId: currentSession.keyId,\n                    action: 'rotate_key',\n                    timestamp: Date.now(),\n                },\n                currentSession.privateKey,\n                currentSession.algorithm,\n                {expiresIn: '15m'}\n            );\n\n            ctx.headers['Authorization'] = `Bearer ${token}`;\n            ctx.headers['X-Key-Id'] = currentSession.keyId;\n\n            // Store new key and userId in metadata\n            ctx.metadata.newPrivateKey = newKeyPair.privateKey;\n            ctx.metadata.newKeyId = newKeyPair.keyId;\n            ctx.metadata.newAlgorithm = newKeyPair.algorithm;\n            ctx.metadata.userId = currentSession.userId;\n        }\n        catch (error)\n        {\n            const err = error as Error;\n            authLogger.interceptor.keyRotation.error('Failed to prepare key rotation', err);\n        }\n\n        await next();\n    },\n\n    response: async (ctx, next) =>\n    {\n        // Only update session on successful rotation\n        if (ctx.response.status !== 200)\n        {\n            await next();\n            return;\n        }\n\n        if (!ctx.metadata.newPrivateKey || !ctx.metadata.userId)\n        {\n            authLogger.interceptor.keyRotation.error('Missing key rotation metadata');\n            await next();\n            return;\n        }\n\n        try\n        {\n            // Get session TTL\n            const ttl = getSessionTtl();\n\n            // Create new session with rotated key\n            const newSessionData =\n            {\n                userId: ctx.metadata.userId,\n                privateKey: ctx.metadata.newPrivateKey,\n                keyId: ctx.metadata.newKeyId,\n                algorithm: ctx.metadata.newAlgorithm,\n            };\n\n            const sealed = await sealSession(newSessionData, ttl);\n\n            // Update session cookie\n            ctx.setCookies.push({\n                name: COOKIE_NAMES.SESSION,\n                value: sealed,\n                options: {\n                    httpOnly: true,\n                    secure: process.env.NODE_ENV === 'production',\n                    sameSite: 'strict',\n                    maxAge: ttl,\n                    path: '/',\n                },\n            });\n\n            // Update keyId cookie\n            ctx.setCookies.push({\n                name: COOKIE_NAMES.SESSION_KEY_ID,\n                value: ctx.metadata.newKeyId,\n                options: {\n                    httpOnly: true,\n                    secure: process.env.NODE_ENV === 'production',\n                    sameSite: 'strict',\n                    maxAge: ttl,\n                    path: '/',\n                },\n            });\n        }\n        catch (error)\n        {\n            const err = error as Error;\n            authLogger.interceptor.keyRotation.error('Failed to update session after rotation', err);\n        }\n\n        await next();\n    },\n};","/**\n * Auth Interceptors for Next.js Proxy\n *\n * Automatically registers interceptors for authentication flow\n *\n * Order matters - more specific interceptors first:\n * 1. loginRegisterInterceptor - Most specific (login/register only)\n * 2. keyRotationInterceptor - Specific (key rotation only)\n * 3. generalAuthInterceptor - General (all authenticated requests)\n */\n\nimport { loginRegisterInterceptor } from './login-register';\nimport { generalAuthInterceptor } from './general-auth';\nimport { keyRotationInterceptor } from './key-rotation';\n\n/**\n * All auth interceptors\n *\n * Execution order:\n * 1. loginRegisterInterceptor - Handles login/register (key generation + session save)\n * 2. keyRotationInterceptor - Handles key rotation (new key generation + session update)\n * 3. generalAuthInterceptor - Handles all authenticated requests (session validation + JWT injection + session renewal)\n */\nexport const authInterceptors = [\n    loginRegisterInterceptor,\n    keyRotationInterceptor,\n    generalAuthInterceptor,\n];\n\nexport { loginRegisterInterceptor } from './login-register';\nexport { generalAuthInterceptor } from './general-auth';\nexport { keyRotationInterceptor } from './key-rotation';\n\n// Deprecated: use generalAuthInterceptor instead\nexport { generalAuthInterceptor as authenticationInterceptor };"],"mappings":";AAoBA,SAAS,4BAA4B;;;ACZrC,SAAS,iBAAiB,aAAa,eAAe,cAAc,kBAAkB;AACtF,SAAS,WAAW;AAQb,IAAM,2BACT;AAAA,EACI,aAAa;AAAA,EACb,QAAQ;AAAA,EAER,SAAS,OAAO,KAAK,SACrB;AAEI,UAAM,WAAW,IAAI,QAAQ,IAAI,aAAa,cAAc;AAG5D,UAAM,WAAW,IAAI,MAAM;AAG3B,UAAM,UAAU,gBAAgB,OAAO;AAGvC,QAAI,CAAC,IAAI,MACT;AACI,UAAI,OAAO,CAAC;AAAA,IAChB;AAEA,QAAI,KAAK,YAAY,QAAQ;AAC7B,QAAI,KAAK,QAAQ,QAAQ;AACzB,QAAI,KAAK,cAAc,QAAQ;AAC/B,QAAI,KAAK,YAAY,QAAQ;AAC7B,QAAI,KAAK,UAAU,OAAO,KAAK,QAAQ,WAAW,QAAQ,EAAE;AAG5D,QAAI,IAAI,SAAS,kBAAkB,UACnC;AACI,UAAI,KAAK,WAAW;AAAA,IACxB;AAGA,WAAO,IAAI,KAAK;AAGhB,QAAI,SAAS,aAAa,QAAQ;AAClC,QAAI,SAAS,QAAQ,QAAQ;AAC7B,QAAI,SAAS,YAAY,QAAQ;AACjC,QAAI,SAAS,WAAW;AAExB,UAAM,KAAK;AAAA,EACf;AAAA,EAEA,UAAU,OAAO,KAAK,SACtB;AAEI,QAAI,IAAI,SAAS,WAAW,KAC5B;AACI,YAAM,KAAK;AACX;AAAA,IACJ;AAGA,UAAM,WAAW,IAAI,SAAS,MAAM,QAAQ,IAAI,SAAS;AACzD,QAAI,CAAC,UAAU,QACf;AACI,iBAAW,YAAY,MAAM,MAAM,uBAAuB;AAC1D,YAAM,KAAK;AACX;AAAA,IACJ;AAEA,QACA;AAEI,YAAM,MAAM,cAAc,IAAI,SAAS,QAAQ;AAG/C,YAAM,cACF;AAAA,QACI,QAAQ,SAAS;AAAA,QACjB,YAAY,IAAI,SAAS;AAAA,QACzB,OAAO,IAAI,SAAS;AAAA,QACpB,WAAW,IAAI,SAAS;AAAA,MAC5B;AAEJ,YAAM,SAAS,MAAM,YAAY,aAAa,GAAG;AAGjD,UAAI,WAAW,KAAK;AAAA,QAChB,MAAM,aAAa;AAAA,QACnB,OAAO;AAAA,QACP,SAAS;AAAA,UACL,UAAU;AAAA,UACV,QAAQ,IAAI,aAAa;AAAA,UACzB,UAAU;AAAA,UACV,QAAQ;AAAA,UACR,MAAM;AAAA,QACV;AAAA,MACJ,CAAC;AAGD,UAAI,WAAW,KAAK;AAAA,QAChB,MAAM,aAAa;AAAA,QACnB,OAAO,IAAI,SAAS;AAAA,QACpB,SAAS;AAAA,UACL,UAAU;AAAA,UACV,QAAQ,IAAI,aAAa;AAAA,UACzB,UAAU;AAAA,UACV,QAAQ;AAAA,UACR,MAAM;AAAA,QACV;AAAA,MACJ,CAAC;AAAA,IACL,SACO,OACP;AACI,YAAM,MAAM;AACZ,iBAAW,YAAY,MAAM,MAAM,0BAA0B,GAAG;AAAA,IACpE;AAEA,UAAM,KAAK;AAAA,EACf;AACJ;;;ACzHJ,SAAS,eAAe,eAAAA,cAAa,sBAAsB,qBAAqB,iBAAAC,gBAAe,gBAAAC,eAAc,cAAAC,mBAAkB;AAC/H,SAAS,OAAAC,YAAW;AAKpB,SAAS,aAAa,MACtB;AAEI,QAAM,cAAc;AAAA,IAChB;AAAA,IACA;AAAA,IACA;AAAA;AAAA,IACA;AAAA;AAAA,IACA;AAAA;AAAA,EACJ;AAEA,SAAO,CAAC,YAAY,KAAK,CAAC,YAAY,QAAQ,KAAK,IAAI,CAAC;AAC5D;AAWO,IAAM,yBACb;AAAA,EACI,aAAa;AAAA;AAAA,EACb,QAAQ,CAAC,OAAO,QAAQ,OAAO,SAAS,QAAQ;AAAA,EAEhD,SAAS,OAAO,KAAK,SACrB;AAEI,QAAI,CAAC,aAAa,IAAI,IAAI,GAC1B;AACI,MAAAD,YAAW,YAAY,QAAQ,MAAM,+BAA+B,IAAI,IAAI,EAAE;AAC9E,YAAM,KAAK;AACX;AAAA,IACJ;AAGA,UAAM,cAAc,MAAM,KAAK,IAAI,QAAQ,KAAK,CAAC;AACjD,IAAAA,YAAW,YAAY,QAAQ,MAAM,sBAAsB;AAAA,MACvD;AAAA,MACA,YAAY,YAAY;AAAA,MACxB,YAAYD,cAAa;AAAA,IAC7B,CAAC;AAED,UAAM,gBAAgB,IAAI,QAAQ,IAAIA,cAAa,OAAO;AAE1D,IAAAC,YAAW,YAAY,QAAQ,MAAM,WAAW;AAAA,MAC5C,QAAQ,IAAI;AAAA,MACZ,MAAM,IAAI;AAAA,MACV,YAAY,CAAC,CAAC;AAAA,MACd,oBAAoB,gBAAgB,iBAAiB;AAAA,IACzD,CAAC;AAGD,QAAI,CAAC,eACL;AACI,MAAAA,YAAW,YAAY,QAAQ,MAAM,4CAA4C;AAEjF,YAAM,KAAK;AACX;AAAA,IACJ;AAEA,QACA;AAEI,YAAM,UAAU,MAAM,cAAc,aAAa;AAEjD,MAAAA,YAAW,YAAY,QAAQ,MAAM,iBAAiB;AAAA,QAClD,QAAQ,QAAQ;AAAA,QAChB,OAAO,QAAQ;AAAA,MACnB,CAAC;AAGD,YAAM,eAAe,MAAM,qBAAqB,eAAe,EAAE;AAEjE,UAAI,cACJ;AACI,QAAAA,YAAW,YAAY,QAAQ,MAAM,8CAA8C;AAEnF,YAAI,SAAS,iBAAiB;AAC9B,YAAI,SAAS,cAAc;AAAA,MAC/B;AAGA,YAAM,QAAQ;AAAA,QACV;AAAA,UACI,QAAQ,QAAQ;AAAA,UAChB,OAAO,QAAQ;AAAA,UACf,WAAW,KAAK,IAAI;AAAA,QACxB;AAAA,QACA,QAAQ;AAAA,QACR,QAAQ;AAAA,QACR,EAAE,WAAW,MAAM;AAAA,MACvB;AAEA,MAAAA,YAAW,YAAY,QAAQ,MAAM,sCAAsC;AAG3E,UAAI,QAAQ,eAAe,IAAI,UAAU,KAAK;AAC9C,UAAI,QAAQ,UAAU,IAAI,QAAQ;AAGlC,UAAI,SAAS,SAAS,QAAQ;AAC9B,UAAI,SAAS,eAAe;AAAA,IAChC,SACO,OACP;AACI,YAAM,MAAM;AAGZ,UAAI,IAAI,QAAQ,SAAS,SAAS,KAAK,IAAI,QAAQ,SAAS,SAAS,GACrE;AACI,QAAAA,YAAW,YAAY,QAAQ,KAAK,8BAA8B,EAAE,SAAS,IAAI,QAAQ,CAAC;AAC1F,QAAAA,YAAW,YAAY,QAAQ,MAAM,6BAA6B;AAGlE,YAAI,SAAS,eAAe;AAC5B,YAAI,SAAS,eAAe;AAAA,MAChC,OAEA;AACI,QAAAA,YAAW,YAAY,QAAQ,MAAM,6BAA6B,GAAG;AAAA,MACzE;AAAA,IACJ;AAEA,UAAM,KAAK;AAAA,EACf;AAAA,EAEA,UAAU,OAAO,KAAK,SACtB;AAEI,QAAI,IAAI,SAAS,cACjB;AACI,UAAI,WAAW,KAAK;AAAA,QAChB,MAAMD,cAAa;AAAA,QACnB,OAAO;AAAA,QACP,SAAS;AAAA,UACL,QAAQ;AAAA,UACR,MAAM;AAAA,QACV;AAAA,MACJ,CAAC;AAED,UAAI,WAAW,KAAK;AAAA,QAChB,MAAMA,cAAa;AAAA,QACnB,OAAO;AAAA,QACP,SAAS;AAAA,UACL,QAAQ;AAAA,UACR,MAAM;AAAA,QACV;AAAA,MACJ,CAAC;AAAA,IACL,WAES,IAAI,SAAS,kBAAkB,IAAI,SAAS,WAAW,KAChE;AACI,UACA;AACI,cAAM,cAAc,IAAI,SAAS;AACjC,cAAM,MAAMD,eAAc;AAG1B,cAAM,SAAS,MAAMD,aAAY,aAAa,GAAG;AAGjD,YAAI,WAAW,KAAK;AAAA,UAChB,MAAME,cAAa;AAAA,UACnB,OAAO;AAAA,UACP,SAAS;AAAA,YACL,UAAU;AAAA,YACV,QAAQE,KAAI,aAAa;AAAA,YACzB,UAAU;AAAA,YACV,QAAQ;AAAA,YACR,MAAM;AAAA,UACV;AAAA,QACJ,CAAC;AAGD,YAAI,WAAW,KAAK;AAAA,UAChB,MAAMF,cAAa;AAAA,UACnB,OAAO,YAAY;AAAA,UACnB,SAAS;AAAA,YACL,UAAU;AAAA,YACV,QAAQ,QAAQ,IAAI,aAAa;AAAA,YACjC,UAAU;AAAA,YACV,QAAQ;AAAA,YACR,MAAM;AAAA,UACV;AAAA,QACJ,CAAC;AAED,QAAAC,YAAW,YAAY,QAAQ,KAAK,qBAAqB,EAAE,QAAQ,YAAY,OAAO,CAAC;AAAA,MAC3F,SACO,OACP;AACI,cAAM,MAAM;AACZ,QAAAA,YAAW,YAAY,QAAQ,MAAM,6BAA6B,GAAG;AAAA,MACzE;AAAA,IACJ,WAES,IAAI,SAAS,mBAAmB,IAAI,SAAS,IACtD;AACI,UAAI,WAAW,KAAK;AAAA,QAChB,MAAMD,cAAa;AAAA,QACnB,OAAO;AAAA,QACP,SAAS;AAAA,UACL,QAAQ;AAAA,UACR,MAAM;AAAA,QACV;AAAA,MACJ,CAAC;AAED,UAAI,WAAW,KAAK;AAAA,QAChB,MAAMA,cAAa;AAAA,QACnB,OAAO;AAAA,QACP,SAAS;AAAA,UACL,QAAQ;AAAA,UACR,MAAM;AAAA,QACV;AAAA,MACJ,CAAC;AAAA,IACL;AAEA,UAAM,KAAK;AAAA,EACf;AACJ;;;ACvOA,SAAS,mBAAAG,kBAAiB,iBAAAC,gBAAe,eAAAC,cAAa,uBAAAC,sBAAqB,iBAAAC,gBAAe,gBAAAC,eAAc,cAAAC,mBAAkB;AAQnH,IAAM,yBACb;AAAA,EACI,aAAa;AAAA,EACb,QAAQ;AAAA,EAER,SAAS,OAAO,KAAK,SACrB;AACI,UAAM,gBAAgB,IAAI,QAAQ,IAAID,cAAa,OAAO;AAE1D,QAAI,CAAC,eACL;AACI,YAAM,KAAK;AACX;AAAA,IACJ;AAEA,QACA;AAEI,YAAM,iBAAiB,MAAMJ,eAAc,aAAa;AAGxD,YAAM,aAAaD,iBAAgB,OAAO;AAG1C,UAAI,CAAC,IAAI,MACT;AACI,YAAI,OAAO,CAAC;AAAA,MAChB;AAEA,UAAI,KAAK,YAAY,WAAW;AAChC,UAAI,KAAK,QAAQ,WAAW;AAC5B,UAAI,KAAK,cAAc,WAAW;AAClC,UAAI,KAAK,YAAY,WAAW;AAChC,UAAI,KAAK,UAAU,OAAO,KAAK,WAAW,WAAW,QAAQ,EAAE;AAE/D,cAAQ,IAAI,sBAAsB,UAAU;AAC5C,cAAQ,IAAI,cAAc,WAAW,SAAS;AAC9C,cAAQ,IAAI,UAAU,WAAW,KAAK;AACtC,cAAQ,IAAI,gBAAgB,WAAW,WAAW;AAGlD,YAAM,QAAQG;AAAA,QACV;AAAA,UACI,QAAQ,eAAe;AAAA,UACvB,OAAO,eAAe;AAAA,UACtB,QAAQ;AAAA,UACR,WAAW,KAAK,IAAI;AAAA,QACxB;AAAA,QACA,eAAe;AAAA,QACf,eAAe;AAAA,QACf,EAAC,WAAW,MAAK;AAAA,MACrB;AAEA,UAAI,QAAQ,eAAe,IAAI,UAAU,KAAK;AAC9C,UAAI,QAAQ,UAAU,IAAI,eAAe;AAGzC,UAAI,SAAS,gBAAgB,WAAW;AACxC,UAAI,SAAS,WAAW,WAAW;AACnC,UAAI,SAAS,eAAe,WAAW;AACvC,UAAI,SAAS,SAAS,eAAe;AAAA,IACzC,SACO,OACP;AACI,YAAM,MAAM;AACZ,MAAAG,YAAW,YAAY,YAAY,MAAM,kCAAkC,GAAG;AAAA,IAClF;AAEA,UAAM,KAAK;AAAA,EACf;AAAA,EAEA,UAAU,OAAO,KAAK,SACtB;AAEI,QAAI,IAAI,SAAS,WAAW,KAC5B;AACI,YAAM,KAAK;AACX;AAAA,IACJ;AAEA,QAAI,CAAC,IAAI,SAAS,iBAAiB,CAAC,IAAI,SAAS,QACjD;AACI,MAAAA,YAAW,YAAY,YAAY,MAAM,+BAA+B;AACxE,YAAM,KAAK;AACX;AAAA,IACJ;AAEA,QACA;AAEI,YAAM,MAAMF,eAAc;AAG1B,YAAM,iBACN;AAAA,QACI,QAAQ,IAAI,SAAS;AAAA,QACrB,YAAY,IAAI,SAAS;AAAA,QACzB,OAAO,IAAI,SAAS;AAAA,QACpB,WAAW,IAAI,SAAS;AAAA,MAC5B;AAEA,YAAM,SAAS,MAAMF,aAAY,gBAAgB,GAAG;AAGpD,UAAI,WAAW,KAAK;AAAA,QAChB,MAAMG,cAAa;AAAA,QACnB,OAAO;AAAA,QACP,SAAS;AAAA,UACL,UAAU;AAAA,UACV,QAAQ,QAAQ,IAAI,aAAa;AAAA,UACjC,UAAU;AAAA,UACV,QAAQ;AAAA,UACR,MAAM;AAAA,QACV;AAAA,MACJ,CAAC;AAGD,UAAI,WAAW,KAAK;AAAA,QAChB,MAAMA,cAAa;AAAA,QACnB,OAAO,IAAI,SAAS;AAAA,QACpB,SAAS;AAAA,UACL,UAAU;AAAA,UACV,QAAQ,QAAQ,IAAI,aAAa;AAAA,UACjC,UAAU;AAAA,UACV,QAAQ;AAAA,UACR,MAAM;AAAA,QACV;AAAA,MACJ,CAAC;AAAA,IACL,SACO,OACP;AACI,YAAM,MAAM;AACZ,MAAAC,YAAW,YAAY,YAAY,MAAM,2CAA2C,GAAG;AAAA,IAC3F;AAEA,UAAM,KAAK;AAAA,EACf;AACJ;;;ACjIO,IAAM,mBAAmB;AAAA,EAC5B;AAAA,EACA;AAAA,EACA;AACJ;;;AJHA,qBAAqB,QAAQ,gBAAgB;","names":["sealSession","getSessionTtl","COOKIE_NAMES","authLogger","env","generateKeyPair","unsealSession","sealSession","generateClientToken","getSessionTtl","COOKIE_NAMES","authLogger"]}
+{"version":3,"sources":["../../src/nextjs/api.ts","../../src/nextjs/interceptors/login-register.ts","../../src/nextjs/interceptors/cookie-options.ts","../../src/nextjs/interceptors/general-auth.ts","../../src/nextjs/interceptors/key-rotation.ts","../../src/nextjs/interceptors/oauth.ts","../../src/nextjs/session-helpers.ts","../../src/nextjs/interceptors/index.ts"],"sourcesContent":["/**\n * @spfn/auth/adapters/nextjs/api\n *\n * Next.js Adapter for SPFN Auth\n *\n * Provides automatic interceptor registration for seamless auth flow:\n * - Session management (HttpOnly cookies)\n * - JWT generation and signing\n * - Public key encryption\n *\n * @requires next >= 13.0.0\n *\n * @example\n * ```typescript\n * // Just import to auto-register interceptors\n * import '@spfn/auth/nextjs/api';\n * ```\n */\n\n// Re-export interceptors for advanced usage\nimport { registerInterceptors } from \"@spfn/core/nextjs/server\";\nimport { authInterceptors } from './interceptors';\n\n// Auto-register interceptors on import\nregisterInterceptors('auth', authInterceptors);","/**\n * Login/Register Interceptor\n *\n * Automatically handles key generation and session management\n * for login and register endpoints\n */\n\nimport type { InterceptorRule } from '@spfn/core/nextjs/server';\nimport { generateKeyPair, sealSession, getSessionTtl, COOKIE_NAMES, authLogger } from '@spfn/auth/server';\nimport { cookieSecure } from './cookie-options';\n\n/**\n * Login and Register Interceptor\n *\n * Request: Generates key pair and adds publicKey to request body\n * Response: Saves privateKey to HttpOnly cookie\n */\nexport const loginRegisterInterceptor: InterceptorRule =\n    {\n        pathPattern: /^\\/_auth\\/(login|register)$/,\n        method: 'POST',\n\n        request: async (ctx, next) =>\n        {\n            // Get old session if exists (for key rotation on login)\n            const oldKeyId = ctx.cookies.get(COOKIE_NAMES.SESSION_KEY_ID);\n\n            // Extract remember option from request body (if provided)\n            const remember = ctx.body?.remember;\n\n            // Generate new key pair\n            const keyPair = generateKeyPair('ES256');\n\n            // Add publicKey data to request body\n            if (!ctx.body)\n            {\n                ctx.body = {};\n            }\n\n            ctx.body.publicKey = keyPair.publicKey;\n            ctx.body.keyId = keyPair.keyId;\n            ctx.body.fingerprint = keyPair.fingerprint;\n            ctx.body.algorithm = keyPair.algorithm;\n            ctx.body.keySize = Buffer.from(keyPair.publicKey, 'base64').length;\n\n            // Add oldKeyId for login (key rotation)\n            if (ctx.path === '/_auth/login' && oldKeyId)\n            {\n                ctx.body.oldKeyId = oldKeyId;\n            }\n\n            // Remove remember from body (not part of contract)\n            delete ctx.body.remember;\n\n            // Store privateKey and remember in metadata for response interceptor\n            ctx.metadata.privateKey = keyPair.privateKey;\n            ctx.metadata.keyId = keyPair.keyId;\n            ctx.metadata.algorithm = keyPair.algorithm;\n            ctx.metadata.remember = remember;\n\n            await next();\n        },\n\n        response: async (ctx, next) =>\n        {\n            // Only process successful responses\n            if (ctx.response.status !== 200)\n            {\n                await next();\n                return;\n            }\n\n            // Handle both wrapped ({ data: { userId } }) and direct ({ userId }) responses\n            const userData = ctx.response.body?.data || ctx.response.body;\n            if (!userData?.userId)\n            {\n                authLogger.interceptor.login.error('No userId in response');\n                await next();\n                return;\n            }\n\n            try\n            {\n                // Get session TTL (priority: runtime > global > env > default)\n                const ttl = getSessionTtl(ctx.metadata.remember);\n\n                // Encrypt session data\n                const sessionData =\n                    {\n                        userId: userData.userId,\n                        privateKey: ctx.metadata.privateKey,\n                        keyId: ctx.metadata.keyId,\n                        algorithm: ctx.metadata.algorithm,\n                    };\n\n                const sealed = await sealSession(sessionData, ttl);\n\n                // Set HttpOnly session cookie\n                ctx.setCookies.push({\n                    name: COOKIE_NAMES.SESSION,\n                    value: sealed,\n                    options: {\n                        httpOnly: true,\n                        secure: cookieSecure,\n                        sameSite: 'strict',\n                        maxAge: ttl,\n                        path: '/',\n                    },\n                });\n\n                // Set keyId cookie (for oldKeyId lookup)\n                ctx.setCookies.push({\n                    name: COOKIE_NAMES.SESSION_KEY_ID,\n                    value: ctx.metadata.keyId,\n                    options: {\n                        httpOnly: true,\n                        secure: cookieSecure,\n                        sameSite: 'strict',\n                        maxAge: ttl,\n                        path: '/',\n                    },\n                });\n            }\n            catch (error)\n            {\n                const err = error as Error;\n                authLogger.interceptor.login.error('Failed to save session', err);\n            }\n\n            await next();\n        },\n    };","/**\n * Shared cookie option helpers for auth interceptors\n *\n * SPFN_AUTH_COOKIE_SECURE env var allows overriding the Secure flag.\n * - unset: defaults to NODE_ENV === 'production'\n * - \"true\" / \"false\": explicit override\n *\n * Useful for HTTP-only staging environments (e.g. bastion over plain HTTP).\n */\n\n/**\n * Resolve whether cookies should have the Secure flag.\n *\n * Priority:\n * 1. SPFN_AUTH_COOKIE_SECURE (explicit override)\n * 2. NODE_ENV === 'production'\n */\nfunction resolveSecure(): boolean\n{\n    const override = process.env.SPFN_AUTH_COOKIE_SECURE;\n\n    if (override !== undefined)\n    {\n        return override === 'true';\n    }\n\n    return process.env.NODE_ENV === 'production';\n}\n\n/**\n * Whether cookies should have the Secure flag.\n * Evaluated once at module load time.\n */\nexport const cookieSecure = resolveSecure();\n","/**\n * General Authentication Interceptor\n *\n * Handles authentication for all API requests except login/register\n * - Session validation and renewal\n * - JWT generation and signing\n * - Expired session cleanup\n */\n\nimport type { InterceptorRule } from '@spfn/core/nextjs/server';\nimport { unsealSession, sealSession, shouldRefreshSession, generateClientToken, getSessionTtl, COOKIE_NAMES, authLogger } from '@spfn/auth/server';\nimport { cookieSecure } from './cookie-options';\n\n/**\n * Check if path requires authentication\n */\nfunction requiresAuth(path: string): boolean\n{\n    // Paths that don't require auth\n    const publicPaths = [\n        /^\\/_auth\\/login$/,\n        /^\\/_auth\\/register$/,\n        /^\\/_auth\\/codes$/,           // Send verification code\n        /^\\/_auth\\/codes\\/verify$/,   // Verify code\n        /^\\/_auth\\/exists$/,           // Check account exists\n    ];\n\n    return !publicPaths.some((pattern) => pattern.test(path));\n}\n\n/**\n * General Authentication Interceptor\n *\n * Applies to all paths except login/register/codes\n * - Validates session\n * - Generates JWT token\n * - Refreshes session if needed\n * - Clears expired sessions\n */\nexport const generalAuthInterceptor: InterceptorRule =\n{\n    pathPattern: '*',  // Match all paths, filter by requiresAuth()\n    method: ['GET', 'POST', 'PUT', 'PATCH', 'DELETE'],\n\n    request: async (ctx, next) =>\n    {\n        // Skip if path doesn't require auth\n        if (!requiresAuth(ctx.path))\n        {\n            authLogger.interceptor.general.debug(`Public path, skipping auth: ${ctx.path}`);\n            await next();\n            return;\n        }\n\n        // Log available cookies\n        const cookieNames = Array.from(ctx.cookies.keys());\n        authLogger.interceptor.general.debug('Available cookies:', {\n            cookieNames,\n            totalCount: cookieNames.length,\n            lookingFor: COOKIE_NAMES.SESSION,\n        });\n\n        const sessionCookie = ctx.cookies.get(COOKIE_NAMES.SESSION);\n\n        authLogger.interceptor.general.debug('Request', {\n            method: ctx.method,\n            path: ctx.path,\n            hasSession: !!sessionCookie,\n            sessionLength: sessionCookie?.length ?? 0,\n            sessionPrefix: sessionCookie?.slice(0, 20) ?? '',\n            sessionSuffix: sessionCookie?.slice(-10) ?? '',\n        });\n\n        // No session cookie\n        if (!sessionCookie)\n        {\n            authLogger.interceptor.general.debug('No session cookie, proceeding without auth');\n            // Let request proceed - server will return 401\n            await next();\n            return;\n        }\n\n        try\n        {\n            // Decrypt and validate session\n            const session = await unsealSession(sessionCookie);\n\n            authLogger.interceptor.general.debug('Session valid', {\n                userId: session.userId,\n                keyId: session.keyId,\n            });\n\n            // Check if session should be refreshed (within 24h of expiry)\n            const needsRefresh = await shouldRefreshSession(sessionCookie, 24);\n\n            if (needsRefresh)\n            {\n                authLogger.interceptor.general.debug('Session needs refresh (within 24h of expiry)');\n                // Mark for session renewal in response interceptor\n                ctx.metadata.refreshSession = true;\n                ctx.metadata.sessionData = session;\n            }\n\n            // Generate JWT token\n            const token = generateClientToken(\n                {\n                    userId: session.userId,\n                    keyId: session.keyId,\n                    timestamp: Date.now(),\n                },\n                session.privateKey,\n                session.algorithm,\n                { expiresIn: '15m' }\n            );\n\n            authLogger.interceptor.general.debug('Generated JWT token (expires in 15m)');\n\n            // Add authentication headers\n            ctx.headers['Authorization'] = `Bearer ${token}`;\n            ctx.headers['X-Key-Id'] = session.keyId;\n\n            // Store session info in metadata\n            ctx.metadata.userId = session.userId;\n            ctx.metadata.sessionValid = true;\n        }\n        catch (error)\n        {\n            const err = error as Error;\n            const msg = err.message.toLowerCase();\n\n            // Session expired or invalid\n            if (msg.includes('expired') || msg.includes('invalid'))\n            {\n                authLogger.interceptor.general.warn('Session expired or invalid', {\n                    message: err.message,\n                    cookieLength: sessionCookie.length,\n                    cookiePrefix: sessionCookie.slice(0, 20),\n                    cookieSuffix: sessionCookie.slice(-10),\n                });\n                authLogger.interceptor.general.debug('Marking session for cleanup');\n\n                // Mark for cleanup in response interceptor\n                ctx.metadata.clearSession = true;\n                ctx.metadata.sessionValid = false;\n            }\n            else\n            {\n                authLogger.interceptor.general.error('Failed to process session', err);\n            }\n        }\n\n        await next();\n    },\n\n    response: async (ctx, next) =>\n    {\n        // Backend returned 401 with a valid session — server rejected it\n        if (ctx.response.status === 401 && ctx.metadata.sessionValid)\n        {\n            authLogger.interceptor.general.warn('Backend returned 401, clearing session');\n\n            ctx.setCookies.push({\n                name: COOKIE_NAMES.SESSION,\n                value: '',\n                options: { maxAge: 0, path: '/' },\n            });\n\n            ctx.setCookies.push({\n                name: COOKIE_NAMES.SESSION_KEY_ID,\n                value: '',\n                options: { maxAge: 0, path: '/' },\n            });\n\n            await next();\n            return;\n        }\n\n        // Clear expired/invalid session\n        if (ctx.metadata.clearSession)\n        {\n            ctx.setCookies.push({\n                name: COOKIE_NAMES.SESSION,\n                value: '',\n                options: {\n                    maxAge: 0,\n                    path: '/',\n                },\n            });\n\n            ctx.setCookies.push({\n                name: COOKIE_NAMES.SESSION_KEY_ID,\n                value: '',\n                options: {\n                    maxAge: 0,\n                    path: '/',\n                },\n            });\n        }\n        // Refresh session if needed and request was successful\n        else if (ctx.metadata.refreshSession && ctx.response.status === 200)\n        {\n            try\n            {\n                const sessionData = ctx.metadata.sessionData;\n                const ttl = getSessionTtl();\n\n                // Re-encrypt session with new TTL\n                const sealed = await sealSession(sessionData, ttl);\n\n                // Update session cookie\n                ctx.setCookies.push({\n                    name: COOKIE_NAMES.SESSION,\n                    value: sealed,\n                    options: {\n                        httpOnly: true,\n                        secure: cookieSecure,\n                        sameSite: 'strict',\n                        maxAge: ttl,\n                        path: '/',\n                    },\n                });\n\n                // Update keyId cookie\n                ctx.setCookies.push({\n                    name: COOKIE_NAMES.SESSION_KEY_ID,\n                    value: sessionData.keyId,\n                    options: {\n                        httpOnly: true,\n                        secure: cookieSecure,\n                        sameSite: 'strict',\n                        maxAge: ttl,\n                        path: '/',\n                    },\n                });\n\n                authLogger.interceptor.general.info('Session refreshed', {\n                    userId: sessionData.userId,\n                    sealedLength: sealed.length,\n                    sealedPrefix: sealed.slice(0, 20),\n                });\n            }\n            catch (error)\n            {\n                const err = error as Error;\n                authLogger.interceptor.general.error('Failed to refresh session', err);\n            }\n        }\n        // Handle logout (clear session)\n        else if (ctx.path === '/_auth/logout' && ctx.response.ok)\n        {\n            ctx.setCookies.push({\n                name: COOKIE_NAMES.SESSION,\n                value: '',\n                options: {\n                    maxAge: 0,\n                    path: '/',\n                },\n            });\n\n            ctx.setCookies.push({\n                name: COOKIE_NAMES.SESSION_KEY_ID,\n                value: '',\n                options: {\n                    maxAge: 0,\n                    path: '/',\n                },\n            });\n        }\n\n        await next();\n    },\n};","/**\n * Key Rotation Interceptor\n *\n * Handles key rotation with new key generation and session update\n */\n\nimport type { InterceptorRule } from '@spfn/core/nextjs/server';\nimport { generateKeyPair, unsealSession, sealSession, generateClientToken, getSessionTtl, COOKIE_NAMES, authLogger } from '@spfn/auth/server';\nimport { cookieSecure } from './cookie-options';\n\n/**\n * Key Rotation Interceptor\n *\n * Request: Generates new key pair and adds to body, authenticates with current key\n * Response: Updates session with new privateKey\n */\nexport const keyRotationInterceptor: InterceptorRule =\n{\n    pathPattern: '/_auth/keys/rotate',\n    method: 'POST',\n\n    request: async (ctx, next) =>\n    {\n        const sessionCookie = ctx.cookies.get(COOKIE_NAMES.SESSION);\n\n        if (!sessionCookie)\n        {\n            await next();\n            return;\n        }\n\n        try\n        {\n            // Get current session\n            const currentSession = await unsealSession(sessionCookie);\n\n            // Generate new key pair\n            const newKeyPair = generateKeyPair('ES256');\n\n            // Add new publicKey to request body\n            if (!ctx.body)\n            {\n                ctx.body = {};\n            }\n\n            ctx.body.publicKey = newKeyPair.publicKey;\n            ctx.body.keyId = newKeyPair.keyId;\n            ctx.body.fingerprint = newKeyPair.fingerprint;\n            ctx.body.algorithm = newKeyPair.algorithm;\n            ctx.body.keySize = Buffer.from(newKeyPair.publicKey, 'base64').length;\n\n            console.log('New key generated:', newKeyPair);\n            console.log('publicKey:', newKeyPair.publicKey);\n            console.log('keyId:', newKeyPair.keyId);\n            console.log('fingerprint:', newKeyPair.fingerprint);\n\n            // Authenticate with CURRENT key\n            const token = generateClientToken(\n                {\n                    userId: currentSession.userId,\n                    keyId: currentSession.keyId,\n                    action: 'rotate_key',\n                    timestamp: Date.now(),\n                },\n                currentSession.privateKey,\n                currentSession.algorithm,\n                {expiresIn: '15m'}\n            );\n\n            ctx.headers['Authorization'] = `Bearer ${token}`;\n            ctx.headers['X-Key-Id'] = currentSession.keyId;\n\n            // Store new key and userId in metadata\n            ctx.metadata.newPrivateKey = newKeyPair.privateKey;\n            ctx.metadata.newKeyId = newKeyPair.keyId;\n            ctx.metadata.newAlgorithm = newKeyPair.algorithm;\n            ctx.metadata.userId = currentSession.userId;\n        }\n        catch (error)\n        {\n            const err = error as Error;\n            authLogger.interceptor.keyRotation.error('Failed to prepare key rotation', err);\n        }\n\n        await next();\n    },\n\n    response: async (ctx, next) =>\n    {\n        // Only update session on successful rotation\n        if (ctx.response.status !== 200)\n        {\n            await next();\n            return;\n        }\n\n        if (!ctx.metadata.newPrivateKey || !ctx.metadata.userId)\n        {\n            authLogger.interceptor.keyRotation.error('Missing key rotation metadata');\n            await next();\n            return;\n        }\n\n        try\n        {\n            // Get session TTL\n            const ttl = getSessionTtl();\n\n            // Create new session with rotated key\n            const newSessionData =\n            {\n                userId: ctx.metadata.userId,\n                privateKey: ctx.metadata.newPrivateKey,\n                keyId: ctx.metadata.newKeyId,\n                algorithm: ctx.metadata.newAlgorithm,\n            };\n\n            const sealed = await sealSession(newSessionData, ttl);\n\n            // Update session cookie\n            ctx.setCookies.push({\n                name: COOKIE_NAMES.SESSION,\n                value: sealed,\n                options: {\n                    httpOnly: true,\n                    secure: cookieSecure,\n                    sameSite: 'strict',\n                    maxAge: ttl,\n                    path: '/',\n                },\n            });\n\n            // Update keyId cookie\n            ctx.setCookies.push({\n                name: COOKIE_NAMES.SESSION_KEY_ID,\n                value: ctx.metadata.newKeyId,\n                options: {\n                    httpOnly: true,\n                    secure: cookieSecure,\n                    sameSite: 'strict',\n                    maxAge: ttl,\n                    path: '/',\n                },\n            });\n        }\n        catch (error)\n        {\n            const err = error as Error;\n            authLogger.interceptor.keyRotation.error('Failed to update session after rotation', err);\n        }\n\n        await next();\n    },\n};","/**\n * OAuth Interceptors\n *\n * 1. oauthUrlInterceptor: OAuth URL 요청 시 키쌍 생성 및 state 주입\n * 2. oauthFinalizeInterceptor: OAuth 완료 시 pending session에서 세션 저장\n */\n\nimport type { InterceptorRule } from '@spfn/core/nextjs/server';\nimport {\n    generateKeyPair,\n    createOAuthState,\n    sealSession,\n    COOKIE_NAMES,\n    getSessionTtl,\n    authLogger,\n} from '@spfn/auth/server';\nimport { sealPendingSession, unsealPendingSession } from '../session-helpers';\nimport { cookieSecure } from './cookie-options';\n\n/**\n * OAuth URL Interceptor\n *\n * POST /_auth/oauth/:provider/url 요청을 가로채서\n * 키쌍 생성 및 state 주입 처리\n */\nexport const oauthUrlInterceptor: InterceptorRule = {\n    pathPattern: /^\\/_auth\\/oauth\\/\\w+\\/url$/,\n    method: 'POST',\n\n    request: async (ctx, next) =>\n    {\n        const provider = ctx.path.split('/')[3]; // google, github, etc.\n        const returnUrl = ctx.body?.returnUrl || '/';\n\n        // 키쌍 생성\n        const keyPair = generateKeyPair('ES256');\n\n        // state 생성 (publicKey 포함)\n        const state = await createOAuthState({\n            provider,\n            returnUrl,\n            publicKey: keyPair.publicKey,\n            keyId: keyPair.keyId,\n            fingerprint: keyPair.fingerprint,\n            algorithm: keyPair.algorithm,\n        });\n\n        // body에 state 주입\n        if (!ctx.body)\n        {\n            ctx.body = {};\n        }\n        ctx.body.state = state;\n\n        // pending session 저장용 metadata\n        ctx.metadata.pendingSession = {\n            privateKey: keyPair.privateKey,\n            keyId: keyPair.keyId,\n            algorithm: keyPair.algorithm,\n        };\n\n        authLogger.interceptor.oauth?.debug?.('OAuth state created', {\n            provider,\n            keyId: keyPair.keyId,\n        });\n\n        await next();\n    },\n\n    response: async (ctx, next) =>\n    {\n        // 성공 응답이고 pending session이 있으면 쿠키 설정\n        if (ctx.response.ok && ctx.metadata.pendingSession)\n        {\n            try\n            {\n                const sealed = await sealPendingSession(ctx.metadata.pendingSession);\n\n                ctx.setCookies.push({\n                    name: COOKIE_NAMES.OAUTH_PENDING,\n                    value: sealed,\n                    options: {\n                        httpOnly: true,\n                        secure: cookieSecure,\n                        sameSite: 'lax', // OAuth 리다이렉트 허용\n                        maxAge: 600, // 10분\n                        path: '/',\n                    },\n                });\n\n                authLogger.interceptor.oauth?.debug?.('Pending session cookie set', {\n                    keyId: ctx.metadata.pendingSession.keyId,\n                });\n            }\n            catch (error)\n            {\n                const err = error as Error;\n                authLogger.interceptor.oauth?.error?.('Failed to set pending session', err);\n            }\n        }\n\n        await next();\n    },\n};\n\n/**\n * OAuth Finalize Interceptor\n *\n * POST /_auth/oauth/finalize 요청을 가로채서\n * pending session에서 세션 저장\n */\nexport const oauthFinalizeInterceptor: InterceptorRule = {\n    pathPattern: /^\\/_auth\\/oauth\\/finalize$/,\n    method: 'POST',\n\n    response: async (ctx, next) =>\n    {\n        // 성공 응답일 때만 처리\n        if (!ctx.response.ok)\n        {\n            await next();\n            return;\n        }\n\n        const pendingCookie = ctx.cookies.get(COOKIE_NAMES.OAUTH_PENDING);\n        if (!pendingCookie)\n        {\n            authLogger.interceptor.oauth?.warn?.('No pending session cookie found');\n            await next();\n            return;\n        }\n\n        try\n        {\n            // pending session에서 privateKey 복원\n            const pendingSession = await unsealPendingSession(pendingCookie);\n\n            // body에서 userId, keyId 추출\n            const { userId, keyId } = ctx.response.body || {};\n\n            if (!userId || !keyId)\n            {\n                authLogger.interceptor.oauth?.error?.('Missing userId or keyId in response');\n                await next();\n                return;\n            }\n\n            // keyId 일치 확인\n            if (pendingSession.keyId !== keyId)\n            {\n                authLogger.interceptor.oauth?.error?.('KeyId mismatch', {\n                    expected: pendingSession.keyId,\n                    received: keyId,\n                });\n                await next();\n                return;\n            }\n\n            // 세션 생성\n            const ttl = getSessionTtl();\n            const sessionToken = await sealSession({\n                userId,\n                privateKey: pendingSession.privateKey,\n                keyId: pendingSession.keyId,\n                algorithm: pendingSession.algorithm,\n            }, ttl);\n\n            // 세션 쿠키 설정\n            ctx.setCookies.push({\n                name: COOKIE_NAMES.SESSION,\n                value: sessionToken,\n                options: {\n                    httpOnly: true,\n                    secure: cookieSecure,\n                    sameSite: 'strict',\n                    maxAge: ttl,\n                    path: '/',\n                },\n            });\n\n            // keyId 쿠키 설정\n            ctx.setCookies.push({\n                name: COOKIE_NAMES.SESSION_KEY_ID,\n                value: keyId,\n                options: {\n                    httpOnly: true,\n                    secure: cookieSecure,\n                    sameSite: 'strict',\n                    maxAge: ttl,\n                    path: '/',\n                },\n            });\n\n            // pending session 쿠키 삭제 (maxAge: 0)\n            ctx.setCookies.push({\n                name: COOKIE_NAMES.OAUTH_PENDING,\n                value: '',\n                options: {\n                    httpOnly: true,\n                    secure: cookieSecure,\n                    sameSite: 'lax',\n                    maxAge: 0,\n                    path: '/',\n                },\n            });\n\n            authLogger.interceptor.oauth?.debug?.('OAuth session finalized', {\n                userId,\n                keyId,\n            });\n        }\n        catch (error)\n        {\n            const err = error as Error;\n            authLogger.interceptor.oauth?.error?.('Failed to finalize OAuth session', err);\n        }\n\n        await next();\n    },\n};\n","/**\n * Session helpers for Next.js\n *\n * Server-side only (uses next/headers)\n */\n\nimport * as jose from 'jose';\nimport { cookies } from 'next/headers.js';\nimport {\n    sealSession,\n    unsealSession,\n    COOKIE_NAMES,\n    getSessionTtl,\n    parseDuration,\n    type SessionData,\n    type KeyAlgorithmType,\n} from '@spfn/auth/server';\nimport { env } from '@spfn/auth/config';\nimport { logger } from '@spfn/core/logger';\n\nexport type { SessionData };\n\n/**\n * Pending OAuth session data (before user ID is known)\n */\nexport interface PendingSessionData\n{\n    privateKey: string;\n    keyId: string;\n    algorithm: KeyAlgorithmType;\n}\n\n/**\n * Public session information (excludes sensitive data)\n */\nexport interface PublicSession\n{\n    /** User ID */\n    userId: string;\n}\n\n/**\n * Options for saveSession\n */\nexport interface SaveSessionOptions\n{\n    /**\n     * Session TTL (time to live)\n     *\n     * Supports:\n     * - Number: seconds (e.g., 2592000)\n     * - String: duration format ('30d', '12h', '45m', '3600s')\n     *\n     * If not provided, uses global configuration:\n     * 1. Global config (configureAuth)\n     * 2. Environment variable (SPFN_AUTH_SESSION_TTL)\n     * 3. Default (7d)\n     */\n    maxAge?: number | string;\n\n    /**\n     * Remember me option\n     *\n     * When true, uses extended session duration (if configured)\n     */\n    remember?: boolean;\n}\n\n/**\n * Save session to HttpOnly cookie\n *\n * @param data - Session data to save\n * @param options - Session options (maxAge, remember)\n *\n * @example\n * ```typescript\n * // Use global configuration\n * await saveSession(sessionData);\n *\n * // Custom TTL with duration string\n * await saveSession(sessionData, { maxAge: '30d' });\n *\n * // Custom TTL in seconds\n * await saveSession(sessionData, { maxAge: 2592000 });\n *\n * // Remember me\n * await saveSession(sessionData, { remember: true });\n * ```\n */\nexport async function saveSession(\n    data: SessionData,\n    options?: SaveSessionOptions\n): Promise<void>\n{\n    // Calculate maxAge\n    let maxAge: number;\n\n    if (options?.maxAge !== undefined)\n    {\n        // Custom maxAge provided\n        maxAge = typeof options.maxAge === 'number'\n            ? options.maxAge\n            : parseDuration(options.maxAge);\n    }\n    else\n    {\n        // Use getSessionTtl for consistent configuration\n        maxAge = getSessionTtl();\n    }\n\n    const token = await sealSession(data, maxAge);\n    const cookieStore = await cookies();\n\n    cookieStore.set(COOKIE_NAMES.SESSION, token, {\n        httpOnly: true,\n        secure: process.env.NODE_ENV === 'production',\n        sameSite: 'strict',\n        path: '/',\n        maxAge\n    });\n}\n\n/**\n * Get session from HttpOnly cookie\n *\n * Returns public session info only (excludes privateKey, algorithm, keyId)\n */\nexport async function getSession(): Promise<PublicSession | null>\n{\n    const cookieStore = await cookies();\n    const sessionCookie = cookieStore.get(COOKIE_NAMES.SESSION);\n\n    if (!sessionCookie)\n    {\n        return null;\n    }\n\n    try\n    {\n        logger.debug('Validating session cookie', { cookie: sessionCookie.value });\n        const session = await unsealSession(sessionCookie.value);\n        // Return only public information\n        return {\n            userId: session.userId,\n        };\n    }\n    catch (error)\n    {\n        // Session expired or invalid\n        // Note: Cannot delete cookies in Server Components (read-only)\n        // Use validateSessionMiddleware() in Next.js middleware for automatic cleanup\n        logger.debug('Session validation failed', {\n            error: error instanceof Error ? error.message : String(error)\n        });\n\n        return null;\n    }\n}\n\n/**\n * Clear session cookie\n */\nexport async function clearSession(): Promise<void>\n{\n    const cookieStore = await cookies();\n    cookieStore.delete(COOKIE_NAMES.SESSION);\n    cookieStore.delete(COOKIE_NAMES.SESSION_KEY_ID);\n}\n\n// ============================================================================\n// Pending OAuth Session (for OAuth flow)\n// ============================================================================\n\n/**\n * Get encryption key for pending session\n */\nasync function getPendingSessionKey(): Promise<Uint8Array>\n{\n    const secret = env.SPFN_AUTH_SESSION_SECRET;\n    const encoder = new TextEncoder();\n    const data = encoder.encode(`oauth-pending:${secret}`);\n    const hashBuffer = await crypto.subtle.digest('SHA-256', data);\n    return new Uint8Array(hashBuffer);\n}\n\n/**\n * Seal pending session data (for OAuth flow)\n *\n * @param data - Pending session data (privateKey, keyId, algorithm)\n * @param ttl - Time to live in seconds (default: 10 minutes)\n */\nexport async function sealPendingSession(\n    data: PendingSessionData,\n    ttl: number = 600\n): Promise<string>\n{\n    const key = await getPendingSessionKey();\n\n    return await new jose.EncryptJWT({ data })\n        .setProtectedHeader({ alg: 'dir', enc: 'A256GCM' })\n        .setIssuedAt()\n        .setExpirationTime(`${ttl}s`)\n        .setIssuer('spfn-auth')\n        .setAudience('spfn-oauth')\n        .encrypt(key);\n}\n\n/**\n * Unseal pending session data\n *\n * @param jwt - Encrypted pending session token\n */\nexport async function unsealPendingSession(jwt: string): Promise<PendingSessionData>\n{\n    const key = await getPendingSessionKey();\n\n    const { payload } = await jose.jwtDecrypt(jwt, key, {\n        issuer: 'spfn-auth',\n        audience: 'spfn-oauth',\n    });\n\n    return payload.data as PendingSessionData;\n}\n\n/**\n * Get pending session from cookie\n */\nexport async function getPendingSession(): Promise<PendingSessionData | null>\n{\n    const cookieStore = await cookies();\n    const pendingCookie = cookieStore.get(COOKIE_NAMES.OAUTH_PENDING);\n\n    if (!pendingCookie)\n    {\n        return null;\n    }\n\n    try\n    {\n        return await unsealPendingSession(pendingCookie.value);\n    }\n    catch (error)\n    {\n        logger.debug('Pending session validation failed', {\n            error: error instanceof Error ? error.message : String(error),\n        });\n        return null;\n    }\n}\n\n/**\n * Clear pending session cookie\n */\nexport async function clearPendingSession(): Promise<void>\n{\n    const cookieStore = await cookies();\n    cookieStore.delete(COOKIE_NAMES.OAUTH_PENDING);\n}\n","/**\n * Auth Interceptors for Next.js Proxy\n *\n * Automatically registers interceptors for authentication flow\n *\n * Order matters - more specific interceptors first:\n * 1. loginRegisterInterceptor - Most specific (login/register only)\n * 2. keyRotationInterceptor - Specific (key rotation only)\n * 3. oauthUrlInterceptor - OAuth URL generation (key generation + state injection)\n * 4. generalAuthInterceptor - General (all authenticated requests)\n */\n\nimport { loginRegisterInterceptor } from './login-register';\nimport { generalAuthInterceptor } from './general-auth';\nimport { keyRotationInterceptor } from './key-rotation';\nimport { oauthUrlInterceptor, oauthFinalizeInterceptor } from './oauth';\n\n/**\n * All auth interceptors\n *\n * Execution order:\n * 1. loginRegisterInterceptor - Handles login/register (key generation + session save)\n * 2. keyRotationInterceptor - Handles key rotation (new key generation + session update)\n * 3. oauthUrlInterceptor - Handles OAuth URL requests (key generation + state injection + pending session)\n * 4. oauthFinalizeInterceptor - Handles OAuth finalize (pending session → full session)\n * 5. generalAuthInterceptor - Handles all authenticated requests (session validation + JWT injection + session renewal)\n */\nexport const authInterceptors = [\n    loginRegisterInterceptor,\n    keyRotationInterceptor,\n    oauthUrlInterceptor,\n    oauthFinalizeInterceptor,\n    generalAuthInterceptor,\n];\n\nexport { loginRegisterInterceptor } from './login-register';\nexport { generalAuthInterceptor } from './general-auth';\nexport { keyRotationInterceptor } from './key-rotation';\nexport { oauthUrlInterceptor, oauthFinalizeInterceptor } from './oauth';\n\n// Deprecated: use generalAuthInterceptor instead\nexport { generalAuthInterceptor as authenticationInterceptor };"],"mappings":";AAoBA,SAAS,4BAA4B;;;ACZrC,SAAS,iBAAiB,aAAa,eAAe,cAAc,kBAAkB;;;ACStF,SAAS,gBACT;AACI,QAAM,WAAW,QAAQ,IAAI;AAE7B,MAAI,aAAa,QACjB;AACI,WAAO,aAAa;AAAA,EACxB;AAEA,SAAO,QAAQ,IAAI,aAAa;AACpC;AAMO,IAAM,eAAe,cAAc;;;ADhBnC,IAAM,2BACT;AAAA,EACI,aAAa;AAAA,EACb,QAAQ;AAAA,EAER,SAAS,OAAO,KAAK,SACrB;AAEI,UAAM,WAAW,IAAI,QAAQ,IAAI,aAAa,cAAc;AAG5D,UAAM,WAAW,IAAI,MAAM;AAG3B,UAAM,UAAU,gBAAgB,OAAO;AAGvC,QAAI,CAAC,IAAI,MACT;AACI,UAAI,OAAO,CAAC;AAAA,IAChB;AAEA,QAAI,KAAK,YAAY,QAAQ;AAC7B,QAAI,KAAK,QAAQ,QAAQ;AACzB,QAAI,KAAK,cAAc,QAAQ;AAC/B,QAAI,KAAK,YAAY,QAAQ;AAC7B,QAAI,KAAK,UAAU,OAAO,KAAK,QAAQ,WAAW,QAAQ,EAAE;AAG5D,QAAI,IAAI,SAAS,kBAAkB,UACnC;AACI,UAAI,KAAK,WAAW;AAAA,IACxB;AAGA,WAAO,IAAI,KAAK;AAGhB,QAAI,SAAS,aAAa,QAAQ;AAClC,QAAI,SAAS,QAAQ,QAAQ;AAC7B,QAAI,SAAS,YAAY,QAAQ;AACjC,QAAI,SAAS,WAAW;AAExB,UAAM,KAAK;AAAA,EACf;AAAA,EAEA,UAAU,OAAO,KAAK,SACtB;AAEI,QAAI,IAAI,SAAS,WAAW,KAC5B;AACI,YAAM,KAAK;AACX;AAAA,IACJ;AAGA,UAAM,WAAW,IAAI,SAAS,MAAM,QAAQ,IAAI,SAAS;AACzD,QAAI,CAAC,UAAU,QACf;AACI,iBAAW,YAAY,MAAM,MAAM,uBAAuB;AAC1D,YAAM,KAAK;AACX;AAAA,IACJ;AAEA,QACA;AAEI,YAAM,MAAM,cAAc,IAAI,SAAS,QAAQ;AAG/C,YAAM,cACF;AAAA,QACI,QAAQ,SAAS;AAAA,QACjB,YAAY,IAAI,SAAS;AAAA,QACzB,OAAO,IAAI,SAAS;AAAA,QACpB,WAAW,IAAI,SAAS;AAAA,MAC5B;AAEJ,YAAM,SAAS,MAAM,YAAY,aAAa,GAAG;AAGjD,UAAI,WAAW,KAAK;AAAA,QAChB,MAAM,aAAa;AAAA,QACnB,OAAO;AAAA,QACP,SAAS;AAAA,UACL,UAAU;AAAA,UACV,QAAQ;AAAA,UACR,UAAU;AAAA,UACV,QAAQ;AAAA,UACR,MAAM;AAAA,QACV;AAAA,MACJ,CAAC;AAGD,UAAI,WAAW,KAAK;AAAA,QAChB,MAAM,aAAa;AAAA,QACnB,OAAO,IAAI,SAAS;AAAA,QACpB,SAAS;AAAA,UACL,UAAU;AAAA,UACV,QAAQ;AAAA,UACR,UAAU;AAAA,UACV,QAAQ;AAAA,UACR,MAAM;AAAA,QACV;AAAA,MACJ,CAAC;AAAA,IACL,SACO,OACP;AACI,YAAM,MAAM;AACZ,iBAAW,YAAY,MAAM,MAAM,0BAA0B,GAAG;AAAA,IACpE;AAEA,UAAM,KAAK;AAAA,EACf;AACJ;;;AEzHJ,SAAS,eAAe,eAAAA,cAAa,sBAAsB,qBAAqB,iBAAAC,gBAAe,gBAAAC,eAAc,cAAAC,mBAAkB;AAM/H,SAAS,aAAa,MACtB;AAEI,QAAM,cAAc;AAAA,IAChB;AAAA,IACA;AAAA,IACA;AAAA;AAAA,IACA;AAAA;AAAA,IACA;AAAA;AAAA,EACJ;AAEA,SAAO,CAAC,YAAY,KAAK,CAAC,YAAY,QAAQ,KAAK,IAAI,CAAC;AAC5D;AAWO,IAAM,yBACb;AAAA,EACI,aAAa;AAAA;AAAA,EACb,QAAQ,CAAC,OAAO,QAAQ,OAAO,SAAS,QAAQ;AAAA,EAEhD,SAAS,OAAO,KAAK,SACrB;AAEI,QAAI,CAAC,aAAa,IAAI,IAAI,GAC1B;AACI,MAAAC,YAAW,YAAY,QAAQ,MAAM,+BAA+B,IAAI,IAAI,EAAE;AAC9E,YAAM,KAAK;AACX;AAAA,IACJ;AAGA,UAAM,cAAc,MAAM,KAAK,IAAI,QAAQ,KAAK,CAAC;AACjD,IAAAA,YAAW,YAAY,QAAQ,MAAM,sBAAsB;AAAA,MACvD;AAAA,MACA,YAAY,YAAY;AAAA,MACxB,YAAYC,cAAa;AAAA,IAC7B,CAAC;AAED,UAAM,gBAAgB,IAAI,QAAQ,IAAIA,cAAa,OAAO;AAE1D,IAAAD,YAAW,YAAY,QAAQ,MAAM,WAAW;AAAA,MAC5C,QAAQ,IAAI;AAAA,MACZ,MAAM,IAAI;AAAA,MACV,YAAY,CAAC,CAAC;AAAA,MACd,eAAe,eAAe,UAAU;AAAA,MACxC,eAAe,eAAe,MAAM,GAAG,EAAE,KAAK;AAAA,MAC9C,eAAe,eAAe,MAAM,GAAG,KAAK;AAAA,IAChD,CAAC;AAGD,QAAI,CAAC,eACL;AACI,MAAAA,YAAW,YAAY,QAAQ,MAAM,4CAA4C;AAEjF,YAAM,KAAK;AACX;AAAA,IACJ;AAEA,QACA;AAEI,YAAM,UAAU,MAAM,cAAc,aAAa;AAEjD,MAAAA,YAAW,YAAY,QAAQ,MAAM,iBAAiB;AAAA,QAClD,QAAQ,QAAQ;AAAA,QAChB,OAAO,QAAQ;AAAA,MACnB,CAAC;AAGD,YAAM,eAAe,MAAM,qBAAqB,eAAe,EAAE;AAEjE,UAAI,cACJ;AACI,QAAAA,YAAW,YAAY,QAAQ,MAAM,8CAA8C;AAEnF,YAAI,SAAS,iBAAiB;AAC9B,YAAI,SAAS,cAAc;AAAA,MAC/B;AAGA,YAAM,QAAQ;AAAA,QACV;AAAA,UACI,QAAQ,QAAQ;AAAA,UAChB,OAAO,QAAQ;AAAA,UACf,WAAW,KAAK,IAAI;AAAA,QACxB;AAAA,QACA,QAAQ;AAAA,QACR,QAAQ;AAAA,QACR,EAAE,WAAW,MAAM;AAAA,MACvB;AAEA,MAAAA,YAAW,YAAY,QAAQ,MAAM,sCAAsC;AAG3E,UAAI,QAAQ,eAAe,IAAI,UAAU,KAAK;AAC9C,UAAI,QAAQ,UAAU,IAAI,QAAQ;AAGlC,UAAI,SAAS,SAAS,QAAQ;AAC9B,UAAI,SAAS,eAAe;AAAA,IAChC,SACO,OACP;AACI,YAAM,MAAM;AACZ,YAAM,MAAM,IAAI,QAAQ,YAAY;AAGpC,UAAI,IAAI,SAAS,SAAS,KAAK,IAAI,SAAS,SAAS,GACrD;AACI,QAAAA,YAAW,YAAY,QAAQ,KAAK,8BAA8B;AAAA,UAC9D,SAAS,IAAI;AAAA,UACb,cAAc,cAAc;AAAA,UAC5B,cAAc,cAAc,MAAM,GAAG,EAAE;AAAA,UACvC,cAAc,cAAc,MAAM,GAAG;AAAA,QACzC,CAAC;AACD,QAAAA,YAAW,YAAY,QAAQ,MAAM,6BAA6B;AAGlE,YAAI,SAAS,eAAe;AAC5B,YAAI,SAAS,eAAe;AAAA,MAChC,OAEA;AACI,QAAAA,YAAW,YAAY,QAAQ,MAAM,6BAA6B,GAAG;AAAA,MACzE;AAAA,IACJ;AAEA,UAAM,KAAK;AAAA,EACf;AAAA,EAEA,UAAU,OAAO,KAAK,SACtB;AAEI,QAAI,IAAI,SAAS,WAAW,OAAO,IAAI,SAAS,cAChD;AACI,MAAAA,YAAW,YAAY,QAAQ,KAAK,wCAAwC;AAE5E,UAAI,WAAW,KAAK;AAAA,QAChB,MAAMC,cAAa;AAAA,QACnB,OAAO;AAAA,QACP,SAAS,EAAE,QAAQ,GAAG,MAAM,IAAI;AAAA,MACpC,CAAC;AAED,UAAI,WAAW,KAAK;AAAA,QAChB,MAAMA,cAAa;AAAA,QACnB,OAAO;AAAA,QACP,SAAS,EAAE,QAAQ,GAAG,MAAM,IAAI;AAAA,MACpC,CAAC;AAED,YAAM,KAAK;AACX;AAAA,IACJ;AAGA,QAAI,IAAI,SAAS,cACjB;AACI,UAAI,WAAW,KAAK;AAAA,QAChB,MAAMA,cAAa;AAAA,QACnB,OAAO;AAAA,QACP,SAAS;AAAA,UACL,QAAQ;AAAA,UACR,MAAM;AAAA,QACV;AAAA,MACJ,CAAC;AAED,UAAI,WAAW,KAAK;AAAA,QAChB,MAAMA,cAAa;AAAA,QACnB,OAAO;AAAA,QACP,SAAS;AAAA,UACL,QAAQ;AAAA,UACR,MAAM;AAAA,QACV;AAAA,MACJ,CAAC;AAAA,IACL,WAES,IAAI,SAAS,kBAAkB,IAAI,SAAS,WAAW,KAChE;AACI,UACA;AACI,cAAM,cAAc,IAAI,SAAS;AACjC,cAAM,MAAMC,eAAc;AAG1B,cAAM,SAAS,MAAMC,aAAY,aAAa,GAAG;AAGjD,YAAI,WAAW,KAAK;AAAA,UAChB,MAAMF,cAAa;AAAA,UACnB,OAAO;AAAA,UACP,SAAS;AAAA,YACL,UAAU;AAAA,YACV,QAAQ;AAAA,YACR,UAAU;AAAA,YACV,QAAQ;AAAA,YACR,MAAM;AAAA,UACV;AAAA,QACJ,CAAC;AAGD,YAAI,WAAW,KAAK;AAAA,UAChB,MAAMA,cAAa;AAAA,UACnB,OAAO,YAAY;AAAA,UACnB,SAAS;AAAA,YACL,UAAU;AAAA,YACV,QAAQ;AAAA,YACR,UAAU;AAAA,YACV,QAAQ;AAAA,YACR,MAAM;AAAA,UACV;AAAA,QACJ,CAAC;AAED,QAAAD,YAAW,YAAY,QAAQ,KAAK,qBAAqB;AAAA,UACrD,QAAQ,YAAY;AAAA,UACpB,cAAc,OAAO;AAAA,UACrB,cAAc,OAAO,MAAM,GAAG,EAAE;AAAA,QACpC,CAAC;AAAA,MACL,SACO,OACP;AACI,cAAM,MAAM;AACZ,QAAAA,YAAW,YAAY,QAAQ,MAAM,6BAA6B,GAAG;AAAA,MACzE;AAAA,IACJ,WAES,IAAI,SAAS,mBAAmB,IAAI,SAAS,IACtD;AACI,UAAI,WAAW,KAAK;AAAA,QAChB,MAAMC,cAAa;AAAA,QACnB,OAAO;AAAA,QACP,SAAS;AAAA,UACL,QAAQ;AAAA,UACR,MAAM;AAAA,QACV;AAAA,MACJ,CAAC;AAED,UAAI,WAAW,KAAK;AAAA,QAChB,MAAMA,cAAa;AAAA,QACnB,OAAO;AAAA,QACP,SAAS;AAAA,UACL,QAAQ;AAAA,UACR,MAAM;AAAA,QACV;AAAA,MACJ,CAAC;AAAA,IACL;AAEA,UAAM,KAAK;AAAA,EACf;AACJ;;;ACxQA,SAAS,mBAAAG,kBAAiB,iBAAAC,gBAAe,eAAAC,cAAa,uBAAAC,sBAAqB,iBAAAC,gBAAe,gBAAAC,eAAc,cAAAC,mBAAkB;AASnH,IAAM,yBACb;AAAA,EACI,aAAa;AAAA,EACb,QAAQ;AAAA,EAER,SAAS,OAAO,KAAK,SACrB;AACI,UAAM,gBAAgB,IAAI,QAAQ,IAAIC,cAAa,OAAO;AAE1D,QAAI,CAAC,eACL;AACI,YAAM,KAAK;AACX;AAAA,IACJ;AAEA,QACA;AAEI,YAAM,iBAAiB,MAAMC,eAAc,aAAa;AAGxD,YAAM,aAAaC,iBAAgB,OAAO;AAG1C,UAAI,CAAC,IAAI,MACT;AACI,YAAI,OAAO,CAAC;AAAA,MAChB;AAEA,UAAI,KAAK,YAAY,WAAW;AAChC,UAAI,KAAK,QAAQ,WAAW;AAC5B,UAAI,KAAK,cAAc,WAAW;AAClC,UAAI,KAAK,YAAY,WAAW;AAChC,UAAI,KAAK,UAAU,OAAO,KAAK,WAAW,WAAW,QAAQ,EAAE;AAE/D,cAAQ,IAAI,sBAAsB,UAAU;AAC5C,cAAQ,IAAI,cAAc,WAAW,SAAS;AAC9C,cAAQ,IAAI,UAAU,WAAW,KAAK;AACtC,cAAQ,IAAI,gBAAgB,WAAW,WAAW;AAGlD,YAAM,QAAQC;AAAA,QACV;AAAA,UACI,QAAQ,eAAe;AAAA,UACvB,OAAO,eAAe;AAAA,UACtB,QAAQ;AAAA,UACR,WAAW,KAAK,IAAI;AAAA,QACxB;AAAA,QACA,eAAe;AAAA,QACf,eAAe;AAAA,QACf,EAAC,WAAW,MAAK;AAAA,MACrB;AAEA,UAAI,QAAQ,eAAe,IAAI,UAAU,KAAK;AAC9C,UAAI,QAAQ,UAAU,IAAI,eAAe;AAGzC,UAAI,SAAS,gBAAgB,WAAW;AACxC,UAAI,SAAS,WAAW,WAAW;AACnC,UAAI,SAAS,eAAe,WAAW;AACvC,UAAI,SAAS,SAAS,eAAe;AAAA,IACzC,SACO,OACP;AACI,YAAM,MAAM;AACZ,MAAAC,YAAW,YAAY,YAAY,MAAM,kCAAkC,GAAG;AAAA,IAClF;AAEA,UAAM,KAAK;AAAA,EACf;AAAA,EAEA,UAAU,OAAO,KAAK,SACtB;AAEI,QAAI,IAAI,SAAS,WAAW,KAC5B;AACI,YAAM,KAAK;AACX;AAAA,IACJ;AAEA,QAAI,CAAC,IAAI,SAAS,iBAAiB,CAAC,IAAI,SAAS,QACjD;AACI,MAAAA,YAAW,YAAY,YAAY,MAAM,+BAA+B;AACxE,YAAM,KAAK;AACX;AAAA,IACJ;AAEA,QACA;AAEI,YAAM,MAAMC,eAAc;AAG1B,YAAM,iBACN;AAAA,QACI,QAAQ,IAAI,SAAS;AAAA,QACrB,YAAY,IAAI,SAAS;AAAA,QACzB,OAAO,IAAI,SAAS;AAAA,QACpB,WAAW,IAAI,SAAS;AAAA,MAC5B;AAEA,YAAM,SAAS,MAAMC,aAAY,gBAAgB,GAAG;AAGpD,UAAI,WAAW,KAAK;AAAA,QAChB,MAAMN,cAAa;AAAA,QACnB,OAAO;AAAA,QACP,SAAS;AAAA,UACL,UAAU;AAAA,UACV,QAAQ;AAAA,UACR,UAAU;AAAA,UACV,QAAQ;AAAA,UACR,MAAM;AAAA,QACV;AAAA,MACJ,CAAC;AAGD,UAAI,WAAW,KAAK;AAAA,QAChB,MAAMA,cAAa;AAAA,QACnB,OAAO,IAAI,SAAS;AAAA,QACpB,SAAS;AAAA,UACL,UAAU;AAAA,UACV,QAAQ;AAAA,UACR,UAAU;AAAA,UACV,QAAQ;AAAA,UACR,MAAM;AAAA,QACV;AAAA,MACJ,CAAC;AAAA,IACL,SACO,OACP;AACI,YAAM,MAAM;AACZ,MAAAI,YAAW,YAAY,YAAY,MAAM,2CAA2C,GAAG;AAAA,IAC3F;AAEA,UAAM,KAAK;AAAA,EACf;AACJ;;;ACjJA;AAAA,EACI,mBAAAG;AAAA,EACA;AAAA,EACA,eAAAC;AAAA,EACA,gBAAAC;AAAA,EACA,iBAAAC;AAAA,EACA,cAAAC;AAAA,OACG;;;ACTP,YAAY,UAAU;AACtB,SAAS,eAAe;AACxB;AAAA,EACI,eAAAC;AAAA,EACA,iBAAAC;AAAA,EACA,gBAAAC;AAAA,EACA,iBAAAC;AAAA,EACA;AAAA,OAGG;AACP,SAAS,WAAW;AACpB,SAAS,cAAc;AA8JvB,eAAe,uBACf;AACI,QAAM,SAAS,IAAI;AACnB,QAAM,UAAU,IAAI,YAAY;AAChC,QAAM,OAAO,QAAQ,OAAO,iBAAiB,MAAM,EAAE;AACrD,QAAM,aAAa,MAAM,OAAO,OAAO,OAAO,WAAW,IAAI;AAC7D,SAAO,IAAI,WAAW,UAAU;AACpC;AAQA,eAAsB,mBAClB,MACA,MAAc,KAElB;AACI,QAAM,MAAM,MAAM,qBAAqB;AAEvC,SAAO,MAAM,IAAS,gBAAW,EAAE,KAAK,CAAC,EACpC,mBAAmB,EAAE,KAAK,OAAO,KAAK,UAAU,CAAC,EACjD,YAAY,EACZ,kBAAkB,GAAG,GAAG,GAAG,EAC3B,UAAU,WAAW,EACrB,YAAY,YAAY,EACxB,QAAQ,GAAG;AACpB;AAOA,eAAsB,qBAAqB,KAC3C;AACI,QAAM,MAAM,MAAM,qBAAqB;AAEvC,QAAM,EAAE,QAAQ,IAAI,MAAW,gBAAW,KAAK,KAAK;AAAA,IAChD,QAAQ;AAAA,IACR,UAAU;AAAA,EACd,CAAC;AAED,SAAO,QAAQ;AACnB;;;ADrMO,IAAM,sBAAuC;AAAA,EAChD,aAAa;AAAA,EACb,QAAQ;AAAA,EAER,SAAS,OAAO,KAAK,SACrB;AACI,UAAM,WAAW,IAAI,KAAK,MAAM,GAAG,EAAE,CAAC;AACtC,UAAM,YAAY,IAAI,MAAM,aAAa;AAGzC,UAAM,UAAUC,iBAAgB,OAAO;AAGvC,UAAM,QAAQ,MAAM,iBAAiB;AAAA,MACjC;AAAA,MACA;AAAA,MACA,WAAW,QAAQ;AAAA,MACnB,OAAO,QAAQ;AAAA,MACf,aAAa,QAAQ;AAAA,MACrB,WAAW,QAAQ;AAAA,IACvB,CAAC;AAGD,QAAI,CAAC,IAAI,MACT;AACI,UAAI,OAAO,CAAC;AAAA,IAChB;AACA,QAAI,KAAK,QAAQ;AAGjB,QAAI,SAAS,iBAAiB;AAAA,MAC1B,YAAY,QAAQ;AAAA,MACpB,OAAO,QAAQ;AAAA,MACf,WAAW,QAAQ;AAAA,IACvB;AAEA,IAAAC,YAAW,YAAY,OAAO,QAAQ,uBAAuB;AAAA,MACzD;AAAA,MACA,OAAO,QAAQ;AAAA,IACnB,CAAC;AAED,UAAM,KAAK;AAAA,EACf;AAAA,EAEA,UAAU,OAAO,KAAK,SACtB;AAEI,QAAI,IAAI,SAAS,MAAM,IAAI,SAAS,gBACpC;AACI,UACA;AACI,cAAM,SAAS,MAAM,mBAAmB,IAAI,SAAS,cAAc;AAEnE,YAAI,WAAW,KAAK;AAAA,UAChB,MAAMC,cAAa;AAAA,UACnB,OAAO;AAAA,UACP,SAAS;AAAA,YACL,UAAU;AAAA,YACV,QAAQ;AAAA,YACR,UAAU;AAAA;AAAA,YACV,QAAQ;AAAA;AAAA,YACR,MAAM;AAAA,UACV;AAAA,QACJ,CAAC;AAED,QAAAD,YAAW,YAAY,OAAO,QAAQ,8BAA8B;AAAA,UAChE,OAAO,IAAI,SAAS,eAAe;AAAA,QACvC,CAAC;AAAA,MACL,SACO,OACP;AACI,cAAM,MAAM;AACZ,QAAAA,YAAW,YAAY,OAAO,QAAQ,iCAAiC,GAAG;AAAA,MAC9E;AAAA,IACJ;AAEA,UAAM,KAAK;AAAA,EACf;AACJ;AAQO,IAAM,2BAA4C;AAAA,EACrD,aAAa;AAAA,EACb,QAAQ;AAAA,EAER,UAAU,OAAO,KAAK,SACtB;AAEI,QAAI,CAAC,IAAI,SAAS,IAClB;AACI,YAAM,KAAK;AACX;AAAA,IACJ;AAEA,UAAM,gBAAgB,IAAI,QAAQ,IAAIC,cAAa,aAAa;AAChE,QAAI,CAAC,eACL;AACI,MAAAD,YAAW,YAAY,OAAO,OAAO,iCAAiC;AACtE,YAAM,KAAK;AACX;AAAA,IACJ;AAEA,QACA;AAEI,YAAM,iBAAiB,MAAM,qBAAqB,aAAa;AAG/D,YAAM,EAAE,QAAQ,MAAM,IAAI,IAAI,SAAS,QAAQ,CAAC;AAEhD,UAAI,CAAC,UAAU,CAAC,OAChB;AACI,QAAAA,YAAW,YAAY,OAAO,QAAQ,qCAAqC;AAC3E,cAAM,KAAK;AACX;AAAA,MACJ;AAGA,UAAI,eAAe,UAAU,OAC7B;AACI,QAAAA,YAAW,YAAY,OAAO,QAAQ,kBAAkB;AAAA,UACpD,UAAU,eAAe;AAAA,UACzB,UAAU;AAAA,QACd,CAAC;AACD,cAAM,KAAK;AACX;AAAA,MACJ;AAGA,YAAM,MAAME,eAAc;AAC1B,YAAM,eAAe,MAAMC,aAAY;AAAA,QACnC;AAAA,QACA,YAAY,eAAe;AAAA,QAC3B,OAAO,eAAe;AAAA,QACtB,WAAW,eAAe;AAAA,MAC9B,GAAG,GAAG;AAGN,UAAI,WAAW,KAAK;AAAA,QAChB,MAAMF,cAAa;AAAA,QACnB,OAAO;AAAA,QACP,SAAS;AAAA,UACL,UAAU;AAAA,UACV,QAAQ;AAAA,UACR,UAAU;AAAA,UACV,QAAQ;AAAA,UACR,MAAM;AAAA,QACV;AAAA,MACJ,CAAC;AAGD,UAAI,WAAW,KAAK;AAAA,QAChB,MAAMA,cAAa;AAAA,QACnB,OAAO;AAAA,QACP,SAAS;AAAA,UACL,UAAU;AAAA,UACV,QAAQ;AAAA,UACR,UAAU;AAAA,UACV,QAAQ;AAAA,UACR,MAAM;AAAA,QACV;AAAA,MACJ,CAAC;AAGD,UAAI,WAAW,KAAK;AAAA,QAChB,MAAMA,cAAa;AAAA,QACnB,OAAO;AAAA,QACP,SAAS;AAAA,UACL,UAAU;AAAA,UACV,QAAQ;AAAA,UACR,UAAU;AAAA,UACV,QAAQ;AAAA,UACR,MAAM;AAAA,QACV;AAAA,MACJ,CAAC;AAED,MAAAD,YAAW,YAAY,OAAO,QAAQ,2BAA2B;AAAA,QAC7D;AAAA,QACA;AAAA,MACJ,CAAC;AAAA,IACL,SACO,OACP;AACI,YAAM,MAAM;AACZ,MAAAA,YAAW,YAAY,OAAO,QAAQ,oCAAoC,GAAG;AAAA,IACjF;AAEA,UAAM,KAAK;AAAA,EACf;AACJ;;;AEhMO,IAAM,mBAAmB;AAAA,EAC5B;AAAA,EACA;AAAA,EACA;AAAA,EACA;AAAA,EACA;AACJ;;;APTA,qBAAqB,QAAQ,gBAAgB;","names":["sealSession","getSessionTtl","COOKIE_NAMES","authLogger","authLogger","COOKIE_NAMES","getSessionTtl","sealSession","generateKeyPair","unsealSession","sealSession","generateClientToken","getSessionTtl","COOKIE_NAMES","authLogger","COOKIE_NAMES","unsealSession","generateKeyPair","generateClientToken","authLogger","getSessionTtl","sealSession","generateKeyPair","sealSession","COOKIE_NAMES","getSessionTtl","authLogger","sealSession","unsealSession","COOKIE_NAMES","getSessionTtl","generateKeyPair","authLogger","COOKIE_NAMES","getSessionTtl","sealSession"]}

package/dist/nextjs/client.d.ts

@@ -0,0 +1,28 @@
+import * as react_jsx_runtime from 'react/jsx-runtime';
+
+interface OAuthCallbackProps {
+    /**
+     * API base path for RPC calls
+     * @default '/api/rpc'
+     */
+    apiBasePath?: string;
+    /**
+     * Custom loading component
+     */
+    loadingComponent?: React.ReactNode;
+    /**
+     * Custom error component
+     */
+    errorComponent?: (error: string) => React.ReactNode;
+    /**
+     * Callback after successful OAuth
+     */
+    onSuccess?: (userId: string) => void;
+    /**
+     * Callback on error
+     */
+    onError?: (error: string) => void;
+}
+declare function OAuthCallback({ apiBasePath, loadingComponent, errorComponent, onSuccess, onError, }: OAuthCallbackProps): react_jsx_runtime.JSX.Element | null;
+
+export { OAuthCallback, type OAuthCallbackProps };

package/dist/nextjs/client.js

@@ -0,0 +1,80 @@
+'use client';
+
+// src/nextjs/components/oauth-callback.tsx
+import { useEffect, useState } from "react";
+import { Fragment, jsx, jsxs } from "react/jsx-runtime";
+function OAuthCallback({
+  apiBasePath = "/api/rpc",
+  loadingComponent,
+  errorComponent,
+  onSuccess,
+  onError
+}) {
+  const [error, setError] = useState(null);
+  const [isLoading, setIsLoading] = useState(true);
+  useEffect(() => {
+    async function finalizeOAuth() {
+      try {
+        const params = new URLSearchParams(window.location.search);
+        const userId = params.get("userId");
+        const keyId = params.get("keyId");
+        const returnUrl = params.get("returnUrl") || "/";
+        const errorParam = params.get("error");
+        if (errorParam) {
+          throw new Error(errorParam);
+        }
+        if (!userId || !keyId) {
+          throw new Error("Missing required parameters");
+        }
+        const response = await fetch(`${apiBasePath}/oauthFinalize`, {
+          method: "POST",
+          headers: {
+            "Content-Type": "application/json"
+          },
+          credentials: "include",
+          body: JSON.stringify({
+            body: {
+              userId,
+              keyId,
+              returnUrl
+            }
+          })
+        });
+        if (!response.ok) {
+          const data2 = await response.json().catch(() => ({}));
+          throw new Error(data2.message || "Failed to finalize OAuth");
+        }
+        const data = await response.json();
+        onSuccess?.(userId);
+        window.location.href = data.returnUrl || returnUrl;
+      } catch (err) {
+        const message = err instanceof Error ? err.message : "OAuth failed";
+        setError(message);
+        setIsLoading(false);
+        onError?.(message);
+      }
+    }
+    finalizeOAuth();
+  }, [apiBasePath, onSuccess, onError]);
+  if (error) {
+    if (errorComponent) {
+      return /* @__PURE__ */ jsx(Fragment, { children: errorComponent(error) });
+    }
+    return /* @__PURE__ */ jsxs("div", { style: { padding: "20px", textAlign: "center" }, children: [
+      /* @__PURE__ */ jsx("h2", { children: "Authentication Error" }),
+      /* @__PURE__ */ jsx("p", { style: { color: "red" }, children: error }),
+      /* @__PURE__ */ jsx("button", { onClick: () => window.location.href = "/", children: "Go Home" })
+    ] });
+  }
+  if (isLoading) {
+    if (loadingComponent) {
+      return /* @__PURE__ */ jsx(Fragment, { children: loadingComponent });
+    }
+    return /* @__PURE__ */ jsx("div", { style: { padding: "20px", textAlign: "center" }, children: /* @__PURE__ */ jsx("p", { children: "Completing authentication..." }) });
+  }
+  return null;
+}
+export {
+  OAuthCallback
+};
+//# sourceMappingURL=client.js.map

package/dist/nextjs/client.js.map

@@ -0,0 +1 @@
+{"version":3,"sources":["../../src/nextjs/components/oauth-callback.tsx"],"sourcesContent":["'use client';\n\n/**\n * OAuthCallback Component\n *\n * OAuth 콜백 페이지용 클라이언트 컴포넌트\n * URL params에서 userId, keyId를 추출하여 oauthFinalize API 호출 후 returnUrl로 리다이렉트\n *\n * @example\n * ```tsx\n * // app/auth/callback/page.tsx\n * export { OAuthCallback as default } from '@spfn/auth/nextjs/client';\n * ```\n */\n\nimport { useEffect, useState } from 'react';\n\nexport interface OAuthCallbackProps\n{\n    /**\n     * API base path for RPC calls\n     * @default '/api/rpc'\n     */\n    apiBasePath?: string;\n\n    /**\n     * Custom loading component\n     */\n    loadingComponent?: React.ReactNode;\n\n    /**\n     * Custom error component\n     */\n    errorComponent?: (error: string) => React.ReactNode;\n\n    /**\n     * Callback after successful OAuth\n     */\n    onSuccess?: (userId: string) => void;\n\n    /**\n     * Callback on error\n     */\n    onError?: (error: string) => void;\n}\n\nexport function OAuthCallback({\n    apiBasePath = '/api/rpc',\n    loadingComponent,\n    errorComponent,\n    onSuccess,\n    onError,\n}: OAuthCallbackProps)\n{\n    const [error, setError] = useState<string | null>(null);\n    const [isLoading, setIsLoading] = useState(true);\n\n    useEffect(() =>\n    {\n        async function finalizeOAuth()\n        {\n            try\n            {\n                const params = new URLSearchParams(window.location.search);\n                const userId = params.get('userId');\n                const keyId = params.get('keyId');\n                const returnUrl = params.get('returnUrl') || '/';\n                const errorParam = params.get('error');\n\n                // Handle error from backend\n                if (errorParam)\n                {\n                    throw new Error(errorParam);\n                }\n\n                if (!userId || !keyId)\n                {\n                    throw new Error('Missing required parameters');\n                }\n\n                // Call oauthFinalize API\n                const response = await fetch(`${apiBasePath}/oauthFinalize`, {\n                    method: 'POST',\n                    headers: {\n                        'Content-Type': 'application/json',\n                    },\n                    credentials: 'include',\n                    body: JSON.stringify({\n                        body: {\n                            userId,\n                            keyId,\n                            returnUrl,\n                        },\n                    }),\n                });\n\n                if (!response.ok)\n                {\n                    const data = await response.json().catch(() => ({}));\n                    throw new Error(data.message || 'Failed to finalize OAuth');\n                }\n\n                const data = await response.json();\n\n                onSuccess?.(userId);\n\n                // Redirect to returnUrl\n                window.location.href = data.returnUrl || returnUrl;\n            }\n            catch (err)\n            {\n                const message = err instanceof Error ? err.message : 'OAuth failed';\n                setError(message);\n                setIsLoading(false);\n                onError?.(message);\n            }\n        }\n\n        finalizeOAuth();\n    }, [apiBasePath, onSuccess, onError]);\n\n    if (error)\n    {\n        if (errorComponent)\n        {\n            return <>{errorComponent(error)}</>;\n        }\n\n        return (\n            <div style={{ padding: '20px', textAlign: 'center' }}>\n                <h2>Authentication Error</h2>\n                <p style={{ color: 'red' }}>{error}</p>\n                <button onClick={() => window.location.href = '/'}>\n                    Go Home\n                </button>\n            </div>\n        );\n    }\n\n    if (isLoading)\n    {\n        if (loadingComponent)\n        {\n            return <>{loadingComponent}</>;\n        }\n\n        return (\n            <div style={{ padding: '20px', textAlign: 'center' }}>\n                <p>Completing authentication...</p>\n            </div>\n        );\n    }\n\n    return null;\n}\n\nexport default OAuthCallback;\n"],"mappings":";;;AAeA,SAAS,WAAW,gBAAgB;AA8GjB,wBAIP,YAJO;AA/EZ,SAAS,cAAc;AAAA,EAC1B,cAAc;AAAA,EACd;AAAA,EACA;AAAA,EACA;AAAA,EACA;AACJ,GACA;AACI,QAAM,CAAC,OAAO,QAAQ,IAAI,SAAwB,IAAI;AACtD,QAAM,CAAC,WAAW,YAAY,IAAI,SAAS,IAAI;AAE/C,YAAU,MACV;AACI,mBAAe,gBACf;AACI,UACA;AACI,cAAM,SAAS,IAAI,gBAAgB,OAAO,SAAS,MAAM;AACzD,cAAM,SAAS,OAAO,IAAI,QAAQ;AAClC,cAAM,QAAQ,OAAO,IAAI,OAAO;AAChC,cAAM,YAAY,OAAO,IAAI,WAAW,KAAK;AAC7C,cAAM,aAAa,OAAO,IAAI,OAAO;AAGrC,YAAI,YACJ;AACI,gBAAM,IAAI,MAAM,UAAU;AAAA,QAC9B;AAEA,YAAI,CAAC,UAAU,CAAC,OAChB;AACI,gBAAM,IAAI,MAAM,6BAA6B;AAAA,QACjD;AAGA,cAAM,WAAW,MAAM,MAAM,GAAG,WAAW,kBAAkB;AAAA,UACzD,QAAQ;AAAA,UACR,SAAS;AAAA,YACL,gBAAgB;AAAA,UACpB;AAAA,UACA,aAAa;AAAA,UACb,MAAM,KAAK,UAAU;AAAA,YACjB,MAAM;AAAA,cACF;AAAA,cACA;AAAA,cACA;AAAA,YACJ;AAAA,UACJ,CAAC;AAAA,QACL,CAAC;AAED,YAAI,CAAC,SAAS,IACd;AACI,gBAAMA,QAAO,MAAM,SAAS,KAAK,EAAE,MAAM,OAAO,CAAC,EAAE;AACnD,gBAAM,IAAI,MAAMA,MAAK,WAAW,0BAA0B;AAAA,QAC9D;AAEA,cAAM,OAAO,MAAM,SAAS,KAAK;AAEjC,oBAAY,MAAM;AAGlB,eAAO,SAAS,OAAO,KAAK,aAAa;AAAA,MAC7C,SACO,KACP;AACI,cAAM,UAAU,eAAe,QAAQ,IAAI,UAAU;AACrD,iBAAS,OAAO;AAChB,qBAAa,KAAK;AAClB,kBAAU,OAAO;AAAA,MACrB;AAAA,IACJ;AAEA,kBAAc;AAAA,EAClB,GAAG,CAAC,aAAa,WAAW,OAAO,CAAC;AAEpC,MAAI,OACJ;AACI,QAAI,gBACJ;AACI,aAAO,gCAAG,yBAAe,KAAK,GAAE;AAAA,IACpC;AAEA,WACI,qBAAC,SAAI,OAAO,EAAE,SAAS,QAAQ,WAAW,SAAS,GAC/C;AAAA,0BAAC,QAAG,kCAAoB;AAAA,MACxB,oBAAC,OAAE,OAAO,EAAE,OAAO,MAAM,GAAI,iBAAM;AAAA,MACnC,oBAAC,YAAO,SAAS,MAAM,OAAO,SAAS,OAAO,KAAK,qBAEnD;AAAA,OACJ;AAAA,EAER;AAEA,MAAI,WACJ;AACI,QAAI,kBACJ;AACI,aAAO,gCAAG,4BAAiB;AAAA,IAC/B;AAEA,WACI,oBAAC,SAAI,OAAO,EAAE,SAAS,QAAQ,WAAW,SAAS,GAC/C,8BAAC,OAAE,0CAA4B,GACnC;AAAA,EAER;AAEA,SAAO;AACX;","names":["data"]}